StartTime Dur Proto SrcAddr Sport Dir DstAddr Dport State sTos dTos TotPkts TotBytes Label 1970/01/01 01:00:00.000000 0.000000 llc 00:00:00:00:00:00 0 -> 00:00:00:00:00:00 0 INT 1 60 flow=Background 1970/01/01 01:00:08.503194 3.231329 arp 10.0.2.105 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/01 01:00:08.511970 3.004894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:00:08.663135 2.002345 arp 0.0.0.0 who 10.0.2.105 INT 3 126 flow=Background-ARP 1970/01/01 01:00:08.663220 0.000000 ipv6-icmp :: 135 -> ff02::1:ffce:e387 0 NNS 0 1 78 flow=Background 1970/01/01 01:00:08.663249 4.004845 ipv6-icmp fe80::d5e6:502a:54ce:e387 133 -> ff02::2 0 NRS 0 2 140 flow=Background 1970/01/01 01:00:08.663290 0.499976 ipv6-icmp fe80::d5e6:502a:54ce:e387 143 -> ff02::16 0 UNK 0 2 180 flow=Background 1970/01/01 01:00:14.777632 0.000000 udp 10.0.2.105 54576 -> 8.8.8.8 53 INT 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:00:14.787504 0.000125 arp 10.0.2.2 who 10.0.2.105 CON 2 84 flow=Background-ARP 1970/01/01 01:00:15.522645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:15.772761 0.009360 udp 10.0.2.105 54576 <-> 8.8.4.4 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/01 01:00:15.782568 0.009287 udp 10.0.2.105 54373 <-> 8.8.4.4 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/01 01:00:16.664149 0.000000 ipv6-icmp fe80::d5e6:502a:54ce:e387 133 -> ff02::2 0 NRS 0 1 70 flow=Background 1970/01/01 01:00:23.524067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:00:39.526681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:01:11.532798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:05:30.221502 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:05:30.221689 0.084775 udp 10.0.2.105 7010 <-> 213.219.135.125 5172 CON 0 0 8 3110 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:05:30.309349 2.138052 tcp 10.0.2.105 49158 -> 213.219.135.125 3906 FSPA* 0 0 581 429878 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:30.324607 0.000000 udp 10.0.2.105 7010 -> 108.74.172.39 3059 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:38.877819 0.719214 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 7 2616 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:05:39.582229 4.966304 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 SPA_* 0 0 37 20717 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:39.691890 0.000000 udp 10.0.2.105 7010 -> 66.63.204.26 3895 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:44.975056 4.698557 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 56 39080 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:47.530087 0.000000 udp 10.0.2.105 7010 -> 70.48.228.139 3263 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:50.536461 4.875782 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 57 40742 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:05:54.510268 0.422071 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 8 3242 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:05:54.948682 0.000000 udp 10.0.2.105 7010 -> 24.153.166.130 2593 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:05:57.356717 4.982922 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 88 66812 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:02.311403 0.000000 udp 10.0.2.105 7010 -> 68.162.252.216 5281 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:02.555095 3.335019 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 28 14044 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:09.131443 0.000000 udp 10.0.2.105 7010 -> 93.58.184.92 5981 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:11.033090 4.995789 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 143 64926 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:14.688968 0.000000 udp 10.0.2.105 7010 -> 205.174.165.43 6964 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:14.889744 0.000000 tcp 10.0.2.105 49160 -> 46.49.61.109 5202 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 01:06:16.451147 4.997214 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 A_PA 0 0 114 48076 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:21.487889 4.973372 tcp 10.0.2.105 49159 -> 84.59.151.27 3285 FPA_* 0 0 107 47891 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:22.199982 0.000000 udp 10.0.2.105 7010 -> 50.241.153.231 9539 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:29.154051 0.011164 udp 10.0.2.105 61337 <-> 8.8.8.8 53 CON 0 0 2 388 flow=From-Botnet-V2-DNS 1970/01/01 01:06:29.306542 0.234362 tcp 10.0.2.105 49161 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:29.542246 0.021576 udp 10.0.2.105 55632 <-> 8.8.8.8 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/01/01 01:06:29.564248 0.312224 tcp 10.0.2.105 49162 -> 195.113.214.226 80 SRPA* 0 0 76 77357 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:29.951801 0.099150 udp fe80::d5e6:502a:54ce:e387 61410 -> ff02::1:3 5355 INT 0 2 168 flow=Background 1970/01/01 01:06:29.952033 0.099065 udp 10.0.2.105 49999 -> 224.0.0.252 5355 INT 0 2 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:29.952113 0.098985 icmp 10.0.2.2 0x000b -> 10.0.2.105 0x0000 TXD 192 2 184 flow=Background 1970/01/01 01:06:29.985108 0.648485 tcp 10.0.2.105 49163 -> 82.211.142.218 9811 FSA_* 0 0 7 394 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:29.990068 0.045528 tcp 10.0.2.105 49164 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.035937 0.045540 tcp 10.0.2.105 49165 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.082757 0.456129 tcp 10.0.2.105 49166 -> 195.113.214.226 443 SRPA* 0 0 37 24914 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.251516 1.502129 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 01:06:30.579890 0.000000 tcp 10.0.2.105 49167 -> 158.110.22.32 5561 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 01:06:30.581340 0.045885 tcp 10.0.2.105 49168 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.627499 0.092200 tcp 10.0.2.105 49169 -> 195.113.214.226 80 SRPA* 0 0 38 23039 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.728732 0.000000 tcp 10.0.2.105 49170 -> 46.49.61.109 5202 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 01:06:30.728911 0.054721 tcp 10.0.2.105 49171 -> 82.211.142.218 9811 SR_SA 0 0 3 178 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:06:30.729099 0.000000 tcp 10.0.2.105 49172 -> 158.110.22.32 5561 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 01:06:44.897985 0.031622 udp 10.0.2.105 7010 <-> 213.219.135.125 5172 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:06:44.979835 0.383049 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:06:45.342580 0.228914 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:07:15.719897 3.000720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 01:07:22.726376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:30.728106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:07:30.728709 0.000000 tcp 10.0.2.105 49173 -> 46.49.61.109 5202 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 01:07:35.344959 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:07:45.730982 0.045304 tcp 10.0.2.105 49174 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:07:45.776525 0.083276 tcp 10.0.2.105 49175 -> 195.113.214.226 80 SRPA* 0 0 43 42245 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:07:45.871068 0.588399 tcp 10.0.2.105 49176 -> 82.211.142.218 9811 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:07:46.731431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:08:18.737480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:22.743945 3.000852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:14:29.750851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:37.752183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:14:53.755472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:15:25.761391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:29.767576 3.001233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:21:36.774608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:21:44.775907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:00.779498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:22:32.785173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:36.821269 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:28:43.828798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:28:51.830183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:07.832871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:29:39.839545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:43.845082 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:35:50.852714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:35:58.854068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:14.867477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:46.872913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:36:49.046232 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 01:36:49.046504 0.255227 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:36:49.249611 0.032274 udp 10.0.2.105 7010 <-> 213.219.135.125 5172 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:36:49.313829 0.103445 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/01/01 01:37:46.489226 0.609162 tcp 10.0.2.105 49177 -> 82.211.142.218 9811 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/01 01:42:50.878704 3.002348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:42:57.886938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:05.887857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:21.891272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:43:53.897209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:49:57.902636 3.002044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:50:04.910201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:12.912334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:50:28.914992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:51:00.921019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:04.927666 3.000849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 01:57:11.934353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:19.936493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:57:35.938949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 01:58:07.945127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:11.950422 3.002575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:04:18.958264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:26.960105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:04:42.963073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:05:14.968888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:07:08.953511 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:07:08.953722 0.875115 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 14 5396 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:07:09.145380 0.270835 udp 10.0.2.105 7010 <-> 213.219.135.125 5172 CON 0 0 14 5152 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:07:09.187865 0.828977 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 14 5335 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:07:09.996568 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:16.153651 0.000000 udp 10.0.2.105 7010 -> 79.48.54.61 6718 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:23.404182 0.000000 udp 10.0.2.105 7010 -> 79.47.75.100 7013 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:30.724158 0.000000 udp 10.0.2.105 7010 -> 41.75.32.70 1398 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:35.370966 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:07:36.452447 0.000000 udp 10.0.2.105 7010 -> 99.255.163.88 8863 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:45.074869 0.000000 udp 10.0.2.105 7010 -> 182.3.56.214 6135 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:07:47.097879 0.564147 tcp 10.0.2.105 49178 -> 82.211.142.218 9811 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:07:54.078254 0.000000 udp 10.0.2.105 7010 -> 75.149.117.1 5929 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:02.740196 0.000000 udp 10.0.2.105 7010 -> 68.236.156.55 9624 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:09.129276 0.000000 udp 10.0.2.105 7010 -> 97.66.167.193 8017 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:13.875977 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:08:15.218378 0.000000 udp 10.0.2.105 7010 -> 60.49.24.45 7009 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:22.498911 0.000000 udp 10.0.2.105 7010 -> 2.228.154.198 7812 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:30.570345 0.288359 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 8 2912 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:08:31.006284 0.000000 udp 10.0.2.105 7010 -> 92.27.69.67 7636 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:38.591957 0.593057 udp 10.0.2.105 7010 -> 200.11.148.17 7483 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:39.185014 0.000000 icmp 200.11.142.65 0x000b -> 10.0.2.105 0x0000 TXD 192 1 138 flow=Background 1970/01/01 02:08:43.378289 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:08:46.483545 0.000000 udp 10.0.2.105 7010 -> 198.232.70.10 1375 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:08:53.243148 0.000000 udp 10.0.2.105 7010 -> 174.88.84.175 7799 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:00.523723 0.058396 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:09:00.622425 0.153394 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:09:00.784376 0.000000 udp 10.0.2.105 7010 -> 95.232.70.167 5668 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:07.934112 0.000000 udp 10.0.2.105 7010 -> 24.151.45.12 8841 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:12.870968 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:09:15.654986 0.000000 udp 10.0.2.105 7010 -> 64.238.113.233 8475 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:23.025555 0.000000 udp 10.0.2.105 7010 -> 24.116.126.187 2309 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:29.636130 0.000000 udp 10.0.2.105 7010 -> 67.139.85.34 6124 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:37.817312 0.304149 udp 10.0.2.105 7010 -> 221.186.76.232 3578 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:38.121461 0.000000 icmp 221.186.76.232 0x0303 -> 10.0.2.105 0xfa0d URP 192 1 174 flow=Background 1970/01/01 02:09:42.373743 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:09:43.505714 0.000000 udp 10.0.2.105 7010 -> 77.28.234.59 6163 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:51.276220 0.000000 udp 10.0.2.105 7010 -> 95.56.25.237 2162 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:09:56.484108 0.000000 udp 10.0.2.105 7010 -> 79.167.44.32 8574 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:04.295192 0.000000 udp 10.0.2.105 7010 -> 66.229.233.123 9551 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:08.871647 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:10:12.066721 0.000000 udp 10.0.2.105 7010 -> 194.247.232.234 2668 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:17.874495 0.000000 udp 10.0.2.105 7010 -> 79.38.151.102 7612 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:25.515928 0.000000 udp 10.0.2.105 7010 -> 64.68.3.213 2941 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:31.945164 0.000000 udp 10.0.2.105 7010 -> 72.54.247.65 1675 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:36.872094 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:10:38.594365 0.159924 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:10:39.433458 0.000000 udp 10.0.2.105 7010 -> 115.69.247.216 1526 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:47.366985 0.000000 udp 10.0.2.105 7010 -> 87.12.86.16 8637 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:10:55.138140 0.211655 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:10:55.359158 0.135826 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:10:55.502481 0.000000 udp 10.0.2.105 7010 -> 99.240.102.190 3025 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:02.028509 0.184281 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:11:02.228117 0.000000 udp 10.0.2.105 7010 -> 201.164.38.37 2103 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:06.874908 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:11:10.390226 0.000000 udp 10.0.2.105 7010 -> 176.44.95.242 1186 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:18.822247 0.000000 udp 10.0.2.105 7010 -> 47.16.102.87 5657 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:18.974361 3.002087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 02:11:25.982203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:27.324446 0.000000 udp 10.0.2.105 7010 -> 220.246.1.6 1987 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:31.871121 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:11:33.983928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:36.317460 0.000000 udp 10.0.2.105 7010 -> 41.105.20.191 5108 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:43.548410 0.000000 udp 10.0.2.105 7010 -> 24.161.35.53 4282 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:49.717026 0.114917 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:11:49.854594 0.000000 udp 10.0.2.105 7010 -> 79.238.122.149 4082 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:11:49.987267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:11:56.566725 0.000000 udp 10.0.2.105 7010 -> 109.211.80.24 7781 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:01.373669 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:12:01.954035 0.000000 udp 10.0.2.105 7010 -> 186.48.197.173 1024 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:10.556398 0.080117 udp 10.0.2.105 7010 <-> 80.139.128.232 7991 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:12:10.646339 0.000000 udp 10.0.2.105 7010 -> 178.248.69.202 6798 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:18.828377 0.138141 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:12:18.974811 0.000000 udp 10.0.2.105 7010 -> 216.215.82.154 9487 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:21.993087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:12:25.788430 0.000000 udp 10.0.2.105 7010 -> 27.251.78.115 3494 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:30.375133 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:12:31.036544 0.000000 udp 10.0.2.105 7010 -> 176.73.0.7 6909 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:37.455367 0.000000 udp 10.0.2.105 7010 -> 109.226.45.179 1710 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:46.217932 2.400250 udp 10.0.2.105 7010 <-> 176.200.219.107 1324 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:12:48.631711 0.000000 udp 10.0.2.105 7010 -> 95.225.140.48 3546 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:53.899217 0.235654 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:12:54.147310 0.000000 udp 10.0.2.105 7010 -> 83.104.57.70 8399 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:12:58.875758 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:12:59.967773 0.189440 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:00.168988 0.000000 udp 10.0.2.105 7010 -> 95.137.182.238 6865 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:07.769199 0.000000 udp 10.0.2.105 7010 -> 151.33.5.221 7383 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:15.279977 0.000000 udp 10.0.2.105 7010 -> 2.226.222.119 6275 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:21.388634 0.176773 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:21.575875 0.000000 udp 10.0.2.105 7010 -> 66.31.196.189 7028 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:26.375530 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:13:29.490237 0.147155 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:29.699880 0.143722 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 661 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:29.889429 0.000000 udp 10.0.2.105 7010 -> 87.173.154.173 5600 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:38.503135 0.037382 udp 10.0.2.105 7010 <-> 88.75.199.134 1790 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:38.550150 0.202991 udp 10.0.2.105 7010 <-> 117.219.243.210 2439 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:13:38.778066 0.000000 udp 10.0.2.105 7010 -> 2.35.146.131 4205 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:46.725226 0.000000 udp 10.0.2.105 7010 -> 81.44.157.185 3839 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:13:51.371677 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:13:53.374276 0.000000 udp 10.0.2.105 7010 -> 68.4.243.145 8509 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:01.566159 0.000000 udp 10.0.2.105 7010 -> 95.57.176.245 5947 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:10.358730 0.000000 udp 10.0.2.105 7010 -> 46.49.71.57 7029 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:17.168488 0.072179 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:14:17.254527 0.305922 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:14:17.569448 0.000000 udp 10.0.2.105 7010 -> 188.169.212.137 9409 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:21.875578 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:14:26.082028 0.000000 udp 10.0.2.105 7010 -> 188.219.120.143 2766 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:33.622211 0.000000 udp 10.0.2.105 7010 -> 81.182.191.94 2407 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:38.919801 0.000000 udp 10.0.2.105 7010 -> 87.188.187.160 3885 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:45.869904 0.000000 udp 10.0.2.105 7010 -> 161.200.34.16 5040 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:50.376198 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:14:53.741842 0.113877 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:14:53.897597 0.000000 udp 10.0.2.105 7010 -> 24.106.191.250 6547 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:14:58.929024 0.000000 udp 10.0.2.105 7010 -> 79.129.118.199 4038 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:04.707088 0.000000 udp 10.0.2.105 7010 -> 88.96.150.102 3707 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:13.219451 0.000000 udp 10.0.2.105 7010 -> 91.93.236.224 7688 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:17.875981 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:15:19.127603 0.000000 udp 10.0.2.105 7010 -> 120.150.223.37 9148 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:24.786115 0.039989 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:24.836842 0.000000 udp 10.0.2.105 7010 -> 58.136.19.120 6381 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:30.013442 0.000000 udp 10.0.2.105 7010 -> 95.9.190.8 3288 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:38.895884 0.156097 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:39.063830 0.138675 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:39.218442 0.069817 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:39.298094 0.138522 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:39.477730 0.390910 udp 10.0.2.105 7010 <-> 59.95.7.63 6258 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:15:39.885181 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:43.873388 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:15:48.840672 0.000000 udp 10.0.2.105 7010 -> 109.170.225.79 1733 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:15:56.701636 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:02.250359 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1462 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:07.627807 0.000000 udp 10.0.2.105 7010 -> 67.204.244.183 7752 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:12.373905 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:16:13.456376 0.136112 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:16:14.155677 0.000000 udp 10.0.2.105 7010 -> 203.125.218.142 9651 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:20.936487 0.056739 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:16:21.024372 0.000000 udp 10.0.2.105 7010 -> 81.133.46.240 3245 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:27.796576 0.166300 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:16:27.974781 0.000000 udp 10.0.2.105 7010 -> 78.184.234.159 5542 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:34.756507 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:39.372735 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:16:42.517772 0.058278 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:16:42.586914 0.000000 udp 10.0.2.105 7010 -> 24.106.162.198 1493 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:48.155663 0.000000 udp 10.0.2.105 7010 -> 95.224.226.16 4846 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:16:55.386657 0.037150 udp 10.0.2.105 7010 <-> 91.16.147.60 2194 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:16:55.721366 0.000000 udp 10.0.2.105 7010 -> 74.94.253.37 3416 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:04.188549 0.000000 udp 10.0.2.105 7010 -> 176.221.158.108 6350 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:08.875237 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:17:12.761403 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:21.674364 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:27.963133 0.000000 udp 10.0.2.105 7010 -> 110.234.196.42 8132 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:32.879972 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:17:34.592752 0.062974 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:17:34.679709 0.000000 udp 10.0.2.105 7010 -> 80.101.112.254 3017 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:43.595716 0.000000 udp 10.0.2.105 7010 -> 91.42.13.199 3165 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:50.725816 0.000000 udp 10.0.2.105 7010 -> 151.77.0.157 4708 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:17:56.694275 0.000000 udp 10.0.2.105 7010 -> 213.107.116.154 4648 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:01.371007 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:18:03.113732 0.000000 udp 10.0.2.105 7010 -> 122.162.46.152 3307 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:08.291022 0.000000 udp 10.0.2.105 7010 -> 101.109.252.42 2857 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:15.671278 0.084881 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:18:15.773004 0.000000 udp 10.0.2.105 7010 -> 79.15.132.103 4088 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:23.853401 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:25.998592 3.002052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 02:18:28.379605 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:18:29.892347 0.053730 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:18:30.208034 0.091291 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:18:30.411696 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:33.006441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:35.560359 0.062977 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:18:35.672655 0.000000 udp 10.0.2.105 7010 -> 184.60.73.228 4067 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:41.008204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:18:41.749462 0.000000 udp 10.0.2.105 7010 -> 95.241.102.142 6350 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:48.628945 0.000000 udp 10.0.2.105 7010 -> 212.31.230.83 5088 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:53.375617 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:18:56.189807 0.000000 udp 10.0.2.105 7010 -> 2.228.156.203 9167 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:18:57.010586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:19:01.727711 0.000000 udp 10.0.2.105 7010 -> 93.193.154.19 7662 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:06.935311 0.000000 udp 10.0.2.105 7010 -> 65.78.184.122 3317 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:11.992897 0.000000 udp 10.0.2.105 7010 -> 79.14.70.76 7947 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:18.552535 0.000000 udp 10.0.2.105 7010 -> 80.153.64.74 6187 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:23.379122 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:19:24.811293 0.000000 udp 10.0.2.105 7010 -> 87.219.16.60 6763 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:29.016918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:19:29.998267 0.000000 udp 10.0.2.105 7010 -> 135.196.47.168 3660 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:38.250181 0.000000 udp 10.0.2.105 7010 -> 87.203.119.65 3236 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:44.599206 0.068193 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:19:44.737895 0.149894 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:19:44.899293 0.000000 udp 10.0.2.105 7010 -> 58.108.229.248 5276 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:19:49.375958 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:19:53.412242 0.000000 udp 10.0.2.105 7010 -> 108.206.84.217 9299 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:25:33.022345 3.002228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:25:40.030046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:25:48.031840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:04.035049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:26:36.041289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:40.046260 3.002838 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:32:47.054178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:32:55.055617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:11.059157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:33:43.064885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:37:47.666961 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:37:47.667116 0.530006 tcp 10.0.2.105 49179 -> 82.211.142.218 9811 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:39:47.070553 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:39:54.078416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:02.079772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:18.082753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:40:50.088520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:46:54.094453 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:47:01.101977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:09.103792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:25.106566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:47:57.112823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:50:26.277516 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 02:50:26.277594 0.182057 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.460057 0.025063 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.485483 0.035640 udp 10.0.2.105 7010 <-> 213.219.135.125 5172 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.521501 0.143845 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.665733 0.150687 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.816841 0.060772 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:26.878128 0.156754 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:27.035260 0.134355 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:27.169994 0.211556 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:27.381891 0.187155 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:27.569440 0.120007 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:27.689809 0.000000 udp 10.0.2.105 7010 -> 80.139.128.232 7991 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 02:50:43.484657 0.048190 tcp 10.0.2.105 49180 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:50:43.533109 0.046597 tcp 10.0.2.105 49181 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:50:43.579936 0.158918 tcp 10.0.2.105 49182 -> 195.113.214.226 443 SRPA* 0 0 33 25599 flow=From-Botnet-V2-TCP-Established 1970/01/01 02:50:43.739447 0.140415 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:43.880249 1.279664 udp 10.0.2.105 7010 <-> 176.200.219.107 1324 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:45.160414 0.232881 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:45.393658 0.202524 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:45.596613 0.174911 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:45.771929 0.143699 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:45.916010 0.144817 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.061265 0.071755 udp 10.0.2.105 7010 <-> 88.75.199.134 1790 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.133400 0.193885 udp 10.0.2.105 7010 <-> 117.219.243.210 2439 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.327675 0.067867 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.395933 0.081781 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.478089 0.137654 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.616159 0.027388 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.643908 0.140583 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.784887 0.056362 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.841638 0.152061 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:46.994179 0.138341 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.132958 0.330283 udp 10.0.2.105 7010 <-> 59.95.7.63 6258 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.463652 0.135480 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.599484 0.051643 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.651502 0.161434 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.813350 0.055152 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.868862 0.034232 udp 10.0.2.105 7010 <-> 91.16.147.60 2194 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.903455 0.058284 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:47.962076 0.079006 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:48.041430 0.095046 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:48.136914 0.056186 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:48.193496 0.061541 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:48.255405 0.063031 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:50:48.318813 0.138893 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 02:54:01.118825 3.001320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 02:54:08.126513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:16.128072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:54:32.130944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 02:55:04.137097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:08.142318 3.002626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:01:15.150323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:23.151930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:01:39.155023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:02:11.160926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:07:48.195657 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:07:48.195833 0.608271 tcp 10.0.2.105 49183 -> 82.211.142.218 9811 FSPA* 0 0 15 1807 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:08:15.167087 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:08:22.174238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:30.175979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:08:46.178421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:09:18.185040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:22.190951 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:15:29.198054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:37.199416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:15:53.202731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:16:25.208716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:20:49.438889 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:20:49.438977 0.000000 udp 10.0.2.105 7010 -> 80.139.128.232 7991 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:21:08.157942 0.048232 tcp 10.0.2.105 49184 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:08.206477 0.046377 tcp 10.0.2.105 49185 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:08.253156 0.149118 tcp 10.0.2.105 49186 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:08.403021 0.278907 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:08.682331 0.000000 udp 10.0.2.105 7010 -> 213.219.135.125 5172 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:21:24.920782 0.045873 tcp 10.0.2.105 49187 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:24.966991 0.091281 tcp 10.0.2.105 49188 -> 195.113.214.226 80 SRPA* 0 0 18 13325 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:25.058784 0.142898 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.202051 0.148742 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.351149 0.058142 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.409736 0.156712 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.566814 0.132866 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.700035 0.185550 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:25.886000 0.118960 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:26.005372 0.184997 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:26.190730 0.209286 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:26.400447 0.141118 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:26.541979 0.832995 udp 10.0.2.105 7010 <-> 176.200.219.107 1324 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:27.375344 0.234062 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:27.609803 0.190923 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:27.801129 0.167536 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:27.969064 0.145400 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:28.114840 0.144036 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:28.259247 0.033624 udp 10.0.2.105 7010 <-> 88.75.199.134 1790 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:28.293238 0.194084 udp 10.0.2.105 7010 <-> 117.219.243.210 2439 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:28.487745 0.068614 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:28.556729 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:21:44.909791 0.047348 tcp 10.0.2.105 49189 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:44.957445 0.087641 tcp 10.0.2.105 49190 -> 195.113.214.226 80 SRPA* 0 0 37 34603 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:21:45.045690 0.207395 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.253472 0.034244 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.288090 0.192478 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.480984 0.056175 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.537569 0.145073 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.683032 0.145336 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:45.828771 0.326853 udp 10.0.2.105 7010 <-> 59.95.7.63 6258 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.156034 0.138438 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.294873 0.057851 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.353122 0.159999 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.513549 0.048460 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.562403 0.036253 udp 10.0.2.105 7010 <-> 91.16.147.60 2194 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.599023 0.055971 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.655359 0.077954 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.733674 0.094920 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.828983 0.054132 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.883450 0.061237 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:46.945095 0.072773 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:21:47.018290 0.144639 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:22:29.214881 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:22:36.222061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:22:44.223400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:23:00.226809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:23:32.232580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:36.238441 3.001543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:29:43.245934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:29:51.247969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:07.250769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:30:39.256806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:43.262386 3.002181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:36:50.270201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:36:58.271229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:14.274946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:46.280560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:37:48.804383 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:37:48.804479 0.576810 tcp 10.0.2.105 49191 -> 82.211.142.218 9811 FSPA* 0 0 15 1607 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:43:50.287093 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:43:57.293688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:05.295862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:21.298181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:44:53.304273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:50:57.310151 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 03:51:04.317905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:12.319432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:51:28.322199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:52:00.328967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:52:08.841354 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 03:52:08.841444 0.035634 udp 10.0.2.105 7010 -> 213.219.135.125 5172 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:52:08.877078 0.000000 icmp 213.219.135.125 0x0303 -> 10.0.2.105 0x3414 URP 192 1 173 flow=Background 1970/01/01 03:52:26.668360 0.047293 tcp 10.0.2.105 49192 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:26.715950 0.047867 tcp 10.0.2.105 49193 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:26.764120 0.146082 tcp 10.0.2.105 49194 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:26.910753 0.079883 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:26.991030 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:52:42.479932 0.046955 tcp 10.0.2.105 49195 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:42.527074 0.046604 tcp 10.0.2.105 49196 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:42.573987 0.149833 tcp 10.0.2.105 49197 -> 195.113.214.226 443 SRPA* 0 0 23 14002 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:52:42.724545 0.142857 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:42.867857 0.056728 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:42.924950 0.155996 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.081294 0.132696 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.214364 0.178473 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.393261 0.119859 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.513486 0.182174 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.696044 0.153211 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.849605 0.140554 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:43.990581 0.217408 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:44.208391 0.261396 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:44.470156 0.187558 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:44.658129 0.175605 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:44.834166 0.141999 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:44.976551 0.147631 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:45.124694 0.045686 udp 10.0.2.105 7010 <-> 88.75.199.134 1790 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:45.170738 0.140369 udp 10.0.2.105 7010 <-> 176.200.219.107 1324 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:45.311482 0.069363 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:52:45.381310 0.000000 udp 10.0.2.105 7010 -> 117.219.243.210 2439 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:53:03.090214 0.045463 tcp 10.0.2.105 49198 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:53:03.135937 0.047096 tcp 10.0.2.105 49199 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:53:03.183310 0.148177 tcp 10.0.2.105 49200 -> 195.113.214.226 443 SRPA* 0 0 41 22676 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:53:03.332154 0.124378 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:03.456922 0.034679 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:03.491970 0.152270 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:03.644632 0.138270 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:03.783266 0.327679 udp 10.0.2.105 7010 <-> 59.95.7.63 6258 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.111343 0.135263 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.247007 0.139034 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.386383 0.059303 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.446061 0.052726 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.499193 0.159470 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.659064 0.047156 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:04.706629 0.000000 udp 10.0.2.105 7010 -> 91.16.147.60 2194 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 03:53:22.217655 0.086945 tcp 10.0.2.105 49201 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:53:22.304879 0.084160 tcp 10.0.2.105 49202 -> 195.113.214.226 80 SRPA* 0 0 20 14709 flow=From-Botnet-V2-TCP-Established 1970/01/01 03:53:22.389522 0.054134 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.444025 0.081698 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.526151 0.090253 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.616806 0.054259 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.671477 0.059979 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.731853 0.103671 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:53:22.835956 0.149642 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 03:58:04.334614 3.001581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 03:58:11.341795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:19.343656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:58:35.346271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 03:59:07.352405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:11.358545 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:05:18.365928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:26.367771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:05:42.370534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:06:14.376286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:07:49.383495 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:07:49.383684 0.867929 tcp 10.0.2.105 49203 -> 82.211.142.218 9811 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:12:18.381932 3.002362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:12:25.389737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:33.391430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:12:49.394195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:13:21.400596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:25.406076 3.002109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:19:32.413688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:40.415598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:19:56.418395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:20:28.424161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:23:52.798291 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:23:52.798570 0.305195 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:23:53.104134 0.000000 udp 10.0.2.105 7010 -> 117.219.243.210 2439 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:24:11.556994 0.048746 tcp 10.0.2.105 49204 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:11.606024 0.088116 tcp 10.0.2.105 49205 -> 195.113.214.226 80 SRPA* 0 0 45 42354 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:11.694898 0.000000 udp 10.0.2.105 7010 -> 91.16.147.60 2194 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:24:26.898217 0.068251 tcp 10.0.2.105 49206 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:26.966717 0.048477 tcp 10.0.2.105 49207 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:27.015449 0.151813 tcp 10.0.2.105 49208 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:27.167999 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:24:43.321863 0.046126 tcp 10.0.2.105 49209 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:43.368238 0.092153 tcp 10.0.2.105 49210 -> 195.113.214.226 80 SRPA* 0 0 21 15955 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:24:43.460899 0.156889 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:43.618167 0.133605 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:43.752124 0.060841 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:43.813315 0.142206 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:43.955932 0.151358 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.107656 0.138668 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.246678 0.218735 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.465795 0.114633 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.580844 0.179781 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.761025 0.186835 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:44.948272 0.141276 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:45.089942 0.246873 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:24:45.337209 0.000000 udp 10.0.2.105 7010 -> 88.75.199.134 1790 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:25:01.738354 0.046741 tcp 10.0.2.105 49211 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:01.785361 0.051382 tcp 10.0.2.105 49212 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:01.836983 0.146125 tcp 10.0.2.105 49213 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:01.983691 0.301384 udp 10.0.2.105 7010 <-> 176.200.219.107 1324 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:02.285442 0.175296 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:02.461129 0.185800 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:02.647293 0.143033 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:02.790740 0.067850 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:02.859014 0.153304 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:03.012713 0.000000 udp 10.0.2.105 7010 -> 59.95.7.63 6258 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:25:18.151902 0.053019 tcp 10.0.2.105 49214 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:18.205250 0.046662 tcp 10.0.2.105 49215 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:18.252175 0.146736 tcp 10.0.2.105 49216 -> 195.113.214.226 443 SRPA* 0 0 22 13128 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:18.399484 0.134779 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:18.534689 0.032323 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:18.567404 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:25:36.208014 0.048036 tcp 10.0.2.105 49217 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:36.256460 0.083946 tcp 10.0.2.105 49218 -> 195.113.214.226 80 SRPA* 0 0 22 13536 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:25:36.340845 0.152365 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:36.493589 0.057371 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:36.551336 0.158217 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:36.709969 0.047203 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:36.757607 0.347378 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.105341 0.057863 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.163605 0.086022 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.249964 0.094967 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.345273 0.056467 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.402134 0.064739 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.467223 0.113025 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.580662 0.145951 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:25:37.727032 0.056082 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:26:32.431145 3.001000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 04:26:39.438056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:26:47.439415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:03.442077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:27:35.448041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:39.453555 3.002401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:33:46.461502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:33:54.463401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:10.466135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:34:42.472405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:37:50.252488 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:37:50.252586 0.531727 tcp 10.0.2.105 49219 -> 82.211.142.218 9811 FSPA* 0 0 15 1737 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:40:46.477639 3.002270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:40:53.486053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:01.487173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:17.490583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:41:49.496708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:47:53.502264 3.001612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:48:00.509602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:08.511430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:24.513988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:48:56.520153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:00.526169 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 04:55:07.533988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:15.535141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:31.537855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:55:45.698836 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 04:55:45.699090 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:56:01.443221 0.046256 tcp 10.0.2.105 49220 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:01.489712 0.046458 tcp 10.0.2.105 49221 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:01.536520 0.144059 tcp 10.0.2.105 49222 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:01.681185 0.000000 udp 10.0.2.105 7010 -> 88.75.199.134 1790 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:56:03.544642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 04:56:20.399583 0.092431 tcp 10.0.2.105 49223 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:20.492350 0.047064 tcp 10.0.2.105 49224 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:20.539690 0.148091 tcp 10.0.2.105 49225 -> 195.113.214.226 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:20.688056 0.113474 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:20.801897 0.000000 udp 10.0.2.105 7010 -> 59.95.7.63 6258 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:56:36.953769 0.049428 tcp 10.0.2.105 49226 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:37.003433 0.048987 tcp 10.0.2.105 49227 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:37.052716 0.159247 tcp 10.0.2.105 49228 -> 195.113.214.226 443 SRPA* 0 0 21 11734 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:37.212563 0.335982 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:37.548962 0.141879 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:37.691240 0.155342 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:37.846929 0.140203 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:37.987462 0.157222 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:38.145070 0.133813 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:38.279271 0.320195 udp 10.0.2.105 7010 <-> 81.136.171.130 8474 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:38.599859 0.149484 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:38.749749 0.210837 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:38.960998 0.114355 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:39.075725 0.184989 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:39.261108 0.181379 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:39.442869 0.235759 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:39.678992 0.000000 udp 10.0.2.105 7010 -> 176.200.219.107 1324 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:56:54.958826 0.046092 tcp 10.0.2.105 49229 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:55.005174 0.052879 tcp 10.0.2.105 49230 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:55.058365 0.145608 tcp 10.0.2.105 49231 -> 195.113.214.226 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:56:55.204737 0.069865 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:55.275010 0.138629 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:55.414113 0.143028 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:56:55.557542 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 8100 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 04:57:13.746345 0.046606 tcp 10.0.2.105 49232 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:57:13.793263 0.089245 tcp 10.0.2.105 49233 -> 195.113.214.226 80 SRPA* 0 0 20 14755 flow=From-Botnet-V2-TCP-Established 1970/01/01 04:57:13.883053 0.165691 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.049103 0.033587 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.083067 0.143254 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.226686 0.130921 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.357982 0.055578 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.413907 0.155355 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.569667 0.052261 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:14.622302 1.516634 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.139256 0.260954 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.400606 0.077239 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.478203 0.062307 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.540890 0.103736 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.645037 0.145944 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.791378 0.056875 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.848610 0.096477 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 04:57:16.945438 0.055080 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:02:07.550593 3.001144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:02:14.557675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:22.559276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:02:38.562103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:03:10.568333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:07:50.791146 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:07:50.791317 0.526634 tcp 10.0.2.105 49234 -> 82.211.142.218 9811 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:09:14.573936 3.002195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:09:21.582088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:29.583300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:09:45.586026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:10:17.592309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:21.597423 3.002585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:16:28.605844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:36.607119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:16:52.610194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:17:24.615926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:28.622268 3.001323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:23:35.629817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:43.630971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:23:59.634114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:24:31.639974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:27:27.713458 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:27:27.713623 0.000000 udp 10.0.2.105 7010 -> 176.200.219.107 1324 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 05:27:44.900102 0.049000 tcp 10.0.2.105 49235 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:27:44.949350 0.049235 tcp 10.0.2.105 49236 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:27:44.998845 0.143337 tcp 10.0.2.105 49237 -> 195.113.214.226 443 SRPA* 0 0 22 13090 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:27:45.143223 0.190328 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:45.333968 0.110474 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:45.444841 0.414879 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:45.860093 0.138043 udp 10.0.2.105 7010 <-> 68.115.137.250 4522 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:45.998486 0.157946 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:46.156839 0.134498 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:46.291739 1.934875 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:48.227129 0.316881 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:48.227558 4.381766 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 SPA_* 0 0 15 5874 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:27:48.544530 0.185552 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:48.730455 0.141317 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:27:48.872164 0.000000 udp 10.0.2.105 7010 -> 81.136.171.130 8474 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 05:27:58.789716 1.958668 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 8 5728 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:05.758891 0.046693 tcp 10.0.2.105 49239 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:05.805953 0.047244 tcp 10.0.2.105 49240 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:05.853446 0.208278 tcp 10.0.2.105 49241 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:06.062271 0.213235 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:06.275860 0.116651 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:06.392916 0.247939 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:06.641257 1.715922 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:08.357612 0.068986 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:08.426980 0.143482 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:08.570847 0.130867 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:08.702115 0.145403 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:08.847889 0.161883 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.010219 0.044259 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.054866 0.160698 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.215975 0.050413 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.266780 0.149856 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.417058 0.056116 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:09.473615 2.781233 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.255231 0.065506 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.321135 0.079976 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.401498 0.062517 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.464383 0.076809 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.541546 0.144897 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.686830 0.058818 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.746048 0.095077 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:12.841508 0.056698 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:28:16.567048 0.407014 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:25.064065 4.067424 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:29.872728 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:28:30.834733 3.995195 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 21 14974 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:39.045990 1.986515 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:45.439142 4.222106 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 11 7586 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:51.222559 4.117258 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 15 10202 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:28:54.378065 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:28:57.078186 4.380211 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:03.009969 4.316670 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 23 19074 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:10.820021 4.588142 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:16.984919 4.391911 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 20 13968 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:22.968942 0.400993 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:25.872904 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:29:31.458166 2.216335 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:37.676428 4.379965 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 18 11564 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:43.650751 4.293843 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 25 19182 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:52.048407 2.405399 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:29:57.976387 4.689229 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 13 9742 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:04.106224 3.998201 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 18 11812 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:07.372915 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:30:11.731596 2.320968 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 15 13098 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:17.984303 2.227003 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 13 10942 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:23.941758 2.388090 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 15 13098 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:29.903134 4.198397 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 26 24532 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:35.645552 3.002392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:30:35.984337 4.306478 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 17 14654 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:42.036784 4.021650 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 16 13752 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:42.653347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:44.876386 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:30:47.850003 4.367726 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 22 19620 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:30:50.655387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:30:53.943014 2.139841 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 13 12390 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:00.204296 3.932423 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 18 11812 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:06.038323 4.625450 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 9 5430 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:06.658273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:10.873858 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:31:18.589185 4.011844 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 23 14730 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:26.249345 2.440461 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 13 10942 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:32.535404 4.676505 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:38.663965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:31:38.771018 3.901266 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 20 11920 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:44.490644 4.518555 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 16 13152 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:49.869860 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:31:50.768681 4.649451 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:31:56.957012 4.639676 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:32:05.406779 4.061146 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 17 12110 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:32:13.152415 3.943412 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:32:14.375052 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:32:25.376530 4.120394 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 15 9354 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:32:31.289089 2.193832 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:32:37.606122 4.537039 tcp 10.0.2.105 49238 -> 184.57.37.198 4909 FPA_* 0 0 17 8124 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:37:42.670438 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:37:49.677428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:37:51.320164 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:37:51.320329 0.701426 tcp 10.0.2.105 49242 -> 82.211.142.218 9811 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:37:57.679221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:13.681846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:38:45.688528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:44:49.693668 3.002070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:44:56.701076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:04.703023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:20.706221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:45:52.712303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:51:56.717901 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 05:52:03.725543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:11.727060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:27.729960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:52:59.736332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:58:26.666393 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 05:58:26.666544 0.000000 udp 10.0.2.105 7010 -> 81.136.171.130 8474 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 05:58:45.465697 0.050725 tcp 10.0.2.105 49243 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:58:45.516730 0.046582 tcp 10.0.2.105 49244 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:58:45.563613 0.143922 tcp 10.0.2.105 49245 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:58:45.708247 0.151022 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:58:45.859657 0.000000 udp 10.0.2.105 7010 -> 68.115.137.250 4522 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 05:59:01.647001 0.045943 tcp 10.0.2.105 49246 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:59:01.693218 0.047654 tcp 10.0.2.105 49247 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:59:01.741102 0.155276 tcp 10.0.2.105 49248 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/01 05:59:01.896964 0.157518 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:02.054859 0.135091 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:02.190343 0.185968 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:02.376710 0.113414 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:02.490459 1.516568 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:03.742052 3.001696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 05:59:04.007393 0.183685 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:04.191473 0.331368 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:04.523208 0.219277 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:04.742845 0.210727 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:04.954000 0.119370 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:05.073790 0.569257 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:05.643440 0.177777 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:05.821586 0.069465 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:05.891425 0.143975 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.035825 0.124411 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.160746 0.138303 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.299452 0.176138 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.475971 0.027363 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.503752 0.159924 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.664924 0.059965 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.725277 0.137806 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.863462 0.096140 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:06.959987 0.130580 udp 10.0.2.105 7010 <-> 197.35.0.203 4641 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.090921 0.059475 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.150813 0.080603 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.231806 0.060076 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.292249 0.083272 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.375914 0.144951 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.521225 0.068806 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.590411 0.095420 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:07.686243 0.055024 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 05:59:10.749457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:18.750859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 05:59:34.754012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:00:06.760013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:10.766060 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:06:17.773474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:25.774507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:06:41.778071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:07:13.784195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:07:52.028899 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:07:52.029034 1.223819 tcp 10.0.2.105 49249 -> 82.211.142.218 9811 FSPA* 0 0 15 1594 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:13:17.790147 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:13:24.797783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:32.798894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:13:48.801465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:14:20.807581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:24.814449 3.001216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:20:31.821230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:39.823079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:20:55.825968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:21:27.831672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:31.837779 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:27:38.845554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:27:46.847100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:02.849533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:28:34.855966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:29:14.382980 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:29:14.383082 0.139227 udp 10.0.2.105 7010 -> 68.115.137.250 4522 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 06:29:14.522309 0.000000 icmp 68.115.137.250 0x0303 -> 10.0.2.105 0xaa11 URP 192 1 228 flow=Background 1970/01/01 06:29:29.957500 0.074992 tcp 10.0.2.105 49250 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:29:30.032838 0.086039 tcp 10.0.2.105 49251 -> 195.113.214.226 80 SRPA* 0 0 31 21008 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:29:30.119208 0.155137 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:30.274757 0.156831 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:30.431961 0.137547 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:30.569902 0.194167 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:30.764442 0.171000 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:30.935854 0.300435 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:31.236713 0.183783 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:31.420893 0.216950 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:31.638197 0.123920 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:31.762490 0.251805 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.014635 0.145490 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.160521 0.231491 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.392544 0.177620 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.570577 0.068079 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.639024 0.147457 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.786876 0.138513 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:32.925785 0.144287 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.070440 0.175233 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.246026 0.032085 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.278524 0.156448 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.435370 0.043930 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.479709 0.144811 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.624903 0.054759 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:33.680088 0.000000 udp 10.0.2.105 7010 -> 197.35.0.203 4641 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 06:29:51.317044 0.074963 tcp 10.0.2.105 49252 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:29:51.392298 0.087492 tcp 10.0.2.105 49253 -> 195.113.214.226 80 SRPA* 0 0 21 15947 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:29:51.480427 0.057493 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.538313 0.079216 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.617945 0.058985 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.677264 0.061784 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.739425 0.094465 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.834227 0.056170 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.890778 0.071028 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:29:51.962162 0.144107 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/01 06:34:38.861498 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 06:34:45.869185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:34:53.870610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:09.873623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:35:41.879737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:37:53.258975 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 06:37:53.259167 0.552570 tcp 10.0.2.105 49254 -> 82.211.142.218 9811 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/01 06:41:45.885747 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:41:52.892894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:00.894992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:16.897932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:42:48.903366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:48:52.909281 3.002426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:48:59.916810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:07.918801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:23.921497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:49:55.927929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:55:59.933504 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 06:56:06.940827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:14.942826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:56:30.945514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 06:57:02.951665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:00:15.158142 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:00:15.158250 0.000000 udp 10.0.2.105 7010 -> 197.35.0.203 4641 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 07:00:33.487051 0.047460 tcp 10.0.2.105 49255 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:00:33.534851 0.084706 tcp 10.0.2.105 49256 -> 195.113.214.226 80 SRPA* 0 0 49 35245 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:00:33.620205 0.210641 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:00:33.831185 0.136068 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:00:33.967642 0.188904 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:00:34.156884 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 07:00:49.398297 0.046369 tcp 10.0.2.105 49257 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:00:49.444864 0.047544 tcp 10.0.2.105 49258 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:00:49.492694 0.141111 tcp 10.0.2.105 49259 -> 195.113.214.226 443 SRPA* 0 0 23 14004 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:00:49.634401 0.141978 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:00:49.776758 0.155544 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:00:49.932704 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 07:01:05.030998 0.045934 tcp 10.0.2.105 49260 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:01:05.077233 0.046674 tcp 10.0.2.105 49261 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:01:05.124188 0.147180 tcp 10.0.2.105 49262 -> 195.113.214.226 443 SRPA* 0 0 21 13038 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:01:05.271942 0.185168 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:05.457491 0.215980 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:05.673821 0.143423 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:05.817588 0.118624 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:05.936583 0.069668 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.006673 0.143962 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.150994 0.136440 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.287814 0.149012 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.437210 0.174067 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.611693 0.034355 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.646416 0.249668 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:06.896497 0.180479 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.077384 0.052545 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.130319 0.157075 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.287818 0.054142 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.342353 0.138879 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.481607 0.058968 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.540917 0.079728 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.621046 0.060362 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.681786 0.057134 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.739316 0.094994 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.834703 0.055118 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.890193 0.071468 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:01:07.961980 0.147355 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:03:06.957577 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 07:03:13.964701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:21.966822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:03:37.970022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:04:09.975772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:07:53.818152 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:07:53.818351 0.558185 tcp 10.0.2.105 49263 -> 82.211.142.218 9811 FSPA* 0 0 15 1691 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:10:13.981510 3.001539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:10:20.989274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:28.990510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:10:44.993316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:11:16.999214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:21.005217 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:17:28.012802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:36.014326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:17:52.017680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:18:24.023466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:28.028834 3.002708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:24:35.036654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:43.038265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:24:59.041681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:25:31.047888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:08.482865 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:31:08.482965 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 07:31:24.668052 0.046883 tcp 10.0.2.105 49264 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:31:24.715140 0.050997 tcp 10.0.2.105 49265 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:31:24.766396 0.157891 tcp 10.0.2.105 49266 -> 195.113.214.226 443 SRPA* 0 0 23 14002 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:31:24.924877 0.296232 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.221512 0.133855 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.355724 0.150791 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.506915 0.178517 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.685820 0.145559 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.831786 0.157174 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:25.989294 0.189462 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.179185 0.211229 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.390806 0.145775 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.537000 0.125784 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.663163 0.071087 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.734655 0.143854 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:26.878909 0.123853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.003132 0.154769 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.158262 0.172241 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.330873 0.052064 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.383303 0.233806 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.617516 0.180721 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:27.798595 0.246672 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.045675 0.156219 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.202281 0.052237 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.254912 0.144677 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.399965 0.055516 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.455874 0.074973 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.531295 0.059719 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.591482 0.056504 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.648544 0.094607 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.743555 0.055569 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.799502 0.068903 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:28.868757 0.272716 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 07:31:35.052936 3.002370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:31:42.060907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:31:50.062249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:06.065493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:32:38.071762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:37:54.376826 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 07:37:54.376999 0.542104 tcp 10.0.2.105 49267 -> 82.211.142.218 9811 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/01/01 07:38:42.077294 3.001902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:38:49.085384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:38:57.086668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:13.089440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:39:45.095651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:45:49.100880 3.002434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:45:56.108852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:04.110199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:20.113380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:46:52.119710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:52:56.124944 3.002465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 07:53:03.132648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:11.133985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:27.137689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 07:53:59.143275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:03.149677 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:00:10.157045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:18.158215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:00:34.161098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:01:06.166994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:01:43.551609 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:01:43.551740 0.369997 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:43.922162 0.190170 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.112726 0.143815 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.256951 0.156899 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.414220 0.185770 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.600421 0.135868 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.736666 0.150792 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:44.887867 0.215109 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.103309 0.144904 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.248572 0.119709 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.368664 0.069260 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.438285 0.144102 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.582791 0.137826 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.721021 0.143666 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:45.865044 0.176370 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.041842 0.044411 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.086596 0.232208 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.319201 0.190895 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.510462 0.057789 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.568647 0.161262 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.730313 0.048014 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.778721 0.138229 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.917345 0.057654 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:46.975339 0.077653 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.053375 0.059242 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.113005 0.057712 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.171121 0.094487 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.266012 0.053372 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.319748 0.072295 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:01:47.392610 0.144174 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:07:10.173657 3.001446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:07:17.180384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:25.182442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:41.185044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:07:54.925318 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:07:54.925547 0.594843 tcp 10.0.2.105 49268 -> 82.211.142.218 9811 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:08:13.190932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:17.196859 3.002015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:14:24.204935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:32.206282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:14:48.209505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:15:20.215421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:24.221226 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:21:31.229039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:39.229971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:21:55.232852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:22:27.239337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:28:31.244618 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:28:38.252275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:28:46.254365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:02.257089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:29:34.263575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:32:15.284841 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:32:15.284985 0.143002 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:15.428421 0.364739 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:15.793555 0.186523 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:15.980504 0.186119 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.167012 0.185433 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.352848 0.135407 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.488631 0.152757 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.641761 0.209566 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.851674 0.142470 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:16.994510 0.118466 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.113396 0.064500 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.178289 0.143730 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.322360 0.144776 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.467524 0.135779 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.603693 0.174089 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.778225 0.038101 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:17.816722 0.230608 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.047703 0.178514 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.226585 0.058419 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.285355 0.158727 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.444475 0.055874 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.500737 0.131135 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.632309 0.054026 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.686731 0.079273 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.766371 0.060453 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.827245 0.054965 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.882580 0.095677 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:18.978654 0.055721 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:19.034766 0.069869 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:32:19.105009 0.145865 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/01 08:35:38.268585 3.002135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:35:45.276404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:35:53.278100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:09.281279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:36:41.287476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:37:55.524336 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 08:37:55.524516 0.530262 tcp 10.0.2.105 49269 -> 82.211.142.218 9811 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/01 08:42:45.292484 3.002450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:42:52.300822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:00.302075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:16.305103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:43:48.982153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:49:52.987916 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:49:59.995472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:07.997392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:23.999670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:50:56.005710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:00.011563 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 08:57:07.019648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:15.021201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:57:31.024182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 08:58:03.030027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:02:41.681330 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:02:41.681473 0.178450 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:41.860522 0.156391 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:42.017304 0.142408 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:42.160113 0.383144 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:42.543641 0.187144 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:42.731172 0.134254 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:42.865791 0.393844 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.260043 0.211576 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.472002 0.145894 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.618267 0.119594 udp 10.0.2.105 7010 <-> 176.222.173.168 1073 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.738263 0.066527 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.805134 0.142911 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:43.948600 0.151770 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.100745 0.136755 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.237908 0.157049 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.395362 0.029627 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.425380 0.231724 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.657503 0.181441 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.839335 0.055438 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:44.895210 0.158619 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.054194 0.138942 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.193545 0.138280 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.332173 0.061787 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.394364 0.076246 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.470996 0.061370 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.532761 0.053480 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:02:45.586646 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 09:03:00.780302 0.046846 tcp 10.0.2.105 49270 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:03:00.827387 0.088025 tcp 10.0.2.105 49271 -> 195.113.214.226 80 SRPA* 0 0 18 13339 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:03:00.915918 0.054310 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:03:00.970552 0.076760 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:03:01.047677 0.136631 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:04:07.035130 3.002540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:04:14.043758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:22.045151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:04:38.048114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:05:10.053918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:07:56.393435 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:07:56.393537 0.648526 tcp 10.0.2.105 49272 -> 82.211.142.218 9811 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:11:14.060030 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:11:21.067595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:29.068733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:11:45.072202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:12:17.077665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:21.084610 3.000865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:18:28.091604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:36.092927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:18:52.095888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:19:24.102304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:28.108638 3.001208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:25:35.115456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:43.117104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:25:59.120201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:26:31.125775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:32:35.132187 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:32:42.139236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:32:50.140833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:06.144029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:28.376205 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:33:28.376418 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 09:33:38.149501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:33:45.272390 0.050054 tcp 10.0.2.105 49273 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:33:45.322711 0.091187 tcp 10.0.2.105 49274 -> 195.113.214.226 80 SRPA* 0 0 31 21029 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:33:45.414546 0.144250 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:45.559228 0.183300 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:45.742880 0.156124 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:45.899350 0.157687 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.057427 0.153029 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.210846 0.304910 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.516113 0.184181 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.700654 0.066843 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.767858 0.142515 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:46.910744 0.220292 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:47.131447 0.137864 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:47.269700 0.139629 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:47.409662 0.143198 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:33:47.553267 0.000000 udp 10.0.2.105 7010 -> 176.222.173.168 1073 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 09:34:05.400157 0.050354 tcp 10.0.2.105 49275 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:34:05.450743 0.092688 tcp 10.0.2.105 49276 -> 195.113.214.226 80 SRPA* 0 0 31 20978 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:34:05.543936 0.252997 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:05.797332 0.183239 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:05.980953 0.063314 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:06.044669 0.158529 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:06.203592 0.056380 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:06.260413 0.000000 udp 10.0.2.105 7010 -> 95.208.250.244 9895 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 09:34:23.135881 0.045674 tcp 10.0.2.105 49277 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:34:23.181837 0.046474 tcp 10.0.2.105 49278 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:34:23.228584 0.132045 tcp 10.0.2.105 49279 -> 195.113.214.226 443 SRPA* 0 0 35 23777 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:34:23.361175 0.174893 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:23.536617 0.062358 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:23.599315 0.884469 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.484189 0.145246 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.629830 0.064216 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.694457 0.088233 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.783038 0.146801 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.930252 0.058656 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:34:24.989272 0.069470 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/01 09:37:57.042701 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 09:37:57.042840 0.602420 tcp 10.0.2.105 49280 -> 82.211.142.218 9811 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/01/01 09:39:42.155797 3.001855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 09:39:49.162942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:39:57.164771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:13.167585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:40:45.173840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:46:49.179620 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:46:56.186891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:04.188411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:20.191927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:47:52.198020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:53:56.203274 3.002465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 09:54:03.211643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:11.212757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:27.215513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 09:54:59.221778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:03.227855 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:01:10.235270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:18.236556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:01:34.239810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:02:06.245542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:04:52.715432 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:04:52.715653 0.000000 udp 10.0.2.105 7010 -> 176.222.173.168 1073 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 10:05:11.063851 0.073351 tcp 10.0.2.105 49281 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:05:11.137517 0.048157 tcp 10.0.2.105 49282 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:05:11.186003 0.137794 tcp 10.0.2.105 49283 -> 195.113.214.226 443 SRPA* 0 0 32 24687 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:05:11.324529 0.028243 udp 10.0.2.105 7010 <-> 95.208.250.244 9895 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:11.353307 0.134075 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:11.487770 0.564601 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.052717 0.156688 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.209792 0.181654 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.391810 0.145030 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.537250 0.144382 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.682007 0.213638 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:12.896060 0.185793 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:13.082251 0.421404 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:13.504091 0.069280 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:13.573758 0.144796 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:13.718941 0.138904 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:13.858234 0.144019 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:14.002632 0.159527 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:14.162572 0.053723 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:14.216612 0.852155 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.069159 0.233542 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.303127 0.060890 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.364565 0.157853 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.522763 0.061072 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.584176 0.057506 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.642083 0.145042 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.787476 0.073119 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.861048 0.077501 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:15.938922 0.143258 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:16.082585 0.055262 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:05:16.138222 0.077771 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:07:57.651524 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:07:57.651722 0.581721 tcp 10.0.2.105 49284 -> 82.211.142.218 9811 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:08:10.251040 3.002553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 10:08:17.259477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:25.260764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:08:41.263339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:09:13.269462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:17.275659 3.001876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:15:24.283074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:32.284460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:15:48.287554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:16:20.293277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:24.299817 3.001803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:22:31.306983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:39.308206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:22:55.311279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:23:27.317495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:31.323786 3.001893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:29:38.331066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:29:46.332762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:30:02.335999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:30:34.341896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:35:22.676797 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:35:22.676950 0.468284 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:23.145622 0.176269 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:23.322315 0.000000 udp 10.0.2.105 7010 -> 95.208.250.244 9895 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 10:35:41.415503 0.071454 tcp 10.0.2.105 49285 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:35:41.487195 0.085682 tcp 10.0.2.105 49286 -> 195.113.214.226 80 SRPA* 0 0 38 24231 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:35:41.573147 0.135057 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:41.708684 0.183854 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:41.892917 0.143756 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:42.037228 0.138389 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:42.176045 0.213481 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:42.389893 0.187784 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:42.578057 0.385376 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:42.963786 0.069269 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.033393 0.143126 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.176891 0.138017 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.315295 0.143470 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.459152 0.162257 udp 10.0.2.105 7010 <-> 65.15.220.248 4874 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.621800 0.049344 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:35:43.671523 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 10:36:00.782113 0.079163 tcp 10.0.2.105 49287 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:36:00.861512 0.092258 tcp 10.0.2.105 49288 -> 195.113.214.226 80 SRPA* 0 0 39 24216 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:36:00.954248 0.235141 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.189789 0.056759 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.246931 0.159011 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.406344 0.059902 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.466723 0.132973 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.600041 0.130918 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.731330 0.063689 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.795386 0.091959 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:01.887727 0.143912 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:02.032017 0.055421 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/01 10:36:02.087818 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 10:36:20.871476 0.071686 tcp 10.0.2.105 49289 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:36:20.943414 0.082944 tcp 10.0.2.105 49290 -> 195.113.214.226 80 SRPA* 0 0 20 14742 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:36:38.347369 3.001724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 10:36:45.355163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:36:53.356809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:09.359665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:41.365537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:37:58.239887 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 10:37:58.240061 0.566337 tcp 10.0.2.105 49291 -> 82.211.142.218 9811 FSPA* 0 0 15 1672 flow=From-Botnet-V2-TCP-Established 1970/01/01 10:43:45.371574 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:43:52.379107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:00.380366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:16.383117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:44:48.389598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:50:52.395023 3.002162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:50:59.403126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:07.404066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:23.407354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:51:55.413413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:57:59.418841 3.002179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 10:58:06.426810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:14.428193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:58:30.431558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 10:59:02.437708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:06.443594 3.001702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:05:13.451097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:21.452106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:05:37.455630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:06:09.461630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:06:33.246314 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:06:33.246413 0.000000 udp 10.0.2.105 7010 -> 95.208.250.244 9895 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 11:06:48.259896 0.046420 tcp 10.0.2.105 49292 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:06:48.306576 0.089442 tcp 10.0.2.105 49293 -> 195.113.214.226 80 SRPA* 0 0 18 13293 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:06:48.396533 0.178108 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:06:48.575019 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 11:07:04.762140 0.048965 tcp 10.0.2.105 49294 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:04.811355 0.047929 tcp 10.0.2.105 49295 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:04.859537 0.127252 tcp 10.0.2.105 49296 -> 195.113.214.226 443 SRPA* 0 0 36 26971 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:04.987428 0.485805 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:05.473606 0.156567 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:05.630523 0.142045 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:05.772929 0.143198 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:05.916551 0.192963 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:06.109876 0.133769 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:06.244000 0.137508 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:06.381835 0.212841 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:06.595097 0.185059 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:06.780570 0.296340 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:07.077273 0.066772 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:07.144639 0.044509 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:07.189530 0.142892 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:07.332775 0.144861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:07.477998 0.000000 udp 10.0.2.105 7010 -> 65.15.220.248 4874 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 11:07:23.589171 0.045259 tcp 10.0.2.105 49297 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:23.634688 0.050374 tcp 10.0.2.105 49298 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:23.685329 0.143963 tcp 10.0.2.105 49299 -> 195.113.214.226 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:07:23.829927 0.053227 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:23.883545 0.231713 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:24.115653 0.753380 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:24.869418 0.138096 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.007884 0.159885 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.168120 0.079910 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.248429 0.144338 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.393139 0.060426 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.453941 0.062224 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:25.516651 0.063828 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:07:58.808677 0.581705 tcp 10.0.2.105 49300 -> 82.211.142.218 9811 FSPA* 0 0 15 1806 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:12:13.466820 3.002676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 11:12:20.474785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:28.476702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:12:44.479450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:13:16.485539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:20.491165 3.001473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:19:27.499111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:35.499914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:19:51.503297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:20:23.589079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:27.594711 3.002021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:26:34.603228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:42.604581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:26:58.607487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:27:30.613625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:34.618595 3.002670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:33:41.627065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:33:49.627956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:05.631677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:34:37.637585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:37:50.194198 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 11:37:50.194299 0.000000 udp 10.0.2.105 7010 -> 65.15.220.248 4874 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 11:37:59.427780 0.527143 tcp 10.0.2.105 49301 -> 82.211.142.218 9811 FSPA* 0 0 15 1669 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:38:07.190811 0.064597 tcp 10.0.2.105 49302 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:38:07.255738 0.046853 tcp 10.0.2.105 49303 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:38:07.302892 0.143212 tcp 10.0.2.105 49304 -> 195.113.214.226 443 SRPA* 0 0 59 38683 flow=From-Botnet-V2-TCP-Established 1970/01/01 11:38:07.446762 0.185839 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:07.632997 0.143626 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:07.777004 0.185004 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:07.962399 0.136497 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:08.099260 0.326836 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:08.426450 0.160157 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:08.586995 0.143801 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:08.731173 0.144973 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:08.876569 0.185903 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.062843 0.400844 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.464043 0.069107 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.533523 0.051600 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.585497 0.209930 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.795839 0.142764 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:09.938992 0.130966 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:10.070372 0.059971 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:10.130702 0.235446 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:10.366490 0.885963 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.252815 0.131313 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.384599 0.160512 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.545528 0.081617 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.627487 0.076086 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.703978 0.059087 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.763454 0.143390 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:38:11.907245 0.055310 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 11:40:41.643863 3.001058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:40:48.650418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:40:56.652532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:12.655620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:41:44.661369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:47:48.667927 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:47:55.674480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:03.676505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:19.679045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:48:51.685076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:54:55.690828 3.001863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 11:55:02.699147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:10.700426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:26.703523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 11:55:58.709566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:02.714974 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:02:09.722315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:17.723931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:02:33.727562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:03:05.732970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:07:59.956718 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:07:59.956904 0.529676 tcp 10.0.2.105 49305 -> 82.211.142.218 9811 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:08:12.334108 0.177168 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:12.511687 0.134219 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:12.646296 0.177640 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:12.824331 0.143543 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:12.968244 0.151681 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:13.120494 0.156329 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:13.277162 0.143831 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:13.421395 0.143680 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:13.565405 0.183806 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:13.749577 0.296266 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.046287 0.069317 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.115976 0.053295 udp 10.0.2.105 7010 <-> 95.33.152.72 1850 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.169653 0.215105 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.385149 0.143876 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.529434 0.123955 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.653803 0.057096 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.711308 0.246833 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:14.958531 0.881992 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:15.840935 0.131108 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:15.972460 0.171017 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:16.143816 0.083166 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:16.227371 0.065195 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:16.292899 0.061650 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:16.354920 0.144272 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:08:16.499621 0.053405 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:09:09.738960 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:09:16.746772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:24.747876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:09:40.751411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:10:12.757153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:16.763029 3.001864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:16:23.770580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:31.772080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:16:47.775485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:17:19.781167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:23.787716 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:23:30.794918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:38.796315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:23:54.798950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:24:26.805150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:30.810657 3.002329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:30:37.818652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:30:45.820044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:31:01.822782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:31:33.829008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:37.834459 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:37:44.842846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:37:52.843809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:00.485578 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:38:00.485720 1.152066 tcp 10.0.2.105 49306 -> 82.211.142.218 9811 FSPA* 0 0 15 1657 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:38:08.847043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:40.853428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:38:42.425954 0.176731 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:42.603037 0.220906 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:42.824285 0.485977 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:43.310649 0.158916 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:43.469936 0.186573 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:43.656960 0.144076 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:43.801396 0.141852 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:43.943665 0.143437 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:44.087472 0.183320 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:44.271174 0.309174 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:44.580722 0.067746 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:38:44.648851 0.000000 udp 10.0.2.105 7010 -> 95.33.152.72 1850 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 12:38:47.231782 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 12:39:03.208563 0.076993 tcp 10.0.2.105 49307 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:39:03.285787 0.084390 tcp 10.0.2.105 49308 -> 195.113.214.226 80 SRPA* 0 0 19 13405 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:39:03.370673 0.227626 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:03.598677 0.144916 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:03.743986 0.130893 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:03.875251 0.052726 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:03.928544 0.235345 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:04.164303 0.168160 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:04.332794 0.075340 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:04.408665 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 3988 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 12:39:22.724319 0.078258 tcp 10.0.2.105 49309 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:39:22.802805 0.084849 tcp 10.0.2.105 49310 -> 195.113.214.226 80 SRPA* 0 0 31 21023 flow=From-Botnet-V2-TCP-Established 1970/01/01 12:39:22.888399 0.130914 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:23.019661 0.143208 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:23.163215 0.053478 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:23.217031 0.065038 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:39:23.282475 0.060285 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/01 12:44:44.858950 3.001632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 12:44:51.866123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:44:59.868256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:15.870886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:45:47.877019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:51:51.882683 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:51:58.890802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:06.892063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:22.895102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:52:54.901468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:58:58.906920 3.001891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 12:59:05.914237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:13.916047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 12:59:29.918637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:00:01.924936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:05.931263 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:06:12.938105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:20.939563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:06:36.943028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:07:08.949208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:08:01.644979 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:08:01.645160 2.994016 tcp 10.0.2.105 49311 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 13:08:10.637788 0.000000 tcp 10.0.2.105 49311 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 13:08:16.648870 0.071099 tcp 10.0.2.105 49312 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:08:16.720459 0.085355 tcp 10.0.2.105 49313 -> 195.113.214.226 80 SRPA* 0 0 40 39382 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:08:16.827284 3.003503 tcp 10.0.2.105 49314 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 13:08:25.829355 0.000000 tcp 10.0.2.105 49314 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/01 13:08:31.829870 0.070930 tcp 10.0.2.105 49315 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:08:31.901068 0.068651 tcp 10.0.2.105 49316 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:08:31.969981 0.160482 tcp 10.0.2.105 49317 -> 195.113.214.226 443 SRPA* 0 0 33 23891 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:08:32.151777 4.765014 tcp 10.0.2.105 49318 -> 200.84.7.244 8038 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:09:49.149667 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:09:49.149765 0.000000 udp 10.0.2.105 7010 -> 95.33.152.72 1850 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:10:07.336537 0.073505 tcp 10.0.2.105 49319 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:10:07.410276 0.084102 tcp 10.0.2.105 49320 -> 195.113.214.226 80 SRPA* 0 0 19 13394 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:10:07.494924 0.956693 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:08.452003 0.180920 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:08.633283 0.143308 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:08.777003 0.177210 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:08.954681 0.133175 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:09.088346 0.142979 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:09.231725 0.139916 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:09.371995 0.184835 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:09.557247 0.157955 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:09.715608 0.351238 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.067244 0.041146 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.108757 0.067403 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.176567 0.059917 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.236837 0.230727 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.467943 0.146894 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.615186 0.213156 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.828744 0.145017 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:10.974178 0.157150 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:11.131670 0.070352 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:11.202362 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:10:27.645648 0.071700 tcp 10.0.2.105 49321 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:10:27.717658 0.114753 tcp 10.0.2.105 49322 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:10:27.832701 0.168796 tcp 10.0.2.105 49323 -> 195.113.214.226 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:10:28.002089 0.069201 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:28.071629 0.131018 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:28.202975 0.140711 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:28.344063 0.058904 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:28.444768 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 REQ 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:10:35.406326 0.187126 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:35.593853 0.143296 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:35.737627 0.183063 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:35.921129 0.136023 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:36.057615 0.145784 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:36.203806 0.925632 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.129818 0.157233 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.287428 0.386669 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.674623 0.067919 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.743023 0.059616 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.803037 0.061944 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:37.865468 0.185244 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.051131 0.145082 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.196671 0.144061 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.341232 0.250488 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 846 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.592125 0.144963 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.737616 0.171598 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.909677 0.072455 udp 10.0.2.105 7010 <-> 217.39.56.28 9931 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:38.982606 0.237379 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:39.220594 0.131108 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:39.352203 0.055109 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:39.407826 0.054023 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:39.462341 0.142094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:10:39.604963 0.000000 udp 10.0.2.105 7010 -> 82.15.144.232 1211 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:10:47.563495 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 9977 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:10:52.229704 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:10:55.815481 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:01.844144 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:09.855415 0.000000 udp 10.0.2.105 7010 -> 24.9.54.77 7585 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:16.334499 0.007560 udp 10.0.2.105 7010 -> 93.91.145.150 1024 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:16.342059 0.000000 icmp 93.91.145.150 0x0303 -> 10.0.2.105 0x0004 URP 192 1 235 flow=Background 1970/01/01 13:11:21.231473 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:11:21.702555 0.000000 udp 10.0.2.105 7010 -> 12.202.109.50 6182 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:27.600781 0.000000 udp 10.0.2.105 7010 -> 62.212.44.70 7424 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:34.080180 0.000000 udp 10.0.2.105 7010 -> 119.192.202.2 2023 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:41.691435 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:46.227415 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:11:49.101978 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 2789 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:11:55.781893 0.000000 udp 10.0.2.105 7010 -> 184.60.73.228 4067 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:01.900670 0.270239 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:12:02.884135 0.000000 udp 10.0.2.105 7010 -> 68.171.117.12 4837 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:08.710296 0.000000 udp 10.0.2.105 7010 -> 87.217.70.140 3681 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:13.226521 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:12:15.479888 0.000000 udp 10.0.2.105 7010 -> 66.133.206.139 9176 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:23.621485 0.000000 udp 10.0.2.105 7010 -> 67.204.244.183 7752 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:31.723045 0.000000 udp 10.0.2.105 7010 -> 78.185.202.133 7280 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:38.613055 0.000000 udp 10.0.2.105 7010 -> 82.49.134.243 2254 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:43.229471 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:12:45.732961 0.000000 udp 10.0.2.105 7010 -> 74.94.253.37 3416 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:52.222796 0.194560 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:12:52.428232 0.000000 udp 10.0.2.105 7010 -> 84.173.5.199 7912 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:12:58.071005 0.000000 udp 10.0.2.105 7010 -> 86.151.21.6 8304 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:04.099509 0.000000 udp 10.0.2.105 7010 -> 71.180.165.54 7058 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:08.725986 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:13:10.238692 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:12.955525 3.000806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:13:18.800814 0.000000 udp 10.0.2.105 7010 -> 81.6.142.26 7781 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:19.962095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:23.817880 0.031896 udp 10.0.2.105 7010 <-> 79.227.150.47 2430 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:13:23.859835 0.000000 udp 10.0.2.105 7010 -> 78.150.173.183 9941 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:27.963865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:29.966936 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:34.733403 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:13:37.677838 0.000000 udp 10.0.2.105 7010 -> 63.85.131.9 9283 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:43.966672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:13:44.057224 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:49.906117 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:13:56.585331 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:01.231717 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:14:04.386180 0.000000 udp 10.0.2.105 7010 -> 95.233.39.60 6578 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:12.878491 0.000000 udp 10.0.2.105 7010 -> 38.122.127.146 8607 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:15.972845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:14:21.490598 0.170641 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:14:21.701949 0.000000 udp 10.0.2.105 7010 -> 82.19.181.120 7823 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:26.227311 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:14:28.751183 0.000000 udp 10.0.2.105 7010 -> 41.182.67.166 7929 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:34.209600 0.000000 udp 10.0.2.105 7010 -> 109.148.69.242 4408 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:40.678432 0.054282 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:14:40.741812 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:48.549508 0.064109 udp 10.0.2.105 7010 -> 87.173.233.74 1288 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:14:48.613617 0.000000 icmp 87.173.233.74 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 245 flow=Background 1970/01/01 13:14:53.226377 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:14:56.110761 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:03.892386 0.000000 udp 10.0.2.105 7010 -> 98.155.135.232 2821 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:09.990800 0.322272 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:15:10.323172 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 8239 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:18.342813 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:23.229836 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:15:24.090629 0.000000 udp 10.0.2.105 7010 -> 24.172.35.138 4850 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:30.399872 0.000000 udp 10.0.2.105 7010 -> 68.64.220.18 8914 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:36.989536 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:45.221181 0.163041 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:15:45.384222 0.000000 icmp 72.242.16.98 0x0303 -> 10.0.2.105 0xa60b URP 192 1 137 flow=Background 1970/01/01 13:15:49.727726 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:15:53.193008 0.000000 udp 10.0.2.105 7010 -> 216.195.6.125 2004 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:02.085867 0.042679 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:16:02.144903 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:10.968268 0.139159 udp 10.0.2.105 7010 -> 24.106.191.250 6547 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:11.107427 0.000000 icmp 24.106.191.250 0x0303 -> 10.0.2.105 0x9319 URP 192 1 173 flow=Background 1970/01/01 13:16:15.725152 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:16:16.005664 0.029780 udp 10.0.2.105 7010 <-> 87.79.206.35 5058 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:16:16.044527 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:22.715042 0.000000 udp 10.0.2.105 7010 -> 88.240.206.241 6019 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:28.283462 0.000000 udp 10.0.2.105 7010 -> 151.54.9.43 4172 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:36.184557 0.000000 udp 10.0.2.105 7010 -> 190.99.75.9 7164 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:40.730892 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:16:43.314932 0.059035 udp 10.0.2.105 7010 <-> 151.48.85.88 3186 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:16:43.383567 0.000000 udp 10.0.2.105 7010 -> 188.217.191.29 1043 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:51.827447 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:16:59.167949 0.000000 udp 10.0.2.105 7010 -> 2.119.32.169 3930 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:05.316299 0.000000 udp 10.0.2.105 7010 -> 151.66.156.162 2040 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:10.233489 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:17:10.654003 0.319266 udp 10.0.2.105 7010 <-> 117.223.131.112 9127 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:17:10.988639 0.000000 udp 10.0.2.105 7010 -> 190.164.108.142 9145 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:19.326418 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 1072 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:26.857347 0.218146 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:17:27.084685 0.000000 udp 10.0.2.105 7010 -> 77.64.10.76 7676 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:34.448643 0.000000 udp 10.0.2.105 7010 -> 80.216.225.141 8508 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:39.225209 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:17:42.590027 0.000000 udp 10.0.2.105 7010 -> 68.12.161.27 7596 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:48.508885 0.000000 udp 10.0.2.105 7010 -> 151.77.0.157 4708 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:17:56.139508 0.000000 udp 10.0.2.105 7010 -> 78.185.159.247 2204 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:04.662102 0.000000 udp 10.0.2.105 7010 -> 24.44.109.104 1183 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:09.228015 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:18:10.190049 0.000000 udp 10.0.2.105 7010 -> 95.237.58.225 2288 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:15.317338 0.000000 udp 10.0.2.105 7010 -> 74.42.204.182 9086 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:20.884930 0.339551 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:18:21.239134 0.000000 udp 10.0.2.105 7010 -> 190.48.18.15 2146 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:27.624949 0.000000 udp 10.0.2.105 7010 -> 80.181.185.24 3641 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:35.816477 0.058946 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:18:35.889134 0.000000 udp 10.0.2.105 7010 -> 151.246.171.76 1086 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:40.733621 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:18:41.695313 0.000000 udp 10.0.2.105 7010 -> 75.146.9.33 3938 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:50.517934 0.000000 udp 10.0.2.105 7010 -> 76.8.230.63 1625 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:18:59.020461 0.000000 udp 10.0.2.105 7010 -> 81.156.37.209 6615 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:07.231860 0.000000 udp 10.0.2.105 7010 -> 71.255.83.4 4307 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:12.228678 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:19:14.792995 0.000000 udp 10.0.2.105 7010 -> 46.197.69.240 6253 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:23.124483 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:31.746781 0.198321 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:19:31.954900 0.040194 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:19:32.003873 0.237705 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:19:32.250866 0.000000 udp 10.0.2.105 7010 -> 190.153.251.210 4226 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:36.733916 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:19:37.455481 0.000000 udp 10.0.2.105 7010 -> 68.64.227.66 2006 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:44.074654 0.000000 udp 10.0.2.105 7010 -> 89.153.109.248 5368 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:53.027314 0.000000 udp 10.0.2.105 7010 -> 78.184.234.159 5542 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:19:59.386824 0.047427 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:19:59.455529 0.000000 udp 10.0.2.105 7010 -> 24.138.24.210 2520 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:04.233177 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:20:07.718898 0.069638 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:20:07.804685 0.000000 udp 10.0.2.105 7010 -> 201.214.4.31 1277 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:15.109193 0.000000 udp 10.0.2.105 7010 -> 5.67.164.156 6712 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:19.978995 3.001432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:20:20.907788 0.000000 udp 10.0.2.105 7010 -> 31.199.227.195 1432 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:26.986028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:29.770747 0.000000 udp 10.0.2.105 7010 -> 76.119.12.242 9679 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:34.727333 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:20:34.987994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:37.221309 0.000000 udp 10.0.2.105 7010 -> 99.108.108.69 5308 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:44.050856 0.000000 udp 10.0.2.105 7010 -> 98.249.196.157 9536 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:50.990816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:20:51.661979 0.000000 udp 10.0.2.105 7010 -> 98.224.233.159 7446 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:20:57.590265 0.000000 udp 10.0.2.105 7010 -> 173.225.48.186 9056 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:02.226669 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:21:06.273029 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:13.342944 0.000000 udp 10.0.2.105 7010 -> 69.15.41.105 7910 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:21.845223 0.000000 udp 10.0.2.105 7010 -> 174.19.64.55 7653 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:22.997185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:21:26.731781 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:21:29.315741 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:37.857999 0.000000 udp 10.0.2.105 7010 -> 38.122.30.34 4069 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:46.070410 0.000000 udp 10.0.2.105 7010 -> 180.1.11.103 5651 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:21:50.726708 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:21:54.872717 0.000000 udp 10.0.2.105 7010 -> 92.51.100.120 3152 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:02.052874 0.000000 udp 10.0.2.105 7010 -> 79.51.60.244 2448 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:08.242024 0.000000 udp 10.0.2.105 7010 -> 82.55.207.68 2392 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:15.342234 0.000000 udp 10.0.2.105 7010 -> 70.184.76.188 3850 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:20.228705 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:22:20.990075 0.090685 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:22:21.101078 0.000000 udp 10.0.2.105 7010 -> 85.39.108.122 2907 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:28.931846 0.000000 udp 10.0.2.105 7010 -> 115.245.143.131 1575 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:34.470045 0.000000 udp 10.0.2.105 7010 -> 41.66.16.244 6144 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:41.169094 0.000000 udp 10.0.2.105 7010 -> 99.20.137.124 4479 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:45.726043 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:22:49.140995 0.047547 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:22:49.198034 0.095287 udp 10.0.2.105 7010 <-> 31.192.18.180 3573 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:22:49.306455 0.000000 udp 10.0.2.105 7010 -> 69.125.232.175 4560 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:22:54.889181 0.000000 udp 10.0.2.105 7010 -> 66.171.106.3 5010 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:23:03.651768 0.073174 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:27:27.002128 3.002658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:27:34.010564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:42.011788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:27:58.014939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:28:30.020962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:34.026633 3.002191 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:34:41.034520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:34:49.035811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:05.039037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:35:37.044579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:38:36.923979 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:38:36.924144 1.475410 tcp 10.0.2.105 49324 -> 200.84.7.244 8038 FSPA* 0 0 15 1759 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:41:41.050209 3.002249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:41:48.057941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:41:56.059746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:12.062556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:42:44.068633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:48:48.074469 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 13:48:55.081904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:03.083630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:19.087086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:49:51.092412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:53:28.044671 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 13:53:28.044837 0.134742 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:28.180006 0.143536 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:28.323919 0.179837 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:28.504177 0.143654 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:28.648231 0.187257 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:28.835884 0.164552 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.000821 0.056579 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.057759 0.151239 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.209398 0.137175 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.346967 0.069845 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.417185 0.054142 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.471726 0.191291 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.663398 0.143838 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:29.807578 0.000000 udp 10.0.2.105 7010 -> 217.39.56.28 9931 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:53:48.206178 0.070693 tcp 10.0.2.105 49325 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:53:48.277107 0.046130 tcp 10.0.2.105 49326 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:53:48.323524 0.171314 tcp 10.0.2.105 49327 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:53:48.495549 0.253099 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:48.749036 0.146239 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:48.895692 0.231630 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.127727 0.124127 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.252352 0.174524 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.427301 0.066289 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.493948 0.060456 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.554785 0.143310 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.698428 0.137864 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:49.836681 0.182853 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:50.019877 0.186400 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:53:50.206695 0.000000 udp 10.0.2.105 7010 -> 79.227.150.47 2430 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:54:08.754142 0.069311 tcp 10.0.2.105 49328 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:08.823765 0.071129 tcp 10.0.2.105 49329 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:08.895144 0.171166 tcp 10.0.2.105 49330 -> 195.113.214.226 443 SRPA* 0 0 40 21402 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:09.067023 0.168246 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:09.235659 0.056777 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:09.292889 0.281235 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:09.574572 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:54:25.488533 0.065207 tcp 10.0.2.105 49331 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:25.554059 0.086461 tcp 10.0.2.105 49332 -> 195.113.214.226 80 SRPA* 0 0 19 13386 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:25.641033 0.027539 udp 10.0.2.105 7010 <-> 87.79.206.35 5058 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:25.668951 0.000000 udp 10.0.2.105 7010 -> 151.48.85.88 3186 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 13:54:41.211214 0.070365 tcp 10.0.2.105 49333 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:41.281857 0.069188 tcp 10.0.2.105 49334 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:41.351302 0.168673 tcp 10.0.2.105 49335 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/01 13:54:41.520725 0.312630 udp 10.0.2.105 7010 <-> 117.223.131.112 9127 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:41.833781 0.217516 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.051688 0.344761 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.396837 0.056361 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.453595 0.040527 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.494549 0.190095 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.685055 0.231883 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.917318 0.046152 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:42.963810 0.069377 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:43.033553 0.077889 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:43.111789 0.041154 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:43.153371 0.097237 udp 10.0.2.105 7010 <-> 31.192.18.180 3573 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:54:43.251068 0.075110 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/01 13:55:55.098795 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 13:56:02.106128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:10.107944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:26.110576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 13:56:58.116503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:02.122287 3.002264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:03:09.130044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:17.131513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:03:33.134898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:04:05.140494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:08:38.403574 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:08:38.403665 0.249536 tcp 10.0.2.105 49336 -> 200.84.7.244 8038 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:08:43.429089 0.026653 tcp 10.0.2.105 49336 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:10:09.146465 3.002115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:10:16.154114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:24.155428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:10:40.158614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:11:12.164440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:16.170656 3.001857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:17:23.177796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:31.179592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:17:47.182824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:18:19.188661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:23.194084 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:24:30.202137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:38.203824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:54.206509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:24:59.074043 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:24:59.074231 0.000000 udp 10.0.2.105 7010 -> 217.39.56.28 9931 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:25:16.410576 0.046195 tcp 10.0.2.105 49337 -> 195.113.214.251 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:16.457069 0.045858 tcp 10.0.2.105 49338 -> 195.113.214.226 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:16.503198 0.133409 tcp 10.0.2.105 49339 -> 195.113.214.226 443 SRPA* 0 0 63 41208 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:16.637034 0.000000 udp 10.0.2.105 7010 -> 79.227.150.47 2430 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:25:26.212413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:25:34.375695 0.046761 tcp 10.0.2.105 49340 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:34.422774 0.084029 tcp 10.0.2.105 49341 -> 195.113.214.226 80 SRPA* 0 0 31 21033 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:34.507137 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:25:51.730619 0.046364 tcp 10.0.2.105 49342 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:51.777241 0.047567 tcp 10.0.2.105 49343 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:51.825058 0.157276 tcp 10.0.2.105 49344 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:25:51.983022 0.000000 udp 10.0.2.105 7010 -> 151.48.85.88 3186 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:26:08.124011 0.045941 tcp 10.0.2.105 49345 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:08.170197 0.045890 tcp 10.0.2.105 49346 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:08.216421 0.151586 tcp 10.0.2.105 49347 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:08.368763 0.135263 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:08.504442 0.155061 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:08.659846 0.057763 udp 10.0.2.105 7010 <-> 79.77.208.218 3988 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:08.718015 0.151194 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:08.869663 0.142147 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.012171 0.143932 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.156551 0.180349 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.337262 0.179101 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.516750 0.053932 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.571083 0.068116 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.639567 0.141742 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.781661 0.069231 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:09.851251 0.185793 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.037441 0.212753 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.250552 0.146767 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.397715 0.299228 udp 10.0.2.105 7010 <-> 189.101.186.193 4592 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.697443 0.137905 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.835743 0.138290 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:10.974445 0.395101 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.369941 0.180556 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.550896 0.060589 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.611820 0.159471 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.771637 0.146622 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.918684 0.058442 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:11.977536 0.169714 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:12.147595 0.055832 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:12.203771 0.000000 udp 10.0.2.105 7010 -> 64.13.5.213 4172 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:26:29.664992 0.045383 tcp 10.0.2.105 49348 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:29.710631 0.046911 tcp 10.0.2.105 49349 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:29.757802 0.154972 tcp 10.0.2.105 49350 -> 195.113.214.226 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:29.913450 0.027476 udp 10.0.2.105 7010 <-> 87.79.206.35 5058 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:29.941309 0.000000 udp 10.0.2.105 7010 -> 117.223.131.112 9127 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:26:45.497741 0.045118 tcp 10.0.2.105 49351 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:45.543119 0.081338 tcp 10.0.2.105 49352 -> 195.113.214.226 80 SRPA* 0 0 42 30127 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:26:45.624909 0.216579 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:45.841837 0.334656 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.176890 0.054775 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.232036 0.039995 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.272414 0.194048 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.466847 0.231683 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.698870 0.045529 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.744773 0.065969 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.811113 0.087984 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.899427 0.039055 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:46.938834 0.094776 udp 10.0.2.105 7010 <-> 31.192.18.180 3573 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:26:47.034021 0.068203 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:31:30.218906 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 14:31:37.226107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:31:45.227803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:32:01.230669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:32:33.236308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:37.243392 3.000675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:38:43.459134 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:38:43.459295 1.408634 tcp 10.0.2.105 49353 -> 200.84.7.244 8038 FSPA* 0 0 15 1753 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:38:44.249759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:38:52.251834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:08.254140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:39:40.260141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:44.267195 3.000553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:45:51.273563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:45:59.275512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:15.278029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:46:47.284402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:52:51.290077 3.002454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 14:52:58.298174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:06.299145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:22.302511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:53:54.308156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 14:56:59.585189 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 14:56:59.585347 0.000000 udp 10.0.2.105 7010 -> 64.13.5.213 4172 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:57:14.869332 0.047184 tcp 10.0.2.105 49354 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:14.916742 0.086373 tcp 10.0.2.105 49355 -> 195.113.214.226 80 SRPA* 0 0 19 13341 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:15.003606 0.000000 udp 10.0.2.105 7010 -> 117.223.131.112 9127 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:57:31.121504 0.045615 tcp 10.0.2.105 49356 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:31.167351 0.081993 tcp 10.0.2.105 49357 -> 195.113.214.226 80 SRPA* 0 0 19 14673 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:31.249885 0.143570 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:57:31.393797 0.274982 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:57:31.669139 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 3988 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:57:50.609235 0.046205 tcp 10.0.2.105 49358 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:50.655689 0.045617 tcp 10.0.2.105 49359 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:50.701583 0.156710 tcp 10.0.2.105 49360 -> 195.113.214.226 443 SRPA* 0 0 37 30900 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:57:50.859101 0.166888 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:57:51.026337 0.000000 udp 10.0.2.105 7010 -> 74.103.10.180 6864 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:58:06.672074 0.044996 tcp 10.0.2.105 49361 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:06.717360 0.046517 tcp 10.0.2.105 49362 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:06.764133 0.155292 tcp 10.0.2.105 49363 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:06.920020 0.149587 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.069943 0.052661 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.122986 0.067435 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.190969 0.137948 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.329295 0.148579 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.478289 0.185483 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.664184 0.218368 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:07.882910 0.173778 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:08.057096 0.189874 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:08.247375 0.146093 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:08.393904 0.131177 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:08.525520 0.000000 udp 10.0.2.105 7010 -> 189.101.186.193 4592 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:58:26.381083 0.045564 tcp 10.0.2.105 49364 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:26.426939 0.082582 tcp 10.0.2.105 49365 -> 195.113.214.226 80 SRPA* 0 0 31 21032 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:26.509780 0.131301 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:26.641465 0.175543 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:26.817362 0.143538 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:26.961290 0.060155 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.021815 0.168758 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.190944 0.056980 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.248328 0.183773 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.432454 0.268206 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.701059 0.068589 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:27.769992 0.000000 udp 10.0.2.105 7010 -> 87.79.206.35 5058 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:58:44.937246 0.045642 tcp 10.0.2.105 49366 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:44.983131 0.045779 tcp 10.0.2.105 49367 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:45.029152 0.152176 tcp 10.0.2.105 49368 -> 195.113.214.226 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:58:45.182034 0.059843 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:45.242283 0.039956 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:45.282622 0.217261 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:45.500292 0.334681 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:45.835306 0.189107 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.024762 0.232076 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.257224 0.045691 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.303278 0.070541 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.374204 0.089199 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.463775 0.041650 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:58:46.505836 0.000000 udp 10.0.2.105 7010 -> 31.192.18.180 3573 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 14:59:05.136978 0.045160 tcp 10.0.2.105 49369 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:59:05.182391 0.080703 tcp 10.0.2.105 49370 -> 195.113.214.226 80 SRPA* 0 0 42 30156 flow=From-Botnet-V2-TCP-Established 1970/01/01 14:59:05.263733 0.073028 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/01 14:59:58.313872 3.002229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 15:00:05.321856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:13.323042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:00:29.326583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:01:01.332108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:05.338454 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:07:12.345789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:20.347529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:07:36.349950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:08:08.356511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:08:44.869245 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:08:44.869407 3.594404 tcp 10.0.2.105 49371 -> 200.84.7.244 8038 FSPA* 0 0 15 1756 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:14:12.362647 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:14:19.370059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:27.370976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:14:43.373943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:15:15.380049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:19.386206 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:21:26.393791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:34.395248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:21:50.397932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:22:22.404099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:26.410077 3.002016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:28:33.417522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:41.419268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:28:57.421821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:29:23.760452 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:29:23.760612 0.134372 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:29:23.895332 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 3988 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 15:29:29.428516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:29:42.078886 0.046540 tcp 10.0.2.105 49372 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:42.125665 0.045416 tcp 10.0.2.105 49373 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:42.171329 0.159071 tcp 10.0.2.105 49374 -> 195.113.214.226 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:42.330940 0.000000 udp 10.0.2.105 7010 -> 189.101.186.193 4592 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 15:29:59.553008 0.045254 tcp 10.0.2.105 49375 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:59.598592 0.046512 tcp 10.0.2.105 49376 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:59.645307 0.152549 tcp 10.0.2.105 49377 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:29:59.798438 0.000000 udp 10.0.2.105 7010 -> 87.79.206.35 5058 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 15:30:17.798778 0.045172 tcp 10.0.2.105 49378 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:17.844290 0.045650 tcp 10.0.2.105 49379 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:17.890232 0.152391 tcp 10.0.2.105 49380 -> 195.113.214.226 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:18.043335 0.000000 udp 10.0.2.105 7010 -> 31.192.18.180 3573 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 15:30:36.015283 0.045218 tcp 10.0.2.105 49381 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:36.060818 0.082473 tcp 10.0.2.105 49382 -> 195.113.214.226 80 SRPA* 0 0 33 21244 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:36.143551 0.143186 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:36.287151 0.400717 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:36.688394 0.155420 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:36.844200 0.064997 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:36.909582 0.151881 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.061846 0.056929 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.119174 0.184373 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.303935 0.187157 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.491506 0.152154 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.644016 0.177093 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.821511 0.018490 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:37.840500 0.210321 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.051173 0.146693 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.198255 0.131037 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.329706 0.060373 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.390476 0.168140 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.558992 0.055558 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.614937 0.144699 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.760014 0.175045 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:38.935424 0.137990 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.073808 0.181078 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.255285 0.180450 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.436108 0.061844 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.498382 0.039861 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.538616 0.059512 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.598517 0.367790 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:39.966745 0.241408 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:40.208541 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1212 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 15:30:56.784770 0.045394 tcp 10.0.2.105 49383 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:56.830424 0.084678 tcp 10.0.2.105 49384 -> 195.113.214.226 80 SRPA* 0 0 38 23026 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:30:56.915618 0.334319 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:57.250287 0.039137 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:57.289820 0.045875 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:57.336087 0.068687 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:57.405175 0.075413 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:30:57.480988 0.069468 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/01 15:35:33.434701 3.001145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 15:35:40.441880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:35:48.442883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:04.446307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:36:36.452530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:38:48.462580 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 15:38:48.462727 1.465143 tcp 10.0.2.105 49385 -> 200.84.7.244 8038 FSPA* 0 0 15 1655 flow=From-Botnet-V2-TCP-Established 1970/01/01 15:42:40.458416 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:42:47.465606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:42:55.467180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:11.469760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:43:43.476022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:49:47.482404 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:49:54.489612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:02.491050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:18.494055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:50:50.500077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:56:54.505441 3.002316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 15:57:01.513619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:09.514889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:25.518225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 15:57:57.523843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:01:18.453464 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:01:18.453558 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1212 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 16:01:37.002271 0.045764 tcp 10.0.2.105 49386 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:37.048448 0.045704 tcp 10.0.2.105 49387 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:37.094405 0.153564 tcp 10.0.2.105 49388 -> 195.113.214.226 443 SRPA* 0 0 39 20860 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:37.248535 0.138601 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:37.387528 0.149374 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:37.537262 0.156378 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:37.694030 0.068979 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:37.763400 0.286100 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.049883 0.056458 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.106679 0.141356 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.248585 0.181571 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.430552 0.185162 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.616112 0.183858 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:38.800516 0.250922 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.051866 0.146515 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.198770 0.022476 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.221548 0.137478 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.359379 0.062315 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.422074 0.167232 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.589673 0.054914 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.644980 0.144439 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.789824 0.174643 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:39.964881 0.130817 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.096043 0.183317 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.279756 0.144742 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.424963 0.062991 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.488420 0.187755 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.676536 0.232338 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:40.909226 0.185814 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:41.095506 0.063569 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:41.159472 0.000000 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 16:01:57.219896 0.045158 tcp 10.0.2.105 49389 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:57.265317 0.045693 tcp 10.0.2.105 49390 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:57.311301 0.156276 tcp 10.0.2.105 49391 -> 195.113.214.226 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:01:57.468360 0.332730 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:57.801464 0.038652 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:57.840514 0.076264 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:57.917114 0.071250 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:57.988765 0.046497 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:01:58.035638 0.067460 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:04:01.529923 3.002125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 16:04:08.537288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:16.538628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:04:32.542192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:05:04.547942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:08:49.932439 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:08:49.932534 3.653531 tcp 10.0.2.105 49392 -> 200.84.7.244 8038 FSPA* 0 0 15 1641 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:11:08.554562 3.001111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:11:15.561393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:23.563159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:11:39.566072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:12:11.572353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:15.577350 3.001997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:18:22.585433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:30.587140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:18:46.589710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:19:18.595772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:22.602356 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:25:29.609891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:37.610900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:25:53.613915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:26:25.620070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:22.863999 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:32:22.864159 0.039843 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:22.904525 0.142112 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.047032 0.157270 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.204688 0.068577 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.273674 0.151069 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.425106 0.056176 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.481644 0.142153 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.624210 0.133903 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.758499 0.184936 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:23.943860 0.222870 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.167116 0.179096 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.346544 0.023254 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.370179 0.153853 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.524434 0.185825 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.710597 0.143597 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.854582 0.056659 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:24.911596 0.144030 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.055974 0.164538 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.220893 0.144827 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.366108 0.194293 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.560742 0.168937 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.730054 0.058763 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:25.789173 0.240874 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.030439 0.184030 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.214854 0.061440 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.276680 0.145108 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.422192 0.053887 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.476656 0.188483 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:26.665522 0.366398 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:27.032302 0.039378 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:27.071988 0.076630 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:27.149028 0.070390 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:27.219797 0.045466 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:27.265688 0.069949 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/01 16:32:29.625668 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:32:36.633654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:32:44.634550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:33:00.637880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:33:32.644449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:38:53.586088 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 16:38:53.586283 1.350765 tcp 10.0.2.105 49393 -> 200.84.7.244 8038 FSPA* 0 0 15 1673 flow=From-Botnet-V2-TCP-Established 1970/01/01 16:39:36.649369 3.001862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:39:43.657343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:39:51.658757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:07.662176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:40:39.670430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:43.674041 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:46:50.681568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:46:58.682723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:14.685520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:47:46.691732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:53:50.698824 3.000842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 16:53:57.705509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:05.707073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:21.709569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 16:54:53.715929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:00:57.721388 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:01:04.729041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:12.730705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:01:28.733728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:02:00.739594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:02:39.014890 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:02:39.015061 0.157823 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.173283 0.067095 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.240749 0.039955 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.281077 0.146150 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.427602 0.152194 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.580385 0.053869 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.634623 0.145978 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.781025 0.134610 udp 10.0.2.105 7010 <-> 74.103.10.180 6864 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:39.916001 0.177860 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.094268 0.215710 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.310368 0.177581 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.488386 0.019885 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.508620 0.147413 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.656450 0.187525 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.844411 0.137365 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:40.982166 0.054822 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.037360 0.146850 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.184624 0.173801 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.358821 0.167502 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.526739 0.060542 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.587702 0.229847 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:41.817968 0.182470 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.000813 0.063290 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.064643 0.151773 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.216775 0.420265 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.637433 0.124091 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.761912 0.057459 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:42.819734 0.186190 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.006314 0.335973 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.342688 0.040464 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.383520 0.092566 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.476504 0.074867 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.551763 0.044909 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:02:43.597050 0.068334 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:08:04.745613 3.001970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:08:11.753229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:19.754601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:35.758096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:08:54.935502 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:08:54.935780 3.127990 tcp 10.0.2.105 49394 -> 200.84.7.244 8038 FSPA* 0 0 15 1681 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:09:07.763574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:11.769963 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:15:18.777182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:26.778287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:15:42.782100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:16:14.787928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:18.793529 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:22:25.800875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:33.802919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:22:49.805411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:23:21.811545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:25.818006 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:29:32.825324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:40.826770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:29:56.829232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:30:28.835998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:33:00.804440 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:33:00.804644 0.048282 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:00.853307 0.201477 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.055119 0.065772 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.121239 0.142255 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.263835 0.153105 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.417354 0.057253 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.475047 0.143298 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:01.618698 0.000000 udp 10.0.2.105 7010 -> 74.103.10.180 6864 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 17:33:18.591839 0.046515 tcp 10.0.2.105 49395 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:33:18.638646 0.082354 tcp 10.0.2.105 49396 -> 195.113.214.226 80 SRPA* 0 0 46 30285 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:33:18.721469 0.181500 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:18.903339 0.027688 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:18.931355 0.143633 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.075307 0.183379 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.259024 0.136724 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.396107 0.063509 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.460007 0.140428 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.600803 0.234418 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:19.835564 0.180164 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.016078 0.171130 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.187549 0.172175 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.360141 0.061118 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.421618 0.240600 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.662616 0.181702 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.844672 0.061813 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:20.906844 0.131230 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.038434 0.062394 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.101220 0.190178 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.291767 0.179673 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.471820 0.145023 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.617178 0.332606 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.950175 0.040090 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:21.990646 0.073716 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:22.064733 0.073214 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:22.138316 0.045274 udp 10.0.2.105 7010 <-> 78.134.83.123 6943 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:33:22.183930 0.066775 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 17:36:32.842373 3.000803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:36:39.849056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:36:47.850384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:03.853834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:37:35.859675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:38:58.068482 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 17:38:58.068618 1.417163 tcp 10.0.2.105 49397 -> 200.84.7.244 8038 FSPA* 0 0 15 1803 flow=From-Botnet-V2-TCP-Established 1970/01/01 17:43:39.865049 3.002054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:43:46.872650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:43:54.874199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:10.877882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:44:42.883731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:50:46.889514 3.002085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:50:53.897760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:01.898634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:17.902002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:51:49.907566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:57:53.913715 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 17:58:00.920995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:08.922284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:24.925461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 17:58:56.931723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:03:37.525529 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:03:37.525691 0.000000 udp 10.0.2.105 7010 -> 74.103.10.180 6864 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 18:03:53.219265 0.041394 tcp 10.0.2.105 49398 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:03:53.260923 0.043477 tcp 10.0.2.105 49399 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:03:53.304710 0.136794 tcp 10.0.2.105 49400 -> 195.113.214.226 443 SRPA* 0 0 32 17640 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:03:53.442190 0.142385 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:53.584949 0.156527 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:53.741884 0.039898 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:53.782182 0.066828 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:53.849348 0.143750 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:53.993492 0.057216 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.051050 0.150778 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.202168 0.143400 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.345974 0.193806 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.540224 0.191262 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.731878 0.021337 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.753547 0.149377 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.903318 0.054190 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:54.957908 0.146407 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:55.104719 0.232950 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:55.338057 0.176599 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:55.515042 0.172522 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:55.687985 0.229888 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:55.918332 0.182357 udp 10.0.2.105 7010 <-> 98.81.114.227 2218 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.101035 0.065213 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.166597 0.145023 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.312082 0.059164 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.371604 0.188991 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.560985 0.169626 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.730974 0.062818 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.794139 0.183508 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:56.978035 0.130929 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:57.109352 0.362339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:57.472071 0.039467 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:57.511906 0.074264 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:57.586551 0.073435 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:03:57.660430 0.000000 udp 10.0.2.105 7010 -> 78.134.83.123 6943 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 18:04:14.469751 0.044554 tcp 10.0.2.105 49401 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:04:14.514683 0.082159 tcp 10.0.2.105 49402 -> 195.113.214.226 80 SRPA* 0 0 38 24261 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:04:14.597427 0.068723 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:05:00.937825 3.000966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:05:07.944656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:15.946317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:05:31.949261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:06:03.955593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:08:59.488612 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:08:59.488815 0.249046 tcp 10.0.2.105 49403 -> 200.84.7.244 8038 SPA_* 0 0 9 1029 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:09:04.588884 0.011645 tcp 10.0.2.105 49403 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:12:07.962002 3.000831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:12:14.969068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:22.970148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:12:38.973161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:13:10.979732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:14.985480 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:19:21.992691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:29.994676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:19:45.997479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:20:18.003291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:22.010214 3.001110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:26:29.016499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:37.018071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:26:53.021619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:27:25.027303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:29.033392 3.001950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:33:36.041185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:33:44.041911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:34:00.045588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:34:26.844600 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:34:26.844914 0.000000 udp 10.0.2.105 7010 -> 78.134.83.123 6943 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 18:34:32.051522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:34:44.712560 0.075413 tcp 10.0.2.105 49404 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:34:44.788355 0.048268 tcp 10.0.2.105 49405 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:34:44.836899 0.142017 tcp 10.0.2.105 49406 -> 195.113.214.226 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:34:44.979504 0.156989 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.136869 0.039804 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.177028 0.069098 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.246497 0.143006 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.389880 0.057052 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.447326 0.150324 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.598107 0.145297 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.743745 0.190863 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:45.934973 0.149524 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.084837 0.142976 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.228221 0.054867 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.283505 0.146358 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.430277 0.020053 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.450731 0.195786 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.646923 0.173291 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:46.820613 0.241381 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:34:47.062413 0.000000 udp 10.0.2.105 7010 -> 98.81.114.227 2218 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 18:35:04.759301 0.073567 tcp 10.0.2.105 49407 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:35:04.833156 0.048012 tcp 10.0.2.105 49408 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:35:04.881497 0.139728 tcp 10.0.2.105 49409 -> 195.113.214.226 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:35:05.021781 0.059396 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.081619 0.214136 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.296104 0.175730 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.472188 0.063927 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.536637 0.189260 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.726274 0.169520 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.896154 0.061329 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:05.957845 0.182856 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.141094 0.137770 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.279272 0.131354 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.411023 0.078104 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.489540 0.043328 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.533200 0.334684 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.868491 0.074821 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:35:06.943680 0.066449 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 18:39:04.603236 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 18:39:04.603407 1.428972 tcp 10.0.2.105 49410 -> 200.84.7.244 8038 FSPA* 0 0 15 1765 flow=From-Botnet-V2-TCP-Established 1970/01/01 18:40:36.057777 3.000963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 18:40:43.064791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:40:51.066289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:07.069198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:41:39.075525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:43.080782 3.002530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:47:50.088736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:47:58.090319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:14.093124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:48:46.099485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:54:50.104995 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 18:54:57.112794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:05.114327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:21.117153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 18:55:53.123089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:01:57.128997 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:02:04.136318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:12.138465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:02:28.140822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:03:00.147121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:05:19.828511 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:05:19.828663 0.178943 udp 10.0.2.105 7010 -> 98.81.114.227 2218 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 19:05:20.007606 0.000000 icmp 98.81.114.227 0x0303 -> 10.0.2.105 0xaa08 URP 192 1 223 flow=Background 1970/01/01 19:05:36.214798 0.046576 tcp 10.0.2.105 49411 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:05:36.260953 0.081812 tcp 10.0.2.105 49412 -> 195.113.214.226 80 SRPA* 0 0 38 23011 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:05:36.343269 0.065875 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.409577 0.179667 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.589937 0.039879 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.630229 0.056304 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.686889 0.150668 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.837995 0.144279 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:36.982701 0.181820 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.164933 0.144247 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.309585 0.138086 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.448078 0.056847 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.505333 0.139325 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.645040 0.192610 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.838054 0.155402 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:37.993807 0.239663 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.233884 0.037256 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.271480 0.144879 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.416741 0.067365 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.484573 0.215291 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.700266 0.185547 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.886178 0.063406 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:38.949917 0.189118 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.139383 0.168288 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.308040 0.061076 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.369470 0.216141 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.586025 0.124064 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.710469 0.039188 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:39.750016 0.335923 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:40.086367 0.081675 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:40.168630 0.065655 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:40.234774 0.138157 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:05:40.373343 0.072502 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:09:04.153002 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:09:06.033794 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:09:06.033961 0.241979 tcp 10.0.2.105 49413 -> 200.84.7.244 8038 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:09:11.160548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:12.628979 0.011789 tcp 10.0.2.105 49413 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:09:19.161979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:09:35.164915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:10:07.171367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:11.177272 3.001603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:16:18.184438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:26.185952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:16:42.189051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:17:14.194975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:18.200762 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:23:25.208314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:33.209799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:23:49.213156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:24:21.219228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:30:25.225519 3.001129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:30:32.232214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:30:40.234294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:30:56.237538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:31:28.242782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:35:52.293262 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:35:52.293512 0.039377 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.333246 0.053258 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.386909 0.149450 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.536721 0.165346 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.702478 0.220173 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.923003 0.069638 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:52.993050 0.551854 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:53.545304 0.144056 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:53.689702 0.147213 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:53.837322 0.053921 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:53.891580 0.145419 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.037402 0.185794 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.223585 0.172906 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.396844 0.240796 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.637997 0.018818 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.657180 0.143671 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.801255 0.060382 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:54.862029 0.213779 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.076223 0.180674 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.257263 0.056663 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.314262 0.194005 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.508651 0.169984 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.679052 0.062617 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.742035 0.180550 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:55.922960 0.144646 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.068045 0.042867 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.111297 0.333297 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.444911 0.085202 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.530520 0.069443 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.600372 0.145176 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:35:56.745906 0.076096 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/01 19:37:32.248480 3.002102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:37:39.256544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:37:47.257698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:03.260669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:38:35.267151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:39:12.641398 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 19:39:12.641558 1.404574 tcp 10.0.2.105 49414 -> 200.84.7.244 8038 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/01 19:44:39.273783 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:44:46.280217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:44:54.282063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:10.284849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:45:42.291192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:51:46.296485 3.001813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:51:53.304437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:01.305548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:17.309102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:52:49.315288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:58:53.320705 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 19:59:00.328437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:08.330144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:24.332959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 19:59:56.338816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:06:00.344319 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:06:07.352050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:06:15.353617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:06:19.901156 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:06:19.901262 0.150913 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.052546 0.143052 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.195994 0.194305 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.390718 0.069005 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.460142 0.039936 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.500651 0.052617 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.553633 0.168996 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.723017 0.145497 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:20.868926 0.143978 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.013300 0.055635 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.069348 0.217703 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.287464 0.180910 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.468795 0.160494 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.629679 0.231303 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.861399 0.017301 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:21.879053 0.144970 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.024579 0.064930 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.089888 0.216688 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.306993 0.181193 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.488609 0.060300 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.549313 0.187919 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.737638 0.169099 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.907120 0.064592 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:22.972077 0.184667 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.157113 0.138065 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.295564 0.038739 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.334660 0.069442 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.404633 0.138146 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.543186 0.077519 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:23.621093 0.379291 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:24.000790 0.076747 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:06:31.356880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:07:03.363219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:09:14.051286 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:09:14.051448 3.693908 tcp 10.0.2.105 49415 -> 200.84.7.244 8038 FSPA* 0 0 15 1644 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:13:07.368405 3.001837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:13:14.376003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:22.378009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:13:38.381295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:14:10.386480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:14.392748 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:20:21.399957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:29.401873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:20:45.405070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:21:17.410869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:27:21.416151 3.002391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:27:28.424186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:27:36.425736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:27:52.428448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:28:24.434590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:34:28.440406 3.002316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:34:35.448223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:34:43.449687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:34:59.452923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:35:31.458819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:36:33.989052 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:36:33.989246 0.151472 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.141071 0.143216 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.284657 0.188560 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.473621 0.076764 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.550760 0.045990 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.597157 0.058887 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.656433 0.156400 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.813219 0.142276 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:34.955921 0.135528 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.091866 0.055054 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.147328 0.145791 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.293469 0.186297 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.480165 0.173002 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.653560 0.230866 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:35.884791 0.172566 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.057709 0.146022 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.204090 0.065039 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.269520 0.061811 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.331899 0.187426 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.519725 0.168416 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.688654 0.063315 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.752374 0.180596 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:36.933292 0.213587 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.147250 0.175985 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.323649 0.138129 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.462188 0.042690 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.505276 0.068474 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.574140 0.145042 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.719591 0.071090 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:37.791070 0.334747 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:36:38.126221 0.076142 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 20:39:17.744834 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 20:39:17.745007 1.361129 tcp 10.0.2.105 49416 -> 200.84.7.244 8038 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/01/01 20:41:35.463908 3.002759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 20:41:42.472498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:41:50.473879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:06.476542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:42:38.482841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:48:42.488119 3.001889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:48:49.496401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:48:57.497715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:13.500430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:49:45.507081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:55:49.513083 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 20:55:56.519760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:04.521784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:20.524405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 20:56:52.531106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:02:56.536975 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:03:03.543929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:11.545498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:27.548630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:03:59.554754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:07:07.425028 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:07:07.425232 0.151199 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:07.576815 0.142621 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:07.719834 0.192321 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:07.912660 0.071756 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:07.984826 0.040020 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.025250 0.055446 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.081053 0.156652 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.238125 0.142644 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.381150 0.143742 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.525273 0.054588 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.580269 0.148783 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.729416 0.223533 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:08.953310 0.162595 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:09.116320 0.241636 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:09.358296 0.308154 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:09.666798 0.151857 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:09.818991 0.062585 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:09.881926 0.169307 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.051580 0.064762 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.116696 0.183042 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.300095 0.211793 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.512263 0.057595 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.570230 0.189076 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.759714 0.179669 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:10.939807 0.137996 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.078218 0.036876 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.115491 0.068272 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.184102 0.145230 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.329754 0.074436 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.404747 0.337678 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:07:11.742805 0.076773 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:09:19.104098 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:09:19.104204 0.250600 tcp 10.0.2.105 49417 -> 200.84.7.244 8038 SPA_* 0 0 9 1195 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:09:25.223671 0.023551 tcp 10.0.2.105 49417 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:10:03.560109 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 21:10:10.568383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:10:18.569530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:10:34.572221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:11:06.578392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:10.585155 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:17:17.592332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:25.593652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:17:41.596123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:18:13.602745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:24:17.607979 3.002142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:24:24.616435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:24:32.617711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:24:48.620263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:25:20.626328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:31:24.632156 3.002308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:31:31.639822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:31:39.641595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:31:55.644452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:32:27.650113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:37:28.493553 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:37:28.493717 0.151033 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:28.645141 0.143452 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:28.788950 0.185948 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:28.975237 0.073064 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:29.048633 0.044019 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:29.093073 0.053134 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:29.146601 0.157679 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:29.304677 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 21:37:44.489053 0.048532 tcp 10.0.2.105 49418 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:37:44.537865 0.045973 tcp 10.0.2.105 49419 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:37:44.584115 0.154859 tcp 10.0.2.105 49420 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:37:44.739539 0.161026 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:44.900953 0.215869 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:45.117162 0.173353 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:45.290913 0.142890 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:45.434158 0.148879 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:45.583413 0.230441 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:45.814255 0.252314 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.066945 0.143670 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.211002 0.124592 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.336000 0.168671 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.505027 0.065618 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.570984 0.204323 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.775698 0.217444 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:46.993532 0.061031 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.054902 0.188568 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.243866 0.186144 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.430404 0.124062 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.554833 0.038687 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.593863 0.068908 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.663121 0.335672 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:47.999218 0.100597 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:48.100365 0.151842 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:37:48.252607 0.073450 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/01 21:38:31.656118 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:38:38.663669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:38:46.665285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:02.668098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:39:25.251153 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 21:39:25.251289 1.558943 tcp 10.0.2.105 49421 -> 200.84.7.244 8038 FSPA* 0 0 15 1602 flow=From-Botnet-V2-TCP-Established 1970/01/01 21:39:34.674484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:45:38.680438 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:45:45.687761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:45:53.689398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:09.692523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:46:41.698885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:52:45.704328 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:52:52.712298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:00.713519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:16.716304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:53:48.722124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 21:59:52.727610 3.002137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 21:59:59.735411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:07.737362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:23.740421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:00:55.746584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:06:59.751993 3.002517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:07:06.759728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:14.761299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:07:30.764002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:02.770085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:08:09.290250 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:08:09.290420 0.054223 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.345028 0.184867 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.530292 0.067926 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.598629 0.040151 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.639127 0.056525 udp 10.0.2.105 7010 <-> 89.97.65.45 3620 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.696026 0.144950 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.841387 0.151883 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:09.993670 0.157325 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.151340 0.144446 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.296206 0.212227 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.508840 0.159348 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.668609 0.144121 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.813134 0.142622 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:10.956166 0.241674 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:11.198225 0.252628 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:11.451231 0.146593 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:11.598181 0.064281 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:11.662826 0.183594 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:11.846783 0.216360 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.063567 0.061639 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.125554 0.189023 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.314933 0.066742 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.382026 0.168892 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.551330 0.184186 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.735923 0.151746 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.888058 0.059392 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:12.947832 0.069674 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:13.017937 0.346731 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:13.365055 0.088997 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:13.454408 0.138003 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:08:13.592819 0.073793 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:09:26.811815 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:09:26.812054 1.431540 tcp 10.0.2.105 49422 -> 200.84.7.244 8038 FSPA* 0 0 15 1761 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:14:06.776878 3.000972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:14:13.783951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:14:21.785167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:14:37.788463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:15:09.794623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:13.800031 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:21:20.807556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:28.808866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:21:44.812581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:22:16.818023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:28:20.823878 3.002319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:28:27.831840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:28:35.832991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:28:51.835852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:29:23.842018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:35:27.868933 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:35:35.025843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:35:43.027607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:35:59.029973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:36:31.827812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:38:36.423986 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 22:38:36.424111 0.055664 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:36.488844 0.186923 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:36.677179 0.069852 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:36.747519 0.040452 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:36.788397 0.000000 udp 10.0.2.105 7010 -> 89.97.65.45 3620 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 22:38:53.648922 0.062088 tcp 10.0.2.105 49423 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:38:53.711241 0.047748 tcp 10.0.2.105 49424 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:38:53.759239 0.165207 tcp 10.0.2.105 49425 -> 195.113.214.226 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:38:53.936773 0.141601 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.078769 0.151774 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.230926 0.158008 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.389310 0.158735 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.554917 0.190500 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.745826 0.135603 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:54.881817 0.240774 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:55.122943 0.200998 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:55.324456 0.226029 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:38:55.550890 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 22:39:11.758605 0.047030 tcp 10.0.2.105 49426 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:39:11.805907 0.046370 tcp 10.0.2.105 49427 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:39:11.852557 0.134402 tcp 10.0.2.105 49428 -> 195.113.214.226 443 SRPA* 0 0 37 24979 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:39:11.987691 0.144416 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.132576 0.064049 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.196967 0.186141 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.383503 0.213118 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.596986 0.057241 udp 10.0.2.105 7010 <-> 86.146.183.124 9734 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.654588 0.190936 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.845926 0.063342 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:12.909617 0.168669 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.078644 0.191640 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.270677 0.131146 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.402206 0.042366 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.444947 0.071790 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.517132 0.138094 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.655591 0.080513 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:13.736453 0.350542 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:14.087379 0.225102 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/01 22:39:28.722387 1.350136 tcp 10.0.2.105 49429 -> 200.84.7.244 8038 FSPA* 0 0 15 1565 flow=From-Botnet-V2-TCP-Established 1970/01/01 22:42:35.834265 3.000548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 22:42:42.840860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:42:50.842628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:06.845806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:43:38.851640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:49:42.857309 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:49:49.865139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:49:57.866324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:13.869642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:50:45.875356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:56:49.881102 3.002296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 22:56:56.888778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:04.890716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:20.893172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 22:57:52.899310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:03:56.905167 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:04:03.912629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:11.914315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:27.917157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:04:59.923427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:09:21.750112 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:09:21.750207 0.055467 udp 10.0.2.105 7010 -> 89.97.65.45 3620 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 23:09:21.805674 0.000000 icmp 89.97.65.45 0x0303 -> 10.0.2.105 0x240e URP 192 1 281 flow=Background 1970/01/01 23:09:30.072448 2.208211 tcp 10.0.2.105 49430 -> 200.84.7.244 8038 FSPA* 0 0 15 1777 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:38.175822 0.047679 tcp 10.0.2.105 49431 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:38.223805 0.046603 tcp 10.0.2.105 49432 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:38.270765 0.171744 tcp 10.0.2.105 49433 -> 195.113.214.226 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:38.443109 0.236957 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:38.680629 0.069030 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:38.750062 0.177295 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:38.927697 0.055311 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:38.983363 0.041308 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.025003 0.144229 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.169616 0.150315 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.320373 0.157759 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.478494 0.146927 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.625835 0.231321 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:39.857531 0.145730 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.003694 0.167507 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.171575 0.173255 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.345235 0.213386 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.558995 0.146167 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.705529 0.068084 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:40.774009 0.000000 udp 10.0.2.105 7010 -> 86.146.183.124 9734 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 23:09:59.225359 0.045957 tcp 10.0.2.105 49434 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:59.271551 0.085772 tcp 10.0.2.105 49435 -> 195.113.214.226 80 SRPA* 0 0 43 38051 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:09:59.358098 0.193847 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:59.552375 0.065654 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:59.618400 0.168195 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:59.786985 0.178857 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:09:59.966191 0.183672 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.150244 0.217588 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.368224 0.137708 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.506340 0.038317 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.545007 0.065932 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.611303 0.138471 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.750202 0.075458 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:00.826013 0.338353 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:10:01.164740 0.081782 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:11:03.930129 3.000820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/01 23:11:10.936748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:18.938000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:11:34.940999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:12:06.947024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:18:10.953958 3.000921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:18:17.961088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:18:25.962288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:18:41.965182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:19:13.971205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:25:17.976636 3.001971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:25:24.984621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:25:32.986551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:25:48.989075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:26:20.995648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:32:25.000832 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:32:32.008621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:32:40.010522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:32:56.013137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:33:28.019293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:39:32.025020 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:39:32.283213 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:39:32.283380 1.475520 tcp 10.0.2.105 49436 -> 200.84.7.244 8038 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:39:39.032357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:39:47.033818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:03.037248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:18.649862 0.000000 udp 10.0.2.105 7010 -> 86.146.183.124 9734 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/01 23:40:23.195740 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/01 23:40:35.042865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:40:35.451285 0.046652 tcp 10.0.2.105 49437 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:40:35.498225 0.050498 tcp 10.0.2.105 49438 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:40:35.548953 0.136612 tcp 10.0.2.105 49439 -> 195.113.214.226 443 SRPA* 0 0 34 24817 flow=From-Botnet-V2-TCP-Established 1970/01/01 23:40:35.686150 0.072056 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:35.758586 0.207239 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:35.966187 0.055663 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.022231 0.042271 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.064917 0.142171 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.207453 0.150934 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.358794 0.326933 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.686125 0.230560 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:36.917056 0.146737 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.064169 0.157585 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.222119 0.171515 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.394045 0.136276 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.530685 0.143660 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.674690 0.065317 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.740375 0.146094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:37.886895 0.210388 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.097694 0.166396 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.264499 0.176410 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.441292 0.184136 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.625794 0.187959 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.814116 0.058305 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:38.872794 0.213727 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.086897 0.138320 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.225588 0.039947 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.265896 0.068387 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.334635 0.131351 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.466387 0.078753 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.545517 0.359899 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:40:39.905845 0.252039 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/01 23:46:39.048804 3.002080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:46:46.056671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:46:54.058011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:10.061131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:47:42.066906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:53:46.083078 3.002346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/01 23:53:53.090544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:01.092173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:17.095353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/01 23:54:49.100967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:00:53.106890 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:01:00.114649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:08.116471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:24.118994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:01:56.125439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:00.130465 3.002136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:08:07.138198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:15.140027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:08:31.143066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:09:03.169866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:09:33.803352 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:09:33.803550 0.252986 tcp 10.0.2.105 49440 -> 200.84.7.244 8038 SPA_* 0 0 9 1188 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:09:40.321374 3.551808 tcp 10.0.2.105 49440 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:10:59.046343 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:10:59.046444 0.072722 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.119567 0.178135 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.298115 0.062208 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.360667 0.041021 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.402088 0.142645 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.545095 0.318299 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:10:59.863761 0.141632 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:00.005793 0.179503 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:00.185649 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 00:11:17.014138 0.139040 tcp 10.0.2.105 49441 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:11:17.153499 0.045738 tcp 10.0.2.105 49442 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:11:17.199496 0.139468 tcp 10.0.2.105 49443 -> 195.113.214.226 443 SRPA* 0 0 77 80167 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:11:17.339659 0.231700 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:17.571735 0.174553 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:17.746644 0.144391 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:17.891414 0.152490 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.044238 0.068400 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.112986 0.146985 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.260391 0.193832 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.454532 0.165986 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.620936 0.178479 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.799803 0.180239 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:18.980428 0.191286 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.172068 0.062032 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.234505 0.213639 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.448534 0.124109 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.573108 0.038702 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.612577 0.068965 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:19.681960 0.334165 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:20.016498 0.204121 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:20.221020 0.124362 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:11:20.345740 0.072534 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:15:07.205245 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 00:15:14.212543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:22.213716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:15:38.216810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:16:10.223123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:14.229434 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:22:21.236683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:29.238092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:22:45.240882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:23:17.247133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:29:21.253450 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:29:28.260322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:29:36.261966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:29:52.265543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:30:24.271140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:36:28.276807 3.002217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:36:35.284444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:36:43.286222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:36:59.289120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:37:31.295222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:39:43.885896 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:39:43.886116 1.398772 tcp 10.0.2.105 49444 -> 200.84.7.244 8038 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/02 00:41:34.905767 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 00:41:34.905930 0.384330 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:35.290624 0.189186 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:35.480192 0.054962 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:35.535548 0.043089 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:35.579011 0.068989 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:35.648374 0.435034 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.083846 0.143954 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.228187 0.151741 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.380477 0.145293 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.526200 0.232615 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.759191 0.176033 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:36.935584 0.136780 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.072758 0.145792 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.218972 0.066884 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.286208 0.140894 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.427510 0.178020 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.605993 0.183168 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.789519 0.195939 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:37.985794 0.070723 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.056870 0.179842 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.237095 0.166334 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.403780 0.217829 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.621976 0.138188 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.760568 0.044895 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.805899 0.069525 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:38.889802 0.336099 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:39.226274 0.267504 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:39.494181 0.131451 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:41:39.625990 0.077112 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/02 00:43:35.301311 3.001341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 00:43:42.308535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:43:50.310232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:06.312848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:44:38.319139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:50:42.325184 3.001110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:50:49.332292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:50:57.334197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:13.336651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:51:45.342730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:57:49.348920 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 00:57:56.356100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:04.357671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:20.360687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 00:58:52.366637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:04:56.373667 3.001194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:05:03.380017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:11.381526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:27.384865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:05:59.391000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:09:45.286427 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:09:45.286662 3.119550 tcp 10.0.2.105 49445 -> 200.84.7.244 8038 FSPA* 0 0 15 1707 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:11:56.524588 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:11:56.524697 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 01:12:03.397134 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 01:12:10.404305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:12.920838 0.046499 tcp 10.0.2.105 49446 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:12:12.967641 0.108740 tcp 10.0.2.105 49447 -> 195.113.214.226 80 SRPA* 0 0 38 24254 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:12:13.076600 0.043572 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:13.120692 0.073812 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:13.194984 0.674567 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:13.869937 0.142130 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.012470 0.189242 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.202091 0.056661 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.259136 0.281629 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.541157 0.144530 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.686103 0.232045 udp 10.0.2.105 7010 <-> 71.39.236.226 5778 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:14.918524 0.161319 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.080267 0.135481 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.216158 0.143334 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.359818 0.067658 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.427895 0.140823 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.569128 0.181849 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.751383 0.183384 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:15.935181 0.188351 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.123894 0.056552 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.180846 0.186646 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.367861 0.167356 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.535595 0.213811 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.749824 0.137944 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.888098 0.040827 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:16.929349 0.070558 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:17.000276 0.337172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:17.337786 0.076954 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:17.416123 0.183875 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:17.600380 0.139059 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:12:18.405752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:12:34.409121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:13:06.415841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:19:10.422268 3.000018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:19:17.428738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:19:25.429760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:19:41.432970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:20:13.438653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:26:17.444141 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:26:24.451863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:26:32.453521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:26:48.456414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:27:20.462850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:33:24.469139 3.000993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:33:31.476036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:33:39.477834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:33:55.481030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:34:27.487230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:39:48.408406 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:39:48.408538 1.448702 tcp 10.0.2.105 49448 -> 200.84.7.244 8038 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:40:31.491961 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:40:38.500120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:40:46.501813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:02.504919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:41:34.511517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:42:47.465814 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 01:42:47.465961 0.270609 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:47.736973 0.044133 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:47.781486 0.071230 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:47.853125 0.780497 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:48.634058 0.142857 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:48.777321 0.182167 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:48.959882 0.056163 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:42:49.016412 0.000000 udp 10.0.2.105 7010 -> 71.39.236.226 5778 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 01:43:07.255971 0.046188 tcp 10.0.2.105 49449 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:43:07.302399 0.095337 tcp 10.0.2.105 49450 -> 195.113.214.226 80 SRPA* 0 0 47 32009 flow=From-Botnet-V2-TCP-Established 1970/01/02 01:43:07.396903 0.156107 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:07.553407 0.136916 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:07.690762 0.151301 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:07.842459 0.144138 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:07.986999 0.143602 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.131026 0.067207 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.198632 0.148122 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.347137 0.177661 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.525152 0.180033 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.705501 0.187981 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.893823 0.072338 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:08.966633 0.184244 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.151221 0.171941 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.323554 0.211668 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.535612 0.145298 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.681253 0.043393 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.725030 0.072331 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:09.797726 0.213707 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:10.011817 0.138365 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:10.150558 0.339678 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:43:10.490594 0.077181 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/02 01:47:38.516084 3.002175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:47:45.523892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:47:53.526043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:09.528797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:48:41.535073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:54:45.539943 3.002141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 01:54:52.547943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:00.549518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:16.553137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 01:55:48.559035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:01:52.563990 3.002393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:01:59.571972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:07.573605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:23.576402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:02:55.582262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:08:59.589042 3.001432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:09:06.595748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:14.597831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:30.600510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:09:49.858470 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:09:49.858565 0.252548 tcp 10.0.2.105 49451 -> 200.84.7.244 8038 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:09:54.938774 0.002377 tcp 10.0.2.105 49451 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:10:02.606256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:13:37.004853 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:13:37.004946 0.000000 udp 10.0.2.105 7010 -> 71.39.236.226 5778 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 02:13:53.791589 0.046116 tcp 10.0.2.105 49452 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:13:53.837941 0.090853 tcp 10.0.2.105 49453 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:13:53.928312 0.072889 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.001596 0.028824 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.030829 0.047280 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.078459 0.182061 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.260876 0.055770 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.317001 0.172572 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.490039 0.141631 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.632002 0.134698 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.767086 0.151018 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:54.918511 0.144685 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.063567 0.151403 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.215365 0.063673 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.279374 0.167546 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.447281 0.142182 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.589811 0.177379 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.767591 0.183141 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:55.951205 0.188078 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.139656 0.130530 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.270598 0.186292 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.457275 0.167620 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.625302 0.209822 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.835525 0.131048 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:56.966972 0.036265 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:57.003653 0.073428 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:57.077425 0.074435 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:57.152232 0.145022 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:57.297659 0.365788 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:13:57.663869 0.075428 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:16:06.613395 3.000585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:16:13.619627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:21.621606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:16:37.624637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:17:09.630395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:23:13.636939 3.001308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:23:20.643828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:23:28.645481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:23:44.648278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:24:16.654233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:30:20.660097 3.001719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:30:27.668255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:30:35.669461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:30:51.672112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:31:23.678161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:37:27.684661 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:37:34.691519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:37:42.693463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:37:58.696380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:38:30.702501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:39:54.943946 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:39:54.944152 1.431408 tcp 10.0.2.105 49454 -> 200.84.7.244 8038 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/01/02 02:44:15.157994 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 02:44:15.158193 0.043783 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.202359 0.197261 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.399985 0.055925 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.456335 0.069685 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.526433 0.308580 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.835373 0.157598 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:15.993382 0.144603 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.138364 0.136771 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.275488 0.151360 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.427187 0.145299 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.572885 0.144615 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.717916 0.065927 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.784243 0.173619 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:16.958267 0.147332 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.106004 0.175761 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.282122 0.180202 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.462677 0.194305 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.657386 0.060824 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.718635 0.182838 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:17.901888 0.165859 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.068149 0.216264 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.284811 0.144811 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.430001 0.101835 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.532389 0.070410 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.603174 0.100453 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.703993 0.144739 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:18.849098 0.384793 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:19.234267 0.077267 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/02 02:44:34.707994 3.001883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 02:44:41.715823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:44:49.717139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:05.720533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:45:37.726493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:51:41.732411 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:51:48.740041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:51:56.741611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:12.744366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:52:44.750387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:58:48.755810 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 02:58:55.763691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:03.765103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:19.768043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 02:59:51.774110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:05:55.780078 3.001928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:06:02.787709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:10.789420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:26.791966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:06:58.798564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:09:56.384099 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:09:56.384341 3.610506 tcp 10.0.2.105 49455 -> 200.84.7.244 8038 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:13:02.804351 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:13:09.811574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:17.813315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:13:33.816087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:05.822018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:14:41.043372 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:14:41.043472 0.046016 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.089904 0.068363 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.158633 0.021374 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.180392 0.156608 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.337410 0.143131 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.480973 0.136441 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.617769 0.204273 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.822389 0.055057 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:41.877859 0.148945 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.027232 0.142144 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.169774 0.143876 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.313987 0.088912 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.403287 0.173562 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.577235 0.147865 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.725540 0.176335 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.902223 0.066442 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:42.969045 0.182307 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:43.151791 0.167488 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:43.319676 0.215617 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:43.535657 0.184116 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:43.720131 0.187931 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:43.908485 0.137938 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.046767 0.044212 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.091382 0.071731 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.163531 0.147367 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.311261 0.138088 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.449730 0.378157 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:14:44.828242 0.074953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:20:09.828575 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:20:16.835966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:24.837045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:20:40.840124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:21:12.845919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:27:16.853268 3.000637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:27:23.859331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:27:31.860919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:27:47.864264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:28:19.870172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:34:23.876130 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:34:30.883666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:34:38.885624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:34:54.887789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:35:26.894021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:39:59.997297 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:39:59.997529 1.420279 tcp 10.0.2.105 49456 -> 200.84.7.244 8038 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:41:30.900488 3.001153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:41:37.907696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:41:45.909366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:01.912017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:42:33.917902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:44:45.427341 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 03:44:45.427550 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 03:45:01.262909 0.046718 tcp 10.0.2.105 49457 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:45:01.309966 0.046688 tcp 10.0.2.105 49458 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:45:01.357012 0.134783 tcp 10.0.2.105 49459 -> 195.113.214.226 443 SRPA* 0 0 59 37931 flow=From-Botnet-V2-TCP-Established 1970/01/02 03:45:01.492135 0.040869 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:01.533375 0.067442 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:01.601221 0.222475 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:01.824104 1.819243 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:03.643747 0.137770 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:03.781839 0.184514 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:03.966728 0.055451 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.022590 0.151357 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.174278 0.146508 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.321137 0.143915 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.465454 0.067162 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.533014 0.172585 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.705941 0.148158 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:04.854519 0.174843 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.029731 0.061823 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.091950 0.183995 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.276364 0.165957 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.442725 0.216996 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.660041 0.180574 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:05.840970 0.198070 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.039387 0.137846 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.177567 0.036371 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.214294 0.071601 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.286275 0.105857 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.392622 0.078518 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.471496 0.145450 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:45:06.617403 0.406103 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 03:48:37.924724 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:48:44.931393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:48:52.932762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:08.936111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:49:40.942015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:55:44.948259 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 03:55:51.955141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:55:59.957171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:15.960309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 03:56:47.965718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:02:51.971712 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:02:58.979550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:06.981275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:22.984207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:03:54.990030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:09:58.996015 3.001982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:10:01.417967 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:10:01.418071 0.254001 tcp 10.0.2.105 49460 -> 200.84.7.244 8038 SPA_* 0 0 7 1099 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:10:06.003530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:07.022806 0.039710 tcp 10.0.2.105 49460 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:10:14.004587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:10:30.007884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:11:02.013746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:15:08.158108 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:15:08.158296 0.076445 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:08.235164 0.156591 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:08.392154 0.043871 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:08.436466 0.069434 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:08.506290 0.000000 udp 10.0.2.105 7010 -> 184.57.37.198 8581 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 04:15:25.095432 0.047772 tcp 10.0.2.105 49461 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:15:25.143530 0.087832 tcp 10.0.2.105 49462 -> 195.113.214.226 80 SRPA* 0 0 45 36521 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:15:25.232032 0.136297 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:25.368701 0.184585 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:25.553701 0.055025 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:25.609136 0.370332 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:25.979897 0.146548 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.126840 0.143543 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.270778 0.070235 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.341416 0.157090 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.498863 0.143645 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.642865 0.180622 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.823862 0.064706 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:26.888993 0.185785 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:27.075246 0.794896 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:27.870564 0.213588 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.084688 0.183551 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.268651 0.189031 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.458047 0.137920 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.596406 0.043846 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.640706 0.073127 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.714260 0.131377 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:28.846052 0.388751 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:29.235164 0.146653 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:15:29.382215 0.079951 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:17:06.019972 3.001346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:17:13.027034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:21.028843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:17:37.032047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:18:09.038169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:13.044486 3.000830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:24:20.051606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:28.053009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:24:44.056032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:25:16.062199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:31:20.067302 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:31:27.075224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:31:35.076955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:31:51.080053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:32:23.086126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:38:27.092789 3.000409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:38:34.099222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:38:42.100716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:38:58.103518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:39:30.109758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:40:07.063238 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:40:07.063342 1.400766 tcp 10.0.2.105 49463 -> 200.84.7.244 8038 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:45:34.115355 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:45:38.539459 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:45:38.539622 1.315832 udp 10.0.2.105 7010 <-> 184.57.37.198 8581 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:39.855886 0.414575 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.271035 0.041158 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.271511 4.915066 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 SPA_* 0 0 31 16240 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:45:40.312726 0.157198 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.470308 0.070463 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.541136 0.145612 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.687110 0.189693 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.877244 0.055837 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:40.933468 0.247366 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.123597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:45:41.181226 0.145993 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.327585 0.145165 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.473170 0.069819 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.543419 0.153971 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.697776 0.139937 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:41.838124 0.181471 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.020019 0.063604 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.083963 0.183288 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.267656 0.183301 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.451340 0.166190 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.617914 0.211270 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:42.829585 0.194879 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.024870 0.138213 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.163503 0.055008 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.218914 0.074092 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.293379 0.145159 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.438937 0.380133 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:45:43.819479 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 04:45:45.389202 0.000000 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:45:49.125000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:00.994343 0.069043 tcp 10.0.2.105 49465 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:01.063634 0.069013 tcp 10.0.2.105 49466 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:01.132944 0.159312 tcp 10.0.2.105 49467 -> 195.113.214.226 443 SRPA* 0 0 39 27985 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:01.292976 0.076639 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 04:46:05.127901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:06.661937 3.914832 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_PA 0 0 26 12828 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:12.156898 4.517721 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_PA 0 0 6 3180 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:26.576048 4.942600 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_PA 0 0 25 12590 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:31.745881 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:46:32.978202 2.433277 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:46:37.134320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:46:42.795835 3.215546 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 A_PA 0 0 23 10150 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:47:16.009845 0.000098 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:49:16.011942 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 04:49:16.012048 0.000000 tcp 10.0.2.105 49464 -> 84.59.151.27 3285 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/02 04:52:41.139497 3.002294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 04:52:48.147166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:52:56.148605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:12.151637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:53:44.157469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 04:59:48.164646 3.000788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 04:59:55.171228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:03.172772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:19.175501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:00:51.182013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:06:55.187290 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:07:02.194895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:10.196574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:26.199736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:07:58.206084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:10:08.463279 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:10:08.463376 0.245123 tcp 10.0.2.105 49468 -> 200.84.7.244 8038 SPA_* 0 0 9 1017 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:10:15.103173 0.005000 tcp 10.0.2.105 49468 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:14:02.211277 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:14:09.219334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:17.220600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:14:33.223565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:15:05.229340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:16:27.238128 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:16:27.238292 0.081402 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:27.320059 0.042165 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:27.362659 0.000000 udp 10.0.2.105 7010 -> 184.57.37.198 8581 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 05:16:42.772722 0.070123 tcp 10.0.2.105 49469 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:16:42.843145 0.107533 tcp 10.0.2.105 49470 -> 195.113.214.226 80 SRPA* 0 0 19 14633 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:16:42.951229 0.558928 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:43.510672 0.145452 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:43.511164 4.245647 tcp 10.0.2.105 49471 -> 84.59.151.27 3285 SPA_* 0 0 8 631 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:16:43.656518 0.181469 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:43.838334 0.077114 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:16:43.915844 0.000000 udp 10.0.2.105 7010 -> 97.65.8.22 1039 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 05:16:52.050111 2.336769 tcp 10.0.2.105 49471 -> 84.59.151.27 3285 A_PA 0 0 14 8516 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:17:00.917277 0.069530 tcp 10.0.2.105 49472 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:17:00.987131 0.071008 tcp 10.0.2.105 49473 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:17:01.058430 0.244391 tcp 10.0.2.105 49474 -> 195.113.214.226 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:17:01.303498 0.157999 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:01.461951 0.068060 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:01.530452 0.183837 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:01.714608 0.066724 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:02.501401 0.169376 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:02.671239 0.146052 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:02.817695 0.181091 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:02.999238 0.060672 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.060377 0.186435 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.247207 0.145634 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.393260 0.166953 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.560582 0.216989 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.777952 0.193878 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:03.972201 0.149722 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.122328 0.050286 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.173027 0.071894 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.245338 0.184067 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.429814 0.379029 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.809190 0.142837 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:04.952488 0.079092 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:17:08.564829 4.658836 tcp 10.0.2.105 49471 -> 84.59.151.27 3285 A_PA 0 0 20 11752 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:17:43.026727 0.912171 tcp 10.0.2.105 49471 -> 84.59.151.27 3285 FRA_* 0 0 4 752 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:21:09.355602 3.002081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:21:16.363060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:24.364638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:21:40.367647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:22:12.373871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:16.379573 3.001664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:28:23.387486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:31.388404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:28:47.392083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:29:19.397934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:35:23.403467 3.001734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:35:30.410950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:35:38.412324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:35:54.416048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:36:26.422042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:40:15.230971 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:40:15.231127 2.146204 tcp 10.0.2.105 49475 -> 200.84.7.244 8038 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:42:30.428716 3.000323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:42:37.434804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:42:45.436687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:01.439801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:43:33.445540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:47:22.325240 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 05:47:22.325352 0.000000 udp 10.0.2.105 7010 -> 184.57.37.198 8581 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 05:47:38.381419 0.547906 tcp 10.0.2.105 49476 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:47:38.929698 0.558146 tcp 10.0.2.105 49477 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:47:39.488162 1.244241 tcp 10.0.2.105 49478 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/02 05:47:40.733041 0.644590 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:41.378157 0.322872 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:41.378551 3.007705 tcp 10.0.2.105 49479 -> 97.65.8.22 6521 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 05:47:41.701452 0.274447 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:41.976378 0.420283 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:42.397129 0.265247 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:42.662854 0.408464 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:43.071750 0.820170 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:43.892272 0.396414 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:44.289112 0.396425 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:44.685962 0.331783 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:45.018152 0.304497 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:45.323054 0.415467 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:45.738912 0.385395 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:46.124757 0.427587 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:46.552767 0.272295 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:46.825444 0.445800 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:47.271616 0.398270 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:47.670324 0.391583 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:48.062277 0.460106 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:48.522810 0.444518 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:48.967725 0.382724 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:49.350804 0.306643 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:49.657826 0.325051 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:49.983285 0.391301 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:50.374995 0.311739 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:50.395219 0.000000 tcp 10.0.2.105 49479 -> 97.65.8.22 6521 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 05:47:50.687195 0.436905 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:51.124603 0.634196 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/02 05:47:56.045624 0.273313 udp 10.0.2.105 52680 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/02 05:47:56.319476 0.255147 udp 10.0.2.105 53034 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/02 05:49:37.451654 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 05:49:44.458899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:49:52.460702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:08.463780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:50:40.469965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:56:44.476498 3.001325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 05:56:51.482761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:56:59.484773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:15.487906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 05:57:47.493942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:03:51.500440 3.000888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:03:58.506939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:06.508975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:22.511560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:04:54.517845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:10:17.382096 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:10:17.382242 4.486893 tcp 10.0.2.105 49480 -> 200.84.7.244 8038 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:10:58.523315 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:11:05.531915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:13.532962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:11:29.536610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:12:01.541555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:02.540632 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:18:02.540884 0.512180 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:03.053452 0.932488 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:03.986427 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 06:18:03.986822 3.000010 tcp 10.0.2.105 49481 -> 97.65.8.22 6521 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 06:18:05.547715 3.001542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:18:12.554617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:12.995497 0.000000 tcp 10.0.2.105 49481 -> 97.65.8.22 6521 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 06:18:20.008711 1.030855 tcp 10.0.2.105 49482 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:18:20.556508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:21.039817 1.026745 tcp 10.0.2.105 49483 -> 195.113.214.226 80 SRPA* 0 0 20 13484 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:18:22.067201 0.641190 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:22.708766 0.654100 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:23.363192 0.545547 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:23.909144 1.092946 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:25.002516 0.636759 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:25.003007 2.511694 tcp 10.0.2.105 49484 -> 84.59.151.27 3285 SPA_* 0 0 7 583 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:18:25.639682 0.570561 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:26.210660 0.646953 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:26.858068 0.570374 udp 10.0.2.105 7010 <-> 86.143.11.135 5422 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:27.515188 0.648390 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:28.163950 0.636957 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:28.801284 0.644986 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:29.446663 0.547109 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:29.994173 0.631753 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:30.626316 0.635560 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:30.668508 2.062841 tcp 10.0.2.105 49484 -> 84.59.151.27 3285 A_PA 0 0 18 10592 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:18:31.262357 0.618021 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:31.880734 0.697923 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:32.579050 0.671683 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:33.251119 0.602281 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:33.853742 0.538007 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:34.392187 0.552728 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:34.945316 0.671585 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:35.617316 0.619476 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:35.888416 0.200535 tcp 10.0.2.105 49484 -> 84.59.151.27 3285 A_PA 0 0 2 728 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:18:36.237250 0.575450 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:18:36.569551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:18:36.813104 0.832395 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:19:05.881675 0.000078 tcp 10.0.2.105 49484 -> 84.59.151.27 3285 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:19:08.575280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:19:27.925266 0.000158 tcp 10.0.2.105 49484 -> 84.59.151.27 3285 RA_A 0 0 2 1528 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:19:32.870222 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:25:12.582416 3.000678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:25:19.589046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:27.590302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:25:43.593756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:26:15.599486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:32:19.605832 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:32:26.612791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:32:34.614400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:32:50.617739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:33:22.623208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:39:26.629075 3.032184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:39:33.667127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:39:41.668460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:39:57.671272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:40:21.966609 0.000186 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:40:21.966894 2.854652 tcp 10.0.2.105 49485 -> 200.84.7.244 8038 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:40:29.847943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:46:33.853321 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 06:46:40.860885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:46:48.862710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:04.866102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:47:36.871467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:49:04.327426 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 06:49:04.327531 0.565809 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:04.893787 0.515047 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:04.894162 2.998334 tcp 10.0.2.105 49486 -> 31.197.209.67 4165 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 06:49:05.409236 0.611564 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:06.021143 0.609824 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:06.631360 0.684652 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:07.316414 0.539898 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:07.856720 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 06:49:13.891317 0.000000 tcp 10.0.2.105 49486 -> 31.197.209.67 4165 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 06:49:23.377647 1.042545 tcp 10.0.2.105 49487 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:24.420489 1.024536 tcp 10.0.2.105 49488 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:25.445339 2.280838 tcp 10.0.2.105 49489 -> 195.113.214.226 443 SRPA* 0 0 36 27221 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:27.726780 0.617747 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:28.345019 0.508387 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:28.345418 4.947373 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 SPA_* 0 0 84 51706 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:28.853761 0.632671 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:29.486865 0.000000 udp 10.0.2.105 7010 -> 86.143.11.135 5422 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 06:49:33.931317 4.918903 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 A_PA 0 0 117 80046 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:39.400063 4.892104 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 A_PA 0 0 112 77728 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:44.496674 4.953597 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 A_PA 0 0 104 73200 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:46.659595 1.014559 tcp 10.0.2.105 49491 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:47.674368 1.040315 tcp 10.0.2.105 49492 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:48.715001 2.116322 tcp 10.0.2.105 49493 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:49.929569 4.953480 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 A_PA 0 0 112 75680 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:50.831917 0.648886 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:51.481220 0.645433 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:52.127072 0.657313 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:52.784827 0.562874 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:53.348042 0.661838 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:54.010226 0.618596 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:54.629213 0.654863 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:54.946121 4.996387 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 A_PA 0 0 101 70990 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:49:55.284416 0.674235 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:55.959090 0.667336 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:56.626776 0.618437 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:57.245573 0.519922 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:57.765836 0.501258 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:58.267482 0.648669 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:58.916590 0.638452 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:59.555419 0.577092 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:49:59.968963 1.561475 tcp 10.0.2.105 49490 -> 70.90.49.1 9347 FPA_* 0 0 11 3931 flow=From-Botnet-V2-TCP-Established 1970/01/02 06:50:00.132842 0.914791 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/02 06:53:40.878578 3.000434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 06:53:47.885021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:53:55.886475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:11.889445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 06:54:43.895319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:00:47.902352 3.000976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:00:54.908857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:02.910688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:18.913486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:01:50.919295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:07:54.925636 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:08:01.933366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:09.934450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:25.937936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:08:57.943559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:10:24.828934 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:10:24.829027 0.738683 tcp 10.0.2.105 49494 -> 200.84.7.244 8038 SPA_* 0 0 7 1135 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:10:31.458868 0.154966 tcp 10.0.2.105 49494 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:15:01.949424 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:15:08.957091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:16.958245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:15:32.961342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:16:04.967420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:20:27.315309 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:20:27.315473 1.045185 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:28.361024 0.000000 udp 10.0.2.105 7010 -> 86.143.11.135 5422 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 07:20:47.135864 1.030306 tcp 10.0.2.105 49495 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:20:48.166491 0.962869 tcp 10.0.2.105 49496 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:20:49.129653 2.381129 tcp 10.0.2.105 49497 -> 195.113.214.226 443 SRPA* 0 0 37 24957 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:20:51.511362 0.563818 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:52.075584 1.053977 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:53.129996 0.530763 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:53.661136 0.653211 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:54.314754 0.621501 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:54.936699 0.535786 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:55.472919 0.616113 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:56.089431 0.545252 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:56.635017 0.643415 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:57.278794 0.620513 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:57.899644 0.616879 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:58.516891 0.667015 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:59.184345 0.557790 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:20:59.742546 0.623585 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:00.366489 0.627725 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:00.994598 0.641524 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:01.636621 0.704862 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:02.341923 0.679788 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:03.022111 0.628528 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:03.651004 0.000000 udp 10.0.2.105 7010 -> 95.89.179.37 6418 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 07:21:21.044016 1.011326 tcp 10.0.2.105 49498 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:21:22.055226 1.029953 tcp 10.0.2.105 49499 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:21:23.085473 2.416785 tcp 10.0.2.105 49500 -> 195.113.214.226 443 SRPA* 0 0 35 24871 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:21:25.502805 0.559731 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:26.062940 0.668383 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:26.731713 0.637115 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:27.369234 0.541284 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:21:27.910927 0.814362 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:22:08.974289 3.001150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:22:15.981163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:23.982758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:22:39.985401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:23:11.991758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:15.997040 3.002327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:29:23.004964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:31.006709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:29:47.009582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:30:19.015506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:36:23.021943 3.001011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:36:30.028927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:36:38.030145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:36:54.033589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:37:26.039383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:40:31.616564 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:40:31.616710 3.192956 tcp 10.0.2.105 49501 -> 200.84.7.244 8038 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:43:30.044920 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:43:37.052728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:43:45.054563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:01.057315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:44:33.063182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:50:37.069313 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 07:50:44.076673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:50:52.078495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:08.081661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:33.868691 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 07:51:33.868793 0.000000 udp 10.0.2.105 7010 -> 95.89.179.37 6418 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 07:51:40.087533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:51:51.266345 1.062652 tcp 10.0.2.105 49502 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:51:52.329275 1.087822 tcp 10.0.2.105 49503 -> 195.113.214.226 80 SRPA* 0 0 18 13341 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:51:53.417611 1.055872 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:54.473908 0.638675 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:55.112983 0.643384 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:55.756775 0.548441 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:56.305579 0.667716 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:56.973692 0.627553 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:57.601620 0.631017 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:58.233044 0.554621 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:58.788082 0.670118 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:51:59.458570 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 07:52:18.283657 1.066457 tcp 10.0.2.105 49504 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:52:19.350408 1.029437 tcp 10.0.2.105 49505 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:52:20.380089 2.634232 tcp 10.0.2.105 49506 -> 195.113.214.226 443 SRPA* 0 0 37 25189 flow=From-Botnet-V2-TCP-Established 1970/01/02 07:52:23.014903 0.633292 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:23.648592 0.672563 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:24.321534 0.635818 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:24.957752 0.558022 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:25.516146 0.678506 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:26.195015 0.647807 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:26.843187 0.663781 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:27.507389 0.716917 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:28.224680 0.692498 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:28.917632 0.614870 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:29.532918 0.556399 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:30.089736 0.666468 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:30.756569 0.637389 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:31.394358 0.561353 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:52:31.956110 0.830663 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/02 07:57:44.094214 3.000886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 07:57:51.100991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:57:59.102511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:15.105275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 07:58:47.111601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:04:51.117056 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:04:58.124929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:06.126074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:22.129572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:05:54.135425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:10:34.809324 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:10:34.809495 2.966671 tcp 10.0.2.105 49507 -> 200.84.7.244 8038 FSPA* 0 0 15 1741 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:11:58.140753 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:12:05.148696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:13.150168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:12:29.153033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:13:01.159440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:05.166132 3.000656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:19:12.172761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:20.174235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:19:36.177046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:20:08.183638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:22:43.686881 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:22:43.687125 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:23:01.234158 1.041484 tcp 10.0.2.105 49508 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:23:02.275986 1.054504 tcp 10.0.2.105 49509 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:23:03.330341 2.130877 tcp 10.0.2.105 49510 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:23:05.461870 0.915953 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:06.378203 0.702232 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:07.080805 0.799073 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:07.880279 0.532324 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:08.412988 0.671845 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:09.085191 0.623727 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:09.709339 0.646831 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:10.356624 0.551975 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:10.909025 0.692828 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:11.602216 0.640006 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:12.242614 0.668385 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:12.911405 0.630229 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:13.541998 0.780465 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:14.322862 0.677106 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:15.000396 0.661848 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:15.662632 0.673011 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:16.336010 0.700930 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:17.037292 0.693129 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:17.730817 0.634460 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:18.365629 0.562290 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:18.928477 0.674759 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:19.603574 0.619189 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:20.223169 0.569811 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:20.793407 0.823621 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:21.638763 0.577654 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:22.216897 0.902467 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:23.125323 0.649177 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:23.774925 0.686256 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:24.461560 0.498469 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 861 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:24.960533 0.648747 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 862 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:25.609761 0.550313 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:26.160521 0.636191 udp 10.0.2.105 7010 <-> 74.90.25.128 9253 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:26.798004 0.661644 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:27.460059 0.719144 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:27.950655 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:23:28.179595 1.503732 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:29.683803 0.653444 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 702 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:30.337694 0.535647 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:30.873823 0.670988 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:31.545273 0.647013 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:32.192809 0.708534 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:32.901784 0.643721 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:33.546024 0.651019 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:34.207596 0.637838 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:34.845853 0.555431 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:35.401823 0.627663 udp 10.0.2.105 7010 <-> 128.255.240.103 1485 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:36.029989 0.683096 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:36.713562 0.562934 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:37.276992 0.923555 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:38.201222 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:23:46.066877 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:23:52.385787 0.591173 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:52.989000 0.000000 udp 10.0.2.105 7010 -> 78.189.27.204 9027 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:23:56.952149 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:23:58.904776 0.545599 udp 10.0.2.105 7010 <-> 78.148.20.134 5515 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:23:59.460351 0.000000 udp 10.0.2.105 7010 -> 46.200.194.209 7330 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:05.905284 0.000000 udp 10.0.2.105 7010 -> 93.91.145.150 5484 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:11.112360 0.000000 udp 10.0.2.105 7010 -> 79.31.252.81 1502 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:19.344405 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:23.950973 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:24:24.692533 0.000000 udp 10.0.2.105 7010 -> 97.84.151.95 8265 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:31.271824 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:38.502149 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1462 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:47.284665 0.000000 udp 10.0.2.105 7010 -> 108.60.40.229 2408 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:24:51.951013 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:24:53.943911 0.000000 udp 10.0.2.105 7010 -> 24.0.143.150 8896 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:02.816953 0.000000 udp 10.0.2.105 7010 -> 96.56.103.252 8236 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:11.519818 0.000000 udp 10.0.2.105 7010 -> 64.68.214.163 4146 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:16.446017 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:25:17.798452 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:26.019973 0.000000 udp 10.0.2.105 7010 -> 94.14.87.25 3614 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:33.831705 0.000000 udp 10.0.2.105 7010 -> 87.173.233.116 1288 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:40.210459 0.000000 udp 10.0.2.105 7010 -> 71.195.238.201 5119 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:44.947301 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:25:48.222199 0.000000 udp 10.0.2.105 7010 -> 190.82.113.10 2831 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:25:56.644145 0.000000 udp 10.0.2.105 7010 -> 88.231.5.110 2157 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:03.574364 0.000000 udp 10.0.2.105 7010 -> 95.229.248.36 6838 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:08.932172 0.682065 udp 10.0.2.105 7010 <-> 98.81.69.246 2218 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:26:09.635354 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:12.188731 3.002247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:26:13.448109 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:26:18.055232 0.000000 udp 10.0.2.105 7010 -> 78.186.182.140 6932 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:19.196412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:25.125067 0.000000 udp 10.0.2.105 7010 -> 93.193.157.44 7662 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:27.198114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:30.312871 0.000000 udp 10.0.2.105 7010 -> 188.6.138.115 9845 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:35.600263 0.000000 udp 10.0.2.105 7010 -> 217.92.83.247 5183 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:40.447164 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:26:40.817870 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:43.201370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:26:46.876575 0.000000 udp 10.0.2.105 7010 -> 174.75.66.37 7814 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:26:54.407333 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:02.358645 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:06.945062 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:27:10.275647 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:15.207332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:27:16.018510 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:22.598272 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:29.898573 0.000000 udp 10.0.2.105 7010 -> 203.88.142.222 8045 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:34.455090 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:27:36.247322 0.000000 udp 10.0.2.105 7010 -> 70.80.180.153 3003 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:43.568260 0.000000 udp 10.0.2.105 7010 -> 190.242.125.21 4875 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:49.216072 0.000000 udp 10.0.2.105 7010 -> 195.81.189.202 6274 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:27:56.036038 0.000000 udp 10.0.2.105 7010 -> 82.234.161.92 3615 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:00.952805 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:28:03.767322 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 3988 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:12.609680 0.000000 udp 10.0.2.105 7010 -> 213.123.141.236 6056 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:21.352526 0.000000 udp 10.0.2.105 7010 -> 69.246.129.53 4542 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:25.948830 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:28:27.781785 0.000000 udp 10.0.2.105 7010 -> 2.125.1.175 8354 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:34.761690 0.000000 udp 10.0.2.105 7010 -> 2.231.214.180 5011 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:40.349697 0.000000 udp 10.0.2.105 7010 -> 80.229.21.199 8837 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:46.809136 0.591682 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:47.400818 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 157 flow=Background 1970/01/02 08:28:51.445747 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:28:51.896156 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:28:57.774565 0.000000 udp 10.0.2.105 7010 -> 68.169.150.254 9247 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:03.523214 0.000000 udp 10.0.2.105 7010 -> 85.104.152.125 4750 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:11.734657 0.000000 udp 10.0.2.105 7010 -> 92.24.137.208 1970 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:16.451286 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:29:17.102474 0.609285 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:29:17.729276 0.000000 udp 10.0.2.105 7010 -> 4.30.208.222 5767 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:25.995552 0.000000 udp 10.0.2.105 7010 -> 190.153.251.210 4226 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:34.247109 0.000000 udp 10.0.2.105 7010 -> 12.202.109.50 6182 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:40.266152 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 7978 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:44.952269 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:29:48.728135 0.534040 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:29:49.278781 0.549298 udp 10.0.2.105 7010 <-> 82.211.144.75 2797 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:29:49.837909 0.525715 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:29:50.373103 0.000000 udp 10.0.2.105 7010 -> 134.83.182.38 3556 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:29:57.600515 0.000000 udp 10.0.2.105 7010 -> 63.192.3.4 8491 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:05.181706 0.000000 udp 10.0.2.105 7010 -> 95.254.21.9 5965 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:09.948475 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:30:12.832840 0.000000 udp 10.0.2.105 7010 -> 79.208.95.218 3393 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:18.000562 0.000000 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:23.418336 0.000000 udp 10.0.2.105 7010 -> 2.119.32.169 3930 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:30.217927 0.000000 udp 10.0.2.105 7010 -> 178.131.149.252 4785 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:34.954035 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:30:36.446702 0.000000 udp 10.0.2.105 7010 -> 93.217.193.198 9568 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:42.014379 0.000000 udp 10.0.2.105 7010 -> 88.78.137.193 4573 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:50.927467 0.000000 udp 10.0.2.105 7010 -> 213.107.116.154 4648 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:30:57.276716 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:01.953147 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:31:03.555457 0.655213 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 862 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:31:04.221995 0.000000 udp 10.0.2.105 7010 -> 4.26.24.202 8821 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:10.155465 0.000000 udp 10.0.2.105 7010 -> 62.212.44.70 7424 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:17.735770 0.000000 udp 10.0.2.105 7010 -> 58.108.229.248 5276 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:26.699148 0.000000 udp 10.0.2.105 7010 -> 50.201.186.50 1075 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:31.445873 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:31:35.140973 0.000000 udp 10.0.2.105 7010 -> 217.227.156.33 2759 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:43.213007 0.000000 udp 10.0.2.105 7010 -> 24.89.190.202 1888 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:49.431789 0.000000 udp 10.0.2.105 7010 -> 114.147.64.13 6238 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:54.588900 0.000000 udp 10.0.2.105 7010 -> 68.39.231.146 6915 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:31:59.445712 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:32:00.157036 0.000000 udp 10.0.2.105 7010 -> 88.232.37.212 3484 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:05.204096 0.518440 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:32:05.734564 0.000000 udp 10.0.2.105 7010 -> 74.94.239.102 7717 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:14.718032 0.000000 udp 10.0.2.105 7010 -> 70.49.6.92 2252 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:20.997134 0.000000 udp 10.0.2.105 7010 -> 118.39.80.146 3821 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:25.954064 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:32:26.555389 0.661058 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:32:27.233001 0.648540 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:32:27.900254 0.000000 udp 10.0.2.105 7010 -> 207.178.233.221 4313 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:34.787067 0.588119 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:32:35.384778 0.000000 udp 10.0.2.105 7010 -> 78.168.181.150 1830 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:42.547982 0.000000 udp 10.0.2.105 7010 -> 88.199.92.3 3443 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:51.090023 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:32:55.946771 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:32:59.682582 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:08.414861 0.575556 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:33:09.000136 0.000000 udp 10.0.2.105 7010 -> 41.206.58.154 4628 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:15.805519 0.550988 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:33:16.515885 0.000000 udp 10.0.2.105 7010 -> 24.234.120.184 3603 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:19.213881 3.000881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:33:20.452065 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:33:23.786942 0.674095 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:33:24.472174 0.000000 udp 10.0.2.105 7010 -> 75.147.161.153 5692 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:26.220284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:33:30.857759 0.000000 udp 10.0.2.105 7010 -> 178.6.217.176 6614 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:34.222161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:33:36.335579 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:45.027692 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:49.954627 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:33:50.225415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:33:51.517298 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:33:56.554339 0.000000 udp 10.0.2.105 7010 -> 24.106.191.250 6547 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:04.295256 0.000000 udp 10.0.2.105 7010 -> 69.39.19.222 8338 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:09.332456 0.000000 udp 10.0.2.105 7010 -> 75.144.91.1 5914 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:13.949112 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:34:15.701606 0.816147 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:34:16.527595 0.549730 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:34:17.100450 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:22.231442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:34:22.381522 0.000000 udp 10.0.2.105 7010 -> 95.244.87.124 9498 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:28.560349 0.000000 udp 10.0.2.105 7010 -> 50.78.115.105 9461 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:36.782033 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:41.449004 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:34:45.665272 0.685289 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:34:46.360465 0.000000 udp 10.0.2.105 7010 -> 24.172.35.138 4850 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:34:55.098569 0.000000 udp 10.0.2.105 7010 -> 77.47.21.172 2343 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:00.877113 0.000000 udp 10.0.2.105 7010 -> 71.89.131.162 9097 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:05.453006 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:35:08.607760 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:13.685096 0.000000 udp 10.0.2.105 7010 -> 71.8.36.162 8299 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:20.675004 0.000000 udp 10.0.2.105 7010 -> 84.193.250.193 2141 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:26.163601 0.000000 udp 10.0.2.105 7010 -> 82.127.255.252 3798 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:30.950038 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:35:32.882898 0.000000 udp 10.0.2.105 7010 -> 116.48.149.182 1024 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:38.991858 0.000000 udp 10.0.2.105 7010 -> 60.225.165.147 6710 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:47.233880 0.000000 udp 10.0.2.105 7010 -> 37.24.177.21 8496 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:54.583913 0.509155 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:35:55.102349 0.000000 udp 10.0.2.105 7010 -> 171.100.57.53 6819 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 08:35:59.451034 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:36:02.876197 0.692264 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/02 08:40:26.237453 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 08:40:33.244503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:40:37.781864 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 08:40:37.781971 2.888881 tcp 10.0.2.105 49511 -> 200.84.7.244 8038 FSPA* 0 0 15 1765 flow=From-Botnet-V2-TCP-Established 1970/01/02 08:40:41.245742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:40:57.248874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:41:29.255222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:47:33.261671 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:47:40.268526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:47:48.270144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:04.273189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:48:36.278745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:54:40.284919 3.002125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 08:54:47.292672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:54:55.293998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:11.297077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 08:55:43.303372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:01:47.309744 3.000741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:01:54.316466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:02.317824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:18.320897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:02:50.327058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:06:30.026952 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:06:30.027097 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:06:48.081287 1.033497 tcp 10.0.2.105 49512 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:06:49.115053 1.017413 tcp 10.0.2.105 49513 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:06:50.132824 2.400108 tcp 10.0.2.105 49514 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:06:52.533655 0.981701 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:53.515753 0.645353 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:54.161550 0.547142 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:54.709080 0.673153 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:55.382616 0.651223 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:56.034203 0.546137 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:06:56.580814 0.000000 udp 10.0.2.105 7010 -> 74.90.25.128 9253 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:07:14.488188 1.057546 tcp 10.0.2.105 49515 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:15.546029 1.050619 tcp 10.0.2.105 49516 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:16.596918 2.095841 tcp 10.0.2.105 49517 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:18.693790 0.612654 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:19.306782 0.646408 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:19.953588 0.676651 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:20.630585 0.613886 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:21.244814 0.555846 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:21.801024 0.647815 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:22.449207 0.685410 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:23.135033 0.709022 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:23.844450 0.709244 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:24.554057 0.664753 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:25.219164 0.613805 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:25.833393 0.000000 udp 10.0.2.105 7010 -> 128.255.240.103 1485 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:07:41.196937 1.015883 tcp 10.0.2.105 49518 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:42.212687 1.062372 tcp 10.0.2.105 49519 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:43.275356 2.107313 tcp 10.0.2.105 49520 -> 195.113.214.226 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:07:45.383361 0.568013 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:45.951772 0.692860 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:46.644984 0.552925 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:47.198317 0.841738 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:48.040574 0.577152 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:48.618120 0.535314 udp 10.0.2.105 7010 <-> 78.148.20.134 5515 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:49.153893 0.669056 udp 10.0.2.105 7010 <-> 98.81.69.246 2218 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:49.823381 0.593385 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:50.417208 0.537253 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:50.954852 0.547320 udp 10.0.2.105 7010 <-> 82.211.144.75 2797 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:51.502554 0.522360 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:52.025258 0.655431 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:52.681095 0.537434 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:53.218947 0.651999 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:53.871270 0.645649 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:54.517337 0.559170 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:55.076878 0.565429 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:55.642664 0.542617 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:56.185688 0.695172 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:56.881270 0.550056 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:57.431716 0.793152 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:58.225281 0.977277 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:07:59.202905 0.000000 udp 10.0.2.105 7010 -> 82.17.183.230 5853 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:08:17.709271 1.050881 tcp 10.0.2.105 49521 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:08:18.760569 1.037848 tcp 10.0.2.105 49522 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:08:19.798262 2.116508 tcp 10.0.2.105 49523 -> 195.113.214.226 443 SRPA* 0 0 29 15124 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:08:21.914548 0.682845 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:08:54.332485 3.002086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:09:01.340163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:09.341866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:25.344714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:09:57.351030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:10:40.673690 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:10:40.673941 4.153616 tcp 10.0.2.105 49524 -> 200.84.7.244 8038 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:16:01.356907 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:16:08.364179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:16:16.365872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:16:32.368890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:17:04.375141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:08.381679 3.001150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:23:15.388136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:23.389656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:23:39.392633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:24:11.398943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:15.405730 3.000550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:30:22.412152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:30.413834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:30:46.416889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:31:18.422840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:37:22.429170 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:37:29.436457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:37:37.437645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:37:53.441026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:25.446553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:38:50.853739 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:38:50.853995 0.563461 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:38:51.417808 0.000000 udp 10.0.2.105 7010 -> 74.90.25.128 9253 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:39:09.893841 1.044139 tcp 10.0.2.105 49525 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:10.938293 1.037871 tcp 10.0.2.105 49526 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:11.976441 2.116316 tcp 10.0.2.105 49527 -> 195.113.214.226 443 SRPA* 0 0 24 13394 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:14.093429 0.000000 udp 10.0.2.105 7010 -> 128.255.240.103 1485 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:39:30.421038 1.050733 tcp 10.0.2.105 49528 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:31.472095 1.040421 tcp 10.0.2.105 49529 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:32.512849 2.150275 tcp 10.0.2.105 49530 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:34.663729 0.000000 udp 10.0.2.105 7010 -> 82.17.183.230 5853 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 09:39:53.384316 1.051455 tcp 10.0.2.105 49531 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:54.436118 1.052286 tcp 10.0.2.105 49532 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:55.488728 2.078542 tcp 10.0.2.105 49533 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:39:57.568039 0.636780 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:39:58.205201 0.797711 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:39:59.003307 0.522117 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:39:59.525827 0.689111 udp 10.0.2.105 7010 <-> 24.234.43.35 8100 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:00.215347 0.634010 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:00.849727 0.550529 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:01.400616 0.672698 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:02.073715 0.653525 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:02.727596 0.680377 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:03.408392 0.639301 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:04.048067 0.551054 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:04.599546 0.680278 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:05.280195 0.649655 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:05.930242 0.700472 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:06.631119 0.643368 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:07.274904 0.662647 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:07.937938 0.606528 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:08.544797 0.550193 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:09.095414 0.565417 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:09.661212 0.667462 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:10.329014 0.827575 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:11.156919 0.573637 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:11.730942 0.544366 udp 10.0.2.105 7010 <-> 78.148.20.134 5515 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:12.275679 0.675552 udp 10.0.2.105 7010 <-> 98.81.69.246 2218 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:12.951603 0.532656 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:13.484675 0.600186 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:14.085239 0.515698 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:14.601310 0.567507 udp 10.0.2.105 7010 <-> 82.211.144.75 2797 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:15.169195 0.613290 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:15.782799 0.547546 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:16.330764 0.641146 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:16.972482 0.645297 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:17.618909 0.611285 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:18.230624 0.544390 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:18.775428 0.665185 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:19.441033 0.669573 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:20.110941 0.580818 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:20.452196 0.000204 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 09:40:20.692144 0.796969 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:21.489464 0.713764 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:22.203623 0.657561 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/02 09:40:44.827857 2.847787 tcp 10.0.2.105 49534 -> 200.84.7.244 8038 FSPA* 0 0 15 1658 flow=From-Botnet-V2-TCP-Established 1970/01/02 09:44:29.452456 3.001901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 09:44:36.460464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:44:44.461662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:00.464565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:45:32.470750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:51:36.476199 3.002034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:51:43.484273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:51:51.485946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:07.488651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:52:39.494540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:58:43.500241 3.002324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 09:58:50.508033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:58:58.509523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:14.512738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 09:59:46.518561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:05:50.525628 3.000424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:05:57.532540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:05.533715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:21.536485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:06:53.542660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:10:30.564867 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:10:30.564976 0.576181 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:10:31.141552 1.051854 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:10:32.193809 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:10:47.679459 2.791708 tcp 10.0.2.105 49535 -> 200.84.7.244 8038 FSPA* 0 0 15 1575 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:10:48.644079 1.071813 tcp 10.0.2.105 49536 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:10:49.716176 1.081707 tcp 10.0.2.105 49537 -> 195.113.214.226 80 SRPA* 0 0 20 14735 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:10:50.798512 0.535124 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:10:51.334051 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 8100 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:11:09.541851 1.057093 tcp 10.0.2.105 49538 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:10.599241 1.023200 tcp 10.0.2.105 49539 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:11.622701 2.368887 tcp 10.0.2.105 49540 -> 195.113.214.226 443 SRPA* 0 0 38 27291 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:13.992186 0.646895 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:14.639429 0.571259 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:15.211039 0.647634 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:15.859020 0.661717 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:16.521203 0.632194 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:17.153794 0.641056 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:17.795224 0.546683 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:18.342324 0.650528 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:18.993245 0.624325 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:19.617955 0.705609 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:20.323923 0.664957 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:20.989271 0.690559 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:21.680205 0.602509 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:22.283086 0.570580 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:22.854102 0.559465 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:23.413968 0.680485 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:24.094823 0.849259 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:24.944565 0.568013 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:25.513001 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:11:42.098684 1.073917 tcp 10.0.2.105 49541 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:43.172511 1.014962 tcp 10.0.2.105 49542 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:44.187787 2.131158 tcp 10.0.2.105 49543 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:11:46.319669 0.689589 udp 10.0.2.105 7010 <-> 98.81.69.246 2218 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:47.009667 0.541066 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:47.551095 0.638041 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:48.189529 0.523862 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:48.713801 0.528608 udp 10.0.2.105 7010 <-> 82.211.144.75 2797 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:49.242770 0.655417 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:49.898562 0.564497 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:50.463483 0.642909 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:51.106746 1.253908 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:52.361073 0.578565 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:52.940037 0.544576 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:53.484998 0.591085 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:54.076611 0.673062 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:54.750087 0.555967 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:55.306460 0.808168 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:56.115044 0.679841 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:11:56.795269 0.685780 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:12:57.548019 3.002017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:13:04.555768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:12.557931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:13:28.560769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:14:00.566346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:20:04.573001 3.001075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:20:11.579823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:20:19.581477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:20:35.584774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:21:07.590424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:11.596596 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:27:18.603891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:26.605732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:27:42.608866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:28:14.614331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:34:18.621683 3.001233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:34:25.628306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:34:33.629705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:34:49.632738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:35:21.638258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:40:50.471916 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:40:50.472072 3.648875 tcp 10.0.2.105 49544 -> 200.84.7.244 8038 FSPA* 0 0 15 1565 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:41:25.644108 3.002381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:41:32.651632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:41:40.653609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:41:56.656378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:16.305074 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 10:42:16.305178 0.509012 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:42:16.814617 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 8100 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:42:28.662909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:42:35.474254 1.080402 tcp 10.0.2.105 49545 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:42:36.554979 1.026262 tcp 10.0.2.105 49546 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:42:37.581594 2.614661 tcp 10.0.2.105 49547 -> 195.113.214.226 443 SRPA* 0 0 39 27985 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:42:40.196827 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:42:58.466385 1.057071 tcp 10.0.2.105 49548 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:42:59.523697 1.096648 tcp 10.0.2.105 49549 -> 195.113.214.226 80 SRPA* 0 0 19 13395 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:00.620862 0.601032 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:01.222226 1.016689 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:02.239326 0.546084 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:02.785826 0.648391 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:03.434547 0.529830 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:03.964775 0.667331 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:04.632528 0.668819 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:05.301773 0.656265 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:05.958414 0.647674 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:06.606485 0.559931 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:07.166791 0.682162 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:07.849302 0.654174 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:08.503849 0.699742 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:09.203988 0.659092 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:09.863504 0.663117 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:10.526991 0.628664 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:11.156039 0.564440 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:11.720852 0.753768 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:12.475018 0.565782 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:13.041222 0.834035 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:13.875648 0.580995 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:14.457007 0.000000 udp 10.0.2.105 7010 -> 98.81.69.246 2218 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:43:32.405921 1.176002 tcp 10.0.2.105 49550 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:33.582272 1.042943 tcp 10.0.2.105 49551 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:34.625522 2.557983 tcp 10.0.2.105 49552 -> 195.113.214.226 443 SRPA* 0 0 37 27877 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:37.184075 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:43:54.127181 1.069663 tcp 10.0.2.105 49553 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:55.197139 1.042089 tcp 10.0.2.105 49554 -> 195.113.214.226 80 SRPA* 0 0 20 14755 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:43:56.239853 0.627172 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:56.867415 0.520501 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:43:57.388428 0.000000 udp 10.0.2.105 7010 -> 82.211.144.75 2797 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:44:14.095664 1.111256 tcp 10.0.2.105 49555 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:15.207231 1.028579 tcp 10.0.2.105 49556 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:16.235666 2.390961 tcp 10.0.2.105 49557 -> 195.113.214.226 443 SRPA* 0 0 39 27985 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:18.627275 0.646285 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:19.273919 0.533598 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:19.807858 0.641073 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:20.449326 0.660464 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:21.110148 0.561692 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:21.672262 0.548980 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:22.221619 0.561626 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:22.783692 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 10:44:39.061663 1.057537 tcp 10.0.2.105 49558 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:40.119473 1.038668 tcp 10.0.2.105 49559 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:41.158468 2.625554 tcp 10.0.2.105 49560 -> 195.113.214.226 443 SRPA* 0 0 35 25237 flow=From-Botnet-V2-TCP-Established 1970/01/02 10:44:43.784640 0.556756 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:44.341771 0.796449 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:45.138682 0.721570 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:44:45.860658 0.702606 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/02 10:48:32.668393 3.001533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 10:48:39.675812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:48:47.677554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:03.680201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:49:35.686187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:55:39.693410 3.000474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 10:55:46.700028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:55:54.701649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:10.704385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 10:56:42.710337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:02:46.715772 3.002204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:02:53.723856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:01.725364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:17.728445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:03:49.734236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:09:53.740520 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:10:00.747616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:08.749414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:24.752649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:10:54.124899 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:10:54.125022 2.821930 tcp 10.0.2.105 49561 -> 200.84.7.244 8038 FSPA* 0 0 15 1676 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:10:56.758303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:15:05.496042 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:15:05.496151 0.691533 udp 10.0.2.105 7010 -> 98.81.69.246 2218 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 11:15:06.187684 0.000000 icmp 98.81.69.246 0x0303 -> 10.0.2.105 0xaa08 URP 192 1 224 flow=Background 1970/01/02 11:15:23.825638 1.041086 tcp 10.0.2.105 49562 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:24.866975 1.038400 tcp 10.0.2.105 49563 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:25.905706 2.573697 tcp 10.0.2.105 49564 -> 195.113.214.226 443 SRPA* 0 0 37 27027 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:28.480128 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 11:15:45.094355 1.040526 tcp 10.0.2.105 49565 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:46.135146 1.043993 tcp 10.0.2.105 49566 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:47.179423 2.096314 tcp 10.0.2.105 49567 -> 195.113.214.226 443 SRPA* 0 0 24 13200 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:15:49.276487 0.000000 udp 10.0.2.105 7010 -> 82.211.144.75 2797 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 11:16:05.143265 1.014784 tcp 10.0.2.105 49568 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:16:06.158337 1.013829 tcp 10.0.2.105 49569 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:16:07.172439 2.079837 tcp 10.0.2.105 49570 -> 195.113.214.226 443 SRPA* 0 0 27 13594 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:16:09.252499 0.646402 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:09.899311 0.868351 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:10.768030 0.569845 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:11.338219 0.891914 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:12.230532 0.546344 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:12.777282 0.664893 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:13.442584 0.544126 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:13.987103 0.641964 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:14.629412 0.654942 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:15.284769 0.654286 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:15.939401 0.638794 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:16.578581 0.562073 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:17.141083 0.689328 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:17.830775 0.706252 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:18.537413 0.634933 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:19.172761 0.644712 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:19.817872 0.621500 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:20.439778 0.670308 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:21.110505 0.558219 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:21.669118 0.671333 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:22.340839 0.560504 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:22.901748 0.912369 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:23.814510 0.564639 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:24.379628 0.616651 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:24.996655 0.528495 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:25.525557 0.631274 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:26.157234 0.547195 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:26.704793 0.653414 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:27.358619 0.640795 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:27.999799 0.555584 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:28.555776 0.539164 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:29.095343 0.559899 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:29.655673 0.556255 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:30.212363 0.999119 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:31.211887 0.689135 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:31.901433 0.693656 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:16:31.950207 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:17:00.764180 3.002145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 11:17:07.771526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:15.773280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:17:31.776543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:18:03.782196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:24:07.789076 3.001194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:24:14.795417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:24:22.797139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:24:38.800451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:25:10.806105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:14.812677 3.001179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:31:21.819968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:29.821189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:31:45.823951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:32:17.830187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:38:21.835959 3.002339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:38:28.843696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:38:36.844920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:38:52.847863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:39:24.854361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:40:56.947031 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:40:56.947201 2.942382 tcp 10.0.2.105 49571 -> 200.84.7.244 8038 FSPA* 0 0 15 1801 flow=From-Botnet-V2-TCP-Established 1970/01/02 11:45:28.859951 3.002280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:45:35.867687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:45:43.868973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:45:59.872456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:31.878177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:46:46.740008 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:46:46.740098 0.701228 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:47.441680 0.802690 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:48.244744 0.717028 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:48.962196 0.652228 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:49.614825 0.529926 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:50.145171 0.639917 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:50.785475 0.570047 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:51.355936 0.652892 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:52.009220 1.440650 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:53.450254 0.647118 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:54.097731 0.647004 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:54.745122 0.552316 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:55.297819 0.670938 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:55.969145 0.700126 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:56.669652 0.643400 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:57.313499 0.664497 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:57.978386 0.646459 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:58.625249 0.694681 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:59.320438 0.559946 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:46:59.880798 0.681967 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:00.563166 0.545232 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:01.108826 0.831199 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:01.940548 0.576914 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:02.517814 0.607419 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:03.125599 0.502086 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:03.628084 0.644228 udp 10.0.2.105 7010 <-> 67.36.127.126 9167 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:04.272750 0.525751 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:04.798921 0.655115 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:05.454449 0.655734 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:06.110592 0.585264 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:06.696326 0.557443 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:07.254178 0.564299 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:07.818860 0.537154 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:08.356557 0.797703 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:09.154633 0.710919 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:09.865946 0.694830 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/02 11:47:10.443804 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 11:52:35.885128 3.000500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:52:42.891923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:52:50.893473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:06.896218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:53:38.902108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:59:42.908867 3.000644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 11:59:49.915815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 11:59:57.917274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:13.919957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:00:45.925987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:06:49.931957 3.002109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:06:56.939595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:04.941103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:20.943984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:07:52.949941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:10:59.889469 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:10:59.889661 2.962583 tcp 10.0.2.105 49572 -> 200.84.7.244 8038 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:13:56.956678 3.000909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:14:03.963357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:11.965050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:27.968353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:14:59.974305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:17:27.636670 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:17:27.636804 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:17:46.436600 1.056417 tcp 10.0.2.105 49573 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:17:47.493296 1.092479 tcp 10.0.2.105 49574 -> 195.113.214.226 80 SRPA* 0 0 18 13318 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:17:48.586326 0.522075 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:49.108821 0.572488 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:49.681656 1.072923 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:50.754984 0.521243 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:51.276640 0.650302 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:51.927333 0.545295 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:52.472996 0.649406 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:53.122749 0.681394 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:53.804554 0.652959 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:54.457922 0.632521 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:55.090860 0.557255 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:55.648601 0.678642 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:56.327699 0.707956 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:57.036079 0.652328 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:57.688829 0.636657 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:58.325826 0.640264 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:58.966441 0.675528 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:17:59.642369 0.558405 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:00.201117 0.745339 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:00.946820 0.558602 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:01.505824 0.836220 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:02.342438 0.560679 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:02.903484 0.564900 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:03.468717 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:18:20.463216 1.069260 tcp 10.0.2.105 49575 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:21.532716 1.064911 tcp 10.0.2.105 49576 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:22.597972 2.623058 tcp 10.0.2.105 49577 -> 195.113.214.226 443 SRPA* 0 0 40 28039 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:25.221709 0.000000 udp 10.0.2.105 7010 -> 67.36.127.126 9167 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:18:43.176465 1.090417 tcp 10.0.2.105 49578 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:44.267125 1.041546 tcp 10.0.2.105 49579 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:45.308951 2.110780 tcp 10.0.2.105 49580 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:18:47.420500 0.516868 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:18:47.937780 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:19:03.125321 1.048348 tcp 10.0.2.105 49581 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:19:04.173925 1.035456 tcp 10.0.2.105 49582 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:19:05.209674 2.154137 tcp 10.0.2.105 49583 -> 195.113.214.226 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:19:07.364467 0.662967 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:08.027830 0.558640 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:08.586805 0.557120 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:09.144310 0.544600 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:09.689287 0.558349 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:10.248006 0.776943 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:11.025363 0.711242 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:19:11.736974 0.696799 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:21:03.980749 3.000851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:21:10.987698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:18.988941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:21:34.991687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:22:06.998041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:28:11.004843 3.000644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:28:18.011546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:28:26.012815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:28:42.016137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:29:14.021902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:35:18.027693 3.002320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:35:25.035550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:35:33.036956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:35:49.039755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:36:21.045854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:41:02.851825 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:41:02.852003 0.725808 tcp 10.0.2.105 49584 -> 200.84.7.244 8038 SPA_* 0 0 9 1011 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:41:11.057973 0.027103 tcp 10.0.2.105 49584 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:42:25.051906 3.001820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:42:32.059587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:42:40.060781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:42:56.064031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:43:28.070081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:49:30.301219 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 12:49:30.301354 0.693063 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:49:30.994817 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:49:32.075897 3.001849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 12:49:39.083365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:49:47.084745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:49:49.852713 1.039618 tcp 10.0.2.105 49585 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:49:50.892566 1.014081 tcp 10.0.2.105 49586 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:49:51.906970 2.176720 tcp 10.0.2.105 49587 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:49:54.084477 0.000000 udp 10.0.2.105 7010 -> 67.36.127.126 9167 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:50:03.087956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:10.539504 1.053688 tcp 10.0.2.105 49588 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:50:11.593546 0.997932 tcp 10.0.2.105 49589 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:50:12.591799 2.173433 tcp 10.0.2.105 49590 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:50:14.765775 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:50:31.410006 1.036013 tcp 10.0.2.105 49591 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:50:32.446303 1.095617 tcp 10.0.2.105 49592 -> 195.113.214.226 80 SRPA* 0 0 18 13325 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:50:33.542572 0.495894 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:34.038861 0.541511 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:34.580775 0.641935 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:35.093936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:50:35.223111 0.534042 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:35.757562 0.666876 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:36.424830 0.553629 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:36.978858 0.650002 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:37.629217 0.700077 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:38.329670 0.629666 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:38.959754 0.659414 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:39.619580 0.569985 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:40.189977 0.681662 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:40.872040 0.701364 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:41.573821 0.629738 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:42.204004 0.656652 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:42.861025 0.651727 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:43.513162 0.670720 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:44.184273 0.563116 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:44.747845 0.671305 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:45.419493 0.578881 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:50:45.998740 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 12:51:03.055222 1.037676 tcp 10.0.2.105 49593 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:51:04.093138 1.081325 tcp 10.0.2.105 49594 -> 195.113.214.226 80 SRPA* 0 0 19 14688 flow=From-Botnet-V2-TCP-Established 1970/01/02 12:51:05.175120 0.841016 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:06.016631 0.592444 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:06.609514 0.554706 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:07.164617 0.648492 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:07.813506 0.538211 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:08.352102 0.579592 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:08.932096 0.554788 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:09.487225 0.558676 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:10.046232 0.812105 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:10.858718 0.728592 udp 10.0.2.105 7010 <-> 76.220.6.173 2188 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:51:11.587663 0.681912 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 12:56:39.099704 3.002173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 12:56:46.107353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:56:54.108906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:10.111521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 12:57:42.117557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:03:46.123618 3.002250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:03:53.131550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:01.132772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:17.135998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:04:49.141925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:10:53.147677 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:11:00.154899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:08.156707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:11.091612 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:11:11.091709 3.076322 tcp 10.0.2.105 49595 -> 200.84.7.244 8038 FSPA* 0 0 15 1722 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:11:24.159880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:11:56.165470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:00.171492 3.001901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:18:07.179577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:15.180406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:18:31.183963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:19:03.189435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:21:24.713593 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:21:24.713771 0.764517 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:25.478649 0.647010 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:26.126054 0.535948 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:26.662403 0.626188 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:27.288938 0.635758 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:27.925107 0.536602 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:28.462052 0.628676 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:29.091130 0.535208 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:29.626740 0.653087 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:30.280165 0.626567 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:30.907115 0.638496 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:31.546042 0.551176 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:32.097614 0.652383 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:32.750425 0.641237 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:33.392034 0.701025 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:34.093461 0.768867 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:34.862759 0.655456 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:35.518625 0.605171 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:36.124174 0.677467 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:36.802037 0.573768 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:37.376140 0.671626 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:38.048193 0.567133 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:38.615712 0.949766 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:39.565839 0.605470 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:40.171719 0.522865 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:40.694942 0.767493 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:41.462827 0.576350 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:42.039602 0.564873 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:42.604860 0.568944 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:21:43.174208 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 13:21:59.024892 1.079738 tcp 10.0.2.105 49596 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:22:00.104975 1.076171 tcp 10.0.2.105 49597 -> 195.113.214.226 80 SRPA* 0 0 18 13332 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:22:01.181673 0.807159 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:22:01.989211 0.000000 udp 10.0.2.105 7010 -> 76.220.6.173 2188 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 13:22:19.733777 1.067287 tcp 10.0.2.105 49598 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:22:20.801323 1.087233 tcp 10.0.2.105 49599 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:22:21.888825 2.106378 tcp 10.0.2.105 49600 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:22:23.995954 0.711977 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:25:07.196179 3.001190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:25:14.203519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:22.204508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:25:38.207611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:26:10.213806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:32:14.220393 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:32:21.227057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:32:29.228616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:32:45.231421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:33:17.237477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:39:21.243302 3.002070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:39:28.251025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:39:36.252487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:39:52.255885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:40:24.261673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:41:14.174207 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:41:14.174365 4.942498 tcp 10.0.2.105 49601 -> 200.84.7.244 8038 FSPA* 0 0 15 1556 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:46:28.267182 3.001822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 13:46:35.274961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:46:43.276511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:46:59.279969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:47:31.285589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:52:35.983969 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 13:52:35.984313 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 13:52:53.591455 1.072633 tcp 10.0.2.105 49602 -> 195.113.214.251 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:52:54.664620 1.042046 tcp 10.0.2.105 49603 -> 195.113.214.226 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:52:55.706986 2.122888 tcp 10.0.2.105 49604 -> 195.113.214.226 443 SRPA* 0 0 22 12879 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:52:57.830447 0.000000 udp 10.0.2.105 7010 -> 76.220.6.173 2188 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 13:53:16.353331 1.071433 tcp 10.0.2.105 49605 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:53:17.424616 1.092795 tcp 10.0.2.105 49606 -> 195.113.214.226 80 SRPA* 0 0 18 13374 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:53:18.518023 0.573273 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:19.091725 0.694034 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:19.786103 0.522641 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:20.309159 0.571416 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:20.880972 0.646213 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:21.527571 0.638760 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:22.166721 0.509903 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:22.677046 0.560417 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:23.237855 0.691860 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:23.930121 0.643000 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:24.573531 0.534934 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:25.108854 0.632102 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:25.741368 0.670562 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:26.412358 0.716816 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:27.129572 0.700457 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:27.830434 0.618436 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:28.449343 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 13:53:35.292505 3.000827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 13:53:42.298742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:53:46.356211 1.070146 tcp 10.0.2.105 49607 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:53:47.426657 1.035405 tcp 10.0.2.105 49608 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:53:48.462372 2.168933 tcp 10.0.2.105 49609 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/02 13:53:50.300389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:53:50.631901 0.635528 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:51.267876 0.663595 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:51.931889 0.574344 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:52.506583 0.663783 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:53.170761 0.554382 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:53.725568 0.825305 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:54.551231 0.598141 udp 10.0.2.105 7010 <-> 79.36.225.196 6654 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:55.149776 0.534047 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:55.684169 0.646359 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:56.330927 0.568195 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:56.899502 0.579735 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:57.479614 0.558453 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:58.038420 1.719072 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:53:59.757884 0.694497 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/02 13:54:06.303924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 13:54:38.309795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:00:42.315688 3.001223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:00:49.322953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:00:57.324229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:13.327691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:01:45.333705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:07:49.339294 3.001759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:08:00.573446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:08.574276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:24.577426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:08:56.583867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:11:21.171987 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:11:21.172075 2.897406 tcp 10.0.2.105 49610 -> 200.84.7.244 8038 FSPA* 0 0 15 1590 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:15:05.596553 3.001885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:15:12.604439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:20.605655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:15:36.609048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:16:08.615111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:12.621324 3.001398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:22:19.628073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:27.629880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:22:43.632802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:23:15.639003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:24:22.375356 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:24:22.375486 0.690994 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:23.066842 0.576520 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:23.643778 0.509101 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:24.153234 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 14:24:40.843492 1.079958 tcp 10.0.2.105 49611 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:24:41.923723 1.045230 tcp 10.0.2.105 49612 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:24:42.969273 2.612370 tcp 10.0.2.105 49613 -> 195.113.214.226 443 SRPA* 0 0 36 27221 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:24:45.582362 0.760518 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:46.343297 0.621926 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:46.965558 0.632685 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:47.598650 0.566716 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:48.165785 0.529956 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:48.696109 0.693254 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:49.389770 0.555307 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:49.945464 0.643552 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:50.589412 0.641374 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:51.231159 0.670708 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:51.902266 0.696437 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:52.599106 0.718041 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:53.317568 0.637565 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:53.955535 0.586138 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:54.542111 0.695049 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:55.237555 0.568432 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:55.806391 0.672408 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:56.479185 0.592221 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:24:57.071810 0.000000 udp 10.0.2.105 7010 -> 79.36.225.196 6654 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 14:25:14.631080 1.071245 tcp 10.0.2.105 49614 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:15.702567 1.016880 tcp 10.0.2.105 49615 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:16.719700 2.190860 tcp 10.0.2.105 49616 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:18.911054 0.842709 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:19.754156 0.538163 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:20.292696 0.642313 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:20.935365 0.586388 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:21.522151 0.574290 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:22.096838 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 14:25:40.528479 1.051271 tcp 10.0.2.105 49617 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:41.580044 1.044994 tcp 10.0.2.105 49618 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:42.625396 2.166668 tcp 10.0.2.105 49619 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:25:44.792802 1.108636 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:25:45.901832 0.692083 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:29:19.645420 3.000842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 14:29:26.651841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:34.653822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:29:50.656470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:30:22.663011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:36:26.670039 3.000647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:36:33.676135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:36:41.677293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:36:57.771134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:37:29.776997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:41:24.104314 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:41:24.104561 2.787791 tcp 10.0.2.105 49620 -> 200.84.7.244 8038 FSPA* 0 0 15 1608 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:43:33.782292 3.002410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:43:40.790266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:43:48.791932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:04.794987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:44:36.801047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:50:40.807376 3.000901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 14:50:47.814140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:50:55.815997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:12.179098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:51:44.185117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:56:03.428597 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 14:56:03.428706 0.675057 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:04.104138 0.000000 udp 10.0.2.105 7010 -> 79.36.225.196 6654 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 14:56:22.618619 1.077495 tcp 10.0.2.105 49621 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:56:23.696392 1.061379 tcp 10.0.2.105 49622 -> 195.113.214.226 80 SRPA* 0 0 20 14721 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:56:24.758391 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 14:56:41.123288 1.054612 tcp 10.0.2.105 49623 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:56:42.178252 1.043636 tcp 10.0.2.105 49624 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:56:43.222179 2.387825 tcp 10.0.2.105 49625 -> 195.113.214.226 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/02 14:56:45.610725 0.657598 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:46.268719 0.784385 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:47.053487 0.516480 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:47.570312 0.612781 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:48.183440 0.667374 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:48.851263 0.658733 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:49.510395 0.566015 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:50.076794 0.530307 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:50.607486 0.546977 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:51.154859 0.669061 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:51.824262 0.640514 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:52.465138 0.614606 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:53.080141 0.698860 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:53.779370 0.663405 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:54.443202 0.669958 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:55.113551 0.627903 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:55.741852 0.681377 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:56.423565 0.650338 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:57.074384 0.580654 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:57.655440 0.707244 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:58.363077 0.550303 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:58.913782 0.539250 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:56:59.453426 0.834301 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:00.288090 0.592484 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:00.880989 0.637362 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:01.518754 0.568356 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:02.087558 0.788560 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:02.876501 0.687620 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/02 14:57:48.190969 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 14:57:55.198512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:03.200408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:19.202828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 14:58:51.209536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:04:55.216063 3.000676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:05:02.222267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:10.223790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:26.227013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:05:58.233522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:11:27.066646 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:11:27.066759 2.954149 tcp 10.0.2.105 49626 -> 200.84.7.244 8038 FSPA* 0 0 15 1618 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:12:02.239894 3.000597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:12:09.246733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:17.248036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:12:33.250844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:13:05.257419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:09.263430 3.001199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:19:16.270721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:24.272206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:19:40.274904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:20:12.281003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:16.287300 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:26:23.294458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:31.295692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:26:47.298857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:19.304938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:27:23.361356 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:27:23.361529 0.696524 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:24.058416 0.662836 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:24.721600 0.665866 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:25.387855 0.849904 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:26.238153 0.574242 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:26.812730 0.638883 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:27.452008 0.641368 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:28.093742 0.557415 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:28.651517 0.524212 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:29.176061 0.571978 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:29.748461 0.673516 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:30.422409 0.667207 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:31.090023 0.651572 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:31.742006 0.696379 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:32.438756 0.643983 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:33.083134 0.703722 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:33.787201 0.635412 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:34.423045 0.669306 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:35.092749 0.616041 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:35.709119 0.574215 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:36.283727 0.722571 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:37.006724 0.589132 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:37.596202 0.528337 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:38.124947 0.794073 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:38.919430 0.581851 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:39.501668 0.647693 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:40.149770 0.577064 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:40.727230 0.809681 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:27:41.537354 0.801100 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:33:23.310456 3.002392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:33:30.318666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:38.320034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:33:54.323058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:34:26.329318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:40:30.335336 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:40:37.342222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:40:45.344096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:01.346777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:41:30.028572 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:41:30.028743 3.777584 tcp 10.0.2.105 49627 -> 200.84.7.244 8038 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:41:33.353296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:47:37.358291 3.002361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:47:44.366136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:47:52.367904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:08.371221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:48:40.376769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:54:44.382702 3.002100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 15:54:51.390380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:54:59.392154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:15.395059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:55:47.400769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 15:58:07.512402 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 15:58:07.512591 0.658186 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:08.171158 0.677529 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:08.849058 0.565383 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:09.414842 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 15:58:27.704500 1.040507 tcp 10.0.2.105 49628 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:28.745334 1.033829 tcp 10.0.2.105 49629 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:29.779461 2.124679 tcp 10.0.2.105 49630 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:31.904892 0.561123 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:32.466389 0.619756 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:33.086514 0.654534 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:33.741458 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 15:58:51.006062 1.021186 tcp 10.0.2.105 49631 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:52.027562 1.058980 tcp 10.0.2.105 49632 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:53.086833 2.091413 tcp 10.0.2.105 49633 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/02 15:58:55.178941 0.538600 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:55.717937 0.563901 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:56.282277 0.671957 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:56.954580 0.632730 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:57.587644 0.633982 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:58.221981 0.660222 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:58.882572 0.664911 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:58:59.547851 0.758923 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:00.307190 0.641723 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:00.949283 0.808953 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:01.758637 0.622666 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:02.381713 0.571580 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:02.953691 0.698404 udp 10.0.2.105 7010 <-> 99.8.180.43 8328 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:03.652738 0.527376 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:04.180706 0.550933 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:04.731993 0.831036 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:05.563385 0.574321 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:06.138052 0.639945 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:06.778303 0.565812 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:07.344468 0.791648 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/02 15:59:08.136561 0.672800 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:01:51.406257 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:01:58.414150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:06.415827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:22.418521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:02:54.424934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:08:58.431378 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:09:05.437985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:13.439965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:09:29.442989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:10:01.449206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:11:33.812123 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:11:33.812325 3.017212 tcp 10.0.2.105 49634 -> 200.84.7.244 8038 FSPA* 0 0 15 1628 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:16:05.454834 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:16:12.462115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:20.463799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:16:36.467312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:17:08.473047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:12.478236 3.002598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:23:19.486435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:27.487512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:23:43.490904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:24:15.497143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:29:35.918043 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:29:35.918231 0.950583 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:29:36.869767 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 16:29:52.834640 1.035745 tcp 10.0.2.105 49635 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:29:53.870692 1.070492 tcp 10.0.2.105 49636 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:29:54.941436 2.119236 tcp 10.0.2.105 49637 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:29:57.061246 0.663612 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:29:57.725289 0.685992 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:29:58.411680 0.542177 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:29:58.954239 0.567062 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:29:59.521681 0.642275 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:00.164368 0.761606 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:00.926485 0.535527 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:01.462412 0.681206 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:02.144045 0.576953 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:02.721405 0.647822 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:03.369637 0.659094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:04.029043 0.669279 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:04.698729 0.644581 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:05.343710 0.746528 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:06.090684 0.612426 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:06.703499 0.860067 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:07.563951 0.614411 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:08.178807 0.564053 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:08.743312 0.000000 udp 10.0.2.105 7010 -> 99.8.180.43 8328 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 16:30:19.503323 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 16:30:26.510137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:26.611691 1.035544 tcp 10.0.2.105 49638 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:30:27.647498 1.059134 tcp 10.0.2.105 49639 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:30:28.706931 2.145402 tcp 10.0.2.105 49640 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:30:30.853094 0.564772 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:31.418230 0.548795 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:31.967426 0.817324 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:32.785152 0.581282 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:33.366850 0.617882 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:33.985105 0.577271 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:34.511606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:30:34.562791 0.798898 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:35.362092 0.699048 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/02 16:30:50.514663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:31:22.520554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:37:26.527609 3.000550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:37:33.534208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:37:41.535721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:37:57.538749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:38:29.545121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:41:36.834602 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 16:41:36.834843 0.739581 tcp 10.0.2.105 49641 -> 200.84.7.244 8038 SPA_* 0 0 9 1099 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:41:45.066125 0.013097 tcp 10.0.2.105 49641 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/02 16:44:33.550665 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:44:40.557827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:44:48.559642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:04.562613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:45:36.568483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:51:40.574652 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:51:47.582034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:51:55.583502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:11.586789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:52:43.592345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:58:47.599364 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 16:58:54.605843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:02.607376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:18.610729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 16:59:50.616318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:00:48.049633 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:00:48.049730 0.000000 udp 10.0.2.105 7010 -> 99.8.180.43 8328 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 17:01:03.894404 1.070229 tcp 10.0.2.105 49642 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:04.964946 1.052314 tcp 10.0.2.105 49643 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:06.017614 2.134993 tcp 10.0.2.105 49644 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:01:08.153188 1.005624 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:09.159143 0.668377 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:09.827931 0.690038 udp 10.0.2.105 7010 <-> 99.118.244.90 1117 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:10.518393 0.534339 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:11.053146 0.557329 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:11.610861 0.652115 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:12.263380 0.644506 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:12.908260 0.529378 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:13.438000 1.236032 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:14.674410 0.573698 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:15.248566 0.665692 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:15.914646 0.624638 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:16.539691 0.660218 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:17.200479 0.742141 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:17.943026 0.670895 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:18.614327 0.613573 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:19.228446 0.684688 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:19.913473 0.618182 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:20.532068 0.560040 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:21.092575 0.569746 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:21.662707 0.539171 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:22.202284 0.816210 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:23.018906 0.581518 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:23.600828 0.645481 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:24.246707 0.576522 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:24.823613 0.816833 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:01:25.640868 0.698417 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:05:54.622939 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:06:01.629888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:09.631571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:25.634227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:06:57.640540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:11:45.084442 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:11:45.084552 4.260832 tcp 10.0.2.105 49645 -> 200.84.7.244 8038 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:13:01.646152 3.002379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:13:08.654157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:16.655792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:13:32.658762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:14:04.664316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:08.671431 3.000717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:20:15.678191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:23.679809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:20:39.682163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:21:11.688585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:15.694973 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:27:22.701809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:30.703200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:27:46.706679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:28:18.712405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:31:27.293820 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:31:27.293946 0.872042 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:31:28.166384 0.669515 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:31:28.836321 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 17:31:45.742088 1.061019 tcp 10.0.2.105 49646 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:31:46.803403 1.029387 tcp 10.0.2.105 49647 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:31:47.833112 2.127654 tcp 10.0.2.105 49648 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:31:49.961511 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 17:32:05.910592 1.048437 tcp 10.0.2.105 49649 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:32:06.959296 1.059005 tcp 10.0.2.105 49650 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:32:08.018627 2.084448 tcp 10.0.2.105 49651 -> 195.113.214.226 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:32:10.103738 0.579795 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:10.683907 0.650239 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:11.334566 0.599078 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:11.934009 0.527811 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:12.462240 0.674251 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:13.136897 0.545481 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:13.682759 0.651606 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:14.334712 0.638656 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:14.973760 0.676528 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:15.650693 0.689857 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:16.340891 0.650709 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:16.991994 0.638310 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:17.630809 0.679752 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:18.310967 0.596557 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:18.907901 0.548928 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:19.457217 0.565234 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:20.022827 0.519481 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:20.542712 0.825247 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:21.368322 0.561608 udp 10.0.2.105 7010 <-> 81.149.71.72 3887 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:21.930264 0.654530 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:22.585140 0.569372 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:23.154868 0.809373 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:32:23.964661 0.685601 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 17:34:22.718701 3.001781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 17:34:29.725555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:37.727692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:34:53.730667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:35:25.736298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:41:29.742678 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:41:36.750018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:41:44.751015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:41:49.348734 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 17:41:49.348825 0.780901 tcp 10.0.2.105 49652 -> 200.84.7.244 8038 SPA_* 0 0 9 1018 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:41:58.977030 0.004800 tcp 10.0.2.105 49652 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/01/02 17:42:00.754627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:42:32.760308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:48:36.767023 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:48:43.774081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:48:51.775117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:07.778118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:49:39.784359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:55:43.791156 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 17:55:50.798120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:55:58.799132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:14.802741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 17:56:46.808127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:02:50.814771 3.001335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:02:51.613332 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:02:51.613449 0.542206 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:02:52.156024 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 18:02:57.821879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:05.823610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:10.202434 1.027252 tcp 10.0.2.105 49653 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:11.229953 1.024793 tcp 10.0.2.105 49654 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:12.255052 2.078476 tcp 10.0.2.105 49655 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:14.334093 0.757768 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:15.092273 0.632397 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:15.725074 0.590190 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:16.315606 0.630181 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:16.946197 0.676505 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:17.623061 0.526947 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:18.150454 0.665920 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:18.816763 0.561186 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:19.378340 0.653542 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:20.032506 0.624486 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:20.657374 0.679090 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:21.336836 0.709419 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:21.826007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:03:22.046636 0.660490 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:22.707477 0.904948 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:23.612791 0.679172 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:24.292564 0.606409 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:24.899319 0.567357 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:25.467074 0.558444 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:26.025911 0.527451 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:26.553712 0.826031 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:03:27.380129 0.000000 udp 10.0.2.105 7010 -> 81.149.71.72 3887 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 18:03:44.199857 1.028853 tcp 10.0.2.105 49656 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:45.229027 1.041584 tcp 10.0.2.105 49657 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:46.270898 2.123623 tcp 10.0.2.105 49658 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:03:48.395121 0.000000 udp 10.0.2.105 7010 -> 76.68.90.33 3572 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 18:03:53.832569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:04:06.161473 1.043532 tcp 10.0.2.105 49659 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:04:07.205360 1.069066 tcp 10.0.2.105 49660 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:04:08.274702 2.102296 tcp 10.0.2.105 49661 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:04:10.377691 0.545617 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:04:10.923687 0.805748 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:04:11.729831 0.651533 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:09:57.839216 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:10:04.845488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:12.846924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:10:28.850180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:00.856713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:11:58.980688 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:11:58.980798 2.993212 tcp 10.0.2.105 49662 -> 200.84.7.244 8038 FSPA* 0 0 15 1709 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:17:04.862030 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:17:11.870235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:19.871803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:17:35.874088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:18:07.880492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:11.887281 3.000949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:24:18.897939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:26.895162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:24:42.898298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:25:14.904495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:18.909427 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:31:25.917649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:33.919382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:31:49.921799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:32:21.928043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:34:29.351310 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:34:29.351462 0.000000 udp 10.0.2.105 7010 -> 81.149.71.72 3887 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 18:34:45.747523 1.036305 tcp 10.0.2.105 49663 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:34:46.784105 1.059242 tcp 10.0.2.105 49664 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:34:47.843598 2.113553 tcp 10.0.2.105 49665 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:34:49.957882 0.634129 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:50.592422 0.572063 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:51.164884 0.749914 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:51.915164 0.658353 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:52.573910 0.643288 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:53.217555 0.605437 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:53.823379 0.658870 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:54.482666 0.533086 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:55.016131 0.659952 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:55.676499 0.564251 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:56.241152 0.626031 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:56.867583 0.641902 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:57.509886 0.697296 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:58.207556 0.668577 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:58.876668 0.669359 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:34:59.546569 0.646718 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:00.309450 0.680298 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:00.990110 0.608293 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:01.598788 0.578861 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:02.178056 0.569502 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:02.747973 0.525077 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:03.273457 0.788906 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:04.062772 0.574792 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:04.637972 0.787251 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:35:05.425579 0.699527 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/02 18:38:25.934296 3.001187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 18:38:32.941804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:40.943211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:38:56.945997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:39:28.952351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:42:01.972974 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 18:42:01.973183 0.740232 tcp 10.0.2.105 49666 -> 200.84.7.244 8038 SPA_* 0 0 9 1169 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:42:12.547211 0.016037 tcp 10.0.2.105 49666 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 18:45:32.957553 3.002300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:45:39.965473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:45:47.967358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:03.969967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:46:35.975754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:52:39.982084 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:52:46.989385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:52:54.991371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:10.993725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:53:43.000516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 18:59:47.006053 3.001315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 18:59:54.013495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:02.015302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:18.018238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:00:50.024380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:05:35.834937 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:05:35.835173 0.645134 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:36.480718 0.548353 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:37.029490 0.729078 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:37.758978 0.671936 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:38.431285 0.626942 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:39.058611 0.555890 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:39.614912 0.639475 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:40.254818 0.523934 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:40.779138 0.647502 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:41.427073 0.554323 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:41.981835 0.639024 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:42.621299 0.638758 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:43.260443 0.699606 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:43.960593 0.673493 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:44.634485 0.652475 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:45.287367 0.638642 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:45.926409 0.685550 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:46.612570 0.605816 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:47.218776 0.544483 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:47.763688 0.569780 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:48.333881 0.521977 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:48.856403 0.845580 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:49.702377 0.574560 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:50.277345 0.788158 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:05:51.065888 0.841560 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:06:54.030673 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:07:01.037381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:09.039332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:25.041706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:07:57.048328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:12:12.565749 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:12:12.565852 3.326584 tcp 10.0.2.105 49667 -> 200.84.7.244 8038 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:14:01.054862 3.000653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:14:08.061699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:16.062875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:14:32.066106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:15:04.071775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:08.077721 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:21:15.085485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:23.087140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:21:39.089791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:22:11.095940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:15.102559 3.000673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:28:22.109384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:30.110751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:28:46.113698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:29:18.119722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:22.125336 3.002220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:35:29.133545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:37.134882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:35:53.137591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:03.322526 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:36:03.322700 0.633519 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:03.956620 0.573741 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:04.530730 0.769867 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:05.300950 0.647087 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:05.948450 0.645739 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:06.594588 0.548502 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:07.143506 0.629674 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:07.773582 0.509067 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:08.283047 0.658800 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:08.942263 0.539900 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:09.482549 0.929171 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:10.412135 0.604836 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:11.017314 0.701178 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:11.718863 0.704732 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:12.423935 0.657199 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:13.081509 0.634341 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:13.716204 0.000000 udp 10.0.2.105 7010 -> 67.232.56.212 4590 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 19:36:25.144012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:36:30.744688 1.012927 tcp 10.0.2.105 49668 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:36:31.757895 1.033411 tcp 10.0.2.105 49669 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:36:32.791616 2.103305 tcp 10.0.2.105 49670 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:36:34.895529 0.614251 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:35.510118 0.541410 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:36.051935 0.558955 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:36.615766 0.532667 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:37.148830 0.821060 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:37.970324 0.579097 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:38.549769 0.862079 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:36:39.412417 0.701823 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/02 19:42:15.898628 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 19:42:15.898810 0.734734 tcp 10.0.2.105 49671 -> 200.84.7.244 8038 SPA_* 0 0 9 1107 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:42:22.073717 0.002460 tcp 10.0.2.105 49671 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 19:42:29.150276 3.000888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 19:42:36.157286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:42:44.158893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:00.161996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:43:32.638217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:49:36.645322 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:49:43.652201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:49:51.653287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:07.656132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:50:39.662472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:56:43.668256 3.002223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 19:56:50.675566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:56:58.677167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:14.680685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 19:57:46.686744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:03:50.692666 3.001273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:03:57.700084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:05.701862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:21.704074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:04:53.710247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:06:57.889229 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:06:57.889324 0.685787 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:06:58.575509 0.629753 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:06:59.205619 0.574199 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:06:59.780171 0.509489 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:00.290092 0.627417 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:00.917909 0.640439 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:01.558717 0.569739 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:02.128824 0.625685 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:02.754933 0.516859 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:03.272151 0.673720 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:03.946294 0.567362 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:04.514046 0.640692 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:05.155157 0.630456 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:05.786062 0.714969 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:06.501474 0.646341 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:07.148206 0.670979 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:07.819539 0.628932 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:08.448893 0.598937 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:09.048225 0.547322 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:09.596005 0.558509 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:10.154906 0.541270 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:10.696738 0.820856 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:11.518024 0.570035 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:12.088549 0.766256 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:07:12.855206 0.647404 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:10:57.717026 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:11:04.724004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:12.725587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:11:28.728559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:12:00.734233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:12:22.306044 0.000215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:12:22.306358 0.747273 tcp 10.0.2.105 49672 -> 200.84.7.244 8038 SPA_* 0 0 9 1029 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:12:28.115071 0.002583 tcp 10.0.2.105 49672 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:18:04.739927 3.001752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:18:11.747915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:19.748940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:18:35.752187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:19:07.758158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:11.765269 3.000990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:25:18.771601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:26.772931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:25:42.775939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:26:14.781942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:18.787753 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 20:32:25.795610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:33.797500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:32:49.800115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:33:21.806520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:37:15.482232 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:37:15.482320 0.704090 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:16.186825 0.634521 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:16.821761 0.573916 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:17.396056 0.871960 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:18.268555 0.658697 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:18.927641 0.641606 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:19.569598 0.609482 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:20.179467 0.608030 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:20.787866 0.529181 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:21.317453 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 20:37:39.368581 1.022085 tcp 10.0.2.105 49673 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:37:40.390996 1.077641 tcp 10.0.2.105 49674 -> 195.113.214.226 80 SRPA* 0 0 18 13335 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:37:41.469297 0.527998 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:41.997704 0.633393 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:42.631524 0.636644 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:43.268570 0.665474 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:43.934470 0.648226 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:44.583062 0.689475 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:45.272983 0.689446 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:45.962802 0.596524 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:46.559726 0.547109 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:47.107226 0.562294 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:47.669902 0.521474 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:48.191789 0.834754 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:49.026956 0.537867 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:49.565208 0.910334 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:37:50.475891 0.674128 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/02 20:39:25.813325 3.000370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 20:39:32.819993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:40.821388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:39:56.823990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:40:28.830262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:42:28.121925 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:42:28.122031 1.449855 tcp 10.0.2.105 49675 -> 200.84.7.244 8038 SPA_* 0 0 11 1267 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:29.574873 0.998032 tcp 10.0.2.105 49676 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:30.573186 1.039489 tcp 10.0.2.105 49677 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:31.613040 2.056728 tcp 10.0.2.105 49678 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:33.690070 0.000053 tcp 10.0.2.105 49675 -> 200.84.7.244 8038 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:33.690346 3.003389 tcp 10.0.2.105 49679 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:42:42.692721 0.000000 tcp 10.0.2.105 49679 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:42:48.692446 1.043580 tcp 10.0.2.105 49680 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:49.736345 1.037130 tcp 10.0.2.105 49681 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:50.773859 2.115020 tcp 10.0.2.105 49682 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:42:52.898878 3.002993 tcp 10.0.2.105 49683 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:01.900176 0.000000 tcp 10.0.2.105 49683 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:07.900380 1.033077 tcp 10.0.2.105 49684 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:08.933746 1.074116 tcp 10.0.2.105 49685 -> 195.113.214.226 80 SRPA* 0 0 19 13404 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:10.024660 2.991792 tcp 10.0.2.105 49686 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:19.025263 0.000000 tcp 10.0.2.105 49686 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:25.024914 1.044191 tcp 10.0.2.105 49687 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:26.069448 1.037028 tcp 10.0.2.105 49688 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:27.106793 2.106823 tcp 10.0.2.105 49689 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:29.239079 1.459073 tcp 10.0.2.105 49690 -> 200.84.7.244 8038 FSPA* 0 0 13 1375 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:43:30.698348 3.007336 tcp 10.0.2.105 49691 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:39.714327 0.000000 tcp 10.0.2.105 49691 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:45.693803 2.993803 tcp 10.0.2.105 49692 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:54.696079 0.000000 tcp 10.0.2.105 49692 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:43:59.423119 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:44:00.695070 2.994438 tcp 10.0.2.105 49693 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:44:09.687644 0.000000 tcp 10.0.2.105 49693 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:46:32.836915 3.000774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 20:46:39.843549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:46:47.845497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:03.847826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:47:35.854346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:49:15.698918 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 20:49:15.699038 3.607535 tcp 10.0.2.105 49694 -> 200.84.7.244 8038 FSPA* 0 0 13 1292 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:17.171811 1.038733 tcp 10.0.2.105 49695 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:18.210816 1.085001 tcp 10.0.2.105 49696 -> 195.113.214.226 80 SRPA* 0 0 19 14713 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:19.306744 3.000548 tcp 10.0.2.105 49697 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:49:28.315920 0.000000 tcp 10.0.2.105 49697 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:49:34.305630 0.976999 tcp 10.0.2.105 49698 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:35.282925 1.031308 tcp 10.0.2.105 49699 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:36.314515 2.145580 tcp 10.0.2.105 49700 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:39.231764 3.004109 tcp 10.0.2.105 49701 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:49:48.244361 0.000000 tcp 10.0.2.105 49701 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:49:54.234480 1.052474 tcp 10.0.2.105 49702 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:55.287228 1.001107 tcp 10.0.2.105 49703 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:56.288691 2.077578 tcp 10.0.2.105 49704 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:49:58.378145 2.995028 tcp 10.0.2.105 49705 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:50:07.371957 0.000000 tcp 10.0.2.105 49705 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 20:50:13.371316 1.059922 tcp 10.0.2.105 49706 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:50:14.431484 1.032897 tcp 10.0.2.105 49707 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:50:15.464702 2.084511 tcp 10.0.2.105 49708 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:50:17.566025 2.991584 tcp 10.0.2.105 49709 -> 200.84.7.244 8038 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/01/02 20:53:39.860140 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 20:53:46.867610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:53:54.869331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:10.871781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 20:54:42.877990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:00:46.884438 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:00:53.891706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:01.893060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:17.896449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:01:49.902387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:07:53.908727 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:08:00.915774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:08.916959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:09.367878 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:08:09.367979 0.647406 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:10.015800 0.684042 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:10.700220 0.645488 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:11.346084 0.584064 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:11.930536 0.581351 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:12.512284 0.672922 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:13.185666 0.639644 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:13.825688 0.704798 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:14.530909 0.528740 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:15.060032 0.630797 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:15.691235 0.554949 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:16.246613 0.593517 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:16.840674 0.658348 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:17.499361 0.718469 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:18.218217 0.663297 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:18.881843 0.665205 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:19.547449 0.625912 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:20.173749 0.631565 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:20.805741 0.561528 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:21.367624 0.546232 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:21.914213 0.523732 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:22.438280 0.834222 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:23.272869 0.569579 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:23.842867 0.769461 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:24.612724 0.755561 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:08:24.919852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:08:56.925985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:00.932911 3.000956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:15:07.939326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:15.941090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:15:31.943769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:16:03.949731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:20:20.559797 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:20:20.559901 1.497718 tcp 10.0.2.105 49710 -> 200.84.7.244 8038 SPA_* 0 0 11 1325 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:22.059903 1.053908 tcp 10.0.2.105 49711 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:23.114103 1.034613 tcp 10.0.2.105 49712 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:24.149010 2.626175 tcp 10.0.2.105 49713 -> 195.113.214.226 443 SRPA* 0 0 38 25869 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:26.923604 0.000053 tcp 10.0.2.105 49710 -> 200.84.7.244 8038 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:26.923874 2.998280 tcp 10.0.2.105 49714 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:20:35.921061 0.000000 tcp 10.0.2.105 49714 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:20:41.920915 1.051799 tcp 10.0.2.105 49715 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:42.972544 1.065140 tcp 10.0.2.105 49716 -> 195.113.214.226 80 SRPA* 0 0 20 14735 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:20:44.049784 2.987209 tcp 10.0.2.105 49717 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:20:53.045545 0.000000 tcp 10.0.2.105 49717 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:20:59.045500 1.049352 tcp 10.0.2.105 49718 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:00.095159 0.982044 tcp 10.0.2.105 49719 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:01.077119 2.099876 tcp 10.0.2.105 49720 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:03.188510 2.996189 tcp 10.0.2.105 49721 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:12.182998 0.000000 tcp 10.0.2.105 49721 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:18.183193 1.062520 tcp 10.0.2.105 49722 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:19.245985 1.075301 tcp 10.0.2.105 49723 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:20.321128 2.104959 tcp 10.0.2.105 49724 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:22.455335 1.485750 tcp 10.0.2.105 49725 -> 200.84.7.244 8038 FSPA* 0 0 13 1433 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:21:23.940935 3.003152 tcp 10.0.2.105 49726 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:32.943405 0.000000 tcp 10.0.2.105 49726 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:38.941569 3.004291 tcp 10.0.2.105 49727 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:47.954281 0.000000 tcp 10.0.2.105 49727 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:21:52.921694 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:21:53.943326 2.994108 tcp 10.0.2.105 49728 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:22:02.946176 0.000000 tcp 10.0.2.105 49728 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 21:22:07.956555 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:22:14.963504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:22.965047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:22:38.968348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:23:10.974265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:27:08.946444 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:27:08.946600 2.863140 tcp 10.0.2.105 49729 -> 200.84.7.244 8038 FSPA* 0 0 15 1689 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:29:14.979620 3.002418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:29:21.987347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:29.988596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:29:45.991960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:30:17.997763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:22.004981 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:36:29.011340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:37.013212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:36:53.015587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:37:25.021631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:38:36.114648 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:38:36.114825 1.262315 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:38:37.311288 0.000000 udp 10.0.2.105 7010 -> 67.232.56.212 4590 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 21:38:55.213874 1.044937 tcp 10.0.2.105 49730 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:38:56.259088 1.039456 tcp 10.0.2.105 49731 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:38:57.298856 2.124078 tcp 10.0.2.105 49732 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:38:59.423535 0.733323 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:00.121587 1.082451 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:01.187337 0.863382 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 5 1719 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:02.035295 0.654738 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:02.686669 0.670885 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:03.343772 0.606993 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:03.942600 0.530982 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:04.490994 0.674020 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:05.176567 0.557695 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:05.714111 0.663637 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:06.355552 0.632400 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:06.971864 0.704573 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:07.677942 0.673764 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:08.343771 0.700589 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:09.053647 0.641782 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:09.673542 0.629055 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:10.304211 0.573947 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:10.860342 0.596890 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:11.492239 0.542460 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:12.044657 0.855553 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:12.871634 0.608287 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:13.458061 0.806495 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:39:14.230218 0.718940 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/01/02 21:43:29.027804 3.002071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 21:43:36.035556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:43:44.036711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:00.040109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:44:32.046085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:50:36.052521 3.000796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:50:43.059042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:50:51.060478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:07.064031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:51:39.070097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:57:11.808673 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 21:57:11.808859 2.917540 tcp 10.0.2.105 49733 -> 200.84.7.244 8038 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/02 21:57:43.076030 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 21:57:50.083250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:57:58.085066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:14.087996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 21:58:46.094348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:04:50.100688 3.000973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:04:57.107431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:05.108823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:21.111875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:05:53.118037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:09:23.210141 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:09:23.210391 0.687689 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:23.898491 0.664767 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:24.563691 0.595458 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:25.159536 0.614704 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:25.774601 0.883062 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:26.658077 0.653136 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:27.311618 0.647914 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:27.959894 0.539717 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:28.499986 0.541470 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:29.041806 0.634424 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:29.676669 0.563142 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:30.240219 0.610671 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:30.851252 0.641431 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:31.493118 0.707410 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:32.200951 0.641487 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:32.842859 0.672155 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:33.515429 0.640022 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:34.155875 0.632979 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:34.789256 0.557817 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:35.347463 0.539135 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:35.887009 0.522109 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:36.409538 0.994746 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:37.404635 0.539918 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:37.944930 0.789548 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:09:38.734888 0.805934 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:11:57.124553 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:12:04.131401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:12.133118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:12:28.135983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:13:00.141484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:04.147485 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:19:11.155274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:19.157002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:19:35.159724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:20:07.165544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:26:11.171225 3.002434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:26:18.179178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:26:26.180595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:26:42.183541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:14.190031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:27:14.731271 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:27:14.731370 1.469503 tcp 10.0.2.105 49734 -> 200.84.7.244 8038 SPA_* 0 0 11 1170 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:16.203193 1.046901 tcp 10.0.2.105 49735 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:17.250372 1.024683 tcp 10.0.2.105 49736 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:18.275371 2.091779 tcp 10.0.2.105 49737 -> 195.113.214.226 443 SRPA* 0 0 25 13880 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:20.390759 0.000072 tcp 10.0.2.105 49734 -> 200.84.7.244 8038 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:20.391103 3.001799 tcp 10.0.2.105 49738 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 22:27:29.391159 0.000000 tcp 10.0.2.105 49738 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 22:27:35.391158 1.018515 tcp 10.0.2.105 49739 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:36.409965 1.023250 tcp 10.0.2.105 49740 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:37.433097 2.101090 tcp 10.0.2.105 49741 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:39.562996 2.997183 tcp 10.0.2.105 49742 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 22:27:48.559398 0.000000 tcp 10.0.2.105 49742 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/02 22:27:54.559143 1.059489 tcp 10.0.2.105 49743 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:55.618962 1.063517 tcp 10.0.2.105 49744 -> 195.113.214.226 80 SRPA* 0 0 19 14717 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:27:56.758189 2.255516 tcp 10.0.2.105 49745 -> 31.192.7.200 5479 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:33:18.196454 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:33:25.203202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:33.204613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:33:49.207542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:34:21.213836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:39:50.778160 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:39:50.778264 0.690967 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:39:51.469636 0.660648 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:39:52.130641 0.668461 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:39:52.799503 0.938725 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:39:53.738585 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 22:40:09.687309 1.033980 tcp 10.0.2.105 49746 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:40:10.721539 1.043835 tcp 10.0.2.105 49747 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:40:11.765725 2.152196 tcp 10.0.2.105 49748 -> 195.113.214.226 443 SRPA* 0 0 26 16346 flow=From-Botnet-V2-TCP-Established 1970/01/02 22:40:13.918651 0.636505 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:14.555560 0.659540 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:15.215492 0.620574 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:15.836488 0.530303 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:16.367187 0.619903 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:16.987436 0.670235 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:17.658068 0.666486 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:18.324945 0.651151 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:18.976639 0.696589 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:19.673584 0.648505 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:20.322541 0.662941 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:20.985827 0.653836 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:21.640094 0.612906 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:22.253405 0.565966 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:22.819778 0.562550 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:23.382746 0.519837 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:23.902975 0.824720 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:24.728052 0.587729 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:25.220456 3.000676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 22:40:25.316183 0.774194 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:26.090779 0.679910 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 22:40:32.227025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:40.228672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:40:56.231923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:41:28.237402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:47:32.244118 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:47:39.250983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:47:47.252299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:03.255901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:48:35.261769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:54:39.268175 3.001093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 22:54:46.274853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:54:54.276209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:10.279178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:55:42.285572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 22:57:59.022380 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 22:57:59.022477 2.072611 tcp 10.0.2.105 49749 -> 31.192.7.200 5479 FSPA* 0 0 15 1766 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:01:46.292172 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:01:53.298914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:01.300738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:17.303627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:02:49.309950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:08:53.316127 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:09:00.323039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:08.324583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:24.327657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:09:56.333528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:10:40.356715 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:10:40.356818 0.829776 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:41.187036 0.681736 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:41.869147 0.743921 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:42.613446 0.612402 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:43.226266 0.567338 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:43.794001 0.672464 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:44.466880 0.628152 udp 10.0.2.105 7010 <-> 97.65.8.22 1039 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:45.095434 0.607032 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:45.702864 0.524307 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:46.227614 0.635675 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:46.863696 0.550770 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:47.414827 0.624433 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:48.039652 0.661849 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:48.701925 0.699353 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:49.401731 0.647133 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:50.049255 0.663045 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:50.712656 0.623416 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:51.336460 0.634852 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:51.971718 0.567730 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:52.539783 0.570887 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:53.110997 0.517776 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:53.629183 0.816356 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:54.445947 0.682676 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:55.128986 1.121063 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:10:56.250475 0.723724 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:16:00.339812 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:16:07.346956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:15.348704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:16:31.351513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:17:03.357721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:07.364427 3.000735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:23:14.371139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:22.372743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:23:38.375346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:24:10.381303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:28:01.094270 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:28:01.094376 2.062473 tcp 10.0.2.105 49750 -> 31.192.7.200 5479 FSPA* 0 0 15 1725 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:30:14.387917 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:30:21.395067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:29.396211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:30:45.399713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:31:17.405363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:21.411747 3.001735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:37:28.418762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:36.420208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:37:52.423102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:38:24.429375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:41:00.303540 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:41:00.303645 0.765786 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:01.069841 0.682339 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:01.752573 0.675870 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:02.428830 0.699963 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:03.129190 0.611635 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:03.741252 0.655109 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:04.396738 0.000000 udp 10.0.2.105 7010 -> 97.65.8.22 1039 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 23:41:19.903635 1.019909 tcp 10.0.2.105 49751 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:20.923850 1.023376 tcp 10.0.2.105 49752 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:21.947511 2.555794 tcp 10.0.2.105 49753 -> 195.113.214.226 443 SRPA* 0 0 35 26309 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:24.503893 0.551525 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:25.055804 0.510991 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:25.567182 0.627553 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:26.195096 0.554014 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:26.749512 0.639639 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:27.389496 0.645075 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:28.034969 0.703466 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:28.738814 0.667099 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:29.406310 0.651681 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:30.058336 0.614795 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:30.673528 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/02 23:41:46.771247 1.034883 tcp 10.0.2.105 49754 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:47.806400 0.976423 tcp 10.0.2.105 49755 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:48.783127 2.103707 tcp 10.0.2.105 49756 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:41:50.887421 0.564217 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:51.452027 0.558245 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:52.010644 0.520013 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:52.531007 0.826590 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:53.358032 0.575803 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:53.934262 0.772783 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:41:54.707471 0.901632 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/02 23:44:28.434884 3.001920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/02 23:44:35.442998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:44:43.444499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:44:59.447181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:45:31.453676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:51:35.459980 3.000963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:51:42.466946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:51:50.468115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:06.470910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:52:38.477138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:58:03.164518 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/02 23:58:03.164623 2.049372 tcp 10.0.2.105 49757 -> 31.192.7.200 5479 FSPA* 0 0 15 1579 flow=From-Botnet-V2-TCP-Established 1970/01/02 23:58:42.482734 3.002379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/02 23:58:49.490836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:58:57.491978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:13.494923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/02 23:59:45.501148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:05:49.507920 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:05:56.514939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:04.516111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:20.519050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:06:52.524931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:11:58.064743 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:11:58.064891 0.650499 udp 10.0.2.105 7010 -> 97.65.8.22 1039 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:11:58.715390 0.000000 icmp 97.65.8.22 0x0303 -> 10.0.2.105 0x0f04 URP 192 1 195 flow=Background 1970/01/03 00:12:14.600850 1.001703 tcp 10.0.2.105 49758 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:12:15.602818 1.053772 tcp 10.0.2.105 49759 -> 195.113.214.226 80 SRPA* 0 0 18 13410 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:12:16.657078 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:12:35.059274 1.001356 tcp 10.0.2.105 49760 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:12:36.060920 1.024603 tcp 10.0.2.105 49761 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:12:37.085316 2.527413 tcp 10.0.2.105 49762 -> 195.113.214.226 443 SRPA* 0 0 35 25237 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:12:39.613465 0.512018 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:12:40.125814 0.681818 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:12:40.808028 0.637527 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:12:41.445977 0.662546 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:12:42.108885 0.631756 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:12:42.741072 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:12:56.531638 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 00:12:59.684759 0.984552 tcp 10.0.2.105 49763 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:13:00.669622 1.068359 tcp 10.0.2.105 49764 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:13:01.738261 2.305158 tcp 10.0.2.105 49765 -> 195.113.214.226 443 SRPA* 0 0 36 27785 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:13:03.538699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:04.044135 0.611112 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:04.655598 0.626466 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:05.282464 0.503616 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:05.786543 0.556862 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:06.343768 0.641627 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:06.985789 0.622294 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:07.608519 0.668297 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:08.277197 0.661072 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:08.938689 0.669834 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:09.608917 0.618261 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:10.227598 0.558664 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:10.786670 0.567343 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:11.354373 0.519795 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:11.540089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:11.874565 0.833370 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:12.708359 0.564455 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:13.273193 0.860170 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:14.133839 0.691520 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:15.110498 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 REQ 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:13:22.966772 0.514637 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:23.481929 0.682249 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:24.164713 0.679668 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:24.844904 0.639327 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:25.484861 0.566088 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:26.051412 0.635757 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:26.687681 0.611611 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:27.299781 0.514834 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:27.543122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:13:27.815065 0.533697 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:27.923917 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:13:28.349177 0.643251 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:28.992894 0.609428 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:29.602793 0.694451 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:30.297744 0.636099 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:30.934385 0.627295 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:31.562195 0.673673 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:32.236610 0.568132 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:32.805236 0.570293 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:33.375944 0.508503 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:33.884901 0.579026 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:34.464385 0.826594 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:35.291480 1.195395 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:36.487411 0.797179 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:13:37.285410 0.000000 udp 10.0.2.105 7010 -> 84.63.162.94 1955 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:13:43.336196 0.000000 udp 10.0.2.105 7010 -> 79.155.59.65 8001 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:13:49.224313 0.826943 udp 10.0.2.105 7010 -> 118.140.6.66 1164 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:13:50.051256 0.000000 icmp 118.140.6.66 0x0303 -> 10.0.2.105 0x8c04 URP 192 1 318 flow=Background 1970/01/03 00:13:53.920951 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:13:54.772466 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:13:59.549120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:14:03.384739 0.000000 udp 10.0.2.105 7010 -> 49.204.25.105 1893 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:09.874042 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:18.556690 0.000000 udp 10.0.2.105 7010 -> 86.140.59.14 5117 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:23.423769 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:14:26.077833 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:32.276502 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1462 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:39.466835 0.000000 udp 10.0.2.105 7010 -> 78.171.57.151 9381 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:47.928990 0.538389 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:14:48.755029 0.000000 udp 10.0.2.105 7010 -> 141.129.1.98 6245 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:14:52.925988 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:14:56.751252 0.000000 udp 10.0.2.105 7010 -> 112.208.131.60 2912 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:04.071898 0.000000 udp 10.0.2.105 7010 -> 78.185.202.133 7280 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:13.015161 0.000000 udp 10.0.2.105 7010 -> 2.50.167.191 9194 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:17.921659 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:15:20.315530 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:26.464511 0.000000 udp 10.0.2.105 7010 -> 194.25.85.242 7827 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:33.754470 0.000000 udp 10.0.2.105 7010 -> 212.189.235.21 5339 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:40.914865 0.000000 udp 10.0.2.105 7010 -> 74.74.103.216 3234 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:45.421107 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:15:47.784925 0.000000 udp 10.0.2.105 7010 -> 63.192.3.4 8491 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:15:54.965212 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:01.564863 0.000000 udp 10.0.2.105 7010 -> 113.161.76.16 8890 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:06.882135 0.000000 udp 10.0.2.105 7010 -> 95.254.21.9 5965 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:11.428922 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:16:15.484612 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:21.433602 0.000000 udp 10.0.2.105 7010 -> 93.193.158.148 7662 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:30.286316 0.000000 udp 10.0.2.105 7010 -> 74.10.216.122 8820 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:38.758181 0.000000 udp 10.0.2.105 7010 -> 116.72.250.115 9919 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:43.424660 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:16:43.875464 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:16:52.688159 0.000000 udp 10.0.2.105 7010 -> 83.242.29.125 6165 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:01.551143 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:07.730195 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:12.426088 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:17:14.189383 0.759845 udp 10.0.2.105 7010 <-> 59.161.91.243 9675 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:17:15.022235 0.000000 udp 10.0.2.105 7010 -> 212.185.17.179 2127 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:20.648357 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:26.097156 0.861711 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:17:26.969334 0.000000 udp 10.0.2.105 7010 -> 97.66.49.193 6412 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:33.627414 0.557672 udp 10.0.2.105 7010 -> 93.213.182.28 7029 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:34.185086 0.000000 icmp 93.213.182.28 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 296 flow=Background 1970/01/03 00:17:38.424034 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:17:40.486862 0.000000 udp 10.0.2.105 7010 -> 87.9.157.23 5377 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:46.666173 0.749184 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:17:47.426503 0.000000 udp 10.0.2.105 7010 -> 93.91.145.150 5484 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:53.826129 0.000000 udp 10.0.2.105 7010 -> 88.234.223.220 1285 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:17:58.923737 0.000000 udp 10.0.2.105 7010 -> 59.92.246.44 3701 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:03.920573 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:18:06.864893 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:12.573019 0.000000 udp 10.0.2.105 7010 -> 95.9.215.11 4570 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:19.002100 0.000000 udp 10.0.2.105 7010 -> 116.73.142.70 4168 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:25.671882 0.874122 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:18:26.557242 0.849754 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:18:27.442430 1.045022 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:18:29.261009 0.000000 udp 10.0.2.105 7010 -> 113.53.255.133 7429 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:30.428441 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:18:36.487689 0.000000 udp 10.0.2.105 7010 -> 202.64.229.19 6045 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:42.876409 0.000000 udp 10.0.2.105 7010 -> 2.125.1.175 8354 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:49.365683 0.915586 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:18:50.343227 1.029466 udp 10.0.2.105 7010 -> 41.182.77.199 7929 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:18:51.372693 0.000000 icmp 41.182.77.199 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 286 flow=Background 1970/01/03 00:18:54.924185 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:18:57.047411 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:05.118453 0.858210 udp 10.0.2.105 7010 <-> 182.237.155.215 7441 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:19:06.002113 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 4579 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:12.579645 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:18.888526 0.000000 udp 10.0.2.105 7010 -> 79.48.246.153 8117 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:23.424587 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:19:26.128795 0.000000 udp 10.0.2.105 7010 -> 79.6.113.104 3391 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:31.216187 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:39.318246 0.000000 udp 10.0.2.105 7010 -> 122.166.4.10 4875 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:47.599667 0.000000 udp 10.0.2.105 7010 -> 24.89.190.202 1888 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:19:52.426208 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:19:52.807415 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:00.838945 0.000000 udp 10.0.2.105 7010 -> 90.18.117.222 5368 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:03.555656 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 00:20:08.790085 0.000000 udp 10.0.2.105 7010 -> 95.254.226.229 2736 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:10.562508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:14.458586 0.000000 udp 10.0.2.105 7010 -> 37.221.57.28 5050 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:18.564188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:19.425488 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:20:21.828735 0.000000 udp 10.0.2.105 7010 -> 69.125.232.175 4560 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:27.186883 0.000000 udp 10.0.2.105 7010 -> 58.48.109.36 5452 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:32.885031 0.000000 udp 10.0.2.105 7010 -> 79.4.78.148 6412 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:34.567355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:20:41.637732 0.868434 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:42.506166 0.000000 icmp 72.242.16.98 0x0303 -> 10.0.2.105 0xa60b URP 192 1 229 flow=Background 1970/01/03 00:20:46.424275 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:20:47.806028 0.000000 udp 10.0.2.105 7010 -> 59.124.6.120 4626 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:20:55.297028 0.000000 udp 10.0.2.105 7010 -> 63.248.106.38 2988 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:03.328557 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:06.572987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:21:10.559260 0.813051 udp 10.0.2.105 7010 -> 199.102.180.39 1024 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:11.372311 0.000000 icmp 199.102.180.39 0x0303 -> 10.0.2.105 0x0004 URP 192 1 321 flow=Background 1970/01/03 00:21:15.425580 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:21:16.537720 0.872127 udp 10.0.2.105 7010 <-> 75.127.21.155 6390 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:21:17.424509 0.000000 udp 10.0.2.105 7010 -> 68.0.210.175 8112 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:22.616396 0.884725 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:21:23.510346 0.000000 udp 10.0.2.105 7010 -> 119.75.41.70 5014 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:32.350587 0.776845 udp 10.0.2.105 7010 <-> 86.137.172.117 5356 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:21:33.143990 0.000000 udp 10.0.2.105 7010 -> 188.117.121.55 3639 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:39.410513 0.000000 udp 10.0.2.105 7010 -> 49.144.24.188 2222 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:43.926742 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:21:44.667963 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:21:52.339187 0.000000 udp 10.0.2.105 7010 -> 79.43.115.192 9533 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:00.921314 0.000000 udp 10.0.2.105 7010 -> 82.59.35.130 6109 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:07.180463 0.000000 udp 10.0.2.105 7010 -> 122.161.222.15 6723 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:12.307452 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:22:16.032817 0.000000 udp 10.0.2.105 7010 -> 175.138.197.38 8834 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:23.733891 0.000000 udp 10.0.2.105 7010 -> 181.48.121.10 1374 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:29.713130 2.006413 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:31.884137 0.689402 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:32.654777 0.746658 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:35.215249 0.644268 udp 10.0.2.105 7010 <-> 1.23.249.96 6353 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:35.979397 0.567078 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:36.592837 0.661362 udp 10.0.2.105 7010 <-> 76.249.28.143 4147 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:36.872951 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:22:37.318444 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:43.362707 0.869544 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:44.244081 0.539066 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:44.797899 0.704545 udp 10.0.2.105 7010 <-> 49.248.198.58 5060 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:45.510989 0.000000 udp 10.0.2.105 7010 -> 95.224.103.10 9990 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:52.835989 0.533630 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:22:53.385367 0.000000 udp 10.0.2.105 7010 -> 94.141.3.66 9349 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:22:59.605892 1.580930 udp 10.0.2.105 7010 <-> 14.96.222.72 9778 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:23:01.196475 0.000000 udp 10.0.2.105 7010 -> 88.69.2.236 4272 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:04.372830 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:23:08.398216 0.000000 udp 10.0.2.105 7010 -> 85.74.65.62 2536 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:15.058146 0.000000 udp 10.0.2.105 7010 -> 77.9.189.139 5572 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:21.727369 0.000000 udp 10.0.2.105 7010 -> 95.224.104.39 9871 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:27.976638 0.000000 udp 10.0.2.105 7010 -> 88.244.168.5 6778 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:32.873610 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:23:33.044148 0.000000 udp 10.0.2.105 7010 -> 95.225.89.11 3735 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:39.603158 0.000000 udp 10.0.2.105 7010 -> 82.114.178.61 8890 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:47.054323 0.823854 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:23:47.917723 0.000000 udp 10.0.2.105 7010 -> 114.143.112.91 7457 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:23:56.046977 0.000000 udp 10.0.2.105 7010 -> 217.92.178.218 8992 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:00.873898 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:24:02.906768 1.032427 udp 10.0.2.105 7010 <-> 115.242.39.199 9511 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:24:03.982896 0.000000 udp 10.0.2.105 7010 -> 2.28.186.31 3547 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:12.851441 0.000000 udp 10.0.2.105 7010 -> 88.234.184.113 1042 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:21.173081 0.000000 udp 10.0.2.105 7010 -> 87.25.37.123 6383 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:25.879399 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:24:29.715068 0.000000 udp 10.0.2.105 7010 -> 87.10.172.164 2252 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:38.477866 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:45.768142 0.563469 udp 10.0.2.105 7010 -> 31.197.110.58 9020 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:46.331611 0.000000 icmp 31.197.110.58 0x0303 -> 10.0.2.105 0x3c23 URP 192 1 307 flow=Background 1970/01/03 00:24:50.375119 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:24:50.795507 0.717923 udp 10.0.2.105 7010 <-> 161.200.34.15 5040 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:24:51.523788 0.547125 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:24:52.111649 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:24:58.016461 0.000000 udp 10.0.2.105 7010 -> 128.255.240.103 1485 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:25:03.514213 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:25:11.595456 0.000000 udp 10.0.2.105 7010 -> 74.90.25.128 9253 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:25:16.372384 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:25:19.627327 0.000000 udp 10.0.2.105 7010 -> 78.175.199.103 4946 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:25:26.777812 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 3988 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:25:32.145341 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 9979 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:27:11.029514 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 00:27:18.037542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:26.038382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:27:42.041871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:28:05.666089 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:28:05.666186 2.097376 tcp 10.0.2.105 49766 -> 31.192.7.200 5479 FSPA* 0 0 15 1585 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:28:14.048114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:18.054408 3.001187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:34:25.061350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:33.062770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:34:49.065685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:35:21.071845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:25.078055 3.012739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:41:32.115511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:40.136381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:41:56.139927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:42:28.156037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:48:32.161577 3.002141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:48:39.168955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:48:47.171010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:03.174135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:49:35.180055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:55:39.185617 3.002111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 00:55:46.193255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:55:54.194508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:55:58.821635 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 00:55:58.821762 0.542188 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:55:59.364401 0.684674 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:00.049427 0.652850 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:00.702663 0.639208 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:01.342288 0.599081 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:01.941760 0.555205 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:02.497381 0.594463 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:03.092257 0.595313 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:03.687988 0.521475 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:04.209856 1.360699 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:05.571006 0.710190 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:06.281620 0.612113 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:06.894128 0.662443 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:07.556969 0.625582 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:08.182927 0.685559 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:08.868871 0.560862 udp 10.0.2.105 7010 <-> 81.130.97.248 8111 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:09.430113 0.523345 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:09.953849 0.560352 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:10.197752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:10.514590 0.812753 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:11.327724 0.562734 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:11.890849 0.719660 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:12.610862 0.780408 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:13.391626 0.543726 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:13.935764 0.000000 udp 10.0.2.105 7010 -> 59.161.91.243 9675 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:56:31.520250 1.022794 tcp 10.0.2.105 49767 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:32.543240 1.031655 tcp 10.0.2.105 49768 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:33.575273 2.574097 tcp 10.0.2.105 49769 -> 195.113.214.226 443 SRPA* 0 0 38 27523 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:36.149956 0.886407 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:56:37.036766 0.000000 udp 10.0.2.105 7010 -> 85.97.241.177 3188 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:56:42.203634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 00:56:54.833447 1.031286 tcp 10.0.2.105 49770 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:55.865070 0.988368 tcp 10.0.2.105 49771 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:56.853802 2.605235 tcp 10.0.2.105 49772 -> 195.113.214.226 443 SRPA* 0 0 37 28071 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:56:59.459592 0.641781 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:00.101775 0.616834 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:00.719038 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:57:16.404499 1.012365 tcp 10.0.2.105 49773 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:17.417124 1.032536 tcp 10.0.2.105 49774 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:18.449956 2.539173 tcp 10.0.2.105 49775 -> 195.113.214.226 443 SRPA* 0 0 40 28039 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:20.989879 0.724467 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:21.714734 0.673788 udp 10.0.2.105 7010 <-> 182.237.155.215 7441 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:22.388952 0.000000 udp 10.0.2.105 7010 -> 75.127.21.155 6390 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:57:39.587453 1.035193 tcp 10.0.2.105 49776 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:40.622997 1.031329 tcp 10.0.2.105 49777 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:41.654560 2.527485 tcp 10.0.2.105 49778 -> 195.113.214.226 443 SRPA* 0 0 34 25221 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:57:44.182615 0.664344 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:44.847400 0.525052 udp 10.0.2.105 7010 <-> 86.137.172.117 5356 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:57:45.372884 0.000000 udp 10.0.2.105 7010 -> 117.235.21.246 8238 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:58:03.422063 1.023705 tcp 10.0.2.105 49779 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:04.446066 1.029231 tcp 10.0.2.105 49780 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:05.475594 2.374241 tcp 10.0.2.105 49781 -> 195.113.214.226 443 SRPA* 0 0 36 24903 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:07.827244 2.042658 tcp 10.0.2.105 49782 -> 31.192.7.200 5479 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:07.850410 0.511774 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:08.362593 0.751413 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:09.114419 0.000000 udp 10.0.2.105 7010 -> 1.23.249.96 6353 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:58:27.516414 1.048451 tcp 10.0.2.105 49783 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:28.565092 1.021010 tcp 10.0.2.105 49784 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:29.586388 2.397256 tcp 10.0.2.105 49785 -> 195.113.214.226 443 SRPA* 0 0 37 27877 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:31.984638 0.573297 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:32.558295 0.000000 udp 10.0.2.105 7010 -> 76.249.28.143 4147 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 00:58:51.010460 1.011310 tcp 10.0.2.105 49786 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:52.022098 1.048877 tcp 10.0.2.105 49787 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:53.071262 2.590448 tcp 10.0.2.105 49788 -> 195.113.214.226 443 SRPA* 0 0 36 25097 flow=From-Botnet-V2-TCP-Established 1970/01/03 00:58:55.662268 0.871088 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:56.533794 0.566352 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:57.100628 0.691586 udp 10.0.2.105 7010 <-> 49.248.198.58 5060 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:57.792618 0.558662 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:58.351682 1.060300 udp 10.0.2.105 7010 <-> 14.96.222.72 9778 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:58:59.412391 0.612236 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:59:00.025016 0.760344 udp 10.0.2.105 7010 <-> 115.242.39.199 9511 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:59:00.785775 0.721130 udp 10.0.2.105 7010 <-> 161.200.34.15 5040 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/03 00:59:01.507372 0.564033 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:02:46.210313 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 01:02:53.217341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:01.218697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:17.221417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:03:49.227337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:09:53.234320 3.001410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:10:00.241261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:08.242914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:24.246070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:10:56.251837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:00.258506 3.000514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:17:07.265344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:15.266198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:17:31.269738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:18:03.275368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:07.280989 3.002450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:24:14.289231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:22.290271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:24:38.293348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:25:10.299340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:28:09.878019 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:28:09.878239 2.055934 tcp 10.0.2.105 49789 -> 31.192.7.200 5479 FSPA* 0 0 15 1744 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:17.455538 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:29:17.455714 0.780533 udp 10.0.2.105 7010 -> 59.161.91.243 9675 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:29:18.236247 0.000000 icmp 59.161.91.243 0x0303 -> 10.0.2.105 0xcb25 URP 192 1 310 flow=Background 1970/01/03 01:29:33.781656 1.030491 tcp 10.0.2.105 49790 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:34.812437 1.020227 tcp 10.0.2.105 49791 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:35.832993 2.143173 tcp 10.0.2.105 49792 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:37.976703 0.554866 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:29:38.531917 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:29:57.003066 1.023286 tcp 10.0.2.105 49793 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:58.026630 1.034364 tcp 10.0.2.105 49794 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:29:59.061277 2.112066 tcp 10.0.2.105 49795 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:01.173931 0.000000 udp 10.0.2.105 7010 -> 75.127.21.155 6390 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:30:18.634622 1.037105 tcp 10.0.2.105 49796 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:19.672022 0.996078 tcp 10.0.2.105 49797 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:20.668555 2.143000 tcp 10.0.2.105 49798 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:22.812278 0.790024 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:30:23.602715 0.000000 udp 10.0.2.105 7010 -> 1.23.249.96 6353 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:30:39.814458 1.029768 tcp 10.0.2.105 49799 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:40.844539 1.008886 tcp 10.0.2.105 49800 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:41.853441 2.121873 tcp 10.0.2.105 49801 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:30:43.976033 0.000000 udp 10.0.2.105 7010 -> 76.249.28.143 4147 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:30:59.863489 1.022376 tcp 10.0.2.105 49802 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:00.886152 0.996310 tcp 10.0.2.105 49803 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:01.882714 2.128092 tcp 10.0.2.105 49804 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:04.011391 0.818326 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:04.830054 1.008642 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:05.839127 0.672996 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:06.512542 0.623603 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:07.136596 0.641352 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:07.778333 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:31:14.305646 3.001870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 01:31:21.313255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:31:23.407383 1.008725 tcp 10.0.2.105 49805 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:24.416411 1.038792 tcp 10.0.2.105 49806 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:25.455516 2.207057 tcp 10.0.2.105 49807 -> 195.113.214.226 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:27.663157 0.639578 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:28.303065 0.547599 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:28.851033 0.533211 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:29.314320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:31:29.384721 0.701357 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:30.086489 1.391287 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:31.478173 0.641492 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:32.120027 0.641189 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:32.761560 0.631287 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:33.393250 0.678400 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:34.072373 0.000000 udp 10.0.2.105 7010 -> 81.130.97.248 8111 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:31:45.317880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:31:49.665373 1.044550 tcp 10.0.2.105 49808 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:50.710147 0.989103 tcp 10.0.2.105 49809 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:51.699170 2.063471 tcp 10.0.2.105 49810 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:31:53.763251 0.539796 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:54.303465 0.559020 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:54.862895 0.835749 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:55.699062 0.576840 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:56.276331 0.942643 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:57.219415 0.534554 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:57.754379 0.761294 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:31:58.516072 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:32:14.581329 1.038587 tcp 10.0.2.105 49811 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:15.619773 1.006987 tcp 10.0.2.105 49812 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:16.627031 2.116394 tcp 10.0.2.105 49813 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:17.323412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:32:18.743625 0.639233 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:19.383228 0.616889 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:20.000493 0.699933 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:20.700835 0.645646 udp 10.0.2.105 7010 <-> 182.237.155.215 7441 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:21.346788 0.000000 udp 10.0.2.105 7010 -> 86.137.172.117 5356 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:32:39.488449 1.007631 tcp 10.0.2.105 49814 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:40.496383 1.035404 tcp 10.0.2.105 49815 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:41.532141 2.050421 tcp 10.0.2.105 49816 -> 195.113.214.226 443 SRPA* 0 0 25 13292 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:32:43.582348 0.645392 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:44.228128 0.527913 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:44.756390 0.739494 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:45.496462 0.572365 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:46.069185 0.557393 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:32:46.626960 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:33:02.890423 1.049154 tcp 10.0.2.105 49817 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:03.939889 1.022640 tcp 10.0.2.105 49818 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:04.962378 2.074651 tcp 10.0.2.105 49819 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:07.037735 0.553400 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:33:07.591495 0.000000 udp 10.0.2.105 7010 -> 49.248.198.58 5060 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:33:25.182500 1.031120 tcp 10.0.2.105 49820 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:26.213938 1.062527 tcp 10.0.2.105 49821 -> 195.113.214.226 80 SRPA* 0 0 19 14684 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:27.277052 0.000000 udp 10.0.2.105 7010 -> 14.96.222.72 9778 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 01:33:44.520192 1.044972 tcp 10.0.2.105 49822 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:45.565410 1.015358 tcp 10.0.2.105 49823 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:46.581075 2.113286 tcp 10.0.2.105 49824 -> 195.113.214.226 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:33:48.695111 0.614447 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:33:49.309939 0.804641 udp 10.0.2.105 7010 <-> 115.242.39.199 9511 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:33:50.114985 0.725108 udp 10.0.2.105 7010 <-> 161.200.34.15 5040 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:33:50.840465 0.574412 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/03 01:38:21.330224 3.000636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 01:38:28.337151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:36.338290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:38:52.341125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:39:24.347196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:45:28.354143 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:45:35.361073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:45:43.362744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:45:59.365243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:46:31.371525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:52:35.377126 3.002361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:52:42.384992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:52:50.386070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:06.389689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:53:38.395365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:58:11.939487 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 01:58:11.939595 2.023952 tcp 10.0.2.105 49825 -> 31.192.7.200 5479 FSPA* 0 0 16 1849 flow=From-Botnet-V2-TCP-Established 1970/01/03 01:59:42.401574 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 01:59:49.409682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 01:59:57.410371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:13.413757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:00:45.419250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:04:19.948165 0.000226 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:04:19.948507 0.535006 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:04:20.483911 0.000000 udp 10.0.2.105 7010 -> 81.130.97.248 8111 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:04:38.547639 1.025303 tcp 10.0.2.105 49826 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:04:39.573225 1.019982 tcp 10.0.2.105 49827 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:04:40.593509 2.120593 tcp 10.0.2.105 49828 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:04:42.714809 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:05:01.409347 0.981240 tcp 10.0.2.105 49829 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:02.390904 1.025037 tcp 10.0.2.105 49830 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:03.415815 2.133457 tcp 10.0.2.105 49831 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:05.549866 0.000000 udp 10.0.2.105 7010 -> 86.137.172.117 5356 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:05:24.421684 1.019948 tcp 10.0.2.105 49832 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:25.441928 1.012063 tcp 10.0.2.105 49833 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:26.454314 2.072937 tcp 10.0.2.105 49834 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:28.527865 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:05:46.393596 1.017694 tcp 10.0.2.105 49835 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:47.411612 1.035788 tcp 10.0.2.105 49836 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:48.447766 2.083391 tcp 10.0.2.105 49837 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:05:50.531742 0.000000 udp 10.0.2.105 7010 -> 49.248.198.58 5060 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:06:06.291582 0.988977 tcp 10.0.2.105 49838 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:07.280844 1.063536 tcp 10.0.2.105 49839 -> 195.113.214.226 80 SRPA* 0 0 20 14767 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:08.344915 0.000000 udp 10.0.2.105 7010 -> 14.96.222.72 9778 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:06:23.416683 1.040850 tcp 10.0.2.105 49840 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:24.457868 1.028261 tcp 10.0.2.105 49841 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:25.486372 2.066041 tcp 10.0.2.105 49842 -> 195.113.214.226 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:27.553158 0.593541 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:28.147100 0.726026 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:28.873561 0.522832 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:29.396747 0.668012 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:30.065190 0.669554 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:30.735095 0.627543 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:31.362982 1.106579 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:32.469928 0.631500 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:33.101822 0.523934 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:33.626093 0.528477 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:34.154924 0.691495 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:34.846806 0.637236 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:35.484418 0.643352 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:36.128169 0.676311 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:36.804855 0.663518 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:37.468791 0.608585 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:38.077803 0.535685 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:38.613874 0.543783 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:39.158047 0.585169 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:39.743608 0.820481 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:40.564644 0.701089 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:06:41.266152 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:06:49.425084 3.001950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:06:56.433214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:06:56.904646 1.002705 tcp 10.0.2.105 49843 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:57.907200 1.034644 tcp 10.0.2.105 49844 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:06:58.942109 2.061364 tcp 10.0.2.105 49845 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:01.004044 0.778153 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:01.782624 0.631164 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:02.414178 0.643960 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:03.058553 1.495952 udp 10.0.2.105 7010 <-> 182.237.155.215 7441 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:04.433989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:04.554884 0.707729 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:05.263027 0.636572 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:05.900035 0.556939 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:06.457337 0.587871 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:07.045615 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:07:20.437207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:07:25.335878 1.021827 tcp 10.0.2.105 49846 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:26.358022 1.082537 tcp 10.0.2.105 49847 -> 195.113.214.226 80 SRPA* 0 0 20 14737 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:27.441079 0.541624 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:27.983103 0.533619 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:28.517060 0.610053 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:29.127527 0.000000 udp 10.0.2.105 7010 -> 115.242.39.199 9511 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:07:44.223937 1.028105 tcp 10.0.2.105 49848 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:45.252367 1.001761 tcp 10.0.2.105 49849 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:46.253884 2.107540 tcp 10.0.2.105 49850 -> 195.113.214.226 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:07:48.362119 0.722446 udp 10.0.2.105 7010 <-> 161.200.34.15 5040 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:49.084981 0.572383 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:07:52.443027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:13:56.449589 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:14:03.456869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:11.458250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:27.461348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:14:59.467522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:03.473989 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:21:10.480727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:18.482184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:21:34.485044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:22:06.491340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:10.497395 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:28:13.970588 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:28:13.971453 2.841372 tcp 10.0.2.105 49851 -> 31.192.7.200 5479 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:28:17.504524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:25.506226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:28:41.509257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:29:13.515334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:35:17.521510 3.001238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:35:24.528761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:35:32.530317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:35:48.533085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:36:20.539425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:38:18.679723 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:38:18.679834 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:38:34.334272 0.048108 tcp 10.0.2.105 49852 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:34.382691 0.049232 tcp 10.0.2.105 49853 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:34.432390 0.308732 tcp 10.0.2.105 49854 -> 195.113.214.226 443 SRPA* 0 0 40 25626 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:34.741838 0.253794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:34.996044 0.000000 udp 10.0.2.105 7010 -> 115.242.39.199 9511 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:38:51.327168 0.051671 tcp 10.0.2.105 49855 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:51.379158 0.046864 tcp 10.0.2.105 49856 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:51.426343 0.148209 tcp 10.0.2.105 49857 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:38:51.575113 0.081723 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:51.657198 0.092072 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:51.749660 0.270857 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.020893 0.192857 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.214121 0.037956 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.252661 0.176210 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.429266 0.145069 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.574666 0.144569 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:38:52.719607 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:39:11.456088 0.045535 tcp 10.0.2.105 49858 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:39:11.501921 0.049999 tcp 10.0.2.105 49859 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:39:11.552212 0.148582 tcp 10.0.2.105 49860 -> 195.113.214.226 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:39:11.701488 0.043979 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:11.745844 0.061227 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:11.807462 0.211824 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.019655 0.157725 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.177765 0.142786 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.320887 0.155767 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.477059 0.142226 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.619659 0.203494 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.823510 0.038570 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.862469 0.081583 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:12.944412 0.077030 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:13.021825 0.338874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:13.361091 0.195461 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:13.557007 0.287750 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:13.845134 0.145762 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:13.991298 0.136341 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.127994 0.215724 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.344141 0.173662 udp 10.0.2.105 7010 <-> 182.237.155.215 7441 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.518191 0.160578 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.679153 0.056493 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.736026 0.092051 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.828509 0.056062 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.884933 0.059106 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:14.944553 0.121036 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:39:15.066019 0.000000 udp 10.0.2.105 7010 -> 161.200.34.15 5040 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 02:39:30.783696 0.050644 tcp 10.0.2.105 49861 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:39:30.834642 0.088345 tcp 10.0.2.105 49862 -> 195.113.214.226 80 SRPA* 0 0 39 24235 flow=From-Botnet-V2-TCP-Established 1970/01/03 02:39:30.923576 0.072096 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/03 02:42:24.545980 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 02:42:31.552556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:39.554279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:42:55.557444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:43:27.563016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:49:31.569001 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:49:38.576766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:49:46.577890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:02.581424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:50:34.587104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:56:38.593379 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 02:56:45.601031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:56:53.602187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:09.605538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:57:41.611227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 02:58:16.812083 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 02:58:16.812172 0.594361 tcp 10.0.2.105 49863 -> 31.192.7.200 5479 FSPA* 0 0 15 1644 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:03:45.616828 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:03:52.624861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:00.626070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:16.628865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:04:48.634807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:09:56.307753 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:09:56.307876 0.072730 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:09:56.380997 0.000000 udp 10.0.2.105 7010 -> 161.200.34.15 5040 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 03:10:12.403784 0.074574 tcp 10.0.2.105 49864 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:10:12.478607 0.089119 tcp 10.0.2.105 49865 -> 195.113.214.226 80 SRPA* 0 0 38 24239 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:10:12.567944 0.247157 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:12.815507 0.194427 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:13.010334 0.348643 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:13.359364 0.101117 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:13.460889 0.128067 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:13.589374 0.291954 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:13.881742 0.177150 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.059285 0.143573 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.203243 0.145715 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.349324 0.217690 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.567429 0.155761 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.723530 0.144064 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.867948 0.066404 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.934697 0.043842 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:14.978926 0.206436 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.185758 0.133849 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.319960 0.077056 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.397418 0.077716 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.475482 0.343360 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.819260 0.145484 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:15.965138 0.161709 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:16.127340 0.145617 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:16.273357 0.138271 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:16.412037 0.206269 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:16.618680 0.275699 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:16.894781 0.406264 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:17.301438 0.000000 udp 10.0.2.105 7010 -> 182.237.155.215 7441 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 03:10:34.844158 0.071056 tcp 10.0.2.105 49866 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:10:34.915502 0.090026 tcp 10.0.2.105 49867 -> 195.113.214.226 80 SRPA* 0 0 39 24227 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:10:35.005887 0.094227 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.100488 0.056165 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.157019 0.054481 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.211924 0.121382 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.333773 0.054063 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.388295 0.163508 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:35.552202 0.086598 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:10:52.644552 2.998437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:10:59.648214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:07.650455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:23.652871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:11:55.658738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:17:59.665278 3.001457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:18:06.672137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:14.674342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:18:30.677210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:19:02.682750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:06.689318 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:25:13.696495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:21.697783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:25:37.701175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:26:09.706967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:28:17.411282 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:28:17.411391 0.655236 tcp 10.0.2.105 49868 -> 31.192.7.200 5479 FSPA* 0 0 15 1672 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:32:13.712957 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:32:20.720672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:28.721872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:32:44.724785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:33:16.731344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:39:20.736394 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:39:27.744040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:39:35.745642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:39:51.748654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:23.754926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:40:50.373350 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:40:50.373448 0.000000 udp 10.0.2.105 7010 -> 182.237.155.215 7441 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 03:41:05.898456 0.047974 tcp 10.0.2.105 49869 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:05.946684 0.047785 tcp 10.0.2.105 49870 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:05.994818 0.134552 tcp 10.0.2.105 49871 -> 195.113.214.226 443 SRPA* 0 0 34 24193 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:06.130082 0.099179 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:06.229631 0.219214 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:06.449299 0.588498 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:07.038185 0.196246 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:07.234821 0.506517 udp 10.0.2.105 7010 <-> 117.235.21.246 8238 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:07.741708 0.092483 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:07.834572 0.143281 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:07.978304 0.144461 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:08.123143 0.177262 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:08.300769 0.307011 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:08.608184 0.158109 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:08.766711 0.210009 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:08.977115 0.059305 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.036772 0.040966 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.078136 0.186911 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.265434 0.044236 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.310122 0.225187 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.535658 0.143451 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.679541 0.159327 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.839260 0.146087 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:09.985738 0.074780 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:10.060878 0.079534 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:10.140832 0.336133 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:10.477392 0.289843 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:10.767650 0.477806 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.245839 0.145669 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.391873 0.206975 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.599258 0.056546 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.656211 0.055245 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.711805 0.123238 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.835438 0.090624 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.926452 0.070744 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:41:11.997607 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 03:41:28.539041 0.047219 tcp 10.0.2.105 49872 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:28.586560 0.048862 tcp 10.0.2.105 49873 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:28.635722 0.139080 tcp 10.0.2.105 49874 -> 195.113.214.226 443 SRPA* 0 0 58 51985 flow=From-Botnet-V2-TCP-Established 1970/01/03 03:41:28.775494 0.161786 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/03 03:46:27.760736 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 03:46:34.768438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:46:42.769897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:46:58.772710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:47:30.778549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:53:34.784979 3.001473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 03:53:41.792101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:53:49.794147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:05.796688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:54:37.802662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 03:58:18.070049 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 03:58:18.070296 0.759515 tcp 10.0.2.105 49875 -> 31.192.7.200 5479 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:00:41.809124 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:00:48.816522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:00:56.818031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:12.821091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:01:44.826829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:07:48.832460 3.001938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:07:55.839892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:03.841682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:19.844792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:08:51.850590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:11:55.935752 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:11:55.935950 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 04:12:11.911246 0.047248 tcp 10.0.2.105 49876 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:12:11.958774 0.087888 tcp 10.0.2.105 49877 -> 195.113.214.226 80 SRPA* 0 0 25 14442 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:12:12.045427 0.079799 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:12.125614 0.193863 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:12.319925 0.393204 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:12.713468 0.250007 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:12.963851 0.183098 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:13.147414 0.000000 udp 10.0.2.105 7010 -> 117.235.21.246 8238 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 04:12:29.634911 0.046135 tcp 10.0.2.105 49878 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:12:29.681303 0.047843 tcp 10.0.2.105 49879 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:12:29.729451 0.211742 tcp 10.0.2.105 49880 -> 195.113.214.226 443 SRPA* 0 0 20 11524 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:12:29.941907 0.181833 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.124122 0.144523 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.269034 0.091483 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.360859 0.073943 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.435237 0.063475 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.499053 0.040244 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.539681 0.186328 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.726412 0.036681 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.763513 0.211225 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:30.975135 0.157782 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.133271 0.158090 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.291774 0.143141 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.435297 0.078842 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.514546 0.080093 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.595032 0.144997 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.740419 0.146750 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:31.887622 0.549996 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:32.438201 0.337207 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:32.775766 0.294762 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.070863 0.058138 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.129422 0.143606 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.273409 0.120665 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.394452 0.094453 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.489530 0.070875 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.560817 0.053944 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.615096 0.227085 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 200 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:12:33.842600 0.161060 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:14:55.856929 3.001170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:15:02.863968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:10.865803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:26.868491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:15:58.874997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:02.880481 3.002142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:22:09.887981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:17.889874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:22:33.892756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:23:05.899027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:28:18.828686 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:28:18.828835 0.620487 tcp 10.0.2.105 49881 -> 31.192.7.200 5479 FSPA* 0 0 15 1734 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:29:09.905171 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:29:16.911971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:24.913929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:29:40.916479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:30:12.922653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:16.929195 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:36:23.935729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:31.938063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:36:47.940355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:37:19.946689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:42:36.712742 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:42:36.712835 0.000000 udp 10.0.2.105 7010 -> 117.235.21.246 8238 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 04:42:54.630561 0.051232 tcp 10.0.2.105 49882 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:42:54.682075 0.093364 tcp 10.0.2.105 49883 -> 195.113.214.226 80 SRPA* 0 0 42 30171 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:42:54.775665 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 04:43:10.402281 0.045837 tcp 10.0.2.105 49884 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:43:10.448434 0.046937 tcp 10.0.2.105 49885 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:43:10.495628 0.146870 tcp 10.0.2.105 49886 -> 195.113.214.226 443 SRPA* 0 0 24 13394 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:43:10.643197 0.192793 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:10.836362 0.146041 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:10.982818 0.249594 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:11.232756 0.383255 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:11.616417 0.085797 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:11.702672 0.179665 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:11.882768 0.144609 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.027742 0.113817 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.141930 0.063513 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.205788 0.042213 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.248383 0.182778 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.431471 0.055758 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.487598 0.219528 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.707492 0.156426 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:12.864265 0.155162 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.019821 0.078161 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.098384 0.143994 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.242737 0.143837 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.386906 0.226230 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.613530 0.077655 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.691565 0.285699 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:13.977652 0.336211 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.314264 0.214041 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.528702 0.062030 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.591130 0.136611 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.728134 0.071434 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.799953 0.060891 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:14.861259 0.216642 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:15.078261 0.160841 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:15.239503 0.120984 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:15.360866 0.090784 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/03 04:43:23.953048 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 04:43:30.959711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:43:38.961751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:43:54.964464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:44:26.970741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:50:30.977055 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:50:37.984143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:50:45.985174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:01.988280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:51:33.994918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:57:38.000508 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 04:57:45.007998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:57:53.009797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:09.012416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 04:58:19.448026 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 04:58:19.448196 0.593986 tcp 10.0.2.105 49887 -> 31.192.7.200 5479 FSPA* 0 0 15 1675 flow=From-Botnet-V2-TCP-Established 1970/01/03 04:58:41.018582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:04:45.024924 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:04:52.032004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:00.033171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:16.036823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:05:48.042438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:11:52.049112 3.001223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:11:59.055850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:07.057468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:23.060263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:12:55.066823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:13:36.426473 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:13:36.426583 0.303655 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:36.730644 0.342793 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:37.073865 0.415619 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:37.489843 0.224538 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:37.714793 0.248896 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:37.964043 0.319775 udp 10.0.2.105 7010 <-> 85.97.241.177 3188 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:38.284376 0.269479 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:38.554273 0.372543 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:38.927212 0.348196 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:39.275822 0.271598 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:39.547900 0.256766 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:39.805076 0.373339 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.178801 0.039601 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.218751 0.212912 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.432059 0.158523 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.590996 0.171999 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.763393 0.090422 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.854221 0.143805 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:40.998395 0.077296 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:13:41.076121 0.000000 udp 10.0.2.105 7010 -> 200.93.56.18 6467 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 05:13:58.720146 0.504866 tcp 10.0.2.105 49888 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:13:59.225352 0.323310 tcp 10.0.2.105 49889 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:13:59.548932 0.844888 tcp 10.0.2.105 49890 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:14:00.394400 0.562671 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:00.957498 0.320411 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:01.278312 0.365693 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:01.644433 0.000000 udp 10.0.2.105 7010 -> 122.176.57.240 8482 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 05:14:17.876596 0.055485 tcp 10.0.2.105 49891 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:14:17.932537 0.061014 tcp 10.0.2.105 49892 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:14:17.993901 0.156665 tcp 10.0.2.105 49893 -> 195.113.214.226 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:14:18.151118 0.056253 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.207757 0.136992 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.345163 0.071763 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.417308 0.065380 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.483104 0.206323 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.689818 0.164800 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.855046 0.123559 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:14:18.978980 0.094738 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:18:59.073516 3.000595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:19:06.079823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:14.081275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:19:30.084056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:20:02.090480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:06.097130 3.000583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:26:13.103929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:21.105429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:26:37.108126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:27:09.114171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:28:20.046861 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:28:20.046966 0.609702 tcp 10.0.2.105 49894 -> 31.192.7.200 5479 FSPA* 0 0 15 1806 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:33:13.121213 3.000705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:33:20.127756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:28.128965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:33:44.132039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:34:16.138014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:20.145065 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:40:27.152006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:35.153663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:40:51.156054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:41:23.162213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:44:41.257732 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:44:41.257908 0.284418 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:44:41.542697 0.196860 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:44:41.739975 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 05:44:57.483596 0.047705 tcp 10.0.2.105 49895 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:44:57.531593 0.047072 tcp 10.0.2.105 49896 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:44:57.579002 0.163150 tcp 10.0.2.105 49897 -> 195.113.214.226 443 SRPA* 0 0 40 30506 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:44:57.742960 0.249688 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:44:57.993030 0.311411 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:44:58.304828 0.000000 udp 10.0.2.105 7010 -> 85.97.241.177 3188 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 05:45:16.559367 0.045981 tcp 10.0.2.105 49898 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:16.605630 0.050894 tcp 10.0.2.105 49899 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:16.656890 0.232734 tcp 10.0.2.105 49900 -> 195.113.214.226 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:16.890187 0.390655 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.281248 0.197649 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.479324 0.177397 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.657136 0.073219 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.730748 0.144029 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.875139 0.055985 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:17.931468 0.187098 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.118924 0.061268 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.180549 0.038573 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.219501 0.076119 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.296039 0.142522 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.438983 0.077287 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.516621 0.215499 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.732535 0.160022 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:18.892963 0.156224 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:19.049576 0.146893 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:19.196827 0.524030 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:19.721247 0.206014 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:19.927616 0.088060 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:20.016056 0.135321 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:20.151770 0.071855 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:20.224054 0.059287 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:20.283692 0.000000 udp 10.0.2.105 7010 -> 75.58.227.32 6959 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 05:45:36.597600 0.045395 tcp 10.0.2.105 49901 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:36.643293 0.046881 tcp 10.0.2.105 49902 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:36.690494 0.178019 tcp 10.0.2.105 49903 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:45:36.869109 0.161214 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:37.030725 0.124117 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:45:37.155234 0.094400 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 05:47:27.169141 3.000726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 05:47:34.175873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:47:42.177599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:47:58.180736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:48:30.186426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:54:34.191934 3.002272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 05:54:41.199543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:54:49.201232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:05.204084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:55:37.209937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 05:58:20.655752 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 05:58:20.655853 2.993380 tcp 10.0.2.105 49904 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 05:58:29.648149 0.000000 tcp 10.0.2.105 49904 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 05:58:33.988134 0.009808 udp 10.0.2.105 52922 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/03 05:58:33.998351 0.009604 udp 10.0.2.105 56207 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/03 05:58:35.659614 0.046786 tcp 10.0.2.105 49905 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:58:35.706706 0.048746 tcp 10.0.2.105 49906 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:58:35.755701 0.147306 tcp 10.0.2.105 49907 -> 195.113.214.226 443 SRPA* 0 0 41 22044 flow=From-Botnet-V2-TCP-Established 1970/01/03 05:58:35.920041 0.550722 tcp 10.0.2.105 49908 -> 82.211.142.218 9811 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:01:41.215747 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:01:48.223557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:01:56.225364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:12.228206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:02:44.234156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:08:48.240586 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:08:55.247716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:03.249361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:19.252455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:09:51.258046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:15:55.264597 3.001130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:16:02.271788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:06.277501 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:16:06.277664 0.074906 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:06.352969 0.000000 udp 10.0.2.105 7010 -> 85.97.241.177 3188 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 06:16:10.273303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:24.266171 0.047332 tcp 10.0.2.105 49909 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:16:24.313844 0.046361 tcp 10.0.2.105 49910 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:16:24.360509 0.148883 tcp 10.0.2.105 49911 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:16:24.510107 0.206833 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:24.717360 0.351436 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:25.069193 0.956052 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.025686 0.247976 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.274041 0.243664 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.275757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:16:26.518072 0.147906 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.666384 0.073247 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.740030 0.143261 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:26.883633 0.177828 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.061801 0.194228 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.256609 0.184428 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.441397 0.039461 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.481281 0.037478 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.519101 0.087236 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.606755 0.059029 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.666191 0.174147 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.840726 0.158484 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:27.999553 0.146933 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.146872 0.077628 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.224871 0.142298 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.367572 0.214356 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.582312 0.146966 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.729689 0.060036 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.790139 0.136873 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.927475 0.072141 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:28.999997 0.076097 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:29.076465 0.335788 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:29.412618 0.094711 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:29.507662 0.164548 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:29.672586 0.123327 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:16:58.282109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:02.288401 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:23:09.295719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:17.297002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:23:33.300285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:24:05.306299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:28:36.476569 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:28:36.476671 0.622173 tcp 10.0.2.105 49912 -> 82.211.142.218 9811 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:30:09.312653 3.001319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:30:16.319879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:24.321020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:30:40.324063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:31:12.330292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:16.335904 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:37:23.343667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:31.344676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:37:47.348099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:38:19.353713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:23.360361 3.001572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:44:30.367472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:38.369200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:44:54.371805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:45:26.377946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:46:32.853934 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:46:32.854141 0.087209 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:32.941751 0.205707 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:33.147850 0.765508 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:33.913766 0.286502 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:34.200635 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 06:46:51.052945 0.046601 tcp 10.0.2.105 49913 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:46:51.099873 0.092559 tcp 10.0.2.105 49914 -> 195.113.214.226 80 SRPA* 0 0 19 14683 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:46:51.193106 0.251659 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:51.445144 0.150242 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:51.595768 0.101857 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:51.698012 0.143786 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:51.842200 0.178734 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.021347 0.191981 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.213699 0.184493 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.398607 0.039744 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.438732 0.040025 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.479144 0.079024 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.558555 0.171498 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.730394 0.153944 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:52.884760 0.157439 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.042592 0.147472 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.190476 0.081389 udp 10.0.2.105 7010 <-> 81.136.203.189 4448 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.272358 0.144710 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.417477 0.213588 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.631481 0.145750 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.777623 0.112650 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:53.890612 0.145262 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.036296 0.071142 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.107810 0.054042 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.162205 0.161528 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.324131 0.124572 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.449087 0.357028 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:46:54.806491 0.090270 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 06:51:30.384110 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:51:37.391154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:51:45.392608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:01.395726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:52:33.402186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:58:37.105728 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 06:58:37.105838 0.535844 tcp 10.0.2.105 49915 -> 82.211.142.218 9811 FSPA* 0 0 15 1794 flow=From-Botnet-V2-TCP-Established 1970/01/03 06:58:37.408124 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 06:58:44.415178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:58:52.416546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:08.419762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 06:59:40.426147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:05:44.432745 3.001196 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:05:51.439079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:05:59.440881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:15.443893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:06:47.449652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:12:51.455913 3.001702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:12:58.463009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:06.464776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:22.467627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:13:54.473875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:17:17.846349 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:17:17.846628 0.278488 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:18.125563 0.295006 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:18.420979 0.461982 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:18.883330 0.496768 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:19.380528 0.528074 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:19.909014 0.494673 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:20.404037 0.400819 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:20.805276 0.411675 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:21.217347 0.367677 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:21.585392 0.418274 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:22.004035 0.410362 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:22.414805 0.452398 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:22.867585 0.286020 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:23.154082 0.343901 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:23.498388 0.312277 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:23.811058 0.320865 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:24.132383 0.378113 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:24.510868 0.402563 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:24.913832 0.396856 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:25.311065 0.000000 udp 10.0.2.105 7010 -> 81.136.203.189 4448 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 07:17:42.854441 0.501719 tcp 10.0.2.105 49916 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:17:43.356418 0.554139 tcp 10.0.2.105 49917 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:17:43.910856 1.151497 tcp 10.0.2.105 49918 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:17:45.063048 0.395591 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:45.458991 0.429684 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:45.889066 0.377432 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:46.266905 0.312220 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:46.579503 0.358351 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:46.938269 0.320300 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:47.258981 0.304637 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:47.564051 0.394799 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:47.959326 0.344439 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:48.304164 0.370151 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:17:48.674660 0.585961 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:19:58.480867 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 07:20:05.487334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:13.488714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:20:29.491791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:21:01.498063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:05.504853 3.000716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:27:12.511562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:20.512597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:27:36.515598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:28:08.521639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:28:37.644198 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:28:37.644422 1.376935 tcp 10.0.2.105 49919 -> 82.211.142.218 9811 FSPA* 0 0 15 1633 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:34:12.528674 3.000540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:34:19.535537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:27.537018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:34:43.539632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:35:15.545662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:19.551009 3.002496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:41:26.559407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:34.560355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:41:50.563818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:42:22.569878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:01.186767 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:48:01.186917 0.000000 udp 10.0.2.105 7010 -> 81.136.203.189 4448 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 07:48:16.671039 0.514667 tcp 10.0.2.105 49920 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:48:17.186024 0.624650 tcp 10.0.2.105 49921 -> 195.113.214.226 80 SRPA* 0 0 20 14771 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:48:17.811216 0.290062 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:18.101637 0.450352 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:18.552404 0.323652 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:18.876496 0.442778 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:19.319698 0.586491 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:19.906717 0.360891 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:20.268005 0.412554 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:20.680914 0.491084 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:21.172559 0.398198 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:21.571129 0.428135 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:21.999645 0.436434 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:22.436540 0.447212 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:22.884184 0.289481 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:23.174050 0.288511 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:23.462960 0.322757 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:23.786137 0.745327 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:24.531881 0.404871 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:24.937148 0.398947 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:25.336604 0.384375 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:25.721417 0.386805 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:26.108600 0.393298 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:26.502309 0.461953 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:26.576466 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:48:26.964658 0.277678 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:27.242723 0.385629 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:27.628683 0.304541 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:27.933578 0.330214 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:28.264187 0.313281 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:28.577847 0.420013 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:28.998243 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 07:48:33.582991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:41.585111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:48:45.491074 0.549817 tcp 10.0.2.105 49922 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:48:46.041214 0.548302 tcp 10.0.2.105 49923 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:48:46.589830 1.340709 tcp 10.0.2.105 49924 -> 195.113.214.226 443 SRPA* 0 0 43 27351 flow=From-Botnet-V2-TCP-Established 1970/01/03 07:48:47.930900 0.575982 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/03 07:48:57.587982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:49:29.593740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:55:33.599437 3.002560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 07:55:40.607846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:55:48.608311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:04.611283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:56:36.617636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 07:58:39.023814 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 07:58:39.023948 1.262423 tcp 10.0.2.105 49925 -> 82.211.142.218 9811 FSPA* 0 0 15 1681 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:02:40.622857 3.002503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:02:47.630932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:02:55.632510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:11.635446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:03:43.641420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:09:47.647834 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:09:54.655078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:02.656439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:18.659463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:10:50.665982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:16:54.671050 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:17:01.678673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:09.680193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:25.683824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:17:57.689380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:19:16.272867 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:19:16.272972 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 08:19:34.741686 0.624836 tcp 10.0.2.105 49926 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:19:35.366841 0.585016 tcp 10.0.2.105 49927 -> 195.113.214.226 80 SRPA* 0 0 19 14650 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:19:35.952471 0.270970 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:36.223834 0.440287 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:36.664652 0.320407 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:36.985469 0.454590 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:37.440489 0.558164 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:37.999055 0.321921 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:38.321401 0.494976 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:38.816789 0.436629 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:39.253819 0.392783 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:39.647009 0.412385 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:40.059799 0.431731 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:40.491885 0.418514 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:40.910796 0.285688 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:41.196907 0.329962 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:41.527257 0.310189 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:41.837851 0.413516 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:42.251700 0.493597 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:42.745688 0.399512 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:43.145627 0.372380 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:43.518430 0.372609 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:43.891454 0.295559 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:44.187366 0.458954 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:44.646753 0.395533 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:45.042703 0.303806 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:45.346898 0.381621 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:45.728882 0.352128 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:46.081428 0.408950 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:46.490808 0.295083 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:19:46.786294 0.570078 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:24:01.695925 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 08:24:08.703184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:16.704197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:24:32.707420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:25:04.713644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:28:40.294407 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:28:40.294685 1.320801 tcp 10.0.2.105 49928 -> 82.211.142.218 9811 FSPA* 0 0 13 1477 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:31:08.720199 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:31:15.726879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:23.728485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:31:39.731491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:32:11.737140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:15.743763 3.001409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:38:22.750751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:30.752645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:38:46.755481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:39:18.761581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:22.767173 3.002209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:45:29.775046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:37.776126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:45:53.779161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:46:25.785283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:50:04.770486 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:50:04.770628 0.441542 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:05.212660 0.439204 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:05.652235 0.325355 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:05.977948 0.640641 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:06.618940 0.439843 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:07.059206 0.548045 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:07.607645 0.491006 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:08.099079 0.585714 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:08.685154 0.423829 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:09.109385 0.399669 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:09.509421 0.292401 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:09.802243 0.434554 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:10.237156 0.414790 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:10.652364 0.328713 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:10.981478 0.288025 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:11.269859 0.424592 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:11.694788 0.000000 udp 10.0.2.105 7010 -> 95.89.179.37 6418 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 08:50:27.795631 0.551359 tcp 10.0.2.105 49929 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:50:28.347341 0.515625 tcp 10.0.2.105 49930 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:50:28.863260 1.306788 tcp 10.0.2.105 49931 -> 195.113.214.226 443 SRPA* 0 0 35 24871 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:50:30.170625 0.407370 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:30.578363 0.309708 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:30.888492 0.392854 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:31.281749 0.391058 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:31.673186 0.469685 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:32.143240 0.365328 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:32.508930 0.292972 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:32.802293 0.383832 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:33.186550 0.335946 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:33.522897 0.602609 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:34.125911 0.405990 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:50:34.532324 0.277888 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 08:52:29.791265 3.001508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 08:52:36.799077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:52:44.799992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:00.803020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:53:32.809279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:58:41.624056 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 08:58:41.624303 1.293738 tcp 10.0.2.105 49932 -> 82.211.142.218 9811 FSPA* 0 0 15 1647 flow=From-Botnet-V2-TCP-Established 1970/01/03 08:59:36.815084 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 08:59:43.822457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 08:59:51.824024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:07.827307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:00:39.833628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:06:43.839036 3.001872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:06:50.846679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:06:58.847936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:14.851157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:07:46.857195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:13:51.805273 3.001267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:13:58.811745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:06.813399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:22.816500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:14:54.822729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:20:45.246933 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:20:45.247041 0.279560 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:45.527117 0.314888 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:45.842379 0.317375 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:46.160190 0.468010 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:46.628625 0.460828 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:47.089862 0.440130 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:47.530385 0.522973 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:48.053700 0.584209 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:48.638318 0.434683 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:49.073363 0.867803 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:49.941563 0.398459 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:50.340463 0.287974 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:50.628857 0.418775 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:51.048034 0.308297 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:51.356701 0.318437 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:51.675556 0.445395 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:52.121360 0.404791 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:52.526565 0.393379 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:52.920378 0.396808 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:53.317607 0.316084 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:53.634108 0.368275 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:54.002785 0.436286 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:54.439552 0.394650 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:54.834580 0.321172 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:55.156128 0.385515 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:55.542080 0.347596 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:55.890094 0.561656 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:56.452102 0.405745 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:56.858179 0.306956 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:20:58.828872 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:21:05.835874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:13.837625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:21:29.840823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:22:01.846814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:11.862073 3.000655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:28:18.868756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:26.869931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:42.873113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:28:43.384724 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:28:43.384982 1.390812 tcp 10.0.2.105 49933 -> 82.211.142.218 9811 FSPA* 0 0 15 1777 flow=From-Botnet-V2-TCP-Established 1970/01/03 09:29:14.879238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:35:35.890454 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:35:42.897263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:35:50.899032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:06.901559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:36:38.907835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:42.914134 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:42:49.921112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:42:57.922715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:13.925335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:43:45.931723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:49:49.937574 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:49:56.944751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:04.946801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:20.949171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:50:52.955214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:51:06.917268 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:51:06.917453 0.301532 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:07.219352 0.288509 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:07.508296 0.301449 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:07.810103 0.402513 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:08.212999 0.473472 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:08.686897 0.423884 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:09.111205 0.495991 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:09.607559 0.556609 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:10.164566 0.405751 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:10.570752 0.394592 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:10.965860 0.421708 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:11.387967 0.308179 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:11.696546 0.283271 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:11.980352 0.431603 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:12.412546 0.302088 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:12.714992 0.438831 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:13.154383 0.399165 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:13.553985 0.288932 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:13.843323 0.403342 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:14.247017 0.388747 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:14.636192 0.410403 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:15.046982 0.480665 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:15.527999 0.393064 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:15.921467 0.312385 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:16.234239 0.582905 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:16.817564 0.427381 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:17.245394 0.388946 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:17.634776 0.331367 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:51:17.966533 0.284971 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 09:56:56.961864 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 09:57:03.969151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:11.970326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:27.973566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:57:59.979478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 09:58:44.774201 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 09:58:44.774357 1.276384 tcp 10.0.2.105 49934 -> 82.211.142.218 9811 FSPA* 0 0 15 1643 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:04:03.985940 3.001434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:04:10.992757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:18.994238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:04:34.997293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:05:07.003622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:11.010095 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:11:18.016905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:26.018092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:11:42.021242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:12:14.027339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:18.034324 3.000826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:18:25.041110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:33.042160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:18:49.055171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:19:21.061898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:21:28.995538 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:21:28.995639 0.322694 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:29.318719 0.436030 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:29.755175 0.331379 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:30.087001 0.252016 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:30.339405 0.777325 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:31.117209 0.363266 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:31.480904 0.489882 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:31.971181 0.525085 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:32.496634 0.385950 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:32.883020 0.424151 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:33.307582 0.385092 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:33.693082 0.299059 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:33.992544 0.281997 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:34.274939 0.430304 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:34.705633 0.302406 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:35.008611 0.425317 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:35.434424 0.389490 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:35.824502 0.401239 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:36.226176 0.299134 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:36.525723 0.388935 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:36.915072 0.399708 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:37.315146 0.428952 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:37.744654 0.393500 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:38.138601 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 10:21:53.352931 0.543777 tcp 10.0.2.105 49935 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:21:53.896998 0.520934 tcp 10.0.2.105 49936 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:21:54.418266 1.360577 tcp 10.0.2.105 49937 -> 195.113.214.226 443 SRPA* 0 0 39 27985 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:21:55.779541 0.595298 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:56.375182 0.405278 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:56.780851 0.273772 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:57.055051 0.383276 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:21:57.438677 0.338652 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:25:25.067938 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:25:32.075134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:40.076088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:25:56.079252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:26:28.085409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:28:46.054346 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:28:46.054541 1.318031 tcp 10.0.2.105 49938 -> 82.211.142.218 9811 FSPA* 0 0 15 1611 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:32:32.090997 3.002062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:32:39.099105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:32:47.100278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:03.103392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:33:35.109334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:39:39.115349 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:39:46.122928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:39:54.124568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:10.127527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:40:42.133554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:46:46.139327 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 10:46:53.146972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:01.148541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:17.151607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:47:49.157207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:52:03.243119 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:52:03.243272 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 10:52:21.491562 0.574941 tcp 10.0.2.105 49939 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:52:22.066786 0.535125 tcp 10.0.2.105 49940 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:52:22.602228 1.299139 tcp 10.0.2.105 49941 -> 195.113.214.226 443 SRPA* 0 0 33 24741 flow=From-Botnet-V2-TCP-Established 1970/01/03 10:52:23.902074 0.320451 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:24.222959 0.429490 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:24.652901 0.292996 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:24.946252 0.394557 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:25.341207 1.061096 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:26.402673 0.517229 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:26.920443 0.326448 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:27.247369 0.406570 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:27.654426 0.385924 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:28.040741 0.580983 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:28.622079 0.300721 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:28.923221 0.417123 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:29.340723 0.293918 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:29.635016 0.312518 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:29.947918 0.436940 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:30.385235 0.433448 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:30.819099 0.390575 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:31.210076 0.416450 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:31.626853 0.388878 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:32.016095 0.295468 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:32.312001 0.408703 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:32.721086 0.480831 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:33.202362 0.467005 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:33.669727 0.561502 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:34.231610 0.421245 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:34.653234 0.293441 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:34.947078 0.388681 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:52:35.336197 0.349185 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/03 10:53:53.163536 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 10:54:00.170469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:08.172372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:24.175432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:54:56.181501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 10:58:47.374254 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 10:58:47.374482 1.270790 tcp 10.0.2.105 49942 -> 82.211.142.218 9811 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:01:00.187798 3.000926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:01:07.194565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:15.196006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:01:31.199003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:02:03.205420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:07.211152 3.001821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:08:14.218700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:22.220201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:08:38.222981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:09:10.229367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:14.235933 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:15:21.242759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:29.244225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:15:45.247454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:16:17.252884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:21.259467 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:22:28.266684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:36.268002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:22:42.747334 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:22:42.747447 0.862045 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:43.609923 0.436629 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:44.046965 0.444192 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:44.491577 0.393503 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:44.885486 0.489810 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:45.375673 0.491688 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:45.867771 0.318652 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:46.186833 0.435095 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:46.622292 0.352960 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:46.975639 0.365008 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:47.341037 0.551964 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:47.893432 0.308172 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:48.202015 0.267748 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:48.470190 0.292994 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:48.763580 0.425859 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:49.189789 0.435505 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:49.625685 0.388089 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:50.014255 0.311294 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:50.325952 0.394617 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:22:50.720957 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 11:22:52.271313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:23:05.923658 0.527588 tcp 10.0.2.105 49943 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:23:06.451572 0.509072 tcp 10.0.2.105 49944 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:23:06.960973 1.315722 tcp 10.0.2.105 49945 -> 195.113.214.226 443 SRPA* 0 0 49 28525 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:23:08.277150 0.414072 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:08.691642 0.390605 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:09.082651 0.443691 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:09.526761 0.588067 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:10.115261 0.388576 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:10.504404 0.403332 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:10.908131 0.312466 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:11.220953 0.318368 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:23:24.277364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:28:48.644088 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:28:48.644318 1.276345 tcp 10.0.2.105 49946 -> 82.211.142.218 9811 FSPA* 0 0 15 1609 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:29:28.283310 3.001598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:29:35.290650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:43.291680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:29:59.295442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:30:31.301562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:35.306592 3.002261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:36:42.314353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:36:50.316298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:37:06.319271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:37:38.325218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:43:42.331455 3.001144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:43:49.338397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:43:57.339992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:13.343271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:44:45.439344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:50:49.445640 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 11:50:56.452745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:04.454081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:20.457234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:51:52.463022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:53:24.586176 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:53:24.586364 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 11:53:42.494034 0.538166 tcp 10.0.2.105 49947 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:53:43.032519 0.544662 tcp 10.0.2.105 49948 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:53:43.577493 1.131003 tcp 10.0.2.105 49949 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:53:44.709181 0.315854 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:45.025432 0.765616 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:45.791521 0.444551 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:45.791904 4.200179 tcp 10.0.2.105 49950 -> 84.59.151.27 3285 SPA_* 0 0 19 7260 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:53:46.236533 0.280083 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:46.517025 1.483937 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:48.001375 0.342434 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:48.344203 0.491206 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:48.835752 0.401706 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:49.237822 0.391732 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:49.629902 0.417269 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:50.047626 0.563191 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:50.611250 0.294786 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:50.906464 0.434699 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:51.341582 0.314221 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:51.656232 0.285300 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:51.941921 0.450852 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:52.393101 0.392059 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:52.785666 0.399503 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:53.185537 0.426867 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:53.612819 0.390205 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:54.003418 0.365566 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:54.369371 0.441276 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:54.811074 0.572857 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:55.384489 0.272211 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:55.657127 0.396171 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:56.053705 0.412929 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/03 11:53:56.467026 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 11:54:13.847409 0.542019 tcp 10.0.2.105 49951 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:54:14.389720 0.547457 tcp 10.0.2.105 49952 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:54:14.937468 1.085151 tcp 10.0.2.105 49953 -> 195.113.214.226 443 SRPA* 0 0 23 12544 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:54:19.785073 1.674864 tcp 10.0.2.105 49950 -> 84.59.151.27 3285 FRA_* 0 0 4 740 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:57:56.468752 3.001823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 11:58:03.476185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:11.478301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:27.480696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 11:58:49.963562 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 11:58:49.963759 1.298632 tcp 10.0.2.105 49954 -> 82.211.142.218 9811 FSPA* 0 0 15 1656 flow=From-Botnet-V2-TCP-Established 1970/01/03 11:58:59.487190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:03.493498 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:05:10.500133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:18.501919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:05:34.505227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:06:06.510987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:10.518500 2.999856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:12:17.524459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:25.526329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:12:41.528999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:13:13.535274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:17.540561 3.002296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:19:24.548085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:32.549809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:19:48.553060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:20:20.558876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:24:36.978179 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:24:36.978292 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 12:24:52.122404 0.558919 tcp 10.0.2.105 49955 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:24:52.681634 0.589926 tcp 10.0.2.105 49956 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:24:53.271510 1.368679 tcp 10.0.2.105 49957 -> 195.113.214.226 443 SRPA* 0 0 29 18391 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:24:54.641045 0.342085 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:54.983574 0.755732 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:55.739800 0.448990 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:55.740180 4.454252 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 SPA_* 0 0 25 13177 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:24:56.189159 0.291126 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:56.480696 0.347630 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:56.828741 0.891605 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:57.720716 0.473590 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:58.194691 0.422174 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:58.617287 0.394512 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:59.012162 0.430682 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:59.443247 0.432000 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:24:59.875595 0.310279 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:00.186228 0.554224 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:00.740874 0.320605 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:00.919740 2.485944 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 18 9784 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:01.061940 0.282404 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:01.344758 0.345600 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:01.690739 0.451666 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:02.142827 0.392542 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:02.535779 0.420953 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:02.957125 0.404210 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:03.361698 0.390904 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:03.752951 0.475926 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:04.229284 0.302187 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:04.531903 0.583564 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:05.115978 0.381431 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:05.497771 0.409325 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:25:09.239255 4.558319 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 20 11696 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:15.973396 3.118187 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 13 7842 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:21.448871 4.305676 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 48 25176 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:22.933582 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:25:27.099296 4.987869 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 23 17006 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:33.853199 3.686395 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 17 9486 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:39.385067 4.318843 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 22 12292 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:46.438550 4.684237 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 47 28542 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:25:51.434460 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:25:53.120262 1.902916 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 7 4474 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:21.900480 4.685077 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 6 3192 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:24.565363 3.000962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:26:26.925415 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:26:26.967731 3.613490 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 14 6700 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:31.572043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:32.538194 1.642547 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 10 7448 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:39.573823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:43.975815 4.150419 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 31 14250 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:49.484650 3.968984 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:26:50.929819 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:26:55.577140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:26:58.783128 4.148284 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:05.102698 0.197807 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 2 620 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:26.935944 4.620230 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 22 8100 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:27.582817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:27:31.929137 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:27:33.543210 2.481666 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 12 5276 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:38.734567 4.540881 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 23 10674 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:45.140211 4.961653 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:50.305569 0.000000 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:27:56.138341 4.291635 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 15 6038 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:02.329292 4.530101 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 6 3480 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:07.450711 3.703664 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:11.426114 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:28:13.647328 0.402070 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:22.796585 1.586997 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:35.637881 4.890165 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 27 10366 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:40.427803 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:28:42.040047 4.947563 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 22 10096 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:49.613154 4.443968 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 23 8846 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:28:51.263633 2.993999 tcp 10.0.2.105 49959 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 12:28:58.904948 4.948940 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 18 11708 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:00.255790 0.000000 tcp 10.0.2.105 49959 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 12:29:04.432002 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:29:06.098869 0.206539 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 2 1156 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:06.267642 0.536985 tcp 10.0.2.105 49960 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:06.804904 0.595017 tcp 10.0.2.105 49961 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:07.438220 3.002481 tcp 10.0.2.105 49962 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 12:29:15.967808 4.767552 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:16.439161 0.000000 tcp 10.0.2.105 49962 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 12:29:21.342499 3.589395 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:22.438827 0.553846 tcp 10.0.2.105 49963 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:22.992964 0.547360 tcp 10.0.2.105 49964 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:23.540702 1.150275 tcp 10.0.2.105 49965 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:24.701624 1.373928 tcp 10.0.2.105 49966 -> 94.137.168.16 9773 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:29.203242 4.680891 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 13 4882 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:35.826815 0.200997 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 2 1168 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:46.376827 4.481922 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:51.429572 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:29:51.741814 4.504570 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 17 6682 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:29:57.030123 4.624005 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 18 6736 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:30:03.889454 0.398575 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:30:34.090893 0.000084 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:30:44.939930 0.000175 tcp 10.0.2.105 49958 -> 84.59.151.27 3285 RA_PA 0 0 2 1156 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:33:31.588899 3.001786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 12:33:38.596003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:33:46.598001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:34:02.600765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:34:34.607051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:38.613022 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:40:45.620134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:40:53.621776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:09.624876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:41:41.631139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:47:45.637245 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:47:52.644108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:00.645606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:16.649201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:48:48.654910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:54:52.661252 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 12:54:59.668132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:07.670047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:18.315143 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:55:18.315351 0.339721 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:18.655523 0.833019 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:19.488962 0.492074 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:19.489340 4.586703 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 SPA_* 0 0 12 2774 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:19.981476 0.289690 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 594 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:20.271567 0.399908 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:20.671912 0.910997 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:21.583331 0.483744 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:22.067532 0.383986 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:22.451868 0.388565 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:22.840862 0.307112 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:23.148438 0.427515 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:23.576354 0.430500 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:23.672757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:55:24.007266 0.710488 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:24.718174 0.330793 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:24.924674 4.736919 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 31 15390 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:25.049369 0.290873 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:25.340615 0.332822 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:25.673848 0.429717 udp 10.0.2.105 7010 <-> 67.232.56.212 4590 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:26.103933 0.393696 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:26.497994 0.417139 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:26.915562 0.414382 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:27.330350 0.387658 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:27.718502 0.463722 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:28.182632 0.317073 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:28.500103 0.578449 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:29.078924 0.393055 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:29.472417 0.421720 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/03 12:55:30.155538 0.015312 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 7 6522 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:36.733638 4.971275 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 23 12666 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:42.395335 4.921306 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 21 12858 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:47.947002 4.314117 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 37 23906 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:48.928948 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:55:53.057763 4.964425 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 25 18354 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:55:55.678935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 12:56:02.455763 3.417577 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 13 8894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:07.614887 4.139417 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 41 22074 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:13.327612 4.431565 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 28 15604 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:15.927906 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:56:18.419361 4.298781 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 53 29730 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:27.510004 2.534980 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 19 12074 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:40.703567 1.882881 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 8040 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:45.430162 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:56:47.985304 4.565396 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 22 10816 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:56:53.138856 4.907411 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:00.431636 0.200524 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 2 620 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:05.619595 4.866372 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 6062 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:12.001748 3.727931 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:17.888093 3.273918 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:23.025690 4.866000 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 16 6104 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:28.349784 1.628187 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 5 1830 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:30.424707 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:57:41.842349 4.437791 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 11 5322 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:47.144454 3.258631 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:52.452173 3.499371 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:57:54.930309 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:58:01.333417 3.900429 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 10 5256 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:09.970388 4.543318 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 22 8524 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:16.223285 3.895429 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 7568 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:19.425296 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:58:30.025986 4.831583 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 13 4894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:35.444235 1.856977 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 13 4894 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:47.134327 3.407108 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 18 7784 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:58:52.285685 2.723314 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:05.794426 4.859712 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 5888 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:10.795270 3.078525 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:12.431559 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:59:18.439132 4.407636 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 25 9734 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:25.718731 3.266690 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 31 13726 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:26.081874 1.325767 tcp 10.0.2.105 49968 -> 94.137.168.16 9773 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:30.876560 0.952923 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:36.283258 4.930068 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:41.813138 4.982196 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 21 10042 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:50.926984 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 12:59:52.300877 4.904069 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 7460 flow=From-Botnet-V2-TCP-Established 1970/01/03 12:59:57.958443 3.613579 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 13 4894 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:03.573445 4.928834 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 24 10728 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:12.569721 3.808037 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:18.320223 3.441188 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:30.652090 4.836272 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 21 8994 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:35.430828 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:00:35.691678 4.348603 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 8 3576 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:40.909356 3.908306 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:46.862555 4.999585 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 20 8940 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:53.880102 3.460680 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:59.853945 4.929509 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:00:59.925912 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:01:05.486609 0.006332 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 3 1210 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:10.805959 4.284985 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:15.966798 4.959258 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:23.930322 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:01:25.434884 4.665211 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 4316 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:30.799123 4.688383 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:36.176937 1.063173 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:42.421548 4.481029 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:48.863302 1.044707 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:59.466634 4.551579 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:01:59.684632 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:02:04.429055 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:02:04.735127 1.996960 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:06.692030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:14.693565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:26.965876 4.742527 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:30.696448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:02:31.928087 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:02:32.313170 4.865708 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:37.375944 3.206430 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 15 7098 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:42.793007 4.901067 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 24 9680 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:47.891658 4.812624 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 21 9518 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:53.025778 0.193121 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:02:56.433776 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:03:02.702990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:03:03.600785 0.203669 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 A_PA 0 0 2 644 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:03:08.736399 4.777630 tcp 10.0.2.105 49967 -> 84.59.151.27 3285 FPA_* 0 0 16 4281 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:09:06.709179 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:09:13.715841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:21.717707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:09:37.720828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:10:09.726361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:13.732541 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:16:20.740164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:28.741731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:16:44.744629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:17:16.750792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:20.756865 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:23:27.763765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:35.765681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:23:51.768289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:24:23.774325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:25:47.154650 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:25:47.154747 0.317780 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:25:47.472982 0.518136 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:25:47.991526 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:26:06.304764 0.580926 tcp 10.0.2.105 49969 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:06.886050 0.541720 tcp 10.0.2.105 49970 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:07.428034 1.148200 tcp 10.0.2.105 49971 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:08.576885 0.442396 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:09.019692 0.338041 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:09.358130 0.848949 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:10.207512 0.485587 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:10.693465 0.301693 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:10.995515 0.386275 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:11.382167 0.390725 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:11.773272 0.421350 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:12.194981 0.431070 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:12.626450 0.707767 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:13.334635 0.323687 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 200 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:13.658724 0.282309 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:13.941397 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:26:29.175979 0.545351 tcp 10.0.2.105 49972 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:29.721606 0.597658 tcp 10.0.2.105 49973 -> 195.113.214.226 80 SRPA* 0 0 20 14740 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:30.319870 0.000000 udp 10.0.2.105 7010 -> 67.232.56.212 4590 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:26:47.933013 0.552179 tcp 10.0.2.105 49974 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:48.485002 0.545914 tcp 10.0.2.105 49975 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:49.031189 1.137166 tcp 10.0.2.105 49976 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:26:50.168967 0.397175 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:50.566511 0.385408 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:50.952359 0.407650 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:51.360435 0.392318 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:51.753166 0.456131 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:52.209708 0.295729 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:52.505779 0.598870 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:53.105051 0.377534 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:26:53.482948 0.414471 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:29:27.411946 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:29:27.412129 3.003316 tcp 10.0.2.105 49977 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 13:29:36.413949 0.000000 tcp 10.0.2.105 49977 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/03 13:29:42.415496 0.545955 tcp 10.0.2.105 49978 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:29:42.961260 0.541832 tcp 10.0.2.105 49979 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:29:43.503409 1.177448 tcp 10.0.2.105 49980 -> 195.113.214.226 443 SRPA* 0 0 21 13074 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:29:44.706627 1.685335 tcp 10.0.2.105 49981 -> 128.255.183.224 9027 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:30:27.780560 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:30:34.787891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:42.789532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:30:58.792889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:31:30.798868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:34.804533 3.002116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:37:41.812407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:37:49.813499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:38:05.816518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:38:37.822662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:41.829524 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:44:48.836400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:44:56.837965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:12.840688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:45:44.846494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:51:48.852142 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 13:51:55.860118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:03.861715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:19.864769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:52:51.870460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:57:06.356751 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:57:06.356863 0.860128 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:07.217427 0.000000 udp 10.0.2.105 7010 -> 67.232.56.212 4590 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:57:24.695552 0.561202 tcp 10.0.2.105 49982 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:57:25.257033 0.555677 tcp 10.0.2.105 49983 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:57:25.813031 1.389879 tcp 10.0.2.105 49984 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:57:27.203509 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:57:43.110380 0.544365 tcp 10.0.2.105 49985 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:57:43.654990 0.589487 tcp 10.0.2.105 49986 -> 195.113.214.226 80 SRPA* 0 0 20 14685 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:57:44.245009 0.319472 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:44.564887 0.460565 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:45.025856 0.446162 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:45.472535 0.343827 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:45.816761 0.969757 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:46.786885 0.487881 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:47.275124 0.312951 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:47.588451 0.425124 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:48.013997 0.386507 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:48.400862 0.390276 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:48.791520 0.549927 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:49.341798 0.432720 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:49.774895 0.327171 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:50.102464 0.288179 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:50.391011 0.405894 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:50.797285 0.392448 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:51.190135 0.436122 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:51.626677 0.391263 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:52.018348 0.465575 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:52.484330 0.307446 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:52.792195 0.619395 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:53.411981 0.400561 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:53.812955 0.412767 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:54.237612 0.876446 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:55.114611 0.576602 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:55.691750 0.433155 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:56.125573 0.339607 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:56.465686 0.445950 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:56.912167 0.708919 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:57.621654 0.488201 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:58.110363 0.432623 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:58.543468 0.298251 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:58.842347 0.399798 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:59.242705 0.563117 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:57:59.806400 0.391749 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:00.198613 0.433767 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:00.632990 0.327207 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:00.960790 0.398545 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:01.359838 0.395010 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:01.755455 0.279143 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:02.035078 0.400285 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:02.435987 0.405259 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 654 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:02.841708 0.459438 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:03.301615 0.315077 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:03.617198 0.388190 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:04.006064 0.404239 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:04.410888 0.619756 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:05.031256 0.000000 udp 10.0.2.105 7010 -> 151.54.58.176 4172 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:07.925114 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:58:10.909377 0.392700 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/03 13:58:11.312305 0.000000 udp 10.0.2.105 7010 -> 76.176.28.159 4257 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:16.487718 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:22.526189 0.000000 udp 10.0.2.105 7010 -> 217.193.181.74 1507 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:30.437914 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1462 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:35.424064 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:58:36.876524 0.000000 udp 10.0.2.105 7010 -> 84.202.162.177 3945 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:44.107092 0.000000 udp 10.0.2.105 7010 -> 208.125.137.100 9876 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:49.735561 0.000000 udp 10.0.2.105 7010 -> 91.143.194.246 7052 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:58:55.876443 3.001767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 13:58:57.065853 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:01.932533 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:59:02.884410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:03.004073 0.000000 udp 10.0.2.105 7010 -> 96.25.50.78 4907 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:10.024426 0.000000 udp 10.0.2.105 7010 -> 99.169.217.69 2927 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:10.885098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:15.472105 0.000000 udp 10.0.2.105 7010 -> 190.48.46.254 2146 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:23.724308 0.000000 udp 10.0.2.105 7010 -> 12.131.105.180 6151 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:26.888765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 13:59:28.430664 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 13:59:32.336398 0.000000 udp 10.0.2.105 7010 -> 213.33.89.98 6737 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:39.957514 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:46.397230 1.733403 tcp 10.0.2.105 49987 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/03 13:59:48.840541 0.000000 udp 10.0.2.105 7010 -> 82.6.95.123 1056 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:56.852010 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 13:59:58.894402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:00:04.242524 0.000000 udp 10.0.2.105 7010 -> 78.184.29.215 5470 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:09.500054 0.527873 udp 10.0.2.105 7010 -> 177.41.86.95 3220 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:10.027927 0.000000 icmp 177.41.86.95 0x0303 -> 10.0.2.105 0x940c URP 192 1 281 flow=Background 1970/01/03 14:00:14.426988 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:00:18.492707 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:24.201068 0.000000 udp 10.0.2.105 7010 -> 78.186.182.140 6932 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:30.100122 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:38.811904 0.000000 udp 10.0.2.105 7010 -> 93.193.158.148 7662 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:43.428455 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:00:44.339896 0.000000 udp 10.0.2.105 7010 -> 67.143.241.87 1834 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:00:53.052438 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:01.264578 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:09.696337 0.288543 udp 10.0.2.105 7010 -> 79.247.248.75 6159 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:09.984880 0.000000 icmp 79.247.248.75 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 310 flow=Background 1970/01/03 14:01:14.432902 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:01:16.456121 0.282417 udp 10.0.2.105 7010 <-> 79.219.100.15 2430 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:01:16.747184 0.000000 udp 10.0.2.105 7010 -> 78.150.173.183 9941 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:24.337478 0.000000 udp 10.0.2.105 7010 -> 80.89.80.173 8214 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:31.928445 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:37.736693 0.808528 udp 10.0.2.105 7010 -> 186.44.185.195 6657 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:38.545221 0.000000 icmp 186.44.185.195 0x0303 -> 10.0.2.105 0x011a URP 192 1 146 flow=Background 1970/01/03 14:01:42.433400 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:01:44.656583 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:50.314868 0.000000 udp 10.0.2.105 7010 -> 87.17.126.37 3845 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:01:56.914448 0.000000 udp 10.0.2.105 7010 -> 151.66.161.176 2244 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:03.513662 0.412856 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 710 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:02:03.946359 0.000000 udp 10.0.2.105 7010 -> 105.236.207.39 2509 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:08.430823 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:02:12.496997 0.000000 udp 10.0.2.105 7010 -> 88.250.234.182 8845 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:17.914746 0.000000 udp 10.0.2.105 7010 -> 92.234.187.129 4688 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:26.126122 0.000000 udp 10.0.2.105 7010 -> 68.15.139.240 1925 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:34.618265 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:39.425430 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:02:40.937872 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:46.045097 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:51.132127 0.000000 udp 10.0.2.105 7010 -> 201.247.102.50 9184 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:02:58.162161 0.000000 udp 10.0.2.105 7010 -> 72.234.28.173 2359 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:07.115627 0.394139 udp 10.0.2.105 7010 -> 67.162.31.163 4085 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:07.509766 0.000000 icmp 67.162.31.163 0x0303 -> 10.0.2.105 0xf50f URP 192 1 117 flow=Background 1970/01/03 14:03:11.931604 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:03:14.405602 0.000000 udp 10.0.2.105 7010 -> 107.199.178.121 6747 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:21.806237 0.000000 udp 10.0.2.105 7010 -> 187.138.78.243 9696 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:27.174148 0.000000 udp 10.0.2.105 7010 -> 68.64.220.18 8914 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:34.925708 0.000000 udp 10.0.2.105 7010 -> 88.62.14.106 8700 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:39.932173 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:03:41.214497 0.000000 udp 10.0.2.105 7010 -> 99.9.80.215 6413 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:48.474959 0.000000 udp 10.0.2.105 7010 -> 82.90.219.191 3027 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:03:57.307735 0.000000 udp 10.0.2.105 7010 -> 98.209.0.7 3434 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:05.128584 0.000000 udp 10.0.2.105 7010 -> 109.208.202.236 5229 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:09.925206 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:04:11.397612 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:18.207559 0.000000 udp 10.0.2.105 7010 -> 78.147.8.242 9529 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:26.599623 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:32.718116 0.687788 udp 10.0.2.105 7010 -> 110.143.47.201 6816 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:33.405904 0.000000 icmp 110.143.47.201 0x0303 -> 10.0.2.105 0xa01a URP 192 1 163 flow=Background 1970/01/03 14:04:37.424734 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:04:38.717370 0.000000 udp 10.0.2.105 7010 -> 75.74.238.49 1813 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:45.627155 0.321381 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:04:45.958752 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 9977 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:53.377888 0.000000 udp 10.0.2.105 7010 -> 88.252.115.136 5937 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:04:58.385588 0.000000 udp 10.0.2.105 7010 -> 24.79.14.98 5956 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:02.931809 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:05:05.255118 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:11.043831 0.000000 udp 10.0.2.105 7010 -> 152.79.12.36 4607 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:18.304005 0.000000 udp 10.0.2.105 7010 -> 88.236.225.181 4253 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:25.754391 0.420172 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:05:26.192193 0.000000 udp 10.0.2.105 7010 -> 67.248.182.24 6756 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:30.430739 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:05:31.332733 0.000000 udp 10.0.2.105 7010 -> 82.234.161.92 3615 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:37.291487 0.000000 udp 10.0.2.105 7010 -> 151.26.54.72 3494 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:43.340205 0.000000 udp 10.0.2.105 7010 -> 109.144.142.11 2651 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:48.928186 0.000000 udp 10.0.2.105 7010 -> 79.192.48.4 4600 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:56.979837 0.285824 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:05:57.265661 0.000000 icmp 217.91.253.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 263 flow=Background 1970/01/03 14:06:01.926222 0.000450 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:06:02.900538 3.001504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:06:05.461697 0.464306 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:06:05.950632 0.000000 udp 10.0.2.105 7010 -> 93.209.178.66 8985 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:09.907696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:12.782265 0.000000 udp 10.0.2.105 7010 -> 221.224.126.154 6567 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:17.909447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:21.334231 0.302571 udp 10.0.2.105 7010 -> 87.173.234.218 1288 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:21.636802 0.000000 icmp 87.173.234.218 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 198 flow=Background 1970/01/03 14:06:25.930556 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:06:27.883738 0.000000 udp 10.0.2.105 7010 -> 85.99.130.112 5005 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:33.912238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:06:34.283214 0.000000 udp 10.0.2.105 7010 -> 184.71.124.86 3571 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:40.251936 0.000000 udp 10.0.2.105 7010 -> 46.252.68.90 6379 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:48.894313 0.604573 udp 10.0.2.105 7010 -> 110.77.148.196 1094 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:06:49.498886 0.000000 icmp 110.77.148.196 0x0303 -> 10.0.2.105 0x4604 URP 192 1 149 flow=Background 1970/01/03 14:06:53.430723 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:06:54.512272 0.000000 udp 10.0.2.105 7010 -> 88.56.49.97 4705 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:07:02.053110 0.000000 udp 10.0.2.105 7010 -> 220.246.51.40 2507 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:07:06.128827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:07:09.132905 0.000000 udp 10.0.2.105 7010 -> 58.32.191.30 2567 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:07:17.144703 0.000000 udp 10.0.2.105 7010 -> 201.223.243.119 8461 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:07:22.141865 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:07:24.505131 0.000000 udp 10.0.2.105 7010 -> 165.228.231.212 1931 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:07:31.695328 0.000000 udp 10.0.2.105 7010 -> 79.107.208.47 1395 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:13:10.134263 3.001833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:13:17.142236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:25.143977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:13:41.146554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:14:13.152386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:17.159183 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:20:24.165920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:32.167763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:20:48.170650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:21:20.176574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:24.182505 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:27:31.189758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:39.191259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:27:55.214614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:28:27.220932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:29:48.347994 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:29:48.348233 1.729236 tcp 10.0.2.105 49988 -> 128.255.183.224 9027 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:34:31.226893 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:34:38.233928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:34:46.235509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:35:02.238327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:35:34.244989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:37:44.302507 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:37:44.302608 0.608781 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:37:44.911863 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 14:38:00.808620 0.559750 tcp 10.0.2.105 49989 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:38:01.368619 0.550869 tcp 10.0.2.105 49990 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:38:01.919396 1.381101 tcp 10.0.2.105 49991 -> 195.113.214.226 443 SRPA* 0 0 35 25459 flow=From-Botnet-V2-TCP-Established 1970/01/03 14:38:03.301185 0.297251 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:03.598885 0.447187 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:04.046471 0.341826 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:04.388664 0.794299 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:05.183348 0.486656 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:05.670376 0.419965 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:06.090756 0.306168 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:06.397332 0.392761 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:06.790459 0.393554 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:07.184435 0.557654 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:07.742499 0.429612 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:08.172524 0.324882 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:08.497759 0.401081 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:08.899205 0.401232 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:09.300806 0.310462 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:09.611635 0.396514 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:10.008596 0.420262 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:10.429194 0.506170 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:10.935765 0.380799 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:11.316950 0.303524 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:11.620907 0.792796 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:12.414111 0.416279 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:12.830782 0.387134 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:13.218308 0.268696 udp 10.0.2.105 7010 <-> 79.219.100.15 2430 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:13.487357 0.419045 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:13.906798 0.316548 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:14.223769 0.407994 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:38:14.632133 0.457358 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 14:41:38.251401 3.000616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 14:41:45.258182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:41:53.259798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:09.262257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:42:41.268292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:48:45.274485 3.001757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:48:52.282296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:00.283330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:16.286440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:49:48.292816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:55:52.298563 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 14:55:59.306635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:07.308109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:23.311344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:56:55.316454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 14:59:50.078191 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 14:59:50.078296 1.711297 tcp 10.0.2.105 49992 -> 128.255.183.224 9027 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:02:59.323313 3.000845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:03:06.330266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:14.331781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:03:30.334860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:04:02.340307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:08:17.327834 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:08:17.328086 0.347752 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:17.676228 0.281633 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:17.958279 0.284315 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:18.243016 0.442706 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:18.686132 0.317335 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:19.003822 0.469200 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:19.473436 0.507979 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:19.981828 0.433189 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:20.415383 0.309686 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:20.725432 0.398020 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:21.123858 0.391167 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:21.515419 0.564256 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:22.080049 0.399330 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:22.479787 0.436166 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:22.916387 0.331694 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:23.248647 0.393034 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:23.642106 0.284220 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:23.926754 0.385521 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:24.312683 0.411408 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:24.724652 0.462131 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:25.187151 0.382205 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:25.569777 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 15:08:41.584385 0.555454 tcp 10.0.2.105 49993 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:08:42.140070 0.545438 tcp 10.0.2.105 49994 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:08:42.685802 1.138519 tcp 10.0.2.105 49995 -> 195.113.214.226 443 SRPA* 0 0 23 12934 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:08:43.825111 0.606344 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:44.431830 0.409490 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:44.841751 0.405208 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:45.247364 0.273694 udp 10.0.2.105 7010 <-> 79.219.100.15 2430 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:45.521426 0.419502 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:45.941324 0.466751 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:46.408553 0.316977 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:08:46.725959 0.000000 udp 10.0.2.105 7010 -> 99.109.125.182 2350 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 15:09:05.277739 0.554988 tcp 10.0.2.105 49996 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:09:05.832974 0.585867 tcp 10.0.2.105 49997 -> 195.113.214.226 80 SRPA* 0 0 19 14693 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:10:06.347013 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 15:10:13.354086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:21.355116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:10:37.358166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:11:09.364395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:13.371201 3.000748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:17:20.468114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:28.469311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:17:44.472315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:18:16.478648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:20.485138 3.000900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:24:27.491986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:35.493222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:24:51.496799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:25:23.502738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:29:51.828980 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:29:51.829087 1.671741 tcp 10.0.2.105 49998 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:31:27.508164 3.001847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:31:34.517104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:42.517279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:31:58.520128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:32:30.526469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:34.533333 3.000662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:38:41.539572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:38:49.541584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:39:05.544095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:39:09.210136 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:39:09.210277 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 15:39:25.775807 0.539134 tcp 10.0.2.105 49999 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:39:26.315238 0.565282 tcp 10.0.2.105 50000 -> 195.113.214.226 80 SRPA* 0 0 19 14664 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:39:26.881140 0.415068 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:27.296617 0.317453 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:27.614438 0.525804 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:28.140659 0.444585 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:28.585631 0.287931 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:28.873959 0.316974 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:29.191346 0.505850 udp 10.0.2.105 7010 <-> 75.58.227.32 6959 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:29.697711 0.504701 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:30.202819 0.325646 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:30.528871 0.431768 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:30.961060 0.394101 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:31.355536 0.552310 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:31.908267 0.392967 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:32.301576 0.402476 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:32.704546 0.439039 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:33.143971 0.285677 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:33.430055 0.321940 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:33.752445 0.394354 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:34.147144 0.391319 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:34.538858 0.419928 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:34.959154 0.454299 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:35.413805 0.401395 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:35.815605 0.591744 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:36.407710 0.447682 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:36.855726 0.382711 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:37.238814 0.275672 udp 10.0.2.105 7010 <-> 79.219.100.15 2430 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:37.514844 0.418801 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:37.550098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:39:37.934028 0.460282 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:39:38.394706 0.307336 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/03 15:45:41.555872 3.001893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:45:48.563598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:45:56.565346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:12.568377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:46:44.574347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:52:48.579824 3.002257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 15:52:55.587895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:03.589151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:19.592311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:53:51.598072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 15:59:53.509623 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 15:59:53.509883 1.718661 tcp 10.0.2.105 50001 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/03 15:59:55.604602 3.001627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:00:02.612063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:10.613527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:26.616027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:00:58.622168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:02.628647 3.001386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:07:09.635544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:17.637390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:07:33.640056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:08:05.646025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:09:55.084521 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:09:55.084722 0.622607 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:09:55.707738 0.421961 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:09:56.130069 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 16:10:12.751821 0.552695 tcp 10.0.2.105 50002 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:13.304792 0.544601 tcp 10.0.2.105 50003 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:13.849631 1.141920 tcp 10.0.2.105 50004 -> 195.113.214.226 443 SRPA* 0 0 24 13862 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:14.992503 0.376743 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:15.369655 0.446393 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:15.816419 0.300968 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:16.117790 0.000000 udp 10.0.2.105 7010 -> 75.58.227.32 6959 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 16:10:34.671509 0.556375 tcp 10.0.2.105 50005 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:35.228175 0.588790 tcp 10.0.2.105 50006 -> 195.113.214.226 80 SRPA* 0 0 19 14685 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:35.817584 0.512693 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:36.330646 0.313397 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:36.644455 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 16:10:54.129628 0.546251 tcp 10.0.2.105 50007 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:54.676163 0.582775 tcp 10.0.2.105 50008 -> 195.113.214.226 80 SRPA* 0 0 19 13449 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:10:55.259419 0.384334 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:55.644174 0.636683 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:56.281267 0.393479 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:56.675166 0.412065 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:57.087640 0.437879 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:57.525878 0.382658 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:57.908915 0.299473 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:58.208725 0.330110 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:58.539209 0.398486 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:58.938081 0.421700 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:59.360134 0.461071 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:10:59.821617 0.405103 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:00.227161 0.591026 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:00.818562 0.411015 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:01.229925 0.418681 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:01.649104 0.400037 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:02.049557 0.277519 udp 10.0.2.105 7010 <-> 79.219.100.15 2430 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:02.327461 0.469166 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:11:02.797053 0.316697 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:14:09.652092 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 16:14:16.660023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:24.661550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:14:40.664073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:15:12.669944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:16.675877 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:21:23.683559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:31.685482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:21:47.688134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:22:19.694019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:23.700078 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:28:30.707388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:38.709179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:28:54.712582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:26.717971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:29:55.229922 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:29:55.230013 1.695157 tcp 10.0.2.105 50009 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:35:30.723960 3.002094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:35:37.731551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:35:45.733432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:36:01.736004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:36:33.741910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:41:15.267108 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:41:15.267310 0.313475 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:15.581193 0.000000 udp 10.0.2.105 7010 -> 75.58.227.32 6959 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 16:41:33.796718 0.530575 tcp 10.0.2.105 50010 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:41:34.327543 0.540783 tcp 10.0.2.105 50011 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:41:34.868625 1.141565 tcp 10.0.2.105 50012 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:41:36.010882 0.428057 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:36.439337 0.563153 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:37.002876 0.407355 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:37.410619 0.313379 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:37.724424 0.292352 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:38.017152 0.443263 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:38.460802 0.670345 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:39.131497 0.311068 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:39.442919 0.388834 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:39.832131 0.404660 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:40.237230 0.629870 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:40.867437 0.395270 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:41.263107 0.427890 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:41.691332 0.394186 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:42.085947 0.397572 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:42.483921 0.287551 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:42.771871 0.320081 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:43.092377 0.414375 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:43.507154 0.462211 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:43.969745 0.387608 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:44.357680 0.583867 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:44.942004 0.387556 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:45.330040 0.412320 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:45.742756 0.416709 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:46.159819 0.328053 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:41:46.488309 0.000000 udp 10.0.2.105 7010 -> 79.219.100.15 2430 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 16:42:05.060111 0.540218 tcp 10.0.2.105 50013 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:42:05.600601 0.537927 tcp 10.0.2.105 50014 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:42:06.138855 1.147351 tcp 10.0.2.105 50015 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/03 16:42:07.286921 0.488827 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 16:42:37.748631 3.001360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 16:42:44.755547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:42:52.756871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:08.759772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:43:40.766154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:44.772705 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:49:51.779514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:49:59.780849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:15.783921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:50:47.790460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:56:51.795503 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 16:56:58.803308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:06.805206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:22.807898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:57:54.813875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 16:59:57.060397 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 16:59:57.060641 1.696862 tcp 10.0.2.105 50016 -> 128.255.183.224 9027 FSPA* 0 0 12 1459 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:03:59.099841 3.002243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:04:06.107727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:14.109714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:04:30.112739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:05:02.118769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:06.124487 3.001789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:11:13.132379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:21.133542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:11:37.136028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:12:09.142074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:12:23.012785 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:12:23.012886 0.000000 udp 10.0.2.105 7010 -> 79.219.100.15 2430 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 17:12:41.651667 0.556330 tcp 10.0.2.105 50017 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:12:42.208497 0.556606 tcp 10.0.2.105 50018 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:12:42.765398 1.351095 tcp 10.0.2.105 50019 -> 195.113.214.226 443 SRPA* 0 0 36 27221 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:12:44.117222 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 17:13:02.740572 0.546425 tcp 10.0.2.105 50020 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:03.287306 2.437446 tcp 10.0.2.105 50021 -> 195.113.214.226 80 FSPA* 0 0 11 1983 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:03.827915 1.179904 tcp 10.0.2.105 50022 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:05.008159 0.274941 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:05.283507 0.441138 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:05.725087 0.278320 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:06.003823 0.312660 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:06.316898 0.419037 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:06.736438 0.441902 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:07.178810 0.497542 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:07.676724 0.302153 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:07.979271 0.000000 udp 10.0.2.105 7010 -> 76.68.90.33 3572 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 17:13:24.612005 0.549147 tcp 10.0.2.105 50023 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:25.161010 0.544615 tcp 10.0.2.105 50024 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:25.705889 1.159611 tcp 10.0.2.105 50025 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:13:26.866240 0.402443 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:27.269051 0.560929 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:27.830394 0.383347 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:28.214121 0.430988 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:28.645454 0.399398 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:29.045212 0.323207 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:29.368830 0.382850 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:29.752039 0.287986 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:30.040571 0.466865 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:30.507880 0.405096 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:30.913368 0.583215 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:31.496975 0.392233 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:31.889629 0.407329 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:32.297360 0.404624 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:32.702367 0.420615 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:33.123424 0.329164 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:13:33.452978 0.472136 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:18:13.148925 3.000926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 17:18:20.155572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:28.157217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:18:44.160044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:19:16.166209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:20.172077 3.002145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:25:27.179595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:35.181247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:25:51.184383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:26:23.190272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:29:58.760635 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:29:58.760837 1.745347 tcp 10.0.2.105 50026 -> 128.255.183.224 9027 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:32:27.196806 3.001161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:32:34.203945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:42.205527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:32:58.208006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:33:30.214183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:34.220609 3.001162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:39:41.227435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:39:49.229535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:40:05.231891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:40:37.238155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:43:40.692521 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 17:43:40.692707 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 17:43:56.257091 0.579011 tcp 10.0.2.105 50027 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:43:56.836620 0.564838 tcp 10.0.2.105 50028 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:43:57.401780 1.356997 tcp 10.0.2.105 50029 -> 195.113.214.226 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/03 17:43:58.759397 0.398727 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:43:59.158462 0.265236 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:43:59.424058 0.285239 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:43:59.709692 0.427831 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:00.137913 0.336832 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:00.475150 0.437676 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:00.913209 0.406698 udp 10.0.2.105 7010 <-> 99.109.125.182 2350 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:01.320345 0.305083 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:01.625823 0.488586 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:02.114806 0.401343 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:02.516582 0.556014 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:03.072998 0.388051 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:03.461440 0.428401 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:03.890200 0.393910 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:04.284476 0.284218 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:04.569133 0.321521 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:04.891003 0.391138 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:05.282526 0.453669 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:05.736581 0.409615 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:06.146543 0.591883 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:06.738843 0.397785 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:07.137019 0.403175 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:07.540757 0.383932 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:07.925097 0.412432 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:08.337942 0.321352 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:44:08.659681 0.460074 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/03 17:46:41.244829 3.001361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:46:48.251774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:46:56.252960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:12.256549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:47:44.262580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:53:48.268387 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 17:53:55.275780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:03.277454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:19.280074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 17:54:51.286185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:00:00.511373 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:00:00.511474 1.745687 tcp 10.0.2.105 50030 -> 128.255.183.224 9027 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:00:55.293099 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:01:02.299515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:10.301432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:26.303869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:01:58.309964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:02.323774 3.004376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:08:09.333301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:17.335158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:08:33.337795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:09:05.344675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:14:29.180524 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:14:29.180642 0.388011 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:29.569396 0.420596 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:29.990408 0.283197 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:30.274003 0.279217 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:30.553627 0.333011 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:30.887014 0.677637 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:31.565013 0.000000 udp 10.0.2.105 7010 -> 99.109.125.182 2350 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 18:14:50.151835 0.548387 tcp 10.0.2.105 50031 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:14:50.700515 0.592167 tcp 10.0.2.105 50032 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:14:51.291180 0.300513 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:51.592629 0.503481 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:52.096618 0.433215 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:52.530265 0.547575 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:53.078287 0.392655 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:53.471367 0.440118 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:53.911822 0.398753 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:54.311005 0.381097 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:54.692577 0.285628 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:54.978620 0.322280 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:55.301233 0.491483 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:55.793073 0.441653 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:56.235094 0.590124 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:56.825632 0.389943 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:57.216002 0.410632 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:57.627033 0.387676 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:58.015152 0.468778 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:58.484342 0.448613 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:14:58.933301 0.334463 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:15:09.350414 3.001570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:15:16.357221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:24.358756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:15:40.362338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:16:12.368302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:16.373857 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:22:23.381940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:31.383040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:22:47.386205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:23:19.391935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:23.397642 3.002167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:29:30.405228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:38.406885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:29:54.410241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:30:02.261774 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:30:02.261890 1.725928 tcp 10.0.2.105 50033 -> 128.255.183.224 9027 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:30:26.416088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:30.422462 3.001372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:36:37.429496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:36:45.431020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:01.434208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:37:33.440177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:43:37.446904 3.000836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:43:44.453080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:43:52.454564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:08.458250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:40.463897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:44:59.952291 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 18:44:59.952395 0.000000 udp 10.0.2.105 7010 -> 99.109.125.182 2350 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 18:45:18.160065 0.549458 tcp 10.0.2.105 50034 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:45:18.709858 0.576136 tcp 10.0.2.105 50035 -> 195.113.214.226 80 SRPA* 0 0 20 14751 flow=From-Botnet-V2-TCP-Established 1970/01/03 18:45:19.286499 0.433997 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:19.720865 0.405740 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:20.126989 0.355427 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:20.482847 0.322037 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:20.805290 0.287659 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:21.093312 0.442777 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:21.536468 0.507504 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:22.044413 0.673972 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:22.718774 0.451658 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:23.170844 0.781562 udp 10.0.2.105 7010 <-> 200.93.56.18 6467 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:23.952754 0.388272 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:24.341421 0.425011 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:24.766786 0.388513 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:25.155619 0.338959 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:25.494987 0.389254 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:25.884585 0.291557 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:26.176635 0.466465 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:26.643504 0.459100 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:27.103084 0.585533 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:27.688958 0.391810 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:28.081199 0.433768 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:28.515368 0.397269 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:28.913004 0.327787 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:29.241148 0.457290 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:45:29.698854 0.467327 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/03 18:50:44.470234 3.001433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 18:50:51.478114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:50:59.479375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:15.482609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:51:47.487874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:57:51.494629 3.001178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 18:57:58.501371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:06.502926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:22.505810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 18:58:54.512204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:00:03.992844 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:00:03.992954 1.708042 tcp 10.0.2.105 50036 -> 128.255.183.224 9027 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:04:58.518674 3.000889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:05:05.525299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:13.526650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:05:29.530038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:06:01.535537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:05.542735 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:12:12.549457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:20.550948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:12:36.554065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:13:08.559661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:15:59.946563 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:15:59.946664 0.424178 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:00.371264 0.393841 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:00.765475 0.294896 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:01.060767 0.709789 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:01.770926 0.335697 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:02.107144 0.568750 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:02.676295 0.307094 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:02.983776 0.501359 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:03.485520 0.407451 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:03.893374 0.000000 udp 10.0.2.105 7010 -> 200.93.56.18 6467 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:16:21.179702 0.546959 tcp 10.0.2.105 50037 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:16:21.727031 0.535455 tcp 10.0.2.105 50038 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:16:22.262792 1.141232 tcp 10.0.2.105 50039 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:16:23.404713 0.390884 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:23.795952 0.443192 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:24.239530 0.395092 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:24.635010 0.280345 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:24.915776 0.314558 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:25.230750 0.385171 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:25.616255 0.455820 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:26.072500 0.394430 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:26.467406 0.580683 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:27.048487 0.392330 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:27.441202 0.325539 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:27.767541 0.414504 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:28.182401 0.399799 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:28.582600 0.473324 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:16:29.056698 0.422771 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:19:12.566597 3.000789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:19:19.573146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:27.574899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:19:43.577857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:20:15.584111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:19.590763 3.000881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:26:26.597526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:34.599040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:26:50.601723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:27:22.608036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:30:05.703053 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:30:05.703153 1.665634 tcp 10.0.2.105 50040 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:33:26.613307 3.001952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:33:33.620971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:41.622712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:33:57.625913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:34:29.631870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:33.637146 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 19:40:40.645389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:40:48.646550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:04.649875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:41:36.655354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:46:46.331191 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:46:46.331416 0.000000 udp 10.0.2.105 7010 -> 200.93.56.18 6467 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:47:01.946543 0.539458 tcp 10.0.2.105 50041 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:02.486324 0.543493 tcp 10.0.2.105 50042 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:03.030108 1.143458 tcp 10.0.2.105 50043 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:04.174160 0.395613 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:04.570157 0.433607 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:05.004128 0.292016 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:05.296686 0.273154 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:05.570266 0.336778 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:05.907488 0.304742 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:06.212575 0.452485 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:06.665471 0.823554 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:07.489410 0.502341 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:07.992276 0.406934 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:08.399623 0.431295 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:08.831322 0.389402 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:09.221123 0.000000 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:47:25.378274 0.530500 tcp 10.0.2.105 50044 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:25.909066 0.539531 tcp 10.0.2.105 50045 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:26.448983 1.162990 tcp 10.0.2.105 50046 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/03 19:47:27.612557 0.330247 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:27.943180 0.390064 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:28.333696 0.463306 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:28.797417 0.414270 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:29.212100 0.574352 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:29.786814 0.378226 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:30.165444 0.327453 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:30.493228 0.409778 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:30.903437 0.393366 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:31.297231 0.473253 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:31.770868 0.412197 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:32.195711 0.000000 udp 10.0.2.105 7010 -> 91.207.7.129 3326 REQ 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:47:40.662189 3.000984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:47:40.688933 0.426947 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:41.116676 0.292359 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:41.409624 0.407429 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:41.817571 0.334817 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:42.152915 0.297424 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:42.451058 0.261981 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:42.713607 0.464035 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:43.178142 1.192399 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:44.371146 1.124437 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:45.496144 0.389894 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:45.886649 0.427699 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:46.314938 0.384792 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:46.700351 0.324497 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:47.025429 0.399690 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:47.425599 0.475612 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:47.668922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:47:47.901785 0.410996 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:48.313435 0.380593 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:48.694598 0.585416 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:49.280651 0.420011 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:49.701151 0.391914 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:50.093651 0.310458 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:50.404883 0.402284 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:50.803292 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:47:50.807751 0.477625 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:51.286199 0.000000 udp 10.0.2.105 7010 -> 87.202.209.50 1297 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:47:55.670947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:47:58.084174 0.319477 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:47:58.418946 0.000000 udp 10.0.2.105 7010 -> 118.140.6.66 5917 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:06.626210 0.000000 udp 10.0.2.105 7010 -> 49.204.25.105 1893 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:11.673892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:15.078436 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:19.805349 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:48:24.011469 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:29.228853 0.000000 udp 10.0.2.105 7010 -> 190.39.168.210 4693 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:34.336166 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:41.977530 0.000000 udp 10.0.2.105 7010 -> 221.224.126.154 6567 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:43.679841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:48:46.803734 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:48:48.767341 0.000000 udp 10.0.2.105 7010 -> 173.229.2.82 1448 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:48:57.159439 0.000000 udp 10.0.2.105 7010 -> 180.253.119.216 1837 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:03.378586 0.000000 udp 10.0.2.105 7010 -> 190.48.46.254 2146 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:10.187664 0.301567 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:10.489231 0.000000 icmp 94.39.219.132 0x0303 -> 10.0.2.105 0xb523 URP 192 1 204 flow=Background 1970/01/03 19:49:14.804053 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:49:15.375496 0.000000 udp 10.0.2.105 7010 -> 122.168.41.201 4327 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:21.514303 0.400745 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:49:21.926488 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:29.084895 0.337198 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:49:29.506194 0.000000 udp 10.0.2.105 7010 -> 108.178.97.169 9252 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:35.224001 0.000000 udp 10.0.2.105 7010 -> 184.90.232.87 3223 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:39.810565 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:49:42.193861 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:50.085422 0.000000 udp 10.0.2.105 7010 -> 174.125.120.163 4337 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:49:57.836104 0.000000 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:05.437677 0.000000 udp 10.0.2.105 7010 -> 111.93.173.190 2106 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:10.304254 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:50:13.979525 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:21.130299 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:27.178377 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:32.656860 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:37.302929 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:50:38.484928 0.000000 udp 10.0.2.105 7010 -> 80.30.211.187 3758 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:45.715414 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:53.576386 0.000000 udp 10.0.2.105 7010 -> 72.54.121.49 5345 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:50:59.154427 0.000000 udp 10.0.2.105 7010 -> 61.145.214.90 9184 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:03.810977 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:51:05.363512 0.000000 udp 10.0.2.105 7010 -> 117.223.130.243 9127 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:11.001834 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:17.240699 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:22.287894 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:28.466852 0.554072 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:51:29.038470 0.000000 udp 10.0.2.105 7010 -> 206.255.94.83 9759 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:33.303832 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:51:37.439338 0.310223 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:51:37.805529 3.644384 udp 10.0.2.105 7010 <-> 79.253.247.201 2373 CON 0 0 2 684 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:51:41.458871 0.000000 udp 10.0.2.105 7010 -> 59.92.240.128 3701 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:48.235075 0.000000 udp 10.0.2.105 7010 -> 190.232.239.16 6130 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:54.343744 0.000000 udp 10.0.2.105 7010 -> 202.85.200.91 1078 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:51:59.310753 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:51:59.691676 0.000000 udp 10.0.2.105 7010 -> 210.186.157.2 9572 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:06.161283 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:14.483028 0.592926 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:52:15.089375 0.637291 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:52:15.740747 0.000000 udp 10.0.2.105 7010 -> 124.38.192.98 2624 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:23.716450 0.000000 udp 10.0.2.105 7010 -> 37.24.30.14 3369 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:28.302491 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:52:28.743397 0.000000 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:35.112492 0.000000 udp 10.0.2.105 7010 -> 93.131.116.22 5572 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:41.201435 0.000000 udp 10.0.2.105 7010 -> 218.103.35.77 1048 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:46.258261 0.000000 udp 10.0.2.105 7010 -> 188.6.138.115 9845 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:55.171311 0.000000 udp 10.0.2.105 7010 -> 203.198.37.50 1784 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:52:59.807813 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:53:01.680797 0.000000 udp 10.0.2.105 7010 -> 182.73.50.154 8974 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:09.902860 0.303332 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:53:10.216055 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:17.933990 0.483862 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:53:18.449572 0.000000 udp 10.0.2.105 7010 -> 80.216.225.141 8508 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:25.144710 0.481057 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:53:25.641783 0.000000 udp 10.0.2.105 7010 -> 126.6.60.224 1324 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:29.811122 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:53:32.094373 0.000000 udp 10.0.2.105 7010 -> 222.159.136.132 7269 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:38.854548 0.000000 udp 10.0.2.105 7010 -> 96.2.106.3 5859 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:46.525105 0.000000 udp 10.0.2.105 7010 -> 24.242.143.34 9069 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:51.842847 0.000000 udp 10.0.2.105 7010 -> 177.134.140.73 6854 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:53:56.809692 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:53:56.960163 0.000000 udp 10.0.2.105 7010 -> 123.125.40.249 2775 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:04.120979 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:09.558209 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:17.550125 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:22.306226 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:54:24.269968 0.457444 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:54:24.737608 0.390526 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 710 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:54:25.141268 0.480199 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:54:25.630939 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:31.860680 0.000000 udp 10.0.2.105 7010 -> 79.48.246.153 8117 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:40.632719 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:47.685996 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 19:54:48.414596 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:54:53.311252 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:54:54.692905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:54:56.966506 0.656342 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:54:57.631754 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:02.694991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:03.746289 0.000000 udp 10.0.2.105 7010 -> 205.162.167.142 4508 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:09.475492 0.000000 udp 10.0.2.105 7010 -> 175.139.212.67 9681 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:16.183917 0.798147 udp 10.0.2.105 7010 -> 202.52.238.98 8498 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:16.982064 0.000000 icmp 202.52.238.98 0x0303 -> 10.0.2.105 0x3221 URP 192 1 324 flow=Background 1970/01/03 19:55:18.697968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:20.810431 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:55:22.032307 0.000000 udp 10.0.2.105 7010 -> 87.234.200.227 7696 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:30.104276 0.000000 udp 10.0.2.105 7010 -> 118.91.233.186 8887 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:38.366192 0.000000 udp 10.0.2.105 7010 -> 124.117.210.182 2294 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:44.705083 0.000000 udp 10.0.2.105 7010 -> 190.164.108.142 9145 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:49.301810 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:55:50.433085 0.538451 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:55:50.703441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 19:55:50.982826 0.000000 udp 10.0.2.105 7010 -> 150.101.247.125 7518 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:55:59.125573 0.000000 udp 10.0.2.105 7010 -> 173.9.151.190 3469 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:06.015703 0.000000 udp 10.0.2.105 7010 -> 50.192.20.106 3278 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:12.354538 0.000000 udp 10.0.2.105 7010 -> 173.219.82.24 7711 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:17.301893 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:56:19.375068 0.000000 udp 10.0.2.105 7010 -> 122.81.56.147 1562 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:25.433648 0.606828 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:56:26.066193 0.389706 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:56:26.474148 0.527307 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:56:27.024936 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:34.716823 0.000000 udp 10.0.2.105 7010 -> 202.29.223.134 1221 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:41.146033 0.000000 udp 10.0.2.105 7010 -> 121.6.158.151 8348 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:45.802579 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:56:46.634203 0.268954 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:56:46.913030 0.000000 udp 10.0.2.105 7010 -> 50.50.222.57 1567 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:56:55.567150 0.267503 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:56:55.843682 0.000000 udp 10.0.2.105 7010 -> 72.186.179.163 1079 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:03.638378 0.000000 udp 10.0.2.105 7010 -> 69.15.41.105 7910 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:12.601833 0.416697 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:57:13.086809 0.000000 udp 10.0.2.105 7010 -> 118.142.224.2 3035 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:17.308344 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:57:20.422657 0.647639 udp 10.0.2.105 7010 <-> 220.255.131.213 4168 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/03 19:57:21.079155 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:28.024524 0.000000 udp 10.0.2.105 7010 -> 176.199.239.154 5230 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:34.983747 0.000000 udp 10.0.2.105 7010 -> 178.12.17.200 3322 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:40.361663 0.322091 udp 10.0.2.105 7010 -> 93.147.165.91 4382 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:40.683754 0.000000 icmp 93.147.165.91 0x0303 -> 10.0.2.105 0x1e11 URP 192 1 208 flow=Background 1970/01/03 19:57:45.307973 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:57:46.600535 0.000000 udp 10.0.2.105 7010 -> 113.30.88.193 9441 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:51.897846 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:57:57.636061 0.000000 udp 10.0.2.105 7010 -> 223.204.58.78 4581 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:04.956440 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:09.803798 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:58:12.547768 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:18.416249 0.000000 udp 10.0.2.105 7010 -> 180.191.3.42 1030 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:23.593793 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:28.921438 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:33.807869 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:58:37.403730 0.000000 udp 10.0.2.105 7010 -> 209.29.221.250 3492 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:43.562171 0.000000 udp 10.0.2.105 7010 -> 62.121.23.63 3041 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:51.474401 0.000000 udp 10.0.2.105 7010 -> 108.18.182.232 2561 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:58:58.624414 0.000000 udp 10.0.2.105 7010 -> 32.59.128.221 7127 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:59:03.310278 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 19:59:04.692891 0.000000 udp 10.0.2.105 7010 -> 95.113.210.79 1485 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:59:10.691187 0.000000 udp 10.0.2.105 7010 -> 82.11.177.228 9666 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:59:18.171751 0.000000 udp 10.0.2.105 7010 -> 96.44.41.133 1097 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:59:26.734060 0.000000 udp 10.0.2.105 7010 -> 180.1.11.103 5651 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 19:59:31.310927 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:00:07.373433 1.730079 tcp 10.0.2.105 50047 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:01:54.710024 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:02:01.717369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:09.718689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:25.721890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:02:57.727438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:01.734311 3.000681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:09:08.741041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:16.742195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:09:32.745395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:10:04.751567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:08.757884 3.001570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:16:15.765012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:23.766312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:16:39.769668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:17:11.775684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:15.782173 3.020772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:23:22.809217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:30.810623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:23:46.813617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:24:18.819164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:29:41.003353 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 20:29:41.003455 0.416171 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:41.420067 0.288133 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:41.708648 0.914459 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:42.623509 0.328567 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:42.952622 0.469957 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:43.422977 0.304806 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:43.728189 0.278676 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:44.007431 0.551188 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:44.559004 0.385414 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:44.944756 0.432048 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:45.377249 0.411337 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:45.789001 0.392140 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:46.181488 0.333691 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:46.515551 0.393670 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:46.909612 0.460184 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:47.370222 0.413146 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:47.783788 0.376778 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:48.160942 0.579238 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:48.740601 0.400394 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:49.141367 0.401450 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:49.543234 0.457994 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:50.001610 0.340006 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:50.342015 0.412798 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:29:50.755238 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 20:30:08.394232 0.548712 tcp 10.0.2.105 50048 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:08.943176 0.541909 tcp 10.0.2.105 50049 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:09.103619 1.766090 tcp 10.0.2.105 50050 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:09.485378 1.153944 tcp 10.0.2.105 50051 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:10.639975 0.395719 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:11.036137 0.327210 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:11.363744 0.505625 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:11.869778 0.313339 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:12.183493 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 20:30:22.826038 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 20:30:28.121928 0.539745 tcp 10.0.2.105 50052 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:28.661933 0.537415 tcp 10.0.2.105 50053 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:29.199589 1.153712 tcp 10.0.2.105 50054 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:29.832821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:30.354067 0.578641 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:30.933125 0.642729 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:31.576377 0.000000 udp 10.0.2.105 7010 -> 93.177.172.241 4362 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 20:30:37.834121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:48.471157 0.550271 tcp 10.0.2.105 50055 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:49.021723 0.542219 tcp 10.0.2.105 50056 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:49.564406 1.141353 tcp 10.0.2.105 50057 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:30:50.706424 0.499260 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:51.206049 0.470908 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:51.677368 0.431863 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:52.109637 0.387459 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:52.497496 0.427678 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:52.925576 0.640479 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:53.566461 0.543663 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:53.837867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:30:54.110519 0.688253 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:54.799109 0.514737 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:55.314234 0.813392 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:56.128072 0.276119 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:56.404769 0.288669 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:56.693792 0.420714 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/03 20:30:57.114902 0.000000 udp 10.0.2.105 7010 -> 220.255.131.213 4168 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 20:31:13.817665 0.536432 tcp 10.0.2.105 50058 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:31:14.354430 0.561230 tcp 10.0.2.105 50059 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:31:14.915974 1.152782 tcp 10.0.2.105 50060 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 20:31:25.843275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:29.850227 3.000687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:37:36.857222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:37:44.858191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:38:00.861733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:38:32.867755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:36.873772 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:44:43.881076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:44:51.882206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:07.885429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:45:39.891162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:51:43.897249 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:51:50.904504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:51:58.905981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:14.909605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:52:46.915370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:58:50.922212 3.000818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 20:58:57.928704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:05.930289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:21.933330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 20:59:53.939019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:00:10.874150 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:00:10.874383 1.687840 tcp 10.0.2.105 50061 -> 128.255.183.224 9027 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:01:32.161360 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:01:32.161621 0.354010 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:01:32.516036 0.000000 udp 10.0.2.105 7010 -> 79.253.247.201 2373 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 21:01:49.267970 0.539196 tcp 10.0.2.105 50062 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:01:49.807437 0.538893 tcp 10.0.2.105 50063 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:01:50.346675 1.163477 tcp 10.0.2.105 50064 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:01:51.511404 0.000000 udp 10.0.2.105 7010 -> 93.177.172.241 4362 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 21:02:07.693107 0.547842 tcp 10.0.2.105 50065 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:08.241265 0.549278 tcp 10.0.2.105 50066 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:08.790892 1.164409 tcp 10.0.2.105 50067 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:09.956063 0.000000 udp 10.0.2.105 7010 -> 220.255.131.213 4168 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 21:02:27.982221 0.536802 tcp 10.0.2.105 50068 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:28.519297 0.560604 tcp 10.0.2.105 50069 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:29.080402 1.151015 tcp 10.0.2.105 50070 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:02:30.232009 0.280188 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:30.512608 0.940049 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:31.453100 0.362710 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:31.816217 0.403591 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:32.220254 0.602044 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:32.822741 0.317804 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:33.140958 0.453332 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:33.594679 0.863928 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:34.459004 0.392537 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:34.851961 0.441448 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:35.293794 0.398983 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:35.693176 0.385865 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:36.079424 0.328321 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:36.408123 0.391975 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:36.800503 0.376034 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:37.176927 0.462140 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:37.639481 0.408427 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:38.048260 0.582979 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:38.631586 0.418431 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:39.050370 0.484437 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:39.535259 0.385640 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:39.921296 0.319940 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:40.241651 0.420239 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:40.662285 0.404036 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:41.066725 0.322394 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:41.389464 0.497787 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:02:41.887636 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 21:03:00.578759 0.534293 tcp 10.0.2.105 50071 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:01.113383 0.544239 tcp 10.0.2.105 50072 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:01.657977 1.139025 tcp 10.0.2.105 50073 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:02.797699 0.568592 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:03.366692 0.641702 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:04.008764 0.490070 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:04.499219 0.555215 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:05.054781 0.488956 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:05.544070 0.421651 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:05.966086 0.388857 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:06.355402 0.539359 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:06.895162 0.000000 udp 10.0.2.105 7010 -> 116.14.92.70 4963 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 21:03:22.320616 0.544785 tcp 10.0.2.105 50074 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:22.865747 0.540901 tcp 10.0.2.105 50075 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:23.406919 1.152126 tcp 10.0.2.105 50076 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:03:24.559618 0.421083 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:24.981143 0.570871 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:25.552545 1.187117 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:26.740064 0.285494 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:27.026012 0.277583 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:03:27.303937 0.416374 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:05:57.945777 3.001082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:06:04.952952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:12.954161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:06:33.253598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:07:05.259746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:11.268609 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:13:18.275457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:26.276952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:13:42.280566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:14:14.286042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:18.292824 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:20:25.299799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:33.301072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:20:49.303934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:21:21.310158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:25.316270 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:27:32.323717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:40.325534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:27:56.328262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:28:28.333954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:30:14.657952 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:30:14.658056 1.715388 tcp 10.0.2.105 50077 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/03 21:33:42.506127 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:33:42.506219 0.312259 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:42.818881 0.637612 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:43.456854 0.348368 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:43.805646 0.293309 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:44.099358 0.385837 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:44.485640 0.451186 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:44.937214 0.349863 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:45.287465 0.650743 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:45.938576 0.317214 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:46.256197 0.444972 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:46.701603 0.504386 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:47.206387 0.434351 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:47.641141 0.394323 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:48.035795 0.386503 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:48.422732 0.394668 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:48.817766 0.324176 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:49.142342 0.383071 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:49.525887 0.390654 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:49.916909 0.497159 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:50.414455 0.404208 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:50.819030 0.414388 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:51.233841 0.579771 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:51.814028 0.467791 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:52.282230 0.395014 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:52.677643 0.318218 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:52.996223 0.401423 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:53.398119 0.428616 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:53.827136 0.318991 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:54.146517 0.507677 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:54.654579 0.645101 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:55.300070 0.586297 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:55.886811 0.418170 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:56.305433 0.486931 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:56.792785 0.480285 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:57.273423 0.426342 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:57.700367 0.401788 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:58.102521 0.552090 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:58.655004 0.426864 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:59.082277 0.583631 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:59.666303 0.284849 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:33:59.951499 2.003072 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:34:01.954981 0.278008 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:34:02.233446 0.449959 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/03 21:34:06.900775 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 21:34:32.340161 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 21:34:39.347736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:34:47.349283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:35:03.352077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:35:35.358135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:39.364022 3.001964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:41:46.371785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:41:54.373362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:42:10.375815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:42:42.381985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:48:46.389158 3.000357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:48:53.395368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:01.397221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:17.400170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:49:49.406479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:55:53.412394 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 21:56:00.419871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:08.420726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:24.424111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 21:56:56.430315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:00:16.377721 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:00:16.377883 1.689621 tcp 10.0.2.105 50078 -> 128.255.183.224 9027 FSPA* 0 0 15 1556 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:03:00.436458 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:03:07.443928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:15.445026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:03:31.447947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:04:03.453809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:04:30.733963 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:04:30.734065 0.307768 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:31.042232 0.288700 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:31.331286 0.649682 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:31.981354 0.316542 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:32.298316 0.394357 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:32.693083 0.426041 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:33.119524 0.345853 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:33.465785 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 22:04:50.473918 0.553121 tcp 10.0.2.105 50079 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:04:51.027331 0.551947 tcp 10.0.2.105 50080 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:04:51.579583 1.369783 tcp 10.0.2.105 50081 -> 195.113.214.226 443 SRPA* 0 0 37 27861 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:04:52.950078 0.339101 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:04:53.289565 0.000000 udp 10.0.2.105 7010 -> 122.176.57.240 8482 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 22:05:10.801808 0.535524 tcp 10.0.2.105 50082 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:05:11.337614 0.542403 tcp 10.0.2.105 50083 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:05:11.879862 1.164618 tcp 10.0.2.105 50084 -> 195.113.214.226 443 SRPA* 0 0 29 14134 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:05:13.045079 0.520027 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:13.565442 0.435834 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:14.001615 0.385540 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:14.387492 0.331121 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:14.718997 0.399839 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:15.119235 0.404536 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:15.524118 0.396008 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:15.920547 0.391595 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:16.312720 0.411171 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:16.724250 0.459458 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:17.184119 0.401911 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:17.586426 0.582427 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:18.169175 0.475132 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:18.644727 0.378280 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:19.023413 0.326889 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:19.350645 0.395028 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:19.746092 0.417283 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:20.163804 0.336933 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:20.501092 0.504554 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:21.006051 0.641085 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:21.647494 0.590902 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:22.238793 0.429827 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:22.669006 0.492257 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:23.161711 0.474013 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:23.636061 0.430951 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:24.067415 0.391073 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:24.458858 0.550129 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:25.009413 0.737238 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:25.747039 0.578704 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:26.326142 0.280611 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:26.607140 0.363772 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:26.971291 0.275046 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:05:27.246723 0.421116 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:10:07.460227 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:10:14.467207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:22.469123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:10:38.471667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:11:10.478297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:14.484211 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:17:21.491127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:29.492695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:17:45.496089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:18:17.502139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:21.508806 3.000931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:24:28.515729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:36.517052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:24:52.519959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:25:24.526134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:30:18.068435 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:30:18.068521 1.720764 tcp 10.0.2.105 50085 -> 128.255.183.224 9027 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:31:28.531519 3.002256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:31:35.539291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:43.540813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:31:59.544014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:32:31.550263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:35:55.563567 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 22:35:55.563667 0.570613 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:56.134695 0.445305 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:56.580350 0.301611 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:56.882361 0.284638 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:57.167351 0.319736 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:57.487442 0.637765 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:58.125621 0.635342 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:58.761393 1.190917 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:35:59.952670 0.352378 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:00.305443 0.330091 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:00.635942 0.495230 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:01.131611 0.439610 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:01.571619 0.392921 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:01.964926 0.395998 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:02.361322 0.324859 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:02.686575 0.388052 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:03.075034 0.550425 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:03.625907 0.392841 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:04.019086 0.404072 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:04.423537 0.468052 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:04.891997 0.868171 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:05.760489 0.580497 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:06.341396 0.318068 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:06.659848 0.470602 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:07.130862 0.389890 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:07.521147 0.414254 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:07.935810 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 22:36:25.268201 0.544577 tcp 10.0.2.105 50086 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:36:25.813069 0.547354 tcp 10.0.2.105 50087 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:36:26.360664 1.153790 tcp 10.0.2.105 50088 -> 195.113.214.226 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/03 22:36:27.515194 0.314365 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:27.830026 0.506321 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:28.336745 0.642112 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:28.979254 0.582183 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:29.561858 0.423936 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:29.986173 0.507259 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:30.493793 0.479972 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:30.974178 0.422911 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:31.397438 0.375282 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:31.773084 0.558527 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:32.331962 0.820830 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:33.153182 0.582173 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:33.735773 0.288861 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:34.025007 0.278638 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:34.303984 0.365695 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:36:34.670079 0.462120 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/03 22:38:35.556577 3.000869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 22:38:42.563555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:38:50.565279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:39:06.568704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:39:38.573555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:42.579649 3.252746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:45:49.837577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:45:57.838988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:13.842077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:46:45.848115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:52:49.853910 3.002042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 22:52:56.862056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:04.862860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:20.866010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:53:52.871969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 22:59:56.878570 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:00:03.885398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:11.887388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:19.909705 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:00:19.909944 1.690562 tcp 10.0.2.105 50089 -> 128.255.183.224 9027 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:00:27.889944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:00:59.896522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:06:42.398886 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:06:42.399048 0.427614 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:06:42.827091 0.649392 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:06:43.476882 0.282875 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:06:43.760188 0.446677 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:06:44.207288 0.306996 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:06:44.514719 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 23:07:02.941192 0.553097 tcp 10.0.2.105 50090 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:07:03.494596 0.569428 tcp 10.0.2.105 50091 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:07:03.902974 3.001106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:07:04.064269 1.152783 tcp 10.0.2.105 50092 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:07:05.217796 0.637418 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:05.855573 0.511513 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:06.367520 0.319301 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:06.687193 0.420470 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:07.108019 0.544204 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:07.652646 0.304083 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:07.957142 0.428184 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:08.385707 0.391442 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:08.777564 0.335515 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:09.113488 0.380250 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:09.494124 0.389687 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:09.884218 0.386579 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:10.271198 0.400224 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:10.671779 0.459035 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:10.909521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:11.131151 0.410752 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:11.542337 0.582386 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:12.125138 0.402904 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:12.545071 0.471563 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:13.017044 0.316284 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:13.333777 0.399202 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:13.733386 0.397083 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:14.130872 0.323653 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:14.454928 0.506380 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:14.961746 0.652112 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:15.614281 0.561422 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:16.176124 0.426367 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:16.602953 0.490377 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:17.093775 0.471441 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:17.565647 0.572497 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:18.138569 0.422369 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:18.561292 0.376435 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:18.911282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:07:18.938059 0.423247 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:19.361774 0.596293 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:19.958477 0.270443 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:20.229318 0.285908 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:20.515566 0.373948 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:20.889929 0.475287 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:07:34.914188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:08:06.919923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:10.927296 3.000374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:14:17.933656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:25.934695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:14:41.938226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:15:13.944149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:17.950117 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:21:24.957722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:32.959218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:21:48.961955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:22:20.968372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:24.974788 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:28:31.981318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:39.982638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:28:55.986061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:29:27.992013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:30:21.599604 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:30:21.599784 1.694760 tcp 10.0.2.105 50093 -> 128.255.183.224 9027 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:35:31.998411 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:35:39.005858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:35:47.006677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:36:03.010324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:36:35.015809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:37:23.906643 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/03 23:37:23.906809 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/03 23:37:42.496714 0.557843 tcp 10.0.2.105 50094 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:37:43.054832 0.539671 tcp 10.0.2.105 50095 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:37:43.594845 1.159562 tcp 10.0.2.105 50096 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/03 23:37:44.754996 0.419602 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:45.175020 0.632003 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:45.807447 0.279142 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:46.086952 0.437973 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:46.525347 0.308612 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:46.834389 0.688834 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:47.523648 0.390496 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:47.914579 0.402641 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:48.317586 0.456475 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:48.774449 0.509976 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:49.284866 0.305342 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:49.590621 0.430074 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:50.021111 0.527505 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:50.548981 0.323699 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:50.873078 0.398325 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:51.271748 0.384521 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:51.656723 0.392005 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:52.049085 0.401814 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:52.451293 0.453339 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:52.905003 0.421038 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:53.326409 0.691080 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:54.017963 0.324488 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:54.342816 0.417236 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:54.760610 0.478142 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:55.239212 0.382104 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:55.621745 0.420293 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:56.042468 0.322513 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:56.365421 0.502810 udp 10.0.2.105 7010 <-> 115.241.177.214 9511 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:56.868666 0.642777 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:57.511840 0.578383 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:58.090588 0.421813 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:58.512832 0.580238 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:59.093427 0.481279 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:37:59.575136 0.549045 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:00.124744 0.466399 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:00.591487 0.429388 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:01.021296 0.384997 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:01.406648 0.534470 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:01.941521 0.285300 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:02.227237 0.436489 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:02.664096 0.275497 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:38:02.940002 0.374480 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/03 23:42:39.021967 3.001509 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/03 23:42:46.029738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:42:54.031275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:43:10.034292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:43:42.040435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:49:46.046154 3.001111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:49:53.053013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:01.054537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:17.058209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:50:49.064132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:56:53.069880 3.001841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/03 23:57:00.077421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:08.078693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:24.081609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/03 23:57:56.088143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:00:23.300006 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:00:23.300185 1.733059 tcp 10.0.2.105 50097 -> 128.255.183.224 9027 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:04:00.093473 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:04:07.101128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:15.102831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:04:31.105994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:05:03.111795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:08:17.231245 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:08:17.231351 0.408921 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:17.640710 0.592424 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:18.233568 0.292229 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:18.526185 0.437014 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:18.963662 0.309141 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:19.273226 0.637579 udp 10.0.2.105 7010 <-> 116.14.92.70 4963 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:19.911140 0.404036 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:20.315602 0.334492 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:20.650522 0.432435 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:21.083315 0.497604 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:21.581324 0.318160 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:21.899852 0.429985 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:22.330162 0.388620 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:22.719185 0.391549 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:23.111174 0.317298 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:23.428867 0.376832 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:23.806039 0.392062 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:24.198522 0.411032 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:24.609980 0.413160 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:25.023504 0.465769 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:25.489666 0.577694 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:26.067782 0.324803 udp 10.0.2.105 7010 <-> 81.134.111.123 8111 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:26.392974 0.421444 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:26.814790 0.452822 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:27.268063 0.317079 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:27.585544 0.385202 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:27.971108 0.418543 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:28.390078 0.000000 udp 10.0.2.105 7010 -> 115.241.177.214 9511 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:08:45.163655 0.561832 tcp 10.0.2.105 50098 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:08:45.725844 0.539493 tcp 10.0.2.105 50099 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:08:46.265188 1.162655 tcp 10.0.2.105 50100 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:08:47.428732 0.645855 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:48.074984 0.587313 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:48.662679 0.422266 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:49.085326 0.508617 udp 10.0.2.105 7010 <-> 158.108.226.161 1919 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:49.594365 0.476870 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:50.071646 0.550739 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:50.622807 0.434020 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:51.057258 0.471971 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:51.529638 0.301665 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:51.831711 0.376001 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:52.208151 0.519393 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:52.727917 0.362351 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:53.090623 0.452414 udp 10.0.2.105 7010 <-> 72.8.219.116 3238 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:08:53.543433 0.272972 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:11:07.117555 3.002188 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 00:11:14.124927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:22.126842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:11:38.130112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:12:10.135944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:14.141957 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:18:21.148996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:29.151083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:18:45.153829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:19:17.159778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:21.165295 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:25:28.173469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:36.175078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:25:52.177517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:26:24.183916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:30:25.040649 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:30:25.040748 2.316871 tcp 10.0.2.105 50101 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:32:28.189367 3.001996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:32:35.197024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:43.198876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:32:59.202254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:33:31.207817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:10.436349 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 00:39:10.436463 0.212507 udp 10.0.2.105 7010 -> 115.241.177.214 9511 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:39:10.648970 0.000000 icmp 115.241.177.214 0x0303 -> 10.0.2.105 0x2725 URP 192 1 226 flow=Background 1970/01/04 00:39:25.710278 0.050479 tcp 10.0.2.105 50102 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:25.761082 0.047975 tcp 10.0.2.105 50103 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:25.809483 0.157720 tcp 10.0.2.105 50104 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:25.966950 0.171960 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.139383 0.305519 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.445299 0.195345 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.641007 0.065407 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.706777 0.038824 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.745973 0.143550 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:26.889890 0.000000 udp 10.0.2.105 7010 -> 116.14.92.70 4963 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:39:35.213120 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:39:42.221543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:39:45.646922 0.046163 tcp 10.0.2.105 50105 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:45.693396 0.047069 tcp 10.0.2.105 50106 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:45.740766 0.161454 tcp 10.0.2.105 50107 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:39:45.902938 0.086266 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:45.989575 0.181011 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.171003 0.183129 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.354537 0.060601 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.415536 0.247084 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.662993 0.141693 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.805046 0.144669 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:46.950132 0.182425 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:47.132964 0.081741 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:47.215135 0.135794 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:47.351314 0.157729 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:47.509413 0.164537 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:47.674384 0.335866 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:48.010613 0.211599 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:48.222597 0.172426 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:39:48.395425 0.000000 udp 10.0.2.105 7010 -> 81.134.111.123 8111 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:39:50.222477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:40:06.225341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:40:07.288623 0.046337 tcp 10.0.2.105 50108 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:07.334801 0.047074 tcp 10.0.2.105 50109 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:07.382234 0.163904 tcp 10.0.2.105 50110 -> 195.113.214.226 443 SRPA* 0 0 49 29500 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:07.545759 0.227459 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:07.773623 0.080718 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:07.854763 0.144486 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:07.999655 0.635805 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:08.635871 0.399211 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:09.035441 0.335911 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:09.371760 0.172944 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:09.545063 0.233907 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:09.779393 0.000000 udp 10.0.2.105 7010 -> 158.108.226.161 1919 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:40:28.638943 0.047743 tcp 10.0.2.105 50111 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:28.687055 0.047487 tcp 10.0.2.105 50112 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:28.734409 0.156079 tcp 10.0.2.105 50113 -> 195.113.214.226 443 SRPA* 0 0 47 27886 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:28.889022 0.179570 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:29.069049 0.298924 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:29.368539 0.035016 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:29.403920 0.137917 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:29.542247 0.178708 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:29.721382 0.285190 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:30.006961 0.284916 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 00:40:30.292537 0.000000 udp 10.0.2.105 7010 -> 72.8.219.116 3238 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:40:38.231954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:40:46.545491 0.047238 tcp 10.0.2.105 50114 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:46.592651 0.048899 tcp 10.0.2.105 50115 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:46.641377 0.162241 tcp 10.0.2.105 50116 -> 195.113.214.226 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:40:46.804554 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 00:41:04.671328 0.047782 tcp 10.0.2.105 50117 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:41:04.719283 0.048797 tcp 10.0.2.105 50118 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:41:04.768593 0.155040 tcp 10.0.2.105 50119 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/04 00:46:42.237508 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:46:49.244997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:46:57.246715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:47:13.249646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:47:45.255736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:53:49.282296 3.000959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 00:53:56.288770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:04.290616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:20.293862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 00:54:52.299469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:00:27.402417 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:00:27.402532 0.967049 tcp 10.0.2.105 50120 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:00:56.356005 3.001646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:01:03.362923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:11.364309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:27.367494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:01:59.373469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:03.380091 3.001234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:08:10.387043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:18.388540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:08:34.391971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:09:06.397566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:11:27.991405 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:11:27.991633 0.000000 udp 10.0.2.105 7010 -> 116.14.92.70 4963 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:11:46.991330 0.049578 tcp 10.0.2.105 50121 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:11:47.041290 0.096875 tcp 10.0.2.105 50122 -> 195.113.214.226 80 SRPA* 0 0 38 23077 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:11:47.138422 0.000000 udp 10.0.2.105 7010 -> 81.134.111.123 8111 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:12:02.211520 0.045614 tcp 10.0.2.105 50123 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:02.257392 0.046988 tcp 10.0.2.105 50124 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:02.304291 0.163006 tcp 10.0.2.105 50125 -> 195.113.214.226 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:02.467952 0.000000 udp 10.0.2.105 7010 -> 158.108.226.161 1919 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:12:18.464978 0.341991 tcp 10.0.2.105 50126 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:18.807300 0.048561 tcp 10.0.2.105 50127 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:18.856185 0.156749 tcp 10.0.2.105 50128 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:19.013494 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:12:37.172077 0.046692 tcp 10.0.2.105 50129 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:37.219011 0.046810 tcp 10.0.2.105 50130 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:37.266121 0.161670 tcp 10.0.2.105 50131 -> 195.113.214.226 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:37.427482 0.000000 udp 10.0.2.105 7010 -> 72.8.219.116 3238 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:12:54.897403 0.045948 tcp 10.0.2.105 50132 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:54.943664 0.102022 tcp 10.0.2.105 50133 -> 195.113.214.226 80 SRPA* 0 0 33 21974 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:12:55.046573 0.171653 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:55.218663 0.147949 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:55.367035 0.055230 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:55.422710 0.423861 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:55.846970 0.427581 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:56.274975 0.194839 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:56.470235 0.073818 udp 10.0.2.105 7010 <-> 31.197.209.67 1519 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:56.544497 0.178877 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:56.723767 0.185862 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:56.910017 0.145486 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.055870 0.136971 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.193204 0.149614 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.343241 0.079308 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.422958 0.060406 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.483742 0.144308 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.628605 0.290727 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:57.919739 0.210125 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:58.130252 0.162697 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:58.293342 0.353766 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:58.647524 0.172818 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:58.820781 0.173301 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:58.994503 0.216116 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:59.211093 0.075506 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:59.287022 0.144174 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:59.431563 0.165796 udp 10.0.2.105 7010 <-> 116.73.142.70 4168 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:12:59.597730 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:13:16.849392 0.046559 tcp 10.0.2.105 50134 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:13:16.896285 0.048369 tcp 10.0.2.105 50135 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:13:16.944949 0.161845 tcp 10.0.2.105 50136 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:13:17.107014 0.404407 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:17.511948 0.182252 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:17.694583 0.234020 udp 10.0.2.105 7010 <-> 161.200.34.89 5040 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:17.929019 0.293700 udp 10.0.2.105 7010 <-> 220.106.143.46 1067 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.223117 0.179870 udp 10.0.2.105 7010 <-> 98.93.75.218 6826 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.403416 0.282305 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.686134 0.121752 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.808449 0.026747 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.835578 0.137887 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:13:18.973871 0.182810 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:15:10.543472 3.002231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:15:17.551216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:25.552748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:15:41.556073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:16:13.561898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:17.568168 3.001172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:22:24.574889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:32.576637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:22:48.579914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:23:20.585595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:24.592015 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:29:31.599336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:39.600962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:29:55.603863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:30:27.609412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:30:28.511234 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:30:28.511440 0.978522 tcp 10.0.2.105 50137 -> 128.255.183.224 9027 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:36:31.615704 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:36:38.623119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:36:46.624536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:37:02.627903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:37:34.633876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:38.640207 3.001089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:43:42.352775 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 01:43:42.352965 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:43:45.647056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:43:53.648347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:44:01.261975 0.046803 tcp 10.0.2.105 50138 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:01.309132 0.048701 tcp 10.0.2.105 50139 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:01.358148 0.161828 tcp 10.0.2.105 50140 -> 195.113.214.226 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:01.520529 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:44:09.651770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:44:19.166448 0.051711 tcp 10.0.2.105 50141 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:19.218452 0.046709 tcp 10.0.2.105 50142 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:19.265497 0.159960 tcp 10.0.2.105 50143 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:19.425869 0.172534 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:19.598779 0.145223 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:19.744593 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:44:37.081729 0.045475 tcp 10.0.2.105 50144 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:37.127484 0.047438 tcp 10.0.2.105 50145 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:37.175221 0.159583 tcp 10.0.2.105 50146 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:37.335380 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:44:41.657557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:44:55.478973 0.046459 tcp 10.0.2.105 50147 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:55.525809 0.047027 tcp 10.0.2.105 50148 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:55.572670 0.159363 tcp 10.0.2.105 50149 -> 195.113.214.226 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:44:55.732954 0.353572 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.086947 0.198765 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.286109 0.138846 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.425367 0.183663 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.609478 0.173603 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.783485 0.146755 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:56.930576 0.080875 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:57.011859 0.065729 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:44:57.077966 0.000000 udp 10.0.2.105 7010 -> 70.90.49.1 4209 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:45:14.716964 0.048487 tcp 10.0.2.105 50150 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:14.765326 0.046727 tcp 10.0.2.105 50151 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:14.812516 0.158451 tcp 10.0.2.105 50152 -> 195.113.214.226 443 SRPA* 0 0 40 22372 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:14.971271 0.135725 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:15.107409 0.162463 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:15.270264 0.335689 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:15.606379 0.215464 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:15.822202 0.258097 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:16.080676 0.078649 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:16.159749 0.142208 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:16.302368 0.000000 udp 10.0.2.105 7010 -> 116.73.142.70 4168 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:45:33.824312 0.046580 tcp 10.0.2.105 50153 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:33.871265 0.047285 tcp 10.0.2.105 50154 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:33.919022 0.166700 tcp 10.0.2.105 50155 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:34.086304 0.549119 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:34.635773 0.173763 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:34.809932 0.224813 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:35.035154 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:45:51.449317 0.046297 tcp 10.0.2.105 50156 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:51.495896 0.046979 tcp 10.0.2.105 50157 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:51.543219 0.157867 tcp 10.0.2.105 50158 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:45:51.701662 0.173810 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:45:51.875871 0.000000 udp 10.0.2.105 7010 -> 161.200.34.89 5040 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:46:09.214979 0.046787 tcp 10.0.2.105 50159 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:09.262035 0.049833 tcp 10.0.2.105 50160 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:09.312141 0.156066 tcp 10.0.2.105 50161 -> 195.113.214.226 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:09.468514 0.346092 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:46:09.814954 0.218731 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:46:10.034048 0.026673 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:46:10.061147 0.151812 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:46:10.213301 0.182463 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/04 01:46:10.396196 0.000000 udp 10.0.2.105 7010 -> 220.106.143.46 1067 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:46:25.858569 0.053064 tcp 10.0.2.105 50162 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:25.912015 0.046295 tcp 10.0.2.105 50163 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:25.958692 0.150063 tcp 10.0.2.105 50164 -> 195.113.214.226 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:26.109515 0.000000 udp 10.0.2.105 7010 -> 98.93.75.218 6826 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 01:46:42.913189 0.047159 tcp 10.0.2.105 50165 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:42.960609 0.046713 tcp 10.0.2.105 50166 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:46:43.007636 0.156042 tcp 10.0.2.105 50167 -> 195.113.214.226 443 SRPA* 0 0 32 22202 flow=From-Botnet-V2-TCP-Established 1970/01/04 01:50:45.663510 3.002337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 01:50:52.670993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:00.672892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:16.675471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:51:48.681820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:57:52.688527 3.000783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 01:57:59.695393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:07.696696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:23.699978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 01:58:55.705683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:00:29.491070 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:00:29.491326 1.001821 tcp 10.0.2.105 50168 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:04:59.711762 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:05:06.719259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:14.720453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:05:30.723473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:06:02.729569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:06.735947 3.001347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:12:13.743198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:21.744281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:12:37.747172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:13:09.753181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:16:54.096675 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:16:54.096881 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:17:10.261958 0.048386 tcp 10.0.2.105 50169 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:10.310658 0.046519 tcp 10.0.2.105 50170 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:10.357465 0.167795 tcp 10.0.2.105 50171 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:10.526024 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 1519 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:17:26.132945 0.046237 tcp 10.0.2.105 50172 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:26.179521 0.050233 tcp 10.0.2.105 50173 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:26.229594 0.159654 tcp 10.0.2.105 50174 -> 195.113.214.226 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:26.389519 0.363601 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:17:26.753507 0.000000 udp 10.0.2.105 7010 -> 70.90.49.1 4209 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:17:45.271120 0.047945 tcp 10.0.2.105 50175 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:45.319382 0.097254 tcp 10.0.2.105 50176 -> 195.113.214.226 80 SRPA* 0 0 33 21301 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:17:45.417281 0.000000 udp 10.0.2.105 7010 -> 116.73.142.70 4168 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:18:01.264152 0.046612 tcp 10.0.2.105 50177 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:01.310610 0.047061 tcp 10.0.2.105 50178 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:01.357964 0.159085 tcp 10.0.2.105 50179 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:01.517631 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:18:19.109781 0.048075 tcp 10.0.2.105 50180 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:19.158160 0.088699 tcp 10.0.2.105 50181 -> 195.113.214.226 80 SRPA* 0 0 38 24283 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:19.247087 0.000000 udp 10.0.2.105 7010 -> 161.200.34.89 5040 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:18:35.993834 0.046195 tcp 10.0.2.105 50182 -> 195.113.214.251 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:36.039878 0.048631 tcp 10.0.2.105 50183 -> 195.113.214.226 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:36.088933 0.159457 tcp 10.0.2.105 50184 -> 195.113.214.226 443 SRPA* 0 0 41 22673 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:36.247179 0.000000 udp 10.0.2.105 7010 -> 220.106.143.46 1067 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:18:52.647507 0.046788 tcp 10.0.2.105 50185 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:52.694626 0.047712 tcp 10.0.2.105 50186 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:52.742632 0.159681 tcp 10.0.2.105 50187 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:18:52.902197 0.000000 udp 10.0.2.105 7010 -> 98.93.75.218 6826 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:19:11.354377 0.046405 tcp 10.0.2.105 50188 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:19:11.401071 0.045914 tcp 10.0.2.105 50189 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:19:11.447326 0.155488 tcp 10.0.2.105 50190 -> 195.113.214.226 443 SRPA* 0 0 39 31858 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:19:11.603548 0.148373 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:11.752498 0.170175 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:11.923058 0.042601 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:11.966061 0.193108 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.159571 0.185673 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.345640 0.062047 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.408106 0.079579 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.488096 0.143152 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.631579 0.145679 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.777671 0.177866 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:12.956015 0.136237 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:13.092673 0.163074 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:13.256097 0.477263 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:13.733754 0.143149 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:13.760156 3.001097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 02:19:13.877332 0.079296 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:13.956971 0.331381 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:14.288825 0.211185 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:14.500585 0.214787 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:14.715754 0.162608 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:14.878842 0.157393 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.036738 0.179254 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.216426 0.040522 udp 10.0.2.105 7010 <-> 81.173.131.33 5058 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.257344 0.278364 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.536109 0.125340 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.661866 0.151902 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:15.814161 0.178406 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:19:20.767307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:28.768539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:19:44.771499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:20:16.777846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:20.783435 3.001849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:26:27.790821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:35.792285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:26:51.795087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:27:23.801383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:30:30.500354 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:30:30.500457 0.952287 tcp 10.0.2.105 50191 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:33:27.806788 3.002606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:33:34.814832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:42.816241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:33:58.819899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:34:30.825576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:34.831402 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:40:41.838720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:40:49.840702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:41:05.843301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:41:37.849731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:41.856099 3.000911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 02:47:48.863706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:47:56.864645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:48:12.867466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:48:44.873239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:49:18.572028 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 02:49:18.572257 0.359598 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:18.932322 0.037825 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:18.970575 0.193333 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:19.164299 0.183381 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:19.348093 0.147498 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:19.495962 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:49:37.561551 0.046579 tcp 10.0.2.105 50192 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:49:37.608457 0.052166 tcp 10.0.2.105 50193 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:49:37.660896 0.163851 tcp 10.0.2.105 50194 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:49:37.825454 0.067476 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:37.893339 0.075209 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:37.968968 0.143851 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:38.113227 0.145682 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:38.259350 0.178895 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:38.438668 0.137765 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:38.576852 0.162939 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:38.740202 0.334985 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.075593 0.146266 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.222260 0.079029 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.301747 0.255029 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.557204 0.214221 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.771911 0.215109 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:39.987429 0.156502 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:40.144516 0.159147 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:40.304044 0.179507 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:40.484002 0.000000 udp 10.0.2.105 7010 -> 81.173.131.33 5058 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 02:49:57.749554 0.045873 tcp 10.0.2.105 50195 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:49:57.795681 0.082955 tcp 10.0.2.105 50196 -> 195.113.214.226 80 SRPA* 0 0 30 19712 flow=From-Botnet-V2-TCP-Established 1970/01/04 02:49:57.879281 0.131145 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:58.010833 0.179291 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:58.190490 0.324132 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:49:58.515021 0.122240 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/04 02:54:48.878969 3.002063 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 02:54:55.886696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:03.888171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:19.891482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 02:55:51.896999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:00:31.460097 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:00:31.460341 0.974034 tcp 10.0.2.105 50197 -> 128.255.183.224 9027 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:01:55.904094 3.001048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:02:02.910827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:10.912514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:26.914915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:02:58.921271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:02.927833 3.000917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:09:09.934470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:17.936147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:09:33.939054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:10:05.945685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:09.950764 3.002228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:16:16.958682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:24.960133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:16:40.963063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:17:12.969337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:20:14.019742 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:20:14.019854 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 03:20:31.808171 0.047191 tcp 10.0.2.105 50198 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:31.855621 0.047185 tcp 10.0.2.105 50199 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:31.903102 0.163890 tcp 10.0.2.105 50200 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:32.066158 0.000000 udp 10.0.2.105 7010 -> 81.173.131.33 5058 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 03:20:48.420071 0.045479 tcp 10.0.2.105 50201 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:48.465844 0.048232 tcp 10.0.2.105 50202 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:48.513924 0.158486 tcp 10.0.2.105 50203 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:20:48.673126 0.182832 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:20:48.856475 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 03:21:05.654832 0.046542 tcp 10.0.2.105 50204 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:21:05.701307 0.086755 tcp 10.0.2.105 50205 -> 195.113.214.226 80 SRPA* 0 0 38 24235 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:21:05.787255 0.202589 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:05.990243 0.039682 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.030293 0.306627 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.337299 0.062896 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.400720 0.141495 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.542596 0.141727 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.684704 0.075674 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.760785 0.161021 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:06.922204 0.334073 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:07.256654 0.144260 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:07.401310 0.077634 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:07.479378 0.152419 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:07.632166 0.172508 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:07.805101 0.212786 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.018237 0.172949 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.191678 0.158038 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.350102 0.250649 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.601124 0.213837 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.815324 0.175913 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:08.991580 0.137883 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:09.129863 0.179734 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:09.310029 0.340700 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:21:09.651107 0.121344 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:23:16.975608 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 03:23:23.982293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:31.984021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:23:47.987350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:24:19.993089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:23.999958 3.001116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:30:31.006917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:32.438795 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:30:32.438894 1.037750 tcp 10.0.2.105 50206 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:30:39.008192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:30:55.010767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:31:27.016928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:31.023418 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:37:38.030547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:37:46.032040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:38:02.035499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:38:34.041504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:38.047175 3.001416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:44:45.054903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:44:53.056441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:09.059355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:45:41.065027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:51:39.871597 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 03:51:39.871725 0.368699 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:40.240848 0.183849 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:40.425095 0.145906 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:40.571388 0.456266 udp 10.0.2.105 7010 <-> 122.176.57.240 8482 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.028055 0.037458 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.065879 0.063179 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.129458 0.147224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.277089 0.143367 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.420819 0.081523 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.502774 0.162990 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:41.666151 0.336486 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:42.003009 0.146411 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:42.149771 0.075611 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:51:42.225762 0.000000 udp 10.0.2.105 7010 -> 67.87.105.252 9318 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 03:51:45.071354 3.001052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:51:52.078225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:00.080242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:00.083158 0.047205 tcp 10.0.2.105 50207 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:00.130741 0.047291 tcp 10.0.2.105 50208 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:00.178338 0.152046 tcp 10.0.2.105 50209 -> 195.113.214.226 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:00.331128 0.180344 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:00.511882 0.223615 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:00.735889 0.155286 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:00.891607 0.157939 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:01.049995 0.171749 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:01.222125 0.138343 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:01.360870 0.188876 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:01.550175 0.255859 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:01.806434 0.211499 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:02.018298 0.342088 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/04 03:52:02.360810 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 03:52:16.082752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:52:17.886710 0.045416 tcp 10.0.2.105 50210 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:17.932573 0.047357 tcp 10.0.2.105 50211 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:17.980426 0.153177 tcp 10.0.2.105 50212 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 03:52:48.089440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:58:52.095665 3.001053 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 03:58:59.102749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:07.103730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:23.106928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 03:59:55.112854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:00:33.478828 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:00:33.478929 0.971801 tcp 10.0.2.105 50213 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:05:59.119611 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:06:06.126676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:14.128090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:06:30.130660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:07:02.137254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:06.143083 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:13:13.150770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:21.151869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:13:37.154896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:14:09.161278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:13.167156 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:20:20.174631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:28.176062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:20:44.178905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:21:16.185241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:22:21.168775 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:22:21.168887 0.134736 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:21.304049 0.121758 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:21.426179 0.371154 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:21.797700 0.000000 udp 10.0.2.105 7010 -> 122.176.57.240 8482 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:22:38.135276 0.046344 tcp 10.0.2.105 50214 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:38.181915 0.052510 tcp 10.0.2.105 50215 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:38.234338 0.150992 tcp 10.0.2.105 50216 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:38.385914 0.046587 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:38.432988 0.058935 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:38.492277 0.145951 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:38.638642 0.149713 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:38.788761 0.179954 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:38.969135 0.361106 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:39.330606 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:22:54.727666 0.050221 tcp 10.0.2.105 50217 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:54.778216 0.046538 tcp 10.0.2.105 50218 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:54.824590 0.162275 tcp 10.0.2.105 50219 -> 195.113.214.226 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:22:54.987593 0.143269 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:55.193694 0.076041 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:55.270087 0.161599 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:55.432088 0.079255 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:55.511765 0.213057 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:22:55.725246 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:23:11.401601 0.049467 tcp 10.0.2.105 50220 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:23:11.451372 0.049974 tcp 10.0.2.105 50221 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:23:11.501150 0.160818 tcp 10.0.2.105 50222 -> 195.113.214.226 443 SRPA* 0 0 33 17674 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:23:11.662524 0.157205 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:11.820180 0.180445 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:12.001011 0.144963 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:12.146380 0.179034 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:12.325823 0.320276 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:12.646502 0.226091 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:12.873043 0.269583 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:23:13.143032 0.215828 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:27:20.190572 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:27:27.198038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:35.199997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:27:51.203010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:28:23.208869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:30:34.458487 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:30:34.458635 0.993781 tcp 10.0.2.105 50223 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:34:27.214525 3.001924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:34:34.222346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:42.224018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:34:58.226901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:35:30.232778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:34.239573 3.001357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:41:41.246066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:41:49.247590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:42:05.250974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:42:37.607134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:41.613654 3.001723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 04:48:48.621143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:48:56.622275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:12.625497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:49:44.630924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:53:26.049803 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:53:26.049907 0.218041 udp 10.0.2.105 7010 -> 122.176.57.240 8482 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:53:26.267948 0.000000 icmp 122.176.57.240 0x0303 -> 10.0.2.105 0x2221 URP 192 1 242 flow=Background 1970/01/04 04:53:42.115455 0.047144 tcp 10.0.2.105 50224 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:53:42.162976 0.047046 tcp 10.0.2.105 50225 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:53:42.210318 0.154442 tcp 10.0.2.105 50226 -> 195.113.214.226 443 SRPA* 0 0 21 9322 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:53:42.365417 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:53:59.769571 0.046095 tcp 10.0.2.105 50227 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:53:59.815995 0.049992 tcp 10.0.2.105 50228 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:53:59.866324 0.157204 tcp 10.0.2.105 50229 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:54:00.024254 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:16.183391 0.053284 tcp 10.0.2.105 50230 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:54:16.237030 0.130621 tcp 10.0.2.105 50231 -> 195.113.214.226 80 SRPA* 0 0 46 30163 flow=From-Botnet-V2-TCP-Established 1970/01/04 04:54:16.367969 4.959867 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 4 1228 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:16.512543 4.078555 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 965 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:16.635342 4.402925 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 4 1178 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:16.972498 4.211191 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 967 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:17.117538 4.395524 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 4 1068 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:17.302375 4.552894 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1184 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:17.642786 4.260693 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 4 989 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:17.710030 4.236221 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 4 1099 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:17.748443 4.702919 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 4 1194 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.037894 4.491952 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1085 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.119702 4.551935 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 4 1355 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.260605 4.572259 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 4 1268 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.424162 4.493292 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 4 1031 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.504456 4.636535 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 4 1086 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.729287 4.569827 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1093 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:18.957821 4.533434 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 4 1127 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:19.129881 0.137784 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:19.268015 4.415616 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 4 1215 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:19.446387 4.506519 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1096 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:19.706091 4.463314 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 4 1088 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:19.941006 4.834940 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 4 1339 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:20.225615 4.261281 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 4 1214 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:24.170017 0.137884 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:54:24.776555 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:30.312291 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:36.721698 0.084940 udp 10.0.2.105 7010 -> 78.172.127.208 3632 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:36.806638 0.000000 icmp 78.172.127.208 0x0303 -> 10.0.2.105 0x300e URP 192 1 240 flow=Background 1970/01/04 04:54:41.367497 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:54:44.192370 0.000000 udp 10.0.2.105 7010 -> 94.71.82.41 4564 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:49.379252 0.000000 udp 10.0.2.105 7010 -> 118.140.6.66 5917 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:54:54.897348 0.000000 udp 10.0.2.105 7010 -> 49.204.25.105 1893 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:02.939402 0.000000 udp 10.0.2.105 7010 -> 95.226.156.186 6800 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:07.865809 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:55:11.401075 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:19.762957 0.000000 udp 10.0.2.105 7010 -> 78.171.50.51 9381 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:28.045379 0.044438 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:55:28.102091 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:32.862194 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:55:34.013614 0.080508 udp 10.0.2.105 7010 <-> 88.110.5.105 5196 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:55:34.103903 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:40.493053 0.000000 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:45.961226 0.000000 udp 10.0.2.105 7010 -> 171.99.231.154 9451 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:48.636938 3.002136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 04:55:54.402890 0.000000 udp 10.0.2.105 7010 -> 85.99.130.112 5005 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:55:55.644557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:55:59.360079 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:56:01.492988 0.000000 udp 10.0.2.105 7010 -> 99.229.152.200 5191 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:03.646076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:08.442949 0.000000 udp 10.0.2.105 7010 -> 95.225.89.11 3735 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:16.514894 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:19.649846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:22.774022 0.000000 udp 10.0.2.105 7010 -> 217.249.184.17 7662 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:27.359919 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:56:27.891028 0.000000 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:36.543373 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:42.411995 0.000000 udp 10.0.2.105 7010 -> 83.22.52.73 7393 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:48.000285 0.000000 udp 10.0.2.105 7010 -> 108.83.1.119 6432 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:56:51.655561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 04:56:52.866786 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:56:55.901662 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:02.500746 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:10.572291 0.000000 udp 10.0.2.105 7010 -> 91.11.4.91 9579 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:17.252386 0.000000 udp 10.0.2.105 7010 -> 69.124.217.64 3969 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:21.868774 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:57:25.394039 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:31.052130 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:39.253855 0.000000 udp 10.0.2.105 7010 -> 80.30.211.187 3758 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:48.056541 0.000000 udp 10.0.2.105 7010 -> 75.92.165.8 6873 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:57:52.862890 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:57:55.436771 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:02.917539 0.000000 udp 10.0.2.105 7010 -> 88.66.60.58 7348 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:08.906151 0.167508 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/04 04:58:09.089004 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:17.338630 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:21.865206 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:58:22.586110 0.000000 udp 10.0.2.105 7010 -> 79.203.246.139 4429 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:30.798266 0.000000 udp 10.0.2.105 7010 -> 85.97.241.177 3188 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:38.108318 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:44.517828 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:49.364496 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:58:50.916664 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:58:57.266114 0.000000 udp 10.0.2.105 7010 -> 217.58.50.234 8087 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:05.387363 0.000000 udp 10.0.2.105 7010 -> 99.20.137.124 4479 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:13.789698 0.000000 udp 10.0.2.105 7010 -> 95.248.92.118 1571 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:18.456156 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:59:21.250333 0.000000 udp 10.0.2.105 7010 -> 80.176.122.74 5241 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:29.192207 0.000000 udp 10.0.2.105 7010 -> 212.114.206.139 2171 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:36.752890 0.000000 udp 10.0.2.105 7010 -> 64.21.206.195 2641 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:43.602620 0.000000 udp 10.0.2.105 7010 -> 79.192.48.4 4600 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:48.459329 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 04:59:48.649979 0.000000 udp 10.0.2.105 7010 -> 217.36.123.4 8835 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 04:59:56.290756 0.000000 udp 10.0.2.105 7010 -> 109.208.202.236 5229 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:04.522703 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:10.731284 0.244666 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:10.975950 0.000000 icmp 72.242.16.98 0x0303 -> 10.0.2.105 0xa60b URP 192 1 163 flow=Background 1970/01/04 05:00:15.457911 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:00:18.673039 0.000000 udp 10.0.2.105 7010 -> 110.143.47.201 6816 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:23.750703 0.000000 udp 10.0.2.105 7010 -> 70.155.246.114 1350 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:31.611716 0.000000 udp 10.0.2.105 7010 -> 137.186.148.241 7321 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:35.717712 1.028493 tcp 10.0.2.105 50232 -> 128.255.183.224 9027 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:00:36.899405 0.000000 udp 10.0.2.105 7010 -> 122.170.54.209 2311 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:45.051538 0.000000 udp 10.0.2.105 7010 -> 95.237.58.225 2288 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:50.919165 0.000000 udp 10.0.2.105 7010 -> 195.145.206.154 5166 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:00:56.928106 0.000000 udp 10.0.2.105 7010 -> 81.110.44.111 1690 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:01.454119 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:01:02.005715 0.000000 udp 10.0.2.105 7010 -> 187.162.186.31 8590 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:07.463273 0.000000 udp 10.0.2.105 7010 -> 85.74.21.81 1729 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:12.750592 0.000000 udp 10.0.2.105 7010 -> 110.4.166.125 4563 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:20.271392 0.000000 udp 10.0.2.105 7010 -> 88.254.98.63 1473 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:29.074527 0.000000 udp 10.0.2.105 7010 -> 81.63.137.250 1218 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:33.951255 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:01:37.676618 0.000000 udp 10.0.2.105 7010 -> 87.16.12.143 3217 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:46.379734 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:53.649708 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:01:58.456190 0.000206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:02:01.430641 0.000000 udp 10.0.2.105 7010 -> 81.134.12.60 8496 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:07.289374 0.000000 udp 10.0.2.105 7010 -> 212.159.23.4 9289 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:14.039062 0.473890 udp 10.0.2.105 7010 <-> 119.234.26.107 2925 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:02:14.526908 0.245550 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:02:14.780861 0.174204 udp 10.0.2.105 7010 <-> 1.23.249.44 6353 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:02:14.986910 0.061543 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:02:15.060092 0.039157 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:02:15.109232 0.000000 udp 10.0.2.105 7010 -> 88.252.115.136 5937 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:21.509755 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:26.456256 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:02:26.807528 0.000000 udp 10.0.2.105 7010 -> 190.153.251.210 4226 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:32.725957 0.000000 udp 10.0.2.105 7010 -> 79.13.77.51 7043 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:40.046850 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:45.954576 0.000000 udp 10.0.2.105 7010 -> 94.138.34.195 5763 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:50.951823 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:02:54.797719 0.000000 udp 10.0.2.105 7010 -> 203.136.227.87 6707 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:02:55.751550 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:03:02.338055 0.000000 udp 10.0.2.105 7010 -> 85.107.177.230 2982 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:02.759082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:08.717984 0.000000 udp 10.0.2.105 7010 -> 85.98.70.176 1838 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:10.760011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:17.089783 0.000000 udp 10.0.2.105 7010 -> 2.97.17.3 9400 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:21.956029 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:03:22.948109 0.000000 udp 10.0.2.105 7010 -> 12.219.241.105 3421 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:26.763421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:03:29.467329 0.000000 udp 10.0.2.105 7010 -> 95.224.104.39 9871 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:36.086988 0.000000 udp 10.0.2.105 7010 -> 212.252.6.244 7865 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:43.677608 0.258785 udp 10.0.2.105 7010 -> 171.4.250.78 9881 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:43.936393 0.000000 icmp 171.4.250.78 0x0303 -> 10.0.2.105 0x9926 URP 192 1 288 flow=Background 1970/01/04 05:03:48.454663 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:03:49.025375 0.000000 udp 10.0.2.105 7010 -> 188.6.138.115 9845 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:55.925695 0.000000 udp 10.0.2.105 7010 -> 95.232.147.133 3391 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:03:58.769649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:04:02.965784 0.000000 udp 10.0.2.105 7010 -> 93.177.172.241 4362 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:09.304573 0.191311 udp 10.0.2.105 7010 -> 182.71.206.98 1025 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:09.495884 0.000000 icmp 182.71.206.98 0x0303 -> 10.0.2.105 0x0104 URP 192 1 246 flow=Background 1970/01/04 05:04:13.951338 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:04:16.855821 0.000000 udp 10.0.2.105 7010 -> 177.99.127.151 9117 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:25.707975 0.000000 udp 10.0.2.105 7010 -> 82.54.86.82 4147 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:31.947341 0.000000 udp 10.0.2.105 7010 -> 95.250.153.228 5995 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:39.408096 0.000000 udp 10.0.2.105 7010 -> 58.8.194.100 9422 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:04:43.953880 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:10:02.775139 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 05:10:09.782765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:17.784303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:10:33.787393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:11:05.793334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:09.799978 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:17:16.806770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:24.808389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:17:40.811314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:18:12.837486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:16.843223 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:24:23.850731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:31.851942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:24:47.855435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:25:19.861094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:30:36.747544 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:30:36.747656 1.069192 tcp 10.0.2.105 50233 -> 128.255.183.224 9027 FSPA* 0 0 12 1421 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:31:23.867243 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:31:30.874581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:38.875863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:31:54.879321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:32:26.885400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:34:51.043459 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 05:34:51.043581 0.327781 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:51.371781 0.123154 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:51.495299 0.043701 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:51.539337 0.144609 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:51.684310 0.138375 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:51.823095 0.186456 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.009993 0.336412 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.346774 0.074560 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.421781 0.073940 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.496114 0.214906 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.711408 0.150274 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.862089 0.074364 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:52.936886 0.143017 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:53.080529 0.163970 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:53.244865 0.173233 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:53.418515 0.184854 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:53.603796 0.331809 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:53.936033 0.156715 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.093175 0.217286 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.310861 0.130889 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.442168 0.183413 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.625982 0.327261 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.953646 0.044579 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:54.998592 0.074977 udp 10.0.2.105 7010 <-> 88.110.5.105 5196 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:55.073994 0.165937 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:55.240566 0.059509 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:34:55.300605 0.000000 udp 10.0.2.105 7010 -> 119.234.26.107 2925 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 05:35:13.077273 0.048686 tcp 10.0.2.105 50234 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:35:13.126246 0.098201 tcp 10.0.2.105 50235 -> 195.113.214.226 80 SRPA* 0 0 39 37700 flow=From-Botnet-V2-TCP-Established 1970/01/04 05:35:13.225058 0.035413 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:35:13.260925 0.201090 udp 10.0.2.105 7010 <-> 1.23.249.44 6353 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:35:13.462398 0.090734 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/04 05:38:30.890679 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:38:37.898561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:38:45.900121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:39:01.903594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:39:33.908973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:37.915602 3.001020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:45:44.922958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:45:52.924612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:46:08.927491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:46:40.933438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:52:44.939275 3.001747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:52:51.946257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:00.068186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:16.070928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:53:48.077552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 05:59:52.083145 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 05:59:59.091036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:07.091876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:23.095253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:00:38.147297 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:00:38.147401 0.927127 tcp 10.0.2.105 50236 -> 128.255.183.224 9027 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:00:55.702272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:05:28.795092 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:05:28.795294 0.931966 udp 10.0.2.105 7010 <-> 119.234.26.107 2925 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:29.727677 0.067340 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:29.795448 0.140489 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:29.936416 0.145183 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.082015 0.187030 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.269468 0.261291 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.531117 0.144770 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.676458 0.061079 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.738005 0.080853 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:30.819261 0.407330 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.226985 0.149312 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.376723 0.081139 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.458267 0.142390 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.601067 0.212052 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.813485 0.174688 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:31.988611 0.461232 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:32.450288 0.156218 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:32.606873 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:05:48.826309 0.048543 tcp 10.0.2.105 50237 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:05:48.875206 0.046717 tcp 10.0.2.105 50238 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:05:48.922215 0.163556 tcp 10.0.2.105 50239 -> 195.113.214.226 443 SRPA* 0 0 36 19636 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:05:49.084511 0.183017 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:49.267900 0.181157 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:05:49.449398 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:06:05.438432 0.045728 tcp 10.0.2.105 50240 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:05.484486 0.047820 tcp 10.0.2.105 50241 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:05.532682 0.157124 tcp 10.0.2.105 50242 -> 195.113.214.226 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:05.690093 0.044484 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:05.734992 0.071643 udp 10.0.2.105 7010 <-> 88.110.5.105 5196 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:05.807060 0.213240 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.020690 0.144777 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.165890 0.166040 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.332356 0.059104 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.391868 0.090454 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.482728 0.036583 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:06:06.519653 0.000000 udp 10.0.2.105 7010 -> 1.23.249.44 6353 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:06:24.195778 0.047647 tcp 10.0.2.105 50243 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:24.243734 0.046891 tcp 10.0.2.105 50244 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:24.290928 0.154087 tcp 10.0.2.105 50245 -> 195.113.214.226 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:06:59.708788 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 06:07:06.715325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:14.717151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:07:30.719721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:08:02.726051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:06.732987 3.000741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:14:13.739689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:21.781136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:14:37.783996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:15:09.789804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:13.797163 3.101003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:21:20.903456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:28.905133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:21:44.908451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:22:16.914276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:20.919944 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:28:27.927722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:35.929468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:28:51.932080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:29:23.938074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:30:39.127092 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:30:39.127326 0.975151 tcp 10.0.2.105 50246 -> 128.255.183.224 9027 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:35:27.945129 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:35:34.951282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:42.953675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:35:58.956028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:36:25.754991 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 06:36:25.755198 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:36:30.961891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:36:43.522716 0.531743 tcp 10.0.2.105 50247 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:36:44.054706 0.547079 tcp 10.0.2.105 50248 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:36:44.602103 1.148315 tcp 10.0.2.105 50249 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:36:45.751141 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:37:01.457028 0.536876 tcp 10.0.2.105 50250 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:01.994212 0.493855 tcp 10.0.2.105 50251 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:02.488456 1.148429 tcp 10.0.2.105 50252 -> 195.113.214.226 443 SRPA* 0 0 24 10462 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:03.637539 0.000000 udp 10.0.2.105 7010 -> 1.23.249.44 6353 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 06:37:21.145720 0.519541 tcp 10.0.2.105 50253 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:21.665117 0.542326 tcp 10.0.2.105 50254 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:22.207240 1.134868 tcp 10.0.2.105 50255 -> 195.113.214.226 443 SRPA* 0 0 25 13254 flow=From-Botnet-V2-TCP-Established 1970/01/04 06:37:23.343594 0.382144 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:23.726170 0.392161 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:24.118774 0.286780 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:24.405927 0.772518 udp 10.0.2.105 7010 <-> 119.234.26.107 2925 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:25.178869 0.315751 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:25.495036 0.533451 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:26.028904 0.452307 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:26.481631 0.423179 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:26.905206 0.309050 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:27.214673 0.300142 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:27.515198 0.429011 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:27.944612 0.430973 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:28.375942 0.472540 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:28.848848 0.586790 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:29.435985 0.393971 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:29.830382 0.406282 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:30.237133 0.472338 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:30.709902 0.411968 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:31.122265 0.423866 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:31.546506 0.451049 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:31.997964 0.379356 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:32.377764 0.293193 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:32.671322 0.611163 udp 10.0.2.105 7010 <-> 88.110.5.105 5196 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:33.282905 0.277628 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:33.560949 0.413891 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:33.975205 0.308642 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:37:34.284320 0.339345 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/04 06:42:34.969036 3.000775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 06:42:41.975787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:42:49.977261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:43:05.979930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:43:37.986030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:41.992692 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:49:48.999362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:49:57.001152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:50:13.003720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:50:45.010234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:56:49.016385 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 06:56:56.023480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:04.025247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:20.027686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 06:57:52.033787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:00:40.106713 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:00:40.106955 1.711945 tcp 10.0.2.105 50256 -> 128.255.183.224 9027 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:03:56.040655 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:04:03.047444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:11.049204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:27.051995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:04:59.058212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:07:41.352140 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:07:41.352298 0.386196 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:41.738881 0.385510 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:42.124786 0.285634 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:42.410821 1.217835 udp 10.0.2.105 7010 <-> 119.234.26.107 2925 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:43.629101 0.327631 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:43.957085 0.584921 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:44.542423 0.467439 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:45.010270 0.427489 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:45.438163 0.275869 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:45.714408 0.335233 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:46.050068 0.405354 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:46.455838 0.392748 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:46.848984 0.464840 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:47.314227 0.564615 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:47.879218 0.390467 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:48.270032 0.414420 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:48.684799 0.389921 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:49.075124 0.590848 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:07:49.666364 0.000000 udp 10.0.2.105 7010 -> 108.76.85.176 4197 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 07:08:06.510842 0.575464 tcp 10.0.2.105 50257 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:07.086592 0.544996 tcp 10.0.2.105 50258 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:07.631892 1.136416 tcp 10.0.2.105 50259 -> 195.113.214.226 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:08.767320 0.454349 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:09.222080 0.380488 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:09.602959 0.285124 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:09.888475 0.412650 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:10.301589 0.000000 udp 10.0.2.105 7010 -> 88.110.5.105 5196 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 07:08:29.241069 0.577238 tcp 10.0.2.105 50260 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:29.818159 0.533827 tcp 10.0.2.105 50261 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:30.352476 1.109326 tcp 10.0.2.105 50262 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:08:31.462515 0.285987 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:31.748917 0.305820 udp 10.0.2.105 7010 <-> 109.155.171.147 2617 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:08:32.055127 0.384360 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:11:03.064455 3.001129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:11:10.071801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:18.073080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:11:34.075657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:12:06.081996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:10.088579 3.001070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:18:17.095535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:25.097283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:18:41.099579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:19:13.105903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:17.112189 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:25:24.119333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:32.120875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:25:48.124035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:26:20.129876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:30:41.827170 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:30:41.827280 1.665896 tcp 10.0.2.105 50263 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:32:24.135932 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:32:31.143594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:39.144499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:32:55.148024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:33:27.164101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:38:32.953859 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 07:38:32.953967 0.426168 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:33.380560 0.000000 udp 10.0.2.105 7010 -> 88.110.5.105 5196 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 07:38:52.143447 0.567758 tcp 10.0.2.105 50264 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:38:52.711463 0.578906 tcp 10.0.2.105 50265 -> 195.113.214.226 80 SRPA* 0 0 20 14739 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:38:53.290887 0.380695 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:53.671985 0.384431 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:54.056795 0.327012 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:54.384304 0.695889 udp 10.0.2.105 7010 <-> 119.234.26.107 2925 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:55.080561 0.340804 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:55.421721 0.397039 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:38:55.819113 4.377287 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:00.196836 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 07:39:18.831016 0.558120 tcp 10.0.2.105 50266 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:39:19.389385 0.588898 tcp 10.0.2.105 50267 -> 195.113.214.226 80 SRPA* 0 0 20 14727 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:39:19.978762 0.448979 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:20.428145 0.317903 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:20.746444 0.389736 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:21.136644 0.421003 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:21.558067 0.453655 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:22.012142 0.580102 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:22.592676 0.430095 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:23.023152 0.413933 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:23.437494 0.797638 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:24.235539 1.992289 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:26.228227 0.288658 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:26.517285 0.364680 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:26.882368 0.446573 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:27.329358 0.417209 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:27.746973 0.286191 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:28.033502 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 07:39:31.169705 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 07:39:38.177396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:39:43.466424 0.539728 tcp 10.0.2.105 50268 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:39:44.006393 0.540904 tcp 10.0.2.105 50269 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:39:44.547536 1.096893 tcp 10.0.2.105 50270 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 07:39:45.644991 0.431689 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 07:39:46.179000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:40:02.181726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:40:34.187987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:38.194642 3.000547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:46:45.201862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:46:53.202756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:47:09.205808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:47:41.212192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:53:45.218288 3.001320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 07:53:52.225402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:00.226479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:16.229816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 07:54:48.235990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:00:43.496935 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:00:43.497088 1.703770 tcp 10.0.2.105 50271 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:00:52.241297 3.002498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:00:59.249345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:07.250354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:23.253470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:01:55.260056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:07:59.266211 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:08:06.273383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:14.274686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:08:30.277550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:09:02.283797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:09:48.921275 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:09:48.921377 0.327142 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:09:49.248519 0.000000 icmp 81.174.154.246 0x0303 -> 10.0.2.105 0x9307 URP 192 1 285 flow=Background 1970/01/04 08:10:04.756438 0.537868 tcp 10.0.2.105 50272 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:05.294535 0.562846 tcp 10.0.2.105 50273 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:05.857724 1.378440 tcp 10.0.2.105 50274 -> 195.113.214.226 443 SRPA* 0 0 33 24698 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:07.236918 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:10:25.684964 0.534769 tcp 10.0.2.105 50275 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:26.220038 0.537508 tcp 10.0.2.105 50276 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:26.757871 1.122150 tcp 10.0.2.105 50277 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:27.880932 0.437868 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:28.319232 0.379639 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:28.699274 0.365971 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:29.065652 0.000000 udp 10.0.2.105 7010 -> 119.234.26.107 2925 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:10:45.763404 0.556385 tcp 10.0.2.105 50278 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:46.319644 0.557206 tcp 10.0.2.105 50279 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:46.877146 1.086728 tcp 10.0.2.105 50280 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:10:47.964621 0.288784 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:48.253822 0.314170 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:48.568552 0.270833 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:10:48.839719 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:05.231916 0.554080 tcp 10.0.2.105 50281 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:11:05.786237 0.498293 tcp 10.0.2.105 50282 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:11:06.284831 1.189397 tcp 10.0.2.105 50283 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:11:07.474785 0.427289 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:07.902475 0.279175 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:08.182032 0.394901 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:08.577333 0.476430 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:09.054164 0.407635 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:09.462157 0.423221 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:09.885729 0.583432 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:10.469560 0.406488 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:10.876616 0.395298 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:11.272490 0.382838 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:11.655750 0.281113 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:11.937253 0.498097 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:12.435754 0.469234 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:12.905400 0.412265 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:13.318099 0.250287 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:13.568789 0.332314 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:13.948701 0.000000 udp 10.0.2.105 7010 -> 119.234.26.107 2925 REQ 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:20.882932 4.178822 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:25.062371 0.381698 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:25.444817 0.378250 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:25.823667 0.408420 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:26.232741 0.613759 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:26.847228 0.342632 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:27.190470 0.260707 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:27.451788 0.277197 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:27.729557 0.427592 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:28.157631 0.459829 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:28.618043 0.399209 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:29.017832 0.424288 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:29.442615 0.441839 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:29.884923 0.408787 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:30.294185 0.591616 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:30.336173 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:11:30.886307 0.387544 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:31.274350 0.286608 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:31.561549 0.394542 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:31.956748 0.509012 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:32.466254 0.453122 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:32.919961 0.282430 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:33.202988 0.343102 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:33.546698 0.412811 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:11:33.960374 0.000000 udp 10.0.2.105 7010 -> 88.71.90.162 5030 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:39.239797 0.000000 udp 10.0.2.105 7010 -> 162.205.97.6 1458 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:47.101118 0.000000 udp 10.0.2.105 7010 -> 78.175.212.131 1843 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:55.323006 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:11:59.829265 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:12:04.135439 0.000000 udp 10.0.2.105 7010 -> 98.201.38.218 1177 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:11.506780 0.000000 udp 10.0.2.105 7010 -> 190.147.158.13 5480 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:20.278219 0.330812 udp 10.0.2.105 7010 -> 78.172.127.208 3632 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:20.609031 0.000000 icmp 78.172.127.208 0x0303 -> 10.0.2.105 0x300e URP 192 1 301 flow=Background 1970/01/04 08:12:24.834809 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:12:26.858250 0.000000 udp 10.0.2.105 7010 -> 94.71.82.41 4564 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:32.565847 0.000000 udp 10.0.2.105 7010 -> 118.140.6.66 5917 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:38.784871 0.000000 udp 10.0.2.105 7010 -> 76.176.28.159 4257 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:45.364663 0.000000 udp 10.0.2.105 7010 -> 49.204.25.105 1893 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:12:50.351414 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:12:53.746941 0.000000 udp 10.0.2.105 7010 -> 81.159.5.77 5117 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:02.238565 0.000000 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:11.071262 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:15.858205 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:13:17.951470 0.000000 udp 10.0.2.105 7010 -> 64.68.214.163 4146 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:24.270456 0.000000 udp 10.0.2.105 7010 -> 175.138.241.7 6504 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:30.640012 2.661228 udp 10.0.2.105 7010 <-> 179.13.179.230 4432 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:13:33.367897 0.000000 udp 10.0.2.105 7010 -> 156.34.204.61 2605 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:42.175981 0.309787 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:42.485768 0.000000 icmp 82.51.116.137 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 158 flow=Background 1970/01/04 08:13:46.902859 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:13:48.255351 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 2495 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:13:55.235153 0.000000 udp 10.0.2.105 7010 -> 109.65.132.188 7298 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:00.983675 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 4579 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:07.512952 0.302105 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:07.815057 0.000000 icmp 94.39.219.132 0x0303 -> 10.0.2.105 0xb523 URP 192 1 118 flow=Background 1970/01/04 08:14:12.399610 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:14:15.894500 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:24.717154 0.000000 udp 10.0.2.105 7010 -> 31.42.4.49 8033 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:30.265831 0.000000 udp 10.0.2.105 7010 -> 88.254.119.230 9475 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:36.163652 0.000000 udp 10.0.2.105 7010 -> 95.224.104.39 9871 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:40.900465 0.720998 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:14:45.276696 0.000000 udp 10.0.2.105 7010 -> 99.229.152.200 5191 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:50.825136 0.000000 udp 10.0.2.105 7010 -> 78.181.5.158 5470 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:14:56.793576 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:02.281809 0.000000 udp 10.0.2.105 7010 -> 188.6.138.115 9845 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:06.671431 3.000865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:15:07.218280 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:15:08.069909 0.000000 udp 10.0.2.105 7010 -> 67.143.241.87 1977 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:13.677645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:15.220558 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:21.228752 0.000000 udp 10.0.2.105 7010 -> 83.22.52.73 7393 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:21.679444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:30.041832 0.000000 udp 10.0.2.105 7010 -> 83.242.29.125 6165 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:34.718158 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:15:36.009936 0.000000 udp 10.0.2.105 7010 -> 95.232.147.133 3391 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:37.681950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:15:41.807922 0.000000 udp 10.0.2.105 7010 -> 189.60.116.229 8208 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:46.945401 0.000000 udp 10.0.2.105 7010 -> 88.246.160.29 6519 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:52.563562 0.000000 udp 10.0.2.105 7010 -> 96.53.16.30 3157 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:58.031550 0.460280 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:15:58.491830 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 232 flow=Background 1970/01/04 08:16:02.718102 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:16:05.382254 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:09.687907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:16:11.621508 0.000000 udp 10.0.2.105 7010 -> 209.122.160.124 8208 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:17.680152 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:25.801473 0.000000 udp 10.0.2.105 7010 -> 80.30.211.187 3758 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:30.718360 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:16:33.983193 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:42.956216 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:51.698919 0.567946 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:16:52.423148 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:16:56.214877 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:16:58.217928 0.000000 udp 10.0.2.105 7010 -> 213.235.233.130 3523 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:06.860290 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:13.139293 0.000000 udp 10.0.2.105 7010 -> 177.99.127.151 9117 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:21.801745 0.000000 udp 10.0.2.105 7010 -> 75.151.248.1 1025 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:26.718890 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:17:29.042100 0.000000 udp 10.0.2.105 7010 -> 41.68.130.23 4629 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:37.384116 0.000000 udp 10.0.2.105 7010 -> 159.205.154.112 7502 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:42.821963 0.000000 udp 10.0.2.105 7010 -> 184.74.168.82 5338 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:48.420196 0.000000 udp 10.0.2.105 7010 -> 95.250.153.228 5995 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:17:53.217158 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:17:53.567380 0.000000 udp 10.0.2.105 7010 -> 90.210.183.220 1437 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:00.898433 0.000000 udp 10.0.2.105 7010 -> 84.209.32.129 5944 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:08.679710 0.000000 udp 10.0.2.105 7010 -> 95.248.92.118 1571 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:17.151708 0.000000 udp 10.0.2.105 7010 -> 188.129.168.105 3978 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:21.717780 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:18:22.409193 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:27.586404 0.000000 udp 10.0.2.105 7010 -> 64.21.206.195 2641 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:35.407967 0.000000 udp 10.0.2.105 7010 -> 176.42.230.55 2586 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:43.700053 0.000000 udp 10.0.2.105 7010 -> 109.208.202.236 5229 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:18:48.215736 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:18:52.041626 0.000000 udp 10.0.2.105 7010 -> 181.198.38.2 4721 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:00.834367 0.000000 udp 10.0.2.105 7010 -> 24.39.134.168 7103 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:05.981868 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:14.534075 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:19.210695 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:19:22.154918 0.000000 udp 10.0.2.105 7010 -> 94.141.208.225 1616 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:30.857972 0.000000 udp 10.0.2.105 7010 -> 108.223.238.221 7722 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:35.965302 0.000000 udp 10.0.2.105 7010 -> 82.52.158.53 6955 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:43.525897 0.000000 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:48.212175 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:19:49.494166 0.000000 udp 10.0.2.105 7010 -> 110.143.47.201 6816 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:19:56.775034 0.423839 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:19:57.218185 0.000000 udp 10.0.2.105 7010 -> 70.155.246.114 1350 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:04.346043 0.000000 udp 10.0.2.105 7010 -> 187.79.252.147 4895 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:11.375693 0.000000 udp 10.0.2.105 7010 -> 137.186.148.241 7321 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:16.212880 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:20:16.893837 0.000000 udp 10.0.2.105 7010 -> 31.223.245.68 9748 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:22.802702 0.000000 udp 10.0.2.105 7010 -> 95.237.58.225 2288 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:29.211199 0.000000 udp 10.0.2.105 7010 -> 207.87.253.170 5819 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:36.171194 0.327499 udp 10.0.2.105 7010 -> 93.70.219.108 5486 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:36.498693 0.000000 icmp 93.70.219.108 0x0303 -> 10.0.2.105 0x6e15 URP 192 1 327 flow=Background 1970/01/04 08:20:40.718213 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:20:44.413331 0.000000 udp 10.0.2.105 7010 -> 68.80.76.81 6311 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:49.780958 0.000000 udp 10.0.2.105 7010 -> 201.140.182.9 3997 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:20:57.011320 0.000000 udp 10.0.2.105 7010 -> 87.16.12.143 3217 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:05.213074 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:10.209971 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:21:10.581370 0.000000 udp 10.0.2.105 7010 -> 207.161.194.212 5824 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:19.263526 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:24.781275 0.000000 udp 10.0.2.105 7010 -> 151.74.150.139 6068 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:32.682909 0.000000 udp 10.0.2.105 7010 -> 2.126.196.115 6590 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:37.219365 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:21:41.295385 0.000000 udp 10.0.2.105 7010 -> 69.199.230.26 4689 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:46.702954 0.000000 udp 10.0.2.105 7010 -> 81.201.62.61 3465 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:52.921955 0.000000 udp 10.0.2.105 7010 -> 61.152.173.94 7700 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:21:59.030446 0.000000 udp 10.0.2.105 7010 -> 71.88.174.49 8776 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:03.717469 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:22:06.031007 0.000000 udp 10.0.2.105 7010 -> 206.54.145.254 6353 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:11.488552 0.000000 udp 10.0.2.105 7010 -> 190.213.111.136 6402 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:13.693933 3.002172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:22:19.460170 0.000000 udp 10.0.2.105 7010 -> 188.123.142.37 9889 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:20.701637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:27.952384 0.000000 udp 10.0.2.105 7010 -> 164.51.234.55 8241 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:28.703325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:32.718967 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:22:34.481697 0.000000 udp 10.0.2.105 7010 -> 69.15.41.105 7910 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:40.940768 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:44.706087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:22:48.782057 0.000000 udp 10.0.2.105 7010 -> 92.75.8.73 6342 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:54.830988 0.000000 udp 10.0.2.105 7010 -> 82.104.56.191 1669 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:22:59.717708 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:23:02.181650 0.000000 udp 10.0.2.105 7010 -> 62.121.23.63 3041 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:07.629127 0.283488 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:23:07.923022 0.000000 udp 10.0.2.105 7010 -> 82.212.15.194 3336 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:13.878291 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:16.711990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:23:21.609509 0.294297 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:23:21.913955 0.000000 udp 10.0.2.105 7010 -> 151.66.161.176 2140 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:26.215535 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:23:27.137490 0.000000 udp 10.0.2.105 7010 -> 91.56.59.128 5125 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:33.126420 0.000000 udp 10.0.2.105 7010 -> 80.241.242.232 1819 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:40.536459 0.373538 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:23:40.920312 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:45.994337 0.000000 udp 10.0.2.105 7010 -> 121.54.22.85 2129 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:23:50.711139 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:23:51.682623 0.000000 udp 10.0.2.105 7010 -> 201.238.117.138 1043 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:00.304977 0.000000 udp 10.0.2.105 7010 -> 5.61.46.148 1663 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:05.782825 0.000000 udp 10.0.2.105 7010 -> 84.197.100.164 9069 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:11.651645 0.000000 udp 10.0.2.105 7010 -> 88.241.63.157 5726 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:16.217695 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:24:20.003121 0.000000 udp 10.0.2.105 7010 -> 2.188.197.143 2446 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:28.325711 0.000000 udp 10.0.2.105 7010 -> 31.15.130.225 7976 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:36.486948 0.000000 udp 10.0.2.105 7010 -> 78.6.121.163 1040 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:41.213392 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:24:44.187911 0.000000 udp 10.0.2.105 7010 -> 190.8.255.111 3156 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:51.037687 0.000000 udp 10.0.2.105 7010 -> 88.226.207.229 9361 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:24:58.198438 0.384626 udp 10.0.2.105 7010 <-> 24.159.59.243 6636 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:24:58.646278 0.419213 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:24:59.083819 0.000000 udp 10.0.2.105 7010 -> 72.70.56.11 3231 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:25:07.952584 0.298956 udp 10.0.2.105 7010 -> 188.216.116.105 1024 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:25:08.251540 0.000000 icmp 188.216.116.105 0x0303 -> 10.0.2.105 0x0004 URP 192 1 206 flow=Background 1970/01/04 08:25:12.719289 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:25:16.283974 0.000000 udp 10.0.2.105 7010 -> 72.164.94.26 4190 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:29:20.718288 3.001762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:29:27.725683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:35.726817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:29:51.729792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:30:23.736138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:30:45.588493 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:30:45.588796 1.727454 tcp 10.0.2.105 50284 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:36:27.742580 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:36:34.749395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:42.750746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:36:58.754227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:37:30.760181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:34.766193 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:43:41.773566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:43:49.774809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:44:05.778417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:44:37.783827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:41.790391 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 08:50:48.797225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:50:56.799300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:51:12.801939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:51:44.808188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:55:43.481940 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 08:55:43.482123 2.168161 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:45.650738 0.476063 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:46.127230 0.384314 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:46.511939 0.294934 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:46.807300 0.341579 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:47.149226 0.472159 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:47.621786 0.395377 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:48.017517 0.277337 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:48.295270 0.306034 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:48.601645 0.381728 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:48.983804 0.433467 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:49.417667 0.421317 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:49.839393 0.404386 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:50.244137 0.581562 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:50.826122 0.431967 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:51.258436 0.376669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:51.635446 0.287913 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:51.923791 0.382792 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:52.306951 0.507085 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:52.814403 0.465401 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:55:53.280208 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:56:09.370337 0.542593 tcp 10.0.2.105 50285 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:09.913231 0.545874 tcp 10.0.2.105 50286 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:10.459357 1.124811 tcp 10.0.2.105 50287 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:11.584897 0.344848 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:11.930097 0.418378 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:12.348857 0.000000 udp 10.0.2.105 7010 -> 179.13.179.230 4432 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:56:30.900794 0.528736 tcp 10.0.2.105 50288 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:31.429893 0.544306 tcp 10.0.2.105 50289 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:31.974428 1.129387 tcp 10.0.2.105 50290 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:33.104660 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 08:56:48.916880 0.551254 tcp 10.0.2.105 50291 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:49.468652 0.541464 tcp 10.0.2.105 50292 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:50.010390 1.123446 tcp 10.0.2.105 50293 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 08:56:51.134391 0.399393 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:51.534117 0.291729 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:51.826181 0.299843 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:52.126380 0.385763 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:52.512577 0.386295 udp 10.0.2.105 7010 <-> 24.159.59.243 6636 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:56:52.899270 0.395230 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/04 08:57:48.813946 3.001841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 08:57:55.821413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:03.823273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:19.825867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 08:58:51.831895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:00:47.318322 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:00:47.318428 1.659246 tcp 10.0.2.105 50294 -> 128.255.183.224 9027 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:04:55.838431 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:05:02.845521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:10.847044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:26.849844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:05:58.856140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:03.713517 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:12:10.721056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:18.721763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:12:34.725341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:13:06.731236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:10.737359 3.001363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:19:17.744251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:25.745954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:19:41.749137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:20:13.754777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:17.761778 3.001164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:26:24.768860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:32.770220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:26:48.773413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:27:05.948927 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:27:05.949029 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 09:27:20.779172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:27:21.313375 0.571295 tcp 10.0.2.105 50295 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:21.884923 0.513124 tcp 10.0.2.105 50296 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:22.398342 1.091487 tcp 10.0.2.105 50297 -> 195.113.214.226 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:23.490502 0.000000 udp 10.0.2.105 7010 -> 179.13.179.230 4432 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 09:27:40.017881 0.530371 tcp 10.0.2.105 50298 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:40.548562 0.552361 tcp 10.0.2.105 50299 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:41.101222 1.165282 tcp 10.0.2.105 50300 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:27:42.267217 0.527716 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:27:42.795339 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 09:27:59.515707 0.576118 tcp 10.0.2.105 50301 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:00.091658 0.556952 tcp 10.0.2.105 50302 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:00.648899 1.140839 tcp 10.0.2.105 50303 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:01.790487 0.386864 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:02.177724 0.583081 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:02.761239 0.390632 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:03.152228 0.640302 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:03.792886 0.439880 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:04.233166 0.400325 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:04.633832 0.388483 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:05.022965 0.305501 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:05.328885 0.337702 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:05.667015 0.431380 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:06.098710 0.443866 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:06.543014 0.598809 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:07.142185 0.420385 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:07.562995 0.304346 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:07.867707 0.372047 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:08.240143 0.378662 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:08.619164 0.380581 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:09.000084 0.477726 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:09.478189 0.467283 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:09.945828 0.332590 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:10.278845 0.393314 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:10.672732 0.296024 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:10.969174 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 09:28:29.879927 0.541094 tcp 10.0.2.105 50304 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:30.421404 0.545441 tcp 10.0.2.105 50305 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:30.967206 1.147869 tcp 10.0.2.105 50306 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:28:32.115771 0.411869 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:32.528058 0.371143 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:32.899613 0.383768 udp 10.0.2.105 7010 <-> 24.159.59.243 6636 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:28:33.283768 0.376539 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:30:49.389621 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:30:49.389733 1.704476 tcp 10.0.2.105 50307 -> 128.255.183.224 9027 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:33:24.785496 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 09:33:31.792450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:39.794128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:33:55.797256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:34:27.803411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:31.809894 3.000498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:40:38.816387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:40:46.817891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:02.821162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:41:34.827451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:38.832715 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:47:45.840268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:47:53.842251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:48:09.845394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:48:41.851228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:54:45.857190 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 09:54:52.864783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:00.865993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:16.869247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:55:48.874769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 09:58:50.115809 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 09:58:50.115979 0.383408 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:50.499767 0.299500 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:50.799678 0.557724 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:51.357923 0.388188 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:51.746522 0.325115 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:52.072008 0.390884 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:52.463304 0.320017 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:52.783710 0.402434 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:53.186506 0.397673 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:53.584668 0.424739 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:54.009790 0.279744 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:54.289938 0.288696 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:54.579036 0.439942 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:55.019430 0.575953 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:55.595800 0.464347 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:56.060606 0.406328 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:56.467352 0.287136 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:56.754837 0.380086 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:57.135334 0.406345 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:57.542020 0.393093 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:57.935474 0.494296 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:58.430217 0.475397 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:58.906023 0.286297 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:59.192731 0.410434 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:59.603606 0.281580 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:58:59.885611 0.398206 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:59:00.284163 0.399011 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/04 09:59:00.683596 0.000000 udp 10.0.2.105 7010 -> 24.159.59.243 6636 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 09:59:18.418885 0.523016 tcp 10.0.2.105 50308 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:59:18.942141 0.523450 tcp 10.0.2.105 50309 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:59:19.465863 1.157840 tcp 10.0.2.105 50310 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 09:59:20.624456 0.404381 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:00:51.099684 0.000170 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:00:51.099952 1.749751 tcp 10.0.2.105 50311 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:01:52.881525 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:01:59.888247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:07.889916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:23.892774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:02:55.899015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:08:59.904701 3.002145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:09:06.912163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:14.913698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:09:30.917169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:10:02.922587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:06.928916 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:16:13.936768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:21.937680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:16:37.940578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:17:09.946740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:13.953173 3.000993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:23:20.960244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:28.961989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:23:44.964696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:24:16.970508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:29:45.193597 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 10:29:45.193707 0.000000 udp 10.0.2.105 7010 -> 24.159.59.243 6636 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 10:30:02.229731 0.596780 tcp 10.0.2.105 50312 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:30:02.826856 0.519183 tcp 10.0.2.105 50313 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:30:03.346007 1.144254 tcp 10.0.2.105 50314 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:30:04.490890 0.423958 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:04.915166 0.306603 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:05.222215 0.569943 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:05.792620 0.401860 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:06.194917 0.329549 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:06.524877 0.436917 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:06.962193 0.270720 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:07.233320 0.371151 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:07.604887 0.831612 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:08.436903 0.427902 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:08.865204 0.292378 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:09.157976 0.279866 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:09.438191 0.451075 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:09.889615 0.445151 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:10.335185 0.581614 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:10.917212 0.437516 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:11.355137 0.293338 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:11.648891 0.366032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:12.015327 0.412937 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:12.428682 0.397551 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:12.826653 0.279747 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:13.106820 0.455438 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:13.562670 0.704912 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:14.267995 0.319219 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:14.587613 0.428285 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:15.016455 0.363736 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:15.380581 0.376640 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:15.757623 0.385557 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 10:30:21.878562 3.001264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 10:30:28.885303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:36.887151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:52.889856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:30:53.291420 1.699468 tcp 10.0.2.105 50315 -> 128.255.183.224 9027 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/01/04 10:31:24.896354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:28.902809 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:37:35.909258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:43.911200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:37:59.914276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:38:31.920331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:35.927092 3.000506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:44:42.933449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:44:50.935254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:45:06.938040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:45:38.943691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:42.950776 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:51:49.957248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:51:57.958956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:52:13.961939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:52:45.967651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:58:49.974920 3.000593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 10:58:56.981209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:04.982737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:20.985627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 10:59:52.992093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:00:28.553740 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:00:28.554001 2.463936 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:31.018323 0.314473 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:31.333195 0.577525 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:31.911112 0.390666 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:32.302169 0.328175 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:32.630728 0.420515 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:33.051651 0.321308 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:33.373325 0.389477 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:33.763202 0.291529 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:34.055126 0.389396 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:34.444879 0.426829 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:34.872138 0.337882 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:35.210357 0.451263 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:35.661964 0.453073 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:36.115464 0.587381 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:36.703267 0.381406 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:37.085082 0.438131 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:37.523550 0.291826 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:37.815779 0.263691 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:38.079823 0.371752 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:38.451938 0.364888 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:38.817202 0.439669 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:39.257289 0.510917 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:39.768558 0.313897 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:40.082770 0.373972 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:40.457100 0.393779 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:40.851269 0.389518 udp 10.0.2.105 7010 <-> 12.30.80.194 1929 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:41.241129 0.390042 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:00:54.991976 1.688604 tcp 10.0.2.105 50316 -> 128.255.183.224 9027 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:05:56.998152 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:06:04.005674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:12.006956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:06:28.009682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:07:00.015685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:04.022419 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:13:11.029458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:19.030606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:13:35.033883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:14:07.040227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:11.045815 3.001426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:20:18.053437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:26.054597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:20:42.057872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:21:14.064148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:18.069938 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:27:25.077349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:33.078979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:27:49.082158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:28:21.087770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:30:48.580177 0.000207 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 11:30:48.580437 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 11:30:56.682450 1.633634 tcp 10.0.2.105 50317 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:31:04.846143 0.564499 tcp 10.0.2.105 50318 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:31:05.410894 0.576912 tcp 10.0.2.105 50319 -> 195.113.214.226 80 SRPA* 0 0 19 14655 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:31:05.988472 0.304964 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:06.293800 0.570798 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:06.864960 0.432951 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:07.298314 0.395004 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:07.693739 0.334008 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:08.028135 0.297807 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:08.326361 0.390544 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:08.717313 0.310392 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:09.028117 0.289573 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:09.318105 0.358462 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:09.676965 0.418860 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:10.096409 0.449069 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:10.545878 0.465685 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:11.012037 0.581491 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:11.593931 0.389096 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:11.983383 0.285414 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:12.269192 0.434855 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:12.704448 0.306741 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:13.011579 0.475896 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:13.487879 0.407713 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:13.896001 0.393688 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:14.290097 0.499105 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:14.789594 0.831173 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:15.621156 0.000000 udp 10.0.2.105 7010 -> 12.30.80.194 1929 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 11:31:33.615952 0.560357 tcp 10.0.2.105 50320 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:31:34.176613 0.608767 tcp 10.0.2.105 50321 -> 195.113.214.226 80 SRPA* 0 0 18 13326 flow=From-Botnet-V2-TCP-Established 1970/01/04 11:31:34.785876 0.432196 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:35.218456 0.403045 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:31:35.621853 0.396740 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/04 11:34:25.093799 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 11:34:32.101007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:40.102561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:34:56.105675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:35:28.111881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:32.117903 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:41:39.125391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:41:47.126594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:42:03.129678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:42:35.135806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:39.142022 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:48:46.149032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:48:54.150730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:10.153345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:49:42.160044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:55:46.166277 3.000740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 11:55:53.173290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:56:01.174726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:56:17.177506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 11:56:49.183798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:00:58.322255 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:00:58.322401 1.713307 tcp 10.0.2.105 50322 -> 128.255.183.224 9027 FSPA* 0 0 14 1579 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:01:57.326983 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:02:02.063418 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:02:16.296539 0.531504 tcp 10.0.2.105 50323 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:16.828479 0.570624 tcp 10.0.2.105 50324 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:17.399381 1.400707 tcp 10.0.2.105 50325 -> 195.113.214.226 443 SRPA* 0 0 32 23577 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:18.800821 0.000000 udp 10.0.2.105 7010 -> 12.30.80.194 1929 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:02:36.815090 0.524461 tcp 10.0.2.105 50326 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:37.339802 0.610740 tcp 10.0.2.105 50327 -> 195.113.214.226 80 SRPA* 0 0 18 13411 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:37.951158 0.613110 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:02:38.564765 0.302463 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:02:38.867630 0.000000 udp 10.0.2.105 7010 -> 62.106.17.88 6418 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:02:53.189278 3.002227 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:02:54.821127 0.574215 tcp 10.0.2.105 50328 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:55.395668 0.539738 tcp 10.0.2.105 50329 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:55.935702 1.157441 tcp 10.0.2.105 50330 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:02:57.093798 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:03:00.196898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:08.198568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:16.071231 0.571370 tcp 10.0.2.105 50331 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:16.642953 0.566640 tcp 10.0.2.105 50332 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:17.209886 1.168351 tcp 10.0.2.105 50333 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:18.378980 0.416929 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:18.796432 0.388566 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:19.185381 0.267805 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:19.453581 0.305388 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:19.759389 0.000000 udp 10.0.2.105 7010 -> 108.76.85.176 4197 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:03:24.201969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:03:38.603469 0.557715 tcp 10.0.2.105 50334 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:39.161431 0.563746 tcp 10.0.2.105 50335 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:39.725533 1.143476 tcp 10.0.2.105 50336 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:03:40.869567 0.279581 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:41.149534 0.382203 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:41.532141 0.453330 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:41.985823 0.453101 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:42.439293 0.394454 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:42.834116 0.586500 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:43.421059 0.272158 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:43.693638 0.306807 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:44.000834 0.437408 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:44.438650 0.373484 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:44.812785 0.481770 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:45.294965 0.382457 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:45.677809 0.489901 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:03:46.168073 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:03:56.207390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:04:02.798560 0.570827 tcp 10.0.2.105 50337 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:04:03.369639 0.547530 tcp 10.0.2.105 50338 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:04:03.917469 1.166749 tcp 10.0.2.105 50339 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:04:05.084997 0.415525 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:04:05.500930 0.388073 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:04:05.889343 0.375766 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:10:00.214315 3.001104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:10:07.220919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:15.222572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:10:31.225383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:11:03.231633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:07.237730 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:17:14.244994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:22.246219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:17:38.249992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:18:10.255470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:14.262522 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:24:21.269345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:29.270347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:24:45.273856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:25:17.279415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:00.043160 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:31:00.043262 1.706015 tcp 10.0.2.105 50340 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:31:21.285606 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:31:28.292980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:36.294685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:31:52.297356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:32:24.303648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:34:29.404016 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:34:29.404118 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:34:44.428182 0.553446 tcp 10.0.2.105 50341 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:34:44.981919 0.555933 tcp 10.0.2.105 50342 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:34:45.538179 1.180395 tcp 10.0.2.105 50343 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:34:46.718972 0.000000 udp 10.0.2.105 7010 -> 62.106.17.88 6418 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:35:01.931105 0.585290 tcp 10.0.2.105 50344 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:35:02.516712 0.600014 tcp 10.0.2.105 50345 -> 195.113.214.226 80 SRPA* 0 0 19 14633 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:35:03.117364 0.390000 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:03.507768 0.323532 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:03.831688 0.558917 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:04.391023 0.301904 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:04.693273 0.389478 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:05.083167 0.428862 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:05.512597 0.298381 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:05.811370 0.284337 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:06.096116 0.293492 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:06.390021 0.463217 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:06.853630 0.391903 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:07.245942 0.388411 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:07.634767 0.457049 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:08.092372 0.590184 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:08.682963 0.274305 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:08.957705 0.252291 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:09.210366 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:35:27.067290 0.572684 tcp 10.0.2.105 50346 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:35:27.640482 0.564943 tcp 10.0.2.105 50347 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:35:28.205732 1.118370 tcp 10.0.2.105 50348 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 12:35:29.324790 0.401077 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:29.726271 0.498511 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:30.225111 0.410001 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:30.635502 0.448558 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:31.084627 0.388114 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:31.473132 0.431252 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:31.904725 0.355468 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:33.582463 0.435411 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:34.018458 0.296974 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:34.315924 0.427172 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:34.743667 0.375162 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:35.119438 0.570587 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:35.690628 0.319485 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:36.010622 0.291668 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:36.302744 0.464507 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:36.767869 0.266062 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:37.034503 0.380242 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:37.415337 0.267426 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:37.683239 0.422750 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:38.106582 0.466909 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:38.574090 0.378083 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:38.952782 0.290529 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:39.243922 0.590401 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:39.834886 0.301941 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:40.137290 0.515623 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:40.653353 0.422153 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:41.075957 0.403984 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:41.480450 0.464947 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:41.946019 0.407029 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:42.353664 0.400217 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:42.754469 0.389674 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:35:43.144960 0.000000 udp 10.0.2.105 7010 -> 82.212.15.194 3336 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:35:48.467322 0.000000 udp 10.0.2.105 7010 -> 79.0.238.117 3159 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:35:53.063372 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:35:55.627418 0.000000 udp 10.0.2.105 7010 -> 82.15.144.232 1211 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:03.378615 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:12.180919 0.000000 udp 10.0.2.105 7010 -> 190.147.158.13 5480 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:17.057867 0.000166 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:36:19.912043 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:25.991247 0.000000 udp 10.0.2.105 7010 -> 78.172.127.208 3632 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:34.663477 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:41.022748 0.000000 udp 10.0.2.105 7010 -> 70.91.92.6 9893 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:45.558840 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:36:49.434965 0.000000 udp 10.0.2.105 7010 -> 85.110.109.22 2872 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:36:57.446319 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:05.317735 0.000000 udp 10.0.2.105 7010 -> 71.43.228.138 7624 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:10.063994 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:37:12.548330 0.000000 udp 10.0.2.105 7010 -> 204.249.210.29 4139 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:21.120272 0.000000 udp 10.0.2.105 7010 -> 82.104.83.211 7333 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:27.619914 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:35.331031 0.000000 udp 10.0.2.105 7010 -> 96.56.103.252 8236 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:40.067406 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:37:43.091948 0.000000 udp 10.0.2.105 7010 -> 88.233.111.131 6085 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:51.934848 0.000000 udp 10.0.2.105 7010 -> 156.34.204.61 2605 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:37:59.485563 0.000000 udp 10.0.2.105 7010 -> 203.122.228.179 4596 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:04.061908 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:38:08.047528 0.000000 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:14.166794 0.000000 udp 10.0.2.105 7010 -> 93.131.116.22 5572 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:21.697800 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 2495 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:28.056440 0.303281 udp 10.0.2.105 7010 -> 213.200.17.114 1841 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:28.310341 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:38:28.359721 0.000000 icmp 213.200.17.114 0x0303 -> 10.0.2.105 0x3107 URP 192 1 262 flow=Background 1970/01/04 12:38:32.562580 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:38:35.316619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:36.448880 0.000000 udp 10.0.2.105 7010 -> 109.65.132.188 7298 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:43.318453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:44.509910 0.000000 udp 10.0.2.105 7010 -> 82.46.174.17 3849 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:52.441488 0.000000 udp 10.0.2.105 7010 -> 69.77.213.45 2473 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:38:57.058253 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:38:59.321222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:38:59.491721 0.425313 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:38:59.932751 0.000000 udp 10.0.2.105 7010 -> 88.254.119.230 9475 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:05.160339 0.000000 udp 10.0.2.105 7010 -> 99.229.152.200 5191 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:13.231606 0.000000 udp 10.0.2.105 7010 -> 184.90.232.87 3223 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:21.794192 0.000000 udp 10.0.2.105 7010 -> 88.244.168.5 6778 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:26.560522 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:39:29.465199 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:31.327645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:39:35.463717 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:41.111458 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:48.712935 0.000000 udp 10.0.2.105 7010 -> 74.42.39.166 6016 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:39:53.559565 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:39:56.263299 0.000000 udp 10.0.2.105 7010 -> 83.242.29.125 6165 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:05.176004 0.000000 udp 10.0.2.105 7010 -> 203.172.213.113 1369 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:11.335109 0.000000 udp 10.0.2.105 7010 -> 190.100.23.138 5273 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:18.355563 0.000000 udp 10.0.2.105 7010 -> 50.197.41.162 7510 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:23.061897 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:40:27.298240 0.000000 udp 10.0.2.105 7010 -> 78.150.173.183 9941 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:33.196509 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:41.348045 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:47.687342 0.000000 udp 10.0.2.105 7010 -> 94.67.15.197 2026 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:40:52.564438 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:40:55.188580 0.000000 udp 10.0.2.105 7010 -> 207.150.245.254 5351 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:02.108159 0.000000 udp 10.0.2.105 7010 -> 68.109.121.12 2079 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:10.450462 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:15.958381 0.605160 udp 10.0.2.105 7010 -> 113.165.249.0 1783 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:16.563541 0.000000 icmp 113.165.249.0 0x0303 -> 10.0.2.105 0xf706 URP 192 1 270 flow=Background 1970/01/04 12:41:20.564179 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:41:21.015109 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:26.523466 0.000000 udp 10.0.2.105 7010 -> 151.66.161.176 2261 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:31.801050 0.000000 udp 10.0.2.105 7010 -> 91.56.59.128 5125 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:37.159127 0.000000 udp 10.0.2.105 7010 -> 82.234.161.92 3615 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:45.820948 0.000000 udp 10.0.2.105 7010 -> 69.246.129.53 4542 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:41:50.567809 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:41:52.500345 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:00.502064 0.000000 udp 10.0.2.105 7010 -> 72.54.121.49 5345 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:08.223018 0.000000 udp 10.0.2.105 7010 -> 95.252.113.58 5139 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:13.530520 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:18.067075 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:42:21.652931 0.000000 udp 10.0.2.105 7010 -> 95.13.28.253 5542 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:28.762461 0.000000 udp 10.0.2.105 7010 -> 135.196.47.168 3660 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:36.373602 0.000000 udp 10.0.2.105 7010 -> 31.150.128.125 1850 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:42.882686 0.459738 udp 10.0.2.105 7010 -> 168.167.98.214 3409 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:43.342424 0.000000 icmp 168.167.98.214 0x0303 -> 10.0.2.105 0x510d URP 192 1 319 flow=Background 1970/01/04 12:42:47.559876 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:42:50.123545 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:42:58.134929 0.000000 udp 10.0.2.105 7010 -> 24.227.212.242 5764 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:07.027453 0.000000 udp 10.0.2.105 7010 -> 89.173.17.6 7753 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:11.564215 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:43:15.539766 0.000000 udp 10.0.2.105 7010 -> 189.220.245.145 4865 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:21.739529 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:29.130007 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:35.217975 0.000000 udp 10.0.2.105 7010 -> 94.141.208.225 1616 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:40.065386 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:43:40.926256 0.287292 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:43:41.509156 0.000000 udp 10.0.2.105 7010 -> 50.79.148.169 7735 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:49.959643 0.000000 udp 10.0.2.105 7010 -> 98.229.32.106 6124 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:43:55.847913 0.000000 udp 10.0.2.105 7010 -> 37.32.244.84 3604 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:01.696563 0.000000 udp 10.0.2.105 7010 -> 98.251.246.205 5294 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:06.562985 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:44:07.104019 0.000000 udp 10.0.2.105 7010 -> 99.118.244.90 1117 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:12.601818 0.000000 udp 10.0.2.105 7010 -> 187.162.186.31 8590 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:18.500331 0.000000 udp 10.0.2.105 7010 -> 201.140.182.9 3997 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:24.329078 0.000000 udp 10.0.2.105 7010 -> 86.98.80.71 7084 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:31.228872 0.000000 udp 10.0.2.105 7010 -> 78.6.121.163 1040 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:36.065819 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:44:38.979871 0.000000 udp 10.0.2.105 7010 -> 87.16.12.143 3217 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:45.339385 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:50.586658 0.000000 udp 10.0.2.105 7010 -> 86.166.130.90 8335 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:44:56.515322 0.000000 udp 10.0.2.105 7010 -> 99.100.164.78 5830 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:01.061268 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:45:03.264958 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:09.263577 0.000000 udp 10.0.2.105 7010 -> 151.74.150.139 6068 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:17.324797 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:24.384989 0.000000 udp 10.0.2.105 7010 -> 95.236.42.177 1598 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:29.061401 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:45:32.417069 0.000000 udp 10.0.2.105 7010 -> 180.250.77.50 5951 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:35.334276 3.000956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:45:38.495305 0.000000 udp 10.0.2.105 7010 -> 69.199.230.26 4689 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:42.341027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:43.622889 0.000000 udp 10.0.2.105 7010 -> 172.0.17.119 5301 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:50.342518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:45:52.195502 0.379167 udp 10.0.2.105 7010 -> 86.97.187.134 1170 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:45:52.574669 0.000000 icmp 86.97.187.134 0x0303 -> 10.0.2.105 0x9204 URP 192 1 116 flow=Background 1970/01/04 12:45:57.061644 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:45:58.564457 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:06.095533 0.000000 udp 10.0.2.105 7010 -> 94.199.27.108 8764 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:06.345088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:46:14.557640 0.000000 udp 10.0.2.105 7010 -> 69.15.41.105 7910 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:23.380508 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:28.066238 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:46:29.539116 0.000000 udp 10.0.2.105 7010 -> 71.110.193.48 1196 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:35.427579 0.000000 udp 10.0.2.105 7010 -> 88.234.68.237 1026 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:38.351096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:46:43.579408 0.000000 udp 10.0.2.105 7010 -> 108.69.101.226 6920 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:52.221775 0.000000 udp 10.0.2.105 7010 -> 64.164.240.14 5817 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:46:57.058111 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:46:57.308799 0.000000 udp 10.0.2.105 7010 -> 176.58.204.174 5140 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:05.820966 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:11.348907 0.000000 udp 10.0.2.105 7010 -> 96.44.41.133 1097 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:17.527815 0.339944 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:47:18.023359 0.000000 udp 10.0.2.105 7010 -> 71.6.87.93 4850 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:22.064044 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:47:24.147498 0.000000 udp 10.0.2.105 7010 -> 5.97.91.130 2286 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:30.516407 0.000000 udp 10.0.2.105 7010 -> 84.94.106.203 8891 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:36.424808 0.000000 udp 10.0.2.105 7010 -> 86.212.57.201 2148 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:42.463951 0.579741 udp 10.0.2.105 7010 -> 110.77.148.196 5636 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:43.043692 0.000000 icmp 110.77.148.196 0x0303 -> 10.0.2.105 0x0416 URP 192 1 172 flow=Background 1970/01/04 12:47:47.060141 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:47:51.426395 0.000000 udp 10.0.2.105 7010 -> 190.8.255.111 3156 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:47:58.727029 0.441766 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:47:59.177826 0.000000 udp 10.0.2.105 7010 -> 84.58.185.12 2044 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:05.947471 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:14.850153 0.294455 udp 10.0.2.105 7010 -> 84.173.71.202 7912 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:15.144608 0.000000 icmp 84.173.71.202 0x0303 -> 10.0.2.105 0xe81e URP 192 1 326 flow=Background 1970/01/04 12:48:19.566827 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:48:22.150683 0.000000 udp 10.0.2.105 7010 -> 189.59.33.228 1244 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:30.493000 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:37.001983 0.000000 udp 10.0.2.105 7010 -> 79.16.20.54 7537 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:45.354114 0.000000 udp 10.0.2.105 7010 -> 173.56.69.35 2860 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:50.060492 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:48:51.172533 0.266009 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:48:51.449677 0.461252 udp 10.0.2.105 7010 <-> 69.156.3.7 8477 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:48:51.947062 0.000000 udp 10.0.2.105 7010 -> 181.210.61.155 9580 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:48:59.424093 0.473075 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:48:59.928037 0.513388 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:49:00.466566 0.000000 udp 10.0.2.105 7010 -> 79.37.68.231 8996 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:49:06.955276 0.000000 udp 10.0.2.105 7010 -> 79.26.35.249 6578 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:49:12.904062 0.000000 udp 10.0.2.105 7010 -> 96.254.50.171 5871 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:49:17.560345 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 12:49:21.265706 0.000000 udp 10.0.2.105 7010 -> 208.113.35.44 8685 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 12:49:28.335925 0.320122 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:49:28.676522 0.397911 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/04 12:52:42.357499 3.001383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 12:52:49.364693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:52:57.366004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:53:13.369224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:53:45.375593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 12:59:49.380951 3.002088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 12:59:56.388996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:04.390189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:20.393164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:00:52.399600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:01:01.753364 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:01:01.753455 1.740949 tcp 10.0.2.105 50349 -> 128.255.183.224 9027 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:06:56.405609 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:07:03.412752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:11.414547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:27.417527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:07:59.423238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:03.430627 3.000243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:14:10.436847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:18.438420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:14:34.441589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:15:06.447631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:19:41.473321 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:19:41.473478 0.426450 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:19:41.900342 0.406041 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:19:42.306778 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 13:19:59.270993 0.562948 tcp 10.0.2.105 50350 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:19:59.834210 0.611604 tcp 10.0.2.105 50351 -> 195.113.214.226 80 SRPA* 0 0 18 13348 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:20:00.446307 0.417578 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:00.864309 0.325973 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:01.190629 0.556659 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:01.747659 0.305842 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:02.053908 0.428882 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:02.483252 0.317762 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:02.801338 0.462093 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:03.263813 0.387102 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:03.651382 0.284408 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:03.936147 0.456727 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:04.393253 0.385470 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:04.779122 0.286562 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:05.066049 0.269268 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:05.335717 0.543627 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:05.879704 0.419113 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:06.299189 0.499146 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:06.798711 0.469360 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:07.268445 0.388896 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:07.657742 0.392550 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:08.050716 0.385323 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 590 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:08.436414 0.417144 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:08.853999 0.403032 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:09.257435 0.314690 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:09.572555 0.340524 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:09.913552 0.435865 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:10.349783 0.292706 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:10.642889 0.000000 udp 10.0.2.105 7010 -> 69.156.3.7 8477 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 13:20:28.181578 0.582766 tcp 10.0.2.105 50352 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:20:28.764734 0.585824 tcp 10.0.2.105 50353 -> 195.113.214.226 80 SRPA* 0 0 20 14753 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:20:29.351076 0.444424 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:29.795904 0.417842 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:30.214154 0.300762 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:20:30.515321 0.394364 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:21:10.453409 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:21:17.461017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:25.462276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:21:41.465041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:22:13.471464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:17.478006 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:28:24.484523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:32.486182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:28:48.489151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:29:20.495149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:31:03.493776 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:31:03.493883 1.705792 tcp 10.0.2.105 50354 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:35:24.501524 3.001632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:35:31.508349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:39.509982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:35:55.513120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:36:28.701174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:37.714910 3.000584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:42:44.721655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:42:52.722798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:43:08.726074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:43:40.732093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:44.738775 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 13:49:51.745220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:49:59.747133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:50:15.750184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:50:34.978549 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 13:50:34.978650 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 13:50:47.756000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:50:53.066626 0.551460 tcp 10.0.2.105 50355 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:50:53.618369 0.552317 tcp 10.0.2.105 50356 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:50:54.170990 1.320537 tcp 10.0.2.105 50357 -> 195.113.214.226 443 SRPA* 0 0 36 27221 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:50:55.492103 0.000000 udp 10.0.2.105 7010 -> 69.156.3.7 8477 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 13:51:14.435813 0.568554 tcp 10.0.2.105 50358 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:15.004656 0.588692 tcp 10.0.2.105 50359 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:15.593628 1.316062 tcp 10.0.2.105 50360 -> 195.113.214.226 443 SRPA* 0 0 35 25081 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:16.910271 0.419376 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:17.330042 0.379119 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:17.709546 0.412891 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:18.122817 0.295940 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:18.419123 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 13:51:37.418888 0.557178 tcp 10.0.2.105 50361 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:37.976387 0.567540 tcp 10.0.2.105 50362 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:38.544180 1.325461 tcp 10.0.2.105 50363 -> 195.113.214.226 443 SRPA* 0 0 37 27027 flow=From-Botnet-V2-TCP-Established 1970/01/04 13:51:39.870205 0.315722 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:40.186301 0.446282 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:40.632945 0.273529 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:40.906873 0.427734 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:41.334946 0.388483 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:41.723758 0.281988 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:42.006116 0.421967 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:42.428486 0.355132 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:42.783964 0.289931 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:43.074296 0.614218 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:43.688931 0.297554 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:43.986874 0.494020 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:44.481302 0.399131 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:44.880817 0.456515 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:45.337741 0.390214 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:45.728288 0.384218 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:46.112888 0.390295 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:46.503545 0.487072 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:46.991030 0.422261 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:47.413716 0.310443 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:47.724596 0.346956 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:48.071909 0.422585 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:48.494823 0.280442 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:48.775659 0.436621 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:49.212619 0.399555 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:49.612713 0.305734 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:51:49.918801 0.389627 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/04 13:57:15.767466 3.001038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 13:57:22.774187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:57:30.775703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:57:46.778169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 13:58:18.784789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:01:05.785206 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:01:05.785309 1.649037 tcp 10.0.2.105 50364 -> 128.255.183.224 9027 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:04:22.790997 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:04:29.798038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:37.799317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:04:53.802571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:05:25.808554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:34.821590 3.002539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:11:41.828732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:11:49.830245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:12:05.833387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:12:37.839292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:18:45.850922 3.002043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:18:52.858857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:19:00.860316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:19:16.863115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:19:48.869713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:22:03.202825 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:22:03.202935 0.562539 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:03.765830 0.418044 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:04.184256 0.381212 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:04.565846 0.420604 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:04.986854 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 14:22:20.389671 0.546087 tcp 10.0.2.105 50365 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:22:20.936033 0.592047 tcp 10.0.2.105 50366 -> 195.113.214.226 80 SRPA* 0 0 19 14652 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:22:21.528792 0.307932 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:21.837129 0.464561 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:22.302113 0.277084 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:22.579596 0.438588 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:23.018575 0.375230 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:23.394158 0.261438 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:23.655988 0.431814 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:24.088193 0.380978 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:24.469534 0.291042 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:24.760992 0.594560 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:25.355975 0.278006 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:25.634332 0.513109 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:26.147799 0.575074 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:26.723230 0.453479 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:27.177048 0.386890 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:27.564361 0.395746 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:27.960511 0.384195 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:28.345117 0.400148 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:28.745667 0.413946 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:29.160041 0.297370 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:29.457798 0.335810 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:29.793966 0.432233 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:30.226591 0.279538 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:30.506504 0.302418 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:30.809280 0.616667 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:31.426344 0.442888 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:22:31.869631 0.382558 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:25:52.875768 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:25:59.882941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:26:07.883970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:26:23.887543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:26:55.893211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:31:07.436064 0.000194 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:31:07.436365 1.747812 tcp 10.0.2.105 50367 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:32:59.900197 3.000574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:33:06.906821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:33:14.908700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:33:30.911540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:34:02.916954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:40:06.923299 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:40:13.930774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:40:21.932068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:40:37.935443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:41:09.941619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:47:13.947209 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 14:47:20.954314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:47:28.956479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:47:44.959122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:48:16.965467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:52:37.259785 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 14:52:37.259984 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 14:52:52.643372 0.573833 tcp 10.0.2.105 50368 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:52:53.217495 0.564605 tcp 10.0.2.105 50369 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:52:53.782362 1.394080 tcp 10.0.2.105 50370 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:52:55.177136 0.560592 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:55.738129 0.418883 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:56.157412 0.393109 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:56.550865 0.429030 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:56.980463 0.315954 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:57.296775 0.461452 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:57.758626 0.287783 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:58.046820 0.425620 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:58.472903 0.413653 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:58.886913 0.402052 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:59.289391 0.288755 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:59.578562 0.359267 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:52:59.938358 0.283540 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:00.222305 0.571876 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:00.794569 0.283383 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:01.078357 0.499972 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:01.578685 0.398816 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:01.977871 0.447473 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:02.425706 0.390942 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:02.817023 0.397127 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:03.214559 0.424396 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:03.639358 0.373930 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:04.013678 0.414252 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:04.428394 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 14:53:20.382501 0.553738 tcp 10.0.2.105 50371 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:53:20.936515 0.570546 tcp 10.0.2.105 50372 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:53:21.507454 1.122205 tcp 10.0.2.105 50373 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/04 14:53:22.630386 0.353037 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:22.983815 0.441098 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:23.425296 0.289944 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:23.715647 0.290659 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:24.006706 0.433137 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:24.440255 0.426011 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:53:24.866648 0.389455 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/04 14:54:20.971375 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 14:54:27.978577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:54:35.980570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:54:51.983397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 14:55:23.989027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:09.186336 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:01:09.186453 1.731251 tcp 10.0.2.105 50374 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:01:27.997927 2.998787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:01:35.002479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:43.004054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:01:59.007482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:02:31.012903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:35.018657 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:08:42.026538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:08:50.028107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:09:06.031111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:09:38.037447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:42.043796 3.000724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:15:49.050310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:15:57.051744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:16:13.055100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:16:45.061416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:22:49.067331 3.001369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:22:56.074406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:23:04.075760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:23:20.078674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:23:35.941995 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:23:35.942137 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 15:23:51.747062 0.569754 tcp 10.0.2.105 50375 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:23:52.085527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:23:52.317086 0.576043 tcp 10.0.2.105 50376 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:23:52.893492 1.153458 tcp 10.0.2.105 50377 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:23:54.047746 0.562636 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:54.610748 0.429280 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:55.040422 0.481255 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:55.522050 0.394401 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:55.916840 0.340007 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:56.257196 0.470200 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:56.727844 0.310451 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:57.038619 0.416318 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:57.455291 0.424019 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:57.879658 0.391750 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:58.271808 0.300138 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:58.572355 0.383983 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:58.956737 0.281496 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:59.238616 0.272494 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:23:59.511476 0.592601 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:00.104487 0.510934 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:00.615845 0.408611 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:01.024814 0.441768 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:01.466971 0.398074 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:01.865447 0.403041 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:02.268859 0.425131 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:02.694387 0.373112 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:03.067840 0.411736 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:03.479991 0.343424 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:03.823799 0.302311 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:04.126516 0.442655 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:04.569585 0.285098 udp 10.0.2.105 7010 <-> 81.174.49.37 6943 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:04.855021 0.419168 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:05.274616 0.439190 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:24:05.714211 0.393067 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:29:56.090709 3.002034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:30:03.098300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:30:11.100033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:30:27.102816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:30:59.109182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:31:10.916523 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:31:10.916716 1.676815 tcp 10.0.2.105 50378 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:37:03.115631 3.001296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:37:10.122743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:37:18.123764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:37:34.127006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:38:06.133084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:44:10.139189 3.001117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:44:17.146627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:44:25.148115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:44:41.150794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:45:13.156872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:51:17.163138 3.001381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 15:51:24.170665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:51:32.172044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:51:48.174818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:52:20.180892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:54:25.010630 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 15:54:25.010825 0.550464 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:25.561701 0.424415 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:25.986522 0.469651 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:26.456612 0.386166 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:26.843134 0.323927 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:27.167540 0.272653 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:27.440869 0.475510 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:27.916790 0.430514 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:28.347674 0.419484 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:28.767556 0.497821 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:29.265770 0.261769 udp 10.0.2.105 7010 <-> 95.89.179.37 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:29.527955 0.395948 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:29.924241 0.291478 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:30.216121 0.291890 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:30.508603 0.586873 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:31.095859 0.517212 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:31.613465 0.403627 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:32.017488 0.459918 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:32.477776 0.394755 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:32.872927 0.390297 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:33.263666 0.429927 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:33.693984 0.416775 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:34.111169 0.421823 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:34.533419 0.333670 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:34.867555 0.297075 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:35.165070 0.434816 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:35.600406 0.000000 udp 10.0.2.105 7010 -> 81.174.49.37 6943 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 15:54:52.553155 0.586702 tcp 10.0.2.105 50379 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:54:53.140119 0.569869 tcp 10.0.2.105 50380 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:54:53.710269 1.132307 tcp 10.0.2.105 50381 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 15:54:54.843373 0.378251 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:55.221972 0.449415 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:54:55.671738 0.504312 udp 10.0.2.105 7010 <-> 50.65.76.70 1024 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 15:58:24.187004 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 15:58:31.194618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:58:39.196153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:58:55.198645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 15:59:27.204750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:01:12.596861 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:01:12.596989 1.690428 tcp 10.0.2.105 50382 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:05:31.210258 3.002532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:05:38.218209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:05:46.219805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:06:02.222961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:06:34.228874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:38.235367 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:12:45.242597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:12:53.244006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:13:09.246625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:13:41.252932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:19:45.259666 3.000602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:19:52.266051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:20:00.267954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:20:16.270902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:20:48.276698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:25:26.096392 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:25:26.096488 0.000000 udp 10.0.2.105 7010 -> 81.174.49.37 6943 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:25:44.144514 0.569437 tcp 10.0.2.105 50383 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:25:44.714255 0.581862 tcp 10.0.2.105 50384 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:25:45.296488 1.134535 tcp 10.0.2.105 50385 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:25:46.431709 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:26:04.212127 0.574861 tcp 10.0.2.105 50386 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:04.787238 0.584574 tcp 10.0.2.105 50387 -> 195.113.214.226 80 SRPA* 0 0 18 13324 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:05.372643 0.423832 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:05.796875 0.413583 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:06.210848 0.395001 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:06.606365 0.307763 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:06.914548 0.467306 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:07.382248 0.485867 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:07.868527 0.443967 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:08.312866 0.430640 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:08.743936 0.392837 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:09.137184 0.290212 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:09.427791 0.660845 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:10.089047 0.000000 udp 10.0.2.105 7010 -> 95.89.179.37 6418 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:26:25.622483 0.565293 tcp 10.0.2.105 50388 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:26.188043 0.565680 tcp 10.0.2.105 50389 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:26.754051 1.150832 tcp 10.0.2.105 50390 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:27.905668 0.582939 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:28.488986 0.292012 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:28.781405 0.500940 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:29.283686 0.547849 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:29.831953 0.387818 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:30.220176 0.463369 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:30.683911 0.396094 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:31.080442 0.395109 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:31.475978 0.421341 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:31.897677 0.297049 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:32.195131 0.350374 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:32.545922 0.402513 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:32.948808 0.441504 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:33.390673 0.399364 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:26:33.790383 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:26:49.717984 0.550761 tcp 10.0.2.105 50391 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:50.269083 0.590845 tcp 10.0.2.105 50392 -> 195.113.214.226 80 SRPA* 0 0 20 14705 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:26:50.860703 0.000000 udp 10.0.2.105 7010 -> 50.65.76.70 1024 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:26:52.283373 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 16:26:59.289908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:27:06.982388 0.578792 tcp 10.0.2.105 50393 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:27:07.291628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:27:07.561495 0.576664 tcp 10.0.2.105 50394 -> 195.113.214.226 80 SRPA* 0 0 18 13384 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:27:23.294593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:27:55.300683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:31:14.287324 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:31:14.287427 1.698419 tcp 10.0.2.105 50395 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:33:59.306561 3.002492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:34:06.314626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:34:14.316146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:34:30.319036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:35:02.324375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:41:06.331227 3.000999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:41:13.338372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:41:21.339422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:41:37.342481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:42:09.348512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:48:13.354655 3.001539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:48:20.362114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:48:28.363502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:48:44.366814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:49:16.373129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:55:20.377890 3.002299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 16:55:27.386084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:55:35.387350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:55:51.390485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:56:23.396469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 16:57:33.477529 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 16:57:33.477728 0.554871 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:57:34.032998 0.000000 udp 10.0.2.105 7010 -> 95.89.179.37 6418 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:57:52.857448 0.562654 tcp 10.0.2.105 50396 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:57:53.420417 0.553210 tcp 10.0.2.105 50397 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:57:53.973973 1.130417 tcp 10.0.2.105 50398 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:57:55.105059 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:58:10.221427 0.578406 tcp 10.0.2.105 50399 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:58:10.800199 0.531103 tcp 10.0.2.105 50400 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:58:11.331595 1.141975 tcp 10.0.2.105 50401 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:58:12.473346 0.000000 udp 10.0.2.105 7010 -> 50.65.76.70 1024 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 16:58:29.960149 0.558375 tcp 10.0.2.105 50402 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:58:30.518815 0.557225 tcp 10.0.2.105 50403 -> 195.113.214.226 80 SRPA* 0 0 20 14722 flow=From-Botnet-V2-TCP-Established 1970/01/04 16:58:31.076925 0.445547 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:31.522887 0.417219 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:31.940522 0.384858 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:32.325789 0.318975 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:32.645119 0.312911 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:32.958450 0.512108 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:33.471021 0.380524 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:33.851904 0.421272 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:34.273536 0.430509 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:34.704414 0.293026 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:34.997815 0.389702 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:35.387878 0.279741 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:35.668029 0.595547 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:36.263995 0.501529 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:36.765927 0.413806 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:37.180062 0.382707 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:37.563144 0.454324 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:38.017883 0.387440 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:38.405777 0.308280 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:38.714382 0.392965 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:39.107873 0.404997 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:39.513268 0.340591 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:39.854264 0.411681 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:40.266429 0.404165 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 16:58:40.670941 0.443061 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:01:15.987635 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:01:15.987726 1.718345 tcp 10.0.2.105 50404 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:02:27.402697 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:02:34.409912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:42.411773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:02:58.414497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:03:30.420484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:34.427211 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:09:41.433945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:09:49.435801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:10:05.438263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:10:37.444565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:41.450099 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:16:48.457624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:16:56.459587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:17:12.462715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:17:44.468286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:23:48.475265 3.000685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:23:55.482393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:24:03.483585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:24:19.486219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:24:51.492737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:28:55.203543 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:28:55.203781 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 17:29:12.941544 0.573406 tcp 10.0.2.105 50405 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:29:13.515296 0.563374 tcp 10.0.2.105 50406 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:29:14.079003 1.136688 tcp 10.0.2.105 50407 -> 195.113.214.226 443 SRPA* 0 0 24 13848 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:29:15.216243 0.423018 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:15.639596 0.435105 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:16.075119 0.280352 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:16.355836 0.393301 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:16.749548 0.307199 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:17.057165 0.469533 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:17.527103 0.369516 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:17.897028 0.300385 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:18.197812 0.434735 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:18.632902 0.427060 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:19.060465 0.844120 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:19.905000 0.306834 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:20.212394 0.583243 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:20.796042 0.501424 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:21.297836 0.373287 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:21.671529 0.367410 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:22.039341 0.460194 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:22.499916 0.417803 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:22.918138 0.391071 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:23.309634 0.294766 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:23.604804 0.400323 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:24.005545 0.350383 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:24.356263 0.942361 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:25.298953 0.416953 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:29:25.716255 0.372291 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:30:55.498298 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 17:31:02.505566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:31:10.507067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:31:17.708288 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:31:17.708394 1.664917 tcp 10.0.2.105 50408 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/04 17:31:26.510233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:31:58.516159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:38:02.522789 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:38:09.530052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:38:17.531549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:38:33.534447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:39:05.540321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:45:09.547059 3.000653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:45:16.553552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:45:24.555071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:45:40.558145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:46:12.564137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:52:16.570834 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:52:23.577770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:52:31.579251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:52:47.582503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:53:19.588157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:23.594001 3.002179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 17:59:30.601940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:38.603291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:45.173011 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 17:59:45.173116 0.569266 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:45.742776 0.423144 udp 10.0.2.105 7010 <-> 98.95.183.150 5323 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:46.166319 0.434962 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:46.601669 0.312929 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:46.915039 0.269494 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:47.184929 0.378490 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:47.563817 0.457541 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:48.021767 0.379094 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:48.401198 0.285818 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:48.687403 0.423866 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:49.111631 0.428510 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:49.540642 0.409148 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:49.950132 0.286860 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:50.237430 0.580482 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:50.818331 0.399068 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:51.217814 0.500880 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:51.719002 0.395720 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:52.115048 0.474882 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:52.791047 0.429251 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:53.220701 0.396297 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:53.617414 0.298431 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:53.916229 0.386622 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:54.303234 0.341606 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:54.606360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 17:59:54.645247 0.393514 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:55.039140 0.434751 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/04 17:59:55.474252 0.421521 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:00:26.612910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:01:19.378618 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:01:19.378820 1.678097 tcp 10.0.2.105 50409 -> 128.255.183.224 9027 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:06:30.619772 3.000402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:06:37.625989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:06:45.627140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:07:01.629963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:07:33.636047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:37.642309 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:13:44.649398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:13:52.650916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:14:08.653911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:14:40.660036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:44.666799 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:20:51.673721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:20:59.675283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:21:15.678130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:21:47.683821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:27:51.691207 3.000409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:27:58.697666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:28:06.699485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:28:22.702305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:28:54.708061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:30:15.504370 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 18:30:15.504597 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 18:30:32.290460 0.564139 tcp 10.0.2.105 50410 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:32.854942 0.560078 tcp 10.0.2.105 50411 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:33.415275 1.132202 tcp 10.0.2.105 50412 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:34.546608 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 18:30:52.899042 0.572335 tcp 10.0.2.105 50413 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:53.471671 0.559504 tcp 10.0.2.105 50414 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:54.031436 1.121200 tcp 10.0.2.105 50415 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:30:55.153360 0.262610 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:55.416414 0.426381 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:55.843216 0.299021 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:56.142684 0.373075 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:56.516188 0.450729 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:56.967255 0.430872 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:57.398546 0.368635 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:57.767620 0.299632 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:58.067662 0.287058 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:58.355172 0.429768 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:58.785352 0.389590 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:59.175344 0.579219 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:30:59.754912 0.394745 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:00.150063 0.510116 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:00.660628 0.400857 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:01.061880 0.461399 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:01.523663 0.432097 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:01.956179 0.393500 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:02.350029 0.304759 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:02.655211 0.416701 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:03.072366 0.387689 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:03.460564 0.351755 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:03.812772 0.419131 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:04.232355 0.412122 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/04 18:31:21.069097 1.719507 tcp 10.0.2.105 50416 -> 128.255.183.224 9027 FSPA* 0 0 12 1597 flow=From-Botnet-V2-TCP-Established 1970/01/04 18:34:58.754172 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 18:35:05.761477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:35:13.763086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:35:29.766349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:36:01.772370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:42:05.778599 3.000969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:42:12.785962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:42:20.786886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:42:36.789974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:43:08.795955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:49:12.802481 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:49:19.809724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:49:27.811354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:49:43.813969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:50:15.820505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:56:19.826859 3.000833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 18:56:26.833407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:56:34.835192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:56:50.837775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 18:57:22.843845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:01:20.115354 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:01:20.115545 0.565888 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:20.681858 0.000000 udp 10.0.2.105 7010 -> 98.95.183.150 5323 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 19:01:22.789714 1.714610 tcp 10.0.2.105 50417 -> 128.255.183.224 9027 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:01:37.392297 0.544998 tcp 10.0.2.105 50418 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:01:37.937572 0.567854 tcp 10.0.2.105 50419 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:01:38.505714 1.099446 tcp 10.0.2.105 50420 -> 195.113.214.226 443 SRPA* 0 0 22 13128 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:01:39.605913 0.309814 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:39.916191 0.267300 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:40.183908 0.433227 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:40.617489 0.389349 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:41.007214 0.467236 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:41.474862 0.386932 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:41.862133 0.428752 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:42.291286 0.376252 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:42.667940 0.396065 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:43.064422 0.284283 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:43.349118 0.427426 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:43.776954 0.592898 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:44.370229 0.390732 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:44.761365 0.504604 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:45.266400 0.398768 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:45.665571 0.458173 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:46.124110 0.390225 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:46.514695 0.391555 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:46.906661 0.305089 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:47.212143 0.394896 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:47.607370 0.437589 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:48.045334 0.396627 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:48.442375 0.352578 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:01:48.795322 0.414828 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:03:26.850832 3.000818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:03:33.857455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:41.858870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:03:57.861865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:04:29.867927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:33.874361 3.001198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:10:40.881101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:10:48.882720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:11:04.886105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:11:36.892174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:40.898102 3.001425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:17:47.905243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:17:55.906805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:18:11.909976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:18:43.915718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:24:47.922975 3.000525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:24:54.929238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:25:02.931182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:25:18.933617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:25:50.940207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:31:24.510424 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:31:24.510686 1.766546 tcp 10.0.2.105 50421 -> 128.255.183.224 9027 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/04 19:31:54.945823 3.001793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:32:01.952992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:32:09.954656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:32:19.188695 0.563025 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:19.752088 0.309898 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:20.062396 0.263412 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:20.326210 0.417878 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:20.744472 0.404882 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:21.149758 0.476106 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:21.626281 0.293988 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:21.920709 0.394877 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:22.315990 0.422495 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:22.738899 0.398432 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:23.137757 0.297512 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:23.435623 0.422766 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:23.858758 0.580593 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:24.145151 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 19:32:24.439757 0.383252 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:24.823384 0.457338 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:25.281129 0.509075 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:25.790624 0.493516 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:25.958251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:32:26.284616 0.419180 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:26.704166 0.405025 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:27.109591 0.298626 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:27.408610 0.411966 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:27.820990 0.435666 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:28.257044 0.416730 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:28.674226 0.390829 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:29.065411 0.333472 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/04 19:32:57.963857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:39:01.970498 3.000914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:39:08.977657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:39:16.978862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:39:32.982191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:40:04.987931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:46:08.994391 3.000997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:46:16.001377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:46:24.003112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:46:40.005756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:47:12.011911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:53:16.018013 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 19:53:23.025324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:53:31.026530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:53:47.030115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 19:54:19.035840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:23.042466 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:00:30.048855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:38.050366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:00:54.053869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:01:26.059935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:01:26.280717 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:01:26.280831 1.698556 tcp 10.0.2.105 50422 -> 128.255.183.224 9027 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:02:54.076517 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:02:54.076624 0.565151 udp 10.0.2.105 7010 <-> 117.223.132.133 9127 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:54.642100 0.307905 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:54.950426 0.394185 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:55.344964 0.276433 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:55.621801 0.426936 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:56.049105 0.456831 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:56.506339 0.285395 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:56.792099 0.365443 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:57.157922 0.384571 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:57.542912 0.424910 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:57.968161 0.297057 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:58.265591 0.429489 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:58.695444 0.591565 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:59.287426 0.390899 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:02:59.678730 0.467312 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:00.146427 0.493923 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:00.640749 0.388544 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:01.029686 0.405292 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:01.435334 0.418182 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:01.853903 0.318239 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:02.172526 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:03:19.064801 0.554683 tcp 10.0.2.105 50423 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:03:19.619773 0.537702 tcp 10.0.2.105 50424 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:03:20.157734 1.124479 tcp 10.0.2.105 50425 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:03:21.282973 0.365303 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:21.648667 0.425106 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:22.074272 0.418890 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:03:22.493546 0.343570 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:07:30.066139 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:07:37.073578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:07:45.074634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:08:01.077901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:08:33.083681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:37.090308 3.001102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:14:44.096916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:14:52.098802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:15:08.101906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:15:40.107784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:21:44.113829 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:21:51.120762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:21:59.122662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:22:15.125659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:22:47.131949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:28:51.137873 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:28:58.145451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:29:06.146542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:29:22.149526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:29:54.155853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:31:27.980820 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:31:27.981012 1.765023 tcp 10.0.2.105 50426 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:33:32.960283 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:33:32.960478 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:33:51.709709 0.563052 tcp 10.0.2.105 50427 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:33:52.273060 0.573085 tcp 10.0.2.105 50428 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:33:52.846425 1.117263 tcp 10.0.2.105 50429 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:33:53.964418 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:34:12.388386 0.576126 tcp 10.0.2.105 50430 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:34:12.964791 0.609897 tcp 10.0.2.105 50431 -> 195.113.214.226 80 SRPA* 0 0 20 14745 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:34:13.575316 0.308703 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:13.884397 0.426205 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:14.310989 0.389647 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:14.701044 0.282358 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:14.983777 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:34:31.495715 0.588547 tcp 10.0.2.105 50432 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:34:32.084592 0.565270 tcp 10.0.2.105 50433 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:34:32.650102 1.120080 tcp 10.0.2.105 50434 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 20:34:33.770746 0.455250 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:34.226386 0.380518 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:34.607320 0.390026 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:34.997729 0.408111 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:35.406266 0.446533 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:35.853162 0.279283 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:36.132816 0.379099 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:36.512307 0.575341 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:37.088000 0.469347 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:37.557725 0.508294 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:38.066395 0.383037 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:38.449810 0.300893 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:38.751117 0.408443 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:39.159955 0.416907 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:39.577249 0.383600 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:39.961232 0.435604 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:40.397263 0.409578 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:40.807236 0.331819 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:41.151942 0.000000 udp 10.0.2.105 7010 -> 117.223.132.133 9127 REQ 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:34:48.578831 0.284751 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:48.864081 0.296642 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 684 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:49.161330 0.390527 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:49.552509 0.400106 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:49.953073 0.430850 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:50.384609 0.459609 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:50.845188 0.392961 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:51.238760 0.376522 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:51.615736 0.441268 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:52.057466 0.279068 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:52.337019 0.433252 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:52.770778 0.383252 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:53.154514 0.584425 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:53.739457 0.519761 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:54.259698 0.467710 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:54.728045 0.299444 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:55.027964 0.405050 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:55.433507 0.389189 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:55.823308 0.421356 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:56.245258 0.384075 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:56.629952 0.412448 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:57.042973 0.361526 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:57.151364 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:34:57.404975 0.443012 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:34:57.848595 0.000000 udp 10.0.2.105 7010 -> 178.11.196.7 5044 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:04.051661 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:11.432305 0.000000 udp 10.0.2.105 7010 -> 72.70.56.11 3231 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:18.952970 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:23.649214 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:35:24.340546 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:29.407732 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 7978 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:34.845911 0.000000 udp 10.0.2.105 7010 -> 81.136.167.9 9607 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:43.788299 0.000000 udp 10.0.2.105 7010 -> 221.224.126.154 6567 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:48.645114 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:35:52.010391 0.000000 udp 10.0.2.105 7010 -> 209.30.61.107 5757 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:35:58.162116 3.001446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 20:36:00.692605 0.000000 udp 10.0.2.105 7010 -> 175.138.241.7 6504 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:05.169414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:36:07.001891 0.000000 udp 10.0.2.105 7010 -> 59.92.245.0 3701 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:13.170369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:36:14.463020 0.332156 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:14.795176 0.000000 icmp 82.51.116.137 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 245 flow=Background 1970/01/04 20:36:19.149131 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:36:22.804464 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 4579 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:29.173754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:36:31.106329 0.000000 udp 10.0.2.105 7010 -> 86.98.43.105 5451 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:38.227069 0.000000 udp 10.0.2.105 7010 -> 63.192.3.4 8491 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:43.153500 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:36:46.418224 0.000000 udp 10.0.2.105 7010 -> 93.221.157.101 6118 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:36:54.349790 0.000000 udp 10.0.2.105 7010 -> 14.216.82.237 7890 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:01.179329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:37:02.291291 0.000000 udp 10.0.2.105 7010 -> 68.15.8.23 8603 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:07.148206 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:37:11.154033 0.000000 udp 10.0.2.105 7010 -> 217.249.185.1 7662 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:17.453236 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:24.683226 0.000000 udp 10.0.2.105 7010 -> 203.172.213.113 1369 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:32.895261 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:37.651956 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:37:38.744072 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:46.534588 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:37:51.982671 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:00.975508 0.000000 udp 10.0.2.105 7010 -> 118.142.97.182 1579 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:05.982771 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:38:08.065876 1.136562 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:38:09.255177 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:14.845869 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 6439 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:23.588224 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:29.556487 0.000000 udp 10.0.2.105 7010 -> 72.54.121.49 5345 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:34.483296 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:38:34.914275 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:42.295092 0.000000 udp 10.0.2.105 7010 -> 121.155.180.70 4433 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:48.033153 0.000000 udp 10.0.2.105 7010 -> 203.85.229.67 5885 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:54.542432 0.000000 udp 10.0.2.105 7010 -> 14.98.233.67 1202 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:38:59.479838 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:39:02.694312 0.000000 udp 10.0.2.105 7010 -> 213.235.233.130 3523 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:07.751923 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:14.721896 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:21.331470 0.531642 udp 10.0.2.105 7010 <-> 118.172.160.97 8148 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:39:21.872974 0.000000 udp 10.0.2.105 7010 -> 24.185.180.57 3045 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:25.977623 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:39:29.643249 0.000000 udp 10.0.2.105 7010 -> 79.54.56.178 5808 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:34.940493 0.000000 udp 10.0.2.105 7010 -> 117.195.48.134 5269 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:40.519156 0.000000 udp 10.0.2.105 7010 -> 95.248.92.118 1571 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:48.740336 0.000000 udp 10.0.2.105 7010 -> 122.165.226.166 3707 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:39:53.477576 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:39:55.360060 0.000000 udp 10.0.2.105 7010 -> 74.98.207.126 2164 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:01.388624 0.000000 udp 10.0.2.105 7010 -> 202.166.160.26 1146 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:08.248715 0.000000 udp 10.0.2.105 7010 -> 182.68.143.120 8520 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:15.689188 0.000000 udp 10.0.2.105 7010 -> 187.143.249.190 6210 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:20.476399 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:40:21.217267 0.000000 udp 10.0.2.105 7010 -> 64.183.160.214 5820 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:27.846708 0.000000 udp 10.0.2.105 7010 -> 113.162.194.41 5475 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:33.584910 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:39.764230 0.432129 udp 10.0.2.105 7010 -> 41.206.58.154 4628 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:40.196359 0.000000 icmp 41.206.58.154 0x0303 -> 10.0.2.105 0x1412 URP 192 1 194 flow=Background 1970/01/04 20:40:44.480332 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:40:46.483949 0.000000 udp 10.0.2.105 7010 -> 81.136.187.125 7491 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:52.331927 0.000000 udp 10.0.2.105 7010 -> 58.8.194.100 9422 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:40:57.629693 0.000000 udp 10.0.2.105 7010 -> 77.102.117.190 1024 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:05.571380 0.000000 udp 10.0.2.105 7010 -> 219.64.95.182 9726 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:10.477590 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:41:11.149071 0.000000 udp 10.0.2.105 7010 -> 216.227.23.201 1363 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:19.040755 0.328328 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:41:19.379136 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:26.811590 0.000000 udp 10.0.2.105 7010 -> 120.61.168.234 9014 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:35.563924 0.000000 udp 10.0.2.105 7010 -> 99.113.240.19 6714 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:40.480960 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:41:44.407376 0.000000 udp 10.0.2.105 7010 -> 95.237.58.225 2288 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:52.799141 0.000000 udp 10.0.2.105 7010 -> 178.239.102.219 5009 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:41:57.906276 0.000000 udp 10.0.2.105 7010 -> 117.223.96.119 1551 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:04.465533 0.000000 udp 10.0.2.105 7010 -> 202.63.156.174 7664 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:08.982330 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:42:12.738103 0.000000 udp 10.0.2.105 7010 -> 202.53.77.106 7664 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:19.177330 0.000000 udp 10.0.2.105 7010 -> 90.214.152.83 2547 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:24.595053 0.000000 udp 10.0.2.105 7010 -> 173.162.99.50 1398 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:30.633656 0.000000 udp 10.0.2.105 7010 -> 87.16.12.143 3217 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:35.480115 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:42:37.203204 0.000000 udp 10.0.2.105 7010 -> 46.252.68.90 6379 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:44.713448 0.000000 udp 10.0.2.105 7010 -> 59.92.137.90 2497 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:52.364353 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:42:57.912366 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:02.479326 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:43:05.516212 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 20:43:06.555370 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:12.523747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:43:13.404608 0.000000 udp 10.0.2.105 7010 -> 95.236.42.177 1598 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:20.525085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:43:21.246607 0.000000 udp 10.0.2.105 7010 -> 217.236.16.234 8132 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:28.406613 0.000000 udp 10.0.2.105 7010 -> 180.183.137.24 8786 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:32.982838 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:43:34.995606 0.000000 udp 10.0.2.105 7010 -> 79.36.237.231 8606 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:36.528108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:43:41.184810 0.000000 udp 10.0.2.105 7010 -> 12.139.152.4 6723 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:48.465273 0.000000 udp 10.0.2.105 7010 -> 60.254.53.91 4902 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:54.383897 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:43:58.979964 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:44:02.345468 0.299288 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:44:02.726599 0.000000 udp 10.0.2.105 7010 -> 183.87.193.158 9569 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:08.083233 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 2495 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:08.533819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:44:14.072278 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:20.391014 0.371502 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:20.762516 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 263 flow=Background 1970/01/04 20:44:24.977544 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:44:25.958869 0.000000 udp 10.0.2.105 7010 -> 95.146.246.83 5084 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:31.527431 0.000000 udp 10.0.2.105 7010 -> 135.196.47.168 3660 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:37.325712 0.389964 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:44:37.724477 0.000000 udp 10.0.2.105 7010 -> 189.147.220.167 4592 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:44.035088 0.000000 udp 10.0.2.105 7010 -> 69.204.229.166 6263 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:44:48.981952 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:44:52.066458 0.339219 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:44:52.416222 0.000000 udp 10.0.2.105 7010 -> 59.97.96.134 9963 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:00.959746 0.000000 udp 10.0.2.105 7010 -> 84.171.248.248 3106 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:08.660910 0.000000 udp 10.0.2.105 7010 -> 122.169.99.244 9838 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:13.477555 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:45:15.069750 0.372180 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:45:15.451845 0.000000 udp 10.0.2.105 7010 -> 61.247.57.248 6704 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:21.969825 0.370652 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:45:22.356608 0.000000 udp 10.0.2.105 7010 -> 217.33.56.73 6449 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:27.528031 0.638810 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:45:28.176001 0.000000 udp 10.0.2.105 7010 -> 71.89.131.162 9097 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:34.787941 0.000000 udp 10.0.2.105 7010 -> 96.2.106.3 5859 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:39.484816 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:45:41.257278 0.000000 udp 10.0.2.105 7010 -> 117.242.196.96 1024 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:48.888079 0.000000 udp 10.0.2.105 7010 -> 122.27.251.215 3403 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:45:56.509306 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:03.209026 0.000000 udp 10.0.2.105 7010 -> 173.181.97.48 1852 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:07.975565 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:46:11.370627 0.000000 udp 10.0.2.105 7010 -> 88.204.167.83 3546 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:18.491224 0.000000 udp 10.0.2.105 7010 -> 69.15.41.105 7910 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:24.439673 0.298986 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:46:25.025283 0.000000 udp 10.0.2.105 7010 -> 182.74.25.146 1915 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:31.919975 0.316522 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:46:32.255731 0.432473 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:46:32.705780 0.000000 udp 10.0.2.105 7010 -> 145.236.208.155 2407 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:36.476295 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:46:40.162375 0.000000 udp 10.0.2.105 7010 -> 203.92.119.39 9994 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:46.671881 0.000000 udp 10.0.2.105 7010 -> 122.161.7.78 6723 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:52.430117 0.000000 udp 10.0.2.105 7010 -> 115.242.92.118 8913 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:46:58.649719 0.000000 udp 10.0.2.105 7010 -> 59.93.94.132 8180 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:03.475645 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:47:04.526847 0.472485 udp 10.0.2.105 7010 <-> 117.194.36.202 3121 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:47:05.009933 0.000000 udp 10.0.2.105 7010 -> 59.144.125.160 5698 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:12.639075 0.000000 udp 10.0.2.105 7010 -> 105.238.162.206 6342 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:20.660520 0.000000 udp 10.0.2.105 7010 -> 59.177.56.205 7476 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:26.088401 0.384247 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/04 20:47:26.483171 0.000000 udp 10.0.2.105 7010 -> 59.90.78.116 8425 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:30.975185 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 20:47:32.247132 0.000000 udp 10.0.2.105 7010 -> 90.215.134.247 9444 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:39.197395 0.000000 udp 10.0.2.105 7010 -> 90.26.5.254 4458 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:47:45.546394 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 20:50:12.540638 3.000835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 20:50:19.547344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:50:27.548987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:50:43.551978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:51:15.558273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:57:19.563297 3.002329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 20:57:26.571044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:57:34.572974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:57:50.575699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 20:58:22.581936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:01:30.082301 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:01:30.082479 1.682358 tcp 10.0.2.105 50435 -> 128.255.183.224 9027 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:04:26.587916 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:04:33.595342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:04:41.597119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:04:57.599793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:05:29.605806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:11:33.611974 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:11:40.619379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:11:48.620880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:12:04.623609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:12:36.629909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:18:07.085339 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:18:07.085592 0.309813 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:07.395857 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 21:18:22.770340 0.538892 tcp 10.0.2.105 50436 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:18:23.309070 0.575087 tcp 10.0.2.105 50437 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:18:23.884663 1.104306 tcp 10.0.2.105 50438 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:18:24.989556 0.388568 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:25.378538 0.281095 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:25.660055 0.469669 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:26.130087 0.395054 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:26.525557 0.434289 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:26.960178 0.380663 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:27.341191 0.428293 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:27.769823 0.295116 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:28.065380 0.422319 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:28.488119 0.386197 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:28.874730 0.583382 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:29.458502 0.498290 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:29.957163 0.454187 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:30.411743 0.319088 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:30.731181 0.400136 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:31.131677 0.419116 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:31.551188 0.382766 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:31.934368 0.391619 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:32.326409 0.416647 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:32.743396 0.436087 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:33.179846 0.332347 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:33.512663 0.519521 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:34.032601 0.578438 udp 10.0.2.105 7010 <-> 118.172.160.97 8148 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:34.611448 0.328498 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:34.940312 0.300703 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:35.241381 0.313542 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:35.555319 0.346761 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:35.902507 0.364142 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:36.267080 0.365660 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:36.633154 0.649045 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:37.282598 0.307393 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:37.590422 0.297298 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:37.888075 0.431078 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:38.319561 0.550409 udp 10.0.2.105 7010 <-> 117.194.36.202 3121 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:38.870366 0.386500 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:18:40.636922 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 21:18:47.643325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:18:55.644441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:19:11.648914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:19:43.654727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:25:47.660236 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:25:54.667421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:26:02.668733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:26:18.671572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:26:50.677697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:31:31.772519 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:31:31.772619 1.660114 tcp 10.0.2.105 50439 -> 128.255.183.224 9027 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:32:54.683705 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:33:01.691394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:33:09.692678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:33:25.696010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:33:57.701846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:40:01.708023 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:40:08.715158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:40:16.716755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:40:32.719587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:41:04.725769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:47:08.731982 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 21:47:15.739078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:47:23.741101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:47:39.743764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:48:11.749750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:49:07.500413 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 21:49:07.500610 0.296585 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:07.797567 0.462478 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:08.260610 0.370116 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:08.631132 0.258496 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:08.890047 0.372957 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:09.263393 0.477752 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:09.741534 0.284810 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:10.026752 0.360761 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:10.387905 0.422785 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:10.811096 0.419735 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:11.231192 0.384014 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:11.615615 0.579455 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:12.195459 0.522361 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:12.718240 0.388598 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:13.107228 0.466248 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:13.573907 0.310906 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:13.885239 0.422019 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:14.307654 0.387103 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:14.695117 0.364388 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:15.059909 0.401405 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:15.461721 0.959384 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:16.421504 0.347556 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:16.769442 0.695301 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:17.465133 0.000000 udp 10.0.2.105 7010 -> 118.172.160.97 8148 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 21:49:36.243486 0.561965 tcp 10.0.2.105 50440 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:49:36.805761 0.565823 tcp 10.0.2.105 50441 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:49:37.371887 1.132707 tcp 10.0.2.105 50442 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:49:38.505290 0.321242 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:38.826932 0.352237 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:39.179525 0.288415 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:39.468369 0.313626 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:39.782349 0.350090 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:40.132846 0.360331 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:40.493514 0.294645 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:40.788576 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 21:49:56.480995 0.563842 tcp 10.0.2.105 50443 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:49:57.045128 0.612440 tcp 10.0.2.105 50444 -> 195.113.214.226 80 SRPA* 0 0 20 14716 flow=From-Botnet-V2-TCP-Established 1970/01/04 21:49:57.658190 0.300353 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:57.959066 0.526812 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:58.486233 0.537730 udp 10.0.2.105 7010 <-> 117.194.36.202 3121 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:49:59.024393 0.370701 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 21:54:15.755622 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 21:54:22.763351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:54:30.764617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:54:46.767620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 21:55:18.773519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:01:22.780217 3.001082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:01:29.786929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:01:33.433314 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:01:33.433465 1.689270 tcp 10.0.2.105 50445 -> 128.255.183.224 9027 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:01:37.788802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:01:53.791367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:02:25.797701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:08:29.805228 2.999742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:08:36.810703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:08:44.812734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:09:00.815269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:09:32.821870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:15:36.827851 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:15:43.835177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:15:51.836697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:16:07.839804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:16:39.845648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:20:18.970939 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:20:18.971047 0.000000 udp 10.0.2.105 7010 -> 118.172.160.97 8148 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 22:20:37.370227 0.566808 tcp 10.0.2.105 50446 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:20:37.937328 0.581395 tcp 10.0.2.105 50447 -> 195.113.214.226 80 SRPA* 0 0 20 14739 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:20:38.519283 0.652103 udp 10.0.2.105 7010 <-> 116.89.110.95 6487 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:39.171817 0.305544 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:39.477780 0.269710 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:39.747895 0.386678 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:40.135023 0.466955 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:40.602449 0.393566 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:40.996528 0.279040 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:41.275999 0.425613 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:41.701964 0.390949 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:42.093280 0.428452 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:42.522076 0.375707 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:42.898192 0.414431 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:43.312992 0.503451 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:43.816772 0.395123 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:44.212436 0.590106 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:44.802990 0.460972 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:45.264392 0.310618 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:45.575419 0.378506 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:45.954322 0.390874 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:46.345599 0.396662 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:46.742671 0.409451 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:47.152693 0.448248 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:47.601300 0.330336 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:47.932047 0.882518 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:48.815039 0.318053 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:49.133440 0.343134 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:49.477001 0.353589 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:49.831012 0.372724 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:50.204066 0.299737 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:50.504246 0.305663 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:50.810319 0.363110 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:51.173834 0.314612 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:51.488831 0.461253 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:51.950494 0.553499 udp 10.0.2.105 7010 <-> 117.194.36.202 3121 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:20:52.504475 0.382186 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:22:43.851205 3.001809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 22:22:50.858990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:22:58.860609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:23:14.863591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:23:46.869245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:29:50.876144 3.000883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:29:57.883072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:30:05.884196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:30:21.887581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:30:53.893664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:31:35.123443 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:31:35.123641 1.661033 tcp 10.0.2.105 50448 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:36:57.899695 3.001466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:37:04.906634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:37:12.908061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:37:28.911466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:38:00.917541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:44:04.923405 3.001976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:44:11.931028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:44:19.932274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:44:35.935704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:45:07.941752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:51:02.962508 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 22:51:02.962710 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 22:51:11.947790 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:51:18.126262 0.587839 tcp 10.0.2.105 50449 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:18.713952 0.569835 tcp 10.0.2.105 50450 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:18.954990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:51:19.284116 1.371947 tcp 10.0.2.105 50451 -> 195.113.214.226 443 SRPA* 0 0 32 24685 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:20.656802 0.379940 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:21.037170 0.309928 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:21.347457 0.276396 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:21.624259 0.462380 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:22.087022 0.392441 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:22.479807 0.274093 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:22.754297 0.427263 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:23.182006 0.376130 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:23.558537 0.461054 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:24.019953 0.393704 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:24.414009 0.430595 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:24.845005 0.542118 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:25.387549 0.776234 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:26.164149 0.576410 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:26.740958 0.463010 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:26.956015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:51:27.204362 0.286811 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:27.491563 0.389934 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:27.881911 0.423165 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:28.305466 0.399309 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:28.705170 0.422127 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:29.127671 0.439259 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:29.567280 0.335907 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:29.903588 0.560414 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:30.464435 0.315836 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:30.780689 0.348732 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:31.129833 0.358387 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:31.488564 0.304991 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:31.793947 0.373559 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:32.167882 0.322059 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:32.490342 0.313139 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:32.803884 0.294551 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:33.098767 0.408445 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:51:33.507589 0.000000 udp 10.0.2.105 7010 -> 117.194.36.202 3121 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 22:51:42.959663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:51:51.492645 0.565453 tcp 10.0.2.105 50452 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:52.058344 0.573135 tcp 10.0.2.105 50453 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:52.631789 1.173217 tcp 10.0.2.105 50454 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/04 22:51:53.805596 0.834975 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/04 22:52:14.965303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:58:18.971472 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 22:58:25.979043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:58:33.980110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:58:49.983690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 22:59:21.989491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:01:36.784097 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:01:36.784378 1.710693 tcp 10.0.2.105 50455 -> 128.255.183.224 9027 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:05:25.995486 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:05:33.002432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:05:41.004108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:05:57.007334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:06:29.013142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:12:33.019699 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:12:40.026770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:12:48.028403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:13:04.031274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:13:36.037111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:19:40.043545 3.001058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:19:47.050667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:19:55.051975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:20:11.055043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:20:43.061358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:22:23.376250 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:22:23.376331 0.000000 udp 10.0.2.105 7010 -> 116.89.110.95 6487 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 23:22:38.379794 0.571506 tcp 10.0.2.105 50456 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:22:38.951555 0.601071 tcp 10.0.2.105 50457 -> 195.113.214.226 80 SRPA* 0 0 20 14757 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:22:39.553120 0.000000 udp 10.0.2.105 7010 -> 117.194.36.202 3121 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 23:22:55.692956 0.555237 tcp 10.0.2.105 50458 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:22:56.248581 0.601940 tcp 10.0.2.105 50459 -> 195.113.214.226 80 SRPA* 0 0 20 14719 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:22:56.851136 0.385532 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:57.237079 0.331410 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:57.568887 0.305260 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:57.874565 0.460127 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:58.335103 0.423661 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:58.759165 0.292609 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:59.052171 0.399196 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:59.451771 0.429979 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:22:59.882155 0.386443 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:00.268938 0.431899 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:00.701231 0.388628 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:01.090490 0.530592 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:01.621460 0.394957 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:02.016829 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/04 23:23:20.569118 0.557270 tcp 10.0.2.105 50460 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:23:21.126656 0.572298 tcp 10.0.2.105 50461 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:23:21.699264 1.176034 tcp 10.0.2.105 50462 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:23:22.875893 0.383207 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:23.259442 0.306832 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:23.566718 0.443447 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:24.010948 0.433369 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:24.444686 0.408945 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:24.853989 0.397975 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:25.252545 0.347129 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:25.600048 0.423581 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:26.024025 0.317325 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:26.341710 0.739995 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:27.082058 0.364596 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:27.447054 0.368300 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:27.815731 0.308088 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:28.124165 0.355888 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:28.480581 0.312362 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:28.793368 0.277456 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:29.071215 0.305279 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:29.376837 0.413872 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:23:29.791151 0.412863 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:26:47.068057 3.000649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/04 23:26:54.075977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:27:02.076293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:27:18.078962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:27:50.085175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:31:38.494045 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:31:38.494186 1.722764 tcp 10.0.2.105 50463 -> 128.255.183.224 9027 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/01/04 23:33:54.091490 3.001208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:34:01.108544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:34:09.110194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:34:25.113474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:34:57.119098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:41:01.125948 3.001148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:41:08.132847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:41:16.134163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:41:32.137307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:42:04.143431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:48:08.149043 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:48:15.156342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:48:23.158070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:48:39.161354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:49:11.167471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:53:38.862675 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/04 23:53:38.862787 0.581422 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:39.444581 0.349892 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:39.795008 0.374716 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:40.170122 0.258487 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:40.429017 0.449601 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:40.879013 0.423730 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:41.303117 0.273326 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:41.576797 0.395671 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:41.972899 0.448357 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:42.421653 0.423944 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:42.845976 0.375445 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:43.221781 0.389162 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:43.611317 0.500276 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:44.112014 0.390102 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:44.502505 0.392930 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:44.895779 0.306495 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:45.202658 0.467384 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:45.670395 0.417414 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:46.088135 0.411151 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:46.499647 0.431849 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:46.931911 0.397964 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:47.330240 0.340764 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:47.671386 0.324148 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:47.995935 0.486617 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:48.482934 0.358286 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:48.841620 0.364529 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:49.206507 0.294318 udp 10.0.2.105 7010 <-> 176.73.114.32 2905 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:49.501245 0.299006 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:49.800689 0.346203 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:50.147304 0.400807 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:50.548689 0.294701 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:50.843773 0.412914 udp 10.0.2.105 7010 <-> 74.196.220.117 9204 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:53:51.257063 0.381022 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/04 23:55:15.173708 3.000943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/04 23:55:22.180747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:55:30.182159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:55:46.185049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/04 23:56:18.190936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:01:40.224458 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:01:40.224555 1.729407 tcp 10.0.2.105 50464 -> 128.255.183.224 9027 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:02:22.197465 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:02:29.204342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:02:37.206257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:02:53.209384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:03:25.215153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:09:29.221081 3.001343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:09:36.228747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:09:44.229637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:10:00.232740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:10:32.239442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:16:36.244956 3.002128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:16:43.252591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:16:51.253826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:17:07.257231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:17:39.262853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:23:43.269506 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:23:50.276268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:23:58.277979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:24:14.280933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:24:16.774630 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:24:16.774852 0.387272 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:17.162555 0.578379 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:17.741304 0.312538 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:18.054226 0.590919 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:18.645542 0.452866 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:19.098767 0.421817 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:19.520991 0.313144 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:19.834542 0.397443 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:20.232405 0.419594 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:20.652412 0.418226 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:21.071038 0.499966 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:21.571379 0.386535 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:21.958257 0.388648 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:22.347307 0.392299 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:22.739982 0.386496 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:23.126880 0.312624 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:23.439899 0.460089 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:23.900353 0.422665 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:24.323426 0.401971 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:24.725854 0.429015 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:25.155316 0.315443 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:25.471168 0.946407 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:26.417931 0.345819 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:26.764122 0.641417 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:27.405914 0.365187 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:27.771517 0.372883 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:28.144823 0.000000 udp 10.0.2.105 7010 -> 176.73.114.32 2905 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 00:24:45.158019 0.589500 tcp 10.0.2.105 50465 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:24:45.747480 0.550413 tcp 10.0.2.105 50466 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:24:46.286610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:24:46.297759 1.405386 tcp 10.0.2.105 50467 -> 195.113.214.226 443 SRPA* 0 0 45 25815 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:24:47.703012 0.294570 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:47.997973 0.355305 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:48.353713 0.339361 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:48.693451 0.292139 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:24:48.985957 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9204 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 00:25:06.437237 0.588343 tcp 10.0.2.105 50468 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:25:07.025887 0.624096 tcp 10.0.2.105 50469 -> 195.113.214.226 80 SRPA* 0 0 19 14721 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:25:07.651144 0.401166 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:30:50.293509 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:30:57.300300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:31:05.301623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:31:21.304762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:31:41.955073 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:31:41.955178 1.738864 tcp 10.0.2.105 50470 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:31:53.311195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:37:57.317089 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:38:04.323990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:38:12.325782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:38:28.329129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:39:00.334968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:45:04.340931 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:45:11.348054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:45:19.349886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:45:35.352740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:46:07.359055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:52:11.364611 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 00:52:18.372045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:52:26.373513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:52:42.377262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:53:14.382737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:55:11.341179 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 00:55:11.341282 0.000000 udp 10.0.2.105 7010 -> 176.73.114.32 2905 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 00:55:27.786930 0.590380 tcp 10.0.2.105 50471 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:28.377569 0.555846 tcp 10.0.2.105 50472 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:28.933709 1.167622 tcp 10.0.2.105 50473 -> 195.113.214.226 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:30.102068 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9204 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 00:55:48.515691 0.564703 tcp 10.0.2.105 50474 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:49.080681 0.562028 tcp 10.0.2.105 50475 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:49.642563 1.152923 tcp 10.0.2.105 50476 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/05 00:55:50.796221 0.388670 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:51.185294 0.592448 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:51.778122 0.306041 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:52.084577 0.251595 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:52.336698 0.448174 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:52.785256 0.293574 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:53.079200 0.429852 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:53.509443 0.390531 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:53.900418 0.429194 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:54.329954 0.429039 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:54.759384 0.489301 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:55.249054 0.399578 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:55.649013 0.388105 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:56.037496 0.391691 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:56.429557 0.385806 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:56.815744 0.300777 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:57.116961 0.479739 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:57.597101 0.434544 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:58.032034 0.410459 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:58.442875 0.445692 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:58.888934 0.309956 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:59.199293 0.339974 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:55:59.539671 0.959771 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:00.499874 0.370745 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:00.870987 0.367276 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:01.238665 0.571414 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:01.810454 0.306158 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:02.116978 0.361739 udp 10.0.2.105 7010 <-> 82.57.18.52 4792 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:02.479153 0.355992 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:02.835558 0.297485 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:56:03.133463 0.842620 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 00:59:18.418934 3.001303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 00:59:25.425946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:59:33.428024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 00:59:49.431176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:00:21.436750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:01:43.725667 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:01:43.725837 1.681195 tcp 10.0.2.105 50477 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:06:25.443055 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:06:32.450141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:06:40.451489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:06:56.454953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:07:28.460669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:13:32.467075 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:13:39.474182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:13:47.475876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:14:03.478415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:14:35.484868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:20:39.491439 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:20:46.498147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:20:54.499600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:21:10.502534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:21:42.508759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:26:04.245550 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:26:04.245670 0.369794 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:04.615872 0.566733 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:05.183010 0.300786 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:05.484184 0.281851 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:05.766387 0.261303 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:06.028146 0.467854 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:06.496565 0.415710 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:06.912685 0.400648 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:07.313694 0.442120 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:07.756343 0.432080 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:08.188823 0.385467 udp 10.0.2.105 7010 <-> 70.90.49.1 4209 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:08.574696 0.495041 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:09.070104 0.380780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:09.451247 0.401933 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:09.853595 0.389914 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:10.243950 0.298341 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:10.542717 0.452834 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:10.995962 0.429689 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:11.426006 0.315906 udp 10.0.2.105 7010 <-> 81.134.85.253 8111 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:11.742315 0.413498 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:12.156214 0.437521 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:12.594154 0.343284 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:12.937872 0.000000 udp 10.0.2.105 7010 -> 99.26.224.9 5585 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:26:30.786037 0.569554 tcp 10.0.2.105 50478 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:26:31.355873 0.604209 tcp 10.0.2.105 50479 -> 195.113.214.226 80 SRPA* 0 0 25 14442 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:26:31.959654 0.364511 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:32.324581 0.307297 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:32.632434 0.379137 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:33.011954 0.496961 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:33.509315 0.299252 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:33.808979 0.000000 udp 10.0.2.105 7010 -> 82.57.18.52 4792 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:26:51.513969 0.598361 tcp 10.0.2.105 50480 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:26:52.112176 0.603702 tcp 10.0.2.105 50481 -> 195.113.214.226 80 SRPA* 0 0 20 14721 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:26:52.717037 0.347594 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:26:53.065002 0.906215 udp 10.0.2.105 7010 <-> 114.79.134.129 8992 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:27:46.515108 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 01:27:53.522102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:28:01.523961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:28:17.526816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:28:49.532949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:31:45.476324 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:31:45.476465 1.702960 tcp 10.0.2.105 50482 -> 128.255.183.224 9027 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:34:53.699082 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:35:00.706060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:35:08.708007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:35:24.710863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:35:56.716683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:42:00.723421 3.000921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:42:07.730610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:42:15.731996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:42:31.734972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:43:03.740867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:49:07.748129 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:49:14.754016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:49:22.756047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:49:38.758787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:50:10.765027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:56:14.771139 3.001080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 01:56:21.777980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:56:29.779927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:56:45.782854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:57:14.654685 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 01:57:14.654940 0.000000 udp 10.0.2.105 7010 -> 99.26.224.9 5585 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:57:17.789112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 01:57:30.509557 0.573644 tcp 10.0.2.105 50483 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:57:31.083458 0.603107 tcp 10.0.2.105 50484 -> 195.113.214.226 80 SRPA* 0 0 18 13447 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:57:31.687081 0.000000 udp 10.0.2.105 7010 -> 82.57.18.52 4792 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:57:47.542693 0.573241 tcp 10.0.2.105 50485 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:57:48.116237 0.581237 tcp 10.0.2.105 50486 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:57:48.697779 1.399123 tcp 10.0.2.105 50487 -> 195.113.214.226 443 SRPA* 0 0 37 25815 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:57:50.097596 0.395727 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:50.493761 0.577603 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:51.071785 0.316413 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:51.388737 0.275689 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:51.664776 0.285602 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:51.950762 0.428864 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:52.380044 0.456471 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:52.836916 0.377777 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:53.215072 0.427142 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:53.642560 0.408067 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:57:54.051016 0.000000 udp 10.0.2.105 7010 -> 70.90.49.1 4209 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:58:11.036643 0.561259 tcp 10.0.2.105 50488 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:11.598200 0.585516 tcp 10.0.2.105 50489 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:12.184065 1.133444 tcp 10.0.2.105 50490 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:13.318177 0.506386 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:13.824901 0.391218 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:14.216551 0.380448 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:14.597374 0.299962 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:14.897743 0.383593 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:15.281771 0.456419 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:15.738616 0.000000 udp 10.0.2.105 7010 -> 81.134.85.253 8111 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:58:32.086839 0.562721 tcp 10.0.2.105 50491 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:32.649850 0.573850 tcp 10.0.2.105 50492 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:33.224028 1.157933 tcp 10.0.2.105 50493 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:34.382635 0.411950 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:34.794981 0.415106 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:35.210495 0.345034 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:35.555906 0.858339 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:36.414602 0.270517 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:36.685500 0.365917 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:37.051813 0.414008 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:37.466231 0.301366 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:37.767953 4.084778 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:41.853098 0.334328 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/05 01:58:42.187840 0.000000 udp 10.0.2.105 7010 -> 114.79.134.129 8992 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 01:58:59.325664 0.563365 tcp 10.0.2.105 50494 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:58:59.889323 0.571829 tcp 10.0.2.105 50495 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 01:59:00.461399 1.158904 tcp 10.0.2.105 50496 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:01:47.186309 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:01:47.186415 1.661971 tcp 10.0.2.105 50497 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:03:21.794656 3.001907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 02:03:28.802093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:03:36.803862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:03:52.806573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:04:24.812432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:10:28.819381 3.000700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:10:35.825983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:10:43.827821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:10:59.830406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:11:31.846929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:17:35.852710 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:17:42.860058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:17:50.861297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:18:06.864321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:18:38.871006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:24:42.876763 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:24:49.884308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:24:57.885301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:25:13.888442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:25:45.894854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:29:12.081484 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:29:12.081666 0.000000 udp 10.0.2.105 7010 -> 70.90.49.1 4209 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 02:29:27.225745 0.577487 tcp 10.0.2.105 50498 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:27.803518 0.583028 tcp 10.0.2.105 50499 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:28.386844 1.157142 tcp 10.0.2.105 50500 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:29.544721 0.000000 udp 10.0.2.105 7010 -> 81.134.85.253 8111 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 02:29:47.283184 0.570863 tcp 10.0.2.105 50501 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:47.854421 0.570739 tcp 10.0.2.105 50502 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:48.425465 1.172002 tcp 10.0.2.105 50503 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:29:49.598157 0.000000 udp 10.0.2.105 7010 -> 114.79.134.129 8992 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 02:30:05.779718 0.567668 tcp 10.0.2.105 50504 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:30:06.347336 0.610949 tcp 10.0.2.105 50505 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:30:06.958465 0.574365 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:07.533247 0.363167 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:07.896823 0.281779 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:08.178997 0.291700 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:08.471059 0.322419 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:08.793850 0.410158 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:09.204411 0.470021 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:09.674835 0.422431 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:10.097649 0.422986 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:10.521041 0.427950 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:10.949390 0.387073 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:11.336839 0.487254 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:11.824711 0.387909 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:12.213008 0.398802 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:12.612195 0.300400 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:12.913022 0.451718 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:13.365144 0.408635 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:13.774128 0.416414 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:14.190958 0.339695 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:14.531035 0.437584 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:14.969018 0.365889 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:15.335233 0.308510 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:15.644142 0.330830 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:15.975350 0.304000 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:16.279720 0.560360 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:30:16.840642 0.377912 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/05 02:31:48.857611 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 02:31:48.857804 1.652736 tcp 10.0.2.105 50506 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/05 02:31:49.900894 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 02:31:56.907903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:32:04.909851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:32:20.912846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:32:52.918827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:38:56.924255 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:39:03.932220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:39:11.933797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:39:27.936230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:39:59.942735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:46:03.949029 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:46:10.955727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:46:18.957723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:46:34.960540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:47:06.966650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:53:10.972509 3.001941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 02:53:17.980481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:53:25.981262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:53:41.984139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 02:54:13.990251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:00:17.997084 3.001033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:00:25.003648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:00:33.005788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:00:45.924669 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:00:45.924856 0.291760 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:46.217002 0.577113 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:46.794526 0.384113 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:47.178981 0.392309 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:47.571728 0.263085 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:47.835187 0.308478 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:48.144056 0.458243 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:48.602695 0.415985 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:49.008244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:00:49.019047 0.423865 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:49.443338 0.428179 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:49.871915 0.392692 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:50.264976 0.375737 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:50.641026 0.597700 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:51.239105 0.384629 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:51.624092 0.308962 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:51.933454 0.420349 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:52.354211 0.459004 udp 10.0.2.105 7010 <-> 24.8.201.73 5506 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:52.813628 0.393320 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:53.207343 0.343049 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:53.550791 0.437115 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:53.988336 0.362206 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:54.350935 0.303385 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:54.654711 0.344928 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:55.000040 0.310390 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:55.310846 0.551060 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:00:55.862339 0.326905 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:01:21.015255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:01:50.517691 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:01:50.517785 1.711328 tcp 10.0.2.105 50507 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:07:25.020747 3.001260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:07:32.028038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:07:40.029662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:07:56.032402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:08:28.038402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:14:32.044513 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:14:39.051767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:14:47.053272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:15:03.056051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:15:35.062118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:21:39.068468 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:21:46.076120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:21:54.077100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:22:10.079987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:22:42.086322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:28:46.092709 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:28:53.099678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:29:01.101201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:29:17.103969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:29:49.110614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:31:24.518103 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 03:31:24.518261 0.289685 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:24.808518 0.581514 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:25.414379 0.399276 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:25.814039 0.317005 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:26.131430 0.383703 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:26.515500 0.279416 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:26.795312 0.617806 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:27.413529 0.413276 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:27.827208 0.391257 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:28.218788 0.425344 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:28.644577 0.426391 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:29.071351 0.382892 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:29.454689 0.475637 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:29.930668 0.389799 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:30.320810 0.303004 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:30.624182 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 03:31:45.880800 0.575784 tcp 10.0.2.105 50508 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:31:46.456937 0.565588 tcp 10.0.2.105 50509 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:31:47.022769 1.384987 tcp 10.0.2.105 50510 -> 195.113.214.226 443 SRPA* 0 0 33 25053 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:31:48.408529 0.420154 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:31:48.829116 0.000000 udp 10.0.2.105 7010 -> 24.8.201.73 5506 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 03:31:52.227809 1.721162 tcp 10.0.2.105 50511 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:32:05.968821 0.578191 tcp 10.0.2.105 50512 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:32:06.547302 0.570935 tcp 10.0.2.105 50513 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:32:07.118600 1.161980 tcp 10.0.2.105 50514 -> 195.113.214.226 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/05 03:32:08.281342 0.351212 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:08.632929 0.440580 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:09.073859 0.372377 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:09.446677 0.300223 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:09.747316 0.338138 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:10.085807 0.320682 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:10.406845 0.294927 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:32:10.702119 0.656254 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 03:35:53.116686 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 03:36:00.123955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:36:08.125583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:36:24.128345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:36:56.134511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:43:00.140255 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:43:07.147792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:43:15.149174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:43:31.151938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:44:03.158281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:50:07.164156 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:50:14.171585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:50:22.172858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:50:38.175982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:51:10.182118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:57:14.189146 3.001020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 03:57:21.195996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:57:29.197412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:57:45.199936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 03:58:17.205845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:01:53.948060 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:01:53.948165 1.707285 tcp 10.0.2.105 50515 -> 128.255.183.224 9027 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:02:35.097473 0.000000 udp 10.0.2.105 7010 -> 24.8.201.73 5506 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 04:02:40.074180 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:02:53.165662 0.587454 tcp 10.0.2.105 50516 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:02:53.753427 0.575343 tcp 10.0.2.105 50517 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:02:54.329051 1.169480 tcp 10.0.2.105 50518 -> 195.113.214.226 443 SRPA* 0 0 23 14604 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:02:55.499239 0.398985 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:55.898631 0.291238 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:56.190287 0.580441 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:56.771088 0.304167 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:57.075633 0.391299 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:57.467347 0.330299 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:57.798047 0.373538 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:58.171985 0.454153 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:58.626477 0.394000 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:59.020836 0.429398 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:59.450614 0.411072 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:02:59.862071 0.449746 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:00.312201 0.607518 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:00.920071 0.392811 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:01.313273 0.379191 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:01.692813 0.308284 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:02.001446 0.422085 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:02.423897 0.348155 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:02.772436 0.438902 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:03.211682 0.366971 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:03.579030 0.300306 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:03.879741 0.358141 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:04.238281 0.323363 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:04.562053 0.299028 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:03:04.861472 0.512759 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:04:21.212750 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 04:04:28.219915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:04:36.220915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:04:52.223791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:05:24.229838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:11:28.236602 3.000878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:11:35.243327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:11:43.245458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:11:59.247890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:12:31.254282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:18:35.260051 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:18:42.267629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:18:50.269146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:19:06.272210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:19:38.278018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:25:42.284499 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:25:49.291614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:25:57.292902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:26:13.296141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:26:45.302286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:31:55.658600 0.000201 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:31:55.658909 1.843354 tcp 10.0.2.105 50519 -> 128.255.183.224 9027 FSPA* 0 0 14 1564 flow=From-Botnet-V2-TCP-Established 1970/01/05 04:32:49.308632 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:32:56.315518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:33:04.317212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:33:20.320113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:33:32.358039 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 04:33:32.358140 0.407902 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:32.766435 0.282456 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:33.049286 0.597175 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:33.646856 0.292267 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:33.939512 0.385104 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:34.325023 0.354155 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:34.679581 0.391913 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:35.071913 0.469706 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:35.541981 0.379112 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:35.921500 0.416072 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:36.338228 0.415828 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:36.754481 0.431352 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:37.186218 0.492138 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:37.678749 0.430842 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:38.109929 0.400050 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:38.510361 0.391987 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:38.902783 0.445143 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:39.348332 0.417810 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:39.766498 0.340888 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:40.107744 0.364227 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:40.472350 0.307703 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:40.780555 0.341964 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:41.122955 0.416095 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:41.539450 0.305714 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:41.845514 0.568276 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/05 04:33:52.326056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:39:56.331853 3.002237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:40:03.339726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:40:11.340874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:40:27.343610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:40:59.349861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:47:03.355544 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:47:10.363581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:47:18.364826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:47:34.367853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:48:06.373624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:54:10.379244 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 04:54:17.387623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:54:25.389072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:54:41.392030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 04:55:13.397917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:01:17.404543 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:01:24.411272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:01:32.412865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:01:48.415566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:01:57.510117 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:01:57.510388 1.742799 tcp 10.0.2.105 50520 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:02:20.421617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:04:03.170119 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:04:03.170279 0.406130 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:03.576832 0.282419 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:03.859610 0.576655 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:04.436662 0.299309 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:04.736411 0.383937 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:05.120788 0.280281 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:05.401433 0.386169 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:05.787959 0.463556 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:06.251869 0.398729 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:06.650996 0.428344 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:07.079670 0.421947 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:07.501999 0.413921 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:07.916369 0.489390 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:08.442585 0.303674 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:08.746623 0.392165 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:09.139177 0.396714 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:09.536296 0.333203 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:09.869915 0.437107 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:10.307425 0.420315 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:10.728094 0.374292 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:11.102800 0.308088 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:11.411248 0.368897 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:11.780573 0.386381 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:12.167303 0.301139 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:04:12.468848 0.620524 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:08:24.428282 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:08:31.435459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:08:39.436825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:08:55.440053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:09:27.445936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:15:31.452465 3.000869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:15:38.459255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:15:46.460811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:16:02.463816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:16:34.469740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:22:38.475774 3.001862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:22:45.483599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:22:53.484754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:23:09.487878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:23:41.494076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:29:45.500857 3.000247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:29:52.506982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:30:00.509173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:30:16.512091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:30:48.517888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:31:59.260130 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:31:59.260391 1.702955 tcp 10.0.2.105 50521 -> 128.255.183.224 9027 FSPA* 0 0 12 1632 flow=From-Botnet-V2-TCP-Established 1970/01/05 05:34:37.627712 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 05:34:37.627909 0.422673 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:38.050936 0.271483 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:38.322836 0.385336 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:38.708626 0.580561 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:39.289586 0.310746 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:39.600693 0.280046 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:39.881141 0.399692 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:40.281226 0.461808 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:40.743459 0.384494 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:41.128518 0.423292 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:41.552172 0.435823 udp 10.0.2.105 7010 <-> 108.76.85.176 4197 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:41.988402 0.418978 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:42.407770 0.504924 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:42.913034 0.314321 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:43.227713 0.407276 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:43.635419 0.373562 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:44.009394 0.337094 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:44.346941 0.371469 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:44.718830 0.432914 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:45.152172 0.423159 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:45.575732 0.300969 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:45.877052 0.377319 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:46.254749 0.369828 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:46.624986 0.294078 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:34:46.919403 0.536451 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 05:36:52.524072 3.001190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 05:36:59.530973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:37:07.532819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:37:23.535997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:37:55.541865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:43:59.548468 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:44:06.555463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:44:14.556791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:44:30.559718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:45:02.565808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:51:06.572478 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:51:13.579281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:51:21.580420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:51:37.583746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:52:09.589334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:58:13.595920 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 05:58:20.602829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:58:28.604303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:58:44.607527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 05:59:16.613512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:02:00.970713 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:02:00.970820 1.791825 tcp 10.0.2.105 50522 -> 128.255.183.224 9027 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:04.434215 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:05:04.434418 0.412372 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:04.847208 0.581168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:05.428815 0.295573 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:05.724762 0.386475 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:06.111647 0.320418 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:06.432446 0.264910 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:06.697705 0.393831 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:07.091941 0.403546 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:07.495817 0.459026 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:07.955228 0.430316 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:08.385957 0.000000 udp 10.0.2.105 7010 -> 108.76.85.176 4197 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:05:20.620455 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 06:05:26.357840 0.556719 tcp 10.0.2.105 50523 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:26.914889 0.583140 tcp 10.0.2.105 50524 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:27.498327 1.365008 tcp 10.0.2.105 50525 -> 195.113.214.226 443 SRPA* 0 0 32 24687 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:27.627310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:05:28.864077 0.425920 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:29.290414 0.483253 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:29.774100 0.303570 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:30.078064 0.390395 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:30.468825 0.391818 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:30.860985 0.439429 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:31.300848 0.334853 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:31.636102 0.358934 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:31.995450 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:05:35.628333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:05:50.691216 0.544878 tcp 10.0.2.105 50526 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:51.236403 0.593000 tcp 10.0.2.105 50527 -> 195.113.214.226 80 SRPA* 0 0 19 14641 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:05:51.631575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:05:51.830050 0.300294 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:05:52.130759 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:06:10.229641 0.572991 tcp 10.0.2.105 50528 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:06:10.802939 0.570569 tcp 10.0.2.105 50529 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:06:11.373779 1.170083 tcp 10.0.2.105 50530 -> 195.113.214.226 443 SRPA* 0 0 24 13432 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:06:12.544696 0.397156 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:06:12.942316 0.315586 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:06:13.258300 1.921764 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:06:23.637854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:12:27.644268 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 06:12:34.651115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:12:42.652505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:12:58.655277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:13:30.661572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:19:34.668311 3.000700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 06:19:41.674747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:19:49.676776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:20:05.679709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:20:37.685968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:26:41.691292 3.002234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 06:26:48.698788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:26:56.700521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:27:12.703399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:27:44.709204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:32:02.771012 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:32:02.771249 1.921893 tcp 10.0.2.105 50531 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:33:48.716390 3.000739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 06:33:55.722899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:34:03.724497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:34:19.727334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:34:51.733307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:36:29.804868 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:36:29.804957 0.000000 udp 10.0.2.105 7010 -> 108.76.85.176 4197 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:36:47.362536 0.599441 tcp 10.0.2.105 50532 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:36:47.962262 0.573917 tcp 10.0.2.105 50533 -> 195.113.214.226 80 SRPA* 0 0 20 14687 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:36:48.536830 0.420769 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:36:48.958386 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:37:06.187957 0.580027 tcp 10.0.2.105 50534 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:37:06.768372 0.591312 tcp 10.0.2.105 50535 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/05 06:37:07.358166 0.419530 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:07.778064 0.380843 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:08.159369 0.579158 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:08.738933 0.284085 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:09.023419 0.274958 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:09.298771 0.314993 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:09.614171 0.403393 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:10.018057 0.405994 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:10.424475 0.456082 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:10.880931 0.416739 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:11.298066 0.615714 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:11.914175 0.420324 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:12.334859 0.309889 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:12.645124 0.389762 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:13.035236 0.383439 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:13.419091 0.359981 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:13.779468 0.344323 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:14.124224 0.434508 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:14.559143 0.309423 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:14.868958 0.378408 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:15.247756 0.297219 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:15.545375 2.136289 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:17.854778 0.408609 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:18.263974 0.388145 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:18.652784 0.415142 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:19.068462 0.288247 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:19.357350 0.586768 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:19.944738 0.271191 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:20.216434 0.300320 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:20.517253 0.363275 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:20.881105 0.457608 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:21.339176 0.396057 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:21.735847 0.427528 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:22.163841 0.505776 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:22.670095 0.309830 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:22.980437 0.385075 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:23.366116 0.440033 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:23.806632 0.398281 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:24.205429 0.372594 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:24.578612 0.352992 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:24.932055 0.280198 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:25.212886 0.335064 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:25.548511 0.428454 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:25.977570 0.301418 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:26.279649 3.572125 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:37:29.852382 0.000000 udp 10.0.2.105 7010 -> 108.129.121.201 6192 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:37:31.072695 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:37:38.583444 0.000000 udp 10.0.2.105 7010 -> 88.240.206.241 6019 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:37:45.262929 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:37:52.133238 0.337907 udp 10.0.2.105 7010 -> 78.172.127.208 3632 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:37:52.471145 0.000000 icmp 78.172.127.208 0x0303 -> 10.0.2.105 0x300e URP 192 1 155 flow=Background 1970/01/05 06:37:57.070033 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:37:57.981660 0.000000 udp 10.0.2.105 7010 -> 182.185.150.118 9282 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:03.899781 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:09.387384 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:18.390672 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 7978 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:23.077082 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:38:24.499884 0.284942 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:38:24.795515 0.000000 udp 10.0.2.105 7010 -> 190.56.116.116 3421 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:33.332007 0.000000 udp 10.0.2.105 7010 -> 79.166.19.39 4707 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:39.641041 0.337492 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:38:40.040561 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:46.391200 0.329581 udp 10.0.2.105 7010 -> 82.51.116.137 2254 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:38:46.720781 0.000000 icmp 82.51.116.137 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 150 flow=Background 1970/01/05 06:38:51.077913 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:38:54.842944 0.000000 udp 10.0.2.105 7010 -> 109.65.132.188 7298 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:01.673296 0.000000 udp 10.0.2.105 7010 -> 82.40.227.91 3537 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:08.633456 0.000000 udp 10.0.2.105 7010 -> 74.215.9.60 7115 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:15.482973 3.336331 udp 10.0.2.105 7010 -> 87.194.249.22 1024 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:18.819304 0.000000 icmp 87.194.249.22 0x0103 -> 10.0.2.105 0x57c2 URH 192 1 148 flow=Background 1970/01/05 06:39:20.078925 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:39:21.140855 0.000000 udp 10.0.2.105 7010 -> 2.135.184.93 3505 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:29.583279 0.000000 udp 10.0.2.105 7010 -> 78.181.2.159 5470 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:35.962457 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:41.620646 0.000000 udp 10.0.2.105 7010 -> 217.249.185.1 7662 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:46.577438 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:39:49.442001 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:39:56.962137 0.000000 udp 10.0.2.105 7010 -> 217.33.56.73 6449 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:02.991318 0.000000 udp 10.0.2.105 7010 -> 74.42.39.166 6016 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:11.173004 0.453865 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:11.626869 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 322 flow=Background 1970/01/05 06:40:16.069353 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:40:17.501688 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:23.510418 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:32.323499 0.000000 udp 10.0.2.105 7010 -> 86.2.153.175 6916 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:40.545284 0.425003 udp 10.0.2.105 7010 -> 190.242.125.21 3115 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:40.970287 0.000000 icmp 190.242.125.21 0x0303 -> 10.0.2.105 0x2b0c URP 192 1 253 flow=Background 1970/01/05 06:40:45.071632 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:40:46.984495 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:52.162077 0.000000 udp 10.0.2.105 7010 -> 110.234.196.42 8132 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:40:55.739906 3.002057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 06:40:58.220802 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:02.747712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:41:06.071784 0.000000 udp 10.0.2.105 7010 -> 145.236.208.155 2407 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:10.749198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:41:11.079073 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:41:13.582681 0.431948 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:41:14.025372 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:19.781893 0.000000 udp 10.0.2.105 7010 -> 201.247.102.50 9184 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:25.470098 0.000000 udp 10.0.2.105 7010 -> 84.183.247.186 5162 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:26.751145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:41:30.716906 0.525811 udp 10.0.2.105 7010 -> 168.167.98.214 3409 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:31.242717 0.000000 icmp 168.167.98.214 0x0303 -> 10.0.2.105 0x510d URP 192 1 210 flow=Background 1970/01/05 06:41:35.573852 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:41:39.700016 0.000000 udp 10.0.2.105 7010 -> 64.32.178.38 2066 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:45.358155 0.000000 udp 10.0.2.105 7010 -> 88.70.61.172 4147 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:52.077671 0.000000 udp 10.0.2.105 7010 -> 201.196.161.253 2383 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:57.104966 0.000000 udp 10.0.2.105 7010 -> 79.2.39.20 9702 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:41:58.757303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:42:02.071856 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:42:04.886363 0.492740 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:42:05.390067 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:13.799432 0.390813 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:42:14.200785 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:20.859511 0.000000 udp 10.0.2.105 7010 -> 99.195.135.226 8881 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:27.388646 0.000000 udp 10.0.2.105 7010 -> 80.183.42.88 3140 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:32.075006 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:42:33.076687 0.000000 udp 10.0.2.105 7010 -> 24.36.147.168 3914 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:42.069801 0.286646 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:42:42.366503 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:49.040075 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:55.068779 0.339683 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:42:55.424259 0.000000 udp 10.0.2.105 7010 -> 186.190.153.111 1149 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:42:59.574857 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:43:04.211330 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 6439 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:11.041617 0.000000 udp 10.0.2.105 7010 -> 112.209.78.156 5721 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:18.362062 0.000000 udp 10.0.2.105 7010 -> 203.92.119.39 9994 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:26.503658 0.000000 udp 10.0.2.105 7010 -> 64.183.160.214 5820 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:31.069949 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:43:34.174524 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:39.672335 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:45.170420 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:50.668091 0.407535 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:43:51.086651 0.451649 udp 10.0.2.105 7010 -> 188.123.130.69 3074 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:43:51.538300 0.000000 icmp 188.123.130.69 0x0303 -> 10.0.2.105 0x020c URP 192 1 203 flow=Background 1970/01/05 06:43:55.575337 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:43:59.280958 0.000000 udp 10.0.2.105 7010 -> 41.69.32.31 2278 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:06.841626 0.000000 udp 10.0.2.105 7010 -> 209.192.34.180 3409 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:14.022144 0.000000 udp 10.0.2.105 7010 -> 84.173.60.119 7912 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:23.025292 0.331903 udp 10.0.2.105 7010 -> 2.32.141.60 8840 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:23.357195 0.000000 icmp 2.32.141.60 0x0303 -> 10.0.2.105 0x8822 URP 192 1 131 flow=Background 1970/01/05 06:44:27.571170 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:44:30.195656 0.000000 udp 10.0.2.105 7010 -> 188.106.11.110 7270 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:38.256681 0.000000 udp 10.0.2.105 7010 -> 188.117.121.242 3639 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:45.086927 0.000000 udp 10.0.2.105 7010 -> 78.150.173.183 9941 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:50.664509 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:44:55.571236 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:44:59.517219 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:05.856347 0.000000 udp 10.0.2.105 7010 -> 41.141.91.138 9737 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:14.388710 0.000000 udp 10.0.2.105 7010 -> 93.58.81.110 9313 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:21.919706 0.000000 udp 10.0.2.105 7010 -> 96.2.106.3 5859 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:26.575814 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:45:27.257220 0.000000 udp 10.0.2.105 7010 -> 78.149.2.39 9529 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:32.895349 0.000000 udp 10.0.2.105 7010 -> 216.172.121.117 7998 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:41.267745 0.000000 udp 10.0.2.105 7010 -> 79.30.218.2 6777 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:48.758095 0.000000 udp 10.0.2.105 7010 -> 85.102.164.62 6710 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:45:53.575186 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:45:55.518365 0.000000 udp 10.0.2.105 7010 -> 87.15.181.250 3159 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:00.875916 0.000000 udp 10.0.2.105 7010 -> 109.55.231.197 9393 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:06.693725 0.294160 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:06.998634 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:13.624461 0.290174 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:13.932091 0.290244 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:14.262933 0.331370 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:14.607790 0.293983 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:14.910250 0.341367 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:15.267267 0.000000 udp 10.0.2.105 7010 -> 82.212.15.194 3336 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:18.571135 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:46:20.283895 0.000000 udp 10.0.2.105 7010 -> 97.101.206.6 7833 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:25.541310 0.000000 udp 10.0.2.105 7010 -> 95.229.248.36 6838 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:34.484188 0.266153 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:35.124849 0.000000 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:40.512401 0.324286 udp 10.0.2.105 7010 -> 95.8.136.37 1024 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:40.836687 0.000000 icmp 95.8.136.37 0x0303 -> 10.0.2.105 0x0004 URP 192 1 204 flow=Background 1970/01/05 06:46:45.078733 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:46:45.839979 0.323921 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:46.179694 0.282642 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:46.471754 0.000000 udp 10.0.2.105 7010 -> 82.89.167.159 4033 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:52.490089 0.545760 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 753 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:53.060791 0.351166 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:46:53.427291 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:46:59.820274 0.000000 udp 10.0.2.105 7010 -> 87.234.200.227 7696 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:06.570420 0.000000 udp 10.0.2.105 7010 -> 151.66.161.176 2001 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:11.576918 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:47:15.373086 0.622732 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:47:16.006290 0.000000 udp 10.0.2.105 7010 -> 71.89.131.162 9097 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:24.846162 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:33.358339 0.000000 udp 10.0.2.105 7010 -> 90.215.134.247 9444 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:38.075562 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:47:41.420516 0.400143 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:47:41.831277 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:50.293229 0.000000 udp 10.0.2.105 7010 -> 67.162.31.163 4085 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:58.524482 0.417646 udp 10.0.2.105 7010 <-> 79.112.228.150 3757 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:47:58.951561 0.321868 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:47:59.288901 0.297311 udp 10.0.2.105 7010 -> 95.33.50.221 8932 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:47:59.586212 0.000000 icmp 95.33.50.221 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 296 flow=Background 1970/01/05 06:48:02.763694 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 06:48:03.070984 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:48:05.454436 0.000000 udp 10.0.2.105 7010 -> 69.142.23.247 8236 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:09.771083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:48:11.874006 0.000000 udp 10.0.2.105 7010 -> 207.112.105.208 6759 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:17.081520 0.000000 udp 10.0.2.105 7010 -> 66.186.168.10 6985 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:17.772593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:48:23.330410 0.324386 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:48:23.702216 0.000000 udp 10.0.2.105 7010 -> 125.29.152.203 6348 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:28.076749 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:48:29.429463 0.000000 udp 10.0.2.105 7010 -> 122.172.163.251 4851 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:33.775465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:48:36.949695 0.000000 udp 10.0.2.105 7010 -> 2.222.249.87 5806 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:43.238897 0.410960 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:48:43.660191 0.000000 udp 10.0.2.105 7010 -> 71.47.55.21 5050 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:52.191928 0.000000 udp 10.0.2.105 7010 -> 87.25.69.76 1035 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:48:57.079042 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:49:01.014898 0.321923 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:49:01.347079 0.000000 udp 10.0.2.105 7010 -> 93.216.127.239 3631 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:49:05.781358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:49:09.166127 0.000000 udp 10.0.2.105 7010 -> 79.225.42.80 2907 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 06:49:17.228459 0.297705 udp 10.0.2.105 7010 <-> 91.33.238.213 5600 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/05 06:49:22.074927 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 06:55:09.786954 3.002460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 06:55:16.795038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:55:24.796408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:55:40.799347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 06:56:12.805178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:02:04.701951 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:02:04.702264 1.729623 tcp 10.0.2.105 50536 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:02:16.811442 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:02:23.818720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:02:31.820550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:02:47.823367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:03:19.829283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:09:23.835522 3.001238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:09:30.843161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:09:38.844546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:09:54.847217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:10:26.852993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:16:30.859860 3.001249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:16:37.866349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:16:45.868514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:17:01.870853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:17:33.877472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:19:37.284833 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:19:37.284942 0.414805 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:37.700140 0.388332 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:38.088906 0.417523 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:38.506803 0.274705 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:38.781914 0.584321 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:39.366649 0.278426 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:39.645500 0.306293 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:39.952156 0.391128 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:40.343676 0.390990 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:40.735063 0.438524 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:41.173932 0.435943 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:41.610304 0.497709 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:42.108489 0.306277 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:42.415179 0.412775 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:42.828438 0.369115 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:43.197915 0.387300 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:43.585602 0.351181 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:43.937148 0.348003 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:44.285530 0.299928 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:44.585792 0.290800 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:44.876945 0.412027 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:45.289335 0.443396 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:45.733139 0.491987 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:46.225519 0.290401 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:46.516489 0.349059 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:46.865943 0.442244 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:47.308707 0.495773 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:47.804838 0.394763 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:48.200016 0.307046 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:19:48.507437 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:20:06.369147 0.573307 tcp 10.0.2.105 50537 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:20:06.942808 0.615037 tcp 10.0.2.105 50538 -> 195.113.214.226 80 SRPA* 0 0 25 14440 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:20:07.557316 0.318198 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:07.875897 0.288796 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:08.165082 0.310065 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:08.475570 0.289970 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:08.765870 0.333685 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:09.099999 0.366002 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:09.466353 0.286827 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:09.753585 0.271848 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:10.025866 0.317237 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:10.343510 0.298750 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:10.642688 0.435888 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:11.078994 0.351936 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:11.431310 0.607050 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:12.038723 0.396387 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:12.435512 0.000000 udp 10.0.2.105 7010 -> 79.112.228.150 3757 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:20:28.399236 0.611145 tcp 10.0.2.105 50539 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:20:29.010684 0.637370 tcp 10.0.2.105 50540 -> 195.113.214.226 80 SRPA* 0 0 18 13341 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:20:29.648704 0.288041 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:29.937147 0.312492 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:30.250034 0.414916 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:30.665400 0.323099 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:20:30.988909 0.325644 udp 10.0.2.105 7010 <-> 91.33.238.213 5600 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:23:37.883618 3.001105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 07:23:44.890835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:23:52.892116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:24:08.895518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:24:40.901419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:30:44.906611 3.002605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:30:51.914274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:30:59.916063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:31:15.919100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:31:47.925299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:32:06.432151 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:32:06.432273 1.762248 tcp 10.0.2.105 50541 -> 128.255.183.224 9027 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:37:51.930775 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:37:58.938347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:38:06.940141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:38:22.943496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:38:54.949170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:44:58.956031 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:45:05.962666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:45:13.964031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:45:29.967048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:46:01.972871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:50:44.058764 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 07:50:44.058920 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:51:02.498244 0.571695 tcp 10.0.2.105 50542 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:03.070220 0.568521 tcp 10.0.2.105 50543 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:03.639030 1.383348 tcp 10.0.2.105 50544 -> 195.113.214.226 443 SRPA* 0 0 41 27685 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:05.022980 0.000000 udp 10.0.2.105 7010 -> 79.112.228.150 3757 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:51:22.965625 0.563341 tcp 10.0.2.105 50545 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:23.529204 0.582014 tcp 10.0.2.105 50546 -> 195.113.214.226 80 SRPA* 0 0 19 14625 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:24.111850 0.422590 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:24.534800 0.372710 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:24.907899 0.407375 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:25.315597 0.287992 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 592 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:25.603995 0.314529 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:25.918901 0.327847 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:26.247116 0.577587 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:26.825054 0.769578 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:27.595033 0.416363 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:28.011780 0.398722 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:28.411004 0.461170 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:28.872559 1.302410 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:30.175340 0.384380 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:30.560111 0.411915 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:30.972395 0.312836 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:31.285668 0.373907 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:31.659929 0.391528 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:32.051860 0.302622 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:32.354881 0.307356 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:32.662668 0.337475 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:33.000484 0.437696 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:33.438528 0.703325 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:34.142267 0.401993 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:34.544620 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:51:52.958915 0.577874 tcp 10.0.2.105 50547 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:53.537048 0.574438 tcp 10.0.2.105 50548 -> 195.113.214.226 80 SRPA* 0 0 18 13383 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:51:54.112018 2.383228 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:56.495663 0.504442 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:57.000557 0.444920 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:57.445895 0.382429 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:57.828699 0.284316 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:58.113409 0.295725 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:58.409533 0.303079 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:58.713039 0.296903 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:59.010349 0.302131 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:59.312827 0.329035 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:59.642227 0.335230 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:51:59.977837 0.255124 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:00.233358 0.275451 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:00.509145 0.297781 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:00.807297 0.322881 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:01.130505 0.438893 udp 10.0.2.105 7010 <-> 99.60.100.64 6761 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:01.569778 0.617839 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:02.188039 0.344560 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:02.533006 0.408627 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:02.942063 0.311245 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:03.253687 0.000000 udp 10.0.2.105 7010 -> 86.184.229.52 7902 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 07:52:05.978979 3.001923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 07:52:12.986231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:52:19.417209 0.578426 tcp 10.0.2.105 50549 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:52:19.995978 0.589802 tcp 10.0.2.105 50550 -> 195.113.214.226 80 SRPA* 0 0 20 13504 flow=From-Botnet-V2-TCP-Established 1970/01/05 07:52:20.586256 0.407928 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:20.988188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:52:20.994527 0.325289 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:21.320169 0.325529 udp 10.0.2.105 7010 <-> 91.33.238.213 5600 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 07:52:36.990682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:53:08.996895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:59:13.003651 3.000933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 07:59:20.010495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:59:28.012471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 07:59:44.014928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:00:16.021172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:02:08.202917 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:02:08.203133 1.759185 tcp 10.0.2.105 50551 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:06:20.027354 3.001700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:06:27.034366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:06:35.036247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:06:51.039254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:07:23.044882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:13:27.050503 3.002163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:13:34.058229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:13:42.059795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:13:58.063049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:14:30.068983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:20:34.075761 3.000524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:20:41.082151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:20:49.083999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:21:05.087041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:21:37.092748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:22:39.673503 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:22:39.673651 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:22:56.880670 0.553438 tcp 10.0.2.105 50552 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:22:57.433921 0.598947 tcp 10.0.2.105 50553 -> 195.113.214.226 80 SRPA* 0 0 19 14678 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:22:58.033487 0.298668 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:22:58.332664 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:23:13.983268 0.576750 tcp 10.0.2.105 50554 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:23:14.560535 0.612066 tcp 10.0.2.105 50555 -> 195.113.214.226 80 SRPA* 0 0 18 13332 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:23:15.173239 0.380111 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:15.553762 0.307699 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:15.861904 0.272680 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:16.134948 0.288246 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:16.423561 0.422655 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:16.846671 0.582766 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:17.429841 0.436689 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:17.866892 0.391398 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:18.258670 0.388320 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:18.647409 0.473258 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:19.121088 0.488470 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:19.609921 0.388467 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:19.998753 0.359625 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:20.358772 0.428380 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:20.787521 0.381251 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:21.169147 0.366521 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:21.536034 0.306588 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:21.843014 0.298482 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:22.141857 0.334568 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:22.476817 0.600435 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:23.077666 0.433559 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:23.511642 0.351309 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:23.863403 0.302969 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:24.166746 0.493944 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:24.661097 0.300658 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:24.962092 0.464418 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:25.426864 0.385377 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:25.812682 0.286141 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:26.099247 0.297289 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:26.396930 0.297135 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:26.694430 0.304851 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:26.999682 0.346960 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:27.347041 0.278730 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:27.626173 0.326710 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:27.953299 0.299416 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:28.253139 0.278905 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:28.532434 0.313835 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:28.846637 0.616206 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:29.463198 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:23:45.038401 0.571936 tcp 10.0.2.105 50556 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:23:45.610135 0.575995 tcp 10.0.2.105 50557 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:23:46.186421 1.283324 tcp 10.0.2.105 50558 -> 195.113.214.226 443 SRPA* 0 0 24 14778 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:23:47.470390 0.327782 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:47.798584 0.420505 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:48.219437 0.335887 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:48.555710 0.415785 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:48.971860 0.314161 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:23:49.286375 0.000000 udp 10.0.2.105 7010 -> 91.33.238.213 5600 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:24:07.831169 0.566191 tcp 10.0.2.105 50559 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:24:08.397564 0.567141 tcp 10.0.2.105 50560 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:24:08.965066 1.169909 tcp 10.0.2.105 50561 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:27:41.098556 3.001997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 08:27:48.106084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:27:56.107958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:28:12.111122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:28:44.117183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:32:09.963646 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:32:09.963838 1.742274 tcp 10.0.2.105 50562 -> 128.255.183.224 9027 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:34:48.122841 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:34:55.130446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:35:03.132153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:35:19.134703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:35:51.140872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:41:55.147132 3.001138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:42:02.154041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:42:10.155603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:42:26.158664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:42:58.165043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:49:02.170748 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 08:49:09.178220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:49:17.179838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:49:33.182474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:50:05.188659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:54:19.514634 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 08:54:19.514736 0.419022 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:54:19.934148 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:54:37.162729 0.570199 tcp 10.0.2.105 50563 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:54:37.733204 0.578228 tcp 10.0.2.105 50564 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:54:38.311753 1.167515 tcp 10.0.2.105 50565 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:54:39.479979 0.000000 udp 10.0.2.105 7010 -> 91.33.238.213 5600 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:54:58.301325 0.582870 tcp 10.0.2.105 50566 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:54:58.884476 0.555138 tcp 10.0.2.105 50567 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:54:59.439973 1.189712 tcp 10.0.2.105 50568 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:00.630262 0.311349 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:00.942019 0.274045 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:01.216551 0.288455 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:01.505402 0.380049 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:01.885834 0.286921 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:02.173171 0.410155 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:02.583751 0.392143 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:02.976315 0.438303 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:03.414992 0.588700 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:04.004091 0.378826 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:04.383286 0.458660 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:04.842369 0.497108 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:05.339849 0.382657 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:05.722928 0.428451 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:06.151728 0.388006 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:06.540112 0.307875 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:06.848470 0.366312 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:07.215204 0.302387 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:07.517983 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:55:22.866997 0.564549 tcp 10.0.2.105 50569 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:23.431871 0.553454 tcp 10.0.2.105 50570 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:23.985603 1.148307 tcp 10.0.2.105 50571 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:25.134611 0.787233 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:25.922211 0.338684 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:26.261269 0.298906 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:26.560761 0.437034 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:26.998145 0.000000 udp 10.0.2.105 7010 -> 79.27.134.208 2054 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 08:55:45.699635 0.555901 tcp 10.0.2.105 50572 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:46.255777 0.556143 tcp 10.0.2.105 50573 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:46.812284 1.160635 tcp 10.0.2.105 50574 -> 195.113.214.226 443 SRPA* 0 0 21 11734 flow=From-Botnet-V2-TCP-Established 1970/01/05 08:55:47.973548 0.496579 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:48.470525 0.294667 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:48.765599 0.306341 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:49.072541 0.388894 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:49.461801 0.475140 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:49.937371 0.299245 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:50.236995 0.296094 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:50.533493 0.291887 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:50.825746 1.519843 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:52.346010 0.330410 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:52.676827 0.300341 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:52.977592 0.341046 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:53.319033 0.318732 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:53.638124 0.271304 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:53.909823 0.614293 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:54.524544 0.310148 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:54.835100 0.403481 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:55.238991 0.337992 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:55.577395 0.410684 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:55:55.988570 0.433336 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 08:56:09.195021 3.001610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 08:56:16.202048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:56:24.204034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:56:40.206831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 08:57:12.212894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:02:11.714146 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:02:11.714241 1.757604 tcp 10.0.2.105 50575 -> 128.255.183.224 9027 FSPA* 0 0 14 1512 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:03:16.218903 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:03:23.225908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:03:31.227939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:03:47.230333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:04:19.236387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:10:23.242379 3.002292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:10:30.249990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:10:38.251781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:10:54.254463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:11:26.260922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:17:30.266571 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:17:37.273954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:17:45.275259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:18:01.278720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:18:33.284930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:24:37.290803 3.001207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:24:44.297789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:24:52.299209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:25:08.302624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:25:40.308863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:26:24.983230 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:26:24.983368 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:26:43.512765 0.568013 tcp 10.0.2.105 50576 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:26:44.081042 0.588205 tcp 10.0.2.105 50577 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:26:44.669629 1.151115 tcp 10.0.2.105 50578 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:26:45.821415 0.348826 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:26:46.170644 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:27:02.898757 0.557224 tcp 10.0.2.105 50579 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:03.456302 0.560228 tcp 10.0.2.105 50580 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:04.016822 1.167731 tcp 10.0.2.105 50581 -> 195.113.214.226 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:05.185108 0.323880 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:05.509385 0.267623 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:05.777488 0.283770 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:06.061687 0.377582 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:06.439637 0.310059 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:06.750073 0.410728 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:07.161170 0.401058 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:07.562617 0.587899 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:08.150861 0.428758 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:08.580001 0.384570 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:08.964924 0.470990 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:09.436441 0.413916 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:09.850756 0.380326 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:10.231449 0.497020 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:10.728829 0.298180 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:11.027393 0.394024 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:11.421778 0.351055 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:11.773247 0.298862 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:12.072525 1.088423 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:13.161355 0.344204 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:13.505967 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:27:21.186483 0.000000 udp 10.0.2.105 7010 <- 79.253.224.170 2373 RSP 0 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:27:21.186923 0.437275 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:21.624610 0.000000 udp 10.0.2.105 7010 -> 188.193.14.198 4126 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:27:39.851442 0.548721 tcp 10.0.2.105 50582 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:40.400470 0.582079 tcp 10.0.2.105 50583 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:40.982911 1.124029 tcp 10.0.2.105 50584 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:27:42.107678 0.490211 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:42.598308 0.321032 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:42.919744 0.436632 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:43.356800 0.303087 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:43.660475 0.386891 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:44.047723 0.305753 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:44.353875 0.292052 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:44.646336 0.258817 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:44.905564 0.378288 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:45.284228 0.287018 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:45.571602 0.284921 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:45.856932 0.328883 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:27:46.186199 0.000000 udp 10.0.2.105 7010 -> 195.174.204.4 7464 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:28:03.866209 0.563407 tcp 10.0.2.105 50585 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:28:04.429938 0.569961 tcp 10.0.2.105 50586 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:28:05.000167 1.185525 tcp 10.0.2.105 50587 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:28:06.186304 0.622125 udp 10.0.2.105 7010 <-> 1.4.158.188 9209 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:28:06.808828 0.317912 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:28:07.127128 0.392796 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:28:07.520352 0.343530 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:28:07.864438 0.412095 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:28:08.276892 0.331892 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:31:44.315475 3.000503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 09:31:51.322031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:31:59.323292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:32:13.474048 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:32:13.474144 1.699045 tcp 10.0.2.105 50588 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:32:15.326265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:32:47.332474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:38:51.339027 3.000954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:38:58.346038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:39:06.347311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:39:22.350617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:39:54.356217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:45:58.362732 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:46:05.370340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:46:13.371790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:46:29.374221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:47:01.380396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:53:05.387048 3.001191 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 09:53:12.393652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:53:20.395250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:53:36.398219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:54:08.404743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 09:58:36.009904 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 09:58:36.010170 0.424383 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:58:36.434996 0.000000 udp 10.0.2.105 7010 -> 188.193.14.198 4126 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:58:51.654159 0.593308 tcp 10.0.2.105 50589 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:58:52.247740 0.612367 tcp 10.0.2.105 50590 -> 195.113.214.226 80 SRPA* 0 0 19 14657 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:58:52.860750 0.000000 udp 10.0.2.105 7010 -> 195.174.204.4 7464 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:59:11.801852 0.565877 tcp 10.0.2.105 50591 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:12.368052 0.571377 tcp 10.0.2.105 50592 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:12.939720 1.183255 tcp 10.0.2.105 50593 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:14.123556 0.326101 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:14.450154 0.302896 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:14.753455 0.246028 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:14.999849 0.308671 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:15.308908 0.323487 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:15.632797 0.415807 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:16.049036 0.361744 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:16.411144 0.575667 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:16.987179 0.404124 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:17.391677 0.435099 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:17.827206 0.377028 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:18.204650 0.405586 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:18.610600 0.460295 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:19.071329 0.387471 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:19.459134 0.498190 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:19.957697 0.303517 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:20.261583 0.388817 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:20.650770 0.298020 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:20.949129 0.369765 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:21.319258 1.321565 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:22.641238 0.320172 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:22.961844 0.351801 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:23.314045 0.440762 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:23.755180 0.499585 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:24.255101 0.303938 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:24.559462 0.430073 udp 10.0.2.105 7010 <-> 180.188.225.70 9127 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:24.990011 0.292552 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:25.282992 0.385833 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:25.669239 0.302827 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:25.972636 0.253732 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:26.226740 0.274249 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:26.501375 0.317663 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:26.819397 0.356161 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:27.175960 0.295710 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:27.472080 0.280169 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:27.752638 0.320010 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:28.073047 0.000000 udp 10.0.2.105 7010 -> 1.4.158.188 9209 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 09:59:44.819308 0.584624 tcp 10.0.2.105 50594 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:45.404228 0.572916 tcp 10.0.2.105 50595 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:45.977465 1.141216 tcp 10.0.2.105 50596 -> 195.113.214.226 443 SRPA* 0 0 23 13792 flow=From-Botnet-V2-TCP-Established 1970/01/05 09:59:47.119373 0.426940 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:47.546708 0.394213 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:47.941311 0.342121 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 09:59:48.283823 0.395844 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:00:12.411365 3.000604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 10:00:19.418224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:00:27.419726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:00:43.422184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:01:15.428622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:02:15.174635 0.000164 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:02:15.174927 1.720783 tcp 10.0.2.105 50597 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:07:19.435119 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:07:26.441773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:07:34.443438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:07:50.446245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:08:22.452253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:14:26.459205 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:14:33.466114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:14:41.467260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:14:57.470312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:15:29.476510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:21:33.483034 3.000707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:21:40.490094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:21:48.491519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:22:04.494302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:22:36.500444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:28:40.507265 3.000757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:28:47.513658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:28:55.514990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:29:11.518198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:29:43.523962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:30:14.168666 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 10:30:14.168863 0.000000 udp 10.0.2.105 7010 -> 1.4.158.188 9209 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 10:30:29.763513 0.564086 tcp 10.0.2.105 50598 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:30:30.327895 0.550238 tcp 10.0.2.105 50599 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:30:30.878415 1.169458 tcp 10.0.2.105 50600 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:30:32.048691 0.421110 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:32.470224 0.261971 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:32.732638 0.330908 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:33.063941 0.290766 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:33.355133 0.414505 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:33.769973 0.302772 udp 10.0.2.105 7010 <-> 86.184.229.52 7902 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:34.073120 0.312088 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:34.385556 0.579736 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:34.965698 0.380672 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:35.346789 0.426342 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:35.773567 0.402007 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:36.176031 0.393712 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:36.570144 0.422569 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:36.993091 0.461263 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:37.454748 0.386032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:37.841175 0.494355 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:38.335932 0.304480 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:38.640805 0.400928 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:39.042159 0.300377 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:39.342958 0.384078 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:39.727443 0.342837 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:40.070678 0.572575 udp 10.0.2.105 7010 <-> 64.13.5.213 4172 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:40.643652 0.581306 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:41.225359 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 10:30:46.669564 0.000000 udp 10.0.2.105 7010 <- 79.253.224.170 2373 RSP 0 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 10:30:46.669929 0.448807 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:47.119154 0.310139 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:30:47.429616 0.000000 udp 10.0.2.105 7010 -> 180.188.225.70 9127 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 10:31:05.283441 0.570342 tcp 10.0.2.105 50601 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:05.854093 0.567000 tcp 10.0.2.105 50602 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:06.421330 1.157828 tcp 10.0.2.105 50603 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:07.579696 0.293649 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:07.873734 0.262383 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:08.136556 0.287537 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:08.424543 0.386606 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:08.811560 0.362664 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:09.174633 0.342059 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:09.517079 0.294240 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:09.811701 0.302612 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:10.114667 0.301016 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:10.416085 0.314761 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:10.731258 0.415941 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:11.147583 0.406558 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:31:11.554527 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 10:31:28.055257 0.552918 tcp 10.0.2.105 50604 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:28.608509 0.580231 tcp 10.0.2.105 50605 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:29.189049 1.152291 tcp 10.0.2.105 50606 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:31:30.342058 0.465478 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 10:32:16.895254 1.707575 tcp 10.0.2.105 50607 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/05 10:35:47.530714 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 10:35:54.537814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:36:02.539185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:36:18.542062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:36:50.548651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:42:54.554011 3.002185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:43:01.562039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:43:09.562894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:43:25.566038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:43:57.572418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:50:01.579052 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:50:08.585728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:50:16.587284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:50:32.589888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:51:04.596191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:57:08.601623 3.002223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 10:57:15.609854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:57:23.611338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:57:39.613776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 10:58:11.619907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:01:44.854264 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:01:44.854421 0.000000 udp 10.0.2.105 7010 -> 180.188.225.70 9127 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:02:03.836885 0.568659 tcp 10.0.2.105 50608 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:04.405845 0.571279 tcp 10.0.2.105 50609 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:04.977479 1.177120 tcp 10.0.2.105 50610 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:06.155258 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:02:18.605636 1.742082 tcp 10.0.2.105 50611 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:22.352039 0.576889 tcp 10.0.2.105 50612 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:22.929254 0.566418 tcp 10.0.2.105 50613 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:23.496038 1.170963 tcp 10.0.2.105 50614 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:24.667710 0.257136 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:24.925214 0.410604 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:25.336186 0.329843 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:25.666406 0.000000 udp 10.0.2.105 7010 -> 86.184.229.52 7902 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:02:42.811741 0.579842 tcp 10.0.2.105 50615 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:43.391847 0.554207 tcp 10.0.2.105 50616 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:43.946349 1.189219 tcp 10.0.2.105 50617 -> 195.113.214.226 443 SRPA* 0 0 23 14004 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:02:45.137074 0.432595 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:45.570095 0.263639 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:45.834147 0.313928 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:46.148470 0.589296 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:46.738176 0.405369 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:47.143972 0.427496 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:47.571850 0.380903 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:47.953159 0.384541 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:48.338147 0.420519 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:48.759054 0.435887 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:49.195349 0.393136 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:49.588909 0.304450 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:49.893761 0.468616 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:50.362756 0.397281 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:50.760477 0.340810 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:51.101755 0.418056 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:51.520184 0.301170 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:02:51.821757 0.000000 udp 10.0.2.105 7010 -> 64.13.5.213 4172 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:03:10.591468 0.578583 tcp 10.0.2.105 50618 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:03:11.170346 0.570788 tcp 10.0.2.105 50619 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:03:11.741429 1.181643 tcp 10.0.2.105 50620 -> 195.113.214.226 443 SRPA* 0 0 24 13200 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:03:12.923833 0.943637 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:13.867879 0.434825 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:14.303106 0.306948 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:14.610427 0.302148 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:14.912971 0.279513 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:15.192864 0.274089 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:15.467387 0.385205 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:15.852962 0.292270 udp 10.0.2.105 7010 <-> 94.190.76.73 1971 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:16.145630 0.252671 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:16.398692 0.227406 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:16.626464 0.271507 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:16.898315 0.260846 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:17.159613 0.247743 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:17.407897 0.269580 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:17.677893 0.360608 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:18.038906 0.371037 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:03:18.410338 0.319153 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:04:15.625755 3.002378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 11:04:22.633572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:04:30.635233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:04:46.638086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:05:18.644081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:11:22.650745 3.001004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:11:29.657654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:11:37.658772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:11:53.662160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:12:25.667764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:18:29.674037 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:18:36.681630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:18:44.682717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:19:00.686034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:19:32.692142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:25:36.698197 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:25:43.705358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:25:51.706928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:26:07.709853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:26:39.715893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:32:20.346409 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:32:20.346595 1.693160 tcp 10.0.2.105 50621 -> 128.255.183.224 9027 FSPA* 0 0 14 1660 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:32:43.722544 3.001163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:32:50.729304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:32:58.730657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:33:14.734091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:33:23.998001 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 11:33:23.998162 0.000000 udp 10.0.2.105 7010 -> 86.184.229.52 7902 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:33:39.732167 0.550551 tcp 10.0.2.105 50622 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:40.283009 0.582420 tcp 10.0.2.105 50623 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:40.865785 1.156995 tcp 10.0.2.105 50624 -> 195.113.214.226 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:42.023386 0.000000 udp 10.0.2.105 7010 -> 64.13.5.213 4172 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:33:46.741111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:33:57.616678 0.585966 tcp 10.0.2.105 50625 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:58.202947 0.583803 tcp 10.0.2.105 50626 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:58.787048 1.140763 tcp 10.0.2.105 50627 -> 195.113.214.226 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:33:59.928621 0.268704 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:00.197678 0.422462 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:00.620516 0.317585 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:00.938510 0.412308 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:01.351187 0.285919 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:01.637524 0.310330 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:01.948492 0.574511 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:02.523394 0.529934 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:03.053732 0.426009 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:03.480134 0.370247 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:03.850802 0.441460 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:04.292682 0.391251 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:04.684499 0.426241 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:05.111147 0.371994 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:05.483578 0.306600 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:05.790577 0.337679 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:06.128647 0.370675 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:06.499703 0.486970 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:06.987054 0.429624 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:07.417012 0.302039 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:07.719402 0.498815 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:08.218577 0.297097 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:08.516030 0.294038 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:08.810481 0.440717 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:09.251588 2.921137 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:12.173138 0.402168 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:12.575712 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 11:34:30.854765 0.567199 tcp 10.0.2.105 50628 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:34:31.422296 0.606733 tcp 10.0.2.105 50629 -> 195.113.214.226 80 SRPA* 0 0 19 13414 flow=From-Botnet-V2-TCP-Established 1970/01/05 11:34:32.029515 0.267174 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:32.297127 0.289372 udp 10.0.2.105 7010 <-> 5.13.50.246 2778 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:32.586861 0.323695 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:32.910953 0.298593 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:33.209884 0.320457 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:33.530679 0.309474 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:33.840553 0.420039 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:34.260935 0.294058 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:34.555350 0.406248 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:34:34.961946 0.386209 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 11:39:50.747325 3.001398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 11:39:57.753078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:40:05.755048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:40:21.757562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:40:53.763832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:46:57.770708 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:47:04.777273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:47:12.778833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:47:28.782066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:48:00.788083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:54:04.793916 3.001979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 11:54:11.801513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:54:19.802614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:54:35.805977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 11:55:07.812302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:01:11.818322 3.001027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:01:18.825049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:01:26.826796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:01:42.829817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:02:14.835541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:02:22.046818 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:02:22.046920 1.731204 tcp 10.0.2.105 50630 -> 128.255.183.224 9027 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:04:47.225070 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:04:47.225168 0.000000 udp 10.0.2.105 7010 -> 94.190.76.73 1971 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:05:02.409764 0.590262 tcp 10.0.2.105 50631 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:03.000370 0.589666 tcp 10.0.2.105 50632 -> 195.113.214.226 80 SRPA* 0 0 20 14742 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:03.590523 0.250961 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:03.841870 0.411620 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:04.253897 0.307973 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:04.562250 0.419216 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:04.981837 0.279169 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:05.261460 0.317305 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:05.579168 0.383996 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:05.963544 0.579682 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:06.543631 0.434557 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:06.978587 0.392507 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:07.371491 0.414401 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:07.786293 0.384378 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:08.171109 0.468133 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:08.639637 0.325850 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:08.965875 0.400997 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:09.367220 0.299373 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:09.666960 0.498930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:10.166279 0.375259 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:10.541935 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:05:27.774272 0.546413 tcp 10.0.2.105 50633 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:28.320950 0.579431 tcp 10.0.2.105 50634 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:28.900684 1.150997 tcp 10.0.2.105 50635 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:30.052413 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:05:48.625120 0.565361 tcp 10.0.2.105 50636 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:49.190789 0.568806 tcp 10.0.2.105 50637 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:49.759925 1.116907 tcp 10.0.2.105 50638 -> 195.113.214.226 443 SRPA* 0 0 23 13338 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:05:50.877514 0.503791 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:51.381698 0.314622 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:51.696694 0.286493 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:51.983590 0.434784 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:52.418787 3.183776 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:55.602995 0.390829 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:55.994242 0.258449 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:05:56.253093 0.000000 udp 10.0.2.105 7010 -> 5.13.50.246 2778 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:06:14.642282 0.570171 tcp 10.0.2.105 50639 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:06:15.212258 0.578989 tcp 10.0.2.105 50640 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:06:15.791561 1.160889 tcp 10.0.2.105 50641 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:06:16.952041 0.331525 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:17.283927 0.312672 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:17.596991 0.411343 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:18.008671 0.314310 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:18.323360 0.312778 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:18.637037 0.268072 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:18.905491 0.411142 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:06:19.317041 0.319696 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:08:18.842740 3.000559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 12:08:25.848903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:08:33.851811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:08:49.853648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:09:21.860061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:15:25.866783 3.000507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:15:32.873164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:15:40.874554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:15:56.877521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:16:28.883559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:22:32.890177 3.001361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:22:39.897080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:22:47.899039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:23:03.901803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:23:35.908031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:29:39.914230 3.000815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:29:46.931300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:29:54.933039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:30:10.936007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:30:42.941865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:32:23.777675 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:32:23.777787 1.721905 tcp 10.0.2.105 50642 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:36:21.989493 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 12:36:21.989633 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:36:40.228106 0.580552 tcp 10.0.2.105 50643 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:36:40.808979 0.577292 tcp 10.0.2.105 50644 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:36:41.386556 1.154170 tcp 10.0.2.105 50645 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:36:42.541330 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:36:46.948672 3.000504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 12:36:53.955487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:36:59.945081 0.568745 tcp 10.0.2.105 50646 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:37:00.514115 0.612178 tcp 10.0.2.105 50647 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:37:01.126636 0.000000 udp 10.0.2.105 7010 -> 5.13.50.246 2778 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 12:37:01.956502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:37:17.959313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:37:19.122846 0.576860 tcp 10.0.2.105 50648 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:37:19.700017 0.563801 tcp 10.0.2.105 50649 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:37:20.264078 1.120691 tcp 10.0.2.105 50650 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 12:37:21.385551 0.482481 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:21.868673 0.428669 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:22.297734 0.416237 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:22.714608 0.356882 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:23.071875 0.293042 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:23.365310 0.896704 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:24.262371 0.308691 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:24.571489 0.583186 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:25.155051 0.441750 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:25.597223 0.418459 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:26.016109 0.380790 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:26.397262 0.389659 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:26.787343 0.346304 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:27.133989 0.467422 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:27.601793 0.373520 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:27.975697 0.307475 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:28.283504 0.481714 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:28.765609 0.392317 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:29.158325 0.299418 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:29.458167 0.488908 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:29.947491 0.494430 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:30.442254 0.438173 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:30.880822 0.405253 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:31.286472 0.299840 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:31.586657 0.247856 udp 10.0.2.105 7010 <-> 89.173.192.157 7663 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:31.834895 0.315523 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:32.150870 0.399017 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:32.550328 0.307033 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:32.857757 0.281921 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:33.140046 0.303572 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:33.443968 0.319709 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:33.764010 0.403292 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:34.167658 0.329883 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 12:37:49.965627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:43:53.972636 3.000698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:44:00.978869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:44:08.980589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:44:24.983490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:44:56.989319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:51:00.996490 3.000680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:51:08.002762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:51:16.004561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:51:32.007761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:52:04.013762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:58:08.019887 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 12:58:15.026858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:58:23.028222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:58:39.031692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 12:59:11.037423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:02:25.507676 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:02:25.507823 1.712996 tcp 10.0.2.105 50651 -> 128.255.183.224 9027 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:05:15.043126 3.002362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:05:22.050798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:05:30.052776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:05:46.055180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:06:18.061656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:07:37.586581 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:07:37.586704 0.272207 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:37.859346 0.349454 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:38.209204 0.417862 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:38.627515 0.420303 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:39.048212 0.286269 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:39.334921 0.416398 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:39.751678 0.300698 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:40.052783 0.596721 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:40.649885 0.427086 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:41.077390 0.413459 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:41.491261 0.337396 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:41.829086 0.364768 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:42.194251 0.397599 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:42.592399 0.292837 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:42.885650 0.472493 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:43.358494 0.380807 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:43.739708 0.494008 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:44.234126 0.439355 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:07:44.673884 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:08:03.295616 0.569230 tcp 10.0.2.105 50652 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:03.864694 0.569957 tcp 10.0.2.105 50653 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:04.434957 1.191578 tcp 10.0.2.105 50654 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:05.627233 0.498258 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:06.125849 0.289406 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:06.415596 0.441303 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:06.857278 0.390074 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:07.247721 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:08:24.254476 0.555563 tcp 10.0.2.105 50655 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:24.810357 0.571662 tcp 10.0.2.105 50656 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:25.382265 1.172911 tcp 10.0.2.105 50657 -> 195.113.214.226 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:26.555861 0.000000 udp 10.0.2.105 7010 -> 89.173.192.157 7663 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:08:45.414508 0.565799 tcp 10.0.2.105 50658 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:45.980643 0.577031 tcp 10.0.2.105 50659 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:46.557560 1.169149 tcp 10.0.2.105 50660 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:08:47.727534 0.345239 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:48.073193 0.298922 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:48.372473 0.405499 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:48.778349 0.306642 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:49.085374 0.417874 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:49.503627 0.306603 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:49.810655 0.310899 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:08:50.121993 0.317102 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:12:22.067657 3.001233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 13:12:29.075261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:12:37.076193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:12:53.079237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:13:25.085715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:19:29.091369 3.001646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:19:36.098899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:19:44.100711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:20:00.103750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:20:32.109654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:26:36.115943 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:26:43.123082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:26:51.124426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:27:07.127603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:27:39.133386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:32:27.228098 0.000212 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:32:27.228417 1.669761 tcp 10.0.2.105 50661 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:33:43.139215 3.001909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:33:50.146778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:33:58.148111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:34:14.151208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:34:46.157900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:39:00.654166 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 13:39:00.654358 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:39:18.832832 0.587119 tcp 10.0.2.105 50662 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:19.420431 0.608877 tcp 10.0.2.105 50663 -> 195.113.214.226 80 SRPA* 0 0 20 14744 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:20.029808 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:39:37.046855 0.577992 tcp 10.0.2.105 50664 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:37.625092 0.567829 tcp 10.0.2.105 50665 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:38.193188 1.326820 tcp 10.0.2.105 50666 -> 195.113.214.226 443 SRPA* 0 0 35 25459 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:39.520765 0.000000 udp 10.0.2.105 7010 -> 89.173.192.157 7663 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:39:55.974244 0.573090 tcp 10.0.2.105 50667 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:56.547627 0.577172 tcp 10.0.2.105 50668 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:57.125093 1.367994 tcp 10.0.2.105 50669 -> 195.113.214.226 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:39:58.493796 0.270534 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:39:58.764712 0.313348 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:39:59.078462 0.416384 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:39:59.495177 0.422022 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:39:59.917566 0.316522 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:00.234446 0.289235 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:00.524083 0.495091 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:01.019582 0.436275 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:01.456410 0.584866 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:02.041690 0.381621 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:02.423653 0.425171 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:02.849216 0.348321 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:03.197943 0.306224 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:03.504551 0.391656 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:03.896626 0.488324 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:04.385368 0.386305 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:04.772075 0.470177 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:05.242639 0.404435 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:05.647496 0.511358 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:06.159238 0.440267 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:06.599956 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:40:22.872873 0.574150 tcp 10.0.2.105 50670 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:40:23.447319 0.554165 tcp 10.0.2.105 50671 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:40:24.001336 1.154251 tcp 10.0.2.105 50672 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:40:25.156200 0.397257 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:25.553845 0.347094 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:25.901339 0.404259 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:26.305992 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 13:40:44.002954 0.563534 tcp 10.0.2.105 50673 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:40:44.566751 0.610673 tcp 10.0.2.105 50674 -> 195.113.214.226 80 SRPA* 0 0 19 14677 flow=From-Botnet-V2-TCP-Established 1970/01/05 13:40:45.178061 0.270859 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:45.449321 0.312216 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:45.761961 0.410126 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:46.172516 0.299693 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:46.472605 0.331510 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/05 13:40:50.163721 3.001585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 13:40:57.170857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:41:05.172559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:41:21.175281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:41:53.181401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:47:57.187579 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:48:04.194891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:48:12.196384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:48:28.199492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:49:00.205637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:55:04.211353 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 13:55:11.218680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:55:19.220532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:55:35.223020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 13:56:07.229485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:02:11.236035 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:02:18.243793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:02:26.244029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:02:28.898807 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:02:28.898964 1.701118 tcp 10.0.2.105 50675 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:02:42.246923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:03:14.253395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:09:18.259371 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:09:25.266736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:09:33.268079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:09:49.270962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:10:21.277375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:11:00.073556 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:11:00.073644 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 14:11:17.831019 0.558594 tcp 10.0.2.105 50676 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:18.389855 0.574683 tcp 10.0.2.105 50677 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:18.964804 1.353743 tcp 10.0.2.105 50678 -> 195.113.214.226 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:20.319135 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 14:11:37.618249 0.576317 tcp 10.0.2.105 50679 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:38.194849 0.571468 tcp 10.0.2.105 50680 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:38.766613 1.346235 tcp 10.0.2.105 50681 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:11:40.113565 0.268851 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:40.382872 0.318635 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:40.701836 0.412096 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:41.114345 0.415414 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:41.530162 0.305725 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:41.836453 0.384709 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:42.221597 0.279696 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:42.501707 0.427505 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:42.929628 0.585529 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:43.515541 0.428355 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:43.944323 0.382964 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:44.327685 0.342957 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:44.671061 0.302732 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:44.974147 0.377581 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:45.352088 0.378636 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:45.731106 0.494489 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:46.226034 0.476870 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:46.703287 0.401755 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:47.105396 0.499381 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:47.605178 0.433689 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:48.039216 0.402428 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:48.442047 0.326283 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:48.768713 0.404027 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:49.173187 0.410505 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:49.584100 0.289822 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:49.874323 0.307037 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:11:50.181698 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 14:12:06.279438 0.548748 tcp 10.0.2.105 50682 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:12:06.828548 0.601351 tcp 10.0.2.105 50683 -> 195.113.214.226 80 SRPA* 0 0 18 8384 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:12:07.430198 0.320925 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:16:25.283264 3.001941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 14:16:32.290585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:16:40.292406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:16:56.294840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:17:28.301135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:23:32.307148 3.001817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:23:39.314723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:23:47.315785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:24:03.319170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:24:35.324936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:30:39.331553 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:30:46.338541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:30:54.340510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:31:10.342990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:31:42.349265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:32:30.599172 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:32:30.599268 1.920334 tcp 10.0.2.105 50684 -> 128.255.183.224 9027 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:37:46.354570 3.002011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:37:53.362686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:38:01.363760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:38:17.367061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:38:49.373317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:42:28.468786 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 14:42:28.468917 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 14:42:46.256473 0.569262 tcp 10.0.2.105 50685 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:42:46.825946 0.613672 tcp 10.0.2.105 50686 -> 195.113.214.226 80 SRPA* 0 0 20 14754 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:42:47.440108 0.428801 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:47.869324 0.274401 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:48.144110 0.326851 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:48.471334 0.411404 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:48.883137 0.297424 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:49.180929 0.387756 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:49.569072 0.433236 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:50.002684 0.280608 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:50.283683 0.590197 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:50.874289 0.429549 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:51.304385 0.377126 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:51.681920 0.341351 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:52.023719 0.296829 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:52.320964 0.505519 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:52.826901 0.384317 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:42:53.211583 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 14:43:08.276452 0.586183 tcp 10.0.2.105 50687 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:43:08.862943 0.560585 tcp 10.0.2.105 50688 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:43:09.423776 1.355376 tcp 10.0.2.105 50689 -> 195.113.214.226 443 SRPA* 0 0 38 27931 flow=From-Botnet-V2-TCP-Established 1970/01/05 14:43:10.779859 0.388446 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:11.168680 0.462930 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:11.631977 0.492968 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:12.125310 0.442884 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:12.568746 0.412128 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:12.981262 0.321418 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:13.303039 0.387950 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:13.691344 0.403784 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:14.095542 0.271392 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:14.367304 0.312200 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:43:14.679877 0.316168 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 14:44:53.379535 3.000986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/05 14:45:00.386172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:45:08.388110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:45:24.391070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:45:56.396745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:52:00.403591 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:52:07.410334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:52:15.411820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:52:31.415248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:53:03.420970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:59:07.427405 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 14:59:14.434118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:59:22.436355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 14:59:38.438809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:00:10.445234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:02:32.520162 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:02:32.520275 1.649463 tcp 10.0.2.105 50690 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:06:14.450774 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:06:21.458245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:06:29.459795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:06:45.462732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:07:17.468636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:13:21.474519 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:13:28.482034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:13:36.483894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:13:41.160926 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:13:41.161173 0.388876 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:41.550458 0.424807 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:41.975676 0.271411 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:42.247434 0.318532 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:42.566368 0.414610 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:42.981392 0.320072 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:43.301828 0.433592 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:43.735818 0.398955 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:44.135216 0.588955 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:44.724569 0.293362 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:45.018320 0.436808 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:45.455490 0.386220 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:45.842118 0.341560 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:46.184075 0.372977 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:46.557445 0.495635 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:47.053434 0.303320 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:47.357153 0.409627 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:47.767146 0.482003 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:48.249541 0.545985 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:48.795890 0.437043 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:49.233335 0.400693 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:49.634432 0.330119 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:49.964918 0.372461 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:50.337726 0.390097 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:50.728458 0.426670 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:51.155496 0.283091 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:51.439001 0.318077 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:13:52.486641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:14:24.493040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:20:28.498975 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:20:35.506005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:20:43.507897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:20:59.510721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:21:31.517135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:27:35.523034 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:27:42.530181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:27:50.531469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:28:06.534662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:28:38.540942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:32:34.169968 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:32:34.170146 2.154578 tcp 10.0.2.105 50691 -> 128.255.183.224 9027 FSPA* 0 0 14 1512 flow=From-Botnet-V2-TCP-Established 1970/01/05 15:34:42.547044 3.001113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:34:49.554541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:34:57.555534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:35:13.558717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:35:45.564494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:41:49.570608 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:41:56.577884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:42:04.579564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:42:20.582526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:42:52.589011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:43:59.054701 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 15:43:59.054958 0.278166 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:43:59.333549 0.368509 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:43:59.702415 0.405174 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:00.107952 0.303212 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:00.411578 0.410133 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:00.822090 0.306334 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:01.128795 0.446093 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:01.575275 0.389692 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:01.965376 0.587884 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:02.553699 0.288624 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:02.842727 0.341026 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:03.184140 0.415120 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:03.599667 0.375181 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:03.975267 0.379930 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:04.355592 0.502449 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:04.858438 0.475490 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:05.334298 0.303733 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:05.638362 0.385986 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:06.025287 0.480215 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:06.505896 0.438266 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:06.944587 0.405175 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:07.350112 0.327250 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:07.677757 0.344495 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:08.022664 0.386807 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:08.409870 0.388218 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:08.798538 0.277129 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:44:09.076068 0.334773 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/05 15:48:56.595511 3.000603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:49:03.602039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:49:11.603772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:49:27.606797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:49:59.612414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:56:03.618483 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 15:56:10.625844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:56:18.627967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:56:34.630894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 15:57:06.636941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:02:36.331603 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:02:36.331817 1.739595 tcp 10.0.2.105 50692 -> 128.255.183.224 9027 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:03:10.642886 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:03:17.649904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:03:25.651308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:03:41.654288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:04:13.660708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:10:17.666993 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:10:24.673749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:10:32.675833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:10:48.678461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:11:20.684301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:14:32.911652 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:14:32.911906 0.419516 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:33.331881 0.264179 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:33.596437 0.380239 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:33.977074 0.301488 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:34.278944 0.308512 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:34.587819 0.475448 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:35.063683 0.431841 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:35.495908 0.399407 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:35.895747 0.319927 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:36.216019 0.581607 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:36.797999 0.277817 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:37.076227 0.407057 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:37.483682 0.395914 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:37.879941 0.387621 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:38.267978 0.493064 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:38.761421 0.392350 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:39.154147 0.459806 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:39.614277 0.313095 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:39.927718 0.509544 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:40.437609 0.451061 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:40.889013 0.410587 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:41.299930 0.324136 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:41.624500 0.312234 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:41.937068 0.272797 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:42.210226 0.381201 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:42.591829 0.403948 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:14:42.996203 0.296676 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:17:24.691314 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:17:31.698374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:17:39.699211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:17:55.702765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:18:27.708341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:24:31.715332 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:24:38.721697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:24:46.723593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:25:02.726449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:25:34.732700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:31:38.741023 2.999606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:31:45.745833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:31:53.747697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:32:09.750253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:32:38.072266 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:32:38.072470 1.788780 tcp 10.0.2.105 50693 -> 128.255.183.224 9027 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/01/05 16:32:41.756724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:38:45.763278 3.000999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:38:52.769837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:39:00.771663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:39:16.774503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:39:48.780330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:44:57.905229 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 16:44:57.905404 0.380532 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:58.286334 0.303000 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:58.589733 0.357189 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:58.947297 0.211831 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:59.159528 0.273756 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:59.433695 0.380558 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:44:59.814597 0.323674 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:00.138621 0.439581 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:00.578555 0.407999 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:00.986954 0.587640 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:01.574984 0.290062 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:01.865411 0.415666 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:02.281456 0.390889 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:02.672735 0.381888 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:03.055047 0.493626 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:03.549076 0.392895 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:03.942369 0.463092 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:04.405854 0.301297 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:04.707507 0.523158 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:05.231031 0.433443 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:05.664874 0.414022 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:06.079300 0.312901 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:06.392609 0.313731 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:06.706737 0.274096 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:06.981237 0.383152 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:07.364793 0.401749 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:07.766930 0.317846 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 16:45:52.786330 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:45:59.794005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:46:07.795074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:46:23.798169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:46:55.804388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:52:59.811207 3.000578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 16:53:06.818058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:53:14.819720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:53:30.822634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 16:54:02.828089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:00:06.835078 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:00:13.841992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:00:21.843654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:00:37.847033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:01:09.852761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:02:39.862377 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:02:39.862471 1.710543 tcp 10.0.2.105 50694 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:07:13.858885 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:07:20.865930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:07:28.867327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:07:44.870167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:08:16.876424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:14:20.883161 3.000717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:14:27.890137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:14:35.891279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:14:51.894285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:15:23.900179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:15:25.392628 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:15:25.392735 0.422830 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:25.815998 0.271684 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:26.088025 0.385538 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:26.474082 0.309664 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:26.784156 0.311292 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:27.095860 0.408590 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:27.504845 0.345650 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:27.850913 0.454495 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:28.305817 0.394000 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:28.700250 0.593717 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:29.294327 0.301538 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:29.596418 0.417593 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:30.014366 0.388499 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:30.403281 0.399318 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:30.803031 0.495703 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:31.299088 0.388768 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:31.688261 0.497796 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:32.186469 0.458317 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:32.645193 0.313150 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:32.958685 0.436654 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:33.395729 0.423432 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:33.819555 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 17:15:51.512435 0.572962 tcp 10.0.2.105 50695 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:15:52.085284 0.562028 tcp 10.0.2.105 50696 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:15:52.647229 1.145718 tcp 10.0.2.105 50697 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:15:53.793653 0.348672 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:54.142722 0.322711 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:54.465803 0.316800 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:54.783001 0.386614 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:15:55.169953 0.395195 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:21:27.907319 3.000413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:21:34.914071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:21:42.915470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:21:58.918446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:22:30.924092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:28:34.930170 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:28:41.937503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:28:49.939120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:29:05.942023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:29:37.947941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:32:41.572869 0.000215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:32:41.573216 1.705285 tcp 10.0.2.105 50698 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:35:41.954458 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:35:48.961744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:35:56.963265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:36:12.966579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:36:44.972085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:42:48.977977 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:42:55.985877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:43:03.986819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:43:19.990505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:43:51.996052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:45:55.994805 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 17:45:55.994960 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 17:46:12.200717 0.552556 tcp 10.0.2.105 50699 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:46:12.753527 0.569248 tcp 10.0.2.105 50700 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:46:13.323122 1.114019 tcp 10.0.2.105 50701 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/05 17:46:14.437876 0.428338 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:14.866592 0.267139 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:15.134129 0.381961 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:15.516488 0.308159 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:15.825000 0.311820 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:16.137219 0.353895 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:16.491472 0.424474 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:16.916359 0.428152 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:17.344915 0.393539 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:17.738813 0.586619 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:18.325808 0.283294 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:18.609489 0.440625 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:19.050445 0.390638 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:19.441487 0.382282 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:19.824177 0.509466 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:20.334040 0.478956 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:20.813347 0.388845 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:21.202538 0.310739 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:21.513670 0.457460 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:21.971504 0.408011 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:22.379922 0.420285 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:22.800616 0.324022 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:23.125036 0.378157 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:23.503542 0.303188 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:23.807135 0.314719 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:46:24.122245 0.397483 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 17:49:56.002904 3.001022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:50:03.009594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:50:11.011012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:50:27.013990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:50:59.020578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:57:03.026590 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 17:57:10.033356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:57:18.034731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:57:34.037877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 17:58:06.044016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:02:43.283138 0.000188 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:02:43.283436 1.800228 tcp 10.0.2.105 50702 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:04:10.050725 3.000947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:04:17.057890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:04:25.059218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:04:41.062255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:05:13.068027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:11:17.073931 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:11:24.081758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:11:32.083400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:11:48.085997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:12:20.092036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:16:50.040423 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:16:50.040535 0.419532 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:50.460503 0.260687 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:50.721661 0.307665 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:51.029730 0.374054 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:51.404205 0.300960 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:51.705592 0.348162 udp 10.0.2.105 7010 <-> 194.190.32.248 9712 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:52.054213 0.413587 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:52.468492 0.431949 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:52.900831 0.388807 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:53.290071 0.422770 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:53.713257 0.578558 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:54.294106 0.284795 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:54.579294 0.367932 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:54.947695 0.374129 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:55.322235 0.389460 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:55.712031 0.516226 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:56.228648 0.485591 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:56.714634 0.313505 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:57.028694 0.457171 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:57.486275 0.411783 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:57.898451 0.427502 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:16:58.326380 0.000000 udp 10.0.2.105 7010 -> 62.106.17.88 6418 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 18:17:13.436767 0.546750 tcp 10.0.2.105 50703 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:17:13.983809 0.559525 tcp 10.0.2.105 50704 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:17:14.543668 1.134616 tcp 10.0.2.105 50705 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:17:15.679042 0.310191 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:17:15.989626 0.387904 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:17:16.377997 0.311515 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:17:16.689840 0.401627 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:18:24.098358 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:18:31.105293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:18:39.106909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:18:55.109927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:19:27.116422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:25:31.122402 3.001198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:25:38.130563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:25:46.131203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:26:02.133658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:26:34.140291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:32:38.146241 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:32:45.084165 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:32:45.084284 1.692425 tcp 10.0.2.105 50706 -> 128.255.183.224 9027 FSPA* 0 0 15 1645 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:32:45.153519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:32:53.154927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:33:09.157769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:33:41.164081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:39:45.170096 3.001379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:39:52.177583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:40:00.178587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:40:16.181958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:40:48.187582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:46:52.194859 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:46:59.201377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:47:07.203145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:47:23.205537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:47:28.173446 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 18:47:28.173607 0.335564 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:47:28.509535 0.000000 udp 10.0.2.105 7010 -> 79.27.134.208 2054 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 18:47:45.019857 0.558944 tcp 10.0.2.105 50707 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:47:45.579088 0.558180 tcp 10.0.2.105 50708 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:47:46.137557 1.114423 tcp 10.0.2.105 50709 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:47:47.252588 0.422787 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:47:47.675716 0.267521 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:47:47.943666 0.000000 udp 10.0.2.105 7010 -> 194.190.32.248 9712 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 18:47:55.211794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:48:06.288898 0.560158 tcp 10.0.2.105 50710 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:48:06.849338 0.563575 tcp 10.0.2.105 50711 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:48:07.413172 1.114677 tcp 10.0.2.105 50712 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/05 18:48:08.528722 0.395883 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:08.924943 0.322209 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:09.247578 0.408687 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:09.656612 0.444254 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:10.101279 0.480672 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:10.582339 0.425485 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:11.008346 0.390454 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:11.399164 0.570796 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:11.970321 0.293100 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:12.263772 0.383808 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:12.647973 0.398470 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:13.046816 0.469759 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:13.516972 0.503555 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:14.020935 0.303499 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:14.324836 0.457653 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:14.782841 0.414835 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:15.198071 0.642298 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:15.840718 0.312492 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:16.153796 0.401468 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:16.555670 0.389359 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:48:16.945376 0.325423 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 18:53:59.218084 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 18:54:06.225166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:54:14.227055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:54:30.229653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 18:55:02.236053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:01:06.242774 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:01:13.249362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:01:21.250897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:01:37.253731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:02:09.259815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:02:46.784137 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:02:46.784277 1.710749 tcp 10.0.2.105 50713 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:08:13.266580 3.000536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:08:20.273305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:08:28.274918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:08:44.278113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:09:16.283936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:15:20.290614 3.000709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:15:27.297133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:15:35.298595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:15:51.301894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:16:23.308111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:18:26.965809 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:18:26.966058 0.301198 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:27.267654 0.000000 udp 10.0.2.105 7010 -> 194.190.32.248 9712 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/05 19:18:45.948545 0.568877 tcp 10.0.2.105 50714 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:18:46.517692 0.605997 tcp 10.0.2.105 50715 -> 195.113.214.226 80 SRPA* 0 0 20 14675 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:18:47.124286 0.325956 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:47.450599 0.416083 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:47.867087 0.246471 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:48.113916 0.378530 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:48.492883 0.309739 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:48.802965 0.410517 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:49.213897 0.432422 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:49.646743 0.369418 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:50.016514 0.412478 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:50.429411 0.399663 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:50.829435 0.578740 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:51.408594 0.302066 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:51.711059 0.381548 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:52.093019 0.392969 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:52.486335 0.486065 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:52.972741 0.530322 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:53.503527 0.305263 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:53.809161 0.439988 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:54.249539 0.412492 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:54.662377 0.432596 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:55.095393 0.326206 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:55.421983 0.324205 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:55.746564 0.406748 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:18:56.153748 0.388666 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:22:27.314706 3.000589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:22:34.321029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:22:42.322737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:22:58.325571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:23:30.331852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:29:34.338353 3.000847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:29:41.345440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:29:49.346498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:30:05.349629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:30:37.355349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:32:48.495128 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:32:48.495228 1.749206 tcp 10.0.2.105 50716 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/05 19:36:41.361690 3.001807 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:36:48.369193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:36:56.370488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:37:12.373832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:37:44.379541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:43:48.385568 3.001596 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:43:55.392779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:44:03.394328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:44:19.397832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:44:51.403603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:48:59.340220 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 19:48:59.340344 0.320395 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:48:59.661156 0.274344 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:48:59.935910 0.335755 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:00.272068 0.418616 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:00.691084 0.384702 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:01.076179 0.306696 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:01.383270 0.404546 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:01.788228 0.435250 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:02.223885 0.395751 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:02.620036 0.425523 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:03.045995 0.376146 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:03.422545 0.577528 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:04.000625 0.290751 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:04.291781 0.384916 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:04.677096 0.379617 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:05.057132 0.465902 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:05.523376 0.484761 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:06.008614 0.507477 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:06.516464 0.302341 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:06.819236 0.421469 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:07.241135 0.433647 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:07.675111 0.401585 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:08.077085 0.314682 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:08.392162 0.320696 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:49:08.713297 0.388256 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/05 19:50:55.409133 3.001983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:51:02.417321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:51:10.418171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:51:26.421517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:51:58.427706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:58:02.433871 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 19:58:09.441052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:58:17.442822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:58:33.445809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 19:59:05.451446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:02:50.245304 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:02:50.245519 1.693483 tcp 10.0.2.105 50717 -> 128.255.183.224 9027 FSPA* 0 0 14 1703 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:05:09.457784 3.001752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:05:16.504965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:05:24.506155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:05:40.509602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:06:12.515497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:12:16.521802 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:12:23.528800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:12:31.530478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:12:47.533326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:13:19.539302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:19:23.545225 3.002330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:19:30.553214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:19:38.404602 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:19:38.404859 0.332371 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:38.554326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:19:38.737593 0.311193 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:39.049185 0.268154 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:39.317749 0.419329 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:39.737471 0.393642 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:40.131457 0.326540 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:40.458401 0.416208 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:40.875008 0.431745 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:41.307158 0.392335 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:41.699913 0.425088 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:42.125418 0.371631 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:42.497413 0.594046 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:43.091859 0.285343 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:43.377613 0.397465 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:43.775455 0.369899 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:44.145778 0.469152 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:44.615309 0.468077 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:45.083854 0.404061 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:45.488289 0.520708 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:46.009407 0.301192 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:46.310925 0.440204 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:46.751513 0.406746 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:47.158699 0.382560 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:47.541659 0.321580 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:47.863674 0.318135 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:19:54.557641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:20:26.563876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:26:30.570129 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:26:37.577219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:26:45.578098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:27:01.581713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:27:33.587716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:32:51.955525 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:32:51.955622 1.749778 tcp 10.0.2.105 50718 -> 128.255.183.224 9027 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/01/05 20:33:37.593325 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:33:44.600529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:33:52.602131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:34:08.605339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:34:40.611754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:40:44.618212 3.001018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:40:51.625117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:40:59.626437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:41:15.629504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:41:47.635426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:47:51.641392 3.001714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:47:58.649046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:48:06.650058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:48:22.653171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:48:54.659664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:50:06.883616 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 20:50:06.883759 0.326659 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:07.210834 0.322327 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:07.533505 0.404719 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:07.938655 0.261709 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:08.200778 0.422112 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:08.623285 0.311877 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:08.935533 0.409932 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:09.345836 0.411787 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:09.758084 0.439842 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:10.198313 0.399818 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:10.598452 0.391434 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:10.990318 0.592062 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:11.582782 0.268380 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:11.851524 0.392461 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:12.244601 0.399935 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:12.644922 0.449338 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:13.094604 0.456785 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:13.551755 0.423182 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:13.975356 0.514579 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:14.490291 0.307181 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:14.797869 0.960600 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:15.758807 0.412360 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:16.171532 0.313217 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:16.485139 0.389565 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:50:16.875128 0.318236 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/05 20:54:58.666114 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 20:55:05.672935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:55:13.673977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:55:29.677454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 20:56:01.683511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:02:05.689801 3.001148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:02:12.696817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:02:20.698507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:02:36.701365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:02:53.706248 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:02:53.706383 1.772161 tcp 10.0.2.105 50719 -> 128.255.183.224 9027 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:03:08.707302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:09:12.713900 3.000715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:09:19.720817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:09:27.722016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:09:43.725497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:10:15.730973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:16:19.737381 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:16:26.745718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:16:34.746862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:16:50.750303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:17:22.755235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:20:29.033882 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:20:29.034101 0.329375 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:29.363833 0.356695 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:29.720942 0.342061 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:30.063379 0.402476 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:30.466246 0.424530 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:30.891172 0.318245 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:31.209800 0.432886 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:31.643103 0.424395 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:32.067929 0.418972 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:32.487309 0.392634 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:32.880397 0.402233 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:33.283025 0.575500 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:33.858932 0.258743 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:34.118084 0.394740 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:34.513233 0.391296 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:34.904903 0.519014 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:35.424280 0.458676 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:35.883388 0.420029 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:36.303835 0.503690 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:36.807971 0.313724 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:37.122043 0.897481 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:38.019930 0.422449 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:38.442740 0.305983 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:38.749130 0.446906 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:20:39.196589 0.391401 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:23:26.761250 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:23:33.768900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:23:41.770003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:23:57.773027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:24:29.779238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:30:33.785816 3.001199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:30:40.792740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:30:48.793908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:31:04.796774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:31:36.803540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:32:55.486819 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:32:55.486921 1.702333 tcp 10.0.2.105 50720 -> 128.255.183.224 9027 FSPA* 0 0 12 1436 flow=From-Botnet-V2-TCP-Established 1970/01/05 21:37:40.809420 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:37:47.816670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:37:55.818079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:38:11.821317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:38:44.017696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:44:48.023897 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:44:55.030705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:45:03.032717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:45:19.035485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:45:51.041152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:51:08.728862 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 21:51:08.728963 0.316604 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:09.045990 0.349843 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:09.396260 0.240798 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:09.637418 0.375117 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:10.012954 0.416475 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:10.429838 0.300644 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:10.730971 0.452667 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:11.184090 0.409443 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:11.593942 0.384963 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:11.979284 0.439900 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:12.419613 0.412328 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:12.832479 0.589903 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:13.422759 0.290462 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:13.713622 0.401016 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:14.115048 0.380806 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:14.496256 0.454681 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:14.951343 0.477843 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:15.429563 0.403280 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:15.833247 0.507766 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:16.341382 0.301774 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:16.643576 0.733874 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:17.377861 0.355381 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:17.733648 0.406177 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:18.140173 0.323030 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:18.463608 0.384346 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/05 21:51:55.047995 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:52:02.055041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:52:10.056337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:52:26.059212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:52:58.065557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:59:02.071536 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 21:59:09.079040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:59:17.079884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 21:59:33.253806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:00:05.259659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:02:57.357088 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:02:57.357251 1.659537 tcp 10.0.2.105 50721 -> 128.255.183.224 9027 FSPA* 0 0 12 1454 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:06:09.266240 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:06:16.273247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:06:24.274095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:06:40.277662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:07:12.283514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:13:16.290167 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:13:23.296969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:13:31.298541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:13:47.301074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:14:19.307921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:20:23.313300 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:20:30.320891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:20:38.322172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:20:54.325712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:21:26.331278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:21:46.911938 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:21:46.912067 0.287216 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:47.199640 0.390400 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:47.590456 0.324862 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:47.915724 0.266694 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:48.182911 0.398378 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:48.581658 0.325296 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:48.907386 0.432732 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:49.340549 0.420441 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:49.761387 0.393130 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:50.154926 0.433540 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:50.588833 0.396027 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:50.985233 0.580163 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:51.565744 0.297189 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:51.863305 0.391947 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:52.255665 0.389522 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:52.645532 0.467987 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:53.113879 0.580496 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:53.694738 0.471783 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:54.166899 0.417796 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:54.585185 0.300931 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:54.886516 0.440098 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:55.327006 0.649714 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:55.977098 0.404252 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:56.381737 0.311068 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:21:56.693195 0.386583 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:27:30.338225 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:27:37.344844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:27:45.346189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:28:01.349757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:28:33.355337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:32:59.018025 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:32:59.018121 1.772205 tcp 10.0.2.105 50722 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/05 22:34:37.361432 3.001504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:34:44.368836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:34:52.370663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:35:08.373236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:35:40.379212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:41:44.385330 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:41:51.392457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:41:59.394047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:42:15.397400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:42:47.403679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:48:51.408837 3.002473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:48:58.416755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:49:06.418144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:49:22.420962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:49:54.427220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:52:06.217049 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 22:52:06.217254 0.314228 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:06.531829 0.264921 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:06.797080 0.391236 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:07.188734 0.329258 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:07.518463 0.421873 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:07.940746 0.310521 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:08.251662 0.440834 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:08.692857 0.417818 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:09.111064 0.392624 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:09.504101 0.407439 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:09.911907 0.394411 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:10.306721 0.591676 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:10.898828 0.290182 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:11.189422 0.395646 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:11.585415 0.392482 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:11.978284 0.473148 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:12.451847 0.508954 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:12.961208 0.473890 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:13.435518 0.418801 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:13.854725 0.307612 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:14.162714 0.431448 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:14.594553 0.317605 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:14.912506 0.397585 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:15.310513 0.411335 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:52:15.722277 0.314625 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/05 22:55:58.433246 3.001776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 22:56:05.440570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:56:13.442552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:56:29.445412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 22:57:01.451150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:03:00.798536 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:03:00.798643 1.742641 tcp 10.0.2.105 50723 -> 128.255.183.224 9027 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:03:05.457495 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:03:12.464910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:03:20.466172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:03:36.469013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:04:08.475076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:10:12.511701 3.000880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:10:19.519065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:10:27.519845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:10:43.523439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:11:15.529381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:17:19.536041 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:17:26.542765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:17:34.544128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:17:50.547145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:18:22.553540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:22:32.222849 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:22:32.222955 0.384330 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:32.607693 0.303991 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:32.912098 0.266758 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:33.179209 0.335579 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:33.515209 0.420813 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:33.936440 0.317052 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:34.253871 0.431890 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:34.686184 0.412003 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:35.098556 0.384790 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:35.483820 0.378631 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:35.862811 0.417208 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:36.280577 0.565728 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:36.846712 0.280524 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:37.127647 0.393963 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:37.522067 0.385283 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:37.907773 0.450245 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:38.358438 0.524128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:38.882945 0.454636 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:39.337986 0.396358 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:39.734750 0.297315 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:40.032483 0.385051 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:40.417925 0.446059 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:40.864502 0.362861 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:41.227788 0.417205 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:22:41.645401 0.311231 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:24:26.559749 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:24:33.576856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:24:41.578201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:24:57.580893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:25:29.587303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:31:33.593268 3.001861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:31:40.600511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:31:48.602183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:32:04.605011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:32:36.611284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:33:02.578595 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:33:02.578738 1.803745 tcp 10.0.2.105 50724 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/05 23:38:40.618091 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:38:47.625089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:38:55.625892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:39:11.629095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:39:43.635195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:45:47.640490 3.002226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:45:54.648198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:46:02.650134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:46:18.652900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:46:50.658868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:52:51.918577 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/05 23:52:51.918685 0.286261 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:52.205353 0.386914 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:52.592698 0.333043 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:52.926139 0.334411 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:53.260899 0.414813 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:53.676158 0.319848 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:53.996411 0.433340 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:54.430169 0.394867 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:54.664519 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/05 23:52:54.825430 0.433730 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:55.259513 0.389086 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:55.648986 0.390874 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:56.040266 0.578203 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:56.618831 0.286706 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:56.905884 0.450482 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:57.356770 0.394991 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:57.752197 0.390338 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:58.142925 0.533521 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:58.676865 0.474236 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:59.151447 0.422584 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:59.574421 0.305011 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:52:59.879859 0.348101 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:53:00.228380 0.387273 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:53:00.616032 0.445356 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:53:01.061799 0.410502 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:53:01.472675 0.315001 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/05 23:53:01.672137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:53:09.674015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:53:25.676995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/05 23:53:57.683341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:00:01.688513 3.002529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:00:08.696107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:00:16.698261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:00:32.701211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:01:04.707233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:03:04.389520 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:03:04.389685 1.709830 tcp 10.0.2.105 50725 -> 128.255.183.224 9027 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:07:08.712214 3.002334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:07:15.720180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:07:23.721795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:07:39.725143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:08:11.730927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:14:15.736576 3.001980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:14:22.744450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:14:30.745607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:14:46.749220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:15:18.754769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:21:22.761266 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:21:29.768527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:21:37.769787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:21:53.772619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:22:25.779204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:23:25.725640 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:23:25.725837 0.267130 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:25.993382 0.331789 udp 10.0.2.105 7010 <-> 62.106.17.88 6418 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:26.325557 0.384213 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:26.710187 0.301148 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:27.011730 0.421822 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:27.433979 0.311978 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:27.746385 0.407468 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:28.154247 0.428636 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:28.583292 0.411535 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:28.995221 0.378748 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:29.374359 0.378841 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:29.753570 0.573819 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:30.327729 0.286853 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:30.614932 0.459101 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:31.074405 0.386765 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:31.461568 0.380488 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:31.842450 0.508989 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:32.351813 0.460935 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:32.813163 0.410910 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:33.224532 0.306353 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:33.531268 0.338110 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:33.869729 0.401438 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:34.271562 0.437887 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:34.709859 0.402768 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:23:35.112972 0.311997 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:28:29.785352 3.001135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:28:36.792235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:28:44.793661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:29:00.796651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:29:32.802661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:33:06.100430 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:33:06.100585 1.669558 tcp 10.0.2.105 50726 -> 128.255.183.224 9027 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:35:36.809078 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:35:43.816011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:35:51.817765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:36:07.820438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:36:39.827067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:42:43.832860 3.001909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:42:50.840034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:42:58.842074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:43:14.844644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:43:46.850423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:49:50.857000 3.001178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:49:57.864072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:50:05.866110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:50:21.868661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:50:53.874482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:53:39.313063 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 00:53:39.313166 0.261066 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:53:39.574563 0.000000 udp 10.0.2.105 7010 -> 62.106.17.88 6418 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 00:53:56.218119 0.561210 tcp 10.0.2.105 50727 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:53:56.779605 0.585790 tcp 10.0.2.105 50728 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:53:57.365714 1.412971 tcp 10.0.2.105 50729 -> 195.113.214.226 443 SRPA* 0 0 38 27286 flow=From-Botnet-V2-TCP-Established 1970/01/06 00:53:58.779515 0.395116 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:53:59.175711 0.324177 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:53:59.500451 0.424628 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:53:59.925479 0.307681 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:00.233656 0.409943 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:00.644008 0.397413 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:01.096964 0.429063 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:01.526407 0.410405 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:01.937192 0.391876 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:02.329500 0.579480 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:02.909384 0.293198 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:03.202907 0.465525 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:03.668786 0.519391 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:04.188516 0.388033 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:04.576965 0.380727 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:04.958082 0.467829 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:05.426288 0.407514 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:05.834207 0.309808 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:06.144373 0.321965 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:06.466710 0.390544 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:06.857641 0.425135 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:07.283136 0.405270 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:54:07.688773 0.317813 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/06 00:56:57.940134 3.002518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 00:57:04.948030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:57:12.949644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:57:28.953063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 00:58:00.958717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:03:07.830580 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:03:07.830841 1.761186 tcp 10.0.2.105 50730 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:04:04.965251 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 01:04:11.972366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:04:19.974049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:04:35.976879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:05:07.982787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:11:11.989093 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 01:11:18.997133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:11:26.998462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:11:43.001809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:12:15.006549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:18:19.013589 3.000509 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 01:18:26.019989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:18:34.021645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:18:50.024387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:19:22.030367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:24:34.139473 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:24:34.139572 0.000000 udp 10.0.2.105 7010 -> 62.106.17.88 6418 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:24:53.025269 0.552848 tcp 10.0.2.105 50731 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:24:53.578391 0.564441 tcp 10.0.2.105 50732 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:24:54.143139 1.184424 tcp 10.0.2.105 50733 -> 195.113.214.226 443 SRPA* 0 0 24 13200 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:24:55.328143 0.270444 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:55.599015 0.383394 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:55.982822 0.310471 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:56.293718 0.415387 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:56.709524 0.311785 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:57.021706 0.426332 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:57.448610 0.386561 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:57.835539 0.377943 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:58.213911 0.434029 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:58.648498 0.417841 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:59.066781 0.572868 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:59.640048 0.293110 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:24:59.933582 0.521262 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:00.455269 0.579381 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:01.035037 0.462134 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:01.497562 0.401670 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:01.899621 0.381229 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:02.281222 0.420774 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:02.702413 0.306310 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:03.009088 0.306880 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:03.316509 0.398705 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:03.715613 0.444420 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:04.195322 0.394501 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:04.590180 0.314312 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:05.567162 0.414942 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:06.089513 0.304528 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:07.147060 0.294578 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:08.194031 0.292937 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:08.762409 0.426844 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:09.801598 0.436432 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:10.238609 0.399508 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:10.638687 0.365263 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:11.004521 0.425245 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 661 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:11.430360 0.437486 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:11.868440 0.425541 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:12.294589 0.583096 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:13.161592 0.463115 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:13.647712 0.587510 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:14.392530 0.393963 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:14.787098 0.389724 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:15.537348 0.468953 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:16.006975 0.408551 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:16.416033 0.322715 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:16.739324 0.312833 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:17.052768 0.436846 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:17.490208 0.390549 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:17.902427 0.319478 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:18.222498 0.411349 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:25:18.322914 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:25:18.634609 0.000000 udp 10.0.2.105 7010 -> 76.184.193.47 9456 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:25.883733 0.000000 udp 10.0.2.105 7010 -> 88.240.206.241 6019 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:26.036929 3.001096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 01:25:31.461752 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:33.044068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:25:39.163553 0.488164 udp 10.0.2.105 7010 -> 78.181.16.73 6681 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:39.651717 0.000000 icmp 78.181.16.73 0x0303 -> 10.0.2.105 0x191a URP 192 1 335 flow=Background 1970/01/06 01:25:41.045462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:25:43.829786 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:25:48.045989 0.000000 udp 10.0.2.105 7010 -> 99.195.135.226 8881 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:56.598403 0.000000 udp 10.0.2.105 7010 -> 93.91.145.150 1024 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:25:57.048797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:26:01.945488 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:09.897279 0.000000 udp 10.0.2.105 7010 -> 81.159.5.77 5117 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:15.204733 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:26:16.611160 0.000000 udp 10.0.2.105 7010 -> 78.174.113.30 9279 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:24.027858 0.285736 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:26:24.330178 0.000000 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:29.435230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:26:29.775469 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:37.596987 0.297817 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:26:37.905984 0.000000 udp 10.0.2.105 7010 -> 81.133.20.199 5500 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:42.203275 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:26:43.285529 0.282352 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:26:43.576549 0.000000 udp 10.0.2.105 7010 -> 143.101.230.197 9771 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:49.183841 0.000000 udp 10.0.2.105 7010 -> 188.217.191.29 1120 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:26:57.485516 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:04.377613 0.000000 udp 10.0.2.105 7010 -> 2.135.181.49 3505 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:09.201961 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:27:12.187117 0.000000 udp 10.0.2.105 7010 -> 203.202.249.140 9130 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:21.009340 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:29.411721 0.000000 udp 10.0.2.105 7010 -> 78.186.182.140 6932 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:34.207923 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:27:34.829422 0.000000 udp 10.0.2.105 7010 -> 93.193.139.212 7662 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:40.257376 0.000000 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:48.539122 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:54.517896 0.000000 udp 10.0.2.105 7010 -> 49.144.138.90 1107 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:27:59.203861 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:28:00.045323 0.000000 udp 10.0.2.105 7010 -> 176.240.233.57 2209 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:06.384518 0.299838 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:06.710323 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:14.095941 0.320117 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:14.432963 0.298387 udp 10.0.2.105 7010 <-> 78.148.20.134 5515 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:14.766384 0.000000 udp 10.0.2.105 7010 -> 95.226.156.186 6800 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:20.625035 0.294923 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:20.937570 0.326112 udp 10.0.2.105 7010 -> 85.107.162.183 2982 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:21.263682 0.000000 icmp 85.107.162.183 0x0303 -> 10.0.2.105 0xa60b URP 192 1 208 flow=Background 1970/01/06 01:28:25.201708 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:28:29.809397 0.301967 udp 10.0.2.105 7010 <-> 82.211.144.75 2797 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:30.538489 0.000000 udp 10.0.2.105 7010 -> 72.70.56.11 3231 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:39.462318 0.306538 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:39.783217 0.487758 udp 10.0.2.105 7010 <-> 183.87.193.88 9569 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:28:40.284325 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5813 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:45.901583 0.000000 udp 10.0.2.105 7010 -> 79.166.19.39 4707 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:50.708146 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:28:54.103190 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:28:59.280630 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:04.829066 0.000000 udp 10.0.2.105 7010 -> 2.177.56.12 4373 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:11.979161 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:16.705554 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:29:18.939214 0.000000 udp 10.0.2.105 7010 -> 82.35.164.95 6230 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:27.351252 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 7946 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:33.610356 0.000000 udp 10.0.2.105 7010 -> 79.23.6.77 5808 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:40.079137 0.339442 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:29:40.594431 0.000000 udp 10.0.2.105 7010 -> 46.197.69.240 6253 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:44.705583 0.001091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:29:46.899049 0.000000 udp 10.0.2.105 7010 -> 88.243.217.64 8937 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:29:55.091238 0.000000 udp 10.0.2.105 7010 -> 109.90.137.232 8739 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:02.131287 0.000000 udp 10.0.2.105 7010 -> 58.152.175.199 2973 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:08.520458 0.000000 udp 10.0.2.105 7010 -> 58.8.162.206 9422 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:13.206831 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:30:14.058615 0.406653 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 734 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:30:14.840636 0.648980 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:30:15.603004 0.445460 udp 10.0.2.105 7010 <-> 50.149.67.7 1024 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:30:16.133436 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 4579 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:21.809591 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:30.612335 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:38.853664 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:43.700397 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:30:44.412164 0.000000 udp 10.0.2.105 7010 -> 99.38.60.198 1095 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:51.732467 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:30:58.452389 0.000000 udp 10.0.2.105 7010 -> 94.141.208.225 1616 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:06.233470 0.000000 udp 10.0.2.105 7010 -> 2.50.163.150 6431 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:11.199909 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:31:12.853100 0.000000 udp 10.0.2.105 7010 -> 151.29.234.65 1023 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:19.902872 0.448387 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:31:20.450829 0.000000 udp 10.0.2.105 7010 -> 86.97.187.134 1170 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:29.406704 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:35.535256 0.627877 udp 10.0.2.105 7010 <-> 111.242.78.179 1084 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:31:36.218258 0.367744 udp 10.0.2.105 7010 -> 88.204.167.83 1124 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:36.586002 0.000000 icmp 88.204.167.83 0x0303 -> 10.0.2.105 0x6404 URP 192 1 181 flow=Background 1970/01/06 01:31:40.201585 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:31:43.306701 0.374032 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:31:43.693961 0.000000 udp 10.0.2.105 7010 -> 115.87.232.66 7346 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:49.165187 0.000000 udp 10.0.2.105 7010 -> 66.205.238.74 1443 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:31:56.435609 0.685900 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:31:57.832399 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:06.520510 0.000000 udp 10.0.2.105 7010 -> 174.141.57.178 5164 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:11.206182 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:32:15.212708 0.493730 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:32:15.762360 0.000000 udp 10.0.2.105 7010 -> 95.237.58.225 2288 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:23.113659 0.000000 udp 10.0.2.105 7010 -> 117.208.233.129 7064 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:30.694775 0.000000 udp 10.0.2.105 7010 -> 24.211.218.253 7370 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:33.440572 3.002367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 01:32:35.200984 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:32:36.292675 0.000000 udp 10.0.2.105 7010 -> 71.246.157.219 3675 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:40.448934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:32:44.614437 0.000000 udp 10.0.2.105 7010 -> 86.129.237.149 9092 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:32:48.450189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:32:53.577538 0.000000 udp 10.0.2.105 7010 -> 151.74.150.139 6068 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:00.747976 0.000000 udp 10.0.2.105 7010 -> 190.233.165.107 1487 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:04.453146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:33:05.705285 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:33:08.308671 0.000000 udp 10.0.2.105 7010 -> 94.122.144.179 4410 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:09.971365 3.341907 tcp 10.0.2.105 50734 -> 128.255.183.224 9027 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/01/06 01:33:13.426192 0.306435 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:33:13.741341 0.304835 udp 10.0.2.105 7010 <-> 46.49.109.111 9261 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:33:14.085625 0.502147 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:33:14.598237 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:20.466108 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:28.297516 0.000000 udp 10.0.2.105 7010 -> 27.145.216.123 7343 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:33.365058 0.000000 udp 10.0.2.105 7010 -> 188.99.168.226 8498 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:36.459435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:33:38.201951 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:33:40.404914 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:45.642732 0.000000 udp 10.0.2.105 7010 -> 167.184.128.4 9845 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:51.200217 0.000000 udp 10.0.2.105 7010 -> 203.122.19.162 5362 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:59.242185 0.327817 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:33:59.589704 0.390988 udp 10.0.2.105 7010 -> 37.232.57.39 6943 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:33:59.980692 0.000000 icmp 37.232.57.39 0x0303 -> 10.0.2.105 0x1f1b URP 192 1 273 flow=Background 1970/01/06 01:34:04.208858 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:34:08.165219 0.318241 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:34:08.509050 0.581389 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:34:09.105494 0.345195 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:34:09.472855 0.000000 udp 10.0.2.105 7010 -> 95.13.65.45 8667 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:17.467988 0.000000 udp 10.0.2.105 7010 -> 86.98.42.39 1828 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:23.997909 0.000000 udp 10.0.2.105 7010 -> 88.240.87.81 8661 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:28.703923 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:34:32.950386 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:39.620296 0.712927 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:34:40.344569 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:48.903465 0.000000 udp 10.0.2.105 7010 -> 125.161.28.85 5306 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:34:53.709947 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:34:56.123905 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:05.127142 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:12.378141 0.000000 udp 10.0.2.105 7010 -> 207.112.105.208 6759 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:19.887900 0.000000 udp 10.0.2.105 7010 -> 205.209.151.251 2308 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:24.705010 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:35:25.937065 0.000000 udp 10.0.2.105 7010 -> 110.77.203.127 7229 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:34.639554 0.000000 udp 10.0.2.105 7010 -> 96.44.41.133 1216 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:41.268778 0.000000 udp 10.0.2.105 7010 -> 153.160.130.137 5651 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:47.107319 0.000000 udp 10.0.2.105 7010 -> 78.164.39.61 1049 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:51.703829 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:35:53.255884 0.000000 udp 10.0.2.105 7010 -> 72.198.91.40 4905 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:35:58.603523 0.000000 udp 10.0.2.105 7010 -> 27.48.226.50 9961 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:07.456527 0.000000 udp 10.0.2.105 7010 -> 76.111.118.32 9378 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:16.208786 0.264255 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:16.473041 0.000000 icmp 217.91.253.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 177 flow=Background 1970/01/06 01:36:21.205717 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:36:23.739852 0.000000 udp 10.0.2.105 7010 -> 204.76.196.110 8805 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:32.372914 0.395874 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:36:32.804575 0.358227 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:36:33.213710 0.000000 udp 10.0.2.105 7010 -> 206.55.93.100 3103 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:40.794742 0.291730 udp 10.0.2.105 7010 -> 188.109.206.212 6614 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:36:41.086472 0.000000 icmp 188.109.206.212 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 213 flow=Background 1970/01/06 01:36:45.701457 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 01:36:48.766173 0.296406 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/06 01:36:49.090861 0.000000 udp 10.0.2.105 7010 -> 114.109.26.4 9585 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 01:39:40.464853 3.002035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 01:39:47.472260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:39:55.474046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:40:11.477057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:40:43.482937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:46:47.489532 3.001634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 01:46:54.496868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:47:02.498261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:47:18.501138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:47:50.507286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:53:54.512718 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 01:54:01.520233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:54:09.522263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:54:25.525348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 01:54:57.531318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:01:01.537482 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:01:08.544501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:01:16.546307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:01:32.549060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:02:04.554879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:03:13.314824 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:03:13.315002 1.707034 tcp 10.0.2.105 50735 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:07:14.310563 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:07:14.310748 0.317722 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:14.628901 0.304600 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:14.933910 0.416103 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:15.350427 0.415149 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:15.765979 0.380251 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:16.146584 0.391328 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:16.538240 0.418925 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:16.957556 0.598537 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:17.556479 0.463454 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:18.020298 0.507571 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:18.528226 0.399351 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:18.927988 0.447379 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:19.375782 0.390778 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:19.766888 0.413029 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:20.180320 0.317849 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:20.498583 0.314930 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:20.813902 0.313578 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:21.127891 0.452543 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:21.581104 0.386702 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:21.968269 0.391688 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:22.360486 0.299331 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:22.660156 0.273103 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:22.933678 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:07:40.310551 0.561738 tcp 10.0.2.105 50736 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:07:40.872625 0.554012 tcp 10.0.2.105 50737 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:07:41.426881 1.166014 tcp 10.0.2.105 50738 -> 195.113.214.226 443 SRPA* 0 0 26 13308 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:07:42.593631 0.295567 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:42.889637 0.289324 udp 10.0.2.105 7010 <-> 78.148.20.134 5515 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:43.179365 0.325802 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:43.505580 0.316600 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:07:43.822584 0.000000 udp 10.0.2.105 7010 -> 82.211.144.75 2797 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:08:00.588014 0.555453 tcp 10.0.2.105 50739 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:08:01.143750 0.529891 tcp 10.0.2.105 50740 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:08:01.674001 1.179111 tcp 10.0.2.105 50741 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:08:02.853685 2.512451 udp 10.0.2.105 7010 <-> 183.87.193.88 9569 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:05.366501 0.305573 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:05.672494 0.348648 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:06.021503 0.388811 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:06.410711 0.630913 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:07.041964 0.448000 udp 10.0.2.105 7010 <-> 50.149.67.7 1024 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:07.490358 0.482154 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:07.972862 0.593803 udp 10.0.2.105 7010 <-> 111.242.78.179 1084 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:08.561339 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 02:08:08.567045 0.360310 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:08.927755 0.405861 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:09.333975 0.411233 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:09.745616 0.295978 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:10.041977 0.295836 udp 10.0.2.105 7010 <-> 46.49.109.111 9261 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:10.338195 0.528408 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:10.866989 0.293845 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:11.161174 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:08:15.568605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:08:23.569589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:08:29.410004 0.584725 tcp 10.0.2.105 50742 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:08:29.995022 0.618493 tcp 10.0.2.105 50743 -> 195.113.214.226 80 SRPA* 0 0 20 14727 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:08:30.614117 0.308859 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:30.923373 0.349571 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:31.273327 0.717576 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:31.991275 0.347989 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:32.339661 0.641864 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:32.981917 0.288239 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:08:39.573473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:09:11.579422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:15:15.585306 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:15:22.592496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:15:30.593970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:15:46.596932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:16:18.603270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:22:22.609319 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:22:29.616225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:22:37.618128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:22:53.621090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:23:25.626988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:29:29.632430 3.001986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:29:36.640344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:29:44.642091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:30:00.644643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:30:32.651292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:33:15.024683 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:33:15.024830 1.668438 tcp 10.0.2.105 50744 -> 128.255.183.224 9027 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:36:36.657287 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:36:43.663974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:36:51.665753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:37:07.669115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:37:39.674696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:38:48.073818 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 02:38:48.073926 0.298390 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:38:48.372747 0.000000 udp 10.0.2.105 7010 -> 82.211.144.75 2797 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:39:05.120135 0.559539 tcp 10.0.2.105 50745 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:05.679950 0.590899 tcp 10.0.2.105 50746 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:06.271158 1.138518 tcp 10.0.2.105 50747 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:07.410284 0.587605 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:07.998255 0.313057 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:08.311656 0.288843 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:08.600899 0.396673 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:08.997956 0.411376 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:09.409710 0.425280 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:09.835408 1.041834 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:10.877638 0.415210 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:11.293274 0.466497 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:11.760148 0.581211 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:12.341711 0.498909 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:12.841016 0.390781 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:13.232242 0.404234 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:13.636882 0.470450 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:14.107751 0.403237 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:14.511402 0.310275 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:14.829029 0.309482 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:15.138907 0.314627 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:15.453887 0.437681 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:15.891928 0.402473 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:16.294806 0.295225 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:16.590389 0.305957 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:16.896651 0.399804 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:17.296852 0.303388 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:17.600615 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:39:34.060644 0.558627 tcp 10.0.2.105 50748 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:34.619619 0.568762 tcp 10.0.2.105 50749 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:35.188721 1.149985 tcp 10.0.2.105 50750 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:36.339331 0.310969 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:36.650683 0.305128 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:36.956172 0.341682 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:37.298184 0.454572 udp 10.0.2.105 7010 <-> 183.87.193.88 9569 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:37.753116 0.305543 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:38.059096 0.404823 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:38.464479 0.629660 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:39.094515 0.000000 udp 10.0.2.105 7010 -> 50.149.67.7 1024 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 02:39:56.432636 0.577470 tcp 10.0.2.105 50751 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:57.009967 0.563159 tcp 10.0.2.105 50752 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:57.573097 1.159919 tcp 10.0.2.105 50753 -> 195.113.214.226 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/06 02:39:58.733759 0.461074 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:59.195254 0.636317 udp 10.0.2.105 7010 <-> 111.242.78.179 1084 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:39:59.831990 0.366123 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:00.198545 0.311423 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:00.510372 0.476536 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:00.987330 0.414903 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:01.402658 0.296783 udp 10.0.2.105 7010 <-> 46.49.109.111 9261 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:01.699843 0.523451 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:02.223644 0.339709 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:02.563753 0.313834 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:02.878006 0.333664 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:03.212041 0.718803 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:03.931183 0.302306 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:04.233824 0.339448 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:40:04.573729 0.393187 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/06 02:43:43.681035 3.001687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 02:43:50.688577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:43:58.689792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:44:14.693007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:44:46.698986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:50:50.704599 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:50:57.712702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:51:05.713797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:51:21.716835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:51:53.723004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:57:57.729388 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 02:58:04.735941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:58:12.737543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:58:28.740616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 02:59:00.746824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:03:16.695275 0.001091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:03:16.696453 1.740063 tcp 10.0.2.105 50754 -> 128.255.183.224 9027 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:05:04.752883 3.001177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:05:11.760145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:05:19.761600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:05:35.764606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:06:07.771003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:10:18.291163 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:10:18.291268 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:10:33.816418 0.564419 tcp 10.0.2.105 50755 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:34.381115 0.579517 tcp 10.0.2.105 50756 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:34.960472 1.149519 tcp 10.0.2.105 50757 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:36.110757 0.000000 udp 10.0.2.105 7010 -> 50.149.67.7 1024 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:10:52.541758 0.554528 tcp 10.0.2.105 50758 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:53.096574 0.574122 tcp 10.0.2.105 50759 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:53.671009 1.148692 tcp 10.0.2.105 50760 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:10:54.820586 0.304011 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:55.124977 0.570485 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:55.695929 0.308804 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:56.005133 0.382189 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:56.387722 0.309315 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:56.697435 0.421111 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:57.118883 0.412434 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:57.531749 0.399576 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:57.931730 0.417211 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:58.349290 0.475275 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:58.824966 0.507500 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:59.332859 0.576537 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:10:59.909737 0.392286 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:00.302391 0.487602 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:00.790409 0.416766 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:01.207513 0.312069 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:01.519933 0.311005 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:01.831317 0.395720 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:02.227443 0.429621 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:02.657496 0.387411 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:03.045301 0.323314 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:03.368951 0.305126 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:03.674411 0.397651 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:04.072636 0.281808 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:04.354851 0.310176 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:04.665445 0.375180 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:05.041035 0.303767 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:05.345248 0.330142 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:05.675864 0.293689 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:05.969949 0.509820 udp 10.0.2.105 7010 <-> 183.87.193.88 9569 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:06.480170 0.361675 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:06.842214 0.624178 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:07.466735 0.471403 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:07.938571 0.605195 udp 10.0.2.105 7010 <-> 111.242.78.179 1084 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:08.544169 0.365672 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:08.910198 0.299736 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:09.210309 0.416276 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:09.626947 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:11:27.712096 0.538572 tcp 10.0.2.105 50761 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:11:28.250906 0.558452 tcp 10.0.2.105 50762 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:11:28.809669 1.180094 tcp 10.0.2.105 50763 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:11:29.990457 0.480451 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:30.471267 0.316582 udp 10.0.2.105 7010 <-> 46.49.109.111 9261 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:30.788230 0.273906 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:31.062470 0.312699 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:31.375535 0.347560 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:31.723490 0.633298 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:32.357195 0.304869 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:32.662476 0.342068 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:11:33.004980 0.404720 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:12:11.776566 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 03:12:18.784485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:12:26.785624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:12:42.788433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:13:14.794400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:19:18.800473 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:19:25.807764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:19:33.809805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:19:49.812908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:20:21.818608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:26:25.825296 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:26:32.831740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:26:40.833636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:26:56.837062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:27:28.842571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:33:18.436015 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:33:18.436119 1.699403 tcp 10.0.2.105 50764 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:33:32.849358 3.010758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:33:39.865979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:33:47.867423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:34:03.870847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:34:35.876541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:40:39.882281 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:40:46.889810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:40:54.891825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:41:10.894788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:41:42.900531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:42:01.377906 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 03:42:01.378071 1.293824 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:42:02.671895 0.000000 icmp 113.11.126.186 0x000b -> 10.0.2.105 0x0000 TXD 192 1 269 flow=Background 1970/01/06 03:42:17.452376 0.546578 tcp 10.0.2.105 50765 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:42:17.999180 0.621220 tcp 10.0.2.105 50766 -> 195.113.214.226 80 SRPA* 0 0 18 13396 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:42:18.620900 0.301810 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:18.923137 0.570113 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:19.493666 0.317296 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:19.811377 0.422592 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:20.234361 0.370136 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:20.604933 0.299335 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:20.904637 0.409432 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:21.314488 0.381725 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:21.696659 0.483826 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:22.180849 0.415519 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:22.596741 0.586504 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:23.183642 0.511510 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:23.695541 0.392028 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:24.087979 0.464114 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:24.552502 0.425420 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:24.978348 0.318893 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:25.297635 0.376278 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:25.674228 0.290553 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:25.965172 0.393661 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:26.359236 0.434263 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:26.793849 0.391862 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:27.186102 0.299558 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:27.486059 0.315386 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:27.801779 0.296692 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:28.098874 0.288314 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:28.387573 0.321699 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:28.709670 0.318594 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:29.028676 0.297432 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:29.326485 0.298724 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:29.625605 0.390998 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:30.016975 0.507416 udp 10.0.2.105 7010 <-> 183.87.193.88 9569 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:30.524810 0.639515 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:31.164754 0.465043 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:31.630147 0.295691 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:31.926194 0.360628 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:32.287214 0.622353 udp 10.0.2.105 7010 <-> 111.242.78.179 1084 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:32.909987 0.524187 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:33.434534 0.000000 udp 10.0.2.105 7010 -> 46.49.109.111 9261 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:42:51.901029 0.577150 tcp 10.0.2.105 50767 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:42:52.478484 0.579813 tcp 10.0.2.105 50768 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:42:53.058593 1.157418 tcp 10.0.2.105 50769 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:42:54.216759 0.286548 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:54.503816 0.452866 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:54.957054 0.339636 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:55.297135 0.322864 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:55.620381 0.334324 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:42:55.955113 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 03:43:12.460735 0.571789 tcp 10.0.2.105 50770 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:43:13.032788 0.608445 tcp 10.0.2.105 50771 -> 195.113.214.226 80 SRPA* 0 0 25 14442 flow=From-Botnet-V2-TCP-Established 1970/01/06 03:43:13.639989 0.283801 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:43:13.924185 0.400567 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 03:47:46.905921 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 03:47:53.913636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:48:01.915681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:48:17.918499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:48:49.924802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:54:53.930746 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 03:55:00.938085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:55:08.939244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:55:24.942189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 03:55:56.948289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:02:00.954240 3.001921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:02:07.961882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:02:15.963762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:02:31.966177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:03:03.972148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:03:20.136529 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:03:20.136695 1.963974 tcp 10.0.2.105 50772 -> 128.255.183.224 9027 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:09:07.978963 3.000957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:09:14.986011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:09:22.987323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:09:38.990219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:10:10.996616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:13:39.065855 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:13:39.066112 0.000000 udp 10.0.2.105 7010 -> 46.49.109.111 9261 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:13:54.540254 0.574161 tcp 10.0.2.105 50773 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:13:55.114708 0.580604 tcp 10.0.2.105 50774 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:13:55.695679 1.157854 tcp 10.0.2.105 50775 -> 195.113.214.226 443 SRPA* 0 0 23 13302 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:13:56.854116 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:14:11.974218 0.591332 tcp 10.0.2.105 50776 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:14:12.565839 0.618855 tcp 10.0.2.105 50777 -> 195.113.214.226 80 SRPA* 0 0 20 14732 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:14:13.185347 0.287122 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:13.472868 0.405074 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:13.878370 0.301099 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:14.179819 0.580858 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:14.761054 0.374864 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:15.136450 0.429765 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:15.566602 0.317226 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:15.884181 0.366442 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:16.251023 0.463367 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:16.714800 0.579043 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:17.294234 0.396910 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:17.691508 0.395717 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:18.087579 0.502151 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:18.590088 0.427868 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:19.018364 0.000000 udp 10.0.2.105 7010 -> 162.202.134.145 3979 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:14:35.397792 0.552864 tcp 10.0.2.105 50778 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:14:35.950904 0.578924 tcp 10.0.2.105 50779 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:14:36.530156 1.159563 tcp 10.0.2.105 50780 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:14:37.690492 0.312987 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:38.003826 0.379043 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:38.383219 0.313660 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:38.697305 0.397637 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:39.095342 0.405057 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:39.500803 0.440460 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:39.941665 0.307972 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:40.249975 0.314852 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:40.565216 0.321946 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:40.887567 0.295522 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:41.183430 0.328667 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:41.512669 0.289244 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:41.802261 0.331979 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:42.134653 0.292304 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:42.427342 0.392803 udp 10.0.2.105 7010 <-> 74.15.162.237 4408 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:14:42.820632 0.000000 udp 10.0.2.105 7010 -> 183.87.193.88 9569 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:14:59.823113 0.560117 tcp 10.0.2.105 50781 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:00.383080 0.586550 tcp 10.0.2.105 50782 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:00.969907 1.156808 tcp 10.0.2.105 50783 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:02.127353 0.000000 udp 10.0.2.105 7010 -> 183.235.132.191 9213 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:15:19.891981 0.543414 tcp 10.0.2.105 50784 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:20.435775 0.608147 tcp 10.0.2.105 50785 -> 195.113.214.226 80 SRPA* 0 0 20 14754 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:21.044540 0.362204 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:21.407099 0.291173 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:21.698664 0.458142 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:22.157157 0.000000 udp 10.0.2.105 7010 -> 111.242.78.179 1084 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:15:39.470068 0.554653 tcp 10.0.2.105 50786 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:40.024990 0.607697 tcp 10.0.2.105 50787 -> 195.113.214.226 80 SRPA* 0 0 20 14753 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:15:40.633262 0.488070 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:41.121743 0.341301 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:41.463393 0.294086 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:41.757899 0.416382 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:42.174623 0.306122 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:42.481140 0.330591 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:42.812132 0.310300 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:15:43.122834 0.386670 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:16:15.002352 3.001416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 04:16:22.010170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:16:30.011129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:16:46.014540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:17:18.020192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:23:22.027269 3.000878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:23:29.033943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:23:37.035486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:23:53.038029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:24:25.044047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:30:29.050899 3.000761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:30:36.057425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:30:44.059254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:31:00.061965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:31:32.068479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:33:22.107192 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:33:22.107420 1.867219 tcp 10.0.2.105 50788 -> 128.255.183.224 9027 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:37:36.124804 3.001567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:37:43.131933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:37:51.133137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:38:07.136045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:38:39.142010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:44:43.149149 3.000595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:44:50.155785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:44:58.157028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:45:14.160629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:45:46.166025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:46:07.918027 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 04:46:07.918134 0.000000 udp 10.0.2.105 7010 -> 162.202.134.145 3979 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:46:23.732908 0.541820 tcp 10.0.2.105 50789 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:24.274995 0.579528 tcp 10.0.2.105 50790 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:24.854850 1.157728 tcp 10.0.2.105 50791 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:26.013206 0.000000 udp 10.0.2.105 7010 -> 183.87.193.88 9569 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:46:42.328568 0.577998 tcp 10.0.2.105 50792 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:42.906860 0.570874 tcp 10.0.2.105 50793 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:43.477982 1.158030 tcp 10.0.2.105 50794 -> 195.113.214.226 443 SRPA* 0 0 24 13824 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:46:44.636802 0.698960 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:46:45.336160 0.000000 udp 10.0.2.105 7010 -> 111.242.78.179 1084 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:47:03.408977 0.574232 tcp 10.0.2.105 50795 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:03.983455 0.567392 tcp 10.0.2.105 50796 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:04.551194 1.171258 tcp 10.0.2.105 50797 -> 195.113.214.226 443 SRPA* 0 0 23 13772 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:05.723020 0.413596 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:06.136983 0.306601 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:06.443943 0.305266 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:06.749600 0.396263 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:07.146273 0.580962 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:07.727630 0.411228 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:08.139260 0.384849 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:08.524648 0.298836 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:08.823897 0.591557 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:09.415811 0.441784 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:09.857998 0.436367 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:10.294795 0.385863 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:10.681044 0.406917 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:11.088436 0.514071 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:11.602919 0.316684 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:11.920012 0.375715 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:12.296119 0.390356 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:12.686923 0.319293 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:13.006610 0.415344 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:13.422557 0.307678 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:13.730618 0.759788 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:14.490788 0.321283 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:14.812641 0.304203 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:15.117173 0.301565 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:15.419062 0.333980 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:15.753462 0.325493 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:16.079406 0.292071 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:16.371923 0.301379 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:16.673721 0.000000 udp 10.0.2.105 7010 -> 74.15.162.237 4408 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 04:47:31.819633 0.585118 tcp 10.0.2.105 50798 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:32.405068 0.553429 tcp 10.0.2.105 50799 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:32.958798 1.189456 tcp 10.0.2.105 50800 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/06 04:47:34.148987 0.459651 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:34.609140 0.311827 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:34.921413 0.599690 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:35.521508 0.480289 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:36.002155 0.416807 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:36.419366 0.350074 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:36.769833 0.271979 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:37.042211 0.300931 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:37.343500 0.304348 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:37.648410 0.334759 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:47:37.983586 0.386589 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 04:51:50.172583 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 04:51:57.179499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:52:05.181598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:52:21.184432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:52:53.190342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:58:57.196369 3.001629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 04:59:04.203660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:59:12.205000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 04:59:28.208069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:00:00.214601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:03:23.977926 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:03:23.978121 1.715080 tcp 10.0.2.105 50801 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:06:04.219798 3.002268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:06:11.227920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:06:19.229585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:06:35.232080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:07:07.237863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:13:13.917895 3.001973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:13:20.925364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:13:28.926841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:13:44.930044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:14:16.936082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:17:40.769874 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:17:40.769979 0.000000 udp 10.0.2.105 7010 -> 74.15.162.237 4408 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 05:17:56.484622 0.568201 tcp 10.0.2.105 50802 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:17:57.053125 0.554837 tcp 10.0.2.105 50803 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:17:57.608268 1.165516 tcp 10.0.2.105 50804 -> 195.113.214.226 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:17:58.774502 0.697713 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:17:59.472647 0.425370 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:17:59.898431 0.288173 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:00.186990 0.369883 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:00.557266 0.302060 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:00.859722 0.415758 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:01.275905 0.539142 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:01.815398 0.307124 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:02.122935 0.392502 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:02.515895 0.457475 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:02.973770 0.576623 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:03.550743 0.422972 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:03.974070 0.383019 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:04.357484 0.391188 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:04.748999 0.488809 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:05.238151 0.330088 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:05.568621 0.397135 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:05.966111 0.303058 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:06.269576 0.376039 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:06.646021 0.279022 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:06.925453 0.412804 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:07.338676 0.436199 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:07.775257 0.310878 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:08.086492 0.300437 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:08.387286 0.279661 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:08.667338 0.319719 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:08.987412 0.313670 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:09.301488 0.325748 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:09.627618 0.313669 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:09.941855 0.452556 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:10.394804 0.298931 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:10.694151 0.403103 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:11.097605 0.524865 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:11.622866 0.433229 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:12.056501 0.335525 udp 10.0.2.105 7010 <-> 85.118.102.159 8395 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:12.392435 0.284853 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:12.677691 0.307503 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:12.985648 0.393975 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:13.380040 0.325357 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:18:13.705822 0.348784 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:20:20.942344 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 05:20:27.949508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:20:35.950602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:20:51.953829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:21:23.960273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:27:27.965976 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:27:34.973535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:27:42.975223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:27:58.977589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:28:30.984006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:33:27.010082 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:33:27.010371 1.904534 tcp 10.0.2.105 50805 -> 128.255.183.224 9027 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:34:34.990883 3.000967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:34:41.997493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:34:49.998688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:35:06.001639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:35:38.007752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:41:42.013509 3.002438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:41:49.020979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:41:57.022919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:42:13.025797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:42:45.031868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:48:34.704805 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 05:48:34.704954 0.292346 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:34.997656 0.665430 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:35.663489 0.415339 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:36.079228 0.422519 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:36.502102 0.371048 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:36.873557 0.333184 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:37.207106 0.509703 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:37.717226 0.310721 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:38.028300 0.445453 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:38.474171 0.461910 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:38.936527 0.580874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:39.517797 0.412256 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:39.930424 0.486621 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:40.417446 0.395531 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:40.813319 0.394622 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:41.208356 0.307210 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:41.515962 0.331946 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:41.848529 0.385363 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:42.234276 0.397279 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:42.631967 0.303201 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:42.935567 0.404531 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:43.340508 0.436849 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:43.777751 0.326289 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:44.104616 0.338641 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:44.443644 0.295884 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:44.739860 0.307785 udp 10.0.2.105 7010 <-> 188.121.220.120 3627 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:45.048067 0.305572 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:48:45.353987 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 05:48:49.038410 3.001021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:48:56.045048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:49:04.047157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:49:04.059950 0.572554 tcp 10.0.2.105 50806 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:04.632745 0.572419 tcp 10.0.2.105 50807 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:05.205425 1.162469 tcp 10.0.2.105 50808 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:06.368636 0.299221 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:06.668264 0.464434 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:07.133065 0.320229 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:07.453622 0.375306 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:07.829344 0.412020 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:08.241763 0.407338 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:08.649499 0.295733 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:08.945611 0.000000 udp 10.0.2.105 7010 -> 85.118.102.159 8395 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 05:49:20.049948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:49:26.450259 0.560345 tcp 10.0.2.105 50809 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:27.010919 0.585297 tcp 10.0.2.105 50810 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:27.596536 1.184138 tcp 10.0.2.105 50811 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/06 05:49:28.781364 0.281162 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:29.062934 0.362554 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:29.425893 0.411034 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:29.837300 0.310875 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 05:49:52.056004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:55:56.062481 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 05:56:03.069568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:56:11.071206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:56:27.073714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 05:56:59.080161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:03:03.086144 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:03:10.092975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:03:18.095085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:03:28.921088 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:03:28.921328 1.744339 tcp 10.0.2.105 50812 -> 128.255.183.224 9027 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:03:34.097958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:04:06.103815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:10:10.110008 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:10:17.117467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:10:25.118684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:10:41.121952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:11:13.127917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:17:17.133999 3.001725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:17:24.141187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:17:32.142731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:17:48.145546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:18:20.151638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:19:49.170814 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:19:49.170921 0.308192 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:19:49.479536 0.000000 udp 10.0.2.105 7010 -> 85.118.102.159 8395 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 06:20:05.926409 0.549848 tcp 10.0.2.105 50813 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:06.476615 0.612361 tcp 10.0.2.105 50814 -> 195.113.214.226 80 SRPA* 0 0 19 14617 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:07.089528 0.443535 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:07.533479 0.640734 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:08.174634 0.407466 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:08.582500 0.309084 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:08.891988 0.378913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:09.271402 0.418997 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:09.690825 0.303126 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:09.994351 0.571986 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:10.566792 0.399837 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:10.966970 0.455462 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:11.422842 0.419214 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:11.842482 0.582385 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:12.425202 0.495372 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:12.920953 0.391531 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:13.312830 0.409497 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:13.722709 0.310369 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:14.033486 0.400860 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:14.434698 0.311724 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:14.746890 0.396355 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:14.747252 3.003359 tcp 10.0.2.105 50815 -> 217.39.56.28 1529 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 06:20:15.143647 0.384958 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:15.529013 0.290411 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:15.819781 0.528185 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:16.348473 0.330239 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:16.679137 0.000000 udp 10.0.2.105 7010 -> 188.121.220.120 3627 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 06:20:23.749450 0.000000 tcp 10.0.2.105 50815 -> 217.39.56.28 1529 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 06:20:32.155797 0.254618 udp 10.0.2.105 58307 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/06 06:20:32.410946 0.261455 udp 10.0.2.105 56740 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/06 06:20:33.975159 0.542601 tcp 10.0.2.105 50816 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:34.518079 0.581916 tcp 10.0.2.105 50817 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:35.099834 1.173346 tcp 10.0.2.105 50818 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:36.273911 0.292526 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:36.566846 0.342809 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:36.567233 4.808477 tcp 10.0.2.105 50819 -> 46.49.112.20 1777 SPA_* 0 0 143 120525 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:36.910030 0.278365 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:37.188744 0.474460 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:37.663593 0.295093 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:37.959091 0.483121 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:38.442610 0.361697 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:38.804641 0.317448 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:39.122444 0.309868 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:39.432667 0.432240 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:39.865216 0.254258 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:40.119859 0.304374 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:40.424666 0.331770 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:40.756735 0.393489 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:20:41.626280 4.871778 tcp 10.0.2.105 50819 -> 46.49.112.20 1777 A_PA 0 0 179 148930 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:46.754478 4.804730 tcp 10.0.2.105 50819 -> 46.49.112.20 1777 A_PA 0 0 181 149038 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:20:51.808761 2.621565 tcp 10.0.2.105 50819 -> 46.49.112.20 1777 FPA_* 0 0 66 44978 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:24:24.158344 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 06:24:31.165038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:24:39.166809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:24:55.169801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:25:27.175547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:31:31.182482 3.001113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:31:38.189608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:31:46.190824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:32:02.193842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:32:34.199528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:33:30.671436 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:33:30.671721 1.740370 tcp 10.0.2.105 50820 -> 128.255.183.224 9027 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:38:38.206619 3.000737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:38:45.213062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:38:53.214505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:39:09.217308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:39:41.223301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:45:45.229661 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 06:45:52.236675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:46:00.238569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:46:16.241812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:46:48.247891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:50:47.612603 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 06:50:47.612782 0.000000 udp 10.0.2.105 7010 -> 188.121.220.120 3627 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 06:51:03.567213 0.562450 tcp 10.0.2.105 50821 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:51:04.129911 0.627147 tcp 10.0.2.105 50822 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:51:04.757310 1.136474 tcp 10.0.2.105 50823 -> 195.113.214.226 443 SRPA* 0 0 25 13900 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:51:05.894550 0.308149 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:06.203070 0.300279 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:06.503671 0.668979 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:07.173072 0.377012 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:07.550469 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 06:51:26.148013 0.586328 tcp 10.0.2.105 50824 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:51:26.734639 0.602708 tcp 10.0.2.105 50825 -> 195.113.214.226 80 SRPA* 0 0 18 13355 flow=From-Botnet-V2-TCP-Established 1970/01/06 06:51:27.337980 0.370202 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:27.708730 0.300637 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:28.009763 0.422129 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:28.432407 0.399584 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:28.832445 0.540168 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:29.373000 0.465611 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:29.839015 0.408332 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:30.247747 0.382355 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:30.630523 0.579955 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:31.210896 0.487291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:31.698591 0.404278 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:32.103271 0.301243 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:32.404874 0.402112 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:32.807374 0.310163 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:33.117979 0.388264 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:33.506643 0.398478 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:33.905524 0.311183 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:34.217047 0.429997 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:34.647445 0.322207 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:34.970086 0.279188 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:35.249696 0.339998 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:35.590108 0.271442 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:35.861925 0.460906 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:36.323187 0.307422 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:36.630967 0.417622 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:37.048979 0.363076 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:37.412492 0.301622 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:37.714524 0.275799 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:37.990715 0.274213 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:38.265290 0.429530 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:38.695211 0.406721 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:39.102297 0.424718 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:51:39.527373 0.414163 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/06 06:52:52.253724 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 06:52:59.261184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:53:07.262320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:53:23.265911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:53:55.271748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 06:59:59.277667 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:00:06.285329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:00:14.286667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:00:30.289446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:01:02.295784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:03:32.411816 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:03:32.411940 1.852583 tcp 10.0.2.105 50826 -> 128.255.183.224 9027 FSPA* 0 0 12 1580 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:07:06.301141 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:07:13.308929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:07:21.310297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:07:37.313746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:08:09.319161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:14:13.325508 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:14:20.332839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:14:28.334090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:14:44.337240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:15:16.343582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:21:20.349784 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:21:27.356953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:21:35.358254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:21:51.361323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:21:56.218848 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:21:56.218940 0.423102 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:56.642454 0.328091 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:56.970941 0.714321 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:57.685669 0.297474 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:57.983537 0.380373 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:58.364324 0.409000 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:58.773731 0.309066 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:59.083202 0.427692 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:59.511290 0.402678 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:21:59.914386 0.520748 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:00.435555 0.453790 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:00.889755 0.414267 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:01.304478 0.393327 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:01.698211 0.577934 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:02.276626 0.504385 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:02.781402 0.413608 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:03.195385 0.308521 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:03.504282 0.323147 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:03.827841 0.408725 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:04.236906 0.385180 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:04.622513 0.374527 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:04.997480 0.278495 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:05.276401 0.321245 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:05.598050 0.448666 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:06.047056 0.372403 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:06.419861 0.470557 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:06.890821 0.342044 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:07.233280 0.283236 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:07.516908 0.320923 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:07.838194 0.483811 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:08.322416 0.343912 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:08.666790 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 07:22:23.367619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:22:25.633231 0.591191 tcp 10.0.2.105 50827 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:22:26.224368 0.571889 tcp 10.0.2.105 50828 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:22:26.796630 1.127717 tcp 10.0.2.105 50829 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:22:27.924918 0.277918 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:28.203178 0.295817 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:28.499412 0.491796 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:28.991618 0.404352 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:29.396437 0.315689 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:22:29.712549 0.326163 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:28:27.373634 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:28:34.380625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:28:42.382087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:28:58.385631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:29:30.391455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:33:34.272608 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:33:34.272716 1.714381 tcp 10.0.2.105 50830 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:35:34.398013 3.001052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:35:41.404954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:35:49.406515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:36:05.409382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:36:37.415506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:42:41.420938 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:42:48.428433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:42:56.430176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:43:12.433305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:43:44.439220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:49:48.445845 3.000837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 07:49:55.452809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:50:03.454279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:50:19.457198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:50:51.463337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:52:49.282637 0.260772 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 07:52:49.543581 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 07:53:05.198017 0.574239 tcp 10.0.2.105 50831 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:05.772612 0.573673 tcp 10.0.2.105 50832 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:06.346609 1.170786 tcp 10.0.2.105 50833 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:07.518133 0.415186 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:07.933659 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 07:53:24.294660 0.567626 tcp 10.0.2.105 50834 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:24.862560 0.568180 tcp 10.0.2.105 50835 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:25.431039 1.183871 tcp 10.0.2.105 50836 -> 195.113.214.226 443 SRPA* 0 0 24 13432 flow=From-Botnet-V2-TCP-Established 1970/01/06 07:53:26.615690 0.676652 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:27.292706 0.295232 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:27.588411 0.394563 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:27.983367 0.341834 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:28.325566 0.313169 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:28.639120 0.430516 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:29.070081 0.409502 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:29.479984 0.557608 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:30.037954 0.425531 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:30.463901 0.463196 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:30.927491 0.588136 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:31.516048 0.390554 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:31.907000 0.414520 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:32.321921 1.016524 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:33.338820 0.304703 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:33.643911 0.410723 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:34.054996 0.314526 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:34.369907 0.475674 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:34.845969 0.369667 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:35.216052 0.291183 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:35.507626 0.308753 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:35.816776 0.434501 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:36.251655 0.685075 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:36.937125 0.457141 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:37.394652 0.334452 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:37.729469 0.589778 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:38.319628 0.281018 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:38.601038 0.307421 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:38.908837 0.399228 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:39.308497 0.275809 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:39.584729 0.316559 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:39.901679 0.461279 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:40.363328 0.333948 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:40.697666 0.372378 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:53:41.070367 0.286649 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 07:56:55.590184 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 07:57:02.597263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:57:10.598261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:57:26.601675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 07:57:58.607573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:03:36.113267 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:03:36.113501 1.709357 tcp 10.0.2.105 50837 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:04:02.613949 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:04:09.620942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:04:17.622379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:04:33.625335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:05:05.631682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:11:09.637544 3.001394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:11:16.645138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:11:24.646124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:11:40.649620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:12:12.655716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:18:16.661488 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:18:23.668654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:18:31.669902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:18:47.672967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:19:19.679424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:24:01.965857 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:24:01.965956 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 08:24:17.509971 0.569770 tcp 10.0.2.105 50838 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:18.080065 0.550869 tcp 10.0.2.105 50839 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:18.631175 1.161201 tcp 10.0.2.105 50840 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:19.793161 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 08:24:37.236997 0.580955 tcp 10.0.2.105 50841 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:37.818186 0.608614 tcp 10.0.2.105 50842 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:38.427111 1.160669 tcp 10.0.2.105 50843 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:24:39.588546 0.663278 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:40.252370 0.280475 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:40.533209 0.306651 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:40.840420 0.376195 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:41.217017 0.319784 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:41.537255 0.413098 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:41.950764 0.406042 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:42.357167 0.539013 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:42.896594 0.414655 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:43.311630 0.464974 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:43.776966 0.583013 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:44.360400 0.395910 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:44.756706 0.414874 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:45.171935 0.483896 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:45.656234 0.307427 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:45.964005 0.425150 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:46.389587 0.313988 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:46.703973 0.376091 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:24:47.080609 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 08:25:02.814211 0.553269 tcp 10.0.2.105 50844 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:03.367729 0.569348 tcp 10.0.2.105 50845 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:03.937388 1.275563 tcp 10.0.2.105 50846 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:05.213705 0.395306 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:05.609449 0.311350 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:05.921204 0.438108 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:06.359675 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 08:25:23.042817 0.568833 tcp 10.0.2.105 50847 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:23.611913 0.582869 tcp 10.0.2.105 50848 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:23.685928 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 08:25:24.195062 1.156755 tcp 10.0.2.105 50849 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:25:25.352460 0.458370 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:25.811239 0.358264 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:26.169892 0.475857 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:26.646160 0.288781 udp 10.0.2.105 7010 <-> 91.16.187.134 2194 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:26.935353 0.302007 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:27.237731 0.360023 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:27.598158 0.418975 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:28.017553 0.287041 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:28.305011 0.302341 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:28.607731 0.327511 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:28.935597 0.326328 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:29.262353 0.391714 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:25:30.692808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:25:38.694088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:25:54.697373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:26:26.703177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:32:30.709504 3.001687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:32:37.716807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:32:45.718198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:33:01.721334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:33:33.727517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:33:37.823486 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:33:37.823729 1.688133 tcp 10.0.2.105 50850 -> 128.255.183.224 9027 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:39:37.733766 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:39:44.740928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:39:52.741887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:40:08.745273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:40:40.750954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:46:44.757330 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:46:51.764263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:46:59.766289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:47:15.769209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:47:47.775309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:53:51.781407 3.001350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 08:53:58.788291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:54:06.790210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:54:22.793117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:54:54.799476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 08:55:33.996029 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 08:55:33.996137 0.432246 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:34.428849 0.297151 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:34.726577 0.320220 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:35.047252 0.673695 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:35.721338 0.298868 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:36.020560 0.320859 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:36.341807 0.384989 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:36.727190 0.425834 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:37.153489 0.308518 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:37.462322 0.389269 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:37.851938 0.426791 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:38.279109 0.520206 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:38.799740 0.618425 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:39.418552 0.472810 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:39.891724 0.404449 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:40.296606 0.403782 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:40.700801 0.491710 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:41.192885 0.317876 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:41.511151 0.381138 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:41.892702 0.310918 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:42.204038 0.396222 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:42.600625 0.399208 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:43.000345 0.304690 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:43.305444 0.426110 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:43.731939 0.481992 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:44.214308 0.306693 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:44.521395 0.441286 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:55:44.963055 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 08:56:01.768990 0.573666 tcp 10.0.2.105 50851 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:56:02.342937 0.575662 tcp 10.0.2.105 50852 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:56:02.918888 1.165924 tcp 10.0.2.105 50853 -> 195.113.214.226 443 SRPA* 0 0 21 12434 flow=From-Botnet-V2-TCP-Established 1970/01/06 08:56:04.085499 0.315744 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:04.401622 0.282797 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:04.684820 0.389108 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:05.074326 1.038273 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:06.112980 0.339553 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:06.452953 0.304038 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:06.757385 0.310544 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/06 08:56:07.068372 0.400648 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:00:58.805273 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 09:01:05.812538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:01:13.813921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:01:29.816723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:02:01.823189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:03:39.513944 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:03:39.514056 1.761733 tcp 10.0.2.105 50854 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:08:05.829737 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:08:12.836615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:08:20.838064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:08:36.840909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:09:08.847323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:15:12.853823 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:15:19.860290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:15:27.862327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:15:43.865035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:16:15.870895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:22:19.877376 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:22:26.884757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:22:35.427059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:22:51.429488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:23:23.496232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:26:28.252100 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:26:28.252351 0.000000 udp 10.0.2.105 7010 -> 91.16.187.134 2194 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 09:26:44.317447 0.576765 tcp 10.0.2.105 50855 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:26:44.894489 0.583835 tcp 10.0.2.105 50856 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:26:45.478608 1.228206 tcp 10.0.2.105 50857 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:26:46.707536 0.327013 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:47.034948 0.415150 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:47.450484 0.300431 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:47.751281 0.355453 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:48.107164 0.708516 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:48.816103 0.283416 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:49.099951 0.393981 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:49.494326 0.420513 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:49.915234 0.398792 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:50.314432 0.308866 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:50.623711 0.421865 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:51.046021 0.523215 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:51.569591 0.419511 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:51.989441 0.584515 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:52.574388 0.491560 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:53.066315 0.843739 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:53.910493 0.981435 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:54.892422 0.330833 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:55.223673 0.387095 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:55.611207 0.309622 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:55.921291 0.404438 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:56.326135 0.366409 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:56.692945 0.296467 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:56.989819 0.433085 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:57.423335 0.464359 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:57.888085 0.336132 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:58.224627 0.453299 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:58.678288 0.310912 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:58.989552 0.272538 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:59.262500 0.377232 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:26:59.640131 0.415206 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:27:00.055723 0.327162 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:27:00.383299 0.340430 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:27:00.724136 0.309816 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:27:01.034287 0.379350 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:29:27.501751 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 09:29:34.508940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:29:42.510771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:29:58.514050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:30:30.519708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:33:41.544707 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:33:41.544816 1.720851 tcp 10.0.2.105 50858 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:36:34.525245 3.002394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:36:41.533171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:36:49.534852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:37:05.538029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:37:37.543510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:43:41.550575 3.000932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:43:48.557684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:43:56.558554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:44:12.561836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:44:44.567409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:50:48.573682 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 09:50:55.581242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:51:03.582701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:51:19.585926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:51:51.591703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:57:15.818564 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 09:57:15.818764 0.316369 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:16.135523 0.313709 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:16.449629 0.426039 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:16.876107 0.301618 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:17.178144 0.675259 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:17.853823 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 09:57:35.129738 0.576073 tcp 10.0.2.105 50859 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:57:35.706082 0.549918 tcp 10.0.2.105 50860 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:57:36.256421 1.161662 tcp 10.0.2.105 50861 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 09:57:37.418830 0.386418 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:37.805640 0.409981 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:38.216007 0.388714 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:38.605105 0.310677 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:38.916143 0.406904 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:39.323406 0.526318 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:39.850073 0.397655 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:40.248092 0.561791 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:40.810272 0.456792 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:41.267434 0.390581 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:41.658418 0.475834 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:42.134608 0.302507 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:42.437522 0.401470 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:42.839394 0.298327 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:43.138077 0.300101 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:43.438564 0.401806 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:43.840761 0.381643 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:44.222798 0.331570 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:44.554762 0.444399 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:44.999575 0.476096 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:45.476080 0.499679 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:45.976137 0.307654 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:46.284180 0.486464 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:46.771042 0.271361 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:47.042885 0.361284 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:47.404672 0.307073 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:47.712141 0.308912 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:48.021432 0.345381 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:48.367148 0.396032 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 09:57:55.598643 3.000937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 09:58:02.605393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:58:10.606952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:58:26.609848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 09:58:58.615629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:03:43.266033 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:03:43.266257 1.884334 tcp 10.0.2.105 50862 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:05:02.621919 3.001388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:05:09.629179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:05:17.630470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:05:33.633437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:06:05.639543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:12:09.645587 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:12:16.653239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:12:24.654260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:12:40.657822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:13:12.663497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:19:16.669524 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:19:23.676847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:19:31.678200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:19:47.681327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:20:19.737553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:26:23.744544 3.001114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:26:30.751380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:26:38.752731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:26:54.755840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:27:26.761690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:28:09.453351 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:28:09.453533 0.310390 udp 10.0.2.105 7010 <-> 46.151.79.173 2230 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:09.764362 0.323998 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:10.088714 0.414911 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:10.504001 0.321060 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:10.825473 0.302371 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:11.128410 0.703740 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:11.832561 0.364785 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:12.222017 0.420926 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:12.643318 0.414271 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:13.057968 0.324235 udp 10.0.2.105 7010 <-> 79.27.134.208 2054 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:13.382599 0.414700 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:13.797656 0.932386 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:14.730409 0.544975 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:15.275801 0.588434 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:15.864640 0.496769 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:16.361774 0.465146 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:16.827331 0.387554 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:17.215288 0.301144 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:17.516810 0.396490 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:17.913717 0.302760 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:18.216915 0.393941 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:18.611224 0.301663 udp 10.0.2.105 7010 <-> 93.177.172.241 4362 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:18.913266 0.405870 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:19.319553 0.341145 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:19.661113 0.433502 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:20.095014 0.473990 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:20.569341 0.514012 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:21.083733 0.308613 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:21.392754 0.413161 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:21.806331 0.301132 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:22.107853 0.314353 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:22.422620 0.366761 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:22.789802 0.293842 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:23.084044 0.334696 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:28:23.419093 0.397690 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:33:30.768026 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:33:37.774740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:33:45.176347 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:33:45.176580 1.687389 tcp 10.0.2.105 50863 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:33:45.776199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:34:01.779716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:34:33.785416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:40:37.791085 3.002228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:40:44.798659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:40:52.800244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:41:08.803611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:41:40.809947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:47:44.815266 3.001807 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:47:51.822705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:47:59.824450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:48:15.827571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:48:47.833807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:54:51.840024 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 10:54:58.846787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:55:06.848092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:55:22.851875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:55:54.857682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 10:58:33.445667 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 10:58:33.445809 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 10:58:50.503398 0.582608 tcp 10.0.2.105 50864 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:58:51.086283 0.569913 tcp 10.0.2.105 50865 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:58:51.656468 1.406125 tcp 10.0.2.105 50866 -> 195.113.214.226 443 SRPA* 0 0 37 24914 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:58:53.063298 0.316870 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:53.380729 0.303179 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:53.684346 0.418982 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:54.103711 0.315107 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:54.419213 0.600082 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:55.019668 0.387216 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:55.407303 0.429473 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:55.837189 0.398162 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:58:56.235759 0.000000 udp 10.0.2.105 7010 -> 79.27.134.208 2054 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 10:59:13.504678 0.552642 tcp 10.0.2.105 50867 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:59:14.057601 0.671521 tcp 10.0.2.105 50868 -> 195.113.214.226 80 SRPA* 0 0 21 14737 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:59:14.729434 0.406672 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:15.136670 0.412863 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:15.549919 0.514782 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 198 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:16.065086 0.575057 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:16.640506 0.393235 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:17.034138 0.502376 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:17.536942 0.469381 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:18.006721 0.322828 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:18.329888 0.402901 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:18.733189 0.312849 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:19.046433 0.383307 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:19.430179 0.000000 udp 10.0.2.105 7010 -> 93.177.172.241 4362 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 10:59:36.918158 0.559145 tcp 10.0.2.105 50869 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:59:37.477592 0.571582 tcp 10.0.2.105 50870 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:59:38.049032 1.135920 tcp 10.0.2.105 50871 -> 195.113.214.226 443 SRPA* 0 0 24 13430 flow=From-Botnet-V2-TCP-Established 1970/01/06 10:59:39.185636 0.414405 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:39.600453 0.396064 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:39.996906 0.350042 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:40.347303 0.461829 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:40.809531 0.441122 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:41.251040 0.306514 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:41.557945 0.409651 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:41.968002 0.308491 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/06 10:59:42.276892 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 10:59:59.660646 0.568286 tcp 10.0.2.105 50872 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:00:00.229283 0.632677 tcp 10.0.2.105 50873 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:00:00.862273 1.161384 tcp 10.0.2.105 50874 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:00:02.024425 0.316280 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:00:02.341061 0.358897 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:00:02.700394 0.337214 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:00:03.038032 0.421665 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:01:58.862947 3.002233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 11:02:05.870544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:02:13.872755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:02:29.875066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:03:01.881736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:03:46.866504 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:03:46.866615 1.674499 tcp 10.0.2.105 50875 -> 128.255.183.224 9027 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:09:05.887773 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:09:12.895038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:09:20.896452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:09:36.899547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:10:08.905621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:16:12.911564 3.001335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:16:19.918619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:16:27.920261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:16:43.923682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:17:15.929682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:23:19.935297 3.002060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:23:26.942775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:23:34.944103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:23:50.947494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:24:22.953383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:30:06.998088 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:30:06.998347 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 11:30:24.235718 0.571668 tcp 10.0.2.105 50876 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:24.807709 0.579227 tcp 10.0.2.105 50877 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:25.387260 1.176590 tcp 10.0.2.105 50878 -> 195.113.214.226 443 SRPA* 0 0 23 11880 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:26.564511 0.000000 udp 10.0.2.105 7010 -> 79.27.134.208 2054 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 11:30:26.959717 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:30:33.966985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:30:41.967901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:30:42.680792 0.578407 tcp 10.0.2.105 50879 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:43.259478 0.586998 tcp 10.0.2.105 50880 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:43.846776 1.156863 tcp 10.0.2.105 50881 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:30:45.004568 0.000000 udp 10.0.2.105 7010 -> 93.177.172.241 4362 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 11:30:57.971505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:31:02.208630 0.553736 tcp 10.0.2.105 50882 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:02.762663 0.571237 tcp 10.0.2.105 50883 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:03.334174 1.190756 tcp 10.0.2.105 50884 -> 195.113.214.226 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:04.525239 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 11:31:19.674067 0.599276 tcp 10.0.2.105 50885 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:20.273646 0.581068 tcp 10.0.2.105 50886 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:20.854972 1.141111 tcp 10.0.2.105 50887 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:21.996747 0.296289 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:22.293442 0.423913 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:22.717757 0.332770 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:23.050992 0.616211 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:23.667569 0.310707 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:23.978693 0.377892 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:24.356962 0.422744 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:24.780089 0.530489 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:25.311046 0.422269 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:25.733732 0.407099 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:26.141229 0.529112 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:26.670821 0.395540 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:27.066766 0.581795 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:27.648981 0.470231 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:28.119571 0.487289 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:28.607235 0.394775 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:29.002428 0.332775 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:29.335608 0.301263 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:29.637290 0.380629 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:29.977364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:31:30.018310 0.431859 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:30.450570 0.410309 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:30.861281 0.440359 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:31.302052 0.463353 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:31.765809 0.335877 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:32.102068 0.314788 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:32.417266 0.415952 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:32.833530 0.283949 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:33.117851 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 11:31:51.510085 0.543685 tcp 10.0.2.105 50888 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:52.054061 0.563062 tcp 10.0.2.105 50889 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:52.616983 1.156162 tcp 10.0.2.105 50890 -> 195.113.214.226 443 SRPA* 0 0 23 14606 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:31:53.773940 0.382054 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:54.156400 0.369158 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:31:54.525949 0.400551 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 11:33:48.547295 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 11:33:48.547512 1.733275 tcp 10.0.2.105 50891 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/06 11:37:33.983751 3.001171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 11:37:40.990891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:37:48.992220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:38:04.995085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:38:37.001368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:44:41.007516 3.001757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:44:48.014330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:44:56.015832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:45:12.018985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:45:44.024991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:51:48.031636 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:51:55.038947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:52:03.040131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:52:19.043377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:52:51.049278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:58:55.055907 3.000796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 11:59:02.062908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:59:10.064136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:59:26.067279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 11:59:58.073108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:02:08.911465 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:02:08.911617 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 12:02:27.239797 0.566974 tcp 10.0.2.105 50892 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:27.807099 0.569506 tcp 10.0.2.105 50893 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:28.376896 1.214526 tcp 10.0.2.105 50894 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:29.592026 0.328324 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:29.920789 0.303350 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:30.224591 0.425543 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:30.650540 0.317111 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:30.968000 0.601001 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:31.569408 0.427032 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:31.996835 0.352271 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:32.349483 0.410695 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:32.760549 0.400071 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:33.160993 0.417277 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:33.578676 0.397267 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:33.976469 0.524206 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:34.501062 0.579366 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:35.080848 0.460828 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:35.542096 0.399904 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:35.942413 0.483317 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:36.426137 0.393756 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:36.820461 0.309240 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:37.130087 0.309072 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:37.439588 0.401505 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:37.841516 0.444036 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:38.285949 0.341505 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:38.627783 0.453151 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:39.081341 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 12:02:55.719843 0.561702 tcp 10.0.2.105 50895 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:56.281908 0.575267 tcp 10.0.2.105 50896 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:56.857472 1.156931 tcp 10.0.2.105 50897 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:02:58.015083 0.413828 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:58.429320 0.300172 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:58.729858 0.264750 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:58.994965 0.317207 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:59.312521 0.375637 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:02:59.688563 0.395506 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:03:50.287593 1.700031 tcp 10.0.2.105 50898 -> 128.255.183.224 9027 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:06:02.079656 3.001658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 12:06:09.086584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:06:17.087803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:06:33.091011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:07:05.097283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:13:09.103603 3.001011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:13:16.110364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:13:24.112394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:13:40.114723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:14:12.121288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:20:16.127132 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:20:23.134234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:20:31.135783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:20:47.139641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:21:19.145679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:27:23.151094 3.001901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:27:30.158253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:27:38.160134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:27:54.163304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:28:26.169131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:33:06.672487 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 12:33:06.672591 0.466096 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:07.139093 0.336259 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:07.475742 0.295731 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:07.771927 0.313776 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:08.086074 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 12:33:24.711257 0.572384 tcp 10.0.2.105 50899 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:25.283935 0.564744 tcp 10.0.2.105 50900 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:25.848977 1.143076 tcp 10.0.2.105 50901 -> 195.113.214.226 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:26.992793 0.633603 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:27.626804 0.415264 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:28.042474 0.401672 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:28.444715 0.429555 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:28.874676 0.389818 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:29.264897 0.399530 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:29.664868 0.389251 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:30.054517 0.590340 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:30.645278 0.535424 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:31.181080 0.383765 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:31.565273 0.470284 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:32.035886 0.375398 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:32.411684 0.493363 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:32.905419 0.312939 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:33.218760 0.405676 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:33.624833 0.283040 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:33.908275 0.459019 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:34.367697 0.336293 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:34.704420 0.437584 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:35.142410 0.296862 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:35.439644 0.282136 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:35.722188 0.411758 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:36.134298 0.417805 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:33:36.552512 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 12:33:51.728363 0.557195 tcp 10.0.2.105 50902 -> 195.113.214.251 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:51.987926 1.704733 tcp 10.0.2.105 50903 -> 128.255.183.224 9027 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:52.285851 0.585181 tcp 10.0.2.105 50904 -> 195.113.214.226 80 FSPA* 0 0 10 1917 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:52.871297 1.152019 tcp 10.0.2.105 50905 -> 195.113.214.226 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/01/06 12:33:54.023953 0.360598 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 12:34:30.175624 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 12:34:37.182642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:34:45.183666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:35:01.187107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:35:33.193304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:41:37.198940 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:41:44.206279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:41:52.207954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:42:08.210921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:42:40.217407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:48:44.222491 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:48:51.230206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:48:59.231870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:49:15.234864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:49:47.240763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:55:51.247375 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 12:55:58.254183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:56:06.256185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:56:22.258786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 12:56:54.264919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:02:58.271263 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:03:05.278401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:03:13.279964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:03:29.282770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:03:53.698780 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:03:53.699039 1.705804 tcp 10.0.2.105 50906 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:04:01.289130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:04:07.328089 0.417694 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:07.746178 0.489336 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:08.235870 0.420673 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:08.656913 0.337966 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:08.995307 0.310518 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:09.306189 0.301434 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:09.608038 0.454673 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:10.063125 0.635115 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:10.698610 0.382132 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:11.081109 0.405025 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:11.486547 0.425018 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:11.911975 0.388785 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:12.301163 0.392904 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:12.694472 0.573467 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:13.268351 0.517721 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:13.786412 0.469566 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:14.256424 0.386480 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:14.643306 0.378087 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:15.021761 1.124893 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:16.147024 0.311292 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:16.458690 0.394143 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:16.853220 0.298572 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:17.152161 0.433309 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:17.585877 0.327918 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:17.914145 0.469917 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:18.384447 0.310086 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:18.694935 0.265940 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:18.961272 0.417964 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:18.974233 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:04:19.379595 0.411448 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:04:19.791449 0.362527 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:10:05.295209 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:10:12.302470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:10:20.303896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:10:36.306754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:11:08.312617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:17:12.318804 3.001892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:17:19.326001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:17:27.327397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:17:43.330898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:18:15.336461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:24:19.343658 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:24:26.350238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:24:34.351965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:24:50.354732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:25:22.360620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:31:26.366498 3.002214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:31:33.374457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:31:41.375853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:31:57.378385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:32:29.384438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:33:55.409009 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:33:55.409114 1.703791 tcp 10.0.2.105 50907 -> 128.255.183.224 9027 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:34:38.580910 0.431877 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:39.013212 0.304722 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:39.318338 0.468410 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:39.787118 0.310475 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:40.098013 0.319071 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:40.417493 0.310661 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:40.728545 0.422736 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:41.151685 0.623594 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:41.775683 0.376438 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:42.152474 0.422221 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:42.575066 0.405853 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:42.981270 0.392473 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:43.374111 0.388939 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:43.467558 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 13:34:43.763425 0.585888 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:44.349677 0.505568 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:44.855635 0.441849 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:45.297883 0.395238 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:45.693525 0.389423 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:46.083360 0.496637 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:46.580426 0.318028 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:46.898889 0.318840 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:47.218156 0.409161 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:47.627688 0.414298 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:34:48.042380 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 13:35:03.137786 0.551870 tcp 10.0.2.105 50908 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:35:03.689992 0.584815 tcp 10.0.2.105 50909 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:35:04.274692 1.348140 tcp 10.0.2.105 50910 -> 195.113.214.226 443 SRPA* 0 0 33 24973 flow=From-Botnet-V2-TCP-Established 1970/01/06 13:35:05.623529 0.276172 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:35:05.900092 0.468698 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:35:06.369186 0.304607 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:35:06.674139 0.429411 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:35:07.103900 0.447193 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:35:07.551499 0.394797 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 13:38:33.391065 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 13:38:40.398282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:38:48.399395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:39:04.402308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:39:36.408677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:45:40.414470 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:45:47.421847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:45:55.423923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:46:11.426458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:46:43.432895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:52:47.439285 3.000685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 13:52:54.446283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:53:02.447562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:53:18.450492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:53:50.456879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 13:59:54.463044 3.001009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:00:01.470165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:00:09.471913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:00:25.474220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:00:57.480305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:03:57.119451 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:03:57.119550 1.714938 tcp 10.0.2.105 50911 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:05:24.374689 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:05:24.374810 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 14:05:39.608697 0.548186 tcp 10.0.2.105 50912 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:05:40.157117 0.616114 tcp 10.0.2.105 50913 -> 195.113.214.226 80 SRPA* 0 0 18 13346 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:05:40.773875 0.419816 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:41.194061 0.334069 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:41.528532 0.504894 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:42.033827 0.342310 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:42.376697 0.429205 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:42.806270 0.299164 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:43.105804 0.310378 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:43.416540 0.613992 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:44.030981 0.389419 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:44.420723 0.413880 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:44.834960 0.423194 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:45.258475 0.409620 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:45.668499 0.387119 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:46.056008 0.531096 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:46.587457 0.591340 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:47.179206 0.377915 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:47.557531 0.457299 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:48.015202 0.385328 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:48.400951 0.497886 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:48.899207 0.302290 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:49.201904 0.330327 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:49.532638 0.437353 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:49.970357 0.408468 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:50.379231 0.267957 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:50.647547 0.385100 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:51.033059 0.474688 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:51.508114 0.277099 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:51.785624 0.417555 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:05:52.203613 0.404230 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:07:01.486493 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 14:07:08.493693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:07:16.495306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:07:32.498499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:08:04.504360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:14:08.810370 3.002348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:14:15.818507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:14:23.819595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:14:41.926060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:15:13.931728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:21:17.938702 3.000782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:21:24.945292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:21:32.947194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:21:48.949965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:22:20.956125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:28:26.964554 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:28:33.972284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:28:41.973426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:28:57.977158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:29:29.982757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:34:01.083469 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:34:01.083572 1.718738 tcp 10.0.2.105 50914 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:35:33.989438 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:35:40.996519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:35:48.997962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:35:55.587456 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 14:35:55.587550 0.423922 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:35:56.011885 0.335561 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:35:56.347790 0.432862 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:35:56.781039 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 14:36:05.000770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:36:12.834426 0.575715 tcp 10.0.2.105 50915 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:36:13.410419 0.627332 tcp 10.0.2.105 50916 -> 195.113.214.226 80 SRPA* 0 0 20 13453 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:36:14.038297 0.332471 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:14.371121 0.443922 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:14.815428 0.313391 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:15.129207 0.624447 udp 10.0.2.105 7010 <-> 183.235.132.191 9213 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:15.754016 0.413462 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:16.167846 0.370379 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:16.538616 0.421576 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:16.960753 0.397344 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:17.358625 0.938110 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:18.297150 0.521818 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:18.819368 0.884973 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:19.704737 0.366282 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:20.071394 0.519947 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:20.591752 0.310485 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:20.902650 0.390471 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:21.293494 0.498675 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:21.792487 0.315992 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:22.108835 0.442898 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:22.552137 0.404712 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:22.957254 0.271209 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:23.228816 0.357372 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:23.586593 0.409914 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:23.996857 0.466634 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:36:24.463902 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 14:36:37.006737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:36:39.531336 0.721975 tcp 10.0.2.105 50917 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:36:40.253701 0.607649 tcp 10.0.2.105 50918 -> 195.113.214.226 80 SRPA* 0 0 20 13434 flow=From-Botnet-V2-TCP-Established 1970/01/06 14:36:40.861963 0.399265 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/06 14:42:41.012936 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:42:48.020066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:42:56.021611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:43:12.024362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:43:44.031001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:49:48.037026 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:49:55.044218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:50:03.045862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:50:19.048613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:50:51.054520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:56:55.061336 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 14:57:02.067801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:57:10.069462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:57:26.072249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 14:57:58.078613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:04:02.084421 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:04:02.804019 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:04:02.804122 1.772071 tcp 10.0.2.105 50919 -> 128.255.183.224 9027 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:04:09.091702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:04:17.093443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:04:33.096241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:05:05.102738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:06:47.837447 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:06:47.837575 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 15:07:05.748509 0.874374 tcp 10.0.2.105 50920 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:06.623116 0.553906 tcp 10.0.2.105 50921 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:07.177318 1.408479 tcp 10.0.2.105 50922 -> 195.113.214.226 443 SRPA* 0 0 36 26973 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:08.586524 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 15:07:27.478185 0.563099 tcp 10.0.2.105 50923 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:28.041145 0.584399 tcp 10.0.2.105 50924 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:28.625836 1.162858 tcp 10.0.2.105 50925 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:29.789415 0.326775 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:30.116564 0.416283 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:30.533223 0.530289 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:31.063880 0.317254 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:31.381493 0.413041 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:31.794942 0.321810 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:32.117082 0.405314 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:32.522812 0.000000 udp 10.0.2.105 7010 -> 183.235.132.191 9213 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 15:07:48.839215 0.564358 tcp 10.0.2.105 50926 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:49.403933 0.567103 tcp 10.0.2.105 50927 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:49.971308 1.148239 tcp 10.0.2.105 50928 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:07:51.120136 0.400022 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:51.520636 0.411250 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:51.932337 0.399609 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:52.332366 0.383355 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:52.716106 0.541561 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:53.258048 0.566594 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:53.825070 0.388375 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:54.213860 0.459902 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:54.674125 0.304144 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:54.978619 0.386405 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:55.365433 0.493135 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:55.858965 0.323543 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:56.182908 0.256017 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:56.439257 0.412439 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:56.852034 0.443578 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:57.296014 0.421940 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:57.718356 0.361384 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:58.080110 0.461803 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:07:58.542262 0.396290 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:11:09.249487 3.000942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 15:11:16.255958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:11:24.257595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:11:40.260622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:12:12.266698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:18:16.273020 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:18:23.279891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:18:31.281373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:18:47.285194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:19:19.290623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:25:23.296835 3.001542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:25:30.304360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:25:38.305581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:25:54.308614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:26:26.314365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:32:30.321118 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:32:37.398742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:32:45.399412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:33:01.402584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:33:33.408493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:34:04.754185 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:34:04.754351 1.894497 tcp 10.0.2.105 50929 -> 128.255.183.224 9027 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:38:21.273462 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 15:38:21.273585 0.000000 udp 10.0.2.105 7010 -> 183.235.132.191 9213 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 15:38:40.262398 0.580623 tcp 10.0.2.105 50930 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:38:40.843303 0.563419 tcp 10.0.2.105 50931 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:38:41.407004 1.133958 tcp 10.0.2.105 50932 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:38:42.541700 0.303614 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:42.845750 0.427236 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:43.273408 0.311558 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:43.585382 0.478705 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:44.064523 0.421500 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:44.486429 0.408463 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:44.895288 0.326904 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:45.222595 0.389165 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:45.612159 0.414164 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:46.026728 0.392129 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:46.419245 0.869147 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:38:47.288810 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 15:39:05.076923 0.554202 tcp 10.0.2.105 50933 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:39:05.631420 0.616648 tcp 10.0.2.105 50934 -> 195.113.214.226 80 SRPA* 0 0 20 14723 flow=From-Botnet-V2-TCP-Established 1970/01/06 15:39:06.248712 0.601831 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:06.850934 0.390464 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:07.241732 0.375288 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:07.617383 0.446972 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:08.064743 0.305307 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:08.370403 0.546377 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:08.917177 0.305827 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:09.223411 0.285061 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:09.508945 0.412740 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:09.922078 0.370386 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:10.292868 0.452868 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:10.746138 0.413415 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:11.159957 0.462152 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:11.622465 0.401569 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 15:39:37.417562 2.998670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 15:39:44.422558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:39:52.424034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:40:08.426820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:40:40.432739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:46:44.439346 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:46:51.446090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:46:59.447906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:47:15.450406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:47:47.456466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:53:51.463283 3.000889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 15:53:58.469757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:54:06.471309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:54:22.474507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 15:54:54.480338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:00:58.486898 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:01:05.494029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:01:13.495346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:01:29.498676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:02:01.504510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:04:06.654913 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:04:06.655023 1.708886 tcp 10.0.2.105 50935 -> 128.255.183.224 9027 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:08:05.511492 3.000536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:08:12.517660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:08:20.519809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:08:36.522622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:09:08.528771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:09:32.112849 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:09:32.112952 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 16:09:50.081039 0.567269 tcp 10.0.2.105 50936 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:09:50.648138 0.611929 tcp 10.0.2.105 50937 -> 195.113.214.226 80 SRPA* 0 0 18 13316 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:09:51.260775 0.307140 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:51.568488 0.416576 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:51.985453 0.414751 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:52.400611 0.308964 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:52.709994 0.405085 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:53.115503 0.435029 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:53.550929 0.317434 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:53.868681 0.419031 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:54.288129 0.368453 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:54.656988 0.393245 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:55.050616 0.381040 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:55.432063 0.575852 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:56.008430 0.414206 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:56.423024 0.386505 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:56.809909 0.482633 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:57.292965 0.319902 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:57.613272 0.309798 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:57.923490 0.490534 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:58.414422 0.268395 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:58.683178 0.390852 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:59.074412 0.362071 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:59.436925 0.425777 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:09:59.863127 0.413536 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:10:00.276997 0.463501 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:10:00.740849 0.372161 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:15:12.534945 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:15:19.542230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:15:27.543668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:15:43.546306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:16:15.553300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:22:19.559477 3.000644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:22:26.566252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:22:34.567658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:22:50.570299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:23:22.576432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:29:26.582524 3.001962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:29:33.589609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:29:41.591402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:29:57.594253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:30:29.600244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:34:08.365623 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:34:08.365727 1.750108 tcp 10.0.2.105 50938 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/06 16:36:33.606776 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:36:40.613917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:36:48.615054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:37:04.618432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:37:36.624137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:40:07.281618 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 16:40:07.281907 0.314405 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:07.596721 0.422558 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:08.019696 0.425294 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:08.445364 0.481677 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:08.927407 0.296123 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:09.223955 0.423886 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:09.648243 0.297782 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:09.946451 0.457788 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:10.404654 0.378790 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:10.783804 0.398124 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:11.182332 0.384128 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:11.566794 0.568946 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:12.136145 0.391172 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:12.527663 0.382310 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:12.910396 0.478186 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:13.389032 0.312833 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:13.702316 0.310012 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:14.012753 0.418737 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:14.431930 0.487331 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:14.919675 0.268502 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:15.188579 0.365366 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:15.554321 0.454735 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:16.009448 0.415170 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:16.424982 0.471675 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:40:16.897073 0.392140 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/06 16:43:40.630617 3.001160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:43:47.638133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:43:55.639180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:44:11.642110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:44:43.648187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:50:47.653983 3.002028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:50:54.661915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:51:02.663686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:51:18.666128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:51:50.672052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:57:54.679179 3.000957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 16:58:01.685795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:58:09.687488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:58:25.690260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 16:58:57.696009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:04:10.116499 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:04:10.116766 1.645022 tcp 10.0.2.105 50939 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:05:01.702901 3.001379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:05:08.709603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:05:16.710980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:05:32.713940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:06:04.720464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:10:23.863330 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:10:23.863582 0.328532 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:24.192529 0.422608 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:24.615492 0.308721 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:24.924560 0.408886 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:25.333774 0.476278 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:25.810442 0.426441 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:26.237296 0.328807 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:26.566451 0.387780 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:26.954619 0.412972 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:27.367976 0.394830 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:27.763225 0.385841 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:28.149426 0.580470 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:28.730305 0.383311 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:29.113999 0.386964 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:29.501375 0.308768 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:29.810558 0.463967 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:30.274901 0.315257 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:30.590538 0.400278 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:30.991180 0.494535 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:31.486110 0.267564 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:31.754017 0.378469 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:32.132942 0.432447 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:32.565806 0.394239 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:32.960422 0.500403 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:10:33.461213 0.466604 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:12:08.726340 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:12:15.733833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:12:23.734897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:12:39.738393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:13:11.743989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:19:15.750608 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:19:22.758057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:19:30.759494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:19:46.762070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:20:18.768501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:26:22.774586 3.041831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:26:29.821640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:26:37.823453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:26:53.826358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:27:26.723665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:33:30.729794 3.001645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:33:37.737046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:33:45.738748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:34:01.741780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:34:12.236941 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:34:12.237048 1.808395 tcp 10.0.2.105 50940 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/06 17:34:33.747817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:40:37.753132 3.002378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:40:42.478366 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 17:40:42.478554 0.323307 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:42.802252 0.417929 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:43.220616 0.310357 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:43.531339 0.411727 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:43.943440 0.491008 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:44.434861 0.417543 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:44.760896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:40:44.852838 0.332648 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:45.249039 0.387084 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:45.636554 0.412903 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:46.049862 0.432568 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:46.482803 0.367717 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:46.850969 0.611653 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:47.462991 0.383546 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:47.846918 0.449263 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:48.296606 0.356884 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:48.653892 0.300515 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:48.954808 0.318863 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:49.274099 0.410509 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:49.685022 0.477466 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:50.162900 0.272582 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:50.435871 0.347313 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:50.783520 0.853436 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:51.637362 0.390535 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:52.028254 0.548553 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:52.577188 0.464026 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/06 17:40:52.762216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:41:08.765845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:41:40.771415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:47:44.778187 3.000885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:47:51.784754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:47:59.786674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:48:15.789594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:48:47.795702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:54:51.801862 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 17:54:58.808767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:55:06.810131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:55:22.813144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 17:55:54.819701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:01:58.825280 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:02:05.833118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:02:13.834279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:02:29.837766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:03:01.843632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:04:14.047402 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:04:14.047699 1.732910 tcp 10.0.2.105 50941 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:09:05.849163 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:09:12.857278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:09:20.858503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:09:36.861402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:10:08.867028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:10:54.002321 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:10:54.002419 0.326818 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:54.329699 0.421494 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:54.751561 0.313517 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:55.065486 0.397488 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:55.463429 0.529692 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:55.993537 0.418187 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:56.412075 0.315529 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:56.728004 0.400312 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:57.128693 0.407777 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:57.536897 0.421899 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:57.959211 0.391646 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:58.351269 0.574282 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:58.925907 0.382641 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:59.308997 0.460703 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:10:59.770123 0.322045 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:00.092708 0.393104 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:00.486261 0.301466 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:00.788211 0.404338 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:01.192948 0.497990 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:01.691319 0.269354 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:01.961113 0.365618 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:02.327078 0.444522 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:02.771926 0.397776 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:11:03.170147 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:11:18.189996 0.528622 tcp 10.0.2.105 50942 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:11:18.718503 0.570757 tcp 10.0.2.105 50943 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:11:19.289109 1.132302 tcp 10.0.2.105 50944 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:11:20.422044 0.466652 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:16:12.873984 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:16:19.880669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:16:27.882095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:16:43.885458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:17:15.891430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:23:19.897831 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:23:26.904590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:23:34.905985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:23:50.909333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:24:22.915659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:30:26.921685 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:30:33.928780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:30:41.930227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:30:57.932880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:31:29.939179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:34:15.788597 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:34:15.788798 1.763875 tcp 10.0.2.105 50945 -> 128.255.183.224 9027 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:37:33.945548 3.000990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 18:37:40.952505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:37:48.954054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:38:04.956805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:38:36.963313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:41:32.826528 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:41:32.826732 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:41:51.585293 0.557274 tcp 10.0.2.105 50946 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:41:52.142794 0.572402 tcp 10.0.2.105 50947 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:41:52.715522 1.116713 tcp 10.0.2.105 50948 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/06 18:41:53.833042 0.315492 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:54.148897 0.313029 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:54.462314 0.415493 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:54.878189 0.424072 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:55.302678 0.478190 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:55.781269 0.316080 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:56.097744 0.423724 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:56.521851 0.393658 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:56.915833 0.400850 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:57.317117 0.411073 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:57.728624 0.377716 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:58.106757 0.376294 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:58.483478 0.595007 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:59.078869 0.323914 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:59.403148 0.460931 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:41:59.864487 0.305468 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:00.170341 0.364332 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:00.535065 0.406515 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:00.941988 0.347635 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:01.290028 0.271576 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:01.561996 0.495794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:02.058244 0.386582 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:02.445157 0.433958 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:02.879593 0.468175 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:03.368913 0.303115 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:03.672516 0.412210 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:04.085242 0.420397 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:04.506212 0.306810 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:04.813507 0.488395 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:05.302428 0.313381 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:05.616418 0.406613 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:06.023544 0.391042 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:06.415134 0.417747 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:06.833444 0.383205 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:07.217244 0.416981 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:07.634729 0.402615 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:08.037915 0.584725 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:08.623225 0.313827 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:08.937627 0.301970 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:09.240194 0.455841 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:09.696655 0.391333 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:10.088668 0.375072 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:10.464229 0.365089 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:10.829913 0.266070 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:11.096568 0.546761 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:11.643963 0.430949 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:12.075414 0.474296 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:12.550345 0.398715 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:12.949633 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:16.849012 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:42:21.325592 0.315972 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:42:21.654033 0.000000 udp 10.0.2.105 7010 -> 24.39.31.250 6234 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:29.758154 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:36.157481 0.286169 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:36.443650 0.000000 icmp 213.209.66.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 182 flow=Background 1970/01/06 18:42:40.853704 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:42:41.204862 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:47.173229 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:42:53.061234 0.000000 udp 10.0.2.105 7010 -> 64.229.176.99 3250 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:00.292043 0.000000 udp 10.0.2.105 7010 -> 86.186.54.6 4408 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:04.848079 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:43:05.599946 0.000000 udp 10.0.2.105 7010 -> 88.249.84.67 4699 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:12.118631 0.295570 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:43:12.438866 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:17.507089 0.000000 udp 10.0.2.105 7010 -> 118.82.179.48 9712 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:24.897431 0.000000 udp 10.0.2.105 7010 -> 202.29.239.165 2845 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:29.854521 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:43:30.575267 0.000000 udp 10.0.2.105 7010 -> 188.217.191.29 1120 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:38.136301 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:43.414178 0.000000 udp 10.0.2.105 7010 -> 203.202.249.140 9130 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:48.992035 0.449259 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:43:49.441294 0.000000 icmp 184.71.110.26 0x0303 -> 10.0.2.105 0x0a1a URP 192 1 159 flow=Background 1970/01/06 18:43:53.848813 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:43:56.552798 0.000000 udp 10.0.2.105 7010 -> 67.143.241.87 1046 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:02.902080 0.000000 udp 10.0.2.105 7010 -> 203.198.37.50 1784 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:10.913881 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:17.893891 0.443289 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:18.337180 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 215 flow=Background 1970/01/06 18:44:22.850200 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:44:24.743163 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:32.034003 0.000000 udp 10.0.2.105 7010 -> 125.114.81.245 9103 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:37.131249 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:40.969169 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 18:44:42.699288 0.000000 udp 10.0.2.105 7010 -> 118.142.97.182 1880 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:47.355764 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:44:47.976778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:44:50.650283 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:44:55.977807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:44:56.559014 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 6439 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:02.046771 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:09.067269 0.000000 udp 10.0.2.105 7010 -> 72.54.121.49 5345 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:11.981503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:45:13.873787 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:45:17.669472 0.000000 udp 10.0.2.105 7010 -> 80.101.112.254 3017 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:23.868150 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:31.078971 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 7946 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:38.169115 0.000000 udp 10.0.2.105 7010 -> 95.240.61.243 7735 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:42.875575 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:45:44.036974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:45:45.829711 0.000000 udp 10.0.2.105 7010 -> 24.89.190.202 1888 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:45:52.008764 0.000000 udp 10.0.2.105 7010 -> 199.7.193.43 6502 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:00.951879 0.453939 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:46:01.450607 0.000000 udp 10.0.2.105 7010 -> 79.23.6.77 5808 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:07.110712 0.710098 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:07.820810 0.000000 icmp 58.185.236.154 0x0303 -> 10.0.2.105 0x5913 URP 192 1 190 flow=Background 1970/01/06 18:46:11.897080 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:46:12.978991 0.000000 udp 10.0.2.105 7010 -> 87.29.87.164 7975 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:21.571490 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:29.733048 0.000000 udp 10.0.2.105 7010 -> 101.109.252.42 7077 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:35.270858 0.000000 udp 10.0.2.105 7010 -> 99.38.60.198 1095 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:39.897687 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:46:42.972343 0.000000 udp 10.0.2.105 7010 -> 124.155.251.151 1645 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:48.579898 0.000000 udp 10.0.2.105 7010 -> 184.18.154.8 7684 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:54.228292 0.000000 udp 10.0.2.105 7010 -> 113.162.195.75 5475 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:46:59.746065 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:04.392819 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:47:06.695965 0.000000 udp 10.0.2.105 7010 -> 41.206.58.154 4628 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:13.485963 0.000000 udp 10.0.2.105 7010 -> 89.144.172.148 3130 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:20.596576 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:28.317000 0.000000 udp 10.0.2.105 7010 -> 203.198.126.93 2214 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:32.893805 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:47:33.704761 0.000000 udp 10.0.2.105 7010 -> 88.168.142.196 4747 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:41.095500 0.000000 udp 10.0.2.105 7010 -> 110.143.47.201 6816 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:49.988282 0.000000 udp 10.0.2.105 7010 -> 75.74.238.49 1813 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:56.507647 3.295741 udp 10.0.2.105 7010 -> 77.102.117.190 1024 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:47:59.803388 0.000000 icmp 77.102.117.190 0x0103 -> 10.0.2.105 0x4d66 URH 192 1 203 flow=Background 1970/01/06 18:48:01.394982 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:48:03.968706 0.000000 udp 10.0.2.105 7010 -> 99.22.48.32 4580 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:09.376395 0.000000 udp 10.0.2.105 7010 -> 216.137.215.7 2207 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:16.366201 0.000000 udp 10.0.2.105 7010 -> 219.64.95.182 9726 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:22.675241 0.000000 udp 10.0.2.105 7010 -> 81.134.85.253 8111 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:27.391680 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:48:30.156109 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:35.183694 0.000000 udp 10.0.2.105 7010 -> 120.150.220.200 3901 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:44.116070 0.000000 udp 10.0.2.105 7010 -> 71.43.140.106 9480 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:49.844746 0.000000 udp 10.0.2.105 7010 -> 37.32.244.84 3604 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:48:54.391019 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:48:58.166459 0.000000 udp 10.0.2.105 7010 -> 151.96.3.246 2225 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:06.538717 0.000000 udp 10.0.2.105 7010 -> 77.31.68.106 5218 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:12.627245 0.000000 udp 10.0.2.105 7010 -> 24.211.218.253 7370 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:21.609937 0.397506 udp 10.0.2.105 7010 -> 208.180.102.202 7982 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:22.007443 0.000000 icmp 208.180.102.202 0x0303 -> 10.0.2.105 0x2e1f URP 192 1 201 flow=Background 1970/01/06 18:49:26.397067 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:49:30.423128 0.000000 udp 10.0.2.105 7010 -> 86.98.80.71 7084 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:37.372981 0.000000 udp 10.0.2.105 7010 -> 61.22.18.155 5629 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:45.955029 0.000000 udp 10.0.2.105 7010 -> 90.214.152.83 2547 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:49:50.891944 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:49:53.365711 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:01.217597 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:07.676546 0.000000 udp 10.0.2.105 7010 -> 139.228.33.73 7259 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:14.636575 0.000000 udp 10.0.2.105 7010 -> 167.184.128.4 9845 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:19.392747 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:50:20.084155 0.000000 udp 10.0.2.105 7010 -> 118.174.7.185 4933 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:27.014243 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:32.021289 0.000000 udp 10.0.2.105 7010 -> 96.22.25.166 7098 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:39.512206 0.319598 udp 10.0.2.105 7010 -> 151.29.234.65 1023 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:39.831804 0.000000 icmp 151.29.234.65 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 265 flow=Background 1970/01/06 18:50:44.389236 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:50:48.204671 0.000000 udp 10.0.2.105 7010 -> 98.116.9.157 1391 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:50:55.244527 0.000000 udp 10.0.2.105 7010 -> 50.156.0.189 3862 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:01.463487 0.000000 udp 10.0.2.105 7010 -> 50.50.222.57 1567 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:09.846114 0.000000 udp 10.0.2.105 7010 -> 88.224.252.207 6516 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:14.392145 0.000263 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:51:16.805607 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:22.163728 0.295947 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:51:22.502393 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:29.604119 0.000000 udp 10.0.2.105 7010 -> 95.38.156.96 2688 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:36.984669 0.298761 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:37.283430 0.000000 icmp 81.139.130.162 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 199 flow=Background 1970/01/06 18:51:41.891919 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:51:43.533987 0.000000 udp 10.0.2.105 7010 -> 123.65.217.111 1188 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:48.065353 2.999709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 18:51:51.585770 0.000000 udp 10.0.2.105 7010 -> 58.246.210.138 2263 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:51:55.070332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:51:56.702956 0.000000 udp 10.0.2.105 7010 -> 95.6.87.219 2670 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:03.072295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:52:03.182345 0.538624 udp 10.0.2.105 7010 -> 125.77.203.10 3820 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:03.720969 0.000000 icmp 125.77.203.10 0x0303 -> 10.0.2.105 0xec0e URP 192 1 170 flow=Background 1970/01/06 18:52:07.888844 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:52:09.931988 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:16.632325 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:19.074957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:52:23.421455 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:30.661877 0.000000 udp 10.0.2.105 7010 -> 61.93.167.33 4249 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:35.388412 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:52:37.301897 0.000000 udp 10.0.2.105 7010 -> 142.59.253.98 3441 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:43.620737 0.290816 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:52:43.920598 0.000000 udp 10.0.2.105 7010 -> 220.136.107.180 2919 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:51.081491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:52:52.143271 0.393892 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:52:52.547427 0.278984 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:52:52.841034 0.000000 udp 10.0.2.105 7010 -> 122.166.4.10 4875 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:52:57.961575 0.000000 udp 10.0.2.105 7010 -> 125.166.94.223 6594 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:02.888173 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:53:03.700098 0.000000 udp 10.0.2.105 7010 -> 62.121.23.63 3041 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:11.761197 0.000000 udp 10.0.2.105 7010 -> 98.19.116.115 7262 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:20.022814 0.000000 udp 10.0.2.105 7010 -> 204.8.9.94 9360 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:28.705448 0.000000 udp 10.0.2.105 7010 -> 219.105.201.19 6324 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:33.391751 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:53:34.924071 0.000000 udp 10.0.2.105 7010 -> 202.94.229.20 5671 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:42.345172 0.000000 udp 10.0.2.105 7010 -> 203.122.210.8 6649 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:49.235033 0.402543 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:53:49.647966 0.000000 udp 10.0.2.105 7010 -> 99.255.163.88 8863 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:53:55.864589 0.000000 udp 10.0.2.105 7010 -> 195.174.239.184 4175 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:00.390811 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:54:02.984581 0.000000 udp 10.0.2.105 7010 -> 203.219.115.2 8502 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:09.954939 0.000000 udp 10.0.2.105 7010 -> 223.197.225.253 9552 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:17.965995 0.000000 udp 10.0.2.105 7010 -> 87.25.87.150 1738 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:24.395338 0.000000 udp 10.0.2.105 7010 -> 95.242.186.57 4459 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:29.392486 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:54:32.357409 0.000000 udp 10.0.2.105 7010 -> 118.200.3.99 7185 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:37.634722 0.000000 udp 10.0.2.105 7010 -> 86.11.246.62 7460 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:43.533401 0.000000 udp 10.0.2.105 7010 -> 116.228.230.26 9424 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:52.135108 0.359227 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/06 18:54:52.510985 0.000000 udp 10.0.2.105 7010 -> 82.7.211.215 4706 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:54:56.952376 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:54:59.586324 0.000000 udp 10.0.2.105 7010 -> 220.255.200.234 3574 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:55:07.698019 0.000000 udp 10.0.2.105 7010 -> 50.126.24.33 3596 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:55:14.848013 0.000000 udp 10.0.2.105 7010 -> 174.76.94.20 1668 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:55:20.906850 0.000000 udp 10.0.2.105 7010 -> 77.98.54.70 4066 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:55:25.452812 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 18:55:28.988220 0.000000 udp 10.0.2.105 7010 -> 173.58.147.108 8784 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:55:35.898273 0.000000 udp 10.0.2.105 7010 -> 82.37.177.166 4757 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 18:58:55.147293 3.001857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 18:59:02.155062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:59:10.156500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:59:26.158964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 18:59:58.165049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:04:17.658966 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:04:17.659150 1.732559 tcp 10.0.2.105 50949 -> 128.255.183.224 9027 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:06:02.171448 3.001228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:06:09.178943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:06:17.180214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:06:33.183128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:07:05.189626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:13:09.195971 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:13:16.202727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:13:24.204160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:13:40.207197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:14:12.213377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:20:16.219991 3.000982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:20:23.226854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:20:31.228624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:20:47.230798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:21:19.236850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:26:12.669272 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:26:12.669420 0.317804 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:12.987642 0.416631 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:13.404687 0.309771 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:13.714948 0.472528 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:14.187881 0.410563 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:14.598844 0.395755 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:14.994973 0.295951 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:15.291322 0.398686 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:15.690433 0.404373 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:16.095248 0.413644 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:16.509309 0.423547 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:16.933266 0.382108 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:17.315757 0.303767 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:17.619946 0.610068 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:18.230444 0.310696 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:18.541568 0.415458 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:18.957431 0.478199 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:19.436032 0.382369 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:19.818828 0.279460 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:20.098664 0.356122 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:20.455165 0.485834 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:20.941385 0.436958 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:21.378692 0.475493 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:21.854608 0.404121 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:22.259134 0.323053 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:22.582840 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 19:26:39.991007 0.553107 tcp 10.0.2.105 50950 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:26:40.544391 0.583229 tcp 10.0.2.105 50951 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:26:41.127949 1.127787 tcp 10.0.2.105 50952 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:26:42.256473 0.473286 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:42.730120 0.306502 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:43.037021 0.286649 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:43.324087 0.386374 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:43.710874 0.286308 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:43.997528 0.449544 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:26:44.447476 0.299658 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:27:23.243508 3.001514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 19:27:30.250805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:27:38.252334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:27:54.255214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:28:26.260968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:34:19.400011 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:34:19.400245 1.722029 tcp 10.0.2.105 50953 -> 128.255.183.224 9027 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/01/06 19:34:30.267519 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:34:37.274741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:34:45.275716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:35:01.279024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:35:33.285184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:41:37.291576 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:41:44.298436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:41:52.300050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:42:08.302863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:42:40.309303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:48:44.314757 3.002100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:48:51.323024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:48:59.324302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:49:15.326925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:49:47.332802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:55:51.339145 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 19:55:58.346612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:56:06.347966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:56:22.351103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:56:54.356958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 19:56:58.242714 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 19:56:58.242905 0.286335 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:56:58.529634 0.329328 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:56:58.859307 0.422362 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:56:59.282079 0.413307 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:56:59.695787 0.310913 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:00.007060 0.315840 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:00.323603 0.389905 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:00.324141 2.996038 tcp 10.0.2.105 50954 -> 31.197.209.67 4165 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 19:57:00.713940 0.401998 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:01.116384 0.392007 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:01.508844 0.393309 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:01.902560 0.416143 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:02.319043 0.407178 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:02.726549 0.419656 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:03.146574 0.304641 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:03.451546 0.583067 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:04.035006 0.397753 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:04.433118 0.326174 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:04.759631 0.390202 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:05.150236 0.459031 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:05.609649 0.273872 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:05.883872 0.368681 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:06.252947 0.496635 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:06.749988 0.437236 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:07.187613 0.453153 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:07.641196 0.394197 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:08.035794 0.322763 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:08.358982 0.301742 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:08.661120 0.284090 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:08.945613 0.493366 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:09.318243 0.000000 tcp 10.0.2.105 50954 -> 31.197.209.67 4165 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 19:57:09.439346 0.394094 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:09.833827 0.274115 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:10.108499 0.405437 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 19:57:10.514337 0.307188 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:02:58.363186 3.001153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:03:05.370413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:03:13.372046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:03:29.375199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:04:01.380739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:04:21.129652 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:04:21.129735 1.709402 tcp 10.0.2.105 50955 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:10:05.387164 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:10:12.394057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:10:20.395654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:10:36.399186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:11:08.405247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:17:12.411220 3.001614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:17:19.418127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:17:27.420200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:17:43.422728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:18:15.429153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:24:19.435174 3.001147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:24:26.442125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:24:34.443928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:24:50.446720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:25:22.452517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:27:23.487638 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:27:23.487859 0.417468 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:23.905680 0.295388 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:24.201564 0.304733 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:24.202042 3.000028 tcp 10.0.2.105 50956 -> 79.253.224.170 3288 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 20:27:24.506708 0.309192 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:24.816276 0.519136 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:25.335756 0.303441 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:25.639603 0.392007 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:26.032036 0.425639 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:26.458084 0.387205 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:26.845714 0.391955 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:27.238051 0.393876 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:27.632355 0.395640 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:28.028348 0.427426 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:28.456114 0.302560 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:28.759063 0.592033 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:29.351458 0.403532 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:29.755363 0.320063 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:30.075880 0.387894 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:30.464173 0.403850 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:30.868572 0.454752 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:31.323662 0.271503 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:31.595576 0.495626 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:32.091592 0.928966 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:33.021205 0.472807 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:33.200957 0.000000 tcp 10.0.2.105 50956 -> 79.253.224.170 3288 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 20:27:33.494352 0.406660 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:33.901418 0.313714 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:34.215515 0.312832 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:34.528709 0.290526 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:34.819678 0.382114 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:35.202156 0.481847 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:35.684439 0.396514 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:36.081366 0.417460 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:36.499243 0.329462 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:27:45.451745 0.254417 udp 10.0.2.105 64832 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/06 20:27:45.706697 0.257332 udp 10.0.2.105 49767 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/06 20:27:50.455568 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:31:26.458532 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:31:33.466173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:31:41.467994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:31:57.470750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:32:29.476748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:34:22.840893 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:34:22.840999 1.765346 tcp 10.0.2.105 50957 -> 128.255.183.224 9027 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/06 20:38:33.483098 3.001335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:38:40.490297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:38:48.492010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:39:04.494773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:39:36.501003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:45:40.506640 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:45:47.514063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:45:55.515889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:46:11.518639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:46:43.524673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:52:47.530257 3.001844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 20:52:54.537827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:53:02.539448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:53:18.542910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:53:50.548618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 20:58:04.754362 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 20:58:04.754600 0.403552 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:05.158546 0.294573 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:05.453577 0.426384 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:05.454020 2.995429 tcp 10.0.2.105 50958 -> 79.253.224.170 3288 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 20:58:05.880377 0.304947 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:06.185691 0.403907 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:06.589976 0.329452 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:06.919891 0.375042 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:07.295351 0.390315 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:07.686066 0.399163 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:08.085578 0.379331 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:08.465303 0.398330 udp 10.0.2.105 7010 <-> 76.68.90.33 3572 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:08.864049 0.407418 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:09.271887 0.588993 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:09.861294 0.413298 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:10.274962 0.311984 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:10.587326 0.400264 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:10.987984 0.314169 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:11.302531 0.464987 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:11.767986 0.385275 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:12.153657 0.378000 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:12.532060 0.293763 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:12.826214 0.538788 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:13.365367 0.436572 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:13.802340 0.472400 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:14.275174 0.377393 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:14.447984 0.000000 tcp 10.0.2.105 50958 -> 79.253.224.170 3288 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 20:58:14.653004 0.405314 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:15.058716 0.637225 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:15.696371 0.300987 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:15.997696 0.316428 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:16.314525 0.482030 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:16.796947 0.369133 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:17.166487 0.402198 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:58:17.569071 0.318502 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 20:59:54.554807 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:00:01.561841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:00:09.563483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:00:25.566537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:00:57.572710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:04:24.611022 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:04:24.611257 1.717154 tcp 10.0.2.105 50959 -> 128.255.183.224 9027 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:07:01.578405 3.001754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:07:08.586256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:07:16.587831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:07:32.590829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:08:04.596536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:14:08.602979 3.001249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:14:15.609934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:14:23.611325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:14:39.614757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:15:11.620532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:21:15.927359 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:21:22.934559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:21:30.936252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:21:46.939156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:22:18.944888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:28:21.676965 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:28:21.677163 0.417462 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:22.095025 0.306989 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:22.402407 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 21:28:22.951201 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:28:29.958238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:28:37.960138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:28:41.287155 0.576530 tcp 10.0.2.105 50960 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:28:41.863957 0.588831 tcp 10.0.2.105 50961 -> 195.113.214.226 80 SRPA* 0 0 18 13346 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:28:42.453404 0.476126 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:42.929926 0.393142 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:43.323514 0.314845 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:43.638863 0.309860 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:43.639252 3.002850 tcp 10.0.2.105 50962 -> 31.197.209.67 4165 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 21:28:43.949148 0.409372 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:44.358927 0.392087 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:44.751417 0.408657 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:45.160610 0.391112 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:28:45.552141 0.000000 udp 10.0.2.105 7010 -> 76.68.90.33 3572 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 21:28:52.640830 0.000000 tcp 10.0.2.105 50962 -> 31.197.209.67 4165 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 21:28:53.962652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:29:00.903965 0.573471 tcp 10.0.2.105 50963 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:01.477738 0.568061 tcp 10.0.2.105 50964 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:02.046160 1.365581 tcp 10.0.2.105 50965 -> 195.113.214.226 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:03.412491 0.605258 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:04.018098 0.423870 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:04.442307 0.317484 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:04.760199 0.399689 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:05.160291 0.319605 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:05.480397 0.472506 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:05.480793 3.003131 tcp 10.0.2.105 50966 -> 217.39.56.28 1529 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 21:29:05.953254 0.387605 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:06.341299 0.507492 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:06.849146 0.366934 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:07.216634 0.257761 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:07.474775 0.449923 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:07.925058 0.469681 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:08.395132 0.406112 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:08.801645 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 21:29:14.482309 0.000000 tcp 10.0.2.105 50966 -> 217.39.56.28 1529 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/06 21:29:25.539568 0.582671 tcp 10.0.2.105 50967 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:25.969154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:29:26.122506 0.544311 tcp 10.0.2.105 50968 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:26.667181 1.376888 tcp 10.0.2.105 50969 -> 195.113.214.226 443 SRPA* 0 0 34 24795 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:28.044825 0.308369 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:28.353667 0.544190 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:28.354032 4.884628 tcp 10.0.2.105 50970 -> 91.207.7.129 3494 SPA_* 0 0 157 119215 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:28.898217 0.298859 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:29.197483 0.483172 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:29.681014 0.381302 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:30.062716 0.401301 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:30.464440 0.322748 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:29:33.539876 4.876474 tcp 10.0.2.105 50970 -> 91.207.7.129 3494 A_PA 0 0 182 147044 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:38.732778 4.816647 tcp 10.0.2.105 50970 -> 91.207.7.129 3494 A_PA 0 0 183 143002 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:29:43.853699 2.425016 tcp 10.0.2.105 50970 -> 91.207.7.129 3494 FPA_* 0 0 79 55920 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:34:26.471551 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:34:26.471751 1.804636 tcp 10.0.2.105 50971 -> 128.255.183.224 9027 FSPA* 0 0 12 1639 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:35:29.975084 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 21:35:36.982229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:35:44.984032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:36:00.987019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:36:32.993116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:42:36.998734 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:42:44.006064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:42:52.007519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:43:08.011301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:43:40.016955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:49:44.023438 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:49:51.030161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:49:59.031819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:50:15.034563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:50:47.041186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:56:51.047282 3.000908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 21:56:58.054521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:57:06.055671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:57:22.058949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:57:54.064657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 21:59:33.788345 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 21:59:33.788547 0.295160 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:34.084113 0.000000 udp 10.0.2.105 7010 -> 76.68.90.33 3572 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 21:59:50.805919 0.544800 tcp 10.0.2.105 50972 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:59:51.350996 0.611300 tcp 10.0.2.105 50973 -> 195.113.214.226 80 SRPA* 0 0 22 16014 flow=From-Botnet-V2-TCP-Established 1970/01/06 21:59:51.962950 0.793948 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:52.757318 0.426517 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:53.184237 0.317713 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:53.502360 0.479396 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:53.985914 0.387542 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:54.373854 0.314995 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:54.689266 0.318181 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:55.007843 0.407982 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:55.416303 0.422497 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:55.839185 0.411230 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:56.250857 0.362022 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:56.613241 0.584973 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:57.198552 0.424801 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:57.623712 0.304801 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:57.928927 0.474961 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:58.404242 0.301456 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:58.706030 0.413144 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:59.119517 0.508740 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/06 21:59:59.628594 0.399387 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:00.028537 0.296654 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:00.325549 0.368821 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:00.694805 0.436635 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:01.131843 0.472646 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:01.604838 0.394683 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:01.999946 0.318523 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:02.318865 0.547204 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:02.866459 0.403282 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:03.270134 0.281036 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:03.551562 0.557233 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:04.109158 0.404856 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:00:04.514410 0.295526 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:03:58.070476 3.002056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 22:04:05.077905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:04:13.080139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:04:28.282329 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:04:28.282512 1.754564 tcp 10.0.2.105 50974 -> 128.255.183.224 9027 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:04:29.082745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:05:01.088474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:11:05.095336 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:11:12.102072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:11:20.103806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:11:36.106970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:12:08.112814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:18:12.118150 3.002568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:18:19.126436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:18:27.127649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:18:43.130800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:19:15.136521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:25:19.142930 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:25:26.149904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:25:34.151667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:25:50.155071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:26:22.160411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:30:12.001784 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:30:12.001895 0.285751 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:12.288060 0.838087 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:13.126566 0.506843 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:13.634068 0.429878 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:14.064364 0.310240 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:14.375019 0.385116 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:14.760564 0.318516 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:15.079466 0.339032 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:15.418917 0.395823 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:15.815138 0.414669 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:16.230201 0.408729 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:16.639271 0.394271 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:17.033952 0.305840 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:17.340226 0.613418 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:17.954073 0.397934 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:18.352582 0.470508 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:18.823462 0.325940 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:19.149801 0.400974 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:19.551124 0.639479 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:20.191009 0.378031 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:20.569413 0.434605 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:21.004573 0.282184 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:21.287158 0.385173 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:21.672758 0.463406 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:22.136571 4.017937 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:26.154854 0.308581 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:26.463826 0.644065 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:27.108299 0.483277 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:27.591907 0.387460 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:27.979766 0.300185 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:28.280376 0.408775 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:30:28.689495 0.324825 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/06 22:32:26.166910 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:32:33.174107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:32:41.175948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:32:57.178971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:33:29.184572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:34:30.042781 0.000190 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 22:34:30.043068 1.674111 tcp 10.0.2.105 50975 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/06 22:39:33.190579 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:39:40.197754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:39:48.199508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:40:04.202933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:40:36.209075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:46:40.214914 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:46:47.221708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:46:55.223680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:47:11.226726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:47:43.232687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:53:47.239384 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 22:53:54.245695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:54:02.247170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:54:18.250230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 22:54:50.256379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:00:36.284309 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:00:36.284508 0.299651 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:36.584605 0.316213 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:36.901203 0.419641 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:37.321255 0.414094 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:37.735780 0.306926 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:38.043109 0.318724 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:38.362188 0.389818 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:38.752575 0.335925 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:39.088915 0.393895 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:39.483225 0.372647 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:39.856470 0.403181 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:40.260633 0.408500 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:40.669538 0.312146 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:40.982045 0.672833 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:41.655224 0.432129 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:42.087777 0.485137 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:42.573331 0.311137 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:42.884872 0.407013 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:43.292325 0.430883 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:43.723620 0.952183 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:44.676171 0.380957 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:45.057528 0.469154 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:45.527090 0.285719 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:45.813233 0.374518 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:46.188119 3.869681 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:50.058215 0.299863 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:50.358487 0.769025 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:51.127845 0.477880 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:51.606099 0.394473 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:52.000993 0.303392 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:52.304788 0.297632 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:52.602815 0.396903 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:00:54.262535 3.002137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:01:01.270260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:01:09.271457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:01:25.274431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:01:57.280491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:04:31.723291 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:04:31.723465 1.763553 tcp 10.0.2.105 50976 -> 128.255.183.224 9027 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:08:01.286691 3.001194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:08:08.294090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:08:16.295517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:08:32.298355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:09:04.304189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:15:08.311083 3.000836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:15:15.317709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:15:23.319768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:15:39.322225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:16:11.328110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:22:15.335037 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:22:22.341870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:22:30.343192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:22:46.346482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:23:18.352431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:29:22.358723 3.001126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:29:29.365964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:29:37.367008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:29:53.370654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:30:25.376119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:31:10.571799 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:31:10.571909 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 23:31:29.261476 0.585375 tcp 10.0.2.105 50977 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:29.847144 0.540408 tcp 10.0.2.105 50978 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:30.387803 1.419567 tcp 10.0.2.105 50979 -> 195.113.214.226 443 SRPA* 0 0 45 28309 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:31.807303 0.319792 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:32.127556 0.329876 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:32.457830 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/06 23:31:48.217051 0.568952 tcp 10.0.2.105 50980 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:48.785881 0.571640 tcp 10.0.2.105 50981 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:49.357332 1.190665 tcp 10.0.2.105 50982 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:31:50.548825 0.420988 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:50.970229 0.323495 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:51.294178 0.394217 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:51.688811 0.318236 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:52.007432 0.380962 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:52.388777 0.385036 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:52.774219 0.292634 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:53.067259 0.413786 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:53.481465 0.419907 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:53.901785 0.574862 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:54.477037 0.412804 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:54.890279 0.476041 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:55.366668 0.320258 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:55.687356 0.402747 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:56.090432 0.687447 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:56.778281 0.547202 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:57.325912 0.389660 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:57.715955 0.462981 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:58.179310 0.319547 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:58.499273 0.422598 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:31:58.922271 3.716434 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:02.639033 0.287080 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:02.926574 0.796993 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:03.723959 0.474607 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:04.198995 0.403150 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:04.602500 0.406139 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:05.009074 0.296028 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:32:05.305530 0.312273 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/06 23:34:33.493727 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/06 23:34:33.493913 1.829006 tcp 10.0.2.105 50983 -> 128.255.183.224 9027 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/06 23:36:29.382528 3.001275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/06 23:36:36.389876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:36:44.391400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:37:00.394237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:37:32.400605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:43:36.406192 3.001946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:43:43.413489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:43:51.415561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:44:07.417940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:44:39.424872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:50:43.430651 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:50:50.437710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:50:58.439356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:51:14.442396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:51:46.448595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:57:50.454135 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/06 23:57:57.461915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:58:05.463510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:58:21.466004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/06 23:58:53.472361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:02:10.566168 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:02:10.566344 0.298381 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:10.865142 0.492036 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:11.357564 0.329476 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:11.687464 0.310148 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:11.998026 0.420947 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:12.419401 0.313628 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:12.733394 0.384624 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:13.118364 0.393549 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:13.512280 0.308916 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:13.821623 0.390938 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:14.213048 0.391210 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:14.604689 0.415731 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:15.020807 0.406493 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:15.427728 0.603664 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:16.031845 0.403437 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:16.435713 0.463166 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:16.899285 0.309020 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:17.208737 0.399747 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:17.608893 0.674920 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:18.284217 0.502304 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:18.786925 0.385010 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:19.172275 0.356534 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:19.529215 0.473406 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:20.003092 0.285471 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:20.288895 0.400830 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:20.690118 0.269575 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:20.960056 0.675905 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:21.636372 0.401060 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:22.037827 0.000000 udp 10.0.2.105 7010 -> 161.200.34.40 5040 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 00:02:40.792008 0.549379 tcp 10.0.2.105 50984 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:02:41.341674 0.578071 tcp 10.0.2.105 50985 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:02:41.919682 1.138222 tcp 10.0.2.105 50986 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:02:43.058516 0.382872 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:43.441822 0.299402 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:02:43.741634 0.307907 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:04:35.324626 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:04:35.324743 1.718991 tcp 10.0.2.105 50987 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:04:57.478980 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 00:05:04.485559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:05:12.487110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:05:28.490031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:06:00.496058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:12:04.502652 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:12:11.509901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:12:19.511107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:12:35.514035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:13:07.520254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:19:11.526687 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:19:18.533483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:19:26.534927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:19:42.538360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:20:14.544202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:26:18.549994 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:26:25.557221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:26:33.558721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:26:49.562126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:27:22.319208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:33:09.228826 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:33:09.229079 0.476266 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:09.705724 0.283733 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:09.989848 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 00:33:26.325775 3.001182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:33:28.398462 0.569063 tcp 10.0.2.105 50988 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:33:28.967877 0.556823 tcp 10.0.2.105 50989 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:33:29.524986 1.179491 tcp 10.0.2.105 50990 -> 195.113.214.226 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:33:30.704016 0.324081 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:31.028561 0.312009 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:31.340943 0.398925 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:31.740324 0.316591 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:32.057293 0.422228 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:32.479898 0.363109 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:32.843436 0.304130 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:33.147969 0.420711 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:33.332712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:33:33.569074 0.397111 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:33.966611 0.355042 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:34.322100 0.417597 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:34.740057 0.577363 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:35.317770 0.462271 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:35.780482 0.418934 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:36.199840 0.326622 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:36.526845 0.397986 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:36.925272 0.504732 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:37.430365 0.439657 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:37.870448 0.351106 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:38.221965 0.376754 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:38.599140 0.471841 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:39.071344 0.289023 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:39.360739 0.396877 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:39.757983 0.260737 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:41.040937 0.401565 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:41.333773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:33:41.442927 0.659322 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:42.102683 0.303821 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:42.406849 0.388592 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:42.795863 0.311895 udp 10.0.2.105 7010 <-> 151.76.10.255 2546 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/07 00:33:57.337408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:34:29.343213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:34:37.405158 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 00:34:37.405355 1.670331 tcp 10.0.2.105 50991 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/07 00:40:33.349546 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:40:40.356481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:40:48.357897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:41:04.361171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:41:36.367347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:47:40.373635 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:47:47.380956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:47:55.381915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:48:11.384833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:48:43.390752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:54:47.397511 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 00:54:54.404185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:55:02.406325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:55:18.409105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 00:55:50.414877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:01:54.420840 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:02:01.428764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:02:09.430136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:02:25.433084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:02:57.439229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:03:43.726011 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:03:43.726216 0.481518 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:44.208166 0.481543 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:44.690136 0.293475 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:44.984027 0.319388 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:45.303920 0.309866 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:45.614233 0.330611 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:45.945235 0.393409 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:46.339126 0.432974 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:46.772518 0.311759 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:47.084697 0.383997 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:47.469106 0.300174 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:47.769652 0.409580 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:48.179615 0.356413 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:48.536414 0.413196 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:48.949958 0.576258 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:49.526753 0.453603 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:49.980811 0.416959 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:50.398166 0.324250 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:50.722769 0.394058 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:51.117245 0.694681 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:51.812293 0.455948 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:52.268612 0.463167 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:52.732138 0.370223 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:53.102756 0.401072 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:53.504223 0.290952 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:53.795565 0.396581 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:54.192552 0.279792 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:54.472772 0.413639 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:54.886988 0.316545 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:03:55.203909 0.000000 udp 10.0.2.105 7010 -> 151.76.10.255 2546 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 01:04:13.000529 0.585582 tcp 10.0.2.105 50992 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:04:13.586380 0.570810 tcp 10.0.2.105 50993 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:04:14.157510 1.180690 tcp 10.0.2.105 50994 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:04:15.338910 0.307577 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:04:15.646893 0.387945 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:04:39.076040 1.687608 tcp 10.0.2.105 50995 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:09:01.444804 3.001800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 01:09:08.452447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:09:16.453966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:09:32.457069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:10:04.462742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:16:08.469417 3.001076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:16:15.476446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:16:23.478038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:16:39.481252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:17:11.486756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:23:15.493392 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:23:22.500140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:23:30.502177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:23:46.505316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:24:18.510689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:30:22.517505 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:30:29.523987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:30:37.526105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:30:53.528931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:31:25.534535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:34:36.719874 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 01:34:36.720155 0.000000 udp 10.0.2.105 7010 -> 151.76.10.255 2546 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 01:34:40.766083 1.756800 tcp 10.0.2.105 50996 -> 128.255.183.224 9027 FSPA* 0 0 12 1633 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:34:53.275778 0.000000 tcp 10.0.2.105 50997 -> 195.113.214.251 80 S_ 0 1 66 flow=From-Botnet-V2-TCP-Attempt 1970/01/07 01:35:02.451655 0.315872 tcp 10.0.2.105 50997 -> 195.113.214.251 80 FPA_* 0 0 9 1828 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:35:02.767780 0.558463 tcp 10.0.2.105 50998 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:35:03.326606 1.134503 tcp 10.0.2.105 50999 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/07 01:35:04.461926 0.284181 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:04.746519 0.447508 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:05.194456 0.484359 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:05.679268 0.355980 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:06.035680 0.317970 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:06.354022 0.329061 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:06.683505 0.325241 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:07.009226 0.428925 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:07.438642 0.388343 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:07.998327 0.302494 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:08.301206 0.395215 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:08.696827 0.352110 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:09.049311 0.409298 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:09.459043 0.417852 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:09.877368 0.499003 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:10.376785 0.604850 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:10.982001 0.333402 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:11.315817 0.415893 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:11.732139 0.393450 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:12.126054 0.504222 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:12.630721 0.389511 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:13.020769 0.446558 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:13.467740 0.472320 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:13.940496 0.282327 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:14.223274 0.381097 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:14.604746 0.266826 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:14.872054 0.397305 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:15.269803 0.392230 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:15.662426 0.340288 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:16.003169 0.294912 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:35:16.298488 0.372849 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/07 01:37:36.322860 2.961024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 01:37:43.232798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:37:51.119681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:38:06.904496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:38:38.469703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:44:38.648691 3.000958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:44:45.655122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:44:53.656731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:45:09.660046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:45:41.665541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:51:45.671990 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:51:52.678889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:52:00.680985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:52:16.683412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:52:48.689769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:58:52.696189 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 01:58:59.704515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:59:07.705213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:59:23.708681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 01:59:55.713684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:04:44.609623 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:04:44.609783 1.685352 tcp 10.0.2.105 51000 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:05:38.567057 0.284269 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:38.851712 0.430398 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:39.282527 0.477535 udp 10.0.2.105 7010 <-> 161.200.34.40 5040 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:39.760622 0.311790 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:40.072799 0.329972 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:40.403147 0.299752 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:40.703270 0.321491 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:41.025102 0.408633 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:41.434175 0.405392 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:41.839930 0.440692 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:42.281065 0.313476 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:42.594937 0.418129 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:43.013451 0.374080 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:43.387982 0.403194 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:43.533579 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:05:43.791573 0.464368 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:44.256346 0.593839 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:44.850561 0.309988 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:05:45.160968 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 02:05:59.719318 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 02:06:02.383961 0.570227 tcp 10.0.2.105 51001 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:06:02.954482 0.575553 tcp 10.0.2.105 51002 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:06:03.529890 1.170604 tcp 10.0.2.105 51003 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:06:04.699471 0.409422 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:05.109299 0.506275 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:05.615992 0.361171 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:05.977575 0.443844 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:06.421829 0.456534 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:06.727364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:06:06.878768 0.283840 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:07.162967 0.402722 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:07.566116 0.274767 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:07.841310 0.402449 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:08.244178 0.402094 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:08.646651 0.387708 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:09.034795 0.359200 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:09.394419 0.294023 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:06:14.728927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:06:30.732003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:07:02.737778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:13:06.744272 3.001044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:13:13.750794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:13:21.752958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:13:37.755991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:14:09.761933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:20:13.768084 3.001220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:20:20.775425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:20:28.776780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:20:44.779583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:21:16.785855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:27:20.792331 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:27:27.798821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:27:35.800788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:27:51.803233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:28:23.809417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:34:27.816093 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:34:34.823020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:34:42.824180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:34:46.300377 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:34:46.300571 1.796539 tcp 10.0.2.105 51004 -> 128.255.183.224 9027 FSPA* 0 0 12 1538 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:34:58.827497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:35:30.834050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:36:15.738122 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 02:36:15.738279 0.438075 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:16.176746 0.286831 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:16.463975 0.440360 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:16.904697 0.000000 udp 10.0.2.105 7010 -> 161.200.34.40 5040 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 02:36:34.056920 0.584517 tcp 10.0.2.105 51005 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:36:34.641745 0.574627 tcp 10.0.2.105 51006 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:36:35.216667 1.162031 tcp 10.0.2.105 51007 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/07 02:36:36.379452 0.319358 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:36.699160 0.331987 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:37.031563 0.311011 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:37.342930 0.328514 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:37.671806 0.409024 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:38.081266 0.424978 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:38.506647 0.381617 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:38.888648 0.308753 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:39.197759 0.511610 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:39.709737 0.391681 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:40.101839 0.405082 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:40.507310 0.578129 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:41.085898 0.456853 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:41.543107 0.324616 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:41.868107 0.400905 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:42.269366 1.164305 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:43.434070 0.375482 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:43.809944 0.448986 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:44.259436 0.483817 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:44.743654 0.281637 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:45.025715 0.380332 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:45.406452 0.284370 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:45.691309 0.391793 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:46.083476 0.400585 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:46.484466 0.423757 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:46.908646 0.288273 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:36:47.197342 0.301385 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 02:41:34.839424 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 02:41:41.847220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:41:49.848141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:42:05.851444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:42:37.857346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:48:41.864049 3.000833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:48:48.870945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:48:56.872168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:49:12.875121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:49:44.881859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:55:48.887659 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 02:55:55.894695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:56:03.896413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:56:19.899542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 02:56:51.905701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:02:55.911492 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:03:02.918937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:03:10.920364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:03:26.923563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:03:58.929433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:04:48.100601 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:04:48.100715 1.778138 tcp 10.0.2.105 51008 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:07:07.010452 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:07:07.010736 0.000000 udp 10.0.2.105 7010 -> 161.200.34.40 5040 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 03:07:23.406228 0.557259 tcp 10.0.2.105 51009 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:07:23.963820 0.571327 tcp 10.0.2.105 51010 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:07:24.534899 1.169758 tcp 10.0.2.105 51011 -> 195.113.214.226 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:07:25.703434 0.341455 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:26.045233 0.430621 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:26.476431 0.423523 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:26.900415 0.305964 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:27.206806 0.337194 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:27.544599 0.314204 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:27.859226 0.357361 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:28.216944 0.381259 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:28.598617 0.412670 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:29.011709 0.375471 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:29.387596 0.389528 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:29.777488 0.289682 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:30.067583 0.413372 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:30.481328 0.406887 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:30.888598 0.588137 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:31.477182 0.465554 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:31.943107 0.315621 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:32.259152 0.405235 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:32.664803 0.488726 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:33.153944 0.365797 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:33.520113 0.437551 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:33.958080 0.469991 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:34.428513 0.286409 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:34.715262 0.382502 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:35.098139 0.397871 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:35.496383 0.276706 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:35.773479 0.393840 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:36.167736 0.414811 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:36.583015 0.280130 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:07:36.863601 0.301537 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:10:02.936144 3.000980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 03:10:09.942716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:10:17.944036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:10:33.947582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:11:05.953048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:17:09.959434 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:17:16.966708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:17:24.968588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:17:40.971525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:18:12.977061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:24:16.984134 3.001386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:24:23.990894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:24:31.992050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:24:47.995535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:25:20.001597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:31:24.007798 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:31:31.014846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:31:39.016389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:31:55.019346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:32:27.025347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:34:49.881611 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:34:49.881855 1.727024 tcp 10.0.2.105 51012 -> 128.255.183.224 9027 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:37:57.761278 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 03:37:57.761396 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 03:38:15.518440 0.548949 tcp 10.0.2.105 51013 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:16.067657 0.563855 tcp 10.0.2.105 51014 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:16.631386 1.139191 tcp 10.0.2.105 51015 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:17.771281 0.438332 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:18.210050 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 03:38:31.031540 3.001151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 03:38:36.787971 0.571474 tcp 10.0.2.105 51016 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:37.359281 0.572411 tcp 10.0.2.105 51017 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:37.932005 1.128147 tcp 10.0.2.105 51018 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:38:38.038820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:38:39.060985 0.332640 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:39.393996 0.313053 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:39.707458 0.320299 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:40.028182 0.876408 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:40.905002 0.401171 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:41.306550 0.419045 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:41.726008 0.291212 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:42.017647 0.391486 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:42.409497 0.390799 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:42.800701 0.426397 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:43.227544 0.408851 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:43.636818 0.579056 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:44.216284 0.449484 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:44.666117 0.357624 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:45.024135 0.403808 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:45.428369 0.430382 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:45.859097 0.488844 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:46.040120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:38:46.348506 0.423759 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:46.772663 0.473653 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:47.246705 0.276957 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:47.524013 0.389921 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:38:47.914294 0.000000 udp 10.0.2.105 7010 -> 67.87.105.252 9318 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 03:39:02.043596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:39:04.047069 0.564931 tcp 10.0.2.105 51019 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:39:04.612456 0.584253 tcp 10.0.2.105 51020 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:39:05.196539 1.193237 tcp 10.0.2.105 51021 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/07 03:39:06.390539 0.265850 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:39:06.656798 0.495643 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:39:07.152842 0.392376 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:39:07.545649 0.406967 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:39:07.953022 0.301347 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/07 03:39:34.049491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:45:38.055444 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:45:45.062451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:45:53.063973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:46:09.067245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:46:41.073504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:52:45.470220 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:52:52.477018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:53:00.478713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:53:16.481585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:53:48.488111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 03:59:52.493802 3.001564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 03:59:59.501353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:00:07.502962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:00:23.505616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:00:55.512039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:04:51.792387 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:04:51.792589 1.737010 tcp 10.0.2.105 51022 -> 128.255.183.224 9027 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:06:59.517778 3.001728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:07:06.525438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:07:14.526902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:07:30.529938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:08:02.535810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:09:28.790274 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:09:28.790451 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 04:09:47.519271 0.556680 tcp 10.0.2.105 51023 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:09:48.076403 0.555209 tcp 10.0.2.105 51024 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:09:48.631910 1.160902 tcp 10.0.2.105 51025 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:09:49.791986 0.527302 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:50.319730 0.412918 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:50.733014 0.418160 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:51.151510 0.319959 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:51.471869 0.314091 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:51.786425 0.316000 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:52.102874 0.331608 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:52.434877 0.378259 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:52.813560 0.299298 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:53.113215 0.435318 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:53.548989 0.383775 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:53.933177 0.396884 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:54.330424 0.407033 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:54.737868 0.402803 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:55.141075 0.314456 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:55.455918 0.459436 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:55.915755 0.577146 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:56.493317 0.411399 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:56.905067 0.954685 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:57.860165 0.376577 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:58.237182 0.504006 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:58.741596 0.396817 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:59.138795 0.291286 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:59.430496 0.476326 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:09:59.907223 0.280163 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:10:00.187765 0.389426 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:10:00.577623 0.611319 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:10:01.189346 0.384079 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:10:01.573861 0.292282 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:14:06.541737 3.001474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 04:14:13.548854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:14:21.550311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:14:37.553802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:15:09.559694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:21:13.566119 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:21:20.572741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:21:28.574307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:21:44.577504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:22:16.583327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:28:20.589614 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:28:27.597278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:28:35.598363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:28:51.601420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:29:23.607356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:34:53.532395 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:34:53.532573 1.672501 tcp 10.0.2.105 51026 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:35:27.613769 3.001462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:35:34.621076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:35:42.622415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:35:58.625859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:36:30.631419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:40:17.217638 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 04:40:17.217880 0.434079 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:17.652360 0.447559 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:18.100443 0.388928 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:18.489729 0.320230 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:18.810380 0.314121 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:19.124936 0.313689 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:19.438998 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 04:40:36.097302 0.572989 tcp 10.0.2.105 51027 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:40:36.670564 0.555953 tcp 10.0.2.105 51028 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:40:37.226536 1.183464 tcp 10.0.2.105 51029 -> 195.113.214.226 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/07 04:40:38.409760 0.389921 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:38.800048 0.307457 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:39.107907 0.437167 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:39.545425 0.378858 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:39.924720 0.413108 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:40.338229 0.396861 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:40.735498 0.396220 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:41.132553 0.333337 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:41.466321 0.499190 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:41.965939 0.577673 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:42.544036 0.397843 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:42.942338 1.098689 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:44.041385 0.371610 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:44.413398 0.850716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:45.264566 0.400553 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:45.665480 0.307367 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:45.973279 0.468659 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:46.442303 0.294808 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:46.737507 0.409364 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:47.147299 0.681668 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:47.829381 0.402384 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:40:48.232188 0.283349 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/07 04:42:34.638282 3.000877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 04:42:41.644880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:42:49.646258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:43:05.649672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:43:37.655522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:49:41.661833 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:49:48.669076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:49:56.670078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:50:12.673668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:50:44.679487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:56:48.685678 3.001087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 04:56:55.692614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:57:03.694045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:57:19.697672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 04:57:51.713179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:03:55.719760 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:04:02.727007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:04:10.728184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:04:26.731092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:04:55.213309 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:04:55.213459 1.702199 tcp 10.0.2.105 51030 -> 128.255.183.224 9027 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:04:58.737070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:10:50.323319 0.000158 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:10:50.323594 0.315446 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:50.639454 0.406993 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:51.046801 0.485928 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:51.533171 0.299343 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:51.832858 0.402231 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:52.235441 0.304699 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:10:52.540654 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 05:11:02.743059 3.002178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:11:09.750503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:11:11.095720 0.570565 tcp 10.0.2.105 51031 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:11.666621 0.573966 tcp 10.0.2.105 51032 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:12.240499 1.150286 tcp 10.0.2.105 51033 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:13.391399 0.407289 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:13.799039 0.301193 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:14.100552 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 05:11:17.752799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:11:30.241564 0.581161 tcp 10.0.2.105 51034 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:30.823054 0.579124 tcp 10.0.2.105 51035 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:31.402554 1.191820 tcp 10.0.2.105 51036 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:11:32.595008 0.389438 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:32.984861 0.412884 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:33.398112 0.407198 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:33.755417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:11:33.805742 0.404511 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:34.210656 0.308927 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:34.520011 0.463821 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:34.984374 0.577853 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:35.562583 0.409814 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:35.972796 0.433617 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:36.406812 0.458646 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:36.865892 0.496380 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:37.362692 0.387569 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:37.750617 0.281348 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:38.032531 0.404727 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:38.437623 0.475910 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:38.913915 0.286960 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:39.201275 0.667737 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:39.869411 0.623544 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:11:40.493375 0.308736 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:12:05.761578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:18:09.767940 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:18:16.774722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:18:24.776027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:18:40.779300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:19:12.785634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:25:16.792002 3.000981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:25:23.798760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:25:31.800133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:25:47.803182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:26:19.809466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:32:23.815315 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:32:30.822712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:32:38.824404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:32:54.827238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:33:26.833464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:34:56.923223 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:34:56.923396 2.521810 tcp 10.0.2.105 51037 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:39:30.839473 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:39:37.846728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:39:45.848019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:40:01.851185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:40:33.857662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:41:58.359390 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 05:41:58.359520 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 05:42:17.138293 1.019697 tcp 10.0.2.105 51038 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:18.157820 1.039803 tcp 10.0.2.105 51039 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:19.197989 2.069981 tcp 10.0.2.105 51040 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:21.268890 0.646205 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:21.915496 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 05:42:37.356100 1.017209 tcp 10.0.2.105 51041 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:38.373124 1.008490 tcp 10.0.2.105 51042 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:39.381938 2.043370 tcp 10.0.2.105 51043 -> 195.113.214.226 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/07 05:42:41.425931 0.660105 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:42.086447 0.643490 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:42.730435 0.615012 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:43.345843 0.607851 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:43.954190 0.527452 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:44.482035 0.612118 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:45.094509 0.518755 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:45.613673 0.610853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:46.224960 0.607919 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:46.833262 0.639538 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:47.473215 0.657069 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:48.130676 0.467219 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:48.598344 0.472083 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:49.070843 0.592789 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:49.664046 0.622452 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:50.286906 0.650429 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:50.937802 0.582601 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:51.520814 0.733635 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:52.254846 0.603315 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:52.858503 0.513533 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:53.372442 0.505739 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:53.879581 0.619726 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:54.499688 0.687399 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:55.187430 0.831869 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:56.019724 0.659152 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:42:56.679272 0.531379 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/07 05:46:37.863613 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 05:46:44.870510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:46:52.872500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:47:08.875210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:47:40.881768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:53:44.888564 3.000494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 05:53:51.894857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:53:59.896489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:54:15.899089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 05:54:47.905526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:00:51.910864 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:00:58.918512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:01:06.919875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:01:22.923002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:01:54.929569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:04:59.444973 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:04:59.445077 1.895149 tcp 10.0.2.105 51044 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:07:58.935605 3.001296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:08:05.942773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:08:13.944029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:08:29.946861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:09:01.953476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:13:26.103422 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:13:26.103544 0.486159 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:26.590077 0.417416 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:27.008181 0.418444 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:27.427033 0.418064 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:27.845526 0.385952 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:28.231844 0.330220 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:28.562461 0.329113 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:28.891978 0.386372 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:29.278709 0.310661 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:29.589770 0.393602 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:29.983758 0.425926 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:30.410097 0.415142 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:30.825663 0.398389 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 592 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:31.224517 0.316206 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:31.541163 0.478012 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:32.019565 0.614997 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:32.634985 0.405846 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:33.041252 0.435146 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:33.476742 0.365220 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:33.842359 0.501193 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:34.343958 0.390003 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:34.734365 0.290217 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:35.024939 0.281964 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:35.307243 0.406944 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:35.714527 0.479952 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:36.194903 0.511374 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:36.706728 0.397793 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:13:37.104882 0.308803 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:15:05.958857 3.002199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:15:12.966872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:15:20.968353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:15:36.970793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:16:08.977031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:22:12.983202 3.001678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:22:19.990182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:22:27.991763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:22:43.995284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:23:16.001181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:29:20.006894 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:29:27.014470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:29:35.015622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:29:51.018860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:30:23.024907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:35:01.345710 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:35:01.345905 1.703695 tcp 10.0.2.105 51045 -> 128.255.183.224 9027 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:36:27.031602 3.000765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:36:34.038806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:36:42.039952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:36:58.042629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:37:30.048686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:43:34.055233 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:43:41.062031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:43:49.063850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:43:50.325811 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 06:43:50.325926 0.314409 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:43:50.640750 0.414731 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:43:51.055892 0.383779 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:43:51.440041 0.424492 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:43:51.864936 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 06:44:05.067209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:44:10.346664 0.569877 tcp 10.0.2.105 51046 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:44:10.916907 0.567750 tcp 10.0.2.105 51047 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:44:11.484957 1.382713 tcp 10.0.2.105 51048 -> 195.113.214.226 443 SRPA* 0 0 34 24193 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:44:12.868588 0.330510 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:13.199449 0.307581 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:13.507430 0.397638 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:13.905493 0.300217 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:14.206135 0.383403 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:14.589973 0.410656 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:15.001059 0.398518 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:15.400012 0.410926 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:15.811342 0.322871 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:16.134596 0.468297 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:16.603291 0.634874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:17.238583 0.407829 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:17.646846 0.432893 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:18.080169 0.365807 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:18.446385 0.494112 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:18.940905 0.392387 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:19.333701 0.282620 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:19.616751 0.278596 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:19.895771 0.426122 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:20.322344 0.475689 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:20.798450 0.720232 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:21.519079 0.396374 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 06:44:21.915871 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 06:44:37.073178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:44:37.324634 0.567576 tcp 10.0.2.105 51049 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:44:37.892594 0.584013 tcp 10.0.2.105 51050 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:44:38.476837 1.176431 tcp 10.0.2.105 51051 -> 195.113.214.226 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/07 06:50:41.078911 3.001906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:50:48.086555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:50:56.087764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:51:12.090919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:51:44.096903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:57:48.103245 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 06:57:55.110157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:58:03.112020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:58:19.114472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 06:58:51.120546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:04:55.127195 3.001625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:05:02.134129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:05:03.056399 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:05:03.056579 1.745101 tcp 10.0.2.105 51052 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:05:10.135764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:05:26.139138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:05:58.144723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:12:02.151252 3.001382 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:12:09.157899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:12:17.159770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:12:33.162829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:13:05.168804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:14:56.409400 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:14:56.409585 0.413634 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:14:56.823633 0.316537 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:14:57.140588 0.418941 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:14:57.559892 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 07:15:14.357187 0.573579 tcp 10.0.2.105 51053 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:15:14.931048 0.578070 tcp 10.0.2.105 51054 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:15:15.509397 1.153082 tcp 10.0.2.105 51055 -> 195.113.214.226 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:15:16.663260 0.390778 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:17.054468 0.418922 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:17.473827 0.351100 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:17.825292 0.386852 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:18.212509 0.334220 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:18.547137 0.303985 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:18.851521 0.381976 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:19.233900 0.395876 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:19.630177 0.322667 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:19.953271 0.480005 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:20.433715 0.396545 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:20.830683 0.459364 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:21.290482 0.620104 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:21.910945 0.397651 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:22.308947 0.435519 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:22.744817 0.468706 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:23.213893 0.372496 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:23.586805 0.283340 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:23.870498 0.391314 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:24.262179 0.267184 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:24.529789 0.468292 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:24.998455 0.401545 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:25.400471 0.621731 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:15:26.022677 0.488118 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:19:09.175404 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 07:19:16.182260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:19:24.183726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:19:40.186983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:20:12.192684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:26:16.199433 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:26:23.205850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:26:31.207920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:26:47.210738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:27:19.216703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:33:23.222026 3.002169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:33:30.229797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:33:38.231501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:33:54.234387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:34:26.240544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:35:04.806901 0.000187 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:35:04.807258 1.782009 tcp 10.0.2.105 51056 -> 128.255.183.224 9027 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:40:30.247408 3.241481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:40:37.604461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:40:45.605975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:41:01.609160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:41:33.615186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:45:47.130269 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 07:45:47.130374 0.319153 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:45:47.449990 0.473517 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:45:47.923915 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 07:46:06.510510 0.576081 tcp 10.0.2.105 51057 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:46:07.086901 0.568076 tcp 10.0.2.105 51058 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:46:07.655237 1.163327 tcp 10.0.2.105 51059 -> 195.113.214.226 443 SRPA* 0 0 23 13772 flow=From-Botnet-V2-TCP-Established 1970/01/07 07:46:08.819290 0.433780 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:09.253575 0.379582 udp 10.0.2.105 7010 <-> 67.87.105.252 9318 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:09.633564 0.434635 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:10.068592 0.348438 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:10.417378 0.391451 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:10.809201 0.384877 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:11.194479 0.315855 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:11.510738 0.311023 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:11.822168 0.412220 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:12.234858 0.331950 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:12.567197 0.423015 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:12.990618 0.448308 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:13.439316 0.461306 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:13.901025 0.633628 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:14.535040 0.407457 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:14.942838 0.434098 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:15.377300 0.544883 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:15.922584 0.367035 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:16.290024 0.292853 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:16.583288 0.387232 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:16.970903 0.313685 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:17.285015 0.476637 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:17.762036 0.409928 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:18.172485 0.614987 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:46:18.787891 0.397207 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/07 07:47:37.621441 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 07:47:44.628261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:47:52.630013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:48:08.633338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:48:40.639426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:54:44.645582 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 07:54:51.652772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:54:59.653885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:55:15.656888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 07:55:47.663256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:01:51.669382 3.001186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:01:58.676570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:02:06.678043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:02:22.681146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:02:54.687017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:05:06.757813 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:05:06.758092 1.697948 tcp 10.0.2.105 51060 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:08:58.693371 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:09:05.700136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:09:13.701955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:09:29.705403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:10:01.711077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:16:05.717834 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:16:12.724762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:16:20.725907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:16:34.536877 0.000261 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:16:34.537260 0.308610 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:34.846312 0.619642 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:35.466277 0.417325 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:35.883971 0.428983 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:36.313788 0.000000 udp 10.0.2.105 7010 -> 67.87.105.252 9318 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 08:16:36.729222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:16:51.863300 0.584842 tcp 10.0.2.105 51061 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:16:52.448460 0.571613 tcp 10.0.2.105 51062 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:16:53.020509 1.178502 tcp 10.0.2.105 51063 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:16:54.199568 0.430929 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:54.630906 0.319398 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:54.950705 0.406691 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:55.357801 0.386941 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:55.745140 0.409885 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:56.155388 0.310258 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:56.466044 0.305452 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:56.771865 0.328797 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:57.101024 0.413156 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:16:57.514537 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 08:17:08.735127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:17:15.565985 0.568927 tcp 10.0.2.105 51064 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:17:16.135225 0.574982 tcp 10.0.2.105 51065 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:17:16.710553 1.176692 tcp 10.0.2.105 51066 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:17:17.887808 0.467929 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:18.356166 0.440943 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:18.797497 0.758184 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:19.556059 0.404878 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:19.961346 0.450412 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:20.412143 0.405194 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:20.817728 0.286662 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:21.104734 0.396910 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:21.502059 0.306779 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:21.809206 0.472267 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:22.281885 0.415864 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:22.698134 0.655909 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:17:23.354420 0.393756 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:23:12.741279 3.001394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:23:19.748154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:23:27.749589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:23:43.752656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:24:15.759106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:30:19.765096 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:30:26.772651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:30:34.774025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:30:50.776887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:31:22.783034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:35:08.458169 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:35:08.458319 1.802354 tcp 10.0.2.105 51067 -> 128.255.183.224 9027 FSPA* 0 0 12 1580 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:37:26.789331 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:37:33.796445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:37:41.797740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:37:57.800774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:38:29.806977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:44:33.812867 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:44:40.820175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:44:48.821881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:45:04.824630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:45:36.830931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:47:35.882633 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 08:47:35.882819 0.000000 udp 10.0.2.105 7010 -> 67.87.105.252 9318 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 08:47:54.390686 0.572042 tcp 10.0.2.105 51068 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:47:54.962968 0.575581 tcp 10.0.2.105 51069 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:47:55.538797 1.168020 tcp 10.0.2.105 51070 -> 195.113.214.226 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:47:56.707541 0.396366 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:57.104265 0.298574 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:57.403226 0.443689 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:57.847303 0.323474 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:58.171172 0.420449 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:58.592035 0.392736 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:58.985171 0.435556 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:59.421139 0.326695 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:47:59.748174 0.414300 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:00.162819 0.382737 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:00.545964 0.307348 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:00.853690 0.309923 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:01.163970 0.323217 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:01.487597 0.423756 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:01.911738 0.457477 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:02.369585 0.000000 udp 10.0.2.105 7010 -> 75.20.135.31 3612 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 08:48:17.633367 0.562250 tcp 10.0.2.105 51071 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:48:18.195968 0.636179 tcp 10.0.2.105 51072 -> 195.113.214.226 80 SRPA* 0 0 20 14740 flow=From-Botnet-V2-TCP-Established 1970/01/07 08:48:18.832802 0.575153 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:19.408487 0.408599 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:19.817456 0.363683 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:20.181550 0.288440 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:20.470396 0.461316 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:20.932060 0.284821 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:21.217354 0.452132 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:21.669921 0.385598 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:22.055875 0.412702 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:22.468995 0.709117 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:48:23.178521 0.401373 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 08:51:40.837221 3.000972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 08:51:47.843936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:51:55.845955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:52:11.848914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:52:43.854621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:58:47.860947 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 08:58:54.868108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:59:02.869792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:59:18.872686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 08:59:50.878884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:05:10.268866 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:05:10.269048 1.743457 tcp 10.0.2.105 51073 -> 128.255.183.224 9027 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:05:54.885437 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:06:01.892118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:06:09.893750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:06:25.896988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:06:57.902763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:13:01.908075 3.002402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:13:08.916180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:13:16.917892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:13:32.920524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:14:04.926867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:18:45.871312 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:18:45.871420 0.473443 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:18:46.345240 0.429189 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:18:46.774884 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 09:19:02.857367 0.571798 tcp 10.0.2.105 51074 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:19:03.429440 0.582609 tcp 10.0.2.105 51075 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:19:04.012547 1.161022 tcp 10.0.2.105 51076 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:19:05.174294 0.453640 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:05.628371 0.342314 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:05.971033 0.391764 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:06.363164 0.419032 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:06.782626 0.428106 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:07.211156 0.406855 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:07.618415 0.360723 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:07.979552 0.381105 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:08.361062 0.308192 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:08.669612 0.324066 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:08.994007 0.454365 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:09.448783 0.411979 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:09.861169 0.325978 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:10.187483 0.360324 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:10.548183 0.576648 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:11.125215 0.403911 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:11.529490 0.309263 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:11.839131 0.463377 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:12.302923 0.294587 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:12.597874 0.472969 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:13.071234 0.386494 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:13.458128 0.410837 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:13.869355 0.597625 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:19:14.467391 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 09:19:29.915651 0.579645 tcp 10.0.2.105 51077 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:19:30.495598 0.582376 tcp 10.0.2.105 51078 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:19:31.078294 1.158433 tcp 10.0.2.105 51079 -> 195.113.214.226 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:20:08.932109 3.002554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 09:20:15.940528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:20:23.941632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:20:39.944846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:21:11.950432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:27:15.956679 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:27:22.964406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:27:30.965372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:27:46.968259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:28:18.974479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:34:22.980585 3.001837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:34:29.988050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:34:37.989213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:34:53.992775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:35:12.018835 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:35:12.018930 1.717811 tcp 10.0.2.105 51080 -> 128.255.183.224 9027 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:35:25.998559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:41:30.004139 3.001923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:41:37.012449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:41:45.013791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:42:01.016687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:42:33.022581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:48:37.028939 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 09:48:44.036912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:48:52.038497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:49:08.041364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:49:40.046564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:49:42.360185 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 09:49:42.360308 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 09:49:57.954744 0.559627 tcp 10.0.2.105 51081 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:49:58.514717 0.594735 tcp 10.0.2.105 51082 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:49:59.109994 1.183816 tcp 10.0.2.105 51083 -> 195.113.214.226 443 SRPA* 0 0 21 12436 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:00.294516 0.401347 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:00.696212 0.442901 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:01.139537 0.396301 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:01.536219 0.317533 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:01.854177 0.387944 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:02.242521 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 09:50:17.521497 0.570121 tcp 10.0.2.105 51084 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:18.091908 0.600697 tcp 10.0.2.105 51085 -> 195.113.214.226 80 SRPA* 0 0 18 13340 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:18.693200 0.422679 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:19.116359 0.420771 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:19.537522 0.413918 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:19.951824 0.321547 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:20.273724 0.391193 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:20.665417 0.306904 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:20.972678 0.321272 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:21.294290 0.320788 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:21.615434 0.506416 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:22.122255 0.476702 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:22.599298 0.367373 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:22.967068 0.596265 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:23.563682 0.636291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:24.200469 0.420144 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:24.621024 0.282654 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:24.904125 0.620255 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:25.524805 0.292727 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:25.817889 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 09:50:44.390626 0.560646 tcp 10.0.2.105 51086 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:44.951531 0.567516 tcp 10.0.2.105 51087 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:45.519343 1.158598 tcp 10.0.2.105 51088 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/07 09:50:46.678698 0.420874 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:50:47.099920 0.404180 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/07 09:55:44.053062 3.001068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 09:55:51.069657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:55:59.071371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:56:15.074560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 09:56:47.080825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:02:51.086373 3.001604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:02:58.094182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:03:06.095411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:03:22.098601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:03:54.104559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:05:13.739840 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:05:13.739956 1.723651 tcp 10.0.2.105 51089 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:09:58.110581 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:10:05.117797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:10:13.119683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:10:29.122266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:11:01.128592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:17:05.135198 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:17:12.141862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:17:20.143282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:17:36.146272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:18:08.152398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:21:02.603603 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:21:02.603842 0.413714 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:03.017941 0.410539 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:03.428872 0.432324 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:03.861978 0.401014 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:04.263409 0.368544 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:04.632367 0.396300 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:05.029056 0.397464 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:05.426908 0.410341 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:05.837633 0.317502 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:06.155481 0.428176 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:06.584078 0.415506 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:07.000011 0.319749 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:07.320168 0.388719 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:07.709298 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 10:21:24.286949 0.563420 tcp 10.0.2.105 51090 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:21:24.850606 0.583854 tcp 10.0.2.105 51091 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:21:25.434765 1.180355 tcp 10.0.2.105 51092 -> 195.113.214.226 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:21:26.615737 0.332492 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:26.948678 0.460098 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:27.409186 0.366452 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:27.776060 0.408545 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:28.185008 0.585223 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:28.770625 0.470336 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:29.241345 0.288674 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:29.530424 0.403576 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:29.934364 0.563906 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:30.498701 0.280391 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:30.779488 0.404886 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:21:31.184765 0.294616 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:24:12.158426 3.002262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:24:19.166323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:24:27.167302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:24:43.170098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:25:15.176194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:31:19.181803 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:31:26.189882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:31:34.191473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:31:50.194262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:32:22.200454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:35:15.470180 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:35:15.470464 1.742428 tcp 10.0.2.105 51093 -> 128.255.183.224 9027 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:38:26.206828 3.001489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:38:33.213669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:38:41.215399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:38:57.218451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:39:29.224413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:45:33.230767 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:45:40.237864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:45:48.239155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:46:04.242305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:46:36.248582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:51:56.849740 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 10:51:56.849851 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 10:52:14.237164 0.567778 tcp 10.0.2.105 51094 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:52:14.805219 0.564313 tcp 10.0.2.105 51095 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:52:15.369894 1.195651 tcp 10.0.2.105 51096 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 10:52:16.566131 0.409456 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:16.975995 0.396970 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:17.373347 0.385737 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:17.759485 0.434544 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:18.194384 0.308270 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:18.503055 0.390564 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:18.894041 0.391145 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:19.285593 0.333690 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:19.619682 0.438798 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:20.058863 0.423204 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:20.482411 0.428064 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:20.910898 0.312742 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:21.224043 0.369769 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:21.594219 0.316105 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:21.910738 0.410803 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:22.321916 0.471281 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:22.793605 0.371237 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:23.165244 0.576857 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:23.742511 0.467225 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:24.210086 0.282475 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:24.492966 0.409576 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:24.902929 0.405566 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:25.308883 0.482516 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:25.791792 0.276295 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:26.068647 0.290624 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 10:52:40.255225 3.000879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:52:47.261884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:52:55.263253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:53:11.266103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:53:43.272080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 10:59:47.279098 3.000987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 10:59:54.285445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:00:02.287413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:00:18.289876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:00:50.296110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:05:17.220644 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:05:17.220736 1.774872 tcp 10.0.2.105 51097 -> 128.255.183.224 9027 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:06:54.302227 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:07:01.309927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:07:09.311394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:07:25.314175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:07:57.319825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:14:01.326864 3.001119 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:14:08.333563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:14:16.335115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:14:32.338489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:15:04.344267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:21:08.350300 3.001662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:21:15.357389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:21:23.359056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:21:39.361716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:22:11.367856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:22:30.366057 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:22:30.366164 0.520788 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:30.887326 0.388859 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:31.276775 0.381857 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:31.658994 0.439626 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:32.099027 0.312012 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:32.411421 0.426439 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:32.838237 0.390026 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:33.228604 0.331755 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:33.560775 0.418472 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:33.979667 0.322301 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:34.302409 0.419762 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:34.722522 0.419142 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:35.142005 0.375799 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:35.518206 0.323639 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:35.842192 0.408033 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:36.250631 0.474952 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:36.725977 0.367800 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:37.094145 0.590938 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:37.685482 0.461945 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:38.147832 0.281880 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:38.430181 0.397993 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:38.828545 0.409180 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:39.238176 0.410299 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:39.648872 0.483553 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:22:40.132771 0.283872 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:28:15.373355 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:28:22.381697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:28:30.382789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:28:46.385977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:29:18.391771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:35:19.001185 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:35:19.001463 1.696486 tcp 10.0.2.105 51098 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:35:22.398368 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:35:29.405480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:35:37.407315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:35:53.410285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:36:25.505959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:42:29.512390 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:42:36.519678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:42:44.521190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:43:00.524276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:43:32.530184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:49:36.535931 3.002021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:49:43.543440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:49:51.545150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:50:07.548151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:50:39.554200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:52:53.136363 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 11:52:53.136470 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 11:53:10.463665 0.590363 tcp 10.0.2.105 51099 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:53:11.054338 0.591262 tcp 10.0.2.105 51100 -> 195.113.214.226 80 SRPA* 0 0 19 13445 flow=From-Botnet-V2-TCP-Established 1970/01/07 11:53:11.646081 0.399751 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:12.046236 0.397011 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:12.443619 0.441743 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:12.885699 0.317716 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:13.203776 0.394484 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:13.598616 0.397276 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:13.996440 0.318098 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:14.314956 0.326987 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:14.642377 0.419377 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:15.062168 0.403007 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:15.465544 0.414487 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:15.880569 0.402263 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:16.283272 0.320966 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:16.604664 0.417330 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:17.022370 0.472416 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:17.495197 0.369484 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:17.865092 0.579840 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:18.445358 0.460615 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:18.906358 0.280772 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:19.187518 0.416575 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:19.604494 0.410861 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:20.015774 0.273442 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:20.289578 0.525455 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:53:20.815441 0.284974 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 11:56:43.560496 3.001417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 11:56:50.567395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:56:58.569037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:57:14.571660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 11:57:46.578114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:03:50.584761 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:03:57.591542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:04:05.592944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:04:21.596036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:04:53.601677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:05:20.741941 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:05:20.742121 1.661275 tcp 10.0.2.105 51101 -> 128.255.183.224 9027 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:10:57.608313 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:11:04.615228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:11:12.617110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:11:28.619730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:12:00.625798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:18:04.631459 3.002131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:18:11.639485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:18:19.640948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:18:35.644069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:19:07.649972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:23:42.034954 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:23:42.035150 0.506080 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:42.541582 0.401230 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:42.943234 0.423412 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:43.367004 0.379330 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:43.746754 0.435397 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:44.182533 0.387842 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:44.570726 0.393279 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:44.964358 0.320047 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:45.284812 0.314792 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:45.600051 1.858835 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:47.459293 0.403987 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:47.863680 0.423453 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:48.287540 0.391246 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:48.679186 0.316106 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:48.995646 0.413948 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:49.409968 0.463678 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:49.874032 0.376061 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:50.250559 0.578885 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:50.829853 0.472269 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:51.302438 0.289364 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:51.592177 0.284870 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:51.877466 0.409770 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:52.287633 0.402809 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:52.690838 0.638785 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:23:53.330030 0.290419 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:25:11.656408 3.001358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:25:18.663143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:25:26.665101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:25:42.668140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:26:14.674145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:32:18.680323 3.000909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:32:25.687348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:32:33.688944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:32:49.692265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:33:21.698093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:35:22.402233 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:35:22.402368 1.677234 tcp 10.0.2.105 51102 -> 128.255.183.224 9027 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:39:25.704514 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:39:32.711160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:39:40.712994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:39:56.715864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:40:28.722222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:46:32.727713 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:46:39.735532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:46:47.736821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:47:03.739635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:47:35.745796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:53:39.752838 3.000516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 12:53:46.759176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:53:54.760877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:54:10.763828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 12:54:15.360499 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 12:54:15.360604 0.410737 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:15.771753 0.403575 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:16.175737 0.439879 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:16.616097 0.364260 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:16.980733 0.385332 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:17.366481 0.391396 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:17.758220 0.410159 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:18.168782 0.324482 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:18.493670 0.334775 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:18.828843 0.415353 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:19.244618 0.420738 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:19.665751 0.408832 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:20.074965 0.402053 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:20.477438 0.319433 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:20.797280 0.368805 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:21.166480 0.413406 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:21.580528 0.465840 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:22.046780 0.577897 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:22.625079 0.471470 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:23.096889 0.286602 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:23.383860 0.253808 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:23.638012 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 12:54:38.897232 0.563441 tcp 10.0.2.105 51103 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:54:39.460930 0.557551 tcp 10.0.2.105 51104 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:54:40.018799 1.395111 tcp 10.0.2.105 51105 -> 195.113.214.226 443 SRPA* 0 0 33 24741 flow=From-Botnet-V2-TCP-Established 1970/01/07 12:54:41.414517 0.406033 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:41.820939 0.471494 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:42.292803 0.279083 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/07 12:54:42.769618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:00:46.776055 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:00:53.783203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:01:01.784773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:01:17.787352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:01:49.794050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:05:24.083386 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:05:24.083660 2.147498 tcp 10.0.2.105 51106 -> 128.255.183.224 9027 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:07:53.800604 3.000584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:08:00.807391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:08:08.808645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:08:24.811424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:08:56.818003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:15:00.824168 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:15:07.830968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:15:15.832771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:15:31.835677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:16:03.841526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:22:07.847715 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:22:14.855202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:22:22.856313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:22:38.859769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:23:10.865953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:25:02.966897 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:25:02.967003 0.404096 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:25:03.371099 0.000000 icmp 24.183.211.41 0x0303 -> 10.0.2.105 0x6226 URP 192 1 121 flow=Background 1970/01/07 13:25:20.364190 0.578163 tcp 10.0.2.105 51107 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:25:20.942654 0.606421 tcp 10.0.2.105 51108 -> 195.113.214.226 80 SRPA* 0 0 23 14334 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:25:21.549715 0.421092 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:21.971208 0.393527 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:22.365137 0.315590 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:22.681131 0.431696 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:23.113220 0.396110 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:23.509728 0.390678 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:23.900826 0.385587 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:24.286850 0.433021 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:24.720331 0.325317 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:25.046055 0.306244 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:25.352707 0.417819 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:25.771098 0.426844 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:26.198306 0.504307 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:26.702965 0.377619 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:27.080988 0.369180 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:27.450548 0.456666 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:27.907597 0.414767 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:28.322774 0.466304 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:28.789465 0.574715 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:29.364607 0.286260 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:29.651282 0.278412 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:29.930144 0.407192 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:30.337737 0.475068 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:30.813219 0.270106 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:31.104772 0.416093 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:31.521438 0.321170 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:31.843207 0.436326 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:32.280073 0.415616 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:32.696266 0.392339 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:33.089102 0.405742 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:33.495472 0.384631 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:33.880835 0.318270 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:34.199690 0.424089 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:34.624512 0.410398 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:35.035394 0.446953 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:35.482930 0.298704 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:35.782244 0.483258 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:36.265953 0.388080 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:36.654496 0.458580 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:37.113705 0.405428 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:37.519708 0.365348 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:37.885630 0.472843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:38.359074 0.586691 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:38.946223 0.281554 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:39.228319 0.308201 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:39.537002 0.461646 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:39.999275 0.280272 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:40.280147 0.416548 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:25:40.697487 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:25:45.408114 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:25:45.978910 0.000000 udp 10.0.2.105 7010 -> 84.58.185.94 2044 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:25:53.940020 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:02.132262 0.000000 udp 10.0.2.105 7010 -> 130.255.143.0 8182 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:07.719947 0.000000 udp 10.0.2.105 7010 -> 50.136.167.140 1505 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:12.406700 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:26:14.590219 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:22.841743 0.000000 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:31.013655 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:39.486121 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:44.402549 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:26:46.715816 0.297959 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:26:47.090890 0.000000 udp 10.0.2.105 7010 -> 70.249.90.135 6601 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:26:53.055303 0.000000 udp 10.0.2.105 7010 -> 118.82.179.48 9712 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:00.816266 0.000000 udp 10.0.2.105 7010 -> 77.182.218.194 5572 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:05.903805 0.358866 udp 10.0.2.105 7010 <-> 95.83.249.219 1106 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:27:06.317506 0.344801 udp 10.0.2.105 7010 -> 188.217.191.29 1120 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:06.662307 0.000000 icmp 188.217.191.29 0x0303 -> 10.0.2.105 0x6004 URP 192 1 205 flow=Background 1970/01/07 13:27:10.910905 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:27:11.431832 0.000000 udp 10.0.2.105 7010 -> 2.135.189.148 3505 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:20.294321 0.000000 udp 10.0.2.105 7010 -> 50.74.192.2 6617 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:28.246132 0.000000 udp 10.0.2.105 7010 -> 203.202.249.140 9130 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:36.737975 0.000000 udp 10.0.2.105 7010 -> 95.239.242.220 2391 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:41.404446 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:27:44.949898 0.000000 udp 10.0.2.105 7010 -> 81.139.130.162 5444 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:51.649757 0.698185 udp 10.0.2.105 7010 <-> 99.112.213.117 2350 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:27:52.370586 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:27:59.831494 0.000000 udp 10.0.2.105 7010 -> 63.138.136.18 3412 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:06.841129 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:11.407762 0.175209 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:28:14.923117 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:20.200585 0.000000 udp 10.0.2.105 7010 -> 64.21.212.180 7896 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:26.109277 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:34.431290 0.000000 udp 10.0.2.105 7010 -> 108.29.37.68 2391 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:38.987020 0.069789 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:28:40.479828 0.000000 udp 10.0.2.105 7010 -> 186.119.121.42 6439 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:46.338498 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:28:53.187607 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 6439 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:00.548371 0.000000 udp 10.0.2.105 7010 -> 94.3.152.95 9922 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:05.505716 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:29:09.260746 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:14.971968 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 13:29:15.540215 0.000000 udp 10.0.2.105 7010 -> 162.232.224.137 2930 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:21.979495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:29:23.932119 0.000000 udp 10.0.2.105 7010 -> 212.29.157.82 6674 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:29.980557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:29:31.132487 0.312402 udp 10.0.2.105 7010 -> 86.64.86.226 6028 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:31.444889 0.000000 icmp 86.64.86.226 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 300 flow=Background 1970/01/07 13:29:36.009232 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:29:39.374725 0.000000 udp 10.0.2.105 7010 -> 24.185.180.57 3045 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:44.642076 0.000000 udp 10.0.2.105 7010 -> 79.23.6.77 5808 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:45.983817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:29:51.732188 0.000000 udp 10.0.2.105 7010 -> 122.165.226.166 9971 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:29:58.421471 0.000000 udp 10.0.2.105 7010 -> 87.29.87.164 7975 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:03.008016 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:30:05.732049 0.332778 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:30:06.080554 0.000000 udp 10.0.2.105 7010 -> 24.79.14.98 5956 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:13.473625 0.299565 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:30:13.782193 0.000000 udp 10.0.2.105 7010 -> 95.225.106.19 1024 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:17.989455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:30:18.831058 0.000000 udp 10.0.2.105 7010 -> 95.137.155.79 8801 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:24.950135 0.000000 udp 10.0.2.105 7010 -> 97.101.206.6 7833 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:29.505952 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:30:31.319118 0.000000 udp 10.0.2.105 7010 -> 88.224.206.52 5923 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:37.297557 0.000000 udp 10.0.2.105 7010 -> 189.59.32.249 3220 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:45.269484 0.000000 udp 10.0.2.105 7010 -> 199.7.193.43 6502 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:53.510910 0.000000 udp 10.0.2.105 7010 -> 82.52.9.199 1571 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:30:58.507625 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:31:01.782988 0.000000 udp 10.0.2.105 7010 -> 24.44.109.104 1653 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:09.684157 0.000000 udp 10.0.2.105 7010 -> 92.238.72.232 6203 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:15.663044 0.295825 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:31:15.970010 0.323416 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:31:16.308830 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:23.934779 0.000000 udp 10.0.2.105 7010 -> 190.163.15.194 2135 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:28.510728 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:31:32.697607 0.000000 udp 10.0.2.105 7010 -> 186.190.153.111 1149 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:38.836155 0.000000 udp 10.0.2.105 7010 -> 173.164.211.249 1568 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:44.053617 0.000000 udp 10.0.2.105 7010 -> 85.102.1.166 1051 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:49.661680 0.000000 udp 10.0.2.105 7010 -> 211.120.147.181 6053 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:31:54.508865 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:31:55.089792 0.000000 udp 10.0.2.105 7010 -> 83.135.67.212 9327 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:01.559114 0.000000 udp 10.0.2.105 7010 -> 190.137.180.169 1024 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:09.029598 0.000000 udp 10.0.2.105 7010 -> 80.216.225.141 8508 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:15.749355 0.000000 udp 10.0.2.105 7010 -> 69.142.23.247 8236 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:20.505760 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:32:22.418693 0.453673 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/07 13:32:23.041566 0.000000 udp 10.0.2.105 7010 -> 70.28.80.192 1386 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:29.899586 0.000000 udp 10.0.2.105 7010 -> 78.185.136.150 2204 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:36.588837 0.000000 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:44.430513 0.000000 udp 10.0.2.105 7010 -> 207.183.255.42 5434 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:49.006783 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:32:51.079713 0.000000 udp 10.0.2.105 7010 -> 82.104.84.169 4248 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:32:59.992958 0.000000 udp 10.0.2.105 7010 -> 84.57.167.8 2107 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:33:07.213304 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 13:35:26.333642 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 13:35:26.333790 1.707007 tcp 10.0.2.105 51109 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/07 13:36:21.996220 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 13:36:29.002820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:36:37.004867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:36:53.008080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:37:25.013832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:43:29.019952 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:43:36.027497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:43:44.028296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:44:00.032076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:44:32.037491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:50:36.043701 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:50:43.050933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:50:51.052613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:51:07.055501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:51:39.062033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:57:43.067986 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 13:57:50.074767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:57:58.076253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:58:14.079877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 13:58:46.085574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:03:19.268626 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:03:19.268774 0.463048 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:19.732376 0.320119 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:20.052917 0.437526 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:20.490845 0.391335 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:20.882563 0.396062 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:21.279050 0.388828 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:21.668306 0.390844 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:22.059553 0.305825 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:22.365783 0.439994 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:22.806175 0.420983 udp 10.0.2.105 7010 <-> 99.29.174.22 1229 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:23.227572 0.328710 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:23.556708 0.422246 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:23.979391 0.311773 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:24.291545 0.478717 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:24.770616 0.383335 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:25.154362 0.372923 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:25.527685 0.544598 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:26.072695 0.293043 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:26.366140 0.483888 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:26.850417 0.589666 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:27.440513 0.294527 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:27.735429 0.324386 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:28.060150 0.473349 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:28.533846 0.419712 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:28.953968 0.283097 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:03:29.237456 0.000000 udp 10.0.2.105 7010 -> 95.83.249.219 1106 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:03:45.038031 0.552630 tcp 10.0.2.105 51110 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:03:45.590923 0.579821 tcp 10.0.2.105 51111 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:03:46.171074 1.366233 tcp 10.0.2.105 51112 -> 195.113.214.226 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:03:47.538065 0.000000 udp 10.0.2.105 7010 -> 99.112.213.117 2350 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:04:06.097016 0.562264 tcp 10.0.2.105 51113 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:06.659537 0.571214 tcp 10.0.2.105 51114 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:07.230609 1.374686 tcp 10.0.2.105 51115 -> 195.113.214.226 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:08.605837 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:04:25.043971 0.565847 tcp 10.0.2.105 51116 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:25.610019 0.611392 tcp 10.0.2.105 51117 -> 195.113.214.226 80 SRPA* 0 0 19 14704 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:04:26.222021 0.309300 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:04:26.531738 0.324270 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:04:26.856401 0.300640 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:04:27.157393 0.432535 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:04:50.091415 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 14:04:57.098913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:05:05.100191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:05:21.103783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:05:28.043864 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:05:28.044056 2.376438 tcp 10.0.2.105 51118 -> 128.255.183.224 9027 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:05:53.109475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:11:57.115236 3.001767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:12:04.122881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:12:12.124502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:12:28.127445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:13:00.133884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:19:04.140076 3.001198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:19:11.146751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:19:19.148267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:19:35.151587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:20:08.639306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:26:12.645733 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:26:19.653160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:26:27.654972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:26:43.657460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:27:15.663699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:33:19.670077 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:33:26.677039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:33:34.678338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:33:50.681518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:34:22.687242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:34:29.257620 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 14:34:29.257795 0.000000 udp 10.0.2.105 7010 -> 95.83.249.219 1106 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:34:45.423088 0.564038 tcp 10.0.2.105 51119 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:34:45.987386 0.558951 tcp 10.0.2.105 51120 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:34:46.546671 1.364630 tcp 10.0.2.105 51121 -> 195.113.214.226 443 SRPA* 0 0 37 27275 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:34:47.912366 0.000000 udp 10.0.2.105 7010 -> 99.112.213.117 2350 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:35:05.951401 0.597809 tcp 10.0.2.105 51122 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:06.549454 0.611397 tcp 10.0.2.105 51123 -> 195.113.214.226 80 SRPA* 0 0 20 14738 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:07.161358 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:35:25.569411 0.568128 tcp 10.0.2.105 51124 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:26.137785 0.574220 tcp 10.0.2.105 51125 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:26.712325 1.151400 tcp 10.0.2.105 51126 -> 195.113.214.226 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:27.864171 0.422375 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:28.286929 0.320849 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:28.608165 0.456249 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:29.064829 0.385024 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:29.450197 0.396829 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:29.847430 0.390108 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:30.237968 0.387944 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:30.626264 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:35:31.146482 1.754881 tcp 10.0.2.105 51127 -> 128.255.183.224 9027 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:45.808555 0.564478 tcp 10.0.2.105 51128 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:46.373282 0.559820 tcp 10.0.2.105 51129 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:46.933390 1.151278 tcp 10.0.2.105 51130 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:35:48.085333 0.413583 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:48.499307 0.315898 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:48.815570 0.427096 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:49.243069 0.316918 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:49.560421 0.306677 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:49.867451 0.396392 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:50.264232 0.468952 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:50.733589 0.384219 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:51.118425 0.421089 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:51.539856 0.483849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:52.024145 0.282447 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:52.306959 0.280251 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:52.587653 0.587678 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:53.175719 0.256816 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:53.432867 0.410151 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:53.843353 0.476624 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:54.320471 0.296384 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:35:54.617229 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 14:36:10.954329 0.562119 tcp 10.0.2.105 51131 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:36:11.516684 0.602089 tcp 10.0.2.105 51132 -> 195.113.214.226 80 SRPA* 0 0 19 14721 flow=From-Botnet-V2-TCP-Established 1970/01/07 14:36:12.119389 0.300509 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:36:12.420276 0.312532 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:36:12.733190 0.435944 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 14:40:26.693476 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 14:40:33.700910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:40:41.702258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:40:57.705625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:41:29.711219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:47:33.717894 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:47:40.725196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:47:48.726648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:48:04.729711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:48:36.735785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:54:40.741220 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 14:54:47.748568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:54:55.750313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:55:11.753180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 14:55:43.759121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:01:47.765543 3.001382 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:01:54.772992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:02:02.774265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:02:18.777049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:02:50.783344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:05:32.907228 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:05:32.907527 1.744133 tcp 10.0.2.105 51133 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:06:34.926561 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:06:34.926657 0.000000 udp 10.0.2.105 7010 -> 99.29.174.22 1229 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 15:06:52.634023 0.581110 tcp 10.0.2.105 51134 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:06:53.215429 0.603169 tcp 10.0.2.105 51135 -> 195.113.214.226 80 SRPA* 0 0 19 14662 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:06:53.819216 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 15:07:10.638013 0.583266 tcp 10.0.2.105 51136 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:11.221532 0.558221 tcp 10.0.2.105 51137 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:11.779687 1.152145 tcp 10.0.2.105 51138 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:12.932449 0.482854 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:13.415726 0.318148 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:13.734230 0.469105 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:14.203700 0.382344 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:14.586405 0.415104 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:15.001980 0.392967 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:15.395348 0.393138 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:15.788839 0.420374 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:16.209580 0.316744 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:16.526736 0.322387 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:16.849483 0.432421 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:17.282293 0.308305 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:17.590986 0.369078 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:17.960441 0.513851 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:18.474663 0.385446 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:18.860507 0.411070 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:19.271919 0.460690 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:19.733032 0.285319 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:20.018729 0.283978 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:20.303111 0.413637 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:20.717082 0.290567 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:21.008019 0.581486 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:21.589926 0.587858 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:22.178188 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 15:07:40.291182 0.569383 tcp 10.0.2.105 51139 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:40.860907 0.566400 tcp 10.0.2.105 51140 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:41.427593 1.145824 tcp 10.0.2.105 51141 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:07:42.574201 0.299233 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:42.873756 0.324330 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:07:43.198450 0.431269 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:08:54.788917 3.002451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 15:09:01.797021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:09:09.798457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:09:25.801604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:09:57.807346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:16:01.813235 3.002132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:16:08.820970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:16:16.822104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:16:32.825670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:17:04.831732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:23:08.838267 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:23:15.845138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:23:23.846233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:23:39.849251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:24:11.855142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:30:15.861201 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:30:22.868420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:30:30.870322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:30:46.872975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:31:18.879119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:35:34.657982 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:35:34.658083 1.705873 tcp 10.0.2.105 51142 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:37:22.886054 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:37:29.892662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:37:37.894414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:37:53.897792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:37:56.381525 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 15:37:56.381696 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 15:38:11.675017 0.553351 tcp 10.0.2.105 51143 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:38:12.228628 0.560465 tcp 10.0.2.105 51144 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:38:12.789322 1.131207 tcp 10.0.2.105 51145 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:38:13.921123 0.432578 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:14.354122 0.317665 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:14.672199 0.400251 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:15.072845 0.456137 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:15.529327 0.383272 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:15.912966 0.393159 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:16.306494 0.387030 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:16.693876 0.314000 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:17.008399 0.316153 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:17.324887 0.435723 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:17.761008 0.361620 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:18.123026 0.314905 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:18.438333 0.415086 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:18.853790 0.461931 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:19.316138 0.380628 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:19.697177 0.482794 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:20.180341 0.467501 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:20.648239 0.269615 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:20.918239 0.311068 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:21.229650 0.405349 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:21.635404 0.303663 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:21.939436 0.580860 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:22.520686 0.588583 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:23.109670 0.304461 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:23.414496 0.327410 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 15:38:23.742295 0.000000 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 15:38:25.903360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:38:39.584716 0.574436 tcp 10.0.2.105 51146 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:38:40.159458 0.570267 tcp 10.0.2.105 51147 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:38:40.730020 1.158173 tcp 10.0.2.105 51148 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 15:44:29.909973 3.000721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:44:36.916554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:44:44.918191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:45:00.921443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:45:32.927385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:51:36.933754 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:51:43.941103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:51:51.941957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:52:07.944915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:52:39.950840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:58:43.957903 3.000848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 15:58:50.964325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:58:58.965992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:59:14.969157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 15:59:46.975556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:05:36.368384 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:05:36.368501 1.728859 tcp 10.0.2.105 51149 -> 128.255.183.224 9027 FSPA* 0 0 12 1473 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:05:50.981452 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:05:57.988546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:06:05.990177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:06:21.993211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:06:53.999400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:09:04.236681 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:09:04.236787 0.000000 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 16:09:19.751504 0.573273 tcp 10.0.2.105 51150 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:09:20.325086 0.572223 tcp 10.0.2.105 51151 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:09:20.897544 1.160926 tcp 10.0.2.105 51152 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:09:22.059016 0.396954 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:22.456502 0.441105 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:22.898010 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 16:09:39.197908 0.569231 tcp 10.0.2.105 51153 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:09:39.767458 0.596532 tcp 10.0.2.105 51154 -> 195.113.214.226 80 SRPA* 0 0 19 14688 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:09:40.364624 0.450511 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:40.815561 0.389640 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:41.205574 0.333630 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:41.539630 0.392064 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:41.932135 0.400026 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:42.332589 0.415474 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:42.748546 0.332230 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:43.081185 0.365454 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:43.446996 0.429020 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:43.876553 0.304682 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:44.181585 0.492569 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:44.681434 0.376015 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:45.057869 0.270720 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:45.328979 0.413270 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:45.742658 0.469105 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:46.212117 0.285830 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:46.498319 0.292132 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:46.790848 0.405048 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:47.196316 0.467416 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:47.664139 0.585123 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:48.249604 0.321297 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:09:48.571298 0.327048 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:12:58.005478 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 16:13:05.012309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:13:13.014159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:13:29.016872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:14:01.022836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:20:05.029636 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:20:12.036430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:20:20.037669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:20:36.041094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:21:08.046998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:27:12.053973 3.000390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:27:19.060097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:27:27.061785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:27:43.065010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:28:15.071317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:34:19.076968 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:34:26.094105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:34:34.096031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:34:50.098981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:35:22.104629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:35:38.098791 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:35:38.098910 1.730410 tcp 10.0.2.105 51155 -> 128.255.183.224 9027 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:39:57.250811 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 16:39:57.250901 0.327388 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:57.578681 0.397961 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:57.977006 0.436070 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:58.413476 0.418577 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:58.832397 0.386015 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:59.218781 0.322220 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:59.541416 0.383076 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:39:59.924909 0.311973 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:00.237291 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 16:40:16.241166 0.572603 tcp 10.0.2.105 51156 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:40:16.814002 0.607415 tcp 10.0.2.105 51157 -> 195.113.214.226 80 SRPA* 0 0 19 14684 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:40:17.422090 0.416273 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:17.838781 0.367894 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:18.207032 0.421902 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:18.629315 0.306463 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:18.936190 0.463022 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:19.399548 0.379422 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:19.779375 0.284677 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:20.064472 0.413822 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:20.478635 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 16:40:39.463058 0.546872 tcp 10.0.2.105 51158 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:40:40.009838 0.563257 tcp 10.0.2.105 51159 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:40:40.573384 1.146709 tcp 10.0.2.105 51160 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 16:40:41.720825 0.460225 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:42.181458 0.286558 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:42.468463 0.413735 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:42.882604 0.472438 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:43.355400 0.325298 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:43.681044 0.607800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:40:44.289233 0.303377 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 16:41:26.111070 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 16:41:33.118273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:41:41.119689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:41:57.122860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:42:29.129238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:48:33.135673 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:48:40.142344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:48:48.143550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:49:04.146985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:49:36.152733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:55:40.159282 3.001054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 16:55:47.166258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:55:55.167829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:56:11.171145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 16:56:43.177033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:02:47.182837 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:02:54.190191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:03:02.192112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:03:18.194707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:03:50.201104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:05:39.829459 0.000246 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:05:39.829878 1.745516 tcp 10.0.2.105 51161 -> 128.255.183.224 9027 FSPA* 0 0 14 1564 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:09:54.207176 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:10:01.214165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:10:09.215744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:10:25.218581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:10:57.224483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:11:09.132002 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:11:09.132182 0.398791 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:09.531371 0.619297 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:10.151018 0.315884 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:10.467311 0.400419 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:10.868125 0.444954 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:11.313432 0.436118 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:11.749982 0.317524 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:12.067906 0.386738 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:12.455002 0.383294 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:12.838672 0.311665 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:13.150727 0.425167 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:13.576418 0.320319 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:13.897155 0.421896 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:14.319409 0.367660 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:14.687426 0.455674 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:15.143506 0.394251 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:15.538172 0.279219 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:15.817785 0.406171 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:16.224313 0.485896 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:16.710607 0.288388 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:16.999414 0.417477 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:17.417264 0.524234 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:17.941963 0.320617 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:18.262994 0.590062 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:11:18.853445 0.294882 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:17:01.231622 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:17:08.238080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:17:16.239578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:17:32.242875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:18:04.248859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:24:08.254602 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:24:15.262480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:24:23.263740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:24:39.266760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:25:11.272682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:31:15.278679 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:31:22.286496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:31:30.287657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:31:46.290339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:32:18.296496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:35:41.579699 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:35:41.579899 1.713572 tcp 10.0.2.105 51162 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/07 17:38:22.303195 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:38:29.309896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:38:37.311744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:38:53.314306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:39:25.320874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:41:32.704151 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 17:41:32.704463 0.393762 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:33.098619 0.391207 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:33.490172 0.579191 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:34.069787 0.330919 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:34.401076 0.451557 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:34.852978 0.434381 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:35.287811 0.336835 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:35.625051 0.388282 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:36.013739 0.394231 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:36.408333 0.310727 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:36.719462 0.314134 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:37.034013 0.413378 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:37.447812 0.422768 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:37.870941 0.368613 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:38.239967 0.283089 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:38.523500 0.470085 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:38.993991 0.408584 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:39.402987 0.411566 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:39.814966 0.475083 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:40.290485 0.278602 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:40.569430 0.411101 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:40.980916 0.466156 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:41.447493 0.335833 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:41.783673 0.583043 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:41:42.367098 0.302314 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/07 17:45:29.326816 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:45:36.333887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:45:44.335442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:46:00.338279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:46:32.345008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:52:36.350545 3.002004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:52:43.358078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:52:51.359471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:53:07.362229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:53:39.368636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:59:43.375378 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 17:59:50.381946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 17:59:58.383775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:00:14.386279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:00:46.392351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:05:43.300633 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:05:43.300916 1.752243 tcp 10.0.2.105 51163 -> 128.255.183.224 9027 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:06:50.398301 3.001602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:06:57.405862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:07:05.407499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:07:21.410500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:07:53.416525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:12:12.368944 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:12:12.369051 0.379812 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:12.749314 0.392649 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:13.142431 0.645100 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:13.787966 0.321149 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:14.109521 0.426283 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:14.536396 0.434842 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:14.971645 0.316021 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:15.288101 0.383422 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:15.671938 0.329226 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:16.001513 0.401778 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:16.403719 0.307568 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:16.711720 0.408828 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:17.120974 0.430180 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:17.551554 0.459176 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:18.011147 0.366921 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:18.378476 0.275888 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:18.654773 0.364441 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:19.019622 0.409942 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:19.429954 0.462750 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:19.893125 0.285821 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:20.179355 0.416224 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:20.596040 0.471353 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:21.067832 0.323618 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:21.391934 0.577124 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:12:21.969484 0.302991 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:13:57.422530 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:14:04.429750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:14:12.431154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:14:28.434126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:15:00.440231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:21:04.447729 3.000217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:21:11.453996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:21:19.455213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:21:35.458099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:22:07.464257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:28:11.471280 3.000489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:28:18.477815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:28:26.479154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:28:42.482499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:29:14.488156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:35:18.494431 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:35:25.501935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:35:33.503013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:35:45.060449 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:35:45.060687 1.667246 tcp 10.0.2.105 51164 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:35:49.506030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:36:21.512070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:42:25.518729 3.001425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:42:32.525850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:42:35.610607 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 18:42:35.610859 0.390388 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:36.001642 0.320753 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:36.322752 0.386970 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:36.710081 0.602502 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:37.313056 0.417358 udp 10.0.2.105 7010 <-> 107.222.234.136 7310 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:37.730782 0.437237 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:38.168453 0.336584 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:38.505436 0.403044 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:38.908888 0.317798 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:39.227069 0.409723 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:39.637164 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 18:42:40.526959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:42:56.503222 0.561272 tcp 10.0.2.105 51165 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:42:56.530536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:42:57.064773 0.549684 tcp 10.0.2.105 51166 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:42:57.614776 1.161795 tcp 10.0.2.105 51167 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:42:58.777146 0.305256 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:59.082750 0.427168 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:59.510360 0.462304 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:42:59.973101 0.399602 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:00.373096 0.360065 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:00.733531 0.269972 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:01.003905 0.426462 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:01.430750 0.464485 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:01.895606 0.291536 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:02.187538 0.408475 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:02.596576 0.466834 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:03.063831 0.312104 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:03.376510 0.584704 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 18:43:03.961575 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 18:43:19.023612 0.566070 tcp 10.0.2.105 51168 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:43:19.589958 0.566350 tcp 10.0.2.105 51169 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:43:20.156608 1.119517 tcp 10.0.2.105 51170 -> 195.113.214.226 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/07 18:43:28.536229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:49:32.542169 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:49:39.549951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:49:47.551676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:50:03.554066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:50:35.560098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:56:39.566618 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 18:56:46.573556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:56:54.574943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:57:10.578289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 18:57:42.584061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:03:46.590058 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 19:03:53.597758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:04:01.599381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:04:17.601878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:04:49.608269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:05:46.731424 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:05:46.731526 1.686923 tcp 10.0.2.105 51171 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:10:53.614982 3.000890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 19:11:00.621634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:11:08.623510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:11:24.626518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:11:56.631933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:13:23.898630 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:13:23.898725 0.385847 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:13:24.284965 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:13:40.073468 0.562474 tcp 10.0.2.105 51172 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:13:40.636346 0.575466 tcp 10.0.2.105 51173 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:13:41.212081 1.171093 tcp 10.0.2.105 51174 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:13:42.383769 0.402185 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:13:42.786364 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:13:58.959103 0.560855 tcp 10.0.2.105 51175 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:13:59.520300 0.592355 tcp 10.0.2.105 51176 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:00.112910 1.166425 tcp 10.0.2.105 51177 -> 195.113.214.226 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:01.280041 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:14:17.075215 0.573006 tcp 10.0.2.105 51178 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:17.648606 0.606503 tcp 10.0.2.105 51179 -> 195.113.214.226 80 SRPA* 0 0 19 14661 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:18.255711 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:14:33.879307 0.562537 tcp 10.0.2.105 51180 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:34.442171 0.599937 tcp 10.0.2.105 51181 -> 195.113.214.226 80 SRPA* 0 0 20 14721 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:35.042736 0.572668 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:35.615794 0.000000 udp 10.0.2.105 7010 -> 75.20.135.31 3612 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:14:54.179105 0.578393 tcp 10.0.2.105 51182 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:54.757753 0.568184 tcp 10.0.2.105 51183 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:55.326216 1.160529 tcp 10.0.2.105 51184 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:14:56.487337 0.390213 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:56.877970 0.332907 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:57.211277 0.422731 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:57.634422 0.318293 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:57.953089 0.320930 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:58.274416 0.431371 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:58.706141 0.453666 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:59.160221 0.271480 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:59.432101 0.382688 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:14:59.815182 0.363763 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:00.179307 0.416963 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:00.596625 0.473927 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:01.070969 0.415014 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:01.486396 0.278978 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:01.765779 0.473161 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:02.239331 0.324516 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:02.564253 0.574212 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:03.238314 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:10.290880 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:19.113373 0.000000 udp 10.0.2.105 7010 -> 107.222.234.136 7310 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:23.720066 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:15:25.382325 0.000000 udp 10.0.2.105 7010 -> 75.20.135.31 3612 REQ 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:32.622703 0.389018 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:33.012337 0.395262 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:33.408220 0.592251 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:34.001078 0.384032 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:34.385736 0.432406 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:34.818839 0.329965 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:35.149391 0.320349 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:35.470328 0.303102 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:35.774003 0.441778 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:36.216381 0.285872 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:36.502808 0.389132 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:36.892561 0.456513 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:37.349565 0.359018 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:37.709153 0.417293 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:38.126995 0.745530 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 661 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:38.872987 0.288542 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 656 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:39.162227 0.451814 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:39.614520 0.325193 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:39.940163 0.586217 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:40.526885 0.472783 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:15:41.000422 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:47.614134 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:15:52.220669 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:15:55.866354 0.000000 udp 10.0.2.105 7010 -> 190.20.216.193 4906 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:03.196857 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:08.925398 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:15.084077 0.000000 udp 10.0.2.105 7010 -> 92.139.238.241 7556 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:19.720680 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:16:22.474586 0.000000 udp 10.0.2.105 7010 -> 114.134.95.210 6595 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:29.274769 0.000000 udp 10.0.2.105 7010 -> 175.138.241.7 6504 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:35.934055 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:42.924189 0.000000 udp 10.0.2.105 7010 -> 81.133.20.199 5500 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:47.720461 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:16:48.722152 0.000000 udp 10.0.2.105 7010 -> 190.237.82.209 1054 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:16:56.243273 0.000000 udp 10.0.2.105 7010 -> 78.180.21.114 3837 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:03.943868 0.000000 udp 10.0.2.105 7010 -> 5.99.80.147 7742 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:11.495431 0.384869 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:11.880300 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 228 flow=Background 1970/01/07 19:17:16.221922 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:17:19.967460 0.000000 udp 10.0.2.105 7010 -> 203.158.200.56 2991 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:26.096326 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:31.763861 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:39.485686 0.293951 udp 10.0.2.105 7010 <-> 79.227.164.183 2430 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:17:39.793948 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:44.221904 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:17:45.383632 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:51.612523 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 6439 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:17:59.634110 0.000000 udp 10.0.2.105 7010 -> 95.6.87.219 2670 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:00.638762 3.001396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 19:18:05.853573 0.392600 udp 10.0.2.105 7010 -> 74.189.7.236 8642 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:06.246173 0.000000 icmp 74.189.7.236 0x0303 -> 10.0.2.105 0xc221 URP 192 1 310 flow=Background 1970/01/07 19:18:07.645581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:18:10.720130 0.000231 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:18:13.734435 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 7946 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:15.648030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:18:21.786293 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 5701 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:27.774499 0.000000 udp 10.0.2.105 7010 -> 209.181.47.151 9631 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:31.649891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:18:33.472944 0.343028 udp 10.0.2.105 7010 -> 78.168.148.194 3484 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:33.815972 0.000000 icmp 78.168.148.194 0x0303 -> 10.0.2.105 0x9c0d URP 192 1 237 flow=Background 1970/01/07 19:18:38.229212 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:18:42.035469 0.000000 udp 10.0.2.105 7010 -> 178.134.181.25 7714 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:50.427394 0.000000 udp 10.0.2.105 7010 -> 124.43.207.76 7520 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:18:55.734961 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:02.684742 0.000000 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:03.656432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:19:07.221398 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:19:09.203992 0.000000 udp 10.0.2.105 7010 -> 117.199.198.238 5321 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:15.143136 0.000000 udp 10.0.2.105 7010 -> 75.74.238.49 1813 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:20.380016 0.000000 udp 10.0.2.105 7010 -> 219.147.23.206 1552 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:29.193430 0.273502 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:19:29.487209 0.000000 udp 10.0.2.105 7010 -> 115.93.240.19 1852 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:33.729028 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:19:37.094118 0.000000 udp 10.0.2.105 7010 -> 203.37.126.254 3921 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:42.532393 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:49.041542 0.000000 udp 10.0.2.105 7010 -> 150.101.228.14 5852 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:19:57.693798 0.000000 udp 10.0.2.105 7010 -> 24.234.120.184 3603 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:02.219996 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:20:05.765985 0.000000 udp 10.0.2.105 7010 -> 178.73.73.124 9413 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:14.608376 0.000000 udp 10.0.2.105 7010 -> 187.210.176.128 1703 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:23.280973 0.397542 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 701 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:20:23.706942 0.000000 udp 10.0.2.105 7010 -> 91.178.136.52 7972 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:28.227805 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:20:29.349735 0.000000 udp 10.0.2.105 7010 -> 86.98.80.71 7084 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:37.100823 0.000000 udp 10.0.2.105 7010 -> 64.218.98.57 2919 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:43.500481 0.000000 udp 10.0.2.105 7010 -> 198.254.136.166 1036 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:49.598711 0.000000 udp 10.0.2.105 7010 -> 24.67.86.194 2675 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:20:54.224749 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:20:57.720160 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:03.719212 0.000000 udp 10.0.2.105 7010 -> 99.100.164.78 5830 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:10.879592 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:18.700441 0.000000 udp 10.0.2.105 7010 -> 167.184.128.4 9845 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:23.227056 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:21:24.929582 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:31.559097 0.000000 udp 10.0.2.105 7010 -> 95.208.226.31 4257 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:37.146901 0.478094 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:21:37.676887 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:43.205480 0.000000 udp 10.0.2.105 7010 -> 81.159.5.77 5117 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:47.721665 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:21:49.845524 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:21:56.834946 0.000000 udp 10.0.2.105 7010 -> 95.225.106.19 1024 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:04.696568 0.000000 udp 10.0.2.105 7010 -> 203.174.60.101 7266 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:12.958404 0.000000 udp 10.0.2.105 7010 -> 67.87.59.243 1156 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:17.725025 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:22:20.179141 0.393617 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:22:20.735867 0.479083 udp 10.0.2.105 7010 <-> 186.88.169.140 3980 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:22:21.245313 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:26.608170 0.603779 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:22:27.366219 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:34.569502 0.000000 udp 10.0.2.105 7010 -> 82.52.9.199 1571 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:42.821692 0.397477 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:22:43.239317 0.000000 udp 10.0.2.105 7010 -> 80.179.7.22 1541 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:47.728513 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:22:49.551227 0.323064 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:22:49.899269 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:22:56.390869 0.000000 udp 10.0.2.105 7010 -> 125.114.81.245 9103 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:04.983358 0.000000 udp 10.0.2.105 7010 -> 175.143.110.170 4924 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:10.721989 0.000000 udp 10.0.2.105 7010 -> 182.169.80.213 9453 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:15.728211 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:23:18.522517 0.000000 udp 10.0.2.105 7010 -> 125.166.151.29 5257 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:26.874762 0.311083 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:23:27.196890 0.000000 udp 10.0.2.105 7010 -> 86.145.59.129 4956 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:34.936000 0.000000 udp 10.0.2.105 7010 -> 60.212.133.96 5531 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:39.723264 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:23:41.465580 0.000000 udp 10.0.2.105 7010 -> 108.18.182.232 2561 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:47.284504 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:23:52.301432 0.000000 udp 10.0.2.105 7010 -> 118.143.85.242 9798 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:00.653133 0.000000 udp 10.0.2.105 7010 -> 24.56.177.80 3264 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:05.219874 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:24:06.060970 0.000000 udp 10.0.2.105 7010 -> 141.129.1.98 6245 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:11.679285 0.000000 udp 10.0.2.105 7010 -> 79.14.70.76 7947 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:17.277295 0.000000 udp 10.0.2.105 7010 -> 145.236.208.155 2407 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:26.210359 0.521461 udp 10.0.2.105 7010 <-> 125.123.164.175 8601 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:26.752722 0.420508 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:27.191722 0.000000 udp 10.0.2.105 7010 -> 96.2.106.3 5859 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:30.726276 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:24:35.263184 0.316108 udp 10.0.2.105 7010 <-> 151.48.85.15 3186 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:35.588679 0.000000 udp 10.0.2.105 7010 -> 151.26.54.72 3494 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:44.556143 0.461208 udp 10.0.2.105 7010 <-> 99.47.65.110 7056 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:45.033471 0.313731 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 684 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:45.362963 0.000000 udp 10.0.2.105 7010 -> 58.11.136.47 7999 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:52.918328 0.395622 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:53.328139 0.402354 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:24:53.740342 0.573089 udp 10.0.2.105 7010 -> 113.30.88.193 9441 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:24:54.313431 0.000000 icmp 113.30.88.193 0x0303 -> 10.0.2.105 0xe124 URP 192 1 291 flow=Background 1970/01/07 19:24:57.725675 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:25:01.561143 0.000000 udp 10.0.2.105 7010 -> 24.242.97.81 6437 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:07.309556 0.000000 udp 10.0.2.105 7010 -> 180.183.42.186 8786 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:07.662253 3.001271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 19:25:13.498336 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:14.669372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:25:19.606815 0.386324 udp 10.0.2.105 7010 -> 88.204.167.83 3546 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:19.993139 0.000000 icmp 88.204.167.83 0x0303 -> 10.0.2.105 0xda0d URP 192 1 297 flow=Background 1970/01/07 19:25:22.671104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:25:24.223482 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:25:28.460024 0.000000 udp 10.0.2.105 7010 -> 218.187.86.28 7242 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:35.208985 0.000000 udp 10.0.2.105 7010 -> 76.169.174.66 9431 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:38.674136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:25:42.630136 0.000000 udp 10.0.2.105 7010 -> 210.87.21.170 3555 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:49.980257 0.000000 udp 10.0.2.105 7010 -> 74.103.112.182 6516 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:25:54.727177 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:25:57.701752 0.000000 udp 10.0.2.105 7010 -> 107.1.120.134 7352 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:05.222436 0.000000 udp 10.0.2.105 7010 -> 88.228.225.47 2670 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:10.680105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:26:14.124911 0.000000 udp 10.0.2.105 7010 -> 183.77.194.1 3356 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:18.721526 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:26:19.382669 0.000000 udp 10.0.2.105 7010 -> 94.39.219.132 9141 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:27.394049 0.481800 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:26:27.975276 0.000000 udp 10.0.2.105 7010 -> 190.118.180.104 3467 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:35.906873 0.000000 udp 10.0.2.105 7010 -> 85.29.177.143 3555 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:44.008175 0.341566 udp 10.0.2.105 7010 -> 83.59.7.163 8447 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:44.349741 0.000000 icmp 83.59.7.163 0x0303 -> 10.0.2.105 0xff20 URP 192 1 231 flow=Background 1970/01/07 19:26:48.725248 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:26:50.477975 0.000000 udp 10.0.2.105 7010 -> 201.243.7.31 3808 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:26:55.845424 0.520157 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:26:56.466359 0.000000 udp 10.0.2.105 7010 -> 190.42.99.207 3329 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:03.806363 0.000000 udp 10.0.2.105 7010 -> 109.155.171.147 2617 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:09.595349 0.000000 udp 10.0.2.105 7010 -> 95.227.97.136 4217 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:14.221428 0.000274 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:27:16.995878 0.000000 udp 10.0.2.105 7010 -> 125.77.203.10 3820 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:25.417695 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:31.676501 0.000000 udp 10.0.2.105 7010 -> 99.60.100.64 6761 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:40.098779 0.302713 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:27:40.499751 0.000000 udp 10.0.2.105 7010 -> 142.59.253.98 3441 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:27:44.725516 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:27:46.007057 0.312350 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:27:46.350244 1.420140 udp 10.0.2.105 7010 <-> 200.91.49.183 7399 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:27:47.809241 0.443150 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:27:48.340923 0.640237 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:32:14.686092 3.001895 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 19:32:21.693252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:32:29.695302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:32:45.698045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:33:17.704481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:35:48.421453 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:35:48.421615 1.805753 tcp 10.0.2.105 51185 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:39:21.710667 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 19:39:28.717401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:39:36.718875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:39:52.722065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:40:24.728444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:46:28.734173 3.001412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 19:46:35.741524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:46:43.743037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:46:59.745927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:47:31.751984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:53:35.757848 3.002059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 19:53:42.765695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:53:50.766741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:54:06.770294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:54:38.775887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 19:57:49.470404 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 19:57:49.470557 0.395895 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:49.866869 0.578936 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:50.446219 0.399071 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:50.845682 0.441218 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:51.287289 0.391937 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:51.679631 0.329957 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:52.010007 0.332805 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:52.343212 0.312483 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:52.656059 0.277728 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:52.934169 0.389027 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:53.323659 0.433278 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:53.757313 0.413777 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:54.171497 0.452295 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:54.624194 0.365880 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:54.990461 0.503697 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:55.494542 0.331073 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:55.825990 0.291799 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:56.118188 0.434344 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:56.553038 0.613791 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:57.167186 0.694140 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:57:57.861701 0.000000 udp 10.0.2.105 7010 -> 79.227.164.183 2430 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:58:15.119934 0.564859 tcp 10.0.2.105 51186 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:15.685044 0.575427 tcp 10.0.2.105 51187 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:16.260746 1.135824 tcp 10.0.2.105 51188 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:17.397148 0.282163 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:17.679708 0.393480 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:18.073578 0.499960 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:18.573901 0.399446 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:18.973743 0.000000 udp 10.0.2.105 7010 -> 186.88.169.140 3980 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:58:36.288811 0.578710 tcp 10.0.2.105 51189 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:36.867764 0.556675 tcp 10.0.2.105 51190 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:37.424747 1.152469 tcp 10.0.2.105 51191 -> 195.113.214.226 443 SRPA* 0 0 27 13152 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:38.578022 0.593124 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:39.171558 0.385028 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:39.556977 0.318622 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:39.875959 0.316549 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:58:40.192868 0.000000 udp 10.0.2.105 7010 -> 125.123.164.175 8601 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:58:57.519085 0.563510 tcp 10.0.2.105 51192 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:58.082826 0.582493 tcp 10.0.2.105 51193 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:58.665592 1.140266 tcp 10.0.2.105 51194 -> 195.113.214.226 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:58:59.806622 0.429594 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:00.236661 0.291581 udp 10.0.2.105 7010 <-> 151.48.85.15 3186 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:00.528648 0.000000 udp 10.0.2.105 7010 -> 99.47.65.110 7056 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:59:15.935841 0.558179 tcp 10.0.2.105 51195 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:59:16.494281 0.608630 tcp 10.0.2.105 51196 -> 195.113.214.226 80 SRPA* 0 0 19 14677 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:59:17.103566 0.325892 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:17.429787 0.414294 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:17.844498 0.395840 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:18.240685 0.477009 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:18.718078 0.525952 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:19.244407 0.296096 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:19.540859 0.311585 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:19.852849 0.000000 udp 10.0.2.105 7010 -> 200.91.49.183 7399 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 19:59:37.747317 0.548515 tcp 10.0.2.105 51197 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:59:38.296149 0.570307 tcp 10.0.2.105 51198 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:59:38.866772 1.141522 tcp 10.0.2.105 51199 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 19:59:40.009008 0.435357 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/07 19:59:40.444768 0.602457 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:00:42.782082 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 20:00:49.789221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:00:57.791162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:01:13.793666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:01:45.799848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:05:50.232219 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:05:50.232330 1.756874 tcp 10.0.2.105 51200 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:07:49.805939 3.001753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:07:56.813192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:08:04.814916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:08:20.817764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:08:52.824353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:14:56.830182 3.001636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:15:03.837470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:15:11.838914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:15:27.841940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:15:59.848102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:22:03.854655 3.000562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:22:10.861529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:22:18.862970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:22:34.866039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:23:06.871808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:29:10.878369 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:29:17.885704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:29:25.886770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:29:41.889849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:29:48.399653 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:29:48.399753 0.000000 udp 10.0.2.105 7010 -> 79.227.164.183 2430 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:30:07.067958 0.560628 tcp 10.0.2.105 51201 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:07.628938 0.556858 tcp 10.0.2.105 51202 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:08.186164 1.168187 tcp 10.0.2.105 51203 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:09.354937 0.000000 udp 10.0.2.105 7010 -> 186.88.169.140 3980 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:30:13.896753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:30:27.346457 0.558807 tcp 10.0.2.105 51204 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:27.905612 0.564764 tcp 10.0.2.105 51205 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:28.470309 1.150097 tcp 10.0.2.105 51206 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:29.620956 0.000000 udp 10.0.2.105 7010 -> 125.123.164.175 8601 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:30:45.172008 0.570600 tcp 10.0.2.105 51207 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:45.742899 0.571409 tcp 10.0.2.105 51208 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:46.314220 1.175407 tcp 10.0.2.105 51209 -> 195.113.214.226 443 SRPA* 0 0 24 14058 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:30:47.490311 0.000000 udp 10.0.2.105 7010 -> 99.47.65.110 7056 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:31:02.947527 0.565910 tcp 10.0.2.105 51210 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:03.513796 0.580920 tcp 10.0.2.105 51211 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:04.095006 1.144991 tcp 10.0.2.105 51212 -> 195.113.214.226 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:05.240759 0.000000 udp 10.0.2.105 7010 -> 200.91.49.183 7399 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:31:22.155249 0.562745 tcp 10.0.2.105 51213 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:22.718344 0.582369 tcp 10.0.2.105 51214 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:23.300966 1.156053 tcp 10.0.2.105 51215 -> 195.113.214.226 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:24.457743 0.387872 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:24.846023 0.631132 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:25.477575 0.608832 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:26.086847 0.326703 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:26.413962 0.388794 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:26.803168 0.416900 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:27.220551 0.321487 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:27.542470 0.268870 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:27.811727 0.312713 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:28.124860 0.370743 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:28.495978 0.414733 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:28.911060 0.473309 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:29.384794 0.423241 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:29.808413 0.366809 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:30.175663 0.280345 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:30.456386 0.324440 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:30.781249 0.470256 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:31.251885 0.406934 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:31.659244 0.477809 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:32.137575 0.578131 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:32.716055 0.291073 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:33.007491 1.059924 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:34.067833 0.383957 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:34.452214 0.497430 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:34.950045 0.594198 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:35.544660 0.381987 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:35.927056 0.316110 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:36.243594 0.308524 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:36.552556 0.000000 udp 10.0.2.105 7010 -> 151.48.85.15 3186 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 20:31:54.271700 0.568204 tcp 10.0.2.105 51216 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:54.840185 0.582393 tcp 10.0.2.105 51217 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:55.422427 1.145755 tcp 10.0.2.105 51218 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:31:56.568915 0.429441 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:56.998767 0.415274 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:57.414485 0.400244 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:57.815168 0.486404 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:58.302043 0.387352 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:58.689802 0.320248 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:59.010535 0.307102 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:59.318034 0.520095 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:31:59.838553 0.434990 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:32:00.273944 0.614439 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 20:35:51.992710 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 20:35:51.992824 1.811115 tcp 10.0.2.105 51219 -> 128.255.183.224 9027 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/01/07 20:36:17.903247 3.000416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 20:36:24.909117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:36:32.910971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:36:48.913797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:37:20.919674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:43:24.925720 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:43:31.933652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:43:39.934456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:43:55.938000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:44:27.944045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:50:31.949455 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:50:38.957238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:50:46.958780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:51:02.961773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:51:34.967753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:57:38.973851 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 20:57:45.981041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:57:53.982837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:58:09.985700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 20:58:41.991679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:02:01.428699 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:02:01.428813 0.000000 udp 10.0.2.105 7010 -> 151.48.85.15 3186 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 21:02:20.407930 0.571472 tcp 10.0.2.105 51220 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:02:20.979735 0.573985 tcp 10.0.2.105 51221 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:02:21.554023 1.377166 tcp 10.0.2.105 51222 -> 195.113.214.226 443 SRPA* 0 0 39 27985 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:02:22.931888 0.385728 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:23.318037 0.553029 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:23.871430 0.569968 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:24.441883 0.390482 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:24.832766 0.348126 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:25.181291 0.332754 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:25.514356 0.306381 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:25.821158 0.280083 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:26.101595 0.418498 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:26.520512 0.395491 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:26.916367 0.429764 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:27.346560 0.477499 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:27.824443 0.435728 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:28.260585 0.320351 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:28.581332 0.374531 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:28.956277 0.301516 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:29.258174 0.460405 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:29.719033 0.410904 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:30.130327 0.477657 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:30.608407 0.593091 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:31.201921 0.276023 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:31.478300 0.390454 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:31.869165 0.438513 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:32.308094 0.404098 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:32.712666 0.594801 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:33.307866 0.398134 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:33.706415 0.324098 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:34.030887 0.313275 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:34.344561 0.420261 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:34.765166 0.410122 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:35.175707 0.313258 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:35.489344 0.390488 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:35.880220 0.322862 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:36.203458 0.485197 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:36.689104 0.309216 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:36.998662 0.531165 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:37.530277 0.438093 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:02:37.968773 0.617079 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:04:45.998233 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 21:04:53.005225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:05:01.006521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:05:17.009924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:05:49.015785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:05:53.802896 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:05:53.802983 1.670458 tcp 10.0.2.105 51223 -> 128.255.183.224 9027 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:11:53.022101 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:12:00.029027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:12:08.030615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:12:24.033726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:12:56.039560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:19:00.045523 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:19:07.053020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:19:15.054764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:19:31.057397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:20:03.063860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:26:07.069866 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:26:14.077216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:26:22.078227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:26:38.081717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:27:10.087421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:32:47.042753 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:32:47.043020 0.389535 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:47.432944 0.428345 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:47.861689 0.359218 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:48.221310 0.394288 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:48.616027 0.315335 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:48.931764 0.279639 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:49.211800 0.333773 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:49.546011 0.327702 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:49.874054 0.406554 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:50.281008 0.407494 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:50.688870 0.465980 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:51.155241 0.474737 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:51.630379 0.419086 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:52.049860 0.337668 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:52.387884 0.366316 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:52.754563 0.408017 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:53.162911 0.290837 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:53.454151 0.464444 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:53.919010 0.473870 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:54.393266 0.579010 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:54.972653 0.270363 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:55.243393 0.384407 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:55.628205 0.818558 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:56.447156 0.387297 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:56.834863 0.327236 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:57.162463 0.591842 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:57.754705 0.411204 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:58.166290 0.310774 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:58.477467 0.424434 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:58.902281 0.403683 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:59.306333 0.317552 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:32:59.624303 0.384287 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:00.008976 0.311399 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:00.320781 0.304624 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:00.625841 0.478053 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:01.104243 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 21:33:14.094306 3.001247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:33:17.238139 0.552737 tcp 10.0.2.105 51224 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:33:17.791108 0.572506 tcp 10.0.2.105 51225 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:33:18.363941 1.366037 tcp 10.0.2.105 51226 -> 195.113.214.226 443 SRPA* 0 0 33 24973 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:33:19.730678 0.436592 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:20.167665 0.614993 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 21:33:21.630736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:33:29.633454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:33:45.636494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:34:17.642285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:35:55.723983 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 21:35:55.724085 1.876307 tcp 10.0.2.105 51227 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/07 21:40:21.648938 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:40:28.655418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:40:36.656943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:40:52.660672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:41:24.666263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:47:28.672937 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:47:35.679845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:47:43.681094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:47:59.684019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:48:31.690159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:54:35.695641 3.002043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 21:54:42.703693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:54:50.705348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:55:06.707903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 21:55:38.713999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:01:42.720001 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:01:49.727406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:01:57.729167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:02:13.731771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:02:45.737930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:03:50.111328 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:03:50.111425 0.522455 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:50.634313 0.388759 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:51.023451 0.605432 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:51.629233 0.320966 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:51.950583 0.479610 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:52.430627 0.388273 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:52.819261 0.318112 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:53.137770 0.272718 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:53.410884 0.321832 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:53.733086 0.380192 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:54.113641 0.426797 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:54.540791 0.408854 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:54.950049 0.433730 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:55.384193 0.469030 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:55.853584 0.317884 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:56.171837 0.363240 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:56.535483 0.301497 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:56.837333 0.398470 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:57.236196 0.472074 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:57.708687 0.584688 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:58.293763 0.460732 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:58.754890 0.275382 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:59.030612 0.390248 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:59.421264 0.391757 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:03:59.813416 0.993890 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:00.807705 0.312400 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:01.120670 0.625944 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:01.746952 0.382036 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:02.129412 0.419218 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:02.549054 0.312979 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:02.862429 0.313144 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:03.175994 0.403036 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:03.579453 0.378362 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:03.958174 0.295156 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:04.253713 0.329321 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:04.583367 0.477914 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:05.061664 0.443428 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:04:05.505463 0.634553 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:05:57.604555 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:05:57.604658 1.686981 tcp 10.0.2.105 51228 -> 128.255.183.224 9027 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:08:49.744358 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 22:08:56.751213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:09:04.752871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:09:20.755980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:09:52.762331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:15:56.768045 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:16:03.775844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:16:11.777421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:16:27.779903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:16:59.786041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:23:03.792047 3.001864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:23:10.799576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:23:18.801267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:23:34.804471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:24:06.810485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:30:10.816090 3.001789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:30:17.823616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:30:25.824898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:30:41.828130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:31:13.833781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:34:28.554652 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:34:28.554842 0.515578 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:29.070825 0.383540 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:29.454721 0.399697 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:29.854775 0.312596 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:30.167739 0.308838 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:30.476941 0.482390 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:30.959773 0.389200 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:31.349395 0.289380 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:31.639136 0.329855 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:31.969402 0.387074 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:32.356866 0.441479 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:32.798733 0.413806 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:33.212954 0.464168 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:33.677533 0.467351 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:34.145227 0.316640 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:34.462310 0.403980 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:34.866710 0.368415 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:35.235462 0.303786 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:35.539645 0.479207 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:36.019245 0.581022 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:36.600638 0.470152 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:37.071183 0.284274 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:37.355878 0.395787 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:37.752051 0.382208 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:38.134620 0.649343 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:38.784366 0.317880 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:39.102606 0.601956 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:39.704969 0.395461 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:40.100825 0.419394 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:40.520643 0.314923 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:40.835969 0.463643 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:41.299988 0.298101 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:41.598485 0.406249 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:42.005084 0.384529 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:42.390018 0.326733 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:42.717112 0.483673 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:43.201264 0.447446 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:34:43.649098 0.600983 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/07 22:35:59.294824 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 22:35:59.295041 2.684280 tcp 10.0.2.105 51229 -> 128.255.183.224 9027 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/01/07 22:37:17.840765 3.000862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 22:37:24.847720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:37:32.849263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:37:48.851679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:38:20.858196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:44:24.863487 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:44:31.871399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:44:39.873032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:44:55.875578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:45:27.882203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:51:31.888446 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:51:38.895293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:51:46.897220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:52:02.900257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:52:34.905585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:58:38.912328 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 22:58:45.919653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:58:53.920927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:59:09.924019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 22:59:41.929730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:04:58.375559 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:04:58.375758 0.525210 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:04:58.901342 0.310412 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:04:59.212141 0.397897 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:04:59.610411 0.395261 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:00.006059 0.398202 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:00.404647 0.320484 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:00.725504 0.420908 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:01.146790 0.304364 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:01.451498 0.334677 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:01.786605 0.380923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:02.167957 0.405369 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:02.573670 0.400935 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:02.974955 0.424807 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:03.400158 0.469948 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:03.870521 0.320871 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:04.191801 0.405387 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:04.597593 0.368414 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:04.966394 0.284339 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:05.251092 0.599549 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:05.851043 0.592038 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:06.443453 0.452629 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:06.896509 0.287041 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:07.183956 0.602593 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:07.786965 0.400262 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:08.187636 0.537932 udp 10.0.2.105 7010 <-> 5.234.91.45 9005 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:08.725918 0.320205 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:09.046523 0.593081 udp 10.0.2.105 7010 <-> 49.144.94.77 2222 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:09.639942 0.389969 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:10.030245 0.426601 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:10.457282 0.317448 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:10.775140 0.312240 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:11.087722 0.391828 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:11.479961 0.303224 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:11.783582 0.400488 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:12.184666 0.315365 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:12.500471 0.477110 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:12.977933 0.436646 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:13.414924 0.583540 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:05:45.936116 3.001286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:05:52.943209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:06:00.944841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:06:01.987089 0.000221 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:06:01.987421 1.655229 tcp 10.0.2.105 51230 -> 128.255.183.224 9027 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:06:16.947601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:06:48.953794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:12:52.960026 3.001634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:12:59.967466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:13:07.968725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:13:23.971857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:13:55.978181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:19:59.984343 3.001122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:20:06.991149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:20:14.993069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:20:30.995731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:21:03.001975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:27:07.007781 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:27:14.015565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:27:22.016415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:27:38.020002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:28:10.025560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:34:14.031989 3.001305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:34:21.039192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:34:29.040604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:34:45.043779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:35:17.049737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:35:37.990186 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/07 23:35:37.990376 0.525943 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:38.516688 0.321900 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:38.838992 0.387532 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:39.226879 0.390352 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:39.617643 0.404781 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:40.022802 0.392630 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:40.415780 0.412224 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:40.828500 0.273466 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:41.102310 0.329299 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:41.431998 0.370024 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:41.802393 0.430774 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:42.233525 0.406127 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:42.639997 0.410887 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:43.051215 0.467103 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:43.518708 0.344091 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:43.863174 0.292039 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:44.155571 0.402561 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:44.558480 0.366645 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:44.925495 0.548636 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:45.474521 0.621949 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:46.096910 0.474650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:46.571976 0.278308 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:46.850625 0.412064 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:47.263053 0.386539 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:35:47.649975 0.000000 udp 10.0.2.105 7010 -> 5.234.91.45 9005 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 23:36:03.647449 1.983614 tcp 10.0.2.105 51231 -> 128.255.183.224 9027 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:04.120533 0.578145 tcp 10.0.2.105 51232 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:04.698921 0.609687 tcp 10.0.2.105 51233 -> 195.113.214.226 80 SRPA* 0 0 18 13358 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:05.309284 0.326169 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:05.635757 0.000000 udp 10.0.2.105 7010 -> 49.144.94.77 2222 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/07 23:36:23.135962 0.560166 tcp 10.0.2.105 51234 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:23.696429 0.565925 tcp 10.0.2.105 51235 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:24.262621 1.451150 tcp 10.0.2.105 51236 -> 195.113.214.226 443 SRPA* 0 0 35 24871 flow=From-Botnet-V2-TCP-Established 1970/01/07 23:36:25.714488 0.495868 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:26.210761 0.421585 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:26.632704 0.330720 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:26.963819 0.325808 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:27.290062 0.399882 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:27.690319 0.395845 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:28.086564 0.310498 udp 10.0.2.105 7010 <-> 82.211.131.43 2029 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:28.397383 0.394510 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:28.792404 0.487592 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:29.280424 0.435524 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:36:29.716505 0.615646 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/07 23:41:21.056757 3.000501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/07 23:41:28.063003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:41:36.064431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:41:52.067285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:42:24.073344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:48:28.080346 3.001128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:48:35.086959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:48:43.088517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:48:59.091262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:49:31.097576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:55:35.104473 3.000572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/07 23:55:42.111307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:55:50.112831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:56:06.115328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/07 23:56:38.121623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:02:42.127365 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:02:49.134660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:02:57.136664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:03:13.139571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:03:45.146184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:06:05.637990 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:06:05.638144 1.840730 tcp 10.0.2.105 51237 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:06:34.539535 0.000000 udp 10.0.2.105 7010 -> 5.234.91.45 9005 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:06:39.475950 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:06:53.538630 0.567339 tcp 10.0.2.105 51238 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:06:54.106225 0.566399 tcp 10.0.2.105 51239 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:06:54.672933 1.153094 tcp 10.0.2.105 51240 -> 195.113.214.226 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:06:55.826700 0.000000 udp 10.0.2.105 7010 -> 49.144.94.77 2222 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:07:13.937384 0.560693 tcp 10.0.2.105 51241 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:14.498392 0.570801 tcp 10.0.2.105 51242 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:15.069416 1.178713 tcp 10.0.2.105 51243 -> 195.113.214.226 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:16.248865 0.313705 udp 10.0.2.105 7010 <-> 109.158.132.143 6090 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:16.562930 0.520367 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:17.083698 0.392341 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:17.476579 0.392512 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:17.869431 0.269457 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:18.139289 0.273822 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:18.413465 0.331744 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:18.745615 0.393479 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:19.139484 0.413805 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:19.553650 0.368935 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:19.922964 0.331280 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:20.254649 0.409021 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:20.664087 0.418476 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:21.082975 0.464072 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:21.547400 0.292329 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:21.840092 0.326543 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:22.166970 0.407282 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:22.574649 0.403271 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:22.978325 0.498292 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:23.477007 0.622956 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:24.197083 0.273741 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:24.471256 0.383013 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:24.854684 0.466604 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:25.321660 0.382291 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:25.704394 0.313362 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:26.018166 0.408685 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:26.427256 0.433346 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:26.861004 0.000000 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:07:42.998782 0.581985 tcp 10.0.2.105 51244 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:43.581130 0.568688 tcp 10.0.2.105 51245 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:44.150126 1.170093 tcp 10.0.2.105 51246 -> 195.113.214.226 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:07:45.320793 0.304305 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:45.625460 0.397471 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:46.023342 0.387702 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:46.411445 0.491394 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:07:46.903273 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:08:04.229343 0.584571 tcp 10.0.2.105 51247 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:08:04.813813 0.581676 tcp 10.0.2.105 51248 -> 195.113.214.226 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:08:05.395793 1.179685 tcp 10.0.2.105 51249 -> 195.113.214.226 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:08:06.576046 0.322808 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:08:06.899213 0.444853 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:08:07.344510 0.906072 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:09:49.152186 3.000927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 00:09:56.158946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:10:04.160188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:10:20.163352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:10:52.169591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:16:56.176387 3.001226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:17:03.182975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:17:11.184102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:17:27.187253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:17:59.193450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:24:03.199339 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:24:10.207038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:24:18.208452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:24:34.211312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:25:06.217537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:31:10.224411 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:31:17.230924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:31:25.232064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:31:41.235743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:32:13.241733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:36:07.478586 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:36:07.478793 2.411530 tcp 10.0.2.105 51250 -> 128.255.183.224 9027 FSPA* 0 0 14 1514 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:38:17.247254 3.002124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:38:24.254930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:38:27.210029 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 00:38:27.210222 0.332136 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:38:27.542724 0.000000 udp 10.0.2.105 7010 -> 82.211.131.43 2029 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:38:32.256157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:38:45.207731 0.573161 tcp 10.0.2.105 51251 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:38:45.781255 0.556561 tcp 10.0.2.105 51252 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:38:46.337631 1.166183 tcp 10.0.2.105 51253 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:38:47.505032 0.000000 udp 10.0.2.105 7010 -> 109.158.132.143 6090 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 00:38:48.259310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:39:05.134695 0.575731 tcp 10.0.2.105 51254 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:39:05.710699 0.561306 tcp 10.0.2.105 51255 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:39:06.272335 1.157182 tcp 10.0.2.105 51256 -> 195.113.214.226 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/08 00:39:07.430214 0.520485 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:07.951096 0.391095 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:08.342533 0.391533 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:08.734409 0.652516 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:09.387296 0.271856 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:09.659532 0.322051 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:09.981992 0.392469 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:10.374917 0.394839 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:10.770159 0.434051 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:11.204642 0.328799 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:11.533821 0.411460 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:11.945651 0.409291 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:12.355280 0.490799 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:12.846516 0.329243 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:13.176157 0.293461 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:13.469945 0.422500 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:13.892876 0.369219 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:14.262478 0.484883 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:14.747814 0.590775 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:15.338979 0.421206 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:15.760745 0.274038 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:16.035215 0.461995 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:16.497568 0.388820 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:16.886729 0.321748 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:17.208894 0.434677 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:17.643919 0.389568 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:18.033907 0.315227 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:18.349465 0.398571 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:18.748549 0.474845 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:19.223865 0.395919 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:19.620125 0.324423 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:19.944959 0.434929 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:39:20.265260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:39:20.380430 0.607609 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 00:45:24.271512 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:45:31.278602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:45:39.280708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:45:55.283365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:46:27.289711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:52:31.295199 3.002008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:52:38.302684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:52:46.304355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:53:02.306948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:53:34.313194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:59:38.319553 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 00:59:45.327088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 00:59:53.328567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:00:09.331631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:00:41.337517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:06:09.889887 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:06:09.889988 1.793557 tcp 10.0.2.105 51257 -> 128.255.183.224 9027 FSPA* 0 0 14 1728 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:06:45.343693 3.001113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:06:52.350359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:07:00.351886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:07:16.355042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:07:48.361466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:09:42.435321 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:09:42.435419 0.000000 udp 10.0.2.105 7010 -> 109.158.132.143 6090 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 01:09:59.693036 0.571869 tcp 10.0.2.105 51258 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:00.265212 0.572545 tcp 10.0.2.105 51259 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:00.837570 1.156639 tcp 10.0.2.105 51260 -> 195.113.214.226 443 SRPA* 0 0 24 13394 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:01.994912 0.317699 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:02.313012 0.534206 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:02.989056 0.398108 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:03.387541 0.381722 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:03.769662 0.624111 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:04.394189 0.288409 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:04.682954 0.311698 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:04.995074 0.398202 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:05.393690 0.378877 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:05.772968 0.430869 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:06.204240 0.418683 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:06.623289 0.314342 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:06.938087 0.405912 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:07.344391 0.463748 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:07.808492 0.332365 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:08.141240 0.283855 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:08.425515 0.610721 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:09.036604 0.376690 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:09.413832 0.463624 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:09.877870 0.585186 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:10.463452 0.390975 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:10.854794 0.286203 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:11.141398 0.312272 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:11.454080 0.472016 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:11.926495 0.397077 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:12.323933 0.000000 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 01:10:31.046853 0.574692 tcp 10.0.2.105 51261 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:31.621401 0.567097 tcp 10.0.2.105 51262 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:32.188763 1.173741 tcp 10.0.2.105 51263 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:10:33.363212 0.393910 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:33.757518 0.344039 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:34.101960 0.414181 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:34.516692 0.481127 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:34.998188 0.430899 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:35.429487 0.394252 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:35.824097 0.311197 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:10:36.135703 0.610719 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:13:52.367096 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 01:13:59.374339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:14:07.376226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:14:23.379380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:14:55.385041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:20:59.391442 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:21:06.398801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:21:14.400008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:21:30.403227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:22:02.408912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:28:06.415683 3.001159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:28:13.422775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:28:21.424382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:28:37.427429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:29:09.432855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:35:13.439326 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:35:20.446268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:35:28.448059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:35:44.451294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:36:11.690733 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:36:11.690854 1.895619 tcp 10.0.2.105 51264 -> 128.255.183.224 9027 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:36:16.457568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:41:03.760705 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 01:41:03.760814 0.430553 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:04.191769 0.322797 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:04.514937 0.523463 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:05.038740 0.396817 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:05.435938 0.383880 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:05.820192 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 01:41:21.368206 0.575321 tcp 10.0.2.105 51265 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:41:21.943814 0.562275 tcp 10.0.2.105 51266 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:41:22.506371 1.172396 tcp 10.0.2.105 51267 -> 195.113.214.226 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 01:41:23.679536 0.276806 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:23.956749 0.580044 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:24.537208 0.420904 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:24.958517 0.392409 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:25.351321 0.395884 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:25.747574 0.420843 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:26.281015 0.416438 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:26.697831 0.310950 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:27.009181 0.461041 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:27.470605 0.328340 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:27.799322 0.411436 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:28.211160 0.297950 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:28.509515 0.366829 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:28.876742 0.485102 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:29.362202 0.621781 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:29.984366 0.390668 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:30.375424 0.271358 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:30.647183 0.471574 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:31.119192 0.331242 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:31.450836 0.404254 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:31.855514 0.381722 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:32.237681 0.307672 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:32.545756 0.402300 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:32.948484 0.481739 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:33.430587 0.299553 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:33.730503 0.445123 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:34.176041 0.394629 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:41:34.571050 0.624447 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 01:42:20.462993 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 01:42:27.470471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:42:35.471899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:42:51.475475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:43:23.481077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:49:27.487761 3.000861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:49:34.494901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:49:42.496452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:50:03.002486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:50:36.275029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:56:36.614285 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 01:56:43.621658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:56:51.623335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:57:07.626309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 01:57:39.631916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:03:43.637889 3.002490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:03:50.645123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:03:58.647106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:04:14.650083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:04:46.655972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:06:15.674619 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:06:15.674842 1.730512 tcp 10.0.2.105 51268 -> 128.255.183.224 9027 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:10:50.661441 3.002356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:10:57.669655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:11:05.671206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:11:21.673828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:11:53.679799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:11:54.752156 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:11:54.752407 0.318993 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:11:55.071838 0.425714 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:11:55.497932 0.319565 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:11:55.817946 0.532313 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:11:56.350688 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 02:12:12.349195 0.571948 tcp 10.0.2.105 51269 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:12:12.921487 0.585166 tcp 10.0.2.105 51270 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:12:13.506525 1.257064 tcp 10.0.2.105 51271 -> 195.113.214.226 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:12:14.764515 0.391608 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:15.156506 0.289522 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:15.446438 0.305458 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:15.752322 0.427862 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:16.180755 0.377235 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:16.558395 0.397579 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:16.956436 0.420433 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:17.377304 0.450945 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:17.828661 0.320343 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:18.149375 0.402785 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:18.552594 0.463678 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:19.016702 0.321592 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:19.429249 0.289634 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:19.719252 0.384185 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:20.103784 0.479878 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:20.584025 0.583417 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:21.167898 0.785905 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:21.954232 0.281152 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:22.235744 0.453546 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:22.689688 0.398790 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:23.088870 0.327261 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:23.416649 0.388947 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:23.806015 0.312109 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:24.118532 0.401345 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:24.520387 0.436533 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:24.957290 0.473984 udp 10.0.2.105 7010 <-> 161.200.34.32 5040 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:25.431693 0.315446 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:25.747531 0.397531 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:12:26.145448 0.746739 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:17:57.686746 3.000999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:18:04.693212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:18:12.694597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:18:28.697932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:19:00.704118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:25:04.710551 3.000974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:25:11.717710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:25:19.719044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:25:35.721956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:26:07.728077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:32:11.733542 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:32:18.741187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:32:26.742952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:32:42.745917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:33:14.751910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:36:17.404976 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:36:17.405208 1.652867 tcp 10.0.2.105 51272 -> 128.255.183.224 9027 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:39:18.758476 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:39:25.765360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:39:33.766890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:39:49.780128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:40:21.786298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:42:40.315693 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 02:42:40.315948 0.408068 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:40.724413 0.325005 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:41.049823 0.310123 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:41.360316 0.462796 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:41.823500 0.528645 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:42.352682 0.381375 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:42.734471 0.268260 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:43.003099 0.534976 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:43.538493 0.426729 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:43.965650 0.424198 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:44.390270 0.397539 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:44.788381 0.391154 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:45.179970 0.408669 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:45.589056 0.331659 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:45.921140 0.409540 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:46.331097 0.462457 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:46.793991 0.321901 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:47.116487 0.279548 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:47.396388 0.905946 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:48.302767 0.461726 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:48.764895 0.578780 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:49.344113 0.394879 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:49.739410 0.273786 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:50.013618 0.470662 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:50.484714 0.393190 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:50.878334 0.320559 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:51.199247 0.380429 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:51.580054 0.327863 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:51.908357 0.409564 udp 10.0.2.105 7010 <-> 24.183.211.41 9826 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:52.318332 0.437787 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:52.756708 0.441104 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:42:53.198162 0.000000 udp 10.0.2.105 7010 -> 161.200.34.32 5040 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 02:43:09.350014 0.569901 tcp 10.0.2.105 51273 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:43:09.920212 0.585604 tcp 10.0.2.105 51274 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:43:10.505751 1.220637 tcp 10.0.2.105 51275 -> 195.113.214.226 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/08 02:43:11.727071 0.309753 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:43:12.037247 0.622832 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 02:46:25.791493 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 02:46:32.799618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:46:40.800410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:46:56.803548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:47:28.809467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:53:32.816549 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 02:53:39.823360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:53:47.824596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:54:03.827710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 02:54:35.833640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:00:39.839602 3.002156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 03:00:46.847394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:00:54.848703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:01:10.851801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:01:42.857747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:06:19.065461 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:06:19.065696 1.691174 tcp 10.0.2.105 51276 -> 128.255.183.224 9027 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:07:46.864092 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 03:07:53.870997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:08:01.872989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:08:17.876044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:08:49.881814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:13:34.911846 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:13:34.912046 0.000000 udp 10.0.2.105 7010 -> 161.200.34.32 5040 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:13:50.426349 0.572751 tcp 10.0.2.105 51277 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:13:50.999379 0.564497 tcp 10.0.2.105 51278 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:13:51.564161 1.166796 tcp 10.0.2.105 51279 -> 195.113.214.226 443 SRPA* 0 0 25 14908 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:13:52.731695 0.401367 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:13:53.133426 0.410852 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:13:53.544649 0.324970 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:13:53.870060 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:14:09.853111 0.584533 tcp 10.0.2.105 51280 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:10.437955 0.568241 tcp 10.0.2.105 51281 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:11.006069 1.213824 tcp 10.0.2.105 51282 -> 195.113.214.226 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:12.218718 0.510009 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:12.729141 0.390290 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:13.119848 0.273917 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:13.394178 0.422807 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:13.817389 0.857426 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:14.675304 0.402887 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:14.675654 2.717043 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 SPA_* 0 0 25 9814 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:15.078574 0.411485 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:15.490448 0.376408 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:15.867301 0.318281 udp 10.0.2.105 7010 <-> 217.39.56.28 1252 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:16.185999 0.417344 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:16.603774 0.413774 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:17.017992 0.293619 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:17.312047 0.336316 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:17.648783 0.465434 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:18.114636 0.483296 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:18.598322 0.614925 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:19.213616 0.594158 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:19.808201 1.027519 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:20.689108 4.006598 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 14 6468 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:20.836134 0.389283 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:21.225837 0.334900 udp 10.0.2.105 7010 <-> 217.41.11.145 5388 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:21.561181 0.379248 udp 10.0.2.105 7010 <-> 184.149.30.4 3821 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:21.940863 0.457438 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:22.398672 0.297761 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:22.696852 0.382373 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:23.079678 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:14:30.803191 0.399004 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 4 1644 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:36.627354 0.403058 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 4 1644 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:38.264237 0.569747 tcp 10.0.2.105 51284 -> 195.113.214.251 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:38.833908 0.588710 tcp 10.0.2.105 51285 -> 195.113.214.226 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:39.422881 1.167683 tcp 10.0.2.105 51286 -> 195.113.214.226 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:14:40.591301 0.401273 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:40.993031 0.444742 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:41.438168 0.326505 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:41.765079 0.651400 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 03:14:53.887661 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 03:14:54.983077 4.385037 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:00.146730 4.891610 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 9 4154 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:00.894872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:15:03.549187 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:15:05.240991 4.817282 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 3 686 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:08.896672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:15:10.589748 4.589213 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:15.890239 4.612814 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:24.900032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:15:30.184503 4.088386 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 24 9680 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:35.054040 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:15:35.716859 4.493928 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:41.779622 0.204813 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 2 620 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:50.939555 4.513772 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 4 1800 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:56.025091 4.744759 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:15:56.905585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:16:00.049844 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:16:03.028073 4.672871 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:16:08.313304 2.873096 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 6 1896 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:16:15.588589 3.579053 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:16:48.970179 0.000149 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:18:48.972690 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:18:48.972812 0.000000 tcp 10.0.2.105 51283 -> 84.59.151.27 3285 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/08 03:22:00.912270 3.001187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 03:22:07.919183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:22:15.920358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:22:31.923887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:23:03.929882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:29:07.935645 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 03:29:14.943278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:29:22.944580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:29:38.947714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:30:10.953754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:36:14.960485 3.000945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 03:36:20.756190 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:36:20.756406 3.003245 tcp 10.0.2.105 51287 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:36:21.967128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:36:29.757930 0.000000 tcp 10.0.2.105 51287 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:36:29.968690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:36:35.758871 3.002507 tcp 10.0.2.105 51288 -> 195.113.214.251 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:36:36.555626 3.998380 udp 10.0.2.105 55321 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:36.694181 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 104 flow=Background 1970/01/08 03:36:37.549323 3.004798 udp 10.0.2.105 55321 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:44.559565 0.000000 udp 10.0.2.105 55321 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:44.559669 0.000000 udp 10.0.2.105 55321 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:44.759923 0.000000 tcp 10.0.2.105 51288 -> 195.113.214.251 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:36:45.550916 3.780088 arp 10.0.2.105 who 10.0.2.2 CON 6 252 flow=Background-ARP 1970/01/08 03:36:45.971281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:36:51.549904 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:36:55.799924 4.001821 udp 10.0.2.105 56543 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:56.797404 3.004490 udp 10.0.2.105 56543 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:36:57.806136 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:37:03.807046 0.000000 udp 10.0.2.105 56543 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:03.807182 0.086901 udp 10.0.2.105 56543 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:03.894083 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:37:07.812765 1.502278 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:09.225522 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:37:10.066581 3.004108 tcp 10.0.2.105 51289 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:37:17.977488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:37:19.069009 0.000000 tcp 10.0.2.105 51289 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:37:25.068501 3.003995 tcp 10.0.2.105 51290 -> 195.113.214.219 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:37:26.552833 4.002803 udp 10.0.2.105 65127 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:27.551475 3.525002 udp 10.0.2.105 65127 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:28.069756 3.006721 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 2 208 flow=Background 1970/01/08 03:37:33.049489 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:37:34.070503 0.000000 tcp 10.0.2.105 51290 -> 195.113.214.219 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:37:34.561022 0.000000 udp 10.0.2.105 65127 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:34.561149 0.000000 udp 10.0.2.105 65127 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:38.566873 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:37:45.080121 4.001997 udp 10.0.2.105 59254 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:46.078140 3.158978 udp 10.0.2.105 59254 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:49.237118 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:37:53.088038 0.000000 udp 10.0.2.105 59254 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:53.088161 0.000000 udp 10.0.2.105 59254 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:57.094260 1.501906 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:37:59.347355 3.003616 tcp 10.0.2.105 51291 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:38:04.054036 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:38:08.349948 0.000000 tcp 10.0.2.105 51291 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:38:14.349609 3.003221 tcp 10.0.2.105 51292 -> 195.113.214.222 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:38:21.550958 4.003397 udp 10.0.2.105 58146 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:22.550036 3.004426 udp 10.0.2.105 58146 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:23.351512 0.000000 tcp 10.0.2.105 51292 -> 195.113.214.222 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:38:28.058414 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:38:29.560394 0.000000 udp 10.0.2.105 58146 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:29.560496 0.000000 udp 10.0.2.105 58146 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:33.566289 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:38:34.361082 4.002319 udp 10.0.2.105 49341 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:35.358892 3.004622 udp 10.0.2.105 49341 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:36.540792 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:38:42.369006 0.000000 udp 10.0.2.105 49341 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:42.369105 0.212616 udp 10.0.2.105 49341 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:42.581721 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:38:46.374806 1.502375 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:38:48.628784 3.003177 tcp 10.0.2.105 51293 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:38:57.631008 0.000000 tcp 10.0.2.105 51293 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:39:02.558155 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:39:03.630560 3.002825 tcp 10.0.2.105 51294 -> 195.113.214.226 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:39:11.542945 4.003636 udp 10.0.2.105 61508 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:11.777537 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 104 flow=Background 1970/01/08 03:39:12.542274 3.004434 udp 10.0.2.105 61508 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:12.632508 0.000000 tcp 10.0.2.105 51294 -> 195.113.214.226 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:39:19.552423 0.000000 udp 10.0.2.105 61508 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:19.552555 0.000000 udp 10.0.2.105 61508 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:23.557837 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:39:23.641365 4.003010 udp 10.0.2.105 58682 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:23.878502 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:39:24.639608 3.004889 udp 10.0.2.105 58682 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:31.649589 0.000000 udp 10.0.2.105 58682 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:31.649703 0.000000 udp 10.0.2.105 58682 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:35.655812 1.502103 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:39:37.909309 3.003644 tcp 10.0.2.105 51295 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:39:46.911649 0.000000 tcp 10.0.2.105 51295 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:39:51.558175 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:39:52.911825 3.002768 tcp 10.0.2.105 51296 -> 195.113.214.211 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:40:01.913094 0.000000 tcp 10.0.2.105 51296 -> 195.113.214.211 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:40:06.552842 4.002930 udp 10.0.2.105 57300 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:07.551143 3.762815 udp 10.0.2.105 57300 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:08.308967 3.004991 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 2 208 flow=Background 1970/01/08 03:40:12.922612 4.002291 udp 10.0.2.105 61215 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:13.920699 3.437918 udp 10.0.2.105 61215 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:14.561656 0.000000 udp 10.0.2.105 57300 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:14.561793 0.000000 udp 10.0.2.105 57300 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:15.553094 3.014566 arp 10.0.2.105 who 10.0.2.2 CON 4 168 flow=Background-ARP 1970/01/08 03:40:17.358617 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:40:20.930834 0.000000 udp 10.0.2.105 61215 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:20.930951 0.000000 udp 10.0.2.105 61215 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:24.936427 1.501714 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:40:27.189695 3.004372 tcp 10.0.2.105 51297 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:40:36.192687 0.000000 tcp 10.0.2.105 51297 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:40:42.191800 3.003748 tcp 10.0.2.105 51298 -> 195.113.214.237 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:40:47.058248 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:40:51.193823 0.000000 tcp 10.0.2.105 51298 -> 195.113.214.237 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:41:01.550927 4.003457 udp 10.0.2.105 51116 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:02.203555 4.002380 udp 10.0.2.105 63031 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:02.550322 3.004175 udp 10.0.2.105 51116 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:03.201509 3.004566 udp 10.0.2.105 63031 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:03.584543 0.001370 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 2 204 flow=Background 1970/01/08 03:41:09.560355 0.000000 udp 10.0.2.105 51116 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:09.560463 0.097490 udp 10.0.2.105 51116 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:09.657953 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 104 flow=Background 1970/01/08 03:41:10.211102 0.000000 udp 10.0.2.105 63031 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:10.211227 0.000000 udp 10.0.2.105 63031 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:11.052393 2.513931 arp 10.0.2.105 who 10.0.2.2 CON 4 168 flow=Background-ARP 1970/01/08 03:41:14.217460 1.501740 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:16.471021 3.003816 tcp 10.0.2.105 51299 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:41:25.473244 0.000000 tcp 10.0.2.105 51299 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:41:31.472845 2.993093 tcp 10.0.2.105 51300 -> 195.113.214.215 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:41:39.053014 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:41:40.474909 0.000000 tcp 10.0.2.105 51300 -> 195.113.214.215 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:41:51.484450 4.001717 udp 10.0.2.105 65494 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:51.544061 4.002445 udp 10.0.2.105 59853 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:52.482692 3.003601 udp 10.0.2.105 65494 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:52.542113 3.004516 udp 10.0.2.105 59853 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:59.492628 0.000000 udp 10.0.2.105 65494 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:59.492760 0.000000 udp 10.0.2.105 65494 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:59.552074 0.000000 udp 10.0.2.105 59853 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:41:59.552209 0.000000 udp 10.0.2.105 59853 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:03.498532 1.501469 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:03.558047 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:42:05.751653 3.004064 tcp 10.0.2.105 51301 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:42:14.754104 0.000000 tcp 10.0.2.105 51301 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:42:20.753768 2.993193 tcp 10.0.2.105 51302 -> 195.113.214.249 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:42:28.553937 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:42:29.755620 0.000000 tcp 10.0.2.105 51302 -> 195.113.214.249 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:42:36.548296 4.003230 udp 10.0.2.105 55196 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:37.546848 3.004808 udp 10.0.2.105 55196 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:39.470184 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 104 flow=Background 1970/01/08 03:42:40.765465 4.001589 udp 10.0.2.105 51605 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:41.762828 3.719340 udp 10.0.2.105 51605 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:44.557062 0.000000 udp 10.0.2.105 55196 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:44.557163 0.924964 udp 10.0.2.105 55196 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:45.482127 0.000041 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 2 204 flow=Background 1970/01/08 03:42:48.562927 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:42:48.773470 0.000000 udp 10.0.2.105 51605 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:48.773613 0.000000 udp 10.0.2.105 51605 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:52.779066 1.502329 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:42:55.032077 2.994155 tcp 10.0.2.105 51303 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:04.035294 0.000000 tcp 10.0.2.105 51303 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:10.035208 2.992548 tcp 10.0.2.105 51304 -> 195.113.214.230 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:14.550028 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:43:19.026408 0.000000 tcp 10.0.2.105 51304 -> 195.113.214.230 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:21.984303 3.001141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 03:43:26.550317 4.002881 udp 10.0.2.105 61291 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:27.549182 3.547672 udp 10.0.2.105 61291 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:28.077936 3.019509 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 3 308 flow=Background 1970/01/08 03:43:28.990727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:43:30.045734 4.002845 udp 10.0.2.105 63006 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:31.043612 3.129929 udp 10.0.2.105 63006 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:34.173541 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:43:34.558964 0.000000 udp 10.0.2.105 61291 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:34.559085 0.000000 udp 10.0.2.105 61291 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:36.992159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:43:38.054275 0.000000 udp 10.0.2.105 63006 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:38.054404 0.000000 udp 10.0.2.105 63006 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:38.554446 0.010389 arp 10.0.2.105 who 10.0.2.2 CON 4 168 flow=Background-ARP 1970/01/08 03:43:42.059654 1.502501 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:43:44.313415 2.993526 tcp 10.0.2.105 51305 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:52.995779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:43:53.315570 0.000000 tcp 10.0.2.105 51305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:43:59.315308 2.993912 tcp 10.0.2.105 51306 -> 195.113.214.236 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:44:04.051603 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:44:08.307390 0.000000 tcp 10.0.2.105 51306 -> 195.113.214.236 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:44:16.551475 4.003798 udp 10.0.2.105 55471 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:17.550638 3.004756 udp 10.0.2.105 55471 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:19.325803 4.002939 udp 10.0.2.105 50120 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:20.325004 3.003851 udp 10.0.2.105 50120 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:24.561146 0.000000 udp 10.0.2.105 55471 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:24.561277 0.784528 udp 10.0.2.105 55471 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:25.001235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:44:25.345805 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 104 flow=Background 1970/01/08 03:44:27.334942 0.000000 udp 10.0.2.105 50120 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:27.335066 0.000000 udp 10.0.2.105 50120 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:28.056008 0.510872 arp 10.0.2.105 who 10.0.2.2 CON 4 168 flow=Background-ARP 1970/01/08 03:44:31.340853 1.501819 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:33.594227 2.993816 tcp 10.0.2.105 51307 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:44:42.586615 0.000000 tcp 10.0.2.105 51307 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:44:48.595911 3.003999 tcp 10.0.2.105 51308 -> 195.113.214.241 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:44:49.807411 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:44:53.552822 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:44:57.598209 0.000000 tcp 10.0.2.105 51308 -> 195.113.214.241 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:05.190322 3.003017 tcp 10.0.2.105 51309 -> 195.113.214.241 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:08.607178 4.002420 udp 10.0.2.105 64541 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:09.605646 4.431279 udp 10.0.2.105 64541 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:11.026764 3.010161 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 2 200 flow=Background 1970/01/08 03:45:14.192152 0.000000 tcp 10.0.2.105 51309 -> 195.113.214.241 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:16.615836 0.000000 udp 10.0.2.105 64541 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:16.615963 0.481607 udp 10.0.2.105 64541 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:17.097570 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/08 03:45:17.557271 0.077215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:45:20.641755 4.577452 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:22.894904 2.994034 tcp 10.0.2.105 51310 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:25.969093 0.750950 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:27.471918 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:31.887671 0.000000 tcp 10.0.2.105 51310 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:37.896799 3.003693 tcp 10.0.2.105 51311 -> 195.113.214.245 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:37.896877 3.003615 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 2 188 flow=Background 1970/01/08 03:45:42.573003 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:45:44.336231 3.004050 tcp 10.0.2.105 51312 -> 195.113.214.245 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:44.336321 3.003960 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 3 278 flow=Background 1970/01/08 03:45:46.899124 0.000127 tcp 10.0.2.105 51311 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:53.338158 0.000076 tcp 10.0.2.105 51312 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:45:53.338234 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 1 90 flow=Background 1970/01/08 03:45:57.908899 4.001692 udp 10.0.2.105 53145 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:57.909000 4.001591 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 200 flow=Background 1970/01/08 03:45:58.906187 3.004454 udp 10.0.2.105 53145 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:45:58.906253 3.004388 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 300 flow=Background 1970/01/08 03:46:05.916519 0.000104 udp 10.0.2.105 53145 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:05.916623 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 03:46:05.916667 0.000046 udp 10.0.2.105 53145 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:05.916713 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 03:46:06.577489 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:46:09.922180 3.755684 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:09.922360 3.755504 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:46:12.175732 3.004342 tcp 10.0.2.105 51313 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:12.175863 3.004211 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 03:46:14.429319 0.000072 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:14.429391 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5074 URN 192 1 160 flow=Background 1970/01/08 03:46:21.178170 0.000103 tcp 10.0.2.105 51313 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:21.178273 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 03:46:27.178949 3.002336 tcp 10.0.2.105 51314 -> 195.113.214.234 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:27.179016 3.182951 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 3 282 flow=Background 1970/01/08 03:46:30.361890 3.004035 tcp 10.0.2.105 51315 -> 195.113.214.234 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:32.074201 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:46:33.365925 2.814083 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 2 184 flow=Background 1970/01/08 03:46:36.179911 0.000097 tcp 10.0.2.105 51314 -> 195.113.214.234 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:39.374644 0.000096 tcp 10.0.2.105 51315 -> 195.113.214.234 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:46:39.374740 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc371 URN 192 1 90 flow=Background 1970/01/08 03:46:47.188813 4.003062 udp 10.0.2.105 52045 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:47.188912 4.002963 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 200 flow=Background 1970/01/08 03:46:48.187149 3.004942 udp 10.0.2.105 52045 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:48.187208 3.004883 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 300 flow=Background 1970/01/08 03:46:55.197280 0.000081 udp 10.0.2.105 52045 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:55.197361 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 03:46:55.197443 0.000129 udp 10.0.2.105 52045 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:55.197572 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 03:46:56.068694 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:46:59.203394 3.755627 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:46:59.203475 3.755546 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:47:01.456709 3.003972 tcp 10.0.2.105 51316 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:47:01.456832 3.003849 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 03:47:03.710081 0.000099 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:03.710180 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc5 URN 192 1 305 flow=Background 1970/01/08 03:47:10.459744 0.000079 tcp 10.0.2.105 51316 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:47:10.459823 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 03:47:16.459509 4.846384 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:16.459599 4.846294 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:47:20.994667 2.994135 tcp 10.0.2.105 51317 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:47:20.994758 2.994044 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 03:47:22.055960 0.751403 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:22.056031 0.751332 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:47:23.558438 0.000055 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:23.558493 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4619 URN 192 1 131 flow=Background 1970/01/08 03:47:25.570974 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:47:29.987526 0.000099 tcp 10.0.2.105 51317 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:47:29.987625 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 03:47:35.998548 4.003570 udp 10.0.2.105 60293 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:35.998636 4.003482 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:47:36.997721 3.004510 udp 10.0.2.105 60293 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:36.997791 3.004440 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:47:44.007594 0.000064 udp 10.0.2.105 60293 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:44.007658 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:47:44.007724 0.000041 udp 10.0.2.105 60293 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:44.007765 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:47:48.013666 4.507811 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:48.013728 4.507749 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:47:52.520313 3.003722 tcp 10.0.2.105 51318 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:47:52.520386 3.003649 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 03:47:53.271066 0.751233 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:53.271123 0.751176 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:47:54.773566 0.000060 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:47:54.773626 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x542c URN 192 1 178 flow=Background 1970/01/08 03:47:57.076110 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:48:01.522817 0.000075 tcp 10.0.2.105 51318 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:48:01.522892 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 03:48:07.522264 4.716824 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 7 644 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:07.522329 4.716759 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 7 840 flow=Background 1970/01/08 03:48:12.027963 3.004285 tcp 10.0.2.105 51319 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:48:12.028039 3.004209 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 03:48:12.989581 3.004195 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 5 460 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:12.989645 3.004131 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 5 600 flow=Background 1970/01/08 03:48:16.745183 0.000068 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:16.745251 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x459f URN 192 1 283 flow=Background 1970/01/08 03:48:21.030817 0.000072 tcp 10.0.2.105 51319 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:48:21.030889 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 03:48:21.571503 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:48:27.032600 4.002828 udp 10.0.2.105 61135 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:27.032680 4.002748 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:48:28.030649 3.005000 udp 10.0.2.105 61135 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:28.030740 3.004909 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:48:35.040647 0.000062 udp 10.0.2.105 61135 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:35.040709 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:48:35.040811 0.000150 udp 10.0.2.105 61135 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:35.040961 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:48:39.046986 4.507815 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:39.047119 4.507682 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:48:43.553406 2.994320 tcp 10.0.2.105 51320 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:48:43.553486 2.994240 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 03:48:44.304057 0.751743 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:44.304115 0.751685 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:48:45.806987 0.000121 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:45.807108 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc4 URN 192 1 179 flow=Background 1970/01/08 03:48:48.069538 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:48:52.556512 0.000070 tcp 10.0.2.105 51320 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:48:52.556582 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 03:48:58.555982 3.754142 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:48:58.556046 3.754078 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:49:03.061877 3.003665 tcp 10.0.2.105 51321 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:49:03.061962 3.003580 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 03:49:04.304060 3.754208 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:04.304130 3.754138 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:49:08.809883 0.000069 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:08.809952 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd13e URN 192 1 177 flow=Background 1970/01/08 03:49:12.064703 0.000085 tcp 10.0.2.105 51321 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:49:12.064788 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 03:49:13.576007 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:49:18.066687 4.002136 udp 10.0.2.105 53018 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:18.066792 4.002031 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:49:19.064051 3.004844 udp 10.0.2.105 53018 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:19.064111 3.004784 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:49:26.074121 0.000108 udp 10.0.2.105 53018 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:26.074229 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:49:26.074249 0.000033 udp 10.0.2.105 53018 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:26.074282 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:49:30.080504 4.508278 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:30.080576 4.508206 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:49:34.586755 3.004400 tcp 10.0.2.105 51322 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:49:34.586819 3.004336 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 03:49:35.337660 0.751478 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:35.337718 0.751420 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:49:36.840030 0.033446 udp 10.0.2.105 7010 -> 71.48.23.198 4217 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:36.873476 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4730 URN 192 1 277 flow=Background 1970/01/08 03:49:39.573458 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:49:43.589531 0.000070 tcp 10.0.2.105 51322 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:49:43.589601 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 03:49:49.589716 4.405351 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 9 828 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:49.589817 4.405250 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 9 1080 flow=Background 1970/01/08 03:49:54.746550 1.501461 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:54.746609 1.501402 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 03:49:56.999281 0.000061 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:49:56.999342 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x543b URN 192 1 258 flow=Background 1970/01/08 03:50:15.979698 4.002181 udp 10.0.2.105 50771 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:15.979817 4.002062 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:50:16.977431 3.004622 udp 10.0.2.105 50771 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:16.977573 3.004480 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:50:20.572972 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:50:23.987952 0.000059 udp 10.0.2.105 50771 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:23.988011 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:50:23.988054 0.000040 udp 10.0.2.105 50771 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:23.988094 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:50:27.993605 3.754898 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:27.993712 3.754791 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:50:30.029044 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 03:50:32.500165 0.000208 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:32.500373 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x415f URN 192 1 292 flow=Background 1970/01/08 03:50:37.036393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:50:45.038189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:50:48.514367 3.753873 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:48.514526 3.753714 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:50:53.019288 0.000060 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:50:53.019348 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 140 flow=Background 1970/01/08 03:50:57.576182 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:51:01.041139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:51:11.950153 4.002591 udp 10.0.2.105 57030 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:11.950233 4.002511 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:51:12.948121 3.004865 udp 10.0.2.105 57030 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:12.948252 3.004734 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:51:19.957983 0.000060 udp 10.0.2.105 57030 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:19.958043 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:51:19.958111 0.000040 udp 10.0.2.105 57030 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:19.958151 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:51:23.964112 3.755335 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:23.964185 3.755262 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:51:24.574402 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:51:28.470970 0.000078 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:28.471048 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd927 URN 192 1 278 flow=Background 1970/01/08 03:51:33.047192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:51:44.895618 3.753644 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:44.895691 3.753571 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:51:49.400931 0.000060 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:51:49.400991 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5bcf URN 192 1 129 flow=Background 1970/01/08 03:51:54.076980 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:52:04.935686 4.002636 udp 10.0.2.105 56109 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:04.935757 4.002565 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:52:05.934161 3.004263 udp 10.0.2.105 56109 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:05.934227 3.004197 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:52:12.944502 0.000085 udp 10.0.2.105 56109 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:12.944587 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:52:12.944676 0.000152 udp 10.0.2.105 56109 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:12.944828 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:52:16.950051 3.755678 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:16.950107 3.755622 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:52:21.457044 0.000058 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:21.457102 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6301 URN 192 1 185 flow=Background 1970/01/08 03:52:26.072890 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:52:38.222276 3.754024 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:38.222359 3.753941 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:52:42.727753 0.000104 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:42.727857 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6380 URN 192 1 273 flow=Background 1970/01/08 03:52:58.622892 4.002689 udp 10.0.2.105 60741 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:58.623007 4.002574 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:52:59.621752 3.003940 udp 10.0.2.105 60741 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:52:59.621814 3.003878 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:53:03.577347 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:53:06.631871 0.000148 udp 10.0.2.105 60741 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:06.632019 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:53:06.632089 0.000041 udp 10.0.2.105 60741 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:06.632130 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:53:10.637234 3.755395 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:10.637324 3.755305 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:53:15.144397 0.000065 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:15.144462 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x51ae URN 192 1 221 flow=Background 1970/01/08 03:53:31.378452 3.753706 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:31.378537 3.753621 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:53:35.883832 0.000064 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:35.883896 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6c59 URN 192 1 178 flow=Background 1970/01/08 03:53:40.570101 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:53:52.349719 4.003706 udp 10.0.2.105 62586 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:52.349818 4.003607 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:53:53.348358 3.005117 udp 10.0.2.105 62586 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:53:53.348419 3.005056 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:54:00.358712 0.000057 udp 10.0.2.105 62586 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:00.358769 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:54:00.358904 0.000040 udp 10.0.2.105 62586 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:00.358944 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:54:04.364734 3.754890 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:04.364797 3.754827 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:54:05.075394 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:54:08.871642 0.000115 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:08.871757 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb8b6 URN 192 1 270 flow=Background 1970/01/08 03:54:24.544903 3.753883 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:24.544970 3.753816 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:54:29.050273 0.000068 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:29.050341 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4cd4 URN 192 1 212 flow=Background 1970/01/08 03:54:33.576256 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:54:44.115590 4.001523 udp 10.0.2.105 59308 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:44.115666 4.001447 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:54:45.113250 3.004102 udp 10.0.2.105 59308 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:45.113309 3.004043 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:54:52.123410 0.000062 udp 10.0.2.105 59308 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:52.123472 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:54:52.123604 0.000062 udp 10.0.2.105 59308 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:52.123666 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:54:54.096759 3.003648 tcp 10.0.2.105 51323 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:54:54.096855 3.003552 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 03:54:56.129479 3.754967 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:54:56.129552 3.754894 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:54:59.072789 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:55:00.636071 0.000076 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:00.636147 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd326 URN 192 1 219 flow=Background 1970/01/08 03:55:03.098565 0.000090 tcp 10.0.2.105 51323 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:55:03.098655 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 03:55:09.098625 3.754731 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:09.098693 3.754663 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:55:13.604301 2.994063 tcp 10.0.2.105 51324 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:55:13.604375 2.993989 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 03:55:17.490859 3.754443 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:17.490915 3.754387 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:55:21.996545 0.000085 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:21.996630 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5604 URN 192 1 305 flow=Background 1970/01/08 03:55:22.596755 0.000070 tcp 10.0.2.105 51324 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:55:22.596825 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 03:55:26.572777 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:55:28.608386 4.003309 udp 10.0.2.105 50682 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:28.608461 4.003234 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:55:29.607410 3.004439 udp 10.0.2.105 50682 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:29.607468 3.004381 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:55:36.617441 0.000095 udp 10.0.2.105 50682 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:36.617536 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:55:36.617672 0.000067 udp 10.0.2.105 50682 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:36.617739 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:55:40.623280 4.508678 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:40.623341 4.508617 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:55:45.129969 3.003715 tcp 10.0.2.105 51325 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:55:45.130063 3.003621 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 03:55:45.880392 0.750869 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:45.880471 0.750790 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:55:47.382996 0.000061 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:55:47.383057 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4618 URN 192 1 125 flow=Background 1970/01/08 03:55:52.068996 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:55:54.131945 0.000070 tcp 10.0.2.105 51325 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:55:54.132015 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 03:56:00.132258 3.753985 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:00.132333 3.753910 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:56:04.638145 3.003326 tcp 10.0.2.105 51326 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:56:04.638215 3.003256 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 03:56:06.030649 3.754325 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:06.030761 3.754213 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:56:10.536277 0.000087 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:10.536364 3.103931 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 279 flow=Background 1970/01/08 03:56:13.640218 0.000077 tcp 10.0.2.105 51326 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:56:18.577065 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:56:19.641753 4.003240 udp 10.0.2.105 53431 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:19.641860 4.003133 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:56:20.640537 3.004592 udp 10.0.2.105 53431 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:20.640597 3.004532 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:56:27.650192 0.000089 udp 10.0.2.105 53431 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:27.650281 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:56:27.650319 0.000058 udp 10.0.2.105 53431 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:27.650377 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:56:31.656660 4.508120 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:31.656844 4.507936 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:56:36.163426 2.993751 tcp 10.0.2.105 51327 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:56:36.163547 2.993630 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 03:56:36.913590 0.751083 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:36.913668 0.751005 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:56:38.416753 0.000076 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:38.416829 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb895 URN 192 1 146 flow=Background 1970/01/08 03:56:43.072950 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:56:45.165792 0.000079 tcp 10.0.2.105 51327 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:56:45.165871 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 03:56:51.164989 3.754568 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:51.165054 3.754503 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:56:55.671284 3.003860 tcp 10.0.2.105 51328 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:56:55.671364 3.003780 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 03:56:57.354004 3.754934 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:56:57.354059 3.754879 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 03:57:01.859874 0.000070 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:01.859944 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd929 URN 192 1 311 flow=Background 1970/01/08 03:57:04.673679 0.000067 tcp 10.0.2.105 51328 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:57:04.673746 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 03:57:09.570850 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:57:10.675376 4.002593 udp 10.0.2.105 62418 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:10.675453 4.002516 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:57:11.673599 3.004481 udp 10.0.2.105 62418 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:11.673744 3.004336 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:57:18.683793 0.000082 udp 10.0.2.105 62418 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:18.683875 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:57:18.683998 0.000151 udp 10.0.2.105 62418 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:18.684149 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:57:22.689911 4.508433 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:22.690000 4.508344 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:57:27.196936 3.003478 tcp 10.0.2.105 51329 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:57:27.197008 3.003406 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 03:57:27.947280 0.751052 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:27.947337 0.750995 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:57:29.449528 0.000061 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:29.449589 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x547f URN 192 1 309 flow=Background 1970/01/08 03:57:34.075980 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:57:36.198899 0.000158 tcp 10.0.2.105 51329 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:57:36.199057 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 03:57:37.053550 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 03:57:42.198651 4.805851 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:42.198775 4.805727 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 03:57:44.060236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:57:46.704422 2.993979 tcp 10.0.2.105 51330 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:57:46.704492 2.993909 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 03:57:47.755469 2.253558 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:47.755548 2.253479 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 03:57:50.760280 0.000068 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:57:50.760348 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4636 URN 192 1 180 flow=Background 1970/01/08 03:57:52.061929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:57:55.697446 0.000081 tcp 10.0.2.105 51330 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:57:55.697527 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 03:58:00.573863 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:58:01.709672 4.002182 udp 10.0.2.105 52288 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:01.709745 4.002109 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:58:02.707271 3.004747 udp 10.0.2.105 52288 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:02.707328 3.004690 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:58:08.064905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:58:09.717491 0.000064 udp 10.0.2.105 52288 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:09.717555 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:58:09.717627 0.000041 udp 10.0.2.105 52288 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:09.717668 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:58:13.722979 4.508046 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:13.723099 4.507926 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:58:18.229798 3.003966 tcp 10.0.2.105 51331 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:58:18.229882 3.003882 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 03:58:18.980315 0.751786 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:18.980375 0.751726 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:58:20.483278 0.000113 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:20.483391 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4634 URN 192 1 235 flow=Background 1970/01/08 03:58:25.069514 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:58:27.232064 0.000103 tcp 10.0.2.105 51331 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:58:27.232167 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 03:58:33.232529 4.566001 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:33.232695 4.565835 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:58:37.737571 3.004291 tcp 10.0.2.105 51332 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:58:37.737653 3.004209 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 03:58:38.549134 0.750980 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:38.549189 0.750925 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:58:40.051452 0.000059 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:40.051511 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc1 URN 192 1 170 flow=Background 1970/01/08 03:58:40.070590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 03:58:46.740398 0.000115 tcp 10.0.2.105 51332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:58:46.740513 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 03:58:51.577217 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:58:52.743368 4.001838 udp 10.0.2.105 62075 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:52.743470 4.001736 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:58:53.740962 3.004402 udp 10.0.2.105 62075 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:58:53.741022 3.004342 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:59:00.750384 0.000110 udp 10.0.2.105 62075 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:00.750494 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:59:00.750512 0.000040 udp 10.0.2.105 62075 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:00.750552 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:59:04.756540 4.508188 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:04.756605 4.508123 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 03:59:09.263512 2.994125 tcp 10.0.2.105 51333 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:59:09.263590 2.994047 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 03:59:10.013691 0.751713 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:10.013779 0.751625 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 03:59:11.516090 0.000176 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:11.516266 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x02e4 URN 192 1 224 flow=Background 1970/01/08 03:59:16.072583 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:59:18.265697 0.000075 tcp 10.0.2.105 51333 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:59:18.265772 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 03:59:24.265672 4.865967 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:24.265797 4.865842 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 03:59:28.771492 3.003935 tcp 10.0.2.105 51334 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:59:28.771617 3.003810 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 03:59:29.882739 2.253168 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:29.882803 2.253104 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 03:59:32.887438 0.000060 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:32.887498 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x3a44 URN 192 1 298 flow=Background 1970/01/08 03:59:37.774218 0.000109 tcp 10.0.2.105 51334 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 03:59:37.774327 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 03:59:42.570739 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 03:59:43.776078 4.002124 udp 10.0.2.105 62281 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:43.776191 4.002011 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 03:59:44.773568 3.004758 udp 10.0.2.105 62281 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:44.773621 3.004705 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 03:59:51.783772 0.000080 udp 10.0.2.105 62281 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:51.783852 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:59:51.783950 0.000039 udp 10.0.2.105 62281 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:51.783989 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 03:59:55.789853 4.507468 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 03:59:55.789961 4.507360 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:00:00.296404 3.004099 tcp 10.0.2.105 51335 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:00:00.296481 3.004022 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:00:01.047684 0.750885 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:01.047770 0.750799 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:00:08.077656 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:00:09.299136 0.000113 tcp 10.0.2.105 51335 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:00:09.299249 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:00:15.298918 3.754430 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:15.299016 3.754332 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:00:19.805005 2.993621 tcp 10.0.2.105 51336 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:00:19.805239 2.993387 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:00:28.797312 0.000070 tcp 10.0.2.105 51336 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:00:28.797382 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:00:33.574160 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:00:34.809706 4.002213 udp 10.0.2.105 52437 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:34.809813 4.002106 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:00:35.807165 3.004818 udp 10.0.2.105 52437 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:35.807243 3.004740 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:00:42.817043 0.000062 udp 10.0.2.105 52437 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:42.817105 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:00:42.817173 0.000040 udp 10.0.2.105 52437 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:42.817213 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:00:46.823194 3.755115 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:00:46.823289 3.755020 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:00:51.330049 3.003685 tcp 10.0.2.105 51337 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:00:51.330119 3.003615 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:00:59.070348 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:01:00.332570 0.000066 tcp 10.0.2.105 51337 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:01:00.332636 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:01:06.332958 3.754054 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:06.333019 3.753993 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:01:10.838356 3.003986 tcp 10.0.2.105 51338 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:01:10.838425 3.003917 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:01:19.840933 0.000098 tcp 10.0.2.105 51338 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:01:19.841031 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:01:24.577122 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:01:25.842857 4.002542 udp 10.0.2.105 53302 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:25.842962 4.002437 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:01:26.840956 3.004608 udp 10.0.2.105 53302 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:26.841020 3.004544 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:01:33.850403 0.000088 udp 10.0.2.105 53302 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:33.850491 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:01:33.850532 0.000039 udp 10.0.2.105 53302 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:33.850571 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:01:37.856473 3.755947 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:37.856540 3.755880 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:01:42.363348 2.993959 tcp 10.0.2.105 51339 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:01:42.363417 2.993890 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:01:50.073845 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:01:51.365983 0.000068 tcp 10.0.2.105 51339 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:01:51.366051 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:01:57.366335 3.753805 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:01:57.366428 3.753712 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:02:01.871232 3.004515 tcp 10.0.2.105 51340 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:02:01.871324 3.004423 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:02:10.873612 0.000095 tcp 10.0.2.105 51340 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:02:10.873707 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:02:15.570976 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:02:16.875534 4.002884 udp 10.0.2.105 59295 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:16.875608 4.002810 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:02:17.874247 3.004293 udp 10.0.2.105 59295 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:17.874331 3.004209 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:02:24.883871 0.000082 udp 10.0.2.105 59295 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:24.883953 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:02:24.884076 0.000041 udp 10.0.2.105 59295 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:24.884117 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:02:28.890363 3.754707 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:28.890427 3.754643 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:02:33.396371 3.004167 tcp 10.0.2.105 51341 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:02:33.396462 3.004076 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:02:41.077218 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:02:42.399533 0.000108 tcp 10.0.2.105 51341 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:02:42.399641 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:02:48.399139 3.754232 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:02:48.399222 3.754149 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:02:52.904575 2.994512 tcp 10.0.2.105 51342 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:02:52.904657 2.994430 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:03:01.897563 0.768752 tcp 10.0.2.105 51342 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:03:02.666315 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:03:06.904424 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:03:08.240395 4.001985 udp 10.0.2.105 55141 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:03:08.240468 4.001912 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:03:09.237746 3.005071 udp 10.0.2.105 55141 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:03:09.237828 3.004989 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:03:16.247932 0.000060 udp 10.0.2.105 55141 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:03:16.247992 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:03:16.248048 0.000141 udp 10.0.2.105 55141 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:03:16.248189 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:03:20.253591 3.755599 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:03:20.253660 3.755530 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:04:44.406880 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:04:51.415123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:04:59.415973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:05:15.419716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:05:47.425157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:08:24.762639 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:08:24.762744 3.003143 tcp 10.0.2.105 51343 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:08:24.762809 3.003078 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:08:33.774174 0.000109 tcp 10.0.2.105 51343 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:08:33.774283 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:08:39.768328 4.000523 udp 10.0.2.105 61502 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:08:39.768406 4.000445 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:08:40.764393 3.004590 udp 10.0.2.105 61502 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:08:40.764457 3.004526 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:08:47.774855 0.000073 udp 10.0.2.105 61502 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:08:47.774928 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:08:47.774996 0.000147 udp 10.0.2.105 61502 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:08:47.775143 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:08:48.405353 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:08:51.780283 3.755332 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:08:51.780362 3.755253 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:08:56.287363 3.003856 tcp 10.0.2.105 51344 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:08:56.287437 3.003782 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:09:05.289769 0.000099 tcp 10.0.2.105 51344 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:09:05.289868 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:09:11.289727 3.753817 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:11.289796 3.753748 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:09:15.794972 2.994586 tcp 10.0.2.105 51345 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:09:15.795096 2.994462 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:09:20.401806 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:09:24.787978 0.000155 tcp 10.0.2.105 51345 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:09:24.788133 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:09:30.799383 4.003260 udp 10.0.2.105 62529 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:30.799454 4.003189 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:09:31.797802 3.004940 udp 10.0.2.105 62529 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:31.797854 3.004888 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:09:38.807969 0.000061 udp 10.0.2.105 62529 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:38.808030 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:09:38.808120 0.000041 udp 10.0.2.105 62529 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:38.808161 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:09:42.814279 3.755172 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:09:42.814397 3.755054 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:09:47.320503 3.004038 tcp 10.0.2.105 51346 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:09:47.320579 3.003962 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:09:51.906603 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:09:56.323409 0.000073 tcp 10.0.2.105 51346 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:09:56.323482 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:10:02.323475 3.753741 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:02.323557 3.753659 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:10:06.828325 3.004470 tcp 10.0.2.105 51347 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:10:06.828419 3.004376 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:10:15.831298 0.000070 tcp 10.0.2.105 51347 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:10:15.831368 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:10:20.407922 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:10:21.832886 4.002873 udp 10.0.2.105 62982 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:21.832967 4.002792 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:10:22.831519 3.004366 udp 10.0.2.105 62982 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:22.831605 3.004280 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:10:29.841059 0.000075 udp 10.0.2.105 62982 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:29.841134 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:10:29.841202 0.000040 udp 10.0.2.105 62982 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:29.841242 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:10:33.847431 3.755021 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:33.847489 3.754963 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:10:38.353804 2.994425 tcp 10.0.2.105 51348 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:10:38.353893 2.994336 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:10:45.904460 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:10:47.346739 0.000076 tcp 10.0.2.105 51348 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:10:47.346815 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:10:53.356771 3.754160 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:10:53.356848 3.754083 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:10:57.862143 3.003602 tcp 10.0.2.105 51349 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:10:57.862225 3.003520 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:11:06.874818 0.000090 tcp 10.0.2.105 51349 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:11:06.874908 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:11:11.401375 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:11:12.866732 4.002547 udp 10.0.2.105 49464 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:12.866803 4.002476 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:11:13.864895 3.004471 udp 10.0.2.105 49464 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:13.864965 3.004401 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:11:20.875116 0.000067 udp 10.0.2.105 49464 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:20.875183 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:11:20.875252 0.000035 udp 10.0.2.105 49464 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:20.875287 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:11:24.880683 3.755472 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:24.880745 3.755410 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:11:29.387503 3.003988 tcp 10.0.2.105 51350 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:11:29.387727 3.003764 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:11:36.907912 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:11:38.390155 0.000117 tcp 10.0.2.105 51350 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:11:38.390272 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:11:44.390331 3.753698 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:11:44.390398 3.753631 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:11:48.895227 2.994489 tcp 10.0.2.105 51351 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:11:48.895317 2.994399 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:11:51.432031 3.000778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:11:57.887851 0.000091 tcp 10.0.2.105 51351 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:11:57.887942 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:11:58.438422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:12:02.404394 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:12:03.899820 4.002800 udp 10.0.2.105 59000 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:03.899993 4.002627 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:12:04.898039 3.004689 udp 10.0.2.105 59000 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:04.898099 3.004629 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:12:06.440093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:12:11.908103 0.000071 udp 10.0.2.105 59000 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:11.908174 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:12:11.908441 0.000075 udp 10.0.2.105 59000 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:11.908516 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:12:15.914236 3.755305 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:15.914309 3.755232 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:12:20.420362 3.004598 tcp 10.0.2.105 51352 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:12:20.420464 3.004496 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:12:22.443319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:12:28.401973 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:12:29.423455 0.000072 tcp 10.0.2.105 51352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:12:29.423527 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:12:35.423586 3.753988 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:35.423661 3.753913 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:12:39.928620 3.004068 tcp 10.0.2.105 51353 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:12:39.928719 3.003969 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:12:48.931498 0.000069 tcp 10.0.2.105 51353 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:12:48.931567 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:12:53.908165 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:12:54.449675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:12:54.932364 4.003692 udp 10.0.2.105 56030 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:54.932436 4.003620 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:12:55.931528 3.004863 udp 10.0.2.105 56030 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:12:55.931591 3.004800 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:13:02.941712 0.000090 udp 10.0.2.105 56030 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:02.941802 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:13:02.941888 0.000110 udp 10.0.2.105 56030 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:02.941998 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:13:06.947690 3.755040 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:06.947784 3.754946 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:13:11.454007 2.994097 tcp 10.0.2.105 51354 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:13:11.454079 2.994025 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:13:19.405002 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:13:20.446529 0.000078 tcp 10.0.2.105 51354 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:13:20.446607 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:13:26.456839 3.753957 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:26.456907 3.753889 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:13:30.962437 2.993526 tcp 10.0.2.105 51355 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:13:30.962527 2.993436 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:13:39.965165 0.000104 tcp 10.0.2.105 51355 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:13:39.965269 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:13:44.901817 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:13:45.966863 4.002455 udp 10.0.2.105 58135 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:45.966947 4.002371 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:13:46.964994 3.004349 udp 10.0.2.105 58135 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:46.965130 3.004213 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:13:53.975182 0.000059 udp 10.0.2.105 58135 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:53.975241 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:13:53.975300 0.000148 udp 10.0.2.105 58135 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:53.975448 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:13:57.980466 3.756196 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:13:57.980529 3.756133 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:14:02.487542 3.003980 tcp 10.0.2.105 51356 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:14:02.487642 3.003880 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:14:10.408125 0.000242 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:14:11.489799 0.000154 tcp 10.0.2.105 51356 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:14:11.489953 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:14:17.490115 3.753892 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:17.490204 3.753803 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:14:21.995604 2.994121 tcp 10.0.2.105 51357 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:14:21.995672 2.994053 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:14:30.988117 0.000238 tcp 10.0.2.105 51357 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:14:30.988355 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:14:35.904848 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:14:36.999846 4.002840 udp 10.0.2.105 52258 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:36.999987 4.002699 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:14:37.998371 3.004420 udp 10.0.2.105 52258 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:37.998428 3.004363 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:14:45.008409 0.000072 udp 10.0.2.105 52258 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:45.008481 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:14:45.008541 0.000035 udp 10.0.2.105 52258 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:45.008576 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:14:49.014560 3.764747 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:14:49.014637 3.764670 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:14:53.530841 3.004237 tcp 10.0.2.105 51358 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:14:53.530933 3.004145 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:15:01.401584 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:15:02.533458 0.000085 tcp 10.0.2.105 51358 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:15:02.533543 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:15:08.534447 3.753322 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:08.534508 3.753261 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:15:13.038686 3.004071 tcp 10.0.2.105 51359 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:15:13.038766 3.003991 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:15:22.041646 0.000084 tcp 10.0.2.105 51359 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:15:22.041730 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:15:26.908116 0.000286 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:15:28.042498 4.003727 udp 10.0.2.105 53153 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:28.042570 4.003655 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:15:29.041454 3.005056 udp 10.0.2.105 53153 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:29.041533 3.004977 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:15:36.051997 0.000097 udp 10.0.2.105 53153 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:36.052094 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:15:36.052151 0.000201 udp 10.0.2.105 53153 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:36.052352 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:15:40.057836 3.754957 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:40.057898 3.754895 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:15:44.563839 2.994097 tcp 10.0.2.105 51360 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:15:44.563920 2.994016 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:15:52.405086 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:15:53.556721 0.000121 tcp 10.0.2.105 51360 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:15:53.556842 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:15:59.566788 3.874469 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:15:59.566862 3.874395 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:16:04.192088 2.994172 tcp 10.0.2.105 51361 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:16:04.192171 2.994089 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:16:13.195064 0.000078 tcp 10.0.2.105 51361 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:16:13.195142 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:16:18.001588 0.142794 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:16:19.247006 4.002414 udp 10.0.2.105 61013 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:19.247075 4.002345 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:16:20.244862 3.004669 udp 10.0.2.105 61013 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:20.244931 3.004600 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:16:27.255009 0.000283 udp 10.0.2.105 61013 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:27.255135 0.000190 udp 10.0.2.105 61013 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:27.255292 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:16:27.255325 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:16:31.261023 3.755325 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:31.261192 3.755156 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:16:35.767467 3.004184 tcp 10.0.2.105 51362 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:16:35.767541 3.004110 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:16:43.558865 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:16:44.770239 0.000137 tcp 10.0.2.105 51362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:16:44.770376 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:16:50.770109 3.754518 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:16:50.770178 3.754449 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:18:58.606088 3.001024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:19:05.612826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:19:13.614759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:19:29.617514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:20:01.623926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:21:55.277404 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:21:55.277584 3.003414 tcp 10.0.2.105 51363 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:21:55.277671 3.003327 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:22:04.279614 0.000099 tcp 10.0.2.105 51363 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:22:04.279713 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:22:10.283683 4.000440 udp 10.0.2.105 59166 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:10.283751 4.000372 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:22:11.279794 3.004641 udp 10.0.2.105 59166 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:11.279873 3.004562 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:22:18.289953 0.000057 udp 10.0.2.105 59166 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:18.290010 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:22:18.290079 0.000040 udp 10.0.2.105 59166 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:18.290119 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:22:19.050872 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:22:22.295946 3.755094 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:22.296128 3.754912 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:22:26.802334 2.994592 tcp 10.0.2.105 51364 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:22:26.802424 2.994502 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:22:35.805386 0.000082 tcp 10.0.2.105 51364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:22:35.805468 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:22:41.805144 3.754309 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:22:41.805286 3.754167 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:22:46.310231 3.004639 tcp 10.0.2.105 51365 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:22:46.310310 3.004560 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:22:51.057310 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:22:55.313461 0.000067 tcp 10.0.2.105 51365 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:22:55.313528 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:23:01.315199 0.000189 udp 10.0.2.105 62660 -> 8.8.8.8 53 INT 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:01.315388 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:23:02.313639 4.586745 udp 10.0.2.105 62660 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:03.897158 3.003226 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:23:06.900198 4.005575 udp 10.0.2.105 62660 -> 8.8.8.8 53 REQ 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:06.900314 4.005459 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:23:10.905854 0.000038 udp 10.0.2.105 62660 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:10.905892 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:23:14.911717 3.755408 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:14.911772 3.755353 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:23:15.833144 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:23:19.418276 3.004406 tcp 10.0.2.105 51366 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:23:19.418382 3.004300 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:23:28.420931 0.000098 tcp 10.0.2.105 51366 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:23:28.421029 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:23:34.421200 3.753713 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:34.421278 3.753635 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:23:38.926238 3.004067 tcp 10.0.2.105 51367 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:23:38.926331 3.003974 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:23:43.833103 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:23:47.929132 0.000066 tcp 10.0.2.105 51367 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:23:47.929198 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:23:53.930389 4.003114 udp 10.0.2.105 61360 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:53.930463 4.003040 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:23:54.929089 3.004441 udp 10.0.2.105 61360 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:23:54.929149 3.004381 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:24:01.939220 0.000119 udp 10.0.2.105 61360 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:01.939339 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:24:01.939367 0.000155 udp 10.0.2.105 61360 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:01.939522 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:24:05.944788 3.755827 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:05.944848 3.755767 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:24:10.451495 3.004050 tcp 10.0.2.105 51368 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:24:10.451586 3.003959 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:24:15.337876 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:24:19.453939 0.000090 tcp 10.0.2.105 51368 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:24:19.454029 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:24:25.454216 3.754070 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:25.454372 3.753914 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:24:29.959314 3.004147 tcp 10.0.2.105 51369 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:24:29.959384 3.004077 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:24:38.961855 0.000066 tcp 10.0.2.105 51369 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:24:38.961921 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:24:43.839111 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:24:44.964689 4.001904 udp 10.0.2.105 50406 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:44.964779 4.001814 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:24:45.962185 3.004509 udp 10.0.2.105 50406 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:45.962262 3.004432 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:24:52.972139 0.648881 udp 10.0.2.105 50406 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:53.621020 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:24:53.622272 0.000047 udp 10.0.2.105 50406 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:53.622319 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:24:57.619604 3.755017 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:24:57.619669 3.754952 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:25:02.125647 3.004312 tcp 10.0.2.105 51370 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:25:02.125728 3.004231 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:25:09.646247 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:25:11.128465 0.000066 tcp 10.0.2.105 51370 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:25:11.128531 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:25:17.129478 3.753168 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:17.129566 3.753080 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:25:21.633926 2.993989 tcp 10.0.2.105 51371 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:25:21.633991 2.993924 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:25:30.626817 0.000116 tcp 10.0.2.105 51371 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:25:30.626933 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:25:35.142815 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:25:36.638528 4.002631 udp 10.0.2.105 55106 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:36.638598 4.002561 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:25:37.636877 3.004502 udp 10.0.2.105 55106 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:37.636997 3.004382 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:25:44.646991 0.000079 udp 10.0.2.105 55106 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:44.647070 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:25:44.647118 0.000208 udp 10.0.2.105 55106 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:44.647326 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:25:48.652608 3.755468 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:25:48.652710 3.755366 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:25:53.158905 3.004436 tcp 10.0.2.105 51372 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:25:53.158994 3.004347 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:26:01.140036 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:26:02.161850 0.000090 tcp 10.0.2.105 51372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:26:02.161940 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:26:06.720622 3.030965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:26:08.161595 3.794773 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:08.161657 3.794711 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:26:12.707480 3.003981 tcp 10.0.2.105 51373 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:26:12.707565 3.003896 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:26:13.748622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:26:21.710236 0.000075 tcp 10.0.2.105 51373 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:26:21.710311 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:26:21.750429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:26:26.666906 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:26:27.712347 4.001923 udp 10.0.2.105 61659 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:27.712424 4.001846 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:26:28.710147 3.004335 udp 10.0.2.105 61659 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:28.710210 3.004272 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:26:35.720081 0.000130 udp 10.0.2.105 61659 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:35.720211 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:26:35.720234 0.000041 udp 10.0.2.105 61659 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:35.720275 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:26:37.752758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:26:39.725786 3.755324 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:39.725863 3.755247 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:26:44.232870 2.994245 tcp 10.0.2.105 51374 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:26:44.232974 2.994141 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:26:52.163785 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:26:53.235483 0.000075 tcp 10.0.2.105 51374 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:26:53.235558 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:26:59.235024 3.753977 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:26:59.235079 3.753922 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:27:03.740663 3.004263 tcp 10.0.2.105 51375 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:27:03.740758 3.004168 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:27:09.759374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:27:12.743568 0.000071 tcp 10.0.2.105 51375 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:27:12.743639 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:27:17.260044 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:27:18.835392 4.152561 udp 10.0.2.105 57860 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:18.835480 4.152473 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:27:19.833211 3.154922 udp 10.0.2.105 57860 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:19.986331 3.001802 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:27:26.994194 0.000072 udp 10.0.2.105 57860 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:26.994266 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:27:26.994378 0.000035 udp 10.0.2.105 57860 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:26.994413 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:27:31.000562 3.754545 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:31.000629 3.754478 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:27:35.506547 3.003561 tcp 10.0.2.105 51376 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:27:35.506630 3.003478 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:27:43.327154 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:27:44.509307 0.000067 tcp 10.0.2.105 51376 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:27:44.509374 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:27:50.508969 3.754317 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:27:50.509050 3.754236 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:27:55.014541 2.994019 tcp 10.0.2.105 51377 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:27:55.014610 2.993950 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:28:04.007211 0.000139 tcp 10.0.2.105 51377 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:28:04.007350 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:28:08.823954 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:28:10.019814 4.002038 udp 10.0.2.105 56914 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:10.019923 4.001929 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:28:11.016952 3.005177 udp 10.0.2.105 56914 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:11.017010 3.005119 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:28:18.027048 0.000056 udp 10.0.2.105 56914 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:18.027104 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:28:18.027255 0.000034 udp 10.0.2.105 56914 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:18.027289 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:28:22.033193 3.755186 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:22.033265 3.755114 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:28:26.540026 3.004076 tcp 10.0.2.105 51378 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:28:26.540115 3.003987 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:28:34.320403 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:28:35.542214 0.000078 tcp 10.0.2.105 51378 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:28:35.542292 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:28:41.543655 3.752613 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:28:41.543716 3.752552 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:28:46.048101 3.003637 tcp 10.0.2.105 51379 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:28:46.048173 3.003565 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:28:55.050334 0.000085 tcp 10.0.2.105 51379 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:28:55.050419 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:28:59.826939 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:29:01.052092 4.002996 udp 10.0.2.105 49424 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:01.052243 4.002845 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:29:02.050300 3.004869 udp 10.0.2.105 49424 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:02.050419 3.004750 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:29:09.060269 0.000062 udp 10.0.2.105 49424 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:09.060331 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:29:09.060417 0.000046 udp 10.0.2.105 49424 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:09.060463 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:29:13.066283 3.755269 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:13.066430 3.755122 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:29:17.573500 2.993695 tcp 10.0.2.105 51380 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:29:17.573584 2.993611 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:29:25.324685 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:29:26.575786 0.000068 tcp 10.0.2.105 51380 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:29:26.575854 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:29:32.575558 3.814328 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:32.695271 3.694615 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:29:37.141579 3.004026 tcp 10.0.2.105 51381 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:29:37.141662 3.003943 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:29:46.144015 0.000073 tcp 10.0.2.105 51381 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:29:46.144088 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:29:50.880847 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:29:52.145835 4.002380 udp 10.0.2.105 60776 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:52.145908 4.002307 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:29:53.143758 3.004595 udp 10.0.2.105 60776 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:29:53.143847 3.004506 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:30:00.154064 0.000053 udp 10.0.2.105 60776 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:00.154117 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:30:00.154191 0.000035 udp 10.0.2.105 60776 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:00.154226 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:30:04.159853 3.755619 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:04.159923 3.755549 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:30:08.666224 3.004703 tcp 10.0.2.105 51382 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:30:08.666296 3.004631 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:30:10.839559 0.000078 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:10.839637 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x710b URN 192 1 178 flow=Background 1970/01/08 04:30:15.385583 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:30:17.669491 0.000078 tcp 10.0.2.105 51382 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:30:17.669569 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:30:23.668806 4.646058 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 9 828 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:23.668914 4.645950 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 9 1080 flow=Background 1970/01/08 04:30:29.066853 1.500693 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:29.066973 1.500573 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 04:30:31.319037 0.000070 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:31.319107 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x18b7 URN 192 1 141 flow=Background 1970/01/08 04:30:46.684372 4.002451 udp 10.0.2.105 63740 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:46.684441 4.002382 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:30:47.682655 3.004254 udp 10.0.2.105 63740 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:47.682833 3.004076 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:30:51.387723 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:30:54.692170 0.000059 udp 10.0.2.105 63740 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:54.692229 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:30:54.692305 0.000041 udp 10.0.2.105 63740 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:54.692346 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:30:58.698452 3.755229 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:30:58.698549 3.755132 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:31:03.204650 0.000073 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:03.204723 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5074 URN 192 1 293 flow=Background 1970/01/08 04:31:22.103134 3.753887 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:22.103218 3.753803 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:31:26.608648 0.000070 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:26.608718 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc5 URN 192 1 297 flow=Background 1970/01/08 04:31:31.385418 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:31:43.627641 4.000712 udp 10.0.2.105 53354 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:43.627763 4.000590 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:31:44.623920 3.004538 udp 10.0.2.105 53354 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:44.623981 3.004477 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:31:51.634344 0.000058 udp 10.0.2.105 53354 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:51.634402 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:31:51.634525 0.000040 udp 10.0.2.105 53354 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:51.634565 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:31:55.640070 3.755154 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:31:55.640133 3.755091 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:31:56.381317 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:32:00.146589 0.000064 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:00.146653 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4619 URN 192 1 233 flow=Background 1970/01/08 04:32:18.494297 3.754233 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:18.494372 3.754158 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:32:23.000024 0.000085 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:23.000109 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x542c URN 192 1 290 flow=Background 1970/01/08 04:32:27.886521 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:32:38.355123 4.002411 udp 10.0.2.105 63902 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:38.355201 4.002333 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:32:39.352733 3.004907 udp 10.0.2.105 63902 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:39.352800 3.004840 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:32:46.363344 0.000115 udp 10.0.2.105 63902 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:46.363459 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:32:46.363485 0.000044 udp 10.0.2.105 63902 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:46.363529 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:32:50.369091 3.755053 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:50.369144 3.755000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:32:54.875695 0.000063 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:32:54.875758 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x459f URN 192 1 281 flow=Background 1970/01/08 04:32:59.381993 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:33:11.761159 3.754235 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:11.761231 3.754163 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:33:14.096119 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:33:16.266169 0.000111 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:16.266280 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc4 URN 192 1 260 flow=Background 1970/01/08 04:33:21.102961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:33:29.104520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:33:31.772007 4.002246 udp 10.0.2.105 60861 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:31.772097 4.002156 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:33:32.769812 3.004636 udp 10.0.2.105 60861 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:32.769881 3.004567 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:33:36.384655 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:33:39.780090 0.000104 udp 10.0.2.105 60861 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:39.780194 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:33:39.780224 0.000096 udp 10.0.2.105 60861 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:39.780320 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:33:43.785943 3.755288 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:43.786007 3.755224 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:33:45.107770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:33:48.292766 0.000068 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:33:48.292834 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd13e URN 192 1 293 flow=Background 1970/01/08 04:34:06.759705 3.754102 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:06.759782 3.754025 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:34:11.265311 0.000064 udp 10.0.2.105 7010 -> 71.48.23.198 4217 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:11.265375 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4730 URN 192 1 211 flow=Background 1970/01/08 04:34:15.881866 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:34:17.113734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:34:27.841704 4.003190 udp 10.0.2.105 59015 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:27.841798 4.003096 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:34:28.840178 3.004863 udp 10.0.2.105 59015 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:28.840388 3.004653 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:34:35.850754 0.000075 udp 10.0.2.105 59015 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:35.850829 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:34:35.850889 0.000039 udp 10.0.2.105 59015 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:35.850928 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:34:39.856042 3.755987 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:39.856122 3.755907 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:34:40.387274 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:34:44.363004 0.000071 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:44.363075 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x543b URN 192 1 211 flow=Background 1970/01/08 04:34:59.827209 3.752938 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:34:59.827276 3.752871 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:35:04.331512 0.000148 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:04.331660 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x415f URN 192 1 269 flow=Background 1970/01/08 04:35:08.887856 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:35:21.609115 4.002829 udp 10.0.2.105 56501 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:21.609183 4.002761 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:35:22.607532 3.004523 udp 10.0.2.105 56501 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:22.607711 3.004344 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:35:28.176557 3.003791 tcp 10.0.2.105 51383 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:35:28.176738 3.003610 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:35:29.617621 0.000107 udp 10.0.2.105 56501 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:29.617728 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:35:29.617758 0.000065 udp 10.0.2.105 56501 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:29.617823 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:35:32.882198 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:35:33.623817 3.755232 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:33.623881 3.755168 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:35:37.178381 0.000092 tcp 10.0.2.105 51383 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:35:37.178473 0.952230 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 226 flow=Background 1970/01/08 04:35:38.130628 0.000075 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:43.178252 3.754659 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:43.178315 3.754596 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:35:47.684255 2.993656 tcp 10.0.2.105 51384 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:35:47.684361 2.993550 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:35:56.676932 0.000152 tcp 10.0.2.105 51384 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:35:56.677084 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:35:56.968490 3.754030 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:35:56.968567 3.753953 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:36:01.383611 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:36:01.474149 0.000075 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:01.474224 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd927 URN 192 1 118 flow=Background 1970/01/08 04:36:02.686540 1.500873 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:02.686650 1.500763 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 04:36:04.942115 4.002305 udp 10.0.2.105 52274 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:04.942193 4.002227 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 200 flow=Background 1970/01/08 04:36:05.939966 3.004480 udp 10.0.2.105 52274 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:05.940035 3.004411 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 300 flow=Background 1970/01/08 04:36:12.949851 0.000067 udp 10.0.2.105 52274 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:12.949918 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 04:36:12.949983 0.000044 udp 10.0.2.105 52274 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:12.950027 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 100 flow=Background 1970/01/08 04:36:16.955832 4.807033 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:16.955893 4.806972 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:36:19.209151 3.004540 tcp 10.0.2.105 51385 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:36:19.209230 3.004461 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:36:22.514658 1.501333 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:22.514737 1.501254 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 04:36:24.767530 0.000078 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:24.767608 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5bcf URN 192 1 200 flow=Background 1970/01/08 04:36:26.890061 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:36:28.212202 0.000074 tcp 10.0.2.105 51385 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:36:28.212276 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:36:34.211688 3.754065 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:34.211757 3.753996 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:36:38.717191 3.004278 tcp 10.0.2.105 51386 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:36:38.717266 3.004203 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:36:41.051718 3.753937 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:41.051817 3.753838 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:36:45.557304 0.000075 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:45.557379 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6301 URN 192 1 167 flow=Background 1970/01/08 04:36:47.719898 0.000173 tcp 10.0.2.105 51386 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:36:47.720071 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:36:52.386922 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:36:53.722073 4.002472 udp 10.0.2.105 64998 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:53.722159 4.002386 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:36:54.720057 3.004600 udp 10.0.2.105 64998 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:36:54.720185 3.004472 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:37:01.729984 0.000061 udp 10.0.2.105 64998 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:01.730045 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:37:01.730115 0.000152 udp 10.0.2.105 64998 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:01.730267 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:37:05.735731 4.508257 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:05.735869 4.508119 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:37:10.242842 2.993591 tcp 10.0.2.105 51387 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:37:10.242940 2.993493 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:37:10.993183 0.751307 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:10.993289 0.751201 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:37:12.495837 0.000059 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:12.495896 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6380 URN 192 1 298 flow=Background 1970/01/08 04:37:17.382339 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:37:19.245077 0.000115 tcp 10.0.2.105 51387 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:37:19.245192 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:37:25.245437 3.754208 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:25.245498 3.754147 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:37:29.750801 3.003962 tcp 10.0.2.105 51388 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:37:29.750907 3.003856 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:37:30.783327 3.753884 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:30.783413 3.753798 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:37:35.288517 0.000060 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:35.288577 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x51ae URN 192 1 260 flow=Background 1970/01/08 04:37:38.753755 0.000071 tcp 10.0.2.105 51388 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:37:38.753826 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:37:43.390076 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:37:44.755149 4.002985 udp 10.0.2.105 55224 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:44.755239 4.002895 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:37:45.753654 3.004594 udp 10.0.2.105 55224 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:45.753719 3.004529 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:37:52.763881 0.000066 udp 10.0.2.105 55224 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:52.763947 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:37:52.764009 0.000039 udp 10.0.2.105 55224 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:52.764048 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:37:56.769137 4.559503 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:37:56.769193 4.559447 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:38:01.316262 3.004318 tcp 10.0.2.105 51389 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:38:01.316396 3.004184 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:38:02.077143 0.751108 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:02.077207 0.751044 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:38:03.579638 0.000067 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:03.579705 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6c59 URN 192 1 204 flow=Background 1970/01/08 04:38:08.406332 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:38:10.318934 0.000105 tcp 10.0.2.105 51389 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:38:10.319039 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:38:16.318819 4.795783 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 9 828 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:16.318889 4.795713 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 9 1080 flow=Background 1970/01/08 04:38:20.824184 2.993741 tcp 10.0.2.105 51390 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:38:20.824453 2.993472 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:38:21.866543 1.501396 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:21.866613 1.501326 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 04:38:24.119136 0.000183 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:24.119319 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb8b6 URN 192 1 267 flow=Background 1970/01/08 04:38:29.816685 0.000095 tcp 10.0.2.105 51390 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:38:29.816780 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:38:34.403035 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:38:35.828208 4.003304 udp 10.0.2.105 58980 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:35.828279 4.003233 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:38:36.826991 3.004607 udp 10.0.2.105 58980 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:36.827086 3.004512 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:38:43.836637 0.000121 udp 10.0.2.105 58980 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:43.836758 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:38:43.836783 0.000039 udp 10.0.2.105 58980 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:43.836822 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:38:47.843038 4.508068 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:47.843132 4.507974 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:38:52.350151 3.003306 tcp 10.0.2.105 51391 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:38:52.350235 3.003222 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:38:53.100505 0.750788 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:53.100584 0.750709 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:38:54.602462 0.000090 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:38:54.602552 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4cd4 URN 192 1 208 flow=Background 1970/01/08 04:38:59.409531 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:39:01.352332 0.000080 tcp 10.0.2.105 51391 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:39:01.352412 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:39:07.352015 4.435596 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:07.352085 4.435526 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 04:39:11.857264 3.004836 tcp 10.0.2.105 51392 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:39:11.857345 3.004755 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:39:12.538017 2.253878 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:12.538186 2.253709 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 04:39:15.542861 0.000070 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:15.542931 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd326 URN 192 1 294 flow=Background 1970/01/08 04:39:20.860427 0.000077 tcp 10.0.2.105 51392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:39:20.860504 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:39:25.407005 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:39:26.862598 4.002224 udp 10.0.2.105 51544 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:26.862687 4.002135 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:39:27.860191 3.004738 udp 10.0.2.105 51544 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:27.860248 3.004681 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:39:34.869996 0.000059 udp 10.0.2.105 51544 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:34.870055 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:39:34.870109 0.000040 udp 10.0.2.105 51544 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:34.870149 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:39:38.875926 4.507683 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:38.876074 4.507535 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:39:43.382700 2.994385 tcp 10.0.2.105 51393 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:39:43.382766 2.994319 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:39:44.133576 0.751345 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:44.133705 0.751216 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:39:45.636090 0.047483 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:45.683573 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5604 URN 192 1 305 flow=Background 1970/01/08 04:39:50.412698 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:39:52.385722 0.000122 tcp 10.0.2.105 51393 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:39:52.385844 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:39:58.395302 4.726840 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:39:58.395404 4.726738 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:40:02.901136 3.003653 tcp 10.0.2.105 51394 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:40:02.901248 3.003541 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:40:03.871883 0.751591 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:03.871985 0.751489 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:40:05.374813 0.000059 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:05.374872 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4618 URN 192 1 156 flow=Background 1970/01/08 04:40:11.903352 0.000077 tcp 10.0.2.105 51394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:40:11.903429 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:40:16.420445 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:40:17.905576 4.002124 udp 10.0.2.105 65049 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:17.905667 4.002033 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:40:18.903363 3.004442 udp 10.0.2.105 65049 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:18.903424 3.004381 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:40:21.149924 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:40:25.913977 0.000078 udp 10.0.2.105 65049 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:25.914055 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:40:25.914186 0.000041 udp 10.0.2.105 65049 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:25.914227 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:40:28.157480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:40:29.919666 4.508149 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:29.919731 4.508084 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:40:34.426451 3.003581 tcp 10.0.2.105 51395 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:40:34.426553 3.003479 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:40:35.177005 0.751092 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:35.177071 0.751026 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:40:36.158494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:40:36.679531 0.000081 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:36.679612 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 180 flow=Background 1970/01/08 04:40:41.416107 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:40:43.428706 0.000084 tcp 10.0.2.105 51395 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:40:43.428790 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:40:49.429066 4.636241 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 7 644 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:49.429128 4.636179 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 7 840 flow=Background 1970/01/08 04:40:52.161258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:40:53.954305 2.993876 tcp 10.0.2.105 51396 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:40:53.954369 2.993812 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:40:54.815106 3.004619 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 5 460 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:54.815164 3.004561 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 5 600 flow=Background 1970/01/08 04:40:58.571006 0.000086 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:40:58.571092 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb895 URN 192 1 249 flow=Background 1970/01/08 04:41:02.947167 0.000075 tcp 10.0.2.105 51396 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:41:02.947242 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:41:07.934182 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:41:08.961014 4.000328 udp 10.0.2.105 64488 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:08.961084 4.000258 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:41:09.956742 3.004714 udp 10.0.2.105 64488 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:09.956805 3.004651 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:41:16.966785 0.000098 udp 10.0.2.105 64488 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:16.966883 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:41:16.966908 0.000167 udp 10.0.2.105 64488 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:16.967075 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:41:20.973012 4.508356 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:20.973068 4.508300 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:41:24.227284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:41:25.480169 3.003750 tcp 10.0.2.105 51397 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:41:25.480421 3.003498 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:41:26.230104 0.751900 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:26.230187 0.751817 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:41:27.732928 0.000139 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:27.733067 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd929 URN 192 1 314 flow=Background 1970/01/08 04:41:32.439209 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:41:34.482664 0.000106 tcp 10.0.2.105 51397 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:41:34.482770 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:41:40.482044 4.355572 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:40.482112 4.355504 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 04:41:44.987396 3.004410 tcp 10.0.2.105 51398 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:41:44.987474 3.004332 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:41:45.588028 2.253936 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:45.588087 2.253877 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 04:41:48.593068 0.000082 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:48.593150 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x547f URN 192 1 262 flow=Background 1970/01/08 04:41:53.990417 0.000114 tcp 10.0.2.105 51398 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:41:53.990531 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:41:58.937228 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:41:59.992162 4.002795 udp 10.0.2.105 65450 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:41:59.992393 4.002564 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:42:00.990811 3.004174 udp 10.0.2.105 65450 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:00.990904 3.004081 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:42:08.000234 0.000127 udp 10.0.2.105 65450 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:08.000361 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:42:08.000419 0.000154 udp 10.0.2.105 65450 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:08.000573 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:42:12.006410 4.507984 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:12.006480 4.507914 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:42:16.513053 2.994333 tcp 10.0.2.105 51399 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:42:16.513132 2.994254 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:42:17.263893 0.751040 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:17.263954 0.750979 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:42:18.765943 0.000075 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:18.766018 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4636 URN 192 1 291 flow=Background 1970/01/08 04:42:23.432790 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:42:25.515586 0.000065 tcp 10.0.2.105 51399 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:42:25.515651 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:42:31.515704 4.284778 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:31.515773 4.284709 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 04:42:36.020721 3.004661 tcp 10.0.2.105 51400 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:42:36.020802 3.004580 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:42:36.551834 2.253343 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:36.551888 2.253289 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 04:42:39.556555 0.000067 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:39.556622 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4634 URN 192 1 261 flow=Background 1970/01/08 04:42:45.023904 0.000082 tcp 10.0.2.105 51400 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:42:45.023986 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:42:49.930769 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:42:51.025611 4.002330 udp 10.0.2.105 53948 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:51.025703 4.002238 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:42:52.023579 3.004480 udp 10.0.2.105 53948 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:52.023720 3.004339 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:42:59.033846 0.000186 udp 10.0.2.105 53948 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:59.033984 0.000074 udp 10.0.2.105 53948 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:42:59.034032 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:42:59.034058 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:43:03.040173 4.547209 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:03.040429 4.546953 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:43:07.586310 3.004323 tcp 10.0.2.105 51401 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:43:07.586376 3.004257 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:43:08.337508 0.751097 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:08.337586 0.751019 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:43:09.840119 0.000095 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:09.840214 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc1 URN 192 1 242 flow=Background 1970/01/08 04:43:14.445845 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:43:16.588927 0.000080 tcp 10.0.2.105 51401 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:43:16.589007 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:43:22.589456 4.474482 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:22.589522 4.474416 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 04:43:27.094212 2.994640 tcp 10.0.2.105 51402 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:43:27.094324 2.994528 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:43:27.815570 2.253157 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:27.815647 2.253080 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 04:43:30.819896 0.000075 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:30.819971 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x02e4 URN 192 1 217 flow=Background 1970/01/08 04:43:36.087343 0.000091 tcp 10.0.2.105 51402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:43:36.087434 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:43:40.944221 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:43:42.098778 4.316693 udp 10.0.2.105 53990 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:42.098871 4.316600 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:43:43.097218 3.319545 udp 10.0.2.105 53990 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:43.097271 3.319492 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:43:50.417616 0.000063 udp 10.0.2.105 53990 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:50.417679 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:43:50.417738 0.000032 udp 10.0.2.105 53990 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:50.417770 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:43:54.423338 4.508239 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:54.423468 4.508109 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 04:43:59.681133 0.751166 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:43:59.681341 0.750958 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 04:44:01.183332 0.000114 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:44:01.183446 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x3a44 URN 192 1 238 flow=Background 1970/01/08 04:44:06.090453 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:44:17.468797 3.753598 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:44:17.468872 3.753523 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:47:28.384859 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:47:35.391490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:47:43.392424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:47:59.396013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:48:31.401574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:48:58.932193 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:48:58.932403 3.003245 tcp 10.0.2.105 51403 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:48:58.932465 3.003183 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:49:07.934225 0.000180 tcp 10.0.2.105 51403 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:49:07.934405 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:49:13.937037 4.001597 udp 10.0.2.105 59877 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:13.937155 4.001479 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:49:14.934326 3.004418 udp 10.0.2.105 59877 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:14.934426 3.004318 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:49:21.944493 0.000096 udp 10.0.2.105 59877 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:21.944589 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:49:21.944619 0.000129 udp 10.0.2.105 59877 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:21.944748 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:49:22.585543 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:49:25.950151 3.755493 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:25.950228 3.755416 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:49:30.456969 3.004282 tcp 10.0.2.105 51404 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:49:30.457064 3.004187 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:49:39.459875 0.000087 tcp 10.0.2.105 51404 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:49:39.459962 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:49:45.459457 3.754372 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:49:45.459638 3.754191 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:49:49.964700 2.994540 tcp 10.0.2.105 51405 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:49:49.964768 2.994472 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:49:54.581205 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:49:58.957928 0.000113 tcp 10.0.2.105 51405 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:49:58.958041 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:50:04.968507 4.003744 udp 10.0.2.105 59039 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:04.968605 4.003646 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:50:05.967666 3.004700 udp 10.0.2.105 59039 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:05.967726 3.004640 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:50:12.977776 0.000306 udp 10.0.2.105 59039 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:12.977914 0.000199 udp 10.0.2.105 59039 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:12.978082 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:50:12.978113 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:50:16.983519 3.755135 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:16.983602 3.755052 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:50:21.490015 3.004589 tcp 10.0.2.105 51406 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:50:21.490090 3.004514 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:50:26.086758 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:50:30.493180 0.000063 tcp 10.0.2.105 51406 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:50:30.493243 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:50:36.493108 3.754248 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:36.493176 3.754180 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:50:40.998514 3.004158 tcp 10.0.2.105 51407 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:50:40.998600 3.004072 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:50:50.000912 0.000090 tcp 10.0.2.105 51407 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:50:50.001002 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:50:54.587636 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:50:56.003037 4.002494 udp 10.0.2.105 52572 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:56.003127 4.002404 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:50:57.001088 3.004621 udp 10.0.2.105 52572 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:50:57.001156 3.004553 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:51:04.011325 0.000082 udp 10.0.2.105 52572 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:04.011407 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:51:04.011523 0.000142 udp 10.0.2.105 52572 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:04.011665 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:51:08.017312 3.754740 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:08.017398 3.754654 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:51:12.523740 2.994162 tcp 10.0.2.105 51408 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:51:12.523818 2.994084 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:51:20.084212 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:51:21.516168 0.000144 tcp 10.0.2.105 51408 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:51:21.516312 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:51:27.526566 3.754191 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:27.526625 3.754132 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:51:32.031756 3.004416 tcp 10.0.2.105 51409 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:51:32.031917 3.004255 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:51:41.034722 0.000078 tcp 10.0.2.105 51409 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:51:41.034800 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:51:45.580947 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:51:47.036981 4.001929 udp 10.0.2.105 52509 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:47.037065 4.001845 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:51:48.034531 3.004408 udp 10.0.2.105 52509 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:48.034605 3.004334 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:51:55.044961 0.000153 udp 10.0.2.105 52509 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:55.045095 0.000198 udp 10.0.2.105 52509 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:55.045114 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:51:55.045293 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:51:59.050385 3.755725 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:51:59.050472 3.755638 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:52:03.557151 3.004184 tcp 10.0.2.105 51410 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:52:03.557256 3.004079 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:52:11.087656 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:52:12.559597 0.000134 tcp 10.0.2.105 51410 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:52:12.559731 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:52:18.560937 3.753136 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:18.561018 3.753055 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:52:23.065205 2.993834 tcp 10.0.2.105 51411 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:52:23.065388 2.993651 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:52:32.057788 0.000214 tcp 10.0.2.105 51411 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:52:32.058002 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:52:36.584040 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:52:38.070055 4.002452 udp 10.0.2.105 55287 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:38.070149 4.002358 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:52:39.067894 3.004717 udp 10.0.2.105 55287 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:39.067956 3.004655 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:52:46.077962 0.000060 udp 10.0.2.105 55287 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:46.078022 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:52:46.078100 0.000035 udp 10.0.2.105 55287 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:46.078135 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:52:50.083951 3.755028 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:52:50.084010 3.754969 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:52:54.590570 3.004252 tcp 10.0.2.105 51412 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:52:54.590693 3.004129 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:53:02.581302 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:53:03.593080 0.000100 tcp 10.0.2.105 51412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:53:03.593180 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:53:09.593386 3.994123 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:09.593445 3.994064 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:53:14.338659 3.004314 tcp 10.0.2.105 51413 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:53:14.338794 3.004179 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 04:53:23.341787 0.000089 tcp 10.0.2.105 51413 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:53:23.341876 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 04:53:28.308477 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:53:29.343218 4.002975 udp 10.0.2.105 49916 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:29.343300 4.002893 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:53:30.341980 3.004390 udp 10.0.2.105 49916 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:30.342078 3.004292 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:53:37.351854 0.000059 udp 10.0.2.105 49916 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:37.351913 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:53:37.351993 0.000137 udp 10.0.2.105 49916 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:37.352130 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:53:41.357729 3.755660 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:53:41.357801 3.755588 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:53:45.864341 2.994206 tcp 10.0.2.105 51414 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:53:45.864424 2.994123 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 04:53:53.805544 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:53:54.856841 0.000070 tcp 10.0.2.105 51414 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:53:54.856911 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 04:54:00.866678 3.754507 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:00.866745 3.754440 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:54:05.372566 2.993980 tcp 10.0.2.105 51415 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:54:05.372637 2.993909 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 04:54:14.375020 0.000083 tcp 10.0.2.105 51415 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:54:14.375103 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 04:54:19.301612 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:54:20.376947 4.002620 udp 10.0.2.105 61246 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:20.377019 4.002548 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:54:21.374971 3.004836 udp 10.0.2.105 61246 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:21.375159 3.004648 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:54:28.385456 0.000061 udp 10.0.2.105 61246 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:28.385517 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:54:28.385595 0.000042 udp 10.0.2.105 61246 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:28.385637 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:54:32.390981 3.755091 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:32.391113 3.754959 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:54:35.628614 3.001374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 04:54:36.897580 3.003719 tcp 10.0.2.105 51416 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:54:36.897709 3.003590 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 04:54:42.635714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:54:44.808255 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:54:45.899919 0.000080 tcp 10.0.2.105 51416 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:54:45.899999 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 04:54:50.636933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:54:51.900050 3.754173 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:54:51.900123 3.754100 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:54:56.406136 3.003708 tcp 10.0.2.105 51417 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:54:56.406221 3.003623 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 04:55:05.408136 0.000136 tcp 10.0.2.105 51417 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:55:05.408272 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 04:55:06.640525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:55:10.305273 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:55:11.410338 4.002461 udp 10.0.2.105 54460 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:11.410477 4.002322 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:55:12.408000 3.005026 udp 10.0.2.105 54460 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:12.408050 3.004976 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:55:19.418245 0.000060 udp 10.0.2.105 54460 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:19.418305 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:55:19.418399 0.000036 udp 10.0.2.105 54460 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:19.418435 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:55:23.424094 3.755815 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:23.424241 3.755668 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:55:27.931027 3.003969 tcp 10.0.2.105 51418 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:55:27.931156 3.003840 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 04:55:35.802171 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:55:36.933446 0.000076 tcp 10.0.2.105 51418 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:55:36.933522 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 04:55:38.646092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 04:55:42.934263 3.753624 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:55:42.934320 3.753567 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:55:47.438667 3.004519 tcp 10.0.2.105 51419 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:55:47.438757 3.004429 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 04:55:56.441710 0.000168 tcp 10.0.2.105 51419 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:55:56.441878 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 04:56:01.308254 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:56:02.444073 4.001832 udp 10.0.2.105 60244 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:02.444155 4.001750 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:56:03.441708 3.004454 udp 10.0.2.105 60244 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:03.441863 3.004299 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:56:10.451808 0.000071 udp 10.0.2.105 60244 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:10.451879 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:56:10.451946 0.000036 udp 10.0.2.105 60244 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:10.451982 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:56:14.457682 3.755597 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:14.457752 3.755527 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:56:18.964503 2.993603 tcp 10.0.2.105 51420 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:56:18.964621 2.993485 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 04:56:26.805253 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:56:27.956581 0.085047 tcp 10.0.2.105 51420 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:56:28.041628 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 04:56:33.986969 3.754386 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:33.987039 3.754316 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:56:38.492222 2.993999 tcp 10.0.2.105 51421 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:56:38.492308 2.993913 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 04:56:47.494909 0.000072 tcp 10.0.2.105 51421 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:56:47.494981 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 04:56:52.322206 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:56:53.498042 4.002014 udp 10.0.2.105 50612 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:53.498118 4.001938 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 04:56:54.495574 3.004511 udp 10.0.2.105 50612 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:56:54.495633 3.004452 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 04:57:01.505551 0.000058 udp 10.0.2.105 50612 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:57:01.505609 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:57:01.505671 0.000038 udp 10.0.2.105 50612 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:57:01.505709 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 04:57:05.511051 3.755232 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:57:05.511124 3.755159 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 04:57:10.017321 3.004337 tcp 10.0.2.105 51422 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:57:10.017388 3.004270 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 04:57:17.828433 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 04:57:19.020044 0.000091 tcp 10.0.2.105 51422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 04:57:19.020135 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 04:57:25.019914 3.754327 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 04:57:25.019982 3.754259 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:01:42.672510 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:01:49.679600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:01:57.680870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:02:13.683993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:02:29.527238 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:02:29.527437 3.004107 tcp 10.0.2.105 51423 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:02:29.527503 3.004041 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:02:38.529551 0.000066 tcp 10.0.2.105 51423 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:02:38.529617 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:02:44.532404 4.001643 udp 10.0.2.105 65364 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:02:44.532473 4.001574 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:02:45.530074 3.004146 udp 10.0.2.105 65364 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:02:45.530135 3.004085 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:02:45.690399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:02:52.539920 0.000086 udp 10.0.2.105 65364 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:02:52.540006 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:02:52.540040 0.000042 udp 10.0.2.105 65364 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:02:52.540082 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:02:53.321357 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:02:56.546134 3.754849 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:02:56.546271 3.754712 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:03:01.052269 2.994007 tcp 10.0.2.105 51424 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:03:01.052388 2.993888 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:03:10.054764 0.000066 tcp 10.0.2.105 51424 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:03:10.054830 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:03:16.055078 3.753765 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:16.055178 3.753665 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:03:20.560652 3.003684 tcp 10.0.2.105 51425 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:03:20.560720 3.003616 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:03:25.326762 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:03:29.562751 0.000153 tcp 10.0.2.105 51425 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:03:29.562904 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:03:35.564069 4.003732 udp 10.0.2.105 54260 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:35.564150 4.003651 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:03:36.563056 3.004902 udp 10.0.2.105 54260 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:36.563148 3.004810 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:03:43.573437 0.000057 udp 10.0.2.105 54260 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:43.573494 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:03:43.573558 0.000057 udp 10.0.2.105 54260 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:43.573615 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:03:47.578833 3.755393 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:03:47.578902 3.755324 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:03:52.086056 2.993755 tcp 10.0.2.105 51426 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:03:52.086126 2.993685 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:03:56.822249 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:04:01.078107 0.000096 tcp 10.0.2.105 51426 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:04:01.078203 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:04:07.088013 3.754426 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:07.088072 3.754367 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:04:11.593581 2.994210 tcp 10.0.2.105 51427 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:04:11.593665 2.994126 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:04:20.586324 0.000084 tcp 10.0.2.105 51427 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:04:20.586408 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:04:25.323104 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:04:26.597974 4.002829 udp 10.0.2.105 50446 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:26.598043 4.002760 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:04:27.596617 3.004298 udp 10.0.2.105 50446 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:27.596690 3.004225 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:04:34.606278 0.000058 udp 10.0.2.105 50446 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:34.606336 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:04:34.606407 0.000035 udp 10.0.2.105 50446 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:34.606442 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:04:38.612368 3.755699 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:38.612440 3.755627 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:04:43.119360 3.003733 tcp 10.0.2.105 51428 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:04:43.119452 3.003641 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:04:50.830257 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:04:52.121813 0.000105 tcp 10.0.2.105 51428 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:04:52.121918 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:04:58.121692 3.754462 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:04:58.121780 3.754374 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:05:02.627347 3.004074 tcp 10.0.2.105 51429 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:05:02.627446 3.003975 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:05:11.630196 0.000132 tcp 10.0.2.105 51429 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:05:11.630328 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:05:16.326584 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:05:17.632122 4.002480 udp 10.0.2.105 61329 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:17.632347 4.002255 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:05:18.629916 3.004822 udp 10.0.2.105 61329 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:18.630011 3.004727 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:05:25.639778 0.000115 udp 10.0.2.105 61329 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:25.639893 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:05:25.639917 0.000040 udp 10.0.2.105 61329 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:25.639957 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:05:29.646266 3.755559 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:29.646333 3.755492 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:05:34.152476 2.993959 tcp 10.0.2.105 51430 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:05:34.152549 2.993886 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:05:41.823308 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:05:43.154944 0.000105 tcp 10.0.2.105 51430 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:05:43.155049 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:05:49.156634 3.753085 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:05:49.156706 3.753013 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:05:53.660372 3.004513 tcp 10.0.2.105 51431 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:05:53.660444 3.004441 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:06:02.663072 2.974099 tcp 10.0.2.105 51431 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:06:05.637171 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:06:08.761631 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:06:10.097982 4.014937 udp 10.0.2.105 56313 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:10.098059 4.014860 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:06:11.095356 3.017713 udp 10.0.2.105 56313 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:11.095470 3.017599 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:06:18.115330 0.000149 udp 10.0.2.105 56313 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:18.115456 0.000151 udp 10.0.2.105 56313 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:18.115479 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:06:18.115607 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:06:22.121356 3.755726 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:22.121444 3.755638 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:06:26.628118 3.004062 tcp 10.0.2.105 51432 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:06:26.628194 3.003986 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:06:34.258641 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:06:35.630872 0.000063 tcp 10.0.2.105 51432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:06:35.630935 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:06:41.630146 3.854697 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:06:41.849824 3.635019 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:06:46.236350 3.004039 tcp 10.0.2.105 51433 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:06:46.236469 3.003920 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:06:55.238966 0.000071 tcp 10.0.2.105 51433 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:06:55.239037 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:06:59.855127 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:07:01.240858 4.002254 udp 10.0.2.105 56998 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:01.240931 4.002181 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:07:02.239313 3.004016 udp 10.0.2.105 56998 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:02.239373 3.003956 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:07:09.249033 0.000161 udp 10.0.2.105 56998 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:09.249171 0.000212 udp 10.0.2.105 56998 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:09.249194 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:07:09.249383 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:07:13.254960 3.755395 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:13.255027 3.755328 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:07:17.761570 3.003828 tcp 10.0.2.105 51434 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:07:17.761652 3.003746 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:07:25.362258 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:07:26.764063 0.000079 tcp 10.0.2.105 51434 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:07:26.764142 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:07:32.764397 3.753656 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:32.764468 3.753585 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:07:37.269724 3.004197 tcp 10.0.2.105 51435 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:07:37.269859 3.004062 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:07:46.272490 0.000076 tcp 10.0.2.105 51435 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:07:46.272566 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:07:50.858784 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:07:52.273184 4.003665 udp 10.0.2.105 58104 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:52.273271 4.003578 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:07:53.272808 3.004167 udp 10.0.2.105 58104 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:07:53.272884 3.004091 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:08:00.282304 0.000072 udp 10.0.2.105 58104 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:00.282376 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:08:00.282435 0.000040 udp 10.0.2.105 58104 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:00.282475 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:08:04.288035 3.755856 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:04.288100 3.755791 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:08:08.794962 2.993792 tcp 10.0.2.105 51436 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:08:08.795043 2.993711 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:08:16.355288 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:08:17.787392 0.000087 tcp 10.0.2.105 51436 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:08:17.787479 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:08:23.797722 3.754081 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:23.797882 3.753921 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:08:28.302820 2.994152 tcp 10.0.2.105 51437 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:08:28.302886 2.994086 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:08:37.305743 0.000061 tcp 10.0.2.105 51437 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:08:37.305804 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:08:41.862497 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:08:43.307892 4.002225 udp 10.0.2.105 60197 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:43.307986 4.002131 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:08:44.305989 3.004229 udp 10.0.2.105 60197 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:44.306061 3.004157 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:08:51.229332 3.000901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:08:51.316038 0.000359 udp 10.0.2.105 60197 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:51.316147 0.000282 udp 10.0.2.105 60197 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:51.316397 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:08:51.316429 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:08:55.321829 3.755325 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:08:55.321901 3.755253 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:08:58.235516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:08:59.828544 3.004083 tcp 10.0.2.105 51438 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:08:59.828612 3.004015 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:09:06.236842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:09:07.359098 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:09:08.831170 0.000184 tcp 10.0.2.105 51438 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:09:08.831354 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:09:14.832300 3.752429 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:14.832375 3.752354 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:09:19.336780 3.003298 tcp 10.0.2.105 51439 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:09:19.336884 3.003194 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:09:22.240009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:09:28.338810 0.000134 tcp 10.0.2.105 51439 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:09:28.338944 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:09:32.855449 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:09:34.340869 4.002670 udp 10.0.2.105 60330 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:34.340949 4.002590 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:09:35.339067 3.004500 udp 10.0.2.105 60330 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:35.339211 3.004356 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:09:42.348914 0.000077 udp 10.0.2.105 60330 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:42.348991 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:09:42.349121 0.000038 udp 10.0.2.105 60330 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:42.349159 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:09:46.355141 3.754839 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:09:46.355200 3.754780 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:09:50.862117 3.003620 tcp 10.0.2.105 51440 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:09:50.862235 3.003502 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:09:54.246124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:09:58.862946 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:09:59.864200 0.000077 tcp 10.0.2.105 51440 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:09:59.864277 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:10:05.864643 3.753548 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:05.864710 3.753481 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:10:10.369866 3.004094 tcp 10.0.2.105 51441 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:10:10.369954 3.004006 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:10:19.372450 0.000072 tcp 10.0.2.105 51441 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:10:19.372522 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:10:24.359134 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:10:25.374646 4.002113 udp 10.0.2.105 49654 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:25.374732 4.002027 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:10:26.372082 3.004781 udp 10.0.2.105 49654 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:26.372158 3.004705 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:10:33.382286 0.000066 udp 10.0.2.105 49654 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:33.382352 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:10:33.382410 0.000041 udp 10.0.2.105 49654 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:33.382451 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:10:37.388243 3.755712 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:37.388354 3.755601 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:10:41.895108 2.993962 tcp 10.0.2.105 51442 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:10:41.895212 2.993858 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:10:49.855918 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:10:50.888223 0.000122 tcp 10.0.2.105 51442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:10:50.888345 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:10:56.897819 3.754265 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:10:56.897936 3.754148 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:14:40.818957 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:14:40.819166 0.000060 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:14:40.819226 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x710b URN 192 1 292 flow=Background 1970/01/08 05:14:56.904751 4.002857 udp 10.0.2.105 63996 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:14:56.904926 4.002682 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:14:57.902724 3.004917 udp 10.0.2.105 63996 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:14:57.902823 3.004818 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:15:04.913176 0.000130 udp 10.0.2.105 63996 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:04.913306 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:15:04.913328 0.000043 udp 10.0.2.105 63996 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:04.913371 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:15:05.853856 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:15:08.918647 3.755537 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:08.918726 3.755458 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:15:13.425435 0.055187 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:13.480622 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x18b7 URN 192 1 162 flow=Background 1970/01/08 05:15:29.930537 3.753521 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:29.930722 3.753336 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:15:34.435709 0.000066 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:34.435775 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5074 URN 192 1 152 flow=Background 1970/01/08 05:15:39.382551 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:15:50.261748 4.002337 udp 10.0.2.105 57166 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:50.261869 4.002216 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:15:51.259302 3.004849 udp 10.0.2.105 57166 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:51.259441 3.004710 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:15:58.269465 0.000077 udp 10.0.2.105 57166 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:58.269542 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:15:58.269623 0.000042 udp 10.0.2.105 57166 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:15:58.269665 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:15:58.272178 3.001971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:16:01.424410 2.994195 tcp 10.0.2.105 51443 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:16:01.424488 2.994117 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:16:02.275282 3.755905 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:02.275469 3.755718 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:16:05.279995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:16:06.381391 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:16:06.782317 0.000060 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:06.782377 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc5 URN 192 1 212 flow=Background 1970/01/08 05:16:10.416842 0.000111 tcp 10.0.2.105 51443 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:16:10.416953 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:16:13.281337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:16:16.426443 3.754484 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:16.426501 3.754426 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:16:20.932783 2.993725 tcp 10.0.2.105 51444 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:16:20.932854 2.993654 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:16:24.268432 3.753690 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:24.268492 3.753630 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:16:28.773391 0.000070 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:28.773461 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4619 URN 192 1 307 flow=Background 1970/01/08 05:16:29.284118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:16:29.934771 0.000079 tcp 10.0.2.105 51444 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:16:29.934850 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:16:33.380073 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:16:35.936007 4.003907 udp 10.0.2.105 63059 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:35.936112 4.003802 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:16:36.935343 3.004742 udp 10.0.2.105 63059 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:36.935422 3.004663 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:16:43.945094 0.000060 udp 10.0.2.105 63059 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:43.945154 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:16:43.945202 0.000036 udp 10.0.2.105 63059 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:43.945238 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:16:47.951373 4.507684 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:47.951432 4.507625 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:16:52.457977 3.004238 tcp 10.0.2.105 51445 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:16:52.458035 3.004180 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:16:53.208559 0.750980 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:53.208624 0.750915 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:16:54.711244 0.000057 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:16:54.711301 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x542c URN 192 1 153 flow=Background 1970/01/08 05:16:57.374181 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:17:01.290486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:17:01.460231 0.000078 tcp 10.0.2.105 51445 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:17:01.460309 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:17:07.460302 3.754172 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:07.460368 3.754106 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:17:11.965892 2.994322 tcp 10.0.2.105 51446 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:17:11.966008 2.994206 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:17:12.918602 3.753973 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:12.918680 3.753895 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:17:17.424045 0.000146 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:17.424191 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x459f URN 192 1 124 flow=Background 1970/01/08 05:17:20.958284 0.000069 tcp 10.0.2.105 51446 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:17:20.958353 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:17:22.380135 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:17:26.970755 4.002273 udp 10.0.2.105 50220 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:26.970956 4.002072 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:17:27.968602 3.004454 udp 10.0.2.105 50220 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:27.968668 3.004388 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:17:34.978323 0.000059 udp 10.0.2.105 50220 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:34.978382 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:17:34.978471 0.000042 udp 10.0.2.105 50220 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:34.978513 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:17:38.984495 4.508526 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:38.984557 4.508464 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:17:43.491630 3.003728 tcp 10.0.2.105 51447 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:17:43.491746 3.003612 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:17:44.241749 0.751571 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:44.241818 0.751502 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:17:45.744675 0.000074 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:45.744749 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc4 URN 192 1 194 flow=Background 1970/01/08 05:17:48.377939 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:17:52.494261 0.000091 tcp 10.0.2.105 51447 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:17:52.494352 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:17:58.495115 4.794019 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:17:58.495236 4.793898 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 05:18:02.999079 3.003878 tcp 10.0.2.105 51448 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:18:02.999151 3.003806 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:18:04.040165 2.253933 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:04.040227 2.253871 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 05:18:07.045650 0.000087 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:07.045737 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd13e URN 192 1 117 flow=Background 1970/01/08 05:18:12.002217 0.000114 tcp 10.0.2.105 51448 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:18:12.002331 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:18:16.878495 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:18:18.002782 4.003191 udp 10.0.2.105 62412 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:18.002858 4.003115 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:18:19.002315 3.003763 udp 10.0.2.105 62412 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:19.002410 3.003668 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:18:26.011694 0.000076 udp 10.0.2.105 62412 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:26.011770 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:18:26.011832 0.000040 udp 10.0.2.105 62412 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:26.011872 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:18:30.017608 4.508528 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:30.017679 4.508457 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:18:34.524943 2.993782 tcp 10.0.2.105 51449 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:18:34.525096 2.993629 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:18:35.275492 0.751257 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:35.275602 0.751147 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:18:36.777771 0.000077 udp 10.0.2.105 7010 -> 71.48.23.198 4217 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:36.777848 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4730 URN 192 1 255 flow=Background 1970/01/08 05:18:41.373869 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:18:43.517293 0.000084 tcp 10.0.2.105 51449 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:18:43.517377 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:18:49.526969 3.754505 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:49.527043 3.754431 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:18:54.032248 2.994084 tcp 10.0.2.105 51450 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:18:54.032329 2.994003 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:18:55.786067 3.754448 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:18:55.786133 3.754382 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:19:00.291890 0.000119 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:00.292009 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x543b URN 192 1 300 flow=Background 1970/01/08 05:19:03.035160 0.000121 tcp 10.0.2.105 51450 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:19:03.035281 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:19:07.882013 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:19:09.037922 4.002019 udp 10.0.2.105 56469 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:09.038013 4.001928 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:19:10.035445 3.004586 udp 10.0.2.105 56469 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:10.035513 3.004518 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:19:17.046235 0.000055 udp 10.0.2.105 56469 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:17.046290 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:19:17.046389 0.000032 udp 10.0.2.105 56469 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:17.046421 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:19:21.051765 4.507520 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:21.051972 4.507313 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:19:25.558129 3.004056 tcp 10.0.2.105 51451 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:19:25.558210 3.003975 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:19:26.308671 0.751162 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:26.308730 0.751103 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:19:27.810925 0.000057 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:27.810982 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x415f URN 192 1 270 flow=Background 1970/01/08 05:19:32.377617 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:19:34.560665 0.000102 tcp 10.0.2.105 51451 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:19:34.560767 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:19:40.560620 4.695376 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:40.560688 4.695308 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 05:19:45.065868 3.003900 tcp 10.0.2.105 51452 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:19:45.065986 3.003782 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:19:46.006923 2.253284 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:46.006983 2.253224 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 05:19:49.011825 0.000078 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:19:49.011903 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 183 flow=Background 1970/01/08 05:19:54.068255 0.000073 tcp 10.0.2.105 51452 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:19:54.068328 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:19:58.875544 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:20:00.070912 4.002675 udp 10.0.2.105 56868 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:00.071004 4.002583 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:20:01.068502 3.005114 udp 10.0.2.105 56868 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:01.068588 3.005028 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:20:08.078945 0.000059 udp 10.0.2.105 56868 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:08.079004 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:20:08.079083 0.000135 udp 10.0.2.105 56868 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:08.079218 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:20:12.084672 4.507961 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:12.084761 4.507872 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:20:16.591448 3.004156 tcp 10.0.2.105 51453 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:20:16.591526 3.004078 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:20:17.342073 0.751009 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:17.342133 0.750949 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:20:18.844602 0.000061 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:18.844663 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd927 URN 192 1 194 flow=Background 1970/01/08 05:20:23.380932 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:20:25.593852 0.000071 tcp 10.0.2.105 51453 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:20:25.593923 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:20:31.593241 4.956734 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:31.593328 4.956647 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 05:20:36.099663 3.003717 tcp 10.0.2.105 51454 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:20:36.099761 3.003619 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:20:37.300720 2.253355 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:37.300782 2.253293 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 05:20:40.305468 0.000110 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:40.305578 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5bcf URN 192 1 243 flow=Background 1970/01/08 05:20:45.102125 0.000080 tcp 10.0.2.105 51454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:20:45.102205 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:20:49.879117 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:20:51.104276 4.002462 udp 10.0.2.105 50318 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:51.104357 4.002381 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:20:52.101706 3.005092 udp 10.0.2.105 50318 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:52.101768 3.005030 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:20:59.111848 0.000060 udp 10.0.2.105 50318 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:59.111908 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:20:59.111994 0.000037 udp 10.0.2.105 50318 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:20:59.112031 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:21:03.117700 4.509623 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:03.117762 4.509561 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:21:07.625000 2.993675 tcp 10.0.2.105 51455 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:21:07.627288 2.991387 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:21:08.375583 0.751033 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:08.375727 0.750889 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:21:09.877727 0.000161 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:09.877888 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6301 URN 192 1 162 flow=Background 1970/01/08 05:21:14.875012 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:21:16.617391 0.000091 tcp 10.0.2.105 51455 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:21:16.617482 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:21:22.627047 4.886968 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:22.627124 4.886891 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:21:27.132452 2.994400 tcp 10.0.2.105 51456 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:21:27.132523 2.994329 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:21:28.263910 0.751947 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:28.263969 0.751888 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:21:29.766698 0.000068 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:29.766766 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6380 URN 192 1 266 flow=Background 1970/01/08 05:21:36.135093 0.000099 tcp 10.0.2.105 51456 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:21:36.135192 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:21:40.881801 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:21:42.137711 4.001883 udp 10.0.2.105 63531 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:42.137791 4.001803 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:21:43.135210 3.004601 udp 10.0.2.105 63531 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:43.135272 3.004539 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:21:50.145176 0.000062 udp 10.0.2.105 63531 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:50.145238 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:21:50.145304 0.000041 udp 10.0.2.105 63531 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:50.145345 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:21:54.151188 4.507793 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:54.151268 4.507713 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:21:58.657900 3.004051 tcp 10.0.2.105 51457 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:21:58.658001 3.003950 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:21:59.408595 0.751432 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:21:59.408670 0.751357 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:22:00.911317 0.000076 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:00.911393 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x51ae URN 192 1 195 flow=Background 1970/01/08 05:22:05.877832 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:22:07.660843 0.000108 tcp 10.0.2.105 51457 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:22:07.660951 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:22:13.660966 4.626565 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 7 644 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:13.661152 4.626379 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 7 840 flow=Background 1970/01/08 05:22:18.166275 3.004115 tcp 10.0.2.105 51458 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:22:18.166397 3.003993 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:22:19.037277 3.004290 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 5 460 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:19.037421 3.004146 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 5 600 flow=Background 1970/01/08 05:22:22.793004 0.000139 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:22.793143 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6c59 URN 192 1 300 flow=Background 1970/01/08 05:22:27.168861 0.000128 tcp 10.0.2.105 51458 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:22:27.168989 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:22:31.875816 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:22:33.170851 4.002622 udp 10.0.2.105 56976 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:33.170970 4.002503 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:22:34.168702 3.004797 udp 10.0.2.105 56976 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:34.168765 3.004734 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:22:41.179094 0.000057 udp 10.0.2.105 56976 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:41.179151 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:22:41.179217 0.000037 udp 10.0.2.105 56976 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:41.179254 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:22:45.184906 4.508239 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:45.185014 4.508131 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:22:49.691898 3.003809 tcp 10.0.2.105 51459 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:22:49.692017 3.003690 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:22:50.442642 0.750374 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:50.442754 0.750262 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:22:51.944596 0.000089 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:22:51.944685 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb8b6 URN 192 1 230 flow=Background 1970/01/08 05:22:56.881570 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:22:58.693977 0.000091 tcp 10.0.2.105 51459 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:22:58.694068 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:23:04.693878 4.926253 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:04.693973 4.926158 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 05:23:05.295844 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:23:09.199640 3.004106 tcp 10.0.2.105 51460 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:23:09.199737 3.004009 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:23:10.371144 2.252742 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:10.371227 2.252659 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 05:23:12.303906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:23:13.375732 0.000073 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:13.375805 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4cd4 URN 192 1 150 flow=Background 1970/01/08 05:23:18.201753 0.000090 tcp 10.0.2.105 51460 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:23:18.201843 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:23:20.305557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:23:22.879061 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:23:24.204033 4.002212 udp 10.0.2.105 55946 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:24.204107 4.002138 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:23:25.202088 3.004259 udp 10.0.2.105 55946 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:25.202233 3.004114 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:23:32.212103 0.000445 udp 10.0.2.105 55946 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:32.212388 0.000192 udp 10.0.2.105 55946 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:32.212548 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:23:32.212580 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:23:36.218359 4.507318 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:36.218499 4.507178 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:23:36.308316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:23:40.724731 2.994178 tcp 10.0.2.105 51461 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:23:40.724809 2.994100 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:23:41.475739 0.751055 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:41.475831 0.750963 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:23:42.978276 0.000065 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:42.978341 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd326 URN 192 1 154 flow=Background 1970/01/08 05:23:47.874689 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:23:49.717247 0.000122 tcp 10.0.2.105 51461 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:23:49.717369 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:23:55.727022 4.365123 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:23:55.727122 4.365023 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 05:24:00.232797 2.994103 tcp 10.0.2.105 51462 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:24:00.232880 2.994020 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:24:00.843748 2.252645 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:00.843849 2.252544 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 05:24:03.848091 0.000163 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:03.848254 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5604 URN 192 1 209 flow=Background 1970/01/08 05:24:08.314307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:24:09.235597 0.000074 tcp 10.0.2.105 51462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:24:09.235671 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:24:13.882035 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:24:15.239204 4.000435 udp 10.0.2.105 62154 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:15.239322 4.000317 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:24:16.235804 3.004029 udp 10.0.2.105 62154 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:16.235870 3.003963 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:24:23.245671 0.000072 udp 10.0.2.105 62154 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:23.245743 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:24:23.245809 0.000178 udp 10.0.2.105 62154 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:23.245987 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:24:27.251996 4.507457 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:27.252058 4.507395 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 05:24:32.509012 0.751355 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:32.509149 0.751218 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 05:24:34.011435 0.000074 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:34.011509 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4618 URN 192 1 268 flow=Background 1970/01/08 05:24:38.877935 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:24:51.337061 3.754676 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:51.337132 3.754605 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:24:55.842832 0.000058 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:24:55.842890 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 209 flow=Background 1970/01/08 05:25:12.149811 4.002284 udp 10.0.2.105 52563 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:12.149928 4.002167 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:25:13.147331 3.004900 udp 10.0.2.105 52563 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:13.147509 3.004722 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:25:16.882879 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:25:20.157237 0.000286 udp 10.0.2.105 52563 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:20.157377 0.000173 udp 10.0.2.105 52563 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:20.157523 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:25:20.157550 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:25:24.163384 3.755025 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:24.163441 3.754968 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:25:28.670290 0.000084 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:28.670374 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb895 URN 192 1 128 flow=Background 1970/01/08 05:25:46.286298 3.754043 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:46.286396 3.753945 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:25:50.792078 0.000090 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:25:50.792168 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd929 URN 192 1 189 flow=Background 1970/01/08 05:25:55.377838 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:26:08.028870 4.040797 udp 10.0.2.105 55300 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:08.028956 4.040711 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:26:09.028002 3.042725 udp 10.0.2.105 55300 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:09.028099 3.042628 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:26:16.067757 0.000146 udp 10.0.2.105 55300 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:16.067882 0.000064 udp 10.0.2.105 55300 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:16.067903 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:26:16.067946 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:26:20.074109 3.755095 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:20.074213 3.754991 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:26:20.874830 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:26:24.580776 0.000061 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:24.580837 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x547f URN 192 1 307 flow=Background 1970/01/08 05:26:40.043605 3.754165 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:40.043682 3.754088 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:26:44.549004 0.000062 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:26:44.549066 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4636 URN 192 1 160 flow=Background 1970/01/08 05:26:49.375905 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:27:00.705504 4.002377 udp 10.0.2.105 62845 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:00.705590 4.002291 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:27:01.703538 3.004441 udp 10.0.2.105 62845 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:01.703601 3.004378 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:27:08.713845 0.000058 udp 10.0.2.105 62845 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:08.713903 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:27:08.714014 0.000036 udp 10.0.2.105 62845 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:08.714050 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:27:12.719131 3.755255 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:12.719206 3.755180 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:27:13.380390 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:27:17.226332 0.000098 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:17.226430 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4634 URN 192 1 208 flow=Background 1970/01/08 05:27:35.884632 3.753676 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:35.884698 3.753610 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:27:40.389077 0.000062 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:40.389139 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc1 URN 192 1 306 flow=Background 1970/01/08 05:27:45.376574 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:27:57.106058 4.002950 udp 10.0.2.105 59093 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:57.106135 4.002873 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:27:58.104731 3.004377 udp 10.0.2.105 59093 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:27:58.104826 3.004282 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:28:05.114750 0.000117 udp 10.0.2.105 59093 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:05.114867 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:28:05.114902 0.000041 udp 10.0.2.105 59093 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:05.114943 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:28:09.120212 3.835565 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:09.329390 3.626387 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:28:09.961214 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:28:13.707423 0.000097 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:13.707520 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x02e4 URN 192 1 262 flow=Background 1970/01/08 05:28:31.683908 3.834177 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:31.684069 3.834016 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:28:36.269381 0.000097 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:36.269478 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x3a44 URN 192 1 131 flow=Background 1970/01/08 05:28:41.015872 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:28:52.225560 4.002577 udp 10.0.2.105 63734 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:52.225678 4.002459 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:28:53.223689 3.004679 udp 10.0.2.105 63734 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:28:53.223854 3.004514 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:29:00.233896 0.000247 udp 10.0.2.105 63734 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:00.234010 0.000165 udp 10.0.2.105 63734 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:00.234143 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:29:00.234175 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:29:04.239631 3.755334 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:04.239695 3.755270 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:29:05.021119 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:29:31.899898 3.004116 tcp 10.0.2.105 51463 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:29:31.899979 3.004035 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:29:36.515662 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:29:40.902407 0.000101 tcp 10.0.2.105 51463 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:29:40.902508 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:29:46.904137 4.002764 udp 10.0.2.105 58254 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:46.904263 4.002638 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:29:47.902827 3.004298 udp 10.0.2.105 58254 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:47.902885 3.004240 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:29:54.912200 0.000120 udp 10.0.2.105 58254 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:54.912320 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:29:54.912352 0.000038 udp 10.0.2.105 58254 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:54.912390 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:29:58.918699 3.755331 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:29:58.918752 3.755278 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:30:03.425394 2.993900 tcp 10.0.2.105 51464 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:30:03.425473 2.993821 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:30:08.021761 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:30:12.417417 0.000150 tcp 10.0.2.105 51464 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:30:12.417567 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:30:12.460080 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:30:18.427858 3.753796 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:18.427916 3.753738 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:30:19.467526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:30:22.932922 2.994614 tcp 10.0.2.105 51465 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:30:22.933016 2.994520 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:30:27.469572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:30:31.935955 0.000072 tcp 10.0.2.105 51465 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:30:31.936027 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:30:36.521997 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:30:37.938599 4.001627 udp 10.0.2.105 64650 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:37.938684 4.001542 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:30:38.936118 3.004146 udp 10.0.2.105 64650 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:38.936182 3.004082 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:30:43.471998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:30:45.946088 0.000061 udp 10.0.2.105 64650 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:45.946149 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:30:45.946293 0.000041 udp 10.0.2.105 64650 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:45.946334 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:30:49.952165 3.755158 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:30:49.952226 3.755097 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:30:54.458182 3.004488 tcp 10.0.2.105 51466 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:30:54.458272 3.004398 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:31:02.018934 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:31:03.461341 0.000079 tcp 10.0.2.105 51466 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:31:03.461420 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:31:09.461078 3.754164 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:09.461137 3.754105 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:31:13.966102 3.004285 tcp 10.0.2.105 51467 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:31:13.966178 3.004209 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:31:15.478555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:31:22.969417 0.000109 tcp 10.0.2.105 51467 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:31:22.969526 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:31:27.515258 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:31:28.970720 4.003124 udp 10.0.2.105 54992 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:28.970797 4.003047 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:31:29.969493 3.004442 udp 10.0.2.105 54992 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:29.969559 3.004376 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:31:36.979448 0.000061 udp 10.0.2.105 54992 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:36.979509 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:31:36.979579 0.000040 udp 10.0.2.105 54992 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:36.979619 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:31:40.984974 3.755367 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:31:40.985046 3.755295 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:31:45.491403 3.004550 tcp 10.0.2.105 51468 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:31:45.491476 3.004477 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:31:53.022060 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:31:54.494694 0.000086 tcp 10.0.2.105 51468 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:31:54.494780 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:32:00.494285 3.754418 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:00.494352 3.754351 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:32:04.999881 3.004125 tcp 10.0.2.105 51469 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:32:04.999964 3.004042 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:32:14.002164 0.000171 tcp 10.0.2.105 51469 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:32:14.002335 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:32:18.518673 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:32:20.004357 4.002792 udp 10.0.2.105 54469 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:20.004433 4.002716 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:32:21.002789 3.004469 udp 10.0.2.105 54469 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:21.002856 3.004402 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:32:28.012528 0.000055 udp 10.0.2.105 54469 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:28.012583 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:32:28.012647 0.000040 udp 10.0.2.105 54469 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:28.012687 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:32:32.018486 3.755665 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:32.018542 3.755609 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:32:36.524939 2.994522 tcp 10.0.2.105 51470 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:32:36.525099 2.994362 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:32:44.516556 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:32:45.517425 0.000105 tcp 10.0.2.105 51470 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:32:45.517530 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:32:51.527228 3.754344 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:32:51.527336 3.754236 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:32:56.033088 2.993899 tcp 10.0.2.105 51471 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:32:56.033181 2.993806 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:33:05.036154 0.000077 tcp 10.0.2.105 51471 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:33:05.036231 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:33:10.022942 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:33:11.037354 4.003050 udp 10.0.2.105 60384 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:11.037427 4.002977 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:33:12.035759 3.004671 udp 10.0.2.105 60384 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:12.035841 3.004589 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:33:19.045656 0.000139 udp 10.0.2.105 60384 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:19.045772 0.000058 udp 10.0.2.105 60384 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:19.045795 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:33:19.045830 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:33:23.051679 3.755508 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:23.051751 3.755436 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:33:27.558763 3.004185 tcp 10.0.2.105 51472 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:33:27.558898 3.004050 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:33:35.519639 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:33:36.561544 0.000090 tcp 10.0.2.105 51472 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:33:36.561634 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:33:42.561465 3.753977 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:33:42.561533 3.753909 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:33:47.066941 3.003593 tcp 10.0.2.105 51473 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:33:47.067024 3.003510 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:33:56.069507 0.000077 tcp 10.0.2.105 51473 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:33:56.069584 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:34:01.015977 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:34:02.071965 4.001986 udp 10.0.2.105 52134 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:02.072063 4.001888 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:34:03.068973 3.005062 udp 10.0.2.105 52134 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:03.069097 3.004938 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:34:10.079058 0.000104 udp 10.0.2.105 52134 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:10.079162 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:34:10.079196 0.000042 udp 10.0.2.105 52134 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:10.079238 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:34:14.085517 3.755336 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:14.085600 3.755253 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:34:18.591955 2.994111 tcp 10.0.2.105 51474 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:34:18.592065 2.994001 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:34:26.523125 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:34:27.594322 0.000071 tcp 10.0.2.105 51474 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:34:27.594393 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:34:33.594833 3.754068 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:33.594952 3.753949 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:34:38.100060 3.003988 tcp 10.0.2.105 51475 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:34:38.100126 3.003922 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:34:47.102689 0.000073 tcp 10.0.2.105 51475 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:34:47.102762 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:34:52.019924 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:34:53.104978 4.002294 udp 10.0.2.105 52544 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:53.105057 4.002215 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:34:54.102713 3.004660 udp 10.0.2.105 52544 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:34:54.102783 3.004590 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:35:01.112572 0.000051 udp 10.0.2.105 52544 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:01.112623 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:35:01.112707 0.000040 udp 10.0.2.105 52544 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:01.112747 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:35:05.118762 3.755190 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:05.118826 3.755126 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:35:09.625104 2.994683 tcp 10.0.2.105 51476 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:35:09.625182 2.994605 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:35:17.516101 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:35:18.617952 0.000111 tcp 10.0.2.105 51476 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:35:18.618063 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:35:24.628121 3.754006 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:24.628419 3.753708 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:35:29.133420 2.994123 tcp 10.0.2.105 51477 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:35:29.133553 2.993990 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:35:38.135872 0.000132 tcp 10.0.2.105 51477 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:35:38.136004 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:35:43.022676 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:35:44.137775 4.002582 udp 10.0.2.105 49581 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:44.137845 4.002512 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:35:45.136397 3.004042 udp 10.0.2.105 49581 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:45.136454 3.003985 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:35:52.145978 0.000093 udp 10.0.2.105 49581 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:52.146071 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:35:52.146110 0.000049 udp 10.0.2.105 49581 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:52.146159 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:35:56.151838 3.755140 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:35:56.151915 3.755063 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:36:00.658521 3.004311 tcp 10.0.2.105 51478 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:36:00.658650 3.004182 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:36:08.519704 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:36:09.661583 0.633373 tcp 10.0.2.105 51478 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:36:10.294956 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:36:15.951249 3.754786 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:15.951405 3.754630 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:36:20.457038 3.004434 tcp 10.0.2.105 51479 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:36:20.457125 3.004347 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:36:29.459956 0.000094 tcp 10.0.2.105 51479 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:36:29.460050 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:36:34.306643 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:36:35.461493 4.002652 udp 10.0.2.105 52683 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:35.461576 4.002569 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:36:36.460183 3.004211 udp 10.0.2.105 52683 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:36.460508 3.003886 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:36:43.470050 0.000066 udp 10.0.2.105 52683 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:43.470116 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:36:43.470251 0.000137 udp 10.0.2.105 52683 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:43.470388 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:36:47.476456 3.754358 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:36:47.476537 3.754277 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:36:51.982446 2.994143 tcp 10.0.2.105 51480 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:36:51.982524 2.994065 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:36:59.813608 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:37:00.985072 0.000069 tcp 10.0.2.105 51480 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:37:00.985141 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:37:06.986446 3.752628 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:06.986510 3.752564 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:37:11.490172 3.004070 tcp 10.0.2.105 51481 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:37:11.490246 3.003996 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:37:19.774674 3.001448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:37:20.493072 0.000065 tcp 10.0.2.105 51481 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:37:20.493137 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:37:25.309677 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:37:26.494840 4.003101 udp 10.0.2.105 59438 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:26.494934 4.003007 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:37:26.782425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:37:27.492977 3.005076 udp 10.0.2.105 59438 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:27.493048 3.005005 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:37:34.503627 0.000071 udp 10.0.2.105 59438 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:34.503698 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:37:34.503757 0.000043 udp 10.0.2.105 59438 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:34.503800 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:37:34.783536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:37:38.508836 3.755554 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:38.508913 3.755477 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:37:43.015726 2.994164 tcp 10.0.2.105 51482 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:37:43.015806 2.994084 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:37:50.786475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:37:50.806444 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:37:52.008486 0.000106 tcp 10.0.2.105 51482 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:37:52.008592 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:37:58.018880 3.753715 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:37:58.018985 3.753610 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:38:22.792683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:43:02.526076 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:43:02.526349 2.993318 tcp 10.0.2.105 51483 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:43:02.526462 2.993205 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:43:11.517508 0.000113 tcp 10.0.2.105 51483 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:43:11.517621 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:43:17.530050 4.062056 udp 10.0.2.105 52076 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:17.530115 4.061991 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:43:18.528086 3.064288 udp 10.0.2.105 52076 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:18.588706 3.003668 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:43:25.597738 0.000054 udp 10.0.2.105 52076 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:25.597792 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:43:25.597871 0.000034 udp 10.0.2.105 52076 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:25.597905 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:43:26.328978 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:43:29.604131 4.125478 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:30.367957 3.361652 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:43:34.480903 3.004221 tcp 10.0.2.105 51484 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:43:34.480976 3.004148 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:43:43.483727 0.000062 tcp 10.0.2.105 51484 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:43:43.483789 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:43:49.483852 3.754176 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:43:49.483911 3.754117 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:43:53.989315 3.004050 tcp 10.0.2.105 51485 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:43:53.989376 3.003989 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:43:58.695637 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:44:02.991832 0.000086 tcp 10.0.2.105 51485 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:44:02.991918 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:44:08.994110 4.001946 udp 10.0.2.105 58305 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:08.994182 4.001874 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:44:09.991688 3.004490 udp 10.0.2.105 58305 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:09.991838 3.004340 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:44:17.002041 0.000062 udp 10.0.2.105 58305 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:17.002103 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:44:17.002220 0.000035 udp 10.0.2.105 58305 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:17.002255 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:44:21.008235 3.755297 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:21.008297 3.755235 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:44:25.514308 2.994075 tcp 10.0.2.105 51486 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:44:25.514376 2.994007 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:44:27.190068 3.000742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:44:30.200765 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:44:34.196711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:44:34.506954 0.000099 tcp 10.0.2.105 51486 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:44:34.507053 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:44:40.516911 3.784155 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:44:40.605380 3.695686 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:44:42.227929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:44:45.053025 2.993972 tcp 10.0.2.105 51487 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:44:45.053094 2.993903 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:44:54.055361 0.000075 tcp 10.0.2.105 51487 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:44:54.055436 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:44:58.231343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:44:58.731882 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:45:00.057639 4.002090 udp 10.0.2.105 49259 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:00.057718 4.002011 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:45:01.055457 3.004294 udp 10.0.2.105 49259 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:01.055520 3.004231 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:45:08.065464 0.000069 udp 10.0.2.105 49259 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:08.065533 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:45:08.065588 0.000082 udp 10.0.2.105 49259 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:08.065670 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:45:12.071295 3.755035 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:12.071392 3.754938 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:45:16.578058 3.004266 tcp 10.0.2.105 51488 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:45:16.578125 3.004199 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:45:24.228823 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:45:25.580753 0.000080 tcp 10.0.2.105 51488 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:45:25.580833 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:45:30.237104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:45:31.580499 3.764243 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:31.580703 3.764039 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:45:36.095826 2.994342 tcp 10.0.2.105 51489 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:45:36.095895 2.994273 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:45:45.088644 0.000083 tcp 10.0.2.105 51489 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:45:45.088727 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:45:49.735440 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:45:51.100451 4.002548 udp 10.0.2.105 63366 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:51.100529 4.002470 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:45:52.099042 3.004116 udp 10.0.2.105 63366 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:52.099092 3.004066 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:45:59.108755 0.000266 udp 10.0.2.105 63366 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:59.108882 0.000166 udp 10.0.2.105 63366 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:45:59.109021 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:45:59.109048 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:46:03.114967 3.935517 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:03.115028 3.935456 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:46:07.801715 3.004196 tcp 10.0.2.105 51490 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:46:07.801809 3.004102 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:46:15.402045 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:46:16.804016 0.000155 tcp 10.0.2.105 51490 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:46:16.804171 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:46:22.805043 3.753045 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:22.805118 3.752970 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:46:27.309731 3.004256 tcp 10.0.2.105 51491 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:46:27.309808 3.004179 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:46:36.312254 0.000087 tcp 10.0.2.105 51491 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:46:36.312341 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:46:40.898492 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:46:42.314045 4.002623 udp 10.0.2.105 57023 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:42.314141 4.002527 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:46:43.312346 3.004449 udp 10.0.2.105 57023 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:43.312416 3.004379 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:46:50.322268 0.000055 udp 10.0.2.105 57023 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:50.322323 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:46:50.322459 0.000036 udp 10.0.2.105 57023 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:50.322495 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:46:54.328460 3.755178 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:46:54.328519 3.755119 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:46:58.835232 2.994083 tcp 10.0.2.105 51492 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:46:58.835352 2.993963 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:47:06.395505 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:47:07.827901 0.000068 tcp 10.0.2.105 51492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:47:07.827969 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:47:13.837416 3.754311 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:13.837485 3.754242 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:47:18.343302 2.993917 tcp 10.0.2.105 51493 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:47:18.343380 2.993839 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:47:27.345462 0.000144 tcp 10.0.2.105 51493 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:47:27.345606 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:47:31.902542 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:47:33.346659 4.003327 udp 10.0.2.105 63348 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:33.346740 4.003246 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:47:34.345893 3.004197 udp 10.0.2.105 63348 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:34.345946 3.004144 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:47:41.355628 0.000049 udp 10.0.2.105 63348 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:41.355677 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:47:41.355722 0.000027 udp 10.0.2.105 63348 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:41.355749 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:47:45.361620 3.763124 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:47:45.361695 3.763049 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:47:49.868547 3.003640 tcp 10.0.2.105 51494 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:47:49.868625 3.003562 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:47:57.398816 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:47:58.871012 0.000156 tcp 10.0.2.105 51494 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:47:58.871168 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:48:04.870955 3.754286 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:04.871068 3.754173 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:48:09.376494 3.004179 tcp 10.0.2.105 51495 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:48:09.376577 3.004096 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:48:18.379303 0.000063 tcp 10.0.2.105 51495 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:48:18.379366 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:48:22.895443 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:48:24.381226 4.002441 udp 10.0.2.105 55547 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:24.381298 4.002369 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:48:25.379065 3.004714 udp 10.0.2.105 55547 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:25.379134 3.004645 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:48:32.389433 0.000092 udp 10.0.2.105 55547 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:32.389525 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:48:32.389558 0.000034 udp 10.0.2.105 55547 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:32.389592 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:48:36.394933 3.755661 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:36.394988 3.755606 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:48:40.901999 3.003792 tcp 10.0.2.105 51496 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:48:40.902074 3.003717 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:48:48.902828 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:48:49.904339 0.000083 tcp 10.0.2.105 51496 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:48:49.904422 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:48:55.904080 4.224613 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:48:55.904166 4.224527 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:49:00.649793 3.004206 tcp 10.0.2.105 51497 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:49:00.649910 3.004089 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:49:09.652734 0.000133 tcp 10.0.2.105 51497 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:49:09.652867 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:49:14.619648 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:49:15.654558 4.002538 udp 10.0.2.105 54611 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:15.654625 4.002471 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:49:16.652929 3.004291 udp 10.0.2.105 54611 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:16.652979 3.004241 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:49:23.663174 0.000050 udp 10.0.2.105 54611 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:23.663224 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:49:23.663311 0.000035 udp 10.0.2.105 54611 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:23.663346 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:49:27.668934 3.755424 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:27.668987 3.755371 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:49:32.175297 2.994402 tcp 10.0.2.105 51498 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:49:32.175373 2.994326 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:49:40.116165 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:49:41.167712 0.000076 tcp 10.0.2.105 51498 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:49:41.167788 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:49:47.179688 3.752339 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:49:47.179757 3.752270 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:49:51.683165 2.994748 tcp 10.0.2.105 51499 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:49:51.683259 2.994654 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:50:00.686205 0.000099 tcp 10.0.2.105 51499 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:50:00.686304 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:50:05.623071 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:50:06.687980 4.002272 udp 10.0.2.105 56194 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:06.688051 4.002201 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:50:07.685981 3.004344 udp 10.0.2.105 56194 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:07.686036 3.004289 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:50:14.696067 0.000071 udp 10.0.2.105 56194 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:14.696138 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:50:14.696242 0.000038 udp 10.0.2.105 56194 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:14.696280 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:50:18.702416 3.754763 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:18.702527 3.754652 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:50:23.208742 3.004480 tcp 10.0.2.105 51500 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:50:23.208803 3.004419 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:50:31.120177 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:50:32.211493 0.000066 tcp 10.0.2.105 51500 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:50:32.211559 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:50:38.211578 3.754086 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:38.211767 3.753897 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:50:42.716631 3.004301 tcp 10.0.2.105 51501 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:50:42.716699 3.004233 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 05:50:51.719514 0.000159 tcp 10.0.2.105 51501 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:50:51.719673 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 05:50:56.616803 0.000286 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:50:57.721616 4.002349 udp 10.0.2.105 55432 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:57.721680 4.002285 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:50:58.719378 3.004696 udp 10.0.2.105 55432 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:50:58.719487 3.004587 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:51:05.730110 0.000115 udp 10.0.2.105 55432 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:51:05.730225 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:51:05.730268 0.000063 udp 10.0.2.105 55432 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:51:05.730331 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:51:09.735916 3.755042 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:51:09.736004 3.754954 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:51:14.242307 3.004102 tcp 10.0.2.105 51502 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:51:14.242383 3.004026 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 05:51:22.123421 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:51:23.254628 0.000132 tcp 10.0.2.105 51502 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:51:23.254760 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 05:51:29.245004 3.753552 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:51:29.245096 3.753460 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:51:34.634652 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:51:41.641258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:51:49.642962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:52:05.646011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:52:37.651938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:56:33.752341 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:56:33.752564 3.003176 tcp 10.0.2.105 51503 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:56:33.752630 3.003110 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 05:56:42.753928 0.000065 tcp 10.0.2.105 51503 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:56:42.753993 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 05:56:48.756640 4.001701 udp 10.0.2.105 60360 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:56:48.756705 4.001636 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:56:49.754298 3.004127 udp 10.0.2.105 60360 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:56:49.754351 3.004074 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:56:56.764151 0.000191 udp 10.0.2.105 60360 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:56:56.764342 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:56:56.764434 0.000052 udp 10.0.2.105 60360 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:56:56.764486 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:56:57.615362 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:57:00.769945 3.755822 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:00.770005 3.755762 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:57:05.276586 3.004279 tcp 10.0.2.105 51504 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:57:05.276669 3.004196 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 05:57:14.279850 0.000163 tcp 10.0.2.105 51504 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:57:14.280013 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 05:57:20.279177 3.754678 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:20.279256 3.754599 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:57:24.785185 2.993643 tcp 10.0.2.105 51505 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:57:24.785275 2.993553 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 05:57:29.621655 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:57:33.777208 0.000062 tcp 10.0.2.105 51505 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:57:33.777270 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 05:57:39.788873 4.003109 udp 10.0.2.105 55160 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:39.788962 4.003020 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:57:40.787327 3.004769 udp 10.0.2.105 55160 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:40.787376 3.004720 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:57:47.797390 0.000083 udp 10.0.2.105 55160 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:47.797473 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:57:47.797553 0.000034 udp 10.0.2.105 55160 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:47.797587 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:57:51.803561 3.755457 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:57:51.803621 3.755397 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:57:56.310497 3.003501 tcp 10.0.2.105 51506 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:57:56.310576 3.003422 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 05:58:01.116902 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:58:05.313141 0.000066 tcp 10.0.2.105 51506 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:58:05.313207 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 05:58:11.312791 3.754458 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:11.312849 3.754400 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:58:15.818158 3.004277 tcp 10.0.2.105 51507 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:58:15.818224 3.004211 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 05:58:24.820753 0.000084 tcp 10.0.2.105 51507 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:58:24.820837 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 05:58:29.617919 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:58:30.822808 4.002607 udp 10.0.2.105 54808 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:30.822888 4.002527 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:58:31.821024 3.004675 udp 10.0.2.105 54808 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:31.821081 3.004618 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:58:38.830767 0.000074 udp 10.0.2.105 54808 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:38.830841 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:58:38.830890 0.000051 udp 10.0.2.105 54808 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:38.830941 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:58:41.658287 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 05:58:42.836914 3.755324 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:58:42.836970 3.755268 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:58:47.343280 2.994638 tcp 10.0.2.105 51508 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:58:47.343371 2.994547 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 05:58:48.665294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:58:55.114428 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:58:56.336267 0.000071 tcp 10.0.2.105 51508 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:58:56.336338 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 05:58:56.666416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:59:02.346550 3.753955 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:02.346621 3.753884 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:59:06.852006 3.003467 tcp 10.0.2.105 51509 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:59:06.852079 3.003394 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 05:59:12.669496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:59:15.853971 0.000089 tcp 10.0.2.105 51509 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:59:15.854060 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 05:59:20.621550 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:59:21.856739 4.002281 udp 10.0.2.105 53365 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:21.856831 4.002189 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 05:59:22.854327 3.004758 udp 10.0.2.105 53365 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:22.854395 3.004690 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 05:59:27.651674 0.000168 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:27.651842 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x710b URN 192 1 313 flow=Background 1970/01/08 05:59:29.864885 0.000075 udp 10.0.2.105 53365 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:29.864960 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:59:29.865061 0.000039 udp 10.0.2.105 53365 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:29.865100 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 05:59:33.870501 3.755113 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:33.870553 3.755061 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:59:38.376903 3.003930 tcp 10.0.2.105 51510 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:59:38.377639 3.003194 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 05:59:44.676059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 05:59:46.117938 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 05:59:46.149271 3.753998 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:46.149341 3.753928 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:59:47.380035 0.000067 tcp 10.0.2.105 51510 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:59:47.380102 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 05:59:50.654487 0.000053 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:50.654540 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x18b7 URN 192 1 267 flow=Background 1970/01/08 05:59:53.378980 3.754824 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 05:59:53.379059 3.754745 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 05:59:57.884880 2.994397 tcp 10.0.2.105 51511 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 05:59:57.884958 2.994319 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:00:06.091124 4.001105 udp 10.0.2.105 50820 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:06.091212 4.001017 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:00:06.877801 0.000080 tcp 10.0.2.105 51511 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:00:06.877881 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:00:07.088219 3.004194 udp 10.0.2.105 50820 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:07.088275 3.004138 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:00:10.622699 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:00:14.098128 0.000052 udp 10.0.2.105 50820 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:14.098180 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:00:14.098242 0.000048 udp 10.0.2.105 50820 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:14.098290 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:00:18.103768 4.508109 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:18.103888 4.507989 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:00:22.610679 0.000055 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:22.610734 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5074 URN 192 1 203 flow=Background 1970/01/08 06:00:23.361509 0.751279 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:23.361567 0.751221 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:00:24.864231 2.993849 tcp 10.0.2.105 51512 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:00:24.864321 2.993759 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:00:33.856130 0.000225 tcp 10.0.2.105 51512 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:00:33.856355 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:00:38.623180 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:00:39.816468 4.507233 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:39.816536 4.507165 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:00:44.322835 0.000062 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:44.322897 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc5 URN 192 1 306 flow=Background 1970/01/08 06:00:45.072656 0.751040 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:00:45.072737 0.750959 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:00:46.574930 2.994184 tcp 10.0.2.105 51513 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:00:46.574993 2.994121 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:00:55.567985 0.000077 tcp 10.0.2.105 51513 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:00:55.568062 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:01:01.579407 4.002778 udp 10.0.2.105 61592 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:01.579506 4.002679 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:01:02.578157 3.004111 udp 10.0.2.105 61592 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:02.578250 3.004018 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:01:06.122753 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:01:09.587998 0.000085 udp 10.0.2.105 61592 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:09.588083 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:01:09.588173 0.000056 udp 10.0.2.105 61592 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:09.588229 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:01:13.593975 4.508021 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:13.594042 4.507954 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:01:18.100857 3.003317 tcp 10.0.2.105 51514 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:01:18.100938 3.003236 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:01:18.851368 0.750965 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:18.851420 0.750913 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:01:20.353691 0.000109 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:20.353800 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4619 URN 192 1 224 flow=Background 1970/01/08 06:01:27.102823 0.000102 tcp 10.0.2.105 51514 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:01:27.102925 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:01:31.619529 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:01:33.102990 3.754571 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:33.103059 3.754502 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:01:37.608315 3.004485 tcp 10.0.2.105 51515 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:01:37.608378 3.004422 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:01:38.410359 3.754063 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:38.410482 3.753940 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:01:42.916402 0.000049 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:42.916451 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x542c URN 192 1 308 flow=Background 1970/01/08 06:01:46.611066 0.000103 tcp 10.0.2.105 51515 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:01:46.611169 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:01:52.613400 4.002436 udp 10.0.2.105 59642 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:52.613470 4.002366 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:01:53.611125 3.004821 udp 10.0.2.105 59642 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:01:53.611180 3.004766 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:01:57.116179 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:02:00.621428 0.000263 udp 10.0.2.105 59642 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:00.621547 0.000170 udp 10.0.2.105 59642 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:00.621691 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:02:00.621717 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:02:04.627253 4.507879 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:04.627435 4.507697 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:02:09.134018 2.993502 tcp 10.0.2.105 51516 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:02:09.134397 2.993123 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:02:09.884228 0.751531 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:09.884294 0.751465 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:02:11.387310 0.000090 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:11.387400 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x459f URN 192 1 309 flow=Background 1970/01/08 06:02:18.126527 0.000146 tcp 10.0.2.105 51516 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:02:18.126673 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:02:23.123212 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:02:24.136705 4.605603 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:24.136762 4.605546 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:02:28.642148 3.003849 tcp 10.0.2.105 51517 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:02:28.642227 3.003770 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:02:29.482805 0.750700 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:29.482857 0.750648 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:02:30.984999 0.000124 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:30.985123 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc4 URN 192 1 281 flow=Background 1970/01/08 06:02:37.654745 0.000124 tcp 10.0.2.105 51517 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:02:37.654869 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:02:43.646536 4.002744 udp 10.0.2.105 56688 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:43.646607 4.002673 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:02:44.644445 3.004903 udp 10.0.2.105 56688 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:44.644520 3.004828 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:02:48.620233 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:02:51.654268 0.000081 udp 10.0.2.105 56688 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:51.654349 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:02:51.654379 0.000041 udp 10.0.2.105 56688 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:51.654420 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:02:55.660505 4.507853 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:02:55.660560 4.507798 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:03:00.167195 3.003992 tcp 10.0.2.105 51518 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:03:00.167258 3.003929 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:03:00.918035 0.751448 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:00.918104 0.751379 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:03:02.420078 0.000076 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:02.420154 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd13e URN 192 1 245 flow=Background 1970/01/08 06:03:09.169433 0.000108 tcp 10.0.2.105 51518 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:03:09.169541 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:03:14.116738 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:03:15.170828 4.874946 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:15.170879 4.874895 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 06:03:19.674951 2.994653 tcp 10.0.2.105 51519 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:03:19.675026 2.994578 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:03:20.796219 2.253709 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:20.796292 2.253636 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 06:03:23.801283 0.000059 udp 10.0.2.105 7010 -> 71.48.23.198 4217 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:23.801342 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4730 URN 192 1 229 flow=Background 1970/01/08 06:03:28.668108 0.000079 tcp 10.0.2.105 51519 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:03:28.668187 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:03:34.679926 4.002015 udp 10.0.2.105 49817 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:34.680017 4.001924 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:03:35.677814 3.004221 udp 10.0.2.105 49817 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:35.677872 3.004163 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:03:39.623331 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:03:42.688058 0.000051 udp 10.0.2.105 49817 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:42.688109 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:03:42.688416 0.000042 udp 10.0.2.105 49817 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:42.688458 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:03:46.694167 4.507439 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:46.694235 4.507371 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:03:51.200726 3.004173 tcp 10.0.2.105 51520 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:03:51.200791 3.004108 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:03:51.950935 0.751671 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:51.951008 0.751598 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:03:53.453820 0.000087 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:03:53.453907 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x543b URN 192 1 253 flow=Background 1970/01/08 06:04:00.203360 0.000064 tcp 10.0.2.105 51520 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:04:00.203424 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:04:05.120183 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:04:06.203181 3.754066 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:06.203269 3.753978 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:04:10.708402 3.004334 tcp 10.0.2.105 51521 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:04:10.708477 3.004259 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:04:12.241231 3.754442 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:12.241299 3.754374 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:04:16.747058 0.000067 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:16.747125 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x415f URN 192 1 246 flow=Background 1970/01/08 06:04:19.711459 0.000089 tcp 10.0.2.105 51521 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:04:19.711548 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:04:25.713558 4.001882 udp 10.0.2.105 60926 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:25.713670 4.001770 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:04:26.711339 3.004161 udp 10.0.2.105 60926 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:26.711398 3.004102 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:04:30.617033 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:04:33.721424 0.000096 udp 10.0.2.105 60926 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:33.721520 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:04:33.721545 0.000033 udp 10.0.2.105 60926 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:33.721578 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:04:37.727586 4.507703 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:37.727659 4.507630 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:04:42.234337 2.993331 tcp 10.0.2.105 51522 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:04:42.234405 2.993263 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:04:42.984613 0.750968 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:42.984682 0.750899 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:04:44.487190 0.000088 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:44.487278 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 264 flow=Background 1970/01/08 06:04:51.226169 0.000073 tcp 10.0.2.105 51522 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:04:51.226242 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:04:56.123485 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:04:57.235843 3.754758 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:04:57.235903 3.754698 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:05:02.663897 3.754861 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:02.663981 3.754777 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:05:07.169630 0.000071 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:07.169701 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd927 URN 192 1 155 flow=Background 1970/01/08 06:05:22.665620 4.002216 udp 10.0.2.105 61126 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:22.665692 4.002144 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:05:23.662912 3.004950 udp 10.0.2.105 61126 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:23.662995 3.004867 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:05:27.618922 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:05:30.672913 0.000066 udp 10.0.2.105 61126 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:30.672979 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:05:30.673049 0.000038 udp 10.0.2.105 61126 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:30.673087 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:05:34.679145 3.755117 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:34.679248 3.755014 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:05:39.186138 0.000065 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:39.186203 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5bcf URN 192 1 125 flow=Background 1970/01/08 06:05:48.682809 3.000475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:05:55.689528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:05:55.710842 3.754206 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:05:55.710909 3.754139 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:06:00.216367 0.000065 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:00.216432 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6301 URN 192 1 132 flow=Background 1970/01/08 06:06:03.690557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:06:05.122619 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:06:15.592933 4.000486 udp 10.0.2.105 51499 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:15.593016 4.000403 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:06:16.589424 3.004113 udp 10.0.2.105 51499 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:16.589479 3.004058 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:06:19.693637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:06:23.599227 0.000096 udp 10.0.2.105 51499 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:23.599323 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:06:23.599347 0.000037 udp 10.0.2.105 51499 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:23.599384 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:06:27.605790 3.754767 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:27.605855 3.754702 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:06:32.112221 0.000097 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:32.112318 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6380 URN 192 1 218 flow=Background 1970/01/08 06:06:36.618241 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:06:50.569850 3.753864 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:50.569916 3.753798 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:06:51.699856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:06:55.074728 0.000075 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:06:55.074803 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x51ae URN 192 1 268 flow=Background 1970/01/08 06:07:11.091171 4.002073 udp 10.0.2.105 59988 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:11.091249 4.001995 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:07:12.089269 3.004105 udp 10.0.2.105 59988 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:12.089317 3.004057 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:07:15.624193 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:07:19.099425 0.000080 udp 10.0.2.105 59988 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:19.099505 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:07:19.099627 0.000059 udp 10.0.2.105 59988 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:19.099686 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:07:23.105459 3.785181 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:23.105641 3.784999 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:07:27.641989 0.000057 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:27.642046 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6c59 URN 192 1 211 flow=Background 1970/01/08 06:07:46.239266 3.754327 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:46.239400 3.754193 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:07:50.745223 0.000064 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:07:50.745287 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb8b6 URN 192 1 126 flow=Background 1970/01/08 06:07:55.631666 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:08:08.102852 4.002724 udp 10.0.2.105 50118 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:08.102933 4.002643 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:08:09.101364 3.004335 udp 10.0.2.105 50118 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:09.101517 3.004182 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:08:16.111008 0.000063 udp 10.0.2.105 50118 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:16.111071 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:08:16.111145 0.000041 udp 10.0.2.105 50118 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:16.111186 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:08:20.116962 3.755161 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:20.117027 3.755096 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:08:20.627799 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:08:24.623897 0.000069 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:24.623966 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4cd4 URN 192 1 262 flow=Background 1970/01/08 06:08:43.171294 3.794138 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:43.171412 3.794020 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:08:47.717349 0.000132 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:08:47.717481 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd326 URN 192 1 210 flow=Background 1970/01/08 06:08:52.653657 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:09:06.627086 4.002832 udp 10.0.2.105 60969 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:06.627156 4.002762 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:09:07.625277 3.004766 udp 10.0.2.105 60969 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:07.625326 3.004717 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:09:14.635448 0.000093 udp 10.0.2.105 60969 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:14.635541 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:09:14.635571 0.000051 udp 10.0.2.105 60969 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:14.635622 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:09:18.640906 3.755280 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:18.640962 3.755224 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:09:19.151964 0.000036 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:09:23.147883 0.000088 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:23.147971 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5604 URN 192 1 209 flow=Background 1970/01/08 06:09:41.025870 3.752732 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:41.025932 3.752670 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:09:45.530286 0.000155 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:09:45.530441 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4618 URN 192 1 288 flow=Background 1970/01/08 06:09:50.145960 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:10:01.774059 2.993286 tcp 10.0.2.105 51523 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:01.774132 2.993213 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:10:01.817167 4.001883 udp 10.0.2.105 59122 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:01.817245 4.001805 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:10:02.814176 3.005143 udp 10.0.2.105 59122 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:02.814242 3.005077 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:10:09.824280 0.000069 udp 10.0.2.105 59122 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:09.824349 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:10:09.824431 0.000039 udp 10.0.2.105 59122 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:09.824470 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:10:10.775719 0.000075 tcp 10.0.2.105 51523 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:10.775794 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:10:13.830257 4.446717 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 9 828 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:13.830369 4.446605 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 9 1080 flow=Background 1970/01/08 06:10:14.651410 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:10:18.337442 0.000050 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:18.337492 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 172 flow=Background 1970/01/08 06:10:19.028525 1.551527 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:19.028594 1.551458 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 06:10:21.331683 3.003999 tcp 10.0.2.105 51524 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:21.331831 3.003851 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:10:30.333949 0.000089 tcp 10.0.2.105 51524 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:30.334038 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:10:34.591454 4.506708 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:34.591625 4.506537 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:10:39.097485 0.000066 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:39.097551 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xb895 URN 192 1 207 flow=Background 1970/01/08 06:10:39.847536 0.751104 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:39.847617 0.751023 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:10:41.350560 3.003525 tcp 10.0.2.105 51525 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:41.350643 3.003442 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:10:43.682972 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:10:50.352706 0.000500 tcp 10.0.2.105 51525 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:10:50.353206 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:10:56.355617 4.001944 udp 10.0.2.105 53438 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:56.355687 4.001874 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:10:57.353616 3.004046 udp 10.0.2.105 53438 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:10:57.353794 3.003868 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:11:04.363109 0.000067 udp 10.0.2.105 53438 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:04.363176 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:11:04.363247 0.000037 udp 10.0.2.105 53438 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:04.363284 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:11:08.369300 4.507531 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:08.369360 4.507471 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:11:09.179703 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:11:12.875584 2.994174 tcp 10.0.2.105 51526 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:11:12.875675 2.994083 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:11:13.626307 0.750820 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:13.626363 0.750764 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:11:15.129041 0.000055 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:15.129096 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xd929 URN 192 1 214 flow=Background 1970/01/08 06:11:21.868572 0.000069 tcp 10.0.2.105 51526 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:11:21.868641 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:11:27.877751 4.505730 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 8 736 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:27.877825 4.505656 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 8 960 flow=Background 1970/01/08 06:11:32.383952 2.993679 tcp 10.0.2.105 51527 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:11:32.384005 2.993626 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:11:33.134018 2.253473 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:33.134068 2.253423 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 4 480 flow=Background 1970/01/08 06:11:36.138692 0.000143 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:36.138835 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x547f URN 192 1 194 flow=Background 1970/01/08 06:11:37.179807 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:11:41.376012 0.000105 tcp 10.0.2.105 51527 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:11:41.376117 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:11:47.387866 4.002727 udp 10.0.2.105 60981 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:47.387936 4.002657 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:11:48.386277 3.004416 udp 10.0.2.105 60981 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:48.386336 3.004357 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:11:55.396161 0.000195 udp 10.0.2.105 60981 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:55.396356 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:11:55.396484 0.000030 udp 10.0.2.105 60981 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:55.396514 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:11:59.402627 4.507262 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:11:59.402685 4.507204 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:12:03.908783 3.004031 tcp 10.0.2.105 51528 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:12:03.908854 3.003960 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:12:04.659849 0.750630 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:04.659901 0.750578 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:12:06.162125 0.000065 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:06.162190 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4636 URN 192 1 132 flow=Background 1970/01/08 06:12:08.675220 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:12:12.911613 0.000062 tcp 10.0.2.105 51528 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:12:12.911675 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:12:18.911493 3.754078 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:18.911569 3.754002 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:12:23.417281 3.003841 tcp 10.0.2.105 51529 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:12:23.417352 3.003770 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:12:25.000348 3.753787 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:25.000408 3.753727 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:12:29.506095 0.000179 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:29.506274 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x4634 URN 192 1 289 flow=Background 1970/01/08 06:12:32.419471 0.000146 tcp 10.0.2.105 51529 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:12:32.419617 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:12:34.182237 0.000033 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:12:38.421079 4.003010 udp 10.0.2.105 53202 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:38.421156 4.002933 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:12:39.419598 3.004584 udp 10.0.2.105 53202 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:39.419660 3.004522 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:12:46.429785 0.000050 udp 10.0.2.105 53202 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:46.429835 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:12:46.429895 0.000034 udp 10.0.2.105 53202 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:46.429929 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:12:50.435583 4.508711 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:50.435747 4.508547 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:12:54.942433 2.994130 tcp 10.0.2.105 51530 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:12:54.942495 2.994068 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:12:55.692740 0.751388 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:55.692865 0.751263 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:12:55.765964 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:12:57.195836 0.000057 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:12:57.195893 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x6bc1 URN 192 1 291 flow=Background 1970/01/08 06:12:59.678791 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:13:02.773513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:13:03.944623 0.000160 tcp 10.0.2.105 51530 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:13:03.944783 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:13:09.944653 4.396382 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 7 644 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:09.944714 4.396321 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 7 840 flow=Background 1970/01/08 06:13:10.774748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:13:14.450282 3.003888 tcp 10.0.2.105 51531 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:13:14.450353 3.003817 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:13:15.091249 3.004498 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 5 460 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:15.091419 3.004328 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 5 600 flow=Background 1970/01/08 06:13:18.846446 0.000062 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:18.846508 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x02e4 URN 192 1 120 flow=Background 1970/01/08 06:13:23.452964 0.000106 tcp 10.0.2.105 51531 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:13:23.453070 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:13:23.683640 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:13:26.777839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:13:29.455779 4.001964 udp 10.0.2.105 64062 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:29.455868 4.001875 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:13:30.453082 3.004717 udp 10.0.2.105 64062 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:30.453233 3.004566 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:13:37.462972 0.000088 udp 10.0.2.105 64062 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:37.463060 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:13:37.463145 0.000041 udp 10.0.2.105 64062 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:37.463186 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:13:41.469440 4.607460 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 10 920 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:41.469507 4.607393 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 10 1200 flow=Background 1970/01/08 06:13:46.065798 2.993941 tcp 10.0.2.105 51532 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:13:46.065923 2.993816 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:13:46.826268 0.751127 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 2 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:46.826436 0.750959 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 2 240 flow=Background 1970/01/08 06:13:48.329266 0.000111 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:13:48.329377 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x3a44 URN 192 1 252 flow=Background 1970/01/08 06:13:50.751996 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:13:55.058605 0.000069 tcp 10.0.2.105 51532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:13:55.058674 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:13:58.853812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:14:01.068584 4.565425 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 9 828 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:01.068646 4.565363 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 9 1080 flow=Background 1970/01/08 06:14:05.574181 2.993512 tcp 10.0.2.105 51533 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:14:05.574294 2.993399 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:14:06.385913 1.501205 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:06.385969 1.501149 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 06:14:14.566172 0.000084 tcp 10.0.2.105 51533 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:14:14.566256 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:14:19.253593 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:14:20.578820 4.002039 udp 10.0.2.105 52807 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:20.578897 4.001962 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:14:21.576242 3.004671 udp 10.0.2.105 52807 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:21.576311 3.004602 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:14:28.586989 0.000056 udp 10.0.2.105 52807 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:28.587045 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:14:28.587118 0.000072 udp 10.0.2.105 52807 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:28.587190 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:14:32.592379 3.755142 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:32.592435 3.755086 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:14:37.099584 3.003423 tcp 10.0.2.105 51534 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:14:37.099732 3.003275 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:14:44.749496 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:14:46.101538 0.000092 tcp 10.0.2.105 51534 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:14:46.101630 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:14:52.101509 3.754327 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:14:52.101583 3.754253 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:14:56.606882 3.004318 tcp 10.0.2.105 51535 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:14:56.606956 3.004244 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:15:05.610240 0.000159 tcp 10.0.2.105 51535 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:15:05.610399 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:15:10.246610 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:15:11.612306 4.001767 udp 10.0.2.105 49991 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:11.612397 4.001676 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:15:12.609646 3.004543 udp 10.0.2.105 49991 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:12.609813 3.004376 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:15:19.620013 0.000175 udp 10.0.2.105 49991 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:19.620137 0.000071 udp 10.0.2.105 49991 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:19.620188 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:15:19.620208 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:15:23.626370 3.754971 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:23.626543 3.754798 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:15:28.132819 2.993837 tcp 10.0.2.105 51536 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:15:28.132900 2.993756 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:15:35.753113 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:15:37.135159 0.000084 tcp 10.0.2.105 51536 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:15:37.135243 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:15:43.136326 3.753250 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:15:43.136397 3.753179 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:15:47.640218 3.004730 tcp 10.0.2.105 51537 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:15:47.640293 3.004655 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:15:56.643486 0.000081 tcp 10.0.2.105 51537 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:15:56.643567 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:16:01.249660 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:16:02.646795 4.000627 udp 10.0.2.105 56037 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:02.646857 4.000565 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:16:03.643090 3.004440 udp 10.0.2.105 56037 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:03.643151 3.004379 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:16:10.653157 0.000077 udp 10.0.2.105 56037 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:10.653234 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:16:10.653251 0.000027 udp 10.0.2.105 56037 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:10.653278 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:16:14.659128 3.755363 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:14.659182 3.755309 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:16:19.165947 3.003937 tcp 10.0.2.105 51538 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:16:19.166051 3.003833 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:16:26.746461 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:16:28.168525 0.000065 tcp 10.0.2.105 51538 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:16:28.168590 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:16:34.168787 3.753999 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:34.168845 3.753941 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:16:38.673639 2.994856 tcp 10.0.2.105 51539 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:16:38.673699 2.994796 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:16:47.666792 0.000070 tcp 10.0.2.105 51539 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:16:47.666862 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:16:52.253073 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:16:53.678610 4.002628 udp 10.0.2.105 49426 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:53.678687 4.002551 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:16:54.676997 3.004357 udp 10.0.2.105 49426 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:16:54.677049 3.004305 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:17:01.686771 0.000052 udp 10.0.2.105 49426 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:01.686823 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:17:01.686903 0.000036 udp 10.0.2.105 49426 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:01.686939 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:17:05.692921 3.754746 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:05.692999 3.754668 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:17:10.199291 3.004301 tcp 10.0.2.105 51540 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:17:10.199429 3.004163 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:17:17.749915 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:17:19.201595 0.000061 tcp 10.0.2.105 51540 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:17:19.201656 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:17:25.201693 3.754271 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:25.201763 3.754201 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:17:29.707779 3.003333 tcp 10.0.2.105 51541 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:17:29.707858 3.003254 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:17:38.709629 0.000144 tcp 10.0.2.105 51541 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:17:38.709773 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:17:43.246559 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:17:44.712010 4.002403 udp 10.0.2.105 55166 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:44.712101 4.002312 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:17:45.710171 3.004266 udp 10.0.2.105 55166 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:45.710227 3.004210 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:17:52.720180 0.000192 udp 10.0.2.105 55166 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:52.720372 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:17:52.720443 0.000265 udp 10.0.2.105 55166 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:52.720708 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:17:56.725855 3.755200 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:17:56.725933 3.755122 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:18:01.232696 2.994016 tcp 10.0.2.105 51542 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:18:01.232780 2.993932 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:18:08.753107 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:18:10.235506 0.000085 tcp 10.0.2.105 51542 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:18:10.235591 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:18:16.235409 3.754053 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:18:16.235480 3.753982 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:20:02.859987 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:20:09.867001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:20:17.869111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:20:33.871739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:21:05.878127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:23:20.742920 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:23:20.743024 3.003096 tcp 10.0.2.105 51543 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:23:20.743085 3.003035 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:23:29.754818 0.000088 tcp 10.0.2.105 51543 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:23:29.754906 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:23:35.747633 4.001926 udp 10.0.2.105 50106 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:23:35.747710 4.001849 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:23:36.744810 3.004774 udp 10.0.2.105 50106 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:23:36.744863 3.004721 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:23:43.755231 0.000318 udp 10.0.2.105 50106 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:23:43.755350 0.000224 udp 10.0.2.105 50106 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:23:43.755549 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:23:43.755574 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:23:44.745993 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:23:47.760985 3.754802 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:23:47.761061 3.754726 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:23:52.267318 3.004255 tcp 10.0.2.105 51544 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:23:52.267406 3.004167 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:24:01.270234 0.000130 tcp 10.0.2.105 51544 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:24:01.270364 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:24:07.270093 3.753878 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:07.270147 3.753824 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:24:11.775899 2.993610 tcp 10.0.2.105 51545 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:24:11.775986 2.993523 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:24:16.752409 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:24:20.767852 0.000087 tcp 10.0.2.105 51545 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:24:20.767939 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:24:26.780175 4.002029 udp 10.0.2.105 59230 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:26.780253 4.001951 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:24:27.777953 3.004366 udp 10.0.2.105 59230 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:27.778107 3.004212 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:24:34.788454 0.000061 udp 10.0.2.105 59230 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:34.788515 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:24:34.788583 0.000152 udp 10.0.2.105 59230 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:34.788735 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:24:38.794366 3.754731 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:38.794532 3.754565 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:24:43.300975 3.004185 tcp 10.0.2.105 51546 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:24:43.301175 3.003985 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:24:48.247894 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:24:52.303363 0.000061 tcp 10.0.2.105 51546 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:24:52.303424 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:24:58.303590 3.754314 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:24:58.303651 3.754253 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:25:02.808637 3.004061 tcp 10.0.2.105 51547 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:25:02.808716 3.003982 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:25:11.811685 0.000109 tcp 10.0.2.105 51547 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:25:11.811794 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:25:16.748655 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:25:17.813360 4.002254 udp 10.0.2.105 51872 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:17.813426 4.002188 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:25:18.811467 3.004225 udp 10.0.2.105 51872 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:18.811632 3.004060 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:25:25.821661 0.000049 udp 10.0.2.105 51872 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:25.821710 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:25:25.821802 0.000119 udp 10.0.2.105 51872 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:25.821921 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:25:29.827772 3.754853 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:29.827831 3.754794 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:25:34.334365 2.993600 tcp 10.0.2.105 51548 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:25:34.334440 2.993525 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:25:42.244980 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:25:43.326943 0.000083 tcp 10.0.2.105 51548 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:25:43.327026 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:25:49.336705 3.754499 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:25:49.336770 3.754434 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:25:53.841870 3.004304 tcp 10.0.2.105 51549 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:25:53.841949 3.004225 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:26:02.855095 0.000120 tcp 10.0.2.105 51549 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:26:02.855215 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:26:07.752104 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:26:08.846772 4.002668 udp 10.0.2.105 51032 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:08.846858 4.002582 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:26:09.845307 3.004211 udp 10.0.2.105 51032 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:09.845383 3.004135 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:26:16.855094 0.000070 udp 10.0.2.105 51032 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:16.855164 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:26:16.855195 0.000032 udp 10.0.2.105 51032 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:16.855227 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:26:20.860702 3.755421 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:20.860887 3.755236 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:26:25.367733 3.004078 tcp 10.0.2.105 51550 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:26:25.367896 3.003915 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:26:33.248167 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:26:34.369940 0.000073 tcp 10.0.2.105 51550 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:26:34.370013 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:26:40.370799 3.753337 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:40.370979 3.753157 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:26:44.875270 2.994518 tcp 10.0.2.105 51551 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:26:44.875605 2.994183 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:26:53.868222 0.000082 tcp 10.0.2.105 51551 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:26:53.868304 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:26:58.745330 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:26:59.879524 4.002831 udp 10.0.2.105 63299 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:26:59.879586 4.002769 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:27:00.878378 3.004089 udp 10.0.2.105 63299 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:00.878460 3.004007 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:27:07.888447 0.000179 udp 10.0.2.105 63299 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:07.888567 0.000080 udp 10.0.2.105 63299 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:07.888626 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:27:07.888647 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:27:09.884330 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:27:11.894440 3.755338 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:11.894499 3.755279 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:27:16.400988 3.004390 tcp 10.0.2.105 51552 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:27:16.401050 3.004328 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:27:16.891687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:27:24.251726 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:27:24.892755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:27:25.403595 0.000063 tcp 10.0.2.105 51552 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:27:25.403658 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:27:31.403483 3.754038 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:31.403553 3.753968 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:27:35.909161 3.003891 tcp 10.0.2.105 51553 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:27:35.909235 3.003817 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:27:40.895786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:27:44.911814 0.000077 tcp 10.0.2.105 51553 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:27:44.911891 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:27:49.748774 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:27:50.913735 4.002678 udp 10.0.2.105 54793 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:50.913800 4.002613 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:27:51.911851 3.004585 udp 10.0.2.105 54793 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:51.911925 3.004511 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:27:58.921678 0.000071 udp 10.0.2.105 54793 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:58.921749 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:27:58.921859 0.000039 udp 10.0.2.105 54793 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:27:58.921898 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:28:02.927450 3.755777 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:02.927583 3.755644 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:28:07.434650 2.993336 tcp 10.0.2.105 51554 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:28:07.434717 2.993269 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:28:12.901994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:28:15.245079 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:28:16.426824 0.000087 tcp 10.0.2.105 51554 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:28:16.426911 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:28:22.436838 3.754246 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:22.436895 3.754189 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:28:26.942598 2.993883 tcp 10.0.2.105 51555 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:28:26.942682 2.993799 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:28:35.944900 0.000068 tcp 10.0.2.105 51555 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:28:35.944968 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:28:40.751954 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:28:41.947182 4.002092 udp 10.0.2.105 52347 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:41.947249 4.002025 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:28:42.945362 3.004125 udp 10.0.2.105 52347 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:42.945479 3.004008 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:28:49.955359 0.000073 udp 10.0.2.105 52347 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:49.955432 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:28:49.955662 0.000044 udp 10.0.2.105 52347 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:49.955706 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:28:53.961147 3.754951 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:28:53.961303 3.754795 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:28:58.467741 3.004220 tcp 10.0.2.105 51556 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:28:58.467815 3.004146 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:29:06.248540 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:29:07.470391 0.000067 tcp 10.0.2.105 51556 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:29:07.470458 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:29:13.470419 3.753964 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:13.470578 3.753805 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:29:17.975450 2.994596 tcp 10.0.2.105 51557 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:29:17.975537 2.994509 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:29:26.968510 0.000079 tcp 10.0.2.105 51557 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:29:26.968589 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:29:31.745136 0.000374 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:29:32.979894 4.002893 udp 10.0.2.105 61869 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:32.979966 4.002821 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:29:33.978206 3.004634 udp 10.0.2.105 61869 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:33.978289 3.004551 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:29:40.988607 0.000056 udp 10.0.2.105 61869 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:40.988663 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:29:40.988717 0.000030 udp 10.0.2.105 61869 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:40.988747 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:29:44.994072 3.755737 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:29:44.994145 3.755664 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:29:49.501307 3.003623 tcp 10.0.2.105 51558 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:29:49.501400 3.003530 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:29:57.251611 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:29:58.503708 0.000105 tcp 10.0.2.105 51558 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:29:58.503813 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:30:04.504121 3.753745 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:04.504360 3.753506 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:30:09.009000 3.004501 tcp 10.0.2.105 51559 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:30:09.009066 3.004435 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:30:18.011775 0.000181 tcp 10.0.2.105 51559 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:30:18.011956 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:30:22.748529 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:30:24.014028 4.002464 udp 10.0.2.105 60913 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:24.014108 4.002384 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:30:25.011757 3.004758 udp 10.0.2.105 60913 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:25.011829 3.004686 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:30:32.022511 0.000068 udp 10.0.2.105 60913 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:32.022579 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:30:32.022648 0.000192 udp 10.0.2.105 60913 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:32.022840 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:30:36.027984 3.755166 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:36.028184 3.754966 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:30:40.534388 2.994649 tcp 10.0.2.105 51560 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:30:40.534472 2.994565 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:30:48.245417 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:30:49.527031 0.000064 tcp 10.0.2.105 51560 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:30:49.527095 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:30:55.536670 3.754442 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:30:55.536737 3.754375 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:31:00.042247 2.993899 tcp 10.0.2.105 51561 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:31:00.042406 2.993740 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:31:09.045028 0.000068 tcp 10.0.2.105 51561 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:31:09.045096 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:31:13.751727 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:31:15.046950 4.002992 udp 10.0.2.105 56976 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:15.047035 4.002907 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:31:16.045352 3.004616 udp 10.0.2.105 56976 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:16.045401 3.004567 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:31:23.055563 0.000255 udp 10.0.2.105 56976 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:23.055691 0.000151 udp 10.0.2.105 56976 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:23.055818 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:31:23.055842 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:31:27.061299 3.755330 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:27.061350 3.755279 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:31:31.567652 3.004005 tcp 10.0.2.105 51562 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:31:31.567813 3.003844 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:31:39.248230 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:31:40.570080 0.000138 tcp 10.0.2.105 51562 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:31:40.570218 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:31:46.570245 3.754159 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:31:46.570430 3.753974 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:34:16.928247 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:34:23.935380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:34:31.937166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:34:47.939631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:35:19.945967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:36:51.097825 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:36:51.097921 3.003273 tcp 10.0.2.105 51563 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:36:51.097987 3.003207 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:37:00.100076 0.000075 tcp 10.0.2.105 51563 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:37:00.100151 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:37:06.102285 4.002031 udp 10.0.2.105 61777 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:06.102364 4.001952 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:37:07.100140 3.004200 udp 10.0.2.105 61777 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:07.100203 3.004137 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:37:14.109682 0.000054 udp 10.0.2.105 61777 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:14.109736 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:37:14.109815 0.000033 udp 10.0.2.105 61777 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:14.109848 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:37:14.770955 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:37:18.115755 3.755368 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:18.115854 3.755269 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:37:22.622317 2.993893 tcp 10.0.2.105 51564 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:37:22.622404 2.993806 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:37:31.625580 0.000071 tcp 10.0.2.105 51564 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:37:31.625651 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:37:37.625310 3.753950 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:37.625367 3.753893 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:37:42.130433 3.003942 tcp 10.0.2.105 51565 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:37:42.130538 3.003837 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:37:46.766963 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:37:51.133168 0.000065 tcp 10.0.2.105 51565 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:37:51.133233 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:37:57.135296 4.002073 udp 10.0.2.105 56016 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:57.135382 4.001987 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:37:58.133019 3.004465 udp 10.0.2.105 56016 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:37:58.133077 3.004407 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:38:05.143596 0.000055 udp 10.0.2.105 56016 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:05.143651 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:38:05.143733 0.000038 udp 10.0.2.105 56016 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:05.143771 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:38:09.149297 3.755099 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:09.149383 3.755013 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:38:13.655595 3.004157 tcp 10.0.2.105 51566 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:38:13.655676 3.004076 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:38:18.272167 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:38:22.658495 0.000069 tcp 10.0.2.105 51566 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:38:22.658564 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:38:28.658811 3.753492 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:28.658884 3.753419 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:38:33.164076 2.993948 tcp 10.0.2.105 51567 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:38:33.164156 2.993868 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:38:42.156593 0.000070 tcp 10.0.2.105 51567 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:38:42.156663 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:38:46.773038 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:38:48.168787 4.002367 udp 10.0.2.105 57872 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:48.168928 4.002226 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:38:49.166501 3.004778 udp 10.0.2.105 57872 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:49.166553 3.004726 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:38:56.176915 0.000059 udp 10.0.2.105 57872 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:56.176974 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:38:56.177122 0.000137 udp 10.0.2.105 57872 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:38:56.177259 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:39:00.182297 3.755941 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:00.182365 3.755873 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:39:04.689597 3.003827 tcp 10.0.2.105 51568 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:39:04.689705 3.003719 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:39:12.269793 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:39:13.691710 0.000068 tcp 10.0.2.105 51568 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:39:13.691778 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:39:19.691788 3.754140 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:19.691859 3.754069 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:39:24.197691 3.003923 tcp 10.0.2.105 51569 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:39:24.197777 3.003837 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:39:33.199695 0.000109 tcp 10.0.2.105 51569 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:39:33.199804 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:39:37.766393 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:39:39.202087 4.002732 udp 10.0.2.105 59740 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:39.202161 4.002658 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:39:40.199868 3.004978 udp 10.0.2.105 59740 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:40.199922 3.004924 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:39:47.209871 0.000076 udp 10.0.2.105 59740 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:47.209947 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:39:47.210061 0.000167 udp 10.0.2.105 59740 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:47.210228 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:39:51.215878 3.755553 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:39:51.215932 3.755499 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:39:55.722376 2.994673 tcp 10.0.2.105 51570 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:39:55.722456 2.994593 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:40:03.273405 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:40:04.725168 0.000148 tcp 10.0.2.105 51570 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:40:04.725316 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:40:10.725666 3.753746 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:10.725739 3.753673 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:40:15.230540 3.004178 tcp 10.0.2.105 51571 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:40:15.230629 3.004089 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:40:24.233002 0.000093 tcp 10.0.2.105 51571 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:40:24.233095 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:40:28.769652 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:40:30.235561 4.002484 udp 10.0.2.105 49401 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:30.235632 4.002413 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:40:31.233489 3.004574 udp 10.0.2.105 49401 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:31.233542 3.004521 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:40:38.243249 0.000103 udp 10.0.2.105 49401 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:38.243352 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:40:38.243384 0.000096 udp 10.0.2.105 49401 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:38.243480 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:40:42.249518 3.755048 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:40:42.249576 3.754990 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:40:46.756165 3.003713 tcp 10.0.2.105 51572 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:40:46.756393 3.003485 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 2 188 flow=Background 1970/01/08 06:40:54.266150 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:40:55.758837 0.000078 tcp 10.0.2.105 51572 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:40:55.758915 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5e89 URN 192 1 90 flow=Background 1970/01/08 06:41:01.759052 3.753754 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:01.759115 3.753691 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:41:06.264405 2.993996 tcp 10.0.2.105 51573 -> 128.255.183.224 9027 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:41:06.264471 2.993930 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 2 188 flow=Background 1970/01/08 06:41:15.256450 0.000066 tcp 10.0.2.105 51573 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:41:15.256516 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x80ff URN 192 1 90 flow=Background 1970/01/08 06:41:19.773343 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:41:21.268424 4.002940 udp 10.0.2.105 51839 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:21.268539 4.002825 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:41:22.266955 3.004573 udp 10.0.2.105 51839 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:22.267110 3.004418 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:41:23.951829 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:41:29.276700 0.000055 udp 10.0.2.105 51839 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:29.276755 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:41:29.276824 0.000038 udp 10.0.2.105 51839 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:29.276862 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:41:30.959373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:41:33.282516 3.755849 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:33.282598 3.755767 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:41:37.789621 3.003952 tcp 10.0.2.105 51574 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:41:37.789680 3.003893 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 2 188 flow=Background 1970/01/08 06:41:38.960528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:41:45.770214 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:41:46.791688 0.000153 tcp 10.0.2.105 51574 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:41:46.791841 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x447b URN 192 1 90 flow=Background 1970/01/08 06:41:52.792360 3.753803 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:41:52.792413 3.753750 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:41:54.963852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:41:57.297140 3.004685 tcp 10.0.2.105 51575 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:41:57.297220 3.004605 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 2 188 flow=Background 1970/01/08 06:42:06.299883 0.000161 tcp 10.0.2.105 51575 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:42:06.300044 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x5f68 URN 192 1 90 flow=Background 1970/01/08 06:42:11.267480 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:42:12.302670 4.001986 udp 10.0.2.105 55499 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:12.302746 4.001910 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:42:13.300100 3.004711 udp 10.0.2.105 55499 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:13.300174 3.004637 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:42:20.310031 0.000059 udp 10.0.2.105 55499 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:20.310090 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:42:20.310172 0.000133 udp 10.0.2.105 55499 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:20.310305 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:42:24.316076 3.755505 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:24.316135 3.755446 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:42:26.969727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:42:28.822446 2.994787 tcp 10.0.2.105 51576 -> 200.84.7.244 8038 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:42:28.822534 2.994699 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 2 188 flow=Background 1970/01/08 06:42:36.773841 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:42:37.825211 0.000092 tcp 10.0.2.105 51576 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:42:37.825303 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0xc854 URN 192 1 90 flow=Background 1970/01/08 06:42:43.825116 3.754556 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:42:43.825193 3.754479 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:42:48.330513 3.004601 tcp 10.0.2.105 51577 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:42:48.330595 3.004519 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 2 188 flow=Background 1970/01/08 06:42:57.333439 0.000065 tcp 10.0.2.105 51577 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:42:57.333504 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x2e31 URN 192 1 90 flow=Background 1970/01/08 06:43:02.270418 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:43:03.335283 4.002753 udp 10.0.2.105 60684 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:03.335349 4.002687 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:43:04.333568 3.004576 udp 10.0.2.105 60684 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:04.333621 3.004523 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:43:11.343471 0.000063 udp 10.0.2.105 60684 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:11.343534 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:43:11.343601 0.000038 udp 10.0.2.105 60684 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:11.343639 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:43:15.349744 3.754914 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:15.349803 3.754855 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:43:19.855741 3.004219 tcp 10.0.2.105 51578 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:43:19.855805 3.004155 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 2 188 flow=Background 1970/01/08 06:43:27.766808 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:43:28.858399 0.000067 tcp 10.0.2.105 51578 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:43:28.858466 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x57c6 URN 192 1 90 flow=Background 1970/01/08 06:43:34.859990 3.752682 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:34.860043 3.752629 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:43:39.363879 2.994433 tcp 10.0.2.105 51579 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:43:39.363941 2.994371 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 2 188 flow=Background 1970/01/08 06:43:48.356927 0.000073 tcp 10.0.2.105 51579 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:43:48.357000 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x1fc0 URN 192 1 90 flow=Background 1970/01/08 06:43:53.273948 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:43:54.369315 4.002402 udp 10.0.2.105 60296 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:54.369382 4.002335 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 204 flow=Background 1970/01/08 06:43:55.366710 3.005126 udp 10.0.2.105 60296 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:43:55.366767 3.005069 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 306 flow=Background 1970/01/08 06:44:02.377462 0.000071 udp 10.0.2.105 60296 -> 8.8.8.8 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:02.377533 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:44:02.377582 0.000029 udp 10.0.2.105 60296 -> 8.8.4.4 53 REQ 0 1 74 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:02.377611 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 1 102 flow=Background 1970/01/08 06:44:06.382738 3.755509 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:06.382902 3.755345 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:44:10.889877 3.003924 tcp 10.0.2.105 51580 -> 82.211.142.218 9811 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:44:10.890038 3.003763 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 2 188 flow=Background 1970/01/08 06:44:18.230043 0.000178 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:18.230221 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x710b URN 192 1 270 flow=Background 1970/01/08 06:44:18.770511 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:44:19.891876 0.000080 tcp 10.0.2.105 51580 -> 82.211.142.218 9811 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:44:19.891956 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x52d3 URN 192 1 90 flow=Background 1970/01/08 06:44:25.892239 3.754312 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:25.892378 3.754173 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/01/08 06:44:30.397421 3.003987 tcp 10.0.2.105 51581 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:44:30.397572 3.003836 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 2 188 flow=Background 1970/01/08 06:44:35.074964 1.501329 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:35.075037 1.501256 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 06:44:37.330609 4.002470 udp 10.0.2.105 53751 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:37.330675 4.002404 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 2 200 flow=Background 1970/01/08 06:44:38.328521 3.004686 udp 10.0.2.105 53751 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:38.328681 3.004526 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 300 flow=Background 1970/01/08 06:44:39.399913 0.000096 tcp 10.0.2.105 51581 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 06:44:39.400009 0.000000 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x9e6e URN 192 1 90 flow=Background 1970/01/08 06:44:43.265899 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:44:45.338848 0.000058 udp 10.0.2.105 53751 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:45.338906 4.065913 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 3 304 flow=Background 1970/01/08 06:44:45.338985 0.000027 udp 10.0.2.105 53751 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:45.339012 4.065825 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0808 URN 192 4 406 flow=Background 1970/01/08 06:44:45.400967 4.003852 udp 10.0.2.105 62159 -> 8.8.8.8 53 INT 0 2 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:46.400057 3.004780 udp 10.0.2.105 62159 -> 8.8.4.4 53 INT 0 3 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:49.344414 4.897215 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 5 460 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:49.344463 1.502541 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/01/08 06:44:51.598204 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:53.410654 0.010213 udp 10.0.2.105 62159 <-> 8.8.8.8 53 CON 0 0 2 388 flow=From-Botnet-V2-DNS 1970/01/08 06:44:53.410779 0.010113 udp 10.0.2.105 62159 <-> 8.8.4.4 53 CON 0 0 2 388 flow=From-Botnet-V2-DNS 1970/01/08 06:44:53.421455 0.076315 tcp 10.0.2.105 51582 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:44:54.992394 2.253319 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 4 368 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:44:57.997016 0.871768 tcp 10.0.2.105 51583 -> 94.137.168.16 9773 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:08.923147 0.076660 tcp 10.0.2.105 51584 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:09.000886 3.747525 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:45:13.499359 0.081657 udp 10.0.2.105 7010 <-> 80.116.176.100 2054 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:13.581437 0.070866 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:13.581756 4.993813 tcp 10.0.2.105 51585 -> 80.116.176.100 8079 SPA_* 0 0 379 237133 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:13.652673 0.181247 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:13.834256 0.053884 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:13.888677 0.143434 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:14.032637 0.182854 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:14.215823 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:45:18.937411 4.992101 tcp 10.0.2.105 51585 -> 80.116.176.100 8079 A_PA 0 0 359 229308 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:23.963917 1.030656 tcp 10.0.2.105 51585 -> 80.116.176.100 8079 FPA_* 0 0 54 26714 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:32.697445 0.073137 tcp 10.0.2.105 51586 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:32.773240 0.010986 udp 10.0.2.105 55108 <-> 8.8.8.8 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/01/08 06:45:32.784704 0.077219 tcp 10.0.2.105 51587 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:32.862189 0.157457 tcp 10.0.2.105 51588 -> 195.113.214.234 443 SRPA* 0 0 33 23869 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:33.020339 0.165997 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:33.205460 0.579009 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:33.784893 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:45:33.785235 2.992231 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 SPA_* 0 0 39 20088 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:42.452051 4.916800 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 22 12612 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:47.937325 4.928580 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 27 15230 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:50.552997 0.078089 tcp 10.0.2.105 51590 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:50.631346 0.118092 tcp 10.0.2.105 51591 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:50.749715 0.186137 tcp 10.0.2.105 51592 -> 195.113.214.234 443 SRPA* 0 0 22 12414 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:45:50.936326 0.144782 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:45:51.081499 0.000000 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:45:53.324096 4.949609 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 23 11482 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:01.608975 4.956704 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 46 27060 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:06.845503 4.316364 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 23 13530 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:10.061175 0.085016 tcp 10.0.2.105 51593 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:10.146443 0.076886 tcp 10.0.2.105 51594 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:10.223679 0.171905 tcp 10.0.2.105 51595 -> 195.113.214.234 443 SRPA* 0 0 21 11772 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:10.396890 0.044482 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:10.441758 0.161630 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:10.603901 0.169885 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:10.774199 0.084888 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:10.859431 0.228036 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.087911 0.121075 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.209337 0.222035 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.431801 0.336576 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.768709 0.032044 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.801139 0.145411 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:11.946971 0.210361 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:46:12.157779 0.000000 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:46:12.169841 4.924011 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 49 30690 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:17.291167 4.937264 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 43 26894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:23.494751 4.445880 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 30 19820 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:28.086763 0.070819 tcp 10.0.2.105 51596 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:28.157794 0.073692 tcp 10.0.2.105 51597 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:28.231758 0.173054 tcp 10.0.2.105 51598 -> 195.113.214.234 443 SRPA* 0 0 24 14622 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:28.405401 0.000000 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:46:29.034752 4.629246 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 37 25578 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:34.253356 4.720663 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 44 26764 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:39.588169 4.875111 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 25 17114 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:45.064494 2.998022 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 13 7654 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:45.343364 0.070341 tcp 10.0.2.105 51599 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:45.414037 0.077482 tcp 10.0.2.105 51600 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:45.491774 0.177111 tcp 10.0.2.105 51601 -> 195.113.214.234 443 SRPA* 0 0 24 13356 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:46:45.669357 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:46:55.550998 2.588650 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:03.848713 0.076175 tcp 10.0.2.105 51602 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:03.925159 0.076585 tcp 10.0.2.105 51603 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:04.002102 0.172574 tcp 10.0.2.105 51604 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:04.173653 0.145169 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:47:04.319226 0.143465 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:47:04.463087 0.188589 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:47:04.652070 0.063836 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:47:04.716281 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:47:13.374572 4.989843 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 20 8416 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:18.962950 3.919884 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 22 9048 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:23.136489 0.074005 tcp 10.0.2.105 51605 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:23.210808 0.087499 tcp 10.0.2.105 51606 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:23.298589 0.169309 tcp 10.0.2.105 51607 -> 195.113.214.234 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:24.411890 4.311741 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 30 12624 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:31.983481 4.634244 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 23 9626 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:37.218752 4.892664 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 21 9518 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:42.688602 0.205412 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:47:56.545559 3.413149 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 6 1908 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:01.270512 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 06:48:03.568832 4.901828 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 21 8994 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:09.599615 4.119162 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 A_PA 0 0 39 17826 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:15.465775 0.993305 tcp 10.0.2.105 51589 -> 84.59.151.27 3285 FPA_* 0 0 9 2013 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:31.145918 3.001950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:48:34.458337 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:48:38.153823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:48:46.155150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:48:50.792556 0.070665 tcp 10.0.2.105 51608 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:50.863560 0.117579 tcp 10.0.2.105 51609 -> 195.113.214.234 80 SRPA* 0 0 33 21316 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:48:50.979679 0.000000 udp 10.0.2.105 7010 -> 24.183.211.41 9826 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:49:02.157884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:49:08.938549 0.071864 tcp 10.0.2.105 51610 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:09.010732 0.114943 tcp 10.0.2.105 51611 -> 195.113.214.234 80 SRPA* 0 0 18 13404 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:09.126089 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:49:19.443426 0.594723 tcp 10.0.2.105 51612 -> 94.137.168.16 9773 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:26.954699 0.071896 tcp 10.0.2.105 51613 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:27.026923 0.128542 tcp 10.0.2.105 51614 -> 195.113.214.234 80 SRPA* 0 0 31 20968 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:27.154550 0.000000 udp 10.0.2.105 7010 -> 217.39.56.28 1252 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:49:34.164299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:49:45.841986 0.076156 tcp 10.0.2.105 51615 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:45.917994 0.075252 tcp 10.0.2.105 51616 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:45.993572 0.179261 tcp 10.0.2.105 51617 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:49:46.173043 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:50:03.136191 0.073939 tcp 10.0.2.105 51618 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:03.210427 0.074721 tcp 10.0.2.105 51619 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:03.285440 0.173250 tcp 10.0.2.105 51620 -> 195.113.214.234 443 SRPA* 0 0 32 17204 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:03.458421 0.000000 udp 10.0.2.105 7010 -> 217.41.11.145 5388 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:50:21.612989 0.076002 tcp 10.0.2.105 51621 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:21.689280 0.109593 tcp 10.0.2.105 51622 -> 195.113.214.234 80 SRPA* 0 0 20 13491 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:21.799264 0.000000 udp 10.0.2.105 7010 -> 184.149.30.4 3821 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:50:37.325703 0.112035 tcp 10.0.2.105 51623 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:37.438016 0.071162 tcp 10.0.2.105 51624 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:37.509554 0.177909 tcp 10.0.2.105 51625 -> 195.113.214.234 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:37.687895 0.066240 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:50:37.754553 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:50:54.190092 0.072459 tcp 10.0.2.105 51626 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:54.262493 0.081244 tcp 10.0.2.105 51627 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:54.344029 0.173736 tcp 10.0.2.105 51628 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:50:54.518332 0.071048 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:50:54.589912 0.181063 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:50:54.771355 0.000000 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 06:51:12.636390 0.074864 tcp 10.0.2.105 51629 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:51:12.711577 0.079503 tcp 10.0.2.105 51630 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:51:12.791402 0.182860 tcp 10.0.2.105 51631 -> 195.113.214.234 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/08 06:51:12.974864 0.141400 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:13.116683 0.147016 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:13.264109 0.026936 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:13.291412 0.169128 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:13.460941 0.669365 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.130700 0.144834 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.275945 0.218801 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.495184 0.167218 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.662755 0.078576 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.741679 0.042028 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.784037 0.163638 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:14.948050 0.122553 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:15.070962 0.218433 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:15.289897 0.144131 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:15.434430 0.033708 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:15.468618 0.223471 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:15.692552 0.334072 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:16.026973 0.143328 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:16.170731 0.188722 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:16.359891 0.147088 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:51:16.507342 0.061792 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 06:55:38.170670 3.000917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 06:55:45.177659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:55:53.179338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:56:09.181626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 06:56:41.187865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:02:45.194470 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:02:52.201815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:03:00.203154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:03:16.206426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:03:48.212241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:09:52.219122 3.000372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:09:59.225801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:10:07.226519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:10:23.229598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:10:55.236079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:16:59.242475 3.000918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:17:06.249368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:17:14.251044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:17:30.253860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:18:02.259616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:19:20.042577 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:19:20.042826 0.912539 tcp 10.0.2.105 51632 -> 94.137.168.16 9773 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:21:29.347806 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:21:29.347976 0.075527 udp 10.0.2.105 7010 -> 80.116.176.100 2054 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:21:29.423503 0.000000 icmp 80.116.176.100 0x0303 -> 10.0.2.105 0x0608 URP 192 1 284 flow=Background 1970/01/08 07:21:46.463994 0.074326 tcp 10.0.2.105 51633 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:21:46.538548 0.081203 tcp 10.0.2.105 51634 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:21:46.620059 0.174725 tcp 10.0.2.105 51635 -> 195.113.214.234 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:21:46.795416 0.062555 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:46.858433 0.084985 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:46.943757 0.181914 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:47.126017 0.138130 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:47.264520 0.165904 udp 10.0.2.105 7010 <-> 71.48.23.198 4217 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:47.430783 0.604823 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.035968 0.150250 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.186649 0.028973 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.216020 0.137955 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.354388 0.219413 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.574221 0.168937 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.743593 0.081692 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.825718 0.043296 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:48.869416 0.161341 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.031179 0.121969 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.153565 0.262029 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.415950 0.149803 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.566157 0.034224 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.600805 0.257838 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:49.859050 0.339709 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:50.199174 0.147605 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:50.347168 0.060668 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:50.408220 0.191200 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:21:50.599872 0.141915 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:24:06.265959 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 07:24:13.273357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:24:21.274477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:24:37.277859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:25:09.284008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:31:13.290775 3.000620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:31:20.297293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:31:28.298922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:31:44.301696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:32:16.307943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:38:20.313595 3.001762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:38:27.321091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:38:35.322732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:38:51.325414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:39:23.332009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:45:27.338161 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 07:45:34.344974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:45:42.346702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:45:58.349937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:46:30.355997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:49:20.961617 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:49:20.961896 0.727884 tcp 10.0.2.105 51636 -> 94.137.168.16 9773 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:52:15.882860 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:52:15.883054 0.178852 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:16.062367 0.157511 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:16.220229 0.071774 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:16.292437 0.464040 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:16.756850 0.143893 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:16.901130 0.000000 udp 10.0.2.105 7010 -> 71.48.23.198 4217 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:52:34.362726 3.000628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 07:52:35.672392 0.074943 tcp 10.0.2.105 51637 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:52:35.747639 0.071250 tcp 10.0.2.105 51638 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:52:35.819144 0.187709 tcp 10.0.2.105 51639 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/08 07:52:36.007212 0.143283 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.150925 0.031516 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.182750 0.130932 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.314093 0.228215 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.542657 0.167873 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.710927 0.082146 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.793451 0.042917 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.836790 0.162682 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:36.999801 0.119915 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:37.120073 0.039966 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:37.160451 0.227650 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:37.388528 0.214123 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:37.603054 0.149910 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:37.753374 0.365329 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:38.119092 0.142192 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:38.261639 0.060157 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:38.322134 0.188741 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:38.511318 0.142060 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:38.665935 0.000000 udp 10.0.2.105 7010 -> 71.48.23.198 4217 REQ 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:52:41.369697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:52:45.605827 0.204729 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:45.811110 0.534541 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.346096 0.144028 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.490698 0.075372 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.566687 0.063943 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.631088 0.144310 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.775840 0.029294 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.805689 0.131192 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:46.937406 0.227796 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:47.165652 0.160908 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:47.327046 0.075631 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:47.403153 0.043322 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:47.446965 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 REQ 0 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:52:49.370330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:52:56.050322 0.120789 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:56.171584 0.034767 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:56.206900 0.222270 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:56.429870 0.151863 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:56.582231 0.344572 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:56.927382 0.215417 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.143386 0.063267 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.207179 0.188175 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.396003 0.145480 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.542062 0.145975 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.688800 0.142063 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 861 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.841156 0.091687 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:52:57.942456 0.014901 udp 10.0.2.105 7010 -> 84.58.150.51 2044 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:52:57.957357 0.000000 icmp 84.58.150.51 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 139 flow=Background 1970/01/08 07:53:00.937371 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:53:05.374034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:53:06.365133 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:13.185032 0.077749 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:53:13.273590 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:19.934457 0.000000 udp 10.0.2.105 7010 -> 190.99.75.9 7164 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:24.941993 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:53:28.346554 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:34.175406 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:37.380010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:53:41.395788 3.203145 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:53:44.641115 0.000000 udp 10.0.2.105 7010 -> 213.123.168.89 6462 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:49.436719 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:53:50.828961 0.000000 udp 10.0.2.105 7010 -> 79.241.14.208 2935 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:53:57.609317 0.000000 udp 10.0.2.105 7010 -> 78.148.20.134 5515 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:03.497633 0.000000 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:09.996438 0.000000 udp 10.0.2.105 7010 -> 81.136.132.253 4598 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:14.943342 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:54:18.448966 0.086731 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:54:18.547493 0.000000 udp 10.0.2.105 7010 -> 85.107.162.183 2982 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:25.158571 0.000000 udp 10.0.2.105 7010 -> 94.34.147.206 9141 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:31.487453 0.000000 udp 10.0.2.105 7010 -> 68.179.56.201 7253 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:38.478111 0.000000 udp 10.0.2.105 7010 -> 132.206.132.133 8156 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:43.434631 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:54:46.249008 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:54:53.358986 0.000000 udp 10.0.2.105 7010 -> 182.71.25.114 5630 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:02.292271 0.000000 udp 10.0.2.105 7010 -> 93.193.148.37 7662 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:11.024858 0.046187 udp 10.0.2.105 7010 -> 81.139.78.72 5444 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:11.071045 0.000000 icmp 81.139.78.72 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 140 flow=Background 1970/01/08 07:55:15.941481 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:55:18.625110 0.000000 udp 10.0.2.105 7010 -> 184.71.110.26 6666 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:26.537352 0.000000 udp 10.0.2.105 7010 -> 206.108.7.250 7014 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:33.166017 0.000000 udp 10.0.2.105 7010 -> 195.72.202.66 1964 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:41.447947 0.061832 udp 10.0.2.105 7010 -> 79.206.70.164 8471 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:41.509779 0.000000 icmp 79.206.70.164 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 234 flow=Background 1970/01/08 07:55:46.435207 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:55:49.460014 0.000000 udp 10.0.2.105 7010 -> 109.117.255.185 8799 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:55:57.881957 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:04.040549 0.000000 udp 10.0.2.105 7010 -> 174.141.57.178 5164 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:11.451304 0.173312 udp 10.0.2.105 7010 -> 182.71.164.209 1407 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:11.624616 0.000000 icmp 182.71.164.209 0x0303 -> 10.0.2.105 0x7f05 URP 192 1 278 flow=Background 1970/01/08 07:56:16.438378 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:56:20.153965 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:28.735883 0.000000 udp 10.0.2.105 7010 -> 12.164.33.10 4914 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:36.317484 0.141392 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:36.458876 0.000000 icmp 207.255.99.210 0x0303 -> 10.0.2.105 0x8922 URP 192 1 182 flow=Background 1970/01/08 07:56:40.943400 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:56:42.255528 0.000000 udp 10.0.2.105 7010 -> 190.84.182.26 9398 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:47.983605 0.000000 udp 10.0.2.105 7010 -> 96.22.25.166 7098 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:54.463281 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:56:59.530739 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:05.459325 0.318596 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:57:05.823407 0.000000 udp 10.0.2.105 7010 -> 82.49.44.129 3641 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:10.435970 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:57:12.178487 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:20.540466 0.056780 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:57:20.609937 0.000000 udp 10.0.2.105 7010 -> 186.154.91.247 2270 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:26.439171 0.000000 udp 10.0.2.105 7010 -> 37.24.117.246 1794 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:32.267638 0.000000 udp 10.0.2.105 7010 -> 68.169.150.254 9247 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:36.933762 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:57:40.389393 0.000000 udp 10.0.2.105 7010 -> 181.198.38.2 4721 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:45.596618 0.000000 udp 10.0.2.105 7010 -> 99.245.138.123 3975 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:53.558191 0.090471 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:57:53.658715 0.172472 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:57:53.847882 0.000000 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:57:59.456379 0.161690 udp 10.0.2.105 7010 <-> 76.249.28.143 4147 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:57:59.626957 0.000000 udp 10.0.2.105 7010 -> 70.75.185.170 9917 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:04.443891 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:58:07.348440 0.000000 udp 10.0.2.105 7010 -> 94.67.15.197 2026 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:13.707520 0.000000 udp 10.0.2.105 7010 -> 63.85.131.9 3279 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:20.577177 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:25.714158 0.000000 udp 10.0.2.105 7010 -> 90.220.108.202 6763 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:30.441195 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:58:32.253506 0.000000 udp 10.0.2.105 7010 -> 79.26.177.26 2254 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:37.461312 0.000000 udp 10.0.2.105 7010 -> 78.180.21.114 3837 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:46.303879 0.000000 udp 10.0.2.105 7010 -> 79.31.132.126 6266 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:51.381540 0.000000 udp 10.0.2.105 7010 -> 85.99.5.141 5005 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:58:55.937699 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:58:59.222266 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:04.369719 0.000000 udp 10.0.2.105 7010 -> 79.48.246.153 8117 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:10.028229 0.000000 udp 10.0.2.105 7010 -> 37.116.141.157 1160 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:17.468726 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:22.435993 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:59:23.007116 0.000000 udp 10.0.2.105 7010 -> 95.232.147.182 3391 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:29.255965 0.458527 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:59:29.771872 0.065026 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/08 07:59:29.852607 0.000000 udp 10.0.2.105 7010 -> 108.223.238.221 7722 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:35.554683 0.000000 udp 10.0.2.105 7010 -> 149.3.112.30 2283 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:41.386380 3.000808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 07:59:44.027004 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:48.393113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:59:48.933809 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 07:59:51.678428 0.000000 udp 10.0.2.105 7010 -> 85.74.65.62 2536 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 07:59:56.394616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 07:59:58.237568 0.000000 udp 10.0.2.105 7010 -> 79.39.193.89 6248 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:06.168943 0.130132 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:00:06.309909 0.000000 udp 10.0.2.105 7010 -> 78.205.120.101 6476 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:11.466744 0.000000 udp 10.0.2.105 7010 -> 77.64.117.101 7676 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:12.397907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:00:16.443526 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:00:16.824385 0.000000 udp 10.0.2.105 7010 -> 108.197.238.146 3835 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:24.134986 0.000000 udp 10.0.2.105 7010 -> 83.149.155.14 3636 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:31.615756 0.000000 udp 10.0.2.105 7010 -> 92.238.72.232 6203 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:40.418384 0.000000 udp 10.0.2.105 7010 -> 90.220.16.184 9444 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:44.403866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:00:44.934229 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:00:46.577165 0.000000 udp 10.0.2.105 7010 -> 79.130.49.122 3236 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:00:52.285489 0.062367 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:00:52.358655 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:00.707529 0.000000 udp 10.0.2.105 7010 -> 66.211.150.197 7981 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:08.699083 0.000000 udp 10.0.2.105 7010 -> 81.182.249.152 8620 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:13.435510 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:01:16.589880 0.000000 udp 10.0.2.105 7010 -> 82.55.129.209 9976 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:24.871828 0.000000 udp 10.0.2.105 7010 -> 81.110.44.111 1690 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:30.930783 0.000000 udp 10.0.2.105 7010 -> 190.12.16.234 1026 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:37.560039 0.000000 udp 10.0.2.105 7010 -> 79.5.41.32 2505 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:01:42.436972 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:06:48.409724 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 08:06:55.416998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:07:03.418866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:07:19.421416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:07:51.427436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:13:55.433404 3.002156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:14:02.441403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:14:10.442306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:14:26.445492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:14:58.451749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:19:21.690660 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:19:21.690900 0.572431 tcp 10.0.2.105 51640 -> 94.137.168.16 9773 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/08 08:21:02.458148 3.000777 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:21:09.465173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:21:17.466281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:21:33.469800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:22:05.475729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:28:09.481268 3.002219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:28:16.489152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:28:24.490165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:28:40.493784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:29:12.499790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:31:59.360047 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:31:59.360200 0.184915 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:31:59.545539 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 08:32:17.707708 0.075248 tcp 10.0.2.105 51641 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 08:32:17.783228 0.109658 tcp 10.0.2.105 51642 -> 195.113.214.234 80 SRPA* 0 0 19 13437 flow=From-Botnet-V2-TCP-Established 1970/01/08 08:32:17.893310 0.140952 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.034664 0.071565 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.106605 0.070697 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.177751 0.144098 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.322207 0.036223 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.358846 0.137915 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.497174 0.217721 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.715319 0.166354 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.882052 0.083951 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:18.966404 0.040852 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:19.007651 0.221853 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:19.229910 0.148639 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:19.379006 0.336326 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:19.715706 0.216865 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:19.932918 0.120369 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.053645 0.033738 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.087785 0.057837 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.146031 0.143214 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.289753 0.095451 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.385617 0.192973 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.578972 0.142412 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.721765 0.258623 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:20.980729 0.077687 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.058792 0.200189 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.259383 0.054205 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.314014 0.310142 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.624569 0.053824 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.678750 0.162154 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.841327 0.094585 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:21.936321 0.161179 udp 10.0.2.105 7010 <-> 76.249.28.143 4147 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:22.097846 0.221683 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:22.319885 0.076681 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:22.396934 0.128886 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:32:22.526163 0.059023 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 08:35:16.505636 3.001854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:35:23.512996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:35:31.514263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:35:47.517628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:36:19.523200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:42:23.529240 3.002150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:42:30.537082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:42:38.538478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:42:54.541193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:43:26.547531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:49:22.269947 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 08:49:22.270056 0.599139 tcp 10.0.2.105 51643 -> 94.137.168.16 9773 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/08 08:49:30.553456 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:49:37.561052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:49:45.562219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:50:01.565787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:50:33.571325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:56:37.577632 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 08:56:44.584760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:56:52.586455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:57:08.589452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 08:57:40.595743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:02:44.853570 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 09:02:44.853702 0.416135 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.270247 0.179697 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.450328 0.142704 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.593431 0.070265 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.664111 0.071067 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.735588 0.147489 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.883484 0.069263 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:45.953085 0.130600 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.084094 0.209302 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.293795 0.168169 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.462370 0.080560 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.543344 0.039674 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.583352 0.213995 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.797689 0.145790 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:46.943868 0.335833 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.280125 0.217676 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.498183 0.120502 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.619105 0.031602 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.651162 0.055945 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.707459 0.188480 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:47.896493 0.139342 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:48.036254 0.170216 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:48.206862 0.075727 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:48.282990 0.063755 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:48.347161 0.096908 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:02:48.444500 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:03:04.873951 0.073301 tcp 10.0.2.105 51644 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:04.947475 0.074261 tcp 10.0.2.105 51645 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:05.022088 0.166838 tcp 10.0.2.105 51646 -> 195.113.214.234 443 SRPA* 0 0 60 38129 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:05.189628 0.053935 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:05.243934 0.296389 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:05.540658 0.054296 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:05.595381 0.163548 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:05.759267 0.094630 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:05.854297 0.000000 udp 10.0.2.105 7010 -> 76.249.28.143 4147 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:03:24.090213 0.069949 tcp 10.0.2.105 51647 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:24.160670 0.119759 tcp 10.0.2.105 51648 -> 195.113.214.234 80 SRPA* 0 0 30 19685 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:24.280540 0.128816 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:24.409808 0.069788 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:24.480051 0.000000 udp 10.0.2.105 7010 -> 88.73.42.82 7099 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:03:42.707065 0.073317 tcp 10.0.2.105 51649 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:42.780696 0.075947 tcp 10.0.2.105 51650 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:42.856907 0.176348 tcp 10.0.2.105 51651 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:03:43.033780 0.040099 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:03:44.601650 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 09:03:51.609136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:03:59.610590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:04:15.617007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:04:47.619578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:10:51.625680 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:10:58.632673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:11:06.633999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:11:22.637420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:11:54.643587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:17:58.649629 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:18:05.656881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:18:13.657900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:18:29.660996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:19:01.667393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:19:22.868626 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 09:19:22.868773 0.837343 tcp 10.0.2.105 51652 -> 94.137.168.16 9773 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:25:05.673485 3.001524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:25:12.680885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:25:20.682348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:25:36.685419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:26:08.691297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:32:12.697162 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:32:19.704708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:32:27.706335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:32:43.709655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:33:15.715470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:34:01.481293 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 09:34:01.481384 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:34:18.287584 0.073782 tcp 10.0.2.105 51653 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:18.361642 0.075893 tcp 10.0.2.105 51654 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:18.437870 0.178036 tcp 10.0.2.105 51655 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:18.614572 0.000000 udp 10.0.2.105 7010 -> 76.249.28.143 4147 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:34:35.981524 0.074297 tcp 10.0.2.105 51656 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:36.056103 0.106624 tcp 10.0.2.105 51657 -> 195.113.214.234 80 SRPA* 0 0 31 20945 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:36.162498 0.241644 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.404501 0.063783 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.468695 0.142507 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.611938 0.031452 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.643759 0.151698 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.795835 0.180372 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:36.976756 0.208150 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:37.185325 0.083900 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:37.269703 0.587402 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:37.857503 0.079450 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:37.937285 0.146954 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.084632 0.227439 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.312494 0.167756 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.480657 0.219765 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.700827 0.039905 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.741149 0.074077 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:38.815592 0.191197 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.007266 0.231473 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.239151 0.216081 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.455685 0.336822 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.792916 0.031620 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.824914 0.120287 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:39.945632 0.060654 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:40.006664 0.075781 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:40.082843 0.149358 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:40.232589 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 09:34:55.419141 0.075138 tcp 10.0.2.105 51658 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:55.494545 0.072097 tcp 10.0.2.105 51659 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:55.566958 0.170044 tcp 10.0.2.105 51660 -> 195.113.214.234 443 SRPA* 0 0 43 22124 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:34:55.737633 0.158722 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:55.896762 0.094508 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:55.991703 0.078450 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:56.070538 0.074031 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:56.144983 0.309183 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:56.454572 0.058940 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:56.513878 0.128511 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:34:56.642824 0.038978 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/08 09:39:19.722024 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 09:39:26.728652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:39:34.730121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:39:50.733304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:40:22.739075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:46:26.745194 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:46:33.752431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:46:41.754069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:46:57.756795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:47:29.763423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:49:23.707461 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 09:49:23.707569 0.608901 tcp 10.0.2.105 51661 -> 94.137.168.16 9773 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/08 09:53:33.769380 3.001242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 09:53:40.776298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:53:48.778299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:54:04.781129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 09:54:36.787460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:00:40.793794 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:00:47.800390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:00:55.802199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:01:11.804882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:01:43.810983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:05:17.599214 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 10:05:17.599456 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 10:05:33.994013 0.069577 tcp 10.0.2.105 51662 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:05:34.063923 0.076701 tcp 10.0.2.105 51663 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:05:34.140937 0.177988 tcp 10.0.2.105 51664 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:05:34.319145 0.139213 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:34.458714 0.142808 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:34.601921 0.120077 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:34.722393 0.144704 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:34.867503 0.215743 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.083690 0.033629 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.117695 0.083841 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.201909 0.146143 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.348517 0.402584 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.751506 0.071075 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:35.823005 0.549275 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:36.372715 0.218262 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:36.591385 0.216306 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:36.808027 0.041973 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:36.850424 0.080226 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:36.930966 0.192151 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.123480 0.166279 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.290170 0.033339 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.323917 0.121021 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.445326 0.062889 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.508611 0.075270 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.584308 0.220526 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.805235 0.142574 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:37.948540 0.337045 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.285959 0.142717 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.429067 0.276279 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.705726 0.094901 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.801029 0.057894 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.859362 0.056462 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:38.916253 0.156864 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:39.073552 0.057300 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:39.131266 0.299136 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:05:39.430792 0.131575 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:07:47.817363 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:07:54.824359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:08:02.825668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:08:18.829221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:08:50.835218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:14:54.841841 3.001062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:15:01.848134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:15:09.849658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:15:25.853124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:15:57.858784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:19:24.316825 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 10:19:24.316924 0.633137 tcp 10.0.2.105 51665 -> 94.137.168.16 9773 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:22:01.865810 3.000752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:22:08.872177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:22:16.874051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:22:32.876636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:23:04.883212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:29:08.889673 3.000637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:29:15.896172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:29:23.898240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:29:39.901005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:30:11.907256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:35:51.626009 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 10:35:51.626268 0.027360 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:35:51.654006 0.151661 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:35:51.806122 0.180392 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:35:51.986920 0.039849 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:35:52.027155 0.067715 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:35:52.095280 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 10:36:10.264909 0.077358 tcp 10.0.2.105 51666 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:10.342578 0.076664 tcp 10.0.2.105 51667 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:10.419546 0.175740 tcp 10.0.2.105 51668 -> 195.113.214.234 443 SRPA* 0 0 33 18100 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:10.595561 0.081043 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:10.677039 0.147189 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:10.824559 0.191545 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.016460 0.208713 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.225577 0.219446 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.445432 0.043859 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.489682 0.071436 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.561520 0.191856 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.753769 0.021696 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:11.775850 0.277725 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:12.053932 0.167869 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:12.222197 0.032719 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:12.255319 0.143901 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:12.399651 0.061139 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:12.461117 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 10:36:15.913533 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:36:22.920043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:36:28.779141 0.069973 tcp 10.0.2.105 51669 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:28.849400 0.071845 tcp 10.0.2.105 51670 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:28.921537 0.181380 tcp 10.0.2.105 51671 -> 195.113.214.234 443 SRPA* 0 0 41 21208 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:29.103386 0.000000 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 10:36:30.922058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:36:44.492029 0.081417 tcp 10.0.2.105 51672 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:44.573837 0.071539 tcp 10.0.2.105 51673 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:44.645673 0.191800 tcp 10.0.2.105 51674 -> 195.113.214.234 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:36:44.838108 0.144853 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:44.983392 0.356471 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.340433 0.142406 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.483221 0.174896 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.658544 0.094493 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.753515 0.055182 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.809115 0.055344 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:45.864878 0.138905 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:46.004192 0.042757 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:46.047362 0.221151 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/08 10:36:46.268949 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 10:36:46.924877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:37:01.576622 0.122210 tcp 10.0.2.105 51675 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:37:01.699129 0.070786 tcp 10.0.2.105 51676 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:37:01.770156 0.179275 tcp 10.0.2.105 51677 -> 195.113.214.234 443 SRPA* 0 0 24 14740 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:37:18.930978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:43:22.937929 3.000763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:43:29.944621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:43:37.945962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:43:53.948916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:44:25.954832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:49:24.955118 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 10:49:24.955229 0.573355 tcp 10.0.2.105 51678 -> 94.137.168.16 9773 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/01/08 10:50:29.961854 3.000351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:50:36.967953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:50:44.969688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:51:00.973022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:51:32.978486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:57:36.984218 3.002280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 10:57:43.992008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:57:51.993810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:58:07.997014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 10:58:40.002478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:04:44.008859 3.001410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:04:51.015948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:04:59.017548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:05:15.020860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:05:47.026716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:07:20.822040 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 11:07:20.822174 0.144606 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:20.967227 0.073556 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:21.041184 0.213291 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:21.254904 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 11:07:37.267381 0.076329 tcp 10.0.2.105 51679 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:07:37.343974 0.070963 tcp 10.0.2.105 51680 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:07:37.415215 0.176294 tcp 10.0.2.105 51681 -> 195.113.214.234 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:07:37.592554 0.066393 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:37.659332 0.278598 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:37.938304 0.246434 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.185155 0.144861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.330415 0.031498 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.362240 0.150659 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.513332 0.147063 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.660813 0.087859 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.749067 0.188269 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.937802 0.042820 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:38.981029 0.233234 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:39.214643 0.211287 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:39.426329 0.071199 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:39.497939 0.354915 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:39.853278 0.070048 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:39.923668 0.120349 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.044456 0.036165 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.080961 0.166645 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.248011 0.067135 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.315543 0.145351 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.461248 0.181383 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.643027 0.144874 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:40.788347 0.340133 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.128908 0.054891 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.184253 0.054497 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.239298 0.130255 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 590 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.369965 0.150140 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.520455 0.090503 udp 10.0.2.105 7010 <-> 178.236.50.212 1167 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:07:41.611352 0.000000 udp 10.0.2.105 7010 -> 186.92.93.240 9821 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 11:07:59.758089 0.080441 tcp 10.0.2.105 51682 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:07:59.838824 0.077015 tcp 10.0.2.105 51683 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:07:59.916160 0.179287 tcp 10.0.2.105 51684 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:11:51.033314 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 11:11:58.039962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:12:06.042037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:12:22.044371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:12:54.050804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:18:58.056849 3.001311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:19:05.064242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:19:13.065868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:19:25.534135 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 11:19:25.534321 0.622552 tcp 10.0.2.105 51685 -> 94.137.168.16 9773 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:19:29.068502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:20:01.074480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:26:05.081612 3.000527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:26:12.088495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:26:20.129875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:26:36.132885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:27:08.138865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:33:12.144881 3.001184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:33:19.151805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:33:27.153568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:33:43.156877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:34:15.162904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:38:00.797444 0.000158 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 11:38:00.797719 0.000000 udp 10.0.2.105 7010 -> 186.92.93.240 9821 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 11:38:18.554815 0.073220 tcp 10.0.2.105 51686 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:18.628462 0.119944 tcp 10.0.2.105 51687 -> 195.113.214.234 80 SRPA* 0 0 18 13356 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:18.748839 0.142002 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:18.891258 0.074931 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:18.966517 0.212347 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.179296 0.073714 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.253467 0.331729 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.585626 0.124067 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.710145 0.041002 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.751490 0.142668 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:19.894602 0.143114 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.038156 0.216920 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.255489 0.188378 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.444265 0.040680 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.485309 0.084045 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.569734 0.070898 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.641005 0.220000 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:20.861402 0.227735 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.089523 0.056286 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.146218 0.121911 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.268665 0.048808 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.317906 0.312258 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.630566 0.061280 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:21.692251 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 11:38:36.699231 0.070370 tcp 10.0.2.105 51688 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:36.769902 0.074680 tcp 10.0.2.105 51689 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:36.844856 0.171021 tcp 10.0.2.105 51690 -> 195.113.214.234 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:37.016383 0.161962 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:37.178761 0.142468 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:37.321683 0.341175 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:37.663205 0.194976 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:37.858544 0.046043 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:37.904936 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 11:38:56.737729 0.069500 tcp 10.0.2.105 51691 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:56.807567 0.107199 tcp 10.0.2.105 51692 -> 195.113.214.234 80 SRPA* 0 0 43 40521 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:38:56.915267 0.056066 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:56.971664 0.053368 udp 10.0.2.105 7010 <-> 46.49.70.63 5916 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:38:57.025424 0.129725 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/08 11:40:19.169519 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 11:40:26.176515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:40:34.177867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:40:50.180566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:41:22.186680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:47:26.192595 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:47:33.200043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:47:41.201790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:47:57.204329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:48:29.210959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:49:26.172912 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 11:49:26.173164 0.684248 tcp 10.0.2.105 51693 -> 94.137.168.16 9773 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/08 11:54:33.216858 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 11:54:40.223733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:54:48.225695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:55:04.228590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 11:55:36.234525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:01:40.239842 3.002849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:01:47.248500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:01:55.249866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:02:11.252698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:02:43.258769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:08:47.264659 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:08:54.271924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:09:00.050383 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 12:09:00.050479 0.141606 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:00.192520 0.000000 udp 10.0.2.105 7010 -> 178.236.50.212 1167 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 12:09:02.273629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:09:16.265797 0.075003 tcp 10.0.2.105 51694 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:16.341138 0.076961 tcp 10.0.2.105 51695 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:16.417901 0.170995 tcp 10.0.2.105 51696 -> 195.113.214.234 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:16.588726 0.142123 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:16.731204 0.076576 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:16.808150 0.291604 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.100173 0.151786 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.252311 0.032030 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.284724 0.145398 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.430524 0.146730 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.577645 0.064758 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.642755 0.212488 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.855647 0.082505 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:17.938576 0.071023 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.010012 0.366674 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.276153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:09:18.377070 0.230829 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.608243 0.055284 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.663890 0.040937 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.705202 0.214120 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:18.919914 0.182795 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:19.103083 0.094898 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:19.198389 0.033613 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:19.232363 0.122063 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:19.354812 0.338151 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:19.693468 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 12:09:36.733179 0.077321 tcp 10.0.2.105 51697 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:36.810787 0.075589 tcp 10.0.2.105 51698 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:36.886651 0.173342 tcp 10.0.2.105 51699 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:37.058933 0.202375 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.261737 0.045947 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.308007 0.144264 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.452677 0.340796 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.793845 0.129057 udp 10.0.2.105 7010 <-> 67.91.129.21 5805 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.923289 0.055868 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:09:37.979566 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 5916 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 12:09:50.282317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:09:56.712221 0.076425 tcp 10.0.2.105 51700 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:56.788929 0.073090 tcp 10.0.2.105 51701 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:09:56.862311 0.181120 tcp 10.0.2.105 51702 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:15:54.288057 3.002463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:16:01.295792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:16:09.297110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:16:25.300393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:16:57.306304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:19:26.862533 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 12:19:26.862780 0.653957 tcp 10.0.2.105 51703 -> 94.137.168.16 9773 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:23:01.312989 3.000820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:23:08.319820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:23:16.321693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:23:32.324234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:24:04.330210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:30:08.337000 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:30:15.343637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:30:23.345326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:30:39.348888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:31:11.354261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:37:15.361135 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:37:22.367602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:37:30.369700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:37:46.372383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:38:18.378243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:40:06.924730 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 12:40:06.924919 0.158249 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:07.083597 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 5916 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 12:40:23.500698 0.072472 tcp 10.0.2.105 51704 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:23.573475 0.071325 tcp 10.0.2.105 51705 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:23.645071 0.167995 tcp 10.0.2.105 51706 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:23.813573 0.142389 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:23.956471 0.075936 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.032818 0.142093 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.175285 0.045739 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.221442 0.142519 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.364539 0.148610 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.513551 0.068366 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.582298 0.252318 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.835018 0.091235 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.926602 0.030034 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:24.957029 0.072108 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.029558 0.151745 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.181678 0.228535 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.410564 0.188978 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.600037 0.179156 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.779612 0.218796 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:25.998808 0.067844 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.067065 0.039800 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.107217 0.047103 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.154669 0.062606 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.217678 0.031081 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.249114 0.123063 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.372641 0.142463 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.515444 0.340999 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:26.856871 0.000000 udp 10.0.2.105 7010 -> 67.91.129.21 5805 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 12:40:42.165957 0.071217 tcp 10.0.2.105 51707 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:42.237462 0.078665 tcp 10.0.2.105 51708 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:42.316573 0.171026 tcp 10.0.2.105 51709 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:40:42.486234 0.055972 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:42.542655 0.041009 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:40:42.584048 0.168503 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/08 12:44:22.384640 3.001598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 12:44:29.391679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:44:37.393559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:44:53.396075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:45:25.402562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:49:27.521218 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 12:49:27.521320 0.686094 tcp 10.0.2.105 51710 -> 94.137.168.16 9773 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/08 12:51:29.408794 3.001234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:51:36.416072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:51:44.417697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:52:00.420087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:52:32.425969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:58:36.433123 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 12:58:43.439907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:58:51.441090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:59:07.444586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 12:59:39.450284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:05:43.456555 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:05:50.463628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:05:58.465338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:06:14.468156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:06:46.473976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:10:49.453633 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 13:10:49.453800 0.000000 udp 10.0.2.105 7010 -> 67.91.129.21 5805 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 13:11:04.477671 0.073452 tcp 10.0.2.105 51711 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:04.551396 0.071076 tcp 10.0.2.105 51712 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:04.622730 0.172832 tcp 10.0.2.105 51713 -> 195.113.214.234 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:04.794506 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 13:11:21.350461 0.070706 tcp 10.0.2.105 51714 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:21.421057 0.075932 tcp 10.0.2.105 51715 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:21.497293 0.167182 tcp 10.0.2.105 51716 -> 195.113.214.234 443 SRPA* 0 0 32 16810 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:11:21.664796 0.144279 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:21.809429 0.144249 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:21.953989 0.073506 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.027948 0.034686 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.063050 0.066111 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.129514 0.258141 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.388013 0.081745 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.470166 0.149177 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.619804 0.148898 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.769130 0.072519 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.842119 0.026346 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:22.868864 0.228347 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:23.097610 0.187464 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:23.285424 0.243524 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:23.529381 0.748329 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:24.278052 0.124423 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:24.402833 0.039368 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:24.442606 0.475411 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:24.918455 0.137684 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.056578 0.144908 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.201871 0.340027 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.542337 0.081757 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.624653 0.029916 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.654999 0.121291 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.776716 0.169076 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:25.946233 0.054214 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:11:26.000867 0.096537 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:12:50.481036 3.000810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 13:12:57.487493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:13:05.489151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:13:21.491950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:13:53.498169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:19:28.209843 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 13:19:28.209962 0.572942 tcp 10.0.2.105 51717 -> 94.137.168.16 9773 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:19:57.504683 3.001035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:20:04.511868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:20:12.513091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:20:28.516537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:21:00.522419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:27:04.528511 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:27:11.535631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:27:19.536751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:27:35.539783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:28:07.545983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:34:11.552971 3.031378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:34:18.589850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:34:26.591250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:34:42.594346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:35:14.600299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:41:18.606427 3.021617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:41:25.633629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:41:29.269375 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 13:41:29.269640 0.159922 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.429985 0.074869 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.505245 0.033847 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.539485 0.068278 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.608170 0.143957 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.752702 0.143694 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:29.896773 0.308229 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.205426 0.074246 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.280091 0.148456 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.428992 0.146058 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.575400 0.072750 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.648565 0.028619 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.677548 0.227274 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:30.905169 0.192488 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.098075 0.180512 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.278976 0.042216 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.321563 0.023141 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.345099 0.137828 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.483333 0.220776 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:31.704527 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 13:41:33.635008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:41:48.027766 0.073728 tcp 10.0.2.105 51718 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:41:48.101799 0.071690 tcp 10.0.2.105 51719 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:41:48.173798 0.148065 tcp 10.0.2.105 51720 -> 195.113.214.234 443 SRPA* 0 0 38 25031 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:41:48.322380 0.149211 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:48.471992 0.339258 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:48.811702 0.060003 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:48.872057 0.031641 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:48.904155 0.120973 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:49.025524 0.170578 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:49.196548 0.055555 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:49.252663 0.042597 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 13:41:49.638031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:42:21.644144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:48:25.651172 3.000984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:48:32.657510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:48:40.659432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:48:56.661725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:49:28.667920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:49:28.789074 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 13:49:28.789173 3.003751 tcp 10.0.2.105 51721 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 13:49:37.791388 0.000000 tcp 10.0.2.105 51721 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/08 13:49:43.792048 0.075191 tcp 10.0.2.105 51722 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:49:43.867596 0.074889 tcp 10.0.2.105 51723 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:49:43.942770 0.153032 tcp 10.0.2.105 51724 -> 195.113.214.234 443 SRPA* 0 0 35 26919 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:49:44.115380 0.922109 tcp 10.0.2.105 51725 -> 128.255.183.224 9027 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/01/08 13:55:32.673790 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 13:55:39.681234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:55:47.682719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:56:03.686201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 13:56:35.691748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:02:39.698675 3.001276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:02:46.705492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:02:54.706982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:03:10.710130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:03:42.715850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:09:46.722812 3.000671 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:09:53.729544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:10:01.730622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:10:17.733985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:10:49.739937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:12:10.606406 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 14:12:10.606506 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 14:12:29.465012 0.070015 tcp 10.0.2.105 51726 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:12:29.535324 0.076563 tcp 10.0.2.105 51727 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:12:29.612207 0.145964 tcp 10.0.2.105 51728 -> 195.113.214.234 443 SRPA* 0 0 37 27027 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:12:29.758776 0.034012 udp 10.0.2.105 7010 <-> 88.73.42.82 7099 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:29.793151 0.066851 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:29.860578 0.137898 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:29.998889 0.144352 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.143662 0.164152 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.308248 0.073850 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.382533 0.075724 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.458618 0.143104 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.602129 0.146327 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:30.770041 0.343151 udp 10.0.2.105 7010 <-> 76.212.1.109 8102 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.113589 0.054254 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.168344 0.226738 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.395533 0.189059 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.584996 0.071430 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.656831 0.131046 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:31.788234 0.288692 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.077332 0.039639 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.117377 0.180750 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.298545 0.060323 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.359230 0.340306 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.699896 0.059213 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.759458 0.034998 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.794782 0.121285 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:32.916572 0.146096 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:33.063057 0.036211 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:33.099664 0.169242 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:12:33.269318 0.054812 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:16:53.745623 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:17:00.753708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:17:08.754931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:17:24.758187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:17:56.763855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:19:45.039780 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 14:19:45.039969 0.942859 tcp 10.0.2.105 51729 -> 128.255.183.224 9027 FSPA* 0 0 14 1514 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:24:00.770060 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:24:07.777274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:24:15.779013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:24:31.781953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:25:03.787706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:31:07.794629 3.000626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:31:14.801521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:31:22.802915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:31:38.805557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:32:10.811902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:38:14.817830 3.002025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:38:21.825105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:38:29.826867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:38:45.859915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:39:17.865589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:42:58.183038 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 14:42:58.183191 0.141242 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:42:58.324828 0.139428 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:42:58.464686 0.000000 udp 10.0.2.105 7010 -> 88.73.42.82 7099 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 14:43:14.688237 0.075000 tcp 10.0.2.105 51730 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:14.763523 0.074278 tcp 10.0.2.105 51731 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:14.838168 0.160787 tcp 10.0.2.105 51732 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:14.999433 0.066834 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:15.066662 0.195852 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:15.262946 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 14:43:32.993639 0.069959 tcp 10.0.2.105 51733 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:33.063943 0.066949 tcp 10.0.2.105 51734 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:33.131201 0.155957 tcp 10.0.2.105 51735 -> 195.113.214.234 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:33.287761 0.076829 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:33.364993 0.150247 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:33.515632 0.140041 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:33.656068 0.000000 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 14:43:52.471531 0.071744 tcp 10.0.2.105 51736 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:52.543649 0.109675 tcp 10.0.2.105 51737 -> 195.113.214.234 80 SRPA* 0 0 38 24217 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:43:52.653840 0.033106 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:52.687346 0.227002 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:52.914723 0.189392 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.104669 0.084015 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.189089 0.137933 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.327443 0.217523 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.545374 0.039422 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.585140 0.180354 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:53.765890 0.475165 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.241467 0.340022 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.581886 0.059465 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.642135 0.032887 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.675432 0.121024 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.796881 0.146067 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:54.943343 0.062295 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:55.006002 0.170502 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:43:55.176871 0.054155 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 14:45:21.872528 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 14:45:28.879111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:45:36.880991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:45:52.884036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:46:24.889700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:49:45.989743 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 14:49:45.989858 0.976247 tcp 10.0.2.105 51738 -> 128.255.183.224 9027 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/01/08 14:52:28.895430 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:52:35.903123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:52:43.904446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:52:59.908087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:53:31.913990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:59:35.920006 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 14:59:42.927236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 14:59:50.928882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:00:06.931842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:00:38.937547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:06:42.944661 3.000489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:06:49.951529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:06:57.952656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:07:13.955864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:07:45.961809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:13:49.968090 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:13:56.974910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:14:04.536192 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:14:04.536361 0.000000 udp 10.0.2.105 7010 -> 88.73.42.82 7099 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:14:04.976711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:14:20.979833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:14:22.934377 0.074823 tcp 10.0.2.105 51739 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:23.009482 0.075078 tcp 10.0.2.105 51740 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:23.084927 0.157607 tcp 10.0.2.105 51741 -> 195.113.214.234 443 SRPA* 0 0 40 21152 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:23.243193 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:14:40.288522 0.074002 tcp 10.0.2.105 51742 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:40.362867 0.075356 tcp 10.0.2.105 51743 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:40.437710 0.159327 tcp 10.0.2.105 51744 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:40.597732 0.000000 udp 10.0.2.105 7010 -> 76.212.1.109 8102 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:14:52.985968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:14:56.571508 0.073174 tcp 10.0.2.105 51745 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:56.644972 0.074519 tcp 10.0.2.105 51746 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:56.719761 0.158032 tcp 10.0.2.105 51747 -> 195.113.214.234 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:14:56.876338 3.454690 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1088 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.021730 3.161762 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 4 1050 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.166382 3.236428 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 4 1086 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.232733 3.338601 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 4 1147 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.399245 3.325323 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 4 1111 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.548071 3.255932 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1077 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.632405 3.323227 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 4 1174 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:57.843734 3.300963 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 4 1143 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.033118 3.149512 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 4 991 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.068741 3.342483 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 4 1042 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.298147 3.201357 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 4 1264 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.382860 3.269317 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1224 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.535204 3.341399 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1149 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.773836 3.143410 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 4 883 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:58.813442 3.314231 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 4 1107 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.023298 3.128466 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 4 1194 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.042492 4.105578 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1285 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.385311 2.833854 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 4 1355 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.461824 2.792366 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 4 1402 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.494093 2.881096 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1158 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.616316 2.916393 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 4 1154 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.765114 2.806541 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 4 1206 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.803809 2.940468 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 4 1173 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:14:59.971076 2.830206 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 4 1152 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:15:03.148971 0.068826 udp 10.0.2.105 7010 <-> 151.54.56.21 4172 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:15:03.242346 0.000000 udp 10.0.2.105 7010 -> 184.53.228.158 2554 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:10.371163 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 9977 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:16.710296 0.250839 udp 10.0.2.105 7010 -> 200.195.167.210 1013 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:16.961135 0.000000 icmp 200.195.167.210 0x0303 -> 10.0.2.105 0xf503 URP 192 1 306 flow=Background 1970/01/08 15:15:21.446796 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:15:25.051989 0.218253 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:15:25.290222 0.000000 udp 10.0.2.105 7010 -> 190.233.32.8 8881 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:32.422291 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:40.854900 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5838 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:45.440755 0.000197 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:15:47.644180 0.000000 udp 10.0.2.105 7010 -> 114.79.17.114 8693 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:15:54.153503 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:00.402498 0.000000 udp 10.0.2.105 7010 -> 98.220.217.87 4936 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:05.900537 0.000000 udp 10.0.2.105 7010 -> 175.140.62.93 6504 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:10.447138 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:16:12.079511 0.000000 udp 10.0.2.105 7010 -> 79.26.177.26 2254 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:19.490422 0.000000 udp 10.0.2.105 7010 -> 79.176.255.30 7298 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:25.518765 0.000000 udp 10.0.2.105 7010 -> 71.195.238.201 6728 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:34.181684 0.070968 udp 10.0.2.105 7010 -> 88.246.131.147 3123 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:34.252652 0.000000 icmp 88.246.131.147 0x0303 -> 10.0.2.105 0x330c URP 192 1 216 flow=Background 1970/01/08 15:16:38.948334 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:16:39.348996 0.000000 udp 10.0.2.105 7010 -> 72.239.84.221 2368 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:45.798204 0.000000 udp 10.0.2.105 7010 -> 94.34.147.206 9141 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:16:53.869684 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:01.060513 0.000000 udp 10.0.2.105 7010 -> 82.63.170.2 6689 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:05.947077 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:17:06.978299 0.000000 udp 10.0.2.105 7010 -> 93.33.100.210 9249 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:12.095665 0.000000 udp 10.0.2.105 7010 -> 39.53.27.213 3129 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:19.706798 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:27.577902 0.031600 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:27.620430 0.199458 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:27.835207 0.199349 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:28.053614 0.060799 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:28.136806 0.139808 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:28.303598 0.000000 udp 10.0.2.105 7010 -> 190.204.198.92 6997 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:32.444963 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:17:36.410649 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:43.030245 0.183307 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:43.223362 0.077440 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:17:43.309808 0.000000 udp 10.0.2.105 7010 -> 75.165.87.71 5665 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:51.542947 0.195410 udp 10.0.2.105 7010 -> 216.14.224.163 9136 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:17:51.738357 0.000000 icmp 216.14.224.163 0x0303 -> 10.0.2.105 0xb023 URP 192 1 221 flow=Background 1970/01/08 15:17:56.449504 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:17:59.023354 0.000000 udp 10.0.2.105 7010 -> 151.64.55.107 2211 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:04.351494 0.000000 udp 10.0.2.105 7010 -> 173.160.235.114 1422 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:12.232076 0.000000 udp 10.0.2.105 7010 -> 119.92.149.80 4846 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:19.723458 0.000000 udp 10.0.2.105 7010 -> 173.17.84.94 3503 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:24.449579 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:18:26.573242 0.000000 udp 10.0.2.105 7010 -> 219.74.177.53 5208 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:33.863215 0.000000 udp 10.0.2.105 7010 -> 88.73.102.31 4521 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:39.240926 0.143385 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 656 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:18:39.395085 0.147443 udp 10.0.2.105 7010 <-> 66.115.236.84 2299 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:18:39.556034 0.000000 udp 10.0.2.105 7010 -> 216.20.151.84 2298 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:46.922115 0.133484 udp 10.0.2.105 7010 -> 88.204.167.83 3546 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:18:47.055599 0.000000 icmp 88.204.167.83 0x0303 -> 10.0.2.105 0xda0d URP 192 1 196 flow=Background 1970/01/08 15:18:51.448891 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:18:52.931204 0.176985 udp 10.0.2.105 7010 <-> 187.160.97.38 5677 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:18:53.118606 0.308792 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:18:53.447946 0.000000 udp 10.0.2.105 7010 -> 85.99.5.141 5005 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:01.943594 0.000000 udp 10.0.2.105 7010 -> 173.186.243.18 6992 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:09.734961 0.170112 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 652 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:19:09.955736 0.000000 udp 10.0.2.105 7010 -> 151.66.167.58 2005 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:15.753453 0.178828 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:19:15.953744 0.073715 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:19:16.054330 0.000000 udp 10.0.2.105 7010 -> 67.52.122.78 7877 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:20.440097 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:19:23.615311 0.000000 udp 10.0.2.105 7010 -> 204.249.210.29 4139 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:29.463680 0.190404 udp 10.0.2.105 7010 <-> 108.208.166.46 9252 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:19:29.670108 0.000000 udp 10.0.2.105 7010 -> 63.85.131.9 3279 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:38.386426 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:43.824266 0.000000 udp 10.0.2.105 7010 -> 99.75.13.7 3823 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:46.968721 0.980747 tcp 10.0.2.105 51748 -> 128.255.183.224 9027 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:19:49.712205 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 7946 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:19:57.333316 0.000000 udp 10.0.2.105 7010 -> 79.28.253.6 9291 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:04.403460 0.000000 udp 10.0.2.105 7010 -> 86.43.111.115 8885 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:11.563863 0.000000 udp 10.0.2.105 7010 -> 151.73.71.169 4708 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:16.440430 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:20:18.844467 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:25.904348 0.095207 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:20:26.017682 0.000000 udp 10.0.2.105 7010 -> 207.248.128.57 1728 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:32.384208 0.000000 udp 10.0.2.105 7010 -> 168.16.67.28 9829 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:40.625599 0.000000 udp 10.0.2.105 7010 -> 77.239.155.128 4868 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:45.442644 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:20:46.374460 0.000000 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:51.391583 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:20:56.992458 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 15:20:57.309492 0.000000 udp 10.0.2.105 7010 -> 186.140.107.30 2397 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:21:03.998815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:21:04.390262 0.000000 udp 10.0.2.105 7010 -> 82.152.24.6 2567 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:21:09.837834 0.000000 udp 10.0.2.105 7010 -> 190.153.214.138 2156 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:21:12.000523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:21:14.444079 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:21:15.505796 0.000000 udp 10.0.2.105 7010 -> 203.206.207.1 6000 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:21:23.747849 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:21:28.004008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:22:00.009587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:28:04.016593 3.000751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:28:11.023324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:28:19.024522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:28:35.027798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:29:07.033798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:35:11.039961 3.041790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:35:18.087105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:35:26.088753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:35:42.091955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:36:14.098017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:42:18.104671 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:42:25.110752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:42:33.112459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:42:49.115403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:43:21.121511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:49:25.127838 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 15:49:32.135287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:49:40.136254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:49:47.968847 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:49:47.968980 0.995025 tcp 10.0.2.105 51749 -> 128.255.183.224 9027 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:49:56.139868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:50:28.145744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:51:33.690400 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 15:51:33.690503 0.159509 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:33.850400 0.147827 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:33.998637 0.078108 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.077150 0.145252 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.222761 0.195076 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.418261 0.136849 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.555475 0.146397 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.702273 0.066782 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.769400 0.027775 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:34.797583 0.228820 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.026813 0.071048 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.098265 0.137712 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.236596 0.222527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.459500 0.039527 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.499418 0.185956 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.685762 0.154548 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.840721 0.061134 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:35.902206 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:51:52.057524 0.069596 tcp 10.0.2.105 51750 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:51:52.127371 0.070751 tcp 10.0.2.105 51751 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:51:52.198453 0.158863 tcp 10.0.2.105 51752 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:51:52.357789 0.121157 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:52.479344 0.144022 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:52.623721 0.035691 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:52.659826 0.169371 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:51:52.829605 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:52:10.172880 0.065218 tcp 10.0.2.105 51753 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:10.238399 0.073993 tcp 10.0.2.105 51754 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:10.312765 0.157798 tcp 10.0.2.105 51755 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:10.471292 0.342972 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:10.814694 0.072528 udp 10.0.2.105 7010 <-> 151.54.56.21 4172 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:10.887655 0.217174 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.105233 0.179506 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.285144 0.191825 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.477332 0.056891 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.534559 0.029549 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.564514 0.140170 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:11.705111 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:52:29.700937 0.066646 tcp 10.0.2.105 51756 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:29.767883 0.103288 tcp 10.0.2.105 51757 -> 195.113.214.234 80 SRPA* 0 0 20 14807 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:29.871555 0.181058 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:30.053011 0.000000 udp 10.0.2.105 7010 -> 66.115.236.84 2299 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:52:46.565607 0.069074 tcp 10.0.2.105 51758 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:46.634953 0.075268 tcp 10.0.2.105 51759 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:46.710469 0.156760 tcp 10.0.2.105 51760 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:52:46.867683 0.157641 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:47.025744 0.177439 udp 10.0.2.105 7010 <-> 187.160.97.38 5677 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:52:47.203541 0.000000 udp 10.0.2.105 7010 -> 186.92.93.240 9821 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:53:05.472818 0.070531 tcp 10.0.2.105 51761 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:53:05.543656 0.100786 tcp 10.0.2.105 51762 -> 195.113.214.234 80 SRPA* 0 0 18 13385 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:53:05.644943 0.169879 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:53:05.815184 0.166036 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:53:05.981644 0.070883 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:53:06.052988 0.000000 udp 10.0.2.105 7010 -> 108.208.166.46 9252 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 15:53:23.758980 0.073742 tcp 10.0.2.105 51763 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:53:23.833041 0.073991 tcp 10.0.2.105 51764 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:53:23.907359 0.156562 tcp 10.0.2.105 51765 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 15:53:24.064596 0.090434 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/08 15:56:32.152070 3.001381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 15:56:39.158945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:56:47.160785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:57:03.163863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 15:57:35.169590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:03:39.176307 3.001161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:03:46.182714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:03:54.184376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:04:10.187343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:04:42.193425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:10:46.200122 3.000750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:10:53.206800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:11:01.208246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:11:17.211511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:11:49.217975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:17:53.224829 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:18:00.231235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:18:08.232498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:18:24.235396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:18:56.242634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:19:48.968341 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 16:19:48.968477 1.010501 tcp 10.0.2.105 51766 -> 128.255.183.224 9027 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:23:52.267365 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 16:23:52.267609 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:24:11.106617 0.070837 tcp 10.0.2.105 51767 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:11.177735 0.074041 tcp 10.0.2.105 51768 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:11.252075 0.150936 tcp 10.0.2.105 51769 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:11.403553 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:24:29.321132 0.068843 tcp 10.0.2.105 51770 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:29.390253 0.073468 tcp 10.0.2.105 51771 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:29.464072 0.158187 tcp 10.0.2.105 51772 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:29.622896 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:24:45.984794 0.068326 tcp 10.0.2.105 51773 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:46.053409 0.070047 tcp 10.0.2.105 51774 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:46.123754 0.157257 tcp 10.0.2.105 51775 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:24:46.281622 0.142475 udp 10.0.2.105 7010 <-> 66.115.236.84 2299 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:24:46.424564 0.296884 udp 10.0.2.105 7010 <-> 186.92.93.240 9821 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:24:46.721885 0.000000 udp 10.0.2.105 7010 -> 108.208.166.46 9252 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:25:00.248216 3.000721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 16:25:04.872048 0.074025 tcp 10.0.2.105 51776 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:25:04.946353 0.101392 tcp 10.0.2.105 51777 -> 195.113.214.234 80 SRPA* 0 0 20 14732 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:25:05.048260 0.081722 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.130390 0.294241 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.425007 0.161034 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.586485 0.072754 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.659639 0.142524 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.802573 0.191253 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:05.994242 0.027140 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.021730 0.146385 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.168549 0.067583 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.236567 0.144342 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.381332 0.229133 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.610855 0.039277 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.650527 0.180802 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:06.831736 0.220267 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.052425 0.137599 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.190382 0.062176 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.253003 0.034785 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.255010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:25:07.288152 0.191141 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.479737 0.121836 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.602022 0.167148 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.769551 0.037138 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:07.807095 0.217094 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.024545 0.062923 udp 10.0.2.105 7010 <-> 151.54.56.21 4172 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.087880 0.338425 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.426649 0.183331 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.610413 0.191334 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.802156 0.145687 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.948200 0.028839 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:08.977433 0.056994 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.034839 0.181526 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.216759 0.146616 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.363798 0.175686 udp 10.0.2.105 7010 <-> 187.160.97.38 5677 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.539886 0.173293 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.713551 0.169467 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.883369 0.070405 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:09.954171 0.094791 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:25:15.256184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:25:31.259069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:26:03.265234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:32:07.271499 3.001682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:32:14.278794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:32:22.280332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:32:38.283254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:33:10.289214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:39:14.296089 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:39:21.302760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:39:29.304123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:39:45.307337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:40:17.313479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:46:21.319853 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:46:28.327044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:46:36.328009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:46:52.331653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:47:24.337356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:49:49.987153 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 16:49:49.987379 0.959807 tcp 10.0.2.105 51778 -> 128.255.183.224 9027 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:53:28.343588 3.001662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 16:53:35.350453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:53:43.352614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:53:59.355268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:54:31.361830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 16:55:36.735854 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 16:55:36.736008 0.139085 udp 10.0.2.105 7010 <-> 66.115.236.84 2299 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:55:36.875429 0.000000 udp 10.0.2.105 7010 -> 186.92.93.240 9821 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:55:54.663037 0.048056 tcp 10.0.2.105 51779 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:55:54.711386 0.062296 tcp 10.0.2.105 51780 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:55:54.773977 0.137066 tcp 10.0.2.105 51781 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:55:54.911773 0.080041 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:55:54.992213 0.000000 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:56:13.418766 0.063627 tcp 10.0.2.105 51782 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:56:13.482744 0.046739 tcp 10.0.2.105 51783 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:56:13.529825 0.150998 tcp 10.0.2.105 51784 -> 195.113.214.234 443 SRPA* 0 0 22 11400 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:56:13.681724 0.160049 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:13.842122 0.072202 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:13.914739 0.145190 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.060376 0.193040 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.253777 0.029687 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.283861 0.146121 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.430364 0.250011 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.680770 0.039782 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.720922 0.178895 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:14.900235 0.355747 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:15.256538 0.063390 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:15.320364 0.142003 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:15.462761 0.124038 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:15.587150 0.062380 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:15.649891 0.383762 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.034072 0.146858 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.181336 0.120804 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.302535 0.168806 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.471738 0.038091 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.510232 0.214927 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:16.725539 0.000000 udp 10.0.2.105 7010 -> 151.54.56.21 4172 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 16:56:32.275624 0.062612 tcp 10.0.2.105 51785 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:56:32.338572 0.082602 tcp 10.0.2.105 51786 -> 195.113.214.234 80 SRPA* 0 0 18 13331 flow=From-Botnet-V2-TCP-Established 1970/01/08 16:56:32.421659 0.190979 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:32.613040 0.138404 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:32.751801 0.029825 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:32.782015 0.057847 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:32.840263 0.339338 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:33.180020 0.174163 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:33.354616 0.195303 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:33.550287 0.192488 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:33.743136 0.177193 udp 10.0.2.105 7010 <-> 187.160.97.38 5677 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:33.920675 0.187912 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:34.109000 0.416399 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:34.525833 0.069265 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 16:56:34.595498 0.094933 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:00:35.367782 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 17:00:42.375079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:00:50.376048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:01:06.379196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:01:38.385190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:07:42.391903 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:07:49.398863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:07:57.400069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:08:13.403009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:08:45.409516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:14:49.415903 3.000872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:14:56.422558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:15:04.424178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:15:20.426818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:15:52.433317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:19:50.946747 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 17:19:50.946847 0.975087 tcp 10.0.2.105 51787 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:21:56.439803 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:22:03.446785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:22:11.448127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:22:27.451137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:22:59.456996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:27:02.426595 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 17:27:02.426696 0.000000 udp 10.0.2.105 7010 -> 186.92.93.240 9821 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:27:17.830972 0.044324 tcp 10.0.2.105 51788 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:17.875570 0.043102 tcp 10.0.2.105 51789 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:17.919077 0.136182 tcp 10.0.2.105 51790 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:18.055740 0.145642 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:18.201821 0.000000 udp 10.0.2.105 7010 -> 151.54.56.21 4172 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:27:33.872715 0.060288 tcp 10.0.2.105 51791 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:33.933310 0.065829 tcp 10.0.2.105 51792 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:33.999427 0.133644 tcp 10.0.2.105 51793 -> 195.113.214.234 443 SRPA* 0 0 21 10744 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:34.133695 0.000000 udp 10.0.2.105 7010 -> 66.115.236.84 2299 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:27:52.008175 0.043256 tcp 10.0.2.105 51794 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:52.051715 0.043246 tcp 10.0.2.105 51795 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:52.095342 0.136403 tcp 10.0.2.105 51796 -> 195.113.214.234 443 SRPA* 0 0 24 11530 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:27:52.232357 0.079113 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.311826 0.139864 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.452129 0.071439 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.523996 0.162487 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.686978 0.027010 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.714354 0.189884 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.904676 0.039598 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:52.944818 0.181494 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.126673 0.227344 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.354407 0.148593 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.503394 0.143519 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.647336 0.137357 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.785088 0.060373 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.845820 0.051686 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:53.897907 0.148997 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.047280 0.067742 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.115449 0.213119 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.328997 0.217004 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.546394 0.121500 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.668287 0.167887 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.836587 0.042234 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:54.879144 0.190301 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:55.069852 0.146140 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:55.216614 0.028004 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:55.244958 0.057212 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:55.302570 0.342556 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:27:55.645470 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:28:10.665166 0.046150 tcp 10.0.2.105 51797 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:10.711660 0.047227 tcp 10.0.2.105 51798 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:10.759159 0.154999 tcp 10.0.2.105 51799 -> 195.113.214.234 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:10.914844 0.000000 udp 10.0.2.105 7010 -> 187.160.97.38 5677 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:28:26.828934 0.043178 tcp 10.0.2.105 51800 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:26.872564 0.064454 tcp 10.0.2.105 51801 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:26.937308 0.138106 tcp 10.0.2.105 51802 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:28:27.075992 0.181655 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:28:27.258054 0.174694 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:28:27.433168 0.194241 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:28:27.627769 0.094428 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:28:27.722545 0.173849 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:28:27.896823 0.071274 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:29:03.462584 3.002447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 17:29:10.470576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:29:18.472344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:29:34.475000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:30:06.871884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:36:10.878516 3.000475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:36:17.885161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:36:25.886273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:36:41.889386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:37:13.895628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:43:17.902313 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:43:24.909269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:43:32.910330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:43:48.913574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:44:20.919467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:49:52.116274 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 17:49:52.116508 2.962746 tcp 10.0.2.105 51803 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:50:24.925361 3.002277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:50:31.933041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:50:39.934286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:50:55.937475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:51:27.943377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:57:31.948989 3.002294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 17:57:38.956798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:57:46.958178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:58:02.961602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:58:34.967715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 17:58:40.345844 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 17:58:40.346003 0.000000 udp 10.0.2.105 7010 -> 66.115.236.84 2299 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:58:57.691562 0.043844 tcp 10.0.2.105 51804 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:58:57.735695 0.044731 tcp 10.0.2.105 51805 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:58:57.780741 0.132503 tcp 10.0.2.105 51806 -> 195.113.214.234 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:58:57.913943 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:59:14.044048 0.043454 tcp 10.0.2.105 51807 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:14.087734 0.046214 tcp 10.0.2.105 51808 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:14.134296 0.136086 tcp 10.0.2.105 51809 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:14.270958 0.000000 udp 10.0.2.105 7010 -> 187.160.97.38 5677 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:59:30.888145 0.041068 tcp 10.0.2.105 51810 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:30.929503 0.041666 tcp 10.0.2.105 51811 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:30.971424 0.138788 tcp 10.0.2.105 51812 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:31.110702 0.147766 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.258920 0.070967 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.330279 0.163151 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.493839 0.027492 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.521696 0.187981 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.710029 0.040601 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.751044 0.179046 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:31.930401 0.143358 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.074211 0.084991 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.159682 0.226722 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.386808 0.064837 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.451993 0.095662 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.548032 0.145624 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:32.694052 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 17:59:48.914385 0.043641 tcp 10.0.2.105 51813 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:48.958301 0.045217 tcp 10.0.2.105 51814 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:49.003901 0.131483 tcp 10.0.2.105 51815 -> 195.113.214.234 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/08 17:59:49.135938 0.148187 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:49.284545 0.145932 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:49.430899 0.151935 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:49.583255 0.036886 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:49.620526 0.188552 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:49.809477 0.220657 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.030542 0.120055 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.151036 0.216132 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.367539 0.167899 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.535871 0.342903 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.879172 0.028640 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:50.908195 0.140584 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.049203 0.055308 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.104833 0.226567 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.331830 0.194412 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.526589 0.094650 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.621646 0.168829 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.790867 0.070441 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 17:59:51.861697 0.158259 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:04:38.973850 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 18:04:45.980816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:04:53.982815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:05:09.985255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:05:41.991684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:11:45.998305 3.000830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:11:53.004627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:12:01.006689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:12:17.009793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:12:49.015774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:18:53.021676 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:19:00.029312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:19:08.032142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:19:24.033450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:19:55.078655 0.000207 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 18:19:55.078969 0.945395 tcp 10.0.2.105 51816 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/08 18:19:56.039153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:26:00.045298 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:26:07.052779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:26:15.054231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:26:31.057453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:27:03.063765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:30:01.931182 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 18:30:01.931376 0.064980 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:01.996781 0.144946 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.142076 0.071323 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.213838 0.190772 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.405029 0.162388 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.567828 0.248375 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.816614 0.137277 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:02.954297 0.077012 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.031707 0.042017 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.074064 0.028270 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.102713 0.147558 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.250698 0.248972 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.500079 0.060306 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.560784 0.072288 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.633473 0.144121 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.777986 0.145232 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:03.923618 0.138078 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:04.062098 0.036682 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:04.099138 0.188667 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:04.288351 0.393745 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:04.682498 0.119912 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:04.802758 0.217984 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.021087 0.172036 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.193507 0.340209 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.534073 0.029206 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.563617 0.138745 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.702755 0.057467 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.760627 0.173855 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:05.934895 0.166664 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:06.101964 0.069288 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:06.171641 0.157117 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:06.329119 0.194544 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:30:06.524066 0.094807 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/08 18:33:07.069652 3.001618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:33:14.077052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:33:22.077987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:33:38.081470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:34:10.087727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:40:14.093919 3.001044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:40:21.100814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:40:29.102225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:40:45.105444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:41:17.111519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:47:21.117657 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:47:28.125021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:47:36.126394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:47:52.129593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:48:24.135565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:49:56.028207 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 18:49:56.028314 1.341442 tcp 10.0.2.105 51817 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/08 18:54:28.141172 3.002045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 18:54:35.148403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:54:43.150133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:54:59.153101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 18:55:31.159306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:00:07.426559 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 19:00:07.426660 0.070240 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:07.497348 0.065841 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:07.563560 0.141294 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:07.705281 0.193051 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:07.898748 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 19:00:25.344070 0.069463 tcp 10.0.2.105 51818 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:00:25.413876 0.073576 tcp 10.0.2.105 51819 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:00:25.487757 0.133533 tcp 10.0.2.105 51820 -> 195.113.214.234 443 SRPA* 0 0 40 20892 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:00:25.621506 0.183381 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:25.805265 0.142891 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:25.948764 0.086587 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.035769 0.041269 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.077406 0.032656 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.110373 0.146388 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.257177 0.228573 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.486105 0.059908 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.546395 0.029994 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.576745 0.146619 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.723753 0.146533 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:26.870697 0.138016 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.009109 0.035910 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.045357 0.189553 udp 10.0.2.105 7010 <-> 190.36.24.192 3980 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.235326 0.218361 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.454100 0.169597 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.624093 0.219945 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.844612 0.120241 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:27.965268 0.380714 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.346384 0.028201 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.374925 0.141798 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.517133 0.056537 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.574002 0.183727 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.758138 0.170193 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:28.928759 0.075707 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:29.004818 0.156794 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:29.161966 0.195630 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:00:29.357979 0.094691 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:01:35.167236 2.999538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:01:42.173113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:01:50.174057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:02:06.177318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:02:38.183296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:08:42.189211 3.002006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:08:49.196377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:08:57.198250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:09:13.201429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:09:45.207577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:15:49.213940 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:15:56.220832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:16:04.221856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:16:20.224926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:16:52.231398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:19:57.378090 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 19:19:57.378205 0.991056 tcp 10.0.2.105 51821 -> 128.255.183.224 9027 FSPA* 0 0 14 1660 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:22:56.237575 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:23:03.244805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:23:11.245748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:23:27.249281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:23:59.255416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:30:03.261809 3.011270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:30:10.278757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:30:18.280018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:30:33.693046 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 19:30:33.693305 0.164396 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:33.858113 0.186923 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.045481 0.062945 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.108835 0.082782 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.191966 0.146418 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.282756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:30:34.430689 0.215784 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.646872 0.141294 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.788520 0.089906 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.878866 0.040826 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.920069 0.026104 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:34.946621 0.146949 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.094023 0.228489 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.322863 0.062220 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.385491 0.279417 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.665394 0.147841 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.813663 0.140997 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:35.955057 0.137775 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:36.177161 0.038861 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:36.216409 0.000000 udp 10.0.2.105 7010 -> 190.36.24.192 3980 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 19:30:51.320190 0.070272 tcp 10.0.2.105 51822 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:30:51.390760 0.108383 tcp 10.0.2.105 51823 -> 195.113.214.234 80 SRPA* 0 0 18 8382 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:30:51.499560 0.217539 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:51.717503 0.120777 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:51.838692 0.378310 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.217413 0.029842 udp 10.0.2.105 7010 <-> 79.219.109.96 2430 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.247932 0.218296 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.466636 0.168219 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.635261 0.141183 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.776905 0.058765 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:52.836035 0.180032 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:53.016489 0.166950 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:53.183811 0.069997 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:53.254207 0.156790 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:53.411350 0.201695 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:30:53.613440 0.095313 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/08 19:31:06.288944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:37:10.735479 3.001583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:37:17.743074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:37:25.744886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:37:41.747778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:38:13.753508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:44:17.759866 3.001175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:44:24.766972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:44:32.768979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:44:48.771782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:45:20.777788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:49:58.597504 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 19:49:58.597609 0.978070 tcp 10.0.2.105 51824 -> 128.255.183.224 9027 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/01/08 19:51:24.783520 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:51:31.791314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:51:39.792339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:51:55.795417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:52:27.801915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:58:31.808269 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 19:58:38.814806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:58:46.816730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:59:02.819441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 19:59:34.825855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:01:17.583806 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 20:01:17.583996 0.000000 udp 10.0.2.105 7010 -> 190.36.24.192 3980 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 20:01:36.583032 0.073630 tcp 10.0.2.105 51825 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:36.656923 0.070748 tcp 10.0.2.105 51826 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:36.727956 0.131891 tcp 10.0.2.105 51827 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:36.860491 0.062463 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:36.923388 0.084264 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:37.008008 0.162743 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:37.171284 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 20:01:53.074769 0.066034 tcp 10.0.2.105 51828 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:53.141092 0.078365 tcp 10.0.2.105 51829 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:53.219731 0.133870 tcp 10.0.2.105 51830 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:01:53.354148 0.180134 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:53.534678 0.143281 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:53.678342 0.087165 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:53.765892 0.044503 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:53.810788 0.147828 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:53.958998 0.144018 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.103439 0.228189 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.332024 0.035332 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.367720 0.142683 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.510975 0.145077 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.656504 0.138006 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.794901 0.036972 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.832411 0.086901 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:54.919702 0.309895 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:55.229966 0.342977 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:01:55.573390 0.000000 udp 10.0.2.105 7010 -> 79.219.109.96 2430 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 20:02:12.563174 0.073156 tcp 10.0.2.105 51831 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:02:12.636627 0.074777 tcp 10.0.2.105 51832 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:02:12.711690 0.130841 tcp 10.0.2.105 51833 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:02:12.843092 0.219383 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.063017 0.121359 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.184736 0.216524 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.401603 0.167817 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.569820 0.139886 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.710125 0.059909 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.770454 0.176508 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:13.947330 0.170270 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:14.118028 0.068960 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:14.187371 0.094423 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:14.282148 0.156526 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:02:14.439053 0.200672 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:05:38.832028 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/08 20:05:45.838678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:05:53.840715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:06:09.843205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:06:41.849709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:12:45.856358 3.000647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:12:52.862942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:13:00.864179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:13:16.867442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:13:48.873644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:19:52.879639 3.001233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:19:59.576805 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 20:19:59.576889 0.927822 tcp 10.0.2.105 51834 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:19:59.886770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:20:07.888389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:20:23.891605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:20:55.897179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:26:59.903407 3.001786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:27:06.911101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:27:14.912170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:27:30.915202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:28:02.921255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:32:31.427943 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 20:32:31.428191 0.188620 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:31.617221 0.000000 udp 10.0.2.105 7010 -> 79.219.109.96 2430 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 20:32:48.853970 0.070609 tcp 10.0.2.105 51835 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:32:48.924878 0.077171 tcp 10.0.2.105 51836 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:32:49.002296 0.159054 tcp 10.0.2.105 51837 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:32:49.161817 0.084637 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.246772 0.063807 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.310992 0.161788 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.473150 0.141826 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.615343 0.085310 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.701109 0.041961 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:49.743574 0.379752 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.123730 0.180122 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.304277 0.148706 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.453334 0.143802 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.597551 0.145388 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.743358 0.137890 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.881606 0.039240 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.921249 0.060544 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:50.982195 0.110852 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:51.093452 0.229709 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:51.323572 0.364974 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:51.688888 0.027835 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:51.717048 0.209879 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:51.927276 0.144618 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.072452 0.216916 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.289787 0.167478 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.457680 0.139031 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.597117 0.057108 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.654573 0.173962 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.828941 0.169121 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:52.998463 0.072054 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:53.070951 0.200601 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:53.272057 0.094448 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:32:53.366874 0.158127 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/08 20:34:06.927654 3.001650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:34:13.935249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:34:21.936147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:34:37.939254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:35:09.945272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:41:13.951834 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:41:20.958680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:41:28.960442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:41:44.963166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:42:16.969175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:48:20.976161 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:48:27.982542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:48:35.984277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:48:51.987697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:49:23.993361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:50:00.506894 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 20:50:00.507129 0.972629 tcp 10.0.2.105 51838 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/08 20:55:27.999284 3.002057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 20:55:35.006878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:55:43.008267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:55:59.011203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 20:56:31.017007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:02:35.023858 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:02:42.031113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:02:50.032497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:03:06.035674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:03:18.763910 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 21:03:18.764015 0.188789 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:18.953186 0.161504 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.115086 0.139208 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.254694 0.081880 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.336990 0.040016 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.377405 0.147594 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.525417 0.071677 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.597521 0.061543 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.659385 0.179747 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.839551 0.147875 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:19.987880 0.253329 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.241623 0.144677 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.386695 0.151989 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.539116 0.036929 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.576444 0.070187 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.647065 0.030084 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.677530 0.078116 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.756040 0.217964 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:20.974420 0.122044 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:21.096884 0.218235 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:21.315750 0.339514 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:21.655670 0.223355 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:21.879464 0.168715 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.048693 0.142125 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.191230 0.063545 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.255167 0.172396 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.427942 0.168180 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.596547 0.071152 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.668114 0.159377 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:22.827896 0.201219 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:03:23.029539 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 21:03:38.041107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:03:39.055062 0.075189 tcp 10.0.2.105 51839 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:03:39.130611 0.070857 tcp 10.0.2.105 51840 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:03:39.201797 0.132840 tcp 10.0.2.105 51841 -> 195.113.214.234 443 SRPA* 0 0 38 27081 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:09:42.047633 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:09:49.054966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:09:57.055980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:10:13.059184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:10:45.065066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:16:49.071861 3.001014 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:16:56.078748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:17:04.080523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:17:20.083456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:17:52.089262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:20:01.486084 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 21:20:01.486182 0.963439 tcp 10.0.2.105 51842 -> 128.255.183.224 9027 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:23:56.095033 3.001533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:24:03.102665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:24:11.103930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:24:27.107057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:24:59.113386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:31:03.119612 3.001091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:31:10.126607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:31:18.128055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:31:34.131240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:32:06.137290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:34:00.722300 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 21:34:00.722460 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 21:34:16.896937 0.075809 tcp 10.0.2.105 51843 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:34:16.973109 0.073674 tcp 10.0.2.105 51844 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:34:17.047068 0.161811 tcp 10.0.2.105 51845 -> 195.113.214.234 443 SRPA* 0 0 69 56743 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:34:17.209565 0.189536 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.399472 0.161311 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.561179 0.084680 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.646275 0.040633 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.687299 0.147122 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.834852 0.072152 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.907428 0.061533 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:17.969353 0.178216 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.147990 0.149085 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.297485 0.142103 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.439940 0.144706 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.585019 0.039420 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.624845 0.266168 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:18.891417 0.143622 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:19.035426 0.148480 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:19.184347 0.334384 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:19.519159 0.335748 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:19.855315 0.121485 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:19.977196 0.039881 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:20.017468 0.221176 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:20.239070 0.167505 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:20.406989 0.139895 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:20.547224 0.219597 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:20.767237 0.533573 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:21.301154 0.167818 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:21.469367 0.072793 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:21.542542 0.158496 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:21.701408 0.207838 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:21.909654 0.176870 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:34:22.086926 0.062767 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 21:38:10.142826 3.002432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:38:17.150248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:38:25.151753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:38:41.154908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:39:13.161258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:45:17.167592 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:45:24.174343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:45:32.176121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:45:48.178996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:46:20.185186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:50:02.454814 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 21:50:02.455020 0.995363 tcp 10.0.2.105 51846 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/08 21:52:24.191254 3.001524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:52:31.198671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:52:39.199879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:52:55.203231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:53:27.209153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:59:31.215887 3.000974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 21:59:38.222383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 21:59:46.224202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:00:02.226949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:00:34.232746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:04:22.261150 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 22:04:22.261346 0.189227 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:22.450974 0.205242 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:22.656569 0.084444 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:22.741446 0.041406 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:22.783255 0.146052 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:22.929692 0.072926 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.002971 0.063177 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.066588 0.181885 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.248883 0.130576 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.379791 0.039242 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.419360 0.074218 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.494003 0.147370 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.641759 0.159433 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.801607 0.143012 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:23.945007 0.141915 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.087362 0.350321 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.438056 0.220095 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.658557 0.121448 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.780370 0.026608 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.807322 0.138984 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:24.946666 0.213058 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:25.160135 0.219795 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:25.380335 0.169189 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:25.549945 0.336600 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:25.886882 0.168556 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:26.055842 0.069313 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:26.125573 0.156519 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:26.282495 0.195075 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:26.478010 0.171315 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:04:26.649711 0.060327 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:06:38.239600 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:06:45.246285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:06:53.247883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:07:09.250729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:07:41.257233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:13:45.263490 3.000908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:13:52.270281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:14:00.272101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:14:16.274725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:14:48.281538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:20:03.454818 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 22:20:03.455029 1.017206 tcp 10.0.2.105 51847 -> 128.255.183.224 9027 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/01/08 22:20:52.287355 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:20:59.294723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:21:07.296001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:21:23.299125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:21:55.304631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:27:59.311477 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:28:06.318186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:28:14.319495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:28:30.333066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:29:02.338945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:34:40.125141 0.000164 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 22:34:40.125409 0.082396 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.208307 0.041338 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.250045 0.148210 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.398653 0.070825 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.469853 0.063755 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.534042 0.188216 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.722678 0.162165 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:40.885251 0.180237 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.065900 0.131151 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.197460 0.035638 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.233478 0.065048 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.298999 0.146783 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.446181 0.307123 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.753724 0.145797 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:41.899873 0.138586 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.038873 0.337551 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.376775 0.210096 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.587315 0.120403 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.708143 0.027769 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.736474 0.139398 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:42.876293 0.209799 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:43.086519 0.220849 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:43.307764 0.167157 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:43.475293 0.341526 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:43.817235 0.168035 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:43.985620 0.071772 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:44.057809 0.179098 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:44.237259 0.059942 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:44.297632 0.159704 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:34:44.457689 0.195746 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/08 22:35:06.345448 3.001019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:35:13.351972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:35:21.353740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:35:37.356658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:36:09.362977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:42:13.389193 3.001012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:42:20.396258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:42:28.397868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:42:44.400692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:43:16.407210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:49:20.413555 3.000693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:49:27.420414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:49:35.421762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:49:51.424640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:50:04.507828 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 22:50:04.507983 1.007036 tcp 10.0.2.105 51848 -> 128.255.183.224 9027 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/01/08 22:50:23.430810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:56:27.437396 3.000837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 22:56:34.444353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:56:42.445581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:56:58.448476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 22:57:30.454823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:03:34.461090 3.001100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:03:41.468529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:03:49.469480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:04:05.472538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:04:37.478449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:04:46.852712 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 23:04:46.852903 0.081786 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:46.935049 0.040688 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:46.976132 0.146240 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.122810 0.072156 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.195362 0.097782 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.293551 0.188244 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.482210 0.161406 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.644000 0.182140 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.826474 0.060360 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:47.887200 0.142222 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.029879 0.244208 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.274496 0.142024 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.416872 0.403080 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.820532 0.130904 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.951892 0.040923 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:48.993158 0.314885 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:49.308434 0.318745 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:49.627537 0.123103 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:49.750976 0.033080 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:49.784490 0.140903 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:49.925737 0.229567 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:50.155693 0.224005 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:50.380038 0.169104 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:50.549533 0.333966 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:50.883862 0.167956 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:51.052343 0.075026 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:51.127716 0.155890 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:51.284210 0.197450 udp 10.0.2.105 7010 <-> 107.221.182.176 4423 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:51.482085 0.178470 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:04:51.660945 0.057653 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:10:41.485446 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:10:48.492219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:10:56.493848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:11:12.496542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:11:44.502943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:17:48.509708 3.001166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:17:55.516476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:18:03.517696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:18:19.520673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:18:51.526354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:20:05.513255 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 23:20:05.513465 0.986438 tcp 10.0.2.105 51849 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/08 23:24:55.532786 3.001451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:25:02.539835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:25:10.541814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:25:26.544595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:25:58.550540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:32:02.557096 3.000858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:32:09.564111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:32:17.565753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:32:33.568405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:33:05.574279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:35:10.314483 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 23:35:10.314593 0.163987 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.479034 0.071169 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.550624 0.074554 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.625585 0.041166 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.667083 0.067799 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.735299 0.188274 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:10.924002 0.165586 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.089994 0.365528 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.455978 0.061258 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.517650 0.143635 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.661710 0.142910 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.804972 0.131046 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.936527 0.040799 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:11.977718 0.200382 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.178518 0.144989 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.323864 0.200314 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.524610 0.219383 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.744436 0.121757 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.866590 0.032319 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:12.899295 0.139441 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:13.039154 0.209400 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:13.248898 0.219455 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:13.468801 0.168474 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:13.637646 0.334412 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:13.972619 0.166534 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:14.139490 0.071339 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:14.211252 0.197904 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:14.409577 0.057392 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:14.467392 0.156259 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/08 23:35:14.624043 0.000000 udp 10.0.2.105 7010 -> 107.221.182.176 4423 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/08 23:35:32.927868 0.078224 tcp 10.0.2.105 51850 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/08 23:35:33.006425 0.073260 tcp 10.0.2.105 51851 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/08 23:35:33.079936 0.192244 tcp 10.0.2.105 51852 -> 195.113.214.234 443 SRPA* 0 0 35 25161 flow=From-Botnet-V2-TCP-Established 1970/01/08 23:39:09.581311 3.000751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:39:16.587861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:39:24.589421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:39:40.592692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:40:12.598525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:46:16.605316 3.000809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:46:23.612182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:46:31.613527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:46:47.616229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:47:19.622253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:50:06.593440 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/08 23:50:06.593741 1.015601 tcp 10.0.2.105 51853 -> 128.255.183.224 9027 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/01/08 23:53:23.747142 3.002885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/08 23:53:30.755868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:53:38.757294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:53:54.760555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/08 23:54:26.766906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:00:30.778278 2.996149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:00:37.780352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:00:45.781565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:01:01.784371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:01:33.790752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:05:52.282556 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 00:05:52.282936 0.000000 udp 10.0.2.105 7010 -> 107.221.182.176 4423 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 00:06:07.526552 0.073431 tcp 10.0.2.105 51854 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:06:07.600473 0.075183 tcp 10.0.2.105 51855 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:06:07.675959 0.175690 tcp 10.0.2.105 51856 -> 195.113.214.234 443 SRPA* 0 0 71 53174 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:06:07.852759 0.072443 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:07.925578 0.086059 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.012054 0.041224 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.053661 0.065876 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.119907 0.191430 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.311762 0.164359 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.476655 0.144604 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:08.621682 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 00:06:25.170091 0.080477 tcp 10.0.2.105 51857 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:06:25.250944 0.103284 tcp 10.0.2.105 51858 -> 195.113.214.234 80 SRPA* 0 0 18 13422 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:06:25.354639 0.131032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:25.486073 0.042429 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:25.528817 0.148361 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:25.677579 0.257667 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:25.935644 0.062754 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:25.998790 0.142747 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.142276 0.147706 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.290339 0.222174 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.512938 0.122074 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.635411 0.028085 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.663824 0.139216 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.803450 0.029256 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:26.833136 0.216190 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:27.049657 0.169534 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:27.219637 0.419300 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:27.639329 0.169142 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:27.808854 0.073290 udp 10.0.2.105 7010 <-> 81.130.112.235 8111 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:27.882513 0.218582 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:28.101453 0.063542 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:28.165411 0.181468 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:06:28.347281 0.155486 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:07:37.797062 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 00:07:44.804150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:07:52.805275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:08:08.808811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:08:40.814570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:14:44.821317 3.000784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:14:51.827779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:14:59.829192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:15:15.832694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:15:47.838817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:20:07.613136 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 00:20:07.613379 0.963962 tcp 10.0.2.105 51859 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:21:51.844644 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:21:58.852458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:22:06.853179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:22:22.856606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:22:54.862583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:28:58.869189 3.000679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:29:05.875749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:29:13.877565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:29:29.880181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:30:01.886232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:36:05.891890 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:36:12.900115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:36:20.901245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:36:36.904430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:36:53.328208 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 00:36:53.328319 0.143617 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:36:53.472340 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 00:37:08.910271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:37:11.235688 0.081213 tcp 10.0.2.105 51860 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:11.317201 0.075619 tcp 10.0.2.105 51861 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:11.393069 0.172984 tcp 10.0.2.105 51862 -> 195.113.214.234 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:11.566592 0.079953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:11.646980 0.071377 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:11.718765 0.042869 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:11.762047 0.164647 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:11.927049 0.189309 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.116767 0.142398 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.259528 0.137651 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.397584 0.039849 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.437859 0.147299 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.585504 0.222861 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.808845 0.081104 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:12.890351 0.142386 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.033085 0.145179 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.178666 0.029974 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.208965 0.138326 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.347635 0.048351 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.396533 0.219675 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.616577 0.172975 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:13.789939 0.216168 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:14.006510 0.122044 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:14.128950 0.336765 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:14.466119 0.168862 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:14.635389 0.000000 udp 10.0.2.105 7010 -> 81.130.112.235 8111 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 00:37:31.192927 0.072858 tcp 10.0.2.105 51863 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:31.266069 0.078746 tcp 10.0.2.105 51864 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:31.345067 0.174492 tcp 10.0.2.105 51865 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:37:31.520161 0.218490 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:31.739053 0.056780 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:31.796249 0.178501 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:37:31.975147 0.156491 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 00:43:12.916968 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:43:19.923852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:43:27.925222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:43:43.928363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:44:15.934127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:50:08.582364 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 00:50:08.582492 0.983391 tcp 10.0.2.105 51866 -> 128.255.183.224 9027 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/01/09 00:50:19.941341 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:50:26.948145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:50:34.949774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:50:50.952350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:51:22.958147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:57:27.073614 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 00:57:34.082194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:57:42.083555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:57:58.086950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 00:58:30.092621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:04:34.098829 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:04:41.105779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:04:49.107372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:05:05.110520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:05:37.116320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:07:35.185563 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 01:07:35.185660 0.083049 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:35.269101 0.000000 udp 10.0.2.105 7010 -> 81.130.112.235 8111 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 01:07:52.593267 0.076053 tcp 10.0.2.105 51867 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:07:52.669616 0.074440 tcp 10.0.2.105 51868 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:07:52.744520 0.214987 tcp 10.0.2.105 51869 -> 195.113.214.234 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:07:52.960152 0.140788 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.101352 0.040932 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.142701 0.163681 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.306828 0.189002 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.496227 0.145401 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.642018 0.089088 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.731444 0.071743 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.803677 0.040042 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.844099 0.148373 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:53.992895 0.182217 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.175468 0.060503 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.236419 0.147115 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.383931 0.144906 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.529195 0.028046 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.557566 0.145326 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.703258 0.169269 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:54.872886 0.223793 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:55.097031 0.121425 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:55.218903 0.138632 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:55.357890 0.272654 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:55.630954 0.216799 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:55.848135 0.170976 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:56.019556 0.337468 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:56.357433 0.184309 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:56.542159 0.161527 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:56.704043 0.230102 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:07:56.934560 0.064991 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:11:41.122592 3.001320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:11:48.129690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:11:56.131341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:12:12.134082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:12:44.140550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:18:48.146752 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:18:55.154132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:19:03.155667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:19:19.158261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:19:51.164101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:20:09.672073 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 01:20:09.672182 1.089193 tcp 10.0.2.105 51870 -> 128.255.183.224 9027 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:25:55.171105 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:26:02.177606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:26:10.179639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:26:26.182161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:26:58.188072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:33:02.194891 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:33:09.202122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:33:17.203522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:33:33.206550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:34:05.212615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:38:07.771672 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 01:38:07.771783 0.091971 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:07.864181 0.160723 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:08.025241 0.144687 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:08.170388 0.042055 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:08.212844 0.188609 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:08.401888 0.143419 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:08.545698 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 01:38:26.580332 0.074503 tcp 10.0.2.105 51871 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:38:26.655124 0.074970 tcp 10.0.2.105 51872 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:38:26.730378 0.173089 tcp 10.0.2.105 51873 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:38:26.904026 0.277987 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:27.182389 0.330835 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:27.513616 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 01:38:43.122762 0.107251 tcp 10.0.2.105 51874 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:38:43.230322 0.110629 tcp 10.0.2.105 51875 -> 195.113.214.234 80 SRPA* 0 0 20 13485 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:38:43.341386 0.184150 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:43.525979 0.060559 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:43.586927 0.146926 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:43.734284 0.147937 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:43.882672 0.029218 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:43.912448 0.130985 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.044901 0.168817 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.214155 0.218491 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.432976 0.121842 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.555193 0.139210 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.694729 0.167925 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:44.863022 0.338437 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:45.201820 0.397284 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:45.599509 0.223819 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:45.823728 0.219096 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:46.043275 0.061060 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:46.104736 0.840956 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:38:46.946061 0.155534 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/09 01:40:09.219089 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 01:40:16.226225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:40:24.227140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:40:40.230394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:41:12.236599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:47:16.244021 3.000587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:47:23.249678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:47:31.250899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:47:47.253929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:48:19.260479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:50:10.761330 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 01:50:10.761431 0.974731 tcp 10.0.2.105 51876 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/09 01:54:23.266420 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 01:54:30.273855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:54:38.275159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:54:54.278569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 01:55:26.284141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:01:30.290945 3.000956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:01:37.297945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:01:45.298837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:02:01.302362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:02:33.308554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:08:37.314270 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:08:44.321637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:08:52.323237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:09:08.326321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:09:16.769000 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 02:09:16.769202 0.141461 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:16.911092 0.087381 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:16.998892 0.043812 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.043140 0.188259 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.231775 0.066423 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.298552 0.140547 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.439536 0.162378 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.602304 0.145653 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.748408 0.077900 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.826730 0.042486 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:17.869584 0.178770 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.048749 0.063327 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.112576 0.142642 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.255566 0.145549 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.401511 0.036191 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.438072 0.144625 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.583089 0.168773 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.752270 0.140909 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:18.893584 0.169738 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:19.063734 0.355887 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:19.420015 0.228122 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:19.648635 0.120281 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:19.769305 0.259595 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:20.029319 0.223664 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:20.253365 0.219277 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:20.472994 0.059978 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:20.533341 0.184884 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:20.718573 0.154884 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:09:40.331870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:15:44.338160 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:15:51.345492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:15:59.347355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:16:15.349881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:16:47.355995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:20:11.740708 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 02:20:11.740807 1.018486 tcp 10.0.2.105 51877 -> 128.255.183.224 9027 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:22:51.362416 3.001096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:22:58.369442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:23:06.371238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:23:22.374300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:23:54.379980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:29:58.386499 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:30:05.393831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:30:13.395224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:30:29.398079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:31:01.403733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:37:05.410654 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:37:12.417589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:37:20.419273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:37:36.422181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:38:08.428449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:39:34.972921 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 02:39:34.973203 0.043402 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:39:35.028400 0.188442 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:39:35.217195 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 02:39:51.788596 0.069210 tcp 10.0.2.105 51878 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:39:51.858115 0.118077 tcp 10.0.2.105 51879 -> 195.113.214.234 80 SRPA* 0 0 38 24314 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:39:51.975903 0.148514 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:39:52.124814 0.088764 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:39:52.213935 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 02:40:07.349850 0.076919 tcp 10.0.2.105 51880 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:40:07.427053 0.081938 tcp 10.0.2.105 51881 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:40:07.509731 0.155429 tcp 10.0.2.105 51882 -> 195.113.214.234 443 SRPA* 0 0 33 21413 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:40:07.665656 0.162052 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:07.828058 0.627224 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:08.455618 0.070076 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:08.526113 0.487841 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.014366 0.183325 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.198109 0.061522 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.260027 0.143749 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.404270 0.146793 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.551512 0.028560 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.580580 0.130899 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.711886 0.167982 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:09.880405 0.139341 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:10.020178 0.168764 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:10.189500 0.335426 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:10.525320 0.215560 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:10.741252 0.121681 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:10.863343 0.314606 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:11.178352 0.217928 udp 10.0.2.105 7010 <-> 108.200.50.101 7560 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:11.396809 0.183921 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:11.581097 0.155345 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:11.736785 0.219877 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:40:11.957035 0.055352 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 02:44:12.434392 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 02:44:19.441591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:44:27.443081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:44:43.445852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:45:15.452059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:50:12.760186 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 02:50:12.760529 0.948858 tcp 10.0.2.105 51883 -> 128.255.183.224 9027 FSPA* 0 0 14 1700 flow=From-Botnet-V2-TCP-Established 1970/01/09 02:51:19.458258 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:51:26.465930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:51:34.466704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:51:50.470209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:52:22.476024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:58:26.482310 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 02:58:33.489620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:58:41.490816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:58:57.493789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 02:59:29.499881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:05:33.506592 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:05:40.513323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:05:48.514518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:06:04.517733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:06:36.523858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:10:25.714012 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 03:10:25.714196 0.063388 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:25.777967 0.141564 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:25.919946 0.047035 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:25.967316 0.195641 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:26.163385 0.152643 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:26.316506 0.089915 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:26.406891 0.160112 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:26.567410 0.412174 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:26.980022 0.182056 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:27.162498 0.060866 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:27.223768 0.000000 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 03:10:43.361448 0.069742 tcp 10.0.2.105 51884 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:10:43.431474 0.074852 tcp 10.0.2.105 51885 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:10:43.506602 0.168764 tcp 10.0.2.105 51886 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:10:43.675991 0.094932 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:43.771306 0.146899 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:43.918565 0.146009 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.065002 0.046170 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.111580 0.137971 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.249923 0.167464 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.417733 0.141495 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.559568 0.170413 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:44.730369 0.335421 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:45.066195 0.216374 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:45.282999 0.121939 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:45.405342 0.366257 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:10:45.771982 0.000000 udp 10.0.2.105 7010 -> 108.200.50.101 7560 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 03:11:03.407906 0.074164 tcp 10.0.2.105 51887 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:11:03.481885 0.070965 tcp 10.0.2.105 51888 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:11:03.553121 0.166873 tcp 10.0.2.105 51889 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:11:03.720560 0.219830 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:11:03.940748 0.058522 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:11:03.999673 0.183162 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:11:04.183232 0.155837 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:12:40.530733 3.000855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 03:12:47.537315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:12:55.538725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:13:11.542216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:13:43.548202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:19:47.554669 3.000871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:19:54.561322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:20:02.563180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:20:13.709274 0.000177 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 03:20:13.709551 1.059874 tcp 10.0.2.105 51890 -> 128.255.183.224 9027 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:20:18.566034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:20:50.572166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:26:54.578546 3.001281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:27:01.585447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:27:09.596921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:27:25.599439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:27:57.605876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:34:01.612048 3.001247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:34:08.619642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:34:16.620547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:34:32.623610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:35:04.629443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:41:07.832582 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 03:41:07.832858 0.000000 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 03:41:08.635821 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:41:15.643252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:41:23.644559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:41:25.770231 0.137472 tcp 10.0.2.105 51891 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:25.908021 0.090460 tcp 10.0.2.105 51892 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:25.998820 0.182985 tcp 10.0.2.105 51893 -> 195.113.214.234 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:26.182302 0.000000 udp 10.0.2.105 7010 -> 108.200.50.101 7560 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 03:41:39.648069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:41:42.642730 0.074521 tcp 10.0.2.105 51894 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:42.717544 0.077080 tcp 10.0.2.105 51895 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:42.794952 0.171757 tcp 10.0.2.105 51896 -> 195.113.214.234 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:42.967190 0.188569 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:41:43.156178 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 03:41:59.407001 0.073456 tcp 10.0.2.105 51897 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:59.480738 0.115700 tcp 10.0.2.105 51898 -> 195.113.214.234 80 SRPA* 0 0 18 13408 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:41:59.596959 0.042751 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:41:59.640103 0.145376 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:41:59.785839 0.115348 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:41:59.901554 0.164565 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.066604 0.064934 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.131943 0.082001 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.214354 0.191173 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.405961 0.043937 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.450279 0.148354 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.598992 0.026838 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.626222 0.138796 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.765367 0.144357 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.910104 0.079634 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:00.990157 0.336584 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:01.327145 0.217821 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:01.545400 0.168176 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:01.713965 0.153443 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:01.867817 0.169969 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.038174 0.023572 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.062107 0.120811 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.183365 0.182608 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.366391 0.156716 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.523529 0.208938 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:02.732908 0.059293 udp 10.0.2.105 7010 <-> 109.158.240.37 6090 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 03:42:11.653906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:48:15.659328 3.001733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:48:22.666830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:48:30.668519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:48:46.671926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:49:18.677669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:50:14.768799 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 03:50:14.768913 1.072547 tcp 10.0.2.105 51899 -> 128.255.183.224 9027 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/09 03:55:22.683135 3.002292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 03:55:29.691386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:55:37.692836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:55:53.695620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 03:56:25.701442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:02:29.707930 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:02:36.714939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:02:44.716473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:03:00.719901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:03:32.725279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:09:36.731512 3.002036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:09:43.738737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:09:51.740770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:10:07.743804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:10:39.750008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:12:05.042403 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 04:12:05.042539 0.146587 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.189526 0.188207 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.378133 0.043566 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.422117 0.137643 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.560110 0.065895 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.626636 0.162840 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.789836 0.066278 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.856504 0.088794 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:05.945846 0.180195 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.126422 0.039294 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.166052 0.144425 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.310831 0.026408 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.337613 0.137944 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.475953 0.143385 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.619759 0.160176 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:06.780360 0.338687 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:07.119483 0.223593 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:07.343566 0.168168 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:07.512122 0.139908 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:07.652415 0.169159 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:07.821949 0.367942 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:08.190257 0.120895 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:08.311530 0.182644 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:08.494559 0.000000 udp 10.0.2.105 7010 -> 109.158.240.37 6090 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 04:12:27.196494 0.070293 tcp 10.0.2.105 51900 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:12:27.267309 0.070566 tcp 10.0.2.105 51901 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:12:27.338183 0.169426 tcp 10.0.2.105 51902 -> 195.113.214.234 443 SRPA* 0 0 24 12990 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:12:27.508377 0.154900 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:12:27.663679 0.219065 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:16:43.755733 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:16:50.762796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:16:58.764331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:17:14.767812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:17:46.773426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:20:15.848235 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 04:20:15.848486 1.003431 tcp 10.0.2.105 51903 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:23:50.779238 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:23:57.787211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:24:05.788714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:24:21.791778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:24:53.797562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:30:57.804098 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:31:04.811170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:31:12.812445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:31:28.815309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:32:00.821642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:38:04.827938 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:38:11.835004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:38:19.836573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:38:35.839372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:39:07.845630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:42:37.868216 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 04:42:37.868358 0.000000 udp 10.0.2.105 7010 -> 109.158.240.37 6090 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 04:42:53.682342 0.071853 tcp 10.0.2.105 51904 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:42:53.754495 0.070587 tcp 10.0.2.105 51905 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:42:53.825342 0.173631 tcp 10.0.2.105 51906 -> 195.113.214.234 443 SRPA* 0 0 23 14568 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:42:53.999564 0.146157 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:54.146094 0.193587 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:54.340046 0.969454 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.309877 0.071699 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.381919 0.164341 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.546627 0.065920 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.612991 0.087473 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.700814 0.180416 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.881616 0.040502 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:55.922525 0.146259 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.069178 0.028144 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.097628 0.039498 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.137504 0.085188 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.223100 0.354949 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.578399 0.219615 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.798441 0.145473 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:56.944516 0.123660 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:57.068584 0.373393 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:57.442315 0.121088 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:57.563771 0.168018 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:57.732127 0.139545 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:57.872003 0.168758 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:58.041159 0.173894 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:58.215394 0.156191 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:42:58.372093 0.219088 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 04:45:11.851592 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:45:18.859177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:45:26.860680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:45:42.863313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:46:14.869708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:50:16.857930 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 04:50:16.858167 1.023996 tcp 10.0.2.105 51907 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/09 04:52:18.875899 3.001000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:52:25.882517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:52:33.884256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:52:49.887769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:53:21.893504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:59:25.899940 3.001249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 04:59:32.906961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:59:40.908214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 04:59:56.911181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:00:28.917659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:06:32.923754 3.000926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:06:39.930545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:06:47.932147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:07:03.935437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:07:35.941240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:13:18.594149 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 05:13:18.594233 0.146962 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:18.741610 0.191234 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:18.933178 0.143693 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:19.077254 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 05:13:37.622768 0.068877 tcp 10.0.2.105 51908 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 05:13:37.691908 0.069239 tcp 10.0.2.105 51909 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 05:13:37.761445 0.179548 tcp 10.0.2.105 51910 -> 195.113.214.234 443 SRPA* 0 0 35 18168 flow=From-Botnet-V2-TCP-Established 1970/01/09 05:13:37.941174 0.159787 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.101311 0.060222 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.161963 0.087748 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.250086 0.178886 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.429412 0.042225 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.472071 0.180185 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.652798 0.030865 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.684063 0.039285 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.723756 0.084284 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.808493 0.147076 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:38.955994 0.137760 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:39.094118 0.371319 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:39.465777 0.225780 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:39.691964 0.303261 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:39.947537 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:13:39.995613 0.121859 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.117855 0.167456 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.285680 0.144780 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.430813 0.170605 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.601815 0.171806 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.774043 0.156600 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:40.931054 0.209554 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:13:46.954826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:13:54.956073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:14:10.959031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:14:42.965792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:20:17.887468 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 05:20:17.887655 1.018337 tcp 10.0.2.105 51911 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/09 05:20:46.971879 3.001404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:20:53.978840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:21:01.979943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:21:17.983545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:21:49.989181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:27:53.996358 3.000529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:28:01.002336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:28:09.004373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:28:25.007005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:28:57.013404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:35:01.019504 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:35:08.026313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:35:16.027948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:35:32.031199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:36:04.037609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:42:08.042389 3.012471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:42:15.060758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:42:23.062077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:42:39.064958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:43:11.071208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:44:06.190612 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 05:44:06.190800 0.075168 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:06.266367 0.191330 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:06.458129 0.233730 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:06.458492 3.006898 tcp 10.0.2.105 51912 -> 107.193.222.108 6686 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 05:44:06.692213 0.140502 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:06.833104 0.088225 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:06.921690 0.178567 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.100618 0.061657 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.162668 0.179247 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.342304 0.043883 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.386581 0.145111 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.532090 0.031555 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.563939 0.039338 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.603691 0.078138 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.682185 0.144637 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.827218 0.137839 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:07.965470 0.481760 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:08.447569 0.120994 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:08.568977 0.167743 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:08.737134 0.335715 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:09.073245 0.254527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:09.328150 0.141539 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:09.470067 0.171890 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:09.642352 0.270074 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:09.912828 0.154293 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:10.067512 0.209527 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/09 05:44:15.463462 0.000000 tcp 10.0.2.105 51912 -> 107.193.222.108 6686 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 05:49:15.077478 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:49:22.084788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:49:30.086243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:49:46.089164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:50:18.095292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:50:18.906789 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 05:50:18.906883 1.151693 tcp 10.0.2.105 51913 -> 128.255.183.224 9027 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/01/09 05:56:22.101407 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 05:56:29.108286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:56:37.110172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:56:53.113274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 05:57:25.119460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:03:29.125635 3.001227 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:03:36.132531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:03:44.134158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:04:00.137303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:04:32.143284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:10:36.149610 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:10:43.156464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:10:51.157975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:11:07.160813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:11:39.166992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:14:29.722479 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 06:14:29.722672 0.082121 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:29.805112 0.206583 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.012150 0.144514 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.012635 2.994384 tcp 10.0.2.105 51914 -> 107.193.222.108 6686 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 06:14:30.157084 0.146808 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.304378 0.087439 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.392260 0.163848 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.556703 0.061886 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.618963 0.179887 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.799254 0.041705 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.841363 0.144654 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:30.986388 0.027458 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.014208 0.044881 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.059442 0.079034 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.138829 0.144645 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.283900 0.137866 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.422131 0.169841 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.592408 0.335315 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:31.928124 0.218053 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:32.146543 0.565940 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:32.712927 0.121678 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:32.835001 0.139475 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:32.974813 0.168460 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:33.143729 0.182101 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:33.326277 0.155582 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:33.482220 0.219269 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:14:39.015740 0.000000 tcp 10.0.2.105 51914 -> 107.193.222.108 6686 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 06:17:43.173811 3.000918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:17:50.180473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:17:58.182089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:18:14.185171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:18:46.191188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:20:20.066756 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 06:20:20.066888 1.003042 tcp 10.0.2.105 51915 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/09 06:24:50.197603 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:24:57.204728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:25:05.205896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:25:21.209024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:25:53.215200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:31:57.220973 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:32:04.228816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:32:12.230113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:32:28.233224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:33:00.239111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:39:04.246296 2.999960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:39:11.252157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:39:19.253515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:39:35.256823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:40:07.282937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:44:59.623752 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 06:44:59.623991 0.308866 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:44:59.933249 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 06:45:18.191470 0.068482 tcp 10.0.2.105 51916 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 06:45:18.260255 0.072159 tcp 10.0.2.105 51917 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 06:45:18.332717 0.176637 tcp 10.0.2.105 51918 -> 195.113.214.234 443 SRPA* 0 0 34 24795 flow=From-Botnet-V2-TCP-Established 1970/01/09 06:45:18.510717 0.088788 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:18.599982 0.076891 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:18.600425 3.004873 tcp 10.0.2.105 51919 -> 81.174.154.246 5785 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 06:45:18.677271 0.188905 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:18.866624 0.165738 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:19.032759 0.862449 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:19.895617 0.179997 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.076022 0.043148 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.119543 0.231653 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.351535 0.068989 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.420913 0.294149 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.715469 0.070377 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.786223 0.171718 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:20.958322 0.365280 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:21.324011 0.224969 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:21.557944 0.137952 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:21.696321 0.168927 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:21.865658 0.595392 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:22.461446 0.121505 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:22.583328 0.144906 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:22.728639 0.170005 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:22.899009 0.178378 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:23.077757 0.156498 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:23.234628 0.249124 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/09 06:45:27.603200 0.000000 tcp 10.0.2.105 51919 -> 81.174.154.246 5785 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 06:46:11.288631 3.001975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:46:18.296170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:46:26.298265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:46:42.300528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:47:14.307039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:50:21.075761 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 06:50:21.076012 0.943602 tcp 10.0.2.105 51920 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/09 06:53:18.312446 3.002058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 06:53:25.319963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:53:33.321976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:53:49.324833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 06:54:21.330703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:00:25.337025 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:00:32.344608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:00:40.345917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:00:56.349086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:01:28.354515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:07:32.361177 3.001650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:07:39.368101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:07:47.370065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:08:03.373052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:08:35.378444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:14:39.384403 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:14:46.391961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:14:54.393387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:15:10.396964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:15:35.132491 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 07:15:35.132594 0.155379 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:35.288410 0.150429 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:35.439221 0.095135 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:35.534783 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 07:15:35.535209 2.992196 tcp 10.0.2.105 51921 -> 81.174.154.246 5785 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 07:15:42.402458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:15:44.535425 0.000000 tcp 10.0.2.105 51921 -> 81.174.154.246 5785 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/09 07:15:52.799686 0.073607 tcp 10.0.2.105 51922 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:15:52.873574 0.072989 tcp 10.0.2.105 51923 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:15:52.946875 0.175513 tcp 10.0.2.105 51924 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:15:53.122695 0.189404 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:53.312539 0.161693 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:53.474588 0.042624 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:53.517603 0.144508 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:53.662496 0.698570 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:54.361459 0.225533 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:54.587438 0.032979 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:54.631331 0.388193 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:55.019920 0.084446 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:55.104767 0.140631 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:55.245785 0.358661 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:55.604843 0.169734 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:55.774979 0.225115 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:56.000525 0.137941 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:15:56.138873 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 07:16:14.439604 0.072844 tcp 10.0.2.105 51925 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:16:14.512801 0.069009 tcp 10.0.2.105 51926 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:16:14.582009 0.164374 tcp 10.0.2.105 51927 -> 195.113.214.234 443 SRPA* 0 0 25 13252 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:16:14.747011 0.120168 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:14.867592 0.146097 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:14.867932 4.880839 tcp 10.0.2.105 51928 -> 184.182.240.239 7058 SPA_* 0 0 442 333428 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:16:15.014010 0.169780 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:15.184189 0.179381 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:15.363930 0.155733 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:15.520084 0.219957 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:16:19.897817 2.283263 tcp 10.0.2.105 51928 -> 184.182.240.239 7058 FPA_* 0 0 213 152731 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:20:22.025852 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 07:20:22.025957 0.986813 tcp 10.0.2.105 51929 -> 128.255.183.224 9027 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:21:46.409818 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 07:21:53.416152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:22:01.417671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:22:17.420976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:22:49.426617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:28:53.433008 3.001026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:29:00.530047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:29:08.531764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:29:24.534910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:29:56.541023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:36:00.546705 3.001477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:36:07.554057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:36:15.555472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:36:31.558784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:37:03.564770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:43:07.570346 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:43:14.578359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:43:22.579592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:43:38.582923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:44:10.588669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:46:16.740759 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 07:46:16.740883 0.106096 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:16.847312 0.562078 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:17.409831 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 07:46:33.316579 0.068335 tcp 10.0.2.105 51930 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:46:33.385189 0.071592 tcp 10.0.2.105 51931 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:46:33.457091 0.168065 tcp 10.0.2.105 51932 -> 195.113.214.234 443 SRPA* 0 0 43 23502 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:46:33.625376 0.090646 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:33.716604 0.492359 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.209377 0.188907 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.398667 0.165119 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.564186 0.148256 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.712832 0.147067 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.860227 0.043560 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:34.904155 0.226388 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.130907 0.078067 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.209356 0.140776 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.350547 0.180931 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.531866 0.040499 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.572797 0.144806 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:35.717973 0.358626 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:36.076997 0.168759 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:36.246127 0.718264 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:36.964762 0.120982 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:37.086087 0.141069 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:37.227554 0.170225 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:37.398191 0.177401 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:37.575931 0.155558 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:46:37.731894 0.209363 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/09 07:50:14.595402 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:50:21.601888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:50:23.054570 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 07:50:23.054738 0.983624 tcp 10.0.2.105 51933 -> 128.255.183.224 9027 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/01/09 07:50:29.603468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:50:45.606554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:51:17.612816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:57:21.619517 3.001070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 07:57:28.626217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:57:36.627777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:57:52.630319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 07:58:24.636600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:04:28.642399 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:04:35.650305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:04:43.651900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:04:59.654465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:05:31.660673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:11:35.667357 3.000760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:11:42.673713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:11:50.675220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:12:06.678500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:12:38.684259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:16:51.408642 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 08:16:51.408741 0.896176 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:16:52.305336 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 08:17:08.544301 0.069821 tcp 10.0.2.105 51934 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:17:08.614330 0.105874 tcp 10.0.2.105 51935 -> 195.113.214.234 80 SRPA* 0 0 31 21024 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:17:08.720759 0.500744 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.221906 0.092941 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.315238 0.148598 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.464205 0.188793 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.653347 0.161863 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.815591 0.060684 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:09.876629 0.160292 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.037278 0.041773 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.079376 0.048734 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.128517 0.076701 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.205645 0.143695 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.349754 0.262331 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.612603 0.028011 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.640935 0.123831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:10.765133 0.333727 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:11.099253 0.168065 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:11.267700 0.139691 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:11.407782 0.688541 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:12.096738 0.122567 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:12.219737 0.159517 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:12.379629 0.272427 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:12.652560 0.172821 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:17:12.825797 0.172309 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:18:42.690181 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:18:49.698277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:18:57.699377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:19:13.702434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:19:45.708851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:20:24.044096 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 08:20:24.044190 1.058872 tcp 10.0.2.105 51936 -> 128.255.183.224 9027 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:25:49.714043 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:25:56.721751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:26:04.723314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:26:20.726199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:26:52.732817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:32:56.739231 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:33:03.765739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:33:11.767718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:33:27.770166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:33:59.776416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:40:03.782071 3.002012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:40:10.790156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:40:18.791385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:40:34.794244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:41:06.800303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:47:10.807273 3.000681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:47:17.813958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:47:25.815245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:47:35.630275 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 08:47:35.630457 0.065123 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:35.695972 0.906080 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:36.602453 0.488245 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:37.091101 0.086780 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:37.178324 0.303694 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:37.482345 0.189075 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:37.671823 0.160008 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:37.832255 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 08:47:41.818717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:47:55.620434 0.072421 tcp 10.0.2.105 51937 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:47:55.693149 0.071301 tcp 10.0.2.105 51938 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:47:55.764735 0.167901 tcp 10.0.2.105 51939 -> 195.113.214.234 443 SRPA* 0 0 37 27027 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:47:55.933225 0.157128 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.090737 0.042148 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.133248 0.048325 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.181924 0.073657 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.256008 0.145261 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.401649 0.184501 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.586483 0.037471 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.624328 0.144767 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:56.769462 0.336926 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.106805 0.167859 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.275052 0.121345 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.396766 0.140512 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.537608 0.235808 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.773820 0.171566 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:57.945783 0.178375 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:58.124521 0.160009 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:47:58.284936 0.209669 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/09 08:48:13.824297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:50:25.103853 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 08:50:25.104104 1.012907 tcp 10.0.2.105 51940 -> 128.255.183.224 9027 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/01/09 08:54:17.830487 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 08:54:24.838107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:54:32.839247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:54:48.842101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 08:55:20.848752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:01:24.854638 3.001512 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:01:31.861502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:01:39.863433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:01:55.866013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:02:27.872560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:08:31.879261 3.000767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:08:38.885775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:08:46.887604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:09:02.890170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:09:34.896308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:15:38.903014 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:15:45.909904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:15:53.911002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:16:09.914001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:16:41.920403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:18:19.701506 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 09:18:19.701685 0.085220 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:19.787283 0.086578 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:19.874231 0.469412 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:20.344051 0.845793 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.219069 0.088603 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.308036 0.162935 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.471303 0.190999 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.662726 0.141941 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.805070 0.048684 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.854208 0.072129 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:21.926707 0.144309 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.071349 0.040822 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.112572 0.147728 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.260634 0.231855 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.492855 0.063657 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.567723 0.137442 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:22.705575 0.336867 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:23.042879 0.169039 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:23.212437 0.322515 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:23.535357 0.169100 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:23.704846 0.328987 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:24.034188 0.161543 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:24.196106 0.126563 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:24.323061 0.140290 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:18:24.463744 0.209067 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:20:26.123586 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 09:20:26.123824 1.018125 tcp 10.0.2.105 51941 -> 128.255.183.224 9027 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/01/09 09:22:45.926804 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 09:22:52.933804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:23:00.935851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:23:16.938518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:23:48.944509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:29:52.951275 3.000416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:29:59.957603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:30:07.959292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:30:23.961868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:30:55.968111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:36:59.973605 3.002171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:37:06.981794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:37:14.983472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:37:30.985949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:38:02.992094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:44:06.997716 3.002307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:44:14.005411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:44:22.006974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:44:38.010102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:45:10.015865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:48:47.008500 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 09:48:47.008692 0.466365 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:48:47.492738 0.062021 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:48:47.555129 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 09:49:06.517735 0.084571 tcp 10.0.2.105 51942 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 09:49:06.602629 0.079178 tcp 10.0.2.105 51943 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 09:49:06.682054 0.180285 tcp 10.0.2.105 51944 -> 195.113.214.234 443 SRPA* 0 0 57 45017 flow=From-Botnet-V2-TCP-Established 1970/01/09 09:49:06.863010 0.924431 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:07.787865 0.083798 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:07.872008 0.192203 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.064555 0.191256 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.256227 0.148663 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.405306 0.043745 udp 10.0.2.105 7010 <-> 95.89.179.80 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.449449 0.072350 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.522184 0.143971 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.666535 0.040782 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.707680 0.144415 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.852512 0.144840 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:08.997821 0.334717 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:09.333028 0.167671 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:09.501143 0.179557 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:09.681089 0.033519 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:09.715012 0.310287 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.025663 0.172384 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.198397 0.186703 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.385452 0.156502 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.542342 0.123868 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.666591 0.140423 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:49:10.807413 0.239230 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/09 09:50:27.142392 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 09:50:27.142632 1.044605 tcp 10.0.2.105 51945 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/09 09:51:14.022149 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 09:51:21.029534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:51:29.031285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:51:45.033940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:52:17.040296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:58:21.045972 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 09:58:28.053755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:58:36.055219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:58:52.057911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 09:59:24.064374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:05:28.070321 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:05:35.077381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:05:43.078895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:05:59.082139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:06:31.087974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:12:35.094746 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:12:42.101304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:12:50.102847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:13:06.106067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:13:38.112180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:19:34.785087 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:19:34.785224 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:19:42.118456 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:19:49.125648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:19:51.961292 0.074014 tcp 10.0.2.105 51946 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:19:52.035580 0.072558 tcp 10.0.2.105 51947 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:19:52.108558 0.191279 tcp 10.0.2.105 51948 -> 195.113.214.234 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:19:52.328139 0.381576 udp 10.0.2.105 7010 <-> 84.59.151.27 7605 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:52.710170 0.066452 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:52.776953 0.160791 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:52.938101 0.191077 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:53.129557 0.920035 udp 10.0.2.105 7010 <-> 69.159.203.121 9541 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:54.049995 0.087521 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:54.137836 0.152261 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:19:54.290474 0.000000 udp 10.0.2.105 7010 -> 95.89.179.80 6418 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:19:57.127214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:20:12.870508 0.075085 tcp 10.0.2.105 51949 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:20:12.945931 0.212656 tcp 10.0.2.105 51950 -> 195.113.214.234 80 SRPA* 0 0 38 23010 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:20:13.130309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:20:13.158800 0.070333 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:13.229523 0.141213 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:13.371090 0.043235 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:13.414730 0.142885 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:13.558067 0.144723 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:13.703170 0.336319 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.039904 0.036653 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.105028 0.319884 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.425275 0.167786 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.593435 0.171649 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.765417 0.178415 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:14.944181 0.173596 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:15.118153 0.155049 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:15.273916 0.121954 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:15.396278 0.139643 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:15.536419 0.208209 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:15.770268 0.000000 udp 10.0.2.105 7010 -> 95.89.179.80 6418 REQ 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:21.782953 0.169013 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:21.952622 0.190770 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:22.143965 0.070346 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:22.214875 0.000000 udp 10.0.2.105 7010 -> 84.59.151.27 7605 REQ 0 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:28.192460 1.131472 tcp 10.0.2.105 51951 -> 128.255.183.224 9027 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:20:29.363232 0.268066 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:29.654066 0.081796 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:29.736544 0.000000 udp 10.0.2.105 7010 -> 69.159.203.121 9541 REQ 0 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:38.046523 0.074392 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.121515 0.146150 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.268225 0.039883 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.308773 0.143855 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.453065 0.144698 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.598404 0.341967 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 753 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.940821 0.034037 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:38.975265 0.329838 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:39.305681 0.168139 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 702 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:39.474384 0.164072 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:39.638922 0.178503 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:39.818009 0.204328 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:40.022909 0.156429 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:40.179803 0.152207 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:40.332472 0.209722 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:40.542753 0.124578 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:40.667866 0.000000 udp 10.0.2.105 7010 -> 24.225.21.187 4246 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:45.136190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:20:47.339227 0.148252 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:47.518969 0.000000 udp 10.0.2.105 7010 -> 184.180.239.226 1766 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:54.459761 0.086139 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:20:54.565775 0.000000 udp 10.0.2.105 7010 -> 86.130.166.27 7930 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:20:59.106213 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:21:02.841716 0.000000 udp 10.0.2.105 7010 -> 201.102.27.51 7510 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:09.380957 0.000000 udp 10.0.2.105 7010 -> 65.101.188.16 5576 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:14.858639 0.000000 udp 10.0.2.105 7010 -> 88.106.176.23 6116 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:23.261227 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:28.107843 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:21:30.701847 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:39.274432 0.072961 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:21:39.358797 0.000000 udp 10.0.2.105 7010 -> 96.11.106.193 2511 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:48.236711 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:21:53.103846 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:21:54.816293 0.000000 udp 10.0.2.105 7010 -> 79.0.117.164 5643 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:01.926383 0.000000 udp 10.0.2.105 7010 -> 95.225.106.19 1024 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:07.194109 0.000000 udp 10.0.2.105 7010 -> 197.81.44.81 9208 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:15.836791 0.047390 udp 10.0.2.105 7010 -> 95.33.115.225 2532 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:15.884181 0.000000 icmp 95.33.115.225 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 299 flow=Background 1970/01/09 10:22:20.603187 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:22:22.646193 0.000000 udp 10.0.2.105 7010 -> 143.101.233.135 9771 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:30.657958 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:39.069962 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:46.790729 0.000000 udp 10.0.2.105 7010 -> 182.71.25.114 5630 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:22:51.607786 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:22:54.552432 0.000000 udp 10.0.2.105 7010 -> 82.63.170.2 6689 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:03.014147 0.000000 udp 10.0.2.105 7010 -> 98.103.26.71 2616 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:11.997015 0.000000 udp 10.0.2.105 7010 -> 93.33.100.210 9249 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:16.604071 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:23:20.078898 0.000000 udp 10.0.2.105 7010 -> 93.193.151.28 7662 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:25.576994 0.000000 udp 10.0.2.105 7010 -> 111.93.173.190 2106 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:32.938103 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:41.660022 0.032032 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:23:41.703912 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:46.607050 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:23:47.888616 0.000000 udp 10.0.2.105 7010 -> 93.51.159.26 8948 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:53.036489 0.000000 udp 10.0.2.105 7010 -> 208.68.246.250 4186 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:23:58.694196 0.000000 udp 10.0.2.105 7010 -> 86.136.250.11 3562 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:04.332612 0.000000 udp 10.0.2.105 7010 -> 198.180.17.38 6189 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:11.182244 0.285459 udp 10.0.2.105 7010 -> 77.9.179.126 5572 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:11.467703 0.000000 icmp 77.9.179.126 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 172 flow=Background 1970/01/09 10:24:16.109540 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:24:18.132336 0.000000 udp 10.0.2.105 7010 -> 88.254.72.211 9475 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:24.200855 0.000000 udp 10.0.2.105 7010 -> 87.167.181.178 6298 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:30.229583 0.000000 udp 10.0.2.105 7010 -> 188.51.32.118 8205 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:35.437512 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:40.103879 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:24:43.308294 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:50.569156 0.000000 udp 10.0.2.105 7010 -> 2.216.27.153 7835 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:24:56.898436 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:05.190121 0.000000 udp 10.0.2.105 7010 -> 78.174.103.221 7974 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:10.106965 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:25:13.711988 0.000000 udp 10.0.2.105 7010 -> 69.2.185.149 5278 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:22.194570 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:29.895935 0.044729 udp 10.0.2.105 7010 -> 77.180.194.112 3830 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:29.940664 0.000000 icmp 77.180.194.112 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 156 flow=Background 1970/01/09 10:25:34.602049 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:25:36.625481 0.000000 udp 10.0.2.105 7010 -> 95.252.139.220 6109 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:45.628578 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:51.216383 0.103279 udp 10.0.2.105 7010 <-> 91.63.31.98 8426 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:25:51.455999 0.000000 udp 10.0.2.105 7010 -> 94.43.185.252 2686 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:25:58.476448 0.000000 udp 10.0.2.105 7010 -> 188.13.62.92 8086 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:03.103303 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:26:03.694266 0.000000 udp 10.0.2.105 7010 -> 108.169.177.114 2866 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:09.152188 0.000000 udp 10.0.2.105 7010 -> 65.117.67.36 4906 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:17.513737 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:24.895030 0.191010 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:26:25.109181 0.094822 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:26:25.226318 0.300604 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:26:25.535221 0.396372 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:26:25.948450 0.000000 udp 10.0.2.105 7010 -> 212.171.55.230 2392 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:29.601122 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:26:31.033245 0.000000 udp 10.0.2.105 7010 -> 200.123.214.44 3564 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:37.653294 0.000000 udp 10.0.2.105 7010 -> 65.74.135.69 9480 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:42.730054 0.000000 udp 10.0.2.105 7010 -> 24.161.35.53 4282 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:49.141504 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 10:26:50.541741 0.000000 udp 10.0.2.105 7010 -> 41.133.2.139 7021 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:55.108096 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:26:56.099668 0.000000 udp 10.0.2.105 7010 -> 195.174.239.184 4175 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:26:56.149581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:27:03.960557 0.000000 udp 10.0.2.105 7010 -> 80.13.20.92 4538 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:04.150803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:27:09.909504 0.000000 udp 10.0.2.105 7010 -> 74.7.151.25 6328 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:18.692149 0.189148 udp 10.0.2.105 7010 -> 208.179.43.29 9986 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:18.881297 0.000000 icmp 208.179.33.46 0x0303 -> 10.0.2.105 0x0227 URP 192 1 147 flow=Background 1970/01/09 10:27:20.153679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:27:23.608598 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:27:23.969468 0.000000 udp 10.0.2.105 7010 -> 188.10.16.129 5849 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:32.101363 0.000000 udp 10.0.2.105 7010 -> 80.200.102.92 3439 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:38.019825 0.000000 udp 10.0.2.105 7010 -> 95.21.145.166 4968 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:45.430283 0.000000 udp 10.0.2.105 7010 -> 71.145.196.37 5613 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:27:50.106634 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:27:52.160179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:27:53.822263 0.000000 udp 10.0.2.105 7010 -> 82.104.84.169 4248 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:00.722447 0.000000 udp 10.0.2.105 7010 -> 24.67.86.194 2675 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:08.593904 0.000000 udp 10.0.2.105 7010 -> 64.74.158.241 1791 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:17.276812 0.000000 udp 10.0.2.105 7010 -> 62.204.166.111 6956 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:22.103280 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:28:24.616775 0.000000 udp 10.0.2.105 7010 -> 50.50.222.57 1567 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:29.804072 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:38.416587 0.000000 udp 10.0.2.105 7010 -> 109.236.17.101 2026 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:45.506788 0.151429 udp 10.0.2.105 7010 -> 217.55.162.105 1024 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:28:45.658217 0.000000 icmp 217.55.162.105 0x0303 -> 10.0.2.105 0x0004 URP 192 1 229 flow=Background 1970/01/09 10:28:50.103610 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:28:52.366385 0.000000 udp 10.0.2.105 7010 -> 66.186.168.10 6985 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:00.127972 0.000000 udp 10.0.2.105 7010 -> 197.15.47.26 5301 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:05.795970 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:13.967713 0.000000 udp 10.0.2.105 7010 -> 78.181.216.61 5421 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:18.613862 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:29:21.167840 0.000000 udp 10.0.2.105 7010 -> 63.239.36.210 7639 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:27.697251 0.000000 udp 10.0.2.105 7010 -> 109.195.183.170 7300 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:34.567484 0.000000 udp 10.0.2.105 7010 -> 82.60.52.140 8714 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:43.129735 0.158355 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:29:43.634190 0.144099 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:29:43.845164 0.192040 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:29:44.062381 0.000000 udp 10.0.2.105 7010 -> 184.74.59.62 7749 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:48.116493 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:29:51.561693 0.000000 udp 10.0.2.105 7010 -> 198.199.185.65 1610 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:29:57.730617 0.000000 udp 10.0.2.105 7010 -> 108.71.114.52 5992 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:03.668938 0.000000 udp 10.0.2.105 7010 -> 202.81.242.79 6910 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:10.549042 0.000000 udp 10.0.2.105 7010 -> 61.93.246.209 7950 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:15.115312 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:30:17.409006 0.000000 udp 10.0.2.105 7010 -> 72.239.157.48 6792 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:22.546258 0.000000 udp 10.0.2.105 7010 -> 92.19.165.132 6704 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:30.417534 0.000000 udp 10.0.2.105 7010 -> 79.135.34.53 7196 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:37.367831 0.000000 udp 10.0.2.105 7010 -> 206.127.9.114 7113 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:42.114180 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:30:43.325981 0.000000 udp 10.0.2.105 7010 -> 223.197.225.253 9552 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:51.207506 0.000000 udp 10.0.2.105 7010 -> 151.33.15.32 7566 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:30:58.407870 0.000000 udp 10.0.2.105 7010 -> 69.63.211.38 7595 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:05.277590 0.167314 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:31:05.473788 0.000000 udp 10.0.2.105 7010 -> 99.110.133.170 4973 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:10.114181 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:31:13.329479 0.000000 udp 10.0.2.105 7010 -> 99.229.161.247 3025 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:22.251886 0.000000 udp 10.0.2.105 7010 -> 199.38.184.63 9990 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:27.640365 0.000000 udp 10.0.2.105 7010 -> 79.240.16.131 4641 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:34.710532 0.068177 udp 10.0.2.105 7010 -> 217.234.160.115 1223 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:34.778709 0.000000 icmp 217.234.160.115 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 271 flow=Background 1970/01/09 10:31:39.616842 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:31:40.348192 0.167479 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:31:40.527931 0.000000 udp 10.0.2.105 7010 -> 95.233.97.84 6380 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:46.507277 0.000000 udp 10.0.2.105 7010 -> 37.138.72.154 8925 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:31:54.428370 0.189172 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:31:54.629347 0.059693 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:31:54.701271 0.000000 udp 10.0.2.105 7010 -> 190.242.125.21 1611 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:01.889969 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:06.615410 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:32:08.939293 0.000000 udp 10.0.2.105 7010 -> 181.53.111.34 5528 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:16.459966 0.185761 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:32:16.657317 0.162637 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:32:16.829280 0.000000 udp 10.0.2.105 7010 -> 188.48.44.111 2506 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:24.661589 0.086822 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:32:24.764663 0.000000 udp 10.0.2.105 7010 -> 24.160.59.98 7204 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:31.762089 0.000000 udp 10.0.2.105 7010 -> 179.223.91.57 9783 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:36.618713 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:32:38.321542 0.000000 udp 10.0.2.105 7010 -> 97.80.140.47 8011 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:44.170197 0.000000 udp 10.0.2.105 7010 -> 213.121.246.194 4936 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:49.447752 0.156122 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:32:49.622174 0.000000 udp 10.0.2.105 7010 -> 24.234.120.184 3603 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:32:55.226176 0.000000 udp 10.0.2.105 7010 -> 87.11.38.117 3217 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 10:33:02.125776 0.058078 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/09 10:33:07.112882 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:33:56.175930 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 10:34:03.183311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:34:11.185161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:34:27.187939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:34:59.193951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:41:03.200510 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:41:10.207515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:41:18.209259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:41:34.211939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:42:06.217680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:48:10.223478 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:48:17.231396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:48:25.232608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:48:41.235618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:49:13.242145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:50:29.341934 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 10:50:29.342021 0.996745 tcp 10.0.2.105 51952 -> 128.255.183.224 9027 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/01/09 10:55:17.248582 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 10:55:24.254953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:55:32.256474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:55:48.259994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 10:56:20.266011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:02:24.271443 3.002268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:02:31.279486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:02:39.281010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:02:55.284486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:03:19.078046 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 11:03:19.078138 0.189541 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.268085 0.063448 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.331906 0.165377 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.497694 0.147190 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.645296 0.087646 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.733348 0.143905 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.877629 0.043256 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.921277 0.072329 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:19.993928 0.337308 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:20.331643 0.036204 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:20.368189 0.320012 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:20.688561 0.143122 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:20.832088 0.124001 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:20.956638 0.184634 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:21.141665 0.182242 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:21.324234 0.216413 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:21.541036 0.155998 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:21.697431 0.141152 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:21.838952 0.168909 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.008269 0.122485 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.131146 0.229472 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.361019 0.145281 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.506710 0.076802 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.583895 0.054145 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.638413 0.030910 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:22.669669 0.000000 udp 10.0.2.105 7010 -> 91.63.31.98 8426 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 11:03:27.290484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:03:38.007740 0.072112 tcp 10.0.2.105 51953 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:03:38.080173 0.078572 tcp 10.0.2.105 51954 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:03:38.159061 0.176818 tcp 10.0.2.105 51955 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:03:38.336625 0.090553 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:38.427643 0.193884 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:38.621878 0.173866 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:38.796086 0.585335 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:39.381759 0.156369 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:39.538502 0.140642 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:39.679540 0.184921 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:39.864814 0.175209 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.040430 0.168246 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.209066 0.186366 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.395754 0.053161 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.449268 0.163173 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.612834 0.181940 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.795125 0.189498 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:40.985034 0.150299 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:03:41.135671 0.053812 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:09:31.295682 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:09:38.303024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:09:46.305140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:10:02.307867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:10:34.313808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:16:38.320002 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:16:45.327055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:16:53.328548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:17:09.332834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:17:41.337678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:20:30.341900 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 11:20:30.341998 1.035818 tcp 10.0.2.105 51956 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:23:45.344429 3.021298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:23:52.370850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:24:00.372359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:24:16.375380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:24:48.381578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:30:52.388184 3.000972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:30:59.394991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:31:07.397091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:31:23.399572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:31:55.405654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:33:45.984984 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 11:33:45.985080 3.080519 udp 10.0.2.105 7010 -> 91.63.31.98 8426 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 11:33:49.065599 0.000000 icmp 91.63.31.98 0x0103 -> 10.0.2.105 0x5b3f URH 192 1 170 flow=Background 1970/01/09 11:34:03.831963 0.073575 tcp 10.0.2.105 51957 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:34:03.905819 0.079797 tcp 10.0.2.105 51958 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:34:03.985919 0.175905 tcp 10.0.2.105 51959 -> 195.113.214.234 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:34:04.162328 0.191446 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.354191 0.061935 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.416476 0.199567 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.616469 0.090076 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.706950 0.143509 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.850878 0.042125 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.893490 0.071519 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:04.965421 0.332926 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:05.298747 0.160410 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:05.459546 0.140402 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:05.600379 0.144730 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:05.745489 0.307734 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.053573 0.028297 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.082257 0.181723 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.264419 0.168235 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.432996 0.139612 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.572936 0.168447 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.741736 0.127110 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:06.869282 0.193428 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.063184 0.170964 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.234559 0.137954 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.372916 0.055118 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.428507 0.029721 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.458585 0.219127 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.678107 0.146674 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:07.825196 0.179378 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:08.004974 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 11:34:24.590732 0.074770 tcp 10.0.2.105 51960 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:34:24.665739 0.133113 tcp 10.0.2.105 51961 -> 195.113.214.234 80 SRPA* 0 0 73 78092 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:34:24.799252 0.190510 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:24.990163 0.396209 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:25.386760 0.155158 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:25.542301 0.139078 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:25.681745 0.195635 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:25.877723 0.172280 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.050396 0.166457 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.217227 0.162325 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.379954 0.186059 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.566437 0.177504 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.744363 0.149174 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.893876 0.056026 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:26.950230 0.184915 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:34:27.135508 0.052863 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/09 11:37:59.411743 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 11:38:06.419057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:38:14.420900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:38:30.423508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:39:02.429797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:45:06.435916 3.001776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:45:13.443250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:45:21.444288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:45:37.447459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:46:09.453596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:50:31.381182 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 11:50:31.381332 0.978893 tcp 10.0.2.105 51962 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/09 11:52:13.459984 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:52:20.467122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:52:28.469002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:52:44.471254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:53:16.477872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:59:20.483287 3.001635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 11:59:27.491380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:59:35.492601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 11:59:51.495476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:00:23.501580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:04:51.266670 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 12:04:51.266865 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:05:06.349615 0.073700 tcp 10.0.2.105 51963 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:06.423580 0.076984 tcp 10.0.2.105 51964 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:06.500885 0.177491 tcp 10.0.2.105 51965 -> 195.113.214.234 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:06.679048 0.192925 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:06.872378 0.242563 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.115334 0.092169 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.207883 0.187951 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.396185 0.040250 udp 10.0.2.105 7010 <-> 91.207.7.129 3326 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.436762 0.072078 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.509194 0.335354 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.844931 0.060401 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:07.905684 0.442959 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:08.349043 0.050072 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:08.399490 0.164745 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:08.564640 0.142715 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:08.707846 0.177732 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:08.885989 0.130871 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.017295 0.144047 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.161752 0.170229 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.332379 0.125085 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.457807 0.175238 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.633424 0.155070 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:09.788857 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:05:27.699892 0.069720 tcp 10.0.2.105 51966 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:27.769931 0.079377 tcp 10.0.2.105 51967 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:27.849578 0.174315 tcp 10.0.2.105 51968 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:28.024677 0.266007 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:28.291022 0.144833 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:28.436286 0.175102 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:28.611806 0.055241 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:28.667419 0.392472 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.060271 0.028475 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.089078 0.231003 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.320670 0.156643 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.477687 0.139708 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.617775 0.183012 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.801189 0.168719 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:29.970266 0.165915 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:30.136690 0.142608 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:30.279659 0.190200 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:30.470285 0.125126 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:30.595805 0.150779 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:30.746995 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:05:49.741482 0.075249 tcp 10.0.2.105 51969 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:49.817017 0.077702 tcp 10.0.2.105 51970 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:49.895017 0.178217 tcp 10.0.2.105 51971 -> 195.113.214.234 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:05:50.073739 0.184066 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:50.258187 0.057471 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:05:50.316065 0.163070 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:06:27.508593 3.000519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 12:06:34.514632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:06:42.516591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:06:58.519693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:07:30.525623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:13:34.532432 3.001046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:13:41.539183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:13:49.540940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:14:05.543441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:14:37.549335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:20:32.360350 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 12:20:32.360494 1.052065 tcp 10.0.2.105 51972 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:20:41.556008 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:20:48.563165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:20:56.564481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:21:12.567828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:21:44.573530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:27:48.579420 3.002087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:27:55.587022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:28:03.588039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:28:19.591480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:28:51.597372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:34:55.602811 3.002015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:35:02.610938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:35:10.612713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:35:26.615477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:35:58.000664 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 12:35:58.000806 0.167988 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:35:58.169179 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:35:58.621503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:36:15.227064 0.073357 tcp 10.0.2.105 51973 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:15.300713 0.073058 tcp 10.0.2.105 51974 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:15.374077 0.173069 tcp 10.0.2.105 51975 -> 195.113.214.234 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:15.547353 0.153714 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:15.701420 0.190583 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:15.892522 0.086983 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:15.979850 0.070042 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:16.050332 0.374491 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:16.425245 0.063897 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:16.489530 0.296576 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:16.786506 0.000000 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:36:33.422046 0.068783 tcp 10.0.2.105 51976 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:33.491140 0.079567 tcp 10.0.2.105 51977 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:33.570998 0.179108 tcp 10.0.2.105 51978 -> 195.113.214.234 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:33.750723 0.141984 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:33.893036 0.137835 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.031275 0.139531 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.171168 0.168841 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.340414 0.034989 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.375802 0.161310 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.537523 0.145215 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.683096 0.206271 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:34.889691 0.125081 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.015129 0.156217 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.171714 0.195354 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.367466 0.211147 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.578955 0.055426 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.634859 0.092994 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.728388 0.028266 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.757028 0.193955 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:35.951381 0.141438 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:36.093234 0.176040 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:36.269685 0.185284 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:36.455350 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 12:36:54.562505 0.072869 tcp 10.0.2.105 51979 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:54.635639 0.076412 tcp 10.0.2.105 51980 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:54.712522 0.174086 tcp 10.0.2.105 51981 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:36:54.887075 0.164083 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.051555 0.337617 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.389529 0.141697 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.531545 0.155978 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.687922 0.188091 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.876567 0.084923 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:55.961841 0.148393 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:56.110593 0.184232 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:56.295154 0.058235 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:36:56.353796 0.160587 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/09 12:42:02.627867 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 12:42:09.634960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:42:17.636110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:42:33.639361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:43:05.645400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:49:09.651256 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:49:16.658859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:49:24.660558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:49:40.663436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:50:12.669665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:50:33.419680 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 12:50:33.419800 0.916772 tcp 10.0.2.105 51982 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/09 12:56:16.674961 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 12:56:23.682908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:56:31.684402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:56:47.687055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 12:57:19.693565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:03:23.699832 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:03:30.707052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:03:38.708017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:03:54.711086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:04:26.717558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:07:02.021144 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 13:07:02.021268 0.039127 udp 10.0.2.105 7010 -> 91.207.7.129 3326 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 13:07:02.060395 0.000000 icmp 79.171.122.198 0x0103 -> 10.0.2.105 0x5bcf URH 192 1 89 flow=Background 1970/01/09 13:07:20.328304 0.066628 tcp 10.0.2.105 51983 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 13:07:20.395211 0.075120 tcp 10.0.2.105 51984 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 13:07:20.470180 0.163038 tcp 10.0.2.105 51985 -> 195.113.214.234 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/09 13:07:20.633751 0.173521 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:20.807728 0.168471 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:20.976596 0.085339 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.062343 0.188224 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.251003 0.188211 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.439604 0.098975 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.539088 0.061372 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.600853 0.335588 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:21.936772 0.251695 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.188884 0.166644 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.355898 0.149010 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.505283 0.137813 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.643450 0.139851 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.783693 0.056331 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.840614 0.143138 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:22.984112 0.185932 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.170388 0.120455 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.291190 0.156663 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.448281 0.244644 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.693257 0.218804 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.912416 0.067984 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:23.980809 0.116983 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.098177 0.028670 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.127157 0.190247 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.317804 0.145292 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.463503 0.173131 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.636990 0.182608 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:24.820020 0.185021 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.005409 0.166683 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.172504 0.307684 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.480760 0.140235 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.621408 0.155882 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.777691 0.179716 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:25.957806 0.081279 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:26.039507 0.150602 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:26.190503 0.184758 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:26.375607 0.053116 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:07:26.429161 0.180966 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:10:30.723512 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:10:37.730647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:10:45.732551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:11:01.735481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:11:33.740887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:17:37.747336 3.001725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:17:44.754871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:17:52.756178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:18:08.759292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:18:40.764855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:20:34.339429 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 13:20:34.339615 0.989165 tcp 10.0.2.105 51986 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/01/09 13:24:44.770872 3.002159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:24:51.778277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:24:59.780171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:25:15.783434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:25:47.789257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:31:51.795668 3.011352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:31:58.812904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:32:06.813845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:32:22.817140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:32:54.823031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:37:44.349427 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 13:37:44.349517 0.071462 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:44.421393 0.143479 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:44.565239 0.235157 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:44.800839 0.168470 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:44.969649 0.188515 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:45.158561 0.094942 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:45.253937 0.059125 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:45.313468 0.334920 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:45.648748 0.238916 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:45.888057 0.167747 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.056136 0.140490 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.196998 0.027540 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.224925 0.145408 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.370716 0.180229 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.551277 0.162031 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.713776 0.143609 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.857736 0.137801 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:46.995966 0.156970 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.153310 0.163116 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.316835 0.232758 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.549992 0.053662 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.604073 0.082981 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.687386 0.030257 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.718039 0.194149 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:47.912606 0.172142 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.085164 0.188678 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.274234 0.165080 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.439710 0.146207 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.586273 0.174457 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.761124 0.177639 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:48.939190 0.137678 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.077290 0.155464 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.233157 0.177556 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.411133 0.087556 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.499110 0.150684 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.650230 0.164642 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:49.815262 0.184525 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:37:50.000201 0.053009 udp 10.0.2.105 7010 <-> 188.129.229.41 5428 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/09 13:38:58.828826 3.002084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:39:05.836416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:39:13.837930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:39:29.841116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:40:01.847084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:46:05.853773 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:46:12.860347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:46:20.861947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:46:36.864845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:47:08.870719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:50:35.328686 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 13:50:35.328918 0.964829 tcp 10.0.2.105 51987 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/09 13:53:12.877681 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 13:53:19.884569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:53:27.886563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:53:43.889594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 13:54:15.895188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:00:19.901940 3.000861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:00:26.908388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:00:34.909760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:00:50.913107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:01:22.918954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:07:26.925440 3.001140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:07:33.932391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:07:41.933927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:07:57.937267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:08:09.884750 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 14:08:09.884854 0.180316 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.065545 0.168358 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.234239 0.187672 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.422283 0.096334 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.518966 0.062022 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.581408 0.085219 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.667030 0.146053 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:10.813458 0.336339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.150184 0.208516 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.359020 0.167138 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.526614 0.139002 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.665969 0.030369 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.696739 0.156089 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:11.853251 0.152990 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.006677 0.144873 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.151995 0.167906 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.320303 0.162483 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.483178 0.145215 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.628762 0.180295 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:12.809418 0.222780 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.032601 0.054347 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.087276 0.074976 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.162703 0.029731 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.192746 0.189826 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.383040 0.174192 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.557599 0.177981 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.735993 0.173512 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:13.909888 0.254573 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.164855 0.138668 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.303977 0.154379 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.458795 0.165272 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.624434 0.140665 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.765448 0.192198 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:14.958045 0.088675 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:15.047112 0.151079 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:15.198522 0.160932 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:15.359863 0.186127 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:08:15.546330 0.000000 udp 10.0.2.105 7010 -> 188.129.229.41 5428 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 14:08:29.943097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:08:31.649225 0.073649 tcp 10.0.2.105 51988 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:08:31.723107 0.071654 tcp 10.0.2.105 51989 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:08:31.795001 0.148620 tcp 10.0.2.105 51990 -> 195.113.214.234 443 SRPA* 0 0 63 41211 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:14:33.948662 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:14:40.956307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:14:48.958305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:15:04.961282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:15:36.967212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:20:36.298271 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 14:20:36.298497 0.973612 tcp 10.0.2.105 51991 -> 128.255.183.224 9027 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:21:40.974036 3.000354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:21:47.980507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:21:55.982117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:22:11.985114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:22:43.990758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:28:47.997400 3.000858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:28:55.004111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:29:03.005992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:29:19.008776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:29:51.015027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:35:55.021281 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:36:02.028164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:36:10.029750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:36:26.032886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:36:58.039130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:38:43.080669 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 14:38:43.080779 0.000000 udp 10.0.2.105 7010 -> 188.129.229.41 5428 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 14:39:01.248068 0.090147 tcp 10.0.2.105 51992 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:01.338513 0.075093 tcp 10.0.2.105 51993 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:01.413925 0.158423 tcp 10.0.2.105 51994 -> 195.113.214.234 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:01.572566 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 14:39:17.950453 0.068535 tcp 10.0.2.105 51995 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:18.019272 0.070011 tcp 10.0.2.105 51996 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:18.089581 0.163006 tcp 10.0.2.105 51997 -> 195.113.214.234 443 SRPA* 0 0 20 11290 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:18.253085 0.209744 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:18.463201 0.100000 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:18.563574 0.067619 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:18.631589 0.071487 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:18.703439 0.203090 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:18.906914 0.336895 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:19.244155 0.190904 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:19.435472 0.146199 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:19.582151 0.270581 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:19.853087 0.121763 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:19.975203 0.145777 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.121302 0.137844 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.259477 0.155871 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.415754 0.027940 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.444015 0.171256 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.615659 0.178412 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.794461 0.144034 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:20.938856 0.164563 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:21.103864 0.054078 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:21.158296 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 14:39:40.082756 0.073370 tcp 10.0.2.105 51998 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:40.156568 0.076822 tcp 10.0.2.105 51999 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:40.233677 0.159075 tcp 10.0.2.105 52000 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:39:40.393407 0.028355 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:40.422090 0.221830 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:40.644310 0.182443 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:40.827124 0.180401 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.007908 0.299329 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.307786 0.136587 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.444758 0.192720 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.637834 0.185182 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.823443 0.143352 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:41.967233 0.188754 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.156415 0.088632 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.245488 0.148761 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.394597 0.165470 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.560491 0.153967 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.714852 0.160379 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:39:42.875645 0.183749 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 14:43:02.045193 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 14:43:09.052687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:43:17.053442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:43:33.056573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:44:05.062839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:50:09.068885 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:50:16.076504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:50:24.077813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:50:37.277118 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 14:50:37.277331 0.953170 tcp 10.0.2.105 52001 -> 128.255.183.224 9027 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/09 14:50:40.080894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:51:12.086576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:57:16.092972 3.001495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 14:57:23.100230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:57:31.101339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:57:47.104561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 14:58:19.110662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:04:23.116047 3.002689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:04:30.123904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:04:38.125959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:04:54.128939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:05:26.134419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:09:52.908607 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 15:09:52.908742 0.168671 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:09:53.077832 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 15:10:10.906013 0.075687 tcp 10.0.2.105 52002 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:10.981958 0.073344 tcp 10.0.2.105 52003 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:11.055596 0.223754 tcp 10.0.2.105 52004 -> 195.113.214.234 443 SRPA* 0 0 35 19200 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:11.279168 0.104623 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:11.384139 0.059249 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:11.443781 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 15:10:29.961920 0.073818 tcp 10.0.2.105 52005 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:30.035966 0.080137 tcp 10.0.2.105 52006 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:30.116001 0.158160 tcp 10.0.2.105 52007 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:10:30.275361 0.151584 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:30.427344 0.343912 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:30.771665 0.167860 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:30.939923 0.142495 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.082851 0.188778 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.272005 0.145778 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.418159 0.137973 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.556555 0.119968 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.676935 0.282613 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:31.959970 0.168108 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.128607 0.180356 udp 10.0.2.105 7010 <-> 107.196.6.122 7552 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.309350 0.144524 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.454232 0.159666 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.614279 0.059794 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.674449 0.028398 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.703244 0.175462 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:32.879102 0.180558 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.060022 0.179040 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.239474 0.187091 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.426967 0.028688 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.456013 0.228765 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.685155 0.138070 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:33.823620 0.192849 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.016901 0.176651 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.193913 0.144158 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.338436 0.188904 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.527717 0.091251 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.619373 0.155713 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.775419 0.160153 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:34.935957 0.182783 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:35.119098 0.191773 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:10:35.311242 0.166276 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:11:30.141257 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 15:11:37.147947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:11:45.149300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:12:01.152468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:12:33.158805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:18:37.165387 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:18:44.171791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:18:52.173886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:19:08.176601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:19:40.182901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:20:38.236673 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 15:20:38.236786 1.039989 tcp 10.0.2.105 52008 -> 128.255.183.224 9027 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:25:44.189251 3.001120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:25:51.196460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:25:59.197290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:26:15.200484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:26:47.206457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:32:51.212661 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:32:58.219684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:33:06.221343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:33:22.224622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:33:54.230824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:39:58.236160 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:40:05.243776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:40:13.245777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:40:29.248902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:40:58.651098 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 15:40:58.651263 0.085108 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:58.736786 0.170316 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:58.907506 0.097285 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.005194 0.064561 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.070109 0.145223 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.215741 0.333598 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.549751 0.167065 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.717255 0.141135 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:40:59.858739 0.188034 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:00.047171 0.140608 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:00.188117 0.310983 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:00.499471 0.169356 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:00.669200 0.000000 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 15:41:01.254191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:41:19.582372 0.070936 tcp 10.0.2.105 52009 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:41:19.653630 0.070487 tcp 10.0.2.105 52010 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:41:19.724443 0.156017 tcp 10.0.2.105 52011 -> 195.113.214.234 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:41:19.880955 0.149858 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.031273 0.124038 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.155724 0.186005 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.342231 0.159947 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.502549 0.053987 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.556901 0.029262 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.586499 0.193423 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.780346 0.182435 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:20.963198 0.175518 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:21.139130 0.238462 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:21.378017 0.139631 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:21.518035 0.189770 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:21.708139 0.179311 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:21.887846 0.142677 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.030940 0.225327 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.256707 0.029982 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.287026 0.188809 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.476220 0.093099 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.569700 0.154839 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.724899 0.160772 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:22.886038 0.200153 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:23.086610 0.185763 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:41:23.272750 0.167614 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 15:47:05.260574 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:47:12.268436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:47:20.269760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:47:36.272101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:48:08.278156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:50:39.276386 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 15:50:39.276624 1.010076 tcp 10.0.2.105 52012 -> 128.255.183.224 9027 FSPA* 0 0 13 1636 flow=From-Botnet-V2-TCP-Established 1970/01/09 15:54:12.284836 3.001540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 15:54:19.291590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:54:27.293599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:54:43.296068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 15:55:15.302597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:01:19.307979 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:01:26.315663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:01:34.317678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:01:50.320117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:02:22.326445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:08:26.332736 3.001124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:08:33.339622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:08:41.341134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:08:57.344004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:09:29.350073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:11:29.844148 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 16:11:29.844291 0.000000 udp 10.0.2.105 7010 -> 107.196.6.122 7552 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 16:11:46.048835 0.069786 tcp 10.0.2.105 52013 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:11:46.118900 0.069393 tcp 10.0.2.105 52014 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:11:46.188142 0.161039 tcp 10.0.2.105 52015 -> 195.113.214.234 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:11:46.423430 0.095396 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:46.519184 0.096300 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:46.615897 0.147871 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:46.764101 0.071740 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:46.836274 0.175793 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.012510 0.144897 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.157790 0.191638 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.349797 0.123681 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.473820 0.334154 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.808375 0.166744 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:47.975513 0.323053 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:48.298892 0.316825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:48.616075 0.146606 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:48.763049 0.146050 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:48.909489 0.131147 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.041065 0.166684 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.208135 0.054925 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.263453 0.026566 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.290397 0.161178 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.451951 0.181301 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.633685 0.173860 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:49.807961 0.193211 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:50.001531 0.175009 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:50.176942 0.141216 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:50.318615 0.600405 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:50.919431 0.028483 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:50.948241 0.208981 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.157634 0.138497 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.296532 0.188945 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.485815 0.090851 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.577057 0.156003 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.733509 0.163735 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:51.897622 0.187345 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:52.085344 0.203528 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:11:52.289229 0.163778 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:15:33.356832 3.001179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:15:40.363616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:15:48.365478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:16:04.368101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:16:36.374088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:20:40.286344 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 16:20:40.286453 1.168348 tcp 10.0.2.105 52016 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:22:40.379906 3.001996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:22:47.387402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:22:55.389085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:23:11.392151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:23:43.398127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:29:47.405119 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:29:54.411906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:30:02.413518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:30:18.416136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:30:50.422043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:36:54.428707 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:37:01.435914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:37:09.437420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:37:25.439978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:37:57.446174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:41:54.487735 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 16:41:54.487835 0.089065 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:54.577308 0.059805 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:54.637489 0.157733 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:54.806680 0.071553 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:54.878656 0.340042 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:55.219078 0.146379 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:55.365810 0.191563 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:55.557728 0.172355 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:55.730422 0.420937 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:56.151783 0.123011 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:56.275193 0.360645 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:56.636233 0.309983 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:56.946578 0.143489 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:57.090491 0.159327 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:57.250256 0.137754 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:57.388576 0.161548 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:41:57.550514 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 16:42:14.187601 0.070412 tcp 10.0.2.105 52017 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:42:14.258156 0.070388 tcp 10.0.2.105 52018 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:42:14.328383 0.157952 tcp 10.0.2.105 52019 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:42:14.486976 0.026652 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:14.514005 0.174030 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:14.688453 0.193910 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:14.882793 0.175775 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:15.058931 0.147359 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:15.206704 0.196196 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:15.403324 0.239232 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:15.642930 0.972696 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:16.616022 0.028806 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:16.645204 0.229484 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:16.875021 0.138987 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.014407 0.155000 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.169758 0.160874 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.331003 0.185087 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.516524 0.181659 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.698546 0.188443 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.887364 0.077296 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:42:17.965047 0.164529 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/09 16:44:01.452304 3.001623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:44:08.459939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:44:16.461319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:44:32.464064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:45:04.469909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:50:41.455043 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 16:50:41.455277 1.016003 tcp 10.0.2.105 52020 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/09 16:51:08.477088 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:51:15.483460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:51:23.485170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:51:39.488244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:52:11.493998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:58:15.500610 3.001295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 16:58:22.507607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:58:30.509328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:58:46.511936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 16:59:18.517784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:05:22.524098 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:05:29.531428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:05:37.533156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:05:53.546035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:06:25.552117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:12:29.558843 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:12:32.710831 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 17:12:32.710938 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 17:12:36.565880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:12:44.567186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:12:48.273809 0.042895 tcp 10.0.2.105 52021 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:12:48.316976 0.042418 tcp 10.0.2.105 52022 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:12:48.359687 0.131102 tcp 10.0.2.105 52023 -> 195.113.214.234 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:12:48.491308 0.155753 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:48.647420 0.072579 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:48.720422 0.170800 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:48.891618 0.089995 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:48.982011 0.071830 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.054197 0.194589 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.249126 0.166823 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.416389 0.141103 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.557889 0.120164 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.678394 0.179867 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:49.858649 0.152630 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:50.011670 0.319329 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:50.331370 0.346800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:50.678521 0.155402 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:50.834322 0.124492 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:50.959194 0.164915 udp 10.0.2.105 7010 <-> 108.73.112.4 2350 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.124643 0.026286 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.151292 0.174951 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.326603 0.191926 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.518885 0.176679 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.695959 0.164145 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:51.860525 0.189667 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:52.050535 0.216953 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:52.267903 0.448783 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:52.717068 0.029084 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:52.746548 0.228697 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:52.975606 0.154441 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.130392 0.190606 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.321321 0.177942 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.499617 0.182185 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.682133 0.075067 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.757591 0.166155 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:53.924136 0.204329 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:12:54.128858 0.163096 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:13:00.569846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:13:32.576076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:19:36.582946 3.000723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:19:43.589537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:19:51.591351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:20:07.593774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:20:39.600075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:20:42.485072 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 17:20:42.485331 0.925799 tcp 10.0.2.105 52024 -> 128.255.183.224 9027 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:26:43.605997 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:26:50.613277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:26:58.614894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:27:14.617939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:27:46.624000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:33:50.630356 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:33:57.637068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:34:05.638569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:34:21.642138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:34:53.648204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:40:57.653912 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:41:04.661611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:41:12.662887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:41:28.666259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:42:00.671770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:43:06.146169 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 17:43:06.161293 0.169862 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.331587 0.085717 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.417656 0.066078 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.484069 0.189532 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.674029 0.152758 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.827169 0.083444 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:06.911004 0.167892 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.079323 0.145715 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.225428 0.122291 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.348125 0.168453 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.516976 0.145626 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.662944 0.319222 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:07.982521 0.336886 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:08.319791 0.145690 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:08.465862 0.137958 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:08.604237 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 17:43:26.567346 0.042679 tcp 10.0.2.105 52025 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:26.610304 0.042137 tcp 10.0.2.105 52026 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:26.652678 0.134629 tcp 10.0.2.105 52027 -> 195.113.214.234 443 SRPA* 0 0 40 21154 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:26.787865 0.042326 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:26.830531 0.174275 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.005145 0.145329 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.150869 0.189148 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.340580 0.199071 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.539994 0.192505 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.732886 0.182785 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:27.916092 0.199622 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.116082 0.029161 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.145572 0.217770 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.363702 0.141712 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.505817 0.154059 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.660393 0.074834 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.735624 0.165907 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:28.901927 0.197770 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:29.100093 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 17:43:44.431583 0.041923 tcp 10.0.2.105 52028 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:44.473332 0.043585 tcp 10.0.2.105 52029 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:44.517311 0.133311 tcp 10.0.2.105 52030 -> 195.113.214.234 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:43:44.651189 0.532648 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:43:45.184391 0.182432 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/09 17:48:04.678423 3.000831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 17:48:11.685582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:48:19.687234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:48:35.690118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:49:07.695718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:50:43.414289 0.000186 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 17:50:43.414580 0.926671 tcp 10.0.2.105 52031 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/09 17:55:11.702757 3.000697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 17:55:18.709107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:55:26.710602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:55:42.713970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 17:56:14.720003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:02:18.726350 3.001213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:02:25.733387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:02:33.734687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:02:49.737898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:03:21.743964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:09:25.750617 3.000794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:09:32.757437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:09:40.759172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:09:56.762009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:10:28.767458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:13:50.528671 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 18:13:50.528770 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 18:14:06.933321 0.042447 tcp 10.0.2.105 52032 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 18:14:06.975606 0.042839 tcp 10.0.2.105 52033 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 18:14:07.018647 0.135598 tcp 10.0.2.105 52034 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/09 18:14:07.154835 0.148935 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:07.304221 0.168824 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:07.473455 0.188902 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:07.662754 0.147444 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:07.810591 0.070196 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:07.881190 0.168508 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.050529 0.153692 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.204628 0.120059 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.325081 0.062986 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.388488 0.089212 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.478123 0.323772 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.802326 0.169068 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:08.971808 0.144615 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:09.116871 0.351035 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:09.468355 0.137924 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:09.606619 0.144551 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:09.751528 0.146543 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:09.898526 0.180523 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.079391 0.180668 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.260497 0.027481 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.288557 0.177694 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.466667 0.393624 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.860660 0.028003 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:10.889045 0.209171 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.098577 0.186347 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.285328 0.191282 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.477042 0.072698 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.550147 0.167095 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.717659 0.185706 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:11.903773 0.141361 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:12.045563 0.154139 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:12.200091 0.169055 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:14:12.369515 0.188822 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:16:32.774164 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:16:39.781481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:16:47.783099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:17:03.785759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:17:35.791511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:20:44.343525 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 18:20:44.343631 1.008321 tcp 10.0.2.105 52035 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/09 18:23:39.798399 3.000870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:23:46.805397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:23:54.806334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:24:10.809625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:24:42.815542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:30:46.822346 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:30:53.829104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:31:01.830671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:31:17.833329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:31:49.839994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:37:53.845261 3.002383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:38:00.852981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:38:08.854834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:38:24.858014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:38:56.863945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:44:23.043094 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 18:44:23.043193 0.175132 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:23.218681 0.232095 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:23.451151 0.190764 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:23.642317 0.146215 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:23.788946 0.071666 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:23.860965 0.167638 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:24.029019 0.143009 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:24.172526 0.120308 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:24.293255 0.317071 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:24.610801 0.333374 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:24.944573 0.144072 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.088988 0.060996 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.150328 0.090441 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.241159 0.334904 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.576666 0.130923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.707963 0.145069 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.853364 0.144059 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:25.997841 0.167577 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.165814 0.229643 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.395820 0.028013 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.424152 0.028380 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.452919 0.227935 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.681256 0.182492 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:26.864150 0.178876 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:27.043430 0.750909 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:27.794734 0.188300 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:27.983389 0.075935 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.059680 0.165688 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.225680 0.185544 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.411611 0.144118 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.556152 0.155242 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.711736 0.165981 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:44:28.878118 0.179811 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 18:45:00.870468 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:45:07.877240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:45:15.878249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:45:31.881285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:46:03.887964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:50:45.352779 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 18:50:45.352875 0.964453 tcp 10.0.2.105 52036 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/09 18:52:07.894631 3.000648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:52:14.901154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:52:22.902743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:52:38.905420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:53:10.911451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:59:14.917987 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 18:59:21.925200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:59:29.926261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 18:59:45.929348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:00:17.935699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:06:21.942394 3.001029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:06:28.948710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:06:36.950446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:06:52.953555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:07:24.959633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:13:28.966612 3.000797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:13:35.972926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:13:43.974743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:13:59.977574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:14:31.983716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:14:32.885126 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 19:14:32.885225 0.148630 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.034193 0.176329 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.210933 0.189035 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.400491 0.149527 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.550391 0.082461 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.633272 0.168072 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.801728 0.140602 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:33.942678 0.120921 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.064015 0.149696 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.214064 0.083210 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.297625 0.091286 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.389357 0.215168 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.604919 0.169265 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:34.774527 0.366338 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:35.141197 0.137780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:35.279377 0.143115 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:35.422943 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 19:14:53.305885 0.070970 tcp 10.0.2.105 52037 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:14:53.377169 0.073226 tcp 10.0.2.105 52038 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:14:53.450724 0.133860 tcp 10.0.2.105 52039 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:14:53.585244 0.160060 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:53.745697 0.028562 udp 10.0.2.105 7010 <-> 79.227.154.174 2430 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:53.774684 0.219166 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:53.994236 0.179742 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:54.174367 0.178629 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:54.353427 0.181005 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:54.534779 0.032350 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:54.567508 0.358143 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:54.926056 0.188653 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.115113 0.075760 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.191241 0.168022 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.359636 0.154689 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.514733 0.170709 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.685784 0.195401 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:55.881559 0.193743 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:14:56.075711 0.139764 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:20:35.989641 3.011162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:20:43.006582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:20:46.322287 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 19:20:46.322363 1.065048 tcp 10.0.2.105 52040 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:20:51.008238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:21:07.011584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:21:39.017937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:27:43.023807 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:27:50.030536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:27:58.032523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:28:14.035422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:28:46.041234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:34:50.047462 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:34:57.055173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:35:05.055998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:35:21.059085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:35:53.065380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:41:57.071736 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:42:04.078469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:42:12.080148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:42:28.083415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:43:00.089320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:45:20.982480 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 19:45:20.982600 0.146609 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:21.129592 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 19:45:36.176086 0.071091 tcp 10.0.2.105 52041 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:36.247565 0.070762 tcp 10.0.2.105 52042 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:36.318656 0.138883 tcp 10.0.2.105 52043 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:36.458128 0.167994 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:36.626491 0.148858 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:36.775723 0.071613 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:36.847825 0.167841 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.016043 0.145432 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.161856 0.122169 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.284395 0.141438 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.426170 0.094242 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.520742 0.192526 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:37.713690 0.334407 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.048525 0.137673 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.186646 0.100316 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.287798 0.227292 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.515447 0.170038 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.685906 0.141641 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:38.827899 0.000000 udp 10.0.2.105 7010 -> 79.227.154.174 2430 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 19:45:54.811187 0.073013 tcp 10.0.2.105 52044 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:54.884513 0.070278 tcp 10.0.2.105 52045 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:54.955065 0.133746 tcp 10.0.2.105 52046 -> 195.113.214.234 443 SRPA* 0 0 20 10884 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:45:55.089470 0.217799 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:55.307821 0.181730 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:45:55.489946 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 19:46:12.146018 0.074461 tcp 10.0.2.105 52047 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:46:12.220824 0.076235 tcp 10.0.2.105 52048 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:46:12.297294 0.135654 tcp 10.0.2.105 52049 -> 195.113.214.234 443 SRPA* 0 0 34 26102 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:46:12.433603 0.156658 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:12.590585 0.176449 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:12.767420 0.026978 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:12.794695 0.242955 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.038049 0.188099 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.226556 0.077895 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.304786 0.164689 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.469919 0.188967 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.659284 0.186320 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.845977 0.141015 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:13.987386 0.155328 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:46:14.143145 0.168195 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 19:49:04.094860 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 19:49:11.102481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:49:19.104540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:49:35.107116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:50:07.113632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:50:47.392046 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 19:50:47.392154 0.991965 tcp 10.0.2.105 52050 -> 128.255.183.224 9027 FSPA* 0 0 12 1418 flow=From-Botnet-V2-TCP-Established 1970/01/09 19:56:11.119329 3.001670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 19:56:18.126620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:56:26.127901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:56:42.131562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 19:57:14.137378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:03:18.142536 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:03:25.150977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:03:33.151903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:03:49.155545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:04:21.161324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:10:25.166873 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:10:32.174466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:10:40.176323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:10:56.179530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:11:28.185424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:16:37.450364 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 20:16:37.450462 0.158385 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:37.609271 0.184829 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:37.794514 0.000000 udp 10.0.2.105 7010 -> 79.227.154.174 2430 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 20:16:56.419351 0.077122 tcp 10.0.2.105 52051 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 20:16:56.496747 0.072206 tcp 10.0.2.105 52052 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 20:16:56.569254 0.154614 tcp 10.0.2.105 52053 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/09 20:16:56.724448 0.145001 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:56.869854 0.070615 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:56.940920 0.167453 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.108792 0.139391 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.248574 0.121634 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.370617 0.151046 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.522075 0.171189 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.693620 0.123907 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.817919 0.083441 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:57.901679 0.193300 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:58.095377 0.143253 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:58.239030 0.068705 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:58.308118 0.369526 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:58.678010 0.217385 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:58.895810 0.143601 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.039755 0.169354 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.209554 0.219727 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.429624 0.183235 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.613264 0.154764 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.768485 0.174603 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.943472 0.028090 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:16:59.971893 0.286570 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:00.258873 0.192067 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:00.451284 0.085753 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:00.537428 0.190754 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:00.728579 0.141157 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:00.870116 0.155571 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:01.026046 0.168968 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:01.195391 0.165204 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:01.360994 0.192592 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:17:32.191946 3.000772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:17:39.198337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:17:47.199933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:18:03.203323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:18:35.209161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:20:48.391244 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 20:20:48.391331 1.003355 tcp 10.0.2.105 52054 -> 128.255.183.224 9027 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/01/09 20:24:39.215755 3.001004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:24:46.222633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:24:54.224017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:25:10.227240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:25:42.233539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:31:46.239309 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:31:53.246762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:32:01.248236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:32:17.250736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:32:49.256872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:38:53.263654 3.000987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:39:00.270842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:39:08.271816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:39:24.275223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:39:56.281359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:46:00.286640 3.002633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:46:07.294800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:46:15.296166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:46:31.299371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:47:01.783326 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 20:47:01.783516 0.151000 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:01.950335 0.174301 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.125044 0.167539 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.292977 0.139320 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.432645 0.147241 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.580239 0.070254 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.650864 0.125629 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.776892 0.144734 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:02.922020 0.170276 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.092659 0.137700 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.230763 0.088706 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.305025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:47:03.319805 0.187502 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.507752 0.145888 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.653978 0.060617 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:03.714960 0.349235 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.064571 0.210030 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.274964 0.145503 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.420792 0.168334 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.589551 0.155510 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.745470 0.177584 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.923463 0.037437 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:04.961239 0.812063 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:05.773720 0.220375 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:05.994452 0.181046 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.175895 0.188775 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.365051 0.079453 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.444903 0.189192 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.634431 0.135500 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.770341 0.154897 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:06.925621 0.160213 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:07.086164 0.165110 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:47:07.251634 0.179520 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 20:50:49.400443 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 20:50:49.400524 0.940866 tcp 10.0.2.105 52055 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/09 20:53:07.310838 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 20:53:14.318124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:53:22.320184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:53:38.323150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 20:54:10.329150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:00:14.336158 3.000189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:00:21.342679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:00:29.343787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:00:45.347056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:01:17.353063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:07:21.358501 3.001799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:07:28.366116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:07:36.367964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:07:52.371274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:08:24.376745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:14:28.383285 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:14:35.390302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:14:43.391621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:14:59.394852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:15:31.401227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:17:17.413644 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 21:17:17.413742 0.169356 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:17.583502 0.315960 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:17.899863 0.204933 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.105226 0.145868 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.251492 0.145637 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.397525 0.072532 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.470393 0.122072 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.592855 0.154844 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.748107 0.169893 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:18.918408 0.151571 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:19.070385 0.089317 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:19.160122 0.064210 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:19.224699 0.624392 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:19.849470 0.214825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:20.064685 0.192262 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:20.257348 0.145267 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:20.403014 0.144526 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:20.547933 0.169963 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:20.718360 1.499504 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:22.218285 0.176481 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:22.395099 0.029860 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:22.425378 0.210473 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:22.636194 0.196488 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:22.833097 0.208518 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.042030 0.192182 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.234582 0.080555 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.315487 0.187721 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.503570 0.141418 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.645415 0.154214 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.800034 0.161205 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:23.961628 0.168179 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:17:24.130146 0.192016 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:20:50.340354 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 21:20:50.340572 0.971827 tcp 10.0.2.105 52056 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/09 21:21:35.406703 3.002105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 21:21:42.414219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:21:50.415923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:22:06.418728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:22:38.424784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:28:42.431671 3.000601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:28:49.438492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:28:57.440050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:29:13.452550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:29:45.458535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:35:49.465147 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:35:56.472584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:36:04.473835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:36:20.476667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:36:52.482616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:42:56.489276 3.001068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:43:03.496356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:43:11.497913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:43:27.500517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:43:59.506575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:47:49.968332 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 21:47:49.968492 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 21:48:05.282058 0.073668 tcp 10.0.2.105 52057 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 21:48:05.356067 0.074652 tcp 10.0.2.105 52058 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 21:48:05.431029 0.165474 tcp 10.0.2.105 52059 -> 195.113.214.234 443 SRPA* 0 0 57 38897 flow=From-Botnet-V2-TCP-Established 1970/01/09 21:48:05.596842 0.139073 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:05.736379 0.168143 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:05.904856 0.151709 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.056968 0.146570 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.203956 0.071934 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.276335 0.120970 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.397684 0.143517 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.541576 0.179022 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.720940 0.131101 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.852503 0.088190 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:06.941074 0.060589 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:07.002042 0.189246 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:07.191698 0.335026 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:07.527066 0.229863 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:07.757348 0.142238 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:07.899930 0.146325 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.046656 0.169355 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.216448 0.155828 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.372665 0.176066 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.549125 0.029882 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.579328 0.200383 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:08.780056 0.302856 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.083281 0.227140 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.310846 0.192683 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.503863 0.082286 udp 10.0.2.105 7010 <-> 217.34.53.163 4123 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.586483 0.189461 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.776412 0.160464 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:09.937293 0.167753 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:10.105435 0.193789 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:10.299586 0.193570 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:48:10.493506 0.144909 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/09 21:50:03.513324 3.001303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:50:10.519951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:50:18.521948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:50:34.524966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:50:51.319627 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 21:50:51.319706 0.977853 tcp 10.0.2.105 52060 -> 128.255.183.224 9027 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/09 21:51:06.530837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:57:10.537389 3.000680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 21:57:17.544294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:57:25.545679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:57:41.548749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 21:58:13.554981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:04:17.560524 3.002052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:04:24.568482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:04:32.569537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:04:48.572696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:05:20.578712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:11:24.584743 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:11:31.591751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:11:39.593791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:11:55.596283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:12:27.602694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:18:20.730641 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 22:18:20.730779 0.175914 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:20.907051 0.288462 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:21.195948 0.146704 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:21.343050 0.296021 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:21.639467 0.140487 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:21.780434 0.167680 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:21.948547 0.122057 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.070978 0.148612 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.220013 0.168718 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.389072 0.130829 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.520311 0.088025 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.608728 0.077968 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.687049 0.191921 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:22.879405 0.337039 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.216865 0.218440 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.435688 0.142697 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.578764 0.143672 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.722775 0.170059 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.893250 0.036441 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:23.930097 0.179664 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:24.110196 0.178345 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:24.288890 0.229608 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:24.518842 0.158430 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:24.677632 0.176273 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:24.854277 0.190190 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:25.044857 0.000000 udp 10.0.2.105 7010 -> 217.34.53.163 4123 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 22:18:31.608202 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:18:38.616090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:18:43.415351 0.073320 tcp 10.0.2.105 52061 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:18:43.488965 0.075209 tcp 10.0.2.105 52062 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:18:43.564595 0.166799 tcp 10.0.2.105 52063 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:18:43.731220 0.154413 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:43.885967 0.160221 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:44.046583 0.168003 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:44.214987 0.190501 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:44.405930 0.183645 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:44.589952 0.141674 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:18:46.617843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:19:02.620807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:19:34.626782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:20:52.298875 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 22:20:52.299034 1.028834 tcp 10.0.2.105 52064 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:25:38.633542 3.000666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:25:45.639782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:25:53.641385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:26:09.644658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:26:41.650510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:32:45.656771 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:32:52.663820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:33:00.665733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:33:16.668152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:33:48.674519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:39:52.680757 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:39:59.687782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:40:07.689475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:40:23.692404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:40:55.698356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:46:59.704953 3.001328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 22:47:06.711583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:47:14.713415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:47:30.716815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:48:02.722553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:48:46.286220 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 22:48:46.286406 0.000000 udp 10.0.2.105 7010 -> 217.34.53.163 4123 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 22:49:04.352843 0.070533 tcp 10.0.2.105 52065 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:49:04.423671 0.069527 tcp 10.0.2.105 52066 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:49:04.493462 0.166607 tcp 10.0.2.105 52067 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:49:04.660729 0.146309 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:04.807418 0.171021 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:04.978782 0.147955 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.127101 0.167908 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.295399 0.121547 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.417389 0.146150 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.563941 0.071853 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.636134 0.150330 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.786824 0.137988 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:05.925202 0.172508 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.098075 0.189412 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.287877 0.336090 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.624427 0.060246 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.685051 0.088646 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.774040 0.143939 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:06.918367 0.168752 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.087616 0.030916 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.118896 0.184235 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.303477 0.210972 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.514866 0.148287 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.663559 0.246437 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:07.948518 0.193017 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:08.141905 0.220955 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:08.363254 0.156621 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:08.520241 0.176060 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:08.696726 0.154836 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:08.851969 0.162281 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:09.014630 0.166422 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:09.181451 0.142519 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:09.324355 0.186667 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:49:09.511437 0.181719 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 22:50:53.328588 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 22:50:53.328777 0.997920 tcp 10.0.2.105 52068 -> 128.255.183.224 9027 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/01/09 22:54:06.728503 3.001459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 22:54:13.735539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:54:21.737540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:54:37.740292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 22:55:09.746522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:01:13.753262 3.000704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:01:20.759873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:01:28.761107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:01:44.764133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:02:16.770359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:08:20.776942 3.001087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:08:27.783838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:08:35.785241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:08:51.787995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:09:23.794318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:15:27.801203 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:15:34.807817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:15:42.809575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:15:58.812010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:16:30.817996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:19:32.800819 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 23:19:32.801010 0.147742 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:32.949159 0.167129 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.116671 0.147578 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.264681 0.186767 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.451797 0.120684 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.572847 0.145897 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.719123 0.071367 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.790884 0.143115 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:33.934367 0.152690 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.087418 0.191402 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.279156 0.189805 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.469378 0.334633 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.804564 0.068682 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.873627 0.093492 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:34.967543 0.146462 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.114351 0.169729 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.284631 0.043113 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.328101 0.182715 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.511180 0.216059 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.727717 0.189642 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:35.917776 0.177123 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.095322 0.145834 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.241533 0.211399 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.453322 0.157524 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.611227 0.178658 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.790237 0.154773 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:36.945416 0.160090 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:37.105898 0.166874 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:37.273169 0.141351 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:37.414925 0.187150 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:19:37.602406 0.194458 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:20:54.328118 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 23:20:54.328373 1.061372 tcp 10.0.2.105 52069 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/09 23:22:34.824401 3.001271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 23:22:41.831451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:22:50.293654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:23:06.296894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:23:38.302868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:29:42.309285 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:29:49.316156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:29:57.318004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:30:13.320990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:30:45.326970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:36:49.333110 3.001410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:36:56.340481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:37:04.342001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:37:20.345050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:37:52.351202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:43:56.356433 3.002533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:44:03.364137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:44:11.366175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:44:27.368909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:44:59.374791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:49:51.825919 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/09 23:49:51.826109 0.148697 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:51.975219 0.236043 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.211647 0.167200 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.379181 0.176768 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.556317 0.122605 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.679269 0.152356 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.831976 0.071839 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:52.904219 0.141548 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.046209 0.138062 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.184710 0.163105 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.348215 0.188765 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.537372 0.333469 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.871263 0.060322 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:53.931982 0.082301 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.014670 0.144737 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.159771 0.169700 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.329851 0.035051 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.365286 0.189550 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.555231 0.317254 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:54.872851 0.142429 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.015670 0.179545 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.195597 0.233627 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.429576 0.227388 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.657310 0.159940 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.817652 0.177091 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:55.995088 0.157008 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:56.152647 0.161540 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:49:56.314600 0.000000 udp 10.0.2.105 7010 -> 99.32.250.204 4812 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/09 23:50:14.519342 0.069114 tcp 10.0.2.105 52070 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/09 23:50:14.588765 0.076804 tcp 10.0.2.105 52071 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/09 23:50:14.665890 0.152680 tcp 10.0.2.105 52072 -> 195.113.214.234 443 SRPA* 0 0 34 25221 flow=From-Botnet-V2-TCP-Established 1970/01/09 23:50:14.819036 0.185711 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:50:15.005092 0.140817 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:50:15.146276 0.176742 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/09 23:50:55.607264 1.014467 tcp 10.0.2.105 52073 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/09 23:51:03.390513 3.001877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/09 23:51:10.398049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:51:18.399833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:51:34.402803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:52:06.408690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:58:10.414346 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/09 23:58:17.422470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:58:25.423878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:58:41.426963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/09 23:59:13.432558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:05:17.438557 3.002352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:05:24.446469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:05:32.447612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:05:48.450510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:06:20.456634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:12:24.462998 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:12:31.470340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:12:39.471336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:12:55.474470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:13:27.480534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:19:31.486445 3.002208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:19:38.494191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:19:46.496240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:20:02.499188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:20:17.240338 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 00:20:17.240523 0.167070 udp 10.0.2.105 7010 <-> 99.32.250.204 4812 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:17.408068 0.148273 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:17.556744 0.170264 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:17.727425 0.184924 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:17.912756 0.120855 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.033975 0.146611 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.180976 0.071589 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.252909 0.141098 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.394372 0.149332 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.544056 0.172414 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.716887 0.144821 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:18.862128 0.334024 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.196553 0.121506 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.318474 0.082974 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.401838 0.144799 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.547047 0.188132 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.735614 0.116542 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.852697 0.145640 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:19.998724 0.028393 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.027521 0.168520 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.196452 0.190643 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.387498 0.210335 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 589 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.598223 0.157769 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.756468 0.180606 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:20.937619 0.154992 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:21.092992 0.183201 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:21.276606 0.296189 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:21.573191 0.160131 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:21.733686 0.184831 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:21.918892 0.144528 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:22.063784 0.186101 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:20:34.505137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:20:56.626694 1.011297 tcp 10.0.2.105 52074 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:26:38.510805 3.001837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:26:45.517772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:26:53.519723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:27:09.522721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:27:41.528999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:33:45.534771 3.001892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:33:52.542216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:34:00.543448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:34:16.546444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:34:48.552661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:40:52.558491 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:40:59.565731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:41:07.567836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:41:23.570215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:41:55.576625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:47:59.583372 3.021132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 00:48:06.609973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:48:14.611392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:48:30.614227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:49:02.620772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:50:29.756368 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 00:50:29.756469 0.000000 udp 10.0.2.105 7010 -> 99.32.250.204 4812 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 00:50:47.342919 0.068997 tcp 10.0.2.105 52075 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:50:47.412159 0.065380 tcp 10.0.2.105 52076 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:50:47.477795 0.162845 tcp 10.0.2.105 52077 -> 195.113.214.234 443 SRPA* 0 0 33 24739 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:50:47.641156 0.148767 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:47.790322 0.173580 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:47.964308 0.179229 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.143896 0.120166 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.264476 0.150077 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.414961 0.147190 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.562543 0.176907 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.739844 0.131185 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.871438 0.071647 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:48.943553 0.139046 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:50:49.082988 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 00:50:57.646201 0.969145 tcp 10.0.2.105 52078 -> 128.255.183.224 9027 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:51:05.037406 0.074219 tcp 10.0.2.105 52079 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:51:05.111505 0.081919 tcp 10.0.2.105 52080 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:51:05.193307 0.199095 tcp 10.0.2.105 52081 -> 195.113.214.234 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/10 00:51:05.392982 0.066544 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:05.459929 0.096599 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:05.556965 0.143567 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:05.700950 0.191768 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:05.893109 0.287217 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:06.180726 0.143704 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:06.324773 0.048455 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:06.373660 0.218814 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:06.592898 0.312921 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:06.906223 0.178375 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:07.084995 0.154360 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:07.239697 0.170575 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:07.410666 0.192910 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:07.604010 0.185990 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:07.790338 0.228165 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:08.018905 0.162426 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:08.181724 0.185082 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:08.367178 0.205952 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:51:08.573529 0.185049 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/10 00:55:06.627177 3.000878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 00:55:13.633783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:55:21.635464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:55:37.638614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 00:56:09.644321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:02:13.650582 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:02:20.658205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:02:28.659707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:02:44.662688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:03:16.668687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:09:20.674120 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:09:27.681899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:09:35.683346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:09:51.686450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:10:23.692538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:16:27.698413 3.001627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:16:34.706088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:16:42.707339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:16:58.710517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:17:30.716326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:20:58.615539 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 01:20:58.615699 0.993413 tcp 10.0.2.105 52082 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:21:32.694982 0.000000 udp 10.0.2.105 7010 -> 99.32.250.204 4812 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 01:21:37.450808 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 01:21:49.309864 0.073441 tcp 10.0.2.105 52083 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:21:49.383651 0.079682 tcp 10.0.2.105 52084 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:21:49.463639 0.181421 tcp 10.0.2.105 52085 -> 195.113.214.234 443 SRPA* 0 0 24 13200 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:21:49.645538 0.336150 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:49.982091 0.147462 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.129989 0.169435 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.299840 0.183401 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.483637 0.147137 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.631137 0.121298 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.752838 0.165862 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:50.919048 0.130968 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.050433 0.071072 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.121870 0.140477 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.262746 0.150008 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.413130 0.183406 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.596876 0.087527 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.684800 0.140657 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:51.825804 0.189447 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.015658 0.031364 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.047402 0.209161 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.256963 0.155406 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.412765 0.180212 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.593350 0.252505 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.846231 0.147476 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:52.994077 0.153846 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:53.148351 0.172034 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:53.320720 0.190415 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:53.511484 0.181655 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:53.693498 0.225885 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:53.919791 0.144100 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:54.064498 0.187452 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:54.252380 0.160795 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:21:54.413600 0.184056 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:23:34.843363 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 01:23:41.850205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:23:49.851529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:24:05.854281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:24:37.860295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:30:41.866341 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:30:48.874171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:30:56.875453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:31:12.878839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:31:44.884652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:37:48.891181 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:37:55.898074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:38:03.899434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:38:19.902225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:38:51.908360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:44:55.914325 3.001650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:45:02.932105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:45:10.933367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:45:26.936557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:45:58.942710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:50:59.735330 0.000190 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 01:50:59.735629 0.943878 tcp 10.0.2.105 52086 -> 128.255.183.224 9027 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:52:02.948216 3.001983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:52:04.178294 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 01:52:04.178431 0.342277 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:04.521051 0.148401 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:04.669811 0.166524 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:04.836788 0.182276 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.019386 0.146591 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.166310 0.120317 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.287031 0.168854 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.456288 0.137831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.594502 0.083478 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.678348 0.140322 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.819043 0.150177 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:05.969620 0.064631 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:06.034650 0.088005 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:06.122996 0.143425 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:06.266815 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 01:52:09.955887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:52:17.957364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:52:24.038113 0.078589 tcp 10.0.2.105 52087 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:52:24.116962 0.071534 tcp 10.0.2.105 52088 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:52:24.188769 0.185400 tcp 10.0.2.105 52089 -> 195.113.214.234 443 SRPA* 0 0 22 13090 flow=From-Botnet-V2-TCP-Established 1970/01/10 01:52:24.374770 0.036609 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:24.411760 0.228744 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:24.640884 0.829720 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:25.470955 0.143643 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:25.615009 0.155484 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:25.771018 0.156874 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:25.928284 0.183374 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:26.112037 0.170085 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:26.282530 0.189121 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:26.472051 0.177292 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:26.649740 0.230046 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:26.880216 0.142719 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:27.023335 0.182474 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:27.206171 0.161974 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:27.368567 0.183418 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/10 01:52:33.960093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:53:05.966101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:59:09.972576 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 01:59:16.980066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:59:24.981741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 01:59:40.984224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:00:12.990415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:06:16.996129 3.001884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:06:24.004054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:06:32.005632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:06:48.008418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:07:20.014069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:13:24.019796 3.002281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:13:31.027943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:13:39.029051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:13:55.032142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:14:27.038250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:20:31.044572 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:20:38.052112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:20:46.053450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:21:00.685380 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 02:21:00.685469 1.398373 tcp 10.0.2.105 52090 -> 128.255.183.224 9027 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:21:02.056760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:21:34.062699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:22:53.877720 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 02:22:53.877937 0.193302 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:54.071644 0.168459 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:54.240505 0.180948 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:54.421848 0.148881 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:54.571126 0.123823 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:54.695343 0.358017 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.053766 0.148831 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.202985 0.072604 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.275935 0.140819 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.417140 0.150176 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.567694 0.065080 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.633135 0.081815 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.715308 0.145795 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.861462 0.137827 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:55.999655 0.246902 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:56.246944 0.038246 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:56.285573 0.228574 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:56.514506 0.155603 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:56.670512 0.157303 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:56.828203 0.176698 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:22:57.005230 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 02:23:12.775999 0.071303 tcp 10.0.2.105 52091 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:23:12.847602 0.077441 tcp 10.0.2.105 52092 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:23:12.925351 0.169233 tcp 10.0.2.105 52093 -> 195.113.214.234 443 SRPA* 0 0 22 13128 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:23:13.095206 0.132269 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:13.227841 0.176871 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:13.405088 0.192337 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:13.597796 0.182569 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:13.780757 0.268130 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:14.049233 0.143978 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:14.193603 0.178672 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:14.372697 0.162364 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:23:14.535464 0.186073 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:27:38.068993 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:27:45.075943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:27:53.077493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:28:09.080281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:28:41.086484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:34:45.093230 3.000591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:34:52.099806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:35:00.101026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:35:16.104059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:35:48.110014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:41:52.117068 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:41:59.133553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:42:07.134989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:42:23.137976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:42:55.143942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:48:59.151052 3.000488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 02:49:06.157436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:49:14.159457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:49:30.162072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:50:02.167981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:51:02.085268 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 02:51:02.085440 0.913912 tcp 10.0.2.105 52094 -> 128.255.183.224 9027 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:53:41.544442 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 02:53:41.544542 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 02:53:59.230676 0.074796 tcp 10.0.2.105 52095 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:53:59.305763 0.075674 tcp 10.0.2.105 52096 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:53:59.381757 0.197225 tcp 10.0.2.105 52097 -> 195.113.214.234 443 SRPA* 0 0 42 21472 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:53:59.579585 0.192743 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:53:59.772705 0.168238 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:53:59.941298 0.120993 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.062677 0.355361 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.418440 0.146227 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.565069 0.074222 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.639696 0.188881 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.828935 0.147515 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:00.976840 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 02:54:17.806137 0.069390 tcp 10.0.2.105 52098 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:54:17.875819 0.082939 tcp 10.0.2.105 52099 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:54:17.959052 0.171657 tcp 10.0.2.105 52100 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/10 02:54:18.131291 0.065312 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.196974 0.085036 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.282404 0.142657 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.425476 0.144679 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.570570 0.174471 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.745391 0.040555 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.786308 0.140715 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:18.927429 0.180329 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:19.108125 0.218505 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:19.327020 0.154999 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:19.482375 0.171143 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:19.653939 0.374813 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.029157 0.145492 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.175027 0.189140 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.364556 0.184711 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.549663 0.237328 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.787365 0.143217 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:20.930967 0.185837 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:21.117191 0.193459 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:54:21.310983 0.160592 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 02:56:06.174424 3.001543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 02:56:13.181444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:56:21.183215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:56:37.186105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 02:57:09.192606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:03:13.198632 3.001462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:03:20.205699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:03:28.207009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:03:44.209758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:04:16.216899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:10:20.222772 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:10:27.229867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:10:35.230874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:10:51.233974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:11:23.239750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:17:27.246804 3.001132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:17:34.253706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:17:42.254899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:17:58.257864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:18:30.263723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:21:03.004041 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 03:21:03.004141 2.055544 tcp 10.0.2.105 52101 -> 128.255.183.224 9027 FSPA* 0 0 15 1769 flow=From-Botnet-V2-TCP-Established 1970/01/10 03:24:34.270549 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:24:41.277419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:24:48.769044 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 03:24:48.769237 0.367878 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:49.137567 0.363676 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:49.278955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:24:49.519155 0.401036 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:49.920584 0.387338 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:50.308545 0.294660 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:50.603582 0.384829 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:50.988828 0.396588 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:51.385834 0.147750 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:51.533917 0.564117 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:52.098435 0.255564 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:52.354353 0.301779 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:52.656573 0.374127 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:53.031102 0.391131 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:53.422612 0.463124 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:53.886081 0.274336 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:54.160840 0.391276 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:54.552556 0.417238 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:54.970144 0.407619 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:55.378171 0.384575 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:55.763144 0.392417 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:56.155891 0.498442 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:56.654685 0.468610 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:57.123689 0.483497 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:57.607602 0.451728 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:58.059772 0.434528 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:58.494710 0.432857 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:58.927953 0.376138 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:59.304518 0.406954 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:24:59.711892 0.399699 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:25:05.282065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:25:37.288022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:31:41.294488 3.000859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:31:48.301318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:31:56.303167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:32:12.306065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:32:44.311786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:38:48.319101 3.000517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:38:55.325778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:39:03.327026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:39:19.330158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:39:51.335682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:45:55.342176 3.001471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:46:02.349392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:46:10.350632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:46:26.354058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:46:58.360149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:51:05.065215 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 03:51:05.065393 2.906750 tcp 10.0.2.105 52102 -> 128.255.183.224 9027 FSPA* 0 0 12 1540 flow=From-Botnet-V2-TCP-Established 1970/01/10 03:53:02.366339 3.000897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 03:53:09.373486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:53:17.374889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:53:33.378228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:54:05.384235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 03:55:26.200807 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 03:55:26.200915 0.581458 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:26.782769 0.540744 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:27.323934 0.624161 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:27.948510 0.607419 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:28.556265 0.594141 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:29.150861 0.620756 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:29.772026 0.679308 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:30.451675 0.767735 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:31.219796 0.966573 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:32.186721 0.696718 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:32.883817 0.725949 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:33.610182 0.700005 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:34.310586 0.828602 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:35.139594 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 03:55:53.671580 1.418371 tcp 10.0.2.105 52103 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 03:55:55.090244 1.065369 tcp 10.0.2.105 52104 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 03:55:56.155931 2.484712 tcp 10.0.2.105 52105 -> 195.113.214.234 443 SRPA* 0 0 34 24795 flow=From-Botnet-V2-TCP-Established 1970/01/10 03:55:58.641137 0.518427 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:59.159982 0.633351 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:55:59.793756 0.781497 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:00.575686 0.780289 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:01.356425 0.667592 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:02.024413 0.779428 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:02.804217 0.806487 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:03.611099 0.769362 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:04.380888 0.779654 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:05.160940 0.837611 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:05.998992 0.947847 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:06.947189 0.676526 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:07.624101 0.842342 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:08.466869 0.739518 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/10 03:56:09.206803 0.898464 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:00:09.390525 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 04:00:16.397784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:00:24.398903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:00:40.402086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:01:12.408211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:07:16.414510 3.001070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:07:23.421087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:07:31.423086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:07:47.425988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:08:19.431668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:14:23.438602 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:14:30.445236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:14:38.446530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:14:54.450028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:15:26.455602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:21:07.977816 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:21:07.977987 2.898890 tcp 10.0.2.105 52106 -> 128.255.183.224 9027 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/01/10 04:21:30.462310 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:21:37.469446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:21:45.470890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:22:01.473835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:22:33.479806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:26:17.071542 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:26:17.071648 0.745529 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:17.817537 0.831260 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:18.649208 0.875022 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:19.524662 0.755367 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:20.280470 0.726294 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:21.007120 0.749763 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:21.757306 0.675199 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:22.432963 0.666387 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:23.099831 0.751458 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:23.851705 0.932289 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:24.784572 0.431048 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:25.216027 0.562688 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:25.779169 0.589855 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:26.369360 0.684528 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:27.054219 0.563522 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:27.618125 0.682345 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:28.300820 0.710296 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:29.011464 0.695360 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:29.707283 0.748536 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:30.456181 1.029408 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:31.485940 0.750253 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:32.236768 0.677371 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:32.914526 0.692046 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:33.606940 0.772161 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:34.379437 0.677650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:35.057457 0.680486 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:35.738344 0.714173 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:36.452937 0.767921 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:37.221246 0.748752 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:26:41.445864 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:28:37.485600 3.002048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:28:44.492838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:28:52.494791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:29:08.497334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:29:40.503379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:35:44.509690 3.001891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:35:51.517110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:35:59.518312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:36:15.521645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:36:47.527629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:42:51.533377 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:42:58.540984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:43:06.542539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:43:22.545506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:43:54.551898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:49:58.558194 3.011111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 04:50:05.575117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:50:13.576534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:50:29.579306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:51:01.585473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:51:10.879324 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:51:10.879531 2.785927 tcp 10.0.2.105 52107 -> 128.255.183.224 9027 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/10 04:56:38.680630 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:56:38.680728 0.881996 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:39.563152 0.775536 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:40.339072 0.818568 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:41.158126 0.685695 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:41.844210 0.823668 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:42.668264 0.828712 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:43.497327 0.695606 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:44.193338 0.733553 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:44.927283 0.763842 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:45.691541 0.923311 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:46.615245 0.737242 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:47.352991 0.747426 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:48.100757 0.661531 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:48.762717 0.678939 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:49.442031 0.683722 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:50.126121 0.820589 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:50.947058 0.905894 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:51.853350 0.683078 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:52.536816 0.854338 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:53.391554 0.902661 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:54.294637 0.933175 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:55.228358 0.784135 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:56.012837 0.752965 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:56.766218 0.939109 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:57.705667 0.844304 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:58.550331 0.821262 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:56:59.371990 0.865885 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:57:00.238226 0.872192 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:57:01.110816 0.888521 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/10 04:57:02.444773 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 04:57:05.591690 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 04:57:12.599301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:57:20.600472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:57:36.603232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 04:58:08.609961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:04:12.615489 3.002447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:04:19.622741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:04:27.624476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:04:43.627281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:05:15.633646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:11:19.639860 3.001220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:11:26.646856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:11:34.648741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:11:50.651658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:12:22.657319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:18:26.663957 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:18:33.671163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:18:41.672947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:18:57.675106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:19:29.681865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:21:13.671727 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 05:21:13.671934 1.588303 tcp 10.0.2.105 52108 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/10 05:25:33.687918 3.001678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:25:40.694965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:25:48.696062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:26:04.699557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:26:36.705116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:27:22.151573 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 05:27:22.151672 0.387901 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:22.539983 0.489801 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:23.030210 0.525923 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:23.556545 0.465552 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:24.022486 0.559569 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:24.582433 0.503123 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:25.085936 0.372090 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:25.458414 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 05:27:41.199873 0.609896 tcp 10.0.2.105 52109 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 05:27:41.810066 0.693469 tcp 10.0.2.105 52110 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 05:27:42.503865 1.779085 tcp 10.0.2.105 52111 -> 195.113.214.234 443 SRPA* 0 0 38 26025 flow=From-Botnet-V2-TCP-Established 1970/01/10 05:27:44.283473 0.518783 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:44.802690 0.711698 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:45.514832 0.440082 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:45.955355 0.473208 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:46.428962 0.462875 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:46.892242 0.401773 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:47.294432 0.365307 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:47.660150 0.461465 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:48.122020 0.533975 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:48.656407 0.296714 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:48.953570 0.463559 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:49.417495 0.598257 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:50.016108 0.446325 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:50.462844 0.418101 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:50.881350 0.441731 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:51.323444 0.434476 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:51.758253 0.512275 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:52.270878 0.403948 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:52.675161 0.410154 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:53.085685 0.316628 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:27:53.402645 0.350552 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:32:40.711836 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 05:32:47.719110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:32:55.720132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:33:11.723284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:33:43.729213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:39:47.735074 3.002379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:39:54.743227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:40:02.744334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:40:18.747515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:40:50.753750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:46:54.759918 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:47:01.766450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:47:09.768061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:47:25.771507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:47:57.777407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:51:15.261881 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 05:51:15.262029 2.923203 tcp 10.0.2.105 52112 -> 128.255.183.224 9027 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/10 05:54:01.783238 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 05:54:08.790776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:54:16.791964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:54:32.795527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:55:04.801323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 05:58:19.711821 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 05:58:19.711926 0.515084 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:20.227459 0.492286 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:20.720136 0.480739 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:21.201309 0.501443 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:21.703178 0.543031 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:22.246634 0.483265 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:22.730308 0.499587 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:23.230293 0.424298 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:23.654928 0.374410 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:24.029740 0.732393 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:24.762550 0.398306 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:25.161225 0.507054 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:25.668623 0.397405 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:26.066437 0.364924 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:26.431701 0.282545 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:26.714655 0.437750 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:27.152831 1.308376 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:28.461609 0.500454 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:28.962474 0.518226 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:29.481119 0.596341 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:30.077860 0.474531 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:30.552746 0.423083 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:30.976385 0.523816 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:31.500601 0.533236 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:32.034260 0.501278 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:32.535954 0.437751 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:32.974129 0.486931 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:33.461468 0.541260 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/10 05:58:34.003117 0.486547 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:01:08.808002 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:01:15.814730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:01:23.816091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:01:39.819164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:02:11.825599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:08:15.831305 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:08:22.838841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:08:30.840342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:08:46.843209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:09:18.849086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:15:22.855947 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:15:29.862567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:15:37.864640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:15:53.867425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:16:25.873402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:21:18.194356 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 06:21:18.194498 1.951880 tcp 10.0.2.105 52113 -> 128.255.183.224 9027 FSPA* 0 0 15 1660 flow=From-Botnet-V2-TCP-Established 1970/01/10 06:22:29.878723 3.001800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:22:36.886783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:22:44.888256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:23:00.890774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:23:32.897011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:28:54.930780 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 06:28:54.930967 0.422367 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:55.353751 0.497231 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:55.884019 0.455296 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:56.339719 0.435301 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:56.775462 0.419796 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:57.195654 0.494031 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:57.690056 0.479614 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:58.170010 0.432353 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:58.602734 0.417172 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:59.020478 0.718128 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:28:59.739010 0.427630 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:00.167011 0.521617 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:00.689047 0.414636 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:01.104085 0.359509 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:01.463955 0.267546 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:01.731901 0.502814 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:02.235086 0.505570 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:02.741008 0.475085 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:03.216483 0.494832 udp 10.0.2.105 7010 <-> 50.90.85.129 3482 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:03.711695 0.719904 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:04.432001 0.453597 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:04.886016 0.420058 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:05.306441 0.572944 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:05.879782 0.526449 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:06.406586 0.501724 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:06.908642 0.417694 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:07.326698 0.542143 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:07.869260 0.499569 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:08.369255 0.512022 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:29:36.902403 3.002587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:29:43.910282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:29:51.912006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:30:07.914767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:30:39.921407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:36:43.927977 3.000607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:36:50.934416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:36:58.936514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:37:14.938777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:37:46.945415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:43:50.951399 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:43:57.958498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:44:05.960005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:44:21.962904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:44:53.969433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:50:57.975317 3.001617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:51:04.982790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:51:12.984022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:51:20.154925 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 06:51:20.155026 1.946590 tcp 10.0.2.105 52114 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/10 06:51:28.986904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:52:00.992956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:58:04.999660 3.000865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 06:58:12.006331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:58:20.007946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:58:36.010825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:59:08.016772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 06:59:19.544084 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 06:59:19.544204 0.484870 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:20.029461 0.511836 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:20.541710 0.518597 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:21.060682 0.443751 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:21.504769 0.466833 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:21.971996 0.617235 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:22.589601 0.409115 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:22.999136 0.390635 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:23.390120 0.413580 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:23.804100 0.695774 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:24.500433 0.450751 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:24.951574 0.470285 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:25.422211 0.425671 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:25.848297 0.362060 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:26.210695 0.408369 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:26.619446 0.455306 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:27.075192 0.523141 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:27.598727 0.451712 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/10 06:59:28.050806 0.000000 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 06:59:45.782616 0.603604 tcp 10.0.2.105 52115 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 06:59:46.386552 0.628254 tcp 10.0.2.105 52116 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 06:59:47.015075 1.720686 tcp 10.0.2.105 52117 -> 195.113.214.234 443 SRPA* 0 0 33 24741 flow=From-Botnet-V2-TCP-Established 1970/01/10 06:59:48.736430 0.000000 udp 10.0.2.105 7010 -> 82.48.199.167 3797 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 07:00:06.692109 0.806221 tcp 10.0.2.105 52118 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:00:07.498634 0.637679 tcp 10.0.2.105 52119 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:00:08.136301 1.260640 tcp 10.0.2.105 52120 -> 195.113.214.234 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:00:09.397433 0.422332 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:09.820084 0.434942 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:10.255413 0.516127 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:10.771926 0.505703 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:11.278046 0.543582 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:11.821968 0.438993 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:12.261346 0.433135 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:12.694872 0.524071 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:00:13.219311 0.494070 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:05:12.023239 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 07:05:19.030264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:05:27.031814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:05:43.035127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:06:15.040836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:12:19.047090 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:12:26.054101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:12:34.055612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:12:50.059069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:13:22.065102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:19:26.070466 3.002164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:19:33.078088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:19:41.079879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:19:57.082672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:20:29.088570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:21:22.105459 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 07:21:22.105556 1.135332 tcp 10.0.2.105 52121 -> 128.255.183.224 9027 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:26:33.094757 3.002110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:26:40.102155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:26:48.103984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:27:04.106764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:27:36.112761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:30:41.620430 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 07:30:41.620523 1.416234 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 07:30:43.036757 0.000000 icmp 50.90.85.129 0x0303 -> 10.0.2.105 0x9a0d URP 192 1 208 flow=Background 1970/01/10 07:30:57.654553 0.096856 tcp 10.0.2.105 52122 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:30:57.751660 0.075923 tcp 10.0.2.105 52123 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:30:57.827894 0.168919 tcp 10.0.2.105 52124 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:30:57.997378 0.424564 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:58.422341 0.146004 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:58.568714 0.172205 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:58.741314 0.189038 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:58.930757 0.121356 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.052528 0.148834 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.201710 0.168396 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.370458 0.185877 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.556731 0.149324 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.706471 0.071544 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:30:59.778379 0.349707 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.128523 0.144423 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.273327 0.081910 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.355632 0.130814 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.486848 0.060910 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.548159 0.045780 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.594362 0.140318 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.735074 0.209193 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:00.944677 0.179733 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:01.124808 0.210530 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:01.335664 0.155090 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:01.491127 0.190030 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:01.681554 0.179734 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:01.861678 0.345799 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:02.207837 0.140640 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:02.348818 0.189308 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:02.538553 0.192638 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:31:02.731598 0.180797 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/10 07:33:40.119125 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:33:47.126217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:33:55.127571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:34:11.130821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:34:43.136686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:40:47.142941 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:40:54.150320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:41:02.151627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:41:18.155382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:41:50.160932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:47:54.166497 3.001982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:48:01.174401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:48:09.175964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:48:25.179050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:48:57.184728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:51:23.245813 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 07:51:23.246038 0.985761 tcp 10.0.2.105 52125 -> 128.255.183.224 9027 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/01/10 07:55:01.191152 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 07:55:08.197935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:55:16.199898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:55:32.202751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 07:56:04.209043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:01:22.847192 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 08:01:22.847290 0.178484 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.026177 0.189276 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.215804 0.121787 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.338000 0.150672 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.489067 0.230445 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.719915 0.160653 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:23.880963 0.168401 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.049785 0.183244 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.233424 0.147694 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.381483 0.070472 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.452307 0.344451 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.797177 0.141231 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:24.938763 0.088474 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.027646 0.151619 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.179660 0.065319 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.245319 0.029421 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.275112 0.140811 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.416325 0.143788 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.560522 0.176719 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.737650 0.220042 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:25.958088 0.156034 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:26.114510 0.189171 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:26.304035 0.197712 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:26.502161 0.291595 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:26.794133 0.195284 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:26.989790 0.183678 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:27.173815 0.139802 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:01:27.313988 0.205485 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:02:08.215761 3.000733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:02:15.221888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:02:23.223449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:02:39.226615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:03:11.232564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:09:15.238564 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:09:22.245953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:09:30.247443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:09:46.250284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:10:18.256759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:16:22.352321 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:16:29.359924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:16:37.362077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:16:53.364878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:17:25.440904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:21:24.304849 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 08:21:24.305030 0.924202 tcp 10.0.2.105 52126 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/10 08:23:29.446261 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:23:36.454136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:23:44.456005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:24:00.458864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:24:32.464749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:30:36.470761 3.001989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:30:43.478186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:30:51.479394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:31:07.482998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:31:35.042790 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 08:31:35.042879 0.168751 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:35.212138 0.191776 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:35.404430 0.495982 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:35.900800 0.150929 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.068091 0.169624 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.238099 0.191854 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.430391 0.120831 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.551629 0.154043 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.706085 0.148203 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.854710 0.071279 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:36.926323 0.336683 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.263414 0.142099 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.405866 0.089487 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.495687 0.144913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.641030 0.059901 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.701327 0.041755 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.743426 0.180546 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:37.924537 0.219873 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.144784 0.153752 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.298933 0.140997 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.440482 0.158074 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.598941 0.189882 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.789222 0.180504 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:38.970161 0.320602 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:39.291199 0.184711 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:39.476280 0.178992 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:39.488886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:31:39.655677 0.142510 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:31:39.798617 0.181850 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/10 08:37:43.495129 3.071603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:37:50.572128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:37:58.573867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:38:14.576630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:38:46.582892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:44:50.588770 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:44:57.596535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:45:05.597455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:45:21.600597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:45:53.606631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:51:25.254198 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 08:51:25.254304 0.955793 tcp 10.0.2.105 52127 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/10 08:51:57.613222 3.001046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:52:04.619937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:52:12.621519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:52:28.624717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:53:00.630615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:59:04.637590 3.000734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 08:59:11.643881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:59:19.645839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 08:59:35.648644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:00:07.654646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:01:43.443106 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 09:01:43.443192 0.171417 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:43.615003 0.291534 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:43.906933 0.168171 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:44.075473 0.188548 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:44.264403 0.338824 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:44.603636 0.177754 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:44.781757 0.121518 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:44.903677 0.151437 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.055450 0.149684 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.205533 0.084286 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.290150 0.334561 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.625102 0.141380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.766876 0.090553 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:45.857848 0.144742 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:46.002986 0.077556 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:46.080939 0.033208 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:46.114475 0.463637 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:46.578500 0.419153 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:46.998061 0.155802 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:47.154270 0.140406 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:47.295127 0.149295 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:47.444772 0.194107 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:47.639276 0.238577 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:47.878225 0.309863 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:48.188468 0.220199 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:48.409055 0.254174 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:48.663576 0.184326 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:01:48.848309 0.184814 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:06:11.660725 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:06:18.667954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:06:26.669716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:06:42.672667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:07:14.679054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:13:18.684295 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:13:25.692133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:13:33.693396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:13:49.696496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:14:21.703359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:20:25.709903 3.000400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:20:32.715892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:20:40.717437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:20:56.720652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:21:26.213769 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 09:21:26.213984 0.899417 tcp 10.0.2.105 52128 -> 128.255.183.224 9027 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/10 09:21:28.726604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:27:32.732496 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:27:39.740273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:27:47.741900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:28:03.744313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:28:35.750856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:31:54.776961 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 09:31:54.777152 0.172619 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:54.950186 0.195971 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:55.146498 0.170360 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:55.317188 0.148535 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:55.466137 0.381767 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:55.848301 0.181964 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.030630 0.124231 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.155269 0.151426 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.307083 0.146380 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.453809 0.125782 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.579994 0.334121 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:56.914483 0.139984 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.054859 0.085181 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.140478 0.130885 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.271723 0.071570 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.343661 0.027541 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.371587 0.155427 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.527411 0.140061 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.667823 0.177647 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:57.845815 0.219754 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:58.065963 0.146462 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:58.212790 0.192431 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:58.405637 0.181149 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:58.587124 0.428560 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:59.016082 0.185227 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:59.201648 0.186644 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:59.388743 0.141925 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:31:59.531106 0.161671 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 09:34:39.756855 3.001427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:34:46.763976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:34:54.765405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:35:10.768496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:35:42.774411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:41:46.780829 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:41:53.788049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:42:01.789491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:42:17.792203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:42:49.798823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:48:53.805481 3.010404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:49:00.821742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:49:08.823535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:49:24.826168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:49:56.832543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:51:27.113167 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 09:51:27.113268 0.972752 tcp 10.0.2.105 52129 -> 128.255.183.224 9027 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/01/10 09:56:00.838337 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 09:56:07.845832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:56:15.847448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:56:31.850499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 09:57:03.856996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:02:12.570724 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 10:02:12.570916 0.179596 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:12.750906 0.169335 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:12.920709 0.187808 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:13.108913 0.174281 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:13.283541 0.119993 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:13.403970 0.195516 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:13.599920 0.145870 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:13.746179 0.391917 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.138525 0.147793 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.286684 0.071103 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.358180 0.336505 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.695073 0.146629 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.842086 0.104080 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:14.946567 0.151656 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.098560 0.061156 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.160116 0.026760 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.187251 0.178935 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.366587 0.220659 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.587592 0.147234 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.735186 0.154083 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:15.889627 0.139600 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:16.029565 0.189559 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:16.219513 0.179644 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:16.399571 0.317821 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:16.717741 0.184968 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:16.903095 0.162996 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:17.066434 0.180982 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:02:17.247828 0.144362 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:03:07.862294 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:03:14.869978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:03:22.871715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:03:38.874119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:04:10.880218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:10:14.886675 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:10:21.893666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:10:29.895232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:10:45.898103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:11:17.904132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:17:21.910012 3.002085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:17:28.918057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:17:36.919481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:17:52.922139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:18:24.928735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:21:28.092739 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 10:21:28.092955 0.980568 tcp 10.0.2.105 52130 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/10 10:24:28.934521 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:24:35.941893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:24:43.943552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:24:59.946103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:25:31.952345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:31:35.958291 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:31:42.965985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:31:51.057805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:32:07.060489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:32:39.066360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:32:41.910781 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 10:32:41.910953 0.188780 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.100129 0.196055 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.296585 0.163258 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.460437 0.167966 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.628788 0.121979 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.751139 0.150103 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:42.901645 0.148357 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:43.050423 0.182260 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:43.233074 0.147907 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:43.381372 0.082230 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:43.464005 0.477168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:43.941574 0.273071 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.214993 0.176588 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.391967 0.124080 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.516385 0.061121 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.577885 0.039306 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.617535 0.179196 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.797119 0.155403 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:44.952949 0.140868 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:45.094221 0.190616 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:45.285241 0.237381 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:45.522987 0.152045 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:45.675390 0.339135 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:46.014935 0.321422 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:46.336687 0.219386 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:46.556423 0.179425 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:46.736251 0.189350 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:32:46.925946 0.134864 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/10 10:38:43.072137 3.021654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:38:50.099964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:38:58.101746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:39:14.104422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:39:46.110140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:45:50.116906 3.011133 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:45:57.134088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:46:05.135326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:46:21.138351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:46:53.144240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:51:29.121950 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 10:51:29.122103 0.952437 tcp 10.0.2.105 52131 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/10 10:52:57.150209 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 10:53:04.157693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:53:12.159096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:53:28.162296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 10:54:00.168257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:00:04.174298 3.001877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:00:11.181871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:00:19.183305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:00:35.186299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:01:07.191987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:03:14.706495 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 11:03:14.706596 0.189212 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:14.896358 0.172471 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.069213 0.219149 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.288771 0.168013 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.457154 0.132552 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.590106 0.151392 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.741908 0.149954 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.892442 0.071382 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:15.964177 0.374271 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:16.338826 0.146999 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:16.486229 0.513871 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.000482 0.147751 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.148644 0.085072 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.234119 0.137923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.372475 0.064959 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.437809 0.045353 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.483537 0.176904 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.660836 0.155342 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.816542 0.140333 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:17.957265 0.145451 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:18.103108 0.185420 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:18.288951 0.194424 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:18.483779 0.229403 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:18.713514 0.319629 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:19.033588 0.186227 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:19.220158 0.161740 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:19.382288 0.180857 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:03:19.563583 0.142440 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:07:11.198040 3.002156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:07:18.205855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:07:26.207543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:07:42.210291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:08:14.216224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:14:18.222515 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:14:25.229796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:14:33.231254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:14:49.234461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:15:21.240342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:21:25.246871 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:21:30.080929 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 11:21:30.081022 1.005293 tcp 10.0.2.105 52132 -> 128.255.183.224 9027 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/01/10 11:21:32.253551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:21:40.254841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:21:56.258169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:22:28.264768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:28:32.271023 3.000868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:28:39.277610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:28:47.278912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:29:03.281967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:29:35.288511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:33:22.645635 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 11:33:22.645826 0.182825 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:22.829087 0.196062 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.025565 0.195188 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.221102 0.168439 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.389945 0.131506 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.521814 0.150233 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.672410 0.148973 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.821768 0.119364 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:23.941498 0.156582 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.098496 0.145462 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.244548 0.087847 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.332810 0.338091 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.671300 0.142648 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.814286 0.131079 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:24.945773 0.061905 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.008096 0.031367 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.039819 0.180758 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.221007 0.156370 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.377780 0.140883 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.519128 0.145428 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.664942 0.183361 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:25.848646 0.312205 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:26.161261 0.186802 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:26.348426 0.189933 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:26.538769 0.228891 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:26.768053 0.142665 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:26.911374 0.161509 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:33:27.073210 0.180208 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 11:35:39.294659 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:35:46.301613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:35:54.303360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:36:10.306141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:36:42.311995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:42:46.377671 3.002281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:42:53.385598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:43:01.387107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:43:17.389926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:43:49.396088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:49:53.403118 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:50:00.409290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:50:08.410790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:50:24.414022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:50:56.420182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:51:31.150513 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 11:51:31.150612 0.893943 tcp 10.0.2.105 52133 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/10 11:57:00.426725 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 11:57:07.434051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:57:15.435407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:57:31.437887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 11:58:03.443838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:03:37.544697 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 12:03:37.544819 0.185289 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:37.730514 0.190301 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:37.921222 0.188327 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.109943 0.169206 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.279539 0.121758 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.401676 0.149031 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.551026 0.148364 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.699758 0.083091 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:38.783270 0.220167 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.003833 0.147487 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.151704 0.085541 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.237600 0.336438 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.574425 0.144017 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.718788 0.130965 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.850115 0.072914 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.923401 0.052069 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:39.975866 0.178172 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:40.154405 0.145655 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:40.300677 0.196806 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:40.497939 0.317387 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:40.815706 0.155189 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:40.971257 0.140447 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:41.112052 0.184617 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:41.297043 0.189984 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:41.487424 0.219833 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:41.707652 0.137852 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:41.845909 0.161695 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:03:42.007922 0.183711 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:04:07.450096 3.001885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:04:14.457233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:04:22.459437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:04:38.461754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:05:10.468590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:11:14.474354 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:11:21.481332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:11:29.483228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:11:45.485825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:12:17.491960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:18:21.498354 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:18:28.505589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:18:36.507291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:18:52.510011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:19:24.515772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:21:32.049757 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 12:21:32.049857 0.918733 tcp 10.0.2.105 52134 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/10 12:25:28.521948 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:25:35.529399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:25:43.531183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:25:59.533811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:26:31.539801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:32:35.546101 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:32:42.553270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:32:50.554601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:33:06.557986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:33:38.563729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:33:43.621797 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 12:33:43.621883 0.188188 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:43.810509 0.169088 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:43.979998 0.182462 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.162884 0.178373 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.341612 0.120151 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.462180 0.155235 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.632657 0.151312 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.784346 0.071848 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:44.856552 0.364474 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:45.221424 0.144878 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:45.366657 0.087111 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:45.454188 0.335925 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:45.790518 0.144270 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:45.935182 0.123882 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:46.059419 0.060066 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:46.119856 0.037836 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:46.158074 0.705255 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:46.863730 0.148059 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:47.012190 0.155255 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:47.168009 0.209358 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:47.377774 0.183693 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:47.561888 0.369372 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:47.931630 0.313073 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:48.245082 0.189900 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:48.435322 0.229131 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:48.664860 0.141856 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:48.807128 0.162083 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:33:48.969601 0.187529 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 12:39:42.569933 3.011834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:39:49.587436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:39:57.588569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:40:13.592230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:40:45.598323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:46:49.604660 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:46:56.611179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:47:04.613168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:47:20.615941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:47:52.622192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:51:32.969734 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 12:51:32.969811 0.930809 tcp 10.0.2.105 52135 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/10 12:53:56.627419 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 12:54:03.635009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:54:11.636622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:54:27.640136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 12:54:59.645953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:01:03.651918 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:01:10.659559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:01:18.660921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:01:34.664204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:02:06.669818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:03:57.649996 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 13:03:57.650091 0.184104 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:03:57.834558 0.215025 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:03:58.049989 0.192560 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:03:58.242880 0.168652 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:03:58.411873 0.119980 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:03:58.532255 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 13:04:15.236598 0.070263 tcp 10.0.2.105 52136 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:04:15.307135 0.075761 tcp 10.0.2.105 52137 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:04:15.383271 0.149920 tcp 10.0.2.105 52138 -> 195.113.214.234 443 SRPA* 0 0 37 26805 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:04:15.533723 0.155309 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:15.689421 0.079230 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:15.769068 0.408440 udp 10.0.2.105 7010 <-> 82.48.199.167 3797 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:16.177837 0.143953 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:16.322189 0.105190 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:16.427823 0.334660 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:16.762826 0.145144 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:16.908387 0.151770 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.060569 0.060930 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.121921 0.044086 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.166376 0.155300 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.322068 0.141885 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.464562 0.178168 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.643228 0.143820 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.643652 2.998491 tcp 10.0.2.105 52139 -> 75.53.126.156 4241 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/10 13:04:17.787433 0.185308 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:17.973133 0.419481 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:18.392980 0.337759 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:18.731165 0.142877 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:18.874437 0.161693 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:19.036681 0.184811 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:19.221854 0.189033 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:19.411268 0.228214 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:04:26.641263 0.000000 tcp 10.0.2.105 52139 -> 75.53.126.156 4241 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/10 13:08:10.675657 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:08:17.683524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:08:25.684918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:08:41.687705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:09:13.694135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:15:17.699598 3.001928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:15:24.707368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:15:32.708507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:15:48.711613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:16:20.717703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:21:33.908919 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 13:21:33.909148 0.981039 tcp 10.0.2.105 52140 -> 128.255.183.224 9027 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:22:24.723836 3.001486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:22:31.731153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:22:39.732626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:22:55.735693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:23:27.741898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:29:31.747274 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:29:38.755225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:29:46.756990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:30:02.760126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:30:34.765708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:34:24.345942 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 13:34:24.346042 4.330629 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:28.677198 0.188768 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:28.677673 4.490566 tcp 10.0.2.105 52141 -> 71.10.54.162 3760 SPA_* 0 0 10 2891 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:34:28.866263 0.183811 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:29.050473 0.249568 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:29.300475 0.168336 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:29.469231 0.122124 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:29.591749 0.000000 udp 10.0.2.105 7010 -> 82.48.199.167 3797 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 13:34:37.178220 4.532740 tcp 10.0.2.105 52141 -> 71.10.54.162 3760 A_PA 0 0 10 5728 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:34:46.619370 0.075159 tcp 10.0.2.105 52142 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:34:46.694814 0.073860 tcp 10.0.2.105 52143 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:34:46.768930 0.144224 tcp 10.0.2.105 52144 -> 195.113.214.234 443 SRPA* 0 0 33 23869 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:34:46.913719 0.146030 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.060103 0.147351 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.207832 0.070322 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.278499 0.085415 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.364259 0.357168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.721749 0.144111 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:47.866211 0.137914 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.004671 0.078116 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.083219 0.034842 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.118463 0.155357 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.274209 0.142320 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.416863 0.186076 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.603342 0.149560 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.753295 0.181492 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:48.935149 0.183272 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:49.118814 0.219300 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:49.338488 0.138741 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:49.477613 0.161070 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:49.639071 0.180832 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:49.820334 0.193430 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:50.014098 0.208789 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/10 13:34:50.136563 0.206331 tcp 10.0.2.105 52141 -> 71.10.54.162 3760 A_PA 0 0 2 1064 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:35:20.135692 0.000258 tcp 10.0.2.105 52141 -> 71.10.54.162 3760 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:35:31.610062 0.000143 tcp 10.0.2.105 52141 -> 71.10.54.162 3760 RA_A 0 0 2 1528 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:36:38.771671 3.002092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 13:36:45.779452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:36:53.780788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:37:09.783815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:37:41.789920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:43:45.796086 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:43:52.803952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:44:00.805282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:44:16.807691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:44:48.813739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:50:52.818950 3.002083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:50:59.827250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:51:07.828394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:51:23.831231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:51:34.898363 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 13:51:34.898455 0.890124 tcp 10.0.2.105 52145 -> 128.255.183.224 9027 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/10 13:51:55.837722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:57:59.844187 3.000744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 13:58:06.851121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:58:14.852304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:58:30.855581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 13:59:02.861726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:05:02.559346 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:05:02.559469 0.000000 udp 10.0.2.105 7010 -> 82.48.199.167 3797 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 14:05:06.866887 3.002801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:05:13.874639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:05:18.843874 0.073982 tcp 10.0.2.105 52146 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:18.917695 0.074025 tcp 10.0.2.105 52147 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:18.992029 0.133919 tcp 10.0.2.105 52148 -> 195.113.214.234 443 SRPA* 0 0 33 23891 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:19.126686 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 14:05:21.876162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:05:36.417810 0.072559 tcp 10.0.2.105 52149 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:36.490668 0.069073 tcp 10.0.2.105 52150 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:36.560037 0.158870 tcp 10.0.2.105 52151 -> 195.113.214.234 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:36.719355 0.192761 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:36.912558 4.508273 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:37.879230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:05:41.421332 0.182620 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:41.421746 4.789584 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 SPA_* 0 0 10 2784 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:05:41.604367 0.120265 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:41.725142 0.172951 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:41.898530 0.070753 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:41.969623 0.090904 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.060874 0.142365 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.203601 0.150708 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.354724 0.335441 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.690568 0.159231 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.850238 0.131431 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:42.982092 0.068015 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.051056 0.036814 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.088236 0.154505 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.243179 0.142631 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.386237 0.184293 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.570931 0.141629 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.712989 0.177227 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:43.890615 0.347904 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:44.238951 0.231075 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:44.470432 0.189578 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:44.660437 0.189935 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:44.850753 0.210582 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:45.061764 0.154848 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:45.217025 0.162800 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:05:50.406124 4.167619 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1676 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:06:05.332463 0.196615 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 696 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:06:09.885677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:06:10.125581 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:06:35.057669 4.841152 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 6630 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:06:40.129232 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:06:52.775394 0.192351 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 216 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:07:08.845416 4.701574 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 6170 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:07:13.627320 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:07:25.754907 0.210143 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 568 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:07:40.417120 4.555523 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 7320 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:07:45.132714 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:07:49.336905 4.718229 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:02.289332 0.198101 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 1272 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:10.649290 0.400102 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:15.626212 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:08:21.951052 4.690730 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 7586 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:36.798838 4.574787 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 7532 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:41.633902 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:08:45.536734 4.649302 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:08:58.978471 0.200569 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 812 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:12.398674 4.495558 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:17.134923 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:09:21.120489 0.200606 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:30.100488 4.649771 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 13 9494 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:43.388559 4.530478 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 5430 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:52.130559 0.404985 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:09:57.132105 0.000337 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:10:05.283324 0.200719 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:10:23.685827 0.204893 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 5 4262 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:10:28.627419 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:10:32.866069 0.408443 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:10:41.933917 4.959823 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 7442 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:10:50.989637 0.400497 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:10:56.127339 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:11:05.019795 4.846644 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:11:19.122573 0.198052 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:11:24.127546 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:11:37.357330 0.199579 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 1308 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:11:46.999864 4.677541 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 6356 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:11:52.127533 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:11:55.761437 4.868424 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:09.792705 4.777032 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:13.892548 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 14:12:18.545057 0.400761 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:19.126373 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:12:20.898834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:12:27.407105 4.717594 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 11 7770 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:28.900564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:12:36.089011 0.402619 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:45.073961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:12:45.180775 4.459729 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:54.172831 4.931178 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:12:59.214126 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:13:08.194712 0.192402 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 2 812 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:13:16.962114 0.198547 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 9 8078 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:13:17.080014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:13:37.942323 4.694585 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 10 6356 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:13:42.706192 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:13:46.678846 4.719983 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:13:55.266955 4.674299 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 15 12330 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:14:08.358292 4.541911 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:14:13.210184 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:14:42.703140 0.000319 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:14:56.091906 0.000148 tcp 10.0.2.105 52152 -> 71.10.54.162 3760 RA_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:19:21.086092 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 14:19:28.093063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:19:36.094587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:19:52.097776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:20:24.103712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:21:35.867202 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:21:35.867411 0.913607 tcp 10.0.2.105 52153 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:26:28.109242 3.002109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:26:35.117166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:26:43.118637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:26:59.121802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:27:31.127872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:33:35.134422 3.000589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:33:42.140926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:33:50.142910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:34:06.145797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:34:38.151695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:35:46.400598 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:35:46.400701 0.175210 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:46.576554 0.199727 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:46.576936 4.973029 tcp 10.0.2.105 52154 -> 115.111.246.54 7006 SPA_* 0 0 396 222278 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:35:46.776745 4.256761 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.033913 0.179530 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.213847 0.120809 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.335018 0.169813 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.505135 0.084499 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.590051 0.087264 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.677810 0.145260 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.680178 4.950475 tcp 10.0.2.105 52154 -> 115.111.246.54 7006 A_PA 0 0 444 251304 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:35:51.823410 0.151942 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:51.975710 0.334725 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.310800 0.143775 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.454935 0.138161 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.593463 0.087624 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.681463 0.032440 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.714300 0.154731 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:52.869391 0.192250 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.062089 0.176892 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.239332 0.179372 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.419088 0.185009 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.604470 0.140151 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.744971 0.208948 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:53.954313 0.186417 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:54.141183 0.189474 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:54.331146 0.227279 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:54.558800 0.136003 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:54.695196 0.161179 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 14:35:56.775895 1.388226 tcp 10.0.2.105 52154 -> 115.111.246.54 7006 FPA_* 0 0 52 26464 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:40:42.157632 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:40:50.286960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:40:58.288387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:41:14.291206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:41:46.297121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:47:50.303206 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:47:57.310296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:48:05.311820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:48:21.315354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:48:53.321136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:51:37.297182 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 14:51:37.297259 0.950470 tcp 10.0.2.105 52155 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/10 14:55:06.330686 3.001323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 14:55:13.337932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:55:21.339215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:55:37.341742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 14:56:09.348239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:02:33.362478 3.002063 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:02:40.369936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:02:48.371680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:03:04.374538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:03:36.380589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:06:11.644676 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 15:06:11.644778 0.228839 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:11.874058 0.195355 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:12.069835 0.121492 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:12.191877 4.127457 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:12.192297 4.911756 tcp 10.0.2.105 52156 -> 184.182.240.239 7058 SPA_* 0 0 284 226483 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:06:16.319735 0.170623 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:16.490733 0.168587 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:16.659692 0.071932 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:16.731989 0.090019 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:16.822380 0.141859 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:16.964605 0.147097 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.112052 0.336295 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.368890 4.968288 tcp 10.0.2.105 52156 -> 184.182.240.239 7058 A_PA 0 0 242 201484 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:06:17.448767 0.146706 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.595857 0.151832 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.748087 0.061403 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.809900 0.028065 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.838328 0.156776 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:17.995463 0.150942 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:18.146753 0.222894 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:18.370069 0.214506 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:18.584974 0.186417 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:18.771812 0.140246 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:18.912446 0.305439 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:19.218258 0.180536 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:19.399190 0.193178 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:19.592783 0.160918 udp 10.0.2.105 7010 <-> 99.1.194.158 9337 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:19.754086 0.216704 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:19.971211 0.141545 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:06:22.456773 1.118965 tcp 10.0.2.105 52156 -> 184.182.240.239 7058 FPA_* 0 0 74 56324 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:09:40.386990 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:09:47.394753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:09:55.396744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:10:11.398441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:10:43.404694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:16:47.411416 3.011169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:16:54.428198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:17:02.429531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:17:18.432984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:17:50.439100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:21:38.246812 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 15:21:38.247102 0.985429 tcp 10.0.2.105 52157 -> 128.255.183.224 9027 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:23:56.447452 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:24:03.455346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:24:11.456254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:24:27.459623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:24:59.465556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:31:03.471709 3.001220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:31:10.479306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:31:18.480471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:31:34.483517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:32:06.489760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:36:41.425498 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 15:36:41.425602 0.174800 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:41.600798 0.190908 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:41.792110 0.121504 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:41.914015 4.419603 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:46.333958 0.180844 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:46.515216 0.168819 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:46.684601 0.071761 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:46.756713 0.346358 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.103463 0.342763 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.446602 0.091753 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.538788 0.146223 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.685344 0.161403 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.847136 0.151909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:47.999452 0.066476 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.066405 0.028215 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.095014 0.154741 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.250162 0.161574 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.412151 0.187946 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.600452 0.145850 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.746711 0.177746 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:48.924880 0.187291 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:49.112565 0.346116 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:49.459007 0.186139 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:49.645550 0.189243 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:49.835117 0.139899 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:36:49.975387 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 15:37:05.751800 0.074376 tcp 10.0.2.105 52158 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:37:05.826022 0.071408 tcp 10.0.2.105 52159 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:37:05.897680 0.132054 tcp 10.0.2.105 52160 -> 195.113.214.234 443 SRPA* 0 0 34 25969 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:37:06.030266 0.218510 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/10 15:38:10.495077 3.002473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:38:17.502680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:38:25.504961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:38:41.507817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:39:13.513583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:45:17.520231 3.000790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:45:24.526805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:45:32.528543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:45:48.531722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:46:20.537923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:51:39.236099 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 15:51:39.236188 0.973310 tcp 10.0.2.105 52161 -> 128.255.183.224 9027 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/01/10 15:52:24.543645 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:52:31.551175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:52:39.552661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:52:55.555400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:53:27.561243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:59:31.568547 3.000745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 15:59:38.575181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 15:59:46.576176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:00:02.579069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:00:34.585686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:06:38.592351 3.001105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:06:45.598855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:06:53.600071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:07:09.603443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:07:18.666737 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 16:07:18.666838 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 16:07:36.354352 0.071205 tcp 10.0.2.105 52162 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:07:36.425406 0.067229 tcp 10.0.2.105 52163 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:07:36.492970 0.160257 tcp 10.0.2.105 52164 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:07:36.653826 0.120365 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:36.774579 0.170726 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:36.945712 0.191490 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:37.137624 0.205115 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:37.343165 0.070360 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:37.413923 0.330984 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:37.745233 4.348300 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:41.609298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:07:42.093971 0.179462 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.273823 0.083049 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.357260 0.142432 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.500117 0.143031 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.643459 0.137507 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.781371 0.062193 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.843998 0.032699 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:42.877091 0.154377 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:43.031910 0.370354 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:43.402646 0.139829 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:43.542820 0.176557 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:43.719768 0.700739 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:44.473275 0.142922 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:44.616688 0.210855 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:44.827975 0.188190 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:45.016655 0.139113 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:45.156180 0.313009 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:45.469638 0.183672 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:07:45.653668 0.209817 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:13:45.615847 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:13:52.622743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:14:00.624153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:14:16.627345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:14:48.633141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:20:52.639914 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:20:59.646576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:21:07.648382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:21:23.651626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:21:40.215970 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 16:21:40.216071 0.958750 tcp 10.0.2.105 52165 -> 128.255.183.224 9027 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:21:55.657016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:27:59.664308 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:28:06.670578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:28:14.672359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:28:30.675200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:29:02.681286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:35:06.687859 3.000780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:35:13.694577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:35:21.696500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:35:37.699386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:36:09.705056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:37:55.778226 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 16:37:55.778305 0.189546 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:55.968306 0.120579 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:56.089219 0.236341 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:56.325998 0.146849 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:56.473275 0.168386 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:56.642010 0.084143 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:37:56.726506 3.309962 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.036877 0.181715 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.218994 0.090231 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.309584 0.141957 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.451985 0.145382 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.597714 0.131208 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.729275 0.065089 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.794754 0.034583 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.829687 0.154714 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:00.984754 0.175324 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:01.160500 0.373819 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:01.534705 0.146129 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:01.681246 0.191872 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:01.873516 0.279021 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:02.152923 0.188527 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:02.341836 0.440384 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:02.782535 0.140385 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:02.923310 0.208508 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:38:03.132217 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 16:38:18.662715 0.074923 tcp 10.0.2.105 52166 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:38:18.737891 0.075215 tcp 10.0.2.105 52167 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:38:18.813410 0.154338 tcp 10.0.2.105 52168 -> 195.113.214.234 443 SRPA* 0 0 35 18854 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:38:18.967961 0.184046 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 16:42:13.711189 3.002209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:42:20.719157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:42:28.720499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:42:44.722992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:43:16.729514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:49:20.734947 3.002254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:49:27.742531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:49:35.744191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:49:51.747318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:50:23.753496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:51:41.175420 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 16:51:41.175701 0.911487 tcp 10.0.2.105 52169 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/10 16:56:27.758639 3.002631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 16:56:34.766540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:56:42.768106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:56:58.770811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 16:57:30.777073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:03:34.783107 3.001895 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:03:41.790371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:03:49.791795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:04:05.795462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:04:37.801333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:08:20.421595 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 17:08:20.421687 0.316103 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:20.738184 0.188753 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:20.927363 0.120255 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.048013 0.174450 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.222790 0.071126 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.294313 0.219533 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.514230 0.148357 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.662989 0.151033 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.814404 0.174463 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:21.989219 0.146406 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.136017 0.144787 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.281223 0.138002 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.419641 0.064315 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.484415 0.041517 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.526319 0.154668 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.681329 0.177075 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.858811 0.083907 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:22.943107 0.158595 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:23.102100 0.396124 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:23.498642 0.146205 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:23.645232 0.181469 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:23.827106 0.142691 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:23.970205 0.218878 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:24.189574 0.188128 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:24.378097 0.185634 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:08:24.564121 0.184931 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:10:41.807043 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:10:48.814505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:10:56.815698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:11:12.819412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:11:44.825302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:17:48.830780 3.002152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:17:55.838589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:18:03.839790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:18:19.843354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:18:51.849124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:21:42.094191 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 17:21:42.094279 1.075779 tcp 10.0.2.105 52170 -> 128.255.183.224 9027 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/10 17:24:55.855594 3.001239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:25:02.862389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:25:10.864429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:25:26.867342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:25:58.872891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:32:02.879194 3.081866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:32:09.966733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:32:17.968026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:32:33.971082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:33:05.977093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:38:53.687657 0.015614 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 17:38:53.703367 0.120475 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:53.824413 0.171797 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:53.996609 0.317553 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:54.314660 0.187839 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:54.502855 0.083556 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:54.586825 0.172204 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:54.759345 0.146795 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:54.906579 0.153022 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.059981 0.169784 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.230164 0.145561 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.376168 0.145840 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.522371 0.131020 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.653717 0.060204 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.714318 0.027265 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.741913 0.153675 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:55.895998 0.179084 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.075507 0.088673 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.164650 0.145876 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.310941 0.191233 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.502514 0.140000 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.642856 0.209316 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:56.852580 0.396753 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:57.249747 0.138836 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:57.388957 0.178945 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:57.568440 0.189875 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:38:57.758716 0.198283 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/10 17:39:09.983303 3.001702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:39:16.990408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:39:24.991807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:39:40.995257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:40:13.001562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:46:17.007485 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:46:24.014199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:46:32.015766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:46:48.019257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:47:20.025210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:51:43.204451 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 17:51:43.204530 0.910694 tcp 10.0.2.105 52171 -> 128.255.183.224 9027 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/01/10 17:53:24.031531 3.001198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 17:53:31.038753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:53:39.040144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:53:55.042767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 17:54:27.049193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:00:31.055423 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:00:38.062487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:00:46.064216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:01:02.066904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:01:34.073435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:07:38.078959 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:07:45.086714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:07:53.087721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:08:09.090959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:08:41.096957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:09:11.430863 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 18:09:11.430958 0.121514 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:11.552877 0.169108 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:11.722372 0.328383 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.051211 0.189829 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.241450 0.071142 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.312980 0.197936 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.511318 0.148880 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.660600 0.153594 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:12.814572 0.185541 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.000656 0.144946 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.145994 0.143224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.289625 0.144847 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.434825 0.090023 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.525239 0.026685 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.552475 0.155356 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.708394 0.176014 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.884813 0.091812 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:13.977102 0.142694 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:14.120200 0.186143 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:14.306689 0.141352 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:14.448440 0.217818 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:14.685358 0.349102 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:15.034897 0.188344 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:15.223671 0.197483 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:15.421872 0.145915 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:09:15.568172 0.182534 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:14:45.102973 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:14:52.110387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:15:00.112348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:15:16.115064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:15:48.120660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:21:44.123577 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 18:21:44.123870 1.033830 tcp 10.0.2.105 52172 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/10 18:21:52.127720 3.000715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:21:59.134067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:22:07.135990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:22:23.138757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:22:55.144807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:28:59.150454 3.002105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:29:06.158174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:29:14.159816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:29:30.162876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:30:02.168497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:36:06.175208 3.000981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:36:13.182366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:36:21.343955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:36:37.347074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:37:09.352765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:39:36.594841 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 18:39:36.595081 0.226102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:36.821580 0.187500 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.009465 0.123265 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.133123 0.167776 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.301302 0.071146 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.372878 0.174912 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.548185 0.147563 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.696143 0.150064 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:37.846575 0.184580 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.031546 0.145312 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.177331 0.145041 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.322799 0.144630 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.467809 0.065970 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.534198 0.033191 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.567723 0.154349 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.722464 0.180966 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.903868 0.090344 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:38.994568 0.144792 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:39.139722 0.209440 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:39.353144 0.357677 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:39.711157 0.193280 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:39.904772 0.183618 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:40.088761 0.138703 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:40.227865 0.185660 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:40.413873 0.186622 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:39:40.600890 0.140519 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/10 18:43:13.359216 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:43:20.366328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:43:28.367910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:43:44.370861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:44:16.377180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:50:20.382457 3.002316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:50:27.390254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:50:35.391726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:50:51.395194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:51:23.401208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:51:45.232929 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 18:51:45.233024 0.956567 tcp 10.0.2.105 52173 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/10 18:57:27.407347 3.001112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 18:57:34.414556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:57:42.415684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:57:58.418554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 18:58:30.425024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:04:34.431090 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:04:41.438175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:04:49.440091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:05:05.442728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:05:37.449012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:10:07.988240 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 19:10:07.988340 0.120691 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.109437 0.168604 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.278506 0.218743 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.497651 0.199459 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.697530 0.072082 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.770022 0.169989 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:08.940449 0.147398 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.088396 0.156465 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.245192 0.180809 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.426388 0.141273 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.568080 0.144298 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.712770 0.144779 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.857919 0.131318 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:09.989661 0.031781 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.021837 0.155245 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.177486 0.181837 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.359693 0.089150 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.449246 0.142540 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.592167 0.229707 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.822211 0.170964 udp 10.0.2.105 7010 <-> 184.144.40.215 6206 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:10.993571 0.138980 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:11.132942 0.369686 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:11.502984 0.193109 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:11.696459 0.143786 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:11.840657 0.195714 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:10:12.036720 0.184865 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:11:41.455456 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:11:48.462223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:11:56.463827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:12:12.467056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:12:44.472814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:18:48.479624 3.000587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:18:55.486642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:19:03.488640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:19:19.491913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:19:51.496897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:21:46.192464 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 19:21:46.192688 1.096111 tcp 10.0.2.105 52174 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/10 19:25:55.503651 3.000754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:26:02.510551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:26:10.511393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:26:26.515038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:26:58.520687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:33:02.527215 3.001612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:33:09.534179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:33:17.535444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:33:33.538387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:34:05.544631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:40:09.550123 3.002030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:40:16.558197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:40:24.559799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:40:40.562853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:40:40.813098 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 19:40:40.813187 0.121125 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:40.934731 0.168832 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.120827 0.070404 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.191594 0.186206 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.378149 0.148883 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.527423 0.151198 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.678968 0.218342 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:41.897735 0.195937 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.094059 0.173754 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.268195 0.146467 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.415009 0.149930 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.565340 0.138233 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.703976 0.067947 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.772495 0.027056 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.799963 0.154958 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:42.955315 0.180593 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:43.136278 0.228735 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:43.365412 0.000000 udp 10.0.2.105 7010 -> 184.144.40.215 6206 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 19:40:58.450053 0.073151 tcp 10.0.2.105 52175 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 19:40:58.523420 0.069228 tcp 10.0.2.105 52176 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 19:40:58.592558 0.150630 tcp 10.0.2.105 52177 -> 195.113.214.234 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/10 19:40:58.743773 0.140356 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:58.884502 0.090430 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:58.975267 0.148984 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:59.124641 0.405501 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:59.530545 0.192067 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:59.723040 0.140327 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:40:59.863803 0.203285 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:41:00.067508 0.184603 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/10 19:41:12.568769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:47:16.574749 3.001416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:47:23.582152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:47:31.583525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:47:47.586313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:48:19.592824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:51:47.291962 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 19:51:47.292187 0.927677 tcp 10.0.2.105 52178 -> 128.255.183.224 9027 FSPA* 0 0 15 1657 flow=From-Botnet-V2-TCP-Established 1970/01/10 19:54:23.599009 3.001199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 19:54:30.606152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:54:38.607753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:54:54.610619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 19:55:26.616550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:01:30.622445 3.002030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:01:37.630333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:01:45.631215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:02:01.634933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:02:33.640613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:08:37.646190 3.001989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:08:44.653918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:08:52.655543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:09:08.658384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:09:40.664924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:11:23.332752 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 20:11:23.332918 0.000000 udp 10.0.2.105 7010 -> 184.144.40.215 6206 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 20:11:42.120771 0.074677 tcp 10.0.2.105 52179 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:11:42.195694 0.069025 tcp 10.0.2.105 52180 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:11:42.264979 0.151074 tcp 10.0.2.105 52181 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:11:42.417499 0.071877 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:11:42.489800 0.120049 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:11:42.610185 0.167871 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:11:42.778487 0.153656 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:11:42.932500 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 20:12:01.227717 0.069475 tcp 10.0.2.105 52182 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:12:01.297454 0.069716 tcp 10.0.2.105 52183 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:12:01.367485 0.161087 tcp 10.0.2.105 52184 -> 195.113.214.234 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:12:01.529170 0.195395 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:01.724955 0.183062 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:01.908451 0.234727 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.143636 0.147393 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.291425 0.145610 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.437466 0.124090 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.561967 0.063621 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.625968 0.027931 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.654248 0.154075 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.808738 0.180742 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:02.989837 0.229228 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.219509 0.148666 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.368571 0.142147 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.511052 0.142602 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.654048 0.090913 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.745296 0.140686 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:03.886337 0.192732 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:04.079462 0.189525 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:04.269398 0.435804 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:12:04.705550 0.194478 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:15:44.670526 3.001629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 20:15:51.677919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:15:59.679484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:16:15.682720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:16:47.688215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:21:48.221535 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 20:21:48.221821 0.975435 tcp 10.0.2.105 52185 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:22:51.694301 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:22:58.701795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:23:06.703341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:23:22.706271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:23:54.712525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:29:58.719255 3.000847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:30:05.725758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:30:13.727679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:30:29.730648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:31:01.736617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:37:05.743208 3.000789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:37:12.750031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:37:20.751289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:37:36.804472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:38:08.810489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:42:26.030533 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 20:42:26.030629 0.225542 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.256576 0.121076 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.378044 0.168550 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.546964 0.148378 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.695776 0.071098 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.767203 0.173816 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:26.941432 0.148922 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.090675 0.200662 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.291719 0.185249 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.477366 0.145965 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.623709 0.123953 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.748018 0.061123 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.809550 0.029426 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.839316 0.154125 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:27.993825 0.179155 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.173412 0.228848 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.402683 0.145473 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.548578 0.091230 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.640236 0.145183 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.785817 0.188399 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:28.974600 0.187333 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:29.162354 0.144944 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:29.307694 0.143387 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:29.451425 0.411963 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:42:29.863803 0.192530 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/10 20:44:12.815857 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:44:19.823986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:44:27.825679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:44:43.828813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:45:15.834443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:51:19.841347 3.000897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:51:26.847653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:51:34.849725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:51:49.210788 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 20:51:49.210868 0.982078 tcp 10.0.2.105 52186 -> 128.255.183.224 9027 FSPA* 0 0 12 1564 flow=From-Botnet-V2-TCP-Established 1970/01/10 20:51:50.852160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:52:22.858266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:58:26.865068 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 20:58:33.871539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:58:41.873490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:58:57.876483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 20:59:29.882795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:05:33.888254 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:05:40.895882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:05:48.897460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:06:04.900349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:06:36.906749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:12:40.913346 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:12:47.919931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:12:53.548390 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 21:12:53.548525 0.268648 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:53.817542 0.121095 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:53.938990 0.071991 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:54.011343 0.175794 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:54.187558 0.147684 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:54.335605 0.195955 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:54.531959 0.169102 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:54.701444 0.401686 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.103513 0.185721 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.289573 0.144027 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.434012 0.137968 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.572422 0.064545 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.637381 0.026688 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.664475 0.154360 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.819223 0.180911 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:55.921619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:12:56.000504 0.239229 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:56.240148 0.144073 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:56.384648 0.094669 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:56.479718 0.139480 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:56.619572 0.200549 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:56.820538 0.198652 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:57.019597 0.143201 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:57.163194 0.192622 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:57.356214 0.143219 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:12:57.499856 0.350001 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:13:11.924546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:13:43.930570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:19:47.936032 3.001823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:19:54.943889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:20:02.945249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:20:18.948116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:20:50.954517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:21:50.200168 0.000196 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 21:21:50.200409 1.159517 tcp 10.0.2.105 52187 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/10 21:26:54.959946 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:27:01.967947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:27:09.968999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:27:25.972048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:27:57.978149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:34:01.983685 3.002579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:34:08.991341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:34:16.993101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:34:32.996128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:35:05.001914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:41:09.007575 3.002485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:41:16.015597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:41:24.017498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:41:40.019955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:42:12.026482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:43:16.208959 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 21:43:16.209062 0.217602 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:16.427070 0.120013 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:16.562119 0.095264 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:16.657810 0.179487 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:16.837713 0.147949 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:16.986022 0.152363 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.138713 0.182270 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.321351 0.196812 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.518569 0.169315 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.688308 0.146753 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.835418 0.145249 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:17.981059 0.063903 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.045327 0.034870 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.080551 0.155618 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.236541 0.180838 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.417710 0.226819 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.644881 0.147596 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.792971 0.083371 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:18.876745 0.139519 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.016663 0.189811 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.206873 0.182255 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.389568 0.144291 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.534272 0.195593 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.730288 0.143135 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:43:19.873809 0.360446 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/10 21:48:16.032166 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:48:23.039698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:48:31.041098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:48:47.043902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:49:19.050358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:51:51.360083 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 21:51:51.360189 0.897277 tcp 10.0.2.105 52188 -> 128.255.183.224 9027 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/01/10 21:55:23.056818 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 21:55:30.063631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:55:38.064753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:55:54.068252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 21:56:26.073914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:02:30.080676 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:02:37.087351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:02:45.089359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:03:01.092300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:03:33.097761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:09:37.104526 3.001011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:09:44.111468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:09:52.113019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:10:08.116410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:10:40.122286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:13:27.723484 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 22:13:27.723591 0.078532 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:27.802545 0.176062 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:27.979013 0.148478 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:28.127864 0.671939 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:28.800213 0.179093 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:28.979738 0.348326 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:29.328501 0.122461 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:29.451293 0.196187 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:29.647877 0.171767 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:29.820031 0.145932 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:29.966299 0.137984 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.104714 0.077949 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.183024 0.036371 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.219828 0.154484 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.374685 0.181837 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.556933 0.229573 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.786876 0.147359 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:30.934649 0.084174 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:31.019170 0.138742 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:31.158321 0.178162 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:31.336840 0.192752 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:31.529986 0.142145 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:31.672700 0.378237 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:32.051280 0.184365 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:13:32.236007 0.147528 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:16:44.128735 3.000757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:16:51.135304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:16:59.137351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:17:15.140081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:17:47.146135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:21:52.258658 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 22:21:52.258748 0.951948 tcp 10.0.2.105 52189 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/10 22:23:51.152401 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:23:58.159474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:24:06.161151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:24:22.164256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:24:54.170296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:30:58.175567 3.002347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:31:05.183177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:31:13.185299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:31:29.188170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:32:01.194248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:38:05.200159 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:38:12.287484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:38:20.288636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:38:36.291793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:39:08.298372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:43:41.280756 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 22:43:41.280864 0.480230 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:41.761543 0.276968 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:42.038903 0.424339 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:42.463684 0.835072 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:43.299375 0.408688 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:43.708649 0.318057 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:44.027084 0.440426 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:44.467924 0.421043 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:43:44.889390 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/10 22:44:01.270619 0.455027 tcp 10.0.2.105 52190 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/10 22:44:01.725922 0.494740 tcp 10.0.2.105 52191 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/10 22:44:02.220964 1.538707 tcp 10.0.2.105 52192 -> 195.113.214.234 443 SRPA* 0 0 32 24085 flow=From-Botnet-V2-TCP-Established 1970/01/10 22:44:03.760490 0.379084 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:04.139955 0.499992 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:04.640403 0.673119 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:05.313961 0.349662 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:05.664019 0.464733 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:06.129145 0.545742 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:06.675291 0.542724 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:07.218365 0.380059 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:07.598833 0.414010 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:08.013255 0.404277 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:08.417917 0.373294 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:08.791568 0.689260 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:09.481211 0.500445 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:09.982065 0.991416 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:10.973898 0.436635 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:44:11.411044 0.443979 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/10 22:45:12.304621 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/10 22:45:19.311565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:45:27.313014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:45:43.315856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:46:15.321725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:51:53.248507 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 22:51:53.248683 1.785319 tcp 10.0.2.105 52193 -> 128.255.183.224 9027 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/01/10 22:52:19.327719 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:52:26.335453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:52:34.336801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:52:50.339905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:53:22.346159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:59:26.351458 3.002535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 22:59:33.359580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:59:41.360828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 22:59:57.363832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:00:29.369763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:06:33.376564 3.001161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:06:40.383156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:06:48.385060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:07:04.387842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:07:36.394026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:13:40.399948 3.001280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:13:47.407495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:13:55.408855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:14:11.412115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:14:12.353297 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 23:14:12.353434 0.504151 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:12.858035 0.460820 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:13.319241 0.380582 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:13.700226 0.478892 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:14.179531 0.425369 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:14.605301 0.468822 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:15.074492 0.559783 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:15.634643 0.390271 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:16.025300 0.406829 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:16.432715 0.459048 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:16.892156 0.483333 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:17.375886 0.689524 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:18.065756 0.382989 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:18.449169 0.426950 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:18.876514 0.480127 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:19.357032 0.560421 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:19.917854 0.420574 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:20.338853 0.448523 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:20.787780 0.393884 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:21.182091 0.536347 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:21.718845 0.709514 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:22.428759 0.473688 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:22.902863 1.266725 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:24.169997 0.486365 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:24.656762 0.486475 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:14:43.418107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:20:47.423887 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:20:54.431315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:21:02.432707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:21:18.435582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:21:50.441774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:21:55.038752 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 23:21:55.038978 1.854361 tcp 10.0.2.105 52194 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/10 23:27:54.447611 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:28:01.455105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:28:09.456667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:28:25.459849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:28:57.466112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:35:01.471778 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:35:08.479260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:35:16.481043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:35:32.483724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:36:04.489488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:42:08.505916 3.011759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:42:15.524253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:42:23.525696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:42:39.528918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:43:11.533929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:44:43.676449 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 23:44:43.676559 0.462769 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:44.139765 0.454920 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:44.595075 0.427689 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:45.023199 0.613991 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:45.637686 0.549547 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:46.187680 0.394809 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:46.582897 0.475726 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:47.059044 0.424155 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:47.483538 0.471026 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:47.954953 0.551328 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:48.506645 0.478615 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:48.985595 0.412285 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:49.398247 0.292606 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:49.691243 0.444583 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:50.136224 0.533222 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:50.669800 0.532652 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:51.202882 0.436121 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:51.648981 0.409405 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:52.058841 0.381322 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:52.440593 0.492370 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:52.933375 0.671669 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:53.605394 0.469600 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:54.075417 0.479504 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:54.555275 0.418437 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:44:54.974112 0.493450 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/10 23:49:15.540099 3.001147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:49:22.547309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:49:30.548435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:49:46.551464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:50:18.557945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:51:56.900079 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/10 23:51:56.900247 1.843693 tcp 10.0.2.105 52195 -> 128.255.183.224 9027 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/01/10 23:56:22.563740 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/10 23:56:29.571088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:56:37.572920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:56:53.576042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/10 23:57:25.581525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:03:29.587215 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:03:36.595379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:03:44.596493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:04:00.599379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:04:32.605442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:10:36.612323 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:10:43.619165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:10:51.620926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:11:07.623560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:11:39.629846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:15:03.713075 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 00:15:03.713223 0.430747 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:04.144550 0.412747 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:04.557761 0.393490 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:04.951661 0.515347 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:05.467319 0.468277 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:05.935917 0.485466 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:06.421786 0.385674 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:06.807871 0.433927 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:07.242197 0.447034 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:07.689623 0.737509 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:08.427531 0.456048 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:08.884009 0.444048 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:09.328549 0.389096 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:09.718052 1.052834 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:10.771311 0.419628 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:11.191283 0.509046 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:11.700682 0.445042 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:12.146104 0.417054 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:12.563588 0.393589 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:12.957516 0.545393 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:13.503296 0.662167 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:14.165815 0.470130 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:14.636335 0.527398 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:15.164138 0.434515 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:15:15.599053 0.515082 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:17:43.635811 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:17:50.642685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:17:58.644193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:18:14.647763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:18:46.653612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:21:58.770578 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 00:21:58.770813 1.874272 tcp 10.0.2.105 52196 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/11 00:24:50.719647 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:24:57.726908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:25:05.728858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:25:21.731568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:25:53.737823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:31:57.744245 3.000816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:32:04.750931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:32:12.752821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:32:28.755828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:33:00.761387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:39:04.768147 3.000990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:39:11.774877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:39:19.776181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:39:35.779702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:40:07.785401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:45:44.770866 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 00:45:44.771109 0.168298 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:44.939836 0.148722 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:45.103982 0.334335 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:45.438689 0.342192 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:45.781336 0.177456 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:45.959173 0.150836 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.110405 0.175487 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.286345 0.120884 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.407625 0.152171 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.560183 0.142362 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.702958 0.063579 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.766924 0.191131 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.958459 0.027538 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:46.986321 0.598874 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:47.585592 0.178577 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:47.764658 0.210914 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:47.975986 0.147832 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:48.124176 0.083320 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:48.207902 0.140080 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:48.348431 0.177833 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:48.526663 0.335385 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:48.862478 0.185692 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:49.048672 0.192311 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:49.241344 0.142834 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:45:49.384712 0.140525 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/11 00:46:11.791332 3.001872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:46:18.799319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:46:26.800900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:46:42.803688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:47:14.809642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:52:00.651303 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 00:52:00.651399 1.143935 tcp 10.0.2.105 52197 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/11 00:53:18.815688 3.001412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 00:53:25.823097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:53:33.824263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:53:49.827853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 00:54:21.853803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:00:25.859950 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:00:32.867105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:00:40.868756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:00:56.871107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:01:28.877541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:07:32.883314 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:07:39.890938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:07:47.892213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:08:03.895789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:08:35.901729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:14:39.907729 3.001358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:14:46.915066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:14:54.916740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:15:10.919065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:15:42.925625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:16:03.274902 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:16:03.275003 0.167844 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:03.443224 0.149749 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:03.593363 0.173317 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:03.767061 0.150592 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:03.918057 0.174771 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.093249 0.077358 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.170992 0.313152 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.484579 0.121348 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.606283 0.144845 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.751542 0.146527 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.898409 0.062283 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:04.961085 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 01:16:23.645688 0.074839 tcp 10.0.2.105 52198 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:16:23.720748 0.074435 tcp 10.0.2.105 52199 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:16:23.795519 0.155170 tcp 10.0.2.105 52200 -> 195.113.214.234 443 SRPA* 0 0 37 27877 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:16:23.951228 0.049499 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:24.001072 0.229554 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:24.231016 0.147487 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:24.378904 0.087911 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:24.467152 0.635260 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:25.102843 0.176601 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:25.279885 0.139664 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:25.280228 3.000698 tcp 10.0.2.105 52201 -> 75.53.126.156 4241 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 01:16:25.419962 0.175996 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:25.596333 0.336407 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:25.933092 0.184410 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:26.117908 0.601419 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:26.719735 0.141566 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:26.861650 0.144773 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:16:34.279363 0.000000 tcp 10.0.2.105 52201 -> 75.53.126.156 4241 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 01:21:46.932223 3.000848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 01:21:53.938760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:22:01.820855 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:22:01.821040 1.004144 tcp 10.0.2.105 52202 -> 128.255.183.224 9027 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:22:01.940001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:22:17.943262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:22:49.949627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:28:53.955922 3.001145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:29:00.962817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:29:08.964493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:29:24.967430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:29:56.973552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:36:00.979019 3.021903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:36:08.006526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:36:16.008318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:36:32.011509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:37:04.017338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:43:08.023079 3.002117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 01:43:15.030669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:43:23.032569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:43:39.034966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:44:11.041120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:46:56.309414 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:46:56.309669 0.187849 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:46:56.497919 0.148849 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:46:56.647174 0.166862 udp 10.0.2.105 7010 <-> 115.111.246.54 5999 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:46:56.814436 4.316119 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.131037 0.198866 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.142509 0.235889 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 SPA_* 0 0 5 472 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:01.330293 0.077478 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.408188 0.170196 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.578737 0.143681 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.722770 0.059988 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:01.783172 0.218575 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:02.002086 0.121455 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:02.123914 0.123959 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:02.248401 0.028769 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:02.277582 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 01:47:08.806360 4.677679 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:20.095189 0.074302 tcp 10.0.2.105 52204 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:20.169765 0.071778 tcp 10.0.2.105 52205 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:20.241854 0.185058 tcp 10.0.2.105 52206 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:20.427460 0.785717 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.213632 0.176060 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.390095 0.146738 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.537229 0.081742 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.619349 0.140365 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.760081 0.177928 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:21.938389 0.356795 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:22.295569 0.184203 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:22.480094 0.145610 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:22.626064 0.191486 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:22.817959 0.142777 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/11 01:47:29.460205 4.493304 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 6168 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:37.914198 0.395346 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:50.770040 0.197241 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 2 926 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:47:55.894185 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:48:07.198051 4.228960 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:48:25.891811 4.543297 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 6168 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:48:30.894876 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:48:34.314186 0.396379 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:48:43.343554 4.765881 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 11 6952 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:48:59.737590 4.555541 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:04.893772 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:49:14.993517 0.395731 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:24.577429 0.205228 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 2 1412 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:29.399021 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:49:34.453303 0.393346 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:44.082610 0.397905 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:53.631117 4.569137 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 6982 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:49:58.390317 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:50:15.046999 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 01:50:17.677178 4.888553 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:50:22.054868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:50:22.395221 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:50:30.056013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:50:31.913039 4.442056 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:50:45.410777 0.398211 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:50:46.059298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:51:02.862913 0.200980 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 2 564 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:51:07.890686 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:51:12.508626 4.415134 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 5846 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:51:18.065048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:51:26.380693 0.397077 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:51:35.804644 4.102463 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 9 5966 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:51:40.897890 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 01:51:44.128593 0.404496 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:51:53.848465 4.665052 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:52:02.420520 0.399315 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 A_PA 0 0 4 2368 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:52:02.830471 1.063509 tcp 10.0.2.105 52207 -> 128.255.183.224 9027 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:52:32.622832 2.375318 tcp 10.0.2.105 52203 -> 71.10.54.162 3760 FRA_A 0 0 4 1636 flow=From-Botnet-V2-TCP-Established 1970/01/11 01:57:22.071592 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 01:57:29.079043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:57:37.080473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:57:53.083647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 01:58:25.089382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:04:29.096010 3.000718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 02:04:36.102597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:04:44.104658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:05:00.106834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:05:32.113189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:11:36.118874 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 02:11:43.126861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:11:51.128006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:12:07.131412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:12:39.137313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:17:51.066283 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:17:51.066459 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:18:06.850014 0.076135 tcp 10.0.2.105 52208 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:06.926368 0.074547 tcp 10.0.2.105 52209 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:07.001217 0.168340 tcp 10.0.2.105 52210 -> 195.113.214.234 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:07.170228 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:18:25.375191 0.069151 tcp 10.0.2.105 52211 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:25.444688 0.071841 tcp 10.0.2.105 52212 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:25.516814 0.168635 tcp 10.0.2.105 52213 -> 195.113.214.234 443 SRPA* 0 0 25 13448 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:25.685964 0.188552 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:25.874889 0.668961 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:26.544289 0.183809 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:26.728788 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:18:26.729212 3.002241 tcp 10.0.2.105 52214 -> 209.62.218.119 1894 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 02:18:35.729675 0.000000 tcp 10.0.2.105 52214 -> 209.62.218.119 1894 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 02:18:43.142863 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 02:18:43.681957 0.074654 tcp 10.0.2.105 52215 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:43.756902 0.067264 tcp 10.0.2.105 52216 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:43.824461 0.178750 tcp 10.0.2.105 52217 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:18:44.003955 0.168036 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.172423 0.071915 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.244730 0.076866 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.322019 0.226983 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.549368 0.121036 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.670836 0.144744 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.815942 0.055962 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:44.872469 0.145252 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.018089 0.156973 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.175500 0.178478 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.354332 0.145906 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.500660 0.087201 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.588277 0.140337 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.728970 0.177924 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:45.907286 0.335776 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:46.243440 0.188505 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:46.432515 0.139908 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:46.572834 0.185593 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:46.758762 0.144507 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:46.916263 0.000000 udp 10.0.2.105 7010 -> 115.111.246.54 5999 REQ 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:18:50.150586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:18:53.325011 4.306860 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:57.632362 0.193725 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:57.826653 0.198494 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:58.025732 0.690652 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:58.152038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:18:58.716906 0.074424 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:58.801043 0.064613 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 860 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:58.866238 0.169931 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.036596 0.228496 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.265677 0.124150 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.390391 0.144736 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.535688 0.042381 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.578504 0.146165 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.725103 0.181688 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:18:59.907378 0.180259 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:00.088352 0.151480 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:00.240437 0.093780 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:00.334672 0.145604 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:00.480839 0.189660 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:00.671059 0.372200 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:01.043880 0.141782 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:01.186180 0.185946 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:01.372904 0.148698 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:01.522235 0.193958 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:01.716960 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:10.129786 0.097314 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:10.237209 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:14.154812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:19:14.896059 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:19:15.707420 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:23.338146 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5833 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:30.378723 0.000000 udp 10.0.2.105 7010 -> 88.252.37.251 1830 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:36.026711 0.044084 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:36.081510 0.069633 udp 10.0.2.105 7010 -> 85.107.135.105 1025 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:36.151143 0.000000 icmp 85.107.135.105 0x0303 -> 10.0.2.105 0x0104 URP 192 1 283 flow=Background 1970/01/11 02:19:40.893448 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:19:41.644605 0.000000 udp 10.0.2.105 7010 -> 94.54.163.72 8938 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:46.161159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:19:48.544922 0.000000 udp 10.0.2.105 7010 -> 81.148.248.46 8818 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:19:53.892087 0.042225 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:19:53.943797 0.000000 udp 10.0.2.105 7010 -> 88.246.131.147 3123 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:01.062480 0.000000 udp 10.0.2.105 7010 -> 79.5.170.20 9095 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:05.899667 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:20:06.670462 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:14.312042 0.000000 udp 10.0.2.105 7010 -> 84.173.65.118 7912 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:22.764017 0.000000 udp 10.0.2.105 7010 -> 208.23.77.130 9855 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:28.452384 0.601530 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:29.053914 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 179 flow=Background 1970/01/11 02:20:33.629267 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:20:36.573702 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:41.901583 0.000000 udp 10.0.2.105 7010 -> 88.224.219.29 5923 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:49.982901 0.000000 udp 10.0.2.105 7010 -> 108.178.97.169 9252 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:20:58.906096 0.000000 udp 10.0.2.105 7010 -> 151.76.111.219 2973 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:03.622259 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:21:06.737613 0.000000 udp 10.0.2.105 7010 -> 108.73.112.4 2350 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:15.680120 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:22.970386 0.117996 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:21:23.138053 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:27.627308 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:21:30.461454 0.000000 udp 10.0.2.105 7010 -> 84.58.184.144 2044 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:36.309610 0.000000 udp 10.0.2.105 7010 -> 91.42.106.221 5609 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:44.431303 0.000000 udp 10.0.2.105 7010 -> 94.71.114.230 4564 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:50.760170 0.000000 udp 10.0.2.105 7010 -> 95.224.103.10 8932 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:21:55.627134 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:21:56.709091 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:04.130403 1.151787 tcp 10.0.2.105 52218 -> 128.255.183.224 9027 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:22:05.531486 0.000000 udp 10.0.2.105 7010 -> 203.136.227.87 6707 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:14.143870 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:20.212916 0.000000 udp 10.0.2.105 7010 -> 59.92.245.17 3701 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:27.473282 0.000000 udp 10.0.2.105 7010 -> 2.228.156.203 9167 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:32.130038 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:22:36.466235 0.000000 udp 10.0.2.105 7010 -> 217.249.187.214 7662 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:43.446392 0.000000 udp 10.0.2.105 7010 -> 84.177.34.231 4751 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:51.257599 3.080716 udp 10.0.2.105 7010 -> 87.3.68.111 8186 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:22:54.338315 0.000000 icmp 87.3.68.111 0x0103 -> 10.0.2.105 0x5703 URH 192 1 179 flow=Background 1970/01/11 02:22:56.124276 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:22:59.639427 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:07.770845 0.656045 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:23:08.457942 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:16.383376 0.110473 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:23:16.566253 0.000000 udp 10.0.2.105 7010 -> 141.105.201.37 6584 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:21.129975 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:23:24.895662 0.000000 udp 10.0.2.105 7010 -> 116.15.105.111 7634 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:32.798059 0.159605 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:23:32.969791 0.065527 udp 10.0.2.105 7010 <-> 91.218.50.162 5686 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:23:33.060973 0.000000 udp 10.0.2.105 7010 -> 122.167.172.8 4242 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:42.060343 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:46.626945 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:23:48.019118 0.000000 udp 10.0.2.105 7010 -> 87.23.134.37 7679 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:54.188104 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:23:59.695899 0.000000 udp 10.0.2.105 7010 -> 89.148.189.101 1620 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:08.387967 0.000000 udp 10.0.2.105 7010 -> 88.34.127.240 7772 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:13.124922 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:24:15.588467 0.000000 udp 10.0.2.105 7010 -> 78.182.25.59 5842 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:21.697078 0.041057 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:21.749416 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:27.405262 0.046913 udp 10.0.2.105 7010 <-> 217.247.156.177 6828 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:27.462606 0.154003 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:27.639643 0.000000 udp 10.0.2.105 7010 -> 117.192.147.132 6161 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:32.923415 0.000000 udp 10.0.2.105 7010 -> 93.70.58.232 8780 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:37.630454 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:24:40.894915 0.299508 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:41.204314 0.089633 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:41.303648 0.000000 udp 10.0.2.105 7010 -> 125.166.211.153 6594 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:48.506213 0.330277 udp 10.0.2.105 7010 <-> 197.228.174.107 4560 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:24:48.845425 0.000000 udp 10.0.2.105 7010 -> 194.46.56.62 4570 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:24:55.796899 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:01.234412 0.185699 udp 10.0.2.105 7010 -> 122.170.80.56 9928 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:01.420111 0.000000 icmp 122.170.80.56 0x0303 -> 10.0.2.105 0xc826 URP 192 1 325 flow=Background 1970/01/11 02:25:06.120882 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:25:09.686491 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:16.906999 0.000000 udp 10.0.2.105 7010 -> 59.90.208.214 8279 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:24.697754 0.215696 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:25:24.930608 0.053826 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:25:24.994172 0.000000 udp 10.0.2.105 7010 -> 88.46.214.154 7330 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:31.828473 0.132815 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:31.961288 0.000000 icmp 5.82.63.25 0x0303 -> 10.0.2.105 0x000f URP 192 1 301 flow=Background 1970/01/11 02:25:36.625307 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:25:40.260128 0.000000 udp 10.0.2.105 7010 -> 59.95.3.5 9917 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:47.440739 0.000000 udp 10.0.2.105 7010 -> 87.78.24.216 3361 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:50.397190 3.001983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 02:25:53.980029 0.000000 udp 10.0.2.105 7010 -> 96.255.210.204 1803 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:25:57.404796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:26:00.399114 0.056734 udp 10.0.2.105 7010 -> 5.98.47.218 4264 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:00.455848 0.000000 icmp 88.53.223.102 0x0303 -> 10.0.2.105 0xa810 URP 192 1 246 flow=Background 1970/01/11 02:26:05.126131 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:26:05.406156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:26:08.701300 0.000000 udp 10.0.2.105 7010 -> 122.169.105.61 7000 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:16.022019 0.000000 udp 10.0.2.105 7010 -> 82.187.20.229 5520 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:21.409240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:26:23.963278 0.361592 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:26:24.380918 0.095794 udp 10.0.2.105 7010 <-> 91.63.30.165 8426 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:26:24.486339 0.250608 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:26:24.755376 0.020645 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:26:24.820608 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:29.130591 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:26:30.282280 0.000000 udp 10.0.2.105 7010 -> 85.96.65.8 3135 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:38.744768 0.000000 udp 10.0.2.105 7010 -> 95.225.245.85 2947 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:44.532988 0.000000 udp 10.0.2.105 7010 -> 176.222.177.214 5569 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:51.552909 0.000000 udp 10.0.2.105 7010 -> 87.160.140.26 4519 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:26:53.415750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:26:56.129718 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:26:59.854517 0.000000 udp 10.0.2.105 7010 -> 87.22.77.107 8311 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:05.602795 0.000000 udp 10.0.2.105 7010 -> 210.195.148.15 6799 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:11.351289 0.000000 udp 10.0.2.105 7010 -> 78.168.47.110 1747 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:20.223927 0.000000 udp 10.0.2.105 7010 -> 62.121.23.63 3041 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:25.121445 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:27:29.207206 0.068003 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:27:29.353747 0.000000 udp 10.0.2.105 7010 -> 91.40.100.168 6685 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:35.195339 0.000000 udp 10.0.2.105 7010 -> 96.44.41.133 1452 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:43.247434 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:49.726713 0.256898 udp 10.0.2.105 7010 <-> 14.96.186.223 3402 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:27:50.062737 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:27:54.623271 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:27:55.724990 0.000000 udp 10.0.2.105 7010 -> 14.97.254.171 8925 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:04.047427 0.000000 udp 10.0.2.105 7010 -> 194.78.84.148 2767 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:10.446538 0.000000 udp 10.0.2.105 7010 -> 82.53.171.22 4740 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:16.184316 1.526475 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:28:17.798841 0.053400 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:28:17.914693 0.000000 udp 10.0.2.105 7010 -> 92.234.187.129 4688 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:21.121834 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:28:23.825899 0.000000 udp 10.0.2.105 7010 -> 87.25.70.12 9496 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:31.196066 0.000000 udp 10.0.2.105 7010 -> 24.251.67.203 6580 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:36.804060 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:42.732805 0.047588 udp 10.0.2.105 7010 -> 87.170.235.167 9446 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:42.780393 0.000000 icmp 87.170.235.167 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 170 flow=Background 1970/01/11 02:28:47.629387 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:28:48.991445 0.000000 udp 10.0.2.105 7010 -> 86.98.42.154 7084 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:28:55.060436 0.000000 udp 10.0.2.105 7010 -> 92.96.30.30 3157 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:02.290958 0.000000 udp 10.0.2.105 7010 -> 188.13.16.205 9333 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:10.622934 0.000000 udp 10.0.2.105 7010 -> 192.167.111.41 2765 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:15.629758 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:29:16.301269 0.000000 udp 10.0.2.105 7010 -> 95.251.50.199 5247 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:24.682918 0.164680 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/11 02:29:24.857226 0.000000 udp 10.0.2.105 7010 -> 80.176.195.242 1855 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:30.922324 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:39.914680 0.000000 udp 10.0.2.105 7010 -> 84.176.127.239 9921 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:44.621920 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:29:45.883707 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:29:53.574248 0.000000 udp 10.0.2.105 7010 -> 122.178.188.199 1029 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:30:01.656548 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:30:07.955729 0.000000 udp 10.0.2.105 7010 -> 79.25.98.156 1598 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:30:12.621855 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:30:16.658017 0.000000 udp 10.0.2.105 7010 -> 67.152.112.162 7205 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:30:23.838134 0.000000 udp 10.0.2.105 7010 -> 217.253.243.129 6689 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:30:29.236039 0.000000 udp 10.0.2.105 7010 -> 90.196.135.19 6751 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 02:32:57.422203 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 02:33:04.429058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:33:12.430054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:33:28.433645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:34:00.439083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:40:04.446017 3.001207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 02:40:11.453011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:40:19.454494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:40:35.457235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:41:07.463494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:47:11.470448 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 02:47:18.477070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:47:26.478014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:47:42.480963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:48:14.487475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:52:05.289727 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 02:52:05.289834 1.000270 tcp 10.0.2.105 52219 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/11 02:54:18.493700 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 02:54:25.500508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:54:33.502445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:54:49.505292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 02:55:21.511401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:00:35.463333 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 03:00:35.463436 0.179989 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:35.643876 4.335528 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:35.644431 2.993035 tcp 10.0.2.105 52220 -> 209.62.218.119 1894 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 03:00:39.979738 0.188717 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.168789 0.071338 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.240693 0.102150 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.343195 0.167510 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.511098 0.223720 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.735215 0.152163 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:40.887792 0.121897 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.010077 0.138531 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.148997 0.030062 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.179459 0.145583 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.325436 0.155402 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.481239 0.178029 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.659612 0.146126 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.806119 0.104241 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:41.910760 0.359604 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:42.270858 0.140981 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:42.412386 0.139136 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:42.551893 0.182369 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:42.734674 0.186694 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:42.921727 0.146087 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.068149 0.190118 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.258763 0.108026 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.367176 0.044539 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.412055 0.037050 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.449515 0.117606 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.567477 0.102554 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.670423 0.074092 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.744880 0.065635 udp 10.0.2.105 7010 <-> 91.218.50.162 5686 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.810876 0.155229 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:43.966502 0.042598 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:00:44.009476 0.000000 udp 10.0.2.105 7010 -> 217.247.156.177 6828 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:00:44.636012 0.000000 tcp 10.0.2.105 52220 -> 209.62.218.119 1894 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 03:01:01.272010 0.075342 tcp 10.0.2.105 52221 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:01.347633 0.065914 tcp 10.0.2.105 52222 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:01.413929 0.162518 tcp 10.0.2.105 52223 -> 195.113.214.234 443 SRPA* 0 0 33 23869 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:01.577064 0.141239 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:01.718594 0.088230 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:01.807247 0.000000 udp 10.0.2.105 7010 -> 95.82.6.151 1369 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:01:18.375047 0.077549 tcp 10.0.2.105 52224 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:18.452919 0.074564 tcp 10.0.2.105 52225 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:18.527725 0.197568 tcp 10.0.2.105 52226 -> 195.113.214.234 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:18.725760 0.000000 udp 10.0.2.105 7010 -> 197.228.174.107 4560 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:01:25.516712 3.001990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 03:01:32.525064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:01:37.151892 0.071712 tcp 10.0.2.105 52227 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:37.223815 0.073813 tcp 10.0.2.105 52228 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:37.297951 0.172282 tcp 10.0.2.105 52229 -> 195.113.214.234 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:37.470714 0.213720 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:37.684849 0.121449 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:37.806692 0.292490 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:38.099636 0.000000 udp 10.0.2.105 7010 -> 91.63.30.165 8426 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:01:38.100033 2.996830 tcp 10.0.2.105 52230 -> 108.80.130.154 8556 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 03:01:40.526067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:01:47.105595 0.000000 tcp 10.0.2.105 52230 -> 108.80.130.154 8556 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/11 03:01:55.198243 0.072440 tcp 10.0.2.105 52231 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:55.271044 0.074134 tcp 10.0.2.105 52232 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:55.345476 0.176591 tcp 10.0.2.105 52233 -> 195.113.214.234 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:01:55.522776 0.020540 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:01:55.543685 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:01:56.529502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:02:13.954874 0.068942 tcp 10.0.2.105 52234 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:14.024070 0.076912 tcp 10.0.2.105 52235 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:14.101298 0.165253 tcp 10.0.2.105 52236 -> 195.113.214.234 443 SRPA* 0 0 23 13182 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:14.267183 0.064695 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:02:14.332426 0.000000 udp 10.0.2.105 7010 -> 14.96.186.223 3402 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:02:28.534963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:02:29.858016 0.074040 tcp 10.0.2.105 52237 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:29.932516 0.071876 tcp 10.0.2.105 52238 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:30.004633 0.170122 tcp 10.0.2.105 52239 -> 195.113.214.234 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:30.174969 0.125969 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:02:30.301450 0.424603 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:02:30.301880 4.872895 tcp 10.0.2.105 52240 -> 134.90.1.162 8348 SPA_* 0 0 372 329483 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:02:30.726475 0.168937 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:02:35.310822 2.694748 tcp 10.0.2.105 52240 -> 134.90.1.162 8348 FPA_* 0 0 175 152430 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:08:32.541763 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:08:39.548414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:08:47.550215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:09:03.553463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:09:35.559417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:15:39.565452 3.091540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:15:46.662762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:15:54.663943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:16:10.667551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:16:42.673585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:22:06.339578 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 03:22:06.339681 1.563012 tcp 10.0.2.105 52241 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:22:46.678974 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:22:53.687046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:23:01.687910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:23:17.691598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:23:49.697240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:29:53.729983 2.995294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:30:00.730770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:30:08.742052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:30:24.745338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:30:56.751474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:32:35.774233 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 03:32:35.774326 0.271131 udp 10.0.2.105 7010 <-> 217.247.156.177 6828 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:32:36.045904 0.603180 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:32:36.649484 0.000000 udp 10.0.2.105 7010 -> 197.228.174.107 4560 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:32:54.603231 0.750269 tcp 10.0.2.105 52242 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:32:55.353799 0.689517 tcp 10.0.2.105 52243 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:32:56.043193 1.421847 tcp 10.0.2.105 52244 -> 195.113.214.234 443 SRPA* 0 0 21 13038 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:32:57.465518 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:33:15.571847 0.657137 tcp 10.0.2.105 52245 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:16.229295 0.690402 tcp 10.0.2.105 52246 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:16.920012 1.390258 tcp 10.0.2.105 52247 -> 195.113.214.234 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:18.310860 0.000000 udp 10.0.2.105 7010 -> 91.63.30.165 8426 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:33:36.991854 0.758740 tcp 10.0.2.105 52248 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:37.750903 0.715379 tcp 10.0.2.105 52249 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:38.466623 1.366044 tcp 10.0.2.105 52250 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:39.833300 0.000000 udp 10.0.2.105 7010 -> 14.96.186.223 3402 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 03:33:58.142684 0.640597 tcp 10.0.2.105 52251 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:58.783553 0.634909 tcp 10.0.2.105 52252 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:33:59.418716 1.450618 tcp 10.0.2.105 52253 -> 195.113.214.234 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:34:00.869911 0.412866 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:01.283192 4.587935 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:05.871546 0.479587 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:06.351537 0.319487 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:06.671404 0.421200 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:07.093022 0.309419 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:07.402844 0.399853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:07.803123 0.338258 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:08.141775 0.370905 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:08.513069 0.643879 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:09.157385 0.536225 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:09.694023 0.549155 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:10.243606 0.416578 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:10.660674 0.391374 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:11.052451 0.475907 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:11.528769 0.334077 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:11.863245 0.547867 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:12.411476 0.437968 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:12.849830 0.501493 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:13.351703 0.391220 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:13.743313 0.723795 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:14.467526 0.471274 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:14.939196 0.419447 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:15.359017 0.345675 udp 10.0.2.105 7010 <-> 91.218.50.162 5686 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:15.705063 0.425667 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:16.131079 0.410537 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:16.541957 0.445896 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:16.988273 0.489262 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:17.477926 0.407464 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:17.885767 0.351405 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:18.237537 1.026340 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:19.264402 0.525175 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:19.789983 0.462702 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:20.253088 0.294146 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:20.547596 0.487824 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:21.035764 0.255944 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:21.292100 0.431872 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:21.724567 0.259383 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:21.984385 0.306824 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:22.291618 0.434942 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:22.727001 0.359917 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:23.087296 0.825032 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/11 03:34:24.169508 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 03:37:00.757841 3.001341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 03:37:07.765045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:37:15.766197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:37:31.769450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:38:03.775343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:44:07.781734 3.001175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:44:14.788596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:44:22.790147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:44:38.793226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:45:10.799314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:51:14.806130 3.000656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:51:21.812906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:51:29.814284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:51:45.817347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:52:07.909139 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 03:52:07.909314 0.433006 tcp 10.0.2.105 52254 -> 128.255.183.224 9027 SPA_* 0 0 9 1054 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:52:13.388840 0.430856 tcp 10.0.2.105 52254 -> 128.255.183.224 9027 FA_F* 0 0 7 615 flow=From-Botnet-V2-TCP-Established 1970/01/11 03:52:17.823185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:58:21.828964 3.001632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 03:58:28.837080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:58:36.838966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:58:52.841300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 03:59:24.847257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:04:46.450125 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 04:04:46.450280 0.000000 udp 10.0.2.105 7010 -> 217.247.156.177 6828 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 04:05:04.067033 0.531171 tcp 10.0.2.105 52255 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:04.598498 0.515352 tcp 10.0.2.105 52256 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:05.114113 1.045445 tcp 10.0.2.105 52257 -> 195.113.214.234 443 SRPA* 0 0 24 13848 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:06.160170 0.525816 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:06.686407 0.429844 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:07.116647 4.543512 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:11.660524 0.499042 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:12.159925 0.358933 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:12.519303 0.797570 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:13.317263 0.421968 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:13.739621 0.408714 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:14.148736 0.411178 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:14.560507 0.403881 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:14.964799 1.166546 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:16.131760 0.537301 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:16.669428 0.513350 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:17.183126 0.508066 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:17.691500 0.401885 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:18.093798 0.528729 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:18.622929 0.500746 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:19.124086 0.555533 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:19.680037 0.460033 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:20.140573 0.513511 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:20.654467 0.514217 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:21.169020 0.712498 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:21.881907 0.451172 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:22.333444 0.524487 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:22.858298 0.433871 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:23.292633 0.000000 udp 10.0.2.105 7010 -> 91.218.50.162 5686 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 04:05:28.853975 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 04:05:35.860796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:05:38.484808 0.742494 tcp 10.0.2.105 52258 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:39.227616 0.698412 tcp 10.0.2.105 52259 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:39.926346 1.364127 tcp 10.0.2.105 52260 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:05:41.290965 0.406318 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:41.697687 0.379719 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:42.077755 0.332089 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:42.410275 0.255130 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:42.665801 0.319703 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:42.985922 0.407922 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:43.394253 0.442547 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:43.837145 0.454497 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:43.861724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:05:44.292033 0.877891 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:45.170347 0.530484 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:45.701171 0.301692 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:46.003247 0.406918 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:46.410548 0.450478 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:46.861452 0.363814 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:47.225667 0.345740 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:47.571813 0.406272 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:47.978506 0.828279 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:05:59.864880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:06:31.871215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:12:35.877804 3.000757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:12:42.884230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:12:50.886064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:13:06.888699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:13:38.894786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:19:42.900747 3.001883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:19:49.908846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:19:57.910063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:20:13.912746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:20:45.919324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:22:13.826234 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 04:22:13.826331 2.153636 tcp 10.0.2.105 52261 -> 128.255.183.224 9027 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:26:49.925056 3.001820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:26:56.932711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:27:04.934290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:27:20.937216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:27:52.942813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:33:56.949000 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:34:03.956703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:34:11.958239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:34:27.960829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:34:59.966743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:35:53.804508 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 04:35:53.804658 0.000000 udp 10.0.2.105 7010 -> 217.247.156.177 6828 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 04:36:12.643378 0.546422 tcp 10.0.2.105 52262 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:13.190083 0.665540 tcp 10.0.2.105 52263 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:13.855969 1.403600 tcp 10.0.2.105 52264 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:15.260055 0.000000 udp 10.0.2.105 7010 -> 91.218.50.162 5686 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 04:36:33.331647 0.733583 tcp 10.0.2.105 52265 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:34.065481 0.688543 tcp 10.0.2.105 52266 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:34.754329 1.377583 tcp 10.0.2.105 52267 -> 195.113.214.234 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:36:36.131013 0.496466 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:36.627845 0.361098 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:36.989346 4.353502 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:41.343239 0.460982 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:41.804670 0.279340 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:42.084475 0.375391 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:42.460471 0.376878 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:42.837739 0.687580 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:43.525729 0.511128 udp 10.0.2.105 7010 <-> 70.25.60.54 5335 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:44.037215 0.496197 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:44.533813 1.080790 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:45.614940 0.537825 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:46.153171 0.458183 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:46.611753 0.390634 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:47.002722 0.415734 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:47.418856 0.476320 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:47.895587 0.471177 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:48.367155 0.543710 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:48.911215 0.440323 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:49.351940 0.544167 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:49.896525 0.439746 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:50.336671 0.739775 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:51.076788 0.439733 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:51.516929 0.432796 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:51.950177 0.445882 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:52.396584 0.904267 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:53.301245 0.294822 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:53.596648 0.295303 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:53.892355 0.345899 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:54.238589 0.425102 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:54.664056 0.421750 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:55.086207 0.417723 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:55.504684 0.324419 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:55.829507 0.406965 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:56.236888 0.551234 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:56.788640 0.319139 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:57.108154 0.524174 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:57.632684 0.323099 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:57.956218 0.300832 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:58.257438 0.299818 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:58.557719 0.451593 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:59.009699 0.893625 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 04:36:59.168003 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 04:41:03.972825 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 04:41:10.980242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:41:18.981584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:41:34.984750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:42:06.991154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:48:10.997204 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:48:18.004349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:48:26.006025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:48:42.009051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:49:14.014814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:52:15.987547 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 04:52:15.987705 1.979442 tcp 10.0.2.105 52268 -> 128.255.183.224 9027 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/01/11 04:55:18.021431 3.000856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 04:55:25.028583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:55:33.029922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:55:49.032914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 04:56:21.038953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:02:25.045633 3.000588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:02:32.052077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:02:40.053678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:02:56.056789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:03:28.062906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:07:27.697878 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 05:07:27.697967 0.574703 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:28.273073 0.548859 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:28.822287 0.314819 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:29.137455 4.607574 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:33.745429 0.402071 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:34.147852 0.398903 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:34.547124 0.376279 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:34.923806 0.455096 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:35.379298 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 05:07:51.163618 0.688695 tcp 10.0.2.105 52269 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:07:51.852154 0.654995 tcp 10.0.2.105 52270 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:07:52.507006 1.338979 tcp 10.0.2.105 52271 -> 195.113.214.234 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:07:53.846455 0.522682 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:54.369520 1.187279 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:55.557171 0.450496 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:56.008028 0.461734 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:56.470155 0.392855 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:56.863338 0.411748 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:57.275504 0.485266 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:57.761130 0.485627 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:58.247149 0.542065 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:58.789584 0.479387 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:59.269320 0.516437 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:07:59.786190 0.451726 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:00.238318 0.720986 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:00.959686 0.451914 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:01.411991 0.457490 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:01.869886 0.416456 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:02.286834 0.383059 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:02.670216 0.376457 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:03.047119 0.341598 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:03.389111 0.513704 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:03.903182 0.319528 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:04.223158 0.404247 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:04.627789 0.507863 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:05.136045 0.492412 udp 10.0.2.105 7010 <-> 84.188.10.95 2865 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:05.628866 0.215103 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:05.844346 0.466915 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:06.311660 0.397883 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:06.709980 0.506598 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:07.217042 0.333234 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:07.550674 0.407461 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:07.958534 0.349563 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:08.308629 0.360427 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:08:08.669481 1.286679 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:09:32.068752 3.001458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 05:09:39.076000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:09:47.077574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:10:03.080784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:10:35.087144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:16:39.093154 3.001385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:16:46.100216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:16:54.101803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:17:10.104897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:17:42.110794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:22:17.967838 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 05:22:17.967985 0.959185 tcp 10.0.2.105 52272 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:23:46.116375 3.002391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:23:53.124396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:24:01.125644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:24:17.128641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:24:49.134986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:30:53.141287 3.010841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:31:00.158172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:31:08.159347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:31:24.162736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:31:56.168848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:38:00.175527 3.000579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:38:07.182486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:38:15.183794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:38:31.186463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:38:35.643836 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 05:38:35.643935 0.000000 udp 10.0.2.105 7010 -> 70.25.60.54 5335 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 05:38:53.700487 0.069895 tcp 10.0.2.105 52273 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:38:53.770674 0.069843 tcp 10.0.2.105 52274 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:38:53.840800 0.183745 tcp 10.0.2.105 52275 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:38:54.025146 0.185770 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:54.211313 0.297317 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:54.509036 0.026440 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:54.535881 0.192371 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:54.728632 3.947801 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:58.676834 0.082955 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:58.760118 0.120973 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:58.881479 0.061891 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:58.943770 0.144731 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:59.088847 0.625398 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:59.714604 0.167625 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:38:59.882632 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 05:39:03.192718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:39:17.143510 0.073054 tcp 10.0.2.105 52276 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:17.216496 0.074031 tcp 10.0.2.105 52277 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:17.290826 0.169568 tcp 10.0.2.105 52278 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:17.460871 0.552684 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.013977 0.177926 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.192305 0.145398 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.338164 0.155586 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.494118 0.185598 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.680133 0.142014 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:18.822561 0.183579 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.006483 0.146197 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.153113 0.346192 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.499721 0.160213 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.660488 0.145320 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.806209 0.045343 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.851917 0.107324 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:19.959720 0.102207 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.062346 0.037602 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.100315 0.193753 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.294458 0.043243 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.338058 0.121868 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.460271 0.094781 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:20.555446 0.000000 udp 10.0.2.105 7010 -> 84.188.10.95 2865 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 05:39:36.041046 0.073486 tcp 10.0.2.105 52279 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:36.114774 0.086067 tcp 10.0.2.105 52280 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:36.201094 0.169825 tcp 10.0.2.105 52281 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:39:36.371380 0.020082 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:36.391793 0.217490 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:36.609701 0.143118 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:36.753238 0.254013 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:37.007631 0.053026 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:37.061043 0.165564 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:37.227000 0.053656 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:37.281019 0.063207 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:39:37.344676 0.576132 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/11 05:45:07.198888 3.092018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:45:14.296003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:45:22.297884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:45:38.300829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:46:10.306526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:52:14.312789 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:52:18.967380 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 05:52:18.967473 0.929425 tcp 10.0.2.105 52282 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/11 05:52:21.320177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:52:29.321914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:52:45.324927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:53:17.330407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:59:21.337164 3.000913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 05:59:28.343862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:59:36.346032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 05:59:52.348922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:00:24.354673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:06:28.361142 3.001544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:06:35.368125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:06:43.369963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:06:59.372843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:07:31.378339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:09:46.373173 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 06:09:46.373357 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:10:01.827150 0.073475 tcp 10.0.2.105 52283 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:01.900972 0.076010 tcp 10.0.2.105 52284 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:01.977292 0.173157 tcp 10.0.2.105 52285 -> 195.113.214.234 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:02.150707 0.000000 udp 10.0.2.105 7010 -> 84.188.10.95 2865 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:10:19.110610 0.065907 tcp 10.0.2.105 52286 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:19.176846 0.074325 tcp 10.0.2.105 52287 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:19.251506 0.174603 tcp 10.0.2.105 52288 -> 195.113.214.234 443 SRPA* 0 0 24 14778 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:19.426593 0.184675 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:19.611643 0.053918 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:19.665992 0.295166 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:19.961557 0.191975 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:20.153889 0.061089 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:20.215368 0.130780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:20.346569 0.071525 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:20.418428 4.080825 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:24.499645 0.121985 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:24.621998 1.012196 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:25.634588 0.168001 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:25.802995 0.086931 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:25.890311 0.177422 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.068089 0.155955 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.224557 0.184345 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.409244 0.141518 udp 10.0.2.105 7010 <-> 71.85.116.125 6456 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.551104 0.178537 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.730037 0.149455 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:26.879887 0.144888 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.025125 0.055564 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.081097 0.092043 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.173468 0.099845 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.273681 0.037354 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.311431 0.157294 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.469061 0.333194 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.802642 0.151271 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:27.954317 0.000000 udp 10.0.2.105 7010 -> 5.245.114.45 9694 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:10:45.969266 0.072628 tcp 10.0.2.105 52289 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:46.042182 0.072943 tcp 10.0.2.105 52290 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:46.115481 0.177946 tcp 10.0.2.105 52291 -> 195.113.214.234 443 SRPA* 0 0 51 35142 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:10:46.293260 0.093492 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:46.387157 0.193093 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:46.580629 0.043530 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:46.624711 0.020107 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:46.645215 0.233530 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:46.879100 0.149587 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:47.029003 0.218282 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:10:47.247685 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:11:06.208565 0.072737 tcp 10.0.2.105 52292 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:11:06.281543 0.074201 tcp 10.0.2.105 52293 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:11:06.356029 0.173549 tcp 10.0.2.105 52294 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:11:06.530194 0.063516 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:11:06.594097 1.668350 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:11:08.262856 0.194228 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:11:08.457487 0.053473 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:13:35.384821 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 06:13:42.392261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:13:50.393793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:14:06.396482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:14:38.402880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:20:42.408966 3.000993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:20:49.416010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:20:57.417559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:21:13.421071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:21:45.426349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:22:19.896380 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 06:22:19.896457 1.305275 tcp 10.0.2.105 52295 -> 128.255.183.224 9027 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:27:49.433167 3.001164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:27:56.440118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:28:04.441316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:28:20.444697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:28:52.450759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:34:56.455979 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:35:03.464031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:35:11.465802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:35:27.468559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:35:59.805026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:41:26.765759 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 06:41:26.765848 0.120464 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:26.886723 0.053019 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:26.940144 0.060054 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.000616 0.290351 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.291371 0.056240 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.347999 0.180535 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.528938 0.189006 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.718335 0.151840 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.870575 0.070731 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:27.941704 3.558980 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:31.501095 0.123093 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:31.624717 0.155017 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:31.780073 0.168554 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:31.949046 0.258006 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.207409 0.082980 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.290780 0.180710 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.471878 0.153842 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.626133 0.143538 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.770063 0.039400 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.809840 0.071863 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:41:32.882105 0.000000 udp 10.0.2.105 7010 -> 72.201.209.113 1245 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:41:48.838672 0.072968 tcp 10.0.2.105 52296 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:41:48.911431 0.074343 tcp 10.0.2.105 52297 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:41:48.986181 0.168687 tcp 10.0.2.105 52298 -> 195.113.214.234 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:41:49.155249 0.000000 udp 10.0.2.105 7010 -> 71.85.116.125 6456 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 06:42:03.811494 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:42:06.983320 0.074292 tcp 10.0.2.105 52299 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:42:07.057550 0.066534 tcp 10.0.2.105 52300 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:42:07.124428 0.167476 tcp 10.0.2.105 52301 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:42:07.290772 0.181916 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:07.473086 0.335292 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:07.808780 0.143132 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:07.952288 0.037445 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:07.990139 0.525286 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:08.515779 0.157922 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:08.674047 0.094390 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:08.768766 0.020512 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:08.789679 0.215745 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.005838 0.147807 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.154049 0.258690 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.425054 0.043248 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.468710 0.191967 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.661037 0.062336 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.723770 0.053748 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:09.777893 0.533240 udp 10.0.2.105 7010 <-> 27.51.9.97 9776 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:10.311524 0.164764 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 06:42:10.818348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:42:18.820444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:42:34.823022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:43:06.829135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:49:10.834860 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:49:17.842674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:49:25.843587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:49:41.847039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:50:13.853197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:52:21.367298 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 06:52:21.367444 0.958963 tcp 10.0.2.105 52302 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/11 06:56:17.858550 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 06:56:24.866081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:56:32.868200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:56:48.870766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 06:57:20.876915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:03:24.883604 3.001124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:03:31.890066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:03:39.891898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:03:55.894730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:04:27.901000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:10:31.907083 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:10:38.914063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:10:46.915637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:11:02.918620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:11:34.925351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:12:18.367714 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 07:12:18.367814 0.000000 udp 10.0.2.105 7010 -> 71.85.116.125 6456 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:12:34.342637 0.275837 tcp 10.0.2.105 52303 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:34.417145 1.257476 tcp 10.0.2.105 52304 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:34.788270 0.791218 tcp 10.0.2.105 52305 -> 195.113.214.234 443 SRPA* 0 0 14 3450 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:35.580113 0.184556 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:12:35.765089 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:12:52.937669 0.069365 tcp 10.0.2.105 52306 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:53.007394 0.693551 tcp 10.0.2.105 52307 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:53.700495 4.717791 tcp 10.0.2.105 52308 -> 195.113.214.234 443 SRPA* 0 0 55 40536 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:12:58.417623 0.054674 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:12:58.472743 0.118359 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:12:58.591458 0.000000 udp 10.0.2.105 7010 -> 95.82.6.151 1369 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:13:14.809338 0.070048 tcp 10.0.2.105 52309 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:14.879670 0.075186 tcp 10.0.2.105 52310 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:14.955217 0.371561 tcp 10.0.2.105 52311 -> 195.113.214.234 443 FSRP* 0 0 23 6818 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:15.324167 0.191319 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:15.515921 0.123872 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:15.640168 0.084556 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:15.725135 0.174499 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:15.900073 0.030652 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:15.931100 0.299600 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:16.231105 0.092513 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:16.323990 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:13:33.625879 0.375772 tcp 10.0.2.105 52312 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:34.001960 0.071038 tcp 10.0.2.105 52313 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:34.072963 0.167162 tcp 10.0.2.105 52314 -> 195.113.214.234 443 SRPA* 0 0 15 4338 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:34.240899 0.121755 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:34.363057 0.000000 udp 10.0.2.105 7010 -> 99.26.224.9 5585 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:13:53.094611 0.069771 tcp 10.0.2.105 52315 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:53.164660 0.078872 tcp 10.0.2.105 52316 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:53.243859 0.232919 tcp 10.0.2.105 52317 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:13:53.477303 0.169238 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:53.646917 0.043293 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:53.690621 0.073727 udp 10.0.2.105 7010 <-> 79.0.63.15 2691 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:53.764700 0.176101 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:53.941151 0.146630 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.088144 0.146077 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.234661 0.137693 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.372744 0.037178 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.410312 0.177445 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.588188 0.335831 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:54.924421 0.101532 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:13:55.026393 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:14:11.670766 0.072597 tcp 10.0.2.105 52318 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:11.743720 4.414250 tcp 10.0.2.105 52319 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:12.257181 0.574168 tcp 10.0.2.105 52320 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:12.831955 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:14:29.125893 0.975619 tcp 10.0.2.105 52321 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:30.101372 1.930285 tcp 10.0.2.105 52322 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:30.795788 0.165935 tcp 10.0.2.105 52323 -> 195.113.214.234 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:30.962535 0.020810 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:30.983739 0.211805 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:31.195965 0.149105 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:31.345434 0.193171 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:31.538971 0.064909 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:31.604288 0.053642 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:31.658315 0.000000 udp 10.0.2.105 7010 -> 27.51.9.97 9776 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:14:46.761175 0.692258 tcp 10.0.2.105 52324 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:47.453302 0.078690 tcp 10.0.2.105 52325 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:47.532279 1.454145 tcp 10.0.2.105 52326 -> 195.113.214.234 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:14:48.986890 0.201656 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:49.188883 0.043482 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:14:49.232800 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:15:07.731670 0.974248 tcp 10.0.2.105 52327 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:15:08.705801 0.070110 tcp 10.0.2.105 52328 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:15:08.776371 0.166704 tcp 10.0.2.105 52329 -> 195.113.214.234 443 SRPA* 0 0 29 14134 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:17:38.931401 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 07:17:45.938561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:17:53.940044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:18:09.942561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:18:41.948587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:22:22.326641 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 07:22:22.326767 1.086588 tcp 10.0.2.105 52330 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:24:45.954748 3.001388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:24:52.961951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:25:00.963666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:25:16.966939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:25:48.973058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:31:52.978567 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:31:59.985895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:32:07.987538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:32:23.990966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:32:55.996935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:39:00.002680 3.002062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:39:07.010261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:39:15.011326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:39:31.014929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:40:03.020666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:45:25.264541 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 07:45:25.264724 0.289915 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:25.565623 0.067011 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:25.633058 0.148822 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:25.782279 0.155351 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:25.938019 0.159000 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:26.097402 0.115694 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:26.213504 0.000000 udp 10.0.2.105 7010 -> 27.51.9.97 9776 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:45:44.704164 0.077087 tcp 10.0.2.105 52331 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:45:44.781522 0.078915 tcp 10.0.2.105 52332 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:45:44.860732 0.175323 tcp 10.0.2.105 52333 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:45:45.036682 0.169587 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.206672 0.184808 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.391873 0.116960 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.509243 0.058280 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.567904 0.075082 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.643453 0.071002 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.714846 0.262549 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:45.977858 0.028004 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.006285 0.130902 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.137602 0.192920 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.330922 0.182979 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.514303 0.120095 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.634790 0.176852 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.812032 0.169194 udp 10.0.2.105 7010 <-> 99.128.195.100 2291 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:46.981574 0.043197 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:47.025175 0.141888 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:45:47.167445 0.000000 udp 10.0.2.105 7010 -> 79.0.63.15 2691 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 07:46:02.607998 0.069191 tcp 10.0.2.105 52334 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:46:02.677468 0.127456 tcp 10.0.2.105 52335 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:46:02.804749 0.167972 tcp 10.0.2.105 52336 -> 195.113.214.234 443 SRPA* 0 0 54 33198 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:46:02.973303 0.177804 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.151504 0.340894 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.492841 0.037899 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.531097 0.139370 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.670862 0.183812 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.855036 0.101943 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:03.957407 0.228385 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.186144 0.020631 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.207146 0.070441 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.277958 0.188363 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.466746 0.147080 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.614222 0.061041 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.675656 0.192818 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:04.868870 0.044026 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 07:46:07.026730 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 07:46:14.034611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:46:22.036890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:46:38.039014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:47:10.044336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:52:23.415766 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 07:52:23.415864 0.995360 tcp 10.0.2.105 52337 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/11 07:53:14.051105 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 07:53:21.058049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:53:29.059251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:53:45.062759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 07:54:17.068437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:00:21.073922 3.002450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:00:28.081900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:00:36.083638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:00:52.086329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:01:24.092686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:07:28.099334 3.000648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:07:35.106257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:07:43.107781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:07:59.110178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:08:31.116254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:14:35.122041 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:14:42.130229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:14:50.131859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:15:06.134190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:15:38.140725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:16:25.208653 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 08:16:25.208840 0.000000 udp 10.0.2.105 7010 -> 79.0.63.15 2691 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:16:40.242158 0.075526 tcp 10.0.2.105 52338 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:40.317976 0.076767 tcp 10.0.2.105 52339 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:40.395038 0.171383 tcp 10.0.2.105 52340 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:40.567116 0.882961 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:41.450446 0.154874 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:41.605729 0.155905 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:41.761990 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:16:58.106062 0.249266 tcp 10.0.2.105 52341 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:58.355606 0.071759 tcp 10.0.2.105 52342 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:58.427601 0.172901 tcp 10.0.2.105 52343 -> 195.113.214.234 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:16:58.600720 0.290500 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:58.891578 0.060960 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:58.954493 0.165572 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:59.120471 0.053858 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:16:59.174738 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:17:17.464504 0.073858 tcp 10.0.2.105 52344 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:17.538611 0.070775 tcp 10.0.2.105 52345 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:17.609755 0.172465 tcp 10.0.2.105 52346 -> 195.113.214.234 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:17.782851 0.117532 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:17.900769 0.185017 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.086202 0.216849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.303464 0.030244 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.334033 0.131003 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.465429 0.084504 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.550357 0.120135 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.670878 0.144403 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:18.815641 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:17:34.348653 0.069569 tcp 10.0.2.105 52347 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:34.418078 0.074600 tcp 10.0.2.105 52348 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:34.492978 0.174232 tcp 10.0.2.105 52349 -> 195.113.214.234 443 SRPA* 0 0 24 10462 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:17:34.667646 0.040497 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:34.708698 0.144078 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:34.853163 0.193857 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.047415 0.195944 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.243762 0.186650 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.430809 0.336288 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.767466 0.036586 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.804462 0.139349 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:35.944358 0.186098 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.130834 0.103687 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.234896 0.241748 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.477042 0.020656 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.498050 0.061788 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.560168 0.066500 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.627044 0.206420 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.833857 0.043612 udp 10.0.2.105 7010 <-> 79.253.224.170 2373 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:36.877854 0.188921 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:17:37.067186 0.267413 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:21:42.216117 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 08:21:49.223875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:21:57.225424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:22:13.228719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:22:24.485218 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 08:22:24.485386 0.977155 tcp 10.0.2.105 52350 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:22:45.234617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:28:49.240879 3.001166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:28:56.248131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:29:04.249572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:29:20.252839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:29:52.258561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:35:56.264281 3.001786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:36:03.272099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:36:11.273263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:36:27.276317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:36:59.282785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:43:03.288654 3.031956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:43:10.326379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:43:18.327435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:43:34.330756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:44:06.336506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:47:55.746969 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 08:47:55.747175 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:48:12.151275 0.065828 tcp 10.0.2.105 52351 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:12.217350 0.075539 tcp 10.0.2.105 52352 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:12.293257 0.162267 tcp 10.0.2.105 52353 -> 195.113.214.234 443 SRPA* 0 0 65 45723 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:12.454560 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:48:29.786065 0.073641 tcp 10.0.2.105 52354 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:29.859558 0.070650 tcp 10.0.2.105 52355 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:29.930501 0.163409 tcp 10.0.2.105 52356 -> 195.113.214.234 443 SRPA* 0 0 28 12150 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:30.094524 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 2291 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:48:47.331272 0.103845 tcp 10.0.2.105 52357 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:47.435402 0.073611 tcp 10.0.2.105 52358 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:47.509307 0.166729 tcp 10.0.2.105 52359 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:48:47.676600 0.164342 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:47.841369 0.154352 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:47.996129 0.156998 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.153502 0.059454 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.213374 0.059820 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.273591 0.296297 udp 10.0.2.105 7010 <-> 95.82.6.151 1369 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.570249 0.167418 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.738073 0.209058 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.947482 0.044765 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:48.992674 0.117877 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.110944 0.186271 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.297609 0.148127 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.446087 0.083321 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.529797 0.144690 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.674865 0.120490 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.795712 0.142088 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:49.938190 0.143229 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:50.081784 0.192508 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:50.274711 0.198177 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:48:50.473311 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:49:07.559980 0.069830 tcp 10.0.2.105 52360 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:07.630058 0.075702 tcp 10.0.2.105 52361 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:07.706116 0.173616 tcp 10.0.2.105 52362 -> 195.113.214.234 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:07.880432 0.142362 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:08.023205 0.187232 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:08.210844 0.106895 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:08.318146 0.741083 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.059570 0.337556 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.397520 0.212727 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.610599 0.020567 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.631529 0.063289 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.695174 0.057131 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:09.752732 0.278916 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:10.032051 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 08:49:28.009855 0.076189 tcp 10.0.2.105 52363 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:28.086352 0.078589 tcp 10.0.2.105 52364 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:28.165300 0.177015 tcp 10.0.2.105 52365 -> 195.113.214.234 443 SRPA* 0 0 25 14712 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:49:28.342913 0.191529 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:49:28.534837 0.143336 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/11 08:50:10.342272 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 08:50:17.349673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:50:25.351375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:50:41.354476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:51:13.360190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:52:25.464418 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 08:52:25.464516 0.893045 tcp 10.0.2.105 52366 -> 128.255.183.224 9027 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/01/11 08:57:17.366944 3.001532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 08:57:24.374207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:57:32.375754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:57:48.378238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 08:58:20.384330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:04:24.390039 3.002084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:04:31.398149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:04:39.399638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:04:55.402191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:05:27.408404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:11:31.415069 3.001001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:11:38.421519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:11:46.423022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:12:02.426030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:12:34.432559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:18:38.438136 3.011821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:18:45.455936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:18:53.457638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:19:09.460524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:19:41.466335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:19:55.807337 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 09:19:55.807434 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 09:20:14.375964 0.073841 tcp 10.0.2.105 52367 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:14.450074 0.075143 tcp 10.0.2.105 52368 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:14.525468 0.157318 tcp 10.0.2.105 52369 -> 195.113.214.234 443 SRPA* 0 0 57 36867 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:14.683420 0.000000 udp 10.0.2.105 7010 -> 79.253.224.170 2373 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 09:20:33.431805 0.075495 tcp 10.0.2.105 52370 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:33.507586 0.072333 tcp 10.0.2.105 52371 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:33.579773 0.175465 tcp 10.0.2.105 52372 -> 195.113.214.234 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:33.754251 0.055838 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:33.810504 0.066646 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:33.877562 0.150823 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.028794 0.153258 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.182411 0.161342 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.344122 0.035505 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.380019 0.115714 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.496113 0.165033 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:34.661488 0.000000 udp 10.0.2.105 7010 -> 95.82.6.151 1369 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 09:20:53.660688 0.070476 tcp 10.0.2.105 52373 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:53.731450 0.075261 tcp 10.0.2.105 52374 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:53.806993 0.174559 tcp 10.0.2.105 52375 -> 195.113.214.234 443 SRPA* 0 0 24 14056 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:20:53.982014 0.187438 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:54.169863 0.224937 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:54.395148 0.120537 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:54.516095 0.304460 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:54.820949 0.145665 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:54.967029 0.191826 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.159257 0.143380 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.302989 0.144578 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.447961 0.143868 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.592196 0.199710 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.792516 0.121388 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:55.914271 0.222566 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.137238 0.193937 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.331502 0.339580 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.671479 0.180360 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.852159 0.065787 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.918347 0.064303 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:56.983073 0.191321 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:57.174874 0.321983 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:57.497255 0.020596 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:57.518177 0.193652 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:20:57.712483 0.143033 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:22:26.364096 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 09:22:26.364200 0.999337 tcp 10.0.2.105 52376 -> 128.255.183.224 9027 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:25:45.473101 3.000745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 09:25:52.479868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:26:00.481451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:26:16.484333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:26:48.490518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:32:52.496713 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:32:59.503885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:33:07.505166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:33:23.507943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:33:55.514520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:39:59.519802 3.002376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:40:06.527680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:40:14.529125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:40:30.572248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:41:02.578104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:47:06.585438 3.000884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 09:47:13.591959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:47:21.593419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:47:37.596263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:48:09.601957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:51:11.083629 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 09:51:11.083731 0.000000 udp 10.0.2.105 7010 -> 95.82.6.151 1369 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 09:51:29.030887 0.069833 tcp 10.0.2.105 52377 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:51:29.101050 0.076599 tcp 10.0.2.105 52378 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:51:29.177949 0.171051 tcp 10.0.2.105 52379 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:51:29.349614 0.431871 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:29.781867 0.155421 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:29.937677 0.155828 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.093845 0.027353 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.121579 0.060080 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.182045 0.056058 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.238516 0.178719 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.417666 0.115615 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.533690 0.183712 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.717828 0.218622 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:30.936843 0.148782 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.085954 0.117340 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.203682 0.140564 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.344590 0.193144 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.538167 0.142901 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.681456 0.195877 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.877707 0.102753 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:31.980806 0.139127 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:32.120281 0.180782 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:32.301433 0.151712 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:32.453515 0.071330 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:32.525250 0.334735 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:32.860539 0.254623 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.116085 0.064336 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.180759 0.062225 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.243434 0.193369 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.437168 0.188939 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.626472 0.156468 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:33.783355 0.245423 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:51:34.029168 0.019953 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 09:52:27.373254 0.946383 tcp 10.0.2.105 52380 -> 128.255.183.224 9027 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/01/11 09:54:13.608718 3.000906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 09:54:20.615777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:54:28.617419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:54:44.620462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 09:55:16.626115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:01:20.632847 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:01:27.639840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:01:35.641468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:01:51.643966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:02:23.650013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:08:27.656838 3.000938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:08:34.663658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:08:42.665594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:08:58.668446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:09:30.674089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:15:34.680669 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:15:41.687931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:15:49.689231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:16:05.691919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:16:37.697946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:21:55.385389 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 10:21:55.385490 0.157495 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:55.543427 0.110825 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:55.654676 0.086520 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:55.741556 0.054842 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:55.796755 0.147173 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:55.944339 0.155785 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.100523 0.168940 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.269833 0.120205 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.390385 0.184223 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.575018 0.259274 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.834668 0.120620 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:56.955632 0.168057 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.124027 0.144447 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.268882 0.190923 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.460411 0.181108 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.641937 0.193257 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.835589 0.100693 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:57.936675 0.140799 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:58.077823 0.180586 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:58.258814 0.144708 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:58.403941 0.071611 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:58.475900 0.365966 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:58.842259 0.177740 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:21:59.020508 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 10:22:16.847955 0.065910 tcp 10.0.2.105 52381 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:22:16.914193 0.073663 tcp 10.0.2.105 52382 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:22:16.988184 0.177207 tcp 10.0.2.105 52383 -> 195.113.214.234 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:22:17.165863 0.063126 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:17.229346 0.147265 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:17.377021 0.223468 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:17.600858 0.020191 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:17.621445 0.190271 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:17.812112 0.191483 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:22:28.322361 0.894424 tcp 10.0.2.105 52384 -> 128.255.183.224 9027 FSPA* 0 0 14 1671 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:22:41.704747 3.001388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 10:22:48.711413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:22:56.712986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:23:12.715873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:23:44.722132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:29:48.728492 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:29:55.735949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:30:03.737376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:30:19.739851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:30:51.746145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:36:55.752510 3.001319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:37:02.759539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:37:10.761199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:37:26.763809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:37:58.770295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:44:02.776782 3.030870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:44:09.813469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:44:17.814979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:44:33.817718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:45:05.823857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:51:09.829952 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 10:51:16.837473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:51:24.838962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:51:40.841933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:52:12.847716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:52:29.221890 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 10:52:29.222119 0.980719 tcp 10.0.2.105 52385 -> 128.255.183.224 9027 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:52:45.726183 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 10:53:03.803562 0.073683 tcp 10.0.2.105 52386 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:53:03.877550 0.074636 tcp 10.0.2.105 52387 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:53:03.952576 0.180623 tcp 10.0.2.105 52388 -> 195.113.214.234 443 SRPA* 0 0 34 26336 flow=From-Botnet-V2-TCP-Established 1970/01/11 10:53:04.133900 0.101138 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.235499 0.060852 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.296659 0.070183 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.367245 0.182823 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.550442 0.154444 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.705291 0.266240 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:04.971891 0.115543 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.087856 0.159756 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.247957 0.186748 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.435065 0.170321 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.605760 0.141875 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.748060 0.120605 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:05.869041 0.212498 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.081928 0.194118 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.276460 0.102796 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.379666 0.140163 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.520382 0.176753 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.697562 0.124060 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:06.822009 0.193418 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.015800 0.222736 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.238914 0.070213 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.309529 0.338004 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.647921 0.172959 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.821225 0.056307 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:07.877913 0.144855 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:08.023131 0.254694 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:08.278156 0.189391 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:08.467981 0.211221 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:53:08.679610 0.020199 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/11 10:58:16.854444 3.001188 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 10:58:23.861476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:58:31.862603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:58:47.865751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 10:59:19.871703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:05:23.878558 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:05:30.885211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:05:38.887186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:05:54.889749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:06:26.895664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:12:30.901667 3.002048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:12:37.909489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:12:45.910533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:13:01.913734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:13:33.919621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:19:37.926592 3.000916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:19:44.933682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:19:52.934936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:20:08.938111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:20:40.943592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:22:30.211602 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 11:22:30.211700 0.991489 tcp 10.0.2.105 52389 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:15.586632 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 11:23:20.462983 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 11:23:33.353810 0.069613 tcp 10.0.2.105 52390 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:33.423704 0.078356 tcp 10.0.2.105 52391 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:33.501877 0.147476 tcp 10.0.2.105 52392 -> 195.113.214.234 443 SRPA* 0 0 33 23891 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:33.650006 0.040827 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:33.691243 0.062377 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:33.754033 0.459302 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:34.213705 0.132277 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:34.346330 0.159160 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:34.505872 0.232644 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:34.738878 0.156403 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:34.895625 0.183393 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.079454 0.245350 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.325204 0.144645 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.470181 0.122045 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.592657 0.214102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.807150 0.188670 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:35.996176 0.100999 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:36.097601 0.130873 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:36.228862 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 11:23:53.431352 0.069689 tcp 10.0.2.105 52393 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:53.501323 0.084204 tcp 10.0.2.105 52394 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:53.585690 0.185653 tcp 10.0.2.105 52395 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:23:53.771613 0.149509 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:53.921515 0.083810 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.005692 0.142418 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.148631 0.181964 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.330942 0.336342 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.667676 0.182695 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.850796 0.054435 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:54.905657 0.147003 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:55.053172 0.242168 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:55.295684 0.020122 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:55.316205 0.191537 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:23:55.508138 0.224779 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:26:44.970768 3.000583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 11:26:51.977632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:26:59.978769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:27:15.981783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:27:47.987640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:33:51.994046 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:33:59.000944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:34:07.002871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:34:23.005713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:34:55.011917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:40:59.018327 3.010834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:41:06.035225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:41:14.036971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:41:30.039627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:42:02.046026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:48:06.052562 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 11:48:13.058878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:48:21.060410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:48:37.064082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:49:09.069731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:52:31.211080 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 11:52:31.211231 0.969060 tcp 10.0.2.105 52396 -> 128.255.183.224 9027 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:54:10.613989 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 11:54:10.614165 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 11:54:27.929793 0.073702 tcp 10.0.2.105 52397 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:54:28.003767 0.070858 tcp 10.0.2.105 52398 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:54:28.074919 0.136759 tcp 10.0.2.105 52399 -> 195.113.214.234 443 SRPA* 0 0 34 25405 flow=From-Botnet-V2-TCP-Established 1970/01/11 11:54:28.212179 0.200808 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:28.413386 0.027541 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:28.441287 0.066398 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:28.508099 1.583157 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.091621 0.151159 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.243178 0.155540 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.399123 0.156473 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.555998 0.120910 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.677273 0.183451 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.861119 0.120267 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:30.981780 0.220132 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.202266 0.188666 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.391336 0.102550 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.494294 0.144917 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.639568 0.039519 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.679514 0.146166 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.826081 0.142586 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:31.969000 0.184411 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.153822 0.154963 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.309124 0.072725 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.382233 0.345569 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.728351 0.181089 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.909795 0.054988 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:32.965350 0.150881 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:33.116644 0.214530 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:33.331566 0.020526 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:33.352577 0.189864 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:54:33.542858 0.446025 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/11 11:55:13.075983 3.001162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 11:55:20.083104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:55:28.084681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:55:44.087649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 11:56:16.094092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:02:20.099459 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:02:27.107479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:02:35.108652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:02:51.111440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:03:23.117636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:09:27.124191 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:09:34.131490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:09:42.133206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:09:58.136652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:10:30.141865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:16:34.147539 3.001854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:16:41.155168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:16:49.156403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:17:05.159928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:17:37.165883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:22:32.180653 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 12:22:32.180763 1.008937 tcp 10.0.2.105 52400 -> 128.255.183.224 9027 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:23:41.171888 3.001347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:23:48.178719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:23:56.180862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:24:12.183720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:24:44.190047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:24:51.069996 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 12:24:51.070183 0.062193 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.132779 0.199903 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.333070 0.155356 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.488809 0.168636 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.657877 0.149559 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.807849 0.155954 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:51.964180 0.156315 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.120865 0.116183 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.237485 0.183827 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.421688 0.121253 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.543342 0.225741 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.769472 0.188068 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:52.957951 0.101545 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:53.059902 0.144674 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:53.205018 0.040168 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:24:53.245569 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 12:25:09.287566 0.069933 tcp 10.0.2.105 52401 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:25:09.357726 0.075085 tcp 10.0.2.105 52402 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:25:09.433117 0.159802 tcp 10.0.2.105 52403 -> 195.113.214.234 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:25:09.592110 0.142095 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:09.734603 0.188414 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:09.923425 0.149071 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.072897 0.070934 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.144405 0.431575 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.576480 0.177661 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.754485 0.055531 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.810359 0.143578 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:10.954397 0.190386 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:11.145195 0.311686 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:11.457275 0.020485 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:25:11.478131 0.188919 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:30:48.196063 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:30:55.203080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:31:03.204818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:31:19.207627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:31:51.213713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:37:55.220612 3.000684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:38:02.227175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:38:10.228589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:38:26.231631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:38:58.237536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:45:02.243305 3.002260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:45:09.250798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:45:17.252365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:45:33.255595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:46:05.261272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:52:09.267968 3.001427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:52:16.275136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:52:24.276105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:52:33.190032 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 12:52:33.190191 0.938470 tcp 10.0.2.105 52404 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:52:40.279644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:53:12.285363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:55:23.514714 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 12:55:23.514840 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 12:55:41.351196 0.069779 tcp 10.0.2.105 52405 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:55:41.421265 0.070668 tcp 10.0.2.105 52406 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:55:41.492236 0.155591 tcp 10.0.2.105 52407 -> 195.113.214.234 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/11 12:55:41.648360 0.061419 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:41.710148 0.169300 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:41.879797 0.150595 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.030727 0.154368 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.185508 0.158148 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.344090 0.116652 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.461147 0.202857 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.664573 0.032162 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.697094 0.120109 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:42.817619 0.217678 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.035712 0.189268 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.225347 0.100790 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.326500 0.137759 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.464631 0.043710 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.508731 0.185909 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.695001 0.146517 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.841913 0.084673 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:43.926977 0.140418 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.067786 0.180270 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.248597 0.336482 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.585532 0.174101 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.760041 0.054326 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.814813 0.147826 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:44.963011 0.251741 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:45.215116 0.193015 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:45.408577 0.311704 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:55:45.720684 0.020691 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 12:59:16.292134 3.000682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 12:59:23.298759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:59:31.300418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 12:59:47.303539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:00:19.309335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:06:23.315759 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:06:30.322618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:06:38.324277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:06:54.327358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:07:26.333673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:13:30.338977 3.002461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:13:37.346722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:13:45.347989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:14:01.351266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:14:33.357185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:20:37.364340 3.000409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:20:44.370499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:20:52.372180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:21:08.375337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:21:40.381600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:22:34.130010 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 13:22:34.130099 1.054964 tcp 10.0.2.105 52408 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:25:48.879212 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 13:25:48.879310 0.158002 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.037653 0.156516 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.194581 0.061027 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.256040 0.163710 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.420158 0.160096 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.580612 0.115137 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.696163 0.201108 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.897669 0.028166 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:49.926121 0.120997 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.047510 0.216786 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.264649 0.187244 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.452446 0.171086 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.623948 0.137853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.762215 0.039829 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.802482 0.185294 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:50.988144 0.141299 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:51.129842 0.069904 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:51.200143 0.138014 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:51.338541 0.184375 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:25:51.523325 0.000000 udp 10.0.2.105 7010 -> 176.73.235.239 5805 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 13:26:09.860277 0.074927 tcp 10.0.2.105 52409 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:26:09.935511 0.074631 tcp 10.0.2.105 52410 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:26:10.010430 0.147038 tcp 10.0.2.105 52411 -> 195.113.214.234 443 SRPA* 0 0 31 16004 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:26:10.158082 0.147177 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:10.305617 0.218349 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:10.524366 0.335901 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:10.860643 0.175710 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:11.036723 0.020425 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:11.057522 0.191517 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:26:11.249438 0.390083 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:27:44.386946 3.001961 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/11 13:27:51.394454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:27:59.396126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:28:15.399441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:28:47.405118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:34:51.411474 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:34:58.418994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:35:06.419904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:35:22.423359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:35:54.428964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:41:58.434880 3.002280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:42:05.442841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:42:13.444038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:42:29.447295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:43:01.452990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:49:05.459528 3.001317 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:49:12.466318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:49:20.467822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:49:36.471499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:50:08.477416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:52:35.188778 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 13:52:35.188877 0.951295 tcp 10.0.2.105 52412 -> 128.255.183.224 9027 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:56:12.483765 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 13:56:19.490609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:56:27.492189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:56:29.595731 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 13:56:29.595901 0.000000 udp 10.0.2.105 7010 -> 176.73.235.239 5805 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 13:56:43.495155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 13:56:45.199161 0.065749 tcp 10.0.2.105 52413 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:56:45.265158 0.073911 tcp 10.0.2.105 52414 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:56:45.339319 0.156222 tcp 10.0.2.105 52415 -> 195.113.214.234 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/11 13:56:45.496013 0.059397 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:45.555828 0.151524 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:45.707756 0.156649 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:45.864827 0.155915 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.021135 0.119665 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.141153 0.195865 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.337457 0.027864 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.365661 0.121991 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.487999 0.165604 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.654038 0.218715 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:46.873247 0.152054 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.025737 0.038187 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.064286 0.182572 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.247276 0.146250 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.393903 0.070538 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.464852 0.101015 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.566298 0.189081 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.755830 0.178954 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:47.935165 0.158653 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:48.094173 0.286936 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:48.381496 0.194496 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:48.576378 0.334814 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:48.911545 0.174436 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:49.086335 0.021735 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:49.108546 0.189832 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:56:49.298809 0.384769 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/11 13:57:15.500966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:03:19.508049 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:03:26.514397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:03:34.515823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:03:50.518950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:04:22.525367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:10:26.531145 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:10:33.538779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:10:41.539988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:10:57.542912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:11:29.548918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:17:33.555375 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:17:40.562248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:17:48.564168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:18:04.566703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:18:36.573205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:22:36.148187 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 14:22:36.148425 0.981265 tcp 10.0.2.105 52416 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/11 14:24:40.579362 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:24:47.586276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:24:55.587999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:25:11.591216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:25:43.596954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:27:11.073346 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 14:27:11.073445 0.154598 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.228427 0.159093 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.387865 0.116688 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.504972 0.059600 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.564945 0.151645 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.717005 0.197617 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.915129 0.055080 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:11.970633 0.133361 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:12.104396 1.041964 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.146795 0.218933 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.366196 0.144776 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.511372 0.044730 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.556517 0.182614 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.739545 0.145791 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.885713 0.071949 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:13.958068 0.152593 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:14.111047 0.188001 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:14.299481 0.191430 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:14.491312 0.139074 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:14.630787 0.334220 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:14.965392 0.175750 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:15.141535 0.020178 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:15.162022 0.192518 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:15.354912 0.265684 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:15.621016 0.193191 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:27:15.814635 0.396604 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:31:47.603610 3.001018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:31:54.610514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:32:02.612157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:32:18.615242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:32:50.621278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:38:54.627039 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:39:01.634136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:39:09.635656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:39:25.639092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:39:57.644768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:46:01.651652 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:46:08.658181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:46:16.659532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:46:32.662875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:47:04.668873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:52:37.137277 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 14:52:37.137355 0.894348 tcp 10.0.2.105 52417 -> 128.255.183.224 9027 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/01/11 14:53:08.675199 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 14:53:15.682450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:53:23.683911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:53:39.686778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:54:11.693296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 14:57:30.759651 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 14:57:30.759748 0.154534 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:30.914694 0.155237 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.070287 0.118206 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.188878 0.060763 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.249982 0.152224 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.402587 0.200607 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.603559 0.041385 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.645318 0.119961 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.765668 0.164499 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:31.930581 0.223647 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.154627 0.144948 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.300000 0.043347 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.343732 0.185956 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.530095 0.143720 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.674172 0.078418 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.752990 0.100623 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:32.853955 0.191211 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.045511 0.179156 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.225043 0.136014 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.361377 0.334837 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.696603 0.176259 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.873247 0.020354 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:33.893886 0.219919 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:34.114131 0.393526 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:34.508017 0.192466 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 14:57:34.700898 0.145603 udp 10.0.2.105 7010 <-> 70.24.105.140 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:00:15.699450 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:00:22.706489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:00:30.707992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:00:46.711083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:01:18.716697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:07:22.722443 3.002217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:07:29.730022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:07:37.741526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:07:53.744957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:08:25.750518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:14:29.756571 3.001572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:14:36.764188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:14:44.766112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:15:00.769041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:15:32.774708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:21:36.781119 3.001614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:21:43.787899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:21:51.789408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:22:07.792874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:22:38.036630 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 15:22:38.036721 0.996856 tcp 10.0.2.105 52418 -> 128.255.183.224 9027 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:22:39.799126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:27:48.743550 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 15:27:48.743666 0.116848 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:48.860907 0.060045 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:48.921278 0.153966 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.075604 0.154837 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.230770 0.152220 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.383399 0.195406 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.579205 0.030015 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.609631 0.120646 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.730659 0.163660 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:49.894673 0.217866 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.112958 0.144855 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.258208 0.037880 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.296569 0.186537 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.483469 0.185312 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.669138 0.071261 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.740809 0.100382 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:50.841571 0.190481 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.032484 0.183262 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.216206 0.212961 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.429564 0.020209 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.450114 0.191678 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.642197 0.140218 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:51.782782 0.335172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:27:52.118319 0.000000 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 15:28:07.321824 0.073178 tcp 10.0.2.105 52419 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:28:07.395377 0.069230 tcp 10.0.2.105 52420 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:28:07.464920 0.153924 tcp 10.0.2.105 52421 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:28:07.619329 0.332868 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:28:07.952585 0.192144 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:28:43.805352 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:28:50.812355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:28:58.813954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:29:14.816390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:29:46.822792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:35:50.828151 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:35:57.836017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:36:05.837964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:36:21.840842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:36:53.856583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:42:57.862452 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:43:04.870193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:43:12.871689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:43:28.874507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:44:00.881049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:50:04.886655 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:50:11.893763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:50:19.895486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:50:35.898912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:51:07.904483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:52:39.036052 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 15:52:39.036360 0.901064 tcp 10.0.2.105 52422 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:57:11.911455 3.000809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 15:57:18.918466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:57:26.919710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:57:42.922595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:58:12.896169 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 15:58:12.896372 0.000000 udp 10.0.2.105 7010 -> 70.24.105.140 3572 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 15:58:14.928740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 15:58:27.928991 0.066652 tcp 10.0.2.105 52423 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:58:27.995916 0.065229 tcp 10.0.2.105 52424 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:58:28.061404 0.153935 tcp 10.0.2.105 52425 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/11 15:58:28.215997 0.154519 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.370872 0.153525 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.524789 0.120000 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.645191 0.066831 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.712398 0.197669 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.910449 0.028554 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:28.939399 0.153946 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.093736 0.191826 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.285934 0.159052 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.445418 0.138073 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.583893 0.036752 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.621033 0.315620 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:29.937039 0.072318 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.009698 0.100731 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.110781 0.193780 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.304958 0.189945 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.495246 0.196485 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.692066 0.150853 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.843272 0.138477 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:30.982164 0.335800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:31.318386 0.179815 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:31.498596 0.020235 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:31.519198 0.188318 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:31.707941 0.329806 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 15:58:32.038172 0.192808 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:04:18.935226 3.000815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:04:25.941673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:04:33.943518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:04:49.946316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:05:21.952523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:11:25.959261 3.001405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:11:32.965865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:11:40.967776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:11:56.970511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:12:28.976281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:18:32.982111 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:18:39.990200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:18:47.991469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:19:03.994203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:19:36.000563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:22:39.995850 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 16:22:39.995949 0.950440 tcp 10.0.2.105 52426 -> 128.255.183.224 9027 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/01/11 16:25:40.116804 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:25:47.123927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:25:55.125649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:26:11.128691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:26:43.134339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:28:36.017523 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 16:28:36.017616 0.115448 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.133415 0.060990 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.194763 0.198723 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.393837 0.031389 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.425624 0.121779 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.547813 0.175002 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.723210 0.155883 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:36.879495 0.157007 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.036860 0.152298 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.189541 0.151849 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.341769 0.038696 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.380877 0.216910 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.598195 0.072550 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.671100 0.101044 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.772534 0.187386 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:37.960488 0.145340 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:38.106222 0.142173 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:38.248770 0.342879 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:38.591964 0.182604 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:38.774960 0.185839 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:38.961214 0.176497 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:39.138183 0.019830 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:39.158409 0.242446 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:39.401265 0.397884 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:28:39.799505 0.688597 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:32:47.141041 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:32:54.147999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:33:02.149572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:33:18.152270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:33:50.158567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:39:54.165250 3.000776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:40:01.172356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:40:09.173731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:40:25.177194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:40:57.183235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:47:01.189253 3.000768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:47:08.236349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:47:16.237388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:47:32.240262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:48:04.246662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:52:40.964998 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 16:52:40.965215 0.989174 tcp 10.0.2.105 52427 -> 128.255.183.224 9027 FSPA* 0 0 12 1613 flow=From-Botnet-V2-TCP-Established 1970/01/11 16:54:08.253335 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 16:54:15.259868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:54:23.261639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:54:39.264176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:55:11.270362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 16:58:45.008353 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 16:58:45.008504 0.115304 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.124572 0.063811 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.188740 0.203111 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.392203 0.029588 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.422156 0.124226 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.546786 0.170419 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.717587 0.153996 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:45.871919 0.157488 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.029802 0.228000 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.258173 0.145001 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.403551 0.043911 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.447894 0.215944 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.664201 0.071378 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.735923 0.114259 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:46.850552 0.188517 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.039452 0.141925 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.181717 0.142097 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.324215 0.186020 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.510638 0.177938 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.688989 0.019941 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:47.709318 0.336968 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:48.046674 0.181384 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:48.228474 0.222597 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:48.451439 0.495687 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/11 16:58:48.947519 0.196968 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:01:15.276660 3.001190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:01:22.284343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:01:30.285829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:01:46.288581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:02:18.294280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:08:22.301429 3.000565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:08:29.307736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:08:37.309306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:08:53.312525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:09:25.318145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:15:29.324057 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:15:36.331890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:15:44.333701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:16:00.336803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:16:32.342491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:22:36.348734 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:22:41.954577 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 17:22:41.954653 0.967435 tcp 10.0.2.105 52428 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/11 17:22:43.355964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:22:51.357612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:23:07.360509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:23:39.366538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:29:09.271442 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 17:29:09.271632 0.114939 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.386966 0.059540 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.446849 0.201100 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.648295 0.028921 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.677615 0.144889 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.822889 0.167297 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:09.990543 0.154936 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.145879 0.153836 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.300109 0.151944 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.452520 0.144953 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.597826 0.045004 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.643171 0.226049 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.869612 0.071424 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:10.941439 0.099893 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.041756 0.190955 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.233113 0.156612 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.390126 0.139853 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.530380 0.020201 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.550899 0.336553 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:11.887863 0.184088 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:12.072367 0.183224 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:12.255990 0.179558 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:12.435951 0.188138 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:12.624509 0.190392 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:12.815254 0.443372 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:29:43.373235 3.000603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:29:50.380057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:29:58.381645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:30:14.384449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:30:46.390191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:36:50.397047 3.000640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:36:57.403694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:37:05.405679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:37:21.407960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:37:53.414238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:43:57.420154 3.001572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:44:04.427820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:44:12.429057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:44:28.432545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:45:00.438239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:51:04.444792 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:51:11.451375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:51:19.453156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:51:35.456476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:52:07.461919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:52:42.923598 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 17:52:43.034437 0.956883 tcp 10.0.2.105 52429 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/11 17:58:11.469228 3.000379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 17:58:18.475333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:58:26.476856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:58:42.479909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:59:14.486102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 17:59:29.007683 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 17:59:29.007837 0.119475 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.127679 0.029268 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.157328 0.121896 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.279643 0.171928 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.451974 0.155390 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.607785 0.155960 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.764092 0.062231 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:29.826659 0.202673 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.029740 0.149197 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.179302 0.152019 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.331752 0.038578 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.370752 0.225335 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.596525 0.070511 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.667435 0.100424 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.768338 0.188392 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:30.957133 0.175537 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:31.133000 0.136134 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:31.269535 0.020523 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:31.290462 0.335999 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:31.626882 0.210573 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:31.837865 0.182762 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:32.021000 0.261739 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:32.283069 0.495395 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:32.778891 0.179411 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/11 17:59:32.958718 0.195030 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:05:18.492515 3.001058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:05:25.499521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:05:33.501464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:05:49.504412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:06:21.510118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:12:25.516797 3.001230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:12:32.523582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:12:40.525025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:12:56.528017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:13:28.533829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:19:32.540392 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:19:39.547929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:19:47.549558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:20:03.551745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:20:35.558520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:22:43.993429 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 18:22:43.993530 0.976643 tcp 10.0.2.105 52430 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/11 18:26:39.563655 3.001959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:26:46.571539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:26:54.573018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:27:10.576048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:27:42.582386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:29:35.084035 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 18:29:35.084155 0.121444 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.206044 0.118231 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.324714 0.028366 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.353492 0.167001 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.520892 0.153611 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.674853 0.153492 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.828753 0.061392 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:35.890551 0.198066 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.088934 0.151376 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.240846 0.151868 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.393138 0.042008 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.435560 0.226813 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.662762 0.070949 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:36.734108 0.499405 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:37.233892 0.188375 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:37.422696 0.145212 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:37.568392 0.818479 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:38.387294 0.020583 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:38.408252 0.195732 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:38.604411 0.230156 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:38.834974 0.369391 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:39.204768 0.214719 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:39.419911 0.197553 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:39.617820 0.434199 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:29:40.052421 0.175154 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:33:46.588797 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:33:53.595184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:34:01.596654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:34:17.600318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:34:49.606022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:40:53.611718 3.001969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:41:00.619754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:41:08.621163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:41:24.624095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:41:56.629990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:48:00.636320 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:48:07.643646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:48:15.645249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:48:31.648400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:49:03.653859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:52:44.973052 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 18:52:44.973155 1.035764 tcp 10.0.2.105 52431 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/11 18:55:07.660945 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 18:55:14.667238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:55:22.668979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:55:38.671654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:56:10.678127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 18:59:55.281621 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 18:59:55.281861 0.026888 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:55.309088 0.121563 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:55.431084 0.116781 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:55.548283 0.177955 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:55.726599 0.156930 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:55.883947 0.156508 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.040873 0.074821 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.116105 0.205960 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.322467 0.160743 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.483582 0.131235 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.615215 0.040695 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.656397 0.220716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.877481 0.071930 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:56.949825 0.104565 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.054720 0.142224 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.197310 0.191418 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.389148 0.144560 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.534069 0.020257 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.554689 0.185506 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:57.740548 0.274187 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:58.015090 0.359342 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:58.374829 0.503180 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:58.878357 0.178322 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:59.057031 0.204436 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/11 18:59:59.261887 0.190087 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:02:14.683890 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:02:21.691034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:02:29.693117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:02:45.696189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:03:17.702289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:09:21.707563 3.001905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:09:28.715635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:09:36.716493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:09:52.719854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:10:24.725557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:16:28.731753 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:16:35.739273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:16:43.740464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:16:59.743936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:17:31.749571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:22:46.012420 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 19:22:46.012513 0.905774 tcp 10.0.2.105 52432 -> 128.255.183.224 9027 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/01/11 19:23:35.755936 3.001278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:23:42.763408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:23:50.764817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:24:06.767753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:24:38.773622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:30:09.689833 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 19:30:09.689918 0.026992 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:09.717317 0.411024 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.128756 0.155317 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.284440 0.157454 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.442299 0.063384 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.506073 0.193355 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.699797 0.120790 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.820987 0.115472 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:10.936864 0.149942 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.087238 0.144947 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.232532 0.039345 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.272389 0.218347 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.491134 0.083152 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.574696 0.100905 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.676025 0.141637 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:11.818046 0.188348 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.006800 0.144612 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.151818 0.020374 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.172873 0.183798 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.357018 0.215625 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.573039 0.374495 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:12.947947 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 7805 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 19:30:28.738487 0.070703 tcp 10.0.2.105 52433 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 19:30:28.809503 0.075431 tcp 10.0.2.105 52434 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 19:30:28.885263 0.159443 tcp 10.0.2.105 52435 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/11 19:30:29.045238 0.485293 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:29.530942 0.179472 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:29.710850 0.188565 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 19:30:42.779496 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:30:49.787171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:30:57.788861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:31:13.792120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:31:45.798145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:37:49.803849 3.001427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:37:56.810843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:38:04.812797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:38:20.815421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:38:52.821412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:44:56.828254 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:45:03.834970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:45:11.837098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:45:27.839468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:45:59.845454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:52:03.852991 3.000416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:52:10.858833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:52:18.860990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:52:34.863783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:52:46.921774 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 19:52:46.922055 0.966007 tcp 10.0.2.105 52436 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/11 19:53:06.889504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:59:10.896145 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 19:59:17.902782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:59:25.904468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 19:59:41.907862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:00:13.913418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:00:42.344775 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 20:00:42.344930 0.190192 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:42.535485 0.154453 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:42.690352 0.028501 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:42.719243 0.177181 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:42.896794 0.060551 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:42.957698 0.197631 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.155726 0.121989 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.278093 0.116804 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.395302 0.148475 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.544188 0.137753 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.682383 0.153767 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.836563 0.040049 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.877024 0.102704 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:43.980053 0.141477 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.121939 0.187561 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.309897 0.143974 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.454285 0.020319 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.474885 0.184831 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.660149 0.071327 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.731836 0.223449 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:44.955667 0.350000 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:45.306032 0.252011 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:45.558459 0.190381 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:45.749213 0.375199 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:00:46.124827 0.181852 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:06:17.919489 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:06:24.926786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:06:32.928578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:06:48.931874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:07:20.937776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:13:24.943169 3.002417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:13:31.951257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:13:39.952977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:13:55.955319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:14:27.961920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:20:31.968589 3.000314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:20:38.975180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:20:46.976753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:21:02.979874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:21:34.985688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:22:47.890854 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 20:22:47.890951 0.949891 tcp 10.0.2.105 52437 -> 128.255.183.224 9027 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/01/11 20:27:38.991922 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:27:45.998636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:27:54.000782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:28:10.003795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:28:42.009507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:31:08.970936 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 20:31:08.971046 0.027523 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:08.998903 0.169663 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:09.168936 0.061315 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:09.230650 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 20:31:26.397769 0.071292 tcp 10.0.2.105 52438 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/11 20:31:26.469346 0.075072 tcp 10.0.2.105 52439 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/11 20:31:26.544771 0.155296 tcp 10.0.2.105 52440 -> 195.113.214.234 443 SRPA* 0 0 34 26100 flow=From-Botnet-V2-TCP-Established 1970/01/11 20:31:26.700726 0.121215 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:26.822282 0.195689 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.018322 0.156097 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.174825 0.116648 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.291893 0.153549 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.445868 0.138023 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.584309 0.158062 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.742779 0.062211 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.805389 0.170294 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:27.976100 0.141394 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.117898 0.191623 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.309894 0.144141 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.454434 0.020604 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.475428 0.185705 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.661487 0.071132 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.732998 0.225728 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:28.959133 0.382266 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:29.341733 0.239373 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:29.581506 0.183446 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:29.765361 0.252841 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:31:30.018576 0.189482 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/11 20:34:46.015013 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:34:53.023239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:35:01.024346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:35:17.027254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:35:49.033682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:41:53.039044 3.002250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:42:00.046771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:42:08.048306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:42:24.051394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:42:56.057707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:49:00.063180 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:49:07.070950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:49:15.072141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:49:31.085516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:50:03.091641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:52:48.840076 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 20:52:48.840178 0.937537 tcp 10.0.2.105 52441 -> 128.255.183.224 9027 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/01/11 20:56:07.098493 3.000848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 20:56:14.104960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:56:22.106445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:56:38.109500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 20:57:10.115201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:01:40.865401 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 21:01:40.865677 0.199638 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.065709 0.287054 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.353127 0.027344 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.380844 0.065983 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.447190 0.154248 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.601829 0.115332 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.717554 0.120247 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:41.838165 0.206048 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.044597 0.149048 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.194060 0.145116 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.339547 0.152990 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.492922 0.037003 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.530302 0.100885 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.631583 0.141663 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.773636 0.188960 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:42.962980 0.139125 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.102458 0.020361 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.123129 0.184618 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.308219 0.084545 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.393150 0.221969 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.615496 0.373157 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:43.989117 0.272983 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:44.262488 0.188491 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:44.451367 0.224809 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:01:44.676619 0.176327 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:03:14.120920 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:03:21.129028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:03:29.130511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:03:45.133448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:04:17.139037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:10:21.145953 3.001077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:10:28.152758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:10:36.153959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:10:52.157346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:11:24.163372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:17:28.169150 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:17:35.176687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:17:43.178474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:17:59.181168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:18:31.188216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:22:49.779287 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 21:22:49.779382 0.970884 tcp 10.0.2.105 52442 -> 128.255.183.224 9027 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/11 21:24:35.193960 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:24:42.200771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:24:50.202526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:25:06.205497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:25:38.211184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:31:42.218032 3.000886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:31:49.224350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:31:57.226152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:32:13.228994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:32:14.360925 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 21:32:14.361174 0.033291 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:14.394874 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 21:32:31.657035 0.065909 tcp 10.0.2.105 52443 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 21:32:31.723250 0.074950 tcp 10.0.2.105 52444 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 21:32:31.798510 0.155280 tcp 10.0.2.105 52445 -> 195.113.214.234 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/11 21:32:31.954408 0.202410 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.157219 0.059455 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.217026 0.153090 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.370456 0.114972 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.485831 0.121801 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.607975 0.207462 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.815858 0.151309 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:32.967534 0.145226 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.113152 0.151323 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.264818 0.039595 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.304842 0.140885 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.446075 0.141980 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.588446 0.188742 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.777552 0.143940 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.921887 0.020309 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:33.942562 0.196034 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:34.139000 0.377683 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:34.517057 0.243620 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:34.761074 0.084476 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:34.845956 0.233026 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:35.079351 0.177773 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:35.257549 0.189701 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:35.447662 0.219320 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 21:32:45.235019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:38:49.241832 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:38:56.249065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:39:04.249994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:39:20.252971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:39:52.259066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:45:56.265113 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:46:03.272516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:46:11.273953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:46:27.277456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:46:59.283166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:52:50.749489 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 21:52:50.749716 1.016839 tcp 10.0.2.105 52446 -> 128.255.183.224 9027 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/01/11 21:53:03.289648 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 21:53:10.296957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:53:18.298016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:53:34.300986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 21:54:06.307437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:00:10.313277 3.001492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:00:17.320468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:00:25.321705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:00:41.324762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:01:13.331348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:02:39.154547 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 22:02:39.154681 0.198781 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.353861 0.032352 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.386586 0.153451 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.540464 0.164594 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.705483 0.060212 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.766083 0.115446 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:39.881891 0.121006 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.003298 0.187308 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.190988 0.151049 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.342479 0.130984 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.473854 0.153039 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.627277 0.040668 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.668359 0.110125 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.778890 0.140688 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:40.919972 0.187543 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.107863 0.145489 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.253769 0.020052 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.274205 0.183510 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.458098 0.082480 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.540978 0.226336 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.767690 0.200093 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:41.968430 0.348341 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:42.317166 0.242041 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:42.559592 0.191070 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:02:42.751021 0.212167 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:07:17.337792 3.000845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:07:24.344221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:07:32.345983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:07:48.349190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:08:20.355467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:14:24.440691 3.001946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:14:31.448813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:14:39.449989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:14:55.452978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:15:27.459007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:21:31.465377 3.001284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:21:38.472584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:21:46.474005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:22:02.476969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:22:34.482921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:22:51.848899 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 22:22:51.849049 1.015354 tcp 10.0.2.105 52447 -> 128.255.183.224 9027 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/01/11 22:28:38.490058 3.000581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:28:45.496805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:28:53.497856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:29:09.500703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:29:41.507223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:32:53.964196 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 22:32:53.964300 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/11 22:33:09.031291 0.073524 tcp 10.0.2.105 52448 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/11 22:33:09.105126 0.076151 tcp 10.0.2.105 52449 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/11 22:33:09.181562 0.136042 tcp 10.0.2.105 52450 -> 195.113.214.234 443 SRPA* 0 0 56 37322 flow=From-Botnet-V2-TCP-Established 1970/01/11 22:33:09.318006 0.026119 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.344565 0.154752 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.499652 0.171149 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.671198 0.070326 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.741956 0.117115 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.859488 0.120541 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:09.980416 0.179727 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.160561 0.151245 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.312352 0.124112 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.436830 0.156159 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.593350 0.046647 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.640424 0.176392 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.817244 0.136898 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:10.954575 0.187895 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:11.142794 0.147504 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:11.290679 0.020077 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:11.311131 0.222716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:11.534187 0.175487 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:11.710064 0.360928 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:12.071372 0.185182 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:12.256923 0.078834 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:12.336188 0.213410 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:12.549955 0.231026 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:33:12.781384 0.188643 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/11 22:35:45.514157 3.000875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:35:52.520217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:36:00.521989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:36:16.525312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:36:48.531134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:42:52.537303 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:42:59.544222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:43:07.546021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:43:23.549091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:43:55.554828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:49:59.561245 3.001617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:50:06.568743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:50:14.570394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:50:30.572937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:51:02.578897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:52:52.868488 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 22:52:52.868591 1.100406 tcp 10.0.2.105 52451 -> 128.255.183.224 9027 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/01/11 22:57:06.585935 3.000352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 22:57:13.592566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:57:21.593906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:57:37.596723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 22:58:09.602746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:03:13.930566 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 23:03:13.930701 0.201194 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.132251 0.085595 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.218173 0.154077 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.372628 0.166803 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.539835 0.060405 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.600638 0.119916 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.720956 0.121965 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:14.843281 0.194219 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.037894 0.148019 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.186271 0.151802 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.338466 0.155529 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.494348 0.040810 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.535530 0.099404 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.635317 0.143305 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.779016 0.188608 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:15.968019 0.144377 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:16.112847 0.020219 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:16.133463 0.378491 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:16.512354 0.183635 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:16.696492 0.126758 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:16.823602 0.449419 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:17.273385 0.177737 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:17.451435 0.190549 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:17.642379 0.211270 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:03:17.854010 0.268030 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:04:13.609096 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:04:20.616293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:04:28.618026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:04:44.621022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:05:16.627069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:11:20.632898 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:11:27.639992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:11:35.641474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:11:51.645136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:12:23.650525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:18:27.656156 3.002140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:18:34.664087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:18:42.665649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:18:58.668944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:19:30.674602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:22:53.967850 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 23:22:53.968095 1.083727 tcp 10.0.2.105 52452 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/11 23:25:34.680682 3.001973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:25:41.688061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:25:49.689567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:26:05.693143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:26:37.698792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:32:41.705236 3.001116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:32:48.712095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:32:56.713750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:33:12.716651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:33:21.860281 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 23:33:21.860393 0.989777 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:22.850590 0.030841 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:22.881815 0.155019 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.037243 0.164916 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.202731 0.061269 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.264416 0.119597 udp 10.0.2.105 7010 <-> 5.245.114.45 9694 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.384432 0.121721 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.506526 0.181461 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.688391 0.150866 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.839664 0.137791 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:23.977852 0.158629 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:24.136901 0.342049 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:24.479360 0.103580 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:24.583326 0.139681 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:24.723417 0.193216 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:24.916978 0.145032 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.062437 0.019773 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.082514 0.090777 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.173698 0.227263 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.401294 0.359076 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.760745 0.188606 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:25.949663 0.212978 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:26.162974 0.266492 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:26.429823 0.180364 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:26.610558 0.189572 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/11 23:33:44.722437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:39:48.730628 2.999476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:39:55.735963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:40:03.737744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:40:19.740356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:40:51.746610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:46:55.751893 3.002805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:47:02.759808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:47:10.761799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:47:26.765140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:47:58.770368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:52:55.057013 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/11 23:52:55.057114 1.025071 tcp 10.0.2.105 52453 -> 128.255.183.224 9027 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/01/11 23:54:02.777827 3.000774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/11 23:54:09.794254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:54:17.795618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:54:33.798760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/11 23:55:05.804348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:01:09.811487 3.000521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:01:16.817989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:01:24.819806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:01:40.822730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:02:12.828900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:03:35.748435 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:03:35.748535 0.156432 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:35.905330 0.162324 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:36.068039 0.060142 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:36.128575 0.206079 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:36.335076 0.027552 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:36.363005 0.000000 udp 10.0.2.105 7010 -> 5.245.114.45 9694 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:03:53.946079 0.073404 tcp 10.0.2.105 52454 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:03:54.019779 0.068706 tcp 10.0.2.105 52455 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:03:54.088796 0.156593 tcp 10.0.2.105 52456 -> 195.113.214.234 443 SRPA* 0 0 39 32730 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:03:54.246024 0.121238 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:54.367674 0.180452 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:54.548517 0.148847 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:54.697756 0.131148 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:54.829288 0.157742 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:54.987437 0.044214 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.032017 0.124028 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.156694 0.144179 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.301276 0.191548 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.493215 0.142655 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.636374 0.020131 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.656851 0.096606 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.753876 0.183115 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:55.937363 0.211220 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:56.148961 0.226248 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:56.375662 0.362091 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:56.738172 0.189746 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:56.928442 0.236077 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:03:57.164935 0.176897 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:08:16.834417 3.001539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:08:23.841726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:08:31.843657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:08:47.846473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:09:19.852448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:15:23.858781 3.001825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:15:30.866247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:15:38.867813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:15:54.870520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:16:26.876227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:22:30.883181 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:22:37.890045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:22:45.891646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:22:56.087106 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:22:56.087287 1.042077 tcp 10.0.2.105 52457 -> 128.255.183.224 9027 FSPA* 0 0 15 1596 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:23:01.894208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:23:33.900211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:29:37.906749 3.001537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:29:44.914197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:29:52.915841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:30:08.918816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:30:40.924478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:34:24.276179 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:34:24.276397 0.000000 udp 10.0.2.105 7010 -> 5.245.114.45 9694 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:34:41.842823 0.075792 tcp 10.0.2.105 52458 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:34:41.918878 0.074540 tcp 10.0.2.105 52459 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:34:41.993804 0.156798 tcp 10.0.2.105 52460 -> 195.113.214.234 443 SRPA* 0 0 24 12990 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:34:42.162000 4.835443 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 4 1108 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.363317 4.680601 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 4 1306 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.397681 4.811939 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1149 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.567853 4.809042 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1126 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.722715 4.720316 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 4 1270 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.785274 4.840003 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1311 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:42.980022 4.837495 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1118 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:43.159193 4.811126 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1240 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:43.310593 0.151797 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:43.462779 4.667909 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 4 1175 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:43.620473 4.732413 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 4 1234 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.135557 4.331920 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 4 1007 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.243812 4.520028 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 4 987 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.384728 4.570259 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 4 1059 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.576770 4.527431 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 4 1122 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.721553 4.404039 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1059 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.742218 4.464133 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 4 1012 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:44.819957 4.573943 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 4 1124 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:45.018723 4.591757 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 4 1320 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:45.232820 4.760166 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 3 608 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:45.756896 4.057485 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1170 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:46.025803 3.966495 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 4 1047 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:46.203445 4.989845 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1290 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:46.433172 4.518035 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1274 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:48.468146 0.152161 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:50.610601 0.000000 udp 10.0.2.105 7010 <- 75.20.135.31 3612 RSP 0 0 1 546 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:34:51.194152 0.149743 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:51.367845 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:34:58.024188 0.079791 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:34:58.115140 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:04.663712 0.000000 udp 10.0.2.105 7010 -> 69.116.245.21 3346 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:09.590379 0.000267 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:35:13.096518 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:19.705713 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5833 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:27.658603 0.000000 udp 10.0.2.105 7010 -> 78.7.208.206 1778 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:32.914756 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:37.590884 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:35:40.655749 0.000000 udp 10.0.2.105 7010 -> 88.252.37.251 1830 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:47.605771 0.000000 udp 10.0.2.105 7010 -> 94.71.118.227 2639 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:35:56.057610 0.000000 udp 10.0.2.105 7010 -> 92.115.136.7 3807 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:01.266101 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:06.091617 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:36:09.967724 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 2495 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:18.529817 0.000000 udp 10.0.2.105 7010 -> 116.24.168.140 8041 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:27.222235 0.060578 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:27.282813 0.000000 icmp 94.34.155.180 0x0303 -> 10.0.2.105 0xb523 URP 192 1 251 flow=Background 1970/01/12 00:36:32.089661 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:36:32.419810 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:40.561912 0.000000 udp 10.0.2.105 7010 -> 91.138.138.3 6424 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:44.931199 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 00:36:47.601798 0.000000 udp 10.0.2.105 7010 -> 219.91.174.27 9254 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:51.938021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:36:53.840958 0.246594 udp 10.0.2.105 7010 -> 122.163.9.21 6258 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:36:54.087552 0.000000 icmp 122.163.9.21 0x0303 -> 10.0.2.105 0x7218 URP 192 1 323 flow=Background 1970/01/12 00:36:58.597634 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:36:59.939194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:37:01.051016 0.000000 udp 10.0.2.105 7010 -> 5.245.114.45 9694 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:09.403508 0.000000 udp 10.0.2.105 7010 -> 67.60.93.78 5816 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:15.942824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:37:17.694770 0.185422 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:17.880192 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 283 flow=Background 1970/01/12 00:37:22.591970 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:37:23.112822 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:28.721000 0.000000 udp 10.0.2.105 7010 -> 2.177.151.76 4373 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:34.839790 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:43.281780 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:47.948505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:37:48.098550 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:37:48.309026 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:37:55.188902 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:01.508015 0.149683 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:38:01.667580 0.000000 udp 10.0.2.105 7010 -> 79.129.44.166 5092 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:08.608381 0.000000 udp 10.0.2.105 7010 -> 2.127.57.202 2804 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:13.595347 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:38:16.569418 0.000000 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:24.561196 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 5701 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:32.823232 0.000000 udp 10.0.2.105 7010 -> 84.92.215.184 9630 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:37.589644 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:38:40.043590 0.000000 udp 10.0.2.105 7010 -> 88.224.21.144 7831 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:46.402454 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:52.832092 0.000000 udp 10.0.2.105 7010 -> 182.68.207.212 1039 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:38:58.780681 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:03.596813 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:39:06.972186 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:15.824592 0.000000 udp 10.0.2.105 7010 -> 87.22.122.182 4128 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:21.813622 0.000000 udp 10.0.2.105 7010 -> 41.206.58.154 4628 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:30.395971 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:35.092666 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:39:37.716784 0.000000 udp 10.0.2.105 7010 -> 24.164.71.63 8550 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:45.026983 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:52.207596 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:39:59.067412 0.000000 udp 10.0.2.105 7010 -> 62.1.59.98 3785 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:03.593719 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:40:04.875717 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:11.925787 0.000000 udp 10.0.2.105 7010 -> 93.46.22.237 3826 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:18.485012 0.000000 udp 10.0.2.105 7010 -> 96.255.210.204 1803 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:23.812963 0.000000 udp 10.0.2.105 7010 -> 108.64.237.34 9229 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:28.589422 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:40:31.113340 0.000000 udp 10.0.2.105 7010 -> 62.94.76.113 9474 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:38.984196 0.000000 udp 10.0.2.105 7010 -> 117.223.53.255 6655 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:46.365370 0.000000 udp 10.0.2.105 7010 -> 88.233.98.41 4651 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:55.017507 0.000000 udp 10.0.2.105 7010 -> 86.98.42.154 7084 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:40:59.613709 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:41:01.687278 0.000000 udp 10.0.2.105 7010 -> 88.75.165.52 8399 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:10.559956 0.000000 udp 10.0.2.105 7010 -> 119.74.146.115 6437 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:16.528651 0.000000 udp 10.0.2.105 7010 -> 87.11.38.117 3217 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:23.568728 0.000000 udp 10.0.2.105 7010 -> 82.187.20.229 5520 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:28.114897 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:41:28.796301 0.000000 udp 10.0.2.105 7010 -> 95.225.245.85 2947 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:37.569039 0.000000 udp 10.0.2.105 7010 -> 175.140.63.202 4933 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:44.638573 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:50.486966 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:41:55.113730 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:41:55.695021 0.000000 udp 10.0.2.105 7010 -> 37.5.216.151 3651 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:02.344178 0.000000 udp 10.0.2.105 7010 -> 98.111.206.215 6834 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:10.676059 0.119470 udp 10.0.2.105 7010 <-> 82.57.16.246 4792 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:42:10.870899 0.000000 udp 10.0.2.105 7010 -> 205.206.236.95 1041 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:18.236912 0.078164 udp 10.0.2.105 7010 -> 85.107.135.105 1026 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:18.315076 0.000000 icmp 85.107.135.105 0x0303 -> 10.0.2.105 0x0204 URP 192 1 205 flow=Background 1970/01/12 00:42:23.113734 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:42:23.344552 0.000000 udp 10.0.2.105 7010 -> 82.47.110.221 3085 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:29.213382 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:36.063098 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:43.783972 0.000000 udp 10.0.2.105 7010 -> 94.64.76.10 1709 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:48.610703 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:42:50.954281 0.000000 udp 10.0.2.105 7010 -> 24.154.75.212 4169 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:42:57.243599 0.000000 udp 10.0.2.105 7010 -> 182.71.206.98 1026 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:02.721236 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:08.890271 0.085448 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:43:09.053729 0.000000 udp 10.0.2.105 7010 -> 122.176.115.180 6144 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:13.616304 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:43:14.077669 0.000000 udp 10.0.2.105 7010 -> 117.212.135.109 3592 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:21.608385 0.000000 udp 10.0.2.105 7010 -> 78.186.47.89 1358 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:28.718703 0.000000 udp 10.0.2.105 7010 -> 158.108.228.50 1500 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:37.500912 0.000000 udp 10.0.2.105 7010 -> 75.150.112.38 9351 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:42.117657 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:43:43.970227 0.358012 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:43:44.352370 0.164659 udp 10.0.2.105 7010 <-> 46.241.230.213 9779 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:43:44.558124 0.000000 udp 10.0.2.105 7010 -> 81.201.62.61 3465 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:51.110381 0.000000 udp 10.0.2.105 7010 -> 217.236.62.1 8132 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:51.975043 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 00:43:57.390102 0.175792 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:43:57.595453 0.000000 udp 10.0.2.105 7010 -> 110.168.133.215 2796 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:43:58.982206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:44:04.656473 0.000000 udp 10.0.2.105 7010 -> 124.253.60.49 2369 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:06.983221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:44:09.617483 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:44:10.859422 0.000000 udp 10.0.2.105 7010 -> 217.249.187.227 7662 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:16.166973 0.000000 udp 10.0.2.105 7010 -> 87.23.134.37 7679 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:22.986157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:44:24.588750 0.000000 udp 10.0.2.105 7010 -> 123.243.15.11 5336 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:32.920910 0.169274 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:44:33.101276 0.000000 udp 10.0.2.105 7010 -> 122.166.4.10 4875 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:37.617284 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:44:39.740491 0.069857 udp 10.0.2.105 7010 <-> 195.174.204.4 7464 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:44:39.837676 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:45.929608 0.000000 udp 10.0.2.105 7010 -> 85.96.13.218 3135 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:54.341762 0.000000 udp 10.0.2.105 7010 -> 122.129.84.67 6337 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:44:54.992431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:45:00.460607 0.000000 udp 10.0.2.105 7010 -> 5.245.198.30 9413 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:05.117143 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:45:08.371764 0.095308 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:45:08.519237 0.000000 udp 10.0.2.105 7010 -> 122.176.4.216 1024 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:16.453799 0.000000 udp 10.0.2.105 7010 -> 24.18.134.120 8098 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:24.134317 0.373762 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:45:24.552905 0.000000 udp 10.0.2.105 7010 -> 41.69.56.233 2278 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:29.111433 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:45:30.013238 0.210292 udp 10.0.2.105 7010 <-> 182.237.155.242 7441 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:45:30.317431 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:37.433645 0.000000 udp 10.0.2.105 7010 -> 83.137.249.156 4763 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:44.062865 0.295299 udp 10.0.2.105 7010 <-> 118.172.55.8 8089 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:45:44.384308 0.000000 udp 10.0.2.105 7010 -> 182.178.124.113 7629 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:50.081683 0.000000 udp 10.0.2.105 7010 -> 83.100.255.43 7643 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:45:54.618053 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:45:56.982060 0.056447 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:45:57.048408 0.000000 udp 10.0.2.105 7010 -> 182.68.172.28 4162 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:06.014638 0.000000 udp 10.0.2.105 7010 -> 82.178.247.251 1506 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:14.596969 0.000000 udp 10.0.2.105 7010 -> 196.201.130.82 2690 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:19.113362 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:46:21.567046 0.000000 udp 10.0.2.105 7010 -> 176.205.19.81 9145 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:30.039092 0.000000 udp 10.0.2.105 7010 -> 79.11.147.81 8740 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:37.960942 0.000000 udp 10.0.2.105 7010 -> 93.64.208.102 1721 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:43.769225 0.000000 udp 10.0.2.105 7010 -> 90.2.53.76 1912 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:48.615971 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:46:49.036511 0.369757 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:46:49.439036 0.054521 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:46:49.510525 0.039784 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:46:49.563088 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:46:55.996500 0.000000 udp 10.0.2.105 7010 -> 182.71.26.106 2484 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:47:01.414207 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 3848 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:47:07.252792 0.000000 udp 10.0.2.105 7010 -> 89.148.189.101 1620 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:47:14.302792 0.052977 udp 10.0.2.105 7010 <-> 93.177.182.120 9343 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/12 00:47:14.365599 0.000000 udp 10.0.2.105 7010 -> 84.183.235.52 5162 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 00:47:19.109758 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:50:58.999070 3.040991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 00:51:06.046301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:51:14.047808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:51:30.050173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:52:02.056649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:52:57.166082 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 00:52:57.166220 1.080299 tcp 10.0.2.105 52461 -> 128.255.183.224 9027 FSPA* 0 0 14 1508 flow=From-Botnet-V2-TCP-Established 1970/01/12 00:58:06.160965 3.003623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 00:58:13.170354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:58:21.171845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:58:37.174361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 00:59:09.180473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:05:13.208190 2.999778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:05:20.213799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:05:28.215541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:05:44.218832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:06:16.224487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:12:20.263256 2.998794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:12:27.268073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:12:35.269919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:12:51.272782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:13:23.278262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:17:37.614887 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 01:17:37.615131 0.213371 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:37.828926 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:17:54.239878 0.071354 tcp 10.0.2.105 52462 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:17:54.311525 0.074793 tcp 10.0.2.105 52463 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:17:54.386586 0.155699 tcp 10.0.2.105 52464 -> 195.113.214.234 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:17:54.543219 0.028109 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:54.571738 0.155897 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:54.728001 0.061792 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:54.790134 0.172722 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:54.963282 0.189361 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.153028 0.146861 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.300472 0.154386 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.455211 0.036934 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.492620 0.144738 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.637706 0.139826 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.777929 0.192138 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:55.970547 0.143631 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.114517 0.020247 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.135139 0.076767 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.299079 0.108765 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.408250 0.185767 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.594427 0.211515 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:56.806341 0.277289 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:57.084051 0.177173 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:57.261594 0.222239 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:57.484444 0.144802 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:57.629595 0.190266 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:57.820414 0.335734 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:58.156656 0.076423 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:58.233548 0.150598 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:58.473264 0.096974 udp 10.0.2.105 7010 <-> 82.57.16.246 4792 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:58.570697 0.081271 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:58.652435 0.359337 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:17:59.012101 0.000000 udp 10.0.2.105 7010 -> 46.241.230.213 9779 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:18:16.591117 0.070567 tcp 10.0.2.105 52465 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:16.661497 0.074996 tcp 10.0.2.105 52466 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:16.736743 0.155947 tcp 10.0.2.105 52467 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:16.892000 0.186626 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:17.079043 0.168881 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:17.248474 0.000000 udp 10.0.2.105 7010 -> 195.174.204.4 7464 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:18:34.606631 0.073597 tcp 10.0.2.105 52468 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:34.680542 0.078051 tcp 10.0.2.105 52469 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:34.758909 0.157856 tcp 10.0.2.105 52470 -> 195.113.214.234 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:18:34.917172 0.095016 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:35.012716 0.341654 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:35.354731 0.514206 udp 10.0.2.105 7010 <-> 182.237.155.242 7441 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:35.869339 0.274236 udp 10.0.2.105 7010 <-> 118.172.55.8 8089 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:36.143968 0.059141 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:36.203538 0.054117 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:36.258049 0.372637 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:36.631022 0.037511 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:18:36.668974 0.052810 udp 10.0.2.105 7010 <-> 93.177.182.120 9343 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:19:27.285112 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 01:19:34.292055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:19:42.293619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:19:58.296574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:20:30.302576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:22:58.326335 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 01:22:58.326435 1.035886 tcp 10.0.2.105 52471 -> 128.255.183.224 9027 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:26:34.308747 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:26:41.315775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:26:49.317280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:27:05.320497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:27:37.326270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:33:41.332069 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:33:48.339788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:33:56.341601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:34:12.344736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:34:44.350695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:40:48.356077 3.002306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:40:55.364107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:41:03.395472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:41:19.398606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:41:51.404776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:47:55.410509 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 01:48:02.417847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:48:10.419742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:48:26.422092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:48:58.428563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:49:01.022324 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 01:49:01.022410 0.198357 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:01.221135 0.000000 udp 10.0.2.105 7010 -> 46.241.230.213 9779 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:49:19.436920 0.075463 tcp 10.0.2.105 52472 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:19.512723 0.068172 tcp 10.0.2.105 52473 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:19.581267 0.163177 tcp 10.0.2.105 52474 -> 195.113.214.234 443 SRPA* 0 0 41 21208 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:19.743449 0.000000 udp 10.0.2.105 7010 -> 195.174.204.4 7464 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:49:37.380342 0.176794 tcp 10.0.2.105 52475 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:37.557435 0.113355 tcp 10.0.2.105 52476 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:37.671091 0.163489 tcp 10.0.2.105 52477 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:37.835101 0.164125 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:37.999572 0.059814 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.059819 0.124125 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.184432 0.181055 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.365941 0.151952 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.518299 0.341561 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.860351 0.031984 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:38.892756 0.191380 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.084482 0.146788 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.231683 0.157218 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.389277 0.094579 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.484451 0.019695 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.504411 0.143770 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.648593 0.144975 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.793952 0.194719 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:39.989060 0.213603 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:40.203098 0.224955 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:40.428512 0.177385 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:40.606301 0.182217 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:40.788928 0.123931 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:40.913212 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:49:58.654570 0.070445 tcp 10.0.2.105 52478 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:58.725263 0.083459 tcp 10.0.2.105 52479 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:58.809033 0.154832 tcp 10.0.2.105 52480 -> 195.113.214.234 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:49:58.964574 0.086553 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:59.051531 0.219375 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:59.271239 0.192329 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:59.463907 0.145623 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:49:59.609944 0.000000 udp 10.0.2.105 7010 -> 82.57.16.246 4792 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:50:18.304197 0.074572 tcp 10.0.2.105 52481 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:18.379029 0.071396 tcp 10.0.2.105 52482 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:18.450791 0.155024 tcp 10.0.2.105 52483 -> 195.113.214.234 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:18.606298 0.149322 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:18.755979 0.096865 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:18.853239 0.346030 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:19.199661 0.169022 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:19.369058 0.354336 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:19.723742 0.343389 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.067551 0.095126 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.163108 0.314284 udp 10.0.2.105 7010 <-> 118.172.55.8 8089 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.477815 0.054882 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.533099 0.054288 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.587765 0.156403 udp 10.0.2.105 7010 <-> 182.237.155.242 7441 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:20.744568 0.000000 udp 10.0.2.105 7010 -> 93.177.182.120 9343 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 01:50:39.444368 0.076709 tcp 10.0.2.105 52484 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:39.520925 0.067349 tcp 10.0.2.105 52485 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:39.604698 0.160549 tcp 10.0.2.105 52486 -> 195.113.214.234 443 SRPA* 0 0 41 21612 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:50:39.764672 0.359143 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:50:40.124202 0.035595 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 01:52:59.365372 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 01:52:59.365620 0.947961 tcp 10.0.2.105 52487 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/12 01:55:02.434798 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 01:55:09.441998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:55:17.443341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:55:33.446546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 01:56:05.452751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:02:09.458978 3.000759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:02:16.465952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:02:24.467669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:02:40.470361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:03:12.476100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:09:16.482339 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:09:23.489883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:09:31.491484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:09:47.494214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:10:19.500337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:16:23.507049 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:16:30.513618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:16:38.515283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:16:54.518014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:17:26.524425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:20:58.318926 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 02:20:58.319031 0.335748 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:20:58.655200 0.000000 udp 10.0.2.105 7010 -> 82.57.16.246 4792 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 02:21:17.398592 0.073095 tcp 10.0.2.105 52488 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:17.471987 0.070972 tcp 10.0.2.105 52489 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:17.543240 0.336487 tcp 10.0.2.105 52490 -> 195.113.214.234 443 SRPA* 0 0 66 53873 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:17.880415 0.000000 udp 10.0.2.105 7010 -> 93.177.182.120 9343 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 02:21:36.354001 0.106954 tcp 10.0.2.105 52491 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:36.461209 0.072378 tcp 10.0.2.105 52492 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:36.533480 0.185152 tcp 10.0.2.105 52493 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:21:36.719200 0.192981 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:36.912583 0.168021 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.081030 0.122769 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.204349 0.060941 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.265726 0.186532 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.452668 0.188593 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.641626 0.147736 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.789737 0.188389 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:37.978520 0.029958 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.008816 0.156673 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.165875 0.079832 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.246082 0.212943 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.582242 0.141495 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.724133 0.154084 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.878642 0.074603 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.953689 0.020391 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:38.974379 0.138160 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.112928 0.178015 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.291308 0.244066 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.535721 0.104475 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.640717 0.182503 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.823580 0.076431 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:39.900418 0.226816 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:40.127641 0.191375 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:40.319418 0.145449 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:40.465292 0.168356 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:40.634017 0.354458 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:40.988870 0.075941 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.065200 0.153902 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.219463 0.095573 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.315382 0.274472 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.590202 0.168798 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.759396 0.156846 udp 10.0.2.105 7010 <-> 182.237.155.242 7441 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:41.916655 0.281254 udp 10.0.2.105 7010 <-> 118.172.55.8 8089 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:42.198293 0.057701 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:42.256542 0.054000 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:42.310886 0.733664 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:21:43.044948 0.038091 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:23:00.314688 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 02:23:00.314966 1.010628 tcp 10.0.2.105 52494 -> 128.255.183.224 9027 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:23:30.530804 3.001015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 02:23:37.537745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:23:45.539635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:24:01.542652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:24:33.548335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:30:37.554729 3.001575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:30:44.561506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:30:52.563129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:31:08.566049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:31:40.572256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:37:44.578759 3.000959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:37:51.585744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:37:59.587304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:38:15.590193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:38:47.595990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:44:51.602357 3.001386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:44:58.609546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:45:06.611398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:45:22.614036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:45:54.620578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:51:58.626726 3.000853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:52:05.633667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:52:05.904522 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 02:52:05.904671 0.336869 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.241894 0.120604 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.362912 0.061482 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.438859 0.195110 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.634344 0.168389 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.803155 0.178369 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:06.981936 0.194638 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.176929 0.153819 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.331164 0.149751 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.481271 0.031866 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.513543 0.155309 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.669301 0.039902 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.709594 0.155923 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.865956 0.100044 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:07.966406 0.020511 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.056060 0.145669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.202063 0.176221 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.378633 0.211302 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.590319 0.143480 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.734132 0.207037 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:08.941521 0.134112 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:09.076057 0.187181 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:09.263639 0.081048 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:09.345089 0.221516 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:09.567003 0.190021 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:09.757439 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 02:52:13.634981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:52:26.234795 0.078659 tcp 10.0.2.105 52495 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:52:26.313771 0.078225 tcp 10.0.2.105 52496 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:52:26.392438 0.177943 tcp 10.0.2.105 52497 -> 195.113.214.234 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:52:26.570999 0.089561 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:26.660934 0.154169 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:26.815492 0.095106 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:26.910983 0.145681 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:27.057089 0.167060 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:27.224609 0.343244 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:27.568423 0.167960 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:27.736795 0.157234 udp 10.0.2.105 7010 <-> 182.237.155.242 7441 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:27.894486 0.277130 udp 10.0.2.105 7010 <-> 118.172.55.8 8089 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:28.171964 0.056382 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:28.228715 0.054136 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:28.283216 0.430639 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:28.714240 0.037078 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/12 02:52:29.638230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:53:01.324727 0.958304 tcp 10.0.2.105 52498 -> 128.255.183.224 9027 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/01/12 02:53:01.644418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:59:05.650589 3.000933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 02:59:12.657680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:59:20.658973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 02:59:36.662203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:00:08.667990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:06:12.674134 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:06:19.681191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:06:27.683179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:06:43.685737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:07:15.692179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:13:19.698588 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:13:26.705943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:13:34.706913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:13:50.710101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:14:22.715899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:20:26.722265 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:20:33.729627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:20:41.731026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:20:57.733872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:21:29.740101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:22:45.629722 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 03:22:45.629817 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:23:02.283537 1.042937 tcp 10.0.2.105 52499 -> 128.255.183.224 9027 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:02.344844 0.078492 tcp 10.0.2.105 52500 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:02.423612 0.067033 tcp 10.0.2.105 52501 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:02.491562 0.173693 tcp 10.0.2.105 52502 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:02.665958 0.393357 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:03.059664 0.168555 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:03.228614 0.619362 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:03.848418 0.167844 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:04.016640 0.192968 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:04.209950 0.191329 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:04.401705 0.144984 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:04.547083 0.505490 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:05.053001 0.153996 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:05.207380 0.047394 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:05.255173 0.772173 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.027753 0.033082 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.061158 0.157359 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.218981 0.020262 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.239545 0.138436 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.378377 0.216215 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.595014 0.153875 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:06.749303 0.265010 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.014708 0.157752 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.172827 0.182738 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.355982 0.076584 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.432993 0.143990 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.577358 0.211556 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.789345 0.189335 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:07.979088 0.678131 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:08.657584 0.090639 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:08.748639 0.145316 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:08.921374 0.167567 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:09.089316 0.135319 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:09.225065 0.157882 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:09.383375 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:23:26.858785 0.075828 tcp 10.0.2.105 52503 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:26.934969 0.075805 tcp 10.0.2.105 52504 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:27.011085 0.166579 tcp 10.0.2.105 52505 -> 195.113.214.234 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:27.178295 0.282994 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:23:27.461697 0.000000 udp 10.0.2.105 7010 -> 182.237.155.242 7441 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:23:45.665784 0.078163 tcp 10.0.2.105 52506 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:45.744325 0.071229 tcp 10.0.2.105 52507 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:45.815361 0.173077 tcp 10.0.2.105 52508 -> 195.113.214.234 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:23:45.988119 0.000000 udp 10.0.2.105 7010 -> 118.172.55.8 8089 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:24:02.350023 0.073093 tcp 10.0.2.105 52509 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:24:02.423352 0.079548 tcp 10.0.2.105 52510 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:24:02.503299 0.175708 tcp 10.0.2.105 52511 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:24:02.679559 0.055340 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:24:02.735296 0.074405 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:24:02.810080 0.397020 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:24:03.207478 0.037055 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:27:33.746445 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 03:27:40.753527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:27:48.755218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:28:04.758092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:28:36.764107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:34:40.770640 3.001076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:34:47.777743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:34:55.779023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:35:11.781681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:35:43.787974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:41:47.794371 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:41:54.801070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:42:02.802722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:42:18.805687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:42:50.811558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:48:54.818321 3.001123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 03:49:01.825283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:49:09.826822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:49:25.830000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:49:57.835929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:53:03.333005 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 03:53:03.333087 1.385164 tcp 10.0.2.105 52512 -> 128.255.183.224 9027 FSPA* 0 0 14 1579 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:09.788785 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 03:54:09.788892 0.000000 udp 10.0.2.105 7010 -> 182.237.155.242 7441 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:54:26.884642 0.070654 tcp 10.0.2.105 52513 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:26.955587 0.069153 tcp 10.0.2.105 52514 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:27.025031 0.181654 tcp 10.0.2.105 52515 -> 195.113.214.234 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:27.207231 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:54:42.686278 0.070940 tcp 10.0.2.105 52516 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:42.757575 0.151671 tcp 10.0.2.105 52517 -> 195.113.214.234 80 SRPA* 0 0 20 15503 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:42.909637 0.000000 udp 10.0.2.105 7010 -> 118.172.55.8 8089 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 03:54:59.670349 0.074357 tcp 10.0.2.105 52518 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:59.744997 0.070852 tcp 10.0.2.105 52519 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:59.816176 0.169450 tcp 10.0.2.105 52520 -> 195.113.214.234 443 SRPA* 0 0 58 39136 flow=From-Botnet-V2-TCP-Established 1970/01/12 03:54:59.986272 1.065993 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:01.052675 0.248131 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:01.301194 0.694133 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:01.995719 0.167881 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:02.163971 0.186377 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:02.350749 0.155464 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:02.506662 0.048264 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:02.555332 0.145488 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:02.701174 0.558596 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:03.260156 0.187594 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:03.448115 1.336826 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:04.786440 0.102597 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:04.889429 0.020512 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:04.910311 0.036598 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:04.947310 0.145113 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:05.092807 0.184210 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:05.277404 0.155290 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:05.433073 0.560293 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:05.993768 0.102030 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:06.096204 0.232333 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:06.328952 0.136490 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:06.465787 0.140140 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:06.606397 0.213728 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:06.820689 0.188372 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:07.009446 0.169221 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:07.179080 0.074664 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:07.254121 0.149075 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:07.403605 0.145721 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:07.549721 0.639573 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.189694 0.095041 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.285154 0.182420 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.467962 0.397847 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.866243 0.036861 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.903553 0.062535 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:55:08.966503 0.054859 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/12 03:56:01.842508 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 03:56:08.849791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:56:16.850650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:56:32.853824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 03:57:04.859653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:03:08.866555 3.001204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:03:15.873376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:03:23.874686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:03:39.878116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:04:11.883791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:10:15.889597 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:10:22.897532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:10:30.898852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:10:46.902212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:11:18.907798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:17:22.914536 3.000547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:17:29.921221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:17:37.922617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:17:53.925488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:18:25.931992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:23:04.723113 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 04:23:04.723224 4.123113 tcp 10.0.2.105 52521 -> 128.255.183.224 9027 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:24:29.937890 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:24:36.945288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:24:44.946450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:25:00.949946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:25:11.665660 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 04:25:11.665749 0.940095 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:12.606258 0.134343 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:12.741012 0.180218 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:12.921654 0.206427 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:13.128509 0.169503 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:13.298379 0.154147 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:13.452940 0.043468 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:13.496737 0.140972 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:13.638135 0.513030 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.151570 0.187203 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.339158 0.020571 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.360053 0.030111 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.390549 0.144700 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.535592 0.182732 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:14.718661 1.139930 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:15.859016 0.070053 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:15.929496 0.157221 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:16.107616 0.181509 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:16.289578 0.170639 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:16.460586 0.214423 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:16.675390 0.215567 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:16.891292 0.188572 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:17.080375 0.168425 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:17.249239 0.083863 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:17.333510 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 04:25:32.955915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:25:34.459716 0.077022 tcp 10.0.2.105 52522 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:25:34.536598 0.072178 tcp 10.0.2.105 52523 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:25:34.609105 0.168269 tcp 10.0.2.105 52524 -> 195.113.214.234 443 SRPA* 0 0 40 21962 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:25:34.777652 0.141023 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:34.919075 0.151940 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.071426 0.143724 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.215542 0.525817 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.741724 0.090452 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.832579 0.035178 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.868161 0.055336 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.923919 0.054819 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:35.979129 0.214116 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:25:36.193683 0.000000 udp 10.0.2.105 7010 -> 111.242.53.24 1084 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 04:25:52.254201 0.072972 tcp 10.0.2.105 52525 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:25:52.327450 0.075202 tcp 10.0.2.105 52526 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:25:52.402527 0.165080 tcp 10.0.2.105 52527 -> 195.113.214.234 443 SRPA* 0 0 44 36166 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:31:36.961690 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:31:43.969346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:31:51.970530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:32:07.973586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:32:39.979604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:38:43.986137 3.011338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:38:51.002745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:38:59.004536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:39:15.007711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:39:47.013513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:45:51.019577 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:45:58.027460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:46:06.028707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:46:22.031374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:46:54.037525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:52:58.043399 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 04:53:05.051328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:53:08.846927 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 04:53:08.847026 1.050550 tcp 10.0.2.105 52528 -> 128.255.183.224 9027 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:53:13.052577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:53:29.055323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:54:01.061935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 04:56:22.465257 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 04:56:22.465356 0.060698 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:22.526436 0.395858 udp 10.0.2.105 7010 <-> 111.242.53.24 1084 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:22.922715 0.169520 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:23.092688 0.182757 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:23.275895 0.197216 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:23.473457 1.163961 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:24.637800 0.606733 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:25.244932 0.250934 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:25.496281 0.586896 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.083516 0.188371 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.272448 0.026388 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.299176 0.038545 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.338080 0.156139 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.494543 0.066900 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.561838 0.151713 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.713976 0.184405 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:26.898713 0.156298 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:27.055339 0.070209 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:27.125958 1.239897 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:28.366190 0.177680 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:28.544202 0.245289 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:28.789910 0.167631 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:28.957935 0.081064 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.039405 0.115323 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.155116 0.192073 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.347603 0.235889 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.583881 0.148618 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.732926 0.143744 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:29.877035 0.145613 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:56:30.022989 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 04:56:46.491287 0.070762 tcp 10.0.2.105 52529 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:56:46.562405 0.071238 tcp 10.0.2.105 52530 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:56:46.633967 0.170450 tcp 10.0.2.105 52531 -> 195.113.214.234 443 SRPA* 0 0 43 22940 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:56:46.804645 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 04:57:05.717609 0.072586 tcp 10.0.2.105 52532 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:57:05.790470 0.079247 tcp 10.0.2.105 52533 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:57:05.870025 0.171751 tcp 10.0.2.105 52534 -> 195.113.214.234 443 SRPA* 0 0 42 22924 flow=From-Botnet-V2-TCP-Established 1970/01/12 04:57:06.042988 0.181738 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:57:06.225081 0.036510 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:57:06.261896 0.095019 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/12 04:57:06.357281 0.571789 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:00:05.068540 3.000719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 05:00:12.075214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:00:20.076142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:00:36.079413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:01:08.085579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:07:12.092144 3.001151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:07:19.098797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:07:27.100481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:07:43.103453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:08:15.109221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:14:19.116286 3.000958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:14:26.122646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:14:34.124258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:14:50.127121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:15:22.133270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:21:26.139262 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:21:33.146916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:21:41.148308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:21:57.151600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:22:29.157194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:23:09.896389 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 05:23:09.896485 1.092719 tcp 10.0.2.105 52535 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:27:31.773210 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 05:27:31.773452 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:27:47.687717 0.074474 tcp 10.0.2.105 52536 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:27:47.762461 0.075255 tcp 10.0.2.105 52537 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:27:47.837985 0.179148 tcp 10.0.2.105 52538 -> 195.113.214.234 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:27:48.017750 0.059919 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:27:48.078037 0.187127 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:27:48.265581 0.000000 udp 10.0.2.105 7010 -> 111.242.53.24 1084 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:28:06.683243 0.072148 tcp 10.0.2.105 52539 -> 195.113.214.236 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:06.755776 0.073061 tcp 10.0.2.105 52540 -> 195.113.214.234 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:06.829320 0.163647 tcp 10.0.2.105 52541 -> 195.113.214.234 443 SRPA* 0 0 42 23354 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:06.993178 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:28:24.288500 0.068468 tcp 10.0.2.105 52542 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:24.357249 0.074282 tcp 10.0.2.105 52543 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:24.431822 0.175815 tcp 10.0.2.105 52544 -> 195.113.214.234 443 SRPA* 0 0 40 22020 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:24.608171 0.175652 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:24.784445 0.293028 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:25.077862 1.047583 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:26.125830 0.205744 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:26.331953 0.037613 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:26.369891 0.558459 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:26.928695 0.247525 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.176668 0.020097 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.197074 0.186536 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.384000 0.183024 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.567370 0.155189 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.722989 0.083285 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.806672 0.155752 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:27.962781 0.039972 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:28.003228 0.145017 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:28.148658 1.429809 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:29.578861 0.081654 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:29.660846 0.147855 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:29.809086 0.189317 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:29.998825 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:28:33.163862 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 05:28:40.171237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:28:46.140047 0.068751 tcp 10.0.2.105 52545 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:46.209087 0.070841 tcp 10.0.2.105 52546 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:46.280246 0.170112 tcp 10.0.2.105 52547 -> 195.113.214.234 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:28:46.451023 0.239028 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:46.690432 0.167449 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:46.858242 0.139432 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:46.998080 0.149302 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:47.147707 0.368712 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:47.516822 0.142425 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:47.659635 0.094807 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:47.754830 0.330210 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:48.085425 0.037929 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:48.123713 0.452646 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:28:48.172431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:29:04.175413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:29:36.181242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:35:40.188302 3.000797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:35:47.195016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:35:55.196283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:36:11.199609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:36:43.205348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:42:47.211774 3.000968 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:42:54.219130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:43:02.220577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:43:18.223111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:43:50.229437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:49:54.235488 3.001804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:50:01.242975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:50:09.244147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:50:25.247349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:50:57.253436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:53:10.995944 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 05:53:10.996082 4.000832 tcp 10.0.2.105 52548 -> 128.255.183.224 9027 FSPA* 0 0 15 1800 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:57:01.259409 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 05:57:08.266792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:57:16.268232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:57:32.271076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:58:04.277018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 05:58:50.754337 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 05:58:50.754592 0.000000 udp 10.0.2.105 7010 -> 111.242.53.24 1084 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:59:09.713772 0.074343 tcp 10.0.2.105 52549 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:09.788468 0.075096 tcp 10.0.2.105 52550 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:09.863896 0.172208 tcp 10.0.2.105 52551 -> 195.113.214.234 443 SRPA* 0 0 21 13000 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:10.036894 0.080555 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:10.117892 0.289807 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:10.408104 0.054216 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:10.462653 0.189137 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:10.652114 0.179573 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:10.832085 0.287447 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:11.119942 0.216189 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:11.336589 0.903827 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.240815 0.055630 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.296812 0.020517 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.317629 0.145962 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.464014 0.345545 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.809915 0.153514 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:12.963833 0.172717 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.136920 0.154879 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.293472 0.043411 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.337235 0.144977 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.482657 0.191595 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.674604 0.189073 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:13.864014 0.192765 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:14.057195 0.665944 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:14.723560 0.073515 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:14.797469 0.161855 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:14.959678 0.178265 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:15.138317 0.171742 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:15.310451 0.142538 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:15.453383 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 05:59:33.986736 0.066151 tcp 10.0.2.105 52552 -> 195.113.214.236 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:34.053216 0.071862 tcp 10.0.2.105 52553 -> 195.113.214.234 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:34.125406 0.169477 tcp 10.0.2.105 52554 -> 195.113.214.234 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/12 05:59:34.295363 0.090729 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:34.386471 0.164945 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:34.551808 0.037186 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:34.589350 0.377849 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:34.967582 0.142171 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 05:59:35.110111 0.564650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:04:08.283677 3.001027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 06:04:15.290540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:04:23.292393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:04:39.294857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:05:11.301067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:11:15.307981 3.001234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:11:22.314377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:11:30.316184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:11:46.319162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:12:18.324858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:18:22.331361 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:18:29.338488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:18:37.339927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:18:53.343024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:19:25.349484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:23:15.000145 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:23:15.000260 1.753973 tcp 10.0.2.105 52555 -> 128.255.183.224 9027 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/12 06:25:29.355721 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:25:36.362582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:25:44.364075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:26:00.367489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:26:32.373515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:29:36.648198 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:29:36.648460 0.101036 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:29:36.749496 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x4889 URH 192 1 163 flow=Background 1970/01/12 06:29:54.025599 2.992176 tcp 10.0.2.105 52556 -> 195.113.214.236 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 06:30:01.703685 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:30:03.026261 0.000000 tcp 10.0.2.105 52556 -> 195.113.214.236 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 06:30:14.195296 4.002528 udp 10.0.2.105 53075 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:15.193554 3.004378 udp 10.0.2.105 53075 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:16.397300 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/12 06:30:22.203406 0.000000 udp 10.0.2.105 53075 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:22.203503 0.313742 udp 10.0.2.105 53075 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:22.517245 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/01/12 06:30:26.237947 1.493697 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:27.200477 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:30:28.483059 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:46.759462 3.004057 tcp 10.0.2.105 52557 -> 195.113.214.211 80 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 06:30:51.705750 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:30:53.773273 0.073140 tcp 10.0.2.105 52557 -> 195.113.214.211 80 FPA_* 0 0 9 1824 flow=From-Botnet-V2-TCP-Established 1970/01/12 06:30:53.847524 3.757221 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 06:30:58.355709 0.059325 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:30:58.415489 0.188702 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:30:58.604769 0.178354 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:30:58.783522 0.810876 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:30:59.594765 0.226645 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:30:59.821821 0.273958 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:00.096189 0.040378 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:00.136936 0.714500 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:00.851863 0.020438 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:00.872647 0.547248 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:01.420489 0.159685 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:01.580622 0.116585 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:01.697615 0.153271 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:01.851270 0.051560 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:01.903205 0.147355 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.050976 0.189737 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.241119 0.189506 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.431041 0.137950 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.569379 0.183197 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.752952 0.108303 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:02.861626 0.179399 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:03.041471 0.167224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:03.209057 0.485414 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:03.694817 0.073708 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:03.768871 0.141688 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:03.910975 0.095547 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:04.006926 0.397055 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:04.404408 0.142511 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:04.547343 0.170939 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:04.718634 0.037727 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:31:04.756762 0.212236 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 06:32:36.380541 2.999905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 06:32:43.386324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:32:51.388191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:33:07.391297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:33:39.397393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:39:43.403011 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:39:50.410433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:39:58.411960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:40:14.415202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:40:46.421505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:46:50.427371 3.001093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:46:57.434594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:47:05.435618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:47:21.438754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:47:53.445318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:53:16.760643 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 06:53:16.760741 1.040014 tcp 10.0.2.105 52558 -> 128.255.183.224 9027 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/01/12 06:53:57.450721 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 06:54:04.458439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:54:12.459737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:54:28.462795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 06:55:00.468731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:01:04.474523 3.002275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:01:11.482304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:01:14.908153 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 07:01:14.908397 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 07:01:19.483983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:01:33.395221 0.071553 tcp 10.0.2.105 52559 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 07:01:33.470035 0.011440 udp 10.0.2.105 55538 <-> 8.8.8.8 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/01/12 07:01:33.481962 0.075757 tcp 10.0.2.105 52560 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 07:01:33.558007 0.159904 tcp 10.0.2.105 52561 -> 195.113.214.236 443 SRPA* 0 0 60 40479 flow=From-Botnet-V2-TCP-Established 1970/01/12 07:01:33.718413 0.154246 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:33.873065 0.179381 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.052844 0.060229 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.113469 0.264751 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.378606 0.128208 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.507178 0.193921 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.701470 0.224373 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.926276 0.038270 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:34.964890 1.041409 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:35.486846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:01:36.006703 0.019643 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:36.033673 0.604300 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:36.638386 0.159780 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:36.798541 0.084473 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:36.883367 0.154339 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.038091 0.047132 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.085646 0.245384 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.331415 0.192144 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.523958 0.185190 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.709561 0.103035 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.812945 0.176928 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:37.990283 0.167500 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:38.158164 0.188926 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:38.347477 0.131040 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:38.478924 0.937748 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.417061 0.096155 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.513704 0.140591 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.654647 0.094840 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.749840 0.169446 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.919678 0.038120 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:39.958164 0.447104 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:40.405631 0.468094 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:01:40.874128 0.143530 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:02:07.493269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:08:11.498713 3.001966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:08:18.506524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:08:26.507651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:08:42.510575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:09:14.517136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:15:18.523594 3.000793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:15:25.530798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:15:33.531969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:15:49.534703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:16:21.540942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:22:25.547256 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:22:32.554206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:22:40.555724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:22:56.559099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:23:17.800414 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 07:23:17.800621 1.008254 tcp 10.0.2.105 52562 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/12 07:23:28.565196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:29:32.570928 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:29:39.578061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:29:47.580142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:30:03.582995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:30:35.588899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:31:54.723147 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 07:31:54.723310 0.059319 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:54.783065 0.167598 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:54.951064 0.083017 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.034527 0.176149 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.211130 0.208256 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.419781 0.039622 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.459821 0.135634 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.595791 0.200926 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:55.797156 1.151603 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:56.949150 0.020625 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:56.970105 0.082758 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.053253 0.156280 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.209869 0.030426 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.240685 0.144675 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.385720 0.131753 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.517825 0.155179 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.673405 0.190015 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:57.863818 0.184589 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.048738 0.122403 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.171531 0.176442 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.348548 0.168278 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.517229 0.188103 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.705739 0.138025 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:58.844214 0.242800 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.087397 0.072712 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.160444 0.141964 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.302816 0.094918 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.398229 0.165817 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.564462 0.037068 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.601908 0.140061 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:31:59.742365 0.540013 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:32:00.282696 0.408915 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/12 07:36:39.595419 3.001393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:36:46.602202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:36:54.603680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:37:10.606408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:37:42.612780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:43:46.618454 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:43:53.626233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:44:01.627466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:44:17.630855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:44:49.636638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:50:53.643726 3.000457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:51:00.650291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:51:08.651980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:51:24.654806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:51:56.660578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:53:18.809797 0.000182 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 07:53:18.810076 0.924365 tcp 10.0.2.105 52563 -> 128.255.183.224 9027 FSPA* 0 0 12 1513 flow=From-Botnet-V2-TCP-Established 1970/01/12 07:58:00.667276 3.000901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 07:58:07.674266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:58:15.675296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:58:31.678515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 07:59:03.684474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:02:28.099807 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 08:02:28.099905 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 08:02:43.252861 0.074626 tcp 10.0.2.105 52564 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:02:43.327773 0.075587 tcp 10.0.2.105 52565 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:02:43.403720 0.171585 tcp 10.0.2.105 52566 -> 195.113.214.236 443 SRPA* 0 0 33 24063 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:02:43.575953 0.179696 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:43.756015 0.066845 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:43.823255 0.170882 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:43.994522 0.286104 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.281056 0.038128 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.319623 0.125348 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.445357 0.192641 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.638367 0.071504 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.710260 0.168740 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.879424 0.036192 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:44.915995 1.099767 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:46.016109 0.020513 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:02:46.036935 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 08:03:02.528753 0.074324 tcp 10.0.2.105 52567 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:03:02.603375 0.066748 tcp 10.0.2.105 52568 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:03:02.670411 0.169783 tcp 10.0.2.105 52569 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:03:02.840508 0.267860 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.108749 0.156921 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.266064 0.188398 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.454855 0.184326 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.639583 0.111845 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.751745 0.177417 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:03.929583 0.151947 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.081920 0.237862 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.320233 0.075691 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.396476 0.139689 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.536553 0.168201 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.705225 0.191426 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.897078 0.094818 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:04.992307 0.323214 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:05.315940 0.038202 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:05.354519 0.141909 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:05.496827 0.526665 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:03:06.023880 0.360617 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:05:07.690417 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 08:05:14.698009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:05:22.699660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:05:38.702306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:06:10.708976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:12:14.714010 3.002764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:12:21.722155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:12:29.723437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:12:45.726248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:13:17.732908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:19:21.738944 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:19:28.746484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:19:36.747883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:19:52.750257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:20:24.756746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:23:19.738378 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 08:23:19.738477 1.054860 tcp 10.0.2.105 52570 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:26:28.762444 3.001766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:26:35.769950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:26:43.771599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:26:59.774748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:27:31.780517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:33:17.748507 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 08:33:17.748610 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 08:33:35.787424 3.000736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:33:35.975845 0.066153 tcp 10.0.2.105 52571 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:36.042283 0.075117 tcp 10.0.2.105 52572 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:36.117685 0.178875 tcp 10.0.2.105 52573 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:36.297053 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 08:33:42.794122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:33:50.795634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:33:54.821533 0.070452 tcp 10.0.2.105 52574 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:54.891839 0.074949 tcp 10.0.2.105 52575 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:54.967065 0.170090 tcp 10.0.2.105 52576 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:33:55.137439 0.225495 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:55.363877 0.043990 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:55.408400 0.180957 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:55.589747 0.098164 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:55.688328 0.219755 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:55.908508 0.547821 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:56.456748 0.083021 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:56.540149 0.154535 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:56.695058 0.032246 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:33:56.727697 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 08:34:06.798304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:34:11.916305 0.070446 tcp 10.0.2.105 52577 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:34:11.987080 0.074629 tcp 10.0.2.105 52578 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:34:12.061614 0.173912 tcp 10.0.2.105 52579 -> 195.113.214.236 443 SRPA* 0 0 41 21456 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:34:12.236065 0.020523 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:12.256960 1.256148 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:13.513467 0.059075 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:13.572935 0.156037 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:13.729388 0.189479 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:13.919250 0.183351 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.103039 0.102186 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.205615 0.183841 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.389943 0.138116 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.528482 0.237042 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.765952 0.080579 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.846863 0.143313 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:14.990523 0.169293 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.160361 0.191157 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.351853 0.090587 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.442849 0.362248 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.805482 0.037053 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.842926 0.141931 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:15.985244 0.485923 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:16.471555 0.353386 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 08:34:38.804490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:40:42.810687 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:40:49.817936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:40:57.819276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:41:13.822511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:41:45.828516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:47:49.834622 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:47:56.841727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:48:04.843142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:48:20.846748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:48:52.852731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:53:20.798158 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 08:53:20.798296 1.125304 tcp 10.0.2.105 52580 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/12 08:54:56.858934 3.001449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 08:55:03.865684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:55:11.867630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:55:27.870101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 08:55:59.876069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:02:03.882703 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:02:10.889469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:02:18.891104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:02:34.894254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:03:06.900699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:04:30.621034 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 09:04:30.621129 0.364536 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:30.986077 0.229572 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.216039 0.080150 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.296591 0.215598 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.512547 0.040107 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.553067 0.189466 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.742933 0.055138 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:31.798494 0.201538 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:32.000479 0.069747 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:32.070561 0.163289 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:32.234210 0.020551 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:32.255045 0.372069 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:32.627527 0.551301 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.179161 0.157159 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.336808 0.190281 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.527414 0.186971 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.714729 0.099734 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.814865 0.175574 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:33.990834 0.137739 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.128948 0.151443 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.280778 0.073926 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.355121 0.144114 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.499624 0.168172 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.668165 0.192693 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:34.861258 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 09:04:52.143416 0.074549 tcp 10.0.2.105 52581 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:04:52.218228 0.074020 tcp 10.0.2.105 52582 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:04:52.292562 0.172891 tcp 10.0.2.105 52583 -> 195.113.214.236 443 SRPA* 0 0 36 26728 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:04:52.466044 0.142377 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:52.608846 0.090563 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:52.699770 0.168800 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:52.868935 0.561679 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:04:53.430952 0.400612 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:09:10.906884 3.000801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:09:17.913859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:09:25.914926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:09:41.917999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:10:13.924098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:16:17.930761 3.001140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:16:24.937556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:16:32.939379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:16:48.942553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:17:20.947975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:23:21.928036 0.000320 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 09:23:21.928456 1.083203 tcp 10.0.2.105 52584 -> 128.255.183.224 9027 FSPA* 0 0 15 1692 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:23:24.955388 3.000797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:23:31.961865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:23:39.963122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:23:55.965892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:24:27.972286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:30:31.978578 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:30:38.985685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:30:46.987484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:31:02.991189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:31:34.996013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:35:09.615389 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 09:35:09.615490 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 09:35:24.648475 0.077614 tcp 10.0.2.105 52585 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:24.726378 0.075952 tcp 10.0.2.105 52586 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:24.802646 0.184498 tcp 10.0.2.105 52587 -> 195.113.214.236 443 SRPA* 0 0 51 33782 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:24.986244 0.060937 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:25.047578 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 09:35:40.089060 0.069783 tcp 10.0.2.105 52588 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:40.158649 0.078480 tcp 10.0.2.105 52589 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:40.237400 0.171400 tcp 10.0.2.105 52590 -> 195.113.214.236 443 SRPA* 0 0 45 37192 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:35:40.409305 0.202250 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:40.611941 0.182391 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:40.794725 0.037898 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:40.833026 0.178758 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.012128 0.071595 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.084127 0.153766 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.238281 0.020377 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.258984 0.267228 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.526613 0.039553 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.566573 0.166118 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:41.733088 0.482778 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:42.216259 0.743088 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:42.959684 0.103605 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:43.063736 0.182274 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:43.246412 0.130891 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:43.377692 0.713493 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.091606 0.074019 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.166018 0.183812 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.350243 0.188763 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.539362 0.145391 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.685126 0.168524 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:44.853992 0.189333 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:45.043724 0.228805 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:45.272959 0.143302 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:45.416649 0.095021 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:45.512080 0.486291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:35:45.998749 0.533290 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/12 09:37:39.002774 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 09:37:46.009871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:37:54.010804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:38:10.013978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:38:42.020025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:44:46.026716 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:44:53.033439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:45:01.035046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:45:17.037792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:45:49.064304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:51:53.071385 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:52:00.077719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:52:08.079053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:52:24.082136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:52:56.088032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:53:23.017277 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 09:53:23.017376 1.116069 tcp 10.0.2.105 52591 -> 128.255.183.224 9027 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/01/12 09:59:00.094944 3.000957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 09:59:07.101729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:59:15.103299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 09:59:31.105868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:00:03.112620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:06:07.118727 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:06:09.149138 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 10:06:09.149282 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 10:06:14.125584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:06:22.126892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:06:27.285874 0.072039 tcp 10.0.2.105 52592 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:06:27.358178 0.070693 tcp 10.0.2.105 52593 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:06:27.429189 0.172764 tcp 10.0.2.105 52594 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:06:27.602536 0.063009 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:27.665938 0.214982 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:27.881289 0.189998 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.071662 0.076407 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.148990 0.177633 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.327012 0.083534 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.410898 0.155735 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.566991 0.020536 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.587823 0.159535 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:28.747746 0.655775 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:29.403854 0.216496 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:29.620748 0.042987 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:29.664141 0.512671 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:30.177209 0.102374 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:30.279995 0.179851 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:30.460181 0.137980 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:30.598595 0.181588 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:30.780514 0.770180 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:31.551090 0.072152 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:31.623643 0.189659 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:31.813725 0.142685 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:31.956852 0.169382 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:32.126649 0.191181 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:32.318233 0.258697 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:32.577295 0.525766 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:33.103465 0.142516 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:33.246373 0.090843 udp 10.0.2.105 7010 <-> 31.192.32.232 6250 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:33.337546 0.463059 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:06:38.129939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:07:10.135803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:13:14.143321 3.000206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:13:21.149433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:13:29.150902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:13:45.154366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:14:17.159899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:20:21.166244 3.021249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:20:28.193598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:20:36.195319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:20:52.197857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:21:24.204156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:23:24.136934 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 10:23:24.137122 0.900666 tcp 10.0.2.105 52595 -> 128.255.183.224 9027 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:27:28.209715 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:27:35.217174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:27:43.218773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:27:59.221707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:28:31.228072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:34:35.233759 3.002045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:34:42.241248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:34:50.243111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:35:06.246301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:35:38.251728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:36:47.739483 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 10:36:47.739712 0.182024 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:47.922149 0.046231 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:47.968719 0.178382 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.147527 0.064097 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.212061 0.199263 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.411756 0.072391 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.484713 0.154816 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.639956 0.020616 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.660954 0.159615 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.820995 0.061133 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:36:48.882500 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 10:37:06.901585 0.072925 tcp 10.0.2.105 52596 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:06.974771 0.076469 tcp 10.0.2.105 52597 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:07.051492 0.199315 tcp 10.0.2.105 52598 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:07.249749 0.102090 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:07.352223 1.118134 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:08.470752 0.216869 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:08.688014 0.180408 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:08.868778 0.124358 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:08.993572 0.185395 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:09.179374 0.686365 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:09.866100 0.083338 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:09.949869 0.190606 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:10.140867 0.143141 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:10.284430 0.168456 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:10.453274 0.187533 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:10.641227 0.142534 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:10.784117 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 10:37:25.967857 0.069273 tcp 10.0.2.105 52599 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:26.037435 0.073973 tcp 10.0.2.105 52600 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:26.111744 0.176927 tcp 10.0.2.105 52601 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:37:26.289340 0.168568 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:26.458252 0.412983 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:37:26.871627 0.344045 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 10:41:42.258885 3.001005 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 10:41:49.265238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:41:57.267075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:42:13.270088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:42:45.275931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:48:49.282826 3.000443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:48:56.289252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:49:04.290640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:49:20.294233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:49:52.310008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:53:25.036695 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 10:53:25.036800 0.945322 tcp 10.0.2.105 52602 -> 128.255.183.224 9027 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/01/12 10:55:56.315764 3.001814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 10:56:03.323333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:56:11.324784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:56:27.328167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 10:56:59.334289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:03:03.339851 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:03:10.347182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:03:18.348820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:03:34.351719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:04:06.357814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:07:27.707745 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 11:07:27.707848 0.605799 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:28.314024 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 11:07:45.975573 0.071839 tcp 10.0.2.105 52603 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 11:07:46.047735 0.070910 tcp 10.0.2.105 52604 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 11:07:46.118889 0.178510 tcp 10.0.2.105 52605 -> 195.113.214.236 443 SRPA* 0 0 47 28020 flow=From-Botnet-V2-TCP-Established 1970/01/12 11:07:46.296633 0.180794 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:46.477825 0.032149 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:46.510301 0.191925 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:46.702638 0.054497 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:46.757555 0.328785 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.086753 0.020630 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.107776 0.155485 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.263622 0.072894 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.336854 0.242245 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.579488 0.231376 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.811262 0.103108 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:47.914766 0.179221 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:48.094399 0.131128 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:48.225880 0.184499 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:48.410761 1.001250 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:49.412456 0.215274 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:49.628115 0.141471 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:49.769975 0.806395 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:50.576769 0.085278 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:50.662440 0.193706 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:50.856482 0.141425 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:50.998387 0.189872 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:51.188679 0.168446 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:51.357525 0.422194 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:51.780097 0.183577 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:07:51.964033 0.545898 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:10:10.364772 3.001636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:10:17.371835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:10:25.373528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:10:41.375824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:11:13.381944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:17:17.387901 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:17:24.395039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:17:32.396550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:17:48.399576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:18:20.405566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:23:25.986141 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 11:23:25.986329 0.945671 tcp 10.0.2.105 52606 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/12 11:24:24.412836 3.000953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:24:31.419366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:24:39.420808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:24:55.423758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:25:27.430043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:31:31.435833 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:31:38.442963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:31:46.444733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:32:02.447422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:32:34.453927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:37:52.791339 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 11:37:52.791438 0.630015 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:53.421897 0.173804 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:53.596100 0.043200 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:53.639710 0.184796 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:53.824944 0.056064 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:53.881407 0.156868 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.038695 0.020570 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.059632 0.157293 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.217339 0.072897 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.290624 0.266707 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.557700 0.042737 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.600840 0.104959 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.706205 0.179338 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:54.885978 0.137930 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:55.024497 0.183398 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:55.208284 0.142603 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:55.351244 0.951168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:56.302810 0.215100 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:56.518324 0.346893 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:56.865621 0.073540 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:56.939578 0.189604 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:57.129659 0.140248 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:57.270334 0.188466 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:57.459240 0.167695 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:57.627365 0.479166 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:58.106848 0.271311 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:37:58.378566 0.646827 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 11:38:38.459486 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:38:45.467383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:38:53.468903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:39:09.471542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:39:41.477505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:45:45.484745 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:45:52.490956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:46:00.492299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:46:16.495489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:46:48.501405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:52:52.508422 3.000846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 11:52:59.515265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:53:07.516504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:53:23.519542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:53:26.934851 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 11:53:26.934955 0.936222 tcp 10.0.2.105 52607 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/12 11:53:55.525602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 11:59:59.532209 3.001144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:00:06.539306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:00:14.540339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:00:30.543814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:01:02.549664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:07:06.556902 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:07:13.562780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:07:21.564620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:07:37.567567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:08:09.573439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:08:12.588436 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 12:08:12.588692 0.466964 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.056025 0.177668 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.234114 0.037723 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.272189 0.181734 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.454363 0.055315 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.510091 0.154617 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.665108 0.020631 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.686051 0.159305 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.845754 0.084778 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:13.930894 0.258450 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.189786 0.041447 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.231610 0.179105 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.411099 0.197947 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.609502 0.145052 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.754956 0.184942 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:14.940351 0.147512 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:15.088423 1.059550 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:16.148333 0.215886 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:16.364564 0.532133 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:16.897147 0.085099 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:16.982688 0.191734 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:17.174824 0.143086 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:17.318325 0.512057 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:17.830802 0.167758 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:18.045154 0.190752 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:18.236338 0.169220 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:08:18.405966 0.397904 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:14:13.580347 3.000847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:14:20.586870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:14:28.588426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:14:44.591465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:15:16.597165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:21:20.604026 3.000947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:21:27.610807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:21:35.612328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:21:51.615615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:22:23.621361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:23:27.874527 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 12:23:27.874630 1.078730 tcp 10.0.2.105 52608 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/12 12:28:27.628066 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:28:34.634963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:28:42.636050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:28:58.639480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:29:30.645317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:35:34.651765 3.001020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:35:41.658704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:35:49.660388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:36:05.663084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:36:37.669428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:38:35.038307 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 12:38:35.038555 0.031998 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:35.070907 0.687158 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:35.758400 0.177439 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:35.936242 0.182079 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.118714 0.055796 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.174863 0.331949 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.507191 0.020507 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.528071 0.157362 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.685840 0.072065 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:36.758302 0.244272 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:37.002963 0.038827 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:37.042193 0.102443 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:37.144967 0.176606 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:37.321968 0.144764 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:37.467156 0.000000 udp 10.0.2.105 7010 -> 72.201.209.113 1245 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 12:38:53.426371 0.074043 tcp 10.0.2.105 52609 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 12:38:53.500781 0.070543 tcp 10.0.2.105 52610 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 12:38:53.571625 0.138459 tcp 10.0.2.105 52611 -> 195.113.214.236 443 SRPA* 0 0 35 26919 flow=From-Botnet-V2-TCP-Established 1970/01/12 12:38:53.710652 0.144246 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:53.855381 1.003180 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:54.859001 0.214626 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:55.074029 0.408644 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:55.483088 0.071690 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:55.555159 0.189625 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:55.745177 0.140593 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:55.886164 0.188858 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:56.075418 0.401694 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:56.477460 0.166022 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:56.643818 0.167459 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:38:56.811672 0.615810 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/12 12:42:41.676056 3.011282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:42:48.692906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:42:56.694298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:43:12.697307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:43:44.703558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:49:48.709334 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:49:55.716684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:50:03.718169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:50:19.721580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:50:51.727729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:53:28.954166 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 12:53:28.954293 0.964647 tcp 10.0.2.105 52612 -> 128.255.183.224 9027 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/12 12:56:55.733193 3.001954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 12:57:02.740541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:57:10.742077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:57:26.745169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 12:57:58.751422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:04:02.756693 3.002173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:04:09.764487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:04:17.766036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:04:33.769374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:05:05.775051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:09:18.909664 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 13:09:18.909757 0.000000 udp 10.0.2.105 7010 -> 72.201.209.113 1245 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 13:09:34.003167 0.072196 tcp 10.0.2.105 52613 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:09:34.075663 0.070893 tcp 10.0.2.105 52614 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:09:34.146843 0.164138 tcp 10.0.2.105 52615 -> 195.113.214.236 443 SRPA* 0 0 83 61974 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:09:34.311208 0.053214 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:34.364810 0.054149 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:34.419349 0.649130 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.068858 0.179331 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.248757 0.181563 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.430704 0.020610 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.451658 0.162356 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.614439 0.084665 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.699494 0.189244 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.889095 0.039834 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:35.929314 0.103013 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:36.032734 0.176990 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:36.210125 0.156294 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:36.366829 0.138369 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:36.505565 0.140077 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:36.646005 1.352349 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:37.998742 0.212148 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:38.211290 0.510971 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:38.722669 0.084508 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:38.807570 0.193478 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:39.001387 0.139556 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:39.141335 0.187915 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:39.329627 0.168191 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:39.498208 0.514703 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:40.013329 0.166691 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:09:40.180563 0.385990 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:11:09.781791 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:11:16.788513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:11:24.790524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:11:40.793577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:12:12.799394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:18:16.805950 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:18:23.812675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:18:31.814146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:18:47.817085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:19:19.822964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:23:29.923253 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 13:23:29.923333 0.943104 tcp 10.0.2.105 52616 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:25:23.829631 3.001270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:25:30.836627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:25:38.838059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:25:54.841114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:26:26.847104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:32:30.853424 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:32:37.860521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:32:45.861772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:33:01.865387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:33:33.871053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:39:37.877192 3.001986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:39:44.884657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:39:49.030703 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 13:39:49.030798 0.029955 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:39:49.061131 0.538639 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:39:49.600107 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 13:39:52.885698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:40:06.287621 0.070626 tcp 10.0.2.105 52617 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:40:06.358521 0.070288 tcp 10.0.2.105 52618 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:40:06.429116 0.161304 tcp 10.0.2.105 52619 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:40:06.590909 0.449331 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.040625 0.204456 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.245483 0.020139 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.265977 0.154593 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.420908 0.072369 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.493635 0.241131 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.735159 0.042449 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.778005 0.158106 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:07.936667 0.174393 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:08.111471 0.154372 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:08.266223 0.130946 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:08.397583 0.144343 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:08.542258 1.145752 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:08.889429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:40:09.688571 0.283463 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:09.972425 0.160229 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.133099 0.071988 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.205475 0.191986 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.397881 0.140887 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.539104 0.187884 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.727370 0.164761 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:10.892492 0.169063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:11.061993 0.445868 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:11.508193 0.405181 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 13:40:40.894752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:46:44.901560 3.020920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:46:51.928653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:46:59.929835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:47:15.932746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:47:47.938933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:53:30.873079 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 13:53:30.873183 1.091269 tcp 10.0.2.105 52620 -> 128.255.183.224 9027 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/01/12 13:53:51.945722 3.000967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 13:53:58.952244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:54:06.954192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:54:22.956680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 13:54:54.963049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:00:58.969241 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:01:05.976271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:01:13.977840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:01:29.981374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:02:01.987284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:08:05.993571 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:08:13.000095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:08:21.001803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:08:37.004948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:09:09.011103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:10:32.771894 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 14:10:32.772063 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 14:10:51.099408 0.074520 tcp 10.0.2.105 52621 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 14:10:51.174207 0.075295 tcp 10.0.2.105 52622 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 14:10:51.249827 0.157720 tcp 10.0.2.105 52623 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 14:10:51.408071 0.028005 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:51.436614 0.180473 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:51.617517 0.020095 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:51.638008 0.589973 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.228507 0.180849 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.409707 0.229157 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.639204 0.072687 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.712309 0.198980 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.911706 0.041880 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:52.954014 0.103096 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:53.057474 0.177041 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:53.234907 0.154520 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:53.389791 0.137908 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:53.528115 0.144430 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:53.672965 0.964090 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:54.637426 0.074183 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:54.712002 0.985364 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:55.697705 0.212274 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:55.910306 0.192531 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:56.103239 0.136236 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:56.239884 0.189153 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:56.467898 0.167853 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:56.636160 0.175784 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:56.812506 0.448959 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:10:57.261823 0.446127 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:15:13.017098 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:15:20.024153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:15:28.026055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:15:44.028922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:16:16.035005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:22:20.040485 3.002127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:22:27.048282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:22:35.049818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:22:51.053117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:23:23.058754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:23:31.972510 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 14:23:31.972590 0.962563 tcp 10.0.2.105 52624 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/12 14:29:27.065906 3.020959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:29:34.092037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:29:42.093708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:29:58.097323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:30:30.102747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:36:34.108540 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:36:41.116563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:36:49.117537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:37:05.121108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:37:37.127108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:41:25.666111 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 14:41:25.666361 0.020292 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:25.687030 0.612747 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.300154 0.039034 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.339553 0.169341 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 198 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.509393 0.191717 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.701519 0.170856 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.872817 0.072105 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:26.945289 0.214801 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.160654 0.038492 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.199628 0.100496 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.300482 0.177469 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.478320 0.156232 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.634893 0.124038 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.759288 0.139369 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:27.898999 0.553165 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:28.452566 0.071427 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:28.524374 0.971270 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:29.496041 0.213994 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:29.710421 0.192516 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:29.903299 0.137747 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:30.041442 0.172426 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:30.214269 0.444453 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:30.659113 0.191111 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:30.850589 0.164920 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:41:31.015911 0.442470 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 14:43:41.132307 3.001981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:43:48.140015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:43:56.141888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:44:12.144859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:44:44.150790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:50:48.156721 3.001726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:50:55.164169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:51:03.165889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:51:19.168698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:51:51.174479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:53:32.942115 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 14:53:32.942218 0.956878 tcp 10.0.2.105 52625 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/12 14:57:55.181871 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 14:58:02.188726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:58:10.189689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:58:26.192810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 14:58:58.198524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:05:02.205567 3.000603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:05:09.212509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:05:17.213520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:05:33.216989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:06:05.223140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:11:38.141765 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 15:11:38.141951 0.042781 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:38.185076 0.020423 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:38.205830 0.541095 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:38.747334 0.181084 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:38.928821 0.178724 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.107968 0.268756 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.377108 0.070429 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.447923 0.286344 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.734661 0.039397 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.774429 0.102270 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:39.877129 0.179062 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:40.056614 0.153847 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:40.210816 0.144861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:40.356075 0.142493 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:40.498982 0.542003 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:41.041361 0.072675 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:41.114379 1.234662 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:42.349519 0.226892 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:42.576765 0.192645 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:42.769818 0.136256 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:42.906460 0.167594 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:43.074428 0.238221 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:43.313036 0.481966 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:43.795359 0.187652 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:11:43.983438 0.218779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:12:09.228758 3.001425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:12:16.235958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:12:24.237765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:12:40.240854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:13:12.246550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:19:16.253663 3.020624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:19:23.279844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:19:31.281701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:19:47.285047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:20:19.290994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:23:33.901006 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 15:23:33.901103 0.961020 tcp 10.0.2.105 52626 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/12 15:26:23.297138 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:26:30.303893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:26:38.305300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:26:54.308406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:27:26.314907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:33:30.321561 3.000797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:33:37.328008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:33:45.329620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:34:01.332871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:34:33.339059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:40:37.345151 3.000832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:40:44.351853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:40:52.353534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:41:08.356997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:41:40.363466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:42:11.076869 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 15:42:11.076975 0.028991 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:11.106368 0.020091 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:11.126823 0.177193 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:11.304386 0.581410 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:11.886181 0.185307 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.071870 0.156218 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.228499 0.072147 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.301130 0.251391 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.552926 0.039645 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.592908 0.099420 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.692681 0.180304 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:12.873319 0.156213 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:13.029897 0.130780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:13.161068 0.000000 udp 10.0.2.105 7010 -> 79.56.200.90 2691 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 15:42:30.086413 0.067018 tcp 10.0.2.105 52627 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 15:42:30.153708 0.075175 tcp 10.0.2.105 52628 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 15:42:30.229184 0.152941 tcp 10.0.2.105 52629 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 15:42:30.382839 0.143968 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:30.527152 1.875619 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:32.403127 1.210629 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:33.614151 0.212272 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:33.826796 0.189299 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:34.016521 0.191859 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:34.208818 0.167669 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:34.376881 0.171230 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:34.548549 0.379478 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:34.928513 0.435242 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:42:35.364154 0.187189 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/12 15:47:44.369781 3.000924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:47:51.375757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:47:59.377267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:48:15.380789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:48:47.386263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:53:34.870384 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 15:53:34.870572 0.969009 tcp 10.0.2.105 52630 -> 128.255.183.224 9027 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/01/12 15:54:51.393183 3.000719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 15:54:58.400000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:55:06.401439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:55:22.404167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 15:55:54.410307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:01:58.415891 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:02:05.423992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:02:13.425222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:02:29.428112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:03:01.434371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:09:05.441349 3.021114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:09:12.468195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:09:20.469494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:09:36.472138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:10:08.478312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:12:46.886541 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 16:12:46.886784 0.078142 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:46.965328 0.187977 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:47.153771 0.033971 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:47.188107 0.020150 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:47.208624 0.070629 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:47.279596 0.670603 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:47.950558 0.176195 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.127148 0.192358 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.319843 0.043809 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.364022 0.102116 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.466769 0.176419 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.643565 0.155411 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.799333 0.131047 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:48.930732 0.260398 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:49.191542 0.144508 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:49.336603 1.901830 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:51.238833 0.392637 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:51.631842 0.216553 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:51.848816 0.190274 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:52.039486 0.137243 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:52.177132 0.168209 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:52.345744 0.525579 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:52.871679 0.166125 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:53.038180 0.346413 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:12:53.385061 0.191493 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:16:12.484575 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:16:19.491964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:16:27.493220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:16:43.496597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:17:15.502210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:23:19.507908 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:23:26.516134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:23:34.517443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:23:35.840196 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 16:23:35.840467 0.956925 tcp 10.0.2.105 52631 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/12 16:23:50.520561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:24:22.526223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:30:26.532944 3.000782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:30:33.539725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:30:41.541319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:30:57.544496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:31:29.550255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:37:33.557239 3.000975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:37:40.563852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:37:48.565607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:38:04.567986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:38:36.574031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:42:55.857602 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 16:42:55.857861 0.073246 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:55.931517 0.185159 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.117078 0.027048 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.144505 0.020143 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.164986 0.071369 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.236701 0.157913 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.395008 0.043133 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.438533 0.399559 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:56.838525 0.174367 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.013232 0.128560 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.142193 0.176472 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.319112 0.154855 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.474384 0.138024 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.612812 0.197703 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.810848 0.144439 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:42:57.955690 2.282155 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:00.238243 1.170598 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:01.409229 0.211972 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:01.621599 0.189555 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:01.811517 0.141027 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:01.952941 0.169534 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:02.122815 0.527248 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:02.650471 0.167589 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:02.818416 0.212019 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:43:03.030783 0.188007 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 16:44:40.580917 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:44:47.587963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:44:55.589473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:45:11.592141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:45:43.597976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:51:47.604719 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:51:54.611508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:52:02.613421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:52:18.616060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:52:50.622164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:53:36.799512 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 16:53:36.799607 0.981461 tcp 10.0.2.105 52632 -> 128.255.183.224 9027 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/01/12 16:58:54.628891 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 16:59:01.635716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:59:09.637390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:59:25.640215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 16:59:57.645933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:06:01.652616 3.001122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:06:08.659713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:06:16.661193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:06:32.664572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:07:04.670292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:13:08.676526 3.000986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:13:15.683364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:13:23.685213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:13:29.814356 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 17:13:29.814443 0.037173 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:29.851996 0.020136 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:29.872700 0.070891 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:29.944008 0.071416 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:30.015815 0.182007 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:30.198158 0.250863 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:30.449502 0.039063 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:30.488946 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 17:13:39.688011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:13:47.471223 0.064517 tcp 10.0.2.105 52633 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:13:47.536088 0.065806 tcp 10.0.2.105 52634 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:13:47.602180 0.156176 tcp 10.0.2.105 52635 -> 195.113.214.236 443 SRPA* 0 0 40 21154 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:13:47.758923 0.185440 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:47.944730 0.102588 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.047687 0.175194 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.223318 0.155236 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.378907 0.137890 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.517249 0.201427 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.719094 0.142505 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:48.862001 2.361828 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:51.224255 1.130097 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:52.354787 0.212148 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:52.567361 0.190028 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:52.757738 0.139027 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:52.897143 0.168090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:53.065644 0.349263 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:53.415265 0.192403 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:53.608074 0.519114 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:13:54.127616 0.296172 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:14:11.694029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:20:15.701147 3.001117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:20:22.707240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:20:30.709266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:20:46.712228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:21:18.718509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:23:37.788725 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 17:23:37.788822 0.975591 tcp 10.0.2.105 52636 -> 128.255.183.224 9027 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:27:22.724822 3.001165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:27:29.731249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:27:37.733146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:27:53.735880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:28:25.742319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:34:29.747529 3.012433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:34:36.765301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:34:44.767339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:35:00.769957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:35:32.776463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:41:36.782572 3.001128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:41:43.789324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:41:51.791157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:42:07.794032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:42:39.800178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:43:59.515080 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 17:43:59.515186 0.718560 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.234149 0.072895 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.307562 0.186912 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.494876 0.020043 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.515272 0.035923 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.551598 0.083747 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.635682 0.039791 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.675849 0.164802 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:00.840996 0.186340 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.027720 0.155421 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.183508 0.177426 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.361333 0.100951 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.462705 0.137948 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.601021 0.237727 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.839155 0.143633 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:01.983168 2.443681 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:04.427206 0.935816 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:05.364113 0.260929 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:05.625453 0.000000 udp 10.0.2.105 7010 -> 75.20.135.31 3612 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 17:44:22.549701 0.068986 tcp 10.0.2.105 52637 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:44:22.619021 0.068556 tcp 10.0.2.105 52638 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:44:22.687951 0.156505 tcp 10.0.2.105 52639 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:44:22.845069 0.140543 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:22.985978 0.169516 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:23.155844 0.514143 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:23.670352 0.295459 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:23.966219 0.187374 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:44:24.153976 0.406262 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 17:48:43.807076 3.000869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:48:50.813757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:48:58.814944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:49:14.817752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:49:46.824148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:53:38.768500 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 17:53:38.768590 0.914903 tcp 10.0.2.105 52640 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/12 17:55:50.830896 3.001150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 17:55:57.837104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:56:05.838940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:56:21.841711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 17:56:53.848079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:02:57.854360 3.001001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:03:04.861297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:03:12.862651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:03:28.866011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:04:00.871820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:10:04.878667 3.001015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:10:11.885227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:10:19.887022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:10:35.889776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:11:07.895938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:14:25.469939 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 18:14:25.470033 0.193834 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:14:25.664281 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 18:14:43.647843 0.063694 tcp 10.0.2.105 52641 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:14:43.711832 0.065615 tcp 10.0.2.105 52642 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:14:43.777303 0.155524 tcp 10.0.2.105 52643 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:14:43.933404 0.073870 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:14:44.007694 0.000000 udp 10.0.2.105 7010 -> 130.149.89.67 1878 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 18:15:02.724268 0.063034 tcp 10.0.2.105 52644 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:15:02.787587 0.065298 tcp 10.0.2.105 52645 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:15:02.852821 0.148690 tcp 10.0.2.105 52646 -> 195.113.214.236 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:15:03.002005 0.026582 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.029012 0.071789 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.101233 0.037880 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.139543 0.156505 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.296472 0.184860 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.481766 0.155965 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.638083 0.178563 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.817037 0.179000 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:03.996448 0.236784 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:04.233676 0.140933 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:04.375039 0.145352 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:04.520813 0.114326 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:04.635591 0.992476 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:05.628502 2.045220 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:07.674100 0.221003 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:07.895503 0.141994 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:08.037890 0.168952 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:08.207233 0.188540 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:08.396119 0.526361 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:08.922903 0.221246 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:15:09.144576 0.190843 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:17:11.902515 3.000852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 18:17:18.909648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:17:26.910680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:17:42.913700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:18:14.919841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:23:39.687454 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 18:23:39.687588 0.919564 tcp 10.0.2.105 52647 -> 128.255.183.224 9027 FSPA* 0 0 12 1586 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:24:18.925975 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:24:25.933667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:24:33.934661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:24:49.938118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:25:21.944158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:31:25.950538 3.000634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:31:32.957530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:31:40.959161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:31:56.961967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:32:28.968017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:38:32.974254 3.001055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:38:39.981422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:38:47.983093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:39:03.985767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:39:35.991892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:45:09.461680 0.009537 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 18:45:09.471313 0.512866 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:09.984608 0.020100 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.005033 0.191369 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.196805 0.071588 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.268838 0.037219 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.306452 0.154456 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.461257 0.029440 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.491029 0.084045 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.575473 0.189576 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.765456 0.157110 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:10.922981 0.169145 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.092691 0.177541 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.270620 0.231423 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.502450 0.143037 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.645902 0.137627 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.783920 0.100504 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:11.884843 0.934800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:12.820029 2.943556 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:15.763985 0.215314 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:15.979699 0.139616 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:16.119734 0.168929 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:16.289050 0.219195 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:16.508638 0.165258 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:16.674289 0.191521 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:16.866198 0.496739 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/12 18:45:39.998624 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:45:47.004956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:45:55.006534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:46:11.009462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:46:43.015479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:52:47.022352 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 18:52:54.029085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:53:02.030303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:53:18.033938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:53:40.606601 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 18:53:40.606698 1.006375 tcp 10.0.2.105 52648 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/12 18:53:50.039443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 18:59:54.046058 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:00:01.053387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:00:09.054736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:00:25.057525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:00:57.063915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:07:01.069303 3.002162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:07:08.076899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:07:16.078556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:07:32.081666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:08:04.087287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:14:08.093421 3.002109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:14:15.101307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:14:23.102476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:14:39.105762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:15:11.111774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:15:18.272053 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 19:15:18.272153 0.193063 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:18.465620 0.073698 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:18.539721 0.040463 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:18.580738 0.722731 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.303894 0.020238 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.324638 0.153554 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.478608 0.028027 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.507024 0.084785 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.592228 0.184174 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.776796 0.154792 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:19.931994 0.180214 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.112633 0.176596 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.289620 0.235790 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.525827 0.143481 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.669687 0.137982 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.808008 0.115853 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:20.924281 1.165368 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:22.090003 1.980874 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:24.071271 0.364260 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:24.435904 0.137823 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:24.574138 0.167192 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:24.741696 0.189254 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:24.931351 0.530351 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:25.462096 0.210429 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:15:25.672972 0.164516 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:21:15.118341 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:21:22.124761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:21:30.126354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:21:46.129421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:22:18.135407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:23:41.616130 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 19:23:41.616224 0.972509 tcp 10.0.2.105 52649 -> 128.255.183.224 9027 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/01/12 19:28:22.141883 3.001419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:28:29.149325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:28:37.150195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:28:53.153845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:29:25.159691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:35:29.166103 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:35:36.173092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:35:44.174102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:36:00.177532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:36:32.183821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:42:36.190332 3.000990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:42:43.196864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:42:51.198842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:43:07.201512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:43:39.207116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:45:34.954445 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 19:45:34.954688 0.037720 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:34.992816 0.634843 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:35.628065 0.020424 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:35.648827 0.193339 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:35.842627 0.073219 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:35.916187 0.154614 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.071176 0.027467 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.098993 0.130902 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.230298 0.188776 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.419495 0.155847 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.575771 0.186040 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.762209 0.175136 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:36.937780 0.197632 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:37.135831 0.142192 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:37.278416 0.137784 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:37.416645 0.103500 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:37.520558 1.023227 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:38.544200 2.927538 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:41.472144 0.213715 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:41.686273 0.136926 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:41.823668 0.167815 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:41.991875 0.188642 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:42.180907 0.170629 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:42.351922 0.419845 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:45:42.772128 0.545285 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/12 19:49:43.213281 3.002150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:49:50.220758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:49:58.222106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:50:14.225722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:50:46.231379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:53:42.596025 0.000181 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 19:53:42.596315 0.889622 tcp 10.0.2.105 52650 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/12 19:56:50.237572 3.001623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 19:56:57.244816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:57:05.246069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:57:21.249150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 19:57:53.255217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:03:57.262255 3.000674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:04:04.268899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:04:12.270414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:04:28.273291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:05:00.279336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:11:04.285949 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:11:11.292701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:11:19.294224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:11:35.297523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:12:07.303604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:15:46.619259 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 20:15:46.619454 0.042514 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:46.662381 0.192376 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:46.855170 0.089394 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:46.944949 0.155078 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.100401 0.036323 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.137125 0.072029 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.209540 0.455973 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.665911 0.020600 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.711199 0.180045 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:47.891672 0.156163 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.048236 0.240912 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.289630 0.177065 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.467114 0.247937 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.715431 0.142282 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.858143 0.123973 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:48.982506 0.114095 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:49.097010 1.168533 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:50.265874 2.633188 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:52.899464 0.170617 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:53.070440 0.143751 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:53.214582 0.167402 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:53.382394 0.188551 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:53.571374 0.165617 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:53.737393 0.462981 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:15:54.200782 0.405141 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:18:11.309161 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:18:18.316526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:18:26.318307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:18:42.321551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:19:14.327287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:23:43.484780 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 20:23:43.484878 0.964431 tcp 10.0.2.105 52651 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/12 20:25:18.333376 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:25:25.340619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:25:33.342194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:25:49.345545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:26:21.351436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:32:25.356748 3.001813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:32:32.365517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:32:40.367018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:32:56.370289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:33:28.374936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:39:32.381646 3.001054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:39:39.389084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:39:47.389835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:40:03.393341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:40:35.399488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:46:05.794557 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 20:46:05.794651 0.041511 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:05.836727 0.188067 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.025203 0.072119 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.097751 0.154926 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.253116 0.031872 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.285400 0.072580 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.358335 0.179255 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.537963 0.157272 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.695720 0.186159 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:06.882328 0.507377 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:07.390132 0.020735 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:07.411234 0.176142 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:07.587805 0.245518 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:07.833682 0.143162 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:07.977192 0.130966 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:08.108570 0.103170 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:08.212141 1.085267 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:09.297794 0.142927 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:09.441118 1.748672 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:11.190206 0.166277 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:11.356804 0.166047 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:11.523264 0.190769 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:11.714403 0.339991 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:12.054784 0.320330 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:12.375505 0.460752 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/12 20:46:39.406357 3.000182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:46:46.412715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:46:54.414467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:47:10.416774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:47:42.422805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:53:44.454520 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 20:53:44.454621 1.047439 tcp 10.0.2.105 52652 -> 128.255.183.224 9027 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/01/12 20:53:46.429990 3.000471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 20:53:53.436889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:54:01.438052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:54:17.441337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 20:54:49.447201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:00:53.453706 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:01:00.460363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:01:08.462031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:01:24.464905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:01:56.471477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:08:00.477500 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:08:07.484151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:08:15.485906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:08:31.489035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:09:03.495075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:15:07.502452 3.000610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:15:14.508303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:15:22.509897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:15:38.512846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:16:10.519254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:16:35.565378 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 21:16:35.565558 0.038623 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:35.604605 0.192494 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:35.797520 0.093366 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:35.891278 0.158125 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.049802 0.036110 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.086309 0.072258 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.158953 0.173908 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.333252 0.190543 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.524127 0.154685 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:36.679169 0.476030 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.155605 0.020708 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.176644 0.176628 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.353717 0.233718 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.587854 0.143836 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.732074 0.131170 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:37.863680 0.206279 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:38.070365 1.016166 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:39.086932 0.143147 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:39.230434 2.153257 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:41.384017 0.186868 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:41.571264 0.167872 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:41.739488 0.191439 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:41.945208 0.321220 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:42.266809 0.239980 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:16:42.507185 0.250284 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 198 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:22:14.525691 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:22:21.532187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:22:29.534043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:22:45.536612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:23:17.542704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:23:45.504063 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 21:23:45.504149 0.919060 tcp 10.0.2.105 52653 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/12 21:29:21.549788 3.001001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:29:28.556064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:29:36.557830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:29:52.560551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:30:24.567283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:36:28.572612 3.002351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:36:35.580152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:36:43.581897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:36:59.584743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:37:31.591003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:43:35.596648 3.001833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:43:42.604387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:43:50.606132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:44:06.608888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:44:38.614927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:47:05.866785 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 21:47:05.867040 0.041548 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:05.909134 0.187805 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.097362 0.072709 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.170446 0.181502 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.352847 0.027805 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.381061 0.084270 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.465740 0.176996 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:06.643091 0.569293 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:07.212787 0.020692 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:07.233902 0.175199 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:07.409591 0.177826 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:07.587766 0.155825 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:07.743968 0.273245 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:08.017571 0.145919 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:08.163883 0.145257 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:08.309613 0.113384 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:08.423462 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 21:47:23.723890 0.053457 tcp 10.0.2.105 52654 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 21:47:23.777641 0.071315 tcp 10.0.2.105 52655 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 21:47:23.849308 0.155860 tcp 10.0.2.105 52656 -> 195.113.214.236 443 SRPA* 0 0 33 26048 flow=From-Botnet-V2-TCP-Established 1970/01/12 21:47:24.005755 0.142238 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:24.148528 1.910728 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:26.059665 0.233306 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:26.293344 0.167222 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:26.460966 0.188154 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:26.649509 0.168403 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:26.818277 0.221190 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:47:27.039855 0.219542 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/12 21:50:42.620514 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:50:49.628527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:50:57.629641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:51:13.632796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:51:45.638755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:53:46.422765 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 21:53:46.422967 1.103328 tcp 10.0.2.105 52657 -> 128.255.183.224 9027 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/01/12 21:57:49.644623 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 21:57:56.652528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:58:04.653763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:58:20.656862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 21:58:52.662916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:04:56.669049 3.001363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 22:05:03.676043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:05:11.677978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:05:27.680865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:05:59.686645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:12:03.693330 3.000806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 22:12:10.700680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:12:18.701745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:12:34.704750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:13:06.710463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:17:49.437236 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:17:49.437315 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:08.256801 0.052315 tcp 10.0.2.105 52658 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:18:08.309462 0.092770 tcp 10.0.2.105 52659 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:18:08.402157 0.152501 tcp 10.0.2.105 52660 -> 195.113.214.236 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:18:08.648971 4.376015 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 4 1013 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:08.721730 3.879298 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1139 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:08.875943 3.787157 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 4 1114 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:08.919172 3.936070 udp 10.0.2.105 7010 <-> 75.20.135.31 3612 CON 0 0 4 1242 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.111264 3.830669 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 4 1053 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.195445 4.032575 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 4 1361 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.382657 3.918280 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 4 1278 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.450683 3.878383 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 4 1066 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.478160 3.872896 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1109 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.499118 4.011608 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 4 1342 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.655423 4.213520 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1217 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:09.887866 4.125140 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 1301 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.031006 4.106591 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1055 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.155627 4.172150 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1183 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.345301 4.994566 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 4 1100 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.524498 3.909459 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 4 1009 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.625599 3.950446 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 4 1136 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:10.767585 4.389772 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1029 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:11.223847 4.310731 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1298 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:11.408992 4.287929 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1125 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:11.577710 4.307786 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 4 1172 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:11.766828 4.303457 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 4 1183 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:11.935287 4.351610 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 4 1249 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:12.148195 4.414526 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1263 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:18:16.563513 0.000000 udp 10.0.2.105 7010 -> 117.193.255.153 7916 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:23.696408 0.000000 udp 10.0.2.105 7010 -> 95.13.65.45 8667 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:30.345862 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:35.193117 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:18:37.126270 0.000000 udp 10.0.2.105 7010 -> 90.209.172.13 2802 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:42.723731 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:49.143053 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:54.451143 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5833 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:18:59.187369 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:19:02.652960 0.412309 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:19:03.146272 0.000000 udp 10.0.2.105 7010 -> 88.252.37.251 1830 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:10.183325 0.000000 udp 10.0.2.105 7010 -> 2.14.11.151 7556 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:10.717331 3.000929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 22:19:17.724034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:19:17.764403 0.000000 udp 10.0.2.105 7010 -> 94.71.118.227 2639 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:24.093431 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:25.725413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:19:28.690023 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:19:29.761497 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 2495 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:36.791520 0.000000 udp 10.0.2.105 7010 -> 2.50.167.132 9194 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:41.729033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:19:45.214027 0.000000 udp 10.0.2.105 7010 -> 74.93.195.86 5044 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:53.375454 0.000000 udp 10.0.2.105 7010 -> 146.255.8.214 6793 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:19:58.192165 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:20:00.155255 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:08.857906 0.000000 udp 10.0.2.105 7010 -> 2.135.211.173 1868 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:13.734829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:20:15.587803 0.000000 udp 10.0.2.105 7010 -> 79.8.187.208 7781 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:24.149580 0.000000 udp 10.0.2.105 7010 -> 93.193.151.154 7662 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:28.696372 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:20:31.911282 0.143323 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:20:32.150356 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:41.054344 0.000000 udp 10.0.2.105 7010 -> 108.247.20.223 6976 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:47.523695 0.108846 udp 10.0.2.105 7010 <-> 92.21.26.156 7966 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:20:47.683190 0.000000 udp 10.0.2.105 7010 -> 190.242.133.206 8141 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:52.911444 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:20:57.688038 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:20:58.088273 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:04.908736 0.171927 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:21:05.104628 0.623395 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:21:05.766665 0.000000 udp 10.0.2.105 7010 -> 78.183.247.37 7653 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:11.677860 0.000000 udp 10.0.2.105 7010 -> 71.195.238.201 9442 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:16.865675 0.000000 udp 10.0.2.105 7010 -> 109.192.115.235 8616 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:21.692115 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:21:24.816757 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:30.445465 0.135268 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:21:30.607435 0.071691 udp 10.0.2.105 7010 <-> 217.232.139.91 7388 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:21:30.702276 0.000000 udp 10.0.2.105 7010 -> 2.177.151.76 4373 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:39.307670 0.000000 udp 10.0.2.105 7010 -> 110.234.196.42 8132 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:44.435438 0.000000 udp 10.0.2.105 7010 -> 190.164.108.142 9145 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:21:49.191666 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:21:52.286260 0.000000 udp 10.0.2.105 7010 -> 64.32.178.38 2066 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:01.259486 0.000000 udp 10.0.2.105 7010 -> 124.122.62.80 9988 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:06.476631 0.000000 udp 10.0.2.105 7010 -> 202.171.188.175 9144 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:15.199654 0.000000 udp 10.0.2.105 7010 -> 68.157.185.147 4161 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:20.196116 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:22:21.398498 0.000000 udp 10.0.2.105 7010 -> 75.61.199.93 5772 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:29.249610 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:36.941196 0.214226 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:22:37.351830 0.000000 udp 10.0.2.105 7010 -> 95.14.70.15 1777 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:45.322673 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:22:50.189392 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:22:52.333162 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:01.035580 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:07.093932 0.259346 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:23:07.426195 0.275605 udp 10.0.2.105 7010 <-> 118.172.146.102 8660 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:23:07.740620 0.150853 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:23:07.936581 0.000000 udp 10.0.2.105 7010 -> 84.92.215.184 9630 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:14.204463 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:19.191103 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:23:22.406500 0.000000 udp 10.0.2.105 7010 -> 86.120.136.10 3509 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:29.506034 0.000000 udp 10.0.2.105 7010 -> 217.165.124.137 2474 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:36.857292 0.000000 udp 10.0.2.105 7010 -> 207.239.238.164 4599 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:44.938839 0.000000 udp 10.0.2.105 7010 -> 173.166.16.233 9435 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:47.532721 0.998465 tcp 10.0.2.105 52661 -> 128.255.183.224 9027 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:23:51.408014 0.342952 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:23:51.769523 0.032269 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 857 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:23:51.821112 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:23:57.146151 0.000000 udp 10.0.2.105 7010 -> 118.44.163.123 4456 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:02.403811 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:08.121855 0.000000 udp 10.0.2.105 7010 -> 87.29.87.164 7975 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:12.687965 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:24:13.790367 0.000000 udp 10.0.2.105 7010 -> 87.10.168.128 4901 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:21.320525 0.000000 udp 10.0.2.105 7010 -> 117.223.53.194 6655 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:28.701550 0.059432 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:24:29.061915 0.000000 udp 10.0.2.105 7010 -> 173.2.140.159 8885 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:35.401377 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:40.187639 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:24:41.890232 1.112705 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:24:43.030312 0.000000 udp 10.0.2.105 7010 -> 88.204.167.83 3546 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:48.149631 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:24:56.401445 0.000000 udp 10.0.2.105 7010 -> 79.129.54.87 1028 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:04.393032 0.000000 udp 10.0.2.105 7010 -> 198.101.101.122 1289 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:09.189200 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:25:11.332873 0.388272 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:25:11.753023 0.000000 udp 10.0.2.105 7010 -> 198.91.222.134 9354 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:17.451441 0.000000 udp 10.0.2.105 7010 -> 82.47.110.221 3085 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:26.224019 0.000000 udp 10.0.2.105 7010 -> 108.9.203.21 5632 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:35.156607 0.063909 udp 10.0.2.105 7010 -> 95.49.169.59 1276 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:35.220516 0.000000 icmp 95.49.169.59 0x0303 -> 10.0.2.105 0xfc04 URP 192 1 293 flow=Background 1970/01/12 22:25:39.693048 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:25:43.268379 0.000000 udp 10.0.2.105 7010 -> 188.58.240.244 1059 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:49.427697 0.000000 udp 10.0.2.105 7010 -> 181.65.11.92 5396 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:25:57.228706 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:05.560648 0.125972 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:05.686620 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 276 flow=Background 1970/01/12 22:26:10.197188 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:26:11.529545 0.000000 udp 10.0.2.105 7010 -> 176.199.239.154 5230 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:17.457643 0.000000 udp 10.0.2.105 7010 -> 70.45.136.9 1606 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:17.741113 3.001104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 22:26:23.005603 0.000000 udp 10.0.2.105 7010 -> 188.245.201.171 5730 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:24.748170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:26:30.876867 0.000000 udp 10.0.2.105 7010 -> 188.217.154.150 6426 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:32.749885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:26:35.693930 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:26:39.619911 0.349251 udp 10.0.2.105 7010 <-> 119.42.65.231 2875 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:26:40.022201 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:45.618555 0.278014 udp 10.0.2.105 7010 <-> 5.234.90.187 2168 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:26:45.972185 0.056066 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:26:46.072457 0.236942 udp 10.0.2.105 7010 <-> 118.175.40.229 5081 CON 0 0 2 702 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:26:46.369564 0.000000 udp 10.0.2.105 7010 -> 217.247.156.187 6828 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:26:48.752284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:26:53.649467 0.000000 udp 10.0.2.105 7010 -> 2.91.112.82 5218 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:02.031815 0.000000 udp 10.0.2.105 7010 -> 2.50.166.40 5454 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:06.688666 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:27:08.811556 0.000000 udp 10.0.2.105 7010 -> 79.20.64.43 9820 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:17.554423 0.121693 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:27:17.705396 0.062038 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:27:17.865305 0.695821 udp 10.0.2.105 7010 <-> 118.231.79.191 9776 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:27:18.828616 0.053247 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:27:18.980666 0.000000 udp 10.0.2.105 7010 -> 118.3.18.176 7928 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:20.758341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:27:26.697388 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 7946 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:31.694662 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:27:35.649917 0.051819 udp 10.0.2.105 7010 <-> 79.112.233.46 3757 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:27:35.741832 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:42.229604 0.000000 udp 10.0.2.105 7010 -> 178.59.171.35 3516 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:48.378313 0.000000 udp 10.0.2.105 7010 -> 85.179.32.170 2372 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:53.636365 0.207408 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:27:53.843773 0.000000 icmp 69.234.20.39 0x0303 -> 10.0.2.105 0xb61d URP 192 1 195 flow=Background 1970/01/12 22:27:58.192540 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:28:02.058213 0.000000 udp 10.0.2.105 7010 -> 98.254.134.82 8430 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:09.418754 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:16.449043 0.000000 udp 10.0.2.105 7010 -> 78.164.52.182 1057 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:25.151693 0.294669 udp 10.0.2.105 7010 <-> 58.11.65.55 7346 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:28:25.457508 0.000000 udp 10.0.2.105 7010 -> 103.30.188.36 5289 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:29.687769 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:28:31.049829 0.000000 udp 10.0.2.105 7010 -> 217.36.221.248 2005 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:39.371906 0.000000 udp 10.0.2.105 7010 -> 66.31.153.6 9408 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:45.370129 0.000000 udp 10.0.2.105 7010 -> 86.10.235.90 4545 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:53.602412 0.308075 udp 10.0.2.105 7010 -> 202.168.232.30 4173 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:28:53.910487 0.000000 icmp 202.168.232.30 0x0303 -> 10.0.2.105 0x4d10 URP 192 1 161 flow=Background 1970/01/12 22:28:58.188864 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:29:00.552361 0.054545 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:29:00.615682 0.172715 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:29:00.804955 0.134147 udp 10.0.2.105 7010 <-> 81.148.82.171 2747 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:29:00.949054 0.000000 udp 10.0.2.105 7010 -> 79.10.234.236 3159 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:29:07.341985 0.000000 udp 10.0.2.105 7010 -> 37.77.121.248 8993 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:29:15.453766 0.000000 udp 10.0.2.105 7010 -> 2.38.1.152 6262 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:29:23.745828 0.053469 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:29:23.810084 0.248650 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:29:24.058734 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 308 flow=Background 1970/01/12 22:29:28.692371 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:29:31.786883 0.000000 udp 10.0.2.105 7010 -> 172.3.194.112 5720 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:29:39.848661 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 22:33:24.764531 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 22:33:31.772115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:33:39.773468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:33:55.776400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:34:27.782750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:40:31.788483 3.001992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 22:40:38.796203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:40:46.797606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:41:02.800725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:41:34.806566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:47:38.812029 3.002321 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 22:47:45.819770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:47:53.821646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:48:09.824460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:48:41.830276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:53:48.532410 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:53:48.532640 0.611549 tcp 10.0.2.105 52662 -> 128.255.183.224 9027 FSPA* 0 0 13 1288 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:53:48.810860 0.088055 tcp 10.0.2.105 52663 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:53:48.899326 0.074706 tcp 10.0.2.105 52664 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:53:48.974385 0.145393 tcp 10.0.2.105 52665 -> 195.113.214.236 443 SRPA* 0 0 57 36504 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:53:49.144536 2.991853 tcp 10.0.2.105 52666 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:53:58.145424 0.000000 tcp 10.0.2.105 52666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:04.144728 0.051195 tcp 10.0.2.105 52667 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:04.196193 0.073810 tcp 10.0.2.105 52668 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:04.270289 0.156407 tcp 10.0.2.105 52669 -> 195.113.214.236 443 SRPA* 0 0 23 12064 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:04.437171 3.001329 tcp 10.0.2.105 52670 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:13.437337 0.000000 tcp 10.0.2.105 52670 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:19.436437 0.052914 tcp 10.0.2.105 52671 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:19.489641 0.075275 tcp 10.0.2.105 52672 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:19.565209 0.162692 tcp 10.0.2.105 52673 -> 195.113.214.236 443 SRPA* 0 0 36 18300 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:19.742120 0.733354 tcp 10.0.2.105 52674 -> 200.84.7.244 8038 FSPA* 0 0 13 1288 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:20.175426 0.055687 tcp 10.0.2.105 52675 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:20.231400 0.070744 tcp 10.0.2.105 52676 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:20.302031 0.161443 tcp 10.0.2.105 52677 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:20.475729 2.995787 tcp 10.0.2.105 52678 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:29.470102 0.000000 tcp 10.0.2.105 52678 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:35.469575 0.050560 tcp 10.0.2.105 52679 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:35.520451 0.066722 tcp 10.0.2.105 52680 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:35.587436 0.163064 tcp 10.0.2.105 52681 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:35.780635 3.003218 tcp 10.0.2.105 52682 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:44.782007 0.000000 tcp 10.0.2.105 52682 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:45.836625 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 22:54:50.781675 0.051776 tcp 10.0.2.105 52683 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:50.833294 0.074321 tcp 10.0.2.105 52684 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:50.907907 0.156275 tcp 10.0.2.105 52685 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:54:51.083108 3.002279 tcp 10.0.2.105 52686 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:54:52.843854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:55:00.084012 0.000000 tcp 10.0.2.105 52686 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:00.845781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:55:06.083649 0.051367 tcp 10.0.2.105 52687 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:06.134831 0.075385 tcp 10.0.2.105 52688 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:06.210093 0.159503 tcp 10.0.2.105 52689 -> 195.113.214.236 443 SRPA* 0 0 22 11400 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:06.379429 0.057850 tcp 10.0.2.105 52690 -> 82.211.142.218 9811 SPA_* 0 0 9 1072 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:16.486058 0.375582 tcp 10.0.2.105 52690 -> 82.211.142.218 9811 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:16.486861 0.050261 tcp 10.0.2.105 52691 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:16.537411 0.073799 tcp 10.0.2.105 52692 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:16.611527 0.159119 tcp 10.0.2.105 52693 -> 195.113.214.236 443 SRPA* 0 0 42 32020 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:16.848226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:55:16.861863 3.001213 tcp 10.0.2.105 52694 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:25.861432 0.000000 tcp 10.0.2.105 52694 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:31.860425 0.050655 tcp 10.0.2.105 52695 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:31.910936 0.075384 tcp 10.0.2.105 52696 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:31.986617 0.159008 tcp 10.0.2.105 52697 -> 195.113.214.236 443 SRPA* 0 0 77 57334 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:32.157719 3.007241 tcp 10.0.2.105 52698 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:41.163340 0.000000 tcp 10.0.2.105 52698 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:47.152843 0.050646 tcp 10.0.2.105 52699 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:47.203773 0.074336 tcp 10.0.2.105 52700 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:47.277990 0.150672 tcp 10.0.2.105 52701 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:47.454409 0.275937 tcp 10.0.2.105 52702 -> 128.255.183.224 9027 FSPA* 0 0 13 1288 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:55:47.730568 2.996478 tcp 10.0.2.105 52703 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:55:48.854489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 22:55:56.736054 0.000000 tcp 10.0.2.105 52703 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:02.724335 2.994649 tcp 10.0.2.105 52704 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:11.717678 0.000000 tcp 10.0.2.105 52704 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:16.694622 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:56:17.725932 0.425182 tcp 10.0.2.105 52705 -> 200.84.7.244 8038 FSPA* 0 0 13 1288 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:56:18.151007 3.000153 tcp 10.0.2.105 52706 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:27.149800 0.000000 tcp 10.0.2.105 52706 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:33.148543 3.003910 tcp 10.0.2.105 52707 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:42.151419 0.000000 tcp 10.0.2.105 52707 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:46.687853 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:56:48.150173 3.003687 tcp 10.0.2.105 52708 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:56:57.152840 0.000000 tcp 10.0.2.105 52708 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:57:03.151855 0.110630 tcp 10.0.2.105 52709 -> 82.211.142.218 9811 FSPA* 0 0 13 1288 flow=From-Botnet-V2-TCP-Established 1970/01/12 22:57:03.262656 3.003348 tcp 10.0.2.105 52710 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:57:12.264153 0.000000 tcp 10.0.2.105 52710 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:57:18.263204 2.994481 tcp 10.0.2.105 52711 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:57:27.266180 0.000000 tcp 10.0.2.105 52711 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 22:57:32.193062 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:59:56.510618 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 22:59:56.510716 0.100428 udp 10.0.2.105 7010 <-> 79.56.200.90 2691 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:56.611559 0.020352 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:56.632383 0.181290 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:56.814114 0.061262 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:56.875754 0.028875 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:56.905011 0.152770 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.058200 0.142930 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.201471 0.285327 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.487180 0.131097 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.618679 0.187691 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.806781 0.153588 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:57.960773 0.158988 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.120136 0.114360 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.234947 0.178017 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.413344 0.189717 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.603542 0.169012 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.772977 0.213119 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:58.986492 0.167621 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:59.154576 0.166863 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:59.321835 0.224197 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:59.546403 0.388976 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/12 22:59:59.935719 0.251006 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:00.187094 0.000000 udp 10.0.2.105 7010 -> 92.21.26.156 7966 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:00:15.299805 0.052980 tcp 10.0.2.105 52712 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:15.353058 0.069688 tcp 10.0.2.105 52713 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:15.423040 0.157948 tcp 10.0.2.105 52714 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:15.581627 0.167625 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:15.749698 0.074700 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:15.824795 0.113837 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:15.939411 0.000000 udp 10.0.2.105 7010 -> 217.232.139.91 7388 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:00:34.125032 0.051363 tcp 10.0.2.105 52715 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:34.176720 0.074425 tcp 10.0.2.105 52716 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:34.251504 0.154940 tcp 10.0.2.105 52717 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:34.406893 0.248612 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:34.655914 0.153138 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:34.809497 0.153759 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:34.963672 0.273977 udp 10.0.2.105 7010 <-> 118.172.146.102 8660 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:35.237981 0.342821 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:35.581208 0.028541 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:35.610071 0.055301 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:35.665771 0.335687 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:36.001805 0.371913 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:36.374091 0.000000 udp 10.0.2.105 7010 -> 119.42.65.231 2875 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:00:51.650736 0.051949 tcp 10.0.2.105 52718 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:51.702956 0.074487 tcp 10.0.2.105 52719 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:51.777787 0.159990 tcp 10.0.2.105 52720 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:00:51.938390 0.422911 udp 10.0.2.105 7010 <-> 5.234.90.187 2168 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:52.362061 0.055832 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:52.418303 0.240090 udp 10.0.2.105 7010 <-> 118.175.40.229 5081 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:52.658764 0.064262 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:52.723364 0.121188 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:52.844930 0.635652 udp 10.0.2.105 7010 <-> 118.231.79.191 9776 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:53.480980 0.052858 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:00:53.534208 0.000000 udp 10.0.2.105 7010 -> 79.112.233.46 3757 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:01:08.885065 0.052214 tcp 10.0.2.105 52721 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:08.937593 0.070036 tcp 10.0.2.105 52722 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:09.007909 0.159904 tcp 10.0.2.105 52723 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:09.168303 0.000000 udp 10.0.2.105 7010 -> 58.11.65.55 7346 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:01:25.138478 0.052186 tcp 10.0.2.105 52724 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:25.191001 0.073970 tcp 10.0.2.105 52725 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:25.265253 0.174582 tcp 10.0.2.105 52726 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:01:25.440487 0.080125 udp 10.0.2.105 7010 <-> 81.148.82.171 2747 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:01:25.521030 0.170128 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:01:25.691540 0.054988 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:01:25.747021 0.054750 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:01:52.860986 3.001281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:01:59.868255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:02:07.869511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:02:23.872420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:02:33.266738 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:02:33.266833 3.003187 tcp 10.0.2.105 52727 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:02:42.268797 0.000000 tcp 10.0.2.105 52727 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:02:48.268793 0.052288 tcp 10.0.2.105 52728 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:48.321366 0.066755 tcp 10.0.2.105 52729 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:48.388560 0.167900 tcp 10.0.2.105 52730 -> 195.113.214.236 443 SRPA* 0 0 44 35970 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:48.628863 0.575483 tcp 10.0.2.105 52731 -> 128.255.183.224 9027 FSPA* 0 0 13 1442 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:48.904894 0.050803 tcp 10.0.2.105 52732 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:48.955551 0.074606 tcp 10.0.2.105 52733 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:49.030356 0.157015 tcp 10.0.2.105 52734 -> 195.113.214.236 443 SRPA* 0 0 37 30056 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:02:49.204529 2.998701 tcp 10.0.2.105 52735 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:02:55.878347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:02:58.201585 0.000000 tcp 10.0.2.105 52735 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:04.201207 0.050518 tcp 10.0.2.105 52736 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:04.252005 0.069066 tcp 10.0.2.105 52737 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:04.321396 0.163363 tcp 10.0.2.105 52738 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:04.494845 3.000334 tcp 10.0.2.105 52739 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:13.494060 0.000000 tcp 10.0.2.105 52739 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:19.493938 0.053494 tcp 10.0.2.105 52740 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:19.547789 0.070308 tcp 10.0.2.105 52741 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:19.618371 0.152262 tcp 10.0.2.105 52742 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:19.794571 0.746495 tcp 10.0.2.105 52743 -> 200.84.7.244 8038 FSPA* 0 0 13 1442 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:20.249628 0.051800 tcp 10.0.2.105 52744 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:20.301737 0.068940 tcp 10.0.2.105 52745 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:20.371024 0.159065 tcp 10.0.2.105 52746 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:20.541234 2.996843 tcp 10.0.2.105 52747 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:29.536847 0.000000 tcp 10.0.2.105 52747 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:35.536374 0.052217 tcp 10.0.2.105 52748 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:35.588919 0.074866 tcp 10.0.2.105 52749 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:35.664081 0.161417 tcp 10.0.2.105 52750 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:35.854710 2.995395 tcp 10.0.2.105 52751 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:44.848787 0.000000 tcp 10.0.2.105 52751 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:03:50.848637 0.051569 tcp 10.0.2.105 52752 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:50.900507 0.074032 tcp 10.0.2.105 52753 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:50.974849 0.155442 tcp 10.0.2.105 52754 -> 195.113.214.236 443 SRPA* 0 0 40 33082 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:03:51.142668 2.999862 tcp 10.0.2.105 52755 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:00.140617 0.000000 tcp 10.0.2.105 52755 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:06.140219 0.052045 tcp 10.0.2.105 52756 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.192349 0.076291 tcp 10.0.2.105 52757 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.268998 0.175395 tcp 10.0.2.105 52758 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.461801 0.404007 tcp 10.0.2.105 52759 -> 82.211.142.218 9811 FSPA* 0 0 13 1442 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.570303 0.052703 tcp 10.0.2.105 52760 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.623343 0.070643 tcp 10.0.2.105 52761 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.694270 0.153166 tcp 10.0.2.105 52762 -> 195.113.214.236 443 SRPA* 0 0 35 18392 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:06.866012 2.998934 tcp 10.0.2.105 52763 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:15.863595 0.000000 tcp 10.0.2.105 52763 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:21.862926 0.051494 tcp 10.0.2.105 52764 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:21.914686 0.070898 tcp 10.0.2.105 52765 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:21.985891 0.160620 tcp 10.0.2.105 52766 -> 195.113.214.236 443 SRPA* 0 0 40 33108 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:22.158238 2.998704 tcp 10.0.2.105 52767 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:31.165535 0.000000 tcp 10.0.2.105 52767 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:37.154306 0.262090 tcp 10.0.2.105 52768 -> 128.255.183.224 9027 FSPA* 0 0 13 1442 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:04:37.416692 3.002219 tcp 10.0.2.105 52769 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:46.417203 0.000000 tcp 10.0.2.105 52769 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:04:52.415958 3.004458 tcp 10.0.2.105 52770 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:01.419214 0.000000 tcp 10.0.2.105 52770 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:06.196114 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:05:07.417887 0.447017 tcp 10.0.2.105 52771 -> 200.84.7.244 8038 FSPA* 0 0 13 1442 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:05:07.865146 2.997537 tcp 10.0.2.105 52772 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:16.861384 0.000000 tcp 10.0.2.105 52772 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:22.859635 3.004314 tcp 10.0.2.105 52773 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:31.862579 0.000000 tcp 10.0.2.105 52773 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:43.489407 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:05:44.649923 3.728895 tcp 10.0.2.105 52774 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:05:54.265918 0.000000 tcp 10.0.2.105 52774 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:06:00.318746 0.074126 tcp 10.0.2.105 52775 -> 82.211.142.218 9811 SPA_* 0 0 9 1226 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:06:30.018194 1.207535 tcp 10.0.2.105 52775 -> 82.211.142.218 9811 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:06:31.226008 2.955603 tcp 10.0.2.105 52776 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:06:42.426969 0.000000 tcp 10.0.2.105 52776 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:09:09.374774 2.961970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:09:16.284838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:09:24.181471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:09:39.967986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:10:11.550676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:11:45.301618 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:11:45.301724 2.963558 tcp 10.0.2.105 52777 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:11:54.177363 0.000000 tcp 10.0.2.105 52777 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:00.089030 0.052216 tcp 10.0.2.105 52778 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:00.141533 0.074305 tcp 10.0.2.105 52779 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:00.216121 0.154475 tcp 10.0.2.105 52780 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:00.415384 0.154173 tcp 10.0.2.105 52781 -> 128.255.183.224 9027 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:10.719495 0.303882 tcp 10.0.2.105 52781 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:10.720364 0.050735 tcp 10.0.2.105 52782 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:10.771406 0.075003 tcp 10.0.2.105 52783 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:10.846807 0.159229 tcp 10.0.2.105 52784 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:11.023632 2.967191 tcp 10.0.2.105 52785 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:19.908317 0.000000 tcp 10.0.2.105 52785 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:25.821084 0.051948 tcp 10.0.2.105 52786 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:25.873320 0.073930 tcp 10.0.2.105 52787 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:25.947576 0.161587 tcp 10.0.2.105 52788 -> 195.113.214.236 443 SRPA* 0 0 67 69800 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:26.125590 2.970846 tcp 10.0.2.105 52789 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:35.013995 0.000000 tcp 10.0.2.105 52789 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:40.931208 0.051293 tcp 10.0.2.105 52790 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:40.982330 0.070573 tcp 10.0.2.105 52791 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.053244 0.161496 tcp 10.0.2.105 52792 -> 195.113.214.236 443 SRPA* 0 0 32 17018 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.231333 0.737489 tcp 10.0.2.105 52793 -> 200.84.7.244 8038 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.682162 0.051690 tcp 10.0.2.105 52794 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.734116 0.065428 tcp 10.0.2.105 52795 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.799843 0.158455 tcp 10.0.2.105 52796 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:41.969128 2.956000 tcp 10.0.2.105 52797 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:50.855349 0.000000 tcp 10.0.2.105 52797 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:12:56.763379 0.051519 tcp 10.0.2.105 52798 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:56.815270 0.074674 tcp 10.0.2.105 52799 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:56.890252 0.156755 tcp 10.0.2.105 52800 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:12:57.241264 2.958457 tcp 10.0.2.105 52801 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:06.120565 0.000000 tcp 10.0.2.105 52801 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:12.038596 0.051476 tcp 10.0.2.105 52802 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:12.090465 0.070028 tcp 10.0.2.105 52803 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:12.160773 0.159316 tcp 10.0.2.105 52804 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:12.338516 2.953137 tcp 10.0.2.105 52805 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:21.206444 0.000000 tcp 10.0.2.105 52805 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:27.128503 0.052092 tcp 10.0.2.105 52806 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.180889 0.074530 tcp 10.0.2.105 52807 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.255680 0.214365 tcp 10.0.2.105 52808 -> 195.113.214.236 443 SRPA* 0 0 67 69800 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.480095 0.605917 tcp 10.0.2.105 52809 -> 82.211.142.218 9811 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.763254 0.051059 tcp 10.0.2.105 52810 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.814713 0.074226 tcp 10.0.2.105 52811 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:27.889299 0.160224 tcp 10.0.2.105 52812 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:28.086205 2.965160 tcp 10.0.2.105 52813 -> 158.110.22.32 5561 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:36.966805 0.000000 tcp 10.0.2.105 52813 -> 158.110.22.32 5561 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:42.879598 0.050915 tcp 10.0.2.105 52814 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:42.930832 0.070363 tcp 10.0.2.105 52815 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:43.001521 0.165083 tcp 10.0.2.105 52816 -> 195.113.214.236 443 SRPA* 0 0 34 26102 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:43.181881 2.961636 tcp 10.0.2.105 52817 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:52.057454 0.000000 tcp 10.0.2.105 52817 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:13:57.970954 0.289894 tcp 10.0.2.105 52818 -> 128.255.183.224 9027 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:13:58.261108 2.949241 tcp 10.0.2.105 52819 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:07.135558 0.000000 tcp 10.0.2.105 52819 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:13.050814 2.948083 tcp 10.0.2.105 52820 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:21.913871 0.000000 tcp 10.0.2.105 52820 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:26.802375 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:14:27.839424 0.437275 tcp 10.0.2.105 52821 -> 200.84.7.244 8038 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:14:28.276549 2.954019 tcp 10.0.2.105 52822 -> 46.49.61.109 5202 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:37.141926 0.000000 tcp 10.0.2.105 52822 -> 46.49.61.109 5202 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:43.060606 2.971050 tcp 10.0.2.105 52823 -> 87.198.39.36 4312 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:51.950589 0.000000 tcp 10.0.2.105 52823 -> 87.198.39.36 4312 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:14:56.875033 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:14:57.866435 2.970111 tcp 10.0.2.105 52824 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:15:06.757459 0.000000 tcp 10.0.2.105 52824 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:15:12.674568 0.111685 tcp 10.0.2.105 52825 -> 82.211.142.218 9811 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:15:12.786069 4.648593 tcp 10.0.2.105 52826 -> 158.110.22.32 5561 S_ 0 3 194 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:16:09.151344 3.002231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:16:16.159411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:16:24.161012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:16:40.163565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:17:12.170028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:20:25.548154 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:20:25.548268 0.592247 tcp 10.0.2.105 52827 -> 128.255.183.224 9027 FSPA* 0 0 13 1254 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:25.826105 0.053222 tcp 10.0.2.105 52828 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:25.879552 0.074719 tcp 10.0.2.105 52829 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:25.954594 0.161818 tcp 10.0.2.105 52830 -> 195.113.214.236 443 SRPA* 0 0 60 40712 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:26.140800 3.001797 tcp 10.0.2.105 52831 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:20:35.141882 0.000000 tcp 10.0.2.105 52831 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:20:41.141133 0.051369 tcp 10.0.2.105 52832 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:41.192807 0.072640 tcp 10.0.2.105 52833 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:41.265737 0.157612 tcp 10.0.2.105 52834 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:41.450613 3.004053 tcp 10.0.2.105 52835 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:20:50.453491 0.000000 tcp 10.0.2.105 52835 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:20:56.453079 0.050506 tcp 10.0.2.105 52836 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:56.503444 0.076672 tcp 10.0.2.105 52837 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:56.580475 0.159306 tcp 10.0.2.105 52838 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:56.758348 0.290124 tcp 10.0.2.105 52839 -> 128.255.183.224 9027 FSPA* 0 0 13 1254 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:20:57.048689 2.998864 tcp 10.0.2.105 52840 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:21:06.055717 0.000000 tcp 10.0.2.105 52840 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:21:12.044370 2.994696 tcp 10.0.2.105 52841 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:21:21.037326 0.000000 tcp 10.0.2.105 52841 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:21:25.934076 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:23:18.178765 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:23:25.185848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:23:33.187770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:23:49.190623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:24:21.196401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:30:25.202563 3.002004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/12 23:30:32.210011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:30:40.211475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:30:56.214080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:31:28.260600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:31:41.629885 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:31:41.629983 0.000000 udp 10.0.2.105 7010 -> 92.21.26.156 7966 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:31:58.495833 0.052435 tcp 10.0.2.105 52842 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:31:58.548579 0.071342 tcp 10.0.2.105 52843 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:31:58.620220 0.159750 tcp 10.0.2.105 52844 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:31:58.780763 0.000000 udp 10.0.2.105 7010 -> 217.232.139.91 7388 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:32:15.278786 0.051020 tcp 10.0.2.105 52845 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:15.330213 0.073699 tcp 10.0.2.105 52846 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:15.404257 0.156781 tcp 10.0.2.105 52847 -> 195.113.214.236 443 SRPA* 0 0 44 28270 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:15.561634 0.000000 udp 10.0.2.105 7010 -> 119.42.65.231 2875 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:32:33.715349 0.051784 tcp 10.0.2.105 52848 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:33.767505 0.071609 tcp 10.0.2.105 52849 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:33.839440 0.161817 tcp 10.0.2.105 52850 -> 195.113.214.236 443 SRPA* 0 0 39 34800 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:34.001825 0.000000 udp 10.0.2.105 7010 -> 79.112.233.46 3757 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:32:51.791412 0.050600 tcp 10.0.2.105 52851 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:51.842311 0.067102 tcp 10.0.2.105 52852 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:51.909673 0.160997 tcp 10.0.2.105 52853 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:32:52.071204 0.000000 udp 10.0.2.105 7010 -> 58.11.65.55 7346 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:33:09.817007 0.052292 tcp 10.0.2.105 52854 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:09.869578 0.066181 tcp 10.0.2.105 52855 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:09.935614 0.159976 tcp 10.0.2.105 52856 -> 195.113.214.236 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:10.096098 0.176070 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.287022 0.182834 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.470271 0.035670 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.515846 0.021954 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.549597 0.174210 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.703480 0.063954 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:10.767809 0.000000 udp 10.0.2.105 7010 -> 79.56.200.90 2691 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:33:12.100469 3.003280 tcp 10.0.2.105 52857 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:21.102602 0.000000 tcp 10.0.2.105 52857 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:26.360653 0.051035 tcp 10.0.2.105 52858 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:26.411565 0.130380 tcp 10.0.2.105 52859 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:26.542231 0.157027 tcp 10.0.2.105 52860 -> 195.113.214.236 443 SRPA* 0 0 41 31966 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:26.699836 0.144926 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:26.810070 0.154398 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 3 815 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:26.960664 0.124097 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.085092 0.143533 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.101637 0.051866 tcp 10.0.2.105 52861 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.154063 0.073913 tcp 10.0.2.105 52862 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.228300 0.159772 tcp 10.0.2.105 52863 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.228891 0.316634 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.410787 0.588825 tcp 10.0.2.105 52864 -> 128.255.183.224 9027 FSPA* 0 0 13 1315 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.534546 0.186628 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.701597 0.050708 tcp 10.0.2.105 52865 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.722642 0.196192 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.752596 0.074329 tcp 10.0.2.105 52866 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.827263 0.157958 tcp 10.0.2.105 52867 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:27.911511 0.170251 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:27.999835 2.997062 tcp 10.0.2.105 52868 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:28.082196 0.178600 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:28.261194 0.175044 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:28.440991 0.167988 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:28.609320 0.235522 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:28.823668 0.229655 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:29.053722 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:33:37.005589 0.000000 tcp 10.0.2.105 52868 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:42.588303 0.019179 udp 10.0.2.105 7010 <- 116.14.228.106 6769 RSP 0 0 5 2087 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:33:42.588734 0.251038 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:42.840167 0.121647 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:42.976530 0.095184 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:42.995340 0.051172 tcp 10.0.2.105 52869 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:43.046791 0.075868 tcp 10.0.2.105 52870 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:43.054546 0.177041 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:43.122993 0.154663 tcp 10.0.2.105 52871 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:33:43.223929 0.311814 udp 10.0.2.105 7010 <-> 118.172.146.102 8660 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:43.291952 2.997238 tcp 10.0.2.105 52872 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:43.502846 0.286166 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:43.789412 0.244069 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.052843 0.155854 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.209026 0.055581 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.266049 0.069224 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.317799 0.342799 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 923 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.653018 0.342185 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:44.995533 0.385481 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:45.381434 0.582910 udp 10.0.2.105 7010 <-> 5.234.90.187 2168 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:45.925363 0.056742 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:33:45.982078 0.000000 udp 10.0.2.105 7010 -> 118.175.40.229 5081 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:33:52.287192 0.000000 tcp 10.0.2.105 52872 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:33:58.286038 0.153743 tcp 10.0.2.105 52873 -> 128.255.183.224 9027 SPA_* 0 0 9 1099 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:01.150981 0.052384 tcp 10.0.2.105 52874 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:01.203663 0.071343 tcp 10.0.2.105 52875 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:01.275282 0.160647 tcp 10.0.2.105 52876 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:01.435187 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:34:18.606087 0.052772 tcp 10.0.2.105 52877 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:18.658672 0.072018 tcp 10.0.2.105 52878 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:18.730994 0.173550 tcp 10.0.2.105 52879 -> 195.113.214.236 443 SRPA* 0 0 35 22364 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:18.906046 0.121236 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 5 1830 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:34:19.027186 1.200959 udp 10.0.2.105 7010 <-> 118.231.79.191 9776 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:34:20.008966 0.054874 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:34:20.064171 0.055659 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:34:20.134395 0.055475 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:34:20.191366 0.000000 udp 10.0.2.105 7010 -> 81.148.82.171 2747 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/12 23:34:28.439618 0.151119 tcp 10.0.2.105 52873 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:28.439900 3.003905 tcp 10.0.2.105 52880 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:34:37.442648 0.000000 tcp 10.0.2.105 52880 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:34:37.593653 0.050388 tcp 10.0.2.105 52881 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:37.644350 0.075317 tcp 10.0.2.105 52882 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:37.719941 0.165456 tcp 10.0.2.105 52883 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:34:37.885895 0.256721 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/01/12 23:37:41.269944 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:37:48.276721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:37:56.278070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:38:12.281951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:38:44.287312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:39:43.442957 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:39:43.443184 2.993289 tcp 10.0.2.105 52884 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:39:52.445752 0.000000 tcp 10.0.2.105 52884 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:39:58.446514 0.052335 tcp 10.0.2.105 52885 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:39:58.499133 0.071352 tcp 10.0.2.105 52886 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:39:58.570781 0.165276 tcp 10.0.2.105 52887 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:39:58.750931 0.139942 tcp 10.0.2.105 52888 -> 128.255.183.224 9027 SPA_* 0 0 9 1089 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:09.027649 0.370910 tcp 10.0.2.105 52888 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:09.028654 0.051193 tcp 10.0.2.105 52889 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:09.080122 0.074777 tcp 10.0.2.105 52890 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:09.154756 0.162304 tcp 10.0.2.105 52891 -> 195.113.214.236 443 SRPA* 0 0 44 40646 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:09.398802 3.005013 tcp 10.0.2.105 52892 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:18.402763 0.000000 tcp 10.0.2.105 52892 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:24.392023 0.051693 tcp 10.0.2.105 52893 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:24.444001 0.077363 tcp 10.0.2.105 52894 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:24.521740 0.164131 tcp 10.0.2.105 52895 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:24.879361 3.006853 tcp 10.0.2.105 52896 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:33.894600 0.000000 tcp 10.0.2.105 52896 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:39.874231 0.051946 tcp 10.0.2.105 52897 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:39.926510 0.074209 tcp 10.0.2.105 52898 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:40.001035 0.162732 tcp 10.0.2.105 52899 -> 195.113.214.236 443 SRPA* 0 0 38 30954 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:40.178122 3.000220 tcp 10.0.2.105 52900 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:49.176733 0.000000 tcp 10.0.2.105 52900 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:40:55.176438 0.052960 tcp 10.0.2.105 52901 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:55.229700 0.074409 tcp 10.0.2.105 52902 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:55.304406 0.157202 tcp 10.0.2.105 52903 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:40:55.486305 3.003901 tcp 10.0.2.105 52904 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:04.488710 0.000000 tcp 10.0.2.105 52904 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:10.488416 0.084498 tcp 10.0.2.105 52905 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:10.572748 0.075635 tcp 10.0.2.105 52906 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:10.648713 0.163947 tcp 10.0.2.105 52907 -> 195.113.214.236 443 SRPA* 0 0 31 24196 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:10.889254 3.002942 tcp 10.0.2.105 52908 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:19.891192 0.000000 tcp 10.0.2.105 52908 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:25.890281 0.051547 tcp 10.0.2.105 52909 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:25.941665 0.069861 tcp 10.0.2.105 52910 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:26.011828 0.156051 tcp 10.0.2.105 52911 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:26.341415 0.769476 tcp 10.0.2.105 52912 -> 134.90.1.162 8348 FSPA* 0 0 13 1305 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:26.449893 0.051288 tcp 10.0.2.105 52913 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:26.501499 0.073410 tcp 10.0.2.105 52914 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:26.575191 0.164184 tcp 10.0.2.105 52915 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:27.111113 0.403191 tcp 10.0.2.105 52916 -> 46.48.220.129 23395 SPA_* 0 0 9 1089 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.269568 0.519143 tcp 10.0.2.105 52916 -> 46.48.220.129 23395 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.270498 0.051565 tcp 10.0.2.105 52917 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.321894 0.072610 tcp 10.0.2.105 52918 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.394861 0.156936 tcp 10.0.2.105 52919 -> 195.113.214.236 443 SRPA* 0 0 45 41864 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.789058 0.450785 tcp 10.0.2.105 52920 -> 82.211.142.218 9811 FSPA* 0 0 13 1305 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.899985 0.051905 tcp 10.0.2.105 52921 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:33.952401 0.070838 tcp 10.0.2.105 52922 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:34.023568 0.165070 tcp 10.0.2.105 52923 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:34.239997 3.006093 tcp 10.0.2.105 52924 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:43.254610 0.000000 tcp 10.0.2.105 52924 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:49.233395 0.275834 tcp 10.0.2.105 52925 -> 128.255.183.224 9027 FSPA* 0 0 13 1305 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:41:49.509442 2.998288 tcp 10.0.2.105 52926 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:41:58.506381 0.000000 tcp 10.0.2.105 52926 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:04.505841 3.003380 tcp 10.0.2.105 52927 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:13.508057 0.000000 tcp 10.0.2.105 52927 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:18.445367 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:42:19.506781 3.004010 tcp 10.0.2.105 52928 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:28.509828 0.000000 tcp 10.0.2.105 52928 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:34.508373 3.004235 tcp 10.0.2.105 52929 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:42.439439 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:42:43.511125 0.000000 tcp 10.0.2.105 52929 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:49.510229 3.003701 tcp 10.0.2.105 52930 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:42:58.512630 0.000000 tcp 10.0.2.105 52930 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:43:04.511949 0.121807 tcp 10.0.2.105 52931 -> 134.90.1.162 8348 FSPA* 0 0 11 1197 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:43:04.634049 0.438757 tcp 10.0.2.105 52932 -> 46.48.220.129 23395 SPA_* 0 0 9 1089 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:43:35.075586 2.884887 tcp 10.0.2.105 52932 -> 46.48.220.129 23395 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:43:35.075952 0.108367 tcp 10.0.2.105 52933 -> 82.211.142.218 9811 FSPA* 0 0 11 1197 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:44:48.294505 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:44:55.301259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:45:03.302121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:45:19.305542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:45:51.311303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:48:35.178001 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:48:35.178296 3.003030 tcp 10.0.2.105 52934 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:48:44.179688 0.000000 tcp 10.0.2.105 52934 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:48:50.180537 0.052371 tcp 10.0.2.105 52935 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.233260 0.074702 tcp 10.0.2.105 52936 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.308427 0.154207 tcp 10.0.2.105 52937 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.495090 0.703002 tcp 10.0.2.105 52938 -> 128.255.183.224 9027 FSPA* 0 0 13 1269 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.785291 0.052469 tcp 10.0.2.105 52939 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.838068 0.074270 tcp 10.0.2.105 52940 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:50.912634 0.244189 tcp 10.0.2.105 52941 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:48:51.198251 3.006350 tcp 10.0.2.105 52942 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:00.202696 0.000000 tcp 10.0.2.105 52942 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:06.192416 0.051330 tcp 10.0.2.105 52943 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:06.244044 0.076394 tcp 10.0.2.105 52944 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:06.320821 0.164706 tcp 10.0.2.105 52945 -> 195.113.214.236 443 SRPA* 0 0 40 22372 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:06.545657 3.000484 tcp 10.0.2.105 52946 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:15.555165 0.000000 tcp 10.0.2.105 52946 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:21.544192 0.052583 tcp 10.0.2.105 52947 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:21.597062 0.071203 tcp 10.0.2.105 52948 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:21.668563 0.163115 tcp 10.0.2.105 52949 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:21.925038 2.993188 tcp 10.0.2.105 52950 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:30.917316 0.000000 tcp 10.0.2.105 52950 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:36.926075 0.052046 tcp 10.0.2.105 52951 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:36.977930 0.074733 tcp 10.0.2.105 52952 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:37.052926 0.190163 tcp 10.0.2.105 52953 -> 195.113.214.236 443 SRPA* 0 0 39 31858 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:37.261738 2.998469 tcp 10.0.2.105 52954 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:46.258798 0.000000 tcp 10.0.2.105 52954 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:49:52.258139 0.052301 tcp 10.0.2.105 52955 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:52.310725 0.071349 tcp 10.0.2.105 52956 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:52.382319 0.218072 tcp 10.0.2.105 52957 -> 195.113.214.236 443 SRPA* 0 0 43 25696 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:49:52.625258 2.997460 tcp 10.0.2.105 52958 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:01.621463 0.000000 tcp 10.0.2.105 52958 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:07.621407 0.051700 tcp 10.0.2.105 52959 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:07.673391 0.066912 tcp 10.0.2.105 52960 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:07.740105 0.164120 tcp 10.0.2.105 52961 -> 195.113.214.236 443 SRPA* 0 0 25 11584 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:07.978777 0.408439 tcp 10.0.2.105 52962 -> 134.90.1.162 8348 FSPA* 0 0 13 1269 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:08.089116 0.051643 tcp 10.0.2.105 52963 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:08.141118 0.075289 tcp 10.0.2.105 52964 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:08.216708 0.159573 tcp 10.0.2.105 52965 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:08.387444 0.401614 tcp 10.0.2.105 52966 -> 46.48.220.129 23395 SPA_* 0 0 7 945 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:25.905446 0.296598 tcp 10.0.2.105 52966 -> 46.48.220.129 23395 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:25.906488 0.051432 tcp 10.0.2.105 52967 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:25.957810 0.070215 tcp 10.0.2.105 52968 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.028436 0.157321 tcp 10.0.2.105 52969 -> 195.113.214.236 443 SRPA* 0 0 35 22364 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.202349 0.408053 tcp 10.0.2.105 52970 -> 82.211.142.218 9811 FSPA* 0 0 13 1269 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.313298 0.050081 tcp 10.0.2.105 52971 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.363613 0.076047 tcp 10.0.2.105 52972 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.439506 0.156928 tcp 10.0.2.105 52973 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:26.610620 3.001271 tcp 10.0.2.105 52974 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:35.610332 0.000000 tcp 10.0.2.105 52974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:41.609096 0.278575 tcp 10.0.2.105 52975 -> 128.255.183.224 9027 FSPA* 0 0 11 1161 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:50:41.887532 3.006213 tcp 10.0.2.105 52976 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:50.891887 0.000000 tcp 10.0.2.105 52976 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:50:56.881079 3.004010 tcp 10.0.2.105 52977 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:05.883901 0.000000 tcp 10.0.2.105 52977 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:10.440202 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:51:11.882253 2.993969 tcp 10.0.2.105 52978 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:20.885187 0.000000 tcp 10.0.2.105 52978 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:26.883950 2.994039 tcp 10.0.2.105 52979 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:34.444837 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:51:35.876397 0.000000 tcp 10.0.2.105 52979 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:41.885406 2.994286 tcp 10.0.2.105 52980 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:50.878102 0.000000 tcp 10.0.2.105 52980 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:51:55.318113 3.000783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:51:56.886963 0.110967 tcp 10.0.2.105 52981 -> 134.90.1.162 8348 FSPA* 0 0 13 1269 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:51:56.998158 1.251883 tcp 10.0.2.105 52982 -> 46.48.220.129 23395 SPA_* 0 0 9 1053 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:52:02.324910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:52:10.326066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:52:26.329537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:52:28.252398 2.153491 tcp 10.0.2.105 52982 -> 46.48.220.129 23395 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:52:28.252778 0.114135 tcp 10.0.2.105 52983 -> 82.211.142.218 9811 FSPA* 0 0 13 1269 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:52:58.335224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:57:28.363966 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/12 23:57:28.364101 2.993753 tcp 10.0.2.105 52984 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:57:37.366132 0.000000 tcp 10.0.2.105 52984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:57:43.367176 0.052663 tcp 10.0.2.105 52985 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:43.420113 0.072239 tcp 10.0.2.105 52986 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:43.492675 0.165458 tcp 10.0.2.105 52987 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:43.683771 0.604322 tcp 10.0.2.105 52988 -> 128.255.183.224 9027 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:43.988096 0.051348 tcp 10.0.2.105 52989 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.039731 0.073795 tcp 10.0.2.105 52990 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.113817 0.165062 tcp 10.0.2.105 52991 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.288284 0.451220 tcp 10.0.2.105 52992 -> 95.104.31.172 9016 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.401714 0.051861 tcp 10.0.2.105 52993 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.453850 0.077451 tcp 10.0.2.105 52994 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.531592 0.156968 tcp 10.0.2.105 52995 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:44.739668 3.002117 tcp 10.0.2.105 52996 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:57:53.740443 0.000000 tcp 10.0.2.105 52996 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:57:59.739370 0.051580 tcp 10.0.2.105 52997 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:59.791220 0.071820 tcp 10.0.2.105 52998 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:57:59.863316 0.161757 tcp 10.0.2.105 52999 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:00.038983 3.004096 tcp 10.0.2.105 53000 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:09.041875 0.000000 tcp 10.0.2.105 53000 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:15.041121 0.051633 tcp 10.0.2.105 53001 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:15.093048 0.071105 tcp 10.0.2.105 53002 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:15.163994 0.157787 tcp 10.0.2.105 53003 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:15.462417 3.003067 tcp 10.0.2.105 53004 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:24.463954 0.000000 tcp 10.0.2.105 53004 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:30.463384 0.051629 tcp 10.0.2.105 53005 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:30.514869 0.073981 tcp 10.0.2.105 53006 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:30.589199 0.160902 tcp 10.0.2.105 53007 -> 195.113.214.236 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:30.761860 2.995996 tcp 10.0.2.105 53008 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:39.765851 0.000000 tcp 10.0.2.105 53008 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:58:45.755335 0.051479 tcp 10.0.2.105 53009 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:45.807143 0.070855 tcp 10.0.2.105 53010 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:45.878282 0.163818 tcp 10.0.2.105 53011 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:46.053906 0.411120 tcp 10.0.2.105 53012 -> 134.90.1.162 8348 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:46.165983 0.053414 tcp 10.0.2.105 53013 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:46.219727 0.075279 tcp 10.0.2.105 53014 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:46.295296 0.159328 tcp 10.0.2.105 53015 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:58:46.465283 2.876839 tcp 10.0.2.105 53016 -> 46.48.220.129 23395 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:02.342366 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/12 23:59:09.348621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:59:17.349967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:59:17.754371 0.307863 tcp 10.0.2.105 53016 -> 46.48.220.129 23395 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:17.755261 0.051788 tcp 10.0.2.105 53017 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:17.806857 0.070283 tcp 10.0.2.105 53018 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:17.877452 0.161186 tcp 10.0.2.105 53019 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:18.062394 0.412120 tcp 10.0.2.105 53020 -> 82.211.142.218 9811 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:18.175520 0.051517 tcp 10.0.2.105 53021 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:18.227461 0.070451 tcp 10.0.2.105 53022 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:18.298235 0.166316 tcp 10.0.2.105 53023 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:18.474791 3.001587 tcp 10.0.2.105 53024 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:59:27.484654 0.000000 tcp 10.0.2.105 53024 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:59:33.353210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/12 23:59:33.473331 0.275983 tcp 10.0.2.105 53025 -> 128.255.183.224 9027 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:33.749544 0.110045 tcp 10.0.2.105 53026 -> 95.104.31.172 9016 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/12 23:59:33.859894 2.998308 tcp 10.0.2.105 53027 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:59:42.857047 0.000000 tcp 10.0.2.105 53027 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:59:48.856016 2.993525 tcp 10.0.2.105 53028 -> 68.123.230.161 5582 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/12 23:59:57.848225 0.000000 tcp 10.0.2.105 53028 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:00:02.444710 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:00:03.857417 3.004023 tcp 10.0.2.105 53029 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:00:05.359647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:00:12.860210 0.000000 tcp 10.0.2.105 53029 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:00:18.858727 3.004056 tcp 10.0.2.105 53030 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:00:26.439780 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:00:27.862004 0.000000 tcp 10.0.2.105 53030 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:00:33.860094 0.110035 tcp 10.0.2.105 53031 -> 134.90.1.162 8348 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:00:33.970364 0.403369 tcp 10.0.2.105 53032 -> 46.48.220.129 23395 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:00:55.097694 0.000493 tcp 10.0.2.105 53032 -> 46.48.220.129 23395 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:00:55.098353 0.108743 tcp 10.0.2.105 53033 -> 82.211.142.218 9811 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:04:59.232470 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:04:59.232586 0.000000 udp 10.0.2.105 7010 -> 79.56.200.90 2691 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:05:16.709143 0.053537 tcp 10.0.2.105 53034 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:16.762945 0.074882 tcp 10.0.2.105 53035 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:16.838139 0.157529 tcp 10.0.2.105 53036 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:16.995889 0.238641 udp 10.0.2.105 7010 <-> 118.175.40.229 5081 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:17.234948 0.065216 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:17.300523 0.000000 udp 10.0.2.105 7010 -> 81.148.82.171 2747 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:05:34.933617 0.052282 tcp 10.0.2.105 53037 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:34.986162 0.073742 tcp 10.0.2.105 53038 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:35.060205 0.153442 tcp 10.0.2.105 53039 -> 195.113.214.236 443 SRPA* 0 0 39 20218 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:35.211973 0.146582 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.358969 0.057421 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.416881 0.155579 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.572868 0.177463 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.750692 0.019966 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.770975 0.027104 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.798412 0.140234 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:35.939022 0.189547 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.129018 0.151571 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.280929 0.148342 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.429672 0.103317 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.533499 0.169357 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.703256 0.180595 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:36.884268 0.187354 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:37.072053 0.188281 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:37.260760 0.165663 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:37.426779 0.164793 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:37.591929 0.217830 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:37.810162 0.211402 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:38.021938 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:05:55.202607 2.993812 tcp 10.0.2.105 53040 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:05:56.054468 0.050753 tcp 10.0.2.105 53041 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:56.105498 0.129902 tcp 10.0.2.105 53042 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:56.235719 0.159702 tcp 10.0.2.105 53043 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:05:56.396018 0.114682 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:56.511044 0.145889 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:56.657329 0.395785 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:57.053509 0.165294 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:57.219214 0.169827 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:57.389435 0.085923 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:57.475781 0.028687 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:05:57.504824 0.000000 udp 10.0.2.105 7010 -> 118.172.146.102 8660 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:06:04.205215 0.000000 tcp 10.0.2.105 53040 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:09.366042 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 00:06:10.204783 0.051742 tcp 10.0.2.105 53044 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.256388 0.074864 tcp 10.0.2.105 53045 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.331550 0.157505 tcp 10.0.2.105 53046 -> 195.113.214.236 443 SRPA* 0 0 44 26622 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.531942 0.641635 tcp 10.0.2.105 53047 -> 128.255.183.224 9027 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.823400 0.053692 tcp 10.0.2.105 53048 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.877390 0.076713 tcp 10.0.2.105 53049 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:10.954395 0.189959 tcp 10.0.2.105 53050 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:11.173836 0.414854 tcp 10.0.2.105 53051 -> 95.104.31.172 9016 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:11.283096 0.052839 tcp 10.0.2.105 53052 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:11.336181 0.065170 tcp 10.0.2.105 53053 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:11.401658 0.164444 tcp 10.0.2.105 53054 -> 195.113.214.236 443 SRPA* 0 0 41 26714 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:11.588945 3.000945 tcp 10.0.2.105 53055 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:16.313388 0.051131 tcp 10.0.2.105 53056 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:16.364844 0.068935 tcp 10.0.2.105 53057 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:16.372905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:06:16.434100 0.160753 tcp 10.0.2.105 53058 -> 195.113.214.236 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:16.595336 0.282377 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:16.878135 0.154271 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:17.032776 0.342834 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:17.376040 0.374581 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:17.751006 0.336263 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:18.087670 0.246759 udp 10.0.2.105 7010 <-> 5.234.90.187 2168 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:18.334735 0.053873 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:18.388938 0.172467 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:18.561819 0.000000 udp 10.0.2.105 7010 -> 118.231.79.191 9776 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:06:20.588552 0.000000 tcp 10.0.2.105 53055 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:24.374268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:06:26.587988 0.052653 tcp 10.0.2.105 53059 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:26.640971 0.074234 tcp 10.0.2.105 53060 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:26.715513 0.154466 tcp 10.0.2.105 53061 -> 195.113.214.236 443 SRPA* 0 0 51 40678 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:26.890829 3.001668 tcp 10.0.2.105 53062 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:35.891027 0.000000 tcp 10.0.2.105 53062 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:37.353290 0.051310 tcp 10.0.2.105 53063 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:37.405145 0.071848 tcp 10.0.2.105 53064 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:37.476826 0.159715 tcp 10.0.2.105 53065 -> 195.113.214.236 443 SRPA* 0 0 46 41918 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:37.637291 0.054789 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:37.692507 0.055130 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:37.747998 0.055990 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:37.804518 0.167973 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:06:40.377491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:06:41.890119 0.051310 tcp 10.0.2.105 53066 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:41.941683 0.070520 tcp 10.0.2.105 53067 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:42.012612 0.160859 tcp 10.0.2.105 53068 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:42.184635 2.999444 tcp 10.0.2.105 53069 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:51.182889 0.000000 tcp 10.0.2.105 53069 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:06:57.182178 0.052851 tcp 10.0.2.105 53070 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.235311 0.075780 tcp 10.0.2.105 53071 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.311412 0.153506 tcp 10.0.2.105 53072 -> 195.113.214.236 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.477122 0.412521 tcp 10.0.2.105 53073 -> 134.90.1.162 8348 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.594082 0.052426 tcp 10.0.2.105 53074 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.646855 0.074266 tcp 10.0.2.105 53075 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.721427 0.156183 tcp 10.0.2.105 53076 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:06:57.889898 0.404198 tcp 10.0.2.105 53077 -> 46.48.220.129 23395 SPA_* 0 0 9 1214 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:12.383342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:07:22.966849 0.791575 tcp 10.0.2.105 53077 -> 46.48.220.129 23395 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:22.967921 0.056659 tcp 10.0.2.105 53078 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:23.024889 0.070825 tcp 10.0.2.105 53079 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:23.095525 0.625549 tcp 10.0.2.105 53080 -> 195.113.214.236 443 SRPA* 0 0 22 11422 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:23.758741 0.410261 tcp 10.0.2.105 53081 -> 82.211.142.218 9811 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:23.873237 0.051399 tcp 10.0.2.105 53082 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:23.924987 0.074809 tcp 10.0.2.105 53083 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:24.000103 0.158241 tcp 10.0.2.105 53084 -> 195.113.214.236 443 SRPA* 0 0 41 34602 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:07:24.169253 3.005533 tcp 10.0.2.105 53085 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:07:33.172819 0.000000 tcp 10.0.2.105 53085 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:07:39.162006 0.132942 tcp 10.0.2.105 53086 -> 128.255.183.224 9027 SPA_* 0 0 9 1214 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:08:09.295416 0.129209 tcp 10.0.2.105 53086 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:08:09.295787 0.112330 tcp 10.0.2.105 53087 -> 95.104.31.172 9016 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:08:09.408410 3.001340 tcp 10.0.2.105 53088 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:18.407874 0.000000 tcp 10.0.2.105 53088 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:24.407148 3.004124 tcp 10.0.2.105 53089 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:33.409467 0.000000 tcp 10.0.2.105 53089 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:37.946390 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:08:39.408474 3.004542 tcp 10.0.2.105 53090 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:48.411295 0.000000 tcp 10.0.2.105 53090 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:08:54.410299 0.107757 tcp 10.0.2.105 53091 -> 134.90.1.162 8348 FSPA* 0 0 11 1322 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:08:54.518259 0.427303 tcp 10.0.2.105 53092 -> 46.48.220.129 23395 SPA_* 0 0 9 1214 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:09:24.943816 0.393232 tcp 10.0.2.105 53092 -> 46.48.220.129 23395 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:09:24.944184 0.106937 tcp 10.0.2.105 53093 -> 82.211.142.218 9811 FSPA* 0 0 13 1430 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:13:16.389495 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 00:13:23.396789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:13:31.398329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:13:47.401081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:14:19.407443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:20:23.413556 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 00:20:30.420868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:20:38.421834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:20:54.425459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:21:26.431274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:27:30.436853 3.002327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 00:27:37.444475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:27:45.445947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:28:01.449114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:28:33.454846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:34:37.461425 3.001254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 00:34:44.468527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:34:52.470129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:35:08.473190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:35:40.478871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:36:43.810576 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:36:43.810838 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:36:59.874977 0.055021 tcp 10.0.2.105 53094 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:36:59.929988 0.077839 tcp 10.0.2.105 53095 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:00.007712 0.160407 tcp 10.0.2.105 53096 -> 195.113.214.236 443 SRPA* 0 0 35 18390 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:00.167361 0.000000 udp 10.0.2.105 7010 -> 118.172.146.102 8660 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:37:15.956800 0.052427 tcp 10.0.2.105 53097 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:16.009538 0.077351 tcp 10.0.2.105 53098 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:16.086745 0.160963 tcp 10.0.2.105 53099 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:16.248310 0.000000 udp 10.0.2.105 7010 -> 118.231.79.191 9776 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:37:34.002943 0.053361 tcp 10.0.2.105 53100 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:34.056609 0.074905 tcp 10.0.2.105 53101 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:34.131852 0.162955 tcp 10.0.2.105 53102 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:34.295008 0.000000 udp 10.0.2.105 7010 -> 118.175.40.229 5081 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:37:51.197900 0.051949 tcp 10.0.2.105 53103 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:51.250202 0.075375 tcp 10.0.2.105 53104 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:51.325876 0.163512 tcp 10.0.2.105 53105 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:37:51.490036 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:38:08.482970 0.052957 tcp 10.0.2.105 53106 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:08.536387 0.076531 tcp 10.0.2.105 53107 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:08.613238 0.159215 tcp 10.0.2.105 53108 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:08.773072 0.164813 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 5 1753 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:09.255129 0.029278 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 3 957 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:09.380162 0.165910 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:09.691109 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 00:38:10.194475 2.994051 tcp 10.0.2.105 53109 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:19.187532 0.000000 tcp 10.0.2.105 53109 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:25.196992 0.052948 tcp 10.0.2.105 53110 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.250234 0.074411 tcp 10.0.2.105 53111 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.324950 0.161502 tcp 10.0.2.105 53112 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.500592 0.453260 tcp 10.0.2.105 53113 -> 176.73.211.244 8034 FSPA* 0 0 13 1353 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.608733 0.052819 tcp 10.0.2.105 53114 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.661876 0.075297 tcp 10.0.2.105 53115 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.737452 0.165138 tcp 10.0.2.105 53116 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:25.954089 2.997187 tcp 10.0.2.105 53117 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:26.578037 0.052052 tcp 10.0.2.105 53118 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:26.630341 0.071647 tcp 10.0.2.105 53119 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:26.702315 0.160982 tcp 10.0.2.105 53120 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:26.863889 0.138207 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 3 762 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.046567 0.022019 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.096755 0.470997 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.441799 0.161640 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 3 921 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.659547 0.069663 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 3 1086 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.722815 0.199242 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:27.914715 0.191418 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1229 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:28.098348 0.172120 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:28.267633 0.159082 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:28.428791 1.021671 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:29.242276 0.206672 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:29.425739 0.238258 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:29.645615 0.262914 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:29.863771 0.172952 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:30.057629 0.201278 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:30.223585 0.183045 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 4 1435 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:30.404470 1.853658 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 3 1030 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:32.258112 0.410407 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 3 747 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:32.662079 0.176398 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:33.101823 0.179284 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:33.272764 0.057150 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:33.413086 0.044416 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:33.680999 0.343073 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 3 873 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:34.129404 0.286301 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:34.403571 0.158878 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:34.561443 0.060777 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:34.633694 0.404901 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:34.950178 0.000000 tcp 10.0.2.105 53117 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:35.014087 0.342620 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 774 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:35.350568 0.329457 udp 10.0.2.105 7010 <-> 5.234.90.187 2168 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:35.645176 0.121287 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:35.766290 0.053372 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 3 838 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:35.899535 0.185641 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:36.071162 0.055476 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 3 933 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:36.205788 0.055844 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 3 921 flow=From-Botnet-V2-UDP-Established 1970/01/13 00:38:40.949139 0.105615 tcp 10.0.2.105 53121 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:41.055053 0.077400 tcp 10.0.2.105 53122 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:41.132793 0.156800 tcp 10.0.2.105 53123 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:41.301274 3.001996 tcp 10.0.2.105 53124 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:50.302264 0.000000 tcp 10.0.2.105 53124 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:38:56.300744 0.114353 tcp 10.0.2.105 53125 -> 176.73.211.244 8034 FSPA* 0 0 13 1353 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:38:56.415296 3.055033 tcp 10.0.2.105 53126 -> 5.178.178.199 4758 SPA_* 0 0 10 1203 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:39:25.155886 0.000477 tcp 10.0.2.105 53126 -> 5.178.178.199 4758 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:41:44.484861 3.002180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 00:41:51.492677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:41:59.493926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:42:15.496964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:42:47.503174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:44:25.153597 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:44:25.153685 0.483646 tcp 10.0.2.105 53127 -> 94.137.168.16 9773 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:25.267969 0.063918 tcp 10.0.2.105 53128 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:25.331742 0.071466 tcp 10.0.2.105 53129 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:25.403625 0.213649 tcp 10.0.2.105 53130 -> 195.113.214.236 443 SRPA* 0 0 70 52531 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:25.637551 3.001159 tcp 10.0.2.105 53131 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:44:34.637188 0.000000 tcp 10.0.2.105 53131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:44:40.636958 0.052220 tcp 10.0.2.105 53132 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:40.689467 0.371319 tcp 10.0.2.105 53133 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.061068 0.176835 tcp 10.0.2.105 53134 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.249424 0.567343 tcp 10.0.2.105 53135 -> 128.255.183.224 9027 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.498052 0.052760 tcp 10.0.2.105 53136 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.551144 0.072858 tcp 10.0.2.105 53137 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.624384 0.169850 tcp 10.0.2.105 53138 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.817082 0.444240 tcp 10.0.2.105 53139 -> 176.73.115.123 1806 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.936368 0.052043 tcp 10.0.2.105 53140 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:41.988768 0.076103 tcp 10.0.2.105 53141 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.065186 0.176412 tcp 10.0.2.105 53142 -> 195.113.214.236 443 SRPA* 0 0 49 41688 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.261542 0.446497 tcp 10.0.2.105 53143 -> 95.104.31.172 9016 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.375899 0.052424 tcp 10.0.2.105 53144 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.428605 0.071792 tcp 10.0.2.105 53145 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.500692 0.177222 tcp 10.0.2.105 53146 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:42.708305 3.004865 tcp 10.0.2.105 53147 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:44:51.711902 0.000000 tcp 10.0.2.105 53147 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:44:57.701344 0.052127 tcp 10.0.2.105 53148 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:57.753784 0.074980 tcp 10.0.2.105 53149 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:57.829039 0.175058 tcp 10.0.2.105 53150 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:44:58.022828 3.002128 tcp 10.0.2.105 53151 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:45:07.023970 0.000000 tcp 10.0.2.105 53151 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:45:13.022540 0.062620 tcp 10.0.2.105 53152 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.085457 0.074926 tcp 10.0.2.105 53153 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.160746 0.174762 tcp 10.0.2.105 53154 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.359244 0.457879 tcp 10.0.2.105 53155 -> 176.73.211.244 8034 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.481846 0.052610 tcp 10.0.2.105 53156 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.534719 0.073082 tcp 10.0.2.105 53157 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.608112 0.183717 tcp 10.0.2.105 53158 -> 195.113.214.236 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.817328 0.496756 tcp 10.0.2.105 53159 -> 176.73.3.72 3605 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.929934 0.051860 tcp 10.0.2.105 53160 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:13.982146 0.138717 tcp 10.0.2.105 53161 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:14.121111 0.174598 tcp 10.0.2.105 53162 -> 195.113.214.236 443 SRPA* 0 0 25 14908 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:14.314274 2.994198 tcp 10.0.2.105 53163 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:45:23.306725 0.000000 tcp 10.0.2.105 53163 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:45:29.316591 0.054072 tcp 10.0.2.105 53164 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.371000 0.072205 tcp 10.0.2.105 53165 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.443527 0.180365 tcp 10.0.2.105 53166 -> 195.113.214.236 443 SRPA* 0 0 30 22892 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.723156 0.450463 tcp 10.0.2.105 53167 -> 82.211.142.218 9811 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.832653 0.053654 tcp 10.0.2.105 53168 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.886654 0.069053 tcp 10.0.2.105 53169 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:29.956052 0.194111 tcp 10.0.2.105 53170 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:30.173844 0.056592 tcp 10.0.2.105 53171 -> 94.137.168.16 9773 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:49.724543 0.000307 tcp 10.0.2.105 53171 -> 94.137.168.16 9773 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:45:49.725092 2.994270 tcp 10.0.2.105 53172 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:45:58.717890 0.000000 tcp 10.0.2.105 53172 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:46:04.716489 0.262270 tcp 10.0.2.105 53173 -> 128.255.183.224 9027 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:46:04.978985 0.118841 tcp 10.0.2.105 53174 -> 176.73.115.123 1806 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:46:05.098043 0.109095 tcp 10.0.2.105 53175 -> 95.104.31.172 9016 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:46:05.207604 3.004101 tcp 10.0.2.105 53176 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:46:14.210492 0.000000 tcp 10.0.2.105 53176 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:46:20.208737 3.004711 tcp 10.0.2.105 53177 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:46:29.212150 0.000000 tcp 10.0.2.105 53177 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:46:33.948279 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:46:35.210334 0.057270 tcp 10.0.2.105 53178 -> 176.73.211.244 8034 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:47:05.263512 0.061976 tcp 10.0.2.105 53178 -> 176.73.211.244 8034 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:47:05.263885 0.109212 tcp 10.0.2.105 53179 -> 176.73.3.72 3605 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:47:05.373359 3.051168 tcp 10.0.2.105 53180 -> 5.178.178.199 4758 SPA_* 0 0 10 1239 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:47:30.248338 0.000321 tcp 10.0.2.105 53180 -> 5.178.178.199 4758 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:47:30.248941 0.115187 tcp 10.0.2.105 53181 -> 82.211.142.218 9811 FSPA* 0 0 13 1389 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:48:51.509502 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 00:48:58.516519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:49:06.518244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:49:22.520808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:49:54.526853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:52:30.361831 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:52:30.361928 0.521006 tcp 10.0.2.105 53182 -> 94.137.168.16 9773 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:30.475672 0.052926 tcp 10.0.2.105 53183 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:30.528884 0.078456 tcp 10.0.2.105 53184 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:30.607622 0.230279 tcp 10.0.2.105 53185 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:30.883135 3.003364 tcp 10.0.2.105 53186 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:52:39.894441 0.000000 tcp 10.0.2.105 53186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:52:45.883914 0.053353 tcp 10.0.2.105 53187 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:45.937558 0.070078 tcp 10.0.2.105 53188 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:46.007945 0.179850 tcp 10.0.2.105 53189 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:46.207146 0.144540 tcp 10.0.2.105 53190 -> 128.255.183.224 9027 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:56.483590 0.427900 tcp 10.0.2.105 53190 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:56.484291 0.052410 tcp 10.0.2.105 53191 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:56.537033 0.079533 tcp 10.0.2.105 53192 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:56.616839 0.184480 tcp 10.0.2.105 53193 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:52:56.911357 0.054819 tcp 10.0.2.105 53194 -> 176.73.115.123 1806 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.017464 0.726167 tcp 10.0.2.105 53194 -> 176.73.115.123 1806 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.018322 0.060010 tcp 10.0.2.105 53195 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.078611 0.074234 tcp 10.0.2.105 53196 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.153257 0.178598 tcp 10.0.2.105 53197 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.743796 0.501892 tcp 10.0.2.105 53198 -> 95.104.31.172 9016 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.850826 0.129952 tcp 10.0.2.105 53199 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:17.981073 0.074615 tcp 10.0.2.105 53200 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:18.056009 0.178989 tcp 10.0.2.105 53201 -> 195.113.214.236 443 SRPA* 0 0 48 35130 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:18.245906 2.998497 tcp 10.0.2.105 53202 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:53:27.242860 0.000000 tcp 10.0.2.105 53202 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:53:33.242299 0.053181 tcp 10.0.2.105 53203 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:33.295796 0.071255 tcp 10.0.2.105 53204 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:33.367363 0.168736 tcp 10.0.2.105 53205 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:33.655697 3.000556 tcp 10.0.2.105 53206 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:53:42.665106 0.000000 tcp 10.0.2.105 53206 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:53:48.654116 0.053018 tcp 10.0.2.105 53207 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:48.707424 0.075825 tcp 10.0.2.105 53208 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:48.783039 0.178071 tcp 10.0.2.105 53209 -> 195.113.214.236 443 SRPA* 0 0 31 22984 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:48.978827 0.438999 tcp 10.0.2.105 53210 -> 176.73.211.244 8034 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.089772 0.052396 tcp 10.0.2.105 53211 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.142406 0.066287 tcp 10.0.2.105 53212 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.208962 0.174641 tcp 10.0.2.105 53213 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.418129 0.430676 tcp 10.0.2.105 53214 -> 176.73.3.72 3605 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.529945 0.053073 tcp 10.0.2.105 53215 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.583289 0.072081 tcp 10.0.2.105 53216 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.655688 0.178691 tcp 10.0.2.105 53217 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:53:49.849016 3.000637 tcp 10.0.2.105 53218 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:53:58.848564 0.000000 tcp 10.0.2.105 53218 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:04.847493 0.053499 tcp 10.0.2.105 53219 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:04.900851 0.077694 tcp 10.0.2.105 53220 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:04.978826 0.184071 tcp 10.0.2.105 53221 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.359012 0.511420 tcp 10.0.2.105 53222 -> 82.211.142.218 9811 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.467160 0.053479 tcp 10.0.2.105 53223 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.520861 0.073535 tcp 10.0.2.105 53224 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.594657 0.168016 tcp 10.0.2.105 53225 -> 195.113.214.236 443 SRPA* 0 0 39 32388 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.870586 0.110498 tcp 10.0.2.105 53226 -> 94.137.168.16 9773 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:05.981286 3.001836 tcp 10.0.2.105 53227 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:14.981789 0.000000 tcp 10.0.2.105 53227 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:20.980188 0.276950 tcp 10.0.2.105 53228 -> 128.255.183.224 9027 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:21.257354 0.109184 tcp 10.0.2.105 53229 -> 176.73.115.123 1806 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:21.366729 0.108007 tcp 10.0.2.105 53230 -> 95.104.31.172 9016 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:21.474927 3.000103 tcp 10.0.2.105 53231 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:30.473548 0.000000 tcp 10.0.2.105 53231 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:36.472423 2.994139 tcp 10.0.2.105 53232 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:45.475643 0.000000 tcp 10.0.2.105 53232 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:54:50.442341 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 00:54:51.474078 0.113107 tcp 10.0.2.105 53233 -> 176.73.211.244 8034 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:51.587428 0.112013 tcp 10.0.2.105 53234 -> 176.73.3.72 3605 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:54:51.699694 2.998564 tcp 10.0.2.105 53235 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:55:00.697106 0.000000 tcp 10.0.2.105 53235 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 00:55:06.696306 0.111760 tcp 10.0.2.105 53236 -> 82.211.142.218 9811 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/13 00:55:58.533171 3.001333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 00:56:05.540175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:56:13.541893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:56:29.544930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 00:57:01.551158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:00:06.807866 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:00:06.808020 0.455523 tcp 10.0.2.105 53237 -> 94.137.168.16 9773 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:06.919542 0.053333 tcp 10.0.2.105 53238 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:06.973133 0.070473 tcp 10.0.2.105 53239 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:07.043912 0.195669 tcp 10.0.2.105 53240 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:07.263760 2.998768 tcp 10.0.2.105 53241 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:16.261005 0.000000 tcp 10.0.2.105 53241 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:22.260106 0.052368 tcp 10.0.2.105 53242 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:22.312553 0.089384 tcp 10.0.2.105 53243 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:22.402280 0.174079 tcp 10.0.2.105 53244 -> 195.113.214.236 443 SRPA* 0 0 40 22620 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:22.614735 0.602993 tcp 10.0.2.105 53245 -> 128.255.183.224 9027 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:22.904778 0.061045 tcp 10.0.2.105 53246 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:22.966116 0.071374 tcp 10.0.2.105 53247 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.037769 0.169581 tcp 10.0.2.105 53248 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.217965 0.426614 tcp 10.0.2.105 53249 -> 176.73.115.123 1806 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.326373 0.053436 tcp 10.0.2.105 53250 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.380017 0.075858 tcp 10.0.2.105 53251 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.456173 0.177538 tcp 10.0.2.105 53252 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.644785 0.418585 tcp 10.0.2.105 53253 -> 95.104.31.172 9016 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.755630 0.052276 tcp 10.0.2.105 53254 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.808204 0.070352 tcp 10.0.2.105 53255 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:23.878843 0.174367 tcp 10.0.2.105 53256 -> 195.113.214.236 443 SRPA* 0 0 41 22676 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:24.063626 2.992657 tcp 10.0.2.105 53257 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:33.064889 0.000000 tcp 10.0.2.105 53257 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:39.064467 0.052016 tcp 10.0.2.105 53258 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:39.116818 0.075966 tcp 10.0.2.105 53259 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:39.193271 0.175150 tcp 10.0.2.105 53260 -> 195.113.214.236 443 SRPA* 0 0 21 10744 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:39.382626 2.995899 tcp 10.0.2.105 53261 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:48.376874 0.000000 tcp 10.0.2.105 53261 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:00:54.376559 0.051858 tcp 10.0.2.105 53262 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.428667 0.071522 tcp 10.0.2.105 53263 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.500509 0.227582 tcp 10.0.2.105 53264 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.738224 0.417063 tcp 10.0.2.105 53265 -> 176.73.211.244 8034 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.846808 0.051975 tcp 10.0.2.105 53266 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.899051 0.070948 tcp 10.0.2.105 53267 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:54.970276 0.175407 tcp 10.0.2.105 53268 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:55.155494 0.437923 tcp 10.0.2.105 53269 -> 176.73.3.72 3605 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:55.265316 0.052848 tcp 10.0.2.105 53270 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:55.318536 0.074697 tcp 10.0.2.105 53271 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:55.393480 0.182015 tcp 10.0.2.105 53272 -> 195.113.214.236 443 SRPA* 0 0 57 36244 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:00:55.593569 2.998479 tcp 10.0.2.105 53273 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:04.590255 0.000000 tcp 10.0.2.105 53273 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:10.610785 0.052917 tcp 10.0.2.105 53274 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:10.663998 0.078863 tcp 10.0.2.105 53275 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:10.743185 0.181514 tcp 10.0.2.105 53276 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:10.946454 0.431813 tcp 10.0.2.105 53277 -> 82.211.142.218 9811 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:11.060583 0.053018 tcp 10.0.2.105 53278 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:11.113950 0.077004 tcp 10.0.2.105 53279 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:11.191303 0.171603 tcp 10.0.2.105 53280 -> 195.113.214.236 443 SRPA* 0 0 41 22016 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:11.378509 0.115601 tcp 10.0.2.105 53281 -> 94.137.168.16 9773 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:11.494343 3.000427 tcp 10.0.2.105 53282 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:20.493432 0.000000 tcp 10.0.2.105 53282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:26.491841 0.277449 tcp 10.0.2.105 53283 -> 128.255.183.224 9027 FSPA* 0 0 11 1154 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:26.769173 0.111543 tcp 10.0.2.105 53284 -> 176.73.115.123 1806 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:26.881033 0.131342 tcp 10.0.2.105 53285 -> 95.104.31.172 9016 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:27.012737 2.994293 tcp 10.0.2.105 53286 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:36.015935 0.000000 tcp 10.0.2.105 53286 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:42.004529 2.993877 tcp 10.0.2.105 53287 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:50.997739 0.000000 tcp 10.0.2.105 53287 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:01:55.944085 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:01:57.005933 0.112514 tcp 10.0.2.105 53288 -> 176.73.211.244 8034 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:57.118650 0.117359 tcp 10.0.2.105 53289 -> 176.73.3.72 3605 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:01:57.236235 3.004142 tcp 10.0.2.105 53290 -> 5.178.178.199 4758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:02:06.238738 0.000000 tcp 10.0.2.105 53290 -> 5.178.178.199 4758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:02:12.238153 0.111085 tcp 10.0.2.105 53291 -> 82.211.142.218 9811 FSPA* 0 0 13 1262 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:03:05.557225 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:03:12.564133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:03:20.565746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:03:36.568955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:04:08.574808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:07:12.349982 0.000182 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:07:12.350283 0.436453 tcp 10.0.2.105 53292 -> 94.137.168.16 9773 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:12.466254 0.053941 tcp 10.0.2.105 53293 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:12.520621 0.073736 tcp 10.0.2.105 53294 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:12.594594 0.175436 tcp 10.0.2.105 53295 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:12.786952 3.007134 tcp 10.0.2.105 53296 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:21.792959 0.000000 tcp 10.0.2.105 53296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:27.782052 0.052810 tcp 10.0.2.105 53297 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:27.835128 0.074644 tcp 10.0.2.105 53298 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:27.910136 0.183328 tcp 10.0.2.105 53299 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.106392 0.595476 tcp 10.0.2.105 53300 -> 128.255.183.224 9027 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.383568 0.053487 tcp 10.0.2.105 53301 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.436771 0.075319 tcp 10.0.2.105 53302 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.512462 0.175120 tcp 10.0.2.105 53303 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.702038 0.428025 tcp 10.0.2.105 53304 -> 176.73.115.123 1806 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.810383 0.052247 tcp 10.0.2.105 53305 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.862933 0.070345 tcp 10.0.2.105 53306 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:28.933677 0.180833 tcp 10.0.2.105 53307 -> 195.113.214.236 443 SRPA* 0 0 23 14004 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:29.130225 0.444563 tcp 10.0.2.105 53308 -> 95.104.31.172 9016 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:29.239361 0.052646 tcp 10.0.2.105 53309 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:29.292299 0.072254 tcp 10.0.2.105 53310 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:29.364835 0.179690 tcp 10.0.2.105 53311 -> 195.113.214.236 443 SRPA* 0 0 35 18718 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:29.575055 2.993392 tcp 10.0.2.105 53312 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:38.567129 0.000000 tcp 10.0.2.105 53312 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:44.576087 0.052437 tcp 10.0.2.105 53313 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:44.628757 0.078312 tcp 10.0.2.105 53314 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:44.707340 0.179838 tcp 10.0.2.105 53315 -> 195.113.214.236 443 SRPA* 0 0 44 28486 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:44.926435 3.003732 tcp 10.0.2.105 53316 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:53.928995 0.000000 tcp 10.0.2.105 53316 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:07:59.928207 0.052801 tcp 10.0.2.105 53317 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:07:59.981326 0.075601 tcp 10.0.2.105 53318 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.056945 0.192597 tcp 10.0.2.105 53319 -> 195.113.214.236 443 SRPA* 0 0 37 27108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.306596 0.431411 tcp 10.0.2.105 53320 -> 176.73.211.244 8034 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.414937 0.059427 tcp 10.0.2.105 53321 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.474664 0.075616 tcp 10.0.2.105 53322 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.550661 0.177506 tcp 10.0.2.105 53323 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.738276 0.478899 tcp 10.0.2.105 53324 -> 176.73.3.72 3605 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.845673 0.052703 tcp 10.0.2.105 53325 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.898681 0.071466 tcp 10.0.2.105 53326 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:00.970433 0.217277 tcp 10.0.2.105 53327 -> 195.113.214.236 443 SRPA* 0 0 58 39276 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.217397 0.436808 tcp 10.0.2.105 53328 -> 82.211.142.218 9811 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.328738 0.052914 tcp 10.0.2.105 53329 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.381918 0.079574 tcp 10.0.2.105 53330 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.461800 0.168972 tcp 10.0.2.105 53331 -> 195.113.214.236 443 SRPA* 0 0 43 34122 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.654435 0.113649 tcp 10.0.2.105 53332 -> 94.137.168.16 9773 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:01.768512 3.005980 tcp 10.0.2.105 53333 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:10.773016 0.000000 tcp 10.0.2.105 53333 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:16.761930 0.262685 tcp 10.0.2.105 53334 -> 128.255.183.224 9027 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:17.024515 0.109872 tcp 10.0.2.105 53335 -> 176.73.115.123 1806 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:17.134631 0.058482 tcp 10.0.2.105 53336 -> 95.104.31.172 9016 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:27.249665 0.000293 tcp 10.0.2.105 53336 -> 95.104.31.172 9016 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:08:27.250199 3.001241 tcp 10.0.2.105 53337 -> 31.192.27.210 7758 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:36.249965 0.000000 tcp 10.0.2.105 53337 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:42.248447 3.003964 tcp 10.0.2.105 53338 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:51.251404 0.000000 tcp 10.0.2.105 53338 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:08:51.342184 0.000000 udp 10.0.2.105 7010 -> 118.175.40.229 5081 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:08:55.948145 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:08:57.249952 0.055385 tcp 10.0.2.105 53339 -> 176.73.211.244 8034 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:07.565984 0.052735 tcp 10.0.2.105 53340 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:07.619091 0.076615 tcp 10.0.2.105 53341 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:07.695998 0.169134 tcp 10.0.2.105 53342 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:07.866235 0.066027 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:07.943839 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:09:23.558487 0.051988 tcp 10.0.2.105 53343 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:23.610746 0.075491 tcp 10.0.2.105 53344 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:23.686524 0.179166 tcp 10.0.2.105 53345 -> 195.113.214.236 443 SRPA* 0 0 35 19200 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:23.865911 0.145582 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.011852 0.032249 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.052934 0.167018 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.226623 0.152224 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 5 1698 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.390586 0.022362 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.414404 0.210575 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 3 842 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.598284 0.161431 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.760092 0.083926 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:24.821308 0.197458 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.011329 0.180503 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 3 773 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.191472 0.167727 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.359612 0.157220 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2576 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.512449 0.148008 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.635711 0.208310 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:25.820927 0.233852 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.034530 0.269924 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.257257 0.167335 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.424974 0.206953 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.595822 0.181041 udp 10.0.2.105 7010 <-> 91.243.168.4 8547 CON 0 0 5 1878 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.796927 0.116310 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:26.912145 4.435302 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 3 845 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:27.303107 0.058700 tcp 10.0.2.105 53339 -> 176.73.211.244 8034 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:27.303498 0.113522 tcp 10.0.2.105 53346 -> 176.73.3.72 3605 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:27.417285 0.113329 tcp 10.0.2.105 53347 -> 82.211.142.218 9811 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:31.332119 0.142786 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:31.475333 0.168329 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:31.644046 0.055838 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:31.701696 0.248905 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:31.950956 0.045699 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:31.980610 0.344169 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:32.326590 0.153149 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:32.480134 0.060315 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:32.542199 0.372712 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:32.915315 0.365309 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:33.252356 0.054516 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:33.307244 0.183828 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:33.479436 0.055835 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:33.536776 0.056294 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 3 748 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:09:33.607230 0.000000 udp 10.0.2.105 7010 -> 5.234.90.187 2168 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:09:48.825124 0.053021 tcp 10.0.2.105 53348 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:48.878306 0.079722 tcp 10.0.2.105 53349 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:48.958308 0.181166 tcp 10.0.2.105 53350 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:09:49.140105 0.126886 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:10:12.580527 3.002483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:10:19.588169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:10:27.589809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:10:43.592686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:11:15.599060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:14:27.525214 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:14:27.525318 0.427537 tcp 10.0.2.105 53351 -> 94.137.168.16 9773 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:27.637466 0.055321 tcp 10.0.2.105 53352 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:27.693197 0.067771 tcp 10.0.2.105 53353 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:27.760788 0.173910 tcp 10.0.2.105 53354 -> 195.113.214.236 443 SRPA* 0 0 43 38406 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:27.953090 2.996803 tcp 10.0.2.105 53355 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:14:36.948406 0.000000 tcp 10.0.2.105 53355 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:14:42.947608 0.052967 tcp 10.0.2.105 53356 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.000875 0.071869 tcp 10.0.2.105 53357 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.073002 0.173702 tcp 10.0.2.105 53358 -> 195.113.214.236 443 SRPA* 0 0 23 12064 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.319858 0.697837 tcp 10.0.2.105 53359 -> 128.255.183.224 9027 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.597081 0.052204 tcp 10.0.2.105 53360 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.649563 0.072323 tcp 10.0.2.105 53361 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:43.722239 0.174568 tcp 10.0.2.105 53362 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:44.017986 0.468993 tcp 10.0.2.105 53363 -> 176.73.115.123 1806 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:44.127335 0.053802 tcp 10.0.2.105 53364 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:44.181462 0.074440 tcp 10.0.2.105 53365 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:44.256171 0.180260 tcp 10.0.2.105 53366 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:44.487137 2.996491 tcp 10.0.2.105 53367 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:14:53.482256 0.000000 tcp 10.0.2.105 53367 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:14:59.481582 0.051614 tcp 10.0.2.105 53368 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:59.533496 0.071847 tcp 10.0.2.105 53369 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:59.605281 0.177223 tcp 10.0.2.105 53370 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:14:59.793985 3.001671 tcp 10.0.2.105 53371 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:08.794210 0.000000 tcp 10.0.2.105 53371 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:14.793796 0.052168 tcp 10.0.2.105 53372 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:14.846289 0.076963 tcp 10.0.2.105 53373 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:14.923136 0.183149 tcp 10.0.2.105 53374 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:15.286635 0.473289 tcp 10.0.2.105 53375 -> 176.73.211.244 8034 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:15.397796 0.052667 tcp 10.0.2.105 53376 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:15.450792 0.077936 tcp 10.0.2.105 53377 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:15.528529 0.173050 tcp 10.0.2.105 53378 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:15.760136 2.998532 tcp 10.0.2.105 53379 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:24.757259 0.000000 tcp 10.0.2.105 53379 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:30.756784 0.055193 tcp 10.0.2.105 53380 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:30.811854 0.076050 tcp 10.0.2.105 53381 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:30.888192 0.187102 tcp 10.0.2.105 53382 -> 195.113.214.236 443 SRPA* 0 0 20 10688 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:31.244805 0.653601 tcp 10.0.2.105 53383 -> 184.182.240.239 7058 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:31.499309 0.052470 tcp 10.0.2.105 53384 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:31.551623 0.068271 tcp 10.0.2.105 53385 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:31.620188 0.170522 tcp 10.0.2.105 53386 -> 195.113.214.236 443 SRPA* 0 0 39 20860 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:31.898674 3.003291 tcp 10.0.2.105 53387 -> 176.73.200.207 7943 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:40.900143 0.000000 tcp 10.0.2.105 53387 -> 176.73.200.207 7943 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:46.899788 0.053106 tcp 10.0.2.105 53388 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:46.952813 0.071791 tcp 10.0.2.105 53389 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:47.024889 0.177712 tcp 10.0.2.105 53390 -> 195.113.214.236 443 SRPA* 0 0 51 34328 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:15:47.290145 3.003413 tcp 10.0.2.105 53391 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:15:56.292444 0.000000 tcp 10.0.2.105 53391 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:02.291999 0.300028 tcp 10.0.2.105 53392 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:02.592320 0.075628 tcp 10.0.2.105 53393 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:02.668381 0.183441 tcp 10.0.2.105 53394 -> 195.113.214.236 443 SRPA* 0 0 48 40516 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:02.899607 0.458956 tcp 10.0.2.105 53395 -> 176.73.3.72 3605 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:03.009784 0.052987 tcp 10.0.2.105 53396 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:03.063103 0.075350 tcp 10.0.2.105 53397 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:03.138795 0.168682 tcp 10.0.2.105 53398 -> 195.113.214.236 443 SRPA* 0 0 49 33596 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:03.358836 0.415986 tcp 10.0.2.105 53399 -> 46.48.200.118 12856 SPA_* 0 0 9 1206 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:09.356695 0.659366 tcp 10.0.2.105 53399 -> 46.48.200.118 12856 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:09.357484 0.060821 tcp 10.0.2.105 53400 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:09.418622 0.075890 tcp 10.0.2.105 53401 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:09.494775 0.173210 tcp 10.0.2.105 53402 -> 195.113.214.236 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.016401 0.500298 tcp 10.0.2.105 53403 -> 82.211.142.218 9811 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.127841 0.054337 tcp 10.0.2.105 53404 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.182436 0.119799 tcp 10.0.2.105 53405 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.302083 0.191928 tcp 10.0.2.105 53406 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.516919 0.108498 tcp 10.0.2.105 53407 -> 94.137.168.16 9773 FSPA* 0 0 11 1314 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:10.625703 3.001886 tcp 10.0.2.105 53408 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:19.625841 0.000000 tcp 10.0.2.105 53408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:25.624744 0.289961 tcp 10.0.2.105 53409 -> 128.255.183.224 9027 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:25.914953 0.360093 tcp 10.0.2.105 53410 -> 176.73.115.123 1806 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:26.274909 2.994866 tcp 10.0.2.105 53411 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:35.268555 0.000000 tcp 10.0.2.105 53411 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:41.267527 3.003819 tcp 10.0.2.105 53412 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:50.269838 0.000000 tcp 10.0.2.105 53412 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:16:55.056895 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:16:56.268654 0.122234 tcp 10.0.2.105 53413 -> 176.73.211.244 8034 FSPA* 0 0 11 1314 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:16:56.391115 3.002101 tcp 10.0.2.105 53414 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:05.391574 0.000000 tcp 10.0.2.105 53414 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:11.391039 0.245618 tcp 10.0.2.105 53415 -> 184.182.240.239 7058 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:17:11.636921 3.008100 tcp 10.0.2.105 53416 -> 176.73.200.207 7943 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:19.715061 3.002006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:17:20.643655 0.000000 tcp 10.0.2.105 53416 -> 176.73.200.207 7943 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:26.632391 2.994245 tcp 10.0.2.105 53417 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:26.723113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:17:34.724577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:17:35.635260 0.000000 tcp 10.0.2.105 53417 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:40.552407 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:17:41.633816 0.109305 tcp 10.0.2.105 53418 -> 176.73.3.72 3605 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:17:41.743337 2.995137 tcp 10.0.2.105 53419 -> 46.48.200.118 12856 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:50.728154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:17:50.737306 0.000000 tcp 10.0.2.105 53419 -> 46.48.200.118 12856 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:17:56.735667 0.111427 tcp 10.0.2.105 53420 -> 82.211.142.218 9811 FSPA* 0 0 13 1422 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:18:22.733458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:22:56.847921 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:22:56.848013 0.488037 tcp 10.0.2.105 53421 -> 94.137.168.16 9773 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:22:56.968052 0.054421 tcp 10.0.2.105 53422 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:22:57.022783 0.077332 tcp 10.0.2.105 53423 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:22:57.100577 0.185349 tcp 10.0.2.105 53424 -> 195.113.214.236 443 SRPA* 0 0 35 29214 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:22:57.335918 3.006418 tcp 10.0.2.105 53425 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:06.340662 0.000000 tcp 10.0.2.105 53425 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:12.330523 0.052752 tcp 10.0.2.105 53426 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:12.383535 0.079262 tcp 10.0.2.105 53427 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:12.463161 0.178561 tcp 10.0.2.105 53428 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:12.665677 0.633951 tcp 10.0.2.105 53429 -> 128.255.183.224 9027 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:12.956128 0.054924 tcp 10.0.2.105 53430 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.011374 0.073397 tcp 10.0.2.105 53431 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.085420 0.184926 tcp 10.0.2.105 53432 -> 195.113.214.236 443 SRPA* 0 0 37 30900 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.299917 0.462009 tcp 10.0.2.105 53433 -> 176.73.115.123 1806 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.409941 0.057916 tcp 10.0.2.105 53434 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.468187 0.072808 tcp 10.0.2.105 53435 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.541236 0.171230 tcp 10.0.2.105 53436 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:13.762153 3.003389 tcp 10.0.2.105 53437 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:22.764766 0.000000 tcp 10.0.2.105 53437 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:28.763670 0.052387 tcp 10.0.2.105 53438 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:28.816507 0.066871 tcp 10.0.2.105 53439 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:28.883666 0.177060 tcp 10.0.2.105 53440 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:29.080995 2.996735 tcp 10.0.2.105 53441 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:38.076162 0.000000 tcp 10.0.2.105 53441 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:44.075653 0.053501 tcp 10.0.2.105 53442 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.129446 0.074587 tcp 10.0.2.105 53443 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.204336 0.177755 tcp 10.0.2.105 53444 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.395875 0.426590 tcp 10.0.2.105 53445 -> 176.73.211.244 8034 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.504535 0.053348 tcp 10.0.2.105 53446 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.558129 0.077563 tcp 10.0.2.105 53447 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.636070 0.176386 tcp 10.0.2.105 53448 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:44.822666 2.997434 tcp 10.0.2.105 53449 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:53.819014 0.000000 tcp 10.0.2.105 53449 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:23:59.818735 0.052466 tcp 10.0.2.105 53450 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:59.871458 0.071283 tcp 10.0.2.105 53451 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:23:59.943113 0.198888 tcp 10.0.2.105 53452 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:00.168438 0.558798 tcp 10.0.2.105 53453 -> 184.182.240.239 7058 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:00.411619 0.052552 tcp 10.0.2.105 53454 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:00.464537 0.078220 tcp 10.0.2.105 53455 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:00.543076 0.171027 tcp 10.0.2.105 53456 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:00.727496 3.006002 tcp 10.0.2.105 53457 -> 176.73.200.207 7943 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:24:09.731894 0.000000 tcp 10.0.2.105 53457 -> 176.73.200.207 7943 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:24:15.722140 0.052492 tcp 10.0.2.105 53458 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:15.774921 0.071433 tcp 10.0.2.105 53459 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:15.846707 0.176113 tcp 10.0.2.105 53460 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:16.040193 3.005516 tcp 10.0.2.105 53461 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:24:25.043873 0.000000 tcp 10.0.2.105 53461 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:24:26.739207 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:24:31.032948 0.052653 tcp 10.0.2.105 53462 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.085453 0.076634 tcp 10.0.2.105 53463 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.162391 0.176333 tcp 10.0.2.105 53464 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.443339 0.589009 tcp 10.0.2.105 53465 -> 176.73.3.72 3605 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.563410 0.052526 tcp 10.0.2.105 53466 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.616223 0.077914 tcp 10.0.2.105 53467 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:31.694376 0.174531 tcp 10.0.2.105 53468 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:32.032624 0.429151 tcp 10.0.2.105 53469 -> 46.48.200.118 12856 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:33.746302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:24:41.748074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:24:57.751455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:24:59.905762 0.429781 tcp 10.0.2.105 53469 -> 46.48.200.118 12856 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:59.906779 0.052144 tcp 10.0.2.105 53470 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:24:59.959231 0.076130 tcp 10.0.2.105 53471 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.035633 0.175931 tcp 10.0.2.105 53472 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.335725 0.440009 tcp 10.0.2.105 53473 -> 82.211.142.218 9811 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.448668 0.052296 tcp 10.0.2.105 53474 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.501251 0.075201 tcp 10.0.2.105 53475 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.576729 0.176711 tcp 10.0.2.105 53476 -> 195.113.214.236 443 SRPA* 0 0 57 37840 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.775984 0.110105 tcp 10.0.2.105 53477 -> 94.137.168.16 9773 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:00.886252 2.993792 tcp 10.0.2.105 53478 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:25:09.878276 0.000000 tcp 10.0.2.105 53478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:25:15.886927 0.248759 tcp 10.0.2.105 53479 -> 128.255.183.224 9027 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:16.135920 0.111211 tcp 10.0.2.105 53480 -> 176.73.115.123 1806 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:16.247415 0.042118 tcp 10.0.2.105 53481 -> 82.17.183.230 3113 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:29.756832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:25:36.826490 0.000310 tcp 10.0.2.105 53481 -> 82.17.183.230 3113 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:25:36.827042 3.004213 tcp 10.0.2.105 53482 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:25:45.829792 0.000000 tcp 10.0.2.105 53482 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:25:51.818879 0.056968 tcp 10.0.2.105 53483 -> 176.73.211.244 8034 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:26:11.934017 0.000262 tcp 10.0.2.105 53483 -> 176.73.211.244 8034 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:26:11.934485 2.997316 tcp 10.0.2.105 53484 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:26:20.930846 0.000000 tcp 10.0.2.105 53484 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:26:26.929383 0.247827 tcp 10.0.2.105 53485 -> 184.182.240.239 7058 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:26:27.177432 0.055878 tcp 10.0.2.105 53486 -> 176.73.200.207 7943 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:26:47.272691 0.000299 tcp 10.0.2.105 53486 -> 176.73.200.207 7943 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:26:47.273179 2.999653 tcp 10.0.2.105 53487 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:26:56.271223 0.000000 tcp 10.0.2.105 53487 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:27:02.269891 0.118049 tcp 10.0.2.105 53488 -> 176.73.3.72 3605 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:27:02.388194 0.402495 tcp 10.0.2.105 53489 -> 46.48.200.118 12856 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:27:09.434276 0.419176 tcp 10.0.2.105 53489 -> 46.48.200.118 12856 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:27:09.434860 0.130525 tcp 10.0.2.105 53490 -> 82.211.142.218 9811 FSPA* 0 0 13 1230 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:31:33.762837 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:31:40.770652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:31:48.772430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:32:04.774791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:32:09.562154 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:32:09.562247 0.535402 tcp 10.0.2.105 53491 -> 94.137.168.16 9773 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:09.675817 0.053426 tcp 10.0.2.105 53492 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:09.729608 0.070989 tcp 10.0.2.105 53493 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:09.800954 0.197552 tcp 10.0.2.105 53494 -> 195.113.214.236 443 SRPA* 0 0 42 37030 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:10.097900 2.999141 tcp 10.0.2.105 53495 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:32:19.105512 0.000000 tcp 10.0.2.105 53495 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:32:25.094707 0.054007 tcp 10.0.2.105 53496 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.149005 0.076272 tcp 10.0.2.105 53497 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.225551 0.168472 tcp 10.0.2.105 53498 -> 195.113.214.236 443 SRPA* 0 0 40 22372 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.484775 0.621898 tcp 10.0.2.105 53499 -> 128.255.183.224 9027 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.783420 0.051976 tcp 10.0.2.105 53500 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.835714 0.074974 tcp 10.0.2.105 53501 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:25.910955 0.174704 tcp 10.0.2.105 53502 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:26.106929 0.428875 tcp 10.0.2.105 53503 -> 176.73.115.123 1806 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:26.213599 0.055376 tcp 10.0.2.105 53504 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:26.269356 0.077890 tcp 10.0.2.105 53505 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:26.347501 0.173517 tcp 10.0.2.105 53506 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:26.536025 4.645516 tcp 10.0.2.105 53507 -> 82.17.183.230 3113 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:30.850749 0.052967 tcp 10.0.2.105 53508 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:30.904004 0.068032 tcp 10.0.2.105 53509 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:30.972326 0.180379 tcp 10.0.2.105 53510 -> 195.113.214.236 443 SRPA* 0 0 50 42538 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:31.181728 2.995681 tcp 10.0.2.105 53511 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:32:36.781026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:32:40.176063 0.000000 tcp 10.0.2.105 53511 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:32:46.174973 0.052608 tcp 10.0.2.105 53512 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.227839 0.071523 tcp 10.0.2.105 53513 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.299701 0.171441 tcp 10.0.2.105 53514 -> 195.113.214.236 443 SRPA* 0 0 52 38992 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.493077 0.447428 tcp 10.0.2.105 53515 -> 176.73.211.244 8034 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.604054 0.054444 tcp 10.0.2.105 53516 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.658394 0.074791 tcp 10.0.2.105 53517 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.733468 0.186803 tcp 10.0.2.105 53518 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:32:46.940702 2.999569 tcp 10.0.2.105 53519 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:32:55.938381 0.000000 tcp 10.0.2.105 53519 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:01.937644 0.052586 tcp 10.0.2.105 53520 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:01.990518 0.076384 tcp 10.0.2.105 53521 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:02.067181 0.186672 tcp 10.0.2.105 53522 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:02.356006 0.796181 tcp 10.0.2.105 53523 -> 184.182.240.239 7058 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:02.787733 0.052867 tcp 10.0.2.105 53524 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:02.840887 0.075435 tcp 10.0.2.105 53525 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:02.916622 0.196548 tcp 10.0.2.105 53526 -> 195.113.214.236 443 SRPA* 0 0 24 10462 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:03.152500 0.500390 tcp 10.0.2.105 53527 -> 176.73.200.207 7943 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:03.262899 0.053066 tcp 10.0.2.105 53528 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:03.315767 0.076655 tcp 10.0.2.105 53529 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:03.392746 0.175614 tcp 10.0.2.105 53530 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:03.653045 3.000951 tcp 10.0.2.105 53531 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:12.652729 0.000000 tcp 10.0.2.105 53531 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:18.651625 0.052984 tcp 10.0.2.105 53532 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:18.704903 0.071490 tcp 10.0.2.105 53533 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:18.776685 0.172344 tcp 10.0.2.105 53534 -> 195.113.214.236 443 SRPA* 0 0 27 11670 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:19.019653 0.623250 tcp 10.0.2.105 53535 -> 176.73.3.72 3605 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:19.131288 0.053119 tcp 10.0.2.105 53536 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:19.184756 0.071168 tcp 10.0.2.105 53537 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:19.256271 0.194379 tcp 10.0.2.105 53538 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:19.643118 4.818882 tcp 10.0.2.105 53539 -> 46.48.200.118 12856 SPA_* 0 0 12 1507 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.462376 0.052309 tcp 10.0.2.105 53540 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.514953 0.075769 tcp 10.0.2.105 53541 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.590996 0.170336 tcp 10.0.2.105 53542 -> 195.113.214.236 443 SRPA* 0 0 35 18598 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.790697 0.000086 tcp 10.0.2.105 53539 -> 46.48.200.118 12856 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.791047 0.431771 tcp 10.0.2.105 53543 -> 82.211.142.218 9811 FSPA* 0 0 11 1193 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.901155 0.052543 tcp 10.0.2.105 53544 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:24.953999 0.076155 tcp 10.0.2.105 53545 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:25.030489 0.179820 tcp 10.0.2.105 53546 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:25.223110 0.110539 tcp 10.0.2.105 53547 -> 94.137.168.16 9773 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:25.333914 3.001456 tcp 10.0.2.105 53548 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:34.333747 0.000000 tcp 10.0.2.105 53548 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:40.332343 0.276443 tcp 10.0.2.105 53549 -> 128.255.183.224 9027 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:40.609047 0.124805 tcp 10.0.2.105 53550 -> 176.73.115.123 1806 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:40.734111 0.339654 tcp 10.0.2.105 53551 -> 82.17.183.230 3113 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:41.073752 2.993779 tcp 10.0.2.105 53552 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:50.066421 0.000000 tcp 10.0.2.105 53552 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:33:56.075402 0.112509 tcp 10.0.2.105 53553 -> 176.73.211.244 8034 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:33:56.188142 3.001220 tcp 10.0.2.105 53554 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:34:05.188065 0.000000 tcp 10.0.2.105 53554 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:34:11.186886 0.260528 tcp 10.0.2.105 53555 -> 184.182.240.239 7058 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:34:11.447662 0.106883 tcp 10.0.2.105 53556 -> 176.73.200.207 7943 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:34:11.554761 2.996651 tcp 10.0.2.105 53557 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:34:20.550031 0.000000 tcp 10.0.2.105 53557 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:34:26.549115 0.109391 tcp 10.0.2.105 53558 -> 176.73.3.72 3605 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:34:26.658745 2.224547 tcp 10.0.2.105 53559 -> 46.48.200.118 12856 FSPA* 0 0 11 1193 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:34:28.883126 0.110501 tcp 10.0.2.105 53560 -> 82.211.142.218 9811 FSPA* 0 0 13 1301 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:38:40.787346 3.071756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:38:47.864304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:38:55.865789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:39:11.868965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:39:29.024150 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:39:29.024231 2.993425 tcp 10.0.2.105 53561 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:39:38.016500 0.000000 tcp 10.0.2.105 53561 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:39:43.875202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:39:44.026522 0.055534 tcp 10.0.2.105 53562 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:44.082386 0.072624 tcp 10.0.2.105 53563 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:44.155359 0.184107 tcp 10.0.2.105 53564 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:44.360867 2.999435 tcp 10.0.2.105 53565 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:39:53.358382 0.000000 tcp 10.0.2.105 53565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:39:59.357989 0.056837 tcp 10.0.2.105 53566 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:59.415142 0.072197 tcp 10.0.2.105 53567 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:59.487716 0.185393 tcp 10.0.2.105 53568 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:59.684533 0.577788 tcp 10.0.2.105 53569 -> 128.255.183.224 9027 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:39:59.947433 0.055516 tcp 10.0.2.105 53570 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.003228 0.070796 tcp 10.0.2.105 53571 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.074317 0.171820 tcp 10.0.2.105 53572 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.262474 0.438066 tcp 10.0.2.105 53573 -> 176.73.115.123 1806 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.379780 0.052404 tcp 10.0.2.105 53574 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.432508 0.077215 tcp 10.0.2.105 53575 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.509967 0.179258 tcp 10.0.2.105 53576 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.700798 0.531358 tcp 10.0.2.105 53577 -> 82.17.183.230 3113 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.845151 0.128197 tcp 10.0.2.105 53578 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:00.973648 0.075122 tcp 10.0.2.105 53579 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:01.049103 0.173105 tcp 10.0.2.105 53580 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:01.232380 3.001997 tcp 10.0.2.105 53581 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:10.233252 0.000000 tcp 10.0.2.105 53581 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:13.508340 0.000000 udp 10.0.2.105 7010 -> 5.234.90.187 2168 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:40:16.232006 0.052461 tcp 10.0.2.105 53582 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.284764 0.076380 tcp 10.0.2.105 53583 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.361412 0.170069 tcp 10.0.2.105 53584 -> 195.113.214.236 443 SRPA* 0 0 51 42188 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.549833 0.487022 tcp 10.0.2.105 53585 -> 176.73.211.244 8034 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.659915 0.054383 tcp 10.0.2.105 53586 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.714577 0.070094 tcp 10.0.2.105 53587 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:16.784961 0.239261 tcp 10.0.2.105 53588 -> 195.113.214.236 443 SRPA* 0 0 44 27916 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:17.037119 2.999886 tcp 10.0.2.105 53589 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:26.045533 0.000000 tcp 10.0.2.105 53589 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:30.292416 0.052353 tcp 10.0.2.105 53590 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:30.345085 0.072600 tcp 10.0.2.105 53591 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:30.417967 0.312264 tcp 10.0.2.105 53592 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:30.730754 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:40:32.034651 0.053260 tcp 10.0.2.105 53593 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:32.088295 0.074542 tcp 10.0.2.105 53594 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:32.163187 0.185999 tcp 10.0.2.105 53595 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:32.362245 3.617870 tcp 10.0.2.105 53596 -> 184.182.240.239 7058 FSPA* 0 0 12 1258 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:35.611473 0.052471 tcp 10.0.2.105 53597 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:35.664230 0.080338 tcp 10.0.2.105 53598 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:35.744858 0.164931 tcp 10.0.2.105 53599 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:35.980558 0.420429 tcp 10.0.2.105 53600 -> 176.73.200.207 7943 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:36.089853 0.051687 tcp 10.0.2.105 53601 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:36.141999 0.071006 tcp 10.0.2.105 53602 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:36.213322 0.177753 tcp 10.0.2.105 53603 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:36.401177 3.003509 tcp 10.0.2.105 53604 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:45.403535 0.000000 tcp 10.0.2.105 53604 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:40:48.749518 0.052605 tcp 10.0.2.105 53605 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:48.802423 0.071399 tcp 10.0.2.105 53606 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:48.874162 0.179626 tcp 10.0.2.105 53607 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:49.052958 0.143824 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.197314 0.138223 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.335956 0.145226 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.481600 0.027804 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.509830 0.020286 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.530439 0.062236 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.593096 0.188246 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.781729 0.177777 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:49.959907 0.157489 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:50.117713 0.177975 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:50.296141 0.169099 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:50.465626 0.174637 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:50.640656 0.211901 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:50.852978 0.223876 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:51.077212 0.150327 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:51.227906 0.203217 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:40:51.402511 0.052684 tcp 10.0.2.105 53608 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.431542 0.000000 udp 10.0.2.105 7010 -> 91.243.168.4 8547 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:40:51.455049 0.076921 tcp 10.0.2.105 53609 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.531878 0.184753 tcp 10.0.2.105 53610 -> 195.113.214.236 443 SRPA* 0 0 42 34030 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.736598 0.431341 tcp 10.0.2.105 53611 -> 176.73.3.72 3605 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.845995 0.052614 tcp 10.0.2.105 53612 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.898926 0.075524 tcp 10.0.2.105 53613 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:51.974728 0.172992 tcp 10.0.2.105 53614 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:40:52.168416 0.411868 tcp 10.0.2.105 53615 -> 46.48.200.118 12856 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:08.517226 0.053253 tcp 10.0.2.105 53616 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:08.570752 0.071137 tcp 10.0.2.105 53617 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:08.642126 0.174636 tcp 10.0.2.105 53618 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:08.815510 0.116056 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:08.932003 0.164000 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:09.096434 0.168717 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:09.265532 1.285151 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:10.551079 0.054080 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:10.605550 0.264014 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:10.869999 0.029331 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:10.899698 0.343429 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:11.243700 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 01:41:22.577987 0.052704 tcp 10.0.2.105 53619 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:22.630978 0.082441 tcp 10.0.2.105 53620 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:22.713733 0.176433 tcp 10.0.2.105 53621 -> 195.113.214.236 443 SRPA* 0 0 40 22584 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:22.913167 0.000056 tcp 10.0.2.105 53615 -> 46.48.200.118 12856 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:22.913458 0.468367 tcp 10.0.2.105 53622 -> 82.211.142.218 9811 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:23.027366 0.052459 tcp 10.0.2.105 53623 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:23.080109 0.073562 tcp 10.0.2.105 53624 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:23.153972 0.185211 tcp 10.0.2.105 53625 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:23.382017 3.000300 tcp 10.0.2.105 53626 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:41:28.366139 0.054311 tcp 10.0.2.105 53627 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:28.420677 0.075008 tcp 10.0.2.105 53628 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:28.495504 0.161143 tcp 10.0.2.105 53629 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:28.657298 0.168899 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:28.826622 0.525006 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:29.352051 0.391182 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:29.743600 0.053992 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:29.797928 0.151985 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:29.950305 0.053631 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:30.004528 0.185735 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:30.190677 0.052892 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:30.243973 0.054338 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:30.298665 0.120098 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 01:41:32.380796 0.000000 tcp 10.0.2.105 53626 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:41:33.378957 0.000133 tcp 10.0.2.105 53615 -> 46.48.200.118 12856 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:38.380383 3.003831 tcp 10.0.2.105 53630 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:41:47.382925 0.000000 tcp 10.0.2.105 53630 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:41:52.079187 0.000261 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 01:41:53.381633 0.276137 tcp 10.0.2.105 53631 -> 128.255.183.224 9027 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:53.657961 0.107917 tcp 10.0.2.105 53632 -> 176.73.115.123 1806 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:41:53.766042 0.041303 tcp 10.0.2.105 53633 -> 82.17.183.230 3113 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:42:23.805298 0.102063 tcp 10.0.2.105 53633 -> 82.17.183.230 3113 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:42:23.805594 2.993819 tcp 10.0.2.105 53634 -> 14.97.23.253 9249 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:42:32.797945 0.000000 tcp 10.0.2.105 53634 -> 14.97.23.253 9249 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:42:38.806789 0.055585 tcp 10.0.2.105 53635 -> 176.73.211.244 8034 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:42:58.917812 0.000304 tcp 10.0.2.105 53635 -> 176.73.211.244 8034 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:42:58.918307 3.001282 tcp 10.0.2.105 53636 -> 82.211.131.43 2533 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:43:07.918069 0.000000 tcp 10.0.2.105 53636 -> 82.211.131.43 2533 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:43:13.917071 0.244857 tcp 10.0.2.105 53637 -> 184.182.240.239 7058 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:43:14.161851 0.055336 tcp 10.0.2.105 53638 -> 176.73.200.207 7943 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:43:34.267395 0.000295 tcp 10.0.2.105 53638 -> 176.73.200.207 7943 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:43:34.267933 3.002820 tcp 10.0.2.105 53639 -> 176.73.154.150 1652 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:43:43.269608 0.000000 tcp 10.0.2.105 53639 -> 176.73.154.150 1652 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 01:43:49.268151 0.112277 tcp 10.0.2.105 53640 -> 176.73.3.72 3605 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:43:49.380605 0.857074 tcp 10.0.2.105 53641 -> 46.48.200.118 12856 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:44:20.232260 0.000068 tcp 10.0.2.105 53641 -> 46.48.200.118 12856 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:44:20.232568 0.110163 tcp 10.0.2.105 53642 -> 82.211.142.218 9811 FSPA* 0 0 13 1300 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:44:29.604296 0.000130 tcp 10.0.2.105 53641 -> 46.48.200.118 12856 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/13 01:45:47.881349 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 01:45:54.888566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:46:02.890153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:46:18.892738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:46:50.899126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:52:54.905387 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 01:53:01.912866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:53:09.914071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:53:25.916693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 01:53:57.922701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:00:01.929393 3.000951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:00:08.936274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:00:16.938043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:00:32.940985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:01:04.946629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:07:08.952896 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:07:15.960451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:07:23.962283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:07:39.965063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:08:11.970928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:11:54.491105 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 02:11:54.491350 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 02:12:09.934975 0.053395 tcp 10.0.2.105 53643 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:09.988660 0.074863 tcp 10.0.2.105 53644 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:10.063825 0.178549 tcp 10.0.2.105 53645 -> 195.113.214.236 443 SRPA* 0 0 49 30834 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:10.240914 0.000000 udp 10.0.2.105 7010 -> 91.243.168.4 8547 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 02:12:26.948146 0.053040 tcp 10.0.2.105 53646 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:27.001471 0.077034 tcp 10.0.2.105 53647 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:27.078378 0.172386 tcp 10.0.2.105 53648 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:27.251271 0.168011 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 6 2612 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:27.434263 0.170259 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:27.609966 0.039366 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:27.646825 0.021745 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:27.717577 0.407938 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:28.098856 0.202213 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:28.293366 0.181454 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:28.472592 0.198998 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:28.651121 0.145310 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:28.840537 0.168893 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:29.017896 0.265815 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:29.237669 0.219060 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 6 1977 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:29.434421 0.172832 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:29.603832 0.317006 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:29.791542 0.235515 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.006390 0.297402 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.274166 0.232431 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.377878 0.120230 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.528761 0.226734 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.756848 0.199428 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:30.924735 0.239218 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:31.151680 0.045792 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:31.210063 0.055047 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:31.276869 2.481629 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:33.732664 0.343758 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:34.080722 0.181874 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:34.255104 0.404587 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:34.633779 0.378033 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:34.981594 0.055623 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.045008 0.210621 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.280798 0.056956 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.356861 0.059515 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.421813 0.122619 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.490531 0.577007 tcp 10.0.2.105 53649 -> 94.137.168.16 9773 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:12:35.555725 0.182196 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:12:35.724840 0.054086 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:14:15.977544 3.000972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 02:14:22.984184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:14:30.986015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:14:46.989068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:15:18.994713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:21:23.001443 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:21:30.008258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:21:38.009716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:21:54.012499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:22:26.018539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:28:30.025070 3.001156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:28:37.032098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:28:45.033479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:29:01.046928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:29:33.052779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:35:37.059579 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:35:44.066119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:35:52.068082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:36:08.070586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:36:40.076779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:42:36.068859 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 02:42:36.069046 0.609496 tcp 10.0.2.105 53650 -> 94.137.168.16 9773 FSPA* 0 0 12 1640 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:42:43.459843 0.036339 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:43.543768 0.022256 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:43.643517 0.084507 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:43.706283 0.170989 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:43.853636 0.172439 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:44.056145 0.198744 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:44.084082 3.000059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:42:44.246896 0.181919 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:44.426732 0.183726 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:44.979924 0.145795 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:45.139353 0.168357 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:45.354838 0.193829 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:45.540894 0.352137 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:45.757636 0.234663 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:45.971774 0.449928 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:46.373374 0.208070 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:46.557853 0.155923 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:46.709510 0.135997 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:46.811626 0.117336 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:46.967876 0.175599 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:42:47.163543 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 02:42:51.090303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:42:59.091959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:43:04.561101 0.052813 tcp 10.0.2.105 53651 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:43:04.614167 0.073179 tcp 10.0.2.105 53652 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:43:04.687198 0.184032 tcp 10.0.2.105 53653 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/13 02:43:04.871708 0.287850 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:05.147434 0.045777 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:05.453610 0.056827 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2549 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:05.515223 0.485331 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:05.968042 0.344098 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:06.337652 0.177604 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:06.506578 0.411469 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:06.892834 0.374739 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.241282 0.056543 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.371808 0.058924 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.493060 0.122562 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.629600 0.183367 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.799184 0.055474 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:07.867332 0.160978 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:08.110742 0.058326 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/01/13 02:43:15.094924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:43:47.100944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:49:51.106949 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:49:58.114289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:50:06.115707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:50:22.119043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:50:54.125102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:56:58.130798 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 02:57:05.138129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:57:13.139352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:57:29.142731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 02:58:01.148799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:04:05.155493 3.000863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:04:12.162108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:04:20.163866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:04:36.166785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:05:08.172838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:11:12.179250 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:11:19.186332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:11:27.187835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:11:43.190566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:12:15.196996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:12:36.677915 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 03:12:36.678013 0.581797 tcp 10.0.2.105 53654 -> 94.137.168.16 9773 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:13:36.934538 0.164205 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.099133 0.062086 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.161653 0.144586 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.306662 0.147558 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.454625 0.044703 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.499685 0.020548 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.520582 0.155586 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.676584 0.144700 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:37.821689 0.188770 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.010842 0.183815 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.195056 0.189194 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.384634 0.215059 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.600125 0.169593 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.770141 0.140403 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:38.910955 0.241919 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:39.153306 0.153015 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:39.306754 0.118014 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:39.425110 0.163959 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:39.589454 0.301798 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:39.891625 0.180503 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:40.072631 0.197442 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:40.270463 0.380014 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 03:13:40.650477 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 193 flow=Background 1970/01/13 03:13:41.580944 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 03:13:55.833248 0.051957 tcp 10.0.2.105 53655 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:13:55.885507 0.079780 tcp 10.0.2.105 53656 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:13:55.965589 0.206546 tcp 10.0.2.105 53657 -> 195.113.214.236 443 SRPA* 0 0 52 37570 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:13:56.172765 0.028876 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:56.201974 0.102404 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:56.304810 0.374433 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:56.679580 0.342673 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.022587 0.167871 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.190850 0.348761 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.540023 0.062150 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.602590 0.055611 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.658579 0.121623 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.780583 0.167652 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:57.948665 0.054894 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:58.004006 0.153204 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:13:58.157644 0.054186 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:18:19.202372 3.002103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 03:18:26.210224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:18:34.211257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:18:50.214607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:19:22.220552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:25:26.227027 3.000970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:25:33.233921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:25:41.235587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:25:57.238657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:26:29.244286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:32:33.250955 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:32:40.258046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:32:48.259496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:33:04.262740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:33:36.269009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:39:40.274637 3.001393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:39:47.282163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:39:55.283693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:40:11.286379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:40:43.292431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:42:37.267131 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 03:42:37.267226 0.599119 tcp 10.0.2.105 53658 -> 94.137.168.16 9773 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:01.839609 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 03:44:01.839746 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 03:44:18.203825 0.051374 tcp 10.0.2.105 53659 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:18.255425 0.072088 tcp 10.0.2.105 53660 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:18.327842 0.168826 tcp 10.0.2.105 53661 -> 195.113.214.236 443 SRPA* 0 0 49 30778 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:18.497235 0.169910 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:18.667478 0.144015 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:18.811916 0.145484 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:18.957757 0.049533 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.007646 0.020562 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.028615 0.160548 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.189629 0.124564 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.314604 0.189311 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.504493 0.070443 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.575348 0.211621 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.787321 0.169261 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:19.956926 0.147440 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.104727 0.173955 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.279075 0.177866 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.457340 0.114224 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.571958 0.163071 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.735407 0.257752 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:20.993639 0.176691 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:21.170713 0.104212 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:21.275334 0.486388 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:21.762143 0.291271 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:22.053810 0.438192 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:22.492570 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 03:44:40.614555 0.050713 tcp 10.0.2.105 53662 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:40.665522 0.067791 tcp 10.0.2.105 53663 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:40.733641 0.172625 tcp 10.0.2.105 53664 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:40.906746 0.029252 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:40.936592 0.056553 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:40.993643 0.540114 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:41.534118 0.383790 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:41.918314 0.055375 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:41.974081 0.056863 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:42.031328 0.123793 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:42.155532 0.248672 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:42.404562 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 03:44:59.240850 0.053036 tcp 10.0.2.105 53665 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:59.294229 0.144807 tcp 10.0.2.105 53666 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:59.439323 0.170772 tcp 10.0.2.105 53667 -> 195.113.214.236 443 SRPA* 0 0 32 25994 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:44:59.610913 0.151870 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 03:44:59.763118 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 03:45:18.598485 0.051980 tcp 10.0.2.105 53668 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:45:18.650316 0.078880 tcp 10.0.2.105 53669 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:45:18.729488 0.164289 tcp 10.0.2.105 53670 -> 195.113.214.236 443 SRPA* 0 0 56 34572 flow=From-Botnet-V2-TCP-Established 1970/01/13 03:46:47.298818 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 03:46:54.305704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:47:02.307600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:47:18.310315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:47:50.316510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:53:54.322180 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 03:54:01.329942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:54:09.331560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:54:25.334222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 03:54:57.340799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:01:01.346664 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:01:08.354080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:01:16.355020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:01:32.358599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:02:04.364506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:08:08.370960 3.001245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:08:15.378006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:08:23.378988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:08:39.382230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:09:11.388266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:12:37.866267 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 04:12:37.866366 0.572546 tcp 10.0.2.105 53671 -> 94.137.168.16 9773 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:15:15.395177 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:15:22.401453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:15:30.403614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:15:33.327949 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 04:15:33.328141 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 04:15:46.406608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:15:51.856621 0.053122 tcp 10.0.2.105 53672 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:15:51.910015 0.077031 tcp 10.0.2.105 53673 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:15:51.987415 0.175375 tcp 10.0.2.105 53674 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:15:52.163421 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 04:16:10.221293 0.053887 tcp 10.0.2.105 53675 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:10.275419 0.075698 tcp 10.0.2.105 53676 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:10.351445 0.168030 tcp 10.0.2.105 53677 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:10.520088 0.055292 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:10.575700 0.020748 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:10.596854 0.032572 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:10.629817 0.147821 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:10.778032 0.145118 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:10.923583 0.164768 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.088690 0.211174 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.300305 0.170685 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.471340 0.142921 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.614702 0.138546 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.753778 0.191351 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:11.945545 0.156490 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.102419 0.176015 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.278866 0.163651 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.443005 0.114267 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.557658 0.177371 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.735422 0.177793 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:12.913599 0.227088 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:13.141120 0.103452 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:13.245005 0.341787 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:13.587138 0.285490 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:13.872978 0.179297 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:14.052703 0.414878 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:14.468019 0.055540 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:14.523954 0.029927 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:14.554266 0.056108 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:14.610778 0.402881 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:15.014094 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 04:16:18.412811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:16:31.861876 0.053117 tcp 10.0.2.105 53678 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:31.915230 0.079487 tcp 10.0.2.105 53679 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:31.995043 0.176554 tcp 10.0.2.105 53680 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:16:32.172223 0.167145 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:32.339696 0.055619 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:32.395644 0.169361 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:16:32.565379 0.159371 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:22:22.418248 3.022251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:22:29.446310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:22:37.447375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:22:53.449986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:23:25.456131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:29:29.462889 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:29:36.470106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:29:44.471564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:30:00.474113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:30:32.480275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:36:36.486883 3.001175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:36:43.493527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:36:51.495389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:37:07.498077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:37:39.503936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:42:38.444550 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 04:42:38.444695 0.701309 tcp 10.0.2.105 53681 -> 94.137.168.16 9773 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/01/13 04:43:43.511421 3.000318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:43:50.517513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:43:58.518964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:44:14.521853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:44:46.528446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:46:39.752513 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 04:46:39.752717 0.123439 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:39.876565 0.020758 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:39.897686 0.032517 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:39.930592 0.146857 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.077846 0.139061 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.217352 0.357482 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.575258 0.057941 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.633975 0.142283 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.776694 0.217772 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:40.994869 0.189120 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.184448 0.152751 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.337555 0.138197 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.476124 0.168909 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.645364 0.113976 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.759733 0.191546 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:41.951639 0.189562 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:42.141594 0.635235 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:42.777254 0.166945 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:42.944612 0.063659 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.008608 0.249003 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.258000 0.176828 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.435202 0.151434 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.587043 0.367268 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.954725 0.028326 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:43.983472 0.055126 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:44.038948 0.472080 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:44.511435 0.056740 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:44.568525 0.392584 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:44.961478 0.168106 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:45.129977 0.153054 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:45.283482 0.166713 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:46:45.450588 0.060062 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 04:50:50.534797 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:50:57.541688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:51:05.543451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:51:21.546627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:51:53.552255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:57:57.557986 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 04:58:04.565664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:58:12.567023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:58:28.570169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 04:59:00.575817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:05:04.581686 3.002048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:05:11.589907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:05:19.591107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:05:35.593912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:06:07.600169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:12:11.606693 3.001357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:12:18.613549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:12:26.615348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:12:39.153989 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 05:12:39.154452 0.739328 tcp 10.0.2.105 53682 -> 94.137.168.16 9773 FSPA* 0 0 12 1409 flow=From-Botnet-V2-TCP-Established 1970/01/13 05:12:42.617944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:13:14.623749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:16:55.722599 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 05:16:55.722700 0.027452 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:55.750576 0.149334 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:55.900419 0.120378 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.021138 0.020693 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.042298 0.147179 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.189858 0.359389 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.549646 0.055990 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.606048 0.142504 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.748944 0.220768 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:56.970108 0.138350 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.108857 0.168618 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.277937 0.116662 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.394991 0.186178 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.581546 0.183047 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.764963 0.193009 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:57.958367 0.157901 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:58.116622 0.274283 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:58.391303 0.165412 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:58.557116 0.451856 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.009400 0.191745 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.201543 0.148345 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.350244 0.028225 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.378851 0.060262 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.439459 0.179676 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.619499 0.174887 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:16:59.794790 0.764986 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:00.560174 0.060299 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:00.620887 0.374926 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:00.996152 0.166453 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:01.162993 0.054296 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:01.217686 0.152563 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:17:01.370663 0.171753 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:19:18.630000 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:19:25.637911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:19:33.639265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:19:49.641971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:20:21.648269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:26:25.654259 3.011672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:26:32.671461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:26:40.672747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:26:56.675718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:27:28.682079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:33:32.688695 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:33:39.695130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:33:47.696836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:34:03.700141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:34:35.705892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:40:39.711888 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:40:46.719599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:40:54.720911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:41:10.724248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:41:42.730103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:42:39.892630 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 05:42:39.892730 0.737089 tcp 10.0.2.105 53683 -> 94.137.168.16 9773 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/13 05:47:28.487457 0.013352 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 05:47:28.501008 0.187023 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:28.688485 0.020439 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:28.709227 0.033246 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:28.742818 0.144417 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:28.887669 0.139375 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.027442 0.173005 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.200852 0.056002 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.257275 0.142651 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.400371 0.222228 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.622920 0.138026 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.761325 0.188676 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:29.950366 0.219311 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:30.170047 0.189352 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:30.359794 0.156558 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:30.516742 0.168241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:30.685392 0.114878 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:30.800693 0.221197 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.022310 0.165855 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.188643 0.138129 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.327161 0.029544 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.357094 0.059938 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.417416 0.277668 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.695486 0.175537 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:31.871453 0.170915 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:32.042809 0.237088 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:32.280357 0.837922 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:33.118659 0.056134 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:33.175121 0.392325 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:33.567879 0.152887 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:33.721171 0.168324 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:33.889887 0.166439 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:34.056725 0.058797 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/13 05:47:46.735565 3.002345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 05:47:53.743316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:48:01.745135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:48:17.748946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:48:49.754765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:54:53.761062 3.000776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 05:55:00.767126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:55:08.768868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:55:24.771941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 05:55:56.778112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:02:00.783981 3.001910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:02:07.790995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:02:15.792457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:02:31.795610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:03:03.801711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:09:07.808986 3.000763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:09:14.815095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:09:22.817076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:09:38.820049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:10:10.825719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:12:40.631850 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 06:12:40.631948 0.606492 tcp 10.0.2.105 53684 -> 94.137.168.16 9773 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:16:14.832412 3.000989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:16:21.839504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:16:29.840868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:16:45.844131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:17:17.850269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:17:53.461484 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 06:17:53.461666 0.062809 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:53.524823 0.144374 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:53.669651 0.145830 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:53.815870 0.131072 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:53.947297 0.020111 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:53.967747 0.176866 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.145043 0.057165 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.202617 0.139192 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.342141 0.258801 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.601360 0.138373 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.740135 0.189198 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:54.929736 0.176524 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:17:55.106618 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 06:18:12.360187 0.055391 tcp 10.0.2.105 53685 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:12.415893 0.070796 tcp 10.0.2.105 53686 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:12.487062 0.171112 tcp 10.0.2.105 53687 -> 195.113.214.236 443 SRPA* 0 0 49 31579 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:12.656565 0.160261 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:12.817260 0.178870 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:12.996568 0.115399 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.112469 0.223921 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.336744 0.028537 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.365612 0.054297 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.420559 0.258988 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.679955 0.180005 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.860376 0.132612 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:13.993440 0.213181 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:14.207068 0.061745 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:14.269159 0.148870 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:14.418459 0.394001 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:14.812838 0.152535 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:14.965762 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 06:18:31.837043 0.051903 tcp 10.0.2.105 53688 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:31.889242 0.074745 tcp 10.0.2.105 53689 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:31.964280 0.274917 tcp 10.0.2.105 53690 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:18:32.238815 0.169832 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:32.409068 0.054872 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:32.464493 0.055905 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:18:32.520799 0.384262 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:23:21.856885 3.001023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 06:23:28.863562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:23:36.864968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:23:52.868071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:24:24.873923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:30:28.879427 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:30:35.887031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:30:43.888591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:30:59.891350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:31:31.897577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:37:35.903348 3.001768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:37:42.911185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:37:50.912608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:38:06.915456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:38:38.922012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:42:41.240555 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 06:42:41.240659 0.636354 tcp 10.0.2.105 53691 -> 94.137.168.16 9773 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:44:42.927578 3.002052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:44:49.935358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:44:57.936874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:45:13.939645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:45:45.945478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:48:58.613110 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 06:48:58.613260 0.188685 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:48:58.802399 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 06:49:15.709572 0.055079 tcp 10.0.2.105 53692 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:15.764963 0.074622 tcp 10.0.2.105 53693 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:15.839827 0.174760 tcp 10.0.2.105 53694 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:16.015163 0.120566 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.136071 0.020483 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.156981 0.168607 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.325953 0.173933 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.500239 0.144059 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.644688 0.028408 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.673491 0.124149 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.798043 0.182162 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:16.980618 0.142892 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.123844 0.058280 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.182555 0.176758 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.359688 0.228454 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.588569 0.169569 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.758519 0.155879 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:17.914751 0.115175 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.030344 0.355243 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.385927 0.181800 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.568140 0.101638 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.670189 0.059779 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.730368 0.028879 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:18.759629 0.532476 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:19.292608 0.065027 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:19.358057 0.149596 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:19.508105 0.485560 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:19.994562 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 5866 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 06:49:37.989581 0.050814 tcp 10.0.2.105 53695 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:38.040694 0.072901 tcp 10.0.2.105 53696 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:38.113952 0.177201 tcp 10.0.2.105 53697 -> 195.113.214.236 443 SRPA* 0 0 42 32892 flow=From-Botnet-V2-TCP-Established 1970/01/13 06:49:38.291725 0.187180 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:38.479322 0.060107 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:38.540145 0.385570 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:38.926112 0.169854 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:49:39.096394 0.057446 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 06:51:49.952233 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 06:51:56.959325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:52:04.961019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:52:20.963951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:52:52.969296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:58:56.974896 3.002385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 06:59:03.982900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:59:11.984368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:59:27.987803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 06:59:59.993541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:06:04.000881 3.000668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:06:11.006924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:06:19.008358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:06:35.011650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:07:07.017645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:12:41.879429 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 07:12:41.879522 0.627031 tcp 10.0.2.105 53698 -> 94.137.168.16 9773 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:13:11.024615 3.000240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:13:18.030798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:13:26.032828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:13:42.035408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:14:14.041801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:19:46.079139 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 07:19:46.079419 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 5866 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 07:20:02.054099 0.052676 tcp 10.0.2.105 53699 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:20:02.107069 0.111945 tcp 10.0.2.105 53700 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:20:02.219330 0.176056 tcp 10.0.2.105 53701 -> 195.113.214.236 443 SRPA* 0 0 40 33960 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:20:02.396148 0.189694 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:02.586227 0.142886 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:02.729451 0.151600 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:02.881476 0.145601 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.027489 0.061416 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.089314 0.152293 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.242017 0.349577 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.591994 0.020397 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.612735 0.142457 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.755566 0.189083 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:03.945047 0.212189 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.157658 0.168126 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.326174 0.154660 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.481170 0.114974 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.596498 0.189482 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.786312 0.059124 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.845862 0.143582 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:04.989867 0.059827 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:05.050075 0.028856 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:05.079248 0.214931 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:05.294540 0.176859 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:05.471720 0.964706 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:06.436835 0.385430 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:06.822637 0.217259 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.040254 0.070314 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.110962 0.378417 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.489787 0.216590 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.706779 0.185870 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.893037 0.080497 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:07.973950 0.058195 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:20:18.057730 3.001353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:20:25.065131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:20:33.066235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:20:49.069495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:21:21.075302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:27:25.080921 3.002529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:27:32.088561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:27:40.090079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:27:56.093348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:28:28.099147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:34:32.106082 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:34:39.112556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:34:47.114039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:35:03.117579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:35:35.123234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:41:39.129822 3.001070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:41:46.137078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:41:54.138660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:42:10.141188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:42:42.147261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:42:42.518610 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 07:42:42.518793 0.600773 tcp 10.0.2.105 53702 -> 94.137.168.16 9773 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:48:46.153358 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:48:53.160865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:49:01.162260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:49:17.165241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:49:49.171168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:50:20.406387 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 07:50:20.406572 0.142901 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:20.549864 0.144325 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:20.694609 0.030187 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:20.725177 0.187880 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:20.913472 0.121292 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.035109 0.124253 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.159848 0.316551 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.476797 0.019960 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.497151 0.149199 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.646766 0.197277 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:21.844591 0.211374 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:22.056405 0.168961 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:22.225780 0.161909 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:22.388178 0.115258 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:22.503767 1.515720 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.019857 0.058970 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.079240 0.144551 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.224167 0.061610 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.286151 0.028325 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.314785 0.182294 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.497434 0.176790 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.674582 0.150729 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:24.825701 0.558331 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:25.384590 0.251177 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:25.636135 0.064165 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:25.700718 0.183802 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:25.884935 0.058302 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:25.943689 0.063721 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:26.007809 0.372347 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/13 07:50:26.380704 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 07:50:42.770157 0.055598 tcp 10.0.2.105 53703 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:50:42.825924 0.073758 tcp 10.0.2.105 53704 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:50:42.900009 0.196821 tcp 10.0.2.105 53705 -> 195.113.214.236 443 SRPA* 0 0 52 42192 flow=From-Botnet-V2-TCP-Established 1970/01/13 07:55:53.178211 3.001099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 07:56:00.184918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:56:08.186226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:56:24.189524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 07:56:56.195008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:03:00.201830 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:03:07.208883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:03:15.210026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:03:31.213452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:04:03.219677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:10:07.225569 3.011131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:10:14.242574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:10:22.244617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:10:38.246887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:11:10.253578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:12:43.127121 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 08:12:43.127219 0.573601 tcp 10.0.2.105 53706 -> 94.137.168.16 9773 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/13 08:17:14.259816 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:17:21.266530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:17:29.268254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:17:45.271053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:18:17.276995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:21:08.063440 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 08:21:08.063690 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 08:21:27.061953 0.056342 tcp 10.0.2.105 53707 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 08:21:27.118600 0.076987 tcp 10.0.2.105 53708 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 08:21:27.195905 0.166133 tcp 10.0.2.105 53709 -> 195.113.214.236 443 SRPA* 0 0 45 37192 flow=From-Botnet-V2-TCP-Established 1970/01/13 08:21:27.362622 0.031148 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:27.394097 0.188689 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:27.583151 0.123647 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:27.707237 0.146802 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:27.854440 0.146604 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.001479 0.168118 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.169958 0.020071 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.190410 0.140504 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.331234 0.180331 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.512080 0.213974 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.726455 0.138063 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:28.864857 0.170276 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:29.035531 0.170857 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:29.206736 0.115607 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:29.322772 1.682045 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.005216 0.083537 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.095554 0.120417 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.216490 0.196932 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.413777 0.175733 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.589870 0.147342 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.737612 0.027975 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.765974 0.083776 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.850174 0.059450 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:31.910031 0.321486 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:32.231941 0.099582 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:32.331907 0.081358 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:32.413696 0.225972 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:32.640055 0.450360 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:21:33.091044 0.375843 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:24:21.283352 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:24:28.290783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:24:36.292013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:24:52.295079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:25:24.301481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:31:28.306889 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:31:35.314501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:31:43.315906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:31:59.318964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:32:31.325174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:38:35.330968 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:38:42.338531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:38:50.339818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:39:06.342813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:39:38.349237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:42:43.706106 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 08:42:43.706199 0.552063 tcp 10.0.2.105 53710 -> 94.137.168.16 9773 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/01/13 08:45:42.354801 3.002125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:45:49.362721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:45:57.364052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:46:13.366899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:46:45.373172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:51:55.910139 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 08:51:55.910331 0.120506 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.031272 0.144707 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.176577 0.143454 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.320533 0.042640 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.363579 0.195101 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.559074 0.166233 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.725694 0.020260 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.746258 0.141766 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:56.888430 0.185546 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.074376 0.221999 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.296755 0.138340 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.435528 0.170528 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.606447 0.176347 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.783184 0.116809 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:57.900424 0.276131 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.176906 0.096183 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.273521 0.116672 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.390534 0.264309 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.655251 0.180015 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.835688 0.147577 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:58.983679 0.029408 udp 10.0.2.105 7010 <-> 79.219.107.122 2430 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.013455 0.093579 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.107374 0.059633 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.167409 0.100454 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.268262 0.226385 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.495052 0.420462 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:51:59.915929 0.196256 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:52:00.112752 0.092676 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:52:00.205887 0.379873 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/13 08:52:49.418535 3.002551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 08:52:56.426485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:53:04.428267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:53:20.431253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:53:52.437346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 08:59:56.443552 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:00:03.450213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:00:11.452376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:00:27.455193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:00:59.461438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:07:03.467511 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:07:10.474177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:07:18.476041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:07:34.479095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:08:06.485275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:12:44.304926 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 09:12:44.305004 0.616884 tcp 10.0.2.105 53711 -> 94.137.168.16 9773 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:14:10.491622 3.001114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:14:17.498665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:14:25.499626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:14:41.503111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:15:13.509213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:21:17.515493 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:21:24.522672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:21:32.523711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:21:48.526611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:22:04.630163 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 09:22:04.630256 0.202793 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:04.833483 0.150371 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:04.984458 0.145197 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.130069 0.031323 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.161791 0.190541 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.352757 0.482351 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.835534 0.020228 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.856177 0.142384 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:05.998924 0.186324 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:06.185648 0.213471 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:06.399531 0.138137 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:06.538078 0.169405 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:06.707877 0.178164 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:06.886479 0.119364 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.006237 0.170913 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.177540 0.092353 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.270310 0.101365 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.372021 0.270303 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.642653 0.178056 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.821105 0.150209 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:07.971655 0.000000 udp 10.0.2.105 7010 -> 79.219.107.122 2430 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 09:22:20.532864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:22:24.690551 0.054355 tcp 10.0.2.105 53712 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:22:24.745217 0.078966 tcp 10.0.2.105 53713 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:22:24.824530 0.160393 tcp 10.0.2.105 53714 -> 195.113.214.236 443 SRPA* 0 0 55 45417 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:22:24.985504 0.118014 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:25.103863 0.065322 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:25.169588 0.412039 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:25.582044 0.187793 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:25.770199 0.086906 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:25.857514 0.224594 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:26.082516 0.111976 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:22:26.194900 0.382515 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:28:24.539366 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:28:31.546075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:28:39.547614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:28:55.551213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:29:27.556815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:35:31.562498 3.002568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:35:38.570127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:35:46.572169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:36:02.574537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:36:34.580729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:42:38.586525 3.001876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:42:44.923996 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 09:42:44.924162 0.601138 tcp 10.0.2.105 53715 -> 94.137.168.16 9773 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:42:45.594301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:42:53.595888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:43:09.598831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:43:41.604538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:49:45.610989 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:49:52.618161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:50:00.620022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:50:16.623051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:50:48.628924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:52:42.422462 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 09:52:42.422562 0.000000 udp 10.0.2.105 7010 -> 79.219.107.122 2430 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 09:52:58.207242 0.062409 tcp 10.0.2.105 53716 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:52:58.269928 0.075951 tcp 10.0.2.105 53717 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:52:58.346183 0.179689 tcp 10.0.2.105 53718 -> 195.113.214.236 443 SRPA* 0 0 61 42604 flow=From-Botnet-V2-TCP-Established 1970/01/13 09:52:58.524730 0.143328 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:58.668450 0.040495 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:58.709345 0.143026 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:58.852837 0.146643 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:58.999922 0.181565 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.181888 0.020428 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.202658 0.144015 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.347012 0.187483 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.534838 0.186227 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.721403 0.170509 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:52:59.892285 0.166768 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.059479 0.115796 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.175641 0.176047 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.352070 0.130985 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.483413 0.211892 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.695652 0.178424 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:00.874539 0.150661 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.025566 0.082597 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.108658 0.103049 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.212048 0.305353 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.517797 0.084510 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.602651 0.066646 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.669694 0.076380 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.746484 0.215245 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:01.962153 0.086111 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:02.048625 0.487873 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:02.536926 0.188578 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:53:02.726512 0.384022 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 09:56:52.635274 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 09:56:59.641900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:57:07.643552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:57:23.646941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 09:57:55.653118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:03:59.658737 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:04:06.666266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:04:14.668027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:04:30.670797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:05:02.676428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:11:06.683138 3.001065 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:11:13.690255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:11:21.691484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:11:37.694556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:12:09.701086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:12:45.533223 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 10:12:45.533452 0.640120 tcp 10.0.2.105 53719 -> 94.137.168.16 9773 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:18:13.707485 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:18:20.714511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:18:28.715969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:18:44.768980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:19:16.774532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:23:05.684183 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 10:23:05.684362 0.120857 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:05.805638 0.142794 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:05.948868 0.165836 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.115102 0.146112 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.261736 0.030355 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.292675 0.020346 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.313403 0.145376 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.459168 0.189304 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.648821 0.189549 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:06.838760 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 10:23:22.620663 0.082664 tcp 10.0.2.105 53720 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:22.703598 0.075209 tcp 10.0.2.105 53721 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:22.779099 0.164380 tcp 10.0.2.105 53722 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:22.943917 0.170339 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:23.114688 0.117149 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:23.232180 0.184271 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:23.416789 0.144795 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:23.562013 0.265359 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:23.827720 0.179337 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.007464 0.152260 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.160133 0.060828 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.221312 0.128325 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.350040 0.218050 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.568645 0.067960 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.636979 0.060550 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:24.697938 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 10:23:43.328542 0.052537 tcp 10.0.2.105 53723 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:43.381364 0.072235 tcp 10.0.2.105 53724 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:43.453882 0.188937 tcp 10.0.2.105 53725 -> 195.113.214.236 443 SRPA* 0 0 37 25700 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:23:43.643406 0.217490 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:43.861231 0.059940 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:43.921552 0.373036 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:44.294946 0.411209 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:23:44.706554 0.233142 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:25:20.780959 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 10:25:27.788546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:25:35.790017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:25:51.792366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:26:23.798910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:32:27.804859 3.002026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:32:34.813033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:32:42.814528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:32:58.816872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:33:30.822690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:39:34.829368 3.001213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:39:41.836624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:39:49.837649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:40:05.840652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:40:37.846801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:42:46.191427 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 10:42:46.191504 0.550830 tcp 10.0.2.105 53726 -> 94.137.168.16 9773 FSPA* 0 0 15 1757 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:46:41.852404 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:46:48.860222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:46:56.861538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:47:12.864328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:47:44.870517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:53:48.876850 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 10:53:55.883797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:53:58.107440 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 10:53:58.107682 0.169345 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:53:58.277359 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 10:54:03.885806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:54:13.912011 0.052859 tcp 10.0.2.105 53727 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:54:13.965077 0.075498 tcp 10.0.2.105 53728 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:54:14.040926 0.172637 tcp 10.0.2.105 53729 -> 195.113.214.236 443 SRPA* 0 0 69 67348 flow=From-Botnet-V2-TCP-Established 1970/01/13 10:54:14.214354 0.181842 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:14.396665 0.144376 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:14.541448 0.169457 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:14.711331 0.142768 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:14.854628 0.189664 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.044675 0.184662 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.229758 0.028511 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.258657 0.145989 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.405044 0.020427 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.425842 0.167977 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.594152 0.138025 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.732600 0.211096 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:15.944036 0.176822 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.121260 0.148472 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.270095 0.115740 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.386197 0.181760 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.568405 0.055143 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.623878 0.069302 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.693543 0.056536 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.750460 0.147508 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:16.898329 0.205471 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:17.104184 0.244276 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:17.348847 0.059341 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:17.408585 0.188695 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:17.597671 0.371622 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:17.969652 0.429217 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/13 10:54:19.888448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 10:54:51.894304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:00:55.901074 3.001495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:01:02.907807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:01:10.910004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:01:26.912602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:01:58.918239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:08:02.924715 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:08:09.932043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:08:17.933426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:08:33.936540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:09:05.942629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:12:46.750268 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 11:12:46.750417 0.624492 tcp 10.0.2.105 53730 -> 94.137.168.16 9773 FSPA* 0 0 15 1586 flow=From-Botnet-V2-TCP-Established 1970/01/13 11:15:09.949178 3.000766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:15:16.955721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:15:24.957464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:15:40.960736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:16:12.966263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:22:16.973027 3.000932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:22:23.979698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:22:31.981077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:22:47.984240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:23:19.990182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:24:24.433353 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 11:24:24.433431 0.168805 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:24.602674 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 11:24:42.621514 0.053418 tcp 10.0.2.105 53731 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 11:24:42.675214 0.077830 tcp 10.0.2.105 53732 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 11:24:42.753355 0.176844 tcp 10.0.2.105 53733 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/13 11:24:42.930749 0.140370 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.071457 0.190996 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.262831 0.120853 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.384052 0.148805 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.533279 0.188029 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.721710 0.055028 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.777163 0.143584 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.921185 0.020429 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:43.941925 0.164017 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.106331 0.137800 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.244503 0.212072 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.456963 0.180597 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.637957 0.147732 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.786080 0.115446 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:44.901953 0.177245 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.079585 0.056362 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.136556 0.061711 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.198664 0.055955 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.255013 0.101635 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.357049 0.432074 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.789531 0.188984 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:45.978924 0.381850 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:46.361149 0.243860 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:46.605402 0.066349 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:24:46.672148 0.398937 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:29:23.997053 3.001409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:29:31.003680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:29:39.005427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:29:55.008049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:30:27.014092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:36:31.020688 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:36:38.027518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:36:46.029180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:37:02.032689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:37:34.038234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:42:47.379528 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 11:42:47.379609 0.598498 tcp 10.0.2.105 53734 -> 94.137.168.16 9773 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/13 11:43:38.045357 3.001107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:43:45.051961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:43:53.053005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:44:09.055991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:44:41.062201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:50:45.068516 3.021423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:50:52.095569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:51:00.097205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:51:16.099996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:51:48.106032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:55:05.050263 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 11:55:05.050357 0.337992 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:05.388705 0.169285 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:05.558394 0.139265 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:05.697992 0.192092 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:05.890502 0.120235 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.011192 0.146672 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.158223 0.190409 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.349061 0.029365 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.378742 0.142235 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.521398 0.020363 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.542116 0.158523 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.701053 0.137756 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:06.839185 0.224566 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.064128 0.180511 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.245038 0.188509 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.433964 0.116551 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.550857 0.186461 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.737714 0.055634 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.793722 0.061009 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:07.855067 0.244274 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:08.099744 0.183978 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:08.284380 0.055872 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:08.340652 0.262370 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:08.603449 0.055570 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:08.659406 0.375989 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:09.035762 0.493645 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:55:09.529876 0.223587 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/13 11:57:52.113235 3.001092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 11:57:59.119541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:58:07.121697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:58:23.124012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 11:58:55.130212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:04:59.136640 3.001503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:05:06.143386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:05:14.145617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:05:30.148486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:06:02.154193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:12:06.160719 3.001165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:12:13.167776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:12:21.169486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:12:37.172045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:12:47.978453 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 12:12:47.978550 0.574858 tcp 10.0.2.105 53735 -> 94.137.168.16 9773 FSPA* 0 0 12 1408 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:13:09.177935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:19:13.184677 3.011453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:19:20.201379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:19:28.203001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:19:44.206046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:20:16.212260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:25:28.511677 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 12:25:28.511780 0.139934 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:28.652078 0.188420 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:28.840859 0.121169 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:28.962478 0.145335 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:29.108259 0.470372 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:29.578993 0.272599 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:29.852006 0.186524 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.038936 0.038919 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.078249 0.142136 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.220742 0.020432 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.241585 0.162181 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.404287 0.131176 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.535805 0.260756 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.796976 0.178169 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:30.975543 0.152974 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.128907 0.116970 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.246290 0.184660 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.431332 0.057095 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.488846 0.059476 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.548714 0.208014 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.757094 0.134497 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:31.891990 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 12:25:49.463179 0.051941 tcp 10.0.2.105 53736 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:25:49.515423 0.074235 tcp 10.0.2.105 53737 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:25:49.590011 0.142478 tcp 10.0.2.105 53738 -> 195.113.214.236 443 SRPA* 0 0 56 37993 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:25:49.731017 0.375886 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:50.107248 0.193116 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:50.300758 0.054847 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:50.356019 0.398106 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:25:50.754534 0.214841 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:26:20.348753 3.001184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:26:27.356141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:26:35.357646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:26:51.360472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:27:23.366192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:33:27.372878 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:33:34.379849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:33:42.381393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:33:58.384597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:34:30.390386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:40:34.396972 3.001093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:40:41.404106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:40:49.405510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:41:05.408442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:41:37.413964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:42:48.687700 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 12:42:48.687800 0.584757 tcp 10.0.2.105 53739 -> 94.137.168.16 9773 FSPA* 0 0 15 1627 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:47:41.420775 3.021275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:47:48.447785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:47:56.449178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:48:12.452149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:48:44.458108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:54:48.464991 3.000759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 12:54:55.471807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:55:03.473041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:55:19.476234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:55:51.482283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 12:56:15.477241 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 12:56:15.477337 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 12:56:31.181679 0.051923 tcp 10.0.2.105 53740 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:56:31.233910 0.074422 tcp 10.0.2.105 53741 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:56:31.308274 0.161427 tcp 10.0.2.105 53742 -> 195.113.214.236 443 SRPA* 0 0 35 17018 flow=From-Botnet-V2-TCP-Established 1970/01/13 12:56:31.469870 0.120291 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:31.590553 0.145644 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:31.736621 0.139406 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:31.876556 0.191363 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.068498 0.168695 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.237617 0.178279 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.416388 0.026774 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.443591 0.167517 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.611454 0.020371 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.632160 0.144219 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:32.776801 0.225650 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:33.002845 0.177102 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:33.180431 0.485097 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:33.665941 0.114958 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:33.781301 0.145361 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:33.927063 0.155061 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.082565 0.242355 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.325317 0.101680 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.427374 0.185231 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.613005 0.055030 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.668450 0.058896 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:34.727726 0.388297 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:35.116607 0.187514 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:35.304558 0.411501 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:35.716606 0.054718 udp 10.0.2.105 7010 <-> 176.73.211.244 9385 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/13 12:56:35.771645 0.369403 udp 10.0.2.105 7010 <-> 165.228.197.8 3533 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:01:55.488587 3.001682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:02:02.495588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:02:10.496853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:02:26.500484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:02:58.506120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:09:02.512688 3.001031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:09:09.519714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:09:17.520911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:09:33.523900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:10:05.529955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:12:49.276101 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:12:49.276368 0.602312 tcp 10.0.2.105 53743 -> 94.137.168.16 9773 FSPA* 0 0 15 1624 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:16:09.536475 3.001123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:16:16.543481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:16:24.545277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:16:40.547784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:17:12.553851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:23:16.559683 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:23:23.567538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:23:31.569115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:23:47.571887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:24:19.578161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:26:36.836233 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:26:36.836343 0.136380 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:36.973166 0.188569 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.162145 0.168962 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.331557 0.122188 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.454165 0.145101 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.599765 0.191008 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.791191 0.031709 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.823312 0.173213 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:37.996909 0.020325 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.017640 0.140691 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.158663 0.231392 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.390458 0.178269 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.569072 0.150268 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.719734 0.115016 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.835177 0.144670 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:38.980492 0.161399 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:39.142245 0.213171 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:39.355749 0.178927 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:39.535093 0.182067 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:39.717496 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:26:55.764055 0.053772 tcp 10.0.2.105 53744 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:26:55.818175 0.076131 tcp 10.0.2.105 53745 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:26:55.894579 0.164956 tcp 10.0.2.105 53746 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:26:56.059006 0.142406 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:56.201850 0.400997 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:56.603267 0.189120 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:26:56.792776 0.000000 udp 10.0.2.105 7010 -> 165.228.197.8 3533 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:27:12.377716 0.052066 tcp 10.0.2.105 53747 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:27:12.430081 0.075100 tcp 10.0.2.105 53748 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:27:12.505501 0.160726 tcp 10.0.2.105 53749 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:27:12.666727 0.463683 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:27:13.130807 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:27:29.221244 0.051648 tcp 10.0.2.105 53750 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:27:29.273168 0.076203 tcp 10.0.2.105 53751 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:27:29.349699 0.154296 tcp 10.0.2.105 53752 -> 195.113.214.236 443 SRPA* 0 0 26 14274 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:30:23.583664 3.002226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 13:30:30.591720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:30:38.592764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:30:54.595830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:31:26.601762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:37:30.608966 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:37:37.615802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:37:45.617138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:38:01.619854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:38:33.625737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:42:49.884674 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:42:49.884778 0.625924 tcp 10.0.2.105 53753 -> 94.137.168.16 9773 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:44:37.632090 3.001682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:44:44.639485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:44:52.640718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:45:08.644033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:45:40.650107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:51:44.655987 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 13:51:51.663755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:51:59.665124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:52:15.668095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:52:47.674145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:57:41.987202 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:57:41.987298 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:57:57.801861 0.051138 tcp 10.0.2.105 53754 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:57:57.853321 0.069930 tcp 10.0.2.105 53755 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:57:57.923655 0.151965 tcp 10.0.2.105 53756 -> 195.113.214.236 443 SRPA* 0 0 24 13862 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:57:58.076254 0.000000 udp 10.0.2.105 7010 -> 176.73.211.244 9385 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:13.462832 0.050747 tcp 10.0.2.105 53757 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:13.513928 0.074107 tcp 10.0.2.105 53758 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:13.588565 0.158403 tcp 10.0.2.105 53759 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:13.747465 0.000000 udp 10.0.2.105 7010 -> 165.228.197.8 3533 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:30.347407 0.052242 tcp 10.0.2.105 53760 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:30.400017 0.076100 tcp 10.0.2.105 53761 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:30.475932 0.155761 tcp 10.0.2.105 53762 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 13:58:30.631931 4.664137 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 4 1222 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:30.820185 4.095962 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 4 1229 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:30.958818 4.120298 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1158 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.127663 3.981016 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 4 1241 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.284525 4.240429 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 4 1098 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.477902 4.068149 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1121 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.498747 4.194989 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 1211 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.642772 4.171954 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1116 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.763771 4.241631 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1094 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:31.952758 4.196311 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 4 1148 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:32.093794 4.193738 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1257 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:32.232112 4.215061 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 4 1174 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:32.389383 4.173115 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 4 1241 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:32.503605 4.388777 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:32.760581 4.796329 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1147 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.081285 4.678538 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 4 1073 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.294453 0.187228 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.482051 4.476954 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 4 994 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.659035 4.408943 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 4 1220 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.760662 4.421984 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 4 1313 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:33.905202 4.654254 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1161 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:34.273549 4.883477 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 3 593 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:34.458111 4.698392 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1141 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:38.559972 0.295738 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:39.339231 0.000000 udp 10.0.2.105 7010 <- 74.196.220.117 9202 RSP 0 0 1 538 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:39.339782 0.000000 udp 10.0.2.105 7010 -> 216.153.41.210 5832 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:44.506864 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:51.036868 0.000000 udp 10.0.2.105 7010 -> 151.84.129.47 1184 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:51.680793 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 13:58:55.762851 0.000243 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:58:57.796539 0.041340 udp 10.0.2.105 7010 <-> 84.186.90.229 7869 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:58:57.851064 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:58:58.687077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:59:04.836530 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 5814 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:06.688864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:59:11.736711 0.397434 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/13 13:59:12.163674 0.000000 udp 10.0.2.105 7010 -> 88.252.56.245 1024 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:17.244138 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:21.770274 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:59:22.691801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 13:59:23.593117 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:29.241544 0.000000 udp 10.0.2.105 7010 -> 77.9.177.31 5572 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:35.560847 0.000000 udp 10.0.2.105 7010 -> 99.245.231.207 6308 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:41.489092 0.000000 udp 10.0.2.105 7010 -> 82.11.180.115 5238 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:46.265863 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 13:59:46.556085 0.000000 udp 10.0.2.105 7010 -> 94.64.236.182 6376 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:52.835748 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 13:59:54.697770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:00:01.157682 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:08.107595 0.060447 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:08.168042 0.000000 icmp 94.34.155.180 0x0303 -> 10.0.2.105 0xb523 URP 192 1 281 flow=Background 1970/01/13 14:00:12.763750 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:00:14.106075 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:21.947142 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:27.144460 0.000000 udp 10.0.2.105 7010 -> 93.193.151.154 7662 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:32.982877 0.000000 udp 10.0.2.105 7010 -> 84.2.73.116 9845 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:37.769842 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:00:41.124750 0.000000 udp 10.0.2.105 7010 -> 77.98.20.126 4182 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:48.064667 0.000000 udp 10.0.2.105 7010 -> 83.242.29.125 6165 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:00:53.622576 0.000000 udp 10.0.2.105 7010 -> 58.95.240.190 1782 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:00.722960 0.081552 udp 10.0.2.105 7010 -> 78.176.147.33 5188 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:00.804512 0.000000 icmp 78.176.147.33 0x0303 -> 10.0.2.105 0x4414 URP 192 1 322 flow=Background 1970/01/13 14:01:05.269577 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:01:08.233884 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:15.233530 0.000000 udp 10.0.2.105 7010 -> 207.195.96.194 2397 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:22.754397 0.000000 udp 10.0.2.105 7010 -> 65.60.120.98 5915 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:30.926709 0.126568 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:31.053277 0.000000 icmp 5.82.63.25 0x0303 -> 10.0.2.105 0x000f URP 192 1 302 flow=Background 1970/01/13 14:01:35.763078 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:01:38.327362 0.000000 udp 10.0.2.105 7010 -> 98.103.149.162 4255 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:43.404077 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:49.132706 0.000000 udp 10.0.2.105 7010 -> 213.235.233.130 3523 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:01:56.673331 0.000000 udp 10.0.2.105 7010 -> 68.169.150.254 9247 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:01.270062 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:02:02.461457 0.000000 udp 10.0.2.105 7010 -> 83.137.249.156 4763 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:10.112897 0.000000 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:15.681072 0.000000 udp 10.0.2.105 7010 -> 82.52.38.173 1571 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:24.012649 0.000000 udp 10.0.2.105 7010 -> 84.92.215.184 9630 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:28.769635 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:02:30.391655 0.041466 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:02:30.448723 0.000000 udp 10.0.2.105 7010 -> 182.71.164.209 1407 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:36.290436 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:41.688100 0.000000 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:49.329210 0.000000 udp 10.0.2.105 7010 -> 95.242.198.35 4766 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:02:54.265866 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:02:54.807606 0.000000 udp 10.0.2.105 7010 -> 75.61.199.93 5772 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:01.106359 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:06.814015 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:12.031811 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:20.734179 0.000000 udp 10.0.2.105 7010 -> 181.225.60.111 3344 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:25.270836 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:03:28.595474 0.000000 udp 10.0.2.105 7010 -> 96.255.210.204 1803 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:36.667016 0.000000 udp 10.0.2.105 7010 -> 62.94.76.113 9474 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:41.764577 0.000000 udp 10.0.2.105 7010 -> 5.245.198.30 9413 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:47.672904 0.169172 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:03:47.853620 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:03:52.269129 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:03:55.154162 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:00.211301 0.000000 udp 10.0.2.105 7010 -> 95.246.241.68 2391 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:06.880613 0.000000 udp 10.0.2.105 7010 -> 67.60.93.78 5816 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:13.500400 0.000000 udp 10.0.2.105 7010 -> 151.66.167.58 2093 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:18.266734 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:04:20.620543 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 1976 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:26.669496 0.000000 udp 10.0.2.105 7010 -> 2.101.52.62 3973 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:32.156721 0.000000 udp 10.0.2.105 7010 -> 69.24.120.254 5574 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:38.285919 0.000000 udp 10.0.2.105 7010 -> 67.78.102.174 8522 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:43.262996 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:04:43.813982 0.000000 udp 10.0.2.105 7010 -> 74.15.100.239 6970 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:52.596626 0.414933 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:04:53.022593 0.000000 udp 10.0.2.105 7010 -> 108.197.238.146 3835 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:04:58.955871 0.000000 udp 10.0.2.105 7010 -> 99.113.240.19 6714 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:06.436768 0.345903 udp 10.0.2.105 7010 -> 114.41.21.193 9209 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:06.782671 0.000000 icmp 114.41.21.193 0x0303 -> 10.0.2.105 0xf923 URP 192 1 210 flow=Background 1970/01/13 14:05:11.263212 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:05:13.946782 0.000000 udp 10.0.2.105 7010 -> 78.176.70.91 1033 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:19.215042 0.319318 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:05:19.544540 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 7455 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:25.383956 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:32.353937 0.189826 udp 10.0.2.105 7010 <-> 108.208.166.46 9252 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:05:32.599201 0.166893 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:05:32.844289 0.000000 udp 10.0.2.105 7010 -> 24.3.217.147 4823 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:37.270088 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:05:40.184637 0.000000 udp 10.0.2.105 7010 -> 96.40.246.26 7006 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:46.523936 0.000000 udp 10.0.2.105 7010 -> 217.36.221.248 2005 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:52.121878 0.000000 udp 10.0.2.105 7010 -> 88.254.205.219 1044 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:57.780267 0.248848 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:05:58.041964 0.000000 udp 10.0.2.105 7010 -> 99.181.143.172 2350 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:05:58.703701 3.001572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 14:06:02.767279 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:06:05.081295 0.000000 udp 10.0.2.105 7010 -> 83.30.98.53 3892 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:05.711056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:06:13.071906 0.000000 udp 10.0.2.105 7010 -> 110.153.18.234 2140 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:13.712687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:06:18.729971 0.218099 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:06:18.982186 0.000000 udp 10.0.2.105 7010 -> 81.151.218.111 5495 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:26.301542 0.393741 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:06:26.737054 0.000000 udp 10.0.2.105 7010 -> 87.3.24.230 8493 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:29.716351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:06:31.267848 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:06:33.000638 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:41.913396 0.034124 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:06:42.065711 0.527865 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:06:42.617884 0.000000 udp 10.0.2.105 7010 -> 78.163.183.29 1073 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:49.925058 0.000000 udp 10.0.2.105 7010 -> 85.106.208.134 6138 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:06:55.723693 0.000000 udp 10.0.2.105 7010 -> 151.65.161.116 7099 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:07:00.269633 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:07:01.722055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:12:50.513512 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:12:50.513598 2.994322 tcp 10.0.2.105 53763 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 14:12:59.506365 0.000000 tcp 10.0.2.105 53763 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/13 14:13:05.517224 1.115704 tcp 10.0.2.105 53764 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:13:06.584772 2.996003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:13:06.633265 0.073273 tcp 10.0.2.105 53765 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:13:06.706630 0.151184 tcp 10.0.2.105 53766 -> 195.113.214.236 443 SRPA* 0 0 21 10744 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:13:06.907090 0.930447 tcp 10.0.2.105 53767 -> 128.255.183.224 9027 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:13:13.586810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:13:21.588269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:13:37.591310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:14:09.597446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:20:13.603557 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:20:20.610264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:20:28.611863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:20:44.615241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:21:16.621138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:27:32.634775 3.001328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:27:39.642165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:27:47.643145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:28:03.646088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:28:35.652457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:34:55.662173 3.000645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:35:02.669029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:35:10.670256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:35:26.672990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:35:58.689326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:37:21.819476 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:37:21.819580 0.029726 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:21.849706 0.192110 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.042222 0.141697 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.184316 0.169303 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.354016 0.180975 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.535408 0.020190 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.555959 0.145475 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.701846 0.121745 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:22.823954 0.190431 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.014810 0.138448 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.153696 0.137713 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.291764 0.117103 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.409233 0.227000 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.636647 0.158413 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.795479 0.060949 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:23.856796 0.148174 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.005373 0.175878 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.181637 0.176523 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.358580 0.149212 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.508354 0.224291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.733053 0.245123 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:24.978543 0.371243 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:25.350201 0.252623 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:25.603181 0.000000 udp 10.0.2.105 7010 -> 84.186.90.229 7869 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:37:44.433256 0.052063 tcp 10.0.2.105 53768 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:37:44.485636 0.070904 tcp 10.0.2.105 53769 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:37:44.556880 0.158658 tcp 10.0.2.105 53770 -> 195.113.214.236 443 SRPA* 0 0 37 30900 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:37:44.716131 0.385926 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:45.102432 0.039823 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:45.142620 0.353016 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:45.496009 0.350091 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:45.846510 0.271597 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:46.118459 0.166311 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:37:46.285147 0.000000 udp 10.0.2.105 7010 -> 108.208.166.46 9252 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 14:38:05.031458 0.051127 tcp 10.0.2.105 53771 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:38:05.082840 0.074124 tcp 10.0.2.105 53772 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:38:05.157237 0.159708 tcp 10.0.2.105 53773 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:38:05.317526 0.074659 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:38:05.392743 0.217315 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:38:05.610434 0.336284 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:38:05.947094 0.033376 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:38:05.980851 0.224198 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/13 14:42:02.695835 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 14:42:09.702619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:42:17.704145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:42:33.707220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:43:05.713290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:43:07.836526 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 14:43:07.836647 0.933122 tcp 10.0.2.105 53774 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/13 14:49:09.719049 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:49:16.726462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:49:24.728076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:49:40.731857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:50:12.737276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:56:17.745543 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 14:56:24.752369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:56:32.753797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:56:48.756250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 14:57:20.762773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:03:24.769223 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:03:31.776054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:03:39.777676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:03:55.781006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:04:27.786804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:08:30.536377 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 15:08:30.536471 0.000000 udp 10.0.2.105 7010 -> 84.186.90.229 7869 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:08:46.720773 0.054597 tcp 10.0.2.105 53775 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:08:46.775713 0.075518 tcp 10.0.2.105 53776 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:08:46.851531 0.153814 tcp 10.0.2.105 53777 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:08:47.005517 0.000000 udp 10.0.2.105 7010 -> 108.208.166.46 9252 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:09:05.256493 0.051863 tcp 10.0.2.105 53778 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:05.308729 0.074675 tcp 10.0.2.105 53779 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:05.383768 0.155683 tcp 10.0.2.105 53780 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:05.540190 0.167363 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:05.708007 0.167981 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:05.876437 0.020278 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:05.897137 0.140156 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.037642 0.188055 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.226050 0.026682 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.253113 0.142499 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.395969 0.144871 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.541196 0.120443 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.662023 0.213662 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:06.876057 0.147189 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.023632 0.113614 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.137678 0.185388 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.323500 0.176859 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.500775 0.183321 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.684595 0.101886 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:07.786885 0.252188 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:08.039466 0.156383 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:08.196259 0.147931 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:08.344720 0.111055 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:08.466370 0.372618 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:08.839396 0.187051 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:09.026833 0.208706 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:09.235903 0.040894 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:09.277115 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:09:25.995945 0.051229 tcp 10.0.2.105 53781 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:26.047449 0.073254 tcp 10.0.2.105 53782 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:26.121018 0.158446 tcp 10.0.2.105 53783 -> 195.113.214.236 443 SRPA* 0 0 51 42188 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:26.280065 0.205101 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:26.485558 0.167289 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:26.653215 0.206068 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:26.859692 0.409702 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:27.269811 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:09:44.642633 0.052614 tcp 10.0.2.105 53784 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:44.695098 0.074862 tcp 10.0.2.105 53785 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:44.770259 0.156418 tcp 10.0.2.105 53786 -> 195.113.214.236 443 SRPA* 0 0 32 17790 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:09:44.927062 0.189031 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:45.116503 0.467849 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:45.584705 1.074158 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:09:46.659241 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:10:05.262772 0.051781 tcp 10.0.2.105 53787 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:10:05.314795 0.074945 tcp 10.0.2.105 53788 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:10:05.389589 0.160124 tcp 10.0.2.105 53789 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:10:31.794603 2.999329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 15:10:38.799682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:10:46.801636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:11:02.804218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:11:34.810777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:13:08.776399 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 15:13:08.776663 0.904773 tcp 10.0.2.105 53790 -> 128.255.183.224 9027 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:17:38.817213 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:17:45.824004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:17:53.825358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:18:09.828222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:18:41.834900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:24:45.840964 3.001276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:24:52.848210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:25:00.849458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:25:16.852505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:25:48.858358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:31:52.883891 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:31:59.891808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:32:07.893647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:32:23.896880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:32:55.902283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:38:59.909007 3.001430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:39:06.915974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:39:14.917221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:39:30.920329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:40:02.926235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:40:21.303131 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 15:40:21.303374 0.415249 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:21.718988 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:40:36.777055 0.051948 tcp 10.0.2.105 53791 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:36.829257 0.074222 tcp 10.0.2.105 53792 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:36.903845 0.156558 tcp 10.0.2.105 53793 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:37.059453 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 15:40:52.788575 0.051788 tcp 10.0.2.105 53794 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:52.840643 0.070564 tcp 10.0.2.105 53795 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:52.911541 0.155515 tcp 10.0.2.105 53796 -> 195.113.214.236 443 SRPA* 0 0 22 11400 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:40:53.067590 0.192750 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:53.260733 0.027482 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:53.288691 0.138255 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:53.427341 0.020138 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:53.447808 0.486305 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:53.934499 0.168991 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.103892 0.144283 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.248598 0.113927 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.362977 0.152942 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.516344 0.122012 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.638702 0.144795 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:54.783892 0.269517 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.053752 0.225544 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.279692 0.177502 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.457585 0.180606 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.638593 0.178909 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.817902 0.100738 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:55.918970 0.159527 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:56.078884 0.266427 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:56.345698 0.149918 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:56.495972 0.067791 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:56.564156 0.184333 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:56.748850 0.458166 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:57.207371 0.042802 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:57.250579 0.144510 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:57.395506 0.240536 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:57.636483 0.166698 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:57.803594 0.394032 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:58.197977 0.261482 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:58.459845 0.244945 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:40:58.705182 0.703066 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 15:43:09.685770 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 15:43:09.685952 0.952369 tcp 10.0.2.105 53797 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/13 15:46:06.933630 3.000308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 15:46:13.939835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:46:21.941210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:46:37.944204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:47:09.951130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:53:13.956924 3.001238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 15:53:20.964143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:53:28.965354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:53:44.968121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 15:54:16.974144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:00:20.980667 3.001733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:00:27.987614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:00:35.989324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:00:51.992063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:01:23.998488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:07:28.004630 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:07:35.011667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:07:43.013321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:07:59.016181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:08:31.021990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:11:18.062565 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 16:11:18.062655 0.381560 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 16:11:18.444215 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 260 flow=Background 1970/01/13 16:11:34.037897 0.052528 tcp 10.0.2.105 53798 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:34.090702 0.073613 tcp 10.0.2.105 53799 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:34.164149 0.158200 tcp 10.0.2.105 53800 -> 195.113.214.236 443 SRPA* 0 0 24 12990 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:34.322871 0.188335 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:34.511573 0.026500 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:34.538453 0.141841 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:34.680698 0.020102 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:34.701160 0.171135 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:34.872702 0.168111 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.041207 0.143998 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.185572 0.121633 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.307530 0.137814 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.445732 0.288284 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.734348 0.115172 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.849982 0.146927 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:35.997264 0.299930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:36.297547 0.177815 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:36.475731 0.197831 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:36.674032 0.185354 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:36.859848 0.102170 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:36.962425 0.156806 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:37.119636 0.060435 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:37.180645 0.185648 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:37.366689 0.390409 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:37.757510 0.040167 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:37.798005 0.232089 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:38.030521 0.164128 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:38.195057 0.142949 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:38.338423 0.272524 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:38.611306 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 16:11:53.834662 0.054011 tcp 10.0.2.105 53801 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:53.888518 0.072353 tcp 10.0.2.105 53802 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:53.961152 0.154107 tcp 10.0.2.105 53803 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:11:54.114237 0.338800 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:54.453431 0.234709 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:11:54.688651 0.000000 udp 10.0.2.105 7010 -> 187.144.195.119 8888 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 16:12:10.658594 0.051678 tcp 10.0.2.105 53804 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:12:10.710579 0.073025 tcp 10.0.2.105 53805 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:12:10.783852 0.153971 tcp 10.0.2.105 53806 -> 195.113.214.236 443 SRPA* 0 0 45 33380 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:12:10.938558 0.655320 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:13:10.644713 0.946370 tcp 10.0.2.105 53807 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:14:35.028333 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 16:14:42.035831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:14:50.037232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:15:06.040423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:15:38.046165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:21:42.052918 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:21:49.059840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:21:57.061031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:22:13.064198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:22:45.070233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:28:49.076659 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:28:56.083617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:29:04.085511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:29:20.088217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:29:52.094320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:35:56.099803 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:36:03.107842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:36:11.109226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:36:27.112345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:36:59.118552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:42:35.752542 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 16:42:35.752641 0.396338 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:36.149333 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 16:42:52.268286 0.052563 tcp 10.0.2.105 53808 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:42:52.321132 0.068435 tcp 10.0.2.105 53809 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:42:52.389932 0.153837 tcp 10.0.2.105 53810 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:42:52.544273 0.223184 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:52.767883 0.136449 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:52.904727 0.019856 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:52.924918 0.168324 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.093652 0.167738 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.261777 0.145874 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.408075 0.028861 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.437435 0.191986 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.629863 0.152412 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.782657 0.122770 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:53.905768 0.328695 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.234881 0.114808 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.350087 0.130975 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.481444 0.180258 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.662090 0.102098 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.764501 0.155849 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.920658 0.067196 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:54.988393 0.229695 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:55.218439 0.184850 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:55.403697 0.180856 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:55.584948 0.258775 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:55.844102 0.182655 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:56.027161 0.184957 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:56.212654 0.357757 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:56.570811 0.042374 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:42:56.613638 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 16:43:03.124817 3.000872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:43:10.131446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:43:11.593903 0.963089 tcp 10.0.2.105 53811 -> 128.255.183.224 9027 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:43:13.947407 0.052228 tcp 10.0.2.105 53812 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:43:13.999542 0.067606 tcp 10.0.2.105 53813 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:43:14.067477 0.158082 tcp 10.0.2.105 53814 -> 195.113.214.236 443 SRPA* 0 0 48 28686 flow=From-Botnet-V2-TCP-Established 1970/01/13 16:43:14.225903 0.246208 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:43:14.472507 0.370806 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:43:14.843697 0.201344 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:43:15.045401 0.924432 udp 10.0.2.105 7010 <-> 177.216.197.21 7553 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/13 16:43:18.133105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:43:34.136225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:44:06.142114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:50:10.147641 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:50:17.155893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:50:25.156835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:50:41.160039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:51:13.166040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:57:17.172552 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 16:57:24.179735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:57:32.181152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:57:48.184099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 16:58:20.190000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:04:24.195735 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:04:31.203593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:04:39.205169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:04:55.207903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:05:27.214048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:11:31.231073 3.000859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:11:38.237272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:11:46.238627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:12:02.241910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:12:34.247796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:13:12.573801 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 17:13:12.574021 1.100269 tcp 10.0.2.105 53815 -> 128.255.183.224 9027 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:13:36.047296 0.146582 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:36.194302 0.390130 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:36.584798 0.141556 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:36.726755 0.020139 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:36.747287 0.496998 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.244711 0.168552 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.413716 0.226076 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.640159 0.150565 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.791109 0.146671 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.938183 0.033206 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:37.971798 0.240299 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:38.212659 0.126636 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:38.339711 0.190528 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:38.530596 0.187335 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:38.718342 0.136675 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:38.855366 0.159610 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.015328 0.067650 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.083411 0.227541 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.311311 0.137905 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.449635 0.117766 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.567772 0.165453 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.733669 0.186351 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:39.920458 0.185880 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:40.106810 0.180675 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:40.287885 0.206940 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:40.495227 0.040501 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:40.536149 0.381228 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:40.813977 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 17:13:40.917774 0.188928 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:41.107147 0.209928 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:41.317460 0.343578 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:13:41.661443 0.000000 udp 10.0.2.105 7010 -> 177.216.197.21 7553 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 17:14:00.303750 0.030998 tcp 10.0.2.105 53816 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:14:00.335019 0.064926 tcp 10.0.2.105 53817 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:14:00.399854 0.153228 tcp 10.0.2.105 53818 -> 195.113.214.236 443 SRPA* 0 0 45 40984 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:18:38.254815 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 17:18:45.261489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:18:53.262717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:19:09.265713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:19:41.272043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:25:45.277414 3.002448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:25:52.285323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:26:00.286772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:26:16.290048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:26:48.296247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:32:52.302519 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:32:59.309448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:33:07.311189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:33:23.313742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:33:55.319591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:39:59.325876 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:40:06.333570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:40:14.334553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:40:30.338201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:41:02.344026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:43:13.673329 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 17:43:13.673414 1.016455 tcp 10.0.2.105 53819 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:25.077292 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 17:44:25.077392 0.000000 udp 10.0.2.105 7010 -> 177.216.197.21 7553 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 17:44:40.959979 0.057430 tcp 10.0.2.105 53820 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:41.017759 0.062034 tcp 10.0.2.105 53821 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:41.080082 0.154690 tcp 10.0.2.105 53822 -> 195.113.214.236 443 SRPA* 0 0 69 69908 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:41.235376 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 17:44:57.502348 0.052370 tcp 10.0.2.105 53823 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:57.554976 0.063498 tcp 10.0.2.105 53824 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:57.618798 0.157893 tcp 10.0.2.105 53825 -> 195.113.214.236 443 SRPA* 0 0 40 34548 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:44:57.777269 0.020137 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:44:57.797783 0.172444 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:44:57.970616 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 17:45:13.846264 0.030313 tcp 10.0.2.105 53826 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:13.876837 0.063860 tcp 10.0.2.105 53827 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:13.940974 0.154728 tcp 10.0.2.105 53828 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:14.096014 0.140419 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:14.236867 0.233856 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:14.471096 0.180074 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:14.651594 0.146365 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:14.798425 0.169764 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:14.968697 0.269444 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.238591 0.029095 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.268111 0.178437 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.446956 0.102064 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.549407 0.122305 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.672092 0.194183 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.866691 0.060410 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:15.927501 0.157731 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:16.085707 0.116349 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:16.202447 0.224189 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:16.427003 0.192770 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:16.620131 0.189612 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:16.810173 0.216445 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:17.026997 0.144749 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:17.172148 0.055818 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:17.228340 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 17:45:36.038042 0.029779 tcp 10.0.2.105 53829 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:36.068095 0.064051 tcp 10.0.2.105 53830 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:36.132471 0.153862 tcp 10.0.2.105 53831 -> 195.113.214.236 443 SRPA* 0 0 35 19576 flow=From-Botnet-V2-TCP-Established 1970/01/13 17:45:36.285147 0.265794 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:36.551330 0.269283 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:36.820970 0.184399 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:37.005755 0.242521 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:45:37.248675 0.326984 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 17:47:06.351123 3.000605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 17:47:13.356951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:47:21.358946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:47:37.361675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:48:09.367671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:54:13.374647 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 17:54:20.381294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:54:28.382826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:54:44.385671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 17:55:16.391788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:01:20.398170 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:01:27.405065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:01:35.406715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:01:51.409547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:02:23.415973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:08:27.422361 3.000856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:08:34.429004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:08:42.430664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:08:58.433367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:09:30.439699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:13:14.692901 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 18:13:14.693031 1.186601 tcp 10.0.2.105 53832 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:15:34.445526 3.002146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:15:41.453229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:15:45.669504 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 18:15:45.669598 0.382472 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:46.052564 0.394542 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:46.447502 0.360879 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:46.808789 0.169824 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:46.978981 0.020020 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:46.999406 0.141534 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.141380 0.146203 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.287908 0.170460 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.458788 0.145532 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.604702 0.242908 udp 10.0.2.105 7010 <-> 187.144.195.119 8888 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.848024 0.025738 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:47.874124 0.299938 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.174507 0.123782 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.298640 0.188728 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.487697 0.081055 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.569153 0.155568 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.725076 0.114866 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:48.840395 0.177468 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.018274 0.103474 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.122158 0.186941 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.309534 0.224413 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.454788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:15:49.534335 0.222372 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.757124 0.130970 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.888709 0.041355 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:49.930474 0.148665 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:50.081906 0.180608 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:50.263381 0.211426 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:50.475212 0.245240 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:50.720888 0.230764 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:15:50.952030 0.343746 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:16:05.457550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:16:37.463835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:22:41.469429 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:22:48.477043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:22:56.478963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:23:12.481480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:23:44.488584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:29:48.494854 3.000306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:29:55.500981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:30:03.502818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:30:19.505670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:30:51.511669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:36:55.517465 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:37:02.525233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:37:10.526255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:37:26.529297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:37:58.535460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:43:15.882519 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 18:43:15.882743 0.941071 tcp 10.0.2.105 53833 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:44:02.541434 3.001836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:44:09.549245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:44:17.550198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:44:33.553633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:45:05.559957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:46:16.281743 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 18:46:16.281847 0.317034 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:16.599290 0.167468 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:16.767145 0.020399 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:16.787857 0.605886 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:17.394080 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 18:46:33.107595 0.030648 tcp 10.0.2.105 53834 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:33.138575 0.063544 tcp 10.0.2.105 53835 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:33.202408 0.162213 tcp 10.0.2.105 53836 -> 195.113.214.236 443 SRPA* 0 0 28 13772 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:33.365095 0.377394 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:33.742896 0.145187 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:33.888499 0.168623 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:34.057521 0.143520 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:34.201442 0.000000 udp 10.0.2.105 7010 -> 187.144.195.119 8888 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 18:46:51.693137 0.030471 tcp 10.0.2.105 53837 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:51.723593 0.065016 tcp 10.0.2.105 53838 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:51.788905 0.158317 tcp 10.0.2.105 53839 -> 195.113.214.236 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/13 18:46:51.947799 0.027391 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:51.975530 0.402433 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:52.378359 0.121265 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:52.499994 0.187807 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:52.688158 0.059917 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:52.748502 0.154082 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:52.903000 0.115314 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.018664 0.174662 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.193792 0.112178 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.306356 0.243964 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.550748 0.187855 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.738946 0.221630 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:53.960971 0.137769 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:54.099086 0.037406 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:54.136872 0.152636 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:54.289916 0.180469 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:54.470828 0.281357 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:54.752557 0.293459 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:55.046444 0.186418 udp 10.0.2.105 7010 <-> 190.200.28.145 3980 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:46:55.233277 0.306005 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/13 18:51:09.566387 3.000496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 18:51:16.572748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:51:24.574640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:51:40.577389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:52:12.583648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:58:16.590444 3.001095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 18:58:23.597053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:58:31.598481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:58:47.601671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 18:59:19.607461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:05:23.613899 3.000917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:05:30.620829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:05:38.622471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:05:54.625252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:06:26.631808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:12:30.636991 3.002499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:12:37.644941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:12:45.646102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:13:01.649780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:13:16.831935 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 19:13:16.832011 1.079224 tcp 10.0.2.105 53840 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:13:33.655808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:16:57.829598 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 19:16:57.829697 1.016770 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:16:58.846827 0.000000 udp 10.0.2.105 7010 -> 187.144.195.119 8888 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 19:17:17.027980 0.051520 tcp 10.0.2.105 53841 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:17.079868 0.071612 tcp 10.0.2.105 53842 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:17.151741 0.159688 tcp 10.0.2.105 53843 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:17.312116 0.020637 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:17.333180 0.191690 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:17.525263 0.235646 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:17.761411 0.140897 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:17.902718 0.146368 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:18.049478 0.399099 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:18.448926 0.144917 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:18.594194 0.170012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:18.764659 0.034691 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:18.799679 0.303525 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:19.103549 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 19:17:34.502264 0.030845 tcp 10.0.2.105 53844 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:34.533028 0.070586 tcp 10.0.2.105 53845 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:34.603908 0.158498 tcp 10.0.2.105 53846 -> 195.113.214.236 443 SRPA* 0 0 32 16646 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:34.762916 0.192478 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:34.955749 0.060829 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.016931 0.157325 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.174614 0.117424 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.292486 0.174838 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.467711 0.188740 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.656837 0.213737 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:35.870900 0.144934 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.016417 0.042198 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.059005 0.102619 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.162038 0.186966 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.349428 0.147494 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.497328 0.329578 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:36.827319 0.216570 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:37.044298 0.264136 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:17:37.308792 0.000000 udp 10.0.2.105 7010 -> 190.200.28.145 3980 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 19:17:54.020024 0.051846 tcp 10.0.2.105 53847 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:54.072178 0.073975 tcp 10.0.2.105 53848 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:54.146469 0.158044 tcp 10.0.2.105 53849 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:17:54.305088 0.360223 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:19:37.662181 3.000590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 19:19:44.668799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:19:52.670667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:20:08.673622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:20:40.679150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:26:44.686150 3.000905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:26:51.692794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:26:59.694311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:27:15.697635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:27:47.703459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:33:51.710013 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:33:58.717043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:34:06.718018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:34:22.721711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:34:54.727012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:40:58.733964 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:41:05.741110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:41:13.742079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:41:29.745312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:42:01.751565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:43:17.911641 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 19:43:17.911956 1.077438 tcp 10.0.2.105 53850 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:05.757597 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:48:12.764661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:48:18.463127 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 19:48:18.463227 0.122329 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:18.585965 0.000000 udp 10.0.2.105 7010 -> 190.200.28.145 3980 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 19:48:20.765931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:48:35.059222 0.030734 tcp 10.0.2.105 53851 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:35.090302 0.066846 tcp 10.0.2.105 53852 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:35.157420 0.151667 tcp 10.0.2.105 53853 -> 195.113.214.236 443 SRPA* 0 0 72 51464 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:35.309484 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 19:48:36.769474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:48:51.350684 0.030375 tcp 10.0.2.105 53854 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:51.381328 0.069371 tcp 10.0.2.105 53855 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:51.451020 0.158760 tcp 10.0.2.105 53856 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/13 19:48:51.610246 0.146924 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:51.757583 0.143982 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:51.901913 0.141316 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.043571 0.167220 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.211196 0.020599 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.232166 0.212408 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.444979 0.143388 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.588773 0.364323 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:52.953513 0.170316 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.124177 0.025992 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.150586 0.157079 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.307998 0.058890 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.367288 0.188892 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.556624 0.173480 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.730453 0.185878 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:53.916744 0.216830 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.133924 0.144657 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.278977 0.039072 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.318510 0.102524 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.421430 0.115443 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.537266 0.180762 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.718425 0.147471 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:54.866236 0.190533 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:55.057157 0.192987 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:55.250542 0.203227 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:48:55.454179 0.374932 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/13 19:49:08.775617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:55:12.781936 3.001012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 19:55:19.788790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:55:27.789969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:55:43.793026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 19:56:15.799180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:02:19.806126 3.000858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:02:26.812809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:02:34.814266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:02:50.816953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:03:22.822877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:09:26.829487 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:09:33.836541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:09:41.837760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:09:57.841351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:10:29.846880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:13:18.990849 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 20:13:18.990943 0.935393 tcp 10.0.2.105 53857 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:16:33.853282 3.001179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:16:40.860585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:16:48.862018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:17:04.865323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:17:36.871279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:19:03.656387 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 20:19:03.656492 0.411697 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.068602 0.124591 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.193596 0.146358 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.340369 0.144364 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.485137 0.144286 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.629817 0.166650 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.796872 0.021009 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:04.818251 0.357880 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.176678 0.168104 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.345180 0.028734 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.374283 0.211473 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.586090 0.146266 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.732784 0.157720 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.890856 0.059831 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:05.951101 0.188916 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.140449 0.184011 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.324799 0.182176 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.507360 0.215451 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.723191 0.137909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.861518 0.040688 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:06.902626 0.162419 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.065449 0.113994 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.179840 0.179207 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.359459 0.150545 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.510411 0.186460 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.697233 0.177496 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:07.875122 0.290536 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:19:08.166047 0.343073 udp 10.0.2.105 7010 <-> 41.70.170.83 9193 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:23:40.878239 3.000363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:23:47.884753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:23:55.886481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:24:11.889284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:24:43.895137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:30:47.901876 3.000648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:30:54.908666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:31:02.910117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:31:18.913342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:31:50.918859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:37:54.925128 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:38:01.932194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:38:09.933708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:38:25.937256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:38:57.942866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:43:19.930343 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 20:43:19.930441 0.976432 tcp 10.0.2.105 53858 -> 128.255.183.224 9027 FSPA* 0 0 12 1582 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:45:01.948886 3.001992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:45:08.956398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:45:16.958220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:45:32.960616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:46:04.966882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:49:27.078077 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 20:49:27.078167 0.389235 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 20:49:27.467402 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 157 flow=Background 1970/01/13 20:49:45.145083 0.054052 tcp 10.0.2.105 53859 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:49:45.199428 0.076129 tcp 10.0.2.105 53860 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:49:45.275835 0.156458 tcp 10.0.2.105 53861 -> 195.113.214.236 443 SRPA* 0 0 76 56228 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:49:45.430527 0.123882 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:45.554919 0.142719 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:45.698039 0.320730 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.019117 0.020466 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.039944 0.356467 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.396834 0.148084 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.545390 0.142322 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.688096 0.169386 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.857915 0.028505 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:46.886974 0.212575 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.099959 0.143515 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.243910 0.156857 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.401166 0.061875 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.463470 0.191939 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.655855 0.180558 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:47.836807 0.182399 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.019597 0.217411 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.237406 0.137824 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.375591 0.041202 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.417187 0.100576 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.518145 0.115274 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.633762 0.168011 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.802171 0.175777 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:48.978281 0.264989 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:49.243614 0.196743 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:49.440692 0.151987 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/13 20:49:49.593043 0.000000 udp 10.0.2.105 7010 -> 41.70.170.83 9193 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 20:50:08.408040 0.051567 tcp 10.0.2.105 53862 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:50:08.459957 0.071249 tcp 10.0.2.105 53863 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:50:08.531535 0.154452 tcp 10.0.2.105 53864 -> 195.113.214.236 443 SRPA* 0 0 24 13862 flow=From-Botnet-V2-TCP-Established 1970/01/13 20:52:08.973170 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 20:52:15.980593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:52:23.982193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:52:39.984877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:53:11.990719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:59:15.997147 3.001104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 20:59:23.004255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:59:31.005882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 20:59:47.009107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:00:19.015213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:06:23.021473 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:06:30.028678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:06:38.029677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:06:54.033108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:07:26.038811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:13:20.909948 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 21:13:20.910126 0.964193 tcp 10.0.2.105 53865 -> 128.255.183.224 9027 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/01/13 21:13:30.044553 3.002244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:13:37.052477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:13:45.053655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:14:01.056996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:14:33.062538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:20:24.919299 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 21:20:24.919533 2.368171 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:27.288105 0.000000 udp 10.0.2.105 7010 -> 41.70.170.83 9193 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 21:20:37.068792 3.001369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:20:44.075958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:20:45.790987 0.054765 tcp 10.0.2.105 53866 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 21:20:45.846031 0.074407 tcp 10.0.2.105 53867 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 21:20:45.920791 0.158051 tcp 10.0.2.105 53868 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/13 21:20:46.079248 0.166787 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.246462 0.020599 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.267378 0.120693 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.388477 0.145250 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.534135 0.140609 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.675105 0.142392 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:46.817902 0.363596 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.181912 0.027508 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.209795 0.212925 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.423068 0.148607 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.572097 0.169513 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.741996 0.061012 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.803390 0.154512 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:47.958320 0.179715 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.138498 0.182553 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.321483 0.221945 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.543770 0.188635 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.732778 0.038548 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.771688 0.102108 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.874184 0.116588 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:48.991205 0.165371 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:49.157020 0.178430 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:49.335873 0.238137 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:49.574453 0.138096 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:49.712978 0.345645 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:50.059048 0.156415 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:20:52.077864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:21:08.080946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:21:40.087019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:27:44.093960 3.050532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:27:51.150170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:27:59.152000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:28:15.154686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:28:47.160920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:34:51.166455 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:34:58.174254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:35:06.175448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:35:22.178879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:35:54.184904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:41:58.190336 3.002403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:42:05.198027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:42:13.199468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:42:29.202724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:43:01.208642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:43:21.898944 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 21:43:21.899045 0.962869 tcp 10.0.2.105 53869 -> 128.255.183.224 9027 FSPA* 0 0 15 1756 flow=From-Botnet-V2-TCP-Established 1970/01/13 21:49:05.214803 3.011418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:49:12.232124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:49:20.233662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:49:36.236568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:50:08.243001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:51:07.838410 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 21:51:07.838492 0.411356 udp 10.0.2.105 7010 <-> 116.14.228.106 6769 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.250192 0.186151 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.436709 0.020637 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.457653 0.120688 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.578773 0.142460 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.721566 0.227619 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:08.949627 0.143487 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:09.093552 0.355767 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:09.449733 0.034071 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:09.484181 0.217228 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:09.701794 0.146319 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:09.848544 0.169402 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.018273 0.065785 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.084614 0.159662 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.244677 0.178290 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.423409 0.179577 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.603384 0.229667 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:10.833450 0.188534 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.022317 0.040485 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.063217 0.099197 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.162801 0.117723 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.280918 0.176810 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.458123 0.137878 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.596596 0.274777 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:11.871761 0.151294 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:12.023447 0.180854 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:51:12.204753 0.222259 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/13 21:56:12.248695 3.001848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 21:56:19.256219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:56:27.257491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:56:43.260803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 21:57:15.266815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:03:19.271930 3.002245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:03:26.280019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:03:34.281534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:03:50.284756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:04:22.290688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:10:26.297212 3.000784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:10:33.303828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:10:41.305327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:10:57.308903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:11:29.314729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:13:22.868040 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 22:13:22.868127 1.071973 tcp 10.0.2.105 53870 -> 128.255.183.224 9027 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:17:33.320095 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:17:40.328148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:17:48.329346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:18:04.332660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:18:36.338315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:21:36.348137 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 22:21:36.348319 0.389020 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 22:21:36.737339 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 246 flow=Background 1970/01/13 22:21:53.714599 0.053626 tcp 10.0.2.105 53871 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:21:53.768531 0.076101 tcp 10.0.2.105 53872 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:21:53.844928 0.164991 tcp 10.0.2.105 53873 -> 195.113.214.236 443 SRPA* 0 0 63 41211 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:21:54.010566 0.132660 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.143582 0.143555 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.287537 0.272239 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.560210 0.143826 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.704467 0.167977 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.872872 0.019977 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:54.893226 0.354070 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.247717 0.031485 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.279585 0.213774 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.493742 0.147597 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.641712 0.170111 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.812220 0.071596 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:55.884180 0.156291 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:56.040873 2.881753 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:58.923052 0.187900 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.111361 0.220521 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.332469 0.188086 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.520958 0.042548 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.563892 0.099975 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.664271 0.113820 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.778471 0.197641 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:21:59.976468 0.151186 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:22:00.128214 0.176959 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:22:00.305583 0.168845 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:22:00.474760 0.144914 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:22:00.620029 0.267591 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:24:40.414800 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:24:47.422133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:24:55.423741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:25:11.427052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:25:43.432523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:31:47.438930 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:31:54.445755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:32:02.447803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:32:18.450334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:32:50.456485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:38:54.463440 3.000801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:39:01.469893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:39:09.471672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:39:25.474287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:39:57.480365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:43:23.978156 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 22:43:23.978260 1.023398 tcp 10.0.2.105 53874 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:46:01.486075 3.002546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 22:46:08.494344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:46:16.495673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:46:32.498504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:47:04.504858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:52:30.062665 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 22:52:30.062762 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 22:52:47.279724 0.053256 tcp 10.0.2.105 53875 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:52:47.333226 0.074823 tcp 10.0.2.105 53876 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:52:47.408422 0.176605 tcp 10.0.2.105 53877 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:52:47.585562 0.121743 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:47.707783 0.145766 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:47.854786 0.145092 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.000318 0.143574 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.144273 0.171100 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.315778 0.020101 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.336183 0.349271 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.685826 0.037245 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.723523 0.213387 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:48.937267 0.145750 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:49.083501 0.168674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:49.252714 0.058140 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:49.311247 0.156515 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:52:49.468103 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 22:53:06.736726 0.052777 tcp 10.0.2.105 53878 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:53:06.789856 0.073347 tcp 10.0.2.105 53879 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:53:06.863610 0.170753 tcp 10.0.2.105 53880 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/13 22:53:07.035059 0.185838 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.221303 0.222395 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.444032 0.190932 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.635376 0.045949 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.681664 0.102181 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.784233 0.115027 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:07.899628 0.183261 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:08.083372 0.150859 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:08.234567 0.180282 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:08.415264 0.268373 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:08.511449 3.000643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 22:53:08.684048 0.220902 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:08.905349 0.137885 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/13 22:53:15.518158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:53:23.519702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:53:39.522938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 22:54:11.528543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:00:15.534902 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:00:22.542306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:00:30.543420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:00:46.546124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:01:18.552766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:07:22.558569 3.001626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:07:29.566045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:07:37.567229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:07:53.570509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:08:25.576154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:13:25.007721 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 23:13:25.007823 1.114563 tcp 10.0.2.105 53881 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:14:29.582412 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:14:36.590136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:14:44.591762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:15:00.594073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:15:32.600224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:21:36.606142 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:21:43.614100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:21:51.615740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:22:07.618111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:22:39.624369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:23:33.842559 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 23:23:33.842668 0.193068 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.036132 0.212250 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.248801 0.141664 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.390874 0.211741 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.603044 0.121440 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.724830 0.144708 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:34.869957 0.370262 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.240568 0.029655 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.270568 0.211611 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.484978 0.147767 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.633101 0.170335 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.803835 0.063563 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.867836 0.019956 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:35.888134 0.155711 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.044217 0.184183 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.228788 0.218353 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.447524 0.189506 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.637457 0.056347 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.694223 0.110385 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.804933 0.115131 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:36.920423 0.182707 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:37.103571 0.147499 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:37.251484 4.900981 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:42.152867 0.138092 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:42.291377 0.176622 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:23:42.468433 0.226080 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:28:43.631047 3.000650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:28:50.637508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:28:58.639137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:29:14.642007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:29:46.648861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:35:50.654006 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:35:57.661606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:36:05.663285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:36:21.666229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:36:53.672112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:42:57.678416 3.001256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:43:04.685890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:43:12.687132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:43:26.127004 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 23:43:26.127104 1.135778 tcp 10.0.2.105 53882 -> 128.255.183.224 9027 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:43:28.689941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:44:00.696223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:50:04.703348 3.020656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/13 23:50:11.729931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:50:19.731390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:50:35.733945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:51:07.740203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:53:57.133826 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/13 23:53:57.133925 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 23:54:14.000461 0.052599 tcp 10.0.2.105 53883 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:14.053386 0.074571 tcp 10.0.2.105 53884 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:14.128512 0.150442 tcp 10.0.2.105 53885 -> 195.113.214.236 443 SRPA* 0 0 41 25195 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:14.279465 0.240899 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:14.520691 0.121710 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:14.642796 0.146167 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:14.789385 0.336164 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.125917 0.037059 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.163435 0.143521 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.307306 0.239485 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.547167 0.211522 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.759067 0.148737 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:15.908154 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 23:54:32.635380 0.051732 tcp 10.0.2.105 53886 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:32.687453 0.074914 tcp 10.0.2.105 53887 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:32.762241 0.185264 tcp 10.0.2.105 53888 -> 195.113.214.236 443 SRPA* 0 0 41 22676 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:32.948131 0.060740 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.009255 0.020258 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.029945 0.156201 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.186489 0.186094 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.373004 0.214847 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.588316 0.190435 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.779172 0.041390 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:33.820917 0.213560 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:34.034838 0.113710 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:34.148945 0.281263 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:34.430613 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/13 23:54:50.811165 0.051147 tcp 10.0.2.105 53889 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:50.862614 0.069424 tcp 10.0.2.105 53890 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:50.932117 0.166732 tcp 10.0.2.105 53891 -> 195.113.214.236 443 SRPA* 0 0 41 35028 flow=From-Botnet-V2-TCP-Established 1970/01/13 23:54:51.099575 0.167467 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:51.267387 0.138259 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:51.406057 0.176418 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:54:51.582864 0.251204 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/13 23:57:11.746932 3.000858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/13 23:57:18.753607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:57:26.755250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:57:42.758266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/13 23:58:14.764359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:04:18.770152 3.001610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:04:25.777785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:04:33.779175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:04:49.782161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:05:21.788510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:11:25.794741 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:11:32.801910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:11:40.802906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:11:56.806182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:12:28.811876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:13:27.266884 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 00:13:27.266983 1.019464 tcp 10.0.2.105 53892 -> 128.255.183.224 9027 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:18:32.817655 3.002557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:18:39.825419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:18:47.826993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:19:03.830227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:19:35.836479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:25:05.981356 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 00:25:05.981455 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 00:25:23.498229 0.052053 tcp 10.0.2.105 53893 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:25:23.550567 0.074285 tcp 10.0.2.105 53894 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:25:23.625195 0.173863 tcp 10.0.2.105 53895 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:25:23.799646 0.169540 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:23.969591 0.149550 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.119539 0.335912 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.455814 0.027003 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.483295 0.138689 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.622399 0.122240 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.745026 0.213748 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:24.959190 0.141905 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.101490 0.213024 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.314920 0.214418 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.529761 0.147383 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.677511 0.156778 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.834666 0.020200 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.855212 0.058884 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:25.914498 0.191506 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.106401 0.044074 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.151340 0.108455 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.260191 0.117281 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.377850 0.187621 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.565882 0.214431 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:26.780702 0.282118 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:27.063183 0.164990 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:27.228639 0.253060 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:27.482174 0.151966 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:27.634546 0.178764 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:25:39.842731 3.001015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:25:46.849695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:25:54.850930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:26:10.854016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:26:42.860114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:32:46.866839 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:32:53.873309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:33:01.875192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:33:17.877715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:33:49.883962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:39:53.890867 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:40:00.897729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:40:08.899130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:40:24.902087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:40:56.908114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:43:28.286237 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 00:43:28.286335 0.939780 tcp 10.0.2.105 53896 -> 128.255.183.224 9027 FSPA* 0 0 14 1742 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:47:00.914022 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:47:07.921660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:47:15.923078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:47:31.936670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:48:03.941879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:54:07.958644 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 00:54:14.965614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:54:22.967169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:54:38.969789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:55:10.975910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 00:55:52.055232 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 00:55:52.055455 0.168327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:52.224246 0.147897 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:52.372670 0.334753 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:52.707802 0.027948 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:52.736218 0.145214 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:52.881850 0.120684 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.002894 0.144912 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.232058 0.147848 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.380396 0.213922 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.594666 0.166505 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.761566 0.143798 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:53.905756 0.160544 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:54.066689 0.020292 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:54.087285 0.068008 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:54.155680 0.188079 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:54.344191 0.038824 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:55:54.383492 0.000000 udp 10.0.2.105 7010 -> 2.115.81.251 9540 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 00:56:11.565198 0.058037 tcp 10.0.2.105 53897 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:56:11.623659 0.067887 tcp 10.0.2.105 53898 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:56:11.691866 0.179998 tcp 10.0.2.105 53899 -> 195.113.214.236 443 SRPA* 0 0 46 40394 flow=From-Botnet-V2-TCP-Established 1970/01/14 00:56:11.872655 0.222083 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.095211 0.228183 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.323872 0.170999 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.324317 2.994446 tcp 10.0.2.105 53900 -> 107.197.113.244 1197 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 00:56:12.495263 0.115315 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.610978 0.177020 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.788446 0.182533 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:12.971348 0.299218 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:13.270930 0.131180 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 00:56:21.317131 0.000000 tcp 10.0.2.105 53900 -> 107.197.113.244 1197 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 01:01:14.982741 3.001216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:01:21.989829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:01:29.991092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:01:45.993955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:02:18.000355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:08:22.006346 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:08:29.013377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:08:37.014880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:08:53.018145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:09:25.023688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:13:29.235566 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:13:29.235666 1.010089 tcp 10.0.2.105 53901 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:15:29.030398 3.000851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:15:36.037546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:15:44.038540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:16:00.041883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:16:32.047595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:22:36.053796 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:22:43.061693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:22:51.062761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:23:07.065672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:23:39.071557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:26:31.419867 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:26:31.419955 0.339005 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:31.764978 0.168136 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:31.765411 3.215718 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 SPA_* 0 0 6 519 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:26:31.933524 0.142904 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:32.076823 0.121813 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:32.199062 0.145307 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:32.344734 0.153797 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:32.498935 0.342681 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:32.841976 1.516307 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:34.358656 0.211522 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:34.570558 0.198875 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:34.769744 0.145935 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:34.916017 0.159232 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.075634 0.020004 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.096001 0.061693 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.158086 0.146505 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.305026 0.041478 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.346900 0.189043 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.536459 0.268880 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:35.805693 0.278653 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.084741 0.163324 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.248488 0.115407 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.364455 0.178770 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.543563 0.181638 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.725523 0.215337 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:36.941250 0.131216 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:26:55.581966 3.377425 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 24 16732 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:00.759625 4.700685 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 33 18518 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:06.466569 4.942869 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 9 6250 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:11.607670 3.931040 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 26 17568 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:17.873536 0.393566 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:19.368187 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:27:26.106365 4.957865 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 34 25784 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:31.265413 0.444902 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 15 12878 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:38.249524 4.920488 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 29 20990 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:43.890555 2.216286 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:27:50.874108 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:28:15.967650 0.000097 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:29:43.078543 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 01:29:50.085169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:29:58.086574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:30:14.089625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:30:15.972638 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:30:15.972733 0.000000 tcp 10.0.2.105 53902 -> 2.115.81.251 9689 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:30:46.096124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:36:50.102343 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:36:57.109194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:37:05.110854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:37:21.113815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:37:53.120041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:43:30.244746 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:43:30.244827 1.032976 tcp 10.0.2.105 53903 -> 128.255.183.224 9027 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:43:57.125775 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:44:04.133009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:44:12.134847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:44:28.137661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:45:00.143680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:51:04.150468 3.000641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 01:51:11.156983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:51:19.158953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:51:35.161631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:52:07.167828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:56:57.725736 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:56:57.725890 0.143066 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:56:57.869334 0.121128 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:56:57.990848 0.000000 udp 10.0.2.105 7010 -> 2.115.81.251 9540 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 01:57:14.821520 0.052624 tcp 10.0.2.105 53904 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:14.874456 0.070584 tcp 10.0.2.105 53905 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:14.945336 0.159998 tcp 10.0.2.105 53906 -> 195.113.214.236 443 SRPA* 0 0 61 39055 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:15.105604 0.173237 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:15.279237 0.334155 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:15.613773 0.146142 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:15.760432 3.372188 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:19.133106 2.062718 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:19.133520 4.299073 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 SPA_* 0 0 10 2905 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:21.196439 0.213285 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.410117 0.168373 udp 10.0.2.105 7010 <-> 69.37.3.191 2275 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.578871 0.148050 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.727377 0.153917 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.881672 0.020011 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.901992 0.078457 udp 10.0.2.105 7010 <-> 2.228.29.94 7043 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:21.980808 0.147038 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.128212 0.210262 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.338865 0.241968 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.581252 0.163515 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.745163 0.042614 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.788107 0.188488 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:22.976983 0.000000 udp 10.0.2.105 7010 -> 5.82.165.99 9694 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 01:57:27.256570 3.924186 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 15 7446 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:39.396433 4.375630 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 14 11952 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:40.377274 0.051979 tcp 10.0.2.105 53908 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:40.429578 0.069989 tcp 10.0.2.105 53909 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:40.499909 0.169282 tcp 10.0.2.105 53910 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:57:40.669732 0.186815 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:40.856962 0.178133 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:41.035459 0.229579 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:41.265421 0.138208 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/14 01:57:51.112582 0.200154 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 708 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:58:11.174229 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 01:58:11.566374 4.221384 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 15 11050 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:58:16.368715 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:58:18.180804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:58:19.502039 4.427080 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 14 10396 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:58:26.182892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:58:31.490023 0.401118 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 2864 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:58:40.777886 4.442908 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6932 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:58:42.186033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:58:45.870870 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:58:54.659820 4.359695 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:07.933863 4.245177 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:12.870112 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:59:14.191373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 01:59:16.059760 4.290944 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8696 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:23.597756 0.408262 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:36.303541 4.236088 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:44.143748 4.417617 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 9088 flow=From-Botnet-V2-TCP-Established 1970/01/14 01:59:44.876015 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 01:59:52.508135 4.515175 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7992 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:05.941387 3.820475 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:10.872802 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:00:13.435720 0.401703 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:21.732569 0.396807 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 5674 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:30.679230 3.998343 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:35.869112 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:00:43.452454 4.124097 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:50.917093 4.490095 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:00:59.155095 4.294220 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 16 12160 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:07.545111 0.400419 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:16.503949 4.319705 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:21.374171 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:01:24.770814 0.198955 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 356 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:42.636685 4.305225 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6344 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:47.371798 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:01:50.632759 0.194391 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:01:59.070646 0.399237 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:07.788580 4.329141 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:12.868472 0.000252 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:02:16.186628 4.573402 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:29.242925 4.425430 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:37.452497 3.863853 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 13 7942 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:38.375236 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:02:45.400070 0.406082 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:02:53.844269 0.193999 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 4522 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:03:16.570128 0.200189 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 708 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:03:21.367198 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:03:25.557938 4.311689 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 7180 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:03:33.920004 4.752016 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:03:45.814210 4.374578 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 6 3676 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:03:50.869633 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:03:58.919980 4.177092 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:04:06.717725 0.405437 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:04:15.745869 4.556088 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:04:20.872918 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:04:28.811739 4.329060 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:04:37.091421 4.481055 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:04:46.369185 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:04:49.973504 0.401756 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:01.941248 0.200995 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 1164 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:10.956026 0.209458 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 3558 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:15.871451 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:05:18.198555 3.000475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 02:05:19.783324 4.400321 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:25.204901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:05:28.133229 4.462238 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:33.206540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:05:36.263202 4.484136 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 8 4592 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:49.027974 0.402070 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 5922 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:05:49.209645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:05:57.519082 4.268630 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:06:06.374147 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:06:18.975002 4.493821 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:06:21.215425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:06:31.420669 0.400116 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:06:36.367620 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:06:39.988838 4.120144 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:06:47.970685 4.490116 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:00.868603 4.310801 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 6838 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:05.870030 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:07:08.976295 0.208590 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 1966 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:17.176544 0.199653 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 1060 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:25.804518 4.510596 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:30.875401 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:07:34.076169 4.650724 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:46.804008 4.210639 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 14 11596 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:07:54.928000 0.202596 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:03.236198 0.206129 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:11.651962 0.202792 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 5 4262 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:16.370808 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:08:29.792546 3.993746 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:37.801743 4.386209 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:42.869504 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:08:45.749730 0.403907 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 5882 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:08:54.159628 4.242288 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8240 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:09:02.125659 4.738249 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 9088 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:09:06.873887 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:09:15.939693 4.493459 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:09:28.315334 4.275329 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8344 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:09:33.371643 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:09:41.131459 4.397697 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:09:54.061393 4.406748 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:02.335283 4.364282 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:10.229267 4.080035 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 16 12160 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:22.287020 4.471829 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:27.369168 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:10:34.385075 3.850352 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 13 11542 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:41.534810 4.551944 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 15 11050 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:50.113828 0.399044 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 7 5922 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:10:54.869207 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:11:03.122843 4.194320 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 10 7284 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:11:11.428655 4.460654 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:11:19.900761 0.467731 tcp 10.0.2.105 53907 -> 71.10.54.162 3760 FPA_* 0 0 9 2154 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:12:25.222136 3.001062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 02:12:32.229162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:12:40.230851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:12:56.233356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:13:28.239482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:13:31.284658 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:13:31.284752 1.113057 tcp 10.0.2.105 53911 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:19:32.246358 3.030824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 02:19:39.282940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:19:47.285019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:20:03.287643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:20:35.293295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:26:39.299673 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 02:26:46.307218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:26:54.308850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:27:10.311573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:27:42.317782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:27:53.153666 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:27:53.153765 0.167282 udp 10.0.2.105 7010 <-> 2.115.81.251 9540 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:27:53.321412 0.000000 udp 10.0.2.105 7010 -> 5.82.165.99 9694 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:28:11.481534 0.055455 tcp 10.0.2.105 53912 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:11.537295 0.072769 tcp 10.0.2.105 53913 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:11.610377 0.170728 tcp 10.0.2.105 53914 -> 195.113.214.236 443 SRPA* 0 0 40 32804 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:11.781612 0.143535 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:11.925569 0.137735 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:12.063735 0.170199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:12.234326 0.346307 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:12.581088 0.144119 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:12.725665 3.851214 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:16.577295 0.031504 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:16.609128 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:28:34.663830 0.051598 tcp 10.0.2.105 53915 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:34.715686 0.074222 tcp 10.0.2.105 53916 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:34.790263 0.183373 tcp 10.0.2.105 53917 -> 195.113.214.236 443 SRPA* 0 0 35 19576 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:34.972943 0.148691 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:35.122095 0.155676 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:35.278177 0.020127 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:35.298686 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:28:51.377451 0.051445 tcp 10.0.2.105 53918 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:51.429190 0.074840 tcp 10.0.2.105 53919 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:51.504361 0.179971 tcp 10.0.2.105 53920 -> 195.113.214.236 443 SRPA* 0 0 45 37170 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:28:51.685027 0.144995 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:51.830434 0.213949 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.044778 0.212273 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.257481 0.165996 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.423895 0.046802 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.471102 0.191749 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.663332 0.229206 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:52.892885 0.273341 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:53.166604 0.176919 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:53.344612 0.178120 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:53.523156 0.138095 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:28:53.675520 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 REQ 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:01.552022 0.000000 udp 10.0.2.105 7010 -> 2.228.29.94 7043 REQ 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:09.883519 0.000000 udp 10.0.2.105 7010 -> 2.115.81.251 9540 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:16.673260 0.170345 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:16.844177 0.120832 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:16.965521 0.145506 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:17.111525 0.372509 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:17.484563 0.462252 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:17.947359 0.029379 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:17.977168 4.860115 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:21.370042 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:29:22.837704 0.020706 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:22.858908 0.158735 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.018171 0.152526 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.171214 0.146383 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.318126 0.215578 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.534181 0.392551 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.927256 0.045105 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:23.972846 0.195868 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:24.169223 0.235239 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:24.404960 0.302066 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:24.707579 0.169797 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:24.877804 0.184453 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:25.062735 0.138212 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:25.201368 0.186022 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:25.387960 0.000000 udp 10.0.2.105 7010 -> 59.97.24.58 6537 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:31.113899 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:36.782351 0.196227 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:29:36.990221 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:41.989475 0.238134 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:42.227609 0.000000 icmp 105.229.5.245 0x0303 -> 10.0.2.105 0xc121 URP 192 1 136 flow=Background 1970/01/14 02:29:46.866526 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:29:49.270047 0.000000 udp 10.0.2.105 7010 -> 2.50.19.29 7480 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:29:55.749788 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:00.917252 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:08.818440 0.782682 udp 10.0.2.105 7010 <-> 182.237.155.82 7441 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:30:09.610876 0.000000 udp 10.0.2.105 7010 -> 78.177.99.36 9899 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:13.374580 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:30:15.017331 0.000000 udp 10.0.2.105 7010 -> 175.141.173.159 5104 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:20.594973 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:28.766871 0.000000 udp 10.0.2.105 7010 -> 88.46.115.139 2638 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:34.826194 0.205516 udp 10.0.2.105 7010 -> 117.207.0.193 3059 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:35.031710 0.000000 icmp 117.207.0.193 0x0303 -> 10.0.2.105 0xf30b URP 192 1 212 flow=Background 1970/01/14 02:30:39.372162 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:30:43.197657 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:50.178324 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 8328 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:30:59.121112 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:03.868389 0.000000 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:31:04.218339 0.404820 udp 10.0.2.105 7010 <-> 121.7.20.101 2622 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:31:04.635406 0.000000 udp 10.0.2.105 7010 -> 202.85.200.91 1078 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:10.216826 0.000000 udp 10.0.2.105 7010 -> 78.185.58.1 7209 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:15.684290 0.000000 udp 10.0.2.105 7010 -> 62.103.214.8 4029 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:22.654880 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:29.193901 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:33.870262 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:31:35.443099 0.000000 udp 10.0.2.105 7010 -> 79.22.245.73 2391 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:44.195477 0.000000 udp 10.0.2.105 7010 -> 203.88.142.180 5347 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:31:52.818079 0.000000 udp 10.0.2.105 7010 -> 193.158.234.34 1636 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:00.098755 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:04.875267 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:32:06.127302 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:14.288612 0.000000 udp 10.0.2.105 7010 -> 122.163.9.175 1024 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:19.586132 0.000000 udp 10.0.2.105 7010 -> 108.247.20.223 6976 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:24.603899 0.000000 udp 10.0.2.105 7010 -> 79.6.133.119 3391 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:29.370389 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:32:30.261837 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:35.749485 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:43.050153 0.000000 udp 10.0.2.105 7010 -> 2.38.66.111 1026 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:51.452116 0.000000 udp 10.0.2.105 7010 -> 208.23.77.130 7690 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:32:56.369453 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:32:59.744246 0.000000 udp 10.0.2.105 7010 -> 85.97.40.157 3188 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:05.102267 0.000000 udp 10.0.2.105 7010 -> 182.71.206.98 8103 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:12.322012 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 9454 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:20.634086 0.000000 udp 10.0.2.105 7010 -> 68.169.150.254 9247 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:25.370421 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:33:25.772594 0.000000 udp 10.0.2.105 7010 -> 162.201.82.115 1211 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:31.449972 0.000000 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:39.261052 0.000000 udp 10.0.2.105 7010 -> 69.70.28.75 4611 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:45.209810 0.000000 udp 10.0.2.105 7010 -> 39.116.248.206 8801 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:46.324736 3.000665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 02:33:49.875968 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:33:51.058280 0.000000 udp 10.0.2.105 7010 -> 79.32.231.134 5785 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:33:53.331331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:33:58.519009 0.000000 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:01.332254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:34:03.766187 0.000000 udp 10.0.2.105 7010 -> 39.226.146.114 6282 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:10.676477 0.000000 udp 10.0.2.105 7010 -> 96.232.10.173 6778 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:15.372442 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:34:17.335807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:34:17.866376 0.000000 udp 10.0.2.105 7010 -> 95.242.198.35 4766 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:24.956581 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:31.185545 0.000000 udp 10.0.2.105 7010 -> 190.79.5.199 2942 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:36.734058 0.000000 udp 10.0.2.105 7010 -> 196.211.70.124 2316 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:41.370011 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:34:45.206091 0.000000 udp 10.0.2.105 7010 -> 96.255.210.204 1803 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:34:49.341649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:34:54.098758 0.000000 udp 10.0.2.105 7010 -> 122.129.84.67 6337 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:00.367734 0.498305 udp 10.0.2.105 7010 -> 117.242.196.146 5028 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:00.866039 0.000000 icmp 117.242.196.146 0x0303 -> 10.0.2.105 0xa413 URP 192 1 195 flow=Background 1970/01/14 02:35:05.374607 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:35:09.290195 0.000000 udp 10.0.2.105 7010 -> 2.50.166.40 5454 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:16.671013 0.372234 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:35:17.051966 0.000000 udp 10.0.2.105 7010 -> 31.146.62.35 6313 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:23.791273 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:30.571300 0.039721 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:35:30.629493 0.000000 udp 10.0.2.105 7010 -> 122.172.30.224 8055 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:35.367579 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:35:36.058929 0.000000 udp 10.0.2.105 7010 -> 86.4.127.47 8116 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:43.790263 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:49.358156 0.000000 udp 10.0.2.105 7010 -> 95.137.229.73 7340 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:35:58.140329 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:02.867180 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:36:06.022001 0.060654 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:36:06.105291 0.000000 udp 10.0.2.105 7010 -> 62.226.73.82 7319 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:14.824486 0.000000 udp 10.0.2.105 7010 -> 99.18.119.118 1871 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:22.145039 0.000000 udp 10.0.2.105 7010 -> 81.149.168.114 1376 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:26.871544 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:36:30.206501 0.053776 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:36:30.284498 0.000000 udp 10.0.2.105 7010 -> 95.253.49.84 4852 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:38.067911 0.466509 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:36:38.548784 0.000000 udp 10.0.2.105 7010 -> 92.198.65.172 6016 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:46.369705 0.070500 udp 10.0.2.105 7010 -> 78.15.130.230 9697 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:36:46.440205 0.000000 icmp 78.15.130.230 0x0303 -> 10.0.2.105 0xe125 URP 192 1 231 flow=Background 1970/01/14 02:36:51.366914 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:36:55.012835 0.000000 udp 10.0.2.105 7010 -> 59.92.244.61 3701 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:03.253975 0.168492 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:37:03.433380 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:09.213054 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:18.135347 0.000000 udp 10.0.2.105 7010 -> 82.63.130.191 4657 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:22.872491 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:37:23.703588 0.000000 udp 10.0.2.105 7010 -> 92.234.187.129 4688 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:32.195945 0.000000 udp 10.0.2.105 7010 -> 2.190.198.98 1102 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:39.075844 0.054711 udp 10.0.2.105 7010 <-> 79.112.227.153 3757 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:37:39.190562 0.000000 udp 10.0.2.105 7010 -> 174.89.111.11 3597 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:45.865432 0.000000 udp 10.0.2.105 7010 -> 109.176.233.143 8353 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:50.372014 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:37:52.955899 0.000000 udp 10.0.2.105 7010 -> 77.242.190.9 6955 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:37:58.203650 0.000000 udp 10.0.2.105 7010 -> 93.34.6.145 1330 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:03.290688 0.000000 udp 10.0.2.105 7010 -> 95.174.19.178 9851 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:11.612646 0.000000 udp 10.0.2.105 7010 -> 108.38.224.158 2814 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:16.369056 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:38:18.101980 0.075363 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:38:18.259049 0.000000 udp 10.0.2.105 7010 -> 50.192.167.73 2329 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:24.871283 0.000000 udp 10.0.2.105 7010 -> 182.73.206.134 1210 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:32.893184 0.000000 udp 10.0.2.105 7010 -> 63.118.20.178 2245 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:38.741835 0.311833 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:38:39.082102 0.000000 udp 10.0.2.105 7010 -> 105.225.143.115 1285 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:43.367674 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:38:46.963405 0.105269 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:38:47.366428 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:38:53.873514 0.524094 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:38:54.436586 0.000000 udp 10.0.2.105 7010 -> 87.23.134.37 7679 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:02.555824 0.000000 udp 10.0.2.105 7010 -> 81.137.224.71 6041 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:07.372696 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:39:09.205023 0.000000 udp 10.0.2.105 7010 -> 77.239.149.134 7709 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:16.506065 0.000000 udp 10.0.2.105 7010 -> 182.73.63.86 5811 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:23.615697 0.092226 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:39:23.825260 0.040151 udp 10.0.2.105 7010 <-> 84.133.76.150 7773 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:39:23.950079 0.000000 udp 10.0.2.105 7010 -> 93.147.209.15 4189 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:32.609560 0.000000 udp 10.0.2.105 7010 -> 79.48.5.215 6835 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:37.375858 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:39:41.542512 0.000000 udp 10.0.2.105 7010 -> 109.45.99.199 9958 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:48.391864 0.000000 udp 10.0.2.105 7010 -> 92.253.1.90 6011 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:54.620379 0.000000 udp 10.0.2.105 7010 -> 79.15.26.11 3690 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:39:59.947998 0.000000 udp 10.0.2.105 7010 -> 184.162.101.108 1830 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:04.874965 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:40:07.558990 0.000000 udp 10.0.2.105 7010 -> 92.231.97.225 8067 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:15.150078 0.200998 udp 10.0.2.105 7010 <-> 58.68.9.242 4181 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/14 02:40:15.366131 0.000000 udp 10.0.2.105 7010 -> 197.169.11.165 1694 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:22.080152 0.000000 udp 10.0.2.105 7010 -> 81.208.123.21 8524 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:30.101565 0.000000 udp 10.0.2.105 7010 -> 85.97.35.172 2031 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:34.868250 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:40:37.011552 0.000000 udp 10.0.2.105 7010 -> 93.213.51.64 6479 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:43.089972 0.000000 udp 10.0.2.105 7010 -> 94.71.171.20 6584 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 02:40:53.347291 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 02:41:00.355130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:41:08.356681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:41:24.359855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:41:56.365845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:43:32.403854 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 02:43:32.404053 1.015362 tcp 10.0.2.105 53921 -> 128.255.183.224 9027 FSPA* 0 0 15 1731 flow=From-Botnet-V2-TCP-Established 1970/01/14 02:48:00.371881 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 02:48:07.378869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:48:15.430534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:48:31.433343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:49:03.439415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:55:07.445914 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 02:55:14.453182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:55:22.454257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:55:38.457337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 02:56:10.463196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:02:14.468974 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:02:21.476833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:02:29.478664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:02:45.481524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:03:17.487378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:09:21.493479 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:09:28.501311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:09:36.502504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:09:52.505674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:10:24.511437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:11:09.747055 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 03:11:09.747172 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:11:28.525747 0.052806 tcp 10.0.2.105 53922 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:28.578849 0.075904 tcp 10.0.2.105 53923 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:28.655092 0.175307 tcp 10.0.2.105 53924 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:28.830871 0.122513 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:28.953755 0.140334 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:29.094540 0.234819 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:29.329765 0.046632 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:29.376735 0.367226 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:29.744405 0.147877 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:29.892676 0.142632 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:30.035735 3.999247 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.035390 0.020384 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.056177 0.153504 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.210075 0.039285 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.249764 0.191851 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.442022 0.211147 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.653592 0.219493 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:34.873512 0.165766 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.039630 0.175967 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.215953 0.138003 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.354288 0.225777 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.580547 0.206116 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.787055 0.179645 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:35.967192 0.174439 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:11:36.142041 0.000000 udp 10.0.2.105 7010 -> 182.237.155.82 7441 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:11:51.797813 0.051018 tcp 10.0.2.105 53925 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:51.849133 0.077251 tcp 10.0.2.105 53926 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:51.926650 0.180024 tcp 10.0.2.105 53927 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:11:52.107219 0.000000 udp 10.0.2.105 7010 -> 121.7.20.101 2622 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:12:09.933933 0.052386 tcp 10.0.2.105 53928 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:09.986594 0.077135 tcp 10.0.2.105 53929 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:10.063552 0.172116 tcp 10.0.2.105 53930 -> 195.113.214.236 443 SRPA* 0 0 41 23438 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:10.235192 0.372148 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:10.607735 0.035748 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:10.643893 0.053618 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:10.697856 0.060414 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:10.758665 0.548582 udp 10.0.2.105 7010 <-> 123.200.15.182 4459 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:11.307668 0.166857 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:11.474929 0.049205 udp 10.0.2.105 7010 <-> 79.112.227.153 3757 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:11.524696 0.065578 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:11.590631 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:12:27.348565 0.052325 tcp 10.0.2.105 53931 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:27.401215 0.074191 tcp 10.0.2.105 53932 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:27.475738 0.169189 tcp 10.0.2.105 53933 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:12:27.643824 0.104527 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:27.748757 0.335630 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:28.084779 0.044848 udp 10.0.2.105 7010 <-> 84.133.76.150 7773 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:28.129989 0.094969 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:12:28.225401 0.223200 udp 10.0.2.105 7010 <-> 58.68.9.242 4181 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:13:33.433323 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 03:13:33.433425 1.125646 tcp 10.0.2.105 53934 -> 128.255.183.224 9027 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:16:28.518241 3.000534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 03:16:35.525029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:16:43.526283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:16:59.529157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:17:31.535573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:23:35.542169 3.001321 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:23:42.549472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:23:50.551149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:24:06.553429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:24:38.559642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:30:42.565893 3.001063 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:30:49.572862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:30:57.574209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:31:13.577680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:31:45.583426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:37:49.589165 3.031740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:37:56.626692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:38:04.628606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:38:20.631671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:38:52.637420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:42:43.339510 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 03:42:43.339619 0.170606 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:42:43.510628 0.000000 udp 10.0.2.105 7010 -> 182.237.155.82 7441 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:43:00.435338 0.053254 tcp 10.0.2.105 53935 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:00.488932 0.073785 tcp 10.0.2.105 53936 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:00.563008 0.165671 tcp 10.0.2.105 53937 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:00.729210 0.000000 udp 10.0.2.105 7010 -> 121.7.20.101 2622 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:43:19.711980 0.051200 tcp 10.0.2.105 53938 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:19.763514 0.073053 tcp 10.0.2.105 53939 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:19.836810 0.192601 tcp 10.0.2.105 53940 -> 195.113.214.236 443 SRPA* 0 0 32 17994 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:20.029540 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:43:34.563100 1.147216 tcp 10.0.2.105 53941 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:35.053947 0.054849 tcp 10.0.2.105 53942 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:35.109073 0.080417 tcp 10.0.2.105 53943 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:35.189853 0.177752 tcp 10.0.2.105 53944 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:43:35.368387 0.120802 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:35.489622 0.142084 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:35.632110 0.143833 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:35.776578 0.145654 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:35.922638 0.147145 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:36.070176 0.427919 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:36.498769 0.034531 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:36.533625 0.039826 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:36.573918 3.733768 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:40.308093 0.157590 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:40.466123 0.020204 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:40.486738 0.179957 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:40.667085 0.166726 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:40.834131 0.288794 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:41.123243 0.211981 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:41.335551 0.189329 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:41.525210 0.247950 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:41.773653 0.144637 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:41.918691 0.181335 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:42.100589 0.254027 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:42.354994 0.171221 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:42.526594 0.053407 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:42.580552 0.060521 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:43:42.641474 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:44:00.720688 0.055357 tcp 10.0.2.105 53945 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:00.776401 0.076840 tcp 10.0.2.105 53946 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:00.853128 0.202094 tcp 10.0.2.105 53947 -> 195.113.214.236 443 SRPA* 0 0 38 24504 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:01.055848 0.351675 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:01.407926 0.035997 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:01.444492 0.000000 udp 10.0.2.105 7010 -> 79.112.227.153 3757 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 03:44:18.586592 0.051599 tcp 10.0.2.105 53948 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:18.638487 0.078355 tcp 10.0.2.105 53949 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:18.717190 0.183127 tcp 10.0.2.105 53950 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/14 03:44:18.900922 0.166364 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.067683 0.075652 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.143748 0.045357 udp 10.0.2.105 7010 <-> 84.133.76.150 7773 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.189557 0.095002 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.284895 0.096698 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.381995 0.355345 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:19.737780 0.222381 udp 10.0.2.105 7010 <-> 58.68.9.242 4181 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 03:44:56.644458 3.000714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 03:45:03.650628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:45:11.652077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:45:27.655365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:45:59.661160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:52:03.667740 3.000970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:52:10.675030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:52:18.676393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:52:34.679367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:53:06.685648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:59:10.691889 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 03:59:17.698902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:59:25.700142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 03:59:41.703003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:00:13.709577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:06:17.715949 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:06:24.722747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:06:32.723863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:06:48.727530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:07:20.733368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:13:24.739476 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:13:31.746603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:13:35.712705 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 04:13:35.712810 0.990891 tcp 10.0.2.105 53951 -> 128.255.183.224 9027 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:13:39.748185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:13:55.751328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:14:27.756860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:14:35.458413 0.000000 udp 10.0.2.105 7010 -> 123.200.15.182 4459 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:14:40.385588 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 04:14:51.893801 0.052534 tcp 10.0.2.105 53952 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:14:51.946703 0.072445 tcp 10.0.2.105 53953 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:14:52.019428 0.179119 tcp 10.0.2.105 53954 -> 195.113.214.236 443 SRPA* 0 0 57 37170 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:14:52.196956 0.000000 udp 10.0.2.105 7010 -> 79.112.227.153 3757 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:15:07.485027 0.115807 tcp 10.0.2.105 53955 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:07.601115 0.078413 tcp 10.0.2.105 53956 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:07.679877 0.180168 tcp 10.0.2.105 53957 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:07.860602 0.161265 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.022289 0.145526 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.168195 0.144858 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.313528 0.147877 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.461794 0.142391 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.604624 0.121216 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.726313 0.033912 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.760643 0.044366 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:08.805350 0.364598 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:09.170369 3.978725 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:13.149516 0.172771 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:13.322697 0.169432 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:13.492766 0.202331 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:13.695467 0.212806 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:13.908688 0.157276 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.066356 0.020125 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.086844 0.189793 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.277049 0.144863 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.422316 0.288828 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.711482 0.178157 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:14.890091 0.174775 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.065299 0.183769 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.249485 0.053381 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.303268 0.055467 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.359131 0.037315 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.396837 0.388222 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.785415 0.078064 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.863887 0.039584 udp 10.0.2.105 7010 <-> 84.133.76.150 7773 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:15.903846 0.100398 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:16.082485 0.149120 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:16.231994 0.000000 udp 10.0.2.105 7010 -> 58.68.9.242 4181 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:15:33.662598 0.052045 tcp 10.0.2.105 53958 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:33.714949 0.076780 tcp 10.0.2.105 53959 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:33.790841 0.176082 tcp 10.0.2.105 53960 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:33.967539 0.102380 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:15:34.070330 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:15:51.718363 0.051221 tcp 10.0.2.105 53961 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:51.769866 0.070798 tcp 10.0.2.105 53962 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:15:51.840980 0.181956 tcp 10.0.2.105 53963 -> 195.113.214.236 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:20:31.762984 3.032149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 04:20:38.800925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:20:46.802521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:21:02.804814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:21:34.810920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:27:38.816453 3.002064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:27:45.824640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:27:53.826310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:28:09.828807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:28:41.834971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:34:45.840473 3.002367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:34:52.848350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:35:00.849760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:35:16.853429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:35:48.859489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:41:52.865851 3.001038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:41:59.872744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:42:07.873917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:42:23.876812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:42:55.883277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:43:36.712775 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 04:43:36.712863 0.980278 tcp 10.0.2.105 53964 -> 128.255.183.224 9027 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:01.310167 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 04:46:01.310325 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:46:17.054320 0.055055 tcp 10.0.2.105 53965 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:17.109610 0.071275 tcp 10.0.2.105 53966 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:17.181210 0.173885 tcp 10.0.2.105 53967 -> 195.113.214.236 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:17.354766 0.000000 udp 10.0.2.105 7010 -> 58.68.9.242 4181 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:46:35.820095 0.052643 tcp 10.0.2.105 53968 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:35.873089 0.073513 tcp 10.0.2.105 53969 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:35.946860 0.167390 tcp 10.0.2.105 53970 -> 195.113.214.236 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:36.114733 0.149059 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.264145 0.152734 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.417230 0.146430 udp 10.0.2.105 7010 <-> 70.54.34.181 3419 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.564019 0.121863 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.686319 0.029004 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.715725 0.040046 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:36.756186 0.359849 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.116454 0.137539 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.254438 0.146970 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.401879 0.173610 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.575887 0.155486 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.731781 0.154500 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.886642 0.020292 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:37.907304 0.217351 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:38.125019 0.170633 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:38.296097 0.243378 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:38.539869 0.188123 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:38.728555 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:46:54.026139 0.052004 tcp 10.0.2.105 53971 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:54.078452 0.076289 tcp 10.0.2.105 53972 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:54.154591 0.181045 tcp 10.0.2.105 53973 -> 195.113.214.236 443 SRPA* 0 0 50 43648 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:46:54.336370 0.182378 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:54.519151 0.053534 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:54.573133 0.144801 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:54.718285 0.179576 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:54.898183 0.462243 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.360847 0.036138 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.397413 0.039598 udp 10.0.2.105 7010 <-> 84.133.76.150 7773 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.437416 0.105801 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.543620 0.154273 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.698308 0.062758 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.761473 0.069093 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:46:55.830986 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 04:47:12.202139 0.055643 tcp 10.0.2.105 53974 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:47:12.258068 0.075124 tcp 10.0.2.105 53975 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:47:12.333693 0.171313 tcp 10.0.2.105 53976 -> 195.113.214.236 443 SRPA* 0 0 24 13318 flow=From-Botnet-V2-TCP-Established 1970/01/14 04:47:12.505564 0.094585 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 04:48:59.889486 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 04:49:06.896742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:49:14.898270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:49:30.901392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:50:02.906931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:56:06.913662 3.000893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 04:56:13.920147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:56:21.922029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:56:37.925123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 04:57:09.931386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:03:13.937629 3.001070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:03:20.944190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:03:28.945977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:03:44.949541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:04:16.954876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:10:20.961599 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:10:27.968166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:10:35.970281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:10:51.972659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:11:23.978670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:13:37.691415 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 05:13:37.691732 1.155759 tcp 10.0.2.105 53977 -> 128.255.183.224 9027 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:17:26.450158 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 05:17:26.450325 2.284489 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:27.985304 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 05:17:28.735252 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:17:34.992032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:17:42.994010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:17:47.211827 0.053938 tcp 10.0.2.105 53978 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:17:47.266101 0.073635 tcp 10.0.2.105 53979 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:17:47.339618 0.187732 tcp 10.0.2.105 53980 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:17:47.527766 0.159757 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:47.687873 0.123085 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:47.811354 0.030833 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:47.842567 0.039071 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:47.881970 0.362773 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:48.245161 0.142738 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:17:48.388442 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:17:58.997336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:18:06.778492 0.053581 tcp 10.0.2.105 53981 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:06.832484 0.075105 tcp 10.0.2.105 53982 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:06.907931 0.203086 tcp 10.0.2.105 53983 -> 195.113.214.236 443 SRPA* 0 0 41 22638 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:07.111188 0.151915 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:07.263722 0.158304 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:07.422428 0.019930 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:07.442730 0.211892 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:07.654936 0.167177 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:07.822505 3.627936 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:11.450809 0.146710 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:11.597966 0.175129 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:11.773472 0.189510 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:11.963394 0.216361 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:12.180156 0.144846 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:12.325400 0.186269 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:12.512049 0.224791 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:12.737489 0.055082 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:12.792997 0.568309 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:13.361742 0.102447 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:13.464584 0.153736 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:13.618748 0.054375 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:13.673507 0.122164 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:13.796089 0.000000 udp 10.0.2.105 7010 -> 84.133.76.150 7773 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:18:31.002858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:18:32.154953 0.052939 tcp 10.0.2.105 53984 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:32.207740 0.076371 tcp 10.0.2.105 53985 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:32.284605 0.178594 tcp 10.0.2.105 53986 -> 195.113.214.236 443 SRPA* 0 0 38 28600 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:18:32.463805 0.037478 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:18:32.501658 0.101178 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:24:35.009249 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:24:42.016412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:24:50.018067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:25:06.021048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:25:38.026756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:31:42.033524 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:31:49.040582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:31:57.042139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:32:13.044817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:32:45.051096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:38:49.057468 3.000702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:38:56.064209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:39:04.065723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:39:20.068851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:39:52.074673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:43:38.851420 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 05:43:38.851518 0.997745 tcp 10.0.2.105 53987 -> 128.255.183.224 9027 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:45:56.081121 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 05:46:03.088363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:46:11.089389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:46:27.092832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:46:59.098469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:48:42.478140 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 05:48:42.478241 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:49:00.775115 0.062527 tcp 10.0.2.105 53988 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:00.837970 0.121723 tcp 10.0.2.105 53989 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:00.959557 0.170947 tcp 10.0.2.105 53990 -> 195.113.214.236 443 SRPA* 0 0 33 19366 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:01.131150 0.000000 udp 10.0.2.105 7010 -> 84.133.76.150 7773 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:49:18.239462 0.082374 tcp 10.0.2.105 53991 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:18.322131 0.088546 tcp 10.0.2.105 53992 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:18.410930 0.179385 tcp 10.0.2.105 53993 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:18.590933 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:49:36.275536 0.053766 tcp 10.0.2.105 53994 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:36.329595 0.076230 tcp 10.0.2.105 53995 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:36.405814 0.178136 tcp 10.0.2.105 53996 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:36.584570 0.046303 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:36.631287 1.199876 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:37.831562 0.313517 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.145501 0.122456 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.268380 0.028034 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.296779 0.141930 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.439148 0.159732 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.599276 0.228758 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.828534 0.170144 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:38.999146 0.020163 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.019682 0.155041 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.175125 0.174164 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.349701 0.193089 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.543199 0.188756 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.732363 0.144693 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:39.877481 0.149517 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:40.027361 0.468771 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:40.496557 0.186498 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:40.683459 0.234912 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:40.918794 0.054451 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:40.973677 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:49:59.528642 0.052217 tcp 10.0.2.105 53997 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:59.581129 0.075929 tcp 10.0.2.105 53998 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:59.657358 0.171202 tcp 10.0.2.105 53999 -> 195.113.214.236 443 SRPA* 0 0 45 36022 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:49:59.829224 0.059145 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:59.888705 0.074159 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:49:59.963253 0.000000 udp 10.0.2.105 7010 -> 95.9.146.51 7616 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 05:50:18.476334 0.051658 tcp 10.0.2.105 54000 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:50:18.527924 0.076522 tcp 10.0.2.105 54001 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:50:18.604753 0.171428 tcp 10.0.2.105 54002 -> 195.113.214.236 443 SRPA* 0 0 35 19576 flow=From-Botnet-V2-TCP-Established 1970/01/14 05:50:18.774656 0.743112 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:50:19.518105 0.035647 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:50:19.554158 0.083839 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 05:53:03.104436 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 05:53:10.111952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:53:18.113871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:53:34.116563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 05:54:06.122769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:00:10.128146 3.002136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:00:17.136123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:00:25.137608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:00:41.141092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:01:13.146503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:07:17.153268 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:07:24.159969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:07:32.161782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:07:48.164967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:08:20.170494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:13:39.850422 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 06:13:39.850508 0.950783 tcp 10.0.2.105 54003 -> 128.255.183.224 9027 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:14:24.176342 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:14:31.184497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:14:39.185853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:14:55.188504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:15:27.194301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:20:19.926326 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 06:20:19.926425 1.593644 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:21.520638 0.149416 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:21.670429 0.000000 udp 10.0.2.105 7010 -> 95.9.146.51 7616 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:20:38.033553 0.052515 tcp 10.0.2.105 54004 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:20:38.086299 0.074545 tcp 10.0.2.105 54005 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:20:38.161135 0.177318 tcp 10.0.2.105 54006 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:20:38.338936 0.054348 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:38.393734 0.120094 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:38.514256 0.028431 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:38.543080 0.957137 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:39.500626 0.144614 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:39.645629 0.020310 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:39.666324 0.149887 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:39.816654 0.216657 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.033721 0.157973 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.192065 0.168701 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.361182 0.143207 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.504793 0.151457 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.656652 0.146866 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.803912 0.170836 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:40.975184 0.203011 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:41.178611 0.188383 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:41.367391 0.183084 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:41.550894 0.450488 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:42.001779 0.288515 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:20:42.290683 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:21:00.023724 0.051451 tcp 10.0.2.105 54007 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:21:00.075420 0.070102 tcp 10.0.2.105 54008 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:21:00.145849 0.181387 tcp 10.0.2.105 54009 -> 195.113.214.236 443 SRPA* 0 0 49 30834 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:21:00.325851 0.078274 udp 10.0.2.105 7010 <-> 84.137.1.138 6108 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:21:00.404550 0.055308 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:21:00.460422 0.101789 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:21:00.562570 0.299825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:21:00.862809 0.036592 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:21:31.201575 3.000800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 06:21:38.208151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:21:46.209411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:22:02.232771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:22:34.238937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:28:38.245107 3.001103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:28:45.251698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:28:53.253865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:29:09.257036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:29:41.262802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:35:45.268698 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:35:52.275913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:36:00.277309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:36:16.280335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:36:48.286464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:42:52.292617 3.001276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:42:59.299800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:43:07.301848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:43:23.304564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:43:40.800593 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 06:43:40.800820 1.118524 tcp 10.0.2.105 54010 -> 128.255.183.224 9027 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:43:55.310272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:49:59.317419 3.000863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 06:50:06.323763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:50:14.335314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:50:30.338186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:51:02.344887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:51:18.317787 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 06:51:18.317896 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:51:35.093698 0.052807 tcp 10.0.2.105 54011 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:35.146780 0.080727 tcp 10.0.2.105 54012 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:35.227811 0.176277 tcp 10.0.2.105 54013 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:35.404868 0.177458 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.582742 0.148797 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.731957 0.040607 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.772950 0.121071 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.894422 0.036676 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.931499 0.020596 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:35.952378 0.168741 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:36.121513 0.147247 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:36.269124 0.400342 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:36.669900 0.157572 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:36.827869 0.213992 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.042202 0.144803 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.187409 0.147945 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.335744 0.175526 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.511632 0.291892 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.803870 0.142380 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:37.946651 0.167311 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:38.114321 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:51:54.008959 0.052725 tcp 10.0.2.105 54014 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:54.061999 0.072588 tcp 10.0.2.105 54015 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:54.134861 0.176567 tcp 10.0.2.105 54016 -> 195.113.214.236 443 SRPA* 0 0 53 35722 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:51:54.312045 0.188477 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:54.500952 0.189166 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:54.690511 0.143401 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:51:54.834275 0.000000 udp 10.0.2.105 7010 -> 84.137.1.138 6108 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:52:11.103666 0.156738 tcp 10.0.2.105 54017 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:52:11.260680 0.066445 tcp 10.0.2.105 54018 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:52:11.327439 0.171793 tcp 10.0.2.105 54019 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:52:11.499929 0.057128 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:52:11.557416 0.098430 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:52:11.656224 0.368993 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/14 06:52:12.025557 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 06:52:31.032814 0.051121 tcp 10.0.2.105 54020 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:52:31.084413 0.075330 tcp 10.0.2.105 54021 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:52:31.159624 0.175031 tcp 10.0.2.105 54022 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/14 06:57:06.350102 3.002374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 06:57:13.357831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:57:21.359626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:57:37.362843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 06:58:09.368146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:04:13.375320 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 07:04:20.381845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:04:28.383144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:04:44.386683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:05:16.392318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:11:20.398345 3.011892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 07:11:27.415773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:11:35.417420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:11:51.420685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:12:23.426178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:13:41.919448 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:13:41.919737 4.014141 tcp 10.0.2.105 54023 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:18:27.433173 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 07:18:34.440090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:18:42.441490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:18:58.444160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:19:30.450222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:22:41.054387 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:22:41.054590 0.243296 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:22:41.313385 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:22:56.679119 0.053371 tcp 10.0.2.105 54024 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:22:56.732783 0.070418 tcp 10.0.2.105 54025 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:22:56.803524 0.173707 tcp 10.0.2.105 54026 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:22:56.977714 0.000000 udp 10.0.2.105 7010 -> 84.137.1.138 6108 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:23:14.933771 0.053834 tcp 10.0.2.105 54027 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:14.987909 0.066831 tcp 10.0.2.105 54028 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:15.055040 0.179610 tcp 10.0.2.105 54029 -> 195.113.214.236 443 SRPA* 0 0 20 9268 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:15.235238 0.028252 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.263865 0.041824 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.306069 0.158819 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.465267 0.145026 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.610709 0.155216 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.766287 0.020595 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.787500 0.121622 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:15.909466 0.187223 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:16.097093 0.144636 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:16.242072 0.151591 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:16.394076 0.214078 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:16.608603 0.440438 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:17.049384 0.146437 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:17.196224 0.180077 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:17.376720 0.445900 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:17.822999 0.189302 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:18.012733 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:23:34.532176 0.087399 tcp 10.0.2.105 54030 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:34.619905 0.074098 tcp 10.0.2.105 54031 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:34.694258 0.176158 tcp 10.0.2.105 54032 -> 195.113.214.236 443 SRPA* 0 0 51 32908 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:23:34.869557 4.801833 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1152 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:35.055012 4.806455 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 4 1069 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:35.254937 4.923236 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1121 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:35.784956 4.162753 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 4 1077 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:35.877937 4.125024 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 4 1194 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:35.932754 4.675563 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1196 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:36.516824 0.166511 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:36.683785 0.250740 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:36.935029 0.030941 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:36.966364 0.055341 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.022225 0.155034 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.177788 0.021139 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.199359 0.148727 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.348822 0.161039 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.510302 0.200241 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.711033 0.144738 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 734 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:37.856389 0.146211 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:38.003002 0.366987 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:38.370430 0.145921 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:38.516843 0.215999 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:38.733343 0.151716 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:38.885455 0.279512 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:39.165483 0.174656 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:39.340700 0.141492 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:40.609070 0.056084 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:23:40.692464 0.000000 udp 10.0.2.105 7010 -> 86.180.55.222 8180 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:23:46.237981 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:23:53.799057 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:23:58.375200 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:24:01.480726 0.000000 udp 10.0.2.105 7010 -> 87.10.78.32 7043 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:09.361875 0.000000 udp 10.0.2.105 7010 -> 82.19.181.120 7823 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:17.863578 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:22.380234 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:24:26.686123 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:33.926883 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:42.468890 0.382504 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:42.851394 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 289 flow=Background 1970/01/14 07:24:47.375641 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:24:47.606650 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:24:54.646916 0.045759 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:24:54.776387 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:00.845422 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:07.164848 0.000000 udp 10.0.2.105 7010 -> 58.108.229.248 5276 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:11.880881 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:25:14.285167 0.000000 udp 10.0.2.105 7010 -> 79.0.114.175 5643 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:20.343737 0.000000 udp 10.0.2.105 7010 -> 12.219.241.105 3421 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:27.844399 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:33.993121 0.000000 udp 10.0.2.105 7010 -> 183.89.82.163 7050 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:34.456844 3.001039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 07:25:38.880120 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:25:41.463534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:25:42.906419 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:49.465448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:25:49.505749 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:25:56.695750 0.000000 udp 10.0.2.105 7010 -> 64.126.31.110 8328 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:04.086439 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:05.478545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:26:08.892879 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:26:12.328383 0.000000 udp 10.0.2.105 7010 -> 79.5.135.81 8840 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:21.120673 0.000000 udp 10.0.2.105 7010 -> 87.151.118.230 1441 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:29.783225 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:34.390020 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:26:37.484042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:26:38.456043 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:44.073834 0.149221 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:26:44.275376 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:26:53.107199 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:00.988874 0.049107 udp 10.0.2.105 7010 -> 78.33.171.33 6928 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:01.037981 0.000000 icmp 78.33.171.33 0x0303 -> 10.0.2.105 0x101b URP 192 1 275 flow=Background 1970/01/14 07:27:05.885154 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:27:07.778118 0.000000 udp 10.0.2.105 7010 -> 151.16.25.133 3658 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:13.456074 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:20.015890 0.000000 udp 10.0.2.105 7010 -> 209.122.160.124 8208 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:26.014315 0.000000 udp 10.0.2.105 7010 -> 87.23.134.37 7679 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:30.890933 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:27:34.366339 0.000000 udp 10.0.2.105 7010 -> 201.151.131.154 7809 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:41.215848 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:47.384895 0.000000 udp 10.0.2.105 7010 -> 98.19.189.76 4925 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:55.226160 0.151050 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:27:55.377210 0.000000 icmp 5.82.63.25 0x0303 -> 10.0.2.105 0x000f URP 192 1 165 flow=Background 1970/01/14 07:27:59.892610 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:28:02.036209 0.000000 udp 10.0.2.105 7010 -> 178.118.209.113 6107 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:07.965046 0.000000 udp 10.0.2.105 7010 -> 2.38.66.111 8775 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:15.095131 0.000000 udp 10.0.2.105 7010 -> 92.234.187.129 4688 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:22.735518 0.000000 udp 10.0.2.105 7010 -> 2.115.81.251 9540 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:27.392148 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:28:30.597178 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:36.425484 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:43.816504 0.000000 udp 10.0.2.105 7010 -> 135.196.47.168 3660 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:49.674963 0.000000 udp 10.0.2.105 7010 -> 90.200.122.182 8793 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:28:54.391157 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:28:55.132632 0.000000 udp 10.0.2.105 7010 -> 50.90.85.129 3482 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:02.052401 0.000000 udp 10.0.2.105 7010 -> 81.107.174.222 8198 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:09.232929 0.000000 udp 10.0.2.105 7010 -> 75.10.246.178 3102 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:15.641817 0.000000 udp 10.0.2.105 7010 -> 87.29.87.164 7975 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:20.388907 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:29:22.612138 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:30.883580 0.000000 udp 10.0.2.105 7010 -> 201.230.167.196 5169 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:36.702588 0.000000 udp 10.0.2.105 7010 -> 91.36.176.193 1289 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:43.431561 0.000000 udp 10.0.2.105 7010 -> 69.70.28.75 4611 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:48.388856 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:29:50.051624 0.000000 udp 10.0.2.105 7010 -> 95.243.90.229 3701 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:29:55.659585 0.000000 udp 10.0.2.105 7010 -> 69.136.43.124 6368 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:01.227380 0.000000 udp 10.0.2.105 7010 -> 151.64.199.195 4148 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:06.284897 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:12.033077 0.034262 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:12.067339 0.000000 icmp 82.115.117.185 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 201 flow=Background 1970/01/14 07:30:16.889500 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:30:19.583976 0.000000 udp 10.0.2.105 7010 -> 78.185.243.251 2204 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:24.981329 0.000000 udp 10.0.2.105 7010 -> 95.242.198.35 4766 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:31.801214 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:40.143589 0.000000 udp 10.0.2.105 7010 -> 186.42.47.172 3041 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:44.889717 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:30:47.594036 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:30:55.745826 0.033251 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:30:55.789311 0.000000 udp 10.0.2.105 7010 -> 187.162.113.149 9977 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:03.777036 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:12.610122 0.000000 udp 10.0.2.105 7010 -> 95.234.113.75 8561 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:17.386653 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:31:21.412924 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:27.712134 0.000000 udp 10.0.2.105 7010 -> 95.229.248.36 6838 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:33.209895 0.000000 udp 10.0.2.105 7010 -> 132.206.132.133 8156 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:41.762141 0.099304 udp 10.0.2.105 7010 <-> 2.40.81.22 4189 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:31:41.871975 0.000000 udp 10.0.2.105 7010 -> 81.99.241.9 7649 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:46.388608 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:31:49.363238 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:31:56.413070 0.143224 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:31:56.565806 0.000000 udp 10.0.2.105 7010 -> 68.96.158.227 8699 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:03.012213 0.192519 udp 10.0.2.105 7010 <-> 108.238.224.142 5831 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:03.217532 0.078583 udp 10.0.2.105 7010 <-> 86.38.111.213 8968 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:03.312255 0.095130 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:03.438351 0.141142 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:03.596772 0.000000 udp 10.0.2.105 7010 -> 81.149.76.60 6645 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:08.750735 0.000000 udp 10.0.2.105 7010 -> 31.195.177.65 9181 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:13.387067 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:32:15.300461 0.046867 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:15.377800 0.155739 udp 10.0.2.105 7010 <-> 76.64.230.69 1475 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:15.551346 0.042044 udp 10.0.2.105 7010 <-> 84.186.90.229 7869 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:15.625958 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:20.707754 0.000000 udp 10.0.2.105 7010 -> 182.71.25.114 5630 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:27.387908 0.000000 udp 10.0.2.105 7010 -> 190.197.2.63 1182 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:32.754973 0.120246 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:32.909194 0.091926 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:33.020977 0.000000 udp 10.0.2.105 7010 -> 63.85.131.9 7646 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:37.391738 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:32:41.337730 0.123670 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:41.490600 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 07:32:41.502810 0.000000 udp 10.0.2.105 7010 -> 176.42.215.40 6672 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:48.237266 0.079769 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:32:48.497790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:32:48.505096 0.000000 udp 10.0.2.105 7010 -> 81.157.88.234 7930 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:54.897347 0.000000 udp 10.0.2.105 7010 -> 94.74.158.152 4120 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:32:56.499605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:33:03.560149 0.000000 udp 10.0.2.105 7010 -> 108.208.166.46 9252 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:08.386015 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:33:09.447996 0.000000 udp 10.0.2.105 7010 -> 74.189.7.236 8642 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:12.502183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:33:16.087631 0.000000 udp 10.0.2.105 7010 -> 94.240.229.175 2312 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:24.419778 0.129412 udp 10.0.2.105 7010 <-> 37.99.80.191 3555 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:33:24.611049 0.000000 udp 10.0.2.105 7010 -> 82.186.159.65 6535 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:32.190821 0.150322 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:32.341143 0.000000 icmp 69.37.3.191 0x0303 -> 10.0.2.105 0xe308 URP 192 1 204 flow=Background 1970/01/14 07:33:36.886964 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:33:39.190848 0.000000 udp 10.0.2.105 7010 -> 86.168.116.151 8444 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:44.508096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:33:44.929423 0.000000 udp 10.0.2.105 7010 -> 2.97.61.67 5110 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:51.869013 0.000000 udp 10.0.2.105 7010 -> 85.39.108.122 2907 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:33:58.769197 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:03.385075 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:34:05.168257 0.000000 udp 10.0.2.105 7010 -> 12.131.105.180 6151 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:13.800408 0.000000 udp 10.0.2.105 7010 -> 82.28.147.243 9181 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:21.061306 0.268544 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:34:21.529842 0.062730 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:34:21.614888 0.000000 udp 10.0.2.105 7010 -> 82.233.39.60 1912 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:29.623036 0.186170 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:34:29.888037 0.000000 udp 10.0.2.105 7010 -> 84.179.31.93 6795 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:34.389649 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:34:36.212938 0.000000 udp 10.0.2.105 7010 -> 72.185.67.66 1116 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:43.673349 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:52.265742 0.000000 udp 10.0.2.105 7010 -> 177.97.153.235 6060 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:34:58.404966 0.000000 udp 10.0.2.105 7010 -> 72.242.16.98 2982 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:03.391857 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:35:06.175606 0.075818 udp 10.0.2.105 7010 <-> 80.117.30.186 7339 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:35:06.267120 0.000000 udp 10.0.2.105 7010 -> 95.253.46.124 5748 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:13.536704 0.000000 udp 10.0.2.105 7010 -> 173.160.94.106 7100 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:22.309176 0.000000 udp 10.0.2.105 7010 -> 50.74.217.114 3243 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:28.838322 0.000000 udp 10.0.2.105 7010 -> 69.141.221.65 3621 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:33.384876 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:35:35.728108 0.000000 udp 10.0.2.105 7010 -> 184.15.10.79 8627 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:35:44.170673 0.297576 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/14 07:35:44.491875 0.000000 udp 10.0.2.105 7010 -> 68.236.156.55 9624 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 07:39:48.514770 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 07:39:55.521731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:40:03.523235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:40:19.526151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:40:51.532564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:43:45.943313 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 07:43:45.943452 1.149594 tcp 10.0.2.105 54033 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/14 07:46:55.538769 3.001261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 07:47:02.545569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:47:10.546929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:47:26.550288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:47:58.556699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:54:02.563460 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 07:54:09.569677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:54:17.571077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:54:33.574528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 07:55:05.579975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:01:09.586843 3.001135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:01:16.593811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:01:24.595271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:01:40.597832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:02:12.603980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:06:03.236329 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 08:06:03.236426 0.026267 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:03.263107 0.056129 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:03.319675 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:06:22.224561 0.056461 tcp 10.0.2.105 54034 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:22.281367 0.092211 tcp 10.0.2.105 54035 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:22.373464 0.186291 tcp 10.0.2.105 54036 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:22.558823 0.021228 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:22.580477 0.167972 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:22.748895 0.231602 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:22.980902 0.216444 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:23.197808 0.148660 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:23.346862 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:06:40.289685 0.052566 tcp 10.0.2.105 54037 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:40.342499 0.070682 tcp 10.0.2.105 54038 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:40.413519 0.171095 tcp 10.0.2.105 54039 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:06:40.585726 0.144696 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:40.730911 0.120334 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:40.851617 0.183335 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:41.035396 0.623337 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:41.659162 0.143047 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:41.802627 0.212235 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:42.015290 0.151523 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:42.167212 0.059963 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:42.227608 1.159631 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:43.387693 0.176235 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:43.564417 0.141803 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:43.706629 0.180732 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:43.887776 0.188249 udp 10.0.2.105 7010 <-> 107.193.222.108 3981 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:44.076468 0.092941 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:44.169754 0.057672 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:06:44.228253 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:06:59.887720 0.113072 tcp 10.0.2.105 54040 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:00.001084 0.071994 tcp 10.0.2.105 54041 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:00.073322 0.178346 tcp 10.0.2.105 54042 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:00.250916 0.045081 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:00.296340 0.142776 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:00.439540 0.034665 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:00.474595 0.091342 udp 10.0.2.105 7010 <-> 2.40.81.22 4189 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:00.566319 0.136003 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:00.702748 0.000000 udp 10.0.2.105 7010 -> 108.238.224.142 5831 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:07:18.054077 0.052264 tcp 10.0.2.105 54043 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:18.106201 0.073314 tcp 10.0.2.105 54044 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:18.179805 0.182123 tcp 10.0.2.105 54045 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:18.362415 0.079807 udp 10.0.2.105 7010 <-> 86.38.111.213 8968 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:18.442566 0.135949 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:18.578881 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:07:34.477405 0.064071 tcp 10.0.2.105 54046 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:34.541352 0.076848 tcp 10.0.2.105 54047 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:34.618007 0.168486 tcp 10.0.2.105 54048 -> 195.113.214.236 443 SRPA* 0 0 24 13432 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:07:34.786978 0.044559 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:34.831941 0.040597 udp 10.0.2.105 7010 <-> 84.186.90.229 7869 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:34.872927 0.152369 udp 10.0.2.105 7010 <-> 76.64.230.69 1475 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.025713 0.094987 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.121087 0.116935 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.238464 0.123058 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.361915 0.201158 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.563462 0.129449 udp 10.0.2.105 7010 <-> 37.99.80.191 3555 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.693346 0.178172 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.871910 0.057985 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:35.930271 0.187021 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:36.117619 0.142950 udp 10.0.2.105 7010 <-> 80.117.30.186 7339 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:07:36.260997 0.290713 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:08:16.610184 3.001906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 08:08:23.617563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:08:31.619041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:08:47.622280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:09:19.628224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:13:47.093444 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 08:13:47.093536 1.058955 tcp 10.0.2.105 54049 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:15:23.634488 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:15:30.641708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:15:38.642771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:15:54.645891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:16:26.652571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:22:30.657985 3.061989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:22:37.725767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:22:45.727312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:23:01.730518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:23:33.736189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:29:37.742395 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:29:44.749933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:29:52.750765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:30:08.754290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:30:40.760306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:36:44.766364 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:36:51.773659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:36:59.775384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:37:15.778351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:37:47.784181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:37:54.414480 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 08:37:54.414709 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:38:09.998445 0.053436 tcp 10.0.2.105 54050 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:10.052257 0.073671 tcp 10.0.2.105 54051 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:10.126184 0.169397 tcp 10.0.2.105 54052 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:10.296067 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:38:28.804014 0.053282 tcp 10.0.2.105 54053 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:28.857651 0.074952 tcp 10.0.2.105 54054 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:28.932915 0.172325 tcp 10.0.2.105 54055 -> 195.113.214.236 443 SRPA* 0 0 42 32020 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:29.106311 0.535126 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:38:29.641836 0.000000 udp 10.0.2.105 7010 -> 108.238.224.142 5831 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:38:45.788542 0.052242 tcp 10.0.2.105 54056 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:45.841142 0.070669 tcp 10.0.2.105 54057 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:45.912164 0.174105 tcp 10.0.2.105 54058 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:38:46.086781 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:39:04.264890 0.051716 tcp 10.0.2.105 54059 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:04.316911 0.074013 tcp 10.0.2.105 54060 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:04.391226 0.173891 tcp 10.0.2.105 54061 -> 195.113.214.236 443 SRPA* 0 0 34 17124 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:04.564181 0.040355 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:04.604933 0.027795 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:04.633065 0.183036 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:04.816618 0.389277 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.206326 0.020584 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.227279 0.165111 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.392870 0.155778 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.549068 0.120130 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.669596 0.208896 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:05.878952 0.138087 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.017408 0.065506 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.083277 0.154374 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.237957 0.329689 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.568012 0.158194 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.726588 0.213329 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:06.940484 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:39:25.685890 0.052744 tcp 10.0.2.105 54062 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:25.738431 0.070642 tcp 10.0.2.105 54063 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:25.809332 0.166169 tcp 10.0.2.105 54064 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:25.974644 0.066526 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.041573 0.060087 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.101991 0.143059 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.245488 0.233957 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.479862 0.182560 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.662809 0.186344 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.849554 0.045182 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:26.895132 0.146954 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.042476 0.091446 udp 10.0.2.105 7010 <-> 2.40.81.22 4189 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.134302 0.035290 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.169966 0.142441 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.312852 0.069104 udp 10.0.2.105 7010 <-> 86.38.111.213 8968 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.382342 0.136893 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.519656 0.044694 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:27.564740 0.000000 udp 10.0.2.105 7010 -> 84.186.90.229 7869 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:39:45.844627 0.051514 tcp 10.0.2.105 54065 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:45.896403 0.074466 tcp 10.0.2.105 54066 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:45.970800 0.174435 tcp 10.0.2.105 54067 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:39:46.145731 0.160255 udp 10.0.2.105 7010 <-> 76.64.230.69 1475 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:46.306347 0.090634 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:46.397347 0.117859 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:39:46.515571 0.000000 udp 10.0.2.105 7010 -> 37.99.80.191 3555 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 08:40:04.280846 0.051543 tcp 10.0.2.105 54068 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:40:04.332700 0.075128 tcp 10.0.2.105 54069 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:40:04.408124 0.175154 tcp 10.0.2.105 54070 -> 195.113.214.236 443 SRPA* 0 0 35 18596 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:40:04.583653 0.175196 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:04.759197 0.064711 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:04.824322 0.184786 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:05.009450 0.183439 udp 10.0.2.105 7010 <-> 80.117.30.186 7339 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:05.193215 0.122446 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:05.316070 0.128892 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:40:05.445325 0.288820 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 08:43:48.172848 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 08:43:48.172946 1.026881 tcp 10.0.2.105 54071 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/14 08:43:51.790184 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 08:43:58.797613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:44:06.799234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:44:22.802216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:44:54.808593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:50:58.814609 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:51:05.821466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:51:13.822965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:51:29.826099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:52:01.831774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:58:05.838608 3.000932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 08:58:12.845725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:58:20.847096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:58:36.850196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 08:59:08.856075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:05:12.861443 3.002377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:05:19.869738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:05:27.871201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:05:43.874275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:06:15.880132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:10:17.457644 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 09:10:17.457843 0.000000 udp 10.0.2.105 7010 -> 107.193.222.108 3981 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:10:35.375516 0.053176 tcp 10.0.2.105 54072 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:35.429029 0.076767 tcp 10.0.2.105 54073 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:35.506102 0.184742 tcp 10.0.2.105 54074 -> 195.113.214.236 443 SRPA* 0 0 51 33312 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:35.689213 0.000000 udp 10.0.2.105 7010 -> 84.186.90.229 7869 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:10:53.790134 0.053745 tcp 10.0.2.105 54075 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:53.844145 0.070808 tcp 10.0.2.105 54076 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:53.915233 0.174453 tcp 10.0.2.105 54077 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:10:54.090503 0.000000 udp 10.0.2.105 7010 -> 37.99.80.191 3555 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:11:11.676029 0.052767 tcp 10.0.2.105 54078 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:11.729056 0.073479 tcp 10.0.2.105 54079 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:11.802894 0.167852 tcp 10.0.2.105 54080 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:11.971396 0.533052 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.504855 0.146830 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.652110 0.020601 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.673055 0.046917 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.720369 0.191343 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.912081 0.037875 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:12.950309 0.212089 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.162791 0.144952 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.308140 0.121123 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.429640 0.146366 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.576518 0.170099 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.746953 0.068713 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.816076 0.154237 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:13.970659 0.151935 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:14.122993 0.406746 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:14.530119 0.208192 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:14.738702 0.142290 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:14.881401 0.071542 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:14.953366 0.115462 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:15.069225 0.579820 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:15.649458 0.086311 udp 10.0.2.105 7010 <-> 2.40.81.22 4189 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:15.736150 0.033562 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:15.770092 0.142438 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:15.912967 0.172888 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.086257 0.149821 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.236482 0.186920 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.423798 0.044693 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.468849 0.135050 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.604419 0.073889 udp 10.0.2.105 7010 <-> 86.38.111.213 8968 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.678654 0.045568 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.724617 0.152877 udp 10.0.2.105 7010 <-> 76.64.230.69 1475 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:16.877899 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:11:35.119739 0.053044 tcp 10.0.2.105 54081 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:35.173080 0.075454 tcp 10.0.2.105 54082 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:35.248818 0.178485 tcp 10.0.2.105 54083 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:35.427959 0.118070 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:35.546442 0.200229 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:35.747065 0.059711 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:35.807149 0.183706 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:35.991210 0.000000 udp 10.0.2.105 7010 -> 80.117.30.186 7339 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:11:54.657912 0.053882 tcp 10.0.2.105 54084 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:54.712060 0.074655 tcp 10.0.2.105 54085 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:54.787036 0.179326 tcp 10.0.2.105 54086 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:11:54.966993 0.122775 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:55.090205 0.076399 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:11:55.166955 0.296572 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:12:19.887423 3.000379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 09:12:26.893430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:12:34.895186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:12:50.898145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:13:22.903951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:13:49.202271 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 09:13:49.202367 1.072394 tcp 10.0.2.105 54087 -> 128.255.183.224 9027 FSPA* 0 0 12 1589 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:19:26.929885 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:19:33.937626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:19:41.939245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:19:57.941903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:20:29.947710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:26:33.954330 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:26:40.961487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:26:48.962754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:27:04.966134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:27:36.971850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:33:40.978057 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:33:47.985437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:33:55.986489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:34:11.990140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:34:43.995734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:40:48.002385 3.000780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:40:55.009534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:41:03.010987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:41:19.013713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:41:51.020056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:42:08.996204 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 09:42:08.996327 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:42:25.001019 0.057886 tcp 10.0.2.105 54088 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:25.059286 0.070669 tcp 10.0.2.105 54089 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:25.130192 0.177420 tcp 10.0.2.105 54090 -> 195.113.214.236 443 SRPA* 0 0 48 29926 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:25.307535 0.000000 udp 10.0.2.105 7010 -> 80.117.30.186 7339 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:42:43.846679 0.053482 tcp 10.0.2.105 54091 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:43.900668 0.072228 tcp 10.0.2.105 54092 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:43.972925 0.175018 tcp 10.0.2.105 54093 -> 195.113.214.236 443 SRPA* 0 0 21 10744 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:42:44.148493 0.028428 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:42:44.177299 0.148399 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:42:44.326105 0.046304 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:42:44.372812 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:43:00.801174 0.052104 tcp 10.0.2.105 54094 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:00.853622 0.076028 tcp 10.0.2.105 54095 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:00.930002 0.173336 tcp 10.0.2.105 54096 -> 195.113.214.236 443 SRPA* 0 0 35 19576 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:01.103875 0.137780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:01.242008 0.227144 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:01.469510 0.020244 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:01.490107 0.319166 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:01.809659 0.064954 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:01.874971 0.156839 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.032353 0.147443 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.180197 0.122615 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.303159 0.157295 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.460898 0.165959 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.627232 0.143656 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.771268 0.061568 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:02.833260 0.213585 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.057109 0.324673 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.382178 0.097165 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.479742 0.175298 udp 10.0.2.105 7010 <-> 75.53.126.156 2469 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.655446 0.139488 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.795344 0.151348 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.947088 0.033000 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:03.980513 0.000000 udp 10.0.2.105 7010 -> 2.40.81.22 4189 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:43:18.997272 0.052274 tcp 10.0.2.105 54097 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:19.049400 0.071949 tcp 10.0.2.105 54098 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:19.121204 0.174397 tcp 10.0.2.105 54099 -> 195.113.214.236 443 SRPA* 0 0 47 40462 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:19.296296 0.142677 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:19.439344 0.134151 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:19.573833 0.000000 udp 10.0.2.105 7010 -> 86.38.111.213 8968 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:43:35.150272 0.051665 tcp 10.0.2.105 54100 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:35.202220 0.070835 tcp 10.0.2.105 54101 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:35.273361 0.167517 tcp 10.0.2.105 54102 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:35.441485 0.046305 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:35.488346 0.163612 udp 10.0.2.105 7010 <-> 76.64.230.69 1475 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:35.652391 0.045139 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:35.697919 0.186882 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:35.885233 0.187148 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:36.072783 0.115501 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:36.188694 0.219051 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:36.408164 0.064258 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:36.472844 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 09:43:50.281913 1.053119 tcp 10.0.2.105 54103 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:52.985887 0.051637 tcp 10.0.2.105 54104 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:53.037803 0.072224 tcp 10.0.2.105 54105 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:53.110387 0.173347 tcp 10.0.2.105 54106 -> 195.113.214.236 443 SRPA* 0 0 50 31744 flow=From-Botnet-V2-TCP-Established 1970/01/14 09:43:53.284503 0.075691 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:43:53.360619 0.297170 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/14 09:47:55.025854 3.001835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 09:48:02.033202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:48:10.034792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:48:26.038016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:48:58.043684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:55:02.050657 3.000791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 09:55:09.057089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:55:17.058477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:55:33.061646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 09:56:05.067883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:02:09.073708 3.001458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:02:16.081474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:02:24.082570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:02:40.086011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:03:12.091791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:09:16.098529 3.001140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:09:23.105280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:09:31.106583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:09:47.109960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:10:19.115435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:13:51.341655 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 10:13:51.341732 0.973148 tcp 10.0.2.105 54107 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:13:56.298259 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:14:12.984148 0.052847 tcp 10.0.2.105 54108 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:13.037376 0.080393 tcp 10.0.2.105 54109 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:13.118105 0.181263 tcp 10.0.2.105 54110 -> 195.113.214.236 443 SRPA* 0 0 41 22792 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:13.298273 0.000000 udp 10.0.2.105 7010 -> 2.40.81.22 4189 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:14:28.885351 0.053561 tcp 10.0.2.105 54111 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:28.939212 0.077781 tcp 10.0.2.105 54112 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:29.017239 0.172128 tcp 10.0.2.105 54113 -> 195.113.214.236 443 SRPA* 0 0 24 13862 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:29.189866 0.000000 udp 10.0.2.105 7010 -> 86.38.111.213 8968 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:14:46.541545 0.051628 tcp 10.0.2.105 54114 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:46.593412 0.073992 tcp 10.0.2.105 54115 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:46.667261 0.178276 tcp 10.0.2.105 54116 -> 195.113.214.236 443 SRPA* 0 0 43 22724 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:14:46.845902 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:15:03.725673 0.068159 tcp 10.0.2.105 54117 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:03.794121 0.077048 tcp 10.0.2.105 54118 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:03.871407 0.166151 tcp 10.0.2.105 54119 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:04.038198 0.030232 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.068778 0.150574 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.219776 0.147273 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.367429 0.144754 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.512599 0.307310 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.820342 0.120162 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.940929 0.020670 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:04.961989 0.225759 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.188133 0.146384 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.334889 0.059086 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.394366 0.150072 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.544833 0.208548 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.753801 0.142374 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:05.896712 0.157007 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.054118 0.101188 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.155708 0.176805 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.332942 0.032297 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.365558 0.100380 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.466303 0.326673 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 197 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.793411 0.145983 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:06.939873 0.000000 udp 10.0.2.105 7010 -> 75.53.126.156 2469 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:15:24.835965 0.052188 tcp 10.0.2.105 54120 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:24.888482 0.077516 tcp 10.0.2.105 54121 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:24.966301 0.173269 tcp 10.0.2.105 54122 -> 195.113.214.236 443 SRPA* 0 0 46 37246 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:25.140136 0.143860 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.284355 0.136924 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.421638 0.135898 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.557920 0.044977 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.603267 0.181448 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.785136 0.198535 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:25.984067 0.116536 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:26.101006 0.000000 udp 10.0.2.105 7010 -> 76.64.230.69 1475 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:15:43.292346 0.052842 tcp 10.0.2.105 54123 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:43.345524 0.071697 tcp 10.0.2.105 54124 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:43.417537 0.280573 tcp 10.0.2.105 54125 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:15:43.698745 0.046159 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:43.745299 0.057416 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:43.803143 0.204912 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:15:44.008617 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:16:00.968152 0.052709 tcp 10.0.2.105 54126 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:16:01.021183 0.075231 tcp 10.0.2.105 54127 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:16:01.096801 0.193092 tcp 10.0.2.105 54128 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:16:01.289033 0.289505 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:16:23.122478 3.000564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 10:16:30.128767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:16:38.130384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:16:54.133433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:17:26.139545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:23:30.146115 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:23:37.152943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:23:45.154837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:24:01.158029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:24:33.163886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:30:37.169244 3.001836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:30:44.177521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:30:52.178428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:31:08.181804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:31:40.187393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:37:44.193297 3.001891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:37:51.200700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:37:59.202873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:38:15.205894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:38:47.211536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:43:52.320623 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 10:43:52.320724 1.044886 tcp 10.0.2.105 54129 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:44:51.217943 3.001037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:44:58.225201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:45:06.226125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:45:22.229678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:45:54.235808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:46:22.736588 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 10:46:22.736733 0.171178 udp 10.0.2.105 7010 -> 75.53.126.156 2469 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:46:22.907911 0.000000 icmp 75.53.126.156 0x0303 -> 10.0.2.105 0xa509 URP 192 1 270 flow=Background 1970/01/14 10:46:39.222453 0.054276 tcp 10.0.2.105 54130 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:39.277030 0.075332 tcp 10.0.2.105 54131 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:39.352657 0.186969 tcp 10.0.2.105 54132 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:39.540190 0.000000 udp 10.0.2.105 7010 -> 76.64.230.69 1475 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:46:55.624476 0.052767 tcp 10.0.2.105 54133 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:55.677512 0.074922 tcp 10.0.2.105 54134 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:55.752782 0.177386 tcp 10.0.2.105 54135 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:46:55.930622 0.075646 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.006675 0.057989 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.065021 0.145263 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.210682 0.121385 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.332602 0.020118 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.353104 0.261599 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.615144 0.147716 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.763238 0.083788 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.847398 0.145023 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:56.992816 0.212430 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.205705 0.151497 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.357582 0.063245 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.421220 0.183343 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.604951 0.033368 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.638670 0.055126 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.694195 0.143786 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.838381 0.156962 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:57.995705 0.208117 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:58.204178 0.326545 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:58.531092 0.143919 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:58.675418 0.059698 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:58.735477 0.154284 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:58.890152 0.180258 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.070810 0.184475 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.255617 0.114465 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.370435 0.138614 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.509502 0.045289 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.555130 0.142467 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.697982 0.045373 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:46:59.743743 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 10:47:15.452714 0.051178 tcp 10.0.2.105 54136 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:47:15.504254 0.074071 tcp 10.0.2.105 54137 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:47:15.578177 0.173073 tcp 10.0.2.105 54138 -> 195.113.214.236 443 SRPA* 0 0 39 33892 flow=From-Botnet-V2-TCP-Established 1970/01/14 10:47:15.751921 0.185461 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:47:15.937770 0.295869 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/14 10:51:58.242525 3.000535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 10:52:05.249057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:52:13.250524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:52:29.253583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:53:01.259517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:59:05.265122 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 10:59:12.272979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:59:20.274327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 10:59:36.277154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:00:08.283252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:06:12.288810 3.001955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:06:19.297119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:06:27.298042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:06:43.301845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:07:15.307618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:13:19.313740 3.001708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:13:26.321249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:13:34.322337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:13:50.325446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:13:53.370006 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 11:13:53.370232 1.039412 tcp 10.0.2.105 54139 -> 128.255.183.224 9027 FSPA* 0 0 12 1636 flow=From-Botnet-V2-TCP-Established 1970/01/14 11:14:22.331572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:17:24.694183 0.000295 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 11:17:24.694594 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 11:17:40.979621 0.054340 tcp 10.0.2.105 54140 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 11:17:41.034258 0.070486 tcp 10.0.2.105 54141 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 11:17:41.105013 0.175539 tcp 10.0.2.105 54142 -> 195.113.214.236 443 SRPA* 0 0 34 23642 flow=From-Botnet-V2-TCP-Established 1970/01/14 11:17:41.281158 0.146559 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.428075 0.120972 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.549467 0.020148 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.569987 0.077167 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.647626 0.058060 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.706033 0.143761 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.850187 0.074543 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:41.925155 0.152153 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.077752 0.213278 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.291434 0.162067 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.453903 0.338653 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.792928 0.034114 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.827410 0.053639 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:42.881402 0.144110 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.025906 0.156969 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.183225 0.229609 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.413238 0.188628 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.602242 0.062559 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.665141 0.067014 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.732756 0.141087 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:43.874179 0.188322 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.062931 0.188400 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.251714 0.351104 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.603157 0.146423 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.750003 0.044332 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.794723 0.135838 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.930966 0.046330 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:44.977699 0.119411 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:45.097501 0.138217 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:45.236137 0.172396 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:17:45.408919 0.282933 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:20:26.337045 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:20:33.344460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:20:41.346709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:20:57.349216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:21:29.355291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:27:33.361070 3.002072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:27:40.368936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:27:48.369942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:28:04.373661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:28:36.379481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:34:40.385977 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:34:47.392697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:34:55.394529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:35:11.396910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:35:43.403055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:41:47.410617 3.000104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:41:54.416737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:42:02.418157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:42:18.421552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:42:50.427459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:43:54.409857 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 11:43:54.410141 0.937420 tcp 10.0.2.105 54143 -> 128.255.183.224 9027 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/01/14 11:48:13.652208 0.074201 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 11:48:13.726598 0.147532 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:13.874578 0.120083 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:13.995091 0.020242 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.015725 0.075993 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.092108 0.050935 udp 10.0.2.105 7010 <-> 84.44.204.98 5058 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.143422 0.147238 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.291066 0.039175 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.330644 0.144744 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.475839 0.292310 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.768575 0.030522 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.799583 0.055981 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.856021 0.141356 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:14.997709 0.153102 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:15.151220 0.151213 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:15.302832 0.216508 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:15.519730 0.207337 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:15.727453 0.216861 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:15.944718 0.075718 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.020790 0.073992 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.095139 0.142690 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.238233 0.180434 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.419095 0.186518 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.606013 0.335537 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:16.941960 0.144202 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.086585 0.044612 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.131592 0.135875 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.267936 0.046411 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.314685 0.115555 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.430578 0.134837 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.565823 0.188829 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:17.755058 0.300347 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/14 11:48:54.464240 3.000617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 11:49:01.470685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:49:09.472386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:49:25.475325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:49:57.481255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:56:01.486894 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 11:56:08.494382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:56:16.495919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:56:32.498924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 11:57:04.505090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:03:08.511841 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:03:15.518283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:03:23.520229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:03:39.523106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:04:11.529198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:10:15.536027 3.001065 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:10:22.542720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:10:30.544449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:10:46.546993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:11:18.552897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:13:55.378934 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:13:55.379119 0.973616 tcp 10.0.2.105 54144 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:17:22.559776 3.031160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:17:29.596668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:17:37.598208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:17:53.600980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:18:25.607372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:18:33.388825 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:18:33.388929 0.019992 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:33.409309 0.076283 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:33.486058 0.000000 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 12:18:52.097053 0.031056 tcp 10.0.2.105 54145 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:18:52.128503 0.075285 tcp 10.0.2.105 54146 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:18:52.203637 0.136797 tcp 10.0.2.105 54147 -> 195.113.214.236 443 SRPA* 0 0 64 42072 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:18:52.340782 0.143574 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:52.484695 0.186571 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:52.671693 0.144867 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:52.816913 0.121076 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:52.938388 0.145077 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.083831 0.210318 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.294524 0.033569 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.328527 0.053521 udp 10.0.2.105 7010 <-> 176.73.235.239 5805 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.382453 0.142074 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.524921 0.150602 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.675916 0.151745 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:53.828004 0.211594 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.039956 0.223945 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.264321 0.164197 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.428944 0.058420 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.487760 0.056130 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.544373 0.171631 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.716466 0.187941 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:54.904755 0.188062 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.093190 0.324414 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.417943 0.144702 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.563059 0.045591 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.609022 0.135658 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.745045 0.046917 udp 10.0.2.105 7010 <-> 5.13.45.255 2778 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.792513 0.173179 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:55.966139 0.298267 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:56.264841 0.123322 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:18:56.388558 0.137354 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:24:29.613852 3.001083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:24:36.620358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:24:44.622136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:25:00.625194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:25:32.631236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:31:36.636510 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:31:43.644876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:31:51.646031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:32:07.649281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:32:39.655046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:38:43.661570 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:38:50.668471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:38:58.669870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:39:14.672673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:39:46.679270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:43:56.358328 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:43:56.358425 0.962024 tcp 10.0.2.105 54148 -> 128.255.183.224 9027 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:45:50.685510 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 12:45:57.692770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:46:05.693989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:46:21.697104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:46:53.702663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:49:02.838892 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:49:02.838996 0.000000 udp 10.0.2.105 7010 -> 84.44.204.98 5058 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 12:49:17.901866 0.030630 tcp 10.0.2.105 54149 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:17.932746 0.070713 tcp 10.0.2.105 54150 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:18.003705 0.155441 tcp 10.0.2.105 54151 -> 195.113.214.236 443 SRPA* 0 0 35 18786 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:18.157779 0.020339 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.178462 0.075257 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.254125 0.144833 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.399396 0.085970 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.485727 0.143433 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.629559 0.120625 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.750588 0.151682 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:18.902671 0.208951 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:19.112052 0.031809 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:19.144352 0.000000 udp 10.0.2.105 7010 -> 176.73.235.239 5805 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 12:49:37.488924 0.030631 tcp 10.0.2.105 54152 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:37.519873 0.075873 tcp 10.0.2.105 54153 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:37.595541 0.150419 tcp 10.0.2.105 54154 -> 195.113.214.236 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:37.746531 0.143979 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:37.890848 0.149127 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:38.040419 0.155241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:38.196139 0.205752 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:38.402329 0.292704 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:38.695371 0.840986 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:39.536841 4.060130 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:43.597516 0.187633 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:43.597909 3.084685 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 SPA_* 0 0 6 503 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:49:43.785578 0.183471 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:43.969441 0.186497 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:44.156306 0.056983 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:44.213679 0.330466 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:44.544512 0.147997 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:49:44.692923 0.000000 udp 10.0.2.105 7010 -> 79.253.213.136 2373 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 12:49:50.614381 4.789495 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 3986 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:00.262095 0.030312 tcp 10.0.2.105 54156 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:00.292093 0.075145 tcp 10.0.2.105 54157 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:00.367529 0.156460 tcp 10.0.2.105 54158 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:00.524608 0.135555 udp 10.0.2.105 7010 <-> 130.71.198.138 4860 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:50:00.660523 0.000000 udp 10.0.2.105 7010 -> 5.13.45.255 2778 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 12:50:10.120184 4.211349 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:17.145975 0.029895 tcp 10.0.2.105 54159 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:17.176171 0.071666 tcp 10.0.2.105 54160 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:17.248162 0.163588 tcp 10.0.2.105 54161 -> 195.113.214.236 443 SRPA* 0 0 42 36110 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:17.412369 0.174914 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:50:17.587620 0.286740 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:50:17.874729 0.114002 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:50:17.989138 0.134105 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/14 12:50:18.256454 4.507642 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:30.756141 0.409574 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 1652 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:44.402174 4.469126 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 8 3796 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:50:49.451645 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:51:01.087932 4.337132 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:51:16.759613 0.202598 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:51:21.958763 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:51:28.069640 4.604414 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 4854 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:51:44.839713 0.202042 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 2 1140 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:51:49.958549 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:52:02.411276 4.301823 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6748 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:10.415551 4.489575 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:15.455470 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:52:22.513891 0.192688 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 7726 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:35.615545 4.456113 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6972 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:40.451479 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:52:48.070920 0.202384 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3518 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:57.675524 4.447806 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6684 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:52:57.729240 3.001128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 12:53:04.736820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:53:06.295508 4.519518 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:53:12.737835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:53:14.590875 0.200475 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3870 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:53:15.451659 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:53:23.064838 0.398766 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:53:28.741145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:53:31.813087 4.198242 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:53:40.458055 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:53:43.555048 0.197447 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3766 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:53:52.818623 4.113054 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:00.746678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 12:54:05.725471 4.254816 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:10.450867 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:54:13.894963 4.547535 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 8696 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:21.832696 0.195313 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:29.918388 0.200844 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 2 1308 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:34.955857 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:54:37.959827 4.216354 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:49.942093 0.395864 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 1652 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:54:58.474751 4.682097 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 5442 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:55:11.644564 4.310678 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:55:16.455499 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:55:20.109842 0.402057 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:55:29.129743 4.320672 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:55:42.179612 4.800282 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:55:46.959892 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:55:55.823537 4.705309 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 6346 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:56:09.363465 4.434855 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:56:14.458847 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:56:23.007156 4.731332 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:56:31.743423 4.336550 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:56:39.803589 4.588861 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 6 2332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:56:40.456609 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:56:53.305211 4.416138 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6932 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:01.680932 4.382756 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 8592 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:09.830973 0.198311 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:17.916878 0.204032 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3518 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:37.099640 4.164665 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6932 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:41.954636 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:57:45.342844 4.303770 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:57:57.708704 0.199303 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 2 212 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:58:06.280734 0.199801 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:58:11.457072 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:58:25.230506 4.343388 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6344 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:58:37.685185 0.400694 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:58:42.451937 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:58:46.816611 4.358259 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 7678 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:58:54.841975 0.198501 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:59:03.568141 4.290510 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:59:08.459635 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 12:59:12.035921 0.209057 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:59:34.846018 4.618415 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 12:59:39.954298 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:00:02.141887 0.194710 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 2 1412 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:00:04.752928 3.002077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:00:06.953637 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:00:11.619403 4.467464 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 10 6356 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:00:11.760113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:00:19.762045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:00:20.281951 0.201172 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:00:28.903265 4.598272 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:00:35.764718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:00:37.957737 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:00:42.337229 4.454185 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 9 5262 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:00:50.797591 0.399811 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:01:07.770713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:01:21.000023 0.000163 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:01:34.018946 0.000161 tcp 10.0.2.105 54155 -> 71.10.54.162 3760 RA_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:07:11.777603 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 13:07:18.784151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:07:26.786150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:07:42.788755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:08:14.794643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:13:57.347796 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:13:57.347964 0.977200 tcp 10.0.2.105 54162 -> 128.255.183.224 9027 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:14:18.801021 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 13:14:25.808009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:14:33.809646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:14:49.812846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:15:21.818862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:20:30.072113 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:20:30.072206 0.000000 udp 10.0.2.105 7010 -> 176.73.235.239 5805 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:20:48.200147 0.031307 tcp 10.0.2.105 54163 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:20:48.231733 0.071333 tcp 10.0.2.105 54164 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:20:48.303348 0.152678 tcp 10.0.2.105 54165 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:20:48.456598 0.000000 udp 10.0.2.105 7010 -> 79.253.213.136 2373 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:21:07.225847 0.031685 tcp 10.0.2.105 54166 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:07.258044 0.074517 tcp 10.0.2.105 54167 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:07.332895 0.160157 tcp 10.0.2.105 54168 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:07.493209 0.000000 udp 10.0.2.105 7010 -> 5.13.45.255 2778 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:21:25.592608 0.030256 tcp 10.0.2.105 54169 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:25.623147 0.074362 tcp 10.0.2.105 54170 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:25.697797 0.163358 tcp 10.0.2.105 54171 -> 195.113.214.236 443 SRPA* 0 0 33 18104 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:25.825857 3.000421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:21:25.861831 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:21:32.832020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:21:40.833747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:21:41.965897 0.031290 tcp 10.0.2.105 54172 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:41.997007 0.076424 tcp 10.0.2.105 54173 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:42.073700 0.156273 tcp 10.0.2.105 54174 -> 195.113.214.236 443 SRPA* 0 0 52 34662 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:21:42.229248 0.020536 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.250183 0.137833 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.388539 0.141894 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.530832 0.031152 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.562385 0.145396 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.708176 0.051877 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:42.760612 0.241169 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.002133 0.120410 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.122951 0.139297 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.262685 0.152625 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.415683 0.155468 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.571551 0.207186 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.779114 0.204699 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:21:43.984380 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:21:56.836848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:22:01.924698 0.029601 tcp 10.0.2.105 54175 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:01.954561 0.076931 tcp 10.0.2.105 54176 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:02.031789 0.153267 tcp 10.0.2.105 54177 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:02.185677 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:22:17.317169 0.030068 tcp 10.0.2.105 54178 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:17.347164 0.072133 tcp 10.0.2.105 54179 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:17.419604 0.162889 tcp 10.0.2.105 54180 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:17.581698 4.299965 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:21.882144 0.180530 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:21.882526 4.646779 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 SPA_* 0 0 7 680 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:22.063090 0.182174 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:22.245661 0.189192 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:22.435227 0.259446 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:22.695060 0.672129 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:23.367526 0.000000 udp 10.0.2.105 7010 -> 130.71.198.138 4860 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:22:28.842676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:22:29.095312 1.212013 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 4880 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:34.395237 0.396080 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:41.060822 0.030569 tcp 10.0.2.105 54182 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:41.091693 0.076804 tcp 10.0.2.105 54183 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:41.168871 0.155071 tcp 10.0.2.105 54184 -> 195.113.214.236 443 SRPA* 0 0 38 30110 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:41.324614 0.116494 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:41.441454 0.137006 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:41.578884 0.177922 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:41.757225 0.300939 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:22:42.504802 0.198218 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 464 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:22:58.242780 4.769440 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 5922 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:23:07.458103 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:23:18.384542 0.200041 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:23:42.132207 4.252190 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 14 12304 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:23:46.955480 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:23:54.788322 0.198545 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:24:16.112363 4.501165 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:24:20.953703 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:24:24.790448 0.399344 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:24:40.262162 4.426234 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:24:45.459229 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:24:48.609929 4.760572 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:24:57.104691 0.191276 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 1060 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:25:06.264220 4.732245 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:25:19.931753 4.173303 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 7086 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:25:28.104538 4.453042 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:25:37.453634 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:25:40.727334 0.402018 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1652 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:25:49.743767 4.274098 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 7192 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:26:02.813657 4.373698 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:26:07.957703 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:26:15.936185 4.479383 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:26:31.899021 0.203703 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 812 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:26:36.959711 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:26:53.863730 4.316868 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:02.330994 0.195875 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:02.956958 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:27:15.223738 0.201266 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 212 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:24.363792 4.790705 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:29.454740 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:27:33.034529 0.395977 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:46.157333 4.718452 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:27:54.710517 4.577640 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:28:07.423340 4.622817 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 9792 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:28:15.876265 0.405749 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:28:20.959262 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:28:23.810670 0.202915 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 708 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:28:32.848953 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:28:39.856477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:28:45.922584 4.228785 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:28:47.858028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:28:50.951876 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:28:54.197935 4.726042 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:03.860798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:29:07.052031 0.203916 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:16.352053 0.397185 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:21.456118 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:29:25.499901 4.428518 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 5182 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:33.886671 4.213440 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:35.866839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:29:47.313520 4.676991 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:29:52.450396 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:29:56.168863 4.553292 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:30:04.723386 0.195019 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:30:13.122081 0.198386 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 316 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:30:17.957475 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:30:21.288355 0.204254 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 8078 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:30:40.881845 4.314871 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 7086 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:30:45.957584 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:30:49.321608 0.401609 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:02.428953 4.398865 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 13 9692 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:10.875674 0.408201 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:11.454100 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:31:19.747716 0.398839 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:28.257646 0.200678 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:37.146962 0.204724 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:41.957912 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:31:46.030801 4.659651 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 5430 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:31:54.953376 4.749858 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:03.721601 0.198411 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3870 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:08.455938 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:32:17.286640 4.628531 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 7230 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:29.948205 4.475127 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 14 11844 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:38.486363 4.589797 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 14 10148 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:46.846201 4.511872 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:32:55.954795 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:33:00.208049 4.529551 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:33:08.887993 4.312856 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:33:26.596498 4.508162 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 15 13450 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:33:31.455242 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:33:34.860970 4.535868 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:33:43.155302 0.397632 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 7 5922 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:01.780520 0.398839 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:06.956605 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:34:10.551545 0.200763 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3518 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:19.260482 4.730809 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:32.284046 4.405131 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:37.460549 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:34:40.887252 0.208587 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:34:49.531034 0.197678 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 6224 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:08.889407 0.206899 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3178 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:13.953134 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:35:18.149132 4.456362 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:26.699851 4.738248 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:35.457151 0.206931 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:39.872990 3.001230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:35:40.450945 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:35:44.004994 0.191019 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 2 512 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:46.879977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:35:52.170969 4.443138 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 14 10396 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:35:54.882185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:36:05.704990 0.392919 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:36:10.453887 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:36:10.884638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:36:14.606476 4.490521 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:36:23.342386 4.756949 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 8344 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:36:31.966772 0.408843 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:36:40.524925 0.393174 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:36:42.890667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:36:59.886307 0.209308 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 7176 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:04.952310 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:37:09.255995 4.769576 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 4854 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:22.659055 4.285049 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:31.033948 4.532189 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:31.450433 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:37:39.261985 4.406498 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 16 12736 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:47.676046 0.408356 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 7 5922 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:37:56.182264 0.194234 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:38:00.952910 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:38:05.053939 4.551978 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 8 4528 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:38:17.737734 4.395965 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 9 5678 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:38:31.301526 4.751865 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:38:44.387723 0.408405 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:38:49.452393 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:38:53.863351 4.812370 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:39:06.769125 1.003002 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 FPA_* 0 0 9 3412 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:39:11.818373 0.000154 tcp 10.0.2.105 54181 -> 71.10.54.162 3760 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:42:46.897265 3.001357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:42:53.903952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:43:01.905449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:43:17.908683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:43:49.914726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:43:58.327665 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:43:58.327763 1.002727 tcp 10.0.2.105 54185 -> 128.255.183.224 9027 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:49:53.921013 3.021180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 13:50:00.948003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:50:08.949392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:50:24.952945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:50:56.958864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:52:43.983109 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:52:43.983211 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:52:59.205871 0.031169 tcp 10.0.2.105 54186 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:52:59.237322 0.076199 tcp 10.0.2.105 54187 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:52:59.313873 0.160181 tcp 10.0.2.105 54188 -> 195.113.214.236 443 SRPA* 0 0 77 64132 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:52:59.474826 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:53:17.992410 0.031638 tcp 10.0.2.105 54189 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:18.024364 0.069350 tcp 10.0.2.105 54190 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:18.094015 0.156579 tcp 10.0.2.105 54191 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:18.249400 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:53:33.964845 0.029634 tcp 10.0.2.105 54192 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:33.994757 0.070150 tcp 10.0.2.105 54193 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:34.065190 0.158637 tcp 10.0.2.105 54194 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:34.224348 0.000000 udp 10.0.2.105 7010 -> 130.71.198.138 4860 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:53:49.898112 0.030444 tcp 10.0.2.105 54195 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:49.928885 0.077884 tcp 10.0.2.105 54196 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:50.007057 0.156524 tcp 10.0.2.105 54197 -> 195.113.214.236 443 SRPA* 0 0 28 12102 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:53:50.162234 0.021149 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.183731 0.039958 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.224114 0.283180 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.507726 0.139861 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.648016 0.142185 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.790620 0.121090 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:50.912152 0.145997 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.058561 0.032575 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.091563 0.137783 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.229744 0.211277 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.441449 0.154230 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.596093 0.164701 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.761198 0.203945 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:51.965536 0.182188 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:52.148070 4.011514 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:56.159992 0.179629 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:56.340035 0.146841 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:56.487319 0.183003 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:56.670729 1.297081 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:57.968193 0.178252 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:58.146779 0.289635 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:58.436762 0.120790 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:53:58.557961 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:54:14.573851 0.030155 tcp 10.0.2.105 54198 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:54:14.604314 0.071347 tcp 10.0.2.105 54199 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:54:14.675998 0.156255 tcp 10.0.2.105 54200 -> 195.113.214.236 443 SRPA* 0 0 40 21154 flow=From-Botnet-V2-TCP-Established 1970/01/14 13:54:14.859870 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 REQ 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:54:23.806341 0.043683 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:23.850535 0.020241 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:23.871204 0.147328 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.019123 0.140998 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.160777 0.120014 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.281224 0.147807 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.429549 0.032348 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.462395 0.138009 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.600882 0.210916 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.812213 0.154066 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:24.966812 0.214914 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:25.182145 0.274927 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:25.457598 0.186786 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:25.644875 0.165152 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:25.810601 4.017151 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:29.828301 0.184138 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:30.012987 0.187642 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:30.201057 0.149436 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:30.351020 1.487420 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:31.839039 0.244839 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:32.084411 0.121257 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:32.206215 0.289634 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:32.496395 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:54:41.491702 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:54:46.458943 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:54:48.982379 0.194111 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:54:49.199481 0.000000 udp 10.0.2.105 7010 -> 81.157.88.234 7930 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:54:58.195821 0.000000 udp 10.0.2.105 7010 -> 74.7.75.190 7266 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:06.046899 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:10.953603 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:55:12.677102 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:20.878068 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:27.007465 0.000000 udp 10.0.2.105 7010 -> 24.79.14.98 5956 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:32.966100 0.391013 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:33.357113 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 142 flow=Background 1970/01/14 13:55:37.952582 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:55:38.423393 0.046183 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:55:38.502656 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:45.954172 0.000000 udp 10.0.2.105 7010 -> 79.27.157.238 7543 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:52.193293 0.000000 udp 10.0.2.105 7010 -> 80.45.79.253 9561 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:55:58.823270 0.000000 udp 10.0.2.105 7010 -> 94.71.79.237 2639 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:03.459352 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:56:03.850443 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:11.791869 0.000000 udp 10.0.2.105 7010 -> 24.39.169.11 6315 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:19.412340 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:24.669968 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:29.456535 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:56:29.917660 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:36.476749 0.000000 udp 10.0.2.105 7010 -> 82.47.110.221 3085 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:43.597223 0.000000 udp 10.0.2.105 7010 -> 207.250.135.98 8219 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:50.527044 0.112402 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:56:50.639446 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 227 flow=Background 1970/01/14 13:56:55.454225 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:56:57.166749 0.000000 udp 10.0.2.105 7010 -> 5.54.17.125 6104 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:00.965541 3.000810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 13:57:05.999605 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:07.972489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:57:13.770402 0.000000 udp 10.0.2.105 7010 -> 65.47.92.78 6109 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:15.973668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:57:22.192841 0.000000 udp 10.0.2.105 7010 -> 151.64.55.41 2160 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:26.959801 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:57:31.085700 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:31.976474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:57:37.254437 0.000000 udp 10.0.2.105 7010 -> 79.22.245.73 2391 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:45.746688 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:52.576506 0.000000 udp 10.0.2.105 7010 -> 74.87.145.62 9090 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:57:57.453260 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:58:00.948222 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:03.982936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 13:58:07.948748 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:14.227919 0.000000 udp 10.0.2.105 7010 -> 85.98.222.231 9490 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:20.506388 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:25.453871 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:58:29.038909 0.194297 udp 10.0.2.105 7010 <-> 70.184.87.44 2916 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/14 13:58:29.242540 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:35.498119 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:41.126571 0.000000 udp 10.0.2.105 7010 -> 118.142.97.182 1234 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:47.725660 0.000000 udp 10.0.2.105 7010 -> 24.227.133.126 9084 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:58:52.452083 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:58:55.386559 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:04.329907 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:12.711672 0.117979 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:12.829651 0.000000 icmp 5.82.63.25 0x0303 -> 10.0.2.105 0x000f URP 192 1 307 flow=Background 1970/01/14 13:59:17.458412 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:59:17.759293 0.000000 udp 10.0.2.105 7010 -> 79.121.223.118 7883 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:24.588636 0.000000 udp 10.0.2.105 7010 -> 75.120.235.208 7466 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:32.550548 0.000000 udp 10.0.2.105 7010 -> 92.234.187.129 4688 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:39.099901 0.000000 udp 10.0.2.105 7010 -> 149.172.245.108 3146 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:43.956143 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 13:59:46.019930 0.000000 udp 10.0.2.105 7010 -> 70.62.57.195 8359 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:53.961001 0.000000 udp 10.0.2.105 7010 -> 94.12.222.249 7835 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 13:59:59.869526 0.208588 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:00:00.095275 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:06.038247 0.000000 udp 10.0.2.105 7010 -> 217.79.123.16 2137 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:10.955263 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:00:11.656941 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:18.106079 0.000000 udp 10.0.2.105 7010 -> 184.175.186.36 6092 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:24.634993 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:33.337886 0.047340 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:00:33.398198 0.000000 udp 10.0.2.105 7010 -> 70.88.127.109 7610 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:37.953700 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:00:42.080030 0.000000 udp 10.0.2.105 7010 -> 64.32.178.38 2066 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:49.490691 0.140029 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:00:49.652410 0.000000 udp 10.0.2.105 7010 -> 68.193.100.50 6097 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:00:57.181742 0.000000 udp 10.0.2.105 7010 -> 81.241.153.22 9098 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:01.958512 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:01:05.954367 0.000000 udp 10.0.2.105 7010 -> 69.237.123.70 2007 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:11.352362 0.000000 udp 10.0.2.105 7010 -> 207.183.255.42 5434 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:20.275185 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:26.814313 0.000000 udp 10.0.2.105 7010 -> 95.242.7.98 3857 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:31.450815 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:01:33.614349 0.211488 udp 10.0.2.105 7010 <-> 187.206.201.118 2527 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:01:33.835820 0.000000 udp 10.0.2.105 7010 -> 124.38.192.98 2624 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:41.626052 0.000000 udp 10.0.2.105 7010 -> 46.120.226.152 7292 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:47.203955 0.000000 udp 10.0.2.105 7010 -> 141.196.103.80 6139 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:53.983433 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 7978 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:01:58.950812 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:02:02.826424 0.000000 udp 10.0.2.105 7010 -> 84.2.73.116 9845 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:08.153748 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:14.543471 0.000000 udp 10.0.2.105 7010 -> 82.222.125.90 4793 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:21.242932 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:25.959403 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:02:27.411613 0.000000 udp 10.0.2.105 7010 -> 81.134.12.60 8496 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:36.204123 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:42.763972 0.000000 udp 10.0.2.105 7010 -> 69.37.3.191 2275 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:48.862377 0.000000 udp 10.0.2.105 7010 -> 203.200.180.124 4571 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:02:53.458520 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:04:07.989033 3.001003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 14:04:14.996240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:04:22.998032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:04:39.000502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:05:11.006579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:11:15.012277 3.052679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:11:22.070436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:11:30.071826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:11:46.074790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:12:18.080498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:13:59.356717 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:13:59.356907 0.949044 tcp 10.0.2.105 54201 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/14 14:18:22.087805 3.000474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:18:29.094178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:18:37.095543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:18:53.098321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:19:25.104992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:25:29.111115 3.001109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:25:36.117824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:25:44.120024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:26:00.122698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:26:32.128899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:32:36.135289 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:32:43.142176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:32:51.143682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:33:07.146507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:33:22.769342 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:33:22.769451 0.142399 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:22.912477 0.121311 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.034137 0.043035 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.077558 0.020251 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.098169 0.149849 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.248523 0.144226 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.393146 0.031431 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.424928 0.144686 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.569957 0.192756 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.763137 0.152050 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:23.915634 0.211694 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:24.127731 0.690999 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:24.819119 0.184212 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:25.003690 0.177028 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:25.181141 0.187533 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:25.369159 3.933918 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:29.303500 0.191268 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:29.495145 0.145325 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:29.640796 1.469422 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:31.110633 0.000000 udp 10.0.2.105 7010 -> 190.200.28.39 3980 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 14:33:39.152733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:33:47.797035 0.118517 tcp 10.0.2.105 54202 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 14:33:47.915789 0.069871 tcp 10.0.2.105 54203 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 14:33:47.985983 0.156518 tcp 10.0.2.105 54204 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/14 14:33:48.142970 0.115206 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:48.258588 0.290126 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:48.549090 0.180493 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:48.729971 0.045102 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:48.775441 0.193412 udp 10.0.2.105 7010 <-> 70.184.87.44 2916 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:48.969205 0.206086 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:49.175699 0.046929 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:49.222962 0.150414 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:33:49.373789 0.205857 udp 10.0.2.105 7010 <-> 187.206.201.118 2527 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 14:39:43.159260 3.011394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:39:50.175714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:39:58.177812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:40:14.180382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:40:46.186949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:44:00.306044 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 14:44:00.306179 0.941075 tcp 10.0.2.105 54205 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/14 14:46:50.192743 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:46:57.200358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:47:05.201639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:47:21.204333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:47:53.210841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:53:57.217189 3.031434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 14:54:04.254403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:54:12.255555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:54:28.258584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 14:55:00.264509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:01:04.271217 3.000717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:01:11.277804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:01:19.279581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:01:35.282923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:02:07.288714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:04:11.146674 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 15:04:11.146868 0.220256 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.367498 0.040460 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.408374 0.020186 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.428952 0.142621 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.571998 0.141551 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.713974 0.122018 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.836568 0.034471 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:11.871406 0.145078 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.016863 0.142273 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.159518 0.150706 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.310629 0.233094 udp 10.0.2.105 7010 <-> 207.119.16.15 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.544131 0.284485 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.829084 0.161723 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:12.991178 0.500773 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:13.492460 0.185044 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:13.677842 0.189825 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:13.868100 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:04:28.964737 0.030326 tcp 10.0.2.105 54206 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:28.995436 0.065592 tcp 10.0.2.105 54207 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:29.061289 0.156345 tcp 10.0.2.105 54208 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:29.218122 0.186306 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:29.404801 0.146530 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:29.551709 0.814883 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:30.366995 0.113456 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:30.480840 0.289829 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:30.771081 0.176115 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:30.947592 0.044238 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:30.992203 0.000000 udp 10.0.2.105 7010 -> 70.184.87.44 2916 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:04:49.622846 0.042936 tcp 10.0.2.105 54209 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:49.666086 0.068290 tcp 10.0.2.105 54210 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:49.734730 0.161705 tcp 10.0.2.105 54211 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:04:49.897012 0.207497 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:50.104900 0.047134 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:50.152609 0.148094 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:04:50.301086 0.201358 udp 10.0.2.105 7010 <-> 187.206.201.118 2527 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:08:11.294858 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 15:08:18.301714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:08:26.303732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:08:42.306350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:09:14.312484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:14:01.255374 0.000194 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 15:14:01.255667 1.025900 tcp 10.0.2.105 54212 -> 128.255.183.224 9027 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:15:18.318087 3.001725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:15:25.325591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:15:33.327582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:15:49.330588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:16:21.336757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:22:25.342519 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:22:32.349946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:22:40.351147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:22:56.354280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:23:28.360711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:29:32.366453 3.031880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:29:39.403889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:29:47.405782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:30:03.408071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:30:35.414703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:34:55.619078 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 15:34:55.619236 4.375044 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:34:59.994692 0.000000 udp 10.0.2.105 7010 -> 70.184.87.44 2916 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:35:17.641627 0.031141 tcp 10.0.2.105 54213 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:17.673090 0.073115 tcp 10.0.2.105 54214 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:17.746526 0.157911 tcp 10.0.2.105 54215 -> 195.113.214.236 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:17.905270 0.020421 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:17.926088 0.238212 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.164711 0.143540 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.308623 0.041044 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.350018 0.032372 udp 10.0.2.105 7010 <-> 86.4.141.254 2633 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.382791 0.144751 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.527987 0.143502 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.671910 0.154597 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.826909 0.121120 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:18.948486 0.194585 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:19.143465 0.160920 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:19.304771 0.000000 udp 10.0.2.105 7010 -> 207.119.16.15 8296 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:35:35.456132 0.029637 tcp 10.0.2.105 54216 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:35.486048 0.073477 tcp 10.0.2.105 54217 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:35.559790 0.155965 tcp 10.0.2.105 54218 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:35.716618 0.269322 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:35.986313 0.190516 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:36.177170 0.213789 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:36.391286 0.179191 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:36.570901 0.148170 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:36.719495 0.188446 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:36.908353 0.295038 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:37.203760 0.291127 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:37.495273 0.000000 udp 10.0.2.105 7010 -> 79.253.213.136 2373 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:35:54.233439 0.030366 tcp 10.0.2.105 54219 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:54.264080 0.073356 tcp 10.0.2.105 54220 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:54.337754 0.152058 tcp 10.0.2.105 54221 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:35:54.490293 0.113270 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:54.603912 0.550146 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:55.154421 0.150350 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:55.305107 0.207006 udp 10.0.2.105 7010 <-> 76.217.180.151 1212 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:55.512465 0.046758 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/14 15:35:55.559541 0.000000 udp 10.0.2.105 7010 -> 187.206.201.118 2527 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 15:36:13.161026 0.029398 tcp 10.0.2.105 54222 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:36:13.190643 0.073920 tcp 10.0.2.105 54223 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:36:13.264837 0.152658 tcp 10.0.2.105 54224 -> 195.113.214.236 443 SRPA* 0 0 33 22256 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:36:39.420962 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 15:36:46.428139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:36:54.429171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:37:10.432048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:37:42.438170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:43:46.445141 3.000769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:43:53.451572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:44:01.453098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:44:02.285328 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 15:44:02.285496 1.088595 tcp 10.0.2.105 54225 -> 128.255.183.224 9027 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/01/14 15:44:17.456217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:44:49.462638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:50:53.469085 3.000998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:51:00.475751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:51:08.497671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:51:24.500119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:51:56.506246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:58:00.512733 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 15:58:07.519607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:58:15.521617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:58:31.524498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 15:59:03.530282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:05:07.536584 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 16:05:14.543878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:05:22.545138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:05:38.548352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:06:10.554585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:06:27.368682 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:06:27.368934 0.000000 udp 10.0.2.105 7010 -> 207.119.16.15 8296 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:06:46.297166 0.045740 tcp 10.0.2.105 54226 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:06:46.343253 0.069991 tcp 10.0.2.105 54227 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:06:46.413582 0.155028 tcp 10.0.2.105 54228 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:06:46.569336 0.044811 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:06:46.614534 0.000000 udp 10.0.2.105 7010 -> 187.206.201.118 2527 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:07:01.758440 0.029654 tcp 10.0.2.105 54229 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:01.788420 0.074607 tcp 10.0.2.105 54230 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:01.863346 0.158358 tcp 10.0.2.105 54231 -> 195.113.214.236 443 SRPA* 0 0 41 31116 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:02.022376 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:07:18.872996 0.030016 tcp 10.0.2.105 54232 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:18.903329 0.070262 tcp 10.0.2.105 54233 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:18.973873 0.156055 tcp 10.0.2.105 54234 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:19.129647 0.139272 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.269358 0.145495 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.415218 0.020624 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.436207 0.152847 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.589439 0.151666 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.741451 0.198392 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:19.940221 0.154491 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:20.095110 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:07:38.040742 0.030131 tcp 10.0.2.105 54235 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:38.070758 0.072537 tcp 10.0.2.105 54236 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:38.143667 0.155689 tcp 10.0.2.105 54237 -> 195.113.214.236 443 SRPA* 0 0 41 34352 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:38.300094 0.120661 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:38.421103 0.145634 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:38.567106 0.042325 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:38.609839 0.185144 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:38.795391 0.305331 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:39.101128 0.141867 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:39.243331 0.233892 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:39.477654 0.295421 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:39.773424 0.191545 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:39.965339 0.214028 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:40.179804 0.199356 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:40.379493 0.115270 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:40.495100 0.327492 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:40.823027 0.149590 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:07:40.973037 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1212 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:07:59.421769 0.030616 tcp 10.0.2.105 54238 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:59.452756 0.074342 tcp 10.0.2.105 54239 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:59.527304 0.151328 tcp 10.0.2.105 54240 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:07:59.678353 0.046830 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:12:14.560840 3.001213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 16:12:21.567981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:12:29.569382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:12:45.572163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:13:17.578234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:14:03.374662 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:14:03.374767 1.051811 tcp 10.0.2.105 54241 -> 128.255.183.224 9027 FSPA* 0 0 15 1606 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:19:21.584714 3.001474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 16:19:28.591456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:19:36.593510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:19:52.596171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:20:24.601965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:26:28.608060 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 16:26:35.615916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:26:43.617047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:26:59.620111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:27:31.626611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:33:35.631603 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 16:33:42.639360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:33:50.641769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:34:06.644522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:34:38.650367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:38:06.149223 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:38:06.149324 0.181034 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:06.330783 0.000000 udp 10.0.2.105 7010 -> 86.4.141.254 2633 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:38:21.713107 0.031632 tcp 10.0.2.105 54242 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:21.745063 0.064916 tcp 10.0.2.105 54243 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:21.810359 0.157507 tcp 10.0.2.105 54244 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:21.968080 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1212 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:38:39.997635 0.030149 tcp 10.0.2.105 54245 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:40.028013 0.068508 tcp 10.0.2.105 54246 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:40.096816 0.160665 tcp 10.0.2.105 54247 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:40.257875 0.044855 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:40.303079 0.143142 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:40.621468 0.151827 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:40.773709 0.187589 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:40.961670 0.146580 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.108654 0.150794 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.259780 0.020475 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.280572 0.156391 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.437376 0.041523 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.479300 0.185043 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.664765 0.216332 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:41.881460 0.142940 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:42.024769 0.122399 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:42.147561 0.143129 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:42.291092 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:38:59.165527 0.030311 tcp 10.0.2.105 54248 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:59.196158 0.065211 tcp 10.0.2.105 54249 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:59.261673 0.157713 tcp 10.0.2.105 54250 -> 195.113.214.236 443 SRPA* 0 0 45 40700 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:38:59.419987 0.184912 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:59.605309 0.283988 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:38:59.889649 0.183420 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:00.073490 0.346683 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:00.420576 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:18.613405 0.030325 tcp 10.0.2.105 54251 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:39:18.644009 0.066496 tcp 10.0.2.105 54252 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:39:18.710795 0.153308 tcp 10.0.2.105 54253 -> 195.113.214.236 443 SRPA* 0 0 51 33782 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:39:18.864746 0.115142 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:18.980378 0.178887 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:19.159641 0.046890 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:19.301702 0.418017 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:19.720517 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 REQ 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:24.942966 0.180842 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.124325 0.044971 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.169783 0.178643 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.349025 0.150743 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.500305 0.153145 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.654004 0.020945 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.675419 0.142706 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.818660 0.151798 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:25.970893 0.250923 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.222352 0.142506 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.365281 0.121446 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.487185 0.146211 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.633926 0.039517 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.673955 0.187147 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:26.861628 0.177298 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:27.039428 0.182978 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:27.222965 0.181902 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:27.405465 0.284276 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:27.690181 0.408041 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:28.098723 0.192135 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:28.291369 0.047219 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:28.339053 0.115864 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:28.455585 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:35.717400 0.194718 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:39:36.050199 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:42.536905 0.000000 udp 10.0.2.105 7010 -> 177.227.214.142 8061 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:47.474109 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:39:47.714815 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:52.872335 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:39:59.291404 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 7217 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:06.611546 0.000000 udp 10.0.2.105 7010 -> 79.126.239.51 4383 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:11.478534 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:40:12.409817 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:20.061330 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:25.218583 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:32.148335 0.000000 udp 10.0.2.105 7010 -> 219.75.59.41 1112 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:36.975498 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:40:40.570370 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:42.656127 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 16:40:47.350140 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:49.663420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:40:54.590982 0.000000 udp 10.0.2.105 7010 -> 80.46.36.238 4983 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:40:57.665457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:41:02.111473 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:06.978659 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:41:10.744051 0.000000 udp 10.0.2.105 7010 -> 75.158.140.215 4320 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:13.667832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:41:17.984336 0.000000 udp 10.0.2.105 7010 -> 2.14.134.38 7556 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:24.524179 0.000000 udp 10.0.2.105 7010 -> 80.45.79.253 9561 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:33.396428 0.000000 udp 10.0.2.105 7010 -> 209.62.254.113 7361 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:37.973041 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:41:41.568045 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:45.674172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:41:49.750285 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:41:54.787159 0.000000 udp 10.0.2.105 7010 -> 174.102.37.32 5006 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:03.790178 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:08.476522 0.000216 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:42:11.691699 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:19.763038 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:28.716145 0.000000 udp 10.0.2.105 7010 -> 82.47.110.221 3085 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:33.472944 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:42:34.875234 0.000000 udp 10.0.2.105 7010 -> 47.65.241.238 6039 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:41.183905 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:49.425677 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:54.833639 0.000000 udp 10.0.2.105 7010 -> 203.94.3.194 4969 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:42:59.469966 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:43:02.684957 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:09.024168 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:17.145716 0.000000 udp 10.0.2.105 7010 -> 59.167.196.72 1562 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:25.508120 0.000000 udp 10.0.2.105 7010 -> 216.16.161.73 2274 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:30.474801 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:43:30.775179 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:36.593662 0.244469 udp 10.0.2.105 7010 <-> 74.171.67.227 6806 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:43:36.989695 0.032294 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:43:37.042062 0.000000 udp 10.0.2.105 7010 -> 84.253.45.7 2075 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:42.632339 0.000000 udp 10.0.2.105 7010 -> 189.60.152.25 8208 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:51.405068 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:43:55.971344 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:43:58.304973 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:04.434177 0.977578 tcp 10.0.2.105 54254 -> 128.255.183.224 9027 FSPA* 0 0 12 1641 flow=From-Botnet-V2-TCP-Established 1970/01/14 16:44:05.785940 0.000000 udp 10.0.2.105 7010 -> 74.189.7.236 8642 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:14.729121 0.000000 udp 10.0.2.105 7010 -> 103.6.50.94 6502 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:21.247776 0.000000 udp 10.0.2.105 7010 -> 115.64.241.144 4581 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:27.867735 0.043332 udp 10.0.2.105 7010 -> 93.159.99.242 5762 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:27.911067 0.000000 icmp 93.159.99.242 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 245 flow=Background 1970/01/14 16:44:32.474094 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:44:34.496706 0.000000 udp 10.0.2.105 7010 -> 83.137.249.156 4763 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:41.887956 0.000000 udp 10.0.2.105 7010 -> 91.142.108.251 1442 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:50.300007 0.000000 udp 10.0.2.105 7010 -> 108.198.86.163 9084 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:44:56.398532 0.000000 udp 10.0.2.105 7010 -> 186.124.190.215 9901 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:00.974945 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:45:02.517225 0.000000 udp 10.0.2.105 7010 -> 74.7.31.82 4053 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:10.759144 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:17.459151 0.000000 udp 10.0.2.105 7010 -> 2.237.34.12 9944 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:23.727424 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:28.474116 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:45:32.429996 0.000000 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:38.889272 0.000000 udp 10.0.2.105 7010 -> 95.242.198.35 4766 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:47.181740 0.000000 udp 10.0.2.105 7010 -> 68.157.185.147 4161 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:53.390060 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:45:57.976695 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:45:59.729562 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:07.720810 0.000000 udp 10.0.2.105 7010 -> 150.101.114.122 7194 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:12.738394 0.000000 udp 10.0.2.105 7010 -> 59.124.6.120 4626 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:20.138817 0.000000 udp 10.0.2.105 7010 -> 60.190.151.90 4805 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:24.975935 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:46:26.468083 0.000000 udp 10.0.2.105 7010 -> 122.106.129.252 1473 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:31.946069 0.000000 udp 10.0.2.105 7010 -> 207.255.99.210 8841 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:37.894138 0.000000 udp 10.0.2.105 7010 -> 181.225.60.111 3344 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:43.983402 0.000000 udp 10.0.2.105 7010 -> 217.86.21.49 2055 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:48.970087 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:46:50.823236 0.102827 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:46:50.981527 0.000000 udp 10.0.2.105 7010 -> 108.73.13.29 1287 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:46:56.290702 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:02.640455 0.000000 udp 10.0.2.105 7010 -> 201.222.134.137 7997 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:09.349369 0.000000 udp 10.0.2.105 7010 -> 173.52.100.51 4368 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:13.975863 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:47:16.749952 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:22.057972 0.065096 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:47:22.353875 0.032302 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:47:22.495664 0.172537 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:47:22.719420 0.216090 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:47:23.057284 0.000000 udp 10.0.2.105 7010 -> 62.249.247.156 2160 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:29.538426 0.000000 udp 10.0.2.105 7010 -> 119.74.146.115 6437 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:38.301637 0.000000 udp 10.0.2.105 7010 -> 87.11.38.117 3217 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:42.977685 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:47:46.533108 0.000000 udp 10.0.2.105 7010 -> 125.236.202.235 1427 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:49.680965 3.000514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 16:47:53.203049 0.000000 udp 10.0.2.105 7010 -> 79.5.41.32 2505 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:47:56.687194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:47:59.130959 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:04.689227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:48:05.259908 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:09.976680 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:48:11.208761 0.292582 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:48:11.554846 0.000000 udp 10.0.2.105 7010 -> 96.44.34.101 1224 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:16.947174 0.348611 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:48:17.313943 0.000000 udp 10.0.2.105 7010 -> 107.1.120.134 7352 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:20.692524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:48:23.997110 0.000000 udp 10.0.2.105 7010 -> 71.196.9.75 1217 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:29.565193 0.622356 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:48:30.209849 0.000000 udp 10.0.2.105 7010 -> 79.51.60.244 2448 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:34.471786 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:48:38.167290 0.000000 udp 10.0.2.105 7010 -> 72.136.76.36 7578 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:46.239331 0.000000 udp 10.0.2.105 7010 -> 70.184.110.246 6479 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:52.458187 0.169291 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:48:52.674548 0.000000 udp 10.0.2.105 7010 -> 209.177.211.86 8208 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:48:52.698131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:49:00.960357 0.068149 udp 10.0.2.105 7010 -> 81.134.12.60 8496 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:01.028506 0.000000 icmp 81.134.12.60 0x0303 -> 10.0.2.105 0x3021 URP 192 1 115 flow=Background 1970/01/14 16:49:05.476135 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:49:08.631164 0.000000 udp 10.0.2.105 7010 -> 74.95.57.1 7183 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:14.760233 0.000000 udp 10.0.2.105 7010 -> 210.11.37.190 7485 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:20.007615 0.183376 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:49:20.201691 0.000000 udp 10.0.2.105 7010 -> 198.101.101.122 1289 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:25.765903 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:30.472435 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:49:33.126755 0.000000 udp 10.0.2.105 7010 -> 58.250.24.97 2607 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:39.585627 0.264090 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:49:39.904068 0.000000 udp 10.0.2.105 7010 -> 217.36.221.248 2005 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:48.388664 0.000000 udp 10.0.2.105 7010 -> 203.200.180.124 4571 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:54.897687 0.624641 udp 10.0.2.105 7010 -> 58.216.51.65 6941 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:49:55.522328 0.000000 icmp 58.216.51.65 0x0303 -> 10.0.2.105 0x1d1b URP 192 1 303 flow=Background 1970/01/14 16:49:59.474073 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:50:01.627317 0.000000 udp 10.0.2.105 7010 -> 50.97.71.116 7095 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:08.066662 0.000000 udp 10.0.2.105 7010 -> 82.57.10.222 7013 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:15.447461 0.000000 udp 10.0.2.105 7010 -> 216.116.168.164 2764 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:20.664368 0.000000 udp 10.0.2.105 7010 -> 206.217.87.35 9079 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:25.471159 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:50:29.497761 0.000000 udp 10.0.2.105 7010 -> 24.161.35.53 4282 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:37.418657 0.143839 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:50:37.698117 0.000000 udp 10.0.2.105 7010 -> 67.23.217.186 3463 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:45.320410 0.000000 udp 10.0.2.105 7010 -> 204.91.21.142 6957 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:50:49.976782 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:50:53.732141 0.134432 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:50:53.969995 0.000000 udp 10.0.2.105 7010 -> 207.119.16.15 8296 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:02.534810 0.000000 udp 10.0.2.105 7010 -> 180.183.145.161 7794 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:08.062726 0.000000 udp 10.0.2.105 7010 -> 86.147.164.53 7400 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:13.360676 0.000000 udp 10.0.2.105 7010 -> 93.37.85.211 2080 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:17.976547 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:51:21.722669 0.000000 udp 10.0.2.105 7010 -> 113.160.108.116 4224 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:28.181925 0.114700 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/14 16:51:28.341779 0.000000 udp 10.0.2.105 7010 -> 188.107.6.240 4256 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:35.321974 0.000000 udp 10.0.2.105 7010 -> 179.202.56.236 7797 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:40.587967 0.000000 udp 10.0.2.105 7010 <- 179.202.56.236 7797 RSP 0 0 1 539 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:40.606002 0.000000 udp 10.0.2.105 7010 -> 85.32.169.35 7645 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:45.476558 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 16:51:47.049568 0.000000 udp 10.0.2.105 7010 -> 175.144.229.102 1241 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:52.336466 0.000000 udp 10.0.2.105 7010 -> 202.134.127.10 6165 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:51:58.284846 0.000000 udp 10.0.2.105 7010 -> 180.175.147.121 4193 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 16:54:56.704882 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 16:55:03.711436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:55:11.712744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:55:27.716222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 16:55:59.721966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:02:03.728747 3.001092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:02:10.735305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:02:18.736744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:02:34.740238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:03:06.746122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:09:10.751960 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:09:17.759728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:09:25.760787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:09:41.764015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:10:13.770048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:14:05.413332 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 17:14:05.413427 0.959842 tcp 10.0.2.105 54255 -> 128.255.183.224 9027 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:16:17.775761 3.002027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:16:24.783723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:16:32.784763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:16:48.788109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:17:20.793900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:22:21.652933 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 17:22:21.653080 0.326579 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:21.980075 0.045495 udp 10.0.2.105 7010 <-> 79.253.213.136 2373 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.026010 0.144289 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.170628 0.172143 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.343202 0.145964 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.489580 0.149799 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.639771 0.020031 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.660176 0.142867 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.803536 0.144958 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:22.948931 0.302368 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.251641 0.144679 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.396689 0.042498 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.439571 0.183342 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.623347 0.155504 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.779283 0.200246 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:23.979875 0.170747 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:24.150973 0.122030 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:24.273394 0.339254 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:24.613055 0.173306 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:24.786796 0.190903 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:24.978090 0.297102 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.275525 0.046671 udp 10.0.2.105 7010 <-> 94.141.43.243 3703 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.322573 0.116842 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.439747 0.213309 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.653399 0.155920 udp 10.0.2.105 7010 <-> 74.171.67.227 6806 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.809653 0.029589 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.839619 0.085108 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:25.925062 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:22:41.276933 0.030973 tcp 10.0.2.105 54256 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:22:41.308508 0.064758 tcp 10.0.2.105 54257 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:22:41.373619 0.155496 tcp 10.0.2.105 54258 -> 195.113.214.236 443 SRPA* 0 0 44 32128 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:22:41.529733 0.169883 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:41.700058 0.031805 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:41.732262 0.258394 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:41.991136 0.285313 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:42.276841 0.346511 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:42.623698 0.170082 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:42.794135 0.164579 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:42.959112 0.185749 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:43.145227 0.149787 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:43.295437 0.150457 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:43.446227 0.134022 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:43.580655 0.116680 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:22:43.697742 0.000000 udp 10.0.2.105 7010 -> 179.202.56.236 7797 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:23:01.153629 0.030597 tcp 10.0.2.105 54259 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:23:01.184577 0.062313 tcp 10.0.2.105 54260 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:23:01.247192 0.150251 tcp 10.0.2.105 54261 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:23:24.800262 3.001224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 17:23:31.807542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:23:39.808955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:23:55.811922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:24:27.817912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:30:31.824153 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:30:38.831253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:30:46.833106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:31:02.835635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:31:34.842368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:37:38.847594 3.002054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:37:45.855239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:37:53.856892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:38:09.859695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:38:41.865775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:44:06.372741 0.013717 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 17:44:06.386556 0.962955 tcp 10.0.2.105 54262 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:44:45.872677 3.000546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:44:52.879313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:45:00.881137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:45:16.883775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:45:48.889955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:51:52.895673 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 17:51:59.903205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:52:07.904791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:52:23.908027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:52:55.913474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:53:06.960068 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 17:53:06.960174 0.061351 udp 10.0.2.105 7010 <-> 84.127.239.194 9345 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:07.021888 0.000000 udp 10.0.2.105 7010 -> 179.202.56.236 7797 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:53:23.185267 0.031129 tcp 10.0.2.105 54263 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:23.216647 0.068272 tcp 10.0.2.105 54264 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:23.285249 0.155275 tcp 10.0.2.105 54265 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:23.441017 0.000000 udp 10.0.2.105 7010 -> 79.253.213.136 2373 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:53:39.567128 0.030301 tcp 10.0.2.105 54266 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:39.597675 0.067114 tcp 10.0.2.105 54267 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:39.665124 0.162369 tcp 10.0.2.105 54268 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:39.828014 0.205801 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.034210 0.203623 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.238215 0.155651 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.394293 0.020002 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.414644 0.138406 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.553491 0.152058 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.706038 0.291191 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:40.997640 0.343429 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:41.341462 0.304743 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:41.646604 0.183199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:41.830241 0.041377 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:41.871989 0.145102 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.017502 0.121264 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.139183 0.191323 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.330861 0.146445 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.477720 0.186101 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.664353 0.173965 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:42.838681 0.000000 udp 10.0.2.105 7010 -> 94.141.43.243 3703 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:53:59.004864 0.031410 tcp 10.0.2.105 54269 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:59.035601 0.062840 tcp 10.0.2.105 54270 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:59.098765 0.154913 tcp 10.0.2.105 54271 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:53:59.254241 0.444112 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:59.698769 0.193610 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:53:59.892861 0.288460 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:00.181710 0.029260 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:00.211345 0.088813 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:00.300556 0.115166 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:00.416105 0.000000 udp 10.0.2.105 7010 -> 108.245.57.129 2307 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 17:54:19.274230 0.030719 tcp 10.0.2.105 54272 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:54:19.305226 0.064890 tcp 10.0.2.105 54273 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:54:19.370199 0.155789 tcp 10.0.2.105 54274 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 17:54:19.526524 0.152162 udp 10.0.2.105 7010 <-> 74.171.67.227 6806 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:19.679076 0.245912 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:19.925326 0.285507 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:20.211221 0.172449 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:20.384132 0.031409 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:20.415905 0.168798 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:20.585112 0.179589 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:20.765106 1.058937 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:21.824469 0.345741 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:22.170594 0.059446 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:22.230471 0.130300 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:22.361159 0.152888 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:54:22.514487 0.111079 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/14 17:58:59.920745 3.000801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 17:59:06.927551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:59:14.929011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 17:59:30.931401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:00:02.937861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:06:06.945029 3.000089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:06:13.950974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:06:21.952745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:06:37.955660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:07:09.961843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:13:13.976016 3.003341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:13:20.985195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:13:28.986931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:13:44.990019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:14:07.352417 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 18:14:07.352621 0.960861 tcp 10.0.2.105 54275 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:14:16.995557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:20:21.002465 3.000817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:20:28.009044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:20:36.010871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:20:52.013354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:21:24.019991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:24:26.973072 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 18:24:26.973182 0.000000 udp 10.0.2.105 7010 -> 79.253.213.136 2373 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:24:45.441017 0.031448 tcp 10.0.2.105 54276 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:24:45.472815 0.063945 tcp 10.0.2.105 54277 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:24:45.537102 0.155325 tcp 10.0.2.105 54278 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:24:45.693130 0.000000 udp 10.0.2.105 7010 -> 94.141.43.243 3703 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:25:02.694799 0.030004 tcp 10.0.2.105 54279 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:02.725091 0.064302 tcp 10.0.2.105 54280 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:02.789687 0.152006 tcp 10.0.2.105 54281 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:02.942186 0.000000 udp 10.0.2.105 7010 -> 108.245.57.129 2307 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:25:21.812369 0.029999 tcp 10.0.2.105 54282 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:21.842598 0.068048 tcp 10.0.2.105 54283 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:21.910933 0.156707 tcp 10.0.2.105 54284 -> 195.113.214.236 443 SRPA* 0 0 50 32854 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:22.067962 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:25:40.989752 0.029745 tcp 10.0.2.105 54285 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:41.019810 0.065526 tcp 10.0.2.105 54286 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:41.085620 0.161974 tcp 10.0.2.105 54287 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:25:41.247830 0.200389 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:41.448565 0.507094 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:41.956093 0.137912 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.094424 0.260407 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.355235 0.140081 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.495668 0.020027 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.515983 0.150833 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.667278 0.149394 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.817064 0.121647 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:42.939048 0.186418 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.125822 0.172847 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.299054 0.153671 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.453081 0.143849 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.597292 0.045535 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.643214 0.179013 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.822617 0.144605 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:43.967614 0.185098 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:44.153127 0.289607 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:44.443096 0.029172 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:44.472710 0.078922 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:44.552033 0.185570 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:44.737996 0.366732 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:45.105150 0.116640 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:45.222214 0.278345 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:25:45.500973 0.000000 udp 10.0.2.105 7010 -> 74.171.67.227 6806 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:26:04.343374 0.030034 tcp 10.0.2.105 54288 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:26:04.373686 0.063173 tcp 10.0.2.105 54289 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:26:04.437129 0.157649 tcp 10.0.2.105 54290 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:26:04.595481 0.289217 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:04.885027 0.173256 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.058652 0.033026 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.092030 0.167917 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.260492 0.235076 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.495999 0.179093 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.675492 0.148247 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:05.824080 0.342531 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:06.166988 0.114830 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:06.282152 0.131997 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:26:06.414527 0.149028 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:27:28.025506 3.002129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 18:27:35.032764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:27:43.034939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:27:59.037660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:28:31.044049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:34:35.049941 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:34:42.056938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:34:50.058231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:35:06.061291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:35:38.068016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:41:42.074080 3.041011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:41:49.121340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:41:57.122250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:42:13.125479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:42:45.131640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:44:08.331511 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 18:44:08.331612 0.987798 tcp 10.0.2.105 54291 -> 128.255.183.224 9027 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:48:49.138315 3.000748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:48:56.144882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:49:04.146416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:49:20.169235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:49:52.175440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:55:56.180966 3.001965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 18:56:03.189132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:56:11.190661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:56:22.727633 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 18:56:22.727770 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 9345 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:56:27.193345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:56:38.751716 0.031698 tcp 10.0.2.105 54292 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:38.783706 0.065141 tcp 10.0.2.105 54293 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:38.849113 0.157254 tcp 10.0.2.105 54294 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:39.006996 0.000000 udp 10.0.2.105 7010 -> 74.171.67.227 6806 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 18:56:54.042493 0.030423 tcp 10.0.2.105 54295 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:54.073201 0.062230 tcp 10.0.2.105 54296 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:54.135734 0.151641 tcp 10.0.2.105 54297 -> 195.113.214.236 443 SRPA* 0 0 35 16806 flow=From-Botnet-V2-TCP-Established 1970/01/14 18:56:54.286536 0.145467 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:54.432460 0.206169 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:54.639016 0.518356 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.157780 0.020120 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.178290 0.201563 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.380286 0.144664 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.525285 0.120070 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.645750 0.182109 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:55.828415 0.180589 udp 10.0.2.105 7010 <-> 190.200.28.39 3980 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.009406 0.153027 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.162832 0.142276 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.305609 0.141472 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.447459 0.053490 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.501323 0.173304 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.675020 0.139974 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:56.815396 0.184522 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.000357 0.161540 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.162319 0.183437 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.346192 0.477197 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.823742 0.113603 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.937780 0.029232 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:57.967403 0.289400 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.257210 0.087281 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.344846 0.277825 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.623055 0.171018 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.794482 0.037872 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.832707 0.166180 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:58.999233 0.250385 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:59.199865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 18:56:59.250610 0.063674 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:59.314681 0.141948 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:59.456959 0.357703 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:59.815000 0.116615 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:56:59.931987 0.177710 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:57:00.110101 0.139268 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/14 18:57:00.249766 0.160822 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:03:03.204942 3.002478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:03:10.212833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:03:18.214440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:03:34.217864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:04:06.223407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:10:10.229974 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:10:17.237202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:10:25.238282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:10:41.241127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:11:13.247388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:14:09.320887 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 19:14:09.321075 0.980355 tcp 10.0.2.105 54298 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:17:17.254346 3.000552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:17:24.260585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:17:32.262279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:17:48.265552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:18:20.271583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:24:24.277973 3.001088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:24:31.285072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:24:39.286070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:24:55.289282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:25:27.295598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:27:15.541102 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 19:27:15.541385 1.304137 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:16.845974 0.020300 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:16.866646 0.145030 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:17.012056 0.506287 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:17.518786 0.215491 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:17.734623 0.557044 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:18.292076 0.122037 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:18.414529 0.192445 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:18.607378 0.000000 udp 10.0.2.105 7010 -> 190.200.28.39 3980 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 19:27:37.003948 0.031672 tcp 10.0.2.105 54299 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:37.035878 0.069538 tcp 10.0.2.105 54300 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:37.105805 0.156088 tcp 10.0.2.105 54301 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:37.262574 0.150753 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:37.413713 0.142324 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:37.556426 0.143034 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:37.699790 0.038860 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:37.739004 0.174687 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:37.914032 0.259068 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:38.173659 0.186110 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:38.360147 0.179058 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:38.539604 0.189349 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:38.729329 0.029905 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:38.759539 0.302289 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:39.062256 0.085296 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:39.147983 0.326198 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:39.474526 0.113595 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:39.588479 0.283733 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:39.872591 0.202952 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:40.075905 0.039615 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:40.115938 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 19:27:58.333557 0.030182 tcp 10.0.2.105 54302 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:58.364023 0.073767 tcp 10.0.2.105 54303 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:58.437644 0.152711 tcp 10.0.2.105 54304 -> 195.113.214.236 443 SRPA* 0 0 23 12064 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:27:58.590947 0.213660 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:58.805022 0.204668 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.010091 0.116970 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.127417 0.229686 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.357509 0.134845 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.492696 0.143982 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.637010 0.340549 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:27:59.978121 0.148022 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:31:31.302020 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 19:31:38.309115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:31:46.310160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:32:02.313504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:32:34.319149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:38:38.325786 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:38:45.332689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:38:53.334294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:39:09.337428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:39:41.343618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:44:10.300820 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 19:44:10.300920 1.124694 tcp 10.0.2.105 54305 -> 128.255.183.224 9027 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:45:45.359975 3.000877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:45:52.366524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:46:00.368573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:46:16.371687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:46:48.377602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:52:52.382935 3.001983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 19:52:59.390918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:53:07.392032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:53:23.395368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:53:55.401694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 19:58:26.211482 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 19:58:26.211726 0.000000 udp 10.0.2.105 7010 -> 190.200.28.39 3980 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 19:58:44.639481 0.031394 tcp 10.0.2.105 54306 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:58:44.671065 0.069841 tcp 10.0.2.105 54307 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:58:44.741197 0.156735 tcp 10.0.2.105 54308 -> 195.113.214.236 443 SRPA* 0 0 23 13772 flow=From-Botnet-V2-TCP-Established 1970/01/14 19:58:44.898450 0.161872 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:45.060729 0.152044 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:45.213145 0.020247 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:45.233728 0.455394 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:45.689569 0.212800 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:45.902760 0.143087 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.046228 0.414380 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.460999 0.175559 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.636965 0.120128 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.757493 0.150687 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.908597 0.041958 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:46.950931 0.175824 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.127174 0.147562 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.275066 0.146958 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.422412 0.141213 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.564043 0.190786 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.755198 0.029830 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:47.785417 0.303141 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.088939 0.084048 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.173348 0.160996 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.334783 0.184496 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.519679 0.175767 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.695846 0.034454 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:48.730706 0.428035 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.159147 0.116405 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.275941 0.276690 udp 10.0.2.105 7010 <-> 27.140.57.98 4240 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.553034 0.210511 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.763959 0.072795 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.837153 0.110380 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:49.947937 0.142638 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:50.090978 0.338055 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:50.429391 0.144863 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:50.574648 0.290623 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:58:50.865676 0.133620 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 19:59:59.408086 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:00:06.414458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:00:14.416636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:00:30.419552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:01:02.425482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:07:06.432027 3.000552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:07:13.438899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:07:21.439873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:07:37.442995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:08:09.449443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:14:11.430092 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 20:14:11.430241 1.021064 tcp 10.0.2.105 54309 -> 128.255.183.224 9027 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:14:13.454726 3.002103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:14:20.462320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:14:28.464158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:14:44.467659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:15:16.472965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:21:20.479648 3.000903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:21:27.486547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:21:35.488064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:21:51.490835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:22:23.496977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:28:27.502837 3.002164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:28:34.510273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:28:42.512061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:28:58.515257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:29:03.112581 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 20:29:03.112729 0.020681 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:03.133714 0.168597 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:03.302664 0.151664 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:03.454767 0.145366 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:03.600545 0.467963 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:04.068872 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 20:29:19.166889 0.051853 tcp 10.0.2.105 54310 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:19.219028 0.073297 tcp 10.0.2.105 54311 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:19.292610 0.160228 tcp 10.0.2.105 54312 -> 195.113.214.236 443 SRPA* 0 0 35 28182 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:19.453654 0.556304 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.010353 0.187021 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.197784 0.121386 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.319628 0.193048 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.513060 0.038933 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.552304 0.176238 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.728926 0.144512 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:20.873872 0.145582 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:21.019930 0.142572 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:21.162884 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 20:29:30.521448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:29:38.743532 0.052353 tcp 10.0.2.105 54313 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:38.796191 0.074607 tcp 10.0.2.105 54314 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:38.871034 0.156293 tcp 10.0.2.105 54315 -> 195.113.214.236 443 SRPA* 0 0 44 27606 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:39.028025 0.028895 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.057330 0.289525 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.347259 0.088035 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.435687 0.158728 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.594786 0.030928 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.626043 0.366727 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:39.993176 0.113583 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:40.107102 0.183360 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:29:40.290856 0.000000 udp 10.0.2.105 7010 -> 99.48.145.248 1101 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 20:29:55.547801 0.051029 tcp 10.0.2.105 54316 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:55.599070 0.074759 tcp 10.0.2.105 54317 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:55.673717 0.155272 tcp 10.0.2.105 54318 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:29:55.829640 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 20:30:13.473968 0.051089 tcp 10.0.2.105 54319 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:30:13.525355 0.070560 tcp 10.0.2.105 54320 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:30:13.596202 0.159753 tcp 10.0.2.105 54321 -> 195.113.214.236 443 SRPA* 0 0 62 46282 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:30:13.754898 0.245393 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.000655 0.063408 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.064499 0.154455 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.219364 0.142743 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.362517 0.266581 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.629495 0.173656 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:14.803585 0.344404 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:30:15.148561 0.144076 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/14 20:35:34.526777 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 20:35:41.534684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:35:49.535996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:36:05.539377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:36:37.545464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:42:41.551342 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:42:48.558218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:42:56.559858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:43:12.562715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:43:44.569036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:44:12.459856 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 20:44:12.460152 0.981911 tcp 10.0.2.105 54322 -> 128.255.183.224 9027 FSPA* 0 0 15 1618 flow=From-Botnet-V2-TCP-Established 1970/01/14 20:49:48.574793 3.001960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:49:55.582655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:50:03.603756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:50:19.606799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:50:51.612823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:56:55.619381 3.001220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 20:57:02.626612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:57:10.627939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:57:26.630923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 20:57:58.636844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:00:20.721758 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 21:00:20.721850 0.179816 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:20.902079 0.174009 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:21.076698 0.171278 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:21.248427 0.000000 udp 10.0.2.105 7010 -> 27.140.57.98 4240 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 21:00:36.976762 0.031550 tcp 10.0.2.105 54323 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:00:37.008649 0.071319 tcp 10.0.2.105 54324 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:00:37.080358 0.155052 tcp 10.0.2.105 54325 -> 195.113.214.236 443 SRPA* 0 0 47 41680 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:00:37.236170 0.153928 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:37.390482 0.020352 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:37.411130 0.519504 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:37.931037 0.527444 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:38.458886 0.144738 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:38.603990 0.190129 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:38.794533 0.223260 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.018136 0.121069 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.139619 0.136584 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.276682 0.135996 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.413060 0.145760 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.559166 0.165714 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.725310 0.143094 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.868760 0.037468 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:39.906631 0.303368 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.210360 0.030565 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.241292 0.115555 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.357219 0.188598 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.546240 0.151527 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.698083 0.097495 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.796009 0.034865 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:40.831236 0.421831 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:41.253462 0.239444 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:41.493295 0.060758 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:41.554439 0.111026 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:41.665859 0.142412 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:41.808710 0.360463 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:42.169500 0.131318 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:42.301281 0.187484 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:00:42.489150 0.165094 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:04:02.643681 3.001228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:04:09.650302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:04:17.652070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:04:33.655022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:05:05.661069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:11:09.666942 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:11:16.674303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:11:24.676121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:11:40.679294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:12:12.684958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:14:13.449413 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 21:14:13.449601 1.015929 tcp 10.0.2.105 54326 -> 128.255.183.224 9027 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:18:16.691008 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:18:23.698301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:18:31.699858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:18:47.703102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:19:19.708944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:25:23.715533 3.001014 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:25:30.722109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:25:38.723778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:25:54.726603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:26:26.732647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:31:10.080429 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 21:31:10.080581 0.165621 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:10.246602 0.184588 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:10.431591 0.185157 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:10.617104 1.038989 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:11.656708 0.154146 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:11.811252 0.020093 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:11.831635 0.142843 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:11.974813 0.144697 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:12.119941 0.188847 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:12.309211 0.269919 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:12.579501 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 21:31:30.591625 0.051692 tcp 10.0.2.105 54327 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:30.643597 0.066044 tcp 10.0.2.105 54328 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:30.709931 0.161953 tcp 10.0.2.105 54329 -> 195.113.214.236 443 SRPA* 0 0 42 22136 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:30.872637 0.136078 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.009066 0.131421 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.140896 0.147607 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.288934 0.166808 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.456073 0.139457 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.595955 0.039716 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.636064 0.296577 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.933106 0.030495 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:31.964008 0.120869 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.085234 0.088129 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.173691 0.034640 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.208722 0.338139 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.547247 0.192021 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.739631 0.152590 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:32.892600 0.216857 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:33.109838 0.070775 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:33.181009 0.116200 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:33.297604 0.141161 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:33.439178 0.000000 udp 10.0.2.105 7010 -> 218.16.58.52 8886 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 21:31:51.911193 0.051909 tcp 10.0.2.105 54330 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:51.963396 0.073816 tcp 10.0.2.105 54331 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:52.037563 0.161328 tcp 10.0.2.105 54332 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:31:52.199571 0.134349 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:52.334314 0.135652 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:31:52.470302 0.255048 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/14 21:32:30.739411 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 21:32:37.746163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:32:45.747818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:33:01.751073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:33:33.757207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:39:37.763678 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:39:44.770313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:39:52.771702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:40:08.774970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:40:40.780986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:44:14.468517 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 21:44:14.468807 1.068858 tcp 10.0.2.105 54333 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/14 21:46:44.787036 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:46:51.794016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:46:59.795644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:47:15.799013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:47:47.804495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:53:51.811482 3.000742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 21:53:58.817852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:54:06.820097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:54:22.842692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 21:54:54.848530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:00:58.855249 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:01:05.862309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:01:13.863749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:01:29.866980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:02:01.872687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:02:15.062723 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 22:02:15.062928 0.121491 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:15.184862 0.338229 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:15.523495 0.170978 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:15.694872 0.288962 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:15.984233 0.163332 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.147979 0.139485 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.287882 0.144785 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.433097 0.189927 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.623412 0.020262 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.644019 0.154582 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:16.798988 2.482391 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:19.281729 0.211646 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:19.493757 0.145554 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:19.639672 0.138345 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:19.778458 0.138404 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:19.917282 0.141269 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.058928 0.044396 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.103702 0.291361 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.395538 0.037363 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.433234 0.115518 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.549115 0.092376 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.642019 0.034221 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.676602 0.172699 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:20.849656 0.164682 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:21.014746 0.245761 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:21.260876 0.091283 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:21.352665 0.108902 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:21.462021 0.677443 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:22.139954 0.186186 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:22.326538 0.135249 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:22.462279 0.133270 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:22.595899 0.135397 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:02:22.731708 0.201627 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:08:05.878712 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:08:12.885953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:08:20.887532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:08:36.890608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:09:08.896771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:14:15.538029 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 22:14:15.538123 0.970326 tcp 10.0.2.105 54334 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/14 22:15:12.903045 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:15:19.910049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:15:27.912457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:15:43.914545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:16:15.920358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:22:19.927045 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:22:26.943880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:22:34.945687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:22:50.948513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:23:22.954736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:29:26.961043 3.001161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:29:33.968282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:29:41.969366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:29:57.972455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:30:29.978333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:32:23.802554 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 22:32:23.802673 0.124394 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:23.927443 0.275706 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.203578 0.171725 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.375704 0.225213 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.601348 0.163484 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.765237 0.138930 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.904708 0.020094 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:24.925169 0.154581 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:25.080112 0.145053 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:25.225511 0.186547 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:25.412494 0.580323 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:25.993156 0.208203 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.201705 0.148262 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.350331 0.139234 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.489983 0.136612 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.627031 0.139734 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.767204 0.039504 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.807029 0.158942 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:26.966342 0.095565 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.062283 0.037538 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.100409 0.172384 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.273187 0.161627 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.435193 0.219824 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.655429 0.288701 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.944554 0.031012 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:27.975981 0.067447 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:28.043786 0.116269 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:28.160444 0.324512 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:28.485363 0.185148 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:28.670937 0.134614 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:28.805962 0.273405 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:29.079791 0.135218 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:32:29.215417 0.131708 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 22:36:33.984431 3.011720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:36:41.002045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:36:49.003212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:37:05.006943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:37:37.012761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:43:41.019215 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:43:48.026152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:43:56.027488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:44:12.030316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:44:16.507912 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 22:44:16.508078 0.977113 tcp 10.0.2.105 54335 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/14 22:44:44.036400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:50:48.063859 3.030221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:50:55.099937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:51:03.101479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:51:19.104538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:51:51.110519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:57:55.117500 3.000554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 22:58:02.124116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:58:10.125692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:58:26.128343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 22:58:58.134357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:02:56.107028 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:02:56.107168 0.120405 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:56.227964 0.325256 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:56.553591 0.169011 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:56.723015 0.214108 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:56.937539 0.162168 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.100062 0.138620 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.239093 0.020480 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.259932 0.154554 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.414846 0.144908 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.560141 0.321220 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:57.881757 0.147191 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:58.029356 0.179990 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:58.209762 0.894696 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.104860 0.137585 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.242873 0.134065 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.377321 0.141483 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.519253 0.039219 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.558857 0.114085 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.673294 0.097217 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.770886 0.049809 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.821030 0.176471 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:02:59.997895 0.282239 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:00.280707 0.037389 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:00.318535 1.507270 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:01.826183 0.117859 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:01.944457 0.157336 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:02.102194 0.283952 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:02.386553 0.335670 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:02.722635 0.211503 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:02.934560 0.135217 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:03.070126 0.210375 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:03.280879 0.141128 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:03:03.422385 0.139338 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:05:02.141563 3.001029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:05:09.148468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:05:17.149772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:05:33.152203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:06:05.158563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:12:09.165397 3.000467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:12:16.171921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:12:24.173765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:12:40.176168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:13:12.182480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:14:17.486854 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:14:17.486961 0.994310 tcp 10.0.2.105 54336 -> 128.255.183.224 9027 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:19:16.189070 3.091380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:19:23.286402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:19:31.287740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:19:47.290246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:20:19.296485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:26:23.303049 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:26:30.310027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:26:38.311411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:26:54.314190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:27:26.320695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:33:24.505859 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:33:24.505965 0.122005 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:24.628560 0.178290 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:24.807209 0.165715 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:24.973343 0.278779 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:25.252654 0.020338 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:25.273312 0.328218 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:25.601953 0.166468 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:25.768805 0.153559 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:25.922806 0.151420 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.074638 0.252473 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.327540 0.148833 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.476706 0.178914 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.656031 0.148575 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.804978 0.139723 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:26.945126 0.134733 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.080259 0.141171 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.222097 0.043056 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.265578 0.113588 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.379564 0.093178 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.473550 0.034310 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.508403 0.167466 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.676401 0.298419 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:27.975228 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/14 23:33:30.326398 3.001727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:33:37.333635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:33:43.485293 0.051390 tcp 10.0.2.105 54337 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:33:43.536995 0.073885 tcp 10.0.2.105 54338 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:33:43.611230 0.167767 tcp 10.0.2.105 54339 -> 195.113.214.236 443 SRPA* 0 0 53 33172 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:33:43.778305 0.152403 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:43.931079 0.065955 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:43.997431 0.116439 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:44.114277 0.220572 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:44.335174 0.323687 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:44.659233 0.183735 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:44.843415 0.147041 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:44.990889 0.171339 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:45.162642 0.141351 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:45.304586 0.130985 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/14 23:33:45.335709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:34:01.338653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:34:33.344188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:40:37.351450 3.111076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/14 23:40:44.468178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:40:52.469647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:41:08.472533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:41:40.478796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:44:18.576314 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:44:18.576526 0.614144 tcp 10.0.2.105 54340 -> 128.255.183.224 9027 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:18.868166 0.052862 tcp 10.0.2.105 54341 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:18.921372 0.074298 tcp 10.0.2.105 54342 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:18.995953 0.166554 tcp 10.0.2.105 54343 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:19.190885 2.999867 tcp 10.0.2.105 54344 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:44:28.189612 0.000000 tcp 10.0.2.105 54344 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:44:34.188931 0.051567 tcp 10.0.2.105 54345 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.240782 0.066158 tcp 10.0.2.105 54346 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.307295 0.190384 tcp 10.0.2.105 54347 -> 195.113.214.236 443 SRPA* 0 0 40 31062 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.537833 0.475661 tcp 10.0.2.105 54348 -> 82.211.142.218 9811 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.646780 0.053641 tcp 10.0.2.105 54349 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.700720 0.071825 tcp 10.0.2.105 54350 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:34.772879 0.181116 tcp 10.0.2.105 54351 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:35.013806 3.000339 tcp 10.0.2.105 54352 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:44:44.012174 0.000000 tcp 10.0.2.105 54352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:44:50.011889 0.052244 tcp 10.0.2.105 54353 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:50.064012 0.070956 tcp 10.0.2.105 54354 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:50.135342 0.178476 tcp 10.0.2.105 54355 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:50.333992 0.289466 tcp 10.0.2.105 54356 -> 128.255.183.224 9027 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:44:50.623695 2.992880 tcp 10.0.2.105 54357 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:44:59.624591 0.000000 tcp 10.0.2.105 54357 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:45:05.623950 0.257243 tcp 10.0.2.105 54358 -> 82.211.142.218 9811 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:45:05.881395 2.996537 tcp 10.0.2.105 54359 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:45:14.876520 0.000000 tcp 10.0.2.105 54359 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:47:44.485275 3.000968 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 23:47:51.492162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:47:59.493479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:48:15.496513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:48:47.502752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:50:20.877686 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:50:20.877850 3.003427 tcp 10.0.2.105 54360 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:50:29.879622 0.000000 tcp 10.0.2.105 54360 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:50:35.879999 0.053097 tcp 10.0.2.105 54361 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:35.933390 0.070331 tcp 10.0.2.105 54362 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:36.004062 0.297724 tcp 10.0.2.105 54363 -> 195.113.214.236 443 SRPA* 0 0 40 21962 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:36.382718 0.697109 tcp 10.0.2.105 54364 -> 128.255.183.224 9027 FSPA* 0 0 13 1213 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:36.686542 0.053224 tcp 10.0.2.105 54365 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:36.740003 0.074426 tcp 10.0.2.105 54366 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:36.814709 0.170721 tcp 10.0.2.105 54367 -> 195.113.214.236 443 SRPA* 0 0 34 19458 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:37.079994 3.004404 tcp 10.0.2.105 54368 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:50:46.082840 0.000000 tcp 10.0.2.105 54368 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:50:52.082275 0.052131 tcp 10.0.2.105 54369 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.134727 0.072241 tcp 10.0.2.105 54370 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.207241 0.170241 tcp 10.0.2.105 54371 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.554396 0.611705 tcp 10.0.2.105 54372 -> 82.211.142.218 9811 FSPA* 0 0 13 1213 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.662625 0.053394 tcp 10.0.2.105 54373 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.716352 0.235220 tcp 10.0.2.105 54374 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:52.951943 0.172016 tcp 10.0.2.105 54375 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:50:53.166276 2.991451 tcp 10.0.2.105 54376 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:51:02.155881 0.000000 tcp 10.0.2.105 54376 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:51:08.165136 0.290618 tcp 10.0.2.105 54377 -> 128.255.183.224 9027 FSPA* 0 0 13 1213 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:51:08.455581 2.994117 tcp 10.0.2.105 54378 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:51:17.448072 0.000000 tcp 10.0.2.105 54378 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:51:23.456800 0.125743 tcp 10.0.2.105 54379 -> 82.211.142.218 9811 FSPA* 0 0 13 1213 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:54:51.569162 3.000976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/14 23:54:58.576155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:55:06.577717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:55:22.580674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:55:54.586566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/14 23:56:23.578533 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/14 23:56:23.578640 3.004074 tcp 10.0.2.105 54380 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:56:32.581360 0.000000 tcp 10.0.2.105 54380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:56:38.582149 0.055122 tcp 10.0.2.105 54381 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:38.637494 0.073504 tcp 10.0.2.105 54382 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:38.711292 0.174178 tcp 10.0.2.105 54383 -> 195.113.214.236 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:38.944488 0.611537 tcp 10.0.2.105 54384 -> 128.255.183.224 9027 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:39.220986 0.050844 tcp 10.0.2.105 54385 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:39.272157 0.074707 tcp 10.0.2.105 54386 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:39.347268 0.178034 tcp 10.0.2.105 54387 -> 195.113.214.236 443 SRPA* 0 0 24 12636 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:39.556424 3.009197 tcp 10.0.2.105 54388 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:56:48.563998 0.000000 tcp 10.0.2.105 54388 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:56:54.553172 0.051275 tcp 10.0.2.105 54389 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:54.604765 0.075931 tcp 10.0.2.105 54390 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:54.680538 0.173368 tcp 10.0.2.105 54391 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:54.928546 0.440253 tcp 10.0.2.105 54392 -> 82.211.142.218 9811 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:55.039160 0.051578 tcp 10.0.2.105 54393 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:55.091070 0.071006 tcp 10.0.2.105 54394 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:55.162399 0.169253 tcp 10.0.2.105 54395 -> 195.113.214.236 443 SRPA* 0 0 36 19688 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:56:55.369013 2.999040 tcp 10.0.2.105 54396 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:57:04.366960 0.000000 tcp 10.0.2.105 54396 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:57:10.365615 0.147517 tcp 10.0.2.105 54397 -> 128.255.183.224 9027 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:57:40.509217 0.148690 tcp 10.0.2.105 54397 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/14 23:57:40.509457 3.003578 tcp 10.0.2.105 54398 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:57:49.512134 0.000000 tcp 10.0.2.105 54398 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/14 23:57:55.510740 0.122672 tcp 10.0.2.105 54399 -> 82.211.142.218 9811 FSPA* 0 0 13 1311 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:01:58.593387 3.000837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:02:05.600422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:02:13.601301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:02:29.604261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:02:55.632569 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:02:55.632757 0.396390 tcp 10.0.2.105 54400 -> 128.255.183.224 9027 SPA_* 0 0 9 1042 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:01.610522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:03:16.515729 2.774001 tcp 10.0.2.105 54400 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:16.518115 0.687492 tcp 10.0.2.105 54401 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:17.205846 0.627293 tcp 10.0.2.105 54402 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:17.833467 1.437983 tcp 10.0.2.105 54403 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:19.289958 3.000188 tcp 10.0.2.105 54404 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:03:28.289088 0.000000 tcp 10.0.2.105 54404 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:03:34.288014 0.693030 tcp 10.0.2.105 54405 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:34.981384 0.653850 tcp 10.0.2.105 54406 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:35.635572 1.426170 tcp 10.0.2.105 54407 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:37.072833 3.175954 tcp 10.0.2.105 54408 -> 82.211.142.218 9811 FSPA* 0 0 13 1258 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:37.660427 0.620508 tcp 10.0.2.105 54409 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:38.281357 0.628724 tcp 10.0.2.105 54410 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:38.910568 1.327879 tcp 10.0.2.105 54411 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:40.248976 0.953840 tcp 10.0.2.105 54412 -> 128.255.183.224 9027 FSPA* 0 0 13 1258 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:03:41.203042 2.998809 tcp 10.0.2.105 54413 -> 188.129.229.41 9120 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:03:50.200651 0.000000 tcp 10.0.2.105 54413 -> 188.129.229.41 9120 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:03:56.199380 0.581602 tcp 10.0.2.105 54414 -> 82.211.142.218 9811 FSPA* 0 0 13 1258 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:00.425826 0.321207 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:00.732215 0.493111 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:01.213486 0.422227 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:01.636794 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:04:17.931375 0.600322 tcp 10.0.2.105 54415 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:18.532008 0.644283 tcp 10.0.2.105 54416 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:19.176605 1.306892 tcp 10.0.2.105 54417 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:20.484192 0.250351 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:20.736890 0.414005 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:21.152209 0.378593 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:21.527203 0.451159 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:21.989796 0.640419 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:22.812137 0.436633 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:23.211510 0.348530 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:23.553799 0.298586 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:23.832736 0.000000 udp 10.0.2.105 7010 -> 70.54.32.137 3419 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:04:42.757136 0.346791 tcp 10.0.2.105 54418 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:43.104241 0.337296 tcp 10.0.2.105 54419 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:43.441833 0.466628 tcp 10.0.2.105 54420 -> 195.113.214.236 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:04:43.909044 0.248865 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:44.189514 0.211902 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:44.377421 0.101730 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:44.467037 0.162546 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:04:44.628286 0.223391 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 5 2213 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:02.485099 0.713581 tcp 10.0.2.105 54421 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:03.198945 0.685602 tcp 10.0.2.105 54422 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:03.884801 1.379417 tcp 10.0.2.105 54423 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:05.265402 0.438754 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:05.701575 0.570401 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:06.291219 0.511039 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:06.696703 0.279787 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:06.971622 0.586540 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:07.446265 0.447512 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:07.890556 0.426554 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:08.299673 0.000000 udp 10.0.2.105 7010 -> 98.116.167.80 7083 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:05:24.276730 0.725360 tcp 10.0.2.105 54424 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:25.002371 0.716831 tcp 10.0.2.105 54425 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:25.719484 1.492976 tcp 10.0.2.105 54426 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:27.213097 0.446904 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:27.658608 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:05:42.822797 0.734250 tcp 10.0.2.105 54427 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:43.557331 0.704187 tcp 10.0.2.105 54428 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:44.261755 1.233749 tcp 10.0.2.105 54429 -> 195.113.214.236 443 SRPA* 0 0 27 11858 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:05:45.494387 0.543369 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:46.024092 0.504013 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:46.520516 0.493515 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:46.987721 0.369564 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:05:47.376352 0.345629 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:08:56.781738 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:08:56.781836 3.160182 tcp 10.0.2.105 54430 -> 94.137.168.16 9773 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:08:57.353356 0.577418 tcp 10.0.2.105 54431 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:08:57.930972 0.618320 tcp 10.0.2.105 54432 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:08:58.549567 1.248384 tcp 10.0.2.105 54433 -> 195.113.214.236 443 SRPA* 0 0 22 11400 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:08:59.942199 2.998225 tcp 10.0.2.105 54434 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:05.616759 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:09:08.938529 0.000000 tcp 10.0.2.105 54434 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:12.624386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:09:14.938340 0.668669 tcp 10.0.2.105 54435 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:15.607302 0.551330 tcp 10.0.2.105 54436 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:16.158912 1.405362 tcp 10.0.2.105 54437 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:17.585920 3.009780 tcp 10.0.2.105 54438 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:20.625693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:09:26.593858 0.000000 tcp 10.0.2.105 54438 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:32.583243 0.218295 tcp 10.0.2.105 54439 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:32.801798 0.267320 tcp 10.0.2.105 54440 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:33.069471 0.545877 tcp 10.0.2.105 54441 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:33.628771 2.999405 tcp 10.0.2.105 54442 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:36.628456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:09:42.627368 0.000000 tcp 10.0.2.105 54442 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:48.626211 0.142915 tcp 10.0.2.105 54443 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:48.769408 0.163995 tcp 10.0.2.105 54444 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:48.933650 0.388337 tcp 10.0.2.105 54445 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:49.333707 0.242323 tcp 10.0.2.105 54446 -> 94.137.168.16 9773 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:09:49.576571 3.004893 tcp 10.0.2.105 54447 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:09:58.579961 0.000000 tcp 10.0.2.105 54447 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:10:04.568825 3.004194 tcp 10.0.2.105 54448 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:10:08.634934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:10:13.571332 0.000000 tcp 10.0.2.105 54448 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:10:18.138269 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:10:19.570122 3.004295 tcp 10.0.2.105 54449 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:10:28.573569 0.000000 tcp 10.0.2.105 54449 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:15:34.573608 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:15:34.573709 3.543658 tcp 10.0.2.105 54450 -> 94.137.168.16 9773 FSPA* 0 0 13 1277 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:35.367408 0.633695 tcp 10.0.2.105 54451 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:36.001485 0.694042 tcp 10.0.2.105 54452 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:36.695383 1.351785 tcp 10.0.2.105 54453 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:38.117624 3.004614 tcp 10.0.2.105 54454 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:15:47.121343 0.000000 tcp 10.0.2.105 54454 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:15:53.110314 0.610582 tcp 10.0.2.105 54455 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:53.721241 0.620412 tcp 10.0.2.105 54456 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:54.341974 1.327416 tcp 10.0.2.105 54457 -> 195.113.214.236 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:15:55.702737 2.995216 tcp 10.0.2.105 54458 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:04.696700 0.000000 tcp 10.0.2.105 54458 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:10.695619 0.737627 tcp 10.0.2.105 54459 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:11.433646 0.635094 tcp 10.0.2.105 54460 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:12.069052 1.397798 tcp 10.0.2.105 54461 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:12.640513 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:16:13.478938 2.994276 tcp 10.0.2.105 54462 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:19.648166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:16:22.472165 0.000000 tcp 10.0.2.105 54462 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:27.649637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:16:28.481500 0.716111 tcp 10.0.2.105 54463 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:29.197939 0.663837 tcp 10.0.2.105 54464 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:29.862074 1.352576 tcp 10.0.2.105 54465 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:31.375104 0.764950 tcp 10.0.2.105 54466 -> 94.137.168.16 9773 FSPA* 0 0 13 1277 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:16:32.140436 2.999503 tcp 10.0.2.105 54467 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:41.139147 0.000000 tcp 10.0.2.105 54467 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:43.652285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:16:47.137794 3.003943 tcp 10.0.2.105 54468 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:16:56.140359 0.000000 tcp 10.0.2.105 54468 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:17:01.137357 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:17:02.139362 3.004094 tcp 10.0.2.105 54469 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:17:11.141962 0.000000 tcp 10.0.2.105 54469 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:17:15.658677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:22:17.142896 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:22:17.142999 3.083457 tcp 10.0.2.105 54470 -> 94.137.168.16 9773 FSPA* 0 0 13 1431 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:17.768247 0.626817 tcp 10.0.2.105 54471 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:18.395338 0.575530 tcp 10.0.2.105 54472 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:18.971230 1.179867 tcp 10.0.2.105 54473 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:20.226634 3.003767 tcp 10.0.2.105 54474 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:22:29.229546 0.000000 tcp 10.0.2.105 54474 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:22:35.228594 0.355964 tcp 10.0.2.105 54475 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:35.584816 0.375122 tcp 10.0.2.105 54476 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:35.960269 0.809451 tcp 10.0.2.105 54477 -> 195.113.214.236 443 SRPA* 0 0 31 13616 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:36.793266 3.001580 tcp 10.0.2.105 54478 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:22:45.793279 0.000000 tcp 10.0.2.105 54478 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:22:51.792704 0.650540 tcp 10.0.2.105 54479 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:52.443495 0.702437 tcp 10.0.2.105 54480 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:53.146271 0.684043 tcp 10.0.2.105 54481 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:22:53.855735 2.993714 tcp 10.0.2.105 54482 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:02.848047 0.000000 tcp 10.0.2.105 54482 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:08.856777 0.752451 tcp 10.0.2.105 54483 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:23:09.609543 0.685726 tcp 10.0.2.105 54484 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:23:10.295521 1.388650 tcp 10.0.2.105 54485 -> 195.113.214.236 443 SRPA* 0 0 21 13038 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:23:11.706180 0.598217 tcp 10.0.2.105 54486 -> 94.137.168.16 9773 FSPA* 0 0 13 1431 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:23:12.304135 3.001766 tcp 10.0.2.105 54487 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:19.664448 3.002152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:23:21.304431 0.000000 tcp 10.0.2.105 54487 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:26.671762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:23:27.303215 2.993996 tcp 10.0.2.105 54488 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:34.673368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:23:36.305721 0.000000 tcp 10.0.2.105 54488 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:41.142548 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:23:42.304376 2.994182 tcp 10.0.2.105 54489 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:23:50.676257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:23:51.297064 0.000000 tcp 10.0.2.105 54489 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:24:22.682546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:28:57.308208 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:28:57.308326 0.606579 tcp 10.0.2.105 54490 -> 94.137.168.16 9773 FSPA* 0 0 13 1374 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:28:57.438010 0.063800 tcp 10.0.2.105 54491 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:28:57.501661 0.091986 tcp 10.0.2.105 54492 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:28:57.593531 0.203847 tcp 10.0.2.105 54493 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:28:57.915177 2.997337 tcp 10.0.2.105 54494 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:06.911028 0.000000 tcp 10.0.2.105 54494 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:12.910680 0.066947 tcp 10.0.2.105 54495 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:12.977933 0.086312 tcp 10.0.2.105 54496 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:13.064518 0.211556 tcp 10.0.2.105 54497 -> 195.113.214.236 443 SRPA* 0 0 18 7306 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:13.359445 3.004938 tcp 10.0.2.105 54498 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:22.363677 0.000000 tcp 10.0.2.105 54498 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:28.352730 0.131492 tcp 10.0.2.105 54499 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:28.484506 0.085769 tcp 10.0.2.105 54500 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:28.570594 0.207247 tcp 10.0.2.105 54501 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:28.860398 2.996268 tcp 10.0.2.105 54502 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:37.865959 0.000000 tcp 10.0.2.105 54502 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:43.854836 0.059827 tcp 10.0.2.105 54503 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:43.914969 0.078342 tcp 10.0.2.105 54504 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:43.993647 0.186051 tcp 10.0.2.105 54505 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:44.307922 0.116861 tcp 10.0.2.105 54506 -> 94.137.168.16 9773 FSPA* 0 0 13 1374 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:29:44.425032 2.994364 tcp 10.0.2.105 54507 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:53.418207 0.000000 tcp 10.0.2.105 54507 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:29:59.427126 3.003788 tcp 10.0.2.105 54508 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:30:08.429633 0.000000 tcp 10.0.2.105 54508 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:30:13.136664 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:30:14.428588 3.003661 tcp 10.0.2.105 54509 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:30:23.431151 0.000000 tcp 10.0.2.105 54509 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:30:26.688761 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:30:33.695857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:30:41.697893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:30:57.700385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:31:29.706852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:35:57.401576 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:35:57.401791 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:36:14.918652 1.223743 tcp 10.0.2.105 54510 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:16.142636 1.216105 tcp 10.0.2.105 54511 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:17.358596 2.629354 tcp 10.0.2.105 54512 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:19.988520 0.000000 udp 10.0.2.105 7010 -> 70.54.32.137 3419 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:36:35.987582 1.435637 tcp 10.0.2.105 54513 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:37.423061 0.739020 tcp 10.0.2.105 54514 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:38.162414 1.727916 tcp 10.0.2.105 54515 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:39.890921 0.446980 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1343 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:36:40.333885 0.000000 udp 10.0.2.105 7010 -> 98.116.167.80 7083 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 00:36:44.439321 0.830925 tcp 10.0.2.105 54516 -> 211.38.175.27 4598 SPA_* 0 0 9 1041 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:58.520132 1.338718 tcp 10.0.2.105 54517 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:36:59.858791 1.394331 tcp 10.0.2.105 54518 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:01.253482 2.439538 tcp 10.0.2.105 54519 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:03.692864 0.775221 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:04.463388 0.709254 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:05.159404 0.903306 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:06.063136 0.934939 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1368 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:06.187617 0.000139 tcp 10.0.2.105 54516 -> 211.38.175.27 4598 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:06.188338 1.236627 tcp 10.0.2.105 54520 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:07.013259 0.651165 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:07.425196 1.282159 tcp 10.0.2.105 54521 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:07.664806 0.644576 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:08.330349 0.793229 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:08.707637 2.746356 tcp 10.0.2.105 54522 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:09.124008 0.795314 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 4 1349 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:09.917856 0.907340 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:10.780101 0.907121 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 3 1248 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:11.469312 0.000046 tcp 10.0.2.105 54516 -> 211.38.175.27 4598 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:11.469578 1.747016 tcp 10.0.2.105 54523 -> 211.38.175.27 4598 FSPA* 0 0 13 1257 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:28.132426 1.150454 tcp 10.0.2.105 54524 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:29.283236 1.224059 tcp 10.0.2.105 54525 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:30.507538 2.869880 tcp 10.0.2.105 54526 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:37:33.378031 0.724638 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:33.712485 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:37:34.100283 0.460662 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 3 770 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:34.555264 0.654660 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:35.210306 0.669653 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:35.880414 0.676048 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:36.556910 0.597832 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:37.155156 0.886814 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:38.059781 0.825138 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:38.885291 0.816373 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:39.582693 0.604981 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:40.188060 0.616951 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:40.719789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:37:40.805415 0.677816 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:41.483679 0.728837 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:42.104961 0.712281 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:42.817615 0.744094 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:43.562134 0.800161 udp 10.0.2.105 7010 <-> 72.201.209.113 1245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:44.362737 0.705255 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:45.068403 0.929957 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:45.954292 0.746450 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 00:37:48.721195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:38:04.724194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:38:36.730114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:42:13.212778 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:42:13.212892 3.209204 tcp 10.0.2.105 54527 -> 94.137.168.16 9773 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:13.966718 0.641328 tcp 10.0.2.105 54528 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:14.608509 0.556579 tcp 10.0.2.105 54529 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:15.165403 1.243500 tcp 10.0.2.105 54530 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:16.422244 2.998440 tcp 10.0.2.105 54531 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:42:25.419377 0.000000 tcp 10.0.2.105 54531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:42:31.418581 0.583384 tcp 10.0.2.105 54532 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:32.002279 0.504057 tcp 10.0.2.105 54533 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:32.506172 1.139775 tcp 10.0.2.105 54534 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:33.656172 2.999356 tcp 10.0.2.105 54535 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:42:42.654027 0.000000 tcp 10.0.2.105 54535 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:42:48.653300 0.433199 tcp 10.0.2.105 54536 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:49.086356 0.502378 tcp 10.0.2.105 54537 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:49.588586 1.020528 tcp 10.0.2.105 54538 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:42:50.620966 2.989123 tcp 10.0.2.105 54539 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:42:59.608511 0.000000 tcp 10.0.2.105 54539 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:05.617780 0.547562 tcp 10.0.2.105 54540 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:06.165635 0.533492 tcp 10.0.2.105 54541 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:06.699419 0.561870 tcp 10.0.2.105 54542 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:07.284360 2.999483 tcp 10.0.2.105 54543 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:16.282010 0.000000 tcp 10.0.2.105 54543 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:22.281707 0.296246 tcp 10.0.2.105 54544 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:22.578253 0.262746 tcp 10.0.2.105 54545 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:22.841384 0.703307 tcp 10.0.2.105 54546 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:23.567519 2.618685 tcp 10.0.2.105 54547 -> 211.38.175.27 4598 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:24.527231 0.398641 tcp 10.0.2.105 54548 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:24.926185 0.373029 tcp 10.0.2.105 54549 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:25.299500 0.834361 tcp 10.0.2.105 54550 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:26.186480 2.336560 tcp 10.0.2.105 54551 -> 184.182.240.239 7058 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:26.747955 0.390428 tcp 10.0.2.105 54552 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:27.138802 0.427722 tcp 10.0.2.105 54553 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:27.566844 0.940347 tcp 10.0.2.105 54554 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:28.523184 2.890333 tcp 10.0.2.105 54555 -> 200.84.7.244 8038 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:29.346814 0.414974 tcp 10.0.2.105 54556 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:29.761573 0.519832 tcp 10.0.2.105 54557 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:30.281742 1.117798 tcp 10.0.2.105 54558 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:31.413698 2.994375 tcp 10.0.2.105 54559 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:40.406973 0.000000 tcp 10.0.2.105 54559 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:46.406359 0.612772 tcp 10.0.2.105 54560 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:47.019379 0.433496 tcp 10.0.2.105 54561 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:47.453168 0.823130 tcp 10.0.2.105 54562 -> 195.113.214.236 443 SRPA* 0 0 32 14296 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:48.325616 0.376423 tcp 10.0.2.105 54563 -> 94.137.168.16 9773 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:43:48.702280 3.000972 tcp 10.0.2.105 54564 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:43:57.702083 0.000000 tcp 10.0.2.105 54564 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:03.701039 3.003451 tcp 10.0.2.105 54565 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:12.703395 0.000000 tcp 10.0.2.105 54565 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:17.640206 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:44:18.701958 2.994619 tcp 10.0.2.105 54566 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:27.704680 0.000000 tcp 10.0.2.105 54566 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:33.703786 2.993971 tcp 10.0.2.105 54567 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:40.736652 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:44:41.634699 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:44:42.696398 0.000000 tcp 10.0.2.105 54567 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:47.743585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:44:48.705051 1.033207 tcp 10.0.2.105 54568 -> 211.38.175.27 4598 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:44:49.738475 0.709273 tcp 10.0.2.105 54569 -> 184.182.240.239 7058 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:44:50.447657 0.680222 tcp 10.0.2.105 54570 -> 200.84.7.244 8038 FSPA* 0 0 13 1295 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:44:51.128085 3.004901 tcp 10.0.2.105 54571 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:44:55.745584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:45:00.131916 0.000000 tcp 10.0.2.105 54571 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:45:11.748209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:45:43.754199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:50:06.122021 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:50:06.122195 1.610666 tcp 10.0.2.105 54572 -> 94.137.168.16 9773 FSPA* 0 0 11 1297 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:06.506512 0.329895 tcp 10.0.2.105 54573 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:06.836698 0.267845 tcp 10.0.2.105 54574 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:07.104829 0.614415 tcp 10.0.2.105 54575 -> 195.113.214.236 443 SRPA* 0 0 24 15480 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:07.733046 2.995045 tcp 10.0.2.105 54576 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:16.727074 0.000000 tcp 10.0.2.105 54576 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:22.726192 0.647467 tcp 10.0.2.105 54577 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:23.373996 0.674991 tcp 10.0.2.105 54578 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:24.049321 1.332238 tcp 10.0.2.105 54579 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:25.392370 3.000902 tcp 10.0.2.105 54580 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:34.392302 0.000000 tcp 10.0.2.105 54580 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:40.391655 0.668273 tcp 10.0.2.105 54581 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:41.060221 0.532260 tcp 10.0.2.105 54582 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:41.592741 1.249485 tcp 10.0.2.105 54583 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:42.860033 2.988537 tcp 10.0.2.105 54584 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:51.847682 0.000000 tcp 10.0.2.105 54584 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:50:57.856726 0.391232 tcp 10.0.2.105 54585 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:58.248239 0.470488 tcp 10.0.2.105 54586 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:58.718815 0.988327 tcp 10.0.2.105 54587 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:50:59.758182 3.004510 tcp 10.0.2.105 54588 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:08.761612 0.000000 tcp 10.0.2.105 54588 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:14.750960 0.636319 tcp 10.0.2.105 54589 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:15.387557 0.683849 tcp 10.0.2.105 54590 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:16.071694 1.372134 tcp 10.0.2.105 54591 -> 195.113.214.236 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:17.471927 2.866017 tcp 10.0.2.105 54592 -> 211.38.175.27 4598 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:18.828395 0.077415 tcp 10.0.2.105 54593 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:18.906076 0.406415 tcp 10.0.2.105 54594 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:19.312787 0.986642 tcp 10.0.2.105 54595 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:20.338125 3.140322 tcp 10.0.2.105 54596 -> 184.182.240.239 7058 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:21.070580 0.544104 tcp 10.0.2.105 54597 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:21.614949 0.563818 tcp 10.0.2.105 54598 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:22.179091 1.202474 tcp 10.0.2.105 54599 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:23.478685 3.049079 tcp 10.0.2.105 54600 -> 200.84.7.244 8038 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:24.395493 0.528219 tcp 10.0.2.105 54601 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:24.923954 0.608590 tcp 10.0.2.105 54602 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:25.532955 0.965170 tcp 10.0.2.105 54603 -> 195.113.214.236 443 SRPA* 0 0 21 11772 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:26.528029 3.003639 tcp 10.0.2.105 54604 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:35.530317 0.000000 tcp 10.0.2.105 54604 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:41.529195 0.626109 tcp 10.0.2.105 54605 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:42.155630 0.254886 tcp 10.0.2.105 54606 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:42.410806 0.930485 tcp 10.0.2.105 54607 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:43.410633 0.569998 tcp 10.0.2.105 54608 -> 94.137.168.16 9773 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:51:43.980519 2.996039 tcp 10.0.2.105 54609 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:47.760872 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:51:52.985457 0.000000 tcp 10.0.2.105 54609 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:51:54.767985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:51:58.974209 2.993781 tcp 10.0.2.105 54610 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:02.769322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:52:07.967047 0.000000 tcp 10.0.2.105 54610 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:12.643523 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:52:13.975534 2.994252 tcp 10.0.2.105 54611 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:18.772522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:52:22.968018 0.000000 tcp 10.0.2.105 54611 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:28.977167 3.004192 tcp 10.0.2.105 54612 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:36.637692 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:52:37.979999 0.000000 tcp 10.0.2.105 54612 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:43.978846 1.308862 tcp 10.0.2.105 54613 -> 211.38.175.27 4598 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:52:45.287980 0.953904 tcp 10.0.2.105 54614 -> 184.182.240.239 7058 FSPA* 0 0 11 1297 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:52:46.242072 1.013271 tcp 10.0.2.105 54615 -> 200.84.7.244 8038 FSPA* 0 0 13 1405 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:52:47.255579 2.991986 tcp 10.0.2.105 54616 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:52:50.778703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:52:56.255888 0.000000 tcp 10.0.2.105 54616 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:02.266437 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 00:58:02.266532 3.431431 tcp 10.0.2.105 54617 -> 94.137.168.16 9773 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:02.956738 0.669853 tcp 10.0.2.105 54618 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:03.626913 0.688539 tcp 10.0.2.105 54619 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:04.315740 1.343348 tcp 10.0.2.105 54620 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:05.698231 3.007327 tcp 10.0.2.105 54621 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:14.704501 0.000000 tcp 10.0.2.105 54621 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:20.693160 0.572589 tcp 10.0.2.105 54622 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:21.265608 0.482550 tcp 10.0.2.105 54623 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:21.748592 1.221915 tcp 10.0.2.105 54624 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:23.221045 2.999516 tcp 10.0.2.105 54625 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:32.219247 0.000000 tcp 10.0.2.105 54625 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:38.218558 0.661857 tcp 10.0.2.105 54626 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:38.880706 0.621295 tcp 10.0.2.105 54627 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:39.502275 0.748411 tcp 10.0.2.105 54628 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:40.432436 3.002716 tcp 10.0.2.105 54629 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:49.433999 0.000000 tcp 10.0.2.105 54629 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:58:54.815292 3.001540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 00:58:55.433161 0.640765 tcp 10.0.2.105 54630 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:56.073812 0.610013 tcp 10.0.2.105 54631 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:56.684066 1.322123 tcp 10.0.2.105 54632 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:58:58.023000 2.997631 tcp 10.0.2.105 54633 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:59:01.822315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:59:07.019344 0.000000 tcp 10.0.2.105 54633 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:59:09.823770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:59:13.018733 0.194257 tcp 10.0.2.105 54634 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:13.213271 0.541434 tcp 10.0.2.105 54635 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:13.754997 1.321657 tcp 10.0.2.105 54636 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:15.198153 0.629418 tcp 10.0.2.105 54637 -> 211.38.175.27 4598 SPA_* 0 0 9 1128 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:25.826112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 00:59:26.443665 2.894690 tcp 10.0.2.105 54637 -> 211.38.175.27 4598 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:26.444532 0.729408 tcp 10.0.2.105 54638 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:27.174189 0.686964 tcp 10.0.2.105 54639 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:27.860943 1.465827 tcp 10.0.2.105 54640 -> 195.113.214.236 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:29.338740 3.154437 tcp 10.0.2.105 54641 -> 184.182.240.239 7058 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:29.998896 0.596993 tcp 10.0.2.105 54642 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:30.595691 0.570481 tcp 10.0.2.105 54643 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:31.166618 1.314885 tcp 10.0.2.105 54644 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:32.493392 3.694881 tcp 10.0.2.105 54645 -> 200.84.7.244 8038 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:33.725064 0.500141 tcp 10.0.2.105 54646 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:34.225063 0.582840 tcp 10.0.2.105 54647 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:34.807767 1.371094 tcp 10.0.2.105 54648 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:36.188500 3.006911 tcp 10.0.2.105 54649 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:59:45.194214 0.000000 tcp 10.0.2.105 54649 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:59:51.183440 0.626480 tcp 10.0.2.105 54650 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:51.810222 0.688023 tcp 10.0.2.105 54651 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:52.498543 1.336275 tcp 10.0.2.105 54652 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:53.846168 0.590418 tcp 10.0.2.105 54653 -> 94.137.168.16 9773 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 00:59:54.436814 3.005277 tcp 10.0.2.105 54654 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 00:59:57.832062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:00:03.440132 0.000000 tcp 10.0.2.105 54654 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:09.429221 3.003929 tcp 10.0.2.105 54655 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:18.431847 0.000000 tcp 10.0.2.105 54655 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:23.148679 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:00:24.430887 3.003777 tcp 10.0.2.105 54656 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:33.433525 0.000000 tcp 10.0.2.105 54656 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:39.432128 3.004357 tcp 10.0.2.105 54657 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:47.153316 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:00:48.445460 0.000000 tcp 10.0.2.105 54657 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:00:54.433930 1.086822 tcp 10.0.2.105 54658 -> 211.38.175.27 4598 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:00:55.520984 0.784900 tcp 10.0.2.105 54659 -> 184.182.240.239 7058 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:00:56.306119 1.103065 tcp 10.0.2.105 54660 -> 200.84.7.244 8038 FSPA* 0 0 11 1236 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:00:57.409408 3.003297 tcp 10.0.2.105 54661 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:01:06.411167 0.000000 tcp 10.0.2.105 54661 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:06:01.838952 3.001001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:06:08.846019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:06:12.411433 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:06:12.411712 0.139948 tcp 10.0.2.105 54662 -> 94.137.168.16 9773 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:16.847395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:06:20.912190 1.327267 tcp 10.0.2.105 54662 -> 94.137.168.16 9773 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:20.914604 0.278146 tcp 10.0.2.105 54663 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:21.193060 0.310781 tcp 10.0.2.105 54664 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:21.503678 0.681699 tcp 10.0.2.105 54665 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:22.239609 3.000013 tcp 10.0.2.105 54666 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:06:31.238094 0.000000 tcp 10.0.2.105 54666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:06:32.850490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:06:37.237159 0.297258 tcp 10.0.2.105 54667 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:37.534396 0.349333 tcp 10.0.2.105 54668 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:37.884019 0.917759 tcp 10.0.2.105 54669 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:38.817816 2.995505 tcp 10.0.2.105 54670 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:06:47.811793 0.000000 tcp 10.0.2.105 54670 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:06:53.810854 0.287377 tcp 10.0.2.105 54671 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:54.098593 0.374664 tcp 10.0.2.105 54672 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:54.473594 0.747408 tcp 10.0.2.105 54673 -> 195.113.214.236 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:06:56.877006 3.002474 tcp 10.0.2.105 54674 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:04.856190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:07:05.878048 0.000000 tcp 10.0.2.105 54674 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:11.876907 0.704134 tcp 10.0.2.105 54675 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:12.581434 0.660090 tcp 10.0.2.105 54676 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:13.241765 1.458392 tcp 10.0.2.105 54677 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:14.742404 3.002482 tcp 10.0.2.105 54678 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:23.743378 0.000000 tcp 10.0.2.105 54678 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:29.742827 0.734097 tcp 10.0.2.105 54679 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:30.477217 0.686673 tcp 10.0.2.105 54680 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:31.164162 1.380710 tcp 10.0.2.105 54681 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:32.615379 3.737129 tcp 10.0.2.105 54682 -> 184.182.240.239 7058 FSPA* 0 0 13 1287 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:33.472530 0.615751 tcp 10.0.2.105 54683 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:34.088852 0.671688 tcp 10.0.2.105 54684 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:34.760823 1.417852 tcp 10.0.2.105 54685 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:36.352766 3.864897 tcp 10.0.2.105 54686 -> 200.84.7.244 8038 FSPA* 0 0 13 1287 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:37.472930 0.652416 tcp 10.0.2.105 54687 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:38.125587 0.682007 tcp 10.0.2.105 54688 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:38.807895 1.385064 tcp 10.0.2.105 54689 -> 195.113.214.236 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:40.217869 3.003807 tcp 10.0.2.105 54690 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:49.219767 0.000000 tcp 10.0.2.105 54690 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:07:55.219669 0.495208 tcp 10.0.2.105 54691 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:55.714781 0.518923 tcp 10.0.2.105 54692 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:56.234003 1.037428 tcp 10.0.2.105 54693 -> 195.113.214.236 443 SRPA* 0 0 24 13392 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:57.355289 0.572337 tcp 10.0.2.105 54694 -> 94.137.168.16 9773 FSPA* 0 0 13 1287 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:07:57.927850 2.999268 tcp 10.0.2.105 54695 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:03.823626 0.573416 udp 10.0.2.105 7010 <-> 218.16.58.52 8886 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:04.409012 0.402966 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:04.812466 0.242257 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:05.038695 0.592756 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:05.627652 0.478090 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:06.094836 0.377753 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:06.473056 0.280209 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 3 793 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:06.778372 0.384653 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:06.935815 0.000000 tcp 10.0.2.105 54695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:07.163435 0.424694 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:07.642579 0.431723 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:08.074671 0.588287 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:08.615877 0.456388 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:09.069996 0.465483 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:09.535867 0.466436 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:09.977870 0.511993 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:10.514990 0.469957 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:10.996833 0.402219 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:11.397356 0.565926 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:12.050665 0.482560 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:12.549555 0.398364 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:12.924052 2.994474 tcp 10.0.2.105 54696 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:12.948335 0.255353 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:13.204109 0.509612 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:13.695692 0.423596 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:14.119761 0.630819 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:14.641029 0.558807 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 4 1493 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:15.199498 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 01:08:21.917069 0.000000 tcp 10.0.2.105 54696 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:26.653736 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:08:27.926190 2.993600 tcp 10.0.2.105 54697 -> 95.104.31.172 9016 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:31.511351 0.172409 tcp 10.0.2.105 54698 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:31.684101 0.439149 tcp 10.0.2.105 54699 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:32.123501 1.119308 tcp 10.0.2.105 54700 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:33.242224 0.000000 udp 10.0.2.105 7010 -> 72.201.209.113 1245 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 01:08:36.918826 0.000000 tcp 10.0.2.105 54697 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:42.927141 3.004243 tcp 10.0.2.105 54701 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:51.800502 0.232523 tcp 10.0.2.105 54702 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:51.929957 0.000000 tcp 10.0.2.105 54701 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:08:52.033354 0.198727 tcp 10.0.2.105 54703 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:52.232405 0.519863 tcp 10.0.2.105 54704 -> 195.113.214.236 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:52.752769 0.240814 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:52.986470 0.454366 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:53.411211 0.232975 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:08:57.929408 0.427441 tcp 10.0.2.105 54705 -> 184.182.240.239 7058 FSPA* 0 0 13 1287 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:58.357034 0.854470 tcp 10.0.2.105 54706 -> 200.84.7.244 8038 FSPA* 0 0 13 1287 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:08:59.211699 3.003582 tcp 10.0.2.105 54707 -> 31.192.7.200 5479 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:09:08.213505 0.000000 tcp 10.0.2.105 54707 -> 31.192.7.200 5479 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:13:08.862855 3.000828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:13:15.869629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:13:23.871520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:13:39.874186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:14:11.880117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:14:14.214242 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:14:14.214420 3.325700 tcp 10.0.2.105 54708 -> 94.137.168.16 9773 FSPA* 0 0 11 1131 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:14.803939 0.655123 tcp 10.0.2.105 54709 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:15.459302 0.661584 tcp 10.0.2.105 54710 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:16.121310 1.404133 tcp 10.0.2.105 54711 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:17.540389 3.002108 tcp 10.0.2.105 54712 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:14:26.541119 0.000000 tcp 10.0.2.105 54712 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:14:32.540678 0.748024 tcp 10.0.2.105 54713 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:33.288969 0.681766 tcp 10.0.2.105 54714 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:33.970974 1.437012 tcp 10.0.2.105 54715 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:35.434177 2.984146 tcp 10.0.2.105 54716 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:14:44.416869 0.000000 tcp 10.0.2.105 54716 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:14:50.436125 0.704609 tcp 10.0.2.105 54717 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:51.141044 0.676096 tcp 10.0.2.105 54718 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:51.817443 1.326549 tcp 10.0.2.105 54719 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:14:53.187463 3.006376 tcp 10.0.2.105 54720 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:02.192642 0.000000 tcp 10.0.2.105 54720 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:08.182116 0.639622 tcp 10.0.2.105 54721 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:08.822558 0.681197 tcp 10.0.2.105 54722 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:09.504048 1.378527 tcp 10.0.2.105 54723 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:10.959566 2.999968 tcp 10.0.2.105 54724 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:19.957818 0.000000 tcp 10.0.2.105 54724 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:25.957415 0.658458 tcp 10.0.2.105 54725 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:26.615674 0.718345 tcp 10.0.2.105 54726 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:27.334335 1.382671 tcp 10.0.2.105 54727 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:28.880024 4.222434 tcp 10.0.2.105 54728 -> 211.38.175.27 4598 FSPA* 0 0 11 1131 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:30.094661 0.763517 tcp 10.0.2.105 54729 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:30.858645 0.694459 tcp 10.0.2.105 54730 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:31.553375 1.479480 tcp 10.0.2.105 54731 -> 195.113.214.236 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:33.102758 2.998693 tcp 10.0.2.105 54732 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:42.100361 0.000000 tcp 10.0.2.105 54732 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:15:48.099174 0.692119 tcp 10.0.2.105 54733 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:48.791577 0.630471 tcp 10.0.2.105 54734 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:49.422352 1.384183 tcp 10.0.2.105 54735 -> 195.113.214.236 443 SRPA* 0 0 23 14004 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:50.890468 3.189660 tcp 10.0.2.105 54736 -> 200.84.7.244 8038 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:51.912718 0.547109 tcp 10.0.2.105 54737 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:52.460101 0.614931 tcp 10.0.2.105 54738 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:53.075413 0.867242 tcp 10.0.2.105 54739 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:54.080412 3.336305 tcp 10.0.2.105 54740 -> 176.73.200.207 7943 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:54.697007 0.590188 tcp 10.0.2.105 54741 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:55.287584 0.622130 tcp 10.0.2.105 54742 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:55.909988 1.198931 tcp 10.0.2.105 54743 -> 195.113.214.236 443 SRPA* 0 0 25 13900 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:15:57.416886 0.662505 tcp 10.0.2.105 54744 -> 46.48.235.250 16076 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:03.361978 2.599501 tcp 10.0.2.105 54744 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:03.362817 0.641453 tcp 10.0.2.105 54745 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:04.004614 0.625365 tcp 10.0.2.105 54746 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:04.630254 1.287526 tcp 10.0.2.105 54747 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:05.961688 3.611899 tcp 10.0.2.105 54748 -> 176.73.3.72 3605 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:06.698689 0.672442 tcp 10.0.2.105 54749 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:07.371405 0.679519 tcp 10.0.2.105 54750 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:08.051398 1.368837 tcp 10.0.2.105 54751 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:09.573775 0.277557 tcp 10.0.2.105 54752 -> 94.137.168.16 9773 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:39.617219 0.000334 tcp 10.0.2.105 54752 -> 94.137.168.16 9773 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:16:39.617753 2.999580 tcp 10.0.2.105 54753 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:16:48.625774 0.000000 tcp 10.0.2.105 54753 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:16:54.614120 2.994322 tcp 10.0.2.105 54754 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:03.607462 0.000000 tcp 10.0.2.105 54754 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:08.153469 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:17:09.616417 3.003933 tcp 10.0.2.105 54755 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:18.619004 0.000000 tcp 10.0.2.105 54755 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:24.617571 3.004370 tcp 10.0.2.105 54756 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:32.148282 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:17:33.620638 0.000000 tcp 10.0.2.105 54756 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:39.618906 1.320843 tcp 10.0.2.105 54757 -> 211.38.175.27 4598 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:17:40.939981 3.005573 tcp 10.0.2.105 54758 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:49.943954 0.000000 tcp 10.0.2.105 54758 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:17:55.932811 1.012685 tcp 10.0.2.105 54759 -> 200.84.7.244 8038 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:17:56.945728 0.609800 tcp 10.0.2.105 54760 -> 176.73.200.207 7943 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:17:57.555760 0.674539 tcp 10.0.2.105 54761 -> 46.48.235.250 16076 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:18:28.229195 0.720750 tcp 10.0.2.105 54761 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:18:28.229455 0.693560 tcp 10.0.2.105 54762 -> 176.73.3.72 3605 FSPA* 0 0 13 1239 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:20:15.887686 3.000599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:20:22.893877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:20:30.895267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:20:46.898606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:21:18.904424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:23:28.922036 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:23:28.922310 3.252939 tcp 10.0.2.105 54763 -> 94.137.168.16 9773 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:29.644778 0.645870 tcp 10.0.2.105 54764 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:30.290894 0.684117 tcp 10.0.2.105 54765 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:30.975256 1.048139 tcp 10.0.2.105 54766 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:32.175492 2.994541 tcp 10.0.2.105 54767 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:23:41.168463 0.000000 tcp 10.0.2.105 54767 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:23:47.178243 0.624776 tcp 10.0.2.105 54768 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:47.802865 0.697830 tcp 10.0.2.105 54769 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:48.501000 1.348668 tcp 10.0.2.105 54770 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:23:49.885270 3.000120 tcp 10.0.2.105 54771 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:23:58.884010 0.000000 tcp 10.0.2.105 54771 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:04.883681 0.594524 tcp 10.0.2.105 54772 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:05.478440 0.673743 tcp 10.0.2.105 54773 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:06.152549 1.363024 tcp 10.0.2.105 54774 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:07.530175 3.001081 tcp 10.0.2.105 54775 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:16.529902 0.000000 tcp 10.0.2.105 54775 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:22.528861 0.460298 tcp 10.0.2.105 54776 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:22.989454 0.483989 tcp 10.0.2.105 54777 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:23.473775 0.807855 tcp 10.0.2.105 54778 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:24.381441 3.004173 tcp 10.0.2.105 54779 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:33.384032 0.000000 tcp 10.0.2.105 54779 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:39.382906 0.587364 tcp 10.0.2.105 54780 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:39.970627 0.606616 tcp 10.0.2.105 54781 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:40.577562 0.606296 tcp 10.0.2.105 54782 -> 195.113.214.236 443 SRPA* 0 0 24 14778 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:41.196634 2.973849 tcp 10.0.2.105 54783 -> 211.38.175.27 4598 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:42.259292 0.434566 tcp 10.0.2.105 54784 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:42.694141 0.477564 tcp 10.0.2.105 54785 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:43.172015 0.986404 tcp 10.0.2.105 54786 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:44.170700 3.002811 tcp 10.0.2.105 54787 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:53.172048 0.000000 tcp 10.0.2.105 54787 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:24:59.171918 0.611537 tcp 10.0.2.105 54788 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:24:59.783764 0.699117 tcp 10.0.2.105 54789 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:00.483212 1.376804 tcp 10.0.2.105 54790 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:01.870533 3.841047 tcp 10.0.2.105 54791 -> 200.84.7.244 8038 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:02.949301 0.646125 tcp 10.0.2.105 54792 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:03.595786 0.663509 tcp 10.0.2.105 54793 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:04.259739 1.370992 tcp 10.0.2.105 54794 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:05.711806 3.006867 tcp 10.0.2.105 54795 -> 176.73.200.207 7943 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:06.421465 0.692555 tcp 10.0.2.105 54796 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:07.114274 0.204845 tcp 10.0.2.105 54797 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:07.319424 1.324371 tcp 10.0.2.105 54798 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:08.718845 0.749041 tcp 10.0.2.105 54799 -> 46.48.235.250 16076 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:39.469643 0.355874 tcp 10.0.2.105 54800 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:39.825871 0.369240 tcp 10.0.2.105 54801 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:40.195477 0.807899 tcp 10.0.2.105 54802 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:41.094959 0.763550 tcp 10.0.2.105 54799 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:41.095240 2.020545 tcp 10.0.2.105 54803 -> 176.73.3.72 3605 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:41.513507 0.367080 tcp 10.0.2.105 54804 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:41.880895 0.395160 tcp 10.0.2.105 54805 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:42.276388 0.790230 tcp 10.0.2.105 54806 -> 195.113.214.236 443 SRPA* 0 0 23 14004 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:43.116020 0.455465 tcp 10.0.2.105 54807 -> 94.137.168.16 9773 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:25:43.571686 2.997699 tcp 10.0.2.105 54808 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:25:50.975598 0.002308 tcp 10.0.2.105 54808 -> 31.192.24.67 3527 PA_SA 0 0 8 1108 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:26:20.978251 0.313694 tcp 10.0.2.105 54808 -> 31.192.24.67 3527 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:26:20.978527 3.004416 tcp 10.0.2.105 54809 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:26:29.981644 0.000000 tcp 10.0.2.105 54809 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:26:35.980182 3.004553 tcp 10.0.2.105 54810 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:26:44.982795 0.000000 tcp 10.0.2.105 54810 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:26:49.649631 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:26:50.982048 3.003887 tcp 10.0.2.105 54811 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:26:59.994814 0.000000 tcp 10.0.2.105 54811 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:27:05.983789 0.561211 tcp 10.0.2.105 54812 -> 211.38.175.27 4598 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:27:22.910715 3.000890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:27:27.109599 0.000577 tcp 10.0.2.105 54812 -> 211.38.175.27 4598 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:27:27.110067 2.997552 tcp 10.0.2.105 54813 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:27:29.917888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:27:36.106714 0.000000 tcp 10.0.2.105 54813 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:27:37.919354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:27:42.105494 1.055091 tcp 10.0.2.105 54814 -> 200.84.7.244 8038 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:27:43.160800 0.687034 tcp 10.0.2.105 54815 -> 176.73.200.207 7943 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:27:43.848002 0.684092 tcp 10.0.2.105 54816 -> 46.48.235.250 16076 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:27:53.921890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:28:11.926423 0.000337 tcp 10.0.2.105 54816 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:28:11.926933 0.628265 tcp 10.0.2.105 54817 -> 176.73.3.72 3605 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:28:25.928365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:33:12.551198 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:33:12.551488 0.270861 tcp 10.0.2.105 54818 -> 94.137.168.16 9773 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:23.099654 2.818596 tcp 10.0.2.105 54818 -> 94.137.168.16 9773 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:23.102065 0.756704 tcp 10.0.2.105 54819 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:23.859102 0.665850 tcp 10.0.2.105 54820 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:24.525246 1.318663 tcp 10.0.2.105 54821 -> 195.113.214.236 443 SRPA* 0 0 23 14606 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:25.918507 3.476370 tcp 10.0.2.105 54822 -> 31.192.24.67 3527 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:26.569079 0.629079 tcp 10.0.2.105 54823 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:27.198443 0.691401 tcp 10.0.2.105 54824 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:27.890364 1.483595 tcp 10.0.2.105 54825 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:29.395150 2.993929 tcp 10.0.2.105 54826 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:33:38.387255 0.000000 tcp 10.0.2.105 54826 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:33:44.396629 0.581563 tcp 10.0.2.105 54827 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:44.978503 0.734011 tcp 10.0.2.105 54828 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:45.712834 1.424358 tcp 10.0.2.105 54829 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:33:47.153714 3.000483 tcp 10.0.2.105 54830 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:33:56.152712 0.000000 tcp 10.0.2.105 54830 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:34:02.152030 0.670600 tcp 10.0.2.105 54831 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:02.822962 0.689095 tcp 10.0.2.105 54832 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:03.512347 1.381006 tcp 10.0.2.105 54833 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:04.938849 3.000790 tcp 10.0.2.105 54834 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:34:13.938846 0.000000 tcp 10.0.2.105 54834 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:34:19.938342 0.771869 tcp 10.0.2.105 54835 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:20.710520 0.652650 tcp 10.0.2.105 54836 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:21.363436 1.362431 tcp 10.0.2.105 54837 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:22.779936 4.020629 tcp 10.0.2.105 54838 -> 211.38.175.27 4598 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:23.997515 0.690403 tcp 10.0.2.105 54839 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:24.688166 0.679603 tcp 10.0.2.105 54840 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:25.368165 1.388332 tcp 10.0.2.105 54841 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:26.800725 3.000458 tcp 10.0.2.105 54842 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:34:29.934754 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:34:35.800065 0.000000 tcp 10.0.2.105 54842 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:34:36.941825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:34:41.799286 0.761442 tcp 10.0.2.105 54843 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:42.561017 0.519856 tcp 10.0.2.105 54844 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:43.081221 1.129267 tcp 10.0.2.105 54845 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:44.239943 3.023750 tcp 10.0.2.105 54846 -> 200.84.7.244 8038 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:44.943354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:34:45.150703 0.488344 tcp 10.0.2.105 54847 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:45.639357 0.534096 tcp 10.0.2.105 54848 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:46.173970 1.061020 tcp 10.0.2.105 54849 -> 195.113.214.236 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:47.263870 2.810592 tcp 10.0.2.105 54850 -> 176.73.200.207 7943 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:47.836438 0.503039 tcp 10.0.2.105 54851 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:48.339760 0.530208 tcp 10.0.2.105 54852 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:48.870113 1.168858 tcp 10.0.2.105 54853 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:34:50.074687 0.842724 tcp 10.0.2.105 54854 -> 46.48.235.250 16076 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:00.946499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:35:06.015931 2.725114 tcp 10.0.2.105 54854 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:06.016955 0.612957 tcp 10.0.2.105 54855 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:06.630217 0.689060 tcp 10.0.2.105 54856 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:07.319528 1.345999 tcp 10.0.2.105 54857 -> 195.113.214.236 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:08.741314 3.245027 tcp 10.0.2.105 54858 -> 176.73.3.72 3605 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:09.480822 0.664682 tcp 10.0.2.105 54859 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:10.145818 0.667826 tcp 10.0.2.105 54860 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:10.813983 1.133325 tcp 10.0.2.105 54861 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:11.986608 0.654017 tcp 10.0.2.105 54862 -> 94.137.168.16 9773 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:12.640833 0.723267 tcp 10.0.2.105 54863 -> 31.192.24.67 3527 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:13.364357 2.994258 tcp 10.0.2.105 54864 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:22.357129 0.000000 tcp 10.0.2.105 54864 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:28.365689 2.994106 tcp 10.0.2.105 54865 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:32.952021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:35:37.358703 0.000000 tcp 10.0.2.105 54865 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:42.145353 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:35:43.367156 3.004414 tcp 10.0.2.105 54866 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:52.369971 0.000000 tcp 10.0.2.105 54866 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:35:58.369065 1.399790 tcp 10.0.2.105 54867 -> 211.38.175.27 4598 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:35:59.769089 3.006325 tcp 10.0.2.105 54868 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:36:08.773745 0.000000 tcp 10.0.2.105 54868 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:36:14.762366 1.090582 tcp 10.0.2.105 54869 -> 200.84.7.244 8038 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:36:15.852812 0.655229 tcp 10.0.2.105 54870 -> 176.73.200.207 7943 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:36:16.508273 0.718231 tcp 10.0.2.105 54871 -> 46.48.235.250 16076 SPA_* 0 0 7 1120 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:36:24.020872 0.000347 tcp 10.0.2.105 54871 -> 46.48.235.250 16076 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:36:24.021386 0.710092 tcp 10.0.2.105 54872 -> 176.73.3.72 3605 FSPA* 0 0 13 1444 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:38:56.645738 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:38:56.645832 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 01:39:12.309360 0.778318 tcp 10.0.2.105 54873 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:13.087910 0.680171 tcp 10.0.2.105 54874 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:13.768555 1.345982 tcp 10.0.2.105 54875 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:15.115138 0.000000 udp 10.0.2.105 7010 -> 72.201.209.113 1245 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 01:39:32.978219 0.431043 tcp 10.0.2.105 54876 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:33.409577 0.442512 tcp 10.0.2.105 54877 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:33.851948 0.751839 tcp 10.0.2.105 54878 -> 195.113.214.236 443 SRPA* 0 0 27 11238 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:34.603099 0.314094 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:34.917656 0.000000 udp 10.0.2.105 7010 -> 218.16.58.52 8886 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 01:39:50.633290 0.670223 tcp 10.0.2.105 54879 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:51.303813 0.678906 tcp 10.0.2.105 54880 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:51.982984 1.377115 tcp 10.0.2.105 54881 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:39:53.360716 0.395404 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:53.756481 0.483380 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:54.240288 0.451259 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:54.691948 0.446658 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:55.139000 0.242473 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:55.381882 0.477396 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:55.859687 0.480689 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:56.340769 0.454332 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:56.795465 0.434958 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:57.230763 0.476389 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:57.707553 0.428901 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:58.136860 0.485054 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:58.622318 0.484463 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:59.107171 0.460993 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:59.568587 0.407467 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:39:59.976466 0.549006 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:00.525892 0.467794 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:00.994055 0.440689 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:01.435063 0.379715 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:01.815142 0.467381 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:02.282963 0.426313 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:02.709682 0.516850 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:03.226941 0.564016 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:03.791520 0.375003 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:04.266230 0.631407 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:40:04.898001 0.414556 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/15 01:41:24.728231 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:41:24.728349 3.567738 tcp 10.0.2.105 54882 -> 94.137.168.16 9773 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:25.457560 0.715036 tcp 10.0.2.105 54883 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:26.172874 0.727290 tcp 10.0.2.105 54884 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:26.900252 1.380376 tcp 10.0.2.105 54885 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:28.296276 3.357491 tcp 10.0.2.105 54886 -> 31.192.24.67 3527 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:29.046049 0.628219 tcp 10.0.2.105 54887 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:29.674554 0.684708 tcp 10.0.2.105 54888 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:30.359753 1.282648 tcp 10.0.2.105 54889 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:31.653933 2.998246 tcp 10.0.2.105 54890 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:41:36.958621 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:41:40.650795 0.000000 tcp 10.0.2.105 54890 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:41:43.965456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:41:46.650245 0.716391 tcp 10.0.2.105 54891 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:47.366952 0.637973 tcp 10.0.2.105 54892 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:48.005241 1.346123 tcp 10.0.2.105 54893 -> 195.113.214.236 443 SRPA* 0 0 25 13902 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:41:49.362103 2.985571 tcp 10.0.2.105 54894 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:41:51.967430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:41:58.346027 0.000000 tcp 10.0.2.105 54894 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:42:04.355446 0.737787 tcp 10.0.2.105 54895 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:05.093503 0.672666 tcp 10.0.2.105 54896 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:05.766471 1.306072 tcp 10.0.2.105 54897 -> 195.113.214.236 443 SRPA* 0 0 24 13236 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:07.091439 3.001677 tcp 10.0.2.105 54898 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:42:07.970097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:42:16.091900 0.000000 tcp 10.0.2.105 54898 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:42:22.091742 0.707679 tcp 10.0.2.105 54899 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:22.799738 0.694800 tcp 10.0.2.105 54900 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:23.494418 1.373777 tcp 10.0.2.105 54901 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:24.879497 3.692092 tcp 10.0.2.105 54902 -> 211.38.175.27 4598 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:26.201741 0.737994 tcp 10.0.2.105 54903 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:26.940148 0.646574 tcp 10.0.2.105 54904 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:27.587042 0.974118 tcp 10.0.2.105 54905 -> 195.113.214.236 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:28.571838 3.002035 tcp 10.0.2.105 54906 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:42:37.573001 0.000000 tcp 10.0.2.105 54906 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:42:39.975953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:42:43.572064 0.666252 tcp 10.0.2.105 54907 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:44.238607 0.689791 tcp 10.0.2.105 54908 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:44.928687 1.345465 tcp 10.0.2.105 54909 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:46.295936 4.100671 tcp 10.0.2.105 54910 -> 200.84.7.244 8038 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:47.532103 0.750148 tcp 10.0.2.105 54911 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:48.282732 0.696881 tcp 10.0.2.105 54912 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:48.979892 1.350368 tcp 10.0.2.105 54913 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:50.396825 3.448825 tcp 10.0.2.105 54914 -> 176.73.200.207 7943 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:51.099476 0.616008 tcp 10.0.2.105 54915 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:51.715737 0.687757 tcp 10.0.2.105 54916 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:52.403793 1.413149 tcp 10.0.2.105 54917 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:42:53.846013 3.672547 tcp 10.0.2.105 54918 -> 46.48.235.250 16076 SPA_* 0 0 10 1231 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:04.280084 2.808061 tcp 10.0.2.105 54918 -> 46.48.235.250 16076 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:04.280993 0.714233 tcp 10.0.2.105 54919 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:04.995512 0.691903 tcp 10.0.2.105 54920 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:05.687765 1.341531 tcp 10.0.2.105 54921 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:07.088408 3.446227 tcp 10.0.2.105 54922 -> 176.73.3.72 3605 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:07.793540 0.662966 tcp 10.0.2.105 54923 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:08.456830 0.693001 tcp 10.0.2.105 54924 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:09.150379 1.369203 tcp 10.0.2.105 54925 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:10.534867 0.592294 tcp 10.0.2.105 54926 -> 94.137.168.16 9773 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:11.127027 0.765686 tcp 10.0.2.105 54927 -> 31.192.24.67 3527 FSPA* 0 0 11 1273 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:43:11.892949 3.003176 tcp 10.0.2.105 54928 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:20.905005 0.000000 tcp 10.0.2.105 54928 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:26.893868 2.994327 tcp 10.0.2.105 54929 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:35.886676 0.000000 tcp 10.0.2.105 54929 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:40.653169 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 01:43:41.895276 2.994419 tcp 10.0.2.105 54930 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:50.888133 0.000000 tcp 10.0.2.105 54930 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:43:56.897173 0.694961 tcp 10.0.2.105 54931 -> 211.38.175.27 4598 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:44:08.284501 0.000569 tcp 10.0.2.105 54931 -> 211.38.175.27 4598 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:44:08.285008 2.992398 tcp 10.0.2.105 54932 -> 91.207.7.129 3494 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:44:17.286336 0.000000 tcp 10.0.2.105 54932 -> 91.207.7.129 3494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:44:23.284753 0.999218 tcp 10.0.2.105 54933 -> 200.84.7.244 8038 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:44:24.283829 0.665114 tcp 10.0.2.105 54934 -> 176.73.200.207 7943 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:44:24.949168 3.002117 tcp 10.0.2.105 54935 -> 46.48.235.250 16076 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 01:44:33.949669 1.674870 tcp 10.0.2.105 54935 -> 46.48.235.250 16076 SPA_* 0 0 9 1161 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:45:05.353823 0.000609 tcp 10.0.2.105 54935 -> 46.48.235.250 16076 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:45:05.354261 0.633255 tcp 10.0.2.105 54936 -> 176.73.3.72 3605 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/01/15 01:48:43.982992 3.000712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 01:48:50.989940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:48:58.991206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:49:14.994319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:49:47.000032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:55:51.006488 3.000990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 01:55:58.013321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:56:06.015332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:56:22.018044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 01:56:54.023852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:02:58.030170 3.001780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 02:03:05.037797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:03:13.039385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:03:29.042154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:04:01.047937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:10:05.054783 3.001239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 02:10:12.061627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:10:20.062797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:10:23.608930 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:10:23.609167 0.000000 udp 10.0.2.105 7010 -> 218.16.58.52 8886 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 02:10:36.066367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:10:41.395498 0.052786 tcp 10.0.2.105 54937 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:41.448623 0.082491 tcp 10.0.2.105 54938 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:41.531402 0.183165 tcp 10.0.2.105 54939 -> 195.113.214.236 443 SRPA* 0 0 33 24741 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:41.715078 0.161230 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:41.871930 0.052951 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:41.909945 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 02:10:51.117857 0.090189 tcp 10.0.2.105 54940 -> 31.192.24.67 3527 SPA_* 0 0 9 1076 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:58.098745 0.052239 tcp 10.0.2.105 54941 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:58.151282 0.082317 tcp 10.0.2.105 54942 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:58.233940 0.172216 tcp 10.0.2.105 54943 -> 195.113.214.236 443 SRPA* 0 0 51 29282 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:10:58.406774 0.143774 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:58.546870 0.121102 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1475 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:58.678042 0.021412 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1517 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:58.719061 0.187196 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:58.904491 0.261759 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 3 775 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.155754 0.154169 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.310276 0.145189 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 3 993 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.457075 0.170324 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.624669 0.140510 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.765562 0.146811 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:10:59.912848 0.136384 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.049651 0.119515 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.167904 0.046784 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.208841 0.290872 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.500136 0.205991 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.598013 0.192271 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.786543 0.051516 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.834845 0.089873 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:00.907055 0.158721 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:01.066142 0.374530 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:01.294559 0.328543 tcp 10.0.2.105 54940 -> 31.192.24.67 3527 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:01.295176 0.051237 tcp 10.0.2.105 54944 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:01.336101 0.206806 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:01.346694 0.080459 tcp 10.0.2.105 54945 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:01.427030 0.184789 tcp 10.0.2.105 54946 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:01.543332 0.148174 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:01.623362 2.993737 tcp 10.0.2.105 54947 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:11:01.684621 0.338375 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:02.023489 0.146045 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:11:08.071935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:11:10.625595 0.000000 tcp 10.0.2.105 54947 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:11:16.624979 0.682944 tcp 10.0.2.105 54948 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:17.308518 0.658991 tcp 10.0.2.105 54949 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:17.967769 1.321223 tcp 10.0.2.105 54950 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:19.310536 0.763647 tcp 10.0.2.105 54951 -> 31.192.24.67 3527 FSPA* 0 0 13 1292 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:11:20.074389 2.998843 tcp 10.0.2.105 54952 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:11:29.072260 0.000000 tcp 10.0.2.105 54952 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:16:35.072552 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:16:35.072653 3.359093 tcp 10.0.2.105 54953 -> 94.137.168.16 9773 FSPA* 0 0 13 1234 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:35.708163 0.617358 tcp 10.0.2.105 54954 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:36.325347 0.639978 tcp 10.0.2.105 54955 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:36.965612 1.455273 tcp 10.0.2.105 54956 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:38.431933 3.296243 tcp 10.0.2.105 54957 -> 31.192.24.67 3527 FSPA* 0 0 13 1234 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:39.076415 0.639925 tcp 10.0.2.105 54958 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:39.716657 0.633090 tcp 10.0.2.105 54959 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:40.350193 1.366364 tcp 10.0.2.105 54960 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:41.728576 3.007465 tcp 10.0.2.105 54961 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:16:50.744637 0.000000 tcp 10.0.2.105 54961 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:16:56.724030 0.524644 tcp 10.0.2.105 54962 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:57.248915 0.576973 tcp 10.0.2.105 54963 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:57.826198 1.214100 tcp 10.0.2.105 54964 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:16:59.122644 2.998931 tcp 10.0.2.105 54965 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:08.119322 0.000000 tcp 10.0.2.105 54965 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:12.078656 3.000729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 02:17:14.119184 0.704940 tcp 10.0.2.105 54966 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:14.824569 0.679703 tcp 10.0.2.105 54967 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:15.504517 1.324964 tcp 10.0.2.105 54968 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:16.856764 2.999901 tcp 10.0.2.105 54969 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:19.085736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:17:25.865443 0.000000 tcp 10.0.2.105 54969 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:27.087055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:17:31.854478 0.646959 tcp 10.0.2.105 54970 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:32.501328 0.671459 tcp 10.0.2.105 54971 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:33.173054 1.371551 tcp 10.0.2.105 54972 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:34.558902 3.003364 tcp 10.0.2.105 54973 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:43.090141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:17:43.560885 0.000000 tcp 10.0.2.105 54973 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:17:49.560392 0.587587 tcp 10.0.2.105 54974 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:50.148296 0.687240 tcp 10.0.2.105 54975 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:50.835863 1.372940 tcp 10.0.2.105 54976 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:52.261960 3.548316 tcp 10.0.2.105 54977 -> 184.182.240.239 7058 SPA_* 0 0 12 1192 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:55.810811 0.456447 tcp 10.0.2.105 54978 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:56.267515 0.080935 tcp 10.0.2.105 54979 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:56.348728 0.924123 tcp 10.0.2.105 54980 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:57.292186 0.000213 tcp 10.0.2.105 54977 -> 184.182.240.239 7058 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:17:57.292672 3.002334 tcp 10.0.2.105 54981 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:06.293690 0.000000 tcp 10.0.2.105 54981 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:12.292624 0.651908 tcp 10.0.2.105 54982 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:18:12.944814 0.629035 tcp 10.0.2.105 54983 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:18:13.574145 1.348975 tcp 10.0.2.105 54984 -> 195.113.214.236 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:18:14.942407 0.614456 tcp 10.0.2.105 54985 -> 94.137.168.16 9773 FSPA* 0 0 13 1234 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:18:15.095751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:18:15.557125 0.534278 tcp 10.0.2.105 54986 -> 31.192.24.67 3527 FSPA* 0 0 13 1234 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:18:16.091656 3.000261 tcp 10.0.2.105 54987 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:25.090561 0.000000 tcp 10.0.2.105 54987 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:31.088939 3.004017 tcp 10.0.2.105 54988 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:40.091946 0.000000 tcp 10.0.2.105 54988 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:44.648405 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:18:46.090753 3.004102 tcp 10.0.2.105 54989 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:18:55.093371 0.000000 tcp 10.0.2.105 54989 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:19:01.092339 2.994263 tcp 10.0.2.105 54990 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:19:08.652884 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:19:10.095164 0.000000 tcp 10.0.2.105 54990 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:19:16.093520 0.741869 tcp 10.0.2.105 54991 -> 184.182.240.239 7058 FSPA* 0 0 13 1234 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:19:16.835600 2.993357 tcp 10.0.2.105 54992 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:19:25.827619 0.000000 tcp 10.0.2.105 54992 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:24:19.102199 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 02:24:26.109312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:24:31.838258 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:24:31.838472 3.476558 tcp 10.0.2.105 54993 -> 94.137.168.16 9773 FSPA* 0 0 13 1216 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:32.583670 0.651811 tcp 10.0.2.105 54994 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:33.235736 0.659456 tcp 10.0.2.105 54995 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:33.895515 1.400677 tcp 10.0.2.105 54996 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:34.110780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:24:35.315314 3.563313 tcp 10.0.2.105 54997 -> 31.192.24.67 3527 FSPA* 0 0 11 1108 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:36.215935 0.632713 tcp 10.0.2.105 54998 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:36.849034 0.692869 tcp 10.0.2.105 54999 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:37.541763 1.322431 tcp 10.0.2.105 55000 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:38.878879 3.003261 tcp 10.0.2.105 55001 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:24:47.880431 0.000000 tcp 10.0.2.105 55001 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:24:50.114135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:24:53.879730 0.746113 tcp 10.0.2.105 55002 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:54.626149 0.748243 tcp 10.0.2.105 55003 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:55.374727 1.420350 tcp 10.0.2.105 55004 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:24:56.822337 2.995429 tcp 10.0.2.105 55005 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:05.816260 0.000000 tcp 10.0.2.105 55005 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:11.816585 0.497172 tcp 10.0.2.105 55006 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:12.313987 0.530067 tcp 10.0.2.105 55007 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:12.844545 1.229249 tcp 10.0.2.105 55008 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:14.095755 2.996797 tcp 10.0.2.105 55009 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:22.119989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:25:23.091088 0.000000 tcp 10.0.2.105 55009 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:29.090823 0.915095 tcp 10.0.2.105 55010 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:30.006188 0.704219 tcp 10.0.2.105 55011 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:30.710707 1.365924 tcp 10.0.2.105 55012 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:32.140843 2.998014 tcp 10.0.2.105 55013 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:41.136931 0.000000 tcp 10.0.2.105 55013 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 02:25:47.136631 0.503820 tcp 10.0.2.105 55014 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:47.640752 0.568376 tcp 10.0.2.105 55015 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:48.209374 1.202025 tcp 10.0.2.105 55016 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:49.850686 3.327928 tcp 10.0.2.105 55017 -> 184.182.240.239 7058 FSPA* 0 0 13 1216 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:50.641615 0.512964 tcp 10.0.2.105 55018 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:51.154928 0.626448 tcp 10.0.2.105 55019 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:51.781630 1.305091 tcp 10.0.2.105 55020 -> 195.113.214.236 443 SRPA* 0 0 24 14020 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:25:53.178906 1.761585 tcp 10.0.2.105 55021 -> 95.104.50.9 3421 FSPA* 0 0 15 1561 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:31:26.246709 3.001357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 02:31:33.253347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:31:41.255106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:31:57.257948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:32:29.264026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:38:33.270697 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 02:38:40.277593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:38:48.278868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:39:04.282125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:39:36.287765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:41:13.268100 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:41:13.268379 0.573536 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:13.842311 0.484161 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:14.326837 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 02:41:31.916723 0.716895 tcp 10.0.2.105 55022 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:32.633874 0.679425 tcp 10.0.2.105 55023 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:33.313447 1.309922 tcp 10.0.2.105 55024 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:34.623985 0.362085 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:34.986461 0.477482 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:35.464499 0.386920 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:35.851840 0.491433 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:36.343621 1.128940 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:37.472978 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 02:41:56.420336 0.604752 tcp 10.0.2.105 55025 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:57.025342 0.314758 tcp 10.0.2.105 55026 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:57.340546 1.238588 tcp 10.0.2.105 55027 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:41:58.579630 0.458281 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:41:59.038311 0.000000 udp 10.0.2.105 7010 -> 99.48.145.248 1101 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 02:42:15.808087 0.061878 tcp 10.0.2.105 55028 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:42:15.870882 0.591830 tcp 10.0.2.105 55029 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:42:16.463128 1.376694 tcp 10.0.2.105 55030 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:42:17.840359 0.457143 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:18.297843 0.456397 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:18.754601 0.461394 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:19.216571 0.436497 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:19.653521 0.375039 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:20.028984 0.569085 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:20.598434 0.312157 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:20.910979 0.430851 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:21.342225 0.332171 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:21.674795 0.355589 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:22.030771 0.417141 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:22.448279 0.503935 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:22.952646 0.690421 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:23.643487 0.598237 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:24.242160 0.937840 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:42:25.180565 0.540353 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 02:45:40.294382 3.001370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 02:45:47.301500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:45:55.302703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:46:11.306041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:46:43.311794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:52:47.318434 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 02:52:54.325383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:53:02.326827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:53:18.329787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:53:50.336167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 02:55:54.945568 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 02:55:54.945669 0.743210 tcp 10.0.2.105 55031 -> 95.104.50.9 3421 FSPA* 0 0 15 1666 flow=From-Botnet-V2-TCP-Established 1970/01/15 02:59:54.342129 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:00:01.349473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:00:09.350573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:00:25.353602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:00:57.360377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:07:01.366482 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:07:08.373583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:07:16.374808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:07:32.377804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:08:04.383759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:12:53.029220 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:12:53.029310 0.035850 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:12:53.065570 0.154558 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:12:53.220537 0.166731 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:12:53.387729 0.204886 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:12:53.388103 3.005943 tcp 10.0.2.105 55032 -> 99.48.145.248 3433 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 03:12:53.592992 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 03:13:02.392407 0.000000 tcp 10.0.2.105 55032 -> 99.48.145.248 3433 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 03:13:11.377264 0.052894 tcp 10.0.2.105 55033 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:13:11.430457 0.074384 tcp 10.0.2.105 55034 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:13:11.505158 0.173940 tcp 10.0.2.105 55035 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:13:11.679692 0.137846 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:11.817846 0.318047 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.136511 0.120561 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.257486 0.019842 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.277696 0.222051 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.500096 0.137711 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.638143 0.141428 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.779896 0.146165 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:12.926449 0.136258 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.063066 0.113535 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.177034 0.039765 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.217209 0.186945 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.404616 0.289866 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.694837 0.091118 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.786335 0.037922 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.824662 0.065299 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:13.890358 0.164503 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:14.055218 0.141467 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:14.197098 0.389808 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:14.587266 0.134630 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:14.722250 0.166427 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:13:14.889134 0.207785 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:14:08.390007 3.001604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:14:15.397473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:14:23.399039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:14:39.402338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:15:11.407752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:21:15.414541 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:21:22.421625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:21:30.422787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:21:46.425892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:22:18.431545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:25:55.694686 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:25:55.694912 0.505859 tcp 10.0.2.105 55036 -> 95.104.50.9 3421 FSPA* 0 0 15 1601 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:28:22.437935 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:28:29.445184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:28:37.446454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:28:53.449586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:29:25.455934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:35:29.462255 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:35:36.469197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:35:44.471080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:36:00.473767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:36:32.479668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:42:36.486452 3.000656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 03:42:43.493438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:42:51.495046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:43:07.497423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:43:33.385248 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:43:33.385349 3.834319 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.220244 0.030822 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.220712 4.196113 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 SPA_* 0 0 10 2770 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:37.251463 0.168253 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.420085 0.172448 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.592904 0.181504 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.774794 0.121403 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.896606 0.020118 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:37.917015 0.151607 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:38.069024 0.343846 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:38.413288 0.535962 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:38.949648 0.151648 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.101726 0.148435 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.250539 0.154515 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.405392 0.142295 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.503960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:43:39.548108 0.117841 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.666398 0.039306 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.706050 0.179339 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:39.885720 0.302073 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:40.188141 0.088328 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:40.276865 0.032729 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:40.309990 0.098409 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:40.408835 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 03:43:44.922815 3.987946 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 15 7446 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:51.942755 0.399084 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:56.210239 0.066235 tcp 10.0.2.105 55038 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:56.276735 0.079942 tcp 10.0.2.105 55039 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:56.356959 0.178683 tcp 10.0.2.105 55040 -> 195.113.214.236 443 SRPA* 0 0 58 42274 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:43:56.536746 0.138531 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:56.675677 0.177409 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:56.853445 0.212377 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:57.066247 0.373224 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:57.439896 0.143241 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/15 03:43:59.818607 0.204339 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 216 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:44:17.878568 0.201043 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:44:22.765955 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:44:31.248128 4.456371 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:44:47.414242 4.323327 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 7086 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:44:52.268090 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:44:55.564420 4.414942 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:10.414116 4.016579 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:16.272763 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:45:17.974419 4.117080 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:29.397786 0.204499 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 162 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:38.013929 4.586867 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:42.771299 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:45:46.090047 0.396079 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:45:54.847951 3.906414 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:46:02.003682 4.421602 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:46:10.255836 4.301125 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 6 2228 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:46:23.233442 4.422388 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8240 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:46:32.272385 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:46:35.207195 4.265219 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:46:42.867422 0.400810 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:47:04.109368 4.094119 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:47:09.265114 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:47:11.791292 4.153934 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 15 11050 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:47:19.845014 3.891576 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:47:42.613200 4.416630 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:47:47.770303 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:47:55.395250 4.312880 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 7532 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:03.396494 4.292945 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:11.110195 4.320537 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 9544 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:23.278882 0.203514 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:31.412643 0.401455 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 2864 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:36.270776 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:48:40.322472 4.249943 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:48.306554 4.016932 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:48:56.148355 0.401690 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1652 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:01.266296 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:49:04.239990 4.206488 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 13 9858 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:12.122465 0.200133 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:19.758333 0.204702 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:28.104004 4.377227 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:33.272047 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:49:36.136179 4.436792 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:43.510157 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 03:49:44.063917 4.090358 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 15 12002 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:50.517342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:49:51.976122 4.269376 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:49:58.519080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:50:00.148120 0.403710 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:14.521914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:50:17.465912 3.645815 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 13 9494 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:22.272701 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:50:24.726018 4.637113 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:32.915390 0.393160 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 7 5426 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:40.869959 4.085586 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:46.528043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:50:48.804025 0.197666 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:50:49.772017 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:50:57.295905 0.207756 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 1308 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:05.264007 0.401105 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 8132 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:14.017525 4.145667 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:29.483985 0.195547 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 1308 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:38.481896 4.467516 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6580 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:43.269079 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:51:51.647223 3.899569 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:51:59.619251 0.404000 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:07.455252 0.199160 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 564 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:12.271030 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:52:16.547200 4.106117 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:24.203290 4.170588 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:31.839054 0.400309 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:36.766232 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:52:39.586856 0.403994 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 7 6026 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:52:48.058812 4.470359 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:53:01.023140 4.314216 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:53:05.767953 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:53:09.186794 0.406936 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:53:17.038647 0.205622 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 1412 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:53:34.366545 4.469086 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:53:46.648443 3.744369 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:01.294368 0.193286 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:06.264494 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:54:09.904383 0.195901 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 4262 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:18.686271 3.411931 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:25.576191 4.172478 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:30.770460 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:54:36.660432 0.198696 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3126 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:44.748158 4.137962 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 6030 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:54:56.568726 0.409155 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:01.764756 0.044029 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:55:04.328763 3.444545 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:11.045815 4.028052 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:18.231862 0.396932 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 7 5530 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:25.463848 0.395567 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:30.275699 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:55:33.023741 4.151785 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:48.067728 4.089533 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 9 5430 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:55:56.213479 0.504063 tcp 10.0.2.105 55041 -> 95.104.50.9 3421 FSPA* 0 0 15 1598 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:00.379619 3.514961 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:07.163541 3.991217 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 7888 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:14.557306 0.202292 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:21.681519 0.198160 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 316 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:26.777105 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:56:29.701547 4.065035 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:37.131383 4.146002 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 12 8488 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:44.617285 0.405614 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:50.544175 3.001146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 03:56:51.733177 0.199553 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 1060 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:56:56.779865 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:56:57.550859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:57:05.552365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:57:08.379217 4.043440 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:57:19.458869 0.203816 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 460 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:57:21.555820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:57:24.279348 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:57:27.703479 3.926773 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 14 10396 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:57:39.164171 3.922746 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:57:46.466687 0.205217 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:57:53.562217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 03:57:54.740975 0.202937 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:58:11.990781 4.263717 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:58:16.775089 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:58:19.964488 0.195897 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:58:28.423699 4.094101 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:58:36.282942 0.400947 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:58:41.280092 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:58:47.544819 0.195042 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 2 916 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:59:05.046262 3.973968 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 A_PA 0 0 10 6972 flow=From-Botnet-V2-TCP-Established 1970/01/15 03:59:09.781335 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 03:59:12.662447 4.137723 tcp 10.0.2.105 55037 -> 71.10.54.162 3760 FPA_* 0 0 9 3286 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:03:57.567809 3.011666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 04:04:04.585253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:04:12.586950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:04:28.589568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:05:00.596057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:11:04.602613 3.000760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:11:11.609616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:11:19.610738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:11:35.613869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:12:07.619498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:13:58.659618 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 04:13:58.659857 0.158144 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:13:58.818354 4.216509 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.035288 0.029618 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.065288 0.281781 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.347396 0.121182 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.469037 0.020059 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.489415 0.145207 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.635042 0.164514 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.799911 0.172593 udp 10.0.2.105 7010 <-> 99.48.145.248 1101 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:03.972906 0.169865 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.143084 0.148670 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.292153 0.144635 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.437207 0.264412 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.701976 0.115603 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.817950 0.039583 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:04.857935 0.178747 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:05.037080 0.297923 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:05.335356 0.081643 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:05.417401 0.031604 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:05.449421 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 04:14:21.394291 0.053805 tcp 10.0.2.105 55042 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:14:21.448512 0.072585 tcp 10.0.2.105 55043 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:14:21.521391 0.197471 tcp 10.0.2.105 55044 -> 195.113.214.236 443 SRPA* 0 0 47 41070 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:14:21.719776 0.142872 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:21.862985 0.066798 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:21.930201 0.204933 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:22.135544 0.130538 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:22.266540 0.177828 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:22.444771 0.324610 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:14:22.769785 0.149846 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:18:11.625769 3.071579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:18:18.702926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:18:26.704512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:18:42.707821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:19:14.713468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:25:18.719955 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:25:25.727293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:25:33.728787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:25:49.731496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:25:56.742485 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 04:25:56.742575 0.514588 tcp 10.0.2.105 55045 -> 95.104.50.9 3421 FSPA* 0 0 13 1622 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:26:21.737554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:32:25.764544 3.000603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:32:32.771465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:32:40.772639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:32:56.775544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:33:28.781939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:39:32.788581 3.000716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:39:39.795250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:39:47.796735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:40:03.799700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:40:35.805755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:44:23.062302 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 04:44:23.062440 0.155562 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:23.218424 0.155398 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:23.374245 3.427648 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:26.802302 0.029733 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:26.832470 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 04:44:44.866232 0.060863 tcp 10.0.2.105 55046 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:44:44.927343 0.078591 tcp 10.0.2.105 55047 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:44:45.006218 0.174627 tcp 10.0.2.105 55048 -> 195.113.214.236 443 SRPA* 0 0 50 38884 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:44:45.181488 0.144360 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:45.326236 0.162157 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:44:45.488811 0.000000 udp 10.0.2.105 7010 -> 99.48.145.248 1101 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 04:45:01.588614 0.052904 tcp 10.0.2.105 55049 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:45:01.641809 0.071238 tcp 10.0.2.105 55050 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:45:01.713391 0.189855 tcp 10.0.2.105 55051 -> 195.113.214.236 443 SRPA* 0 0 49 31168 flow=From-Botnet-V2-TCP-Established 1970/01/15 04:45:01.903845 0.019875 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:01.924114 0.120316 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.044840 0.148178 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.193444 0.225747 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.419602 0.115707 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.535748 0.040298 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.576445 0.190235 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:02.767085 0.298509 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:03.066019 0.821668 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:03.888096 0.144887 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.033463 0.034738 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.068639 0.087816 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.156819 0.142499 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.299681 0.115797 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.416014 0.221649 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.638151 0.353217 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:04.991813 0.379927 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:05.372181 0.376850 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:45:05.749448 0.620723 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 04:46:39.811205 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 04:46:46.818936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:46:54.820534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:47:10.823705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:47:42.829910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:53:46.835873 3.001480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 04:53:53.842731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:54:01.844339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:54:17.847210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:54:49.853563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 04:55:57.260649 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 04:55:57.260845 4.317037 tcp 10.0.2.105 55052 -> 95.104.50.9 3421 FSRP* 0 0 18 1879 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:00:54.280719 3.001052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:01:01.287639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:01:09.289067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:01:25.291882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:01:57.298489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:08:01.305522 3.000536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:08:08.311540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:08:16.313148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:08:32.316296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:09:04.322235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:15:08.327762 3.001964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:15:15.335810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:15:23.337252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:15:30.718347 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 05:15:30.718536 0.227590 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:15:30.946541 0.000000 udp 10.0.2.105 7010 -> 99.48.145.248 1101 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 05:15:39.340494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:15:48.885709 0.054204 tcp 10.0.2.105 55053 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:15:48.940428 0.081043 tcp 10.0.2.105 55054 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:15:49.021896 0.175300 tcp 10.0.2.105 55055 -> 195.113.214.236 443 SRPA* 0 0 49 41788 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:15:49.197824 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 05:16:06.640081 0.052123 tcp 10.0.2.105 55056 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:16:06.692543 0.077026 tcp 10.0.2.105 55057 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:16:06.769932 0.177064 tcp 10.0.2.105 55058 -> 195.113.214.236 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:16:06.946222 0.162328 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:07.108909 0.028957 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:07.138270 4.057478 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.196155 0.337662 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.346287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:16:11.534410 0.169274 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.704043 0.148296 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.852728 0.019626 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.872679 0.121736 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:11.994811 0.164863 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.160114 0.116778 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.277315 0.040272 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.318001 0.188992 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.507389 0.296208 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.803992 0.033724 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.838113 0.082812 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:12.921324 0.144763 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:13.066482 0.821533 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:13.888541 0.144944 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:14.033846 2.128608 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:16.162936 0.259369 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:16.422780 0.138141 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:16.561289 0.139087 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:16.700793 0.176406 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:16:16.877544 0.503745 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:22:15.352144 3.001664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:22:22.359521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:22:30.360846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:22:46.364224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:23:18.370007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:26:01.585197 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 05:26:01.585301 2.993782 tcp 10.0.2.105 55059 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:10.577666 0.000000 tcp 10.0.2.105 55059 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:16.588608 0.053261 tcp 10.0.2.105 55060 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:16.642149 0.065363 tcp 10.0.2.105 55061 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:16.707823 0.171255 tcp 10.0.2.105 55062 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:17.233052 2.998095 tcp 10.0.2.105 55063 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:26.229769 0.000000 tcp 10.0.2.105 55063 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:32.229611 0.052217 tcp 10.0.2.105 55064 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:32.282120 0.075613 tcp 10.0.2.105 55065 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:32.357992 0.172526 tcp 10.0.2.105 55066 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:32.655581 2.998439 tcp 10.0.2.105 55067 -> 31.192.24.67 3527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:41.652121 0.000000 tcp 10.0.2.105 55067 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:47.651648 0.052320 tcp 10.0.2.105 55068 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:47.703823 0.068193 tcp 10.0.2.105 55069 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:47.772358 0.172204 tcp 10.0.2.105 55070 -> 195.113.214.236 443 SRPA* 0 0 26 13502 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:26:48.054397 3.001715 tcp 10.0.2.105 55071 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:26:57.054567 0.000000 tcp 10.0.2.105 55071 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:27:03.053720 0.052397 tcp 10.0.2.105 55072 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:03.106404 0.077585 tcp 10.0.2.105 55073 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:03.184496 0.180018 tcp 10.0.2.105 55074 -> 195.113.214.236 443 SRPA* 0 0 42 24232 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:03.382085 2.995412 tcp 10.0.2.105 55075 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:27:04.786928 0.000129 tcp 10.0.2.105 55059 -> 95.104.50.9 3421 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:12.376824 0.000000 tcp 10.0.2.105 55075 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:27:18.375359 0.052894 tcp 10.0.2.105 55076 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:18.428577 0.078110 tcp 10.0.2.105 55077 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:18.507139 0.248614 tcp 10.0.2.105 55078 -> 195.113.214.236 443 SRPA* 0 0 52 35384 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:18.867008 3.003129 tcp 10.0.2.105 55079 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:27:27.868838 0.000000 tcp 10.0.2.105 55079 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 05:27:33.868591 0.062628 tcp 10.0.2.105 55080 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:33.931575 0.075646 tcp 10.0.2.105 55081 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:34.007537 0.178741 tcp 10.0.2.105 55082 -> 195.113.214.236 443 SRPA* 0 0 23 14606 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:27:34.281705 0.576389 tcp 10.0.2.105 55083 -> 176.73.211.244 8034 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:29:22.376651 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 05:29:29.383846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:29:37.385804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:29:53.388673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:30:25.394883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:36:29.399594 3.002025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:36:36.407265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:36:44.408588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:37:00.412184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:37:32.418061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:43:36.425030 3.000308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:43:43.431728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:43:51.432912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:44:07.435801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:44:39.442125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:46:27.877867 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 05:46:27.877965 0.154833 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:46:28.111619 0.197537 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:46:28.309558 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 05:46:44.003154 0.066220 tcp 10.0.2.105 55084 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:46:44.069705 0.079898 tcp 10.0.2.105 55085 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:46:44.149447 0.175042 tcp 10.0.2.105 55086 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:46:44.324957 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 05:47:00.185126 0.059343 tcp 10.0.2.105 55087 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:00.244789 0.070538 tcp 10.0.2.105 55088 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:00.315694 0.176294 tcp 10.0.2.105 55089 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:00.493062 3.815620 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:04.309088 0.412823 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:04.729107 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 05:47:23.058099 0.053494 tcp 10.0.2.105 55090 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:23.111912 0.074728 tcp 10.0.2.105 55091 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:23.187195 0.169543 tcp 10.0.2.105 55092 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:47:23.357339 0.148173 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.505963 0.020109 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.526425 0.148268 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.675131 0.163860 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.839368 0.114845 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.954639 0.043431 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:23.998468 0.189674 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:24.188618 0.291684 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:24.480685 0.031757 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:24.512808 0.082088 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:24.595291 0.145725 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:24.741414 0.598907 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:25.340774 0.144551 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:25.485738 1.940810 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:27.426958 0.151905 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:27.579290 0.176264 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:27.756007 0.376161 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:28.132665 0.243553 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:47:28.376611 0.131399 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/15 05:50:43.448151 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 05:50:50.455254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:50:58.457006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:51:14.459765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:51:46.465801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:57:34.856976 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 05:57:34.857081 0.730819 tcp 10.0.2.105 55093 -> 176.73.211.244 8034 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/01/15 05:57:50.471837 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 05:57:57.479534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:58:05.480927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:58:21.483700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 05:58:53.490089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:04:57.495583 3.001934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 06:05:04.503152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:05:12.504475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:05:28.508084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:06:00.513743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:12:04.520166 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 06:12:11.527496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:12:19.528892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:12:35.531576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:13:07.537461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:17:40.080088 0.039604 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:17:40.119894 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:17:58.988708 0.052522 tcp 10.0.2.105 55094 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:17:59.041569 0.100628 tcp 10.0.2.105 55095 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:17:59.142531 0.181773 tcp 10.0.2.105 55096 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:17:59.324914 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:18:17.724668 0.052336 tcp 10.0.2.105 55097 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:17.777289 0.075766 tcp 10.0.2.105 55098 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:17.853321 0.180180 tcp 10.0.2.105 55099 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:18.034198 0.169179 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:18.203855 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:18:34.918892 0.030844 tcp 10.0.2.105 55100 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:34.950017 0.076714 tcp 10.0.2.105 55101 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:35.027065 0.186198 tcp 10.0.2.105 55102 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:18:35.213888 0.215593 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:35.430012 3.659455 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.089822 0.144293 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.234567 0.147236 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.382229 0.020274 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.402871 0.120719 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.524048 0.169376 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.693834 0.117044 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.811313 0.060771 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:39.872563 0.181161 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:40.054152 0.083742 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:40.138311 0.140294 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:40.278964 0.520861 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:40.800281 0.297200 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:41.097942 0.032570 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:41.130914 0.151643 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:41.282990 1.938419 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:43.221742 0.145753 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:43.367897 0.183981 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:43.552467 0.355628 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:43.908522 0.259946 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:44.168835 0.133080 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:44.420776 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 REQ 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:18:51.482344 0.165442 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:51.648180 0.239454 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:51.888141 3.478993 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.367562 0.143862 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.511850 0.147288 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.659727 0.020977 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.681134 0.120810 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.802462 0.166647 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:55.969636 0.116482 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 862 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:56.086585 0.045015 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:56.132027 0.179445 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:56.311892 0.102177 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:56.414543 0.140921 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:56.556030 0.575370 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:57.131946 0.040429 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:57.172775 0.151639 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:57.324933 0.297719 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:57.623168 1.914385 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:59.537956 0.143832 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:59.682281 0.195226 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:18:59.877964 0.243370 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:19:00.121805 0.133220 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:19:00.225029 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:19:00.255482 0.389195 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:19:00.645380 0.000000 udp 10.0.2.105 7010 -> 87.139.11.107 9990 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:06.173759 0.000000 udp 10.0.2.105 7010 -> 88.236.71.8 6019 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:12.555911 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 06:19:12.592890 0.000000 udp 10.0.2.105 7010 -> 85.126.236.106 8179 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:19.562755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:19:21.225391 0.000000 udp 10.0.2.105 7010 -> 75.87.95.41 6866 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:26.231953 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:19:26.622941 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:27.563990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:19:35.435488 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:41.664510 0.000000 udp 10.0.2.105 7010 -> 46.120.226.152 7292 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:43.567505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:19:47.232745 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:19:52.229642 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:19:55.054157 0.000000 udp 10.0.2.105 7010 -> 217.34.36.106 7845 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:00.271714 0.000000 udp 10.0.2.105 7010 -> 78.97.152.250 4185 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:08.963992 0.000000 udp 10.0.2.105 7010 -> 80.45.79.253 9561 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:14.591954 0.000000 udp 10.0.2.105 7010 -> 95.137.216.202 1042 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:15.573043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:20:19.228403 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:20:22.673953 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:30.274592 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:35.611862 0.000000 udp 10.0.2.105 7010 -> 189.11.188.192 4055 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:43.052758 0.116909 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:43.169667 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 194 flow=Background 1970/01/15 06:20:47.729068 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:20:48.911171 0.000000 udp 10.0.2.105 7010 -> 173.11.62.229 1487 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:20:57.543384 0.000000 udp 10.0.2.105 7010 -> 176.240.96.202 1703 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:05.655740 0.000000 udp 10.0.2.105 7010 -> 77.65.25.66 2978 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:12.354958 0.275265 udp 10.0.2.105 7010 -> 171.4.250.195 9881 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:12.630223 0.000000 icmp 171.4.250.195 0x0303 -> 10.0.2.105 0x9926 URP 192 1 265 flow=Background 1970/01/15 06:21:17.231751 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:21:19.445199 0.000000 udp 10.0.2.105 7010 -> 75.145.210.153 1365 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:26.314891 0.000000 udp 10.0.2.105 7010 -> 86.176.93.34 2997 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:32.954450 0.031577 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:21:33.150052 0.000000 udp 10.0.2.105 7010 -> 78.33.171.33 6928 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:38.322363 0.123216 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:21:38.482823 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:43.229377 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:21:43.599657 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:50.900114 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:21:58.111156 0.000000 udp 10.0.2.105 7010 -> 79.77.208.218 1976 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:06.412749 0.000000 udp 10.0.2.105 7010 -> 145.236.129.118 2407 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:11.229282 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:22:15.005298 0.146808 udp 10.0.2.105 7010 <-> 72.137.74.7 7427 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:22:15.222639 0.000000 udp 10.0.2.105 7010 -> 24.172.250.40 1765 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:24.047814 0.000000 udp 10.0.2.105 7010 -> 181.1.130.140 3410 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:29.735901 0.000000 udp 10.0.2.105 7010 -> 81.107.174.222 8198 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:36.205402 0.000000 udp 10.0.2.105 7010 -> 87.16.88.192 5808 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:40.792017 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:22:41.943666 0.000000 udp 10.0.2.105 7010 -> 93.155.253.139 9159 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:50.616238 0.000000 udp 10.0.2.105 7010 -> 68.193.100.50 6097 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:22:56.394777 0.000000 udp 10.0.2.105 7010 -> 176.237.171.139 2200 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:05.237408 0.000000 udp 10.0.2.105 7010 -> 89.210.186.247 6696 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:09.783474 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:23:14.089920 0.000000 udp 10.0.2.105 7010 -> 94.240.229.175 2312 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:21.390255 0.000000 udp 10.0.2.105 7010 -> 83.149.155.14 3636 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:29.061709 0.000000 udp 10.0.2.105 7010 -> 80.108.184.129 7352 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:33.788040 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:23:35.851387 0.000000 udp 10.0.2.105 7010 -> 50.58.42.2 6024 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:43.212172 0.000000 udp 10.0.2.105 7010 -> 186.85.58.66 9398 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:48.620008 0.000000 udp 10.0.2.105 7010 -> 78.144.57.71 6727 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:54.337807 0.162271 udp 10.0.2.105 7010 -> 209.177.211.86 8208 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:23:54.500078 0.000000 icmp 209.177.211.86 0x0303 -> 10.0.2.105 0x1020 URP 192 1 287 flow=Background 1970/01/15 06:23:59.284677 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:24:02.179527 0.000000 udp 10.0.2.105 7010 -> 212.141.80.253 2899 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:08.608853 0.151795 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:24:08.782909 0.000000 udp 10.0.2.105 7010 -> 81.214.28.29 7949 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:17.721661 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1086 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:23.940410 0.058957 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:24:24.076006 0.000000 udp 10.0.2.105 7010 -> 12.87.136.122 5305 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:28.787287 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:24:30.760625 0.193172 udp 10.0.2.105 7010 <-> 108.178.134.95 1873 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:24:30.969947 0.000000 udp 10.0.2.105 7010 -> 194.70.155.2 9912 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:36.799232 0.169357 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:24:36.998635 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:44.980661 0.000000 udp 10.0.2.105 7010 -> 79.36.206.68 5404 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:51.399872 0.097543 udp 10.0.2.105 7010 -> 79.146.155.142 2188 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:24:51.497415 0.000000 icmp 79.146.155.142 0x0303 -> 10.0.2.105 0x8c08 URP 192 1 232 flow=Background 1970/01/15 06:24:56.286789 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:24:59.011206 0.000000 udp 10.0.2.105 7010 -> 107.0.139.66 9422 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:05.690833 0.000000 udp 10.0.2.105 7010 -> 41.202.233.180 9999 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:12.630166 0.158725 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:25:12.802795 0.056827 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:25:12.893206 0.090916 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:25:12.993856 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:20.471809 0.252976 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:25:20.742024 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:25.288374 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:25:28.273244 0.000000 udp 10.0.2.105 7010 -> 217.79.123.16 2137 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:36.785614 0.000000 udp 10.0.2.105 7010 -> 96.25.50.78 4907 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:41.982816 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:47.380364 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:25:52.287574 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:25:53.859621 0.000000 udp 10.0.2.105 7010 -> 207.250.135.98 8219 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:01.100216 0.063731 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:26:01.499697 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:09.081789 0.000000 udp 10.0.2.105 7010 -> 196.219.223.98 1688 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:16.041645 0.000000 udp 10.0.2.105 7010 -> 24.39.169.11 6315 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:19.639280 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 06:26:20.788432 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:26:23.752948 0.000000 udp 10.0.2.105 7010 -> 116.25.86.252 8041 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:26.646839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:26:32.345399 0.000000 udp 10.0.2.105 7010 -> 83.148.187.26 6579 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:34.648039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:26:39.005152 0.053359 udp 10.0.2.105 7010 <-> 86.134.102.14 8490 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:26:39.090250 0.149798 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:26:39.272045 0.087512 udp 10.0.2.105 7010 <-> 109.151.208.171 8486 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:26:39.372899 0.000000 udp 10.0.2.105 7010 -> 124.121.137.244 1286 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:47.997918 0.000000 udp 10.0.2.105 7010 -> 108.238.224.142 5831 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:26:50.651251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:26:52.783968 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:26:54.126313 0.000000 udp 10.0.2.105 7010 -> 64.207.28.54 6206 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:02.508410 0.211099 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:27:02.875337 0.000000 udp 10.0.2.105 7010 -> 146.255.8.214 6793 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:11.811758 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:16.788677 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:27:18.801553 0.000000 udp 10.0.2.105 7010 -> 209.122.160.124 8208 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:22.657007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:27:24.149412 0.000000 udp 10.0.2.105 7010 -> 151.66.167.58 2384 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:31.970543 0.000000 udp 10.0.2.105 7010 -> 213.182.74.17 7970 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:35.656619 0.584217 tcp 10.0.2.105 55103 -> 176.73.211.244 8034 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/15 06:27:40.332887 0.000000 udp 10.0.2.105 7010 -> 79.36.161.19 5995 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:48.784907 0.000000 udp 10.0.2.105 7010 -> 84.197.100.164 9069 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:27:57.687718 0.147065 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:27:57.858097 0.000000 udp 10.0.2.105 7010 -> 79.29.246.107 9258 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:02.283841 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:28:05.118342 0.055375 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:28:05.230298 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:12.499213 0.086163 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:28:12.600815 0.000000 udp 10.0.2.105 7010 -> 79.44.162.38 8740 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:18.538060 0.000000 udp 10.0.2.105 7010 -> 87.22.77.107 8311 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:25.537973 0.198374 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:25.736347 0.000000 icmp 69.234.20.39 0x0303 -> 10.0.2.105 0xb61d URP 192 1 200 flow=Background 1970/01/15 06:28:30.284647 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:28:31.706373 0.000000 udp 10.0.2.105 7010 -> 113.162.67.101 7729 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:39.047464 0.000000 udp 10.0.2.105 7010 -> 96.44.41.133 1452 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:45.155916 0.000000 udp 10.0.2.105 7010 -> 208.148.207.62 1385 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:52.987324 0.000000 udp 10.0.2.105 7010 -> 124.120.44.28 7578 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:28:57.783833 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:29:01.048738 0.000000 udp 10.0.2.105 7010 -> 109.28.97.170 6982 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:09.230503 0.000000 udp 10.0.2.105 7010 -> 182.73.50.154 8974 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:15.569871 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:22.800228 0.176982 udp 10.0.2.105 7010 -> 41.130.238.171 1024 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:22.977210 0.000000 icmp 41.130.238.171 0x0303 -> 10.0.2.105 0x0004 URP 192 1 223 flow=Background 1970/01/15 06:29:27.787427 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:29:29.539878 0.000000 udp 10.0.2.105 7010 -> 87.16.84.57 3431 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:35.588939 0.000000 udp 10.0.2.105 7010 -> 67.51.224.166 1484 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:42.338181 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:51.100984 0.066007 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/01/15 06:29:51.177325 0.000000 udp 10.0.2.105 7010 -> 80.180.167.173 2691 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:29:55.787602 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:30:00.023726 0.000000 udp 10.0.2.105 7010 -> 149.148.152.15 4602 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:07.294317 0.000000 udp 10.0.2.105 7010 -> 94.216.55.12 8964 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:14.975245 0.000000 udp 10.0.2.105 7010 -> 84.133.154.159 4207 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:19.791970 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:30:21.384068 0.000000 udp 10.0.2.105 7010 -> 95.224.202.77 9902 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:29.545841 0.000000 udp 10.0.2.105 7010 -> 80.7.161.7 7976 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:37.637815 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:44.778572 0.000000 udp 10.0.2.105 7010 -> 81.137.224.71 6041 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:49.284149 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:30:52.398772 0.000000 udp 10.0.2.105 7010 -> 122.179.154.128 9928 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:30:58.387371 0.000000 udp 10.0.2.105 7010 -> 85.236.148.125 1679 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:31:05.427391 0.000000 udp 10.0.2.105 7010 -> 46.226.6.238 9356 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:31:10.494823 0.000000 udp 10.0.2.105 7010 -> 207.4.125.2 2129 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:31:15.291630 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:31:15.592596 0.000000 udp 10.0.2.105 7010 -> 109.148.64.143 3965 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:31:21.080039 0.000000 udp 10.0.2.105 7010 -> 80.38.215.51 6380 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:31:26.898739 0.000000 udp 10.0.2.105 7010 -> 88.148.1.252 5430 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 06:33:26.666373 2.998667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 06:33:33.670474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:33:41.671992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:33:57.675475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:34:29.681649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:40:33.687358 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 06:40:40.694866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:40:48.696140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:41:04.699124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:41:36.705260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:47:40.712077 3.000572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 06:47:47.718307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:47:55.720002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:48:11.722805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:48:43.729085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:54:47.785852 3.021000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 06:54:54.812351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:55:02.814371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:55:18.817371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:55:50.823070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 06:57:36.265379 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 06:57:36.265485 0.652146 tcp 10.0.2.105 55104 -> 176.73.211.244 8034 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:01:42.980095 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 07:01:42.980184 0.212865 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:43.193417 0.167013 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:43.360858 0.144238 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:43.505494 0.397222 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:43.903070 0.147476 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.050948 0.020402 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.071710 0.121563 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.193705 0.187215 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.381339 0.116789 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.498541 0.387070 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:44.886002 0.190672 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.077063 0.081792 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.159232 0.138505 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.298114 0.031495 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.329904 0.144864 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.475130 0.291122 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:45.766659 0.467844 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:46.234964 0.144683 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:46.380092 0.173977 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:46.554493 1.581692 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.136724 0.135746 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.272887 0.334605 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.607831 0.203606 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.811846 0.029796 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.842004 0.123254 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:48.965652 0.166066 udp 10.0.2.105 7010 <-> 72.137.74.7 7427 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.132447 0.142848 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.275662 0.054960 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.331035 0.195525 udp 10.0.2.105 7010 <-> 108.178.134.95 1873 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.526940 0.144442 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.671768 0.055036 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.727224 0.158242 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.885906 0.088845 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:49.975102 0.241967 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:50.217461 0.044651 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:50.262474 0.141964 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:01:50.404812 0.000000 udp 10.0.2.105 7010 -> 86.134.102.14 8490 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:01:54.829639 3.001188 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 07:02:01.836312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:02:07.516492 0.080594 tcp 10.0.2.105 55105 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:07.597414 0.073881 tcp 10.0.2.105 55106 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:07.671637 0.200081 tcp 10.0.2.105 55107 -> 195.113.214.236 443 SRPA* 0 0 22 11788 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:07.872223 0.000000 udp 10.0.2.105 7010 -> 109.151.208.171 8486 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:02:09.837945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:02:25.431156 0.051442 tcp 10.0.2.105 55108 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:25.482809 0.073754 tcp 10.0.2.105 55109 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:25.556853 0.175083 tcp 10.0.2.105 55110 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:02:25.732146 0.209508 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:02:25.841162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:02:25.942058 0.141421 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:02:26.083881 0.053223 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:02:26.137551 0.082761 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:02:26.220738 0.112492 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:02:57.846876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:09:01.854195 3.000462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:09:08.860732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:09:16.861916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:09:32.865431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:10:04.870918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:16:08.877486 3.001261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:16:15.884956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:16:23.886237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:16:39.889335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:17:11.895014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:23:15.900713 3.001817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:23:22.908480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:23:30.909907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:23:46.913119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:24:18.919377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:27:36.924389 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 07:27:36.924481 0.572342 tcp 10.0.2.105 55111 -> 176.73.211.244 8034 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:30:22.925625 3.001284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:30:29.932893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:30:37.933792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:30:53.936915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:31:25.943466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:32:48.772732 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 07:32:48.772823 0.000000 udp 10.0.2.105 7010 -> 86.134.102.14 8490 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:33:05.207800 0.032092 tcp 10.0.2.105 55112 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:05.240142 0.077224 tcp 10.0.2.105 55113 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:05.317734 0.179749 tcp 10.0.2.105 55114 -> 195.113.214.236 443 SRPA* 0 0 45 37192 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:05.498125 0.000000 udp 10.0.2.105 7010 -> 109.151.208.171 8486 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:33:23.412587 0.052815 tcp 10.0.2.105 55115 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:23.465272 0.073913 tcp 10.0.2.105 55116 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:23.539039 0.180605 tcp 10.0.2.105 55117 -> 195.113.214.236 443 SRPA* 0 0 32 17994 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:23.720280 0.260887 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:23.981523 0.168876 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.150809 0.146844 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.297998 0.020189 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.318471 0.120842 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.439729 0.163652 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.603775 0.251542 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.855713 0.142176 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:24.998245 0.188658 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.187314 0.403591 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.591309 0.143274 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.734936 0.036831 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.772221 0.086309 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.858931 0.118349 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:25.977735 0.145018 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:26.123158 0.396723 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:26.520311 0.308598 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:26.829312 0.145097 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:26.974762 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:33:44.252842 0.069365 tcp 10.0.2.105 55118 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:44.322500 0.070795 tcp 10.0.2.105 55119 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:44.393534 0.260172 tcp 10.0.2.105 55120 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:33:44.654212 0.129541 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:44.784184 2.142043 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:33:46.926616 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 7427 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:34:04.602246 0.050714 tcp 10.0.2.105 55121 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:04.653298 0.074695 tcp 10.0.2.105 55122 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:04.728318 0.176582 tcp 10.0.2.105 55123 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:04.905527 0.145877 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:05.051829 0.056565 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:05.108783 0.651820 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:05.761013 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:34:20.955175 0.056961 tcp 10.0.2.105 55124 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:21.011989 0.074799 tcp 10.0.2.105 55125 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:21.086660 0.183847 tcp 10.0.2.105 55126 -> 195.113.214.236 443 SRPA* 0 0 45 37226 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:21.271095 0.029876 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:21.301374 0.245681 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:21.547402 0.057978 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:21.605798 0.157821 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:21.764039 0.083537 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:21.847910 0.239202 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:22.087501 0.043978 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:22.131793 0.000000 udp 10.0.2.105 7010 -> 108.178.134.95 1873 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 07:34:39.952790 0.052420 tcp 10.0.2.105 55127 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:40.005504 0.070450 tcp 10.0.2.105 55128 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:40.076220 0.182503 tcp 10.0.2.105 55129 -> 195.113.214.236 443 SRPA* 0 0 43 21526 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:34:40.259342 0.145598 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.405365 0.144946 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.550746 0.055500 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.606666 0.081049 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.688050 0.064679 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.753136 0.210066 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:34:40.963605 0.144220 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 07:37:29.948833 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 07:37:36.956757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:37:44.958381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:38:00.960854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:38:32.967137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:44:36.972402 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:44:43.980319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:44:51.982216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:45:07.985168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:45:39.991343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:51:43.998128 3.000602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:51:51.004530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:51:59.005632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:52:15.008855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:52:47.015063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:57:37.503152 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 07:57:37.503250 0.578060 tcp 10.0.2.105 55130 -> 176.73.211.244 8034 FSPA* 0 0 12 1483 flow=From-Botnet-V2-TCP-Established 1970/01/15 07:58:51.021652 3.000688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 07:58:58.028381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:59:06.029889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:59:22.032766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 07:59:54.038587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:04:45.118033 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 08:04:45.118190 0.182738 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:04:45.301326 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 08:05:02.424205 0.062080 tcp 10.0.2.105 55131 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:02.486568 0.067142 tcp 10.0.2.105 55132 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:02.554083 0.187983 tcp 10.0.2.105 55133 -> 195.113.214.236 443 SRPA* 0 0 42 37030 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:02.742658 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 7427 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 08:05:21.209876 0.052568 tcp 10.0.2.105 55134 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:21.262756 0.071133 tcp 10.0.2.105 55135 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:21.334143 0.171238 tcp 10.0.2.105 55136 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:21.505926 0.000000 udp 10.0.2.105 7010 -> 108.178.134.95 1873 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 08:05:38.965324 0.053353 tcp 10.0.2.105 55137 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:39.018992 0.082837 tcp 10.0.2.105 55138 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:39.102187 0.188552 tcp 10.0.2.105 55139 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:05:39.291041 0.147634 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:39.439164 0.161194 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:39.600775 0.271620 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:39.872800 0.020522 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:39.893714 0.181288 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.075330 0.166430 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.242157 0.121202 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.363776 0.146637 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.510815 0.142533 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.653812 0.140688 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.794901 0.099228 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.894527 0.070865 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:40.965790 0.115225 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.081386 0.038069 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.119835 0.137854 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.258172 0.291177 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.549748 0.147963 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.698057 0.219463 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:41.917934 0.131010 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:42.049371 1.719378 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:43.769166 0.146332 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:43.915925 0.054204 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:43.970530 0.459907 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.430833 0.028036 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.459201 0.057336 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.516940 0.088078 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.605383 0.237777 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.843498 0.045308 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:44.889254 0.163569 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.053236 0.216097 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.269697 0.055613 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.325731 0.083146 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.409260 0.058116 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.467789 0.211530 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.679720 0.142841 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.822997 0.143269 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:45.966657 0.141297 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:05:58.044429 3.002435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 08:06:05.052298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:06:13.053898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:06:29.057137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:07:01.062767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:13:05.069082 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:13:12.076852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:13:20.078350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:13:36.081233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:14:08.087113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:20:12.092423 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:20:19.100259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:20:27.102036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:20:43.104695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:21:15.111099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:27:19.117286 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:27:26.124009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:27:34.125949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:27:38.082596 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 08:27:38.097579 0.678383 tcp 10.0.2.105 55140 -> 176.73.211.244 8034 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:27:50.128852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:28:22.134716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:34:26.151337 3.001397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:34:33.158114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:34:41.159562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:34:57.162986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:35:29.169023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:35:55.887714 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 08:35:55.887813 0.177997 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.066229 0.204666 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.271297 0.020038 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.291658 0.187953 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.480029 0.178903 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.659308 0.121965 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.781763 0.144568 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:35:56.926689 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 08:36:13.084513 0.056544 tcp 10.0.2.105 55141 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:13.141332 0.074334 tcp 10.0.2.105 55142 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:13.216025 0.176853 tcp 10.0.2.105 55143 -> 195.113.214.236 443 SRPA* 0 0 58 39246 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:13.391509 0.204994 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:13.596860 0.146986 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:13.744355 0.143056 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:13.887840 0.085872 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:13.974122 0.040866 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.015402 0.113732 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.129534 0.065718 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.195646 0.144895 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.340939 0.295977 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.637281 0.144845 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:14.782475 0.371234 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:15.154121 0.135167 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:15.289686 0.055420 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:15.345529 1.619572 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:16.965514 0.145950 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:17.111904 0.329855 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:17.442118 0.032034 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:17.474513 0.057529 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:17.532498 0.088512 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:17.621403 0.806574 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:18.428418 0.045924 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:18.474706 0.167535 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:18.642672 0.000000 udp 10.0.2.105 7010 -> 190.155.11.222 7822 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 08:36:35.965625 0.053806 tcp 10.0.2.105 55144 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:36.019712 0.070806 tcp 10.0.2.105 55145 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:36.090875 0.172059 tcp 10.0.2.105 55146 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/15 08:36:36.263457 0.061669 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:36.325536 0.212843 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:36.538796 0.141596 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:36.680800 0.142816 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:36.823967 0.144349 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:36.968722 0.083382 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:36:37.052505 0.062216 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/15 08:41:33.175446 3.061252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 08:41:40.242518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:41:48.243806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:42:04.247099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:42:36.252759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:48:40.258387 3.002218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:48:47.266476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:48:55.338121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:49:11.341044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:49:43.347071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:55:47.353972 3.000243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 08:55:54.360294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:56:02.362033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:56:18.364926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:56:50.370830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 08:57:38.820826 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 08:57:38.820935 0.772496 tcp 10.0.2.105 55147 -> 176.73.211.244 8034 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:02:54.377052 3.001750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:03:01.383960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:03:09.385546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:03:25.388809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:03:57.394722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:06:52.316432 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:06:52.316539 0.168953 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:52.485861 0.261753 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:52.747957 0.020401 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:52.768678 0.249130 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.018219 0.179895 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.198485 0.148120 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.347008 0.223508 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.570852 0.178697 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.750013 0.120312 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:53.870735 0.171853 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.043050 0.145419 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.188891 0.275534 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.464786 0.115082 udp 10.0.2.105 7010 <-> 5.82.165.99 9694 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.580443 0.054960 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.635790 0.144887 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.781072 0.085910 udp 10.0.2.105 7010 <-> 87.181.28.17 8151 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:54.867406 0.143711 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:55.011918 0.555594 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:55.567903 0.136348 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:55.704639 0.054944 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:55.759927 0.151281 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:55.911606 0.297698 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:56.209754 2.260105 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:58.470319 0.219870 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:58.690639 0.088334 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:58.779368 0.395568 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:59.175309 0.028803 udp 10.0.2.105 7010 <-> 79.227.169.62 2430 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:59.204528 0.071096 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:59.276092 0.158046 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:59.434521 0.055469 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:06:59.490357 3.890026 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.380836 0.062416 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.443615 0.178325 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.622377 0.142478 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.765227 0.080884 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.846487 0.057615 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:03.904629 0.209863 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:07:04.114884 0.143084 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:10:01.400699 3.001916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:10:08.408025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:10:16.410110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:10:32.412714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:11:04.418599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:17:08.425209 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:17:15.432546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:17:23.433575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:17:39.436502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:18:11.442736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:24:15.449253 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:24:22.456348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:24:30.457928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:24:46.460514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:25:18.466504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:27:39.599823 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:27:39.599986 0.677333 tcp 10.0.2.105 55148 -> 176.73.211.244 8034 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:31:22.473311 3.000922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:31:29.480127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:31:37.481921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:31:53.484907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:32:25.490336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:37:19.844508 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:37:19.844612 0.020163 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:19.865093 0.209434 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.074926 0.168975 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.244388 0.167507 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.412317 0.208994 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.621706 0.144296 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.766420 0.168427 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:20.935275 0.181834 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:21.117503 0.121741 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:21.239665 2.318922 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:23.559111 0.144851 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:23.559593 2.300318 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 SPA_* 0 0 5 520 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:23.704539 0.034405 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:23.739278 0.151720 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:23.891414 0.000000 udp 10.0.2.105 7010 -> 87.181.28.17 8151 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 09:37:35.096082 4.814621 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 5 3138 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:39.414147 0.031479 tcp 10.0.2.105 55150 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:39.445926 0.085683 tcp 10.0.2.105 55151 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:39.531899 0.166536 tcp 10.0.2.105 55152 -> 195.113.214.236 443 SRPA* 0 0 70 46161 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:39.697429 0.140584 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:39.838505 0.040690 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:39.879577 0.000000 udp 10.0.2.105 7010 -> 5.82.165.99 9694 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 09:37:40.113204 2.593621 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 10 4912 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:46.702033 4.997481 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 15 12006 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:53.619983 4.989361 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 34 19668 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:55.886082 0.059748 tcp 10.0.2.105 55153 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:55.946233 0.075148 tcp 10.0.2.105 55154 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:56.021177 0.238925 tcp 10.0.2.105 55155 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:37:56.260558 0.217298 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:56.478291 0.130467 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:56.609155 0.055082 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:37:56.664675 0.000000 udp 10.0.2.105 7010 -> 67.86.242.80 8736 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 09:38:02.991556 2.558557 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 17 15254 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:10.056907 2.583512 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 8894 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:11.799028 0.058641 tcp 10.0.2.105 55156 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:11.858007 0.080227 tcp 10.0.2.105 55157 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:11.938537 0.179137 tcp 10.0.2.105 55158 -> 195.113.214.236 443 SRPA* 0 0 42 23050 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:12.118079 0.303279 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:12.421817 0.088336 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:12.510563 0.324102 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:12.835068 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 09:38:22.565850 4.975364 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:29.496946 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 09:38:29.775180 4.987511 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 5 3138 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:31.316849 0.059944 tcp 10.0.2.105 55159 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:31.377074 0.073669 tcp 10.0.2.105 55160 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:31.451068 0.195339 tcp 10.0.2.105 55161 -> 195.113.214.236 443 SRPA* 0 0 42 30864 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:31.646202 0.083603 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:31.730157 2.149978 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:33.880632 0.146132 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.027138 0.154190 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.181671 0.044634 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.226655 0.397898 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.624923 0.067616 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.692956 0.161144 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.854497 0.147256 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:34.961936 4.776681 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 9080 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:35.002132 0.082199 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:35.084749 0.057271 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:35.142372 0.209539 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:35.352376 0.137467 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/15 09:38:36.503990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:38:41.676726 4.938895 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 7914 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:44.505340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:38:46.819021 4.646667 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 15 8534 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:55.977070 4.892559 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 27 23386 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:38:56.342968 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:39:00.508907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:39:05.482842 2.403756 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 7 4474 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:12.883137 2.787328 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:20.292512 4.409920 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 16 9656 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:26.763931 4.679372 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 10942 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:32.515070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:39:33.486187 4.856920 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 7 3874 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:42.822940 0.396931 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:43.350231 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:39:49.366448 2.596246 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:39:55.807567 2.634429 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 12 10040 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:02.512727 2.759221 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 10942 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:07.344491 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:40:09.163238 4.680800 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 24 19128 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:18.423163 2.591023 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 8 4528 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:25.371512 4.496028 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 9548 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:34.488863 4.424612 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 17 10558 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:39.350727 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:40:40.971748 4.377893 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 10942 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:47.193145 4.855959 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 9 4230 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:40:52.249074 4.065845 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 7852 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:00.718390 4.669850 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 18 11212 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:05.849150 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:41:07.441142 2.674006 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 15 12498 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:14.232625 2.522269 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 11542 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:21.348985 4.668908 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 18 13260 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:28.048772 4.789351 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 14 12444 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:32.847824 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:41:34.844715 4.872962 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 25 19782 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:41.857603 4.957121 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 6 3792 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:47.007716 4.455929 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 21 12002 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:41:56.336320 0.405643 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:01.390857 4.774420 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 17 10310 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:06.345438 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:42:08.037808 4.967110 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 8 5348 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:13.205564 4.837268 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 13 6026 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:22.305466 2.527237 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:29.188831 4.766377 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 24 15632 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:34.345803 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:42:35.902175 4.903529 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 15 11050 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:42.946364 4.909423 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 10 7532 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:49.962897 2.579044 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 16 10256 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:42:57.261748 4.814542 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 19 13314 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:02.345941 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:43:04.067478 4.868016 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 10 8132 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:09.135797 1.918761 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 8 5128 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:15.876288 2.390656 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 7 4370 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:23.081430 4.892035 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 18 11316 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:27.852988 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:43:29.943150 2.526430 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 15 9002 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:37.004185 2.805719 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 9 6278 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:44.361408 2.729058 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 8 3680 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:43:56.614917 2.702934 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:44:01.350905 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:44:18.806322 2.733045 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 FPA_* 0 0 10 3169 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:44:26.423699 0.000157 tcp 10.0.2.105 55149 -> 70.61.48.21 9140 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:45:36.530533 3.001938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 09:45:43.537726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:45:51.539364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:46:07.542417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:46:39.548438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:52:43.555661 3.000552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:52:50.562310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:52:58.563472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:53:14.566453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:53:46.572540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 09:57:40.289381 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 09:57:40.289467 0.588475 tcp 10.0.2.105 55162 -> 176.73.211.244 8034 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/15 09:59:50.579050 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 09:59:57.586043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:00:05.587920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:00:21.590195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:00:53.597055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:06:57.602414 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:07:04.610180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:07:12.611244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:07:28.614228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:08:00.620609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:08:50.873063 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 10:08:50.873155 0.000000 udp 10.0.2.105 7010 -> 5.82.165.99 9694 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:09:09.771950 0.031961 tcp 10.0.2.105 55163 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:09.804183 0.072441 tcp 10.0.2.105 55164 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:09.876921 0.189829 tcp 10.0.2.105 55165 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:10.066927 0.000000 udp 10.0.2.105 7010 -> 87.181.28.17 8151 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:09:27.866831 0.052382 tcp 10.0.2.105 55166 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:27.919534 0.075456 tcp 10.0.2.105 55167 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:27.995271 0.179091 tcp 10.0.2.105 55168 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:28.174923 0.145523 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:09:28.320784 0.000000 udp 10.0.2.105 7010 -> 79.227.169.62 2430 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:09:45.331954 0.058313 tcp 10.0.2.105 55169 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:45.390547 0.114074 tcp 10.0.2.105 55170 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:45.504908 0.191450 tcp 10.0.2.105 55171 -> 195.113.214.236 443 SRPA* 0 0 33 18052 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:09:45.695576 0.212575 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:09:45.908518 0.019667 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:09:45.928685 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:10:03.447736 0.033030 tcp 10.0.2.105 55172 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:10:03.480625 0.075753 tcp 10.0.2.105 55173 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:10:03.556719 0.184308 tcp 10.0.2.105 55174 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:10:03.741495 0.182507 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:03.924371 0.119984 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:04.044760 0.166185 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:04.211316 0.150223 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:04.361891 0.162230 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:04.524579 0.248179 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:04.773090 0.382719 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.156215 0.144854 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.301465 0.147017 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.448857 0.032363 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.481551 0.145071 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.627025 0.040974 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.668536 0.055466 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.724445 0.138845 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:05.863693 0.229127 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:06.093162 0.288625 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:06.382135 0.092996 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:06.475552 0.385920 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:06.861934 0.108518 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:06.970872 0.181123 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:07.152396 0.045130 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:07.197900 2.098846 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:09.297154 0.184699 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:09.482209 0.236138 udp 10.0.2.105 7010 <-> 75.254.146.180 5379 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:09.718747 0.068886 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:09.788030 0.147559 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:09.936022 0.144593 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:10.081006 0.079985 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:10.161412 0.057544 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:10.219343 0.246370 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:10:10.466098 0.146774 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:14:04.626986 3.001513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 10:14:11.633943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:14:19.635586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:14:35.638191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:15:07.644142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:21:11.650683 3.001435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:21:18.657781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:21:26.659515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:21:42.662642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:22:14.668435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:27:40.877819 0.014866 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 10:27:40.892901 0.544254 tcp 10.0.2.105 55175 -> 176.73.211.244 8034 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:28:18.673991 3.001916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:28:25.682007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:28:33.683614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:28:49.686379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:29:21.692318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:35:25.698972 3.001131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:35:32.706135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:35:40.707460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:35:56.710227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:36:28.716097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:40:10.776118 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 10:40:10.776220 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:40:25.969745 0.068002 tcp 10.0.2.105 55176 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:26.038066 0.080233 tcp 10.0.2.105 55177 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:26.118596 0.202360 tcp 10.0.2.105 55178 -> 195.113.214.236 443 SRPA* 0 0 34 27782 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:26.321563 0.147533 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:26.469504 0.223213 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:26.693164 0.020228 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:26.713908 0.181994 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:26.896457 0.121737 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 199 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:27.018562 0.169109 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:27.188070 0.249384 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:27.437852 0.339282 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:27.777533 0.137707 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:27.915649 0.146509 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.062685 0.164988 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.228110 0.144784 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.373236 0.033938 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.407504 0.144227 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.552071 0.151865 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.704363 0.058410 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.763188 0.134469 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:28.898043 0.450047 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:29.348533 0.423182 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:29.772139 0.056872 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:29.829374 0.152855 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:29.982648 0.044765 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:30.027768 0.302986 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:30.331212 0.092397 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:30.423973 0.344440 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:30.768850 0.216316 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:30.985559 0.000000 udp 10.0.2.105 7010 -> 75.254.146.180 5379 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:40:47.168425 0.060141 tcp 10.0.2.105 55179 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:47.228898 0.087475 tcp 10.0.2.105 55180 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:47.316689 0.190926 tcp 10.0.2.105 55181 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:40:47.508221 0.056007 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:47.564614 0.145989 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:47.711097 0.144409 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:47.855907 0.090103 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:40:47.946421 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 10:41:03.662321 0.029979 tcp 10.0.2.105 55182 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:41:03.692616 0.080005 tcp 10.0.2.105 55183 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:41:03.772973 0.175887 tcp 10.0.2.105 55184 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:41:03.949371 0.224437 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:41:04.174235 0.141882 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/15 10:42:32.722711 3.001038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 10:42:39.729580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:42:47.731265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:43:03.734673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:43:35.740613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:49:39.746684 3.091554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:49:46.844101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:49:54.845801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:50:10.848814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:50:42.854235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:56:46.860175 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 10:56:53.868135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:57:01.869101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:57:17.872048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 10:57:41.456575 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 10:57:41.456678 0.548645 tcp 10.0.2.105 55185 -> 176.73.211.244 8034 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/01/15 10:57:49.878239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:03:53.885124 3.001127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:04:00.891690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:04:08.893452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:04:24.895981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:04:56.902158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:11:00.909193 3.000864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:11:07.915571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:11:14.125080 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 11:11:14.125175 0.000000 udp 10.0.2.105 7010 -> 75.254.146.180 5379 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 11:11:15.917399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:11:31.602317 0.052804 tcp 10.0.2.105 55186 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:31.655405 0.082528 tcp 10.0.2.105 55187 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:31.738255 0.188267 tcp 10.0.2.105 55188 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:31.920537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:11:31.927068 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 11:11:48.094136 0.034049 tcp 10.0.2.105 55189 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:48.128485 0.083320 tcp 10.0.2.105 55190 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:48.211673 0.178166 tcp 10.0.2.105 55191 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:11:48.390406 0.179646 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:48.570461 0.119871 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:48.690762 0.166868 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:48.858026 0.020128 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:48.878466 0.231503 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:49.110406 0.151637 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:49.262408 0.149258 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:49.412083 0.144495 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:49.556908 0.258421 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:49.815676 0.293649 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.109740 0.151909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.262074 0.037418 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.299896 0.055323 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.355613 0.130702 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.486685 0.233025 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.720164 0.147665 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.868198 0.039000 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:50.908011 0.144681 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.053086 0.044588 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.098096 0.286808 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.385315 0.071517 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.457275 0.325739 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.783472 0.162111 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:11:51.945990 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 11:12:03.926221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:12:07.963069 0.057674 tcp 10.0.2.105 55192 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:12:08.020996 0.073946 tcp 10.0.2.105 55193 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:12:08.095249 0.192035 tcp 10.0.2.105 55194 -> 195.113.214.236 443 SRPA* 0 0 42 21666 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:12:08.287603 0.575926 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:08.863942 0.063788 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:08.928072 0.082202 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:09.010647 0.191648 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:09.202698 0.055218 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:09.258234 0.143490 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:09.402120 0.203965 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:12:09.606496 0.145605 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:18:07.933172 3.030869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:18:14.969759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:18:22.971262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:18:38.974054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:19:11.230482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:25:15.236799 3.001371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:25:22.244270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:25:30.245849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:25:46.248721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:26:18.254576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:27:42.116045 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 11:27:42.116141 0.561327 tcp 10.0.2.105 55195 -> 176.73.211.244 8034 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:32:22.260488 3.002001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:32:29.268036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:32:37.269240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:32:53.272850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:33:25.278701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:39:29.285136 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:39:36.292024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:39:44.293621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:40:00.296956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:40:32.302893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:42:32.605984 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 11:42:32.606235 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 11:42:51.073734 0.055905 tcp 10.0.2.105 55196 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:42:51.129942 0.067278 tcp 10.0.2.105 55197 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:42:51.197522 0.192513 tcp 10.0.2.105 55198 -> 195.113.214.236 443 SRPA* 0 0 67 69800 flow=From-Botnet-V2-TCP-Established 1970/01/15 11:42:51.390683 0.168772 udp 10.0.2.105 7010 <-> 76.240.25.244 2185 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:51.559822 0.019953 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:51.580071 0.221202 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:51.801624 0.140073 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:51.942131 0.184915 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.127388 0.120195 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.248000 0.144368 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.392739 0.265574 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.658749 0.166354 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.825444 0.148628 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:52.974471 0.136580 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.111395 0.055299 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.167109 0.144600 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.312057 0.146525 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.459001 0.108416 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.567814 0.142886 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.711038 0.044893 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.756312 0.132543 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:53.889270 0.293102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:54.182765 0.160851 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:54.344082 0.286661 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:54.631118 0.082496 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:54.713999 0.331572 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:55.046014 0.471741 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:55.518164 0.386458 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:55.904960 0.079806 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:55.985101 0.154899 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:56.140568 0.053356 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:56.194276 0.143585 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:56.338271 0.144849 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:42:56.483568 0.209377 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/15 11:46:36.309022 3.071171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:46:43.386373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:46:51.387862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:47:07.390313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:47:39.396420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:53:43.403282 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 11:53:50.409796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:53:58.411954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:54:14.414311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:54:46.420876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 11:57:42.714404 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 11:57:42.714548 0.582293 tcp 10.0.2.105 55199 -> 176.73.211.244 8034 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:00:50.426751 3.001809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:00:57.434314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:01:05.435214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:01:21.438335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:01:53.444627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:07:57.451017 3.000907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:08:04.458160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:08:12.459594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:08:28.462650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:09:00.468871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:13:24.448622 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 12:13:24.448724 0.239031 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:24.689013 0.153227 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:24.842650 0.186171 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:25.029198 0.122373 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:25.151971 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 12:13:43.006550 0.031642 tcp 10.0.2.105 55200 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:13:43.038521 0.065401 tcp 10.0.2.105 55201 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:13:43.104233 0.163556 tcp 10.0.2.105 55202 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:13:43.267769 0.020062 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.288155 0.143214 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.431804 0.219316 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.651533 0.165468 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.817419 0.143812 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.961649 0.034392 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:43.996551 0.055475 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.052474 0.144804 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.197645 0.150148 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.348212 0.040601 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.389251 0.134552 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.524131 0.046413 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.570992 0.137278 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.708693 0.210043 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:44.919100 0.151954 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.071527 0.332673 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.404633 0.294732 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.699757 0.064793 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.764904 0.144631 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.909909 0.059941 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:45.970272 0.080650 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:46.051336 0.149268 udp 10.0.2.105 7010 <-> 99.181.129.86 2350 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:46.200954 0.053538 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:46.254835 0.139233 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:46.394467 0.144985 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:13:46.539912 0.207399 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:15:04.474448 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:15:11.501934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:15:19.503611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:15:35.506201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:16:07.512346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:22:11.519275 3.000613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:22:18.525645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:22:26.527571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:22:42.530243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:23:14.537002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:27:43.303269 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 12:27:43.303382 0.523437 tcp 10.0.2.105 55203 -> 176.73.211.244 8034 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:29:18.543404 3.000620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:29:25.550088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:29:33.551438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:29:49.554282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:30:21.560368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:36:25.566865 3.001466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:36:32.573751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:36:40.575119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:36:56.578210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:37:28.584584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:43:32.591101 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:43:39.598155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:43:47.599515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:43:57.584264 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 12:43:57.584469 0.000000 udp 10.0.2.105 7010 -> 76.240.25.244 2185 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 12:44:03.602304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:44:14.170093 0.053308 tcp 10.0.2.105 55204 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:14.223693 0.072953 tcp 10.0.2.105 55205 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:14.296901 0.169861 tcp 10.0.2.105 55206 -> 195.113.214.236 443 SRPA* 0 0 39 31174 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:14.467411 0.120161 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:14.587973 0.153069 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:14.741386 0.240962 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:14.982769 0.183214 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.166377 0.020107 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.186840 0.144775 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.332016 0.232080 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.564470 0.186790 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.751672 0.144480 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.896560 0.031269 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.928117 0.054462 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:15.982985 0.137841 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.121248 0.148316 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.269949 0.156747 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.427153 0.141056 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.568617 0.046733 udp 10.0.2.105 7010 <-> 5.13.35.165 2778 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.615737 0.134873 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.751028 0.217779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:16.969224 0.157471 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:17.127064 0.325678 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:17.453141 0.288960 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:17.742513 0.057007 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:17.799918 0.144886 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:17.945209 0.059938 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:18.005516 0.082138 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:18.088001 0.000000 udp 10.0.2.105 7010 -> 99.181.129.86 2350 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 12:44:35.428785 0.051498 tcp 10.0.2.105 55207 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:35.480577 0.073279 tcp 10.0.2.105 55208 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:35.554234 0.171457 tcp 10.0.2.105 55209 -> 195.113.214.236 443 SRPA* 0 0 44 32904 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:44:35.608512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:44:35.726428 0.057071 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:35.783904 0.207780 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:35.992115 0.142257 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:44:36.134796 0.256490 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/15 12:50:39.615111 3.071439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:50:46.691914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:50:54.693370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:51:10.696471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:51:42.703255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:57:43.851991 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 12:57:43.852129 0.545111 tcp 10.0.2.105 55210 -> 176.73.211.244 8034 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/15 12:57:46.709201 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 12:57:53.716144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:58:01.717087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:58:17.720093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 12:58:49.726270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:04:53.733234 3.000953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:05:00.739692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:05:08.741666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:05:24.744055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:05:56.750283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:12:04.501934 3.001874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:12:11.509186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:12:19.510378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:12:35.514018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:13:07.520825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:14:56.807380 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 13:14:56.807475 0.000000 udp 10.0.2.105 7010 -> 99.181.129.86 2350 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:15:13.031688 0.053836 tcp 10.0.2.105 55211 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:13.085359 0.076512 tcp 10.0.2.105 55212 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:13.162178 0.146843 tcp 10.0.2.105 55213 -> 195.113.214.236 443 SRPA* 0 0 57 35655 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:13.309617 0.260560 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:13.570599 0.191692 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:13.762693 0.019988 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:13.783042 0.119919 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:13.903468 0.155039 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.058900 0.248857 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.308158 0.250484 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.559043 0.144951 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.704537 0.031369 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.736308 0.143521 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:14.880218 0.137971 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:15.018616 0.179211 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:15.198202 0.053570 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:15.252137 0.000000 udp 10.0.2.105 7010 -> 5.13.35.165 2778 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:15:32.348415 0.051399 tcp 10.0.2.105 55214 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:32.400081 0.075947 tcp 10.0.2.105 55215 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:32.476503 0.149760 tcp 10.0.2.105 55216 -> 195.113.214.236 443 SRPA* 0 0 69 69908 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:32.627035 0.136552 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:32.763996 0.264570 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.029058 0.151479 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.180963 0.038473 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.219800 0.139064 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.359276 0.287130 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.646831 0.059999 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.707287 0.147533 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:33.855218 0.490354 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:34.345944 0.079996 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:34.426340 0.329545 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:34.756401 0.141175 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:34.897985 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:15:49.983872 0.051091 tcp 10.0.2.105 55217 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:50.035207 0.074344 tcp 10.0.2.105 55218 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:50.109483 0.155904 tcp 10.0.2.105 55219 -> 195.113.214.236 443 SRPA* 0 0 42 23318 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:15:50.264623 0.207347 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:15:50.472441 0.145311 udp 10.0.2.105 7010 <-> 70.54.32.137 3419 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:19:11.526153 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 13:19:18.533550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:19:26.534372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:19:42.537755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:20:14.543803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:26:18.550255 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:26:25.557176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:26:33.558435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:26:49.561456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:27:21.567619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:27:46.213968 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 13:27:46.214065 2.993191 tcp 10.0.2.105 55220 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 13:27:55.206043 0.000000 tcp 10.0.2.105 55220 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/15 13:28:01.216679 0.053125 tcp 10.0.2.105 55221 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:28:01.270030 0.074341 tcp 10.0.2.105 55222 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:28:01.344732 0.163002 tcp 10.0.2.105 55223 -> 195.113.214.236 443 SRPA* 0 0 32 17620 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:28:01.546828 0.944392 tcp 10.0.2.105 55224 -> 184.182.240.239 7058 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:33:25.574539 3.000586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:33:32.580875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:33:40.582641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:33:56.585458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:34:28.591681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:40:32.597887 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:40:39.605294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:40:47.606301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:41:03.609479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:41:35.615887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:46:14.276645 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 13:46:14.276835 0.000000 udp 10.0.2.105 7010 -> 5.13.35.165 2778 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:46:30.220937 0.072775 tcp 10.0.2.105 55225 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:30.294064 0.075243 tcp 10.0.2.105 55226 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:30.369624 0.154940 tcp 10.0.2.105 55227 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:30.525070 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:46:46.382815 0.051480 tcp 10.0.2.105 55228 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:46.434134 0.074467 tcp 10.0.2.105 55229 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:46.508917 0.157081 tcp 10.0.2.105 55230 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:46:46.666239 0.159442 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:46.826260 0.307523 udp 10.0.2.105 7010 <-> 190.155.11.222 7822 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.134171 0.020237 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.154771 0.186204 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.341391 0.246135 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.587999 0.120167 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.708579 0.031371 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.740454 0.142437 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:47.883365 0.145166 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.028940 0.142391 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.171757 0.054954 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.227143 0.167348 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.394944 0.145179 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.540546 0.037183 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.578122 0.142923 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.721441 0.137606 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:48.859449 0.210591 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:49.070367 0.160105 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:49.230880 0.148849 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:49.380141 0.082361 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:49.462945 0.302011 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:46:49.765373 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:47:06.191323 0.051278 tcp 10.0.2.105 55231 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:06.242842 0.075567 tcp 10.0.2.105 55232 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:06.318700 0.151823 tcp 10.0.2.105 55233 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:06.471168 0.324132 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:47:06.795674 0.079012 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:47:06.875074 0.141836 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:47:07.017301 0.209254 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/15 13:47:07.226876 0.000000 udp 10.0.2.105 7010 -> 70.54.32.137 3419 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 13:47:25.419102 0.051652 tcp 10.0.2.105 55234 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:25.470633 0.075942 tcp 10.0.2.105 55235 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:25.546779 0.156458 tcp 10.0.2.105 55236 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/15 13:47:39.622457 3.000779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 13:47:46.628834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:47:54.630603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:48:10.633656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:48:42.639448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:54:46.646369 3.001117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 13:54:53.653058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:55:01.654263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:55:17.657853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:55:49.663904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 13:58:02.494596 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 13:58:02.494685 0.809353 tcp 10.0.2.105 55237 -> 184.182.240.239 7058 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:01:53.670397 3.000605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:02:00.677331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:02:08.678475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:02:24.681664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:02:56.687617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:09:00.693834 3.131751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:09:07.831305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:09:15.832828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:09:31.835379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:10:03.841692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:16:07.847434 3.001554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:16:14.855127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:16:22.856831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:16:38.859932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:17:10.865902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:17:34.759913 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:17:34.760069 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:17:50.404637 0.051806 tcp 10.0.2.105 55238 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:17:50.456777 0.074525 tcp 10.0.2.105 55239 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:17:50.531549 0.153281 tcp 10.0.2.105 55240 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:17:50.685496 0.000000 udp 10.0.2.105 7010 -> 70.54.32.137 3419 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:18:05.725860 0.053132 tcp 10.0.2.105 55241 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:05.779263 0.074888 tcp 10.0.2.105 55242 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:05.854469 0.157208 tcp 10.0.2.105 55243 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:06.012316 0.020251 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:06.032956 0.000000 udp 10.0.2.105 7010 -> 190.155.11.222 7822 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:18:24.541861 0.052256 tcp 10.0.2.105 55244 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:24.594414 0.075238 tcp 10.0.2.105 55245 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:24.669900 0.159508 tcp 10.0.2.105 55246 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:18:24.829583 0.149723 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:24.979656 0.188832 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.201582 0.031773 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.233685 0.140979 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.375034 0.141676 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.517104 0.146984 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.664508 0.054498 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.719407 0.120230 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:25.840033 0.273625 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.114005 0.142157 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.256521 0.136028 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.392894 0.228803 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.622045 0.155070 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.777442 0.144878 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:26.922762 0.189084 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.112411 0.038753 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.151499 0.282196 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.434056 0.059447 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.493908 0.141850 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.636112 0.246022 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.882539 0.078247 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:27.961155 0.324412 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:18:28.285938 0.141174 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:23:14.872090 3.080955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 14:23:21.959062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:23:29.960912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:23:45.963579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:24:17.970008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:28:03.394225 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:28:03.394319 0.902588 tcp 10.0.2.105 55247 -> 184.182.240.239 7058 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:30:21.975048 3.002237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:30:28.983410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:30:36.984547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:30:52.987608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:31:24.993472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:37:29.000444 3.000555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:37:36.007158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:37:44.009174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:38:00.011842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:38:32.017443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:44:36.024207 3.011020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 14:44:43.041005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:44:51.042795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:45:07.045612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:45:39.051790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:48:54.352767 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:48:54.352848 0.000000 udp 10.0.2.105 7010 -> 190.155.11.222 7822 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:12.650880 0.053768 tcp 10.0.2.105 55248 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:49:12.704922 0.073782 tcp 10.0.2.105 55249 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:49:12.779065 0.158773 tcp 10.0.2.105 55250 -> 195.113.214.236 443 SRPA* 0 0 38 24552 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:49:12.938530 4.168249 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1240 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:12.959752 3.799472 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 4 1161 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:12.992546 3.911080 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 4 1211 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:13.139154 3.946100 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1249 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:13.327872 3.952056 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 4 1181 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:13.691187 3.736428 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 1167 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:13.837055 3.736716 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1283 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:13.982392 3.642408 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1246 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.036643 3.709353 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1160 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.157954 3.777921 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1281 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.358702 3.722217 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 4 1164 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.498635 3.710999 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 4 1245 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.630545 3.790029 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 914 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.832589 3.742613 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1127 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:14.995306 3.732593 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1305 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.147508 3.765983 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 938 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.335680 4.426797 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 4 1041 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.373885 3.693138 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 4 1263 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.521393 3.755081 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 4 1069 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.778065 3.580598 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1149 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:15.858552 3.860649 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1103 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:16.202002 4.056427 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1143 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:16.489252 3.335538 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 4 1201 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:16.567096 3.403700 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1062 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:49:20.259113 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:27.460392 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:36.282876 0.000000 udp 10.0.2.105 7010 -> 95.70.170.149 8173 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:40.939359 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:49:45.137125 0.000000 udp 10.0.2.105 7010 -> 86.220.100.238 8476 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:51.625110 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:49:57.863794 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 2171 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:05.134764 0.000000 udp 10.0.2.105 7010 -> 151.84.129.47 1184 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:09.931157 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:50:11.904300 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:19.404885 0.000000 udp 10.0.2.105 7010 -> 69.116.245.21 3346 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:28.167781 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:34.266437 0.000000 udp 10.0.2.105 7010 -> 24.56.177.80 3264 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:38.932690 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:50:42.157802 0.000000 udp 10.0.2.105 7010 -> 190.87.195.2 4498 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:49.567954 0.000000 udp 10.0.2.105 7010 -> 71.195.238.201 9442 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:50:58.220714 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:02.936898 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:51:05.530910 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:10.848937 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:18.840383 0.000000 udp 10.0.2.105 7010 -> 50.193.82.157 3140 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:25.079457 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:29.935898 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:51:31.278572 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:36.746194 0.000000 udp 10.0.2.105 7010 -> 93.193.154.8 7662 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:43.057547 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 14:51:44.807966 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:50.065233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:51:52.187908 0.000000 udp 10.0.2.105 7010 -> 84.253.45.7 2075 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:51:56.934868 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:51:58.066247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:51:59.719133 0.000000 udp 10.0.2.105 7010 -> 81.15.213.168 8449 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:05.547693 0.000000 udp 10.0.2.105 7010 -> 188.50.35.84 8205 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:11.516110 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:14.069462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:52:17.775005 0.000000 udp 10.0.2.105 7010 -> 200.8.96.85 5327 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:22.431904 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:52:24.484670 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:30.963990 0.000000 udp 10.0.2.105 7010 -> 201.151.131.154 2892 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:37.032995 0.000000 udp 10.0.2.105 7010 -> 70.72.69.30 8489 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:43.011739 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:46.075865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:52:47.938294 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:52:51.152890 0.000000 udp 10.0.2.105 7010 -> 67.0.232.147 9846 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:52:56.541086 0.000000 udp 10.0.2.105 7010 -> 70.195.207.27 7155 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:04.011811 0.000000 udp 10.0.2.105 7010 -> 95.224.215.143 2283 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:11.282184 0.000000 udp 10.0.2.105 7010 -> 81.156.63.97 4530 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:15.938458 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:53:18.732381 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:25.802850 0.000000 udp 10.0.2.105 7010 -> 58.152.175.199 2973 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:31.701350 0.000000 udp 10.0.2.105 7010 -> 90.206.129.197 9958 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:37.140052 0.000000 udp 10.0.2.105 7010 -> 121.54.77.87 2821 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:41.935947 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:53:42.897183 0.000000 udp 10.0.2.105 7010 -> 184.74.168.82 5338 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:49.857704 0.000000 udp 10.0.2.105 7010 -> 84.197.100.164 1067 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:53:57.147600 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:06.151236 0.000000 udp 10.0.2.105 7010 -> 109.255.79.150 3826 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:10.937513 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:54:13.311488 0.000000 udp 10.0.2.105 7010 -> 174.141.57.178 5164 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:19.580250 0.000000 udp 10.0.2.105 7010 -> 182.71.164.209 1407 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:27.952193 0.047007 udp 10.0.2.105 7010 <-> 78.134.107.235 6943 CON 0 0 2 710 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:54:28.018562 0.000000 udp 10.0.2.105 7010 -> 176.199.239.154 5230 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:34.992207 0.027733 udp 10.0.2.105 7010 -> 94.216.55.12 8964 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:35.019940 0.000000 icmp 94.216.55.12 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 306 flow=Background 1970/01/15 14:54:39.939299 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:54:43.625002 0.000000 udp 10.0.2.105 7010 -> 69.142.23.247 8236 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:50.374170 0.000000 udp 10.0.2.105 7010 -> 67.149.200.85 9820 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:54:58.997095 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:03.933607 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:55:04.554482 0.000000 udp 10.0.2.105 7010 -> 203.206.207.1 6000 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:10.583301 0.000000 udp 10.0.2.105 7010 -> 92.103.177.68 7672 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:16.812256 0.000000 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:23.131718 0.000000 udp 10.0.2.105 7010 -> 173.168.202.154 1302 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:27.937908 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:55:30.972821 0.000000 udp 10.0.2.105 7010 -> 216.215.106.130 2268 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:36.601177 0.000000 udp 10.0.2.105 7010 -> 95.242.198.35 4766 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:42.199312 0.000000 udp 10.0.2.105 7010 -> 79.54.199.83 3768 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:47.406240 0.000000 udp 10.0.2.105 7010 -> 41.220.12.5 2252 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:55:51.932665 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:55:53.585588 0.000000 udp 10.0.2.105 7010 -> 85.236.148.125 1679 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:02.188060 0.000000 udp 10.0.2.105 7010 -> 121.72.44.197 3196 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:09.898694 0.000000 udp 10.0.2.105 7010 -> 200.46.214.133 4147 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:17.810133 0.000000 udp 10.0.2.105 7010 -> 96.39.2.178 3085 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:22.436576 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:56:22.877574 0.000000 udp 10.0.2.105 7010 -> 202.63.156.174 7664 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:30.117761 0.000000 udp 10.0.2.105 7010 -> 72.219.142.58 2272 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:36.497512 0.000000 udp 10.0.2.105 7010 -> 87.11.38.117 3217 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:41.794335 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:46.431385 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:56:47.573265 0.000000 udp 10.0.2.105 7010 -> 84.92.66.11 8449 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:53.321676 0.000000 udp 10.0.2.105 7010 -> 66.196.207.90 9944 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:56:59.429921 0.000000 udp 10.0.2.105 7010 -> 2.231.96.156 9134 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:05.498883 0.000000 udp 10.0.2.105 7010 -> 50.11.251.87 2037 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:10.435520 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:57:12.088509 0.000000 udp 10.0.2.105 7010 -> 99.107.251.77 1839 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:18.267159 0.000000 udp 10.0.2.105 7010 -> 109.204.19.179 9194 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:26.989993 0.000000 udp 10.0.2.105 7010 -> 92.23.132.254 2722 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:35.041553 0.000000 udp 10.0.2.105 7010 -> 69.15.27.221 2682 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:39.937715 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:57:43.423529 0.157743 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:57:43.630667 0.000000 udp 10.0.2.105 7010 -> 188.54.78.238 4378 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:49.231557 0.000000 udp 10.0.2.105 7010 -> 187.246.221.208 4816 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:57:57.833938 0.000000 udp 10.0.2.105 7010 -> 178.105.187.28 6256 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:04.303373 0.882191 tcp 10.0.2.105 55251 -> 184.182.240.239 7058 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/15 14:58:04.663577 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:13.095994 0.000000 udp 10.0.2.105 7010 -> 110.55.116.57 7963 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:21.968729 0.000000 udp 10.0.2.105 7010 -> 87.91.33.133 3827 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:29.469323 0.197676 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:29.666999 0.000000 icmp 69.234.20.39 0x0303 -> 10.0.2.105 0xb61d URP 192 1 252 flow=Background 1970/01/15 14:58:34.436059 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:58:36.659745 0.000000 udp 10.0.2.105 7010 -> 93.186.211.86 1048 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:42.298139 0.285124 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:58:42.594790 0.000000 udp 10.0.2.105 7010 -> 85.97.35.172 2031 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:48.246304 0.000000 udp 10.0.2.105 7010 -> 94.199.27.108 8764 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:50.082412 3.000794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 14:58:55.957182 0.000000 udp 10.0.2.105 7010 -> 79.46.25.82 3704 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:58:57.089219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:59:00.934507 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:59:02.407063 0.000000 udp 10.0.2.105 7010 -> 98.206.41.175 7426 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:05.090506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:59:10.548298 0.000000 udp 10.0.2.105 7010 -> 207.112.105.208 6759 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:16.917634 0.000000 udp 10.0.2.105 7010 -> 75.130.63.194 7084 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:21.093294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:59:25.089712 0.000000 udp 10.0.2.105 7010 -> 113.162.67.101 7729 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:29.936161 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:59:32.950405 0.112252 udp 10.0.2.105 7010 <-> 85.72.53.197 1143 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:59:33.075481 0.000000 udp 10.0.2.105 7010 -> 72.219.182.153 1598 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:41.422984 0.164647 udp 10.0.2.105 7010 <-> 67.225.81.29 2262 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/15 14:59:41.722181 0.000000 udp 10.0.2.105 7010 -> 183.75.230.129 5686 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:48.973919 0.000000 udp 10.0.2.105 7010 -> 210.195.25.66 6222 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 14:59:53.099297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 14:59:53.940753 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 14:59:54.201068 0.000000 udp 10.0.2.105 7010 -> 72.233.209.145 8448 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:01.992829 0.000000 udp 10.0.2.105 7010 -> 178.59.171.35 3537 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:10.134403 0.000000 udp 10.0.2.105 7010 -> 98.216.62.212 7097 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:15.191506 0.047790 udp 10.0.2.105 7010 -> 62.94.100.195 4634 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:15.239296 0.000000 icmp 62.94.100.195 0x0303 -> 10.0.2.105 0x1a12 URP 192 1 158 flow=Background 1970/01/15 15:00:19.938083 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:00:23.313059 0.000000 udp 10.0.2.105 7010 -> 180.26.72.111 9378 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:31.665148 0.000000 udp 10.0.2.105 7010 -> 76.116.194.132 3881 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:39.837162 0.000000 udp 10.0.2.105 7010 -> 88.254.247.41 7032 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:44.433240 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:00:46.376070 0.000000 udp 10.0.2.105 7010 -> 198.101.101.122 1289 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:52.034737 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:00:59.344771 0.000000 udp 10.0.2.105 7010 -> 217.36.221.248 2005 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:05.824848 0.144073 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:01:06.124491 0.057062 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:01:06.245179 0.075365 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:01:06.342993 0.197024 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:01:06.593320 0.000000 udp 10.0.2.105 7010 -> 198.91.222.134 9354 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:10.440997 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:01:15.337800 0.000000 udp 10.0.2.105 7010 -> 115.117.114.155 6400 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:23.950674 0.000000 udp 10.0.2.105 7010 -> 69.95.137.144 8211 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:30.159591 0.000000 udp 10.0.2.105 7010 -> 81.179.237.114 5205 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:34.935873 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:01:37.209423 0.000000 udp 10.0.2.105 7010 -> 179.98.54.249 8453 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:45.070521 0.000000 udp 10.0.2.105 7010 -> 203.143.170.17 3662 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:52.190649 0.000000 udp 10.0.2.105 7010 -> 202.174.130.138 7838 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:01:59.822229 0.510718 udp 10.0.2.105 7010 <-> 201.1.19.254 9216 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:02:00.353153 0.000000 udp 10.0.2.105 7010 -> 31.42.44.1 8918 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:04.438024 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:02:09.355730 0.000000 udp 10.0.2.105 7010 -> 202.81.242.79 6910 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:16.726383 0.146778 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:02:16.931592 0.000000 udp 10.0.2.105 7010 -> 195.174.239.184 4175 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:21.953730 0.000000 udp 10.0.2.105 7010 -> 69.7.166.242 9563 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:27.892494 0.000000 udp 10.0.2.105 7010 -> 95.225.139.68 5079 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:32.438954 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:02:35.222917 0.000000 udp 10.0.2.105 7010 -> 82.3.246.113 5954 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:02:41.141254 0.000000 udp 10.0.2.105 7010 -> 87.170.157.230 9415 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:05:57.105962 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 15:06:04.112650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:06:12.114632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:06:28.117323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:07:00.123184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:13:04.130447 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:13:11.136704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:13:19.138896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:13:35.141786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:14:07.147270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:20:11.152979 3.022236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:20:18.181043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:20:26.182287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:20:42.185734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:21:14.191475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:27:18.198200 3.071356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:27:25.274899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:27:33.276335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:27:49.279491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:28:05.213032 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:28:05.213126 0.884026 tcp 10.0.2.105 55252 -> 184.182.240.239 7058 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:28:21.285453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:33:10.902043 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:33:10.902146 0.185356 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.087872 0.020441 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.108690 0.175930 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.284961 0.035628 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.320992 0.151153 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.472522 0.146894 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.619785 0.148582 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.768759 0.054409 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.823527 0.121560 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:11.945438 0.278167 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:12.224077 0.143101 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:12.367603 0.136521 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:12.504532 0.292525 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:12.797458 0.152455 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:12.950260 0.144849 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.095566 0.187480 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.283479 0.141024 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.424936 0.207324 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.632636 0.060025 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.692993 0.141994 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:13.835349 0.295168 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:14.130918 0.079554 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:14.210891 0.378657 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:14.589933 0.040259 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:14.630564 0.000000 udp 10.0.2.105 7010 -> 78.134.107.235 6943 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:33:33.566155 0.031180 tcp 10.0.2.105 55253 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:33.597717 0.073319 tcp 10.0.2.105 55254 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:33.671394 0.152393 tcp 10.0.2.105 55255 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:33.825151 0.149601 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:33:33.975130 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:33:50.429623 0.029987 tcp 10.0.2.105 55256 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:50.459868 0.074968 tcp 10.0.2.105 55257 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:50.535143 0.160884 tcp 10.0.2.105 55258 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:33:50.696548 0.000000 udp 10.0.2.105 7010 -> 85.72.53.197 1143 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:34:09.056319 0.030289 tcp 10.0.2.105 55259 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:09.086870 0.075830 tcp 10.0.2.105 55260 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:09.162996 0.152750 tcp 10.0.2.105 55261 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:09.316421 0.000000 udp 10.0.2.105 7010 -> 67.225.81.29 2262 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:34:25.291145 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 15:34:27.091900 0.029753 tcp 10.0.2.105 55262 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:27.121893 0.074089 tcp 10.0.2.105 55263 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:27.196495 0.161058 tcp 10.0.2.105 55264 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:27.357932 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 15:34:32.298860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:34:40.300853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:34:43.175379 0.030159 tcp 10.0.2.105 55265 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:43.205391 0.073825 tcp 10.0.2.105 55266 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:43.279502 0.154721 tcp 10.0.2.105 55267 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/15 15:34:43.434753 0.052863 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:34:43.488023 0.140669 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:34:43.629082 0.180363 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:34:43.809897 0.300377 udp 10.0.2.105 7010 <-> 201.1.19.254 9216 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:34:44.110707 0.141481 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 15:34:56.303583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:35:28.309672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:41:32.316421 3.000438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:41:39.322797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:41:47.324850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:42:03.327663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:42:35.333509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:48:39.339552 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:48:46.347109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:48:54.348213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:49:10.351612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:49:42.357237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:55:46.363145 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 15:55:53.370828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:56:01.372375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:56:17.375662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:56:49.381677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 15:58:06.102428 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 15:58:06.102536 0.867682 tcp 10.0.2.105 55268 -> 184.182.240.239 7058 FSPA* 0 0 14 1512 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:02:53.398114 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:03:00.404802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:03:08.406511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:03:24.409265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:03:56.415061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:05:06.115657 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 16:05:06.115847 0.000000 udp 10.0.2.105 7010 -> 78.134.107.235 6943 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 16:05:23.031798 0.031171 tcp 10.0.2.105 55269 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:23.063226 0.051996 tcp 10.0.2.105 55270 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:23.115492 0.154253 tcp 10.0.2.105 55271 -> 195.113.214.236 443 SRPA* 0 0 20 11312 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:23.270406 0.177595 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:23.448425 0.000000 udp 10.0.2.105 7010 -> 85.72.53.197 1143 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 16:05:42.328763 0.030547 tcp 10.0.2.105 55272 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:42.359228 0.052913 tcp 10.0.2.105 55273 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:42.412602 0.154092 tcp 10.0.2.105 55274 -> 195.113.214.236 443 SRPA* 0 0 37 30056 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:05:42.567304 0.160058 udp 10.0.2.105 7010 <-> 67.225.81.29 2262 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:42.727810 0.083104 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:42.811348 0.031838 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:42.843583 0.177525 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.021528 0.020347 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.042230 0.186345 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.229007 0.138023 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.367431 0.145890 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.513690 0.144374 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.658431 0.121551 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.780557 0.158680 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.939606 0.053614 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:43.993596 0.206892 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:44.200875 0.211380 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:44.412632 0.156894 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:44.569937 0.136705 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:44.707154 0.184807 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:44.892392 0.151655 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.044420 0.148376 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.193159 0.213146 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.406763 0.149887 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.557086 0.063249 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.620733 0.078480 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.699576 0.289281 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:45.989266 0.036331 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:46.025994 0.340085 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:46.366509 0.156973 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:46.523890 0.183202 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:46.707497 0.304876 udp 10.0.2.105 7010 <-> 201.1.19.254 9216 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:47.012772 0.312257 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:47.325345 0.051373 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:05:47.377071 0.136507 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:10:00.421582 3.011814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 16:10:07.438586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:10:15.440035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:10:31.443611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:11:03.449270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:17:07.455250 3.001705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:17:14.462860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:17:22.464127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:17:38.467586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:18:10.473256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:24:14.478885 3.002285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:24:21.487345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:24:29.488434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:24:45.491581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:25:17.497348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:28:06.971486 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 16:28:06.971587 3.793320 tcp 10.0.2.105 55275 -> 184.182.240.239 7058 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:31:21.504120 3.000720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:31:28.510517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:31:36.511976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:31:52.515582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:32:24.521284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:36:04.708143 0.000213 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 16:36:04.708441 0.237874 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:04.946756 0.000000 udp 10.0.2.105 7010 -> 67.225.81.29 2262 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 16:36:20.653304 0.031065 tcp 10.0.2.105 55276 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:20.684631 0.068195 tcp 10.0.2.105 55277 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:20.753217 0.156001 tcp 10.0.2.105 55278 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:20.909890 0.083990 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:20.994257 0.031124 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:21.025727 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 16:36:37.095110 0.030663 tcp 10.0.2.105 55279 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:37.125631 0.066175 tcp 10.0.2.105 55280 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:37.191647 0.153272 tcp 10.0.2.105 55281 -> 195.113.214.236 443 SRPA* 0 0 35 18784 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:37.345131 0.020256 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:37.365674 0.181997 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:37.548081 0.198771 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:37.747293 0.120005 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:37.867698 0.145610 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.013710 0.055730 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.069828 0.259008 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.329258 0.143724 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.473402 0.146076 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.619840 0.210837 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.831016 0.155993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:38.987427 0.132541 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.120373 0.185438 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.306215 0.151669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.458281 0.143010 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.601722 0.209121 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.811240 0.146123 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:39.957799 0.063301 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:40.021533 0.079636 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:40.101566 0.300687 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:40.402596 0.038566 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:40.441569 0.325657 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:40.767649 0.000000 udp 10.0.2.105 7010 -> 201.1.19.254 9216 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 16:36:58.205771 0.030336 tcp 10.0.2.105 55282 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:58.236463 0.061379 tcp 10.0.2.105 55283 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:58.298122 0.153391 tcp 10.0.2.105 55284 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:36:58.452142 0.136907 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:58.589438 0.149832 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:58.739670 0.177787 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:58.917850 0.054493 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:36:58.972768 0.141602 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 16:38:28.527654 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 16:38:35.534643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:38:43.536370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:38:59.539170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:39:31.545147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:45:35.550927 3.002011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:45:42.558332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:45:50.560176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:46:06.563121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:46:38.569273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:52:42.575738 3.001112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:52:49.582631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:52:57.584243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:53:13.587400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:53:45.592990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 16:58:10.764920 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 16:58:10.765117 1.058330 tcp 10.0.2.105 55285 -> 184.182.240.239 7058 FSPA* 0 0 15 1607 flow=From-Botnet-V2-TCP-Established 1970/01/15 16:59:49.739763 3.001278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 16:59:56.746995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:00:04.748428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:00:20.751734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:00:52.757808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:06:56.764089 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:07:03.771850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:07:10.160580 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 17:07:10.160683 0.180283 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:10.341382 0.160071 udp 10.0.2.105 7010 <-> 67.225.81.29 2262 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:10.501890 0.000000 udp 10.0.2.105 7010 -> 201.1.19.254 9216 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 17:07:11.771918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:07:25.925187 0.031008 tcp 10.0.2.105 55286 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:07:25.956552 0.062253 tcp 10.0.2.105 55287 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:07:26.019167 0.153528 tcp 10.0.2.105 55288 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:07:26.173588 0.187094 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.361144 0.031703 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.393336 0.072215 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.465940 0.020365 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.486751 0.143710 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.630896 0.178712 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.809994 0.054020 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:26.864439 0.289857 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.154671 0.145548 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.300630 0.120355 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.421350 0.235162 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.656933 0.156299 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.775575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:07:27.813671 0.131273 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:27.945351 0.198171 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.143920 0.144751 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.289095 0.165761 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.455195 0.209639 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.665225 0.148046 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.813711 0.057886 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.871963 0.078160 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:28.950546 0.137823 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:29.088806 0.141774 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:29.230984 0.347115 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:29.578508 0.052364 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:29.631225 0.285123 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:29.916752 0.175546 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:30.092711 0.055362 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:30.148559 0.136775 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:30.285739 0.170181 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:30.456260 0.150886 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:07:59.780971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:14:03.787297 3.001811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:14:10.794605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:14:18.795963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:14:34.799013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:15:06.805615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:21:10.811629 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:21:17.818514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:21:25.820192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:21:41.822861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:22:13.829555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:28:11.824372 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 17:28:11.824476 0.869339 tcp 10.0.2.105 55289 -> 184.182.240.239 7058 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:28:17.835924 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:28:24.842490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:28:32.843970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:28:48.847210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:29:20.852918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:35:24.859312 3.001629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:35:31.866939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:35:39.868570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:35:55.871123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:36:27.877228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:37:45.459232 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 17:37:45.459324 0.179138 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:37:45.638862 0.160443 udp 10.0.2.105 7010 <-> 67.225.81.29 2262 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:37:45.799701 0.209332 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:37:46.009502 0.031677 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:37:46.041589 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 17:38:01.463572 0.031601 tcp 10.0.2.105 55290 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:38:01.495528 0.066379 tcp 10.0.2.105 55291 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:38:01.562217 0.159012 tcp 10.0.2.105 55292 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/15 17:38:01.721454 0.020095 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:01.741908 0.142440 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:01.884730 0.188150 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.073217 0.055942 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.129545 0.120437 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.250409 0.212292 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.463040 0.341164 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.804602 0.136329 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:02.941344 0.262051 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:03.203754 0.161485 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:03.365658 0.249700 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:03.615712 0.146429 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:03.762561 0.147705 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:03.910673 0.210240 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.121375 0.152865 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.274634 0.062301 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.337302 0.078516 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.416240 0.138015 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.554590 0.144856 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:04.699850 0.323930 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.024174 0.040344 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.064831 0.288769 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.353976 0.177405 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.531848 0.142462 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.674662 0.153678 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.828679 0.054815 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:38:05.883866 0.146004 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/15 17:42:31.884013 3.011138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:42:38.900583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:42:46.902325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:43:02.905303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:43:34.910813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:49:38.917702 3.001363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:49:45.924416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:49:53.925727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:50:09.929042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:50:41.935186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:56:45.941454 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 17:56:52.948848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:57:00.949829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:57:16.953016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:57:48.959170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 17:58:12.693403 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 17:58:12.693651 1.087720 tcp 10.0.2.105 55293 -> 184.182.240.239 7058 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:03:52.965171 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:03:59.972145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:04:07.973924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:04:23.977249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:04:55.982983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:08:07.918905 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 18:08:07.919041 0.070958 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:07.990413 0.032590 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:08.023431 0.000000 udp 10.0.2.105 7010 -> 67.225.81.29 2262 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 18:08:23.333133 0.030556 tcp 10.0.2.105 55294 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:23.363990 0.065191 tcp 10.0.2.105 55295 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:23.429495 0.193283 tcp 10.0.2.105 55296 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:23.623508 0.149449 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:23.773297 0.230575 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.004378 0.020041 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.024798 0.139709 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.164939 0.187924 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.353284 0.222926 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.576622 0.157941 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.734964 0.132535 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.867914 0.054604 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:24.922937 0.120637 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.043972 0.197788 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.242189 0.152628 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.395220 0.183087 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.578673 0.143459 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.722552 0.147141 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:25.870152 0.207651 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:26.078239 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 18:08:44.582328 0.030511 tcp 10.0.2.105 55297 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:44.613182 0.067651 tcp 10.0.2.105 55298 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:44.681247 0.205547 tcp 10.0.2.105 55299 -> 195.113.214.236 443 SRPA* 0 0 35 18856 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:08:44.887092 0.472701 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:45.360242 0.088111 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:45.448826 0.151736 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:45.601059 0.143591 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:45.745056 0.387847 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.133320 0.039324 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.173084 0.144272 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.317751 0.150687 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.468860 0.055719 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.524989 0.142985 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.668391 0.287653 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:08:46.956491 0.167767 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:10:59.989179 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/15 18:11:06.996516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:11:14.998227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:11:31.001078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:12:03.006981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:18:07.013554 3.030978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:18:14.050258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:18:22.051781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:18:38.055009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:19:10.061337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:25:14.067399 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:25:21.074169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:25:29.075622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:25:45.209524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:26:17.214958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:28:13.833266 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 18:28:13.833372 1.010870 tcp 10.0.2.105 55300 -> 184.182.240.239 7058 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:32:21.220837 3.001718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:32:28.228665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:32:36.229738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:32:52.233307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:33:24.239353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:39:06.010570 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 18:39:06.010664 0.000000 udp 10.0.2.105 7010 -> 67.225.81.29 2262 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 18:39:22.256074 0.030506 tcp 10.0.2.105 55301 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:39:22.286866 0.067476 tcp 10.0.2.105 55302 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:39:22.354655 0.157290 tcp 10.0.2.105 55303 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/15 18:39:22.512666 0.146235 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:22.659259 0.072457 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:22.732111 0.035621 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:22.768076 0.142945 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:22.911404 0.175913 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.087794 0.020021 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.108143 0.209082 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.317648 0.163032 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.481083 0.191298 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.672803 0.141487 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.814698 0.055386 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.870504 0.120468 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:23.991385 0.132770 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.124649 0.182716 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.307735 0.145301 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.453404 0.144768 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.598572 0.210033 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.808965 0.150598 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:24.959998 0.297139 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:25.257552 0.144968 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:25.402940 0.142420 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:25.545700 0.555024 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.101119 0.079701 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.181232 0.336763 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.518388 0.038291 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.557088 0.141923 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.699369 0.151691 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.851483 0.053956 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:26.905856 0.321459 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:27.227671 0.289798 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:27.517956 0.172880 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/15 18:39:28.245026 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:39:35.252334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:39:43.254361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:39:59.257407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:40:31.263447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:46:35.269640 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:46:42.276308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:46:50.278303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:47:06.280984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:47:38.286786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:53:42.293923 3.071199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 18:53:49.370942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:53:57.372139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:54:13.374906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:54:45.381346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 18:58:14.872687 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 18:58:14.872854 0.840592 tcp 10.0.2.105 55304 -> 184.182.240.239 7058 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:00:49.386517 3.002257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:00:56.394851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:01:04.396186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:01:20.398732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:01:52.405282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:07:56.410516 3.002170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:08:03.418226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:08:11.419728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:08:27.422921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:08:59.428950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:09:34.630067 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 19:09:34.630152 0.032038 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:34.662598 0.346520 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:35.009551 0.361557 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:35.371529 0.019870 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:35.391770 0.146244 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:35.538418 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 19:09:53.928973 0.030566 tcp 10.0.2.105 55305 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:09:53.959842 0.074587 tcp 10.0.2.105 55306 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:09:54.034715 0.157954 tcp 10.0.2.105 55307 -> 195.113.214.236 443 SRPA* 0 0 35 18002 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:09:54.193014 0.227417 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:54.420821 0.152797 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:54.574056 0.200095 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:54.774636 0.142075 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:54.917127 0.054868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:54.972423 0.120845 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.093680 0.137937 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.232016 0.189510 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.421962 0.144648 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.566981 0.141382 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.708798 0.210025 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:55.919239 0.157562 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.077135 0.142353 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.219896 0.130268 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.350569 0.187056 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.537948 0.151569 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.689925 0.083951 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:56.774264 0.324020 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.098712 0.038914 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.138012 0.137838 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.276257 0.149545 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.426215 0.054708 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.481323 0.178259 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.660016 0.140651 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:09:57.801067 0.298671 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:15:03.434570 3.002194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:15:10.442582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:15:18.444198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:15:34.446878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:16:06.453159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:22:10.459180 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:22:17.466346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:22:25.467936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:22:41.471035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:23:13.476787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:28:15.712179 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 19:28:15.712433 0.931587 tcp 10.0.2.105 55308 -> 184.182.240.239 7058 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:29:17.513469 3.001127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:29:24.520565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:29:32.522162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:29:48.525085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:30:20.531374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:36:24.536687 3.002252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:36:31.544220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:36:39.545968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:36:55.548628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:37:27.555284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:40:05.462794 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 19:40:05.463004 0.070001 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:05.533460 0.031948 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:05.565831 0.146830 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:05.713060 0.020406 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:05.733849 0.259971 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:05.994214 0.370208 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:06.364802 0.203556 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:06.568803 0.156955 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:06.726155 0.191699 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:06.918242 0.142470 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.131331 0.055174 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.186840 0.120832 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.308074 0.135608 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.444131 0.181321 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.625851 0.145168 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.771359 0.142773 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:07.914477 0.204052 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.118890 0.154398 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.273820 0.143911 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.418134 0.065832 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.484379 0.199018 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.683844 0.144960 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.829170 0.077512 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:08.907085 0.322407 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.229912 0.037022 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.267337 0.057378 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.325129 0.172783 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.498321 0.155403 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.654224 0.301180 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:09.955823 0.138893 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:40:10.095116 0.149099 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/15 19:43:31.560719 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:43:38.568158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:43:46.569579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:44:02.573052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:44:34.579042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:50:38.585161 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:50:45.592428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:50:53.594106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:51:09.596795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:51:41.603037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:57:45.609650 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 19:57:52.616278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:58:00.617605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:58:16.620591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 19:58:16.651341 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 19:58:16.651635 0.864741 tcp 10.0.2.105 55309 -> 184.182.240.239 7058 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/01/15 19:58:48.627255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:04:52.633664 3.000665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:04:59.639982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:05:07.641431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:05:23.644930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:05:55.650909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:10:21.603834 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 20:10:21.603944 0.143010 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:21.747361 0.019957 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:21.767595 0.213681 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:21.981687 0.083979 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.066040 0.031658 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.098092 0.147112 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.245628 0.202323 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.448302 0.159008 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.607715 0.185738 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.793813 0.139029 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.933251 0.055102 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:22.988711 0.121352 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.110468 0.134284 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.245159 0.188059 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.433636 0.150781 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.584832 0.144661 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.729842 0.207571 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:23.937791 0.343454 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.281655 0.185671 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.467813 0.151696 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.619970 0.082501 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.702874 0.144896 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.848183 0.143885 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:24.992457 0.323369 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:25.316215 0.039684 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:25.356237 0.060015 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:25.416631 0.178612 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:25.595731 0.142234 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:25.738410 0.298722 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:26.037474 0.136524 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:10:26.174384 0.149146 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:11:59.657161 3.001165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:12:06.663998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:12:14.666032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:12:30.668686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:13:02.674733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:19:06.680739 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:19:13.688508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:19:21.689633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:19:37.692920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:20:09.698590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:26:13.704719 3.101882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:26:20.812064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:26:28.813713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:26:44.816933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:27:16.822530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:28:17.560659 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 20:28:17.560759 0.866160 tcp 10.0.2.105 55310 -> 184.182.240.239 7058 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/15 20:33:20.829557 3.000616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:33:27.835966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:33:35.838160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:33:51.840708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:34:23.847130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:40:27.810293 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 20:40:27.810539 0.175552 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:27.853058 3.001367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:40:27.986505 0.072029 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:28.058957 0.034698 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:28.093992 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 20:40:34.859997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:40:42.861408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:40:44.055394 0.052102 tcp 10.0.2.105 55311 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 20:40:44.107836 0.075222 tcp 10.0.2.105 55312 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 20:40:44.183415 0.208045 tcp 10.0.2.105 55313 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/15 20:40:44.392070 0.020391 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:44.412837 0.144140 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:44.557333 0.211362 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:44.769046 0.160513 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:44.929919 0.178465 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.108780 0.143164 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.252378 0.055340 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.308142 0.140027 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.448667 0.128810 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.577886 0.185683 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.763998 0.148156 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:45.912561 0.142153 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.055090 0.209389 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.264880 0.144579 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.409811 0.084206 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.494419 0.160556 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.655356 0.140577 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:46.796347 0.412249 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:47.208997 0.212320 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:47.421671 0.330096 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:47.752142 0.039443 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:47.792008 0.052221 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:47.844619 0.180377 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:48.025396 0.142061 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:48.167880 0.287755 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:48.456089 0.144668 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:48.601145 0.146772 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/15 20:40:58.865234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:41:30.871083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:47:34.877099 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:47:41.884069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:47:49.885632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:48:05.888600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:48:37.894972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:54:41.900760 3.002172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 20:54:48.908594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:54:56.910061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:55:12.912858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:55:44.918697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 20:58:18.430012 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 20:58:18.430107 0.863460 tcp 10.0.2.105 55314 -> 184.182.240.239 7058 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:01:48.924775 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:01:55.931883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:02:03.933288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:02:19.936547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:02:51.943028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:08:55.948133 3.002224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:09:02.955927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:09:10.957474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:09:26.960606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:09:58.966877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:11:19.252129 0.000235 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 21:11:19.252447 0.146668 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:19.399489 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 21:11:36.758798 0.053003 tcp 10.0.2.105 55315 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:11:36.812071 0.072849 tcp 10.0.2.105 55316 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:11:36.884762 0.157230 tcp 10.0.2.105 55317 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:11:37.042619 0.286184 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.329193 0.031773 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.361294 0.020034 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.381705 0.144293 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.526356 0.212404 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.739123 0.156063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:37.895596 0.186177 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.082144 0.141138 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.223684 0.058970 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.282981 0.120254 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.403609 0.130740 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.534762 0.168219 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.703416 0.148583 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.852429 0.146931 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:38.999783 0.082294 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:39.082489 0.151570 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:39.234422 0.145353 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:39.380178 0.569095 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:39.949651 0.210285 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.160361 0.137672 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.298376 0.183637 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.482474 0.323339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.806224 0.039876 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.846525 0.059543 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:40.906474 0.175163 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:41.081990 0.137983 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:41.220392 0.149848 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:41.370652 0.283325 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:11:41.654383 0.268880 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:16:02.973542 3.000506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:16:09.980192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:16:17.981957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:16:33.984306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:17:05.990283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:23:09.997245 3.000861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:23:17.003883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:23:25.005776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:23:41.008723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:24:13.014738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:28:19.299454 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 21:28:19.299622 0.917600 tcp 10.0.2.105 55318 -> 184.182.240.239 7058 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:30:17.021226 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:30:24.028381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:30:32.029694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:30:48.032498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:31:20.038199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:37:24.044471 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:37:31.052030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:37:39.053242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:37:55.056137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:38:27.062269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:41:42.584190 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 21:41:42.584327 0.114030 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:42.698719 0.595291 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:43.294433 0.284943 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:43.579750 0.036592 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:43.616731 0.020356 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:43.637465 0.144948 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:43.782779 0.218346 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:41:44.001479 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 21:42:02.554253 0.053358 tcp 10.0.2.105 55319 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:42:02.607949 0.074937 tcp 10.0.2.105 55320 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:42:02.683124 0.151433 tcp 10.0.2.105 55321 -> 195.113.214.236 443 SRPA* 0 0 53 50039 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:42:02.835158 0.177191 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.012728 0.142530 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.155665 0.057192 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.213258 0.121537 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.335162 0.132028 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.467595 0.225158 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.693169 0.148028 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.841605 0.146862 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:03.988867 0.086255 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.075464 0.151751 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.227615 0.206297 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.434331 0.144124 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.578817 0.179525 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.758696 0.145276 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:04.904413 0.275549 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.180363 0.330062 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.510776 0.042924 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.554097 0.058683 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.613208 0.179474 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.793084 0.143084 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:05.936499 0.143898 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:06.080833 0.152680 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:42:06.233856 0.288572 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/15 21:44:31.068860 3.001271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:44:38.075582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:44:46.077612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:45:02.080507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:45:34.086725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:51:38.092853 3.051009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:51:45.150311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:51:53.151538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:52:09.154160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:52:41.160292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:58:20.228715 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 21:58:20.228826 0.784641 tcp 10.0.2.105 55322 -> 184.182.240.239 7058 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/15 21:58:45.167083 3.001114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 21:58:52.174045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:59:00.175649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:59:16.178266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 21:59:48.184450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:05:52.191176 3.000709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:05:59.197886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:06:07.199108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:06:23.202271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:06:55.208356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:12:22.379398 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 22:12:22.379506 0.156827 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:22.536776 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/15 22:12:38.023457 0.053009 tcp 10.0.2.105 55323 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/15 22:12:38.076809 0.073662 tcp 10.0.2.105 55324 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/15 22:12:38.150745 0.177681 tcp 10.0.2.105 55325 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/15 22:12:38.328259 0.035411 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:38.364087 0.020218 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:38.384679 0.145411 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:38.530499 0.295711 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:38.826600 0.253318 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:39.080344 3.564856 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:42.645624 0.057094 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:42.703117 0.180393 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:42.883996 0.141209 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.025616 0.121421 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.147453 0.137336 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.285210 0.173796 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.459422 0.146297 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.606115 0.142087 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.748603 0.083635 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.832710 0.145778 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:43.978917 0.064388 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:44.043716 0.145040 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:44.189166 0.167824 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:44.357358 0.210419 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:44.568192 0.141146 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:44.709766 0.347332 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.057437 0.037559 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.095336 0.053890 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.149602 0.172693 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.322697 0.141176 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.464280 0.144721 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.609386 0.153582 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:45.763362 0.295689 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:12:59.215189 3.000682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:13:06.222108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:13:14.223324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:13:30.226132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:14:02.232550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:20:06.238180 3.001646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:20:13.245725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:20:21.247396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:20:37.250473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:21:09.256145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:27:13.262288 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:27:20.270005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:27:28.271585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:27:44.274095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:28:16.280102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:28:21.017437 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 22:28:21.017538 0.849088 tcp 10.0.2.105 55326 -> 184.182.240.239 7058 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/01/15 22:34:20.286926 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:34:27.294027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:34:35.295347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:34:51.297933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:35:23.303985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:41:27.310729 3.041154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:41:34.357706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:41:42.359634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:41:58.362139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:42:30.368331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:43:08.833774 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 22:43:08.833889 0.071340 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:08.905605 0.157467 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.063523 0.051781 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.115720 0.020067 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.136177 0.148394 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.284983 0.231016 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.516431 0.286764 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.803626 0.181662 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:09.985712 0.141810 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.127953 0.120119 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.248512 0.141833 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.390703 0.057901 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.449018 0.133232 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.582676 0.166994 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.750068 0.147545 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:10.898003 0.140765 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.039197 0.081262 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.120830 0.144520 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.265806 0.058822 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.325025 0.145308 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.470705 0.177539 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.648615 0.210924 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:11.859875 0.145687 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.005989 0.404454 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.410841 0.041122 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.452319 0.057208 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.509949 0.184130 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.694476 0.150194 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:12.845088 0.299406 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:13.144891 0.181243 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:43:13.326515 0.143664 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/15 22:48:34.375256 3.010403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:48:41.391963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:48:49.393483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:49:05.396118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:49:37.402682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:55:41.408739 3.031299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 22:55:48.445664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:55:56.447135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:56:12.450256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:56:44.456378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 22:58:21.876697 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 22:58:21.876878 0.920045 tcp 10.0.2.105 55327 -> 184.182.240.239 7058 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/01/15 23:02:48.463006 3.001083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:02:55.469946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:03:03.471411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:03:19.474160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:03:51.480099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:09:55.486667 3.011212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:10:02.503838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:10:10.505385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:10:26.507882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:10:58.514065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:13:31.584343 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 23:13:31.584493 0.037340 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:31.622247 0.020216 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:31.642870 0.085170 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:31.728465 0.164145 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:31.892970 0.146629 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.039988 0.297454 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.337816 0.200051 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.538260 0.186904 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.725632 0.143174 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.869127 0.120362 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:32.989882 0.192610 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.182899 0.057426 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.240765 0.135839 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.376979 0.163621 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.541001 0.146782 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.688148 0.145542 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.834061 0.081106 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:33.915499 0.155436 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.071332 0.235899 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.307641 0.209677 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.517716 0.144744 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.662889 0.085562 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.748821 0.138007 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:34.887252 0.391479 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:35.279133 0.038981 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:35.318474 0.054507 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:35.373403 0.220613 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:35.594415 0.151200 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:35.745969 0.291792 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:36.038146 0.176288 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:13:36.214814 0.140982 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:17:02.520446 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:17:09.527902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:17:17.529046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:17:33.531855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:18:05.538306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:24:09.544075 3.002084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:24:16.551597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:24:24.552898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:24:40.556101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:25:12.562316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:28:22.796047 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 23:28:22.796146 0.944201 tcp 10.0.2.105 55328 -> 184.182.240.239 7058 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/01/15 23:31:16.568628 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:31:23.575911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:31:31.577013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:31:47.579867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:32:19.585977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:38:23.592356 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:38:30.599244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:38:38.601316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:38:54.603817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:39:26.610210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:43:45.132533 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 23:43:45.132637 0.071859 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:45.204871 0.154213 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:45.359416 0.143371 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:45.503193 0.035869 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:45.539434 0.020171 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:45.559924 0.453584 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:46.013950 0.243214 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:46.257551 0.185193 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:46.443180 0.142105 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:46.585685 0.121530 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:46.707645 0.301042 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.009106 0.060486 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.069977 0.133746 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.204193 0.169864 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.374468 0.148834 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.523696 0.141202 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.665308 0.087494 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.753208 0.139526 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:47.893149 0.144973 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:48.038523 1.435570 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:49.474439 0.137989 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:49.612834 0.326962 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:49.940177 0.258897 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.199419 0.253365 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.453206 0.040053 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.493591 0.054109 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.548130 0.157111 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.705636 0.148529 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:50.854504 0.291002 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:51.145888 0.180779 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:43:51.327045 0.165774 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/15 23:45:30.616945 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:45:37.673437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:45:45.674780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:46:01.677798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:46:33.684065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:52:37.690739 3.001226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:52:44.697887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:52:52.699218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:53:08.701799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:53:40.707800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:58:23.765450 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/15 23:58:23.765545 0.859290 tcp 10.0.2.105 55329 -> 184.182.240.239 7058 FSPA* 0 0 12 1476 flow=From-Botnet-V2-TCP-Established 1970/01/15 23:59:44.713519 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/15 23:59:51.721209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/15 23:59:59.723183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:00:15.726119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:00:47.732234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:06:51.872214 2.997969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:06:58.875898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:07:06.877372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:07:22.880199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:07:54.885905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:13:55.775547 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 00:13:55.775733 0.083358 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:55.859528 0.156956 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.016835 0.145631 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.162810 0.032537 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.195781 0.020094 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.216180 0.269163 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.485718 0.218794 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.704858 0.122419 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.827682 0.147769 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:56.975886 0.055877 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.032174 0.132880 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.165405 0.176801 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.342624 0.142164 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.485219 0.162056 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.647621 0.148200 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.796383 0.141801 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:57.938664 0.087516 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.026543 0.143540 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.170413 0.144096 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.314855 0.329783 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.645058 0.180040 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.825480 0.242529 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:58.983989 2.999869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:13:59.068535 0.151740 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.220666 0.205087 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.426158 0.053498 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.480078 0.051116 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.531583 0.155891 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.687853 0.149972 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:13:59.838233 0.295477 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:14:00.134122 0.177964 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:14:00.312450 0.139872 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:14:05.990021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:14:13.991203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:14:29.994262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:15:02.000348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:21:06.006596 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:21:13.013778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:21:21.015519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:21:37.018419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:22:09.024475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:28:13.031125 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:28:20.038547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:28:24.724972 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 00:28:24.725082 0.872375 tcp 10.0.2.105 55330 -> 184.182.240.239 7058 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/01/16 00:28:28.040336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:28:44.042730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:29:16.048077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:35:20.053912 3.001870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:35:27.061911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:35:35.063096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:35:51.066296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:36:23.072241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:42:27.079003 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:42:34.085562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:42:42.086807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:42:58.090218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:43:30.096257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:44:04.515875 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 00:44:04.516037 0.165235 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:04.681634 0.031496 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:04.713522 0.020123 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:04.733916 0.072612 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:04.806841 0.153945 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:04.961189 0.288675 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:05.250314 0.182885 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:05.433644 0.123696 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:05.557764 0.148200 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:05.706367 0.055861 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:05.769030 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 00:44:21.602296 0.052850 tcp 10.0.2.105 55331 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/16 00:44:21.655417 0.075395 tcp 10.0.2.105 55332 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/16 00:44:21.731127 0.160434 tcp 10.0.2.105 55333 -> 195.113.214.236 443 SRPA* 0 0 65 40689 flow=From-Botnet-V2-TCP-Established 1970/01/16 00:44:21.892063 0.178176 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.070685 0.139442 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.210476 0.167915 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.378763 0.150203 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.529354 0.144139 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.673969 0.088049 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.762440 0.150472 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:22.913273 0.143224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.057371 0.060130 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.117867 0.151682 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.269948 0.329586 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.599963 0.160898 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.761226 0.208701 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:23.970339 0.040746 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.011660 0.105296 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.117358 0.141312 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.259074 0.154731 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.414207 0.299184 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.713844 0.176666 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:44:24.890911 0.142176 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/16 00:49:34.101875 3.001893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:49:41.109813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:49:49.111298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:50:05.114305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:50:37.120417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:56:41.357396 3.000953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 00:56:48.493962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:56:56.495325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:57:12.499114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:57:44.504827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 00:58:25.894663 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 00:58:25.894774 0.811700 tcp 10.0.2.105 55334 -> 184.182.240.239 7058 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/01/16 01:03:48.511033 3.001182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:03:55.518377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:04:03.519550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:04:19.522310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:04:51.528955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:10:55.535030 3.001129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:11:02.542056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:11:10.543688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:11:26.546234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:11:58.552761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:14:31.352460 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 01:14:31.352564 0.132085 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:31.485026 0.019976 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:31.505353 0.071742 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:31.577511 0.154506 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:31.732523 0.208914 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:31.941851 0.219438 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.161630 0.031916 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.193934 0.143212 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.337523 0.057552 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.395519 0.121340 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.517202 0.232968 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.750506 0.167178 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:32.918076 0.184595 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.103068 0.142379 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.245844 0.146852 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.393108 0.145596 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.539172 0.088069 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.627698 0.146798 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.774914 0.139266 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.914605 0.059800 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:33.974792 0.144919 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:34.120067 0.352490 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:34.473035 0.170985 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:34.644457 0.209636 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:34.854503 0.039894 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:34.894790 0.132524 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:35.027816 0.762206 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:35.790442 0.175134 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:35.966007 0.143135 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:36.109490 0.150585 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:14:36.260411 0.294757 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:18:02.558954 3.001434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:18:09.565747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:18:17.567167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:18:33.570424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:19:05.576246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:25:09.583563 3.000381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:25:16.590347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:25:24.591344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:25:40.594152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:26:12.600807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:28:26.714060 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 01:28:26.714160 0.850606 tcp 10.0.2.105 55335 -> 184.182.240.239 7058 FSPA* 0 0 12 1417 flow=From-Botnet-V2-TCP-Established 1970/01/16 01:32:16.607176 3.000724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:32:23.613586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:32:31.615099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:32:47.618098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:33:19.624534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:39:23.630918 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:39:30.637952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:39:38.639788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:39:54.642344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:40:26.648247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:44:45.630984 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 01:44:45.631226 0.070011 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:44:45.701644 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 01:45:04.039150 0.053064 tcp 10.0.2.105 55336 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 01:45:04.092517 0.075921 tcp 10.0.2.105 55337 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 01:45:04.168796 0.186718 tcp 10.0.2.105 55338 -> 195.113.214.236 443 SRPA* 0 0 77 57777 flow=From-Botnet-V2-TCP-Established 1970/01/16 01:45:04.355701 0.247313 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:04.603414 0.410417 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.014298 0.032571 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.047257 0.129938 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.177603 0.020116 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.198046 0.147159 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.345574 0.057349 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.403330 0.122381 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.526153 0.197491 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.724042 0.220923 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:05.945376 0.185880 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.131671 0.143312 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.275362 0.149193 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.424963 0.140767 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.566100 0.089772 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.656298 0.139266 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.795977 0.144518 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:06.940889 0.064252 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.005564 0.152285 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.158179 0.210299 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.368902 0.046333 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.415636 0.107435 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.523519 0.333837 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:07.857795 0.228052 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:08.086328 0.834872 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:08.921548 0.176867 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:09.098866 0.245522 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:09.344743 0.150439 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:45:09.495607 0.297655 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 01:46:30.654714 3.001278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:46:37.662085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:46:45.663404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:47:01.666498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:47:33.672189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:53:37.679033 3.001106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 01:53:44.685812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:53:52.687378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:54:08.690090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:54:40.696161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 01:58:27.573057 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 01:58:27.573162 0.940324 tcp 10.0.2.105 55339 -> 184.182.240.239 7058 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:00:44.702043 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:00:51.709997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:00:59.710964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:01:15.714236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:01:47.720354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:07:51.726388 3.001596 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:07:58.733536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:08:06.735572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:08:22.738150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:08:54.744073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:14:58.750824 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:15:05.757967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:15:13.758945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:15:29.761940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:15:34.289489 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 02:15:34.289602 0.158761 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:34.448791 0.072354 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:34.521573 0.032951 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:34.554944 0.131139 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:34.686480 0.019991 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:34.706830 0.343667 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.050932 0.284738 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.336053 0.145891 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.482369 0.055406 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.538172 0.121668 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.660227 0.180685 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:35.841282 0.169309 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.010985 0.177916 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.189291 0.151104 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.340761 0.146856 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.487991 0.146121 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.634473 0.084953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.719867 0.158549 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:36.878797 0.145926 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:37.025115 0.438388 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:37.463950 0.144984 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:37.609339 0.058631 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:37.668343 0.390925 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.059601 0.168366 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.228310 0.210017 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.438746 0.038783 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.477861 0.140867 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.619120 0.169358 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:38.788850 0.289451 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:39.078709 0.142925 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:15:39.222037 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 02:15:54.359829 0.053267 tcp 10.0.2.105 55340 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:15:54.413417 0.071674 tcp 10.0.2.105 55341 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:15:54.485449 0.235871 tcp 10.0.2.105 55342 -> 195.113.214.236 443 SRPA* 0 0 35 28438 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:16:01.768353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:22:05.774773 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:22:12.781505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:22:20.782883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:22:36.786291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:23:08.791978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:28:28.522443 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 02:28:28.522561 0.871794 tcp 10.0.2.105 55343 -> 184.182.240.239 7058 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:29:12.797815 3.002032 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:29:19.805494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:29:27.807285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:29:43.810573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:30:15.816108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:36:19.821820 3.002272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:36:26.829904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:36:34.831603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:36:50.833959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:37:22.839836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:43:26.845919 3.011775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:43:33.863510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:43:41.865139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:43:57.868052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:44:29.873812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:46:08.326397 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 02:46:08.326498 0.150022 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:08.476919 0.054267 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:08.531571 0.138261 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:08.670187 0.020016 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:08.690539 0.204167 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:08.895116 0.152533 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.048081 0.070546 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.119076 0.145437 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.264936 0.055500 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.320797 0.120625 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.441836 0.511086 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:09.953272 0.165845 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.209874 0.177731 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.388053 0.147529 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.535997 0.146725 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.683134 0.142646 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.826185 0.081798 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:10.908391 0.146113 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:11.054876 0.143812 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:11.199144 0.146283 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:11.345834 0.109020 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:11.455305 0.368711 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:11.824573 0.187121 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.012095 0.063305 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.075807 0.144962 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.221180 0.139858 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.361380 0.179759 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.541549 0.304127 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.846072 0.143280 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:12.989698 0.049162 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:46:13.039299 0.209751 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/16 02:50:33.881027 3.000863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:50:40.887828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:50:48.889429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:51:04.892056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:51:36.898247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:57:40.905052 3.000694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 02:57:47.911697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:57:55.912864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:58:11.916288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 02:58:29.401426 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 02:58:29.401516 0.809566 tcp 10.0.2.105 55344 -> 184.182.240.239 7058 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/16 02:58:43.921984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:04:47.928395 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:04:54.935618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:05:02.936659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:05:18.939800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:05:50.946374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:11:54.952632 3.001285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:12:01.959424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:12:09.961166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:12:25.963805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:12:57.969835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:16:30.135375 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 03:16:30.135623 0.154177 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.290164 0.035867 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.326520 0.131703 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.327003 3.003014 tcp 10.0.2.105 55345 -> 78.134.76.143 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:16:30.458648 0.020327 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.479291 0.347847 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.827471 0.157297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:30.985182 0.127440 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:16:31.113058 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:16:39.328515 0.000000 tcp 10.0.2.105 55345 -> 78.134.76.143 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:16:45.312297 0.000000 udp 10.0.2.105 7010 <- 70.61.48.21 7859 RSP 0 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:16:45.312724 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:17:00.811407 0.094118 tcp 10.0.2.105 55346 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:17:00.905760 0.074593 tcp 10.0.2.105 55347 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:17:00.980631 0.171685 tcp 10.0.2.105 55348 -> 195.113.214.236 443 SRPA* 0 0 60 39877 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:17:01.151785 0.166292 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.318407 0.057285 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.376214 0.121004 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.376620 3.007298 tcp 10.0.2.105 55349 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:17:01.497606 0.195582 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.693583 0.144619 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.838559 0.148401 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:01.987378 0.143617 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:02.131426 0.089559 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:02.221412 0.148585 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:02.370343 0.144029 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:02.514820 0.328189 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:02.843465 0.203417 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.047310 0.059051 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.106798 0.144934 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.252085 0.144546 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.397025 0.049382 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.446816 0.323457 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.770664 0.172232 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:03.943362 0.297604 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:04.241367 0.139782 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:04.381539 0.039083 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:04.421013 0.211370 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:17:10.382679 0.000000 tcp 10.0.2.105 55349 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:19:01.986551 3.001388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 03:19:08.993524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:19:16.994754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:19:32.998171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:20:05.003907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:26:09.009534 3.002053 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:26:16.017638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:26:24.018588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:26:40.021866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:27:12.027865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:28:30.220861 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 03:28:30.220971 0.825121 tcp 10.0.2.105 55350 -> 184.182.240.239 7058 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:33:16.034571 3.000974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:33:23.041111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:33:31.042761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:33:47.046102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:34:19.052194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:40:23.057397 3.002132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:40:30.065677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:40:38.066947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:40:54.070064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:41:26.075692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:47:06.665765 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 03:47:06.666036 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:47:22.810379 0.054654 tcp 10.0.2.105 55351 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:22.865381 0.075078 tcp 10.0.2.105 55352 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:22.940815 0.191312 tcp 10.0.2.105 55353 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:23.132773 0.150507 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:23.283731 0.020338 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:23.284060 3.000010 tcp 10.0.2.105 55354 -> 96.237.22.160 1238 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:47:23.304387 0.031502 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:23.336214 0.160847 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:23.497423 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:47:30.082384 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 03:47:32.282601 0.000000 tcp 10.0.2.105 55354 -> 96.237.22.160 1238 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:47:37.089485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:47:39.673466 0.054230 tcp 10.0.2.105 55355 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:39.727956 0.075059 tcp 10.0.2.105 55356 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:39.803354 0.171325 tcp 10.0.2.105 55357 -> 195.113.214.236 443 SRPA* 0 0 58 39840 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:47:39.975230 0.241180 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:40.216829 0.136407 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:40.353635 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:47:45.090864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:47:49.235901 0.000000 udp 10.0.2.105 7010 <- 70.61.48.21 7859 RSP 0 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 03:47:49.236379 0.170850 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:49.236746 3.004586 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:47:49.407630 0.058214 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:49.466255 0.121656 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:49.588510 0.179940 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:49.768798 0.273239 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.042422 0.148824 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.191586 0.143244 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.335204 0.084524 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.420190 0.331252 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.751840 0.232785 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:50.985025 0.058946 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.044404 0.144565 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.189380 0.145398 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.335207 0.146443 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.481977 0.163847 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.646254 0.056210 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.702788 0.136028 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:51.839195 0.198087 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:52.037628 0.301259 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:52.339303 0.211288 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:52.550985 0.141844 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:52.693206 0.038125 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 03:47:58.239519 0.000000 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 03:48:01.093981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:48:06.861909 4.196519 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 PA_S* 0 0 35 16341 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:12.092893 4.332912 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 68 36440 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:17.451397 4.522515 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 68 36440 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:22.906737 4.564878 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 68 36440 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:28.423136 4.306396 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 68 36440 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:33.099854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:48:33.487804 4.999025 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 75 40314 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:38.496030 4.997493 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 64 34176 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:43.502426 4.914680 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 73 39358 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:48.517775 4.671390 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 77 41022 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:53.748542 4.521895 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 85 45550 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:48:58.830333 4.957074 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 103 52666 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:49:03.993885 4.969189 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 99 50402 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:49:08.998703 4.918421 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 A_PA 0 0 95 51259 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:49:14.118859 1.334136 tcp 10.0.2.105 55358 -> 70.61.48.21 9140 FPA_* 0 0 7 382 flow=From-Botnet-V2-TCP-Established 1970/01/16 03:54:37.106360 3.001038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 03:54:44.113521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:54:52.115070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:55:08.117432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:55:40.123516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 03:58:31.049759 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 03:58:31.049876 0.801076 tcp 10.0.2.105 55359 -> 184.182.240.239 7058 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:01:44.129624 3.001732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:01:51.137663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:01:59.139012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:02:15.141688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:02:47.147798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:08:51.153315 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:08:58.160899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:09:06.162362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:09:22.166084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:09:54.172159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:15:58.178439 3.000825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:16:05.185052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:16:13.186488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:16:29.189635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:17:01.195868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:18:08.162331 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 04:18:08.162423 0.081926 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.244750 0.150585 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.395764 0.020091 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.416387 0.068702 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.485466 0.151681 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.637492 0.236047 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:08.873936 0.129036 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.003384 0.207118 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.210949 0.145681 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.357060 0.178934 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.536379 0.141649 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.678452 0.146401 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:09.825195 0.176932 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.002568 0.056513 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.059466 0.142288 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.202154 0.078917 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.281455 0.351783 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.633655 0.222226 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:10.856238 0.180945 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.037572 0.144690 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.182735 0.144995 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.328123 0.144875 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.473490 0.141561 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.615437 0.051291 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.667119 0.146118 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.813674 0.175879 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:11.989934 0.284230 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:12.274498 0.047166 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:12.322067 0.296444 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:18:12.618932 0.209508 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:23:05.201214 3.002017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:23:12.209303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:23:20.210282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:23:36.213754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:24:08.219470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:28:31.859304 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 04:28:31.859410 0.872466 tcp 10.0.2.105 55360 -> 184.182.240.239 7058 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:30:12.226389 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:30:19.233261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:30:27.234284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:30:43.237918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:31:15.243385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:37:19.249417 3.001645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:37:26.256931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:37:34.258735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:37:50.261887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:38:22.267464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:44:26.273727 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:44:33.281379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:44:41.282441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:44:57.285613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:45:29.291801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:48:39.014393 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 04:48:39.014493 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 04:48:57.873509 0.077607 tcp 10.0.2.105 55361 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:48:57.951450 0.075498 tcp 10.0.2.105 55362 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:48:58.027270 0.162406 tcp 10.0.2.105 55363 -> 195.113.214.236 443 SRPA* 0 0 56 48973 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:48:58.190344 0.032210 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:58.222867 0.151889 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:58.375203 0.550476 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:58.926105 0.132884 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.059353 0.142398 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.202165 0.150911 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.353549 0.020291 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.374184 0.120612 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.495207 0.190096 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.685692 0.147696 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.833785 0.148163 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:48:59.982353 0.167092 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.149854 0.060273 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.210545 0.143606 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.354565 0.083054 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.438037 0.058346 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.496751 0.151775 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:00.648945 0.382229 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:01.031576 0.201024 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:01.233016 0.144481 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:01.377906 0.145139 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:01.523395 0.141075 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:01.664849 0.378184 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.043467 0.144109 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.187986 0.180600 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.368992 0.178129 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.547497 0.209922 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.757752 0.038971 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:49:02.797125 0.300892 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/16 04:51:33.298879 3.000362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:51:40.304649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:51:48.306421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:52:04.309367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:52:36.315532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:58:32.738530 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 04:58:32.738846 0.912670 tcp 10.0.2.105 55364 -> 184.182.240.239 7058 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/01/16 04:58:40.321582 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 04:58:47.328742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:58:55.330443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:59:11.333418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 04:59:43.340688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:05:47.346000 3.001410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:05:54.352831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:06:02.354275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:06:18.357474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:06:50.363227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:12:54.369859 3.000945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:13:01.377143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:13:09.378044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:13:25.381086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:13:57.387601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:19:32.749612 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 05:19:32.749707 0.071783 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:19:32.821843 0.031848 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:19:32.854057 0.293262 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:19:33.147725 0.141695 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:19:33.289826 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 05:19:49.215363 0.054411 tcp 10.0.2.105 55365 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:19:49.270070 0.075028 tcp 10.0.2.105 55366 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:19:49.345392 0.175308 tcp 10.0.2.105 55367 -> 195.113.214.236 443 SRPA* 0 0 23 13302 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:19:49.521159 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 05:20:01.464110 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:20:07.990485 0.055807 tcp 10.0.2.105 55368 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:20:08.046186 0.113882 tcp 10.0.2.105 55369 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:20:08.160382 0.174347 tcp 10.0.2.105 55370 -> 195.113.214.236 443 SRPA* 0 0 28 13454 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:20:08.335252 0.154146 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:08.470794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:20:08.489767 0.019889 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:08.509899 0.120888 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:08.631143 0.185559 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:08.817102 0.146785 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:08.964269 0.147390 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.158497 0.167200 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.326069 0.056317 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.382791 0.142514 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.525724 0.088997 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.615155 0.063343 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.678927 0.145254 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:09.824604 0.400633 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:10.225675 0.275733 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:10.501814 0.141033 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:10.643231 0.054413 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:10.698050 0.147839 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:10.846286 0.154660 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.001355 0.138464 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.140405 0.175919 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.316680 0.141007 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.458120 0.266072 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.724602 0.042273 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:11.767274 0.302878 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:20:16.472558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:20:32.475693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:21:04.481665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:27:08.488372 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:27:15.494574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:27:23.496219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:27:39.499102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:28:11.505455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:28:33.728140 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 05:28:33.728375 1.865332 tcp 10.0.2.105 55371 -> 184.182.240.239 7058 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:34:15.511537 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:34:22.518855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:34:30.520694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:34:46.523591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:35:18.529095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:41:22.535292 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:41:29.542802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:41:37.544330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:41:53.547726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:42:25.553628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:48:29.559769 3.010943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:48:36.576636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:48:44.578199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:49:00.581206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:49:32.587527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:50:24.702576 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 05:50:24.702697 0.647654 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:25.350703 0.160369 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:25.511513 0.131834 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:25.643708 0.152977 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:25.797031 0.073334 udp 10.0.2.105 7010 <-> 31.197.209.67 7926 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:25.870768 0.146278 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:26.017463 0.152480 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:26.170298 0.020524 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:26.191200 0.120305 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:26.311864 0.178286 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:26.490486 0.598955 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:27.089771 0.147617 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:27.237784 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 05:50:43.621139 0.052719 tcp 10.0.2.105 55372 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:50:43.674130 0.082454 tcp 10.0.2.105 55373 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:50:43.756875 0.170401 tcp 10.0.2.105 55374 -> 195.113.214.236 443 SRPA* 0 0 51 36058 flow=From-Botnet-V2-TCP-Established 1970/01/16 05:50:43.927892 0.106076 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.034307 0.186763 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.221475 0.086318 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.308189 0.058160 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.366779 0.151830 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.518992 0.408839 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:44.928258 0.203198 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.131882 0.146862 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.279133 0.113951 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.393444 0.144809 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.538669 0.147848 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.686864 0.144644 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:45.831846 0.173247 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:46.005563 0.084616 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:46.090574 0.292093 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:46.383252 0.140603 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:50:46.524196 0.211975 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 05:55:36.594055 3.001012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 05:55:43.601212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:55:51.602073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:56:07.605668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:56:39.721602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 05:58:35.648955 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 05:58:35.649102 0.876816 tcp 10.0.2.105 55375 -> 184.182.240.239 7058 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:02:43.727197 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:02:50.734897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:02:58.736086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:03:14.739270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:03:46.745392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:09:50.752370 3.000752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:09:57.758680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:10:05.760529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:10:21.763204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:10:53.769464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:16:57.776140 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:17:04.783225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:17:12.784389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:17:28.787330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:18:00.793338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:21:01.473616 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 06:21:01.473715 0.188569 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:01.662714 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 06:21:17.558912 0.053123 tcp 10.0.2.105 55376 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:17.612355 0.078880 tcp 10.0.2.105 55377 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:17.691522 0.183106 tcp 10.0.2.105 55378 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:17.875226 0.130327 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:18.006096 0.031914 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:18.038373 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 06:21:35.042282 0.052752 tcp 10.0.2.105 55379 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:35.094898 0.090634 tcp 10.0.2.105 55380 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:35.185385 0.171642 tcp 10.0.2.105 55381 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:21:35.357265 0.150712 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:35.508415 0.157204 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:35.665962 0.020187 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:35.686546 0.120396 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:35.807362 0.150062 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:35.957836 0.305322 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.263571 0.189123 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.453044 0.147012 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.600413 0.059898 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.660645 0.143785 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.804762 0.082381 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.887551 0.060089 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:36.947999 0.220164 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:37.168734 0.142033 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:37.311150 0.137834 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:37.449371 0.380056 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:37.829766 0.054397 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:37.884552 0.141651 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.026624 0.151790 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.178759 0.145171 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.324358 0.177870 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.502620 0.045565 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.548687 0.210088 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:38.759219 0.286255 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:21:39.045897 0.142143 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:24:04.799532 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 06:24:11.806628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:24:19.808263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:24:35.811706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:25:07.817523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:28:36.528062 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 06:28:36.528160 0.879388 tcp 10.0.2.105 55382 -> 184.182.240.239 7058 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:31:11.823521 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:31:18.830650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:31:26.832361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:31:42.835223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:32:14.841464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:38:18.847635 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:38:25.854513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:38:33.856450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:38:49.859495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:39:21.865519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:45:25.871298 3.052072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:45:32.928787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:45:40.930187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:45:56.933115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:46:28.939520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:51:44.974352 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 06:51:44.974634 0.461771 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:51:45.436833 0.000000 udp 10.0.2.105 7010 -> 31.197.209.67 7926 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 06:52:04.113275 0.052896 tcp 10.0.2.105 55383 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:52:04.166440 0.114936 tcp 10.0.2.105 55384 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:52:04.281662 0.170677 tcp 10.0.2.105 55385 -> 195.113.214.236 443 SRPA* 0 0 32 17994 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:52:04.451222 0.169531 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:04.621138 0.134269 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:04.755826 0.031863 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:04.788056 0.142929 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:04.931322 0.161356 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.093048 0.020115 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.113503 0.121694 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.235567 0.151749 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.387738 0.146320 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.534442 0.198081 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.732952 0.148534 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.881859 0.058296 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:05.940610 0.141293 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.082308 0.085150 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.167867 0.249583 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.417857 0.245979 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.664365 0.141590 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.806384 0.145040 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:06.951858 0.360850 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:07.313101 0.056102 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:07.369597 0.142291 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:07.512384 0.154156 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:07.666977 0.142766 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:07.810090 0.205675 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:08.016178 0.301075 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:08.317682 0.141907 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:08.459925 0.184883 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:08.645173 0.039960 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 06:52:32.945214 3.002062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:52:39.952880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:52:47.953935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:53:03.957213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:53:35.963212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:58:37.427129 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 06:58:37.427224 0.829499 tcp 10.0.2.105 55386 -> 184.182.240.239 7058 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/01/16 06:59:39.969462 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 06:59:46.976840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 06:59:54.978231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:00:10.980882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:00:42.986923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:06:46.993986 3.001210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:06:54.000905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:07:02.002001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:07:18.005313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:07:50.011014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:13:54.018241 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:14:01.024487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:14:09.025964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:14:25.029061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:14:57.035044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:21:01.041517 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:21:08.048524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:21:16.050094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:21:32.053378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:22:04.059058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:22:21.274025 0.000362 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 07:22:21.274488 0.209131 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:21.484753 0.140425 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:21.625595 0.258361 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:21.884405 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 07:22:40.003392 0.053493 tcp 10.0.2.105 55387 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:40.057223 0.075643 tcp 10.0.2.105 55388 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:40.133264 0.180119 tcp 10.0.2.105 55389 -> 195.113.214.236 443 SRPA* 0 0 41 22794 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:40.313957 0.019907 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:40.334244 0.120436 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:40.455090 0.164548 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:40.620059 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 07:22:58.227793 0.054377 tcp 10.0.2.105 55390 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:58.282520 0.069890 tcp 10.0.2.105 55391 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:58.352723 0.183258 tcp 10.0.2.105 55392 -> 195.113.214.236 443 SRPA* 0 0 24 14778 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:22:58.536573 0.148594 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:58.685527 0.145776 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:58.831720 0.177802 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.009890 0.143885 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.154160 0.056141 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.210693 0.142026 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.353117 0.080181 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.433731 0.142720 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.576883 0.137792 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:22:59.715056 0.322621 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.038081 0.058863 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.097367 0.253308 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.351082 0.055497 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.406988 0.139327 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.546757 0.142448 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.689543 0.144305 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:00.834275 0.226881 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:01.061612 0.293008 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:01.355049 0.040476 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:01.395941 0.143679 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:23:01.539989 0.204206 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:28:08.085760 3.000916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 07:28:15.092299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:28:23.094124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:28:38.276415 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 07:28:38.276505 3.671685 tcp 10.0.2.105 55393 -> 184.182.240.239 7058 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/01/16 07:28:39.097170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:29:11.103473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:35:15.109223 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:35:22.116216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:35:30.118402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:35:46.121083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:36:18.127372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:42:22.134017 3.000768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:42:29.140443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:42:37.142290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:42:53.145275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:43:25.151217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:49:29.156364 3.082559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:49:36.244645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:49:44.246031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:50:00.248833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:50:32.255276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:53:10.353086 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 07:53:10.353236 0.138839 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:10.567176 0.154410 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:10.824938 0.032867 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:10.858211 0.564985 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:11.423665 0.141581 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:11.565650 0.020225 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:11.586233 0.168040 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:11.754613 0.119995 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:11.875045 0.147789 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.023227 0.179873 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.203570 0.146907 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.350856 0.056479 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.407735 0.143888 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.552056 0.153127 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.705590 0.087111 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.793113 0.141684 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:12.935237 0.144676 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.080360 0.324451 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.405231 0.059465 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.465062 0.209580 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.675005 0.056889 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.732397 0.144977 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:13.877976 0.146272 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.024664 0.145981 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.171052 0.211264 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.382724 0.302787 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.685858 0.182355 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.868647 0.047269 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:53:14.916356 0.139286 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/16 07:56:36.261390 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 07:56:43.268713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:56:51.270013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:57:07.273079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:57:39.279185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 07:58:41.970105 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 07:58:41.970307 0.871699 tcp 10.0.2.105 55394 -> 184.182.240.239 7058 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:03:43.285694 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:03:50.292286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:03:58.293964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:04:14.297076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:04:46.303210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:10:50.309160 3.001367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:10:57.316433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:11:05.317813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:11:21.320967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:11:53.327127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:17:57.334229 3.020290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:18:04.360620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:18:12.362049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:18:28.364835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:19:00.370704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:23:38.326070 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 08:23:38.326258 0.033670 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:38.360342 0.133877 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:38.494581 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 08:23:56.869687 0.140207 tcp 10.0.2.105 55395 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:23:57.010146 0.072952 tcp 10.0.2.105 55396 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:23:57.083479 0.163602 tcp 10.0.2.105 55397 -> 195.113.214.236 443 SRPA* 0 0 61 38431 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:23:57.246265 0.213556 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:57.460476 0.148678 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:57.609954 0.020326 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:57.630700 0.176537 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:57.807588 0.122209 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:57.930173 0.146802 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.077382 0.178638 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.256506 0.145849 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.402744 0.059444 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.462588 0.143097 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.606086 0.147710 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.754159 0.085550 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:58.840126 0.222372 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.062916 0.144608 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.207929 0.335887 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.544237 0.064117 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.608758 0.264200 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.873361 0.055609 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:23:59.929385 0.158384 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.088190 0.143916 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.232641 0.144231 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.377282 0.209917 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.587650 0.046016 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.634068 0.143397 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:00.777885 0.289509 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:24:01.067782 0.171089 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:25:04.417292 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:25:11.424555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:25:19.426323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:25:35.429430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:26:07.435169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:28:42.888696 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 08:28:42.888797 0.895240 tcp 10.0.2.105 55398 -> 184.182.240.239 7058 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:32:11.442174 3.000677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:32:18.448480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:32:26.450077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:32:42.453364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:33:14.458705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:39:18.464927 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:39:25.472239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:39:33.473793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:39:49.477253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:40:21.482770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:46:25.489385 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:46:32.496080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:46:40.497577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:46:56.501140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:47:28.507156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:53:32.513419 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 08:53:39.530163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:53:47.531710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:54:03.345073 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 08:54:03.345246 0.158978 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:03.504682 0.033251 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:03.534922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:54:03.538281 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 08:54:20.591130 0.053527 tcp 10.0.2.105 55399 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:54:20.644982 0.117447 tcp 10.0.2.105 55400 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:54:20.762745 0.185750 tcp 10.0.2.105 55401 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/16 08:54:20.949032 0.206476 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.155925 0.147465 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.303794 0.020309 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.324420 0.163221 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.488059 0.120617 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.609089 0.148459 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.821347 0.176784 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:21.998532 0.146242 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.145116 0.060116 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.205582 0.142071 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.348072 0.152310 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.500784 0.084599 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.585814 0.142284 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.728563 0.144898 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:22.873888 0.352994 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:23.227328 0.169251 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:23.396982 0.246348 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:23.643712 0.058228 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:23.702298 0.215995 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:23.918739 0.142617 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:24.061760 0.143289 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:24.205398 0.207371 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:24.413151 0.287302 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:24.700791 0.181548 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:24.882769 1.240860 udp 10.0.2.105 7010 <-> 95.89.176.2 6418 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:26.124027 0.144247 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 08:54:35.541256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 08:58:43.788286 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 08:58:43.788387 0.893746 tcp 10.0.2.105 55402 -> 184.182.240.239 7058 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:00:39.546644 3.002343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:00:46.555148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:00:54.556756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:01:10.559455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:01:42.565626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:07:46.571139 3.001727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:07:53.578234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:08:01.580148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:08:17.583043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:08:49.589084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:14:53.594791 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:15:00.601949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:15:08.603537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:15:24.606636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:15:56.612583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:22:00.619206 3.011020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:22:07.636437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:22:15.638022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:22:31.640903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:23:03.646603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:24:50.630909 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 09:24:50.631109 0.136500 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:50.768010 0.157100 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:50.925477 0.037237 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:50.963146 0.020601 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:50.984114 0.213012 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.197571 0.150026 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.347956 0.165550 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.513934 0.121498 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.635839 0.147179 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.783470 0.187121 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:51.970994 0.145603 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.117047 0.056582 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.173987 0.139440 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.313784 0.366783 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.680971 0.082894 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.764215 0.144276 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:52.908872 0.138222 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.047465 0.324793 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.372680 0.068341 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.441431 0.218634 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.660537 0.057344 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.718232 0.138788 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:53.857495 0.150056 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:54.007987 0.209944 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:54.218332 0.182950 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:54.401696 0.209791 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:54.611923 0.287622 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:24:54.899944 0.000000 udp 10.0.2.105 7010 -> 95.89.176.2 6418 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 09:25:11.371915 0.054309 tcp 10.0.2.105 55403 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:25:11.426507 0.106127 tcp 10.0.2.105 55404 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:25:11.532953 0.197465 tcp 10.0.2.105 55405 -> 195.113.214.236 443 SRPA* 0 0 20 10884 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:25:11.731100 0.138171 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:28:44.687752 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 09:28:44.687869 0.814664 tcp 10.0.2.105 55406 -> 184.182.240.239 7058 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:29:07.652956 3.011523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 09:29:14.670053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:29:22.671682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:29:38.674777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:30:10.681138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:36:14.687421 3.001210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:36:21.693979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:36:29.695401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:36:45.698584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:37:17.704634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:43:21.711196 3.031078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:43:28.748214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:43:36.749922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:43:52.752979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:44:24.759071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:50:28.764404 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 09:50:35.771916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:50:43.773803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:50:59.776488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:51:31.782788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:55:16.356214 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 09:55:16.356392 0.000000 udp 10.0.2.105 7010 -> 95.89.176.2 6418 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 09:55:35.215149 0.052520 tcp 10.0.2.105 55407 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:35.267957 0.093239 tcp 10.0.2.105 55408 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:35.361564 0.172355 tcp 10.0.2.105 55409 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:35.534544 0.031565 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:35.566487 0.020127 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:35.586968 0.218261 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:35.805588 0.132070 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:35.938033 0.160698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:36.099138 0.223139 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:36.322695 0.120234 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:36.443426 0.144900 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:36.588743 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 09:55:51.947301 0.053411 tcp 10.0.2.105 55410 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:52.001001 0.078756 tcp 10.0.2.105 55411 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:52.080084 0.269279 tcp 10.0.2.105 55412 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:55:52.349834 0.144476 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:52.494701 0.055120 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:52.550183 0.144658 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:52.695269 0.191833 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:52.887440 0.142354 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:53.030248 0.144709 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:53.175380 0.086250 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:53.262032 0.147819 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:53.345208 0.000000 udp 10.0.2.105 7010 <- 70.61.48.21 7859 RSP 0 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 09:55:53.410283 2.324848 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:53.410653 3.002394 tcp 10.0.2.105 55413 -> 96.237.22.160 1238 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 09:55:55.735547 0.187728 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:55.923641 0.055125 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:55.979212 0.240041 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:56.219655 0.149730 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:56.369738 0.144908 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:56.515008 0.332963 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:56.848528 0.174645 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:57.023560 0.213375 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:57.237291 0.292295 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/16 09:55:57.529925 0.000000 udp 10.0.2.105 7010 -> 70.53.181.18 9504 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 09:56:02.412005 0.000000 tcp 10.0.2.105 55413 -> 96.237.22.160 1238 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 09:56:13.928738 0.052280 tcp 10.0.2.105 55414 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:56:13.981327 0.074282 tcp 10.0.2.105 55415 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:56:14.055854 0.190110 tcp 10.0.2.105 55416 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/16 09:57:35.789300 3.000967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 09:57:42.796404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:57:50.797633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:58:06.800538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:58:38.806381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 09:58:45.506543 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 09:58:45.506653 0.810267 tcp 10.0.2.105 55417 -> 184.182.240.239 7058 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:04:42.813635 3.000671 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:04:49.820209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:04:57.821867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:05:13.824798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:05:45.830593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:11:49.837000 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:11:56.844082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:12:04.845551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:12:20.848944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:12:52.854369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:18:56.861442 3.000908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:19:03.868550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:19:11.869825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:19:27.872332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:19:59.878508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:26:03.885253 3.001335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:26:10.891960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:26:14.560737 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 10:26:14.560837 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 10:26:18.893952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:26:31.113554 0.051782 tcp 10.0.2.105 55418 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:26:31.165616 0.075881 tcp 10.0.2.105 55419 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:26:31.241798 0.231950 tcp 10.0.2.105 55420 -> 195.113.214.236 443 SRPA* 0 0 44 26970 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:26:31.473941 0.140968 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:31.615442 0.141288 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:31.615843 3.010103 tcp 10.0.2.105 55421 -> 70.53.181.18 4967 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 10:26:31.757116 0.153044 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:31.910574 0.167223 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.078203 0.077884 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.156481 0.218066 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.374959 0.020722 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.396095 0.148271 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.544720 0.122722 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.667828 0.143942 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:32.812175 0.191798 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:33.004553 3.895945 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:33.164080 0.000000 udp 10.0.2.105 7010 <- 70.61.48.21 7859 RSP 0 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 10:26:34.896915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:26:36.900929 0.056212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:36.991932 0.147426 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.139810 0.085365 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.225539 0.144801 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.370757 0.152114 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.523463 0.048371 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.572261 0.200009 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:37.772697 0.265888 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:38.038988 2.232196 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:40.271598 1.601558 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:40.634732 0.000000 tcp 10.0.2.105 55421 -> 70.53.181.18 4967 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 10:26:41.873560 0.174106 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:42.048098 0.207653 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:42.256175 0.146654 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:42.403195 0.161141 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:26:42.564681 0.297588 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:27:06.902780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:28:46.315471 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 10:28:46.315611 0.861810 tcp 10.0.2.105 55422 -> 184.182.240.239 7058 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:33:10.909683 3.000193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:33:17.916049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:33:25.917353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:33:41.920710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:34:13.926816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:40:17.932721 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:40:24.940465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:40:32.941205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:40:48.944129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:41:20.950382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:47:24.957134 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:47:31.964266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:47:39.965260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:47:55.968211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:48:27.974198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:54:31.980586 3.001354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 10:54:38.987773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:54:46.989058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:55:02.992819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:55:34.998341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 10:56:45.109614 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 10:56:45.109832 0.164046 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:45.291831 0.588366 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:45.880875 0.033398 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:45.881348 4.996694 tcp 10.0.2.105 55423 -> 74.196.220.117 6410 SPA_* 0 0 419 233709 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:56:45.914689 0.140568 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.055599 0.129692 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.185612 0.233479 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.419501 0.020467 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.440328 0.146650 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.587330 0.121801 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.709453 0.142478 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:46.852466 0.181222 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:47.034139 4.177103 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:50.918419 4.965462 tcp 10.0.2.105 55423 -> 74.196.220.117 6410 A_PA 0 0 472 267152 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:56:51.211574 0.056337 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.268455 0.146951 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.415734 0.084700 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.500811 0.050437 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.551641 0.206786 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.758881 0.221237 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:51.980492 0.151484 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:52.132447 0.150078 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:52.282820 0.064613 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:52.347832 1.469808 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:53.817988 0.181147 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:53.999493 0.209341 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:54.209184 0.290985 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:54.500528 0.144081 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:54.645023 0.155216 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 10:56:55.928561 1.113148 tcp 10.0.2.105 55423 -> 74.196.220.117 6410 FPA_* 0 0 76 39032 flow=From-Botnet-V2-TCP-Established 1970/01/16 10:58:47.184877 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 10:58:47.185030 0.988913 tcp 10.0.2.105 55424 -> 184.182.240.239 7058 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:01:39.004644 3.001238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 11:01:46.011675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:01:54.013290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:02:10.016254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:02:42.022156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:08:46.029103 3.000855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:08:53.035944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:09:01.037688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:09:17.040466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:09:49.046270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:15:53.052906 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:16:00.059562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:16:08.061446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:16:24.064394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:16:56.070353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:23:00.076682 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:23:07.083888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:23:15.085384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:23:31.087944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:24:03.094014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:27:18.715573 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:27:18.715673 0.154220 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:18.870299 0.142549 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.032429 0.130984 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.032894 2.997043 tcp 10.0.2.105 55425 -> 70.53.181.18 4967 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 11:27:19.163844 0.169556 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.333813 0.042381 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.376588 0.258610 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.635596 0.020766 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.656727 0.147387 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.804682 0.121202 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:19.926213 0.140992 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:20.067560 0.193381 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:20.261364 4.150202 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.411986 0.056114 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.468506 0.143563 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.699463 0.085378 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.785236 0.056916 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.842552 0.144020 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:24.986986 0.186056 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:25.173535 0.151806 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:25.325744 0.154792 udp 10.0.2.105 7010 <-> 96.237.22.160 2962 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:25.480952 0.065685 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:25.547032 0.209683 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:25.757142 1.730125 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:27.487666 0.181584 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:27.669617 0.140194 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:27.810256 0.289394 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:27:28.028708 0.000000 tcp 10.0.2.105 55425 -> 70.53.181.18 4967 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 11:27:28.100101 0.144063 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:28:48.174335 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:28:48.174438 0.839125 tcp 10.0.2.105 55426 -> 184.182.240.239 7058 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:30:07.100447 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 11:30:14.107719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:30:22.109643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:30:38.112093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:31:10.118136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:37:14.124803 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:37:21.131331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:37:29.133100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:37:45.136641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:38:17.142236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:44:21.147777 3.002396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:44:28.155577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:44:36.157046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:44:52.159886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:45:24.165836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:51:28.283293 3.010841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 11:51:35.299805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:51:43.301263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:51:59.304679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:52:31.310556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:57:35.067507 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:57:35.067615 0.131596 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:35.199764 0.162059 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:35.200426 3.001361 tcp 10.0.2.105 55427 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 11:57:35.362195 0.158993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:35.521567 0.142524 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:35.664529 0.132135 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:35.797046 0.569513 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.366962 0.020693 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.387966 0.147022 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.535399 0.120754 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.658946 0.141636 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.800986 0.177614 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:36.979014 4.158845 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.138266 0.056450 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.195119 0.148836 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.344526 0.082880 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.427830 0.053004 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.481225 0.339240 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:41.820828 0.181988 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:42.003253 0.151665 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:42.155327 0.236844 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:42.392578 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 11:57:44.200481 0.000000 tcp 10.0.2.105 55427 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 11:57:59.473544 0.052405 tcp 10.0.2.105 55428 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:57:59.526219 0.079286 tcp 10.0.2.105 55429 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:57:59.605746 0.161341 tcp 10.0.2.105 55430 -> 195.113.214.236 443 SRPA* 0 0 46 29997 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:57:59.766116 0.206302 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:57:59.972832 0.146506 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:58:00.132977 0.288988 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:58:00.422360 0.145647 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:58:00.568520 1.487652 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:58:02.056785 0.171023 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 11:58:02.057184 4.609092 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 SPA_* 0 0 6 459 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:08.239974 3.660230 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:14.540999 1.654796 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:19.683523 1.493528 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:28.350464 3.247581 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 13 7942 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:33.430982 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:58:34.341531 2.760446 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 21 14126 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:35.315787 3.002405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 11:58:40.336922 4.810920 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 15 10422 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:42.323406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:58:45.348364 4.986651 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 13 8922 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:49.064077 0.896565 tcp 10.0.2.105 55432 -> 184.182.240.239 7058 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:50.325015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:58:50.535424 2.854417 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 12 6440 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:58:56.626813 4.916678 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 12 7744 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:03.007037 4.583064 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 15 10450 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:06.328414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:59:10.553515 4.988334 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 13 7942 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:15.430951 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:59:15.741446 4.657286 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 16 12904 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:21.604933 4.781781 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 33 20566 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:27.458567 1.802615 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 26 13692 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:32.508353 4.909627 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 11 6358 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:37.623496 2.985031 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 8 3356 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:38.334159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 11:59:43.655446 4.653040 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 35 21874 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:49.493716 3.671929 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 18 12660 flow=From-Botnet-V2-TCP-Established 1970/01/16 11:59:51.432721 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 11:59:56.221491 3.553631 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 15 9602 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:03.074936 4.305036 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:14.599833 3.441535 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 15 9354 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:20.880656 3.369543 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 12 6440 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:27.426409 4.890262 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 16 8560 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:32.431902 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:00:32.522154 2.829762 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 16 8086 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:38.795190 2.957868 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 20 12186 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:44.740484 4.874756 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 14 10472 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:49.807062 4.847601 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 13 5074 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:00:56.322144 4.711324 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 39 22938 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:02.109953 4.984698 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 32 20160 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:07.116236 3.177974 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 16 10504 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:13.639718 4.456781 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 23 11482 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:21.397389 4.704526 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 11 4938 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:21.432216 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:01:29.515258 0.399384 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:36.256960 3.291823 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 15 8532 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:42.621982 1.883759 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 9 7204 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:47.912695 1.583122 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:52.917081 4.555523 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:01:54.440176 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:02:00.646869 4.948041 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 16 12524 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:05.785900 4.587199 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 32 17292 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:11.631073 3.368774 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 47 25066 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:17.955972 3.056129 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 12 6440 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:24.483259 4.949923 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 11 7310 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:29.630185 3.175120 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 14 8728 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:35.939697 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:02:36.101303 3.684086 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 18 13260 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:42.755661 0.204138 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 5 4366 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:50.111403 3.713685 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 8 4528 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:02:57.063601 4.770367 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 21 12222 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:03:03.284398 4.941698 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 31 21306 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:03:09.844571 4.019609 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:03:15.018618 3.276141 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 A_PA 0 0 26 16340 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:03:21.435098 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:03:21.806918 1.359260 tcp 10.0.2.105 55431 -> 211.38.175.27 4598 FPA_* 0 0 7 1261 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:05:42.340913 3.000892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 12:05:49.347484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:05:57.349452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:06:13.352370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:06:45.358063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:12:49.364458 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:12:56.371931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:13:04.373095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:13:20.376108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:13:52.382043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:19:56.389052 3.001098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:20:03.395877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:20:11.397329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:20:27.400183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:20:59.405856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:27:03.412388 3.001448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:27:10.419466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:27:18.420775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:27:34.424242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:28:06.429851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:28:12.749523 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:28:12.749680 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 2962 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 12:28:30.847354 0.052775 tcp 10.0.2.105 55433 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:28:30.900488 0.071964 tcp 10.0.2.105 55434 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:28:30.972732 0.173639 tcp 10.0.2.105 55435 -> 195.113.214.236 443 SRPA* 0 0 41 22756 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:28:31.146999 0.139257 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:31.286709 0.186961 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:31.287021 3.003197 tcp 10.0.2.105 55436 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 12:28:31.474108 0.061148 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:31.535676 0.711687 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:32.247779 0.157749 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:32.405905 0.142444 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:32.548698 0.120803 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:32.669903 0.141461 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:32.811713 0.191702 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:33.003819 0.163647 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:33.167900 0.020866 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:33.189159 0.148226 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:33.337760 0.055995 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:33.394176 4.010730 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:37.405339 0.182768 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:37.588687 0.144697 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:37.733819 0.082825 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:37.817042 0.052490 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:37.869944 0.316692 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:38.187044 0.209812 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:38.397257 0.064751 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:38.462437 0.140752 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:38.603555 0.290754 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:38.894627 0.141464 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:39.036478 1.147673 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:40.184566 0.171642 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:28:40.288917 0.000000 tcp 10.0.2.105 55436 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 12:28:49.963470 0.805599 tcp 10.0.2.105 55437 -> 184.182.240.239 7058 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:34:10.435795 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 12:34:17.443828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:34:25.445327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:34:41.447830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:35:13.454192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:41:17.460513 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:41:24.467189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:41:32.469281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:41:48.471919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:42:20.478337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:48:24.484562 3.001156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:48:31.491519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:48:39.492652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:48:55.496206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:49:27.501729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:55:31.508813 3.001190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 12:55:38.515709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:55:46.516756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:56:02.520075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:56:34.525682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 12:58:50.792523 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 12:58:50.792611 0.801880 tcp 10.0.2.105 55438 -> 184.182.240.239 7058 FSPA* 0 0 14 1597 flow=From-Botnet-V2-TCP-Established 1970/01/16 12:59:06.674946 0.136208 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:06.811594 0.211320 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:06.811929 2.997271 tcp 10.0.2.105 55439 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 12:59:07.023349 0.182101 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.224342 0.042281 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.267016 0.152396 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.419825 0.136943 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.557168 0.120302 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.677913 0.141837 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:07.820121 0.184273 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:08.004737 0.151445 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:08.156655 0.020322 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:08.177343 0.147063 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:08.324773 0.056790 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:08.381945 3.689804 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.072142 0.254387 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.326861 0.144539 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.471805 0.081430 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.553641 0.056923 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.611017 0.344370 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:12.955805 0.153362 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:13.109580 0.298411 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:13.408627 0.141656 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:13.550659 0.207401 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:13.758481 0.063024 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:13.821959 0.346307 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:14.168640 0.173566 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 12:59:15.807540 0.000000 tcp 10.0.2.105 55439 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 12:59:16.959143 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 13:02:38.592183 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:02:45.599454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:02:53.601090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:03:09.604449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:03:41.609922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:09:45.616755 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:09:52.624531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:10:00.625950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:10:16.628760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:10:48.633985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:16:52.640777 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:16:59.647117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:17:07.649117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:17:23.651818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:17:55.657992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:23:59.684492 3.171412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:24:06.861872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:24:14.863078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:24:30.866249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:25:02.872022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:28:51.681700 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 13:28:51.681807 0.831030 tcp 10.0.2.105 55440 -> 184.182.240.239 7058 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/01/16 13:29:22.415794 0.185443 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:22.601644 0.032604 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:22.634785 0.133640 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:22.635200 2.994607 tcp 10.0.2.105 55441 -> 78.134.76.143 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 13:29:22.768810 0.206005 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:22.975188 0.156961 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.132564 0.141918 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.274898 0.121343 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.396715 0.142215 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.539323 0.182806 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.722522 0.145527 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.868469 0.020305 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:23.889091 0.144629 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:24.034165 0.055111 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:24.089629 0.986246 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.076337 0.240988 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.317686 0.056696 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.374768 0.228256 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.603432 0.147988 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.751781 0.151854 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.904024 0.082809 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:25.987215 0.300624 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:26.288256 0.145380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:26.434004 0.210944 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:26.645369 0.060140 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:26.705908 0.330702 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:27.031913 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 13:29:27.036965 0.171435 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:29:31.628748 0.000000 tcp 10.0.2.105 55441 -> 78.134.76.143 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 13:31:06.878934 3.000975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 13:31:13.885300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:31:21.887181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:31:37.889929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:32:09.895858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:38:13.903357 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:38:20.909833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:38:28.911338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:38:44.913860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:39:16.920121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:45:20.926053 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:45:27.933266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:45:35.935424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:45:51.937793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:46:23.944173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:52:27.950266 3.001360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:52:34.957662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:52:42.958954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:52:58.962210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:53:30.968359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:58:52.521139 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 13:58:52.521318 0.852080 tcp 10.0.2.105 55442 -> 184.182.240.239 7058 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/01/16 13:59:34.995222 3.000706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 13:59:37.656099 0.136812 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:37.793424 0.212356 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:37.793892 2.995889 tcp 10.0.2.105 55443 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 13:59:38.006137 0.151593 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.158121 0.139691 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.298184 0.241480 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.540037 0.031227 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.571659 0.121932 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.694065 0.142287 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:38.836756 0.189510 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.026635 0.196863 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.223910 0.020084 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.244471 0.145565 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.390448 0.057044 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.447896 0.149320 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.597641 0.201894 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.800005 0.054758 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.855147 0.137964 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:39.993539 0.080138 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:40.074087 0.286740 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:40.361270 0.292567 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:40.654247 0.154227 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:40.808878 0.142622 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:40.951869 0.209717 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:41.161994 0.059195 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:41.221598 0.324858 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:41.546854 0.177482 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 13:59:42.001200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 13:59:42.552514 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 13:59:46.788056 0.000000 tcp 10.0.2.105 55443 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 13:59:50.003014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:00:06.006126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:00:38.011949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:06:42.018846 3.000909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:06:49.025782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:06:57.026959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:07:13.029688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:07:45.035811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:13:49.042569 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:13:56.049596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:14:04.050777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:14:20.053658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:14:52.059675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:20:56.065972 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:21:03.073609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:21:11.075133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:21:27.078260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:21:59.083666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:28:03.089700 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:28:10.097842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:28:18.099033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:28:34.102210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:28:53.380348 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 14:28:53.380463 0.887175 tcp 10.0.2.105 55444 -> 184.182.240.239 7058 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/16 14:29:06.107906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:30:06.375115 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 14:30:06.375218 0.155554 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:06.531129 0.141589 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:06.673205 0.136838 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:06.673674 2.995887 tcp 10.0.2.105 55445 -> 70.53.181.18 4967 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 14:30:06.810453 0.215825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.026629 0.174722 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.201752 0.031189 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.233313 0.120968 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.354633 0.143447 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.517152 0.180730 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.698230 0.144966 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.843582 0.020072 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:07.863976 0.143196 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.007600 0.055871 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.063871 0.147097 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.211378 0.274683 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.486400 0.057890 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.544714 0.144587 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.689700 0.082929 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:08.773031 0.302383 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.075834 0.142640 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.218947 0.210077 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.429434 0.058601 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.488463 0.234067 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.722924 0.144868 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:09.868167 0.323178 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:10.191761 0.170556 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/16 14:30:15.667700 0.000000 tcp 10.0.2.105 55445 -> 70.53.181.18 4967 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 14:35:10.113780 3.001970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:35:17.121173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:35:25.122823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:35:41.125954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:36:13.131907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:42:17.137522 3.002390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:42:24.145511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:42:32.146632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:42:48.149732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:43:20.156117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:49:24.162031 3.041665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:49:31.209379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:49:39.211119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:49:55.213590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:50:27.219695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:56:31.225698 3.002171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 14:56:38.233164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:56:46.234588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:57:02.237909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:57:34.244160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 14:58:54.269760 0.000310 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 14:58:54.270168 0.839193 tcp 10.0.2.105 55446 -> 184.182.240.239 7058 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/16 15:00:33.772757 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 15:00:33.772853 0.131931 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:33.905313 0.211742 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:33.905664 3.001147 tcp 10.0.2.105 55447 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 15:00:34.117477 0.173781 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.291627 0.032758 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.324794 0.121985 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.447134 0.156205 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.603793 0.136609 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.740809 0.143416 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:34.884642 0.184668 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.069769 0.145684 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.215853 0.020087 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.236465 0.145647 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.382540 0.057199 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.440172 0.147030 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.587646 0.151781 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.739824 0.082852 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:35.823080 0.296612 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.120110 0.142292 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.262805 0.183311 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.446530 0.059216 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.506094 0.209560 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.716128 0.058889 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.775375 0.189896 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:36.965691 0.141181 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:37.107287 0.338599 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:37.446246 0.168053 udp 10.0.2.105 7010 <-> 209.62.218.119 7268 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:00:42.915183 0.000000 tcp 10.0.2.105 55447 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 15:03:38.250480 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 15:03:45.257359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:03:53.259139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:04:09.262024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:04:41.267823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:10:45.274832 3.000306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:10:52.281345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:11:00.282824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:11:16.285771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:11:48.291644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:17:52.297772 3.001564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:17:59.305240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:18:07.307060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:18:23.309680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:18:55.315973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:24:59.321516 3.002116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:25:06.329537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:25:14.330338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:25:30.333936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:26:02.339901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:28:55.108679 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 15:28:55.108776 0.952727 tcp 10.0.2.105 55448 -> 184.182.240.239 7058 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/01/16 15:30:57.023904 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 15:30:57.024007 0.171523 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:57.195982 0.031703 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:57.228153 0.133296 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:57.228568 2.999144 tcp 10.0.2.105 55449 -> 78.134.76.143 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 15:30:57.361803 0.545888 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:57.908117 0.120350 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:58.028857 0.156863 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:58.186135 0.145869 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:58.332430 0.138178 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:58.471001 0.191368 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:58.662795 0.476790 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.140020 0.020237 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.160634 0.144265 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.305279 0.056143 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.361845 0.157698 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.519971 0.144714 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.665094 0.080633 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:30:59.746150 0.300894 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.047491 0.143777 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.191669 0.231646 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.423668 0.059360 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.483465 0.143457 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.627328 0.146977 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:00.774712 0.272209 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:01.047316 0.057538 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:01.105254 0.324105 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 15:31:01.429791 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 15:31:06.226272 0.000000 tcp 10.0.2.105 55449 -> 78.134.76.143 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 15:31:20.258479 0.031554 tcp 10.0.2.105 55450 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 15:31:20.290362 0.073540 tcp 10.0.2.105 55451 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 15:31:20.364228 0.133779 tcp 10.0.2.105 55452 -> 195.113.214.236 443 SRPA* 0 0 67 41787 flow=From-Botnet-V2-TCP-Established 1970/01/16 15:32:06.345675 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 15:32:13.353412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:32:21.355039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:32:37.357382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:33:09.363701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:39:13.369890 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:39:20.376984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:39:28.378422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:39:44.381592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:40:16.387305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:46:20.394474 3.040985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:46:27.440998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:46:35.442364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:46:51.445495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:47:23.451761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:53:27.458186 3.000800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 15:53:34.465191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:53:42.466449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:53:58.469697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:54:30.475695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 15:58:56.078068 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 15:58:56.078168 0.944019 tcp 10.0.2.105 55453 -> 184.182.240.239 7058 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:00:34.482248 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:00:41.489382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:00:49.490241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:01:05.493294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:01:37.499336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:01:38.912141 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 16:01:38.912285 0.000000 udp 10.0.2.105 7010 -> 209.62.218.119 7268 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 16:01:55.446896 0.031297 tcp 10.0.2.105 55454 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:01:55.478497 0.074828 tcp 10.0.2.105 55455 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:01:55.553660 0.158324 tcp 10.0.2.105 55456 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:01:55.717189 0.137754 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:55.855394 0.201219 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:55.855712 2.994452 tcp 10.0.2.105 55457 -> 99.45.44.111 7036 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 16:01:56.056992 0.031599 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.089041 0.152498 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.241915 0.142281 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.384609 0.242940 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.627906 0.120676 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.749031 0.137753 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.887227 0.020450 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:56.908088 0.144734 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.053236 0.054989 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.108580 0.145041 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.254041 0.177991 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.432407 0.081960 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.514706 0.296402 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.811532 0.144020 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:57.955893 0.158353 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.114639 0.151815 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.266817 0.139238 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.406474 0.148429 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.555266 0.261515 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.817167 0.051201 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.868723 0.063032 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:58.932129 0.209224 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:01:59.141777 0.331388 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:02:04.849073 0.000000 tcp 10.0.2.105 55457 -> 99.45.44.111 7036 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 16:07:41.505402 3.001881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:07:48.512718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:07:56.514477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:08:12.517770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:08:44.523547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:14:48.529290 3.002122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:14:55.537661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:15:03.538433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:15:19.541362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:15:51.547699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:21:55.554426 3.000981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:22:02.561373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:22:10.562252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:22:26.565513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:22:58.571781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:28:57.026988 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 16:28:57.027195 0.845728 tcp 10.0.2.105 55458 -> 184.182.240.239 7058 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:29:02.578146 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:29:09.584904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:29:17.586549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:29:33.589587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:30:05.595390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:32:01.111751 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 16:32:01.112025 0.034560 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:01.147027 0.161290 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:01.147361 3.008690 tcp 10.0.2.105 55459 -> 78.134.76.143 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 16:32:01.308814 0.132266 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:01.441501 0.169200 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:01.611101 0.142760 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:01.754254 0.280180 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.034891 0.122943 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.158234 0.140381 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.299044 0.020346 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.319724 0.146820 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.466896 0.055357 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.522693 0.153514 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.676542 0.180161 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.857023 0.077098 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:02.934530 0.295179 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:03.230174 0.143433 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:03.373998 0.157168 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:03.531590 0.138054 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:03.670051 0.280342 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:03.950795 0.059331 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:04.010513 0.064023 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:04.074927 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 16:32:10.164584 0.000000 tcp 10.0.2.105 55459 -> 78.134.76.143 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 16:32:19.770004 0.031635 tcp 10.0.2.105 55460 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:32:19.801957 0.075297 tcp 10.0.2.105 55461 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:32:19.877600 0.158967 tcp 10.0.2.105 55462 -> 195.113.214.236 443 SRPA* 0 0 40 33108 flow=From-Botnet-V2-TCP-Established 1970/01/16 16:32:20.037314 0.138525 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:20.176369 0.151093 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:32:20.327876 0.329456 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/16 16:36:09.602035 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:36:16.608756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:36:24.610229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:36:40.613859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:37:12.619634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:43:16.626323 3.001042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:43:23.633130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:43:31.634488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:43:47.637251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:44:19.643922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:50:23.649175 3.022006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:50:30.677010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:50:38.678296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:50:54.681267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:51:26.687362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:57:30.693208 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 16:57:37.700827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:57:45.702669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:58:01.705462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:58:33.711365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 16:58:57.876782 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 16:58:57.877080 0.919996 tcp 10.0.2.105 55463 -> 184.182.240.239 7058 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:02:21.469261 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:02:21.469352 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:02:36.691987 0.031702 tcp 10.0.2.105 55464 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:02:36.723950 0.065070 tcp 10.0.2.105 55465 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:02:36.789320 0.162430 tcp 10.0.2.105 55466 -> 195.113.214.236 443 SRPA* 0 0 40 32244 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:02:36.952517 3.885131 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 4 1064 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:36.984484 3.640262 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1150 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:36.984880 3.000749 tcp 10.0.2.105 55467 -> 78.134.76.143 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 17:02:37.138224 3.664928 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 947 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:37.311728 3.757750 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 4 1158 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:37.451001 3.829132 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1123 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:37.658492 3.744667 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1018 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:37.781093 3.776001 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 4 1111 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:37.922683 3.762859 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 4 1184 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.054591 3.653094 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1100 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.075420 3.785709 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 4 1119 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.239999 3.809669 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1069 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.430353 3.690512 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1113 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.503055 3.915655 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1214 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.801672 3.764158 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 1093 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:38.945772 3.672137 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1119 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.001661 3.769772 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1069 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.155565 3.754716 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1275 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.293881 4.408056 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1150 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.502279 3.464881 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 4 1123 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.552836 3.477024 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 4 1103 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.611558 3.564287 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1071 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.756860 3.558402 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1203 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:39.988024 3.469012 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 4 1194 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:40.130713 3.900543 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1109 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:02:44.031962 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:02:45.983995 0.000000 tcp 10.0.2.105 55467 -> 78.134.76.143 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/16 17:02:49.559575 0.000000 udp 10.0.2.105 7010 -> 220.98.160.219 9894 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:02:56.889995 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 2105 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:01.566330 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:03:05.662850 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:14.585795 0.000000 udp 10.0.2.105 7010 -> 173.240.26.185 8531 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:20.543767 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:25.831341 0.413218 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:26.244559 0.000000 icmp 116.14.228.106 0x0303 -> 10.0.2.105 0x711a URP 192 1 263 flow=Background 1970/01/16 17:03:30.568477 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:03:30.999107 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:37.798614 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:44.979262 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:53.561661 0.000000 udp 10.0.2.105 7010 -> 71.236.23.231 3223 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:03:58.558351 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:04:02.394381 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:08.032577 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:15.983701 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:22.392971 0.157525 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:22.550496 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 238 flow=Background 1970/01/16 17:04:27.059230 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:04:29.563205 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:35.862599 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:37.717083 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 17:04:43.663763 0.000000 udp 10.0.2.105 7010 -> 93.193.152.37 7662 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:44.724570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:04:52.055114 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:04:52.725992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:04:56.562216 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:05:01.018810 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:06.025354 0.000000 udp 10.0.2.105 7010 -> 190.204.196.50 6997 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:08.729654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:05:12.234728 0.148350 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:05:12.392494 0.000000 udp 10.0.2.105 7010 -> 2.102.20.236 8211 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:18.814334 0.000000 udp 10.0.2.105 7010 -> 67.60.93.78 5816 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:23.560929 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:05:24.912990 0.000000 udp 10.0.2.105 7010 -> 80.89.80.173 8214 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:33.084184 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:40.164963 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:40.736469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:05:45.962971 0.000000 udp 10.0.2.105 7010 -> 2.177.135.174 4373 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:50.559579 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:05:53.453526 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:05:58.981900 0.000000 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:06.973336 0.402434 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:06:07.385879 0.000000 udp 10.0.2.105 7010 -> 75.103.7.180 3992 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:15.265296 0.000000 udp 10.0.2.105 7010 -> 87.194.148.167 2531 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:20.062087 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:06:24.138050 0.000000 udp 10.0.2.105 7010 -> 88.253.50.173 1039 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:29.555514 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:36.525856 0.298440 udp 10.0.2.105 7010 <-> 183.171.68.40 6103 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:06:36.842653 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:44.346856 0.062937 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:06:44.454910 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:49.063510 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:06:49.684516 0.000000 udp 10.0.2.105 7010 -> 88.46.115.139 2638 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:06:56.063587 0.000000 udp 10.0.2.105 7010 -> 95.229.248.36 6838 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:01.481929 0.158154 udp 10.0.2.105 7010 <-> 99.112.213.90 7576 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:01.658438 0.000000 udp 10.0.2.105 7010 -> 108.13.212.248 1969 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:09.713240 0.454389 udp 10.0.2.105 7010 <-> 177.216.207.87 7553 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:10.197071 0.000000 udp 10.0.2.105 7010 -> 31.223.43.131 2184 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:14.559966 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:07:18.306090 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:23.903576 0.000000 udp 10.0.2.105 7010 -> 79.29.246.107 9258 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:30.883742 0.000000 udp 10.0.2.105 7010 -> 95.89.176.2 6418 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:35.971542 0.026865 udp 10.0.2.105 7010 -> 88.64.228.163 6222 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:35.998407 0.000000 icmp 88.64.228.163 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 200 flow=Background 1970/01/16 17:07:40.567412 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:07:42.731643 0.000000 udp 10.0.2.105 7010 -> 202.171.188.175 9144 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:48.489316 0.000000 udp 10.0.2.105 7010 -> 86.28.160.4 9314 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:07:56.180319 0.138936 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:56.418675 0.222989 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:56.663524 0.040338 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:56.749230 0.219867 udp 10.0.2.105 7010 <-> 186.91.236.120 5723 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:07:56.987751 0.000000 udp 10.0.2.105 7010 -> 46.196.14.240 2209 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:05.804036 0.196640 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:06.000676 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 153 flow=Background 1970/01/16 17:08:10.560335 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:08:12.523545 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:20.324740 0.000000 udp 10.0.2.105 7010 -> 93.159.99.242 5762 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:27.024282 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:32.642918 0.267344 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:08:32.966825 0.182175 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:08:33.221998 0.138555 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:08:33.530246 0.000000 udp 10.0.2.105 7010 -> 74.7.75.190 7266 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:37.559690 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:08:40.554386 0.000000 udp 10.0.2.105 7010 -> 110.142.68.235 1192 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:46.502372 0.000000 udp 10.0.2.105 7010 -> 71.42.227.34 4412 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:08:54.864769 0.000000 udp 10.0.2.105 7010 -> 108.238.224.142 5831 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:03.507191 0.000000 udp 10.0.2.105 7010 -> 61.92.255.186 6612 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:08.063712 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:09:09.856440 0.169536 udp 10.0.2.105 7010 <-> 162.200.204.187 9727 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:09:10.134041 0.000000 udp 10.0.2.105 7010 -> 68.193.100.50 6097 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:15.774425 0.000000 udp 10.0.2.105 7010 -> 110.77.152.241 8260 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:21.032426 0.156833 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:09:21.265476 0.000000 udp 10.0.2.105 7010 -> 110.142.255.98 1143 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:29.163973 0.000000 udp 10.0.2.105 7010 -> 181.225.60.111 3344 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:34.060792 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:09:37.806487 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 3838 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:43.795183 0.000000 udp 10.0.2.105 7010 -> 50.70.12.174 1469 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:50.865346 0.000000 udp 10.0.2.105 7010 -> 178.51.222.26 3027 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:09:58.866614 0.000000 udp 10.0.2.105 7010 -> 70.82.200.113 3053 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:03.563397 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:10:06.517296 0.000000 udp 10.0.2.105 7010 -> 108.178.97.179 9252 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:12.125581 0.000000 udp 10.0.2.105 7010 -> 118.142.97.182 1920 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:18.084458 0.000000 udp 10.0.2.105 7010 -> 218.1.30.46 7464 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:25.775377 0.000000 udp 10.0.2.105 7010 -> 112.216.17.194 2137 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:30.561866 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:10:33.275957 0.000000 udp 10.0.2.105 7010 -> 86.4.127.47 8116 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:41.277503 0.000000 udp 10.0.2.105 7010 -> 202.62.72.186 9454 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:10:46.514881 0.000000 udp 10.0.2.105 7010 -> 59.37.27.204 4149 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:11:44.742913 3.000256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 17:11:51.748697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:11:59.750501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:12:15.753108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:12:47.759542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:18:51.765903 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:18:58.772687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:19:06.774144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:19:22.777199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:19:54.783217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:25:58.789132 3.001995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:26:05.796524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:26:13.798016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:26:29.891281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:27:01.897550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:28:58.836569 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:28:58.836666 1.013632 tcp 10.0.2.105 55468 -> 184.182.240.239 7058 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:33:05.904434 3.000397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:33:12.911142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:33:20.912088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:33:36.915636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:34:08.921654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:40:12.926881 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:40:19.934928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:40:27.936392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:40:43.939370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:40:58.250565 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:40:58.250805 0.171045 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:58.422301 0.031488 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:58.422669 4.920178 tcp 10.0.2.105 55469 -> 74.196.220.117 6410 SPA_* 0 0 423 236010 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:40:58.454196 0.142398 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:58.596979 0.308732 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:58.906034 0.155823 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.062261 0.122718 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.185269 0.140382 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.326098 0.136951 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.463428 0.020739 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.484519 0.153478 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.638343 0.196003 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.834734 0.072786 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:40:59.907932 0.292371 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.200654 0.145442 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.346445 0.058839 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.405656 0.239243 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.645242 0.144472 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.790083 0.052482 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:00.842978 0.852817 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:01.696180 0.143776 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:01.840529 0.136038 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:01.976928 0.223952 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:02.201282 0.324353 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:02.526089 0.142981 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:02.669451 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:41:03.469300 4.955322 tcp 10.0.2.105 55469 -> 74.196.220.117 6410 A_PA 0 0 464 262624 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:08.469430 1.322931 tcp 10.0.2.105 55469 -> 74.196.220.117 6410 FPA_* 0 0 80 41705 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:15.945166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:41:19.471565 0.031347 tcp 10.0.2.105 55470 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:19.503250 0.065386 tcp 10.0.2.105 55471 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:19.568992 0.157035 tcp 10.0.2.105 55472 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:19.726802 0.399145 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:20.126318 0.301538 udp 10.0.2.105 7010 <-> 183.171.68.40 6103 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:20.428452 0.058859 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:20.487659 0.147536 udp 10.0.2.105 7010 <-> 99.112.213.90 7576 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:20.635561 0.000000 udp 10.0.2.105 7010 -> 177.216.207.87 7553 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:41:39.580005 0.029619 tcp 10.0.2.105 55473 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:39.609880 0.064933 tcp 10.0.2.105 55474 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:39.675094 0.165329 tcp 10.0.2.105 55475 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:39.840908 0.137261 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:39.978601 0.174408 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:40.153396 0.212624 udp 10.0.2.105 7010 <-> 186.91.236.120 5723 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:40.366407 0.037303 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:40.404120 0.177282 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:40.581802 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 17:41:57.074819 0.031431 tcp 10.0.2.105 55476 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:57.106592 0.066810 tcp 10.0.2.105 55477 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:57.173695 0.160471 tcp 10.0.2.105 55478 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/16 17:41:57.334736 0.136655 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:57.471737 0.213809 udp 10.0.2.105 7010 <-> 162.200.204.187 9727 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:41:57.685895 0.151235 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/16 17:47:19.952776 3.020200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:47:26.979196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:47:34.979974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:47:50.983580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:48:22.989313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:54:26.995180 3.002066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 17:54:34.002459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:54:42.003911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:54:58.007046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:55:30.013512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 17:58:59.855705 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 17:58:59.855800 0.821475 tcp 10.0.2.105 55479 -> 184.182.240.239 7058 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:01:34.020150 3.000785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:01:41.026487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:01:49.028212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:02:05.031517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:02:37.037542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:08:41.043712 3.001317 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:08:48.050993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:08:56.051957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:09:12.054969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:09:44.101108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:12:04.283040 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 18:12:04.283152 0.148170 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:04.431747 0.000000 udp 10.0.2.105 7010 -> 177.216.207.87 7553 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:12:20.658168 0.031904 tcp 10.0.2.105 55480 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:20.690462 0.067395 tcp 10.0.2.105 55481 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:20.757741 0.156501 tcp 10.0.2.105 55482 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:20.914351 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:12:37.221059 0.032856 tcp 10.0.2.105 55483 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:37.254156 0.064714 tcp 10.0.2.105 55484 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:37.318684 0.152743 tcp 10.0.2.105 55485 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:37.471973 0.144486 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:37.616859 0.120403 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:37.737709 0.142697 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:37.880828 0.031630 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:37.912868 0.154422 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:38.067732 0.301933 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:38.370092 0.249537 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:38.620111 0.077205 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:38.697706 0.482291 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.180398 0.145814 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.326620 0.137845 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.464944 0.020653 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.485976 0.294868 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.781271 0.184172 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:39.965818 0.054254 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.020547 0.057034 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.078024 0.142345 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.220786 0.144748 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.365934 0.147677 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.514029 0.144121 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:40.658586 0.364076 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:41.023085 0.212761 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:41.236461 0.357516 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:41.594390 0.153532 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:41.748405 0.000000 udp 10.0.2.105 7010 -> 116.89.110.23 6487 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:12:58.461257 0.031727 tcp 10.0.2.105 55486 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:58.492774 0.065258 tcp 10.0.2.105 55487 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:58.558363 0.176068 tcp 10.0.2.105 55488 -> 195.113.214.236 443 SRPA* 0 0 53 32180 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:12:58.733126 0.058559 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:58.792025 0.311997 udp 10.0.2.105 7010 <-> 183.171.68.40 6103 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:12:59.104582 0.000000 udp 10.0.2.105 7010 -> 99.112.213.90 7576 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:13:14.353786 0.030643 tcp 10.0.2.105 55489 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:13:14.384779 0.064395 tcp 10.0.2.105 55490 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:13:14.449493 0.159232 tcp 10.0.2.105 55491 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:13:14.609340 0.146726 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:14.756525 0.133655 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:14.890547 0.036731 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:14.927697 0.209035 udp 10.0.2.105 7010 <-> 186.91.236.120 5723 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:15.137090 0.177540 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:15.315103 0.151278 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:15.466832 0.137856 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:13:15.605127 0.232355 udp 10.0.2.105 7010 <-> 162.200.204.187 9727 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:15:48.107940 3.000924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 18:15:55.114662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:16:03.116353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:16:19.119525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:16:51.125776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:22:55.131514 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:23:02.138735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:23:10.140319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:23:26.142974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:23:58.149210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:29:00.715096 0.054476 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 18:29:00.769841 0.840238 tcp 10.0.2.105 55492 -> 184.182.240.239 7058 FSPA* 0 0 12 1471 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:30:02.255631 3.001480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:30:09.262753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:30:17.264198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:30:33.267293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:31:05.272983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:37:09.279737 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:37:16.286792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:37:24.288389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:37:40.291376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:38:12.297256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:43:41.711071 0.271830 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 18:43:41.983314 0.399546 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:42.383254 0.000000 udp 10.0.2.105 7010 -> 99.112.213.90 7576 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:43:57.815980 0.031051 tcp 10.0.2.105 55493 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:43:57.847340 0.067174 tcp 10.0.2.105 55494 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:43:57.914365 0.154801 tcp 10.0.2.105 55495 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:43:58.069720 0.151850 udp 10.0.2.105 7010 <-> 108.205.242.54 8109 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.221974 0.144138 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.366507 0.036845 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.403780 0.157231 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.561426 0.262876 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.824697 0.122685 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:58.947781 0.138553 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:43:59.086710 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:44:16.434140 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:44:17.733710 0.030157 tcp 10.0.2.105 55496 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:17.764145 0.063361 tcp 10.0.2.105 55497 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:17.827870 0.160353 tcp 10.0.2.105 55498 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:17.988839 0.177079 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.166338 0.145090 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.311822 0.150704 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.462903 0.288021 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.751339 0.185604 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.937300 0.057325 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:18.995060 0.055961 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.051423 0.146347 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.198196 0.133129 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.331707 0.020348 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.352472 0.208784 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.561633 0.144621 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.706625 0.143690 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:19.850738 0.167588 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:20.018662 0.059403 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:20.078466 0.150305 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:20.229179 0.330776 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:20.560563 0.000000 udp 10.0.2.105 7010 -> 183.171.68.40 6103 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:44:23.441208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:44:31.442003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:44:35.759239 0.030708 tcp 10.0.2.105 55499 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:35.790222 0.067434 tcp 10.0.2.105 55500 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:35.858013 0.162428 tcp 10.0.2.105 55501 -> 195.113.214.236 443 SRPA* 0 0 41 32298 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:36.021057 0.058177 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:36.079637 0.134388 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:36.214344 0.038850 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:36.253524 0.000000 udp 10.0.2.105 7010 -> 186.91.236.120 5723 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 18:44:47.445399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:44:54.505929 0.030047 tcp 10.0.2.105 55502 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:54.536251 0.063998 tcp 10.0.2.105 55503 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:54.600092 0.156370 tcp 10.0.2.105 55504 -> 195.113.214.236 443 SRPA* 0 0 66 45388 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:44:54.755444 0.178896 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:54.934754 0.146450 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:55.081627 0.167731 udp 10.0.2.105 7010 <-> 162.200.204.187 9727 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:55.249698 0.155557 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:44:55.405688 0.137936 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/16 18:45:19.451213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:51:23.457731 3.021068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:51:30.484719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:51:38.486110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:51:54.489573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:52:26.495675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:58:30.501557 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 18:58:37.508895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:58:45.510032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:59:01.513046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 18:59:01.743792 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 18:59:01.743882 0.788111 tcp 10.0.2.105 55505 -> 184.182.240.239 7058 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/01/16 18:59:33.519477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:05:37.525725 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:05:44.532631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:05:52.533932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:06:08.537685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:06:40.543186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:12:44.549679 3.001045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:12:51.556793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:12:59.558048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:13:15.561429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:13:47.567255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:15:14.031809 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 19:15:14.032051 0.077203 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:15:14.109623 0.000000 udp 10.0.2.105 7010 -> 183.171.68.40 6103 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:15:30.667892 0.030571 tcp 10.0.2.105 55506 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:15:30.698847 0.070328 tcp 10.0.2.105 55507 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:15:30.769458 0.155362 tcp 10.0.2.105 55508 -> 195.113.214.236 443 SRPA* 0 0 48 42026 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:15:30.925456 0.000000 udp 10.0.2.105 7010 -> 186.91.236.120 5723 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:15:48.582084 0.030203 tcp 10.0.2.105 55509 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:15:48.612486 0.142625 tcp 10.0.2.105 55510 -> 195.113.214.236 80 SRPA* 0 0 55 43669 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:15:48.754666 0.400765 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:15:49.155861 0.033285 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:15:49.189566 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:16:04.725308 0.030055 tcp 10.0.2.105 55511 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:04.755662 0.065878 tcp 10.0.2.105 55512 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:04.821851 0.156724 tcp 10.0.2.105 55513 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:04.979411 0.139329 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.119135 0.140467 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.259952 0.188024 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.448442 0.119954 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.568743 0.204181 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.773330 0.147434 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:05.921129 0.164808 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.086357 0.143637 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.230408 0.284444 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.515253 0.167408 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.683071 0.137436 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.820840 0.019464 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:06.840680 0.253671 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.094705 0.144923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.240023 0.054705 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.295051 0.183404 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.478912 0.055452 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.534761 0.328787 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:07.863987 0.201572 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.065976 0.142255 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.208628 0.182665 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.391723 0.163203 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.555281 0.059882 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.615635 0.037652 udp 10.0.2.105 7010 <-> 91.16.163.44 2194 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.653646 0.133385 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.787386 0.181335 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:08.969097 0.142111 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:09.111559 0.137403 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:16:09.249332 0.000000 udp 10.0.2.105 7010 -> 162.200.204.187 9727 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:16:27.377882 0.029776 tcp 10.0.2.105 55514 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:27.407956 0.070005 tcp 10.0.2.105 55515 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:27.478263 0.155517 tcp 10.0.2.105 55516 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:16:27.634397 0.191105 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:19:51.574093 3.001064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 19:19:58.580937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:20:06.582132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:20:22.585294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:20:54.591053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:26:58.596562 3.001989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:27:05.604474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:27:13.606013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:27:29.609048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:28:01.614972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:29:02.533548 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 19:29:02.533647 0.837319 tcp 10.0.2.105 55517 -> 184.182.240.239 7058 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:34:05.622150 3.000654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:34:12.628650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:34:20.629917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:34:36.633143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:35:08.639022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:41:12.646114 3.000586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:41:19.652401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:41:27.653758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:41:43.657193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:42:15.663170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:46:56.014839 0.005628 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 19:46:56.020510 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:47:12.041573 0.030848 tcp 10.0.2.105 55518 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:12.072766 0.075162 tcp 10.0.2.105 55519 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:12.148392 0.163186 tcp 10.0.2.105 55520 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:12.310810 0.000000 udp 10.0.2.105 7010 -> 162.200.204.187 9727 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:47:30.646620 0.067509 tcp 10.0.2.105 55521 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:30.713981 0.071711 tcp 10.0.2.105 55522 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:30.785544 0.156731 tcp 10.0.2.105 55523 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:30.942904 0.078832 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.022159 0.401360 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.423879 0.037622 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.461905 0.139274 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.601558 0.120845 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.722787 0.157789 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:31.881021 0.143455 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.024834 0.166485 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.191727 0.204500 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.396628 0.143863 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.540877 0.147331 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.688610 0.147473 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.836585 0.132042 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.969023 0.019770 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:32.989170 0.240345 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:33.229984 0.299955 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:33.530347 0.056583 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:33.587298 0.351508 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:33.939204 0.169607 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.109194 0.057090 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.166693 0.151800 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.318911 0.187206 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.506480 0.059283 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.566171 0.154011 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.720728 0.058873 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:34.780014 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:47:52.648445 0.031035 tcp 10.0.2.105 55524 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:52.679946 0.070960 tcp 10.0.2.105 55525 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:52.751173 0.157778 tcp 10.0.2.105 55526 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:47:52.909584 0.138532 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:53.048950 0.176919 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:47:53.226217 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:48:08.260926 0.030120 tcp 10.0.2.105 55527 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:08.291360 0.071242 tcp 10.0.2.105 55528 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:08.362874 0.154304 tcp 10.0.2.105 55529 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:08.517654 0.144760 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:48:08.662866 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 19:48:19.669397 3.001420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 19:48:26.316512 0.030046 tcp 10.0.2.105 55530 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:26.346841 0.070503 tcp 10.0.2.105 55531 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:26.417621 0.151873 tcp 10.0.2.105 55532 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/16 19:48:26.569985 0.189202 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/16 19:48:26.676305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:48:34.677871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:48:50.680885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:49:22.687461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:55:26.693240 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 19:55:33.700453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:55:41.701830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:55:57.704928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:56:29.711252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 19:59:03.372806 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 19:59:03.372991 0.800500 tcp 10.0.2.105 55533 -> 184.182.240.239 7058 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:02:33.718163 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:02:40.724254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:02:48.726181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:03:04.729264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:03:36.734895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:09:40.740988 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:09:47.748332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:09:55.750256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:10:11.753128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:10:43.758668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:16:47.765618 3.000836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:16:54.772469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:17:02.773893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:17:18.776606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:17:50.782988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:18:55.406036 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 20:18:55.406197 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 20:19:12.031963 0.030999 tcp 10.0.2.105 55534 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:12.063270 0.076484 tcp 10.0.2.105 55535 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:12.139605 0.157730 tcp 10.0.2.105 55536 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:12.297559 0.157417 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:12.455359 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 20:19:30.196918 0.029915 tcp 10.0.2.105 55537 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:30.227049 0.076559 tcp 10.0.2.105 55538 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:30.303473 0.163979 tcp 10.0.2.105 55539 -> 195.113.214.236 443 SRPA* 0 0 48 39056 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:30.466433 0.080633 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:30.547496 0.120367 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:30.668229 0.159740 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:30.828398 0.146542 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:30.975274 0.402388 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:31.378086 0.141216 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:31.519728 0.033252 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:31.553391 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 20:19:49.744755 0.029549 tcp 10.0.2.105 55540 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:49.774605 0.071560 tcp 10.0.2.105 55541 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:49.846019 0.155504 tcp 10.0.2.105 55542 -> 195.113.214.236 443 SRPA* 0 0 50 41842 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:19:50.002226 0.137205 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.139835 0.020209 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.160429 0.164542 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.325352 0.148374 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.474155 0.142206 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.616766 0.148616 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:50.765789 0.301021 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:51.067249 0.215483 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:51.283120 0.324225 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:51.607691 0.058513 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:51.666635 0.660166 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.327215 0.152480 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.480059 0.057769 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.538252 0.181374 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.720019 0.151741 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.872152 0.052899 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:52.925461 0.232929 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:53.158734 0.141210 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:53.300394 0.174733 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:53.475512 0.143294 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:19:53.619143 0.190527 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:23:54.789319 3.001179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 20:24:01.796209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:24:09.797632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:24:25.801138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:24:57.807091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:29:04.171923 0.000222 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 20:29:04.172248 0.830161 tcp 10.0.2.105 55543 -> 184.182.240.239 7058 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:31:01.813647 3.000617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:31:08.820010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:31:16.822099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:31:32.824649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:32:04.831146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:38:08.836491 3.002416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:38:15.844424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:38:23.846082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:38:39.848741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:39:11.855046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:45:15.861292 3.001164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:45:22.868200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:45:30.869722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:45:46.872722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:46:18.879201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:50:22.389010 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 20:50:22.389117 0.321391 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:22.710858 0.142900 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:22.854162 0.158878 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.013497 0.077449 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.091335 0.147327 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.239053 0.120897 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.360445 0.141936 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.502842 0.401333 udp 10.0.2.105 7010 <-> 116.89.110.23 6487 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.904580 0.038051 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:23.942996 0.134444 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.077883 0.020147 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.098342 0.166234 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.265001 0.148326 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.413764 0.143509 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.557646 0.147069 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:24.705123 0.303150 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.008642 0.057268 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.066334 0.228885 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.295616 0.325077 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.621096 0.180714 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.802211 0.144824 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:25.947440 0.058985 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.006825 0.183067 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.190249 0.164645 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.355308 0.055765 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.411484 0.179448 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.591326 0.142770 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.734486 0.192135 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.927011 0.058127 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:50:26.985564 0.132559 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/16 20:52:22.885224 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:52:29.891953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:52:37.893767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:52:53.896895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:53:25.902685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:59:05.010584 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 20:59:05.080744 0.945623 tcp 10.0.2.105 55544 -> 184.182.240.239 7058 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/16 20:59:29.909352 3.000931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 20:59:36.915962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 20:59:44.917731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:00:00.920992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:00:32.926639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:06:36.932530 3.001614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:06:43.939999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:06:51.942120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:07:07.944816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:07:39.951353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:13:43.956839 3.001524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:13:50.964164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:13:58.965606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:14:14.968918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:14:46.974698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:20:49.967049 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 21:20:49.967196 0.152320 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.119947 0.079176 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.199556 0.229186 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.443639 0.259722 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.703767 0.145008 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.849197 0.119947 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.969517 0.141416 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:20:50.981244 3.000768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:20:51.111353 0.000000 udp 10.0.2.105 7010 -> 116.89.110.23 6487 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 21:20:57.988011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:21:05.989469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:21:07.914609 0.062070 tcp 10.0.2.105 55545 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:07.977047 0.069303 tcp 10.0.2.105 55546 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:08.046647 0.127878 tcp 10.0.2.105 55547 -> 195.113.214.236 443 SRPA* 0 0 55 52717 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:08.175371 0.032386 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.208127 0.133602 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.342173 0.020062 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.362618 0.162319 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.525287 0.145675 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.671385 0.143260 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:08.814996 0.229710 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.045105 0.297058 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.342505 0.056906 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.399842 0.161546 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.561758 0.147607 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.709854 0.057704 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:09.767978 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 21:21:21.992299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:21:27.952779 0.061716 tcp 10.0.2.105 55548 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:28.014802 0.070164 tcp 10.0.2.105 55549 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:28.085256 0.146219 tcp 10.0.2.105 55550 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:21:28.232035 0.331065 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:28.563523 0.178048 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:28.742018 0.145128 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:28.887574 0.056467 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:28.944465 0.177232 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:29.122134 0.143406 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:29.265908 0.155622 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:29.421948 0.058696 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:29.481115 0.137698 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:21:53.998724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:27:58.004817 3.001435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:28:05.012128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:28:13.013926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:28:29.016718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:29:01.022891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:29:06.030556 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 21:29:06.030826 0.882429 tcp 10.0.2.105 55551 -> 184.182.240.239 7058 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:35:05.029504 3.000440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:35:12.035912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:35:20.037207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:35:36.040441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:36:08.046537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:42:12.052869 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:42:19.059665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:42:27.061520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:42:43.064402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:43:15.070327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:49:19.077556 3.000342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:49:26.084251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:49:34.085570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:49:50.088256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:50:22.094835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:51:53.265838 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 21:51:53.266073 0.000000 udp 10.0.2.105 7010 -> 116.89.110.23 6487 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 21:52:10.953528 0.061457 tcp 10.0.2.105 55552 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:52:11.015270 0.068494 tcp 10.0.2.105 55553 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:52:11.084119 0.167835 tcp 10.0.2.105 55554 -> 195.113.214.236 443 SRPA* 0 0 55 52653 flow=From-Botnet-V2-TCP-Established 1970/01/16 21:52:11.252672 0.262471 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:11.515489 0.153741 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:11.669720 0.148516 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:11.818581 0.120323 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:11.939320 0.143541 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.083269 0.225772 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.309551 0.081582 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.391541 0.140583 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.532627 0.134583 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.667608 0.031846 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.699853 0.164355 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:12.864620 0.219971 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.084998 0.145001 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.230419 0.151687 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.382457 0.020029 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.402904 0.147089 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.550403 0.058026 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.608857 0.058205 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.667450 0.303777 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:13.971652 0.141980 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:14.114017 0.329752 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:14.444193 0.187865 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:14.632622 0.151612 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:14.784642 0.125228 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:14.910290 0.179711 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:15.090402 0.170854 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:15.261682 0.135181 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:15.397385 0.146970 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:52:15.544775 0.155853 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/16 21:56:26.101473 3.000518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 21:56:33.108185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:56:41.109568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:56:57.112750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:57:29.118459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 21:59:06.919513 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 21:59:06.919617 0.928912 tcp 10.0.2.105 55555 -> 184.182.240.239 7058 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:03:33.124871 3.001064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:03:40.131746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:03:48.133611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:04:04.136079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:04:36.142144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:10:40.149124 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:10:47.155599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:10:55.157598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:11:11.160154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:11:43.166141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:17:47.173432 3.020668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:17:54.199933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:18:02.201266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:18:18.204045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:18:50.210168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:22:45.659036 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 22:22:45.659135 0.147555 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:45.807116 0.120259 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:45.927734 0.144398 udp 10.0.2.105 7010 <-> 70.26.66.165 7629 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.072651 0.274940 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.348003 0.155391 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.503769 0.207935 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.712145 0.072390 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.784944 0.146121 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:46.931417 0.132539 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.064396 0.038501 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.103239 0.229370 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.332962 0.183366 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.516741 0.147430 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.664596 0.148531 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.813529 0.020069 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.833964 0.123990 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:47.958421 0.058390 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:48.017166 0.061617 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:48.079189 0.298393 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:48.377992 0.140921 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:48.519317 0.327882 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:48.847551 0.185795 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.033770 0.144600 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.178767 0.058078 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.237277 0.177733 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.415452 0.143855 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.559651 0.157809 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.729140 0.058491 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:22:49.788066 0.137592 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:24:54.216706 3.001308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:25:01.223850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:25:09.225317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:25:25.228507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:25:57.234162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:29:07.848689 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 22:29:07.848788 3.840514 tcp 10.0.2.105 55556 -> 184.182.240.239 7058 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:32:01.241500 3.000907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:32:08.247448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:32:16.249344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:32:32.252445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:33:04.258170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:39:08.264666 3.001474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:39:15.271453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:39:23.273481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:39:39.276569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:40:11.282060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:46:15.289142 3.000977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:46:22.295927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:46:30.297439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:46:46.300121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:47:18.306398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:53:04.564683 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 22:53:04.564830 0.000000 udp 10.0.2.105 7010 -> 70.26.66.165 7629 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 22:53:21.159700 0.072653 tcp 10.0.2.105 55557 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:21.232733 0.074646 tcp 10.0.2.105 55558 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:21.307673 0.152881 tcp 10.0.2.105 55559 -> 195.113.214.236 443 SRPA* 0 0 63 40961 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:21.461148 0.145168 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:21.606747 0.120749 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:21.727984 0.272543 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:22.000957 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 22:53:22.312781 3.001358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 22:53:29.319848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:53:37.320849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:53:37.422478 0.060039 tcp 10.0.2.105 55560 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:37.482868 0.073519 tcp 10.0.2.105 55561 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:37.556746 0.177253 tcp 10.0.2.105 55562 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/16 22:53:37.734475 0.383836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.118752 0.076984 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.196124 0.144064 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.340643 0.131054 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.472042 0.031783 udp 10.0.2.105 7010 <-> 78.134.76.143 5837 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.504210 0.167528 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.672146 0.148796 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.821355 0.140560 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:38.962245 0.147654 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.110316 0.020226 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.130942 0.146371 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.277703 0.058424 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.336549 0.056359 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.393249 0.419642 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.813269 0.176679 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:39.990331 0.297198 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.287939 0.137835 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.426222 0.144927 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.571585 0.054489 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.626428 0.179746 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.806599 0.143443 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:40.950424 0.151139 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:41.101971 0.426120 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:41.528507 0.137331 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/16 22:53:53.324083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:54:25.330539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 22:59:11.692551 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 22:59:11.692655 3.354030 tcp 10.0.2.105 55563 -> 184.182.240.239 7058 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:00:29.336107 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:00:36.343632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:00:44.345509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:01:00.347880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:01:32.354140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:07:36.360319 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:07:43.367358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:07:51.369360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:08:07.372357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:08:39.378030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:14:43.384466 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:14:50.391944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:14:58.393022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:15:14.396026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:15:46.402104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:21:50.408431 3.001159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:21:57.415278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:22:05.417279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:22:21.420174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:22:53.425857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:23:49.477185 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 23:23:49.477372 0.000000 udp 10.0.2.105 7010 -> 70.26.66.165 7629 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 23:24:06.463097 0.062449 tcp 10.0.2.105 55564 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:06.525837 0.071690 tcp 10.0.2.105 55565 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:06.597811 0.168077 tcp 10.0.2.105 55566 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:06.766779 0.156549 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:06.923732 0.126302 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.050473 0.149215 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.200356 0.280091 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.480848 0.226093 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.707348 0.086041 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.793817 0.146809 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:07.940995 0.134113 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:08.075489 0.000000 udp 10.0.2.105 7010 -> 78.134.76.143 5837 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 23:24:26.570849 0.060090 tcp 10.0.2.105 55567 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:26.631222 0.071968 tcp 10.0.2.105 55568 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:26.703487 0.177250 tcp 10.0.2.105 55569 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:24:26.881202 0.164842 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.046471 0.153755 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.200702 0.140858 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.341922 0.396008 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.738319 0.020105 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.758807 0.056989 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:27.816173 0.756277 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:28.572857 0.182329 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:28.755637 0.155571 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:28.911579 0.066790 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:28.978779 0.304086 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.283270 0.142908 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.426580 0.152182 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.579187 0.055982 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.635485 0.179172 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.815046 0.144367 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:29.959761 0.154338 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:30.114496 0.134914 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:24:30.249819 0.135360 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:28:57.432868 3.000792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/16 23:29:04.439769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:29:12.440986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:29:15.055222 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 23:29:15.055355 0.881353 tcp 10.0.2.105 55570 -> 184.182.240.239 7058 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:29:28.444347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:30:00.449845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:36:04.456501 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:36:11.463756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:36:19.464842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:36:35.468100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:37:07.473803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:43:11.480698 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:43:18.487659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:43:26.489040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:43:42.491858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:44:14.497786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:50:18.504238 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:50:25.511472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:50:33.553227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:50:49.556093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:51:21.562180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:54:47.769061 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 23:54:47.769158 0.043484 udp 10.0.2.105 7010 -> 78.134.76.143 5837 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/16 23:54:47.812642 0.000000 icmp 78.134.76.143 0x0303 -> 10.0.2.105 0xcd16 URP 192 1 182 flow=Background 1970/01/16 23:55:05.846317 0.062304 tcp 10.0.2.105 55571 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:55:05.908883 0.068407 tcp 10.0.2.105 55572 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:55:05.977633 0.182013 tcp 10.0.2.105 55573 -> 195.113.214.236 443 SRPA* 0 0 67 69800 flow=From-Botnet-V2-TCP-Established 1970/01/16 23:55:06.160504 0.162509 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.323512 0.120677 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.444608 0.145960 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.590961 0.077456 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.668848 0.145007 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.814251 0.136826 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:06.951481 0.225174 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:07.177050 0.221868 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:07.399352 0.165497 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:07.565260 0.145722 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:07.711379 0.141018 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:07.852806 0.194089 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.047237 0.020134 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.067666 0.058606 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.126626 0.139449 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.266483 0.057945 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.324782 0.357959 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.683099 0.175957 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:08.859384 0.285523 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.145246 0.213161 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.358806 0.151928 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.511147 0.055700 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.567242 0.179649 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.747239 0.143684 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:09.891305 0.156859 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:10.048671 0.085071 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:55:10.134165 0.137454 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/16 23:57:25.567815 3.072118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/16 23:57:32.645462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:57:40.647241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:57:56.650004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:58:28.655765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/16 23:59:15.984335 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/16 23:59:15.984444 3.565292 tcp 10.0.2.105 55574 -> 184.182.240.239 7058 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/17 00:04:32.661717 3.002315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:04:39.669767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:04:47.670969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:05:03.673666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:05:35.679878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:11:39.686510 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:11:46.693751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:11:54.694836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:12:10.697843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:12:42.703693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:18:46.710241 3.031450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:18:53.847353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:19:01.849341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:19:17.852266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:19:49.858298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:25:11.881202 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 00:25:11.881428 0.147695 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.029547 0.077334 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.107291 0.209276 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.316986 0.132868 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.450266 0.156643 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.607341 0.120052 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.727812 0.214483 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:12.942768 0.207212 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.150388 0.169346 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.320118 0.148651 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.469276 0.146111 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.615738 0.150968 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.767109 0.020600 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.788077 0.057263 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:13.845759 0.329781 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:14.175929 0.176512 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:14.352817 0.299491 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:14.652716 0.148844 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:14.802011 0.056748 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:14.859135 0.216290 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.075754 0.151938 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.228090 0.053154 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.281640 0.179496 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.461499 0.145550 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.607431 0.152421 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:15.760433 0.263676 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:16.024683 0.132539 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:25:53.884380 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:26:00.891862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:26:08.893078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:26:24.895811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:26:56.901849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:29:19.617803 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 00:29:19.617906 0.891636 tcp 10.0.2.105 55575 -> 184.182.240.239 7058 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/01/17 00:33:00.908850 3.000737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:33:07.915536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:33:15.917219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:33:31.920052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:34:03.926034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:40:07.932072 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:40:14.939399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:40:22.941022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:40:38.943885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:41:10.950397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:47:14.956608 3.001558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:47:21.963803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:47:29.964785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:47:45.968026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:48:17.974039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:54:21.990056 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 00:54:28.997957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:54:36.999267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:54:53.001925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:55:25.008083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 00:55:27.101778 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 00:55:27.102020 0.148580 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:27.251021 0.080934 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:27.332345 0.156507 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:27.489273 0.121325 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:27.611016 0.220667 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:27.832090 0.284121 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:28.116656 0.145560 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:28.262634 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 00:55:44.096969 0.062162 tcp 10.0.2.105 55576 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 00:55:44.159484 0.069645 tcp 10.0.2.105 55577 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 00:55:44.229446 0.163318 tcp 10.0.2.105 55578 -> 195.113.214.236 443 SRPA* 0 0 61 55935 flow=From-Botnet-V2-TCP-Established 1970/01/17 00:55:44.393376 0.164989 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:44.558798 0.143469 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:44.702903 0.142164 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:44.845443 0.143295 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:44.989163 0.019900 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:45.009399 0.055880 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:45.065726 0.422823 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:45.488937 0.144449 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:45.633824 0.056860 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:45.691085 0.688206 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:46.379634 0.151859 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:46.531917 0.189130 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:46.721446 0.305707 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.027548 0.096867 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.124830 0.175313 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.300524 0.142762 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.443635 0.152150 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.596185 0.259198 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:55:47.855801 0.133112 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/17 00:59:20.527383 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 00:59:20.527480 0.868813 tcp 10.0.2.105 55579 -> 184.182.240.239 7058 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:01:29.024045 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 01:01:36.031661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:01:44.032888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:02:00.036095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:02:32.041687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:08:36.048853 3.000825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:08:43.055662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:08:51.057517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:09:07.061194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:09:39.066264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:15:43.072730 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:15:50.079187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:15:58.080711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:16:14.084163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:16:46.090062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:22:50.096910 3.060532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:22:57.163199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:23:05.165099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:23:21.167776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:23:53.173866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:26:15.979588 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 01:26:15.979691 0.131528 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:16.111620 0.146768 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:16.258770 0.336089 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:16.595226 0.205600 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:16.801246 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 01:26:34.417973 0.075394 tcp 10.0.2.105 55580 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:26:34.493722 0.070684 tcp 10.0.2.105 55581 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:26:34.564669 0.165886 tcp 10.0.2.105 55582 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:26:34.731209 0.082115 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:34.813680 0.120425 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:34.934495 0.255028 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.189959 0.163744 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.354048 0.146816 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.501276 0.145490 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.647475 0.140715 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.788722 0.019968 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.808994 0.059233 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.868586 0.080801 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:35.949816 0.358172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:36.308512 0.141902 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:36.450797 0.686283 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.137501 0.144816 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.282632 0.183748 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.466815 0.288034 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.755245 0.054129 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.809729 0.160166 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:37.970350 0.720552 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:38.691321 0.133507 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:38.825243 0.179101 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:26:39.004756 0.147666 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:29:21.415881 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 01:29:21.415969 0.778874 tcp 10.0.2.105 55583 -> 184.182.240.239 7058 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:29:57.180432 3.001406 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 01:30:04.187425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:30:12.189182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:30:28.192037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:31:00.197800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:37:04.204663 3.001100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:37:11.211711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:37:19.212923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:37:35.216062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:38:07.222141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:44:11.228846 3.000670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:44:18.235422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:44:26.236817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:44:42.239911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:45:14.245734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:51:18.251776 3.031904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:51:25.289442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:51:33.290844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:51:49.293987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:52:21.299872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:56:46.852634 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 01:56:46.852777 0.156582 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:47.107414 0.136833 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:47.244693 0.147968 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:47.393118 0.264527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:47.658059 0.217741 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:47.876180 0.141927 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.018538 0.082526 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.101460 0.120765 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.222613 0.165433 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.388605 0.143390 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.532586 0.143167 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.676105 0.147871 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.824446 0.020154 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.844937 0.120495 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:48.965835 0.059660 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:49.025898 0.815726 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:49.842022 0.369003 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:50.211428 0.139655 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:50.351454 0.144692 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:50.496559 0.177057 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:50.673973 0.302718 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:50.977104 0.053156 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:51.030687 0.161885 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:51.192984 0.180482 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:51.373835 0.145210 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:51.519400 0.059312 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:56:51.579117 0.132906 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 01:58:25.305564 3.001950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 01:58:32.313431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:58:40.314735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:58:56.317844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 01:59:22.195623 0.000203 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 01:59:22.195931 1.093122 tcp 10.0.2.105 55584 -> 184.182.240.239 7058 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/01/17 01:59:28.324398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:05:32.330681 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:05:39.337271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:05:47.338627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:06:03.342098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:06:35.347707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:12:39.354427 3.001397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:12:46.361305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:12:54.362974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:13:10.365969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:13:42.371478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:19:46.377692 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:19:53.385497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:20:01.387003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:20:17.389478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:20:49.396018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:26:53.401653 3.001966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:27:00.409339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:27:08.410762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:27:21.640577 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 02:27:21.640722 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 02:27:24.414007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:27:39.267459 0.080858 tcp 10.0.2.105 55585 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 02:27:39.348675 0.070928 tcp 10.0.2.105 55586 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 02:27:39.419895 0.156741 tcp 10.0.2.105 55587 -> 195.113.214.236 443 SRPA* 0 0 59 37825 flow=From-Botnet-V2-TCP-Established 1970/01/17 02:27:39.577239 0.137450 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:39.715138 0.235861 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:39.951445 0.141732 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:40.093559 0.083737 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:40.177624 0.119915 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:40.297951 0.144494 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:40.442869 0.216785 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:40.660068 0.450518 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.111009 0.146389 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.257861 0.144223 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.402435 0.146003 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.548857 0.020090 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.569335 0.058358 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.628127 0.059155 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.687682 0.296448 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:41.984581 0.329666 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:42.314645 0.139721 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:42.454740 0.144877 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:42.600007 0.182343 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:42.782726 0.302665 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.085761 0.055385 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.141519 0.158129 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.300036 0.064784 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.365227 0.138164 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.503938 0.180987 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:43.685305 0.144733 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:27:56.419588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:29:23.294704 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 02:29:23.294950 0.868082 tcp 10.0.2.105 55588 -> 184.182.240.239 7058 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/17 02:34:00.426420 3.001018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:34:07.433281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:34:15.434312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:34:31.437613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:35:03.443954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:41:07.450201 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:41:14.456866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:41:22.458877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:41:38.461447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:42:10.467315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:48:14.473868 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:48:21.481348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:48:29.482319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:48:45.485786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:49:17.491545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:55:21.498549 3.000780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 02:55:28.505389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:55:36.506481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:55:52.509729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:56:24.515630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 02:57:49.137384 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 02:57:49.137487 0.156580 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.294430 0.141956 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.436792 0.094755 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.531971 0.136574 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.668996 0.189358 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.858795 0.120505 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:49.979697 0.147342 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:50.127392 0.213533 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:50.341281 0.164230 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:50.505920 0.287606 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:50.793959 0.139519 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:50.933842 0.151580 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.085832 0.020230 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.106496 0.055857 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.162732 0.058110 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.221265 0.138052 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.359696 0.355328 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.715384 0.140017 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:51.855776 0.151840 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.008033 0.186032 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.194475 0.295100 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.489974 0.055342 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.545730 0.134112 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.680190 0.178827 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:52.859438 0.142107 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:53.089117 0.158214 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:57:53.247757 0.064621 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 02:59:24.164461 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 02:59:24.164696 0.846487 tcp 10.0.2.105 55589 -> 184.182.240.239 7058 FSPA* 0 0 14 1555 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:02:28.521779 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 03:02:35.528995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:02:43.530324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:02:59.533609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:03:31.539517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:09:35.546262 3.000617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:09:42.552950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:09:50.554135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:10:06.557368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:10:38.563214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:16:42.569803 3.001420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:16:49.577069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:16:57.578649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:17:13.581559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:17:45.587234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:23:49.594013 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:23:56.600731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:24:04.602086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:24:20.605589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:24:52.611655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:27:58.248613 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 03:27:58.248691 0.073883 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:58.322987 0.131538 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:58.454919 0.270965 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:58.726307 0.122210 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:58.848896 0.149463 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:58.998698 0.157477 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.156619 0.145060 udp 10.0.2.105 7010 <-> 70.61.48.21 7859 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.302033 0.222828 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.525212 0.165632 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.691236 0.145385 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.837104 0.145173 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:27:59.982628 0.144331 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.127380 0.020057 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.147815 0.057374 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.205521 0.058548 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.264467 0.146363 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.411228 0.144877 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.556630 0.183903 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.740953 0.136560 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:00.877912 0.369634 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:01.247881 0.297548 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:01.545793 0.058137 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:01.604355 0.138011 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:01.742779 0.174543 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:01.917711 0.144131 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:02.062238 0.157438 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:28:02.220111 0.059954 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:29:25.013442 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 03:29:25.013555 0.821940 tcp 10.0.2.105 55590 -> 184.182.240.239 7058 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:30:56.617281 3.002060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 03:31:03.624919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:31:11.626282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:31:27.629753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:31:59.635629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:38:03.642276 3.000474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:38:10.649134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:38:18.650308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:38:34.653546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:39:06.659463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:45:10.665644 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:45:17.672784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:45:25.684457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:45:41.687246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:46:13.693652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:52:17.699764 3.000925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 03:52:24.706586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:52:32.708228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:52:48.711210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:53:20.717760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:58:30.062755 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 03:58:30.062863 0.183646 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:58:30.246929 0.121350 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:58:30.368758 0.146351 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:58:30.515551 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 03:58:45.636234 0.060863 tcp 10.0.2.105 55591 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:58:45.697346 0.069054 tcp 10.0.2.105 55592 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:58:45.766338 0.172796 tcp 10.0.2.105 55593 -> 195.113.214.236 443 SRPA* 0 0 62 47937 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:58:45.939832 0.118319 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:58:46.058557 0.134247 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:58:46.193323 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 03:59:04.862399 0.060992 tcp 10.0.2.105 55594 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:59:04.923700 0.075879 tcp 10.0.2.105 55595 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:59:04.999905 0.174989 tcp 10.0.2.105 55596 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:59:05.175379 0.221679 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:05.397406 0.168141 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:05.565988 0.149041 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:05.715443 0.139028 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:05.854852 0.142320 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:05.997541 0.020261 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.018073 0.057115 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.075565 0.058161 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.134163 0.185475 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.320064 0.143172 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.463624 0.440535 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:06.904703 0.158845 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.063986 0.144796 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.209131 0.296661 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.506243 0.052509 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.559163 0.140135 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.699633 0.178638 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:07.878696 0.144138 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:08.023263 0.151613 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:08.175282 0.064474 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/17 03:59:24.723306 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 03:59:25.843017 0.882057 tcp 10.0.2.105 55597 -> 184.182.240.239 7058 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/01/17 03:59:31.730534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:59:39.732048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 03:59:55.735091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:00:27.741416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:06:31.747010 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:06:38.754766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:06:46.755879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:07:02.759261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:07:34.765154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:13:38.771175 3.002068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:13:45.778332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:13:53.779850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:14:09.783531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:14:41.789064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:20:45.794971 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:20:52.802732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:21:00.804253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:21:16.807398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:21:48.813274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:27:52.819189 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:27:59.826697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:28:07.847969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:28:23.850806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:28:55.856935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:29:26.732242 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 04:29:26.732492 0.880853 tcp 10.0.2.105 55598 -> 184.182.240.239 7058 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:29:35.144048 0.156591 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:35.301013 0.000000 udp 10.0.2.105 7010 -> 70.61.48.21 7859 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 04:29:50.818175 0.064098 tcp 10.0.2.105 55599 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:29:50.882563 0.068723 tcp 10.0.2.105 55600 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:29:50.951581 0.172050 tcp 10.0.2.105 55601 -> 195.113.214.236 443 SRPA* 0 0 42 22848 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:29:51.124364 0.251752 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:51.376698 0.121832 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:51.498918 0.147957 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:51.647326 0.078241 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:51.726000 0.133471 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:51.859822 0.222398 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:52.082616 0.161707 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:52.244742 0.147933 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:29:52.409095 0.000000 udp 10.0.2.105 7010 -> 70.53.181.18 9504 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 04:30:10.054884 0.064228 tcp 10.0.2.105 55602 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:30:10.119366 0.070594 tcp 10.0.2.105 55603 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:30:10.190290 0.179018 tcp 10.0.2.105 55604 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/17 04:30:10.368651 0.141753 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:10.510812 0.020326 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:10.531643 0.058053 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:10.590097 0.057177 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:10.647620 0.329523 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:10.977542 0.140530 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.118481 0.144740 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.263569 0.180657 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.444642 0.138046 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.583102 0.296818 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.880363 0.057789 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:11.938502 0.139984 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:12.078869 0.180894 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:12.260167 0.144723 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:12.405292 0.159126 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:30:12.564820 0.225797 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 04:34:59.864061 3.000943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 04:35:06.870257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:35:14.872620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:35:30.874976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:36:02.880895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:42:06.887004 3.001957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:42:13.894233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:42:21.895931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:42:37.899476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:43:09.905491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:49:13.910599 3.002137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:49:20.918183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:49:28.920011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:49:44.923317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:50:16.929242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:56:20.935584 3.001182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 04:56:27.942724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:56:35.943834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:56:51.946741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:57:23.953166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 04:59:27.621163 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 04:59:27.621379 0.868004 tcp 10.0.2.105 55605 -> 184.182.240.239 7058 FSPA* 0 0 12 1596 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:00:34.407458 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 05:00:34.407538 0.144241 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:34.552373 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 05:00:52.985298 0.070090 tcp 10.0.2.105 55606 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:00:53.055675 0.070381 tcp 10.0.2.105 55607 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:00:53.126480 0.167616 tcp 10.0.2.105 55608 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:00:53.294306 0.147413 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:53.442121 0.078238 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:53.520774 0.209903 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:53.731368 0.283412 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:54.015209 0.167236 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:00:54.182819 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 05:01:10.469356 0.061400 tcp 10.0.2.105 55609 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:01:10.531100 0.071746 tcp 10.0.2.105 55610 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:01:10.603155 0.228745 tcp 10.0.2.105 55611 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:01:10.831812 0.137160 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:10.969349 0.141132 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:11.110934 0.416266 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:11.527550 0.020025 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:11.547936 0.057647 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:11.605983 0.058035 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:11.664432 0.414182 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:12.078993 0.151794 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:12.231193 0.145233 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:12.376836 0.183768 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:12.561022 0.214766 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:12.776177 0.300297 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.076949 0.052991 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.130382 0.314535 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.445320 0.181744 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.627450 0.064241 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.692180 0.143611 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:01:13.836183 0.226669 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:03:27.968702 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 05:03:34.976803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:03:42.977635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:03:58.980827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:04:30.986901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:10:34.993295 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:10:42.000785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:10:50.002091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:11:06.004924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:11:38.011203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:17:42.017446 3.021154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:17:49.044126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:17:57.045810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:18:13.048832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:18:45.054748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:24:49.061112 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:24:56.078950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:25:04.081178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:25:20.083524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:25:52.088843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:29:28.490654 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 05:29:28.490761 0.907874 tcp 10.0.2.105 55612 -> 184.182.240.239 7058 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:31:31.747710 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 05:31:31.747930 0.231661 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:31.979969 0.210389 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:32.190706 0.140416 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:32.331526 0.266271 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:32.598218 0.266585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:32.865216 0.166638 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.032307 0.069382 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.102063 0.146999 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.249410 0.120940 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.370732 0.147275 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.518380 0.195217 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.713997 0.020120 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.734374 0.070451 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.805196 0.066749 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:33.872387 0.469150 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:34.341934 0.151557 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:34.493899 0.229862 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:34.724097 0.296719 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:35.021216 0.056078 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:35.077738 0.144587 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:35.222702 0.187159 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:35.410242 0.000000 udp 10.0.2.105 7010 -> 64.105.149.138 5704 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 05:31:52.188500 0.061826 tcp 10.0.2.105 55613 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:31:52.250637 0.069363 tcp 10.0.2.105 55614 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:31:52.320308 0.174108 tcp 10.0.2.105 55615 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/17 05:31:52.494978 0.181652 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:52.677119 0.059955 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:52.737510 0.147072 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:52.884949 0.249869 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/17 05:31:56.095586 3.001323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 05:32:03.102359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:32:11.103855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:32:27.106577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:32:59.112852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:39:03.119462 3.000929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:39:10.126622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:39:18.127834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:39:34.130933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:40:06.137249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:46:10.143339 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:46:17.150509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:46:25.151579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:46:41.154997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:47:13.160622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:53:17.166748 3.011558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 05:53:24.183988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:53:32.185961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:53:48.189021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:54:20.194819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 05:59:29.399973 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 05:59:29.400120 1.154992 tcp 10.0.2.105 55616 -> 184.182.240.239 7058 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:00:24.200571 3.002174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:00:31.208410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:00:39.210002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:00:55.212695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:01:27.218802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:02:18.672907 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 06:02:18.673052 0.186245 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:18.859722 0.251536 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:19.111666 0.230809 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:19.342902 0.275862 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:19.619187 0.270181 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:19.889776 0.168599 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.058782 0.113276 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.172488 0.430951 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.603863 0.146842 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.751148 0.194386 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.945996 0.020046 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:20.966411 0.058652 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.025435 0.058576 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.084424 0.166764 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.251573 0.119776 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.371752 0.229914 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.602094 0.299392 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.901888 0.066778 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:21.969096 0.137885 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:22.107381 0.438364 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:22.546164 0.148394 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:22.694983 0.177457 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:22.872844 0.136121 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:23.009394 0.245078 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:23.254881 0.181568 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:02:23.436928 0.059734 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:07:31.224862 3.001760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:07:38.232022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:07:46.233963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:08:02.236941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:08:34.242876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:14:38.248434 3.002146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:14:45.256582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:14:53.257512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:15:09.260658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:15:41.266705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:21:45.272755 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:21:52.279965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:22:00.281430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:22:16.284358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:22:48.290531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:28:52.297516 3.001096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:28:59.303775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:29:07.305488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:29:23.308422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:29:30.559571 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 06:29:30.559812 3.003526 tcp 10.0.2.105 55617 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 06:29:39.561814 0.000000 tcp 10.0.2.105 55617 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 06:29:45.562323 0.122325 tcp 10.0.2.105 55618 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:29:45.684961 0.069979 tcp 10.0.2.105 55619 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:29:45.755256 0.333275 tcp 10.0.2.105 55620 -> 195.113.214.236 443 SRPA* 0 0 78 75967 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:29:46.190383 0.590680 tcp 10.0.2.105 55621 -> 95.104.50.9 3421 FSPA* 0 0 15 1638 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:29:55.324541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:30:01.748960 0.000139 tcp 10.0.2.105 55617 -> 184.182.240.239 7058 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:32:42.796088 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 06:32:42.796363 0.145206 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:42.941978 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 06:32:57.958708 0.062849 tcp 10.0.2.105 55622 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:32:58.021837 0.071439 tcp 10.0.2.105 55623 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:32:58.093565 0.170535 tcp 10.0.2.105 55624 -> 195.113.214.236 443 SRPA* 0 0 34 24336 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:32:58.264933 0.229975 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:58.495319 0.226248 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 589 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:58.722002 0.088572 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:58.811005 0.153610 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:58.965089 0.298591 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:59.264106 0.141411 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:59.405912 0.148209 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:59.554474 0.377107 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:59.932017 0.020177 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:32:59.952512 0.072533 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:00.025468 0.056560 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:00.082466 0.357275 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:00.440089 0.292763 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:00.733270 0.886047 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:01.619710 0.144750 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:01.764865 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 06:33:19.028414 0.060838 tcp 10.0.2.105 55625 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:33:19.089620 0.067102 tcp 10.0.2.105 55626 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:33:19.157103 0.172879 tcp 10.0.2.105 55627 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/17 06:33:19.330640 0.162496 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:19.493576 0.349421 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:19.843422 0.149478 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:19.993237 0.176185 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:20.169888 0.144191 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:20.314476 0.178366 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:20.493179 0.180420 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:33:20.674081 0.064029 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/17 06:35:59.331038 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 06:36:06.337942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:36:14.339722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:36:30.342758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:37:02.348310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:43:06.355163 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:43:13.361947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:43:21.363372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:43:37.366281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:44:09.372956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:50:13.378902 3.091720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:50:20.476160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:50:28.478007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:50:44.480855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:51:16.487148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:57:20.492645 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 06:57:27.500076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:57:35.501347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:57:51.504353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:58:23.510616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 06:59:46.820997 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 06:59:46.821093 0.496445 tcp 10.0.2.105 55628 -> 95.104.50.9 3421 FSPA* 0 0 15 1554 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:03:29.771605 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 07:03:29.771720 0.179902 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:03:29.952060 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 07:03:47.198551 0.179965 tcp 10.0.2.105 55629 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:03:47.378816 0.070731 tcp 10.0.2.105 55630 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:03:47.449842 0.188578 tcp 10.0.2.105 55631 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:03:47.638649 0.149195 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:03:47.788195 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 07:04:04.551176 0.057217 tcp 10.0.2.105 55632 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:04:04.608688 0.070014 tcp 10.0.2.105 55633 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:04:04.678940 0.192898 tcp 10.0.2.105 55634 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:04:04.872463 0.251085 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:05.124047 0.278784 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:05.403165 0.162660 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:05.566175 0.585928 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.152546 0.147839 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.300763 0.154470 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.455639 0.020237 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.476231 0.055912 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.532702 0.057823 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.590872 0.146866 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.738154 0.143516 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:06.882021 0.288092 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:07.170514 0.151655 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:07.322624 0.874305 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:08.197334 0.162787 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:08.360554 0.350086 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:08.711016 0.156744 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:08.868122 0.186004 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:09.054482 0.179624 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:09.234463 0.074542 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:09.309390 0.143178 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:09.452946 0.180635 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:04:27.516390 3.002159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 07:04:34.524081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:04:42.525734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:04:58.528784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:05:30.534957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:11:34.541001 3.011703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:11:41.558066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:11:49.559341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:12:05.562718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:12:37.568320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:18:41.575291 3.000653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:18:48.582299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:18:56.583783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:19:12.586943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:19:44.592518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:25:48.598813 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:25:55.605669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:26:03.607698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:26:19.610526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:26:51.616400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:29:47.319890 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 07:29:47.319997 0.469374 tcp 10.0.2.105 55635 -> 95.104.50.9 3421 FSPA* 0 0 15 1602 flow=From-Botnet-V2-TCP-Established 1970/01/17 07:32:55.622581 3.002136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:33:02.629809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:33:10.631238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:33:26.634349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:33:58.640341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:34:25.859904 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 07:34:25.860016 0.153243 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:26.013615 0.178573 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:26.192630 0.142606 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:26.335638 0.306920 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:26.642982 0.576848 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.220416 0.138818 udp 10.0.2.105 7010 <-> 70.53.181.18 9504 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.359643 0.266119 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.626156 0.168583 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.795136 0.158064 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.953580 0.020077 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:27.974045 0.056513 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.030887 0.055959 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.087235 0.146665 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.234276 0.146534 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.381180 0.289831 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.671444 0.144929 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:28.816776 0.814918 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:29.632124 0.168648 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:29.801149 0.357663 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.159147 0.146947 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.306489 0.188262 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.495115 0.179911 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.675394 0.075687 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.751427 0.139448 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:34:30.891251 0.179287 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/17 07:40:02.647110 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:40:09.653747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:40:17.655646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:40:33.658112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:41:05.664376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:47:09.670450 3.001558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:47:16.677921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:47:24.679327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:47:40.682542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:48:12.688382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:54:16.695027 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 07:54:23.701845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:54:31.703013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:54:47.726573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:55:19.732779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 07:59:47.798551 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 07:59:47.798710 0.890287 tcp 10.0.2.105 55636 -> 95.104.50.9 3421 FSPA* 0 0 15 1630 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:01:23.738524 3.001361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:01:30.746078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:01:38.747503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:01:54.750305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:02:26.756586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:04:56.502040 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:04:56.502215 0.152931 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:04:56.655528 0.176445 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:04:56.832422 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:05:12.166216 0.053292 tcp 10.0.2.105 55637 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:12.219820 0.072098 tcp 10.0.2.105 55638 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:12.292341 0.151323 tcp 10.0.2.105 55639 -> 195.113.214.236 443 SRPA* 0 0 37 27275 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:12.444261 0.147304 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:12.591992 0.248927 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:12.841374 0.000000 udp 10.0.2.105 7010 -> 70.53.181.18 9504 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:05:29.589648 0.054094 tcp 10.0.2.105 55640 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:29.644028 0.117505 tcp 10.0.2.105 55641 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:29.761824 0.171364 tcp 10.0.2.105 55642 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:29.934007 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:05:47.756167 0.052814 tcp 10.0.2.105 55643 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:47.808819 0.066407 tcp 10.0.2.105 55644 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:47.875555 0.180943 tcp 10.0.2.105 55645 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:05:48.056802 0.165538 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.222737 0.169224 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.392394 0.020200 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.412874 0.059708 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.472945 0.057469 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.530871 0.146849 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.678096 0.144755 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.823258 0.147444 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:48.971052 0.314549 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:49.286127 0.854527 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.141041 0.163931 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.305435 0.336436 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.642288 0.145279 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.787957 0.059531 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.847844 0.144602 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:50.992832 0.192863 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:51.186056 0.176529 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:05:51.362949 0.180109 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:08:30.763165 3.000626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 08:08:37.769848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:08:45.771158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:09:01.774052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:09:33.780165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:15:37.786837 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:15:44.793985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:15:52.795440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:16:08.798194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:16:40.804130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:22:44.810936 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:22:51.817595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:22:59.819364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:23:15.822164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:23:47.827977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:29:48.698096 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:29:48.698432 1.105079 tcp 10.0.2.105 55646 -> 95.104.50.9 3421 FSPA* 0 0 15 1683 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:29:51.834549 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:29:58.841502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:30:06.843350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:30:22.845957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:30:54.852308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:36:06.440349 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:36:06.440511 0.095609 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:06.536537 0.000000 udp 10.0.2.105 7010 -> 70.53.181.18 9504 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:23.516309 0.052974 tcp 10.0.2.105 55647 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:36:23.569540 0.080587 tcp 10.0.2.105 55648 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:36:23.650416 0.178525 tcp 10.0.2.105 55649 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/17 08:36:23.829216 4.506892 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1183 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:24.150560 3.856442 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 4 1175 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:24.303899 4.204839 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1305 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:24.483382 4.178306 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 4 1093 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:24.629216 4.323997 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1044 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:24.844028 4.273121 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1130 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.035032 4.236274 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1050 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.190061 4.102530 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1019 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.210475 4.134402 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1350 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.270863 4.136326 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 4 1175 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.329309 4.224517 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 950 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.475749 4.223646 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1192 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.620933 4.230229 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 4 1210 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:25.770598 4.372241 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 965 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.061120 4.139598 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 4 1125 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.117412 4.250339 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1258 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.282521 4.632019 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 610 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.633480 3.882244 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 4 1195 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.787711 3.803189 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 4 1191 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.852599 3.882113 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1353 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:26.995073 3.918868 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 4 1245 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:27.175542 4.495319 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 4 1197 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:27.363958 4.117862 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 1170 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:27.777327 0.077498 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:36:31.302059 0.000000 udp 10.0.2.105 7010 <- 211.38.175.27 2833 RSP 0 0 1 546 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:31.671443 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:39.708170 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:48.100662 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 9977 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:52.956961 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:36:53.778155 0.000000 udp 10.0.2.105 7010 -> 84.58.157.28 2044 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:36:58.857787 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 08:37:02.040240 0.000000 udp 10.0.2.105 7010 -> 176.61.33.208 5734 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:05.865892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:37:08.149248 0.000000 udp 10.0.2.105 7010 -> 84.170.159.182 3546 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:13.867073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:37:16.280563 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:20.957786 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:37:21.828731 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:29.869886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:37:29.950293 0.000000 udp 10.0.2.105 7010 -> 116.14.228.106 6769 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:35.588702 0.000000 udp 10.0.2.105 7010 -> 68.202.102.44 2326 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:42.178013 0.000000 udp 10.0.2.105 7010 -> 2.14.134.38 7556 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:46.954989 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:37:47.355815 0.000000 udp 10.0.2.105 7010 -> 141.237.223.124 4707 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:53.273845 0.000000 udp 10.0.2.105 7010 -> 173.161.36.149 8727 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:37:58.842067 0.000000 udp 10.0.2.105 7010 -> 94.64.97.34 8868 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:01.876143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:38:04.419885 0.000000 udp 10.0.2.105 7010 -> 62.90.23.46 9283 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:10.669190 0.055272 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 861 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:38:10.734436 0.000000 udp 10.0.2.105 7010 -> 94.34.155.180 9141 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:15.455662 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:38:16.898240 0.000000 udp 10.0.2.105 7010 -> 95.229.248.36 6838 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:23.337352 0.000000 udp 10.0.2.105 7010 -> 174.96.172.127 8178 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:30.117188 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:37.447673 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:41.953527 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:38:42.574705 0.000000 udp 10.0.2.105 7010 -> 65.47.92.78 6109 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:51.007350 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:38:56.134348 0.000000 udp 10.0.2.105 7010 -> 93.193.152.37 7662 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:01.291976 0.141251 udp 10.0.2.105 7010 -> 61.8.150.49 5783 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:01.433227 0.000000 icmp 61.8.150.49 0x0303 -> 10.0.2.105 0x9716 URP 192 1 324 flow=Background 1970/01/17 08:39:05.958156 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:39:08.101714 0.000000 udp 10.0.2.105 7010 -> 70.54.34.181 3419 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:13.579811 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:21.961730 0.000000 udp 10.0.2.105 7010 -> 81.99.241.9 7666 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:29.462615 0.000000 udp 10.0.2.105 7010 -> 67.248.182.24 6756 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:34.459246 0.000261 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:39:36.622845 0.000000 udp 10.0.2.105 7010 -> 217.95.227.83 3003 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:42.310745 0.000000 udp 10.0.2.105 7010 -> 67.60.93.78 5816 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:49.330716 0.000000 udp 10.0.2.105 7010 -> 95.246.203.148 5404 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:39:56.671797 0.095015 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:39:56.960371 0.000000 udp 10.0.2.105 7010 -> 80.89.80.173 8214 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:01.457863 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:40:02.660064 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:10.040419 0.122547 udp 10.0.2.105 7010 <-> 46.236.139.244 7454 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:40:10.266517 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:16.640076 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:21.777525 0.170511 udp 10.0.2.105 7010 -> 5.82.63.25 3840 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:21.948036 0.000000 icmp 5.82.63.25 0x0303 -> 10.0.2.105 0x000f URP 192 1 133 flow=Background 1970/01/17 08:40:26.454266 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:40:27.075318 0.000000 udp 10.0.2.105 7010 -> 109.149.12.252 3508 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:33.444354 0.000000 udp 10.0.2.105 7010 -> 64.207.28.54 6206 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:40.554481 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:48.135286 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:40:52.952123 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:40:54.985449 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:03.597957 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:10.978121 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:18.248648 0.000000 udp 10.0.2.105 7010 -> 94.9.204.103 5485 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:22.955515 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:41:26.380845 0.000000 udp 10.0.2.105 7010 -> 74.218.228.214 5021 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:33.941262 0.000000 udp 10.0.2.105 7010 -> 68.189.94.26 4338 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:42.613851 0.000000 udp 10.0.2.105 7010 -> 76.212.187.204 7513 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:47.540790 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:41:49.283306 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 3275 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:41:55.672498 0.000000 udp 10.0.2.105 7010 -> 68.83.230.161 3709 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:03.023498 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:11.215317 0.089319 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:42:11.318758 0.000000 udp 10.0.2.105 7010 -> 74.64.20.16 7800 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:16.041523 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:42:18.314898 0.000000 udp 10.0.2.105 7010 -> 79.126.234.191 4383 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:23.963508 0.000000 udp 10.0.2.105 7010 -> 82.55.181.68 2254 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:32.445777 0.000000 udp 10.0.2.105 7010 -> 82.3.24.131 8200 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:41.247940 0.000000 udp 10.0.2.105 7010 -> 99.237.76.173 7860 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:46.044565 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:42:47.597445 0.329592 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:42:47.938336 0.000000 udp 10.0.2.105 7010 -> 93.196.54.223 1415 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:42:55.769182 0.000000 udp 10.0.2.105 7010 -> 82.28.147.243 9181 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:02.167987 0.000000 udp 10.0.2.105 7010 -> 217.203.16.79 7456 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:08.778093 0.179983 udp 10.0.2.105 7010 <-> 99.181.131.193 7576 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:43:08.969005 0.000000 udp 10.0.2.105 7010 -> 79.45.19.180 2003 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:13.543927 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:43:17.390421 0.082523 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:43:17.491843 0.154517 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:43:17.663333 0.000000 udp 10.0.2.105 7010 -> 95.224.148.88 1582 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:23.258299 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:31.410115 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:37.919557 0.067116 udp 10.0.2.105 7010 -> 84.173.71.23 7912 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:37.986673 0.000000 icmp 84.173.71.23 0x0303 -> 10.0.2.105 0xe81e URP 192 1 224 flow=Background 1970/01/17 08:43:42.545778 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:43:43.046623 0.046172 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/17 08:43:43.115885 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:51.319008 0.000000 udp 10.0.2.105 7010 -> 173.9.47.141 5827 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:43:58.599410 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:05.972781 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 08:44:07.041330 0.000000 udp 10.0.2.105 7010 -> 71.241.216.33 9164 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:12.048208 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:44:12.979678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:44:15.623952 0.000000 udp 10.0.2.105 7010 -> 217.35.95.162 6443 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:20.981403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:44:22.924089 0.000000 udp 10.0.2.105 7010 -> 109.255.79.150 3826 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:30.996171 0.000000 udp 10.0.2.105 7010 -> 84.181.199.63 6506 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:36.984761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:44:39.838781 0.000000 udp 10.0.2.105 7010 -> 88.253.147.59 5421 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:44.545176 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:44:48.370887 0.000000 udp 10.0.2.105 7010 -> 70.64.76.156 8633 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:53.408177 0.000000 udp 10.0.2.105 7010 -> 184.163.157.196 3552 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:44:59.506537 0.000000 udp 10.0.2.105 7010 -> 87.202.108.122 7047 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 08:45:08.990471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:51:12.996619 3.021056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:51:20.023558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:51:28.045383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:51:44.048110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:52:16.054003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:58:20.060986 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 08:58:27.067531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:58:35.069640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:58:51.072098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:59:23.077957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 08:59:49.897633 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 08:59:49.897744 1.077346 tcp 10.0.2.105 55650 -> 95.104.50.9 3421 FSPA* 0 0 15 1714 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:05:27.083978 3.001750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:05:34.091791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:05:42.093436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:05:58.096110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:06:30.102215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:12:34.108951 3.001458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:12:41.115697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:12:49.117262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:13:05.120259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:13:37.126088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:15:25.652351 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 09:15:25.652507 0.086161 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:25.739172 0.156042 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:25.895656 0.323210 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:26.219270 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:15:44.330995 0.061007 tcp 10.0.2.105 55651 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:15:44.392448 0.078004 tcp 10.0.2.105 55652 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:15:44.470764 0.189210 tcp 10.0.2.105 55653 -> 195.113.214.236 443 SRPA* 0 0 46 37246 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:15:44.660611 0.246104 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:44.907085 0.293913 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.201504 0.163990 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.365846 0.186825 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.553080 0.020122 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.573533 0.151616 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.725559 0.145965 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:45.871941 0.287524 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.159881 0.054344 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.214627 0.059562 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.274594 0.057711 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.332704 0.148379 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.481492 0.207761 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:46.689647 0.362255 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.052318 0.163156 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.215867 0.146866 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.363180 0.062751 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.426310 0.145438 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.572110 0.215638 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.788089 0.176617 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:47.965118 0.057311 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:48.022898 0.102483 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:15:48.125765 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:16:05.570683 0.054614 tcp 10.0.2.105 55654 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:05.625580 0.079120 tcp 10.0.2.105 55655 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:05.705063 0.195439 tcp 10.0.2.105 55656 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:05.900982 0.072636 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:16:05.973995 0.184444 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:16:06.158846 0.000000 udp 10.0.2.105 7010 -> 99.181.131.193 7576 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:16:24.818335 0.061097 tcp 10.0.2.105 55657 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:24.879661 0.081031 tcp 10.0.2.105 55658 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:24.960937 0.168505 tcp 10.0.2.105 55659 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:16:25.129995 0.154041 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:16:25.284462 0.046985 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:16:25.331816 0.049406 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:19:41.134382 2.999707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 09:19:48.139773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:19:56.141507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:20:12.144205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:20:44.150195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:26:48.156560 3.000973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:26:55.163868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:27:03.165042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:27:19.168435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:27:51.174091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:29:50.976642 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 09:29:50.976755 0.532366 tcp 10.0.2.105 55660 -> 95.104.50.9 3421 FSPA* 0 0 15 1712 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:33:55.180842 3.000794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:34:02.187849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:34:10.189075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:34:26.192030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:34:58.197993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:41:02.204575 3.000971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:41:09.213153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:41:17.213841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:41:33.216621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:42:05.222032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:46:53.036316 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 09:46:53.036423 0.175661 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:46:53.212671 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:47:11.614243 0.095806 tcp 10.0.2.105 55661 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:11.710349 0.067538 tcp 10.0.2.105 55662 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:11.777717 0.260732 tcp 10.0.2.105 55663 -> 195.113.214.236 443 SRPA* 0 0 47 25046 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:12.037323 0.173191 udp 10.0.2.105 7010 <-> 99.181.131.193 7576 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:12.210892 0.326371 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:12.537667 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:47:31.001708 0.060161 tcp 10.0.2.105 55664 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:31.062183 0.095574 tcp 10.0.2.105 55665 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:31.158010 0.173580 tcp 10.0.2.105 55666 -> 195.113.214.236 443 SRPA* 0 0 58 39244 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:31.331234 0.086340 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:31.417988 0.295323 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:31.713747 0.147434 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:31.861641 0.167424 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.029465 0.145224 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.175053 0.154734 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.330267 0.053648 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.384335 0.059682 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.444448 0.058799 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.503630 0.144630 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.648680 0.020359 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.669395 0.294620 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:32.964454 0.145884 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:33.110697 0.145855 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:33.256966 0.450248 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:33.707617 0.178359 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:33.886371 0.163094 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:34.049803 0.179376 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:34.229565 0.055129 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:34.285102 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 09:47:51.680537 0.051323 tcp 10.0.2.105 55667 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:51.732118 0.081865 tcp 10.0.2.105 55668 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:51.814288 0.166693 tcp 10.0.2.105 55669 -> 195.113.214.236 443 SRPA* 0 0 33 18764 flow=From-Botnet-V2-TCP-Established 1970/01/17 09:47:51.981661 0.144308 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.126371 0.064777 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.191528 0.175155 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.367027 0.154279 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.521824 0.192809 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.715017 0.054477 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.769935 0.153009 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:47:52.923335 0.046715 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/17 09:48:09.228682 3.001196 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 09:48:16.235182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:48:24.236898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:48:40.240487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:49:12.246092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:55:16.251683 3.001794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 09:55:23.259389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:55:31.261088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:55:47.263854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:56:19.270195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 09:59:51.515562 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 09:59:51.515660 0.501498 tcp 10.0.2.105 55670 -> 95.104.50.9 3421 FSPA* 0 0 15 1675 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:02:23.276463 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:02:30.283324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:02:38.285072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:02:54.287763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:03:26.293804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:09:30.300581 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:09:37.307301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:09:45.309264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:10:01.311995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:10:33.317878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:16:37.324603 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:16:44.381674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:16:52.383070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:17:08.386032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:17:40.392277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:17:57.847098 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 10:17:57.847262 0.157997 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:17:58.005619 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 10:18:15.284499 0.332772 tcp 10.0.2.105 55671 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:18:15.617562 0.067960 tcp 10.0.2.105 55672 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:18:15.685406 0.175438 tcp 10.0.2.105 55673 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:18:15.861463 0.192762 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:16.054575 2.145866 udp 10.0.2.105 7010 <-> 99.181.131.193 7576 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:18.200836 0.335484 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:18.536785 0.245111 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:18.782292 0.169713 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:18.952506 0.319723 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.272642 0.262672 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.535687 0.081771 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.617859 0.061106 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.679383 0.154331 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.834044 0.137719 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.972102 0.020362 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:19.992861 0.289616 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.282872 0.143992 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.427276 0.145847 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.573524 0.058458 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.632548 0.057897 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.690840 0.188653 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.879899 0.055003 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:20.935255 0.357345 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:21.293096 0.197045 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:21.490556 0.183806 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:21.674686 0.142380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:21.817411 0.159154 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:21.976949 0.183938 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:22.161326 0.055488 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:22.217135 0.149582 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:22.367139 0.046839 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:22.414340 0.088451 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:18:22.503126 0.185288 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:23:44.527928 3.002194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:23:51.535877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:23:59.537465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:24:15.540060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:24:48.057083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:29:52.444951 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 10:29:52.445065 2.993888 tcp 10.0.2.105 55674 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 10:30:01.437627 0.000000 tcp 10.0.2.105 55674 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 10:30:07.448488 0.076818 tcp 10.0.2.105 55675 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:30:07.525608 0.079152 tcp 10.0.2.105 55676 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:30:07.605049 0.149479 tcp 10.0.2.105 55677 -> 195.113.214.236 443 SRPA* 0 0 60 51837 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:30:07.992820 0.620446 tcp 10.0.2.105 55678 -> 94.137.168.16 9773 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/17 10:30:52.063902 3.000332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:30:59.069973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:31:07.071857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:31:23.074613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:31:55.080860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:37:59.087460 3.000769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:38:06.094583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:38:14.095516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:38:30.098651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:39:02.104837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:45:06.111449 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:45:13.118132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:45:21.119830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:45:37.123123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:46:09.128838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:48:40.566890 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 10:48:40.567082 0.152513 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:40.720013 0.173779 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:40.894175 0.171981 udp 10.0.2.105 7010 <-> 99.181.131.193 7576 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:41.066530 0.183193 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:41.250122 0.148465 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:41.398986 0.344417 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:41.743794 0.152942 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:41.897143 0.299812 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.197325 0.078358 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.276087 0.056094 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.332576 0.153943 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.486929 0.144889 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.632171 0.020226 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.652762 0.292666 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:42.945863 0.147030 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.093247 0.141967 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.235632 0.058198 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.294228 0.057680 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.352285 0.184492 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.537127 0.055265 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.592813 0.337007 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:43.930233 0.178988 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.109618 0.163643 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.273697 0.148793 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.422888 0.059470 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.482722 0.179518 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.662756 0.046324 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.709428 0.153225 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:44.863081 0.185650 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:45.049180 0.048149 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:48:45.097761 0.087840 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/17 10:52:13.135772 3.000365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:52:20.142302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:52:28.143560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:52:44.146898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:53:16.152544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:59:20.158517 3.002231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 10:59:27.166011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:59:35.167784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 10:59:51.170359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:00:08.616348 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 11:00:08.616444 0.656601 tcp 10.0.2.105 55679 -> 94.137.168.16 9773 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:00:23.176802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:06:27.183264 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:06:34.190185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:06:42.191310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:06:58.194763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:07:30.200966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:13:34.206357 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:13:41.214099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:13:49.215532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:14:05.218852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:14:37.224794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:19:10.848355 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 11:19:10.848448 0.169069 udp 10.0.2.105 7010 <-> 99.181.131.193 7576 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:11.017928 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 11:19:27.503882 0.054575 tcp 10.0.2.105 55680 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:19:27.558765 0.075070 tcp 10.0.2.105 55681 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:19:27.633662 0.156547 tcp 10.0.2.105 55682 -> 195.113.214.236 443 SRPA* 0 0 39 21774 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:19:27.790422 0.174328 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:27.965073 0.326674 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:28.292185 0.144942 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:28.437529 0.355049 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:28.792989 0.166374 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:28.959791 0.142987 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.103211 0.077353 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.180979 0.058065 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.239459 0.168497 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.408367 0.144838 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.553591 0.019942 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.573965 0.283977 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:29.858407 0.149511 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.008286 0.147394 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.156145 0.184006 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.340697 0.058688 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.399756 0.371112 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.771286 0.179114 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:30.950766 0.061190 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.012529 0.057935 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.070877 0.162559 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.233840 0.144971 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.379187 0.104447 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.484055 0.180630 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.665052 0.057827 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.723244 0.151973 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:31.875620 0.187310 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:32.063343 0.046658 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:19:32.110401 0.080365 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:20:41.230523 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:20:48.238138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:20:56.439817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:21:12.442536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:21:44.448871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:27:48.454455 3.002172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:27:55.462069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:28:03.463766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:28:19.466741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:28:51.473330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:30:09.365733 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 11:30:09.365932 0.627720 tcp 10.0.2.105 55683 -> 94.137.168.16 9773 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:34:55.479441 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:35:02.486186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:35:10.487662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:35:26.491047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:35:58.496555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:42:02.503250 3.000914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:42:09.510319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:42:17.511694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:42:33.514651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:43:05.520886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:49:09.526427 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:49:16.534090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:49:24.535376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:49:40.538741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:49:54.449251 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 11:49:54.449340 0.152356 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:49:54.602112 0.000000 udp 10.0.2.105 7010 -> 99.181.131.193 7576 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 11:50:11.465710 0.052881 tcp 10.0.2.105 55684 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:11.518947 0.072870 tcp 10.0.2.105 55685 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:11.592164 0.165897 tcp 10.0.2.105 55686 -> 195.113.214.236 443 SRPA* 0 0 41 34602 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:11.758797 0.174567 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:11.933771 0.330763 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:12.264976 0.217416 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:12.482855 0.265890 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:12.544826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:50:12.749108 0.184079 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:12.933597 0.146226 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.080259 0.083864 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.164516 0.054543 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.219491 0.154934 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.374829 0.151615 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.526878 0.020318 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.547486 0.317177 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:13.865059 0.143328 udp 10.0.2.105 7010 <-> 67.86.242.80 8736 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.008772 0.147539 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.156722 0.369322 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.526391 0.210662 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.737450 0.058336 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.796134 0.057622 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:14.854150 0.197426 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:15.051917 0.190580 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:15.242899 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 11:50:31.342275 0.052599 tcp 10.0.2.105 55687 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:31.394726 0.069652 tcp 10.0.2.105 55688 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:31.464660 0.154953 tcp 10.0.2.105 55689 -> 195.113.214.236 443 SRPA* 0 0 24 13826 flow=From-Botnet-V2-TCP-Established 1970/01/17 11:50:31.620095 0.145649 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:31.766097 0.061466 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:31.827914 0.178181 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:32.006473 0.044386 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:32.051231 0.153318 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:32.204982 0.188359 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:32.393774 0.046704 udp 10.0.2.105 7010 <-> 92.244.233.227 3703 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:50:32.440869 0.072914 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/17 11:56:16.551403 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 11:56:23.558069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:56:31.559691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:56:47.562873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 11:57:19.829107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:00:10.294777 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 12:00:10.294873 2.993663 tcp 10.0.2.105 55690 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:19.287057 0.000000 tcp 10.0.2.105 55690 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:25.297985 0.053690 tcp 10.0.2.105 55691 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:25.351935 0.074268 tcp 10.0.2.105 55692 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:25.426532 0.158793 tcp 10.0.2.105 55693 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:25.606602 3.003843 tcp 10.0.2.105 55694 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:34.608883 0.000000 tcp 10.0.2.105 55694 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:40.608294 0.033112 tcp 10.0.2.105 55695 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:40.641256 0.077557 tcp 10.0.2.105 55696 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:40.719082 0.157107 tcp 10.0.2.105 55697 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:41.262873 2.999894 tcp 10.0.2.105 55698 -> 42.98.128.49 9518 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:50.261962 0.000000 tcp 10.0.2.105 55698 -> 42.98.128.49 9518 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:00:56.260924 0.070948 tcp 10.0.2.105 55699 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:56.332165 0.073980 tcp 10.0.2.105 55700 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:56.405994 0.154827 tcp 10.0.2.105 55701 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:00:56.695051 3.000135 tcp 10.0.2.105 55702 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:01:05.693872 0.000000 tcp 10.0.2.105 55702 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 12:01:11.693099 0.052340 tcp 10.0.2.105 55703 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:01:11.745240 0.074211 tcp 10.0.2.105 55704 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:01:11.819736 0.159339 tcp 10.0.2.105 55705 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:01:12.128416 0.564802 tcp 10.0.2.105 55706 -> 176.73.211.244 8034 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:03:24.205891 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 12:03:31.213400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:03:39.214206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:03:55.217979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:04:27.223657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:10:31.229800 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 12:10:38.236922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:10:46.238238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:11:02.241740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:11:34.247647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:17:38.253777 3.001449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 12:17:45.261176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:17:53.262711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:18:09.265838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:18:41.271670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:20:57.106973 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 12:20:57.107225 0.000000 udp 10.0.2.105 7010 -> 99.181.131.193 7576 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:21:13.902651 0.051384 tcp 10.0.2.105 55707 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:13.954307 0.075260 tcp 10.0.2.105 55708 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:14.029872 0.154946 tcp 10.0.2.105 55709 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:14.185457 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:21:29.664441 0.051601 tcp 10.0.2.105 55710 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:29.716497 0.072441 tcp 10.0.2.105 55711 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:29.789308 0.168879 tcp 10.0.2.105 55712 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:29.958755 0.151491 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:30.110700 0.331655 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:30.442735 0.176377 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:30.619483 0.183486 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:30.803405 0.142808 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:30.946617 0.263360 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.210384 0.146005 udp 10.0.2.105 7010 <-> 64.105.149.138 5704 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.356794 0.056451 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.413632 0.082950 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.496993 0.019916 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.517259 0.302245 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:31.819952 0.000000 udp 10.0.2.105 7010 -> 67.86.242.80 8736 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:21:49.754688 0.051623 tcp 10.0.2.105 55713 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:49.806561 0.078069 tcp 10.0.2.105 55714 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:49.884947 0.158304 tcp 10.0.2.105 55715 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:21:50.043804 0.148264 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.192494 0.154837 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.347720 0.144919 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.493058 0.059635 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.553138 0.162282 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.715826 0.185271 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:50.901438 0.337960 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.239796 0.176242 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.416465 0.059443 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.476338 0.145346 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.622115 0.059757 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.682337 0.180672 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.863454 0.046771 udp 10.0.2.105 7010 <-> 5.13.40.175 2778 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:51.910601 0.152194 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:52.063241 0.099179 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:52.178272 0.185080 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:21:52.363716 0.000000 udp 10.0.2.105 7010 -> 92.244.233.227 3703 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:22:10.813604 0.052280 tcp 10.0.2.105 55716 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:22:10.866164 0.074162 tcp 10.0.2.105 55717 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:22:10.940118 0.166115 tcp 10.0.2.105 55718 -> 195.113.214.236 443 SRPA* 0 0 64 66250 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:24:45.278100 3.000937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 12:24:52.285161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:25:00.286657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:25:16.289458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:25:48.295951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:31:12.692224 0.075774 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 12:31:12.768298 0.784792 tcp 10.0.2.105 55719 -> 176.73.211.244 8034 FSPA* 0 0 12 1454 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:31:52.330922 3.002111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 12:31:59.339241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:32:07.340265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:32:23.343410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:32:55.349881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:38:59.355670 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 12:39:06.362719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:39:14.364684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:39:30.367845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:40:02.373604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:46:06.380314 3.000619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 12:46:13.386659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:46:21.388391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:46:37.391622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:47:09.397646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:52:12.153219 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 12:52:12.153319 0.000000 udp 10.0.2.105 7010 -> 67.86.242.80 8736 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:52:27.897756 0.053240 tcp 10.0.2.105 55720 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:27.951264 0.074039 tcp 10.0.2.105 55721 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:28.025745 0.158543 tcp 10.0.2.105 55722 -> 195.113.214.236 443 SRPA* 0 0 51 33274 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:28.184989 0.000000 udp 10.0.2.105 7010 -> 92.244.233.227 3703 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:52:46.953229 0.051197 tcp 10.0.2.105 55723 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:47.004736 0.073534 tcp 10.0.2.105 55724 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:47.078796 0.160789 tcp 10.0.2.105 55725 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:52:47.240068 0.153427 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:47.394023 0.190497 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:47.584911 0.150443 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:47.735743 0.192411 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:47.928572 0.175201 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:48.104298 0.324526 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:48.429219 0.300289 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:52:48.729874 0.000000 udp 10.0.2.105 7010 -> 64.105.149.138 5704 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:53:06.862000 0.051594 tcp 10.0.2.105 55726 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:06.913905 0.070800 tcp 10.0.2.105 55727 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:06.984577 0.160954 tcp 10.0.2.105 55728 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:07.146156 0.020151 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.166709 0.080115 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.247180 0.056874 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.304492 0.146208 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.451192 0.156421 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.608046 0.058641 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.667092 0.163303 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:07.830836 0.176449 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.007631 0.337827 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.345867 0.144982 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.491194 0.056654 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.548395 0.140622 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.689419 0.059955 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.749808 0.179207 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:08.929389 0.000000 udp 10.0.2.105 7010 -> 5.13.40.175 2778 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 12:53:13.403557 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 12:53:20.410986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:53:24.597583 0.052499 tcp 10.0.2.105 55729 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:24.650369 0.074551 tcp 10.0.2.105 55730 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:24.725205 0.158191 tcp 10.0.2.105 55731 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/17 12:53:24.884024 0.221163 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:25.105540 0.073077 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:25.179009 0.178253 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:25.357685 0.184397 udp 10.0.2.105 7010 <-> 107.216.33.249 7319 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 12:53:28.412548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:53:44.415025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 12:54:16.421479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:00:20.427413 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:00:27.435075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:00:35.436448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:00:51.439009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:01:13.561813 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:01:13.561916 0.745479 tcp 10.0.2.105 55732 -> 176.73.211.244 8034 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:01:23.445039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:07:27.451853 3.001138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:07:34.458720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:07:42.700479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:07:58.703680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:08:30.709379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:14:34.716379 3.000785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:14:41.723368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:14:49.724754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:15:05.727422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:15:37.733514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:21:41.740433 3.001051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:21:48.747246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:21:56.748210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:22:12.751379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:22:44.757823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:23:30.534101 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:23:30.534346 0.000000 udp 10.0.2.105 7010 -> 64.105.149.138 5704 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:23:46.468807 0.052768 tcp 10.0.2.105 55733 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:23:46.521809 0.071645 tcp 10.0.2.105 55734 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:23:46.593717 0.166812 tcp 10.0.2.105 55735 -> 195.113.214.236 443 SRPA* 0 0 45 38894 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:23:46.761218 0.000000 udp 10.0.2.105 7010 -> 5.13.40.175 2778 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:24:02.510400 0.052435 tcp 10.0.2.105 55736 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:24:02.563117 0.066825 tcp 10.0.2.105 55737 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:24:02.630231 0.166640 tcp 10.0.2.105 55738 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:24:02.795649 0.296213 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:03.092258 0.173975 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:03.266706 0.154097 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:03.421186 0.621865 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:05.331696 0.167292 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:05.499390 0.287307 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:05.787108 0.309766 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.097236 0.020535 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.118160 0.078036 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.196709 0.053352 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.250433 0.058628 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.309465 0.161909 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.471791 0.182957 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.655144 0.153683 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.809198 0.141166 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:06.950765 0.151909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.103105 0.059570 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.163065 0.142365 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.305833 0.058804 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.365059 0.178747 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.544250 0.337588 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:07.882239 0.173675 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:08.056482 0.072516 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:08.129475 0.177532 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:24:08.307432 0.000000 udp 10.0.2.105 7010 -> 107.216.33.249 7319 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:24:23.810538 0.052134 tcp 10.0.2.105 55739 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:24:23.862974 0.074144 tcp 10.0.2.105 55740 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:24:23.937401 0.153912 tcp 10.0.2.105 55741 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:28:48.763794 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 13:28:55.771046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:29:03.772399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:29:19.775764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:29:51.781479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:31:14.421013 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:31:14.421099 0.681306 tcp 10.0.2.105 55742 -> 176.73.211.244 8034 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:35:55.787879 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:36:02.794955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:36:10.796161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:36:26.799286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:36:58.805498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:43:02.812092 3.000794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:43:09.818904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:43:17.820136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:43:33.823300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:44:05.829670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:50:09.835591 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 13:50:16.842723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:50:24.844094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:50:40.847467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:51:12.853442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:54:52.008677 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:54:52.008789 0.000000 udp 10.0.2.105 7010 -> 107.216.33.249 7319 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:10.277311 0.031393 tcp 10.0.2.105 55743 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:55:10.309059 0.053130 tcp 10.0.2.105 55744 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:55:10.362488 0.143928 tcp 10.0.2.105 55745 -> 195.113.214.236 443 SRPA* 0 0 50 32852 flow=From-Botnet-V2-TCP-Established 1970/01/17 13:55:10.504438 4.681314 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 942 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:10.797507 3.889618 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1149 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:10.972461 3.866010 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 4 1084 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.125893 3.865113 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 4 1142 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.272424 4.233527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1157 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.584842 3.942403 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 4 1187 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.605277 4.089142 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1241 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.774795 4.036809 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 4 996 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.883989 3.990275 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 4 1184 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:11.942998 4.007317 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1103 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.033427 4.212393 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1080 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.328674 4.083206 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1193 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.492702 4.073975 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1111 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.646870 4.069390 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 4 1228 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.792428 4.069223 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1291 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.937579 3.975866 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1100 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:12.995310 4.064303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1157 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.138697 3.989237 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 4 1196 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.203347 4.927440 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 3 631 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.380911 3.824057 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 4 1210 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.454709 3.928317 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 4 1127 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.632933 4.092065 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1215 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:13.971126 3.932905 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 1310 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:14.150352 3.980046 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 4 1137 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:55:18.312759 0.000000 udp 10.0.2.105 7010 <- 24.234.43.35 7805 RSP 0 0 1 542 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:18.313297 0.000000 udp 10.0.2.105 7010 -> 82.15.144.232 1211 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:24.445466 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:29.973326 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:34.489543 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:55:38.215337 0.000000 udp 10.0.2.105 7010 -> 67.52.122.78 2712 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:44.554168 0.000000 udp 10.0.2.105 7010 -> 176.61.33.208 5734 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:49.921730 0.000000 udp 10.0.2.105 7010 -> 84.170.177.49 3546 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:55:55.780104 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:00.496843 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:56:04.362863 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1133 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:10.201236 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:18.102287 0.000000 udp 10.0.2.105 7010 -> 105.229.5.245 8641 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:26.034255 0.000000 udp 10.0.2.105 7010 -> 173.240.26.185 8531 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:30.990498 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:56:34.045713 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:42.427535 0.000000 udp 10.0.2.105 7010 -> 71.43.15.18 9376 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:51.020003 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1479 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:56:55.997066 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:56:57.398918 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:02.596431 0.165205 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:57:02.917594 0.000000 udp 10.0.2.105 7010 -> 79.95.189.77 4489 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:11.169260 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:16.859772 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 13:57:18.999805 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:23.866916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:57:23.997227 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:57:24.968412 0.000000 udp 10.0.2.105 7010 -> 71.236.23.231 1040 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:30.957626 0.000000 udp 10.0.2.105 7010 -> 93.220.49.6 7273 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:31.868128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:57:39.850315 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:47.610989 0.000000 udp 10.0.2.105 7010 -> 64.203.114.44 6304 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:57:47.871476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:57:52.497947 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:57:53.910457 0.000000 udp 10.0.2.105 7010 -> 87.17.89.198 3641 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:02.773010 0.000000 udp 10.0.2.105 7010 -> 107.216.33.249 7319 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:10.093888 0.264016 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/17 13:58:10.378636 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:17.133762 0.000000 udp 10.0.2.105 7010 -> 184.163.157.196 1065 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:19.877881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 13:58:21.990079 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:58:24.303673 0.000000 udp 10.0.2.105 7010 -> 2.135.211.150 1868 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:32.285971 0.000000 udp 10.0.2.105 7010 -> 50.20.81.25 1966 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:37.322673 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:42.480108 0.094830 udp 10.0.2.105 7010 -> 37.142.237.136 7823 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:42.574938 0.000000 icmp 37.142.237.136 0x0303 -> 10.0.2.105 0x8f1e URP 192 1 189 flow=Background 1970/01/17 13:58:46.996710 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:58:50.982109 0.000000 udp 10.0.2.105 7010 -> 93.193.152.37 7662 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:58:58.713122 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:03.850727 0.000000 udp 10.0.2.105 7010 -> 151.16.26.206 3658 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:11.482154 0.000000 udp 10.0.2.105 7010 -> 108.66.64.142 1086 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:15.997721 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:59:20.234303 0.000000 udp 10.0.2.105 7010 -> 205.232.71.149 2484 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:28.736902 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:37.148984 0.000000 udp 10.0.2.105 7010 -> 178.236.129.116 6381 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:41.995145 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 13:59:43.968433 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:50.898516 0.000000 udp 10.0.2.105 7010 -> 71.241.216.33 9164 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 13:59:58.409617 0.000000 udp 10.0.2.105 7010 -> 193.238.69.205 1849 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:05.169727 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:09.996121 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:00:10.336398 0.000000 udp 10.0.2.105 7010 -> 151.66.205.157 2011 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:16.485257 0.000000 udp 10.0.2.105 7010 -> 81.99.246.142 5922 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:23.635338 0.000000 udp 10.0.2.105 7010 -> 95.6.87.219 2670 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:29.563920 0.000000 udp 10.0.2.105 7010 -> 115.84.253.146 4252 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:34.491177 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:00:36.283448 0.000000 udp 10.0.2.105 7010 -> 198.72.60.111 2497 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:42.932947 0.000000 udp 10.0.2.105 7010 -> 86.4.127.47 8116 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:49.072511 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:00:56.903634 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:01.489917 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:01:03.853674 0.000000 udp 10.0.2.105 7010 -> 82.14.222.51 7687 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:10.342377 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:15.110115 0.826812 tcp 10.0.2.105 55746 -> 176.73.211.244 8034 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/17 14:01:17.532942 0.000000 udp 10.0.2.105 7010 -> 90.208.221.240 7297 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:25.915126 0.000000 udp 10.0.2.105 7010 -> 95.242.22.131 2220 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:31.903397 0.000000 udp 10.0.2.105 7010 -> 85.250.166.2 1025 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:40.135301 0.000000 udp 10.0.2.105 7010 -> 95.250.20.254 5808 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:44.992657 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:01:49.008013 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 3275 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:01:56.228694 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:05.171820 0.154149 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:05.342804 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:09.998240 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:02:11.300263 0.048560 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:11.357857 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:18.370393 0.000000 udp 10.0.2.105 7010 -> 72.70.56.11 3231 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:24.539571 0.142676 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:24.693184 0.000000 udp 10.0.2.105 7010 -> 94.209.117.182 4228 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:33.101446 0.229994 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:33.623664 0.199959 udp 10.0.2.105 7010 <-> 108.246.49.50 5831 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:34.086779 0.159766 udp 10.0.2.105 7010 <-> 115.117.114.180 6400 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:02:34.305106 0.000000 udp 10.0.2.105 7010 -> 88.253.161.162 9279 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:37.998288 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:02:42.204481 0.000000 udp 10.0.2.105 7010 -> 77.99.46.243 8034 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:49.004164 0.000000 udp 10.0.2.105 7010 -> 82.53.113.216 2254 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:02:55.443458 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:01.002043 0.059676 udp 10.0.2.105 7010 -> 94.34.143.202 9141 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:01.061719 0.000000 icmp 94.34.143.202 0x0303 -> 10.0.2.105 0xb523 URP 192 1 237 flow=Background 1970/01/17 14:03:05.988985 0.164119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:03:06.279045 0.000000 udp 10.0.2.105 7010 -> 75.72.136.225 4583 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:12.588185 0.000000 udp 10.0.2.105 7010 -> 71.202.34.145 3042 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:19.168077 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:26.317860 0.158931 udp 10.0.2.105 7010 -> 216.215.106.130 2268 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:26.476791 0.000000 icmp 216.215.106.130 0x0303 -> 10.0.2.105 0xdc08 URP 192 1 147 flow=Background 1970/01/17 14:03:31.064758 0.047871 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:03:33.628767 0.000000 udp 10.0.2.105 7010 -> 94.240.229.175 2312 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:39.587155 0.118720 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:03:39.955024 0.000000 udp 10.0.2.105 7010 -> 173.22.1.181 9930 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:47.849019 0.000000 udp 10.0.2.105 7010 -> 65.182.80.146 4086 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:54.668981 0.000000 udp 10.0.2.105 7010 -> 95.254.253.196 6945 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:03:59.576035 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:04:01.368418 0.000000 udp 10.0.2.105 7010 -> 74.220.7.15 9204 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:04:09.951095 0.000000 udp 10.0.2.105 7010 -> 108.91.77.114 9029 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:04:15.899738 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:04:21.857947 0.000000 udp 10.0.2.105 7010 -> 12.184.137.162 8730 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:04:23.964029 3.001303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 14:04:26.574321 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:04:27.065825 0.000000 udp 10.0.2.105 7010 -> 99.103.56.21 3499 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:04:30.970888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:04:38.972231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:04:54.975586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:05:26.981750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:11:30.988130 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:11:37.994587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:11:45.996437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:12:01.999283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:12:34.005865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:18:38.012710 3.000139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:18:45.019035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:18:53.020178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:19:09.023278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:19:41.029785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:25:45.035832 3.001625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:25:52.583793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:26:00.585047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:26:16.588601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:26:48.594053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:31:16.269530 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:31:16.269632 0.691341 tcp 10.0.2.105 55747 -> 176.73.211.244 8034 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/17 14:32:52.599634 3.001907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:32:59.607362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:33:07.609001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:33:23.611775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:33:55.618240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:34:52.770596 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 14:34:52.770698 0.148773 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:52.919887 0.249676 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:53.169993 0.173439 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:53.343767 0.153673 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:53.497932 0.325058 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:53.823453 0.020082 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:53.843894 0.185840 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.030158 0.055560 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.086221 0.058717 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.145343 0.077851 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.223650 0.288627 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.512779 0.161470 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:54.674617 0.409331 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.084448 0.146058 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.230851 0.144776 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.376035 0.056460 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.432951 0.144577 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.577920 0.060333 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.638660 0.144956 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.784040 0.179004 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:55.963435 0.161864 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:56.125628 0.181848 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:56.307880 0.342360 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:56.650640 0.178612 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:56.829578 0.163609 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:56.993640 0.261352 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.255357 0.143800 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.399490 0.038550 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.438413 0.139093 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.577938 0.221501 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.799852 0.154346 udp 10.0.2.105 7010 <-> 115.117.114.180 6400 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:34:57.954575 0.000000 udp 10.0.2.105 7010 -> 108.246.49.50 5831 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 14:35:15.925165 0.030643 tcp 10.0.2.105 55748 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 14:35:15.956111 0.048706 tcp 10.0.2.105 55749 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 14:35:16.005073 0.141357 tcp 10.0.2.105 55750 -> 195.113.214.236 443 SRPA* 0 0 28 12102 flow=From-Botnet-V2-TCP-Established 1970/01/17 14:35:16.146269 0.115428 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 14:39:59.623989 3.102167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:40:06.731354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:40:14.733360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:40:30.736442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:41:02.742098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:47:06.749048 3.001141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:47:13.755954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:47:21.756996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:47:37.759945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:48:09.766031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:54:13.771816 3.002015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 14:54:20.779504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:54:28.781448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:54:44.783829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 14:55:16.789860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:01:17.008746 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 15:01:17.008839 0.825316 tcp 10.0.2.105 55751 -> 176.73.211.244 8034 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/01/17 15:01:20.797688 3.000345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:01:27.803949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:01:35.805382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:01:51.808556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:02:23.814125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:05:40.898129 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 15:05:40.898384 0.186315 udp 10.0.2.105 7010 <-> 108.246.49.50 5831 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:41.085043 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 15:05:56.972620 0.053530 tcp 10.0.2.105 55752 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 15:05:57.026443 0.061198 tcp 10.0.2.105 55753 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 15:05:57.087891 0.150413 tcp 10.0.2.105 55754 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 15:05:57.238862 0.252374 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:57.491639 0.155652 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:57.647723 0.321160 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:57.969299 0.020089 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:57.989809 0.190666 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.180909 0.053644 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.235006 0.061203 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.296659 0.175476 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.472640 0.075323 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.548304 0.171045 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.719743 0.162094 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:58.882182 0.301334 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.183895 0.144836 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.329137 0.056533 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.386039 0.142518 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.528975 0.062565 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.592015 0.074769 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.667219 0.178088 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:05:59.845672 0.359649 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:00.205671 0.146173 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:00.352440 0.177825 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:00.530674 0.161045 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:00.692157 0.182441 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:00.874935 0.335808 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:01.313892 0.262459 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:01.576768 0.134521 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:01.711674 0.221742 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:01.933793 0.149591 udp 10.0.2.105 7010 <-> 115.117.114.180 6400 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:02.083752 0.039054 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:02.123181 0.146523 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:06:02.270088 0.611183 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:08:27.820025 3.002043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:08:34.827287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:08:42.828918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:08:58.832026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:09:30.838228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:15:34.844791 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:15:41.851454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:15:49.852880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:16:05.855893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:16:37.972539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:22:41.978491 3.002131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:22:48.986265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:22:56.987411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:23:12.989961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:23:44.995887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:29:49.003178 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:29:56.009838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:30:04.010802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:30:20.014005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:30:52.019951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:31:17.887631 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 15:31:17.887815 0.646444 tcp 10.0.2.105 55755 -> 176.73.211.244 8034 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/01/17 15:36:32.139312 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 15:36:32.139408 0.738548 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:32.878391 0.188605 udp 10.0.2.105 7010 <-> 108.246.49.50 5831 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:33.067381 0.279591 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:33.347405 0.154102 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:33.501846 0.392489 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:33.894702 0.020035 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:33.915040 0.184908 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.100309 0.058587 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.189427 0.074333 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.264196 0.174101 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.438729 0.163198 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.602292 0.302197 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.904869 0.058929 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:34.964206 0.174654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.139295 0.144700 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.284497 0.056623 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.341537 0.143504 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.485379 0.063340 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.549134 0.071384 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.620946 0.178140 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.799513 0.189584 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:35.989503 0.163706 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:36.153633 0.184385 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:36.338449 0.145576 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:36.484588 0.180365 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:36.665362 0.349211 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:37.015012 0.321416 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:37.336824 0.133081 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:37.470273 0.731938 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:38.202583 0.151670 udp 10.0.2.105 7010 <-> 115.117.114.180 6400 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:38.354707 0.044314 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:38.399374 0.146388 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:38.546136 0.129596 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/17 15:36:56.026062 3.001921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 15:37:03.033814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:37:11.035172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:37:27.037919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:37:59.044412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:44:03.050954 3.001014 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:44:10.057209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:44:18.059110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:44:34.062211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:45:06.067998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:51:10.074844 3.000623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:51:17.081772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:51:25.083272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:51:41.085735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:52:13.092106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:58:17.097957 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 15:58:24.105877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:58:32.107436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:58:48.109652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 15:59:20.115819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:01:18.536366 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:01:18.536576 3.003984 tcp 10.0.2.105 55756 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:01:27.539285 0.000000 tcp 10.0.2.105 55756 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:01:33.539716 0.030786 tcp 10.0.2.105 55757 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:33.570767 0.064293 tcp 10.0.2.105 55758 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:33.634935 0.161157 tcp 10.0.2.105 55759 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:33.814529 2.997729 tcp 10.0.2.105 55760 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:01:42.811407 0.000000 tcp 10.0.2.105 55760 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:01:48.810977 0.050649 tcp 10.0.2.105 55761 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:48.861907 0.064189 tcp 10.0.2.105 55762 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:48.926399 0.150914 tcp 10.0.2.105 55763 -> 195.113.214.236 443 SRPA* 0 0 35 18392 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:01:49.088655 3.005505 tcp 10.0.2.105 55764 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:01:58.092966 0.000000 tcp 10.0.2.105 55764 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:04.082214 0.030043 tcp 10.0.2.105 55765 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:04.112566 0.066997 tcp 10.0.2.105 55766 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:04.179859 0.154938 tcp 10.0.2.105 55767 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:04.345516 2.991185 tcp 10.0.2.105 55768 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:13.344715 0.000000 tcp 10.0.2.105 55768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:19.344519 0.029731 tcp 10.0.2.105 55769 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:19.374539 0.068242 tcp 10.0.2.105 55770 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:19.443096 0.154131 tcp 10.0.2.105 55771 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:02:19.633116 2.995367 tcp 10.0.2.105 55772 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:28.627048 0.000000 tcp 10.0.2.105 55772 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:34.625620 2.994004 tcp 10.0.2.105 55773 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:43.618235 0.000000 tcp 10.0.2.105 55773 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:48.415282 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:02:49.627466 3.003737 tcp 10.0.2.105 55774 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:02:58.630432 0.000000 tcp 10.0.2.105 55774 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:03:04.628971 3.004375 tcp 10.0.2.105 55775 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:03:12.410213 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:03:13.631806 0.000000 tcp 10.0.2.105 55775 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:05:24.121864 3.001990 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 16:05:31.129303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:05:39.131177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:05:55.133738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:06:27.139797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:06:57.013163 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:06:57.013247 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:07:12.798158 0.031419 tcp 10.0.2.105 55776 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:12.829922 0.065292 tcp 10.0.2.105 55777 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:12.895512 0.151817 tcp 10.0.2.105 55778 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:13.047592 0.199969 udp 10.0.2.105 7010 <-> 108.246.49.50 5831 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:13.247955 0.252580 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:13.500958 0.154548 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:13.655940 0.398991 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.055312 0.020179 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.075795 0.186475 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.262608 0.063954 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.326955 0.076844 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.404179 0.283637 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.688252 0.059396 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.748065 0.174360 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:14.922849 0.151706 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.074953 0.178770 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.254103 0.162559 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.417103 0.056945 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.474428 0.144883 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.619738 0.063173 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.683371 0.206121 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:15.889934 0.178385 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:16.068723 0.212271 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:16.281369 0.159769 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:16.441486 0.178257 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:16.620147 0.335590 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:16.956105 0.179485 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:17.135929 0.145404 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:17.281761 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:07:33.666301 0.029732 tcp 10.0.2.105 55779 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:33.696327 0.065692 tcp 10.0.2.105 55780 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:33.762303 0.153737 tcp 10.0.2.105 55781 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:33.916748 0.135237 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:34.052426 0.422516 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:34.475286 0.152163 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:34.627899 0.364732 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:07:34.992978 0.000000 udp 10.0.2.105 7010 -> 115.117.114.180 6400 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:07:51.812339 0.052005 tcp 10.0.2.105 55782 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:51.864650 0.061585 tcp 10.0.2.105 55783 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:51.926546 0.152343 tcp 10.0.2.105 55784 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:07:52.080116 0.045282 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:08:19.631799 2.994297 tcp 10.0.2.105 55785 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:08:24.408494 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:08:28.634443 0.000000 tcp 10.0.2.105 55785 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:08:34.634175 0.030057 tcp 10.0.2.105 55786 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:34.664543 0.062060 tcp 10.0.2.105 55787 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:34.726446 0.155714 tcp 10.0.2.105 55788 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:34.971968 2.995887 tcp 10.0.2.105 55789 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:08:43.966419 0.000000 tcp 10.0.2.105 55789 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:08:49.966012 0.029813 tcp 10.0.2.105 55790 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:49.996113 0.067766 tcp 10.0.2.105 55791 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:50.064133 0.158818 tcp 10.0.2.105 55792 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:08:50.671387 2.998899 tcp 10.0.2.105 55793 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:08:59.669672 0.000000 tcp 10.0.2.105 55793 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:05.668934 0.052002 tcp 10.0.2.105 55794 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:05.721294 0.061053 tcp 10.0.2.105 55795 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:05.782621 0.158926 tcp 10.0.2.105 55796 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:06.654164 2.999491 tcp 10.0.2.105 55797 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:15.652048 0.000000 tcp 10.0.2.105 55797 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:21.651877 0.052171 tcp 10.0.2.105 55798 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:21.704368 0.067816 tcp 10.0.2.105 55799 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:21.772651 0.151352 tcp 10.0.2.105 55800 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:09:22.064549 3.001518 tcp 10.0.2.105 55801 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:31.064513 0.000000 tcp 10.0.2.105 55801 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:37.063157 2.994363 tcp 10.0.2.105 55802 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:46.065684 0.000000 tcp 10.0.2.105 55802 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:09:50.912829 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:09:52.065046 2.993904 tcp 10.0.2.105 55803 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:10:01.057653 0.000000 tcp 10.0.2.105 55803 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:10:07.066452 3.003803 tcp 10.0.2.105 55804 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:10:14.917112 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:10:16.068835 0.000000 tcp 10.0.2.105 55804 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:12:31.146267 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 16:12:38.153596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:12:46.154924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:13:02.158245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:13:34.164348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:15:22.069919 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:15:22.070192 3.003506 tcp 10.0.2.105 55805 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:15:31.071851 0.000000 tcp 10.0.2.105 55805 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:15:37.073004 0.054335 tcp 10.0.2.105 55806 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:37.127585 0.062435 tcp 10.0.2.105 55807 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:37.190322 0.149570 tcp 10.0.2.105 55808 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:37.412643 3.002521 tcp 10.0.2.105 55809 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:15:46.413793 0.000000 tcp 10.0.2.105 55809 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:15:52.413443 0.454412 tcp 10.0.2.105 55810 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:52.868147 0.064050 tcp 10.0.2.105 55811 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:52.932048 0.159419 tcp 10.0.2.105 55812 -> 195.113.214.236 443 SRPA* 0 0 40 21154 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:15:53.120042 2.998151 tcp 10.0.2.105 55813 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:02.116800 0.000000 tcp 10.0.2.105 55813 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:08.115675 0.052381 tcp 10.0.2.105 55814 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:08.168357 0.063337 tcp 10.0.2.105 55815 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:08.231974 0.155526 tcp 10.0.2.105 55816 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:09.403532 2.998085 tcp 10.0.2.105 55817 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:18.400515 0.000000 tcp 10.0.2.105 55817 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:24.399270 0.052480 tcp 10.0.2.105 55818 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:24.452021 0.064760 tcp 10.0.2.105 55819 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:24.516974 0.153354 tcp 10.0.2.105 55820 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:16:24.883543 2.999840 tcp 10.0.2.105 55821 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:33.882185 0.000000 tcp 10.0.2.105 55821 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:39.881515 3.003955 tcp 10.0.2.105 55822 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:48.883657 0.000000 tcp 10.0.2.105 55822 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:16:53.610437 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:16:54.882738 2.994380 tcp 10.0.2.105 55823 -> 184.182.240.239 7058 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:17:03.885477 0.000000 tcp 10.0.2.105 55823 -> 184.182.240.239 7058 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:17:09.883937 2.994189 tcp 10.0.2.105 55824 -> 95.104.50.9 3421 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:17:17.615364 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:17:18.876767 0.000000 tcp 10.0.2.105 55824 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:19:38.370882 3.001187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 16:19:45.377633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:19:53.379284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:20:09.381870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:20:41.388161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:22:24.887809 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:22:24.887952 3.003008 tcp 10.0.2.105 55825 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:22:33.889582 0.000000 tcp 10.0.2.105 55825 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:22:39.890422 0.030977 tcp 10.0.2.105 55826 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:22:39.921674 0.061959 tcp 10.0.2.105 55827 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:22:39.983951 0.151555 tcp 10.0.2.105 55828 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:22:40.179025 3.004411 tcp 10.0.2.105 55829 -> 176.73.211.244 8034 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:22:49.182280 0.000000 tcp 10.0.2.105 55829 -> 176.73.211.244 8034 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:26:45.394938 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 16:26:52.401963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:27:00.402912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:27:16.406216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:27:48.412439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:33:52.418754 3.001276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 16:33:59.425938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:34:07.427420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:34:23.430294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:34:55.436222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:38:03.606972 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:38:03.607074 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:38:19.912439 0.052504 tcp 10.0.2.105 55830 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:19.965259 0.062564 tcp 10.0.2.105 55831 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:20.028119 0.150464 tcp 10.0.2.105 55832 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:20.178720 0.289480 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:20.459856 0.000000 udp 10.0.2.105 7010 -> 115.117.114.180 6400 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:38:25.248008 3.004184 tcp 10.0.2.105 55833 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:38:34.250364 0.000000 tcp 10.0.2.105 55833 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:38:38.978227 0.053139 tcp 10.0.2.105 55834 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:39.031378 0.062607 tcp 10.0.2.105 55835 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:39.094265 0.155660 tcp 10.0.2.105 55836 -> 195.113.214.236 443 SRPA* 0 0 46 24966 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:39.249394 0.000000 udp 10.0.2.105 7010 -> 108.246.49.50 5831 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 16:38:40.249681 0.051949 tcp 10.0.2.105 55837 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:40.301925 0.061934 tcp 10.0.2.105 55838 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:40.364103 0.157307 tcp 10.0.2.105 55839 -> 195.113.214.236 443 SRPA* 0 0 41 35212 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:40.690539 3.003908 tcp 10.0.2.105 55840 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:38:49.693092 0.000000 tcp 10.0.2.105 55840 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:38:58.225472 0.030617 tcp 10.0.2.105 55841 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:58.256393 0.061938 tcp 10.0.2.105 55842 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:58.318616 0.159471 tcp 10.0.2.105 55843 -> 195.113.214.236 443 SRPA* 0 0 33 17072 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:38:58.479570 0.021840 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:58.622801 0.235258 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:59.009742 0.389608 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:59.354106 0.165261 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:59.561096 0.260511 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:59.811922 0.085435 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:38:59.982539 0.152207 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:00.331950 0.166047 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:00.493833 0.101409 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:00.746255 0.290400 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:01.093381 0.183057 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:01.270783 0.069986 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:01.445287 0.356264 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:01.781379 0.093487 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:02.241656 0.184395 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:02.422241 0.184437 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:02.605446 0.177652 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:02.767588 0.171805 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:02.916335 0.060126 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:03.268744 0.192941 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:03.453515 0.173634 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:04.132792 0.185550 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:04.310740 0.174972 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:04.476183 0.368550 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:04.815339 0.164900 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:05.019301 0.156132 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:05.233479 0.268910 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:05.468206 0.451080 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:39:06.345888 0.056814 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2019 flow=From-Botnet-V2-UDP-Established 1970/01/17 16:40:59.442436 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 16:41:06.449451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:41:14.741697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:41:30.744549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:42:02.750870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:43:55.833293 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 16:43:55.833555 2.993785 tcp 10.0.2.105 55844 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:44:04.835667 0.000000 tcp 10.0.2.105 55844 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/17 16:44:10.836419 0.030886 tcp 10.0.2.105 55845 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:44:10.867590 0.062751 tcp 10.0.2.105 55846 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:44:10.930597 0.155820 tcp 10.0.2.105 55847 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:44:11.338862 1.268750 tcp 10.0.2.105 55848 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/17 16:48:06.755901 3.002004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 16:48:13.763943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:48:21.765643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:48:37.768536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:49:09.774322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:55:13.781003 3.000942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 16:55:20.787622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:55:28.789687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:55:44.792084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 16:56:16.798228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:02:20.804311 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:02:27.811941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:02:35.813604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:02:51.816077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:03:23.822741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:09:14.407040 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 17:09:14.407293 0.000000 udp 10.0.2.105 7010 -> 108.246.49.50 5831 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:09:27.828565 3.001811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:09:31.423875 0.053088 tcp 10.0.2.105 55849 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:31.477262 0.176440 tcp 10.0.2.105 55850 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:31.653970 0.161723 tcp 10.0.2.105 55851 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:31.816513 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:09:34.836066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:09:42.837004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:09:47.054273 0.030262 tcp 10.0.2.105 55852 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:47.084886 0.067098 tcp 10.0.2.105 55853 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:47.152366 0.158995 tcp 10.0.2.105 55854 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:09:47.311884 0.019716 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:47.331973 0.185093 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:47.517484 0.321794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:47.839682 0.153523 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:47.993602 0.266288 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:48.341097 0.055416 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:48.396934 0.072317 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:48.469689 0.282785 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:48.752859 0.145002 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:48.898249 0.159362 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.058025 0.058520 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.116974 0.174793 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.292161 0.058332 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.350906 0.090708 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.442022 0.179351 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.621747 0.181222 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.803394 0.162585 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:49.966383 0.142131 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.108918 0.055602 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.164933 0.181329 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.346681 0.143489 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.490515 0.180686 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.671656 0.163245 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:50.835332 0.356827 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:51.192638 0.137265 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:09:51.330311 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:09:58.840573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:10:06.672135 0.029637 tcp 10.0.2.105 55855 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:10:06.702044 0.068571 tcp 10.0.2.105 55856 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:10:06.770470 0.158494 tcp 10.0.2.105 55857 -> 195.113.214.236 443 SRPA* 0 0 29 14436 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:10:06.929580 0.236606 udp 10.0.2.105 7010 <-> 190.36.168.112 5723 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:10:07.166630 0.303945 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:10:07.470979 0.038648 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:10:30.846096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:14:12.615878 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 17:14:12.615973 1.014858 tcp 10.0.2.105 55858 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:16:34.852643 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:16:41.859471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:16:50.041642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:17:06.044276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:17:38.050746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:23:42.057050 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:23:49.064044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:23:57.065444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:24:13.068504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:24:45.074617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:30:49.081132 3.000840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:30:56.087657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:31:04.089205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:31:20.092501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:31:52.098325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:37:56.104830 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:38:03.112007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:38:11.113496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:38:27.116687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:38:59.122666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:40:16.053640 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 17:40:16.053886 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:40:32.669022 0.030830 tcp 10.0.2.105 55859 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:32.700116 0.066726 tcp 10.0.2.105 55860 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:32.766693 0.155242 tcp 10.0.2.105 55861 -> 195.113.214.236 443 SRPA* 0 0 32 17640 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:32.922330 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:40:50.773983 0.191674 tcp 10.0.2.105 55862 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:50.965931 0.066856 tcp 10.0.2.105 55863 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:51.033075 0.154425 tcp 10.0.2.105 55864 -> 195.113.214.236 443 SRPA* 0 0 33 24304 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:40:51.187973 0.339621 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:51.528016 0.154158 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:51.682505 0.020279 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:51.703120 0.187813 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:51.891360 0.073361 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:51.965170 0.297350 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.262860 0.144607 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.407891 0.059206 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.467473 0.217631 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.685510 0.064236 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.750161 0.157226 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.907847 0.057782 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:52.966071 0.077275 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.043759 0.178269 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.222452 0.190518 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.413439 0.162325 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.576112 0.145551 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.722024 0.059868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.782303 0.175509 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:53.958221 0.181219 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:54.139866 0.165717 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:54.306004 0.389655 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:54.696070 0.182694 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:54.879213 0.144088 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:55.023752 0.138154 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:40:55.162268 0.000000 udp 10.0.2.105 7010 -> 190.36.168.112 5723 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 17:41:11.042630 0.029773 tcp 10.0.2.105 55865 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:41:11.072762 0.065569 tcp 10.0.2.105 55866 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:41:11.138670 0.158038 tcp 10.0.2.105 55867 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:41:11.296372 0.618807 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:41:11.915573 0.044355 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/17 17:44:13.715268 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 17:44:13.715372 1.013294 tcp 10.0.2.105 55868 -> 128.255.183.224 9027 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/17 17:45:03.128157 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 17:45:10.135587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:45:18.137640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:45:34.140514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:46:06.146538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:52:10.153058 3.000922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:52:17.160112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:52:25.161593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:52:41.164136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:53:13.170317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:59:17.176486 3.001894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 17:59:24.183699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:59:32.185279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 17:59:48.188165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:00:20.194104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:06:24.200667 3.001088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:06:31.207535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:06:39.529784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:06:55.532814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:07:27.538545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:11:38.489968 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 18:11:38.490075 0.000000 udp 10.0.2.105 7010 -> 190.36.168.112 5723 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 18:11:57.278169 0.031302 tcp 10.0.2.105 55869 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 18:11:57.309888 0.065359 tcp 10.0.2.105 55870 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 18:11:57.375622 0.162686 tcp 10.0.2.105 55871 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/17 18:11:57.538907 0.020123 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:57.559481 0.187529 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:57.747424 0.077374 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:57.825223 0.289240 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:58.114829 0.376378 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:58.542542 0.153405 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:58.696529 0.054204 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:58.751076 0.204502 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:58.955997 0.064367 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.020771 0.156008 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.177190 0.151628 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.329221 0.083688 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.413339 0.178453 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.592280 0.058757 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.651376 0.147999 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.799740 0.056290 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:11:59.856421 0.179756 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.036548 0.180719 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.217679 0.164641 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.382691 0.161307 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.544623 0.162519 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.707560 0.136136 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:00.844436 0.348210 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:01.193076 0.185774 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:01.379300 0.145422 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:01.525102 0.381705 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:12:01.907247 0.037925 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:13:31.545163 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:13:38.552055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:13:46.553421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:14:02.558383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:14:14.894995 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 18:14:14.895102 1.042049 tcp 10.0.2.105 55872 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/17 18:14:34.563131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:20:38.568538 3.002295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:20:45.576071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:20:53.577982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:21:09.581050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:21:41.586605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:27:45.592728 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:27:52.600154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:28:00.602476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:28:16.604687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:28:48.610680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:34:52.616460 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:34:59.624023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:35:07.625501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:35:23.628995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:35:55.634493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:41:59.641070 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:42:06.068026 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 18:42:06.068236 0.082834 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:06.151495 0.287326 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:06.439177 0.019823 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:06.459376 0.221985 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:06.648454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:42:06.681788 0.477179 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:07.159593 0.153681 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:07.313704 0.055753 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:07.369833 0.304002 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:07.674260 0.063828 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:07.738518 0.462006 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.200893 0.144572 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.345859 0.073601 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.419797 0.177952 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.598125 0.059437 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.706377 0.143446 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.850171 0.056403 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:08.906991 0.174519 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:09.081892 0.181126 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:09.263454 0.159872 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:09.423740 0.141332 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:09.565468 0.336628 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:09.902486 0.177275 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:10.080103 0.150630 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:10.231066 0.162291 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:10.393697 0.045616 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:10.439743 0.141719 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:10.581833 0.530426 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/17 18:42:14.649492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:42:30.652519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:43:02.658856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:44:15.944299 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 18:44:15.944470 0.947770 tcp 10.0.2.105 55873 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/17 18:49:06.665464 3.000810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:49:13.672057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:49:21.673441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:49:37.676596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:50:09.682328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:56:13.688409 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 18:56:20.695777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:56:28.697620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:56:44.700505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 18:57:16.706625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:03:20.712325 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:03:27.719953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:03:35.721322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:03:51.724904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:04:23.730593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:10:27.736964 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:10:34.743636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:10:42.745696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:10:58.748281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:11:30.754239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:12:38.502184 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 19:12:38.502341 0.083586 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:38.763982 0.296097 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.060491 0.020141 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.081076 0.271801 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.353286 0.234730 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.588459 0.154363 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.743174 0.055798 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.799338 0.155903 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:39.955641 0.144865 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.100937 0.252376 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.353737 0.059922 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.414086 0.073886 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.488355 0.178147 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.666873 0.058979 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.726230 0.147352 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.873929 0.056655 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:40.930939 0.175226 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:41.106608 0.180810 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:41.287806 0.163514 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:41.451728 0.139384 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:41.591545 0.349643 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:41.941610 0.189239 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:42.131181 0.153980 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:42.285583 0.163013 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:42.448966 0.728593 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:43.177980 0.039297 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:12:43.217669 0.144104 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:14:16.894109 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 19:14:16.894333 1.065366 tcp 10.0.2.105 55874 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/17 19:17:34.761348 3.000779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 19:17:41.768148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:17:49.769904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:18:05.772179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:18:37.888930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:24:41.894367 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:24:48.901755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:24:56.903795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:25:12.906355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:25:44.912959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:31:48.918646 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:31:55.925918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:32:03.927662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:32:19.930517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:32:51.936499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:38:55.942120 3.002469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:39:02.949930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:39:10.951665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:39:26.954172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:39:58.960839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:42:53.631951 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 19:42:53.632142 0.020218 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:53.652744 0.187489 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:53.840632 0.083448 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:53.924524 0.303296 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:54.228232 0.258128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:54.486775 0.155885 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:54.643077 0.058278 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:54.701695 0.236582 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:54.938613 0.144790 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.083737 0.235703 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.319866 0.064730 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.384919 0.085572 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.470899 0.178193 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.649480 0.064485 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.714413 0.143178 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.857930 0.058300 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:55.916592 0.175836 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:56.092784 0.179880 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:56.273034 0.161951 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:56.435425 0.138930 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:56.574696 0.348815 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:56.923903 0.184174 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:57.108531 0.147335 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:57.256392 0.040599 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:57.297360 0.147631 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:57.445407 0.161965 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:42:57.607858 0.327482 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/17 19:44:18.013868 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 19:44:18.014009 1.257519 tcp 10.0.2.105 55875 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/17 19:46:02.966506 3.002001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 19:46:09.974036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:46:17.975714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:46:33.978313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:47:05.984509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:53:09.992212 2.999735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 19:53:16.998090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:53:24.999958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:53:41.002169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 19:54:13.008251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:00:17.014229 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:00:24.132023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:00:32.133801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:00:48.136765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:01:20.142552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:07:24.149182 3.001213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:07:31.155953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:07:39.157179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:07:55.160224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:08:27.166280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:13:21.330153 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 20:13:21.330255 0.081697 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:21.412535 0.290143 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:21.703040 0.019971 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:21.723480 0.188330 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:21.912220 0.361959 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:22.274596 0.151857 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:22.426871 0.055525 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:22.482811 0.155029 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:22.638246 0.151491 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:22.790160 0.294592 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.085185 0.058612 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.144192 0.073747 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.218352 0.178815 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.397583 0.058565 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.456539 0.143037 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.599916 0.058366 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.658634 0.174143 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:23.833199 0.177946 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:24.011520 0.165432 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:24.177350 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 20:13:39.268184 0.052897 tcp 10.0.2.105 55876 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:13:39.321350 0.065371 tcp 10.0.2.105 55877 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:13:39.386987 0.161092 tcp 10.0.2.105 55878 -> 195.113.214.236 443 SRPA* 0 0 26 16322 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:13:39.548637 0.375220 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:39.924208 0.189391 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:40.114036 0.148545 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:40.262920 0.040367 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:40.303640 0.261976 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:40.565977 0.149627 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:13:40.715975 0.162703 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:14:19.323122 1.224147 tcp 10.0.2.105 55879 -> 128.255.183.224 9027 FSPA* 0 0 14 1671 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:14:31.172617 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 20:14:38.179642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:14:46.181616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:15:02.184316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:15:34.190201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:21:38.196791 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:21:45.203925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:21:53.205444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:22:09.208493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:22:41.214295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:28:45.221091 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:28:52.228141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:29:00.229424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:29:16.232095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:29:48.238127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:35:52.244129 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:35:59.252062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:36:07.253452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:36:23.256182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:36:55.263260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:42:59.269335 3.000855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:43:06.276068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:43:14.277306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:43:30.280166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:44:00.874308 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 20:44:00.874403 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 20:44:02.286075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:44:18.082525 0.052867 tcp 10.0.2.105 55880 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:44:18.135658 0.073446 tcp 10.0.2.105 55881 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:44:18.209393 0.278317 tcp 10.0.2.105 55882 -> 195.113.214.236 443 SRPA* 0 0 79 87114 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:44:18.488334 0.020202 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:18.508889 0.163836 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:18.673143 0.387200 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.060750 0.076594 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.137716 0.292264 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.430405 0.056705 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.487503 0.156644 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.644569 0.144981 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.789961 0.193355 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:19.983765 0.152683 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.136850 0.104732 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.241990 0.179678 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.422086 0.064162 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.486670 0.175868 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.552806 0.999563 tcp 10.0.2.105 55883 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/17 20:44:20.663357 0.180690 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:20.844402 0.165440 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.010191 0.063189 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.073798 0.151684 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.225859 0.058357 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.284572 0.189702 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.474651 0.152656 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.627726 0.045810 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:21.673935 0.339710 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:22.014019 0.161571 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:22.176017 0.434137 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:44:22.610574 0.146488 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/17 20:50:06.291982 3.001809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:50:13.299492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:50:21.301262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:50:37.304355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:51:09.310474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:57:13.317251 3.000597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 20:57:20.323767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:57:28.325458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:57:44.328089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 20:58:16.334261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:04:20.340834 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:04:27.347938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:04:35.349617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:04:51.352416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:05:23.358230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:11:27.365169 3.000738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:11:34.371356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:11:42.373137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:11:58.376068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:12:30.381953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:14:21.552769 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 21:14:21.552881 1.076372 tcp 10.0.2.105 55884 -> 128.255.183.224 9027 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/01/17 21:14:38.306701 0.453055 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:38.760100 0.078040 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:38.838532 0.020108 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:38.859006 0.164297 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.023732 0.303616 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.327817 0.052275 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.380516 0.155951 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.536834 0.138043 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.675301 0.242907 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:39.918636 0.153881 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.072912 0.071705 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.145039 0.180578 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.325993 0.059548 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.385952 0.176053 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.562352 0.181646 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.744572 0.166064 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.910971 0.058650 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:40.969977 0.147244 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.117565 0.061756 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.179747 0.039741 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.219918 0.408070 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.628434 0.163233 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.792058 0.188427 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:41.980954 0.151842 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:42.133216 0.391578 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:42.525182 0.146091 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:14:46.588492 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 21:18:34.388681 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:18:41.395402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:18:49.397253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:19:05.400511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:19:37.406307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:25:41.412902 3.000957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:25:48.419830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:25:56.421427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:26:12.424672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:26:44.430078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:32:48.436511 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:32:55.443900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:33:03.445576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:33:19.447893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:33:51.454104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:39:55.461082 3.000784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:40:02.467340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:40:10.469437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:40:26.472377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:40:58.477802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:44:22.632120 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 21:44:22.632225 1.311537 tcp 10.0.2.105 55885 -> 128.255.183.224 9027 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/01/17 21:45:01.738246 0.020452 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:01.759108 0.167356 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:01.926835 0.292520 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:02.219719 0.054766 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:02.274875 0.374467 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:02.649804 0.080432 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:02.730578 0.153291 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:02.886570 0.138651 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:03.025627 0.257473 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:03.283587 0.153103 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:03.437158 0.084483 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:03.522013 0.180379 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:03.702775 0.376321 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.079543 0.174252 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.254228 0.180799 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.435402 0.163712 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.599583 0.057522 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.657543 0.145182 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.803191 0.061382 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.864987 0.039025 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:04.904471 0.194030 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:05.098912 0.150310 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:05.249625 0.336860 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:05.586813 0.161896 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:05.749176 0.532622 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:06.282213 0.146962 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/17 21:45:06.594672 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 21:47:02.485160 3.000828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 21:47:09.491699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:47:17.493249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:47:33.496074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:48:05.501764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:54:09.508483 3.001188 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 21:54:16.515582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:54:24.517276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:54:40.519684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 21:55:12.526010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:01:16.532840 3.000871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:01:23.539244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:01:31.540957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:01:47.543785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:02:19.550132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:08:23.556014 3.001752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:08:30.563095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:08:38.565046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:08:54.568460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:09:26.574232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:14:23.952258 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 22:14:23.952450 1.080053 tcp 10.0.2.105 55886 -> 128.255.183.224 9027 FSPA* 0 0 15 1703 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:15:23.047331 0.288941 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:23.336656 0.124252 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:23.461269 0.020312 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:23.481946 0.166887 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:23.649295 0.375480 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.025203 0.080336 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.105973 0.156436 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.262733 0.152015 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.415164 0.193370 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.608920 0.153920 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.763204 0.094558 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:24.858144 0.180720 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.039322 0.063219 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.102968 0.173466 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.276828 0.181064 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.458303 0.159807 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.618628 0.065492 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.684636 0.142929 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.827936 0.060668 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.888995 0.045135 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:25.934532 0.176759 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:26.111645 0.151578 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:26.263600 0.000000 udp 10.0.2.105 7010 -> 79.6.196.105 3797 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 22:15:27.623288 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 22:15:30.610287 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 22:15:37.617196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:15:42.445682 0.054931 tcp 10.0.2.105 55887 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:15:42.500840 0.074493 tcp 10.0.2.105 55888 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:15:42.575580 0.161008 tcp 10.0.2.105 55889 -> 195.113.214.236 443 SRPA* 0 0 47 41970 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:15:42.737078 0.337829 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:43.075290 0.162543 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:43.238279 0.146530 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:15:45.619051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:16:01.621916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:16:34.128442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:22:38.136719 2.999593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:22:45.142194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:22:53.143439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:23:09.147023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:23:41.153142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:29:45.158092 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:29:52.165813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:30:00.167641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:30:16.170406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:30:48.176466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:36:52.183074 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:36:59.190109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:37:07.191436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:37:23.194978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:37:55.671638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:43:59.677959 3.001095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:44:06.684838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:44:14.685975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:44:25.532388 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 22:44:25.532581 1.008165 tcp 10.0.2.105 55890 -> 128.255.183.224 9027 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:44:30.689246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:45:02.695552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:46:12.065772 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 22:46:12.065874 0.513473 udp 10.0.2.105 7010 <-> 79.6.196.105 3797 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:12.579690 0.300007 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:12.880121 0.020575 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:12.901081 0.175940 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:13.077432 0.597007 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:13.674807 0.077137 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:13.752384 0.153295 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:13.906089 0.053540 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:13.960021 0.137954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.098374 0.071391 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.170185 0.182274 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.352885 0.145263 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.498490 0.174929 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.673753 0.217127 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:14.891244 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 22:46:32.216004 0.053614 tcp 10.0.2.105 55891 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:46:32.269883 0.075387 tcp 10.0.2.105 55892 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:46:32.345618 0.151361 tcp 10.0.2.105 55893 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/17 22:46:32.497042 0.159043 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:32.656648 0.069211 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:32.726248 0.145242 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:32.871843 0.059533 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:32.931808 0.038349 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:32.970610 0.190931 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:33.161964 0.152804 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:33.315171 0.179755 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:33.495327 0.142972 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:33.638930 0.352593 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:46:33.991868 0.162108 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/17 22:51:06.702271 3.000779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:51:13.709037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:51:21.709919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:51:37.713035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:52:09.719452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:58:13.725755 3.000840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 22:58:20.732752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:58:28.734003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:58:44.737024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 22:59:16.743068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:05:20.748574 3.002412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:05:27.756692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:05:35.758657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:05:51.761532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:06:23.767598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:12:27.772839 3.002349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:12:34.780399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:12:42.781964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:12:58.785212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:13:30.790821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:14:26.542202 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 23:14:26.542399 2.047055 tcp 10.0.2.105 55894 -> 128.255.183.224 9027 FSPA* 0 0 12 1619 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:17:04.128300 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 23:17:04.128462 0.444264 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:04.573118 0.382536 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:04.956083 0.458117 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:05.414600 0.000000 udp 10.0.2.105 7010 -> 79.6.196.105 3797 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 23:17:23.117537 0.754133 tcp 10.0.2.105 55895 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:17:23.871898 0.668397 tcp 10.0.2.105 55896 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:17:24.540570 1.361458 tcp 10.0.2.105 55897 -> 195.113.214.236 443 SRPA* 0 0 22 13128 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:17:25.902642 0.545265 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:26.448332 0.422327 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:26.871006 0.421446 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:27.292852 0.600527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:27.893750 0.411310 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:28.305408 0.420742 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:28.726528 0.353224 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:29.080193 0.421784 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:29.502416 0.566808 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:30.069618 0.455097 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:30.525138 0.366969 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:30.892723 0.391938 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:31.284991 0.433810 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:31.719237 0.314191 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:32.033847 0.436407 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:32.470666 0.397291 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:32.868375 0.427838 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:33.296625 0.435402 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:33.732441 0.495670 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:34.228701 0.434627 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:34.663747 0.676600 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:17:35.340676 0.464433 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:19:34.796614 3.003740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/17 23:19:41.804756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:19:49.806055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:20:05.809225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:20:37.815229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:26:41.820948 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:26:48.828552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:26:56.829672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:27:12.832796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:27:44.839199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:33:48.845208 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:33:55.852862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:34:03.853654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:34:19.856608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:34:51.862695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:40:55.869261 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:41:02.876150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:41:10.877683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:41:26.880585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:41:58.887210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:44:28.592552 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 23:44:28.592661 2.004411 tcp 10.0.2.105 55898 -> 128.255.183.224 9027 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:02.893813 3.000649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:48:04.412668 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/17 23:48:04.412776 0.000000 udp 10.0.2.105 7010 -> 79.6.196.105 3797 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 23:48:09.900522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:48:17.901997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:48:19.756476 0.671299 tcp 10.0.2.105 55899 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:20.427624 0.665872 tcp 10.0.2.105 55900 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:21.093774 1.356141 tcp 10.0.2.105 55901 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:22.450530 0.519629 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:22.970508 0.386642 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:23.357521 0.473747 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:23.831673 0.595176 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:24.427287 0.441805 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:24.869498 0.399587 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:25.269456 0.909047 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:26.178907 0.327727 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:26.506990 0.420653 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:26.928071 0.400788 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:27.329299 0.481085 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:27.810775 0.531747 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:28.342914 0.447298 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:28.790613 0.363085 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:29.154091 0.313539 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:29.468049 0.431224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:29.899610 0.403153 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:30.303198 0.454772 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:30.758337 0.431039 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:31.189777 0.475394 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:31.665516 0.471551 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:32.137457 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/17 23:48:33.905071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:48:50.589632 0.688140 tcp 10.0.2.105 55902 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:51.277976 0.649350 tcp 10.0.2.105 55903 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:51.927644 1.344322 tcp 10.0.2.105 55904 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/17 23:48:53.272808 0.395068 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:53.668404 0.664045 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:48:54.332884 0.473597 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/17 23:49:05.911277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:55:09.917076 3.001303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/17 23:55:16.924099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:55:24.926069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:55:40.928689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/17 23:56:12.934634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:02:16.941247 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:02:23.947994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:02:31.950010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:02:47.953055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:03:19.958521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:09:23.965294 3.000987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:09:30.971949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:09:38.973527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:09:54.976877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:10:26.982724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:14:30.604049 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 00:14:30.604409 2.174140 tcp 10.0.2.105 55905 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/18 00:16:31.109363 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:16:38.116730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:16:46.118214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:17:02.120861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:17:34.126824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:19:07.892340 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 00:19:07.892445 0.418602 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:08.311476 0.468042 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:08.779881 0.513499 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:09.293803 0.339305 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:09.633541 0.576716 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:10.210595 0.451282 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:10.662239 0.401099 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:11.063674 0.448852 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:11.512978 0.454250 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:11.967630 0.738219 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:12.706231 0.388805 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:13.095376 0.456664 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:13.552551 0.518974 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:14.071965 0.580049 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:14.652449 0.308651 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:14.961509 0.289395 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:15.251340 0.447104 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:15.698848 0.383488 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:16.082690 0.444116 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:16.527200 0.527555 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:17.055110 0.355413 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:17.410941 0.434732 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:17.846114 0.513515 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:18.360076 0.673293 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:19:19.033693 0.834820 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:23:38.133132 3.001405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:23:45.140142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:23:53.142347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:24:09.145135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:24:41.151283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:30:45.157336 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:30:52.164052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:31:00.166084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:31:16.168676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:31:48.175247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:37:53.202661 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:38:00.210060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:38:08.211590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:38:24.214010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:38:56.220209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:44:33.295956 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 00:44:33.296054 1.903293 tcp 10.0.2.105 55906 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/18 00:45:00.226932 3.001234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:45:07.233859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:45:15.235464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:45:31.237934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:46:03.244805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:49:28.630005 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 00:49:28.630119 0.477351 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:29.107915 0.489636 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:29.597979 0.604842 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:30.203166 0.550629 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:30.754225 0.361842 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:31.116534 0.399276 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:31.516378 0.398765 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:31.915498 0.450872 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:32.366753 0.428156 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:32.795289 0.659984 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:33.455704 0.337358 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:33.793599 0.458785 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:34.252822 0.483192 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:34.736398 0.529280 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:35.266312 0.356053 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:35.622773 0.303767 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:35.926899 0.339766 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:36.267089 0.422118 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:36.689564 0.540324 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:37.230306 0.512414 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:37.743082 0.396287 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:38.139823 0.415926 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:38.556179 0.486330 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:39.042943 0.698750 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:49:39.742090 0.957670 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/18 00:52:07.251007 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:52:14.257510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:52:22.259097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:52:38.262396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:53:10.268396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:59:14.284484 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 00:59:21.291584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:59:29.292913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 00:59:45.296505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:00:17.302085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:06:21.308596 3.001057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:06:28.315705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:06:36.317231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:06:52.320290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:07:24.326328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:13:28.332006 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:13:35.339777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:13:43.340997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:13:59.344172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:14:31.350061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:14:35.216168 0.000202 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 01:14:35.216471 2.103695 tcp 10.0.2.105 55907 -> 128.255.183.224 9027 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/01/18 01:19:48.936869 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 01:19:48.937561 0.432455 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:49.370471 0.427277 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:49.798176 0.542037 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:50.340657 0.459913 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:50.800981 0.306425 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:51.107752 0.352199 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:51.460546 0.497950 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:51.958878 0.438922 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:52.398176 0.365176 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:52.763727 0.429016 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:53.193188 0.839423 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:54.033026 0.326606 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:54.360048 0.458780 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:54.819244 0.515612 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:55.335329 0.331170 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:55.666883 0.361228 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:56.028538 0.312296 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:56.341169 0.416795 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:56.758364 0.513118 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:57.271872 0.529569 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:57.801849 0.345542 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:58.147783 0.424623 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:58.572797 0.479065 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:59.052220 0.684003 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:19:59.736652 1.002647 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:20:35.356123 3.002126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 01:20:42.363900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:20:50.365001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:21:06.368132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:21:38.374302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:27:42.380386 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:27:49.387728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:27:57.389323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:28:13.391968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:28:45.398601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:34:49.404536 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:34:57.302832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:35:05.304021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:35:21.307399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:35:53.313291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:41:57.319928 3.000757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:42:04.326957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:42:12.328043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:42:28.331450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:43:00.337579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:44:37.758001 0.000214 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 01:44:37.758319 1.943136 tcp 10.0.2.105 55908 -> 128.255.183.224 9027 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/18 01:49:04.344192 3.000789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:49:11.350409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:49:19.352232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:49:35.354922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:50:07.361214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:50:10.225624 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 01:50:10.225713 0.652586 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:10.878740 0.502010 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:11.381096 0.472474 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:11.853974 0.492616 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:12.347003 0.348653 udp 10.0.2.105 7010 <-> 130.149.89.67 1878 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:12.696086 0.427482 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:13.124037 0.558848 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:13.683334 0.532305 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:14.216054 0.488071 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:14.704632 0.436598 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:15.141683 0.632578 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:15.774724 0.341469 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:16.116645 0.463153 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:16.580256 0.581187 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:17.161852 0.296927 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:17.459130 0.314253 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:17.773808 0.378395 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:18.152664 0.450406 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:18.603511 0.518651 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:19.122593 0.538567 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:20.700875 0.317504 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:21.018779 0.398572 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:21.417708 0.537454 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:21.955956 0.679060 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:50:22.635424 0.956944 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 01:56:11.367218 3.001750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 01:56:18.374587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:56:26.376019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:56:42.379390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 01:57:14.385526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:03:18.391714 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:03:25.398430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:03:33.399952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:03:49.403216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:04:21.408998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:10:25.415057 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:10:32.422840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:10:40.424016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:10:56.427227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:11:28.433043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:14:39.708830 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:14:39.708930 1.055493 tcp 10.0.2.105 55909 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:17:32.438703 3.182604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:17:39.626930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:17:47.628078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:18:03.631561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:18:35.637392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:20:31.424135 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:20:31.424239 0.295946 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:31.720784 0.180019 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:31.901171 0.153901 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:32.055468 0.164595 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:32.220532 0.000000 udp 10.0.2.105 7010 -> 130.149.89.67 1878 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:20:49.111990 0.057917 tcp 10.0.2.105 55910 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:20:49.170193 0.071106 tcp 10.0.2.105 55911 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:20:49.241595 0.161312 tcp 10.0.2.105 55912 -> 195.113.214.236 443 SRPA* 0 0 42 23254 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:20:49.403505 0.078194 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:49.482107 0.155905 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:49.638470 0.174335 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:49.813140 0.144792 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:49.958358 0.063727 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:50.022500 0.423671 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:50.446595 0.056211 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:50.503221 0.180470 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:50.684064 0.282865 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:20:50.967372 0.000000 udp 10.0.2.105 7010 -> 79.23.200.237 2691 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:21:07.876826 0.052145 tcp 10.0.2.105 55913 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:21:07.929279 0.073903 tcp 10.0.2.105 55914 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:21:08.003556 0.155717 tcp 10.0.2.105 55915 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:21:08.158172 0.059302 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.217907 0.044584 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.262928 0.144332 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.407598 0.162339 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.570359 0.178347 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.749065 0.058918 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.808351 0.150692 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:08.959481 0.145596 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:09.105488 0.362807 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:21:09.468774 0.163999 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:24:39.644272 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 02:24:46.651023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:24:54.652169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:25:10.655243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:25:42.661514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:31:47.289027 3.001145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:31:54.295493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:32:02.297219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:32:18.299897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:32:50.306099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:38:54.312820 3.001126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:39:01.319923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:39:09.320802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:39:25.324108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:39:57.329884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:44:41.138734 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:44:41.138831 1.218836 tcp 10.0.2.105 55916 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:46:01.336738 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 02:46:08.343359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:46:16.345189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:46:32.348337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:47:04.354102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:51:26.551201 0.643288 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:51:27.196044 0.000000 udp 10.0.2.105 7010 -> 130.149.89.67 1878 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:51:43.146741 0.053097 tcp 10.0.2.105 55917 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:51:43.200179 0.074748 tcp 10.0.2.105 55918 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:51:43.275260 0.157703 tcp 10.0.2.105 55919 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/18 02:51:43.433649 0.072366 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:43.506631 0.171699 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:43.678760 0.155185 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:43.834278 0.175403 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.010132 0.298062 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.308753 0.081015 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.390226 0.144887 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.535529 0.083196 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.619112 0.174730 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.794256 0.155174 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:44.949879 0.182833 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.133136 0.224689 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.358254 0.266851 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.625592 0.049448 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.675423 0.057258 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.733090 0.044602 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.778058 0.145352 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:45.923720 0.158356 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.082405 0.184133 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.266941 0.058345 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.325670 0.153867 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.480812 0.148506 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.629715 0.337872 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:51:46.967959 0.181087 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:52:46.093955 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/01/18 02:52:59.886700 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/01/18 02:52:59.890826 0.077020 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:52:59.968472 0.154433 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.123454 0.174171 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.298087 0.299878 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.598539 0.073093 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.672211 0.144922 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.817702 0.168106 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:00.986285 0.062837 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:01.049617 0.175879 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:01.225959 0.283520 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:01.510046 0.178599 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:01.689097 0.268714 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:01.958397 0.314307 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.273149 0.056322 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.329956 0.056846 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.387268 0.047269 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.435030 0.146796 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.582351 0.160533 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.743331 0.185155 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.928965 0.061668 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:02.991159 0.152962 udp 10.0.2.105 7010 <-> 74.141.181.225 5866 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:03.144692 0.146492 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:03.291642 0.165498 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:03.457751 0.371811 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/18 02:53:03.830324 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:53:10.332590 0.000000 udp 10.0.2.105 7010 -> 173.25.151.56 2703 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:53:20.311305 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:53:27.782999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 1 146 flow=Background 1970/01/18 02:53:44.125989 0.000000 udp 10.0.2.105 7010 -> 120.63.204.82 5366 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:53:44.472600 1.978453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/18 02:53:48.585054 0.113217 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:53:50.498656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:53:51.452387 0.000000 udp 10.0.2.105 7010 -> 84.170.177.49 3546 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:53:58.377372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:53:59.190029 0.000000 udp 10.0.2.105 7010 -> 77.96.161.186 5809 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:06.442151 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:11.860627 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:28.633226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:54:31.246389 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:54:31.405310 0.000000 udp 10.0.2.105 7010 -> 173.240.26.185 8531 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:42.301226 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:51.036911 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1613 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:54:56.906237 0.000000 udp 10.0.2.105 7010 -> 12.181.169.190 7070 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:55:01.588522 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:55:04.260184 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:55:05.382530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 02:55:09.428742 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:55:57.597014 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:02.715314 0.108874 udp 10.0.2.105 7010 -> 82.53.113.216 2254 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:02.824188 0.000000 icmp 82.53.113.216 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 226 flow=Background 1970/01/18 02:56:07.641468 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:56:11.557226 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:18.957781 0.000000 udp 10.0.2.105 7010 -> 4.26.209.110 8611 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:25.187200 0.000000 udp 10.0.2.105 7010 -> 120.62.12.235 9870 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:33.208616 0.000000 udp 10.0.2.105 7010 -> 173.161.31.218 4015 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:38.145400 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:56:40.749481 0.000000 udp 10.0.2.105 7010 -> 94.34.143.202 9141 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:47.328767 0.000000 udp 10.0.2.105 7010 -> 79.248.148.153 3526 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:56:53.077167 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:00.507636 0.000000 udp 10.0.2.105 7010 -> 184.163.157.196 3552 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:05.144066 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:57:06.155743 0.000000 udp 10.0.2.105 7010 -> 95.33.185.175 5164 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:12.945639 0.000000 udp 10.0.2.105 7010 -> 87.151.124.80 1441 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:20.867035 0.000000 udp 10.0.2.105 7010 -> 217.35.102.24 7881 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:27.255961 0.000000 udp 10.0.2.105 7010 -> 79.8.187.208 7781 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:32.142979 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:57:32.713965 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:38.823160 0.000000 udp 10.0.2.105 7010 -> 93.193.153.79 7662 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:46.944224 0.000000 udp 10.0.2.105 7010 -> 85.206.31.102 8361 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:53.543914 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:57:58.140104 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:58:00.263657 0.000000 udp 10.0.2.105 7010 -> 83.22.53.236 7393 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:05.571278 0.000000 udp 10.0.2.105 7010 -> 67.79.80.108 8176 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:11.489515 0.000000 udp 10.0.2.105 7010 -> 182.68.137.86 5273 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:16.948158 0.000000 udp 10.0.2.105 7010 -> 95.246.203.148 5404 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:25.229611 0.000000 udp 10.0.2.105 7010 -> 84.104.134.48 9519 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:30.145923 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:58:32.800816 0.000000 udp 10.0.2.105 7010 -> 80.89.80.173 8214 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:38.047843 0.000000 udp 10.0.2.105 7010 -> 82.63.130.191 4657 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:45.058164 0.000000 udp 10.0.2.105 7010 -> 87.23.134.37 7679 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:51.217334 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:58:56.143287 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:58:56.243700 0.000000 udp 10.0.2.105 7010 -> 46.236.139.244 7454 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:04.315509 0.000000 udp 10.0.2.105 7010 -> 217.36.212.201 6979 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:10.484278 0.000000 udp 10.0.2.105 7010 -> 119.74.203.111 4508 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:17.424380 0.000000 udp 10.0.2.105 7010 -> 212.36.45.227 1686 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:22.141141 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:59:22.791900 0.000000 udp 10.0.2.105 7010 -> 41.82.12.234 9671 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:28.079866 0.000000 udp 10.0.2.105 7010 -> 89.148.189.101 1620 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:33.188994 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:39.596961 0.000000 udp 10.0.2.105 7010 -> 50.126.243.50 8503 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:47.087163 0.000000 udp 10.0.2.105 7010 -> 78.92.226.23 4606 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 02:59:51.643475 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 02:59:55.018786 0.000000 udp 10.0.2.105 7010 -> 82.14.222.51 7687 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:03.060147 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:10.982091 0.168731 udp 10.0.2.105 7010 -> 110.234.8.144 7208 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:11.150822 0.000000 icmp 110.234.8.144 0x0303 -> 10.0.2.105 0x281c URP 192 1 302 flow=Background 1970/01/18 03:00:15.637909 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:00:18.202104 0.000000 udp 10.0.2.105 7010 -> 90.208.221.240 9017 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:26.270085 0.000000 udp 10.0.2.105 7010 -> 213.182.89.178 2702 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:34.014330 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:39.042051 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 5701 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:43.638586 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:00:46.863157 0.000000 udp 10.0.2.105 7010 -> 95.242.58.78 6720 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:00:54.073465 0.000000 udp 10.0.2.105 7010 -> 220.233.233.205 7904 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:02.275509 0.135218 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:01:02.525602 0.000000 udp 10.0.2.105 7010 -> 109.255.79.150 3826 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:09.375729 0.000000 udp 10.0.2.105 7010 -> 84.92.215.184 9630 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:14.141975 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:01:16.035252 0.044137 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:01:16.102283 0.000000 udp 10.0.2.105 7010 -> 86.136.162.219 1255 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:24.948722 0.000000 udp 10.0.2.105 7010 -> 94.216.55.12 8964 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:30.045273 0.000000 udp 10.0.2.105 7010 -> 82.135.37.18 1624 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:35.393331 0.000000 udp 10.0.2.105 7010 -> 151.64.220.6 4148 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:40.139802 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:01:42.102929 0.000000 udp 10.0.2.105 7010 -> 80.7.161.7 7976 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:49.004796 3.002151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 03:01:50.815368 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:01:56.011912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:01:57.235097 0.000000 udp 10.0.2.105 7010 -> 118.39.80.146 3821 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:02.543164 0.000000 udp 10.0.2.105 7010 -> 79.54.199.83 3768 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:04.013657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:02:07.138802 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:02:07.709509 0.000000 udp 10.0.2.105 7010 -> 82.6.23.15 3475 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:16.612699 0.000000 udp 10.0.2.105 7010 -> 24.164.71.63 8550 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:20.017474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:02:22.751080 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:29.953354 0.271904 udp 10.0.2.105 7010 -> 59.97.57.173 6298 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:30.225258 0.000000 icmp 59.97.57.173 0x0303 -> 10.0.2.105 0x9a18 URP 192 1 245 flow=Background 1970/01/18 03:02:34.637876 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:02:36.911671 0.000000 udp 10.0.2.105 7010 -> 115.108.181.233 7094 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:43.661640 0.000000 udp 10.0.2.105 7010 -> 95.239.124.160 9533 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:49.769866 0.000000 udp 10.0.2.105 7010 -> 165.145.81.35 9653 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:52.023506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:02:55.649059 0.078932 udp 10.0.2.105 7010 -> 93.70.219.108 5486 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:02:55.727991 0.000000 icmp 93.70.219.108 0x0303 -> 10.0.2.105 0x6e15 URP 192 1 215 flow=Background 1970/01/18 03:03:00.645463 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:03:04.511528 0.382521 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:03:05.425169 0.000000 udp 10.0.2.105 7010 -> 194.228.84.182 6003 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:10.960446 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:18.461669 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:26.853241 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:31.639521 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:03:34.144062 0.000000 udp 10.0.2.105 7010 -> 122.161.76.207 6723 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:39.692282 0.000000 udp 10.0.2.105 7010 -> 109.111.210.82 6134 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:46.291563 0.362886 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:03:46.690094 0.000000 udp 10.0.2.105 7010 -> 122.162.94.55 9031 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:54.542960 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:03:59.140116 0.000282 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:04:03.095637 0.000000 udp 10.0.2.105 7010 -> 87.139.162.32 6381 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:08.553430 0.174388 udp 10.0.2.105 7010 <-> 75.46.81.240 2831 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:04:08.753621 0.097937 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:04:08.892275 0.000000 udp 10.0.2.105 7010 -> 94.120.137.121 3260 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:14.221638 0.000000 udp 10.0.2.105 7010 -> 58.8.29.190 9422 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:19.999596 0.054551 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:04:20.081042 0.000000 udp 10.0.2.105 7010 -> 88.77.95.202 4638 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:24.645930 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:04:25.717887 0.150898 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:04:25.877282 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 4856 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:33.569188 0.000000 udp 10.0.2.105 7010 -> 91.16.163.44 2194 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:41.099899 0.000000 udp 10.0.2.105 7010 -> 108.178.66.206 9252 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:47.109313 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:04:51.644999 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:04:55.340300 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:02.571117 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:07.758331 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 9979 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:15.509268 0.074690 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:05:15.722124 0.000000 udp 10.0.2.105 7010 -> 217.40.227.161 1026 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:20.146558 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:05:21.547803 0.404580 udp 10.0.2.105 7010 <-> 58.23.23.30 1666 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:05:21.990178 0.000000 udp 10.0.2.105 7010 -> 88.64.251.170 6222 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:30.162058 0.000000 udp 10.0.2.105 7010 -> 46.10.66.127 1744 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:38.111830 0.000000 udp 10.0.2.105 7010 -> 41.155.22.224 2113 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:43.629647 0.000000 udp 10.0.2.105 7010 -> 79.166.58.22 9017 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:48.146846 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:05:50.949915 0.000000 udp 10.0.2.105 7010 -> 86.122.168.189 9920 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:05:57.098932 0.000000 udp 10.0.2.105 7010 -> 78.35.212.140 3361 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:05.902784 0.000000 udp 10.0.2.105 7010 -> 31.192.32.232 6250 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:14.744884 0.000000 udp 10.0.2.105 7010 -> 79.59.31.132 4233 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:19.643985 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:06:21.104975 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:30.086303 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:37.166738 0.146102 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:06:37.633677 0.000000 udp 10.0.2.105 7010 -> 84.253.45.7 2075 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:45.969423 0.000000 udp 10.0.2.105 7010 -> 80.2.88.76 1258 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:06:50.646265 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:06:52.891249 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:07:01.241625 0.053253 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 860 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:07:01.307065 0.000000 udp 10.0.2.105 7010 -> 99.1.194.158 9337 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:07:09.663626 0.214769 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:07:09.931095 0.000000 udp 10.0.2.105 7010 -> 64.199.2.66 2291 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:07:14.642711 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:08:56.029240 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 03:09:03.036569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:09:11.037623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:09:27.042723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:09:59.047298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:16:03.053109 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:16:10.060157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:16:15.969544 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:16:15.969635 0.987569 tcp 10.0.2.105 55920 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:16:18.061917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:16:34.065112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:17:06.070982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:23:10.076429 3.002056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:23:17.083967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:23:25.085354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:23:41.088984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:24:14.693696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:30:17.110359 3.002338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:30:24.118050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:30:32.119948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:30:48.122706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:31:20.128799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:37:24.134505 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:37:31.143272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:37:38.473102 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:37:38.473197 0.077481 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:38.551095 0.154420 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:38.705987 0.176814 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:38.883280 0.296830 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.143755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:37:39.180485 0.070934 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.251859 0.144786 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.397078 0.182035 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.579512 0.182352 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.762257 0.060305 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:39.823007 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:37:55.147415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:37:58.205261 0.056850 tcp 10.0.2.105 55921 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:37:58.262359 0.077783 tcp 10.0.2.105 55922 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:37:58.340501 0.166473 tcp 10.0.2.105 55923 -> 195.113.214.236 443 SRPA* 0 0 44 28270 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:37:58.507596 0.154112 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:58.662166 0.244493 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:58.907045 0.284461 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:37:59.191936 0.000000 udp 10.0.2.105 7010 -> 86.130.11.75 6786 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:38:17.700826 0.053269 tcp 10.0.2.105 55924 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:17.753963 0.077264 tcp 10.0.2.105 55925 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:17.831538 0.178915 tcp 10.0.2.105 55926 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:18.010436 0.060735 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:18.071654 0.045511 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:18.117589 0.140777 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:18.258749 0.162693 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:18.421833 0.175662 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:18.598024 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 5866 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:38:27.153353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:38:36.106033 0.052405 tcp 10.0.2.105 55927 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:36.158772 0.130898 tcp 10.0.2.105 55928 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:36.289921 0.161374 tcp 10.0.2.105 55929 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:36.451495 0.144170 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:36.596049 0.161368 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:36.757767 0.341812 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:37.099999 0.059079 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:37.159421 0.120732 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:37.280597 0.041429 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:37.322478 0.387911 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:37.710846 0.357199 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.068694 0.093065 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.162161 0.167993 udp 10.0.2.105 7010 <-> 75.46.81.240 2831 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.330551 0.054506 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.385413 0.147241 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.533091 0.072647 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:38.606096 0.000000 udp 10.0.2.105 7010 -> 58.23.23.30 1666 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 03:38:53.891968 0.051241 tcp 10.0.2.105 55930 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:53.943542 0.069573 tcp 10.0.2.105 55931 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:54.013395 0.159422 tcp 10.0.2.105 55932 -> 195.113.214.236 443 SRPA* 0 0 41 22080 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:38:54.173475 0.145381 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:54.319227 0.054874 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:38:54.374468 0.216380 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 03:45:30.163493 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:45:37.171176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:45:45.176663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:46:01.176684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:46:16.960135 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 03:46:16.960406 1.221463 tcp 10.0.2.105 55933 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/18 03:46:33.182516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:52:45.189198 3.154881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 03:52:52.320572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:53:00.256793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:53:16.211172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:53:48.217565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 03:59:55.228666 3.002201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:00:02.234816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:00:10.236409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:00:26.239372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:00:58.246034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:07:02.252283 3.000835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:07:09.794077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:07:17.703118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:07:33.527019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:08:05.279698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:09:18.995915 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 04:09:18.996032 0.175234 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:19.171644 0.056001 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:19.228001 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 5866 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 04:09:34.900403 0.053423 tcp 10.0.2.105 55934 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:34.954098 0.072747 tcp 10.0.2.105 55935 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:35.027151 0.175091 tcp 10.0.2.105 55936 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:35.203622 0.000000 udp 10.0.2.105 7010 -> 58.23.23.30 1666 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 04:09:53.355429 0.053165 tcp 10.0.2.105 55937 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:53.409271 0.076693 tcp 10.0.2.105 55938 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:53.486242 0.200112 tcp 10.0.2.105 55939 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:09:53.686789 0.181168 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:53.868375 0.160874 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.029736 0.073218 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.103470 0.090366 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.194289 0.284521 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.479303 0.163589 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.643395 0.137846 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.781619 0.181835 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:54.963836 0.064927 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:55.029217 0.221108 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:55.250719 0.155867 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:55.406957 0.617550 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.024977 0.045925 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.071332 0.058133 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.129904 0.183415 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.313753 0.165524 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.479713 0.142025 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.622119 0.372567 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:56.995143 0.059392 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.054984 0.147560 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.202972 0.163009 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.366422 0.039349 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.406215 0.388011 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.794687 0.120849 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:57.916000 0.097598 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:58.013959 0.356916 udp 10.0.2.105 7010 <-> 220.130.33.167 5551 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:58.371327 0.056087 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:58.427784 0.267511 udp 10.0.2.105 7010 <-> 75.46.81.240 2831 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:58.695745 0.053575 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:58.749684 0.461910 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:59.211992 0.215101 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:59.427470 0.144040 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:09:59.571954 0.054454 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:14:09.285728 3.001350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 04:14:16.293110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:14:24.294817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:14:40.298075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:15:12.303416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:16:18.188344 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 04:16:18.188531 1.025839 tcp 10.0.2.105 55940 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:21:16.314414 2.996631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:21:23.317572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:21:31.318670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:21:47.321232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:22:19.327162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:28:23.335257 2.999745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:28:30.340837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:28:38.342997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:28:54.345634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:29:26.351134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:35:30.357787 3.001089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:35:37.364616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:35:45.368819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:36:01.369151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:36:33.786844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:40:23.469612 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 04:40:23.469801 0.173804 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:23.644013 0.052000 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:23.696431 0.083882 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:23.780674 0.089770 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:23.870850 0.179175 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.050476 0.154014 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.204928 0.293758 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.499137 0.168015 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.667612 0.144831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.812858 0.180203 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:24.993538 0.060570 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:25.054548 0.202706 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:25.257666 0.038921 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:25.297077 0.058097 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:25.355655 0.247430 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:25.603457 0.614685 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:26.218493 0.189308 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:26.408261 0.164269 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:26.572972 0.143439 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:26.716904 0.492192 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:27.209506 0.058973 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:27.268866 0.147601 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:27.416888 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 04:40:43.035979 0.056492 tcp 10.0.2.105 55941 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:40:43.092747 0.075856 tcp 10.0.2.105 55942 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:40:43.168915 0.231368 tcp 10.0.2.105 55943 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:40:43.400941 0.142318 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:43.543676 0.097494 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:43.641584 0.163299 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:43.805289 0.041504 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:40:43.847206 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 04:41:01.571755 0.057282 tcp 10.0.2.105 55944 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:41:01.629358 0.075228 tcp 10.0.2.105 55945 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:41:01.704994 0.165236 tcp 10.0.2.105 55946 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:41:01.870879 0.056116 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:01.927493 0.168557 udp 10.0.2.105 7010 <-> 75.46.81.240 2831 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:02.096487 0.053195 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:02.150089 0.152311 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:02.302865 0.054599 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:02.357894 0.240719 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:41:02.599067 0.140020 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/18 04:42:37.392358 3.000538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 04:42:44.403489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:42:52.400117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:43:08.403295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:43:40.409260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:46:19.218033 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 04:46:19.218314 0.964842 tcp 10.0.2.105 55947 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/18 04:49:44.416383 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:49:51.422724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:49:59.423980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:50:15.427130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:50:47.433526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:56:52.442471 3.000210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 04:56:59.447760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:57:07.449525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:57:23.452748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 04:57:55.458483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:04:02.469353 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:04:09.476226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:04:17.477813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:04:33.481277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:05:05.486722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:11:09.494121 3.000324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:11:16.500042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:11:17.332118 0.000321 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 05:11:17.332545 1.133716 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 05:11:18.466261 0.000000 icmp 42.61.215.227 0x0103 -> 10.0.2.105 0x2a3d URH 192 1 119 flow=Background 1970/01/18 05:11:24.501852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:11:36.010269 0.053095 tcp 10.0.2.105 55948 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:36.063637 0.071231 tcp 10.0.2.105 55949 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:36.135154 0.156805 tcp 10.0.2.105 55950 -> 195.113.214.236 443 SRPA* 0 0 34 26946 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:36.293263 0.000000 udp 10.0.2.105 7010 -> 220.130.33.167 5551 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 05:11:40.504785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:11:55.016336 0.053454 tcp 10.0.2.105 55951 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:55.070081 0.094902 tcp 10.0.2.105 55952 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:55.165272 0.163148 tcp 10.0.2.105 55953 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:11:55.329019 0.079466 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:55.408925 0.182129 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:55.591471 0.154262 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:55.746183 0.073008 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:55.819636 0.121058 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:55.941133 0.173285 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.114810 0.180834 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.296043 0.075164 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.371633 0.169471 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.541542 0.039852 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.581847 0.305163 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:56.887384 0.248758 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.136660 0.144794 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.281915 0.400958 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.683338 0.060095 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.743906 0.156950 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.901238 0.056581 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:57.958196 0.140619 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:58.099230 0.164890 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:58.264700 0.186425 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:58.451568 0.534700 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:58.986691 0.148041 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:59.135171 0.161668 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:59.297237 0.047106 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:59.344783 0.093429 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:59.438662 0.120790 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:11:59.559881 0.000000 udp 10.0.2.105 7010 -> 75.46.81.240 2831 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 05:12:12.510727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:12:15.575770 0.053349 tcp 10.0.2.105 55954 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:12:15.629429 0.073568 tcp 10.0.2.105 55955 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:12:15.703316 0.162262 tcp 10.0.2.105 55956 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:12:15.866240 0.053445 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:12:15.920121 0.144081 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:12:16.064610 0.055190 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:12:16.120361 0.138937 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:12:16.259678 0.053125 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:12:16.313171 0.217857 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:16:20.187288 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 05:16:20.187366 1.097203 tcp 10.0.2.105 55957 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:18:16.517670 3.000716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:18:23.524185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:18:31.525482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:18:47.528577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:19:19.534918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:25:23.541831 3.003738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:25:30.547915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:25:38.549503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:25:54.552608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:26:26.558945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:32:30.565822 3.000085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:32:37.572238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:32:45.573760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:33:01.576087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:33:33.582700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:39:37.589164 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:39:44.595890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:39:52.597527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:40:08.600939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:40:40.606174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:42:36.023128 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 05:42:36.023234 0.000000 udp 10.0.2.105 7010 -> 75.46.81.240 2831 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 05:42:52.969353 0.203404 tcp 10.0.2.105 55958 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:42:53.173117 0.076291 tcp 10.0.2.105 55959 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:42:53.249758 0.156757 tcp 10.0.2.105 55960 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:42:53.407737 0.182027 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:53.590306 0.153680 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:53.744461 0.079286 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:53.824397 0.055852 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:53.880739 0.173102 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.054267 0.183017 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.237740 0.078627 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.316818 0.040555 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.357816 0.064117 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.422369 0.279365 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.702203 0.137840 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:54.840432 0.305921 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.146792 0.192115 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.339289 0.159258 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.498933 0.064618 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.563941 0.143531 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.707880 0.166262 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.874565 0.058598 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:55.933559 0.462868 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:56.396872 0.146533 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:56.543855 0.163856 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:56.708134 0.184298 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:56.892885 0.337987 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.231266 0.119444 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.351156 0.039622 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.391151 0.093599 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.485214 0.146915 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.632517 0.065987 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:57.698938 0.932594 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:58.631986 0.062551 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:58.695005 0.056151 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:42:58.751606 0.227056 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 05:46:21.287056 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 05:46:21.287347 1.068576 tcp 10.0.2.105 55961 -> 128.255.183.224 9027 FSPA* 0 0 15 1802 flow=From-Botnet-V2-TCP-Established 1970/01/18 05:46:44.612447 3.001814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 05:46:51.620126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:46:59.621818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:47:15.624500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:47:47.630864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:53:51.637280 3.000778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 05:53:58.645155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:54:06.645503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:54:22.648712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 05:54:54.654590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:01:00.663751 3.001396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:01:07.671022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:01:15.673044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:01:31.675188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:02:03.681349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:08:07.687947 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:08:14.695220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:08:22.696872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:08:38.698930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:09:10.705568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:13:04.832573 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 06:13:04.832761 0.039033 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:04.872813 0.097414 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:04.970669 0.145427 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.116723 0.337796 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.454986 0.120795 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.576243 0.142844 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.719471 0.072455 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.792364 0.053328 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:05.846077 0.225319 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:06.071773 0.054966 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:06.127113 0.039394 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:06.166931 0.075746 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:06.243049 0.182252 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:06.425755 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 06:13:21.607663 0.053312 tcp 10.0.2.105 55962 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:21.661227 0.074024 tcp 10.0.2.105 55963 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:21.735102 0.170086 tcp 10.0.2.105 55964 -> 195.113.214.236 443 SRPA* 0 0 21 12436 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:21.905746 0.050308 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:21.956461 0.084518 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:22.041341 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 06:13:37.310059 0.052490 tcp 10.0.2.105 55965 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:37.362894 0.072078 tcp 10.0.2.105 55966 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:37.435281 0.166195 tcp 10.0.2.105 55967 -> 195.113.214.236 443 SRPA* 0 0 33 19153 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:13:37.602025 0.154326 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:37.756751 0.314845 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:38.071948 0.268384 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:38.340727 0.144469 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:38.485583 0.169909 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:38.655878 0.290073 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:39.309510 0.236194 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:39.546069 0.165840 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:39.712450 0.155957 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:39.868874 0.058014 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:39.927234 0.426966 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:40.354600 0.065259 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:40.420468 0.147223 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:40.569709 0.186407 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:13:40.756617 0.161391 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:15:14.712710 3.000333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 06:15:21.718299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:15:29.720920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:15:45.723236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:16:17.729488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:16:22.357182 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 06:16:22.357286 1.423314 tcp 10.0.2.105 55968 -> 128.255.183.224 9027 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:22:21.736345 3.001063 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:22:28.743464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:22:36.744159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:22:52.748072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:23:24.753304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:29:28.759092 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:29:35.766837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:29:43.768587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:29:59.771268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:30:31.777311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:36:35.783628 3.004169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:36:42.791002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:36:50.792135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:37:06.795676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:37:38.801318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:44:06.479396 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 06:44:06.479926 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 06:44:24.176139 0.055415 tcp 10.0.2.105 55969 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:24.231899 0.071820 tcp 10.0.2.105 55970 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:24.304009 0.163869 tcp 10.0.2.105 55971 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:24.468368 0.183773 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:24.652750 0.147528 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:24.800743 0.097148 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:24.898284 0.041691 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:24.940506 0.144115 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:25.085095 0.000000 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 06:44:40.298227 0.053249 tcp 10.0.2.105 55972 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:40.351791 0.069556 tcp 10.0.2.105 55973 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:40.421617 0.165190 tcp 10.0.2.105 55974 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:44:40.587423 0.053447 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:40.641313 0.212810 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:40.854558 0.054612 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:40.909564 0.039120 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:40.949097 0.075963 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.025469 0.119202 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.145048 0.335460 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.480981 0.179884 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.661300 0.071504 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.733362 0.051460 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.785199 0.058974 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.844599 0.152462 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:41.997454 0.163623 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:42.161452 0.290709 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:42.452530 0.212119 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:42.665113 0.137755 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:42.803294 0.144392 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:42.948139 0.165428 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.114026 0.169345 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.283808 0.059989 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.344218 0.147064 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.491689 0.186558 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.678595 0.162824 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:43.841787 0.481471 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:44:44.323737 0.059093 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 06:45:03.814645 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 06:45:10.821239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:45:18.822608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:45:34.825278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:46:06.831736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:46:23.786468 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 06:46:23.786566 0.983381 tcp 10.0.2.105 55975 -> 128.255.183.224 9027 FSPA* 0 0 15 1556 flow=From-Botnet-V2-TCP-Established 1970/01/18 06:52:21.843479 3.002354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:52:28.851081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:52:36.852746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:52:52.855666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:53:24.861341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:59:32.873899 3.001014 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 06:59:39.881246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 06:59:47.882430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:00:03.885606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:00:35.892354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:06:39.898019 3.001031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:06:46.904652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:06:54.907708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:07:10.909121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:07:42.915310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:13:46.922420 3.000832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:13:53.929614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:14:01.930107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:14:17.933220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:14:49.939955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:15:09.007104 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 07:15:09.007212 2.652027 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 07:15:11.659239 0.000000 icmp 95.13.37.13 0x0103 -> 10.0.2.105 0x5f0d URH 192 1 263 flow=Background 1970/01/18 07:15:26.480693 0.062457 tcp 10.0.2.105 55976 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:26.543414 0.074496 tcp 10.0.2.105 55977 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:26.618195 0.138946 tcp 10.0.2.105 55978 -> 195.113.214.236 443 SRPA* 0 0 61 39578 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:26.757799 0.175096 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:26.933351 0.144673 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.097330 0.093546 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.191253 0.143935 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.335580 0.045349 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.381368 0.054439 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.436419 0.039750 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.476571 0.083882 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.560909 0.119222 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.680572 0.214744 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.895775 0.053018 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:27.949223 0.359747 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:28.309361 0.179975 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:28.489781 0.000000 udp 10.0.2.105 7010 -> 79.23.200.237 2691 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 07:15:43.878386 0.052875 tcp 10.0.2.105 55979 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:43.931505 0.073559 tcp 10.0.2.105 55980 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:44.004929 0.167787 tcp 10.0.2.105 55981 -> 195.113.214.236 443 SRPA* 0 0 42 35862 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:15:44.173364 0.056771 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:44.230752 0.064301 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:44.295476 0.152691 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:44.448533 0.282850 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:44.731807 0.233328 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:44.965507 0.305798 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.271773 0.137714 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.409919 0.142896 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.553164 0.164344 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.717930 0.154616 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.872965 0.058679 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:45.932042 0.163150 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:46.095586 0.146864 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:46.242890 0.186000 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:46.429339 0.415473 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:15:46.845235 0.057988 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:16:24.776273 1.109199 tcp 10.0.2.105 55982 -> 128.255.183.224 9027 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:20:53.950218 2.997085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 07:21:00.953004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:21:08.953920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:21:24.957388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:21:56.963130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:28:00.970378 3.002257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:28:07.976047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:28:15.977696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:28:31.980982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:29:03.987134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:35:07.993980 3.001051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:35:15.000591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:35:23.002151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:35:39.006167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:36:11.011128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:42:15.017549 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:42:22.024733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:42:30.026092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:42:46.029219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:43:18.035691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:45:56.853490 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 07:45:56.853713 0.072965 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:56.927120 0.097772 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.025313 0.146568 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.172375 0.176064 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.348816 0.143935 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.493109 0.055414 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.548895 0.039559 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.588895 0.040488 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.629808 0.122197 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.752447 0.227311 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:57.980194 0.053952 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.034505 0.349670 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.384716 0.078817 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.463949 0.181605 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.645922 0.054307 udp 10.0.2.105 7010 <-> 86.130.11.75 6786 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.700685 0.059625 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.760715 0.183039 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:58.944095 0.290817 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:59.235346 0.154862 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:59.390615 0.309106 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:59.700138 0.144682 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:59.845256 0.143611 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:45:59.989202 0.165441 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.155046 0.154878 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.310421 0.061876 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.372749 0.163338 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.536570 0.149208 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.686255 0.058605 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.745297 0.185053 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:00.930790 0.262549 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 07:46:25.886012 0.983498 tcp 10.0.2.105 55983 -> 128.255.183.224 9027 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/01/18 07:49:22.041115 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:49:29.048211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:49:37.049646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:49:53.052869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:50:25.058979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:56:34.072122 3.001780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 07:56:41.079709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:56:49.081084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:57:05.083941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 07:57:37.090074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:03:45.102913 3.000641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:03:52.109611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:04:00.112559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:04:16.113669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:04:48.120676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:10:52.126067 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:10:59.134919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:11:07.135298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:11:23.137918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:11:55.143878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:16:26.875254 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 08:16:26.875353 1.152484 tcp 10.0.2.105 55984 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:16:26.945022 0.146212 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.091651 0.086022 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.178146 0.097827 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.276438 0.175976 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.452781 0.145629 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.598816 0.054333 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.653613 0.045665 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.699660 0.045350 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.745439 0.120273 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:27.866129 0.335996 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:28.202547 0.076086 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:28.279104 0.215172 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:28.494672 0.054854 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:28.549958 0.180941 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:28.731324 0.000000 udp 10.0.2.105 7010 -> 86.130.11.75 6786 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 08:16:44.561885 0.057141 tcp 10.0.2.105 55985 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:16:44.619323 0.078791 tcp 10.0.2.105 55986 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:16:44.698010 0.167941 tcp 10.0.2.105 55987 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:16:44.866495 0.082351 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:44.949258 0.189102 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:45.138763 0.293132 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:45.432332 0.137918 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:45.570694 0.152969 udp 10.0.2.105 7010 <-> 99.45.44.111 8183 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:45.724113 0.273083 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:45.997577 0.144702 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.142676 0.166828 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.309880 0.154257 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.464599 0.062339 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.527372 0.164125 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.691920 0.184474 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:46.876831 0.234458 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:47.111689 0.149042 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:16:47.261147 0.058429 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:17:59.150547 3.001230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:18:06.158019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:18:14.159545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:18:30.161849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:19:02.168073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:25:06.173830 3.002390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:25:13.181265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:25:21.182865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:25:37.185833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:26:09.191845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:32:13.198039 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:32:20.205667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:32:28.207104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:32:44.209980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:33:16.225850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:39:20.232436 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:39:27.239421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:39:35.240532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:39:51.243841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:40:23.250064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:46:27.255864 3.002260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:46:28.034742 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 08:46:28.034851 0.970402 tcp 10.0.2.105 55988 -> 128.255.183.224 9027 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:46:34.263514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:46:42.264377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:46:54.543261 0.000000 udp 10.0.2.105 7010 -> 86.130.11.75 6786 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 08:46:58.267643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:46:59.138811 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 08:47:13.200706 0.055309 tcp 10.0.2.105 55989 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:13.256396 0.079079 tcp 10.0.2.105 55990 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:13.335760 0.169307 tcp 10.0.2.105 55991 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:13.505291 0.093544 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:13.599251 0.154659 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:13.754345 0.079730 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:13.834491 0.147637 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:13.982517 0.066271 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.049153 0.039333 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.088929 0.191300 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.280595 0.119436 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.400471 0.338225 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.739092 0.078310 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.817860 0.057672 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.875866 0.056554 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:14.932871 0.232505 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:15.165774 0.216574 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:15.382850 0.059434 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:15.442770 0.184088 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:15.627296 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 08:47:30.273611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:47:33.779686 0.052900 tcp 10.0.2.105 55992 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:33.832862 0.075020 tcp 10.0.2.105 55993 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:33.908193 0.160327 tcp 10.0.2.105 55994 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/18 08:47:34.069108 0.276622 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:34.346123 0.143251 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:34.489826 0.162613 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:34.652832 0.295918 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:34.949184 0.144648 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.094230 0.158053 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.252756 0.058267 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.312382 0.178934 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.491700 0.178684 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.670817 0.234601 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:35.905818 0.146601 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:47:36.052924 0.057826 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/18 08:53:34.280237 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 08:53:41.287530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:53:49.289048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:54:05.291533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 08:54:37.297966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:00:41.304163 3.001457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:00:48.311231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:00:56.312839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:01:12.315758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:01:44.321917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:07:48.328729 3.067630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:07:55.481122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:08:03.420189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:08:19.359457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:08:51.366032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:14:55.372622 3.000629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:15:02.379124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:15:10.380658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:15:26.383633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:15:58.389568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:16:29.004130 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 09:16:29.004233 0.975403 tcp 10.0.2.105 55995 -> 128.255.183.224 9027 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:17:40.867214 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 09:17:40.867313 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8183 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 09:17:58.454186 0.053612 tcp 10.0.2.105 55996 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:17:58.508089 0.076761 tcp 10.0.2.105 55997 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:17:58.585165 0.166639 tcp 10.0.2.105 55998 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:17:58.751028 0.079509 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:58.830966 0.143645 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:58.974997 0.078573 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.054078 0.097902 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.152618 0.402001 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.555080 0.175692 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.808649 0.120127 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.929156 0.039954 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:17:59.969534 0.085262 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.055191 0.040688 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.096254 0.061395 udp 10.0.2.105 7010 <-> 134.90.1.162 9006 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.158051 0.351492 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.509938 0.061889 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.572256 0.181563 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.756658 0.183358 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:00.940571 0.230547 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:01.171567 0.224858 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:01.396841 0.142354 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:01.539567 0.164771 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:01.704766 0.295078 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.000305 0.137765 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.138512 0.156875 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.295838 0.059633 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.355870 0.162870 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.519229 0.145557 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.665149 0.059340 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.724861 0.176946 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:18:02.902223 0.225274 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:22:02.396689 3.000853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 09:22:09.403313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:22:17.405917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:22:33.407631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:23:05.413678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:29:09.420234 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:29:16.427060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:29:24.428632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:29:40.432853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:30:12.437686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:36:16.444436 3.001503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:36:23.450992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:36:31.452410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:36:47.455279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:37:19.461800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:44:54.468182 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:45:01.475757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:45:09.478947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:45:25.481015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:45:57.486275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:46:29.983774 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 09:46:29.984012 0.945852 tcp 10.0.2.105 55999 -> 128.255.183.224 9027 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:48:21.743889 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 09:48:21.743978 0.094572 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:21.838955 0.094436 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:21.933868 0.093831 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.028101 0.140379 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.168884 0.146909 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.316254 0.174661 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.491330 0.119588 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.611249 0.044542 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.656156 0.079511 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.736092 0.048542 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:22.785074 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 09:48:39.802224 0.053163 tcp 10.0.2.105 56000 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:48:39.855815 0.071394 tcp 10.0.2.105 56001 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:48:39.927077 0.156879 tcp 10.0.2.105 56002 -> 195.113.214.236 443 SRPA* 0 0 41 31966 flow=From-Botnet-V2-TCP-Established 1970/01/18 09:48:40.084751 0.337041 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:40.422213 0.383514 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:40.806161 0.183740 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:40.990267 0.193164 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:41.183779 0.227824 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:41.412021 0.165542 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:41.577981 0.295544 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:41.873943 0.137649 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.011937 0.153601 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.165903 0.207804 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.374109 0.141051 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.515628 0.062872 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.578941 0.164234 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.743519 0.145491 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.889403 0.059253 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:42.949068 0.184914 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:48:43.134435 0.219030 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/18 09:52:11.497108 3.000996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 09:52:18.503851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:52:26.505348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:52:42.508559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:53:14.514660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:59:18.521261 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 09:59:25.528433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:59:33.529568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 09:59:49.533094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:00:21.538777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:06:25.545361 3.124826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:06:32.646836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:06:40.588971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:06:56.566504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:07:28.572828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:13:32.579215 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:13:39.586228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:13:47.587533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:14:03.590589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:14:35.596845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:16:30.933190 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 10:16:30.933336 1.178963 tcp 10.0.2.105 56003 -> 128.255.183.224 9027 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:18:45.147224 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 10:18:45.147340 0.000000 udp 10.0.2.105 7010 -> 134.90.1.162 9006 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 10:19:00.649971 0.054626 tcp 10.0.2.105 56004 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:00.704846 0.076749 tcp 10.0.2.105 56005 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:00.781899 0.236806 tcp 10.0.2.105 56006 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:01.019499 0.073880 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.093789 0.144483 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.238688 0.303274 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.542375 0.188107 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.730935 0.120596 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.851940 0.093682 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:01.946070 0.055351 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.001898 0.039027 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.041336 0.082441 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.124194 0.056655 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.181228 0.352408 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.534034 0.059813 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.594217 0.185718 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.780380 0.210381 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:02.991189 0.215649 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:03.207263 0.144597 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:03.352449 0.195992 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:03.548778 0.239783 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:03.788979 0.165364 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:03.954784 0.296150 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:04.251367 0.143470 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:04.395250 0.060180 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:04.455903 0.183866 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:04.640138 0.146441 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:04.786925 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 10:19:19.896052 0.055071 tcp 10.0.2.105 56007 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:19.950903 0.068136 tcp 10.0.2.105 56008 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:20.019423 0.157347 tcp 10.0.2.105 56009 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:19:20.177368 0.179357 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:19:20.357159 0.400664 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:20:39.602987 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 10:20:46.609947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:20:54.616358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:21:10.614354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:21:42.621040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:27:46.627015 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:27:53.634023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:28:01.635400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:28:17.638673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:28:50.106207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:34:53.660590 3.001664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:35:00.667946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:35:08.669874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:35:24.672290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:35:56.678002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:42:00.685338 3.000965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:42:07.691895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:42:15.693250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:42:31.696650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:43:03.702670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:46:32.113057 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 10:46:32.113361 0.974421 tcp 10.0.2.105 56010 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:49:07.708722 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:49:14.715386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:49:22.717372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:49:37.159057 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 10:49:37.159139 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 10:49:38.720491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:49:54.006228 0.053347 tcp 10.0.2.105 56011 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:49:54.059950 0.075956 tcp 10.0.2.105 56012 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:49:54.136376 0.162376 tcp 10.0.2.105 56013 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/18 10:49:54.299409 0.079259 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.379104 0.142760 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.522307 0.176132 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.698922 0.120277 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.819739 0.098143 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.820081 2.998106 tcp 10.0.2.105 56014 -> 208.104.248.106 1527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/18 10:49:54.918305 0.055822 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:54.974605 0.044898 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.019896 0.145863 udp 10.0.2.105 7010 <-> 76.68.94.91 3572 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.166206 0.127849 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.294504 0.085502 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.380497 0.185493 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.566408 0.181538 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.748376 0.215626 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:55.964429 0.411745 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:56.376607 0.344117 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:56.721179 0.235811 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:56.957427 0.165834 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:57.123706 0.292187 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:57.416238 0.144822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:57.561421 0.157407 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:57.719257 0.165276 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:57.884904 0.146609 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:58.031965 0.146044 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:58.178527 0.059709 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:58.238787 0.212223 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:49:58.451533 0.345410 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/18 10:50:03.815833 0.000000 tcp 10.0.2.105 56014 -> 208.104.248.106 1527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/18 10:50:10.725798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:56:18.737867 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 10:56:25.745678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:56:33.746779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:56:49.749636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 10:57:21.756976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:03:27.765832 3.000674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:03:34.772613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:03:42.773780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:03:58.777059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:04:30.782901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:10:34.788791 3.071230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:10:41.836430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:10:49.817898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:11:05.821909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:11:37.827334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:16:33.092245 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 11:16:33.092369 1.230325 tcp 10.0.2.105 56015 -> 128.255.183.224 9027 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:17:41.832734 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:17:48.840360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:17:56.841909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:18:12.844958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:18:44.850899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:20:28.460235 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 11:20:28.460349 0.174480 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:28.635267 0.121367 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:28.757095 0.084340 udp 10.0.2.105 7010 <-> 79.23.200.237 2691 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:28.757503 3.006930 tcp 10.0.2.105 56016 -> 208.104.248.106 1527 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/18 11:20:28.842399 0.144928 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:28.987778 0.103027 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:29.091261 0.053464 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:29.145166 0.044258 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:29.189875 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:20:37.764413 0.000000 tcp 10.0.2.105 56016 -> 208.104.248.106 1527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/18 11:20:44.795644 0.062649 tcp 10.0.2.105 56017 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:20:44.858540 0.071194 tcp 10.0.2.105 56018 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:20:44.930099 0.166101 tcp 10.0.2.105 56019 -> 195.113.214.236 443 SRPA* 0 0 44 28270 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:20:45.094883 0.039642 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:45.134876 0.079779 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:45.215089 0.226735 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:45.442276 0.181627 udp 10.0.2.105 7010 <-> 99.20.56.222 9503 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:45.624290 0.230058 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:45.854747 0.455072 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:46.310194 0.336983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:46.647516 0.289160 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:46.937047 0.166451 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:47.103933 0.300950 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:47.405281 0.144669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:47.550430 0.152995 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:47.703944 0.163571 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:47.867921 0.142035 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:48.010395 0.144821 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:48.155620 0.060201 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:48.216260 0.188487 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:20:48.405205 0.233907 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:24:48.858050 3.000150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:24:55.868720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:25:03.865613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:25:19.869337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:25:51.874874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:31:55.880916 3.069299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:32:02.922207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:32:10.910771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:32:26.914697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:32:58.919139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:39:02.925204 3.001875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:39:09.932818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:39:17.933647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:39:33.937224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:40:05.942942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:46:16.950138 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 11:46:23.957350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:46:31.959142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:46:34.322093 0.000221 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 11:46:34.322433 1.402852 tcp 10.0.2.105 56020 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:46:47.961121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:47:19.967919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:50:55.217427 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 11:50:55.217534 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 3572 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:51:11.161592 0.053358 tcp 10.0.2.105 56021 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:11.215246 0.076834 tcp 10.0.2.105 56022 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:11.291886 0.162467 tcp 10.0.2.105 56023 -> 195.113.214.236 443 SRPA* 0 0 56 36298 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:11.454941 0.000000 udp 10.0.2.105 7010 -> 79.23.200.237 2691 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:51:30.117139 0.052723 tcp 10.0.2.105 56024 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:30.170173 0.081250 tcp 10.0.2.105 56025 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:30.251726 0.162043 tcp 10.0.2.105 56026 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:30.412608 0.145600 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:30.558695 0.098673 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:30.658126 0.056850 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:30.715514 0.046800 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:30.715905 2.671699 tcp 10.0.2.105 56027 -> 188.121.218.27 4091 FSPA* 0 0 512 369191 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:30.762741 0.120148 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:30.883229 0.174446 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:31.058127 0.055982 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:31.114456 0.078741 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:31.193618 0.186516 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:51:31.380512 0.000000 udp 10.0.2.105 7010 -> 99.20.56.222 9503 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:51:34.218988 0.054015 tcp 10.0.2.105 56028 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:34.273350 0.073696 tcp 10.0.2.105 56029 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:34.347456 0.277684 tcp 10.0.2.105 56030 -> 195.113.214.236 443 SRPA* 0 0 78 77362 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:51:50.102813 0.000000 udp 10.0.2.105 7010 -> 79.23.200.237 2691 REQ 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:52:06.337799 0.052909 tcp 10.0.2.105 56031 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:06.391004 0.070397 tcp 10.0.2.105 56032 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:06.461747 0.163840 tcp 10.0.2.105 56033 -> 195.113.214.236 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:06.626167 0.212684 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:06.839250 0.000000 udp 10.0.2.105 7010 -> 99.20.56.222 9503 REQ 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 11:52:24.304785 0.052160 tcp 10.0.2.105 56034 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:24.357244 0.065281 tcp 10.0.2.105 56035 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:24.422776 0.158301 tcp 10.0.2.105 56036 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:52:24.581243 0.096960 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:24.678656 0.163358 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:24.842415 0.210512 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:25.053376 0.491629 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:25.545435 0.267358 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:25.813174 0.148242 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:25.961861 0.163106 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.125366 0.059590 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.185351 0.151829 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.337669 0.303495 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.641590 0.159702 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.801696 0.191771 udp 10.0.2.105 7010 <-> 24.234.43.35 7805 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:26.993876 0.590382 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:27.584704 0.141186 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:27.726323 0.097925 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:27.824685 0.055177 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:27.880416 0.195719 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:28.076573 0.073826 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:28.150808 0.042492 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:28.193741 0.175650 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:28.369848 0.120931 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:28.491228 0.037870 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/18 11:52:35.030063 0.967883 tcp 10.0.2.105 56037 -> 128.255.183.224 9027 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/18 11:53:24.013198 3.001564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 11:53:31.021863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:53:39.021832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:53:55.025195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 11:54:27.030867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:00:31.037404 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:00:38.044164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:00:46.045663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:01:02.048646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:01:34.054715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:07:38.063163 2.999586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:07:45.069200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:07:53.069826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:08:09.073325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:08:41.079064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:14:45.089213 2.997052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:14:52.092354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:15:00.093611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:15:16.097783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:15:48.102702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:21:52.125681 2.995464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:21:59.126762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:22:07.127616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:22:23.131744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:22:35.829035 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:22:35.829183 0.229333 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:36.000024 1.369381 tcp 10.0.2.105 56038 -> 128.255.183.224 9027 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:22:36.059048 0.444518 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:36.504064 0.338172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:36.842666 0.160530 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:37.003620 0.247946 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:37.252016 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:22:55.137467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:22:55.479509 0.052071 tcp 10.0.2.105 56039 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:22:55.531518 0.071886 tcp 10.0.2.105 56040 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:22:55.603670 0.159423 tcp 10.0.2.105 56041 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:22:55.763911 0.147779 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:55.912133 0.162744 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:56.075287 0.059012 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:56.134732 0.137862 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:56.272952 0.303546 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:22:56.576902 3.720326 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:00.297653 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 7805 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:23:16.097637 0.052432 tcp 10.0.2.105 56042 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:23:16.150427 0.075993 tcp 10.0.2.105 56043 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:23:16.226747 0.203479 tcp 10.0.2.105 56044 -> 195.113.214.236 443 SRPA* 0 0 52 36114 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:23:16.429381 0.235942 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:16.665765 0.144096 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:16.810314 0.093830 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:16.904595 0.056251 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:16.961227 0.184135 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:17.145800 0.086669 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:17.232960 0.054912 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:17.288308 0.174497 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:17.463252 0.120740 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:23:17.584590 0.045252 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:28:59.145560 2.999162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:29:06.150744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:29:14.151944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:29:30.154873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:30:02.161310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:36:06.168079 3.001204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:36:13.173712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:36:21.175520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:36:37.178716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:37:09.185958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:44:44.193038 2.999688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:44:51.206462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:44:59.202651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:45:15.203400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:45:47.220255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:52:00.228188 3.002073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 12:52:07.237173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:52:15.237526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:52:31.241403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:52:37.369793 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:52:37.370121 0.957586 tcp 10.0.2.105 56045 -> 128.255.183.224 9027 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:03.246763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:53:24.677692 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:53:29.674466 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:53:40.091140 0.052205 tcp 10.0.2.105 56046 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:40.143675 0.072694 tcp 10.0.2.105 56047 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:40.216041 0.159233 tcp 10.0.2.105 56048 -> 195.113.214.236 443 SRPA* 0 0 40 21154 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:40.375901 0.000000 udp 10.0.2.105 7010 -> 24.234.43.35 7805 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:53:56.323467 0.051074 tcp 10.0.2.105 56049 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:56.374849 0.075873 tcp 10.0.2.105 56050 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:56.451028 0.159292 tcp 10.0.2.105 56051 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 12:53:56.610818 0.213538 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:56.824810 0.213235 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.038472 0.336874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.375764 0.058674 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.434929 0.164954 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.600304 0.057412 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.658136 0.144406 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.802929 0.147322 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:57.950679 0.162030 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:58.113155 0.296900 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:53:58.410464 3.392446 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:01.803459 0.248918 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.052766 0.141169 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.194390 0.092897 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.287710 0.055804 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.343967 0.187114 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.531462 0.083090 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.614962 0.042129 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.657456 0.045614 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.703486 0.176851 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:02.880783 0.119741 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:03.024694 0.261721 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:03.286973 0.213355 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:03.500896 0.351783 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:03.853216 0.061862 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:03.915625 0.164552 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.080705 0.050369 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.131588 0.144900 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.276920 0.147308 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.424664 0.164384 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.589587 0.297299 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:04.887441 3.383724 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:08.271660 0.255714 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:08.527901 0.146339 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:08.674785 0.093334 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:08.768611 0.056218 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:08.825283 0.191453 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.017271 0.077005 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.094754 0.047219 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.142524 0.169927 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.313049 0.129842 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.443451 0.042760 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.486787 0.058767 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:54:09.559614 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:15.430177 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:20.177457 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:54:23.832816 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:32.234743 0.000000 udp 10.0.2.105 7010 -> 176.27.252.10 5342 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:37.963075 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:44.292350 0.000000 udp 10.0.2.105 7010 -> 70.64.76.156 8633 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:49.178533 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:54:51.893158 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:54:58.542822 0.000000 udp 10.0.2.105 7010 -> 12.181.169.190 7070 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:06.023114 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:12.803027 0.000000 udp 10.0.2.105 7010 -> 58.108.229.248 5276 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:17.679358 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:55:19.392354 0.000000 udp 10.0.2.105 7010 -> 60.50.117.227 6504 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:25.992173 0.000000 udp 10.0.2.105 7010 -> 82.53.113.216 2254 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:34.013403 0.000000 udp 10.0.2.105 7010 -> 208.69.109.110 7083 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:39.140954 0.000000 udp 10.0.2.105 7010 -> 190.48.30.234 2146 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:43.676423 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:55:44.388136 0.000000 udp 10.0.2.105 7010 -> 84.173.71.89 7912 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:50.546992 0.264741 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/18 12:55:50.916051 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:55:59.870697 0.000000 udp 10.0.2.105 7010 -> 98.230.235.207 4880 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:06.870228 0.099965 udp 10.0.2.105 7010 -> 91.138.134.16 1024 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:06.970193 0.000000 icmp 91.138.134.16 0x0303 -> 10.0.2.105 0x0004 URP 192 1 246 flow=Background 1970/01/18 12:56:11.677194 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:56:12.869126 0.000000 udp 10.0.2.105 7010 -> 64.199.2.66 2291 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:18.187008 0.000000 udp 10.0.2.105 7010 -> 190.86.187.27 6971 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:26.369455 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:33.689261 0.000000 udp 10.0.2.105 7010 -> 108.215.37.87 1726 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:38.676868 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:56:38.747189 0.000000 udp 10.0.2.105 7010 -> 93.193.153.79 7662 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:45.586225 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:56:53.067734 0.000000 udp 10.0.2.105 7010 -> 88.72.36.130 4052 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:00.268119 0.064001 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:00.332120 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 212 flow=Background 1970/01/18 12:57:05.174061 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:57:05.805043 0.000000 udp 10.0.2.105 7010 -> 71.122.116.2 3758 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:14.787803 0.000000 udp 10.0.2.105 7010 -> 217.131.205.158 4793 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:20.386795 0.000000 udp 10.0.2.105 7010 -> 85.74.139.175 7047 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:29.349266 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:34.176751 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:57:37.941640 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:44.971566 0.000000 udp 10.0.2.105 7010 -> 79.24.70.157 5316 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:52.973251 0.000000 udp 10.0.2.105 7010 -> 38.122.127.146 8607 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:57:58.270896 0.000000 udp 10.0.2.105 7010 -> 41.107.78.225 7904 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:03.177997 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:58:05.641549 0.000000 udp 10.0.2.105 7010 -> 91.187.192.90 7869 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:13.152463 0.000000 udp 10.0.2.105 7010 -> 81.99.246.142 5922 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:19.051131 0.000000 udp 10.0.2.105 7010 -> 78.53.129.50 1900 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:25.910865 0.000000 udp 10.0.2.105 7010 -> 115.84.253.146 4252 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:30.677318 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:58:32.860710 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:38.628767 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:47.171050 0.000000 udp 10.0.2.105 7010 -> 95.242.22.131 2220 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:52.568530 0.000000 udp 10.0.2.105 7010 -> 78.183.9.169 3165 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:58:57.175257 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:58:59.999728 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:07.253872 3.000127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 12:59:08.281841 0.000000 udp 10.0.2.105 7010 -> 68.189.94.26 4338 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:14.259862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:59:17.264458 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 9860 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:22.181446 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:59:22.261611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:59:24.654747 0.000000 udp 10.0.2.105 7010 -> 84.197.100.164 1118 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:31.475124 0.000000 udp 10.0.2.105 7010 -> 81.138.22.113 8841 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:36.953210 0.000000 udp 10.0.2.105 7010 -> 151.77.21.82 4708 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:38.264014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 12:59:43.172093 0.158313 udp 10.0.2.105 7010 -> 67.186.107.158 3970 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:43.330406 0.000000 icmp 67.186.107.158 0x0303 -> 10.0.2.105 0x820f URP 192 1 244 flow=Background 1970/01/18 12:59:47.677779 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 12:59:51.663584 0.000000 udp 10.0.2.105 7010 -> 82.55.79.82 5729 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 12:59:59.585170 0.000000 udp 10.0.2.105 7010 -> 50.14.130.69 3586 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:05.804063 0.000000 udp 10.0.2.105 7010 -> 67.197.247.232 7685 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:10.270693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:00:14.586870 0.000000 udp 10.0.2.105 7010 -> 181.198.38.2 4721 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:19.173287 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:00:20.684985 0.000000 udp 10.0.2.105 7010 -> 86.158.115.167 1371 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:29.418101 0.000000 udp 10.0.2.105 7010 -> 209.44.18.43 6239 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:38.341138 0.000000 udp 10.0.2.105 7010 -> 107.218.52.246 1702 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:43.177478 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:00:46.442484 0.000000 udp 10.0.2.105 7010 -> 82.6.23.15 3475 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:52.651703 0.000000 udp 10.0.2.105 7010 -> 94.240.229.175 2312 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:00:58.019420 0.000000 udp 10.0.2.105 7010 -> 94.141.208.225 1616 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:04.578859 0.000000 udp 10.0.2.105 7010 -> 83.149.155.14 3636 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:09.175248 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:01:10.367001 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:15.634375 0.000000 udp 10.0.2.105 7010 -> 72.27.0.103 4150 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:22.734304 0.000000 udp 10.0.2.105 7010 -> 176.73.127.188 2769 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:29.674786 0.188711 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:01:29.884865 0.000000 udp 10.0.2.105 7010 -> 174.89.248.53 8723 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:34.671991 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:01:36.504688 0.049743 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:01:36.564066 0.000000 udp 10.0.2.105 7010 -> 94.5.81.255 8052 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:44.576473 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:50.835369 0.059823 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:01:50.905042 0.135313 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:01:51.050443 0.000000 udp 10.0.2.105 7010 -> 79.44.71.32 2003 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:01:56.363794 0.000000 udp 10.0.2.105 7010 -> 130.71.198.138 4860 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:01.179670 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:02:03.232946 0.000000 udp 10.0.2.105 7010 -> 87.174.74.26 5119 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:08.941366 0.000000 udp 10.0.2.105 7010 -> 201.240.221.37 5169 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:17.773868 0.000000 udp 10.0.2.105 7010 -> 80.149.63.137 2612 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:25.835483 0.000000 udp 10.0.2.105 7010 -> 95.21.145.166 4968 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:30.672229 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:02:32.756424 0.000000 udp 10.0.2.105 7010 -> 220.246.37.206 1736 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:41.708048 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:49.729956 0.000000 udp 10.0.2.105 7010 -> 88.243.69.241 8937 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:02:54.676374 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:02:57.039986 0.000000 udp 10.0.2.105 7010 -> 31.146.93.115 8877 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:05.262456 0.000000 udp 10.0.2.105 7010 -> 99.100.164.78 5830 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:11.551399 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:20.163530 0.064725 udp 10.0.2.105 7010 <-> 86.177.80.69 8321 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:20.238138 0.359069 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:20.685841 0.404185 udp 10.0.2.105 7010 <-> 119.74.180.103 6769 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:21.104699 0.000000 udp 10.0.2.105 7010 -> 68.195.226.11 7924 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:24.680134 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:03:27.203596 0.000000 udp 10.0.2.105 7010 -> 94.39.221.62 9141 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:34.565062 0.000000 udp 10.0.2.105 7010 -> 79.8.187.208 7781 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:41.734410 0.000000 udp 10.0.2.105 7010 -> 96.252.71.253 9624 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:46.902821 0.000000 udp 10.0.2.105 7010 -> 69.120.124.14 7431 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:03:51.679709 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:03:52.870858 0.147972 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:53.093524 0.041745 udp 10.0.2.105 7010 <-> 78.134.120.61 6943 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:53.157539 0.251361 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:03:53.436705 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:01.323000 0.000000 udp 10.0.2.105 7010 -> 76.4.201.251 2771 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:07.712800 0.000000 udp 10.0.2.105 7010 -> 50.20.81.25 1966 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:15.423129 0.000000 udp 10.0.2.105 7010 -> 151.66.205.157 2144 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:20.179920 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:04:22.893833 0.210251 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:04:23.181456 0.367956 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:04:23.658636 0.176725 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:04:23.845815 0.000000 udp 10.0.2.105 7010 -> 76.2.217.49 8825 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:29.433152 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 4482 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:36.332843 0.000000 udp 10.0.2.105 7010 -> 77.192.48.217 5402 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:42.022001 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:46.677592 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:04:50.653164 0.000000 udp 10.0.2.105 7010 -> 92.232.98.23 8223 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:04:58.755828 0.000000 udp 10.0.2.105 7010 -> 74.7.75.190 7266 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:06.126754 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:10.672590 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:05:11.564049 0.000000 udp 10.0.2.105 7010 -> 99.8.180.43 8328 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:20.396312 0.000000 udp 10.0.2.105 7010 -> 94.14.6.243 3614 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:27.977480 0.000000 udp 10.0.2.105 7010 -> 93.41.227.235 1989 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:33.795240 0.000000 udp 10.0.2.105 7010 -> 79.47.228.135 6578 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:38.672525 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:05:38.843884 0.137117 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:05:39.490897 0.000000 udp 10.0.2.105 7010 -> 86.4.127.47 8116 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:45.462836 0.000000 udp 10.0.2.105 7010 -> 206.11.107.34 9099 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:51.759281 0.000000 udp 10.0.2.105 7010 -> 180.92.40.37 5497 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:05:57.947114 0.000000 udp 10.0.2.105 7010 -> 50.193.105.14 3113 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:04.555139 0.000000 udp 10.0.2.105 7010 -> 70.49.6.92 2252 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:09.075685 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:06:11.652559 0.000000 udp 10.0.2.105 7010 -> 216.215.106.130 2268 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:14.614449 2.964975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 13:06:20.310743 0.344883 udp 10.0.2.105 7010 <-> 79.6.197.209 3797 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:06:21.604040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:06:21.617011 0.000000 udp 10.0.2.105 7010 -> 76.188.46.243 2160 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:29.508848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:06:29.842997 0.000000 udp 10.0.2.105 7010 -> 87.11.38.117 3217 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:34.355149 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:06:38.244349 0.000000 udp 10.0.2.105 7010 -> 50.192.41.189 7756 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:45.347274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:06:45.780560 0.000000 udp 10.0.2.105 7010 -> 78.172.138.173 9809 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:53.521067 0.000000 udp 10.0.2.105 7010 -> 87.7.126.118 8738 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:06:58.177045 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:07:01.952422 0.000000 udp 10.0.2.105 7010 -> 90.209.102.218 3066 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:07:08.702297 0.000000 udp 10.0.2.105 7010 -> 84.2.67.165 3469 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:07:17.294522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:07:17.615064 0.000000 udp 10.0.2.105 7010 -> 92.106.27.175 2807 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:07:22.181493 0.183436 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:13:21.301372 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:13:28.307711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:13:36.309282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:13:52.312697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:14:24.319225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:20:28.329180 2.996957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:20:35.331770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:20:43.342970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:20:59.346391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:21:31.353994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:22:38.329067 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:22:38.329157 0.968308 tcp 10.0.2.105 56052 -> 128.255.183.224 9027 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:27:35.357796 3.002887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:27:42.366687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:27:50.368344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:28:06.370122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:28:38.386774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:34:42.393101 3.000807 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:34:49.399545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:34:57.401377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:35:13.404308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:35:45.420190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:37:40.025604 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:37:40.025706 0.236931 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:40.263104 0.295783 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:40.559385 0.159364 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:40.719282 0.057807 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:40.777454 0.144639 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:40.922554 0.210248 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:41.133294 0.350240 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:41.483964 0.162431 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:41.646866 0.303784 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:41.977341 0.145061 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.122793 0.208518 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.331734 0.222507 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.554637 0.142510 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.697543 0.097432 udp 10.0.2.105 7010 <-> 31.192.27.210 5496 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.795379 0.056070 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:42.851846 0.194505 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:43.046699 0.074068 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:43.121207 0.039958 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:43.161587 0.174423 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:43.336633 0.205859 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:37:43.542892 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:38:01.839493 0.053465 tcp 10.0.2.105 56053 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:01.893251 0.074140 tcp 10.0.2.105 56054 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:01.967260 0.187572 tcp 10.0.2.105 56055 -> 195.113.214.236 443 SRPA* 0 0 23 12582 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:02.155377 0.120513 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.276317 0.274566 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.551335 0.179534 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.731302 0.052123 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.783874 0.131119 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.915471 0.056099 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:02.972020 0.000000 udp 10.0.2.105 7010 -> 86.177.80.69 8321 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:38:20.854214 0.051626 tcp 10.0.2.105 56056 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:20.906147 0.070009 tcp 10.0.2.105 56057 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:20.976504 0.158708 tcp 10.0.2.105 56058 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:21.135799 0.417024 udp 10.0.2.105 7010 <-> 119.74.180.103 6769 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:21.553195 0.238501 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:21.792136 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:38:38.651259 0.052660 tcp 10.0.2.105 56059 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:38.704402 0.074836 tcp 10.0.2.105 56060 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:38.779569 0.155390 tcp 10.0.2.105 56061 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:38.935483 0.000000 udp 10.0.2.105 7010 -> 78.134.120.61 6943 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 13:38:54.813789 0.052415 tcp 10.0.2.105 56062 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:54.866512 0.075773 tcp 10.0.2.105 56063 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:54.942604 0.155805 tcp 10.0.2.105 56064 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:38:55.097502 0.224108 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:55.322051 0.221739 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:55.544189 0.239686 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:55.784316 0.178214 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:55.962856 0.135058 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:38:56.098302 0.452481 udp 10.0.2.105 7010 <-> 79.6.197.209 3797 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/18 13:41:49.427326 3.000421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 13:41:56.433674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:42:04.435223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:42:20.438000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:42:52.446739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:48:56.450531 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:49:03.458135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:49:11.459755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:49:27.462562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:49:59.468576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:52:39.298833 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 13:52:39.299009 0.956964 tcp 10.0.2.105 56065 -> 128.255.183.224 9027 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/01/18 13:56:03.474962 3.004311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 13:56:10.481907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:56:18.483273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:56:34.485940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 13:57:06.494720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:03:10.498558 3.000811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:03:17.505364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:03:25.506888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:03:41.510183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:04:13.515951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:09:08.670943 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 14:09:08.671058 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:09:24.854791 0.053575 tcp 10.0.2.105 56066 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:24.908686 0.066908 tcp 10.0.2.105 56067 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:24.975446 0.159335 tcp 10.0.2.105 56068 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:25.135296 0.000000 udp 10.0.2.105 7010 -> 86.177.80.69 8321 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:09:40.727419 0.051955 tcp 10.0.2.105 56069 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:40.779626 0.068700 tcp 10.0.2.105 56070 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:40.848557 0.546526 tcp 10.0.2.105 56071 -> 195.113.214.236 443 SRPA* 0 0 73 78428 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:41.395872 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:09:56.990467 0.052153 tcp 10.0.2.105 56072 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:57.042916 0.064800 tcp 10.0.2.105 56073 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:57.107960 0.156254 tcp 10.0.2.105 56074 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:09:57.264927 0.000000 udp 10.0.2.105 7010 -> 78.134.120.61 6943 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:10:14.746291 0.053800 tcp 10.0.2.105 56075 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:14.799876 0.062149 tcp 10.0.2.105 56076 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:14.862325 0.164293 tcp 10.0.2.105 56077 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:15.026897 0.285938 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:15.313698 0.215304 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:15.529374 0.057374 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:15.587183 0.346330 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:15.933933 0.160208 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:16.094562 0.137749 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:16.232768 0.160952 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:16.394196 0.144027 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:16.538680 0.304266 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:16.843384 0.338256 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.182052 0.155731 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.338207 0.082021 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.420645 0.044855 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.465886 0.226585 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.521751 3.006377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 14:10:17.692873 0.268026 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:17.961264 0.185521 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:18.147190 0.056016 udp 10.0.2.105 7010 <-> 188.121.218.27 1385 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:18.203625 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:10:24.529431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:10:32.534491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:10:36.469394 0.053157 tcp 10.0.2.105 56078 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:36.522878 0.061328 tcp 10.0.2.105 56079 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:36.584061 0.162001 tcp 10.0.2.105 56080 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:36.746744 0.147487 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:36.894692 0.040601 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:36.935693 0.120005 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.056177 0.057027 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.113626 0.142886 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.256930 0.053967 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.311307 0.262779 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.574530 0.132753 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:37.707714 0.399181 udp 10.0.2.105 7010 <-> 119.74.180.103 6769 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:38.107265 0.246240 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:38.353948 0.265631 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:38.619906 0.180548 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:38.800834 0.134240 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:38.935451 0.222557 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:39.158403 0.180858 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:10:39.339622 0.000000 udp 10.0.2.105 7010 -> 79.6.197.209 3797 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:10:48.533959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:10:56.598015 0.052469 tcp 10.0.2.105 56081 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:56.650793 0.061728 tcp 10.0.2.105 56082 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:10:56.712781 0.156577 tcp 10.0.2.105 56083 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:11:20.539924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:17:24.550845 3.000511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:17:31.553398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:17:39.554933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:17:55.557922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:18:27.564027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:22:40.260104 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 14:22:40.260223 1.326327 tcp 10.0.2.105 56084 -> 128.255.183.224 9027 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:24:31.572721 3.002033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:24:38.578961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:24:46.578720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:25:02.581959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:25:34.587905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:31:38.614287 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:31:45.621299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:31:53.626593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:32:09.626549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:32:41.632135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:38:45.638436 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:38:52.645655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:39:00.646936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:39:16.898109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:39:48.668722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:41:16.412992 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 14:41:16.413097 0.000000 udp 10.0.2.105 7010 -> 31.192.27.210 5496 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:41:32.047650 0.052697 tcp 10.0.2.105 56085 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:32.100638 0.062973 tcp 10.0.2.105 56086 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:32.163472 0.152238 tcp 10.0.2.105 56087 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:32.316448 0.000000 udp 10.0.2.105 7010 -> 79.6.197.209 3797 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:41:47.437486 0.052536 tcp 10.0.2.105 56088 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:47.490341 0.064206 tcp 10.0.2.105 56089 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:47.554835 0.160907 tcp 10.0.2.105 56090 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:41:47.716673 0.283750 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.000843 0.064752 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.066035 0.160630 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.227100 0.137838 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.365373 0.161869 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.527580 0.058352 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.588722 0.215206 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.804436 0.163115 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:48.968040 0.288785 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:49.257286 0.144414 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:49.402129 0.352215 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:49.754674 0.039260 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:49.794330 0.182351 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:41:49.977054 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:42:06.985445 0.052046 tcp 10.0.2.105 56091 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:07.037783 0.065089 tcp 10.0.2.105 56092 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:07.103163 0.161240 tcp 10.0.2.105 56093 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:07.265006 0.078117 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:07.343603 0.222325 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:07.566560 0.175694 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:07.742722 0.118387 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:07.861568 0.057526 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:07.919460 0.159950 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.079849 0.054711 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.134921 0.161140 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.296684 0.039238 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.336381 0.130631 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.467476 0.389227 udp 10.0.2.105 7010 <-> 119.74.180.103 6769 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:08.857083 0.238496 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:09.095961 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 14:42:25.822497 0.053307 tcp 10.0.2.105 56094 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:25.875655 0.066993 tcp 10.0.2.105 56095 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:25.942960 0.157481 tcp 10.0.2.105 56096 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:42:26.101158 0.208893 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:26.310487 0.307733 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:26.618620 0.173829 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:26.792860 0.233979 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:42:27.027299 0.134559 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/18 14:46:10.679416 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 14:46:17.685451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:46:25.686318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:46:41.689846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:47:13.695784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:52:41.588063 0.000237 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 14:52:41.588428 0.964845 tcp 10.0.2.105 56097 -> 128.255.183.224 9027 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/01/18 14:53:17.702878 3.000583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 14:53:24.709290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:53:32.710803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:53:48.713498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 14:54:20.719880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:00:24.726281 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:00:31.733072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:00:39.734841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:00:55.737797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:01:27.743773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:07:32.752535 3.000317 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:07:39.759267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:07:47.760621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:08:03.762682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:08:35.768594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:12:42.264035 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 15:12:42.264150 0.000000 udp 10.0.2.105 7010 -> 188.121.218.27 1385 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 15:12:59.832345 0.152801 tcp 10.0.2.105 56098 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:12:59.985440 0.063853 tcp 10.0.2.105 56099 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:13:00.049574 0.160573 tcp 10.0.2.105 56100 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:13:00.208596 0.279195 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:00.488144 0.166169 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:00.654764 0.063217 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:00.718498 0.309212 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:01.028146 0.144977 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:01.173534 0.276750 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:01.450740 0.301227 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:01.752463 0.142183 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:01.895157 0.161946 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.057535 0.056322 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.114299 0.227677 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.342430 0.336044 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.678903 0.185774 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.865056 0.044207 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.909649 0.081555 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:02.991633 0.176590 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.168667 0.119861 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.288956 0.056043 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.345476 0.144930 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.490845 0.051310 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.542566 0.145553 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.688782 0.041997 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.731209 0.231244 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:03.962887 0.130500 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:04.093841 0.392655 udp 10.0.2.105 7010 <-> 119.74.180.103 6769 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:04.486943 0.257142 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:04.744671 0.208516 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:04.953635 0.270220 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:05.224447 0.134493 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:05.359303 0.209683 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:13:05.569373 0.178188 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:14:39.776205 3.000590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:14:46.783149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:14:54.784771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:15:10.787004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:15:42.793073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:21:47.800780 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:21:54.808435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:22:02.809233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:22:19.593133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:22:43.051175 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 15:22:43.051342 1.569904 tcp 10.0.2.105 56101 -> 128.255.183.224 9027 FSPA* 0 0 12 1478 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:22:51.230109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:28:54.834501 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:29:01.845771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:29:09.844487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:29:25.847691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:29:57.852632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:36:01.860004 3.002867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:36:08.865935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:36:16.867408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:36:32.870735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:37:04.876817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:43:15.309406 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 15:43:15.309506 0.104897 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:15.414773 0.270342 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:15.685551 0.137664 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:15.823583 0.263393 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:16.087336 0.164804 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:16.252767 0.372581 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:16.625707 0.286779 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:16.912908 0.142257 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:17.055610 0.228396 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:17.284610 0.163460 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:17.448503 0.059040 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:17.507969 0.336716 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:17.845118 0.255359 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.100869 0.040548 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.142289 0.079732 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.222428 0.176226 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.399080 0.118936 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.518383 0.060320 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.579151 0.207280 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.786843 0.041393 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:18.828667 0.228712 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:19.057837 0.130780 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:19.189075 0.193164 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:19.382681 0.053724 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:19.485484 0.000000 udp 10.0.2.105 7010 -> 119.74.180.103 6769 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 15:43:35.360913 0.053831 tcp 10.0.2.105 56102 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:35.415031 0.067988 tcp 10.0.2.105 56103 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:35.483316 0.161738 tcp 10.0.2.105 56104 -> 195.113.214.236 443 SRPA* 0 0 51 33782 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:35.645833 0.223643 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:35.869934 0.135270 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:36.005639 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 15:43:54.508353 0.051975 tcp 10.0.2.105 56105 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:54.560644 0.072987 tcp 10.0.2.105 56106 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:54.633952 0.157678 tcp 10.0.2.105 56107 -> 195.113.214.236 443 SRPA* 0 0 31 22148 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:43:54.792360 0.253398 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:55.046220 0.419388 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:43:55.466046 0.178939 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 15:44:41.888064 2.999728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 15:44:48.959123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:44:56.905176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:45:12.908103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:45:44.914221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:51:53.927312 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:52:00.934277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:52:08.936208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:52:24.939685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:52:44.147606 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 15:52:44.147711 0.953641 tcp 10.0.2.105 56108 -> 128.255.183.224 9027 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/18 15:52:56.945017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:59:00.952357 3.000448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 15:59:07.958846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:59:15.961053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 15:59:31.963231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:00:03.969107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:06:11.985022 2.997341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:06:18.988701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:06:26.990275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:06:42.995948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:07:14.998921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:13:24.013672 3.000732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:13:31.020949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:13:39.021184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:13:55.023854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:14:07.793173 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 16:14:07.793366 0.386331 udp 10.0.2.105 7010 -> 119.74.180.103 6769 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 16:14:08.179697 0.000000 icmp 119.74.180.103 0x0303 -> 10.0.2.105 0x711a URP 192 1 167 flow=Background 1970/01/18 16:14:25.881373 0.341629 tcp 10.0.2.105 56109 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:26.223362 0.068249 tcp 10.0.2.105 56110 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:26.291540 0.159160 tcp 10.0.2.105 56111 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:26.451415 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 16:14:27.303208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:14:44.180938 0.053015 tcp 10.0.2.105 56112 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:44.234275 0.065094 tcp 10.0.2.105 56113 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:44.299177 0.163859 tcp 10.0.2.105 56114 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:14:44.463804 0.110343 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:44.617619 0.159615 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:44.777670 0.137779 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:44.915845 0.284345 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:45.200638 0.258717 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:45.459751 0.300887 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:45.761068 0.165225 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:45.926713 0.143760 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:46.070966 0.191690 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:46.263055 0.253295 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:46.516745 0.163019 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:46.680131 0.338374 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.018996 0.057299 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.076707 0.120338 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.197467 0.056579 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.254497 0.146217 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.401167 0.040421 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.442008 0.044992 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.487461 0.174607 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.662491 0.077694 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.740805 0.132303 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:47.873504 0.231560 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:48.105494 0.239172 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:48.345120 0.055313 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:48.400806 0.219624 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:48.620786 0.134857 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:48.756100 0.363505 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:49.119983 0.186313 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:14:49.306746 0.180195 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:20:31.036703 3.003841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:20:38.043705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:20:46.045527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:21:02.047660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:21:34.056885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:22:45.107353 0.000220 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 16:22:45.107692 1.243671 tcp 10.0.2.105 56115 -> 128.255.183.224 9027 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:27:38.060580 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:27:45.067718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:27:53.069400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:28:09.072161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:28:41.080819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:34:45.084517 3.006113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:34:52.091474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:35:00.093596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:35:16.096041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:35:48.102328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:41:52.109991 2.999583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:41:59.115458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:42:07.118528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:42:23.119877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:42:55.126039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:44:56.301308 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 16:44:56.301419 0.875833 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:57.177607 0.160275 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:57.338327 0.263683 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:57.602397 0.287768 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:57.890631 0.163318 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:58.054409 0.141683 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:58.196475 0.151559 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:58.348545 0.280356 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:58.629360 0.191707 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:58.821419 0.244076 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.065974 0.162849 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.229192 0.337658 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.567257 0.056482 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.624109 0.120483 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.745066 0.053658 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.799100 0.142442 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.942014 0.043715 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:44:59.986200 0.044608 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:00.031263 0.176463 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:00.208166 0.082813 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:00.291443 0.131671 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:00.423503 0.225653 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:00.649567 0.441480 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:01.091409 0.052651 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:01.144640 0.226735 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:01.371805 0.134912 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:01.507131 0.180189 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:01.687754 0.382624 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:45:02.070800 0.326061 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/18 16:48:59.132876 3.003747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:49:06.139460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:49:14.141002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:49:30.143936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:50:02.150195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:52:46.356784 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 16:52:46.356874 0.991949 tcp 10.0.2.105 56116 -> 128.255.183.224 9027 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/01/18 16:56:06.157418 3.000472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 16:56:13.163402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:56:21.165040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:56:37.168091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 16:57:09.174075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:03:13.181223 3.000281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:03:20.187526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:03:28.189106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:03:44.192019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:04:16.198269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:10:26.212956 3.001098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:10:33.220693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:10:41.221838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:10:57.225042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:11:29.230909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:15:17.810490 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 17:15:17.810598 0.350193 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:18.161192 0.164481 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:18.326104 0.156282 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:18.482867 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 17:15:36.817595 0.053586 tcp 10.0.2.105 56117 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:15:36.870988 0.062470 tcp 10.0.2.105 56118 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:15:36.933694 0.135404 tcp 10.0.2.105 56119 -> 195.113.214.236 443 SRPA* 0 0 33 23848 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:15:37.069735 0.293791 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:37.363935 0.145733 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:37.510059 0.151934 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:37.662376 0.301717 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:37.964464 0.162177 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:38.127055 0.193653 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:38.321292 0.226329 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:38.547972 0.337389 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:38.885746 0.056994 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:38.943132 0.121400 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.064984 0.055406 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.120823 0.141763 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.262985 0.062271 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.325664 0.038781 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.364835 0.131902 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.497131 0.222389 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.719904 0.174826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.895069 0.079291 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:39.974805 0.142133 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:40.117384 0.052303 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:40.170081 0.223500 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:40.394035 0.134590 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:40.529057 0.176847 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:40.706304 0.333861 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:15:41.045271 0.224667 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:17:33.236711 3.000996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:17:40.291802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:17:48.255476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:18:04.258718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:18:36.264695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:22:47.357434 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 17:22:47.357533 1.020208 tcp 10.0.2.105 56120 -> 128.255.183.224 9027 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:24:40.271505 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:24:47.277830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:24:55.279467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:25:11.282721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:25:43.289435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:31:47.294773 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:31:54.302025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:32:02.303504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:32:18.307358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:32:50.312572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:38:54.319163 3.000704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:39:01.326394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:39:09.327260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:39:25.330964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:39:57.336522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:46:04.334448 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 17:46:04.334553 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 17:46:12.349519 3.000469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:46:19.355955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:46:19.788508 0.031708 tcp 10.0.2.105 56121 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:46:19.820563 0.067580 tcp 10.0.2.105 56122 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:46:19.888663 0.162847 tcp 10.0.2.105 56123 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:46:20.049792 0.199141 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:20.249382 0.164733 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:20.414547 0.156593 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:20.571567 0.304834 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:20.876820 0.145199 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:21.022433 0.163552 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:21.186408 0.188730 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:21.375612 0.152098 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:21.528156 0.278347 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:21.806940 0.214813 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.022127 0.338434 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.360999 0.056981 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.418370 0.119138 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.537903 0.059156 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.597470 0.037894 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.635809 0.134976 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.771219 0.227528 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:22.999205 0.173719 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.173352 0.148219 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.322019 0.044667 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.367027 0.071901 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.439273 0.143644 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.583333 0.054104 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.637885 0.238671 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:23.876987 0.133482 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:24.010843 0.180240 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:24.191515 0.421553 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:24.613592 0.247976 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 17:46:27.359818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:46:43.360180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:47:15.367203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:52:48.386432 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 17:52:48.386536 0.978873 tcp 10.0.2.105 56124 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/18 17:53:19.374909 2.999077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 17:53:26.379658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:53:34.381166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:53:50.386873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 17:54:22.390054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:00:26.396646 3.004138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:00:33.403672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:00:41.405919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:00:57.407948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:01:29.415617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:07:33.425229 3.003353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:07:40.429772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:07:48.429718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:08:04.447777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:08:36.447338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:14:40.451916 2.996529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:14:47.454316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:14:55.459648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:15:11.463866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:15:43.472143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:16:32.334887 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 18:16:32.334992 0.165623 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:32.501077 0.485088 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:32.986678 0.166036 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:33.153099 0.162521 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:33.316007 0.305264 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:33.621719 0.141908 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:33.764086 0.189404 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:33.953915 0.151631 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.105998 0.210988 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.317470 0.057502 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.375426 0.121311 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.497216 0.054067 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.551699 0.229417 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:34.781556 0.335461 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.117486 0.038467 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.156456 0.132781 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.289698 0.219484 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.509700 0.176700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.686772 0.144146 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.831603 0.039823 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.871908 0.076459 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:35.948835 0.147863 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:36.097221 0.055443 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:36.153123 0.222515 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:36.376048 0.134493 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:36.511441 0.178135 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:36.690057 0.359659 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:16:37.050170 0.000000 udp 10.0.2.105 7010 -> 41.189.45.248 6144 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 18:16:54.991669 0.030951 tcp 10.0.2.105 56125 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 18:16:55.022984 0.065631 tcp 10.0.2.105 56126 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 18:16:55.088928 0.162281 tcp 10.0.2.105 56127 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/18 18:21:47.469369 3.015738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:21:54.478542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:22:02.500171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:22:18.498729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:22:49.370384 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 18:22:49.370581 1.082440 tcp 10.0.2.105 56128 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/18 18:22:50.489736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:28:54.492099 3.002671 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:29:01.516380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:29:09.510912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:29:25.514103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:29:57.520659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:36:01.526538 3.001030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:36:08.533548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:36:16.534925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:36:32.537525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:37:04.543734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:44:41.553988 3.016668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:44:48.571421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:44:56.572622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:45:12.575657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:45:44.582348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:47:15.542875 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 18:47:15.542970 0.152629 udp 10.0.2.105 7010 <-> 41.189.45.248 6144 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:15.696008 0.157435 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:15.853794 0.107276 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:15.961425 0.162294 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:16.124045 0.289001 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:16.413519 0.147024 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:16.560888 0.186988 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:16.748329 0.144928 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:16.893712 0.159962 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.054131 0.119273 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.173908 0.056115 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.230483 0.249670 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.480527 0.339399 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.820413 0.057246 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:17.878112 0.281032 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.159579 0.129089 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.289051 0.039783 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.329252 0.239935 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.569670 0.139933 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.710051 0.040962 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.751445 0.072523 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.824425 0.140364 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:18.965180 0.056218 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:19.021801 0.217875 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:19.240099 0.135300 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:19.397340 0.214663 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:19.612569 0.178238 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:47:19.791252 0.426406 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 18:51:55.598209 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:52:02.605538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:52:10.607102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:52:26.609732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:52:50.454517 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 18:52:50.454788 0.983682 tcp 10.0.2.105 56129 -> 128.255.183.224 9027 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/18 18:52:58.616120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:59:02.622887 3.000381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 18:59:09.628739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:59:17.630760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 18:59:33.633502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:00:05.640528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:06:14.653885 3.000665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:06:21.660781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:06:29.661580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:06:45.665154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:07:17.672050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:13:22.678590 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:13:29.689485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:13:37.687309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:13:53.693536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:14:25.696435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:17:45.153672 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 19:17:45.153781 0.000000 udp 10.0.2.105 7010 -> 41.189.45.248 6144 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 19:18:00.318889 0.031037 tcp 10.0.2.105 56130 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:18:00.350229 0.064701 tcp 10.0.2.105 56131 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:18:00.415211 0.156501 tcp 10.0.2.105 56132 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:18:00.572343 0.160215 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:00.733094 0.064270 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:00.797733 0.590842 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:01.388957 0.301149 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:01.690558 0.147301 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:01.838297 0.184889 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.023656 0.144822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 590 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.168823 0.056793 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.225996 0.229204 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.455596 0.339369 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.795352 0.057559 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:02.853340 0.159702 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.013522 0.120931 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.134889 0.300606 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.435958 0.134672 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.571014 0.039551 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.610904 0.176448 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.787787 0.143875 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.932062 0.043848 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:03.976420 0.079875 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:04.056709 0.146206 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:04.203329 0.055229 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:04.258955 0.636441 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:04.895789 0.178396 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:05.074616 0.357372 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:05.432455 0.221936 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:18:05.654851 0.136131 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:20:29.702588 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:20:36.709514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:20:44.711175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:21:00.714278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:21:32.720162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:22:51.444176 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 19:22:51.444287 0.957855 tcp 10.0.2.105 56133 -> 128.255.183.224 9027 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:27:36.726076 3.002884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:27:43.733774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:27:51.736000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:28:07.738571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:28:39.744211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:34:43.750023 3.003031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:34:50.757074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:34:58.760452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:35:14.765065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:35:46.768535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:41:50.785633 3.000410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:41:57.791534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:42:05.793344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:42:21.795910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:42:53.802610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:48:12.523792 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 19:48:12.524079 0.000000 udp 10.0.2.105 7010 -> 41.189.45.248 6144 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/18 19:48:27.735913 0.053201 tcp 10.0.2.105 56134 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:48:27.789413 0.062169 tcp 10.0.2.105 56135 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:48:27.851890 0.155841 tcp 10.0.2.105 56136 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:48:28.006765 0.155432 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:28.162670 0.064187 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:28.227310 0.721467 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:28.949158 0.288932 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:29.238465 0.146737 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:29.385573 0.247881 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:29.633814 0.151869 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:29.786100 0.059158 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:29.846214 0.280265 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:30.126928 0.340851 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:30.468300 0.059994 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:30.528688 0.165450 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:30.694530 0.119959 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:30.814896 0.193544 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.008855 0.132866 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.142136 0.045080 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.187601 0.175979 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.363977 0.142354 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.506768 0.042943 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.550137 0.076856 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.627390 0.142904 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.770710 0.053962 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:31.825085 0.284567 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:32.110262 0.225173 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:32.335907 0.181012 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:32.517306 0.223052 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:32.740756 0.138069 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/18 19:48:57.808894 3.001124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:49:04.815199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:49:12.817903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:49:28.820258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:50:00.825647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:52:52.403209 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 19:52:52.403489 0.954200 tcp 10.0.2.105 56137 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/18 19:56:04.833790 3.000009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 19:56:11.839892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:56:19.841575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:56:35.844606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 19:57:07.849964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:03:11.855743 3.003082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:03:18.863561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:03:26.865381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:03:42.868155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:04:14.874494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:10:24.889559 3.001170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:10:31.895994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:10:39.898825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:10:55.900867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:11:27.906614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:17:31.912487 3.001612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:17:38.920387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:17:46.921527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:18:02.924801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:18:34.933111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:18:41.101000 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 20:18:41.101089 0.153921 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:41.255463 0.063095 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:41.318926 0.147521 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:41.466837 0.186693 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:41.653942 0.162762 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:41.817206 0.296620 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:42.114187 0.151695 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:42.266315 0.055745 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:42.322529 0.226990 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:42.549877 0.335344 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:42.957587 0.060522 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.018570 0.164143 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.183172 0.121285 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.305320 0.197428 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.503203 0.130740 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.634322 0.045974 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.680716 0.175271 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.856340 0.141579 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:43.998344 0.039387 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.038068 0.078932 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.117423 0.276897 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.394723 0.226808 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.621978 0.180323 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.802703 0.146957 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:44.950099 0.055839 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:45.006307 0.218877 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:18:45.225659 0.135090 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:22:53.363379 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 20:22:53.363544 1.036931 tcp 10.0.2.105 56138 -> 128.255.183.224 9027 FSPA* 0 0 12 1443 flow=From-Botnet-V2-TCP-Established 1970/01/18 20:24:38.937367 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 20:24:45.944108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:24:53.945651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:25:09.948028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:25:41.954706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:31:45.962143 3.000644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:31:52.968122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:32:00.969458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:32:16.972817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:32:48.978750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:38:52.986290 2.999960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:38:59.991824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:39:07.994220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:39:23.996128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:39:56.002718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:46:14.008583 3.002092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 20:46:21.015866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:46:29.017596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:46:45.020973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:47:17.026114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:48:54.276715 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 20:48:54.276815 0.154483 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:54.431689 0.083210 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:54.515332 0.147691 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:54.663520 0.196335 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:54.860227 0.161937 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:55.022621 0.288020 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:55.311085 0.216013 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:55.527465 0.339786 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:55.867619 0.059238 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:55.927245 0.144755 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.072403 0.054973 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.127834 0.166917 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.295209 0.121247 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.416908 0.194870 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.612211 0.132105 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.744708 0.044488 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.789604 0.177624 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:56.967627 0.144151 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:57.112359 0.044582 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:57.157372 0.511623 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:57.669448 0.180821 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:57.850605 0.146165 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:57.997108 0.051319 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:58.048811 0.076768 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:58.125958 0.206401 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:58.332791 0.219417 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:48:58.552787 0.133752 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 20:52:54.403654 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 20:52:54.403754 0.959391 tcp 10.0.2.105 56139 -> 128.255.183.224 9027 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/01/18 20:53:21.034260 2.999739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 20:53:28.040033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:53:36.042063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:53:52.044646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 20:54:24.050860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:00:28.056961 3.000977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:00:35.066527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:00:43.066782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:00:59.068114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:01:31.074503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:07:35.081550 3.094242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:07:42.151908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:07:50.099847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:08:06.102695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:08:38.108717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:14:42.116205 2.999945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:14:49.122148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:14:57.123440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:15:13.126718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:15:45.133002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:19:21.694176 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 21:19:21.694281 0.153305 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:21.847961 0.060209 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:21.908549 0.146067 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.055052 0.171498 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.226935 0.162864 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.390169 0.296435 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.687024 0.059310 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.746774 0.151432 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:22.898567 0.059317 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:23.065746 0.323948 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:23.390163 0.336148 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:23.726759 0.166790 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:23.893984 0.120837 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:24.015230 0.274691 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:24.290402 0.133163 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:24.423919 0.045650 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:24.469946 0.186013 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:24.656387 0.422829 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.079657 0.142985 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.223095 0.039220 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.262674 0.179041 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.442160 0.297388 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.740013 0.051095 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.791507 0.083650 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:25.875497 0.207090 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:26.082958 0.238570 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:19:26.321964 0.133338 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:21:49.139682 3.001965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:21:56.145966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:22:04.147814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:22:20.150877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:22:52.157862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:22:55.373207 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 21:22:55.373315 1.129609 tcp 10.0.2.105 56140 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/18 21:28:56.162674 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:29:03.169744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:29:11.171552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:29:27.174655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:29:59.180019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:36:03.187088 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:36:10.193800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:36:18.196896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:36:34.198634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:37:06.207594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:44:43.214946 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:44:50.223606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:44:58.222734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:45:14.225993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:45:46.232129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:49:51.885497 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 21:49:51.885757 0.147660 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.033877 0.155942 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.190235 0.063310 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.253944 0.162546 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.416873 0.162174 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.579437 0.299436 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.879291 0.059395 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:52.939072 0.151717 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:53.091196 0.059240 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:53.150814 0.166731 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:53.317978 0.121026 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:53.439380 0.226866 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:53.666679 0.337770 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.004869 0.302600 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.307868 0.130546 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.438953 0.044685 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.484146 0.220442 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.705012 0.225221 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:54.930654 0.145351 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.076478 0.041102 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.118012 0.176397 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.294801 0.199652 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.494859 0.053422 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.548741 0.072637 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.621814 0.207287 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:55.829524 0.228784 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:49:56.058744 0.133475 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/18 21:51:56.247441 3.000630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:52:03.253912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:52:11.256037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:52:27.258759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:52:56.511456 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 21:52:56.511561 0.930568 tcp 10.0.2.105 56141 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/18 21:52:59.264994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:59:03.272026 3.000275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 21:59:10.278514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:59:18.279705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 21:59:34.282869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:00:06.288655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:06:15.302876 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:06:22.309361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:06:30.310728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:06:46.313619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:07:18.319814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:13:25.336505 2.996770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:13:32.337615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:13:40.339187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:13:56.341997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:14:28.348154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:20:21.417221 0.000299 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 22:20:21.417627 0.059656 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:21.477661 0.170795 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:21.648923 0.146060 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:21.795414 0.154464 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:21.950322 0.162894 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.256820 0.298522 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.555775 0.059544 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.615777 0.151454 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.767689 0.056929 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.824978 0.164086 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:22.989502 0.120288 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:23.110226 0.227094 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:23.337761 0.367553 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:23.705740 0.212185 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:23.918324 0.130683 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.049396 0.039773 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.089542 0.174695 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.264701 0.227169 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.492324 0.143346 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.636110 0.038909 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.675446 0.179903 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:24.855778 0.146715 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:25.002960 0.055023 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:25.058439 0.078542 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:25.137535 0.133624 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:25.271628 0.207231 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:25.479292 0.233847 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:20:32.354377 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:20:39.361468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:20:47.362876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:21:03.366219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:21:35.372091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:22:57.450704 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 22:22:57.450807 1.118196 tcp 10.0.2.105 56142 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/18 22:27:39.379887 3.000022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:27:46.385429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:27:54.389524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:28:10.390698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:28:42.396123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:34:46.402904 3.000697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:34:53.420259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:35:01.421139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:35:17.427447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:35:49.430715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:41:53.456348 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:42:00.465019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:42:08.738958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:42:24.600793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:42:56.484502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:49:00.490872 3.000653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 22:49:07.497111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:49:15.498911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:49:31.502192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:50:03.507871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:50:55.961522 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 22:50:55.961623 0.145056 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.107068 0.154402 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.261916 0.063953 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.326273 0.164272 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.490963 0.162440 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.653816 0.291646 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:56.945793 0.058977 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.005191 0.138051 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.143664 0.059509 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.203631 0.168723 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.372845 0.118662 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.491910 0.218814 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:57.711160 0.337278 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.048870 0.287096 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.336542 0.129602 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.466540 0.039670 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.506609 0.175416 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.682430 0.218219 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:58.900995 0.143799 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.045202 0.040606 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.086217 0.179896 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.266564 0.142573 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.409562 0.051399 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.461328 0.206432 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.668192 0.220764 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.889380 0.078222 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:50:59.968060 0.135857 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/18 22:52:58.590318 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 22:52:58.590414 0.967864 tcp 10.0.2.105 56143 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/18 22:56:07.514585 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 22:56:14.521353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:56:22.522926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:56:38.525923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 22:57:10.531934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:03:14.538538 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:03:21.545098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:03:29.546843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:03:45.549465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:04:17.556091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:10:21.562710 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:10:28.569170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:10:36.570759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:10:52.573961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:11:24.579283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:17:28.596306 3.090641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:17:35.662554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:17:43.625008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:17:59.627759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:18:31.633887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:21:15.840499 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 23:21:15.840609 0.094651 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:15.935687 0.167551 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.103609 0.146071 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.250125 0.155464 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.406068 0.161516 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.568049 0.290176 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.858728 0.059223 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:16.918380 0.151907 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.070692 0.055573 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.126652 0.169112 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.296189 0.345870 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.642492 0.127550 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.770526 0.212527 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:17.983426 0.235305 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.219171 0.131826 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.351333 0.044291 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.395958 0.175739 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.572139 0.223218 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.795746 0.143159 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.939322 0.047170 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:18.986920 0.053615 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.040976 0.206785 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.248214 0.234867 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.483555 0.118057 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.602069 0.181024 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.783535 0.142717 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:21:19.926729 0.133450 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:22:59.560463 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 23:22:59.560634 1.146412 tcp 10.0.2.105 56144 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/18 23:24:35.640341 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 23:24:42.647597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:24:50.648915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:25:06.651808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:25:38.667844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:31:42.673949 3.003610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:31:49.681344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:31:57.683544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:32:13.685841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:32:45.693350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:38:49.700103 2.999444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:38:56.705522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:39:04.706847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:39:20.711875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:39:52.715789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:46:09.730581 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/18 23:46:16.737822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:46:24.739695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:46:40.742560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:47:12.748709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:51:41.735634 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 23:51:41.735755 0.059083 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:41.795249 0.223831 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:42.019507 0.146958 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:42.166894 0.154975 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:42.322267 0.754143 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.076797 0.302165 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.379427 0.059130 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.439009 0.145076 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.584435 0.055644 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.640499 0.125456 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:43.766351 0.248290 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.015039 0.166434 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.181906 0.337110 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.519449 0.237726 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.757555 0.131023 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.888980 0.039745 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:44.929127 0.174580 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.104158 0.239650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.344181 0.143115 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.487734 0.039696 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.527815 0.051995 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.580170 0.074470 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.655531 0.175626 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.831586 0.145712 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:45.977727 0.134610 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:46.112726 0.207087 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:51:46.320227 0.221088 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/18 23:53:00.708705 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/18 23:53:00.708908 1.057674 tcp 10.0.2.105 56145 -> 128.255.183.224 9027 FSPA* 0 0 12 1443 flow=From-Botnet-V2-TCP-Established 1970/01/18 23:53:16.753821 3.006042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/18 23:53:23.762948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:53:31.763243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:53:47.766225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/18 23:54:19.773110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:00:23.789605 3.000352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:00:30.797478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:00:38.797588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:00:54.800212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:01:26.816156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:07:30.822748 3.111377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:07:37.908044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:07:45.849632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:08:01.844281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:08:33.850554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:14:37.857672 3.000611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:14:44.864167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:14:52.866144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:15:08.868113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:15:40.875299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:21:44.882622 3.001129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:21:51.888015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:21:57.706115 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 00:21:57.706283 0.144864 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:57.851498 0.156551 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:58.008418 0.063139 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:58.071948 0.349427 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:58.421807 0.347478 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:58.769702 0.302209 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.072340 0.059420 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.132113 0.145047 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.277686 0.059320 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.337461 0.123292 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.461147 0.216459 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.678004 0.165039 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.843482 0.338456 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:21:59.889447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:22:00.182284 0.257299 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:00.440034 0.131400 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:00.571815 0.044826 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:00.617092 0.175353 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:00.792901 0.223816 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.017182 0.145668 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.163250 0.049073 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.212750 0.051979 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.265165 0.081917 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.347525 0.174925 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.522829 0.145682 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.668929 0.221420 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:01.890756 0.134869 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:02.026053 0.199912 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:22:15.892829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:22:47.899381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:23:01.769104 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 00:23:01.769275 0.973503 tcp 10.0.2.105 56146 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/19 00:28:51.905363 3.000263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:28:58.912712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:29:06.914035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:29:22.916470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:29:54.922579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:35:58.932058 3.174194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:36:06.080013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:36:14.010455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:36:29.950196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:37:01.955690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:44:38.976918 3.000225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:44:45.983352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:44:53.985569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:45:09.988008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:45:41.994938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:51:52.016009 2.994534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:51:59.016163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:52:07.017643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:52:19.376805 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 00:52:19.376913 0.064514 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:19.441814 0.147106 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:19.589398 0.179909 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:19.769683 0.179918 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:19.950052 0.559412 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:20.509895 0.297567 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:20.807836 0.057431 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:20.865680 0.120554 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:20.986716 0.215672 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:21.202845 0.162631 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:21.365866 0.137507 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:21.503830 0.054110 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:21.558351 0.336776 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:21.895551 0.266496 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.162484 0.131097 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.293984 0.045038 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.339467 0.178211 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.518115 0.222479 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.740930 0.145056 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.886401 0.041136 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.927924 0.051854 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:22.980316 0.079718 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:23.020827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:52:23.060504 0.179066 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:23.240086 0.146061 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:23.386572 0.220255 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:23.684109 0.135425 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:23.819934 0.205210 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/19 00:52:55.026435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:53:02.747793 1.109080 tcp 10.0.2.105 56147 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/19 00:58:59.225796 2.999208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 00:59:06.230559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:59:14.231770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 00:59:30.235174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:00:02.241375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:06:06.324242 3.004593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:06:13.334685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:06:21.336766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:06:37.339932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:07:09.344891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:13:13.351494 3.049367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:13:20.385619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:13:28.370627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:13:44.374802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:14:16.378998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:20:20.385927 3.000297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:20:27.394579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:20:35.393924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:20:51.396795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:21:23.403063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:22:28.837388 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 01:22:28.837495 0.153505 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:28.991360 0.064368 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:29.056341 0.148719 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:29.205498 0.164133 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:29.370068 0.529443 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:29.899936 0.300381 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.200711 0.054494 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.255551 0.167291 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.446564 0.144690 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.591654 0.054264 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.646317 0.120745 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.767456 0.218360 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:30.986244 0.335074 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:31.321761 0.279091 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:31.601301 0.131144 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:31.732865 0.045775 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:31.779044 0.175801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:31.955248 0.283704 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.239363 0.143874 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.383650 0.040140 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.424207 0.054488 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.479028 0.074475 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.553914 0.179095 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.733452 0.141831 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:32.875732 1.887046 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:34.763181 0.135886 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:22:34.899496 0.207075 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:23:03.901098 1.510645 tcp 10.0.2.105 56148 -> 128.255.183.224 9027 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/01/19 01:27:27.408560 3.004285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 01:27:34.416841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:27:42.417937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:27:58.421096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:28:30.427673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:34:34.432833 3.001409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:34:41.444791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:34:49.443058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:35:05.444774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:35:37.450625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:41:41.456311 3.001905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:41:48.464538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:41:56.466595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:42:12.468855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:42:44.474776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:48:48.481256 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:48:55.488085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:49:03.489292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:49:19.492607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:49:51.498558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:52:53.861429 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 01:52:53.861541 0.157815 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:54.019762 0.064723 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:54.084932 0.544283 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:54.629619 0.147980 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:54.778010 0.168369 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:54.969096 0.289058 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.258519 0.060455 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.319386 0.168374 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.488153 0.152056 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.640628 0.061630 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.702710 0.121079 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:55.824398 0.226755 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.051549 0.338857 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.390753 0.207256 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.598339 0.129824 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.728686 0.045987 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.775035 0.174721 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:56.950183 0.223130 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.173749 0.143113 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.317233 0.038917 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.356765 0.053293 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.410482 0.077279 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.488189 0.174175 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.662806 0.145992 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:57.809169 0.200764 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:58.010563 0.570833 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:52:58.581797 0.135101 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 01:53:05.418254 1.011805 tcp 10.0.2.105 56149 -> 128.255.183.224 9027 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/19 01:55:55.506380 2.999899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 01:56:02.512038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:56:10.513449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:56:26.516404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 01:56:58.522734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:03:02.530685 2.999864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:03:09.535968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:03:17.537749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:03:33.540684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:04:05.546876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:10:09.553482 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:10:16.559894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:10:24.563148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:10:40.564709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:11:12.570593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:17:16.577442 3.000647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:17:23.583924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:17:31.595501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:17:47.598286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:18:19.605113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:23:06.438212 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 02:23:06.438299 1.003362 tcp 10.0.2.105 56150 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:23:15.931230 0.164757 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.096582 0.189200 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.286218 0.058792 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.345445 0.150160 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.496004 0.165877 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.662345 0.325956 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:16.988748 0.058122 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:17.047271 0.163162 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:17.210886 0.164619 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:17.375951 0.229752 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:17.606062 0.404111 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:18.010560 0.137842 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:18.148810 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 02:23:33.751298 0.071263 tcp 10.0.2.105 56151 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:23:33.822919 0.072937 tcp 10.0.2.105 56152 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:23:33.896215 0.998834 tcp 10.0.2.105 56153 -> 195.113.214.236 443 SRPA* 0 0 56 48391 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:23:34.895768 0.219980 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.116197 0.131593 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.248204 0.040309 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.288916 0.175029 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.464446 0.228328 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.693225 0.145214 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.838921 0.042378 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:35.881720 0.180451 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:36.062533 0.485410 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:36.548335 0.201924 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:36.750722 0.051422 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:36.802571 0.075578 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:36.878565 0.220322 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:23:37.369754 0.134099 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:24:23.611357 3.002178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 02:24:30.618119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:24:38.619173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:24:54.622477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:25:26.628909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:31:30.635324 3.005665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:31:37.641881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:31:45.643994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:32:01.646511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:32:33.652544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:38:37.659208 3.000927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:38:44.666648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:38:52.670004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:39:08.671578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:39:40.677295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:46:06.684370 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:46:13.691593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:46:21.692691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:46:37.697440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:47:09.702260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:53:07.447457 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 02:53:07.447620 1.115648 tcp 10.0.2.105 56154 -> 128.255.183.224 9027 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:53:13.708758 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 02:53:20.715905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:53:28.716590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:53:39.933881 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 02:53:44.719968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 02:53:44.729945 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 02:53:55.867939 0.053430 tcp 10.0.2.105 56155 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:53:55.921545 0.077125 tcp 10.0.2.105 56156 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:53:55.998992 0.157515 tcp 10.0.2.105 56157 -> 195.113.214.236 443 SRPA* 0 0 43 38240 flow=From-Botnet-V2-TCP-Established 1970/01/19 02:53:56.157361 0.162777 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:56.320759 0.063293 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:56.384454 0.145027 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:56.529937 0.165723 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:56.695989 0.290494 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:56.986893 0.154585 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:57.141890 0.057318 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:57.199623 0.388563 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:57.588613 0.151789 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:57.740824 0.164139 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:57.905400 0.119827 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.025674 0.231280 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.257380 0.222347 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.480138 0.133235 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.613798 0.046087 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.660513 0.170327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:58.831247 0.228774 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.060438 0.145414 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.206287 0.050360 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.257114 0.178430 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.435968 0.051999 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.488511 0.077994 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.566876 0.145364 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.712693 0.206035 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:53:59.919202 0.221434 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:54:00.141082 0.134343 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 02:54:16.725842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:00:20.732286 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:00:27.739737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:00:35.741360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:00:51.743614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:01:23.749991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:07:27.755786 3.002055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:07:34.763575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:07:42.765235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:07:58.769102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:08:30.774044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:14:34.780096 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:14:41.786774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:14:49.789150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:15:05.791850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:15:37.798215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:21:41.805379 2.999901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:21:48.811567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:21:56.816491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:22:12.816095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:22:44.822200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:23:08.566352 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 03:23:08.566467 0.976243 tcp 10.0.2.105 56158 -> 128.255.183.224 9027 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/01/19 03:24:16.173897 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 03:24:16.174162 0.147244 udp 10.0.2.105 7010 <-> 65.95.215.213 5207 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:16.358688 0.163162 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:16.522220 0.062781 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:16.585416 0.168349 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:16.754246 0.291224 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.045926 0.165418 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.211864 0.055193 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.267512 0.169228 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.437089 0.119208 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.556746 0.214225 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:17.771503 0.282097 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.053961 0.372734 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.427347 0.145366 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.573114 0.132168 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.705661 0.045601 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.751791 0.171090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:18.923319 0.227058 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.150788 0.145666 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.296945 0.054465 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.351941 0.085112 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.437509 0.242263 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.680264 0.201025 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:19.881710 0.229422 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:20.111662 0.136456 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:20.248699 0.178936 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:24:20.428094 0.057297 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:28:48.828074 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 03:28:55.835276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:29:03.836732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:29:19.840376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:29:51.846239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:35:55.852101 3.004521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:36:02.858925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:36:10.860915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:36:26.864747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:36:58.869840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:44:35.878682 3.005958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:44:42.887146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:44:50.888262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:45:07.114984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:45:38.917636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:51:45.932394 2.996863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 03:51:52.935272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:52:00.936897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:52:16.939565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:52:48.946321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:53:09.545966 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 03:53:09.546067 0.960571 tcp 10.0.2.105 56159 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/19 03:54:31.714870 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 03:54:31.715166 0.063103 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:31.778716 0.223372 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:32.002510 0.298041 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:32.300987 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 03:54:48.610363 0.053284 tcp 10.0.2.105 56160 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 03:54:48.663929 0.072074 tcp 10.0.2.105 56161 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 03:54:48.736455 0.166041 tcp 10.0.2.105 56162 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/19 03:54:48.901002 0.164362 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.065741 0.155320 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.221548 0.055562 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.277495 0.166961 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.444825 0.167573 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.612803 0.228330 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:49.841522 0.194424 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.036366 0.381202 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.418005 0.151712 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.570142 0.132347 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.702979 0.041194 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.744624 0.171046 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:50.916060 0.287530 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.203927 0.142475 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.346831 0.041331 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.388726 0.074031 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.463232 0.142305 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.605914 0.205755 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:51.812072 0.223086 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:52.035570 0.053263 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:52.089213 0.134784 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:54:52.224381 0.175922 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 03:58:52.952797 3.000591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 03:58:59.959147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:59:07.960532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:59:23.963708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 03:59:55.969768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:05:59.976760 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:06:06.983103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:06:14.984917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:06:30.987549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:07:03.003840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:13:07.008968 3.021302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:13:14.027576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:13:22.033630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:13:38.031730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:14:10.047564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:20:14.063688 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:20:21.071175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:20:29.072932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:20:45.076798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:21:17.081851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:23:10.506074 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 04:23:10.506262 0.960785 tcp 10.0.2.105 56163 -> 128.255.183.224 9027 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/01/19 04:25:19.411124 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 04:25:19.411450 0.000000 udp 10.0.2.105 7010 -> 65.95.215.213 5207 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 04:25:36.566624 0.056408 tcp 10.0.2.105 56164 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 04:25:36.623294 0.073908 tcp 10.0.2.105 56165 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 04:25:36.697589 0.165940 tcp 10.0.2.105 56166 -> 195.113.214.236 443 SRPA* 0 0 26 9778 flow=From-Botnet-V2-TCP-Established 1970/01/19 04:25:36.861992 0.181680 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.044104 0.060183 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.104669 0.285204 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.390308 0.163757 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.554503 0.155973 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.711019 0.058081 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.769561 0.170870 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:37.940804 0.135415 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:38.076644 0.231971 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:38.309047 0.261472 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:38.570966 0.339290 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:38.910771 0.137960 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.049198 0.132454 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.182028 0.039908 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.222358 0.172542 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.395334 0.220373 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.616064 0.142092 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.758492 0.093234 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.852122 0.078732 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:39.931287 0.440596 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:40.372486 0.212028 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:40.584947 1.435881 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:42.021278 0.055790 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:42.077519 0.134836 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:25:42.212794 0.174246 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:27:21.089268 3.001618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 04:27:28.095450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:27:36.096832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:27:52.099853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:28:24.105313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:34:28.112246 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:34:35.119145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:34:43.120352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:34:59.123818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:35:31.129729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:41:35.137189 3.000233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:41:42.142900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:41:50.144532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:42:06.147506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:42:38.153660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:48:42.160723 3.051147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:48:49.193948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:48:57.178668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:49:13.187176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:49:45.189019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:53:11.474526 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 04:53:11.474668 1.031920 tcp 10.0.2.105 56167 -> 128.255.183.224 9027 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/19 04:55:49.193848 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 04:55:56.200808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:56:04.202730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:56:11.753693 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 04:56:11.753937 0.168486 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:11.922836 0.079332 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.002610 0.158602 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.161614 0.059756 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.221709 0.166812 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.388918 0.171461 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.560743 0.295098 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:12.856514 0.161174 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:13.018115 0.226974 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:13.245480 0.258875 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:13.504812 0.392323 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:13.897557 0.144901 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.042998 0.339366 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.382751 0.228874 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.612073 0.142229 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.754746 0.046193 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.801386 0.078020 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.879844 0.046434 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:14.926717 0.170825 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.097992 0.144150 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.242553 0.207473 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.450485 0.240752 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.691595 0.052107 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.744108 0.134647 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:15.879209 0.181203 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 04:56:20.205491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 04:56:52.212166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:02:56.217765 3.001996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:03:03.224852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:03:11.228401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:03:27.229529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:03:59.235615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:10:03.242418 3.212266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:10:10.669665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:10:18.597263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:10:34.458587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:11:06.279874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:17:10.288393 2.998869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:17:17.293307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:17:25.294923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:17:41.297779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:18:13.303799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:23:12.514658 0.000208 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 05:23:12.515030 1.163536 tcp 10.0.2.105 56168 -> 128.255.183.224 9027 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/01/19 05:24:17.324114 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:24:24.327655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:24:32.328528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:24:48.332844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:25:20.337417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:26:18.511337 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 05:26:18.511434 0.155053 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:18.666932 0.183286 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:18.850702 0.170368 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.021482 0.057838 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.079756 0.167590 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.247744 0.120300 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.368531 0.289418 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.658390 0.162631 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:19.821388 0.334594 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:20.156459 0.144897 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:20.301712 0.220447 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:20.522619 0.212178 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:20.735241 0.131335 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:20.867076 0.226048 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.093605 0.145263 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.239301 0.039904 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.279582 0.083435 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.363442 0.046041 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.409887 0.170614 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:21.580862 0.537805 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:22.119048 0.054527 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:22.173924 0.136630 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:22.310957 0.180044 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:22.491334 0.262456 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:26:22.754211 0.206489 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:31:24.345123 3.000828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:31:31.533090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:31:39.462974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:31:55.553847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:32:27.381801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:38:31.388419 3.001131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:38:38.395068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:38:46.396395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:39:02.399436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:39:34.405971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:46:00.414444 3.000182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:46:07.421153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:46:15.422142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:46:31.425826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:47:03.430960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:53:07.436735 3.002256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 05:53:13.684871 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 05:53:13.684974 0.938840 tcp 10.0.2.105 56169 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/19 05:53:14.444812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:53:22.446052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:53:38.449730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:54:10.455623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 05:56:28.123027 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 05:56:28.123168 0.085810 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.209315 0.055045 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.264770 0.157880 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.422990 0.189641 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.613045 0.164876 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.778322 0.166396 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:28.945123 0.295692 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:29.241165 0.163236 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:29.404746 0.383597 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:29.788686 0.145111 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:29.934244 0.228830 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.163444 0.266975 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.430794 0.132790 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.564021 0.221075 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.785434 0.141831 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.927650 0.041364 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:30.969401 0.081013 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.050788 0.044947 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.096129 0.171589 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.268112 0.223239 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.491796 0.050774 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.543064 0.146636 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.690104 0.205918 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:31.896497 0.134024 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 05:56:32.031022 0.179297 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:00:14.462231 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:00:21.468518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:00:29.469824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:00:45.472757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:01:17.479728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:07:21.486756 2.999961 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:07:28.493304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:07:36.493848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:07:52.496481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:08:24.502920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:14:28.508579 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:14:35.515800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:14:43.518241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:14:59.521634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:15:31.536529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:21:35.544058 3.000532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:21:42.551260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:21:50.551837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:22:06.554259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:22:38.561503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:23:14.624494 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 06:23:14.624609 0.977080 tcp 10.0.2.105 56170 -> 128.255.183.224 9027 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/01/19 06:26:40.188237 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 06:26:40.188348 0.063736 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.252727 0.058463 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.311598 0.154859 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.467048 0.167218 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.634724 0.168288 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.803467 0.175609 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:40.979527 0.393199 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:41.373090 0.144933 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:41.518408 0.209177 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:41.728009 0.297152 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.025614 0.162612 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.188675 0.236719 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.425901 0.130859 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.557188 0.218717 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.776351 0.143579 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.920417 0.040797 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:42.961590 0.082445 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.044483 0.044950 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.089822 0.058203 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.148461 0.145364 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.294231 0.207308 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.501950 0.134837 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.637228 0.170558 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:43.808170 0.219111 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:26:44.027725 0.179368 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:28:42.566351 3.002370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 06:28:49.575711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:28:57.575553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:29:13.578663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:29:45.584813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:35:49.591369 3.000929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:35:56.598106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:36:04.603955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:36:20.603031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:36:52.608887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:42:56.615089 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:43:03.622912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:43:11.623837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:43:27.627800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:43:59.633884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:50:03.639199 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 06:50:10.646295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:50:18.647356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:50:34.650840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:51:06.906929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:53:15.603211 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 06:53:15.603324 0.973544 tcp 10.0.2.105 56171 -> 128.255.183.224 9027 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/01/19 06:56:58.272563 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 06:56:58.272659 0.064224 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:58.337266 0.059592 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:58.397285 0.154035 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:58.551727 0.194286 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:58.746416 0.168984 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:58.915756 0.180653 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:59.096804 0.214390 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:59.311611 0.324346 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:59.636389 0.162474 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:56:59.799265 0.338524 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:00.138194 0.137557 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:00.276121 0.288697 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:00.565244 0.130381 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:00.696025 0.219590 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:00.916076 0.144812 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.061260 0.038932 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.100606 0.080181 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.181120 0.045147 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.226758 0.055530 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.282727 0.134823 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.418029 0.201650 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.620064 0.314506 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:01.934966 0.180376 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:02.115751 0.145410 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:02.261574 0.333974 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/19 06:57:10.673147 3.000848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 06:57:17.680670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:57:25.682727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:57:41.684784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 06:58:13.691496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:04:17.696320 3.002702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:04:24.704405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:04:32.705768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:04:48.708737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:05:20.714897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:11:24.721179 3.001931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:11:31.727827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:11:39.731730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:11:55.733029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:12:27.975353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:18:31.754375 3.002190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:18:38.761885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:18:46.763655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:19:02.766640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:19:34.772710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:23:16.582571 0.000224 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 07:23:16.582910 0.953920 tcp 10.0.2.105 56172 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/19 07:25:38.781026 2.998872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:25:45.785940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:25:53.787302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:26:09.790866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:26:41.797170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:27:17.578308 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 07:27:17.578411 0.058568 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:17.637392 0.059058 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:17.696836 0.159897 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:17.857113 0.184957 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:18.042477 0.162172 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:18.205128 0.170398 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:18.375914 0.163301 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:18.539715 0.394983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:18.935185 0.221479 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:19.157087 0.293580 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:19.451129 0.144954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:19.596553 0.233308 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:19.830300 0.131586 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:19.962543 0.219818 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.182724 0.141937 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.325087 0.041823 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.367360 0.080168 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.447965 0.134936 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.583346 0.171145 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:20.754824 0.264516 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:21.019659 0.180113 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:21.200150 0.040139 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:21.240710 0.054967 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:21.296097 0.147467 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:27:21.444474 0.246737 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:32:45.802382 3.002214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:32:52.810055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:33:00.811494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:33:16.814700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:33:48.944851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:39:52.838594 3.003941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:39:59.843760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:40:07.845206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:40:23.848604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:40:55.854620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:46:59.860869 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:47:06.868735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:47:14.869785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:47:30.875345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:48:02.883305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:53:17.541269 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 07:53:17.541382 0.968865 tcp 10.0.2.105 56173 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/19 07:54:06.885006 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 07:54:13.892693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:54:21.893537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:54:37.896820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:55:09.903243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 07:57:23.756009 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 07:57:23.756303 0.442890 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:24.199588 0.059476 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:24.259471 0.154267 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:24.414173 0.246325 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:24.660961 0.167406 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:24.829080 0.334718 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:25.164230 0.238956 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:25.403676 0.152334 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:25.556465 0.161286 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:25.718154 0.290736 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.009278 0.151569 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.161280 0.239287 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.400946 0.132401 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.533805 0.226204 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.760403 0.145166 udp 10.0.2.105 7010 <-> 74.12.172.46 3419 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.905953 0.038535 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:26.944920 0.093743 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.039117 0.135208 udp 10.0.2.105 7010 <-> 64.238.24.147 8701 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.174741 0.171779 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.346948 0.224096 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.571474 0.175157 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.747096 0.148892 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:27.896417 0.255098 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:28.152043 0.045992 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 07:57:28.198472 0.058800 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:01:13.910023 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:01:20.915838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:01:28.918147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:01:44.920664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:02:16.926462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:08:20.934011 2.999756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:08:27.939980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:08:35.941717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:08:51.945416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:09:23.950306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:15:27.956763 3.000829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:15:34.963729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:15:42.965621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:15:58.972499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:16:30.974341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:22:34.981134 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:22:41.987784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:22:49.989154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:23:05.993128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:23:18.512686 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:23:18.512806 1.092354 tcp 10.0.2.105 56174 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:23:37.997966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:27:36.813022 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:27:36.813133 0.059362 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:36.872936 0.059989 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:36.933341 0.154398 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:37.088182 0.186498 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:37.275044 0.166776 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:37.442201 0.356199 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:37.798839 0.163285 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:37.962522 0.305071 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:38.267993 0.144867 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:38.413249 0.215194 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:38.628787 0.119129 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:38.748428 0.260976 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:39.009887 0.132071 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:39.142392 0.220638 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:39.363475 0.000000 udp 10.0.2.105 7010 -> 74.12.172.46 3419 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:27:55.040773 0.052776 tcp 10.0.2.105 56175 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:27:55.093891 0.074800 tcp 10.0.2.105 56176 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:27:55.168997 0.142542 tcp 10.0.2.105 56177 -> 195.113.214.236 443 SRPA* 0 0 33 24455 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:27:55.312493 0.082415 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:55.395341 0.081892 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:27:55.477685 0.000000 udp 10.0.2.105 7010 -> 64.238.24.147 8701 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:28:11.122137 0.053970 tcp 10.0.2.105 56178 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:28:11.175961 0.070538 tcp 10.0.2.105 56179 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:28:11.246368 0.165954 tcp 10.0.2.105 56180 -> 195.113.214.236 443 SRPA* 0 0 41 23299 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:28:11.413017 0.181328 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:11.594783 0.146342 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:11.741559 0.244859 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:11.986813 0.045228 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:12.032408 0.182706 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:12.215566 0.246248 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:28:12.462283 0.050939 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:29:42.005587 3.002842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 08:29:49.012577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:29:57.013091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:30:13.016616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:30:45.022444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:36:49.029418 3.000488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:36:56.037356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:37:04.039958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:37:20.858076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:37:52.504096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:45:11.071032 3.000624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:45:18.650727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:45:26.558418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:45:42.376976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:46:14.099651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:52:29.110558 3.001256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 08:52:36.117587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:52:44.118625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:53:00.121946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:53:19.610756 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:53:19.610900 0.966178 tcp 10.0.2.105 56181 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:53:32.127845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:58:20.192884 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:58:20.192979 0.000000 udp 10.0.2.105 7010 -> 74.12.172.46 3419 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:58:39.140997 0.058124 tcp 10.0.2.105 56182 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:39.199443 0.076524 tcp 10.0.2.105 56183 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:39.276279 0.158700 tcp 10.0.2.105 56184 -> 195.113.214.236 443 SRPA* 0 0 27 12042 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:39.435603 0.000000 udp 10.0.2.105 7010 -> 64.238.24.147 8701 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:58:56.754938 0.054551 tcp 10.0.2.105 56185 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:56.809795 0.134728 tcp 10.0.2.105 56186 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:56.944939 0.160629 tcp 10.0.2.105 56187 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/19 08:58:57.106292 4.628650 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1221 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.298085 3.650915 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1259 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.364968 3.646566 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 4 1075 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.425152 3.752933 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 945 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.587867 3.756875 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1200 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.754727 3.777615 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1138 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:57.944724 4.146692 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1163 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:58.280972 3.935703 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 4 1091 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:58.401402 4.082947 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 1109 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:58.692735 3.927225 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 4 1221 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:58.824971 4.011988 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 4 1290 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.040628 3.948648 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1105 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.192754 4.098295 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1251 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.495957 4.030511 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1097 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.723361 3.844153 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 1325 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.763386 3.881887 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1032 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:58:59.846698 3.977979 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 1069 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.028181 3.944587 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 4 1102 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.169510 4.520254 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 4 1262 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.372014 3.642907 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1105 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.412086 3.772993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 977 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.583922 3.841098 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 4 1335 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:00.826503 3.646268 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 4 1061 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:04.690351 0.000000 udp 10.0.2.105 7010 -> 216.153.41.210 5832 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:12.677911 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:21.470410 0.282181 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/19 08:59:21.771747 0.000000 udp 10.0.2.105 7010 -> 208.83.75.81 4446 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:26.226970 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:59:28.550381 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:36.642198 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:37.135818 3.001696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 08:59:43.693141 0.000000 udp 10.0.2.105 7010 -> 69.116.245.21 3346 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:44.142899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:59:50.962190 0.191114 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 08:59:51.153304 0.000000 icmp 70.184.105.18 0x0303 -> 10.0.2.105 0x091d URP 192 1 129 flow=Background 1970/01/19 08:59:52.144829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 08:59:55.729367 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 08:59:57.672479 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1613 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:05.403834 0.000000 udp 10.0.2.105 7010 -> 67.82.221.233 7920 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:08.147528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:00:10.601226 0.000000 udp 10.0.2.105 7010 -> 50.124.129.56 4327 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:18.612522 0.000000 udp 10.0.2.105 7010 -> 94.11.24.57 3614 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:23.228905 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:00:26.443339 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:32.072112 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:40.153483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:00:40.694555 0.000000 udp 10.0.2.105 7010 -> 82.53.113.216 2254 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:47.474029 0.000000 udp 10.0.2.105 7010 -> 79.21.8.126 3903 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:00:52.220174 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:00:56.156546 0.000000 udp 10.0.2.105 7010 -> 94.39.221.62 9141 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:02.135101 0.000000 udp 10.0.2.105 7010 -> 90.45.57.35 5187 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:10.637326 0.000000 udp 10.0.2.105 7010 -> 24.220.156.55 3227 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:16.525946 0.250886 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:16.776832 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 260 flow=Background 1970/01/19 09:01:21.222353 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:01:22.805064 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:28.252706 0.000000 udp 10.0.2.105 7010 -> 184.163.157.196 1074 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:33.820444 0.046108 udp 10.0.2.105 7010 <-> 5.13.52.252 2778 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:01:33.877309 0.000000 udp 10.0.2.105 7010 -> 98.230.235.207 4880 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:38.998166 0.000000 udp 10.0.2.105 7010 -> 79.248.233.185 1246 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:44.916653 0.000000 udp 10.0.2.105 7010 -> 94.209.117.182 4228 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:49.723109 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:01:53.018882 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:01:59.607561 0.000000 udp 10.0.2.105 7010 -> 83.7.84.39 7393 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:04.865346 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:12.185776 0.000000 udp 10.0.2.105 7010 -> 98.113.158.137 1210 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:16.722029 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:02:17.743832 0.000000 udp 10.0.2.105 7010 -> 71.122.116.2 3758 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:25.734894 0.000000 udp 10.0.2.105 7010 -> 128.72.101.33 9418 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:30.902758 0.000000 udp 10.0.2.105 7010 -> 173.9.47.141 5827 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:39.314630 0.000000 udp 10.0.2.105 7010 -> 195.72.202.66 1964 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:44.221703 0.000206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:02:46.395587 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:53.465340 0.000000 udp 10.0.2.105 7010 -> 95.240.232.250 6168 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:02:59.604003 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:06.884663 0.000000 udp 10.0.2.105 7010 -> 89.106.30.18 8755 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:11.721460 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:03:14.836392 0.000000 udp 10.0.2.105 7010 -> 151.26.54.72 3494 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:23.789019 0.000000 udp 10.0.2.105 7010 -> 112.216.17.194 2137 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:32.771796 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:37.728528 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:03:40.883539 0.000000 udp 10.0.2.105 7010 -> 95.137.131.12 9499 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:48.564382 0.000000 udp 10.0.2.105 7010 -> 2.120.185.217 2765 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:03:57.226817 0.000000 udp 10.0.2.105 7010 -> 121.54.22.85 2129 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:02.223713 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:04:03.235996 0.000000 udp 10.0.2.105 7010 -> 176.26.113.38 3396 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:12.087833 0.000000 udp 10.0.2.105 7010 -> 103.6.50.94 6502 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:19.488594 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:28.502704 0.000000 udp 10.0.2.105 7010 -> 77.254.234.237 7200 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:33.262264 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:04:35.010442 0.000000 udp 10.0.2.105 7010 -> 81.137.195.6 3427 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:40.028394 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:48.651792 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:04:56.261789 0.000000 udp 10.0.2.105 7010 -> 2.125.213.216 8793 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:01.229286 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:05:02.149848 0.000000 udp 10.0.2.105 7010 -> 79.18.207.129 5808 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:07.577988 0.000000 udp 10.0.2.105 7010 -> 176.255.37.236 9061 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:13.346765 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1067 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:22.028687 0.000000 udp 10.0.2.105 7010 -> 174.141.57.178 6609 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:26.725185 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:05:30.651395 0.000000 udp 10.0.2.105 7010 -> 94.120.143.109 3260 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:39.100143 0.000000 udp 10.0.2.105 7010 -> 60.242.78.235 6576 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:47.947283 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:05:52.722675 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:05:53.944455 0.000000 udp 10.0.2.105 7010 -> 2.101.25.253 4372 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:02.927496 0.000000 udp 10.0.2.105 7010 -> 118.39.80.146 3821 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:08.755885 0.000000 udp 10.0.2.105 7010 -> 216.227.31.21 6059 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:17.488926 0.000000 udp 10.0.2.105 7010 -> 82.6.23.15 3475 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:22.225132 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:06:24.989386 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:30.307408 0.000000 udp 10.0.2.105 7010 -> 86.112.66.47 7140 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:37.017426 0.000000 udp 10.0.2.105 7010 -> 47.22.2.162 7784 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:44.160467 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 09:06:45.639529 0.000000 udp 10.0.2.105 7010 -> 86.148.149.185 9383 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:50.225960 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:06:51.167036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:06:52.238876 0.000000 udp 10.0.2.105 7010 -> 174.89.248.53 8723 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:06:59.169530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:07:00.069895 0.000000 udp 10.0.2.105 7010 -> 71.227.13.152 8556 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:08.723119 0.000000 udp 10.0.2.105 7010 -> 71.246.159.37 3675 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:15.172686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:07:17.264266 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:22.222907 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:07:24.005351 0.000000 udp 10.0.2.105 7010 -> 88.233.63.251 1024 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:30.107031 0.000000 udp 10.0.2.105 7010 -> 90.220.133.202 6540 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:37.188696 0.000000 udp 10.0.2.105 7010 -> 59.90.9.135 6391 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:44.603804 0.178571 udp 10.0.2.105 7010 -> 37.127.2.38 2119 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:44.782375 0.000000 icmp 37.127.2.38 0x0303 -> 10.0.2.105 0x4708 URP 192 1 254 flow=Background 1970/01/19 09:07:47.178018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:07:49.230553 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:07:51.553573 0.000000 udp 10.0.2.105 7010 -> 95.9.199.196 1129 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:07:58.055321 0.000000 udp 10.0.2.105 7010 -> 177.225.166.39 5909 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:06.405631 0.000000 udp 10.0.2.105 7010 -> 86.140.57.22 6186 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:12.565090 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:17.231244 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:08:18.252852 0.000000 udp 10.0.2.105 7010 -> 80.227.35.234 3750 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:26.683927 0.106608 udp 10.0.2.105 7010 <-> 94.68.176.164 8269 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:08:26.911679 0.000000 udp 10.0.2.105 7010 -> 173.209.142.238 2814 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:35.396764 0.000000 udp 10.0.2.105 7010 -> 90.220.229.220 1578 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:40.934460 0.045043 udp 10.0.2.105 7010 -> 212.14.63.170 3902 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:40.979503 0.000000 icmp 212.14.63.170 0x0303 -> 10.0.2.105 0x3e0f URP 192 1 307 flow=Background 1970/01/19 09:08:45.722120 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:08:49.357258 0.000000 udp 10.0.2.105 7010 -> 151.29.154.203 1023 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:08:56.957778 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:03.127381 0.000000 udp 10.0.2.105 7010 -> 81.138.7.133 9086 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:09.256074 0.000000 udp 10.0.2.105 7010 -> 98.224.233.159 7446 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:14.222908 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:09:15.974673 0.000000 udp 10.0.2.105 7010 -> 77.192.48.217 5402 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:21.713277 0.000000 udp 10.0.2.105 7010 -> 178.59.171.35 3521 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:28.172932 0.058864 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:09:28.319859 0.147018 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:09:28.485015 0.000000 udp 10.0.2.105 7010 -> 46.120.226.152 7292 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:37.157847 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:41.721994 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:09:43.294572 0.000000 udp 10.0.2.105 7010 -> 186.31.37.185 2270 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:49.542988 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:09:57.114178 0.060479 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:09:57.246127 0.000000 udp 10.0.2.105 7010 -> 92.21.240.151 8300 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:03.493946 0.064120 udp 10.0.2.105 7010 -> 77.182.140.166 9155 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:03.558066 0.000000 icmp 77.182.140.166 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 265 flow=Background 1970/01/19 09:10:08.230137 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:10:08.983183 0.000000 udp 10.0.2.105 7010 -> 88.243.111.219 8996 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:15.851503 0.000000 udp 10.0.2.105 7010 -> 82.18.53.79 7164 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:23.813136 0.000000 udp 10.0.2.105 7010 -> 112.208.87.70 1029 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:31.033105 0.000000 udp 10.0.2.105 7010 -> 82.104.84.169 4248 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:35.730013 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:10:37.923055 0.065203 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:10:38.226790 0.072651 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:10:38.437472 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:46.495875 0.000000 udp 10.0.2.105 7010 -> 184.180.239.226 1766 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:52.153472 0.000000 udp 10.0.2.105 7010 -> 78.139.182.8 2564 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:10:58.705085 0.000000 udp 10.0.2.105 7010 -> 81.215.111.223 4451 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:03.229150 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:11:05.843085 0.000000 udp 10.0.2.105 7010 -> 95.247.21.149 8561 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:13.964859 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:22.647160 0.056093 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:23.041746 0.000000 udp 10.0.2.105 7010 -> 173.13.200.141 9972 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:27.223637 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:11:30.048157 0.093734 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:30.275481 0.000000 udp 10.0.2.105 7010 -> 82.25.31.25 9048 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:36.468103 0.422092 udp 10.0.2.105 7010 <-> 182.48.199.2 9617 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:37.120448 0.000000 udp 10.0.2.105 7010 -> 201.240.221.37 5169 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:43.227409 0.042074 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:43.465295 0.034927 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:43.702581 0.058749 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:43.782027 0.000000 udp 10.0.2.105 7010 -> 98.160.135.172 9435 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:50.087148 0.000000 udp 10.0.2.105 7010 -> 89.67.58.21 1211 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:11:54.722587 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:11:56.145525 0.085306 udp 10.0.2.105 7010 <-> 79.129.119.28 3426 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:11:56.561439 0.000000 udp 10.0.2.105 7010 -> 113.87.223.174 8041 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:12:01.983557 0.263890 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:12:02.273264 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:12:11.086640 0.079268 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:13:51.183620 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 09:13:58.190525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:14:06.192742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:14:22.195197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:14:54.202594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:20:58.208968 3.000042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:21:05.214359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:21:13.217355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:21:29.219574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:22:01.227056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:23:20.579886 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:23:20.579985 1.166240 tcp 10.0.2.105 56188 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:28:05.231473 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:28:12.239285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:28:20.240334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:28:36.243151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:29:08.249116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:35:12.256058 3.000894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:35:19.262586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:35:27.268802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:35:43.268697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:36:15.273883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:42:19.278579 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:42:26.286527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:42:29.591713 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:42:29.591809 0.059611 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:29.651864 0.059622 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:29.711845 0.162493 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:29.874742 0.186153 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:30.061330 0.344288 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:30.406072 0.120954 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:30.527429 0.167758 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:30.695585 0.190604 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:30.886558 0.274204 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.161093 0.132470 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.294329 0.284085 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.578811 0.144870 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.724082 0.046452 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.770930 0.078773 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:31.850037 0.179830 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.030230 0.176643 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.207290 0.038639 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.246362 0.171684 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.418474 0.296285 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.715139 0.220436 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.935962 0.054664 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:32.991006 0.242774 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.234190 0.237326 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.471979 0.242745 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.715152 0.044775 udp 10.0.2.105 7010 <-> 5.13.52.252 2778 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.760455 0.132814 udp 10.0.2.105 7010 <-> 94.68.176.164 8269 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.893691 0.039983 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:33.934111 0.135651 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:34.070229 0.057933 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:34.128584 0.066270 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:34.195252 0.057432 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:34.253546 0.054825 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:42:34.288352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:42:34.308710 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:42:50.291132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:42:53.107390 0.053348 tcp 10.0.2.105 56189 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:42:53.160720 0.056586 tcp 10.0.2.105 56190 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:42:53.217159 0.133629 tcp 10.0.2.105 56191 -> 195.113.214.236 443 SRPA* 0 0 78 60125 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:42:53.351553 0.000000 udp 10.0.2.105 7010 -> 182.48.199.2 9617 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:43:10.210221 0.052867 tcp 10.0.2.105 56192 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:10.262969 0.052722 tcp 10.0.2.105 56193 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:10.315973 0.151253 tcp 10.0.2.105 56194 -> 195.113.214.236 443 SRPA* 0 0 22 11422 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:10.467807 0.042075 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:43:10.510339 0.060876 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:43:10.571590 0.030275 udp 10.0.2.105 7010 <-> 188.193.14.198 4126 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:43:10.602203 0.000000 udp 10.0.2.105 7010 -> 79.129.119.28 3426 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 09:43:22.299079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:43:27.124676 0.052909 tcp 10.0.2.105 56195 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:27.177966 0.055232 tcp 10.0.2.105 56196 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:27.233546 0.148238 tcp 10.0.2.105 56197 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:43:27.382308 0.263130 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:43:27.645837 0.085201 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/19 09:49:26.304359 3.010458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:49:33.321126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:49:41.322630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:49:57.325061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:50:29.331126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:53:21.749192 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 09:53:21.749289 0.949003 tcp 10.0.2.105 56198 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/19 09:56:36.341064 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 09:56:43.348901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:56:51.350533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:57:07.353209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 09:57:39.359679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:03:43.365510 3.001970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:03:50.372911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:03:58.374136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:04:14.377372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:04:46.383237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:10:50.390032 3.001126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:10:57.396787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:11:05.455895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:11:21.410921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:11:53.428984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:13:45.459173 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 10:13:45.459285 0.097871 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:13:45.557569 0.000000 udp 10.0.2.105 7010 -> 182.48.199.2 9617 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:14:02.522491 0.052307 tcp 10.0.2.105 56199 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:02.575077 0.055592 tcp 10.0.2.105 56200 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:02.631010 0.153778 tcp 10.0.2.105 56201 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:02.785382 0.000000 udp 10.0.2.105 7010 -> 79.129.119.28 3426 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:14:18.186484 0.053589 tcp 10.0.2.105 56202 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:18.240410 0.052422 tcp 10.0.2.105 56203 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:18.293156 0.157373 tcp 10.0.2.105 56204 -> 195.113.214.236 443 SRPA* 0 0 27 11254 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:18.449315 0.041435 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:18.491125 0.059010 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:18.550591 0.000000 udp 10.0.2.105 7010 -> 188.193.14.198 4126 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:14:33.948846 0.051760 tcp 10.0.2.105 56205 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:34.000439 0.053644 tcp 10.0.2.105 56206 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:34.054394 0.146713 tcp 10.0.2.105 56207 -> 195.113.214.236 443 SRPA* 0 0 45 40942 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:34.201801 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:14:52.855928 0.054558 tcp 10.0.2.105 56208 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:52.910766 0.053343 tcp 10.0.2.105 56209 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:52.964435 0.172901 tcp 10.0.2.105 56210 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:14:53.137908 0.273349 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:53.411709 0.066446 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:53.478585 0.162271 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:53.641283 0.153745 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:53.795468 0.058645 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:14:53.854560 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:15:10.241739 0.051360 tcp 10.0.2.105 56211 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:10.294079 0.052769 tcp 10.0.2.105 56212 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:10.347174 0.157748 tcp 10.0.2.105 56213 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:10.505477 0.166196 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:10.672103 0.201325 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:10.873867 0.191512 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.065806 0.266381 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.332825 0.152372 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.485646 0.179450 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.665549 0.144755 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.810714 0.080658 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.891807 0.042562 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:11.934752 0.132392 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.067515 0.214526 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.282480 0.052651 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.335481 0.045088 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.380890 0.306439 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.687762 0.226259 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:12.914457 0.171122 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:13.086054 0.068978 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:13.229309 0.241391 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:13.471165 0.222340 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:13.693957 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:15:30.391033 0.057425 tcp 10.0.2.105 56214 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:30.448830 0.055333 tcp 10.0.2.105 56215 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:30.504423 0.159499 tcp 10.0.2.105 56216 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:30.664717 0.134887 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:30.799936 0.000000 udp 10.0.2.105 7010 -> 94.68.176.164 8269 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:15:47.545225 0.055860 tcp 10.0.2.105 56217 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:47.601406 0.052290 tcp 10.0.2.105 56218 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:47.654004 0.156756 tcp 10.0.2.105 56219 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:15:47.811343 0.045772 udp 10.0.2.105 7010 <-> 5.13.52.252 2778 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:47.857512 0.327285 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:48.185252 0.040818 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:48.437307 0.056052 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:15:48.493814 0.058549 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:17:57.434413 3.002311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 10:18:04.441444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:18:12.442033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:18:28.445361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:19:00.457500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:23:22.709272 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 10:23:22.709360 1.216128 tcp 10.0.2.105 56220 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:25:04.456573 3.002308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:25:11.464115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:25:19.467388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:25:35.469452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:26:07.476142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:32:11.482499 3.000399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:32:18.488404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:32:26.490769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:32:42.493169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:33:14.498915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:39:18.506374 3.000870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:39:25.514489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:39:33.514646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:39:49.517019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:40:21.523812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:45:55.915076 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 10:45:55.915188 0.000000 udp 10.0.2.105 7010 -> 188.193.14.198 4126 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:46:11.888651 0.054838 tcp 10.0.2.105 56221 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:11.943771 0.056065 tcp 10.0.2.105 56222 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:12.000134 0.152959 tcp 10.0.2.105 56223 -> 195.113.214.236 443 SRPA* 0 0 40 33276 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:12.153921 0.085896 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:12.240239 0.380230 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:12.620911 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:46:28.534288 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:46:31.556224 0.052614 tcp 10.0.2.105 56224 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:31.609184 0.053077 tcp 10.0.2.105 56225 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:31.662561 0.149309 tcp 10.0.2.105 56226 -> 195.113.214.236 443 SRPA* 0 0 36 27846 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:31.812743 0.000000 udp 10.0.2.105 7010 -> 94.68.176.164 8269 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 10:46:35.540821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:46:43.542638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:46:47.458986 0.052806 tcp 10.0.2.105 56227 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:47.512039 0.061477 tcp 10.0.2.105 56228 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:47.573810 0.141548 tcp 10.0.2.105 56229 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:46:47.715962 0.097628 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:47.813941 0.041274 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:47.855597 0.054959 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:47.910951 0.060731 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:47.972064 0.261782 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.234318 0.162681 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.397443 0.096880 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.494727 0.155233 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.650329 0.122292 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.797755 0.187007 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:48.985219 0.165852 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.151550 0.151820 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.303822 0.084524 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.388763 0.040713 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.429915 0.132251 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.562553 0.145870 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.708880 0.251778 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:49.961086 0.179715 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:50.141247 0.301078 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:50.442769 0.331885 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:50.775083 0.170327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:50.945913 0.066362 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.012742 0.228137 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.241265 0.056663 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.298353 0.046041 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.344846 0.232194 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.577483 0.244177 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.822077 0.142330 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:51.964877 0.045182 udp 10.0.2.105 7010 <-> 5.13.52.252 2778 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:52.010482 0.274002 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:52.284907 0.064178 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:52.349464 0.043240 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:52.393162 0.055050 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/19 10:46:59.545552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:47:31.551280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:53:23.928558 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 10:53:23.928656 0.964493 tcp 10.0.2.105 56230 -> 128.255.183.224 9027 FSPA* 0 0 12 1509 flow=From-Botnet-V2-TCP-Established 1970/01/19 10:53:35.557337 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 10:53:42.564341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:53:50.566341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:54:06.569608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 10:54:38.575391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:00:42.583669 2.999157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:00:49.588979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:00:57.592588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:01:13.593393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:01:45.599707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:07:49.607165 2.999899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:07:56.612733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:08:04.617385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:08:20.617215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:08:52.623068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:14:56.636097 2.995123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:15:03.636975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:15:11.639280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:15:27.641456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:15:59.920648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:16:59.083170 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 11:16:59.083349 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:17:15.640441 0.056086 tcp 10.0.2.105 56231 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:15.696791 0.052110 tcp 10.0.2.105 56232 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:15.749274 0.151307 tcp 10.0.2.105 56233 -> 195.113.214.236 443 SRPA* 0 0 48 41696 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:15.901312 0.386594 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.288485 0.097088 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.385996 0.041258 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.427700 0.056535 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.484699 0.059299 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.544403 0.265268 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.810072 0.161176 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:16.971691 0.063662 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.035831 0.190213 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.226441 0.167640 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.394535 0.144686 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.539693 0.078421 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.618569 0.153885 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.772843 0.121839 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:17.895120 0.343521 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:18.239088 0.130967 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:18.370431 0.144060 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:18.514926 0.194778 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:18.710136 0.180410 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:18.890977 0.187800 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:19.079138 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:17:35.596121 0.053641 tcp 10.0.2.105 56234 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:35.650135 0.053193 tcp 10.0.2.105 56235 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:35.703179 0.150829 tcp 10.0.2.105 56236 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:35.854503 0.291859 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.146760 0.226294 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.373517 0.240481 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.614365 0.058879 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.673694 0.039614 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.713678 0.201494 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:36.915567 0.253567 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:37.169514 0.278568 udp 10.0.2.105 7010 <-> 108.245.57.129 2307 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:37.448529 0.063972 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:37.512874 0.039726 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:37.553026 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:17:54.705386 0.057351 tcp 10.0.2.105 56237 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:54.763044 0.059844 tcp 10.0.2.105 56238 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:54.823255 0.150551 tcp 10.0.2.105 56239 -> 195.113.214.236 443 SRPA* 0 0 42 33668 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:17:54.974518 0.136340 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:17:55.181474 0.045164 udp 10.0.2.105 7010 <-> 5.13.52.252 2778 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:22:03.666298 2.999274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 11:22:10.673063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:22:18.672125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:22:34.676486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:23:06.681446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:23:24.898490 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 11:23:24.898591 0.967749 tcp 10.0.2.105 56240 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:29:10.689069 2.999986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:29:17.694953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:29:25.696821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:29:41.699107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:30:13.706801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:36:17.711308 3.001062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:36:24.718090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:36:32.720198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:36:48.725033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:37:20.729329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:44:55.735587 3.002982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:45:02.744331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:45:10.745478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:45:26.747441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:45:58.755137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:48:15.381800 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 11:48:15.381891 0.078496 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:15.460830 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:48:33.018132 0.053475 tcp 10.0.2.105 56241 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:33.071900 0.053418 tcp 10.0.2.105 56242 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:33.125609 0.148716 tcp 10.0.2.105 56243 -> 195.113.214.236 443 SRPA* 0 0 51 28106 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:33.273368 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:48:49.320280 0.054372 tcp 10.0.2.105 56244 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:49.374959 0.052853 tcp 10.0.2.105 56245 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:49.428075 0.151632 tcp 10.0.2.105 56246 -> 195.113.214.236 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:48:49.580271 0.040896 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:49.621520 0.058837 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:49.680824 0.059678 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:49.740912 0.274455 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:50.015804 0.162935 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:50.179583 0.064413 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:50.244387 0.216186 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:50.461012 0.371342 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:48:50.832757 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:49:06.774568 0.052220 tcp 10.0.2.105 56247 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:06.827075 0.052867 tcp 10.0.2.105 56248 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:06.880183 0.150917 tcp 10.0.2.105 56249 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:07.031630 0.154175 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.186271 0.123033 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.309742 0.038013 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.348146 0.166132 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.514709 0.076987 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.592122 0.144835 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.737342 0.171826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:07.909834 0.127902 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:08.038193 0.194680 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:08.233232 0.143056 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:08.376671 0.179508 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:08.556637 0.297138 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:08.854148 0.318992 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:09.173530 0.051747 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:09.225762 0.045639 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:09.271828 0.292641 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:09.564873 0.245220 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:09.810468 0.215051 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:10.025972 0.057705 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:10.084158 0.000000 udp 10.0.2.105 7010 -> 108.245.57.129 2307 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:49:27.976609 0.053350 tcp 10.0.2.105 56250 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:28.030268 0.054750 tcp 10.0.2.105 56251 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:28.085260 0.256332 tcp 10.0.2.105 56252 -> 195.113.214.236 443 SRPA* 0 0 32 17602 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:28.340023 0.043022 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:28.383502 0.137936 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 11:49:28.521816 0.000000 udp 10.0.2.105 7010 -> 5.13.52.252 2778 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 11:49:44.569792 0.052277 tcp 10.0.2.105 56253 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:44.622384 0.053802 tcp 10.0.2.105 56254 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:49:44.676504 0.164357 tcp 10.0.2.105 56255 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:52:12.765138 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 11:52:19.772247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:52:27.773162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:52:43.777207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:53:15.782308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:53:25.867303 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 11:53:25.867408 0.989955 tcp 10.0.2.105 56256 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/19 11:59:20.790172 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 11:59:27.798292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:59:35.798841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 11:59:51.802738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:00:23.807723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:06:27.814116 3.002011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:06:34.822234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:06:42.823876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:06:58.826770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:07:30.831920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:13:34.837853 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:13:41.845848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:13:49.846472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:14:05.852579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:14:37.856045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:20:08.782293 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 12:20:08.782400 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:20:27.250149 0.054637 tcp 10.0.2.105 56257 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:27.305060 0.054444 tcp 10.0.2.105 56258 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:27.359855 0.225019 tcp 10.0.2.105 56259 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:27.584004 0.000000 udp 10.0.2.105 7010 -> 108.245.57.129 2307 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:20:41.862554 3.000249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:20:43.061468 0.052366 tcp 10.0.2.105 56260 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:43.113695 0.051823 tcp 10.0.2.105 56261 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:43.165878 0.267060 tcp 10.0.2.105 56262 -> 195.113.214.236 443 SRPA* 0 0 32 17620 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:43.433412 0.000000 udp 10.0.2.105 7010 -> 5.13.52.252 2778 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:20:48.869389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:20:56.871524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:20:59.285639 0.052147 tcp 10.0.2.105 56263 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:59.338086 0.053088 tcp 10.0.2.105 56264 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:59.391487 0.159210 tcp 10.0.2.105 56265 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:20:59.551212 0.113742 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:20:59.665465 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:21:12.873591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:21:15.397763 0.053688 tcp 10.0.2.105 56266 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:15.451299 0.032593 tcp 10.0.2.105 56267 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:15.484491 0.150681 tcp 10.0.2.105 56268 -> 195.113.214.236 443 SRPA* 0 0 27 11252 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:15.634067 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:21:30.921534 0.057419 tcp 10.0.2.105 56269 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:30.978784 0.032787 tcp 10.0.2.105 56270 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:31.011895 0.151986 tcp 10.0.2.105 56271 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:21:31.163747 0.041668 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:31.205868 0.059256 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:31.265560 0.162809 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:31.428814 0.059355 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:31.488610 0.336733 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:31.825713 0.282823 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.108913 0.158120 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.267497 0.042344 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.310268 0.120388 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.431130 0.164831 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.596550 0.131222 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.728352 0.170415 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.899182 0.083181 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:32.982809 0.144615 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:33.127890 0.177491 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:33.305807 0.217568 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:33.523822 0.178319 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:33.702582 0.039808 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:33.742838 0.294902 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:34.038181 0.217353 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:34.255983 0.051491 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:34.307898 0.218639 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:34.526997 0.276609 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:34.804002 0.233432 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:35.037886 0.052975 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:35.091225 0.039787 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:35.131429 0.234116 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:21:44.879830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:23:26.856564 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 12:23:26.856658 1.143242 tcp 10.0.2.105 56272 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:27:48.885957 3.001662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:27:55.893913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:28:03.895220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:28:19.899057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:28:51.905525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:34:55.916189 2.995130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:35:02.916842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:35:10.918477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:35:26.921887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:35:58.927735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:42:02.934409 3.000909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:42:09.941594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:42:17.943181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:42:33.946175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:43:05.951551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:49:09.957673 3.001733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 12:49:16.965095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:49:24.966186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:49:40.969144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:50:12.976792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:52:03.705372 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 12:52:03.705575 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 12:52:20.230224 0.051795 tcp 10.0.2.105 56273 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:52:20.282367 0.053380 tcp 10.0.2.105 56274 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:52:20.336148 0.146786 tcp 10.0.2.105 56275 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:52:20.483881 0.259068 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:20.743443 0.097634 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:20.841528 0.055730 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:20.897619 0.057730 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:20.955801 0.163842 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.120014 0.062802 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.183281 0.340545 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.524224 0.197686 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.722323 0.154483 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.877247 0.070281 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:21.947962 0.119403 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.067800 0.166943 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.235150 0.130759 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.366333 0.172551 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.539246 0.075937 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.615528 0.137553 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.753449 0.173263 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.927127 0.039912 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:22.967557 0.294876 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:23.262834 0.145938 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:23.409214 0.235983 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:23.645551 0.210316 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:23.856238 0.053036 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:23.909644 0.214111 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:24.124382 0.269209 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:24.393967 0.258391 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:24.652745 0.067466 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:24.720617 0.043139 udp 10.0.2.105 7010 <-> 82.17.183.230 5853 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:52:24.764136 0.208068 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 12:53:28.006326 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 12:53:28.006418 1.005582 tcp 10.0.2.105 56276 -> 128.255.183.224 9027 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/01/19 12:56:19.986031 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 12:56:26.993347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:56:34.995573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:56:50.997798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 12:57:23.003782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:03:27.010131 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:03:34.017435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:03:42.018697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:03:58.021784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:04:30.027802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:10:34.035256 2.999923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:10:41.041299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:10:49.045739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:11:05.046021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:11:37.051796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:17:41.060170 3.000749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:17:48.065541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:17:56.066810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:18:12.069771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:18:44.076196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:22:26.095587 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 13:22:26.095798 0.041559 udp 10.0.2.105 7010 <-> 88.149.250.55 6943 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.137794 0.057515 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.195760 0.262312 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.458440 0.241626 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.700493 0.161466 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.862364 0.058284 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:26.921080 0.558099 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:27.479624 0.428578 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:27.908713 0.158586 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.067744 0.041602 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.109765 0.117213 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.227422 0.164147 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.392091 0.128327 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.520813 0.171726 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.692987 0.080285 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.773704 0.144981 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:28.919392 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 13:22:46.997611 0.053256 tcp 10.0.2.105 56277 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:22:47.051142 0.053515 tcp 10.0.2.105 56278 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:22:47.104913 0.149668 tcp 10.0.2.105 56279 -> 195.113.214.236 443 SRPA* 0 0 33 19366 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:22:47.255290 0.140884 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:47.396592 0.227529 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:47.624557 0.211521 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:47.836632 0.052637 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:47.889681 0.038296 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:47.928399 0.296509 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:48.225307 0.227224 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:48.452914 0.453766 udp 10.0.2.105 7010 <-> 207.119.1.121 8296 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:48.907067 0.244541 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:49.152054 0.063557 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:22:49.216040 0.000000 udp 10.0.2.105 7010 -> 82.17.183.230 5853 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 13:23:07.254924 0.051792 tcp 10.0.2.105 56280 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:23:07.307017 0.054194 tcp 10.0.2.105 56281 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:23:07.361526 0.151655 tcp 10.0.2.105 56282 -> 195.113.214.236 443 SRPA* 0 0 44 35374 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:23:07.513979 0.136101 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:23:29.015686 1.373091 tcp 10.0.2.105 56283 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:24:48.085514 2.999506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 13:24:55.089283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:25:03.090858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:25:19.094535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:25:51.099714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:31:55.106030 3.284239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:32:02.364673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:32:10.298995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:32:26.161767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:32:58.144352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:39:02.150789 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:39:09.156889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:39:17.160690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:39:33.161628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:40:05.177798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:46:17.186010 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:46:24.193020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:46:32.193930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:46:48.197625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:47:20.203176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:53:20.862147 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 13:53:20.862248 0.178963 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:21.041624 0.000000 udp 10.0.2.105 7010 -> 82.17.183.230 5853 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 13:53:24.209334 3.002415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 13:53:30.385712 1.141397 tcp 10.0.2.105 56284 -> 128.255.183.224 9027 FSPA* 0 0 14 1514 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:31.216916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:53:38.559122 0.052425 tcp 10.0.2.105 56285 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:38.611884 0.052433 tcp 10.0.2.105 56286 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:38.664660 0.144957 tcp 10.0.2.105 56287 -> 195.113.214.236 443 SRPA* 0 0 44 32128 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:38.810310 0.000000 udp 10.0.2.105 7010 -> 88.149.250.55 6943 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 13:53:39.218073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:53:54.850880 0.052440 tcp 10.0.2.105 56288 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:54.903611 0.052408 tcp 10.0.2.105 56289 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:54.956306 0.145768 tcp 10.0.2.105 56290 -> 195.113.214.236 443 SRPA* 0 0 46 37246 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:53:55.102954 0.057858 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:55.161590 0.162798 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:55.221807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 13:53:55.324789 0.525291 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:55.850545 0.078151 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:55.929095 0.256567 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:56.186058 0.120605 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:56.307014 0.041243 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:56.348737 0.153807 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:56.502968 0.198476 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:56.701852 0.362864 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.065067 0.078010 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.143538 0.145083 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.289041 0.131853 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.421309 0.164783 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.586512 0.171065 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.758040 0.228843 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:57.987339 0.230280 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.218017 0.052293 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.270675 0.046151 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.317154 0.289053 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.606666 0.142980 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.750092 0.064543 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:58.815058 0.246745 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:53:59.062229 0.000000 udp 10.0.2.105 7010 -> 207.119.1.121 8296 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 13:54:17.483925 0.051684 tcp 10.0.2.105 56291 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:54:17.535889 0.054067 tcp 10.0.2.105 56292 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:54:17.590297 0.147975 tcp 10.0.2.105 56293 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/19 13:54:17.738992 0.235882 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:54:17.975284 0.138706 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 13:54:27.227281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:00:31.234015 3.000790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:00:38.241252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:00:46.242011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:01:02.245086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:01:34.251423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:07:38.259164 3.006219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:07:45.266850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:07:53.268726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:08:09.275460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:08:41.275248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:14:45.281929 3.090997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:14:52.347446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:15:00.299944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:15:16.303160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:15:48.309143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:21:52.318582 3.008804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:21:59.332982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:22:07.341014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:22:23.339978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:22:55.353242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:23:31.535475 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 14:23:31.535718 1.080566 tcp 10.0.2.105 56294 -> 128.255.183.224 9027 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:24:38.722329 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 14:24:38.722439 0.000000 udp 10.0.2.105 7010 -> 88.149.250.55 6943 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 14:24:55.487238 0.053592 tcp 10.0.2.105 56295 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:24:55.541206 0.053296 tcp 10.0.2.105 56296 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:24:55.594270 0.150897 tcp 10.0.2.105 56297 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:24:55.743125 0.000000 udp 10.0.2.105 7010 -> 207.119.1.121 8296 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 14:25:12.871667 0.109145 tcp 10.0.2.105 56298 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:25:12.981114 0.053885 tcp 10.0.2.105 56299 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:25:13.035323 0.154045 tcp 10.0.2.105 56300 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:25:13.190084 0.179391 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:13.369851 0.162342 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:13.532676 0.057509 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:13.590644 0.263138 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:13.854540 0.121166 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:13.976066 0.076876 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.053388 0.058087 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.111919 0.158240 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.270582 0.046457 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.317422 0.079258 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.397125 0.138109 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.535577 0.132498 udp 10.0.2.105 7010 <-> 69.159.94.54 5290 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:14.668610 0.335214 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.004430 0.171034 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.175877 0.225464 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.401717 0.233800 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.635894 0.055500 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.691836 0.039901 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.732191 0.165344 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:15.897915 0.170801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:16.069141 0.064247 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:16.133799 0.284071 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:16.418303 0.303956 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:16.722651 0.145391 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:16.868482 0.245710 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:25:17.114593 0.138320 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:28:59.360455 2.999761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 14:29:06.366487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:29:14.368444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:29:30.371318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:30:02.377162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:36:06.383353 3.001539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:36:13.390840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:36:21.391950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:36:37.394656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:37:09.411029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:44:46.421523 3.002343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:44:53.428865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:45:01.430656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:45:17.434796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:45:49.439280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:52:02.447886 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 14:52:09.454930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:52:17.460690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:52:33.461003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:53:05.465744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:53:32.615370 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 14:53:32.615473 0.985469 tcp 10.0.2.105 56301 -> 128.255.183.224 9027 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:55:22.182550 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 14:55:22.182782 0.056644 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:22.239776 0.260888 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:22.501109 0.120102 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:22.621608 0.183476 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:22.805417 0.059624 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:22.865437 0.180018 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.045795 0.162368 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.208578 0.156282 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.365302 0.045473 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.411118 0.075816 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.487275 0.144807 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:23.632629 0.000000 udp 10.0.2.105 7010 -> 69.159.94.54 5290 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 14:55:41.011236 0.344763 tcp 10.0.2.105 56302 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:55:41.355783 0.054814 tcp 10.0.2.105 56303 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:55:41.410429 0.126888 tcp 10.0.2.105 56304 -> 195.113.214.236 443 SRPA* 0 0 38 19182 flow=From-Botnet-V2-TCP-Established 1970/01/19 14:55:41.538168 0.337416 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:41.876015 0.171371 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.047850 0.212941 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.261174 0.227769 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.489291 0.050762 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.540577 0.040667 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.581650 0.165003 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.747100 0.170669 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.918232 0.057659 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:42.976497 0.465143 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:43.442093 0.260165 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:43.702693 0.140401 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:43.843616 0.346998 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:55:44.190962 0.288587 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/19 14:59:09.472623 3.003129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 14:59:16.479975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:59:24.480180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 14:59:40.483421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:00:12.490700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:06:16.497284 2.999966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:06:23.503123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:06:31.503849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:06:47.507448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:07:19.513633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:13:23.519016 3.002679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:13:30.526581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:13:38.528084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:13:54.531459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:14:26.537705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:20:30.544700 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:20:37.551605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:20:45.552598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:21:01.555210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:21:33.564618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:23:33.607719 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 15:23:33.607830 1.177355 tcp 10.0.2.105 56305 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:25:54.076537 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 15:25:54.076622 0.000000 udp 10.0.2.105 7010 -> 69.159.94.54 5290 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 15:26:12.434381 0.053550 tcp 10.0.2.105 56306 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:26:12.488189 0.053118 tcp 10.0.2.105 56307 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:26:12.541103 0.150436 tcp 10.0.2.105 56308 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:26:12.692146 0.060163 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:12.752681 0.123769 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:12.876919 0.103018 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:12.980416 0.059959 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.040750 0.179164 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.220360 0.260665 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.481459 0.161376 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.643233 0.137708 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.781355 0.169622 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.951407 0.040869 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:13.992723 0.088907 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:14.082073 0.337207 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:14.419665 0.168542 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:14.588659 0.250145 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:14.839248 0.217152 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.056768 0.053090 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.110243 0.044696 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.155389 0.165116 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.320969 0.170889 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.492183 0.065177 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.557743 0.148482 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:15.706699 0.348301 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:16.055437 0.150456 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:16.206268 0.235586 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:26:16.442279 0.300522 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:27:37.567083 3.002771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 15:27:44.574809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:27:52.576498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:28:08.579287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:28:40.585296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:34:44.592184 3.000495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:34:51.598882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:34:59.600773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:35:15.603333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:35:47.609401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:41:51.616880 3.000083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:41:58.622653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:42:06.624183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:42:22.629565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:42:54.636656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:48:58.640875 3.000287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:49:05.646664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:49:13.649681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:49:29.653186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:50:01.657149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:53:34.784186 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 15:53:34.784460 1.066273 tcp 10.0.2.105 56309 -> 128.255.183.224 9027 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:56:05.664380 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 15:56:12.670717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:56:20.672912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:56:36.676920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:56:46.069140 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 15:56:46.069225 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 15:57:01.833087 0.053983 tcp 10.0.2.105 56310 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:01.886829 0.052809 tcp 10.0.2.105 56311 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:01.939971 0.144067 tcp 10.0.2.105 56312 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:02.084575 0.063794 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.148924 0.179432 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.398175 0.056219 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.454787 0.119331 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.574563 0.260976 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.835995 0.162593 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:02.998976 0.137588 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:03.136993 0.174967 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:03.312411 0.039469 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:03.352427 0.077589 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:03.430424 0.336519 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:03.767307 0.266527 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.034216 0.278394 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.313006 0.217621 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.531037 0.053665 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.585108 0.039358 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.624902 0.064089 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.689349 0.138177 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:04.827929 0.345203 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:05.173546 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 15:57:08.681138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 15:57:20.899420 0.051305 tcp 10.0.2.105 56313 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:20.950998 0.052112 tcp 10.0.2.105 56314 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:21.002983 0.146367 tcp 10.0.2.105 56315 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/19 15:57:21.150014 0.165873 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:21.316467 0.170574 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:21.487461 0.241376 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/19 15:57:21.729281 0.289726 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:03:12.687555 3.000958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 16:03:19.694227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:03:27.696420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:03:43.699062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:04:15.705248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:10:19.713417 2.999909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 16:10:26.718906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:10:34.724603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:10:50.724523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:11:22.730153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:17:26.736481 3.002152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 16:17:33.743897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:17:41.744696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:17:57.747171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:18:29.753347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:23:35.853902 0.000215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:23:35.854223 1.488669 tcp 10.0.2.105 56316 -> 128.255.183.224 9027 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/01/19 16:24:33.759175 3.001305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 16:24:40.767982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:24:48.770110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:25:04.771150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:25:36.776707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:27:35.457989 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:27:35.458218 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:27:52.254573 0.031977 tcp 10.0.2.105 56317 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 16:27:52.286371 0.052819 tcp 10.0.2.105 56318 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 16:27:52.339495 0.123661 tcp 10.0.2.105 56319 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/19 16:27:52.463762 0.450990 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:52.915199 0.440933 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:53.356687 4.603579 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 4 1033 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:53.478249 4.741032 udp 10.0.2.105 7010 <-> 190.222.249.198 4324 CON 0 0 4 1230 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:53.739553 4.643903 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1230 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:53.901892 4.533036 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1130 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:53.959486 4.655194 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 984 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:54.140405 4.686924 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1124 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:54.285659 4.613747 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1018 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:54.360787 4.880724 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 976 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:54.696438 4.719264 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1269 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:54.942210 4.638543 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 4 1340 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.113201 4.513131 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 922 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.152350 4.748761 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 4 1146 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.379626 4.570358 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 4 1075 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.433640 4.558196 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1234 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.474238 4.579660 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 4 1264 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.532147 4.673993 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 4 980 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:55.685802 4.872626 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1157 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:56.032932 4.824386 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 4 950 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:56.245322 0.243051 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:56.488786 4.653982 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1111 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:56.774762 4.533694 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1054 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:56.940504 4.538337 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1106 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:57.504983 0.332156 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:27:58.615251 0.066418 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:28:01.479455 0.232781 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:28:01.712918 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:10.648643 0.000000 udp 10.0.2.105 7010 -> 208.69.109.110 7998 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:18.360918 0.000000 udp 10.0.2.105 7010 -> 86.172.172.128 8640 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:23.226536 0.000444 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:28:25.750532 0.000000 udp 10.0.2.105 7010 -> 216.137.162.91 4206 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:32.410767 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:38.959250 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:44.267256 0.190419 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:44.457675 0.000000 icmp 70.184.105.18 0x0303 -> 10.0.2.105 0x091d URP 192 1 297 flow=Background 1970/01/19 16:28:49.223635 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:28:49.504595 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:28:57.786155 0.000000 udp 10.0.2.105 7010 -> 60.50.117.227 6504 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:04.383153 0.000000 udp 10.0.2.105 7010 -> 46.177.20.127 7654 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:11.926877 0.000000 udp 10.0.2.105 7010 -> 216.218.47.246 4621 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:16.724277 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:29:19.026853 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:25.976857 0.000000 udp 10.0.2.105 7010 -> 82.53.113.216 2254 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:32.456091 0.000000 udp 10.0.2.105 7010 -> 201.170.89.116 3931 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:40.968388 0.325433 udp 10.0.2.105 7010 -> 58.9.120.114 2796 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:41.293821 0.000000 icmp 58.9.120.114 0x0303 -> 10.0.2.105 0xec0a URP 192 1 186 flow=Background 1970/01/19 16:29:45.725086 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:29:49.731238 0.000000 udp 10.0.2.105 7010 -> 187.172.156.168 7906 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:29:58.332847 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:05.272956 0.000000 udp 10.0.2.105 7010 -> 81.179.23.86 7560 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:10.220180 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:30:12.904061 0.000000 udp 10.0.2.105 7010 -> 86.130.29.224 5102 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:18.031769 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:26.483866 0.000000 udp 10.0.2.105 7010 -> 184.163.157.196 3552 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:32.502605 0.000000 udp 10.0.2.105 7010 -> 79.197.233.163 1246 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:37.218865 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:30:40.734562 0.000000 udp 10.0.2.105 7010 -> 192.198.63.222 2442 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:47.134854 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:30:55.435598 0.000000 udp 10.0.2.105 7010 -> 220.238.51.9 2803 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:04.187872 0.160238 udp 10.0.2.105 7010 <-> 70.54.33.210 3419 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:31:04.613059 0.000000 udp 10.0.2.105 7010 -> 174.75.66.37 7814 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:08.724918 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:31:13.541834 0.000000 udp 10.0.2.105 7010 -> 189.60.152.25 8208 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:19.509823 0.000000 udp 10.0.2.105 7010 -> 183.98.184.237 3687 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:28.132894 0.000000 udp 10.0.2.105 7010 -> 71.122.116.2 3758 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:32.720661 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:31:35.022257 0.000000 udp 10.0.2.105 7010 -> 94.64.79.253 5042 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:40.783430 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 16:31:42.782916 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:47.791266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:31:51.606226 0.000000 udp 10.0.2.105 7010 -> 50.202.165.170 2416 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:31:55.793182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:32:00.498618 0.000000 udp 10.0.2.105 7010 -> 68.109.121.12 2079 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:05.225581 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:32:05.746339 0.000000 udp 10.0.2.105 7010 -> 24.243.167.205 1396 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:11.796093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:32:12.426071 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:20.978384 0.000000 udp 10.0.2.105 7010 -> 98.194.54.238 7963 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:29.010137 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:33.716548 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:32:34.548140 0.000000 udp 10.0.2.105 7010 -> 145.236.208.104 2407 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:43.010867 0.000000 udp 10.0.2.105 7010 -> 81.149.41.169 8498 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:43.801594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:32:51.442257 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:32:59.423254 0.000000 udp 10.0.2.105 7010 -> 90.208.221.240 7297 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:04.220377 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:33:06.173276 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:15.088496 0.000000 udp 10.0.2.105 7010 -> 93.167.107.63 5449 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:22.506752 0.000000 udp 10.0.2.105 7010 -> 65.93.202.64 3925 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:29.627108 0.000000 udp 10.0.2.105 7010 -> 173.162.113.118 9353 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:34.223440 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:33:36.587161 0.000000 udp 10.0.2.105 7010 -> 79.45.20.99 9512 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:41.904817 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1046 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:49.105294 0.000000 udp 10.0.2.105 7010 -> 212.50.168.126 1295 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:55.143693 0.000000 udp 10.0.2.105 7010 -> 175.141.204.60 3630 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:33:59.720476 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:34:02.114238 0.000000 udp 10.0.2.105 7010 -> 88.64.244.43 6222 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:08.003227 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:15.613126 0.000000 udp 10.0.2.105 7010 -> 82.6.23.15 3475 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:23.524534 0.000000 udp 10.0.2.105 7010 -> 94.141.208.225 1616 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:28.222645 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:34:30.564937 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:37.725065 0.000000 udp 10.0.2.105 7010 -> 77.102.117.190 6754 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:42.814855 0.000000 udp 10.0.2.105 7010 -> 177.206.168.126 6854 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:50.503526 0.037239 udp 10.0.2.105 7010 -> 85.236.148.125 1679 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:34:50.540765 0.000000 icmp 85.236.148.125 0x0303 -> 10.0.2.105 0x8f06 URP 192 1 235 flow=Background 1970/01/19 16:34:55.220529 0.004521 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:34:57.947890 0.000000 udp 10.0.2.105 7010 -> 201.164.34.133 2936 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:06.806666 0.000000 udp 10.0.2.105 7010 -> 181.225.60.111 3344 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:13.857603 0.000000 udp 10.0.2.105 7010 -> 212.141.80.253 2899 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:19.534878 0.000000 udp 10.0.2.105 7010 -> 187.210.176.128 1703 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:24.221916 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:35:27.005461 0.000000 udp 10.0.2.105 7010 -> 194.255.111.66 4529 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:32.809384 0.000000 udp 10.0.2.105 7010 -> 174.89.248.53 8723 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:39.774194 0.226491 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:35:40.649831 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:47.786060 0.000000 udp 10.0.2.105 7010 -> 173.17.155.155 4883 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:35:52.722591 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:35:54.295590 0.000000 udp 10.0.2.105 7010 -> 95.9.199.196 1129 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:00.977003 0.000000 udp 10.0.2.105 7010 -> 122.81.56.88 6652 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:07.634330 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:13.483104 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:18.220049 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:36:19.641478 0.000000 udp 10.0.2.105 7010 -> 2.231.96.156 4903 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:25.460363 0.000000 udp 10.0.2.105 7010 -> 151.29.154.203 1023 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:33.292497 0.000000 udp 10.0.2.105 7010 -> 81.138.7.133 9086 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:39.780563 0.000000 udp 10.0.2.105 7010 -> 69.15.27.221 2682 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:44.718128 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:36:46.319888 0.000000 udp 10.0.2.105 7010 -> 217.41.11.94 3204 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:51.567513 0.000000 udp 10.0.2.105 7010 -> 82.21.57.81 2107 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:36:58.728674 0.000000 udp 10.0.2.105 7010 -> 111.94.37.205 2243 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:05.557202 0.000000 udp 10.0.2.105 7010 -> 184.146.167.167 7523 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:10.223676 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:37:14.420390 0.081771 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:37:14.803659 0.000000 udp 10.0.2.105 7010 -> 209.240.48.64 7524 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:20.298303 0.000000 udp 10.0.2.105 7010 -> 74.220.7.15 9204 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:28.841597 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:36.061544 0.197621 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:36.259165 0.000000 icmp 69.234.20.39 0x0303 -> 10.0.2.105 0xb61d URP 192 1 181 flow=Background 1970/01/19 16:37:40.717800 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:37:44.253345 0.000000 udp 10.0.2.105 7010 -> 108.4.84.252 6211 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:37:52.876613 0.000000 udp 10.0.2.105 7010 -> 195.189.109.218 9749 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:01.127496 0.231090 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:38:01.374567 0.000000 udp 10.0.2.105 7010 -> 213.123.168.89 6462 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:05.723681 0.007009 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:38:06.605218 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:14.486382 0.000000 udp 10.0.2.105 7010 -> 217.79.123.16 3935 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:21.736711 0.065839 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:38:22.007070 0.143514 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:38:22.174707 0.000000 udp 10.0.2.105 7010 -> 69.26.213.202 6590 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:28.596681 0.000000 udp 10.0.2.105 7010 -> 94.137.165.126 3555 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:33.222986 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:38:37.450143 0.000000 udp 10.0.2.105 7010 -> 74.56.93.88 5813 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:43.137908 0.000000 udp 10.0.2.105 7010 -> 98.216.62.212 8590 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:47.808213 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 16:38:50.889903 0.234825 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:38:51.274326 0.000000 udp 10.0.2.105 7010 -> 187.160.17.91 4448 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:38:54.814496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:38:59.561706 0.197915 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:39:00.059828 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:02.816104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:39:04.218450 0.000201 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:39:05.550177 0.000000 udp 10.0.2.105 7010 -> 74.7.75.190 7266 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:11.478726 0.000000 udp 10.0.2.105 7010 -> 88.224.223.72 1051 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:17.928030 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:18.818938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:39:25.500066 0.000000 udp 10.0.2.105 7010 -> 108.178.66.206 9252 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:30.225772 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:39:34.351715 0.000000 udp 10.0.2.105 7010 -> 88.243.111.219 8996 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:40.740876 0.064271 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:39:41.112859 0.000000 udp 10.0.2.105 7010 -> 37.24.177.21 8496 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:46.188673 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:50.825280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:39:54.951432 0.000000 udp 10.0.2.105 7010 -> 96.44.34.101 1461 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:39:59.717770 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:40:00.319022 0.093918 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:40:01.001377 0.000000 udp 10.0.2.105 7010 -> 178.51.34.137 7475 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:07.849413 0.176339 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:40:08.223687 0.214355 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:40:08.538751 0.000000 udp 10.0.2.105 7010 -> 115.166.24.98 6760 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:15.551113 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:21.259822 0.000000 udp 10.0.2.105 7010 -> 210.11.37.190 7485 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:26.226027 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:40:28.028938 0.000000 udp 10.0.2.105 7010 -> 183.32.8.181 2521 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:36.882861 0.000000 udp 10.0.2.105 7010 -> 79.5.74.18 1188 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:44.914970 0.178305 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:40:45.268795 0.193687 udp 10.0.2.105 7010 -> 41.215.82.18 1931 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:45.462482 0.000000 icmp 41.215.82.18 0x0303 -> 10.0.2.105 0x8b07 URP 192 1 305 flow=Background 1970/01/19 16:40:50.222458 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:40:51.333190 0.000000 udp 10.0.2.105 7010 -> 69.165.129.7 5114 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:40:59.566867 0.214793 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:41:00.087264 0.000000 udp 10.0.2.105 7010 -> 24.161.35.53 4282 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:41:08.757429 0.000000 udp 10.0.2.105 7010 -> 82.35.172.111 8559 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:41:17.269537 0.000000 udp 10.0.2.105 7010 -> 98.198.27.240 3257 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 16:41:22.216400 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:41:23.208123 0.180391 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/19 16:46:12.837284 3.000740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 16:46:19.846462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:46:27.845853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:46:43.848525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:47:15.854333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:53:19.861097 3.001664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 16:53:26.868144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:53:34.869709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:53:37.343873 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 16:53:37.343958 1.170827 tcp 10.0.2.105 56320 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/19 16:53:50.873049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 16:54:22.878819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:00:26.885347 3.001636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:00:33.893414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:00:41.894509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:00:57.897293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:01:29.902902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:07:33.911076 3.002528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:07:40.918523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:07:48.917925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:08:04.921100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:08:36.927924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:11:39.339413 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 17:11:39.339670 0.121618 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:39.461747 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 17:11:55.684475 0.171073 tcp 10.0.2.105 56321 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:11:55.855793 0.031207 tcp 10.0.2.105 56322 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:11:55.887331 0.126439 tcp 10.0.2.105 56323 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:11:56.014372 0.440696 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:56.455519 0.162592 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:56.618574 0.055919 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:56.674872 0.178654 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:56.853984 0.257190 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.111612 0.151740 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.263815 0.073600 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.337816 0.357289 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.695589 0.038971 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.734975 0.062567 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.797980 0.139196 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:57.937590 0.186810 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.124842 0.165839 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.291086 0.050662 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.342127 0.213497 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.556117 0.053678 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.610184 0.288792 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:58.899408 0.343083 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:59.242932 0.295963 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:59.539352 0.170306 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:59.710077 0.224482 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:11:59.935007 0.166058 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:00.101498 0.291652 udp 10.0.2.105 7010 <-> 70.54.33.210 3419 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:00.393618 0.338610 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:00.732647 0.073778 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:00.806832 0.000000 udp 10.0.2.105 7010 -> 184.7.120.127 2274 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 17:12:18.807333 0.051991 tcp 10.0.2.105 56324 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:12:18.859631 0.031015 tcp 10.0.2.105 56325 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:12:18.890897 0.130429 tcp 10.0.2.105 56326 -> 195.113.214.236 443 SRPA* 0 0 35 19576 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:12:19.020034 0.064587 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.085002 0.130695 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.216146 0.193275 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.409848 0.193055 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.603300 0.063522 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.667257 0.087713 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.755380 0.170369 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:19.926194 0.216138 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:20.142737 0.177062 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:20.320140 0.211022 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:12:20.531575 0.174546 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:14:40.934721 2.999466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 17:14:47.939692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:14:55.941738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:15:11.945158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:15:43.951719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:21:47.957234 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:21:54.964044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:22:02.965794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:22:18.968790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:22:50.974948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:23:38.513739 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 17:23:38.513852 1.091124 tcp 10.0.2.105 56327 -> 128.255.183.224 9027 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:28:54.981240 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:29:01.987976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:29:09.989422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:29:25.992638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:29:58.000398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:36:02.006260 3.000541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:36:09.012679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:36:17.013646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:36:33.017177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:37:05.022993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:42:24.817191 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 17:42:24.817302 0.000000 udp 10.0.2.105 7010 -> 190.222.249.198 4324 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 17:42:41.394698 0.031433 tcp 10.0.2.105 56328 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:42:41.426419 0.052941 tcp 10.0.2.105 56329 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:42:41.479710 0.142139 tcp 10.0.2.105 56330 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:42:41.622421 0.193250 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:41.816096 0.120239 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:41.936777 0.056331 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:41.993559 0.178355 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:42.172508 0.413058 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:42.586020 0.144820 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:42.731261 0.072292 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:42.804011 0.144433 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:42.948825 0.161337 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.110575 0.058590 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.169548 0.142234 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.312382 0.169682 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.482571 0.164459 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.647459 0.042168 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.690020 0.045710 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:43.736110 0.336568 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:44.073266 0.298612 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:44.372328 0.345832 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:44.718616 0.050483 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:44.769493 0.219177 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:44.989121 0.165445 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:45.154973 0.192775 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:45.348142 0.170702 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:45.519273 0.243045 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:45.762725 0.076842 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:45.839960 0.366808 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.207214 0.158667 udp 10.0.2.105 7010 <-> 70.54.33.210 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.366323 0.065452 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.432360 0.129617 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.562426 0.188849 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.751644 0.169387 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.921435 0.064042 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:46.985875 0.086883 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:47.073280 0.171152 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:47.244867 0.212830 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:47.458163 0.173500 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:47.631991 0.177970 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:42:47.810364 0.213001 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/19 17:44:42.032442 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:44:49.041921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:44:57.042071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:45:13.043954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:45:45.052727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:51:53.061723 3.001961 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:52:00.070561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:52:08.070996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:52:24.073918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:52:56.081021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:53:39.613397 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 17:53:39.613504 0.994104 tcp 10.0.2.105 56331 -> 128.255.183.224 9027 FSPA* 0 0 12 1423 flow=From-Botnet-V2-TCP-Established 1970/01/19 17:59:00.086302 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 17:59:07.093172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:59:15.095336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 17:59:31.098175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:00:03.103901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:06:07.119670 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:06:14.126512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:06:22.122856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:06:38.127110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:07:10.129229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:13:05.329871 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 18:13:05.329981 0.058989 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:05.389483 0.190970 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:05.580893 0.192391 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:05.773739 0.121499 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:05.895698 0.489872 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.386069 0.138216 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.524738 0.070338 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.595513 0.143073 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.739048 0.163457 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.902951 0.061646 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:06.965068 0.168267 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.133808 0.038856 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.173188 0.044335 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.217968 0.335966 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.554384 0.140263 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.695103 0.167705 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:07.863254 0.290333 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:08.153956 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 18:13:14.143459 2.993139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:13:21.150532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:13:23.901229 0.031837 tcp 10.0.2.105 56332 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 18:13:23.932958 0.031416 tcp 10.0.2.105 56333 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 18:13:23.964748 0.132258 tcp 10.0.2.105 56334 -> 195.113.214.236 443 SRPA* 0 0 58 40386 flow=From-Botnet-V2-TCP-Established 1970/01/19 18:13:24.095211 0.051561 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:24.147152 0.213332 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:24.360932 0.160919 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:24.522224 0.235781 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:24.758492 0.077338 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:24.836309 0.390950 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.227676 0.253603 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.481742 0.173092 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.655263 0.146475 udp 10.0.2.105 7010 <-> 70.54.33.210 3419 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.802090 0.063803 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.866323 0.131045 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:25.997772 0.278733 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:26.276947 0.310014 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:26.587363 0.062136 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:26.649887 0.084442 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:26.734734 0.169136 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:26.904347 0.176677 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:27.081857 0.216864 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:27.302804 0.214134 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:27.517436 0.176809 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:13:29.148893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:13:45.152574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:14:17.155813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:20:21.162622 3.002712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:20:28.169081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:20:36.170570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:20:52.175005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:21:24.182660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:23:40.612922 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 18:23:40.613018 1.018872 tcp 10.0.2.105 56335 -> 128.255.183.224 9027 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/01/19 18:27:28.181745 3.003585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:27:35.189958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:27:43.191112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:27:59.193706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:28:31.209727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:34:35.217711 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:34:42.223906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:34:50.224848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:35:06.228193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:35:38.236899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:41:42.240756 3.000825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:41:49.247102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:41:57.249040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:42:13.253141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:42:45.258059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:43:42.200029 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 18:43:42.200117 0.342465 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:42.543014 0.190126 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:42.733572 0.121301 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:42.855455 0.056698 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:42.912657 0.179019 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.092024 0.144922 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.237329 0.082300 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.320021 0.063523 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.384010 0.162758 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.547151 0.062408 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.609988 0.157247 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.767600 0.039167 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.807141 0.045250 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:43.852784 0.166259 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:44.019425 0.303758 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:44.323521 0.335842 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:44.659781 0.138392 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:44.798531 0.171663 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:44.970566 0.052916 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:45.023949 0.291845 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:45.316179 0.164639 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:45.481166 0.266626 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:45.748423 0.077340 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:45.826195 0.407786 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:46.234392 0.148119 udp 10.0.2.105 7010 <-> 70.54.33.210 3419 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:46.382942 0.066233 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:46.449519 0.132664 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:46.582602 0.278426 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:46.861447 0.191966 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.053860 0.171113 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.225399 0.315092 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.540920 0.059401 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.600713 0.093090 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.694194 0.172714 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:47.867309 0.228539 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:48.096253 0.174584 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:48.271253 0.213130 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:43:48.484810 0.214269 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 18:48:49.265012 3.001404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:48:56.272057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:49:04.273605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:49:20.275994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:49:52.323106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:53:41.632373 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 18:53:41.632454 0.965717 tcp 10.0.2.105 56336 -> 128.255.183.224 9027 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/01/19 18:55:56.300145 2.999426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 18:56:03.305377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:56:11.306238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:56:27.310322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 18:56:59.316689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:03:03.322767 3.000691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:03:10.329236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:03:18.330949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:03:34.334218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:04:06.342941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:10:10.346271 3.001617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:10:17.358970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:10:25.354520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:10:41.357652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:11:13.363687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:14:17.108927 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 19:14:17.109089 0.341655 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:17.451272 0.056262 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:17.507909 0.176910 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:17.685268 0.137874 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:17.823525 0.191987 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.015899 0.155307 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.171635 0.079064 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.251205 0.063155 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.314732 0.162043 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.477123 0.083758 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.561321 0.167370 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.729138 0.046011 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.775582 0.045958 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.821964 0.147407 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:18.969796 0.290531 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:19.260759 0.169686 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:19.430877 0.052992 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:19.484684 0.356959 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:19.842069 0.138798 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:19.981206 0.219842 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.201438 0.160242 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.362149 0.222715 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.585262 0.075377 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.661068 0.064708 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.726175 0.251866 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:20.978491 0.000000 udp 10.0.2.105 7010 -> 70.54.33.210 3419 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 19:14:38.160812 0.031888 tcp 10.0.2.105 56337 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:14:38.193054 0.031134 tcp 10.0.2.105 56338 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:14:38.224608 0.148819 tcp 10.0.2.105 56339 -> 195.113.214.236 443 SRPA* 0 0 40 31910 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:14:38.374148 0.253783 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:38.628300 0.172067 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:38.800771 0.132751 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:38.933910 0.255452 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.189793 0.172837 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.363074 0.059643 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.423184 0.084611 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.508372 0.169044 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.677850 0.209993 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:39.888287 0.182423 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:40.071203 0.176807 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:14:40.248450 0.219362 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:17:17.370876 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:17:24.379225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:17:32.379473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:17:48.381705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:18:20.387864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:23:42.601731 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 19:23:42.601838 1.188830 tcp 10.0.2.105 56340 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:24:24.394441 3.001004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:24:31.401405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:24:39.402845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:24:55.406519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:25:27.939878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:31:31.429136 3.000135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:31:38.436771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:31:46.436445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:32:02.439379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:32:34.445855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:38:38.452666 3.000537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:38:45.894834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:38:53.824178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:39:09.707449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:39:41.479603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:44:46.809521 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 19:44:46.809672 0.000000 udp 10.0.2.105 7010 -> 70.54.33.210 3419 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 19:45:05.287184 0.031176 tcp 10.0.2.105 56341 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:45:05.318696 0.032087 tcp 10.0.2.105 56342 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:45:05.350626 0.109737 tcp 10.0.2.105 56343 -> 195.113.214.236 443 SRPA* 0 0 50 31590 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:45:05.459352 0.180284 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:05.640017 0.144815 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:05.785260 0.193394 udp 10.0.2.105 7010 <-> 184.7.120.127 2274 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:05.979082 0.144456 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:06.124006 0.073209 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:06.197651 0.324064 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:06.522147 0.057586 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:06.580127 0.628941 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.209530 0.064073 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.274018 0.063515 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.337965 0.041833 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.380236 0.040756 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.421352 0.144550 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.566297 0.290501 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:07.857226 0.155993 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.013621 0.357287 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.371352 0.138026 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.509727 0.221787 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.731933 0.050903 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.783241 0.171090 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:08.954759 0.064587 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.019735 0.225156 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.245288 0.165926 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.411651 0.245926 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.658056 0.072947 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.731606 0.246068 udp 10.0.2.105 7010 <-> 108.80.130.154 3576 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:09.978087 0.171151 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.149618 0.132300 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.282286 0.178933 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.461573 0.086699 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.548632 0.171980 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.721038 0.198169 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:10.919609 0.174757 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:11.094734 0.177687 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:11.272870 0.341627 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:11.614945 0.065591 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:45:11.680914 0.215584 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/19 19:46:05.494806 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:46:12.501758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:46:20.503319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:46:36.506224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:47:08.512544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:53:12.519221 3.072299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 19:53:19.572960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:53:27.547560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:53:43.550112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 19:53:43.791435 0.000236 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 19:53:43.791821 1.009278 tcp 10.0.2.105 56344 -> 128.255.183.224 9027 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/01/19 19:54:15.557172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:00:19.562873 3.001714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:00:26.569729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:00:34.573917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:00:50.574307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:01:22.580788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:07:26.587827 2.999991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:07:33.600547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:07:41.595385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:07:57.598272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:08:29.605008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:14:33.621512 3.000550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:14:40.627798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:14:48.629479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:15:04.632834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:15:24.084470 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 20:15:24.084578 0.181034 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:24.266049 0.122468 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:24.389530 0.076927 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:24.466894 0.138102 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:24.605443 0.000000 udp 10.0.2.105 7010 -> 184.7.120.127 2274 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 20:15:36.648646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:15:42.902868 0.031322 tcp 10.0.2.105 56345 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:15:42.934483 0.030879 tcp 10.0.2.105 56346 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:15:42.965700 0.146658 tcp 10.0.2.105 56347 -> 195.113.214.236 443 SRPA* 0 0 71 70016 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:15:43.113148 0.237787 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.351445 0.056721 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.408745 0.161563 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.570723 0.068878 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.640057 0.149784 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.790286 0.039113 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.829822 0.040143 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:43.870362 0.146116 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:44.016974 0.341085 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:44.358431 0.291305 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:44.650070 0.153452 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:44.803926 0.138954 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:44.943243 0.214767 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.158375 0.052725 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.211454 0.177971 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.389867 0.064872 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.455095 0.221553 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.677101 0.078934 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.756505 0.206053 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:45.962966 0.166448 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:46.129872 0.128119 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:15:46.258425 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 20:16:03.407779 0.031647 tcp 10.0.2.105 56348 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:16:03.439726 0.031560 tcp 10.0.2.105 56349 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:16:03.471663 0.132832 tcp 10.0.2.105 56350 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:16:03.605041 0.172131 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:03.777583 0.202278 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:03.980208 0.089163 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.117831 0.169630 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.287888 0.213678 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.501968 0.176290 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.678637 0.060799 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.739860 0.176376 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:04.916695 0.192534 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:16:05.109667 0.213287 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:21:40.656063 2.999994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:21:47.661727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:21:55.663025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:22:11.666530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:22:43.672713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:23:44.801038 0.000204 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 20:23:44.801346 0.995844 tcp 10.0.2.105 56351 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:28:47.678397 3.001326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:28:54.686145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:29:02.687327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:29:18.690189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:29:50.697936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:35:54.702272 3.001874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:36:01.710168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:36:09.711352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:36:25.716633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:36:57.723408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:44:35.731722 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:44:42.738165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:44:50.741031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:45:06.744708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:45:38.749010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:46:21.644247 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 20:46:21.644393 0.000000 udp 10.0.2.105 7010 -> 184.7.120.127 2274 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 20:46:39.679221 0.030650 tcp 10.0.2.105 56352 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:39.710157 0.052675 tcp 10.0.2.105 56353 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:39.763088 0.133312 tcp 10.0.2.105 56354 -> 195.113.214.236 443 SRPA* 0 0 42 35862 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:39.897331 0.000000 udp 10.0.2.105 7010 -> 108.80.130.154 3576 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 20:46:58.124138 0.030070 tcp 10.0.2.105 56355 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:58.154495 0.031408 tcp 10.0.2.105 56356 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:58.186193 0.130079 tcp 10.0.2.105 56357 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:46:58.316819 0.179242 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:58.496495 0.150042 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:58.646976 0.144697 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:58.792118 0.074362 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:58.866921 0.164374 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.031721 0.058522 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.090666 0.063468 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.154609 0.058173 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.213191 0.222236 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.435866 0.045454 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.481775 0.145875 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.628101 0.045356 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.673803 0.154966 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:46:59.829142 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 20:47:16.880883 0.054563 tcp 10.0.2.105 56358 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:47:16.935249 0.053949 tcp 10.0.2.105 56359 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:47:16.989490 0.143363 tcp 10.0.2.105 56360 -> 195.113.214.236 443 SRPA* 0 0 31 24174 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:47:17.133547 0.219121 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:17.353067 0.053669 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:17.407124 0.305649 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:17.713199 0.356742 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.070377 0.078966 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.149729 0.206571 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.356841 0.167125 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.524431 0.132105 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.656986 0.257438 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.914861 0.067054 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:18.982381 0.222830 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:19.205609 0.170947 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:19.376962 0.377520 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:19.755515 0.089887 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:19.845797 0.170729 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.016973 0.059970 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.077382 0.177371 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.255232 0.201475 udp 10.0.2.105 7010 <-> 180.151.24.1 4289 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.457094 0.198327 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.655868 0.256871 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:47:20.913171 0.216042 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/19 20:51:45.759829 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 20:51:52.766767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:52:00.768296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:52:16.774381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:52:48.777298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:53:45.805615 0.000238 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 20:53:45.805977 4.247649 tcp 10.0.2.105 56361 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/19 20:58:52.784806 3.000054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 20:58:59.791536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:59:07.792764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:59:23.796115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 20:59:55.802233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:05:59.808496 3.000715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:06:06.815372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:06:14.816474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:06:30.819469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:07:02.825691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:13:06.833697 3.001271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:13:13.838459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:13:21.841223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:13:37.844020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:14:09.850171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:17:47.444174 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 21:17:47.444286 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 21:18:05.780992 0.052681 tcp 10.0.2.105 56362 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:05.833918 0.052367 tcp 10.0.2.105 56363 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:05.886669 0.150401 tcp 10.0.2.105 56364 -> 195.113.214.236 443 SRPA* 0 0 50 32854 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:06.037655 0.169517 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.207614 0.145125 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.353126 0.078032 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.431522 0.163836 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.595756 0.063020 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.659204 0.088106 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.747764 0.058764 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.806970 0.178742 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:06.986069 0.044145 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:07.030624 0.154287 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:07.185360 0.045612 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:07.231354 0.219188 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:07.450988 0.515980 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:07.967411 0.227463 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:08.195364 0.050540 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:08.246290 0.297939 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:08.544605 0.383766 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:08.928837 0.072304 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.001546 0.131946 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.133871 0.168519 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.302820 0.065500 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.368690 0.220928 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.589995 0.206557 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.796932 0.164312 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:09.961681 0.172301 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.134345 0.200776 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.335603 0.088397 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.424490 0.170146 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.595155 0.065389 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.660983 0.176942 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:10.838397 0.176361 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:11.015169 0.213278 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:18:11.228821 0.000000 udp 10.0.2.105 7010 -> 180.151.24.1 4289 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 21:18:29.873502 0.051981 tcp 10.0.2.105 56365 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:29.925842 0.053866 tcp 10.0.2.105 56366 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:29.979595 0.146390 tcp 10.0.2.105 56367 -> 195.113.214.236 443 SRPA* 0 0 32 17250 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:18:30.126198 0.203586 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:20:13.856870 3.002605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 21:20:20.864092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:20:28.866647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:20:44.867814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:21:16.873476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:23:50.054098 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 21:23:50.054327 1.213306 tcp 10.0.2.105 56368 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:27:20.879738 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:27:27.887900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:27:35.888347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:27:51.892536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:28:23.897386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:34:27.903927 3.003127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:34:34.910837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:34:42.912509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:34:58.915078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:35:30.922993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:41:34.929001 3.000585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:41:41.935326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:41:49.935839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:42:05.939100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:42:37.945301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:48:31.774404 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 21:48:31.774546 0.000000 udp 10.0.2.105 7010 -> 180.151.24.1 4289 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 21:48:41.951172 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:48:48.039421 0.052899 tcp 10.0.2.105 56369 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:48:48.092635 0.052985 tcp 10.0.2.105 56370 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:48:48.145937 0.155178 tcp 10.0.2.105 56371 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:48:48.299878 0.161491 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:48.461761 0.080230 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:48.542434 0.162310 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:48.705148 0.058605 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:48.764114 0.257416 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:48.958932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:48:49.021920 0.060039 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.082407 0.175753 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.258551 0.039542 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.298525 0.154834 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.453713 0.138150 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.592277 0.039272 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.632010 0.218508 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.850912 0.058347 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:49.909680 0.217883 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:50.127981 0.145872 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:50.274206 0.115707 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:50.390360 0.131581 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:50.522346 0.168243 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:50.690973 0.384004 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:51.075442 0.306916 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:51.382831 0.204148 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:51.587334 0.166166 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:51.753872 0.171270 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:48:51.925570 0.000000 udp 10.0.2.105 7010 -> 86.128.169.173 2112 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 21:48:56.960555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:49:09.349430 0.052332 tcp 10.0.2.105 56372 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:49:09.402052 0.054013 tcp 10.0.2.105 56373 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:49:09.456416 0.146954 tcp 10.0.2.105 56374 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:49:09.604053 0.222323 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:09.826824 0.197725 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.024977 0.061576 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.086997 0.180554 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.267941 0.177368 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.537271 0.217477 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.755231 0.170402 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:10.926084 0.090522 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:11.017042 0.197526 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/19 21:49:12.963105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:49:44.969194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:53:51.274022 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 21:53:51.274288 0.998535 tcp 10.0.2.105 56375 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/19 21:55:48.975856 3.001374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 21:55:55.982686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:56:03.984136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:56:19.988228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 21:56:51.993155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:02:55.999853 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:03:03.006758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:03:11.008799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:03:27.011077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:03:59.017650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:10:03.025692 2.999874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:10:10.030397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:10:18.032122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:10:34.035554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:11:06.041511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:17:10.047384 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:17:17.054624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:17:25.055710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:17:41.059246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:18:13.065021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:19:17.147767 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 22:19:17.147879 0.000000 udp 10.0.2.105 7010 -> 86.128.169.173 2112 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/19 22:19:34.935198 0.053080 tcp 10.0.2.105 56376 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/19 22:19:34.988648 0.053124 tcp 10.0.2.105 56377 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/19 22:19:35.042141 0.147780 tcp 10.0.2.105 56378 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/19 22:19:35.190206 0.163133 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.353795 0.119672 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.473945 0.073875 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.548440 0.059610 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.608702 0.180344 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.789474 0.041973 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.831826 0.156733 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:35.988948 0.151737 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.141077 0.058684 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.200763 0.187385 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.388684 0.229605 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.618654 0.058609 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.677726 0.219384 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:36.897587 0.144284 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.042372 0.157748 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.200587 0.039063 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.240081 0.166740 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.407332 0.130446 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.538304 0.338731 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:37.877447 0.175770 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:38.054033 0.304339 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:38.358817 0.203642 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:38.562899 0.166923 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:38.730251 0.243693 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:38.974310 0.252710 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.227459 0.066197 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.294073 0.176425 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.470895 0.176475 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.647799 0.091211 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.739523 0.193212 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:39.933200 0.214918 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:19:40.148543 0.171660 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:23:52.275098 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 22:23:52.275204 1.476039 tcp 10.0.2.105 56379 -> 128.255.183.224 9027 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/01/19 22:24:17.082322 3.000454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/19 22:24:24.088606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:24:32.184350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:24:48.103164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:25:20.110132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:31:24.116036 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:31:31.122724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:31:39.124086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:31:55.126984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:32:27.133342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:38:31.140430 3.002270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:38:38.147834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:38:46.148722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:39:02.151190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:39:34.157901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:46:03.172899 2.997886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:46:10.175950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:46:18.180572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:46:34.180809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:47:06.187163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:49:55.391239 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 22:49:55.391346 0.162465 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:55.554249 0.178251 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:55.732974 0.081522 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:55.814881 0.059896 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:55.875199 0.180457 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.056098 0.040248 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.096796 0.154352 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.251520 0.145000 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.396947 0.058810 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.456243 0.056766 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.513387 0.474986 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:56.988819 0.365176 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.354435 0.075182 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.430041 0.039533 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.469990 0.058904 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.529322 0.235185 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.764846 0.168328 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:57.933581 0.130335 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:58.064398 0.352996 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:58.417803 0.172277 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:58.590533 0.166341 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:58.757252 0.219941 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:58.977588 0.179294 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:59.157310 0.069153 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:59.226855 0.302989 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:59.530294 0.207028 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:59.737772 0.175228 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:49:59.913404 0.176638 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:50:00.090490 0.088209 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:50:00.179104 0.194180 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:50:00.373664 0.216778 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:50:00.590827 0.171317 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/19 22:53:10.193054 3.001753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 22:53:17.200496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:53:25.202530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:53:41.204780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 22:53:53.753527 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 22:53:53.753619 0.972337 tcp 10.0.2.105 56380 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/19 22:54:13.210801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:00:17.217371 3.001405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:00:24.224100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:00:32.225836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:00:48.228902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:01:20.235702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:07:24.251187 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:07:31.258238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:07:39.259642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:07:55.262971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:08:27.271136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:14:31.275066 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:14:38.286577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:14:46.283705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:15:02.286985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:15:34.303005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:20:17.691041 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 23:20:17.691159 0.076655 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:17.768306 0.059561 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:17.828342 0.180189 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.008947 0.039535 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.048927 0.163746 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.213112 0.120319 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.333965 0.156014 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.490407 0.144839 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.635683 0.058278 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.694340 0.057997 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.752827 0.218695 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:18.972002 0.282529 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.254992 0.071561 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.326973 0.046524 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.373998 0.139295 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.513800 0.228488 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.742690 0.162365 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:19.905452 0.131216 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:20.037091 0.375562 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:20.413000 0.170617 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:20.584016 0.319319 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:20.903746 0.067262 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:20.971351 0.299470 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:21.271269 0.205794 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:21.477441 0.163472 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:21.641315 0.237583 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:21.879237 0.179615 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:22.059254 0.215842 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:22.275510 0.093080 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:22.369015 0.198809 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:22.568239 0.215139 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:20:22.783819 0.169638 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:21:38.310652 3.000156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:21:45.316182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:21:53.318651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:22:09.320874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:22:41.326475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:23:54.743299 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 23:23:54.743399 1.273358 tcp 10.0.2.105 56381 -> 128.255.183.224 9027 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/19 23:28:45.332812 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:28:52.341358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:29:00.341822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:29:16.344335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:29:48.350318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:35:52.357178 3.001979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:35:59.364068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:36:07.365921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:36:23.369456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:36:55.374859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:44:33.386259 3.001369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:44:40.393414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:44:48.394257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:45:04.398426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:45:36.404395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:50:32.243347 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 23:50:32.243464 0.175897 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.419799 0.039086 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.459256 0.162515 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.622139 0.078947 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.701523 0.060054 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.761990 0.121204 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:32.883636 0.157420 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.041496 0.137867 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.179800 0.057236 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.237462 0.055775 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.293727 0.219087 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.513302 0.150328 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.664084 0.074901 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.739388 0.039232 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.779042 0.063281 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:33.842808 0.242442 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.085692 0.163776 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.249867 0.129952 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.429434 0.196996 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.626893 0.064897 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.692247 0.300378 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:34.993028 0.337736 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:35.331155 0.170889 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:35.502419 0.206921 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:35.709776 0.168594 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:35.878798 0.246985 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.126179 0.174897 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.301427 0.176863 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.478704 0.215540 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.694684 0.167584 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.862660 0.091457 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:50:36.954487 0.200185 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/19 23:51:41.412108 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:51:48.419123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:51:56.420867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:52:12.424043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:52:44.429706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:53:56.022711 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/19 23:53:56.022907 1.102430 tcp 10.0.2.105 56382 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/19 23:58:48.436379 3.000760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/19 23:58:55.442895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:59:03.443892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:59:19.447203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/19 23:59:51.453129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:05:55.459733 3.002027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:06:02.468429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:06:10.469380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:06:26.472702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:06:58.477749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:13:02.485476 2.999245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:13:09.492020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:13:17.493593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:13:33.495602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:14:05.501897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:20:09.509388 2.999492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:20:16.515152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:20:24.516265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:20:40.489320 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 00:20:40.489424 0.505072 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:40.518954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:20:40.994938 0.078834 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.074132 0.059242 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.133851 0.159734 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.293984 0.154534 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.448959 0.178822 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.628223 0.053474 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.682142 0.151652 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.834233 0.059614 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.894272 0.054344 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:41.949071 0.223280 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.172782 0.257721 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.430865 0.074760 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.506026 0.039230 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.545696 0.063335 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.609446 0.216391 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.826275 0.165847 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:42.992599 0.131808 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:43.124781 0.201058 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:43.326280 0.066551 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:43.393203 0.303407 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:43.696995 0.373622 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:44.071022 0.170971 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:44.242472 0.206602 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:44.449475 0.166063 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:44.615951 0.224002 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:44.840432 0.175992 udp 10.0.2.105 7010 <-> 97.91.121.218 5261 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:45.016858 0.172799 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:45.190030 0.090487 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:45.280965 0.230134 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:45.511531 0.178608 udp 10.0.2.105 7010 <-> 108.94.60.232 3976 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:20:45.690574 0.216302 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:21:12.525101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:23:57.133709 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 00:23:57.133918 1.444022 tcp 10.0.2.105 56383 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:27:16.531493 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:27:23.539532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:27:31.541209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:27:47.543075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:28:19.549209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:34:23.555120 3.003674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:34:30.562800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:34:38.563722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:34:54.567414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:35:26.573122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:41:30.579231 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:41:37.586773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:41:45.588164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:42:01.591130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:42:33.597069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:48:37.603972 3.000850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 00:48:44.610710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:48:52.612118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:49:08.614871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:49:40.621067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:50:53.746824 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 00:50:53.747016 0.058023 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:53.805477 0.166192 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:53.972121 0.888997 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:54.861546 0.072780 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:54.934753 0.156995 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.092172 0.176242 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.268860 0.065414 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.334716 0.145671 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.480686 0.063281 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.544419 0.055175 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.600025 0.224855 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.825319 0.144083 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:55.969848 0.076604 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.046890 0.045036 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.092518 0.162113 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.255057 0.216581 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.472066 0.223851 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.696372 0.130687 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:56.827506 0.179491 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:57.007375 0.384617 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:57.392446 0.171743 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:57.564607 0.063755 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:57.628810 0.292076 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:57.921234 0.205258 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:58.126926 0.169350 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:58.296748 0.238478 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:50:58.535604 0.000000 udp 10.0.2.105 7010 -> 97.91.121.218 5261 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 00:51:17.532301 0.070204 tcp 10.0.2.105 56384 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:51:17.803039 0.059031 tcp 10.0.2.105 56385 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:51:17.862368 0.268860 tcp 10.0.2.105 56386 -> 195.113.214.236 443 SRPA* 0 0 64 48045 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:51:18.132601 0.172373 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:51:18.305341 0.087096 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:51:18.392938 0.215940 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:51:18.609310 0.201354 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 00:51:18.811093 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 00:51:34.224308 0.053257 tcp 10.0.2.105 56387 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:51:34.277854 0.052502 tcp 10.0.2.105 56388 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:51:34.330629 0.148433 tcp 10.0.2.105 56389 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:53:58.583515 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 00:53:58.583783 0.978329 tcp 10.0.2.105 56390 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/20 00:55:44.640000 2.988172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 00:55:51.635300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:55:59.637161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:56:15.639077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 00:56:47.645266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:02:51.650800 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:02:58.659224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:03:06.659803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:03:22.662738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:03:54.668577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:09:58.676314 3.000275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:10:05.683159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:10:13.683722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:10:29.688709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:11:01.693419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:17:05.699259 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:17:12.706879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:17:20.707635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:17:37.605386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:18:09.265165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:21:57.776628 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 01:21:57.776838 0.000000 udp 10.0.2.105 7010 -> 97.91.121.218 5261 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 01:22:16.575169 0.053494 tcp 10.0.2.105 56391 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:16.628527 0.032807 tcp 10.0.2.105 56392 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:16.661168 0.120552 tcp 10.0.2.105 56393 -> 195.113.214.236 443 SRPA* 0 0 63 40603 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:16.781144 0.000000 udp 10.0.2.105 7010 -> 108.94.60.232 3976 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 01:22:34.990309 0.084948 tcp 10.0.2.105 56394 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:35.075513 0.032812 tcp 10.0.2.105 56395 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:35.108635 0.214341 tcp 10.0.2.105 56396 -> 195.113.214.236 443 SRPA* 0 0 49 28908 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:22:35.513258 0.057813 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:35.571570 0.121058 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:35.693071 0.153119 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:35.846691 0.179762 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:36.026904 0.043774 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:36.071128 0.075478 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:36.147075 0.568564 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:36.716078 0.233162 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:36.949669 0.146026 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.096143 0.063581 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.160150 0.039969 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.200560 0.075984 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.276903 0.145017 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.422323 0.058464 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.481157 0.130547 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.612139 0.197885 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.810450 0.059046 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:37.869972 0.216616 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:38.087087 0.166296 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:38.253780 0.383167 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:38.637319 0.170550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:38.808343 0.071277 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:38.880060 0.167547 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:39.047975 0.222212 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:39.270713 0.287401 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:39.558582 0.204883 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:39.763921 0.199092 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:39.963465 0.171317 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:40.135235 0.091778 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:22:40.227363 0.214747 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:23:59.561917 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 01:23:59.562014 1.346810 tcp 10.0.2.105 56397 -> 128.255.183.224 9027 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:24:12.743333 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 01:24:19.750313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:24:27.751948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:24:43.754761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:25:15.761909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:31:19.766444 3.002358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:31:26.776748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:31:34.776076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:31:50.778446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:32:22.784935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:38:26.791903 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:38:33.798163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:38:41.799978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:38:57.802801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:39:29.808840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:45:58.821210 3.000712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:46:05.828260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:46:13.831914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:46:29.834141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:47:01.839412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:53:05.845052 3.001489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 01:53:06.183153 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 01:53:06.183439 0.153476 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:06.337366 0.179943 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:06.517724 0.237596 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:06.755722 0.074620 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:06.830767 0.057332 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:06.888536 0.120619 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:07.009541 0.706086 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:07.716007 0.229153 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:07.945500 0.145334 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.091242 0.056969 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.148622 0.045806 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.194822 0.100373 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.295881 0.145009 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.441283 0.057785 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.499480 0.131420 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.631257 0.213651 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.845347 0.065311 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:08.911105 0.227707 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:09.139212 0.162207 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:09.301806 0.064687 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:09.366965 0.167699 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:09.535076 0.236085 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:09.771541 0.343354 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:10.115293 0.172806 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:10.288598 0.300552 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:10.589573 0.207191 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:10.797169 0.203565 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:11.001196 0.172562 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:11.174174 0.090532 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:11.265123 0.213632 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/20 01:53:12.852500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:53:20.853544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:53:36.858244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 01:54:00.911965 1.087065 tcp 10.0.2.105 56398 -> 128.255.183.224 9027 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/20 01:54:08.862590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:00:12.869062 3.001868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:00:19.876616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:00:27.877716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:00:43.880175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:01:15.886514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:07:19.892015 3.002653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:07:26.901292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:07:34.906262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:07:50.904504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:08:22.911620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:14:26.916477 3.001607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:14:33.924883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:14:41.925581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:14:57.930969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:15:29.934664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:21:33.950133 3.048517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:21:40.978652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:21:48.969411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:22:04.973249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:22:36.978733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:23:31.627249 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 02:23:31.627346 0.041827 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:31.669582 0.074911 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:31.744842 0.062606 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:31.807895 0.171518 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:31.979829 0.156336 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:32.136620 0.179322 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:32.316269 0.292102 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:32.608814 0.227645 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:32.836840 0.147046 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:32.984222 0.063642 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.048321 0.039267 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.088017 0.100816 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.189274 0.145113 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.334830 0.060686 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.395955 0.131130 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.527490 0.209772 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.737673 0.160944 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.898978 0.064407 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:33.963740 0.168416 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:34.132739 0.239291 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:34.372532 0.403031 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:34.775966 0.211207 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:34.987620 0.178277 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:35.166277 0.172601 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:35.339265 0.290489 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:35.630240 0.207246 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:35.837912 0.198118 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:36.036488 0.171538 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:36.208591 0.090882 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:23:36.299898 0.215022 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:24:02.003915 1.103059 tcp 10.0.2.105 56399 -> 128.255.183.224 9027 FSPA* 0 0 14 1700 flow=From-Botnet-V2-TCP-Established 1970/01/20 02:28:40.984356 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 02:28:47.991887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:28:56.071259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:29:12.011444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:29:44.012705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:35:48.030147 3.000165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:35:55.036105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:36:03.037359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:36:19.040953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:36:51.047635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:42:55.052875 3.001846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:43:02.059856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:43:10.061463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:43:26.070617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:43:58.070829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:50:02.078086 3.000178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:50:09.084829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:50:17.085790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:50:33.088773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:51:05.094805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:53:46.175882 0.000201 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 02:53:46.176256 0.059303 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.236028 0.180792 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.417268 0.153505 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.571198 0.179302 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.750982 0.039351 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.790764 0.078795 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:46.957295 0.163638 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.121373 0.228175 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.349926 0.146745 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.497483 0.064263 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.562190 0.046610 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.609256 0.117116 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.726829 0.152133 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.879429 0.058356 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:47.938231 0.132005 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:48.070671 0.199090 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:48.270153 0.407616 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:48.678173 0.063866 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:48.742391 0.168068 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:48.910867 0.230299 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:49.141496 0.164091 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:49.306007 0.173177 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:49.479597 0.239305 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:49.719308 0.337980 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:50.057719 0.304951 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:50.363145 0.203550 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:50.567122 0.202231 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:50.769724 0.172686 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:50.942857 0.091425 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:53:51.034716 0.216328 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/20 02:54:03.111497 1.097855 tcp 10.0.2.105 56400 -> 128.255.183.224 9027 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/01/20 02:57:09.101773 3.000523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 02:57:16.108145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:57:24.109495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:57:40.113274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 02:58:12.119638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:04:16.125390 3.000852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:04:23.132664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:04:31.133112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:04:47.136632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:05:19.142983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:11:23.147686 3.080580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:11:30.205716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:11:38.168086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:11:54.170250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:12:26.176387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:18:30.183251 3.000579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:18:37.191592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:18:45.192691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:19:01.194229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:19:33.200546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:24:04.210549 0.000176 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 03:24:04.210836 1.505577 tcp 10.0.2.105 56401 -> 128.255.183.224 9027 FSPA* 0 0 14 1555 flow=From-Botnet-V2-TCP-Established 1970/01/20 03:24:07.975572 0.153609 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.129652 0.181140 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.311167 0.040676 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.352216 0.073289 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.425907 0.059934 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.486236 0.121532 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.608365 0.161853 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.770621 0.227355 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:08.998341 0.142451 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.141177 0.057594 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.199224 0.045788 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.245442 0.073840 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.319716 0.144854 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.464952 0.057712 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.523067 0.131845 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.655268 0.177607 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:09.833239 0.186393 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:10.020005 0.062375 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:10.082778 0.167104 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:10.250259 0.172134 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:10.422821 0.230075 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:10.653293 0.367536 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:11.021171 0.214169 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:11.235737 0.165653 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:11.401730 0.295640 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:11.697788 0.204776 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:11.903020 0.199601 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:12.103097 0.172156 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:12.275608 0.094565 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:24:12.370510 0.211563 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:25:37.207290 3.000856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:25:44.214123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:25:52.383149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:26:08.248779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:26:40.234244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:32:44.240212 3.001817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:32:51.247759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:32:59.249274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:33:15.255451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:33:47.258217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:39:51.264615 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:39:58.271755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:40:06.273236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:40:22.276427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:40:54.282651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:46:58.289255 3.000581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:47:05.296569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:47:13.546716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:47:29.406226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:48:01.316022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:54:05.323405 2.999924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 03:54:05.721265 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 03:54:05.721371 0.927367 tcp 10.0.2.105 56402 -> 128.255.183.224 9027 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/01/20 03:54:12.329910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:54:20.331862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:54:32.849264 0.153490 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.003079 0.180650 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.184173 0.046781 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.231948 0.083917 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.316468 0.055075 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.371936 0.168296 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.540627 0.162265 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.703314 0.230680 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:33.934451 0.349290 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.284146 0.063009 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.347583 0.038810 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.386851 0.071726 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.458968 0.151589 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.610949 0.058302 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.669598 0.130468 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.800472 0.180692 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:34.981625 0.063451 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:35.045550 0.061417 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:35.107471 0.167390 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:35.275255 0.337803 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:35.613450 0.768501 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:36.334085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 03:54:36.382349 0.170583 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:36.553326 0.269147 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:36.822957 0.166371 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:36.989783 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 03:54:37.725900 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 03:54:54.052146 0.054446 tcp 10.0.2.105 56403 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 03:54:54.106906 0.043719 tcp 10.0.2.105 56404 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 03:54:54.150956 0.125512 tcp 10.0.2.105 56405 -> 195.113.214.236 443 SRPA* 0 0 62 39513 flow=From-Botnet-V2-TCP-Established 1970/01/20 03:54:54.276296 0.203989 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:54.480671 0.193160 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:54.674220 0.171783 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:54.846534 0.098133 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:54:54.945036 0.216218 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/20 03:55:08.340539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:01:12.346244 3.011516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:01:19.364071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:01:27.368620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:01:43.368489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:02:15.374089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:08:19.381261 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:08:26.387581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:08:34.389021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:08:50.392485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:09:22.408106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:15:26.414442 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:15:33.422810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:15:41.423428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:15:57.426611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:16:29.432655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:22:33.440182 2.999972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:22:40.447181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:22:48.447288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:23:04.450208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:23:36.456928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:24:06.649887 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 04:24:06.650258 1.155662 tcp 10.0.2.105 56406 -> 128.255.183.224 9027 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/01/20 04:25:11.433059 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 04:25:11.433169 0.302660 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:11.736293 0.158399 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:11.895125 0.042223 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:11.937702 0.089398 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.027466 0.058726 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.086635 0.160125 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.247165 0.163861 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.411390 0.234748 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.646520 0.174738 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.821628 0.059430 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:12.881490 0.441810 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.323834 0.071432 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.395771 0.144898 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.541076 0.059296 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.600754 0.130308 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.731512 0.203651 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.935514 0.059274 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:13.995185 0.066733 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:14.062394 0.168393 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:14.231156 0.039342 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:14.270943 0.385983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:14.657371 0.227172 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:14.884945 0.170638 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:15.055975 0.238357 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:15.294755 0.167134 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:15.462266 0.205438 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:15.668134 0.198799 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:15.867291 0.171824 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:16.039551 0.093430 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:25:16.133365 0.215337 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:29:40.462461 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 04:29:47.469472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:29:55.471837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:30:11.474686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:30:43.480181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:36:47.486561 3.000697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:36:54.493388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:37:02.505029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:37:18.508916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:37:50.513751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:45:12.522019 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:45:19.529552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:45:27.531544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:45:43.534059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:46:15.540003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:52:30.552111 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 04:52:37.559070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:52:45.561023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:53:01.563773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:53:33.570005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:54:07.809448 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 04:54:07.809548 0.965205 tcp 10.0.2.105 56407 -> 128.255.183.224 9027 FSPA* 0 0 12 1564 flow=From-Botnet-V2-TCP-Established 1970/01/20 04:55:44.749125 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 04:55:44.749237 0.307157 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.056831 0.155345 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.212660 0.041285 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.254421 0.074953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.329875 0.059077 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.389398 0.163667 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.553730 0.179194 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:55:45.733312 0.000000 udp 10.0.2.105 7010 -> 95.48.35.226 1897 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 04:56:01.295029 0.053466 tcp 10.0.2.105 56408 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 04:56:01.348793 0.056603 tcp 10.0.2.105 56409 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 04:56:01.405667 0.135013 tcp 10.0.2.105 56410 -> 195.113.214.236 443 SRPA* 0 0 51 47343 flow=From-Botnet-V2-TCP-Established 1970/01/20 04:56:01.541394 0.148715 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:01.690510 0.163012 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:01.853959 0.287644 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.142046 0.073495 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.215875 0.151853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.368172 0.057783 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.426325 0.130572 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.557284 0.265819 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.823557 0.063827 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.887834 0.066205 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:02.954497 0.167489 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:03.122426 0.045589 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:03.168452 0.170558 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:03.339448 0.237823 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:03.577671 0.338883 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:03.917004 0.208967 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:04.126427 0.226919 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:04.353732 0.206098 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:04.560177 0.197393 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:04.758008 0.172859 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:04.931253 0.093165 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:56:05.024826 0.209526 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 04:59:38.578366 3.000924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 04:59:45.584739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 04:59:53.586680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:00:09.589771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:00:41.595192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:06:45.601894 3.001280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:06:52.610743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:07:00.612678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:07:16.614106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:07:48.623202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:13:52.626108 3.000940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:13:59.632779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:14:07.634210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:14:23.637149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:14:55.643437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:20:59.651035 3.001800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:21:06.656712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:21:14.657601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:21:30.661369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:22:02.667559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:24:08.779426 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 05:24:08.779557 1.132792 tcp 10.0.2.105 56411 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/20 05:26:32.639633 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 05:26:32.639820 0.057992 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:32.698205 0.074563 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:32.773217 0.154630 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:32.928294 0.300117 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.228904 0.047905 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.277213 0.177421 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.454968 0.156878 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.612322 0.059214 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.671971 0.224845 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.897294 0.075550 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:33.973267 0.146190 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.119899 0.181991 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.302330 0.144972 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.447696 0.057471 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.505629 0.128869 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.634901 0.237966 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:34.873323 0.320427 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.194193 0.065956 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.260752 0.166775 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.427866 0.044972 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.473226 0.192026 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.665699 0.233308 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:35.899433 0.167833 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:36.067658 0.243529 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:36.311566 0.367567 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:36.679589 0.217033 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:36.897039 0.202849 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:37.100244 0.191143 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:37.291786 0.092937 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:26:37.385078 0.216141 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:28:06.677504 2.997083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 05:28:13.681632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:28:21.682016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:28:37.686538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:29:09.691800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:35:13.699018 2.999808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:35:20.705134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:35:28.706709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:35:44.710903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:36:16.714597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:42:20.721583 3.000780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:42:27.729385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:42:35.730038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:42:51.733326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:43:23.739233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:49:27.744972 3.001682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:49:34.756621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:49:42.753998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:49:58.757571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:50:30.762983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:54:09.918361 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 05:54:09.918552 0.965511 tcp 10.0.2.105 56412 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/20 05:56:38.776044 3.000965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 05:56:45.782623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:56:53.783673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:56:58.281244 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 05:56:58.281348 0.154647 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:58.436462 0.291933 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:58.728788 0.050574 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:58.779789 0.062017 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:58.842247 0.077945 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:58.920565 0.181096 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.102064 0.173806 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.276336 0.059209 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.335980 0.225685 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.562150 0.085396 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.647965 0.145186 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.793574 0.162319 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:56:59.956384 0.137955 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.094783 0.202688 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.297899 0.130379 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.428693 0.248123 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.677224 0.059329 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.737023 0.062810 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.800314 0.173825 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:00.974556 0.255919 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:01.230923 0.372294 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:01.603707 0.238622 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:01.842745 0.161624 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:02.004710 0.038412 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:02.043641 0.378797 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:02.422879 0.210356 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:02.633598 0.200083 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:02.834040 0.170669 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:03.005071 0.091755 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:03.097294 0.216438 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/20 05:57:09.787391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 05:57:41.793358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:03:45.800030 3.000324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:03:52.806209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:04:00.807326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:04:16.811243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:04:48.817043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:10:52.823120 3.163983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:10:59.961452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:11:07.905056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:11:23.855804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:11:55.860724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:17:59.866872 3.003215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:18:06.874209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:18:14.875854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:18:30.878721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:19:02.884779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:24:10.888523 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 06:24:10.888647 0.997079 tcp 10.0.2.105 56413 -> 128.255.183.224 9027 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:25:06.892112 3.138281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:25:14.004435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:25:21.946998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:25:37.915088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:26:09.919084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:27:12.318764 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 06:27:12.318861 0.182416 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:12.501738 0.295764 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:12.797863 0.059217 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:12.857473 0.000000 udp 10.0.2.105 7010 -> 95.48.35.226 1897 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 06:27:31.128096 0.053748 tcp 10.0.2.105 56414 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:27:31.182201 0.055539 tcp 10.0.2.105 56415 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:27:31.237534 0.139263 tcp 10.0.2.105 56416 -> 195.113.214.236 443 SRPA* 0 0 78 75819 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:27:31.377587 0.074597 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:31.452704 0.179611 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:31.632729 0.173666 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:31.806753 0.060447 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:31.867589 0.146330 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.014318 0.162722 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.177569 0.145403 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.323325 0.054754 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.378972 0.223404 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.602785 0.074967 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.678150 0.130938 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.809543 0.177701 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:32.987610 0.059606 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.047596 0.066503 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.114524 0.173340 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.288345 0.214966 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.503752 0.167566 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.671720 0.045351 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.717481 0.166119 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:33.884105 0.243071 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:34.127615 0.390393 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:34.518493 0.220498 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:34.739354 0.212794 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:34.952669 0.171901 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:35.124968 0.090084 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:27:35.234362 0.213748 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:32:13.926140 3.052384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:32:20.962900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:32:28.943989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:32:44.947192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:33:16.952709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:39:20.969346 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:39:27.976040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:39:35.978543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:39:51.982695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:40:23.986661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:46:29.995706 3.003124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:46:37.002945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:46:45.004646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:47:01.007396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:47:33.014229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:53:37.019813 3.001182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 06:53:44.026738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:53:52.028539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:54:08.031820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:54:11.887708 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 06:54:11.887806 0.952203 tcp 10.0.2.105 56417 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:54:40.037935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 06:57:51.563537 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 06:57:51.563718 0.063168 udp 10.0.2.105 7010 <-> 95.48.35.226 1897 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:51.627327 0.288832 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:51.916678 0.170564 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.087737 0.039700 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.127889 0.079640 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.207983 0.173987 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.382332 0.163468 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.546225 0.059675 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.606315 0.144229 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.750962 0.179144 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:52.930540 0.151853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.082854 0.058038 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.141318 0.213571 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.355324 0.077594 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.433391 0.131930 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.565714 0.266292 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.832425 0.060056 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.892892 0.057162 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:53.950448 0.172990 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.123800 0.038934 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.163104 0.167959 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.331448 0.252077 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.583944 0.223993 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.808440 0.166645 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:54.975545 0.338518 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:55.314486 0.228161 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:55.543050 0.216864 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:55.760314 0.170221 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:55.930912 0.093358 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 06:57:56.024718 0.000000 udp 10.0.2.105 7010 -> 50.134.170.237 5506 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 06:58:14.287402 0.050780 tcp 10.0.2.105 56418 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:58:14.337850 0.059440 tcp 10.0.2.105 56419 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 06:58:14.397133 0.114844 tcp 10.0.2.105 56420 -> 195.113.214.236 443 SRPA* 0 0 57 37419 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:00:44.043778 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:00:51.051004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:00:59.052959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:01:15.055870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:01:47.062585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:07:51.070560 2.998711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:07:58.075016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:08:06.076622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:08:22.079422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:08:54.085805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:14:58.091798 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:15:05.098972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:15:13.100582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:15:29.104587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:16:01.110037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:22:05.115855 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:22:12.122672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:22:20.124807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:22:36.129744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:23:08.134828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:24:12.847046 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 07:24:12.847320 0.991962 tcp 10.0.2.105 56421 -> 128.255.183.224 9027 FSPA* 0 0 14 1728 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:28:16.346936 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 07:28:16.347046 0.227727 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:16.575180 0.191798 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:16.767423 0.040849 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:16.808607 0.083019 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:16.892017 0.000000 udp 10.0.2.105 7010 -> 95.48.35.226 1897 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 07:28:32.982891 0.054517 tcp 10.0.2.105 56422 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:28:33.037656 0.055335 tcp 10.0.2.105 56423 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:28:33.093307 0.136965 tcp 10.0.2.105 56424 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:28:33.231077 0.314909 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:33.546408 0.120787 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:33.667622 0.058620 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:33.726653 0.147423 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:33.874524 0.189384 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.064315 0.144737 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.209416 0.055769 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.265583 0.247149 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.513111 0.179598 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.693128 0.131863 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.825443 0.111441 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:34.937255 0.063664 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.001274 0.065734 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.067486 0.201978 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.269882 0.045835 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.316069 0.165675 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.530108 0.273834 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.804410 0.168817 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:35.973575 0.404779 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:36.378751 0.292843 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:36.671977 0.259566 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:36.931923 0.090853 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:37.023256 0.340981 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:37.364589 0.208813 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:28:37.573730 0.281670 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:29:12.142468 2.999325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 07:29:19.147411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:29:27.148435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:29:43.151469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:30:15.157454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:36:19.162782 3.001719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:36:26.171229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:36:34.172674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:36:50.175377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:37:22.181867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:44:53.194283 3.028154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:45:00.214515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:45:08.211937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:45:24.214204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:45:56.221866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:52:16.231815 2.999641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 07:52:23.237234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:52:31.238520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:52:47.241493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:53:19.247496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:54:13.846320 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 07:54:13.846421 0.971771 tcp 10.0.2.105 56425 -> 128.255.183.224 9027 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:58:58.315805 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 07:58:58.316075 0.074654 udp 10.0.2.105 7010 -> 95.48.35.226 1897 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 07:58:58.390729 0.000000 icmp 95.48.35.226 0x0303 -> 10.0.2.105 0x6907 URP 192 1 305 flow=Background 1970/01/20 07:59:13.428946 0.054836 tcp 10.0.2.105 56426 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:13.484102 0.051996 tcp 10.0.2.105 56427 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:13.536452 0.143844 tcp 10.0.2.105 56428 -> 195.113.214.236 443 SRPA* 0 0 58 56852 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:13.681021 0.098167 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:13.779613 0.179254 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:13.959283 0.000000 udp 10.0.2.105 7010 -> 50.134.170.237 5506 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 07:59:24.255526 3.001161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/20 07:59:30.312176 0.048738 tcp 10.0.2.105 56429 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:30.361229 0.052655 tcp 10.0.2.105 56430 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:30.413722 0.138603 tcp 10.0.2.105 56431 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/20 07:59:30.552077 0.044166 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:30.596719 0.306630 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:30.903815 0.158894 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.063130 0.059204 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.122775 0.148636 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.263146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:59:31.271816 0.175658 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.447981 0.138111 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.586530 0.058291 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.645237 0.249787 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:31.895422 0.175065 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.070929 0.128807 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.200171 0.076044 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.276622 0.161303 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.438288 0.065058 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.503773 0.182195 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.686396 0.038745 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.725581 0.169311 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:32.895529 0.167540 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:33.063480 0.179305 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:33.243197 0.378530 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:33.622152 0.251838 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:33.874359 0.271057 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:34.145912 0.094027 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:34.240541 0.204872 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:34.445854 0.203686 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:34.649946 0.200429 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 07:59:39.263788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 07:59:55.266885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:00:27.272953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:06:31.279281 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:06:38.286636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:06:46.289328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:07:02.291112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:07:34.297013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:13:38.303587 3.003046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:13:45.310525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:13:53.311621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:14:09.314293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:14:41.320987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:20:45.327737 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:20:52.337278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:21:00.337270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:21:16.338734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:21:48.345057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:24:14.816590 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 08:24:14.816700 1.009560 tcp 10.0.2.105 56432 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/20 08:27:52.352066 3.000552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:27:59.358409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:28:07.362023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:28:23.362489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:28:55.368666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:29:38.140449 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 08:29:38.140640 0.000000 udp 10.0.2.105 7010 -> 50.134.170.237 5506 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 08:29:53.574819 0.063553 tcp 10.0.2.105 56433 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 08:29:53.638670 0.049924 tcp 10.0.2.105 56434 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 08:29:53.688899 0.138603 tcp 10.0.2.105 56435 -> 195.113.214.236 443 SRPA* 0 0 59 53885 flow=From-Botnet-V2-TCP-Established 1970/01/20 08:29:53.828229 0.078831 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:53.907421 0.187684 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.095481 0.121296 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.217203 0.060386 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.278013 0.151143 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.429572 0.044989 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.474915 0.301813 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.777114 0.197575 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:54.975088 0.137924 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.113479 0.059260 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.173180 0.249048 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.422632 0.179247 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.602316 0.131871 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.734600 0.073515 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:55.808587 0.197066 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.006005 0.040356 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.046806 0.165105 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.212452 0.163002 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.375889 0.227191 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.603437 0.064563 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.668556 0.064129 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:56.733027 0.467480 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:57.200925 0.284052 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:57.485364 0.260884 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:57.746626 0.089198 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:57.836252 0.318976 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:58.249376 0.207555 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:29:58.457400 0.211905 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/20 08:34:59.375086 3.000916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:35:06.381912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:35:14.383464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:35:30.386890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:36:02.392701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:42:06.400357 3.002929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:42:13.406950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:42:21.407671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:42:37.410605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:43:09.418028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:49:13.424600 2.999514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:49:20.429797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:49:28.432756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:49:44.434353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:50:16.440844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:54:15.825328 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 08:54:15.825428 1.152538 tcp 10.0.2.105 56436 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/20 08:56:20.456116 3.001931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 08:56:27.463841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:56:35.465570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:56:51.468641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 08:57:23.475374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:00:22.011498 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 09:00:22.011720 0.121270 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.133457 0.059620 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.193446 0.076286 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.270139 0.188745 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.459295 0.146606 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.606297 0.052750 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.659438 0.301846 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:22.961647 0.193704 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.155755 0.144987 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.301112 0.056624 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.358169 0.249190 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.607712 0.179994 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.788062 0.133336 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:23.921784 0.089347 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.011509 0.205104 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.216996 0.048030 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.265528 0.167112 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.433039 0.248491 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.681943 0.066475 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:24.748874 0.387382 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:25.136590 0.178933 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:25.315976 0.068433 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:25.384786 0.275060 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:25.660406 0.515458 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:26.176420 0.087831 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:26.264645 0.206015 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:26.471065 0.208866 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:00:26.680519 0.218017 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:03:27.480370 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:03:34.487952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:03:42.488990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:03:58.492646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:04:30.498552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:10:34.506665 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:10:41.511752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:10:49.513503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:11:05.517628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:11:37.523436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:17:41.528527 3.011476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:17:48.546080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:17:56.548556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:18:12.550358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:18:44.556514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:24:16.987711 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 09:24:16.987827 1.124045 tcp 10.0.2.105 56437 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/20 09:24:48.562311 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:24:55.570164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:25:03.572500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:25:19.574226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:25:51.582263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:30:32.994798 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 09:30:32.994901 0.079581 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.074989 0.120715 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.196148 0.059137 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.255641 0.192793 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.448902 0.143923 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.593222 0.046794 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.640587 0.330331 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:33.971318 0.178125 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.149871 0.137601 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.287883 0.056630 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.344940 0.243046 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.588499 0.180763 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.769794 0.129361 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.899605 0.075605 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:34.975630 0.207669 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:35.183736 0.191942 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:35.376089 0.064480 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:35.440979 0.403520 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:35.844911 0.039143 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:35.884537 0.167557 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:36.052672 0.179430 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:36.232764 0.155884 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:36.389095 0.269914 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:36.659432 0.192488 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:36.876692 0.312485 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:37.189632 0.222749 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:37.412764 0.212402 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:30:37.625487 0.099998 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/20 09:31:55.587631 3.000224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:32:02.593844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:32:10.595323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:32:26.598366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:32:58.606333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:39:02.610677 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:39:09.617219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:39:17.618895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:39:33.622063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:40:05.628114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:46:17.637390 3.000240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:46:24.643204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:46:32.646563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:46:48.647436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:47:20.653516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:53:24.659959 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 09:53:31.666692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:53:39.668539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:53:55.671728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 09:54:18.114315 0.000158 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 09:54:18.114563 1.141535 tcp 10.0.2.105 56438 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/20 09:54:27.677731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:00:31.685121 3.000211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:00:38.210831 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 10:00:38.210909 0.084918 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:38.296403 0.120322 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:38.417094 0.145547 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:38.563004 0.042644 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:38.605983 0.306651 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:38.691275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:00:38.912986 0.193615 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.107043 0.061039 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.168515 0.188222 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.357183 0.137910 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.495519 0.056953 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.552967 0.248363 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.801794 0.175243 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:39.977455 0.130931 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.112395 0.074181 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.187016 0.185005 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.372685 0.373972 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.747050 0.045033 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.792693 0.168260 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:40.961346 0.186532 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.148292 0.067948 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.216678 0.238929 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.456062 0.064497 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.520960 0.279595 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.801027 0.196611 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:41.998061 0.226881 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:42.225412 0.091465 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:42.317285 0.214053 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:42.531744 0.241589 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:00:46.692596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:01:02.695462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:01:34.701980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:07:38.708831 3.001859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:07:45.716011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:07:53.718848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:08:09.721401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:08:41.725540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:14:45.732978 3.000380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:14:52.739620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:15:00.740850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:15:16.744697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:15:48.750254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:21:52.756666 3.000558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:21:59.764114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:22:07.764748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:22:23.767559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:22:55.773816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:24:19.263812 0.000203 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 10:24:19.264138 1.084013 tcp 10.0.2.105 56439 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/20 10:28:59.780886 3.000316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:29:06.787067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:29:14.788597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:29:30.791370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:30:02.797385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:30:49.394905 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 10:30:49.395145 0.148451 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:49.544004 0.040100 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:49.584557 0.083635 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:49.668634 0.119977 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:49.789047 0.302250 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.091740 0.186623 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.278834 0.059854 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.339553 0.174666 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.514692 0.137654 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.652805 0.056399 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.709653 0.237564 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:50.947733 0.179356 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.127608 0.132098 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.260116 0.075536 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.336091 0.189017 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.525503 0.360339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.886241 0.044426 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:51.931066 0.164755 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.096196 0.194674 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.291304 0.065507 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.357219 0.179683 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.537359 0.068676 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.606491 0.278089 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.885027 0.091118 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:52.976586 0.238353 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:53.215316 0.231903 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:53.447655 0.206449 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:30:53.654533 0.206664 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 10:36:06.804513 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:36:13.812561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:36:21.812637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:36:37.815219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:37:09.821473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:44:45.832893 3.000994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:44:52.837255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:45:00.838746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:45:16.841619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:45:48.847853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:52:08.856697 3.002147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:52:15.867296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:52:23.865735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:52:39.872858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:53:11.874325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:54:20.356453 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 10:54:20.356546 1.026199 tcp 10.0.2.105 56440 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/20 10:59:15.881964 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 10:59:22.888747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:59:30.890136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 10:59:46.893171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:00:18.899485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:01:09.793058 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 11:01:09.793356 0.076199 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:09.870005 0.120546 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:09.990992 0.297140 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.288718 0.205611 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.494770 0.042233 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.537447 0.197781 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.735593 0.062675 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.798650 0.185166 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:10.984192 0.144798 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:11.129417 0.051625 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:11.181436 0.519470 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:11.701271 0.179543 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:11.881286 0.129339 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.011059 0.075991 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.087488 0.194902 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.282831 0.361828 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.645038 0.046816 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.692300 0.166950 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:12.859675 0.194256 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.054366 0.067048 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.121798 0.184402 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.306648 0.197359 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.504606 0.281557 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.786566 0.092955 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:13.879900 0.221684 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:14.102008 0.226297 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:14.328823 0.251953 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:01:14.581156 0.199790 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:06:22.906301 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:06:29.913914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:06:37.913505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:06:53.916597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:07:25.925316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:13:29.930104 3.001113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:13:36.935588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:13:44.939254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:14:00.940772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:14:32.946913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:20:36.963271 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:20:43.970517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:20:51.971226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:21:07.974631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:21:39.981447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:24:21.384341 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 11:24:21.384523 1.129027 tcp 10.0.2.105 56441 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/20 11:27:43.987567 3.000651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:27:50.993908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:27:58.995400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:28:14.998614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:28:47.004634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:31:26.658045 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 11:31:26.658225 0.082705 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:26.741385 0.121124 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:26.862870 0.289860 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.153133 0.144133 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.297730 0.041093 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.339286 0.163795 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.503524 0.059780 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.563697 0.155067 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.719193 0.215502 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:27.935138 0.180219 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.115748 0.128551 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.244670 0.074801 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.319916 0.138028 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.458317 0.055662 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.514386 0.171417 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:28.686306 0.357661 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.044522 0.039619 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.084589 0.161586 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.246583 0.188218 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.435130 0.069154 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.504682 0.289156 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.794197 0.087289 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:29.881944 0.230647 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:30.113032 0.366975 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:30.480381 0.062809 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:30.543644 0.254133 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:30.798181 0.219675 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:31:31.018233 0.173718 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/20 11:34:51.010491 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:34:58.017940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:35:06.020268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:35:22.022486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:35:54.028752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:41:58.036700 2.999867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:42:05.044448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:42:13.043048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:42:29.046687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:43:01.063280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:49:05.069546 3.000074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:49:12.076115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:49:20.077316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:49:36.080486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:50:08.086014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:54:22.513679 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 11:54:22.513782 1.381977 tcp 10.0.2.105 56442 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/20 11:56:12.093796 2.999921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 11:56:19.099849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:56:27.101593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:56:43.104910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 11:57:15.109859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:01:34.113212 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 12:01:34.113324 0.289337 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.403138 0.081759 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.485315 0.121859 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.607574 0.150830 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.758742 0.059897 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.819047 0.164946 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:34.984548 0.058290 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.043243 0.157868 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.201529 0.220078 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.422028 0.180409 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.602864 0.132499 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.735780 0.069849 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.806057 0.138005 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.944652 0.051732 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:35.996766 0.178846 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.176054 0.333692 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.510134 0.045411 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.556036 0.163588 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.719938 0.185095 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.905463 0.056845 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:36.962688 0.208190 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:37.171344 0.093877 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:37.265650 0.211581 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:37.477653 0.264439 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:37.742546 0.255855 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:37.998860 0.169879 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:38.169146 0.261910 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:01:38.431486 0.067239 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:03:19.116478 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:03:26.123961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:03:34.125493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:03:50.128622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:04:22.134432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:10:26.142628 2.999378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:10:33.148849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:10:41.149717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:10:57.152499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:11:29.160560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:17:33.166679 2.999103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:17:40.171866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:17:48.173195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:18:04.176035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:18:36.182763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:24:23.902778 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 12:24:23.902875 1.118993 tcp 10.0.2.105 56443 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/20 12:24:40.199930 2.999984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:24:47.206774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:24:55.207896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:25:11.211064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:25:43.216686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:31:47.223392 3.000565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:31:54.230273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:32:02.231541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:32:03.533659 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 12:32:03.533841 0.287358 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:03.821583 0.084022 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:03.906006 0.121654 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.028068 0.147314 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.175845 0.041597 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.217868 0.345688 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.563924 0.059027 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.623383 0.161546 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.785333 0.132369 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.918139 0.072932 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:04.991520 0.152075 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:05.144018 0.059558 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:05.203992 0.216313 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:05.420717 0.179950 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:05.601121 0.171884 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:05.773474 0.338074 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.111960 0.040744 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.153131 0.166137 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.319720 0.189095 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.509209 0.063726 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.576531 0.236921 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:06.813842 0.265136 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:07.079391 0.200419 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:07.280249 0.091772 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:07.372560 0.351703 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:07.724655 0.063406 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:07.788451 0.214971 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:08.003814 0.173492 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 12:32:18.234686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:32:50.239989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:38:54.250068 2.999356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:39:01.253986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:39:09.256197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:39:25.258298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:39:57.264870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:46:16.271913 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:46:23.490613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:46:31.418312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:46:47.295318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:47:19.302730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:53:23.306337 3.001766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 12:53:30.313000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:53:38.319819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:53:54.318679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 12:54:25.022493 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 12:54:25.022797 1.070553 tcp 10.0.2.105 56444 -> 128.255.183.224 9027 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/20 12:54:26.323837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:00:30.331776 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:00:37.337216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:00:45.338830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:01:01.415073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:01:33.358142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:02:14.707714 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 13:02:14.707830 0.122017 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:14.830250 0.277894 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.108517 0.041803 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.150722 0.303514 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.454666 0.081415 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.536501 0.317066 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.854000 0.057198 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:15.911632 0.160025 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.072019 0.131321 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.203760 0.073638 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.277836 0.137903 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.416212 0.054048 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.470699 0.223981 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.695049 0.180349 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:16.875860 0.171074 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.047332 0.336863 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.384657 0.046392 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.431484 0.066552 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.498469 0.210138 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.708968 0.252216 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:17.961620 0.170432 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:18.132477 0.249088 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:18.382045 0.262257 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:18.644695 0.087752 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:18.732840 0.374349 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:19.107600 0.079833 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:19.187837 0.229054 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:02:19.417284 0.169854 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:07:38.366735 3.001807 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:07:45.374696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:07:53.375417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:08:09.380190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:08:41.383017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:14:45.390496 3.044046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:14:52.418698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:15:00.409966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:15:16.411243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:15:48.417024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:21:52.422912 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:21:59.432483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:22:07.432414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:22:23.434998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:22:56.402835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:24:26.102756 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 13:24:26.102880 1.340114 tcp 10.0.2.105 56445 -> 128.255.183.224 9027 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/01/20 13:28:59.458640 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:29:06.466713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:29:14.465946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:29:30.473351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:30:02.474972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:32:47.782598 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 13:32:47.782689 0.039959 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:47.823079 0.119103 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:47.942533 0.148654 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.091555 0.162731 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.254766 0.057083 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.312262 0.163673 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.476339 0.288907 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.765666 0.081935 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.847994 0.132872 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:48.981304 0.071396 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.053086 0.152039 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.205473 0.054430 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.260320 0.215740 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.476522 0.178265 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.655180 0.170481 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.826071 0.062666 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:49.889066 0.215040 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:50.104648 0.256227 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:50.361245 0.160994 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:50.522618 0.337544 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:50.860696 0.045043 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:50.906138 0.189224 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.095800 0.182728 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.278983 0.097489 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.376869 0.251814 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.629048 0.060218 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.689668 0.220114 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:32:51.910180 0.170108 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 13:36:06.481095 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:36:13.487899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:36:21.491165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:36:37.494950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:37:09.499911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:44:44.507728 2.999657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:44:51.513382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:44:59.517963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:45:15.517563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:45:47.523736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:52:07.533535 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:52:14.540914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:52:22.542004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:52:38.544943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:53:10.550971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:54:27.443422 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 13:54:27.443528 1.106222 tcp 10.0.2.105 56446 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/20 13:59:14.557600 3.000522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 13:59:21.563903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:59:29.565606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 13:59:45.568589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:00:17.574560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:03:01.971779 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 14:03:01.971902 0.148307 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.120615 0.038998 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.159981 0.119851 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.280338 0.162725 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.443423 0.057008 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.500836 0.164940 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.666141 0.288849 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:02.955407 0.071446 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.027316 0.131446 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.159128 0.074331 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.233869 0.144737 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.379063 0.049079 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.428942 0.222895 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.652385 0.179810 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:03.832763 0.170758 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.003946 0.064171 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.068540 0.212989 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.281953 0.335626 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.618016 0.045442 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.663834 0.183976 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:04.848872 0.238246 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.087564 0.160442 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.248556 0.190447 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.439387 0.087300 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.527039 0.223777 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.751195 0.064048 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:05.815648 0.228967 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:03:06.045107 0.170687 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:06:21.582529 3.016002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:06:28.588145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:06:36.596337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:06:52.616916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:07:24.607596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:13:28.605375 3.003939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:13:35.616674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:13:43.613884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:14:01.167558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:14:32.824758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:20:35.638760 3.002665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:20:42.647424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:20:50.647959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:21:06.650907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:21:38.658782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:24:28.551067 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 14:24:28.551256 1.117653 tcp 10.0.2.105 56447 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/20 14:27:42.665570 2.999009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:27:49.670212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:27:57.672072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:28:13.679218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:28:45.680615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:33:14.587388 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 14:33:14.587530 0.121535 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:14.709462 0.161148 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:14.871041 0.146249 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.017706 0.041387 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.059491 0.056465 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.116415 0.178941 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.295732 0.296229 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.592527 0.077109 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.670027 0.131259 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.801618 0.113427 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:15.915421 0.151671 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.067480 0.053171 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.121060 0.215809 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.337253 0.178012 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.515653 0.170379 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.686451 0.065134 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.751943 0.217066 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:16.969421 0.421201 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:17.391027 0.044392 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:17.435768 0.189035 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:17.625180 0.230590 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:17.856176 0.164890 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.021483 0.219527 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.241420 0.059815 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.301664 0.217532 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.519593 0.171431 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.691410 0.088275 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:33:18.780073 0.357844 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/20 14:34:49.690018 2.997902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:34:56.694030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:35:04.696693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:35:20.698721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:35:52.705107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:41:56.711395 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:42:03.718053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:42:11.719597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:42:27.722682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:42:59.728132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:49:03.735300 3.003210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:49:10.742682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:49:18.746693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:49:34.747310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:50:06.752845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:54:29.671019 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 14:54:29.671120 0.996294 tcp 10.0.2.105 56448 -> 128.255.183.224 9027 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/01/20 14:56:10.758518 3.003408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 14:56:17.765999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:56:25.767147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:56:41.772992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 14:57:13.776351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:03:17.782973 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:03:24.789414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:03:32.791429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:03:36.818360 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 15:03:36.818463 0.387548 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:37.206467 0.040555 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:37.247460 0.056582 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:37.304487 0.120724 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:37.473160 0.394158 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:37.867753 0.526396 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:38.394536 0.300526 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:38.695470 0.079102 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:38.774982 0.130409 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:38.905816 0.071818 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:38.978043 0.144909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:39.123369 0.055498 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:39.179262 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 15:03:48.794533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:03:55.075529 0.052514 tcp 10.0.2.105 56449 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:03:55.128378 0.052717 tcp 10.0.2.105 56450 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:03:55.181410 0.108833 tcp 10.0.2.105 56451 -> 195.113.214.236 443 SRPA* 0 0 53 33011 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:03:55.288901 0.180447 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:55.469783 0.171214 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:55.641389 0.060687 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:55.702453 0.218554 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:55.921392 0.357919 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:56.279780 0.039060 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:56.319286 0.185331 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:56.504999 0.246547 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:56.751993 0.163056 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:56.915443 0.236488 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:57.152330 0.172794 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:57.325519 0.094506 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:57.517233 0.245739 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:57.763354 0.290616 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:03:58.054353 0.238254 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:04:20.800569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:10:24.807977 3.003290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:10:31.813798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:10:39.817186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:10:55.818190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:11:27.824305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:17:31.832030 3.000558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:17:38.837910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:17:46.899203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:18:02.862062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:18:34.871132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:24:30.670578 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 15:24:30.670676 0.969060 tcp 10.0.2.105 56452 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:24:38.876888 2.999151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:24:45.881875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:24:54.000892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:25:09.899288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:25:41.902214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:31:45.908417 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:31:52.915777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:32:01.147835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:32:17.004740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:32:48.939875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:34:07.950766 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 15:34:07.950956 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 15:34:25.737658 0.052522 tcp 10.0.2.105 56453 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:34:25.790497 0.053062 tcp 10.0.2.105 56454 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:34:25.843878 0.125448 tcp 10.0.2.105 56455 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/20 15:34:25.969929 0.147487 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.117871 0.040650 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.158893 0.058034 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.217353 0.121971 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.339734 0.219900 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.560013 0.200428 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.760844 0.078593 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.839859 0.130048 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:26.970352 0.075924 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.046719 0.144693 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.191841 0.058343 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.250618 0.286885 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.537951 0.179452 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.717839 0.170050 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.888310 0.067597 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:27.956346 0.223623 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:28.180570 0.352469 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:28.533451 0.045949 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:28.579887 0.169394 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:28.749663 0.241533 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:28.991630 0.165881 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.157969 0.201833 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.360151 0.206826 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.567409 0.113876 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.681734 0.174322 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.856531 0.091115 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:34:29.948020 0.230390 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/20 15:38:52.942839 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:38:59.949275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:39:07.951508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:39:23.954529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:39:55.960435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:46:11.974626 3.000605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:46:18.981313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:46:26.983224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:46:42.986265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:47:14.991856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:53:18.997997 3.002375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 15:53:26.492456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:53:34.403909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:53:50.229917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:54:22.026836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 15:54:31.640584 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 15:54:31.640694 1.136795 tcp 10.0.2.105 56456 -> 128.255.183.224 9027 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:00:26.031821 3.001446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:00:33.038838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:00:41.040009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:00:57.044705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:01:29.110492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:04:49.037464 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 16:04:49.037566 0.056385 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.094385 0.148797 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.243658 0.040906 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.285050 0.121922 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.407431 0.168691 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.576716 0.175450 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.752501 0.078698 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.831625 0.130006 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:49.962058 0.075599 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.038035 0.151959 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.190430 0.054081 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.244893 0.294358 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.539655 0.180466 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.720547 0.171327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.892319 0.060247 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:50.952958 0.219092 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:51.172549 0.170964 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:51.343944 0.230212 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:51.574548 0.161372 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:51.736449 0.406979 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.143822 0.038734 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.183015 0.270871 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.513716 0.239626 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.753725 0.063939 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.818102 0.171365 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:52.989877 0.088877 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:04:53.079175 0.229936 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:07:35.069899 2.999999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:07:42.075830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:07:50.077280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:08:06.080551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:08:38.086680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:14:42.094344 2.999579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:14:49.099683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:14:57.101742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:15:13.105142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:15:45.110573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:21:49.118218 3.003725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:21:56.124793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:22:04.125585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:22:20.128437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:22:52.134713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:24:32.780354 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 16:24:32.780453 1.333976 tcp 10.0.2.105 56457 -> 128.255.183.224 9027 FSPA* 0 0 12 1550 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:28:56.139782 3.003906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:29:03.150181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:29:11.149483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:29:27.233102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:29:59.168855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:35:21.433889 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 16:35:21.434177 0.056917 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:21.491527 0.147979 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:21.639932 0.040540 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:21.680905 0.122104 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:21.803445 0.161074 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:21.965014 0.180331 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.145718 0.080104 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.226267 0.139661 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.366749 0.079378 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.446583 0.151710 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.598671 0.054806 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.653867 0.298060 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:22.952279 0.181531 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:23.134227 0.171364 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:23.306042 0.068980 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:23.375385 0.000000 udp 10.0.2.105 7010 -> 190.84.240.16 2537 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 16:35:41.242398 0.031422 tcp 10.0.2.105 56458 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:35:41.274148 0.053989 tcp 10.0.2.105 56459 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:35:41.328473 0.128020 tcp 10.0.2.105 56460 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:35:41.456013 0.165089 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:41.621543 0.338810 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:41.960816 0.045637 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:42.006886 0.173437 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:42.180812 0.248098 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:42.429311 0.174201 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:42.603894 0.338368 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:42.942703 0.071630 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:43.014771 0.170596 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:43.185732 0.087434 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:35:43.273678 0.216992 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/20 16:36:03.175446 3.000585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:36:10.183661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:36:18.183177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:36:34.188469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:37:06.192898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:44:42.200210 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:44:49.207914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:44:57.209508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:45:13.213199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:45:45.221159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:52:05.228990 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:52:12.237107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:52:20.236666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:52:36.240567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:53:08.245639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:54:34.119464 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 16:54:34.119645 1.066531 tcp 10.0.2.105 56461 -> 128.255.183.224 9027 FSPA* 0 0 12 1473 flow=From-Botnet-V2-TCP-Established 1970/01/20 16:59:12.251883 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 16:59:19.259136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:59:27.260624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 16:59:43.264365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:00:15.269485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:06:13.807582 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 17:06:13.807774 0.214233 udp 10.0.2.105 7010 -> 190.84.240.16 2537 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 17:06:14.022007 0.000000 icmp 190.84.240.16 0x0303 -> 10.0.2.105 0xe909 URP 192 1 251 flow=Background 1970/01/20 17:06:19.277057 3.000033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:06:26.283225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:06:32.515056 0.031517 tcp 10.0.2.105 56462 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 17:06:32.546871 0.031986 tcp 10.0.2.105 56463 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 17:06:32.579175 0.112533 tcp 10.0.2.105 56464 -> 195.113.214.236 443 SRPA* 0 0 91 70287 flow=From-Botnet-V2-TCP-Established 1970/01/20 17:06:32.695257 0.042980 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:32.738698 0.120964 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:32.860057 0.164531 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.025022 0.169320 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.194774 0.081704 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.276910 0.056778 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.334114 0.147937 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.482455 0.137953 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.620830 0.056327 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.677544 0.298388 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:33.976502 0.181594 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.158509 0.076334 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.235277 0.141311 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.284681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:06:34.376951 0.171442 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.548824 0.061273 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.610544 0.044732 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.655750 0.254312 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:34.910447 0.206107 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:35.116912 0.336742 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:35.454102 0.224577 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:35.679092 0.197101 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:35.876652 0.302746 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:36.179826 0.093538 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:36.273818 0.171276 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:36.445501 0.087945 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:36.533848 0.232842 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:06:50.288967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:07:22.295196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:13:26.301118 3.001957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:13:33.307783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:13:41.310996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:13:57.315255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:14:29.317391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:20:33.325878 3.000442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:20:40.332560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:20:48.472893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:21:04.346603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:21:36.352447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:24:35.189380 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 17:24:35.189489 1.565158 tcp 10.0.2.105 56465 -> 128.255.183.224 9027 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/20 17:27:40.357569 3.001631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:27:47.367019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:27:55.369168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:28:11.369329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:28:43.376077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:34:47.382734 3.000197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:34:54.388675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:35:02.390534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:35:18.394251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:35:50.399504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:36:46.251290 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 17:36:46.251479 0.164492 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.416437 0.180273 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.597066 0.039584 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.637043 0.117726 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.755116 0.078213 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.834100 0.058586 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:46.893137 0.155354 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.048980 0.137822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.187158 0.053585 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.241147 0.303375 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.544960 0.174106 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.719428 0.074474 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.794294 0.132150 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:47.926804 0.170477 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.097672 0.071312 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.169395 0.039419 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.209182 0.171053 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.380615 0.161609 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.542666 0.239681 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:48.782789 0.389091 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:49.172321 0.258301 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:49.431014 0.339585 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:49.771061 0.222814 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:49.994273 0.228684 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:50.223404 0.172512 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:36:50.396395 0.090523 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/20 17:41:54.405775 3.001323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:42:01.413766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:42:09.414632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:42:25.417647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:42:57.423548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:49:01.432151 2.999143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:49:08.437096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:49:16.438128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:49:32.441594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:50:04.447270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:54:36.759351 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 17:54:36.759444 1.010600 tcp 10.0.2.105 56466 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/20 17:56:10.457436 3.000681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 17:56:17.469126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:56:25.465449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:56:41.467951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 17:57:13.473937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:03:17.480566 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:03:24.488292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:03:32.489108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:03:48.491856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:04:20.498110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:07:12.500484 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 18:07:12.500592 0.293776 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:12.794831 0.227155 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.022430 0.054332 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.077213 0.120853 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.198570 0.082561 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.281631 0.057007 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.339124 0.143654 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.483241 0.151850 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.635503 0.052805 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.688782 0.295731 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:13.984978 0.176714 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.162170 0.072194 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.234785 0.131469 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.366721 0.171912 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.539088 0.062591 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.602151 0.044238 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.646846 0.226460 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:14.873756 0.261481 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:15.135696 0.167121 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:15.303287 0.160699 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:15.464418 0.063804 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:15.528669 0.343392 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:15.872523 0.917159 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:16.790119 0.245244 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:17.035813 0.171892 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:07:17.208120 0.090812 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:10:24.515065 2.992730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:10:31.512676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:10:39.514968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:10:55.516650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:11:27.524562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:17:31.530259 3.001017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:17:38.535282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:17:46.541101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:18:02.553655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:18:34.546151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:24:37.768611 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 18:24:37.768751 1.517242 tcp 10.0.2.105 56467 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/20 18:24:38.553082 3.000574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:24:45.559246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:24:53.562606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:25:09.564085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:25:41.570793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:31:45.576522 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:31:52.583302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:32:00.585206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:32:16.588164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:32:48.593844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:37:33.253869 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 18:37:33.253977 0.040461 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.294860 0.119866 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.415105 0.076897 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.492533 0.208319 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.701202 0.183706 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.885312 0.058241 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:33.943994 0.143559 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.087980 0.144979 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.233360 0.059407 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.293127 0.297542 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.591053 0.178964 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.770445 0.076046 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.846897 0.130458 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:34.977840 0.172590 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.150811 0.069600 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.220828 0.040815 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.262076 0.218885 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.481384 0.237442 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.719167 0.059596 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:35.779135 0.335438 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:36.115010 0.169902 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:36.285307 0.160223 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:36.445999 0.168435 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:36.614886 0.243260 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:36.858611 0.224040 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:37:37.083058 0.090961 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 18:38:52.601345 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:38:59.609112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:39:07.609497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:39:23.614780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:39:55.617808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:46:14.626247 3.000263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:46:21.632917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:46:29.634579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:46:45.638076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:47:17.643434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:53:21.651799 3.000369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 18:53:28.656719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:53:36.658167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:53:52.661667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:54:24.667459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 18:54:39.289433 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 18:54:39.289534 0.999322 tcp 10.0.2.105 56468 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:00:28.678102 2.997129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:00:35.680804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:00:43.682712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:00:59.685139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:01:31.692327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:07:37.700691 3.001981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:07:38.069363 0.000176 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 19:07:38.069641 0.073971 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:38.144056 0.217421 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:38.361904 0.165864 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:38.528200 0.061965 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:38.590608 0.531966 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:39.123005 0.144954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:39.268572 0.044026 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:39.313006 0.120498 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:39.433946 0.058563 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:39.492970 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 19:07:44.707402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:07:52.712533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:07:56.099497 0.030731 tcp 10.0.2.105 56469 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:07:56.130602 0.033020 tcp 10.0.2.105 56470 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:07:56.163922 0.188204 tcp 10.0.2.105 56471 -> 195.113.214.236 443 SRPA* 0 0 23 12062 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:07:56.352854 0.178579 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:56.531846 0.084581 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:56.616899 0.129415 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:56.746788 0.170086 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:56.917263 0.064049 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:56.981751 0.040477 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:57.022676 0.063591 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:57.086708 0.338724 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:57.425847 0.268187 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:57.694424 0.219316 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:57.914178 0.171242 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:58.085879 0.166517 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:58.252814 0.173028 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:58.426232 0.241101 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:58.667762 0.227658 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:07:58.895778 0.092150 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:08:08.713338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:08:40.719369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:14:44.725926 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:14:51.731385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:14:59.733079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:15:15.736919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:15:47.742520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:21:51.751316 2.999299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:21:58.760642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:22:06.757914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:22:22.760202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:22:54.766064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:24:40.290502 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 19:24:40.290604 1.018487 tcp 10.0.2.105 56472 -> 128.255.183.224 9027 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:28:58.772323 3.001535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:29:05.779638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:29:13.781064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:29:29.785187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:30:01.790320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:36:05.796544 3.000593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:36:12.802996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:36:20.805424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:36:36.809759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:37:08.814286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:37:59.717266 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 19:37:59.717368 0.296531 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:00.014361 0.073409 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:00.088387 0.067724 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:00.173480 0.145469 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:00.319418 0.673443 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:00.993301 0.144843 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.138592 0.164723 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.303779 0.118027 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.422162 0.040246 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.462836 0.058796 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.522064 0.181215 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.703644 0.076022 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.780113 0.132896 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:01.913868 0.169848 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.084150 0.082862 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.167429 0.039710 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.207549 0.063344 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.271386 0.363726 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.635545 0.256996 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:02.892968 0.208516 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:03.101847 0.185602 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:03.287843 0.166250 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:03.454502 1.612159 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:05.067095 0.091322 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:05.158861 0.168935 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:38:05.328193 0.242446 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/20 19:44:44.822336 3.002839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:44:51.829712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:44:59.831291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:45:15.834546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:45:47.840761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:52:06.848134 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:52:13.855378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:52:21.856766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:52:37.859678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:53:09.865509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:54:41.307858 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 19:54:41.308167 1.285560 tcp 10.0.2.105 56473 -> 128.255.183.224 9027 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/01/20 19:59:13.872910 3.000591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 19:59:20.879079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:59:28.881192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 19:59:44.884676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:00:16.890186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:06:20.899541 2.998214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:06:27.903125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:06:35.904768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:06:51.913520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:07:23.913482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:08:18.603226 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 20:08:18.603474 0.060332 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:18.664414 0.299502 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:18.964458 0.084243 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.049083 0.144902 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.194454 0.143454 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.338351 0.162481 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.501227 0.156258 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.657944 0.122573 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.780964 0.054177 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.835583 0.058774 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:19.894744 0.179628 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.074808 0.072848 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.148073 0.135477 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.283921 0.173220 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.457573 0.064353 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.522325 0.045861 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.568593 0.059445 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.628440 0.218043 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:20.846875 0.189425 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:21.036704 0.335483 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:21.372637 0.245376 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:21.621153 0.166461 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:21.788056 0.242862 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:22.031275 0.088915 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:22.120719 0.172436 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:08:22.293596 0.230414 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:13:27.930226 3.002433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:13:34.937237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:13:42.938753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:13:58.941722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:14:30.948046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:20:34.955430 3.000721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:20:41.961874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:20:49.963118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:21:05.967420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:21:37.971891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:24:42.598495 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 20:24:42.598604 0.946099 tcp 10.0.2.105 56474 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/20 20:27:41.977503 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:27:48.985817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:27:56.986648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:28:12.989780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:28:44.995760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:34:49.003188 3.000131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:34:56.010812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:35:04.011302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:35:20.013029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:35:52.019360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:38:40.162152 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 20:38:40.162261 0.089035 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:40.251779 0.144934 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:40.397187 0.060187 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:40.457830 0.302701 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:40.760976 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/20 20:38:55.956433 0.055103 tcp 10.0.2.105 56475 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/20 20:38:56.011856 0.054329 tcp 10.0.2.105 56476 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/20 20:38:56.066020 0.149591 tcp 10.0.2.105 56477 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/20 20:38:56.216172 0.301628 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:56.518157 0.155974 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:56.674523 0.128382 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:56.803352 0.040501 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:56.844250 0.058828 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:56.903516 0.181277 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.085222 0.075207 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.169350 0.133417 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.303233 0.170675 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.474334 0.067313 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.542109 0.040610 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.583197 0.059003 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.642649 0.205021 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:57.848108 0.184385 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:58.032949 0.162599 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:58.195916 0.226522 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:58.422932 0.090260 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:58.513618 0.168554 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:58.682604 0.341330 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:59.024386 0.191063 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:38:59.215894 0.242397 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/20 20:41:56.028398 2.999082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:42:03.032910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:42:11.034638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:42:27.037439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:42:59.043744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:49:03.051632 2.999830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:49:10.057809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:49:18.059115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:49:34.061619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:50:06.068537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:54:43.546880 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 20:54:43.546986 1.112383 tcp 10.0.2.105 56478 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/20 20:56:10.073877 3.002557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 20:56:17.081593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:56:25.082526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:56:41.085529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 20:57:13.091608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:03:17.098459 3.000622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:03:24.105067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:03:32.106836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:03:48.109873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:04:20.118674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:09:18.024130 0.192954 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 21:09:18.217221 0.145937 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:18.363540 0.083317 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:18.447282 0.059428 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:18.507131 0.137779 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:18.645288 0.290077 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:18.935747 0.260489 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.196740 0.155904 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.353007 0.182868 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.536339 0.047861 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.584651 0.058772 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.643839 0.176736 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.821006 0.073923 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:19.895380 0.134137 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.029952 0.171328 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.201660 0.074412 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.276535 0.046627 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.323606 0.065507 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.389493 0.205579 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.595479 0.223616 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.819560 0.166892 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:20.986913 0.171923 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:21.159282 0.399430 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:21.559173 0.308459 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:21.868003 0.231336 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:22.099779 0.093382 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:09:22.193591 0.256142 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:10:24.122622 3.000860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:10:31.128755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:10:39.130679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:10:55.133663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:11:27.149459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:17:31.156699 3.002571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:17:38.164355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:17:46.164421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:18:02.167563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:18:34.173326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:24:38.179542 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:24:44.666591 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 21:24:44.666689 1.043122 tcp 10.0.2.105 56479 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/20 21:24:45.187565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:24:53.190657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:25:09.191329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:25:41.199333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:31:45.215557 2.999458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:31:52.220552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:32:00.222576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:32:16.225893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:32:48.392518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:38:52.249962 2.999307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:38:59.256778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:39:07.256180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:39:23.259213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:39:45.471519 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 21:39:45.471711 0.145658 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:45.617778 0.081298 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:45.699515 0.296319 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:45.996264 0.361676 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:46.358376 0.340708 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:46.699514 0.059048 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:46.758960 0.137737 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:46.897200 0.120839 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.018406 0.041421 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.060220 0.059226 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.119804 0.179997 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.300208 0.074164 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.374784 0.133732 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.508972 0.172049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.681376 0.068579 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.750348 0.040166 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.790922 0.063657 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:47.855002 0.167490 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:48.022976 0.171893 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:48.195373 0.206067 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:48.401853 0.172808 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:48.574993 0.339881 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:48.915271 0.195717 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:49.111387 0.248195 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:49.359991 0.090880 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:49.451271 0.917448 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/20 21:39:55.265419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:46:11.279285 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:46:18.287190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:46:26.288046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:46:42.291130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:47:14.296461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:53:18.304848 2.999676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 21:53:25.310067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:53:33.311729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:53:49.314562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:54:21.320763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 21:54:45.716905 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 21:54:45.717018 1.289644 tcp 10.0.2.105 56480 -> 128.255.183.224 9027 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/01/20 22:00:25.327438 3.001275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:00:32.333938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:00:40.335755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:00:56.338709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:01:28.344099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:07:33.351614 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:07:40.359937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:07:48.362683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:08:04.363924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:08:36.370798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:10:20.299830 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 22:10:20.571797 0.297817 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:20.870028 0.182995 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.053415 0.073521 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.127323 0.162918 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.290669 0.459946 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.751056 0.060191 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.811751 0.151889 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:21.964057 0.120790 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.085247 0.047293 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.132894 0.059984 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.193264 0.181994 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.375670 0.077845 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.453921 0.135722 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.590028 0.170374 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.760833 0.063511 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.824762 0.039749 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.864934 0.058895 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:22.924489 0.162931 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:23.087861 0.170790 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:23.259090 0.354703 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:23.614190 0.218271 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:23.832844 0.204824 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:24.038106 0.165240 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:24.203768 0.225476 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:24.429715 0.091891 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:10:24.522002 0.272824 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:14:40.376835 3.005214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:14:47.383257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:14:55.385359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:15:11.387903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:15:43.393950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:21:47.401520 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:21:54.407566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:22:02.408504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:22:18.411923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:22:50.418336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:24:47.006287 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 22:24:47.006393 1.123874 tcp 10.0.2.105 56481 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/20 22:28:54.425593 2.999915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:29:01.431280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:29:09.433202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:29:25.436184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:29:57.630010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:36:01.459898 2.999872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:36:08.465227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:36:16.467167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:36:32.469533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:37:04.475830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:40:49.440487 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 22:40:49.440597 0.110307 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:49.551346 0.161624 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:49.713441 0.281747 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:49.995636 0.161066 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.157127 0.192264 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.349861 0.060150 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.410453 0.151911 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.562789 0.119730 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.682901 0.041932 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.725232 0.066730 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.792383 0.181086 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:50.973900 0.069630 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.043921 0.135651 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.180039 0.170755 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.351197 0.066850 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.418484 0.046580 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.465515 0.063833 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.529817 0.167561 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.697771 0.171452 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:51.869655 0.223348 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:52.093435 0.167333 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:52.261194 0.343293 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:52.604902 0.209031 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:52.814382 0.240001 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:53.054733 0.211086 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:40:53.266198 0.091864 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/20 22:44:40.484420 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:44:47.492792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:44:55.493374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:45:11.495834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:45:43.599587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:52:02.530041 3.002452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:52:09.603335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:52:17.548633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:52:33.551733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:53:05.557614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:54:48.135842 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 22:54:48.135940 1.650594 tcp 10.0.2.105 56482 -> 128.255.183.224 9027 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/01/20 22:59:09.563630 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 22:59:16.571479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:59:24.572659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 22:59:40.575761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:00:12.581717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:06:16.587343 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:06:23.594957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:06:31.596807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:06:47.599339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:07:19.606787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:10:57.699975 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 23:10:57.700154 0.287200 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:57.987763 0.145955 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.134181 0.075622 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.210267 0.354465 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.565173 0.154869 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.720561 0.057307 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.778262 0.152057 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:58.930771 0.120073 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.051659 0.044062 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.096070 0.061967 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.158470 0.182179 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.341079 0.073177 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.414710 0.131691 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.546829 0.199822 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.747022 0.059750 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.807216 0.040343 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.847918 0.060228 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:10:59.909116 0.165938 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:00.075542 0.172755 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:00.248757 0.205880 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:00.454974 0.165327 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:00.620733 0.231256 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:00.852372 0.254532 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:01.107378 0.359083 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:01.466828 0.254225 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:11:01.721462 0.091429 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:13:23.611733 3.001714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:13:30.619653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:13:38.620630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:13:54.624482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:14:26.629640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:20:30.637204 3.000197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:20:37.643013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:20:45.645733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:21:01.651304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:21:33.653438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:24:49.786069 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 23:24:49.786180 1.165249 tcp 10.0.2.105 56483 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/20 23:27:37.662944 2.998666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:27:44.667411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:27:52.668073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:28:08.671432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:28:40.677224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:34:44.684113 3.000737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:34:51.690760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:34:59.692446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:35:15.695423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:35:47.701594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:41:06.159639 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 23:41:06.159864 0.511634 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:06.671919 0.294468 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:06.966798 0.143636 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.110867 0.367290 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.478600 0.152658 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.631721 0.061517 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.693699 0.152228 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.846365 0.120882 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:07.967680 0.042448 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.010573 0.063236 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.074191 0.181927 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.256545 0.196807 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.453761 0.134233 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.588475 0.172236 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.761109 0.064794 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.826323 0.038805 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.865498 0.059117 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:08.925022 0.192900 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:09.118341 0.172276 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:09.291044 0.246969 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:09.538459 0.214751 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:09.753700 0.205501 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:09.959617 0.165680 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:10.125736 0.090182 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:10.216424 0.338278 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:10.555067 0.285032 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/20 23:41:51.710267 2.998414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:41:58.714944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:42:06.716566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:42:22.719277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:42:54.725356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:48:58.736161 2.996956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:49:05.738944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:49:13.740048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:49:29.746708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:50:01.749465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:54:50.955799 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/20 23:54:50.956059 1.186573 tcp 10.0.2.105 56484 -> 128.255.183.224 9027 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/01/20 23:56:09.763182 2.999636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/20 23:56:16.768720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:56:24.780491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:56:40.783171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/20 23:57:12.788706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:03:17.797327 3.000356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:03:24.803898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:03:32.805463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:03:48.808605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:04:20.814065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:10:24.820692 3.001451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:10:31.827829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:10:39.829395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:10:55.832674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:11:27.838673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:11:31.315070 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 00:11:31.315179 0.144542 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:31.460122 0.340384 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:31.800944 0.294545 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:32.095930 0.740031 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:32.836600 0.153341 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:32.990369 0.061633 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.052619 0.151910 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.204956 0.124190 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.329611 0.041056 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.371115 0.061789 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.433350 0.181975 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.615698 0.133454 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.749538 0.129494 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:33.879395 0.170329 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.050059 0.065973 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.116423 0.045665 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.162567 0.224805 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.387891 0.168943 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.557198 0.172145 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.729772 0.205819 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:34.935988 0.165487 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:35.101925 0.090743 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:35.193087 0.224202 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:35.417651 0.215761 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:35.633855 0.345076 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:11:35.979362 0.178826 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:17:31.847080 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:17:38.854576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:17:46.852890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:18:02.860487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:18:34.862805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:24:38.868677 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:24:45.875901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:24:52.145429 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 00:24:52.145740 1.033984 tcp 10.0.2.105 56485 -> 128.255.183.224 9027 FSPA* 0 0 12 1486 flow=From-Botnet-V2-TCP-Established 1970/01/21 00:24:53.877165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:25:09.880952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:25:41.887049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:31:45.893738 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:31:52.900888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:32:00.901338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:32:16.904857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:32:48.910088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:38:52.916931 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:38:59.923777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:39:07.925752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:39:23.928236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:39:55.934750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:41:44.581618 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 00:41:44.581740 0.289282 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:44.871511 0.146086 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.017969 0.071425 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.089748 0.055382 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.145634 0.152054 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.146121 2.999122 tcp 10.0.2.105 56486 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 00:41:45.298122 0.424163 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.722734 0.154761 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.877963 0.119515 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:45.997933 0.040845 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.039195 0.059571 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.099205 0.181524 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.281177 0.071436 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.353047 0.128632 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.482126 0.171735 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.654361 0.064416 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.719126 0.039980 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:46.759555 1.123282 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:47.883255 0.165621 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:48.049325 0.171399 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:48.221110 0.207474 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:48.428947 0.166390 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:48.595763 0.091325 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:48.687464 0.362736 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:49.050633 0.178154 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:49.229147 0.238555 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:49.468151 0.215712 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 00:41:54.144198 0.000000 tcp 10.0.2.105 56486 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 00:46:13.943182 2.999408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:46:21.015424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:46:28.959347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:46:44.962961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:47:16.968329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:53:20.975237 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 00:53:27.982053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:53:35.983330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:53:51.986413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:54:23.993202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 00:54:53.187965 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 00:54:53.188071 2.310058 tcp 10.0.2.105 56487 -> 128.255.183.224 9027 FSPA* 0 0 12 1612 flow=From-Botnet-V2-TCP-Established 1970/01/21 01:00:28.019146 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:00:35.025859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:00:43.027786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:00:59.030493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:01:31.036531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:07:37.047234 3.000609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:07:44.053100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:07:52.056715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:08:08.058879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:08:40.063396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:12:03.566164 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 01:12:03.566275 0.073154 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:03.639873 0.060538 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:03.700930 0.151880 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:03.701436 2.999064 tcp 10.0.2.105 56488 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 01:12:03.853189 0.301820 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:04.155384 0.148007 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:04.426854 0.677316 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:05.104700 3.883640 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:08.988716 0.160210 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.149339 0.038889 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.188700 0.062115 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.251213 0.182053 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.433723 0.073617 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.507748 0.136703 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.644864 0.170587 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.815831 0.060918 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.877168 0.044789 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:09.922317 0.173284 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:10.096020 0.264052 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:10.360621 0.164397 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:10.525466 0.206506 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:10.732567 0.222487 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:10.955463 0.090099 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:11.045947 0.393349 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:11.439732 0.221605 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:11.661788 0.250288 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:11.912600 0.219707 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:12:12.698522 0.000000 tcp 10.0.2.105 56488 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 01:14:44.080025 3.001144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:14:51.086061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:14:59.087742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:15:15.091881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:15:47.098026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:21:51.103512 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:21:58.110873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:22:06.112011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:22:22.115304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:22:54.121415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:24:54.584915 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 01:24:54.585021 0.990442 tcp 10.0.2.105 56489 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/21 01:28:58.127355 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:29:05.134168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:29:13.136534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:29:29.142514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:30:01.145355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:36:05.151656 3.001110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:36:12.158040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:36:20.159951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:36:36.163776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:37:08.169015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:42:13.118539 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 01:42:13.118648 0.151937 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:13.271177 0.296871 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:13.271792 3.345588 tcp 10.0.2.105 56490 -> 128.255.183.224 9027 FSPA* 0 0 471 514232 flow=From-Botnet-V2-TCP-Established 1970/01/21 01:42:13.568543 0.077136 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:13.646095 0.060791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:13.707332 0.218811 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:13.926532 0.919062 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:14.845941 0.041469 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:14.887778 0.059418 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:14.947561 3.924768 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:18.872768 0.122204 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:18.995443 0.179634 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.175491 0.075375 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.251274 0.133402 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.385138 0.170567 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.556085 0.063128 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.619621 0.039641 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.659662 0.170981 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:19.831073 1.818217 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:21.649683 0.166933 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:21.817033 0.206520 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:22.023947 0.167258 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:22.191709 0.097794 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:22.289854 0.236075 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:22.526288 0.235366 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:22.762095 0.495113 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:42:23.257597 0.287758 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 01:44:44.178415 3.000364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:44:51.184418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:44:59.186929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:45:15.189398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:45:47.195597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:51:58.202570 3.000499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:52:05.209421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:52:13.407584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:52:29.263299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:53:01.229575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:54:55.574512 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 01:54:55.574637 1.138335 tcp 10.0.2.105 56491 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/21 01:59:05.236673 3.000442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 01:59:12.242818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:59:20.245285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 01:59:36.247369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:00:08.253658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:06:12.260215 3.000686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:06:19.266820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:06:27.269177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:06:43.271378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:07:15.279421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:12:49.430032 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 02:12:49.430142 0.153623 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:49.584231 0.056151 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:49.640833 0.146586 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.000702 0.312424 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.313510 0.072152 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.386033 0.191539 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.577990 0.040130 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.618559 0.062991 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:12:50.681997 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 02:13:09.418674 0.054168 tcp 10.0.2.105 56492 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:13:09.473148 0.057977 tcp 10.0.2.105 56493 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:13:09.531443 0.137841 tcp 10.0.2.105 56494 -> 195.113.214.236 443 SRPA* 0 0 54 47505 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:13:09.669870 0.069385 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:09.739687 3.896753 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:13.636808 0.120408 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:13.757576 0.131429 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:13.889442 0.171577 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.061422 0.064618 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.126489 0.045832 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.172721 0.173757 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.346875 0.060089 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.407383 0.164782 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.572738 0.205364 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.778446 0.165070 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:14.943963 0.089803 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:15.034233 0.884162 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:15.918789 0.243066 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:16.162247 0.216690 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:16.379369 0.207761 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:13:19.285424 2.999716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:13:26.291617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:13:34.292259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:13:50.295204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:14:22.307201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:20:26.308494 3.001285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:20:33.315038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:20:41.316090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:20:57.322189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:21:29.325254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:24:56.713444 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 02:24:56.713523 0.980103 tcp 10.0.2.105 56495 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:27:33.331578 3.002455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:27:40.338757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:27:48.340080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:28:04.343246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:28:36.349429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:34:40.355033 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:34:47.362625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:34:55.363783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:35:11.367242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:35:43.374792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:41:47.380198 3.000853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:41:54.387114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:42:02.388241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:42:18.391010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:42:50.593242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:43:43.273527 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 02:43:43.273815 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 02:43:58.968355 0.060401 tcp 10.0.2.105 56496 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:43:59.029077 0.061099 tcp 10.0.2.105 56497 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:43:59.090370 0.149586 tcp 10.0.2.105 56498 -> 195.113.214.236 443 SRPA* 0 0 41 35210 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:43:59.240683 0.249002 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:43:59.490123 0.151564 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:43:59.642113 0.057111 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:43:59.699676 0.297884 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:43:59.998025 0.041218 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:00.039607 0.060842 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:00.100907 0.072089 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:00.173370 0.302781 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:00.476599 0.069282 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:00.546267 3.512006 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.058725 0.121025 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.180127 0.132846 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.313394 0.170717 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.484463 0.066488 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.551411 0.222005 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.773843 0.173160 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:04.947432 0.410600 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:05.358474 0.164404 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:05.523315 0.206334 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:05.749102 0.166521 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:05.916094 0.091467 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:06.007999 0.424267 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:06.432640 0.182927 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:06.615951 0.244433 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:44:06.860831 0.215705 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 02:48:54.414805 3.000080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:49:01.420868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:49:09.422898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:49:25.424815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:49:57.431311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:54:57.693732 0.000221 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 02:54:57.694367 1.015109 tcp 10.0.2.105 56499 -> 128.255.183.224 9027 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/01/21 02:56:01.438071 3.001102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 02:56:08.444198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:56:16.445980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:56:32.449126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 02:57:04.455283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:03:08.462101 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:03:15.469312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:03:23.470241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:03:39.473097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:04:11.480135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:10:15.486904 3.000796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:10:22.494180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:10:30.494301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:10:46.498134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:11:18.502667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:14:16.219058 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 03:14:16.219330 0.753699 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:16.973490 0.151726 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.125622 0.058374 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.184430 0.163742 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.348609 0.043437 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.392536 0.060589 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.453519 0.073070 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.527045 0.287709 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.815235 0.111577 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:17.927266 3.720225 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:21.693898 0.120928 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:21.815279 0.133545 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:21.949225 0.173783 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.123464 0.065566 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.189481 0.045168 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.235135 0.163226 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.398723 0.170087 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.569212 0.426027 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:22.995787 0.209525 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:23.205727 0.162919 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:23.369047 0.092249 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:23.461696 0.236678 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:23.698784 0.347547 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:24.046766 0.226415 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:14:24.273529 0.216114 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:17:22.512095 3.000482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:17:29.521798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:17:37.518259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:17:53.521140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:18:25.527038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:24:29.533270 3.001252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:24:36.540524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:24:44.541734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:24:58.713518 0.000226 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 03:24:58.713855 1.580568 tcp 10.0.2.105 56500 -> 128.255.183.224 9027 FSPA* 0 0 12 1598 flow=From-Botnet-V2-TCP-Established 1970/01/21 03:25:00.546364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:25:32.551527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:31:36.557100 3.002108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:31:43.564768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:31:51.565714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:32:07.568489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:32:39.574993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:38:43.581361 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:38:50.588610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:38:58.590223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:39:14.594762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:39:46.599086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:44:28.386620 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 03:44:28.386720 0.154689 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:28.541841 0.151792 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:28.694087 0.059287 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:28.753831 0.162016 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:28.916264 0.042738 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:28.959432 0.059339 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:29.019245 0.083109 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:29.102712 0.301416 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:29.404694 0.072320 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:29.477395 3.764683 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:33.242511 0.120754 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:33.363659 0.135848 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:33.499935 0.170443 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:33.670727 0.161714 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:33.832822 0.179918 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.013123 0.067416 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.081003 0.065258 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.146630 0.045983 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.193032 0.206182 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.399649 0.163502 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.563486 0.089814 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.653682 0.247491 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:34.901592 0.357355 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:35.259352 0.184444 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:44:35.444227 0.220031 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/21 03:46:07.609496 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:46:14.619018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:46:22.618113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:46:38.621582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:47:10.632873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:53:14.634645 2.999954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 03:53:21.642768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:53:29.642205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:53:45.645398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:54:17.661424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 03:55:00.293849 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 03:55:00.293964 0.934776 tcp 10.0.2.105 56501 -> 128.255.183.224 9027 FSPA* 0 0 12 1513 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:00:21.669192 2.999662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:00:28.674113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:00:36.676152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:00:52.678669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:01:24.686063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:07:28.692722 3.003395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:07:35.698780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:07:43.699789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:07:59.710867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:08:31.709097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:14:35.717960 2.999745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:14:37.697023 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 04:14:37.697134 0.057503 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:37.755081 0.140546 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:37.896503 0.120327 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.017213 0.163817 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.181491 0.095872 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.277747 0.059822 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.338011 0.077589 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.415956 0.296826 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.713201 0.079971 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:38.793666 3.678414 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:42.472682 0.145931 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:42.619064 0.128497 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:42.723405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:14:42.747994 0.172404 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:42.920828 0.167361 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:43.088739 0.172797 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:43.089272 2.998947 tcp 10.0.2.105 56502 -> 99.135.106.151 6166 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 04:14:43.261904 0.640803 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:43.903143 0.059905 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:43.963475 0.046025 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:44.009925 0.206672 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:44.217029 0.165130 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:44.382596 0.087979 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:44.470922 0.896744 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:45.368085 0.365636 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:45.734111 0.250626 udp 10.0.2.105 7010 <-> 107.197.113.244 4344 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:45.985160 0.231789 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:14:50.724053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:14:52.095710 0.000000 tcp 10.0.2.105 56502 -> 99.135.106.151 6166 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/21 04:15:06.727711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:15:38.733527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:21:42.740089 3.000676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:21:49.747413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:21:57.747972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:22:13.751189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:22:45.756968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:25:01.232258 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 04:25:01.232364 0.982566 tcp 10.0.2.105 56503 -> 128.255.183.224 9027 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:28:49.773490 3.001451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:28:56.780855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:29:04.782033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:29:20.784689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:29:52.893275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:35:56.807514 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:36:03.816818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:36:11.815907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:36:27.819166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:36:59.825897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:44:36.834962 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:44:43.842209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:44:51.846884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:44:53.648786 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 04:44:53.648896 0.120607 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:53.769997 0.058997 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:53.770430 2.664301 tcp 10.0.2.105 56504 -> 128.255.183.224 9027 FSPA* 0 0 474 517145 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:44:53.829444 0.147052 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:53.976857 0.163681 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.141005 0.043551 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.184970 0.059112 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.244664 0.077139 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.322219 0.314127 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.636806 0.074455 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:54.711701 3.839747 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:58.551878 0.120789 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:58.673147 0.131974 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:58.805549 0.183275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:58.989207 0.166646 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.156275 0.065462 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.222121 0.039358 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.261908 0.187391 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.449700 0.187745 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.637883 0.207565 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:44:59.845888 0.166888 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:45:00.013244 0.088687 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:45:00.102265 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 04:45:07.847518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:45:16.140407 0.056872 tcp 10.0.2.105 56505 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:45:16.197564 0.051814 tcp 10.0.2.105 56506 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:45:16.249229 0.127113 tcp 10.0.2.105 56507 -> 195.113.214.236 443 SRPA* 0 0 32 24687 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:45:16.377037 0.361721 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:45:16.739200 1.321097 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:45:18.060737 0.216424 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 04:45:39.855460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:51:50.858273 3.002328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:51:57.866144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:52:05.867839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:52:21.871494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:52:53.877224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:55:02.221844 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 04:55:02.221943 1.085035 tcp 10.0.2.105 56508 -> 128.255.183.224 9027 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/01/21 04:58:57.883744 3.003320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 04:59:04.890733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:59:12.892737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 04:59:28.894934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:00:00.902022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:06:04.907956 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:06:11.913921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:06:19.915536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:06:35.922767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:07:07.924960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:13:11.932689 3.001969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:13:18.938988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:13:26.939723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:13:42.942216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:14:14.949238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:15:33.171994 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:15:33.172417 0.000000 udp 10.0.2.105 7010 -> 107.197.113.244 4344 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:15:49.887084 0.055495 tcp 10.0.2.105 56509 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:15:49.942954 0.054527 tcp 10.0.2.105 56510 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:15:49.997849 0.140373 tcp 10.0.2.105 56511 -> 195.113.214.236 443 SRPA* 0 0 65 41567 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:15:50.136882 0.121032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.258272 0.076970 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.335607 0.039541 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.375521 0.061712 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.437603 0.078990 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.522285 0.176710 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.699408 0.261570 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:50.961336 0.069842 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:51.031565 0.305872 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:51.337928 4.295015 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:55.659485 0.171536 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:55.831437 0.165360 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:55.997137 0.065727 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.063245 0.046414 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.110065 0.159124 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.269583 0.135163 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.405241 0.169316 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.574989 0.064595 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.640009 0.204631 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:56.845093 0.289683 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:57.135165 0.091331 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:57.226881 0.680623 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:57.907905 1.178345 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.086728 0.221297 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.722876 0.120791 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.844101 0.056176 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.900779 0.047486 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.948870 0.047415 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:15:59.996844 0.076031 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:00.193973 0.209038 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:00.403596 0.163972 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:00.702000 0.071939 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:00.774400 0.307718 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:01.082697 4.030370 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.113709 0.171591 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.285851 0.166253 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.452841 0.053914 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.507339 0.047116 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.554921 0.168286 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.723760 0.139138 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:05.863449 0.172323 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:06.036341 0.673108 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:06.709975 0.209533 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:06.920061 0.160918 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:07.621746 0.699962 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:08.322131 0.084874 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:08.407431 1.354271 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:09.762272 0.220594 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:09.983646 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:14.731744 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:16:17.114379 0.000000 udp 10.0.2.105 7010 -> 194.121.246.177 1128 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:25.092037 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:31.413082 0.044752 udp 10.0.2.105 7010 <-> 81.138.16.80 1646 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:16:31.617678 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:38.082309 0.000000 udp 10.0.2.105 7010 -> 83.58.98.34 6534 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:42.963523 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:16:44.322711 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:51.062673 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:16:57.372132 0.000000 udp 10.0.2.105 7010 -> 95.226.156.186 6800 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:05.389926 0.000000 udp 10.0.2.105 7010 -> 176.221.167.25 1233 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:10.148502 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:17:13.196196 0.000000 udp 10.0.2.105 7010 -> 83.244.54.142 9435 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:19.348965 0.000000 udp 10.0.2.105 7010 -> 71.43.15.18 9376 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:27.335821 0.000000 udp 10.0.2.105 7010 -> 78.177.229.95 1062 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:34.440562 0.072992 udp 10.0.2.105 7010 -> 92.198.65.172 6016 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:34.513554 0.000000 icmp 92.198.65.172 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 210 flow=Background 1970/01/21 05:17:39.335324 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:17:42.603077 0.000000 udp 10.0.2.105 7010 -> 79.190.175.106 1603 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:47.842940 0.187162 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:17:48.158916 0.073991 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:17:48.623160 0.000000 udp 10.0.2.105 7010 -> 194.31.48.2 1236 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:17:57.138345 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:05.280496 0.000000 udp 10.0.2.105 7010 -> 41.133.220.75 6446 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:10.227501 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:18:14.233373 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:20.412833 0.000000 udp 10.0.2.105 7010 -> 90.200.117.193 8940 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:25.919878 0.000000 udp 10.0.2.105 7010 -> 50.84.63.126 9414 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:31.268734 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:36.234645 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:18:38.250098 0.000000 udp 10.0.2.105 7010 -> 108.178.66.206 9252 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:47.000675 0.000000 udp 10.0.2.105 7010 -> 79.8.187.208 7781 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:18:54.553008 0.000000 udp 10.0.2.105 7010 -> 188.10.150.150 1653 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:00.012484 0.000000 udp 10.0.2.105 7010 -> 93.193.155.13 7662 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:04.735978 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:19:06.521070 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:14.321059 0.000000 udp 10.0.2.105 7010 -> 79.1.161.67 3391 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:22.030226 0.000000 udp 10.0.2.105 7010 -> 212.55.218.171 2075 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:28.901359 0.000000 udp 10.0.2.105 7010 -> 67.79.80.108 8176 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:33.727946 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:19:36.804012 0.000000 udp 10.0.2.105 7010 -> 94.67.25.24 2026 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:44.412704 0.000000 udp 10.0.2.105 7010 -> 188.219.120.143 2766 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:53.397289 0.000000 udp 10.0.2.105 7010 -> 24.149.7.120 2642 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:19:58.234248 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:20:00.236998 0.000000 udp 10.0.2.105 7010 -> 212.147.28.196 4327 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:06.043684 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:14.857055 0.000000 udp 10.0.2.105 7010 -> 80.141.149.192 6064 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:18.958370 2.998418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 05:20:21.627098 0.000000 udp 10.0.2.105 7010 -> 95.230.10.88 1517 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:25.962097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:20:26.233787 0.000222 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:20:26.963911 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:33.073004 0.000000 udp 10.0.2.105 7010 -> 87.188.147.236 3885 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:33.963553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:20:40.774307 0.000000 udp 10.0.2.105 7010 -> 79.23.144.8 1226 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:48.474371 0.000000 udp 10.0.2.105 7010 -> 95.247.7.75 5995 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:20:49.967415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:20:53.231157 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:20:56.356911 0.000000 udp 10.0.2.105 7010 -> 79.53.181.245 6854 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:05.259963 0.000000 udp 10.0.2.105 7010 -> 79.112.224.197 3757 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:12.589465 0.000000 udp 10.0.2.105 7010 -> 173.162.113.118 9353 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:17.235893 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:21:17.607037 0.000000 udp 10.0.2.105 7010 -> 188.99.179.81 6131 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:21.972205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:21:26.539436 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1060 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:33.609356 0.000000 udp 10.0.2.105 7010 -> 186.124.190.215 9901 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:42.357299 0.000000 udp 10.0.2.105 7010 -> 96.236.211.19 2164 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:47.229266 0.125651 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:21:49.263738 0.000000 udp 10.0.2.105 7010 -> 175.141.192.220 3630 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:21:57.333720 0.000000 udp 10.0.2.105 7010 -> 173.224.47.76 1233 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:05.486005 0.000000 udp 10.0.2.105 7010 -> 88.64.253.102 6222 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:11.685030 0.121853 udp 10.0.2.105 7010 -> 78.143.167.65 9163 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:11.806883 0.000000 icmp 78.143.167.65 0x0303 -> 10.0.2.105 0xcb23 URP 192 1 257 flow=Background 1970/01/21 05:22:16.230758 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:22:18.464605 0.000000 udp 10.0.2.105 7010 -> 78.145.13.138 3025 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:26.977094 0.000000 udp 10.0.2.105 7010 -> 88.87.100.164 1043 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:34.647755 0.000000 udp 10.0.2.105 7010 -> 87.101.230.38 6343 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:42.940457 0.000000 udp 10.0.2.105 7010 -> 70.45.165.242 1606 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:47.735746 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:22:48.026753 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:22:54.436027 0.000000 udp 10.0.2.105 7010 -> 46.1.242.58 5294 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:02.490222 0.000000 udp 10.0.2.105 7010 -> 81.137.224.71 6041 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:11.210850 0.000000 udp 10.0.2.105 7010 -> 86.156.222.133 9898 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:15.735904 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:23:17.489520 0.000000 udp 10.0.2.105 7010 -> 78.186.47.89 1358 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:24.244723 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:29.893665 0.000000 udp 10.0.2.105 7010 -> 79.190.224.136 8575 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:37.147031 0.000000 udp 10.0.2.105 7010 -> 72.27.28.207 4150 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:41.733624 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:23:43.797003 0.000000 udp 10.0.2.105 7010 -> 79.242.147.133 8459 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:50.186256 0.383152 udp 10.0.2.105 7010 <-> 42.61.215.227 4381 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:23:51.022233 0.000000 udp 10.0.2.105 7010 -> 197.241.129.66 1327 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:23:58.017119 0.000000 udp 10.0.2.105 7010 -> 85.107.187.27 1032 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:06.118367 0.000000 udp 10.0.2.105 7010 -> 190.184.229.156 5671 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:10.734765 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:24:11.236508 0.000000 udp 10.0.2.105 7010 -> 89.251.49.75 6892 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:18.576874 0.076823 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:24:19.416632 0.000000 udp 10.0.2.105 7010 -> 94.34.136.204 9141 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:25.376580 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:32.786981 0.000000 udp 10.0.2.105 7010 -> 92.234.141.104 5833 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:37.734533 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:24:39.546839 0.000000 udp 10.0.2.105 7010 -> 173.13.200.141 9972 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:47.698897 0.000000 udp 10.0.2.105 7010 -> 95.242.22.131 2220 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:24:55.770229 0.000000 udp 10.0.2.105 7010 -> 78.13.167.126 6455 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:02.760539 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 9860 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:03.766348 1.182734 tcp 10.0.2.105 56512 -> 128.255.183.224 9027 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:25:08.879906 0.060543 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:25:09.113392 0.145166 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:25:09.316146 0.423256 udp 10.0.2.105 7010 <-> 187.57.209.40 5862 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:25:10.001213 0.000000 udp 10.0.2.105 7010 -> 2.219.154.185 6763 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:17.577812 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:22.673638 0.000000 udp 10.0.2.105 7010 -> 84.173.8.224 7912 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:29.357765 0.177112 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:25:30.183505 0.075800 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:30.259305 0.000000 icmp 151.58.244.201 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 287 flow=Background 1970/01/21 05:25:33.919774 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:25:37.056014 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:45.476152 0.165841 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:25:45.722007 0.000000 udp 10.0.2.105 7010 -> 195.32.93.106 9540 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:52.677150 0.000000 udp 10.0.2.105 7010 -> 86.4.127.47 8116 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:25:57.799534 0.000000 udp 10.0.2.105 7010 -> 88.229.82.172 5340 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:02.726437 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:26:04.138165 0.062737 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:26:04.331678 0.000000 udp 10.0.2.105 7010 -> 46.44.203.7 1643 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:09.535937 0.089107 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:26:09.871089 0.092849 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:26:10.503558 0.000000 udp 10.0.2.105 7010 -> 93.41.185.225 6234 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:16.786896 0.000000 udp 10.0.2.105 7010 -> 77.21.186.2 1920 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:23.496309 0.000000 udp 10.0.2.105 7010 -> 176.240.96.202 1703 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:28.233082 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:26:30.546075 0.000000 udp 10.0.2.105 7010 -> 173.221.33.243 5799 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:36.064455 0.000000 udp 10.0.2.105 7010 -> 151.66.205.157 2146 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:43.655401 0.000000 udp 10.0.2.105 7010 -> 50.75.14.152 2021 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:48.742723 0.159180 udp 10.0.2.105 7010 -> 38.69.39.2 2580 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:26:48.901903 0.000000 icmp 38.69.39.2 0x0303 -> 10.0.2.105 0x140a URP 192 1 167 flow=Background 1970/01/21 05:26:53.729152 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:26:55.652684 0.000000 udp 10.0.2.105 7010 -> 86.161.199.171 2667 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:03.501898 0.000000 udp 10.0.2.105 7010 -> 87.29.87.164 7975 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:08.961826 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:14.119143 0.183622 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:27:14.567941 0.074026 udp 10.0.2.105 7010 -> 46.142.42.244 3456 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:14.641967 0.000000 icmp 46.142.42.244 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 217 flow=Background 1970/01/21 05:27:18.735205 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:27:20.088002 0.000000 udp 10.0.2.105 7010 -> 82.91.56.81 9874 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:25.980504 3.000259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 05:27:26.426909 0.000000 udp 10.0.2.105 7010 -> 213.23.227.92 6012 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:32.986204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:27:33.537334 0.000000 udp 10.0.2.105 7010 -> 210.195.25.66 6222 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:39.386026 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:40.987807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:27:44.232606 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:27:47.757463 0.000000 udp 10.0.2.105 7010 -> 79.15.26.11 3690 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:55.198135 0.000000 udp 10.0.2.105 7010 -> 195.138.163.125 5689 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:27:56.990642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:28:01.608406 0.474419 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:28:02.567609 0.000000 udp 10.0.2.105 7010 -> 80.152.134.107 8664 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:09.498637 0.097943 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:28:09.777294 0.000000 udp 10.0.2.105 7010 -> 84.63.162.94 1955 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:14.235372 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:28:18.201293 0.000000 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:25.581972 0.000000 udp 10.0.2.105 7010 -> 12.219.241.105 3421 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:29.001982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:28:31.460466 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:39.472772 0.000000 udp 10.0.2.105 7010 -> 105.238.245.100 2820 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:44.228634 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:28:48.324541 0.089706 udp 10.0.2.105 7010 <-> 85.210.40.35 2432 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:28:48.500263 0.000000 udp 10.0.2.105 7010 -> 79.228.192.190 3784 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:28:55.975490 0.041843 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:34:33.005539 2.998995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:34:40.009625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:34:48.012290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:35:04.014873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:35:36.030665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:41:40.037391 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:41:47.043579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:41:55.045641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:42:11.048119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:42:43.055247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:48:47.060713 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:48:54.068217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:49:02.069582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:49:18.072676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:49:50.078635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:55:04.501143 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:55:04.501243 0.931369 tcp 10.0.2.105 56513 -> 128.255.183.224 9027 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:55:54.086978 2.999283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 05:56:01.091881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:56:09.093595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:56:25.096777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:56:57.112979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 05:59:09.713607 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 05:59:09.713730 0.042958 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:09.757114 0.061945 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:09.819524 0.078919 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:09.898823 0.132880 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.032112 0.058199 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.156546 0.070024 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.226962 0.304003 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.531318 0.145431 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.677195 0.163469 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:10.841100 4.242685 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.084230 0.124260 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.208940 0.132593 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.341933 0.170964 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.513357 0.171153 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.684894 0.164968 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.850313 0.070230 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.920945 0.047082 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:15.968461 0.210477 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:16.179475 0.399435 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:16.579356 0.166823 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:16.746600 0.245608 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:16.992669 0.091942 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:17.084980 1.033447 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:18.149195 0.222078 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:18.371719 0.043671 udp 10.0.2.105 7010 <-> 81.138.16.80 1646 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:18.415851 0.171521 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:18.587854 0.070348 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:18.658564 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:59:35.754187 0.055564 tcp 10.0.2.105 56514 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:35.810051 0.056126 tcp 10.0.2.105 56515 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:35.866506 0.121253 tcp 10.0.2.105 56516 -> 195.113.214.236 443 SRPA* 0 0 49 33515 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:35.988543 0.182441 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:36.171447 0.145825 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:36.317756 0.059469 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:36.377680 0.000000 udp 10.0.2.105 7010 -> 187.57.209.40 5862 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 05:59:54.298396 0.052251 tcp 10.0.2.105 56517 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:54.350998 0.054491 tcp 10.0.2.105 56518 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:54.405870 0.161122 tcp 10.0.2.105 56519 -> 195.113.214.236 443 SRPA* 0 0 34 18102 flow=From-Botnet-V2-TCP-Established 1970/01/21 05:59:54.565306 0.166515 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:54.732238 0.167130 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:54.899799 0.145222 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 05:59:55.045394 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 06:00:12.754348 0.101507 tcp 10.0.2.105 56520 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:12.855006 0.056411 tcp 10.0.2.105 56521 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:12.911923 0.139936 tcp 10.0.2.105 56522 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:13.050858 0.064001 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:00:13.115304 0.188477 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:00:13.304234 0.478540 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:00:13.783166 0.097018 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:00:13.880622 0.000000 udp 10.0.2.105 7010 -> 85.210.40.35 2432 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 06:00:30.409868 0.055793 tcp 10.0.2.105 56523 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:30.465997 0.054964 tcp 10.0.2.105 56524 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:30.520838 0.138499 tcp 10.0.2.105 56525 -> 195.113.214.236 443 SRPA* 0 0 40 21980 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:00:30.657369 0.043233 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:03:01.122562 2.997292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 06:03:08.125833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:03:16.127428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:03:32.130234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:04:04.136690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:10:08.143927 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:10:15.150739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:10:23.151854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:10:39.155449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:11:11.159929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:17:15.166165 3.003438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:17:22.177335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:17:30.177280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:17:46.179831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:18:18.186745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:24:22.190271 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:24:29.197923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:24:37.199426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:24:53.203062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:25:05.441316 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 06:25:05.441471 0.902902 tcp 10.0.2.105 56526 -> 128.255.183.224 9027 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:25:25.208647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:30:36.406268 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 06:30:36.406381 0.000000 udp 10.0.2.105 7010 -> 42.61.215.227 4381 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 06:30:54.504268 0.050811 tcp 10.0.2.105 56527 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:30:54.555377 0.051732 tcp 10.0.2.105 56528 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:30:54.607415 0.137839 tcp 10.0.2.105 56529 -> 195.113.214.236 443 SRPA* 0 0 42 23254 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:30:54.743031 0.000000 udp 10.0.2.105 7010 -> 187.57.209.40 5862 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 06:31:11.306796 0.267304 tcp 10.0.2.105 56530 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:11.574401 0.052627 tcp 10.0.2.105 56531 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:11.626891 0.153526 tcp 10.0.2.105 56532 -> 195.113.214.236 443 SRPA* 0 0 34 18102 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:11.780163 0.105692 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:11.886338 4.554943 udp 10.0.2.105 7010 <-> 85.210.40.35 2432 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.441676 0.062295 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.504535 0.132688 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.637706 0.085457 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.723568 0.061541 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.785583 0.055168 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:16.841215 0.301016 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:17.142699 0.082214 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:17.225373 0.232420 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:17.458229 0.146330 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:17.604988 4.368888 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:21.974319 0.046175 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.020937 0.172651 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.194041 0.134317 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.328810 0.135055 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.464306 0.072343 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.537065 0.166468 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.776806 0.169704 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:22.946884 0.756180 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:23.703526 0.168421 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:23.872556 0.605092 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:24.478090 0.205146 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:24.683630 0.088539 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:24.772819 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 06:31:29.278456 2.979322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 06:31:36.224396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:31:40.918654 0.049888 tcp 10.0.2.105 56533 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:40.968439 0.054005 tcp 10.0.2.105 56534 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:41.022252 0.153744 tcp 10.0.2.105 56535 -> 195.113.214.236 443 SRPA* 0 0 48 29360 flow=From-Botnet-V2-TCP-Established 1970/01/21 06:31:41.175601 0.306160 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.482192 0.043235 udp 10.0.2.105 7010 <-> 81.138.16.80 1646 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.525846 0.071641 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.597832 0.178304 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.776710 0.074237 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.851352 0.058333 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:41.910054 0.143959 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:42.054460 0.058624 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:42.113477 0.165139 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:42.279044 0.169005 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:42.448609 0.059840 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:42.508844 0.564048 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:43.073281 0.181341 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:43.255100 0.098046 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:43.353581 0.042249 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/21 06:31:44.223383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:32:00.226002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:32:32.232194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:38:36.238289 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:38:43.246938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:38:51.247889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:39:07.250532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:39:39.258776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:46:06.266097 3.002734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:46:13.273071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:46:21.274627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:46:37.277399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:47:09.283327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:53:13.291079 3.000583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 06:53:20.297202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:53:28.298895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:53:44.301803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:54:16.307294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 06:55:06.350270 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 06:55:06.350463 1.304401 tcp 10.0.2.105 56536 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:00:20.314576 3.000780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:00:27.320844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:00:35.322411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:00:51.325398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:01:23.331513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:02:11.110540 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 07:02:11.110653 0.833485 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:11.944718 0.080770 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.025971 0.058003 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.084435 0.120351 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.205154 0.070205 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.275859 0.051665 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.327940 0.054897 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.383230 0.297550 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.681200 0.071282 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:12.752912 0.000000 udp 10.0.2.105 7010 -> 85.210.40.35 2432 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:02:28.337378 0.050306 tcp 10.0.2.105 56537 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:28.388015 0.051007 tcp 10.0.2.105 56538 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:28.439330 0.130014 tcp 10.0.2.105 56539 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:28.569886 0.143523 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:28.713758 0.505038 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:29.219134 0.172135 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:29.391681 3.964506 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.356564 0.039798 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.396723 0.164428 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.561577 0.172725 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.734651 0.122030 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.857046 0.134142 udp 10.0.2.105 7010 <-> 69.159.93.156 5290 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:33.991603 0.069482 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:34.061490 0.164982 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:34.226870 0.242668 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:34.470161 1.287520 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:35.758126 0.206530 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:35.965067 0.000000 udp 10.0.2.105 7010 -> 213.121.6.147 4599 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:02:52.800555 0.049199 tcp 10.0.2.105 56540 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:52.850074 0.051141 tcp 10.0.2.105 56541 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:52.901563 0.147241 tcp 10.0.2.105 56542 -> 195.113.214.236 443 SRPA* 0 0 81 55890 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:02:53.046431 0.215893 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:02:53.262755 0.000000 udp 10.0.2.105 7010 -> 81.138.16.80 1646 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:03:11.086441 0.049576 tcp 10.0.2.105 56543 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:03:11.135949 0.050548 tcp 10.0.2.105 56544 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:03:11.186416 0.130320 tcp 10.0.2.105 56545 -> 195.113.214.236 443 SRPA* 0 0 40 22584 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:03:11.317493 0.068512 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.386403 0.172047 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.558851 0.087113 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.646407 0.063611 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.710448 0.143224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.854112 0.058166 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.912717 0.060169 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:11.973270 0.429499 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:12.403212 0.164844 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:12.568667 0.168990 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:12.738146 0.041948 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:12.780602 0.181847 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:03:12.962820 0.093334 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:07:27.337921 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 07:07:34.346765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:07:42.346208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:07:58.349721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:08:30.357526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:14:34.365616 2.999195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:14:41.368509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:14:49.371891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:15:05.373176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:15:37.379135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:21:41.388536 2.998561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:21:48.392671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:21:56.394719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:22:12.397576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:22:44.403342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:25:07.659190 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 07:25:07.659394 1.052656 tcp 10.0.2.105 56546 -> 128.255.183.224 9027 FSPA* 0 0 12 1525 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:28:48.409060 3.006037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:28:55.417764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:29:03.418644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:29:19.421129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:29:51.427352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:33:25.025237 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 07:33:25.025513 0.000000 udp 10.0.2.105 7010 -> 85.210.40.35 2432 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:33:40.310018 0.055192 tcp 10.0.2.105 56547 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:40.365511 0.050064 tcp 10.0.2.105 56548 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:40.415859 0.133065 tcp 10.0.2.105 56549 -> 195.113.214.236 443 SRPA* 0 0 42 22730 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:40.549640 0.000000 udp 10.0.2.105 7010 -> 213.121.6.147 4599 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:33:58.082261 0.056300 tcp 10.0.2.105 56550 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:58.138405 0.050827 tcp 10.0.2.105 56551 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:58.189575 0.133670 tcp 10.0.2.105 56552 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:33:58.323877 0.000000 udp 10.0.2.105 7010 -> 81.138.16.80 1646 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:34:15.280180 0.054139 tcp 10.0.2.105 56553 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:15.334154 0.051679 tcp 10.0.2.105 56554 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:15.386126 0.129184 tcp 10.0.2.105 56555 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:15.515850 0.061332 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:15.577626 0.160647 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:15.738720 0.458357 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.197531 0.306192 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.504120 0.070559 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.575114 0.061976 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.637517 0.069849 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.707794 0.133191 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.841417 0.041353 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:16.883212 0.143937 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.027618 0.192793 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.220861 0.215545 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.436855 0.038737 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.476013 0.164902 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.641420 0.119461 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:17.761447 0.000000 udp 10.0.2.105 7010 -> 69.159.93.156 5290 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:34:36.067211 0.052452 tcp 10.0.2.105 56556 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:36.120006 0.181869 tcp 10.0.2.105 56557 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:36.301734 0.131349 tcp 10.0.2.105 56558 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:34:36.433632 0.071886 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:36.505976 3.650678 udp 10.0.2.105 7010 <-> 71.10.54.162 3559 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:40.157072 0.168113 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:40.325568 0.235577 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:40.561547 0.168983 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:40.730943 0.205724 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:40.937050 0.724066 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:41.661523 0.219236 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:41.881198 0.070519 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:41.952169 0.180791 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:42.133305 0.134763 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:42.268609 0.059232 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:42.328428 0.144315 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:34:42.473167 0.000000 udp 10.0.2.105 7010 -> 81.136.220.61 6167 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 07:35:00.101748 0.053017 tcp 10.0.2.105 56559 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:35:00.155151 0.055394 tcp 10.0.2.105 56560 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:35:00.210388 0.154169 tcp 10.0.2.105 56561 -> 195.113.214.236 443 SRPA* 0 0 69 69908 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:35:00.365137 0.055801 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:00.421390 0.169551 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:00.591403 0.040948 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:00.632818 0.180302 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:00.813583 0.098074 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:00.912106 0.360683 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:01.273162 0.166303 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 07:35:55.434501 3.000331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 07:36:02.441228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:36:10.442000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:36:26.445371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:36:58.451249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:44:35.462183 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:44:42.469644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:44:50.469778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:45:06.473514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:45:38.479989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:51:47.492671 3.000922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:51:54.499273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:52:02.502279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:52:18.505134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:52:50.510045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:55:08.718652 0.000194 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 07:55:08.718950 1.221860 tcp 10.0.2.105 56562 -> 128.255.183.224 9027 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/01/21 07:58:54.516875 3.000731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 07:59:01.523258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:59:09.524867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:59:25.527857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 07:59:57.533904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:05:17.874928 0.000194 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 08:05:17.875242 0.000000 udp 10.0.2.105 7010 -> 69.159.93.156 5290 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:05:34.230445 0.050751 tcp 10.0.2.105 56563 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:34.281535 0.058077 tcp 10.0.2.105 56564 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:34.339976 0.130969 tcp 10.0.2.105 56565 -> 195.113.214.236 443 SRPA* 0 0 27 11840 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:34.469278 0.000000 udp 10.0.2.105 7010 -> 81.136.220.61 6167 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:05:50.411909 0.053563 tcp 10.0.2.105 56566 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:50.465372 0.052995 tcp 10.0.2.105 56567 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:50.518223 0.131669 tcp 10.0.2.105 56568 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:05:50.649111 0.059843 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:05:50.709354 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:06:01.540104 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 08:06:08.027411 0.049051 tcp 10.0.2.105 56569 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:08.076774 0.055647 tcp 10.0.2.105 56570 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:08.132205 0.146880 tcp 10.0.2.105 56571 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:08.279626 0.066560 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.346598 0.056886 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.403909 0.076122 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.480552 0.120615 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.547411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:06:08.601534 0.039303 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.641287 0.144223 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:08.785942 0.336620 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.122959 0.304828 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.428225 0.119403 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.548070 0.169938 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.718368 0.040261 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.759071 0.161825 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:09.921262 0.172940 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:10.094591 0.074423 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:10.169422 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:06:16.549676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:06:25.764542 0.049208 tcp 10.0.2.105 56572 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:25.813540 0.066803 tcp 10.0.2.105 56573 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:25.880207 0.141766 tcp 10.0.2.105 56574 -> 195.113.214.236 443 SRPA* 0 0 33 18052 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:26.020048 0.206394 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:26.226851 0.839226 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:27.066434 0.167423 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:27.234216 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:06:32.552120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:06:44.300848 0.049517 tcp 10.0.2.105 56575 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:44.350730 0.054771 tcp 10.0.2.105 56576 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:44.405427 0.134130 tcp 10.0.2.105 56577 -> 195.113.214.236 443 SRPA* 0 0 28 12100 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:06:44.539294 0.178520 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:44.718220 1.216316 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:45.945221 0.218009 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.163673 0.068581 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.232806 0.143488 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.376766 0.058469 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.436388 0.101098 udp 10.0.2.105 7010 <-> 78.148.139.226 7537 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.537871 0.217035 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.755340 0.041435 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.797208 0.181166 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:46.978808 0.104520 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:47.083729 0.055627 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:47.139777 0.362474 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:06:47.502692 0.164845 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:07:04.557687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:13:08.565392 3.001107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:13:15.571302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:13:23.572745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:13:39.576068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:14:11.583024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:20:15.589611 2.999843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:20:22.595951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:20:30.598222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:20:46.600817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:21:18.617235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:25:09.948750 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 08:25:09.948851 1.048931 tcp 10.0.2.105 56578 -> 128.255.183.224 9027 FSPA* 0 0 12 1476 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:27:22.622631 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:27:29.629249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:27:37.631026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:27:53.633549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:28:25.639690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:34:29.646553 3.000879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:34:36.653410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:34:44.654867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:35:00.657739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:35:32.663619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:37:08.511883 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 08:37:08.512032 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:37:25.388086 0.049338 tcp 10.0.2.105 56579 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:25.437735 0.050354 tcp 10.0.2.105 56580 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:25.488397 0.141753 tcp 10.0.2.105 56581 -> 195.113.214.236 443 SRPA* 0 0 63 38539 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:25.629049 0.000000 udp 10.0.2.105 7010 -> 71.10.54.162 3559 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:37:43.243365 0.048393 tcp 10.0.2.105 56582 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:43.292005 0.066079 tcp 10.0.2.105 56583 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:43.358399 0.152758 tcp 10.0.2.105 56584 -> 195.113.214.236 443 SRPA* 0 0 40 21980 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:37:43.511071 0.168198 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:43.679709 0.059761 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:43.739937 0.083126 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:43.823588 0.132621 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:43.956690 0.044137 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.001380 0.145990 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.147755 0.335902 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.484139 0.061917 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.546502 0.071531 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.618495 0.040593 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.659508 0.162875 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.822795 0.170981 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:44.994302 0.063404 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:45.058145 0.171049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:45.229584 0.306979 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:45.536964 0.119563 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:45.656943 0.232853 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:45.890249 0.242352 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:46.133084 0.165552 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:46.299086 0.181072 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:46.480734 0.369213 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:46.850440 0.954104 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:47.804943 0.067971 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:47.873262 0.143437 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:48.017168 0.056563 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:37:48.074205 0.000000 udp 10.0.2.105 7010 -> 78.148.139.226 7537 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 08:38:05.674420 0.049782 tcp 10.0.2.105 56585 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:38:05.724041 0.051473 tcp 10.0.2.105 56586 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:38:05.775911 0.149838 tcp 10.0.2.105 56587 -> 195.113.214.236 443 SRPA* 0 0 44 36218 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:38:05.926915 0.167084 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.094453 0.040880 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.135781 0.182255 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.318430 0.093306 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.412157 0.056571 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.469117 0.360005 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:38:06.829508 0.165076 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 08:41:36.670871 3.000478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 08:41:43.677210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:41:51.678437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:42:07.681711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:42:39.697718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:48:43.704224 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:48:50.711106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:48:58.712783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:49:14.726584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:49:46.731794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:55:10.998233 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 08:55:10.998447 0.978515 tcp 10.0.2.105 56588 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/21 08:55:50.738944 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 08:55:57.745295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:56:05.746296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:56:21.749838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 08:56:53.756156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:02:57.762657 3.000624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:03:04.769105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:03:12.770559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:03:28.773479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:04:00.779624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:08:16.137172 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 09:08:16.137300 0.000000 udp 10.0.2.105 7010 -> 78.148.139.226 7537 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 09:08:33.484034 0.051090 tcp 10.0.2.105 56589 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:08:33.535479 0.051710 tcp 10.0.2.105 56590 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:08:33.586975 0.114659 tcp 10.0.2.105 56591 -> 195.113.214.236 443 SRPA* 0 0 35 24846 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:08:33.702242 0.082297 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:33.784987 0.132844 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:33.918248 0.047847 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:33.966549 0.150692 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.117605 0.164298 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.282365 0.058663 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.341404 0.060966 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.402883 0.073215 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.476542 0.341613 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.818561 0.157262 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:34.976201 0.172147 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:35.148761 0.070071 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:35.219251 0.038864 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:35.258591 0.119932 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:35.378909 0.242973 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:35.622335 0.696639 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:36.319355 0.171361 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:36.491127 0.296180 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:36.787751 0.166879 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:36.955082 0.171537 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.127096 0.144369 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.271897 0.058528 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.330828 0.070593 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.401808 0.217491 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.619668 0.144737 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.764790 0.222799 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:37.988044 0.041042 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:38.029455 0.056581 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:38.086465 0.364000 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:38.450901 0.164484 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:38.615831 0.180571 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:08:38.796817 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 09:08:54.153245 0.049653 tcp 10.0.2.105 56592 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:08:54.203205 0.063850 tcp 10.0.2.105 56593 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:08:54.267336 0.131090 tcp 10.0.2.105 56594 -> 195.113.214.236 443 SRPA* 0 0 24 14854 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:10:04.786239 3.006302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 09:10:11.793098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:10:19.794600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:10:35.797617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:11:07.803460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:17:11.810129 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:17:18.816959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:17:26.818912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:17:42.821695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:18:14.830275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:24:18.836254 2.999194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:24:25.841229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:24:33.842909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:24:49.845215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:25:11.977969 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 09:25:11.978077 0.955428 tcp 10.0.2.105 56595 -> 128.255.183.224 9027 FSPA* 0 0 14 1668 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:25:21.851602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:31:25.858212 3.000446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:31:32.864945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:31:40.866593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:31:56.869593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:32:28.875413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:38:32.881734 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:38:39.888870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:38:47.890696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:38:56.744342 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 09:38:56.744528 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 09:39:03.893342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:39:14.783436 0.050389 tcp 10.0.2.105 56596 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:14.834116 0.052881 tcp 10.0.2.105 56597 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:14.887265 0.137233 tcp 10.0.2.105 56598 -> 195.113.214.236 443 SRPA* 0 0 56 37993 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:15.025267 0.039315 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.065033 0.146927 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.212504 0.089667 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.302650 0.120304 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.423336 0.060016 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.483717 0.063801 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.547896 0.076528 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.624870 0.368870 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:15.994118 0.163435 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.157975 0.170418 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.328844 0.167493 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.496718 0.213998 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.757485 0.070283 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.828191 0.038276 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.866887 0.121738 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:16.989047 0.473737 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:17.463195 0.297037 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:17.760653 0.165355 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:17.926415 0.180351 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:18.107146 0.170257 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:18.277816 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 09:39:33.516921 0.049334 tcp 10.0.2.105 56599 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:33.566506 0.054150 tcp 10.0.2.105 56600 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:33.620943 0.155091 tcp 10.0.2.105 56601 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/21 09:39:33.775015 0.067760 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:33.843213 0.247859 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:34.091469 0.142778 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:34.234622 1.088023 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.323012 0.042724 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.366145 0.066105 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.432637 0.195087 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.628064 0.163232 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.791702 0.363066 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:39:35.900062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:39:36.155127 0.179278 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 09:46:01.910740 2.998040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:46:08.914261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:46:16.918934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:46:32.919069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:47:04.925147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:53:08.932778 3.000050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 09:53:15.938639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:53:23.940147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:53:39.943251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:54:11.948863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 09:55:12.938315 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 09:55:12.938408 1.028961 tcp 10.0.2.105 56602 -> 128.255.183.224 9027 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:00:15.955345 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:00:22.962633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:00:30.964047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:00:46.966777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:01:18.972918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:07:22.980114 3.000793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:07:29.987846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:07:37.989990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:07:53.994442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:08:25.997429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:09:59.982699 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 10:09:59.982963 0.056835 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.040172 0.043822 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.084419 0.421142 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.505997 0.120907 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.627567 0.066344 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.694253 0.059620 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.754294 0.071512 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:00.826198 0.343825 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.170401 0.157353 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.328141 0.142078 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.470591 0.169136 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.640088 0.222785 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.863272 0.066993 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.930633 0.039579 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:01.970572 0.121544 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:02.092687 0.167813 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:02.260914 0.179949 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:02.441367 0.297850 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:02.739597 0.237708 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:02.977720 0.167498 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:03.145548 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 10:10:19.823089 0.032380 tcp 10.0.2.105 56603 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:19.855805 0.033008 tcp 10.0.2.105 56604 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:19.889127 0.121171 tcp 10.0.2.105 56605 -> 195.113.214.236 443 SRPA* 0 0 47 27211 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:20.008346 0.073631 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:20.082404 0.000000 udp 10.0.2.105 7010 -> 162.202.134.145 3979 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 10:10:36.194395 0.031617 tcp 10.0.2.105 56606 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:36.225882 0.033631 tcp 10.0.2.105 56607 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:36.259840 0.146545 tcp 10.0.2.105 56608 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:10:36.405214 0.140528 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:36.546136 0.042295 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:36.588768 0.063984 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:36.653186 0.902746 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:37.556329 0.167336 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:37.724080 0.361997 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:38.086496 0.220159 udp 10.0.2.105 7010 <-> 108.195.138.35 7576 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:10:38.307043 0.181722 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:14:30.005772 2.999111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 10:14:37.010634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:14:45.011752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:15:01.015139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:15:33.020921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:21:37.032338 2.995879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:21:44.034212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:21:52.039210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:22:08.039059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:22:40.054829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:25:13.966665 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 10:25:13.966886 1.184473 tcp 10.0.2.105 56609 -> 128.255.183.224 9027 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:28:44.061302 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:28:51.068216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:28:59.069553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:29:15.073571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:29:47.080069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:35:51.085104 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:35:58.092281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:36:06.095621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:36:22.096910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:36:54.103089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:41:07.147032 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 10:41:07.147133 0.171182 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:07.318751 0.000000 udp 10.0.2.105 7010 -> 162.202.134.145 3979 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 10:41:26.266505 0.032254 tcp 10.0.2.105 56610 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:26.299057 0.031478 tcp 10.0.2.105 56611 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:26.330377 0.131084 tcp 10.0.2.105 56612 -> 195.113.214.236 443 SRPA* 0 0 60 38035 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:26.462221 0.059801 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:26.522456 0.042112 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:26.565044 0.065830 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:26.631288 0.062738 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:26.694483 0.075560 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:26.770503 0.337058 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:27.108033 0.120331 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:27.228807 0.088492 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:27.317713 0.162375 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:27.480537 0.275283 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:27.756229 0.324880 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.081555 0.120836 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.202825 0.181677 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.384937 0.147787 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.533089 0.253842 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.787343 0.167353 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:28.955094 0.718950 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:29.674448 0.305271 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:29.980105 0.183797 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.164348 0.246295 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.442931 0.070841 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.514210 0.040756 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.555401 0.074589 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.630378 0.143414 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.774264 0.164505 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:30.939189 0.362053 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:31.302009 0.461124 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/21 10:41:31.763576 0.000000 udp 10.0.2.105 7010 -> 108.195.138.35 7576 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 10:41:48.516817 0.032027 tcp 10.0.2.105 56613 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:48.549195 0.033258 tcp 10.0.2.105 56614 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:48.582528 0.191018 tcp 10.0.2.105 56615 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:41:48.774277 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 10:42:05.791661 0.031102 tcp 10.0.2.105 56616 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:42:05.823121 0.033119 tcp 10.0.2.105 56617 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:42:05.856556 0.188427 tcp 10.0.2.105 56618 -> 195.113.214.236 443 SRPA* 0 0 39 31212 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:44:31.114103 2.999976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 10:44:38.119918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:44:46.121654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:45:02.124057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:45:34.130198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:51:44.146494 3.000381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:51:51.152836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:51:59.154239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:52:15.157079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:52:47.163155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:55:15.158409 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 10:55:15.158594 1.042439 tcp 10.0.2.105 56619 -> 128.255.183.224 9027 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/01/21 10:58:51.169170 3.002373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 10:58:58.177313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:59:06.177489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:59:22.181176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 10:59:54.187696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:05:58.194823 3.003819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:06:05.200724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:06:13.206553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:06:29.205723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:07:01.211225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:12:22.163101 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 11:12:22.163276 0.181156 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:22.344827 0.000000 udp 10.0.2.105 7010 -> 108.195.138.35 7576 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 11:12:38.989072 0.030774 tcp 10.0.2.105 56620 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:12:39.020137 0.032474 tcp 10.0.2.105 56621 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:12:39.052930 0.172748 tcp 10.0.2.105 56622 -> 195.113.214.236 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:12:39.226280 0.170825 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:39.397602 0.058724 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:39.456696 0.063179 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:39.520422 0.069539 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:39.590300 0.364564 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:39.955278 0.047338 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.003008 0.056931 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.060552 0.238531 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.299497 0.038871 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.338735 0.144762 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.483953 0.062813 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.547207 0.157480 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.705071 0.119698 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.825193 0.167357 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:40.993040 0.277779 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:41.271257 0.145241 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:41.416914 0.230587 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:41.647948 0.165799 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:41.814111 0.301896 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.116457 0.179564 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.296444 0.057586 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.354434 0.072659 udp 10.0.2.105 7010 <-> 86.128.169.173 2112 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.427504 0.162887 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.590809 0.144029 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:42.735274 0.756840 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:43.492657 0.041872 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:43.534920 0.361256 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:12:43.896552 0.066831 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:13:05.216542 3.002398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:13:12.224396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:13:20.226057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:13:36.229584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:14:08.235437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:20:12.243037 2.999660 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:20:19.249476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:20:27.251107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:20:43.252963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:21:15.262964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:25:16.206109 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 11:25:16.206222 0.951038 tcp 10.0.2.105 56623 -> 128.255.183.224 9027 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:27:19.267130 2.999672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:27:26.272449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:27:34.274447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:27:50.277134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:28:22.282864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:34:26.290373 2.999702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:34:33.296600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:34:41.299187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:34:57.301253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:35:29.307006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:41:33.314080 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:41:40.320748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:41:48.323526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:42:04.326085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:42:36.331009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:43:08.427580 0.000166 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 11:43:08.427854 0.180911 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:08.609125 0.062430 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:08.671984 0.073652 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:08.746010 0.396091 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.142557 0.039854 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.237477 0.064520 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.302416 0.171056 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.473921 0.058641 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.532947 0.091431 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.624698 0.041033 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.666233 0.137954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.804585 0.065771 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:09.870753 0.162432 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.033681 0.120145 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.154215 0.166041 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.320687 0.207809 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.528970 0.164795 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.694187 0.301033 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:10.995616 0.238077 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:11.234153 0.143778 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:11.378328 0.180776 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:11.559553 0.056527 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:11.616481 0.000000 udp 10.0.2.105 7010 -> 86.128.169.173 2112 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 11:43:29.689309 0.031564 tcp 10.0.2.105 56624 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:43:29.721141 0.032184 tcp 10.0.2.105 56625 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:43:29.753643 0.113126 tcp 10.0.2.105 56626 -> 195.113.214.236 443 SRPA* 0 0 63 41211 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:43:29.865940 0.162729 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:30.029167 0.143916 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:30.173528 0.362796 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:30.536773 0.059028 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:30.596137 0.365276 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:43:30.961763 0.040825 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 11:48:40.337470 3.001205 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:48:47.344431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:48:55.346684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:49:11.348783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:49:43.354845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:55:17.165371 0.000219 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 11:55:17.165693 1.625077 tcp 10.0.2.105 56627 -> 128.255.183.224 9027 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/21 11:55:47.365192 3.004579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 11:55:54.368153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:56:02.370413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:56:18.373684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 11:56:50.378865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:02:54.385244 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:03:01.392225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:03:09.393691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:03:25.397116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:03:57.402834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:10:01.412154 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:10:08.416593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:10:16.419462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:10:32.421155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:11:04.428050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:13:41.443466 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 12:13:41.443579 0.000000 udp 10.0.2.105 7010 -> 86.128.169.173 2112 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 12:13:56.848495 0.032343 tcp 10.0.2.105 56628 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:13:56.881178 0.033321 tcp 10.0.2.105 56629 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:13:56.914336 0.122804 tcp 10.0.2.105 56630 -> 195.113.214.236 443 SRPA* 0 0 60 53517 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:13:57.037892 0.070265 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.108610 0.348733 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.457810 0.060552 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.518822 0.055618 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.574796 0.171849 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.747843 0.181992 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.930434 0.062337 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:57.993127 0.046797 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.040420 0.151516 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.192521 0.065463 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.258429 0.161190 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.419989 0.121384 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.541798 0.167230 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.709401 0.081057 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.791468 0.061145 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:58.852996 0.302341 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:59.155764 0.263287 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:59.419477 0.206521 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:59.626397 0.168816 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:59.795626 0.058432 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:13:59.854423 0.147072 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:00.001890 0.177778 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:00.180134 0.142441 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:00.323085 0.163456 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:00.487003 1.334195 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:01.821676 0.041167 udp 10.0.2.105 7010 <-> 88.149.249.3 6943 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:01.863281 0.362822 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:14:02.226488 0.273449 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:17:08.434704 3.002755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:17:15.441594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:17:23.441845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:17:39.444201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:18:11.450659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:24:15.457517 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:24:22.632156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:24:30.562768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:24:46.468812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:25:18.474807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:25:18.795934 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 12:25:18.796047 1.020929 tcp 10.0.2.105 56631 -> 128.255.183.224 9027 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:31:22.480620 3.002280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:31:29.488146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:31:37.489217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:31:53.492638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:32:25.498427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:38:29.505602 3.000584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:38:36.516773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:38:44.513544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:39:00.516663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:39:32.684223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:44:25.164532 0.165536 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 12:44:25.330183 0.070583 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:25.401233 0.337275 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:25.738903 0.043232 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:25.782503 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 12:44:41.905095 0.032053 tcp 10.0.2.105 56632 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:41.937533 0.033321 tcp 10.0.2.105 56633 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:41.971174 0.115906 tcp 10.0.2.105 56634 -> 195.113.214.236 443 SRPA* 0 0 46 24945 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:42.085835 0.171379 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:42.257648 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 12:44:57.401836 0.030676 tcp 10.0.2.105 56635 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:57.432833 0.032048 tcp 10.0.2.105 56636 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:57.465242 0.142311 tcp 10.0.2.105 56637 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:44:57.606421 0.057997 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:57.664855 0.040939 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:57.706191 0.144852 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:57.851491 0.082999 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:57.934922 0.164660 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.099962 0.120124 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.220535 0.167830 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.388805 0.083119 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.472304 0.059727 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.532483 0.302586 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:58.835540 0.167655 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.003550 0.056513 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.060671 0.145287 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.206343 0.178534 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.385302 0.281630 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.667361 0.220324 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:44:59.888128 0.140275 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:45:00.028773 0.163347 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:45:00.192532 0.881858 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:45:01.074821 0.000000 udp 10.0.2.105 7010 -> 88.149.249.3 6943 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 12:45:19.853195 0.031581 tcp 10.0.2.105 56638 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:45:19.885124 0.032387 tcp 10.0.2.105 56639 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:45:19.917821 0.141100 tcp 10.0.2.105 56640 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/21 12:45:20.059581 0.362715 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:45:20.422690 0.357377 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/21 12:46:02.546383 3.685162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 12:46:10.195598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:46:18.109318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:46:33.925628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:47:05.573802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:53:09.580659 3.004868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 12:53:16.586826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:53:24.589190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:53:40.591872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:54:12.598050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 12:55:19.824990 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 12:55:19.825275 1.243125 tcp 10.0.2.105 56641 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:00:16.604144 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:00:23.611794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:00:31.612743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:00:47.615982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:01:19.622359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:07:23.627640 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:07:30.635401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:07:38.643653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:07:54.640087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:08:26.647020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:14:30.652469 3.001719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:14:37.659390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:14:45.971683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:15:01.847839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:15:23.054737 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 13:15:23.054871 0.183175 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:15:23.238485 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 13:15:33.679782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:15:41.604163 0.032315 tcp 10.0.2.105 56642 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:41.636786 0.034174 tcp 10.0.2.105 56643 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:41.670800 0.131417 tcp 10.0.2.105 56644 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:41.802972 0.000000 udp 10.0.2.105 7010 -> 88.149.249.3 6943 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 13:15:59.668039 0.030944 tcp 10.0.2.105 56645 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:59.698782 0.033724 tcp 10.0.2.105 56646 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:59.732810 0.137216 tcp 10.0.2.105 56647 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:15:59.870559 0.072755 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:15:59.943798 0.343014 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.287258 0.042312 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.330040 0.176938 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.507441 0.059852 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.568483 0.066822 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.635746 0.157322 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.793566 0.151965 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.945983 0.046289 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:00.992799 0.082523 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.075760 0.059046 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.135243 0.296132 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.431816 0.164548 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.596805 0.120355 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.717616 0.178297 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:01.896368 0.166725 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.063549 0.059012 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.123012 0.147990 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.271447 0.143127 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.415019 0.206755 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.622202 0.265882 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:02.888492 0.163855 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:03.052790 0.238108 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:03.291265 0.360781 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:16:03.652643 0.377041 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:21:37.686093 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:21:44.693307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:21:52.695282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:22:08.697831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:22:40.704811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:25:21.074637 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 13:25:21.074809 1.289638 tcp 10.0.2.105 56648 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:28:44.710300 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:28:51.717183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:28:59.718821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:29:15.722027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:29:47.727906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:35:51.734378 3.001280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:35:58.741463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:36:06.742713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:36:22.745811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:36:54.751701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:44:31.762160 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:44:38.768899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:44:46.771000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:45:02.773466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:45:34.779407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:46:29.591988 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 13:46:29.592099 0.179713 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:29.772240 0.070411 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:29.843040 0.354819 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.198239 0.043556 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.242173 0.171450 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.414051 0.060262 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.474760 0.063361 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.538576 0.157779 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.696781 0.137797 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.834999 0.046316 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.881749 0.078326 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:30.960606 0.058937 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.019914 0.286740 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.307083 0.165836 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.473300 0.119181 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.592901 0.175548 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.768901 0.169637 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:31.938957 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 13:46:48.377292 0.032252 tcp 10.0.2.105 56649 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:46:48.409829 0.032582 tcp 10.0.2.105 56650 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:46:48.442738 0.136679 tcp 10.0.2.105 56651 -> 195.113.214.236 443 SRPA* 0 0 42 23254 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:46:48.580167 0.229842 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:48.810402 0.313687 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:49.124483 0.163979 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:46:49.288804 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 13:47:05.722235 0.037344 tcp 10.0.2.105 56652 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:47:05.759879 0.031802 tcp 10.0.2.105 56653 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:47:05.791932 0.158116 tcp 10.0.2.105 56654 -> 195.113.214.236 443 SRPA* 0 0 20 11311 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:47:05.950624 0.142124 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:47:06.093200 0.059199 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:47:06.152831 0.235934 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:47:06.389178 0.361484 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/21 13:51:42.792009 3.000766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 13:51:49.800740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:51:57.800865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:52:13.803155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:52:45.809366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:55:22.364727 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 13:55:22.364919 1.073587 tcp 10.0.2.105 56655 -> 128.255.183.224 9027 FSPA* 0 0 12 1546 flow=From-Botnet-V2-TCP-Established 1970/01/21 13:58:49.815561 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 13:58:56.822738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:59:04.824066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:59:20.826915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 13:59:52.833188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:05:56.864005 2.990008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:06:03.858466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:06:11.848430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:06:27.851588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:06:59.857663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:13:03.869290 2.996497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:13:10.870496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:13:18.878465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:13:34.877313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:14:06.888500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:17:11.909959 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 14:17:11.910072 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 14:17:27.611690 0.031060 tcp 10.0.2.105 56656 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 14:17:27.643073 0.031769 tcp 10.0.2.105 56657 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 14:17:27.675152 0.131971 tcp 10.0.2.105 56658 -> 195.113.214.236 443 SRPA* 0 0 27 11692 flow=From-Botnet-V2-TCP-Established 1970/01/21 14:17:27.807068 0.145344 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:27.952790 0.180468 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.133658 0.068392 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.202484 0.170319 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.374252 0.055130 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.429818 0.065375 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.495632 0.162373 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.658468 0.040342 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:28.699249 0.362194 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.061921 0.060086 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.122715 0.300875 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.485455 0.070780 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.556637 0.151673 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.708687 0.040414 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.749519 0.167381 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:29.917359 0.171828 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.089670 0.120108 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.210198 0.166643 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.377308 0.207864 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.585641 0.175054 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.761110 0.169604 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:30.931149 0.244845 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:31.176496 0.139833 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:31.316783 0.063820 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:17:31.381060 0.360943 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:20:10.887979 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:20:17.895239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:20:25.897703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:20:41.899483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:21:13.905194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:25:23.444149 0.000209 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 14:25:23.444473 1.275176 tcp 10.0.2.105 56659 -> 128.255.183.224 9027 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/01/21 14:27:17.911190 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:27:24.918606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:27:32.920398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:27:48.923728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:28:20.928817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:34:24.936222 3.000588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:34:31.942809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:34:39.943788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:34:55.947010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:35:27.953032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:41:31.960079 3.000560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:41:38.966565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:41:46.968130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:42:02.971038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:42:34.979207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:47:46.385164 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 14:47:46.385271 0.069532 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:46.455205 0.147970 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:46.603564 0.180602 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:46.784667 0.171872 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:46.956903 0.054327 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.011673 0.065252 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.077412 0.161607 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.239419 0.043642 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.283427 0.395650 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.679458 0.059800 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:47.739695 0.294527 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.034649 0.072173 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.107317 0.137891 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.245626 0.039404 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.285488 0.165077 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.450998 0.177723 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.629128 0.119661 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.749113 0.165579 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:48.915074 0.215784 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:49.131251 0.196662 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:49.328378 0.181664 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:49.510374 0.238930 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:49.749755 0.361361 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:50.111509 0.140338 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:47:50.252224 0.069961 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 14:48:38.983906 3.000826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:48:45.990280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:48:53.992080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:49:09.995522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:49:42.000714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:55:24.724383 0.000190 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 14:55:24.724694 0.988462 tcp 10.0.2.105 56660 -> 128.255.183.224 9027 FSPA* 0 0 12 1473 flow=From-Botnet-V2-TCP-Established 1970/01/21 14:55:46.017543 3.001321 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 14:55:53.024813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:56:01.026663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:56:17.030932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 14:56:49.035042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:02:53.046155 2.996482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:03:00.048614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:03:08.051657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:03:24.052885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:03:56.059049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:10:00.065493 3.003247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:10:07.072791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:10:15.196423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:10:31.086646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:11:03.094550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:17:07.100790 3.000304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:17:14.106003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:17:22.107934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:17:38.110705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:17:54.575738 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 15:17:54.575855 0.069540 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:54.645922 0.143904 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:54.790306 0.178803 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:54.969528 0.170689 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.140704 0.058372 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.199563 0.066563 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.266568 0.161712 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.428720 0.039645 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.468815 0.335957 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.805286 0.059676 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:55.865478 0.300909 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.166838 0.073715 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.240994 0.151912 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.393362 0.045649 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.439454 0.169572 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.609467 0.179682 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.789506 0.119258 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:56.909223 0.167507 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:57.077150 0.217653 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:57.295288 0.246277 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:57.541980 0.354094 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:57.896552 0.141313 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:58.038346 0.107843 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:58.146529 0.198213 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:17:58.345238 0.173355 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:18:10.116768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:24:14.122519 3.002929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:24:21.131971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:24:29.131928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:24:45.135541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:25:17.140798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:25:25.713749 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 15:25:25.713848 1.027019 tcp 10.0.2.105 56661 -> 128.255.183.224 9027 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/01/21 15:31:21.147176 3.001174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:31:28.157231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:31:36.155644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:31:52.159206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:32:24.165047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:38:28.171678 3.175720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:38:35.330515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:38:43.266188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:38:59.193103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:39:31.198973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:45:58.210441 2.999066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:46:05.215438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:46:13.216757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:46:29.219936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:47:01.225759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:48:20.439936 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 15:48:20.440038 0.178496 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:20.618989 0.170476 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:20.789819 0.055446 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:20.845665 0.072391 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:20.918461 0.150431 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.069304 0.063739 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.133463 0.161824 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.295739 0.043528 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.339728 0.350935 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.691065 0.064710 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:21.756177 0.294522 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.051161 0.078648 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.130276 0.144669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.275393 0.046057 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.321905 0.167814 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.490142 0.190618 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.681194 0.120861 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.802519 0.172388 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:22.975311 0.359033 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:23.334790 0.143423 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:23.478617 0.063313 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:23.542336 0.306274 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:23.849064 0.257756 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:24.107267 0.196576 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:48:24.304379 0.234756 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/21 15:53:05.231898 3.030094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 15:53:12.253116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:53:20.250866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:53:36.253758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:54:08.262791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 15:55:26.583340 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 15:55:26.583449 1.106272 tcp 10.0.2.105 56662 -> 128.255.183.224 9027 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:00:12.266419 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:00:19.273283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:00:27.275461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:00:43.277936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:01:15.283616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:07:19.290179 3.003568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:07:26.297509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:07:34.299090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:07:50.305114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:08:22.307543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:14:26.314604 3.001249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:14:33.322734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:14:41.324122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:14:57.326703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:15:29.333001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:18:41.730650 0.000487 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 16:18:41.731248 0.056890 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:18:41.788761 0.070675 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:18:41.859880 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 16:18:58.955113 0.031472 tcp 10.0.2.105 56663 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:18:58.986925 0.053061 tcp 10.0.2.105 56664 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:18:59.040330 0.129346 tcp 10.0.2.105 56665 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:18:59.168028 0.000000 udp 10.0.2.105 7010 -> 31.52.40.81 8321 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 16:19:17.641943 0.053455 tcp 10.0.2.105 56666 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:19:17.695174 0.053721 tcp 10.0.2.105 56667 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:19:17.749204 0.124934 tcp 10.0.2.105 56668 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:19:17.874801 0.180494 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.055719 0.170831 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.226971 0.156527 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.383975 0.043500 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.427939 0.330369 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.758740 0.059390 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:18.818576 0.303857 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.122877 0.085849 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.209164 0.144733 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.354308 0.040460 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.395284 0.167139 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.562880 0.177827 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.741154 0.121348 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:19.862942 0.180068 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:20.043459 0.080658 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:20.124578 0.206136 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:20.331177 0.244823 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:20.576476 0.360185 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:20.937129 0.138754 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:21.076445 0.196894 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:19:21.273763 0.208900 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:21:33.339460 2.999797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 16:21:40.345289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:21:48.346671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:22:04.355512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:22:36.357918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:25:27.692486 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 16:25:27.692733 0.983295 tcp 10.0.2.105 56669 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:28:40.362434 3.000663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:28:47.369029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:28:55.371053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:29:11.372960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:29:43.379627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:35:47.386549 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:35:54.403376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:36:02.404155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:36:18.407687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:36:50.417685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:42:54.419879 3.002871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:43:01.427170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:43:09.428775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:43:25.431683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:43:57.438819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:49:32.709824 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 16:49:32.709930 0.067178 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:32.777529 0.148942 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:32.926941 0.060269 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:32.987585 0.071561 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.059566 0.181293 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.241297 0.182604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.424450 0.157048 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.581940 0.043172 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.625546 0.342808 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:33.968802 0.059698 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.028917 0.296361 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.325710 0.070998 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.397046 0.151535 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.549039 0.045547 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.595011 0.168091 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.763607 0.173958 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:34.937925 0.119375 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:35.057663 0.167581 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:35.225666 0.065837 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:35.291904 0.361008 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:35.653397 0.142433 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:35.796216 0.285590 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:36.082197 0.407872 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:36.490508 0.202809 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:49:36.693701 0.172211 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/21 16:50:01.444747 3.002620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:50:08.451118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:50:16.452657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:50:32.462544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:51:04.462562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:55:28.681839 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 16:55:28.681976 1.242250 tcp 10.0.2.105 56670 -> 128.255.183.224 9027 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/01/21 16:57:08.468828 3.000528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 16:57:15.475365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:57:23.476596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:57:39.479541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 16:58:11.485495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:04:15.491347 3.002469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:04:22.498264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:04:30.500299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:04:46.503541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:05:18.509634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:11:22.516416 3.000362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:11:29.523097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:11:37.525000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:11:53.527412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:12:25.534549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:18:29.541423 3.000324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:18:36.546589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:18:44.548932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:19:00.552112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:19:32.557221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:19:48.942207 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 17:19:48.942325 0.056277 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:48.999047 0.067647 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.067156 0.065443 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.133322 0.146511 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.280340 0.180764 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.461639 0.171681 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.633770 0.163108 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.797328 0.042184 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:49.839939 0.336640 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.177035 0.062114 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.239582 0.296555 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.536666 0.077448 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.614547 0.144864 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.759834 0.039389 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.799657 0.167935 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:50.968083 0.177204 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:51.145668 0.120040 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:51.266122 0.359242 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:51.625736 0.142571 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:51.805382 0.269902 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:52.075617 0.177212 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:52.253219 0.063514 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:52.317161 0.171530 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:52.489126 0.259085 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:19:52.748661 0.197753 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:25:29.932436 0.029617 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 17:25:29.962214 1.098432 tcp 10.0.2.105 56671 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/21 17:25:36.564339 3.136693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 17:25:43.673506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:25:51.617908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:26:07.585323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:26:39.591276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:32:43.598290 3.147757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:32:50.726132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:32:58.668166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:33:14.828222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:33:46.635267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:39:50.641270 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:39:57.648621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:40:05.650064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:40:21.653391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:40:53.659447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:46:57.665854 3.001311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:47:04.673247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:47:12.674195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:47:28.677151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:48:00.685236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:49:55.129172 0.000177 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 17:49:55.129457 0.066946 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.196834 0.056214 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.253427 0.066965 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.320830 0.146343 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.467544 0.179422 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.647361 0.171192 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:55.819009 0.197989 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.017336 0.045202 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.062982 0.342944 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.406318 0.059496 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.466162 0.297152 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.763781 0.081560 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.845746 0.151930 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:56.998057 0.044065 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.042507 0.167841 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.210797 0.184750 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.395981 0.143073 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.539492 0.229192 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.769076 0.120879 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:57.890410 0.360449 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:58.251258 0.227557 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:58.479235 0.058922 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:58.538552 0.174472 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:58.713485 0.242109 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:49:58.955986 0.201383 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 17:54:04.690373 3.004073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 17:54:11.696750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:54:19.698526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:54:35.701248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:55:07.707374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 17:55:31.052366 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 17:55:31.052481 1.149042 tcp 10.0.2.105 56672 -> 128.255.183.224 9027 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/01/21 18:01:11.714272 3.000175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:01:18.722843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:01:26.725173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:01:42.725087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:02:14.731303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:08:18.742472 3.002526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:08:25.752406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:08:33.762785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:08:49.761457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:09:21.774997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:15:25.766370 3.003622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:15:32.768649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:15:40.778543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:15:56.784463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:16:28.786563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:20:04.265700 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 18:20:04.265814 0.063020 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:04.329285 0.469687 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:04.799494 0.180315 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:04.980190 0.172574 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.214009 0.162575 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.377055 0.040457 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.417953 0.057045 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.475461 0.069791 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.545643 0.335992 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.882063 0.059200 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:05.941614 0.298713 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:06.240660 0.075333 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:06.337013 0.144633 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:06.481998 0.044178 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:06.533137 0.166519 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:06.700023 0.303401 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.003912 0.120920 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.125258 0.181201 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.306934 0.141687 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.449008 0.355825 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.805261 0.173195 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:07.978929 0.058151 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:08.037553 0.173681 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:08.211658 0.238618 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:20:08.450715 0.199495 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:22:32.794963 3.007506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:22:39.805089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:22:47.805540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:23:03.810488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:23:35.807608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:25:32.201073 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 18:25:32.201171 1.175778 tcp 10.0.2.105 56673 -> 128.255.183.224 9027 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/01/21 18:29:39.809106 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:29:46.816457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:29:54.821493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:30:10.821187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:30:42.836900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:36:46.844454 3.002110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:36:53.850888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:37:01.851939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:37:17.854637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:37:49.862900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:45:10.867916 3.001347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:45:17.875152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:45:25.876731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:45:41.879087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:46:13.886714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:50:28.862616 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 18:50:28.862788 0.179743 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.042939 0.170192 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.213581 0.072289 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.286296 0.144317 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.430953 0.155927 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.587319 0.040323 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.628170 0.057310 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.685856 0.070494 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:29.756780 0.337340 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.094457 0.060903 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.155741 0.287529 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.443685 0.077362 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.521510 0.137885 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.659775 0.045765 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.706157 0.166290 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:30.872880 0.213585 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.086923 0.120329 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.207702 0.361298 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.569565 0.170046 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.740048 0.059103 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.799570 0.170622 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:31.970608 0.179497 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:32.150506 0.174435 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:32.325378 0.258830 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:50:32.584753 0.174751 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 18:52:26.895339 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:52:33.902697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:52:41.904521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:52:57.907454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:53:29.913933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:55:33.381127 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 18:55:33.381227 1.453738 tcp 10.0.2.105 56674 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/21 18:59:33.918715 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 18:59:40.925546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 18:59:48.927604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:00:04.930089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:00:36.936715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:06:40.943127 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:06:47.949994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:06:55.952738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:07:11.954779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:07:43.961985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:13:47.966391 3.001791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:13:54.973864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:14:02.975578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:14:18.978833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:14:50.984419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:20:49.400968 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 19:20:49.401056 0.180184 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:49.581648 0.171664 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:49.753720 0.064586 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:49.818661 0.143784 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:49.962873 0.155825 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.119157 0.037951 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.157631 0.060954 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.218930 0.068743 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.288209 0.347522 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.636096 0.062307 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.698864 0.296789 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:50.996100 0.076323 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.072775 0.144786 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.218409 0.039595 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.258396 0.168559 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.427374 0.204848 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.632654 0.119003 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.752050 0.095692 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:51.848220 0.199972 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:52.048808 0.180281 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:52.229482 0.359585 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:52.589471 0.172085 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:52.761933 0.164180 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:53.013234 0.140854 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:53.154551 0.220731 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:20:54.991208 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:21:02.084753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:21:10.016453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:21:26.012713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:21:58.019520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:25:34.840852 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 19:25:34.840957 1.293583 tcp 10.0.2.105 56675 -> 128.255.183.224 9027 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/01/21 19:28:02.025885 3.000093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:28:09.031831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:28:17.033390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:28:33.036503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:29:05.042554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:35:09.053810 2.996753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:35:16.056720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:35:24.057514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:35:40.062464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:36:12.066920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:42:16.072492 3.001362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:42:23.079972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:42:31.082876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:42:47.084039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:43:19.092265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:49:23.098768 2.999163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 19:49:30.104603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:49:38.109513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:49:54.108572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:50:26.115187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:51:23.417294 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 19:51:23.417530 0.064816 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:23.482820 0.146924 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:23.630079 0.307462 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:23.937937 0.039328 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:23.977657 0.062335 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:24.040535 0.181297 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:24.222297 0.209237 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:24.431982 0.293014 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:24.725366 0.337083 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.062826 0.058124 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.121390 0.302103 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.423929 0.083226 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.507554 0.151365 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.659407 0.039305 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.699089 0.167977 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:25.867433 0.207711 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.075493 0.120954 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.196852 0.065120 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.263538 0.163343 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.427329 0.179430 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.607127 0.164236 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.771745 0.143251 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:26.915423 0.360242 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:27.276167 0.165147 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:51:27.441769 0.244844 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/21 19:55:36.140600 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 19:55:36.140705 1.169482 tcp 10.0.2.105 56676 -> 128.255.183.224 9027 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/21 19:56:30.121271 3.001001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 19:56:37.127852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:56:45.129265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:57:01.134578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 19:57:33.138413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:03:37.146397 2.999577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:03:44.151990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:03:52.153298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:04:08.155916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:04:40.162268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:10:44.169311 3.043395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:10:51.197532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:10:59.187829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:11:15.192640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:11:47.201692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:17:51.202223 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:17:58.209845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:18:06.211096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:18:22.214027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:18:54.221188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:21:41.060829 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 20:21:41.060945 0.067454 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.128889 0.266317 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.395578 0.162196 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.558203 0.041486 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.600131 0.059917 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.660479 0.183016 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:41.843922 0.336998 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.181355 0.060256 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.242043 0.173778 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.416245 0.071516 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.488147 0.287175 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.775764 0.075912 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.852073 0.144386 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:42.996886 0.038887 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.036145 0.165724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.202217 0.207256 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.409890 0.120493 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.530803 0.179372 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.710573 0.164009 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:43.874968 0.142979 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:44.018428 0.066857 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:44.085744 0.170407 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:44.256576 0.221632 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:44.478602 0.363574 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:21:44.842580 0.168719 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:24:58.225700 3.002401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:25:05.233622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:25:13.237432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:25:29.241508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:25:37.311818 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 20:25:37.311925 1.114269 tcp 10.0.2.105 56677 -> 128.255.183.224 9027 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/21 20:26:01.243620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:32:05.251598 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:32:12.257708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:32:20.259284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:32:36.262742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:33:08.268237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:39:12.274762 3.001047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:39:19.281593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:39:27.282714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:39:43.286088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:40:15.304840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:46:25.317975 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:46:32.324130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:46:40.326332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:46:56.330560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:47:28.342517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:51:55.379255 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 20:51:55.379474 0.066750 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:55.446685 0.038905 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:55.486000 0.068767 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:55.555209 0.180009 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:55.809749 0.339089 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.149294 0.147813 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.297469 0.155777 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.453651 0.060422 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.514475 0.170614 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.685584 0.070057 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:56.756003 0.288937 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.045371 0.081182 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.127066 0.144671 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.272210 0.044962 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.317610 0.169471 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.487530 0.205174 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.693070 0.119536 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.813027 0.180755 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:57.994172 0.163889 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:58.158493 0.138770 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:58.297685 0.062260 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:58.360476 0.361356 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:58.722276 0.193130 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:58.915801 0.180650 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:51:59.096898 0.240344 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 20:53:32.351127 3.001540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 20:53:39.358065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:53:47.359561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:54:03.362787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:54:35.378944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 20:55:38.429818 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 20:55:38.429917 1.339107 tcp 10.0.2.105 56678 -> 128.255.183.224 9027 FSPA* 0 0 14 1700 flow=From-Botnet-V2-TCP-Established 1970/01/21 21:00:39.385057 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:00:46.392372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:00:54.394740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:01:10.397554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:01:42.403661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:07:46.408997 3.003218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:07:53.416118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:08:01.418543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:08:17.420712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:08:49.427190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:14:53.433094 3.001218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:15:00.440503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:15:08.441538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:15:24.444678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:15:56.450750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:22:00.458084 3.000134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:22:07.465664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:22:13.983749 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 21:22:13.983999 0.061523 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.045922 0.182320 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.228649 0.335669 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.564705 0.069841 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.635026 0.040894 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.676267 0.149153 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.825872 0.155549 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:14.981866 0.061022 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.043336 0.170965 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.214745 0.074166 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.289333 0.297910 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.467984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:22:15.587695 0.081392 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.669517 0.144745 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.814688 0.039369 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:15.854472 0.167045 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:16.021944 0.205242 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:16.227643 0.120215 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:16.348952 0.172887 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:16.522275 0.163802 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:16.686544 0.364947 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:17.051865 0.171830 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:17.224138 0.175498 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:17.400055 0.143619 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:17.544130 0.084488 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:17.629074 1.973637 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:22:31.469477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:23:03.474595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:25:39.769974 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 21:25:39.770086 0.942859 tcp 10.0.2.105 56679 -> 128.255.183.224 9027 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/01/21 21:29:07.481170 3.001210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:29:14.487826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:29:22.489668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:29:38.492528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:30:10.498523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:36:14.505803 3.000451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:36:21.511782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:36:29.513772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:36:45.516306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:37:17.522459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:44:50.537115 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:44:57.543353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:45:05.721168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:45:21.577477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:45:53.564567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:52:06.575896 2.998628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:52:13.580848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:52:21.582253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:52:37.586219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:52:42.403628 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 21:52:42.403712 0.059063 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:42.463253 0.181807 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:42.645473 0.337809 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:42.983846 0.067536 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.051826 0.039255 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.091518 0.144700 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.236679 0.163526 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.485177 0.058841 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.544445 0.170883 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.715745 0.070040 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:43.786137 0.292089 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.078632 0.072484 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.151564 0.144610 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.296748 0.039547 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.336712 0.169022 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.506096 0.207121 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.713591 0.121140 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:44.835116 0.174932 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.010473 0.163453 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.174352 0.361323 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.536102 0.224015 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.760715 0.062874 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.824009 0.172419 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:45.996868 0.143210 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:52:46.140511 1.668562 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/21 21:53:09.591388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:55:40.719431 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 21:55:40.719666 0.993975 tcp 10.0.2.105 56680 -> 128.255.183.224 9027 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/21 21:59:13.597608 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 21:59:20.605751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:59:28.606197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 21:59:44.609279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:00:16.614869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:06:20.621991 3.000517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:06:27.628763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:06:35.630515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:06:51.633448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:07:23.639199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:13:27.646579 3.382821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:13:35.000708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:13:42.931974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:13:58.802910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:14:30.757758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:20:34.739093 3.006669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:20:41.747981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:20:49.748222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:21:05.752943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:21:37.757440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:23:03.281617 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 22:23:03.281900 0.716841 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:03.999204 0.063441 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.063034 0.041021 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.104511 0.144678 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.249649 0.060401 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.310529 0.181112 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.492087 0.162435 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.654968 0.059845 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:04.715220 0.179008 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.041438 0.072944 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.114755 0.306434 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.421628 0.076332 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.498318 0.145015 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.643779 0.040391 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.684525 0.166068 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:05.850948 0.206732 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.058029 0.118794 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.177237 0.180535 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.358126 0.164574 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.523112 0.179787 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.703343 0.172322 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:06.876025 0.146458 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:07.022934 0.361458 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:07.384816 0.171921 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:23:07.557080 0.242606 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:25:41.778871 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 22:25:41.778972 1.267401 tcp 10.0.2.105 56681 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/21 22:27:41.765141 2.999970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 22:27:48.770700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:27:56.771865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:28:12.778154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:28:44.781288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:34:48.787425 3.001451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:34:55.794746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:35:03.795639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:35:19.798790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:35:51.805987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:41:55.810912 3.002219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:42:02.819507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:42:10.820041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:42:26.823296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:42:58.828994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:49:02.835605 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 22:49:09.843156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:49:17.844319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:49:33.847095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:50:05.853246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:53:24.239202 0.000207 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 22:53:24.239521 0.043782 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:24.283809 0.147271 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:24.431529 0.055696 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:24.487710 0.357036 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:24.845112 0.066158 udp 10.0.2.105 7010 <-> 31.52.40.81 8321 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:24.911665 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 22:53:39.954032 0.086005 tcp 10.0.2.105 56682 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 22:53:40.040247 0.053843 tcp 10.0.2.105 56683 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 22:53:40.094406 0.402282 tcp 10.0.2.105 56684 -> 195.113.214.236 443 SRPA* 0 0 33 24328 flow=From-Botnet-V2-TCP-Established 1970/01/21 22:53:40.497220 0.155860 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:40.653488 0.057806 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:40.711626 0.170297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:40.951104 0.074750 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.026441 0.287828 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.314702 0.076818 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.391952 0.144852 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.537222 0.045806 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.583444 0.172988 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.756814 0.205831 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:41.963100 0.120681 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.084210 0.059047 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.143745 0.172598 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.316746 0.144990 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.462201 0.185115 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.647769 0.164298 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:42.812521 0.609881 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:43.422802 0.360886 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:53:43.784083 0.210770 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/21 22:55:43.048581 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 22:55:43.048667 0.947197 tcp 10.0.2.105 56685 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/21 22:56:09.860311 3.001078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/21 22:56:16.867129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:56:24.877543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:56:40.881314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 22:57:12.887167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:03:16.893550 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:03:23.900615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:03:31.902176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:03:47.905773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:04:19.911449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:10:23.919341 2.999300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:10:30.923983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:10:38.933121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:10:54.929543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:11:26.935127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:17:30.943248 3.000674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:17:37.949797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:17:45.951584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:18:01.963020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:18:33.968905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:23:50.896554 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:23:50.896701 0.180999 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:23:51.078063 0.042331 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:23:51.120781 0.378536 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:23:51.499735 0.000000 udp 10.0.2.105 7010 -> 31.52.40.81 8321 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:24:07.262453 0.054017 tcp 10.0.2.105 56686 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:24:07.316275 0.054242 tcp 10.0.2.105 56687 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:24:07.370272 0.143755 tcp 10.0.2.105 56688 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:24:07.514742 0.144607 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:07.659774 0.062523 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:07.722757 0.058816 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:07.782023 0.171347 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:07.953764 0.074399 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.028579 0.295315 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.324370 0.161638 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.486450 0.074719 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.561531 0.144926 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.706864 0.038852 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.746161 0.166898 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:08.913502 0.204219 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.118177 0.158523 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.277145 0.063547 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.341153 0.169309 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.510899 0.166779 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.678071 0.140244 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.818748 0.177214 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:09.996434 0.165008 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:10.161872 0.669891 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:10.832149 1.989683 udp 10.0.2.105 7010 <-> 114.24.74.190 7701 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:24:37.974684 3.002547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:24:44.982971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:24:52.997986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:25:08.996693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:25:41.004849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:25:43.997913 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:25:43.998004 1.191777 tcp 10.0.2.105 56689 -> 128.255.183.224 9027 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:31:45.009352 3.047067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:31:52.042405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:32:00.028070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:32:16.031239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:32:48.042572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:38:52.045807 2.999672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:38:59.050846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:39:07.051893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:39:23.055224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:39:55.061744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:46:12.076161 3.001242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:46:19.083354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:46:27.087605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:46:43.087520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:47:15.093454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:53:19.103694 2.997540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/21 23:53:26.107138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:53:34.109045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:53:50.111941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:54:14.849289 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:54:14.849532 0.000000 udp 10.0.2.105 7010 -> 31.52.40.81 8321 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:54:22.121754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/21 23:54:33.679328 0.053999 tcp 10.0.2.105 56690 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:33.733623 0.082710 tcp 10.0.2.105 56691 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:33.816179 0.149733 tcp 10.0.2.105 56692 -> 195.113.214.236 443 SRPA* 0 0 39 22570 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:33.966137 0.180920 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.147430 0.045319 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.193112 0.411499 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.605024 0.149608 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.755049 0.058684 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.814147 0.059560 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:34.874130 0.171337 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.045916 0.072044 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.118347 0.289513 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.408229 0.155765 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.564448 0.077596 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.642488 0.145201 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.788137 0.055648 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:35.844239 0.167547 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.012208 0.206065 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.218641 0.179905 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.398920 0.165169 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.564574 0.143835 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.708860 0.176452 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:36.885736 0.165732 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:37.051933 0.059254 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:37.111640 0.173475 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:37.285545 0.812997 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:54:38.098952 0.000000 udp 10.0.2.105 7010 -> 114.24.74.190 7701 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:54:53.506438 0.052780 tcp 10.0.2.105 56693 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:53.559062 0.054194 tcp 10.0.2.105 56694 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:53.613559 0.138876 tcp 10.0.2.105 56695 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:54:54.141632 0.000000 udp 10.0.2.105 7010 -> 114.24.74.190 7701 REQ 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:01.224063 0.041671 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 846 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:01.304197 0.179137 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:01.507111 0.150957 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:01.658584 0.047661 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:01.706663 0.056816 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:01.897868 0.172260 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:02.070684 0.068674 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:02.232913 0.396540 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:02.629925 0.070459 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:02.700944 0.144970 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:02.846407 0.289205 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:03.136179 0.157911 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:03.294609 0.164569 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:03.459729 0.208724 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:03.893207 0.048380 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:03.942127 0.165340 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:04.108024 0.143127 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:04.317809 0.178083 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.021467 0.161786 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 857 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.183834 0.062499 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.246910 0.168926 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.416496 0.150167 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.567096 0.297418 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:55:05.865068 0.000000 udp 10.0.2.105 7010 -> 50.193.105.14 3113 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:13.764928 0.000000 udp 10.0.2.105 7010 -> 59.97.24.76 6537 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:18.278847 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:55:21.493521 0.000000 udp 10.0.2.105 7010 -> 88.87.114.148 4253 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:27.953647 0.000000 udp 10.0.2.105 7010 -> 94.3.187.109 8052 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:34.572831 0.000000 udp 10.0.2.105 7010 -> 188.76.173.179 1447 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:41.747419 0.190002 udp 10.0.2.105 7010 -> 70.184.105.18 7433 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:41.937421 0.000000 icmp 70.184.105.18 0x0303 -> 10.0.2.105 0x091d URP 192 1 299 flow=Background 1970/01/21 23:55:45.343401 1.201724 tcp 10.0.2.105 56696 -> 128.255.183.224 9027 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/01/21 23:55:49.293525 0.000000 udp 10.0.2.105 7010 -> 71.43.15.18 9376 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:55:55.595423 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1613 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:01.696064 0.000000 udp 10.0.2.105 7010 -> 2.50.16.104 7480 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:09.264605 0.000000 udp 10.0.2.105 7010 -> 86.149.212.160 7502 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:13.887888 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:56:14.958468 0.000000 udp 10.0.2.105 7010 -> 92.24.42.123 4979 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:20.380952 0.000000 udp 10.0.2.105 7010 -> 77.44.71.222 3807 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:25.682291 0.000000 udp 10.0.2.105 7010 -> 115.22.126.66 1425 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:31.333410 0.000000 udp 10.0.2.105 7010 -> 114.134.95.210 6595 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:39.906067 0.071203 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:56:40.185866 0.000000 udp 10.0.2.105 7010 -> 91.93.125.155 1250 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:44.782571 0.046985 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:56:46.325773 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:51.413985 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:56:58.492829 0.000000 udp 10.0.2.105 7010 -> 41.133.220.75 6446 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:06.964893 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 1432 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:11.781501 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:57:14.836724 0.000000 udp 10.0.2.105 7010 -> 108.193.232.163 2885 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:23.720095 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:30.418932 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:37.330665 0.055541 udp 10.0.2.105 7010 -> 81.183.223.209 2596 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:37.386206 0.000000 icmp 81.183.223.209 0x0303 -> 10.0.2.105 0x240a URP 192 1 253 flow=Background 1970/01/21 23:57:42.285219 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:57:46.301449 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:57:54.933976 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:00.511820 0.135910 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/21 23:58:00.832040 0.000000 udp 10.0.2.105 7010 -> 94.68.152.241 6497 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:07.872365 0.117266 udp 10.0.2.105 7010 -> 149.200.189.151 4432 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:07.989631 0.000000 icmp 149.200.189.151 0x0303 -> 10.0.2.105 0x5011 URP 192 1 186 flow=Background 1970/01/21 23:58:12.780027 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:58:14.812479 0.000000 udp 10.0.2.105 7010 -> 93.64.195.65 1367 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:20.730895 0.000000 udp 10.0.2.105 7010 -> 93.193.156.135 7662 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:29.336866 0.000000 udp 10.0.2.105 7010 -> 89.28.59.170 7723 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:36.133570 0.257564 udp 10.0.2.105 7010 -> 122.163.44.48 6258 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:36.391134 0.000000 icmp 122.163.44.48 0x0303 -> 10.0.2.105 0x7218 URP 192 1 273 flow=Background 1970/01/21 23:58:40.779556 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:58:42.542541 0.000000 udp 10.0.2.105 7010 -> 98.113.158.137 1210 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:51.056067 0.000000 udp 10.0.2.105 7010 -> 84.253.45.7 2075 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:58:56.582821 0.000000 udp 10.0.2.105 7010 -> 195.72.202.66 1964 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:05.235903 0.000000 udp 10.0.2.105 7010 -> 81.38.206.89 5622 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:09.781391 0.031171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:59:10.852729 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 4027 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:17.772987 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:22.820243 0.000000 udp 10.0.2.105 7010 -> 119.74.203.111 4508 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:31.622785 0.000000 udp 10.0.2.105 7010 -> 96.237.109.8 9774 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:36.279832 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/21 23:59:38.742906 0.000000 udp 10.0.2.105 7010 -> 74.124.40.40 5564 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:46.244958 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:51.812123 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/21 23:59:56.899388 0.000000 udp 10.0.2.105 7010 -> 92.230.27.100 7936 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:01.785920 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:00:03.078149 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:09.696981 0.000000 udp 10.0.2.105 7010 -> 95.242.22.131 2220 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:16.618076 0.000000 udp 10.0.2.105 7010 -> 213.133.203.3 4763 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:24.919951 0.000000 udp 10.0.2.105 7010 -> 103.29.116.166 4235 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:27.051258 2.971957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 00:00:30.664848 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:00:32.955499 0.000000 udp 10.0.2.105 7010 -> 87.17.52.16 4147 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:33.990652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:00:39.722932 0.000000 udp 10.0.2.105 7010 -> 87.181.116.248 4995 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:41.966474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:00:47.138719 0.060365 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:00:47.432836 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:55.295437 0.110506 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:00:55.716125 0.249790 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:00:56.361903 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:00:57.803376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:00:59.910306 0.714444 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:01:03.218985 0.147585 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:01:03.498084 0.000000 udp 10.0.2.105 7010 -> 59.90.238.151 4228 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:10.842879 0.000000 udp 10.0.2.105 7010 -> 12.181.169.190 7070 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:16.698694 0.000000 udp 10.0.2.105 7010 -> 82.51.118.168 2254 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:23.583923 0.138952 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:01:24.335086 0.000000 udp 10.0.2.105 7010 -> 111.68.47.165 6946 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:28.305396 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:01:30.157776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:01:30.416058 0.000000 udp 10.0.2.105 7010 -> 89.106.30.18 8755 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:35.975580 0.000000 udp 10.0.2.105 7010 -> 31.192.22.145 4544 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:41.493426 0.000000 udp 10.0.2.105 7010 -> 87.29.160.27 4614 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:48.200061 0.182841 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:01:48.643993 0.000000 udp 10.0.2.105 7010 -> 92.44.215.8 5953 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:01:53.031384 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:01:55.644558 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:04.252917 0.000000 udp 10.0.2.105 7010 -> 219.76.180.82 1031 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:11.115225 0.000000 udp 10.0.2.105 7010 -> 77.85.145.192 1708 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:16.468369 0.000000 udp 10.0.2.105 7010 -> 105.224.210.33 4041 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:21.199323 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:02:22.177723 0.138929 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:02:22.359995 0.178423 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:02:22.620698 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:30.794902 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 8239 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:39.153768 0.000000 udp 10.0.2.105 7010 -> 173.8.192.113 3486 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:45.197374 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:49.851079 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:02:50.252005 0.014068 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:02:50.843186 0.000000 udp 10.0.2.105 7010 -> 86.170.231.103 1734 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:02:56.798270 0.000000 udp 10.0.2.105 7010 -> 94.29.176.171 6956 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:02.315788 0.000000 udp 10.0.2.105 7010 -> 182.64.19.226 7263 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:09.025233 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:13.782148 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:03:16.228100 0.000000 udp 10.0.2.105 7010 -> 122.162.12.28 9031 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:23.148976 0.000000 udp 10.0.2.105 7010 -> 175.141.166.84 1351 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:32.138862 0.000000 udp 10.0.2.105 7010 -> 62.244.93.73 4418 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:39.449103 0.056009 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:39.505112 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 253 flow=Background 1970/01/22 00:03:44.288143 0.145684 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:03:48.554646 0.000000 udp 10.0.2.105 7010 -> 46.185.141.18 7209 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:03:57.021363 0.076298 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:03:57.594589 0.000000 udp 10.0.2.105 7010 -> 217.254.183.128 8882 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:03.323091 0.255599 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:04:04.125849 0.121486 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:04:04.656612 0.199476 udp 10.0.2.105 7010 <-> 172.248.133.192 7891 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:04:04.879920 0.000000 udp 10.0.2.105 7010 -> 86.112.66.47 7140 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:08.280560 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:04:13.781497 0.000000 udp 10.0.2.105 7010 -> 79.43.115.99 9533 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:20.688286 0.000000 udp 10.0.2.105 7010 -> 165.145.81.35 9653 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:27.622797 0.740797 udp 10.0.2.105 7010 -> 176.19.4.63 2119 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:28.363594 0.000000 icmp 176.19.4.63 0x0303 -> 10.0.2.105 0x4708 URP 192 1 226 flow=Background 1970/01/22 00:04:32.284423 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:04:36.291101 0.000000 udp 10.0.2.105 7010 -> 95.253.49.84 4852 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:41.818721 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:49.029027 0.000000 udp 10.0.2.105 7010 -> 88.71.108.24 4663 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:04:56.960003 0.000000 udp 10.0.2.105 7010 -> 66.97.58.230 1180 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:01.777321 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:05:04.521687 0.337249 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:05.117731 0.000000 udp 10.0.2.105 7010 -> 121.6.15.110 1056 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:13.084946 0.000000 udp 10.0.2.105 7010 -> 213.131.36.242 6857 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:19.593131 0.318099 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:20.086130 0.000000 udp 10.0.2.105 7010 -> 84.173.1.239 7912 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:27.344512 0.144676 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:28.465234 0.000000 udp 10.0.2.105 7010 -> 92.8.87.117 8430 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:32.282785 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:05:37.288773 0.214449 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:37.551557 0.000000 udp 10.0.2.105 7010 -> 63.239.36.210 7639 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:45.783003 0.000000 udp 10.0.2.105 7010 -> 83.7.69.191 6420 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:50.824885 0.000000 udp 10.0.2.105 7010 -> 182.71.150.234 2702 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:57.612446 0.044094 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:57.879419 0.219848 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:05:58.134467 0.342025 udp 10.0.2.105 7010 -> 36.231.193.109 7095 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:05:58.476492 0.000000 icmp 36.231.193.109 0x0303 -> 10.0.2.105 0xb71b URP 192 1 168 flow=Background 1970/01/22 00:06:02.283954 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:06:03.556190 0.000000 udp 10.0.2.105 7010 -> 95.243.90.229 3701 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:11.348637 0.000000 udp 10.0.2.105 7010 -> 80.176.129.156 2252 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:17.667578 0.000000 udp 10.0.2.105 7010 -> 68.228.9.45 9440 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:26.119032 0.000000 udp 10.0.2.105 7010 -> 80.11.185.19 5437 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:30.785304 0.000920 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:06:34.390747 0.000000 udp 10.0.2.105 7010 -> 78.171.107.229 6133 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:40.871851 0.000000 udp 10.0.2.105 7010 -> 116.15.11.219 3888 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:48.942860 0.000000 udp 10.0.2.105 7010 -> 86.147.140.159 6086 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:55.150732 0.210040 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:06:55.360772 0.000000 icmp 69.234.20.39 0x0303 -> 10.0.2.105 0xb61d URP 192 1 131 flow=Background 1970/01/22 00:06:59.776783 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:07:04.124158 0.000000 udp 10.0.2.105 7010 -> 108.12.169.24 5397 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:07:11.393804 0.358687 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:07:12.164328 0.000000 udp 10.0.2.105 7010 -> 176.248.156.39 4063 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:07:18.984995 0.000000 udp 10.0.2.105 7010 -> 162.227.185.50 9012 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:07:23.781549 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:07:33.159545 3.000608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 00:07:40.165129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:07:48.166949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:08:04.169686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:08:36.175589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:14:40.182335 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:14:47.189903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:14:55.193273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:15:11.193407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:15:43.200380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:21:47.208518 2.999632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:21:54.213649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:22:02.213966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:22:18.217657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:22:50.224904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:25:46.197085 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:25:46.197381 1.279281 tcp 10.0.2.105 56697 -> 128.255.183.224 9027 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/01/22 00:28:54.230546 3.000695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:29:01.237000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:29:09.239255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:29:25.241677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:29:57.248396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:36:01.253299 3.003595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:36:08.261273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:36:16.262649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:36:32.265721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:37:04.271654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:37:28.116437 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:37:28.116549 0.039317 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.156435 0.145572 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.302426 0.061712 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.364547 0.058767 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.423721 0.171680 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.595798 0.082056 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:28.678274 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 00:37:43.790335 0.054058 tcp 10.0.2.105 56698 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 00:37:43.844764 0.053373 tcp 10.0.2.105 56699 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 00:37:43.898419 0.129138 tcp 10.0.2.105 56700 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/22 00:37:44.028579 0.349185 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:44.378234 0.079180 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:44.457809 0.144601 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:44.602868 0.292689 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:44.895986 0.162519 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.058947 0.163624 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.223009 0.141354 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.364802 0.166286 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.531502 0.204958 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.736873 0.039943 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.777173 0.058713 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:45.836251 0.173565 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:46.010185 0.492144 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:46.502817 0.150365 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:46.653760 1.055414 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:47.709601 0.170723 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:47.880702 0.070287 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:47.951453 0.134184 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.086070 0.062838 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.149344 0.236842 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.417474 0.066231 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.484386 0.142163 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.626946 0.138299 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.765685 0.182665 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:48.948728 0.172858 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.122008 0.136226 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.258608 0.014784 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.273786 0.081465 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.355682 0.243871 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.599987 0.120621 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.721066 0.211085 udp 10.0.2.105 7010 <-> 172.248.133.192 7891 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:49.932630 0.316650 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:50.249704 0.318061 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:50.568215 0.141339 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:50.709983 0.210012 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:50.920604 0.214367 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:51.135397 0.042248 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:37:51.178058 0.315248 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 00:44:40.281226 3.000093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:44:47.287405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:44:55.288908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:45:11.291472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:45:43.298073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:51:55.306102 3.799143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:52:03.063843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:52:10.986238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:52:26.815974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:52:58.461407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:55:47.476933 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 00:55:47.477024 1.148722 tcp 10.0.2.105 56701 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/22 00:59:02.340137 3.001289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 00:59:09.346796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:59:17.348578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 00:59:33.351994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:00:05.357223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:06:09.364384 3.000669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:06:16.371965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:06:24.372646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:06:40.375496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:07:12.381308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:07:53.855729 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 01:07:53.855845 0.180495 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.036796 0.093567 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.130793 0.144464 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.275688 0.072859 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.348999 0.055698 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.405142 0.062604 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.468169 0.172326 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:54.640961 0.376715 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.018118 0.082236 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.100804 0.145714 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.246963 0.287102 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.534501 0.155659 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.690532 0.164072 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:55.855109 0.205826 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.061393 0.045650 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.107489 0.058104 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.166029 0.182842 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.349303 0.144356 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.494071 0.165503 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.660005 0.169195 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.829645 0.121722 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:56.951820 0.881113 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:57.833385 0.163701 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:57.997503 0.068551 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.066459 0.131898 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.198865 0.062942 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.262208 0.140306 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.457286 0.139180 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.596903 0.181610 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.778957 0.170510 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:58.949837 0.136100 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.086299 0.014733 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.101417 0.236117 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.337963 0.069691 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.408092 0.072899 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.481416 0.240273 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.722123 0.121366 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:07:59.843926 0.210954 udp 10.0.2.105 7010 <-> 172.248.133.192 7891 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:00.055265 0.284361 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:00.340079 0.214063 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:00.554572 0.215784 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:00.770837 0.041699 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:00.812895 0.317654 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:01.131010 0.142399 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:08:01.273880 0.312631 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:13:16.390159 3.000220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:13:23.395068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:13:31.395965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:13:47.399299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:14:19.405264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:20:23.412085 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:20:30.420763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:20:38.420087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:20:54.426631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:21:26.432943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:25:48.626539 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 01:25:48.626636 1.476270 tcp 10.0.2.105 56702 -> 128.255.183.224 9027 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/01/22 01:27:30.440663 2.996311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:27:37.443238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:27:45.443882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:28:01.447015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:28:33.452725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:34:37.459585 3.001675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:34:44.466490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:34:52.468006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:35:08.471253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:35:40.477067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:38:15.821030 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 01:38:15.821135 0.149276 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:15.970894 0.181848 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.153155 0.040269 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.193888 0.117840 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.312112 0.059741 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.372386 0.060557 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.433432 0.171337 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.605190 0.390769 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:16.996557 0.074516 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:17.071511 0.144668 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:17.216663 0.301518 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:17.518614 0.586512 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.105499 0.164164 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.270055 0.205778 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.476283 0.045722 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.522433 0.065220 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.588088 0.164144 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.752675 0.197604 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:18.950714 0.139285 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:19.090471 0.182548 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:19.273468 0.145539 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:19.419450 0.265162 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:19.775031 0.172137 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:19.947625 0.069015 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.017006 0.134908 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.152522 0.063708 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.216640 0.182367 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.399386 0.169421 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.569211 0.134405 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.703986 0.014940 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:20.719271 1.670476 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:22.390160 0.146229 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:22.536732 0.138418 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:22.675514 0.066591 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:22.742481 0.073370 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:22.816430 0.243174 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:23.060083 0.120244 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:23.180747 0.000000 udp 10.0.2.105 7010 -> 172.248.133.192 7891 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 01:38:40.652643 0.054400 tcp 10.0.2.105 56703 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 01:38:40.706891 0.033722 tcp 10.0.2.105 56704 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 01:38:40.740924 0.131514 tcp 10.0.2.105 56705 -> 195.113.214.236 443 SRPA* 0 0 59 36460 flow=From-Botnet-V2-TCP-Established 1970/01/22 01:38:40.872095 0.213882 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:41.086345 0.042156 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:41.128944 0.316635 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:41.445963 0.141883 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:41.588239 0.324723 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:41.913351 0.216109 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:38:42.129885 0.313875 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/22 01:41:44.483837 3.000482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:41:51.490664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:41:59.492951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:42:15.495034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:42:47.503332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:48:51.506465 3.002225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:48:58.514046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:49:06.515923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:49:22.518768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:49:54.524928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:55:50.109014 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 01:55:50.109120 0.985257 tcp 10.0.2.105 56706 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/01/22 01:55:58.530580 3.002217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 01:56:05.537982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:56:13.541975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:56:29.542800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 01:57:01.548939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:03:05.565193 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:03:12.573687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:03:20.574134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:03:36.577183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:04:08.582276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:08:47.618995 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 02:08:47.619148 0.000000 udp 10.0.2.105 7010 -> 172.248.133.192 7891 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 02:09:04.241057 0.053562 tcp 10.0.2.105 56707 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 02:09:04.294872 0.057212 tcp 10.0.2.105 56708 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 02:09:04.352416 0.132997 tcp 10.0.2.105 56709 -> 195.113.214.236 443 SRPA* 0 0 43 23372 flow=From-Botnet-V2-TCP-Established 1970/01/22 02:09:04.483827 0.045253 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:04.529555 0.072179 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:04.602187 0.146953 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:04.749539 0.181322 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:04.931318 0.062698 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:04.994471 0.171687 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.166532 0.350281 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.517250 0.080363 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.598042 0.145089 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.743533 0.058868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.802753 0.161006 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:05.964136 0.294330 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:06.258928 0.167189 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:06.629149 0.039155 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:06.668700 0.104836 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:06.773895 0.165924 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:06.940180 0.228498 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.169048 0.120158 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.289632 0.180826 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.470846 0.205108 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.676357 0.172926 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.849615 0.072637 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:07.922686 0.132251 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.055278 0.060310 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.116033 0.247454 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.363969 0.145419 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.509824 0.136300 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.646490 0.014553 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.661369 0.180959 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:08.842774 0.168583 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.011738 0.214232 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.226402 0.066246 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.293034 0.080313 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.373770 0.246385 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.620583 0.121454 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.742508 0.138992 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:09.881933 0.144953 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:10.027319 0.208538 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:10.236362 0.042934 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:10.279712 0.275611 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:10.555666 0.264288 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:10.820337 0.318066 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:11.138799 0.145882 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:09:11.285136 0.315548 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:10:12.588998 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:10:19.596521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:10:27.602655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:10:43.601082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:11:15.609827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:17:19.613798 3.000608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:17:26.621526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:17:34.622619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:17:50.625105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:18:22.631205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:24:26.647941 3.000637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:24:33.654490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:24:41.656145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:24:57.660004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:25:29.664988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:25:51.096847 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 02:25:51.096971 1.884626 tcp 10.0.2.105 56710 -> 128.255.183.224 9027 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/01/22 02:31:33.671515 3.224454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:31:40.869880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:31:48.802340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:32:04.692642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:32:36.698309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:38:40.705300 3.004628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:38:47.712786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:38:55.713749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:39:11.716737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:39:13.029344 0.329757 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 02:39:13.359291 0.387073 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:13.746878 0.409814 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:14.157088 0.309360 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:14.466839 0.413413 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:14.880656 0.278256 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:15.159366 0.320845 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:15.480677 0.674961 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:16.156077 0.325400 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:16.481848 0.380260 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:16.862520 0.303495 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:17.166425 0.378785 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:17.545665 0.546009 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:18.092114 0.309166 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:18.401703 0.420060 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:18.822207 0.405094 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:19.227793 0.387494 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:19.615723 0.409745 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:20.025927 0.285379 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:20.311727 0.427424 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:20.739591 0.454363 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:21.194863 0.408233 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:21.603545 0.317766 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:21.921784 0.374072 udp 10.0.2.105 7010 <-> 69.159.94.130 5290 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:22.296337 0.301287 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:22.598022 0.395116 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:22.993595 0.233456 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:23.227449 0.382990 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:23.610883 0.416080 udp 10.0.2.105 7010 <-> 99.181.129.28 7576 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:24.027411 0.477597 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:24.505441 0.295648 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:24.801570 0.471464 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:25.273462 0.359059 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:25.632892 0.323798 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:25.957193 0.483927 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:26.441584 0.363993 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:26.806014 0.367418 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:27.173870 0.383135 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:27.557430 0.450788 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:28.008612 0.273355 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:28.282340 0.560440 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:28.843228 0.397899 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:29.241500 0.517641 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:29.759913 0.441004 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:30.201379 0.548720 udp 10.0.2.105 7010 <-> 113.11.31.184 9619 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 02:39:43.784415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:46:08.728925 3.001343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:46:15.736510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:46:23.737345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:46:39.740782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:47:11.746830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:53:15.753182 3.000918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 02:53:22.760448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:53:30.761934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:53:46.768886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:54:18.770958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 02:55:52.987943 1.971052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 02:55:54.959130 1.792118 tcp 10.0.2.105 56711 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:00:22.776457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:00:59.210393 1.968369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/22 03:01:05.128821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:01:13.014986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:01:28.769339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:02:06.989680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:08:05.602742 2.959973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:08:12.510462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:08:20.400761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:08:36.173653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:09:07.690805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:10:24.927763 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 03:10:24.927917 0.309192 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:25.237493 1.006958 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:26.244901 0.400147 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:26.645509 0.308000 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:26.953870 0.410500 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:27.364831 0.280656 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:27.645853 0.922279 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:28.568533 0.292935 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:28.861884 0.390018 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:29.252419 0.314009 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:29.566868 0.399553 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:29.966788 0.528286 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:30.495528 0.300928 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:30.796915 0.411910 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:31.209300 0.418828 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:31.628588 0.381651 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:32.010692 0.404716 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:32.415954 0.296251 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:32.712600 0.407766 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:33.120761 0.446312 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:33.567515 0.414119 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:33.982025 0.319464 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:34.301921 0.000000 udp 10.0.2.105 7010 -> 69.159.94.130 5290 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:10:49.843750 0.544439 tcp 10.0.2.105 56712 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:10:50.388398 0.523807 tcp 10.0.2.105 56713 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:10:50.912114 1.353119 tcp 10.0.2.105 56714 -> 195.113.214.236 443 SRPA* 0 0 38 27329 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:10:52.265903 0.253338 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:52.519793 0.307711 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:52.827967 0.368669 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:53.196997 0.514676 udp 10.0.2.105 7010 <-> 49.248.195.45 5060 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:53.712113 0.394976 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:10:54.107488 0.000000 udp 10.0.2.105 7010 -> 99.181.129.28 7576 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:11:10.865091 0.523681 tcp 10.0.2.105 56715 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:11:11.389052 0.537263 tcp 10.0.2.105 56716 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:11:11.926589 1.102766 tcp 10.0.2.105 56717 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:11:13.030031 0.308412 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:13.338848 0.658452 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:13.997664 0.386129 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:14.384140 0.315794 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:14.700316 0.487073 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:15.187830 0.359981 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:15.548211 0.379037 udp 10.0.2.105 7010 <-> 68.115.137.250 6839 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:15.927720 0.279316 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:16.207467 0.385925 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:16.593850 0.449894 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:17.044347 0.560899 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:17.605619 0.381821 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:17.987816 0.514927 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:18.503127 0.420827 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:11:18.924349 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:11:35.531109 0.535132 tcp 10.0.2.105 56718 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:11:36.066552 0.547646 tcp 10.0.2.105 56719 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:11:36.614457 1.052534 tcp 10.0.2.105 56720 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:15:06.407772 2.959892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 03:15:13.321312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:15:21.211124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:15:36.991425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:16:08.547338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:22:07.344168 2.950062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:22:14.245926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:22:22.132780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:22:37.912482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:23:09.493011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:26:14.723952 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 03:26:14.724109 1.760847 tcp 10.0.2.105 56721 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:29:08.270341 2.963436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:29:15.176130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:29:23.062579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:29:39.200101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:30:10.726576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:36:09.495437 2.953696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:36:16.403100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:36:24.292406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:36:40.053612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:37:11.602226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:41:18.995882 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 03:41:18.995979 0.370400 udp 10.0.2.105 7010 -> 69.159.94.130 5290 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:41:19.366379 0.000000 icmp 69.159.94.130 0x0303 -> 10.0.2.105 0xaa14 URP 192 1 235 flow=Background 1970/01/22 03:41:36.544612 0.527415 tcp 10.0.2.105 56722 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:37.072439 0.532790 tcp 10.0.2.105 56723 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:37.605542 1.344908 tcp 10.0.2.105 56724 -> 195.113.214.236 443 SRPA* 0 0 34 24793 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:38.951103 0.000000 udp 10.0.2.105 7010 -> 99.181.129.28 7576 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:41:55.000763 0.533537 tcp 10.0.2.105 56725 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:55.534600 0.543030 tcp 10.0.2.105 56726 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:56.077921 1.019927 tcp 10.0.2.105 56727 -> 195.113.214.236 443 SRPA* 0 0 23 13182 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:41:57.098573 0.000000 udp 10.0.2.105 7010 -> 113.11.31.184 9619 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:42:13.234318 0.534313 tcp 10.0.2.105 56728 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:13.768970 0.548861 tcp 10.0.2.105 56729 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:14.318119 1.030406 tcp 10.0.2.105 56730 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:15.349206 0.299825 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:15.649417 0.384480 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:16.034282 0.298691 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:16.333410 0.417247 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:16.751081 0.414740 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:17.166251 0.297392 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:17.464102 0.698942 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:18.163527 0.339513 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:18.503481 0.359218 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:18.863135 0.277902 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:19.141531 0.409599 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:19.551586 0.303818 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:19.855887 0.503101 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:20.359385 0.417453 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:20.777296 0.404123 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:21.181835 0.284645 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:21.466912 0.323034 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:21.790378 0.404366 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:22.195221 0.449464 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:22.645062 0.421423 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:23.066903 0.311982 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:23.379377 0.414415 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:23.794235 0.257864 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:24.052696 0.302715 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:24.355913 0.373784 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:24.730129 0.000000 udp 10.0.2.105 7010 -> 49.248.195.45 5060 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:42:42.896441 0.538646 tcp 10.0.2.105 56731 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:43.435351 0.545922 tcp 10.0.2.105 56732 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:43.981542 1.109133 tcp 10.0.2.105 56733 -> 195.113.214.236 443 SRPA* 0 0 26 13972 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:42:45.091381 0.433722 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:45.525525 0.478711 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:46.004610 0.307201 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:46.312377 0.525618 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:46.838423 0.328092 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:47.166892 0.389777 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:47.557067 0.281003 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:42:47.838506 0.000000 udp 10.0.2.105 7010 -> 68.115.137.250 6839 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 03:43:04.018648 0.541176 tcp 10.0.2.105 56734 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:43:04.560125 0.537501 tcp 10.0.2.105 56735 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:43:05.098005 1.039792 tcp 10.0.2.105 56736 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:43:06.138491 0.368755 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:06.507625 0.385741 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:06.893832 0.462100 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:07.356356 0.592356 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:07.949066 0.355041 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:08.304542 0.557488 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:43:08.862454 0.955267 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 03:44:40.975151 2.963792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 03:44:47.876881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:44:55.760826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:45:11.530311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:45:43.075572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:51:51.979445 3.000160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:51:58.985862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:52:06.987193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:52:22.990483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:52:54.996837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:55:56.618241 0.039768 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 03:55:56.658309 1.751088 tcp 10.0.2.105 56737 -> 128.255.183.224 9027 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/01/22 03:58:59.003139 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 03:59:06.009763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:59:19.996588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 03:59:42.616061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:00:14.194438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:06:20.273998 3.897951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:06:28.128403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:06:36.023402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:06:51.807513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:07:23.389977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:13:23.119038 3.072803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:13:30.143772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:13:38.034066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:13:43.671230 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 04:13:43.671339 0.000000 udp 10.0.2.105 7010 -> 49.248.195.45 5060 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:13:53.811548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:14:00.970064 0.537798 tcp 10.0.2.105 56738 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:01.508147 0.531031 tcp 10.0.2.105 56739 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:02.039467 1.356324 tcp 10.0.2.105 56740 -> 195.113.214.236 443 SRPA* 0 0 39 27383 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:03.396556 0.000000 udp 10.0.2.105 7010 -> 68.115.137.250 6839 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:14:20.719219 0.533509 tcp 10.0.2.105 56741 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:21.253000 0.524166 tcp 10.0.2.105 56742 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:21.777429 1.129135 tcp 10.0.2.105 56743 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:14:22.907264 0.387985 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:23.295693 0.445844 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:23.741923 0.361298 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:24.103674 0.591507 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:24.695613 0.368918 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:25.064956 0.553291 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:25.381680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:14:25.618720 0.460872 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:26.079982 0.383433 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:26.463837 0.408598 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:26.872873 0.284086 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:27.157408 0.278688 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:27.436730 0.423813 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:27.861011 0.384432 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:28.245836 0.611876 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:28.858111 0.364270 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:29.222750 0.298317 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:29.521477 0.317627 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:29.839706 0.833331 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:30.673492 0.384801 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:31.058784 0.503886 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:31.563122 0.402697 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:31.966251 0.409900 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:32.376545 0.381813 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:32.758720 0.462089 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:33.221256 0.277002 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:33.498626 0.419438 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:33.918501 0.314416 udp 10.0.2.105 7010 <-> 86.128.160.143 2112 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:34.233376 0.421133 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:34.654872 0.407051 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:35.062300 0.255186 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:35.317913 0.286479 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:35.604802 0.377045 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:35.982240 0.419989 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:36.402664 0.508829 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:36.911927 0.318680 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:37.230969 0.508612 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:37.740023 0.303004 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:38.043411 0.286079 udp 10.0.2.105 7010 <-> 84.143.195.34 4208 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:14:38.329942 0.400609 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:20:24.521823 2.963493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:20:31.431970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:20:39.323505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:20:55.109790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:21:26.666965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:25:58.399788 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 04:25:58.399943 1.842292 tcp 10.0.2.105 56744 -> 128.255.183.224 9027 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:27:27.159047 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:27:34.166001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:27:42.167374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:27:58.170176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:28:30.176065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:34:34.182679 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:34:41.193636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:34:49.191422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:35:05.199056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:35:37.210128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:41:41.217324 3.000531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:41:48.223410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:41:56.225207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:42:12.228242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:42:44.234003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:44:41.453345 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 04:44:41.453456 0.392115 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:41.846005 0.462611 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:42.309060 0.360248 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:42.669711 0.608207 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:43.278290 0.363976 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:43.642694 0.365808 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:44.008934 0.538331 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:44.547669 0.571585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:45.119647 0.293258 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:45.413307 0.311038 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:45.724736 0.276635 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:46.001810 0.419676 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:46.421925 0.408068 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:46.830425 0.283775 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:47.114633 0.750836 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:47.865864 0.385206 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:48.251471 0.322409 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:48.574237 0.303441 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:48.878071 0.414288 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:49.292693 0.526257 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:44:49.819325 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:45:08.683623 0.533323 tcp 10.0.2.105 56745 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:09.217278 0.538231 tcp 10.0.2.105 56746 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:09.755807 1.334083 tcp 10.0.2.105 56747 -> 195.113.214.236 443 SRPA* 0 0 35 23739 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:11.090542 0.418416 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:11.509298 0.415530 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:11.925214 0.000000 udp 10.0.2.105 7010 -> 70.117.22.156 5141 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:45:28.861534 0.535967 tcp 10.0.2.105 56748 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:29.397878 0.517830 tcp 10.0.2.105 56749 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:29.916094 1.122215 tcp 10.0.2.105 56750 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:31.038985 0.000000 udp 10.0.2.105 7010 -> 86.128.160.143 2112 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:45:49.100551 0.531322 tcp 10.0.2.105 56751 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:49.632167 0.605473 tcp 10.0.2.105 56752 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:50.238006 1.290271 tcp 10.0.2.105 56753 -> 195.113.214.236 443 SRPA* 0 0 23 13184 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:45:51.528987 0.321662 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:51.851056 0.422318 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:52.273766 0.316722 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:52.590910 0.583393 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:53.174669 0.625012 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:53.800099 0.445907 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:54.246395 0.382925 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:54.629758 0.425771 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:45:55.055982 0.000000 udp 10.0.2.105 7010 -> 68.20.50.206 6568 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:46:10.371442 0.540555 tcp 10.0.2.105 56754 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:10.912456 0.520544 tcp 10.0.2.105 56755 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:11.433262 1.115064 tcp 10.0.2.105 56756 -> 195.113.214.236 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:12.549044 0.311564 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:46:12.861011 0.000000 udp 10.0.2.105 7010 -> 84.143.195.34 4208 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 04:46:29.018367 0.547020 tcp 10.0.2.105 56757 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:29.565714 0.543299 tcp 10.0.2.105 56758 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:30.109332 1.122456 tcp 10.0.2.105 56759 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:46:31.232499 0.494856 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:46:31.727717 0.333903 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:46:32.062061 0.381484 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/22 04:48:48.241205 3.000903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 04:48:55.247863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:49:03.251713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:49:19.252454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:49:51.263332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:55:55.265447 3.000412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 04:56:00.249437 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 04:56:00.249587 2.672328 tcp 10.0.2.105 56760 -> 128.255.183.224 9027 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/01/22 04:56:02.271696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:56:10.273247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:56:26.276011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 04:56:58.282178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:03:02.288398 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:03:09.295649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:03:17.297360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:03:33.300156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:04:05.306130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:10:09.312149 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:10:16.322835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:10:24.321126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:10:40.324084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:11:12.330291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:16:51.087859 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 05:16:51.088015 0.526220 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:16:51.614675 0.000000 udp 10.0.2.105 7010 -> 70.117.22.156 5141 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 05:17:07.993449 1.172911 tcp 10.0.2.105 56761 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:09.166637 1.170506 tcp 10.0.2.105 56762 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:10.337418 2.112757 tcp 10.0.2.105 56763 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:12.450781 0.000000 udp 10.0.2.105 7010 -> 86.128.160.143 2112 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 05:17:16.341107 2.996787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:17:23.343388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:17:27.560747 1.019472 tcp 10.0.2.105 56764 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:28.580484 0.891027 tcp 10.0.2.105 56765 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:29.471807 1.973923 tcp 10.0.2.105 56766 -> 195.113.214.236 443 SRPA* 0 0 23 13794 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:31.345479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:17:31.446293 0.674574 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:32.121219 0.000000 udp 10.0.2.105 7010 -> 84.143.195.34 4208 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 05:17:47.348541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:17:50.523447 1.084543 tcp 10.0.2.105 56767 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:51.608307 1.146763 tcp 10.0.2.105 56768 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:52.755405 1.989309 tcp 10.0.2.105 56769 -> 195.113.214.236 443 SRPA* 0 0 24 13356 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:17:54.745322 0.567343 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:55.313025 0.569611 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:55.883075 0.493888 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:56.377344 0.791478 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:57.169202 0.652790 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:57.822399 0.560510 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:58.383345 0.728967 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:59.112706 0.573400 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:17:59.713554 0.407569 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:00.121526 0.498844 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:00.620737 0.473407 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:01.094475 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 05:18:18.343416 1.013983 tcp 10.0.2.105 56770 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:18:19.354292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:18:19.357675 1.029975 tcp 10.0.2.105 56771 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:18:20.387991 1.807638 tcp 10.0.2.105 56772 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:18:22.196218 0.435902 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:22.632492 0.538629 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:23.171546 0.846386 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:24.018291 0.557600 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:24.576333 0.468956 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:25.045633 0.556418 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:25.602433 0.475957 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:26.078790 0.651057 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:26.730192 0.565981 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:27.296538 0.593516 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:27.890424 0.463040 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:28.353913 0.556923 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:28.911185 0.382965 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:29.294525 0.590960 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:29.885825 0.553893 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:30.440226 0.566314 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:31.006871 0.485883 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:31.493144 0.613641 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:32.107152 0.496165 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:32.603699 0.611211 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:33.215321 0.451572 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:18:33.667306 0.520250 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:24:23.360892 3.000766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:24:30.372680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:24:38.369200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:24:54.372115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:25:26.377856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:26:02.920848 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 05:26:02.920940 1.999695 tcp 10.0.2.105 56773 -> 128.255.183.224 9027 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:31:30.390872 3.001148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:31:37.431254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:31:45.405343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:32:01.406422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:32:33.412375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:38:37.418060 3.001675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:38:44.425553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:38:58.173810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:39:14.032516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:39:45.620229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:46:05.594273 2.960983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 05:46:12.505487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:46:37.325195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:47:20.353070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:47:51.867319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:50:20.014547 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 05:50:20.014700 0.701253 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:20.716481 0.857643 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:21.574507 0.983774 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:22.558643 0.799874 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:23.358883 0.980258 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:24.339555 0.778323 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:25.118270 1.113460 udp 10.0.2.105 7010 <-> 121.133.182.85 2829 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:26.232157 0.708329 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:26.940848 1.084786 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:28.026121 0.702877 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:28.729347 0.777425 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:29.507168 0.815462 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:30.322976 0.722582 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:31.045953 0.609798 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:31.656127 0.584241 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:32.240711 0.710475 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:32.951727 1.386413 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:34.338504 0.663064 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:35.001934 0.826041 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:35.828412 0.677641 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:36.506441 0.772774 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:37.279548 0.858299 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:38.138203 0.737660 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:38.876229 0.847621 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:39.724161 0.801717 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:40.526211 0.745388 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:50:41.271976 0.000000 udp 10.0.2.105 7010 -> 134.60.38.73 4960 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 05:50:43.638012 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 05:50:56.798958 1.200307 tcp 10.0.2.105 56774 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:50:57.999565 1.188023 tcp 10.0.2.105 56775 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:50:59.187875 2.968227 tcp 10.0.2.105 56776 -> 195.113.214.236 443 SRPA* 0 0 24 13848 flow=From-Botnet-V2-TCP-Established 1970/01/22 05:51:02.156874 0.800414 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:02.957756 0.827535 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:03.785657 0.836867 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:04.622879 0.790393 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:05.413672 0.731655 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:06.145697 0.767385 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:06.913431 0.793637 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:07.707467 0.756459 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:51:08.464543 0.672377 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/22 05:54:37.377656 3.001241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 05:54:44.384199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:54:52.385592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:55:08.388785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:55:40.394922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 05:57:29.782669 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 05:57:29.782763 3.094493 tcp 10.0.2.105 56777 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:01:44.400873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:01:58.333241 1.980946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/22 06:02:04.264580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:02:12.154279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:02:27.944659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:02:59.503898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:08:58.448973 2.961446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 06:09:05.355473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:09:13.251887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:09:29.037856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:10:00.607647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:15:59.662371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:16:41.053847 1.966308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/22 06:16:46.972066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:16:54.853489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:17:10.606194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:17:42.136517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:22:04.880921 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 06:22:04.881103 0.000000 udp 10.0.2.105 7010 -> 134.60.38.73 4960 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 06:22:21.255183 1.411333 tcp 10.0.2.105 56778 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:22.666780 1.169812 tcp 10.0.2.105 56779 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:23.836861 2.375897 tcp 10.0.2.105 56780 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:26.213492 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 06:22:43.693207 1.168902 tcp 10.0.2.105 56781 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:44.862465 1.193218 tcp 10.0.2.105 56782 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:46.056015 2.367057 tcp 10.0.2.105 56783 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:22:48.423661 0.670864 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:22:49.094900 0.964145 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:22:50.059478 0.754342 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:22:50.814254 0.925835 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:22:51.740672 0.796229 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:22:52.537515 0.000000 udp 10.0.2.105 7010 -> 121.133.182.85 2829 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 06:23:07.760866 3.967140 tcp 10.0.2.105 56784 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:23:11.728461 1.155148 tcp 10.0.2.105 56785 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:23:12.883875 2.358197 tcp 10.0.2.105 56786 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:23:15.242603 0.634476 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:16.609141 0.911957 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:17.521461 0.723064 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:18.244888 0.755202 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:19.000607 0.761248 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:19.762204 0.727592 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:20.490250 0.589838 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:21.080501 0.577878 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:21.658754 0.716025 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:22.375176 1.085137 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:23.460726 0.617539 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:24.078659 0.833904 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:24.912936 0.681607 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:25.594948 0.776745 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:26.372081 0.843805 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:27.216273 0.794646 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:28.011278 0.838106 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:28.849813 0.733322 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:29.583573 0.740309 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:30.324291 0.905842 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:31.230499 0.954341 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:32.185207 0.778159 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:32.963819 0.787015 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:33.751210 0.725389 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:34.477013 0.743886 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:35.221308 0.923525 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:36.145263 0.850177 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:36.995789 0.633695 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:23:37.640726 0.000032 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 06:23:43.400165 3.616452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 06:23:50.955431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:23:58.839955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:24:14.611674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:24:49.890146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:28:11.182829 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 06:28:11.182916 3.328901 tcp 10.0.2.105 56787 -> 128.255.183.224 9027 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:30:48.409922 2.955533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 06:30:55.322760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:31:03.210301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:31:18.972647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:31:50.507093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:37:48.946800 2.953113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 06:37:55.844435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:38:03.723973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:38:19.499570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:38:51.029567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:47:44.892251 2.953545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 06:47:51.791996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:47:59.665798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:48:15.430542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:48:46.966232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:53:48.877005 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/01/22 06:53:53.922282 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/01/22 06:53:53.922509 0.180275 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:53:54.103253 0.000000 udp 10.0.2.105 7010 -> 121.133.182.85 2829 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 06:54:10.638682 0.062866 tcp 10.0.2.105 56788 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:54:10.701792 0.055653 tcp 10.0.2.105 56789 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:54:10.757741 0.156114 tcp 10.0.2.105 56790 -> 195.113.214.236 443 SRPA* 0 0 59 38683 flow=From-Botnet-V2-TCP-Established 1970/01/22 06:54:10.914541 0.167343 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:11.082246 0.335091 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:11.417683 0.146220 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:11.564296 0.213210 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:11.777884 0.120377 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:11.898661 0.148710 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.047718 0.327040 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.375159 0.143897 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.519421 0.045746 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.565490 0.216464 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.782400 0.074093 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.856883 0.072838 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.930100 0.058540 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:12.989011 0.170096 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:13.159501 0.623251 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:13.783136 0.144764 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:13.937655 0.084968 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.022964 0.162205 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.185532 0.060108 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.246020 0.302908 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.549272 0.172280 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.721895 0.169173 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.891449 0.047430 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:14.939221 0.175470 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.115060 0.215792 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.331227 0.161925 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.493582 0.136322 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.630336 0.066717 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.697406 0.182586 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.880495 0.065717 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:15.946552 0.255001 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:16.201915 0.078172 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:16.280494 0.144492 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/22 06:54:50.620350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:55:21.616493 1.973339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/22 06:55:27.531299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:55:35.409365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:55:51.166285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:56:22.671528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 06:58:22.475910 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 06:58:22.476066 0.928529 tcp 10.0.2.105 56791 -> 128.255.183.224 9027 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:02:15.242328 2.950167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:02:22.144779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:02:30.024029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:02:45.776974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:03:17.301713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:09:15.783284 2.964316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:09:22.688003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:09:30.575708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:09:46.344057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:10:17.862718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:16:16.479626 2.954884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:16:23.378235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:16:31.256973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:16:47.008448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:17:18.547248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:23:17.180898 2.953635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:23:24.081331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:23:31.964206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:23:47.721442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:24:17.043226 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 07:24:17.043387 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 07:24:19.231215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:24:33.951115 0.052332 tcp 10.0.2.105 56792 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:34.003691 0.054452 tcp 10.0.2.105 56793 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:34.058428 0.152928 tcp 10.0.2.105 56794 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:34.211967 0.144540 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:34.356893 0.225808 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:34.583054 0.166525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:34.749959 0.760906 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:35.511223 0.122222 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:35.633950 0.146131 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:35.780488 0.277758 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.058630 0.192955 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.251976 0.046273 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.298570 0.220274 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.519228 0.066082 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.585673 0.172562 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.758599 0.075260 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.834240 0.071062 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:36.905743 0.354080 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.260178 0.144630 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.405178 0.074672 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.480467 0.163133 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.643991 0.058911 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.703247 0.295336 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:37.998974 0.167364 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.166773 0.121295 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.288493 0.039552 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.328449 0.182783 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.511569 0.206933 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.718872 0.274919 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:38.994192 0.135744 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:39.130354 0.061994 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:39.192680 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 3760 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 07:24:56.817680 0.049245 tcp 10.0.2.105 56795 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:56.867240 0.053577 tcp 10.0.2.105 56796 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:56.921089 0.152673 tcp 10.0.2.105 56797 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:24:57.074500 0.102053 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:57.176907 0.143286 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:57.320587 0.182953 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:24:57.503922 0.067039 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:27:50.525573 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 07:27:50.525769 1.007656 tcp 10.0.2.105 56798 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:30:17.837936 2.959242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 07:30:24.740086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:30:32.624420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:30:48.386438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:31:19.901318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:37:18.493803 2.951187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:37:25.399265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:37:33.283782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:37:49.045338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:38:20.578654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:44:20.993586 3.000718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:44:28.000125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:44:36.002167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:44:52.005000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:45:24.011512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:51:28.016463 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 07:51:35.024114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:51:43.025707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:51:59.028758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:52:31.034463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:55:11.806445 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 07:55:11.806600 0.180303 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:11.987300 0.279235 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:12.266896 0.144993 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:12.412449 0.214824 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:12.627680 0.167516 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:12.795571 0.199403 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:12.995405 0.926344 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:13.922133 0.141741 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.064491 0.045700 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.110577 0.280518 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.391512 0.121532 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.513422 0.062565 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.576549 0.207853 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.784945 0.078626 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.863935 0.059548 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:14.923857 0.384165 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:15.308428 0.151665 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:15.460645 0.171020 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:15.632049 0.292250 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:15.924659 0.170690 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.095751 0.153471 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.249618 0.041180 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.291106 0.162646 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.454131 0.082413 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.536900 0.064675 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.601885 0.205745 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.808024 0.166374 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:16.974809 0.139045 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.114235 0.065102 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.179729 0.182253 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.362368 0.180849 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.543609 0.067057 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.611044 0.114626 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:55:17.726054 0.142909 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/22 07:57:38.447246 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 07:57:38.447472 0.977534 tcp 10.0.2.105 56799 -> 128.255.183.224 9027 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/01/22 07:58:35.041616 3.000600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 07:58:42.050634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:58:50.049573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:59:06.053347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 07:59:38.058841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:05:42.065155 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:05:49.073173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:05:57.073641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:06:13.076788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:06:45.082703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:12:49.158375 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:12:56.166083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:13:04.167689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:13:20.171071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:13:52.177104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:19:56.184376 3.000407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:20:03.191139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:20:11.193761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:20:27.199017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:20:59.200903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:25:21.998868 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 08:25:21.999058 0.182380 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:22.181837 0.288803 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:22.471035 0.168686 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:22.640074 0.146689 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:22.787095 0.145078 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:22.932632 0.217973 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:23.150980 0.233686 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:23.385036 0.144357 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:23.529782 0.039721 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:23.569842 0.311183 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:23.881439 0.284750 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.166607 0.071531 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.238504 0.058681 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.297585 0.421772 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.719755 0.121528 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.841707 0.060203 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:24.902323 0.144927 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.047615 0.213119 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.261092 0.298353 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.559801 0.164719 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.724864 0.120447 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.845654 0.045222 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:25.891276 0.162920 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.054512 0.084169 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.139062 0.064397 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.203821 0.207960 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.412130 0.166772 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.579261 0.138927 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.718656 0.062317 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.781379 0.181798 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:26.963583 0.095576 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:27.059580 0.142404 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:27.202418 0.181793 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:25:27.384565 0.150435 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:27:03.205952 3.004655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:27:10.213868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:27:18.215512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:27:34.221255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:27:39.442815 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 08:27:39.442912 0.970155 tcp 10.0.2.105 56800 -> 128.255.183.224 9027 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/01/22 08:28:06.224640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:34:10.231256 3.007231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:34:17.240350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:34:25.245997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:34:41.242839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:35:13.248206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:41:17.255249 3.001544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:41:24.263280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:41:32.263274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:41:48.266691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:42:20.273286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:49:34.279264 3.005612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:49:41.287100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:49:49.288158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:50:05.291816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:50:37.297073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:55:56.407174 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 08:55:56.407336 0.182342 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:56.590095 0.261705 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:56.852198 0.166031 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:57.018586 0.146610 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:57.165588 0.144498 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:57.310447 0.215045 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:57.525899 0.239792 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:57.766063 0.277959 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.044455 0.216691 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.261551 0.071358 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.333283 0.059584 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.393198 0.144575 udp 10.0.2.105 7010 <-> 184.147.201.3 5871 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.538127 0.390352 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:58.928892 0.342103 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.271385 0.122492 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.394277 0.060059 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.454695 0.137667 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.592769 0.199188 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.792370 0.122230 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.915042 0.046303 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:55:59.961669 0.164019 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.126117 0.075195 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.201714 0.063805 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.265880 0.286839 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.553068 0.166208 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.719730 0.205278 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:00.925436 0.172373 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:01.098220 0.135503 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:01.234107 0.060633 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:01.295045 0.183694 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:01.479115 0.000000 udp 10.0.2.105 7010 -> 95.252.221.129 7032 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 08:56:16.596363 0.049514 tcp 10.0.2.105 56801 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 08:56:16.646133 0.051805 tcp 10.0.2.105 56802 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 08:56:16.698172 0.118026 tcp 10.0.2.105 56803 -> 195.113.214.236 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/22 08:56:16.816880 0.144753 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:16.962024 0.180779 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:17.143225 0.068860 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 08:56:50.307410 3.000224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 08:56:57.313694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:57:05.314902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:57:21.317862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 08:57:40.396778 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 08:57:40.396863 0.975446 tcp 10.0.2.105 56804 -> 128.255.183.224 9027 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/01/22 08:57:53.324262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:03:57.330340 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:04:04.337762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:04:12.338921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:04:28.341892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:05:00.347723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:11:04.355070 3.000546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:11:11.361374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:11:19.363077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:11:35.370692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:12:07.372038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:18:11.382188 2.999197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:18:18.385340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:18:26.387116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:18:42.391311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:19:14.395945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:25:18.402128 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:25:25.409750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:25:33.411021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:25:49.413879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:26:21.419662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:26:42.650453 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 09:26:42.650632 0.103871 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:42.754920 0.166645 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:42.921949 0.148464 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:43.070796 0.144294 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:43.215462 0.181689 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:43.397555 0.307847 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:43.705835 0.283314 udp 10.0.2.105 7010 <-> 61.21.238.160 4240 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:43.989500 0.218466 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:44.208387 0.074896 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:44.283682 0.061444 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:44.345491 0.215885 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:44.561765 0.237256 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:44.799428 0.353295 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:45.153121 0.120639 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:45.274139 0.041660 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:26:45.316144 0.000000 udp 10.0.2.105 7010 -> 184.147.201.3 5871 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 09:27:04.243984 0.050508 tcp 10.0.2.105 56805 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:04.294759 0.053368 tcp 10.0.2.105 56806 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:04.348591 0.131508 tcp 10.0.2.105 56807 -> 195.113.214.236 443 SRPA* 0 0 53 47451 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:04.481100 0.172076 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:04.653564 0.120301 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:04.774235 0.044844 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:04.819510 0.156754 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:04.976627 0.075144 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.052126 0.064853 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.117387 0.058488 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.176430 0.137843 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.314644 0.207703 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.522733 0.175455 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.698618 0.135336 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.834327 0.063535 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:05.898258 0.301150 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:06.199806 0.186013 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:06.386245 0.182308 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:06.568904 0.065809 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:06.635180 0.142802 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:27:06.778476 0.000000 udp 10.0.2.105 7010 -> 99.10.189.189 6684 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 09:27:22.758811 0.050076 tcp 10.0.2.105 56808 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:22.809174 0.053970 tcp 10.0.2.105 56809 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:22.863399 0.146864 tcp 10.0.2.105 56810 -> 195.113.214.236 443 SRPA* 0 0 49 41390 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:27:41.376072 1.030786 tcp 10.0.2.105 56811 -> 128.255.183.224 9027 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:32:25.426344 3.001208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 09:32:32.433328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:32:40.434859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:32:56.437919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:33:28.443892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:39:32.450436 3.002223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:39:39.457142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:39:47.458384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:40:03.464238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:40:35.467887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:48:43.481857 3.002111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:48:50.489599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:48:58.490846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:49:14.494092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:49:46.500061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:55:52.511595 2.998406 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 09:55:59.517252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:56:07.517797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:56:23.521065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:56:55.526295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 09:57:38.549318 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 09:57:38.549583 0.000000 udp 10.0.2.105 7010 -> 184.147.201.3 5871 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 09:57:42.405046 0.931486 tcp 10.0.2.105 56812 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:57:55.761325 0.049545 tcp 10.0.2.105 56813 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:57:55.811055 0.051796 tcp 10.0.2.105 56814 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:57:55.863060 0.117001 tcp 10.0.2.105 56815 -> 195.113.214.236 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:57:55.980611 0.184012 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.164983 0.182173 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.347466 0.083086 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.430947 0.146376 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.577723 0.166752 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.744889 0.144340 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:56.889600 0.215254 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:57.105246 0.075845 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:57.181502 0.060816 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:57:57.242701 0.000000 udp 10.0.2.105 7010 -> 61.21.238.160 4240 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 09:58:14.360910 0.049868 tcp 10.0.2.105 56816 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:58:14.411031 0.051073 tcp 10.0.2.105 56817 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:58:14.462300 0.134350 tcp 10.0.2.105 56818 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/22 09:58:14.597132 0.267663 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:14.865217 0.042850 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:14.908567 0.214789 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:15.123782 0.339185 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:15.463370 0.241597 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:15.705424 0.122358 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:15.828210 0.172683 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.001326 0.038452 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.040149 0.158427 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.198967 0.085768 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.285124 0.464118 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.749659 0.058823 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.808868 0.151993 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:16.961203 0.123949 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.085550 0.173843 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.259767 0.136845 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.396931 0.060384 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.457701 0.296213 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.754255 0.165341 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:17.919951 0.205513 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:18.125857 0.071733 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:18.197957 0.183465 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 09:58:18.381822 0.145605 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:02:59.532896 3.001605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 10:03:06.540073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:03:14.542333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:03:30.545158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:04:02.550763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:10:06.557339 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:10:13.564504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:10:21.565968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:10:37.568900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:11:09.574920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:17:13.580802 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:17:20.590969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:17:28.589779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:17:44.592687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:18:16.598865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:24:20.604455 3.002333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:24:27.612210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:24:35.613610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:24:51.616704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:25:23.622734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:27:43.344008 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 10:27:43.344148 0.999087 tcp 10.0.2.105 56819 -> 128.255.183.224 9027 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/22 10:28:28.969443 0.000000 udp 10.0.2.105 7010 -> 61.21.238.160 4240 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 10:28:33.836839 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 10:28:46.235645 0.050591 tcp 10.0.2.105 56820 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 10:28:46.286485 0.051658 tcp 10.0.2.105 56821 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 10:28:46.338404 0.156878 tcp 10.0.2.105 56822 -> 195.113.214.236 443 SRPA* 0 0 34 25405 flow=From-Botnet-V2-TCP-Established 1970/01/22 10:28:46.496436 0.182700 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:46.679530 0.181063 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:46.861043 0.165000 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.026438 0.088617 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.115384 0.311666 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.427387 0.078669 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.506436 0.060632 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.567462 0.144998 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.712799 0.149301 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:47.862442 0.230924 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:48.093713 0.274477 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:48.368492 0.041057 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:48.409925 0.334776 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:48.745071 0.231043 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:48.976656 0.123270 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.100350 0.172627 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.273387 0.039750 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.313510 0.162986 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.476924 0.083057 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.560405 0.138147 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.698947 0.120631 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.819946 0.170182 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:49.990502 0.135493 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.126363 0.059695 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.186385 0.059787 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.246526 0.063652 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.310536 0.298112 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.609026 0.232593 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:50.841981 0.211686 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:51.054119 0.064202 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:51.118745 0.183562 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:28:51.302731 0.145991 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:31:27.631578 2.998871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 10:31:34.638087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:31:42.637547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:31:58.640063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:32:30.646969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:38:34.652721 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:38:41.659660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:38:49.661650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:39:05.664886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:39:37.670776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:48:09.679814 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:48:16.687865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:48:24.688709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:48:40.691698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:49:12.697953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:55:16.703156 3.002093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 10:55:23.711210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:55:31.713629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:55:47.715485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:56:19.721571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 10:57:44.343625 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 10:57:44.343786 0.941584 tcp 10.0.2.105 56823 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/22 10:59:00.663436 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 10:59:00.663700 0.165532 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:00.829641 0.071652 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:00.901640 0.183336 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.085407 0.180990 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.266768 0.212043 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.479167 0.076326 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.555885 0.061320 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.617585 0.144597 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.762574 0.143736 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:01.906687 0.218703 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:02.125768 0.253048 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:02.379196 0.048937 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:02.428644 0.621661 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.050712 0.244310 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.295431 0.122056 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.417864 0.171479 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.589739 0.046616 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.636667 0.163574 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.800661 0.085129 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:03.886178 0.144947 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.031483 0.120655 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.152509 0.169574 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.322508 0.140602 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.463521 0.070103 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.533994 0.068416 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.602755 0.065351 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.668490 0.212338 udp 10.0.2.105 7010 <-> 207.119.4.6 8296 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.881131 0.064498 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:04.945917 0.175586 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:05.121916 0.301058 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:05.423323 0.185612 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 10:59:05.609318 0.144101 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:02:23.729773 2.999313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 11:02:30.735106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:02:38.737109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:02:54.740665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:03:26.745552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:09:30.751492 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:09:37.758348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:09:45.760173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:10:01.763338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:10:33.769458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:16:37.775290 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:16:44.782718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:16:52.784850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:17:08.787292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:17:40.793424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:23:44.799692 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:23:51.806885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:23:59.807883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:24:15.811174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:24:47.817244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:27:45.293827 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 11:27:45.294065 1.132534 tcp 10.0.2.105 56824 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:29:26.218064 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 11:29:26.218188 0.182038 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:26.400593 0.180384 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:26.581342 0.167600 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:26.749342 0.073954 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:26.823706 0.211287 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:27.035419 0.123681 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:27.159530 0.062910 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:27.222760 0.142290 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:27.365442 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 11:29:43.817316 0.055949 tcp 10.0.2.105 56825 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:29:43.873494 0.053918 tcp 10.0.2.105 56826 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:29:43.927741 0.150008 tcp 10.0.2.105 56827 -> 195.113.214.236 443 SRPA* 0 0 48 31516 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:29:44.078518 0.219002 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:44.297889 0.337641 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:44.635989 0.239243 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:44.875605 0.288929 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.164891 0.120834 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.286118 0.119924 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.406442 0.171760 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.578561 0.045957 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.624889 0.163282 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.788557 0.077891 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:45.866814 0.151610 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.018811 0.120254 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.139485 0.164907 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.304802 0.145405 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.450812 0.058822 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.509997 0.059728 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.570141 0.066246 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:29:46.636477 0.000000 udp 10.0.2.105 7010 -> 207.119.4.6 8296 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 11:30:02.853092 0.051127 tcp 10.0.2.105 56828 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:30:02.904536 0.054273 tcp 10.0.2.105 56829 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:30:02.959144 0.145216 tcp 10.0.2.105 56830 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/22 11:30:03.104973 0.069880 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:30:03.175252 0.185297 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:30:03.361124 0.140197 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:30:03.501758 0.286913 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:30:03.789099 0.168569 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/22 11:30:51.824084 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 11:30:58.830813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:31:06.832545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:31:22.835211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:31:54.840639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:37:58.847332 3.001645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:38:05.858005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:38:13.856354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:38:29.859184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:39:01.865294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:47:52.872033 3.001026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:47:59.879321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:48:07.879760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:48:23.883580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:48:55.889454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:54:59.896019 3.001462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 11:55:06.903023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:55:14.904265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:55:30.907756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:56:02.913592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 11:57:46.432832 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 11:57:46.433024 0.974174 tcp 10.0.2.105 56831 -> 128.255.183.224 9027 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:00:24.189394 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 12:00:24.189478 0.148087 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:24.337942 0.000000 udp 10.0.2.105 7010 -> 207.119.4.6 8296 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 12:00:43.258366 0.057464 tcp 10.0.2.105 56832 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:00:43.316050 0.052632 tcp 10.0.2.105 56833 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:00:43.368930 0.146927 tcp 10.0.2.105 56834 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:00:43.516555 0.074517 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:43.591429 0.180074 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:43.771902 0.070203 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:43.842435 0.408154 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:44.250992 0.198424 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:44.449811 0.213054 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:44.663237 0.167974 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:44.831604 0.142943 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:44.974916 0.214499 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:45.189761 0.259271 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:45.449441 0.057416 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:45.507195 0.247377 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:45.754973 0.334568 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.089930 0.120301 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.210589 0.158156 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.369078 0.078906 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.448365 0.144476 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.593216 0.121883 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.715514 0.172936 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.888853 0.039567 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:46.928776 0.170296 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.099451 0.056870 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.156722 0.136072 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.293220 0.060119 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.353642 0.060491 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.414488 0.066695 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.481550 0.180288 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.662222 0.186445 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.849102 0.140244 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:00:47.989724 0.294828 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:02:06.919434 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 12:02:13.926612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:02:21.928483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:02:37.931934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:03:09.937990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:09:13.942911 3.002011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:09:20.950493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:09:28.953175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:09:44.955228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:10:16.961534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:16:20.967507 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:16:27.975252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:16:35.976592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:16:51.979028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:17:23.985178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:23:27.990661 3.002373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:23:34.998606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:23:43.000085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:23:59.003854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:24:31.009705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:27:47.423441 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 12:27:47.423594 1.147059 tcp 10.0.2.105 56835 -> 128.255.183.224 9027 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:30:35.015134 3.001877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:30:42.022930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:30:50.023972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:30:50.034213 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 12:30:50.034385 0.147642 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.182421 0.070496 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.253326 0.060095 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.313785 0.074267 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.388425 0.180802 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.569562 0.182796 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.752729 0.217106 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:50.970204 0.166945 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:51.137583 0.146094 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:51.284075 0.207443 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:30:51.491908 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 3760 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 12:31:06.027347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:31:10.305156 0.052185 tcp 10.0.2.105 56836 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:31:10.357596 0.055365 tcp 10.0.2.105 56837 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:31:10.413210 0.145363 tcp 10.0.2.105 56838 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/22 12:31:10.559175 0.045037 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:10.604550 0.247307 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:10.852453 0.335414 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.188421 0.121633 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.310366 0.156964 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.467672 0.079264 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.547307 0.144629 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.692527 0.120470 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.813389 0.170672 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:11.984404 0.043727 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.028610 0.171073 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.200084 0.062745 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.263209 0.135932 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.399552 0.062436 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.462346 0.181077 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.643809 0.167582 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.811820 0.144989 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:12.957258 0.295164 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:13.252810 0.059888 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:13.313108 0.110255 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 12:31:38.036949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:37:42.039347 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:37:49.046581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:37:57.048259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:38:13.050961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:38:45.057799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:47:43.063082 3.001727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:47:50.070804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:47:58.072404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:48:14.075097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:48:46.081571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:54:50.087608 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 12:54:57.095024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:55:05.096455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:55:21.099329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:55:53.105656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 12:57:48.562174 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 12:57:48.562345 0.977305 tcp 10.0.2.105 56839 -> 128.255.183.224 9027 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/01/22 13:01:24.011632 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 13:01:24.011778 0.262015 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.274151 0.051690 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.326210 0.148784 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.475366 0.070957 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.546705 0.078412 udp 10.0.2.105 7010 <-> 95.252.221.129 7032 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.625581 0.208464 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:24.834402 0.167842 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:25.002644 0.142966 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:25.146044 0.181908 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:25.328321 0.180402 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:25.509128 0.216622 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:25.726138 0.335937 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.062502 0.121863 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.184731 0.047629 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.232749 0.232646 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.465825 0.163354 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.629557 0.085504 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.715463 0.144950 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.860789 0.119277 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:26.980575 0.167063 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.148106 0.039412 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.187873 0.172026 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.360271 0.061027 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.421626 0.179846 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.601892 0.250301 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.852585 0.140335 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:27.993272 0.302845 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:28.296509 0.059924 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:28.356803 0.136395 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:28.493587 0.064756 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:28.558727 0.068229 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:01:57.110999 3.002330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 13:02:04.118354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:02:12.120106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:02:28.123267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:03:00.129533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:09:04.135926 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:09:11.142859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:09:19.144125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:09:35.147148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:10:07.153491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:16:11.158593 3.002203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:16:18.166769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:16:26.168209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:16:42.170989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:17:14.182834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:23:18.184096 3.010630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:23:25.200516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:23:33.201855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:23:49.205133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:24:21.211430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:27:49.549099 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 13:27:49.549302 1.060957 tcp 10.0.2.105 56840 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/22 13:30:25.217150 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:30:32.226040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:30:40.225895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:30:56.228801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:31:28.234940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:31:49.656386 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 13:31:49.656543 0.279109 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:31:49.936072 0.057486 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:31:49.993936 0.149006 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:31:50.143359 0.117635 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:31:50.261402 0.000000 udp 10.0.2.105 7010 -> 95.252.221.129 7032 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 13:32:06.872688 0.052920 tcp 10.0.2.105 56841 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 13:32:06.925858 0.053635 tcp 10.0.2.105 56842 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 13:32:06.979758 0.146592 tcp 10.0.2.105 56843 -> 195.113.214.236 443 SRPA* 0 0 38 21720 flow=From-Botnet-V2-TCP-Established 1970/01/22 13:32:07.126864 0.210111 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:07.337357 0.167773 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:07.505508 0.142285 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:07.648175 0.182496 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:07.831048 0.330837 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.162265 0.120477 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.283126 0.038507 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.321996 0.180603 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.502982 0.218187 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.721632 0.236455 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:08.958532 0.161676 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.120605 0.083974 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.204896 0.144861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.350107 0.119194 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.469619 0.171114 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.641097 0.043776 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.685193 0.170767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.856552 0.062198 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:09.919144 0.178390 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.097958 0.167268 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.266060 0.139798 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.406232 0.302532 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.709159 0.060260 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.769812 0.062615 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.832781 0.137291 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:32:10.970505 0.064151 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/22 13:37:32.240617 3.014283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:37:39.258710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:37:47.259889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:38:03.262891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:38:35.268920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:47:36.280137 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:47:43.287967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:47:51.288908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:48:07.291388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:48:39.297886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:54:43.303891 3.001151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 13:54:50.311946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:54:58.313478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:55:14.315423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:55:46.321540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 13:57:50.610436 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 13:57:50.610615 0.971548 tcp 10.0.2.105 56844 -> 128.255.183.224 9027 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/01/22 14:01:50.327724 3.001484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:01:57.334732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:02:05.336731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:02:21.339305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:02:24.844716 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 14:02:24.844878 0.000000 udp 10.0.2.105 7010 -> 95.252.221.129 7032 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 14:02:40.618939 0.053131 tcp 10.0.2.105 56845 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 14:02:40.672481 0.054584 tcp 10.0.2.105 56846 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 14:02:40.727317 0.141834 tcp 10.0.2.105 56847 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/22 14:02:40.869724 0.068267 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:40.938419 0.053409 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:40.992191 0.248825 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:41.241360 0.274615 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:41.516355 0.241962 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:41.758750 0.168106 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:41.927276 0.140988 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.068685 0.181840 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.250914 0.354887 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.606524 0.120966 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.727974 0.038349 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.766695 0.180038 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:42.947149 0.211465 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.159011 0.244292 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.403727 0.163501 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.567609 0.082858 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.650866 0.145110 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.796357 0.119910 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:43.916694 0.173139 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.090240 0.045167 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.135749 0.170313 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.306435 0.064377 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.371203 0.180629 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.552230 0.167658 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.720280 0.058408 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.779077 0.065864 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.845323 0.136978 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:44.982651 0.059437 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:45.042471 0.142681 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:45.185488 0.295093 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:02:53.345308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:08:57.354176 2.998844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:09:04.358343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:09:12.360191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:09:28.363469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:10:00.369104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:16:04.375699 3.006370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:16:11.385758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:16:19.389143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:16:35.387580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:17:07.393237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:23:11.399258 3.002379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:23:18.408862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:23:26.408521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:23:42.411398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:24:14.417366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:27:51.589865 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 14:27:51.590019 0.927571 tcp 10.0.2.105 56848 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/22 14:30:18.422783 3.003182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:30:25.430746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:30:33.432691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:30:49.434600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:31:21.441309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:33:10.572224 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 14:33:10.572463 0.235053 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:10.807935 0.071392 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:10.879748 0.056815 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:10.937017 0.144313 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:11.081725 0.549930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:11.632101 0.163637 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:11.796162 0.144459 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:11.941003 0.181286 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:12.122710 0.044672 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:12.167801 0.179990 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:12.348196 0.214628 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:12.563238 0.370298 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:12.933934 0.121037 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.055338 0.219477 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.275213 0.145980 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.421584 0.079122 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.501132 0.120954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.622509 0.118905 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.741842 0.153262 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.895482 0.038801 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:13.934704 0.145750 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.080802 0.062702 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.143866 0.058949 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.203258 0.065130 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.268794 0.129145 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.398374 0.152024 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.550786 0.142559 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.693729 0.161568 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:14.855690 0.234797 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:33:15.090843 0.288172 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/22 14:37:25.447006 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:37:32.458634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:37:40.456175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:37:56.461575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:38:28.471550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:47:30.480053 2.998773 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:47:37.484621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:47:45.486110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:48:01.488639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:48:33.495054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:54:37.500086 3.006231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 14:54:44.508233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:54:52.509480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:55:08.512737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:55:40.519333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 14:57:52.519294 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 14:57:52.519478 0.871438 tcp 10.0.2.105 56849 -> 128.255.183.224 9027 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/01/22 15:01:44.525897 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:01:51.532508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:01:59.533785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:02:15.537119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:02:47.542859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:03:27.340539 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 15:03:27.340731 0.054344 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:27.395365 0.143070 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:27.538831 0.243615 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:27.782846 0.068456 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:27.851676 0.213546 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.065609 0.167723 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.233783 0.143826 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.377990 0.182624 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.560975 0.043412 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.604739 0.179225 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.784368 0.122859 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:28.907629 0.230715 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:29.138698 0.213343 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:29.352426 0.336643 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:29.689440 0.141898 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:29.831721 0.082553 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:29.914662 0.120589 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.035676 0.120974 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.157033 0.152201 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.309659 0.038718 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.348714 0.149518 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.498581 0.060828 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.559731 0.057848 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.617882 0.063557 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.681803 0.140872 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.823086 0.156605 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:30.980084 0.217304 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:31.197768 0.286601 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:31.484751 0.126746 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:03:31.611867 0.063920 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:08:51.548251 3.002400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:08:58.556870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:09:06.557989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:09:22.560915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:09:54.567160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:15:58.572547 3.002503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:16:05.579866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:16:13.581985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:16:29.585149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:17:01.590937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:23:05.597315 3.001037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:23:12.604727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:23:20.605823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:23:36.608873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:24:08.615295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:27:53.399160 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 15:27:53.399346 1.018254 tcp 10.0.2.105 56850 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/22 15:30:12.629584 2.993115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:30:19.632175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:30:27.634695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:30:43.632764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:31:15.638933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:33:49.510491 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 15:33:49.510583 0.058877 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:49.569926 0.146158 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:49.716487 0.239256 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:49.956164 0.069906 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:50.026477 0.512432 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:50.539314 0.167981 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:50.707676 0.142557 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:50.850609 0.181131 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.032152 0.120390 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.152944 0.293971 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.447304 0.214630 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.662344 0.181514 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.844401 0.048766 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:51.893512 0.453860 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.347747 0.143661 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.491815 0.080820 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.573022 0.120518 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.693925 0.119522 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.813837 0.145968 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:52.960379 0.045569 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.006268 0.147491 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.154182 0.063114 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.217697 0.057985 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.276082 0.065092 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.341570 0.144978 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.486925 0.159470 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.646757 0.172139 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.819258 0.097707 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:53.917329 0.302000 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:33:54.219722 0.127478 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/22 15:37:19.644826 3.001116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:37:26.652616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:37:34.653672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:37:50.656731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:38:22.665890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:47:24.675130 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:47:31.682247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:47:39.683676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:47:55.687131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:48:27.692819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:54:31.698916 3.001950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 15:54:38.710649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:54:46.707811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:55:02.710985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:55:34.717218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 15:57:54.417914 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 15:57:54.418091 0.882667 tcp 10.0.2.105 56851 -> 128.255.183.224 9027 FSPA* 0 0 12 1427 flow=From-Botnet-V2-TCP-Established 1970/01/22 16:01:38.722671 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:01:45.729676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:01:53.731705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:02:09.734799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:02:41.740711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:04:20.412877 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 16:04:20.413068 0.251783 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:20.665224 0.116185 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:20.781824 0.052992 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:20.835212 0.148440 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:20.984028 0.354576 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:21.338985 0.167700 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:21.507055 0.144130 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:21.651561 0.180869 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:21.832795 0.122039 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:21.955205 0.181246 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:22.136837 0.121036 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:22.258238 0.645493 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:22.904166 0.219520 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.124033 0.215147 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.339531 0.137297 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.477215 0.074687 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.552239 0.120505 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.673120 0.120596 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.794125 0.145576 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.940076 0.045139 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:23.985560 0.151334 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.137256 0.061144 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.198722 0.058498 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.257567 0.061660 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.319582 0.175487 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.495463 0.083390 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.579198 0.300623 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:24.880179 0.127955 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:25.008500 0.144982 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:04:25.153824 0.156851 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:08:45.746390 3.002028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:08:52.754031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:09:00.755902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:09:16.758884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:09:48.768585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:15:52.770379 3.001853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:15:59.778005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:16:07.779638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:16:23.782694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:16:55.788610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:22:59.794502 3.002712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:23:06.802156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:23:14.803499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:23:30.806708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:24:02.812732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:27:55.307226 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 16:27:55.307459 0.985592 tcp 10.0.2.105 56852 -> 128.255.183.224 9027 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/01/22 16:30:06.821758 2.998682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:30:13.826186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:30:21.827895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:30:37.830828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:31:09.836818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:34:45.559218 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 16:34:45.559505 0.058887 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:45.618764 0.271698 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:45.890873 0.212403 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.103684 0.231233 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.335308 0.169105 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.504754 0.166945 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.672079 0.139222 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.811657 0.181262 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:46.993318 0.121144 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:47.114847 0.179024 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:47.294168 0.081060 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:47.375591 0.214999 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:47.590949 0.647273 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.238625 0.229949 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.469021 0.137242 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.606663 0.082838 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.689895 0.120524 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.810830 0.119976 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:48.931159 0.146396 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.077903 0.045913 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.124177 0.150836 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.275392 0.060588 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.336516 0.058121 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.394981 0.102989 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.498421 0.300932 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.799729 0.126828 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:49.926919 0.145072 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:50.072381 0.159216 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:50.232034 0.173643 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:34:50.406019 0.060130 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 16:37:13.843006 3.001282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:37:20.850137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:37:28.851538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:37:44.854708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:38:16.860719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:44:20.866828 3.001372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:44:27.873793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:44:35.875529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:44:51.878376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:45:23.884657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:51:27.890789 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:51:34.898296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:51:42.899207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:51:58.903294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:52:30.908866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:57:56.286640 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 16:57:56.286852 0.882957 tcp 10.0.2.105 56853 -> 128.255.183.224 9027 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/01/22 16:58:38.920537 3.002165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 16:58:45.927756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:58:53.929221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:59:09.933162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 16:59:41.938012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:05:09.349097 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 17:05:09.349263 0.206596 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:09.556386 0.237398 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:09.794153 0.051951 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:09.846394 0.145701 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:09.992472 0.071696 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.064527 0.167834 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.232700 0.142865 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.375871 0.180882 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.557080 0.121525 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.678977 0.182923 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.862274 0.049015 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:10.911621 0.218062 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:11.130040 0.347683 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:11.478122 0.204853 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:11.683349 0.139578 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:11.823333 0.073403 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:11.897105 0.120547 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.018048 0.118608 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.137023 0.154087 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.291508 0.046379 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.338398 0.163094 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.501871 0.061872 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.564086 0.288449 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.852901 0.128600 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:12.981913 0.143787 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:13.126089 0.153339 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:13.279799 0.058103 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:13.338295 0.068816 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:13.407490 0.169505 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:13.577377 0.057320 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:05:45.944310 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:05:52.951504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:06:00.953658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:06:16.956147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:06:48.962303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:12:52.968454 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:12:59.975613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:13:07.977160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:13:23.980180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:13:55.986007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:19:59.991612 3.002270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:20:07.000018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:20:15.001730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:20:31.004384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:21:03.016878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:27:07.016382 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:27:14.023499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:27:22.025180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:27:38.028103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:27:57.178536 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 17:27:57.178676 0.918164 tcp 10.0.2.105 56854 -> 128.255.183.224 9027 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/01/22 17:28:10.042955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:34:14.039479 3.002192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:34:21.047831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:34:29.048814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:34:45.051808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:35:17.058104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:35:39.671061 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 17:35:39.671225 0.211834 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:39.883506 0.237153 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.121117 0.055456 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.176980 0.162362 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.339734 0.122938 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.463067 0.166277 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.629772 0.143822 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.774031 0.181788 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:40.956191 0.044228 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:41.000804 0.215790 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:41.216999 0.180266 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:41.397650 0.121246 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:41.519273 0.817000 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:42.336601 1.083563 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:43.420648 0.136305 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:43.557379 0.082493 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:43.640323 0.120982 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:43.761905 0.122271 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:43.884554 0.150934 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.035888 0.046048 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.082264 0.146248 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.228871 0.064092 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.293303 0.300451 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.594179 0.126946 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.721551 0.144671 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:44.866569 0.159750 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:45.026749 0.059169 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:45.086316 0.065008 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:45.151711 0.065738 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:35:45.217822 0.172745 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 17:41:21.064047 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:41:28.076071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:41:36.082448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:41:52.076462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:42:24.083098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:49:33.091306 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:49:40.099312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:49:48.100530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:50:04.103399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:50:36.109428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:56:48.116210 3.002481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 17:56:55.124657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:57:03.125881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:57:19.129134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:57:51.135055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 17:57:58.095696 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 17:57:58.095844 0.880346 tcp 10.0.2.105 56855 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/22 18:03:55.141290 3.002117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:04:02.148580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:04:10.149567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:04:26.153593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:04:58.165835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:05:47.309691 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 18:05:47.309781 0.057271 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:47.367377 0.254073 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:47.621896 0.220267 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:47.842531 0.232561 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.075582 0.101420 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.177416 0.169297 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.347094 0.143947 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.491423 0.182142 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.674000 0.043489 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.717936 0.213581 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:48.931920 0.179854 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:49.112159 0.121634 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:49.234256 0.930543 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.165151 0.210359 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.375848 0.142932 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.519152 0.077464 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.597008 0.120597 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.718016 0.120636 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.839024 0.145835 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:50.985642 0.045747 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.031722 0.145974 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.178056 0.059946 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.238403 0.144918 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.383771 0.155629 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.539826 0.059358 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.599607 0.058753 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.658748 0.063482 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.722618 0.172227 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:51.895242 0.296709 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:05:52.192494 0.126423 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:11:02.166240 3.000554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:11:09.172493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:11:17.173716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:11:33.178665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:12:05.182646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:18:09.191717 2.998953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:18:16.196551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:18:24.197874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:18:40.200898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:19:12.207666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:25:16.212661 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:25:23.219969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:25:31.222222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:25:47.224800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:26:19.230712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:27:58.984804 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 18:27:58.984894 0.876802 tcp 10.0.2.105 56856 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/22 18:32:23.237180 3.001163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:32:30.244420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:32:38.246205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:32:54.248262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:33:26.254888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:36:17.631481 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 18:36:17.631675 0.058061 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:17.690157 0.250503 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:17.941029 0.071443 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.012839 0.166421 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.179678 0.145852 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.325971 0.200819 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.527176 0.140465 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.668010 0.182949 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.851328 0.046025 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:18.897683 0.216965 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:19.115062 0.181013 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:19.296482 0.121361 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:19.418255 0.342407 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:19.761081 0.268745 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.030226 0.140448 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.171050 0.095300 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.266721 0.120559 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.387643 0.121547 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.509571 0.152579 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.662544 0.045954 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.708884 0.181707 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.890976 0.066660 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:20.958057 0.141589 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:21.100048 0.072311 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:21.172772 0.067653 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:21.240840 0.484195 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:21.725436 0.295458 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:22.021305 0.126932 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:22.148615 0.157139 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:36:22.306143 0.059976 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/22 18:39:30.261108 3.001228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:39:37.268440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:39:45.269592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:40:01.273246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:40:33.278363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:48:38.288130 3.002067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:48:45.296790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:48:53.297984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:49:09.300693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:49:41.306596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:55:45.312437 3.001603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 18:55:52.320085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:56:00.322788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:56:16.324481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:56:48.331132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 18:57:59.863746 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 18:57:59.863837 0.901060 tcp 10.0.2.105 56857 -> 128.255.183.224 9027 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/01/22 19:02:52.338070 3.003960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:02:59.343886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:03:07.345200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:03:23.348246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:03:55.354547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:06:27.103211 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 19:06:27.103313 0.070371 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:27.174048 0.167006 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:27.341470 0.145475 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:27.487363 0.059065 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:27.546814 0.236195 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:27.783431 0.222680 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.006487 0.139531 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.146387 0.181807 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.328537 0.049945 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.378825 0.215150 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.594447 0.178964 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.773802 0.134674 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:28.908867 0.576339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:29.485604 0.890798 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.376741 0.137043 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.514145 0.082675 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.597211 0.120529 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.718178 0.121541 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.840070 0.152412 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:30.992886 0.046003 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.039272 0.147561 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.187257 0.063936 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.251536 0.144855 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.396719 0.061114 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.458129 0.067488 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.526000 0.128906 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.655283 0.157247 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.812900 0.060588 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:31.873814 0.172449 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:06:32.046631 0.301306 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:09:59.360779 3.001430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:10:06.367795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:10:14.369195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:10:30.372218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:11:02.378250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:17:06.384667 3.001333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:17:13.391960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:17:21.395870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:17:37.396572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:18:09.403867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:24:13.408652 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:24:20.416467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:24:28.417331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:24:44.420338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:25:16.426561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:28:00.776376 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 19:28:00.776566 0.892643 tcp 10.0.2.105 56858 -> 128.255.183.224 9027 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/01/22 19:31:20.432161 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:31:27.439978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:31:35.442841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:31:51.444582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:32:23.449995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:36:38.042312 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 19:36:38.042494 0.069191 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:38.112021 0.169328 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:38.281757 0.206050 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:38.488348 0.060915 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:38.549664 0.235848 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:38.785896 0.271880 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.073145 0.139544 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.213225 0.182573 udp 10.0.2.105 7010 <-> 99.10.189.189 6684 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.396194 0.047314 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.443887 0.120305 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.564619 0.215594 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.780552 0.180886 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:39.961810 0.757585 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:40.719755 1.287248 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:42.007352 0.699085 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:42.706875 0.079061 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:42.786285 0.120431 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:42.907301 0.119306 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.026955 0.154894 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.182268 0.039081 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.221728 0.149315 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.371414 0.065898 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.437684 0.143576 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.581783 0.126027 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.708122 0.162680 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.871214 0.059190 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:43.930817 0.175839 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:44.107077 0.289483 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:44.396953 0.059522 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:36:44.456890 0.063970 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 19:38:27.457532 3.000554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:38:34.465009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:38:42.465338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:38:58.468222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:39:30.474417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:48:08.481901 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:48:15.489271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:48:23.490640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:48:39.493607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:49:11.499803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:55:15.506070 3.001045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 19:55:22.513142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:55:30.514719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:55:46.523435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:56:18.523108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 19:58:01.672931 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 19:58:01.673115 0.877032 tcp 10.0.2.105 56859 -> 128.255.183.224 9027 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:02:24.531996 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:02:31.539890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:02:39.541515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:02:55.544681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:03:27.550115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:06:48.710229 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 20:06:48.710505 0.072340 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:48.783180 0.166366 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:48.949904 0.268593 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:49.218910 0.057010 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:49.276489 0.245479 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:49.522298 0.317163 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:49.839844 0.144581 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:06:49.984773 0.000000 udp 10.0.2.105 7010 -> 99.10.189.189 6684 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 20:07:05.125385 0.053450 tcp 10.0.2.105 56860 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:05.179180 0.032273 tcp 10.0.2.105 56861 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:05.211737 0.112965 tcp 10.0.2.105 56862 -> 195.113.214.236 443 SRPA* 0 0 63 41211 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:05.325211 0.213857 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:05.539464 0.180064 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:05.719914 0.055747 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:05.776082 0.120417 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:05.896885 0.373144 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.270472 0.209268 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.480164 0.141234 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.621759 0.084110 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.706251 0.120474 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.827137 0.120661 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:06.948175 0.146884 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:07.095472 0.045685 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:07.141538 0.149090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:07.291002 0.061195 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:07.352604 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 20:07:23.149950 0.050559 tcp 10.0.2.105 56863 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:23.200781 0.031479 tcp 10.0.2.105 56864 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:23.232494 0.125499 tcp 10.0.2.105 56865 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:07:23.358555 0.127641 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:23.486565 0.152382 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:23.639341 0.060223 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:23.699906 0.251686 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:23.952022 0.304793 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:24.257232 0.063607 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:07:24.321277 0.073719 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:09:31.558052 3.000224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 20:09:38.564171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:09:46.565359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:10:02.568169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:10:34.574717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:16:38.580772 3.001198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:16:45.588225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:16:53.589225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:17:09.592527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:17:41.598232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:23:45.605051 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:23:52.611858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:24:00.613334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:24:16.615832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:24:48.622192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:28:02.551195 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 20:28:02.551338 1.061193 tcp 10.0.2.105 56866 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:30:52.628632 3.004908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:30:59.635775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:31:07.637685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:31:23.640750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:31:55.645922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:37:44.398225 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 20:37:44.398346 0.000000 udp 10.0.2.105 7010 -> 99.10.189.189 6684 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 20:37:59.651845 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:38:00.623246 0.053393 tcp 10.0.2.105 56867 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:00.676906 0.032321 tcp 10.0.2.105 56868 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:00.709477 0.136222 tcp 10.0.2.105 56869 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:00.846261 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 20:38:06.659887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:38:14.661346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:38:16.254086 0.052065 tcp 10.0.2.105 56870 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:16.306414 0.031540 tcp 10.0.2.105 56871 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:16.338170 0.124451 tcp 10.0.2.105 56872 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/22 20:38:16.463152 0.069731 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:16.533243 0.144631 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:16.678268 0.165894 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:16.844544 0.070151 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:16.915062 0.214208 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:17.129722 0.242117 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:17.372282 0.144885 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:17.517528 0.179764 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:17.697668 0.214859 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:17.912956 0.865577 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:18.778937 0.124386 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:18.903683 0.046434 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:18.950502 0.200757 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.151627 0.075625 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.227612 0.120573 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.348782 0.120176 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.469394 0.146494 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.616336 0.045471 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.662213 0.148224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.810876 0.062597 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:19.873892 0.142555 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.016842 0.059166 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.076472 0.221507 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.298421 0.289525 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.588339 0.083352 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.672065 0.127185 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.799617 0.166820 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:20.966861 0.105525 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 20:38:30.664568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:39:02.670423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:47:55.679443 3.002498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:48:02.687925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:48:10.688516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:48:26.691716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:48:58.701168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:55:02.703102 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 20:55:09.710905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:55:17.713349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:55:33.715067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:56:05.721400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 20:58:03.610978 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 20:58:03.611159 0.883878 tcp 10.0.2.105 56873 -> 128.255.183.224 9027 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/22 21:02:10.728238 3.002753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:02:17.736472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:02:25.737842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:02:41.741373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:03:13.746626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:08:22.491160 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 21:08:22.491403 0.071538 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:22.563355 0.147799 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:22.711603 0.166146 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:22.878259 0.061485 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:22.940128 0.206646 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:23.147170 0.219984 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:23.367581 0.215684 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:23.583631 0.144721 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:23.728729 0.179280 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:23.908599 0.761795 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:24.670758 0.123032 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:24.794154 0.044658 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:24.839104 2.126153 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:26.965648 0.084266 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.050291 0.122280 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.172981 0.120541 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.293850 0.134964 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.429152 0.045682 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.475216 0.149621 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.625174 0.058740 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.684268 0.133257 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.817993 0.058821 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:27.877211 0.165416 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:28.043047 0.127196 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:28.170671 0.145508 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:28.316536 0.066432 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:28.383358 0.304255 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:08:28.687984 0.060062 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:09:17.752933 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:09:24.759872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:09:32.762589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:09:48.764510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:10:20.770773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:16:24.775780 3.002500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:16:31.784060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:16:39.785707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:16:55.789036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:17:27.794524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:23:31.800486 3.002087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:23:38.808148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:23:46.809581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:24:02.812637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:24:34.818641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:28:04.507414 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 21:28:04.507515 1.043969 tcp 10.0.2.105 56874 -> 128.255.183.224 9027 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/01/22 21:30:38.824610 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:30:45.831955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:30:53.833419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:31:09.836602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:31:41.842475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:37:45.848566 3.001544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:37:52.856044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:38:00.857439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:38:16.860514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:38:42.219118 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 21:38:42.219286 0.172221 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:42.391923 0.061169 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:42.453449 0.210243 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:42.664046 0.216050 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:42.880682 0.072907 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:42.953909 0.147903 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:43.102226 0.218093 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:43.320676 0.146553 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:43.467655 0.180239 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:43.648208 0.044008 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:43.692516 0.809404 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:44.502291 0.120646 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:44.623288 0.629804 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.253498 0.080352 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.334193 0.120484 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.455076 0.120153 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.575637 0.147990 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.724001 0.038544 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.762827 0.152633 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.915824 0.065756 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:45.981972 0.144428 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.126833 0.059482 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.186748 0.171138 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.358398 0.127720 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.486497 0.159360 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.646237 0.296875 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:46.943590 0.287595 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:47.231585 0.063731 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/22 21:38:48.866829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:47:47.874101 3.002393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:47:54.881549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:48:02.887745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:48:18.886574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:48:50.892029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:54:54.897957 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 21:55:01.905482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:55:09.907263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:55:25.909891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:55:57.916598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 21:58:05.550153 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 21:58:05.550243 0.882696 tcp 10.0.2.105 56875 -> 128.255.183.224 9027 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/01/22 22:02:01.921507 3.002236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:02:08.929547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:02:16.931208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:02:32.934086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:03:04.939913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:08:55.143706 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 22:08:55.143907 0.212407 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:55.356736 0.218945 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:55.576058 0.072394 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:55.648862 0.148990 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:55.798198 0.232552 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.031139 0.166919 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.198556 0.060837 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.259763 0.145711 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.405828 0.181216 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.587388 0.050682 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:56.638445 1.339090 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:57.977914 0.077136 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:58.055391 0.695652 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:58.751391 0.122352 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:58.874128 0.120461 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:58.995029 0.121742 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.117143 0.145293 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.262802 0.044300 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.307465 0.145791 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.453750 0.067195 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.521277 0.137630 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.659268 0.058965 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.718662 0.169695 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.888745 0.070566 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:08:59.959711 0.289304 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:09:00.249387 0.173293 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:09:00.423108 0.126711 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:09:00.550165 0.166108 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:09:08.947236 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:09:15.953906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:09:23.954900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:09:39.958884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:10:11.964371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:16:15.969894 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:16:22.977243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:16:30.979208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:16:46.981903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:17:18.988120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:23:22.994843 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:23:30.002101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:23:38.003493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:23:54.006850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:24:26.011703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:28:06.447275 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 22:28:06.447453 2.941330 tcp 10.0.2.105 56876 -> 128.255.183.224 9027 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/01/22 22:30:30.018275 3.001165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:30:37.025565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:30:45.027253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:31:01.029645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:31:33.040537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:37:37.044508 2.998973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:37:44.049418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:37:52.050872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:38:08.053697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:38:40.059667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:39:11.966021 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 22:39:11.966240 0.976525 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:12.943129 0.952882 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:13.896423 0.780737 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:14.677532 0.907110 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:15.585064 0.958864 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:16.544313 0.845582 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:17.390281 0.822087 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:18.212719 0.721319 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:18.934449 0.844797 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:19.779623 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 22:39:37.514293 1.233972 tcp 10.0.2.105 56877 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 22:39:38.748497 1.164239 tcp 10.0.2.105 56878 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 22:39:39.912980 2.723570 tcp 10.0.2.105 56879 -> 195.113.214.236 443 SRPA* 0 0 38 27081 flow=From-Botnet-V2-TCP-Established 1970/01/22 22:39:42.637137 2.011074 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:44.648666 0.692434 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:45.341474 1.000077 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:46.341905 0.830881 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:47.173176 0.888458 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:48.062066 0.874528 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:48.937049 0.912029 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:49.849461 0.802605 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:50.652499 0.689756 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:51.342761 0.793952 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:52.137145 0.655579 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:52.793115 0.824791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:53.618364 0.763680 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:54.382440 0.722356 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:55.105178 0.804303 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:55.909877 0.744104 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:56.654399 0.780231 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:39:57.435061 0.687362 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/22 22:47:39.067396 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/22 22:47:46.074801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:47:54.077033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:48:10.079326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:48:42.085609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:54:46.091621 3.002105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 22:54:53.098746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:55:01.100356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:55:17.103512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:55:49.109409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 22:58:09.381744 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 22:58:09.381912 2.996353 tcp 10.0.2.105 56880 -> 128.255.183.224 9027 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/01/22 23:01:53.115784 3.001675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:02:00.123050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:02:08.124068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:02:24.127937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:02:56.133536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:09:00.139169 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:09:07.146734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:09:15.148575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:09:31.151275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:10:03.157226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:10:22.535696 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 23:10:22.535841 0.181514 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:22.717785 0.443628 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:23.161802 0.237476 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:23.399692 0.071256 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:23.471392 0.143652 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:23.615498 0.166335 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:23.782231 0.218763 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.001409 0.067821 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.069558 0.043098 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.113018 0.145139 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.258541 0.250986 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.509920 0.084112 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:24.594431 0.828268 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.423150 0.120852 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.544446 0.121090 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.665875 0.120069 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.786309 0.148979 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.935670 0.045737 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:25.981758 0.144680 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.126885 0.064940 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.192242 0.144334 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.337017 0.059283 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.396669 0.168335 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.565361 0.068161 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.633923 0.295460 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:26.929760 0.162022 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:27.092171 0.060280 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:10:27.152833 0.126073 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:16:07.165438 2.999355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:16:14.171031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:16:22.172245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:16:38.175496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:17:10.181358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:23:14.187364 3.013508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:23:21.204929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:23:29.206269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:23:45.209192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:24:17.215359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:28:12.383637 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 23:28:12.383795 0.964856 tcp 10.0.2.105 56881 -> 128.255.183.224 9027 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/01/22 23:30:21.221531 3.008347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:30:28.231862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:30:36.230129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:30:52.233209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:31:24.239159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:37:28.246068 3.000994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:37:35.253011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:37:43.254182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:37:59.258512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:38:31.263133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:40:50.533081 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 23:40:50.533231 0.232291 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:50.765970 0.180175 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:50.946529 0.246341 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:51.193333 0.137490 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:51.331282 0.148234 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:51.479856 0.187476 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:40:51.667794 0.000000 udp 10.0.2.105 7010 -> 50.134.170.237 5506 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/22 23:41:08.732752 0.053562 tcp 10.0.2.105 56882 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/22 23:41:08.786556 0.048464 tcp 10.0.2.105 56883 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/22 23:41:08.835273 0.144302 tcp 10.0.2.105 56884 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/22 23:41:08.980131 0.058657 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:09.039171 0.045940 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:09.085474 0.147070 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:09.232942 0.997486 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:12.654695 0.073395 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:12.728531 0.477001 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.205919 0.121584 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.327939 0.120446 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.448756 0.120324 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.569495 0.147324 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.717224 0.047184 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.764769 0.149124 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.914290 0.065765 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:13.980520 0.137866 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.118759 0.060575 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.179725 0.301049 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.481121 0.154891 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.636389 0.062372 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.699092 0.126799 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.826368 0.165120 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:41:14.991831 0.069819 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/22 23:47:32.273971 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/22 23:47:39.281214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:47:47.283079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:48:03.286263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:48:35.291532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:54:39.297960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:54:50.984802 1.972842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/22 23:54:56.912695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:55:04.806606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:55:20.593886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:55:52.643847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/22 23:58:21.568850 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/22 23:58:21.569021 0.997694 tcp 10.0.2.105 56885 -> 128.255.183.224 9027 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:01:51.621280 2.961149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:01:58.529203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:02:06.431225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:02:22.209173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:02:53.769289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:08:53.375574 3.001509 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:09:00.383128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:09:08.384363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:09:24.387625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:09:56.393717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:11:38.750527 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 00:11:38.750635 0.221205 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:38.972248 0.075696 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:39.048319 0.181519 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:39.230189 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 3760 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 00:11:54.234692 0.052460 tcp 10.0.2.105 56886 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:11:54.287437 0.034119 tcp 10.0.2.105 56887 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:11:54.321950 0.143275 tcp 10.0.2.105 56888 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:11:54.465795 0.205796 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:54.672002 0.579093 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:55.251497 0.167304 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:55.419161 0.060992 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:55.480706 0.054488 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:55.535581 0.145352 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:55.681342 0.761443 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:56.443157 0.120651 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:56.564169 0.217247 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:56.781783 0.081788 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:56.863931 0.120907 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:56.985271 0.119495 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.105166 0.149939 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.255502 0.050502 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.306430 0.146960 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.453787 0.064789 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.518913 0.148907 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.668155 0.055991 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.724611 0.058287 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.783263 0.126713 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:57.910354 0.163040 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:58.073815 0.070866 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:58.145012 0.298237 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:11:58.443667 0.159329 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:16:00.529683 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:16:07.539004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:16:15.542690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:16:31.541579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:17:03.550890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:23:07.661537 3.007316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:23:14.675227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:23:22.672976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:23:38.675808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:24:10.682317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:28:14.462948 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 00:28:14.463047 0.891756 tcp 10.0.2.105 56889 -> 128.255.183.224 9027 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:30:14.710327 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:30:21.715345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:30:29.717151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:30:45.719888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:31:17.725854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:37:21.762466 3.001199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:37:28.769471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:37:36.771014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:37:52.783937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:38:24.790621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:42:09.903846 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 00:42:09.904011 0.216004 udp 10.0.2.105 7010 <-> 200.55.153.18 3760 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.120555 0.074636 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.195598 0.214938 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.410931 0.180754 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.592088 0.206421 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.798875 0.142356 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.941576 0.045843 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:10.987721 0.147098 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:11.135240 0.165080 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:11.300720 0.060625 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:11.361786 0.327832 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:11.689993 0.123185 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:11.813568 0.427898 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.241897 0.081503 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.323791 0.120550 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.444773 0.121328 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.566429 0.148339 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.715224 0.044785 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.760549 0.147768 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.908749 0.066408 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:12.975556 0.621756 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:13.597731 0.058202 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:13.656396 0.064780 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:13.721557 0.126442 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:13.848442 0.166814 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:14.015603 0.113457 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:42:14.129472 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 00:42:32.077393 0.053557 tcp 10.0.2.105 56890 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:42:32.131212 0.033330 tcp 10.0.2.105 56891 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:42:32.164766 0.139796 tcp 10.0.2.105 56892 -> 195.113.214.236 443 SRPA* 0 0 41 22616 flow=From-Botnet-V2-TCP-Established 1970/01/23 00:42:32.305263 0.166671 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/23 00:47:26.803242 3.000288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:47:33.809577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:47:41.810744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:47:57.813996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:48:29.823696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:54:33.827413 3.000951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 00:54:40.833961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:54:48.834762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:55:04.837651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:55:36.843693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 00:58:16.023469 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 00:58:16.023616 1.007586 tcp 10.0.2.105 56893 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:01:41.510677 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:01:48.518986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:01:56.519563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:02:12.523232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:02:44.530855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:08:48.535307 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:08:55.542156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:09:03.543425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:09:19.546383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:09:51.553076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:12:44.101873 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 01:12:44.102063 0.291963 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:12:44.394424 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 3760 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 01:13:00.135559 0.053732 tcp 10.0.2.105 56894 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:00.189505 0.034748 tcp 10.0.2.105 56895 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:00.224533 0.144428 tcp 10.0.2.105 56896 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:00.369625 0.073532 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:00.477760 0.216133 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:00.478082 2.992582 tcp 10.0.2.105 56897 -> 86.155.127.11 2605 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 01:13:00.694313 0.164358 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:00.859072 0.057852 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:00.917321 0.145782 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.063498 0.166310 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.230189 0.061021 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.291572 0.207133 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.499066 0.180090 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.679494 0.121177 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:01.801053 0.238901 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:02.040350 0.080065 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:02.120847 0.634463 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:02.755672 0.040175 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:02.796223 0.169980 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:02.966574 0.063910 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.030855 0.428354 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.459633 0.137873 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.597933 0.185231 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.783593 0.059577 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.843599 0.137561 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:03.981554 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 01:13:09.480750 0.000000 tcp 10.0.2.105 56897 -> 86.155.127.11 2605 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 01:13:22.696562 0.051094 tcp 10.0.2.105 56898 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:22.747914 0.033187 tcp 10.0.2.105 56899 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:22.781386 0.125398 tcp 10.0.2.105 56900 -> 195.113.214.236 443 SRPA* 0 0 41 23496 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:13:22.907287 0.070766 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:22.978440 0.879995 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:23.858810 0.057094 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:13:23.916297 0.175338 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:15:55.558310 3.002080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 01:16:02.566078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:16:10.567047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:16:26.570633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:16:58.576584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:23:02.582618 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:23:09.590385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:23:17.591706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:23:33.594631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:24:05.600727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:28:17.033169 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 01:28:17.033275 1.011546 tcp 10.0.2.105 56901 -> 128.255.183.224 9027 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:30:09.606937 3.001247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:30:16.615092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:30:24.615188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:30:40.618502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:31:12.624626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:37:16.631577 3.000754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:37:23.637306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:37:31.639400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:37:47.642530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:38:19.648160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:43:34.962536 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 01:43:34.962710 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 3760 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 01:43:53.430641 0.054363 tcp 10.0.2.105 56902 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:43:53.485265 0.033083 tcp 10.0.2.105 56903 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:43:53.518753 0.130909 tcp 10.0.2.105 56904 -> 195.113.214.236 443 SRPA* 0 0 35 28436 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:43:53.650381 0.168812 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:53.819588 0.291084 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:54.111066 0.044101 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:54.155583 0.145312 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:54.301302 0.076929 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:54.378656 0.695225 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:54.379016 3.005247 tcp 10.0.2.105 56905 -> 86.155.127.11 2605 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 01:43:55.074326 0.148287 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.223022 0.060701 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.284088 0.168278 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.452735 0.181571 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.634673 0.120490 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.755510 0.230577 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:55.986441 0.076653 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.063483 0.215438 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.279349 0.060486 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.340180 0.046756 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.387283 0.329476 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.717168 0.170137 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:56.887679 0.137817 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.025917 0.169644 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.195988 0.064958 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.261314 0.136960 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.398608 0.121984 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.521000 0.068494 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.589894 0.182680 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:57.772967 0.502695 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:43:58.276107 0.064570 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/23 01:44:03.383501 0.000000 tcp 10.0.2.105 56905 -> 86.155.127.11 2605 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 01:44:23.654686 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:44:30.663025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:44:38.663437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:44:54.666415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:45:26.673074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:51:30.678750 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:51:37.685993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:51:45.687536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:52:01.690346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:52:33.696058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:58:18.052150 0.000236 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 01:58:18.052497 0.983217 tcp 10.0.2.105 56906 -> 128.255.183.224 9027 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/01/23 01:58:37.702239 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 01:58:44.709978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:58:52.711510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:59:08.715020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 01:59:40.720820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:05:44.727336 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:05:51.733738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:05:59.735070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:06:15.738289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:06:47.744466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:12:51.753692 2.999003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:12:58.757613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:13:06.758922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:13:22.762836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:13:54.771061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:14:19.925003 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 02:14:19.925106 0.061772 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:19.987317 0.169358 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:20.157171 0.289643 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:20.157607 4.994421 tcp 10.0.2.105 56907 -> 74.196.220.117 6410 SPA_* 0 0 435 242758 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:20.447202 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 02:14:25.160385 4.995531 tcp 10.0.2.105 56907 -> 74.196.220.117 6410 A_PA 0 0 416 235456 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:30.172142 2.329494 tcp 10.0.2.105 56907 -> 74.196.220.117 6410 FPA_* 0 0 116 62216 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:37.908465 0.055892 tcp 10.0.2.105 56908 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:37.964659 0.034310 tcp 10.0.2.105 56909 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:37.999282 0.230841 tcp 10.0.2.105 56910 -> 195.113.214.236 443 SRPA* 0 0 53 31646 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:14:38.230823 0.145564 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:38.376804 0.174032 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:38.551255 0.148937 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:38.700649 0.059145 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:38.760171 0.167234 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:38.927783 0.181506 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.109670 0.120808 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.230855 0.238771 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.470079 0.080985 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.551778 0.204023 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.756249 0.065811 udp 10.0.2.105 7010 <-> 81.149.156.217 2530 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.822516 0.040721 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:39.863637 1.222126 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.086225 0.171105 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.257731 0.144567 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.402694 0.136202 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.539336 0.119610 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.659339 0.072154 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.731899 0.183208 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:41.915494 0.171116 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:42.086986 0.064250 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:42.151665 0.155808 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:14:42.307883 0.059524 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:19:58.774625 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:20:05.781726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:20:13.783142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:20:29.786155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:21:01.792615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:27:05.798458 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:27:12.805840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:27:20.807207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:27:36.810150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:28:08.816331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:28:19.041978 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 02:28:19.042175 1.084366 tcp 10.0.2.105 56911 -> 128.255.183.224 9027 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:34:12.826781 2.997121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:34:19.830962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:34:27.831565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:34:43.834176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:35:15.840340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:41:19.846175 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:41:26.853459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:41:34.855738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:41:50.858019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:42:22.864107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:45:03.020166 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 02:45:03.020430 0.801150 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:03.821992 0.043996 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:03.866351 0.164245 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.030994 0.289972 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.321365 0.147966 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.469747 0.094613 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.564767 0.233301 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.798508 0.060368 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:04.859241 0.167040 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:05.026622 0.181008 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:05.208065 0.121217 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:05.329641 0.534248 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:05.864250 0.078088 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:05.942672 0.218573 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:06.161672 0.000000 udp 10.0.2.105 7010 -> 81.149.156.217 2530 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 02:45:22.644934 0.054741 tcp 10.0.2.105 56912 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:45:22.699886 0.040783 tcp 10.0.2.105 56913 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:45:22.740891 0.146144 tcp 10.0.2.105 56914 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/23 02:45:22.887571 0.039353 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:22.927293 1.425688 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:24.353379 0.180174 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:24.533973 0.144954 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:24.679303 0.135746 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:24.815469 0.118901 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:24.934750 0.068096 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:25.003199 0.182916 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:25.186574 0.170437 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:25.357424 2.088133 udp 10.0.2.105 7010 <-> 80.177.149.35 7646 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:27.445951 0.165170 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:45:27.611476 0.059757 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 02:49:34.877979 3.001817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:49:41.885481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:49:49.886895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:50:05.889904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:50:37.895933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:56:49.905978 2.998940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 02:56:56.911130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:57:04.912674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:57:20.915548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:57:52.921341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 02:58:20.131523 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 02:58:20.131720 0.952567 tcp 10.0.2.105 56915 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:03:56.927962 3.002881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 03:04:03.935828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:04:11.936477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:04:27.940663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:04:59.945237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:11:03.951638 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 03:11:10.958846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:11:18.960920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:11:34.963335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:12:06.969154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:15:32.504887 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:15:32.505055 0.000000 udp 10.0.2.105 7010 -> 81.149.156.217 2530 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 03:15:48.559350 0.053312 tcp 10.0.2.105 56916 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:15:48.612915 0.052857 tcp 10.0.2.105 56917 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:15:48.666028 0.137607 tcp 10.0.2.105 56918 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:15:48.920645 0.180606 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:49.101690 0.610796 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:49.712878 0.044228 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:49.757510 0.192793 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:49.950710 0.288715 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.239865 0.151544 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.391836 0.165020 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.557223 0.181635 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.739235 0.121716 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.861308 0.064173 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:50.925847 0.257193 udp 10.0.2.105 7010 <-> 76.68.94.91 6665 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:51.183473 0.080170 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:51.264018 0.567802 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:51.832349 0.216187 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:52.231232 0.045786 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:52.277404 0.144706 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:52.422478 0.137352 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:52.560319 1.201796 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:53.762549 0.171012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:53.933918 0.121451 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:54.055759 0.122087 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:54.178303 0.175994 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:54.354685 0.171537 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:15:54.526609 0.000000 udp 10.0.2.105 7010 -> 80.177.149.35 7646 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 03:16:10.680474 0.054473 tcp 10.0.2.105 56919 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:16:10.735231 0.051493 tcp 10.0.2.105 56920 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:16:10.786990 0.131363 tcp 10.0.2.105 56921 -> 195.113.214.236 443 SRPA* 0 0 47 41972 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:16:10.919185 0.155517 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:16:11.075117 0.062277 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:18:10.975565 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 03:18:17.982872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:18:25.983971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:18:41.987556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:19:13.993377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:25:17.998986 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 03:25:25.006510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:25:33.012662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:25:49.011129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:26:21.017249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:28:21.090105 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:28:21.090318 0.939138 tcp 10.0.2.105 56922 -> 128.255.183.224 9027 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:32:25.023982 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 03:32:32.030948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:32:40.031969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:32:56.035064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:33:28.041783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:39:32.047089 3.001999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 03:39:39.054580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:39:47.056372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:40:03.059681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:40:35.065268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:46:27.542469 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:46:27.542571 0.000000 udp 10.0.2.105 7010 -> 80.177.149.35 7646 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 03:46:44.017736 0.055144 tcp 10.0.2.105 56923 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:46:44.073134 0.035227 tcp 10.0.2.105 56924 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:46:44.108589 0.131628 tcp 10.0.2.105 56925 -> 195.113.214.236 443 SRPA* 0 0 37 26009 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:46:44.240793 0.407374 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:44.648565 0.299985 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:44.949024 0.706193 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:44.949440 1.752881 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 SPA_* 0 0 29 18223 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:46:45.655607 0.041119 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:45.697062 0.083048 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:45.780493 0.165661 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:45.946551 0.146567 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:46.093488 0.122949 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:46.216817 0.060340 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:46:46.277528 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 03:46:49.993142 0.401567 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:46:56.183643 1.570139 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:03.103861 0.062514 tcp 10.0.2.105 56927 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:03.166689 0.034561 tcp 10.0.2.105 56928 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:03.201581 0.147178 tcp 10.0.2.105 56929 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:03.349356 0.181530 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:03.493858 2.870525 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:03.531290 0.212482 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:03.744170 0.234687 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:03.979296 0.086976 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.066642 0.047082 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.114062 0.144630 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.259120 0.135586 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.395129 0.121618 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.517155 0.068903 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.586429 0.171318 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:04.758140 1.411623 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:06.170138 0.174573 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:06.345157 0.183473 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:06.529074 0.156021 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:06.685506 0.059288 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/23 03:47:09.164365 4.520392 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 16 8104 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:14.494495 4.940431 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 3084 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:19.636801 0.200136 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 3 190 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:24.725364 3.123153 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:29.581735 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:47:32.745699 2.730116 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:40.766190 2.730396 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:48.786689 2.730347 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:47:53.575667 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:47:56.807346 2.730108 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:09.948005 0.401740 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:15.238143 0.409313 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:20.073651 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:48:25.648884 0.404646 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:30.940151 4.670523 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:36.440653 2.470215 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 12 6440 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:42.077953 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 03:48:44.350900 0.398228 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:49.085824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:48:49.791205 0.415770 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:48:57.086800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:49:00.822211 0.401168 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:05.579433 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:49:06.252216 0.398604 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:13.089941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:49:16.972827 4.750390 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:22.533120 0.000155 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 3 2210 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:27.823628 1.450150 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 4776 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:32.578321 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:49:34.563835 3.131823 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:42.584500 4.123268 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 18 9660 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:45.096026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:49:49.434795 4.000556 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 17 10662 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:54.885127 1.450350 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 6 3220 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:49:57.573702 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:50:01.625489 3.130115 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:07.086811 0.401430 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:20.057650 0.399770 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:25.073690 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:50:25.347618 1.450342 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 4226 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:32.088322 3.130058 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:40.108824 4.350327 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 14 6548 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:45.269012 3.880374 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:51.879370 2.900443 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:50:57.509760 3.950705 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 16 8104 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:02.910082 1.942412 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 4776 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:04.581523 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:51:09.940622 3.271960 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:18.250965 3.203635 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:26.491574 4.733294 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 17 8158 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:31.578916 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:51:32.041757 1.123324 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 9 5554 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:43.872538 0.404649 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:49.162788 0.402221 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:51:59.573519 0.396791 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:04.575851 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:52:04.863775 0.393709 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:15.274301 3.993447 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 25 18586 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:20.314736 3.129004 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:25.774968 0.000197 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:36.185738 0.396961 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:41.079002 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:52:41.475971 0.394469 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:51.887438 0.407561 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:52:57.177813 0.405704 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:07.588476 1.167252 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 22 16476 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:12.574544 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:53:19.159183 0.405568 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:24.449606 0.403304 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 2016 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:34.859965 0.406871 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:39.573115 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:53:40.150351 0.404493 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:45.441722 4.400395 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 19 9714 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:50.661981 4.280422 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 10 5484 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:53:56.422109 4.280700 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:03.492668 2.800558 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:04.084728 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:54:09.023061 0.402923 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:14.313355 3.124140 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:22.333700 2.730528 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:35.474441 0.399603 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:40.580308 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:54:40.764801 0.397192 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:51.195455 0.403390 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:54:56.595867 0.398495 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:07.196634 0.392762 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:12.076049 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:55:12.596810 3.900515 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:17.997198 4.804694 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 13 6494 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:23.897550 3.200361 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:29.497739 3.128196 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:34.947982 3.136029 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:37.082633 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:55:40.408476 3.132913 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:45.868968 3.130226 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:51.106137 3.000908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 03:55:51.329115 4.860439 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 22 14220 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:56.999353 4.830594 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 28 19224 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:55:58.112910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:56:04.849794 0.203213 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:06.114653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:56:15.880648 0.197769 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:21.320776 0.405400 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:22.116799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:56:26.083235 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:56:32.351433 2.800387 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:40.441860 2.870506 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:46.112314 0.399444 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:51.078790 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:56:51.552608 3.201094 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:56:54.123122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 03:56:59.783066 3.953435 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 11 4938 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:06.063267 3.131678 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:11.523751 4.170425 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 18 9660 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:16.074500 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:57:18.714278 2.730318 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 5500 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:24.174762 2.730107 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:29.634959 4.520315 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 16 8104 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:34.965255 4.980364 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 21 11994 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:41.395615 4.990430 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:47.835985 4.995454 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 29 18678 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:53.636330 4.400454 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 31 22154 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:57:59.486494 4.577100 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:01.579951 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:58:05.117258 4.180059 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:12.027341 4.181600 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:18.938777 2.730355 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:22.030457 0.945147 tcp 10.0.2.105 56930 -> 128.255.183.224 9027 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:24.398988 0.403758 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:29.689275 4.170646 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 19 12610 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:35.309782 0.000161 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:40.599993 3.124125 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:48.076438 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:58:48.920483 3.201907 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:58:57.101106 3.303141 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:59:02.901368 0.397575 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:59:08.301710 3.300302 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/01/23 03:59:13.082796 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 03:59:16.802281 4.220639 tcp 10.0.2.105 56926 -> 58.177.94.240 9222 FPA_* 0 0 26 14021 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:02:58.129073 3.002072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 04:03:05.136063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:03:13.137954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:03:29.141673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:04:01.147329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:10:05.153683 3.001135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 04:10:12.160421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:10:20.161854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:10:36.165075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:11:08.171252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:17:12.177579 3.064964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 04:17:19.224091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:17:27.195827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:17:29.820016 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:17:29.820175 0.000000 udp 10.0.2.105 7010 -> 76.68.94.91 6665 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:17:43.198576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:17:48.638515 0.053740 tcp 10.0.2.105 56931 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:17:48.692550 0.060225 tcp 10.0.2.105 56932 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:17:48.753151 0.145648 tcp 10.0.2.105 56933 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:17:48.899312 0.166203 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:17:49.065962 0.297045 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:17:49.363406 0.073220 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:17:49.436978 0.048067 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:17:49.485439 0.166824 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:17:49.652617 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:06.022461 0.053146 tcp 10.0.2.105 56934 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:06.075925 0.055710 tcp 10.0.2.105 56935 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:06.131912 0.154732 tcp 10.0.2.105 56936 -> 195.113.214.236 443 SRPA* 0 0 45 35632 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:06.287296 0.121675 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:06.409346 0.145694 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:06.555392 0.067513 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:06.623293 0.182069 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:06.805745 0.215241 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.021368 0.253636 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.275400 0.144542 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.464624 0.136256 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.601285 0.119909 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.721589 0.098762 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.820734 0.077613 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.898738 0.045459 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:07.944586 0.172606 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:08.117585 0.181742 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:08.299690 0.162915 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:08.463016 1.467570 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:09.930965 0.000000 udp 10.0.2.105 7010 -> 67.37.63.150 7419 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:15.204765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:18:25.399859 0.051835 tcp 10.0.2.105 56937 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:25.451943 0.054352 tcp 10.0.2.105 56938 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:25.506576 0.150742 tcp 10.0.2.105 56939 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:18:25.657873 0.059974 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:25.856257 0.695765 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:26.552516 0.171648 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:26.809068 0.168510 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.021439 0.169936 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.191850 0.078539 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.308641 0.304433 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.635013 0.046882 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.682381 0.065481 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:27.748483 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 REQ 0 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:33.113358 0.147059 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 661 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.260937 0.120742 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.382190 0.217773 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.600504 0.138272 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.739243 0.124420 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.864179 0.072945 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:33.981959 0.084267 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:34.066686 0.043984 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:34.111160 0.171474 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:34.283098 1.260269 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:35.543811 0.151771 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:35.696135 0.186770 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:35.883380 0.166809 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:36.050648 1.376340 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:37.427512 0.051593 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:37.479790 0.000000 udp 10.0.2.105 7010 -> 213.123.118.176 9007 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:44.296949 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:49.073645 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:18:49.854835 0.091463 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:18:49.966285 0.000000 udp 10.0.2.105 7010 -> 88.243.111.255 4072 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:18:55.223029 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:02.623443 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:07.799933 0.000000 udp 10.0.2.105 7010 -> 176.221.167.25 1233 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:16.633367 0.047525 udp 10.0.2.105 7010 -> 213.209.66.138 3037 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:16.680892 0.000000 icmp 213.209.66.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 251 flow=Background 1970/01/23 04:19:21.580629 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:19:25.316238 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 4183 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:33.149877 0.000000 udp 10.0.2.105 7010 -> 94.54.163.72 8938 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:39.706008 0.000000 udp 10.0.2.105 7010 -> 92.24.42.123 4979 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:45.604853 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:50.581901 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:19:52.174320 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:19:57.782512 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:05.183233 0.000000 udp 10.0.2.105 7010 -> 89.165.70.11 3445 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:14.175795 0.000000 udp 10.0.2.105 7010 -> 69.159.92.105 5290 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:19.072727 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:20:22.868403 0.000000 udp 10.0.2.105 7010 -> 64.130.177.133 7435 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:30.870069 0.000000 udp 10.0.2.105 7010 -> 93.64.195.65 1367 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:39.622209 0.000000 udp 10.0.2.105 7010 -> 79.35.241.54 2391 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:44.578853 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:20:45.531005 0.000000 udp 10.0.2.105 7010 -> 37.116.141.157 1160 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:51.159355 0.000000 udp 10.0.2.105 7010 -> 212.76.75.69 8380 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:20:57.037773 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:02.084576 0.000000 udp 10.0.2.105 7010 -> 82.63.130.191 4657 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:07.153043 0.000000 udp 10.0.2.105 7010 -> 37.153.221.193 9926 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:12.078999 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:21:14.623111 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:22.154071 0.000000 udp 10.0.2.105 7010 -> 71.126.54.37 4383 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:30.695943 0.000000 udp 10.0.2.105 7010 -> 188.219.120.143 2766 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:37.940140 0.340068 udp 10.0.2.105 7010 -> 1.164.84.148 6487 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:38.280208 0.000000 icmp 1.164.84.148 0x0303 -> 10.0.2.105 0x5719 URP 192 1 215 flow=Background 1970/01/23 04:21:42.573021 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:21:45.486713 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:21:53.919482 0.169488 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:21:54.110906 0.000000 udp 10.0.2.105 7010 -> 38.122.127.146 8607 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:03.072836 0.000000 udp 10.0.2.105 7010 -> 79.77.220.138 2432 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:07.578566 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:22:11.395204 0.000000 udp 10.0.2.105 7010 -> 88.36.202.81 3215 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:19.125695 0.000000 udp 10.0.2.105 7010 -> 85.97.31.226 3188 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:28.032864 0.116481 udp 10.0.2.105 7010 -> 46.198.226.232 7569 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:28.149345 0.000000 icmp 46.198.226.232 0x0303 -> 10.0.2.105 0x911d URP 192 1 280 flow=Background 1970/01/23 04:22:32.574639 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:22:35.308947 0.000000 udp 10.0.2.105 7010 -> 91.183.201.190 6902 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:43.560108 0.000000 udp 10.0.2.105 7010 -> 109.255.102.74 7460 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:51.782771 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:22:56.579240 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:23:00.014792 0.000000 udp 10.0.2.105 7010 -> 212.74.116.102 5147 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:07.886290 0.221562 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:23:08.120058 0.000000 udp 10.0.2.105 7010 -> 91.54.11.205 1023 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:13.895051 0.000000 udp 10.0.2.105 7010 -> 81.4.179.30 9447 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:20.690563 0.000000 udp 10.0.2.105 7010 -> 79.53.222.50 6028 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:25.580394 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:23:28.615308 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:34.103224 0.000000 udp 10.0.2.105 7010 -> 96.32.180.66 9860 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:42.245131 0.000000 udp 10.0.2.105 7010 -> 107.199.178.121 6747 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:49.104884 0.000000 udp 10.0.2.105 7010 -> 95.239.62.234 5808 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:23:54.082154 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:23:56.185442 0.000000 udp 10.0.2.105 7010 -> 82.49.5.84 5995 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:04.927933 0.000000 udp 10.0.2.105 7010 -> 151.27.158.104 2823 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:10.014930 0.000000 udp 10.0.2.105 7010 -> 217.25.10.142 8534 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:17.095257 0.000000 udp 10.0.2.105 7010 -> 194.46.56.62 4570 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:19.210415 3.002370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 04:24:22.082544 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:24:25.147331 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 1024 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:26.218170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:24:33.469002 0.000000 udp 10.0.2.105 7010 -> 70.49.6.92 2252 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:34.219753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:24:42.161448 0.000000 udp 10.0.2.105 7010 -> 123.237.104.26 9022 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:47.078447 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:24:50.226052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:24:50.455817 0.000000 udp 10.0.2.105 7010 -> 82.71.59.38 8876 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:24:57.543695 0.306166 udp 10.0.2.105 7010 <-> 41.70.151.76 9529 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:24:57.867987 0.000000 udp 10.0.2.105 7010 -> 188.107.62.71 6884 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:04.163286 0.046112 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:25:04.219157 0.000000 udp 10.0.2.105 7010 -> 196.201.224.150 1807 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:09.280859 0.000000 udp 10.0.2.105 7010 -> 87.30.61.122 2287 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:14.077030 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:25:17.332049 0.000000 udp 10.0.2.105 7010 -> 151.64.16.195 2151 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:22.228927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:25:25.183154 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:30.720974 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:36.158939 0.000000 udp 10.0.2.105 7010 -> 2.177.164.170 4373 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:41.075844 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:25:43.179415 0.143590 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:25:43.332889 0.000000 udp 10.0.2.105 7010 -> 109.149.12.252 3508 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:50.038979 0.000000 udp 10.0.2.105 7010 -> 122.177.51.247 1575 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:25:56.057710 0.079863 udp 10.0.2.105 7010 <-> 86.173.180.204 7785 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:25:56.153703 0.000000 udp 10.0.2.105 7010 -> 4.34.117.133 8378 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:02.777873 0.029103 udp 10.0.2.105 7010 -> 87.176.47.34 9286 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:02.806976 0.000000 icmp 87.176.47.34 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 179 flow=Background 1970/01/23 04:26:07.573871 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:26:08.685843 0.000000 udp 10.0.2.105 7010 -> 77.97.237.63 7022 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:14.213577 0.000000 udp 10.0.2.105 7010 -> 212.67.186.98 9774 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:22.014214 0.149849 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:26:22.174274 0.000000 udp 10.0.2.105 7010 -> 117.199.82.47 9710 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:30.607149 0.000000 udp 10.0.2.105 7010 -> 217.251.85.107 3349 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:35.574147 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:26:36.645948 0.000000 udp 10.0.2.105 7010 -> 188.169.236.190 4092 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:44.517112 0.000000 udp 10.0.2.105 7010 -> 58.9.188.253 5534 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:52.208516 0.346502 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:26:52.644209 0.149617 udp 10.0.2.105 7010 <-> 74.12.172.203 3419 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:26:52.822157 0.000000 udp 10.0.2.105 7010 -> 81.137.229.17 5521 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:26:58.416907 0.000000 udp 10.0.2.105 7010 -> 151.77.25.0 4708 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:03.073533 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:27:05.727864 0.057305 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:05.951144 0.000000 udp 10.0.2.105 7010 -> 212.114.206.139 2171 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:13.719334 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1242 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:19.978443 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:26.657853 0.065442 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:26.849739 0.080921 udp 10.0.2.105 7010 -> 88.235.172.45 5925 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:26.930660 0.000000 icmp 88.235.172.45 0x0303 -> 10.0.2.105 0x2517 URP 192 1 188 flow=Background 1970/01/23 04:27:31.574999 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:27:32.626118 0.072694 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:32.791539 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:39.566047 0.000000 udp 10.0.2.105 7010 -> 213.125.137.18 7670 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:48.509378 0.177409 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:48.773103 0.000000 udp 10.0.2.105 7010 -> 91.14.238.103 7430 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:27:56.551131 0.401367 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:56.998531 0.157708 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:27:57.234598 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 1398 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:01.077143 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:28:05.323679 0.000000 udp 10.0.2.105 7010 -> 84.63.208.243 2142 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:12.723867 0.000000 udp 10.0.2.105 7010 -> 86.174.142.100 9534 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:18.322013 0.000000 udp 10.0.2.105 7010 -> 93.220.11.188 7273 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:22.978940 1.005849 tcp 10.0.2.105 56940 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/23 04:28:26.654065 0.000000 udp 10.0.2.105 7010 -> 79.38.123.131 5600 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:33.574350 0.015180 udp 10.0.2.105 7010 <-> 134.60.38.73 4960 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:28:33.758272 0.064816 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:28:33.844549 0.000000 udp 10.0.2.105 7010 -> 93.148.97.107 2689 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:41.715766 0.000000 udp 10.0.2.105 7010 -> 95.246.150.8 2426 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:49.566560 0.000000 udp 10.0.2.105 7010 -> 194.219.11.90 3785 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:28:54.073503 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:28:57.477751 0.075925 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:28:57.750737 0.000000 udp 10.0.2.105 7010 -> 80.2.58.114 4298 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:06.697616 0.000000 udp 10.0.2.105 7010 -> 86.184.9.67 8078 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:12.825296 0.000000 udp 10.0.2.105 7010 -> 208.124.117.254 6762 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:18.030283 0.000000 udp 10.0.2.105 7010 -> 109.234.204.162 3071 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:22.574382 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:29:23.155546 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 1024 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:31.721840 0.000000 udp 10.0.2.105 7010 -> 79.47.46.191 6854 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:38.327171 0.000000 udp 10.0.2.105 7010 -> 87.78.41.135 3361 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:45.988064 0.000000 udp 10.0.2.105 7010 -> 89.250.212.62 3999 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:50.574072 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:29:52.627107 0.076691 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:29:52.718875 0.000000 udp 10.0.2.105 7010 -> 46.14.134.96 2604 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:29:59.153348 0.103922 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:29:59.293855 0.000000 udp 10.0.2.105 7010 -> 95.10.157.242 1192 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:07.799652 1.027201 udp 10.0.2.105 7010 <-> 190.193.96.71 5308 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:30:08.871276 0.083541 udp 10.0.2.105 7010 <-> 46.8.127.74 6331 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/23 04:30:08.968812 0.000000 udp 10.0.2.105 7010 -> 115.30.57.71 8453 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:16.402272 0.000000 udp 10.0.2.105 7010 -> 122.129.84.67 6337 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:21.078448 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:30:22.630863 0.000000 udp 10.0.2.105 7010 -> 194.228.84.182 6003 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:29.180187 0.000000 udp 10.0.2.105 7010 -> 212.69.47.40 8789 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:38.013511 0.000000 udp 10.0.2.105 7010 -> 77.1.73.53 5290 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:44.182017 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:30:49.079262 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:30:50.521005 0.000000 udp 10.0.2.105 7010 -> 92.110.32.21 4397 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 04:31:26.235993 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 04:31:33.244353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:31:41.248693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:31:57.246868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:32:29.252768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:38:33.259690 3.000517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 04:38:40.266012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:38:48.267886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:39:04.270972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:39:36.276886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:48:14.284471 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 04:48:21.291569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:48:29.293343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:48:45.295996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:49:17.302472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:55:21.308496 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 04:55:28.315543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:55:36.316898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:55:52.320734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:56:24.326332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 04:58:23.988600 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 04:58:23.988698 0.948779 tcp 10.0.2.105 56941 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:00:57.429332 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 05:00:57.429495 0.622301 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:58.052220 0.164264 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:58.216897 0.164545 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:58.381877 0.875119 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.257402 0.069392 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.327181 0.297822 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.625421 0.079766 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.705548 0.051996 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.757884 0.146247 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:00:59.904526 0.119526 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.024458 0.110742 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.135584 0.148620 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.284722 0.041242 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.326291 0.120971 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.447640 0.213302 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.661320 0.136489 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.798522 0.170328 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:00.969196 0.156560 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:01.126105 0.949075 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:02.075525 0.144791 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:02.220848 0.182330 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:02.403600 1.516437 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:03.920427 0.065713 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:03.986513 0.086642 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:04.073498 0.165903 udp 10.0.2.105 7010 <-> 70.117.22.156 5141 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:04.239788 0.221144 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:04.461335 0.000000 udp 10.0.2.105 7010 -> 41.70.151.76 9529 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:01:20.173691 0.052729 tcp 10.0.2.105 56942 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:20.226701 0.052530 tcp 10.0.2.105 56943 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:20.279523 0.143494 tcp 10.0.2.105 56944 -> 195.113.214.236 443 SRPA* 0 0 42 22136 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:20.423626 0.044779 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:20.468802 0.143228 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:20.612503 0.065537 udp 10.0.2.105 7010 <-> 86.173.180.204 7785 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:20.678437 0.146601 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:20.825383 0.000000 udp 10.0.2.105 7010 -> 74.12.172.203 3419 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:01:37.687240 0.052183 tcp 10.0.2.105 56945 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:37.739616 0.053213 tcp 10.0.2.105 56946 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:37.793055 0.149346 tcp 10.0.2.105 56947 -> 195.113.214.236 443 SRPA* 0 0 23 13302 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:37.942971 0.783606 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:38.727005 0.056654 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:38.784003 0.061150 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:38.845549 0.063260 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:38.909174 0.177783 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:39.087388 0.398410 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:39.486193 0.398569 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:39.885138 0.057965 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:39.943481 0.000000 udp 10.0.2.105 7010 -> 134.60.38.73 4960 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:01:56.884704 0.052796 tcp 10.0.2.105 56948 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:56.937702 0.052238 tcp 10.0.2.105 56949 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:56.990173 0.153062 tcp 10.0.2.105 56950 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:01:57.143792 0.065302 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:57.209517 0.062926 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:57.272852 0.119006 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:57.392218 0.733562 udp 10.0.2.105 7010 <-> 190.193.96.71 5308 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:01:58.126170 0.000000 udp 10.0.2.105 7010 -> 46.8.127.74 6331 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:02:13.859575 0.053629 tcp 10.0.2.105 56951 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:02:13.913545 0.058924 tcp 10.0.2.105 56952 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:02:13.972818 0.147982 tcp 10.0.2.105 56953 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:02:28.331975 3.002091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 05:02:35.339789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:02:43.343445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:02:59.343649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:03:31.352643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:09:35.356001 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:09:42.363438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:09:50.364996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:10:06.367786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:10:38.373875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:16:42.379445 3.002079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:16:49.387350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:16:57.389030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:17:13.392187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:17:45.397952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:23:49.404712 3.000809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:23:56.411922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:24:04.413191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:24:20.416191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:24:52.422010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:28:24.937990 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 05:28:24.938087 0.987334 tcp 10.0.2.105 56954 -> 128.255.183.224 9027 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:30:56.428398 3.002723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:31:03.435297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:31:11.436438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:31:27.441796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:31:59.445586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:32:24.803139 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 05:32:24.803238 0.000000 udp 10.0.2.105 7010 -> 41.70.151.76 9529 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:32:41.387705 0.051253 tcp 10.0.2.105 56955 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:41.439216 0.076374 tcp 10.0.2.105 56956 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:41.515815 0.155578 tcp 10.0.2.105 56957 -> 195.113.214.236 443 SRPA* 0 0 34 27112 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:41.672113 0.000000 udp 10.0.2.105 7010 -> 74.12.172.203 3419 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:32:57.669426 0.053899 tcp 10.0.2.105 56958 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:57.723571 0.053091 tcp 10.0.2.105 56959 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:57.776944 0.156368 tcp 10.0.2.105 56960 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:32:57.933995 0.000000 udp 10.0.2.105 7010 -> 134.60.38.73 4960 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:33:13.372862 0.050983 tcp 10.0.2.105 56961 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:13.424134 0.052780 tcp 10.0.2.105 56962 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:13.477172 0.151999 tcp 10.0.2.105 56963 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:13.629732 0.000000 udp 10.0.2.105 7010 -> 46.8.127.74 6331 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:33:30.827940 0.054550 tcp 10.0.2.105 56964 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:30.882803 0.055602 tcp 10.0.2.105 56965 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:30.938637 0.161379 tcp 10.0.2.105 56966 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:31.100606 0.474090 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:31.575042 0.163353 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:31.738784 0.407368 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.146555 0.184784 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.331747 0.118530 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.450621 0.071733 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.522757 0.146718 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.669850 0.061119 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.731348 0.085060 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.816799 0.080692 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:32.897833 0.302004 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.200256 0.171323 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.371964 0.166082 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.538475 0.120332 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.659193 0.084194 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.743762 0.215262 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:33.959402 0.040663 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:34.000572 0.135383 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:34.136349 0.137708 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:34.274415 0.284650 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:34.559496 0.180218 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:34.740067 1.065981 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:35.806406 0.060715 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:33:35.867489 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:33:53.981971 0.057670 tcp 10.0.2.105 56967 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:54.039908 0.053525 tcp 10.0.2.105 56968 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:54.093744 0.224342 tcp 10.0.2.105 56969 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:33:54.319185 0.000000 udp 10.0.2.105 7010 -> 70.117.22.156 5141 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:34:10.117952 0.052811 tcp 10.0.2.105 56970 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:10.171013 0.056373 tcp 10.0.2.105 56971 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:10.227659 0.145704 tcp 10.0.2.105 56972 -> 195.113.214.236 443 SRPA* 0 0 25 13916 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:10.373910 0.207955 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:10.582302 0.136946 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:10.719679 0.000000 udp 10.0.2.105 7010 -> 86.173.180.204 7785 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:34:27.179098 0.052557 tcp 10.0.2.105 56973 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:27.232001 0.060707 tcp 10.0.2.105 56974 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:27.293046 0.158033 tcp 10.0.2.105 56975 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:27.451604 0.145619 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:27.597653 0.046619 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:27.644665 0.060218 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:27.705308 0.068091 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:27.773740 0.176800 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:27.950937 0.072652 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.023983 0.218372 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.242771 0.227100 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.470263 0.059217 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.529872 0.399562 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.929777 0.065424 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:28.995616 0.066182 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:29.062202 0.136360 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/23 05:34:29.198943 0.000000 udp 10.0.2.105 7010 -> 190.193.96.71 5308 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 05:34:44.554146 0.051276 tcp 10.0.2.105 56976 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:44.605633 0.052946 tcp 10.0.2.105 56977 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:34:44.658843 0.243771 tcp 10.0.2.105 56978 -> 195.113.214.236 443 SRPA* 0 0 68 69852 flow=From-Botnet-V2-TCP-Established 1970/01/23 05:38:03.455474 3.000699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 05:38:10.466771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:38:18.466624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:38:34.463937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:39:06.469832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:47:54.481674 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:48:01.489307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:48:09.490682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:48:25.493621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:48:57.499141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:55:01.505882 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 05:55:08.516765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:55:16.516584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:55:32.517464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:56:04.523386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 05:58:25.927734 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 05:58:25.927820 0.972729 tcp 10.0.2.105 56979 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:02:08.529844 3.003436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:02:15.537252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:02:23.538438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:02:39.541654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:03:11.547275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:05:06.013217 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 06:05:06.013319 0.000000 udp 10.0.2.105 7010 -> 70.117.22.156 5141 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 06:05:22.477898 0.052117 tcp 10.0.2.105 56980 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:22.530347 0.053514 tcp 10.0.2.105 56981 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:22.584152 0.123901 tcp 10.0.2.105 56982 -> 195.113.214.236 443 SRPA* 0 0 53 47449 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:22.709004 0.097439 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:05:22.806943 0.000000 udp 10.0.2.105 7010 -> 86.173.180.204 7785 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 06:05:40.943229 0.056784 tcp 10.0.2.105 56983 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:41.000261 0.053088 tcp 10.0.2.105 56984 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:41.053623 0.139998 tcp 10.0.2.105 56985 -> 195.113.214.236 443 SRPA* 0 0 47 41028 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:41.194362 0.000000 udp 10.0.2.105 7010 -> 190.193.96.71 5308 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 06:05:59.541373 0.051914 tcp 10.0.2.105 56986 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:59.593616 0.053352 tcp 10.0.2.105 56987 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:59.647312 0.222079 tcp 10.0.2.105 56988 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:05:59.869928 0.172361 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:00.042736 0.686316 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:00.729532 0.163958 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:00.893837 0.062364 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:00.956588 0.311069 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:01.268029 0.073296 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:01.341733 0.304987 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:01.647128 0.174536 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:01.822056 0.119453 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:01.941892 0.067674 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.010020 0.147681 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.158143 0.217416 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.376000 0.041220 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.417573 0.137551 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.555460 0.144762 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.700661 0.163982 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.865101 0.122621 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:02.988190 0.080092 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:03.068645 0.171209 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:03.240200 0.184679 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:03.425336 0.246609 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:03.672365 0.061205 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:03.733939 1.203266 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:04.937587 0.138654 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.076631 0.220572 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.297586 0.045584 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.343574 0.062421 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.406429 0.067971 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.474766 0.178880 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.654032 0.055742 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.710155 0.233667 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:05.944182 0.144582 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.089128 0.067987 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.157510 0.059538 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.217420 0.217993 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.435780 0.061987 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.498158 0.367735 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:06:06.866291 0.401110 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:09:15.553246 3.002311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 06:09:22.560731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:09:30.572391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:09:46.575264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:10:18.581280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:16:22.590466 2.998864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:16:29.595088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:16:37.596292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:16:53.599606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:17:25.605208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:23:29.612314 3.002815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:23:36.622788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:23:44.622214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:24:00.623264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:24:32.629148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:28:26.906594 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 06:28:26.906742 0.972531 tcp 10.0.2.105 56989 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:30:36.635571 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:30:43.642662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:30:51.644314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:31:07.646729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:31:39.653391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:36:29.310263 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 06:36:29.310367 0.097890 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:29.408653 0.172778 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:29.581919 0.079656 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:29.662031 0.161187 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:29.823646 0.215061 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:30.039106 0.164807 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:30.204282 0.071286 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:30.275934 0.299825 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:30.576161 0.000000 udp 10.0.2.105 7010 -> 74.196.220.117 9202 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 06:36:47.898555 0.052326 tcp 10.0.2.105 56990 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:36:47.951158 0.032846 tcp 10.0.2.105 56991 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:36:47.984365 0.130967 tcp 10.0.2.105 56992 -> 195.113.214.236 443 SRPA* 0 0 48 41330 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:36:48.116037 0.120546 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.237043 0.070631 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.308065 0.143035 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.451492 0.207806 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.659692 0.040168 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.700423 0.135540 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.836354 0.144709 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:48.981418 0.222974 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.204803 0.120760 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.325936 0.078340 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.404653 0.171049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.576071 0.059583 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.635998 0.184271 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:49.820671 0.239697 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:50.060774 1.085450 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.146601 0.140728 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.287758 0.233767 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.521929 0.045054 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.567380 0.066993 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.634807 0.071262 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.706436 0.179031 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:36:51.885894 0.000000 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 06:37:09.749125 0.051612 tcp 10.0.2.105 56993 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:37:09.801103 0.032504 tcp 10.0.2.105 56994 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:37:09.833920 0.142051 tcp 10.0.2.105 56995 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/23 06:37:09.976628 0.145871 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.122891 0.140322 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.263680 0.067884 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.331949 0.066032 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.398343 0.078523 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.477260 0.399863 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:10.877483 0.145320 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:11.023156 0.058203 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 06:37:43.660422 3.000420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 06:37:50.666960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:37:58.668194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:38:14.671254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:38:46.677458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:47:44.683581 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:47:51.690902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:47:59.692763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:48:15.695607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:48:47.701503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:54:51.707629 3.001629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 06:54:58.715585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:55:06.716885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:55:22.719720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:55:54.728970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 06:58:27.886222 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 06:58:27.886323 0.953487 tcp 10.0.2.105 56996 -> 128.255.183.224 9027 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:01:58.731502 3.001963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:02:10.056460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:02:17.946562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:02:33.733396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:03:05.290463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:07:32.601033 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 07:07:32.601143 0.234429 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:32.836007 0.000000 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 07:07:49.695086 0.054216 tcp 10.0.2.105 56997 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:07:49.749566 0.052533 tcp 10.0.2.105 56998 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:07:49.802460 0.136548 tcp 10.0.2.105 56999 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:07:49.939545 0.294788 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.234693 0.171375 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.406419 0.169899 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.576694 0.082876 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.660020 0.097143 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.758186 0.213244 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:50.971763 0.060722 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.032895 0.291166 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.324547 0.119294 udp 10.0.2.105 7010 <-> 208.104.248.106 9259 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.444272 0.068214 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.512939 0.045457 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.558768 0.137790 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.696947 0.144930 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:51.842255 0.165611 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.008263 0.216639 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.225359 0.147947 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.373749 0.171455 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.545670 0.058643 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.604789 0.185323 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:52.790442 0.244259 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.035090 0.076200 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.111676 0.122063 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.234192 0.334214 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.568792 0.065219 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.634371 0.068210 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.702997 0.175401 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:53.878733 0.223687 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.102765 0.137704 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.240855 0.045819 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.287040 0.171840 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.459284 0.140919 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.600594 0.380004 udp 10.0.2.105 7010 <-> 86.174.32.132 5609 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:54.980927 0.398543 udp 10.0.2.105 7010 <-> 116.89.110.81 6487 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:55.379869 0.177744 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:55.557932 0.061152 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:55.619435 0.605748 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:07:56.225564 0.072389 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:09:05.765364 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:09:12.772999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:09:20.774171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:09:36.777587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:10:08.783315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:16:12.789068 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:16:19.796872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:16:27.801022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:16:43.801230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:17:15.807611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:23:19.812907 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:23:26.820786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:23:34.822214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:23:50.825355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:24:22.831287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:28:28.845546 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 07:28:28.845697 1.951763 tcp 10.0.2.105 57000 -> 128.255.183.224 9027 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:30:26.837551 3.002184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:30:33.844650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:30:41.845996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:30:57.849147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:31:29.865592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:37:33.872445 3.010550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:37:40.889744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:37:48.890523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:38:04.893352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:38:21.285161 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 07:38:21.285329 0.166125 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:21.451875 0.045453 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:21.497729 0.108944 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:21.607032 0.146853 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:21.754322 0.213150 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:21.967828 0.060570 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:22.028772 0.171947 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:22.201100 0.385287 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:22.586787 0.302835 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:22.890031 0.000000 udp 10.0.2.105 7010 -> 208.104.248.106 9259 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 07:38:37.148479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:38:40.859992 0.054425 tcp 10.0.2.105 57001 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:38:40.914750 0.058070 tcp 10.0.2.105 57002 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:38:40.973114 0.124929 tcp 10.0.2.105 57003 -> 195.113.214.236 443 SRPA* 0 0 36 26971 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:38:41.098606 0.065969 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.164994 0.041023 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.206377 0.135303 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.342106 0.137749 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.480239 0.161236 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.641843 0.216588 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:41.858825 0.145958 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.005143 0.171068 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.176627 0.059969 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.236981 0.180807 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.418184 0.240834 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.659409 0.077586 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.737384 0.122439 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.860314 0.074565 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:42.935302 0.176821 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.112519 0.220607 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.333699 0.143184 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.477243 0.045011 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.522667 0.336735 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.859768 0.064162 udp 10.0.2.105 7010 <-> 213.123.194.246 4270 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:43.924524 0.127908 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:44.052873 0.139725 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:38:44.192946 0.000000 udp 10.0.2.105 7010 -> 86.174.32.132 5609 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 07:39:00.576987 0.053308 tcp 10.0.2.105 57004 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:00.630570 0.064635 tcp 10.0.2.105 57005 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:00.695482 0.214100 tcp 10.0.2.105 57006 -> 195.113.214.236 443 SRPA* 0 0 42 23354 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:00.910309 0.058712 udp 10.0.2.105 7010 <-> 81.136.220.61 6167 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:39:00.969420 0.071070 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:39:01.040900 0.000000 udp 10.0.2.105 7010 -> 116.89.110.81 6487 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 07:39:18.819117 0.052159 tcp 10.0.2.105 57007 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:18.871613 0.057276 tcp 10.0.2.105 57008 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:18.929246 0.147326 tcp 10.0.2.105 57009 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/23 07:39:19.077225 0.114969 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:39:19.192718 0.069085 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/23 07:47:36.928183 3.060838 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 07:47:43.968509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:47:51.946719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:48:07.950044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:48:39.956581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:54:43.962096 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 07:54:50.969824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:54:58.971230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:55:14.974160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:55:46.980558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 07:58:30.806492 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 07:58:30.806726 0.986475 tcp 10.0.2.105 57010 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:01:50.985889 3.002056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:01:57.993863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:02:05.995299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:02:21.998204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:02:54.010668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:08:58.010601 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:09:05.017419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:09:13.019259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:09:29.022235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:09:43.143280 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 08:09:43.143433 0.118616 udp 10.0.2.105 7010 -> 208.104.248.106 9259 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:09:43.262049 0.000000 icmp 208.104.248.106 0x0303 -> 10.0.2.105 0x2b24 URP 192 1 153 flow=Background 1970/01/23 08:09:59.207366 0.050459 tcp 10.0.2.105 57011 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:09:59.258096 0.051712 tcp 10.0.2.105 57012 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:09:59.310063 0.128967 tcp 10.0.2.105 57013 -> 195.113.214.236 443 SRPA* 0 0 61 53641 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:09:59.439669 0.000000 udp 10.0.2.105 7010 -> 86.174.32.132 5609 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:10:01.028214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:10:17.772938 0.048875 tcp 10.0.2.105 57014 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:17.821824 0.050926 tcp 10.0.2.105 57015 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:17.873018 0.132004 tcp 10.0.2.105 57016 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:18.005599 0.000000 udp 10.0.2.105 7010 -> 116.89.110.81 6487 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:10:35.598567 0.053397 tcp 10.0.2.105 57017 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:35.652204 0.051690 tcp 10.0.2.105 57018 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:35.704134 0.216406 tcp 10.0.2.105 57019 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:35.921215 0.163947 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.085580 0.208769 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.294783 0.062859 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.358039 0.159450 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.517831 0.166569 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.684793 0.069324 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.754461 0.092502 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.847434 0.049274 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:36.897108 0.294868 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.192529 0.043932 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.236853 0.137600 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.374821 0.072066 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.447305 0.147822 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.595467 0.188320 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.784149 0.062941 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:37.847427 0.217373 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.065177 0.162832 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.228538 0.144741 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.373643 0.072084 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.446126 0.178163 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.624685 0.181303 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.806375 0.076761 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:38.883522 1.147999 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:40.031874 0.120493 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:40.152787 0.044517 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:40.197668 0.603082 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:40.801138 0.000000 udp 10.0.2.105 7010 -> 213.123.194.246 4270 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:10:56.017822 0.051606 tcp 10.0.2.105 57020 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:56.069708 0.052615 tcp 10.0.2.105 57021 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:56.122575 0.145441 tcp 10.0.2.105 57022 -> 195.113.214.236 443 SRPA* 0 0 46 24992 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:10:56.268631 0.167860 udp 10.0.2.105 7010 <-> 95.238.31.20 2799 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:56.436861 0.142590 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:56.579868 0.143558 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:56.723813 0.220096 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:56.944396 0.065597 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:10:57.010316 0.000000 udp 10.0.2.105 7010 -> 81.136.220.61 6167 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:11:12.622128 0.054257 tcp 10.0.2.105 57023 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:11:12.676684 0.049371 tcp 10.0.2.105 57024 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:11:12.726337 0.212485 tcp 10.0.2.105 57025 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:11:12.939415 0.144248 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:11:13.084004 0.251644 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:16:05.034227 3.012194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 08:16:12.051640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:16:20.053050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:16:36.056025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:17:08.063551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:23:12.068330 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:23:19.076090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:23:27.077160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:23:43.080111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:24:15.086533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:28:31.795788 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 08:28:31.795935 0.942371 tcp 10.0.2.105 57026 -> 128.255.183.224 9027 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:30:19.092267 3.001549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:30:26.100235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:30:34.103014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:30:50.104149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:31:22.113512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:37:26.116091 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:37:33.123702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:37:41.125161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:37:57.127840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:38:29.134609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:41:18.828580 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 08:41:18.828783 0.000000 udp 10.0.2.105 7010 -> 213.123.194.246 4270 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:41:33.961786 0.049256 tcp 10.0.2.105 57027 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:34.011355 0.052062 tcp 10.0.2.105 57028 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:34.063756 0.141138 tcp 10.0.2.105 57029 -> 195.113.214.236 443 SRPA* 0 0 61 39893 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:34.205476 0.000000 udp 10.0.2.105 7010 -> 81.136.220.61 6167 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:41:49.683360 0.053015 tcp 10.0.2.105 57030 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:49.736634 0.075722 tcp 10.0.2.105 57031 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:49.812610 0.148024 tcp 10.0.2.105 57032 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:41:49.961250 0.164054 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.125632 0.217387 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.343437 0.165475 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.509263 0.072511 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.582138 0.096990 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.679469 0.043394 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:50.723186 0.290258 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.013803 0.044969 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.059108 0.171556 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.231050 0.060030 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.291492 0.171563 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.463454 0.059552 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.523392 0.210146 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.733872 0.167231 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.901539 0.070792 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:51.972744 0.136299 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.109468 0.147943 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.257790 0.078656 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.336880 0.144921 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.482186 0.177765 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.660472 0.069586 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.730429 0.180504 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:52.911297 0.256350 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.168073 0.120972 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.289419 0.045719 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.335532 0.341014 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.676952 0.208693 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.886031 0.065359 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:53.951746 0.145263 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:41:54.097383 0.000000 udp 10.0.2.105 7010 -> 95.238.31.20 2799 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 08:42:09.521114 0.049205 tcp 10.0.2.105 57033 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:42:09.570513 0.058308 tcp 10.0.2.105 57034 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:42:09.629062 0.143325 tcp 10.0.2.105 57035 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/23 08:42:09.772685 0.142222 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:42:09.915292 0.240816 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:42:10.156627 0.066808 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/23 08:47:30.145957 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 08:47:37.152846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:47:45.153684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:48:01.157164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:48:33.163329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:54:37.171583 2.999220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 08:54:44.176237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:54:52.177791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:55:08.180776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:55:40.186977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 08:58:32.745637 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 08:58:32.745818 0.960790 tcp 10.0.2.105 57036 -> 128.255.183.224 9027 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:01:44.193332 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:01:51.206053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:01:59.202288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:02:15.204930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:02:47.210902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:08:51.216759 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:08:58.223864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:09:06.225641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:09:22.228754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:09:54.234532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:12:26.083358 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 09:12:26.083531 0.000000 udp 10.0.2.105 7010 -> 95.238.31.20 2799 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:12:43.593068 0.054561 tcp 10.0.2.105 57037 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:12:43.647990 0.056831 tcp 10.0.2.105 57038 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:12:43.705151 0.123702 tcp 10.0.2.105 57039 -> 195.113.214.236 443 SRPA* 0 0 53 47451 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:12:43.829434 0.293249 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:12:44.123062 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:13:02.355407 0.053321 tcp 10.0.2.105 57040 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:02.408970 0.064151 tcp 10.0.2.105 57041 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:02.473435 0.180204 tcp 10.0.2.105 57042 -> 195.113.214.236 443 SRPA* 0 0 41 23458 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:02.653808 0.077951 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:02.732156 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:13:17.888063 0.053172 tcp 10.0.2.105 57043 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:17.941574 0.061113 tcp 10.0.2.105 57044 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:18.003032 0.146767 tcp 10.0.2.105 57045 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:13:18.150317 0.193114 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:18.343857 0.301014 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:18.645279 0.041121 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:18.686787 0.169558 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:18.856733 0.294935 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.152074 0.059313 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.211802 0.235378 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.447531 0.157048 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.604979 0.118392 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.723765 0.136851 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:19.861022 0.145384 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.006800 0.171199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.178362 0.059283 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.238037 0.176694 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.415079 0.067320 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.482791 0.176162 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.659309 0.231495 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:20.891241 0.121528 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.013175 0.083695 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.097233 0.151791 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.249452 0.220785 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.470626 0.068045 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.539057 0.142946 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.682420 0.046221 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:21.729007 0.325470 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:22.054834 0.064271 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:22.119494 0.141914 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:13:22.261807 0.183577 udp 10.0.2.105 7010 <-> 95.247.105.32 6234 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:15:58.240785 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 09:16:05.247828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:16:13.249355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:16:29.252638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:17:01.258486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:23:05.264080 3.002655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:23:12.271910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:23:20.273530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:23:36.276887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:24:08.282938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:28:33.714598 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 09:28:33.714733 1.006641 tcp 10.0.2.105 57046 -> 128.255.183.224 9027 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:30:12.288762 3.003749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:30:19.295839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:30:27.297446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:30:43.300532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:31:15.306875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:37:19.311923 3.002207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:37:26.320778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:37:34.321277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:37:50.324176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:38:22.338061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:43:51.624035 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 09:43:51.624220 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:44:07.610366 0.049159 tcp 10.0.2.105 57047 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:07.659740 0.049813 tcp 10.0.2.105 57048 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:07.709800 0.130327 tcp 10.0.2.105 57049 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:07.840832 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:44:24.171394 0.049076 tcp 10.0.2.105 57050 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:24.220776 0.049421 tcp 10.0.2.105 57051 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:24.270435 0.126672 tcp 10.0.2.105 57052 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:24.397757 0.177209 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:24.575335 0.075086 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:24.650789 0.099243 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:24.750430 0.307858 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.058933 0.063970 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.123282 0.285076 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.408710 0.225786 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.634891 0.058723 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.694237 0.206831 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:25.901692 0.156962 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.059064 0.067980 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.127422 0.137086 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.264895 0.158657 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.423885 0.172678 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.597030 0.059332 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.656699 0.211838 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:26.868901 0.937620 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:27.806928 0.123674 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:27.930966 0.076957 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.008333 0.179722 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.188458 0.176736 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.365595 0.067134 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.433105 0.221109 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.654825 0.069477 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:28.724693 0.278533 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:29.003628 0.060165 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:29.064179 0.430219 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:29.494748 0.063072 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:29.558192 0.151806 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/23 09:44:29.710343 0.000000 udp 10.0.2.105 7010 -> 95.247.105.32 6234 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 09:44:46.173271 0.050841 tcp 10.0.2.105 57053 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:46.224336 0.053919 tcp 10.0.2.105 57054 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:44:46.278507 0.138568 tcp 10.0.2.105 57055 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/23 09:47:24.343014 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 09:47:31.349851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:47:39.351250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:47:55.354282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:48:27.359977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:54:31.366120 3.001486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 09:54:38.379163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:54:46.375261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:55:02.378058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:55:34.383951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 09:58:34.724100 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 09:58:34.724260 1.059967 tcp 10.0.2.105 57056 -> 128.255.183.224 9027 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:01:38.389635 3.002739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:01:45.397795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:01:53.398938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:02:09.402952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:02:41.408247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:08:45.414806 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:08:52.421874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:09:00.422853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:09:16.426160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:09:48.432191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:14:53.306183 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 10:14:53.306341 0.000000 udp 10.0.2.105 7010 -> 95.247.105.32 6234 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 10:15:11.233579 0.053332 tcp 10.0.2.105 57057 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:15:11.287225 0.052864 tcp 10.0.2.105 57058 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:15:11.340464 0.139244 tcp 10.0.2.105 57059 -> 195.113.214.236 443 SRPA* 0 0 42 35082 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:15:11.480486 0.059698 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:11.540721 0.296748 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:11.837893 0.065494 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:11.903783 0.167738 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.071913 0.070846 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.143153 0.253464 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.397332 0.062032 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.459754 0.210446 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.670588 0.227453 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.898441 0.070102 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:12.968989 0.136460 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:13.105870 0.258209 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:13.364497 0.058804 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:13.423741 0.213946 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:13.638078 0.163181 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:13.833972 0.179714 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:14.014074 0.460636 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:14.475088 0.173126 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:14.648629 0.079325 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:14.728510 0.228337 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:14.957213 0.067296 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.024886 0.207080 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.232507 0.177337 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.410242 0.155671 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.566304 0.061161 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.627898 0.067196 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.695518 0.068167 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:15.764075 0.436533 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:16.200993 0.159362 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:15:52.438246 3.001720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:15:59.446408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:16:07.446956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:16:23.450024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:16:55.456404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:22:59.461726 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:23:06.469188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:23:14.471663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:23:30.473926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:24:02.480098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:28:35.783543 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 10:28:35.783701 1.113193 tcp 10.0.2.105 57060 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:30:06.486054 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:30:13.493472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:30:21.495019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:30:37.502704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:31:09.503903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:37:13.509677 3.002235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:37:20.516855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:37:28.519043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:37:55.829922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:38:27.387744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:44:26.330567 3.072537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:44:42.016686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:44:49.913402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:45:05.706058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:45:39.019192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:45:40.918249 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 10:45:40.918339 0.065222 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:40.983929 0.171858 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.156107 0.110083 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.266541 0.083645 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.350517 0.292887 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.643841 0.238854 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.883070 0.062197 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:41.945646 0.214706 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:43.019491 0.162679 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:43.182507 0.069035 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:43.251806 0.138561 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:43.390713 0.256701 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:58.984809 0.060559 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.045788 0.169849 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.216028 0.160138 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.376561 0.177359 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.554325 0.095052 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.649748 0.128974 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.779092 0.069793 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:45:59.849243 0.220851 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.070502 0.267154 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.338031 0.179976 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.518408 0.176594 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.695378 0.157740 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.853514 0.066114 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.920024 0.067833 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:00.988474 0.067259 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:01.056104 0.351394 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:01.407910 0.150047 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/23 10:46:04.152742 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 10:51:37.972963 2.953790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:51:44.886776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:51:52.780053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:52:08.564227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:52:40.133524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:58:39.049001 2.961668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 10:58:41.269449 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 10:58:41.269643 1.030708 tcp 10.0.2.105 57061 -> 128.255.183.224 9027 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/23 10:58:45.957796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:58:53.841284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:59:09.622361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 10:59:41.182005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:05:41.647028 3.000750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:05:48.653130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:05:56.655375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:06:12.658043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:06:44.664039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:12:48.669966 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:12:55.678914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:13:03.678915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:13:19.681735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:13:51.691236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:16:15.815450 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 11:16:15.815657 0.062228 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:15.878323 0.227938 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.106650 0.294374 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.401411 0.069748 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.471529 0.059546 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.531440 0.215410 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.747217 0.062448 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:16.810046 0.215806 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.026184 0.137310 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.163856 0.198453 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.362782 0.071480 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.434678 0.239594 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.674674 0.059645 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.734719 0.170979 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:17.906128 0.158693 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:18.065243 0.183832 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:18.265051 0.072978 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:18.338406 0.221779 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:18.560639 0.083273 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:18.644437 0.366514 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.011300 0.230816 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.242484 0.172817 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.415666 0.176996 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.592990 0.152573 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.745946 0.069564 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:19.815878 0.326221 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:20.143008 0.065537 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:20.208907 0.064601 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:16:20.273904 0.152395 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:19:55.693761 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:20:02.701336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:20:10.703033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:20:26.705725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:20:58.712136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:27:02.718488 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:27:09.725631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:27:17.726841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:27:33.729332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:28:05.741720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:28:37.923218 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 11:28:37.923434 1.025333 tcp 10.0.2.105 57062 -> 128.255.183.224 9027 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/01/23 11:34:09.743971 3.009369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:34:16.759195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:34:24.760891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:34:40.763658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:35:12.769932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:41:16.776114 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:41:23.783479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:41:31.784894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:41:47.788095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:42:19.793614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:46:27.570044 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 11:46:27.570283 0.056605 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:27.627249 0.165322 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:27.792979 0.301311 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:28.094713 0.073426 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:28.168663 0.359534 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:28.528739 0.216709 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:28.745841 0.062481 udp 10.0.2.105 7010 <-> 31.54.193.159 8742 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:28.808730 0.213439 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.022560 0.137264 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.160198 0.156712 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.317300 0.080052 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.397736 0.247227 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.645349 0.059838 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.705554 0.170771 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:29.876720 0.158851 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.035900 0.184212 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.220614 0.083974 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.304952 0.121791 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.427155 0.275543 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.703097 0.069443 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.772937 0.208651 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:30.981959 0.173103 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:31.155420 0.178629 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:31.334461 0.159305 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:31.494163 0.070910 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:31.565460 0.379486 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:31.945401 0.061726 udp 10.0.2.105 7010 <-> 5.13.40.238 2778 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:32.007451 0.066235 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:46:32.074025 0.223314 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 11:49:30.807323 3.000785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:49:37.813448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:49:45.815310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:50:01.818305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:50:33.825872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:56:45.831584 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 11:56:52.839098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:57:00.840779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:57:16.843769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:57:48.849597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 11:58:38.952482 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 11:58:38.952673 1.010104 tcp 10.0.2.105 57063 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:03:52.855002 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:03:59.863386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:04:07.864563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:04:23.867215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:04:55.873602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:10:59.879512 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:11:06.886997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:11:14.888548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:11:30.891353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:12:02.897640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:16:45.343750 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 12:16:45.343907 0.062527 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:45.406780 0.067625 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:45.474783 0.166591 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:45.641751 0.295215 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:45.937355 0.064249 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:46.002014 0.207614 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:16:46.210051 0.000000 udp 10.0.2.105 7010 -> 31.54.193.159 8742 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:17:03.351433 0.032199 tcp 10.0.2.105 57064 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:03.383950 0.034251 tcp 10.0.2.105 57065 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:03.418505 0.116489 tcp 10.0.2.105 57066 -> 195.113.214.236 443 SRPA* 0 0 62 34217 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:03.535209 0.164653 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:03.700413 0.072765 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:03.773607 0.217816 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:03.991846 0.136345 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.128600 0.229760 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.358745 0.060399 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.419512 0.230397 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.650273 0.159063 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.809758 0.182688 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:04.992843 0.581593 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:05.574853 0.067559 udp 10.0.2.105 7010 <-> 109.148.227.60 2112 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:05.642806 0.078945 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:05.722185 0.122189 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:05.844818 0.221815 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.066949 0.166122 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.233406 0.177318 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.411095 0.157262 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.568716 0.063320 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.632396 0.065653 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:06.698399 0.332460 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:17:07.031269 0.000000 udp 10.0.2.105 7010 -> 5.13.40.238 2778 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:17:22.189247 0.030548 tcp 10.0.2.105 57067 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:22.220069 0.034010 tcp 10.0.2.105 57068 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:22.254369 0.145600 tcp 10.0.2.105 57069 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:17:22.400550 0.154252 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:18:06.903465 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 12:18:13.911081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:18:21.914485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:18:37.915416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:19:09.921289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:25:13.932184 2.997373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:25:20.934239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:25:28.936618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:25:44.939404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:26:16.945801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:28:39.961256 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 12:28:39.961411 1.031784 tcp 10.0.2.105 57070 -> 128.255.183.224 9027 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:32:20.951443 3.001754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:32:27.959222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:32:35.960201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:32:51.963337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:33:23.969305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:39:27.976544 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:39:34.983008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:39:42.984154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:39:58.987296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:40:30.993319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:47:37.056876 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 12:47:37.057081 0.000000 udp 10.0.2.105 7010 -> 31.54.193.159 8742 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:47:53.370916 0.031442 tcp 10.0.2.105 57071 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:47:53.402593 0.031168 tcp 10.0.2.105 57072 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:47:53.433981 0.127162 tcp 10.0.2.105 57073 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:47:53.561709 0.000000 udp 10.0.2.105 7010 -> 5.13.40.238 2778 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:48:09.823886 0.030037 tcp 10.0.2.105 57074 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:09.854138 0.031952 tcp 10.0.2.105 57075 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:09.886324 0.130241 tcp 10.0.2.105 57076 -> 195.113.214.236 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:10.017097 0.301370 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.318880 0.064506 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.383681 0.209517 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.593566 0.189571 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.783531 0.073379 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.857254 0.058516 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:10.916094 0.209407 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.125901 0.137769 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.264063 0.069521 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.333934 0.162394 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.496692 0.170604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.667650 0.160734 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:11.828758 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:48:26.838348 0.031127 tcp 10.0.2.105 57077 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:26.869675 0.032336 tcp 10.0.2.105 57078 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:26.902192 0.125551 tcp 10.0.2.105 57079 -> 195.113.214.236 443 SRPA* 0 0 21 12826 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:27.028552 0.059306 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.088353 0.277962 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.366725 0.083920 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.451037 0.121320 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.572746 0.220947 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.794084 0.180022 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:27.974488 0.223512 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:28.198443 0.000000 udp 10.0.2.105 7010 -> 109.148.227.60 2112 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 12:48:37.004926 3.002706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 12:48:44.012241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:48:46.786742 0.029959 tcp 10.0.2.105 57080 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:46.816931 0.030830 tcp 10.0.2.105 57081 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:46.848016 0.183583 tcp 10.0.2.105 57082 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/23 12:48:47.032463 0.068014 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:47.100892 0.068585 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:47.169849 0.323294 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:47.493502 0.178874 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:47.672776 0.157845 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:47.831025 0.155911 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/23 12:48:52.013600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:49:08.017280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:49:40.023372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:55:46.034630 2.999030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 12:55:53.039180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:56:01.040760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:56:17.043591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:56:49.049615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 12:58:41.001293 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 12:58:41.001483 1.032393 tcp 10.0.2.105 57083 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/23 13:02:53.056767 3.003711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:03:00.063039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:03:08.064325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:03:24.067930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:03:56.073475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:10:00.079727 3.001701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:10:07.091864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:10:15.088985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:10:31.091336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:11:03.102627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:17:07.104396 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:17:14.111033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:17:22.112783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:17:38.115368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:18:10.121559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:19:17.318293 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 13:19:17.318396 0.178875 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:17.497683 0.000000 udp 10.0.2.105 7010 -> 109.148.227.60 2112 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 13:19:34.194244 0.052958 tcp 10.0.2.105 57084 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 13:19:34.247488 0.054444 tcp 10.0.2.105 57085 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 13:19:34.302254 0.146935 tcp 10.0.2.105 57086 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/23 13:19:34.449928 0.191911 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:34.642239 0.209735 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:34.852583 0.058947 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:34.911891 0.294561 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.206845 0.136550 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.343751 0.058353 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.402446 0.072467 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.475317 0.106618 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.582334 0.210451 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.793214 0.165007 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:35.958621 0.160448 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.119497 0.171254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.291159 0.264978 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.556645 0.060912 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.617951 0.079828 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.698230 0.229199 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:36.927871 0.221889 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:37.150186 0.166118 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:37.316721 0.234914 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:37.552006 0.066142 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:37.618510 0.326277 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:37.945206 0.065577 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:38.011241 0.154966 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:38.166575 0.178514 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:19:38.345485 0.157405 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:24:14.127414 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:24:21.135410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:24:29.136332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:24:45.139823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:25:17.145858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:28:42.040912 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 13:28:42.041070 1.061192 tcp 10.0.2.105 57087 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/23 13:31:21.151716 3.004284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:31:28.162796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:31:36.173639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:31:52.167429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:32:24.169668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:38:28.176550 3.005353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:38:35.182686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:38:43.184147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:38:59.187267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:39:31.193473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:48:08.200089 3.000826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:48:15.207270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:48:23.208391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:48:39.211532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:49:11.217721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:49:51.195656 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 13:49:51.195885 0.289170 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:51.485513 0.058218 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:51.544383 0.302705 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:51.847493 0.190692 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.038586 0.209661 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.248658 0.141333 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.390381 0.058402 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.449176 0.139712 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.589299 0.069654 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.659369 0.215462 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:52.875207 0.163078 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.038631 0.159582 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.198673 0.170775 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.369892 0.172058 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.542355 0.071336 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.614109 0.082175 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.696619 0.122054 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:53.819055 0.207973 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:54.027430 0.179948 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:54.207765 0.376354 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:54.584518 0.070536 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:54.655419 0.156299 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:54.812102 1.455718 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:56.268271 0.068548 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:56.337203 0.179423 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:49:56.517009 0.155155 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 13:55:15.223417 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 13:55:22.231163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:55:30.233124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:55:46.235292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:56:18.242319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 13:58:43.109938 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 13:58:43.110031 1.059058 tcp 10.0.2.105 57088 -> 128.255.183.224 9027 FSPA* 0 0 14 1700 flow=From-Botnet-V2-TCP-Established 1970/01/23 14:02:22.247580 3.005599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:02:29.255208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:02:37.256160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:02:53.259433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:03:25.266335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:09:29.272361 3.000418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:09:36.278840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:09:44.280264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:10:00.283164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:10:32.289241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:16:36.305437 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:16:43.315954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:16:51.315642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:17:07.317029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:17:39.323368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:20:03.791362 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 14:20:03.791553 0.294635 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.086562 0.171302 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.258284 0.098611 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.357253 0.185347 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.542982 0.216435 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.759848 0.137215 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.897450 0.058295 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:04.956191 0.071436 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.027998 0.062579 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.090976 0.154191 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.245556 0.227862 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.473908 0.162725 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.637041 0.188902 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.826312 0.171005 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:05.997744 0.059619 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.057776 0.074634 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.132840 0.121454 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.254688 0.326102 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.581156 0.066515 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.648091 0.234001 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:06.882555 0.165941 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:07.048935 0.158763 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:07.208099 0.180396 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:07.388887 0.157963 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:07.547319 0.219776 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:20:07.767475 0.067540 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:23:43.329562 3.026594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:23:50.346215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:23:58.347697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:24:14.351130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:24:46.356631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:28:44.169425 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 14:28:44.169606 1.027385 tcp 10.0.2.105 57089 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/23 14:30:50.362957 3.009213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:30:57.370420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:31:05.371946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:31:21.375205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:31:53.381200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:37:57.386158 3.008706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:38:04.404188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:38:12.401130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:38:28.399260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:39:00.405084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:47:54.415990 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:48:01.426868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:48:09.424862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:48:25.427359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:48:57.433645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:50:21.714498 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 14:50:21.714678 0.296585 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.011580 0.181563 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.193559 0.060033 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.254089 0.191151 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.445668 0.289235 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.735258 0.138398 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.874055 0.057422 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:22.931875 0.143327 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.075563 0.066929 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.142868 0.158334 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.301600 0.215162 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.517119 0.163733 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.681292 0.170838 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:23.852536 0.171915 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.024839 0.058843 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.084020 0.081472 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.165879 0.120690 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.286989 0.325852 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.613238 0.065876 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.679488 0.213671 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:24.893566 0.165982 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:25.059940 0.153481 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:25.213771 0.223510 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:25.437707 0.067931 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:25.505966 0.177365 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:50:25.683698 0.157885 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/23 14:55:01.439067 3.002714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 14:55:08.447401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:55:16.449054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:55:32.451480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:56:04.457515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 14:58:45.199458 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 14:58:45.199612 1.045418 tcp 10.0.2.105 57090 -> 128.255.183.224 9027 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/23 15:02:08.467508 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:02:15.471290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:02:23.472516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:02:39.475395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:03:11.482313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:09:15.488282 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:09:22.494497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:09:30.496715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:09:46.499486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:10:18.505753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:16:22.511523 3.001833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:16:29.518881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:16:37.520120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:16:53.523502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:17:25.528926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:20:28.813390 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 15:20:28.813477 0.062982 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:28.876868 0.255619 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:29.132898 0.302484 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:29.435718 0.178849 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:29.614931 0.217363 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:29.832714 0.138077 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:29.971154 0.057329 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.028854 0.070293 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.099583 0.062904 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.162922 0.155518 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.319042 0.171738 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.491164 0.159853 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.651335 0.237169 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:30.888842 0.170223 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.059516 0.059677 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.119588 0.076824 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.196814 0.120928 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.318108 0.332087 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.650539 0.064953 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.715905 0.220840 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:31.937109 0.172731 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:32.110204 0.156493 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:32.267168 0.180338 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:32.447887 0.158811 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:32.607077 0.665994 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:20:33.273458 0.068105 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:23:29.535888 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:23:36.543308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:23:44.544201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:24:00.546770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:24:32.553295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:28:46.248727 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 15:28:46.248914 1.086838 tcp 10.0.2.105 57091 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/23 15:30:36.559164 3.001419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:30:43.569035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:30:51.567832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:31:07.571355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:31:39.580716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:37:43.583596 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:37:50.590596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:37:58.592104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:38:14.595887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:38:46.611987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:47:45.608231 3.002282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:47:52.616267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:48:00.617790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:48:16.620701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:48:48.627019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:50:36.702895 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 15:50:36.703099 0.061296 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:36.764767 0.187629 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:36.952806 0.289181 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.242422 0.174174 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.416980 0.210805 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.628221 0.138062 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.766640 0.057140 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.824170 0.066967 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.891552 0.063804 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:37.955688 0.156201 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.112212 0.172604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.285233 0.157925 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.443577 0.215092 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.659036 0.198488 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.857900 0.061126 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:38.919383 0.080730 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.000532 0.120347 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.121286 0.357584 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.479274 0.063748 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.543395 0.207827 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.751595 0.166084 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:39.918073 0.156574 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:40.075037 0.237449 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:40.313101 0.178612 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:40.492074 0.159109 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:50:40.651580 0.066345 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 15:54:52.633597 3.000399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 15:54:59.640150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:55:07.641939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:55:23.645108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:55:55.651563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 15:58:47.338154 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 15:58:47.338250 1.040624 tcp 10.0.2.105 57092 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/23 16:01:59.660518 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:02:06.664421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:02:14.670960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:02:30.668906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:03:02.674673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:09:06.680432 3.002357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:09:13.687904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:09:21.690078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:09:37.693012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:10:09.698915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:16:13.710360 2.996141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:16:20.711748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:16:28.713637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:16:44.716472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:17:16.723281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:21:09.848087 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 16:21:09.848288 0.056787 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:09.905474 0.191455 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:10.097347 0.317312 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:10.415073 0.302716 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:10.718226 0.176969 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:10.895615 0.135878 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.031858 0.058589 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.090834 0.068880 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.160126 0.069321 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.229802 0.164203 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.394373 0.171024 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.565748 0.157994 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.724099 0.216259 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:11.940819 0.163484 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.104717 0.059560 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.164653 0.076341 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.241400 0.063354 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.305125 0.120848 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.426339 0.364270 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:12.791019 0.232766 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.024347 0.165831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.190608 0.154358 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.345347 0.222467 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.568191 0.067294 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.635940 0.180979 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:21:13.817282 0.156231 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:23:20.728999 3.001285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:23:27.736005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:23:35.738187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:23:51.741678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:24:23.747145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:28:48.377507 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 16:28:48.377697 1.065838 tcp 10.0.2.105 57093 -> 128.255.183.224 9027 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/01/23 16:30:27.753029 3.001179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:30:34.770087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:30:42.773366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:30:58.774259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:31:30.782780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:37:34.786189 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:37:41.794059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:37:49.795779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:38:05.798514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:38:37.806177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:47:38.815493 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:47:45.822427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:47:53.823946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:48:09.827617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:48:41.833577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:51:29.784579 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 16:51:29.784736 0.060315 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:29.845402 0.188076 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:30.033860 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 16:51:48.333218 0.052798 tcp 10.0.2.105 57094 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/23 16:51:48.386254 0.031475 tcp 10.0.2.105 57095 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/23 16:51:48.417944 0.108600 tcp 10.0.2.105 57096 -> 195.113.214.236 443 SRPA* 0 0 64 41263 flow=From-Botnet-V2-TCP-Established 1970/01/23 16:51:48.527079 0.302719 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:48.830203 0.177425 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.007981 0.137674 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.146067 0.063418 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.209860 0.073560 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.283813 0.062158 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.346346 0.162859 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.509541 0.213120 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.723033 0.159916 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:49.883363 0.209619 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.093319 0.163330 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.257019 0.059828 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.317200 0.081435 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.398980 0.071011 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.470358 0.221105 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.691820 0.165920 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.858123 0.120210 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:50.978689 0.337288 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:51.316500 0.154677 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:51.471582 0.240341 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:51.712352 0.067933 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:51.780671 0.177076 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:51:51.958142 0.157839 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 16:54:45.839475 3.001542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 16:54:52.846781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:55:00.848551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:55:16.851333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:55:48.857424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 16:58:49.447176 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 16:58:49.447401 1.051181 tcp 10.0.2.105 57097 -> 128.255.183.224 9027 FSPA* 0 0 14 1673 flow=From-Botnet-V2-TCP-Established 1970/01/23 17:01:52.863259 3.001995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:01:59.870772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:02:07.872852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:02:23.877660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:02:55.880979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:08:59.887510 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:09:06.894292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:09:14.895811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:09:30.898862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:10:02.905458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:16:06.910539 3.002945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:16:13.918363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:16:21.920184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:16:37.922944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:17:09.928884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:22:18.226130 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 17:22:18.226315 0.218431 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:18.445160 0.061452 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:18.506999 0.186911 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:18.694316 0.296202 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:18.990916 0.173841 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.165156 0.143983 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.309523 0.064344 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.374329 0.071203 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.446014 0.105715 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.552091 0.164478 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.716991 0.189898 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:19.907285 0.161428 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.069148 0.208609 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.278167 0.170931 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.449534 0.062902 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.512787 0.073814 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.586995 0.067835 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.655193 0.207325 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:20.862887 0.179911 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:21.043179 0.121791 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:21.165335 0.386788 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:21.552440 0.154437 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:21.707263 0.908345 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:22.616036 0.066520 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:22.682965 0.184065 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:22:22.867430 0.155119 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:23:13.935180 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:23:20.942795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:23:28.944041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:23:44.946803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:24:16.952836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:28:50.510041 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 17:28:50.510239 1.103165 tcp 10.0.2.105 57098 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/23 17:30:20.958885 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:30:27.969801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:30:35.967739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:30:51.970489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:31:23.976885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:37:27.982984 3.001146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:37:34.990437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:37:42.991914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:37:58.994175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:38:31.000869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:47:33.013428 3.004259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:47:40.020119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:47:48.022090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:48:04.025044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:48:36.030487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:52:43.056205 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 17:52:43.056434 0.388628 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:43.445419 0.295520 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:43.741280 0.173546 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:43.915264 0.136472 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.052123 0.228547 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.281023 0.059170 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.340527 0.056160 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.397037 0.069366 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.466765 0.061748 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.528855 0.164141 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.693406 0.171069 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:44.864893 0.160992 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.026304 0.216955 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.243630 0.172134 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.416152 0.061068 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.477587 0.078395 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.556561 0.065642 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.622550 0.220783 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:45.843710 0.172855 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.016956 0.120122 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.137414 0.333531 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.471350 0.152408 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.624391 0.177571 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.802364 0.149723 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:46.952475 0.860000 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:52:47.812883 0.071094 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/23 17:54:40.036797 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 17:54:47.044108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:54:55.046387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:55:11.048853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:55:43.054615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 17:58:51.616850 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 17:58:51.617028 1.007637 tcp 10.0.2.105 57099 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/23 18:01:47.062055 3.000553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:01:54.068631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:02:02.073310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:02:18.072689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:02:50.078886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:08:54.086136 3.000374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:09:01.092005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:09:09.095607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:09:25.096937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:09:57.102602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:16:01.113073 3.004066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:16:08.118822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:16:16.120835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:16:32.120031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:17:04.128218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:23:05.626542 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 18:23:05.626738 0.180608 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:05.807749 0.136726 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:05.944882 0.284168 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.229429 0.058302 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.288146 0.185252 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.473761 0.300790 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.774971 0.059094 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.834499 0.081436 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.916514 0.065933 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:06.982832 0.157383 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.140592 0.171105 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.312065 0.157225 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.469680 0.217400 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.687515 0.164004 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.851871 0.060608 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.912867 0.078242 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:07.991539 0.073637 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.065593 0.220608 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.135208 2.999715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:23:08.286584 0.172872 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.459912 0.151346 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.611658 0.177755 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.789845 0.157044 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:08.947252 0.327084 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:09.275074 0.155786 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:09.431261 0.222422 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:09.654046 0.070053 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:23:15.140191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:23:23.143585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:23:39.144860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:24:11.160870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:28:52.626066 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 18:28:52.626316 1.059026 tcp 10.0.2.105 57100 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/23 18:30:15.166591 3.002544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:30:22.173951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:30:30.175481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:30:46.181581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:31:18.184690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:37:22.191540 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:37:29.198079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:37:37.200053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:37:53.202275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:38:25.214033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:47:26.230195 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:47:33.236675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:47:41.237763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:47:57.241252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:48:29.247355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:53:24.612557 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 18:53:24.612707 0.209366 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:24.822551 0.057337 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:24.880401 0.180816 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.061656 0.140346 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.202425 0.191260 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.394133 0.287428 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.681980 0.059628 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.741994 0.067880 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.810251 0.068338 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:25.879026 0.156075 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.035474 0.219603 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.255465 0.160100 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.415941 0.213147 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.629470 0.172199 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.802070 0.059181 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.861604 0.072660 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:26.934600 0.071474 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:27.006395 0.221131 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:27.227933 0.178824 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:27.407140 0.158647 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:27.566255 0.329895 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:27.896542 0.166011 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:28.063194 0.120798 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:28.184444 0.066392 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:28.251367 0.157538 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:53:28.409361 0.223301 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 18:54:33.253206 3.001004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 18:54:40.260364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:54:48.263202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:55:04.264518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:55:36.270853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 18:58:53.685348 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 18:58:53.685542 1.063287 tcp 10.0.2.105 57101 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/23 19:01:40.279020 2.999977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:01:47.284532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:01:55.285909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:02:11.289079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:02:43.294908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:08:47.301239 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:08:54.308565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:09:02.309918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:09:18.312850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:09:50.319028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:15:54.325376 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:16:01.332452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:16:09.333608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:16:25.337724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:16:57.343548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:23:01.348171 3.002318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:23:08.356856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:23:16.357550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:23:32.360673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:23:56.125421 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 19:23:56.125564 0.172518 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:56.298483 0.136801 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:56.435633 0.214561 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:56.650624 0.059457 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:56.710457 0.255694 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:56.966588 0.294921 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.261968 0.058155 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.320516 0.072324 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.393232 0.062500 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.456140 0.163262 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.619783 0.171985 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.792198 0.157469 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:57.950090 0.212498 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.162994 0.171874 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.335204 0.059431 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.394981 0.083276 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.478681 0.066535 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.545574 0.220356 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:58.766327 0.591500 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:59.358225 0.180032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:59.538650 0.122227 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:59.661283 0.065882 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:59.727497 0.178162 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:23:59.906060 0.155647 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:24:00.062085 0.152765 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:24:00.215233 0.489168 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:24:04.366659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:28:54.754699 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 19:28:54.754807 1.062177 tcp 10.0.2.105 57102 -> 128.255.183.224 9027 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/01/23 19:30:08.372320 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:30:15.379924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:30:23.381762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:30:39.384683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:31:11.390084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:37:15.396453 3.002036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:37:22.404053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:37:30.405701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:37:46.408598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:38:18.415038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:44:22.420424 3.002131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:44:29.427860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:44:37.429304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:44:53.432666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:45:25.438587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:51:29.444833 3.001631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:51:36.455388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:51:44.453608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:52:00.456724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:52:32.463224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:54:28.749896 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 19:54:28.750043 0.182011 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:28.932445 0.058101 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:28.990917 0.188147 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.179459 0.291123 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.471009 0.063238 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.534626 0.137553 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.672583 0.217680 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.890662 0.073163 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:29.964307 0.064305 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:30.028980 0.584556 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:30.613944 0.170683 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:30.785010 0.156655 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:30.942122 0.215172 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:31.157676 0.169141 udp 10.0.2.105 7010 <-> 67.37.63.150 7419 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:31.327209 0.063732 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:31.391308 0.221336 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:31.612990 0.553829 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.167163 0.062948 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.230479 0.076798 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.307630 0.172963 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.480997 0.176260 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.657663 0.069748 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.727803 0.179101 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:32.907280 0.156197 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:33.063909 0.149957 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:54:33.214227 0.276726 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/23 19:58:36.470465 2.999778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 19:58:43.475922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:58:51.477594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:58:55.814326 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 19:58:55.814548 1.027472 tcp 10.0.2.105 57103 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/23 19:59:07.480890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 19:59:39.486941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:05:43.492874 3.001343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:05:50.500104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:05:58.501767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:06:14.504672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:06:46.511152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:12:50.517528 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:12:57.531090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:13:05.525516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:13:21.528487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:13:53.534262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:19:57.540365 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:20:04.548000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:20:12.549128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:20:28.552653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:21:00.559389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:24:35.107347 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 20:24:35.107514 0.164177 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:35.272132 0.182550 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:35.455038 0.060512 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:35.515926 0.299509 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:35.815843 0.058419 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:35.874709 0.139325 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.014448 0.208729 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.223556 0.075054 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.299079 0.068027 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.367542 0.161626 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.529592 0.170293 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.700405 0.159596 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:36.860397 0.217227 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:37.078026 0.000000 udp 10.0.2.105 7010 -> 67.37.63.150 7419 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 20:24:55.297656 0.074164 tcp 10.0.2.105 57104 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:24:55.372055 0.032771 tcp 10.0.2.105 57105 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:24:55.405081 0.126606 tcp 10.0.2.105 57106 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:24:55.532392 0.355405 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:55.888403 0.060409 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:55.949209 0.075272 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.024881 0.067133 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.092537 0.214194 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.307167 0.166321 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.473849 0.326196 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.800573 0.066954 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:56.867906 0.178007 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:57.046280 0.159496 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:57.206131 0.154356 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:24:57.360930 0.222245 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:27:04.564490 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:27:11.572034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:27:19.573352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:27:35.576429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:28:07.581880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:28:56.843630 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 20:28:56.843808 1.115511 tcp 10.0.2.105 57107 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:34:11.588462 3.001029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:34:18.595805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:34:26.597516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:34:42.600865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:35:14.606018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:41:18.612173 3.001835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:41:25.619688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:41:33.621332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:41:49.624412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:42:21.630669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:49:34.645811 3.002016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:49:41.653501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:49:49.654246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:50:05.657982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:50:37.663598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:55:06.129739 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 20:55:06.129831 0.163989 udp 10.0.2.105 7010 -> 67.37.63.150 7419 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 20:55:06.293820 0.000000 icmp 67.37.63.150 0x0303 -> 10.0.2.105 0xfb1c URP 192 1 213 flow=Background 1970/01/23 20:55:22.414351 0.052252 tcp 10.0.2.105 57108 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:55:22.466827 0.053909 tcp 10.0.2.105 57109 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:55:22.520966 0.131060 tcp 10.0.2.105 57110 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/23 20:55:22.652591 0.168180 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:22.821162 0.059695 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:22.881184 0.294774 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.176499 0.062923 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.239740 0.145693 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.385790 0.238495 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.624708 0.112574 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.737670 0.065719 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.803782 0.182196 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:23.986336 0.157729 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.144490 0.217440 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.362350 0.182311 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.545047 0.163828 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.709303 0.066104 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.775770 0.077552 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.853645 0.090906 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:24.944902 0.234445 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:25.179757 0.327079 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:25.507235 0.220285 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:25.727865 0.064974 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:25.793160 0.177287 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:25.970883 0.157516 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:26.128773 0.155323 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:26.284711 0.165825 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:55:26.450932 0.882288 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/23 20:56:49.670165 3.003151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 20:56:56.683335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:57:04.680042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:57:20.683095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:57:52.689201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 20:58:57.963669 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 20:58:57.963869 1.038627 tcp 10.0.2.105 57111 -> 128.255.183.224 9027 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/01/23 21:03:56.695900 3.000790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:04:03.702704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:04:11.703826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:04:27.706814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:04:59.713290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:11:03.719152 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:11:10.726693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:11:18.727851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:11:34.731503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:12:06.747091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:18:10.753451 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:18:17.760538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:18:25.762108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:18:41.764853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:19:13.771179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:25:17.776889 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:25:24.784487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:25:27.739975 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 21:25:27.740230 0.289664 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.030264 0.058332 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.089109 0.164533 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.254004 0.061628 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.315985 0.138246 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.454648 0.209248 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.664313 0.073773 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.738496 0.110845 udp 10.0.2.105 7010 <-> 86.138.1.8 9232 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:28.849716 0.178820 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.028950 0.163356 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.192706 0.212449 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.405562 0.172350 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.578299 0.155943 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.734640 0.058817 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.793824 0.082869 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.877105 0.068453 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:29.945928 0.222046 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:30.168402 0.068835 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:30.237640 0.178192 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:30.416270 0.154582 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:30.571213 0.154227 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:30.725832 0.356896 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:31.083102 0.198833 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:31.282312 0.165941 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:31.448577 0.955826 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:25:32.786033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:25:48.788941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:26:20.794712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:28:59.003271 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 21:28:59.003435 1.232507 tcp 10.0.2.105 57112 -> 128.255.183.224 9027 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/01/23 21:32:24.801022 3.002097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:32:31.808675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:32:39.819407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:32:55.814531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:33:27.819097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:39:31.835168 2.991752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:39:38.833306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:39:46.837845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:40:02.837528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:40:34.842909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:48:41.855342 3.002042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:48:48.863272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:48:56.864656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:49:12.867969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:49:44.873757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:55:50.882510 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 21:55:55.817351 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 21:55:55.817551 0.164098 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:55.982054 0.063609 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.046085 0.290792 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.337244 0.063598 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.401265 0.138128 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.539812 0.216329 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.756585 0.069689 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:55:56.826703 0.000000 udp 10.0.2.105 7010 -> 86.138.1.8 9232 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 21:55:57.894801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:56:05.891750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:56:15.347139 0.053283 tcp 10.0.2.105 57113 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 21:56:15.400661 0.031521 tcp 10.0.2.105 57114 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 21:56:15.432482 0.130523 tcp 10.0.2.105 57115 -> 195.113.214.236 443 SRPA* 0 0 46 40996 flow=From-Botnet-V2-TCP-Established 1970/01/23 21:56:15.563698 0.183255 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:15.747333 0.159442 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:15.907177 0.213875 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.121442 0.172011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.293826 0.163122 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.457294 0.059891 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.517561 0.082965 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.600933 0.068725 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.670069 0.221907 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.892402 0.069640 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:16.962461 0.157241 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:17.120097 0.748343 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:17.868829 0.121086 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:17.990357 0.179903 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:18.170673 0.155951 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:18.327062 0.166337 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:18.493802 0.239670 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/23 21:56:21.895488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:56:53.900781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 21:59:00.243665 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 21:59:00.243901 1.068943 tcp 10.0.2.105 57116 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/23 22:02:57.906542 3.002146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:03:04.913919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:03:12.915725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:03:28.918603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:04:00.925014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:10:04.930540 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:10:11.938134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:10:19.939368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:10:35.942746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:11:07.948839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:17:11.955707 3.000339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:17:18.961899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:17:26.963408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:17:42.966571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:18:14.972716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:24:18.986543 2.993587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:24:25.985671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:24:33.987303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:24:49.990581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:25:21.996016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:26:40.890194 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:26:40.890329 0.000000 udp 10.0.2.105 7010 -> 86.138.1.8 9232 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:26:57.235141 0.053619 tcp 10.0.2.105 57117 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 22:26:57.289073 0.053199 tcp 10.0.2.105 57118 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 22:26:57.342551 0.128135 tcp 10.0.2.105 57119 -> 195.113.214.236 443 SRPA* 0 0 34 26946 flow=From-Botnet-V2-TCP-Established 1970/01/23 22:26:57.471323 4.535574 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 1038 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:57.517159 3.846222 udp 10.0.2.105 7010 <-> 74.196.220.117 9202 CON 0 0 4 1267 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:57.683351 3.971811 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1019 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:57.974236 3.903849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1263 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.192512 3.757061 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 4 1112 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.266932 3.880160 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 4 1049 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.406646 3.782510 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1132 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.446689 3.952125 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 4 1066 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.659671 3.909406 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1109 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:58.830936 3.926454 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 1229 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.014688 3.885635 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 4 1068 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.157044 3.909749 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1051 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.321684 3.800247 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1220 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.382980 3.812801 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1123 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.456109 3.802623 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 4 1189 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.535629 3.943418 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 4 1028 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.756420 3.794776 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 4 1074 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.826406 3.869404 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 4 1298 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:26:59.970253 3.901952 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 4 1137 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:00.149366 3.868686 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1087 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:00.293493 4.553880 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1294 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:00.701651 3.438598 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1067 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:00.823096 3.462588 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1012 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:00.968725 3.545833 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 4 1176 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:27:04.847901 0.000000 udp 10.0.2.105 7010 -> 223.30.44.190 7768 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:10.833117 0.000000 udp 10.0.2.105 7010 -> 79.156.228.245 3282 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:17.863291 0.000000 udp 10.0.2.105 7010 -> 124.38.192.98 2624 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:22.569744 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:27:24.102295 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:29.409446 0.000000 udp 10.0.2.105 7010 -> 117.103.87.110 2943 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:36.520140 0.000000 udp 10.0.2.105 7010 -> 105.229.159.245 8641 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:43.770612 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1499 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:48.567119 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:27:50.289589 0.000000 udp 10.0.2.105 7010 -> 182.68.166.203 1999 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:27:58.821984 0.000000 udp 10.0.2.105 7010 -> 24.156.37.111 7825 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:07.003970 0.000000 udp 10.0.2.105 7010 -> 92.24.42.123 4979 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:14.094102 0.169455 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:28:14.310412 0.388261 udp 10.0.2.105 7010 -> 120.151.43.201 4489 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:14.698673 0.000000 icmp 120.151.43.201 0x0303 -> 10.0.2.105 0x8911 URP 192 1 336 flow=Background 1970/01/23 22:28:19.071042 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:28:20.132960 0.000000 udp 10.0.2.105 7010 -> 82.163.62.90 5483 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:27.173717 0.066257 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:28:27.249004 0.000000 udp 10.0.2.105 7010 -> 82.49.142.166 2254 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:34.403299 0.000000 udp 10.0.2.105 7010 -> 78.147.44.157 8923 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:42.815310 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:47.571722 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:28:49.374488 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 1432 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:28:54.582327 0.000000 udp 10.0.2.105 7010 -> 94.34.150.216 9141 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:01.312140 0.940035 tcp 10.0.2.105 57120 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/23 22:29:02.033413 0.000000 udp 10.0.2.105 7010 -> 118.94.178.174 1636 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:08.292208 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:14.641253 0.134801 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:29:14.853489 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:20.059094 0.000000 udp 10.0.2.105 7010 -> 93.64.195.65 1367 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:26.578107 0.000000 udp 10.0.2.105 7010 -> 79.35.241.54 2391 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:31.565302 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:29:34.800132 0.000000 udp 10.0.2.105 7010 -> 74.94.175.201 7900 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:40.097908 0.151528 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:29:40.301531 0.000000 udp 10.0.2.105 7010 -> 79.28.111.204 9211 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:49.281082 0.000000 udp 10.0.2.105 7010 -> 94.69.66.115 9655 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:29:57.332407 0.078168 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:29:57.447160 0.000000 udp 10.0.2.105 7010 -> 186.130.235.194 2146 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:02.069077 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:30:04.092122 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:10.761685 0.054481 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:30:10.852932 0.000000 udp 10.0.2.105 7010 -> 212.76.75.69 8380 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:16.930965 0.200034 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:30:17.139821 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:22.570930 0.000000 udp 10.0.2.105 7010 -> 195.72.202.66 1964 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:27.571343 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:30:30.700013 0.344423 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:30:31.443792 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:36.909307 0.000000 udp 10.0.2.105 7010 -> 66.43.211.81 8570 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:42.254610 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:49.671291 0.000000 udp 10.0.2.105 7010 -> 111.68.47.136 6946 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:30:54.564538 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:30:57.418680 0.172037 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:30:57.625581 0.000000 udp 10.0.2.105 7010 -> 188.219.120.143 2766 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:03.007270 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:11.008116 0.000000 udp 10.0.2.105 7010 -> 87.194.137.29 4226 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:18.989617 0.354004 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:31:19.379602 0.169083 udp 10.0.2.105 7010 -> 108.199.118.130 9648 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:19.548685 0.000000 icmp 108.199.118.130 0x0303 -> 10.0.2.105 0xb025 URP 192 1 124 flow=Background 1970/01/23 22:31:23.566165 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:31:26.002555 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 22:31:27.482208 0.000000 udp 10.0.2.105 7010 -> 79.192.59.165 4600 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:33.010645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:31:33.060800 0.064004 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:31:33.137105 0.000000 udp 10.0.2.105 7010 -> 84.62.20.55 5024 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:38.217489 0.182884 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:31:38.449205 0.166440 udp 10.0.2.105 7010 <-> 1.23.250.147 6353 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:31:38.652193 0.000000 udp 10.0.2.105 7010 -> 122.172.156.211 4242 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:41.011546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:31:44.667208 0.056262 udp 10.0.2.105 7010 -> 85.10.34.114 1247 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:44.723470 0.000000 icmp 85.10.34.114 0x0303 -> 10.0.2.105 0xdf04 URP 192 1 169 flow=Background 1970/01/23 22:31:49.563348 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:31:51.226104 0.284091 udp 10.0.2.105 7010 <-> 14.97.172.177 6801 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:31:51.540056 0.000000 udp 10.0.2.105 7010 -> 117.208.122.23 9128 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:31:57.014337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:31:57.955738 0.000000 udp 10.0.2.105 7010 -> 219.74.100.95 4508 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:03.343578 0.000000 udp 10.0.2.105 7010 -> 94.68.84.201 4908 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:09.923656 0.340379 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:10.274090 0.000000 udp 10.0.2.105 7010 -> 222.164.216.48 6476 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:14.569478 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:32:17.795879 0.000000 udp 10.0.2.105 7010 -> 72.39.4.50 2421 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:26.627465 0.000000 udp 10.0.2.105 7010 -> 188.9.38.194 8087 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:29.020484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:32:31.966428 0.000000 udp 10.0.2.105 7010 -> 68.96.153.21 9449 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:39.696900 0.070180 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:39.894721 0.059564 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:40.009445 0.318791 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:40.430332 0.000000 udp 10.0.2.105 7010 -> 81.133.16.59 8184 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:44.574253 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:32:47.329914 0.065086 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:47.662495 0.000000 udp 10.0.2.105 7010 -> 175.137.190.176 2219 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:32:56.590031 0.075968 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:32:56.790643 0.000000 udp 10.0.2.105 7010 -> 122.166.47.80 8272 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:02.821079 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 4027 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:08.061024 0.000000 udp 10.0.2.105 7010 -> 118.175.19.49 1794 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:12.564839 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:33:16.628985 0.000000 udp 10.0.2.105 7010 -> 110.172.180.2 8076 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:22.637682 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:30.699164 0.000000 udp 10.0.2.105 7010 -> 182.72.210.94 3118 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:37.078377 0.410133 udp 10.0.2.105 7010 -> 117.207.254.225 1268 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:37.488510 0.000000 icmp 117.207.254.225 0x0303 -> 10.0.2.105 0xf404 URP 192 1 317 flow=Background 1970/01/23 22:33:42.065385 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:33:45.851008 0.236725 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:33:46.114573 0.421230 udp 10.0.2.105 7010 <-> 121.6.78.230 3400 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:33:46.570217 0.000000 udp 10.0.2.105 7010 -> 217.25.10.142 8534 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:33:54.343327 0.000000 udp 10.0.2.105 7010 -> 59.90.216.36 6595 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:02.447559 0.000000 udp 10.0.2.105 7010 -> 14.102.115.66 9831 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:07.071327 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:34:10.576501 0.000000 udp 10.0.2.105 7010 -> 59.97.148.161 8891 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:17.496366 0.000000 udp 10.0.2.105 7010 -> 116.73.53.30 9667 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:24.386301 0.000000 udp 10.0.2.105 7010 -> 79.129.44.166 5092 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:31.817190 0.000000 udp 10.0.2.105 7010 -> 101.78.179.114 4484 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:36.565453 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:34:38.126223 0.000000 udp 10.0.2.105 7010 -> 124.122.166.54 6296 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:45.777415 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:34:50.874627 0.054228 udp 10.0.2.105 7010 <-> 79.112.231.200 3757 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:51.148722 0.079338 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:51.261415 0.177460 udp 10.0.2.105 7010 <-> 188.253.38.153 5671 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:51.477032 0.202748 udp 10.0.2.105 7010 <-> 190.84.240.16 2537 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:51.855214 0.078652 udp 10.0.2.105 7010 <-> 194.150.233.9 6771 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:51.969215 0.211345 udp 10.0.2.105 7010 <-> 98.125.179.89 4731 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:52.298090 0.134810 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:52.442449 0.142275 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 684 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:34:52.609422 0.000000 udp 10.0.2.105 7010 -> 82.21.57.81 2107 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:01.129325 0.000000 udp 10.0.2.105 7010 -> 202.176.80.159 8027 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:06.065999 0.010892 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:35:07.929026 0.000000 udp 10.0.2.105 7010 -> 78.96.147.70 4476 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:16.070901 0.057374 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:35:16.186323 0.028730 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:35:16.266619 0.000000 udp 10.0.2.105 7010 -> 204.9.216.242 1970 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:25.213693 0.196291 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:35:25.418928 0.000000 udp 10.0.2.105 7010 -> 173.197.59.1 8428 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:30.070631 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:35:34.136690 0.078159 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:35:34.249470 0.000000 udp 10.0.2.105 7010 -> 2.50.163.18 6431 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:43.229958 0.000000 udp 10.0.2.105 7010 -> 58.185.179.85 3181 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:51.101088 0.000000 udp 10.0.2.105 7010 -> 194.85.146.166 9672 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:35:56.067820 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:35:57.260120 0.000000 udp 10.0.2.105 7010 -> 122.160.232.188 5691 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:05.611849 0.000000 udp 10.0.2.105 7010 -> 113.163.4.114 1123 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:12.382122 0.835139 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:36:13.251070 0.000000 udp 10.0.2.105 7010 -> 49.231.4.108 9558 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:18.520602 0.281083 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:36:18.926689 0.140947 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:36:19.080526 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:23.067266 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:36:24.609434 0.000000 udp 10.0.2.105 7010 -> 202.166.160.26 2817 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:31.872278 0.000000 udp 10.0.2.105 7010 -> 2.50.41.144 2474 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:37.283366 0.000000 udp 10.0.2.105 7010 -> 219.75.115.75 6437 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:43.606777 0.000000 udp 10.0.2.105 7010 -> 122.161.176.77 6723 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:48.563347 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:36:50.709157 0.316212 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/23 22:36:51.036110 0.000000 udp 10.0.2.105 7010 -> 183.82.4.67 1882 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:36:56.254980 0.000000 udp 10.0.2.105 7010 -> 66.184.166.74 8267 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:37:03.947092 0.000000 udp 10.0.2.105 7010 -> 95.228.31.177 8787 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:37:09.864369 0.036027 udp 10.0.2.105 7010 -> 93.218.244.186 4652 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:37:09.900396 0.000000 icmp 93.218.244.186 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 156 flow=Background 1970/01/23 22:37:14.570650 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:37:17.384880 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 22:38:33.026418 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 22:38:40.033624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:38:48.035263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:39:04.038216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:39:36.044609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:48:13.050330 3.004595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:48:20.062352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:48:28.059485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:48:44.062762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:49:16.068201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:55:20.074031 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 22:55:27.082012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:55:35.083276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:55:51.085983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:56:23.092347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 22:59:02.251455 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 22:59:02.251614 0.924580 tcp 10.0.2.105 57121 -> 128.255.183.224 9027 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:02:27.098272 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 23:02:34.105731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:02:42.896860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:03:06.390699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:03:37.940044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:07:43.042320 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 23:07:43.042444 0.045368 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.088259 0.046662 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.135311 0.137994 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.273735 0.171047 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.445198 0.177248 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.622855 0.058667 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.681921 0.063907 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.746229 0.078426 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.825023 0.147402 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:43.972806 0.137724 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.110914 0.207508 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.318831 0.202315 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.521520 0.140235 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.662151 0.178852 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.841471 0.121454 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:44.963331 0.281107 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:45.244892 0.473824 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:45.719152 0.167845 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:45.887368 0.062829 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:45.950606 0.134039 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.085093 0.142138 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.227622 0.072487 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.300632 0.051311 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.352342 0.205738 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.558501 0.332908 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:46.891909 0.167525 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:47.059808 0.348531 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:47.408737 0.056303 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:47.465406 0.632256 udp 10.0.2.105 7010 <-> 1.23.250.147 6353 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:48.098047 0.180957 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:48.279380 0.182454 udp 10.0.2.105 7010 <-> 14.97.172.177 6801 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:48.462203 0.328498 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:48.791219 0.067110 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:48.858709 0.306092 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:49.165216 0.052487 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:49.218095 0.059248 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:49.277761 0.109589 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:49.387785 0.233475 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:49.621652 0.403335 udp 10.0.2.105 7010 <-> 121.6.78.230 3400 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:07:50.025473 0.000000 udp 10.0.2.105 7010 -> 79.112.231.200 3757 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:08:05.363904 0.053088 tcp 10.0.2.105 57122 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:05.417389 0.058697 tcp 10.0.2.105 57123 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:05.476534 0.146076 tcp 10.0.2.105 57124 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:05.623399 0.078308 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:05.702092 0.000000 udp 10.0.2.105 7010 -> 188.253.38.153 5671 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:08:21.400853 0.052436 tcp 10.0.2.105 57125 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:21.453636 0.055125 tcp 10.0.2.105 57126 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:21.509093 0.130864 tcp 10.0.2.105 57127 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:08:21.640812 0.145674 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:21.786894 0.051781 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:21.839039 0.025807 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:21.865183 0.072765 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:21.938302 0.784115 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:22.722839 0.272024 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:22.995276 0.144315 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:08:23.140060 0.315668 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:09:36.913086 2.962371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 23:09:43.823993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:09:51.711563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:10:07.497790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:10:39.050849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:16:41.165759 3.023655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 23:16:48.183414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:16:56.185238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:17:12.188113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:17:44.194966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:23:48.200493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:24:16.852968 1.969353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/23 23:24:22.777352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:24:30.663491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:24:46.438217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:25:18.312368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:29:26.833727 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 23:29:26.833846 0.962965 tcp 10.0.2.105 57128 -> 128.255.183.224 9027 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:31:17.355191 2.965943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 23:31:24.264341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:31:32.157707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:31:47.937231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:32:19.486263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:38:18.535930 2.955868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 23:38:25.445123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:38:33.335808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:38:40.232939 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 23:38:40.233024 0.000000 udp 10.0.2.105 7010 -> 79.112.231.200 3757 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:38:49.116128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:38:57.038665 0.053127 tcp 10.0.2.105 57129 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:38:57.092054 0.032065 tcp 10.0.2.105 57130 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:38:57.124536 0.131495 tcp 10.0.2.105 57131 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:38:57.256785 0.224133 udp 10.0.2.105 7010 <-> 188.253.38.153 5671 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.481302 0.174437 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.656190 0.059172 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.715932 0.136635 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.716409 2.966296 tcp 10.0.2.105 57132 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 23:38:57.852954 0.043233 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.896580 0.045544 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:57.942524 0.171577 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.114524 0.145773 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.260662 0.138042 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.399065 0.233579 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.633039 0.143950 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.777394 0.144418 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:58.922212 0.082893 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:59.005470 0.066682 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:59.072541 0.121737 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:38:59.194676 0.960641 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.155747 0.178343 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.334476 0.069711 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.404583 0.163614 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.568795 0.140542 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.709704 0.069746 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.779829 0.054255 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:00.834434 0.207819 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:01.042671 0.130877 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:01.173907 0.323087 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:01.497420 0.161916 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:01.659717 0.332609 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:01.992737 0.354278 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:02.347410 0.061448 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:02.409218 0.180610 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:02.590230 0.000000 udp 10.0.2.105 7010 -> 1.23.250.147 6353 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:39:06.597358 0.000000 tcp 10.0.2.105 57132 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/23 23:39:20.003727 0.052768 tcp 10.0.2.105 57133 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:20.056874 0.032518 tcp 10.0.2.105 57134 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:20.089681 0.137072 tcp 10.0.2.105 57135 -> 195.113.214.236 443 SRPA* 0 0 41 21418 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:20.227374 0.603087 udp 10.0.2.105 7010 <-> 14.97.172.177 6801 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:20.677193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:39:20.830938 0.302552 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:20.831328 4.857974 tcp 10.0.2.105 57136 -> 14.97.172.177 7712 SPA_* 0 0 169 89973 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:21.133921 0.055257 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:21.189557 0.063854 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:21.253804 0.000000 udp 10.0.2.105 7010 -> 86.161.199.171 2667 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:39:25.888541 4.981663 tcp 10.0.2.105 57136 -> 14.97.172.177 7712 A_PA 0 0 307 183658 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:30.894942 4.999762 tcp 10.0.2.105 57136 -> 14.97.172.177 7712 A_PA 0 0 286 175188 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:35.903291 4.558386 tcp 10.0.2.105 57136 -> 14.97.172.177 7712 FPA_* 0 0 247 155168 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:38.383714 0.051780 tcp 10.0.2.105 57137 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:38.435834 0.032340 tcp 10.0.2.105 57138 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:38.468480 0.135305 tcp 10.0.2.105 57139 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:38.604354 0.238609 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:38.843395 0.326158 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:39.169945 0.083580 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:39.253921 0.399962 udp 10.0.2.105 7010 <-> 121.6.78.230 3400 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.209816 0.078969 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.289225 0.051560 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.341145 0.025185 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.366753 0.072711 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.439851 0.360658 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.800953 0.142214 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:40.943557 0.580218 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:39:41.524354 0.000000 udp 10.0.2.105 7010 -> 59.99.72.113 9084 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/23 23:39:56.739232 0.052773 tcp 10.0.2.105 57140 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:56.792264 0.031193 tcp 10.0.2.105 57141 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:56.823683 0.178545 tcp 10.0.2.105 57142 -> 195.113.214.236 443 SRPA* 0 0 33 23696 flow=From-Botnet-V2-TCP-Established 1970/01/23 23:39:57.002788 0.314338 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/23 23:48:05.430664 2.984465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/23 23:48:12.359768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:48:20.255802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:48:36.042566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:49:07.605640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:55:26.375975 4.537582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/23 23:55:34.858707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:55:42.751305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:55:58.531396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:56:30.106270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/23 23:59:24.457063 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/23 23:59:24.457156 0.935298 tcp 10.0.2.105 57143 -> 128.255.183.224 9027 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:02:29.046771 2.960502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:02:35.954013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:02:43.839043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:02:59.619573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:03:31.175607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:09:30.158454 2.960168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:09:37.069295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:09:44.960501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:09:57.383161 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 00:09:57.383247 0.000000 udp 10.0.2.105 7010 -> 1.23.250.147 6353 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:10:00.739355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:10:15.974228 0.053600 tcp 10.0.2.105 57144 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:16.028096 0.031747 tcp 10.0.2.105 57145 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:16.060146 0.135673 tcp 10.0.2.105 57146 -> 195.113.214.236 443 SRPA* 0 0 41 23496 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:16.196452 0.064421 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:16.261243 0.557664 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:16.819301 0.043126 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:16.862867 0.039066 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:16.902317 0.136874 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:17.039592 0.061665 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:17.101713 0.183946 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:17.286097 0.000000 udp 10.0.2.105 7010 -> 188.253.38.153 5671 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:10:32.291481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:10:33.035625 0.053299 tcp 10.0.2.105 57147 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:33.089238 0.032335 tcp 10.0.2.105 57148 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:33.121817 0.140661 tcp 10.0.2.105 57149 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:33.263108 0.222226 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:33.485738 0.140620 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:33.626755 0.143701 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:33.770875 0.081609 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:33.852885 0.070681 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:33.923934 0.170804 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.095115 0.151717 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.247193 0.148275 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.395823 0.121014 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.517246 0.143501 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.661119 0.070765 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.732428 0.053376 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.786209 0.206134 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:34.992711 0.163504 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:35.156618 0.064447 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:35.221431 0.181125 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:35.402885 0.254207 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:35.657450 0.133115 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:35.790930 0.339760 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:36.131068 0.168780 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:36.300223 1.350231 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:37.650844 0.181873 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:37.833132 0.359950 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.193484 0.053075 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.246966 0.305509 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.552874 0.221206 udp 10.0.2.105 7010 <-> 14.97.172.177 6801 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.774445 0.053164 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.828011 0.062730 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:38.891138 0.232784 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:10:39.124457 0.000000 udp 10.0.2.105 7010 -> 79.21.5.110 7032 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:10:55.087727 0.052454 tcp 10.0.2.105 57150 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:55.140495 0.033129 tcp 10.0.2.105 57151 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:55.173865 0.131953 tcp 10.0.2.105 57152 -> 195.113.214.236 443 SRPA* 0 0 34 26336 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:10:55.306551 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:11:11.853706 0.052059 tcp 10.0.2.105 57153 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:11:11.906060 0.054686 tcp 10.0.2.105 57154 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:11:11.960988 0.132142 tcp 10.0.2.105 57155 -> 195.113.214.236 443 SRPA* 0 0 21 12436 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:11:12.093713 0.049268 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.143350 0.024376 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.168125 0.081566 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.250050 0.404816 udp 10.0.2.105 7010 <-> 121.6.78.230 3400 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.655329 0.086098 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.741792 0.143789 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:12.885977 0.140478 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:13.026886 0.547489 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:11:13.574725 0.308926 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:16:31.365388 3.002378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 00:16:38.323317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:16:46.214120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:17:01.999135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:17:33.566816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:23:32.661783 2.965066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:23:39.568632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:23:47.467928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:24:03.455330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:24:35.461795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:29:05.119538 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 00:29:05.119633 1.077516 tcp 10.0.2.105 57156 -> 128.255.183.224 9027 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:30:39.467612 3.001524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:30:46.474232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:30:54.476495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:31:10.479268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:31:42.485437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:37:46.492075 3.000959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:37:53.498986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:38:01.500213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:38:17.503390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:38:49.509681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:41:32.283862 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 00:41:32.284072 0.169350 udp 10.0.2.105 7010 -> 188.253.38.153 5671 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:41:32.453422 0.000000 icmp 188.253.38.153 0x0303 -> 10.0.2.105 0x2716 URP 192 1 257 flow=Background 1970/01/24 00:41:50.420978 0.053383 tcp 10.0.2.105 57157 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:41:50.474552 0.055950 tcp 10.0.2.105 57158 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:41:50.530683 0.132897 tcp 10.0.2.105 57159 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:41:50.664124 0.073350 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:41:50.737879 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:42:08.716880 0.053471 tcp 10.0.2.105 57160 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:08.770565 0.035030 tcp 10.0.2.105 57161 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:08.805822 0.137117 tcp 10.0.2.105 57162 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:08.943467 0.067527 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.011379 0.136055 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.147816 0.058014 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.206313 0.175083 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.206727 2.994155 tcp 10.0.2.105 57163 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 00:42:09.381806 0.045588 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.427728 0.229766 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:09.657908 0.380751 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.039059 0.087271 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.126708 0.170646 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.297767 0.222032 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.520238 0.145843 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.666501 0.143870 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.810724 0.151805 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:10.962884 0.081361 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.044747 0.144316 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.189480 0.074014 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.263869 0.056237 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.320600 0.206858 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.527851 0.168025 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.696249 0.063330 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.759912 0.120581 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:11.880867 0.148503 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:12.029779 1.393624 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:13.423806 0.179485 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:13.603723 0.131292 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:13.735428 0.333415 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:14.069223 0.161145 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:14.230799 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:42:18.199652 0.000000 tcp 10.0.2.105 57163 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 00:42:31.488650 0.054205 tcp 10.0.2.105 57164 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:31.543076 0.032951 tcp 10.0.2.105 57165 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:31.576399 0.143257 tcp 10.0.2.105 57166 -> 195.113.214.236 443 SRPA* 0 0 69 69908 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:31.720780 1.434926 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:33.156118 0.350942 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:33.507456 0.055056 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:33.562917 0.063733 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:33.627013 0.233339 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:33.860766 0.305011 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:34.166416 0.057896 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:34.224683 0.000000 udp 10.0.2.105 7010 -> 14.97.172.177 6801 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 00:42:50.766967 0.054058 tcp 10.0.2.105 57167 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:50.821278 0.031962 tcp 10.0.2.105 57168 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:50.853422 0.129456 tcp 10.0.2.105 57169 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/24 00:42:50.983447 0.025638 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.009377 0.086405 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.096151 0.395766 udp 10.0.2.105 7010 <-> 121.6.78.230 3400 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.492297 0.055234 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.547942 0.141106 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 199 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.689455 0.142420 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.832475 0.888634 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:51.832782 2.999408 tcp 10.0.2.105 57170 -> 24.153.42.51 8367 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 00:42:52.721522 0.078328 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:42:52.800296 0.310666 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/24 00:43:00.831428 0.000000 tcp 10.0.2.105 57170 -> 24.153.42.51 8367 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 00:47:45.524666 2.999529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 00:47:52.530125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:48:00.531768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:48:16.534479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:48:48.540932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:54:52.545815 3.003206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 00:54:59.553705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:55:07.555046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:55:23.563303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:55:55.564830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 00:59:06.200376 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 00:59:06.200565 1.031025 tcp 10.0.2.105 57171 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:01:59.570980 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:02:06.578653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:02:14.579782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:02:30.582613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:03:02.589012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:09:06.595091 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:09:13.601903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:09:21.603558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:09:37.606102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:10:09.612893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:13:13.868053 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 01:13:13.868150 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:13:30.934471 0.054840 tcp 10.0.2.105 57172 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:30.989618 0.032377 tcp 10.0.2.105 57173 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:31.022353 0.132242 tcp 10.0.2.105 57174 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:31.155250 0.000000 udp 10.0.2.105 7010 -> 14.97.172.177 6801 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:13:47.887557 0.094841 tcp 10.0.2.105 57175 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:47.982752 0.031913 tcp 10.0.2.105 57176 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:48.014954 0.132794 tcp 10.0.2.105 57177 -> 195.113.214.236 443 SRPA* 0 0 41 22676 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:13:48.148598 0.089443 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.238412 0.184130 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.422911 0.137049 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.560440 0.065202 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.626040 0.058113 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.626367 2.995261 tcp 10.0.2.105 57178 -> 86.161.199.171 2673 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:13:48.684592 0.268598 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:48.953591 0.063283 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.017255 0.170888 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.188616 0.042426 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.231383 0.040047 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.271756 0.074609 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.346761 0.141643 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.488818 0.221397 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.710577 0.073740 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.784779 0.053390 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.838593 0.147262 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:49.986235 0.144374 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:50.130986 0.151657 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:50.283042 0.064784 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:13:50.348215 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:13:57.620809 0.000000 tcp 10.0.2.105 57178 -> 86.161.199.171 2673 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:14:06.121235 0.009714 udp 10.0.2.105 58004 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/24 01:14:06.131294 0.009690 udp 10.0.2.105 62777 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/24 01:14:07.244705 0.052576 tcp 10.0.2.105 57179 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:07.297562 0.034571 tcp 10.0.2.105 57180 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:07.332439 0.131366 tcp 10.0.2.105 57181 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:07.464384 0.148288 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:07.613063 0.207855 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:07.821294 0.165014 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:07.986673 0.169457 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:08.156552 0.245561 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:08.402498 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:14:24.819933 0.392606 tcp 10.0.2.105 57182 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:25.212785 0.034473 tcp 10.0.2.105 57183 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:25.247508 0.132606 tcp 10.0.2.105 57184 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:25.380569 0.134603 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:25.515624 0.345932 udp 10.0.2.105 7010 <-> 49.144.4.42 2222 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:25.515963 2.974941 tcp 10.0.2.105 57185 -> 69.159.92.136 2653 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:14:25.861914 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:14:34.429110 0.000000 tcp 10.0.2.105 57185 -> 69.159.92.136 2653 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:14:41.232426 0.009870 udp 10.0.2.105 50448 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/24 01:14:41.242787 0.009865 udp 10.0.2.105 62573 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/24 01:14:43.590812 0.062208 tcp 10.0.2.105 57186 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:43.653268 0.032973 tcp 10.0.2.105 57187 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:43.686495 0.132849 tcp 10.0.2.105 57188 -> 195.113.214.236 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:14:43.819934 0.063379 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:43.883676 0.232955 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.116991 0.307351 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.424785 0.063980 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.489149 0.056886 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.546413 0.359004 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.905817 0.074582 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:44.980783 0.146151 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:45.127330 0.052628 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:45.180361 0.139268 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:45.320042 0.140445 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:14:45.460873 0.000000 udp 10.0.2.105 7010 -> 121.6.78.230 3400 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:15:00.711608 0.052801 tcp 10.0.2.105 57189 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:15:00.764711 0.032969 tcp 10.0.2.105 57190 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:15:00.797876 0.132394 tcp 10.0.2.105 57191 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:15:00.930789 0.339100 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:15:01.270366 0.843434 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:15:01.270689 3.005812 tcp 10.0.2.105 57192 -> 175.202.204.27 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:15:02.114207 0.077108 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:15:10.290234 0.000000 tcp 10.0.2.105 57192 -> 175.202.204.27 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/24 01:16:13.618486 3.001814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 01:16:20.626182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:16:28.627664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:16:44.630302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:17:16.636989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:23:20.642142 3.002240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:23:27.649702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:23:35.651492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:23:51.654471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:24:23.660779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:29:07.238599 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 01:29:07.238780 0.970026 tcp 10.0.2.105 57193 -> 128.255.183.224 9027 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:30:27.667692 3.000452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:30:34.673973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:30:42.675724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:30:58.677962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:31:30.684690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:37:34.690487 3.004950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:37:41.701141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:37:49.699196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:38:05.702721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:38:37.708414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:45:02.712420 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 01:45:02.712609 0.123055 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:02.836486 0.179628 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:02.836883 1.972429 tcp 10.0.2.105 57194 -> 184.182.240.239 7058 SPA_* 0 0 127 102575 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:03.016688 1.598481 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:04.615517 0.000000 udp 10.0.2.105 7010 -> 121.6.78.230 3400 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:45:11.743080 4.877367 tcp 10.0.2.105 57194 -> 184.182.240.239 7058 A_PA 0 0 371 333015 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:17.302367 4.687993 tcp 10.0.2.105 57194 -> 184.182.240.239 7058 A_PA 0 0 150 122788 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:22.353157 3.497874 tcp 10.0.2.105 57194 -> 184.182.240.239 7058 FPA_* 0 0 52 45560 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:23.353920 0.053472 tcp 10.0.2.105 57195 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:23.407725 0.054249 tcp 10.0.2.105 57196 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:23.462250 0.130492 tcp 10.0.2.105 57197 -> 195.113.214.236 443 SRPA* 0 0 32 23577 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:23.593426 0.086051 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:23.679823 0.545087 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.225337 0.064854 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.290518 0.170049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.460941 0.044522 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.505774 0.038915 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.545257 0.076304 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.621980 0.182314 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.804681 0.074919 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.880006 0.057312 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:24.937715 0.136196 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.074298 0.147229 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.221949 0.144996 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.367346 0.063567 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.431351 0.228091 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.730369 0.144476 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:25.875285 0.143319 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:26.019006 0.054903 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:26.074304 0.073166 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:26.147859 0.148488 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:26.296730 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:45:44.172344 0.051635 tcp 10.0.2.105 57198 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:44.224415 0.053216 tcp 10.0.2.105 57199 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:44.277874 0.151368 tcp 10.0.2.105 57200 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:45:44.429767 0.168469 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:44.598658 0.207519 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:44.806537 0.243708 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:45.050689 0.131729 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:45:45.182788 0.000000 udp 10.0.2.105 7010 -> 49.144.4.42 2222 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:46:00.365473 0.053229 tcp 10.0.2.105 57201 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:00.418889 0.058830 tcp 10.0.2.105 57202 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:00.477963 0.172805 tcp 10.0.2.105 57203 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:00.651484 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 01:46:16.799338 0.056180 tcp 10.0.2.105 57204 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:16.855776 0.054076 tcp 10.0.2.105 57205 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:16.910119 0.149367 tcp 10.0.2.105 57206 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 01:46:17.059986 0.058710 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.119112 0.066403 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.185896 0.233352 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.419602 0.057345 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.477323 0.076163 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.553896 0.026330 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.580558 0.054038 udp 10.0.2.105 7010 <-> 31.52.139.141 5071 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.634924 0.139857 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.775245 0.140646 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:17.916215 0.351756 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:18.268515 0.355326 udp 10.0.2.105 7010 <-> 175.202.204.27 7447 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:18.624197 0.159320 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:46:18.783910 0.077953 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 01:47:37.717432 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 01:47:44.725011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:47:52.726855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:48:08.729532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:48:40.735891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:54:44.742426 3.001105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 01:54:51.748814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:54:59.750237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:55:15.753351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:55:47.759344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 01:59:08.208151 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 01:59:08.208304 0.957784 tcp 10.0.2.105 57207 -> 128.255.183.224 9027 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:01:51.765771 3.033395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:01:59.063422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:02:11.651194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:02:27.435060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:03:00.000567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:08:58.972647 2.952728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:09:05.880888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:09:13.838065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:09:29.841188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:10:01.847342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:16:05.854704 3.000515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:16:12.860908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:16:20.862954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:16:31.427415 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 02:16:31.427507 0.166808 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:16:31.594716 0.000000 udp 10.0.2.105 7010 -> 49.144.4.42 2222 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:16:36.868549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:16:48.043501 0.052936 tcp 10.0.2.105 57208 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:16:48.096727 0.032246 tcp 10.0.2.105 57209 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:16:48.129261 0.116431 tcp 10.0.2.105 57210 -> 195.113.214.236 443 SRPA* 0 0 34 24817 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:16:48.246341 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:17:06.884405 0.052675 tcp 10.0.2.105 57211 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:06.937372 0.032094 tcp 10.0.2.105 57212 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:06.969751 0.135002 tcp 10.0.2.105 57213 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:07.105316 0.120360 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:07.226069 0.180078 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:07.406573 1.451686 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:08.858633 0.087212 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:08.875803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:17:08.946279 0.290776 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.237506 0.142389 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.380264 0.081140 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.461858 0.184652 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.646896 0.039276 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.686631 0.059683 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.746686 0.073457 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.820715 0.068856 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:09.889959 0.170606 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.061012 0.139867 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.201260 0.063263 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.264941 0.138159 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.403483 0.145060 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.548972 0.077808 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.627238 0.151006 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.778653 0.147101 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:10.926157 0.237121 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:11.163653 0.056956 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:11.221045 0.145333 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:11.366818 0.206939 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:11.574147 1.197238 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:12.771771 0.167051 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:12.939267 0.133612 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:13.073235 0.054455 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:13.128044 0.058921 udp 10.0.2.105 7010 <-> 86.150.222.206 9256 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:13.187320 0.000000 udp 10.0.2.105 7010 -> 161.200.34.33 5040 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:17:28.880733 0.051531 tcp 10.0.2.105 57214 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:28.932581 0.032506 tcp 10.0.2.105 57215 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:28.965318 0.137237 tcp 10.0.2.105 57216 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:29.103225 0.057747 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:29.161420 0.075695 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:29.237563 0.026243 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:29.264173 0.000000 udp 10.0.2.105 7010 -> 31.52.139.141 5071 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:17:45.845387 0.051027 tcp 10.0.2.105 57217 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:45.896671 0.032281 tcp 10.0.2.105 57218 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:45.929271 0.167937 tcp 10.0.2.105 57219 -> 195.113.214.236 443 SRPA* 0 0 24 14740 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:17:46.097791 0.349412 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:46.447568 0.141649 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:46.589644 0.144280 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:46.734267 0.084034 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:17:46.818648 0.000000 udp 10.0.2.105 7010 -> 175.202.204.27 7447 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:18:03.070110 0.053952 tcp 10.0.2.105 57220 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:18:03.124461 0.086197 tcp 10.0.2.105 57221 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:18:03.210914 0.147660 tcp 10.0.2.105 57222 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:18:03.359116 0.200143 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:23:12.877187 3.002383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 02:23:19.884906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:23:27.886530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:23:43.889885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:24:15.895393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:29:09.167424 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 02:29:09.167571 0.998147 tcp 10.0.2.105 57223 -> 128.255.183.224 9027 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:30:19.902385 3.000951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:30:26.909066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:30:34.910544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:30:50.913511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:31:22.923051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:37:26.925177 3.001675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:37:33.943880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:37:41.937180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:37:57.937336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:38:29.945952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:47:30.963896 3.013098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 02:47:37.981256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:47:45.982679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:48:01.985604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:48:14.925248 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 02:48:14.925443 0.000000 udp 10.0.2.105 7010 -> 161.200.34.33 5040 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:48:31.379732 0.058554 tcp 10.0.2.105 57224 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:31.438556 0.036883 tcp 10.0.2.105 57225 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:31.475709 0.138903 tcp 10.0.2.105 57226 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:31.615159 0.000000 udp 10.0.2.105 7010 -> 31.52.139.141 5071 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:48:33.991619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:48:49.975421 0.052164 tcp 10.0.2.105 57227 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:50.027848 0.032623 tcp 10.0.2.105 57228 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:50.060721 0.130810 tcp 10.0.2.105 57229 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:48:50.192060 0.000000 udp 10.0.2.105 7010 -> 175.202.204.27 7447 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:49:06.589363 0.052177 tcp 10.0.2.105 57230 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:06.641735 0.071038 tcp 10.0.2.105 57231 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:06.713043 0.150621 tcp 10.0.2.105 57232 -> 195.113.214.236 443 SRPA* 0 0 44 27486 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:06.865450 0.160530 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:07.026342 0.121569 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:07.148267 0.176607 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:07.325269 0.311623 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:07.637236 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:49:25.616323 0.059568 tcp 10.0.2.105 57233 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:25.676118 0.032289 tcp 10.0.2.105 57234 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:25.708643 0.129346 tcp 10.0.2.105 57235 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:25.838513 0.112015 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:25.950922 0.067924 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.019227 0.058537 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.078135 0.045765 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.124221 0.069363 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.193919 0.181897 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.376229 0.141740 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.518359 0.062561 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.581292 0.149637 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.731362 0.072445 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.804251 0.108525 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:26.913161 0.221299 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.134881 0.221851 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.357185 0.057123 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.414658 0.144709 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.559772 0.072691 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.632834 0.151602 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.784832 0.143291 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:27.928680 0.147742 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.076743 0.206514 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.283605 0.163328 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.447329 0.059491 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.507231 0.131634 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.639228 0.222512 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:28.862121 0.000000 udp 10.0.2.105 7010 -> 86.150.222.206 9256 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:49:44.624527 0.052966 tcp 10.0.2.105 57236 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:44.677744 0.034208 tcp 10.0.2.105 57237 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:44.712228 0.203002 tcp 10.0.2.105 57238 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:49:44.915729 0.075809 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:44.991969 0.053397 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:49:45.045727 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 02:50:03.270810 0.051332 tcp 10.0.2.105 57239 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:50:03.322412 0.032966 tcp 10.0.2.105 57240 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:50:03.355669 0.143823 tcp 10.0.2.105 57241 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/24 02:50:03.499965 0.079158 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:50:03.579489 0.257400 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:50:03.837325 0.348828 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:50:04.186550 0.141731 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:50:04.328730 0.174575 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 02:54:37.997639 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 02:54:45.005329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:54:53.006991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:55:09.013034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:55:41.015721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 02:59:10.167243 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 02:59:10.167431 0.966626 tcp 10.0.2.105 57242 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:01:45.025944 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:01:52.029286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:02:00.030656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:02:16.033528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:02:48.039501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:08:52.045474 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:08:59.053420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:09:07.054675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:09:23.057607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:09:55.063666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:15:59.069798 3.079328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:16:06.124067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:16:14.088862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:16:30.091594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:17:02.097778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:20:33.872529 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 03:20:33.872615 1.552130 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:20:35.425186 0.000000 udp 10.0.2.105 7010 -> 86.150.222.206 9256 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 03:20:50.439422 0.053481 tcp 10.0.2.105 57243 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:20:50.493287 0.058597 tcp 10.0.2.105 57244 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:20:50.552172 0.136036 tcp 10.0.2.105 57245 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:20:50.688775 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 03:21:05.768919 0.053334 tcp 10.0.2.105 57246 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:05.822501 0.053722 tcp 10.0.2.105 57247 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:05.876526 0.135503 tcp 10.0.2.105 57248 -> 195.113.214.236 443 SRPA* 0 0 24 13862 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:06.012548 0.121378 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:06.134316 2.056542 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:08.191263 0.178979 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:08.370599 0.000000 udp 10.0.2.105 7010 -> 59.99.72.113 9084 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 03:21:27.339679 0.052500 tcp 10.0.2.105 57249 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:27.392444 0.054997 tcp 10.0.2.105 57250 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:27.447704 0.134016 tcp 10.0.2.105 57251 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:21:27.582211 0.058566 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:27.641139 0.046215 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:27.687725 0.070485 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:27.758597 0.088441 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:27.847425 0.065609 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:27.913410 0.095593 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.009362 0.063412 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.073123 0.178206 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.251721 0.146266 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.398390 0.139269 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.538000 0.055182 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.593555 0.143677 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.737584 0.204963 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:28.942956 0.221745 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.165145 0.171084 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.336633 0.146583 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.483569 0.152143 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.636073 0.073612 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.710042 0.143989 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:29.854429 0.164112 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.018968 0.226233 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.245602 0.200483 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.446463 0.132179 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.579032 0.059405 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.638792 0.084834 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.723974 0.080643 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.804983 0.083872 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:30.889224 0.139165 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:31.028779 0.348317 udp 10.0.2.105 7010 <-> 36.239.243.162 7010 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:31.377490 0.141905 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:21:31.519718 0.159301 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:23:06.104476 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 03:23:13.111070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:23:21.112678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:23:37.118511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:24:09.121982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:29:11.137521 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 03:29:11.137631 1.039984 tcp 10.0.2.105 57252 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:30:13.133302 2.996822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:30:20.141599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:30:28.136776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:30:44.140129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:31:16.145847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:37:20.158296 2.995042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:37:27.160606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:37:35.160876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:37:51.163423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:38:23.169512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:47:25.182348 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:47:32.189238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:47:40.190531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:47:56.194098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:48:28.200837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:51:46.414712 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 03:51:46.414869 0.274182 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:46.689470 1.275447 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:47.965337 0.122615 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.088510 0.166299 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.255225 0.180312 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.435882 0.065365 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.501571 0.039954 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.541888 0.069182 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.611445 0.086959 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.698743 0.066256 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.765344 0.070720 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.836511 0.063066 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:48.899944 0.182913 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.083217 0.141204 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.224806 0.137867 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.363094 0.058689 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.422120 0.142556 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.565007 0.048307 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.613645 0.227642 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:49.841642 0.170161 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.012157 0.069619 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.082152 0.142685 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.225208 0.164032 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.389635 0.221653 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.611647 0.146832 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.758841 0.144895 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:50.904175 0.208262 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.112871 0.130591 udp 10.0.2.105 7010 <-> 69.159.92.136 5290 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.243853 0.056104 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.300358 0.077534 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.378265 0.056970 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.435587 0.083781 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.519774 0.146531 udp 10.0.2.105 7010 <-> 99.225.11.224 6140 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:51:51.666685 0.000000 udp 10.0.2.105 7010 -> 36.239.243.162 7010 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 03:52:09.189028 0.054516 tcp 10.0.2.105 57253 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:52:09.243828 0.032182 tcp 10.0.2.105 57254 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:52:09.276238 0.129523 tcp 10.0.2.105 57255 -> 195.113.214.236 443 SRPA* 0 0 22 12490 flow=From-Botnet-V2-TCP-Established 1970/01/24 03:52:09.406323 0.142370 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:52:09.549039 0.319166 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 03:54:32.206124 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 03:54:39.213145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:54:47.214065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:55:03.217695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:55:35.223567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 03:59:12.185868 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 03:59:12.186021 0.981119 tcp 10.0.2.105 57256 -> 128.255.183.224 9027 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:01:39.231305 3.000180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:01:46.237317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:01:54.241575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:02:10.241525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:02:42.259772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:08:46.273428 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:08:53.281474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:09:01.282038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:09:17.285375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:09:49.291781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:15:53.306028 2.998851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:16:00.308035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:16:08.306051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:16:24.309273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:16:56.315289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:22:24.998157 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 04:22:24.998257 0.354525 udp 10.0.2.105 7010 -> 36.239.243.162 7010 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:22:25.352782 0.000000 icmp 36.239.243.162 0x0303 -> 10.0.2.105 0x621b URP 192 1 236 flow=Background 1970/01/24 04:22:41.565034 0.052962 tcp 10.0.2.105 57257 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:22:41.618256 0.052678 tcp 10.0.2.105 57258 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:22:41.671221 0.133351 tcp 10.0.2.105 57259 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:22:41.805185 0.273352 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.078969 0.120589 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.199919 0.170962 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.371271 0.178994 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.550749 0.057698 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.608829 0.040365 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.649547 0.070107 udp 10.0.2.105 7010 <-> 86.161.199.171 2667 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.720063 0.078716 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.799125 0.076678 udp 10.0.2.105 7010 <-> 86.135.43.196 8321 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.876149 0.083106 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:42.959635 0.864438 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:43.824476 0.181467 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.006350 0.143807 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.150589 0.140806 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.291786 0.048323 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.340488 0.144899 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.485804 0.044393 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.530614 0.222174 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.753210 0.170132 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.923716 0.072665 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:44.996826 0.064032 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:45.061245 0.171144 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:45.232472 0.379696 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:45.612561 0.144198 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:45.757207 0.144395 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:45.902048 0.208478 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:22:46.110938 0.000000 udp 10.0.2.105 7010 -> 69.159.92.136 5290 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:23:00.321825 3.001295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:23:01.350641 0.052500 tcp 10.0.2.105 57260 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:01.403448 0.053567 tcp 10.0.2.105 57261 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:01.457233 0.156461 tcp 10.0.2.105 57262 -> 195.113.214.236 443 SRPA* 0 0 61 54851 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:01.614398 0.061487 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:01.676248 0.076126 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:01.752803 0.058024 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:01.811217 0.079884 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:01.891493 0.145889 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:02.037758 0.000000 udp 10.0.2.105 7010 -> 99.225.11.224 6140 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:23:07.328697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:23:15.330346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:23:20.037573 0.056789 tcp 10.0.2.105 57263 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:20.094622 0.054804 tcp 10.0.2.105 57264 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:20.149675 0.156038 tcp 10.0.2.105 57265 -> 195.113.214.236 443 SRPA* 0 0 24 13824 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:23:20.306274 0.143504 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:20.450099 0.482334 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:23:31.333374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:24:03.339275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:29:13.175428 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 04:29:13.175529 1.046835 tcp 10.0.2.105 57266 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:30:07.345517 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:30:14.352904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:30:22.354142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:30:38.361299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:31:10.363296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:37:14.369452 3.013595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:37:21.386470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:37:29.392953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:37:45.394610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:38:17.397223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:44:21.402758 3.002281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:44:28.410669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:44:36.412431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:44:52.415152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:45:24.421449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:51:28.427191 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 04:51:35.434670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:51:43.436065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:51:59.439051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:52:31.445211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:53:21.636981 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 04:53:21.637130 0.000000 udp 10.0.2.105 7010 -> 69.159.92.136 5290 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:53:38.793467 0.053944 tcp 10.0.2.105 57267 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:38.847651 0.054068 tcp 10.0.2.105 57268 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:38.901930 0.147526 tcp 10.0.2.105 57269 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:39.049705 0.000000 udp 10.0.2.105 7010 -> 99.225.11.224 6140 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:53:55.797352 0.056978 tcp 10.0.2.105 57270 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:55.854626 0.057872 tcp 10.0.2.105 57271 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:55.912763 0.154675 tcp 10.0.2.105 57272 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:53:56.068053 0.598199 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:53:56.666680 0.120422 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:53:56.787491 0.060284 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:53:56.848143 0.041299 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:53:56.889792 0.000000 udp 10.0.2.105 7010 -> 86.161.199.171 2667 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:54:14.103481 0.053824 tcp 10.0.2.105 57273 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:14.157553 0.052047 tcp 10.0.2.105 57274 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:14.209895 0.150981 tcp 10.0.2.105 57275 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:14.361396 0.071779 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:14.433586 0.000000 udp 10.0.2.105 7010 -> 86.135.43.196 8321 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 04:54:32.159580 0.052787 tcp 10.0.2.105 57276 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:32.212620 0.054533 tcp 10.0.2.105 57277 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:32.267496 0.141557 tcp 10.0.2.105 57278 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:54:32.409579 0.095557 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:32.505454 0.167899 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:32.673745 0.178945 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:32.853097 0.052941 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:32.906386 0.482338 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:33.389129 0.183534 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:33.573042 0.142015 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:33.715454 0.137800 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:33.853627 0.171618 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.025626 0.067549 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.093505 0.073907 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.167813 0.166026 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.334332 0.146359 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.481068 0.209316 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.690765 0.046660 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.737788 0.208915 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:34.947113 0.146239 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:35.093724 1.541615 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:36.635704 0.137823 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:36.773875 0.087982 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:36.862223 0.092480 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:36.955071 0.146005 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:37.101465 0.077649 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:37.179475 0.061965 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:37.241829 0.140650 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:54:37.382801 0.520996 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/24 04:58:37.454036 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 04:58:44.462964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:58:52.462925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:59:08.466141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 04:59:14.224962 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 04:59:14.225116 0.978580 tcp 10.0.2.105 57279 -> 128.255.183.224 9027 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/01/24 04:59:40.471964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:05:44.477795 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:05:51.485633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:05:59.486924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:06:15.489607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:06:47.495959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:12:51.501733 3.001853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:12:58.509388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:13:06.513024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:13:22.513997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:13:54.522488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:19:58.530374 2.997114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:20:05.533271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:20:13.534890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:20:29.537751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:21:01.543858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:25:00.868434 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 05:25:00.868531 0.000000 udp 10.0.2.105 7010 -> 86.135.43.196 8321 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 05:25:17.603524 0.057074 tcp 10.0.2.105 57280 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:17.660867 0.034034 tcp 10.0.2.105 57281 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:17.695089 0.148275 tcp 10.0.2.105 57282 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:17.843962 0.000000 udp 10.0.2.105 7010 -> 86.161.199.171 2667 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 05:25:33.155074 0.052227 tcp 10.0.2.105 57283 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:33.207567 0.032684 tcp 10.0.2.105 57284 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:33.240520 0.155716 tcp 10.0.2.105 57285 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:25:33.396817 0.044605 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:33.441807 0.062212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:33.504446 0.120609 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:33.625599 0.339734 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:33.965745 0.129358 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.095512 0.179878 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.275781 0.050305 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.326493 0.076454 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.403353 0.163207 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.566907 0.368568 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:34.935870 0.181070 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.117391 0.144986 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.262748 0.138636 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.401795 0.170137 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.572461 0.075164 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.647984 0.076538 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.724870 0.163311 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.888638 0.049186 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:35.938210 0.208849 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:36.147439 0.148917 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:36.296793 0.141082 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:36.438188 0.235259 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:36.673786 0.726872 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.401021 0.151735 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.553110 0.056004 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.609546 0.078182 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.688095 0.058904 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.747414 0.148598 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:37.896403 0.348558 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:38.245332 0.082768 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:25:38.328507 0.144827 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:27:05.550041 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 05:27:12.557483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:27:20.559064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:27:36.564801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:28:08.567209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:29:15.203981 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 05:29:15.204136 0.968749 tcp 10.0.2.105 57286 -> 128.255.183.224 9027 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/01/24 05:34:12.576454 2.999088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:34:19.581275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:34:27.582696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:34:43.585501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:35:15.591603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:41:19.597197 3.002416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:41:26.605272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:41:34.606984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:41:50.609785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:42:22.615828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:49:36.625545 2.999289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:49:43.629684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:49:51.633487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:50:07.634551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:50:39.640177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:55:52.644767 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 05:55:52.644920 0.044507 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:52.689775 0.059323 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:52.749439 0.122149 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:52.871938 0.284774 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:53.157130 0.088431 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:53.245922 0.181857 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:53.428147 0.053000 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:53.481481 0.440742 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:53.922613 0.186004 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.108989 0.144425 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.253846 0.071458 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.325668 0.161493 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.487574 0.141558 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.629514 0.170396 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.800306 0.076112 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.876778 0.081026 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:54.958217 0.165826 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.124447 0.044770 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.169541 0.210744 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.380692 0.147997 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.529108 0.141677 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.671185 0.209277 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:55.880819 1.712283 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:57.593461 0.144936 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:57.738798 0.055515 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:57.794676 0.077971 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:57.873006 0.060892 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:57.934294 0.142837 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:58.077490 0.582614 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:58.660641 0.085162 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:55:58.746239 0.144167 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/24 05:56:51.647428 3.007263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 05:56:58.655256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:57:06.657087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:57:22.660695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:57:54.665991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 05:59:16.179696 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 05:59:16.179817 0.938488 tcp 10.0.2.105 57287 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:03:58.673588 3.000067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:04:05.679317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:04:13.681157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:04:29.683621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:05:01.690140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:11:05.697188 3.000736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:11:12.703194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:11:20.705125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:11:36.707814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:12:08.713713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:18:12.719744 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:18:19.727251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:18:27.728540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:18:43.732603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:19:15.738422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:25:19.744013 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:25:26.750819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:25:34.752845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:25:50.755523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:26:14.069691 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 06:26:14.069930 0.120280 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 593 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.190580 0.047266 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.238298 0.057118 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.295796 0.285820 udp 10.0.2.105 7010 <-> 59.99.72.113 9084 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.582006 0.072052 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.654456 0.180025 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.834819 0.052984 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:14.888199 0.462552 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:15.351133 0.181516 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:15.532980 0.146537 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:15.679861 0.075467 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:15.755711 0.176140 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:15.932250 0.138491 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.071173 0.172016 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.243557 0.072816 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.316758 0.064161 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.381319 0.164881 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.546571 0.046093 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.593087 0.142154 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.735644 0.208704 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:16.944738 0.205554 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:17.150694 0.150347 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:17.301519 0.559973 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:17.861859 0.144892 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.007138 0.056957 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.064636 0.075569 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.140642 0.058497 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.199505 0.145104 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.344992 0.145493 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.490891 0.483254 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:18.974497 0.077983 udp 10.0.2.105 7010 <-> 95.13.37.13 2925 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:26:22.761700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:29:17.113140 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 06:29:17.113243 0.978348 tcp 10.0.2.105 57288 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:32:26.768344 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:32:33.775297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:32:41.776714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:32:57.779644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:33:29.785620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:39:33.791313 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:39:40.798987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:39:48.803285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:40:04.803536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:40:36.809869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:48:39.816527 3.003069 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:48:46.824117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:48:54.825599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:49:10.829089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:49:42.834926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:55:46.840759 3.002164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 06:55:53.848529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:56:01.851833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:56:17.853406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:56:21.498773 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 06:56:21.499022 0.062166 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:21.561586 0.122529 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:21.684541 0.039364 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:21.724186 0.000000 udp 10.0.2.105 7010 -> 59.99.72.113 9084 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 06:56:37.232887 0.052584 tcp 10.0.2.105 57289 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:37.285679 0.053614 tcp 10.0.2.105 57290 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:37.339589 0.128327 tcp 10.0.2.105 57291 -> 195.113.214.236 443 SRPA* 0 0 59 38435 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:37.468878 0.073487 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:37.542811 0.180176 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:37.723421 0.054843 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:37.778647 0.327290 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.106354 0.085666 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.192440 0.164580 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.357424 0.136096 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.493855 0.170204 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.664504 0.073071 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.737957 0.177022 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:38.915351 0.144927 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.060731 0.065818 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.126928 0.165616 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.292909 0.048604 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.341836 0.140830 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.483082 0.215328 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.698831 0.207033 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:39.906303 0.146270 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:40.053002 0.722946 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:40.776322 0.144953 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:40.921633 0.058480 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:40.980467 0.092452 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:41.073292 0.059198 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:41.132860 0.144597 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:41.277840 0.000000 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 06:56:49.859020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 06:56:57.029677 0.052189 tcp 10.0.2.105 57292 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:57.082196 0.058711 tcp 10.0.2.105 57293 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:57.141174 0.160691 tcp 10.0.2.105 57294 -> 195.113.214.236 443 SRPA* 0 0 42 22924 flow=From-Botnet-V2-TCP-Established 1970/01/24 06:56:57.302396 0.232303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:56:57.535115 0.373067 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 06:59:18.092815 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 06:59:18.092981 0.969546 tcp 10.0.2.105 57295 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:02:53.870185 2.996577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 07:03:00.872686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:03:08.873745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:03:24.880356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:03:56.882742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:10:00.889077 3.001664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:10:07.896180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:10:15.897408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:10:31.900782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:11:03.906708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:17:07.912450 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:17:14.920532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:17:22.921735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:17:38.924791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:18:10.930902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:24:14.936216 3.002109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:24:21.944025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:24:29.945408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:24:45.948729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:25:17.955171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:27:14.703141 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 07:27:14.703283 0.000000 udp 10.0.2.105 7010 -> 59.99.72.113 9084 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 07:27:31.759159 0.053231 tcp 10.0.2.105 57296 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:31.812650 0.052508 tcp 10.0.2.105 57297 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:31.865472 0.160614 tcp 10.0.2.105 57298 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:32.026722 0.000000 udp 10.0.2.105 7010 -> 95.13.37.13 2925 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 07:27:48.671888 0.055111 tcp 10.0.2.105 57299 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:48.727322 0.059505 tcp 10.0.2.105 57300 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:48.787155 0.146599 tcp 10.0.2.105 57301 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:27:48.934382 0.119993 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.054743 0.060105 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.115228 0.045767 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.161406 0.180440 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.342253 0.056333 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.398960 0.326837 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.726204 0.076061 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.802696 0.083323 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:49.886405 0.688371 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:50.575148 0.138313 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:50.713805 0.179239 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:50.893471 0.148149 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.041969 0.087043 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.129373 0.168541 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.298299 0.049667 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.348379 0.077854 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.426650 0.171199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.598208 0.209502 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.808045 0.148148 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:51.956650 0.141951 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.098982 0.222809 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.322213 0.255490 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.578101 0.080268 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.658757 0.060470 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.719590 0.144173 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.864478 0.061469 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:52.926383 0.144631 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:53.071398 0.144507 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:27:53.216283 0.421217 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:29:19.061754 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 07:29:19.061856 0.991227 tcp 10.0.2.105 57302 -> 128.255.183.224 9027 FSPA* 0 0 14 1703 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:31:21.959992 3.002509 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 07:31:28.967830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:31:36.969483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:31:52.972648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:32:24.978649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:38:28.984874 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:38:35.991996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:38:43.993255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:38:59.996416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:39:32.004514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:48:08.016694 3.002125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:48:15.024711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:48:23.025783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:48:39.029407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:49:11.035624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:55:15.041715 3.001471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 07:55:22.048752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:55:30.050168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:55:46.053333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:56:18.058942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 07:58:21.276428 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 07:58:21.276601 0.039906 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:21.316848 0.182057 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:21.499235 0.126155 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:21.625807 0.064650 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:21.691094 0.097057 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:21.788611 0.000000 udp 10.0.2.105 7010 -> 79.21.5.110 7032 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 07:58:38.042698 0.055348 tcp 10.0.2.105 57303 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:58:38.098304 0.053271 tcp 10.0.2.105 57304 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:58:38.151804 0.160887 tcp 10.0.2.105 57305 -> 195.113.214.236 443 SRPA* 0 0 22 12490 flow=From-Botnet-V2-TCP-Established 1970/01/24 07:58:38.313348 0.059003 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:38.372751 0.330162 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:38.703298 0.172855 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:38.876643 0.136811 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.013830 0.175063 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.189306 0.144685 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.334386 0.064126 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.398897 0.165781 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.565087 0.061220 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.626645 0.208293 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.835328 0.146969 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:39.982643 0.144882 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:40.127933 0.222714 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:40.351014 0.077358 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:40.428696 0.171068 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:40.600088 0.874924 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.475389 0.078437 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.554202 0.057340 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.611911 0.168502 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.780804 0.057532 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.838726 0.137675 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:41.977003 0.145070 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:58:42.122468 0.387224 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/24 07:59:20.061451 0.958475 tcp 10.0.2.105 57306 -> 128.255.183.224 9027 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:02:22.065675 3.001245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 08:02:29.073057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:02:37.073983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:02:53.076942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:03:25.083350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:09:29.088979 3.002007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:09:36.096293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:09:44.098010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:10:00.101255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:10:32.106913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:16:36.113915 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:16:43.120721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:16:51.121924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:17:07.124766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:17:39.130953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:23:43.136426 3.002568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:23:50.144136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:23:58.145722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:24:14.148917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:24:46.154864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:28:53.520910 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 08:28:53.521081 0.080513 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:53.602032 0.044602 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:53.646993 0.082707 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:53.730112 0.411126 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.141634 0.179633 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.321741 0.062483 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.384616 0.057960 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.442937 0.138773 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.582155 0.178204 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.760746 0.150851 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:54.911996 0.447168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:55.359579 0.171043 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:55.531041 0.107697 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:55.639135 0.165598 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:55.805144 0.041836 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:55.847393 0.209683 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.057490 0.145556 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.203419 0.144432 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.348229 0.208814 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.557466 0.075954 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.633793 0.234181 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:56.868420 0.956499 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:57.825353 0.073875 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:57.899605 0.059445 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:57.959467 0.150321 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:58.110177 0.057416 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:58.167941 0.137782 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:58.306127 0.144358 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:28:58.450839 0.860053 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:29:21.020647 0.976916 tcp 10.0.2.105 57307 -> 128.255.183.224 9027 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:30:50.160502 3.002628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:30:57.168222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:31:05.169933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:31:21.173448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:31:53.178855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:37:57.185399 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:38:04.193265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:38:12.193743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:38:28.197259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:39:00.202963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:47:52.211046 3.001270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:47:59.217607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:48:07.219622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:48:23.222481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:48:55.228455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:54:59.234466 3.002086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 08:55:06.241684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:55:14.243470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:55:30.246976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:56:02.253011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 08:59:16.141893 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 08:59:16.142041 0.088146 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:16.230583 0.153605 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:16.384759 0.178468 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:16.563671 0.000000 udp 10.0.2.105 7010 -> 79.21.5.110 7032 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 08:59:22.001858 0.921073 tcp 10.0.2.105 57308 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:59:35.019642 0.055708 tcp 10.0.2.105 57309 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:59:35.075597 0.071256 tcp 10.0.2.105 57310 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:59:35.147124 0.113011 tcp 10.0.2.105 57311 -> 195.113.214.236 443 SRPA* 0 0 38 27081 flow=From-Botnet-V2-TCP-Established 1970/01/24 08:59:35.260816 0.045174 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.306336 0.059681 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.366395 0.058470 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.425221 0.137119 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.562742 0.182188 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.745339 0.144978 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:35.890701 0.345851 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:36.236972 0.167359 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:36.404758 0.065420 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:36.470467 0.165057 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:36.635959 0.315770 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:36.952095 0.199807 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.152285 0.152549 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.305191 0.142506 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.448075 0.170304 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.618790 0.222971 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.842229 0.074805 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:37.917433 0.247257 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.165069 0.076674 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.242174 0.057717 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.300225 0.141626 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.442233 0.057542 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.500168 0.145107 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.645680 0.143088 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 08:59:38.789169 0.436887 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:02:06.258676 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:02:13.266100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:02:21.267184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:02:37.270601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:03:09.275934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:09:13.281912 3.002319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:09:20.289557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:09:28.291117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:09:44.294243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:10:16.300427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:16:20.310279 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:16:27.314905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:16:35.321900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:16:51.321847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:17:23.324241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:23:27.330441 3.001233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:23:34.337501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:23:42.339092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:23:58.342263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:24:30.347925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:29:22.929311 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 09:29:22.929457 1.015928 tcp 10.0.2.105 57312 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/24 09:29:44.450104 0.073121 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:44.523672 0.081898 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:44.606016 0.233532 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:44.839938 0.179362 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.019672 0.044309 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.064541 0.056904 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.121838 0.183285 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.305535 0.143258 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.449181 0.329874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.779507 0.057664 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.837557 0.135848 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:45.973817 1.975024 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:47.949210 0.064241 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.013869 0.167203 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.181439 0.052443 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.234259 0.208056 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.442745 0.148783 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.591980 0.143742 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.736711 0.170592 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:29:48.907724 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 09:29:49.066514 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 09:30:06.452877 0.051336 tcp 10.0.2.105 57313 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 09:30:06.504525 0.049037 tcp 10.0.2.105 57314 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 09:30:06.553866 0.147551 tcp 10.0.2.105 57315 -> 195.113.214.236 443 SRPA* 0 0 63 41459 flow=From-Botnet-V2-TCP-Established 1970/01/24 09:30:06.701591 0.072974 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:06.774963 0.246100 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.021454 0.078769 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.100618 0.057448 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.158487 0.151613 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.310492 0.143149 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.454016 0.294679 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.749081 0.143528 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:07.892981 0.088594 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/24 09:30:34.354210 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 09:30:41.361532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:30:49.366726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:31:05.368959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:31:37.372066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:37:41.383059 3.005891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:37:48.386621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:37:56.386855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:38:12.391873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:38:44.395906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:47:44.405442 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:47:51.413226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:47:59.414025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:48:15.416945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:48:47.423209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:54:51.429236 3.001599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 09:54:58.436436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:55:06.438065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:55:22.441539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:55:54.447254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 09:59:23.948743 0.000176 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 09:59:23.949029 0.970385 tcp 10.0.2.105 57316 -> 128.255.183.224 9027 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/01/24 10:00:37.099096 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 10:00:37.099279 0.221808 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.321538 0.089756 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.411710 0.121505 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.533587 0.180916 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.714891 0.045600 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.760884 0.059918 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:37.821111 0.182168 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.003623 0.073545 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.077534 0.138420 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.216358 0.328684 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.545457 0.141915 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.687770 0.054615 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.742776 0.164364 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.907527 0.046495 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:38.954404 0.064850 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.019671 0.170698 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.190754 0.171567 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.362714 0.208156 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.571232 0.143870 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.715460 0.144905 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.860753 0.079210 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:39.940577 0.789639 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:40.730636 0.085812 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:40.816779 0.060937 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:40.878064 0.144849 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:41.023336 0.159411 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:41.183138 0.057984 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:41.241488 0.147890 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:00:41.389717 0.768347 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:01:58.455383 3.005743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 10:02:05.461957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:02:13.462204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:02:29.465280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:03:01.471086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:09:05.476059 3.002559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:09:12.484603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:09:20.486114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:09:36.488956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:10:08.494964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:16:12.500545 3.002240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:16:19.507773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:16:27.510034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:16:43.512823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:17:15.518857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:23:19.524767 3.001836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:23:26.532258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:23:34.533964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:23:50.536958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:24:22.542715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:29:24.918245 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 10:29:24.918427 0.967045 tcp 10.0.2.105 57317 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/24 10:30:26.569293 2.981411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:30:33.556910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:30:41.557829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:30:44.732964 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 10:30:44.733051 0.222721 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:44.956356 0.081874 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.038645 0.121342 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.160530 0.179099 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.340023 0.039729 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.380121 0.058950 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.439414 0.185103 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.624870 0.072864 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.698100 0.138319 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:45.836742 0.348232 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.185331 0.148134 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.333870 0.053735 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.387985 0.167190 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.555473 0.045946 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.601830 0.063456 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.665645 0.166847 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:46.832912 0.171390 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.004684 0.146065 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.151144 0.072860 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.224579 0.208267 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.433256 0.146963 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.580576 0.246948 udp 10.0.2.105 7010 <-> 68.20.50.206 6568 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.827928 0.079552 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.907900 0.062838 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:47.971114 0.144786 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:48.116274 0.141131 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:48.257781 0.056557 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:48.314763 0.139264 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:48.454408 0.967514 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 10:30:57.561120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:31:29.566602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:37:33.572935 3.002656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:37:40.579786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:37:48.582039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:38:04.584191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:38:36.590876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:47:37.601534 3.001800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:47:44.608813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:47:52.610258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:48:08.613352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:48:40.618711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:54:44.625402 3.001715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 10:54:51.633032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:54:59.634090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:55:15.637089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:55:47.643195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 10:59:25.887461 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 10:59:25.887560 0.949294 tcp 10.0.2.105 57318 -> 128.255.183.224 9027 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:00:55.626520 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 11:00:55.626706 0.120653 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:55.747759 0.181195 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:55.929340 0.039582 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:55.969270 0.235378 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.205048 0.083322 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.288757 0.061181 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.350330 0.183530 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.534226 0.080569 udp 10.0.2.105 7010 <-> 79.21.5.110 7032 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.615143 0.140411 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:56.755975 0.325993 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.082377 0.145724 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.228447 0.054540 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.283312 0.166972 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.450650 0.045553 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.496662 0.064432 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.561399 0.186376 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.748160 0.171267 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:57.919750 0.146041 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:58.066117 0.075402 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:58.141910 0.209105 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:58.351353 0.147665 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:00:58.499399 0.000000 udp 10.0.2.105 7010 -> 68.20.50.206 6568 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 11:01:13.914291 0.054844 tcp 10.0.2.105 57319 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:01:13.969379 0.051851 tcp 10.0.2.105 57320 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:01:14.021464 0.111303 tcp 10.0.2.105 57321 -> 195.113.214.236 443 SRPA* 0 0 64 41667 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:01:14.133709 0.068680 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.202729 0.057852 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.260933 0.144912 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.406203 0.143916 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.550490 0.058033 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.608908 0.139316 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:14.748608 0.757104 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:01:51.649407 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 11:01:58.656821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:02:06.657974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:02:22.661211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:02:54.667562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:08:58.673511 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:09:05.680807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:09:13.682576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:09:29.685061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:10:01.690961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:16:05.699274 2.999491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:16:12.707207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:16:20.706301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:16:36.709013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:17:08.715313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:23:12.721090 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:23:19.730283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:23:27.730674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:23:43.733643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:24:15.739212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:29:26.837281 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 11:29:26.837486 0.973842 tcp 10.0.2.105 57322 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:30:19.746140 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:30:26.756200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:30:34.758888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:30:50.756988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:31:22.763271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:31:45.085694 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 11:31:45.085928 0.000000 udp 10.0.2.105 7010 -> 68.20.50.206 6568 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 11:32:01.600153 0.054042 tcp 10.0.2.105 57323 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:01.654460 0.054814 tcp 10.0.2.105 57324 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:01.709633 0.140936 tcp 10.0.2.105 57325 -> 195.113.214.236 443 SRPA* 0 0 21 13038 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:01.851298 0.180139 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.031811 0.039532 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.071716 0.209950 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.282031 0.078671 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.361040 0.059930 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.421303 0.120555 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.542186 0.140790 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:02.683385 0.328456 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:03.012239 0.188119 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:03.200745 0.052396 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:03.253564 0.158217 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:03.412161 0.000000 udp 10.0.2.105 7010 -> 79.21.5.110 7032 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 11:32:19.304891 0.053105 tcp 10.0.2.105 57326 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:19.358317 0.059756 tcp 10.0.2.105 57327 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:19.418342 0.131441 tcp 10.0.2.105 57328 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:19.550297 0.165984 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:19.716638 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 11:32:36.599785 0.115540 tcp 10.0.2.105 57329 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:36.715620 0.053554 tcp 10.0.2.105 57330 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:36.769487 0.141267 tcp 10.0.2.105 57331 -> 195.113.214.236 443 SRPA* 0 0 42 22292 flow=From-Botnet-V2-TCP-Established 1970/01/24 11:32:36.911307 0.170611 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.082298 0.144575 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.227250 0.079831 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.307531 0.200218 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.508130 0.065990 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.574522 0.043559 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.618476 0.146805 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.765645 0.072474 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.838476 0.060989 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.899843 0.058400 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:37.958594 0.141929 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:38.100929 0.137591 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:38.239059 0.146932 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:32:38.386385 0.808317 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/24 11:37:26.777286 2.996172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 11:37:33.776399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:37:41.778148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:37:57.781202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:38:29.787039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:47:31.800903 2.999674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:47:38.806615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:47:46.807963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:48:02.811550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:48:34.819522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:54:38.823202 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 11:54:45.830065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:54:53.831948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:55:09.835251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:55:41.840822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 11:59:27.816654 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 11:59:27.816823 0.943651 tcp 10.0.2.105 57332 -> 128.255.183.224 9027 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:01:45.846581 3.002325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:01:52.854293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:02:00.856462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:02:16.859020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:02:48.865610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:03:07.682118 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 12:03:07.682270 0.000000 udp 10.0.2.105 7010 -> 79.21.5.110 7032 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 12:03:26.660918 0.052913 tcp 10.0.2.105 57333 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:26.714075 0.032119 tcp 10.0.2.105 57334 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:26.746422 0.125756 tcp 10.0.2.105 57335 -> 195.113.214.236 443 SRPA* 0 0 58 51793 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:26.872863 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 12:03:44.835972 0.054686 tcp 10.0.2.105 57336 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:44.890875 0.031800 tcp 10.0.2.105 57337 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:44.922924 0.147160 tcp 10.0.2.105 57338 -> 195.113.214.236 443 SRPA* 0 0 25 13916 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:03:45.070593 0.227609 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.298578 0.038939 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.337884 0.179606 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.517905 0.088352 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.606615 0.121589 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.728571 0.174329 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.903258 0.053761 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:45.957421 0.373513 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:46.331347 0.061320 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:46.393071 0.136606 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:46.530022 0.141594 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:46.672013 0.165495 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:46.837897 0.170700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.008955 0.145421 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.154761 0.076606 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.231810 0.211427 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.443579 0.064997 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.508907 0.322303 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.831666 0.146561 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:47.978617 0.068970 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.047984 0.060583 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.108946 0.056595 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.165953 0.143763 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.310126 0.137931 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.448612 0.143771 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:03:48.592735 0.161970 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:08:52.870920 3.002349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 12:08:59.878672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:09:07.879718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:09:23.883259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:09:55.888848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:15:59.894720 3.003511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:16:06.902320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:16:14.903567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:16:30.906668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:17:02.913191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:23:06.918936 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:23:13.926234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:23:21.928982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:23:37.930587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:24:09.936798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:29:28.766072 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 12:29:28.766259 0.951718 tcp 10.0.2.105 57339 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:30:13.943299 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:30:20.950503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:30:28.951649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:30:44.966597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:31:16.961218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:34:00.455544 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 12:34:00.455622 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 12:34:17.202088 0.053342 tcp 10.0.2.105 57340 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:17.255692 0.053424 tcp 10.0.2.105 57341 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:17.309372 0.143995 tcp 10.0.2.105 57342 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:17.453851 0.039966 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:17.494136 0.178571 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:17.673085 0.074848 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:17.748336 0.124312 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:17.873040 0.183525 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:18.056953 0.058253 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:18.115563 0.325798 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:18.441738 0.060066 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:18.502161 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 12:34:34.084655 0.052629 tcp 10.0.2.105 57343 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:34.137576 0.055306 tcp 10.0.2.105 57344 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:34.193181 0.147583 tcp 10.0.2.105 57345 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/24 12:34:34.341283 0.142247 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:34.501280 0.166546 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:34.668274 0.170098 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:34.838814 0.145696 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:34.984893 0.072232 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.057542 0.209273 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.267197 0.063915 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.331477 0.334458 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.666374 0.148158 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.814970 0.072879 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.888250 0.060771 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:35.949426 0.055909 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:36.005768 0.145570 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:36.151823 0.452049 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:36.604424 0.137812 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:34:36.742605 0.140751 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 12:37:20.966725 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 12:37:27.974220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:37:35.975718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:37:51.981205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:38:23.984950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:47:25.997574 3.001052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:47:33.003965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:47:41.005660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:47:57.008697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:48:29.017313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:54:33.020508 3.002536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 12:54:40.028092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:54:48.030121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:55:04.032733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:55:36.044207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 12:59:29.729700 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 12:59:29.729910 0.966469 tcp 10.0.2.105 57346 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:01:40.044819 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:01:47.052665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:01:55.053505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:02:11.058414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:02:43.062800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:04:37.988179 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:04:37.988389 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:04:55.194694 0.053860 tcp 10.0.2.105 57347 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:04:55.248783 0.053675 tcp 10.0.2.105 57348 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:04:55.302730 0.143622 tcp 10.0.2.105 57349 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:04:55.446873 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:13.179789 0.053445 tcp 10.0.2.105 57350 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:05:13.233476 0.052258 tcp 10.0.2.105 57351 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:05:13.285987 0.149315 tcp 10.0.2.105 57352 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:05:13.435848 4.145158 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 935 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:13.520016 3.539100 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1246 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:13.640886 3.459960 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1049 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:13.680285 3.463871 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 4 1168 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:13.731831 3.596061 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 972 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:13.912035 3.593636 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 4 1073 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:14.093495 3.816193 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1169 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:14.480544 3.481702 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1261 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:14.541451 3.569875 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 4 1291 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:14.685351 3.592430 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1080 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:14.853887 3.593763 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1295 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.025017 3.566601 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 4 1082 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.167323 3.490722 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 4 1197 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.237282 3.630599 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 4 1140 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.445514 3.484205 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 4 1124 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.509933 3.677741 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 1062 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.566266 3.765128 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 4 1120 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.710766 3.684863 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 4 1123 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.780000 3.674118 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 4 1088 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.836072 3.667502 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1060 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:15.895616 3.755384 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1266 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:16.042322 3.749464 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 4 1118 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:16.187490 4.498344 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 4 1149 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:16.781775 3.155805 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1235 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:05:20.686504 0.000000 udp 10.0.2.105 7010 -> 92.77.240.246 5042 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:26.457394 0.000000 udp 10.0.2.105 7010 -> 70.166.32.12 3590 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:31.625073 0.000000 udp 10.0.2.105 7010 -> 46.18.120.19 7370 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:38.364483 0.102511 udp 10.0.2.105 7010 -> 176.221.130.44 5152 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:38.466994 0.000000 icmp 176.221.130.44 0x0303 -> 10.0.2.105 0x2014 URP 192 1 258 flow=Background 1970/01/24 13:05:43.061307 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:05:45.334823 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:52.074423 0.000000 udp 10.0.2.105 7010 -> 196.47.160.253 1386 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:05:58.533375 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:04.642308 0.000000 udp 10.0.2.105 7010 -> 67.134.193.3 5448 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:09.559016 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:06:10.090362 0.000000 udp 10.0.2.105 7010 -> 62.94.88.242 6977 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:18.452407 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:24.060472 0.000000 udp 10.0.2.105 7010 -> 201.102.76.225 8498 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:32.633289 0.000000 udp 10.0.2.105 7010 -> 50.65.72.230 9941 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:37.559496 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:06:41.205166 0.000000 udp 10.0.2.105 7010 -> 64.229.176.88 3250 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:47.794729 0.000000 udp 10.0.2.105 7010 -> 91.66.36.140 5027 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:06:56.397162 0.000000 udp 10.0.2.105 7010 -> 93.148.161.61 5700 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:02.876859 0.386573 udp 10.0.2.105 7010 -> 120.151.43.201 4489 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:03.263432 0.000000 icmp 120.151.43.201 0x0303 -> 10.0.2.105 0x8911 URP 192 1 213 flow=Background 1970/01/24 13:07:07.562943 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:07:10.467085 0.000000 udp 10.0.2.105 7010 -> 41.105.81.213 9937 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:17.397309 0.000000 udp 10.0.2.105 7010 -> 115.134.158.102 6504 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:25.528958 0.000000 udp 10.0.2.105 7010 -> 151.200.192.187 1779 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:32.799651 0.000000 udp 10.0.2.105 7010 -> 190.212.234.18 6838 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:37.556070 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:07:38.187147 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:45.437393 0.000000 udp 10.0.2.105 7010 -> 49.206.16.181 4119 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:52.417425 0.000000 udp 10.0.2.105 7010 -> 173.165.66.129 1801 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:07:57.805341 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:02.561854 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:08:06.678017 0.000000 udp 10.0.2.105 7010 -> 94.34.150.216 9141 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:12.256163 0.000000 udp 10.0.2.105 7010 -> 68.60.75.213 6599 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:17.403451 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:26.196080 0.046557 udp 10.0.2.105 7010 <-> 84.174.94.213 6671 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:08:26.260759 0.000000 udp 10.0.2.105 7010 -> 24.32.240.41 3571 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:31.062933 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:08:33.356392 0.000000 udp 10.0.2.105 7010 -> 65.47.92.78 6109 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:42.149105 0.000000 udp 10.0.2.105 7010 -> 79.35.241.54 2391 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:47.068469 3.001825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 13:08:48.267772 0.000000 udp 10.0.2.105 7010 -> 92.8.159.251 8563 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:08:54.075870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:08:55.347789 0.170989 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:08:55.538366 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:00.064779 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:09:00.975982 0.032351 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:09:01.023997 0.000000 udp 10.0.2.105 7010 -> 67.167.205.196 9416 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:02.077391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:09:08.717207 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:17.469143 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:18.080687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:09:23.318823 0.177487 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:09:23.516355 0.058122 udp 10.0.2.105 7010 <-> 94.137.168.16 8509 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:09:23.587087 0.000000 udp 10.0.2.105 7010 -> 86.180.55.222 8180 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:28.055080 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:09:30.068195 0.352771 udp 10.0.2.105 7010 <-> 119.120.105.254 1350 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:09:30.434568 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:36.346862 0.000000 udp 10.0.2.105 7010 -> 79.44.114.209 5643 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:44.158370 0.000000 udp 10.0.2.105 7010 -> 208.105.98.196 8649 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:49.445750 0.094592 udp 10.0.2.105 7010 -> 95.245.228.110 2254 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:09:49.540342 0.000000 icmp 95.245.228.110 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 194 flow=Background 1970/01/24 13:09:50.086764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:09:54.062106 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:09:58.027878 0.000000 udp 10.0.2.105 7010 -> 111.89.94.37 9286 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:04.838056 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:10.195289 0.000000 udp 10.0.2.105 7010 -> 186.6.14.232 3659 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:18.627599 0.000000 udp 10.0.2.105 7010 -> 2.228.156.203 9167 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:23.564548 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:10:26.769812 0.000000 udp 10.0.2.105 7010 -> 182.178.77.156 3709 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:33.559145 0.000000 udp 10.0.2.105 7010 -> 208.124.117.254 6762 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:39.979280 0.000000 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:48.000350 0.100387 udp 10.0.2.105 7010 -> 95.8.190.130 8990 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:10:48.100737 0.000000 icmp 95.8.190.130 0x0303 -> 10.0.2.105 0x1e23 URP 192 1 328 flow=Background 1970/01/24 13:10:52.556186 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:10:56.352008 0.000000 udp 10.0.2.105 7010 -> 64.141.144.2 7025 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:02.661081 0.000000 udp 10.0.2.105 7010 -> 95.245.48.1 5580 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:08.329186 0.000000 udp 10.0.2.105 7010 -> 87.188.160.57 3885 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:15.409198 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:20.055837 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:11:21.487895 0.140870 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:11:21.672906 0.000000 udp 10.0.2.105 7010 -> 94.172.234.145 8741 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:27.707310 0.000000 udp 10.0.2.105 7010 -> 88.12.41.15 8741 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:35.628799 0.000000 udp 10.0.2.105 7010 -> 81.148.248.47 8818 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:43.589910 0.000000 udp 10.0.2.105 7010 -> 201.230.205.207 1055 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:48.556643 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:11:49.598840 0.000000 udp 10.0.2.105 7010 -> 50.84.63.126 9414 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:11:56.358073 0.000000 udp 10.0.2.105 7010 -> 173.162.169.249 1833 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:04.509352 0.000000 udp 10.0.2.105 7010 -> 82.19.181.120 7823 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:11.599723 0.000000 udp 10.0.2.105 7010 -> 176.240.42.21 8513 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:16.556645 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:12:18.599487 0.000000 udp 10.0.2.105 7010 -> 173.9.47.141 5827 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:27.513246 0.000000 udp 10.0.2.105 7010 -> 216.43.174.194 9625 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:32.564469 0.140938 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:12:32.727033 0.182037 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:12:32.952986 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:38.418778 0.000000 udp 10.0.2.105 7010 -> 67.240.9.157 7236 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:43.055138 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:12:47.081221 0.175534 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:12:47.269582 0.000000 udp 10.0.2.105 7010 -> 96.37.142.174 7681 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:12:53.730840 0.000000 udp 10.0.2.105 7010 -> 87.194.137.29 4226 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:02.353448 0.176259 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:02.529707 0.000000 icmp 187.162.38.22 0x0303 -> 10.0.2.105 0x6704 URP 192 1 223 flow=Background 1970/01/24 13:13:07.059553 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:13:09.573278 0.000000 udp 10.0.2.105 7010 -> 203.88.141.37 7265 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:18.009202 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:26.648088 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:31.555207 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:13:33.077178 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:40.882307 0.000000 udp 10.0.2.105 7010 -> 94.94.96.81 2651 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:46.166498 0.000000 udp 10.0.2.105 7010 -> 72.38.201.14 3738 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:53.296681 0.000000 udp 10.0.2.105 7010 -> 121.97.49.118 4252 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:13:58.063388 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:13:58.874110 0.000000 udp 10.0.2.105 7010 -> 72.24.132.199 5397 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:07.466303 0.104736 udp 10.0.2.105 7010 <-> 95.247.213.229 2203 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:14:07.650325 0.000000 udp 10.0.2.105 7010 -> 72.39.4.50 2421 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:16.529904 0.178977 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:14:16.919225 0.178510 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:14:17.256533 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:22.059993 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:14:23.293072 0.000000 udp 10.0.2.105 7010 -> 94.2.238.193 8494 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:28.416812 0.168432 udp 10.0.2.105 7010 <-> 130.184.163.76 2702 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:14:28.618148 0.057070 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:14:28.714378 0.000000 udp 10.0.2.105 7010 -> 88.78.88.128 7455 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:35.117232 0.000000 udp 10.0.2.105 7010 -> 216.237.0.211 9106 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:41.125253 0.000000 udp 10.0.2.105 7010 -> 79.166.69.137 7669 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:46.062126 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:14:46.923482 0.000000 udp 10.0.2.105 7010 -> 142.59.160.98 4949 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:14:55.816384 0.000000 udp 10.0.2.105 7010 -> 108.205.242.54 8109 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:15:01.974895 0.000000 udp 10.0.2.105 7010 -> 92.196.120.29 1159 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:15:54.096826 3.000318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 13:16:01.103475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:16:09.110445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:16:25.104223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:16:57.110973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:23:01.117205 3.124107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:23:08.213724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:23:16.151283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:23:32.138683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:24:04.144224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:29:30.694416 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:29:30.694595 1.006741 tcp 10.0.2.105 57353 -> 128.255.183.224 9027 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:30:08.149905 3.002545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:30:15.158980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:30:23.159435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:30:39.162690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:31:11.168405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:37:15.175337 3.000480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:37:22.182036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:37:30.193344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:37:46.196473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:38:18.202610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:44:22.208350 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:44:29.215859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:44:37.217278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:44:53.220285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:45:16.464054 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:45:16.464299 0.129588 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:16.594280 0.045287 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:16.639904 0.052134 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:16.692425 0.174851 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:16.867946 0.180794 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.049080 0.071509 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.120947 0.329635 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.450988 0.059312 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.510659 0.144310 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.655379 0.164679 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.820465 0.171284 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:17.992186 0.140361 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.132989 0.075132 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.208612 0.210229 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.419223 0.066510 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.486137 0.178534 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.665064 0.145909 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.811377 0.072742 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.884498 0.061221 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:18.946085 0.059866 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:19.006286 0.145430 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:19.152045 0.141561 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:19.293974 0.144913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:19.439271 0.823150 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:20.262840 0.000000 udp 10.0.2.105 7010 -> 84.174.94.213 6671 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:45:25.226609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:45:35.963867 0.030694 tcp 10.0.2.105 57354 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:35.994832 0.030973 tcp 10.0.2.105 57355 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:36.026058 0.123569 tcp 10.0.2.105 57356 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:36.150220 0.168578 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:36.319169 0.029862 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:36.349306 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:45:55.260779 0.030558 tcp 10.0.2.105 57357 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:55.291561 0.031278 tcp 10.0.2.105 57358 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:55.323088 0.123069 tcp 10.0.2.105 57359 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:45:55.446640 0.179228 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:55.626271 0.264699 udp 10.0.2.105 7010 <-> 119.120.105.254 1350 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:55.891338 0.139716 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:56.031498 0.327928 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:56.359841 0.180437 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:56.540693 0.368266 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:45:56.909405 0.000000 udp 10.0.2.105 7010 -> 95.247.213.229 2203 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:46:13.265718 0.030669 tcp 10.0.2.105 57360 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:13.296584 0.030836 tcp 10.0.2.105 57361 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:13.327687 0.121694 tcp 10.0.2.105 57362 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:13.449876 0.188605 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:46:13.638893 0.149402 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:46:13.788677 0.000000 udp 10.0.2.105 7010 -> 130.184.163.76 2702 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 13:46:30.791683 0.030029 tcp 10.0.2.105 57363 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:30.821902 0.030863 tcp 10.0.2.105 57364 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:30.852933 0.121453 tcp 10.0.2.105 57365 -> 195.113.214.236 443 SRPA* 0 0 38 21720 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:46:30.974877 0.057721 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/24 13:51:29.232895 3.001011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 13:51:36.239576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:51:44.241497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:52:00.244147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:52:32.251196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:58:40.267640 2.998394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 13:58:47.269895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:58:55.273413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:59:11.275877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 13:59:31.703773 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 13:59:31.703938 0.966040 tcp 10.0.2.105 57366 -> 128.255.183.224 9027 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/24 13:59:43.280672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:05:47.285933 3.001658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:05:54.293252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:06:02.295140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:06:18.297913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:06:50.314240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:12:54.319481 3.002203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:13:01.327435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:13:09.333532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:13:25.331998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:13:57.337894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:16:36.719946 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 14:16:36.720048 0.000000 udp 10.0.2.105 7010 -> 84.174.94.213 6671 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 14:16:55.249184 0.031054 tcp 10.0.2.105 57367 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:16:55.280528 0.030824 tcp 10.0.2.105 57368 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:16:55.311673 0.120445 tcp 10.0.2.105 57369 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:16:55.433026 0.000000 udp 10.0.2.105 7010 -> 94.137.168.16 8509 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 14:17:11.227330 0.030054 tcp 10.0.2.105 57370 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:11.257665 0.032016 tcp 10.0.2.105 57371 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:11.289941 0.120099 tcp 10.0.2.105 57372 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:11.410574 0.000000 udp 10.0.2.105 7010 -> 95.247.213.229 2203 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 14:17:27.942529 0.030029 tcp 10.0.2.105 57373 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:27.972822 0.030543 tcp 10.0.2.105 57374 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:28.003611 0.125964 tcp 10.0.2.105 57375 -> 195.113.214.236 443 SRPA* 0 0 33 19154 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:28.130155 0.000000 udp 10.0.2.105 7010 -> 130.184.163.76 2702 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 14:17:47.031817 0.030460 tcp 10.0.2.105 57376 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:47.062600 0.031340 tcp 10.0.2.105 57377 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:47.094307 0.149214 tcp 10.0.2.105 57378 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:17:47.243961 0.040504 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.284868 0.120217 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.405460 0.054733 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.473281 0.181632 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.655339 0.179216 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.834958 0.073772 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:47.909181 0.166473 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:48.076076 0.144693 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:48.221129 0.360726 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:48.582296 0.059573 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:48.642304 0.172316 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:48.815026 0.220648 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.036077 0.069461 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.105940 0.142643 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.248988 0.043880 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.293275 0.083385 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.377043 0.057369 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.434781 0.057652 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.492804 0.072165 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.565350 0.145784 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.711562 0.146940 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:49.858900 0.144223 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:50.003570 0.144720 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:50.148714 0.889820 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.038900 0.162369 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.201735 0.029222 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.231358 0.190511 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.422260 0.264801 udp 10.0.2.105 7010 <-> 119.120.105.254 1350 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.687455 0.138943 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:51.826771 0.179062 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:52.006203 0.148129 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:52.154719 0.171946 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:52.327118 0.184547 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:52.512066 0.150968 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:17:52.663415 0.056593 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:20:01.344999 3.000555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 14:20:08.351461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:20:16.352694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:20:32.355939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:21:04.372819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:27:08.378752 3.002910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:27:15.385362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:27:23.386606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:27:39.389721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:28:11.395777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:29:32.673376 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 14:29:32.673491 0.951451 tcp 10.0.2.105 57379 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:34:15.401716 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:34:22.409303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:34:30.418471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:34:46.414678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:35:18.419838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:41:22.425643 3.001939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:41:29.433250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:41:37.434283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:41:53.438086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:42:25.443323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:48:01.747673 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 14:48:01.747849 0.049142 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:01.797376 0.182114 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:01.979918 0.178332 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.158650 0.081628 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.240624 0.165483 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.406512 0.145183 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.552061 0.121897 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.674338 0.052229 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:02.726926 0.355234 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.082546 0.060130 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.143038 0.170109 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.313573 0.223984 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.537926 0.072748 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.611056 0.139161 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.750613 0.146412 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.897440 0.068226 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:03.966064 0.053062 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.019477 0.059963 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.079800 0.070370 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.150529 0.144256 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.295196 0.142377 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.437944 0.143618 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.581982 0.137855 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.720348 0.028960 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:04.749615 0.955427 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:05.705498 0.164509 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:05.870400 0.180723 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:06.051481 0.394719 udp 10.0.2.105 7010 <-> 119.120.105.254 1350 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:06.446577 0.139539 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:06.586474 0.180431 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:06.767304 0.145229 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:06.912885 0.171165 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:07.084598 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 14:48:22.891444 0.052835 tcp 10.0.2.105 57380 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:48:22.944484 0.053223 tcp 10.0.2.105 57381 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:48:22.998053 0.143388 tcp 10.0.2.105 57382 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/24 14:48:23.141971 0.184633 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:48:23.327019 0.150040 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/24 14:49:35.454796 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:49:42.463135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:49:50.463487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:50:06.466843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:50:38.473100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:56:52.486855 2.998885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 14:56:59.490569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:57:07.492074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:57:23.494831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:57:55.501088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 14:59:33.633149 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 14:59:33.633351 0.977431 tcp 10.0.2.105 57383 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:03:59.506326 3.002614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:04:06.514448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:04:14.516046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:04:30.518955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:05:02.524996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:11:06.530444 3.002514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:11:13.537986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:11:21.539834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:11:37.543206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:12:09.548783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:18:13.555685 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:18:20.562575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:18:28.563868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:18:40.043608 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 15:18:40.043713 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 15:18:44.566752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:18:57.997836 0.052666 tcp 10.0.2.105 57384 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:18:58.050805 0.054154 tcp 10.0.2.105 57385 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:18:58.105164 0.143586 tcp 10.0.2.105 57386 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:18:58.249447 0.041502 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:58.291362 0.078929 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:58.370606 0.167810 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:58.538784 0.152579 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:58.691743 0.175687 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:58.867862 0.180086 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.048365 0.330808 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.379565 0.058675 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.438558 0.046811 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.485723 0.120654 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.606746 0.068260 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.675390 0.141442 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.817267 0.042448 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:18:59.860111 0.215388 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.075890 0.170943 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.247184 0.056939 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.304653 0.068720 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.373729 0.145091 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.519220 0.187303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.706860 0.142960 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.850219 0.053506 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.904112 0.068639 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:00.973146 0.144820 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:01.118332 0.028410 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:01.147097 0.166612 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:01.314065 0.158193 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:01.472664 0.000000 udp 10.0.2.105 7010 -> 119.120.105.254 1350 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 15:19:16.573360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:19:17.414716 0.051163 tcp 10.0.2.105 57387 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:19:17.466167 0.052479 tcp 10.0.2.105 57388 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:19:17.518923 0.146322 tcp 10.0.2.105 57389 -> 195.113.214.236 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:19:17.665719 0.137509 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:17.803607 0.184949 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:17.988952 0.152477 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:18.141848 0.180019 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:18.322233 0.171785 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:18.494406 0.184827 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:19:18.679827 0.151455 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:25:20.579057 3.011529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:25:27.596785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:25:35.597884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:25:51.600951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:26:23.606719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:29:34.612104 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 15:29:34.612384 0.976989 tcp 10.0.2.105 57390 -> 128.255.183.224 9027 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:32:27.612670 3.002957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:32:34.620548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:32:42.621838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:32:58.629565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:33:30.630921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:39:34.636154 3.002567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:39:41.644119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:39:49.647380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:40:05.648895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:40:37.654734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:48:42.665713 3.003230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:48:49.672098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:48:57.675166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:49:13.677157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:49:38.613039 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 15:49:38.613244 0.254516 udp 10.0.2.105 7010 -> 119.120.105.254 1350 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 15:49:38.867760 0.000000 icmp 119.120.105.254 0x0303 -> 10.0.2.105 0x4605 URP 192 1 184 flow=Background 1970/01/24 15:49:45.683153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:49:55.048876 0.053403 tcp 10.0.2.105 57391 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:49:55.102553 0.053361 tcp 10.0.2.105 57392 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:49:55.156188 0.145868 tcp 10.0.2.105 57393 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/24 15:49:55.302566 0.040063 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:55.342963 0.075604 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:55.418992 0.181779 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:55.601266 0.178663 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:55.780498 0.330445 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.111395 0.167228 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.279052 0.145750 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.425183 0.121636 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.547186 0.076538 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.624368 0.142719 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.767504 0.046220 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.814299 0.047392 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.862068 0.060504 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:56.923102 0.170281 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.093784 0.062047 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.156193 0.071795 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.228619 0.223046 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.452395 0.141708 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.594484 0.053921 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.648917 0.065827 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.715140 0.151619 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.867137 0.027964 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:57.895456 0.166036 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.062203 0.141054 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.203663 0.145748 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.349839 0.157347 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.507602 0.144982 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.652979 0.181845 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.835236 0.138344 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:58.974186 0.189621 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:59.164431 0.151695 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:59.316552 0.171363 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:49:59.488800 0.185499 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 15:55:49.689385 3.001009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 15:55:56.696246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:56:04.697803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:56:20.700915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:56:52.707121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 15:59:35.591590 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 15:59:35.591773 0.971353 tcp 10.0.2.105 57394 -> 128.255.183.224 9027 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/01/24 16:02:56.712728 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:03:03.720182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:03:11.721895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:03:27.725457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:03:59.731294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:10:03.736966 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:10:10.744381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:10:18.745571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:10:34.748979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:11:06.754772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:17:10.760028 3.002721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:17:17.768162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:17:25.769850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:17:41.772853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:18:13.778811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:20:17.113006 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 16:20:17.113150 0.179638 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:17.293212 0.176597 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:17.470176 0.040758 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:17.511359 0.077632 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:17.589407 0.149778 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:17.739614 0.331634 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.071683 0.165353 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.237397 0.125791 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.363599 0.068468 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.432474 0.144175 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.577029 0.048971 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.626370 0.053674 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.680452 0.058367 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.739207 0.184405 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.924015 0.059568 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:18.983978 0.071739 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.056171 0.220833 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.277406 0.142287 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.420125 0.100330 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.520872 0.069050 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.590370 0.165568 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.756472 0.145594 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:19.902527 0.144754 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.047671 0.151664 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.199759 0.029973 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.230176 0.159503 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.390120 0.177066 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.567602 0.180586 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.748565 0.148634 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:20.897554 0.171800 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:21.069704 0.178646 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:21.248713 0.187323 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:20:21.436584 0.150800 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:24:17.784332 3.012181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:24:24.801872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:24:32.803607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:24:48.808778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:25:20.813315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:29:36.570639 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 16:29:36.570782 0.958620 tcp 10.0.2.105 57395 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/24 16:31:24.818694 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:31:31.829131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:31:39.827625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:31:55.830525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:32:27.837242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:38:31.842517 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:38:38.850049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:38:46.851546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:39:02.854736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:39:34.859954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:48:11.866176 3.003570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:48:18.873855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:48:26.876340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:48:42.878675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:49:14.886486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:50:39.026432 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 16:50:39.026522 0.188331 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:39.215210 0.075801 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:39.291366 0.150903 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:39.442710 0.328602 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:39.771718 0.168744 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:39.940886 0.120722 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.062019 0.178765 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.241216 0.040304 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.281893 0.071998 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.354271 0.142483 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.497144 0.047209 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.544686 0.049419 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.594393 0.059906 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.654672 0.171140 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.826150 0.057138 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.883669 0.073110 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:40.957158 0.221838 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.179376 0.144084 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.323805 0.057405 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.381557 0.072782 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.454731 0.171254 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.626379 0.145722 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.772565 0.145703 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:41.918684 0.144915 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.063959 0.029401 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.093720 0.157360 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.251426 0.138977 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.390768 0.172649 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.563816 0.180266 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.744718 0.172700 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:42.917895 0.181083 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:43.099373 0.167774 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:50:43.267698 0.149331 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/24 16:55:18.890416 3.002111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 16:55:25.898764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:55:33.899803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:55:49.903378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:56:21.908770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 16:59:37.530195 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 16:59:37.530384 0.967205 tcp 10.0.2.105 57396 -> 128.255.183.224 9027 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/24 17:02:28.918757 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:02:35.926992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:02:43.928034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:02:59.931193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:03:31.937194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:09:35.942693 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:09:42.950054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:09:50.951681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:10:06.954715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:10:38.960688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:16:42.967008 3.001844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:16:49.974069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:16:57.975982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:17:13.978189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:17:45.985079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:21:04.580684 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 17:21:04.580914 0.146871 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:04.728242 0.179996 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:04.908650 0.077519 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:04.986606 0.126920 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:05.113932 0.180052 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:05.294412 0.045157 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:05.339989 0.489656 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:05.830070 0.167151 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:05.997632 0.069750 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.067768 0.143083 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.211257 0.044216 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.255897 0.056676 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.312911 0.060684 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.374001 0.171501 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.545882 0.057520 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.603791 0.072258 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.676643 0.220964 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:06.898016 0.143105 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.041514 0.057413 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.099288 0.070179 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.169836 0.169940 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.340202 0.144833 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.485388 0.028821 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.514550 0.159752 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.674663 0.144084 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.819163 0.144382 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:07.963953 0.137496 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.101808 0.164329 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.266511 0.185241 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.452111 0.155143 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.607686 0.150307 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.758354 0.179527 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:21:08.938250 0.183470 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:23:49.992480 3.002606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:23:56.998095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:24:04.999470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:24:21.002639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:24:53.008704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:29:38.499309 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 17:29:38.499464 0.961575 tcp 10.0.2.105 57397 -> 128.255.183.224 9027 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/01/24 17:30:57.023242 2.993429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:31:04.022861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:31:12.023585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:31:28.026883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:32:00.033184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:38:04.043247 3.003220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:38:11.048533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:38:19.048928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:38:35.050637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:39:07.056656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:47:58.062776 3.001386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:48:05.069991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:48:13.071660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:48:29.074797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:49:01.080626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:51:24.397203 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 17:51:24.398141 0.079863 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:24.478371 0.120500 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:24.599196 0.179254 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:24.778827 0.040250 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:24.819466 0.173572 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:24.993414 0.175208 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.169013 0.329077 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.498458 0.166955 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.665822 0.074130 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.740342 0.142419 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.883150 0.047706 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.931252 0.055127 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:25.986708 0.059885 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.046961 0.171235 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.218612 0.060850 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.279819 0.069205 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.349357 0.221261 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.570975 0.144907 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.716420 0.055916 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.772675 0.077387 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:26.850433 0.164107 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.014944 0.144878 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.160446 0.028532 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.189302 0.158345 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.348069 0.146160 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.494603 0.146124 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.641069 0.133785 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.775259 0.184085 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:27.959687 0.150930 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:28.110977 0.179455 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:28.290817 0.189960 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:28.481170 0.178373 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:51:28.659940 0.837861 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/24 17:55:05.086213 3.002497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 17:55:12.094113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:55:20.098861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:55:36.098854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:56:08.104791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 17:59:39.469478 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 17:59:39.469693 0.994997 tcp 10.0.2.105 57398 -> 128.255.183.224 9027 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:02:14.113511 3.002262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:02:21.120798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:02:29.122364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:02:45.125846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:03:17.131663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:09:21.138823 3.000157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:09:28.149447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:09:36.146567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:09:52.149387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:10:24.155186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:16:28.165814 2.997412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:16:35.174894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:16:43.199373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:16:59.185517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:17:31.192024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:21:47.950050 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 18:21:47.950171 0.180624 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.131182 0.044580 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.176166 0.077717 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.254384 0.127808 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.382645 0.143722 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.526795 0.180624 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:48.707803 0.329841 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.038089 0.167575 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.206126 0.072754 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.279307 0.143017 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.422789 0.044640 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.467823 0.048687 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.516920 0.058814 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.576174 0.171779 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.748456 0.059187 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.808116 0.071750 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:49.880394 0.231999 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:50.112840 0.141536 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:50.254790 0.052690 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:50.307925 0.069692 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:21:50.378000 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 18:22:09.090921 0.051976 tcp 10.0.2.105 57399 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:22:09.143151 0.031752 tcp 10.0.2.105 57400 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:22:09.175179 0.100598 tcp 10.0.2.105 57401 -> 195.113.214.236 443 SRPA* 0 0 33 23891 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:22:09.276404 0.137671 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:09.414439 0.028658 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:09.443461 0.160166 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:09.604010 0.145223 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:09.749605 0.146872 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:09.896886 0.134254 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.031493 0.181296 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.213188 0.171620 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.385178 0.178990 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.564644 0.169992 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.735041 0.151252 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:22:10.886656 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 18:22:26.865684 0.051825 tcp 10.0.2.105 57402 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:22:26.917904 0.032564 tcp 10.0.2.105 57403 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:22:26.950711 0.124097 tcp 10.0.2.105 57404 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:23:35.195773 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 18:23:42.202866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:23:50.204231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:24:06.211794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:24:38.226497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:29:40.468495 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 18:29:40.468733 0.929911 tcp 10.0.2.105 57405 -> 128.255.183.224 9027 FSPA* 0 0 12 1450 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:30:42.220124 3.001150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:30:49.226813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:30:57.228187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:31:13.231353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:31:45.237474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:37:49.243598 3.001947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:37:56.251134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:38:04.252388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:38:20.255620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:38:52.261504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:47:50.266865 3.002120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:47:57.275712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:48:05.277367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:48:21.279332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:48:53.285415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:52:32.811465 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 18:52:32.811626 0.170504 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:32.982557 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 18:52:49.136413 0.031378 tcp 10.0.2.105 57406 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:52:49.168032 0.032099 tcp 10.0.2.105 57407 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:52:49.200336 0.122074 tcp 10.0.2.105 57408 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/24 18:52:49.322870 0.121970 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.445185 0.077988 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.523551 0.045753 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.569648 0.179330 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.749329 0.166081 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.915848 0.079112 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:49.995308 0.182056 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.177823 0.143690 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.321916 0.323563 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.645860 0.047684 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.693863 0.059511 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.753770 0.043634 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.797764 0.056589 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.854715 0.075416 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:50.930500 0.143570 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.074471 0.143123 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.217944 0.055701 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.273960 0.063044 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.337336 0.171882 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.509652 0.221326 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.731317 0.029848 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.761510 0.157751 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:51.919708 0.145331 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.065444 0.144916 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.210748 0.137282 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.348555 0.180692 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.529647 0.173574 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.703593 0.145217 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:52.849213 0.170924 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:53.020660 0.185411 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:52:53.206497 0.152292 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/24 18:54:57.291261 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 18:55:04.299033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:55:12.300874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:55:28.303554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:56:00.309423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 18:59:41.397644 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 18:59:41.397830 0.975191 tcp 10.0.2.105 57409 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/24 19:02:04.315846 3.001477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:02:11.323246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:02:19.324386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:02:35.328243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:03:07.333889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:09:11.339993 3.001053 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:09:18.347033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:09:26.348357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:09:42.351288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:10:14.357389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:16:18.367299 3.081177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:16:25.420104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:16:33.382639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:16:49.385178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:17:21.391396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:22:58.682927 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 19:22:58.683071 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 19:23:15.492390 0.053643 tcp 10.0.2.105 57410 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 19:23:15.546294 0.031806 tcp 10.0.2.105 57411 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 19:23:15.578396 0.124284 tcp 10.0.2.105 57412 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/24 19:23:15.703158 0.121979 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:15.825520 0.071508 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:15.897452 0.047241 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:15.945140 0.179909 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:16.125460 0.165549 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:16.291432 0.081311 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:16.373219 0.185311 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:16.558899 0.142219 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:16.701523 0.321050 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.022950 0.053364 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.076723 0.062300 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.139418 0.048149 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.187992 0.064269 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.252697 0.071894 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.324927 0.152109 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.477430 0.142274 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.620105 0.056221 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.676719 0.068843 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.745938 0.171947 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:17.918240 0.237979 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.156613 0.029119 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.186075 0.159802 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.346304 0.154670 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.501363 0.154559 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.656338 0.136230 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.793034 0.144651 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:18.938131 0.171256 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:19.109778 0.186408 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:19.296585 0.151449 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:19.448403 0.180288 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:19.629104 0.179607 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:23:25.397073 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:23:32.404931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:23:40.406311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:23:56.409187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:24:28.415215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:29:42.377228 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 19:29:42.377330 1.055711 tcp 10.0.2.105 57413 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/24 19:30:32.421273 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:30:39.428700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:30:47.430107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:31:03.437948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:31:35.439312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:37:39.445868 3.001098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:37:46.452826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:37:54.454095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:38:10.457399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:38:42.463369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:47:41.469809 3.003106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:47:48.478170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:47:56.479684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:48:12.482896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:48:44.488950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:53:23.380506 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 19:53:23.380675 0.164344 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:23.545351 0.046092 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:23.591776 0.178066 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:23.770241 0.121995 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:23.892672 0.077738 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:23.970811 0.167816 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.139047 0.067774 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.207207 0.186892 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.394439 0.147491 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.542339 0.327988 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.870742 0.049040 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.920189 0.059440 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:24.979985 0.043676 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.024023 0.059367 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.083756 0.078233 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.162377 0.155521 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.318277 0.140711 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.459373 0.056388 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.516139 0.070279 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.586776 0.170629 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.757777 0.223243 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:25.981407 0.029587 udp 10.0.2.105 7010 <-> 79.219.126.130 2430 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.011369 0.162538 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.174253 0.156061 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.330647 0.156166 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.487208 0.137030 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.624628 0.137816 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.762857 0.171220 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:26.934489 0.181301 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:27.116180 0.174822 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:27.291474 0.184735 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:53:27.476601 0.148929 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 19:54:48.495022 3.005983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 19:54:55.503314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:55:03.504082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:55:19.506912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:55:51.512924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 19:59:43.436756 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 19:59:43.436959 0.985974 tcp 10.0.2.105 57414 -> 128.255.183.224 9027 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:01:55.518314 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:02:02.532734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:02:10.527642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:02:26.530358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:02:58.536948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:09:02.543281 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:09:09.550284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:09:17.551728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:09:33.554630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:10:05.560956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:16:09.566919 3.005724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:16:16.585502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:16:24.575636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:16:40.578500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:17:12.584846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:23:16.593607 3.002163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:23:23.598872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:23:31.599713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:23:47.602690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:23:53.962289 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 20:23:53.962488 0.181077 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.144048 0.171599 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.316102 0.040123 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.356668 0.122675 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.479714 0.077311 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.557437 0.166549 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.724515 0.078026 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.803029 0.175410 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:54.978811 0.051109 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.030300 0.060526 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.091191 0.045177 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.136744 0.057505 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.194639 0.073918 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.268935 0.150414 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.419758 0.328827 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.748953 0.151865 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:55.901199 0.142352 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:56.043923 0.054917 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:56.099171 0.065707 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:56.165360 0.171540 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:56.337273 0.208405 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:23:56.546001 0.000000 udp 10.0.2.105 7010 -> 79.219.126.130 2430 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 20:24:14.973661 0.051108 tcp 10.0.2.105 57415 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:24:15.024992 0.031050 tcp 10.0.2.105 57416 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:24:15.056393 0.126007 tcp 10.0.2.105 57417 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:24:15.182967 0.153555 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:15.336885 0.137715 udp 10.0.2.105 7010 <-> 174.93.131.50 8057 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:15.475040 0.151643 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:15.627051 0.163480 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:15.790889 0.159234 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:15.950474 0.174580 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:16.125450 0.180262 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:16.306112 0.169565 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:16.476068 0.184968 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:16.661447 0.150656 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:24:19.608116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:29:44.426309 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 20:29:44.426433 0.982556 tcp 10.0.2.105 57418 -> 128.255.183.224 9027 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:30:23.614263 3.002340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:30:30.622063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:30:38.623506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:30:54.631233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:31:26.632786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:37:30.638098 3.001598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:37:37.645358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:37:45.647364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:38:01.652157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:38:33.656240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:47:34.666723 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:47:41.674636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:47:49.676247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:48:05.679501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:48:37.685146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:54:21.793066 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 20:54:21.793222 0.000000 udp 10.0.2.105 7010 -> 79.219.126.130 2430 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 20:54:37.624672 0.053795 tcp 10.0.2.105 57419 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:37.678728 0.054169 tcp 10.0.2.105 57420 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:37.733156 0.123398 tcp 10.0.2.105 57421 -> 195.113.214.236 443 SRPA* 0 0 56 37365 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:37.857008 0.180617 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.038012 0.040528 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.078896 0.169747 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.249010 0.082810 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.332404 0.168305 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.501072 0.076002 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.577493 0.182315 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.760203 0.058874 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.819471 0.059982 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:38.879863 0.160923 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.041195 0.058684 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.100364 0.048332 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.148974 0.323377 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.472778 0.156857 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.630053 0.140522 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.770938 0.056510 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.827809 0.132566 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:39.960747 0.146401 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:40.107502 0.073032 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:40.180888 0.206402 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:40.387649 0.172199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:40.560281 0.156806 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:40.717461 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 20:54:41.691264 3.001537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 20:54:48.701408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:54:56.483274 0.052390 tcp 10.0.2.105 57422 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:56.535882 0.053679 tcp 10.0.2.105 57423 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:56.589818 0.141480 tcp 10.0.2.105 57424 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/24 20:54:56.702906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:54:56.731792 0.145024 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:56.877215 0.161884 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.039496 0.154626 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.194548 0.171324 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.366286 0.184381 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.551053 0.151227 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.702654 0.183423 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:54:57.886446 0.168544 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 20:55:12.702778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:55:44.709611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 20:59:45.416119 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 20:59:45.416391 0.953496 tcp 10.0.2.105 57425 -> 128.255.183.224 9027 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/01/24 21:01:48.715361 3.001461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:01:55.723529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:02:03.725265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:02:19.733467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:02:51.732839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:08:55.739084 3.001719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:09:02.746192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:09:10.747662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:09:26.750998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:09:58.756858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:16:02.762918 3.003485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:16:09.769986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:16:17.788523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:16:33.778085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:17:05.781033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:23:09.795356 3.000415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:23:16.794098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:23:24.803630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:23:40.803499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:24:12.804649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:25:07.934475 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 21:25:07.934664 0.000000 udp 10.0.2.105 7010 -> 174.93.131.50 8057 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 21:25:22.967350 0.052540 tcp 10.0.2.105 57426 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 21:25:23.020127 0.032323 tcp 10.0.2.105 57427 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 21:25:23.052712 0.106520 tcp 10.0.2.105 57428 -> 195.113.214.236 443 SRPA* 0 0 64 42115 flow=From-Botnet-V2-TCP-Established 1970/01/24 21:25:23.159871 0.039151 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.199383 0.121345 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.321154 0.079652 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.401173 0.168669 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.570183 0.078990 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.649563 0.183592 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.833542 0.056453 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.890360 0.059094 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:23.949864 0.164906 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.115142 0.059580 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.175096 0.178652 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.354123 0.327014 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.681520 0.144661 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.826543 0.141173 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:24.968076 0.059788 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.028229 0.087001 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.115614 0.145556 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.261605 0.073211 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.335163 0.043773 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.379375 0.205327 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.585090 0.170855 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.756511 0.146930 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:25.903817 0.144620 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.048886 0.160821 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.210155 0.145026 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.355671 0.191351 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.547372 0.184173 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.731882 0.150329 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:26.882549 0.179851 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:25:27.062818 0.175257 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:29:46.374616 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 21:29:46.374791 0.975468 tcp 10.0.2.105 57429 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/24 21:30:16.810778 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 21:30:23.818331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:30:31.820031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:30:47.822833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:31:19.828950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:37:23.834849 3.001923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:37:30.842691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:37:38.849696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:37:54.846850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:38:26.853393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:47:28.870384 2.996596 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:47:35.872453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:47:43.873587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:47:59.876884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:48:31.883005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:54:35.888415 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 21:54:42.896721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:54:50.897960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:55:06.901146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:55:38.907600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 21:55:54.088974 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 21:55:54.089199 0.039847 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.129447 0.209058 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.338936 0.078337 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.417614 0.165436 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.583435 0.078964 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.662760 0.181915 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.845074 0.055091 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.900568 0.062639 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:54.963562 0.171617 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.135538 0.059260 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.195178 0.179641 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.375236 0.330268 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.705934 0.143865 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.850171 0.142922 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:55.993497 0.059388 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.053238 0.069740 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.123371 0.148694 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.272656 0.078138 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.351144 0.043304 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.394802 0.201907 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.597132 0.171679 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.769179 0.142425 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:56.911983 0.137923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.050256 0.158224 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.208880 0.185206 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.394474 0.151462 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.546333 0.180605 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.727332 0.170528 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:57.898212 0.146699 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:55:58.045314 0.171853 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/24 21:59:47.354239 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 21:59:47.354414 0.970779 tcp 10.0.2.105 57430 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/24 22:01:42.912611 3.001607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 22:01:49.920012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:01:57.922117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:02:13.924540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:02:45.930816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:08:49.937394 3.000940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:08:56.943989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:09:04.945678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:09:20.948809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:09:52.954516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:15:56.960855 3.004038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:16:03.968123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:16:11.976110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:16:27.973298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:16:59.978236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:23:03.990994 2.995560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:23:10.992278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:23:18.992950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:23:35.000488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:24:07.002827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:26:17.720384 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 22:26:17.720541 0.074005 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:17.794956 0.056987 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:17.852327 0.121516 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:17.974257 0.167500 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.142184 0.082490 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.225058 0.180669 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.406160 0.051219 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.457845 0.060596 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.518851 0.171752 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.691018 0.059984 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.751375 0.178629 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:18.930371 0.436246 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.366987 0.143996 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.511353 0.141114 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.652885 0.058185 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.711423 0.074810 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.786589 0.147803 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:19.934764 0.073176 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.008454 0.042330 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.051170 0.207078 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.258622 0.171306 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.430276 0.144157 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.574848 0.144899 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.720131 0.162128 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:20.882635 0.179481 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:21.062490 0.150587 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:21.213466 0.147971 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:21.361833 0.171209 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:26:21.533452 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 22:26:39.516825 0.055327 tcp 10.0.2.105 57431 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 22:26:39.572409 0.034792 tcp 10.0.2.105 57432 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 22:26:39.607453 0.127128 tcp 10.0.2.105 57433 -> 195.113.214.236 443 SRPA* 0 0 59 39575 flow=From-Botnet-V2-TCP-Established 1970/01/24 22:26:39.735124 0.170129 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:29:48.323692 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 22:29:48.323936 1.063059 tcp 10.0.2.105 57434 -> 128.255.183.224 9027 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/24 22:30:11.008540 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 22:30:18.016486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:30:26.017329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:30:42.020800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:31:14.029710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:37:18.033194 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:37:25.039990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:37:33.051516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:37:49.054399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:38:21.063712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:47:23.072374 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:47:30.080201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:47:38.082027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:47:54.084621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:48:26.091268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:54:30.096173 3.002359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 22:54:37.103848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:54:45.105079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:55:01.108794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:55:33.114848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 22:57:04.546375 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 22:57:04.546542 0.181278 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:04.728189 0.123659 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:04.852216 0.167713 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.020766 0.085529 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.106677 0.080275 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.187376 0.040588 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.228313 0.054170 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.282833 0.059307 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.342518 0.173822 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.516721 0.060755 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.577816 0.220200 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.798380 0.180319 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:05.979086 0.322056 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.301528 0.060024 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.361910 0.096318 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.458634 0.148191 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.607241 0.076251 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.683827 0.041738 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.725891 0.143481 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:06.869766 0.143683 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.013851 0.171977 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.186174 0.145328 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.331896 0.144775 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.476998 0.160887 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.638261 0.185369 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.824025 0.151736 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:07.976122 0.206913 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:08.183444 0.171679 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:08.355540 0.148800 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:57:08.504697 0.171613 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/24 22:59:49.395952 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 22:59:49.396382 0.968482 tcp 10.0.2.105 57435 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:01:37.120844 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 23:01:44.127939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:01:52.133154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:02:08.132435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:02:40.139243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:08:44.144439 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:08:51.151846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:08:59.153182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:09:15.157909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:09:47.162704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:15:51.175521 2.997648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:15:58.183688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:16:06.194593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:16:22.183485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:16:54.187052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:22:58.192629 3.011377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:23:05.199838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:23:13.204917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:23:29.212643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:24:01.210324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:27:20.256969 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 23:27:20.257162 0.181928 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:20.439507 0.230226 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:20.670140 0.171208 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:20.841735 0.075092 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:20.917245 0.079339 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:20.996977 0.038157 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:21.035537 0.057824 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:21.093727 0.056868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:21.150997 0.768541 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:21.919931 0.061339 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:21.981728 0.323905 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.306005 0.057208 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.363588 0.075690 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.439671 0.175626 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.615682 0.181002 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.797101 0.143370 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:22.940848 0.075815 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.017085 0.043959 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.061408 0.141178 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.203018 0.149515 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.352876 0.171118 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.524583 0.143770 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.668725 0.184439 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:23.853570 0.151819 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.005804 0.211407 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.217607 0.144890 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.362900 0.160243 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.523531 0.167022 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.690943 0.172216 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:27:24.863494 0.146444 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:29:50.362698 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 23:29:50.362831 1.022812 tcp 10.0.2.105 57436 -> 128.255.183.224 9027 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:30:05.216045 3.001867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 23:30:12.223582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:30:20.225092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:30:36.228299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:31:08.234002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:37:12.239472 3.002319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:37:19.247633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:37:27.248995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:37:43.252048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:38:15.257969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:44:19.264526 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:44:26.271692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:44:34.273344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:44:50.276667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:45:22.282790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:51:26.287815 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/24 23:51:33.295533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:51:41.297267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:51:57.300705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:52:29.306040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:57:45.541641 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 23:57:45.541842 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 23:58:02.918306 0.052689 tcp 10.0.2.105 57437 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:02.971247 0.032001 tcp 10.0.2.105 57438 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:03.003517 0.110547 tcp 10.0.2.105 57439 -> 195.113.214.236 443 SRPA* 0 0 54 34635 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:03.114616 0.814358 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:03.929425 0.168093 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.097934 0.076524 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.174868 0.080247 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.255509 0.038687 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.294509 0.059028 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.353844 0.061134 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:04.415313 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/24 23:58:21.923501 0.052848 tcp 10.0.2.105 57440 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:21.976627 0.032365 tcp 10.0.2.105 57441 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:22.009231 0.136364 tcp 10.0.2.105 57442 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/24 23:58:22.146242 0.059327 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:22.205999 0.444985 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:22.651403 0.060969 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:22.712735 0.530732 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.243882 0.183718 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.427987 0.181507 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.609887 0.147935 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.758247 0.074811 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.833495 0.043704 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:23.877567 0.141943 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.019878 0.146040 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.166275 0.178239 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.344859 0.146748 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.492039 0.185204 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.677618 0.152912 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:24.830895 0.207720 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:25.039001 0.174711 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:25.214131 0.170640 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:25.385209 0.146549 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:25.532173 0.144761 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:25.677394 0.162534 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/24 23:58:33.312665 3.001112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/24 23:58:40.319999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:58:48.321264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:59:04.323874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:59:36.330159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/24 23:59:51.393832 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/24 23:59:51.394053 0.953607 tcp 10.0.2.105 57443 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:05:40.335883 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:05:47.343260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:05:55.344760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:06:11.347861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:06:43.353982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:12:47.359095 3.002625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:12:54.367175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:13:02.368591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:13:18.371772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:13:50.380911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:19:54.384574 3.000900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:20:01.392910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:20:09.393022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:20:25.396027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:20:57.402311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:27:01.407758 3.001876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:27:08.415308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:27:16.416967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:27:32.419970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:28:04.425802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:28:48.840137 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 00:28:48.840228 0.182065 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:28:49.022728 0.167770 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:28:49.190879 0.076576 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:28:49.268007 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 00:28:49.268584 3.005850 tcp 10.0.2.105 57444 -> 86.159.150.19 1929 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 00:28:58.273370 0.000000 tcp 10.0.2.105 57444 -> 86.159.150.19 1929 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 00:29:05.595890 0.063571 tcp 10.0.2.105 57445 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:29:05.659707 0.031921 tcp 10.0.2.105 57446 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:29:05.691887 0.128353 tcp 10.0.2.105 57447 -> 195.113.214.236 443 SRPA* 0 0 42 23356 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:29:05.820811 0.046888 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:05.868061 0.057906 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:05.926377 0.055538 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:05.982282 0.077228 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.059956 0.168107 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.228496 0.059181 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.288006 0.067303 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.355668 0.180534 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.536594 0.322549 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.859502 0.058627 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:06.918531 0.179068 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.097976 0.146425 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.244836 0.076827 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.322140 0.042934 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.365423 0.140767 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.506661 0.142152 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.649235 0.184958 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.834605 0.151665 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:07.986690 0.223647 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:08.210718 0.169823 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:08.380955 0.142439 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:08.523738 0.172504 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:08.696601 0.172972 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:08.869975 0.147333 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:09.017694 0.144795 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:09.162922 0.160773 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:29:52.351853 1.019093 tcp 10.0.2.105 57448 -> 128.255.183.224 9027 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:34:08.431384 3.002262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 00:34:15.439274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:34:23.440846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:34:39.445146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:35:11.450085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:41:15.455963 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:41:22.463291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:41:30.464824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:41:46.470079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:42:18.475513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:49:35.488651 3.000467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:49:42.493307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:49:50.493657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:50:06.496757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:50:38.502964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:56:53.515302 3.004066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 00:57:00.522913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:57:08.543385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:57:24.546620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:57:56.552722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 00:59:10.940504 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 00:59:10.940771 1.580787 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:12.522072 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 00:59:12.522510 3.894862 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 SPA_* 0 0 10 2655 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:18.208614 0.201651 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 1456 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:29.177882 0.061150 tcp 10.0.2.105 57450 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:29.239286 0.031514 tcp 10.0.2.105 57451 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:29.271042 0.189912 tcp 10.0.2.105 57452 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:29.461472 0.171325 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.560553 0.209253 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 1456 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:29.633157 0.082514 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.716066 0.046718 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.763150 0.061941 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.825513 0.060256 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.886150 0.081863 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:29.968662 0.164355 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.133365 0.058324 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.192087 0.069002 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.261514 0.187329 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.449263 0.360606 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.810315 0.059950 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:30.870589 0.180331 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.051370 0.147187 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.198995 0.140974 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.340400 0.145341 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.486129 0.177320 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.663885 0.153215 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:31.817509 0.210114 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.028019 0.078419 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.106775 0.045157 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.152426 0.170986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.323820 0.145327 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.469566 0.193430 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.663401 0.171036 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.834760 0.146468 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:32.981619 0.132809 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:33.114825 0.164077 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/25 00:59:34.606009 0.197705 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 120 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:43.185492 1.933268 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 7334 flow=From-Botnet-V2-TCP-Established 1970/01/25 00:59:53.390905 0.945000 tcp 10.0.2.105 57453 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:01.009940 0.201779 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 900 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:07.771506 1.839931 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 7 4990 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:32.062089 4.860599 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 10114 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:37.073314 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:00:37.123327 4.929968 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 8990 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:42.253341 0.000000 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:00:51.408565 0.405799 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:06.280208 0.208414 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 4338 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:11.073440 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:01:15.289481 0.199202 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 1456 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:23.237328 3.287101 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 9 7226 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:39.238167 3.006826 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 8 7184 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:44.069683 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:01:47.428539 1.513694 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 4314 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:01:59.789518 4.170851 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 18 14884 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:05.558325 4.188601 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 10188 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:26.414276 1.665422 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 7 5822 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:31.578010 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:02:32.129932 2.462875 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 6 4368 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:43.852866 4.048595 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 7334 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:49.367462 1.648633 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 9642 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:02:55.572918 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:02:55.640506 3.721207 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:03:01.221393 0.199902 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 4366 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:03:12.274231 3.597202 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:03:21.278887 3.698683 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 10084 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:03:37.416874 3.244426 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 10084 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:03:42.572108 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:03:50.416876 0.196409 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 8 6784 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:03.561827 3.002543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 01:04:03.852924 1.890848 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 4 2964 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:08.577766 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:04:10.570059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:04:16.755191 3.851292 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 17 13906 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:18.572716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:04:26.924761 3.034078 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:34.574863 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:04:34.575021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:04:34.810390 3.253193 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 24 19728 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:40.972927 4.554944 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 30 26844 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:46.828591 0.204287 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 1456 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:04:58.897147 4.408995 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 19 15414 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:04.077332 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:05:05.227491 0.191953 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 4366 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:06.580994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:05:10.241053 0.406004 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 4 2912 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:17.016120 3.204507 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 9 7226 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:23.189094 4.281769 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 14 11540 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:29.490721 4.208857 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 15 11310 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:34.594808 1.083584 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 11 10834 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:43.566212 1.902489 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 10 7980 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:48.571315 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:05:48.678168 4.824340 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 25 20534 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:53.698216 3.986900 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 12 9488 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:05:59.044447 2.368223 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 21 18218 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:09.015427 4.798074 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 16 14396 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:14.930115 4.966342 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 23 19026 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:21.077921 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:06:21.433248 0.195496 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 212 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:28.956352 4.349108 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 15 11050 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:34.642713 4.931795 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 22 19620 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:39.774768 4.088127 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 14 10296 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:06:45.535036 0.200227 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 808 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:00.704301 4.827503 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 18 16604 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:05.571722 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:07:05.731992 0.125142 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 4 2912 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:11.289368 0.522448 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 8 6680 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:17.027490 4.479785 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 25 21830 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:22.655441 4.743291 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 16 12452 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:28.050839 3.017716 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 3018 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:33.790928 0.201746 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 2 1456 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:41.557599 4.342538 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 26 23932 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:46.570332 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:07:47.041049 4.806878 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 22 20320 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:52.048668 3.775255 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 5 2318 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:07:59.212132 2.990740 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_PA 0 0 17 13750 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:08:05.465196 4.231303 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 FPA_* 0 0 47 32131 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:08:12.433486 0.000138 tcp 10.0.2.105 57449 -> 184.182.240.239 7058 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:11:10.586408 3.002311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 01:11:17.594171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:11:25.595850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:11:41.598832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:12:13.604660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:18:17.611357 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:18:24.618213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:18:32.620353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:18:48.622746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:19:20.628928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:25:24.634899 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:25:31.642881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:25:39.643594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:25:55.646849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:26:27.653036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:29:51.345899 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:29:51.346108 0.181943 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.528525 0.121061 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.649957 0.045512 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.695847 0.059224 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.755443 0.062557 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.818382 0.163902 udp 10.0.2.105 7010 <-> 99.181.134.112 7576 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:51.982661 0.078979 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.062050 0.081107 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.143632 0.170108 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.314196 0.062673 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.377244 0.069172 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.446812 0.182189 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.629413 0.327509 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:52.957331 0.061794 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:29:53.019478 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 01:29:54.340721 1.034256 tcp 10.0.2.105 57454 -> 128.255.183.224 9027 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:30:09.123322 0.062804 tcp 10.0.2.105 57455 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:30:09.186657 0.031792 tcp 10.0.2.105 57456 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:30:09.218760 0.151255 tcp 10.0.2.105 57457 -> 195.113.214.236 443 SRPA* 0 0 34 27156 flow=From-Botnet-V2-TCP-Established 1970/01/25 01:30:09.370644 0.146684 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:09.517687 0.153831 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:09.671929 0.144834 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:09.817219 0.186775 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.004480 0.151711 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.156695 0.207908 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.365219 0.076052 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.441688 0.043482 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.485549 0.170089 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.655997 0.144372 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.801097 0.167467 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:10.968957 0.172100 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:11.141469 0.142975 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:11.284864 0.144675 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:30:11.429941 0.160285 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 01:32:31.658596 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:32:38.666542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:32:46.667663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:33:02.670245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:33:34.679123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:39:38.682513 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:39:45.689945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:39:53.691889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:40:09.694629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:40:41.701010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:48:42.715567 3.001370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:48:49.722686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:48:57.723939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:49:13.726625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:49:45.733499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:55:50.739956 3.002578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 01:55:57.748196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:56:05.752088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:56:21.752331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:56:53.760783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 01:59:55.380044 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 01:59:55.380274 0.921941 tcp 10.0.2.105 57458 -> 128.255.183.224 9027 FSPA* 0 0 14 1742 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:00:37.750610 0.181165 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:37.932184 1.131076 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:39.063631 0.045651 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:39.109670 0.057015 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:39.167082 0.064713 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:39.232398 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 02:00:42.577163 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 02:00:57.170131 0.062798 tcp 10.0.2.105 57459 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:00:57.233190 0.036006 tcp 10.0.2.105 57460 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:00:57.269417 0.125163 tcp 10.0.2.105 57461 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:00:57.395116 0.069858 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:57.465369 0.076068 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:57.541798 0.182206 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:57.724583 0.183400 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:00:57.908368 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 02:01:15.014367 0.063836 tcp 10.0.2.105 57462 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:01:15.078521 0.032393 tcp 10.0.2.105 57463 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:01:15.111242 0.128482 tcp 10.0.2.105 57464 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:01:15.240193 0.055001 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.295514 0.056661 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.352664 0.166014 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.519041 0.068201 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.587604 0.149108 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.737133 0.142693 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:15.880257 0.145780 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.026417 0.179255 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.206024 0.151412 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.357792 0.209980 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.568148 0.069318 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.637777 0.041791 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.679886 0.170173 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.850413 0.146107 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:16.996935 0.173850 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:17.171121 0.172700 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:17.344386 0.160974 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:17.505764 0.147343 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:01:17.653552 0.144669 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:02:57.764226 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 02:03:04.772514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:03:12.773239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:03:28.775985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:04:00.782407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:10:04.787918 3.002202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:10:11.795654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:10:19.797106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:10:35.800101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:11:07.805838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:17:11.812174 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:17:18.819429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:17:26.821227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:17:42.823943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:18:14.830498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:24:18.835138 3.002516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:24:25.843536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:24:33.846892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:24:49.848181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:25:21.854038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:29:56.309825 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 02:29:56.310013 0.982094 tcp 10.0.2.105 57465 -> 128.255.183.224 9027 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:31:25.860256 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:31:32.867363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:31:37.955163 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 02:31:37.955310 0.000000 udp 10.0.2.105 7010 -> 99.181.134.112 7576 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 02:31:40.868937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:31:56.062544 0.058321 tcp 10.0.2.105 57466 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:31:56.121141 0.032611 tcp 10.0.2.105 57467 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:31:56.154013 0.139477 tcp 10.0.2.105 57468 -> 195.113.214.236 443 SRPA* 0 0 64 41018 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:31:56.294054 0.673888 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:56.872196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:31:56.968476 0.180846 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:57.149754 0.120567 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:57.270733 0.044854 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:57.315977 0.059445 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:57.375848 0.060011 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:31:57.436382 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 02:32:13.056131 0.056715 tcp 10.0.2.105 57469 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:32:13.113202 0.033065 tcp 10.0.2.105 57470 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:32:13.146607 0.133302 tcp 10.0.2.105 57471 -> 195.113.214.236 443 SRPA* 0 0 60 41752 flow=From-Botnet-V2-TCP-Established 1970/01/25 02:32:13.280480 0.182669 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.463617 0.082372 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.546397 0.076254 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.623021 0.169706 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.793185 0.059366 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.852957 0.059515 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.912884 0.074082 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:13.987360 0.146585 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.134422 0.140428 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.275288 0.141375 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.417035 0.186072 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.603537 0.152390 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.756287 0.205602 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:14.962222 0.078547 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.041197 0.043475 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.085040 0.170384 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.255831 0.144561 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.400808 0.171329 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.572514 0.168877 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.741778 0.144856 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:15.887019 0.163004 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:16.050389 0.145858 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/25 02:32:28.878276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:38:32.884167 3.059800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:38:39.923516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:38:47.903371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:39:03.906000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:39:35.912200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:48:09.923742 3.002080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:48:16.931946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:48:24.933346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:48:40.935602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:49:12.941638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:55:16.947754 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 02:55:23.955240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:55:31.966867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:55:47.969905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:56:19.975634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 02:59:57.298474 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 02:59:57.298675 0.968777 tcp 10.0.2.105 57472 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/25 03:02:26.072458 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 03:02:26.072681 0.180159 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:26.253227 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 03:02:28.988760 3.004626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 03:02:35.996630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:02:41.886322 0.056296 tcp 10.0.2.105 57473 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 03:02:41.942893 0.057271 tcp 10.0.2.105 57474 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 03:02:42.000388 0.127270 tcp 10.0.2.105 57475 -> 195.113.214.236 443 SRPA* 0 0 56 37343 flow=From-Botnet-V2-TCP-Established 1970/01/25 03:02:42.128282 0.864720 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:42.993425 0.120934 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.114774 0.056938 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.172095 0.043984 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.216497 0.055736 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.272596 0.183806 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.456771 0.076746 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.533920 0.080192 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.614496 0.168997 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.783925 0.054561 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.838844 0.074203 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.913451 0.079726 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.993598 0.143703 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:43.997803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:02:44.137666 0.142126 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:44.280146 0.143532 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:44.424099 0.186766 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:44.611273 0.200149 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:44.811792 0.207898 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.020067 0.066836 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.087273 0.044691 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.132397 0.171344 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.304226 0.166005 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.470588 0.151958 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.622926 0.162810 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.786168 0.147152 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:45.933717 0.145267 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:02:46.079333 0.166458 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:03:00.001263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:03:32.007045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:09:36.014189 2.999844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:09:43.020554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:09:51.021783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:10:07.024643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:10:39.031240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:16:43.039138 2.999269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:16:50.044208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:16:58.048751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:17:14.048914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:17:46.054646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:23:50.061295 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:23:57.068175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:24:05.069574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:24:21.073021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:24:53.078701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:29:58.267888 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 03:29:58.268046 0.997025 tcp 10.0.2.105 57476 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/25 03:30:57.085281 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:31:04.092101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:31:12.093619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:31:28.096923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:32:00.116222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:33:00.880513 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 03:33:00.880706 0.178803 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.059925 0.181635 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.241958 0.378997 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.621328 0.121587 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.743278 0.057944 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.801598 0.044888 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.892974 0.052470 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:01.945839 0.234316 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.180594 0.085236 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.266214 0.075141 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.341749 0.165899 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.508039 0.054339 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.562742 0.058903 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.622064 0.072792 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.695226 0.150830 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.846457 0.142121 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:02.988966 0.144061 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.133425 0.204483 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.338302 0.077739 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.416520 0.045148 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.462031 0.185928 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.648320 0.150449 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.799150 0.169859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:03.969418 0.170822 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:04.140624 0.137987 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:04.279029 0.159956 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:04.439383 0.145573 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:04.585383 0.144042 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:33:04.729801 0.175946 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 03:38:04.119441 3.002307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:38:11.126612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:38:19.127608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:38:35.130587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:39:07.137470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:47:56.150369 3.001249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:48:03.157762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:48:11.159172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:48:27.162146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:48:59.168253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:55:03.174418 3.000996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 03:55:10.182866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:55:18.183430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:55:34.185697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:56:06.192184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 03:59:59.267513 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 03:59:59.267691 0.960036 tcp 10.0.2.105 57477 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/25 04:02:14.203532 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:02:21.210861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:02:29.213267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:02:45.215586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:03:17.222063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:03:32.083660 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 04:03:32.083803 0.179516 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:32.263687 0.180689 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:32.444737 0.655631 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.100766 0.121013 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.222132 0.062504 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.285065 0.045907 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.331333 0.055975 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.387705 0.183863 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.571923 0.075442 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.647731 0.079403 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.727495 0.167998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.895890 0.059594 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:33.955917 0.059276 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.015661 0.067733 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.083789 0.157677 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.241819 0.144410 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.386649 0.142088 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.529134 0.214581 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.744101 0.070043 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.814549 0.043936 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:34.858813 0.185736 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.044907 0.152755 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.198035 0.233060 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.431458 0.171713 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.603575 0.151962 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.755946 0.140283 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:35.896750 0.172997 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:36.070148 0.159953 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:03:36.230463 0.148510 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:09:21.228329 3.000840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:09:28.234964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:09:36.236782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:09:52.239635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:10:24.245781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:16:28.253580 2.999939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:16:35.258900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:16:43.260578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:16:59.263377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:17:31.269816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:23:35.276553 3.000758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:23:42.282696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:23:50.284519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:24:06.287518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:24:38.293481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:30:00.227180 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 04:30:00.227353 1.006097 tcp 10.0.2.105 57478 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/25 04:30:42.299164 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:30:49.307013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:30:57.308748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:31:13.312376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:31:45.327652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:33:57.798318 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 04:33:57.798497 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 04:34:13.532834 0.052883 tcp 10.0.2.105 57479 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 04:34:13.585956 0.033507 tcp 10.0.2.105 57480 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 04:34:13.619837 0.185683 tcp 10.0.2.105 57481 -> 195.113.214.236 443 SRPA* 0 0 53 47451 flow=From-Botnet-V2-TCP-Established 1970/01/25 04:34:13.806047 0.180676 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:13.987155 0.900320 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:14.887811 0.121816 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.010072 0.059445 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.069939 0.044092 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.114444 0.052255 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.167083 0.177255 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.344700 0.080368 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.425477 0.078846 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.504728 0.165701 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.670905 0.058662 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.729963 0.057809 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.788144 0.083235 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:15.871813 0.146976 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.019226 0.146269 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.165850 0.141140 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.307478 0.205266 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.513146 0.076525 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.590146 0.045242 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.635831 0.187263 udp 10.0.2.105 7010 <-> 99.12.229.97 4894 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:16.823532 0.314006 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.137977 0.151767 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.290151 0.144781 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.435354 0.168029 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.603751 0.210148 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.814341 0.148570 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:17.963352 0.171417 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:34:18.135161 0.173841 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 04:37:49.336498 2.999071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:37:56.341155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:38:04.342516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:38:20.348899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:38:52.351362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:47:49.365475 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:47:56.373558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:48:04.374928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:48:20.380033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:48:52.384163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:54:56.390287 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 04:55:03.397498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:55:11.398795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:55:27.402181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 04:55:59.407952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:00:01.236417 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 05:00:01.236649 0.968882 tcp 10.0.2.105 57482 -> 128.255.183.224 9027 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:02:05.416658 3.002029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:02:12.425020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:02:20.425961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:02:36.429035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:03:08.435557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:04:19.838093 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 05:04:19.838235 0.183729 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:20.022348 0.181595 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:20.204431 0.057038 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:20.262081 0.041515 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:20.303986 0.059857 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:20.364205 0.965328 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:21.329965 0.120707 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:21.451053 0.183887 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:21.635334 0.076091 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:21.711767 0.084873 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:21.797317 0.473960 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.271645 0.059942 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.331946 0.057381 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.389615 0.069694 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.459674 0.147495 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.607532 0.143169 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.751062 0.145084 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:22.896565 0.206677 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:23.103643 0.070602 udp 10.0.2.105 7010 <-> 109.157.104.137 9935 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:23.174616 0.045224 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:23.220193 0.000000 udp 10.0.2.105 7010 -> 99.12.229.97 4894 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 05:04:38.836798 0.053950 tcp 10.0.2.105 57483 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:04:38.890954 0.033498 tcp 10.0.2.105 57484 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:04:38.924699 0.127881 tcp 10.0.2.105 57485 -> 195.113.214.236 443 SRPA* 0 0 32 24709 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:04:39.053098 0.150263 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.203757 0.146346 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.350523 0.159217 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.510134 0.148780 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.659271 0.170784 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.830465 0.140348 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:39.971221 0.169417 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:04:40.141060 0.165370 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:09:12.440890 3.002189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:09:19.448565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:09:27.449961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:09:43.453137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:10:15.458248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:16:19.465972 3.002870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:16:26.477896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:16:34.480678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:16:50.491035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:17:22.483133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:23:26.489822 3.000125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:23:33.501986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:23:41.505117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:23:57.500844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:24:29.512814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:30:02.205837 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 05:30:02.206004 0.990953 tcp 10.0.2.105 57486 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:30:33.513187 3.001457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:30:40.520042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:30:48.521721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:31:04.524871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:31:36.530392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:35:07.384409 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 05:35:07.384617 0.000000 udp 10.0.2.105 7010 -> 99.12.229.97 4894 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 05:35:25.131091 0.056149 tcp 10.0.2.105 57487 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:25.187479 0.034966 tcp 10.0.2.105 57488 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:25.222794 0.149981 tcp 10.0.2.105 57489 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:25.373295 0.058403 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:25.432086 0.178743 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:25.611237 0.181520 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:25.793120 0.038234 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:25.831773 0.053818 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:25.886049 0.120728 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:26.007117 0.944507 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:26.952017 0.077060 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.029468 0.079857 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.109703 0.223427 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.333513 0.060965 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.394890 0.070925 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.466264 0.148166 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.614820 0.141504 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.756749 0.165630 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.922807 0.063028 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:27.986231 0.105742 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:28.092448 0.143832 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:28.236711 0.223586 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:28.460646 0.000000 udp 10.0.2.105 7010 -> 109.157.104.137 9935 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 05:35:44.387629 0.056377 tcp 10.0.2.105 57490 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:44.444272 0.031657 tcp 10.0.2.105 57491 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:44.476139 0.150269 tcp 10.0.2.105 57492 -> 195.113.214.236 443 SRPA* 0 0 39 24018 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:35:44.627007 0.153064 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:44.780459 0.152452 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:44.933293 0.189780 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:45.123446 0.146508 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:45.270344 0.170943 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:45.441689 0.143650 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:45.585724 0.171378 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 05:35:45.757523 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 05:36:03.074507 0.052279 tcp 10.0.2.105 57493 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:36:03.127012 0.033835 tcp 10.0.2.105 57494 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:36:03.161150 0.149332 tcp 10.0.2.105 57495 -> 195.113.214.236 443 SRPA* 0 0 25 13044 flow=From-Botnet-V2-TCP-Established 1970/01/25 05:37:40.536312 3.002262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 05:37:47.544381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:37:55.545630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:38:11.548744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:38:43.555052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:47:43.564593 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:47:50.571926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:47:58.572859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:48:14.575431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:48:46.581954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:54:50.588670 3.000811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 05:54:57.595135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:55:05.603075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:55:21.600013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 05:55:53.606083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:00:03.205299 0.000176 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 06:00:03.205578 1.031932 tcp 10.0.2.105 57496 -> 128.255.183.224 9027 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:01:57.611663 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:02:04.619207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:02:12.626457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:02:28.623599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:03:00.629670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:06:18.234308 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 06:06:18.234491 0.000000 udp 10.0.2.105 7010 -> 109.157.104.137 9935 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 06:06:35.019645 0.058306 tcp 10.0.2.105 57497 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:35.078191 0.051957 tcp 10.0.2.105 57498 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:35.130417 0.145463 tcp 10.0.2.105 57499 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:35.276464 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 06:06:51.933459 0.059289 tcp 10.0.2.105 57500 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:51.993022 0.056218 tcp 10.0.2.105 57501 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:52.049479 0.151441 tcp 10.0.2.105 57502 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:06:52.201827 0.039566 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.241845 0.049547 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.291832 0.122918 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.415207 0.181682 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.597328 0.180037 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.777750 0.058890 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.837027 0.083320 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:52.920741 0.838919 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:53.760042 0.083936 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:53.844374 0.065857 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:53.910622 0.223223 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.134237 0.143309 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.277947 0.183380 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.461743 0.064793 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.526992 0.056190 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.583526 0.144617 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.728554 0.165149 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.894156 0.057262 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:54.951817 0.211658 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.163907 0.147728 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.312037 0.144992 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.457470 0.151344 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.609238 0.160056 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.769683 0.138917 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:55.909018 0.170967 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:06:56.080518 0.173585 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:09:04.635793 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 06:09:11.643381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:09:19.644851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:09:35.647608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:10:07.653709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:16:11.659475 3.005848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:16:18.668783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:16:26.669345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:16:42.678715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:17:14.677736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:23:18.688658 2.996662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:23:25.691112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:23:33.694076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:23:49.695392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:24:21.701609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:30:04.244575 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 06:30:04.244729 0.983822 tcp 10.0.2.105 57503 -> 128.255.183.224 9027 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/01/25 06:30:25.707958 3.001264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:30:32.715485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:30:40.716732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:30:56.719756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:31:28.727177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:36:58.199655 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 06:36:58.199852 0.039804 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.240030 0.057582 udp 10.0.2.105 7010 <-> 81.149.166.200 8858 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.297983 0.124951 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.423270 0.182446 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.606147 0.179199 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.785748 0.060042 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.846203 0.093554 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:58.940164 0.066843 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.007465 0.243713 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.251551 0.141139 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.393071 0.326025 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.719498 0.081235 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.801152 0.180996 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:36:59.982518 0.059750 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.042658 0.295150 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.338213 0.141457 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.480023 0.164689 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.645106 0.060901 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.706411 0.208060 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:00.914890 0.148015 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:01.063306 0.491760 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:01.555407 0.145252 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:01.701025 0.170270 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:01.871752 0.169603 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:02.041764 0.145822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:02.187976 0.150926 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 06:37:32.731443 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:37:39.739487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:37:47.741218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:38:03.743958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:38:35.749741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:47:37.762549 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:47:44.769068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:47:52.773199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:48:08.773333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:48:40.779475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:54:44.786130 3.001107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 06:54:51.793349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:54:59.794252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:55:15.797488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 06:55:47.803668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:00:05.233960 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:00:05.234163 1.437761 tcp 10.0.2.105 57504 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:01:51.811599 2.999554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 07:01:58.817070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:02:06.818286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:02:22.821383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:02:54.827303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:07:28.611425 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:07:28.611565 0.039669 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:07:28.651587 0.000000 udp 10.0.2.105 7010 -> 81.149.166.200 8858 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:07:46.698629 0.054352 tcp 10.0.2.105 57505 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:07:46.753256 0.053551 tcp 10.0.2.105 57506 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:07:46.807053 0.148206 tcp 10.0.2.105 57507 -> 195.113.214.236 443 SRPA* 0 0 20 10728 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:07:46.955902 0.120795 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:07:47.077081 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:08:05.164093 0.354593 tcp 10.0.2.105 57508 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:05.518975 0.053680 tcp 10.0.2.105 57509 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:05.572985 0.147590 tcp 10.0.2.105 57510 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:05.721264 0.179660 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:05.901296 0.057925 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:05.959609 0.081755 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:06.041801 0.068448 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:06.110618 0.255059 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:06.366052 0.142397 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:06.508855 0.959827 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:07.469086 0.080489 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:07.549948 0.183964 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:07.734333 0.061845 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:07.796621 0.854384 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:08.651364 0.061281 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:08.713044 0.207934 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:08.921400 0.147295 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:09.069172 0.049106 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:09.118688 0.141841 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:09.260922 0.000000 udp 10.0.2.105 7010 -> 98.69.224.36 1591 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:08:25.223403 0.070700 tcp 10.0.2.105 57511 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:25.294437 0.054904 tcp 10.0.2.105 57512 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:25.349598 0.144705 tcp 10.0.2.105 57513 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:25.494757 0.145056 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:25.640192 0.235767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:25.876488 0.000000 udp 10.0.2.105 7010 -> 74.187.52.53 5502 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:08:44.480551 0.053813 tcp 10.0.2.105 57514 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:44.534609 0.054252 tcp 10.0.2.105 57515 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:44.589133 0.152575 tcp 10.0.2.105 57516 -> 195.113.214.236 443 SRPA* 0 0 39 26628 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:08:44.742132 0.151817 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:44.894289 1.641116 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:08:58.832834 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 07:09:05.841058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:09:13.842765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:09:29.845576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:10:01.851319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:16:05.857530 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 07:16:12.864616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:16:20.867413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:16:36.874342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:17:08.881307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:23:12.881290 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 07:23:19.888804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:23:27.892009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:23:43.894921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:24:15.899321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:30:06.679457 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:30:06.679610 1.006918 tcp 10.0.2.105 57517 -> 128.255.183.224 9027 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:30:19.905276 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 07:30:26.912869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:30:34.913621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:30:50.917108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:31:22.923295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:37:26.929579 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 07:37:33.936873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:37:41.938538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:37:57.941255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:38:29.947751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:38:50.997886 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:38:50.998107 0.000000 udp 10.0.2.105 7010 -> 81.149.166.200 8858 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:06.854971 0.053905 tcp 10.0.2.105 57518 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:06.909153 0.052606 tcp 10.0.2.105 57519 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:06.962022 0.161587 tcp 10.0.2.105 57520 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:07.124216 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:24.566543 0.053399 tcp 10.0.2.105 57521 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:24.620216 0.053502 tcp 10.0.2.105 57522 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:24.674012 0.146897 tcp 10.0.2.105 57523 -> 195.113.214.236 443 SRPA* 0 0 40 21318 flow=From-Botnet-V2-TCP-Established 1970/01/25 07:39:24.821437 4.678338 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 4 1102 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:25.431578 4.245458 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 4 1192 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:25.603229 4.116079 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1161 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:25.642689 4.197524 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 4 1253 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:25.643015 2.999004 tcp 10.0.2.105 57524 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 07:39:25.763606 4.139680 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 4 1017 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:25.832186 4.250368 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 4 1133 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.012734 4.146596 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1228 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.090990 4.120031 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1186 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.150723 4.209516 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 4 1208 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.295303 4.459500 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 4 993 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.553909 3.855760 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1281 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.610828 3.876963 udp 10.0.2.105 7010 <-> 86.159.150.19 6503 CON 0 0 4 1130 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:26.689124 4.066111 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 588 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:27.657149 4.446902 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 1162 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:27.841499 4.409229 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 4 1162 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:27.988945 4.307163 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.033857 4.405923 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 4 1186 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.179087 4.317902 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 4 1107 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.241008 0.164939 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.406315 4.326629 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 4 1203 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.616703 4.261752 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1308 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.762884 4.286659 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1351 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:28.935997 4.252081 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1004 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:29.074258 4.269555 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:31.918569 0.000000 udp 10.0.2.105 7010 <- 211.38.175.27 2833 RSP 0 0 1 539 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:33.344467 0.164498 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:33.509541 0.000000 udp 10.0.2.105 7010 -> 69.119.178.86 2682 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:34.640127 0.000000 tcp 10.0.2.105 57524 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 07:39:39.036674 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 4949 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:46.357009 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:51.073497 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:39:53.898842 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 9977 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:39:59.415953 0.103688 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:39:59.543910 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:08.253181 0.000000 udp 10.0.2.105 7010 -> 199.227.96.226 1933 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:13.746372 0.000000 udp 10.0.2.105 7010 -> 151.62.65.115 5261 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:18.573172 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:40:21.941823 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:29.899731 0.000000 udp 10.0.2.105 7010 -> 62.212.44.70 7424 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:38.171633 0.000000 udp 10.0.2.105 7010 -> 192.119.27.164 3037 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:43.068638 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:40:46.413670 0.069286 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:40:46.510283 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:40:53.323495 0.000000 udp 10.0.2.105 7010 -> 24.156.37.111 7825 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:01.708731 0.000000 udp 10.0.2.105 7010 -> 81.137.205.62 2561 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:08.531573 0.000000 udp 10.0.2.105 7010 -> 115.134.158.102 6504 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:13.073193 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:41:17.451336 0.000000 udp 10.0.2.105 7010 -> 86.155.140.159 2915 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:26.153971 0.000000 udp 10.0.2.105 7010 -> 190.87.195.45 4498 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:32.985165 0.000000 udp 10.0.2.105 7010 -> 81.149.76.60 6645 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:37.567329 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:41:41.682804 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:49.965616 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:41:55.032040 0.000000 udp 10.0.2.105 7010 -> 72.230.107.113 7826 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:01.925201 0.000000 udp 10.0.2.105 7010 -> 74.50.234.34 6339 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:06.568863 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:42:07.239848 0.179377 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:42:07.645071 0.000000 udp 10.0.2.105 7010 -> 96.11.209.40 1478 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:13.799388 0.000000 udp 10.0.2.105 7010 -> 79.18.106.132 3641 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:21.053061 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:29.041098 0.062062 udp 10.0.2.105 7010 -> 94.34.249.99 9141 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:29.103160 0.000000 icmp 94.34.249.99 0x0303 -> 10.0.2.105 0xb523 URP 192 1 137 flow=Background 1970/01/25 07:42:33.567320 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:42:37.853797 0.000000 udp 10.0.2.105 7010 -> 88.234.99.205 5484 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:46.165765 0.000000 udp 10.0.2.105 7010 -> 84.173.20.143 7912 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:52.475031 0.000000 udp 10.0.2.105 7010 -> 81.30.3.148 2066 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:42:57.833361 0.000000 udp 10.0.2.105 7010 -> 68.60.75.213 6599 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:02.568700 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:43:06.265036 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:14.045906 0.202881 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:43:14.643910 0.366892 udp 10.0.2.105 7010 <-> 59.93.242.229 5840 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:43:15.033115 0.000000 udp 10.0.2.105 7010 -> 78.139.182.8 2564 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:23.870145 0.000000 udp 10.0.2.105 7010 -> 75.224.248.166 5379 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:28.566877 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:43:30.509090 0.000000 udp 10.0.2.105 7010 -> 139.193.160.247 5778 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:38.621397 0.000000 udp 10.0.2.105 7010 -> 64.40.243.226 4203 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:43.638269 0.088406 udp 10.0.2.105 7010 <-> 79.129.143.234 6161 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:43:43.737309 0.032110 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:43:43.778028 0.000000 udp 10.0.2.105 7010 -> 80.46.44.40 2972 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:49.286993 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:43:54.073317 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:43:57.079069 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:02.986909 0.192227 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:44:03.189085 0.000000 udp 10.0.2.105 7010 -> 80.45.163.203 7025 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:11.017660 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:16.255580 0.000000 udp 10.0.2.105 7010 -> 188.9.0.37 4685 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:21.071837 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:44:24.056765 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8490 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:31.537178 0.000000 udp 10.0.2.105 7010 -> 190.198.148.129 6782 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:37.586119 0.000000 udp 10.0.2.105 7010 -> 151.64.16.195 2163 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:45.006805 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 5245 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:49.573321 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:44:50.705123 0.000000 udp 10.0.2.105 7010 -> 217.254.154.252 8967 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:44:56.403508 0.088082 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 863 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:44:56.501018 0.214924 udp 10.0.2.105 7010 <-> 50.134.170.237 5506 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:44:56.735377 0.217636 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:44:56.962011 0.178447 udp 10.0.2.105 7010 <-> 67.209.76.247 7951 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:44:57.154606 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:05.656753 0.000000 udp 10.0.2.105 7010 -> 78.96.147.70 4476 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:12.981750 0.280865 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:45:13.276649 0.217017 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:45:13.509552 0.000000 udp 10.0.2.105 7010 -> 50.195.194.193 3783 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:17.573439 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:45:18.815761 0.000000 udp 10.0.2.105 7010 -> 109.2.245.226 2949 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:25.064269 0.095576 udp 10.0.2.105 7010 <-> 86.46.199.113 8274 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:45:25.169712 0.000000 udp 10.0.2.105 7010 -> 89.28.203.181 5870 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:32.815359 0.000000 udp 10.0.2.105 7010 -> 175.140.15.83 2584 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:38.814264 0.165806 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:45:38.989869 0.000000 udp 10.0.2.105 7010 -> 79.19.62.156 6869 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:43.569977 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:45:47.528822 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:52.921199 0.000000 udp 10.0.2.105 7010 -> 93.50.85.222 8521 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:45:58.352069 0.147770 udp 10.0.2.105 7010 <-> 210.89.45.28 5007 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:45:58.509559 0.000000 udp 10.0.2.105 7010 -> 77.31.252.9 4400 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:06.203688 0.000000 udp 10.0.2.105 7010 -> 82.152.34.230 8894 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:11.070177 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:46:12.062193 0.063600 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:46:12.138163 1.005441 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:46:13.160870 0.000000 udp 10.0.2.105 7010 -> 87.0.105.159 1659 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:21.344912 0.479139 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:46:21.834524 0.000000 udp 10.0.2.105 7010 -> 188.78.72.47 6200 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:27.223914 0.000000 udp 10.0.2.105 7010 -> 2.123.87.194 4585 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:34.013556 0.000000 udp 10.0.2.105 7010 -> 67.79.246.2 3506 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:38.570917 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:46:39.131632 0.000000 udp 10.0.2.105 7010 -> 86.17.18.95 3775 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:45.219461 0.000000 udp 10.0.2.105 7010 -> 64.53.125.173 2109 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:46:52.700738 0.208341 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:46:52.918551 0.000000 udp 10.0.2.105 7010 -> 79.40.43.12 2448 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:00.867242 0.000000 udp 10.0.2.105 7010 -> 92.8.79.229 4860 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:05.572681 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:47:08.683666 0.000000 udp 10.0.2.105 7010 -> 105.228.255.233 7877 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:15.923566 0.000000 udp 10.0.2.105 7010 -> 86.148.165.10 8821 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:22.883688 0.000000 udp 10.0.2.105 7010 -> 84.129.140.112 8775 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:29.273607 0.000000 udp 10.0.2.105 7010 -> 94.52.191.85 2152 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:31.959311 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 07:47:34.069536 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:47:34.840658 0.000000 udp 10.0.2.105 7010 -> 71.249.189.169 4722 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:38.966428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:47:40.228997 0.220613 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:47:40.459541 0.069711 udp 10.0.2.105 7010 <-> 85.177.192.7 5508 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:47:40.555158 0.040349 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:47:40.604424 0.000000 udp 10.0.2.105 7010 -> 81.192.61.150 6594 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:45.926889 0.310660 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:47:46.247548 0.000000 udp 10.0.2.105 7010 -> 95.250.43.194 4364 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:47:46.968369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:47:52.505701 0.000000 udp 10.0.2.105 7010 -> 67.21.18.10 7467 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:01.198834 0.000000 udp 10.0.2.105 7010 -> 85.219.13.80 3199 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:02.974778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:48:06.067034 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:48:09.191884 0.000000 udp 10.0.2.105 7010 -> 86.18.118.139 5595 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:17.853111 0.183635 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:48:18.075153 0.143741 udp 10.0.2.105 7010 <-> 109.55.240.33 9694 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:48:18.237314 0.000000 udp 10.0.2.105 7010 -> 75.65.217.141 5786 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:23.941597 0.000000 udp 10.0.2.105 7010 -> 72.250.217.205 4312 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:29.338954 0.207038 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:48:29.555977 0.000000 udp 10.0.2.105 7010 -> 86.17.72.223 4675 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:34.065815 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:48:34.947620 0.000000 udp 10.0.2.105 7010 -> 5.82.153.227 1186 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:34.977615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:48:43.752863 0.000000 udp 10.0.2.105 7010 -> 99.72.157.230 5869 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:51.360347 0.000000 udp 10.0.2.105 7010 -> 95.240.108.217 6418 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:48:56.919858 0.000000 udp 10.0.2.105 7010 -> 198.153.148.7 7942 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:49:01.565262 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:49:04.095136 0.883544 udp 10.0.2.105 7010 <-> 187.69.110.223 3440 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:49:04.988918 0.172241 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:49:05.173093 0.000000 udp 10.0.2.105 7010 -> 118.96.203.39 2773 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:49:13.553233 0.000000 udp 10.0.2.105 7010 -> 95.254.185.29 9256 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:49:18.870541 0.000000 udp 10.0.2.105 7010 -> 151.66.3.91 4934 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:49:27.393050 0.000000 udp 10.0.2.105 7010 -> 81.136.171.243 1901 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 07:49:32.069354 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 07:49:34.523266 0.047066 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/01/25 07:54:38.983088 3.001868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 07:54:45.990907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:54:53.992552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:55:09.995056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 07:55:42.001723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:00:07.683437 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 08:00:07.683634 0.931130 tcp 10.0.2.105 57525 -> 128.255.183.224 9027 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:01:46.007269 3.002227 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:01:53.014575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:02:01.016129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:02:17.019562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:02:49.025584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:08:53.030613 3.002323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:09:00.038637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:09:08.040924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:09:24.043260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:09:56.049138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:16:00.055308 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:16:07.062707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:16:15.063917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:16:31.070470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:17:03.073158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:19:49.303044 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 08:19:49.303155 0.161438 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:49.465095 0.890181 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:49.465520 3.000942 tcp 10.0.2.105 57526 -> 98.69.224.36 3482 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:19:50.355718 0.039254 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.395346 0.121070 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.516823 0.065518 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.582696 0.181198 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.764501 0.077560 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.842453 0.060447 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:50.903307 0.143115 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:51.046819 0.060430 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:19:51.107598 0.000000 udp 10.0.2.105 7010 -> 86.159.150.19 6503 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:19:58.465255 0.000000 tcp 10.0.2.105 57526 -> 98.69.224.36 3482 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:20:07.139639 0.063490 tcp 10.0.2.105 57527 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:07.203399 0.056260 tcp 10.0.2.105 57528 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:07.259983 0.154502 tcp 10.0.2.105 57529 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:07.415142 0.248188 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:07.663696 0.573779 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:08.237832 0.182894 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:08.421091 0.146790 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:08.568332 1.106955 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:09.675684 0.146454 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:09.822528 0.063505 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:09.886433 0.210122 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.097007 0.154864 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.252403 0.171166 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.424053 0.144700 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.569146 0.150081 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.719607 0.167288 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.887258 0.097209 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:10.984916 0.070687 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.056008 0.081506 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.138022 0.179741 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.138358 2.999235 tcp 10.0.2.105 57530 -> 213.123.183.25 4491 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:20:11.318126 0.026981 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.345435 0.200588 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.546456 0.202494 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:11.749312 0.331010 udp 10.0.2.105 7010 <-> 59.93.242.229 5840 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:12.080698 0.147246 udp 10.0.2.105 7010 <-> 210.89.45.28 5007 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:12.228345 0.000000 udp 10.0.2.105 7010 -> 79.129.143.234 6161 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:20:20.146339 0.000000 tcp 10.0.2.105 57530 -> 213.123.183.25 4491 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:20:29.159906 0.053506 tcp 10.0.2.105 57531 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:29.213719 0.066557 tcp 10.0.2.105 57532 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:29.280522 0.145616 tcp 10.0.2.105 57533 -> 195.113.214.236 443 SRPA* 0 0 24 13354 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:29.426797 0.031923 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:29.459095 0.059123 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:29.518585 0.319121 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:29.838086 0.186957 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:30.025435 0.000000 udp 10.0.2.105 7010 -> 203.45.33.236 2485 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:20:47.135526 0.054385 tcp 10.0.2.105 57534 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:47.190166 0.053081 tcp 10.0.2.105 57535 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:47.243504 0.148644 tcp 10.0.2.105 57536 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:20:47.392767 0.194683 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:47.587835 0.090575 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:47.678852 0.035670 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:47.679166 3.000798 tcp 10.0.2.105 57537 -> 78.134.67.242 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:20:47.714863 0.033954 udp 10.0.2.105 7010 <-> 85.177.192.7 5508 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:47.749177 0.266381 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:48.015943 0.181261 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:20:48.197569 0.000000 udp 10.0.2.105 7010 -> 109.55.240.33 9694 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:20:56.678634 0.000000 tcp 10.0.2.105 57537 -> 78.134.67.242 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:21:03.812376 0.053309 tcp 10.0.2.105 57538 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:21:03.865953 0.052872 tcp 10.0.2.105 57539 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:21:03.919121 0.152634 tcp 10.0.2.105 57540 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:21:04.072400 0.205226 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:21:04.278028 0.053336 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:21:04.331736 0.684053 udp 10.0.2.105 7010 <-> 187.69.110.223 3440 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:21:05.016191 0.041347 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:23:07.079138 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 08:23:14.090140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:23:22.092219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:23:38.101984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:24:10.096965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:30:08.623197 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 08:30:08.623398 1.010293 tcp 10.0.2.105 57541 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:30:14.102996 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:30:21.110628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:30:29.111654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:30:45.117201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:31:17.121254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:37:21.127008 3.001998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:37:28.134394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:37:36.136407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:37:52.139254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:38:24.145485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:47:26.156328 3.002733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 08:47:33.164359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:47:41.165691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:47:57.168630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:48:29.174786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:51:08.324536 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 08:51:08.324815 0.050108 udp 10.0.2.105 7010 -> 86.159.150.19 6503 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:51:08.374923 0.000000 icmp 86.159.150.19 0x0303 -> 10.0.2.105 0x6719 URP 192 1 126 flow=Background 1970/01/25 08:51:24.869503 0.049421 tcp 10.0.2.105 57542 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:24.919098 0.049682 tcp 10.0.2.105 57543 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:24.969014 0.143608 tcp 10.0.2.105 57544 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:25.113176 0.000000 udp 10.0.2.105 7010 -> 79.129.143.234 6161 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:51:42.994498 0.049458 tcp 10.0.2.105 57545 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:43.044227 0.054767 tcp 10.0.2.105 57546 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:43.099199 0.149323 tcp 10.0.2.105 57547 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:51:43.249036 0.466618 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:51:43.716152 0.000000 udp 10.0.2.105 7010 -> 109.55.240.33 9694 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:51:43.716497 2.992451 tcp 10.0.2.105 57548 -> 203.45.33.236 9877 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:51:52.707562 0.000000 tcp 10.0.2.105 57548 -> 203.45.33.236 9877 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:52:01.530675 0.048874 tcp 10.0.2.105 57549 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:01.579783 0.052671 tcp 10.0.2.105 57550 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:01.632721 0.145586 tcp 10.0.2.105 57551 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:01.778851 0.474019 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.253283 0.178673 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.432282 0.082018 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.514730 0.058901 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.573940 0.159822 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.734138 0.059420 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.793904 0.117637 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:02.911929 0.168080 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:03.080441 0.121997 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:03.202825 0.046873 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:03.250059 0.145593 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:03.396015 1.263509 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:04.659896 0.146863 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:04.807105 0.181624 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:04.989179 0.145506 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.135057 0.208565 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.344060 0.062745 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.407301 0.146171 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.407628 3.002178 tcp 10.0.2.105 57552 -> 81.156.111.183 4925 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:52:05.553803 0.049142 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.603342 0.167183 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.770894 0.096597 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.867906 0.068835 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:05.937169 0.083585 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:06.021139 0.177339 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:06.198835 0.151679 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:06.350881 0.170805 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:06.522011 0.196776 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:06.719198 0.309926 udp 10.0.2.105 7010 <-> 59.93.242.229 5840 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:07.029517 0.146764 udp 10.0.2.105 7010 <-> 210.89.45.28 5007 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:07.176693 0.203692 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:07.380749 0.200284 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:07.581467 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:52:14.408724 0.000000 tcp 10.0.2.105 57552 -> 81.156.111.183 4925 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 08:52:24.353710 0.050268 tcp 10.0.2.105 57553 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:24.404241 0.050875 tcp 10.0.2.105 57554 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:24.455402 0.150013 tcp 10.0.2.105 57555 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:24.605912 0.188268 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:24.794601 0.031312 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:24.826277 0.058384 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:24.885051 0.317882 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.203341 0.037851 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.241521 0.034383 udp 10.0.2.105 7010 <-> 85.177.192.7 5508 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.276438 0.257389 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.534213 0.174636 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.709234 0.036867 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.746426 0.190503 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:25.937312 0.203378 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:26.141099 0.039579 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:26.181079 0.066719 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/25 08:52:26.248142 0.000000 udp 10.0.2.105 7010 -> 187.69.110.223 3440 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 08:52:44.864014 0.048897 tcp 10.0.2.105 57556 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:44.913163 0.050562 tcp 10.0.2.105 57557 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:52:44.963985 0.140898 tcp 10.0.2.105 57558 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 08:54:33.181233 3.002256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 08:54:40.188759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:54:48.189782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:55:04.194613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 08:55:36.199336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:00:09.643320 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 09:00:09.643512 0.995685 tcp 10.0.2.105 57559 -> 128.255.183.224 9027 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:01:40.206115 3.000731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:01:47.212618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:01:55.213714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:02:11.216928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:02:43.223236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:08:47.228230 3.002370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:08:54.236252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:09:02.237541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:09:18.240759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:09:50.247037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:15:54.252659 3.003803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:16:01.260155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:16:09.261317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:16:25.264409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:16:57.282518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:22:49.878424 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 09:22:49.878526 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:23:01.286287 3.001886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:23:07.315539 0.054100 tcp 10.0.2.105 57560 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:07.369960 0.059819 tcp 10.0.2.105 57561 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:07.430104 0.166952 tcp 10.0.2.105 57562 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:07.597686 0.000000 udp 10.0.2.105 7010 -> 187.69.110.223 3440 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:23:08.293969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:23:16.308479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:23:23.986509 0.062445 tcp 10.0.2.105 57563 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:24.049263 0.057400 tcp 10.0.2.105 57564 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:24.106974 0.149814 tcp 10.0.2.105 57565 -> 195.113.214.236 443 SRPA* 0 0 42 37030 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:24.257457 0.475635 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:24.733558 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:23:24.733916 3.000787 tcp 10.0.2.105 57566 -> 203.45.33.236 9877 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 09:23:32.298730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:23:33.730680 0.000000 tcp 10.0.2.105 57566 -> 203.45.33.236 9877 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/25 09:23:40.313217 0.053530 tcp 10.0.2.105 57567 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:40.367050 0.056194 tcp 10.0.2.105 57568 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:40.423568 0.152569 tcp 10.0.2.105 57569 -> 195.113.214.236 443 SRPA* 0 0 38 21720 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:23:40.576805 0.159054 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:40.736283 0.077052 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:40.813763 0.058386 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:40.872617 0.067862 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:40.940922 0.195891 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.137250 0.121859 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.259546 0.045107 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.305101 0.253188 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.558728 0.143848 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.702986 0.059803 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:41.763185 1.310812 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.074456 0.062002 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.136882 0.144256 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.281509 0.045308 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.327268 0.145770 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.473465 0.177667 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.651592 0.235019 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:43.887066 0.146728 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.034233 0.099639 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.134271 0.167394 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.302096 0.178974 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.481461 0.151839 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.633754 0.170972 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:44.805134 0.287368 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:23:45.092909 0.000000 udp 10.0.2.105 7010 -> 59.93.242.229 5840 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:24:00.980458 0.054088 tcp 10.0.2.105 57570 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:01.034833 0.055224 tcp 10.0.2.105 57571 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:01.090339 0.141977 tcp 10.0.2.105 57572 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:01.232878 0.097050 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:01.330392 0.083586 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:01.330729 4.977113 tcp 10.0.2.105 57573 -> 31.192.24.67 3527 SPA_* 0 0 459 424390 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:01.414328 0.000000 udp 10.0.2.105 7010 -> 210.89.45.28 5007 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:24:04.313847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:24:06.404889 2.557108 tcp 10.0.2.105 57573 -> 31.192.24.67 3527 FPA_* 0 0 183 162892 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:17.284410 0.054946 tcp 10.0.2.105 57574 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:17.339681 0.055058 tcp 10.0.2.105 57575 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:17.395047 0.145771 tcp 10.0.2.105 57576 -> 195.113.214.236 443 SRPA* 0 0 40 22372 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:24:17.541329 0.203113 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:17.745023 0.220669 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:17.966102 0.032458 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:17.998953 0.058853 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:18.058173 0.920858 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:18.979430 0.036105 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.015909 0.187768 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.204109 0.268251 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.472759 0.173086 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.646213 0.033330 udp 10.0.2.105 7010 <-> 85.177.192.7 5508 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.679960 0.039535 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.719876 0.061698 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.781973 0.210886 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:19.993250 0.034147 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:24:20.027785 0.206917 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:30:08.310429 3.003013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:30:10.644324 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 09:30:10.644465 1.001179 tcp 10.0.2.105 57577 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:30:15.318672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:30:23.321002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:30:39.322575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:31:11.328696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:37:15.334374 3.002331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:37:22.342260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:37:30.343524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:37:46.346270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:38:18.352876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:44:22.358288 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:44:29.366019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:44:37.367486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:44:53.370626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:45:25.376573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:51:29.382414 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 09:51:36.389816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:51:44.391482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:52:00.394280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:52:32.401341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:54:47.435264 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 09:54:47.435423 0.179873 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:54:47.615728 0.000000 udp 10.0.2.105 7010 -> 59.93.242.229 5840 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:55:05.892879 0.058525 tcp 10.0.2.105 57578 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:05.951667 0.052180 tcp 10.0.2.105 57579 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:06.004166 0.146024 tcp 10.0.2.105 57580 -> 195.113.214.236 443 SRPA* 0 0 40 22620 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:06.150651 0.000000 udp 10.0.2.105 7010 -> 210.89.45.28 5007 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:55:23.227102 0.054034 tcp 10.0.2.105 57581 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:23.281376 0.053473 tcp 10.0.2.105 57582 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:23.335058 0.151333 tcp 10.0.2.105 57583 -> 195.113.214.236 443 SRPA* 0 0 40 21962 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:23.486944 0.000000 udp 10.0.2.105 7010 -> 203.45.33.236 2485 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:55:41.463124 0.053910 tcp 10.0.2.105 57584 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:41.517293 0.053720 tcp 10.0.2.105 57585 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:41.571241 0.152470 tcp 10.0.2.105 57586 -> 195.113.214.236 443 SRPA* 0 0 20 11524 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:55:41.724334 0.059875 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:41.784606 0.085051 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:41.870067 0.173087 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:42.043788 0.121672 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:42.165869 0.045047 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:42.211301 0.073448 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:42.285179 0.183146 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:55:42.468738 0.000000 udp 10.0.2.105 7010 -> 74.12.172.197 3419 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:56:00.270347 0.108676 tcp 10.0.2.105 57587 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:00.379263 0.052438 tcp 10.0.2.105 57588 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:00.431994 0.165580 tcp 10.0.2.105 57589 -> 195.113.214.236 443 SRPA* 0 0 21 13074 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:00.598030 0.143872 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:00.742287 0.058884 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:00.801531 0.141003 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:00.942953 0.063785 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:01.007085 1.219359 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.226871 0.044321 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.271542 0.205532 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.477487 0.146424 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.624329 0.083012 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.707744 0.168480 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:02.876622 0.180509 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.057551 0.146549 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.204448 0.177466 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.382377 0.144739 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.527499 0.214981 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.742863 0.152005 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:03.895475 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 09:56:19.477598 0.054246 tcp 10.0.2.105 57590 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:19.532141 0.059009 tcp 10.0.2.105 57591 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:19.591385 0.151410 tcp 10.0.2.105 57592 -> 195.113.214.236 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/25 09:56:19.743375 0.081232 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:19.824994 0.032879 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:19.858183 0.058983 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:19.917514 0.202283 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:20.120211 0.339463 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:20.460059 0.814381 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.274866 0.036666 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.312016 0.179728 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.492130 0.034595 udp 10.0.2.105 7010 <-> 85.177.192.7 5508 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.526984 0.038950 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.566223 0.065955 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.632610 0.203487 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.836641 0.044499 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:21.881494 0.206270 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:22.088123 0.278202 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:56:22.366745 0.248607 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 09:58:37.412366 2.996958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 09:58:44.415513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:58:52.416848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:59:08.419795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 09:59:40.426015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:00:11.651214 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 10:00:11.651382 0.946726 tcp 10.0.2.105 57593 -> 128.255.183.224 9027 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:05:44.431413 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:05:51.439096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:05:59.440513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:06:15.443587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:06:47.449963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:12:51.456016 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:12:58.463316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:13:06.465001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:13:22.467828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:13:54.473716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:19:58.479333 3.002257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:20:05.487465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:20:13.488929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:20:29.492868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:21:01.497116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:26:42.318498 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 10:26:42.318696 0.473631 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:26:42.792770 0.242582 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:26:43.035796 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:26:58.843625 0.056242 tcp 10.0.2.105 57594 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:26:58.900147 0.054009 tcp 10.0.2.105 57595 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:26:58.954402 0.148637 tcp 10.0.2.105 57596 -> 195.113.214.236 443 SRPA* 0 0 35 19224 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:26:59.103224 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:27:05.503879 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:27:12.511322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:27:17.348469 0.058745 tcp 10.0.2.105 57597 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:17.407483 0.054944 tcp 10.0.2.105 57598 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:17.462737 0.139398 tcp 10.0.2.105 57599 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:17.602661 0.174985 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:17.778017 0.122888 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:17.901310 0.039253 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:17.940951 0.074303 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.015727 0.615283 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.631357 0.068211 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.699940 0.058667 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.759367 0.061135 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.820919 0.144243 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:18.965541 0.062717 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:19.028671 0.143821 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:19.172899 0.207682 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:19.380981 0.048686 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:19.430050 0.686440 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.116820 0.167301 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.284636 0.140385 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.425455 0.145584 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.512913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:27:20.571389 0.182522 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.754305 0.151499 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:20.906237 0.171354 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.077974 0.179707 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.258102 0.075590 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.334084 0.152165 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.486620 0.058365 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.545309 0.089805 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.635475 0.031607 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.667408 0.202705 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:21.870536 0.202526 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:22.073429 0.691155 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:22.764971 0.037119 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:22.802514 0.180048 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:22.982969 0.000000 udp 10.0.2.105 7010 -> 85.177.192.7 5508 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:27:36.515756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:27:38.979886 0.055676 tcp 10.0.2.105 57600 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:39.035901 0.053221 tcp 10.0.2.105 57601 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:39.089490 0.150620 tcp 10.0.2.105 57602 -> 195.113.214.236 443 SRPA* 0 0 39 21774 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:27:39.240636 0.045076 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:39.286118 0.058961 udp 10.0.2.105 7010 <-> 46.49.34.173 3919 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:39.345527 0.209263 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:39.555203 0.228879 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:39.784606 0.204136 udp 10.0.2.105 7010 <-> 50.170.100.87 3920 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:39.989207 0.319491 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:27:40.309065 0.181415 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:28:08.521939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:30:12.600452 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 10:30:12.600633 0.963871 tcp 10.0.2.105 57603 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:34:12.527668 3.002060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:34:19.535513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:34:27.538646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:34:43.539016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:35:15.545779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:41:19.551456 3.003448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:41:26.558793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:41:34.562013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:41:50.563781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:42:22.569026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:49:34.583681 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:49:41.591029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:49:49.592355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:50:05.595510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:50:37.601540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:56:51.611744 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 10:56:58.619468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:57:06.620964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:57:22.623567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:57:54.629899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 10:58:08.039620 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 10:58:08.039772 0.179606 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:08.219755 0.000000 udp 10.0.2.105 7010 -> 85.177.192.7 5508 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:58:25.187077 0.054886 tcp 10.0.2.105 57604 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:25.242197 0.052579 tcp 10.0.2.105 57605 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:25.295033 0.153915 tcp 10.0.2.105 57606 -> 195.113.214.236 443 SRPA* 0 0 38 30718 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:25.449506 0.466929 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:25.916840 0.000000 udp 10.0.2.105 7010 -> 74.12.172.197 3419 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:58:42.559483 0.053731 tcp 10.0.2.105 57607 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:42.613533 0.053464 tcp 10.0.2.105 57608 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:42.667312 0.153384 tcp 10.0.2.105 57609 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:58:42.821197 0.047928 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:42.869518 0.081146 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:42.951044 0.169022 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:43.120578 0.122054 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:43.243027 0.654912 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:43.898325 0.061270 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:43.959991 0.143279 udp 10.0.2.105 7010 <-> 24.153.42.51 2694 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.103642 0.063452 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.167498 0.056870 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.224742 0.066051 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.291183 0.140795 udp 10.0.2.105 7010 <-> 174.88.169.13 6425 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.432401 0.338416 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.771249 0.169043 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.940689 0.050020 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:44.991075 0.219487 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.210984 0.144957 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.356367 0.144572 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.501310 0.194870 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.696573 0.181389 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.878414 0.059789 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:45.938580 0.177210 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.116182 0.142756 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.259313 0.149031 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.408686 0.031221 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.440229 0.202987 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.643609 0.200918 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.845018 0.151683 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:46.997077 0.058990 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:47.056586 0.180987 udp 10.0.2.105 7010 <-> 99.177.88.148 6339 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:47.237956 0.931550 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:48.169888 0.038807 udp 10.0.2.105 7010 <-> 82.9.81.57 3713 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:48.209069 0.042252 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:48.251698 0.214914 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:48.467025 0.046550 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:58:48.513932 0.000000 udp 10.0.2.105 7010 -> 50.170.100.87 3920 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:59:03.700020 0.052877 tcp 10.0.2.105 57610 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:03.753138 0.055134 tcp 10.0.2.105 57611 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:03.808571 0.145790 tcp 10.0.2.105 57612 -> 195.113.214.236 443 SRPA* 0 0 32 16646 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:03.954827 0.437130 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 10:59:04.392389 0.000000 udp 10.0.2.105 7010 -> 46.49.34.173 3919 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 10:59:19.573257 0.054000 tcp 10.0.2.105 57613 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:19.627452 0.053383 tcp 10.0.2.105 57614 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:19.681081 0.145796 tcp 10.0.2.105 57615 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/25 10:59:19.827351 0.172585 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:00:13.570200 0.963867 tcp 10.0.2.105 57616 -> 128.255.183.224 9027 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:04:01.645721 2.997456 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 11:04:08.652857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:04:16.649843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:04:32.652091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:05:04.658268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:11:08.663586 3.001954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:11:15.671573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:11:23.673388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:11:39.676420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:12:11.682057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:18:15.688047 3.001889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:18:22.695739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:18:30.697083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:18:46.700008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:19:18.705943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:25:22.711367 3.002170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:25:29.719290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:25:37.721020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:25:53.723799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:26:25.730031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:29:33.871113 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 11:29:33.871320 0.000000 udp 10.0.2.105 7010 -> 74.12.172.197 3419 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:29:51.497832 0.054234 tcp 10.0.2.105 57617 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:29:51.552389 0.055165 tcp 10.0.2.105 57618 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:29:51.607855 0.144783 tcp 10.0.2.105 57619 -> 195.113.214.236 443 SRPA* 0 0 44 28270 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:29:51.753275 0.000000 udp 10.0.2.105 7010 -> 50.170.100.87 3920 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:30:10.563876 0.052973 tcp 10.0.2.105 57620 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:10.617124 0.054280 tcp 10.0.2.105 57621 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:10.671755 0.155797 tcp 10.0.2.105 57622 -> 195.113.214.236 443 SRPA* 0 0 46 35298 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:10.828456 0.000000 udp 10.0.2.105 7010 -> 46.49.34.173 3919 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:30:14.539567 0.971942 tcp 10.0.2.105 57623 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:29.241062 0.053601 tcp 10.0.2.105 57624 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:29.294900 0.053239 tcp 10.0.2.105 57625 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:29.348511 0.156682 tcp 10.0.2.105 57626 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:29.505664 0.177803 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:29.683830 0.472154 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.156466 0.176957 udp 10.0.2.105 7010 <-> 74.187.52.53 5502 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.333853 0.241612 udp 10.0.2.105 7010 <-> 184.182.240.239 9640 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.575844 0.043719 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.619893 0.073062 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.693310 0.063424 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.757093 0.057828 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.815264 0.059616 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:30.875247 0.000000 udp 10.0.2.105 7010 -> 174.88.169.13 6425 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:30:49.810275 0.053045 tcp 10.0.2.105 57627 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:49.863608 0.052818 tcp 10.0.2.105 57628 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:49.916721 0.151253 tcp 10.0.2.105 57629 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:30:50.068665 0.653347 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:50.722375 0.070065 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:30:50.792808 0.000000 udp 10.0.2.105 7010 -> 24.153.42.51 2694 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:31:06.113805 0.052738 tcp 10.0.2.105 57630 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:06.166758 0.054035 tcp 10.0.2.105 57631 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:06.221089 0.153467 tcp 10.0.2.105 57632 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:06.375137 0.224571 udp 10.0.2.105 7010 <-> 76.25.89.119 8889 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:06.600047 0.139841 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:06.740283 0.137891 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:06.878556 0.165918 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.044825 0.045949 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.091151 0.332496 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.424084 0.145854 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.570291 0.081215 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.651882 0.031810 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.684085 0.169934 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.854408 0.054928 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:07.909758 0.182324 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:08.092679 0.178790 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:08.271847 0.155772 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:08.428018 0.056553 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:08.484919 0.000000 udp 10.0.2.105 7010 -> 99.177.88.148 6339 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:31:26.683350 0.052623 tcp 10.0.2.105 57633 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:26.736214 0.052556 tcp 10.0.2.105 57634 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:26.789009 0.148019 tcp 10.0.2.105 57635 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:26.937562 0.201158 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:27.139085 0.203432 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:27.342889 0.110304 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:27.453621 0.520944 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:27.974939 0.040632 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:28.015916 0.000000 udp 10.0.2.105 7010 -> 82.9.81.57 3713 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 11:31:45.900816 0.053503 tcp 10.0.2.105 57636 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:45.954620 0.065722 tcp 10.0.2.105 57637 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:46.020564 0.152565 tcp 10.0.2.105 57638 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/25 11:31:46.173701 0.190079 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:46.364220 0.286151 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:31:46.650795 0.180070 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/25 11:32:29.736287 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 11:32:36.743832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:32:44.744268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:33:00.748015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:33:32.753701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:39:36.766512 2.994832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:39:43.767287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:39:51.768959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:40:07.771641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:40:39.778890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:48:43.786340 3.002416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:48:50.793684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:48:58.795151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:49:14.798767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:49:46.805025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:55:50.815758 2.997697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 11:55:57.818566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:56:05.819566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:56:21.822817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 11:56:53.828701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:00:15.518773 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 12:00:15.519061 0.963118 tcp 10.0.2.105 57639 -> 128.255.183.224 9027 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:13.951110 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 12:02:13.951291 0.000000 udp 10.0.2.105 7010 -> 24.153.42.51 2694 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:02:30.263661 0.053715 tcp 10.0.2.105 57640 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:30.317571 0.053710 tcp 10.0.2.105 57641 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:30.371532 0.147476 tcp 10.0.2.105 57642 -> 195.113.214.236 443 SRPA* 0 0 36 19644 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:30.519420 0.000000 udp 10.0.2.105 7010 -> 174.88.169.13 6425 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:02:45.955489 0.053454 tcp 10.0.2.105 57643 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:46.009237 0.058616 tcp 10.0.2.105 57644 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:46.068031 0.145493 tcp 10.0.2.105 57645 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:02:46.214025 0.000000 udp 10.0.2.105 7010 -> 99.177.88.148 6339 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:02:57.834145 3.002555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 12:03:03.100548 0.052840 tcp 10.0.2.105 57646 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:03.153638 0.051342 tcp 10.0.2.105 57647 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:03.205286 0.145801 tcp 10.0.2.105 57648 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:03.351602 0.000000 udp 10.0.2.105 7010 -> 82.9.81.57 3713 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:03:04.842091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:03:12.843566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:03:19.784146 0.053825 tcp 10.0.2.105 57649 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:19.838229 0.053165 tcp 10.0.2.105 57650 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:19.891666 0.146630 tcp 10.0.2.105 57651 -> 195.113.214.236 443 SRPA* 0 0 24 13826 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:20.038802 0.000000 udp 10.0.2.105 7010 -> 74.187.52.53 5502 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:03:28.846298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:03:38.621989 0.052674 tcp 10.0.2.105 57652 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:38.674903 0.053890 tcp 10.0.2.105 57653 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:38.729029 0.148736 tcp 10.0.2.105 57654 -> 195.113.214.236 443 SRPA* 0 0 32 16646 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:38.878197 0.472446 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.351053 0.180959 udp 10.0.2.105 7010 <-> 108.216.236.243 7244 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.532561 0.057675 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.590627 0.059879 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.650856 0.057167 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.708406 0.045895 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:39.754680 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:03:56.436539 0.053739 tcp 10.0.2.105 57655 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:56.490509 0.055686 tcp 10.0.2.105 57656 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:56.546419 0.145964 tcp 10.0.2.105 57657 -> 195.113.214.236 443 SRPA* 0 0 41 22016 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:03:56.692880 0.085177 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:56.778429 0.085255 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:56.864080 0.158471 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:57.022915 0.168300 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:57.191623 0.043963 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:03:57.235970 0.000000 udp 10.0.2.105 7010 -> 76.25.89.119 8889 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:04:00.852388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:04:14.212967 0.052749 tcp 10.0.2.105 57658 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:04:14.265930 0.052602 tcp 10.0.2.105 57659 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:04:14.318850 0.151153 tcp 10.0.2.105 57660 -> 195.113.214.236 443 SRPA* 0 0 23 13338 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:04:14.470507 0.144727 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:14.615662 0.143431 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:14.759490 0.031976 udp 10.0.2.105 7010 <-> 85.24.253.117 2141 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:14.791814 0.170719 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:14.962902 0.057678 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.020967 0.180946 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.202303 0.238164 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.440874 0.324481 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.765689 0.144183 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.910232 0.080608 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:15.991241 0.421884 udp 10.0.2.105 7010 <-> 68.161.236.126 3113 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:16.413493 0.055794 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:16.469634 0.203370 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:16.673406 0.195134 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:16.868949 0.793983 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 196 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:17.663310 0.045003 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:17.708657 0.043043 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:17.752027 0.180951 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:17.933370 0.187848 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:04:18.121631 0.281811 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:10:04.857859 3.002318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:10:11.865744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:10:19.867276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:10:35.870100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:11:07.876492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:17:11.882393 3.032526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:17:18.914268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:17:26.901462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:17:42.904169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:18:14.910654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:24:18.925239 2.999253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:24:25.923608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:24:33.925906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:24:49.928197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:25:21.934079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:30:16.488133 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 12:30:16.488325 0.968850 tcp 10.0.2.105 57661 -> 128.255.183.224 9027 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:31:25.940263 3.002349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:31:32.957649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:31:40.959662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:31:56.962215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:32:28.968295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:34:38.240963 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 12:34:38.241070 0.000000 udp 10.0.2.105 7010 -> 74.187.52.53 5502 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:34:54.842604 0.054723 tcp 10.0.2.105 57662 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:34:54.897604 0.053062 tcp 10.0.2.105 57663 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:34:54.950912 0.144456 tcp 10.0.2.105 57664 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:34:55.095946 0.000000 udp 10.0.2.105 7010 -> 184.182.240.239 9640 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:35:11.712742 0.054417 tcp 10.0.2.105 57665 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:11.767433 0.052239 tcp 10.0.2.105 57666 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:11.819992 0.146779 tcp 10.0.2.105 57667 -> 195.113.214.236 443 SRPA* 0 0 51 32288 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:11.967279 0.000000 udp 10.0.2.105 7010 -> 76.25.89.119 8889 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:35:28.296802 0.053345 tcp 10.0.2.105 57668 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:28.350455 0.052770 tcp 10.0.2.105 57669 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:28.403535 0.144261 tcp 10.0.2.105 57670 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:28.548280 0.055668 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:28.604367 0.059854 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:28.664605 0.061022 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:28.726016 0.037990 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:28.764461 0.474308 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:29.239169 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:35:47.163810 0.054171 tcp 10.0.2.105 57671 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:47.218324 0.054545 tcp 10.0.2.105 57672 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:47.273111 0.143651 tcp 10.0.2.105 57673 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:35:47.417285 0.167418 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:47.585091 0.048575 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:47.634043 0.070707 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:47.705153 0.069943 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:47.775479 0.471883 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:48.247737 0.151774 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:48.399895 0.143858 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:35:48.544148 0.000000 udp 10.0.2.105 7010 -> 85.24.253.117 2141 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:36:05.971547 0.053525 tcp 10.0.2.105 57674 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:06.025327 0.056841 tcp 10.0.2.105 57675 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:06.082420 0.144231 tcp 10.0.2.105 57676 -> 195.113.214.236 443 SRPA* 0 0 39 33892 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:06.227310 0.170339 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:06.398027 0.060182 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:06.458541 0.331930 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:06.790821 0.142291 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:06.933535 0.181360 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:07.115303 0.182549 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:07.298243 0.080091 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:07.378753 0.000000 udp 10.0.2.105 7010 -> 68.161.236.126 3113 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 12:36:23.875921 0.054124 tcp 10.0.2.105 57677 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:23.930233 0.053774 tcp 10.0.2.105 57678 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:23.984333 0.148966 tcp 10.0.2.105 57679 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/25 12:36:24.133615 0.059293 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:24.193276 0.211438 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:24.405128 0.205794 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:24.611309 0.039990 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:24.651671 0.744309 udp 10.0.2.105 7010 <-> 190.134.156.28 8917 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:25.396426 0.053068 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:25.449870 0.364891 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:25.815146 0.174813 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:36:25.990366 0.184844 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/25 12:38:32.975224 3.000708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 12:38:39.981732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:38:47.983386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:39:03.986168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:39:35.992059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:48:12.998072 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:48:20.005398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:48:28.006964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:48:44.010726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:49:16.016680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:55:20.026299 2.997673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 12:55:27.029478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:55:35.031581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:55:51.034011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 12:56:23.039964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:00:17.457593 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 13:00:17.457755 1.011008 tcp 10.0.2.105 57680 -> 128.255.183.224 9027 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:02:32.053464 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:02:39.061186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:02:47.062361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:03:03.065588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:03:35.071469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:06:38.355285 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 13:06:38.355514 0.000000 udp 10.0.2.105 7010 -> 108.216.236.243 7244 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:06:55.440947 0.055437 tcp 10.0.2.105 57681 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:06:55.496631 0.052129 tcp 10.0.2.105 57682 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:06:55.549009 0.144412 tcp 10.0.2.105 57683 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:06:55.693612 0.000000 udp 10.0.2.105 7010 -> 85.24.253.117 2141 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:07:13.695769 0.053319 tcp 10.0.2.105 57684 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:13.749369 0.052087 tcp 10.0.2.105 57685 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:13.801672 0.147484 tcp 10.0.2.105 57686 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:13.949717 0.000000 udp 10.0.2.105 7010 -> 68.161.236.126 3113 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:07:32.072787 0.053277 tcp 10.0.2.105 57687 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:32.126307 0.051417 tcp 10.0.2.105 57688 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:32.177991 0.141699 tcp 10.0.2.105 57689 -> 195.113.214.236 443 SRPA* 0 0 40 21962 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:32.320402 0.000000 udp 10.0.2.105 7010 -> 203.45.33.236 2485 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:07:49.257412 0.052560 tcp 10.0.2.105 57690 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:49.310276 0.052409 tcp 10.0.2.105 57691 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:49.362969 0.143602 tcp 10.0.2.105 57692 -> 195.113.214.236 443 SRPA* 0 0 33 24282 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:07:49.507209 0.046167 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.553766 0.058940 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.613079 0.058599 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.672016 0.055085 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.727526 0.063929 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.791904 0.043381 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:49.835640 0.261174 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.097199 0.167922 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.265537 0.077366 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.343334 0.144840 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.488688 0.144879 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.633941 0.328850 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:50.963177 0.145167 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.108746 0.180361 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.289514 0.177009 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.466934 0.181822 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.649146 0.055574 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.705044 0.100735 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.806146 0.053945 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.860435 0.043524 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:51.904479 0.200388 udp 10.0.2.105 7010 <-> 190.84.240.16 3270 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:52.105302 0.204329 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:07:52.310038 0.000000 udp 10.0.2.105 7010 -> 190.134.156.28 8917 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:08:07.723816 0.053758 tcp 10.0.2.105 57693 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:08:07.777902 0.053037 tcp 10.0.2.105 57694 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:08:07.831291 0.143847 tcp 10.0.2.105 57695 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:08:07.975683 0.058654 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:08:08.034782 0.269472 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:08:08.304660 0.178972 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:08:08.483959 0.191719 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:09:39.078116 3.000748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 13:09:46.084936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:09:54.086020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:10:10.089235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:10:42.095416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:16:46.112354 2.997297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:16:53.108208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:17:01.114033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:17:17.113504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:17:49.122247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:23:53.125464 3.007491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:24:00.140626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:24:08.134381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:24:24.137450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:24:56.143185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:30:18.477021 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 13:30:18.477175 0.984318 tcp 10.0.2.105 57696 -> 128.255.183.224 9027 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:31:00.149573 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:31:07.156511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:31:15.158130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:31:31.161164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:32:03.171115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:38:07.172727 3.002055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:38:14.180816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:38:18.637108 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 13:38:18.637255 0.472284 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:19.109883 0.000000 udp 10.0.2.105 7010 -> 190.134.156.28 8917 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:38:22.182045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:38:34.371156 0.054766 tcp 10.0.2.105 57697 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:34.426279 0.074848 tcp 10.0.2.105 57698 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:34.501417 0.144872 tcp 10.0.2.105 57699 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:34.646932 0.060920 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:34.708412 0.062157 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:34.770948 0.056117 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:34.827434 0.066006 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:34.893798 0.054745 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:34.948916 0.651463 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:35.600761 0.038317 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:35.639428 0.077355 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:35.717156 0.167354 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:35.884867 0.332584 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.217810 0.142770 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.360960 0.181373 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.542703 0.138016 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.681085 0.144680 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.826174 0.170866 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:36.997426 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:38:38.184844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:38:54.368891 0.054291 tcp 10.0.2.105 57700 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:54.423431 0.052892 tcp 10.0.2.105 57701 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:54.476580 0.142521 tcp 10.0.2.105 57702 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:38:54.619638 0.086111 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:54.706123 0.057179 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:54.763717 0.039555 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:38:54.803633 0.000000 udp 10.0.2.105 7010 -> 190.84.240.16 3270 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 13:39:10.191118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:39:12.664883 0.054105 tcp 10.0.2.105 57703 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:39:12.719236 0.053280 tcp 10.0.2.105 57704 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:39:12.772825 0.141739 tcp 10.0.2.105 57705 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/25 13:39:12.915075 0.207598 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:39:13.123055 0.197085 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:39:13.320530 0.051193 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:39:13.372099 0.266445 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:39:13.638896 0.179909 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:39:13.819180 0.192214 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/25 13:48:00.206256 3.014158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:48:07.223431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:48:15.224803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:48:31.227887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:49:03.240814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:55:07.239125 3.002328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 13:55:14.247202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:55:22.249362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:55:38.251609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 13:56:10.257689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:00:19.466699 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 14:00:19.466889 0.955353 tcp 10.0.2.105 57706 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:02:18.269550 3.001870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:02:25.276992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:02:33.278301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:02:49.281419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:03:21.287506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:09:15.487085 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 14:09:15.487187 0.203794 udp 10.0.2.105 7010 -> 190.84.240.16 3270 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 14:09:15.690981 0.000000 icmp 190.84.240.16 0x0303 -> 10.0.2.105 0xc60c URP 192 1 137 flow=Background 1970/01/25 14:09:25.293411 3.001726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:09:32.300980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:09:34.365292 0.053759 tcp 10.0.2.105 57707 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:34.419397 0.052380 tcp 10.0.2.105 57708 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:34.472148 0.143386 tcp 10.0.2.105 57709 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:34.616045 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 14:09:40.302651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:09:51.068958 0.052838 tcp 10.0.2.105 57710 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:51.122050 0.053194 tcp 10.0.2.105 57711 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:51.175528 0.146210 tcp 10.0.2.105 57712 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:09:51.322262 0.478138 udp 10.0.2.105 7010 <-> 203.45.33.236 2485 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:51.800780 0.071567 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:51.872768 0.041219 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:51.914386 0.056479 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:51.971199 0.058211 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.029771 0.054389 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.084655 0.158628 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.243693 0.325487 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.569571 0.143729 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.713654 0.077610 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.791606 0.040521 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.832515 0.166905 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:52.999800 0.174301 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.174481 0.144639 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.319517 0.145039 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.464929 0.170935 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.636254 0.040089 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.676730 0.093028 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.770130 0.057234 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:53.827722 0.178238 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:54.006407 0.195346 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:54.202127 0.181416 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:54.383905 0.188527 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:54.572815 0.034641 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:54.607866 0.249926 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:09:56.307816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:10:28.311577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:16:32.317374 3.005444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:16:39.324888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:16:47.326530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:17:03.331213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:17:35.335202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:23:39.342118 3.002531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:23:46.350518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:23:54.352440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:24:10.353115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:24:42.359425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:30:20.425854 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 14:30:20.426077 0.937644 tcp 10.0.2.105 57713 -> 128.255.183.224 9027 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:30:46.365367 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:30:53.372720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:31:01.374294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:31:17.377345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:31:49.383304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:37:53.389636 3.015496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:38:00.406778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:38:08.408144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:38:24.411527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:38:56.418259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:40:21.840667 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 14:40:21.840777 0.056871 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:21.898076 0.058209 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:21.956685 0.060262 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:22.017367 0.058885 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:22.076678 0.804103 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:22.881166 0.000000 udp 10.0.2.105 7010 -> 203.45.33.236 2485 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 14:40:38.775982 0.066979 tcp 10.0.2.105 57714 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:40:38.843228 0.053686 tcp 10.0.2.105 57715 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:40:38.897163 0.124597 tcp 10.0.2.105 57716 -> 195.113.214.236 443 SRPA* 0 0 32 24687 flow=From-Botnet-V2-TCP-Established 1970/01/25 14:40:39.022283 0.067514 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.090169 0.331373 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.421882 0.142470 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.564750 0.081917 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.647034 0.039920 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.687351 0.164687 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:39.852430 0.179969 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.032810 0.143990 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.177231 0.152231 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.329879 0.171490 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.501785 0.040230 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.542374 0.078648 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.621370 0.056158 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.677903 0.178223 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:40.856553 0.196759 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:41.053678 0.035319 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:41.089336 0.258676 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:41.348471 0.180481 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:40:41.529295 0.191212 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/25 14:47:50.427986 3.094937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:47:57.497207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:48:05.446975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:48:21.449644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:48:53.456249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:54:57.461291 3.002584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 14:55:04.468982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:55:12.470290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:55:28.473895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 14:56:00.478973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:00:21.365429 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:00:21.365673 0.976330 tcp 10.0.2.105 57717 -> 128.255.183.224 9027 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:02:08.490952 3.002852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:02:15.498286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:02:23.500514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:02:39.509242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:03:11.511884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:09:15.515404 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:09:22.522637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:09:30.524238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:09:46.526669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:10:18.533771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:10:47.315487 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:10:47.315641 0.471586 udp 10.0.2.105 7010 -> 203.45.33.236 2485 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:10:47.787227 0.000000 icmp 203.45.33.236 0x0303 -> 10.0.2.105 0xb509 URP 192 1 174 flow=Background 1970/01/25 15:11:04.871562 0.067220 tcp 10.0.2.105 57718 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:11:04.939006 0.054883 tcp 10.0.2.105 57719 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:11:04.994152 0.144762 tcp 10.0.2.105 57720 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:11:05.139398 3.659939 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1012 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.194625 3.447666 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1165 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.252100 3.439585 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 4 1174 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.296403 3.454420 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 4 1404 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.354700 3.608767 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 4 944 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.678006 3.346463 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 4 1088 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:05.745773 3.617171 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1121 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.077063 3.432594 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 4 1023 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.222417 3.359643 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1173 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.301105 3.322544 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 951 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.339058 3.450809 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1103 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.506628 3.468268 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 1125 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.689317 3.431058 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1062 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.834188 3.424673 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1154 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:06.972343 3.456327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1048 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.143713 3.327535 udp 10.0.2.105 7010 <-> 217.253.14.40 5550 CON 0 0 4 1140 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.183936 3.355446 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 4 1406 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.268818 3.316741 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 4 1119 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.326936 4.080980 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 4 1318 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.505156 3.274023 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 4 1155 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.756137 3.057186 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 4 1213 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:07.794593 3.435779 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:08.210781 3.556056 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 4 1199 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:08.385180 3.208968 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 4 1053 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:11:11.767480 0.000000 udp 10.0.2.105 7010 -> 216.153.41.210 5832 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:18.209320 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:24.218099 0.000000 udp 10.0.2.105 7010 -> 162.205.97.6 1458 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:29.064949 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:11:30.977718 0.000000 udp 10.0.2.105 7010 -> 176.250.168.18 4637 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:37.236798 0.000000 udp 10.0.2.105 7010 -> 222.96.230.154 4347 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:43.125120 0.000000 udp 10.0.2.105 7010 -> 5.158.173.86 1941 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:50.525731 0.000000 udp 10.0.2.105 7010 -> 78.161.128.203 5443 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:11:55.061921 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:11:58.237315 0.000000 udp 10.0.2.105 7010 -> 86.149.186.31 1721 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:07.219866 0.000000 udp 10.0.2.105 7010 -> 95.14.74.88 1777 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:13.008317 0.000000 udp 10.0.2.105 7010 -> 66.133.206.139 9176 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:20.739793 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:25.565930 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:12:26.257279 0.000000 udp 10.0.2.105 7010 -> 81.147.148.210 7220 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:31.484566 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:36.862601 0.000000 udp 10.0.2.105 7010 -> 95.245.228.110 2254 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:44.493709 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:53.356026 0.000000 udp 10.0.2.105 7010 -> 89.143.74.63 9630 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:12:58.062895 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:12:59.825341 0.000000 udp 10.0.2.105 7010 -> 80.232.221.58 4344 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:07.336620 0.000000 udp 10.0.2.105 7010 -> 75.6.136.137 8501 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:15.918831 0.000000 udp 10.0.2.105 7010 -> 202.63.127.18 4933 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:22.708480 0.000000 udp 10.0.2.105 7010 -> 31.211.237.198 8269 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:27.565113 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:13:28.196117 0.000000 udp 10.0.2.105 7010 -> 94.34.249.99 9141 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:33.613995 0.000000 udp 10.0.2.105 7010 -> 94.172.160.167 4788 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:39.889671 0.000000 udp 10.0.2.105 7010 -> 207.250.135.98 8219 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:48.445249 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:53.061828 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:13:54.353680 0.000000 udp 10.0.2.105 7010 -> 68.83.178.236 1262 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:13:59.661543 0.000000 udp 10.0.2.105 7010 -> 87.234.200.227 7696 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:05.982128 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:12.379725 0.000000 udp 10.0.2.105 7010 -> 67.167.30.251 9503 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:17.066191 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:14:18.358443 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:24.517011 0.000000 udp 10.0.2.105 7010 -> 174.75.66.37 7814 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:33.299901 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:38.757525 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:43.572004 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:14:46.418754 0.000000 udp 10.0.2.105 7010 -> 93.64.164.99 6772 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:52.166749 0.000000 udp 10.0.2.105 7010 -> 95.245.48.1 5580 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:14:57.725094 0.000000 udp 10.0.2.105 7010 -> 24.47.1.92 2207 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:06.237312 0.000000 udp 10.0.2.105 7010 -> 2.177.221.75 4373 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:11.063583 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:15:13.037213 0.000000 udp 10.0.2.105 7010 -> 165.123.243.167 6856 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:19.506065 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:27.777926 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:36.440638 0.000000 udp 10.0.2.105 7010 -> 211.120.147.181 6053 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:41.069259 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:15:43.369988 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:48.848659 0.229164 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:15:49.114175 0.000000 udp 10.0.2.105 7010 -> 188.9.38.194 8087 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:15:55.758214 0.000000 udp 10.0.2.105 7010 -> 96.43.186.72 2901 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:03.809965 0.000000 udp 10.0.2.105 7010 -> 68.96.153.21 9449 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:08.566509 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:16:10.860213 0.000000 udp 10.0.2.105 7010 -> 81.133.16.59 8184 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:18.040185 0.000000 udp 10.0.2.105 7010 -> 216.67.11.60 6318 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:22.538996 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 15:16:23.127627 0.000000 udp 10.0.2.105 7010 -> 86.128.184.84 6597 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:29.546945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:16:31.980180 0.000000 udp 10.0.2.105 7010 -> 90.49.223.96 6012 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:36.566679 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:16:37.548274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:16:40.031958 0.000000 udp 10.0.2.105 7010 -> 79.43.4.213 4409 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:47.242677 0.000000 udp 10.0.2.105 7010 -> 211.232.37.5 1289 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:16:53.551403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:16:55.800897 0.000000 udp 10.0.2.105 7010 -> 189.236.130.244 6210 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:00.562038 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:17:03.030520 0.000000 udp 10.0.2.105 7010 -> 75.149.202.57 9803 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:08.472895 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:14.451835 0.000000 udp 10.0.2.105 7010 -> 77.102.117.190 6754 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:23.070302 0.000000 udp 10.0.2.105 7010 -> 80.176.166.97 6550 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:25.558932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:17:28.060938 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:17:31.566249 0.181777 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:17:31.785749 0.000000 udp 10.0.2.105 7010 -> 187.114.102.208 6854 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:38.756396 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:44.123697 0.000000 udp 10.0.2.105 7010 -> 76.14.115.86 6591 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:49.301507 0.000000 udp 10.0.2.105 7010 -> 65.96.250.136 8678 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:17:54.068603 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:17:56.992954 0.000000 udp 10.0.2.105 7010 -> 173.196.222.249 1570 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:04.303265 0.000000 udp 10.0.2.105 7010 -> 65.183.101.216 5331 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:11.333383 0.000000 udp 10.0.2.105 7010 -> 71.227.13.152 8556 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:17.251726 0.000000 udp 10.0.2.105 7010 -> 62.94.216.127 2207 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:22.068936 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:18:26.155759 0.219083 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 679 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:18:26.543133 0.000000 udp 10.0.2.105 7010 -> 78.6.121.163 1040 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:33.595327 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:41.326845 0.000000 udp 10.0.2.105 7010 -> 74.122.66.102 3480 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:46.063014 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:18:46.714247 0.000000 udp 10.0.2.105 7010 -> 50.124.44.158 6656 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:18:52.883201 0.000000 udp 10.0.2.105 7010 -> 88.207.189.89 5091 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:00.834550 0.000000 udp 10.0.2.105 7010 -> 82.21.57.81 2107 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:07.143718 0.075737 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:19:07.287330 0.000000 udp 10.0.2.105 7010 -> 81.108.249.65 2974 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:12.070005 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:19:12.561439 0.000000 udp 10.0.2.105 7010 -> 202.191.162.51 1058 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:21.123657 0.000000 udp 10.0.2.105 7010 -> 187.172.131.192 7906 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:28.834593 0.000000 udp 10.0.2.105 7010 -> 123.243.15.11 5336 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:35.564928 0.000000 udp 10.0.2.105 7010 -> 182.237.17.227 8132 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:40.561532 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:19:41.803613 0.000000 udp 10.0.2.105 7010 -> 217.155.158.110 6469 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:48.152726 0.000000 udp 10.0.2.105 7010 -> 209.163.221.126 5775 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:19:53.941038 0.000000 udp 10.0.2.105 7010 -> 80.13.160.104 3639 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:00.619835 0.000000 udp 10.0.2.105 7010 -> 174.33.231.19 3509 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:05.567264 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:20:06.949470 0.000000 udp 10.0.2.105 7010 -> 67.185.95.78 9842 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:12.117006 0.000000 udp 10.0.2.105 7010 -> 118.39.80.146 3821 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:17.169167 0.000000 udp 10.0.2.105 7010 -> 41.202.232.66 5278 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:24.326401 0.000000 udp 10.0.2.105 7010 -> 41.87.24.162 1135 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:29.371635 0.000000 udp 10.0.2.105 7010 -> 83.28.62.159 1540 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:34.068433 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:20:35.660785 0.000000 udp 10.0.2.105 7010 -> 89.241.148.141 1236 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:44.423356 0.052304 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:20:44.615036 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:52.114193 0.000000 udp 10.0.2.105 7010 -> 219.74.86.103 5848 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:57.912791 0.042827 udp 10.0.2.105 7010 -> 89.12.163.33 6578 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:20:57.955618 0.000000 icmp 89.12.163.33 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 148 flow=Background 1970/01/25 15:21:02.569375 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:21:04.102114 0.000000 udp 10.0.2.105 7010 -> 64.164.240.14 5817 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:12.528382 0.104326 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 862 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:21:12.655339 0.000000 udp 10.0.2.105 7010 -> 94.160.113.129 4991 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:20.205000 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:26.453584 0.045561 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:21:26.531293 0.000000 udp 10.0.2.105 7010 -> 184.21.106.179 4748 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:31.069981 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:21:31.991884 0.000000 udp 10.0.2.105 7010 -> 50.131.75.157 3945 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:37.589674 0.000000 udp 10.0.2.105 7010 -> 75.119.44.42 4107 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:44.501021 0.075654 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:21:44.866753 0.000000 udp 10.0.2.105 7010 -> 93.67.37.157 7731 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:53.232260 0.000000 udp 10.0.2.105 7010 -> 69.154.78.150 1623 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:21:58.070934 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:22:00.513070 0.073800 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:22:00.768173 0.000000 udp 10.0.2.105 7010 -> 207.144.227.87 9675 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:08.353945 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:15.233780 0.000000 udp 10.0.2.105 7010 -> 68.106.77.14 8077 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:20.912054 0.000000 udp 10.0.2.105 7010 -> 203.45.44.43 2098 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:25.568611 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:22:25.929491 0.030266 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:22:26.046045 0.000000 udp 10.0.2.105 7010 -> 95.227.129.17 2466 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:34.201417 0.000000 udp 10.0.2.105 7010 -> 80.195.168.162 2526 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:41.111132 0.083851 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:22:41.217205 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:47.140187 0.000000 udp 10.0.2.105 7010 -> 41.68.166.246 4629 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:52.067199 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:22:53.339222 0.000000 udp 10.0.2.105 7010 -> 151.225.163.217 4446 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:22:59.447569 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:07.348883 0.000000 udp 10.0.2.105 7010 -> 178.24.100.150 7395 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:12.996831 0.000000 udp 10.0.2.105 7010 -> 69.207.135.48 2970 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:17.563295 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:23:20.938160 0.000000 udp 10.0.2.105 7010 -> 151.74.44.230 7701 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:28.990142 0.000000 udp 10.0.2.105 7010 -> 81.157.215.16 6633 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:29.563753 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 15:23:36.010060 0.223272 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:23:36.294991 0.000000 udp 10.0.2.105 7010 -> 95.250.43.194 4364 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:36.570667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:23:41.918846 0.000000 udp 10.0.2.105 7010 -> 82.46.102.116 5176 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:44.572457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:23:46.564990 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:23:47.206393 0.000000 udp 10.0.2.105 7010 -> 98.198.27.240 3257 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:23:56.088980 1.738971 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:23:57.944568 0.071668 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:24:00.575261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:24:32.581811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:30:22.344646 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:30:22.344798 0.995347 tcp 10.0.2.105 57721 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:30:36.586935 3.001934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:30:43.594800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:30:51.596155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:31:07.599217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:31:39.605170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:37:43.610407 3.002574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:37:50.618564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:37:58.619984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:38:14.623366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:38:46.629289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:47:44.635466 3.001799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:47:51.642777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:47:59.644533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:48:15.647520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:48:47.653165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:54:24.227668 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 15:54:24.227906 0.043610 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:24.271867 0.059351 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:24.331534 0.052673 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:24.384584 0.737815 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.122781 0.098662 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.221860 0.359427 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.581681 0.057405 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.639519 0.143222 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.783122 0.080602 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.864078 0.044804 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:25.909177 0.165565 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:26.075101 0.179935 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:26.255440 0.142762 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:26.398567 0.151644 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:26.550635 0.170802 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:26.721802 0.000000 udp 10.0.2.105 7010 -> 217.253.14.40 5550 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:54:42.265759 0.065003 tcp 10.0.2.105 57722 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:42.330981 0.053455 tcp 10.0.2.105 57723 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:42.384683 0.150700 tcp 10.0.2.105 57724 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:42.535885 0.074663 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:42.610905 0.057417 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:42.668705 0.197298 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:42.866406 0.034846 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:42.901586 0.258676 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:43.160672 0.179753 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:43.340842 0.188575 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:43.529804 0.179154 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:43.709337 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 15:54:51.659222 3.002506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 15:54:58.668827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:54:58.809199 0.065391 tcp 10.0.2.105 57725 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:58.874873 0.055217 tcp 10.0.2.105 57726 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:58.930370 0.147265 tcp 10.0.2.105 57727 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/25 15:54:59.078275 0.179722 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.258362 0.213024 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.471835 0.067696 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.539857 0.052037 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.592276 0.105400 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.698062 0.038524 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.736919 0.068910 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.806203 0.065544 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.872190 0.026352 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.898888 0.074072 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:54:59.973334 0.303943 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:55:00.277648 0.181236 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:55:00.459269 0.071515 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 15:55:06.668141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:55:22.671405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 15:55:54.677515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:00:23.344074 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 16:00:23.344403 0.965055 tcp 10.0.2.105 57728 -> 128.255.183.224 9027 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:01:58.682438 3.002707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:02:05.690684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:02:13.692086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:02:29.695623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:03:01.701386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:09:05.707174 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:09:12.714536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:09:20.716446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:09:36.719064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:10:08.725258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:16:12.731578 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:16:19.739313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:16:27.745120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:16:43.749473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:17:15.748988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:23:19.756844 3.007052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:23:26.763196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:23:34.766494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:23:50.768459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:24:22.773552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:25:09.833564 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 16:25:09.833719 0.000000 udp 10.0.2.105 7010 -> 217.253.14.40 5550 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 16:25:28.549572 0.064656 tcp 10.0.2.105 57729 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:28.614498 0.054437 tcp 10.0.2.105 57730 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:28.669202 0.124322 tcp 10.0.2.105 57731 -> 195.113.214.236 443 SRPA* 0 0 33 23891 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:28.794090 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 16:25:45.913427 0.064874 tcp 10.0.2.105 57732 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:45.978655 0.054841 tcp 10.0.2.105 57733 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:46.033824 0.147354 tcp 10.0.2.105 57734 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:25:46.182232 0.058872 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.241503 0.042008 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.283883 0.051695 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.335932 0.371045 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.707342 0.057064 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.764793 0.145445 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:46.910607 0.163189 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.074254 0.065199 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.139865 0.179449 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.319741 0.044462 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.364649 0.144831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.509867 0.171042 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.681337 0.081963 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.763716 0.140256 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:47.904392 0.165949 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.070774 0.082006 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.153190 0.031360 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.184914 0.263079 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.448511 0.177924 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.626823 0.199271 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:48.826510 0.179817 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.006752 0.056433 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.063612 0.203398 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.267476 0.180419 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.448211 0.212367 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.660939 0.073278 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.734580 0.051811 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.786764 0.102758 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.889914 0.038465 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:49.928889 0.073476 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.002779 0.072012 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.075206 0.025939 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.101511 0.075237 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.177142 0.069628 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.247158 0.206768 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:25:50.454345 0.173740 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:30:24.313250 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 16:30:24.313471 0.963732 tcp 10.0.2.105 57735 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/25 16:30:26.780611 2.999726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 16:30:33.786433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:30:41.788392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:30:57.791064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:31:29.797173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:37:33.803261 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:37:40.810532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:37:48.813287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:38:04.815082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:38:36.821307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:47:37.831623 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:47:44.839298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:47:52.840816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:48:08.843447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:48:40.849450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:54:44.856437 3.000875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 16:54:51.863497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:54:59.864486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:55:15.868073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:55:47.873426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 16:55:57.191158 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 16:55:57.191446 0.054746 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.246640 0.056063 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.303074 0.058083 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.361541 0.336192 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.698108 0.057237 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.755747 0.143852 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:57.899975 0.160048 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.060575 0.065432 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.126359 0.181028 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.307796 0.043948 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.352487 0.081022 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.433874 0.144555 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.578795 0.167016 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.746242 0.078067 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.824677 0.031414 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:58.856416 0.144684 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:59.001502 0.170344 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:59.172367 0.267656 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:59.440563 0.179253 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:59.620193 0.260100 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:55:59.880720 0.174787 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.055879 0.055324 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.111581 0.196379 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.308386 0.180254 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.489031 0.228722 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.718184 0.069389 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.787966 0.051982 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.840392 0.105631 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.946444 0.038568 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:00.985400 0.071076 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.056848 0.066410 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.123650 0.025429 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.149373 0.076324 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.226113 0.071322 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.297775 0.210630 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 16:56:01.508899 0.169707 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:00:25.283180 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 17:00:25.283354 0.982325 tcp 10.0.2.105 57736 -> 128.255.183.224 9027 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/01/25 17:01:51.880204 3.000832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 17:01:58.887611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:02:06.888900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:02:22.891238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:02:54.902059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:08:58.903001 3.002146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:09:05.910752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:09:13.912553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:09:29.915603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:10:01.921528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:16:05.927640 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:16:12.934963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:16:20.936710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:16:36.939374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:17:08.947173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:23:12.951459 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:23:19.958903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:23:27.960217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:23:43.968024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:24:15.974766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:26:18.649169 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 17:26:18.649354 0.045458 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:18.695189 0.346333 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:19.041931 0.060168 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:19.102491 0.055880 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:19.158766 0.058912 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:19.218082 0.141285 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:19.359741 0.816765 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.176944 0.065530 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.242866 0.178933 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.422180 0.044190 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.466778 0.083480 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.550694 0.142582 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.693662 0.165104 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.859181 0.084229 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.943824 0.033017 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:20.977245 0.138001 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:21.115710 0.170543 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:21.286625 0.246866 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:21.533875 0.179317 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:21.713581 0.244412 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:21.958378 0.173137 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.131903 0.058525 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.190806 0.197422 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.388593 0.177784 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.566802 0.218170 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.785385 0.071408 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.857206 0.052118 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:22.909737 0.106103 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.016172 0.038551 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.055049 0.071216 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.126647 0.064283 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.191255 0.026348 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.217948 0.077276 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.295586 0.177421 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.473400 0.071033 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:26:23.544782 0.431295 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:30:19.975928 3.001082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:30:26.272897 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 17:30:26.273048 0.927738 tcp 10.0.2.105 57737 -> 128.255.183.224 9027 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/01/25 17:30:26.982909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:30:34.984111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:30:50.987911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:31:22.993557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:37:26.999322 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:37:34.006892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:37:42.008698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:37:58.011663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:38:30.017702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:47:32.031841 2.999637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:47:39.037267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:47:47.038664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:48:03.041382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:48:35.048440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:54:39.053201 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 17:54:46.060795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:54:54.063053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:55:10.065241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:55:42.071360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 17:56:53.825343 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 17:56:53.825499 0.057607 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:53.883467 0.056540 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:53.940422 0.058908 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:53.999707 0.143729 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.143847 0.045318 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.189537 0.317533 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.507440 0.201344 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.709170 0.065322 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.774882 0.185755 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:54.961012 0.046184 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.007565 0.073618 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.081552 0.146364 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.228497 0.166271 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.395161 0.086751 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.482275 0.032247 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.514863 0.144909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.660146 0.173431 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:55.833968 0.250337 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.084662 0.181699 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.266708 0.251828 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.518901 0.173979 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.693308 0.055452 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.749143 0.197749 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:56.947292 0.179293 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.126989 0.224403 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.351810 0.070961 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.423158 0.052276 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.475802 0.098497 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.574622 0.152459 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.727450 0.070469 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.798282 0.066038 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.864665 0.025996 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.890989 0.073065 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:57.964593 0.208964 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:58.173965 0.177783 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/25 17:56:58.352146 0.068846 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:00:27.201925 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 18:00:27.202021 0.922650 tcp 10.0.2.105 57738 -> 128.255.183.224 9027 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/01/25 18:01:46.077201 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 18:01:53.084921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:02:01.086184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:02:17.089327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:02:49.095233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:08:53.100909 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:09:00.108669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:09:08.110100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:09:24.113220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:09:56.118935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:16:00.125898 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:16:07.133112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:16:15.139518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:16:31.137247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:17:03.143313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:23:07.150144 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:23:14.156579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:23:22.203349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:23:38.171142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:24:10.177121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:27:26.780337 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 18:27:26.780551 0.056586 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:26.837545 0.057864 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:26.895803 0.056567 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:26.952770 0.366697 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:27.319858 0.340011 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:27.660224 0.065034 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:27.725635 0.145276 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:27.871333 0.045959 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:27.917639 0.175311 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.093311 0.046343 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.140040 0.078482 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.218970 0.137966 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.357348 0.165651 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.523401 0.084856 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.608617 0.034800 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.643797 0.151918 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.796120 0.170520 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:28.967066 0.249245 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:29.216671 0.178111 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:29.395177 0.264853 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:29.660497 0.172406 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:29.833275 0.180703 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.014406 0.215571 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.230381 0.071932 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.302747 0.052051 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.355179 0.101788 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.457350 0.069595 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.527339 0.196774 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.724651 0.039225 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.764217 0.068783 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:30.833339 0.607632 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:31.441389 0.025840 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:31.467615 0.083563 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:31.551568 0.209486 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:31.761438 0.173765 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:27:31.935644 0.072969 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:30:14.184088 3.000617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:30:21.190185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:30:28.130828 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 18:30:28.130924 1.083510 tcp 10.0.2.105 57739 -> 128.255.183.224 9027 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/25 18:30:29.191975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:30:45.194850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:31:17.200999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:37:21.207154 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:37:28.215268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:37:36.215857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:37:52.219116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:38:24.224931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:47:26.237006 3.001906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:47:33.244455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:47:41.246560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:47:57.249854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:48:29.255057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:54:33.261436 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 18:54:40.268758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:54:48.270133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:55:04.272818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:55:36.283159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 18:57:32.807008 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 18:57:32.807269 0.054701 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:32.862400 0.313962 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.176770 0.060149 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.237310 0.057586 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.295242 0.450626 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.746261 0.067736 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.814564 0.142200 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:33.957205 0.045531 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.003089 0.183634 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.187194 0.039914 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.227643 0.082342 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.310319 0.142553 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.453258 0.033147 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.486732 0.145165 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.632593 0.235302 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:34.868295 0.269181 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:35.137858 0.167856 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:35.306120 0.085818 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:35.392446 0.179481 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:35.572386 0.268702 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:35.841473 0.179539 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.021420 0.179585 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.201405 0.227651 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.429446 0.135185 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.565007 0.052193 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.617589 0.196054 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.814032 0.039052 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.853451 0.069768 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:36.923594 0.102580 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.026556 0.059929 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.086884 0.066591 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.153878 0.026599 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.180808 0.077448 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.258642 0.242009 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.501029 0.181095 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 18:57:37.682531 0.070023 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:00:29.220970 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 19:00:29.221082 0.977286 tcp 10.0.2.105 57740 -> 128.255.183.224 9027 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/01/25 19:01:40.284501 3.002362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 19:01:47.292202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:01:55.293866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:02:11.299745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:02:43.303127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:08:47.309395 3.001186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:08:54.321912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:09:02.317907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:09:18.321288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:09:50.327050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:15:54.333016 3.001615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:16:01.340007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:16:09.341784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:16:25.345582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:16:57.357267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:23:01.356248 3.002280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:23:08.367351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:23:16.368470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:23:32.373093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:24:04.374805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:27:57.509835 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 19:27:57.510016 0.055669 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:57.566053 0.057543 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:57.623963 0.159379 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:57.783743 0.102546 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:57.886673 0.144410 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.031428 0.313698 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.345528 0.062164 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.408105 0.043931 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.452386 0.182300 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.635043 0.044105 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.679559 0.083110 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.763060 0.143560 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.906962 0.031740 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:58.939154 0.151632 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.091226 0.174130 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.265759 0.293995 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.560136 0.167118 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.727662 0.085578 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.813680 0.177710 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:27:59.991839 0.246880 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.239113 0.178823 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.418368 0.179695 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.598441 0.213221 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.812186 0.070669 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.883258 0.052018 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:00.935636 0.203030 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.139106 0.039024 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.178493 0.077720 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.256612 0.100963 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.357978 0.057284 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.415758 0.068510 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.484659 0.025418 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.510467 0.076186 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.587082 0.075302 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.662795 0.207362 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:28:01.870549 0.182695 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:30:08.380079 3.002559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:30:15.388377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:30:23.389450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:30:30.199810 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 19:30:30.199968 0.982622 tcp 10.0.2.105 57741 -> 128.255.183.224 9027 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/01/25 19:30:39.392825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:31:11.398232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:37:15.404202 3.002459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:37:22.412101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:37:30.413621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:37:46.416683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:38:18.423042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:44:22.429535 3.000483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:44:29.436191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:44:37.437440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:44:53.440750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:45:25.446811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:51:29.453714 3.000388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:51:36.459775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:51:44.462053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:52:00.464619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:52:32.470569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:58:13.371152 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 19:58:13.371323 0.155080 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:13.526849 0.069590 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:13.596807 0.140946 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:13.738159 0.326613 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.065165 0.055342 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.121091 0.058141 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.179567 0.059472 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.239355 0.041947 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.281612 0.184251 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.466248 0.039752 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.506328 0.076290 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.582977 0.141884 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.725237 0.038571 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.764384 0.137996 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:14.902802 0.170335 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:15.073513 0.289123 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:15.363037 0.167146 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:15.530576 0.084174 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:15.615121 0.182870 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:15.798393 0.214637 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:16.013400 0.174091 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:16.187911 0.179758 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:16.368336 0.211600 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:16.580494 0.072223 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:16.653150 0.000000 udp 10.0.2.105 7010 -> 129.242.134.23 1751 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 19:58:33.611415 0.066622 tcp 10.0.2.105 57742 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 19:58:33.678255 0.052641 tcp 10.0.2.105 57743 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 19:58:33.731059 0.105028 tcp 10.0.2.105 57744 -> 195.113.214.236 443 SRPA* 0 0 60 38129 flow=From-Botnet-V2-TCP-Established 1970/01/25 19:58:33.836373 0.232491 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.069257 0.039517 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.109114 0.067968 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.177400 0.104603 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.282402 0.025972 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.308695 0.077201 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.386276 0.068812 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.455486 0.215881 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.671733 0.178178 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.850284 0.056140 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:34.906752 0.065928 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/25 19:58:36.475650 3.002142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 19:58:43.483819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:58:51.485462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:59:07.488720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 19:59:39.494634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:00:31.189572 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 20:00:31.189657 0.974873 tcp 10.0.2.105 57745 -> 128.255.183.224 9027 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:05:43.500870 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:05:50.508009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:05:58.509292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:06:14.513252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:06:46.518290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:12:50.524585 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:12:57.531849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:13:05.533280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:13:21.536933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:13:53.542687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:19:57.547921 3.002141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:20:04.555357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:20:12.557406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:20:28.560199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:21:00.565983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:27:04.572530 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:27:11.579475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:27:19.581368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:27:35.584557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:28:07.589793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:28:46.236452 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 20:28:46.236589 0.051937 udp 10.0.2.105 7010 -> 129.242.134.23 1751 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 20:28:46.288526 0.000000 icmp 129.242.134.23 0x0303 -> 10.0.2.105 0xd706 URP 192 1 188 flow=Background 1970/01/25 20:29:01.499412 0.062794 tcp 10.0.2.105 57746 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:01.562466 0.053519 tcp 10.0.2.105 57747 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:01.616250 0.147385 tcp 10.0.2.105 57748 -> 195.113.214.236 443 SRPA* 0 0 59 42620 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:01.763840 0.144249 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:01.908519 0.171405 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.080557 0.069374 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.150308 0.059772 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.210452 0.059878 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.270684 0.044035 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.315077 0.178356 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.493831 0.045447 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.539630 0.082939 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.622931 0.324649 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:02.947977 0.060122 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.008495 0.137302 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.146178 0.172108 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.318669 0.293120 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.612155 0.167015 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.779512 0.143503 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.923418 0.031755 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:03.955577 0.206615 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:04.162637 0.172918 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:04.335920 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 20:29:20.456278 0.060829 tcp 10.0.2.105 57749 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:20.517362 0.052954 tcp 10.0.2.105 57750 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:20.570618 0.143497 tcp 10.0.2.105 57751 -> 195.113.214.236 443 SRPA* 0 0 20 11314 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:29:20.714644 0.177965 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:20.893035 0.084960 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:20.978387 0.067129 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.045905 0.213161 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.259448 0.196541 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.456445 0.045039 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.501873 0.070105 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.572424 0.113035 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.685878 0.026170 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.712566 0.078980 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.791962 0.075497 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:21.867878 0.208543 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:22.076807 0.176839 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:22.254060 0.056821 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:29:22.311310 0.067831 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:30:32.168838 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 20:30:32.169027 0.994938 tcp 10.0.2.105 57752 -> 128.255.183.224 9027 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/01/25 20:34:11.597043 3.005754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 20:34:18.606029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:34:26.605271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:34:42.609826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:35:14.615863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:41:18.620398 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:41:25.627748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:41:33.629448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:41:49.632171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:42:21.638339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:49:32.651233 3.001033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:49:39.657929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:49:47.659689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:50:03.662744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:50:35.668573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:56:49.679239 3.007770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 20:56:56.695476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:57:04.688206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:57:20.691058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:57:52.696946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 20:59:39.881797 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 20:59:39.881889 0.182384 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.064666 0.069289 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.134286 0.058951 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.193603 0.059919 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.253901 0.043096 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.297355 0.145450 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.443200 0.173888 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.617485 0.044668 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.662553 0.082334 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:40.745290 0.348284 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.093966 0.179870 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.274230 0.151751 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.426371 0.170479 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.597227 0.056724 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.654308 0.144581 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.799293 0.036003 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:41.835674 0.218221 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.054299 0.182266 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.236995 0.291210 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.528627 0.168053 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.697099 0.072617 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.770145 0.212295 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:42.982838 0.179179 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.162418 0.099150 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.262006 0.204327 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.466738 0.039233 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.506307 0.075002 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.581708 0.102952 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.685021 0.026158 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.711544 0.074971 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.786889 0.071834 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:43.859071 0.211193 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:44.070622 0.173593 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:44.244602 0.060011 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 20:59:44.304973 0.069399 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:00:33.168242 0.967444 tcp 10.0.2.105 57753 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/25 21:03:59.707406 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 21:04:06.714705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:04:14.717088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:04:30.719365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:05:02.725448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:11:06.730943 3.002863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:11:13.739125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:11:21.740387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:11:37.743608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:12:09.749435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:18:13.755368 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:18:20.762856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:18:28.764019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:18:44.767654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:19:16.773240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:25:20.779978 3.000931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:25:27.786664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:25:35.790651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:25:51.791086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:26:23.797209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:30:06.738427 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 21:30:06.738572 0.179287 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:06.918239 0.069433 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:06.988047 0.059954 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.048557 0.058564 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.107499 0.053949 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.161880 0.146063 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.308359 0.161851 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.470618 0.045234 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.516445 0.094587 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.611419 0.145035 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.756944 0.170957 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.928317 0.058946 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:07.987629 0.338113 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:08.326113 0.181879 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:08.508395 0.140016 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:08.648787 0.032099 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:08.681200 0.187884 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:08.869478 0.180989 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:09.050841 0.287331 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:09.338599 0.213100 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:09.552137 0.169682 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:09.722166 0.084203 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:09.806780 0.197776 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.004981 0.038377 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.043749 0.166060 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.210289 0.076571 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.287322 0.073964 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.361701 0.101010 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.463105 0.025930 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.489364 0.071114 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.560844 0.074746 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.636054 0.217310 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:10.853780 0.183642 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:11.037769 0.056306 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:11.094429 0.071407 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/25 21:30:34.137869 0.979913 tcp 10.0.2.105 57754 -> 128.255.183.224 9027 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/01/25 21:32:27.802412 3.002505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:32:34.810923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:32:42.816849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:32:58.815002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:33:30.821298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:39:34.827790 3.001938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:39:41.834082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:39:49.837607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:40:05.838980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:40:37.845271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:48:40.858037 3.000594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:48:47.860690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:48:55.861030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:49:11.864267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:49:43.870093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:55:47.876035 3.002193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 21:55:54.883456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:56:02.885157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:56:18.888298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 21:56:50.893948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:00:35.117290 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 22:00:35.117440 0.953406 tcp 10.0.2.105 57755 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/25 22:00:37.360027 0.059848 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.420458 0.062399 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.483161 0.044810 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.528451 0.144728 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.673573 0.181953 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.855921 0.081658 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:37.937947 0.216746 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.155084 0.043847 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.199307 0.078697 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.278455 0.145119 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.423958 0.170482 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.594838 0.058518 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.653709 0.326032 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:38.980124 0.183033 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.163559 0.143401 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.307310 0.037701 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.345377 0.185181 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.530970 0.180058 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.711430 0.287593 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:39.999430 0.087333 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.087125 0.197592 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.285146 0.038926 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.324550 0.165956 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.490907 0.068913 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.560211 0.071834 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.632484 0.212194 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:40.845069 0.171031 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.016486 0.102526 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.119420 0.026239 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.145962 0.075229 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.221549 0.076592 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.298593 0.219202 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.518565 0.179677 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.698653 0.054907 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:00:41.753896 0.000000 udp 10.0.2.105 7010 -> 86.138.252.68 9315 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 22:00:57.130867 0.067019 tcp 10.0.2.105 57756 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 22:00:57.198229 0.053954 tcp 10.0.2.105 57757 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 22:00:57.252555 0.148170 tcp 10.0.2.105 57758 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/25 22:02:54.901073 3.002225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:03:01.910030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:03:09.908925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:03:25.912688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:03:57.918187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:10:01.925244 3.000540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:10:08.931573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:10:16.933476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:10:32.936078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:11:04.941986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:17:08.956848 3.004444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:17:15.968801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:17:23.961544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:17:39.959990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:18:11.966151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:24:15.972862 3.000826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:24:22.983352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:24:30.980914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:24:46.983923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:25:18.990146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:30:36.076705 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 22:30:36.076961 0.950476 tcp 10.0.2.105 57759 -> 128.255.183.224 9027 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/01/25 22:31:03.365292 0.070567 udp 10.0.2.105 7010 <-> 86.138.252.68 9315 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.436369 0.042830 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.479593 0.146098 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.626100 0.180765 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.807244 0.074664 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.882325 0.059181 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:03.941870 0.060555 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.002808 0.040597 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.043753 0.075177 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.119298 0.137940 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.257632 0.171142 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.429188 0.060483 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.490179 0.339793 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.830362 0.160342 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:04.991103 0.111204 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:05.102746 0.201697 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:05.304900 0.147584 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:05.452855 0.181165 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:05.634385 0.287569 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:05.922341 0.079873 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.002614 0.174246 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.177292 0.205811 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.383487 0.166116 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.549946 0.098463 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.648746 0.073367 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.722487 0.210881 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:06.933725 0.168919 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.102990 0.099332 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.202712 0.026543 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.229631 0.076994 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.307051 0.072450 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.379884 0.038488 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.418739 0.179164 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.598359 0.209039 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:07.807742 0.054281 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/25 22:31:08.061734 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 22:31:22.995717 3.001811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 22:31:30.003719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:31:38.004938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:31:54.007917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:32:26.013774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:38:30.021048 3.000498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:38:37.027738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:38:45.029103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:39:01.031877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:39:33.038133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:48:09.051884 3.002230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:48:16.059979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:48:24.061330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:48:40.064439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:49:12.070004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:55:16.083843 2.994258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 22:55:23.089618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:55:31.086297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:55:47.089049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 22:56:19.094576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:00:37.025674 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 23:00:37.025827 0.967185 tcp 10.0.2.105 57760 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:01:25.975953 0.000000 udp 10.0.2.105 7010 -> 86.138.252.68 9315 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 23:01:30.562224 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 23:01:43.142251 0.066902 tcp 10.0.2.105 57761 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:01:43.209374 0.053925 tcp 10.0.2.105 57762 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:01:43.263609 0.144974 tcp 10.0.2.105 57763 -> 195.113.214.236 443 SRPA* 0 0 40 20402 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:01:43.409093 0.044324 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.453721 0.148340 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.602456 0.179204 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.782039 0.065504 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.847920 0.059571 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.907843 0.057388 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:43.965657 0.525522 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:44.491598 0.079332 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:44.571339 0.144706 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:44.716709 0.343328 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.060404 0.159314 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.220137 0.056198 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.276694 0.185724 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.462785 0.171327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.634499 0.057981 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.692885 0.146830 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:45.840139 0.175484 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.016040 0.286172 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.302598 0.083067 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.386085 0.180843 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.567318 0.206331 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.774031 0.168247 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:46.942640 0.079687 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.022708 0.073217 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.096350 0.212856 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.309556 0.179320 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.489268 0.181533 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.671197 0.029817 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.701401 0.077642 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.779443 0.072319 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:47.852115 0.219438 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:48.071955 0.056613 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:48.128944 0.039094 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:01:48.168432 0.182361 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:02:28.107197 3.002183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/25 23:02:35.115109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:02:43.117275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:02:59.119370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:03:31.125514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:09:35.131741 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:09:42.139000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:09:50.140672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:10:06.143776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:10:38.149687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:16:53.161859 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:17:00.177050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:17:08.176508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:17:24.178594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:17:56.179355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:24:00.186164 3.003290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:24:07.194744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:24:15.200683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:24:31.199326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:25:03.203219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:30:37.996058 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 23:30:37.996377 0.984023 tcp 10.0.2.105 57764 -> 128.255.183.224 9027 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:31:08.211662 3.000897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:31:15.218311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:31:23.219741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:31:39.223001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:31:56.768481 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/25 23:31:56.768671 0.000000 udp 10.0.2.105 7010 -> 86.138.252.68 9315 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/25 23:32:11.229121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:32:13.333772 0.066956 tcp 10.0.2.105 57765 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:32:13.400998 0.056688 tcp 10.0.2.105 57766 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:32:13.457951 0.143233 tcp 10.0.2.105 57767 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/25 23:32:13.601701 0.042829 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:13.644910 0.148245 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:13.793573 0.181433 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:13.975447 0.073246 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.049082 0.055605 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.105072 0.061959 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.167438 0.043896 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.211731 0.077583 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.289712 0.151893 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.441986 0.326485 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.768884 0.159954 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.929197 0.058970 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:14.988511 0.185934 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.174831 0.170544 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.345760 0.062950 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.409125 0.145143 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.554652 0.181529 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.736694 0.175244 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:15.912414 0.205507 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.118320 0.166079 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.284787 0.071099 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.356287 0.074269 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.430897 0.291823 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.723168 0.086289 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:16.809848 0.213330 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.023567 0.170439 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.194366 0.102721 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.297463 0.031046 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.328861 0.077603 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.406792 0.074425 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.481587 0.217893 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.699864 0.057691 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:17.757934 0.242978 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:32:18.001322 0.183133 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/25 23:38:15.234319 3.024514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:38:22.252084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:38:30.253437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:38:46.256760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:39:18.263167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:48:02.280156 3.000375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:48:09.286672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:48:17.287468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:48:33.291021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:49:05.296960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:55:09.302607 3.001915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/25 23:55:16.309878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:55:24.311698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:55:40.314949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/25 23:56:12.320714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:00:38.994456 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 00:00:38.994584 0.978571 tcp 10.0.2.105 57768 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/26 00:02:21.333589 3.002132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:02:28.341259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:02:36.342875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:02:48.090177 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 00:02:48.090402 0.043532 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.134334 0.145405 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.280111 0.180731 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.461212 0.068880 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.530441 0.061588 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.592606 0.059906 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.652851 0.045168 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.698336 0.078647 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:48.777349 0.397487 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:49.175228 0.052276 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:49.227855 0.183897 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:49.412155 0.169992 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:49.582519 0.145006 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:49.727935 0.345916 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.074251 0.062401 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.137049 0.145419 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.282890 0.181547 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.464855 0.181629 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.646817 0.196786 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:50.843968 0.167360 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.011709 0.068759 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.080816 0.076722 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.157920 0.277394 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.435696 0.088195 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.524269 0.213541 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.738193 0.176681 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:51.915293 0.114996 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.030726 0.026473 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.057565 0.209204 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.267176 0.056448 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.324003 0.038524 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.346046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:02:52.362865 0.179934 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.543212 0.077651 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:02:52.621218 0.078250 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:03:24.351924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:09:28.358027 3.001153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:09:35.365033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:09:43.366383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:09:59.369470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:10:31.375838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:16:43.387362 3.004494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:16:50.392681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:16:58.403435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:17:14.395377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:17:46.401241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:23:50.408206 3.000038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:23:57.414708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:24:05.419639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:24:21.418732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:24:53.425371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:30:39.974122 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 00:30:39.974281 0.975082 tcp 10.0.2.105 57769 -> 128.255.183.224 9027 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/01/26 00:30:57.430678 3.002642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:31:04.438903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:31:12.439845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:31:28.443138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:32:00.449936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:32:54.929590 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 00:32:54.929718 0.042621 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:54.972719 0.147236 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.120569 0.180435 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.301397 0.073365 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.375169 0.069503 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.445147 0.055617 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.501158 0.498348 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:55.999971 0.083052 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:56.083383 0.457671 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:56.541508 0.170820 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:56.712721 0.138051 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:56.851180 0.062347 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:56.913917 0.185309 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:57.099596 0.332241 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:57.432225 0.059432 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:57.492012 0.145548 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:57.637949 0.183752 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:57.822066 0.360632 udp 10.0.2.105 7010 <-> 99.189.38.91 8937 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:58.183087 0.205560 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:58.389019 0.071177 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:32:58.460558 0.000000 udp 10.0.2.105 7010 -> 59.99.72.96 9084 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 00:33:16.509827 0.068282 tcp 10.0.2.105 57770 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 00:33:16.578370 0.052529 tcp 10.0.2.105 57771 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 00:33:16.631170 0.164900 tcp 10.0.2.105 57772 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/26 00:33:16.796649 0.085234 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:16.882258 0.213843 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.096526 0.166799 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.263711 0.074120 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.338189 0.172348 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.510929 0.102711 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.614087 0.026004 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.640441 0.209016 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.849862 0.050745 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.900980 0.044643 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:17.946035 0.171657 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:18.118067 0.076949 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:33:18.195408 0.072065 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 00:38:04.455663 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:38:11.462525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:38:19.464306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:38:35.466982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:39:07.473295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:47:58.479162 3.001884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:48:05.490662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:48:13.488153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:48:29.491418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:49:01.497384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:55:05.503317 3.002030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 00:55:12.510877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:55:20.512037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:55:36.515292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 00:56:08.521497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:00:40.974243 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 01:00:40.974434 0.990343 tcp 10.0.2.105 57773 -> 128.255.183.224 9027 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:02:16.552634 3.002143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:02:23.560170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:02:31.561952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:02:47.564791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:03:19.570958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:03:40.631641 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 01:03:40.631894 0.257332 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:40.889584 0.137264 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.027233 0.147075 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.174642 0.057124 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.232241 0.435752 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.668881 0.045646 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.714864 0.077904 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.793176 0.181052 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:41.974874 0.069372 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.044612 0.179730 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.224789 0.043802 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.268981 0.184758 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.454134 0.137974 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.592921 0.170265 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.763589 0.144658 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:42.908647 0.182908 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:43.092165 0.061300 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:43.153770 0.329823 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:43.483946 0.199457 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:43.683785 0.000000 udp 10.0.2.105 7010 -> 99.189.38.91 8937 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 01:03:59.100197 0.067826 tcp 10.0.2.105 57774 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:03:59.168284 0.052511 tcp 10.0.2.105 57775 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:03:59.220986 0.148408 tcp 10.0.2.105 57776 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:03:59.369846 0.068951 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:59.439100 0.082774 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:59.522248 0.213796 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:59.736468 0.165989 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:59.902883 0.071527 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:03:59.974793 0.177295 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.152520 0.103162 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.256035 0.026602 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.283008 0.215379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.498781 0.051128 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.550295 0.038325 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.589000 0.174800 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.764130 0.071448 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:04:00.835991 0.072811 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:09:23.576882 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:09:30.584330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:09:38.585780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:09:54.589101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:10:26.594873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:16:36.609527 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:16:43.616748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:16:51.619675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:17:07.624024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:17:39.627181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:23:45.654751 2.992844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:23:52.645637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:24:00.650877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:24:16.649799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:24:48.654186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:30:41.963046 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 01:30:41.963141 0.958317 tcp 10.0.2.105 57777 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:30:52.661907 3.000093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:30:59.667950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:31:07.669519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:31:23.672114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:31:55.678157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:34:12.715891 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 01:34:12.716092 0.000000 udp 10.0.2.105 7010 -> 99.189.38.91 8937 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 01:34:30.483745 0.067468 tcp 10.0.2.105 57778 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:34:30.551525 0.099701 tcp 10.0.2.105 57779 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:34:30.651499 0.147762 tcp 10.0.2.105 57780 -> 195.113.214.236 443 SRPA* 0 0 42 21666 flow=From-Botnet-V2-TCP-Established 1970/01/26 01:34:30.799845 0.399262 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.199551 0.044439 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.244419 0.054862 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.299719 0.063830 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.363986 0.254987 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.619405 0.076982 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.696459 0.180199 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.877101 0.073127 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:31.950666 0.146053 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:32.097079 0.034576 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:32.132058 0.659901 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:32.792411 0.170638 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:32.963422 0.142824 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:33.106683 0.175468 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:33.282597 0.062785 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:33.345755 0.328104 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:33.674277 0.185254 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:33.859929 0.137852 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.013861 0.198168 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.212510 0.075087 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.288043 0.082737 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.371201 0.211874 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.583469 0.167854 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.751755 0.074320 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:34.826516 0.177967 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.005037 0.099790 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.105219 0.026414 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.131982 0.230004 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.362377 0.058974 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.421691 0.044166 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.466243 0.072790 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.539402 0.175797 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:34:35.715556 0.075501 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/26 01:37:59.685871 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:38:06.691508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:38:14.693462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:38:30.696358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:39:02.704021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:47:56.712523 3.001852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:48:03.720250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:48:11.721492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:48:27.724574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:48:59.730598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:55:03.737138 3.002200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 01:55:10.744686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:55:18.745398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:55:34.748390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 01:56:06.757302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:00:42.922284 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 02:00:42.922490 0.970897 tcp 10.0.2.105 57781 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:02:11.762682 3.001994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:02:18.769707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:02:26.771049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:02:42.773958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:03:14.780115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:04:44.669529 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 02:04:44.669754 0.294665 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:44.964842 0.081907 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:45.047147 0.059136 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:45.106676 0.756331 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:45.863440 0.039458 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:45.903268 0.078706 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:45.982590 0.179750 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:46.162693 0.102540 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:46.265610 0.147915 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:46.413894 0.034088 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:46.448361 0.143598 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:46.592344 0.866137 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:47.458819 0.170393 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:47.629607 0.186247 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:47.816284 0.059734 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:47.876446 0.332815 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:48.209640 0.186025 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:48.396079 0.144973 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:48.541472 0.197591 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:04:48.739516 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 02:05:05.571026 0.066670 tcp 10.0.2.105 57782 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:05:05.638004 0.054401 tcp 10.0.2.105 57783 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:05:05.692663 0.150009 tcp 10.0.2.105 57784 -> 195.113.214.236 443 SRPA* 0 0 20 10690 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:05:05.843205 0.081979 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:05.925523 0.212576 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.138491 0.165463 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.304476 0.071968 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.376840 0.178790 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.556012 0.101620 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.658018 0.058444 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.716822 0.038378 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.755553 0.072162 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:06.828082 0.175080 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:07.003581 0.074913 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:07.078894 0.026846 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:05:07.106039 0.221115 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:09:18.786206 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:09:25.793421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:09:33.795326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:09:49.797911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:10:21.803892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:16:25.812068 2.999549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:16:32.817420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:16:40.818838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:16:56.821969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:17:28.828510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:23:32.836185 3.003301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:23:39.841172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:23:47.842992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:24:03.852515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:24:35.851992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:30:39.857627 3.001902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:30:43.891699 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 02:30:43.891883 0.934808 tcp 10.0.2.105 57785 -> 128.255.183.224 9027 FSPA* 0 0 12 1644 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:30:46.865473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:30:54.866941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:31:10.869655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:31:42.876294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:35:30.884165 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 02:35:30.884251 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 02:35:47.930197 0.066476 tcp 10.0.2.105 57786 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:35:47.996925 0.053752 tcp 10.0.2.105 57787 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:35:48.050979 0.143176 tcp 10.0.2.105 57788 -> 195.113.214.236 443 SRPA* 0 0 32 16856 flow=From-Botnet-V2-TCP-Established 1970/01/26 02:35:48.194708 0.055383 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.250506 0.304366 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.555255 0.047364 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.603006 0.071444 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.674810 0.182111 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.857306 0.072588 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.930254 0.060693 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:48.991277 0.039634 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.031322 0.148271 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.180006 0.143977 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.324502 0.054005 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.378873 0.185691 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.564910 0.060905 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:49.626181 0.374123 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.000692 0.171374 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.172441 0.155644 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.328475 0.151777 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.480618 0.184514 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.665484 0.204979 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:50.870822 0.168288 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.039493 0.086750 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.126604 0.210716 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.337683 0.094101 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.432172 0.176019 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.608562 0.112779 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.721759 0.057847 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.779969 0.038919 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.819240 0.073734 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:51.893327 0.180819 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:52.074511 0.077552 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:52.152432 0.025800 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:35:52.178564 0.212870 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/26 02:37:46.881888 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:37:53.889384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:38:01.890854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:38:17.893677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:38:49.899409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:47:48.909277 3.000274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:47:55.915535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:48:03.916713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:48:19.919564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:48:51.925607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:54:55.931372 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 02:55:02.939085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:55:10.940363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:55:26.943767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 02:55:58.949851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:00:44.831080 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 03:00:44.831337 0.958233 tcp 10.0.2.105 57789 -> 128.255.183.224 9027 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/01/26 03:02:02.955963 3.001410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:02:09.962816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:02:17.964066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:02:33.967832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:03:05.973362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:06:02.047110 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 03:06:02.047268 0.055831 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.103503 0.277901 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.381808 0.049392 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.431558 0.076518 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.508498 0.181111 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.689981 0.067833 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.758191 0.060720 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.819292 0.044889 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:02.864550 0.145930 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.010873 0.175230 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.186489 0.056061 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.242898 0.372209 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.615465 0.170919 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.786772 0.143683 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.930833 0.039062 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:03.970266 0.157718 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.128420 0.151920 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.280711 0.186371 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.467461 0.203383 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.671243 0.167366 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.839037 0.083418 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:04.922871 0.212038 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.135307 0.073510 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.209171 0.178580 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.388121 0.110270 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.498809 0.058530 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.557784 0.038629 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.596819 0.072361 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.669538 0.192103 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.862072 0.073706 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.936113 0.026273 udp 10.0.2.105 7010 <-> 78.43.89.57 5808 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:06:05.962763 0.222495 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:09:09.979205 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:09:16.987080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:09:24.988415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:09:40.991233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:10:12.997748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:16:17.002617 3.002200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:16:24.010647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:16:32.012177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:16:48.016624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:17:20.023782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:23:24.027386 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:23:31.034736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:23:39.036472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:23:55.039481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:24:27.045548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:30:31.050910 3.002588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:30:38.058652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:30:45.790532 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 03:30:45.790710 0.974480 tcp 10.0.2.105 57790 -> 128.255.183.224 9027 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/01/26 03:30:46.060103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:31:02.063168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:31:34.069481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:36:25.889435 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 03:36:25.889543 0.054336 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:25.944307 0.252892 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.197552 0.240611 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.438600 0.074381 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.513462 0.179667 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.693524 0.085658 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.779576 0.062811 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.842752 0.038766 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:26.881813 0.148749 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.031012 0.328143 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.359611 0.170802 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.530778 0.140051 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.671223 0.033123 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.704657 0.181095 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.886145 0.061551 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:27.948073 0.158449 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.106900 0.151945 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.259259 0.185424 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.445127 0.203329 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.648864 0.166404 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.815727 0.085894 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:28.902052 0.212952 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.115400 0.070830 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.186592 0.178492 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.365465 0.101312 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.467170 0.056620 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.524126 0.051415 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.575895 0.078737 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.654997 0.171252 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.826643 0.076322 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:36:29.903403 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 03:36:44.958414 0.067420 tcp 10.0.2.105 57791 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 03:36:45.026074 0.054474 tcp 10.0.2.105 57792 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 03:36:45.080801 0.147383 tcp 10.0.2.105 57793 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/26 03:36:45.228739 0.211197 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/26 03:37:38.075125 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:37:45.082603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:37:53.084152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:38:09.087376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:38:41.093265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:47:40.100895 3.001662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:47:47.108382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:47:55.110081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:48:11.112774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:48:43.123428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:54:47.124352 3.002459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 03:54:54.132164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:55:02.133848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:55:18.136700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 03:55:50.142972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:00:46.769836 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 04:00:46.770031 0.953996 tcp 10.0.2.105 57794 -> 128.255.183.224 9027 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:01:54.150453 3.000334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:02:01.156902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:02:09.158531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:02:25.161759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:02:57.166923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:06:51.083522 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 04:06:51.083683 0.000000 udp 10.0.2.105 7010 -> 78.43.89.57 5808 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 04:07:07.759581 0.109996 tcp 10.0.2.105 57795 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:07:07.869910 0.052344 tcp 10.0.2.105 57796 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:07:07.922537 0.144322 tcp 10.0.2.105 57797 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:07:08.067383 0.055533 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.123251 0.095912 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.219577 0.082085 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.302027 0.179502 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.481896 0.090545 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.572799 0.060401 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.633607 0.039943 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.673909 0.146322 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:08.820641 0.249778 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.070828 0.209821 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.281122 0.331192 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.612689 0.038784 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.651871 0.184252 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.836536 0.061270 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:09.898199 0.749629 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:10.648409 0.140853 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:10.789666 0.168342 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:10.958417 0.079601 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.038410 0.190375 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.229227 0.144834 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.374473 0.203191 udp 10.0.2.105 7010 <-> 99.9.238.186 2652 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.578059 0.073689 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.652110 0.176687 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.829163 0.104218 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.933810 0.057299 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:11.991522 0.038651 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:12.030561 0.076283 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:12.107213 0.173463 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:12.281030 0.071119 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:12.352641 0.212627 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:07:12.565618 0.213917 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:09:01.173866 3.000545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:09:08.180103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:09:16.181788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:09:32.185144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:10:04.190837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:16:08.196606 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:16:15.203984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:16:23.205614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:16:39.208876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:17:11.218136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:23:15.230631 3.001471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:23:22.238310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:23:30.239513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:23:46.246411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:24:18.256634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:30:22.255072 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:30:29.261942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:30:37.263549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:30:47.729360 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 04:30:47.729498 0.995058 tcp 10.0.2.105 57798 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:30:53.266563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:31:25.273187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:37:23.748387 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 04:37:23.748495 0.056673 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:23.805592 0.048729 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:23.854698 0.094238 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:23.949300 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 04:37:29.278696 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:37:36.286287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:37:40.203364 0.068055 tcp 10.0.2.105 57799 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:37:40.271685 0.052811 tcp 10.0.2.105 57800 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:37:40.324777 0.154707 tcp 10.0.2.105 57801 -> 195.113.214.236 443 SRPA* 0 0 43 37084 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:37:40.480059 0.072025 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:40.552672 0.066098 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:40.619229 0.044273 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:40.663867 0.147671 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:40.811915 0.264043 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.076397 0.033445 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.110193 0.249501 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.360150 0.061434 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.421931 0.172527 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.594821 0.350417 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:41.945625 0.758480 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:42.704556 0.144468 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:42.849350 0.165979 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:43.015683 0.083375 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:43.099433 0.192594 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:43.292463 0.144961 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:37:43.437793 0.000000 udp 10.0.2.105 7010 -> 99.9.238.186 2652 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 04:37:44.287549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:38:00.290902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:38:01.342670 0.066582 tcp 10.0.2.105 57802 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:38:01.409611 0.054252 tcp 10.0.2.105 57803 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:38:01.464207 0.248467 tcp 10.0.2.105 57804 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/26 04:38:01.713220 0.074176 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:01.787788 0.170381 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:01.958540 0.102277 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.061186 0.060583 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.122170 0.045044 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.167541 0.072619 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.240604 0.212460 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.453474 0.213149 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.667032 0.179359 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:02.846771 0.078780 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 04:38:32.296751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:47:34.308304 3.001798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:47:41.316066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:47:49.317245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:48:05.321100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:48:37.326388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:54:41.332624 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 04:54:48.340607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:54:56.341159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:55:12.344213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 04:55:44.350624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:00:48.728561 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 05:00:48.728757 0.977121 tcp 10.0.2.105 57805 -> 128.255.183.224 9027 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/01/26 05:01:48.356344 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:01:55.364829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:02:03.365540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:02:19.368942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:02:51.374165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:08:28.629719 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 05:08:28.629817 0.180164 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:28.810379 0.000000 udp 10.0.2.105 7010 -> 99.9.238.186 2652 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 05:08:44.503727 0.066960 tcp 10.0.2.105 57806 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 05:08:44.570925 0.052958 tcp 10.0.2.105 57807 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 05:08:44.624149 0.147078 tcp 10.0.2.105 57808 -> 195.113.214.236 443 SRPA* 0 0 55 34734 flow=From-Botnet-V2-TCP-Established 1970/01/26 05:08:44.771806 0.041150 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:44.813267 0.060262 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:44.873944 0.078497 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:44.952861 0.061167 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.014444 0.044971 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.059789 0.145599 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.205735 0.279636 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.485769 0.070772 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.556902 0.031100 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.588410 0.350820 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:45.939680 0.170933 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.110961 0.054266 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.165594 0.176577 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.342526 0.165892 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.508790 0.086090 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.595307 0.145257 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:46.740943 0.597390 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.338764 0.144778 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.483897 0.217024 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.701369 0.101163 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.802921 0.056313 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.859644 0.126111 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:47.986171 0.171367 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.157930 0.038984 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.197257 0.078700 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.276311 0.215490 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.492161 0.221565 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.714104 0.180252 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:48.894785 0.072917 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:08:55.379616 3.002556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:09:02.387779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:09:10.389095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:09:26.392544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:09:58.398299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:16:02.403928 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:16:09.411929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:16:17.412834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:16:33.416070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:17:05.422878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:23:09.428417 3.001457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:23:16.435699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:23:24.437294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:23:40.440727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:24:12.450980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:30:16.452211 3.001682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:30:23.459122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:30:31.461187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:30:47.464092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:30:49.708393 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 05:30:49.708613 1.024943 tcp 10.0.2.105 57809 -> 128.255.183.224 9027 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/01/26 05:31:19.470275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:37:23.479248 3.000249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:37:30.484984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:37:38.485350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:37:54.488186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:38:26.494266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:39:00.743772 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 05:39:00.743983 0.182530 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:00.926945 0.080975 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.008364 0.064600 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.073346 0.039177 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.112891 0.045319 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.158541 0.056888 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.215796 0.143414 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.359554 0.251482 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.611381 0.082012 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.693731 0.057548 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:01.751670 0.325045 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.077099 0.178105 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.255582 0.058840 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.314786 0.186436 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.501613 0.164932 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.666913 0.082816 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.750129 0.140326 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:02.890822 0.208369 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.099593 0.108840 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.208832 0.068449 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.277669 0.076528 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.354559 0.158648 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.513610 0.145150 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.659086 0.179907 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.839388 0.037952 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.877696 0.077769 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:03.955890 0.214475 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:04.170745 0.224477 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:04.395590 1.205926 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:39:05.601954 0.073308 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/26 05:47:29.507404 3.015383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:47:36.525024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:47:44.526615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:48:00.529986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:48:32.535864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:54:36.541502 3.003558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 05:54:43.548711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:54:51.550511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:55:07.553542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 05:55:39.559406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:00:50.737551 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 06:00:50.737802 1.012176 tcp 10.0.2.105 57810 -> 128.255.183.224 9027 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/01/26 06:01:43.566086 3.000876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:01:50.573104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:01:58.574240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:02:14.577524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:02:46.583621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:08:50.590137 3.000659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:08:57.600908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:09:05.598375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:09:21.601381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:09:34.980849 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 06:09:34.980961 0.063458 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.044783 0.045176 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.090332 0.181802 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.272697 0.082355 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.355459 0.043190 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.399009 0.055374 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.454706 0.144962 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.600107 0.249880 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.850415 0.072932 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.923769 0.031983 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:35.956067 0.399726 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:36.356175 0.170191 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:36.526760 0.059528 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:36.586675 0.176629 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:36.764085 0.168472 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:36.932964 0.086829 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.020169 0.143084 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.163635 0.230613 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.394654 0.106999 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.502057 0.057448 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.559862 0.067912 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:37.628147 0.444459 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.072966 0.145177 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.218484 0.171559 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.390407 0.039451 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.430237 0.074380 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.505108 0.213812 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.719284 0.224615 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:38.944451 0.183539 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:39.128443 0.073355 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:09:53.607403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:15:57.613873 3.018744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:16:04.638246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:16:12.632785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:16:28.635754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:17:00.642465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:23:04.647413 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:23:11.654992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:23:19.657092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:23:35.659572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:24:07.666671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:30:11.670905 3.002207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:30:18.678952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:30:26.679765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:30:42.683182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:30:51.758032 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 06:30:51.758171 1.042757 tcp 10.0.2.105 57811 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/26 06:31:14.689546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:37:18.695415 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:37:25.702823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:37:33.704159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:37:49.707536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:38:21.713299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:39:51.664551 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 06:39:51.664733 0.059704 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:51.724804 0.045290 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:51.770477 0.180216 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:51.951092 0.081718 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.033206 0.044852 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.078467 0.060760 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.139619 0.148116 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.288113 0.270523 udp 10.0.2.105 7010 <-> 59.99.72.96 9084 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.559017 0.071697 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.631106 0.035004 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.666463 0.321324 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:52.988214 0.171264 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.159838 0.055545 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.215778 0.184802 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.400991 0.166641 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.568056 0.082371 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.650817 0.106768 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.757940 0.066752 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.825056 0.165870 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:53.991297 0.157122 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.148829 0.143649 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.292877 0.217800 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.511065 0.137781 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.649232 0.177996 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.827640 0.039247 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.867359 0.078058 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:54.945864 0.210549 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:55.160695 0.221131 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:55.382214 0.174022 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:39:55.556661 0.077854 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/26 06:47:24.726600 3.001226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:47:31.734217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:47:39.736072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:47:55.738250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:48:27.745012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:54:31.750541 3.004951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 06:54:38.758277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:54:46.760633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:55:02.764049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 06:55:34.768639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:00:52.813228 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 07:00:52.813409 1.004818 tcp 10.0.2.105 57812 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:01:38.775453 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:01:45.782811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:01:53.783441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:02:09.786510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:02:41.792977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:08:45.798767 3.002341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:08:52.805806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:09:00.807528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:09:16.810785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:09:48.816850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:10:00.844064 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 07:10:00.844155 0.179648 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.024349 0.074538 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.099266 0.045486 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.145118 0.073866 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.219355 0.039255 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.258964 0.058540 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.317902 0.147431 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:01.465763 0.000000 udp 10.0.2.105 7010 -> 59.99.72.96 9084 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 07:10:19.763445 0.067487 tcp 10.0.2.105 57813 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:10:19.831200 0.052705 tcp 10.0.2.105 57814 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:10:19.884148 0.149944 tcp 10.0.2.105 57815 -> 195.113.214.236 443 SRPA* 0 0 63 41168 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:10:20.034297 0.070100 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.104724 0.033414 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.138492 0.323389 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.462249 0.170517 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.633153 0.058795 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.692509 0.180844 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:20.873776 0.166589 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.040716 0.084535 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.125602 0.100235 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.226167 0.058227 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.284740 0.071485 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.356587 0.620046 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:21.977023 0.146848 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.124240 0.210827 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.335459 0.145156 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.481019 0.177651 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.659088 0.038747 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.698223 0.070700 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.769337 0.173033 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:22.942862 0.076282 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:23.019473 0.294323 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:10:23.314158 0.214239 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:15:52.823305 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:15:59.830591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:16:07.833043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:16:23.834521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:16:55.840167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:22:59.848174 3.000297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:23:06.854050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:23:14.855442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:23:30.858492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:24:02.864587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:30:06.870781 3.001483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:30:13.877841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:30:21.879604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:30:37.882433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:30:53.815864 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 07:30:53.815946 1.012934 tcp 10.0.2.105 57816 -> 128.255.183.224 9027 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:31:09.888571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:37:13.894312 3.002525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:37:20.901929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:37:28.903605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:37:44.906759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:38:16.913031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:40:52.266181 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 07:40:52.266331 0.223569 udp 10.0.2.105 7010 -> 59.99.72.96 9084 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 07:40:52.489900 0.000000 icmp 59.99.72.96 0x0303 -> 10.0.2.105 0x7c23 URP 192 1 220 flow=Background 1970/01/26 07:41:10.674190 0.068276 tcp 10.0.2.105 57817 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:41:10.742720 0.057158 tcp 10.0.2.105 57818 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:41:10.800146 0.149015 tcp 10.0.2.105 57819 -> 195.113.214.236 443 SRPA* 0 0 20 11290 flow=From-Botnet-V2-TCP-Established 1970/01/26 07:41:10.949678 0.180353 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.130440 0.077228 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.208075 0.038991 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.247448 0.059186 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.307089 0.143915 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.451384 0.059474 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.511234 0.050867 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.562448 0.074780 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.637553 0.041975 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:11.679900 0.372687 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.053014 0.170649 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.224097 0.061768 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.286271 0.179383 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.465973 0.168511 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.634872 0.084003 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.719241 0.072913 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.792569 0.159313 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:12.952458 0.141841 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.094698 0.106803 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.201937 0.058436 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.260798 0.224651 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.485835 0.137464 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.623744 0.177303 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.801442 0.038405 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.840353 0.078219 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:13.918996 0.288723 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:14.208142 0.072083 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:14.280634 0.211673 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:41:14.492700 0.209742 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/26 07:44:20.918683 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:44:27.925789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:44:35.927700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:44:51.930735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:45:23.937071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:51:27.944639 2.999480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:51:34.950027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:51:42.951696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:51:58.954205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:52:30.960908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:58:35.969049 3.000404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 07:58:42.975045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:58:50.976878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:59:06.979541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 07:59:38.985741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:00:54.838012 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 08:00:54.838193 0.976950 tcp 10.0.2.105 57820 -> 128.255.183.224 9027 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/01/26 08:05:42.991602 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:05:49.999227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:05:58.000963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:06:14.003628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:06:46.009748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:11:34.194320 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 08:11:34.194453 0.181500 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.376381 0.080505 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.457292 0.040095 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.497760 0.059377 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.557509 0.148181 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.706072 0.064876 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.771343 0.049454 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.821181 0.070806 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.892429 0.032981 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:34.925736 0.327526 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.253688 0.172759 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.426795 0.062124 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.489283 0.185557 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.675294 0.169122 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.844791 0.085376 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:35.930563 0.075362 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.006297 0.159319 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.166042 0.144130 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.310601 0.100333 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.411354 0.057802 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.469542 0.390838 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:36.860766 0.152129 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.013286 0.170491 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.184203 0.038760 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.223348 0.074652 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.298420 0.219095 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.517977 0.208256 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.726638 0.172595 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:11:37.899608 0.075179 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:12:50.015961 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:12:57.023274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:13:05.024143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:13:21.027874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:13:53.033621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:19:57.040052 3.020628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:20:04.057043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:20:12.059232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:20:28.061817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:21:00.067853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:27:04.073567 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:27:11.081058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:27:19.082687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:27:35.085375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:28:07.091830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:30:55.814627 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 08:30:55.814760 1.070796 tcp 10.0.2.105 57821 -> 128.255.183.224 9027 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/01/26 08:34:11.097776 3.001907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:34:18.104860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:34:26.106486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:34:42.109611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:35:14.117301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:41:18.121955 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:41:25.128857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:41:33.130772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:41:49.133437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:41:56.414405 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 08:41:56.414543 0.180536 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.595479 0.073559 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.669407 0.045530 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.715296 0.058380 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.774037 0.146897 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.921311 0.057885 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:56.979563 0.044726 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.024664 0.075217 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.100460 0.039405 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.140198 0.345082 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.485703 0.170730 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.656792 0.061496 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.718714 0.183665 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:57.902770 0.165328 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.068503 0.081478 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.150369 0.070762 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.221489 0.103103 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.324978 0.058081 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.383421 0.342540 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.726336 0.145057 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:58.871793 0.200503 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.072683 0.145650 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.218787 0.178218 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.397437 0.038106 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.435975 0.078270 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.514644 0.213818 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.728911 0.208137 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:41:59.937446 0.173921 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:42:00.111832 0.078409 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/26 08:42:21.139578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:49:36.147379 3.002118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:49:43.155512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:49:51.157123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:50:07.160150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:50:39.165478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:56:53.177661 3.000072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 08:57:00.183707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:57:08.185545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:57:24.188965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 08:57:56.197416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:00:56.884138 0.000229 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 09:00:56.884450 0.927031 tcp 10.0.2.105 57822 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/26 09:04:00.200348 3.001901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:04:07.207894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:04:15.209392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:04:31.211907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:05:03.217988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:11:07.223978 3.002165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:11:14.231494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:11:22.233229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:11:38.235761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:12:02.821501 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 09:12:02.821769 0.181820 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.003966 0.074929 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.079309 0.038953 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.118632 0.058717 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.177747 0.146326 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.324536 0.060366 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.385317 0.046288 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.432007 0.074806 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.507239 0.034817 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.542400 0.061452 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.604398 0.182914 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.787678 0.166616 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:03.954661 0.354955 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.310012 0.176011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.486433 0.102622 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.589448 0.079318 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.669114 0.101877 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.771377 0.059259 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:04.831065 0.314372 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.145828 0.137917 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.284159 0.158188 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.442762 0.038675 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.481828 0.074047 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.556216 0.217615 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:05.774225 0.269503 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:06.044133 0.180316 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:06.224841 0.146095 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:06.371335 0.179048 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:06.550805 0.076599 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:12:10.242194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:18:14.248002 3.001754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:18:21.255360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:18:29.256811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:18:45.259893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:19:17.265806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:25:21.271165 3.006124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:25:28.282463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:25:36.280792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:25:52.283856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:26:24.289706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:30:57.813854 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 09:30:57.813940 1.083417 tcp 10.0.2.105 57823 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/26 09:32:28.295977 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:32:35.306862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:32:43.304750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:32:59.307794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:33:31.313856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:39:35.320194 3.001171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:39:42.327394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:39:50.328638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:40:06.332115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:40:38.337627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:42:25.802516 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 09:42:25.802653 0.038045 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:25.841111 0.179764 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.021242 0.072591 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.094173 0.059546 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.154081 0.143781 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.298277 0.059045 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.357733 0.047060 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.405202 0.073674 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.479275 0.055886 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.535519 0.059041 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.595010 0.184098 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.779510 0.165739 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:26.945622 0.349757 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.295754 0.203240 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.499352 0.088291 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.587987 0.070008 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.658347 0.102412 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.761172 0.056446 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:27.817964 0.218841 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.037168 0.144945 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.182504 0.154144 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.337031 0.044321 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.381697 0.072254 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.454366 0.212048 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.666835 0.224590 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:28.891814 0.178067 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:29.070268 0.075451 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:29.146122 0.297335 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:42:29.443882 0.144794 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 09:48:41.345143 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:48:48.353071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:48:56.358945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:49:12.361739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:49:44.363340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:55:48.369845 3.000470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 09:55:55.376410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:56:03.383242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:56:19.380578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 09:56:51.386964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:00:58.903473 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 10:00:58.903657 0.980451 tcp 10.0.2.105 57824 -> 128.255.183.224 9027 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/01/26 10:02:55.392053 3.011092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:03:02.400097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:03:10.402017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:03:26.408292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:03:58.410894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:10:02.416440 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:10:09.424028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:10:17.425566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:10:33.428610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:11:05.434550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:12:52.029579 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 10:12:52.029737 0.078892 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.109022 0.043616 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.153022 0.180057 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.333443 0.060047 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.393947 0.144092 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.538441 0.060661 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.599470 0.047056 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.646873 0.073606 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.720920 0.053068 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.774376 0.058791 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:52.833558 0.181717 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.015618 0.166114 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.182096 0.323228 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.505721 0.170011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.676130 0.087259 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.763842 0.142226 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:53.906441 0.102673 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:54.009492 0.055478 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:54.065333 0.214849 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:54.280691 0.144652 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:54.425743 0.956479 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:55.382629 0.038858 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:55.421925 0.074381 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:55.496746 0.212399 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:55.709531 0.219379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:55.929335 0.171794 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:56.101575 0.081542 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:56.183506 0.178113 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:12:56.361995 0.143649 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:17:09.440318 3.002241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:17:16.450337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:17:24.449485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:17:40.455710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:18:12.458046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:24:16.465425 3.000688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:24:23.472340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:24:31.474810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:24:47.478926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:25:19.485343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:30:59.892713 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 10:30:59.892904 0.972166 tcp 10.0.2.105 57825 -> 128.255.183.224 9027 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/01/26 10:31:23.490085 2.999783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:31:30.496529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:31:38.497782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:31:54.500553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:32:26.508650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:38:30.512406 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:38:37.548903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:38:45.531552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:39:01.534474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:39:33.540741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:43:08.550214 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 10:43:08.550396 0.078634 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:08.629440 0.038129 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:08.667982 0.179455 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:08.847811 0.059682 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:08.907897 0.148053 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.056325 0.059414 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.116120 0.045538 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.162003 0.070966 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.233338 0.033630 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.267373 0.058924 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.326728 0.175865 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.503012 0.167302 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:09.670741 0.329892 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.000997 0.171283 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.172656 0.086850 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.259978 0.070543 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.330944 0.102429 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.433753 0.059850 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.493954 0.214161 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.737076 0.152207 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:10.889652 0.297621 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.187623 0.038265 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.226244 0.074764 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.301367 0.213539 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.515325 0.217705 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.733390 0.171211 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:11.904968 0.145899 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:12.051263 0.077480 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 589 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:43:12.129108 0.181768 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/26 10:48:09.556069 3.055445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:48:16.649104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:48:24.585825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:48:40.586859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:49:12.593123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:55:16.601630 2.999357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 10:55:23.606548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:55:31.607872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:55:47.610563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 10:56:19.616624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:01:00.872040 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 11:01:00.872206 0.947607 tcp 10.0.2.105 57826 -> 128.255.183.224 9027 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/01/26 11:02:25.628204 2.999343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:02:32.633541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:02:40.635056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:02:56.637842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:03:28.643941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:09:32.649641 3.002274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:09:39.657239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:09:47.658699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:10:03.661942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:10:35.667787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:13:42.446898 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 11:13:42.447050 0.181708 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:42.629171 0.060018 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:42.689603 0.144373 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:42.834378 0.069317 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:42.904115 0.080921 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:42.985477 0.038676 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.024732 0.101934 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.127071 0.074959 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.202376 0.032493 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.235264 0.058045 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.293742 0.182522 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.476641 0.166777 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.643783 0.322253 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:43.966465 0.171012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.137882 0.091932 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.230223 0.072522 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.303123 0.101891 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.405394 0.056072 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.461848 0.206704 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.668944 0.144696 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.814067 0.183688 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:44.998177 0.038359 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.036990 0.078684 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.116057 0.227431 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.343874 0.225060 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.569380 0.181289 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.751654 0.143069 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.895104 0.076036 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:13:45.971550 0.181547 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:16:39.673526 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:16:46.681512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:16:54.682904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:17:10.685594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:17:42.691931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:23:46.699103 3.000385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:23:53.706612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:24:01.707108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:24:17.710067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:24:49.715747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:30:53.722120 3.001394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:31:00.729305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:31:01.821152 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 11:31:01.821249 1.010554 tcp 10.0.2.105 57827 -> 128.255.183.224 9027 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/01/26 11:31:08.731118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:31:24.733724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:31:56.739885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:38:00.745856 3.003095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:38:07.753897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:38:15.759491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:38:31.758184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:39:03.763742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:43:46.631385 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 11:43:46.631573 0.147711 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:46.779685 0.064688 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:46.844794 0.070408 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:46.915601 0.038494 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:46.954452 0.149575 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.104581 0.180782 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.285793 0.060084 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.346320 0.070631 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.417370 0.037642 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.455409 0.059451 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.515233 0.181491 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.697123 0.165510 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:47.863024 0.339273 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.202663 0.170366 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.373439 0.087623 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.461513 0.072872 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.534826 0.101609 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.636804 0.061207 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.698385 0.217385 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:48.916378 0.145033 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.061817 0.160469 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.222663 0.044726 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.267789 0.074988 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.343187 0.178731 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.522350 0.145170 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.667916 0.080810 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:49.749102 0.474881 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:50.224500 0.258525 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:43:50.483403 0.213747 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 11:47:55.771268 3.001857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:48:02.778573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:48:10.782930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:48:26.783593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:48:58.789391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:55:02.795155 3.001862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 11:55:09.805110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:55:17.805381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:55:33.807355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 11:56:05.819189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:01:02.830566 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 12:01:02.830772 0.970805 tcp 10.0.2.105 57828 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/01/26 12:02:10.821302 3.001020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:02:17.828106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:02:25.829521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:02:41.832730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:03:13.838875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:09:17.844646 3.006774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:09:24.852479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:09:32.853602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:09:48.858227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:10:20.863094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:14:17.362911 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 12:14:17.363007 0.081913 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.445315 0.039062 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.484744 0.045377 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.530478 0.141300 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.672109 0.058657 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.731170 0.181090 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.912650 0.061711 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:17.974716 0.071604 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.046700 0.032933 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.080104 0.059297 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.139750 0.173200 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.313311 0.167916 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.481608 0.331738 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.813709 0.169968 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:18.984080 0.087544 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.071988 0.084568 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.156934 0.102809 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.260145 0.057767 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.318274 0.227485 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.546128 0.137885 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.684566 0.188154 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.873105 0.038784 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.912346 0.075331 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:19.988334 0.176226 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:20.164913 0.144789 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:20.310120 0.078563 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:20.389057 0.215719 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:20.605199 0.175544 udp 10.0.2.105 7010 <-> 68.93.102.147 1275 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:14:20.781134 0.289936 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:16:24.871777 2.998551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:16:31.875826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:16:39.877570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:16:55.880834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:17:27.886103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:23:31.892217 3.007202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:23:38.899879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:23:46.903719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:24:02.903904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:24:34.910755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:30:38.916492 3.002126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:30:45.923863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:30:53.925395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:31:03.800002 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 12:31:03.800195 0.923204 tcp 10.0.2.105 57829 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/26 12:31:09.928852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:31:41.934196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:37:45.941505 3.000701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:37:52.950764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:38:00.949439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:38:16.953840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:38:48.958292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:44:36.858903 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 12:44:36.859071 0.075522 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:36.935014 0.046046 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:36.981468 0.050576 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.032452 0.145498 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.178345 0.061249 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.240022 0.181141 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.421554 0.059111 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.481016 0.083025 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.564663 0.031616 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.596703 0.054379 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.651470 0.181581 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:37.833472 0.166969 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.000834 0.318768 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.319971 0.171117 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.491510 0.086857 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.578776 0.067255 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.646417 0.102511 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.749319 0.054663 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:38.804408 0.220717 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.025515 0.144783 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.170699 0.164148 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.335235 0.038467 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.374064 0.072185 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.446656 0.222475 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.669502 0.212529 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:39.882394 0.000000 udp 10.0.2.105 7010 -> 68.93.102.147 1275 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 12:44:55.747785 0.066522 tcp 10.0.2.105 57830 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/26 12:44:55.814562 0.052148 tcp 10.0.2.105 57831 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/26 12:44:55.866942 0.123091 tcp 10.0.2.105 57832 -> 195.113.214.236 443 SRPA* 0 0 56 37363 flow=From-Botnet-V2-TCP-Established 1970/01/26 12:44:55.990534 0.212607 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:56.203503 0.141877 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:44:56.345785 0.074894 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 12:47:46.964705 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:47:53.972316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:48:01.973718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:48:17.976886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:48:49.982550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:54:53.989002 3.001101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 12:55:00.995996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:55:09.003038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:55:25.005311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 12:55:57.006677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:01:04.730008 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 13:01:04.730216 1.020708 tcp 10.0.2.105 57833 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/26 13:02:01.012566 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:02:08.019906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:02:16.021435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:02:32.024564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:03:04.032963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:09:08.036043 3.002089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:09:15.043964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:09:23.045604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:09:39.048791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:10:11.054646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:15:16.153863 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 13:15:16.153969 0.000000 udp 10.0.2.105 7010 -> 68.93.102.147 1275 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 13:15:33.179033 0.217456 tcp 10.0.2.105 57834 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 13:15:33.396709 0.054240 tcp 10.0.2.105 57835 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 13:15:33.451244 0.145252 tcp 10.0.2.105 57836 -> 195.113.214.236 443 SRPA* 0 0 33 18764 flow=From-Botnet-V2-TCP-Established 1970/01/26 13:15:33.596986 0.053789 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:33.651170 0.075353 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:33.726893 0.044840 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:33.772045 0.060890 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:33.833316 0.179659 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.013392 0.057443 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.071220 0.066889 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.138512 0.035429 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.174313 0.144138 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.318816 0.179335 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.498607 0.056908 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.555880 0.171469 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.727720 0.083212 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.811343 0.067983 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.879742 0.103239 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:34.983406 0.059494 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.043344 0.165458 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.209241 0.322265 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.531890 0.214496 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.746790 0.038669 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.785963 0.075556 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:35.861976 0.178672 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.041113 0.186347 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.227894 0.151896 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.380229 0.214167 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.594810 0.076415 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.671587 0.219428 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:15:36.891424 0.142869 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:16:15.060631 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:16:22.072770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:16:30.069335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:16:46.074814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:17:18.078441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:23:22.084571 3.007368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:23:29.091878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:23:37.093383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:23:53.096589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:24:25.102443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:30:29.109710 3.000345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:30:36.115926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:30:44.117368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:31:00.120541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:31:05.759033 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 13:31:05.759133 0.954946 tcp 10.0.2.105 57837 -> 128.255.183.224 9027 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/01/26 13:31:32.126116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:37:36.132595 3.009116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:37:43.146721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:37:51.144846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:38:07.144437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:38:39.154168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:46:00.225044 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 13:46:00.225156 0.038383 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.263999 0.057212 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.321618 0.178941 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.501030 0.056860 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.558292 0.066717 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.625377 0.033427 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.659175 0.045470 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.705043 0.075800 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.781275 0.145131 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:00.926805 0.178558 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.105836 0.055169 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.161419 0.170579 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.332412 0.080171 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.412959 0.069365 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.482728 0.101827 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.584951 0.055474 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.640801 0.299781 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.940995 0.038574 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:01.979987 0.067207 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:02.047532 0.178429 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:02.226335 0.165413 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:02.392116 0.330534 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:02.722994 0.222177 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:02.945549 0.144719 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:03.090658 0.208058 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:03.299081 0.075731 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:03.375186 0.288413 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:46:03.664002 0.145022 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/01/26 13:47:40.165465 2.997139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:47:47.168450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:47:55.169708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:48:11.173498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:48:43.179292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:54:47.185067 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 13:54:54.193136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:55:02.193806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:55:18.196811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 13:55:50.203032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:01:06.719037 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 14:01:06.719148 0.969509 tcp 10.0.2.105 57838 -> 128.255.183.224 9027 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:01:54.209017 3.001975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:02:01.216467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:02:09.217620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:02:25.221156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:02:57.229651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:09:01.232792 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:09:08.240088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:09:16.241833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:09:32.244887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:10:04.251201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:16:08.256145 3.002486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:16:15.264170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:16:22.695114 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 14:16:22.695262 0.044088 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:22.739695 0.059372 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:22.799428 0.181152 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:22.980989 0.057303 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.038769 0.065971 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.105134 0.034862 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.140517 0.086109 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.227028 0.076342 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.265717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:16:23.303745 0.055512 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.359644 0.170329 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.530314 0.080776 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.611466 0.067790 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.679632 0.144209 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:23.824479 0.180372 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:24.005229 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 14:16:39.268978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:16:43.349799 0.066025 tcp 10.0.2.105 57839 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:16:43.416089 0.051072 tcp 10.0.2.105 57840 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:16:43.467449 0.142986 tcp 10.0.2.105 57841 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:16:43.611027 0.056753 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:43.668152 0.158230 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:43.826758 0.039482 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:43.866629 0.070839 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:43.937822 0.179291 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:44.117523 0.167111 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:44.285014 0.331315 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:44.616726 0.210835 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:44.827940 0.077332 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:44.905655 0.188278 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:45.094313 0.145097 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:45.239809 0.273258 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:16:45.513424 0.144094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:17:12.657187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:23:15.296804 2.996277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:23:22.297907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:23:30.301441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:23:46.302903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:24:18.308964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:30:22.314237 3.001980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:30:29.322174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:30:37.328639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:30:53.326766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:31:07.687861 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 14:31:07.688096 0.998188 tcp 10.0.2.105 57842 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:31:25.335809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:37:29.338551 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:37:36.345637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:37:44.347509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:38:00.350057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:38:32.356648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:46:47.208278 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 14:46:47.208478 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 14:47:03.042623 0.067800 tcp 10.0.2.105 57843 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:47:03.110660 0.051985 tcp 10.0.2.105 57844 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:47:03.162921 0.143460 tcp 10.0.2.105 57845 -> 195.113.214.236 443 SRPA* 0 0 23 13808 flow=From-Botnet-V2-TCP-Established 1970/01/26 14:47:03.306903 0.180924 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.530044 0.057572 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.588023 0.068071 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.656429 0.035775 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.692502 0.038830 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.731676 0.059096 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.791160 0.055966 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:03.847504 0.172281 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.020194 0.076351 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.096936 0.079052 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.176416 0.142917 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.319742 0.179696 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.499831 0.044735 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.544945 0.079634 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:04.624977 0.482531 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.107875 0.038789 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.147041 0.056146 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.203593 0.177763 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.381743 0.165187 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.547312 0.356843 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:05.904538 0.210216 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.115130 0.073498 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.188996 0.195500 udp 10.0.2.105 7010 <-> 201.167.130.189 2660 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.384934 0.152001 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.537341 0.258630 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.796499 0.145236 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:06.942157 0.075579 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 14:47:35.369797 3.005792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:47:42.377290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:47:50.378758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:48:06.381799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:48:38.387535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:54:42.394330 3.001028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 14:54:49.401388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:54:57.403087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:55:13.405937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 14:55:45.411843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:01:08.691002 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 15:01:08.691193 0.989198 tcp 10.0.2.105 57846 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:01:49.418346 3.001339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:01:56.426908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:02:04.426804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:02:20.429980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:02:52.436017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:08:56.441432 3.002144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:09:03.449267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:09:11.450746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:09:27.453806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:09:59.459925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:16:03.465725 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:16:10.473331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:16:18.475421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:16:34.487997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:17:06.493791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:17:19.593177 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 15:17:19.593326 0.070134 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:19.663903 0.031959 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:19.696415 0.038981 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:19.735820 0.059464 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:19.795704 0.055414 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:19.851531 0.170519 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.022497 0.180275 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.203139 0.057363 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.260961 0.077410 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.338767 0.071030 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.410240 0.143809 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.554373 0.180426 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.735193 0.047934 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.783507 0.079860 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.863736 0.052170 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:20.916304 0.179249 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:21.095935 0.161849 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:21.258233 0.038495 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:21.297215 0.165872 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:21.463493 0.325138 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:21.789049 0.215468 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:22.004877 0.071394 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:22.076648 0.000000 udp 10.0.2.105 7010 -> 201.167.130.189 2660 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 15:17:39.833714 0.062506 tcp 10.0.2.105 57847 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:17:39.896511 0.054688 tcp 10.0.2.105 57848 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:17:39.951478 0.139578 tcp 10.0.2.105 57849 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:17:40.091570 0.152104 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:40.244031 0.076021 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:40.320444 0.292515 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:17:40.613400 0.145339 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:23:10.500135 3.002801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:23:17.507388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:23:25.508950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:23:41.512122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:24:13.517808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:30:17.524032 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:30:24.531202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:30:32.532800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:30:48.535653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:31:09.686660 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 15:31:09.686823 0.979262 tcp 10.0.2.105 57850 -> 128.255.183.224 9027 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:31:20.541797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:37:24.547959 3.028423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:37:31.567287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:37:39.566471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:37:55.569844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:38:27.575698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:47:30.588884 3.002071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:47:37.596067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:47:45.597769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:47:59.007902 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 15:47:59.008113 0.000000 udp 10.0.2.105 7010 -> 201.167.130.189 2660 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 15:48:01.600962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:48:15.433190 0.064893 tcp 10.0.2.105 57851 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:48:15.498369 0.053441 tcp 10.0.2.105 57852 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:48:15.552190 0.147397 tcp 10.0.2.105 57853 -> 195.113.214.236 443 SRPA* 0 0 60 41218 flow=From-Botnet-V2-TCP-Established 1970/01/26 15:48:15.698647 0.045805 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:15.744809 0.056454 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:15.801614 0.056395 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:15.858403 0.170966 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.029754 0.068592 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.098794 0.032740 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.131913 0.059422 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.191786 0.179200 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.371399 0.263976 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.635750 0.144416 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.780695 0.181643 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:16.962758 0.042757 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.005939 0.080321 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.086708 0.054138 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.141290 0.190906 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.332718 0.076137 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.409245 0.037739 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.447374 0.165786 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.613541 0.329840 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:17.943754 0.211758 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.155924 0.073405 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.229736 0.160111 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.390302 0.242992 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.633675 0.145882 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.779950 0.137921 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:18.918289 0.074600 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/26 15:48:33.607065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:54:37.612393 3.003697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 15:54:44.621936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:54:52.623176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:55:08.625096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 15:55:40.632658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:01:10.665899 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 16:01:10.666058 0.933826 tcp 10.0.2.105 57854 -> 128.255.183.224 9027 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/01/26 16:01:44.636696 3.002435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:01:51.644074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:01:59.651662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:02:15.649021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:02:47.655163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:08:51.660322 3.002431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:08:58.668480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:09:06.669619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:09:22.672779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:09:54.679062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:15:58.686340 3.000318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:16:05.692805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:16:13.693941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:16:29.696720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:17:01.705324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:18:45.854890 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 16:18:45.855078 0.054379 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:45.909839 0.039120 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:45.949331 0.058986 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.008741 0.033967 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.043051 0.056874 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.100276 0.180857 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.281502 0.172012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.453965 0.070505 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.524834 0.068656 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.593859 0.144978 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.739205 0.171233 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.910820 0.047110 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:46.958330 0.077611 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.036318 0.056670 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.093361 0.038327 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.132059 0.164684 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.297172 0.323512 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.621065 0.179557 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.800994 0.079786 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:47.881205 0.218092 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.099711 0.068555 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.168631 0.155633 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.324642 0.144657 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.469718 0.076625 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.546789 0.213598 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:18:48.764395 0.141690 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:23:05.711428 2.999298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:23:12.716714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:23:20.720111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:23:36.729881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:24:08.731010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:30:12.733260 3.001182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:30:19.740542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:30:27.741730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:30:43.745007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:31:11.605511 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 16:31:11.605735 0.956849 tcp 10.0.2.105 57855 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/01/26 16:31:15.751232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:37:19.756912 3.001393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:37:26.764454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:37:34.765908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:37:50.772775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:38:22.774831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:47:23.785305 3.157773 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:47:30.911733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:47:38.845282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:47:54.807507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:48:26.813431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:49:01.198964 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 16:49:01.199096 0.060091 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.259591 0.033160 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.293127 0.057686 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.351204 0.058845 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.410437 0.039001 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.449833 0.180783 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.631074 0.171835 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.803367 0.077200 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.880926 0.069677 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:01.951013 0.142145 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.093591 0.180407 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.274404 0.049190 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.323968 0.077633 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.402001 0.053676 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.456068 0.037810 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.494253 0.165347 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.659953 0.329094 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:02.989417 0.170011 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.159781 0.076730 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.236910 0.217684 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.455042 0.071591 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.527068 0.076681 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.604181 0.317927 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:03.922504 0.141660 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:04.064578 0.205862 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:49:04.270871 0.144938 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 16:54:30.824025 2.997523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 16:54:37.826914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:54:45.830806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:55:01.831554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 16:55:33.840901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:01:12.564791 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 17:01:12.564879 0.976956 tcp 10.0.2.105 57856 -> 128.255.183.224 9027 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/01/26 17:01:37.842828 3.002177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:01:44.851073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:01:52.852163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:02:08.856010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:02:40.861178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:08:44.866767 3.002075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:08:51.874682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:08:59.875992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:09:15.881383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:09:47.885263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:15:51.890700 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:15:58.898808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:16:06.900075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:16:22.903156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:16:54.909112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:19:20.458099 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 17:19:20.458269 0.056498 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:20.515149 0.054976 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:20.570475 0.039596 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:20.610466 0.179942 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:20.790832 0.170501 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:20.961673 0.056602 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.018642 0.031493 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.050474 0.067521 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.118360 0.074881 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.193635 0.143499 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.337569 0.173787 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.511662 0.046078 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.558085 0.075340 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.633759 0.052113 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:21.686204 0.323630 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.010287 0.038418 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.049129 0.165867 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.215374 0.172343 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.388200 0.077557 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.466196 0.215249 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.681827 0.072444 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.754629 0.071513 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.826536 0.158870 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:22.985782 0.144763 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:23.130954 0.348522 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:19:23.479915 0.140596 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:22:58.916074 3.000694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:23:05.922764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:23:13.923678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:23:29.927024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:24:01.933045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:30:05.939832 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:30:12.946878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:30:20.947920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:30:36.950987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:31:08.957239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:31:13.544117 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 17:31:13.544345 1.029124 tcp 10.0.2.105 57857 -> 128.255.183.224 9027 FSPA* 0 0 14 1703 flow=From-Botnet-V2-TCP-Established 1970/01/26 17:37:12.964671 3.000141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:37:19.970687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:37:27.972031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:37:43.975002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:38:15.981162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:44:19.986701 3.002034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:44:26.994310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:44:34.996134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:44:50.999331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:45:23.005161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:49:51.925154 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 17:49:51.925352 0.057377 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:51.983126 0.056560 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.040067 0.038429 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.078945 0.179044 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.258406 0.170835 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.429627 0.062290 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.492420 0.031506 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.524231 0.069563 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.594227 0.070900 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.665485 0.146146 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.812022 0.179386 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:52.991818 0.043340 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.035500 0.076835 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.112699 0.058111 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.171219 0.323402 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.495008 0.044610 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.539977 0.166420 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.706857 0.179543 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.887234 0.079539 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:53.967123 0.210640 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.178161 0.074057 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.252676 0.076405 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.329447 0.159356 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.489211 0.137838 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.627416 0.361845 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:49:54.989619 0.144228 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 17:51:27.010802 3.002380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:51:34.018666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:51:42.021647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:51:58.023658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:52:30.029209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:58:34.035321 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 17:58:41.042669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:58:49.043896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:59:05.046911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 17:59:37.053707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:01:14.574138 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 18:01:14.574238 0.956296 tcp 10.0.2.105 57858 -> 128.255.183.224 9027 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/01/26 18:05:41.064269 2.995840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:05:48.069986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:05:56.068903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:06:12.071085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:06:44.076964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:12:48.083420 3.000775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:12:55.092318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:13:03.092301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:13:19.094976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:13:51.101883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:19:55.107276 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:19:56.326109 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 18:19:56.326283 0.045948 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.372637 0.180374 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.553474 0.060892 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.675244 0.056300 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.731905 0.173434 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.905727 0.059028 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.965153 0.033367 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:56.998894 0.081705 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.081043 0.070767 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.152233 0.139787 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.292673 0.181133 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.474180 0.043467 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.518042 0.073046 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.591488 0.055231 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.647186 0.330453 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:57.978036 0.038662 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.017085 0.166625 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.184170 0.179815 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.364358 0.080852 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.445680 0.214966 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.660985 0.071662 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.733089 0.074456 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:58.807992 0.426882 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:59.235278 0.157232 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:59.392945 0.151888 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:19:59.545254 0.143993 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:20:02.114204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:20:10.115957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:20:26.123098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:20:58.124809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:27:02.130638 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:27:09.138238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:27:17.140439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:27:33.143213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:28:05.149771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:31:15.533053 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 18:31:15.533243 1.028731 tcp 10.0.2.105 57859 -> 128.255.183.224 9027 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/26 18:34:09.154914 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:34:16.165648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:34:24.163738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:34:40.166891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:35:12.175739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:41:16.178492 3.002542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:41:23.186692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:41:31.187601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:41:47.190718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:42:19.196747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:49:32.211935 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:49:39.219354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:49:47.222078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:50:03.223967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:50:05.968374 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 18:50:05.968544 0.156070 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.124987 0.179982 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.305401 0.056684 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.362484 0.055941 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.419628 0.170428 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.590512 0.059306 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.650213 0.031172 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.681728 0.066120 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.748196 0.067241 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.815786 0.143031 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:06.959234 0.180062 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.139681 0.044119 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.184161 0.081581 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.266145 0.067778 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.334239 0.352499 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.687136 0.038290 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.725710 0.167300 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:07.893380 0.215596 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.109329 0.078548 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.188451 0.226503 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.415373 0.071585 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.487357 0.071256 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.558961 0.291709 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.851077 0.141359 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:08.992873 0.157989 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:09.151224 0.144883 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 18:50:35.230274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:56:48.238930 3.002065 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 18:56:55.246237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:57:03.247751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:57:19.251345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 18:57:51.256810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:01:16.562370 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 19:01:16.562612 1.007816 tcp 10.0.2.105 57860 -> 128.255.183.224 9027 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/01/26 19:03:55.262877 3.001325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:04:02.271254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:04:10.271646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:04:26.274828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:04:58.281570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:11:02.287070 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:11:09.294324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:11:17.295639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:11:33.298670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:12:05.304874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:18:09.310842 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:18:16.318010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:18:24.319641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:18:40.322899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:19:12.329251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:20:19.646048 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 19:20:19.646247 0.044450 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:19.691143 0.178597 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:19.870190 0.057803 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:19.928401 0.055735 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:19.984648 0.170457 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.155495 0.057087 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.212984 0.031371 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.244710 0.067311 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.312441 0.069450 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.382287 0.142129 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.524800 0.180228 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.705435 0.045382 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.751174 0.077360 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.828954 0.053190 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:20.882514 0.166119 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.049017 0.171819 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.221284 0.078730 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.300412 0.445123 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.746007 0.038778 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.785145 0.209526 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:21.995096 0.072537 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:22.068056 0.075004 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:22.143475 0.263353 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:22.407178 0.144849 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:22.552621 0.145493 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:20:22.698522 0.178597 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:25:16.335224 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:25:23.342518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:25:31.343473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:25:47.346478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:26:19.353014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:31:17.571932 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 19:31:17.572117 0.943406 tcp 10.0.2.105 57861 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/26 19:32:23.358393 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:32:30.366723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:32:38.367500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:32:54.375180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:33:26.377055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:39:30.383232 3.001353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:39:37.390172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:39:45.391793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:40:01.396208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:40:33.400662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:48:40.413331 3.001627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:48:47.421297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:48:55.423261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:49:11.427568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:49:43.431766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:50:37.479685 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 19:50:37.479847 0.058001 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.538221 0.057270 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.595914 0.171110 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.767447 0.059180 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.827089 0.031737 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.859136 0.069768 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.929290 0.039341 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:37.968971 0.177892 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.147277 0.069576 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.217289 0.143484 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.361164 0.179331 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.540968 0.046372 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.587730 0.078851 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.667023 0.057168 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.724529 0.166226 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:38.891164 0.180233 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.071787 0.077200 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.149366 0.386151 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.535892 0.038427 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.574671 0.217340 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.792430 0.073145 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.865947 0.088471 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:39.954789 0.140953 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:40.096135 0.209701 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:40.306208 0.228631 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:50:40.535250 0.144802 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 19:55:49.440345 3.001632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 19:55:56.447781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:56:04.449226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:56:20.452777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 19:56:52.457760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:01:18.521399 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 20:01:18.521640 1.009015 tcp 10.0.2.105 57862 -> 128.255.183.224 9027 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/26 20:02:56.464576 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:03:03.471824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:03:11.473596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:03:27.482028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:03:59.482725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:10:03.489281 3.000712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:10:10.495075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:10:18.497249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:10:34.500607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:11:06.506168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:17:10.514751 3.013433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:17:17.529264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:17:25.532676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:17:41.533991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:18:13.539770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:21:09.453595 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 20:21:09.453767 0.321658 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:09.775770 0.060349 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:09.836503 0.039142 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:09.876022 0.086734 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:09.963125 0.039495 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.002937 0.059811 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.063095 0.054612 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.118057 0.181205 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.299599 0.126269 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.457174 0.142559 udp 10.0.2.105 7010 <-> 65.95.214.102 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.600175 0.182372 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.782895 0.042789 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.825995 0.075762 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.902226 0.057693 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:10.960424 0.078932 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:11.039728 0.165818 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:11.205960 0.239901 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:11.446242 0.324207 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:11.770831 0.038197 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:11.809437 0.215829 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.025671 0.073832 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.099814 0.076008 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.176189 0.224565 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.401183 0.151872 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.553426 0.142368 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:21:12.696449 0.256009 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:24:17.549019 2.999875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:24:24.560780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:24:32.556842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:24:48.558168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:25:20.564110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:31:19.532858 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 20:31:19.533059 1.054253 tcp 10.0.2.105 57863 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/26 20:31:24.569437 3.002453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:31:31.577635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:31:39.579001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:31:55.582114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:32:27.588009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:38:31.594164 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:38:38.601512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:38:46.603118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:39:02.606657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:39:34.612442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:48:11.617624 3.002116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:48:18.625434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:48:26.626749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:48:42.630392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:49:14.636909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:51:24.193570 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 20:51:24.193840 0.031830 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.226031 0.070975 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.297348 0.044438 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.342139 0.061365 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.403853 0.057385 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.461617 0.179761 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.641802 0.169694 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.811877 0.060126 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:24.872437 0.225915 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:25.098748 0.000000 udp 10.0.2.105 7010 -> 65.95.214.102 5207 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 20:51:42.230361 0.061238 tcp 10.0.2.105 57864 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 20:51:42.291857 0.054619 tcp 10.0.2.105 57865 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 20:51:42.346772 0.150695 tcp 10.0.2.105 57866 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/26 20:51:42.498000 0.180184 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:42.678562 0.044063 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:42.722962 0.072594 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:42.795934 0.053477 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:42.849791 0.076263 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:42.926400 0.166616 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:43.093415 0.178268 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:43.272048 0.314263 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:43.586690 0.042516 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:43.629578 0.306111 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:43.936043 0.072928 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:44.009381 0.075550 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:44.085354 0.144698 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:44.230448 0.156310 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:44.387234 0.211721 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:51:44.599344 0.151771 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/26 20:55:18.642143 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 20:55:25.649794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:55:33.651249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:55:49.654079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 20:56:21.660164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:01:20.590166 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 21:01:20.590340 1.022637 tcp 10.0.2.105 57867 -> 128.255.183.224 9027 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/01/26 21:02:25.665903 3.001977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:02:32.673439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:02:40.674860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:02:56.678005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:03:28.684277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:09:32.690017 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:09:39.697562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:09:47.699181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:10:03.701968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:10:35.708005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:16:39.714157 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:16:46.721524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:16:54.722957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:17:10.726148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:17:42.733447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:21:51.420015 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 21:21:51.420142 0.000000 udp 10.0.2.105 7010 -> 65.95.214.102 5207 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/26 21:22:09.557351 0.044261 tcp 10.0.2.105 57868 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/26 21:22:09.601971 0.053069 tcp 10.0.2.105 57869 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/26 21:22:09.655358 0.150772 tcp 10.0.2.105 57870 -> 195.113.214.236 443 SRPA* 0 0 35 19434 flow=From-Botnet-V2-TCP-Established 1970/01/26 21:22:09.806782 0.076758 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:09.884034 0.044747 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:09.929250 0.057671 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:09.987363 0.055919 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.043702 0.177912 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.221998 0.170825 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.393209 0.059458 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.453069 0.067629 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.521070 0.032844 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.554274 0.181004 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.735738 0.044920 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.781042 0.073669 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.855112 0.057487 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.913041 0.077811 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:10.991227 0.165762 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.157357 0.178046 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.335778 0.325412 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.661537 0.042367 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.704399 0.076261 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.781041 0.143880 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:11.925265 0.157160 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:12.082794 0.211061 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:12.294275 0.137825 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:12.432462 0.211823 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:22:12.644658 0.074624 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:23:46.738063 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:23:53.745656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:24:01.747120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:24:17.751906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:24:49.762520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:30:53.761376 3.002077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:31:00.769546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:31:08.770738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:31:21.619816 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 21:31:21.619993 1.036130 tcp 10.0.2.105 57871 -> 128.255.183.224 9027 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/01/26 21:31:24.773766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:31:56.780172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:38:00.785703 3.001794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:38:07.793413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:38:15.794742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:38:31.797756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:39:03.803945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:47:56.812161 3.002480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:48:03.820024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:48:11.822626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:48:27.824879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:48:59.831316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:52:19.167840 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 21:52:19.168121 0.057609 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.226132 0.055803 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.282329 0.179420 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.462160 0.068679 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.531199 0.044618 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.576143 0.171287 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.747769 0.057920 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.806093 0.071071 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.877565 0.036280 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:19.914136 0.179637 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.094161 0.044719 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.139262 0.082219 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.221820 0.067664 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.289809 0.085961 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.376101 0.167435 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.543913 0.170255 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:20.714602 0.327088 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.042058 0.038332 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.080743 0.076284 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.157441 0.145188 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.303047 0.157847 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.461258 0.211426 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.673069 0.073085 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.746537 0.144939 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:52:21.891888 0.216794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/26 21:55:03.836581 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 21:55:10.844091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:55:18.845857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:55:34.848750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 21:56:06.854960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:01:22.659288 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 22:01:22.659487 0.982465 tcp 10.0.2.105 57872 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/26 22:02:10.860465 3.003064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:02:17.868129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:02:25.869927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:02:41.873585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:03:13.879448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:09:17.885967 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:09:24.893070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:09:32.893836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:09:48.896788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:10:20.902925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:16:24.908645 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:16:31.916415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:16:39.917467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:16:55.922784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:17:27.930474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:22:36.971542 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 22:22:36.971732 0.059217 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.031369 0.059044 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.090839 0.179033 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.270249 0.069399 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.340040 0.045325 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.385756 0.170993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.557135 0.057349 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.614889 0.073222 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.688570 0.034390 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.723349 0.175834 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.899546 0.059690 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:37.959637 0.073504 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.033565 0.057078 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.091050 0.087750 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.179222 0.167421 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.347078 0.177969 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.525372 0.342622 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.868377 0.038364 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.907099 0.075830 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:38.983296 0.142901 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:39.126645 0.950086 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:40.077122 0.213959 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:40.291506 0.073866 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:40.365824 0.137913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:22:40.504346 0.210802 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:23:31.932704 3.000954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:23:38.940150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:23:46.941507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:24:02.944541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:24:34.950697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:30:38.956013 3.002204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:30:45.963999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:30:53.965633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:31:09.968687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:31:23.648243 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 22:31:23.648441 1.098408 tcp 10.0.2.105 57873 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/26 22:31:41.974981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:37:45.980261 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:37:52.987834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:38:00.989746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:38:16.992516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:38:48.998756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:47:45.011735 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:47:52.019047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:48:00.020643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:48:16.023780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:48:48.029764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:52:46.853445 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 22:52:46.853612 0.181393 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.035348 0.071322 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.107088 0.061372 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.168923 0.053690 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.222980 0.038423 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.261809 0.195045 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.457280 0.064930 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.522575 0.070683 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.593576 0.045343 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.639246 0.182272 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.821901 0.059340 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.881602 0.077084 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:47.959073 0.059117 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.018584 0.084953 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.103928 0.167430 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.271758 0.038374 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.310506 0.074680 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.385541 0.145054 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.531021 0.178484 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:48.709924 0.332228 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:49.042579 0.230547 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:49.273499 0.212199 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:49.486037 0.269378 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:49.755841 0.073417 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:52:49.829857 0.144680 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/26 22:54:52.045565 3.001999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 22:54:59.053332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:55:07.055176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:55:23.059618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 22:55:55.063744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:01:24.751340 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 23:01:24.751591 0.942890 tcp 10.0.2.105 57874 -> 128.255.183.224 9027 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/01/26 23:01:59.072387 2.999015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:02:06.077332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:02:14.079115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:02:30.084141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:03:02.087990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:09:06.114108 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:09:13.121049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:09:21.122677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:09:37.126594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:10:09.131594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:16:13.137679 3.001971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:16:20.145438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:16:28.146909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:16:44.149737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:17:16.155914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:22:54.953541 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 23:22:54.953683 0.252457 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.206546 0.091190 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.298172 0.062521 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.361050 0.062949 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.424383 0.039813 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.561475 0.171148 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.733034 0.060803 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.794230 0.074283 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.868833 0.033239 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:55.902428 0.185348 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.088178 0.043828 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.132418 0.076045 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.208873 0.056706 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.265960 0.083153 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.349477 0.259718 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.609578 0.044561 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.654506 0.259634 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:56.914574 0.144224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:57.059252 0.170417 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:57.230049 0.358077 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:57.588470 0.399620 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:57.988638 0.211618 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:58.200688 0.144910 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:58.345971 0.216039 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:22:58.562435 0.077857 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:23:20.161316 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:23:27.169613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:23:35.170897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:23:51.174046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:24:23.179632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:30:27.186037 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:30:34.193184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:30:42.194649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:30:58.197404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:31:25.717867 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 23:31:25.718060 0.961349 tcp 10.0.2.105 57875 -> 128.255.183.224 9027 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/01/26 23:31:30.203651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:37:34.209312 3.002180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:37:41.217455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:37:49.222974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:38:05.221881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:38:37.227571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:47:36.235183 3.002245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:47:43.242734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:47:51.244825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:48:07.250210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:48:39.253501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:53:06.017642 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/26 23:53:06.017887 0.059817 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.078029 0.181089 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.259568 0.079500 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.339512 0.057484 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.397370 0.037899 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.435605 0.170294 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.606260 0.062338 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.668920 0.079675 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.748989 0.037054 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.786336 0.185762 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:06.972471 0.046512 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.019343 0.080019 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.099755 0.059921 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.160011 0.083485 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.243877 0.076387 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.320650 0.141041 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.462079 0.179612 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.642130 0.169634 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.812120 0.038875 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:07.851277 0.316704 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:08.168421 0.159301 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:08.328074 0.213010 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:08.541461 0.151984 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:08.693844 0.206165 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:53:08.900420 0.079715 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/26 23:54:43.260115 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/26 23:54:50.266957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:54:58.273328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:55:14.271757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/26 23:55:46.277264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:01:26.687361 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 00:01:26.687582 0.937947 tcp 10.0.2.105 57876 -> 128.255.183.224 9027 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/27 00:01:50.288399 2.999745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:01:57.290882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:02:05.292086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:02:21.295641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:02:53.305728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:08:57.308098 3.000475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:09:04.315894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:09:12.315900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:09:28.318939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:10:00.325101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:16:04.331628 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:16:11.339893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:16:19.340856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:16:35.343318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:17:07.349097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:23:11.354767 3.001839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:23:18.362492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:23:23.189748 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 00:23:23.190000 0.059428 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:23.249819 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 00:23:26.363932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:23:39.026063 0.094968 tcp 10.0.2.105 57877 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 00:23:39.130831 0.075961 tcp 10.0.2.105 57878 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 00:23:39.207109 0.192042 tcp 10.0.2.105 57879 -> 195.113.214.236 443 SRPA* 0 0 59 39780 flow=From-Botnet-V2-TCP-Established 1970/01/27 00:23:39.399859 0.071788 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.472073 0.058094 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.530622 0.043567 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.574585 0.204542 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.779494 0.063930 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.843859 0.075298 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.919595 0.036142 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:39.956128 0.183898 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.140393 0.055698 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.196490 0.079329 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.276241 0.058925 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.335541 0.076539 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.412436 0.074592 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.487425 0.145813 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.633898 0.199006 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.833386 0.165978 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:40.999697 0.038577 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:41.038636 0.213785 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:41.252839 0.144850 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:41.398093 0.206227 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:41.604705 0.077144 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:41.682227 0.332055 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:42.014697 0.194090 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:23:42.366958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:24:14.372943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:30:18.379010 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:30:25.386470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:30:33.388107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:30:49.391203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:31:21.397000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:31:27.625733 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 00:31:27.625892 1.132324 tcp 10.0.2.105 57880 -> 128.255.183.224 9027 FSPA* 0 0 12 1495 flow=From-Botnet-V2-TCP-Established 1970/01/27 00:37:25.402327 3.022389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:37:32.430530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:37:40.433200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:37:56.437031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:38:28.441618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:47:30.452471 3.002225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:47:37.460306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:47:45.462187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:48:01.464995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:48:33.470996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:53:53.091150 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 00:53:53.091236 0.181559 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.273446 0.060045 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.333862 0.073561 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.407855 0.060106 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.468413 0.038285 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.507057 0.171546 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.679100 0.061441 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.740954 0.070083 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.811378 0.047680 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:53.859434 0.185244 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.045067 0.057083 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.102553 0.076338 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.179279 0.059222 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.238898 0.082846 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.322107 0.075850 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.398576 0.144926 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.543900 0.179342 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.723647 0.167245 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.891316 0.038583 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:54.930234 0.214153 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:55.144763 0.076555 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:55.221718 0.327879 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:55.550010 0.160932 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:55.711348 0.145084 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:53:55.856880 0.207663 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 00:54:37.476567 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 00:54:44.484406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:54:52.485553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:55:08.488464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 00:55:40.494819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:01:28.836531 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 01:01:28.836688 0.938584 tcp 10.0.2.105 57881 -> 128.255.183.224 9027 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/01/27 01:01:44.584093 2.998557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:01:51.588667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:01:59.589893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:02:15.598168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:02:47.598945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:08:51.634756 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:08:58.642685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:09:06.643968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:09:22.646908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:09:54.652837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:15:58.658722 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:16:05.666584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:16:13.668042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:16:29.671123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:17:01.676982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:23:05.682915 3.001499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:23:12.690140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:23:20.691733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:23:36.694906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:23:57.625433 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 01:23:57.625678 0.081813 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:57.707968 0.056221 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:57.764641 0.044557 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:57.809556 0.170026 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.046762 0.060268 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.107413 0.182869 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.290663 0.058081 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.349160 0.145059 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.494587 0.033145 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.528094 0.184623 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.713146 0.051718 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.765276 0.081237 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.846989 0.063560 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.910937 0.083557 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:58.994866 0.075077 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.070306 0.167031 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.237811 0.038091 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.276226 0.143454 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.420102 0.179001 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.599488 0.211553 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.811406 0.073755 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:23:59.885547 0.327901 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:24:00.213862 0.161163 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:24:00.375372 0.145298 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:24:00.521015 0.213150 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:24:08.704519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:30:12.706520 3.002213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:30:19.714317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:30:27.715740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:30:43.719098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:31:15.725048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:31:29.775549 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 01:31:29.775705 1.129216 tcp 10.0.2.105 57882 -> 128.255.183.224 9027 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/01/27 01:37:19.733207 2.999470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:37:26.741386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:37:34.740007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:37:50.743110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:38:22.749014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:47:24.760652 3.004499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:47:31.768263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:47:39.769683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:47:55.773371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:48:27.778983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:54:11.042704 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 01:54:11.042954 0.039275 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.082587 0.170604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.253613 0.061516 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.315474 0.181026 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.496875 0.059491 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.556824 0.072597 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.629845 0.061977 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.692378 0.142908 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.835676 0.079358 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:11.915427 0.180623 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.096486 0.049130 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.145984 0.080489 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.226883 0.056496 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.284014 0.079551 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.363906 0.073901 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.438116 0.167145 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.605592 0.038838 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.644746 0.212237 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.857393 0.076865 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:12.934657 0.331365 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:13.266408 0.144793 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:13.411765 0.178516 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:13.590638 0.214659 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:13.805974 0.156005 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:13.962377 0.152123 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/27 01:54:31.788418 2.998481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 01:54:38.792056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:54:46.793644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:55:02.796922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 01:55:34.803746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:01:30.905305 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 02:01:30.905401 0.956259 tcp 10.0.2.105 57883 -> 128.255.183.224 9027 FSPA* 0 0 12 1575 flow=From-Botnet-V2-TCP-Established 1970/01/27 02:01:38.808672 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:01:45.815969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:01:53.817704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:02:09.820451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:02:41.826888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:08:45.832044 3.002695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:08:52.841093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:09:00.842352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:09:16.844391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:09:48.850754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:15:52.858362 3.003004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:15:59.866999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:16:07.870341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:16:23.868511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:16:55.874582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:22:59.879960 3.002780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:23:06.887982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:23:14.889739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:23:30.892766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:24:02.899187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:24:28.145151 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 02:24:28.145312 0.038811 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.184532 0.178923 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.363844 0.059773 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.423983 0.072861 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.497204 0.057512 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.555026 0.068004 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.623406 0.201292 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.825093 0.061883 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.887412 0.041384 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:28.929148 0.179699 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.109209 0.049805 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.159450 0.077099 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.237227 0.060142 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.297797 0.084249 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.382416 0.076645 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.459429 0.213557 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.673351 0.078254 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:29.751975 0.353467 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.105791 0.166613 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.272805 0.038697 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.311906 0.143526 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.455887 0.178827 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.635094 0.208144 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:30.843594 0.156222 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:24:31.000372 0.138186 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:30:06.905103 3.052393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:30:13.935175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:30:21.923370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:30:37.926655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:31:09.932475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:31:31.864619 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 02:31:31.864764 1.005260 tcp 10.0.2.105 57884 -> 128.255.183.224 9027 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/01/27 02:37:13.939342 3.000726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:37:20.945819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:37:28.947259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:37:44.950778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:38:16.956483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:44:20.962860 3.001056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:44:27.970402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:44:35.971521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:44:51.974286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:45:23.980163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:51:27.992731 3.000764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:51:34.993760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:51:42.996172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:51:58.998682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:52:31.006228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:54:47.842263 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 02:54:47.842460 0.038112 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:47.881004 0.180513 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.061927 0.059595 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.121857 0.072547 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.194748 0.061396 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.256615 0.071801 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.328738 0.175364 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.504527 0.060823 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.565730 0.358615 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:48.924714 0.180967 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.106034 0.058794 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.165147 0.078271 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.243802 0.060193 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.304371 0.100654 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.405379 0.073683 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.479411 0.213599 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.693398 0.074052 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:49.767880 0.344830 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.113064 0.168741 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.282177 0.038279 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.320787 0.215386 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.536686 0.157922 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.695012 0.145116 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.840514 0.145586 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:54:50.986502 0.179379 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/27 02:58:35.011444 3.000637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 02:58:42.017814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:58:50.019389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:59:06.022362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 02:59:38.028487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:01:32.877299 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 03:01:32.877534 0.957385 tcp 10.0.2.105 57885 -> 128.255.183.224 9027 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/01/27 03:05:45.038765 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:05:52.046121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:06:00.047900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:06:16.050395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:06:48.057464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:12:52.062577 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:12:59.070196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:13:07.071476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:13:23.074567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:13:55.080879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:19:59.087131 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:20:06.093939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:20:14.095641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:20:30.098673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:21:02.104436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:24:57.413151 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 03:24:57.413377 0.059798 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.473563 0.083594 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.557503 0.055481 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.613361 0.067937 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.681671 0.174184 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.856390 0.063892 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.920675 0.045551 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:57.966639 0.180095 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.147109 0.059821 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.207294 0.183471 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.391143 0.053486 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.444999 0.071794 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.517161 0.058857 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.576583 0.087472 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.664560 0.077169 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.742119 0.211378 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:58.953866 0.076193 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.030463 0.038605 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.069427 0.214044 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.283934 0.157884 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.442179 0.137648 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.580167 0.382649 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:24:59.963225 0.167365 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:25:00.131005 0.145749 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:25:00.277131 0.177671 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:27:06.113235 2.998833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:27:13.118610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:27:21.119470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:27:37.123229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:28:09.128893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:31:33.834247 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 03:31:33.834425 0.966162 tcp 10.0.2.105 57886 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/27 03:34:13.134878 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:34:20.141900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:34:28.143552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:34:44.147047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:35:16.152501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:41:20.158577 3.023856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:41:27.176052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:41:35.179219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:41:51.180280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:42:23.186727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:49:36.201492 3.012099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:49:43.209130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:49:51.210870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:50:07.213887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:50:39.219978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:55:18.261354 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 03:55:18.261518 0.057185 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.319087 0.073238 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.392712 0.061909 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.455006 0.071777 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.527182 0.217171 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.744734 0.063078 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.808178 0.039162 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:18.847701 0.181902 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.029953 0.038950 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.069213 0.183924 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.253542 0.045030 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.298906 0.081673 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.380989 0.058786 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.440173 0.111766 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.552620 0.078095 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.631105 0.212148 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.843659 0.072771 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.916837 0.038768 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:19.955972 0.213042 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:20.169442 0.355059 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:20.524853 0.166760 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:20.691982 0.145171 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:20.837496 0.686937 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:21.524804 0.152000 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:55:21.677203 0.176660 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/27 03:56:54.231611 3.001946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 03:57:01.240172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:57:09.243520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:57:25.243385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 03:57:57.249964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:01:34.802568 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 04:01:34.802722 0.922795 tcp 10.0.2.105 57887 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/01/27 04:04:05.262124 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:04:12.269551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:04:20.270116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:04:36.273381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:05:08.279536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:11:12.284806 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:11:19.292600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:11:27.294084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:11:43.297399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:12:15.303009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:18:19.310675 3.000102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:18:26.318912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:18:34.318414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:18:50.323012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:19:22.327147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:25:26.336637 2.998112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:25:33.340545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:25:36.719202 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 04:25:36.719374 0.059604 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:36.779403 0.059471 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:36.839584 0.076401 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:36.916608 0.073270 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:36.990373 0.175183 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.166002 0.063074 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.229509 0.039515 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.269428 0.180470 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.450384 0.031929 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.482725 0.181084 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.664243 0.061781 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.726429 0.070801 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.797662 0.057692 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.855764 0.082715 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:37.938876 0.072483 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.011779 0.222371 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.234555 0.079081 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.314026 0.038459 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.352851 0.218477 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.571760 0.333062 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:38.905243 0.167166 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:39.072864 0.145692 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:39.218971 0.178701 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:39.398131 0.837363 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:40.235935 0.138137 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:25:41.342155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:25:57.344962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:26:29.351052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:31:35.731921 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 04:31:35.732121 0.992804 tcp 10.0.2.105 57888 -> 128.255.183.224 9027 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/01/27 04:32:33.356409 3.002464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:32:40.364424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:32:48.366954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:33:04.369000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:33:36.375208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:39:40.381100 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:39:47.388667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:39:55.389707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:40:11.393184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:40:43.402714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:48:43.411195 3.002441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:48:50.422469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:48:58.420831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:49:14.423692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:49:46.429766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:55:52.846603 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 04:55:52.846783 0.159186 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.006342 0.068828 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.075554 0.175090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.251081 0.060191 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.311677 0.044158 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.356424 0.052122 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.408836 0.057212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.466360 0.179824 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.646617 0.055234 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.702216 0.187425 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.890047 0.058847 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:53.949247 0.072616 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.022300 0.057595 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.080270 0.075885 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.156594 0.075109 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.232113 0.214328 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.446848 0.078630 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.525886 0.038347 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.564584 0.166059 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.731055 0.160376 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:54.891824 0.214062 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:55.106284 0.376779 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:55.483448 0.152086 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:55.635894 0.172085 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:55:55.808400 0.475053 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 04:56:02.442973 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 04:56:09.450255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:56:17.451963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:56:33.455195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 04:57:05.460891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:01:36.731822 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 05:01:36.732044 0.945159 tcp 10.0.2.105 57889 -> 128.255.183.224 9027 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/01/27 05:03:09.466778 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:03:16.474274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:03:24.476359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:03:40.479085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:04:12.490994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:10:16.490348 3.002320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:10:23.497867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:10:31.499957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:10:47.502891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:11:19.508924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:17:23.514779 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:17:30.522575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:17:38.524740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:17:54.527203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:18:26.536063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:24:30.538476 3.002017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:24:37.546389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:24:45.547904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:25:01.550943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:25:33.563178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:26:01.337452 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 05:26:01.337644 0.074150 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.412199 0.071777 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.484464 0.174430 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.659333 0.062998 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.722697 0.040183 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.763304 0.058404 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.822068 0.059645 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:01.882097 0.564369 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.446887 0.050443 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.497736 0.177587 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.675747 0.047257 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.723438 0.076002 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.799874 0.057085 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.857349 0.082072 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:02.939805 0.075254 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.015460 0.213081 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.228987 0.076021 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.305374 0.038434 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.344192 0.166796 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.511319 0.142483 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.654195 0.144614 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.799243 0.178587 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:03.978265 0.216849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:04.195579 0.329436 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:26:04.525436 0.158928 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:31:37.562805 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:31:37.680570 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 05:31:37.680718 0.939940 tcp 10.0.2.105 57890 -> 128.255.183.224 9027 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/01/27 05:31:44.569738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:31:52.571902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:32:08.574631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:32:40.580890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:38:44.586567 3.012987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:38:51.604136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:38:59.605869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:39:15.608849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:39:47.614751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:48:15.628533 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:48:22.635378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:48:30.636867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:48:46.639702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:49:18.646144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:55:22.651734 3.001820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 05:55:29.659372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:55:37.660969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:55:53.663573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:56:23.117316 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 05:56:23.117488 0.174985 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.292838 0.061664 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.354937 0.044236 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.399554 0.060909 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.460850 0.059785 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.521038 0.075547 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.596973 0.070547 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:23.667908 0.333095 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.001406 0.039911 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.041720 0.177835 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.219911 0.054974 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.275271 0.071539 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.347216 0.057805 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.405425 0.074808 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.480642 0.076479 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.557497 0.217277 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.775213 0.079488 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.855084 0.038581 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:24.894055 0.151682 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:25.046129 0.179349 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:25.225910 0.214698 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:25.441007 0.166816 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:25.608286 0.143556 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:25.669895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 05:56:25.752209 0.321061 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/27 05:56:26.073669 0.444989 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:01:38.621552 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 06:01:38.621713 0.955487 tcp 10.0.2.105 57891 -> 128.255.183.224 9027 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/01/27 06:02:32.680640 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:02:39.690897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:02:47.689836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:03:03.691959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:03:35.698249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:09:39.703637 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:09:46.711425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:09:54.713126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:10:10.716090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:10:42.722079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:16:46.729303 3.000550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:16:53.735843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:17:01.736915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:17:17.745147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:17:49.750923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:23:53.751972 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:24:00.759471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:24:08.761691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:24:24.765972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:24:56.781348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:26:48.841380 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 06:26:48.861209 0.175420 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.037040 0.063363 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.100767 0.038812 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.139919 0.061213 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.201520 0.060707 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.262605 0.072917 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.335908 0.071179 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.407526 0.180608 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:49.588720 0.622699 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.211839 0.180346 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.392702 0.054472 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.447553 0.076093 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.524029 0.057837 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.582228 0.083764 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.666396 0.075388 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:50.742126 0.310368 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:51.052914 0.079101 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:51.132433 0.038472 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:26:51.171274 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 06:27:07.980701 0.067109 tcp 10.0.2.105 57892 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 06:27:08.048136 0.052562 tcp 10.0.2.105 57893 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 06:27:08.101006 0.163429 tcp 10.0.2.105 57894 -> 195.113.214.236 443 SRPA* 0 0 53 47451 flow=From-Botnet-V2-TCP-Established 1970/01/27 06:27:08.264959 0.166137 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:27:08.431485 0.145611 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:27:08.577532 0.144992 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:27:08.722911 0.179595 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:27:08.902921 0.314983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:27:09.218269 0.790777 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:31:00.775786 3.003132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:31:07.783521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:31:15.784876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:31:31.787902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:31:39.579387 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 06:31:39.579570 0.949351 tcp 10.0.2.105 57895 -> 128.255.183.224 9027 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/01/27 06:32:03.793973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:38:07.799741 3.001906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:38:14.807284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:38:22.808967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:38:38.811930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:39:10.817799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:47:57.830040 2.999862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:48:04.836594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:48:12.838305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:48:28.839983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:49:00.847888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:55:04.852560 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 06:55:11.859677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:55:19.861210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:55:35.864229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:56:07.875091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 06:57:14.797016 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 06:57:14.797218 0.213293 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.010911 0.065171 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.076558 0.040646 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.117603 0.060488 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.178498 0.056298 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.235153 0.073264 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.308763 0.188301 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.497484 0.058331 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.556191 0.075884 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.632472 0.181512 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.814313 0.182162 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:15.996909 0.059015 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.056351 0.043893 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.100644 0.078251 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.179277 0.251665 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.431325 0.076992 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.508679 0.038847 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.547888 0.114415 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.662671 0.076180 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.739256 0.151987 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:16.891855 0.177619 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:17.069877 0.323403 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:17.393679 0.167379 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:17.561441 0.145198 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 06:57:17.707029 0.700471 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:01:40.529291 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 07:01:40.529444 1.054276 tcp 10.0.2.105 57896 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/27 07:02:16.883360 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 07:02:23.891437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:02:31.892225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:02:47.895747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:03:19.901222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:09:23.907104 3.002073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:09:30.914714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:09:38.916614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:09:54.919318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:10:26.926094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:16:30.931751 3.001513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:16:37.938523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:16:45.940373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:17:01.943299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:17:33.949821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:23:37.955184 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:23:44.962818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:23:52.964260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:24:08.967333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:24:40.975458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:27:29.015276 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 07:27:29.015506 0.044729 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:29.060681 0.059684 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:29.120741 0.069674 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:29.190813 0.077430 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:29.268638 0.175668 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:29.444762 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 07:27:44.972509 0.068137 tcp 10.0.2.105 57897 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 07:27:45.041020 0.052902 tcp 10.0.2.105 57898 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 07:27:45.094276 0.294362 tcp 10.0.2.105 57899 -> 195.113.214.236 443 SRPA* 0 0 46 41918 flow=From-Botnet-V2-TCP-Established 1970/01/27 07:27:45.389225 0.065258 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:45.454923 0.054454 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:45.509801 0.072935 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:45.583126 0.180972 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:45.764555 0.179274 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:45.944255 0.057445 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.002072 0.096608 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.099103 0.073592 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.173056 0.273735 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.447198 0.080054 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.527700 0.044648 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.572705 0.104540 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.677655 0.072885 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.750958 0.144672 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:46.896045 0.178306 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:47.074714 0.330379 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:47.405463 0.481301 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:47.887095 0.167230 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:27:48.054744 0.143481 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:30:44.979984 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:30:51.986807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:30:59.988719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:31:15.991168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:31:41.588196 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 07:31:41.588366 1.026633 tcp 10.0.2.105 57900 -> 128.255.183.224 9027 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/01/27 07:31:47.997289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:37:52.003399 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:37:59.010345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:38:07.012097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:38:23.015118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:38:55.021538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:47:50.034236 3.000715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:47:57.040447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:48:05.041842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:48:21.047487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:48:53.051707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:54:57.056703 3.007769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 07:55:04.069379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:55:12.065847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:55:28.068937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:56:00.075363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 07:58:04.644507 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 07:58:04.644714 0.244561 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:04.889671 0.087191 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:04.977256 0.059889 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.037504 0.039157 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.077175 0.060204 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.137764 0.175217 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.313339 0.062902 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.376805 0.044410 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.421553 0.069194 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.491310 0.182944 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.674824 0.181318 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.856504 0.057906 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:05.914757 0.202970 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.118131 0.073313 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.192061 0.234059 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.426568 0.077365 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.504341 0.038092 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.542792 0.106200 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.649374 0.077989 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.727764 0.138094 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:06.866213 0.178722 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:07.045315 0.346290 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:07.391975 0.141446 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:07.533839 0.839379 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/27 07:58:08.373681 0.166441 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:01:42.618080 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 08:01:42.618264 0.960391 tcp 10.0.2.105 57901 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/01/27 08:02:06.083757 3.002575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 08:02:13.091483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:02:21.093234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:02:37.095747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:03:09.101740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:09:13.107683 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:09:20.115257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:09:28.116708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:09:44.119532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:10:16.125914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:16:20.132114 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:16:27.144044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:16:35.140923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:16:51.144558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:17:23.149914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:23:27.155758 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:23:34.163382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:23:42.164939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:23:58.167474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:24:30.174087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:28:33.709916 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 08:28:33.710093 0.060456 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:33.770953 0.038586 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:33.809953 0.060095 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:33.870579 0.176497 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.047484 0.067070 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.114951 0.218007 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.333400 0.073817 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.407607 0.056093 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.464082 0.072136 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.536634 0.182859 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.719902 0.182515 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.902867 0.059378 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:34.962668 0.046689 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.009744 0.073653 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.083819 0.239225 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.323471 0.081167 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.405060 0.038537 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.443968 0.082487 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.526844 0.080927 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.608371 0.151865 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.760602 0.177769 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:35.938757 0.322164 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:36.261274 0.144077 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:36.405749 0.157845 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:28:36.563953 0.167664 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:30:34.179830 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:30:41.187166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:30:49.189109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:31:05.191670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:31:37.197504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:31:43.577041 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 08:31:43.577211 1.027723 tcp 10.0.2.105 57902 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/27 08:37:41.203536 3.079635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:37:48.252439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:37:56.225511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:38:12.225760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:38:44.232009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:47:44.240840 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:47:51.248160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:47:59.249998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:48:15.253419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:48:47.259632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:54:51.265865 3.003187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 08:54:58.276777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:55:06.273774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:55:22.277123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:55:54.283712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 08:58:58.708495 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 08:58:58.708707 0.060619 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:58.769699 0.174206 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:58.944389 0.059956 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.004727 0.062445 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.067519 0.039601 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.107466 0.218098 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.325936 0.079112 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.405409 0.035953 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.441679 0.144905 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.586993 0.181436 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.768856 0.179949 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:58:59.949236 0.057942 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.007620 0.047563 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.055539 0.075419 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.131312 0.305872 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.437557 0.072767 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.510705 0.044754 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:00.555766 0.549292 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.105440 0.079243 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.185073 0.138231 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.323654 0.170146 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.494143 0.235033 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.729613 0.166556 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:01.896602 0.324224 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 08:59:02.221221 0.143104 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:01:44.606620 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 09:01:44.606716 0.955079 tcp 10.0.2.105 57903 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/27 09:01:59.290952 3.000687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 09:02:06.297689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:02:14.299251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:02:30.301998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:03:02.308577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:09:06.313811 3.001875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:09:13.321403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:09:21.322869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:09:37.326363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:10:09.332054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:16:13.338061 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:16:20.345993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:16:28.347041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:16:44.349480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:17:16.355946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:23:20.361310 3.002159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:23:27.369267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:23:35.370749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:23:51.373897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:24:23.379694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:29:05.916687 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 09:29:05.916810 0.064315 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:05.981525 0.066257 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.048216 0.040314 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.088896 0.062868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.152156 0.174901 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.327502 0.219352 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.547196 0.073982 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.621527 0.089658 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.711560 0.075430 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.787313 0.181188 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:06.968931 0.180523 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.149885 0.056483 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.206731 0.073358 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.280478 0.072536 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.353349 0.252590 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.606353 0.080517 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.687318 0.038420 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.726127 0.144664 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:07.871165 0.177134 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.048690 0.154272 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.203416 0.086681 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.290518 0.081574 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.372471 0.145665 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.518470 0.166087 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:29:08.684883 0.330356 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:30:27.385867 3.001636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:30:34.393272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:30:42.394597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:30:58.397981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:31:30.403824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:31:45.566345 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 09:31:45.566488 0.978686 tcp 10.0.2.105 57904 -> 128.255.183.224 9027 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/01/27 09:37:34.409854 3.053358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:37:41.443072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:37:49.428775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:38:05.431655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:38:37.437862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:47:38.447802 3.001860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:47:45.455838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:47:53.457334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:48:09.459953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:48:41.468737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:54:45.471210 3.002715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 09:54:52.479733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:55:00.484029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:55:16.490137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:55:48.490329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 09:59:23.059495 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 09:59:23.059708 0.038590 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.098632 0.060817 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.159847 0.063775 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.224014 0.061177 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.285553 0.212427 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.498421 0.293242 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.792052 0.072393 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.864824 0.064117 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.929313 0.070168 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:23.999862 0.178290 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.178538 0.179769 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.358667 0.056221 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.415216 0.044891 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.460630 0.074167 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.535205 0.283908 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.819488 0.079206 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.899113 0.038485 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:24.937950 0.145120 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:25.083484 0.218216 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:25.302126 0.163830 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:25.466383 0.146201 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:25.612956 0.166365 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:25.779696 0.330117 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:26.110326 0.096884 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/27 09:59:26.207829 0.077495 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:01:46.545709 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 10:01:46.545862 0.986635 tcp 10.0.2.105 57905 -> 128.255.183.224 9027 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/27 10:01:52.496177 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 10:01:59.503579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:02:07.505457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:02:23.508495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:02:55.514133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:08:59.520198 3.001604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:09:06.527684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:09:14.529066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:09:30.532495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:10:02.538398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:16:06.543756 3.002129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:16:13.551512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:16:21.553037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:16:37.556188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:17:09.562182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:23:13.567807 3.002117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:23:20.575472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:23:28.577615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:23:44.579479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:24:16.585807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:29:34.473681 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 10:29:34.473785 0.063971 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:34.538130 0.060359 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:34.598847 0.175063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:34.774315 0.219188 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:34.993954 0.046156 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.040587 0.059179 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.100186 0.073959 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.174596 0.091221 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.266269 0.067388 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.334048 0.179354 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.513855 0.179772 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.694076 0.058811 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:35.753228 0.000000 udp 10.0.2.105 7010 -> 95.89.179.81 6418 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 10:29:51.376879 0.076632 tcp 10.0.2.105 57906 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 10:29:51.453753 0.053405 tcp 10.0.2.105 57907 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 10:29:51.507479 0.138510 tcp 10.0.2.105 57908 -> 195.113.214.236 443 SRPA* 0 0 33 24973 flow=From-Botnet-V2-TCP-Established 1970/01/27 10:29:51.646512 0.077134 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:51.724056 0.248937 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:51.973362 0.076486 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.050274 0.038575 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.089296 0.159412 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.249168 0.142738 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.392312 0.166604 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.559283 0.323979 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:52.883654 0.137980 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:53.022027 0.178517 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:53.201000 0.086133 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:29:53.287549 0.076836 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/27 10:30:20.591619 3.002172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:30:27.599390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:30:35.600487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:30:51.603938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:31:23.610223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:31:47.534930 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 10:31:47.535037 1.005156 tcp 10.0.2.105 57909 -> 128.255.183.224 9027 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/01/27 10:37:27.616900 3.006521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:37:34.623442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:37:42.624989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:37:58.628135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:38:30.634076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:47:32.646200 3.007055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:47:39.653322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:47:47.655249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:48:03.657352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:48:35.664835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:54:39.669744 3.001980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 10:54:46.677587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:54:54.679068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:55:10.681861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 10:55:42.688087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:00:07.990178 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 11:00:07.990368 0.042870 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.033606 0.174766 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.208774 0.213215 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.422380 0.044452 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.467193 0.060079 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.527621 0.071487 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.599477 0.061734 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.661594 0.058352 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.720266 0.181643 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:08.902353 0.180139 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.082904 0.056176 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.139449 0.035342 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.175098 0.070920 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.246387 0.212778 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.459535 0.074682 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.534612 0.044753 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.579779 0.077462 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.657637 0.140241 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.798298 0.167656 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:09.966345 0.327484 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:10.294272 0.151738 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:10.446398 0.178357 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:10.625193 0.157384 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:10.782970 0.084138 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:00:10.867496 0.078799 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:01:46.695904 3.002837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:01:48.546460 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 11:01:48.546638 0.941366 tcp 10.0.2.105 57910 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/01/27 11:01:53.703407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:02:01.702958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:02:17.707102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:02:49.711997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:08:54.718720 3.002012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:09:01.726814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:09:09.728277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:09:25.733096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:09:57.737586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:16:01.743124 3.002454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:16:08.750121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:16:16.752206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:16:32.755563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:17:04.761354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:23:08.767724 3.001295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:23:15.774767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:23:23.781062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:23:39.781205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:24:11.795062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:30:15.801015 3.002115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:30:22.809125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:30:30.810244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:30:31.872068 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 11:30:31.872301 0.214249 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.086971 0.039944 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.127302 0.060866 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.188729 0.076526 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.265674 0.049282 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.315386 0.175458 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.491238 0.063369 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.555019 0.058381 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.613747 0.183522 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.797635 0.179706 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:32.977732 0.059610 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.037736 0.031805 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.069920 0.072116 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.142454 0.215706 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.358513 0.077579 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.436651 0.044553 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.481641 0.075059 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.557088 0.148003 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.705511 0.165957 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:33.871888 0.326843 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:34.199132 0.151747 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:34.351221 0.084491 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:34.436097 0.074041 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:34.510484 0.178855 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:34.689709 0.688000 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/27 11:30:46.813413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:31:18.819215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:31:49.494053 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 11:31:49.494236 0.957800 tcp 10.0.2.105 57911 -> 128.255.183.224 9027 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/01/27 11:37:22.825121 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:37:29.833657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:37:37.834536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:37:53.837652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:38:25.843100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:47:26.853600 3.001859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:47:33.861435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:47:41.863419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:47:57.865440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:48:29.871561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:54:33.882236 2.998697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 11:54:40.885177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:54:48.891016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:55:04.889807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 11:55:36.900914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:00:45.389920 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 12:00:45.390056 0.060678 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:45.451124 0.234758 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:45.686287 0.040192 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:45.727158 0.065394 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:45.792902 0.049943 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:45.843241 0.198327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.041973 0.052959 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.095272 0.059112 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.154702 0.181880 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.337219 0.180902 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.518504 0.059802 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.578622 0.032784 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.611719 0.067453 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.679529 0.212497 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.892452 0.075559 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:46.968354 0.038508 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.007229 0.073468 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.081057 0.144574 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.225986 0.165627 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.392036 0.328586 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.721023 0.075720 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.797118 0.180623 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:47.978119 0.144693 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:48.123290 0.083592 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:00:48.207284 0.000000 udp 10.0.2.105 7010 -> 98.69.224.36 1591 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 12:01:03.431512 0.070054 tcp 10.0.2.105 57912 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 12:01:03.501851 0.055167 tcp 10.0.2.105 57913 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 12:01:03.557290 0.154254 tcp 10.0.2.105 57914 -> 195.113.214.236 443 SRPA* 0 0 41 34602 flow=From-Botnet-V2-TCP-Established 1970/01/27 12:01:40.901931 3.001508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:01:47.908887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:01:50.453121 0.930801 tcp 10.0.2.105 57915 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/27 12:01:55.910726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:02:11.913522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:02:43.919733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:08:48.927071 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:08:55.933958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:09:03.936150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:09:19.938682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:09:51.944702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:15:55.950536 3.006558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:16:02.959497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:16:10.959897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:16:26.965134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:16:58.969097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:23:02.977583 2.998935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:23:09.982609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:23:17.983814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:23:33.990750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:24:05.993095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:30:09.998365 3.005522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:30:17.006331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:30:25.007750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:30:41.010355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:31:13.016899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:31:31.443888 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 12:31:31.444028 0.987053 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.431536 0.058952 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.490870 0.046055 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.537332 0.067094 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.604875 0.046694 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.651952 0.174512 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.826851 0.063210 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.890441 0.060181 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:32.951043 0.175235 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.126644 0.181137 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.308223 0.056995 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.365602 0.035310 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.401287 0.217041 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.618677 0.244161 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.863278 0.075100 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.938828 0.038480 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:33.977735 0.071406 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.049528 0.141665 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.191613 0.166361 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.358328 0.319894 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.678631 0.071856 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.750841 0.080606 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:34.831799 0.170894 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:35.003099 0.074035 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:35.077530 0.144673 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 12:31:51.382515 0.966999 tcp 10.0.2.105 57916 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/27 12:37:17.022510 3.002064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:37:24.033923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:37:32.031841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:37:48.034976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:38:20.043530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:44:24.046519 3.002066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:44:31.054551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:44:39.055874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:44:55.058821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:45:27.064995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:51:31.070529 3.001863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:51:38.079969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:51:46.079833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:52:02.083490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:52:34.088973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:58:38.096632 3.000035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 12:58:45.102231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:58:53.103704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:59:09.108054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 12:59:41.112768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:01:41.175561 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 13:01:41.175682 0.160817 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.336968 0.057597 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.395001 0.045090 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.440683 0.064325 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.505402 0.048981 udp 10.0.2.105 7010 <-> 95.89.179.81 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.554779 0.174142 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.729272 0.057185 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.786836 0.055259 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:41.842506 0.174263 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.017162 0.180215 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.197793 0.051666 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.249849 0.042280 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.292649 0.213694 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.506726 0.212342 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.719457 0.071120 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.790974 0.038463 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.829825 0.072035 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:42.902275 0.144598 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.047307 0.066432 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.114078 0.075716 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.190237 0.170922 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.361515 0.075984 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.437900 0.144654 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.582888 0.166992 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:43.750282 0.318170 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:01:52.353566 0.944501 tcp 10.0.2.105 57917 -> 128.255.183.224 9027 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/01/27 13:05:50.125699 3.003848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:05:57.133478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:06:05.134914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:06:21.137648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:06:53.143832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:12:57.149845 3.001670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:13:04.157320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:13:12.159069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:13:28.161759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:14:00.168546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:20:04.174199 3.001405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:20:11.196533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:20:19.193009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:20:35.195761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:21:07.201848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:27:11.208128 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:27:18.215442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:27:26.216844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:27:42.219699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:28:14.225733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:31:53.300968 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 13:31:53.301077 0.973169 tcp 10.0.2.105 57918 -> 128.255.183.224 9027 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/01/27 13:31:56.395876 0.156371 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:31:56.552715 0.058068 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:31:56.611175 0.045899 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:31:56.657443 0.067779 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:31:56.725608 0.000000 udp 10.0.2.105 7010 -> 95.89.179.81 6418 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 13:32:13.311665 0.066862 tcp 10.0.2.105 57919 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 13:32:13.378782 0.051969 tcp 10.0.2.105 57920 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 13:32:13.431062 0.151320 tcp 10.0.2.105 57921 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/27 13:32:13.582897 0.175129 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:13.758451 0.058607 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:13.817426 0.055357 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:13.873122 0.182362 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.055839 0.181832 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.238061 0.057256 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.295640 0.061621 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.357663 0.208733 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.566725 0.211967 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.779154 0.073783 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.853277 0.040131 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.893813 0.075335 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:14.969560 0.143531 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.113496 0.071273 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.185164 0.075939 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.261451 0.178029 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.439874 0.080210 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.520626 0.144585 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.665647 0.166470 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:32:15.832614 0.329648 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/27 13:34:18.232028 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:34:25.239217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:34:33.240763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:34:49.243739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:35:21.250158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:41:25.255909 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:41:32.263247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:41:40.264890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:41:56.267697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:42:28.273685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:49:38.284752 3.004485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:49:45.295950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:49:53.293709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:50:09.296626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:50:41.303740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:56:53.312230 2.999672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 13:57:00.319968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:57:08.319078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:57:24.322085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 13:57:56.328141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:01:54.283472 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:01:54.283576 1.034210 tcp 10.0.2.105 57922 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:02:35.563397 0.000000 udp 10.0.2.105 7010 -> 95.89.179.81 6418 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:02:40.156639 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:02:51.123487 0.067857 tcp 10.0.2.105 57923 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:02:51.191604 0.054190 tcp 10.0.2.105 57924 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:02:51.246070 0.140759 tcp 10.0.2.105 57925 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:02:51.387300 3.587054 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 4 1053 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.450406 2.951156 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1140 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.507036 3.123753 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 4 1241 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.668966 3.013868 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1244 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.708788 3.143570 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1207 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.883298 3.026522 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 4 1046 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.937101 3.086083 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1356 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:51.991121 3.218489 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 1166 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.171153 3.219128 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 1173 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.351895 3.085688 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 4 1222 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.409983 3.070186 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 4 1087 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.449417 3.292563 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1367 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.671162 3.071320 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 3 570 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.926066 0.072948 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:52.999367 0.038136 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.037800 0.077317 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.115450 0.139970 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.255804 0.068519 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.324707 0.080350 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.405491 0.151692 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.557604 0.165213 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:53.723223 0.326712 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:54.050365 0.084485 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:02:54.135227 0.176537 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:04.661630 0.068640 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:04.744057 0.039026 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:04.783523 0.120367 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:04.904456 0.142488 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.047397 0.069585 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.117469 0.088195 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.206254 0.151977 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.358766 0.164435 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.523687 0.066846 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.590998 0.176856 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:05.768468 0.333745 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:06.102814 0.000000 udp 10.0.2.105 7010 -> 88.70.183.224 5047 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:11.290944 0.000000 udp 10.0.2.105 7010 -> 50.147.54.161 7355 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:16.158845 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:03:18.531416 0.000000 udp 10.0.2.105 7010 -> 86.30.200.49 1794 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:26.583482 0.147205 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:03:26.760976 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:35.739280 0.000000 udp 10.0.2.105 7010 -> 86.130.167.179 7930 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:40.663144 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:03:41.053699 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:49.151577 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 1499 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:03:54.312831 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 1432 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:00.773728 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:04.339992 3.005309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 14:04:05.659060 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:04:08.717132 0.000000 udp 10.0.2.105 7010 -> 24.156.37.111 7825 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:11.349780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:04:15.704919 0.000000 udp 10.0.2.105 7010 -> 41.105.37.26 9937 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:19.348468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:04:23.094551 0.000000 udp 10.0.2.105 7010 -> 194.218.32.246 1448 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:29.724000 0.074869 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:04:29.808543 0.000000 udp 10.0.2.105 7010 -> 173.172.250.56 7621 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:34.661050 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:04:35.351867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:04:37.941090 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:46.537412 0.000000 udp 10.0.2.105 7010 -> 99.9.238.186 2652 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:53.658375 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:04:58.655308 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:05:00.387933 0.000000 udp 10.0.2.105 7010 -> 75.98.148.80 4730 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:07.357608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:05:08.569716 0.052792 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:05:08.649097 0.164768 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:05:08.837392 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:15.089689 0.000000 udp 10.0.2.105 7010 -> 72.70.56.11 3231 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:20.187155 0.000000 udp 10.0.2.105 7010 -> 202.191.162.51 1058 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:25.163248 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:05:26.545421 0.000000 udp 10.0.2.105 7010 -> 86.2.81.209 2530 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:35.478510 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:41.847511 0.000000 udp 10.0.2.105 7010 -> 80.46.44.40 2972 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:47.116042 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:05:51.661282 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:05:55.116989 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:03.849354 0.000000 udp 10.0.2.105 7010 -> 79.46.204.236 6571 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:12.521650 0.329090 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 857 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:06:12.878664 0.050755 udp 10.0.2.105 7010 -> 89.91.23.145 3728 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:12.929419 0.000000 icmp 89.91.23.145 0x0303 -> 10.0.2.105 0x900e URP 192 1 186 flow=Background 1970/01/27 14:06:17.158214 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:06:20.282956 0.000000 udp 10.0.2.105 7010 -> 76.245.12.189 3291 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:28.604990 0.000000 udp 10.0.2.105 7010 -> 86.137.248.53 7235 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:36.606242 0.020905 udp 10.0.2.105 7010 -> 176.198.66.204 5230 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:36.627147 0.000000 icmp 176.198.66.204 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 287 flow=Background 1970/01/27 14:06:41.162724 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:06:42.915344 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:49.905487 0.000000 udp 10.0.2.105 7010 -> 84.62.1.98 5024 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:06:58.747983 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:04.286042 0.053376 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:07:04.387699 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:09.162826 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:07:12.762164 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:19.187554 0.000000 udp 10.0.2.105 7010 -> 173.9.47.141 5827 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:26.647636 0.000000 udp 10.0.2.105 7010 -> 2.177.185.151 4373 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:35.470464 0.078517 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:07:35.699913 0.000000 udp 10.0.2.105 7010 -> 4.238.255.50 3072 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:40.157327 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:07:41.159140 0.000000 udp 10.0.2.105 7010 -> 187.162.94.249 4444 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:41.895785 0.000000 udp 10.0.2.105 7010 <- 4.238.255.50 3072 RSP 0 0 1 539 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:49.270909 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:07:55.489496 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:01.037692 0.000000 udp 10.0.2.105 7010 -> 190.250.102.231 8671 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:05.664239 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:08:09.079301 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:14.477100 0.000000 udp 10.0.2.105 7010 -> 95.76.248.6 2126 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:22.298263 0.069755 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:08:22.531650 0.100659 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:08:22.671436 0.000000 udp 10.0.2.105 7010 -> 190.8.255.111 3156 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:27.715932 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:32.663110 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:08:35.317111 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:42.517038 0.000000 udp 10.0.2.105 7010 -> 80.180.204.184 8082 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:48.355467 0.000000 udp 10.0.2.105 7010 -> 82.6.23.15 3475 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:08:57.258357 0.041754 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:08:57.320179 0.000000 udp 10.0.2.105 7010 -> 2.50.138.249 6431 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:02.155282 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:09:02.545454 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 8311 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:08.985510 0.245178 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:09:09.436956 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:16.891596 0.047982 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:09:16.979469 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:25.178857 0.037497 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:25.216354 0.000000 icmp 217.91.253.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 186 flow=Background 1970/01/27 14:09:30.155447 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:09:33.360521 0.000000 udp 10.0.2.105 7010 -> 84.94.106.203 8891 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:41.541955 0.000000 udp 10.0.2.105 7010 -> 85.220.152.99 2615 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:50.144774 0.000000 udp 10.0.2.105 7010 -> 115.134.158.102 6504 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:09:54.660185 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:09:58.436301 0.207223 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:09:58.906925 0.000000 udp 10.0.2.105 7010 -> 24.200.146.136 2286 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:06.147814 0.000000 udp 10.0.2.105 7010 -> 24.211.218.253 7370 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:13.838681 0.074650 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:10:13.945757 0.057556 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:10:14.026009 0.000000 udp 10.0.2.105 7010 -> 46.1.189.38 2378 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:18.654789 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:10:22.340810 0.220887 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:10:22.662061 0.058555 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:10:23.416844 0.000000 udp 10.0.2.105 7010 -> 173.161.36.149 8727 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:30.172713 0.000000 udp 10.0.2.105 7010 -> 186.71.64.59 8597 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:37.222160 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:42.389617 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:47.162552 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:10:51.192198 0.421235 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 859 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:10:52.116410 0.000000 udp 10.0.2.105 7010 -> 50.75.14.152 2021 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:10:59.940204 0.000000 udp 10.0.2.105 7010 -> 2.28.249.170 2350 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:08.727533 0.000000 udp 10.0.2.105 7010 -> 217.41.1.184 6616 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:13.367355 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 14:11:13.664020 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:11:16.318997 0.000000 udp 10.0.2.105 7010 -> 173.200.120.65 6167 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:20.374001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:11:23.859416 0.000000 udp 10.0.2.105 7010 -> 2.231.46.204 2312 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:28.375613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:11:29.176983 0.000000 udp 10.0.2.105 7010 -> 188.84.238.72 1309 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:38.008978 0.000000 udp 10.0.2.105 7010 -> 75.119.44.42 4107 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:42.777018 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:11:44.358300 0.000000 udp 10.0.2.105 7010 -> 92.27.28.156 7524 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:11:44.968485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:11:52.675264 0.000000 udp 10.0.2.105 7010 -> 142.0.151.182 7995 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:01.508614 0.000000 udp 10.0.2.105 7010 -> 88.207.189.89 5091 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:10.275756 0.000000 udp 10.0.2.105 7010 -> 190.38.211.20 4910 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:14.886834 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:12:16.589878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:12:18.756085 0.000000 udp 10.0.2.105 7010 -> 79.158.90.5 6358 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:25.957275 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:31.847000 0.000000 udp 10.0.2.105 7010 -> 109.150.225.10 7463 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:39.728262 0.000000 udp 10.0.2.105 7010 -> 80.180.204.142 5247 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:44.655441 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:12:47.790110 0.098254 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:12:47.898328 0.000000 udp 10.0.2.105 7010 -> 81.111.231.199 2089 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:12:55.403699 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:01.389560 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:09.020444 0.000000 udp 10.0.2.105 7010 -> 69.199.230.26 4689 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:13.657026 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:13:16.421421 0.363158 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:13:16.805753 0.000000 udp 10.0.2.105 7010 -> 69.207.135.48 2970 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:22.600571 1.423650 udp 10.0.2.105 7010 <-> 67.142.81.219 1324 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:13:24.033355 0.000000 udp 10.0.2.105 7010 -> 151.74.63.201 1480 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:30.631643 0.000000 udp 10.0.2.105 7010 -> 70.128.236.65 9001 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:38.432766 0.000000 udp 10.0.2.105 7010 -> 82.104.84.169 4248 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:43.159178 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:13:43.450238 0.052088 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:13:43.520337 0.206530 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:13:43.735765 0.000000 udp 10.0.2.105 7010 -> 86.182.185.124 5001 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:52.102478 0.243935 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:13:52.361824 0.000000 udp 10.0.2.105 7010 -> 76.176.74.230 9038 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:13:57.776976 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:03.809224 0.207049 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:14:04.058366 0.000000 udp 10.0.2.105 7010 -> 86.5.175.14 1691 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:08.656181 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:14:11.440571 0.000000 udp 10.0.2.105 7010 -> 204.14.77.27 1040 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:19.380029 0.000000 udp 10.0.2.105 7010 -> 2.101.23.59 4372 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:26.431731 0.000000 udp 10.0.2.105 7010 -> 181.225.60.111 3344 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:32.901474 1.242077 udp 10.0.2.105 7010 -> 42.77.101.30 6280 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:34.143551 0.000000 icmp 42.77.101.30 0x0303 -> 10.0.2.105 0x8818 URP 192 1 270 flow=Background 1970/01/27 14:14:37.657699 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:14:38.639440 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:44.517634 0.000000 udp 10.0.2.105 7010 -> 68.225.126.199 6027 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:52.709855 0.000000 udp 10.0.2.105 7010 -> 24.130.224.177 1828 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:14:58.237688 0.000000 udp 10.0.2.105 7010 -> 82.21.57.81 2107 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:15:03.164732 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:15:06.498956 0.000000 udp 10.0.2.105 7010 -> 82.13.85.18 7761 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:15:15.181898 0.000000 udp 10.0.2.105 7010 -> 96.241.156.166 7035 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:18:20.390156 3.003679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 14:18:27.398023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:18:35.399283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:18:51.402819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:19:23.408596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:25:27.414787 3.052843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 14:25:34.449959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:25:42.443388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:25:58.447152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:26:30.453156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:31:55.339387 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:31:55.339586 0.939146 tcp 10.0.2.105 57926 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:32:34.458908 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 14:32:41.466386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:32:49.467528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:33:05.470915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:33:37.476596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:39:41.482983 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 14:39:48.491991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:39:56.493738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:40:12.498934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:40:44.500162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:45:35.321205 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 14:45:35.321404 0.046768 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:35.368709 0.057158 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:35.426328 0.278954 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:35.705733 0.175035 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:35.881184 0.058417 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:35.939932 0.091660 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.032003 0.055223 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.087590 0.174702 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.262682 0.180030 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.461898 0.053172 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.529040 0.033412 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.562806 0.219474 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.782664 0.071853 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.854943 0.039009 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.894340 0.074292 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:36.969016 0.143619 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.113067 0.072530 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.185981 0.073509 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.259893 0.144799 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.457117 0.167935 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.625449 0.081348 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.707207 0.179918 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:37.887540 0.325874 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.213784 0.139307 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.353465 0.078079 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.446750 0.163922 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.611056 0.052503 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.663908 0.329195 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:38.993490 0.050652 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.044532 0.073081 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.118031 0.090532 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.208959 0.067102 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.276477 0.040493 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.317350 0.243674 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.561432 0.044019 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.605842 0.210257 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.816510 0.070174 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.887205 0.052413 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:39.940027 0.219901 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:40.160356 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:45:55.438942 0.064163 tcp 10.0.2.105 57927 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:45:55.503381 0.052283 tcp 10.0.2.105 57928 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:45:55.555956 0.147635 tcp 10.0.2.105 57929 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:45:55.704085 0.215966 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:45:55.920485 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:46:11.420910 0.064504 tcp 10.0.2.105 57930 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:11.485667 0.053356 tcp 10.0.2.105 57931 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:11.539324 0.144007 tcp 10.0.2.105 57932 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:11.683794 0.360931 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:46:12.045125 0.000000 udp 10.0.2.105 7010 -> 67.142.81.219 1324 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 14:46:27.384140 0.066328 tcp 10.0.2.105 57933 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:27.450804 0.054092 tcp 10.0.2.105 57934 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:27.505176 0.144833 tcp 10.0.2.105 57935 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/27 14:46:27.650535 0.052183 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:46:27.703117 0.361287 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:46:28.064811 0.223638 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:46:28.288880 0.200987 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/27 14:48:46.516047 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 14:48:53.523563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:49:01.524716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:49:17.528823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:49:49.533970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:56:04.546100 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 14:56:11.553685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:56:19.554892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:56:35.557873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 14:57:07.564088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:01:56.279685 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 15:01:56.279875 0.961679 tcp 10.0.2.105 57936 -> 128.255.183.224 9027 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:03:11.570093 3.002642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:03:18.577556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:03:26.578921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:03:42.581859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:04:14.587719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:10:18.594083 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:10:25.601544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:10:33.603346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:10:49.609579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:11:21.611678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:16:34.292112 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 15:16:34.292339 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:16:53.094473 0.065689 tcp 10.0.2.105 57937 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:16:53.160446 0.051575 tcp 10.0.2.105 57938 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:16:53.212524 0.149024 tcp 10.0.2.105 57939 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:16:53.362106 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:17:09.432401 0.061598 tcp 10.0.2.105 57940 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:09.494243 0.054496 tcp 10.0.2.105 57941 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:09.549134 0.146786 tcp 10.0.2.105 57942 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:09.696982 0.000000 udp 10.0.2.105 7010 -> 67.142.81.219 1324 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:17:25.618347 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 15:17:26.066637 0.063643 tcp 10.0.2.105 57943 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:26.130584 0.053333 tcp 10.0.2.105 57944 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:26.184181 0.148690 tcp 10.0.2.105 57945 -> 195.113.214.236 443 SRPA* 0 0 20 11311 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:26.333399 0.038673 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.372468 0.057061 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.429904 0.073573 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.503880 0.055838 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.560104 0.157538 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.718028 0.058050 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.776678 0.175384 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.952434 0.037044 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:26.989843 0.210957 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.201225 0.075315 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.276923 0.054197 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.331525 0.179761 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.511673 0.179024 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.691081 0.137915 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.829748 0.077676 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.907844 0.038988 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:27.947184 0.071860 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.019441 0.143877 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.163730 0.077350 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.241496 0.328582 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.570440 0.166363 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.737161 0.078318 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.815878 0.181764 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:28.998055 0.138379 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.136874 0.153891 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.291150 0.088880 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.380558 0.073143 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.454046 0.091453 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.545861 0.069006 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:29.615217 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:17:32.625404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:17:40.626828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:17:44.652612 0.064897 tcp 10.0.2.105 57946 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:44.717829 0.052720 tcp 10.0.2.105 57947 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:44.770832 0.145477 tcp 10.0.2.105 57948 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:17:44.916533 0.239691 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.156640 0.326327 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.483392 0.051433 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.535215 0.074944 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.610569 0.219632 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.830645 0.068973 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.899985 0.044104 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:45.944500 0.211614 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:46.156644 0.054266 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:46.211299 0.244823 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:46.456732 0.354358 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:46.811538 0.051908 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:17:46.863845 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:17:56.629900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:18:05.063907 0.063883 tcp 10.0.2.105 57949 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:18:05.128056 0.052907 tcp 10.0.2.105 57950 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:18:05.181238 0.143488 tcp 10.0.2.105 57951 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:18:05.325224 0.230669 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:18:05.556249 0.290993 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:18:28.635785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:24:32.641436 3.004114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:24:39.649245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:24:47.650269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:25:03.653951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:25:35.661033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:31:39.666174 3.001346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:31:46.673560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:31:54.674906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:31:57.249134 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 15:31:57.249230 1.041439 tcp 10.0.2.105 57952 -> 128.255.183.224 9027 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:32:10.677739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:32:42.683932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:38:46.689533 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:38:53.697350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:39:01.699435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:39:17.701566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:39:49.707921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:48:19.723916 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:48:26.731539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:48:30.276962 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 15:48:30.277110 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 15:48:34.732898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:48:45.529737 0.064450 tcp 10.0.2.105 57953 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:48:45.594434 0.053150 tcp 10.0.2.105 57954 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:48:45.647780 0.142473 tcp 10.0.2.105 57955 -> 195.113.214.236 443 SRPA* 0 0 32 17518 flow=From-Botnet-V2-TCP-Established 1970/01/27 15:48:45.790742 0.197188 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:45.988495 0.055130 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.044019 0.158782 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.203198 0.056580 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.260086 0.176579 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.437074 0.034587 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.471992 0.218740 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.691116 0.057569 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.749042 0.066898 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.816493 0.046572 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:46.863444 0.183424 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.047268 0.180873 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.228575 0.056847 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.285846 0.076062 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.362289 0.042101 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.408444 0.217289 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.626139 0.143923 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.770486 0.075195 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.846090 0.073480 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:47.920019 0.145021 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:48.065502 0.182148 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:48.248045 0.143979 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:48.392454 0.399329 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:48.792172 0.083158 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:48.875735 0.165491 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.041639 0.090458 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.132721 0.069855 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.203020 0.053401 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.256784 0.161434 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.418660 0.074407 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.493405 0.244654 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.738430 0.052834 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:49.791596 0.336460 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.128599 0.221952 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.350969 0.067894 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.419258 0.045788 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.465472 0.210909 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.676742 0.052156 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.729271 0.085007 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:50.737409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:48:50.814687 0.515725 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:51.330845 0.361677 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:51.692917 0.052063 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:51.745339 0.241491 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:48:51.987303 0.225829 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 15:49:22.743490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:55:26.749101 2.999820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 15:55:33.755133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:55:41.756829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:55:57.760057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 15:56:29.765749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:01:58.298454 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 16:01:58.298620 0.948109 tcp 10.0.2.105 57956 -> 128.255.183.224 9027 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/01/27 16:02:40.781918 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:02:47.789283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:02:55.790818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:03:11.793382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:03:43.799781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:09:49.808588 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:09:56.815769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:10:04.817496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:10:20.820668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:10:52.827515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:16:56.832380 3.002779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:17:03.840035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:17:11.841575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:17:27.844586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:17:59.852866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:19:05.735601 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 16:19:05.735801 0.350330 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.086520 0.054866 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.141806 0.175741 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.317996 0.035295 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.353699 0.213187 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.567294 0.056861 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:06.624592 0.523072 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.148045 0.056874 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.205366 0.086600 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.292433 0.046236 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.339040 0.178852 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.518225 0.179384 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.698012 0.054953 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.753319 0.076484 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.830194 0.038898 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.869452 0.077980 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:07.947828 0.074752 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.022944 0.144815 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.168119 0.073616 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.242141 0.142986 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.385580 0.177333 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.563258 0.143206 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:08.706964 0.329076 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.036446 0.075635 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.112611 0.166504 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.279578 0.092269 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.372204 0.067408 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.440015 0.052656 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.493029 0.178665 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.672084 0.051257 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.723680 0.077809 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:09.801879 0.250509 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.052795 0.331807 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.384975 0.219717 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.605059 0.068692 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.674150 0.045240 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.719857 0.211420 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.931657 0.054791 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:10.986851 0.092160 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:11.079375 0.213297 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:11.293066 0.232378 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:11.525866 0.368660 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:11.894892 0.052108 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:19:11.947371 0.301937 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:24:03.856164 3.002154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:24:10.863969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:24:18.865282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:24:34.868481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:25:06.874391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:31:10.881400 3.000661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:31:17.887888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:31:25.889359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:31:41.892840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:31:59.248008 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 16:31:59.248370 0.957188 tcp 10.0.2.105 57957 -> 128.255.183.224 9027 FSPA* 0 0 12 1573 flow=From-Botnet-V2-TCP-Established 1970/01/27 16:32:13.898647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:38:17.904960 3.001512 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:38:24.911952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:38:32.913310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:38:48.916691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:39:20.922520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:48:05.929227 3.002233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:48:12.937399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:48:20.939056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:48:36.943374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:49:08.947956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:49:33.643769 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 16:49:33.643920 0.201845 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:33.846152 0.055640 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:33.902148 0.220811 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.123363 0.054963 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.178718 0.256460 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.435598 0.058942 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.494888 0.174612 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.669916 0.031480 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.701786 0.081503 udp 10.0.2.105 7010 <-> 86.128.161.252 2112 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.783693 0.040372 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:34.824442 0.178525 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.003358 0.179912 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.183722 0.057235 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.241323 0.069761 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.311465 0.038472 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.350279 0.073951 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.424595 0.073653 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.498661 0.137864 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.636893 0.071678 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.708949 0.141317 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:35.850599 0.177878 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.028882 0.143654 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.172936 0.325453 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.498810 0.078668 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.577808 0.070303 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.648462 0.056154 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.704984 0.164074 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.869466 0.061633 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:36.931487 0.072875 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:37.004734 0.243613 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:37.248784 0.165416 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:37.414560 0.087348 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:37.502287 0.339591 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:37.842304 0.220439 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.063196 0.074071 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.137679 0.044119 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.182210 0.216133 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.398755 0.053109 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.452466 0.073256 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.526121 0.353675 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.880216 0.051956 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:38.932698 0.214055 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:39.147191 0.802202 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:49:39.949789 0.226407 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/27 16:55:12.953940 3.002232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 16:55:19.961442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:55:27.962885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:55:43.965880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 16:56:15.972431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:02:00.207419 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 17:02:00.207628 0.932438 tcp 10.0.2.105 57958 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:02:23.983243 3.002008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:02:30.991191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:02:38.992860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:02:54.995646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:03:27.001576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:09:31.008281 3.001031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:09:38.015166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:09:46.016770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:10:02.019742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:10:34.025681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:16:38.031373 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:16:45.038915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:16:53.040751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:17:09.045984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:17:41.053320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:19:49.083661 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 17:19:49.083931 0.204456 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.288740 0.054886 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.344021 0.157862 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.502280 0.057731 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.560440 0.232269 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.793082 0.060467 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:49.853933 0.174012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:50.028391 0.048040 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:19:50.076804 0.000000 udp 10.0.2.105 7010 -> 86.128.161.252 2112 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 17:20:06.489645 0.064594 tcp 10.0.2.105 57959 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:20:06.554484 0.052616 tcp 10.0.2.105 57960 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:20:06.607392 0.144492 tcp 10.0.2.105 57961 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:20:06.752424 0.045502 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:06.798316 0.178875 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:06.977598 0.181220 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.159181 0.057742 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.217280 0.074709 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.292398 0.075421 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.368194 0.151710 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.520240 0.069930 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.590520 0.139235 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.730132 0.103460 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.833979 0.038178 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:07.872529 0.178322 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.051281 0.140768 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.192458 0.330602 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.523464 0.080284 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.604224 0.068646 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.673233 0.054182 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.727786 0.161702 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.889915 0.050251 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:08.940595 0.071792 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:09.012820 0.246820 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:09.260083 0.336614 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:09.597085 0.166564 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:09.764124 0.088771 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:09.853277 0.220969 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.074630 0.072515 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.147472 0.047101 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.194953 0.214273 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.409610 0.055228 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.465240 0.095690 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.561307 0.201190 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:10.762882 0.353699 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:11.116995 0.052086 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:11.169425 0.421879 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:20:11.591675 0.220430 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:23:45.059440 2.997544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:23:52.062829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:24:00.064564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:24:16.067533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:24:48.073613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:30:52.080193 3.000903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:30:59.086849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:31:07.088224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:31:23.091260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:31:55.097537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:32:01.146780 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 17:32:01.146958 1.002828 tcp 10.0.2.105 57962 -> 128.255.183.224 9027 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:37:59.102986 3.025058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:38:06.121029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:38:14.124769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:38:30.125533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:39:02.133064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:47:52.146474 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:47:59.153372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:48:07.155263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:48:23.158197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:48:55.168907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:50:26.766118 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 17:50:26.766367 0.000000 udp 10.0.2.105 7010 -> 86.128.161.252 2112 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 17:50:44.014227 0.067448 tcp 10.0.2.105 57963 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:50:44.081952 0.053060 tcp 10.0.2.105 57964 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:50:44.135268 0.144609 tcp 10.0.2.105 57965 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/27 17:50:44.280425 0.054242 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:44.335290 0.159206 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:44.494877 0.059213 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:44.554451 0.219201 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:44.774043 0.063078 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:44.837679 0.175174 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.013272 0.032048 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.045662 0.196380 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.242775 0.042558 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.285692 0.173979 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.460088 0.181322 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.641851 0.070656 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.712870 0.076430 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.789699 0.075288 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:45.865444 0.151769 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.017573 0.068449 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.086382 0.142303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.229075 0.077654 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.307080 0.038332 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.345758 0.171745 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.517896 0.142542 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.660807 0.325055 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:46.986491 0.080216 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.067142 0.067187 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.134740 0.056162 udp 10.0.2.105 7010 <-> 86.136.207.119 8490 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.191437 0.156933 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.348811 0.050884 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.400079 0.075438 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.475925 0.237972 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.714270 0.089570 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:47.804210 0.220479 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.025034 0.068896 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.094299 0.042743 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.137418 0.333792 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.471549 0.165315 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.637288 0.211550 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.849234 0.056192 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.905786 0.074056 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:48.980188 0.227419 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:49.207983 0.360143 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:49.568549 0.051668 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:49.620558 0.390425 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:50:50.011345 0.233443 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/27 17:54:59.170759 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 17:55:06.177758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:55:14.179555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:55:30.182127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 17:56:02.188881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:02:02.155896 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 18:02:02.156086 0.993490 tcp 10.0.2.105 57966 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:02:09.199181 3.000814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:02:16.205612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:02:24.207221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:02:40.210262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:03:12.216225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:09:16.223938 3.005865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:09:23.233322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:09:31.231532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:09:47.234836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:10:19.241828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:16:23.248011 2.999847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:16:30.253439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:16:38.255219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:16:54.260701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:17:26.264237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:20:58.209282 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 18:20:58.209539 0.056108 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.266025 0.243485 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.509855 0.059822 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.570025 0.175014 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.745465 0.035377 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.807155 0.158301 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:58.965900 0.058811 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.025074 0.206326 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.231805 0.039429 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.271654 0.184014 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.456050 0.182186 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.638636 0.057432 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.696507 0.080077 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.776951 0.109175 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:20:59.886539 0.143597 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.030544 0.076790 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.107727 0.038379 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.146444 0.179927 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.326741 0.074560 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.401787 0.145291 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.547503 0.142347 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:00.690208 0.329140 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:01.019749 0.082474 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:01.102683 0.071611 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:01.174662 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8490 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 18:21:19.722340 0.064426 tcp 10.0.2.105 57967 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:21:19.787058 0.031197 tcp 10.0.2.105 57968 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:21:19.818541 0.123854 tcp 10.0.2.105 57969 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:21:19.942911 0.078531 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.021835 0.247315 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.269543 0.092670 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.362601 0.220893 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.583992 0.151007 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.735402 0.052149 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.787948 0.071662 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.859994 0.052969 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:20.913303 0.340497 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:21.254160 0.166266 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:21.420846 0.074131 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:21.495543 0.271690 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:21.767635 0.203255 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:21.971270 0.056944 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:22.028589 0.215061 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:22.244091 0.230470 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:22.474925 0.356043 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:21:22.831348 0.052042 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:23:30.270430 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:23:37.277783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:23:45.279190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:24:01.282110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:24:33.291178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:30:37.296290 2.999454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:30:44.301766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:30:52.303544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:31:08.306363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:31:40.311953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:32:03.155687 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 18:32:03.155843 0.980560 tcp 10.0.2.105 57970 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:37:44.321448 2.998457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:37:51.325431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:37:59.327426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:38:15.329970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:38:47.336008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:47:45.342249 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:47:52.350075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:48:00.351164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:48:16.354216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:48:48.361038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:51:23.764023 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 18:51:23.764247 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8490 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 18:51:40.700109 0.065906 tcp 10.0.2.105 57971 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:51:40.766334 0.063597 tcp 10.0.2.105 57972 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:51:40.830152 0.145211 tcp 10.0.2.105 57973 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/27 18:51:40.975872 0.057496 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:41.033735 0.060250 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:41.094349 0.175449 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:41.270184 0.031609 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:41.302131 0.935233 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.237708 0.059032 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.297074 0.197994 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.495478 0.039666 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.535480 0.214308 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.750177 0.180968 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:42.931601 0.181651 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.113663 0.069810 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.183890 0.143654 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.327970 0.074707 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.403061 0.038521 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.441919 0.073282 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.515555 0.058730 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.574634 0.144891 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.719936 0.144433 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:43.864791 0.329069 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.194240 0.084762 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.279410 0.067722 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.347553 0.078707 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.426616 0.178430 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.605477 0.076805 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.682903 0.244324 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:44.927582 0.092381 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.020327 0.222199 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.242874 0.151755 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.394994 0.052017 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.447402 0.068599 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.516378 0.043992 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.560734 0.331768 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:45.892999 0.168502 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:46.061866 0.073941 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:46.136172 0.294202 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:46.430705 0.875632 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:47.306736 0.055890 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:47.362978 0.215171 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:47.578542 0.051982 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:47.630909 0.252886 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:51:47.884211 0.361055 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/27 18:54:52.367001 3.000644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 18:54:59.375662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:55:07.374805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:55:23.378454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 18:55:55.384481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:02:00.393920 2.999245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:02:04.144637 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 19:02:04.144882 1.014537 tcp 10.0.2.105 57974 -> 128.255.183.224 9027 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/01/27 19:02:07.399016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:02:15.400588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:02:31.403739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:03:03.409191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:09:07.416040 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:09:14.423160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:09:22.424873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:09:38.427486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:10:10.433703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:16:14.441228 3.000158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:16:21.447034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:16:29.448715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:16:45.451928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:17:17.457521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:22:16.574113 0.008879 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 19:22:16.583087 0.174094 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:16.757585 0.034498 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:16.792710 0.058756 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:16.851877 0.071362 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:16.923624 0.769011 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:17.693008 0.058474 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:17.751864 0.200612 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:17.952905 0.045993 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:17.999296 0.262074 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.261815 0.179190 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.441418 0.172813 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.614648 0.073498 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.688685 0.146009 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.835085 0.077227 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 594 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.912699 0.038915 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:18.952048 0.077375 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.029858 0.058556 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.088815 0.145187 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.234432 0.142926 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.377728 0.315593 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.693774 0.082373 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.776563 0.068958 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.845902 0.076612 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:19.922947 0.179230 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.102560 0.071539 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.174481 0.244753 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.419675 0.090982 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.511089 0.220279 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.731738 0.153313 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.885450 0.079476 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:20.965309 0.072947 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.038678 0.045529 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.084594 0.326148 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.411149 0.167635 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.579222 0.073200 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.652846 0.242802 udp 10.0.2.105 7010 <-> 200.84.72.78 3980 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:21.896003 0.209603 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:22.105993 0.052037 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:22.158387 0.242710 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:22.401456 0.209437 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:22.611285 0.054014 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:22:22.665665 0.360040 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:23:21.465278 3.000265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:23:28.470332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:23:36.472943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:23:52.477559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:24:24.481577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:30:28.487293 3.001867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:30:35.495174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:30:43.496827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:30:59.498896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:31:31.504896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:32:05.164495 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 19:32:05.169633 1.019008 tcp 10.0.2.105 57975 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/27 19:37:35.512181 3.001051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:37:42.518439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:37:50.522467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:38:06.523544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:38:38.529352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:47:38.538388 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:47:45.546036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:47:53.547406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:48:09.550191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:48:41.556883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:52:41.021355 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 19:52:41.021465 0.057754 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:41.079632 0.059849 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:41.139865 0.176050 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:41.316287 0.032314 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:41.348969 0.846083 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:42.195456 0.060545 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:42.256497 0.324024 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:42.580948 0.045447 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:42.626730 0.211215 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:42.838348 0.180551 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.019268 0.186541 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.206181 0.173907 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.380502 0.145176 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.526067 0.077801 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.604264 0.038300 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.642864 0.076382 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.719629 0.059296 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.779314 0.137835 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:43.917549 0.142473 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.060499 0.313530 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.374408 0.107055 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.481912 0.071808 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.554100 0.079684 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.634181 0.180065 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.814615 0.075560 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:44.890559 0.222327 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.113336 0.151004 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.264705 0.052359 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.317466 0.070623 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.388608 0.043856 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.432791 0.244807 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.677936 0.089336 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:45.767664 0.330001 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:46.098109 0.167711 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:46.266246 0.073562 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:52:46.340177 0.000000 udp 10.0.2.105 7010 -> 200.84.72.78 3980 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 19:53:01.833410 0.065231 tcp 10.0.2.105 57976 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 19:53:01.898916 0.053523 tcp 10.0.2.105 57977 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 19:53:01.952640 0.143215 tcp 10.0.2.105 57978 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/27 19:53:02.096357 0.306757 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:53:02.403525 0.052138 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:53:02.456016 0.055893 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:53:02.512527 0.361238 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:53:02.874200 0.227384 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:53:03.102185 0.209976 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 19:54:45.562443 3.002110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 19:54:52.570036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:55:00.571933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:55:16.574413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 19:55:48.579954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:01:53.590767 2.998918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:02:00.595144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:02:06.193692 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 20:02:06.193901 0.990302 tcp 10.0.2.105 57979 -> 128.255.183.224 9027 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:02:08.597272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:02:24.599834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:02:56.605961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:09:00.612280 3.001124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:09:07.619319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:09:15.620887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:09:31.623740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:10:03.629900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:16:07.637230 3.001687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:16:14.643173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:16:22.644650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:16:38.648069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:17:10.653895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:23:04.843047 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 20:23:04.843127 0.000000 udp 10.0.2.105 7010 -> 200.84.72.78 3980 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 20:23:14.659690 3.003846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:23:21.667175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:23:21.739365 0.044234 tcp 10.0.2.105 57980 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:23:21.783909 0.054201 tcp 10.0.2.105 57981 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:23:21.838404 0.142393 tcp 10.0.2.105 57982 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:23:21.981354 0.060607 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.042413 0.175295 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.218144 0.035698 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.254215 0.061365 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.315976 0.549077 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.865510 0.046273 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:22.912169 0.578325 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:23.490950 0.060019 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:23.551376 0.216435 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:23.768192 0.073567 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:23.842168 0.146380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:23.988941 0.077871 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.067246 0.173077 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.240699 0.179926 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.421019 0.078176 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.499593 0.055649 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.555658 0.144997 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.701016 0.044565 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:24.745914 0.315793 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.062141 0.086454 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.149019 0.072321 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.221738 0.080471 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.302628 0.186107 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.489175 0.080155 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.569764 0.221376 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.791550 0.150806 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.942812 0.051330 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:25.994539 0.143441 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:26.138372 0.045352 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:26.184623 0.249671 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:26.434655 0.091897 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:26.526929 0.320329 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:26.847700 0.474272 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.322367 0.088397 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.411172 0.069594 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.481220 0.060712 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.542338 0.215814 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.758596 0.052011 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:27.811002 0.214628 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:28.026027 0.358775 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:28.385181 0.245193 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:23:29.668789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:23:45.671737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:24:17.678640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:30:21.683725 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:30:28.691152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:30:36.692899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:30:52.695700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:31:24.701939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:32:07.183499 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 20:32:07.183689 0.957408 tcp 10.0.2.105 57983 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:37:28.708403 3.000976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:37:35.715246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:37:43.717002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:37:59.719400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:38:31.725583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:47:32.736189 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:47:39.743428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:47:47.745085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:48:03.748191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:48:35.756897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:53:39.040777 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 20:53:39.040951 0.031425 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.072741 0.063244 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.136472 0.174437 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.311253 0.039251 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.350841 0.060476 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.411677 0.197838 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.609873 0.159366 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.769602 0.059282 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:39.829254 0.218031 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.047674 0.071978 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.120018 0.145991 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.266377 0.074069 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.340855 0.186536 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.527804 0.182582 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.710763 0.071736 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.782943 0.056345 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.839604 0.145360 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:40.985387 0.038436 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:41.024127 0.328144 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:41.352617 0.085407 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:41.438389 0.072240 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:41.511053 0.076522 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:41.587921 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 20:53:59.211392 0.044082 tcp 10.0.2.105 57984 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:53:59.255766 0.053248 tcp 10.0.2.105 57985 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:53:59.309275 0.121638 tcp 10.0.2.105 57986 -> 195.113.214.236 443 SRPA* 0 0 64 39938 flow=From-Botnet-V2-TCP-Established 1970/01/27 20:53:59.431443 0.148646 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:59.580648 0.052469 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:59.633506 0.143967 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:59.777860 0.062394 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:53:59.840597 0.178469 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.019419 0.073051 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.092841 0.244576 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.337801 0.086057 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.424189 0.332988 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.757610 0.166357 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.924378 0.074645 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:00.999375 0.072576 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.072536 0.053734 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.126664 0.214684 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.341723 0.052106 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.394220 0.203190 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.597828 0.362687 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:01.960915 0.224446 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 20:54:39.762539 2.999454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 20:54:46.767910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:54:54.768941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:55:10.772326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 20:55:42.778063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:01:46.784249 3.001567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:01:53.792746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:02:01.793403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:02:08.142578 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 21:02:08.142789 0.963304 tcp 10.0.2.105 57987 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/27 21:02:17.795979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:02:49.803362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:08:54.809775 3.001371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:09:01.817538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:09:09.818713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:09:25.821443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:09:57.827957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:16:01.836093 3.002883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:16:08.840643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:16:16.843214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:16:32.845342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:17:04.851887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:23:08.856414 3.006378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:23:15.869189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:23:23.867991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:23:39.869541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:24:11.875416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:24:25.266968 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 21:24:25.267060 0.220812 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:25.488346 0.175027 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:25.663813 0.046036 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:25.710232 0.031310 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:25.742011 0.065165 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:25.807583 0.195522 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.003536 0.059691 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.063689 0.211226 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.275350 0.070043 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.345799 0.062316 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.408527 0.268002 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.676926 0.183005 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:26.860496 0.181672 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.042621 0.107618 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.150686 0.058293 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.209412 0.072326 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.282142 0.145437 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.427968 0.473106 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.901523 0.073757 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:27.975639 0.071427 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.047427 0.079879 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.127738 0.038400 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.166529 0.144934 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.311873 0.150518 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.462835 0.053727 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.517009 0.180281 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.697669 0.075518 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:28.773655 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 21:24:44.073262 0.044087 tcp 10.0.2.105 57988 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 21:24:44.117637 0.053397 tcp 10.0.2.105 57989 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 21:24:44.171312 0.152393 tcp 10.0.2.105 57990 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/27 21:24:44.324329 0.086453 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:44.411170 0.143455 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:44.555017 0.047693 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:44.603115 0.324396 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:44.927871 0.167412 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.095716 0.085775 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.181899 0.075551 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.257881 0.051977 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.310211 0.202536 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.513191 0.054713 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.568348 0.210653 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:45.779366 0.359496 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:24:46.139287 0.237087 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:30:15.882148 3.010966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:30:22.899183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:30:30.900514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:30:46.903270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:31:18.909489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:32:09.112167 0.000204 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 21:32:09.112420 1.053805 tcp 10.0.2.105 57991 -> 128.255.183.224 9027 FSPA* 0 0 15 1576 flow=From-Botnet-V2-TCP-Established 1970/01/27 21:37:22.915648 3.001670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:37:29.922962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:37:37.924348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:37:53.927223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:38:25.933598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:47:27.946139 3.000843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:47:34.952567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:47:42.953764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:47:58.963738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:48:30.966568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:54:34.970099 3.001056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 21:54:41.977420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:54:49.978647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:54:58.260654 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 21:54:58.260788 0.238041 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:58.499220 0.175927 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:58.675506 0.046937 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:58.722754 0.035641 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:58.758780 0.061204 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:58.820363 0.258487 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.079250 0.059711 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.139314 0.216408 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.356083 0.220381 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.576856 0.202428 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.779701 0.177909 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:54:59.957948 0.069395 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.027691 0.076535 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.104622 0.059701 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.164705 0.075561 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.240594 0.180712 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.421679 0.060551 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.482595 0.089243 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.572230 0.071681 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.644324 0.080664 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.725394 0.038474 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.764247 0.138224 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:00.902861 0.147729 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.050959 0.331218 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.382570 0.080742 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.463731 0.152111 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.616269 0.052697 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.669353 0.178787 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.848556 0.089678 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:01.938611 0.142798 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.081793 0.047946 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.130129 0.328711 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.459211 0.166579 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.626180 0.072803 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.699360 0.077090 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.776793 0.055243 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:02.832419 0.231686 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:03.064694 0.361141 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:03.426254 0.051883 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:03.478504 0.211526 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:03.690383 0.236648 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/27 21:55:05.981068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 21:55:37.987599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:01:41.993350 3.001820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:01:49.000535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:01:57.002576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:02:10.171328 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 22:02:10.171546 0.955135 tcp 10.0.2.105 57992 -> 128.255.183.224 9027 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/01/27 22:02:13.005646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:02:45.012193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:08:51.020417 3.001139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:08:58.027613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:09:06.029201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:09:22.031828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:09:54.038305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:15:58.044067 3.001709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:16:05.051533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:16:13.052853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:16:29.055942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:17:01.063097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:23:05.073577 2.999031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:23:12.075416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:23:20.076886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:23:36.079828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:24:08.085775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:25:26.348255 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 22:25:26.348370 0.045382 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:26.394242 0.031447 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:26.426086 0.071994 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:26.498459 0.246289 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:26.745219 0.175345 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:26.920982 0.154342 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:27.075755 0.060045 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:27.136170 0.217529 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:27.354110 0.222426 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:27.576943 0.723423 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.300731 0.181633 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.482786 0.070112 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.553316 0.076071 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.629816 0.058172 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.688372 0.076598 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.765320 0.183860 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:28.949584 0.059214 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.009189 0.078548 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.088116 0.076864 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.165345 0.074660 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.240412 0.038490 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.279261 0.152421 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.432070 0.144642 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.577122 0.150529 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.728051 0.051238 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.779659 0.178814 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:29.958898 0.089761 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.049025 0.143096 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.192543 0.050976 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.243926 0.324837 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.577667 0.078718 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.656716 0.333340 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:30.990474 0.166534 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.157356 0.074667 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.232409 0.075145 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.307877 0.058211 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.366457 0.212625 udp 10.0.2.105 7010 <-> 76.218.126.170 6044 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.579460 0.365945 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.945823 0.051755 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:31.997932 0.212068 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:25:32.210437 0.227084 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:30:12.092864 3.000701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:30:19.099400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:30:27.100975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:30:43.104188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:31:15.109905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:32:11.131296 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 22:32:11.131450 0.962945 tcp 10.0.2.105 57993 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/27 22:37:19.115798 3.022891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:37:26.133487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:37:34.134615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:37:50.137667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:38:22.143670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:47:23.154423 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:47:30.162088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:47:38.163925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:47:54.166165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:48:26.172782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:54:30.182570 3.000951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 22:54:37.185867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:54:45.187616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:55:01.190188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:55:33.196673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 22:55:50.662232 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 22:55:50.662385 0.038483 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:50.701219 0.031397 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:50.732935 0.063382 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:50.796745 0.238274 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:51.035450 0.174028 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:51.209891 0.787027 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:51.997307 0.055379 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:52.053033 0.288752 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:52.342190 0.220737 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:52.563321 0.221722 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:52.785443 0.184474 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:52.970287 0.070529 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.041188 0.084417 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.126031 0.055942 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.182331 0.074054 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.256754 0.181511 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.438685 0.062827 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.502124 0.092448 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.594938 0.082496 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.677827 0.074605 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.752840 0.038459 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.791651 0.150301 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.942350 0.053806 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:53.996495 0.170990 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.167885 0.093941 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.262229 0.139941 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.402594 0.057244 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.460383 0.145006 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.605789 0.144913 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:54.751009 0.555655 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:55.307026 0.081670 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:55.389059 0.335976 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:55.725466 0.165349 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:55.891226 0.087527 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:55.979190 0.075741 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:56.055342 0.359967 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:56.415751 0.052046 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:56.468207 0.203583 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:56.672204 0.060883 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/27 22:55:56.733516 0.000000 udp 10.0.2.105 7010 -> 76.218.126.170 6044 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 22:56:12.599693 0.067346 tcp 10.0.2.105 57994 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 22:56:12.667272 0.053309 tcp 10.0.2.105 57995 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 22:56:12.720846 0.150054 tcp 10.0.2.105 57996 -> 195.113.214.236 443 SRPA* 0 0 45 24938 flow=From-Botnet-V2-TCP-Established 1970/01/27 22:56:12.871438 0.237098 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:01:37.203735 3.000184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:01:44.209914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:01:52.211447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:02:08.214498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:02:12.100632 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 23:02:12.100826 0.944065 tcp 10.0.2.105 57997 -> 128.255.183.224 9027 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:02:40.220452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:08:46.230867 3.000352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:08:53.237116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:09:01.239237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:09:17.241137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:09:49.247651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:15:53.253499 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:16:00.260852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:16:08.267831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:16:24.265063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:16:56.271150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:23:00.277301 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:23:07.284331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:23:15.288490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:23:31.289938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:24:03.295132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:26:19.070722 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 23:26:19.071044 0.000000 udp 10.0.2.105 7010 -> 76.218.126.170 6044 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 23:26:34.437269 0.067219 tcp 10.0.2.105 57998 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:26:34.504812 0.053408 tcp 10.0.2.105 57999 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:26:34.558529 0.147745 tcp 10.0.2.105 58000 -> 195.113.214.236 443 SRPA* 0 0 24 13236 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:26:34.706940 0.031833 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:34.739197 0.063310 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:34.802947 0.243783 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:35.047129 0.039520 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:35.087027 0.059346 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:35.146810 0.923259 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.070533 0.174724 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.245634 0.157959 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.404108 0.222211 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.626736 0.072952 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.700130 0.087171 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.826359 0.057743 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.884479 0.076966 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:36.961804 0.185991 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.148188 0.220681 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.369318 0.060676 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.430404 0.082338 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.513180 0.076836 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.590449 0.183048 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.773880 0.039785 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.814008 0.151875 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:37.966318 0.050658 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.017404 0.178305 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.196142 0.091588 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.288156 0.143861 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.432427 0.051849 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.484701 0.152175 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.637309 0.142079 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.779767 0.070855 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:38.851035 0.327606 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.179035 0.168271 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.347716 0.074306 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.422394 0.342945 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.765717 0.084520 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.850622 0.052067 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:39.903036 0.207448 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:40.110887 0.060165 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:40.171425 0.361798 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:40.533600 0.075466 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:26:40.609467 0.241979 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:30:07.301378 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:30:14.308670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:30:22.309794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:30:38.313421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:31:10.319084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:32:13.054539 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 23:32:13.054714 0.966292 tcp 10.0.2.105 58001 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:37:14.324647 3.012274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:37:21.342435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:37:29.343926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:37:45.350103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:38:17.353085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:44:21.359657 3.000989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:44:28.366204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:44:36.367428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:44:52.371162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:45:24.376966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:51:28.382316 3.002640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/27 23:51:35.389715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:51:43.391816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:51:59.395208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:52:31.401269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:57:07.528615 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/27 23:57:07.528803 0.244773 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:07.773937 0.039783 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:07.814118 0.058704 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:07.873230 0.031895 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:07.905462 0.062424 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:07.968287 0.804982 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:08.773710 0.175352 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:08.949468 0.158684 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.108539 0.211810 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.320724 0.072434 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.393523 0.086566 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.480482 0.058307 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.539107 0.075949 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.615411 0.181424 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:09.797266 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 23:57:28.709984 0.066066 tcp 10.0.2.105 58002 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:28.776339 0.053033 tcp 10.0.2.105 58003 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:28.829664 0.153167 tcp 10.0.2.105 58004 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:28.983346 0.061942 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:29.045685 0.080920 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:29.126998 0.075924 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:29.203283 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 23:57:46.905576 0.066456 tcp 10.0.2.105 58005 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:46.972463 0.053688 tcp 10.0.2.105 58006 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:47.026397 0.148040 tcp 10.0.2.105 58007 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:57:47.174938 0.038606 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.213886 0.153412 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.367704 0.052098 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.420139 0.177910 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.598483 0.089735 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.688623 0.145112 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.834136 0.145281 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:47.979839 0.075744 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.055973 0.342951 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.399376 0.141860 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.541676 0.141116 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.683173 0.165639 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.849232 0.086278 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:48.935957 0.599643 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:49.536029 0.082400 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:57:49.618867 0.000000 udp 10.0.2.105 7010 -> 129.242.134.23 1751 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/27 23:58:06.954246 0.067441 tcp 10.0.2.105 58008 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:58:07.021948 0.053794 tcp 10.0.2.105 58009 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:58:07.075988 0.151429 tcp 10.0.2.105 58010 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/27 23:58:07.227907 0.218701 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:58:07.447022 0.061991 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:58:07.509351 0.233840 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:58:07.743603 0.360316 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:58:08.104475 0.078871 udp 10.0.2.105 7010 <-> 109.158.67.160 9935 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/27 23:58:35.406640 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/27 23:58:42.414494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:58:50.415844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:59:06.418968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/27 23:59:38.425107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:02:14.019354 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 00:02:14.019504 0.973084 tcp 10.0.2.105 58011 -> 128.255.183.224 9027 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:05:47.438325 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:05:54.445528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:06:02.447040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:06:18.449698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:06:50.456071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:12:54.462125 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:13:01.468913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:13:09.471048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:13:25.473891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:13:57.480060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:20:01.485840 3.001942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:20:08.493522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:20:16.494963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:20:32.497641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:21:04.503914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:27:08.509309 3.002441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:27:15.517365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:27:23.518588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:27:39.523216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:28:11.527708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:28:16.195354 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 00:28:16.195527 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 00:28:34.823646 0.068298 tcp 10.0.2.105 58012 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:34.892210 0.051893 tcp 10.0.2.105 58013 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:34.944357 0.160301 tcp 10.0.2.105 58014 -> 195.113.214.236 443 SRPA* 0 0 31 15194 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:35.105183 0.220241 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:35.325802 0.052148 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:35.378330 0.036921 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:35.415559 0.062520 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:35.478487 0.047134 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:35.526005 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 00:28:51.415824 0.066297 tcp 10.0.2.105 58015 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:51.482437 0.052795 tcp 10.0.2.105 58016 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:51.535561 0.144436 tcp 10.0.2.105 58017 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:28:51.680486 0.062617 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:51.743559 0.310472 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:52.054406 0.093451 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:52.148262 0.077254 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:52.225897 0.744287 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:52.970601 0.079461 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:53.050458 0.463072 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:53.513871 0.226853 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:53.741069 0.058226 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:53.799689 0.186064 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:53.986195 0.060131 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.046798 0.072691 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.119885 0.076871 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.197164 0.050986 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.248579 0.224076 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.473045 0.038414 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.511934 0.145135 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.657488 0.145095 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.802923 0.075621 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:54.878887 0.332790 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:55.212069 0.139409 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:55.351888 0.179397 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:55.531663 0.087945 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:55.620047 0.074602 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:55.695040 0.332070 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.027550 0.073357 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.101376 0.088902 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.190720 0.167020 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.358141 0.220210 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.578707 0.206430 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.785535 0.062173 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:56.848070 0.358444 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:28:57.206869 0.000000 udp 10.0.2.105 7010 -> 109.158.67.160 9935 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 00:29:15.459814 0.066443 tcp 10.0.2.105 58018 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:29:15.526528 0.053592 tcp 10.0.2.105 58019 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:29:15.580646 0.154402 tcp 10.0.2.105 58020 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:32:14.998630 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 00:32:14.998766 0.993912 tcp 10.0.2.105 58021 -> 128.255.183.224 9027 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:34:15.541176 2.999742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 00:34:22.545908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:34:30.552298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:34:46.545434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:35:18.551881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:41:22.558978 3.000610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:41:29.565395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:41:37.566901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:41:53.580625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:42:25.575807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:49:34.587531 2.999522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:49:41.593140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:49:49.594281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:50:05.597469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:50:37.607682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:56:48.609443 3.001789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 00:56:55.617129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:57:03.643807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:57:19.632780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:57:51.637512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 00:59:19.824588 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 00:59:19.824810 0.242437 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:20.067682 0.000000 udp 10.0.2.105 7010 -> 109.158.67.160 9935 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 00:59:36.099312 0.068516 tcp 10.0.2.105 58022 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:59:36.168107 0.054281 tcp 10.0.2.105 58023 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:59:36.222647 0.160058 tcp 10.0.2.105 58024 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/28 00:59:36.383237 0.059745 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.443364 0.039296 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.483004 0.036164 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.519520 0.052185 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.572070 0.216811 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.789287 0.074580 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.864291 0.079018 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:36.943699 0.063548 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.007683 0.221999 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.230112 0.074937 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.305440 0.156310 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.462150 0.206285 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.668834 0.052570 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.721794 0.176655 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.898879 0.056898 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:37.956139 0.099436 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.055988 0.076781 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.133181 0.166670 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.300264 0.053603 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.354171 0.144848 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.499357 0.153820 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.653582 0.076556 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:38.730746 0.332525 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.063648 0.145124 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.209171 0.038501 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.248240 0.167654 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.416275 0.096353 udp 10.0.2.105 7010 <-> 213.121.6.147 4599 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.513008 0.074369 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.587770 0.143857 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.732058 0.079761 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.812224 0.049003 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:39.861567 0.487872 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:40.349823 0.068777 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:40.418911 0.355618 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:40.774920 0.163797 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:40.939126 0.244687 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/28 00:59:41.184197 0.208256 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:02:16.007792 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 01:02:16.008024 0.931792 tcp 10.0.2.105 58025 -> 128.255.183.224 9027 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:03:55.643832 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 01:04:02.650464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:04:10.652569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:04:26.655418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:04:58.661659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:11:02.667079 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:11:09.675020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:11:17.676347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:11:33.679395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:12:05.685110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:18:09.693411 3.117250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:18:16.785732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:18:24.728374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:18:40.717800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:19:12.719268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:25:16.725404 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:25:23.733032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:25:31.734362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:25:47.737368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:26:19.752650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:29:56.159683 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 01:29:56.159802 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 01:30:12.690095 0.067273 tcp 10.0.2.105 58026 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:12.757643 0.053651 tcp 10.0.2.105 58027 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:12.811589 0.150494 tcp 10.0.2.105 58028 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:12.962641 0.057140 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.020174 0.040192 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.060699 0.032257 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.093305 0.052192 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.145854 0.221885 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.368167 0.139820 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.508467 0.078880 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.587741 0.065271 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.653381 0.157517 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:13.811267 0.682682 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:14.494341 0.054799 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:14.549498 0.180914 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:14.730803 0.060968 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:14.792194 0.069040 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:14.861605 0.292757 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.154727 0.076884 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.232635 0.076649 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.309784 0.171474 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.481642 0.050754 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.532781 0.145031 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.678287 0.154981 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.833695 0.073466 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:15.907538 0.321891 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:16.229863 0.147255 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:16.377522 0.038662 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:16.416576 0.173959 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:16.590947 0.000000 udp 10.0.2.105 7010 -> 213.121.6.147 4599 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 01:30:32.978099 0.065578 tcp 10.0.2.105 58029 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:33.044081 0.053433 tcp 10.0.2.105 58030 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:33.097851 0.143847 tcp 10.0.2.105 58031 -> 195.113.214.236 443 SRPA* 0 0 22 12880 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:30:33.242216 0.073237 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:33.315901 0.143719 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:33.460037 0.083514 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:33.543876 0.051250 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:33.595523 0.355661 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:33.951601 0.170101 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:34.122087 0.333980 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:34.456613 0.059747 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:34.516765 0.237952 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:30:34.755106 0.212217 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/28 01:32:16.947441 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 01:32:16.947561 0.941427 tcp 10.0.2.105 58032 -> 128.255.183.224 9027 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/01/28 01:32:23.749673 3.001218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 01:32:30.756768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:32:38.757983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:32:54.761470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:33:26.771276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:39:30.778349 3.024499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:39:37.791052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:39:45.792285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:40:01.795345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:40:33.801626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:48:39.812085 3.002016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:48:46.820109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:48:54.823021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:49:10.824593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:49:42.831251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:55:49.842836 3.000368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 01:55:56.848969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:56:04.850526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:56:20.853501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 01:56:52.858882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:00:39.996198 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 02:00:39.996350 0.237984 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:40.234769 0.000000 udp 10.0.2.105 7010 -> 213.121.6.147 4599 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 02:00:59.095072 0.069845 tcp 10.0.2.105 58033 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 02:00:59.165202 0.053792 tcp 10.0.2.105 58034 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 02:00:59.219278 0.145228 tcp 10.0.2.105 58035 -> 195.113.214.236 443 SRPA* 0 0 44 37138 flow=From-Botnet-V2-TCP-Established 1970/01/28 02:00:59.365091 0.031885 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.397389 0.060512 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.458250 0.041101 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.499718 0.073072 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.573197 0.051987 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.625550 0.057986 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.683906 0.157745 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.842020 0.074058 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:00:59.916520 0.221069 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.137967 0.199631 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.337957 0.060640 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.398999 0.078690 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.478089 0.181078 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.659518 0.056430 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.716521 0.078372 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.795330 0.071945 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:00.867645 0.171268 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.039240 0.050965 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.090569 0.138536 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.229549 0.152378 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.382280 0.078540 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.461192 0.216115 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.677693 0.169957 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:01.848063 0.326334 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.174813 0.142915 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.318088 0.038355 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.356827 0.073339 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.430561 0.140400 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.571371 0.074266 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.646029 0.049956 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:02.696380 0.361845 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:03.058658 0.167079 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:03.226103 0.229040 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:03.455502 0.204465 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:03.660353 0.321100 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:01:03.981829 0.052840 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:02:17.896679 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 02:02:17.896951 0.934849 tcp 10.0.2.105 58036 -> 128.255.183.224 9027 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/01/28 02:02:56.864688 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 02:03:03.873106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:03:11.873881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:03:27.876584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:03:59.883305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:10:03.888801 3.002216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:10:10.895663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:10:18.897541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:10:34.900986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:11:06.906564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:17:10.913148 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:17:17.920164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:17:25.922750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:17:41.924275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:18:13.935283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:24:17.938252 3.002553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:24:24.944899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:24:32.953899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:24:49.282425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:25:20.964862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:31:07.853784 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 02:31:07.853884 0.246179 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.100441 0.041644 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.142483 0.059433 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.202311 0.038535 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.241208 0.070627 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.312227 0.052039 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.364617 0.062403 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.427435 0.157055 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.584850 0.108229 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.693519 0.216612 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:08.910525 0.361846 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:09.272734 0.154188 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:09.427360 0.293945 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:09.721674 0.231549 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:09.953614 0.060188 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.014232 0.085161 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.099780 0.074394 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.174565 0.171384 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.346351 0.051504 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.398283 0.077606 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.476305 0.222227 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.698968 0.172216 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:10.871605 0.144651 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.016609 0.149464 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.166442 0.324931 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.491806 0.146418 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.638612 0.040473 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.679405 0.076324 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.756101 0.142214 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.898670 0.075041 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:11.974081 0.054487 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:12.028949 0.361298 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:12.390611 0.205316 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:12.596298 0.349965 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:12.946643 0.070303 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:13.017424 0.165747 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:13.183518 0.231475 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 02:31:24.970356 3.002818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:31:31.978025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:31:39.979623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:31:55.982675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:32:18.836700 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 02:32:18.836807 0.953808 tcp 10.0.2.105 58037 -> 128.255.183.224 9027 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/01/28 02:32:27.988618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:38:32.007548 3.061763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:38:39.046503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:38:47.013719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:39:03.021580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:39:35.022694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:48:11.038164 3.000538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:48:18.044538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:48:26.046562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:48:42.051712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:49:14.055244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:55:18.061194 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 02:55:25.069401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:55:33.070061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:55:49.073530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 02:56:21.079316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:01:41.159962 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 03:01:41.160191 0.247944 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.408508 0.033025 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.441913 0.055922 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.498218 0.045451 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.544036 0.144604 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.689055 0.052314 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.741685 0.064693 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:41.806774 0.858620 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:42.665911 0.073717 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:42.740064 0.213598 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:42.954027 0.075432 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.029867 0.172366 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.202693 0.057101 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.260147 0.076264 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.336771 0.463848 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.801052 0.060490 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.861917 0.076377 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:43.938628 0.171244 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.110303 0.052057 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.162760 0.073331 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.236680 0.223338 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.460393 0.204256 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.665049 0.131019 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.796477 0.151892 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:44.948751 0.332334 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.281458 0.145961 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.427882 0.039984 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.468212 0.074813 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.543354 0.145501 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.689260 0.069104 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.758703 0.050448 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:45.809555 0.342894 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:46.152900 0.054044 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:46.207340 0.360402 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:46.568116 0.212901 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:46.781371 0.164876 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:01:46.946672 0.235195 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:02:19.795287 0.909100 tcp 10.0.2.105 58038 -> 128.255.183.224 9027 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/01/28 03:02:25.086505 3.001022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 03:02:32.093423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:02:40.099496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:02:56.097175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:03:28.103351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:09:32.109198 3.001726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:09:39.116780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:09:47.118173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:10:03.121281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:10:35.127423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:16:39.132911 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:16:46.140710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:16:54.141891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:17:10.145725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:17:42.151155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:23:46.157349 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:23:53.164646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:24:01.166080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:24:17.168913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:24:49.176739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:30:53.181345 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:31:00.188426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:31:08.189913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:31:24.193211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:31:53.875831 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 03:31:53.875989 0.061351 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:53.937763 0.055287 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:53.993475 0.235868 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:54.229756 0.052144 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:54.282276 0.065285 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:54.347964 0.258793 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:54.607179 0.047093 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:54.654633 0.517339 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.172344 0.072078 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.244862 0.221375 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.466646 0.074540 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.541562 0.076282 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.618307 0.206458 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.825174 0.062034 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.887618 0.094778 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:55.982834 0.171040 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.154286 0.183467 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.199086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:31:56.338162 0.059590 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.398152 0.053033 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.451566 0.084319 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.536425 0.223933 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.760732 0.174258 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:56.935427 0.138025 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.073903 0.151708 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.225986 0.354406 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.580808 0.144670 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.725883 0.040079 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.766352 0.074850 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.841618 0.139829 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:57.981842 0.079704 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:58.061949 0.054087 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:58.116412 0.360009 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:58.476825 0.211549 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:58.688841 0.165674 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:58.854886 0.731789 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:59.587064 0.059698 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:31:59.647131 0.231306 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/28 03:32:20.704712 1.023618 tcp 10.0.2.105 58039 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/28 03:38:00.204815 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:38:07.212803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:38:15.213786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:38:31.216844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:39:03.223005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:47:56.232313 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:48:03.241850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:48:11.241708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:48:27.243876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:48:59.249952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:55:03.255474 3.002147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 03:55:10.263378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:55:18.264957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:55:34.268846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 03:56:06.273895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:02:10.284517 2.998842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:02:17.287512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:02:21.734286 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 04:02:21.734383 0.922397 tcp 10.0.2.105 58040 -> 128.255.183.224 9027 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:02:23.797283 0.059510 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:23.857215 0.045227 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:23.902844 0.069052 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:23.972329 0.285136 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.257913 0.045648 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.303959 0.213021 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.517381 0.052244 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.570000 0.158941 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.729326 0.072206 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:24.801908 0.220050 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.022319 0.313705 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.289154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:02:25.336596 0.076328 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.413297 0.196340 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.610118 0.060821 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.671293 0.078418 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.750086 0.170859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:25.921338 0.177033 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.098822 0.057411 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.156613 0.053268 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.210246 0.071797 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.282448 0.215445 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.498286 0.173050 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.671739 0.144942 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.817069 0.163703 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:26.981169 0.369520 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.351107 0.145381 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.496877 0.039861 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.537060 0.075586 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.613027 0.142325 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.755703 0.074317 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.830418 0.050135 udp 10.0.2.105 7010 <-> 86.160.254.149 1811 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:27.880898 0.167714 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:28.049049 0.539326 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:28.588711 0.205893 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:28.795050 0.240371 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:29.035865 0.779749 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:29.816035 0.054724 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:02:41.292296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:03:13.298225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:09:17.304635 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:09:24.311374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:09:32.313253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:09:48.315900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:10:20.321774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:16:24.331490 2.997877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:16:31.335487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:16:39.339621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:16:55.339849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:17:27.345920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:23:31.353411 3.003759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:23:42.883535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:23:50.770776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:24:06.550692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:24:38.123125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:30:38.385298 3.002247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:30:45.393177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:30:53.394048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:31:09.397520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:31:41.403590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:32:22.663351 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 04:32:22.663590 0.948584 tcp 10.0.2.105 58041 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:32:30.003861 0.064478 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.068685 0.059590 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.128638 0.046901 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.175919 0.265262 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.441581 0.047896 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.489946 0.086016 udp 10.0.2.105 7010 <-> 86.155.127.11 4918 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.576338 0.052292 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:30.629033 0.929350 udp 10.0.2.105 7010 <-> 98.69.224.36 1591 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:32:31.558770 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 04:32:48.141258 0.066631 tcp 10.0.2.105 58042 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:32:48.208406 0.053375 tcp 10.0.2.105 58043 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:32:48.261971 0.128906 tcp 10.0.2.105 58044 -> 195.113.214.236 443 SRPA* 0 0 56 47613 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:32:48.391475 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 04:33:05.845767 0.091967 tcp 10.0.2.105 58045 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:05.938018 0.055095 tcp 10.0.2.105 58046 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:05.993458 0.178993 tcp 10.0.2.105 58047 -> 195.113.214.236 443 SRPA* 0 0 43 24756 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:06.173465 0.206422 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:06.380313 0.063260 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:06.443994 0.082291 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:06.526698 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 04:33:23.821231 0.066104 tcp 10.0.2.105 58048 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:23.887625 0.053051 tcp 10.0.2.105 58049 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:23.941001 0.211747 tcp 10.0.2.105 58050 -> 195.113.214.236 443 SRPA* 0 0 44 37138 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:24.153308 0.175802 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.329535 0.162016 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.491966 0.076130 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.568606 0.058330 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.627296 0.052825 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.680578 0.076169 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:24.757151 0.422538 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:25.180141 0.179531 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:25.360028 0.137802 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:25.498231 0.148968 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:25.647533 0.349419 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:25.997358 0.147178 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:26.144882 0.039717 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:26.184953 0.084066 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:26.269359 0.143119 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:26.412859 0.079767 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:26.492982 0.000000 udp 10.0.2.105 7010 -> 86.160.254.149 1811 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 04:33:44.801925 0.065821 tcp 10.0.2.105 58051 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:44.868097 0.052888 tcp 10.0.2.105 58052 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:44.921272 0.153079 tcp 10.0.2.105 58053 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/28 04:33:45.074891 0.171315 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:45.246586 0.232281 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:45.479297 0.510179 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:45.989851 0.220093 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:46.210388 0.827715 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:33:47.038504 0.060282 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 04:37:45.409005 3.022624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 04:37:52.437130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:38:00.438814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:38:16.441735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:38:48.450726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:47:47.454932 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:47:54.463099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:48:02.464481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:48:18.466777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:48:50.472619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:54:54.479282 3.001225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 04:55:01.486997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:55:09.492704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:55:25.491864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 04:55:57.497370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:02:01.502357 3.003153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:02:08.510960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:02:16.512758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:02:23.612992 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 05:02:23.613207 0.973145 tcp 10.0.2.105 58054 -> 128.255.183.224 9027 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:02:32.515294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:03:04.521370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:04:12.900067 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 05:04:12.900357 0.221041 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:13.121837 0.074388 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:13.196639 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:04:30.126278 0.068788 tcp 10.0.2.105 58055 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:30.195339 0.057117 tcp 10.0.2.105 58056 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:30.252808 0.151233 tcp 10.0.2.105 58057 -> 195.113.214.236 443 SRPA* 0 0 41 22082 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:30.412941 0.000000 udp 10.0.2.105 7010 -> 86.160.254.149 1811 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:04:48.350921 0.066078 tcp 10.0.2.105 58058 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:48.417217 0.052686 tcp 10.0.2.105 58059 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:48.470085 0.157242 tcp 10.0.2.105 58060 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:04:48.627856 0.060181 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:48.688620 0.063478 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:48.752534 0.052244 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:48.805174 0.045526 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:04:48.851103 0.000000 udp 10.0.2.105 7010 -> 86.155.127.11 4918 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:05:05.075774 0.066556 tcp 10.0.2.105 58061 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:05.142648 0.057960 tcp 10.0.2.105 58062 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:05.201035 0.146144 tcp 10.0.2.105 58063 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:05.347674 0.052977 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:05.401038 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:05:20.547464 0.066855 tcp 10.0.2.105 58064 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:20.614658 0.066813 tcp 10.0.2.105 58065 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:20.682107 0.153606 tcp 10.0.2.105 58066 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:20.836554 0.000000 udp 10.0.2.105 7010 -> 98.69.224.36 1591 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:05:38.473220 0.066290 tcp 10.0.2.105 58067 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:38.539785 0.057244 tcp 10.0.2.105 58068 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:38.597313 0.146429 tcp 10.0.2.105 58069 -> 195.113.214.236 443 SRPA* 0 0 38 21720 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:05:38.744274 0.063010 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:38.807656 0.201436 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.009520 0.074973 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.084948 0.176878 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.262247 0.057718 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.320387 0.051684 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.372489 0.082522 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.455409 0.080101 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.535890 0.076108 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.612410 0.151761 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.764599 0.152384 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:39.917467 0.372639 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.290551 0.231790 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.522704 0.171192 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.694293 0.075326 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.770008 0.142640 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.912980 0.072489 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:40.985865 0.040160 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:41.026425 0.148224 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:41.175050 0.683333 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:41.858787 0.165359 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:42.024606 0.225302 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:42.250279 0.054598 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:42.305268 0.214502 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:05:42.520167 0.319816 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:09:08.528071 3.000877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 05:09:15.534697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:09:23.536189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:09:39.538708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:10:11.545031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:16:15.551152 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:16:22.558324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:16:30.559493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:16:46.572505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:17:18.569148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:23:22.575173 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:23:29.582647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:23:37.583813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:23:53.593783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:24:25.593236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:30:29.599562 3.000562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:30:36.606086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:30:44.608154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:31:00.610960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:31:32.616974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:32:24.592550 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 05:32:24.592713 0.999119 tcp 10.0.2.105 58070 -> 128.255.183.224 9027 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:35:52.741539 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 05:35:52.741646 0.000000 udp 10.0.2.105 7010 -> 86.155.127.11 4918 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:36:09.788603 0.065739 tcp 10.0.2.105 58071 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:09.854631 0.054622 tcp 10.0.2.105 58072 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:09.909609 0.147884 tcp 10.0.2.105 58073 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:10.058195 0.270432 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:10.329099 0.000000 udp 10.0.2.105 7010 -> 98.69.224.36 1591 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:36:28.513438 0.076771 tcp 10.0.2.105 58074 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:28.590535 0.058281 tcp 10.0.2.105 58075 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:28.649195 0.168885 tcp 10.0.2.105 58076 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:28.818628 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 05:36:46.739539 0.066645 tcp 10.0.2.105 58077 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:46.806458 0.051788 tcp 10.0.2.105 58078 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:46.858605 0.170292 tcp 10.0.2.105 58079 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/28 05:36:47.029500 0.074084 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.104008 0.065461 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.169865 0.046347 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.216602 0.052122 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.269075 0.059350 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.328847 0.046298 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.375565 0.078128 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.454056 0.062831 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.517254 0.198063 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:47.715733 0.388896 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.105076 0.058083 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.163552 0.063744 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.227674 0.082971 udp 10.0.2.105 7010 <-> 86.143.119.177 8841 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.311099 0.077609 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.389083 0.089790 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.479233 0.130825 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.610459 0.152226 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.763056 0.173155 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:48.936625 0.074398 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.011405 0.145980 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.157788 0.081527 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.239753 0.040211 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.280369 0.382662 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.663475 0.300764 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:49.964630 0.141769 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:50.106907 0.675881 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:50.783191 0.162676 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:50.946258 0.213848 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:51.160655 0.356267 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:51.517302 0.245235 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:36:51.762903 0.058674 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 05:37:36.623575 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 05:37:43.630266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:37:51.634640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:38:07.638273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:38:39.640623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:47:40.651245 3.002087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:47:47.658924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:47:55.663224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:48:11.663323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:48:43.669828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:54:47.675733 3.001470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 05:54:54.683105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:55:02.684598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:55:18.693260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 05:55:50.693355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:01:54.699759 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:02:01.707118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:02:09.708877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:02:25.592126 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 06:02:25.592232 0.990771 tcp 10.0.2.105 58080 -> 128.255.183.224 9027 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:02:25.712076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:02:57.717352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:07:07.457123 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 06:07:07.457283 0.221505 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:07.679177 0.260361 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:07.939917 0.071873 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.012184 0.063578 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.076180 0.056709 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.133260 0.080243 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.213934 0.058169 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.272635 0.047714 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.320737 0.077339 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.398463 0.057863 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.456778 0.199309 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.656609 0.176484 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.833526 0.051823 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.885772 0.050257 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:08.936454 0.000000 udp 10.0.2.105 7010 -> 86.143.119.177 8841 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:07:24.953907 0.067719 tcp 10.0.2.105 58081 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:25.021891 0.075693 tcp 10.0.2.105 58082 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:25.097863 0.158283 tcp 10.0.2.105 58083 -> 195.113.214.236 443 SRPA* 0 0 41 21206 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:25.256478 0.000000 udp 10.0.2.105 7010 -> 213.123.0.137 1035 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:07:40.504777 0.065684 tcp 10.0.2.105 58084 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:40.570804 0.054582 tcp 10.0.2.105 58085 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:40.625727 0.151353 tcp 10.0.2.105 58086 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:07:40.777516 0.076917 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:40.854871 0.165910 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.021193 0.163116 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.184671 0.170800 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.355816 0.091690 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.447884 0.041091 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.489315 0.380837 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:41.870484 0.222285 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:42.093163 0.157591 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:42.251111 0.161485 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:42.413002 0.079112 udp 10.0.2.105 7010 <-> 109.148.12.241 6503 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:42.492507 0.668458 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:43.161375 0.167020 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:43.328754 0.227449 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:43.556590 0.058313 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:43.615246 0.211083 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:07:43.826741 0.374204 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:09:01.722820 3.002144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 06:09:08.731063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:09:16.732237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:09:32.735247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:10:04.741474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:16:08.747285 3.001791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:16:15.755010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:16:23.756322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:16:39.759490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:17:11.765594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:23:15.772119 3.000678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:23:22.778676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:23:30.780347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:23:46.783582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:24:18.789101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:30:22.795493 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:30:29.802953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:30:37.804473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:30:53.807216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:31:25.813519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:32:26.580622 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 06:32:26.580727 0.965251 tcp 10.0.2.105 58087 -> 128.255.183.224 9027 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:37:29.819498 3.013568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:37:36.837057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:37:44.838083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:37:52.489708 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 06:37:52.489895 0.261248 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:37:52.751532 0.000000 udp 10.0.2.105 7010 -> 86.143.119.177 8841 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:38:00.841255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:38:08.074007 0.067046 tcp 10.0.2.105 58088 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:08.141287 0.056709 tcp 10.0.2.105 58089 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:08.198270 0.150350 tcp 10.0.2.105 58090 -> 195.113.214.236 443 SRPA* 0 0 40 21982 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:08.349152 0.104178 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:38:08.453766 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:38:08.454107 3.002492 tcp 10.0.2.105 58091 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 06:38:17.454849 0.000000 tcp 10.0.2.105 58091 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 06:38:26.869222 0.067386 tcp 10.0.2.105 58092 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:26.936903 0.054464 tcp 10.0.2.105 58093 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:26.991726 0.158210 tcp 10.0.2.105 58094 -> 195.113.214.236 443 SRPA* 0 0 42 23318 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:27.150459 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:38:32.847728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:38:44.884970 0.065549 tcp 10.0.2.105 58095 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:44.950834 0.054686 tcp 10.0.2.105 58096 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:45.005749 0.214216 tcp 10.0.2.105 58097 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:38:45.220703 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:39:02.132314 0.065844 tcp 10.0.2.105 58098 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:02.198461 0.055375 tcp 10.0.2.105 58099 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:02.254100 0.149710 tcp 10.0.2.105 58100 -> 195.113.214.236 443 SRPA* 0 0 44 37138 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:02.404478 0.068224 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:02.473162 0.058270 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:02.531832 0.057819 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:02.590042 0.061334 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:02.651768 0.205331 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:02.857535 0.179053 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.037026 0.060097 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.097674 0.054920 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.153005 0.052054 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.172103 3.003051 tcp 10.0.2.105 58101 -> 81.147.127.73 5826 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 06:39:03.205503 0.079937 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.285914 0.077288 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.363708 0.144771 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.509093 0.085830 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.595310 0.039919 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.635645 0.345401 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:03.981401 0.679513 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:04.661339 0.206046 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:04.867813 0.179092 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:05.047329 0.143779 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:05.191472 0.146113 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:05.337956 0.000000 udp 10.0.2.105 7010 -> 109.148.12.241 6503 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 06:39:12.173580 0.000000 tcp 10.0.2.105 58101 -> 81.147.127.73 5826 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 06:39:21.238143 0.065901 tcp 10.0.2.105 58102 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:21.304476 0.060024 tcp 10.0.2.105 58103 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:21.364764 0.150601 tcp 10.0.2.105 58104 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/28 06:39:21.386143 0.009696 udp 10.0.2.105 53834 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/28 06:39:21.396235 0.009837 udp 10.0.2.105 62870 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/28 06:39:21.515902 0.231888 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:21.748176 0.055957 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:21.804538 0.210319 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:22.015294 0.646732 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:22.662422 0.166712 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:39:22.830070 0.326308 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 06:47:33.857945 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 06:47:40.865167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:47:48.866662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:48:04.869783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:48:36.875629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:54:40.882135 3.001480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 06:54:47.889324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:54:55.890640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:55:11.893589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 06:55:43.899573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:01:47.906098 3.001875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:01:54.913236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:02:02.914445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:02:18.917477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:02:27.557244 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 07:02:27.557583 0.947494 tcp 10.0.2.105 58105 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:02:50.923531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:08:54.929902 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:09:01.937299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:09:09.938717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:09:25.941677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:09:29.987813 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 07:09:29.987928 0.076589 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:30.064943 0.262228 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:30.327632 0.218616 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:30.546600 0.000000 udp 10.0.2.105 7010 -> 109.148.12.241 6503 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 07:09:48.175184 0.067946 tcp 10.0.2.105 58106 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:09:48.243458 0.052843 tcp 10.0.2.105 58107 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:09:48.296556 0.150109 tcp 10.0.2.105 58108 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:09:48.447211 0.078639 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.526222 0.045119 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.571940 0.065956 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.572420 2.996101 tcp 10.0.2.105 58109 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 07:09:48.638356 0.059734 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.698497 0.204222 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.903062 0.049478 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:48.952916 0.081066 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.034431 0.052359 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.087208 0.180062 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.267670 0.082471 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.350484 0.078810 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.429653 0.130880 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.560953 0.074417 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.635750 0.040524 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:49.676630 0.336181 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:50.013256 0.051999 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:50.065617 0.053925 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:50.119919 0.615210 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:50.735517 0.151529 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:50.887477 0.173360 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.061229 0.147206 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.208885 0.144788 udp 10.0.2.105 7010 <-> 69.158.38.35 5207 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.354035 0.241076 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.595562 0.065318 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.661315 0.207336 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:51.869050 0.582899 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:52.452389 0.167233 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:52.620079 0.398373 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:09:57.577178 0.000000 tcp 10.0.2.105 58109 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 07:09:57.947482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:16:01.954222 3.000917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:16:08.962527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:16:16.966694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:16:32.965635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:17:04.971758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:23:08.977359 3.002170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:23:15.993576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:23:23.986851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:23:39.989357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:24:11.995506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:30:16.001795 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:30:23.008994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:30:31.010664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:30:47.013257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:31:19.019694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:32:28.509412 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 07:32:28.509570 0.955359 tcp 10.0.2.105 58110 -> 128.255.183.224 9027 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:37:23.028227 3.064129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:37:30.061181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:37:38.045389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:37:54.047499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:38:26.053381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:40:01.741187 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 07:40:01.741468 0.071592 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:01.813431 0.398735 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.212684 0.221043 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.434105 0.079438 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.513934 0.040199 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.554613 0.063390 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.555042 3.001697 tcp 10.0.2.105 58111 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 07:40:02.618401 0.057378 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.676208 0.204532 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:02.881166 0.126350 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.007913 0.062367 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.070651 0.056277 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.127289 0.175078 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.302752 0.081238 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.384402 0.067136 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.451946 0.124058 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.576446 0.073727 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.650506 0.040114 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:03.690953 0.333104 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:04.024559 0.051944 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:04.076892 0.051406 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:04.128639 0.169737 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:04.298765 0.679999 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:04.979195 0.152382 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:05.131969 0.145639 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:05.277968 0.000000 udp 10.0.2.105 7010 -> 69.158.38.35 5207 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 07:40:11.555052 0.000000 tcp 10.0.2.105 58111 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 07:40:21.380706 0.066916 tcp 10.0.2.105 58112 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:40:21.447863 0.061812 tcp 10.0.2.105 58113 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:40:21.509997 0.151019 tcp 10.0.2.105 58114 -> 195.113.214.236 443 SRPA* 0 0 42 22650 flow=From-Botnet-V2-TCP-Established 1970/01/28 07:40:21.661194 0.229346 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:21.890977 0.058783 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:21.950099 0.214732 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:22.165181 0.360755 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:22.526294 0.663998 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:40:23.190714 0.167767 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 07:47:27.063901 3.002494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:47:34.071740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:47:42.073520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:47:58.078592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:48:30.081840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:54:34.089369 3.000087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 07:54:41.095757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:54:49.099686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:55:05.100029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 07:55:37.106590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:01:41.111664 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:01:48.119359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:01:56.121039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:02:12.123811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:02:29.468706 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 08:02:29.469001 0.901342 tcp 10.0.2.105 58115 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:02:44.131806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:08:48.135904 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:08:55.143352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:09:03.144752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:09:19.148866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:09:51.153797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:10:39.583211 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 08:10:39.583388 0.000000 udp 10.0.2.105 7010 -> 69.158.38.35 5207 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 08:10:56.519453 0.067407 tcp 10.0.2.105 58116 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:10:56.587124 0.053387 tcp 10.0.2.105 58117 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:10:56.640798 0.157432 tcp 10.0.2.105 58118 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:10:56.798836 0.081334 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:10:56.880549 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 08:11:12.580985 0.067382 tcp 10.0.2.105 58119 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:12.648644 0.054672 tcp 10.0.2.105 58120 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:12.703536 0.148288 tcp 10.0.2.105 58121 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:12.852345 0.077393 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:12.930210 0.039845 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:12.930539 2.995588 tcp 10.0.2.105 58122 -> 213.123.0.137 5054 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 08:11:12.970480 0.058866 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:13.029701 0.067036 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:13.097156 0.198743 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:13.296353 0.058661 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:13.355394 0.062126 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:13.417887 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 08:11:21.924465 0.000000 tcp 10.0.2.105 58122 -> 213.123.0.137 5054 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 08:11:28.544563 0.066035 tcp 10.0.2.105 58123 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:28.610942 0.056867 tcp 10.0.2.105 58124 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:28.668053 0.161866 tcp 10.0.2.105 58125 -> 195.113.214.236 443 SRPA* 0 0 21 11368 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:11:28.830508 0.060808 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:28.891670 0.089443 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:28.981550 0.074267 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.056156 0.137892 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.194510 0.073684 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.268609 0.039554 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.308704 0.334777 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.643928 0.052255 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.696579 0.206548 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:29.903572 0.175221 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:30.079200 0.173516 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:30.253141 0.668348 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:30.921921 0.150743 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:31.073063 0.282259 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:31.355761 0.231339 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:31.587498 0.060947 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:31.648965 0.213376 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:31.862746 0.325858 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:32.188997 0.357311 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:11:32.546729 0.166110 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:15:55.159891 3.001658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 08:16:02.167258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:16:10.169486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:16:26.171849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:16:58.177830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:23:02.183642 3.005092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:23:09.191193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:23:17.198682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:23:33.198901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:24:05.203543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:30:09.216136 2.993290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:30:16.215478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:30:24.216794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:30:40.219753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:31:12.225816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:32:30.378537 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 08:32:30.378710 0.976605 tcp 10.0.2.105 58126 -> 128.255.183.224 9027 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/01/28 08:37:16.231943 3.070007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:37:23.277031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:37:31.259831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:37:47.253640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:38:19.260110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:41:41.981432 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 08:41:41.981618 0.246533 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.228586 0.214504 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.443504 0.088622 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.532668 0.060124 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.593280 0.074958 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.593698 3.002487 tcp 10.0.2.105 58127 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 08:41:42.668682 0.060722 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.729853 0.048273 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.778476 0.070220 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:42.849128 0.201644 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.051125 0.070836 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.122377 0.080202 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.202950 0.058962 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.262251 0.098573 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.361233 0.130689 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.492449 0.086511 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.579342 0.040341 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.620097 0.339268 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:43.959783 0.052124 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:44.012284 0.050924 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:44.063598 0.367820 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:44.431822 0.157151 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:44.589353 0.169317 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:44.759121 0.735616 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:45.495131 0.140712 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:45.636206 0.235919 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:45.872554 0.059576 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:45.932490 0.216115 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:46.148999 0.477662 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:46.626994 1.080512 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:47.707841 0.354185 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/28 08:41:51.595146 0.000000 tcp 10.0.2.105 58127 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 08:44:23.265826 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:44:30.273364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:44:38.274744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:44:54.277668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:45:26.283608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:51:30.289989 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:51:37.297468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:51:45.306855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:52:01.302293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:52:33.307622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:58:37.315129 3.000351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 08:58:44.321023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:58:52.323054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:59:08.325470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 08:59:40.331836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:02:31.357739 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 09:02:31.357957 0.918970 tcp 10.0.2.105 58128 -> 128.255.183.224 9027 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:05:44.337117 3.002462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:05:51.345049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:05:59.346692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:06:15.349493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:06:47.355602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:12:01.677417 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 09:12:01.677589 0.266304 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:01.944339 0.222421 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.167141 0.087384 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.254954 0.059750 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.315225 0.076766 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.315813 2.996781 tcp 10.0.2.105 58129 -> 81.156.70.255 6663 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 09:12:02.392588 0.060354 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.453313 0.038830 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.492473 0.046373 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.539227 0.201558 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.741110 0.063601 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.805071 0.075167 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.880591 0.068519 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:02.949479 0.076637 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.026514 0.137740 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.164648 0.074374 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.239435 0.039530 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.279398 0.347648 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.627417 0.051992 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.679771 0.064420 udp 10.0.2.105 7010 <-> 89.147.71.235 4662 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.744585 0.177685 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:03.922666 0.177743 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:04.100769 0.151231 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:04.252589 0.651329 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:04.904274 0.146787 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:05.051421 0.227580 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:05.279404 0.070828 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:05.350692 0.215053 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:05.566161 0.167707 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:05.734194 0.981628 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:06.716177 0.349160 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:12:11.311306 0.000000 tcp 10.0.2.105 58129 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 09:12:51.360911 3.002309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:12:58.368553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:13:06.370210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:13:22.375167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:13:54.379183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:19:58.385476 3.001343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:22:28.984584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:22:36.888427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:22:58.430992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:23:29.991731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:29:29.012155 2.958438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:29:35.934637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:29:43.830569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:29:59.628380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:30:31.225638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:34:54.707726 0.000236 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 09:34:54.708069 0.968783 tcp 10.0.2.105 58130 -> 128.255.183.224 9027 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:36:51.898488 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:36:58.905225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:37:06.907025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:37:22.909983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:37:54.915752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:43:58.922394 3.001054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:44:05.929360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:44:13.930318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:44:29.933786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:44:38.056071 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 09:44:38.056487 0.251883 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.308767 0.217851 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.527046 0.087560 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.615100 0.059749 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.615530 2.995326 tcp 10.0.2.105 58131 -> 81.174.154.246 5785 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 09:44:38.675250 0.076829 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.752647 0.060388 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.813509 0.039217 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.853209 0.109769 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:38.963408 0.200144 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.164043 0.061203 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.225723 0.075302 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.301405 0.057103 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.358936 0.076730 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.436356 0.151671 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.588500 0.074251 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.663119 0.040721 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:39.704317 0.350324 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:40.055026 0.051943 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:40.107387 0.000000 udp 10.0.2.105 7010 -> 89.147.71.235 4662 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 09:44:47.609538 0.000000 tcp 10.0.2.105 58131 -> 81.174.154.246 5785 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 09:44:55.762653 0.069506 tcp 10.0.2.105 58132 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:44:55.832489 0.051397 tcp 10.0.2.105 58133 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:44:55.884145 0.148386 tcp 10.0.2.105 58134 -> 195.113.214.236 443 SRPA* 0 0 39 31256 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:44:56.033333 0.173774 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:56.207567 0.178958 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:56.386998 0.145628 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:56.533040 0.186533 udp 10.0.2.105 7010 <-> 69.159.92.51 5290 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:44:56.720030 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 09:45:01.940064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:45:13.497386 0.066210 tcp 10.0.2.105 58135 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:13.563867 0.050486 tcp 10.0.2.105 58136 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:13.614628 0.150413 tcp 10.0.2.105 58137 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:13.765604 0.237503 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:14.003540 0.061170 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:14.003859 4.965772 tcp 10.0.2.105 58138 -> 172.190.4.74 2008 SPA_* 0 0 188 137317 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:14.065103 0.206385 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:14.271913 0.165981 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:14.438256 0.967652 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:15.406318 0.358952 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/28 09:45:19.031830 4.954831 tcp 10.0.2.105 58138 -> 172.190.4.74 2008 A_PA 0 0 231 170170 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:24.037644 4.908422 tcp 10.0.2.105 58138 -> 172.190.4.74 2008 A_PA 0 0 249 183430 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:45:29.044873 4.539405 tcp 10.0.2.105 58138 -> 172.190.4.74 2008 FPA_* 0 0 179 127726 flow=From-Botnet-V2-TCP-Established 1970/01/28 09:51:05.945263 3.002253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:51:12.953537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:51:20.955031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:51:36.958000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:52:08.966305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:58:12.970744 3.000916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 09:58:19.977445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:58:27.978593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:58:43.981898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 09:59:15.987722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:04:55.676811 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 10:04:55.676964 0.884600 tcp 10.0.2.105 58139 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:05:19.994818 3.000453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 10:05:27.001259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:05:35.002981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:05:51.005855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:06:23.011946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:12:27.018331 3.001207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 10:12:34.025519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:12:42.027113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:12:58.029391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:13:30.035944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:15:34.354827 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 10:15:34.354981 0.000000 udp 10.0.2.105 7010 -> 89.147.71.235 4662 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 10:15:51.731342 0.067476 tcp 10.0.2.105 58140 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:15:51.799121 0.056540 tcp 10.0.2.105 58141 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:15:51.855990 0.149274 tcp 10.0.2.105 58142 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:15:52.005769 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 10:16:09.545806 0.070982 tcp 10.0.2.105 58143 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:09.617144 0.054815 tcp 10.0.2.105 58144 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:09.671780 0.152657 tcp 10.0.2.105 58145 -> 195.113.214.236 443 SRPA* 0 0 40 22372 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:09.824623 0.059517 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:09.884543 0.222213 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.107156 0.061686 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.169426 0.044539 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.214396 0.074394 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.289195 0.088828 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.378434 0.083201 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.462070 0.280145 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.742678 0.058160 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.801258 0.078710 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:10.880427 0.151618 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.032699 0.099303 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.132408 0.040282 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.173067 0.207758 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.381318 0.062336 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.444131 0.082516 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.527039 0.052108 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.579624 0.340279 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:11.920489 0.174272 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:12.095189 0.145452 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:12.241092 0.230121 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:12.471546 0.000000 udp 10.0.2.105 7010 -> 69.159.92.51 5290 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 10:16:30.145439 0.067294 tcp 10.0.2.105 58146 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:30.213121 0.053505 tcp 10.0.2.105 58147 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:30.267021 0.151246 tcp 10.0.2.105 58148 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:16:30.418793 0.248558 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:30.667796 0.059336 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:30.727656 0.207216 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:30.935332 0.168092 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:31.103876 1.178821 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:16:32.283105 0.387268 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:19:34.042496 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 10:19:41.049014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:19:49.050294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:20:05.053818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:20:37.060014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:26:41.068443 2.999087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 10:26:48.073357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:26:56.074929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:27:12.077773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:27:44.083949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:33:48.091254 3.000049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 10:33:55.097342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:34:03.098841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:34:19.101677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:34:51.107990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:34:56.565895 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 10:34:56.566076 0.975079 tcp 10.0.2.105 58149 -> 128.255.183.224 9027 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:40:55.113614 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 10:41:02.121226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:41:10.122811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:41:26.125741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:41:58.132060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:46:41.369426 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 10:46:41.369617 0.000000 udp 10.0.2.105 7010 -> 69.159.92.51 5290 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 10:46:59.657902 0.066928 tcp 10.0.2.105 58150 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:46:59.725132 0.052495 tcp 10.0.2.105 58151 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:46:59.777887 0.156303 tcp 10.0.2.105 58152 -> 195.113.214.236 443 SRPA* 0 0 43 34710 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:46:59.934899 0.064298 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:46:59.999710 0.037878 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.038027 0.068745 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.107238 0.060900 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.168566 0.221447 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.390458 0.094171 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.485120 0.252335 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.737917 0.059863 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.798253 0.076537 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.875233 0.075727 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:00.951491 0.078228 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.030190 0.040346 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.070992 0.138006 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.209437 0.074606 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.284464 0.052310 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.337241 0.353250 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.691083 0.175273 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:01.866761 0.142902 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:02.010039 0.705508 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:02.716021 0.062664 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:02.779170 0.174701 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:02.954332 0.217241 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:03.172059 0.166320 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:03.338870 0.244212 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:03.583623 0.055712 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:47:03.639783 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 10:47:22.047873 0.067962 tcp 10.0.2.105 58153 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:47:22.116269 0.054067 tcp 10.0.2.105 58154 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:47:22.170685 0.147764 tcp 10.0.2.105 58155 -> 195.113.214.236 443 SRPA* 0 0 38 28750 flow=From-Botnet-V2-TCP-Established 1970/01/28 10:47:22.318973 0.348998 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/28 10:52:57.142286 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 10:53:04.149480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:53:12.150433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:53:28.153965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 10:54:00.159733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:00:04.166808 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:00:11.173183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:00:19.174932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:00:35.177717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:01:07.183646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:04:57.545682 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 11:04:57.545898 0.938594 tcp 10.0.2.105 58156 -> 128.255.183.224 9027 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:07:14.194338 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:07:21.201414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:07:29.205327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:07:45.206613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:08:17.211884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:14:21.218997 3.000425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:14:28.225713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:14:36.227086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:14:52.229851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:15:24.235601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:17:32.621391 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 11:17:32.621513 0.916049 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:33.538015 0.059849 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:33.598348 0.045911 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:33.644731 0.062338 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:33.707497 0.224109 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:33.932027 0.084126 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.016589 0.248351 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.265347 0.058052 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.323807 0.073556 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.397823 0.073662 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.471949 0.076227 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.548617 0.144866 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.693931 0.078535 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.772882 0.051945 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:34.825218 0.338773 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.164520 0.173677 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.338654 0.073729 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.412885 0.039938 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.453267 0.150393 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.604124 0.198921 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.803436 0.064343 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:35.868176 0.165850 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:36.034442 0.242204 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:36.276995 0.058510 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:36.336045 0.221497 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:36.557959 0.182826 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:17:36.741182 0.359846 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:21:28.242323 3.001219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:21:35.249473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:21:43.251055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:21:59.253973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:22:31.260387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:28:35.267109 3.000530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:28:42.273118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:28:50.274859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:29:06.278007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:29:38.283676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:34:58.485077 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 11:34:58.485196 0.956216 tcp 10.0.2.105 58157 -> 128.255.183.224 9027 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:35:42.289708 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:35:49.297282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:35:57.299079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:36:13.301828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:36:45.307970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:42:49.314142 3.018452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 11:42:56.331861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:43:04.332812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:43:20.335823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:43:52.341765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:47:47.239867 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 11:47:47.239985 0.046165 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:47:47.286575 0.060644 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:47:47.347650 0.221373 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:47:47.569439 0.088033 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:47:47.657880 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 11:48:05.558370 0.068354 tcp 10.0.2.105 58158 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:05.627014 0.053853 tcp 10.0.2.105 58159 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:05.681232 0.154415 tcp 10.0.2.105 58160 -> 195.113.214.236 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:05.836179 0.057152 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:05.893788 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 11:48:24.393625 0.066869 tcp 10.0.2.105 58161 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:24.460805 0.054415 tcp 10.0.2.105 58162 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:24.515490 0.143606 tcp 10.0.2.105 58163 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/28 11:48:24.659793 0.061307 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:24.721504 0.074279 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:24.796159 0.047418 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:24.844019 0.075959 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:24.920364 0.144859 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.065623 0.075062 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.141069 0.052331 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.193811 0.345342 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.562739 0.170856 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.734012 0.075583 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.810000 0.064242 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:25.874664 0.144752 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:26.019848 0.649107 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:26.669325 0.058397 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:26.728078 0.165698 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:26.894214 0.239159 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:27.133810 0.055712 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:27.189923 0.360723 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:27.550996 0.205376 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:48:27.756857 0.182661 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/28 11:53:55.352476 3.000850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 11:54:02.359024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:54:10.360790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:54:26.363445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 11:54:58.369570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:01:02.375636 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:01:09.383390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:01:17.384473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:01:33.387380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:02:05.393670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:04:59.444160 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 12:04:59.444267 0.992423 tcp 10.0.2.105 58164 -> 128.255.183.224 9027 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/01/28 12:08:09.399917 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:08:16.406884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:08:24.408483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:08:40.411465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:09:12.417420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:15:19.427641 3.001650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:15:26.435163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:15:34.437185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:15:50.439892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:16:22.455923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:18:31.501612 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 12:18:31.501793 1.003691 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:32.505901 0.275610 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:32.781977 0.219832 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.002222 0.061223 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.063931 0.040291 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.104602 0.079776 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.184781 0.056246 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.241421 0.058636 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.300496 0.076437 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.377384 0.131051 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.508893 0.059630 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.568966 0.076175 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.645547 0.076087 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.722053 0.052179 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:33.774675 0.350406 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:34.125532 0.174581 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:34.300662 0.142154 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:34.443230 0.075161 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:34.518772 0.039555 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:34.558777 0.682616 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:35.241845 0.065318 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:35.307631 0.165611 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:35.473627 0.361002 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:35.835062 0.206297 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:36.041834 0.216731 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:36.259227 0.059808 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:18:36.319511 0.399105 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:22:26.462119 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:22:33.469032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:22:41.470583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:22:57.473669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:23:29.479787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:29:33.485400 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:29:40.493221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:29:48.494722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:30:04.497699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:30:36.503518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:35:00.443992 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 12:35:00.444111 0.983759 tcp 10.0.2.105 58165 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/28 12:36:40.509720 3.001804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:36:47.516892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:36:55.518935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:37:11.521635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:37:43.527840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:43:47.534319 3.001042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:43:54.541164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:44:02.542757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:44:18.545891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:44:50.554840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:48:45.730216 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 12:48:45.730324 0.221668 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:45.952587 0.059489 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:46.012654 0.040484 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:46.053556 0.082869 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:46.136818 0.057449 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:46.194709 0.049202 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:46.244318 1.039620 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:48:47.284570 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 12:49:04.208049 0.067403 tcp 10.0.2.105 58166 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 12:49:04.275258 0.053396 tcp 10.0.2.105 58167 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 12:49:04.329004 0.145973 tcp 10.0.2.105 58168 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/28 12:49:04.475572 0.075511 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.551794 0.145059 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.697482 0.059359 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.758230 0.072971 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.831628 0.078582 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.910583 0.052325 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:04.963319 0.337205 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:05.300933 0.228708 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:05.530072 0.039559 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:05.570112 0.951430 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:06.521940 0.065095 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:06.587497 0.147243 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:06.735277 0.074492 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:06.810176 0.166884 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:06.977465 0.356608 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:07.334517 0.217295 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:07.552403 0.243014 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:07.795831 0.058458 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:49:07.854713 0.175196 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 12:54:20.563826 3.001693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 12:54:27.571117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:54:35.572851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:54:51.575760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 12:55:23.581947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:01:27.588742 3.000913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:01:34.595393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:01:42.596522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:01:58.599751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:02:30.605580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:05:01.433325 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 13:05:01.433444 0.972061 tcp 10.0.2.105 58169 -> 128.255.183.224 9027 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/01/28 13:08:34.611860 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:08:41.619086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:08:49.620732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:09:05.623515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:09:37.630069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:15:44.639968 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:15:51.647460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:15:59.648862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:16:15.652118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:16:47.658589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:19:25.519955 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 13:19:25.520077 0.251579 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:25.772053 0.077373 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:25.849864 0.059492 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:25.909811 0.045900 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:25.956141 0.059905 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:26.016462 0.220413 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:26.237321 0.039181 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:26.276969 1.044172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.321554 0.074540 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.396494 0.144666 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.541561 0.059141 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.601237 0.071288 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.673000 0.077047 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.750488 0.051975 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.802933 0.039329 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:27.842711 0.340331 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.183502 0.170276 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.354279 0.238880 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.593632 0.059720 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.653842 0.145179 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.799446 0.075195 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:28.875052 0.164519 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:29.040096 0.355872 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:29.396358 0.208383 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:29.605187 0.177074 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:29.782663 0.224212 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:19:30.007387 0.055344 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:22:51.665009 3.000776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:22:58.671557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:23:06.672760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:23:22.675815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:23:54.682267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:29:58.688594 3.023016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:30:05.706037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:30:13.707108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:30:29.710056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:31:01.715895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:35:02.412500 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 13:35:02.412626 1.012384 tcp 10.0.2.105 58170 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/01/28 13:37:05.722655 3.000849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:37:12.729344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:37:20.730752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:37:36.733856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:38:08.739986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:44:12.745799 3.086071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:44:19.800591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:44:27.765068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:44:43.767903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:45:15.773428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:49:55.196253 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 13:49:55.196381 0.057920 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:49:55.254764 0.048733 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:49:55.303926 0.059414 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:49:55.363737 0.220406 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:49:55.584598 0.045800 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:49:55.630839 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 13:50:13.954599 0.066776 tcp 10.0.2.105 58171 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 13:50:14.021648 0.052570 tcp 10.0.2.105 58172 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 13:50:14.074511 0.140001 tcp 10.0.2.105 58173 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/28 13:50:14.215093 0.079359 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:14.294886 1.013383 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.308675 0.074439 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.383509 0.130974 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.514906 0.059799 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.575129 0.072770 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.648322 0.078081 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.726875 0.051929 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.779208 0.039818 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:15.819421 0.352727 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:16.172597 0.178812 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:16.351862 0.143082 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:16.495339 0.170602 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:16.666338 0.166001 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:16.832841 0.202313 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:17.035518 0.060325 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:17.096216 0.356765 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:17.453397 0.209402 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:17.663226 0.177999 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:17.841681 0.207490 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:50:18.049558 0.056561 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/28 13:54:33.789088 3.001102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 13:54:40.796176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:54:48.797718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:55:04.800652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 13:55:36.806971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:01:40.812836 3.001470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:01:47.819998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:01:55.821723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:02:11.824711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:02:43.830385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:05:03.431979 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 14:05:03.432137 0.903198 tcp 10.0.2.105 58174 -> 128.255.183.224 9027 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/01/28 14:08:47.839083 2.999215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:08:54.844173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:09:02.846138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:09:18.848548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:09:50.855464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:15:55.862147 3.001757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:16:02.870240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:16:10.870909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:16:26.874128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:16:58.880178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:20:29.093057 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 14:20:29.093245 0.245245 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.338978 0.060297 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.399715 0.058609 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.458811 0.049711 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.509024 0.218104 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.727542 0.045201 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.773296 0.079771 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.773817 2.993916 tcp 10.0.2.105 58175 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:20:29.853515 0.130887 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:29.984826 0.992028 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:30.977351 0.078124 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.055921 0.058370 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.114728 0.071705 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.186861 0.075929 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.263174 0.052033 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.315692 0.040471 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.356629 0.353895 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.710917 0.089949 udp 10.0.2.105 7010 <-> 82.61.66.27 7032 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.801284 0.166110 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:31.967771 0.175227 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:32.143364 0.144010 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:32.287766 0.613632 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:32.901901 0.064752 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:32.967101 0.357088 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:33.324564 0.209930 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:33.534955 0.056425 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:33.591800 0.210767 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:33.802958 0.181539 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:20:38.776783 0.000000 tcp 10.0.2.105 58175 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:23:02.886295 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:23:09.893518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:23:17.895011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:23:33.898005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:24:05.904121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:30:09.910456 3.001239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:30:16.917517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:30:24.919111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:30:40.922110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:31:12.928379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:35:04.341692 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 14:35:04.341851 0.946793 tcp 10.0.2.105 58176 -> 128.255.183.224 9027 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/28 14:37:16.934409 3.000790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:37:23.941453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:37:31.942980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:37:47.946147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:38:19.951788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:44:23.958381 3.001319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 14:44:30.965058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:44:38.967041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:44:54.969708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:45:26.976079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:50:46.205445 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 14:50:46.205646 0.249800 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.455848 0.045281 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.501528 0.220864 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.722797 0.039036 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.762417 0.081040 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.762933 2.997041 tcp 10.0.2.105 58177 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:50:46.843874 0.151768 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:46.996088 0.059115 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:47.055614 0.056204 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:47.112259 0.923624 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.036286 0.076641 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.113312 0.062175 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.175880 0.073766 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.250037 0.085923 udp 10.0.2.105 7010 <-> 213.123.183.25 6469 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.336366 0.052134 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.389064 0.039638 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.429151 0.166045 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.595612 0.174309 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.770319 0.146222 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:48.916960 0.339823 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:50:49.257183 0.000000 udp 10.0.2.105 7010 -> 82.61.66.27 7032 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 14:50:55.758862 0.000000 tcp 10.0.2.105 58177 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:51:07.547662 0.064106 tcp 10.0.2.105 58178 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 14:51:07.612037 0.054307 tcp 10.0.2.105 58179 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 14:51:07.666689 0.145200 tcp 10.0.2.105 58180 -> 195.113.214.236 443 SRPA* 0 0 32 24666 flow=From-Botnet-V2-TCP-Established 1970/01/28 14:51:07.812476 0.194436 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:08.007398 0.065017 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:08.007751 3.002930 tcp 10.0.2.105 58181 -> 65.8.202.66 1723 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:51:08.072906 0.357097 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:08.430436 0.207361 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:08.638274 0.177251 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:08.815999 0.243980 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:09.060461 0.059415 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 14:51:17.009230 0.000000 tcp 10.0.2.105 58181 -> 65.8.202.66 1723 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 14:54:39.982976 3.002614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 14:54:46.990506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:54:54.992643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:55:10.995470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 14:55:43.001610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:01:47.008612 3.000756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:01:54.015141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:02:02.017015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:02:18.019862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:02:50.025574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:05:05.290488 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 15:05:05.290673 0.950098 tcp 10.0.2.105 58182 -> 128.255.183.224 9027 FSPA* 0 0 14 1579 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:08:58.037686 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:09:05.044858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:09:13.046515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:09:29.049390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:10:01.055633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:16:05.060791 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:16:12.068730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:16:20.070339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:16:36.073384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:17:08.079209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:21:39.189695 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 15:21:39.189848 0.072469 udp 10.0.2.105 7010 -> 82.61.66.27 7032 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 15:21:39.262317 0.000000 icmp 82.61.66.27 0x0303 -> 10.0.2.105 0x781b URP 192 1 145 flow=Background 1970/01/28 15:21:54.903440 0.078449 tcp 10.0.2.105 58183 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:21:54.982240 0.052408 tcp 10.0.2.105 58184 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:21:55.034947 0.146405 tcp 10.0.2.105 58185 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:21:55.182002 0.250629 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.433131 0.046968 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.433482 3.003222 tcp 10.0.2.105 58186 -> 200.55.153.18 7297 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:21:55.480690 0.083869 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.565018 0.144944 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.710431 0.059974 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.770818 0.056867 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:55.828115 0.222193 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:56.050758 0.044172 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:56.095330 0.585264 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:56.681033 0.077266 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:21:56.758728 0.000000 udp 10.0.2.105 7010 -> 213.123.183.25 6469 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 15:22:04.435306 0.000000 tcp 10.0.2.105 58186 -> 200.55.153.18 7297 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:22:15.662395 0.066034 tcp 10.0.2.105 58187 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:22:15.728698 0.053449 tcp 10.0.2.105 58188 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:22:15.782457 0.140929 tcp 10.0.2.105 58189 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:22:15.924087 0.051880 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:15.976614 0.040545 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.017619 0.166572 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.184680 0.062188 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.247249 0.075403 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.323142 0.172088 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.495822 0.145784 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.496262 3.000731 tcp 10.0.2.105 58190 -> 76.216.212.201 8810 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:22:16.641998 0.352494 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:16.994903 0.200875 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:17.196140 0.063936 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:17.260689 0.360770 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:17.621903 0.217129 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:17.839443 0.057866 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:17.897775 0.173473 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:18.071686 0.230982 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:22:25.495680 0.000000 tcp 10.0.2.105 58190 -> 76.216.212.201 8810 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:22:38.577610 0.009585 udp 10.0.2.105 50313 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/01/28 15:22:38.587733 0.009738 udp 10.0.2.105 59444 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/01/28 15:22:43.090826 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 15:23:12.085223 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 15:23:19.092587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:23:27.094312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:23:43.097385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:24:15.103339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:30:19.108607 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:30:26.116820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:30:34.118615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:30:50.121440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:31:22.127412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:35:06.240187 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 15:35:06.240345 0.979908 tcp 10.0.2.105 58191 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:37:26.133140 3.001709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:37:33.140939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:37:41.142164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:37:57.145069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:38:29.151327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:44:33.156641 3.002317 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:44:40.164690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:44:48.166037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:45:04.169140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:45:36.175111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:52:19.225314 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 15:52:19.225435 0.000000 udp 10.0.2.105 7010 -> 213.123.183.25 6469 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 15:52:35.900477 0.064147 tcp 10.0.2.105 58192 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:52:35.964910 0.053318 tcp 10.0.2.105 58193 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:52:36.018484 0.145262 tcp 10.0.2.105 58194 -> 195.113.214.236 443 SRPA* 0 0 35 19202 flow=From-Botnet-V2-TCP-Established 1970/01/28 15:52:36.164503 0.046577 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.211573 0.080999 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.211917 3.001291 tcp 10.0.2.105 58195 -> 78.134.67.242 7392 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:52:36.293064 0.138122 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.431673 0.057018 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.489107 0.059637 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.549176 0.217927 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.767536 0.045800 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:36.813712 0.242809 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.056881 0.342853 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.400116 0.084752 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.485270 0.052020 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.537732 0.040417 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.578587 0.166390 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.745406 0.062468 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.808391 0.076513 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:37.885360 0.350250 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:38.235960 0.219593 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:38.455953 0.062985 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:38.519375 0.171105 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:38.690870 0.144091 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:38.835343 0.353299 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:39.189052 0.221520 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:39.411081 0.056629 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:39.468213 0.174365 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:39.642930 0.223315 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/28 15:52:45.211915 0.000000 tcp 10.0.2.105 58195 -> 78.134.67.242 7392 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/28 15:54:45.187886 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 15:54:52.194613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:55:00.196493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:55:16.199209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 15:55:48.205420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:01:52.211465 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:01:59.218780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:02:07.220253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:02:23.223076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:02:55.229462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:05:07.219671 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 16:05:07.219841 0.930869 tcp 10.0.2.105 58196 -> 128.255.183.224 9027 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:09:06.245532 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:09:13.252932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:09:21.254621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:09:37.257584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:10:09.263131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:16:13.269366 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:16:20.276176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:16:28.278096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:16:44.281195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:17:16.287344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:23:00.462129 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 16:23:00.462287 0.137897 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:00.600665 0.058712 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:00.601038 2.006002 tcp 10.0.2.105 58197 -> 128.255.183.224 9027 FSPA* 0 0 312 342633 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:23:00.659830 0.057941 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:00.718209 0.046843 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:00.765453 0.079090 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:00.844932 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 16:23:03.222480 0.065154 tcp 10.0.2.105 58198 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:23:03.287839 0.053812 tcp 10.0.2.105 58199 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:23:03.341938 0.146966 tcp 10.0.2.105 58200 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:23:19.482076 0.242345 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:19.724818 0.045715 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:19.770940 0.222646 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:19.994017 0.052114 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.046544 0.039527 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.086471 0.063055 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.150002 0.077158 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.227577 0.166967 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.313053 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:23:20.395031 0.388654 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.784093 0.075203 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:20.859764 0.335860 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:21.196042 0.216780 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:21.413257 0.070166 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:21.483820 0.359960 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:21.844116 0.143590 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:21.988090 0.175335 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.163793 0.060975 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.225184 0.177708 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.403382 0.221578 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.625341 0.211996 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.837821 0.044044 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.882317 0.050692 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:22.933457 0.137980 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:23.071821 0.067567 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:23.139785 0.050294 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:23:27.110527 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 16:23:27.320528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:23:35.321861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:23:51.325080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:24:04.444386 0.990238 tcp 10.0.2.105 58201 -> 128.255.183.224 9027 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:24:23.331264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:30:27.336823 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:30:34.344354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:30:42.346216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:30:58.349021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:31:30.355167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:37:34.362780 2.999791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:37:41.368917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:37:49.370162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:38:05.372821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:38:37.378937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:44:41.386278 3.000615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:44:48.392842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:44:56.394083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:45:12.397018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:45:44.403262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:51:48.408437 3.002754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:51:55.416450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:52:03.418159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:52:19.420946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:52:51.427171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:53:47.548030 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 16:53:47.548367 0.242872 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:47.791685 0.039111 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:47.831246 0.218364 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.050036 0.052294 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.102788 0.041032 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.144316 0.060704 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.205508 0.076485 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.282383 0.168052 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.450909 0.343086 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:48.794403 0.418748 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:49.213588 0.075081 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:49.289062 0.203779 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:49.493294 0.064471 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:49.558202 0.357151 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:49.915784 0.142937 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.059195 0.168464 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.228091 0.059750 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.288302 0.191620 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.480301 0.057828 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.538555 0.062499 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.601436 0.137822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.739631 0.101779 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.841907 0.046634 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:50.889015 0.221338 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:53:51.110841 0.205578 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/28 16:54:05.433974 0.909308 tcp 10.0.2.105 58202 -> 128.255.183.224 9027 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/01/28 16:58:55.433159 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 16:59:02.440735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:59:10.442073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:59:26.445095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 16:59:58.451233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:06:26.461657 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:06:33.469221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:06:41.470600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:06:57.473407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:07:29.479353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:13:37.491126 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:13:44.498540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:13:52.500037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:14:08.503111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:14:40.509334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:20:44.516099 3.000409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:20:51.522671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:20:59.523876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:21:15.527106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:21:47.533224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:23:54.576137 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 17:23:54.576274 0.254419 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:54.831106 0.039925 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:54.871551 0.221614 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.093557 0.051859 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.145796 0.040014 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.186273 0.060339 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.247113 0.076709 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.324443 0.167704 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.492782 0.347294 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:55.840615 0.322203 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.163195 0.074217 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.237780 0.216764 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.454924 0.061949 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.517298 0.178022 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.695725 0.061675 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:56.757789 0.359325 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.117528 0.145706 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.337433 0.177158 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.515016 0.059262 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.574661 0.059608 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.634693 0.138071 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.773173 0.081392 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.854907 0.045254 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:57.900571 0.232838 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:23:58.133807 0.229171 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:24:06.343043 0.997513 tcp 10.0.2.105 58203 -> 128.255.183.224 9027 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:27:51.539708 3.002804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:27:58.546732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:28:06.548153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:28:22.550960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:28:54.557271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:34:58.562724 3.002461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:35:05.570771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:35:13.572030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:35:29.575131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:36:01.581220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:42:05.588035 3.000702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:42:12.594297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:42:20.596082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:42:36.598973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:43:08.605063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:53:33.615783 3.002587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 17:53:40.623854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:53:48.625317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:54:01.433924 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 17:54:01.434090 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 17:54:04.628208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:54:07.342737 0.964674 tcp 10.0.2.105 58204 -> 128.255.183.224 9027 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:20.304400 0.064559 tcp 10.0.2.105 58205 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:20.369261 0.053159 tcp 10.0.2.105 58206 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:20.422692 0.140475 tcp 10.0.2.105 58207 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:20.563723 0.040317 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:20.604613 0.217566 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:20.822599 0.051988 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:20.875057 0.039159 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:20.914673 0.060672 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:20.975788 0.078078 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:21.054313 0.335300 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:21.390081 0.078659 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:21.469168 0.165488 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:21.635099 0.327065 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:21.962582 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 17:54:36.634392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 17:54:40.580910 0.067604 tcp 10.0.2.105 58208 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:40.648788 0.052767 tcp 10.0.2.105 58209 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:40.701875 0.123538 tcp 10.0.2.105 58210 -> 195.113.214.236 443 SRPA* 0 0 20 10884 flow=From-Botnet-V2-TCP-Established 1970/01/28 17:54:40.825920 0.127133 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:40.953476 0.174880 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.128762 0.058013 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.187340 0.357786 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.545589 0.144576 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.690621 0.062070 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.753060 0.131133 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.884761 0.074971 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.960186 0.037474 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:41.998075 0.281057 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:42.279545 0.219090 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:42.499087 0.175618 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 17:54:42.675129 0.060158 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:00:40.641257 3.000446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:00:47.647698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:00:55.649230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:01:11.652202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:01:43.658674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:07:47.664289 3.002356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:07:54.671878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:08:02.673497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:08:18.676483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:08:50.682107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:14:54.689107 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:15:01.696797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:15:09.697152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:15:25.699873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:15:57.706631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:22:01.712816 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:22:08.719629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:22:16.721259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:22:32.724031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:23:04.729935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:24:08.312011 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 18:24:08.312183 1.116135 tcp 10.0.2.105 58211 -> 128.255.183.224 9027 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:25:12.313889 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 18:25:12.314039 0.238298 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.552723 0.199324 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.752446 0.051887 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.804684 0.039974 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.845074 0.060613 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.906166 0.040822 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:12.947415 0.222350 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:13.170252 0.072720 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:13.243391 0.166487 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:13.410395 0.075649 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:13.486425 0.323775 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:13.810558 0.336789 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.147746 0.060690 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.208914 0.353737 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.563146 0.182139 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.745726 0.061567 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.807767 0.146972 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:14.955104 0.060160 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.015708 0.124092 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.140198 0.080737 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.221314 0.033506 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.255261 0.231842 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.487553 0.057665 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.545651 0.215551 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:25:15.761717 0.175827 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:29:08.737510 3.000307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 18:29:15.743195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:29:23.745220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:29:39.747895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:30:11.754053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:36:15.762659 2.999105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:36:22.767485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:36:30.769073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:36:46.772184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:37:18.777847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:43:22.785089 3.000327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:43:29.791280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:43:37.793015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:43:53.795812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:44:25.801958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:54:07.810841 3.002269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 18:54:09.431974 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 18:54:09.432165 1.002323 tcp 10.0.2.105 58212 -> 128.255.183.224 9027 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:54:14.818998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:54:22.820441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:54:38.823180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:55:10.829440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 18:55:27.053128 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 18:55:27.053288 0.051854 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:55:27.105582 0.039676 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:55:27.145746 0.060771 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:55:27.206940 0.046985 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:55:27.254357 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 18:55:43.508229 0.065376 tcp 10.0.2.105 58213 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:55:43.573889 0.031494 tcp 10.0.2.105 58214 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:55:43.605671 0.121682 tcp 10.0.2.105 58215 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:55:43.727909 0.076927 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:55:43.805243 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 18:56:00.231270 0.060847 tcp 10.0.2.105 58216 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:56:00.292550 0.031480 tcp 10.0.2.105 58217 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:56:00.324330 0.124433 tcp 10.0.2.105 58218 -> 195.113.214.236 443 SRPA* 0 0 32 16856 flow=From-Botnet-V2-TCP-Established 1970/01/28 18:56:00.449422 0.355462 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:00.805321 0.166688 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:00.972406 0.074809 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:01.047661 0.326483 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:01.374640 0.323359 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:01.698455 0.061154 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:01.760046 0.354520 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.115043 0.171484 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.286932 0.056619 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.343949 0.142136 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.486520 0.059185 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.546130 0.144787 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.691340 0.079203 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.771007 0.031809 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:02.803313 0.215241 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:03.019021 0.179454 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:03.198921 0.226544 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/28 18:56:03.425943 0.058113 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:01:14.835938 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 19:01:21.842946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:01:29.844552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:01:45.847375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:02:17.853467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:08:21.859269 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:08:28.866828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:08:36.868141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:08:52.871282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:09:24.877307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:15:33.890822 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:15:40.897793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:15:48.899412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:16:04.902112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:16:36.908684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:22:40.914245 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:22:47.921844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:22:55.923501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:23:11.926295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:23:43.932573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:24:10.441083 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 19:24:10.441276 0.940853 tcp 10.0.2.105 58219 -> 128.255.183.224 9027 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/01/28 19:26:31.103363 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 19:26:31.103486 0.257540 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.361463 0.221486 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.583360 0.046087 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.629824 0.060301 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.690536 0.039800 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.730727 0.052143 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.783284 0.078011 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:31.909616 0.205664 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:32.115739 0.421459 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:32.537653 0.166085 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:32.704150 0.096484 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:32.801017 0.322923 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.124502 0.066963 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.191929 0.355264 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.547572 0.172547 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.720603 0.057492 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.778498 0.142780 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.921713 0.059037 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:33.981108 0.131199 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.112704 0.081190 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.194386 0.035713 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.230519 0.229363 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.460262 0.057058 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.517797 0.204394 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:26:34.722565 0.178176 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:29:47.938563 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 19:29:54.945900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:30:02.947588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:30:18.950179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:30:50.956544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:36:54.963439 3.000589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:37:01.970002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:37:09.971346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:37:25.974268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:37:57.980317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:44:01.986457 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:44:08.994034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:44:16.995514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:44:32.997769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:45:05.004193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:54:11.390611 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 19:54:11.390814 1.026426 tcp 10.0.2.105 58220 -> 128.255.183.224 9027 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/01/28 19:54:28.017198 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 19:54:35.023940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:54:43.025589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:54:59.028118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:55:31.034577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 19:56:47.444679 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 19:56:47.444871 0.241704 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:47.686997 0.059052 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:47.746461 0.039670 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:47.786573 0.052166 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:47.839189 0.076034 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:47.915667 0.195857 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:56:48.111942 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 19:57:03.649670 0.064394 tcp 10.0.2.105 58221 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 19:57:03.714339 0.030563 tcp 10.0.2.105 58222 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 19:57:03.745193 0.145213 tcp 10.0.2.105 58223 -> 195.113.214.236 443 SRPA* 0 0 31 16004 flow=From-Botnet-V2-TCP-Established 1970/01/28 19:57:03.891023 0.047188 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:03.938662 0.325784 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:04.264888 0.167493 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:04.432839 0.077728 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:04.511014 0.335185 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:04.846642 0.062494 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:04.909585 0.361158 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.271143 0.175547 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.447098 0.060226 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.507758 0.145570 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.653777 0.058255 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.712489 0.144940 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.857826 0.080696 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.938900 0.035209 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:05.974502 0.212132 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:06.187096 0.186899 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:06.374430 0.225168 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/28 19:57:06.600027 0.057246 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:01:35.041414 3.000700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:01:42.047584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:01:50.049687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:02:06.052643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:02:38.058363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:08:42.064767 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:08:49.071841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:08:57.073321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:09:13.077001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:09:45.082536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:15:51.091551 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:15:58.098668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:16:06.100422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:16:22.103021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:16:54.109199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:22:58.115469 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:23:05.122755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:23:13.124150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:23:29.127189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:24:01.133039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:24:12.419923 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 20:24:12.420108 1.065992 tcp 10.0.2.105 58224 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/28 20:27:22.583078 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 20:27:22.583253 0.222863 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:22.806579 0.039547 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:22.846483 0.052219 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:22.899062 0.075309 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:22.974793 0.060053 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.035269 0.237097 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.272734 0.222181 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.495338 0.044781 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.540547 0.074550 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.615500 0.371323 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:23.987261 0.166985 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:24.154730 0.334537 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:24.489690 0.062763 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:24.552882 0.357802 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:24.911087 0.174553 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.086119 0.062759 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.149352 0.146676 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.296470 0.062724 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.359593 0.131195 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.491211 0.073194 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.564851 0.042015 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.607295 0.240857 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.848600 0.056449 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:25.905469 0.217164 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:27:26.122967 0.173155 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:30:05.139137 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 20:30:12.146721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:30:20.147791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:30:36.151029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:31:08.156906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:37:12.162553 3.002473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:37:19.170926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:37:27.172031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:37:43.175179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:38:15.181212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:44:19.186814 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:44:26.194372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:44:34.195835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:44:50.198988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:45:22.205182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:54:13.489790 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 20:54:13.489984 0.894656 tcp 10.0.2.105 58225 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/28 20:54:37.215687 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 20:54:44.223126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:54:52.224602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:55:08.227703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:55:40.233605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 20:57:37.302312 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 20:57:37.302433 0.221821 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.524698 0.039809 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.564930 0.052003 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.617385 0.077120 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.694922 0.058396 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.753783 0.237777 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:37.991948 0.076934 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:38.069350 0.328009 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:38.397716 0.166584 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:38.564722 0.204154 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:38.769270 0.039935 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:38.809599 0.334301 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.144344 0.066102 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.210872 0.397769 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.609027 0.177852 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.787268 0.060026 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.847671 0.145137 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:39.993196 0.059306 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.052956 0.032650 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.086038 0.234110 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.320572 0.058209 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.379168 0.211494 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.591083 0.171085 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.762584 0.144722 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/28 20:57:40.907751 0.081347 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:01:44.239621 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:01:51.247123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:01:59.248849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:02:15.251696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:02:47.257876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:08:53.267314 3.000624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:09:00.274246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:09:08.276013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:09:24.278957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:09:56.284812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:16:00.290678 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:16:07.297803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:16:15.299734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:16:31.302966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:17:03.308359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:23:07.314992 3.042257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:23:14.336082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:23:22.333443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:23:38.336794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:24:10.342842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:24:14.389122 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 21:24:14.389300 1.092593 tcp 10.0.2.105 58226 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/28 21:28:03.609065 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 21:28:03.609259 0.217730 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:03.827477 0.039518 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:03.867476 0.052167 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:03.920104 0.073738 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:03.994278 0.060532 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:04.055275 0.796539 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:04.852168 0.168398 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.021022 0.235031 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.256561 0.095619 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.352583 0.203455 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.556487 0.039953 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.596889 0.324859 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.922245 0.062919 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:05.985570 0.059579 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.045624 0.360383 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.406449 0.178979 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.585859 0.146822 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.733066 0.059209 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.821160 0.043169 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:06.864764 0.230341 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:07.095550 0.074415 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:07.170434 0.151886 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:07.322815 0.082953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:07.406183 0.210494 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:28:07.617154 0.174864 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:30:14.348696 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 21:30:21.355963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:30:29.357767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:30:45.360197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:31:17.366389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:37:21.372467 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:37:28.379658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:37:36.381515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:37:52.384445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:38:24.390288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:44:28.396669 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:44:35.403882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:44:43.405503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:44:59.408374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:45:31.414360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:54:15.488280 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 21:54:15.488444 0.945571 tcp 10.0.2.105 58227 -> 128.255.183.224 9027 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/01/28 21:54:43.420962 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 21:54:50.427959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:54:58.429551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:55:14.432421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:55:46.440401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 21:58:10.967111 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 21:58:10.967271 0.219312 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.187053 0.040864 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.228402 0.052026 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.280853 0.076159 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.357504 0.062034 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.419988 0.241137 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.661513 0.074099 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:11.736045 0.574570 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:12.310958 0.167440 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:12.478838 0.322279 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:12.801556 0.048501 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:12.850501 0.326783 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.177710 0.065850 udp 10.0.2.105 7010 <-> 81.156.111.183 8044 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.243998 0.056578 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.301049 0.362899 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.664428 0.179283 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.844167 0.143955 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:13.988598 0.059384 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.048456 0.036733 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.085622 0.240771 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.326901 0.059358 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.386769 0.145009 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.532198 0.181894 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.714554 0.078418 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/28 21:58:14.793399 0.207311 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:01:50.444516 3.002277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:01:57.451837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:02:05.453487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:02:21.456730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:02:53.462554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:09:04.479054 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:09:11.486148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:09:19.487496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:09:35.490939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:10:07.496950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:16:12.504161 3.001466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:16:19.511611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:16:27.513050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:16:43.515934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:17:15.522056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:23:20.529291 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:23:27.537105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:23:35.538219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:23:51.541271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:24:16.437872 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 22:24:16.438066 1.070917 tcp 10.0.2.105 58228 -> 128.255.183.224 9027 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:24:23.547351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:28:20.107926 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 22:28:20.108218 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 22:28:37.694942 0.066461 tcp 10.0.2.105 58229 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:37.761713 0.053069 tcp 10.0.2.105 58230 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:37.815135 0.128818 tcp 10.0.2.105 58231 -> 195.113.214.236 443 SRPA* 0 0 32 24687 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:37.944516 0.040290 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:37.985224 0.051877 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.037526 0.093408 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.131424 0.060470 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.192405 0.239333 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.432168 0.076144 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.508714 0.365509 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:38.874616 0.610764 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:39.485802 0.166555 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:39.652785 0.039415 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:39.692669 0.329985 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:40.023106 0.000000 udp 10.0.2.105 7010 -> 81.156.111.183 8044 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 22:28:58.353392 0.043958 tcp 10.0.2.105 58232 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:58.397657 0.053036 tcp 10.0.2.105 58233 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:58.450956 0.155530 tcp 10.0.2.105 58234 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:28:58.607206 0.061852 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:58.669430 0.359678 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.029478 0.176054 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.205962 0.143119 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.349479 0.060894 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.410765 0.040552 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.451679 0.226646 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.678775 0.057506 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.736693 0.151938 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:28:59.889093 0.206277 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:29:00.095860 0.175408 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:29:00.271688 0.079501 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:30:27.552889 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 22:30:34.561072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:30:42.562349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:30:58.565470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:31:30.571519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:37:34.587197 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:37:41.594798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:37:49.596688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:38:05.599223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:38:37.605576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:44:41.622330 3.010746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:44:48.638719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:44:56.640208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:45:12.643352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:45:44.649549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:51:48.655097 3.002095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:51:55.663178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:52:03.664144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:52:19.667322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:52:51.673401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:54:17.527808 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 22:54:17.528017 0.966701 tcp 10.0.2.105 58235 -> 128.255.183.224 9027 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:58:55.679889 3.001908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 22:59:02.687466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:59:10.688313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:59:18.057321 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 22:59:18.057427 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 22:59:26.691403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 22:59:36.670533 0.067583 tcp 10.0.2.105 58236 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:36.738378 0.052445 tcp 10.0.2.105 58237 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:36.791182 0.168253 tcp 10.0.2.105 58238 -> 195.113.214.236 443 SRPA* 0 0 69 69906 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:36.960009 0.000000 udp 10.0.2.105 7010 -> 81.156.111.183 8044 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 22:59:53.331109 0.044410 tcp 10.0.2.105 58239 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:53.375788 0.053793 tcp 10.0.2.105 58240 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:53.429940 0.147459 tcp 10.0.2.105 58241 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/28 22:59:53.577924 3.488451 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 4 1413 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:53.630367 3.496632 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 4 1301 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:53.706552 3.470715 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1003 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:53.766885 3.451215 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 4 1228 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:53.806886 3.618458 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 4 1182 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.005712 3.486848 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 4 1191 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.084043 3.648905 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 4 1256 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.323648 3.457126 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1200 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.370333 4.407039 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 4 1018 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.697944 3.248980 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1167 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:54.866261 3.582880 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:55.263608 3.877266 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 4 1254 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:55.625070 3.689388 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 4 1108 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:55.801016 3.566639 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 4 1087 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:55.860826 3.653465 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1127 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.007993 3.564666 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1254 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.069171 3.541675 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 4 1099 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.104594 3.839510 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 4 1335 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.334709 3.655779 udp 10.0.2.105 7010 <-> 81.147.127.73 4349 CON 0 0 4 1171 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.393702 3.728360 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1079 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.525115 4.064719 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1166 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.738976 3.560977 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 947 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:56.920018 3.459104 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1208 flow=From-Botnet-V2-UDP-Established 1970/01/28 22:59:58.697271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:00:00.590698 0.000000 udp 10.0.2.105 7010 -> 213.123.118.176 9007 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:06.859199 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:14.981359 0.000000 udp 10.0.2.105 7010 -> 79.25.72.47 1115 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:19.607280 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:00:22.461494 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 1398 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:30.763508 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:36.832547 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:42.610366 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:47.607495 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:00:49.800387 0.000000 udp 10.0.2.105 7010 -> 79.123.60.26 8369 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:00:55.729473 0.000000 udp 10.0.2.105 7010 -> 195.38.123.48 8794 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:01.097158 0.000000 udp 10.0.2.105 7010 -> 115.160.136.214 3048 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:09.720278 0.074088 udp 10.0.2.105 7010 -> 92.198.65.172 6016 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:09.794366 0.000000 icmp 92.198.65.172 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 294 flow=Background 1970/01/28 23:01:14.616806 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:01:15.828169 0.000000 udp 10.0.2.105 7010 -> 14.52.9.104 6518 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:20.916033 0.000000 udp 10.0.2.105 7010 -> 79.25.239.134 8169 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:27.425136 0.086832 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:01:27.521162 0.000000 udp 10.0.2.105 7010 -> 93.205.99.67 4760 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:32.582439 0.000000 udp 10.0.2.105 7010 -> 41.207.172.200 5955 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:38.801744 0.000000 udp 10.0.2.105 7010 -> 122.164.143.27 4003 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:43.607944 0.000158 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:01:44.439726 0.324753 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:01:44.774632 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:51.589876 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:01:56.807548 0.000000 udp 10.0.2.105 7010 -> 82.231.62.101 7792 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:02.705959 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:07.612828 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:02:09.355379 0.133558 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:02:09.498298 0.000000 udp 10.0.2.105 7010 -> 108.215.37.87 1726 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:16.195161 0.144316 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:02:16.348793 0.000000 udp 10.0.2.105 7010 -> 86.42.95.150 6606 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:22.123506 0.000000 udp 10.0.2.105 7010 -> 183.82.4.140 1027 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:28.242589 0.000000 udp 10.0.2.105 7010 -> 210.19.117.254 8970 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:33.109156 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:02:36.544073 0.000000 udp 10.0.2.105 7010 -> 75.6.136.137 8501 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:43.994802 0.000000 udp 10.0.2.105 7010 -> 202.85.200.91 1078 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:50.224052 0.000000 udp 10.0.2.105 7010 -> 49.205.122.14 8992 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:56.663663 0.112340 udp 10.0.2.105 7010 -> 178.204.118.249 6536 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:02:56.776003 0.000000 icmp 178.204.118.249 0x0303 -> 10.0.2.105 0x8819 URP 192 1 271 flow=Background 1970/01/28 23:03:01.610110 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:03:03.773692 0.000000 udp 10.0.2.105 7010 -> 217.58.82.66 2532 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:11.013782 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 9668 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:19.396377 0.327326 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:03:19.734684 0.000000 udp 10.0.2.105 7010 -> 72.43.116.100 1278 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:27.327480 0.000000 udp 10.0.2.105 7010 -> 24.15.75.195 3268 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:32.113936 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:03:34.307422 0.367104 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:03:34.685612 0.000000 udp 10.0.2.105 7010 -> 68.96.153.21 9449 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:41.758569 0.000000 udp 10.0.2.105 7010 -> 90.34.203.81 5368 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:48.147789 0.000000 udp 10.0.2.105 7010 -> 78.191.121.21 3546 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:53.865417 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:03:58.612356 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:03:59.143532 0.000000 udp 10.0.2.105 7010 -> 110.225.47.81 4795 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:06.253385 0.000000 udp 10.0.2.105 7010 -> 12.48.50.58 6239 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:12.021515 0.000000 udp 10.0.2.105 7010 -> 74.103.144.6 9310 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:19.752692 0.103273 udp 10.0.2.105 7010 -> 83.59.7.163 5272 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:19.855965 0.000000 icmp 83.59.7.163 0x0303 -> 10.0.2.105 0x9814 URP 192 1 200 flow=Background 1970/01/28 23:04:24.609573 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:04:26.472468 0.000000 udp 10.0.2.105 7010 -> 171.100.204.82 4674 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:32.520835 0.000000 udp 10.0.2.105 7010 -> 118.96.76.222 1803 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:40.072034 0.000000 udp 10.0.2.105 7010 -> 110.143.51.224 7946 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:48.724599 0.000000 udp 10.0.2.105 7010 -> 86.25.145.198 1214 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:04:53.611604 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:04:54.963727 0.000000 udp 10.0.2.105 7010 -> 175.143.33.248 6176 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:02.824906 0.000000 udp 10.0.2.105 7010 -> 202.166.198.44 1031 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:09.494293 0.000000 udp 10.0.2.105 7010 -> 86.111.68.245 7349 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:17.265495 0.205179 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:05:17.499448 0.173648 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:05:17.684429 0.000000 udp 10.0.2.105 7010 -> 95.6.87.219 2670 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:22.112193 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:05:22.763262 0.000000 udp 10.0.2.105 7010 -> 125.166.88.6 6594 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:27.800162 0.000000 udp 10.0.2.105 7010 -> 176.35.68.3 4408 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:36.122600 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 1025 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:44.895267 0.043198 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:05:44.961014 0.000000 udp 10.0.2.105 7010 -> 110.168.247.189 2159 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:05:49.611898 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:05:53.867920 0.157066 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:05:54.042412 0.110451 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:05:54.171713 0.000000 udp 10.0.2.105 7010 -> 211.21.138.89 5029 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:02.210089 0.000000 udp 10.0.2.105 7010 -> 122.150.211.150 2196 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:09.531224 0.080808 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:06:09.621001 0.066535 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:06:09.699488 0.000000 udp 10.0.2.105 7010 -> 211.26.10.184 4600 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:14.107121 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:06:17.852676 0.151878 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:06:18.020071 0.145478 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:06:18.183481 0.000000 udp 10.0.2.105 7010 -> 72.208.79.203 2315 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:24.231933 0.000000 udp 10.0.2.105 7010 -> 68.83.178.236 1262 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:26.707776 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 23:06:32.583609 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:33.715077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:06:40.765629 0.853615 udp 10.0.2.105 7010 -> 203.125.218.142 9651 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:41.619244 0.000000 icmp 203.125.218.142 0x0303 -> 10.0.2.105 0xb325 URP 192 1 242 flow=Background 1970/01/28 23:06:41.716959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:06:45.612188 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:06:45.822821 0.000000 udp 10.0.2.105 7010 -> 124.253.177.168 2369 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:52.932974 0.000000 udp 10.0.2.105 7010 -> 93.70.69.61 3431 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:06:57.719723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:07:01.194916 0.000000 udp 10.0.2.105 7010 -> 113.61.87.76 2182 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:08.184891 0.000000 udp 10.0.2.105 7010 -> 5.157.115.86 9630 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:13.111851 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:07:14.203630 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:20.262371 0.000000 udp 10.0.2.105 7010 -> 58.87.2.27 8817 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:26.671436 0.000000 udp 10.0.2.105 7010 -> 99.113.208.131 6755 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:29.725867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:07:33.401749 0.000000 udp 10.0.2.105 7010 -> 92.21.184.221 4372 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:38.107841 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:07:40.741644 0.185562 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:07:40.944630 0.000000 udp 10.0.2.105 7010 -> 213.205.77.50 5691 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:48.723354 0.000000 udp 10.0.2.105 7010 -> 14.154.151.18 8738 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:57.255971 0.103554 udp 10.0.2.105 7010 -> 78.182.235.16 6681 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:07:57.359525 0.000000 icmp 78.182.235.16 0x0303 -> 10.0.2.105 0x191a URP 192 1 337 flow=Background 1970/01/28 23:08:02.112326 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:08:02.443034 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:09.403310 0.000000 udp 10.0.2.105 7010 -> 83.216.183.107 4364 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:15.411786 0.000000 udp 10.0.2.105 7010 -> 176.240.96.202 1703 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:20.778818 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:26.968480 0.000000 udp 10.0.2.105 7010 -> 97.71.71.145 6905 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:31.614685 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:08:34.779263 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:41.238834 0.000000 udp 10.0.2.105 7010 -> 173.51.212.170 1997 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:47.317426 0.094692 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:08:47.428042 0.000000 udp 10.0.2.105 7010 -> 222.127.42.16 1028 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:53.536685 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:08:58.112789 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:09:00.566740 0.000000 udp 10.0.2.105 7010 -> 59.13.155.122 1555 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:06.314498 0.000000 udp 10.0.2.105 7010 -> 95.225.222.177 2538 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:11.542386 0.000000 udp 10.0.2.105 7010 -> 122.179.129.201 7743 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:18.171918 0.421947 udp 10.0.2.105 7010 -> 203.59.75.201 8404 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:18.593865 0.000000 icmp 203.59.75.201 0x0303 -> 10.0.2.105 0xd420 URP 192 1 279 flow=Background 1970/01/28 23:09:23.108655 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:09:24.162105 0.355546 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:24.528503 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:31.400808 0.000000 udp 10.0.2.105 7010 -> 207.144.227.87 9675 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:39.552772 0.000000 udp 10.0.2.105 7010 -> 24.103.56.70 4259 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:47.454156 0.042568 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:47.514447 0.000000 udp 10.0.2.105 7010 -> 188.169.133.171 5510 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:52.110354 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:09:53.883391 0.152611 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:54.060669 0.062684 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:54.135357 0.097853 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:54.253264 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 5352 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:09:59.511395 0.255199 udp 10.0.2.105 7010 <-> 161.200.34.33 5040 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:09:59.784123 0.000000 udp 10.0.2.105 7010 -> 116.6.192.167 3256 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:06.180464 0.219987 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:10:06.419585 0.000000 udp 10.0.2.105 7010 -> 90.55.70.38 4227 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:14.693090 0.000000 udp 10.0.2.105 7010 -> 115.187.88.74 5384 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:19.609948 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:10:20.141373 0.079178 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:10:20.245089 0.163595 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:10:20.445210 0.000000 udp 10.0.2.105 7010 -> 158.108.226.45 1919 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:27.683320 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:35.322655 0.000000 udp 10.0.2.105 7010 -> 86.150.222.206 9256 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:41.922496 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:46.608851 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:10:47.069309 0.000000 udp 10.0.2.105 7010 -> 81.156.111.183 8044 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:52.537640 0.000000 udp 10.0.2.105 7010 -> 24.188.42.35 5880 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:10:59.738158 0.000000 udp 10.0.2.105 7010 -> 219.75.33.25 3295 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:11:08.490291 0.171426 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:11:08.705995 0.000000 udp 10.0.2.105 7010 -> 87.24.106.78 5944 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:11:13.116961 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:13:37.737711 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 23:13:44.744954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:13:52.746417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:14:08.749466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:14:40.755699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:20:45.763109 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 23:20:52.770222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:21:00.771818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:21:16.774849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:21:48.780586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:24:18.496883 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:24:18.496993 1.107967 tcp 10.0.2.105 58242 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:27:52.787268 3.001003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 23:27:59.794149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:28:07.795761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:28:23.798713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:28:55.804855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:34:59.815386 4.087100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 23:35:07.858280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:35:15.760130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:35:31.570182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:36:03.174863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:41:15.198300 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:41:15.198469 0.195009 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.393921 0.076328 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.470697 0.052037 udp 10.0.2.105 7010 <-> 129.242.134.23 1751 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.523197 0.075479 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.599058 0.061315 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.660820 0.223590 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:15.884849 0.241348 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:16.126569 0.039383 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:16.166389 0.168541 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:16.335433 0.836633 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:17.172536 0.322259 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:17.495273 0.357309 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:17.853167 0.173979 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:18.027606 0.061225 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:18.089331 0.036376 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:18.126116 0.237299 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:18.363878 0.000000 udp 10.0.2.105 7010 -> 81.147.127.73 4349 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:41:34.633930 0.123279 tcp 10.0.2.105 58243 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:34.757545 0.052552 tcp 10.0.2.105 58244 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:34.810408 0.162131 tcp 10.0.2.105 58245 -> 195.113.214.236 443 SRPA* 0 0 50 32442 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:34.973217 0.138074 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.111707 0.198849 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.310988 0.081200 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.392787 0.143751 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.537014 0.059448 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.596851 0.212135 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:41:35.809386 0.000000 udp 10.0.2.105 7010 -> 79.10.2.161 6208 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:41:51.220094 2.117142 tcp 10.0.2.105 58246 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:53.337543 0.054408 tcp 10.0.2.105 58247 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:53.392398 0.181396 tcp 10.0.2.105 58248 -> 195.113.214.236 443 SRPA* 0 0 69 46944 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:41:53.574573 0.000000 udp 10.0.2.105 7010 -> 75.90.102.249 6029 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:42:08.707547 2.964889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/28 23:42:10.022321 0.066748 tcp 10.0.2.105 58249 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:10.089341 0.116683 tcp 10.0.2.105 58250 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:10.206294 0.147398 tcp 10.0.2.105 58251 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:10.354400 0.131405 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:10.486291 0.155440 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:10.642178 0.327698 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:10.970269 0.374746 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:11.345476 0.173217 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:11.519167 0.192391 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:11.712023 0.046402 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:11.758877 0.091299 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:11.850629 0.170320 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.021331 0.064658 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.086482 0.071380 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.158420 0.142628 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.301442 0.147469 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.449322 0.182204 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.632082 0.074008 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:12.706474 0.385260 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:13.092188 0.041379 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:13.134019 0.145103 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:13.279560 0.058962 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:13.349276 0.097379 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:13.447127 0.000000 udp 10.0.2.105 7010 -> 161.200.34.33 5040 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/28 23:42:15.626737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:42:23.527187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:42:31.232865 0.066968 tcp 10.0.2.105 58252 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:31.300154 0.054457 tcp 10.0.2.105 58253 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:31.354909 0.147833 tcp 10.0.2.105 58254 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:42:31.503281 0.215733 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:31.719454 0.155883 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:31.875747 0.065492 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:31.941686 0.167669 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/28 23:42:39.331824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:43:10.948379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:53:33.873195 3.001029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/28 23:53:40.879780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:53:49.000017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:54:04.904375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/28 23:54:19.606280 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/28 23:54:19.606434 0.929502 tcp 10.0.2.105 58255 -> 128.255.183.224 9027 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/01/28 23:54:36.910268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:00:40.917283 3.000911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:00:47.923954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:00:55.925176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:01:11.928559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:01:43.934847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:07:47.940230 3.002051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:07:54.948210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:08:02.949277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:08:18.952852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:08:50.958426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:12:55.189831 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 00:12:55.189943 0.000000 udp 10.0.2.105 7010 -> 81.147.127.73 4349 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:13:11.325224 0.044603 tcp 10.0.2.105 58256 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:11.370167 0.051144 tcp 10.0.2.105 58257 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:11.421726 0.142753 tcp 10.0.2.105 58258 -> 195.113.214.236 443 SRPA* 0 0 23 13146 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:11.564993 0.000000 udp 10.0.2.105 7010 -> 79.10.2.161 6208 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:13:28.548399 0.065724 tcp 10.0.2.105 58259 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:28.614496 0.051757 tcp 10.0.2.105 58260 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:28.666517 0.144871 tcp 10.0.2.105 58261 -> 195.113.214.236 443 SRPA* 0 0 24 13238 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:28.812041 0.000000 udp 10.0.2.105 7010 -> 75.90.102.249 6029 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:13:46.604023 0.066155 tcp 10.0.2.105 58262 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:46.670566 0.051220 tcp 10.0.2.105 58263 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:46.722107 0.156130 tcp 10.0.2.105 58264 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:13:46.878917 0.000000 udp 10.0.2.105 7010 -> 161.200.34.33 5040 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:14:03.949138 0.044563 tcp 10.0.2.105 58265 -> 195.113.214.211 80 FSPA* 0 0 10 1888 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:03.993950 0.054968 tcp 10.0.2.105 58266 -> 195.113.214.236 80 FSPA* 0 0 10 1920 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:04.049287 0.149634 tcp 10.0.2.105 58267 -> 195.113.214.236 443 SRPA* 0 0 22 12879 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:04.199471 0.040003 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:04.239845 0.074297 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:04.314614 0.039180 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:04.354195 0.166815 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:04.521452 0.000000 udp 10.0.2.105 7010 -> 129.242.134.23 1751 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:14:21.875048 0.066442 tcp 10.0.2.105 58268 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:21.941335 0.053178 tcp 10.0.2.105 58269 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:21.994790 0.153833 tcp 10.0.2.105 58270 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:22.149144 0.076697 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:22.226202 0.245168 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:22.471770 0.053344 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:22.525618 0.206107 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:22.732112 0.802486 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:23.535068 0.364133 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:23.899581 0.179277 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.079314 0.059579 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.139262 0.325491 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.465166 0.039845 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.505399 0.237520 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.743355 0.138074 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.881829 0.081293 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:24.963557 0.211463 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.175391 0.185090 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.360936 0.144083 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.505420 0.057440 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.563241 0.135127 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.698781 0.131760 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:25.830952 0.325066 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:26.156427 0.174826 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:26.331667 0.192220 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:26.524413 0.043870 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:26.568760 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:14:43.034740 0.045799 tcp 10.0.2.105 58271 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:43.080833 0.054820 tcp 10.0.2.105 58272 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:43.135992 0.145511 tcp 10.0.2.105 58273 -> 195.113.214.236 443 SRPA* 0 0 33 19366 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:43.282169 0.176231 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:43.458834 0.361246 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:43.820520 0.143221 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:43.964175 0.142338 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.106962 0.182586 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.289984 0.074332 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.364718 0.069359 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.434491 0.069151 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.504014 0.042657 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.547083 0.145827 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.693341 0.058047 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:14:44.751833 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:14:54.964486 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 00:14:59.819542 0.078005 tcp 10.0.2.105 58274 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:59.897835 0.052338 tcp 10.0.2.105 58275 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:14:59.950515 0.153620 tcp 10.0.2.105 58276 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:15:00.104685 0.336877 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:15:00.442136 0.215150 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:15:00.657715 0.169170 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:15:00.827280 0.150449 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:15:00.978141 0.094315 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:15:01.971978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:15:09.973242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:15:25.975903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:15:57.982716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:22:03.991673 3.001067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:22:10.998919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:22:19.000507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:22:35.003506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:23:07.009556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:24:20.535470 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 00:24:20.535573 0.944093 tcp 10.0.2.105 58277 -> 128.255.183.224 9027 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:29:11.015971 3.025580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:29:18.033431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:29:26.034152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:29:42.037305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:30:14.043420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:36:18.050402 3.000666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:36:25.056205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:36:33.057652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:36:49.061250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:37:21.067197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:43:25.074478 3.000505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 00:43:32.080800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:43:40.082332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:43:56.085326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:44:28.091168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:45:04.724390 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 00:45:04.724584 0.051825 udp 10.0.2.105 7010 -> 129.242.134.23 1751 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:45:04.776409 0.000000 icmp 129.242.134.23 0x0303 -> 10.0.2.105 0xd706 URP 192 1 183 flow=Background 1970/01/29 00:45:22.681715 0.067768 tcp 10.0.2.105 58278 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:22.749758 0.053866 tcp 10.0.2.105 58279 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:22.803933 0.146623 tcp 10.0.2.105 58280 -> 195.113.214.236 443 SRPA* 0 0 48 34378 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:22.951253 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:45:38.443414 0.066405 tcp 10.0.2.105 58281 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:38.510200 0.053337 tcp 10.0.2.105 58282 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:38.563805 0.147873 tcp 10.0.2.105 58283 -> 195.113.214.236 443 SRPA* 0 0 42 23318 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:38.712202 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 00:45:53.744918 0.069027 tcp 10.0.2.105 58284 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:53.814236 0.052934 tcp 10.0.2.105 58285 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:53.867452 0.158041 tcp 10.0.2.105 58286 -> 195.113.214.236 443 SRPA* 0 0 46 41552 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:45:54.026094 0.039140 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.065703 0.080186 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.146262 0.040393 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.187072 0.167637 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.355143 0.061377 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.416981 0.198088 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.615486 0.239446 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.855311 0.078104 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:54.933862 0.368662 udp 10.0.2.105 7010 <-> 1.160.251.22 7701 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:55.302974 0.179801 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:55.483239 0.391414 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:55.875205 0.057328 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:55.932926 0.233345 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.166740 0.137851 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.305000 0.081900 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.387328 0.207789 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.595593 0.325697 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.921688 0.035661 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:56.957802 0.136305 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.094503 0.132593 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.227535 0.331098 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.559023 0.170691 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.730119 0.181148 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.911645 0.059457 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:57.971507 0.147655 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.119599 0.189725 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.309712 0.190047 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.500147 0.159956 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.660714 0.145025 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.806179 0.143825 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:58.950398 0.352390 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.303253 0.094500 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.398207 0.069436 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.468046 0.067493 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.536038 0.042984 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.579449 0.180490 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.760345 0.056416 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.817170 0.142380 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:45:59.959961 0.168818 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:46:00.129207 0.386690 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:46:00.516311 0.218529 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:46:00.735311 0.148747 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:46:00.884556 0.066997 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/29 00:54:13.105550 3.001267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 00:54:20.112765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:54:21.485451 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 00:54:21.485604 0.906714 tcp 10.0.2.105 58287 -> 128.255.183.224 9027 FSPA* 0 0 14 1555 flow=From-Botnet-V2-TCP-Established 1970/01/29 00:54:28.113797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:54:44.117136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 00:55:16.123248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:01:20.129031 3.001100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:01:27.136754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:01:35.137924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:01:51.140820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:02:23.147235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:08:27.153049 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:08:34.159880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:08:42.161917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:08:58.165050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:09:30.170550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:15:38.183573 3.000368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:15:45.190099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:15:53.191637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:16:09.194753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:16:29.694382 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 01:16:29.694472 0.040004 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:29.734885 0.046437 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:29.781703 0.074485 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:29.856610 0.195854 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:30.052947 0.244633 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:30.298023 0.075866 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:30.374332 0.166607 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:30.541361 0.060623 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:30.602409 0.000000 udp 10.0.2.105 7010 -> 1.160.251.22 7701 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:16:41.200843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:16:47.100848 0.067629 tcp 10.0.2.105 58288 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:16:47.168749 0.053974 tcp 10.0.2.105 58289 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:16:47.223021 0.153375 tcp 10.0.2.105 58290 -> 195.113.214.236 443 SRPA* 0 0 40 22620 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:16:47.376849 0.179679 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:47.556932 0.323669 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:47.880960 0.059993 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:47.941360 0.232237 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:48.174078 0.207234 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:48.381771 0.341172 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:48.723338 0.034924 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:48.758722 0.153992 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:48.913120 0.134766 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:49.048523 0.124112 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:49.173098 0.079690 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:16:49.253211 0.000000 udp 10.0.2.105 7010 -> 121.166.91.53 6783 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:17:06.784671 0.044732 tcp 10.0.2.105 58291 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:17:06.829718 0.055169 tcp 10.0.2.105 58292 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:17:06.885180 0.158624 tcp 10.0.2.105 58293 -> 195.113.214.236 443 SRPA* 0 0 23 12936 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:17:07.044513 0.177065 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.222045 0.177384 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.399832 0.061208 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.461505 0.146289 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.608247 0.177889 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.786524 0.146823 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:07.933713 0.143567 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:08.077635 0.826129 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:08.904232 0.043822 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:08.948481 0.414446 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.363317 0.073854 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.437625 0.071106 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.509126 0.070981 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.580631 0.044433 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.625441 0.181867 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.807703 0.060832 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:09.868973 0.145199 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:10.014605 0.168809 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:10.183813 0.200239 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:10.384641 0.079461 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:10.464575 0.323185 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:17:10.788214 0.214598 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:22:45.206634 3.032692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:22:52.223896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:23:00.225529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:23:16.228164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:23:48.234743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:24:22.394349 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 01:24:22.394450 0.942143 tcp 10.0.2.105 58294 -> 128.255.183.224 9027 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:29:52.241006 3.032216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:29:59.257690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:30:07.259541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:30:23.262451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:30:55.268561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:36:59.274687 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:37:06.282417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:37:14.284017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:37:30.287141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:38:02.292874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:44:06.298124 3.002133 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 01:44:13.305985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:44:21.307359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:44:37.310561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:45:09.316700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:47:13.015018 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 01:47:13.015134 0.000000 udp 10.0.2.105 7010 -> 1.160.251.22 7701 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:47:28.448308 0.066088 tcp 10.0.2.105 58295 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:28.514668 0.056200 tcp 10.0.2.105 58296 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:28.571236 0.155028 tcp 10.0.2.105 58297 -> 195.113.214.236 443 SRPA* 0 0 43 37064 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:28.727030 0.000000 udp 10.0.2.105 7010 -> 121.166.91.53 6783 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:47:45.421551 0.048979 tcp 10.0.2.105 58298 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:45.470802 0.055259 tcp 10.0.2.105 58299 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:45.526369 0.149195 tcp 10.0.2.105 58300 -> 195.113.214.236 443 SRPA* 0 0 22 13092 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:47:45.676074 0.261229 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:45.937678 0.238029 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.176172 0.075824 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.252590 0.039622 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.292583 0.077390 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.370411 0.045583 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.416458 0.064674 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.481634 0.165160 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.647180 0.173116 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.820739 0.060381 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:46.881545 0.230593 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:47.112516 0.451339 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:47.564258 0.148859 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:47.713510 0.132699 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:47.846607 0.123861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:47.970945 0.083354 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:48.054683 0.327549 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:48.382656 0.212800 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:48.595938 0.039850 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:48.636234 0.185082 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:48.821676 0.178514 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:49.000756 0.060056 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:49.061230 0.143921 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:47:49.205575 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:48:05.731223 0.065434 tcp 10.0.2.105 58301 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:05.796962 0.054827 tcp 10.0.2.105 58302 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:05.851679 0.147762 tcp 10.0.2.105 58303 -> 195.113.214.236 443 SRPA* 0 0 25 13044 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:05.999985 0.145095 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:06.145514 0.044106 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:06.190100 0.299815 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:06.490351 0.346973 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:06.837730 0.379048 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.217164 0.073963 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.291525 0.072386 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.364381 0.068400 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.433214 0.043192 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.476822 0.182412 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:07.659648 0.000000 udp 10.0.2.105 7010 -> 86.162.152.102 4795 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 01:48:23.876708 0.043889 tcp 10.0.2.105 58304 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:23.920879 0.055167 tcp 10.0.2.105 58305 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:23.976386 0.146150 tcp 10.0.2.105 58306 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:48:24.123193 0.141387 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:24.265032 2.702905 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:26.968524 0.152608 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:27.121509 0.066645 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:27.188563 0.327609 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:48:27.516568 0.214210 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 01:54:23.343907 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 01:54:23.344077 0.980948 tcp 10.0.2.105 58307 -> 128.255.183.224 9027 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/01/29 01:54:30.325442 3.002030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 01:54:37.333467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:54:45.334885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:55:01.337789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 01:55:33.343592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:01:37.349916 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:01:44.359098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:01:52.358896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:02:08.362005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:02:40.367781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:08:44.373842 3.001678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:08:51.381237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:08:59.382377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:09:15.385513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:09:47.391521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:15:56.404711 3.012062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:16:03.422163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:16:11.423913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:16:27.426975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:16:59.432887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:18:33.719161 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 02:18:33.719331 0.175225 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:33.895059 0.059673 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:33.955140 0.040175 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:33.995781 0.077154 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.073395 0.039822 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.113680 0.062611 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.176746 0.071248 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.248497 0.252174 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.501110 0.206782 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.708533 0.230965 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:34.939957 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 02:18:51.595732 0.066577 tcp 10.0.2.105 58308 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:18:51.662589 0.065970 tcp 10.0.2.105 58309 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:18:51.728863 0.147833 tcp 10.0.2.105 58310 -> 195.113.214.236 443 SRPA* 0 0 23 13378 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:18:51.877197 0.210462 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:52.088162 0.062827 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:52.151402 0.745444 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:52.897306 0.157575 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:53.055290 0.134485 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:53.190158 0.151903 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:53.342451 0.329245 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:53.672200 0.080263 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:53.873253 0.198564 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.072200 0.059584 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.132206 0.143590 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.276204 0.176554 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.453204 0.039298 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.492948 0.212235 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.705631 0.140282 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.846283 0.144724 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:54.991382 0.046507 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.038277 0.353566 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.392270 0.196112 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.588798 0.067458 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.656721 0.042892 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.700091 0.182683 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.883154 0.069804 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:55.953344 0.074572 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:56.028338 0.249126 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:56.278449 0.069005 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:56.347878 0.168595 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:56.516895 0.157040 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:56.674322 0.344304 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:18:57.019032 0.215846 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:23:05.441565 3.001725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:23:12.449166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:23:20.451110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:23:36.453660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:24:08.459727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:24:24.333328 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 02:24:24.333437 0.912600 tcp 10.0.2.105 58311 -> 128.255.183.224 9027 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:30:12.466063 3.001253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:30:19.473142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:30:27.474612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:30:43.477690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:31:15.483503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:37:19.489123 3.002378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:37:26.497267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:37:34.498527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:37:50.501860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:38:22.507741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:44:26.514223 3.001492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 02:44:33.521236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:44:41.522656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:44:57.525367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:45:29.531801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:49:19.182093 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 02:49:19.182192 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 02:49:37.790146 0.066988 tcp 10.0.2.105 58312 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:49:37.857423 0.054123 tcp 10.0.2.105 58313 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:49:37.911845 0.161396 tcp 10.0.2.105 58314 -> 195.113.214.236 443 SRPA* 0 0 42 34656 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:49:38.073838 0.062376 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.136747 0.040001 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.177231 0.075295 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.252992 0.039406 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.292858 0.060935 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.354244 0.077587 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.432209 0.240611 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:38.673417 0.878946 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:39.552750 0.170904 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:39.724001 0.225264 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:39.949728 0.172564 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.122727 0.061497 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.184613 0.131282 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.316341 0.145314 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.462099 0.389771 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.852408 0.136652 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:40.989481 0.358424 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:41.348288 0.077751 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:41.426407 0.174074 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:41.600934 0.060798 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:41.662141 0.180861 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:41.843457 0.182992 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.026843 0.034973 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.062204 0.144180 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.206770 0.047277 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.254530 0.353246 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.608171 0.208660 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.817187 0.142948 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:42.960533 0.190970 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.151968 0.066981 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.219367 0.044534 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.264508 0.181763 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.446723 0.070279 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.517465 0.074693 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.592572 0.146351 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.739374 0.069113 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:43.808936 0.314711 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:44.124084 0.215752 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:49:44.340221 0.000000 udp 10.0.2.105 7010 -> 108.210.102.165 7973 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 02:49:53.165534 0.000000 udp 10.0.2.105 7010 <- 108.210.102.165 7973 RSP 0 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 02:49:53.166024 0.150993 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 02:54:25.252609 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 02:54:25.252771 0.974743 tcp 10.0.2.105 58315 -> 128.255.183.224 9027 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/01/29 02:54:41.538014 3.001678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 02:54:48.545473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:54:56.547089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:55:12.550516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 02:55:44.556343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:01:48.561703 3.002201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:01:55.569293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:02:03.570743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:02:19.573600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:02:51.579817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:09:02.595860 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:09:09.603349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:09:17.604763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:09:33.608059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:10:05.613906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:16:10.622099 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:16:17.628704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:16:25.630323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:16:41.633246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:17:13.639428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:20:05.075735 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 03:20:05.075935 0.057812 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.134120 0.039351 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.173858 0.083955 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.258184 0.039053 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.297618 0.058133 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.356194 0.121526 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.478108 0.236136 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.714681 0.201061 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:05.916137 0.151050 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.067614 0.233539 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.301607 0.171887 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.473888 0.057124 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.531458 0.132930 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.664729 0.141310 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.806513 0.131123 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:06.938032 0.325278 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:07.263712 0.181334 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:07.445424 0.060811 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:07.506719 0.347327 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:07.854468 0.078764 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:07.933667 0.143140 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.077216 0.180427 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.258076 0.033096 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.291536 0.143572 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.435584 0.045065 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.481021 0.143996 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.625408 0.361709 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:08.987531 0.206983 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.194986 0.200773 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.396137 0.068478 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.464994 0.044507 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.509879 0.180494 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.690724 0.070474 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.761562 0.074725 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.836646 0.144464 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:09.981578 0.216128 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:10.198100 0.065851 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:10.264528 0.333195 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:10.598165 0.189983 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:20:10.788712 0.150282 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:23:18.646393 3.002301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:23:25.654217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:23:33.655846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:23:49.658698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:24:21.664852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:24:26.231752 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 03:24:26.231963 0.986578 tcp 10.0.2.105 58316 -> 128.255.183.224 9027 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/01/29 03:30:25.671933 3.000515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:30:32.678411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:30:40.680468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:30:56.683066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:31:28.688671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:37:32.694504 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:37:39.702021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:37:47.703399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:38:03.706825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:38:35.712903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:44:39.718192 3.002123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 03:44:46.726291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:44:54.727520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:45:10.740368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:45:42.746626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:50:37.070214 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 03:50:37.070331 0.075246 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.146074 0.043932 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.190426 0.059312 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.250182 0.074864 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.325483 0.060652 udp 10.0.2.105 7010 <-> 86.162.152.102 4795 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.386555 0.039912 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.426919 0.287039 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:37.714371 0.677218 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:38.391990 0.174866 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:38.567262 0.229408 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:38.797112 0.170701 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:38.968472 0.060386 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:39.029264 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 03:50:54.487020 0.044677 tcp 10.0.2.105 58317 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 03:50:54.532026 0.052587 tcp 10.0.2.105 58318 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 03:50:54.585007 0.193632 tcp 10.0.2.105 58319 -> 195.113.214.236 443 SRPA* 0 0 34 27738 flow=From-Botnet-V2-TCP-Established 1970/01/29 03:50:54.779351 0.143394 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:54.923165 0.124055 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:55.047724 0.957381 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:56.005525 0.361539 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:56.367528 0.060401 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:56.428548 0.320934 udp 10.0.2.105 7010 <-> 218.164.98.103 7010 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:56.750000 0.080688 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:56.831092 0.229635 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.061158 0.179021 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.240597 0.057799 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.298863 0.142817 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.442040 0.068029 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.510420 0.139875 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:57.650660 0.353326 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.004411 0.217942 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.222784 0.218943 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.442136 0.067688 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.510233 0.043698 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.554413 0.181656 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.736567 0.072467 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.809464 0.078290 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:58.888194 0.145956 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:59.034540 0.215458 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:59.250413 0.066477 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:59.317295 0.340759 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:59.658478 0.170554 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:50:59.829467 0.155228 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 03:54:27.221012 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 03:54:27.221214 0.954328 tcp 10.0.2.105 58320 -> 128.255.183.224 9027 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/01/29 03:54:48.754612 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 03:54:55.761666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:55:03.763269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:55:19.766662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 03:55:51.772568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:01:55.779164 3.000469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:02:02.785482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:02:10.787030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:02:26.789714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:02:58.796177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:09:13.809097 3.003095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:09:20.815589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:09:28.817024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:09:44.820070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:10:16.825996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:16:20.831632 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:16:27.839206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:16:35.840449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:16:51.843932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:17:23.850012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:21:29.984211 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 04:21:29.984416 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:21:47.801400 0.072150 tcp 10.0.2.105 58321 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:21:47.874179 0.053492 tcp 10.0.2.105 58322 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:21:47.927947 0.158355 tcp 10.0.2.105 58323 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:21:48.086915 0.450193 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:21:48.537501 0.722060 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:21:49.260016 0.000000 udp 10.0.2.105 7010 -> 86.162.152.102 4795 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:22:07.919347 0.066059 tcp 10.0.2.105 58324 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:07.985757 0.054312 tcp 10.0.2.105 58325 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:08.040401 0.149260 tcp 10.0.2.105 58326 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:08.190227 0.040003 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:08.230641 0.078723 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:08.309815 0.039096 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:08.349341 0.262155 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:08.611972 0.239670 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:08.852080 0.180071 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.032535 0.176301 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.209211 0.200787 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.410482 0.060299 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.471235 0.145355 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.617058 0.131000 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:09.748607 0.761320 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:10.510414 0.000000 udp 10.0.2.105 7010 -> 218.164.98.103 7010 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:22:27.997916 0.069636 tcp 10.0.2.105 58327 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:28.067903 0.109823 tcp 10.0.2.105 58328 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:28.178040 0.155543 tcp 10.0.2.105 58329 -> 195.113.214.236 443 SRPA* 0 0 43 34898 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:22:28.334252 0.084925 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:28.419627 0.179245 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:28.599317 0.059786 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:28.659557 0.139266 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:28.799189 0.174680 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:28.974278 0.032503 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:29.007175 0.252224 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:29.259889 0.045576 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:29.305922 0.214689 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:29.521073 0.143794 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:29.665240 0.340920 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.006568 0.222522 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.229502 0.070730 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.300626 0.043889 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.344895 0.181338 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.526691 0.071768 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.598935 0.074462 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.673759 0.061858 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.736048 0.147399 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:30.883873 0.217161 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:31.101473 0.152553 udp 10.0.2.105 7010 <-> 69.159.94.252 5290 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:31.254438 0.339229 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:22:31.594042 3.838779 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:23:27.855941 3.001860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 04:23:34.863290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:23:42.865008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:23:58.867938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:24:28.180652 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 04:24:28.180805 0.959122 tcp 10.0.2.105 58330 -> 128.255.183.224 9027 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:24:30.873761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:30:34.881085 3.000569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:30:41.887429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:30:49.890828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:31:05.891797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:31:37.898139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:37:41.903866 3.001743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:37:48.911804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:37:56.913045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:38:12.915977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:38:44.922146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:44:48.927976 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:44:55.935333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:45:03.936865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:45:19.939870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:45:51.945875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:51:55.951642 3.001992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 04:52:02.959383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:52:10.960767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:52:26.964928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:52:58.969851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:53:04.599143 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 04:53:04.599348 0.000000 udp 10.0.2.105 7010 -> 86.162.152.102 4795 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:53:23.066161 0.045135 tcp 10.0.2.105 58331 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:23.111525 0.052929 tcp 10.0.2.105 58332 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:23.164736 0.142403 tcp 10.0.2.105 58333 -> 195.113.214.236 443 SRPA* 0 0 34 24817 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:23.307659 0.000000 udp 10.0.2.105 7010 -> 218.164.98.103 7010 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:53:38.547763 0.043876 tcp 10.0.2.105 58334 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:38.591970 0.052466 tcp 10.0.2.105 58335 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:38.644781 0.155382 tcp 10.0.2.105 58336 -> 195.113.214.236 443 SRPA* 0 0 36 26728 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:38.801031 0.061556 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:38.863045 0.076318 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:38.939805 0.040083 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:38.980511 0.281387 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:39.262359 0.228953 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:39.491741 0.041749 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:39.533917 0.076062 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:39.610387 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:53:58.326063 0.044426 tcp 10.0.2.105 58337 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:58.370807 0.054044 tcp 10.0.2.105 58338 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:58.425271 0.147969 tcp 10.0.2.105 58339 -> 195.113.214.236 443 SRPA* 0 0 75 52678 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:53:58.573958 0.176257 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:58.750614 0.138036 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:58.889081 0.351959 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:59.241426 0.069348 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:59.311196 0.135586 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:53:59.447192 0.638645 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.086254 0.076392 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.163072 0.183968 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.347454 0.059508 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.407435 0.143830 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.551708 0.177509 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.729658 0.034203 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.764265 0.145542 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:00.910234 0.138226 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.048941 0.342744 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.392084 0.215504 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.608059 0.045962 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.654416 0.207500 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.862328 0.067916 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.930636 0.043357 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:01.974435 0.182369 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.157243 0.073227 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.230929 0.075376 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.306757 0.064340 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.371551 0.158703 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.530679 0.215805 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:02.746889 0.000000 udp 10.0.2.105 7010 -> 69.159.94.252 5290 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:54:20.427478 0.066483 tcp 10.0.2.105 58340 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:54:20.494261 0.051723 tcp 10.0.2.105 58341 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:54:20.546253 0.156780 tcp 10.0.2.105 58342 -> 195.113.214.236 443 SRPA* 0 0 41 22832 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:54:20.703614 0.337658 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 04:54:21.041807 0.000000 udp 10.0.2.105 7010 -> 108.210.102.165 7973 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:54:26.422331 0.000000 udp 10.0.2.105 7010 <- 108.210.102.165 7973 RSP 0 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 04:54:29.139436 0.997591 tcp 10.0.2.105 58343 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/29 04:59:02.976029 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 04:59:09.983145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:59:17.984791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 04:59:33.987754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:00:05.993304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:06:34.005365 2.999943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:06:41.011502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:06:49.013254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:07:05.016195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:07:37.022210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:13:41.028328 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:13:48.035276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:13:56.037192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:14:12.040422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:14:44.046465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:20:48.051690 3.002181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:20:55.059579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:21:03.061110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:21:19.064247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:21:51.070256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:24:30.139220 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 05:24:30.139407 1.002584 tcp 10.0.2.105 58344 -> 128.255.183.224 9027 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:24:38.731519 0.150334 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:38.882295 0.000000 udp 10.0.2.105 7010 -> 69.159.94.252 5290 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 05:24:54.977321 0.045011 tcp 10.0.2.105 58345 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:24:55.022690 0.052697 tcp 10.0.2.105 58346 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:24:55.075689 0.150944 tcp 10.0.2.105 58347 -> 195.113.214.236 443 SRPA* 0 0 21 13074 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:24:55.227162 0.242770 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.470447 0.062006 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.532868 0.040318 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.573686 0.078539 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.652689 0.251586 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.904716 0.046160 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:55.951231 0.074470 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.026200 0.173944 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.200684 0.060810 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.261887 0.185662 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.447934 0.202555 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.650916 0.144725 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:56.796047 0.439864 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.236327 0.078397 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.315158 0.149039 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.464585 0.180753 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.645801 0.034292 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.680581 0.058968 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.739947 0.178491 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:57.918844 0.345320 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.264699 0.142996 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.408116 0.144738 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.553322 0.042295 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.596054 0.214924 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.811424 0.067947 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.879740 0.043443 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:58.923740 0.212412 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.136580 0.182537 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.319505 0.158229 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.478197 0.215317 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.693888 0.072047 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.766376 0.074636 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.841505 0.069184 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:24:59.911115 0.338527 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:25:00.250107 0.171514 udp 10.0.2.105 7010 <-> 108.210.102.165 7973 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:27:55.076397 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 05:28:02.083556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:28:10.085334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:28:26.088058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:28:58.094232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:35:02.099641 3.002265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:35:09.107795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:35:17.108877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:35:33.112010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:36:05.117817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:42:09.125548 3.000315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:42:16.131394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:42:24.133001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:42:40.136055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:43:12.142077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:53:34.149069 3.001267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 05:53:41.156483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:53:49.158015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:54:05.161010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:54:31.139202 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 05:54:31.139387 0.935137 tcp 10.0.2.105 58348 -> 128.255.183.224 9027 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:54:37.167183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 05:55:24.075245 0.177379 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:24.253097 0.224827 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:24.478367 0.063428 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:24.542234 0.039593 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:24.582261 0.075664 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:24.658358 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 05:55:28.610863 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 05:55:42.823128 0.065024 tcp 10.0.2.105 58349 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:55:42.888488 0.089940 tcp 10.0.2.105 58350 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:55:42.978712 0.165989 tcp 10.0.2.105 58351 -> 195.113.214.236 443 SRPA* 0 0 23 13264 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:55:43.145268 0.044564 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:43.190247 0.075653 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:43.266304 0.169661 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:43.436378 0.060325 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:43.497181 0.151857 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:43.649440 0.421294 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.071167 0.136442 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.208056 0.208418 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.416928 0.083209 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.500722 0.143697 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.644873 0.180941 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.826239 0.040914 udp 10.0.2.105 7010 <-> 78.134.67.242 4044 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.867594 0.059908 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:44.927919 0.177492 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.105823 0.365905 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.472386 0.046754 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.519600 0.214950 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.734953 0.068265 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.803641 0.044006 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:45.848070 0.220967 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.069467 0.143539 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.213454 0.142681 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.356574 0.182308 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.539328 0.144347 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.684191 0.215668 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.900394 0.083258 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:46.984099 0.075041 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:47.059593 0.070795 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:47.130823 0.333066 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 05:55:47.464538 0.000000 udp 10.0.2.105 7010 -> 108.210.102.165 7973 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 05:56:04.112937 0.070476 tcp 10.0.2.105 58352 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:56:04.183702 0.055521 tcp 10.0.2.105 58353 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 05:56:04.239544 0.147185 tcp 10.0.2.105 58354 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:00:41.172647 3.002007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 06:00:48.179798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:00:56.182040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:01:12.185197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:01:44.191040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:07:48.196626 3.002111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:07:55.204546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:08:03.205870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:08:19.209060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:08:51.214933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:14:55.220964 3.001864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:15:02.228060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:15:10.229603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:15:26.232992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:15:58.239133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:22:04.247946 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:22:11.255462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:22:19.256915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:22:35.259137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:23:07.265609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:24:32.077747 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 06:24:32.077925 1.031839 tcp 10.0.2.105 58355 -> 128.255.183.224 9027 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:21.805766 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 06:26:21.805944 0.256864 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:22.063254 0.000000 udp 10.0.2.105 7010 -> 108.210.102.165 7973 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 06:26:39.431977 0.060235 tcp 10.0.2.105 58356 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:39.492536 0.057301 tcp 10.0.2.105 58357 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:39.550170 0.149051 tcp 10.0.2.105 58358 -> 195.113.214.236 443 SRPA* 0 0 41 22870 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:39.699819 0.076109 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:39.776303 0.059668 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:39.836359 0.228136 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.064928 0.151624 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.216959 0.039643 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.257074 0.076564 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.334063 0.044457 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.378964 0.177487 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.556833 0.060332 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.617566 0.144736 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:40.762725 0.382453 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:41.145575 0.080477 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:41.226506 0.144074 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:41.370968 0.202633 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:41.573956 0.140700 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:41.715050 0.000000 udp 10.0.2.105 7010 -> 78.134.67.242 4044 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 06:26:57.006126 0.068025 tcp 10.0.2.105 58359 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:57.074446 0.053176 tcp 10.0.2.105 58360 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:57.127915 0.150593 tcp 10.0.2.105 58361 -> 195.113.214.236 443 SRPA* 0 0 68 60628 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:26:57.279131 0.176723 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:57.456319 0.184558 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:57.641349 0.058148 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:57.699967 0.206727 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:57.907051 0.067403 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:57.974879 0.043111 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.018407 0.060407 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.079170 0.377249 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.456847 0.142494 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.599764 0.144085 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.744380 0.232513 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:58.977340 0.146791 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.124581 0.181419 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.306393 0.205330 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.512188 0.072528 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.585146 0.216303 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.801843 0.075379 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:26:59.877668 0.321880 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:29:11.271652 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 06:29:18.279484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:29:26.280555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:29:42.283974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:30:14.289692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:36:18.295971 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:36:25.303192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:36:33.304518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:36:49.307648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:37:21.313614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:43:25.329405 3.002006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:43:32.337300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:43:40.338646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:43:56.341662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:44:28.347672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:54:14.362858 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 06:54:21.370630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:54:29.371882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:54:33.117766 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 06:54:33.117946 0.974655 tcp 10.0.2.105 58362 -> 128.255.183.224 9027 FSPA* 0 0 12 1617 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:54:45.374789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:55:17.381237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 06:57:02.552259 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 06:57:02.552427 0.000000 udp 10.0.2.105 7010 -> 78.134.67.242 4044 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 06:57:19.358143 0.068831 tcp 10.0.2.105 58363 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:19.427217 0.054156 tcp 10.0.2.105 58364 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:19.481734 0.147859 tcp 10.0.2.105 58365 -> 195.113.214.236 443 SRPA* 0 0 41 34014 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:19.630140 0.253046 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:19.883659 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 06:57:36.130838 0.068055 tcp 10.0.2.105 58366 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:36.199204 0.052235 tcp 10.0.2.105 58367 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:36.251724 0.143743 tcp 10.0.2.105 58368 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:36.396064 0.040299 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.436763 0.075650 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.512829 0.073360 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.586666 0.231006 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.818086 0.044555 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.863101 0.081274 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:36.944832 0.058803 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.004095 0.137834 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.142377 0.351434 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.494241 0.082954 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.577697 0.178352 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.756633 0.196344 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:37.953351 0.354443 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:38.308500 0.161723 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:38.470675 0.170434 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:38.641501 0.177693 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:38.819588 0.060076 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:38.880063 0.214398 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.094929 0.068950 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.164333 0.042999 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.207769 0.042211 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.250413 0.145025 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.395902 0.207953 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.604430 0.145346 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:39.750221 0.366942 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:40.117604 0.143575 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:40.261595 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 06:57:57.652241 0.065971 tcp 10.0.2.105 58369 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:57.718543 0.054244 tcp 10.0.2.105 58370 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:57.773057 0.156799 tcp 10.0.2.105 58371 -> 195.113.214.236 443 SRPA* 0 0 41 21612 flow=From-Botnet-V2-TCP-Established 1970/01/29 06:57:57.930368 0.071050 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:58.001802 0.070671 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:58.072885 0.215802 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:58.289112 0.087689 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 06:57:58.377233 0.326227 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:01:21.386559 3.002097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 07:01:28.394152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:01:36.395740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:01:52.398658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:02:24.404775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:08:28.411347 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:08:35.418450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:08:43.419647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:08:59.422894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:09:31.428746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:15:40.442299 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:15:47.449350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:15:55.450976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:16:11.453842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:16:43.460590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:22:47.465957 3.001346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:22:54.473278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:23:02.474958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:23:18.477959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:23:50.483783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:24:34.097237 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 07:24:34.097354 1.409184 tcp 10.0.2.105 58372 -> 128.255.183.224 9027 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:28:15.925974 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 07:28:15.926094 0.176771 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:16.103330 0.180065 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:16.283817 0.258571 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:16.542853 0.040305 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:16.583571 0.472016 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:17.056024 0.041422 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:17.097881 0.745816 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:17.844069 0.059214 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:17.903628 0.123913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:18.027957 0.082906 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:18.111235 1.913967 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:20.025635 0.169968 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:20.196039 0.081695 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:20.278168 0.781291 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.059888 0.140157 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.200494 0.205771 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.406739 0.143171 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.550330 0.176159 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.726883 0.206434 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:21.933676 0.068897 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:22.002971 0.000000 udp 10.0.2.105 7010 -> 217.41.41.12 5678 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 07:28:40.542893 0.068346 tcp 10.0.2.105 58373 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:28:40.611515 0.061436 tcp 10.0.2.105 58374 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:28:40.673215 0.152730 tcp 10.0.2.105 58375 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:28:40.826506 0.062178 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:40.889137 0.176848 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:41.066480 0.214881 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:41.282452 0.147898 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:41.430718 0.118059 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:41.549203 0.141782 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:41.691436 0.366575 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.058424 0.142281 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.201185 0.069728 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.271348 0.097046 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.368837 0.292019 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.661233 0.074198 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:28:42.735842 0.214935 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:29:54.490547 3.001172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 07:30:01.497350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:30:09.498633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:30:25.501975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:30:57.507981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:37:01.513901 3.001700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:37:08.521164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:37:16.522751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:37:32.525971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:38:04.531899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:44:08.539190 3.037457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:44:15.558315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:44:23.556688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:44:39.559778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:45:11.565843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:54:31.573962 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 07:54:35.507403 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 07:54:35.507616 0.916813 tcp 10.0.2.105 58376 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:54:38.580920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:54:46.582335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:55:02.585905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:55:34.591677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 07:58:50.643635 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 07:58:50.643799 0.000000 udp 10.0.2.105 7010 -> 217.41.41.12 5678 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 07:59:07.008740 0.044273 tcp 10.0.2.105 58377 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:07.053269 0.056370 tcp 10.0.2.105 58378 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:07.109929 0.150220 tcp 10.0.2.105 58379 -> 195.113.214.236 443 SRPA* 0 0 43 35136 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:07.260895 0.173885 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:07.435252 0.181904 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:07.617542 0.040166 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:07.658135 0.258688 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:07.917230 0.039996 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:07.957652 0.075703 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.033818 0.137914 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.172138 0.070642 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.243189 0.061082 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.304708 0.060695 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.365856 0.083028 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.449264 0.230876 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.680708 0.170969 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:08.852058 0.451972 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:09.304592 0.147423 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:09.452496 0.179424 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:09.632376 0.208846 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:09.841606 0.068120 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:09.910176 0.151280 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.061868 0.198988 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.261292 0.226476 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.488187 0.059751 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.548392 0.178818 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.727629 0.147570 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.875618 0.044754 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:10.920796 0.143575 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:11.064797 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 07:59:29.830308 0.066991 tcp 10.0.2.105 58380 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:29.897563 0.052175 tcp 10.0.2.105 58381 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:29.949979 0.157017 tcp 10.0.2.105 58382 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/29 07:59:30.107496 0.143230 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:30.251122 0.067527 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:30.319113 0.073511 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:30.393019 0.215314 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:30.608822 0.074131 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/29 07:59:30.683370 0.298694 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:01:38.597857 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 08:01:45.605087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:01:53.606951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:02:09.609450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:02:41.615499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:08:45.621814 3.001419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:08:52.628990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:09:00.630884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:09:16.633344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:09:48.639529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:15:57.653528 3.000741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:16:04.660022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:16:12.661792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:16:28.664491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:17:00.670607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:23:06.679956 3.018832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:23:13.697080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:23:21.698679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:23:37.701371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:24:09.707378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:24:36.426664 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 08:24:36.426833 0.979278 tcp 10.0.2.105 58383 -> 128.255.183.224 9027 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:29:42.035180 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 08:29:42.035379 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 08:29:58.571382 0.067982 tcp 10.0.2.105 58384 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:29:58.639625 0.055034 tcp 10.0.2.105 58385 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:29:58.694951 0.155921 tcp 10.0.2.105 58386 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:29:58.851542 0.177270 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.029236 0.044871 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.074560 0.248440 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.323563 0.039863 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.363923 0.073207 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.437544 0.130989 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.568920 0.077821 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.647204 0.059706 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.707303 0.059230 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:29:59.766929 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 08:30:13.713712 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 08:30:15.544179 0.066766 tcp 10.0.2.105 58387 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:30:15.611295 0.056205 tcp 10.0.2.105 58388 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:30:15.667822 0.149878 tcp 10.0.2.105 58389 -> 195.113.214.236 443 SRPA* 0 0 47 37300 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:30:15.818393 0.215330 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.034113 0.175427 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.210052 0.076920 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.287382 0.178203 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.466027 0.207435 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.673854 0.068424 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.742825 0.156394 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:16.899601 0.198793 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.098814 0.152887 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.252175 0.361278 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.613852 0.146966 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.761252 0.044068 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.805723 0.144036 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:17.950188 0.196491 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.147102 0.060531 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.208063 0.172341 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.380873 0.144998 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.526289 0.087109 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.613817 0.074637 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.688872 0.216479 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.905781 0.074835 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:18.981083 0.296269 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 08:30:20.720970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:30:28.722647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:30:44.725625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:31:16.731580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:37:20.737343 3.001857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:37:27.744837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:37:35.746906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:37:51.749443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:38:23.755615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:44:27.761498 3.001513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:44:34.768844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:44:42.770879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:44:58.773629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:45:30.779106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:54:37.406040 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 08:54:37.406188 0.956864 tcp 10.0.2.105 58390 -> 128.255.183.224 9027 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/01/29 08:54:41.793874 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 08:54:48.801932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:54:56.803151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:55:12.805944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 08:55:44.812539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:00:47.567809 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 09:00:47.568067 0.180438 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:00:47.748938 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 09:01:06.336326 0.068237 tcp 10.0.2.105 58391 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 09:01:06.404890 0.054440 tcp 10.0.2.105 58392 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 09:01:06.459680 0.153989 tcp 10.0.2.105 58393 -> 195.113.214.236 443 SRPA* 0 0 42 22672 flow=From-Botnet-V2-TCP-Established 1970/01/29 09:01:06.614278 0.040096 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:06.654927 0.075989 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:06.655440 2.993658 tcp 10.0.2.105 58394 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 09:01:06.731376 0.246848 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:06.978722 0.075032 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.054181 0.051967 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.106556 0.060939 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.167903 0.138060 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.306373 0.054145 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.360923 0.095423 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.456715 0.234506 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.691657 0.177103 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:07.869208 0.176294 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.045920 0.205294 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.251633 0.060380 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.312426 0.141920 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.454745 0.207147 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.662276 0.151705 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.814350 0.139071 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:08.953856 0.143798 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:09.098149 0.220752 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:09.319269 0.059773 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:09.379434 0.324221 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:09.704051 0.144531 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:09.848969 0.180344 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.029676 0.150389 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.180584 0.072144 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.253118 0.074319 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.327882 0.257321 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.585621 0.086005 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:10.672022 0.292980 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:01:15.647933 0.000000 tcp 10.0.2.105 58394 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 09:01:48.817691 3.002174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:01:55.825478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:02:03.827122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:02:19.829926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:02:51.836426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:09:02.853806 3.000165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:09:09.859543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:09:17.861187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:09:33.864596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:10:05.869974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:16:10.877426 3.002015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:16:17.885048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:16:25.886770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:16:41.889732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:17:13.895698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:23:19.904565 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:23:26.911876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:23:34.913412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:23:50.916542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:24:22.922676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:24:38.365270 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 09:24:38.365439 1.063740 tcp 10.0.2.105 58395 -> 128.255.183.224 9027 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/01/29 09:30:26.929108 3.000850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:30:33.935974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:30:41.937381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:30:57.940652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:31:29.946009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:31:34.633670 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 09:31:34.633777 0.172988 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:34.807236 0.181873 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:34.989581 0.298245 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:34.989990 2.997966 tcp 10.0.2.105 58396 -> 108.236.234.31 9417 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 09:31:35.288261 0.071341 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.360011 0.061067 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.421500 0.046684 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.468585 0.081213 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.550234 0.061023 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.611637 0.137802 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.749951 0.040362 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.790776 0.082139 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:35.873342 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 09:31:43.996808 0.000000 tcp 10.0.2.105 58396 -> 108.236.234.31 9417 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 09:31:51.235825 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 09:31:51.236239 0.174024 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:51.410739 0.173837 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:51.585028 0.208549 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:51.793950 0.068734 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:51.863058 0.143556 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:52.006985 0.906347 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:52.913792 0.143429 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.057685 0.078204 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.136318 0.059882 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.196582 0.358895 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.555890 0.144620 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.700930 0.143120 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:53.844488 0.193335 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.038227 0.181425 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.220085 0.145706 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.366145 0.071278 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.437860 0.074945 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.513213 0.215049 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.728693 0.074303 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:54.803465 0.296972 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 09:31:58.607702 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 09:37:33.952431 3.013575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:37:40.969966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:37:48.971549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:38:04.974299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:38:36.980324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:44:40.986234 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:44:47.993434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:44:55.995231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:45:11.998518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:45:44.004754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:51:48.010959 3.011658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:51:55.027886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:52:03.029396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:52:19.032947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:52:51.038698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:54:39.434670 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 09:54:39.434895 0.937228 tcp 10.0.2.105 58397 -> 128.255.183.224 9027 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/29 09:58:55.044621 3.001448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 09:59:02.052159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:59:10.053586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:59:26.056828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 09:59:58.062542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:02:07.818785 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 10:02:07.818964 0.257295 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.076668 0.181903 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.259041 0.181949 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.441581 0.077755 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.442104 3.001832 tcp 10.0.2.105 58398 -> 108.236.234.31 9417 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 10:02:08.519690 0.057864 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.578013 0.047318 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.625736 0.067199 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.693426 0.062674 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.756566 0.144913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.901905 0.040248 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:08.942631 0.086456 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:09.029522 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 10:02:17.442542 0.000000 tcp 10.0.2.105 58398 -> 108.236.234.31 9417 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 10:02:24.439239 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 10:02:24.439727 0.179704 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:24.619840 0.180546 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:24.800855 0.212148 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.013442 0.061660 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.075522 0.145898 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.221891 0.171821 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.394173 0.060338 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.454938 0.279340 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.734753 0.140809 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:25.876017 0.333112 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.209518 0.146381 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.356447 0.141378 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.498234 0.192876 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.691525 0.177499 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.869442 0.077319 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:26.947192 0.215815 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:27.163470 0.122810 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:27.286676 0.292846 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:27.579949 0.151585 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:27.731982 0.072583 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:02:31.603571 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 10:06:27.074336 3.001549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:06:34.081703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:06:42.083385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:06:58.086319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:07:30.092212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:13:37.102062 3.002004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:13:44.110129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:13:52.111597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:14:08.114574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:14:40.120366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:20:45.129046 3.000466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:20:52.135288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:21:00.136989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:21:16.139947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:21:48.146003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:24:40.373962 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 10:24:40.374138 1.069997 tcp 10.0.2.105 58399 -> 128.255.183.224 9027 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/01/29 10:27:52.151943 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:27:59.158864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:28:07.160523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:28:23.163877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:28:55.169876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:32:30.179163 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 10:32:30.179375 0.242630 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.422388 0.163826 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.586616 0.180303 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.767484 0.075495 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.767916 3.006174 tcp 10.0.2.105 58400 -> 108.236.234.31 9417 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 10:32:30.843409 0.059865 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.903624 0.046550 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:30.950584 0.151484 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:31.102421 0.040346 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:31.143196 0.085426 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:31.229058 0.078524 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:31.308043 0.062458 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:31.370936 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 10:32:39.772767 0.000000 tcp 10.0.2.105 58400 -> 108.236.234.31 9417 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 10:32:43.100933 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 10:32:43.101429 0.178413 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.280280 0.173858 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.454550 0.208834 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.663760 0.068733 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.732915 0.146419 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.879731 0.047960 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.928150 0.058994 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:43.987645 0.479987 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:44.468140 0.137171 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:44.605715 0.336550 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:44.942621 0.139252 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:45.082271 0.143394 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:45.226073 0.297620 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:45.524187 0.180410 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:45.705087 0.070752 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:45.776313 0.295335 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:46.072108 0.146666 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:46.219127 0.068532 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:46.288098 0.215420 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:32:46.503994 0.074957 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/29 10:34:59.176839 3.001135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:35:06.183398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:35:14.184988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:35:30.187838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:36:02.194047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:42:06.200102 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:42:13.207241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:42:21.208792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:42:37.211800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:43:09.218066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:53:32.226364 3.001101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 10:53:39.233626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:53:47.235254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:54:03.238023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:54:35.244483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 10:54:41.443821 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 10:54:41.443988 0.908061 tcp 10.0.2.105 58401 -> 128.255.183.224 9027 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:00:39.250098 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:00:46.257989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:00:54.259169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:01:10.262062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:01:42.268068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:03:16.183542 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 11:03:16.183661 0.261154 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.445206 0.170847 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.616531 0.183422 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.800423 0.077562 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.800792 2.997645 tcp 10.0.2.105 58402 -> 108.236.234.31 9417 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 11:03:16.878347 0.056274 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.935035 0.044703 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:16.980131 0.138010 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.118523 0.040258 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.159199 0.086842 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.246480 0.076691 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.323632 0.061627 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.385679 0.225734 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.611845 0.173506 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.785783 0.175359 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:17.961586 0.216420 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.178462 0.114437 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.293387 0.148599 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.442412 0.071962 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.514857 0.078685 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.594016 0.325144 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:18.919571 0.218358 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:19.138348 0.142910 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:19.281623 0.205398 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:19.487466 0.150484 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:19.638318 0.191023 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:19.829772 0.181771 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:20.011999 0.073761 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:20.086165 0.296906 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:20.383514 0.144754 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:20.528693 0.070171 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:20.599325 0.489048 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:21.088769 0.087204 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:03:25.806861 0.000000 tcp 10.0.2.105 58402 -> 108.236.234.31 9417 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 11:07:46.274571 3.001907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:07:53.281911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:08:01.283574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:08:17.286351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:08:49.292115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:14:53.298312 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:15:00.305391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:15:08.306974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:15:24.309944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:15:56.316066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:22:01.323817 3.001275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:22:08.341279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:22:16.342533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:22:32.345555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:23:04.351595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:24:42.353275 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 11:24:42.353402 0.989042 tcp 10.0.2.105 58403 -> 128.255.183.224 9027 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:29:08.357372 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:29:15.365064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:29:23.366362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:29:39.369646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:30:11.375341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:33:26.045817 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 11:33:26.045968 0.180540 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.227024 0.075558 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.227495 3.002018 tcp 10.0.2.105 58404 -> 108.236.234.31 9417 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 11:33:26.302938 0.060069 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.363497 0.246912 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.610820 0.176994 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.788397 0.038717 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.827521 0.137749 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:26.965699 0.040802 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.006979 0.083375 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.090846 0.074642 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.165901 0.075972 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.242263 0.232689 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.475367 0.173322 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.649056 0.179680 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:27.829138 0.212081 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.041598 0.069595 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.111569 0.142420 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.254441 0.074112 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.328958 0.058521 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.387910 0.139694 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.528073 0.200662 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:28.729129 0.360058 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.089603 0.139294 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.229335 0.138480 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.368405 0.193793 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.562619 0.179158 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.742150 0.071400 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:29.813976 0.294184 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:30.108615 0.000000 udp 10.0.2.105 7010 -> 190.205.193.197 7746 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 11:33:35.228169 0.000000 tcp 10.0.2.105 58404 -> 108.236.234.31 9417 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 11:33:46.436298 0.068135 tcp 10.0.2.105 58405 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:33:46.504700 0.053881 tcp 10.0.2.105 58406 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:33:46.558842 0.132596 tcp 10.0.2.105 58407 -> 195.113.214.236 443 SRPA* 0 0 55 51825 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:33:46.692169 0.084822 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:46.777412 0.144032 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:33:46.921935 0.067387 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 11:36:15.381619 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:36:22.388539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:36:30.390697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:36:46.393522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:37:18.399380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:43:22.406993 3.000442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:43:29.412680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:43:37.414493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:43:53.417461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:44:25.423352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:54:11.438202 3.002683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 11:54:18.446349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:54:26.447547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:54:42.450683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 11:54:43.342532 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 11:54:43.342736 0.917080 tcp 10.0.2.105 58408 -> 128.255.183.224 9027 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/01/29 11:55:14.456587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:01:18.463048 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:01:25.469912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:01:33.471629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:01:49.474740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:02:21.480808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:03:49.648106 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 12:03:49.648426 0.262920 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:03:49.911927 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 12:03:49.912565 2.999244 tcp 10.0.2.105 58409 -> 190.205.193.197 4858 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 12:03:58.910415 0.000000 tcp 10.0.2.105 58409 -> 190.205.193.197 4858 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 12:04:08.676487 0.066673 tcp 10.0.2.105 58410 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:08.743472 0.052755 tcp 10.0.2.105 58411 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:08.796524 0.144967 tcp 10.0.2.105 58412 -> 195.113.214.236 443 SRPA* 0 0 42 22886 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:08.942179 0.078341 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:09.020907 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 12:04:24.116855 0.066239 tcp 10.0.2.105 58413 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:24.183349 0.052340 tcp 10.0.2.105 58414 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:24.235912 0.163575 tcp 10.0.2.105 58415 -> 195.113.214.236 443 SRPA* 0 0 41 22428 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:24.400026 1.097059 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.497505 0.044020 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 197 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.542035 0.130984 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.542375 3.000875 tcp 10.0.2.105 58416 -> 86.89.2.116 5541 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 12:04:25.673462 0.040061 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.714032 0.081015 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.795512 0.059023 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.854978 0.064660 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.920241 0.079282 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:25.999888 0.180067 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:26.180393 0.387390 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:26.568145 0.063603 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:26.632191 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 12:04:34.541787 0.000000 tcp 10.0.2.105 58416 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/29 12:04:45.548248 0.066355 tcp 10.0.2.105 58417 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:45.614873 0.052992 tcp 10.0.2.105 58418 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:45.668182 0.156339 tcp 10.0.2.105 58419 -> 195.113.214.236 443 SRPA* 0 0 40 22584 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:45.825098 0.176613 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:46.002171 0.239029 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:46.241617 0.142271 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:46.384441 0.818687 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.203621 0.330823 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.534840 0.148742 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.684003 0.044547 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.729084 0.059820 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.729460 4.929733 tcp 10.0.2.105 58420 -> 95.89.168.173 2431 SPA_* 0 0 1180 663620 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:04:47.789254 0.176661 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:47.966319 0.071660 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.038461 0.298231 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.337028 0.144317 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.481722 0.205622 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.687779 0.066485 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.754629 0.086687 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:48.841789 0.143786 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:04:52.937687 0.045854 tcp 10.0.2.105 58420 -> 95.89.168.173 2431 FPA_* 0 0 6 328 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:08:25.485977 3.002004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 12:08:32.493895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:08:40.495586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:08:56.498692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:09:28.504634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:15:36.516431 3.001382 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:15:43.523579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:15:51.525417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:16:07.528557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:16:39.534268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:22:43.540730 3.001003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:22:50.547704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:22:58.549395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:23:14.552149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:23:46.558046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:24:44.261739 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 12:24:44.261894 1.080426 tcp 10.0.2.105 58421 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:29:50.564972 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:29:57.571950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:30:05.573156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:30:21.576331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:30:53.582388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:35:14.948309 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 12:35:14.948431 0.180854 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:15.129714 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 12:35:32.154717 0.066287 tcp 10.0.2.105 58422 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:32.221395 0.052223 tcp 10.0.2.105 58423 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:32.273908 0.145579 tcp 10.0.2.105 58424 -> 195.113.214.236 443 SRPA* 0 0 40 31912 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:32.420173 0.145134 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:32.565704 0.000000 udp 10.0.2.105 7010 -> 190.205.193.197 7746 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 12:35:47.725847 0.065952 tcp 10.0.2.105 58425 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:47.792141 0.052613 tcp 10.0.2.105 58426 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:47.845016 0.159036 tcp 10.0.2.105 58427 -> 195.113.214.236 443 SRPA* 0 0 45 40354 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:35:48.004754 0.078534 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.083669 0.144884 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.228949 0.040769 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.270143 0.044741 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.315340 0.172851 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.488596 0.056119 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.545087 0.065157 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.610617 0.077980 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:48.689270 0.444786 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.134457 0.081351 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.216171 0.212186 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.428756 0.062959 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.492099 0.175681 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.668216 0.260952 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:49.929584 0.142796 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:50.072769 0.144134 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:50.217346 0.349928 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:50.567705 0.059685 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:50.627833 0.211287 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:50.839588 0.341690 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:51.181625 0.179807 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:51.361843 0.069739 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:51.432034 0.294590 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:51.727122 0.149276 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:51.876846 0.222649 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:52.099920 0.070586 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:52.170980 0.074874 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:35:52.246277 0.144100 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/29 12:36:57.588946 3.000738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 12:37:04.595741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:37:12.597104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:37:28.600516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:38:00.606185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:44:04.612067 3.022638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:44:11.629677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:44:19.631050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:44:35.634139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:45:07.640297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:54:33.646009 3.002698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 12:54:40.653784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:54:45.341305 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 12:54:45.341444 0.933769 tcp 10.0.2.105 58428 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/29 12:54:48.655573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:55:04.658283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 12:55:36.664561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:01:40.670531 3.002486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:01:47.678140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:01:55.680478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:02:11.682456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:02:43.688638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:06:01.463474 1.640150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 13:06:03.103798 0.245970 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:03.350183 0.179931 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:03.530519 0.142832 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:03.673804 0.080945 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:03.755168 0.138054 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:03.893679 0.162251 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.056354 0.044211 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.100972 0.064354 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.165694 0.077219 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.243351 0.457586 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.701334 0.079633 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.781399 0.174456 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:04.956318 0.059529 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:05.016259 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 13:06:20.123734 0.066791 tcp 10.0.2.105 58429 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:06:20.190760 0.052828 tcp 10.0.2.105 58430 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:06:20.243446 0.150207 tcp 10.0.2.105 58431 -> 195.113.214.236 443 SRPA* 0 0 39 30340 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:06:20.394419 0.064620 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:20.459714 0.175249 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:20.635333 0.231352 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:20.867112 0.143196 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:21.010911 0.198671 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:21.210071 0.412739 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:21.623273 0.344184 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:21.967975 0.121266 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.089653 0.061460 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.151493 0.182623 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.334544 0.073488 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.408582 0.294050 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.703052 0.136884 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:22.840479 0.231036 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:23.071997 0.066980 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:23.139390 0.075359 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:06:23.215160 0.150333 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:08:47.695827 3.000477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:08:54.701978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:09:02.703395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:09:18.706724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:09:50.712729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:15:54.719641 3.000307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:16:01.725762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:16:09.727497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:16:25.730226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:16:57.736516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:23:01.743455 3.000367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:23:08.749675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:23:16.751407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:23:32.754507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:24:04.760779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:24:46.280970 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 13:24:46.281074 0.940542 tcp 10.0.2.105 58432 -> 128.255.183.224 9027 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:30:08.766593 3.004183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:30:15.773732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:30:23.775033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:30:39.778211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:31:11.784137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:36:24.684269 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 13:36:24.684430 0.220513 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:24.905331 0.151679 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:25.057467 0.232863 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:25.290755 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 13:36:40.428729 0.066830 tcp 10.0.2.105 58433 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:36:40.495808 0.053285 tcp 10.0.2.105 58434 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:36:40.549431 0.156204 tcp 10.0.2.105 58435 -> 195.113.214.236 443 SRPA* 0 0 70 52584 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:36:40.703549 0.077792 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:40.781712 0.045883 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:40.853273 0.060248 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:40.914028 0.084084 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:40.998461 0.440789 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.439637 0.040035 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.480107 0.145066 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.625574 0.081741 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.707724 0.167439 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.875508 0.059281 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:41.935212 0.066697 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.002325 0.177867 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.180565 0.268587 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.449556 0.142955 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.592965 0.145551 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.738915 0.065621 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.804975 0.062748 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:42.868104 0.183091 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:43.051678 0.073075 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:43.125192 0.198991 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:43.324802 0.333226 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:43.658439 0.296436 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:43.955269 0.147038 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:44.102714 0.193648 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:44.296764 0.069337 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:44.366528 0.072426 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:36:44.439319 0.144107 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/01/29 13:37:15.789570 3.002489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:37:22.797575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:37:30.799087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:37:46.802607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:38:18.808453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:44:22.814615 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:44:29.821856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:44:37.823297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:44:53.826072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:45:25.832352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:54:42.846476 3.001037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 13:54:47.220161 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 13:54:47.220325 0.912749 tcp 10.0.2.105 58436 -> 128.255.183.224 9027 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/01/29 13:54:49.853132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:54:57.854802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:55:13.857939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 13:55:45.863915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:01:49.869179 3.002403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:01:56.877033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:02:04.878433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:02:20.881754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:02:52.887649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:07:08.896170 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 14:07:08.896469 0.179750 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.076726 0.141011 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.218150 0.215533 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.434089 0.215943 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.650516 0.061599 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.712665 0.079082 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.792117 0.073863 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.866407 0.045769 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:09.912618 0.426310 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.339311 0.039513 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.379228 0.144793 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.524494 0.078169 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.603083 0.177409 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.780936 0.058028 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.839292 0.068401 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:10.908118 0.177445 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.085932 0.202070 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.288423 0.045603 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.334488 0.059344 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.394243 0.177427 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.572120 0.071814 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.644545 0.249873 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:11.894830 0.144020 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:12.039287 0.197368 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:12.237063 0.332840 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:12.570326 0.298331 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:12.869037 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 14:07:28.605601 0.061502 tcp 10.0.2.105 58437 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:07:28.667447 0.053240 tcp 10.0.2.105 58438 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:07:28.721036 0.145166 tcp 10.0.2.105 58439 -> 195.113.214.236 443 SRPA* 0 0 32 17642 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:07:28.866507 0.222456 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:29.089337 0.141358 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:29.231088 0.070677 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:07:29.302235 0.074535 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:08:56.893361 3.001780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:09:03.901115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:09:11.902535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:09:27.905850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:09:59.911543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:16:03.917540 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:16:10.925326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:16:18.925949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:16:34.929047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:17:06.935739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:23:10.941601 3.060164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:23:17.980862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:23:25.960498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:23:41.963639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:24:13.968971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:24:48.139077 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 14:24:48.139280 1.070204 tcp 10.0.2.105 58440 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:30:17.976303 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:30:24.983493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:30:32.984365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:30:48.987330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:31:20.993612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:37:24.999558 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:37:32.007169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:37:40.008541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:37:53.308049 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 14:37:53.308156 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 14:37:56.011665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:38:10.914798 0.063526 tcp 10.0.2.105 58441 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:38:10.978995 0.051793 tcp 10.0.2.105 58442 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:38:11.031100 0.148969 tcp 10.0.2.105 58443 -> 195.113.214.236 443 SRPA* 0 0 39 33056 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:38:11.180946 0.179597 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.361041 0.244553 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.605972 0.059548 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.665871 0.080163 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.746462 0.071806 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.818766 0.038232 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.857402 0.139006 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:11.996774 0.217230 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.214364 0.081990 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.296761 0.137909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.435083 0.082888 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.518371 0.182634 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.701497 0.058530 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.760584 0.063441 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.824455 0.174085 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:12.998924 0.415308 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:13.414669 0.060279 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:13.475395 0.173539 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:13.649314 0.071063 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:13.720852 0.230860 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:13.952148 0.144427 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:14.096948 0.370161 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:14.467483 0.044065 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:14.512016 0.294864 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:14.807368 0.325916 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:15.133688 0.211703 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:15.345820 0.203911 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:15.550204 0.073091 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:15.623679 0.162874 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:15.786995 0.069637 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/29 14:38:28.017572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:44:32.023085 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:44:39.030788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:44:47.032556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:45:03.035158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:45:35.041538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:54:43.051504 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 14:54:49.208811 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 14:54:49.208910 0.963997 tcp 10.0.2.105 58444 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/29 14:54:50.059073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:54:58.060782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:55:14.063989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 14:55:46.070226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:01:50.076136 3.001461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:01:57.083394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:02:05.085065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:02:21.088103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:02:53.094059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:08:36.097497 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 15:08:36.097622 0.055222 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.153235 0.076395 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.230097 0.075921 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.306450 0.044064 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.350894 0.143935 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.495218 0.180718 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.676583 0.268143 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:36.945139 0.218078 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.163670 0.039937 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.204076 0.145071 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.349575 0.077304 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.427314 0.178604 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.606356 0.055532 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.662273 0.063595 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.726363 0.179375 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:37.906183 0.368266 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.274851 0.059663 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.334954 0.178213 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.513667 0.072516 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.586690 0.259283 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.846608 0.144170 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:38.991239 0.298018 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:39.289638 0.263066 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:39.553152 0.045197 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:39.598788 0.326333 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:39.925559 0.215067 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:40.141101 0.259295 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:40.400790 0.073940 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:40.475170 0.148356 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:08:40.623870 0.076373 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:09:00.103878 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:09:07.111991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:09:15.113164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:09:31.116221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:10:03.122222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:16:07.128595 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:16:14.135677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:16:22.137084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:16:38.140392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:17:10.146334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:23:14.152966 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:23:21.159649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:23:29.163939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:23:45.164193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:24:17.170016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:24:50.178310 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 15:24:50.178469 1.098211 tcp 10.0.2.105 58445 -> 128.255.183.224 9027 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/01/29 15:30:21.176171 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:30:28.183707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:30:36.184908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:30:52.188082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:31:24.194128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:37:28.200904 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:37:35.207405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:37:43.209095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:37:59.212521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:38:31.217976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:38:57.556543 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 15:38:57.556757 0.085569 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:57.642707 0.044008 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:57.687110 0.144524 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:57.832088 0.181143 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.013617 0.234851 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.248862 0.079621 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.328906 0.092911 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.422197 0.225281 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.647896 0.047169 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.695502 0.145095 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.840980 0.092228 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:58.933586 0.168529 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.102525 0.075596 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.178449 0.077166 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.255982 0.174499 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.430885 0.408580 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.839881 0.075643 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:38:59.915990 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 15:39:15.954644 0.067234 tcp 10.0.2.105 58446 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 15:39:16.022196 0.053697 tcp 10.0.2.105 58447 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 15:39:16.076228 0.145462 tcp 10.0.2.105 58448 -> 195.113.214.236 443 SRPA* 0 0 31 24174 flow=From-Botnet-V2-TCP-Established 1970/01/29 15:39:16.222243 0.083568 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:16.306235 0.241452 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:16.548080 0.143084 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:16.691593 0.044785 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:16.736794 0.330474 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.067723 0.296492 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.364693 0.146993 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.512115 0.202079 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.714584 0.191006 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.906006 0.073986 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:17.980555 0.147115 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:39:18.128066 0.081558 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/29 15:44:35.223950 3.011875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:44:42.241748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:44:50.243237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:45:06.246118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:45:38.252600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:54:46.262584 3.001973 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 15:54:51.279205 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 15:54:51.279373 0.961941 tcp 10.0.2.105 58449 -> 128.255.183.224 9027 FSPA* 0 0 14 1742 flow=From-Botnet-V2-TCP-Established 1970/01/29 15:54:53.270592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:55:01.272405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:55:17.275401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 15:55:49.280890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:01:53.286588 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:02:00.293824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:02:08.295700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:02:24.298800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:02:56.304660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:09:03.314768 3.001757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:09:10.322640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:09:18.323656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:09:34.327059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:09:35.719310 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 16:09:35.719419 0.178627 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:35.898484 0.140949 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.039820 0.180320 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.220715 0.075942 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.297102 0.045539 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.343095 0.061770 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.405377 0.078132 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.483931 0.219508 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.703822 0.039923 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.744196 0.234826 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:36.979412 0.082182 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:37.061958 0.176961 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:37.239374 0.145068 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:37.384805 0.179271 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:37.564622 0.446737 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.011779 0.059701 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.071952 0.060966 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.133349 0.058687 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.192535 0.141237 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.334307 0.044736 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.379501 0.335987 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.715989 0.072453 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:38.788913 0.233432 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.022734 0.293201 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.316456 0.143971 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.460838 0.215617 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.676857 0.202361 udp 10.0.2.105 7010 <-> 166.239.50.28 1930 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.879675 0.087030 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:39.967144 0.145549 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:09:40.113099 0.070100 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:10:06.332869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:16:10.339447 3.000814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:16:17.346505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:16:25.347704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:16:41.350980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:17:13.357110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:23:17.363058 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:23:24.370668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:23:32.371756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:23:48.375086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:24:20.380981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:24:52.247131 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 16:24:52.247281 1.084833 tcp 10.0.2.105 58450 -> 128.255.183.224 9027 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:30:24.387290 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:30:31.394309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:30:39.395781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:30:55.398709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:31:27.405035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:37:31.410640 3.002011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:37:38.418249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:37:46.419732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:38:02.422816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:38:34.428966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:39:54.824476 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 16:39:54.824639 0.179852 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.004850 0.142189 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.147440 0.181373 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.329227 0.091660 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.421363 0.040425 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.462170 0.077278 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.539843 0.093626 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.633855 0.206915 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.841221 0.047300 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:55.888975 0.222856 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.112220 0.086358 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.198941 0.177223 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.376632 0.137953 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.515015 0.174963 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.690361 0.176215 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.867012 0.075345 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:56.942754 0.143881 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.087124 0.042537 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.130131 0.369844 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.500371 0.085692 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.586562 0.233358 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.820508 0.079277 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.900167 0.077879 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:39:57.978412 0.000000 udp 10.0.2.105 7010 -> 210.117.186.140 8912 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 16:40:14.545110 0.064845 tcp 10.0.2.105 58451 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:14.610319 0.052894 tcp 10.0.2.105 58452 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:14.663526 0.149984 tcp 10.0.2.105 58453 -> 195.113.214.236 443 SRPA* 0 0 35 18856 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:14.814215 0.144362 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:40:14.959031 0.204304 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:40:15.163726 0.000000 udp 10.0.2.105 7010 -> 166.239.50.28 1930 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 16:40:30.416235 0.066553 tcp 10.0.2.105 58454 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:30.483061 0.052527 tcp 10.0.2.105 58455 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:30.535891 0.148991 tcp 10.0.2.105 58456 -> 195.113.214.236 443 SRPA* 0 0 21 11346 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:40:30.685386 0.073928 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:40:30.759798 0.147260 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:40:30.907451 0.082370 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/29 16:44:38.435143 3.001383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 16:44:45.442031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:44:53.443469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:45:09.446837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:45:41.452743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:54:48.462617 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 16:54:53.336520 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 16:54:53.336751 0.956034 tcp 10.0.2.105 58457 -> 128.255.183.224 9027 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/01/29 16:54:55.469547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:55:03.471416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:55:19.473793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 16:55:51.479961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:01:55.486178 3.001264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:02:02.493208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:02:10.494809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:02:26.497655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:02:58.503645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:09:05.515367 3.000508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:09:12.521479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:09:20.523227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:09:36.526144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:10:08.532643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:10:52.545813 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 17:10:52.545933 0.320611 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:10:52.866980 0.000000 udp 10.0.2.105 7010 -> 166.239.50.28 1930 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 17:11:08.290047 0.062189 tcp 10.0.2.105 58458 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:08.352544 0.053409 tcp 10.0.2.105 58459 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:08.406305 0.147002 tcp 10.0.2.105 58460 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:08.553971 0.175370 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:08.729773 0.073979 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:08.804214 0.039477 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:08.844190 0.060272 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:08.904846 0.076811 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:08.982126 0.215430 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.197942 0.040150 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.238497 0.181944 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.420866 0.143858 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.565194 0.225822 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.791469 0.170891 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:09.962824 0.180208 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.143451 0.059204 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.203116 0.150667 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.354211 0.091192 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.445858 0.180397 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.626771 0.144771 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:10.771924 0.252819 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:11.025240 0.146998 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:11.172653 0.062660 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:11.235694 0.326870 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:11.563075 0.000000 udp 10.0.2.105 7010 -> 95.89.168.173 6418 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 17:11:28.637809 0.064005 tcp 10.0.2.105 58461 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:28.702132 0.054549 tcp 10.0.2.105 58462 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:28.757054 0.147475 tcp 10.0.2.105 58463 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:11:28.905039 0.070262 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:28.975782 0.253255 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:29.229401 0.203759 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:29.433645 0.069984 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:29.504081 0.086169 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:11:29.590614 0.152484 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:16:12.538902 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 17:16:19.545457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:16:27.547209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:16:43.549804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:17:15.555995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:23:19.562823 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:23:26.569517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:23:34.571205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:23:50.574059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:24:22.580063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:24:54.296321 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 17:24:54.296438 1.419941 tcp 10.0.2.105 58464 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:30:26.596551 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:30:33.603643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:30:41.605163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:30:57.608216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:31:29.613636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:37:33.620124 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:37:40.627276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:37:48.629014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:38:04.631850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:38:36.637957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:41:30.869125 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 17:41:30.869311 0.044076 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:30.913790 0.340213 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.254398 0.078873 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.333720 0.046515 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.380667 0.060896 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.442258 0.073194 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.515906 0.176056 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.692453 0.143755 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:31.836714 0.210922 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.048086 0.039282 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.087846 0.170940 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.259210 0.221404 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.481043 0.180333 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.661810 0.143426 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.805610 0.085853 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:32.891850 0.170357 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:33.062638 0.123943 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:33.187028 0.216889 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:33.404369 0.059612 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:33.464455 0.176421 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:33.641292 0.000000 udp 10.0.2.105 7010 -> 86.159.25.36 2112 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 17:41:52.050548 0.065662 tcp 10.0.2.105 58465 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:41:52.116637 0.056229 tcp 10.0.2.105 58466 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:41:52.173164 0.107204 tcp 10.0.2.105 58467 -> 195.113.214.236 443 SRPA* 0 0 32 23189 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:41:52.280887 0.061217 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:52.342543 0.349357 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:52.692342 0.071721 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:52.764538 0.148159 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:52.913087 0.566544 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:53.480052 0.066260 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:53.546741 0.073122 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:41:53.620410 0.148496 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/29 17:44:40.644058 3.001776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:44:47.651577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:44:55.652896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:45:11.655958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:45:43.661813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:51:47.668043 3.001854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:51:54.675659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:52:02.677558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:52:18.680020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:52:50.685851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:54:55.716200 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 17:54:55.716373 0.914855 tcp 10.0.2.105 58468 -> 128.255.183.224 9027 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/01/29 17:58:54.692193 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 17:59:01.699223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:59:09.701037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:59:25.703608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 17:59:57.710163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:06:10.719752 3.000821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:06:17.726581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:06:25.727611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:06:41.730577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:07:13.736940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:12:10.303187 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 18:12:10.303295 0.000000 udp 10.0.2.105 7010 -> 86.159.25.36 2112 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 18:12:28.121098 0.061272 tcp 10.0.2.105 58469 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 18:12:28.182712 0.031682 tcp 10.0.2.105 58470 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 18:12:28.214692 0.128011 tcp 10.0.2.105 58471 -> 195.113.214.236 443 SRPA* 0 0 53 50039 flow=From-Botnet-V2-TCP-Established 1970/01/29 18:12:28.343698 0.047317 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.391476 0.097342 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.489349 0.046036 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.535892 0.060430 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.596791 0.075206 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.672516 0.181882 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.854899 0.143420 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:28.998809 0.331317 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.330574 0.041722 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.372759 0.211715 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.584988 0.182026 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.767506 0.142990 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.910900 0.084833 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:29.996141 0.174522 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:30.171118 0.217615 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:30.389140 0.179412 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:30.568950 0.179571 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:30.748923 0.137952 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:30.887283 0.249184 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.136934 0.058716 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.196074 0.059252 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.255705 0.321584 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.577824 0.074354 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.652571 0.140826 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.793871 0.074523 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:31.868806 0.145770 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:32.014936 0.443238 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:12:32.458611 0.067199 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:13:17.744669 3.002583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:13:24.753903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:13:32.751479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:13:48.754727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:14:20.761722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:20:24.767154 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:20:31.773918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:20:39.777159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:20:55.778395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:21:27.784811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:24:56.635270 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 18:24:56.635460 0.989410 tcp 10.0.2.105 58472 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/29 18:27:31.790361 3.002296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:27:38.798009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:27:46.799239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:28:02.802462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:28:34.808569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:34:38.814500 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:34:45.821991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:34:53.823162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:35:09.826559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:35:41.832690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:41:45.838729 3.031173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:41:52.856037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:42:00.857580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:42:16.860539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:42:43.619303 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 18:42:43.619444 0.043571 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:43.663420 0.074133 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:43.737960 0.045533 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:43.783874 0.059639 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:43.843904 0.133970 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:43.978291 0.178099 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.156872 0.145301 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.302731 0.202855 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.505989 0.180420 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.686839 0.143135 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.830408 0.094678 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:44.925540 0.329637 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:45.255587 0.041181 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:45.297221 0.170335 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:45.468008 0.215903 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:45.684353 0.206437 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:45.891199 0.178590 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.070290 0.145153 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.215847 0.238845 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.455087 0.060112 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.515721 0.071679 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.587863 0.325586 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.913863 0.073313 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:46.987641 0.417504 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:47.405601 0.085474 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:47.491505 0.145363 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:47.637305 0.198039 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:47.835796 0.067175 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/29 18:42:48.876267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:53:23.882049 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 18:53:30.889762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:53:38.891600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:53:54.894376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:54:26.900124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 18:54:57.624849 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 18:54:57.625067 0.887558 tcp 10.0.2.105 58473 -> 128.255.183.224 9027 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:00:30.906055 3.001821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:00:37.913477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:00:45.915048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:01:01.918132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:01:33.924102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:07:37.930252 3.001610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:07:44.937712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:07:52.938502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:08:08.941444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:08:40.948112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:12:53.481694 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 19:12:53.481815 0.043852 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.526145 0.070387 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.597026 0.045038 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.642485 0.064920 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.707919 0.085994 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.794311 0.179512 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:53.974276 0.188192 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:54.162866 0.138349 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:54.301616 0.094459 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:54.396471 0.145373 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:54.542261 0.217695 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:54.760612 0.339279 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.100355 0.039981 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.140717 0.153306 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.294413 0.214237 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.509042 0.177429 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.686989 0.180126 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.867562 0.130909 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:55.998921 0.245130 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.244532 0.058625 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.303646 0.072906 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.376930 0.332085 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.709463 0.072488 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.782323 0.146030 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:56.928732 0.205298 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:57.134467 0.068459 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:57.203370 0.441875 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:12:57.645691 0.073865 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:14:44.954102 3.001963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:14:51.961659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:14:59.963042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:15:15.966128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:15:47.971941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:21:51.978970 3.000638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:21:58.985652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:22:06.987120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:22:22.990047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:22:54.995996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:24:58.513948 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 19:24:58.514043 0.974873 tcp 10.0.2.105 58474 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:28:59.002860 3.010687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:29:06.019444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:29:14.021062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:29:30.023764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:30:02.030073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:36:06.035758 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:36:13.043431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:36:21.044916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:36:37.048161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:37:09.053934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:43:13.061115 3.000726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:43:16.392449 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 19:43:16.392665 0.047731 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.440841 0.061395 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.502646 0.077083 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.580181 0.176832 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.757450 0.045664 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.803524 0.076995 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:16.880907 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 19:43:20.067546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:43:28.068968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:43:34.349833 0.064260 tcp 10.0.2.105 58475 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:43:34.414365 0.051833 tcp 10.0.2.105 58476 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:43:34.466473 0.141565 tcp 10.0.2.105 58477 -> 195.113.214.236 443 SRPA* 0 0 39 31858 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:43:34.608711 0.141923 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:34.751065 0.085692 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:34.837221 0.158660 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:34.996557 0.207405 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:35.204351 0.307337 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:35.512059 0.040502 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:35.552961 0.160640 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:35.714077 0.214541 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:35.929062 0.179061 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.108573 0.177449 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.286450 0.137688 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.424700 0.244400 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.669562 0.062070 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.732041 0.073563 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:36.806052 0.316547 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.123030 0.070870 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.194294 0.146115 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.340891 0.206002 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.547318 0.074739 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.622455 0.067867 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:37.690692 0.143272 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/29 19:43:44.071967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:44:16.077512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:54:08.091912 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 19:54:15.099020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:54:23.100372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:54:39.103611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 19:54:59.493545 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 19:54:59.493707 0.892541 tcp 10.0.2.105 58478 -> 128.255.183.224 9027 FSPA* 0 0 14 1681 flow=From-Botnet-V2-TCP-Established 1970/01/29 19:55:11.110144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:01:15.115748 3.001934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:01:22.123405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:01:30.124873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:01:46.127616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:02:18.133673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:08:22.139827 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:08:29.147054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:08:37.149567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:08:53.151806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:09:25.157715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:14:02.667403 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 20:14:02.667566 0.181592 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:02.849582 0.075950 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:02.925932 0.183940 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.110323 0.051749 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.162606 0.076425 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.239440 0.067317 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.307177 0.040041 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.347689 0.144619 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.492714 0.143489 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.636607 0.080447 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.717465 0.211768 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:03.929729 0.340887 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:04.271034 0.039966 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:04.311449 0.158263 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:04.470096 0.214317 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:04.684855 0.170648 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:04.855908 0.238758 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.095041 0.059721 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.155153 0.074099 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.229704 0.323148 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.553254 0.179455 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.733050 0.144795 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.878256 0.074883 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:05.953586 0.143972 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:06.098009 0.199406 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:06.297854 0.074688 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:06.372957 0.070810 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:14:06.444132 0.145750 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:15:29.163110 3.002236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:15:36.171332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:15:44.172586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:16:00.175750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:16:32.181832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:22:36.188070 3.001103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:22:43.195217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:22:51.196658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:23:07.199712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:23:39.205856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:25:00.392753 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 20:25:00.392987 1.056322 tcp 10.0.2.105 58479 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:29:43.212484 3.000910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:29:50.219167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:29:58.220274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:30:14.223394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:30:46.229624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:36:50.236416 3.000746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:36:57.242926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:37:05.244501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:37:21.247676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:37:53.253390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:43:57.259871 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:44:04.267897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:44:12.269142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:44:28.272264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:44:31.846921 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 20:44:31.847021 0.184455 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:32.031940 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 20:44:47.495169 0.044752 tcp 10.0.2.105 58480 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:44:47.540235 0.031108 tcp 10.0.2.105 58481 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:44:47.571740 0.150713 tcp 10.0.2.105 58482 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:44:47.723086 0.076134 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:47.799618 0.045777 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:47.845814 0.075625 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:47.921862 0.064704 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:47.987018 0.040973 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.028556 0.141758 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.170767 0.143104 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.314293 0.084128 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.398809 0.206098 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.605379 0.360551 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:48.966342 0.039730 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:44:49.006453 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 20:45:00.277692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:45:06.046037 0.043279 tcp 10.0.2.105 58483 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:45:06.089555 0.055491 tcp 10.0.2.105 58484 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:45:06.145324 0.148869 tcp 10.0.2.105 58485 -> 195.113.214.236 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:45:06.294430 0.213999 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:06.508832 0.193491 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:06.702709 0.564496 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:07.268196 0.059743 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:07.328435 0.078016 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:07.406893 0.326613 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:07.733886 0.173296 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:07.907564 0.130748 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.038712 0.075174 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.114312 0.145373 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.260106 0.070296 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.330835 0.146088 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.477392 0.205346 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:45:08.683090 0.074813 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/29 20:54:26.283838 3.011738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 20:54:33.301355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:54:41.302916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:54:57.306537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 20:55:01.452493 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 20:55:01.452705 0.957211 tcp 10.0.2.105 58486 -> 128.255.183.224 9027 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/01/29 20:55:29.311927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:01:33.318044 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:01:40.325662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:01:48.327045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:02:04.330054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:02:36.336109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:08:40.342281 3.001371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:08:47.349316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:08:55.350843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:09:11.353815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:09:43.359925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:15:24.801189 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 21:15:24.801355 0.183205 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:24.984965 0.177394 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.162771 0.181738 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.344984 0.081614 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.427061 0.061669 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.489118 0.044885 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.534388 0.075395 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.610180 0.044640 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.655221 0.077965 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.733583 0.214325 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:25.948581 0.317489 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.266502 0.040124 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.307052 0.142992 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.450457 0.143271 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.594147 0.216174 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.810739 0.177342 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:26.988704 0.228399 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:27.217508 0.061913 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:27.279860 0.070623 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:27.350869 0.395359 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:27.746624 0.181140 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:27.928179 0.131214 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.059833 0.070497 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.130686 0.146738 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.277829 0.254984 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.533233 0.086775 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.685535 0.144784 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:28.830711 0.069433 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:15:47.367226 3.000296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:15:54.373156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:16:02.374707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:16:18.378011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:16:50.383819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:22:54.390519 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:23:01.397344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:23:09.398700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:23:25.401889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:23:57.407884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:25:02.411735 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 21:25:02.411935 4.934481 tcp 10.0.2.105 58487 -> 128.255.183.224 9027 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/01/29 21:30:01.414793 3.000728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:30:08.421324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:30:16.422675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:30:32.425784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:31:04.431853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:37:08.438782 3.000672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:37:15.445175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:37:23.446759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:37:39.449711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:38:11.455560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:44:15.461869 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:44:22.469281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:44:30.470714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:44:46.473535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:45:18.479602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:45:38.759492 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 21:45:38.759682 0.181400 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:38.941511 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 21:45:56.386203 0.066934 tcp 10.0.2.105 58488 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 21:45:56.453447 0.054140 tcp 10.0.2.105 58489 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 21:45:56.507911 0.153027 tcp 10.0.2.105 58490 -> 195.113.214.236 443 SRPA* 0 0 40 34548 flow=From-Botnet-V2-TCP-Established 1970/01/29 21:45:56.661643 0.244985 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:56.907048 0.078649 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:56.986099 0.059176 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.045723 0.046077 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.092238 0.080336 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.173078 0.046806 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.220798 0.072716 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.294063 0.207167 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.501648 0.332986 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.835020 0.040081 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:57.875516 0.143977 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.019954 0.143178 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.163588 0.216056 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.380125 0.174511 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.555071 0.265847 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.821325 0.060401 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.882178 0.072283 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:58.954833 0.354445 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.309672 0.177891 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.487989 0.145012 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.633423 0.074151 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.707992 0.085414 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.793841 0.148550 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:45:59.942821 0.067847 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:46:00.011062 0.142506 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:46:00.154371 0.208003 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 21:54:36.494984 3.001886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 21:54:43.502217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:54:51.503684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:55:07.346751 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 21:55:07.346934 0.944643 tcp 10.0.2.105 58491 -> 128.255.183.224 9027 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/29 21:55:07.506728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 21:55:39.512764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:01:43.519053 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:01:50.526091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:01:58.527747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:02:14.531098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:02:46.536636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:08:50.543810 3.000293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:08:57.549923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:09:05.551346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:09:21.554617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:09:53.560693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:15:57.565914 3.002665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:16:04.573882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:16:09.241026 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 22:16:09.241187 0.185121 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:09.426718 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 22:16:12.575643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:16:26.867621 0.066919 tcp 10.0.2.105 58492 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 22:16:26.934780 0.052645 tcp 10.0.2.105 58493 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 22:16:26.987812 0.160980 tcp 10.0.2.105 58494 -> 195.113.214.236 443 SRPA* 0 0 44 28270 flow=From-Botnet-V2-TCP-Established 1970/01/29 22:16:27.149484 0.065412 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.215310 0.047153 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.262894 0.182324 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.445645 0.077224 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.523286 0.078220 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.601948 0.057691 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.660038 0.093448 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.753950 0.209445 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:27.963913 0.310700 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.275016 0.040131 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.315569 0.145062 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.461056 0.143382 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.578697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:16:28.604864 0.215068 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.820274 0.178557 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:28.999277 0.336935 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:29.336639 0.061631 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:29.398679 0.072589 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:29.471655 0.339045 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:29.811164 0.177871 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:29.989457 0.144967 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.134840 0.077019 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.212239 0.073675 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.286269 0.144915 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.431622 0.068724 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.500790 0.143428 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:16:30.644641 0.967194 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:17:00.584501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:23:04.590868 3.001328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:23:11.598091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:23:19.599849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:23:35.602500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:24:07.608476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:25:08.296412 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 22:25:08.296525 1.053751 tcp 10.0.2.105 58495 -> 128.255.183.224 9027 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/01/29 22:30:11.615478 3.027173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:30:18.631740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:30:26.633564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:30:42.636650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:31:14.642677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:37:18.649320 3.030459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:37:25.670645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:37:33.667403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:37:49.670552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:38:21.676610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:44:25.682987 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:44:32.690011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:44:40.691639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:44:56.695191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:45:28.700238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:46:39.172150 0.000251 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 22:46:39.172492 0.183318 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.356197 0.179439 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.536146 0.059489 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.596093 0.045814 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.642394 0.204011 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.846849 0.074987 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:39.922240 0.078342 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.000998 0.042454 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.043903 0.086367 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.130677 0.214758 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.345894 0.322988 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.669355 0.040444 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.710316 0.145094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.855767 0.143123 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:40.999261 0.215191 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:41.214972 0.177214 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:41.392758 0.070459 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:41.463740 0.400723 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:41.864877 0.174619 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.039966 0.131043 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.171391 0.235231 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.407106 0.063999 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.471500 0.072161 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.544078 0.080193 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.624738 0.147665 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.772854 0.074227 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.847471 0.144733 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:46:42.992621 0.207236 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/29 22:54:41.708321 3.001575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 22:54:48.715695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:54:56.717327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:55:09.355668 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 22:55:09.355849 0.970841 tcp 10.0.2.105 58496 -> 128.255.183.224 9027 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/01/29 22:55:12.720102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 22:55:44.726206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:01:48.732157 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:01:55.739893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:02:03.741196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:02:19.744201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:02:51.750209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:08:55.757006 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:09:02.763706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:09:10.764931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:09:26.768061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:09:58.774095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:16:03.201293 2.976367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:16:10.168045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:16:18.169487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:16:34.172874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:17:05.828218 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 23:17:05.828395 0.183061 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:06.011861 0.159827 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:06.172111 0.077297 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:06.178728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:17:06.249841 0.046042 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:06.296287 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:17:23.875402 0.067183 tcp 10.0.2.105 58497 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:23.942896 0.053272 tcp 10.0.2.105 58498 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:23.996448 0.161553 tcp 10.0.2.105 58499 -> 195.113.214.236 443 SRPA* 0 0 44 22780 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:24.158509 0.081532 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.240487 0.077886 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.318844 0.087057 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.406285 0.077494 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.484361 0.039861 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.524692 0.141970 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.667075 0.140166 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:24.807621 0.206568 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:25.014625 0.315725 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:25.330736 0.214860 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:25.546013 0.170189 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:25.716695 0.070537 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:25.787629 0.625074 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:26.413114 0.178673 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:26.592198 0.144965 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:26.737533 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:17:44.211970 0.051585 tcp 10.0.2.105 58500 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:44.263838 0.055345 tcp 10.0.2.105 58501 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:44.319042 0.152043 tcp 10.0.2.105 58502 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:17:44.471570 0.059770 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:44.531776 0.071947 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:44.604132 0.086497 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:44.691076 0.145536 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:44.837082 0.067406 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:44.904895 0.143487 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:45.048783 0.360109 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:17:47.315754 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:23:10.274623 3.001915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:23:17.282549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:23:25.283426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:23:41.286711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:24:13.292913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:25:10.455449 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 23:25:10.455602 1.097666 tcp 10.0.2.105 58503 -> 128.255.183.224 9027 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:30:17.298533 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:30:24.306153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:30:32.307645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:30:48.310673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:31:20.316635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:37:24.322648 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:37:31.329849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:37:39.331644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:37:55.334911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:38:27.340695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:44:31.445102 3.003566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/29 23:44:38.453924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:44:46.455655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:45:02.458631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:45:34.464768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:48:00.835614 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 23:48:00.835803 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:48:18.893650 0.066933 tcp 10.0.2.105 58504 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:48:18.960892 0.053590 tcp 10.0.2.105 58505 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:48:19.014802 0.154788 tcp 10.0.2.105 58506 -> 195.113.214.236 443 SRPA* 0 0 42 33854 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:48:19.170275 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:48:29.638160 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/01/29 23:48:29.638586 0.061289 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:29.700295 0.174154 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:29.874868 0.181359 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.056665 0.039964 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.097023 0.074785 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.172391 0.083740 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.256735 0.047286 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.304672 0.078700 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.383859 0.143198 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.527493 0.141969 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.669881 0.212136 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.882477 0.045045 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:30.927956 0.171410 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:31.099739 0.073157 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:31.173289 0.214504 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:31.388202 0.328681 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:31.717317 0.721354 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.439113 0.176481 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.616045 0.144561 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.761104 0.060291 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.821811 0.075814 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.898094 0.075579 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:32.974059 0.147727 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:33.261186 0.067734 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:33.329454 0.152369 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:48:33.482216 0.224162 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/29 23:54:45.479760 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/29 23:54:52.486861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:55:00.488721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:55:11.554840 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/29 23:55:11.555099 0.925046 tcp 10.0.2.105 58507 -> 128.255.183.224 9027 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/01/29 23:55:16.491419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/29 23:55:48.497457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:01:52.503597 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:01:59.511164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:02:07.512661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:02:23.515570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:02:55.521569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:09:00.528725 3.002310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:09:07.536325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:09:15.537716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:09:31.541114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:10:03.546853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:16:07.553474 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:16:14.560456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:16:22.561922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:16:38.564996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:17:10.570976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:18:58.867136 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 00:18:58.867266 3.250177 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.117958 0.061420 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.179848 0.171044 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.351302 0.183408 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.535105 0.046537 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.582125 0.073248 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.655787 0.078730 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.734939 0.046501 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.781834 0.144544 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:02.926781 0.211818 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.138999 0.040378 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.179780 0.078845 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.259094 0.144460 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.404014 0.170853 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.575306 0.071898 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.647620 0.214958 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:03.863041 0.000000 udp 10.0.2.105 7010 -> 210.117.186.140 8912 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 00:19:21.130852 0.066781 tcp 10.0.2.105 58508 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:19:21.197906 0.053590 tcp 10.0.2.105 58509 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:19:21.251775 0.152997 tcp 10.0.2.105 58510 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:19:21.405886 0.724862 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.131145 0.174550 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.306160 0.137992 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.444736 0.060042 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.505193 0.074385 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.579962 0.087280 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.667753 0.145924 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.814075 0.142383 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:22.956909 0.069221 udp 10.0.2.105 7010 <-> 86.156.55.68 9984 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:19:23.026528 0.243087 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:23:14.577560 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:23:21.584328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:23:29.585969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:23:45.588999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:24:17.594978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:25:12.484143 0.000206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 00:25:12.484405 1.025386 tcp 10.0.2.105 58511 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:30:21.600989 3.001558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:30:28.608421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:30:36.609833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:30:52.612779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:31:24.618818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:37:28.624727 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:37:35.632126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:37:43.633472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:37:59.636626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:38:31.642909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:44:35.648896 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:44:42.656283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:44:50.657738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:45:06.660781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:45:38.666821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:49:28.207062 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 00:49:28.207248 0.332461 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:28.540165 0.577989 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.118570 0.057898 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.176866 0.182020 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.359295 0.046796 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.406527 0.077428 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.484454 0.082369 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.567304 0.045165 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.612962 0.158696 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.772083 0.209620 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:29.982112 0.041235 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.023857 0.078195 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.102434 0.144912 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.247811 0.075181 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.323363 0.214774 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.538577 0.175715 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.714908 0.149449 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:30.864752 0.354564 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.219764 0.181678 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.401939 0.145254 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.547602 0.060328 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.608369 0.074374 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.683174 0.074473 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.758062 0.142525 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:31.900957 0.144365 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:49:32.045783 0.000000 udp 10.0.2.105 7010 -> 86.156.55.68 9984 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 00:49:49.889953 0.067238 tcp 10.0.2.105 58512 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:49:49.957484 0.053833 tcp 10.0.2.105 58513 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:49:50.011600 0.159388 tcp 10.0.2.105 58514 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:49:50.171569 0.886392 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/30 00:54:48.680174 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 00:54:55.687684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:55:03.688953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:55:13.514184 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 00:55:13.514424 0.895782 tcp 10.0.2.105 58515 -> 128.255.183.224 9027 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/01/30 00:55:19.692348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 00:55:51.698194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:01:56.044086 3.002348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:02:03.051997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:02:11.053773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:02:27.056591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:02:59.062955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:09:03.068898 3.000697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:09:10.076013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:09:18.077476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:09:34.080509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:10:06.086582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:16:10.091510 3.002462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:16:17.100003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:16:25.101283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:16:41.104631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:17:13.110410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:20:08.883510 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 01:20:08.883624 0.000000 udp 10.0.2.105 7010 -> 86.156.55.68 9984 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 01:20:24.308005 0.446549 tcp 10.0.2.105 58516 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:20:24.754856 0.057481 tcp 10.0.2.105 58517 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:20:24.812628 0.146334 tcp 10.0.2.105 58518 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:20:24.959647 0.320596 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:25.280729 0.182023 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:25.463168 0.040615 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:25.504587 0.077798 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:25.657827 4.395537 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.053832 0.061451 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.115706 0.056079 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.172457 0.082358 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.255279 0.041440 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.297113 0.075960 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.373539 0.206823 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.741018 0.175362 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:30.916756 0.213980 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:31.131173 0.171076 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:31.302639 0.143530 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:31.446595 0.067237 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:31.514311 0.144705 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:31.659426 0.343273 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.003093 0.178064 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.181591 0.131570 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.313673 0.073079 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.387265 0.145726 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.533638 0.148745 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.682850 0.073609 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.756842 0.058679 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:20:32.815958 0.643614 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:23:17.116662 3.001091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:23:24.123974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:23:32.126003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:23:48.129021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:24:20.134649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:25:14.753544 0.000170 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 01:25:14.753834 0.971901 tcp 10.0.2.105 58519 -> 128.255.183.224 9027 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:30:24.141019 3.011148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:30:31.158054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:30:39.159137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:30:55.162591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:31:27.168760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:37:31.175329 3.000760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:37:38.182006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:37:46.183370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:38:02.186160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:38:34.192735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:44:38.198353 3.001353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:44:45.205887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:44:53.207420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:45:09.209875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:45:41.216488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:50:54.577123 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 01:50:54.577221 0.039454 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:54.617055 0.076793 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:54.694223 0.340358 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.035005 0.182170 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.217609 0.237957 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.456103 0.061003 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.517463 0.044046 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.562000 0.079916 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.642282 0.040400 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.683100 0.075598 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.759064 0.207144 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:50:55.966625 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 01:51:14.687666 0.068149 tcp 10.0.2.105 58520 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:51:14.756147 0.054531 tcp 10.0.2.105 58521 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:51:14.810959 0.167294 tcp 10.0.2.105 58522 -> 195.113.214.236 443 SRPA* 0 0 33 19404 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:51:14.978753 0.213425 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:15.192651 0.177658 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:15.370729 0.143445 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:15.514574 0.072202 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:15.587207 0.144832 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:15.732423 0.343187 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.076033 0.074114 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.150527 0.159977 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.310992 0.144044 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.455547 0.073048 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.528997 0.058951 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.588583 0.179055 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.768060 0.131263 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:51:16.899699 0.724351 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 01:54:50.228911 3.001095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 01:54:57.236057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:55:05.237433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:55:15.733433 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 01:55:15.733589 0.160433 tcp 10.0.2.105 58523 -> 128.255.183.224 9027 SPA_* 0 0 9 1128 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:55:21.240649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:55:45.897687 0.068298 tcp 10.0.2.105 58524 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:55:45.966246 0.052085 tcp 10.0.2.105 58525 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:55:46.018612 0.155645 tcp 10.0.2.105 58526 -> 195.113.214.236 443 SRPA* 0 0 48 41104 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:55:46.024653 0.201313 tcp 10.0.2.105 58523 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:55:46.226192 2.994415 tcp 10.0.2.105 58527 -> 176.73.115.123 1806 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:55:53.246248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 01:55:55.219298 0.000000 tcp 10.0.2.105 58527 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:01.229214 0.044338 tcp 10.0.2.105 58528 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:01.273856 0.053422 tcp 10.0.2.105 58529 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:01.327576 0.156933 tcp 10.0.2.105 58530 -> 195.113.214.236 443 SRPA* 0 0 33 19154 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:01.496747 2.996046 tcp 10.0.2.105 58531 -> 77.70.16.3 1237 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:10.491128 0.000000 tcp 10.0.2.105 58531 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:16.490660 0.066597 tcp 10.0.2.105 58532 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:16.557640 0.237442 tcp 10.0.2.105 58533 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:16.795340 0.146942 tcp 10.0.2.105 58534 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:16.952390 3.002262 tcp 10.0.2.105 58535 -> 82.17.183.230 3113 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:25.953506 0.000000 tcp 10.0.2.105 58535 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:31.952761 0.065930 tcp 10.0.2.105 58536 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:32.018952 0.052432 tcp 10.0.2.105 58537 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:32.071715 0.166234 tcp 10.0.2.105 58538 -> 195.113.214.236 443 SRPA* 0 0 37 27274 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:32.256230 3.000797 tcp 10.0.2.105 58539 -> 94.137.168.16 9773 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:41.255316 0.000000 tcp 10.0.2.105 58539 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 01:56:47.254553 0.066658 tcp 10.0.2.105 58540 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:47.321504 0.051914 tcp 10.0.2.105 58541 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:47.373738 0.148600 tcp 10.0.2.105 58542 -> 195.113.214.236 443 SRPA* 0 0 43 22726 flow=From-Botnet-V2-TCP-Established 1970/01/30 01:56:47.533658 0.974096 tcp 10.0.2.105 58543 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:01:57.252617 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 02:02:04.259996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:02:12.261399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:02:28.264481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:03:00.270474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:09:06.279290 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:09:13.286822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:09:21.288095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:09:37.291297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:10:09.297118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:16:13.303396 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:16:20.310873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:16:28.312411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:16:44.314984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:17:16.321514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:21:17.778530 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 02:21:17.778638 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 02:21:33.663078 0.111929 tcp 10.0.2.105 58544 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:21:33.775410 0.102674 tcp 10.0.2.105 58545 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:21:33.878428 0.151993 tcp 10.0.2.105 58546 -> 195.113.214.236 443 SRPA* 0 0 45 40964 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:21:34.031195 0.347049 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.378697 0.039853 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.419005 0.077066 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.496471 0.058157 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.555018 0.180646 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.736064 0.072467 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.808969 0.045915 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.855355 0.043477 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:34.899235 0.520724 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:35.420353 0.127130 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:35.547888 0.207732 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:35.756069 0.215415 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:35.971913 0.177942 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:36.150284 0.139991 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:36.290695 0.074025 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:36.365210 0.141348 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:36.507018 0.142595 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:36.650059 0.360065 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.010527 0.087609 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.098516 0.143573 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.242528 0.075312 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.318196 0.064507 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.383196 0.181317 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.564992 0.152338 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:21:37.717712 0.203505 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:23:20.328563 3.000246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:23:27.334663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:23:35.336229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:23:51.338959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:24:23.345237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:26:48.514190 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 02:26:48.514369 1.031536 tcp 10.0.2.105 58547 -> 128.255.183.224 9027 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:30:27.352056 3.000880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:30:34.358652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:30:42.359944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:30:58.363051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:31:30.368999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:37:34.375468 3.001187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:37:41.382777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:37:49.384038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:38:05.386797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:38:37.394977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:44:41.398685 3.002187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:44:48.406336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:44:56.408192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:45:12.410889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:45:44.417184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:51:48.424037 3.000694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:51:55.430530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:52:03.432168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:52:06.326432 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 02:52:06.326621 0.320770 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:06.653067 0.040911 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:06.694388 0.081669 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:06.776569 0.060694 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:06.837647 0.179776 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.017816 0.082436 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.100665 0.039915 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.141083 0.057574 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.199073 0.209689 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.409209 0.216150 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.625780 0.238270 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.864629 0.075225 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:07.940363 0.171350 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.112091 0.140570 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.268972 0.076616 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.346040 0.142643 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.489285 0.146112 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.635887 0.337977 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:08.974246 0.085657 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.060286 0.060296 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.121039 0.171693 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.293165 0.138131 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.431750 0.264020 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.696273 0.152895 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:09.849565 0.078350 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 02:52:19.435083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:52:51.441100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:56:49.553853 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 02:56:49.554024 0.945259 tcp 10.0.2.105 58548 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/30 02:58:55.447456 3.001033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 02:59:02.455012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:59:10.456084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:59:26.458875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 02:59:58.464783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:06:27.477137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:06:37.587457 1.973095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/01/30 03:06:43.509225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:06:51.396563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:07:07.166798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:07:38.703043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:13:38.518722 2.961430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 03:13:45.426699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:13:53.317102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:14:09.100605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:14:47.508699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:20:57.474182 2.959691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 03:21:04.384437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:21:12.274802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:21:28.060168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:21:59.615305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:22:45.746359 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 03:22:45.746566 0.076882 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:22:45.823893 0.061831 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:22:45.886208 0.340157 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:22:46.330412 0.040785 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:22:46.371654 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 03:23:02.674003 0.044178 tcp 10.0.2.105 58549 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 03:23:02.718469 0.052253 tcp 10.0.2.105 58550 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 03:23:02.770976 0.155396 tcp 10.0.2.105 58551 -> 195.113.214.236 443 SRPA* 0 0 25 13918 flow=From-Botnet-V2-TCP-Established 1970/01/30 03:23:02.926916 0.084173 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.011507 0.040347 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.052793 0.044846 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.126758 0.214700 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.344923 0.214669 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.560023 0.400390 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:03.960898 0.081441 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.042789 0.174633 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.217884 0.142761 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.361022 0.151394 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.512847 0.070758 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.584045 0.152076 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:04.736578 0.363242 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.100274 0.077001 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.177683 0.057503 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.251914 0.172082 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.424419 0.138179 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.593232 0.073384 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.667103 0.200583 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:23:05.868144 0.142157 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:27:00.208155 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 03:27:00.208426 1.018997 tcp 10.0.2.105 58552 -> 128.255.183.224 9027 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/01/30 03:27:58.446604 2.950545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 03:28:05.348967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:28:13.230386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:28:29.003776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:29:00.569514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:34:59.461715 2.964679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 03:35:06.366901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:35:14.257722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:35:30.035021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:36:01.733378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:42:03.638428 3.001360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 03:42:10.645766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:42:18.647011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:42:34.650428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:43:06.656117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:53:05.367494 0.015628 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 03:53:05.383254 0.180639 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:05.564304 0.039280 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:05.603974 0.061774 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:05.666195 0.075876 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:05.742462 0.346153 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.089046 0.206976 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.296426 0.081018 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.377849 0.041844 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.420288 0.207197 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.420808 4.506156 tcp 10.0.2.105 58553 -> 194.246.126.196 7306 FSPA* 0 0 805 643371 flow=From-Botnet-V2-TCP-Established 1970/01/30 03:53:06.627922 0.214378 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:06.842775 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 03:53:13.443457 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 03:53:13.443934 0.076328 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:13.520757 0.178019 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:13.699178 0.072204 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:13.771764 0.142172 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:13.914397 0.657138 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:14.571990 0.074873 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:14.647246 0.144495 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:14.792172 0.148700 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:14.941266 0.059416 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:15.001046 0.176193 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:15.177685 0.145081 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:15.323164 0.077533 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:15.401127 0.208741 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:15.610282 0.146956 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 03:53:29.665290 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 03:53:36.672084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:53:44.673488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:54:00.677123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:54:32.682712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 03:56:51.543074 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 03:56:51.543202 0.949901 tcp 10.0.2.105 58554 -> 128.255.183.224 9027 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/01/30 04:00:36.688829 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:00:43.695954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:00:51.697550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:01:07.700165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:01:39.706521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:07:43.712979 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:07:50.720009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:07:58.721356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:08:14.725211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:08:46.730945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:14:50.735888 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:14:57.743671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:15:05.745370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:15:21.747828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:15:53.754217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:21:57.760757 3.001367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:22:04.824864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:22:12.769305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:22:28.772392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:23:00.778116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:23:19.665811 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:23:19.665976 0.060228 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:19.726592 0.094373 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:19.821421 0.336805 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.158680 0.181827 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.340923 0.047541 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.388903 0.044884 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.434249 0.074982 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.509702 0.040507 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.550678 0.209501 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.760695 0.214870 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:20.976052 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 04:23:36.696858 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 04:23:36.697244 0.076806 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:36.774506 0.179306 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:36.954293 0.071567 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.026263 0.143015 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.169683 0.139161 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.309321 0.365226 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.675025 0.087695 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.763153 0.150663 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.914260 0.060467 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:37.975149 0.181112 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:38.156641 0.131659 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:38.288715 0.073889 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:38.363000 0.205560 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:38.568985 0.144040 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:23:43.559861 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:26:52.492028 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:26:52.492121 0.901224 tcp 10.0.2.105 58555 -> 128.255.183.224 9027 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/01/30 04:29:04.784870 3.001054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 04:29:11.794877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:29:19.793239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:29:35.796311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:30:07.802227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:36:11.807933 3.002066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:36:18.815752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:36:26.817053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:36:42.820126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:37:14.826173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:43:18.832545 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:43:25.839572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:43:33.841156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:43:49.844343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:44:21.849879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:54:07.866122 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 04:54:08.744461 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:54:08.744674 0.332044 udp 10.0.2.105 7010 <-> 210.117.186.140 8912 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:09.077196 0.060798 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:09.138396 0.076141 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:09.215010 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 04:54:14.873304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:54:22.874198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:54:26.431206 0.046276 tcp 10.0.2.105 58556 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 04:54:26.477802 0.054982 tcp 10.0.2.105 58557 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 04:54:26.533087 0.150476 tcp 10.0.2.105 58558 -> 195.113.214.236 443 SRPA* 0 0 35 24322 flow=From-Botnet-V2-TCP-Established 1970/01/30 04:54:26.684085 0.039120 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:26.723620 0.071585 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:26.795591 0.081914 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:26.877926 0.040668 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:26.918989 0.208491 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:27.127895 0.214639 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:27.342937 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 04:54:38.877499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:54:43.185386 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 04:54:43.185865 0.078515 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:43.264815 0.175531 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:43.440759 0.074887 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:43.516078 0.140387 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:43.656927 0.145101 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:43.814885 0.358387 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.173743 0.088661 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.262869 0.159169 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.422593 0.059645 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.482707 0.075180 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.558369 0.207117 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.765983 0.144695 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:44.911154 0.176395 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:45.087925 0.151991 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 04:54:50.053824 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:55:10.883493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 04:56:53.401172 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 04:56:53.401343 0.911261 tcp 10.0.2.105 58559 -> 128.255.183.224 9027 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:01:14.889562 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:01:21.897105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:01:29.898646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:01:45.901285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:02:17.907643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:08:21.913044 3.002113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:08:28.920920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:08:36.922257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:08:52.925334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:09:24.931403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:15:28.937746 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:15:35.944728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:15:43.946353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:15:59.949278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:16:31.955302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:22:35.961046 3.002050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:22:42.968842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:22:50.970250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:23:06.973160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:23:38.978839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:24:54.528469 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:24:54.528646 0.181782 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:24:54.710831 0.062528 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:24:54.773798 0.000000 udp 10.0.2.105 7010 -> 210.117.186.140 8912 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:25:09.962351 0.067663 tcp 10.0.2.105 58560 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:25:10.030314 0.053550 tcp 10.0.2.105 58561 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:25:10.084167 0.152624 tcp 10.0.2.105 58562 -> 195.113.214.236 443 SRPA* 0 0 41 22830 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:25:10.237050 0.076151 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.313622 0.038860 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.352835 0.161796 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.515018 0.084524 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.599978 0.043603 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.644011 0.207010 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:10.851492 0.215491 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:11.067395 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:25:25.381668 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:25:25.382203 0.090328 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:25.473240 0.171068 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:25.644728 0.089037 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:25.734200 0.143868 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:25.878556 0.142187 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:26.021133 0.621870 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:26.643499 0.077531 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:26.721421 0.145064 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:26.866840 0.058062 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:26.925341 0.076197 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:27.001976 0.173293 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:27.175687 0.151625 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:27.327835 0.206487 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:25:27.534692 0.245952 udp 10.0.2.105 7010 <-> 74.12.172.197 3419 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:26:54.320628 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:26:54.320747 0.949273 tcp 10.0.2.105 58563 -> 128.255.183.224 9027 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:29:42.985974 3.000325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 05:29:49.992765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:29:57.994180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:30:13.996796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:30:46.002870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:36:50.009026 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:36:57.016405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:37:05.018283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:37:21.020774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:37:53.026981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:43:57.033885 3.000833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:44:04.063920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:44:12.052432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:44:28.055305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:45:00.060965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:54:27.069386 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 05:54:34.076646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:54:42.077823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:54:58.081197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:55:30.087717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 05:55:37.488153 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:55:37.488334 0.000000 udp 10.0.2.105 7010 -> 210.117.186.140 8912 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:55:53.873734 0.066671 tcp 10.0.2.105 58564 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:55:53.940662 0.055117 tcp 10.0.2.105 58565 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:55:53.996042 0.151979 tcp 10.0.2.105 58566 -> 195.113.214.236 443 SRPA* 0 0 38 21250 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:55:54.148747 0.181895 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.331080 0.062014 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.393520 0.078640 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.472651 0.047329 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.520561 0.043912 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.564906 0.094265 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.659580 0.040372 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.700542 0.208108 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:54.909077 0.215921 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.125446 0.268744 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.394662 0.077416 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.472515 0.170807 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.643765 0.072356 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.716582 0.148263 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:55.865273 0.144536 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:56.010209 0.331535 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:56.342249 0.082823 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:56.425449 0.146673 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:56.572767 0.364586 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:56.937861 0.159524 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:57.097840 0.234713 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:55:57.332992 0.000000 udp 10.0.2.105 7010 -> 74.12.172.197 3419 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:15.623338 0.152461 tcp 10.0.2.105 58567 -> 195.113.214.211 80 FSPA* 0 0 10 1539 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:56:15.776147 0.054301 tcp 10.0.2.105 58568 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:56:15.830746 0.169430 tcp 10.0.2.105 58569 -> 195.113.214.236 443 SRPA* 0 0 40 21364 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:56:16.000883 0.177260 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:16.178546 0.138093 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:16.343064 0.000000 udp 10.0.2.105 7010 -> 74.12.172.197 3419 REQ 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:24.275369 0.047597 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.323428 0.067243 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.391146 0.047398 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.439002 0.181816 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.621364 0.075032 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.710846 0.041623 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.764937 0.049854 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:24.815330 0.220380 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.036206 0.204399 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.241150 0.171776 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.413510 0.069141 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.483183 0.147934 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.631678 0.067825 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:25.699995 0.558484 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.258942 0.077541 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.336980 0.145094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.482555 0.334536 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.817546 0.072481 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.890539 0.053144 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:26.944114 0.149390 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:27.094061 0.210723 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:27.305187 0.137835 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:27.443507 0.174768 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:27.618833 0.000000 udp 10.0.2.105 7010 -> 95.13.69.207 8667 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:32.647168 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:38.505689 0.000000 udp 10.0.2.105 7010 -> 81.108.249.65 2974 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:43.051813 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:56:45.835988 0.057755 udp 10.0.2.105 7010 <-> 86.173.209.175 6090 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:56:45.910464 0.000000 udp 10.0.2.105 7010 -> 63.230.157.158 2736 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:52.405458 0.000000 udp 10.0.2.105 7010 -> 151.77.48.102 9599 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:56:55.269845 0.945497 tcp 10.0.2.105 58570 -> 128.255.183.224 9027 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/01/30 05:56:58.695309 0.000000 udp 10.0.2.105 7010 -> 85.37.38.186 4914 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:06.686207 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:14.617881 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:21.126760 0.000000 udp 10.0.2.105 7010 -> 50.124.128.232 4327 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:26.053632 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:57:27.366246 0.000000 udp 10.0.2.105 7010 -> 212.58.56.98 4670 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:33.544794 0.167057 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/01/30 05:57:33.730684 0.000000 udp 10.0.2.105 7010 -> 92.139.106.159 7556 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:41.015818 0.000000 udp 10.0.2.105 7010 -> 173.161.36.149 8727 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:47.324732 0.000000 udp 10.0.2.105 7010 -> 79.190.175.106 1603 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:57:52.050940 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:57:53.073193 0.000000 udp 10.0.2.105 7010 -> 78.185.204.22 7280 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:00.413456 0.000000 udp 10.0.2.105 7010 -> 171.99.231.154 9451 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:06.852973 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:13.542504 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:18.058479 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:58:20.312367 0.000000 udp 10.0.2.105 7010 -> 108.217.199.137 7525 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:27.131951 0.000000 udp 10.0.2.105 7010 -> 182.70.16.251 2397 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:34.211898 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:39.789421 0.000000 udp 10.0.2.105 7010 -> 65.216.142.242 1770 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:44.556683 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:58:46.459674 0.000000 udp 10.0.2.105 7010 -> 79.129.143.234 6161 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:51.927526 0.000000 udp 10.0.2.105 7010 -> 211.26.10.184 4600 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:58:59.918827 0.000000 udp 10.0.2.105 7010 -> 37.152.47.70 8297 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:07.940753 0.000000 udp 10.0.2.105 7010 -> 135.196.169.64 4826 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:12.557322 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:59:15.371400 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:24.323782 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:30.963520 0.000000 udp 10.0.2.105 7010 -> 176.221.158.108 6350 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:38.434465 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:43.051105 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 05:59:44.663488 0.000000 udp 10.0.2.105 7010 -> 69.2.82.46 4573 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:50.721872 0.000000 udp 10.0.2.105 7010 -> 108.215.37.87 1726 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 05:59:58.473854 0.000000 udp 10.0.2.105 7010 -> 93.193.134.38 7662 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:04.812308 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:09.558871 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:00:10.751204 0.000000 udp 10.0.2.105 7010 -> 83.30.5.102 7393 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:16.789530 0.032971 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:00:16.841111 0.000000 udp 10.0.2.105 7010 -> 31.146.145.105 7642 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:25.521999 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:31.310144 0.000000 udp 10.0.2.105 7010 -> 62.8.110.186 6219 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:36.056885 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:00:39.281748 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:44.348651 0.000000 udp 10.0.2.105 7010 -> 66.152.153.32 1024 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:00:52.991450 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:01.493731 0.175483 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:01:01.698581 0.000000 udp 10.0.2.105 7010 -> 63.153.204.202 3230 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:06.060071 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:01:10.076114 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:15.434207 0.175576 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:01:15.635121 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:21.192057 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:27.771614 0.042903 udp 10.0.2.105 7010 -> 82.36.145.189 1512 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:27.814517 0.000000 icmp 82.36.145.189 0x0303 -> 10.0.2.105 0xe805 URP 192 1 189 flow=Background 1970/01/30 06:01:32.558086 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:01:33.539670 0.000000 udp 10.0.2.105 7010 -> 176.255.73.14 6188 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:34.093380 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 06:01:41.100308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:01:42.372345 0.073951 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:01:42.455016 0.507928 udp 10.0.2.105 7010 <-> 86.184.96.67 8449 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:01:42.988125 0.074230 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:01:43.081249 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:49.102393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:01:49.222820 0.000000 udp 10.0.2.105 7010 -> 77.100.187.34 5747 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:01:58.095162 0.000000 udp 10.0.2.105 7010 -> 2.139.231.119 9353 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:03.052090 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:02:04.043785 0.000000 udp 10.0.2.105 7010 -> 87.22.58.162 3856 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:05.105081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:02:10.843583 0.259245 udp 10.0.2.105 7010 <-> 75.230.75.162 5379 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:11.113824 0.057699 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:11.195543 0.000000 udp 10.0.2.105 7010 -> 24.154.118.210 2211 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:16.992900 0.066281 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:17.130250 0.000000 udp 10.0.2.105 7010 -> 31.211.237.198 8269 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:23.852126 0.324585 udp 10.0.2.105 7010 -> 186.6.14.232 3659 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:24.176711 0.000000 icmp 186.6.14.232 0x0303 -> 10.0.2.105 0x4b0e URP 192 1 152 flow=Background 1970/01/30 06:02:28.558657 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:02:29.139939 0.856506 udp 10.0.2.105 7010 <-> 62.18.240.34 9988 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:30.022283 0.181513 udp 10.0.2.105 7010 <-> 196.47.165.6 1386 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:30.214519 0.075118 udp 10.0.2.105 7010 <-> 151.75.143.219 4594 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:30.298838 0.591263 udp 10.0.2.105 7010 <-> 41.208.224.238 5371 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:30.908182 0.183222 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:31.100898 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 4856 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:37.110802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:02:40.025469 0.072768 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:40.137629 0.000000 udp 10.0.2.105 7010 -> 72.94.60.28 1395 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:45.423399 0.000000 udp 10.0.2.105 7010 -> 85.74.131.220 2536 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:51.742282 0.060121 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:51.811287 0.137487 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:02:51.969181 0.000000 udp 10.0.2.105 7010 -> 94.67.14.102 2026 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:02:56.558992 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:03:00.745798 0.000000 udp 10.0.2.105 7010 -> 91.39.145.249 8575 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:07.725943 0.000000 udp 10.0.2.105 7010 -> 171.98.182.80 3308 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:16.057286 0.245899 udp 10.0.2.105 7010 -> 190.41.80.68 7806 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:16.303185 0.000000 icmp 190.41.80.68 0x0303 -> 10.0.2.105 0x7e1e URP 192 1 178 flow=Background 1970/01/30 06:03:21.054651 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:03:21.615754 0.219843 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:03:21.859919 0.000000 udp 10.0.2.105 7010 -> 2.100.223.178 1070 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:29.036177 0.000000 udp 10.0.2.105 7010 -> 173.65.4.44 5672 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:36.917055 0.000000 udp 10.0.2.105 7010 -> 122.149.210.198 6211 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:44.017485 0.000000 udp 10.0.2.105 7010 -> 24.172.96.6 2158 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:48.553484 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:03:49.365522 0.000000 udp 10.0.2.105 7010 -> 87.208.51.54 4584 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:03:55.914637 0.000000 udp 10.0.2.105 7010 -> 86.29.222.245 8929 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:03.605831 0.000000 udp 10.0.2.105 7010 -> 90.208.221.240 9017 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:12.217910 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:17.054711 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:04:18.567224 0.000000 udp 10.0.2.105 7010 -> 185.30.65.165 7249 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:26.838768 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:33.788806 0.000000 udp 10.0.2.105 7010 -> 187.162.94.249 4444 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:41.079281 0.000000 udp 10.0.2.105 7010 -> 78.190.4.229 1030 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:46.056395 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:04:47.648777 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:04:54.759052 0.000000 udp 10.0.2.105 7010 -> 72.77.55.109 6834 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:03.611979 0.000000 udp 10.0.2.105 7010 -> 90.153.13.194 1870 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:10.942368 0.090645 udp 10.0.2.105 7010 -> 82.186.159.65 6535 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:11.033013 0.000000 icmp 2.113.153.206 0x0303 -> 10.0.2.105 0x8719 URP 192 1 219 flow=Background 1970/01/30 06:05:15.558516 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:05:19.695194 0.000000 udp 10.0.2.105 7010 -> 5.71.48.47 8366 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:27.846832 0.000000 udp 10.0.2.105 7010 -> 46.177.18.188 8856 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:36.769370 0.229603 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:05:37.013220 0.000000 udp 10.0.2.105 7010 -> 92.232.98.23 8223 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:41.556498 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:05:44.059928 0.000000 udp 10.0.2.105 7010 -> 93.72.8.0 6240 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:51.410383 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:05:58.390441 0.000000 udp 10.0.2.105 7010 -> 89.121.55.205 2876 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:03.657884 0.000000 udp 10.0.2.105 7010 -> 87.18.196.134 7243 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:08.555038 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:06:10.577943 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:15.785318 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:21.663921 0.000000 udp 10.0.2.105 7010 -> 86.142.56.66 6887 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:29.885630 0.199350 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:06:30.103370 0.238782 udp 10.0.2.105 7010 -> 93.94.92.173 1024 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:30.342152 0.000000 icmp 93.94.92.173 0x0303 -> 10.0.2.105 0x0004 URP 192 1 217 flow=Background 1970/01/30 06:06:34.552544 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:06:35.674309 0.000000 udp 10.0.2.105 7010 -> 212.14.63.170 3902 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:43.835642 0.408544 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:06:44.260120 0.000000 udp 10.0.2.105 7010 -> 86.170.91.177 5521 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:52.878734 0.000000 udp 10.0.2.105 7010 -> 93.64.144.84 6067 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:59.758953 0.081799 udp 10.0.2.105 7010 <-> 86.156.83.195 5175 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:06:59.850225 0.033183 udp 10.0.2.105 7010 -> 178.8.220.182 4346 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:06:59.883408 0.000000 icmp 178.8.220.182 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 198 flow=Background 1970/01/30 06:07:04.555544 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:07:08.070641 0.000000 udp 10.0.2.105 7010 -> 24.12.184.9 3414 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:16.793278 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:22.411480 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:30.292970 0.000000 udp 10.0.2.105 7010 -> 95.241.29.16 1395 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:35.059263 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:07:38.153874 0.000000 udp 10.0.2.105 7010 -> 210.195.210.135 1614 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:45.755142 0.000000 udp 10.0.2.105 7010 -> 204.96.146.40 2099 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:52.194142 0.000000 udp 10.0.2.105 7010 -> 99.100.164.78 5830 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:07:58.493336 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:08:03.059670 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:08:03.990515 0.000000 udp 10.0.2.105 7010 -> 98.254.63.202 7467 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:08:10.209929 0.000000 udp 10.0.2.105 7010 -> 200.223.31.39 1987 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:08:16.679383 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:08:41.118596 2.999809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 06:08:48.124749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:08:56.126399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:09:12.128527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:09:44.135060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:15:48.140900 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 06:15:55.148501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:16:03.149634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:16:19.153090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:16:51.159121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:22:55.165437 3.001583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 06:23:02.172370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:23:10.173784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:23:26.176789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:23:58.182952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:26:56.219297 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:26:56.219520 1.025934 tcp 10.0.2.105 58571 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:30:02.190111 2.999909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 06:30:09.196598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:30:17.197391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:30:33.200832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:31:05.207045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:37:09.212496 3.001610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 06:37:16.220004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:37:24.221784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:37:40.224787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:38:12.230531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:38:32.570586 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:38:32.570680 0.307810 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:32.878890 0.045803 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:32.925171 0.059332 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:32.984951 0.213751 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.199190 0.181639 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.381238 0.084269 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.465933 0.040816 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.507285 0.063202 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.570920 0.174639 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.745975 0.070366 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.816829 0.144994 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:33.962236 0.075298 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:34.038024 0.209203 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:34.247705 0.074677 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:34.322881 0.140402 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:34.463697 0.720604 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.184719 0.319547 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.504644 0.075779 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.580794 0.058984 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.640267 0.144139 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.784803 0.206308 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:35.991500 0.130865 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:38:36.122753 0.000000 udp 10.0.2.105 7010 -> 108.95.26.135 6940 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:38:52.450517 0.067726 tcp 10.0.2.105 58572 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:38:52.518644 0.058201 tcp 10.0.2.105 58573 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:38:52.577138 0.159791 tcp 10.0.2.105 58574 -> 195.113.214.236 443 SRPA* 0 0 40 22584 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:38:52.737451 0.000000 udp 10.0.2.105 7010 -> 86.173.209.175 6090 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:39:11.216365 0.067084 tcp 10.0.2.105 58575 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:11.283740 0.058777 tcp 10.0.2.105 58576 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:11.342809 0.161381 tcp 10.0.2.105 58577 -> 195.113.214.236 443 SRPA* 0 0 53 37624 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:11.504853 0.165474 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:11.670746 0.029836 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:11.700984 0.172327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:11.873755 0.204891 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:12.079147 0.069884 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:12.149467 0.082386 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:12.232447 0.000000 udp 10.0.2.105 7010 -> 86.184.96.67 8449 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:39:28.441288 0.067504 tcp 10.0.2.105 58578 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:28.509138 0.052796 tcp 10.0.2.105 58579 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:28.562233 0.157125 tcp 10.0.2.105 58580 -> 195.113.214.236 443 SRPA* 0 0 40 33902 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:28.720025 0.057154 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:28.777571 0.228676 udp 10.0.2.105 7010 <-> 75.230.75.162 5379 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:29.006642 0.065735 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:29.072827 0.183728 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:29.256965 0.000000 udp 10.0.2.105 7010 -> 151.75.143.219 4594 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:39:46.947568 0.069426 tcp 10.0.2.105 58581 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:47.017328 0.054946 tcp 10.0.2.105 58582 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:47.072569 0.162525 tcp 10.0.2.105 58583 -> 195.113.214.236 443 SRPA* 0 0 33 19154 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:39:47.235766 0.160829 udp 10.0.2.105 7010 <-> 196.47.165.6 1386 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:47.397063 0.693760 udp 10.0.2.105 7010 <-> 41.208.224.238 5371 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:39:48.091248 0.000000 udp 10.0.2.105 7010 -> 62.18.240.34 9988 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:40:05.765038 0.065428 tcp 10.0.2.105 58584 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:40:05.830820 0.071240 tcp 10.0.2.105 58585 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:40:05.902354 0.148282 tcp 10.0.2.105 58586 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:40:06.051148 0.063354 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.114897 0.143337 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.258634 0.052025 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.311056 0.212023 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.523458 0.241067 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.764997 0.189316 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:06.954668 0.403552 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 06:40:07.358618 0.000000 udp 10.0.2.105 7010 -> 86.156.83.195 5175 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 06:40:22.989304 0.069416 tcp 10.0.2.105 58587 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:40:23.059085 0.052314 tcp 10.0.2.105 58588 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:40:23.111740 0.160949 tcp 10.0.2.105 58589 -> 195.113.214.236 443 SRPA* 0 0 27 12044 flow=From-Botnet-V2-TCP-Established 1970/01/30 06:44:16.237345 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 06:44:23.244163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:44:31.245538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:44:47.248762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:45:19.254228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:54:38.261189 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 06:54:45.268727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:54:53.270104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:55:09.273113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:55:41.279013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 06:56:57.248730 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 06:56:57.248860 0.918807 tcp 10.0.2.105 58590 -> 128.255.183.224 9027 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:01:45.286115 3.000795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:01:52.293094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:02:00.293923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:02:16.297388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:02:48.303503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:08:52.309074 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:08:59.316449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:09:07.317842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:09:23.321146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:09:55.327196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:10:26.041526 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 07:10:26.041788 0.000000 udp 10.0.2.105 7010 -> 108.95.26.135 6940 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:10:45.010813 0.046018 tcp 10.0.2.105 58591 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:10:45.057126 0.055050 tcp 10.0.2.105 58592 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:10:45.112631 0.156388 tcp 10.0.2.105 58593 -> 195.113.214.236 443 SRPA* 0 0 41 22618 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:10:45.269427 0.000000 udp 10.0.2.105 7010 -> 86.173.209.175 6090 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:11:01.993482 0.067417 tcp 10.0.2.105 58594 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:02.061227 0.052537 tcp 10.0.2.105 58595 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:02.114037 0.185455 tcp 10.0.2.105 58596 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:02.300058 0.000000 udp 10.0.2.105 7010 -> 86.184.96.67 8449 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:11:17.966447 0.043863 tcp 10.0.2.105 58597 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:18.010587 0.053867 tcp 10.0.2.105 58598 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:18.064777 0.164213 tcp 10.0.2.105 58599 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:18.229573 0.000000 udp 10.0.2.105 7010 -> 151.75.143.219 4594 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:11:35.591841 0.047600 tcp 10.0.2.105 58600 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:35.639720 0.052940 tcp 10.0.2.105 58601 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:35.692921 0.155997 tcp 10.0.2.105 58602 -> 195.113.214.236 443 SRPA* 0 0 33 19366 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:35.849578 0.000000 udp 10.0.2.105 7010 -> 62.18.240.34 9988 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:11:51.113977 0.044375 tcp 10.0.2.105 58603 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:51.158637 0.054873 tcp 10.0.2.105 58604 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:51.213776 0.148023 tcp 10.0.2.105 58605 -> 195.113.214.236 443 SRPA* 0 0 41 23300 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:11:51.362345 0.000000 udp 10.0.2.105 7010 -> 86.156.83.195 5175 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:12:09.180145 0.066970 tcp 10.0.2.105 58606 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:09.247393 0.057822 tcp 10.0.2.105 58607 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:09.305499 0.156511 tcp 10.0.2.105 58608 -> 195.113.214.236 443 SRPA* 0 0 44 37138 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:09.462855 0.039638 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.502885 0.074634 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.578013 0.065199 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.643649 0.144749 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.788788 0.084344 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.873643 0.072876 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:09.946885 0.171532 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:10.118894 0.048508 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:10.167895 0.217595 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:10.385937 0.040118 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:10.426525 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:12:26.074309 0.067638 tcp 10.0.2.105 58609 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:26.142239 0.053585 tcp 10.0.2.105 58610 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:26.196120 0.152806 tcp 10.0.2.105 58611 -> 195.113.214.236 443 SRPA* 0 0 44 27878 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:26.349631 0.092002 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:26.442056 0.144843 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:26.587286 0.211853 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:26.799541 0.074666 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:26.874572 0.073918 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:26.948904 0.494883 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:27.444228 0.142473 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:27.587097 0.058258 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:27.645755 0.218732 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:27.864877 0.385410 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:28.250633 0.144649 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:28.395676 0.172233 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:28.568314 0.363660 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:28.932379 0.000000 udp 10.0.2.105 7010 -> 79.219.110.217 2430 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:12:47.785504 0.066159 tcp 10.0.2.105 58612 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:47.851951 0.053374 tcp 10.0.2.105 58613 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:47.905604 0.156032 tcp 10.0.2.105 58614 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:12:48.062195 0.081322 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.143922 0.173278 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.317585 0.076181 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.394148 0.244927 udp 10.0.2.105 7010 <-> 75.230.75.162 5379 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.639585 0.063410 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.703452 0.081297 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:48.785124 0.248076 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:49.033628 0.555224 udp 10.0.2.105 7010 <-> 41.208.224.238 5371 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:12:49.589312 0.000000 udp 10.0.2.105 7010 -> 196.47.165.6 1386 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:13:05.400900 0.067307 tcp 10.0.2.105 58615 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:05.468532 0.052828 tcp 10.0.2.105 58616 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:05.521646 0.160571 tcp 10.0.2.105 58617 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:05.682762 0.062166 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:13:05.745334 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:13:23.297208 0.068089 tcp 10.0.2.105 58618 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:23.365562 0.054428 tcp 10.0.2.105 58619 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:23.420304 0.151090 tcp 10.0.2.105 58620 -> 195.113.214.236 443 SRPA* 0 0 77 56912 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:13:23.572173 0.210933 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:13:23.783542 0.210639 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:13:23.994681 0.196921 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:13:24.192053 0.143440 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:13:24.335900 2.318823 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:15:59.333372 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 07:16:06.340733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:16:14.342117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:16:30.344946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:17:02.350655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:23:06.356631 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:23:13.364249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:23:21.366278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:23:37.369070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:24:09.375081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:26:58.168842 0.000231 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 07:26:58.169182 0.996222 tcp 10.0.2.105 58621 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:30:13.380417 3.002301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:30:20.388310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:30:28.389742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:30:44.393161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:31:16.398932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:37:20.404786 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:37:27.412541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:37:35.413621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:37:51.417055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:38:23.423058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:43:43.102876 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 07:43:43.102991 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:44:00.659475 0.067216 tcp 10.0.2.105 58622 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:00.727006 0.053628 tcp 10.0.2.105 58623 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:00.780975 0.205817 tcp 10.0.2.105 58624 -> 195.113.214.236 443 SRPA* 0 0 42 24346 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:00.987389 0.029249 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:01.017042 0.000000 udp 10.0.2.105 7010 -> 196.47.165.6 1386 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:44:18.063750 0.067645 tcp 10.0.2.105 58625 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:18.131692 0.053671 tcp 10.0.2.105 58626 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:18.185689 0.153612 tcp 10.0.2.105 58627 -> 195.113.214.236 443 SRPA* 0 0 23 13340 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:18.339809 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:44:27.429749 3.000888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 07:44:34.436646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:44:35.128734 0.065877 tcp 10.0.2.105 58628 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:35.194899 0.055057 tcp 10.0.2.105 58629 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:35.249736 0.171163 tcp 10.0.2.105 58630 -> 195.113.214.236 443 SRPA* 0 0 25 13448 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:35.421481 0.060829 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.482692 0.173469 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.656718 0.082136 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.739258 0.076429 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.816088 0.075596 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.892011 0.072992 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:35.965455 0.145458 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.111305 0.040540 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.152305 0.040283 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.193039 0.215324 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.408812 0.074201 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.483519 0.086605 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.570515 0.143239 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.714172 0.213746 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:36.928505 0.075295 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.004195 0.233398 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.238043 0.209510 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.448053 0.143250 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.591714 0.063704 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.655870 0.170976 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.827281 0.131110 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:37.958826 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:44:42.437722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:44:55.657563 0.066793 tcp 10.0.2.105 58631 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:55.724732 0.053259 tcp 10.0.2.105 58632 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:55.778324 0.156629 tcp 10.0.2.105 58633 -> 195.113.214.236 443 SRPA* 0 0 40 22622 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:44:55.935123 0.165825 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:56.101386 0.070137 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:44:56.171950 0.000000 udp 10.0.2.105 7010 -> 75.230.75.162 5379 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:44:58.440755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:45:12.491979 0.067575 tcp 10.0.2.105 58634 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:12.559824 0.054102 tcp 10.0.2.105 58635 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:12.614206 0.199299 tcp 10.0.2.105 58636 -> 195.113.214.236 443 SRPA* 0 0 21 12828 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:12.814074 0.068219 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:12.882684 0.054987 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:12.938082 0.178754 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:13.117212 0.172192 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:13.289824 0.076847 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:13.367067 0.000000 udp 10.0.2.105 7010 -> 41.208.224.238 5371 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 07:45:30.446953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:45:30.738239 0.067683 tcp 10.0.2.105 58637 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:30.806313 0.054548 tcp 10.0.2.105 58638 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:30.861229 0.168943 tcp 10.0.2.105 58639 -> 195.113.214.236 443 SRPA* 0 0 22 11826 flow=From-Botnet-V2-TCP-Established 1970/01/30 07:45:31.030658 0.063911 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:31.094931 0.212801 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:31.308203 0.222067 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:31.530674 0.191647 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:31.722742 0.148668 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:45:31.871850 0.759221 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 07:54:44.456038 3.011725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 07:54:51.473576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:54:59.475067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:55:15.478121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:55:47.483936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 07:56:59.167353 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 07:56:59.167544 0.941849 tcp 10.0.2.105 58640 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:01:51.489916 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:01:58.497441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:02:06.498838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:02:22.502280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:02:54.508084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:08:58.514141 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:09:05.521385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:09:13.522899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:09:29.526069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:10:01.531903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:15:45.657550 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 08:15:45.657741 0.884918 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:15:46.543026 0.000000 udp 10.0.2.105 7010 -> 75.230.75.162 5379 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 08:16:04.565803 0.066375 tcp 10.0.2.105 58641 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:04.632449 0.051900 tcp 10.0.2.105 58642 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:04.684646 0.152573 tcp 10.0.2.105 58643 -> 195.113.214.236 443 SRPA* 0 0 40 22584 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:04.837877 0.000000 udp 10.0.2.105 7010 -> 41.208.224.238 5371 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 08:16:05.537756 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:16:12.545346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:16:20.546879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:16:21.148551 0.066896 tcp 10.0.2.105 58644 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:21.215696 0.050780 tcp 10.0.2.105 58645 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:21.266808 0.199018 tcp 10.0.2.105 58646 -> 195.113.214.236 443 SRPA* 0 0 41 22756 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:21.466996 0.000000 udp 10.0.2.105 7010 -> 79.219.110.217 2430 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 08:16:36.549938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:16:39.494554 0.067061 tcp 10.0.2.105 58647 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:39.561934 0.050224 tcp 10.0.2.105 58648 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:39.612466 0.168620 tcp 10.0.2.105 58649 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:39.781601 0.073281 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:39.855277 0.074517 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:39.930256 0.073863 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.004536 0.143226 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.148286 0.039990 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.188775 0.059217 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.248401 0.399193 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.648015 0.175637 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:40.824012 0.209341 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.033826 0.078057 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.112317 0.039867 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.152759 0.074496 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.227631 0.219237 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.447353 0.106309 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.554191 0.141019 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.695593 0.171704 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:41.867676 0.144762 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.012801 0.204739 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.217978 0.228551 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.446943 0.059316 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.506645 0.145247 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.652431 0.165507 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:42.818348 0.000000 udp 10.0.2.105 7010 -> 79.10.2.161 6208 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 08:16:57.891294 0.066862 tcp 10.0.2.105 58650 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:57.958538 0.051790 tcp 10.0.2.105 58651 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:58.010593 0.149717 tcp 10.0.2.105 58652 -> 195.113.214.236 443 SRPA* 0 0 42 22656 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:16:58.160821 0.060978 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.222167 0.066908 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.289472 0.182905 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.472799 0.082615 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.555833 0.172881 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.729162 0.065011 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:16:58.794587 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 08:17:08.556090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:17:15.506604 0.067213 tcp 10.0.2.105 58653 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:17:15.574095 0.052533 tcp 10.0.2.105 58654 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:17:15.626893 0.150889 tcp 10.0.2.105 58655 -> 195.113.214.236 443 SRPA* 0 0 21 13076 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:17:15.778303 0.143475 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:17:15.922203 0.213015 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:17:16.135644 0.222346 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:17:16.358456 0.359001 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:23:12.562071 3.018749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:23:19.579309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:23:27.580869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:23:43.583907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:24:15.589851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:27:00.116462 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 08:27:00.116666 1.026325 tcp 10.0.2.105 58656 -> 128.255.183.224 9027 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/01/30 08:30:19.596585 3.000957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:30:26.603278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:30:34.605040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:30:50.608174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:31:22.613893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:37:26.620587 3.000792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:37:33.627511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:37:41.628596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:37:57.631880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:38:29.637747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:44:33.644908 3.000862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:44:40.651288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:44:48.652719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:45:04.655822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:45:36.662038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:47:29.314158 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 08:47:29.314367 0.029359 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:29.344347 0.068846 udp 10.0.2.105 7010 <-> 79.10.2.161 6208 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:29.413571 0.219528 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:29.633505 1.111026 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:30.781160 0.074647 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:30.856392 0.142871 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:30.999639 0.076217 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.076313 0.078790 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.155497 0.046971 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.202862 0.072569 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.275828 0.040268 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.316551 0.175218 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.492348 0.395225 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:31.887979 0.214068 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.102485 0.063421 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.166300 0.144189 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.310895 0.170126 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.481440 0.130867 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.612729 0.074412 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.687577 0.095890 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:32.783850 0.216440 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.000656 0.142665 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.143690 0.166592 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.310704 0.242337 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.553430 0.206026 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.759866 0.059779 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:33.820064 0.188497 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.009007 0.075727 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.085142 0.169106 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.254687 0.062564 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.317616 0.072082 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.390117 0.064760 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.455231 0.136381 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.592007 0.213131 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:34.805553 0.462960 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:47:35.268898 0.364779 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/30 08:54:48.668082 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 08:54:55.676008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:55:03.677295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:55:19.680181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:55:51.686662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 08:57:01.146681 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 08:57:01.146844 0.973317 tcp 10.0.2.105 58657 -> 128.255.183.224 9027 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:01:55.691918 3.002030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:02:02.699432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:02:10.701902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:02:26.704222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:02:58.710170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:09:03.717464 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:09:10.725220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:09:18.727153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:09:34.729903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:10:06.735721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:16:10.741638 3.001603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:16:17.748672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:16:25.750683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:16:41.753443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:17:13.759465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:17:39.497235 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 09:17:39.497347 0.199823 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:39.697582 0.029415 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:39.727621 0.000000 udp 10.0.2.105 7010 -> 79.10.2.161 6208 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 09:17:55.280893 0.078749 tcp 10.0.2.105 58658 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:17:55.359933 0.052752 tcp 10.0.2.105 58659 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:17:55.412996 0.157482 tcp 10.0.2.105 58660 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:17:55.571092 0.340651 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:55.912141 0.070717 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:55.983286 0.146940 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.130576 0.074468 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.205473 0.074301 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.280292 0.040460 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.321209 0.073742 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.395379 0.262825 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.658646 0.040230 udp 10.0.2.105 7010 <-> 194.246.126.196 6690 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.699335 0.174815 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:56.874506 0.141442 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.016482 0.168513 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.185377 0.137784 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.323924 0.213782 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.538112 0.066624 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.605128 0.073894 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.679459 0.079701 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.759548 0.215288 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:57.975305 0.149808 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.125543 0.164823 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.290864 0.060257 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.351526 0.176287 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.528177 0.242063 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.770644 0.206412 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:58.977509 0.080448 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.058355 0.176671 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.235426 0.059860 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.295680 0.163332 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.459425 0.064997 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.524829 0.141662 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.666916 0.212334 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:17:59.879698 0.319243 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:18:00.199327 0.361059 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:23:17.766317 3.000666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:23:24.772969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:23:32.774376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:23:48.777024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:24:20.803310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:27:02.125996 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 09:27:02.126109 0.963461 tcp 10.0.2.105 58661 -> 128.255.183.224 9027 FSPA* 0 0 14 1508 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:30:24.809217 3.001860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:30:31.816827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:30:39.818218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:30:55.821372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:31:27.827389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:37:31.833095 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:37:38.840759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:37:46.842209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:38:02.845155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:38:34.851396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:44:38.857225 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 09:44:45.865019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:44:53.866009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:45:09.869490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:45:41.875345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:48:13.403757 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 09:48:13.403863 0.000000 udp 10.0.2.105 7010 -> 79.10.2.161 6208 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 09:48:32.062364 0.075338 tcp 10.0.2.105 58662 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:32.138053 0.053560 tcp 10.0.2.105 58663 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:32.191883 0.150504 tcp 10.0.2.105 58664 -> 195.113.214.236 443 SRPA* 0 0 40 31912 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:32.343058 0.210948 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:32.605107 0.029660 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:32.635144 0.142313 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:32.777841 0.324802 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.103035 0.069612 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.173065 0.077631 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.251100 0.073907 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.325447 0.045934 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.371786 0.075122 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.447420 0.369071 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:33.816857 0.000000 udp 10.0.2.105 7010 -> 194.246.126.196 6690 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 09:48:50.086202 0.067116 tcp 10.0.2.105 58665 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:50.153678 0.050771 tcp 10.0.2.105 58666 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:50.204869 0.150962 tcp 10.0.2.105 58667 -> 195.113.214.236 443 SRPA* 0 0 38 33002 flow=From-Botnet-V2-TCP-Established 1970/01/30 09:48:50.356866 0.174319 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:50.531593 0.146104 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:50.678083 0.168811 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:50.847292 0.137996 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:50.985702 0.209261 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:51.195327 0.064846 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:51.260667 0.075375 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:51.336556 0.103473 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:51.440454 0.217696 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:51.658544 0.625689 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:52.284610 0.183226 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:52.468369 0.259100 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:52.727881 0.198610 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:52.926967 0.075215 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.002587 0.163662 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.166658 0.065025 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.232077 0.171947 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.404622 0.066027 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.471091 0.065686 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.537236 0.064177 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.601872 0.136959 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.739290 0.252707 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:53.992514 0.221146 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:48:54.214061 0.364090 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/30 09:54:46.882394 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 09:54:53.888897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:55:01.890324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:55:17.893564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:55:49.899491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 09:57:03.095155 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 09:57:03.095348 0.930214 tcp 10.0.2.105 58668 -> 128.255.183.224 9027 FSPA* 0 0 12 1447 flow=From-Botnet-V2-TCP-Established 1970/01/30 10:01:53.906549 3.000579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:02:00.913421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:02:08.914696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:02:24.917344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:02:56.923651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:09:04.935328 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:09:11.942819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:09:19.944195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:09:35.947264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:10:07.953223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:16:11.958888 3.001372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:16:18.966143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:16:26.967713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:16:42.970525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:17:14.977210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:19:15.941408 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 10:19:15.941656 0.000000 udp 10.0.2.105 7010 -> 194.246.126.196 6690 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 10:19:34.940379 0.073566 tcp 10.0.2.105 58669 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 10:19:35.014239 0.055153 tcp 10.0.2.105 58670 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 10:19:35.069647 0.161834 tcp 10.0.2.105 58671 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/30 10:19:35.231980 0.204470 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:35.436953 0.029391 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:35.466807 0.167711 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:35.635012 0.077603 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:35.713164 0.330954 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.044557 0.074075 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.119050 0.071791 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.191203 0.264335 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.455949 0.039646 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.495978 0.079530 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.575892 0.169640 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.745962 0.144903 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:36.891285 0.218035 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.109761 0.062650 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.172875 0.143530 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.316809 0.171206 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.488511 0.074920 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.488894 3.007873 tcp 10.0.2.105 58672 -> 76.69.98.57 7717 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 10:19:37.563908 0.085116 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.649498 0.218737 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:37.868714 0.143095 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.012189 0.181060 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.193663 0.078468 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.272744 0.165659 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.438844 0.059307 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.498535 0.240495 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.739385 0.246515 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:38.986362 0.208521 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.195330 0.067002 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.262785 0.058713 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.321888 0.064076 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.386392 0.137748 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.524545 0.365228 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:39.890153 0.217952 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:40.108804 0.415848 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:19:46.495190 0.000000 tcp 10.0.2.105 58672 -> 76.69.98.57 7717 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 10:23:18.983264 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 10:23:25.990579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:23:33.992006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:23:49.995183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:24:22.000770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:27:04.024636 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 10:27:04.024727 0.955439 tcp 10.0.2.105 58673 -> 128.255.183.224 9027 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/01/30 10:30:26.007319 3.044177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:30:33.034282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:30:41.036233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:30:57.038797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:31:29.045392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:37:33.051042 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:37:40.058902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:37:48.059620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:38:04.062953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:38:36.069044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:44:40.075107 3.001648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:44:47.082666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:44:55.083782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:45:11.086807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:45:43.092971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:49:56.437490 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 10:49:56.437599 0.144593 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:56.582618 0.073459 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:56.656683 0.320162 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:56.977256 0.074140 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.051834 0.182970 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.235223 0.030738 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.266354 0.076138 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.342925 0.359104 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.702422 0.046451 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.749256 0.077609 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.827235 0.170234 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:57.997863 0.130803 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.129040 0.215436 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.344928 0.060842 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.406155 0.144106 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.550761 0.172578 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.723908 0.074923 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.724455 3.000293 tcp 10.0.2.105 58674 -> 76.69.98.57 7717 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 10:49:58.799275 0.083834 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:58.883472 0.222928 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:59.106782 0.277403 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:59.384667 0.165320 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:59.550381 0.059833 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:59.610664 0.237272 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:49:59.848504 0.205316 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.054228 0.181077 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.235771 0.075220 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.311403 0.183878 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.495697 0.065939 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.562090 0.058900 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.621405 0.063251 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.685030 0.136182 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:00.821581 0.362030 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:01.184031 0.212084 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:01.396667 0.221333 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/30 10:50:07.723536 0.000000 tcp 10.0.2.105 58674 -> 76.69.98.57 7717 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/30 10:54:48.100552 3.000318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 10:54:55.107084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:55:03.108657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:55:19.111190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:55:51.117350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 10:57:04.983964 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 10:57:04.984109 0.972712 tcp 10.0.2.105 58675 -> 128.255.183.224 9027 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:01:55.122897 3.002517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:02:02.131352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:02:10.132196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:02:26.135197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:02:58.140993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:09:06.153433 3.001210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:09:13.160302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:09:21.161985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:09:37.164994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:10:09.171001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:16:13.176661 3.001575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:16:20.184338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:16:28.186027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:16:44.189070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:17:16.194920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:20:07.451342 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 11:20:07.451571 0.392404 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:07.844434 0.076813 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:07.921726 0.140253 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.062407 0.071276 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.134092 0.196516 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.331015 0.029045 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.360485 0.071758 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.432748 0.313141 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.746326 0.040008 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.786782 0.079428 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:08.866662 0.209014 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.076098 0.063586 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.140104 0.174134 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.314646 0.144757 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.459926 0.141976 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.460499 2.929834 tcp 10.0.2.105 58676 -> 128.255.183.224 9027 FSPA* 0 0 534 628668 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:20:09.602290 0.170428 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.773155 0.074163 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.847712 0.073582 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:09.921671 0.269663 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:10.191766 0.060794 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:10.253002 1.546317 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:12.252292 0.144847 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:12.397586 0.165741 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:12.563746 0.205378 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:12.769530 0.183900 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:12.953812 0.071155 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.025332 0.167908 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.193785 0.063176 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.257383 0.143192 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.401039 0.360131 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.761623 0.064136 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.826141 0.057879 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:13.884439 0.211587 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:20:14.096457 0.221639 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:23:20.201266 3.001379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:23:27.209326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:23:35.209827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:23:51.212725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:24:23.218530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:27:05.963199 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 11:27:05.963303 0.996986 tcp 10.0.2.105 58677 -> 128.255.183.224 9027 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:30:27.225328 3.000743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:30:34.232354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:30:42.233750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:30:58.236804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:31:30.242701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:37:34.248999 3.001230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:37:41.256256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:37:49.257966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:38:05.260444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:38:37.266778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:44:41.272898 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:44:48.280357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:44:56.282032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:45:12.284542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:45:44.291300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:50:19.416612 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 11:50:19.416796 0.143645 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:19.672830 0.079090 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:19.752318 0.431317 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:20.184070 0.079840 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:20.264304 1.384122 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:21.648830 0.029233 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:21.678470 0.076874 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:21.755773 0.000000 udp 10.0.2.105 7010 -> 95.89.168.173 6418 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 11:50:38.945839 0.044769 tcp 10.0.2.105 58678 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:50:38.990916 0.032059 tcp 10.0.2.105 58679 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:50:39.023247 0.149813 tcp 10.0.2.105 58680 -> 195.113.214.236 443 SRPA* 0 0 45 27214 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:50:39.173657 0.039273 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.213355 0.077108 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.290882 0.209654 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.500943 0.063730 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.565074 0.179183 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.744674 0.138024 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:39.894258 0.144350 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.039022 0.171300 udp 10.0.2.105 7010 <-> 76.69.98.57 5067 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.210770 0.073960 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.285104 0.084585 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.370130 0.244954 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.615558 0.058918 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:40.674862 1.357722 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:42.033066 0.151734 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:42.185234 0.167874 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:42.353645 1.008533 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:43.362646 0.190071 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:43.553186 0.077822 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:43.631339 0.174241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:43.805956 0.358656 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:44.165072 0.065880 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:50:44.231374 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 11:51:03.199508 0.044263 tcp 10.0.2.105 58681 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:51:03.244113 0.032994 tcp 10.0.2.105 58682 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:51:03.277393 0.153561 tcp 10.0.2.105 58683 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:51:03.431479 0.216192 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:51:03.648099 0.064658 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:51:03.713130 0.141940 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:51:03.855455 0.212430 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/30 11:51:48.297094 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 11:51:55.304112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:52:03.305729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:52:19.308702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:52:51.314800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:57:06.963076 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 11:57:06.963282 0.953197 tcp 10.0.2.105 58684 -> 128.255.183.224 9027 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/01/30 11:58:55.320464 3.002101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 11:59:02.328188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:59:10.329758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:59:26.333019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 11:59:58.338780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:06:26.349059 3.001780 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 12:06:33.356554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:06:41.358166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:06:57.361052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:07:29.367132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:13:36.378130 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 12:13:43.385044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:13:51.386331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:14:07.389600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:14:39.395418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:20:43.401494 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 12:20:50.408848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:20:58.410362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:21:14.413481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:21:15.805839 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 12:21:15.805946 0.323612 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:16.129949 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 12:21:34.524598 0.045392 tcp 10.0.2.105 58685 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:34.570326 0.032770 tcp 10.0.2.105 58686 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:34.603389 0.132752 tcp 10.0.2.105 58687 -> 195.113.214.236 443 SRPA* 0 0 24 13864 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:34.736751 0.150617 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:34.887785 1.218617 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.106798 0.072237 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.179448 0.083290 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.263115 0.071188 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.334726 0.030376 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.365514 0.182995 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.548958 0.212807 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.762181 0.064922 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.827508 0.074513 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.902465 0.052814 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:36.955722 0.143278 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:37.099506 0.000000 udp 10.0.2.105 7010 -> 76.69.98.57 5067 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 12:21:46.419360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:21:54.992623 0.150089 tcp 10.0.2.105 58688 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:55.143005 0.031678 tcp 10.0.2.105 58689 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:55.174960 0.144406 tcp 10.0.2.105 58690 -> 195.113.214.236 443 SRPA* 0 0 40 31912 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:21:55.320147 0.086362 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:55.406976 0.085019 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:55.492690 0.144775 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:55.637841 0.176002 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:55.814274 0.220716 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.035481 0.059232 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.095138 0.235793 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.331368 0.143684 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.475452 0.165396 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.641206 0.206017 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.847685 0.079744 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:56.927803 0.172945 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.101150 0.363657 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.465244 0.171808 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.637493 0.066045 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.703941 0.215606 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.919983 0.061521 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:57.982289 0.142576 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:21:58.125236 0.216528 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:27:07.922366 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 12:27:07.922560 0.934828 tcp 10.0.2.105 58691 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:27:50.425350 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 12:27:57.432717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:28:05.434528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:28:21.437391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:28:53.443320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:34:57.450021 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 12:35:04.456945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:35:12.458172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:35:28.461257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:36:00.467456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:42:04.474124 3.000919 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 12:42:11.481390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:42:19.482752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:42:35.485366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:43:07.491408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:52:15.749938 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 12:52:15.750187 0.170246 udp 10.0.2.105 7010 -> 76.69.98.57 5067 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 12:52:15.920433 0.000000 icmp 76.69.98.57 0x0303 -> 10.0.2.105 0xcb13 URP 192 1 274 flow=Background 1970/01/30 12:52:34.448296 0.044375 tcp 10.0.2.105 58692 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:34.492946 0.077308 tcp 10.0.2.105 58693 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:34.570561 0.148401 tcp 10.0.2.105 58694 -> 195.113.214.236 443 SRPA* 0 0 39 20430 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:34.719429 0.382288 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:35.102157 0.143660 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:35.246226 1.105944 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:36.352748 0.073384 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:36.426579 0.028995 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:36.455972 0.000000 udp 10.0.2.105 7010 -> 217.41.11.145 4358 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 12:52:55.136923 0.043230 tcp 10.0.2.105 58695 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:55.180589 0.031621 tcp 10.0.2.105 58696 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:55.212546 0.135888 tcp 10.0.2.105 58697 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:52:55.349077 0.074740 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:55.424307 0.206928 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:55.631706 0.061083 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:55.693232 0.077535 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:55.771205 0.047257 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:52:55.818868 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 12:53:11.740923 0.042909 tcp 10.0.2.105 58698 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:53:11.784111 0.032375 tcp 10.0.2.105 58699 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:53:11.816750 0.131991 tcp 10.0.2.105 58700 -> 195.113.214.236 443 SRPA* 0 0 33 18764 flow=From-Botnet-V2-TCP-Established 1970/01/30 12:53:11.949285 0.195257 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.144940 0.073504 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.218872 0.080392 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.299681 0.137778 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.437946 0.174610 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.612918 0.252704 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.866055 0.060467 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:12.926911 0.164263 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.091640 0.206171 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.298232 0.073472 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.372149 0.182841 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.555465 0.239003 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.794919 0.143959 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:13.939260 0.599526 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:14.539242 0.172180 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:14.711873 0.065559 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:14.777839 0.211945 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:14.990187 0.061649 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:15.052434 0.139659 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:15.192494 0.224462 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 12:53:32.502272 3.002356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 12:53:39.510122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:53:47.511538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:54:03.514883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:54:35.520818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 12:57:08.861602 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 12:57:08.861800 0.900193 tcp 10.0.2.105 58701 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/30 13:00:39.526094 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:00:46.533958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:00:54.535700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:01:10.538635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:01:42.544869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:07:46.550440 3.001709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:07:53.557888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:08:01.559528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:08:17.562523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:08:49.568529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:14:53.574491 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:15:00.581750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:15:08.583352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:15:24.586692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:15:56.592293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:22:00.599432 3.000734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:22:07.606573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:22:15.607442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:22:31.610708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:23:03.616441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:23:31.427096 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 13:23:31.427245 0.144778 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:31.572532 0.077157 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:31.650157 0.138978 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:31.789558 0.452683 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:32.242681 1.053250 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.296371 0.029584 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.326363 0.071323 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.398129 0.076832 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.475371 0.046089 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.521877 0.064828 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.587168 0.212961 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.800585 0.077912 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:33.878979 0.199413 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.078806 0.088521 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.167779 0.078888 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.247180 0.130929 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.378574 0.171626 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.550628 0.218896 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.769953 0.200354 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:34.970774 0.072600 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.043857 0.178438 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.222750 0.060531 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.283700 0.166554 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.450663 0.230329 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.681423 0.145503 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:35.827376 0.364244 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:36.192033 0.172604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:36.365055 0.060726 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:36.426232 0.151307 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:36.577934 0.221139 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:36.799502 0.216432 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:23:37.016406 0.059342 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:27:09.761131 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 13:27:09.761334 1.161855 tcp 10.0.2.105 58702 -> 128.255.183.224 9027 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/30 13:29:07.623411 3.000448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 13:29:14.629985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:29:22.631300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:29:38.634250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:30:10.640772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:36:14.646355 3.004731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:36:21.653751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:36:29.655892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:36:45.658295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:37:17.664348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:43:21.671219 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:43:28.677917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:43:36.679318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:43:52.682276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:44:24.688368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:53:55.609464 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 13:53:55.609753 0.144523 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:55.754814 0.139117 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:55.894342 0.074622 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:55.969373 0.221519 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.191274 0.324763 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.516584 0.028755 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.545765 0.072017 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.618217 0.075759 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.694372 0.046948 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.741717 0.059223 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:56.801380 0.206510 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.008341 0.080523 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.089261 0.187961 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.277721 0.074380 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.352606 0.081067 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.434140 0.145050 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.579637 0.177577 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:57.757652 0.258237 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:58.016376 0.456496 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:58.473313 0.072684 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:58.546405 0.163939 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:58.710805 0.234621 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:58.945823 0.257133 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:59.203399 0.364459 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:59.568235 0.178276 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:59.746904 0.059114 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:59.806482 0.172434 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:53:59.979408 0.063988 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:54:00.043783 0.141655 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:54:00.185976 0.222854 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:54:00.409268 0.211305 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:54:00.621014 0.062813 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/30 13:54:11.694956 3.002041 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 13:54:18.702375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:54:26.703741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:54:42.707027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:55:14.712964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 13:57:10.933059 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 13:57:10.933215 0.922491 tcp 10.0.2.105 58703 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/30 14:01:18.720253 3.001006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:01:25.727069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:01:33.727699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:01:49.731479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:02:21.737021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:08:25.742972 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:08:32.750304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:08:40.751685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:08:56.755138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:09:28.760786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:15:32.767600 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:15:39.774338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:15:47.775463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:16:03.778512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:16:35.784729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:22:39.790474 3.012305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:22:46.808279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:22:54.809714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:23:10.812789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:23:42.818528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:24:14.694944 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 14:24:14.695097 0.074486 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:14.770027 0.170295 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:14.940705 0.142537 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.083641 0.152411 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.236494 0.324946 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.561908 0.029243 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.591642 0.069328 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.661341 0.083719 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.745484 0.046299 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.792187 0.076165 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:15.868793 0.206366 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.075515 0.075188 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.284968 0.093453 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.378899 0.060999 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.440333 0.214966 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.655751 0.145061 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.801281 0.174824 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:16.976546 0.213841 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:17.190847 0.167050 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:17.358291 0.207937 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:17.566758 0.071463 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:17.638617 0.269991 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:17.908995 0.142878 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.052384 0.365084 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.417938 0.175687 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.594071 0.058669 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.653160 0.176996 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.830557 0.063745 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:18.894692 0.217763 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:19.112888 0.062583 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:19.176011 0.135588 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:24:19.312109 0.219814 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:27:11.859744 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 14:27:11.859922 1.097389 tcp 10.0.2.105 58704 -> 128.255.183.224 9027 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/01/30 14:29:46.824673 3.001924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 14:29:53.832281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:30:01.833736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:30:17.836638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:30:49.842777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:36:53.849249 3.001296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:37:00.856163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:37:08.857516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:37:24.860697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:37:56.866787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:44:00.873230 3.000881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:44:07.879910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:44:15.881840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:44:31.884738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:45:03.890617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:54:31.899786 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 14:54:38.907290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:54:39.738803 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 14:54:39.738910 0.144243 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:39.883642 0.044266 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:39.928476 0.075451 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.004481 0.142906 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.147917 0.358693 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.507011 0.029548 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.536971 0.074003 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.611501 0.076917 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.688809 0.040994 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.730249 0.071534 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:40.802197 0.206805 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.009407 0.073294 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.083101 0.099532 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.183025 0.060392 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.243866 0.210669 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.455004 0.130986 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.586443 0.174217 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:41.761194 0.265812 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:42.027383 0.075650 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:42.103403 0.227009 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:54:42.330865 0.000000 udp 10.0.2.105 7010 -> 67.71.151.221 6231 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 14:54:46.908310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:55:00.961197 0.060672 tcp 10.0.2.105 58705 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 14:55:01.022164 0.054942 tcp 10.0.2.105 58706 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 14:55:01.077375 0.126627 tcp 10.0.2.105 58707 -> 195.113.214.236 443 SRPA* 0 0 63 61358 flow=From-Botnet-V2-TCP-Established 1970/01/30 14:55:01.205117 0.164249 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:01.369823 0.202652 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:01.572883 0.364431 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:01.937699 0.177572 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.115732 0.059446 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.175586 0.175676 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.351680 0.066854 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.418959 0.213040 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.632620 0.058508 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.691576 0.161580 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.853555 0.327296 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/30 14:55:02.912112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:55:34.917862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 14:57:12.959293 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 14:57:12.959450 1.093404 tcp 10.0.2.105 58708 -> 128.255.183.224 9027 FSPA* 0 0 12 1622 flow=From-Botnet-V2-TCP-Established 1970/01/30 15:01:38.923597 3.002054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:01:45.931466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:01:53.932834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:02:09.935283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:02:41.941940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:08:45.947791 3.001969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:08:52.955439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:09:00.957083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:09:16.959704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:09:48.965808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:15:52.971866 3.001734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:15:59.978659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:16:07.980551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:16:23.983900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:16:55.989816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:22:59.995686 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:23:07.003217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:23:15.004715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:23:31.007999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:24:03.013753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:25:22.618452 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 15:25:22.618552 0.147708 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:22.766738 0.144588 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:22.911715 0.046595 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:22.958727 0.326585 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.285765 0.030623 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.316907 0.069739 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.387089 0.073171 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.460724 0.165928 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.627092 0.074623 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.702107 0.188144 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.890658 0.074266 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:23.965315 0.074083 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.039927 0.065687 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.106099 0.077220 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.183759 0.045005 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.229214 0.179368 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.409069 0.138103 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.547613 0.207959 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.756062 0.218015 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:24.974428 0.071852 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:25.046687 0.225206 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:25.272322 0.359690 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:25.632461 0.165534 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:25.798372 0.293768 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.092684 0.178077 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.271170 0.059077 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.330704 0.177209 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.508384 0.063772 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.572764 0.218772 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:26.791936 0.215441 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:27.007826 0.060545 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:25:27.068837 0.141807 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:27:14.058903 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 15:27:14.059085 0.958809 tcp 10.0.2.105 58709 -> 128.255.183.224 9027 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/01/30 15:30:07.019815 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 15:30:14.027425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:30:22.028575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:30:38.031738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:31:10.038282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:37:14.043318 3.012269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:37:21.061212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:37:29.062697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:37:45.065570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:38:17.071741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:44:21.078593 3.000322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:44:28.085296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:44:36.086716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:44:52.089198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:45:24.095378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:54:37.103577 3.001779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 15:54:44.110989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:54:52.112574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:55:08.115432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:55:40.122043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 15:55:48.283562 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 15:55:48.283776 0.045286 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:48.329514 0.459319 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:48.789263 0.146504 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:48.936143 0.602602 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.539154 0.028989 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.568594 0.071681 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.640672 0.075461 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.716615 0.148876 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.865857 0.073109 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:49.939431 0.183451 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.123371 0.086548 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.210317 0.077259 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.288066 0.061652 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.350124 0.078865 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.429421 0.039891 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.469778 0.224891 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.695087 0.123874 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:50.819368 0.212547 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.032377 0.228081 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.260913 0.074614 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.335997 0.165474 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.501927 0.198855 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.701164 0.227464 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:51.929009 0.363994 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.293407 0.174014 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.467854 0.058712 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.527046 0.173472 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.700944 0.063095 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.764452 0.226607 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:52.991514 0.214869 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:53.206788 0.063629 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:55:53.270820 0.135224 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 15:57:15.018357 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 15:57:15.018525 0.892337 tcp 10.0.2.105 58710 -> 128.255.183.224 9027 FSPA* 0 0 15 1720 flow=From-Botnet-V2-TCP-Established 1970/01/30 16:01:44.128813 3.000263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 16:01:51.134799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:01:59.136955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:02:15.139663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:02:47.145282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:08:51.151645 3.001343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:08:58.158456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:09:06.159747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:09:22.164174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:09:54.169402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:15:58.176368 3.000668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:16:05.182803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:16:13.184117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:16:29.187423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:17:01.194463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:23:05.200453 3.000348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:23:12.206777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:23:20.208356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:23:36.211147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:24:08.217549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:26:12.506498 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 16:26:12.506604 0.045995 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:12.553113 0.549817 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.103323 0.139560 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.243284 0.072691 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.316502 0.073836 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.390799 0.327335 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.718652 0.029939 udp 10.0.2.105 7010 <-> 79.219.110.217 2430 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.749031 0.141532 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.890980 0.076399 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:13.967782 0.197557 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.165757 0.074376 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.240503 0.096297 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.337242 0.061891 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.399555 0.080001 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.480003 0.040089 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.520585 0.198094 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.719110 0.131041 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:14.850568 0.211279 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.062223 0.166560 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.229197 0.212688 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.442324 0.236664 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.679450 0.074653 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.754500 0.177366 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:15.932288 0.436094 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:16.368887 0.358200 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:16.727511 0.062631 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:16.790597 0.174838 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:16.965902 0.064092 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:17.030445 0.211768 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:17.242630 0.135914 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:17.378994 0.219800 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:26:17.599259 0.061549 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:27:15.917449 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 16:27:15.917603 0.945458 tcp 10.0.2.105 58711 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/30 16:30:12.223558 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 16:30:19.230539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:30:27.232043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:30:43.235216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:31:15.241321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:37:19.246703 3.002261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:37:26.254769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:37:34.256363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:37:50.259168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:38:22.265280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:44:26.270479 3.002646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:44:33.278555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:44:41.280077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:44:57.283269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:45:29.289409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:54:41.295249 3.002225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 16:54:48.303681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:54:56.304226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:55:12.307475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:55:44.313511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 16:56:45.171138 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 16:56:45.171392 0.045683 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:45.217500 0.145170 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:45.363087 0.144277 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:45.507880 0.071633 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:45.579968 0.074377 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:45.654830 0.380182 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:56:46.035447 0.000000 udp 10.0.2.105 7010 -> 79.219.110.217 2430 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 16:57:04.320664 0.044598 tcp 10.0.2.105 58712 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 16:57:04.365525 0.030994 tcp 10.0.2.105 58713 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 16:57:04.396871 0.122328 tcp 10.0.2.105 58714 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/30 16:57:04.519966 0.141794 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:04.662151 0.076639 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:04.739196 0.205085 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:04.944713 0.075268 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.020523 0.083879 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.104779 0.061099 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.166306 0.077875 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.244559 0.046383 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.291366 0.175813 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.467647 0.123776 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.591853 0.219819 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:05.812052 0.221324 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:06.033730 0.076684 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:06.110809 0.174671 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:06.285897 0.165577 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:06.451859 0.889232 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:07.341538 0.222207 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:07.564154 0.363375 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:07.927974 0.059923 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:07.988318 0.169275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:08.157974 0.065771 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:08.224458 0.225195 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:08.450061 0.059970 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:08.510452 0.213296 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:08.724158 0.148666 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 16:57:16.866818 0.936497 tcp 10.0.2.105 58715 -> 128.255.183.224 9027 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:01:48.319272 3.002086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 17:01:55.327489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:02:03.328459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:02:19.331418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:02:51.337376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:08:56.345826 3.000519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:09:03.352429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:09:11.353988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:09:27.356851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:09:59.363027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:16:03.369122 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:16:10.376399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:16:18.377974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:16:34.380722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:17:06.386786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:23:10.392455 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:23:17.399657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:23:25.411806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:23:41.414985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:24:13.420985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:27:11.297198 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 17:27:11.297365 0.000000 udp 10.0.2.105 7010 -> 79.219.110.217 2430 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 17:27:17.806568 0.979965 tcp 10.0.2.105 58716 -> 128.255.183.224 9027 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:27:29.494050 0.042083 tcp 10.0.2.105 58717 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:27:29.536590 0.031613 tcp 10.0.2.105 58718 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:27:29.568534 0.123834 tcp 10.0.2.105 58719 -> 195.113.214.236 443 SRPA* 0 0 40 33960 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:27:29.693226 0.143538 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:29.837161 0.067438 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:29.905052 0.071635 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:29.977119 0.822981 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:30.800520 0.045785 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:30.846782 0.322962 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.170210 0.186696 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.357317 0.075149 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.432906 0.144628 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.577947 0.076759 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.655185 0.083810 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.739374 0.062785 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.802624 0.075430 udp 10.0.2.105 7010 <-> 213.123.0.137 1035 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.878402 0.039595 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:31.918478 0.174976 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.093940 0.137849 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.232312 0.073638 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.306374 0.177269 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.484085 0.219166 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.703668 0.222683 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:32.926731 0.165255 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:33.092419 0.197198 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:33.290000 0.222893 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:33.513298 0.363967 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:33.877687 0.059207 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:33.937391 0.172321 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:34.110161 0.065330 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:34.175914 0.214656 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:34.390943 0.139218 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:34.530514 0.224443 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:27:34.755390 0.060018 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:30:17.427797 3.000762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:30:24.434136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:30:32.435878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:30:48.438816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:31:20.444768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:37:24.450625 3.002370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:37:31.458223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:37:39.459772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:37:55.462732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:38:27.469017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:44:31.475513 3.001017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:44:38.482348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:44:46.483438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:45:02.486786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:45:34.492779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:54:44.506013 3.001976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 17:54:51.513492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:54:59.515021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:55:15.518537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:55:47.524058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 17:57:18.785962 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 17:57:18.786081 0.940428 tcp 10.0.2.105 58720 -> 128.255.183.224 9027 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:58:00.836102 0.077173 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:00.913708 0.142803 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.056909 0.072264 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.129558 0.359044 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.489043 0.142077 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.631553 0.044109 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.676096 0.181928 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.858387 0.075066 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:01.933996 0.141001 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:02.075386 0.072390 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:02.148191 0.077158 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:02.225756 0.059750 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:02.285956 0.000000 udp 10.0.2.105 7010 -> 213.123.0.137 1035 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 17:58:05.552767 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 17:58:19.264628 0.062896 tcp 10.0.2.105 58721 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:58:19.327767 0.052678 tcp 10.0.2.105 58722 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:58:19.380727 0.144784 tcp 10.0.2.105 58723 -> 195.113.214.236 443 SRPA* 0 0 20 11292 flow=From-Botnet-V2-TCP-Established 1970/01/30 17:58:19.526142 0.045628 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:19.572183 0.174739 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:19.747361 0.137816 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:19.885671 0.071749 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:19.957828 0.174168 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:20.132433 0.217296 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:20.350129 0.225144 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:20.575624 0.165463 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:20.741567 1.065227 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:21.807226 0.219480 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.027151 0.364100 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.391684 0.059843 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.451940 0.172653 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.625034 0.063024 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.688502 0.221282 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.910216 0.058976 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:22.969603 0.218325 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/01/30 17:58:23.188544 0.142426 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:01:51.529975 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 18:01:58.537964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:02:06.538935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:02:22.542267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:02:54.548166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:09:00.561569 2.998860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:09:07.564353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:09:15.565709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:09:31.571274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:10:03.574897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:16:07.581547 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:16:14.588343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:16:22.589739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:16:38.592763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:17:10.598888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:23:14.605331 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:23:21.612564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:23:29.613829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:23:45.616879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:24:17.622969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:27:19.725652 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 18:27:19.725765 1.151772 tcp 10.0.2.105 58724 -> 128.255.183.224 9027 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/01/30 18:28:38.137715 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 18:28:38.137913 0.000000 udp 10.0.2.105 7010 -> 213.123.0.137 1035 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 18:28:53.961790 0.060422 tcp 10.0.2.105 58725 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 18:28:54.022457 0.031326 tcp 10.0.2.105 58726 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 18:28:54.054074 0.121686 tcp 10.0.2.105 58727 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/30 18:28:54.176318 0.072619 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:54.249363 0.139972 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:54.389720 0.328143 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:54.718286 0.938725 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:55.657476 0.045011 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:55.702925 0.074629 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:55.777969 0.195440 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:55.973853 0.085475 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.059707 0.060933 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.121031 0.158848 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.280359 0.075061 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.355808 0.074784 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.430968 0.040187 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.471639 0.171595 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.643667 0.131081 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.775179 0.214024 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:56.989751 0.211465 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:57.201652 0.165808 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:57.367816 0.073731 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:57.442000 0.173494 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:57.615886 0.199565 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:57.815886 0.234475 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.050793 0.361378 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.412569 0.055926 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.468913 0.168755 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.638118 0.061941 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.700534 0.213036 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:58.913960 0.144939 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:59.059352 0.065157 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:28:59.124930 0.221889 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:30:21.630190 3.000583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 18:30:28.636738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:30:36.638689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:30:52.640608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:31:24.646675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:37:28.652075 3.002669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:37:35.660315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:37:43.661656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:37:59.665015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:38:31.671039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:44:35.677556 3.020549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:44:42.694332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:44:50.695825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:45:06.699053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:45:38.704929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:54:47.716724 3.002252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 18:54:54.724631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:55:02.725793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:55:18.728937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:55:50.734802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 18:57:20.884819 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 18:57:20.884928 0.973460 tcp 10.0.2.105 58728 -> 128.255.183.224 9027 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/01/30 18:59:08.829663 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 18:59:08.829869 0.327168 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.157441 0.076637 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.234465 0.146351 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.381250 0.502431 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.884098 0.043897 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.928581 0.070541 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:09.999547 0.198768 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.198795 0.085722 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.284945 0.059991 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.345433 0.170472 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.516517 0.074795 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.591851 0.069443 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.661761 0.046466 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.708755 0.171144 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:10.880365 0.144950 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:11.025718 0.208083 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:11.234213 0.210984 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:11.445648 0.172436 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:11.618517 0.203370 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:11.822287 0.229287 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.052022 0.166233 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.218646 0.070655 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.289717 0.358705 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.648839 0.059281 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.708514 0.169571 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.878504 0.061387 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:12.940514 0.211550 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:13.152518 0.134786 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:13.287707 0.067277 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/30 18:59:13.355403 0.222976 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:01:54.741575 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 19:02:01.747933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:02:09.749682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:02:25.753013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:02:57.758926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:09:04.770533 3.000528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:09:11.776678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:09:19.777698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:09:35.780703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:10:07.787081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:16:11.792247 3.002312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:16:18.800139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:16:26.801914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:16:42.804792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:17:14.810717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:23:18.817803 3.000802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:23:25.824375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:23:33.825733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:23:49.828617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:24:21.834807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:27:21.864015 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 19:27:21.864167 0.901177 tcp 10.0.2.105 58729 -> 128.255.183.224 9027 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/01/30 19:29:32.632107 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 19:29:32.632413 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 19:29:50.269129 0.063896 tcp 10.0.2.105 58730 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 19:29:50.333327 0.030561 tcp 10.0.2.105 58731 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 19:29:50.364208 0.125540 tcp 10.0.2.105 58732 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/30 19:29:50.490457 0.440538 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:50.931518 0.046087 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:50.978071 0.073356 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.051890 0.387761 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.440128 0.072062 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.512639 0.200913 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.714040 0.084279 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.798800 0.060423 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:51.859668 0.143904 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.003998 0.075080 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.079524 0.077360 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.157324 0.046016 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.203869 0.171696 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.375998 0.144626 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.521064 0.205475 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.726914 0.211840 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:52.939131 0.169295 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:53.108909 0.238265 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:53.347538 0.269480 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:53.617471 0.166528 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:53.784420 0.074793 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:53.859649 0.360442 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.220738 0.061075 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.282214 0.168967 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.451641 0.060504 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.512611 0.246171 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.759193 0.227455 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:54.987094 0.143777 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:29:55.131321 0.066026 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:30:25.841212 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 19:30:32.848172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:30:40.849488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:30:56.852775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:31:28.858766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:37:32.866239 3.000274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:37:39.872396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:37:47.873552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:38:03.876850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:38:35.882763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:44:39.888838 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:44:46.896326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:44:54.897665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:45:10.900612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:45:42.906875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:54:49.916932 3.000617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 19:54:56.923413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:55:04.925016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:55:20.927842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:55:52.934102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 19:57:22.773454 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 19:57:22.773570 0.943170 tcp 10.0.2.105 58733 -> 128.255.183.224 9027 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/01/30 19:59:56.804694 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 19:59:56.804864 0.146142 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:56.951518 0.073322 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:57.025297 0.784904 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:57.810584 0.045466 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:57.856596 0.334042 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.191063 0.072974 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.264666 0.195823 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.460906 0.079565 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.540938 0.061270 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.602660 0.144098 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.747260 0.073609 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.821265 0.080879 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.902532 0.044945 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:58.947863 0.171609 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:59.119920 0.151837 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:59.272181 0.205709 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:59.478328 0.212606 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:59.691369 0.172508 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 19:59:59.864283 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 20:00:18.737877 0.063580 tcp 10.0.2.105 58734 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:18.801814 0.032055 tcp 10.0.2.105 58735 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:18.834216 0.125591 tcp 10.0.2.105 58736 -> 195.113.214.236 443 SRPA* 0 0 30 22094 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:18.960574 0.081095 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:19.042108 0.365708 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:19.408439 1.211150 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:20.620043 0.221437 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:20.841942 0.062936 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:20.905316 0.170604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:21.076567 0.061053 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:21.138076 0.213097 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:21.351552 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 20:00:38.024475 0.060195 tcp 10.0.2.105 58737 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:38.084959 0.031842 tcp 10.0.2.105 58738 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:38.117151 0.125604 tcp 10.0.2.105 58739 -> 195.113.214.236 443 SRPA* 0 0 22 12882 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:00:38.243278 0.135046 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:00:38.378819 0.062388 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:01:56.939721 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/30 20:02:03.947471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:02:11.948419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:02:27.951902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:02:59.957892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:09:06.968625 3.000565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:09:13.975459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:09:21.977241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:09:37.980055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:10:09.986114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:16:13.992496 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:16:20.998892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:16:29.001051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:16:45.003601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:17:17.011830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:23:21.017109 3.019695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:23:28.033155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:23:36.034999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:23:52.038166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:24:24.043970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:27:23.723151 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 20:27:23.723343 0.938019 tcp 10.0.2.105 58740 -> 128.255.183.224 9027 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:30:28.050312 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:30:35.057415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:30:43.059158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:30:52.012524 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 20:30:52.012652 0.165908 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.179050 0.271947 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.451479 0.144114 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.596098 0.071330 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.667834 0.073745 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.742079 0.048354 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:52.790819 0.965274 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:53.756544 0.322094 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.079028 0.080785 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.160435 0.196733 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.357627 0.076239 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.434261 0.045198 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.479884 0.170546 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.650841 0.144025 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.795363 0.061341 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.857116 0.073116 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:54.930746 0.137686 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:55.068862 0.211758 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:55.281151 0.202985 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:55.484586 0.172618 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:55.657639 0.427337 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.085379 0.072686 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.158449 0.064026 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.222954 0.168142 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.391490 0.219679 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.611563 0.203679 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.815722 0.063760 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:56.879871 0.213157 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:57.093414 0.139334 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:57.233149 0.064646 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/30 20:30:59.061938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:31:31.068001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:37:35.074653 3.000929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:37:42.081606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:37:50.082962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:38:06.086238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:38:38.091872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:44:42.098174 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:44:49.105379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:44:57.117198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:45:13.120374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:45:45.125881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:51:49.132348 3.001227 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:51:56.139510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:52:04.150786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:52:20.153654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:52:52.160056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:57:24.662131 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 20:57:24.662298 0.979414 tcp 10.0.2.105 58741 -> 128.255.183.224 9027 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/01/30 20:58:56.176065 3.001735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 20:59:03.183409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:59:11.184999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:59:27.187986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 20:59:59.194059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:01:06.541275 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 21:01:06.541394 0.165864 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:06.707753 0.221064 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:06.929308 0.141155 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:07.070940 0.067277 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:07.138681 0.078911 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:07.218063 0.045989 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:07.264671 0.076496 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:07.341617 0.993157 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:08.335201 0.335299 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:08.670965 0.202529 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:08.873933 0.089656 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:08.964058 0.045847 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.010317 0.170472 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.181276 0.140496 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.322145 0.060470 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.383027 0.081789 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.465296 0.151778 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.617475 0.174765 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:09.792674 0.625953 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:10.418997 0.072332 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:10.491783 0.062804 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:10.554999 0.212351 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:10.767810 0.203083 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:10.971342 0.169902 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.141676 0.225921 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.368072 0.202600 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.571101 0.059397 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.630972 0.211224 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.842619 0.144541 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:01:11.987569 0.068047 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:06:26.214175 3.000462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:06:33.220420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:06:41.221957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:06:57.224830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:07:29.230677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:13:38.243770 3.001902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:13:45.251552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:13:53.253109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:14:09.256564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:14:41.262089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:20:45.267773 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:20:52.275665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:21:00.295434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:21:16.290110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:21:48.296053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:27:25.641472 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 21:27:25.641619 0.962699 tcp 10.0.2.105 58742 -> 128.255.183.224 9027 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/01/30 21:27:52.302097 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:27:59.309542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:28:07.310949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:28:23.313857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:28:55.320065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:31:20.298294 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 21:31:20.298462 0.167012 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:20.465907 0.220178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:20.686562 0.139303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:20.826299 0.071225 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:20.897986 0.076937 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:20.975307 0.044131 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.019841 0.085482 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.105722 0.262240 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.368438 0.076681 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.445567 0.039971 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.485930 0.170849 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.657214 0.324581 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:21.982286 0.197859 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.180758 0.169629 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.350812 0.061259 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.412498 0.074497 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.487402 0.137850 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.625683 0.175585 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.801739 0.060257 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:22.862475 0.213803 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:23.076677 0.205039 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:23.282140 0.594544 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:23.877089 0.075760 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:23.953260 0.170453 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:24.124176 0.221017 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:24.345561 0.287920 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:24.633867 0.063622 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:24.697960 0.215321 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:31:24.913677 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/30 21:31:43.664176 0.068001 tcp 10.0.2.105 58743 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/30 21:31:43.732675 0.053277 tcp 10.0.2.105 58744 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/30 21:31:43.786164 0.147295 tcp 10.0.2.105 58745 -> 195.113.214.236 443 SRPA* 0 0 44 36218 flow=From-Botnet-V2-TCP-Established 1970/01/30 21:31:43.934051 0.066259 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/30 21:34:59.326093 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:35:06.333401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:35:14.334950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:35:30.338014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:36:02.343921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:42:06.349560 3.062259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:42:13.392048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:42:21.369164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:42:37.372055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:43:09.387952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:53:30.403446 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 21:53:37.411210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:53:45.412470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:54:01.415746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:54:33.421709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 21:57:26.610996 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 21:57:26.611158 0.965690 tcp 10.0.2.105 58746 -> 128.255.183.224 9027 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/01/30 22:00:37.427373 3.001941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:00:44.434874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:00:52.436685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:01:08.439510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:01:40.445327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:02:12.882226 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 22:02:12.882370 0.135837 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.018649 0.215823 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.234848 0.144392 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.379668 0.068503 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.448650 0.077836 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.526866 0.043305 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.570585 0.071702 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.642744 0.165120 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.808295 0.046522 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:13.855272 0.754852 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:14.610547 0.347416 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:14.958384 0.187314 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.146114 0.172486 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.318994 0.069633 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.389061 0.074850 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.464353 0.145450 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.610280 0.171809 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.782580 0.059992 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:15.842950 0.211755 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:16.055113 0.055122 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:16.110675 0.182421 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:16.293540 0.168468 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:16.462447 0.204466 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:16.667337 0.610321 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:17.278102 0.071784 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:17.350289 0.058822 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:17.409545 0.213292 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:17.623289 0.402480 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:18.026225 0.689362 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:02:18.715966 0.061668 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:07:44.451941 3.001204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:07:51.459012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:07:59.460530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:08:15.463348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:08:47.469694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:14:51.475160 3.001983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:14:58.482730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:15:06.484379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:15:22.487457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:15:54.493516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:21:58.502173 2.998574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:22:05.506973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:22:13.508252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:22:29.511316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:23:01.517343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:27:27.580818 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 22:27:27.580956 0.944304 tcp 10.0.2.105 58747 -> 128.255.183.224 9027 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/01/30 22:29:05.523449 3.001867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:29:12.530576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:29:20.532321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:29:36.535396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:30:08.541475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:32:26.880446 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 22:32:26.880641 0.142806 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.023819 0.262434 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.286628 0.144672 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.431722 0.073077 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.505182 0.077872 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.583514 0.043895 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.627824 0.073803 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.702083 0.165721 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.868216 0.039944 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:27.908606 0.146089 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.055081 0.330028 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.385523 0.180029 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.565954 0.170072 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.736483 0.077352 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.814272 0.073257 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:28.887983 0.138023 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.026430 0.175010 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.201850 0.059650 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.261984 0.212693 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.475080 0.063750 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.539239 0.146664 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.686301 0.169157 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:29.855844 0.205827 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:30.062123 0.640143 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:30.702685 0.076597 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:30.779739 0.066783 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:30.846968 0.212664 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:31.060051 0.060753 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:31.121178 1.086826 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:32:32.208410 0.477110 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/30 22:36:12.546730 3.002295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:36:19.555066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:36:27.556493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:36:43.559237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:37:15.565620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:43:19.571410 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:43:26.578701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:43:34.580395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:43:50.583317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:44:22.589216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:54:07.603410 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 22:54:14.610374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:54:22.612107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:54:38.615048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:55:10.621452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 22:57:28.530078 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 22:57:28.530303 0.963343 tcp 10.0.2.105 58748 -> 128.255.183.224 9027 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/01/30 23:01:14.627330 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:01:21.635214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:01:29.635879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:01:45.638979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:02:17.645004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:02:36.452112 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 23:02:36.452283 0.159150 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:36.611840 0.252821 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:36.865062 0.141519 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:37.006944 0.797969 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:37.805383 0.079391 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:37.885204 0.055841 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:37.941462 0.083063 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:38.025000 0.164929 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:38.190291 0.045411 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:38.236132 0.613150 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:38.849727 1.023304 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:39.873422 0.189314 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.063143 0.171224 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.234815 0.077063 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.312500 0.087149 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.400119 0.138271 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.538857 0.170504 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.709776 0.056990 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.767156 0.143924 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:40.911473 0.168991 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:41.080916 0.206209 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:41.287540 0.211664 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:41.499613 0.059978 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:41.560011 0.639491 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:42.199916 0.074614 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:42.274974 0.059131 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:42.334568 0.211424 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:42.546462 0.065426 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:42.612348 0.587063 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:02:43.199845 0.235266 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:08:21.651331 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:08:28.658791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:08:36.659848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:08:52.662742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:09:24.668962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:15:28.675275 3.001999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:15:35.682308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:15:43.683798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:15:59.686806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:16:31.692907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:22:35.700497 3.000302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:22:42.706178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:22:50.707809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:23:06.710703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:23:38.717443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:27:29.499057 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 23:27:29.499199 0.890192 tcp 10.0.2.105 58749 -> 128.255.183.224 9027 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/01/30 23:29:42.724789 2.999754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:29:49.730548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:29:57.731589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:30:13.734866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:30:45.740808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:32:48.561426 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 23:32:48.561540 0.141664 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:48.703677 0.151486 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:48.855560 0.214469 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.070446 0.074677 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.145611 0.068917 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.214964 0.044472 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.259871 0.078259 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.338579 0.165563 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.504784 0.046858 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.552077 0.146149 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.698675 0.171550 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.870659 0.077471 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:49.948706 0.734194 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:50.683339 0.191569 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:50.875262 0.074576 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:50.950220 0.145432 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.096080 0.175407 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.271898 0.062556 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.334960 0.186724 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.522073 0.168474 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.690957 0.203703 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:51.895051 0.211764 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.107219 0.083040 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.190688 0.064118 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.255174 0.212185 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.467790 0.063758 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.532004 0.054178 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:52.586578 0.609962 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:53.196957 1.011479 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:32:54.208797 0.227928 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/30 23:36:49.746327 3.002475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:36:56.754140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:37:04.755758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:37:20.758742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:37:52.764823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:43:56.770961 3.001230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:44:03.778160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:44:11.779830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:44:27.782792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:44:59.789017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:54:26.796875 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/30 23:54:33.805004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:54:41.805566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:54:57.808513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:55:29.814668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/30 23:57:30.388743 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/30 23:57:30.388909 0.913066 tcp 10.0.2.105 58750 -> 128.255.183.224 9027 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/01/31 00:01:33.820388 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:01:40.828074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:01:48.829516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:02:04.832538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:02:36.838616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:02:56.366650 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 00:02:56.366821 0.224065 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:56.591338 0.069847 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:56.661624 0.076352 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:56.738358 0.043774 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:56.782541 0.142620 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:56.925620 0.136436 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.062527 0.080870 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.143879 0.166126 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.310461 0.040106 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.351000 0.143615 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.495001 0.169482 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.664882 0.074180 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:57.739469 0.333277 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.073181 0.189607 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.263217 0.073330 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.336961 0.123894 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.461311 0.173816 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.635530 0.061469 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.697428 0.144803 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:58.842607 0.168826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.011842 0.208355 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.220708 0.210831 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.431980 0.074848 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.507262 0.063107 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.570765 0.060805 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:02:59.632015 0.586859 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:03:00.219315 0.212193 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:03:00.431909 0.065344 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:03:00.497619 0.382005 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:03:00.880059 0.309863 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:08:40.844114 3.001985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:08:47.851913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:08:55.853327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:09:11.856858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:09:43.862339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:15:47.868029 3.002129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:15:54.875836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:16:02.877434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:16:18.880384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:16:50.886808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:22:54.892001 3.002077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:23:01.899837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:23:09.901374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:23:25.904315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:23:57.910405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:27:31.307683 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 00:27:31.307833 0.955423 tcp 10.0.2.105 58751 -> 128.255.183.224 9027 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/01/31 00:30:01.916208 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:30:08.923882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:30:16.925131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:30:32.928336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:31:04.934349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:33:30.914477 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 00:33:30.914602 0.241516 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.156709 0.072285 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.229470 0.076566 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.306524 0.045266 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.352227 0.145175 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.497789 0.137945 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.636165 0.083683 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:31.720384 0.500561 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:32.221299 0.171422 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:32.393138 0.077915 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:32.471454 0.755060 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:33.226864 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 00:33:49.643135 0.052694 tcp 10.0.2.105 58752 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 00:33:49.696081 0.055003 tcp 10.0.2.105 58753 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 00:33:49.751453 0.137687 tcp 10.0.2.105 58754 -> 195.113.214.236 443 SRPA* 0 0 33 24763 flow=From-Botnet-V2-TCP-Established 1970/01/31 00:33:49.889818 0.041599 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:49.931762 0.189312 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.121528 0.073485 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.195490 0.137831 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.333765 0.176398 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.510604 0.059006 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.570075 0.145305 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.715781 0.168870 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:50.885055 0.207616 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:51.093117 0.212025 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:51.305532 0.077865 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:51.383796 0.065652 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:51.449873 0.058252 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:51.508654 0.595863 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:52.104956 0.202059 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:52.307461 0.520442 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:52.828492 0.211777 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:33:53.040686 0.067216 udp 10.0.2.105 7010 <-> 86.167.130.17 4984 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/31 00:37:08.941024 3.000895 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:37:15.947977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:37:23.949288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:37:39.952402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:38:11.958570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:44:15.964033 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:44:22.971915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:44:30.973149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:44:46.976791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:45:18.982026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:54:36.997347 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 00:54:44.004844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:54:52.006261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:55:08.009438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:55:40.015319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 00:57:32.267368 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 00:57:32.267522 0.929622 tcp 10.0.2.105 58755 -> 128.255.183.224 9027 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:01:44.031387 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:01:51.038038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:01:59.039832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:02:15.043316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:02:47.049450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:04:22.896698 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 01:04:22.896797 0.164243 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.061440 0.220068 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.281915 0.070615 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.352954 0.077904 udp 10.0.2.105 7010 <-> 217.41.11.145 4358 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.431289 0.138797 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.570479 0.084425 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.655369 0.158276 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.814082 0.147163 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:23.961733 0.047513 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.009712 0.171646 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.181789 0.080668 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.262851 0.400344 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.663593 0.120297 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.784493 0.046942 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:24.831855 0.196884 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.029162 0.138535 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.168083 0.175780 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.344365 0.060830 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.405587 0.143764 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.549760 0.169165 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.719398 0.207045 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:25.926805 0.210553 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:26.137758 0.071037 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:26.209249 0.061512 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:26.271161 0.149601 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:26.421167 0.501521 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:26.923062 0.213811 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:27.137236 0.000000 udp 10.0.2.105 7010 -> 86.167.130.17 4984 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:04:43.197827 0.053525 tcp 10.0.2.105 58756 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:04:43.251617 0.033743 tcp 10.0.2.105 58757 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:04:43.285668 0.153943 tcp 10.0.2.105 58758 -> 195.113.214.236 443 SRPA* 0 0 22 13130 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:04:43.440159 0.201549 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:04:43.642162 0.243992 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:08:51.055210 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:08:58.062654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:09:06.064143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:09:22.067295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:09:54.073304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:15:58.079954 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:16:05.086926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:16:13.087495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:16:29.091282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:17:01.097261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:23:05.102434 3.002585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:23:12.109967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:23:20.112117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:23:36.115050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:24:08.121226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:27:33.206117 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 01:27:33.206271 0.958806 tcp 10.0.2.105 58759 -> 128.255.183.224 9027 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:30:12.127802 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:30:19.134338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:30:27.136176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:30:43.139218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:31:15.144913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:34:47.149901 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 01:34:47.150035 0.000000 udp 10.0.2.105 7010 -> 86.167.130.17 4984 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:35:02.344169 0.052347 tcp 10.0.2.105 58760 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:02.396803 0.033841 tcp 10.0.2.105 58761 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:02.430949 0.130547 tcp 10.0.2.105 58762 -> 195.113.214.236 443 SRPA* 0 0 44 38272 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:02.562123 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:35:21.029470 0.051933 tcp 10.0.2.105 58763 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:21.081724 0.056994 tcp 10.0.2.105 58764 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:21.139097 0.143372 tcp 10.0.2.105 58765 -> 195.113.214.236 443 SRPA* 0 0 25 13902 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:21.283085 0.071796 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:21.355326 0.000000 udp 10.0.2.105 7010 -> 217.41.11.145 4358 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:35:40.036838 0.051032 tcp 10.0.2.105 58766 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:40.088112 0.053792 tcp 10.0.2.105 58767 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:40.142175 0.150792 tcp 10.0.2.105 58768 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:40.293619 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:35:56.910671 0.051970 tcp 10.0.2.105 58769 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:56.962944 0.033058 tcp 10.0.2.105 58770 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:56.996415 0.157078 tcp 10.0.2.105 58771 -> 195.113.214.236 443 SRPA* 0 0 51 32360 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:35:57.154135 0.081958 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:57.236529 0.143020 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:57.379933 0.148466 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:57.528817 0.329779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:57.859087 0.137641 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:57.997111 0.381113 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.378646 0.073901 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.452956 0.045827 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.499183 0.074187 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.573763 0.170827 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.744957 0.174122 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.919469 0.059608 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:58.979525 0.144876 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:59.124779 0.177382 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:59.302671 0.131047 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:35:59.434263 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 01:36:17.069750 0.054764 tcp 10.0.2.105 58772 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:36:17.124871 0.032904 tcp 10.0.2.105 58773 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:36:17.158105 0.135356 tcp 10.0.2.105 58774 -> 195.113.214.236 443 SRPA* 0 0 42 23686 flow=From-Botnet-V2-TCP-Established 1970/01/31 01:36:17.294084 0.080740 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:17.375203 0.067180 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:17.442845 0.060741 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:17.504010 0.214639 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:17.719063 0.211105 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:17.930657 0.546105 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:18.477171 0.211982 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:18.689596 0.339576 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:36:19.029560 0.317071 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 01:37:19.151159 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 01:37:26.158747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:37:34.159906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:37:50.162914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:38:22.169093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:44:26.175510 3.001067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:44:33.182497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:44:41.183784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:44:57.186951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:45:29.192929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:54:42.200319 3.001992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 01:54:49.207999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:54:57.209642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:55:13.212286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:55:45.218897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 01:57:34.165856 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 01:57:34.166042 0.933628 tcp 10.0.2.105 58775 -> 128.255.183.224 9027 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:01:49.224184 3.002412 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:01:56.232121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:02:04.233497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:02:20.236826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:02:52.242828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:06:30.387048 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 02:06:30.387146 0.165438 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:06:30.552987 0.143092 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:06:30.696505 0.000000 udp 10.0.2.105 7010 -> 217.41.11.145 4358 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 02:06:49.215413 0.052587 tcp 10.0.2.105 58776 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:06:49.268270 0.032362 tcp 10.0.2.105 58777 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:06:49.300918 0.143862 tcp 10.0.2.105 58778 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:06:49.445243 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 02:07:04.476102 0.053237 tcp 10.0.2.105 58779 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:04.529714 0.054615 tcp 10.0.2.105 58780 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:04.584716 0.210786 tcp 10.0.2.105 58781 -> 195.113.214.236 443 SRPA* 0 0 23 13810 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:04.796004 0.074915 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:04.871374 0.737383 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:05.609150 0.054760 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:05.664379 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 02:07:22.602044 0.051305 tcp 10.0.2.105 58782 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:22.653636 0.030921 tcp 10.0.2.105 58783 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:22.684880 0.134543 tcp 10.0.2.105 58784 -> 195.113.214.236 443 SRPA* 0 0 36 28640 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:07:22.820031 0.139986 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:22.960569 0.222388 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.183328 0.102142 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.285849 0.040745 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.326948 0.079055 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.406399 0.172227 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.579158 0.174617 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.754246 0.058870 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.813476 0.176808 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:23.990690 0.323741 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.314876 0.151576 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.466920 0.176628 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.643940 0.074206 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.718599 0.064811 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.783859 0.060740 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:24.845004 0.203446 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:25.048846 0.212879 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:25.262114 0.202278 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:25.464821 0.588459 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:26.053643 0.213176 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:07:26.267285 0.352867 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:08:56.248977 3.001110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 02:09:03.256040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:09:11.257803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:09:27.260668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:09:59.266820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:16:03.272450 3.002229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:16:10.280134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:16:18.281446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:16:34.284776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:17:06.290272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:23:10.297611 3.000599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:23:17.303895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:23:25.306020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:23:41.308402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:24:13.314841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:27:35.105215 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 02:27:35.105415 1.246375 tcp 10.0.2.105 58785 -> 128.255.183.224 9027 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/01/31 02:30:17.320814 3.001354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:30:24.327912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:30:32.329527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:30:48.332455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:31:20.338807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:37:24.345170 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:37:30.681543 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 02:37:30.681691 0.144575 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:30.826670 0.165414 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:30.992565 0.144104 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:31.137089 0.072678 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:31.210182 0.073566 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:31.284256 0.382526 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:31.351929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:37:31.667195 0.832680 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:32.500488 0.039144 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:32.540063 0.168441 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:32.708918 0.170832 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:32.880123 0.172805 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.053327 0.214794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.268718 0.074309 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.343454 0.056565 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.400628 0.146645 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.547656 0.358260 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:33.906316 0.137771 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.044510 0.066926 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.111854 0.063118 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.175455 0.204289 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.380231 0.169122 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.549789 0.083748 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.633917 0.213190 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:34.847523 0.197706 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:35.045700 0.234201 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:35.280355 0.613949 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:35.894784 0.212852 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/31 02:37:39.353539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:37:55.356626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:38:27.362866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:44:31.368844 3.087934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:44:38.429400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:44:46.387687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:45:02.390726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:45:34.396677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:54:46.402765 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 02:54:53.410060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:55:01.411544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:55:17.414884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:55:49.421023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 02:57:36.355220 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 02:57:36.355405 0.944108 tcp 10.0.2.105 58786 -> 128.255.183.224 9027 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/01/31 03:01:53.436818 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:02:00.444207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:02:08.445782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:02:24.448835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:02:56.454833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:07:51.769820 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 03:07:51.770005 0.136555 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:51.906928 0.086525 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:51.993861 0.077999 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.072389 0.145960 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.218827 0.164811 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.384054 0.045434 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.429933 0.144860 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.575184 0.046332 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.621978 0.077087 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.699460 0.171494 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:52.871352 0.175148 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.046993 0.221657 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.269108 0.086690 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.356402 0.059593 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.416528 0.147359 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.564444 0.334434 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:53.899287 0.137861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.037595 0.068193 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.106180 0.063162 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.169723 0.076006 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.246155 0.212596 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.459190 0.208643 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.668322 0.246990 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:54.915740 0.209669 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:55.125805 0.193911 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:55.320156 0.567366 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:07:55.887938 0.212713 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:09:00.461023 3.426406 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:09:07.856353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:09:15.778526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:09:31.624677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:10:03.581567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:16:07.505058 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:16:14.522227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:16:22.523698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:16:41.698227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:17:13.249708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:23:14.549184 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:23:21.556081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:23:29.557557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:23:45.560808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:24:17.566830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:27:37.304305 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 03:27:37.304425 0.952359 tcp 10.0.2.105 58787 -> 128.255.183.224 9027 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/01/31 03:30:21.572672 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:30:28.580103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:30:36.581512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:30:52.584703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:31:24.590795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:37:28.596997 3.001184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:37:35.604034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:37:43.605711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:37:59.608543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:38:19.958302 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 03:38:19.958443 0.136304 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.095197 0.071621 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.167248 0.081268 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.248978 0.143705 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.393079 0.163523 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.557029 0.252691 udp 10.0.2.105 7010 <-> 95.89.168.173 6418 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.810099 0.143894 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.954414 0.039862 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:20.994687 0.077111 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.072262 0.171285 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.243978 0.175284 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.419729 0.214026 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.634189 0.093633 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.728255 0.058960 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.787642 0.144722 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:21.932716 0.342182 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.275351 0.144808 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.420759 0.069145 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.490295 0.060299 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.551033 0.079834 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.631292 0.209969 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:22.841710 0.200501 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:23.042642 0.170320 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:23.213417 0.245547 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:23.459421 0.213207 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:23.673072 0.412500 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:24.085970 0.212858 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/31 03:38:31.614536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:44:35.621315 3.351585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:44:42.942053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:44:50.865662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:45:08.255440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:45:39.868773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:54:49.673664 3.001140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 03:54:56.681098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:55:04.682623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:55:20.685521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:55:52.691337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 03:57:38.265583 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 03:57:38.265692 1.059670 tcp 10.0.2.105 58788 -> 128.255.183.224 9027 FSPA* 0 0 12 1603 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:01:56.697500 3.001432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:02:03.705157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:02:11.706721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:02:27.709472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:02:59.716458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:08:24.803198 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 04:08:24.803413 0.081660 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:24.885414 0.136474 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:25.022344 0.072394 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:25.095142 0.158912 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:25.254465 0.165499 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:25.420455 0.000000 udp 10.0.2.105 7010 -> 95.89.168.173 6418 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 04:08:41.999728 0.055298 tcp 10.0.2.105 58789 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:08:42.055333 0.055959 tcp 10.0.2.105 58790 -> 195.113.214.236 80 FSPA* 0 0 10 1923 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:08:42.111589 0.120050 tcp 10.0.2.105 58791 -> 195.113.214.236 443 SRPA* 0 0 35 26501 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:08:42.232129 0.144502 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:42.376985 0.040302 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:42.417689 0.085170 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:42.503256 0.170782 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:42.674393 0.175873 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:42.850676 0.217162 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.068155 0.086480 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.154982 0.059298 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.214680 0.142515 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.357632 0.368887 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.726924 0.137913 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.865185 0.069173 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:43.934718 0.163776 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:44.098838 0.074447 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:44.173668 0.211439 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:44.385474 0.205360 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:44.591160 0.170067 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:44.761649 0.412361 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:45.174350 0.211472 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:45.386220 0.225004 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:08:45.611574 0.205132 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:09:04.723452 3.002346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:09:11.730149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:09:19.731774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:09:35.735042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:10:07.741118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:16:11.752625 2.996201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:16:18.755866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:16:26.755735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:16:42.759073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:17:14.764965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:23:18.775554 3.001396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:23:25.782925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:23:33.779591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:23:49.782865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:24:21.788534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:27:39.253319 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 04:27:39.253441 0.989392 tcp 10.0.2.105 58792 -> 128.255.183.224 9027 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:30:25.795037 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:30:32.802008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:30:40.803606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:30:56.806652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:31:28.812721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:37:32.819189 3.001432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:37:39.828906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:37:47.827487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:38:03.830824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:38:35.836558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:39:00.292469 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 04:39:00.292627 0.027538 udp 10.0.2.105 7010 -> 95.89.168.173 6418 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 04:39:00.320165 0.000000 icmp 83.169.177.129 0x0103 -> 10.0.2.105 0x5f59 URH 192 1 184 flow=Background 1970/01/31 04:39:16.897568 0.053018 tcp 10.0.2.105 58793 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:16.950824 0.034045 tcp 10.0.2.105 58794 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:16.985119 0.161697 tcp 10.0.2.105 58795 -> 195.113.214.236 443 SRPA* 0 0 40 22374 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:17.147388 0.195533 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:17.343315 0.138501 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:17.482225 0.079329 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:17.561955 0.072291 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:17.634637 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 04:39:35.833716 0.051830 tcp 10.0.2.105 58796 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:35.885875 0.062722 tcp 10.0.2.105 58797 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:35.948876 0.159945 tcp 10.0.2.105 58798 -> 195.113.214.236 443 SRPA* 0 0 45 39424 flow=From-Botnet-V2-TCP-Established 1970/01/31 04:39:36.109425 0.145486 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.255538 0.046726 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.302693 0.073771 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.376877 0.171642 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.548912 0.176441 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.725787 0.222722 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:36.948916 0.074963 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.024401 0.062332 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.087186 0.144965 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.232578 0.365393 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.598420 0.145159 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.743981 0.069741 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.814121 0.059639 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.874165 0.079013 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:37.953589 0.211341 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:38.165302 0.208453 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:38.374210 0.214906 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:38.589534 0.411972 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:39.001828 0.209205 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:39.211387 0.212670 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:39:39.424542 0.291344 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/31 04:44:39.842500 3.038246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 04:44:46.860356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:44:54.861628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:45:10.864926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:45:42.870601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:54:46.885432 3.002104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 04:54:53.892809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:55:01.894378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:55:17.897432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:55:49.903428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 04:57:40.242403 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 04:57:40.242510 0.927667 tcp 10.0.2.105 58799 -> 128.255.183.224 9027 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/01/31 05:01:53.910431 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:02:00.917029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:02:08.918012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:02:24.921369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:02:56.927849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:09:04.939017 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:09:11.946904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:09:19.948142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:09:35.950922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:09:52.104310 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 05:09:52.104450 0.165299 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.270148 0.070020 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.340608 0.135303 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.476276 0.141890 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.618533 0.084678 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.703581 0.146012 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.849944 0.046374 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.896633 0.078892 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:52.975874 0.171408 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.147665 0.172765 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.320800 0.221612 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.542761 0.104466 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.647583 0.059877 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.707917 0.145164 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.853470 0.069145 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.922956 0.061356 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:53.984660 0.076780 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:54.061760 0.212172 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:54.274336 0.839148 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:55.113881 0.130918 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:55.245221 0.199380 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:55.445022 0.169354 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:55.614825 0.413679 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:56.028887 0.206985 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:56.236207 0.212052 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:09:56.448638 0.239863 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:10:07.957293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:16:11.963144 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:16:18.970406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:16:26.971995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:16:42.975061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:17:14.981376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:23:18.988394 3.000281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:23:25.994637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:23:33.995913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:23:49.998945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:24:22.004962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:27:41.171502 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 05:27:41.171643 0.957577 tcp 10.0.2.105 58800 -> 128.255.183.224 9027 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/01/31 05:30:26.011374 3.001508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:30:33.018687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:30:41.022446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:30:57.023330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:31:29.028929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:37:33.035316 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:37:40.042543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:37:48.044080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:38:04.047059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:38:36.067652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:40:25.151578 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 05:40:25.151741 0.163879 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.316063 0.074682 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.391209 0.146102 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.537759 0.146251 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.684542 0.078750 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.763669 0.141416 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.905556 0.039807 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:25.945809 0.077876 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.024114 0.171160 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.195666 0.177209 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.373285 0.231780 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.605516 0.075307 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.681208 0.058531 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.740136 0.150975 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.891465 0.069497 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:26.961382 0.058554 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:27.020383 0.078937 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:27.099719 0.211183 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:27.311293 0.897342 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:28.209032 0.144853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:28.354267 0.420066 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:28.774715 0.210068 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:28.985172 0.472835 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:29.458434 0.169865 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:29.628701 0.212100 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:40:29.841187 0.307862 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/31 05:44:40.058992 3.001727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:44:47.066297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:44:55.067545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:45:11.071116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:45:43.076883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:54:48.086731 3.000417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 05:54:55.090902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:55:03.092568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:55:19.095176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:55:51.101248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 05:57:42.131846 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 05:57:42.132126 0.977871 tcp 10.0.2.105 58801 -> 128.255.183.224 9027 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/01/31 06:01:55.106939 3.002093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:02:02.114262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:02:10.117089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:02:26.119466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:02:58.125419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:09:06.136482 3.002318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:09:13.144477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:09:21.146346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:09:37.148981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:10:09.154804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:10:34.912084 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 06:10:34.912406 0.165285 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.078103 0.072137 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.150599 0.143087 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.294079 0.142012 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.436506 0.084233 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.521124 0.150282 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.671819 0.045950 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.718126 0.082217 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.800714 0.170911 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:35.971974 0.177690 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.150019 0.214612 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.364947 0.075158 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.440535 0.061336 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.502223 0.146845 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.649432 0.068900 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.718737 0.064004 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.783102 0.078370 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:36.861860 0.212186 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:37.125615 0.651415 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:37.777383 0.214535 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:37.992371 0.131003 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:38.123734 0.388447 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:38.512731 0.212260 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:38.725414 0.238704 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:38.964524 0.201174 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:10:39.166069 0.169990 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:16:13.160961 3.001891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:16:20.167993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:16:28.170176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:16:44.172802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:17:16.179287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:23:20.184906 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:23:27.192131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:23:35.193669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:23:51.197002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:24:23.202641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:27:43.110618 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 06:27:43.110789 1.026326 tcp 10.0.2.105 58802 -> 128.255.183.224 9027 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/01/31 06:30:27.209004 3.005937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:30:34.216627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:30:42.217789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:30:58.220406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:31:30.228121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:37:34.232113 3.002684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:37:41.245314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:37:49.241685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:38:05.244703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:38:37.250304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:40:46.967270 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 06:40:46.967448 0.138200 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.106046 0.164268 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.270745 0.075040 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.346231 0.141952 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.488659 0.081359 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.570404 0.147779 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.718595 0.039855 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.758872 0.076929 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:47.836157 0.171321 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.007913 0.176096 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.184612 0.220980 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.406054 0.073718 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.480184 0.061115 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.541658 0.144808 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.686877 0.071734 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.759044 0.073120 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.832675 0.076396 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:48.909421 0.214064 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:49.123925 0.137770 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:49.262058 0.734830 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:49.997285 0.210368 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:50.208077 0.249592 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:50.458097 0.201404 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:50.659871 0.405412 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:51.065669 0.211837 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:40:51.277920 0.169555 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/31 06:44:41.256736 3.015850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:44:48.274212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:44:56.275761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:45:12.279127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:45:44.284926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:51:48.290803 3.001680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:51:55.297974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:52:03.299691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:52:19.308178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:52:51.308345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:57:44.143734 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 06:57:44.143902 0.938069 tcp 10.0.2.105 58803 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/31 06:58:55.314313 3.004576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 06:59:02.321987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:59:10.323582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:59:26.326904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 06:59:58.332679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:06:26.344483 3.000208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:06:33.350868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:06:41.352177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:06:57.355117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:07:29.361326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:10:59.783966 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 07:10:59.784189 0.140319 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:10:59.924925 0.164362 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.089687 0.086078 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.176143 0.142766 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.319306 0.120828 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.440544 0.145331 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.586221 0.046606 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.633211 0.075675 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.709225 0.171126 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:00.880753 0.173694 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.054841 0.216542 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.271786 0.074783 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.346911 0.059185 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.406507 0.140319 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.547167 0.071153 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.618732 0.061673 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.680800 0.086504 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.767693 0.211395 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:01.979499 0.130895 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:02.110771 0.689066 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:02.800240 0.209527 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:03.010170 0.449704 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:03.460458 0.211496 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:03.672416 0.273265 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:03.946033 0.202383 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:11:04.148816 0.169004 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:13:36.371790 3.000911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:13:43.379207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:13:51.380457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:14:07.383468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:14:39.389433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:20:43.395308 3.001982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:20:50.402835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:20:58.405202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:21:14.407252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:21:46.413527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:27:45.081024 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 07:27:45.081202 1.063292 tcp 10.0.2.105 58804 -> 128.255.183.224 9027 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/01/31 07:27:50.424521 2.999583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:27:57.434802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:28:05.428553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:28:21.431468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:28:53.437222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:34:57.443518 3.001045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:35:04.451025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:35:12.452089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:35:28.455359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:36:00.461204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:41:27.338077 0.041977 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 07:41:27.380239 0.072656 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:27.453351 0.142091 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:27.595870 0.154900 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:27.751211 0.164188 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:27.915823 0.073504 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.061402 0.140861 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.202662 0.044565 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.247674 0.077978 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.326010 0.171356 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.497768 0.178426 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.676642 0.220063 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.897168 0.075375 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:28.972990 0.061131 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.034547 0.146693 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.181623 0.068401 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.250451 0.115971 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.366879 0.080509 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.447838 0.213928 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 589 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.662154 0.137866 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:29.800635 0.663801 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:30.464804 0.206719 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:30.671966 0.223992 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:30.896434 0.200879 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:31.097759 0.169200 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:31.267341 0.370703 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:41:31.638451 0.212936 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/31 07:42:04.467476 3.001543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:42:11.474801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:42:19.476306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:42:35.479218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:43:07.486670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:53:32.496463 3.002312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 07:53:39.504046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:53:47.505562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:54:03.509845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:54:35.514467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 07:57:46.148598 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 07:57:46.148713 0.915444 tcp 10.0.2.105 58805 -> 128.255.183.224 9027 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:00:39.520167 3.003156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:00:46.527860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:00:54.529503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:01:10.532477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:01:42.538708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:07:46.544477 3.001789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:07:53.551899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:08:01.553354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:08:17.556588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:08:49.562563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:11:49.621805 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 08:11:49.621955 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 08:12:08.240741 0.069075 tcp 10.0.2.105 58806 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:12:08.310107 0.050701 tcp 10.0.2.105 58807 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:12:08.361126 0.131144 tcp 10.0.2.105 58808 -> 195.113.214.236 443 SRPA* 0 0 58 54927 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:12:08.493045 0.174724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:08.668423 0.161935 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:08.830776 0.144422 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:08.975562 0.047306 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.023243 0.074466 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.098124 0.067826 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.166319 0.139948 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.306670 0.171400 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.478487 0.176654 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.655498 0.222572 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.878435 0.073128 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:09.951913 0.059399 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.011665 0.147217 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.159294 0.069631 udp 10.0.2.105 7010 <-> 86.159.25.36 2112 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.229309 0.213880 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.443573 0.137995 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.581973 0.127685 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.709989 0.079750 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:10.790086 0.624642 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:11.415173 0.207348 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:11.623005 0.219720 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:11.843179 0.201994 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:12.045580 0.169829 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:12.215809 0.365550 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:12:12.581767 0.211277 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:14:53.568974 3.001170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:15:00.576118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:15:08.577454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:15:24.580395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:15:56.586456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:22:00.591997 3.002176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:22:07.599749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:22:15.601395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:22:31.604314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:23:03.610641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:27:47.068179 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 08:27:47.068426 0.978554 tcp 10.0.2.105 58809 -> 128.255.183.224 9027 FSPA* 0 0 14 1700 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:29:07.615962 3.002187 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:29:14.623712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:29:22.625324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:29:38.628767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:30:10.634252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:36:14.640994 3.001055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:36:21.647656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:36:29.649205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:36:45.652538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:37:17.658209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:42:35.044871 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 08:42:35.045032 0.154934 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.200542 0.145230 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.346212 0.039650 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.386235 0.076080 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.462799 0.071769 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.534977 0.144929 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.680443 0.166166 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.846955 0.088881 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:35.936232 0.170404 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.107015 0.178103 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.285545 0.221454 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.507375 0.074954 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.582733 0.060168 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.643292 0.144503 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:36.788154 0.000000 udp 10.0.2.105 7010 -> 86.159.25.36 2112 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 08:42:55.645824 0.053059 tcp 10.0.2.105 58810 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:42:55.699225 0.050319 tcp 10.0.2.105 58811 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:42:55.749888 0.165908 tcp 10.0.2.105 58812 -> 195.113.214.236 443 SRPA* 0 0 33 19156 flow=From-Botnet-V2-TCP-Established 1970/01/31 08:42:55.916358 0.066911 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:55.983669 0.075890 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:56.059998 0.211377 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:56.271741 0.124108 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:56.396262 0.338481 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:56.735258 0.206728 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:56.942341 0.221010 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:57.163768 0.286325 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:57.450522 0.169976 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:57.620887 0.361255 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:42:57.982484 0.220068 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 08:43:21.664169 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:43:28.671759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:43:36.673210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:43:52.676750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:44:24.682183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:54:11.689237 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 08:54:18.696270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:54:26.697786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:54:42.701429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:55:14.706971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 08:57:48.047693 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 08:57:48.047793 0.955937 tcp 10.0.2.105 58813 -> 128.255.183.224 9027 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:01:18.713889 3.001091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:01:25.721013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:01:33.722224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:01:49.725353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:02:21.730957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:08:25.737898 3.001035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:08:32.744207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:08:40.746616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:08:56.749090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:09:28.754972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:13:21.690387 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 09:13:21.690629 0.000000 udp 10.0.2.105 7010 -> 86.159.25.36 2112 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 09:13:37.654717 0.052685 tcp 10.0.2.105 58814 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:13:37.707700 0.054821 tcp 10.0.2.105 58815 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:13:37.762779 0.153028 tcp 10.0.2.105 58816 -> 195.113.214.236 443 SRPA* 0 0 45 37192 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:13:37.916754 0.135999 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.053159 0.046971 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.100522 0.079612 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.180519 0.072376 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.253255 0.142486 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.396083 0.163785 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.560426 0.147406 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.708187 0.170631 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:38.879205 0.174514 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.054167 0.083990 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.138609 0.062091 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.201136 0.144490 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.345967 0.074844 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.421185 0.215413 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.637011 0.212510 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.849896 0.061237 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.911497 0.079006 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:39.990855 0.137781 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:40.129044 0.320810 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:40.450281 0.208809 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:40.659533 0.233924 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:40.893809 0.358435 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:41.252658 0.214181 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:41.467272 0.571391 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:13:42.039157 0.169277 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:15:32.761669 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:15:39.768553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:15:47.769676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:16:03.772924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:16:35.778706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:22:39.785661 3.000627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:22:46.792232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:22:54.793698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:23:10.796597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:23:42.802803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:27:49.007021 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 09:27:49.007184 1.053499 tcp 10.0.2.105 58817 -> 128.255.183.224 9027 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:29:46.808436 3.002117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:29:53.816209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:30:01.817813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:30:17.820222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:30:49.826904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:36:53.833348 3.001160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:37:00.840039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:37:08.841455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:37:24.844626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:37:56.850657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:43:55.447008 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 09:43:55.447109 0.076790 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:55.524327 0.072497 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:55.597198 0.136452 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:55.734067 0.039424 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:55.773863 0.144589 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:55.918881 0.166087 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.085411 0.142508 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.228275 0.171686 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.400334 0.173064 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.573846 0.137039 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.711334 0.060639 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.772392 0.148112 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.920879 0.074690 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:56.995976 0.222973 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:57.219379 0.222578 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:57.442420 0.061491 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:57.504307 0.076059 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:57.580754 0.137572 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:57.718770 0.533371 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:58.252714 0.360976 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:58.614048 0.327156 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:58.941620 0.204816 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:43:59.146873 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 09:44:00.856940 3.001184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:44:07.864017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:44:15.871580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:44:17.050354 0.069370 tcp 10.0.2.105 58818 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:44:17.119992 0.054722 tcp 10.0.2.105 58819 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:44:17.175023 0.147198 tcp 10.0.2.105 58820 -> 195.113.214.236 443 SRPA* 0 0 33 25053 flow=From-Botnet-V2-TCP-Established 1970/01/31 09:44:17.322843 0.212795 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:44:17.536035 0.207438 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/01/31 09:44:31.868467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:45:03.874789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:54:31.883989 3.002105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 09:54:38.891265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:54:46.893028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:55:02.895647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:55:34.903152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 09:57:50.066695 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 09:57:50.066924 1.054238 tcp 10.0.2.105 58821 -> 128.255.183.224 9027 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/01/31 10:01:38.907966 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:01:45.915431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:01:53.917045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:02:09.919380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:02:41.925845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:08:45.931971 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:08:52.939266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:09:00.940759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:09:16.943759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:09:48.949815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:14:29.423046 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 10:14:29.423202 0.170282 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:29.593871 0.138334 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:29.732696 0.048013 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:29.781077 0.145328 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:29.926816 0.165787 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.093018 0.146499 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.239884 0.076663 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.316915 0.083064 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.400516 0.083975 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.484895 0.060233 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.545546 0.143867 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.689778 0.086364 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.776550 0.216665 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:30.993596 0.171307 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:31.165272 0.175050 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:31.340687 0.130822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:31.471905 0.417258 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:31.889610 0.263761 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:32.153758 0.063707 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:32.217921 0.076110 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:32.294470 0.207487 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:32.502354 0.321801 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:32.824642 0.360418 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:33.185455 0.220144 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:14:33.406048 0.198569 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:15:52.955876 3.001195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:15:59.963117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:16:07.964709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:16:23.967886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:16:55.973689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:22:59.979298 3.025218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:23:06.997436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:23:14.998940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:23:31.001625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:24:03.007116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:27:51.126416 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 10:27:51.126513 1.025588 tcp 10.0.2.105 58822 -> 128.255.183.224 9027 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/01/31 10:30:07.013357 3.001989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:30:14.022229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:30:22.022657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:30:38.026703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:31:10.031600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:37:14.037544 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:37:21.045164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:37:29.046819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:37:45.049220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:38:17.055606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:44:21.062024 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:44:28.068946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:44:36.080703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:44:52.083676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:44:56.049842 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 10:44:56.049969 0.040532 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.090926 0.144205 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.235543 0.164010 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.399938 0.145627 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.545982 0.124521 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.670934 0.169643 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.840977 0.149101 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:56.990446 0.072665 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.063494 0.087655 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.151541 0.059604 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.211527 0.144513 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.356523 0.073964 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.430892 0.220729 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.652004 0.173140 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:57.825631 0.181117 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.007202 0.215755 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.223367 0.068101 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.291865 0.080186 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.372627 0.151636 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.524661 0.241479 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.766549 0.206364 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:58.973315 0.351397 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:59.325096 0.364733 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:59.690205 0.212622 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:44:59.903246 0.206639 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/31 10:45:24.089657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:54:37.096917 3.001980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 10:54:44.104807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:54:52.106287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:55:08.110917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:55:40.115437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 10:57:52.155619 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 10:57:52.155813 0.930386 tcp 10.0.2.105 58823 -> 128.255.183.224 9027 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/01/31 11:01:44.122148 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:01:51.128990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:01:59.130411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:02:15.133618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:02:47.139417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:08:51.145797 3.001163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:08:58.153014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:09:06.154206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:09:22.157246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:09:54.163671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:15:13.482945 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 11:15:13.483194 0.039982 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:13.523633 0.144555 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:13.668578 0.166809 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:13.835836 0.145407 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:13.981713 0.076202 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.058318 0.170363 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.229093 0.139562 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.369065 0.074967 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.444614 0.083488 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.528475 0.057182 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.586066 0.145689 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.732117 0.092323 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:14.824925 0.216013 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.041335 0.170945 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.212729 0.177007 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.390136 0.222372 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.612991 0.063171 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.676676 0.080355 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.757386 0.207397 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:15.965198 0.316303 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:16.281872 0.137810 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:16.420128 0.225978 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:16.646501 0.199315 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:16.846184 0.358400 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:17.204966 0.213009 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:15:58.169806 3.000984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:16:05.176391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:16:13.178059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:16:29.181679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:17:01.187259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:23:05.193575 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:23:12.200161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:23:20.202214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:23:36.204684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:24:08.211198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:27:53.084491 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 11:27:53.084732 0.976561 tcp 10.0.2.105 58824 -> 128.255.183.224 9027 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/01/31 11:30:12.216688 3.002253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:30:19.224708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:30:27.228923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:30:43.229289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:31:15.235268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:37:19.241403 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:37:26.248119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:37:34.249917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:37:50.253436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:38:22.259217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:44:26.265704 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:44:33.272914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:44:41.274217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:44:57.277070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:45:29.283182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:45:39.518437 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 11:45:39.518552 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 11:45:55.513357 0.068642 tcp 10.0.2.105 58825 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 11:45:55.582335 0.054152 tcp 10.0.2.105 58826 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 11:45:55.636797 0.139755 tcp 10.0.2.105 58827 -> 195.113.214.236 443 SRPA* 0 0 33 23631 flow=From-Botnet-V2-TCP-Established 1970/01/31 11:45:55.777212 0.144249 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:55.921864 0.078252 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.000562 0.174698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.175653 0.045510 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.221571 0.143837 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.365793 0.137360 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.503603 0.072507 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.576557 0.085852 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.662894 0.061212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.724550 0.145559 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.870468 0.074015 udp 10.0.2.105 7010 <-> 82.61.66.27 4734 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:56.944849 0.221744 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.167076 0.172100 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.339632 0.178201 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.518202 0.224802 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.743347 0.060348 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.804065 0.077886 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:57.882297 0.204937 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:58.087666 0.326171 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:58.414216 0.326249 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:58.740816 0.360790 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:59.102067 0.131947 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:59.234434 0.230566 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:45:59.465447 0.215082 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 11:54:40.297594 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 11:54:47.305555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:54:55.307067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:55:11.312731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:55:43.315866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 11:57:54.064727 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 11:57:54.064898 0.958676 tcp 10.0.2.105 58828 -> 128.255.183.224 9027 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:01:47.321784 3.002016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:01:54.329451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:02:02.331536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:02:18.333738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:02:50.339932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:08:55.346784 3.002376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:09:02.354618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:09:10.356111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:09:26.359259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:09:58.365384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:16:02.372279 3.000845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:16:09.378932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:16:11.021490 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:16:11.021593 0.164151 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.186232 0.173625 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.360344 0.040938 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.401669 0.138453 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.540486 0.074067 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.615005 0.272795 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:11.888219 0.143977 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:12.032565 0.073391 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:12.106422 0.085629 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:12.192456 0.059230 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:12.252122 0.140258 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:12.392789 0.000000 udp 10.0.2.105 7010 -> 82.61.66.27 4734 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:16:17.380602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:16:31.081214 0.066407 tcp 10.0.2.105 58829 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:31.147907 0.054299 tcp 10.0.2.105 58830 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:31.202532 0.145847 tcp 10.0.2.105 58831 -> 195.113.214.236 443 SRPA* 0 0 46 40350 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:31.349108 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:16:33.383106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:16:47.383864 0.067499 tcp 10.0.2.105 58832 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:47.451646 0.053179 tcp 10.0.2.105 58833 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:47.505119 0.153383 tcp 10.0.2.105 58834 -> 195.113.214.236 443 SRPA* 0 0 41 23302 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:16:47.658718 0.175265 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:47.834435 0.063439 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:47.898254 0.077056 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:47.975704 0.204358 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:48.180454 0.174617 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:48.355433 0.227167 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:48.583004 0.315890 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:48.899331 0.203305 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:49.102984 0.362049 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:49.465440 0.130780 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:49.596659 0.308930 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:16:49.905936 0.245396 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:17:05.389377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:23:09.396741 3.000171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:23:16.402895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:23:24.404236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:23:40.407265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:24:12.413300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:27:55.023879 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:27:55.023983 0.977708 tcp 10.0.2.105 58835 -> 128.255.183.224 9027 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:30:16.422176 2.998820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:30:23.426868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:30:31.428196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:30:47.431344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:31:19.437244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:37:23.442616 3.002314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:37:30.450740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:37:38.452105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:37:54.455166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:38:26.461246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:44:30.468110 3.001112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 12:44:37.474612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:44:45.482698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:45:01.478942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:45:33.485104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:47:12.297456 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:47:12.297646 0.213773 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:12.511852 0.000000 udp 10.0.2.105 7010 -> 82.61.66.27 4734 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:47:30.715759 0.044107 tcp 10.0.2.105 58836 -> 195.113.214.211 80 FSPA* 0 0 10 1894 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:47:30.760161 0.032302 tcp 10.0.2.105 58837 -> 195.113.214.236 80 FSPA* 0 0 10 1929 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:47:30.792835 0.130617 tcp 10.0.2.105 58838 -> 195.113.214.236 443 SRPA* 0 0 40 34548 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:47:30.924194 0.164726 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.089415 0.146426 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.236391 0.076689 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.313639 0.143744 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.457754 0.136442 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.594638 0.072996 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.668090 0.084665 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.753143 0.060680 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.814218 0.046827 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:31.861419 0.170414 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.032402 0.143985 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.180416 0.059544 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.240425 0.072761 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.313600 0.206916 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.520987 0.173348 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.694719 0.222925 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:32.918104 0.323362 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:33.241898 0.288360 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:33.530683 0.175143 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:33.706231 0.000000 udp 10.0.2.105 7010 -> 172.190.4.74 6478 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:47:49.969608 4.164995 udp 10.0.2.105 7010 <-> 172.190.4.74 6478 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:49.970116 4.164050 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 4 1042 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:49.970475 3.006346 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 S_ 0 2 132 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 12:47:50.209056 0.364758 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:50.574229 0.130772 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:50.844287 0.221313 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.066138 0.147129 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.213791 0.064043 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.278253 0.147230 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.426037 0.136385 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.562874 0.163869 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.727173 0.059668 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.787300 0.074952 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.933215 0.052228 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:51.985900 0.047511 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.033803 0.164511 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.198784 0.146250 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.345595 0.048917 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.395006 0.206982 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.602518 0.171923 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.774879 0.222242 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:52.997615 0.070110 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:53.068358 0.325906 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:53.394814 0.327287 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:53.722634 0.178729 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:47:54.547957 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:47:58.974148 0.000000 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 12:48:00.947470 0.131143 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:48:01.079037 0.367059 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:48:01.446648 0.071053 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:48:01.539733 0.000000 udp 10.0.2.105 7010 -> 176.205.19.117 2807 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:06.810921 0.000371 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 PA_SA 0 0 4 296 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:48:10.100564 0.000000 udp 10.0.2.105 7010 -> 86.29.17.237 1126 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:11.286567 0.000000 udp 10.0.2.105 7010 <- 172.190.4.74 6478 RSP 0 0 1 540 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:16.089609 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:24.589626 4.988992 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 6 3020 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:48:24.981730 0.000000 udp 10.0.2.105 7010 -> 194.168.13.65 4309 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:29.778636 0.000000 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:48:33.954916 0.000000 udp 10.0.2.105 7010 -> 203.199.178.220 2121 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:40.073477 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:41.391012 4.851549 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 7 5770 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:48:46.793163 0.000000 udp 10.0.2.105 7010 -> 85.210.60.134 6242 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:51.048915 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:48:52.781790 0.000000 udp 10.0.2.105 7010 -> 95.226.81.61 6156 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:48:57.250291 0.198455 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6684 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:48:59.942142 0.000000 udp 10.0.2.105 7010 -> 70.58.38.70 9654 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:07.343313 0.000000 udp 10.0.2.105 7010 -> 85.5.215.82 9121 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:13.203089 0.198713 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:49:16.115664 0.397404 udp 10.0.2.105 7010 -> 120.151.43.201 4634 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:16.513068 0.000000 icmp 120.151.43.201 0x0303 -> 10.0.2.105 0x1a12 URP 192 1 279 flow=Background 1970/01/31 12:49:18.048120 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:49:24.167084 0.000000 udp 10.0.2.105 7010 -> 95.137.251.112 1048 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:29.426589 0.398196 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:49:33.039552 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:38.407753 0.000000 udp 10.0.2.105 7010 -> 78.147.44.157 8923 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:43.043728 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:49:46.058673 0.200465 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:49:47.300411 0.000000 udp 10.0.2.105 7010 -> 178.82.135.21 9685 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:49:54.761109 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:00.332176 0.000000 udp 10.0.2.105 7010 -> 82.29.99.200 9573 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:03.265047 0.203701 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:50:07.209047 0.000000 udp 10.0.2.105 7010 -> 78.183.232.174 9522 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:08.050594 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:50:14.879685 0.000000 udp 10.0.2.105 7010 -> 78.173.79.147 3749 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:20.637865 0.194767 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:50:22.821419 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 1432 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:30.602797 0.000000 udp 10.0.2.105 7010 -> 89.241.188.141 8066 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:35.549343 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:50:38.054468 0.199330 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:50:39.355056 0.000000 udp 10.0.2.105 7010 -> 108.217.199.137 7525 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:47.947452 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:54.817255 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:50:57.273888 0.397314 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:01.827250 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:07.916181 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:15.721470 0.196257 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:16.168452 0.242298 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:16.410750 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 200 flow=Background 1970/01/31 12:51:21.044879 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:51:21.175260 0.000000 udp 10.0.2.105 7010 -> 211.186.137.130 9164 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:28.926229 0.000000 udp 10.0.2.105 7010 -> 87.146.194.169 3349 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:34.350037 0.204765 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:37.549222 0.000000 udp 10.0.2.105 7010 -> 182.74.88.66 5630 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:39.381769 0.199633 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 298 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:45.269945 0.000000 udp 10.0.2.105 7010 -> 94.6.0.35 4175 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:50.046627 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:51:52.333711 0.196921 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 7788 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:52.780754 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:51:57.436973 0.190506 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 385 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:51:59.049091 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:04.848180 0.000000 udp 10.0.2.105 7010 -> 86.128.174.253 8153 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:09.325234 0.200217 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 7053 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:52:12.819433 0.000000 udp 10.0.2.105 7010 -> 93.193.135.234 7662 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:14.050999 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:52:18.988626 0.179383 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:52:19.223402 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:25.738399 0.000000 udp 10.0.2.105 7010 -> 174.75.66.37 7814 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:28.232025 0.200337 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:52:31.015664 0.226965 udp 10.0.2.105 7010 <-> 174.28.10.32 4712 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:52:31.304562 0.000000 udp 10.0.2.105 7010 -> 37.141.100.3 6638 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:39.037229 0.056192 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:39.093421 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 239 flow=Background 1970/01/31 12:52:43.553486 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:52:45.791212 0.206276 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:52:46.247973 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:51.545513 0.000000 udp 10.0.2.105 7010 -> 87.20.101.251 5580 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:52:58.525326 0.000000 udp 10.0.2.105 7010 -> 174.77.93.198 6494 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:04.232438 0.201584 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:53:05.825533 0.173972 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:53:06.020707 0.000000 udp 10.0.2.105 7010 -> 79.41.58.223 3968 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:09.049854 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:53:13.556850 0.062021 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:53:13.807353 0.000000 udp 10.0.2.105 7010 -> 88.226.109.59 1026 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:20.797278 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:21.125419 0.192698 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:53:27.226343 0.000000 udp 10.0.2.105 7010 -> 84.162.23.250 6671 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:34.236294 0.134086 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:53:34.391328 0.000000 udp 10.0.2.105 7010 -> 208.124.117.254 6762 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:37.531863 0.213969 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:53:39.554163 0.000000 udp 10.0.2.105 7010 -> 99.38.6.142 3840 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:45.383401 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:50.048893 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:53:52.943646 0.000000 udp 10.0.2.105 7010 -> 67.78.102.174 6984 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:53:54.421873 0.404059 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:54:00.153814 0.000000 udp 10.0.2.105 7010 -> 190.42.212.58 4136 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:09.116933 0.075919 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:54:09.210193 0.000000 udp 10.0.2.105 7010 -> 89.98.227.49 6425 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:12.161652 0.216774 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:54:14.053677 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:54:16.176657 0.000000 udp 10.0.2.105 7010 -> 70.45.165.242 1606 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:21.224067 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:28.784791 0.188435 udp 10.0.2.105 7010 <-> 105.235.30.37 1386 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:54:28.982325 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:30.843160 0.253018 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:54:36.435837 0.000000 udp 10.0.2.105 7010 -> 190.48.35.181 2146 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:41.052618 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:54:42.184529 0.000000 udp 10.0.2.105 7010 -> 79.6.87.35 2611 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:44.500891 3.002313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 12:54:47.973499 0.000000 udp 10.0.2.105 7010 -> 5.69.77.66 1148 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:49.910765 0.259277 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:54:51.507483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:54:53.530744 0.000000 udp 10.0.2.105 7010 -> 80.175.91.209 7359 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:54:59.509434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:55:02.363178 0.000000 udp 10.0.2.105 7010 -> 86.11.239.19 9895 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:07.049805 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:55:08.891034 0.312321 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:55:11.276127 0.000000 udp 10.0.2.105 7010 -> 216.43.174.194 9543 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:15.511904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:55:17.965643 0.000000 udp 10.0.2.105 7010 -> 213.160.24.138 3673 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:23.894222 0.000000 udp 10.0.2.105 7010 -> 176.205.230.216 8887 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:27.998336 0.348018 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:55:32.036097 0.059470 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:55:32.106175 0.000000 udp 10.0.2.105 7010 -> 86.139.169.97 2410 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:33.047135 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:55:39.847293 0.000000 udp 10.0.2.105 7010 -> 79.9.143.35 1060 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:45.742125 0.337280 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:55:47.517921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 12:55:48.389431 0.000000 udp 10.0.2.105 7010 -> 95.226.81.45 5425 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:55:53.526707 0.000000 udp 10.0.2.105 7010 -> 77.192.48.217 5402 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:00.306479 0.000000 udp 10.0.2.105 7010 -> 82.15.144.232 1211 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:02.788493 0.362080 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:56:05.584143 0.000000 udp 10.0.2.105 7010 -> 88.226.149.242 4451 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:10.551068 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:56:13.905896 0.000000 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:19.790007 0.467616 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:56:20.054776 0.155134 udp 10.0.2.105 7010 <-> 130.184.162.171 2702 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:56:20.220810 0.000000 udp 10.0.2.105 7010 -> 217.36.217.232 7048 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:27.886165 0.000000 udp 10.0.2.105 7010 -> 94.120.149.16 3260 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:34.756084 0.000000 udp 10.0.2.105 7010 -> 93.150.131.253 8462 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:36.734782 0.492773 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:56:39.553557 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:56:40.744761 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:47.975044 0.000000 udp 10.0.2.105 7010 -> 70.188.60.116 9735 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:56:54.411941 0.515522 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:56:56.467315 0.180103 udp 10.0.2.105 7010 <-> 67.236.122.86 7754 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/31 12:56:56.656729 0.000000 udp 10.0.2.105 7010 -> 203.45.59.75 7319 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:02.065436 0.000000 udp 10.0.2.105 7010 -> 94.66.38.135 3480 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:07.053108 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:57:09.656398 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:13.017512 0.476468 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:57:18.358917 0.000000 udp 10.0.2.105 7010 -> 201.247.102.50 9184 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:24.296911 0.000000 udp 10.0.2.105 7010 -> 77.8.221.165 5037 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:31.186415 0.435040 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:57:31.517748 0.000000 udp 10.0.2.105 7010 -> 118.39.80.146 3821 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:36.043849 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:57:37.336070 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 12:57:48.827799 0.480962 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:57:56.002579 0.968187 tcp 10.0.2.105 58840 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:58:07.169547 0.431101 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:58:25.097502 0.419928 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:58:30.052118 0.000268 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:58:42.822509 0.416755 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:59:00.036371 0.442233 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:59:05.053054 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:59:16.606750 0.466425 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:59:33.523451 0.462415 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 12:59:38.550375 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 12:59:50.814728 0.488627 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 13 8894 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:00:10.458566 0.243950 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:00:30.340350 0.204812 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:00:35.552347 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:00:50.599880 0.204724 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:00:55.631841 0.199580 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 285 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:00.548642 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:01:08.568575 0.201502 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 7801 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:13.728998 0.198095 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 152 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:19.218159 0.206887 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 316 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:26.295376 0.200099 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 7078 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:31.051908 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:01:43.279058 0.201130 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:01:51.523893 3.001909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 13:01:58.531365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:01:59.747522 0.210017 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:02:04.550607 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:02:06.533239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:02:15.401301 0.205059 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:02:22.535845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:02:31.055582 0.193289 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:02:36.045535 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:02:46.653226 0.198032 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:02:54.542109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:03:02.095978 0.198123 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:03:17.849903 0.206469 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:03:23.053284 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:03:34.060981 0.198812 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:03:50.990208 0.203836 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:03:56.049701 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:04:09.060065 0.399570 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:04:26.337079 0.397360 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:04:31.050389 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:04:43.249771 0.358114 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:04:59.265571 0.262531 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:05:14.245021 0.214549 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:05:19.049714 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:05:29.515305 0.264023 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:05:45.163823 0.562301 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:05:50.044386 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:06:00.550119 0.199860 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:06:15.398023 0.203384 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:06:20.548163 0.000212 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:06:30.591105 0.202639 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:06:46.310607 0.206663 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:07:02.419948 0.199227 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:07:17.987344 0.212208 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:07:23.047953 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:07:33.292846 0.200814 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:07:48.346233 0.198801 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 8678 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:07:53.557346 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:08:02.798320 0.437756 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:08:21.181236 0.400952 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:08:26.047912 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:08:35.623371 0.199820 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:08:48.900570 0.201194 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:08:53.932786 0.196113 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 279 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:08:59.548760 3.002763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 13:09:02.126157 0.194937 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 9 7807 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:09:06.556860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:09:07.206228 0.191837 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 2 148 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:09:12.208837 3.741808 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 11 7398 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:09:14.558252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:09:17.052133 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:09:29.172764 0.397233 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_PA 0 0 10 8732 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:09:30.561250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:09:42.439986 0.385035 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 FPA_* 0 0 12 6454 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:09:56.010023 0.000164 tcp 10.0.2.105 58839 -> 172.190.4.74 2008 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:10:02.567288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:16:06.573537 3.001607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 13:16:13.581162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:16:21.582765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:16:37.585207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:17:09.591730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:23:13.597382 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 13:23:20.604940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:23:28.606324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:23:44.609452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:24:16.615453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:27:53.106894 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:27:53.107082 0.076095 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:53.183693 0.144987 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:53.329080 0.142704 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:53.472195 0.256967 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:53.729544 0.351382 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.081361 0.163850 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.245623 0.073268 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.319281 0.078107 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.397791 0.068883 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.467043 0.039662 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.507107 0.169038 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.676681 0.203123 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:54.880372 0.172918 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:55.053721 0.141780 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:55.195872 0.059822 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:55.256057 0.210422 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:55.466883 0.073558 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:27:55.540795 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:27:56.972662 0.948590 tcp 10.0.2.105 58841 -> 128.255.183.224 9027 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:10.914268 0.043952 tcp 10.0.2.105 58842 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:10.958503 0.032048 tcp 10.0.2.105 58843 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:10.990882 0.132743 tcp 10.0.2.105 58844 -> 195.113.214.236 443 SRPA* 0 0 40 31908 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:11.124196 0.201188 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:11.325835 0.175589 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:11.501795 0.223319 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:11.725554 0.144703 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:11.870638 0.358282 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.229272 0.059769 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.289436 0.144180 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.433969 0.224694 udp 10.0.2.105 7010 <-> 174.28.10.32 4712 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.659035 0.171364 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.830793 0.051832 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:12.883016 0.132600 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:13.016018 0.072819 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:13.089237 0.328686 udp 10.0.2.105 7010 <-> 105.235.30.37 1386 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:13.418321 0.059699 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:28:13.478421 0.000000 udp 10.0.2.105 7010 -> 130.184.162.171 2702 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:28:31.452374 0.043495 tcp 10.0.2.105 58845 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:31.496177 0.031939 tcp 10.0.2.105 58846 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:31.528520 0.127639 tcp 10.0.2.105 58847 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:28:31.656686 0.181706 udp 10.0.2.105 7010 <-> 67.236.122.86 7754 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:30:20.621191 3.001920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 13:30:27.628985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:30:35.630121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:30:51.633416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:31:23.639262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:37:27.646053 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 13:37:34.653181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:37:42.654027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:37:58.657230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:38:30.663220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:44:34.669152 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 13:44:41.676846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:44:49.678170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:45:05.681650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:45:37.687106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:54:46.698610 3.002406 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 13:54:53.717017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:55:01.718702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:55:17.722078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:55:49.728054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 13:57:57.921986 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:57:57.922189 0.917940 tcp 10.0.2.105 58848 -> 128.255.183.224 9027 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:58:41.624789 1.354589 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:58:42.979782 0.000000 udp 10.0.2.105 7010 -> 130.184.162.171 2702 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:58:46.551315 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 13:58:59.981848 0.044066 tcp 10.0.2.105 58849 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:00.026124 0.031115 tcp 10.0.2.105 58850 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:00.057512 0.128381 tcp 10.0.2.105 58851 -> 195.113.214.236 443 SRPA* 0 0 42 34652 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:00.186423 0.073980 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:00.260842 0.144051 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:00.405266 0.000000 udp 10.0.2.105 7010 -> 67.71.151.221 6231 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:59:17.526590 0.043248 tcp 10.0.2.105 58852 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:17.570141 0.030956 tcp 10.0.2.105 58853 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:17.601310 0.129079 tcp 10.0.2.105 58854 -> 195.113.214.236 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:17.730900 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:59:35.893265 0.043114 tcp 10.0.2.105 58855 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:35.936677 0.032141 tcp 10.0.2.105 58856 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:35.969100 0.125586 tcp 10.0.2.105 58857 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:36.095111 0.070746 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:36.166250 0.222641 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:36.389295 0.136677 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:36.526353 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 13:59:54.910129 0.043474 tcp 10.0.2.105 58858 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:54.953877 0.030826 tcp 10.0.2.105 58859 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:54.984961 0.128709 tcp 10.0.2.105 58860 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/01/31 13:59:55.114155 0.211819 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.326434 0.173196 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.500061 0.145416 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.645911 0.062154 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.708694 0.080377 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.789464 0.062522 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.852601 0.040201 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:55.893211 0.221447 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:56.115071 0.074230 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:56.189693 0.202325 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:56.392577 0.361217 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/31 13:59:56.754179 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:00:13.366829 0.043264 tcp 10.0.2.105 58861 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:13.410356 0.031339 tcp 10.0.2.105 58862 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:13.441991 0.123928 tcp 10.0.2.105 58863 -> 195.113.214.236 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:13.566383 0.213432 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:13.780181 0.172150 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:13.952756 0.124154 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:14.077269 0.000000 udp 10.0.2.105 7010 -> 174.28.10.32 4712 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:00:31.302524 0.042977 tcp 10.0.2.105 58864 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:31.345823 0.031038 tcp 10.0.2.105 58865 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:31.377137 0.128142 tcp 10.0.2.105 58866 -> 195.113.214.236 443 SRPA* 0 0 40 33956 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:31.505920 0.176489 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:31.682905 0.060505 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:31.743844 0.132016 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:31.876443 0.070535 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:31.947402 0.149568 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:32.097368 0.062414 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:32.160164 0.149338 udp 10.0.2.105 7010 <-> 105.235.30.37 1386 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:00:32.309898 0.000000 udp 10.0.2.105 7010 -> 67.236.122.86 7754 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:00:48.728059 0.043725 tcp 10.0.2.105 58867 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:48.772082 0.030904 tcp 10.0.2.105 58868 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:00:48.803282 0.125603 tcp 10.0.2.105 58869 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:01:53.733005 3.001820 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 14:02:00.740788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:02:08.742001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:02:24.745051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:02:56.751244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:09:02.760914 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:09:09.767192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:09:17.768779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:09:33.771889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:10:05.777823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:16:09.784140 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:16:16.791561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:16:24.792858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:16:40.795743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:17:12.801895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:23:16.808282 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:23:23.815371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:23:31.816834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:23:47.819669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:24:19.825795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:27:58.841062 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 14:27:58.841243 1.032984 tcp 10.0.2.105 58870 -> 128.255.183.224 9027 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:30:23.833020 3.011726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:30:30.839311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:30:38.842317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:30:52.480868 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 14:30:52.480963 0.481215 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:30:52.962544 0.163646 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:30:53.126640 0.168930 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:30:53.296029 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:30:54.843752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:31:11.769943 0.042783 tcp 10.0.2.105 58871 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:11.813008 0.031839 tcp 10.0.2.105 58872 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:11.845110 0.126416 tcp 10.0.2.105 58873 -> 195.113.214.236 443 SRPA* 0 0 29 15266 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:11.972097 0.000000 udp 10.0.2.105 7010 -> 174.28.10.32 4712 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:31:26.849854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:31:29.293943 0.040636 tcp 10.0.2.105 58874 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:29.334867 0.031017 tcp 10.0.2.105 58875 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:29.366186 0.124694 tcp 10.0.2.105 58876 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:29.491505 0.000000 udp 10.0.2.105 7010 -> 67.236.122.86 7754 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 14:31:45.777787 0.044382 tcp 10.0.2.105 58877 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:45.822452 0.031368 tcp 10.0.2.105 58878 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:45.854099 0.127691 tcp 10.0.2.105 58879 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/01/31 14:31:45.982343 0.814192 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:46.796946 0.145437 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:46.942779 0.075132 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.018293 0.142191 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.160852 0.070514 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.231775 0.214662 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.446898 0.207847 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.655157 0.060214 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.715724 0.040032 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.756144 0.143898 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.900435 0.078640 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:47.979450 0.204358 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:48.184451 0.094290 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:48.279195 0.059789 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:48.339404 0.171177 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:48.510981 0.237884 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:48.749262 0.357375 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.107004 0.212653 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.320074 0.171825 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.492447 0.123874 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.616683 0.179856 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.796877 0.072160 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:49.869382 0.131757 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:50.001508 0.053096 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:50.054979 0.058073 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:50.113447 0.153328 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:31:50.267237 0.185850 udp 10.0.2.105 7010 <-> 105.235.30.37 1386 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/01/31 14:37:30.855590 3.002035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:37:37.863359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:37:45.864780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:38:01.867876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:38:33.873838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:44:37.879573 3.004077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:44:44.892495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:44:52.889171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:45:08.891889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:45:40.897541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:54:48.908010 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 14:54:55.915782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:55:03.917183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:55:19.920017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:55:51.926301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 14:57:59.880487 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 14:57:59.880626 0.906056 tcp 10.0.2.105 58880 -> 128.255.183.224 9027 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/01/31 15:01:55.931980 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:02:02.939721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:02:10.941342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:02:14.496340 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 15:02:14.496536 0.167711 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:14.664697 0.152894 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:14.817985 0.164124 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:14.982586 0.075908 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:15.058896 0.137863 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:15.197182 0.066146 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:15.263739 1.292707 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:16.556875 0.140006 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:16.697328 0.237843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:16.935576 0.205477 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.141481 0.060681 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.202556 0.044791 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.247746 0.158743 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.406947 0.142931 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.550281 0.208451 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.759120 0.078823 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.838366 0.060294 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:17.899101 0.356759 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:18.256425 0.218893 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:18.475693 0.173294 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:18.649432 0.282457 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:18.932353 0.175095 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.107880 0.144663 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.252969 0.173986 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.427415 0.071193 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.499059 0.132269 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.631731 0.051778 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.683946 0.061505 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.745874 0.140486 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:19.886774 0.197880 udp 10.0.2.105 7010 <-> 105.235.30.37 1386 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:02:26.944536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:02:58.950423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:09:04.959247 3.001734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:09:11.966557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:09:19.968046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:09:35.971142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:10:07.977009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:16:11.982906 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:16:18.990805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:16:26.992373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:16:42.995147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:17:15.000630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:23:19.007393 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:23:26.014521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:23:34.016149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:23:50.019169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:24:22.025416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:28:00.789799 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 15:28:00.789961 0.911685 tcp 10.0.2.105 58881 -> 128.255.183.224 9027 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/01/31 15:30:26.030967 3.002165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:30:33.038783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:30:41.040099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:30:57.043192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:31:29.048586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:32:22.709194 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 15:32:22.709400 0.700089 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:23.409976 0.226652 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:23.637069 0.165076 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:23.802576 0.075312 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:23.878346 0.144829 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:24.029057 0.074166 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:24.103711 0.221646 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:24.325768 0.210871 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:24.537090 0.060253 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:24.597814 1.034508 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:25.632732 0.143409 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:25.776528 0.038890 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:25.815785 0.145883 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:25.962056 0.073428 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.035898 0.200502 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.236880 0.080171 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.317486 0.054677 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.372525 0.359233 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.732158 0.213051 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:26.945577 0.228597 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:27.174552 0.356228 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:27.531211 0.173131 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:27.704746 0.123827 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:27.828962 0.173730 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.003113 0.072017 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.075516 0.132883 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.208828 0.142345 udp 10.0.2.105 7010 <-> 151.75.170.33 7526 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.351558 0.058051 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.410051 0.201420 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 15:32:28.611859 0.000000 udp 10.0.2.105 7010 -> 105.235.30.37 1386 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 15:32:44.839742 0.061186 tcp 10.0.2.105 58882 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 15:32:44.901212 0.054879 tcp 10.0.2.105 58883 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 15:32:44.956537 0.144736 tcp 10.0.2.105 58884 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/01/31 15:37:33.055888 3.000849 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:37:40.062635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:37:48.063571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:38:04.066562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:38:36.073188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:44:40.079286 3.001470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:44:47.086874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:44:55.088165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:45:11.090933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:45:43.096983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:54:51.107166 3.002260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 15:54:58.115214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:55:06.116185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:55:22.119743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:55:54.125518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 15:58:01.709461 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 15:58:01.709665 0.911668 tcp 10.0.2.105 58885 -> 128.255.183.224 9027 FSPA* 0 0 15 1744 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:01:58.130996 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:02:05.139296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:02:13.140621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:02:29.143809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:03:01.149355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:03:02.442028 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 16:03:02.442197 0.000000 udp 10.0.2.105 7010 -> 105.235.30.37 1386 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 16:03:21.049848 0.064638 tcp 10.0.2.105 58886 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:21.114746 0.053540 tcp 10.0.2.105 58887 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:21.168551 0.144165 tcp 10.0.2.105 58888 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:21.313287 0.150190 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:21.463859 0.165293 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:21.629601 0.074527 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:21.704660 0.142476 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:21.847568 0.064541 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:21.912547 0.222776 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.135694 0.166740 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.302845 0.063422 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.366673 0.211370 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.578466 0.045392 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.624434 0.145838 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.770732 0.072071 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:22.843220 0.208021 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:23.051626 0.143599 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:23.195650 1.152821 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:24.348883 0.077668 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:24.426976 0.215331 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:24.642755 0.062091 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:24.705297 0.173431 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:24.879122 0.360225 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:25.239783 0.178817 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:25.418963 0.151830 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:25.571184 0.238218 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:25.809816 0.072198 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:25.882450 0.138258 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:26.021116 0.000000 udp 10.0.2.105 7010 -> 151.75.170.33 7526 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 16:03:44.523050 0.060253 tcp 10.0.2.105 58889 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:44.583578 0.054900 tcp 10.0.2.105 58890 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:44.638743 0.144780 tcp 10.0.2.105 58891 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:03:44.784008 0.174986 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:44.959405 0.055582 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:03:45.015364 0.146642 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:09:08.159255 3.002427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:09:15.166941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:09:23.168544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:09:39.171642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:10:11.177562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:16:15.184720 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:16:22.191178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:16:30.192938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:16:46.195291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:17:18.201839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:23:22.207415 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:23:29.215251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:23:37.216795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:23:53.219424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:24:25.225446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:28:02.628397 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 16:28:02.628500 0.923984 tcp 10.0.2.105 58892 -> 128.255.183.224 9027 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:30:29.232104 3.001245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:30:36.239214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:30:44.240236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:31:00.244454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:31:32.249231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:33:57.649365 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 16:33:57.649464 0.000000 udp 10.0.2.105 7010 -> 151.75.170.33 7526 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 16:34:13.102233 0.062852 tcp 10.0.2.105 58893 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:34:13.165358 0.053281 tcp 10.0.2.105 58894 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:34:13.218963 0.144707 tcp 10.0.2.105 58895 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:34:13.364219 0.173439 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:13.538111 0.166554 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:13.705016 0.074593 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:13.779994 0.214601 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:13.994962 0.165697 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.161066 0.061678 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.223123 0.092273 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.315854 0.147686 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.463959 0.047052 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.511459 0.213554 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.725461 0.069968 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:14.795770 0.460261 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.256572 0.144511 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.401491 0.145446 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.547346 0.061097 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.608816 0.172667 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.781829 0.083244 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:15.865506 1.022312 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:16.888210 0.221256 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.109889 0.176341 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.286689 0.138002 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.425169 0.220665 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.646297 0.072145 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.718846 0.133342 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:17.852620 0.363258 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:18.216326 0.147177 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:18.363941 0.173810 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:34:18.538202 0.062604 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 16:37:36.256522 3.000775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:37:43.263309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:37:51.264450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:38:07.267171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:38:39.273552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:44:43.280634 3.010676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:44:50.297024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:44:58.298367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:45:14.301590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:45:46.307816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:51:50.314376 3.000693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:51:57.320841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:52:05.322798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:52:21.325446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:52:53.331494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:58:03.558834 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 16:58:03.559025 0.989418 tcp 10.0.2.105 58896 -> 128.255.183.224 9027 FSPA* 0 0 14 1504 flow=From-Botnet-V2-TCP-Established 1970/01/31 16:58:57.338368 3.000954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 16:59:04.344525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:59:12.346622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 16:59:28.349651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:00:00.355640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:04:42.111461 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 17:04:42.111635 0.149692 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.261743 0.165730 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.427868 0.066835 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.495081 0.221264 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.716791 0.167022 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.884206 0.060387 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:42.944984 0.071375 udp 10.0.2.105 7010 <-> 86.151.73.65 8024 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:43.016784 0.212387 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:43.229559 0.073986 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:43.303995 0.649485 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:43.953899 0.136469 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:44.090734 0.039691 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:44.130833 0.146511 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:44.277698 0.144626 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:44.422753 0.060037 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:04:44.483172 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 17:05:00.438933 0.062577 tcp 10.0.2.105 58897 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:00.501713 0.053785 tcp 10.0.2.105 58898 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:00.555782 0.147533 tcp 10.0.2.105 58899 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:00.703991 0.087487 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:00.791877 0.175992 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:00.968269 0.662459 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:01.631170 0.234916 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:01.866427 0.130826 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:01.997647 0.216768 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:02.214813 0.072386 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:02.287633 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 17:05:20.486307 0.062917 tcp 10.0.2.105 58900 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:20.549506 0.054080 tcp 10.0.2.105 58901 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:20.603862 0.141709 tcp 10.0.2.105 58902 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:05:20.746112 0.361673 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:21.108255 0.145672 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:21.254284 0.175450 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:05:21.430083 0.059157 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:06:29.367421 3.001860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 17:06:36.374630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:06:44.376094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:07:00.379387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:07:32.385448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:13:36.391826 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:13:43.398696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:13:51.400542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:14:07.403339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:14:39.409425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:20:43.420949 2.996373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:20:50.428966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:20:58.424186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:21:14.427359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:21:46.433384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:27:50.439988 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:27:57.446188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:28:04.547720 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 17:28:04.547900 0.956059 tcp 10.0.2.105 58903 -> 128.255.183.224 9027 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:28:05.448221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:28:21.451291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:28:53.461615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:34:57.466449 2.998435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:35:04.471020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:35:12.472364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:35:28.475130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:35:42.515828 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 17:35:42.515980 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 17:35:59.251477 0.060760 tcp 10.0.2.105 58904 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:35:59.312597 0.054999 tcp 10.0.2.105 58905 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:35:59.367954 0.145838 tcp 10.0.2.105 58906 -> 195.113.214.236 443 SRPA* 0 0 32 22198 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:35:59.514468 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 17:36:00.481565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:36:16.464846 0.059982 tcp 10.0.2.105 58907 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:16.525143 0.054146 tcp 10.0.2.105 58908 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:16.579165 0.148971 tcp 10.0.2.105 58909 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:16.728771 0.102654 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:16.831826 0.163878 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:16.996039 0.149154 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:17.145590 0.223762 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:17.369755 0.000000 udp 10.0.2.105 7010 -> 86.151.73.65 8024 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 17:36:33.168417 0.060229 tcp 10.0.2.105 58910 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:33.228894 0.054096 tcp 10.0.2.105 58911 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:33.283340 0.147609 tcp 10.0.2.105 58912 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/01/31 17:36:33.431413 0.211193 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:33.642988 0.060738 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:33.704166 0.313978 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.018532 0.168389 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.187381 0.083822 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.271644 0.144180 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.416287 0.060171 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.476893 0.144479 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.621806 0.040760 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.662994 0.143635 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.807010 0.172635 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:34.980044 0.077148 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:35.057596 0.144872 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:35.202870 0.219527 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:35.422802 0.072427 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:35.495682 0.214062 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:35.710154 0.327364 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:36.037945 0.171949 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:36.210286 0.059910 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:36.270581 0.357129 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:36:36.628095 0.144814 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/01/31 17:42:04.486785 3.067186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:42:11.532595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:42:19.510677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:42:35.509104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:43:07.515507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:53:30.523788 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 17:53:37.534455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:53:45.533023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:54:01.535953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:54:33.541857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 17:58:05.506830 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 17:58:05.507056 0.919640 tcp 10.0.2.105 58913 -> 128.255.183.224 9027 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:00:37.547431 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:00:44.555424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:00:52.556936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:01:08.559660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:01:40.566301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:06:38.714966 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 18:06:38.715163 0.000000 udp 10.0.2.105 7010 -> 86.151.73.65 8024 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 18:06:57.323366 0.061537 tcp 10.0.2.105 58914 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:06:57.384740 0.031329 tcp 10.0.2.105 58915 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:06:57.416396 0.144092 tcp 10.0.2.105 58916 -> 195.113.214.236 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:06:57.560798 0.227784 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:57.789034 0.165215 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:57.954788 0.068700 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:58.023977 0.144456 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:58.168830 0.208879 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:58.378126 0.062010 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:06:58.440615 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 18:07:13.845428 0.059516 tcp 10.0.2.105 58917 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:13.905220 0.053664 tcp 10.0.2.105 58918 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:13.958702 0.123503 tcp 10.0.2.105 58919 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:14.082741 0.168223 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:14.251369 0.075936 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:14.327727 0.146023 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:14.474161 0.068020 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:14.542585 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 18:07:33.416808 0.059957 tcp 10.0.2.105 58920 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:33.477092 0.053836 tcp 10.0.2.105 58921 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:33.531291 0.145864 tcp 10.0.2.105 58922 -> 195.113.214.236 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:07:33.677791 0.046554 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:33.724809 0.147995 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:33.873248 0.171901 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:34.045603 0.082266 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:34.128244 0.130594 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:34.259303 0.260652 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:34.520406 0.318358 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:34.839187 0.173926 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:35.013496 0.058820 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:35.072748 0.212610 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:35.285801 0.072262 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:35.358416 0.364956 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:35.723764 0.148021 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:07:44.570725 3.002695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 18:07:51.578996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:07:59.580572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:08:15.588725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:08:47.589477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:14:51.595444 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:14:58.602725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:15:06.605237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:15:22.608462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:15:54.613585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:21:58.619972 3.011271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:22:05.637093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:22:13.638750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:22:29.641672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:23:01.647682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:28:06.426359 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 18:28:06.426473 1.002437 tcp 10.0.2.105 58923 -> 128.255.183.224 9027 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/01/31 18:29:05.653772 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:29:12.663362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:29:20.666708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:29:36.684457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:30:08.681672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:36:12.687792 3.001360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:36:19.695332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:36:27.696753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:36:43.699478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:37:15.705382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:37:58.557145 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 18:37:58.557313 0.201225 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:58.758981 0.148315 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:58.907679 0.232689 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.140779 0.174126 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.315358 0.072124 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.387878 0.212294 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.600577 0.141649 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.742637 0.060485 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.803548 0.169112 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:37:59.973057 0.144580 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.118006 0.080377 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.198836 0.059150 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.258337 0.045283 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.303993 0.145136 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.449494 0.151843 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.601785 0.212449 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:00.814572 0.220019 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.034961 0.078613 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.114014 0.332905 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.447293 0.177620 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.625370 0.060401 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.686213 0.212711 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.899266 0.071842 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:01.971468 0.357311 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:38:02.329224 0.142888 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 18:43:19.711348 3.021186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:43:26.728954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:43:34.730220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:43:50.733287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:44:22.739425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:54:08.755559 3.001011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 18:54:15.762284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:54:23.763382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:54:39.766999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:55:11.773312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 18:58:07.435493 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 18:58:07.435661 0.977491 tcp 10.0.2.105 58924 -> 128.255.183.224 9027 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/01/31 19:01:15.778493 3.002029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:01:22.786284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:01:30.787472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:01:46.790276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:02:18.796648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:08:03.963072 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 19:08:03.963238 0.503531 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:04.467182 0.166206 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:04.633793 0.075609 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:04.709791 0.964090 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:05.674287 0.151543 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:05.826217 0.210440 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.037080 0.146243 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.183746 0.060066 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.244464 0.167520 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.412543 0.141516 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.554516 0.124152 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.679104 0.058994 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.738554 0.046831 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.785775 0.211356 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:06.997502 0.175590 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:07.173457 0.091789 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:07.265614 0.144869 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:07.410885 0.144797 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:07.556042 0.321079 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:07.877509 0.174510 udp 10.0.2.105 7010 <-> 108.95.26.135 6940 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:08.052393 0.057985 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:08.110781 0.211982 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:08.323224 0.072466 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:08.396152 0.366971 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:08.763524 0.140241 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:08:22.803080 3.001057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:08:29.809952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:08:37.811564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:08:53.814315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:09:25.820679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:15:29.827046 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:15:36.833903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:15:44.835494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:16:00.844433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:16:32.844180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:22:36.851343 3.000919 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:22:43.857884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:22:51.859652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:23:07.862735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:23:39.868372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:28:08.414946 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 19:28:08.415110 0.930560 tcp 10.0.2.105 58925 -> 128.255.183.224 9027 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/01/31 19:29:43.874754 3.003804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:29:50.881800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:29:58.883266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:30:14.886289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:30:46.892759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:36:50.899045 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:36:57.906019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:37:05.906871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:37:21.910159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:37:53.916639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:38:16.509201 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 19:38:16.509352 0.071343 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:16.581104 0.225015 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:16.806479 0.164284 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:16.971094 0.204361 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.175809 0.147032 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.323241 0.060956 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.384683 0.210027 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.595156 0.148549 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.744137 0.187615 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:17.932112 0.143198 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.075681 0.075781 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.151836 0.059250 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.211456 0.040503 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.252339 0.212905 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.465610 0.174507 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.640760 0.075870 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.717014 0.138631 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:18.856075 0.000000 udp 10.0.2.105 7010 -> 108.95.26.135 6940 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 19:38:36.710095 0.061675 tcp 10.0.2.105 58926 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 19:38:36.772042 0.053961 tcp 10.0.2.105 58927 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 19:38:36.826276 0.126820 tcp 10.0.2.105 58928 -> 195.113.214.236 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/01/31 19:38:36.953673 0.058858 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:37.012897 0.211394 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:37.224662 0.073680 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:37.298765 0.144990 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:37.444442 0.323730 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:37.768665 0.363751 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:38:38.132870 0.142703 udp 10.0.2.105 7010 <-> 74.12.172.185 3419 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/01/31 19:43:57.922387 3.076438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:44:04.968155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:44:12.951331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:44:28.954377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:45:00.959896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:54:27.968302 3.011032 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 19:54:34.985275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:54:42.988950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:54:58.990276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:55:30.996550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 19:58:09.344594 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 19:58:09.344708 0.935650 tcp 10.0.2.105 58929 -> 128.255.183.224 9027 FSPA* 0 0 14 1499 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:01:35.002699 3.001459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 20:01:42.009540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:01:50.011189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:02:06.013848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:02:38.020518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:08:42.025757 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 20:08:49.033575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:08:57.035107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:08:59.669470 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:08:59.669660 0.000000 udp 10.0.2.105 7010 -> 108.95.26.135 6940 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:09:13.038252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:09:16.365123 0.062988 tcp 10.0.2.105 58930 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:16.428420 0.052621 tcp 10.0.2.105 58931 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:16.481338 0.124681 tcp 10.0.2.105 58932 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:16.606574 0.164097 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:16.771090 0.208025 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:16.979484 0.145511 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.125448 0.063864 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.189670 0.072718 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.262820 0.232223 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.495446 0.168615 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.664475 0.143490 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.808354 0.074408 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.883178 0.060158 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.943750 0.046088 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:17.990251 0.137370 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.127972 0.210853 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.339189 0.143198 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.482829 0.220177 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.703395 0.178728 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.882537 0.078601 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:18.961519 0.061620 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:19.023516 0.212640 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:19.236546 0.070639 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:19.307617 0.359522 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:19.667547 0.000000 udp 10.0.2.105 7010 -> 74.12.172.185 3419 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:09:37.924789 0.065746 tcp 10.0.2.105 58933 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:37.990859 0.053177 tcp 10.0.2.105 58934 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:38.044553 0.125644 tcp 10.0.2.105 58935 -> 195.113.214.236 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:09:38.170846 0.123932 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:38.295170 0.332273 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:38.639070 0.000000 udp 10.0.2.105 7010 -> 74.12.172.185 3419 REQ 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:09:45.044255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:09:47.227248 0.204819 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:47.432624 0.146110 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:47.579188 0.049761 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 654 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:47.629365 0.066666 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:47.696493 0.164737 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:47.861694 0.221178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.083330 0.068927 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.152808 0.051256 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.204533 0.047601 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.252705 0.139773 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.392955 0.213398 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.606770 0.143054 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.750303 0.175008 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:48.925798 0.215908 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.142130 0.178589 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.321190 0.074365 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.396031 0.054059 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.450561 0.216420 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.667464 0.073676 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.741618 0.142043 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:49.884126 0.373280 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:50.257850 0.124309 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:50.382593 0.375809 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:09:50.758946 0.000000 udp 10.0.2.105 7010 -> 77.176.159.228 9077 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:09:58.363472 0.175793 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:09:58.539265 0.000000 icmp 66.55.26.130 0x0303 -> 10.0.2.105 0x2b20 URP 192 1 158 flow=Background 1970/01/31 20:10:03.039858 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:10:05.654135 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:10.851543 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:18.342086 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1803 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:23.369428 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:28.045752 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:10:29.578604 0.000000 udp 10.0.2.105 7010 -> 178.215.218.157 9435 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:35.456812 0.000000 udp 10.0.2.105 7010 -> 65.200.21.130 5172 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:42.736994 0.000000 udp 10.0.2.105 7010 -> 85.210.60.134 6242 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:51.659960 0.000000 udp 10.0.2.105 7010 -> 95.226.81.61 6156 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:10:56.546968 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:10:56.847271 0.000000 udp 10.0.2.105 7010 -> 85.5.215.82 9121 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:03.316197 0.000000 udp 10.0.2.105 7010 -> 182.68.226.123 4781 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:08.474345 0.000000 udp 10.0.2.105 7010 -> 220.100.111.194 9297 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:14.993590 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:20.922024 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 1432 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:25.548630 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:11:29.895037 0.000000 udp 10.0.2.105 7010 -> 220.233.11.220 7713 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:38.547624 0.000000 udp 10.0.2.105 7010 -> 175.142.63.133 6841 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:46.148829 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:11:51.045038 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:11:52.747932 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:00.819207 0.000000 udp 10.0.2.105 7010 -> 175.141.166.117 1351 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:09.622032 0.055399 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:12:09.791831 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:18.274811 0.000000 udp 10.0.2.105 7010 -> 78.185.80.210 7209 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:23.041189 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:12:25.054299 0.000000 udp 10.0.2.105 7010 -> 117.208.37.228 1082 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:32.264486 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:37.522139 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:45.964498 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:12:50.540885 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:12:53.134804 0.000000 udp 10.0.2.105 7010 -> 87.146.194.169 3349 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:01.488195 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:07.565637 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:14.205248 0.000000 udp 10.0.2.105 7010 -> 93.193.138.193 7662 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:19.042021 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:13:21.325309 0.032912 udp 10.0.2.105 7010 <-> 79.227.160.121 2430 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:13:21.369855 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:29.386539 0.000000 udp 10.0.2.105 7010 -> 87.20.101.251 5580 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:35.665580 0.000000 udp 10.0.2.105 7010 -> 2.177.151.118 4373 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:43.607320 0.000000 udp 10.0.2.105 7010 -> 203.88.142.222 8045 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:48.544420 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:13:49.385814 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:13:55.814905 0.000000 udp 10.0.2.105 7010 -> 123.243.15.11 5336 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:04.387221 0.000000 udp 10.0.2.105 7010 -> 41.86.46.57 4350 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:12.679482 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:17.545706 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:14:18.657747 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:23.935099 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:32.757893 0.000000 udp 10.0.2.105 7010 -> 184.243.167.4 9444 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:40.469110 0.083412 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:40.552522 0.000000 icmp 86.137.93.212 0x0303 -> 10.0.2.105 0x6804 URP 192 1 141 flow=Background 1970/01/31 20:14:45.044840 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:14:48.190113 0.000000 udp 10.0.2.105 7010 -> 202.82.115.137 3144 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:14:53.307398 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:01.789242 0.000000 udp 10.0.2.105 7010 -> 94.9.204.103 5485 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:09.210512 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:14.047235 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:15:15.449564 0.000000 udp 10.0.2.105 7010 -> 150.101.187.95 2211 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:22.859822 0.000000 udp 10.0.2.105 7010 -> 90.34.203.81 5368 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:28.578335 0.345017 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:15:28.946130 0.000000 udp 10.0.2.105 7010 -> 126.67.222.54 1324 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:36.499481 0.000000 udp 10.0.2.105 7010 -> 116.14.91.176 3400 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:41.045865 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:15:45.322185 0.000000 udp 10.0.2.105 7010 -> 125.205.213.81 1498 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:49.050194 3.001708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 20:15:51.320530 0.000000 udp 10.0.2.105 7010 -> 94.68.230.176 3325 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:15:56.057728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:15:58.461289 0.000000 udp 10.0.2.105 7010 -> 125.236.212.112 1096 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:04.059336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:16:06.773405 0.000000 udp 10.0.2.105 7010 -> 197.87.231.99 7503 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:11.539744 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:16:12.461624 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 5245 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:18.860362 0.000000 udp 10.0.2.105 7010 -> 58.152.119.230 8764 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:20.062172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:16:25.690245 0.000000 udp 10.0.2.105 7010 -> 59.99.249.64 8043 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:30.837776 0.000000 udp 10.0.2.105 7010 -> 27.104.71.244 9731 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:35.544530 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:16:39.460637 0.000000 udp 10.0.2.105 7010 -> 94.120.149.16 3260 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:48.263137 0.000000 udp 10.0.2.105 7010 -> 118.102.161.150 7226 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:52.067911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:16:53.450169 0.000000 udp 10.0.2.105 7010 -> 86.158.115.167 1371 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:16:59.097750 0.000000 udp 10.0.2.105 7010 -> 84.112.114.60 6227 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:04.045362 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:17:04.466061 0.000000 udp 10.0.2.105 7010 -> 78.172.161.61 2205 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:12.752025 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:20.369039 0.000000 udp 10.0.2.105 7010 -> 93.65.147.86 9153 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:28.170289 0.000000 udp 10.0.2.105 7010 -> 95.237.18.118 2426 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:33.047013 0.227774 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:17:33.583245 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:40.756155 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:48.845880 0.183250 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:17:49.165273 0.000000 udp 10.0.2.105 7010 -> 88.243.89.207 4072 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:56.060428 0.300371 udp 10.0.2.105 7010 -> 210.186.141.114 2496 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:17:56.360799 0.000000 icmp 210.186.141.114 0x0303 -> 10.0.2.105 0xc009 URP 192 1 168 flow=Background 1970/01/31 20:18:01.047162 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:18:01.207103 0.000000 udp 10.0.2.105 7010 -> 139.130.22.46 7144 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:10.102870 0.258212 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:18:10.404856 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:17.452059 0.000000 udp 10.0.2.105 7010 -> 210.124.233.2 8650 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:24.813630 0.000000 udp 10.0.2.105 7010 -> 165.228.75.134 2446 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:29.548382 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:18:32.362771 0.000000 udp 10.0.2.105 7010 -> 72.204.145.167 4486 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:39.673121 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:47.263843 0.000000 udp 10.0.2.105 7010 -> 69.234.20.39 7606 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:53.913539 0.000000 udp 10.0.2.105 7010 -> 96.44.34.101 4364 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:18:58.540011 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:19:00.773209 0.000000 udp 10.0.2.105 7010 -> 113.64.78.36 7648 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:07.242580 0.188355 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:07.504109 0.130610 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:07.645097 0.061462 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:07.763442 0.256284 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:08.052990 0.000000 udp 10.0.2.105 7010 -> 175.143.8.17 5896 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:14.392877 0.338851 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:14.801504 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 3275 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:22.454395 0.044760 udp 10.0.2.105 7010 -> 93.129.1.58 3830 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:22.499155 0.000000 icmp 93.129.1.58 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 156 flow=Background 1970/01/31 20:19:27.040913 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:19:29.264332 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:38.157031 0.375211 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:19:38.600857 0.000000 udp 10.0.2.105 7010 -> 27.4.177.110 5668 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:45.187278 0.000000 udp 10.0.2.105 7010 -> 120.151.39.192 2261 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:54.050173 0.000000 udp 10.0.2.105 7010 -> 86.128.192.196 4274 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:19:59.046839 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:19:59.858021 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:08.480757 0.000000 udp 10.0.2.105 7010 -> 41.134.208.1 9090 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:15.571182 0.000000 udp 10.0.2.105 7010 -> 75.53.34.58 4736 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:23.281919 0.187187 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:20:23.542793 0.408207 udp 10.0.2.105 7010 <-> 121.7.90.38 8975 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:20:24.033032 0.000000 udp 10.0.2.105 7010 -> 74.94.175.201 7900 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:28.048749 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:20:32.898728 0.000000 udp 10.0.2.105 7010 -> 5.245.45.52 6638 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:40.912547 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:47.961242 0.416841 udp 10.0.2.105 7010 <-> 101.83.238.230 9210 CON 0 0 2 679 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:20:48.446484 0.000000 udp 10.0.2.105 7010 -> 220.255.71.139 6437 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:20:52.543787 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:20:54.449816 0.000000 udp 10.0.2.105 7010 -> 24.86.232.250 1963 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:00.926051 0.077064 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:21:01.522082 0.148100 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:21:01.766194 0.655396 udp 10.0.2.105 7010 <-> 180.242.46.162 2020 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:21:02.806504 0.000000 udp 10.0.2.105 7010 -> 75.149.249.149 1750 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:10.288614 0.000000 udp 10.0.2.105 7010 -> 69.114.180.174 4705 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:19.118628 0.000000 udp 10.0.2.105 7010 -> 74.5.31.241 8825 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:23.672776 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:21:26.388652 0.000000 udp 10.0.2.105 7010 -> 151.29.154.203 1023 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:32.177415 0.000000 udp 10.0.2.105 7010 -> 24.239.41.224 7684 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:39.011073 0.381945 udp 10.0.2.105 7010 <-> 219.74.245.242 7213 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:21:39.468395 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5356 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:48.314128 0.000000 udp 10.0.2.105 7010 -> 12.139.152.4 6723 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:53.040160 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:21:53.982384 0.000000 udp 10.0.2.105 7010 -> 58.10.125.145 8390 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:21:59.940987 0.000000 udp 10.0.2.105 7010 -> 82.13.157.28 5710 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:22:05.989214 0.055695 udp 10.0.2.105 7010 <-> 176.73.98.103 6111 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:22:06.128575 0.000000 udp 10.0.2.105 7010 -> 108.83.57.248 5817 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:22:14.702185 0.000000 udp 10.0.2.105 7010 -> 90.214.206.121 9444 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:22:19.548916 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:22:21.121105 0.499898 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:22:21.785185 0.308626 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:22:56.074115 3.008695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 20:23:03.083108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:23:11.083217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:23:27.086193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:23:59.092044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:28:10.283570 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:28:10.283682 0.942041 tcp 10.0.2.105 58936 -> 128.255.183.224 9027 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:30:03.097245 3.006282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 20:30:10.105692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:30:18.106736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:30:34.110083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:31:06.115833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:37:10.122141 3.007787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 20:37:17.129549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:37:25.130880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:37:41.133880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:38:13.139640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:44:17.145256 3.046096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 20:44:24.170491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:44:32.165055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:44:48.167923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:45:20.173978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:52:30.973799 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:52:30.973996 0.209509 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.183980 0.144032 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.328509 0.059316 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.388234 0.069840 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.458468 0.164903 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.623757 0.223321 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.847440 0.077455 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.925251 0.058879 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:31.984659 0.038314 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.023369 0.134755 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.158521 0.198143 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.357022 0.145281 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.502730 0.207750 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.710839 0.212573 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:32.923797 0.174935 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.099183 0.083029 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.182658 0.212685 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.395776 0.072990 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.469158 0.146729 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.616460 0.358585 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:33.975437 0.137990 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:34.113837 0.057622 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:34.171866 0.416310 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:52:34.588726 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:52:50.453380 0.044411 tcp 10.0.2.105 58937 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:52:50.497986 0.054250 tcp 10.0.2.105 58938 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:52:50.552521 0.152476 tcp 10.0.2.105 58939 -> 195.113.214.236 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:52:50.705425 0.000000 udp 10.0.2.105 7010 -> 79.227.160.121 2430 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:53:06.725591 0.043234 tcp 10.0.2.105 58940 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:06.769133 0.053398 tcp 10.0.2.105 58941 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:06.822839 0.144092 tcp 10.0.2.105 58942 -> 195.113.214.236 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:06.967566 0.398322 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:07.366283 0.180714 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:07.547426 0.270615 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:07.818471 0.196096 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:08.014987 0.054778 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:08.070198 0.131978 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:08.202615 0.559623 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:08.762645 0.333188 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:09.096243 0.369657 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:09.466294 0.184543 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:09.651252 0.000000 udp 10.0.2.105 7010 -> 121.7.90.38 8975 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:53:28.487464 0.043699 tcp 10.0.2.105 58943 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:28.531509 0.052839 tcp 10.0.2.105 58944 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:28.584728 0.145429 tcp 10.0.2.105 58945 -> 195.113.214.236 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:28.730811 0.366306 udp 10.0.2.105 7010 <-> 101.83.238.230 9210 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:29.097452 0.061900 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:29.159753 0.147828 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:29.307990 0.000000 udp 10.0.2.105 7010 -> 180.242.46.162 2020 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 20:53:46.302714 0.043056 tcp 10.0.2.105 58946 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:46.346087 0.053219 tcp 10.0.2.105 58947 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:46.399566 0.146936 tcp 10.0.2.105 58948 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/01/31 20:53:46.546978 0.356910 udp 10.0.2.105 7010 <-> 219.74.245.242 7213 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:46.904347 0.061832 udp 10.0.2.105 7010 <-> 176.73.98.103 6111 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:46.966615 0.434841 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:53:47.401851 0.308732 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 20:54:38.188622 3.002167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 20:54:45.196640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:54:53.198024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:55:09.200594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:55:41.207051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 20:58:11.233104 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 20:58:11.233305 0.957142 tcp 10.0.2.105 58949 -> 128.255.183.224 9027 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:01:45.212897 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:01:52.220648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:02:00.221770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:02:16.225070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:02:48.230807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:08:52.236362 3.002306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:08:59.244703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:09:07.245837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:09:23.248900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:09:55.254938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:15:59.260813 3.001920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:16:06.268043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:16:14.269795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:16:30.272891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:17:02.278646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:23:06.285464 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:23:13.295369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:23:21.293832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:23:37.296751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:23:48.853581 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 21:23:48.853754 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:24:05.148954 0.044090 tcp 10.0.2.105 58950 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:05.193323 0.054078 tcp 10.0.2.105 58951 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:05.247696 0.147484 tcp 10.0.2.105 58952 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:05.395706 0.000000 udp 10.0.2.105 7010 -> 79.227.160.121 2430 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:24:09.303159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:24:20.890132 0.044103 tcp 10.0.2.105 58953 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:20.934509 0.052475 tcp 10.0.2.105 58954 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:20.987224 0.148243 tcp 10.0.2.105 58955 -> 195.113.214.236 443 SRPA* 0 0 52 41922 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:21.136202 0.000000 udp 10.0.2.105 7010 -> 121.7.90.38 8975 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:24:37.043251 0.043297 tcp 10.0.2.105 58956 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:37.086853 0.052321 tcp 10.0.2.105 58957 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:37.139425 0.151750 tcp 10.0.2.105 58958 -> 195.113.214.236 443 SRPA* 0 0 42 34646 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:37.291826 0.000000 udp 10.0.2.105 7010 -> 180.242.46.162 2020 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:24:55.970303 0.043209 tcp 10.0.2.105 58959 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:56.013816 0.052564 tcp 10.0.2.105 58960 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:56.066690 0.145684 tcp 10.0.2.105 58961 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:24:56.212861 0.206534 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:56.419840 0.567198 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:56.987434 0.063123 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.051004 0.148811 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.200213 0.164861 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.365531 0.072513 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.438504 0.208857 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.647747 0.146584 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.794746 0.137761 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.932897 0.045295 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:57.978582 0.082265 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.061243 0.061165 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.122761 0.174887 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.298036 0.213049 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.511526 0.166974 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.678916 0.081913 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.761250 0.139638 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:58.901299 0.212371 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:59.114076 0.073300 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:59.187750 0.065637 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:59.253803 0.130911 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:59.385212 0.357158 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:24:59.742782 0.414346 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:00.157672 0.160698 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:00.318734 0.344004 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:00.663120 0.179933 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:00.843498 0.058071 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:00.901976 0.196698 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:01.099092 0.135264 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:01.234744 0.332399 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:01.567536 0.347297 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:01.915194 0.369290 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:02.284869 0.183978 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:02.469341 0.000000 udp 10.0.2.105 7010 -> 101.83.238.230 9210 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:25:18.122751 0.042973 tcp 10.0.2.105 58962 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:18.166027 0.053643 tcp 10.0.2.105 58963 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:18.219928 0.151573 tcp 10.0.2.105 58964 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:18.372004 0.065285 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:18.437730 0.146901 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:18.585028 0.000000 udp 10.0.2.105 7010 -> 219.74.245.242 7213 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:25:33.855193 0.043860 tcp 10.0.2.105 58965 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:33.899421 0.053042 tcp 10.0.2.105 58966 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:33.952756 0.141498 tcp 10.0.2.105 58967 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:25:34.094756 0.057251 udp 10.0.2.105 7010 <-> 176.73.98.103 6111 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:34.152421 0.443642 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:25:34.596524 0.307303 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:28:12.192286 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 21:28:12.192392 0.995942 tcp 10.0.2.105 58968 -> 128.255.183.224 9027 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:30:13.312158 2.998167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 21:30:20.315945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:30:28.317708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:30:44.320916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:31:16.326722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:37:20.331967 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:37:27.340587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:37:35.341564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:37:51.344647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:38:23.351102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:44:27.356763 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:44:34.364080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:44:42.365606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:44:58.368853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:45:30.374276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:54:44.383669 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 21:54:51.391240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:54:59.393334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:55:15.395837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:55:36.106010 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 21:55:36.106224 0.000000 udp 10.0.2.105 7010 -> 101.83.238.230 9210 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:55:47.401770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 21:55:52.170443 0.044573 tcp 10.0.2.105 58969 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:55:52.215238 0.051865 tcp 10.0.2.105 58970 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:55:52.267408 0.134553 tcp 10.0.2.105 58971 -> 195.113.214.236 443 SRPA* 0 0 56 37946 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:55:52.402369 0.000000 udp 10.0.2.105 7010 -> 219.74.245.242 7213 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:56:07.621485 0.043530 tcp 10.0.2.105 58972 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:07.665284 0.052608 tcp 10.0.2.105 58973 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:07.718196 0.142680 tcp 10.0.2.105 58974 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:07.862163 0.164389 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.027017 0.065473 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.092908 0.223661 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.316991 0.206545 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.523941 0.146341 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.670709 0.144432 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.815571 0.136120 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.952140 0.045751 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:08.998331 0.092977 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.091759 0.204224 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.296408 0.174781 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.471574 0.074700 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.546969 0.060689 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.608088 0.145377 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.753808 0.212976 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:09.967214 0.072519 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.040148 0.060859 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.101398 0.137786 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.239570 0.213529 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.453508 0.083904 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.537868 0.168083 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:10.706401 0.358846 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:11.065629 0.837840 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:11.903874 0.161452 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:12.065696 0.183002 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:12.249138 0.133187 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:12.382694 0.366226 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:12.749286 0.057120 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:12.806768 0.195130 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:13.002256 0.404153 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:13.406792 0.286642 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:13.693845 0.342427 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:14.036666 0.184654 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:14.221771 0.069503 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:14.291632 0.142755 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:14.434741 0.000000 udp 10.0.2.105 7010 -> 176.73.98.103 6111 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 21:56:29.593869 0.043684 tcp 10.0.2.105 58975 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:29.637816 0.053749 tcp 10.0.2.105 58976 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:29.691850 0.141873 tcp 10.0.2.105 58977 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/01/31 21:56:29.834265 0.819468 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:56:30.654125 0.307403 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 21:58:13.191825 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 21:58:13.192111 0.898462 tcp 10.0.2.105 58978 -> 128.255.183.224 9027 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:01:51.408740 3.000856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 22:01:58.415297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:02:06.417233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:02:22.419862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:02:54.426109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:09:01.435998 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:09:08.443673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:09:16.445086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:09:32.448115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:10:04.454016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:16:08.459805 3.001831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:16:15.467742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:16:23.468915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:16:39.472037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:17:11.477754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:23:15.484042 3.002295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:23:22.491414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:23:30.492806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:23:46.495999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:24:18.502050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:26:45.233155 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 22:26:45.233262 0.000000 udp 10.0.2.105 7010 -> 176.73.98.103 6111 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 22:27:00.496872 0.043992 tcp 10.0.2.105 58979 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:00.541106 0.052255 tcp 10.0.2.105 58980 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:00.593666 0.153151 tcp 10.0.2.105 58981 -> 195.113.214.236 443 SRPA* 0 0 54 36986 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:00.747397 0.386508 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.134325 0.163448 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.298115 0.062648 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.361205 0.146306 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.507951 0.140989 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.649421 0.046461 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.696468 0.205417 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:01.902249 0.146870 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:02.049498 0.178038 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:02.227945 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 22:27:19.001933 0.043216 tcp 10.0.2.105 58982 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:19.045438 0.053504 tcp 10.0.2.105 58983 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:19.099205 0.147963 tcp 10.0.2.105 58984 -> 195.113.214.236 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:27:19.247668 0.075218 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.341314 0.059477 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.401206 0.064216 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.465813 0.072861 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.539065 0.060509 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.600014 0.137942 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.738408 0.143474 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:19.882314 0.211818 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:20.094556 0.167554 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:20.262557 1.329595 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:21.592760 0.213031 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:21.806207 0.078593 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:21.885207 0.180604 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:22.066156 0.134050 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:22.200572 0.726405 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:22.927382 0.221718 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:23.149512 0.054108 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:23.203974 0.345983 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:23.550355 0.198508 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:23.785081 0.265697 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:24.051157 0.369421 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:24.420960 0.360162 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:24.781491 0.181766 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:24.963709 0.067850 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:25.031973 0.139351 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:25.171717 2.258101 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:27:27.430223 0.307955 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:28:14.091246 0.964323 tcp 10.0.2.105 58985 -> 128.255.183.224 9027 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:30:22.507930 3.001752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 22:30:29.520195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:30:37.517008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:30:53.519670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:31:25.525998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:37:29.532626 3.001019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:37:36.539343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:37:44.540579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:38:00.543680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:38:32.549816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:44:36.556049 3.001311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:44:43.563404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:44:51.597860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:45:07.577920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:45:39.583794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:54:50.609195 3.001320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 22:54:57.616218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:55:05.617869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:55:21.621054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:55:53.627249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 22:57:33.090467 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 22:57:33.090632 0.406716 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:33.497738 0.432234 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:33.930403 0.164536 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:34.095325 0.146911 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:34.242668 0.060164 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:34.303278 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 22:57:52.479328 0.044626 tcp 10.0.2.105 58986 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:57:52.524327 0.055029 tcp 10.0.2.105 58987 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:57:52.579675 0.151947 tcp 10.0.2.105 58988 -> 195.113.214.236 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/01/31 22:57:52.732431 0.162285 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:52.895166 0.176090 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.071680 0.040205 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.112384 0.149868 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.262649 0.081707 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.344712 0.059683 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.404807 0.063795 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.468990 0.079879 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.549268 0.059517 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.609239 0.131744 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.741413 0.141592 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:53.883450 0.212620 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:54.096489 0.190790 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:54.287697 0.071094 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:54.359225 0.182154 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:54.541746 0.130603 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:54.672835 1.422808 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:56.096064 0.211364 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:56.307854 0.058154 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:56.366401 0.619785 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:56.986580 0.162575 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:57.149620 0.344328 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:57.494399 0.188007 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:57.682801 0.404410 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:58.087609 0.191809 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:58.279816 0.069832 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:58.350058 0.144767 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:58.495267 0.368576 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:58.864408 0.331679 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:59.196536 0.669270 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:57:59.866248 0.307879 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/01/31 22:58:15.060542 0.919034 tcp 10.0.2.105 58989 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:01:57.632969 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 23:02:04.640529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:02:12.641681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:02:28.644786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:03:00.650824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:09:12.707970 3.001889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:09:19.715771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:09:27.717069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:09:43.720120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:10:15.726314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:16:19.733204 3.000783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:16:26.739895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:16:34.741339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:16:50.744132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:17:22.750414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:23:26.755872 3.002156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:23:33.763990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:23:41.765710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:23:57.768762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:24:29.774256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:28:04.583644 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 23:28:04.583799 0.207711 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:04.791940 0.203155 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:04.995516 0.164593 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.160510 0.230602 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.391460 0.138977 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.530831 0.065275 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.596706 0.151457 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.748597 0.178487 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.927545 0.046065 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:05.973977 0.151180 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.125638 0.074655 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.200717 0.059170 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.260380 0.067626 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.328537 0.070634 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.399558 0.064457 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.464426 0.211753 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.676719 0.152526 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.829656 0.150279 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:06.980405 0.167439 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:07.148349 0.076240 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:07.224997 0.182234 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:07.407613 0.129302 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:07.537405 0.359467 udp 10.0.2.105 7010 <-> 1.160.247.177 7701 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:07.897276 0.211489 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:08.109194 0.052569 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:08.162206 0.345206 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:08.507833 0.325014 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:08.833212 0.199012 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:09.032591 0.186447 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:09.219374 0.252375 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:09.472139 0.186513 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:09.659222 0.372115 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:10.031776 0.067037 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:10.099185 0.151934 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:10.251549 0.373707 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:10.625686 3.331985 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:13.958062 0.309575 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:28:16.029986 0.923784 tcp 10.0.2.105 58990 -> 128.255.183.224 9027 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:30:33.779973 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:30:40.792088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:30:48.789192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:31:04.792132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:31:36.798361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:37:40.804636 3.001194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:37:47.811576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:37:55.813175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:38:11.816005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:38:43.822302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:44:47.828606 3.000967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:44:54.838922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:45:02.836957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:45:18.839796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:45:50.846121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:51:54.853996 2.999591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/01/31 23:52:01.859539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:52:09.861132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:52:25.863860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:52:57.870021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:58:16.958590 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/01/31 23:58:16.958732 3.004472 tcp 10.0.2.105 58991 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:58:22.867764 0.165982 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:23.034155 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 23:58:25.961941 0.000000 tcp 10.0.2.105 58991 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:58:31.962664 0.082112 tcp 10.0.2.105 58992 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:32.045104 0.054160 tcp 10.0.2.105 58993 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:32.099466 0.153418 tcp 10.0.2.105 58994 -> 195.113.214.236 443 SRPA* 0 0 41 23492 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:32.295657 2.999708 tcp 10.0.2.105 58995 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:58:40.927241 0.050496 tcp 10.0.2.105 58996 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:40.978035 0.054760 tcp 10.0.2.105 58997 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:41.033078 0.149452 tcp 10.0.2.105 58998 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:41.183094 0.201960 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:41.293681 0.000000 tcp 10.0.2.105 58995 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:58:41.385470 0.421273 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:41.807120 0.136179 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:41.943672 0.062013 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.006081 0.143966 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.150443 0.178024 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.328872 0.039771 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.369108 0.146937 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.516464 0.076016 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.592874 0.058212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.651471 0.066832 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.718703 0.059003 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.778124 0.090406 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:42.868941 0.211519 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:58:43.080889 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 23:58:47.293192 0.043986 tcp 10.0.2.105 58999 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:47.337431 0.052487 tcp 10.0.2.105 59000 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:47.390185 0.150710 tcp 10.0.2.105 59001 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:58:47.578649 3.008639 tcp 10.0.2.105 59002 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:58:56.595879 0.000000 tcp 10.0.2.105 59002 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:00.041442 0.044737 tcp 10.0.2.105 59003 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:00.086518 0.053305 tcp 10.0.2.105 59004 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:00.140169 0.231553 tcp 10.0.2.105 59005 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:00.372265 0.145079 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:00.517719 0.168524 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:00.686695 0.079457 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:00.766534 0.000000 udp 10.0.2.105 7010 -> 1.160.247.177 7701 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 23:59:01.876348 3.000878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/01/31 23:59:02.574883 0.066407 tcp 10.0.2.105 59006 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:02.641608 0.052888 tcp 10.0.2.105 59007 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:02.694819 0.149169 tcp 10.0.2.105 59008 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:02.890620 3.004088 tcp 10.0.2.105 59009 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:08.884676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:59:11.887550 0.000000 tcp 10.0.2.105 59009 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:16.884379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:59:17.886875 0.065498 tcp 10.0.2.105 59010 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:17.952672 0.053867 tcp 10.0.2.105 59011 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:18.006840 0.158450 tcp 10.0.2.105 59012 -> 195.113.214.236 443 SRPA* 0 0 41 34748 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:18.202250 2.998893 tcp 10.0.2.105 59013 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:19.338910 0.066730 tcp 10.0.2.105 59014 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:19.405927 0.054388 tcp 10.0.2.105 59015 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:19.460175 0.152355 tcp 10.0.2.105 59016 -> 195.113.214.236 443 SRPA* 0 0 41 23260 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:19.613227 0.211598 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:19.825215 0.056980 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:19.882595 0.182084 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:20.065086 0.129885 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:20.195497 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/01/31 23:59:27.199679 0.000000 tcp 10.0.2.105 59013 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:32.887907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/01/31 23:59:33.199428 0.065901 tcp 10.0.2.105 59017 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:33.265664 0.055758 tcp 10.0.2.105 59018 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:33.321790 0.161241 tcp 10.0.2.105 59019 -> 195.113.214.236 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:33.497704 3.005582 tcp 10.0.2.105 59020 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:36.603718 0.044181 tcp 10.0.2.105 59021 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:36.648176 0.054831 tcp 10.0.2.105 59022 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:36.703325 0.149317 tcp 10.0.2.105 59023 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/01/31 23:59:36.853167 0.470380 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:37.323930 0.160355 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:37.484727 0.181828 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:37.666970 1.444907 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:39.112392 0.068589 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:39.181394 0.142689 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:39.324493 0.346907 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:39.671806 0.185214 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:39.857393 0.358533 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:40.216524 0.717338 udp 10.0.2.105 7010 <-> 113.210.10.104 4346 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:40.934316 0.308822 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/01/31 23:59:42.501655 0.000000 tcp 10.0.2.105 59020 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:48.491097 3.003797 tcp 10.0.2.105 59024 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/01/31 23:59:57.493296 0.000000 tcp 10.0.2.105 59024 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:02.089848 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:00:03.492224 3.004177 tcp 10.0.2.105 59025 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:04.895552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:00:12.495000 0.000000 tcp 10.0.2.105 59025 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:18.493721 2.994233 tcp 10.0.2.105 59026 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:26.094220 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:00:27.496898 0.000000 tcp 10.0.2.105 59026 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:33.495337 2.994258 tcp 10.0.2.105 59027 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:00:42.488172 0.000000 tcp 10.0.2.105 59027 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:05:48.498788 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:05:48.498884 3.003370 tcp 10.0.2.105 59028 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:05:57.500981 0.000000 tcp 10.0.2.105 59028 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:03.501426 0.046179 tcp 10.0.2.105 59029 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:03.547933 0.054184 tcp 10.0.2.105 59030 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:03.602458 0.151758 tcp 10.0.2.105 59031 -> 195.113.214.236 443 SRPA* 0 0 39 33052 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:03.828304 2.995955 tcp 10.0.2.105 59032 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:12.823083 0.000000 tcp 10.0.2.105 59032 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:18.822139 0.044101 tcp 10.0.2.105 59033 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:18.866516 0.053283 tcp 10.0.2.105 59034 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:18.920104 0.155844 tcp 10.0.2.105 59035 -> 195.113.214.236 443 SRPA* 0 0 41 22062 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:19.093307 3.002643 tcp 10.0.2.105 59036 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:28.095085 0.000000 tcp 10.0.2.105 59036 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:33.906520 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:06:34.094246 0.043448 tcp 10.0.2.105 59037 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:34.137987 0.053640 tcp 10.0.2.105 59038 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:34.191966 0.154135 tcp 10.0.2.105 59039 -> 195.113.214.236 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:34.358163 3.000323 tcp 10.0.2.105 59040 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:40.913423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:06:43.367123 0.000000 tcp 10.0.2.105 59040 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:48.914877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:06:49.356042 0.044420 tcp 10.0.2.105 59041 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:49.400769 0.054881 tcp 10.0.2.105 59042 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:49.455971 0.147226 tcp 10.0.2.105 59043 -> 195.113.214.236 443 SRPA* 0 0 41 33158 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:06:49.621649 2.998477 tcp 10.0.2.105 59044 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:06:58.618940 0.000000 tcp 10.0.2.105 59044 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:04.617991 0.044518 tcp 10.0.2.105 59045 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:07:04.662758 0.053889 tcp 10.0.2.105 59046 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:07:04.716966 0.175189 tcp 10.0.2.105 59047 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:07:04.914913 2.997545 tcp 10.0.2.105 59048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:04.917891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:07:13.910173 0.000000 tcp 10.0.2.105 59048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:19.909542 3.003702 tcp 10.0.2.105 59049 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:28.912347 0.000000 tcp 10.0.2.105 59049 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:33.589181 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:07:34.911118 3.004345 tcp 10.0.2.105 59050 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:36.923851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:07:43.913929 0.000000 tcp 10.0.2.105 59050 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:49.913101 3.003972 tcp 10.0.2.105 59051 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:07:57.593617 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:07:58.915019 0.000000 tcp 10.0.2.105 59051 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:08:04.914398 2.994271 tcp 10.0.2.105 59052 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:08:13.907169 0.000000 tcp 10.0.2.105 59052 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:19.917081 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:13:19.917250 3.004120 tcp 10.0.2.105 59053 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:28.920192 0.000000 tcp 10.0.2.105 59053 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:34.920037 0.068199 tcp 10.0.2.105 59054 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:34.988544 0.054801 tcp 10.0.2.105 59055 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:35.043627 0.155578 tcp 10.0.2.105 59056 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:35.217039 2.996278 tcp 10.0.2.105 59057 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:40.929250 3.002394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:13:44.212098 0.000000 tcp 10.0.2.105 59057 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:47.937739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:13:50.210794 0.066515 tcp 10.0.2.105 59058 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:50.277613 0.052963 tcp 10.0.2.105 59059 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:50.330956 0.149818 tcp 10.0.2.105 59060 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:13:50.491653 3.003816 tcp 10.0.2.105 59061 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:13:55.938294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:13:59.493936 0.000000 tcp 10.0.2.105 59061 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:05.493378 0.044185 tcp 10.0.2.105 59062 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:05.537814 0.052915 tcp 10.0.2.105 59063 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:05.591030 0.148951 tcp 10.0.2.105 59064 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:05.751584 3.005506 tcp 10.0.2.105 59065 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:11.941813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:14:14.766149 0.000000 tcp 10.0.2.105 59065 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:20.745058 0.044211 tcp 10.0.2.105 59066 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:20.789589 0.053551 tcp 10.0.2.105 59067 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:20.843428 0.149202 tcp 10.0.2.105 59068 -> 195.113.214.236 443 SRPA* 0 0 48 32870 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:14:21.013740 2.995532 tcp 10.0.2.105 59069 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:30.007694 0.000000 tcp 10.0.2.105 59069 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:36.006138 2.994391 tcp 10.0.2.105 59070 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:43.947309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:14:44.998914 0.000000 tcp 10.0.2.105 59070 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:14:49.596097 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:14:51.007606 3.005011 tcp 10.0.2.105 59071 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:15:00.010470 0.000000 tcp 10.0.2.105 59071 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:15:06.009193 3.004296 tcp 10.0.2.105 59072 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:15:13.590547 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:15:15.012734 0.000000 tcp 10.0.2.105 59072 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:20:21.012480 0.026935 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:20:21.039538 2.983210 tcp 10.0.2.105 59073 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:20:30.015633 0.000000 tcp 10.0.2.105 59073 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:20:36.025610 0.043819 tcp 10.0.2.105 59074 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:20:36.069720 0.075553 tcp 10.0.2.105 59075 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:20:36.145538 0.161968 tcp 10.0.2.105 59076 -> 195.113.214.236 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:20:36.319167 3.000176 tcp 10.0.2.105 59077 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:20:45.329395 0.000000 tcp 10.0.2.105 59077 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:20:47.956728 3.002167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:20:54.962675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:21:02.971332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:21:18.966995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:21:50.971729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:27:54.978064 3.003229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 00:28:01.985571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:28:09.986863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:28:25.989236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:28:57.995547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:29:48.879213 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:29:48.879393 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:30:05.915160 0.067803 tcp 10.0.2.105 59078 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:05.983243 0.056111 tcp 10.0.2.105 59079 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:06.039705 0.155289 tcp 10.0.2.105 59080 -> 195.113.214.236 443 SRPA* 0 0 52 42238 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:06.195690 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:30:22.698079 0.066206 tcp 10.0.2.105 59081 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:22.764541 0.053405 tcp 10.0.2.105 59082 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:22.818230 0.159682 tcp 10.0.2.105 59083 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:22.978562 0.000000 udp 10.0.2.105 7010 -> 1.160.247.177 7701 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:30:39.612426 0.066067 tcp 10.0.2.105 59084 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:39.678778 0.052871 tcp 10.0.2.105 59085 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:39.732042 0.154887 tcp 10.0.2.105 59086 -> 195.113.214.236 443 SRPA* 0 0 37 26778 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:39.887527 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:30:56.396662 0.045098 tcp 10.0.2.105 59087 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:56.442018 0.053125 tcp 10.0.2.105 59088 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:56.495458 0.154842 tcp 10.0.2.105 59089 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:30:56.650852 0.173844 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:56.817749 0.249101 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:57.055966 0.169450 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:57.233375 0.216449 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:57.412121 0.065288 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:57.518696 0.170754 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 1846 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.019625 0.101593 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.104012 0.149808 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.249521 0.089349 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.322253 0.070139 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.410856 0.079704 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.476677 0.081161 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.576934 0.259618 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.799501 0.062910 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:58.952936 0.238429 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:59.168525 0.173419 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:59.337690 0.172165 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:59.487836 0.100232 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:59.680410 0.137269 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:30:59.815767 0.235799 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:00.030998 0.079233 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:00.110675 0.189434 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:00.292952 0.352899 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:00.596460 0.196171 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:00.786502 0.671767 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:01.430443 0.107197 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:01.500525 0.149467 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:01.706774 0.363735 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:02.038311 0.192037 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:02.222573 0.398634 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:02.594557 0.387268 udp 10.0.2.105 7010 <-> 49.144.118.137 2222 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:02.962378 0.000000 udp 10.0.2.105 7010 -> 113.210.10.104 4346 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:31:06.351019 3.003691 tcp 10.0.2.105 59090 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:15.353289 0.000000 tcp 10.0.2.105 59090 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:19.450270 0.045078 tcp 10.0.2.105 59091 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:19.495641 0.051974 tcp 10.0.2.105 59092 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:19.547965 0.212934 tcp 10.0.2.105 59093 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:19.761468 0.313060 udp 10.0.2.105 7010 <-> 121.166.91.53 6783 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/01 00:31:21.352449 0.066777 tcp 10.0.2.105 59094 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:21.419538 0.056035 tcp 10.0.2.105 59095 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:21.475861 0.151894 tcp 10.0.2.105 59096 -> 195.113.214.236 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:21.676711 0.488662 udp 10.0.2.105 7010 <- 113.210.10.104 4346 RSP 0 0 5 2172 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 00:31:22.013305 2.993707 tcp 10.0.2.105 59097 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:31.018801 0.000000 tcp 10.0.2.105 59097 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:37.014661 0.043537 tcp 10.0.2.105 59098 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:37.058460 0.053511 tcp 10.0.2.105 59099 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:37.112241 0.151032 tcp 10.0.2.105 59100 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:37.825791 2.993790 tcp 10.0.2.105 59101 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:46.818302 0.000000 tcp 10.0.2.105 59101 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:31:52.817578 0.109946 tcp 10.0.2.105 59102 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:52.927821 0.053606 tcp 10.0.2.105 59103 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:52.981768 0.152110 tcp 10.0.2.105 59104 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:31:53.267060 3.005117 tcp 10.0.2.105 59105 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:02.272744 0.000000 tcp 10.0.2.105 59105 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:08.259988 0.044523 tcp 10.0.2.105 59106 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:32:08.304841 0.054583 tcp 10.0.2.105 59107 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:32:08.359683 0.150954 tcp 10.0.2.105 59108 -> 195.113.214.236 443 SRPA* 0 0 35 23800 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:32:08.526585 2.997167 tcp 10.0.2.105 59109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:17.522636 0.000000 tcp 10.0.2.105 59109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:23.521467 3.004271 tcp 10.0.2.105 59110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:32.524757 0.000000 tcp 10.0.2.105 59110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:37.090887 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:32:38.523005 2.994248 tcp 10.0.2.105 59111 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:47.525788 0.000000 tcp 10.0.2.105 59111 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:32:53.524974 2.993878 tcp 10.0.2.105 59112 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:33:01.095262 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:33:02.517573 0.000000 tcp 10.0.2.105 59112 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:35:02.005440 2.998141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:35:09.008673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:35:17.010729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:35:33.013948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:36:05.019652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:38:08.528204 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:38:08.528377 3.003391 tcp 10.0.2.105 59113 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:17.530232 0.000000 tcp 10.0.2.105 59113 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:23.530994 0.045371 tcp 10.0.2.105 59114 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:23.576645 0.053655 tcp 10.0.2.105 59115 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:23.630606 0.155884 tcp 10.0.2.105 59116 -> 195.113.214.236 443 SRPA* 0 0 42 22882 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:23.813191 3.000394 tcp 10.0.2.105 59117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:32.812431 0.000000 tcp 10.0.2.105 59117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:38.811260 0.045260 tcp 10.0.2.105 59118 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:38.856840 0.053196 tcp 10.0.2.105 59119 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:38.910308 0.158231 tcp 10.0.2.105 59120 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:39.104741 3.000717 tcp 10.0.2.105 59121 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:48.104342 0.000000 tcp 10.0.2.105 59121 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:38:54.103383 0.050044 tcp 10.0.2.105 59122 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:54.153754 0.056176 tcp 10.0.2.105 59123 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:54.210282 0.154197 tcp 10.0.2.105 59124 -> 195.113.214.236 443 SRPA* 0 0 49 42074 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:38:54.391036 3.006808 tcp 10.0.2.105 59125 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:03.406881 0.000000 tcp 10.0.2.105 59125 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:09.385691 0.066998 tcp 10.0.2.105 59126 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:39:09.452955 0.110278 tcp 10.0.2.105 59127 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:39:09.563516 0.149353 tcp 10.0.2.105 59128 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:39:09.753848 2.995718 tcp 10.0.2.105 59129 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:18.748410 0.000000 tcp 10.0.2.105 59129 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:24.747537 3.003643 tcp 10.0.2.105 59130 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:33.749984 0.000000 tcp 10.0.2.105 59130 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:38.596885 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:39:39.748935 3.003950 tcp 10.0.2.105 59131 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:48.751419 0.000000 tcp 10.0.2.105 59131 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:39:54.750152 3.004314 tcp 10.0.2.105 59132 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:40:02.591399 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:40:03.753084 0.000000 tcp 10.0.2.105 59132 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:42:09.026581 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:42:16.033326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:42:24.034686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:42:40.037630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:43:12.043985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:45:09.753671 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:45:09.753794 3.003616 tcp 10.0.2.105 59133 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:18.766009 0.000000 tcp 10.0.2.105 59133 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:24.756497 0.067529 tcp 10.0.2.105 59134 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:24.824362 0.053319 tcp 10.0.2.105 59135 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:24.878001 0.167063 tcp 10.0.2.105 59136 -> 195.113.214.236 443 SRPA* 0 0 49 41746 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:25.102660 2.986371 tcp 10.0.2.105 59137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:34.088010 0.000000 tcp 10.0.2.105 59137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:40.097856 0.064970 tcp 10.0.2.105 59138 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:40.163095 0.061384 tcp 10.0.2.105 59139 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:40.224789 0.179489 tcp 10.0.2.105 59140 -> 195.113.214.236 443 SRPA* 0 0 33 19398 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:40.458953 3.002456 tcp 10.0.2.105 59141 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:49.462625 0.000000 tcp 10.0.2.105 59141 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:45:55.459334 0.068137 tcp 10.0.2.105 59142 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:55.527835 0.053003 tcp 10.0.2.105 59143 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:55.581099 0.155378 tcp 10.0.2.105 59144 -> 195.113.214.236 443 SRPA* 0 0 33 26888 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:45:55.763572 2.999783 tcp 10.0.2.105 59145 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:04.762126 0.000000 tcp 10.0.2.105 59145 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:10.761809 0.044183 tcp 10.0.2.105 59146 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:46:10.806270 0.055145 tcp 10.0.2.105 59147 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:46:10.861665 0.153951 tcp 10.0.2.105 59148 -> 195.113.214.236 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:46:11.057629 3.007665 tcp 10.0.2.105 59149 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:20.064016 0.000000 tcp 10.0.2.105 59149 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:26.052867 3.003760 tcp 10.0.2.105 59150 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:35.055768 0.000000 tcp 10.0.2.105 59150 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:39.592766 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:46:41.054679 2.996739 tcp 10.0.2.105 59151 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:50.057375 0.000000 tcp 10.0.2.105 59151 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:46:56.055471 2.994535 tcp 10.0.2.105 59152 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:47:03.596651 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:47:05.048157 0.000000 tcp 10.0.2.105 59152 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:11.059361 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:52:11.059515 3.003283 tcp 10.0.2.105 59153 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:20.062934 0.000000 tcp 10.0.2.105 59153 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:26.062123 0.067030 tcp 10.0.2.105 59154 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:26.129398 0.053501 tcp 10.0.2.105 59155 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:26.183221 0.157206 tcp 10.0.2.105 59156 -> 195.113.214.236 443 SRPA* 0 0 41 23260 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:26.375924 2.999376 tcp 10.0.2.105 59157 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:35.373628 0.000000 tcp 10.0.2.105 59157 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:41.373183 0.066640 tcp 10.0.2.105 59158 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:41.440128 0.059247 tcp 10.0.2.105 59159 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:41.499622 0.211331 tcp 10.0.2.105 59160 -> 195.113.214.236 443 SRPA* 0 0 37 31972 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:41.764964 3.002444 tcp 10.0.2.105 59161 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:50.775799 0.000000 tcp 10.0.2.105 59161 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:52:56.765957 0.043861 tcp 10.0.2.105 59162 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:56.810177 0.056069 tcp 10.0.2.105 59163 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:56.866553 0.145368 tcp 10.0.2.105 59164 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:52:57.144441 2.994886 tcp 10.0.2.105 59165 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:06.137462 0.000000 tcp 10.0.2.105 59165 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:12.137332 0.043011 tcp 10.0.2.105 59166 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:53:12.180636 0.053067 tcp 10.0.2.105 59167 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:53:12.234086 0.154590 tcp 10.0.2.105 59168 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/01 00:53:12.465697 2.985065 tcp 10.0.2.105 59169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:21.449953 0.000000 tcp 10.0.2.105 59169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:27.459154 3.003742 tcp 10.0.2.105 59170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:32.057744 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 00:53:36.461596 0.000000 tcp 10.0.2.105 59170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:39.065353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:53:41.088143 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:53:42.460537 3.006350 tcp 10.0.2.105 59171 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:47.066486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:53:51.462915 0.000000 tcp 10.0.2.105 59171 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:53:57.465429 3.004012 tcp 10.0.2.105 59172 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:54:03.071938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 00:54:05.094300 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 00:54:06.464881 0.000000 tcp 10.0.2.105 59172 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 00:54:35.076005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:00:39.082869 3.000532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 01:00:46.089487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:00:54.092722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:01:10.093536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:01:40.787870 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:01:40.788028 0.000000 udp 10.0.2.105 7010 -> 113.210.10.104 4346 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:01:42.099634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:01:56.262237 0.044501 tcp 10.0.2.105 59173 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:01:56.307016 0.056308 tcp 10.0.2.105 59174 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:01:56.363661 0.157261 tcp 10.0.2.105 59175 -> 195.113.214.236 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:01:56.521454 0.213890 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:01:56.738898 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:01:57.482103 3.004585 tcp 10.0.2.105 59176 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:02:06.484905 0.000000 tcp 10.0.2.105 59176 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:02:12.484554 0.066879 tcp 10.0.2.105 59177 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:12.551721 0.058942 tcp 10.0.2.105 59178 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:12.611089 0.150543 tcp 10.0.2.105 59179 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:12.771960 2.996763 tcp 10.0.2.105 59180 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:02:13.114893 0.066776 tcp 10.0.2.105 59181 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:13.182018 0.054132 tcp 10.0.2.105 59182 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:13.236467 0.166828 tcp 10.0.2.105 59183 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:13.403910 1.036069 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 5 1795 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:14.390231 0.171498 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:14.543438 0.096423 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:14.619841 0.141156 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:14.757014 0.089258 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:14.825686 0.220201 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2610 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.007204 0.066066 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.073667 0.079727 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.138521 0.072014 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.199572 0.266989 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.430536 0.063321 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.492456 0.239659 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.708909 0.213803 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.919969 0.081228 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:15.985560 0.233389 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.197864 0.081389 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.257139 0.190635 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.439969 0.106201 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.566910 0.170751 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.713881 0.133314 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:16.845378 0.204932 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.049997 0.215115 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.219040 0.140702 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2588 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.368653 0.281374 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.620828 0.199147 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 1946 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.813144 0.106862 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:17.883086 0.746834 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:18.602197 0.000000 udp 10.0.2.105 7010 -> 49.144.118.137 2222 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:02:21.776792 0.000000 tcp 10.0.2.105 59180 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:02:36.098665 0.043445 tcp 10.0.2.105 59184 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:36.142425 0.053547 tcp 10.0.2.105 59185 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:36.196215 0.150503 tcp 10.0.2.105 59186 -> 195.113.214.236 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:36.347215 0.508473 udp 10.0.2.105 7010 <-> 112.120.19.231 1931 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:02:36.827318 0.000000 udp 10.0.2.105 7010 -> 121.166.91.53 6783 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:02:55.599849 0.044293 tcp 10.0.2.105 59187 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:55.644456 0.053952 tcp 10.0.2.105 59188 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:55.698670 0.151940 tcp 10.0.2.105 59189 -> 195.113.214.236 443 SRPA* 0 0 41 23260 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:02:55.851299 0.000000 udp 10.0.2.105 7010 -> 113.210.10.104 4346 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:07:27.767478 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:07:27.767657 3.003377 tcp 10.0.2.105 59190 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:07:36.769536 0.000000 tcp 10.0.2.105 59190 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:07:42.813925 0.047348 tcp 10.0.2.105 59191 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:42.861549 0.053873 tcp 10.0.2.105 59192 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:42.915683 0.146650 tcp 10.0.2.105 59193 -> 195.113.214.236 443 SRPA* 0 0 45 38608 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:43.139034 3.004247 tcp 10.0.2.105 59194 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:07:46.106154 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:07:52.141835 0.000000 tcp 10.0.2.105 59194 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:07:53.112978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:07:58.158799 0.043661 tcp 10.0.2.105 59195 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:58.202825 0.059429 tcp 10.0.2.105 59196 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:58.262624 0.179970 tcp 10.0.2.105 59197 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:07:58.457713 2.997579 tcp 10.0.2.105 59198 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:01.114876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:08:07.453725 0.000000 tcp 10.0.2.105 59198 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:13.453129 0.044565 tcp 10.0.2.105 59199 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:13.498028 0.054836 tcp 10.0.2.105 59200 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:13.553210 0.150458 tcp 10.0.2.105 59201 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:13.733576 3.003465 tcp 10.0.2.105 59202 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:17.117680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:08:22.745687 0.000000 tcp 10.0.2.105 59202 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:28.735005 0.066106 tcp 10.0.2.105 59203 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:28.801396 0.052464 tcp 10.0.2.105 59204 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:28.854158 0.152022 tcp 10.0.2.105 59205 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:08:29.027121 2.992048 tcp 10.0.2.105 59206 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:38.017937 0.000000 tcp 10.0.2.105 59206 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:44.026509 2.993562 tcp 10.0.2.105 59207 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:49.123671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:08:53.019217 0.000000 tcp 10.0.2.105 59207 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:08:57.596101 0.000158 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:08:59.028112 3.004348 tcp 10.0.2.105 59208 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:09:08.030889 0.000000 tcp 10.0.2.105 59208 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:09:14.029809 3.004124 tcp 10.0.2.105 59209 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:09:21.590440 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:09:23.032552 0.000000 tcp 10.0.2.105 59209 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:14:29.033546 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:14:29.033722 3.002515 tcp 10.0.2.105 59210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:14:38.034991 0.000000 tcp 10.0.2.105 59210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:14:44.035788 0.045405 tcp 10.0.2.105 59211 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:44.081550 0.053961 tcp 10.0.2.105 59212 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:44.135802 0.149758 tcp 10.0.2.105 59213 -> 195.113.214.236 443 SRPA* 0 0 63 42426 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:44.306074 2.993059 tcp 10.0.2.105 59214 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:14:53.129679 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:14:53.307285 0.000000 tcp 10.0.2.105 59214 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:14:59.306587 0.068448 tcp 10.0.2.105 59215 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:59.375288 0.054445 tcp 10.0.2.105 59216 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:59.430026 0.157199 tcp 10.0.2.105 59217 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:14:59.617041 2.993198 tcp 10.0.2.105 59218 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:00.136968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:15:08.138166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:15:08.609233 0.000000 tcp 10.0.2.105 59218 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:14.618964 0.044175 tcp 10.0.2.105 59219 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:14.663461 0.055651 tcp 10.0.2.105 59220 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:14.719446 0.164545 tcp 10.0.2.105 59221 -> 195.113.214.236 443 SRPA* 0 0 37 31106 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:14.926120 2.996561 tcp 10.0.2.105 59222 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:23.921964 0.000000 tcp 10.0.2.105 59222 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:24.141977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:15:29.920752 0.044350 tcp 10.0.2.105 59223 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:29.965439 0.057325 tcp 10.0.2.105 59224 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:30.023050 0.152030 tcp 10.0.2.105 59225 -> 195.113.214.236 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:15:30.199316 3.005366 tcp 10.0.2.105 59226 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:39.203434 0.000000 tcp 10.0.2.105 59226 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:45.192119 3.004282 tcp 10.0.2.105 59227 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:54.195081 0.000000 tcp 10.0.2.105 59227 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:15:56.147665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:15:59.091828 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:16:00.193604 2.993900 tcp 10.0.2.105 59228 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:16:09.196398 0.000000 tcp 10.0.2.105 59228 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:16:15.195463 2.993746 tcp 10.0.2.105 59229 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:16:23.096746 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:16:24.189798 0.000000 tcp 10.0.2.105 59229 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:21:30.198306 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:21:30.198484 3.004055 tcp 10.0.2.105 59230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:21:39.201024 0.000000 tcp 10.0.2.105 59230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:21:45.201423 0.047646 tcp 10.0.2.105 59231 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:21:45.249380 0.070536 tcp 10.0.2.105 59232 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:21:45.320206 2.396292 tcp 10.0.2.105 59233 -> 195.113.214.236 443 SRPA* 0 0 53 47447 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:21:47.772039 2.995671 tcp 10.0.2.105 59234 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:21:56.776042 0.000000 tcp 10.0.2.105 59234 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:00.153717 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:22:02.766206 0.043282 tcp 10.0.2.105 59235 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:02.809808 0.054585 tcp 10.0.2.105 59236 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:02.864887 0.168683 tcp 10.0.2.105 59237 -> 195.113.214.236 443 SRPA* 0 0 42 28812 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:03.180153 2.999204 tcp 10.0.2.105 59238 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:07.160962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:22:12.177760 0.000000 tcp 10.0.2.105 59238 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:15.162993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:22:18.177169 0.044787 tcp 10.0.2.105 59239 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:18.222246 0.058143 tcp 10.0.2.105 59240 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:18.280759 0.237740 tcp 10.0.2.105 59241 -> 195.113.214.236 443 SRPA* 0 0 54 47499 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:18.731453 3.000806 tcp 10.0.2.105 59242 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:27.730803 0.000000 tcp 10.0.2.105 59242 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:31.166154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:22:33.729855 0.045601 tcp 10.0.2.105 59243 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:33.775675 0.053181 tcp 10.0.2.105 59244 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:33.829138 0.177646 tcp 10.0.2.105 59245 -> 195.113.214.236 443 SRPA* 0 0 63 41417 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:22:34.056399 2.997760 tcp 10.0.2.105 59246 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:43.052941 0.000000 tcp 10.0.2.105 59246 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:49.051649 3.004137 tcp 10.0.2.105 59247 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:22:58.054056 0.000000 tcp 10.0.2.105 59247 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:23:02.590259 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:23:03.171778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:23:04.053436 3.003494 tcp 10.0.2.105 59248 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:23:13.066018 0.000000 tcp 10.0.2.105 59248 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:23:19.054635 2.993820 tcp 10.0.2.105 59249 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:23:26.595465 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:23:28.057310 0.000000 tcp 10.0.2.105 59249 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:28:34.057914 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:28:34.058024 3.003714 tcp 10.0.2.105 59250 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:28:43.060488 0.000000 tcp 10.0.2.105 59250 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:28:49.063858 0.044634 tcp 10.0.2.105 59251 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:28:49.108798 0.064771 tcp 10.0.2.105 59252 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:28:49.173847 0.112506 tcp 10.0.2.105 59253 -> 195.113.214.236 443 SRPA* 0 0 37 27871 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:28:49.342768 2.999355 tcp 10.0.2.105 59254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:28:58.335499 0.000000 tcp 10.0.2.105 59254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:04.341849 0.043949 tcp 10.0.2.105 59255 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:04.386135 0.054732 tcp 10.0.2.105 59256 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:04.441171 0.144444 tcp 10.0.2.105 59257 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:04.719422 3.001955 tcp 10.0.2.105 59258 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:07.185212 2.994078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:29:13.715515 0.000000 tcp 10.0.2.105 59258 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:14.185447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:29:19.713153 0.109720 tcp 10.0.2.105 59259 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:19.823135 0.053465 tcp 10.0.2.105 59260 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:19.876965 0.132197 tcp 10.0.2.105 59261 -> 195.113.214.236 443 SRPA* 0 0 50 43994 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:20.078024 2.989532 tcp 10.0.2.105 59262 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:22.186891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:29:29.081277 0.000000 tcp 10.0.2.105 59262 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:35.065779 0.066409 tcp 10.0.2.105 59263 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:35.132515 0.053802 tcp 10.0.2.105 59264 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:35.186663 0.132688 tcp 10.0.2.105 59265 -> 195.113.214.236 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:29:35.469856 3.000096 tcp 10.0.2.105 59266 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:38.189739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:29:44.468912 0.000000 tcp 10.0.2.105 59266 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:50.467636 3.003489 tcp 10.0.2.105 59267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:29:59.470019 0.000000 tcp 10.0.2.105 59267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:30:04.097289 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:30:05.469199 3.003924 tcp 10.0.2.105 59268 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:30:10.195726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:30:14.472781 0.000000 tcp 10.0.2.105 59268 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:30:20.470411 3.004276 tcp 10.0.2.105 59269 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:30:28.093585 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:30:29.473347 0.000000 tcp 10.0.2.105 59269 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:33:17.785728 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:33:17.785898 0.172384 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:17.950540 0.000000 udp 10.0.2.105 7010 -> 49.144.118.137 2222 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:33:35.202153 0.069197 tcp 10.0.2.105 59270 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:35.271668 0.069838 tcp 10.0.2.105 59271 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:35.341775 0.132665 tcp 10.0.2.105 59272 -> 195.113.214.236 443 SRPA* 0 0 48 38772 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:35.475132 0.000000 udp 10.0.2.105 7010 -> 121.166.91.53 6783 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:33:53.577455 0.043885 tcp 10.0.2.105 59273 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:53.621630 0.058460 tcp 10.0.2.105 59274 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:53.680543 0.136401 tcp 10.0.2.105 59275 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:33:53.817463 0.170827 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:53.964085 0.103474 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.113555 0.148664 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.257507 0.089430 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.326947 0.215117 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.507147 0.062356 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.581573 0.173861 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:54.810092 0.255675 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.018403 0.260502 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.241926 0.069631 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.317941 0.237665 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.531516 0.172767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.701000 0.077181 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.880454 0.081373 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:55.945784 0.080861 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:56.003650 0.189990 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:56.407802 0.122548 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:56.605854 0.067425 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:56.734015 0.235546 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:33:56.948361 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:34:12.724758 0.067144 tcp 10.0.2.105 59276 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:34:12.792231 0.136128 tcp 10.0.2.105 59277 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:34:12.928598 0.133853 tcp 10.0.2.105 59278 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:34:13.062927 0.216491 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:13.230976 0.141647 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:13.393234 0.283350 udp 10.0.2.105 7010 <-> 180.175.145.94 6091 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:13.644309 0.198263 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:13.834151 0.107045 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:13.972856 0.171916 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:14.122764 0.131947 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:14.253077 0.399123 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/01 01:34:14.624532 0.000000 udp 10.0.2.105 7010 -> 112.120.19.231 1931 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 01:34:29.989254 0.044176 tcp 10.0.2.105 59279 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:34:30.033744 0.065854 tcp 10.0.2.105 59280 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:34:30.099972 0.132700 tcp 10.0.2.105 59281 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:35:35.473651 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:35:35.473832 2.994135 tcp 10.0.2.105 59282 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:35:44.476370 0.000000 tcp 10.0.2.105 59282 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:35:50.475770 0.066645 tcp 10.0.2.105 59283 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:35:50.542764 0.053957 tcp 10.0.2.105 59284 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:35:50.597037 0.130055 tcp 10.0.2.105 59285 -> 195.113.214.236 443 SRPA* 0 0 59 39571 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:35:50.739492 3.000064 tcp 10.0.2.105 59286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:35:59.738335 0.000000 tcp 10.0.2.105 59286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:05.737808 0.044214 tcp 10.0.2.105 59287 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:05.782376 0.054718 tcp 10.0.2.105 59288 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:05.837444 0.155032 tcp 10.0.2.105 59289 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:06.006955 3.004607 tcp 10.0.2.105 59290 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:14.201527 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:36:15.010162 0.000000 tcp 10.0.2.105 59290 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:21.008777 0.043164 tcp 10.0.2.105 59291 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:21.052432 0.052811 tcp 10.0.2.105 59292 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:21.105545 0.156391 tcp 10.0.2.105 59293 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:21.209151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:36:21.271379 3.002116 tcp 10.0.2.105 59294 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:29.210623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:36:30.272086 0.000000 tcp 10.0.2.105 59294 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:36.272076 0.043593 tcp 10.0.2.105 59295 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:36.315940 0.061003 tcp 10.0.2.105 59296 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:36.377185 0.158815 tcp 10.0.2.105 59297 -> 195.113.214.236 443 SRPA* 0 0 40 22616 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:36:36.545455 2.999827 tcp 10.0.2.105 59298 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:45.213459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:36:45.544046 0.000000 tcp 10.0.2.105 59298 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:36:51.543130 3.003700 tcp 10.0.2.105 59299 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:37:00.545693 0.000000 tcp 10.0.2.105 59299 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:37:05.092422 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:37:06.544676 2.994189 tcp 10.0.2.105 59300 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:37:15.547283 0.000000 tcp 10.0.2.105 59300 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:37:17.219447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:37:21.546312 2.993559 tcp 10.0.2.105 59301 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:37:29.096828 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:37:30.538861 0.000000 tcp 10.0.2.105 59301 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:42:36.549497 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:42:36.549652 3.003205 tcp 10.0.2.105 59302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:42:45.552532 0.000000 tcp 10.0.2.105 59302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:42:51.552076 0.093243 tcp 10.0.2.105 59303 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:42:51.645638 0.053350 tcp 10.0.2.105 59304 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:42:51.699237 0.158518 tcp 10.0.2.105 59305 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:42:51.869319 3.005874 tcp 10.0.2.105 59306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:00.873599 0.000000 tcp 10.0.2.105 59306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:06.862811 0.066145 tcp 10.0.2.105 59307 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:06.929210 0.052688 tcp 10.0.2.105 59308 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:06.982132 0.152044 tcp 10.0.2.105 59309 -> 195.113.214.236 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:07.180843 3.006157 tcp 10.0.2.105 59310 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:16.185982 0.000000 tcp 10.0.2.105 59310 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:21.226470 3.000879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:43:22.174902 0.044360 tcp 10.0.2.105 59311 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:22.219570 0.054094 tcp 10.0.2.105 59312 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:22.273986 0.150006 tcp 10.0.2.105 59313 -> 195.113.214.236 443 SRPA* 0 0 33 19362 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:22.447128 3.002074 tcp 10.0.2.105 59314 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:28.233185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:43:31.447760 0.000000 tcp 10.0.2.105 59314 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:36.234068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:43:37.446986 0.043988 tcp 10.0.2.105 59315 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:37.491311 0.053333 tcp 10.0.2.105 59316 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:37.544927 0.148974 tcp 10.0.2.105 59317 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:43:37.704867 2.996001 tcp 10.0.2.105 59318 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:46.699532 0.000000 tcp 10.0.2.105 59318 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:43:52.237829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:43:52.698520 3.004119 tcp 10.0.2.105 59319 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:44:01.702785 0.000000 tcp 10.0.2.105 59319 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:44:06.588662 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:44:07.699753 3.004224 tcp 10.0.2.105 59320 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:44:16.702775 0.000000 tcp 10.0.2.105 59320 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:44:22.701560 3.003999 tcp 10.0.2.105 59321 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:44:24.243562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:44:30.592708 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:44:31.704496 0.000000 tcp 10.0.2.105 59321 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:49:37.704790 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:49:37.704896 2.993508 tcp 10.0.2.105 59322 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:49:46.707060 0.000000 tcp 10.0.2.105 59322 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:49:52.708047 0.044788 tcp 10.0.2.105 59323 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:49:52.753352 0.052073 tcp 10.0.2.105 59324 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:49:52.805708 0.149020 tcp 10.0.2.105 59325 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:49:53.009802 3.000421 tcp 10.0.2.105 59326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:02.011146 0.000000 tcp 10.0.2.105 59326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:08.008654 0.044014 tcp 10.0.2.105 59327 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:08.052960 0.053303 tcp 10.0.2.105 59328 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:08.106586 0.149242 tcp 10.0.2.105 59329 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:08.296809 2.995860 tcp 10.0.2.105 59330 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:17.292669 0.000000 tcp 10.0.2.105 59330 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:23.292160 0.044045 tcp 10.0.2.105 59331 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:23.336494 0.144544 tcp 10.0.2.105 59332 -> 195.113.214.236 80 SRPA* 0 0 30 19736 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:23.505270 2.999030 tcp 10.0.2.105 59333 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:32.505763 0.000000 tcp 10.0.2.105 59333 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:38.503555 0.043770 tcp 10.0.2.105 59334 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:38.547639 0.051415 tcp 10.0.2.105 59335 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:38.599420 0.210977 tcp 10.0.2.105 59336 -> 195.113.214.236 443 SRPA* 0 0 41 22750 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:50:38.835250 3.007397 tcp 10.0.2.105 59337 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:47.835004 0.000000 tcp 10.0.2.105 59337 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:50:53.833732 2.994445 tcp 10.0.2.105 59338 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:51:02.841723 0.000000 tcp 10.0.2.105 59338 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:51:07.593432 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:51:08.835478 2.994201 tcp 10.0.2.105 59339 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:51:17.828205 0.000000 tcp 10.0.2.105 59339 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:51:23.836979 2.994100 tcp 10.0.2.105 59340 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:51:31.587968 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:51:32.829543 0.000000 tcp 10.0.2.105 59340 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:54:09.257139 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 01:54:16.264683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:54:24.266728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:54:40.269276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:55:12.275486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 01:56:38.840448 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:56:38.840666 3.003159 tcp 10.0.2.105 59341 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:56:47.842589 0.000000 tcp 10.0.2.105 59341 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:56:53.842974 0.068065 tcp 10.0.2.105 59342 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:56:53.911243 0.054342 tcp 10.0.2.105 59343 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:56:53.965873 0.232901 tcp 10.0.2.105 59344 -> 195.113.214.236 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:56:54.230153 3.005999 tcp 10.0.2.105 59345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:03.234813 0.000000 tcp 10.0.2.105 59345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:09.223914 0.043663 tcp 10.0.2.105 59346 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:09.267880 0.054207 tcp 10.0.2.105 59347 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:09.322389 0.144697 tcp 10.0.2.105 59348 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:09.513467 2.994616 tcp 10.0.2.105 59349 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:18.517163 0.000000 tcp 10.0.2.105 59349 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:24.506091 0.045616 tcp 10.0.2.105 59350 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:24.552055 0.053954 tcp 10.0.2.105 59351 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:24.606280 0.157229 tcp 10.0.2.105 59352 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:24.774916 2.995381 tcp 10.0.2.105 59353 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:33.768645 0.000000 tcp 10.0.2.105 59353 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:39.768476 0.045212 tcp 10.0.2.105 59354 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:39.814009 0.054543 tcp 10.0.2.105 59355 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:39.868815 0.218588 tcp 10.0.2.105 59356 -> 195.113.214.236 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/01 01:57:40.105409 2.996839 tcp 10.0.2.105 59357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:49.100324 0.000000 tcp 10.0.2.105 59357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:57:55.099645 3.004163 tcp 10.0.2.105 59358 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:58:04.102636 0.000000 tcp 10.0.2.105 59358 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:58:09.089527 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:58:10.100759 3.004831 tcp 10.0.2.105 59359 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:58:19.104050 0.000000 tcp 10.0.2.105 59359 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:58:25.102859 3.004215 tcp 10.0.2.105 59360 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 01:58:33.094027 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 01:58:34.105281 0.000000 tcp 10.0.2.105 59360 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:01:16.281108 3.002346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:01:23.289571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:01:31.290190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:01:47.293465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:02:19.299169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:04:49.986291 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:04:49.986395 0.187281 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:04:50.169397 0.000000 udp 10.0.2.105 7010 -> 112.120.19.231 1931 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 02:04:55.114091 2.993276 tcp 10.0.2.105 59361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:05:04.116401 0.000000 tcp 10.0.2.105 59361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:05:08.974930 0.045352 tcp 10.0.2.105 59362 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:09.020539 0.053805 tcp 10.0.2.105 59363 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:09.074627 0.148295 tcp 10.0.2.105 59364 -> 195.113.214.236 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:09.223499 0.172515 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:09.388731 0.140569 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:09.525122 0.090956 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:09.597352 0.098539 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:09.676786 0.175251 udp 10.0.2.105 7010 <-> 67.71.151.221 6231 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:09.876429 0.248586 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.079793 0.262531 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.116381 0.044253 tcp 10.0.2.105 59365 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:10.160951 0.082462 tcp 10.0.2.105 59366 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:10.243685 0.151346 tcp 10.0.2.105 59367 -> 195.113.214.236 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:10.304445 0.058659 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.376931 0.211540 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.409452 3.000115 tcp 10.0.2.105 59368 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:05:10.555676 0.086039 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.633634 0.172619 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.784633 0.078879 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:10.847937 0.238761 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.062733 0.079727 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.117285 0.171316 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.285997 0.079371 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2565 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.349461 0.234889 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.561613 0.101978 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.696144 0.188963 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.877808 0.062512 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:11.940707 0.142556 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.109349 0.217118 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.275987 0.113482 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.348698 0.171696 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.496005 0.133236 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.627376 0.195313 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:05:12.814906 0.000000 udp 10.0.2.105 7010 -> 180.175.145.94 6091 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 02:05:19.408167 0.000000 tcp 10.0.2.105 59368 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:05:29.433344 0.044866 tcp 10.0.2.105 59369 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:29.478479 0.055378 tcp 10.0.2.105 59370 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:29.534175 0.157053 tcp 10.0.2.105 59371 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:05:29.691796 0.589983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:08:23.305421 3.001708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:08:30.312917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:08:38.314290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:08:54.318821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:09:26.323844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:10:25.408631 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:10:25.408726 3.004029 tcp 10.0.2.105 59372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:10:34.410959 0.000000 tcp 10.0.2.105 59372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:10:40.411514 0.092522 tcp 10.0.2.105 59373 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:40.504492 0.031911 tcp 10.0.2.105 59374 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:40.536752 0.120711 tcp 10.0.2.105 59375 -> 195.113.214.236 443 SRPA* 0 0 67 61229 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:40.669264 2.995210 tcp 10.0.2.105 59376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:10:49.663071 0.000000 tcp 10.0.2.105 59376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:10:55.663225 0.043707 tcp 10.0.2.105 59377 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:55.707274 0.032666 tcp 10.0.2.105 59378 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:55.740173 0.126750 tcp 10.0.2.105 59379 -> 195.113.214.236 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:10:55.918016 3.008483 tcp 10.0.2.105 59380 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:04.925054 0.000000 tcp 10.0.2.105 59380 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:10.913701 0.066436 tcp 10.0.2.105 59381 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:10.980423 0.032398 tcp 10.0.2.105 59382 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:11.013089 0.143114 tcp 10.0.2.105 59383 -> 195.113.214.236 443 SRPA* 0 0 23 14564 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:11.191078 2.997078 tcp 10.0.2.105 59384 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:20.196864 0.000000 tcp 10.0.2.105 59384 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:26.186285 0.082539 tcp 10.0.2.105 59385 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:26.269067 0.033008 tcp 10.0.2.105 59386 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:26.302348 0.131435 tcp 10.0.2.105 59387 -> 195.113.214.236 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:11:26.529345 2.991402 tcp 10.0.2.105 59388 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:35.519069 0.000000 tcp 10.0.2.105 59388 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:41.527671 3.004368 tcp 10.0.2.105 59389 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:50.530778 0.000000 tcp 10.0.2.105 59389 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:11:55.087507 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:11:56.529428 3.004058 tcp 10.0.2.105 59390 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:12:05.532588 0.000000 tcp 10.0.2.105 59390 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:12:11.530299 3.004868 tcp 10.0.2.105 59391 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:12:19.091663 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:12:20.533666 0.000000 tcp 10.0.2.105 59391 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:15:35.336782 3.001163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:15:42.343846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:15:50.345255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:16:06.348238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:16:38.354411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:17:26.534272 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:17:26.534497 2.993505 tcp 10.0.2.105 59392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:17:35.536977 0.000000 tcp 10.0.2.105 59392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:17:41.537559 0.045294 tcp 10.0.2.105 59393 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:41.583147 0.038083 tcp 10.0.2.105 59394 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:41.621531 0.134670 tcp 10.0.2.105 59395 -> 195.113.214.236 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:41.797305 3.002376 tcp 10.0.2.105 59396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:17:50.798462 0.000000 tcp 10.0.2.105 59396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:17:56.797451 0.043395 tcp 10.0.2.105 59397 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:56.841085 0.037115 tcp 10.0.2.105 59398 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:56.878515 0.147758 tcp 10.0.2.105 59399 -> 195.113.214.236 443 SRPA* 0 0 41 21532 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:17:57.094888 2.996801 tcp 10.0.2.105 59400 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:06.090202 0.000000 tcp 10.0.2.105 59400 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:12.089911 0.044603 tcp 10.0.2.105 59401 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:12.134855 0.033058 tcp 10.0.2.105 59402 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:12.168267 0.136705 tcp 10.0.2.105 59403 -> 195.113.214.236 443 SRPA* 0 0 37 27896 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:12.376770 2.996801 tcp 10.0.2.105 59404 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:21.372491 0.000000 tcp 10.0.2.105 59404 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:27.373287 0.067031 tcp 10.0.2.105 59405 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:27.440616 0.031595 tcp 10.0.2.105 59406 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:27.473687 0.133120 tcp 10.0.2.105 59407 -> 195.113.214.236 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:18:27.688105 3.003386 tcp 10.0.2.105 59408 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:36.684517 0.000000 tcp 10.0.2.105 59408 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:42.683456 2.998265 tcp 10.0.2.105 59409 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:51.686011 0.000000 tcp 10.0.2.105 59409 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:18:56.595046 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:18:57.688951 2.990044 tcp 10.0.2.105 59410 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:19:06.677841 0.000000 tcp 10.0.2.105 59410 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:19:12.686423 2.993751 tcp 10.0.2.105 59411 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:19:20.587870 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:19:21.679080 0.000000 tcp 10.0.2.105 59411 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:22:42.361753 3.000320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:22:49.367847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:22:57.372797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:23:13.372814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:23:45.378426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:24:27.689646 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:24:27.689807 3.003511 tcp 10.0.2.105 59412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:24:36.691896 0.000000 tcp 10.0.2.105 59412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:24:42.692772 0.067026 tcp 10.0.2.105 59413 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:42.760072 0.057546 tcp 10.0.2.105 59414 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:42.817944 0.211867 tcp 10.0.2.105 59415 -> 195.113.214.236 443 SRPA* 0 0 60 40475 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:43.041134 2.994437 tcp 10.0.2.105 59416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:24:52.034175 0.000000 tcp 10.0.2.105 59416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:24:58.043635 0.065743 tcp 10.0.2.105 59417 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:58.109686 0.052560 tcp 10.0.2.105 59418 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:58.162528 0.156295 tcp 10.0.2.105 59419 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:24:58.349373 3.008338 tcp 10.0.2.105 59420 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:07.366202 0.000000 tcp 10.0.2.105 59420 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:13.345706 0.043819 tcp 10.0.2.105 59421 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:13.389870 0.053795 tcp 10.0.2.105 59422 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:13.443956 0.190721 tcp 10.0.2.105 59423 -> 195.113.214.236 443 SRPA* 0 0 41 22612 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:13.681619 2.997919 tcp 10.0.2.105 59424 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:22.678718 0.000000 tcp 10.0.2.105 59424 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:28.677572 0.066461 tcp 10.0.2.105 59425 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:28.744476 0.052663 tcp 10.0.2.105 59426 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:28.797410 0.154310 tcp 10.0.2.105 59427 -> 195.113.214.236 443 SRPA* 0 0 42 35466 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:25:29.006977 3.004522 tcp 10.0.2.105 59428 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:38.010231 0.000000 tcp 10.0.2.105 59428 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:44.009017 3.004204 tcp 10.0.2.105 59429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:53.011883 0.000000 tcp 10.0.2.105 59429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:25:57.588617 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:25:59.010484 3.004464 tcp 10.0.2.105 59430 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:26:08.013145 0.000000 tcp 10.0.2.105 59430 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:26:14.012273 3.003445 tcp 10.0.2.105 59431 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:26:21.592986 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:26:23.014567 0.000000 tcp 10.0.2.105 59431 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:29:49.383942 3.002226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:29:56.391830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:30:04.393124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:30:20.395840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:30:52.402647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:31:29.015714 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:31:29.015939 2.993419 tcp 10.0.2.105 59432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:31:38.007311 0.000000 tcp 10.0.2.105 59432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 02:31:44.018774 0.045851 tcp 10.0.2.105 59433 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:31:44.064950 0.056239 tcp 10.0.2.105 59434 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:31:44.121528 0.149944 tcp 10.0.2.105 59435 -> 195.113.214.236 443 SRPA* 0 0 42 23250 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:31:44.490425 0.616907 tcp 10.0.2.105 59436 -> 31.192.24.67 3527 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:35:31.053388 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 02:35:31.053490 0.000000 udp 10.0.2.105 7010 -> 180.175.145.94 6091 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 02:35:46.737596 0.044744 tcp 10.0.2.105 59437 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:35:46.782651 0.053626 tcp 10.0.2.105 59438 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:35:46.836615 0.208803 tcp 10.0.2.105 59439 -> 195.113.214.236 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:35:47.046070 0.192017 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:35:47.233964 0.174525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:35:47.549191 0.091914 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:35:47.671063 0.103905 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:35:47.754354 0.000000 udp 10.0.2.105 7010 -> 67.71.151.221 6231 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 02:36:04.862071 0.066380 tcp 10.0.2.105 59440 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:36:04.928777 0.054517 tcp 10.0.2.105 59441 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:36:04.983573 0.155466 tcp 10.0.2.105 59442 -> 195.113.214.236 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/01 02:36:05.139524 0.793957 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:05.886992 0.508915 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.030233 0.065348 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.139443 0.217377 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2553 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.319203 0.070343 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.545833 0.173218 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.823955 0.155662 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:07.975385 0.077628 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:08.085545 0.081266 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2560 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:08.215980 0.171406 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:08.384530 0.076576 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:12.480053 0.237013 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:13.082873 0.098534 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:13.507835 0.189520 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:13.689310 0.063841 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:14.096038 0.150290 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:15.153533 0.213709 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:15.316488 0.239062 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:15.531168 0.194716 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:15.719295 0.104877 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:15.882389 0.168283 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:16.028821 0.133277 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:16.159867 0.393172 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/01 02:36:56.409648 3.000273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 02:37:03.415865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:37:11.417259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:37:27.420187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:37:59.426027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:44:03.432257 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 02:44:10.439508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:44:18.441120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:44:34.444504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:45:06.449736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:54:31.465579 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 02:54:38.472672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:54:46.474422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:55:02.477948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 02:55:34.483288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:01:38.489528 3.001457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:01:45.106689 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 03:01:45.106852 0.609748 tcp 10.0.2.105 59443 -> 31.192.24.67 3527 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/01 03:01:45.496650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:01:53.498321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:02:09.501214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:02:41.507437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:06:39.629859 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 03:06:39.630022 0.000000 udp 10.0.2.105 7010 -> 67.71.151.221 6231 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 03:06:55.994684 0.044630 tcp 10.0.2.105 59444 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 03:06:56.039643 0.034548 tcp 10.0.2.105 59445 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 03:06:56.074479 0.159423 tcp 10.0.2.105 59446 -> 195.113.214.236 443 SRPA* 0 0 41 33370 flow=From-Botnet-V2-TCP-Established 1970/02/01 03:06:56.234582 0.199705 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:56.434629 0.075575 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:56.510779 0.166444 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:56.677620 0.072825 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:56.750829 0.202473 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:56.953744 0.174206 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.128422 0.258449 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.387240 0.038646 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.426274 0.059180 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.485865 0.147109 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.633420 0.149446 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.783274 0.059024 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.842717 0.053101 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:57.896218 0.167518 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.064142 0.059773 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.124288 0.212896 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.337583 0.061423 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.399385 0.147120 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.547034 0.075356 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.622786 0.180846 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.803993 0.177101 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:58.981461 0.406013 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:59.387871 0.145877 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:59.534103 0.134916 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:59.669426 0.212217 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:06:59.882049 0.186954 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:07:00.069380 0.368429 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:08:45.513554 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:08:52.520341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:09:00.522284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:09:16.524961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:09:48.531467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:15:54.540020 3.001746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:16:01.547425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:16:09.549251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:16:25.552099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:16:57.558302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:23:01.563941 3.001659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:23:08.571550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:23:16.572829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:23:32.576560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:24:04.592043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:30:08.598039 3.001760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:30:15.605254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:30:23.607059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:30:39.609683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:31:11.616203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:31:45.715451 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 03:31:45.715542 0.600529 tcp 10.0.2.105 59447 -> 31.192.24.67 3527 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/02/01 03:37:15.621820 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:37:22.629473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:37:29.369550 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 03:37:29.369717 0.165879 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:29.535979 0.065981 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:29.602372 0.436548 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.039403 0.189361 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.229165 0.081380 udp 10.0.2.105 7010 <-> 86.184.72.63 6503 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.310937 0.177614 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.488939 0.234638 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.631099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:37:30.724004 0.045266 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.769839 0.059960 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.770325 3.005141 tcp 10.0.2.105 59448 -> 86.89.2.116 5541 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 03:37:30.830194 0.148090 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:30.978688 0.141809 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.120931 0.059752 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.181096 0.056939 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.238402 0.166900 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.405714 0.057982 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.464070 0.213777 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.678250 0.062847 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.741495 0.150897 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:31.892767 0.165347 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.058450 0.076303 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.135152 0.180992 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.316555 0.069326 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.386283 0.147605 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.534289 0.134381 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.669136 0.210912 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:32.880467 0.180296 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:33.061155 0.372850 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/01 03:37:39.774356 0.000000 tcp 10.0.2.105 59448 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 03:37:46.633948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:38:18.639675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:44:22.646209 3.115950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:44:29.732398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:44:37.670823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:44:53.667540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:45:25.673922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:54:41.686097 3.004862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 03:54:48.693463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:54:56.695211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:55:12.697708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 03:55:44.703990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:01:46.324450 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:01:46.324632 2.993298 tcp 10.0.2.105 59449 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:01:48.710811 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 04:01:55.327077 0.000000 tcp 10.0.2.105 59449 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:01:55.717760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:02:01.327475 0.045405 tcp 10.0.2.105 59450 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:01.373145 0.055486 tcp 10.0.2.105 59451 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:01.428908 0.134874 tcp 10.0.2.105 59452 -> 195.113.214.236 443 SRPA* 0 0 62 39083 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:01.598998 3.001069 tcp 10.0.2.105 59453 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:03.718854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:02:10.599225 0.000000 tcp 10.0.2.105 59453 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:16.598098 0.044022 tcp 10.0.2.105 59454 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:16.642422 0.051386 tcp 10.0.2.105 59455 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:16.694079 0.231137 tcp 10.0.2.105 59456 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:16.961755 3.000549 tcp 10.0.2.105 59457 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:19.722108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:02:25.960886 0.000000 tcp 10.0.2.105 59457 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:31.969591 0.043799 tcp 10.0.2.105 59458 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:32.013670 0.053374 tcp 10.0.2.105 59459 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:32.067314 0.146756 tcp 10.0.2.105 59460 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:32.223798 3.000206 tcp 10.0.2.105 59461 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:41.222921 0.000000 tcp 10.0.2.105 59461 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:47.222304 0.046397 tcp 10.0.2.105 59462 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:47.268957 0.053447 tcp 10.0.2.105 59463 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:47.322691 0.152019 tcp 10.0.2.105 59464 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:02:47.493559 3.003217 tcp 10.0.2.105 59465 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:02:51.727991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:02:56.494652 0.000000 tcp 10.0.2.105 59465 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:02.493528 2.994079 tcp 10.0.2.105 59466 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:11.496724 0.000000 tcp 10.0.2.105 59466 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:16.093129 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:03:17.495075 2.994342 tcp 10.0.2.105 59467 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:26.488014 0.000000 tcp 10.0.2.105 59467 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:32.496570 2.994350 tcp 10.0.2.105 59468 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:03:40.087190 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:03:41.489470 0.000000 tcp 10.0.2.105 59468 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:07:40.026007 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:07:40.026099 0.208970 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:40.235503 0.189689 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:40.425648 0.000000 udp 10.0.2.105 7010 -> 86.184.72.63 6503 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 04:07:58.484229 0.069864 tcp 10.0.2.105 59469 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:07:58.554422 0.054488 tcp 10.0.2.105 59470 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:07:58.609188 0.150791 tcp 10.0.2.105 59471 -> 195.113.214.236 443 SRPA* 0 0 33 27724 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:07:58.760569 0.165407 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:58.926376 0.074296 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.001049 0.176377 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.177818 0.236365 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.414569 0.237888 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.652954 0.058412 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.653298 3.001791 tcp 10.0.2.105 59472 -> 86.89.2.116 5541 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:07:59.711751 0.144343 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:07:59.856600 0.144857 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.001935 0.060901 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.063225 0.157431 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.221052 0.172001 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.393453 0.060793 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.454705 0.210542 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.665625 0.059396 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.725410 0.151923 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:00.877725 0.189269 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:01.067412 0.084107 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:01.151892 0.180408 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:01.332673 0.071926 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:01.405016 0.210400 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:01.615802 0.000000 udp 10.0.2.105 7010 -> 108.255.59.40 5109 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 04:08:08.653050 0.000000 tcp 10.0.2.105 59472 -> 86.89.2.116 5541 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:08:17.677261 0.066770 tcp 10.0.2.105 59473 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:08:17.744280 0.054450 tcp 10.0.2.105 59474 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:08:17.799024 0.153125 tcp 10.0.2.105 59475 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:08:17.952749 0.144781 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:18.097887 0.130320 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:18.228614 0.702655 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:08:47.499883 3.003894 tcp 10.0.2.105 59476 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:08:52.085746 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:08:56.502616 0.000000 tcp 10.0.2.105 59476 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:08:56.735360 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 04:09:02.501625 0.047686 tcp 10.0.2.105 59477 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:02.549682 0.087099 tcp 10.0.2.105 59478 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:02.637082 0.162163 tcp 10.0.2.105 59479 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:02.809693 3.005712 tcp 10.0.2.105 59480 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:03.742918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:09:11.744220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:09:11.814123 0.000000 tcp 10.0.2.105 59480 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:17.803611 0.044269 tcp 10.0.2.105 59481 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:17.848389 0.052408 tcp 10.0.2.105 59482 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:17.901119 0.157185 tcp 10.0.2.105 59483 -> 195.113.214.236 443 SRPA* 0 0 50 42630 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:18.073989 2.993583 tcp 10.0.2.105 59484 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:27.076185 0.000000 tcp 10.0.2.105 59484 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:27.747588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:09:33.075972 0.066800 tcp 10.0.2.105 59485 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:33.143026 0.054275 tcp 10.0.2.105 59486 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:33.197668 0.151517 tcp 10.0.2.105 59487 -> 195.113.214.236 443 SRPA* 0 0 41 23492 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:33.371003 2.998605 tcp 10.0.2.105 59488 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:42.368156 0.000000 tcp 10.0.2.105 59488 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:48.367568 0.043713 tcp 10.0.2.105 59489 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:48.411567 0.053442 tcp 10.0.2.105 59490 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:48.465267 0.158652 tcp 10.0.2.105 59491 -> 195.113.214.236 443 SRPA* 0 0 41 21966 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:09:48.658103 3.003419 tcp 10.0.2.105 59492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:57.660743 0.000000 tcp 10.0.2.105 59492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:09:59.753423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:10:03.659132 3.003973 tcp 10.0.2.105 59493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:10:12.661619 0.000000 tcp 10.0.2.105 59493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:10:17.588967 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:10:18.661281 3.003693 tcp 10.0.2.105 59494 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:10:27.663349 0.000000 tcp 10.0.2.105 59494 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:10:33.662435 3.003676 tcp 10.0.2.105 59495 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:10:41.593555 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:10:42.665091 0.000000 tcp 10.0.2.105 59495 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:15:48.665523 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:15:48.665639 2.993527 tcp 10.0.2.105 59496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:15:57.657807 0.000000 tcp 10.0.2.105 59496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:03.668452 0.075958 tcp 10.0.2.105 59497 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:03.744681 0.054570 tcp 10.0.2.105 59498 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:03.799562 0.150060 tcp 10.0.2.105 59499 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:03.969918 3.001187 tcp 10.0.2.105 59500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:07.765219 3.001504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 04:16:12.969881 0.000000 tcp 10.0.2.105 59500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:14.772599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:16:18.968493 0.065981 tcp 10.0.2.105 59501 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:19.034736 0.055237 tcp 10.0.2.105 59502 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:19.090240 0.165220 tcp 10.0.2.105 59503 -> 195.113.214.236 443 SRPA* 0 0 51 37512 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:19.270728 3.002511 tcp 10.0.2.105 59504 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:22.773813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:16:28.272208 0.000000 tcp 10.0.2.105 59504 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:34.271460 0.044541 tcp 10.0.2.105 59505 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:34.316335 0.052313 tcp 10.0.2.105 59506 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:34.368909 0.153603 tcp 10.0.2.105 59507 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:34.634231 3.001102 tcp 10.0.2.105 59508 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:38.777046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:16:43.633877 0.000000 tcp 10.0.2.105 59508 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:49.633411 0.119884 tcp 10.0.2.105 59509 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:49.753619 0.052268 tcp 10.0.2.105 59510 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:49.806182 0.166354 tcp 10.0.2.105 59511 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:16:49.993992 3.003551 tcp 10.0.2.105 59512 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:16:59.006218 0.000000 tcp 10.0.2.105 59512 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:04.995055 2.993470 tcp 10.0.2.105 59513 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:10.782939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:17:13.997642 0.000000 tcp 10.0.2.105 59513 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:18.594172 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:17:19.996366 2.994287 tcp 10.0.2.105 59514 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:28.988810 0.000000 tcp 10.0.2.105 59514 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:34.997785 3.004380 tcp 10.0.2.105 59515 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:17:42.588803 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:17:44.000300 0.000000 tcp 10.0.2.105 59515 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:22:50.000731 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:22:50.000905 3.003958 tcp 10.0.2.105 59516 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:22:59.003490 0.000000 tcp 10.0.2.105 59516 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:05.004509 0.066423 tcp 10.0.2.105 59517 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:05.071202 0.058620 tcp 10.0.2.105 59518 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:05.130087 0.157068 tcp 10.0.2.105 59519 -> 195.113.214.236 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:05.317485 3.009433 tcp 10.0.2.105 59520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:14.329711 0.000000 tcp 10.0.2.105 59520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:16.794818 2.998580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 04:23:20.314993 0.075403 tcp 10.0.2.105 59521 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:20.390660 0.100516 tcp 10.0.2.105 59522 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:20.491470 0.157818 tcp 10.0.2.105 59523 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:20.855412 2.995258 tcp 10.0.2.105 59524 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:23.800677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:23:29.847924 0.000000 tcp 10.0.2.105 59524 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:31.800802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:23:35.868203 0.067180 tcp 10.0.2.105 59525 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:35.935652 0.054883 tcp 10.0.2.105 59526 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:35.990832 0.151379 tcp 10.0.2.105 59527 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:36.158773 2.992568 tcp 10.0.2.105 59528 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:45.155120 0.000000 tcp 10.0.2.105 59528 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:23:47.816802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:23:51.153359 0.047804 tcp 10.0.2.105 59529 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:51.201484 0.053996 tcp 10.0.2.105 59530 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:51.255837 0.157999 tcp 10.0.2.105 59531 -> 195.113.214.236 443 SRPA* 0 0 43 37080 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:23:51.486577 2.996834 tcp 10.0.2.105 59532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:00.482482 0.000000 tcp 10.0.2.105 59532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:06.480715 3.004457 tcp 10.0.2.105 59533 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:15.484038 0.000000 tcp 10.0.2.105 59533 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:19.809682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:24:20.090041 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:24:21.482145 3.004601 tcp 10.0.2.105 59534 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:30.485118 0.000000 tcp 10.0.2.105 59534 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:36.483965 2.994310 tcp 10.0.2.105 59535 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:24:44.094521 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:24:45.486676 0.000000 tcp 10.0.2.105 59535 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:30:23.816328 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 04:30:30.823510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:30:38.824831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:30:54.827702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:31:26.834953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:37:30.839203 3.002215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 04:37:37.847038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:37:45.848655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:38:01.851745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:38:23.413283 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:38:23.413474 0.000000 udp 10.0.2.105 7010 -> 86.184.72.63 6503 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 04:38:33.857943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:38:42.291981 0.044986 tcp 10.0.2.105 59536 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:38:42.337285 0.053928 tcp 10.0.2.105 59537 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:38:42.391500 0.165686 tcp 10.0.2.105 59538 -> 195.113.214.236 443 SRPA* 0 0 41 23260 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:38:42.557726 0.197530 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:38:42.747343 0.383411 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:38:42.747740 3.007139 tcp 10.0.2.105 59539 -> 108.255.59.40 9357 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:38:43.083148 0.188997 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:38:43.266234 0.094664 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:38:43.343210 0.222382 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:38:43.527467 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 04:38:51.543558 2.993915 tcp 10.0.2.105 59540 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:38:51.753499 0.000000 tcp 10.0.2.105 59539 -> 108.255.59.40 9357 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:38:59.160208 0.014189 udp 10.0.2.105 63083 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/02/01 04:38:59.174890 0.009652 udp 10.0.2.105 60261 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/02/01 04:39:00.546213 0.000000 tcp 10.0.2.105 59540 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:00.847092 0.043772 tcp 10.0.2.105 59541 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:00.891183 0.053516 tcp 10.0.2.105 59542 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:00.944971 0.154358 tcp 10.0.2.105 59543 -> 195.113.214.236 443 SRPA* 0 0 39 19244 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:01.099855 0.059597 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.141059 0.068968 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.209386 0.173582 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.376106 0.174970 udp 10.0.2.105 7010 <-> 70.48.161.172 5207 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.585567 0.081787 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.643022 0.175044 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.813405 0.079133 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:01.874758 0.235040 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.089312 0.063348 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.168854 0.079491 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.234926 0.141625 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.391504 0.304625 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.645783 0.108107 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.769877 0.191208 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:02.953181 0.107891 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:03.022303 0.236559 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:03.235885 0.150301 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:03.387560 0.173060 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:03.538224 0.131912 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:03.668213 0.409709 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/01 04:39:06.545126 0.043869 tcp 10.0.2.105 59544 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:06.589293 0.053788 tcp 10.0.2.105 59545 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:06.643302 0.151924 tcp 10.0.2.105 59546 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:06.814005 2.995525 tcp 10.0.2.105 59547 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:15.808073 0.000000 tcp 10.0.2.105 59547 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:21.807376 0.067013 tcp 10.0.2.105 59548 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:21.874663 0.066796 tcp 10.0.2.105 59549 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:21.941754 0.155271 tcp 10.0.2.105 59550 -> 195.113.214.236 443 SRPA* 0 0 40 21914 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:22.112375 2.999121 tcp 10.0.2.105 59551 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:31.110347 0.000000 tcp 10.0.2.105 59551 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:37.109590 0.048571 tcp 10.0.2.105 59552 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:37.158519 0.088266 tcp 10.0.2.105 59553 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:37.247143 0.162315 tcp 10.0.2.105 59554 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:39:37.432845 3.000441 tcp 10.0.2.105 59555 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:46.432175 0.000000 tcp 10.0.2.105 59555 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:39:52.431306 3.003656 tcp 10.0.2.105 59556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:40:01.433636 0.000000 tcp 10.0.2.105 59556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:40:06.090252 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:40:07.432841 3.004019 tcp 10.0.2.105 59557 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:40:16.435327 0.000000 tcp 10.0.2.105 59557 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:44:37.864982 3.000379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 04:44:44.871188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:44:52.873094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:45:08.885267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:45:22.436092 0.029638 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 04:45:22.466103 2.972321 tcp 10.0.2.105 59558 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:45:31.428313 0.000000 tcp 10.0.2.105 59558 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:45:37.448720 0.048276 tcp 10.0.2.105 59559 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:37.497251 0.056278 tcp 10.0.2.105 59560 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:37.553790 0.151282 tcp 10.0.2.105 59561 -> 195.113.214.236 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:37.889614 3.002079 tcp 10.0.2.105 59562 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:45:40.891870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:45:46.890145 0.000000 tcp 10.0.2.105 59562 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/01 04:45:52.889706 0.066159 tcp 10.0.2.105 59563 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:52.955894 0.056718 tcp 10.0.2.105 59564 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:53.012497 0.156424 tcp 10.0.2.105 59565 -> 195.113.214.236 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:45:53.201475 0.938617 tcp 10.0.2.105 59566 -> 162.210.27.16 8808 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/01 04:54:49.905180 3.000484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 04:54:56.911314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:55:04.912682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:55:20.916025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 04:55:52.921914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:01:56.928646 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:02:03.934531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:02:11.936756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:02:27.939224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:02:59.955870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:09:08.796182 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:09:08.796375 0.640021 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:09.436914 0.185457 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:09.437323 3.391963 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 SPA_* 0 0 36 15970 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:09.622835 0.204629 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:09.827941 0.076053 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:09.904535 0.196413 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:10.101343 0.177673 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:10.279400 0.046265 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:10.326103 0.058242 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:10.384725 0.164987 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:10.550134 0.000000 udp 10.0.2.105 7010 -> 70.48.161.172 5207 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 05:09:11.973025 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:09:18.980813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:09:25.265537 3.138605 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 9548 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:26.982211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:09:27.354393 0.045058 tcp 10.0.2.105 59568 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:27.399783 0.051025 tcp 10.0.2.105 59569 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:27.451062 0.152275 tcp 10.0.2.105 59570 -> 195.113.214.236 443 SRPA* 0 0 52 34002 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:27.603777 0.056414 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:27.660576 0.173478 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:27.834474 0.062140 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:27.896992 0.212519 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.109930 0.058828 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.169161 0.059270 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.228847 0.149931 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.379172 0.159836 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.539449 0.085118 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.624962 0.181678 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:28.806988 0.695940 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:29.503322 0.146340 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:29.650115 0.129611 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:29.780077 0.477409 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:30.257863 0.211514 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:30.469741 0.139984 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:09:33.753714 3.737013 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 20 11216 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:39.512122 4.935262 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:42.985011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:09:46.012809 3.501896 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 21 10382 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:51.086989 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:09:51.876367 4.977539 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 25 17382 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:09:57.505065 4.968262 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 30 17756 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:02.673423 4.872887 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 30 18604 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:07.740963 4.686576 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 23 14378 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:13.841432 4.344307 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 35 19474 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:14.991355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:10:19.662384 4.882636 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 38 22532 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:25.633654 2.508748 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 12114 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:32.102480 4.433014 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:38.353008 4.958785 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:41.088067 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:10:43.512312 4.806694 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 28 15456 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:48.519568 2.946756 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:53.590509 0.880247 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 7 4474 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:10:59.209171 0.730142 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 4776 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:04.354777 4.474028 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 25 14342 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:13.585596 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:11:17.832421 0.980614 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 2336 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:22.835755 4.827607 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 13 7378 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:27.865989 4.859147 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 3094 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:32.923087 2.844288 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 2956 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:37.589999 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:11:45.110260 2.156733 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:11:56.304711 4.210277 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:01.594549 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:12:02.248565 0.206966 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:10.681054 4.954272 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:17.420013 4.581135 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:22.740953 0.203792 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:31.037758 3.804621 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:38.731773 1.613137 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:45.086870 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:12:49.615233 4.812749 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:12:56.368796 3.509228 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:01.470630 4.368800 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:07.794728 2.571181 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:09.592446 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:13:14.346420 4.679533 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:20.454330 2.877717 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 1896 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:32.337582 4.844445 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:37.091823 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:13:37.642943 2.773702 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:44.048412 4.820406 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:13:50.520728 4.748113 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 24 9124 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:04.993943 4.684722 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 7184 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:10.089141 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:14:10.147767 4.735755 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:15.727148 4.076000 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:23.924111 4.165402 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:29.974684 4.409784 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:36.163275 4.674739 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:42.725811 3.703274 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 7098 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:48.237730 0.206905 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:14:56.709352 4.975668 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:01.593355 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:15:02.446087 0.198872 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:14.107196 0.885393 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:24.539369 4.986644 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 3486 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:29.593390 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:15:29.723559 1.250140 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 2726 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:40.009749 4.437826 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 7676 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:45.117705 4.053940 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:50.630886 4.815069 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 6116 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:53.587942 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:15:54.139000 0.866091 tcp 10.0.2.105 59571 -> 162.210.27.16 8808 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:15:57.415301 4.125715 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:02.882812 2.662512 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 4678 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:09.203743 4.322843 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 11 5310 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:14.681734 4.992061 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:19.585288 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:16:19.999440 3.000727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 05:16:20.341156 3.540670 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 7676 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:25.520082 4.203801 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:27.006167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:16:31.717123 0.702452 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 5 2366 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:35.007448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:16:36.982948 4.554161 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:43.115927 0.903931 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:16:46.093442 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:16:51.010648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:17:01.001000 4.340328 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 2528 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:09.335720 3.274576 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:10.087886 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:17:14.619905 4.381040 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 25 9734 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:20.522486 1.031936 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 2944 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:23.016733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:17:25.879856 4.557455 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:30.928716 3.664522 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:35.093615 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:17:36.343236 4.528006 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:42.705839 4.991474 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:47.902679 3.042734 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:17:54.890031 2.792802 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:00.089488 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:18:06.009509 4.586462 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 7006 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:11.153937 4.107953 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 5780 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:16.782802 3.365733 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 3816 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:21.836031 4.426064 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 17 6658 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:27.050387 3.573484 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:32.085667 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:18:32.399643 3.711977 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 5214 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:37.834712 3.815140 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 13 4798 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:43.711623 0.872224 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 6 4400 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:48.819895 4.532886 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:54.942222 1.398604 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:18:57.092002 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:19:03.789645 3.950052 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:09.223864 3.519834 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 25 9734 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:15.353535 4.092414 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 29 15190 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:20.796751 4.866175 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 5148 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:26.090016 3.133528 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:31.282132 4.921154 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:36.716320 3.794725 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:44.185195 4.513492 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:45.090194 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:19:49.458096 4.695354 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:19:57.868566 4.627405 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:04.766898 4.949449 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:09.585830 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:20:11.447239 4.832376 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:16.804172 3.597397 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 5872 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:22.305397 4.766307 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 23 10382 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:27.533613 1.214869 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 8 3576 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:32.680368 4.315141 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 12 4748 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:33.590574 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:20:41.264705 4.980067 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 5 2458 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:46.438888 3.815688 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 4948 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:53.752109 4.976545 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:20:58.777747 4.835851 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 17 7206 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:21:01.590652 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:21:05.346666 4.946614 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:21:10.697540 4.775492 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:21:16.207535 1.707410 tcp 10.0.2.105 59567 -> 200.84.7.244 8038 FPA_* 0 0 12 2694 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:23:29.025947 3.000699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 05:23:36.032885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:23:44.034707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:24:00.037401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:24:32.042947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:30:36.049283 3.001204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:30:43.063970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:30:51.062182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:31:07.061529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:31:39.067450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:37:43.072664 3.002563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:37:50.080752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:37:58.082596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:38:14.085455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:38:46.091516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:39:38.015715 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:39:38.015812 0.000000 udp 10.0.2.105 7010 -> 70.48.161.172 5207 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 05:39:53.600100 0.097849 tcp 10.0.2.105 59572 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:39:53.698264 0.058557 tcp 10.0.2.105 59573 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:39:53.757133 0.153361 tcp 10.0.2.105 59574 -> 195.113.214.236 443 SRPA* 0 0 40 33064 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:39:53.911240 0.205808 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:39:54.117466 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 05:40:11.725227 0.044099 tcp 10.0.2.105 59575 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:40:11.769594 0.056780 tcp 10.0.2.105 59576 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:40:11.826632 0.181541 tcp 10.0.2.105 59577 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:40:12.008743 0.182193 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.191301 0.070882 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.262643 0.039309 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.302406 0.064648 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.367439 0.163512 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.531388 0.176465 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.708261 0.188674 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.897379 0.056039 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:12.953826 0.170668 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.124875 0.061610 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.186893 0.213643 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.400997 0.059589 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.460984 0.063224 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.524603 0.141841 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 594 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.666826 0.180721 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:13.847910 0.160775 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.009040 0.083775 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.098322 0.066377 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.165053 0.145027 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.310439 0.133298 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.444095 0.408320 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:14.852784 0.211209 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:40:15.064527 0.140406 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/01 05:44:50.097419 3.012583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 05:44:57.114715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:45:05.116418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:45:21.119973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:45:53.125138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:45:55.008502 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 05:45:55.008694 0.138784 tcp 10.0.2.105 59578 -> 162.210.27.16 8808 SPA_* 0 0 9 1117 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:46:01.527270 0.109632 tcp 10.0.2.105 59578 -> 162.210.27.16 8808 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/01 05:51:57.131377 3.001602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:52:04.138953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:52:12.140560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:52:28.143387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:53:00.150029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:59:04.156729 3.000678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 05:59:11.163080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:59:19.164358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 05:59:35.170051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:00:07.173223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:06:36.185542 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:06:43.192992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:06:51.194328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:07:07.197127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:07:39.203422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:10:29.798904 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 06:10:29.799009 0.725781 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:30.525197 0.710257 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:31.235843 0.000000 udp 10.0.2.105 7010 -> 108.255.59.40 5109 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 06:10:49.949319 0.072312 tcp 10.0.2.105 59579 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 06:10:50.021971 0.053127 tcp 10.0.2.105 59580 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 06:10:50.075409 0.125648 tcp 10.0.2.105 59581 -> 195.113.214.236 443 SRPA* 0 0 54 51133 flow=From-Botnet-V2-TCP-Established 1970/02/01 06:10:50.201759 0.068296 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.270481 0.038854 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.309733 0.059091 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.369182 0.164159 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.533741 0.176338 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.710464 0.180284 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.891146 0.051974 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:50.943505 0.166612 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.110566 0.063784 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.174715 0.238279 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.413384 0.059911 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.473710 0.065864 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.539973 0.145271 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.685712 0.180804 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:51.866874 0.162278 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.029507 0.076830 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.106723 0.065000 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.172086 0.463741 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.636445 0.210922 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.847823 0.142623 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:52.990834 0.230532 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:10:53.221773 0.131070 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:13:43.208469 3.002699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:13:50.216417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:13:58.218362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:14:14.221055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:14:46.227371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:16:01.636047 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 06:16:01.636151 0.940444 tcp 10.0.2.105 59582 -> 162.210.27.16 8808 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/01 06:20:50.232471 3.002411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:20:57.243740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:21:05.246481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:21:21.245035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:21:53.251212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:27:57.257221 3.001782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:28:04.264874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:28:12.265671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:28:28.269067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:29:00.274984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:35:04.282707 2.999986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:35:11.288066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:35:19.289970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:35:35.294689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:36:07.299057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:41:01.312101 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 06:41:01.312207 0.188142 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:01.500791 0.724514 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.225713 0.200236 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.426345 0.058886 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.485605 0.164200 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.650209 0.071356 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.721962 0.045880 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.768235 0.174827 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:02.943474 0.189070 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.132918 0.053695 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.187050 0.168837 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.356258 0.062046 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.418726 0.214210 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.633339 0.058410 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.692180 0.063832 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.756470 0.147563 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:03.904538 0.183951 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:04.088869 0.070627 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:04.159923 0.435832 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:04.596190 0.212787 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:04.809419 0.155313 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:04.965140 0.142538 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:05.108049 0.255909 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:05.364397 0.093565 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:41:05.458378 0.132940 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 06:42:11.305167 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:42:18.312690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:42:26.314043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:42:42.317187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:43:14.325564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:46:02.575355 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 06:46:02.575459 0.993785 tcp 10.0.2.105 59583 -> 162.210.27.16 8808 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/01 06:53:34.338193 3.000967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 06:53:41.344700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:53:49.345940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:54:05.349188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 06:54:37.355316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:00:41.362100 3.000802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:00:48.368794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:00:56.370207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:01:12.373015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:01:44.379356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:07:48.386103 3.000819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:07:55.392811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:08:03.393932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:08:19.397130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:08:51.403181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:11:20.838174 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 07:11:20.838376 0.196165 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:21.034896 0.770755 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:21.805998 0.203420 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.009846 0.057535 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.067748 0.164033 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.232182 0.075622 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.308222 0.039926 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.348737 0.176736 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.525824 0.189344 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.715578 0.051963 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.767964 0.170180 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.938511 0.061048 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:22.999917 0.257752 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.258036 0.059415 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.317864 0.062690 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.380971 0.142305 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.523692 0.180902 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.705001 0.068321 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.773710 0.138239 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:23.912469 0.147576 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:24.060490 0.330310 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:24.391176 0.212249 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:24.603793 0.133673 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:24.737876 0.165601 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:11:24.903897 0.082359 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:14:55.409630 3.001321 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:15:02.416535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:15:10.418173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:15:26.421059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:15:58.427564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:16:03.575007 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 07:16:03.575278 1.077001 tcp 10.0.2.105 59584 -> 162.210.27.16 8808 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/01 07:22:03.435577 3.000615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:22:10.441916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:22:18.445220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:22:34.446460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:23:06.452287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:29:10.461694 2.998618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:29:17.466727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:29:25.467327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:29:41.470863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:30:13.476167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:36:17.482587 3.001302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:36:24.489639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:36:32.491439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:36:48.494580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:37:20.500173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:41:44.680655 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 07:41:44.680755 0.181918 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:44.863025 0.599672 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:45.463082 0.208180 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:45.671672 0.058654 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:45.730751 0.166019 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:45.897142 0.073185 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:45.970789 0.039685 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.041478 0.205071 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.246924 0.205864 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.453176 0.053130 udp 10.0.2.105 7010 <-> 86.130.10.33 6786 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.506706 0.226172 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.733297 0.069365 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:46.803096 0.212311 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.015812 0.054946 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.071143 0.062605 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.134115 0.135687 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.270259 0.181569 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.452174 0.070098 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.522616 0.144127 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.667146 0.213880 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:47.881418 0.129307 udp 10.0.2.105 7010 <-> 98.116.167.80 7083 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:48.011166 0.184319 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:48.195906 0.088196 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:48.284569 0.147272 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:41:48.432240 0.337988 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/01 07:43:24.512996 2.999965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:43:31.513697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:43:39.515460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:43:55.518655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:44:27.524151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:46:04.654219 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 07:46:04.654397 0.911065 tcp 10.0.2.105 59585 -> 162.210.27.16 8808 FSPA* 0 0 12 1493 flow=From-Botnet-V2-TCP-Established 1970/02/01 07:54:11.537303 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 07:54:18.549874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:54:26.545407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:54:42.548428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 07:55:14.554704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:01:18.560652 3.001884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 08:01:25.568098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:01:33.569728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:01:49.572902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:02:21.578644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:08:25.584751 3.001241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 08:08:32.592155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:08:40.593308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:08:56.596469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:09:28.602635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:11:50.105946 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:11:50.106141 0.184315 udp 10.0.2.105 7010 <-> 108.255.59.40 5109 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:50.290890 0.058689 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:50.349959 0.165003 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:50.515403 0.071903 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:50.587717 0.038934 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:50.627030 0.676998 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:51.304574 0.203846 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:51.508872 0.177191 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:51.686475 0.193076 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:11:51.879986 0.000000 udp 10.0.2.105 7010 -> 86.130.10.33 6786 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:12:09.886716 0.075714 tcp 10.0.2.105 59586 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:09.962759 0.053450 tcp 10.0.2.105 59587 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:10.016496 0.133603 tcp 10.0.2.105 59588 -> 195.113.214.236 443 SRPA* 0 0 56 37339 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:10.151049 0.167786 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.319233 0.061431 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.381106 0.211587 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.593141 0.059183 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.652763 0.059297 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.712527 0.146781 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:10.859757 0.181693 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:11.041870 0.070879 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:11.113113 0.142071 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:11.255571 0.264638 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:11.520597 0.000000 udp 10.0.2.105 7010 -> 98.116.167.80 7083 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:12:27.120043 0.069590 tcp 10.0.2.105 59589 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:27.189971 0.053235 tcp 10.0.2.105 59590 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:27.243565 0.146459 tcp 10.0.2.105 59591 -> 195.113.214.236 443 SRPA* 0 0 55 41476 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:12:27.390647 0.162388 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:27.553400 0.330198 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:27.884014 0.084520 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:12:27.968951 0.144060 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:15:38.617188 3.001822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 08:15:45.624545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:15:53.625922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:16:05.573712 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:16:05.573853 0.978537 tcp 10.0.2.105 59592 -> 162.210.27.16 8808 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:16:09.629170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:16:41.634933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:22:45.642318 3.000339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 08:22:52.648668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:23:00.654826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:23:16.653266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:23:48.659144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:29:52.668326 3.034319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 08:29:59.682767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:30:07.683940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:30:23.687277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:30:55.693147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:36:59.699903 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 08:37:06.706721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:37:14.707905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:37:30.711060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:38:02.717339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:42:46.094575 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:42:46.094684 0.000000 udp 10.0.2.105 7010 -> 86.130.10.33 6786 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:43:03.435650 0.074692 tcp 10.0.2.105 59593 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:03.510605 0.066591 tcp 10.0.2.105 59594 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:03.577500 0.150783 tcp 10.0.2.105 59595 -> 195.113.214.236 443 SRPA* 0 0 49 38826 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:03.728951 0.000000 udp 10.0.2.105 7010 -> 98.116.167.80 7083 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:43:19.653563 0.073644 tcp 10.0.2.105 59596 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:19.727448 0.054861 tcp 10.0.2.105 59597 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:19.782610 0.156668 tcp 10.0.2.105 59598 -> 195.113.214.236 443 SRPA* 0 0 44 23644 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:19.939445 0.075233 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:20.015102 0.041397 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:20.056871 0.164435 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:20.221658 0.058772 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:20.280811 0.000000 udp 10.0.2.105 7010 -> 108.255.59.40 5109 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:43:38.109804 0.071019 tcp 10.0.2.105 59599 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:38.181087 0.052732 tcp 10.0.2.105 59600 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:38.234107 0.149605 tcp 10.0.2.105 59601 -> 195.113.214.236 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:43:38.384376 0.660346 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.045115 0.170877 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 200 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.216476 0.209790 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.426767 0.195746 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.622908 0.168206 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.791537 0.060026 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.851995 0.061802 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:39.914162 0.150666 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.065295 0.213712 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.279432 0.059567 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.339462 0.212930 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.552787 0.180414 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.733672 0.068405 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.802527 0.142594 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:40.945524 0.077763 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:41.023733 0.144445 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:41.168654 0.249263 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:41.418380 0.327545 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:42.052467 0.000000 udp 10.0.2.105 7010 -> 108.255.59.40 5109 REQ 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:43:50.368653 0.163053 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:50.532271 0.041724 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:50.574437 0.058763 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:50.633711 0.058982 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:50.693152 0.177281 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:50.870951 0.587962 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:51.459443 0.212333 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:51.672211 0.195315 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:51.867982 0.166653 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.035057 0.051871 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.087434 0.057745 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.145663 0.153081 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.299165 0.217254 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.516868 0.048472 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.565793 0.234021 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.800375 0.179720 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 690 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:52.980525 0.067301 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:53.048370 0.338108 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:53.386902 0.087463 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:53.474814 0.146328 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 671 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:53.621585 0.332229 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:53.954219 0.167826 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:54.122624 0.148129 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:43:54.310147 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:43:59.520182 0.000000 udp 10.0.2.105 7010 -> 81.174.18.218 9264 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:04.086107 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:44:06.722413 3.002361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 08:44:07.391598 0.000000 udp 10.0.2.105 7010 -> 211.21.138.89 5029 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:13.530385 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 2245 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:13.730721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:44:21.731908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:44:22.093030 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:30.996777 0.000000 udp 10.0.2.105 7010 -> 75.74.118.74 7848 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:35.591787 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:44:37.234424 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:37.734893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:44:43.293412 0.000000 udp 10.0.2.105 7010 -> 85.210.55.4 6242 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:50.233444 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:44:56.282036 0.069411 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:44:56.639242 0.000000 udp 10.0.2.105 7010 -> 2.100.223.178 5395 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:01.088806 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:45:04.776786 0.000000 udp 10.0.2.105 7010 -> 81.137.205.62 2561 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:09.741047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:45:11.603339 0.000000 udp 10.0.2.105 7010 -> 176.255.73.14 6188 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:17.051638 0.000000 udp 10.0.2.105 7010 -> 78.185.204.22 7280 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:25.563876 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:30.090028 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:45:31.722954 0.000000 udp 10.0.2.105 7010 -> 50.166.141.98 1287 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:39.664107 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:46.383908 0.000000 udp 10.0.2.105 7010 -> 38.122.48.90 7199 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:51.541247 0.000000 udp 10.0.2.105 7010 -> 79.53.196.41 9774 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:45:56.087017 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:45:59.913470 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:06.552981 1.082714 tcp 10.0.2.105 59602 -> 162.210.27.16 8808 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/02/01 08:46:07.354214 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:15.505812 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:24.508807 0.000000 udp 10.0.2.105 7010 -> 95.210.233.209 5298 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:33.140742 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:38.087821 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:46:41.733443 0.000000 udp 10.0.2.105 7010 -> 95.240.251.140 7109 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:48.673370 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:54.081053 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:46:59.909705 0.000000 udp 10.0.2.105 7010 -> 87.146.194.169 3349 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:04.586091 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:47:05.487461 0.000000 udp 10.0.2.105 7010 -> 211.26.10.184 4600 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:14.069927 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:20.689415 0.000000 udp 10.0.2.105 7010 -> 217.171.43.148 9418 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:29.151593 0.000000 udp 10.0.2.105 7010 -> 88.245.129.84 6778 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:34.087956 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:47:37.784094 0.000000 udp 10.0.2.105 7010 -> 66.180.120.106 8004 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:44.183323 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:51.173323 0.000000 udp 10.0.2.105 7010 -> 93.193.138.193 7662 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:47:59.184802 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:04.091790 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:48:06.505281 0.000000 udp 10.0.2.105 7010 -> 82.58.46.151 3391 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:14.136191 0.000000 udp 10.0.2.105 7010 -> 50.202.165.170 2416 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:21.256608 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:26.664033 0.000000 udp 10.0.2.105 7010 -> 203.88.142.222 8045 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:31.591133 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:48:34.445661 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:40.053640 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:46.442902 0.385715 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:48:46.868407 0.000000 udp 10.0.2.105 7010 -> 84.232.59.132 5430 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:51.870484 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:48:56.587103 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:49:00.742852 0.000000 udp 10.0.2.105 7010 -> 184.243.167.4 9444 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:07.342868 0.000000 udp 10.0.2.105 7010 -> 93.67.209.214 1024 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:14.383095 0.000000 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:20.852084 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:25.588995 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:49:26.450227 0.000000 udp 10.0.2.105 7010 -> 80.175.91.209 7359 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:32.129226 0.000000 udp 10.0.2.105 7010 -> 2.34.219.232 1029 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:40.661154 0.000000 udp 10.0.2.105 7010 -> 181.53.116.250 3560 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:47.099746 0.000000 udp 10.0.2.105 7010 -> 77.97.237.63 6103 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:52.086764 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:49:52.727857 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:49:59.721389 0.000000 udp 10.0.2.105 7010 -> 92.135.3.25 2023 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:07.999300 0.000000 udp 10.0.2.105 7010 -> 92.232.53.158 2139 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:13.968590 0.000000 udp 10.0.2.105 7010 -> 70.27.155.136 3925 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:18.585087 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:50:22.551052 0.000000 udp 10.0.2.105 7010 -> 69.114.180.174 4705 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:30.723004 0.000000 udp 10.0.2.105 7010 -> 24.66.140.112 7854 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:37.482572 0.000000 udp 10.0.2.105 7010 -> 94.68.230.176 3325 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:45.373654 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 5245 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:50.089807 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:50:52.173360 0.000000 udp 10.0.2.105 7010 -> 176.35.148.23 8222 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:50:59.634071 0.000000 udp 10.0.2.105 7010 -> 66.240.7.34 7030 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:07.685914 0.000000 udp 10.0.2.105 7010 -> 94.120.149.16 3260 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:15.076453 0.000000 udp 10.0.2.105 7010 -> 78.145.13.138 3025 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:19.592538 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:51:23.809069 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:30.128045 0.000000 udp 10.0.2.105 7010 -> 87.0.161.98 2469 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:36.857802 0.000000 udp 10.0.2.105 7010 -> 86.139.169.97 2410 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:45.550055 0.000000 udp 10.0.2.105 7010 -> 176.27.224.143 4044 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:51:50.086708 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:51:53.972210 0.000000 udp 10.0.2.105 7010 -> 79.9.143.35 1060 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:02.494319 0.000000 udp 10.0.2.105 7010 -> 84.62.63.70 5024 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:08.165837 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:16.591065 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:21.592003 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:52:22.292954 0.000000 udp 10.0.2.105 7010 -> 80.176.166.97 6550 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:27.611711 0.000000 udp 10.0.2.105 7010 -> 84.241.248.207 3078 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:36.073001 0.000000 udp 10.0.2.105 7010 -> 79.69.235.149 9183 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:43.143304 0.000000 udp 10.0.2.105 7010 -> 72.49.21.231 8985 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:48.089885 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:52:49.412115 0.000000 udp 10.0.2.105 7010 -> 87.102.87.14 8386 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:52:56.001676 0.000000 udp 10.0.2.105 7010 -> 87.24.143.192 7339 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:02.601299 0.000000 udp 10.0.2.105 7010 -> 85.211.176.20 2439 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:10.071910 0.000000 udp 10.0.2.105 7010 -> 90.213.96.217 3805 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:14.587903 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:53:18.994388 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:26.756674 0.072289 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:53:26.842568 0.000000 udp 10.0.2.105 7010 -> 69.119.178.86 2682 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:34.547186 0.000000 udp 10.0.2.105 7010 -> 151.77.194.156 1105 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:39.083097 0.000279 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:53:43.309607 0.000000 udp 10.0.2.105 7010 -> 209.234.215.166 4728 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:50.760978 0.000000 udp 10.0.2.105 7010 -> 50.194.125.185 7720 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:53:58.270988 0.000000 udp 10.0.2.105 7010 -> 79.38.25.78 2191 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:03.087410 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:54:04.890166 0.000000 udp 10.0.2.105 7010 -> 67.175.236.104 7399 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:12.591813 0.102826 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:54:12.847332 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:19.060791 0.000000 udp 10.0.2.105 7010 -> 93.42.10.66 5742 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:26.120992 0.523692 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:26.644684 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 155 flow=Background 1970/02/01 08:54:31.087959 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:54:32.361902 0.000000 udp 10.0.2.105 7010 -> 193.61.239.58 4634 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:32.754685 3.002722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 08:54:39.761480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:54:39.930338 0.000000 udp 10.0.2.105 7010 -> 174.28.23.142 4712 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:45.388990 0.000000 udp 10.0.2.105 7010 -> 95.240.12.162 8363 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:47.762876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:54:52.418989 0.620715 udp 10.0.2.105 7010 -> 88.245.53.17 7964 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:54:53.039704 0.000000 icmp 88.245.53.17 0x0303 -> 10.0.2.105 0x1c1f URP 192 1 154 flow=Background 1970/02/01 08:54:57.084918 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:55:01.241173 0.077351 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 701 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:55:01.327332 0.000000 udp 10.0.2.105 7010 -> 95.225.174.59 1439 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:03.765184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:55:09.913796 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:16.503655 0.000000 udp 10.0.2.105 7010 -> 46.197.69.240 6253 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:21.091087 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:55:21.831524 0.000000 udp 10.0.2.105 7010 -> 187.189.45.203 1127 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:28.170097 0.000000 udp 10.0.2.105 7010 -> 95.243.3.35 9626 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:35.180018 0.000000 udp 10.0.2.105 7010 -> 65.48.19.50 4687 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:35.771344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 08:55:43.352864 0.000000 udp 10.0.2.105 7010 -> 2.226.216.215 9493 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:48.088916 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:55:49.711418 0.394372 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:55:50.116552 0.076123 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 858 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:55:50.207144 0.057827 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:55:50.281799 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:55:55.609684 0.000000 udp 10.0.2.105 7010 -> 87.8.241.238 6542 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:00.897446 0.000000 udp 10.0.2.105 7010 -> 95.137.225.217 1048 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:05.924460 0.228086 udp 10.0.2.105 7010 <-> 2.194.26.90 4752 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:56:06.163429 0.046962 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:56:06.223373 0.000000 udp 10.0.2.105 7010 -> 79.52.35.166 5331 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:14.346640 0.060035 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:56:14.415692 0.083152 udp 10.0.2.105 7010 -> 81.214.28.29 7949 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:14.498844 0.000000 icmp 81.214.28.29 0x0303 -> 10.0.2.105 0x0d1f URP 192 1 284 flow=Background 1970/02/01 08:56:19.083411 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:56:22.488452 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:30.019097 0.000000 udp 10.0.2.105 7010 -> 60.50.115.252 6504 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:37.560135 0.000000 udp 10.0.2.105 7010 -> 95.137.216.202 1036 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:44.720874 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:49.587583 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 08:56:50.057932 0.000000 udp 10.0.2.105 7010 -> 90.45.29.20 5865 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:56:58.740985 0.000000 udp 10.0.2.105 7010 -> 84.173.12.253 7912 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:57:06.271591 0.133818 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 753 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:57:06.415962 0.000000 udp 10.0.2.105 7010 -> 95.236.100.169 9555 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:57:12.310325 0.031925 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/01 08:57:12.355386 0.000000 udp 10.0.2.105 7010 -> 2.228.117.42 8994 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 08:57:17.086965 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 09:01:39.776655 3.001675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 09:01:46.784497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:01:54.786033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:02:10.788695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:02:42.795387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:08:46.800847 3.001811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:08:53.808276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:09:01.809722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:09:17.813149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:09:49.818579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:15:58.832489 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:16:05.839523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:16:07.643108 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 09:16:07.643218 0.992649 tcp 10.0.2.105 59603 -> 162.210.27.16 8808 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:16:13.841111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:16:29.843995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:17:01.850513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:23:08.860620 3.001603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:23:15.867561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:23:23.869068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:23:39.872571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:24:11.878606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:27:26.268124 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 09:27:26.268326 0.166548 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:26.435256 0.039945 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:26.475574 0.075293 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:26.551320 0.059038 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:26.610771 0.172962 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:26.784085 0.216507 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.000974 0.206633 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.208010 0.198068 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.406514 0.213800 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.620728 0.059859 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.680972 0.066553 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.747953 0.181723 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:27.930060 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 09:27:43.676810 0.069882 tcp 10.0.2.105 59604 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:27:43.747041 0.051942 tcp 10.0.2.105 59605 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:27:43.799228 0.164301 tcp 10.0.2.105 59606 -> 195.113.214.236 443 SRPA* 0 0 64 41471 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:27:43.964269 0.141199 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.105878 0.212108 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.318425 0.060209 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.379019 0.214258 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.593672 0.142619 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.736735 0.081000 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.818115 0.144530 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:44.963043 0.321121 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:45.284552 0.164217 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:45.449173 0.142829 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:45.592553 0.382901 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:45.975839 0.070939 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.047141 0.071120 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.118636 0.082404 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.201511 0.132200 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.334128 0.071139 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.405674 0.382933 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.789042 0.057699 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.847097 0.044625 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:46.892089 0.932691 udp 10.0.2.105 7010 <-> 2.194.26.90 4752 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:47.825249 0.053789 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:47.879498 0.133223 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:27:48.013183 0.028572 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:30:15.884713 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:30:22.891720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:30:30.893505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:30:46.896722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:31:18.902698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:37:22.908198 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:37:29.915812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:37:37.916800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:37:53.920442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:38:25.926053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:44:29.933644 3.000596 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:44:36.939618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:44:44.941397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:45:00.944250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:45:32.950232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:46:08.642368 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 09:46:08.642533 1.065502 tcp 10.0.2.105 59607 -> 162.210.27.16 8808 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:54:44.956839 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 09:54:51.963967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:54:59.965709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:55:15.968820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:55:47.974716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 09:58:17.280170 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 09:58:17.280346 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 09:58:35.637607 0.074454 tcp 10.0.2.105 59608 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:58:35.712311 0.049221 tcp 10.0.2.105 59609 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:58:35.761819 0.143697 tcp 10.0.2.105 59610 -> 195.113.214.236 443 SRPA* 0 0 41 23434 flow=From-Botnet-V2-TCP-Established 1970/02/01 09:58:35.906085 0.045423 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:35.951943 0.075234 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.027617 0.088658 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.116728 0.176317 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.293452 0.212167 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.506035 0.303473 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.809928 0.164995 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:36.975313 0.062145 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.037849 0.180614 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.218841 0.170242 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.389458 0.184190 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.574054 0.059951 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.634341 0.136286 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.771030 0.213892 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:37.985322 0.063629 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.049390 0.211197 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.260960 0.152859 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.414257 0.080109 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.494773 0.144746 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.639958 0.143715 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:38.784040 0.386490 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.170972 0.079718 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.251269 0.078566 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.330230 0.135436 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.466099 0.323044 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.789519 0.162471 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:39.952579 0.086927 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.039893 0.070283 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.110544 0.380097 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.491046 0.069093 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.560533 0.044734 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.605639 0.132399 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.738506 0.029322 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.768360 0.146858 udp 10.0.2.105 7010 <-> 2.194.26.90 4752 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/01 09:58:40.915600 0.478629 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:01:51.979821 3.002771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:01:58.987455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:02:06.989469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:02:22.992703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:02:54.998525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:09:04.011036 3.002398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:09:11.018638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:09:19.020170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:09:35.023910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:10:07.029356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:16:09.711716 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 10:16:09.711871 1.074147 tcp 10.0.2.105 59611 -> 162.210.27.16 8808 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:16:13.039294 3.001092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:16:20.046191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:16:28.047087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:16:44.050394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:17:16.056862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:23:22.065712 3.033549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:23:29.082993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:23:37.084638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:23:53.087162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:24:25.093411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:29:06.968744 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 10:29:06.968894 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 10:29:25.727858 0.073145 tcp 10.0.2.105 59612 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:25.801228 0.049957 tcp 10.0.2.105 59613 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:25.851439 0.133489 tcp 10.0.2.105 59614 -> 195.113.214.236 443 SRPA* 0 0 58 50559 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:25.985474 0.046642 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.032747 0.072339 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.105476 0.175758 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.281692 0.220547 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.502665 0.214314 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.717388 0.164784 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.882563 0.065799 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:26.948724 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 10:29:45.674989 0.071757 tcp 10.0.2.105 59615 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:45.747119 0.050214 tcp 10.0.2.105 59616 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:45.797647 0.147689 tcp 10.0.2.105 59617 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:29:45.945901 0.059639 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.005976 0.153195 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.159622 0.213721 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.373721 0.060923 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.435101 0.229003 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.664496 0.140604 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:46.805497 0.269325 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:47.075212 0.180142 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:47.255732 0.079629 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:47.335904 0.145302 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:47.481633 0.143388 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:47.625385 0.385383 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:48.011143 0.070467 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:48.081997 0.068935 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:48.151343 0.094095 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:48.245902 0.401565 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:48.647927 0.363880 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.012165 0.175047 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.187647 0.067110 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.255212 0.379746 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.635397 0.059058 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.694860 0.044449 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.739707 0.134252 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.874374 0.056227 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.930984 0.030546 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:29:49.961916 0.180100 udp 10.0.2.105 7010 <-> 2.194.26.90 4752 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/01 10:30:29.437734 3.004025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 10:30:36.447373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:30:44.448956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:31:00.451947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:31:32.458002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:37:36.463971 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:37:43.471532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:37:51.472834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:38:07.476000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:38:39.482187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:44:43.488307 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:44:50.495428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:44:58.496892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:45:14.499938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:45:46.505871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:46:10.791137 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 10:46:10.791315 0.986109 tcp 10.0.2.105 59618 -> 162.210.27.16 8808 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/02/01 10:51:50.511965 3.070976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:51:57.562047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:52:05.530887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:52:21.534606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:52:53.540032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:58:57.546393 3.001254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 10:59:04.553595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:59:12.554989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:59:28.557923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 10:59:52.522508 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 10:59:52.522677 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 11:00:00.564050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:00:07.866230 0.074793 tcp 10.0.2.105 59619 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:00:07.941307 0.049339 tcp 10.0.2.105 59620 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:00:07.990954 0.148319 tcp 10.0.2.105 59621 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:00:08.139804 0.183037 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.323263 0.074304 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.398037 0.040669 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.439104 0.200040 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.639587 0.164913 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.804897 0.066429 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:08.871727 0.220539 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.092662 0.175902 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.269024 0.158422 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.427868 0.059923 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.488240 0.211274 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.699901 0.150291 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:09.850563 0.169986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.020937 0.199185 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.220585 0.212377 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.433376 0.060482 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.494329 0.087779 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.582534 0.145104 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.728075 0.142514 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:10.870993 0.383036 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.254456 0.067834 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.322742 0.069238 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.392584 0.094451 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.487447 0.064081 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.551959 0.070043 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.622389 0.366434 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:11.989213 0.248251 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:12.237837 0.388388 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:12.626642 0.056639 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:12.683741 0.044504 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:12.728663 0.140235 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:12.869292 0.273212 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:13.142946 0.029193 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:00:13.172592 0.000000 udp 10.0.2.105 7010 -> 2.194.26.90 4752 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 11:00:31.068096 0.070356 tcp 10.0.2.105 59622 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:00:31.138770 0.051695 tcp 10.0.2.105 59623 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:00:31.190816 0.151112 tcp 10.0.2.105 59624 -> 195.113.214.236 443 SRPA* 0 0 42 28164 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:06:28.574569 3.001322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:06:35.581682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:06:43.583485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:06:59.586267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:07:31.592305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:13:40.605095 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:13:47.613463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:13:55.614253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:14:11.617605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:14:43.623594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:16:11.780200 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 11:16:11.780390 1.019656 tcp 10.0.2.105 59625 -> 162.210.27.16 8808 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:20:48.634079 3.009254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:20:55.643163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:21:03.641933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:21:19.642978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:21:51.648943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:27:55.655012 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:28:02.662630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:28:10.663790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:28:26.666801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:28:58.672940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:30:33.038899 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 11:30:33.039130 0.180889 udp 10.0.2.105 7010 -> 2.194.26.90 4752 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 11:30:33.220019 0.000000 icmp 2.194.26.90 0x0303 -> 10.0.2.105 0x9012 URP 192 1 272 flow=Background 1970/02/01 11:30:51.126447 0.075162 tcp 10.0.2.105 59626 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:30:51.201867 0.053854 tcp 10.0.2.105 59627 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:30:51.255995 0.147165 tcp 10.0.2.105 59628 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:30:51.403684 0.074205 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:51.478281 0.045325 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:51.524043 0.207641 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:51.732075 0.165341 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:51.897800 0.061774 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:51.959969 0.180705 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.141071 0.135486 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.276971 0.060303 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.337686 0.211896 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.550006 0.140980 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.691438 0.216661 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:52.908553 0.176749 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.085699 0.214598 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.300663 0.064420 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.365550 0.080559 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.446522 0.167896 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.614866 0.198982 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.814285 0.144424 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:53.959114 0.144825 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.104435 0.065022 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.169924 0.082732 udp 10.0.2.105 7010 <-> 79.47.224.234 2977 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.253058 0.066765 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.320265 0.071343 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.392049 0.056071 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.448729 0.387141 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:54.836289 0.254372 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.091045 0.326155 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.417621 0.134206 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.552408 0.071718 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.624702 0.029996 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.655097 0.068467 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:55.724051 0.378702 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:30:56.103190 0.045061 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 11:35:02.679471 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:35:09.686182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:35:17.687875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:35:33.690880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:36:05.696465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:42:09.703245 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:42:16.710161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:42:24.711657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:42:40.714943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:43:12.720862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:46:12.799693 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 11:46:12.799868 0.938028 tcp 10.0.2.105 59629 -> 162.210.27.16 8808 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/02/01 11:53:36.732299 3.024332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 11:53:43.747902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:53:51.749499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:54:07.753248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 11:54:39.759384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:00:43.764891 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:00:50.771752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:00:58.773255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:01:13.445125 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 12:01:13.445236 0.200893 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:13.646543 0.166725 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:13.813676 0.062269 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:13.876464 0.180980 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.057863 0.064747 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.123043 0.038766 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.162267 0.136582 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.299279 0.083287 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.382993 0.213696 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.597029 0.138370 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.735869 0.245720 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:14.776528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:01:14.982020 0.175289 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.157726 0.255673 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.413850 0.069540 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.483782 0.079968 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.564087 0.170302 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.734770 0.183580 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:15.918751 0.364818 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:16.284000 0.143980 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:16.428440 0.056281 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:16.485158 0.000000 udp 10.0.2.105 7010 -> 79.47.224.234 2977 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 12:01:32.013904 0.072565 tcp 10.0.2.105 59630 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:01:32.086708 0.057355 tcp 10.0.2.105 59631 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:01:32.144380 0.152436 tcp 10.0.2.105 59632 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:01:32.297356 0.057633 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:32.355331 0.382675 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:32.738409 0.161956 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:32.900777 0.063866 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:32.965084 0.074997 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:33.040719 0.321153 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:33.362231 0.133004 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:33.495614 0.461461 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:33.957463 0.029497 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:33.987331 0.056288 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:34.043967 0.382202 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:34.426553 0.046232 udp 10.0.2.105 7010 <-> 5.13.40.89 2778 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:01:46.783149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:07:50.788810 3.001398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:07:57.795670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:08:05.797466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:08:21.800398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:08:53.806552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:14:57.811977 3.002648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:15:04.819836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:15:12.821332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:15:28.824616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:16:00.830511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:16:13.709064 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 12:16:13.709230 1.036618 tcp 10.0.2.105 59633 -> 162.210.27.16 8808 FSPA* 0 0 16 1692 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:22:06.840069 3.000889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:22:13.846550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:22:21.848097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:22:37.851375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:23:09.857385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:29:13.862928 3.002228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:29:20.870573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:29:28.872177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:29:44.887192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:30:16.881421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:31:48.403230 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 12:31:48.403343 0.000000 udp 10.0.2.105 7010 -> 79.47.224.234 2977 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 12:32:04.588774 0.074387 tcp 10.0.2.105 59634 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:04.663431 0.053287 tcp 10.0.2.105 59635 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:04.717105 0.154184 tcp 10.0.2.105 59636 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:04.871505 0.165816 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.037697 0.066976 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.105077 0.182238 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.287738 0.071941 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.360093 0.039890 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.400456 0.201290 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.602200 0.227926 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.830524 0.143165 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:05.974070 0.214642 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.189125 0.174465 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.364014 0.152667 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.517067 0.059512 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.576999 0.080626 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.658069 0.168188 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:06.826692 0.192083 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.019247 0.222323 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.242006 0.061169 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.303653 0.145137 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.449134 0.143830 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.593379 0.057429 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.651202 0.054909 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:07.706578 0.386329 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.093281 0.243129 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.336787 0.069934 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.407073 0.068859 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.476510 0.320038 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.796965 0.133115 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.930523 0.059799 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:08.990766 0.389245 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:32:09.380404 0.000000 udp 10.0.2.105 7010 -> 5.13.40.89 2778 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 12:32:26.087110 0.072954 tcp 10.0.2.105 59637 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:26.160317 0.055585 tcp 10.0.2.105 59638 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:26.216212 0.149745 tcp 10.0.2.105 59639 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:26.366555 0.000000 udp 10.0.2.105 7010 -> 79.77.219.124 2432 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 12:32:42.010529 0.069266 tcp 10.0.2.105 59640 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:42.080194 0.053875 tcp 10.0.2.105 59641 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:42.134398 0.149124 tcp 10.0.2.105 59642 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:32:42.284072 0.029337 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/01 12:36:20.887481 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 12:36:27.894287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:36:35.896382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:36:51.899283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:37:23.905026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:43:27.910233 3.002842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:43:34.917991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:43:42.920160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:43:58.923266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:44:30.929378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:46:14.749396 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 12:46:14.749593 1.320789 tcp 10.0.2.105 59643 -> 162.210.27.16 8808 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/02/01 12:54:11.938497 2.999744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 12:54:18.944773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:54:26.946277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:54:42.949010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 12:55:14.955249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:01:18.962014 3.000783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:01:25.968619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:01:33.969735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:01:49.973190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:02:21.979169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:03:08.306129 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 13:03:08.306278 0.000000 udp 10.0.2.105 7010 -> 5.13.40.89 2778 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:03:24.161152 0.073793 tcp 10.0.2.105 59644 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:24.235206 0.052485 tcp 10.0.2.105 59645 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:24.288013 0.145778 tcp 10.0.2.105 59646 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:24.434289 0.000000 udp 10.0.2.105 7010 -> 79.77.219.124 2432 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:03:43.316973 0.074155 tcp 10.0.2.105 59647 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:43.391401 0.054476 tcp 10.0.2.105 59648 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:43.446166 0.147509 tcp 10.0.2.105 59649 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:03:43.594136 0.165023 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:43.759618 0.060503 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:43.820575 0.045774 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:43.866794 0.203848 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.071054 0.213110 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.284717 0.141533 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.426653 0.214672 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.641661 0.069987 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.712035 0.182754 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:44.895164 0.173698 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.069265 0.169160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.238825 0.189800 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.429037 0.217968 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.647415 0.151371 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.799146 0.059770 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.859330 0.081295 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.941019 0.056604 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:45.998021 0.382485 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:46.380936 0.061731 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:46.443084 0.144105 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:46.587631 0.145582 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:03:46.733597 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:04:02.093739 0.073341 tcp 10.0.2.105 59650 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:02.167462 0.054788 tcp 10.0.2.105 59651 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:02.222485 0.154073 tcp 10.0.2.105 59652 -> 195.113.214.236 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:02.377286 0.324237 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:02.701969 0.133121 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:02.835469 0.058439 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:02.894310 0.162372 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:03.057124 0.000000 udp 10.0.2.105 7010 -> 81.155.249.248 7785 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:04:19.008131 0.073411 tcp 10.0.2.105 59653 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:19.081882 0.053607 tcp 10.0.2.105 59654 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:19.135841 0.150358 tcp 10.0.2.105 59655 -> 195.113.214.236 443 SRPA* 0 0 41 21646 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:04:19.286420 0.070362 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:19.357199 0.382973 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:04:19.740647 0.029089 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:08:25.984970 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 13:08:32.992610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:08:40.993859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:08:56.996988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:09:29.002693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:15:39.017895 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:15:46.025078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:15:54.026661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:16:10.029666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:16:16.078139 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 13:16:16.078239 0.978669 tcp 10.0.2.105 59656 -> 162.210.27.16 8808 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:16:42.035691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:22:47.048550 2.996350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:22:54.050645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:23:02.051747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:23:18.055159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:23:50.061000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:29:54.066719 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:30:01.074585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:30:09.075404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:30:25.079206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:30:57.092497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:34:28.919858 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 13:34:28.920027 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:34:47.568938 0.067907 tcp 10.0.2.105 59657 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:34:47.637107 0.053391 tcp 10.0.2.105 59658 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:34:47.690863 0.144851 tcp 10.0.2.105 59659 -> 195.113.214.236 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:34:47.835422 0.000000 udp 10.0.2.105 7010 -> 81.155.249.248 7785 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 13:35:05.202244 0.069355 tcp 10.0.2.105 59660 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:35:05.272020 0.054987 tcp 10.0.2.105 59661 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:35:05.327362 0.153137 tcp 10.0.2.105 59662 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:35:05.480992 0.057323 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:05.538662 0.165724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:05.704848 0.046976 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:05.753164 0.222102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:05.975659 0.204809 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.180925 0.213808 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.395091 0.145635 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.541096 0.180202 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.721641 0.073902 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.795933 0.171800 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:06.968109 0.166647 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.135172 0.060406 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.195974 0.081055 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.277407 0.056874 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.334737 0.212974 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.548177 0.217373 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.765937 0.154900 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.921256 0.059006 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:07.980674 0.143384 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:08.124474 0.381770 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:08.506756 0.145089 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:08.652299 0.060467 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:08.713146 0.134044 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:08.847573 0.326640 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:09.174753 0.163506 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:09.338632 0.066036 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:09.405047 0.374518 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:35:09.780002 0.028979 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/01 13:37:01.090034 3.002288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 13:37:08.098805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:37:16.099472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:37:32.103309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:38:04.108769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:44:08.115171 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:44:15.122893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:44:23.123866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:44:39.131010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:45:11.134714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:46:17.057865 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 13:46:17.058058 1.012141 tcp 10.0.2.105 59663 -> 162.210.27.16 8808 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/01 13:54:32.142363 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 13:54:39.149354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:54:47.151344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:55:03.154423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 13:55:35.159953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:01:39.165779 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:01:46.173741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:01:54.175262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:02:10.177960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:02:42.184716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:05:12.100144 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 14:05:12.100350 0.040007 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:12.140736 0.216496 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:12.357679 0.376014 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:12.734102 0.059130 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:12.793619 0.164914 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:12.958884 0.210763 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.170123 0.138019 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.308564 0.180031 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.489003 0.068680 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.558085 0.172174 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.730713 0.169029 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.900144 0.059034 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:13.959568 0.083356 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:14.043320 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 14:05:29.596724 0.070706 tcp 10.0.2.105 59664 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:05:29.667780 0.053585 tcp 10.0.2.105 59665 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:05:29.721648 0.146009 tcp 10.0.2.105 59666 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:05:29.867875 0.195518 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:30.063803 0.216300 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:30.280638 0.142912 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:30.423954 0.064127 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:30.488520 0.143671 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:30.632578 0.385995 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:31.018947 0.144653 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:31.164012 0.057774 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:31.222214 0.131591 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:31.354206 0.333934 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:31.688533 0.386787 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:32.075722 0.030001 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:32.106113 0.255855 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:05:32.362406 0.068968 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:08:46.193510 2.998225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:08:53.197258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:09:01.198603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:09:17.202007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:09:49.208183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:15:58.222087 3.000767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:16:05.228255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:16:13.229870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:16:18.077806 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 14:16:18.077972 0.893766 tcp 10.0.2.105 59667 -> 162.210.27.16 8808 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:16:29.233267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:17:01.239793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:23:08.249883 3.001726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:23:15.257096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:23:23.258135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:23:39.261786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:24:11.267501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:30:15.274895 3.000438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:30:22.281113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:30:30.282770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:30:46.285695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:31:18.292100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:35:37.564929 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 14:35:37.565043 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 14:35:54.641444 0.162246 tcp 10.0.2.105 59668 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:35:54.803970 0.052192 tcp 10.0.2.105 59669 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:35:54.856621 0.147096 tcp 10.0.2.105 59670 -> 195.113.214.236 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:35:55.004497 0.198484 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.203425 0.057180 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.261041 0.046475 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.307898 0.219589 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.527970 0.216572 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.745051 0.138992 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:55.884440 0.163647 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.048533 0.070733 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.119718 0.173377 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.293521 0.170604 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.464658 0.058638 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.523698 0.080020 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.604087 0.180578 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.785214 0.189045 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:56.974714 0.211223 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:57.186357 0.141830 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:57.328738 0.057681 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:57.386800 0.141678 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:57.528897 0.403502 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:57.932798 0.144893 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:35:58.078096 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 14:36:14.467799 0.073429 tcp 10.0.2.105 59671 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:36:14.541485 0.053729 tcp 10.0.2.105 59672 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:36:14.595471 0.146745 tcp 10.0.2.105 59673 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:36:14.742890 0.133261 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:36:14.876554 0.326293 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:36:15.203260 0.386114 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:36:15.589827 0.028931 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:36:15.619271 0.339881 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:36:15.959611 0.070205 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/01 14:37:22.298386 3.001054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 14:37:29.304927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:37:37.306191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:37:53.351018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:38:25.325646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:44:29.331967 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:44:36.339196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:44:44.340110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:45:00.347472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:45:32.349343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:46:18.977164 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 14:46:18.977269 1.035632 tcp 10.0.2.105 59674 -> 162.210.27.16 8808 FSPA* 0 0 12 1549 flow=From-Botnet-V2-TCP-Established 1970/02/01 14:54:44.355770 3.014350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 14:54:51.373156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:54:59.374776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:55:15.377672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 14:55:47.383776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:01:51.390045 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:01:58.397200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:02:06.398915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:02:22.401729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:02:54.407951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:06:38.149608 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 15:06:38.149860 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 15:06:55.355803 0.061536 tcp 10.0.2.105 59675 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 15:06:55.417563 0.052186 tcp 10.0.2.105 59676 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 15:06:55.470035 0.147144 tcp 10.0.2.105 59677 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/01 15:06:55.617673 0.045970 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:55.664064 0.199024 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:55.863473 0.056512 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:55.920424 0.213558 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.134429 0.139871 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.274704 0.164251 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.439345 0.072212 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.511977 0.223379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.735788 0.176598 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.912766 0.084837 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:56.997979 0.180817 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.179203 0.189529 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.369124 0.213464 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.582989 0.150948 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.734386 0.059149 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.793953 0.168436 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:57.962746 0.145291 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:58.108591 0.060279 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:58.169208 0.144976 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:58.314569 0.386236 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:58.701209 0.133906 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:58.835457 0.339884 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:59.175665 0.399189 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:59.575261 0.067264 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:06:59.642971 0.376120 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:07:00.019468 0.030684 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:09:04.422619 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:09:11.429497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:09:19.431267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:09:35.434532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:10:07.440210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:16:12.448362 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:16:19.455089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:16:20.016341 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 15:16:20.016430 1.013825 tcp 10.0.2.105 59678 -> 162.210.27.16 8808 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/01 15:16:27.456898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:16:43.459800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:17:15.465831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:23:20.472704 3.012475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:23:27.490050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:23:35.491982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:23:51.495101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:24:23.501253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:30:27.512904 2.995993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:30:34.514838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:30:42.516039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:30:58.519183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:31:30.531947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:37:06.007826 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 15:37:06.007944 0.062649 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.071000 0.213007 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.284472 0.040598 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.325492 0.204837 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.530721 0.146571 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.677770 0.164746 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.842939 0.070109 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:06.913448 0.272577 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:07.186423 0.181043 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:07.367826 0.197119 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:07.565388 0.213748 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:07.779486 0.170902 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:07.950731 0.082504 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.033706 0.143518 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.177589 0.061854 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.239839 0.178149 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.418361 0.144298 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.563045 0.057069 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.620676 0.143038 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:08.764084 0.386706 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:09.151202 0.133458 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:09.285040 0.066548 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:09.352035 0.320757 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:09.673206 0.162297 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:09.835884 0.388430 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:10.224776 0.029874 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/01 15:37:34.531415 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:37:41.538543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:37:49.539840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:38:05.543057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:38:37.549073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:44:41.555765 3.001252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:44:48.562862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:44:56.563831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:45:12.577095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:45:44.583230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:46:21.035558 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 15:46:21.035728 1.121719 tcp 10.0.2.105 59679 -> 162.210.27.16 8808 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/01 15:51:48.589625 3.001102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:51:55.596316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:52:03.597791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:52:19.601083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:52:51.608579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:58:55.612809 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 15:59:02.620764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:59:10.621812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:59:26.625136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 15:59:58.631118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:06:26.642180 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:06:33.648773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:06:41.650288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:06:57.653532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:07:20.747269 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 16:07:20.747378 0.059230 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:20.807021 0.228920 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.036448 0.142330 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.179218 0.164546 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.344215 0.070157 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.414753 0.222991 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.638275 0.039248 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.677912 0.202459 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:21.880754 0.179082 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.060427 0.198952 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.259792 0.258043 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.518285 0.173766 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.692473 0.082066 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.774932 0.141126 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.916490 0.059177 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:22.976001 0.168318 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:23.144714 0.146699 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:23.291789 0.060566 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:23.352725 0.144201 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:23.497295 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 16:07:29.660845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:07:39.655371 0.063793 tcp 10.0.2.105 59680 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 16:07:39.719487 0.052978 tcp 10.0.2.105 59681 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 16:07:39.772766 0.110038 tcp 10.0.2.105 59682 -> 195.113.214.236 443 SRPA* 0 0 56 37989 flow=From-Botnet-V2-TCP-Established 1970/02/01 16:07:39.883282 0.141782 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:40.025489 0.811574 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:40.837511 0.373826 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:41.211739 0.029523 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:41.241720 0.067066 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:07:41.309154 0.341102 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:13:38.672923 3.001554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:13:45.680431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:13:53.681597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:14:09.684863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:14:41.690827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:16:22.165498 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 16:16:22.165648 0.931150 tcp 10.0.2.105 59683 -> 162.210.27.16 8808 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/01 16:20:46.698349 3.001535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:20:53.705363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:21:01.707136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:21:17.713174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:21:49.716530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:27:53.722475 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:28:00.729385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:28:08.730994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:28:24.733908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:28:56.740088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:35:00.745828 3.001781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:35:07.753890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:35:15.755660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:35:31.758582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:36:03.764014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:37:49.296539 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 16:37:49.296731 0.385392 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:49.682500 0.140876 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:49.823765 0.065981 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:49.890164 0.229445 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.119991 0.215825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.336262 0.046568 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.383266 0.208124 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.591779 0.163665 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.755894 0.074962 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:50.831274 0.409321 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.241015 0.199521 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.440997 0.180109 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.621480 0.146175 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.768112 0.059039 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.827560 0.168172 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:51.996137 0.145191 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.141669 0.172350 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.314429 0.083513 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.398300 0.143191 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.541928 0.061039 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.603419 0.135755 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.739547 0.029509 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.769463 0.068163 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:52.837985 0.354245 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:53.192653 0.362195 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:37:53.555278 0.328306 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/01 16:42:07.769766 3.011940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:42:14.777592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:42:22.778439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:42:38.781732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:43:10.787787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:46:23.104847 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 16:46:23.105034 1.170924 tcp 10.0.2.105 59684 -> 162.210.27.16 8808 FSPA* 0 0 15 1585 flow=From-Botnet-V2-TCP-Established 1970/02/01 16:53:34.798124 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 16:53:41.805010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:53:49.806644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:54:05.809271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 16:54:37.815665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:00:41.821384 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:00:48.828805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:00:56.830276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:01:12.833578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:01:44.839522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:07:48.845697 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:07:55.853125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:07:55.923417 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 17:07:55.923577 0.058259 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:07:55.982201 0.221817 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:07:56.204413 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 17:08:03.854628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:08:15.132073 0.061154 tcp 10.0.2.105 59685 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:15.193503 0.031210 tcp 10.0.2.105 59686 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:15.225019 0.124739 tcp 10.0.2.105 59687 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:15.350262 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 17:08:19.857791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:08:34.329089 0.063266 tcp 10.0.2.105 59688 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:34.392638 0.031139 tcp 10.0.2.105 59689 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:34.424067 0.145151 tcp 10.0.2.105 59690 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:08:34.569890 0.215722 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:34.786020 0.039729 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:34.826137 0.343966 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:35.170471 0.163974 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:35.334799 0.092464 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:35.427602 0.318909 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:35.746888 0.208277 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:35.955582 0.180228 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.136410 0.149967 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.286820 0.060212 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.347385 0.167618 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.515393 0.145524 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.661351 0.170746 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.832625 0.079529 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:36.912542 0.144100 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.057056 0.061927 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.119338 0.134287 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.254080 0.028341 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.282904 0.070750 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.354057 0.237808 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.592336 0.375985 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:37.968678 0.321509 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:08:51.863639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:14:55.869197 3.002130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:15:02.876870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:15:10.878392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:15:26.881558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:15:58.887037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:16:24.284570 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 17:16:24.284674 0.876699 tcp 10.0.2.105 59691 -> 162.210.27.16 8808 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:22:04.896319 3.003126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:22:11.904682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:22:19.905505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:22:35.908504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:23:07.914621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:29:11.920072 3.002165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:29:18.927356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:29:26.929654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:29:42.932142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:30:14.938252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:36:18.945415 3.000141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:36:25.952209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:36:33.953375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:36:49.956679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:37:21.962152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:38:52.993622 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 17:38:52.993810 0.153173 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:38:53.147342 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 17:39:10.771115 0.062565 tcp 10.0.2.105 59692 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:10.834014 0.052600 tcp 10.0.2.105 59693 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:10.886979 0.144842 tcp 10.0.2.105 59694 -> 195.113.214.236 443 SRPA* 0 0 32 22196 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:11.032624 0.060751 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:11.093730 0.214333 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:11.308809 0.214525 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:11.523761 0.045676 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:11.569837 0.356600 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:11.926876 0.164632 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:12.091885 0.069467 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:12.161778 0.400155 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:12.562386 0.188935 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:12.752380 0.179227 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:12.932031 0.149006 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:13.081387 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 17:39:30.247608 0.060629 tcp 10.0.2.105 59695 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:30.308618 0.052247 tcp 10.0.2.105 59696 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:30.361221 0.145344 tcp 10.0.2.105 59697 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:39:30.507474 0.169158 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:30.676966 0.145734 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:30.823105 0.176594 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.000114 0.078764 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.079256 0.142904 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.222532 0.063855 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.286818 0.067225 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.354495 0.163164 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.518082 0.377586 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:31.896070 0.355351 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:32.251771 0.139072 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:39:32.391208 0.028900 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/01 17:43:25.968111 3.001847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 17:43:32.975916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:43:40.977404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:43:56.984858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:44:28.986507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:46:25.163813 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 17:46:25.163923 1.015556 tcp 10.0.2.105 59698 -> 162.210.27.16 8808 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/01 17:54:15.001534 3.001081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 17:54:22.008622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:54:30.010870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:54:46.013396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 17:55:18.029400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:01:22.036351 3.000799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 18:01:29.042901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:01:37.044584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:01:53.047275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:02:25.053590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:08:29.059473 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 18:08:36.067471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:08:44.068488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:09:00.071530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:09:32.077463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:09:46.939175 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:09:46.939272 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:05.848346 0.063378 tcp 10.0.2.105 59699 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:10:05.912093 0.031334 tcp 10.0.2.105 59700 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:10:05.943733 0.105677 tcp 10.0.2.105 59701 -> 195.113.214.236 443 SRPA* 0 0 56 37361 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:10:06.049999 4.798559 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 4 1046 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.192872 3.857019 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 4 1071 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.255213 4.025233 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1250 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.478810 3.849011 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 4 1181 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.527443 4.179919 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 4 978 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.725146 4.288595 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1301 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.891887 4.178983 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 4 1273 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:06.963476 4.325526 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 4 1262 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:07.176188 4.292547 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 4 1031 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:07.356700 4.254697 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 4 1317 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:07.497801 4.312062 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 4 949 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:07.706533 4.454918 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 4 1080 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.087704 4.220537 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1194 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.238143 4.247234 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 4 1079 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.411122 4.148203 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1254 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.492824 4.214210 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 4 1204 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.635981 4.122496 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1024 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.703185 4.230758 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1198 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:08.878581 4.223002 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 4 1204 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:09.047672 4.832695 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 4 1248 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:09.427082 4.001509 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1336 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:09.750576 3.747627 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 4 1035 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:09.819361 4.241403 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 4 1070 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:09.954304 3.957718 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 4 1232 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:10:14.061419 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:19.996714 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:26.206772 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:31.082270 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:10:31.903320 0.000000 udp 10.0.2.105 7010 -> 76.69.98.57 5067 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:38.112817 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:46.344396 0.000000 udp 10.0.2.105 7010 -> 86.42.95.150 6606 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:52.283074 0.358628 udp 10.0.2.105 7010 -> 211.21.138.89 5029 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:10:52.641702 0.000000 icmp 211.21.138.89 0x0303 -> 10.0.2.105 0xa513 URP 192 1 326 flow=Background 1970/02/01 18:10:57.079549 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:11:00.755864 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1564 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:06.573604 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:11.921300 0.000000 udp 10.0.2.105 7010 -> 98.100.82.122 5693 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:18.991342 0.069186 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:11:19.085054 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:23.578065 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:11:27.635281 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:35.646916 0.000000 udp 10.0.2.105 7010 -> 175.45.28.78 1609 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:44.537966 0.000000 udp 10.0.2.105 7010 -> 95.226.81.61 6156 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:11:49.084487 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:11:52.208964 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:01.172145 0.000000 udp 10.0.2.105 7010 -> 71.41.135.28 7627 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:07.811669 0.000000 udp 10.0.2.105 7010 -> 50.124.178.238 4327 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:14.060395 0.000000 udp 10.0.2.105 7010 -> 120.146.163.240 4618 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:18.586781 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:12:20.770734 0.000000 udp 10.0.2.105 7010 -> 88.226.105.174 1067 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:26.828940 0.000000 udp 10.0.2.105 7010 -> 81.61.131.123 2312 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:35.141199 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:43.032144 0.000000 udp 10.0.2.105 7010 -> 178.82.135.21 9685 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:47.580699 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:12:48.130135 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:12:54.629052 0.000000 udp 10.0.2.105 7010 -> 114.145.192.213 1432 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:02.039560 0.000000 udp 10.0.2.105 7010 -> 201.183.69.178 9830 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:07.727718 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:12.584037 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:13:16.019033 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:21.758408 0.000000 udp 10.0.2.105 7010 -> 61.76.185.163 8506 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:29.869417 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:38.021437 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:42.587479 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:13:43.850763 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:49.978321 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:13:54.985691 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:03.157700 0.000000 udp 10.0.2.105 7010 -> 67.175.43.106 1242 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:08.084195 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:14:09.276935 0.000000 udp 10.0.2.105 7010 -> 211.26.10.184 4600 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:15.084528 0.000000 udp 10.0.2.105 7010 -> 122.149.210.198 6211 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:20.452537 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:25.659850 0.000000 udp 10.0.2.105 7010 -> 87.7.89.13 2391 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:33.981664 0.000000 udp 10.0.2.105 7010 -> 93.193.132.150 7662 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:38.577943 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:14:41.742962 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:48.798241 0.000000 udp 10.0.2.105 7010 -> 14.155.10.40 9147 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:14:56.464085 0.000000 udp 10.0.2.105 7010 -> 174.28.140.223 4712 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:02.762922 0.056015 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:02.818937 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 234 flow=Background 1970/02/01 18:15:07.580008 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:15:09.793204 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:18.157374 0.000000 udp 10.0.2.105 7010 -> 86.5.175.14 1691 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:23.653207 0.000000 udp 10.0.2.105 7010 -> 86.180.155.39 6896 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:32.235699 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:37.082417 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:15:40.056853 0.000000 udp 10.0.2.105 7010 -> 85.233.185.90 6312 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:41.091682 3.000926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 18:15:45.936195 0.000000 udp 10.0.2.105 7010 -> 213.137.0.155 2634 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:48.099120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:15:54.207099 0.000000 udp 10.0.2.105 7010 -> 62.249.247.156 2160 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:15:56.100751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:16:00.325726 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:05.082500 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:16:05.473311 0.000000 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:11.712382 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:12.102791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:16:18.422028 0.328046 udp 10.0.2.105 7010 <-> 218.164.148.252 7010 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:16:18.780940 0.000000 udp 10.0.2.105 7010 -> 108.178.84.253 1628 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:25.463623 0.000000 udp 10.0.2.105 7010 -> 77.97.237.63 6103 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:26.185338 0.923673 tcp 10.0.2.105 59702 -> 162.210.27.16 8808 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:16:34.384996 0.000000 udp 10.0.2.105 7010 -> 79.28.160.30 1508 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:40.895770 0.000000 udp 10.0.2.105 7010 -> 210.124.233.2 8650 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:44.108671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:16:46.372500 0.000000 udp 10.0.2.105 7010 -> 2.32.3.249 1853 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:16:51.078776 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:16:54.513683 0.000000 udp 10.0.2.105 7010 -> 211.47.85.103 4304 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:01.834778 0.142869 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:17:01.998578 0.000000 udp 10.0.2.105 7010 -> 69.114.180.174 4705 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:10.226263 0.000000 udp 10.0.2.105 7010 -> 24.66.140.112 7854 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:15.082483 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:17:18.778363 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1058 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:24.867439 0.000000 udp 10.0.2.105 7010 -> 212.50.168.126 2533 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:33.679991 0.208423 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:17:33.907435 0.137861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:17:34.069941 0.000000 udp 10.0.2.105 7010 -> 84.94.106.58 1024 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:41.561641 0.000000 udp 10.0.2.105 7010 -> 94.172.160.167 4788 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:46.077227 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:17:48.441695 0.000000 udp 10.0.2.105 7010 -> 202.134.122.248 7008 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:17:53.938743 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:01.249512 0.000000 udp 10.0.2.105 7010 -> 12.161.106.217 1233 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:06.357166 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:11.083698 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:18:12.556193 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:19.986227 0.000000 udp 10.0.2.105 7010 -> 96.43.186.72 2901 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:26.385854 0.000000 udp 10.0.2.105 7010 -> 115.132.43.235 2219 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:35.348276 0.432667 udp 10.0.2.105 7010 <-> 201.210.193.30 9206 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:18:35.897600 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:40.088219 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:18:42.569302 0.000000 udp 10.0.2.105 7010 -> 120.28.233.227 1238 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:47.828723 0.000000 udp 10.0.2.105 7010 -> 65.167.141.55 7133 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:18:54.201909 0.247259 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:18:54.461449 0.189145 udp 10.0.2.105 7010 <-> 27.7.223.108 2489 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:18:54.670091 0.681263 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:18:55.363983 0.000000 udp 10.0.2.105 7010 -> 200.223.161.235 5881 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:02.159107 0.000000 udp 10.0.2.105 7010 -> 85.189.154.81 5187 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:07.084438 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:19:09.748131 0.000000 udp 10.0.2.105 7010 -> 94.34.255.116 9141 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:17.319613 0.000000 udp 10.0.2.105 7010 -> 92.48.4.127 6638 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:23.036928 0.000000 udp 10.0.2.105 7010 -> 68.15.109.132 4884 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:28.314866 0.046171 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:19:28.375981 0.000000 udp 10.0.2.105 7010 -> 92.44.141.113 4238 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:33.083165 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:19:36.246282 0.180147 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:19:36.441211 0.000000 udp 10.0.2.105 7010 -> 74.210.196.231 5705 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:41.553721 0.212066 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:19:41.859774 0.000000 udp 10.0.2.105 7010 -> 80.28.159.218 6380 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:48.844482 0.000000 udp 10.0.2.105 7010 -> 95.239.74.16 5580 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:54.092000 0.000000 udp 10.0.2.105 7010 -> 116.246.25.164 8351 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:19:59.078688 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:20:00.270527 0.000000 udp 10.0.2.105 7010 -> 95.243.209.28 9149 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:06.459636 0.000000 udp 10.0.2.105 7010 -> 99.113.240.19 6714 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:12.989162 0.000000 udp 10.0.2.105 7010 -> 166.127.176.80 6824 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:20.644947 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:25.586976 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:20:28.672157 0.375891 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:29.072717 0.220981 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:29.389324 0.382480 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:29.865690 0.055128 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:30.267695 0.000000 udp 10.0.2.105 7010 -> 124.82.158.145 4605 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:39.176937 0.000000 udp 10.0.2.105 7010 -> 50.171.50.122 4153 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:47.058012 0.113818 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:47.215039 0.000000 udp 10.0.2.105 7010 -> 115.132.149.178 8834 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:20:51.584606 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:20:55.810306 0.380559 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:20:56.366880 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:04.675682 0.000000 udp 10.0.2.105 7010 -> 111.95.117.94 5231 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:10.414459 0.000000 udp 10.0.2.105 7010 -> 58.27.36.34 8722 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:17.712403 0.000000 udp 10.0.2.105 7010 -> 95.238.196.194 3387 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:22.578966 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:21:26.454804 0.000000 udp 10.0.2.105 7010 -> 96.35.63.5 4436 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:33.125767 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:39.573593 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:45.451997 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:21:50.078434 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:21:51.671206 0.000000 udp 10.0.2.105 7010 -> 70.103.195.190 4612 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:22:00.623819 0.104893 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:22:00.803524 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:22:08.037275 0.224877 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:22:08.329275 0.211559 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:22:08.563611 0.000000 udp 10.0.2.105 7010 -> 189.60.149.191 8208 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:22:16.746926 0.000000 udp 10.0.2.105 7010 -> 124.65.151.30 2963 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:22:21.585007 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:22:23.076200 0.000000 udp 10.0.2.105 7010 -> 184.21.106.179 4748 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:22:48.115708 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 18:22:55.121906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:23:03.128694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:23:19.130217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:23:51.133268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:29:55.138909 3.001261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 18:30:02.148743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:30:10.148079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:30:26.151298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:30:58.156796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:37:02.162962 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 18:37:09.170174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:37:17.171624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:37:33.174363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:38:05.180986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:44:09.187203 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 18:44:16.194099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:44:24.195480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:44:40.197933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:45:12.204610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:46:27.113072 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:46:27.113298 0.828638 tcp 10.0.2.105 59703 -> 162.210.27.16 8808 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:52:42.311940 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 18:52:42.312105 0.046883 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:42.359446 0.475155 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:42.835042 0.061345 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:42.896800 0.221323 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.118524 0.139823 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.258730 0.164898 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.424004 0.070724 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.495073 0.211008 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.706657 0.181965 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:43.889039 0.142620 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:44.032020 0.195243 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:44.227701 0.226136 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:44.454219 0.145061 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:44.599730 0.171296 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:44.771415 0.233277 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.005117 0.173297 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.178866 0.089829 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.269085 0.144476 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.414005 0.060173 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.474578 0.318810 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.793726 0.070119 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:45.864290 0.373686 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.238395 0.028624 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.267501 0.132186 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.400074 0.065644 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.466148 0.335592 udp 10.0.2.105 7010 <-> 218.164.148.252 7010 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.802168 0.139156 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:46.941738 0.151784 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:47.093955 0.202060 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:52:47.296502 0.000000 udp 10.0.2.105 7010 -> 201.210.193.30 9206 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:53:04.415307 0.063990 tcp 10.0.2.105 59704 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:04.479570 0.031830 tcp 10.0.2.105 59705 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:04.511701 0.127670 tcp 10.0.2.105 59706 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:04.640019 0.242956 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:04.897057 0.000000 udp 10.0.2.105 7010 -> 27.7.223.108 2489 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:53:23.110667 0.063233 tcp 10.0.2.105 59707 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:23.174202 0.031298 tcp 10.0.2.105 59708 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:23.205748 0.202514 tcp 10.0.2.105 59709 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 18:53:23.408762 0.000000 udp 10.0.2.105 7010 -> 172.162.109.59 7488 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:53:31.971382 0.000000 udp 10.0.2.105 7010 <- 172.162.109.59 7488 RSP 0 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 18:53:31.971775 0.043774 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:32.015969 0.175629 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:32.192054 0.287780 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:32.480255 0.384056 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:32.864723 0.217805 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:33.082982 0.051826 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:33.135224 0.376227 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:33.511900 0.103855 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:33.616144 0.376747 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:33.993279 0.115603 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:34.109296 0.172448 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:53:34.282131 0.106776 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 18:54:32.212592 3.001285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 18:54:39.219832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:54:47.221095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:55:03.224431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 18:55:35.231559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:01:39.235988 3.002219 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:01:46.243604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:01:54.249052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:02:10.249683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:02:42.254277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:08:46.261305 3.000829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:08:53.268033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:09:01.269373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:09:17.272413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:09:49.278184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:15:58.292583 3.000607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:16:05.298870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:16:13.300160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:16:27.942159 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 19:16:27.942264 0.904168 tcp 10.0.2.105 59710 -> 162.210.27.16 8808 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:16:29.303240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:17:01.309377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:23:07.317779 3.002373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:23:14.325789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:23:22.327012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:23:38.330162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:23:46.802792 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 19:23:46.802961 0.000000 udp 10.0.2.105 7010 -> 201.210.193.30 9206 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 19:24:05.551648 0.061984 tcp 10.0.2.105 59711 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:05.613969 0.032097 tcp 10.0.2.105 59712 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:05.646368 0.125652 tcp 10.0.2.105 59713 -> 195.113.214.236 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:05.772713 0.000000 udp 10.0.2.105 7010 -> 27.7.223.108 2489 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 19:24:10.336358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:24:22.844581 0.059599 tcp 10.0.2.105 59714 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:22.904485 0.031950 tcp 10.0.2.105 59715 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:22.936660 0.124833 tcp 10.0.2.105 59716 -> 195.113.214.236 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:23.061709 0.060592 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:23.122689 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 19:24:38.327173 0.060562 tcp 10.0.2.105 59717 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:38.388086 0.032770 tcp 10.0.2.105 59718 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:38.421169 0.124766 tcp 10.0.2.105 59719 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:38.546459 0.040471 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:38.587358 0.071126 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:38.658878 0.144535 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:38.803798 0.223638 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.027871 0.164103 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.192386 0.147697 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.340632 0.190542 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.531619 0.210953 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.743014 0.179586 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:39.922956 0.144730 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.068043 0.168746 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.237196 0.230337 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.467966 0.061022 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.529339 0.081266 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.611019 0.170789 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:40.782187 0.227017 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:41.009556 0.144338 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:41.154288 0.375178 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:41.529897 0.425401 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:41.955711 0.071280 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:42.027368 0.068208 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:42.095977 0.133026 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:42.229447 0.029087 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:42.259004 0.000000 udp 10.0.2.105 7010 -> 218.164.148.252 7010 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 19:24:59.007038 0.060941 tcp 10.0.2.105 59720 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:59.068391 0.032054 tcp 10.0.2.105 59721 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:59.100743 0.126253 tcp 10.0.2.105 59722 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:24:59.227675 0.137837 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:59.365967 0.205155 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:59.571519 0.151918 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:59.723812 0.241307 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:24:59.965518 0.073107 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:00.039089 0.174737 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:00.214252 1.604111 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:01.818743 0.388836 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:02.207945 0.244745 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:02.453138 0.354953 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:02.808506 0.217908 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.026784 0.053297 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.080472 0.372119 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.453067 0.104362 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.557877 0.116007 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.674317 0.188613 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:25:03.863308 0.113629 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:30:14.345621 3.052464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 19:30:21.382833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:30:29.361283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:30:45.364832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:31:17.370179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:37:21.375845 3.002143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:37:28.383693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:37:36.384983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:37:52.388642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:38:24.395031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:44:28.402468 2.999365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:44:35.407779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:44:43.409073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:44:59.412012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:45:31.418548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:46:28.851098 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 19:46:28.851331 0.842309 tcp 10.0.2.105 59723 -> 162.210.27.16 8808 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:54:43.425256 3.000905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 19:54:50.431999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:54:58.433203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:55:14.436552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:55:23.319472 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 19:55:23.319577 0.206667 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:23.526709 0.000000 udp 10.0.2.105 7010 -> 218.164.148.252 7010 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 19:55:42.008403 0.053281 tcp 10.0.2.105 59724 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:55:42.061964 0.053378 tcp 10.0.2.105 59725 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:55:42.115605 0.106233 tcp 10.0.2.105 59726 -> 195.113.214.236 443 SRPA* 0 0 56 37361 flow=From-Botnet-V2-TCP-Established 1970/02/01 19:55:42.222487 0.065379 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.288253 0.156508 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.445150 0.219503 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.665090 0.165682 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.831195 0.046005 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.877634 0.076261 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:42.954298 0.212007 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:43.166695 0.180477 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:43.347545 0.147188 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:43.495122 0.169973 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:43.665457 0.196058 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:43.861900 0.166621 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.028905 0.088396 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.117771 0.171725 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.289915 0.256628 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.546942 0.143188 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.690565 0.213685 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.904641 0.063779 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:44.968790 0.067771 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.036953 0.067343 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.104704 0.134898 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.240019 0.030191 udp 10.0.2.105 7010 <-> 79.219.125.193 2430 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.270667 0.323731 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.594806 0.358750 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:45.953969 0.130926 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.085295 0.235696 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.321368 0.046272 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.368020 0.175267 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.442240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 19:55:46.544977 0.155124 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.700469 0.202594 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:46.903424 0.562222 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:47.466002 0.363556 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:47.829978 0.285146 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:48.115584 0.351138 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:48.467105 0.220164 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:48.687730 0.053841 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:48.741960 0.103695 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:48.846047 0.169093 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:49.015547 0.115714 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:49.131625 0.376382 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/01 19:55:49.508425 0.105004 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:01:50.448493 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:01:57.455741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:02:05.457274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:02:21.460889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:02:53.466962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:09:04.482814 3.000991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:09:11.489920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:09:19.491094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:09:35.494415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:10:07.500579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:16:12.509008 3.000390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:16:19.515718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:16:27.517430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:16:29.700624 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 20:16:29.700805 0.988547 tcp 10.0.2.105 59727 -> 162.210.27.16 8808 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:16:43.519742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:17:15.525898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:23:20.534149 3.000733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:23:27.540495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:23:35.541946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:23:51.545093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:24:23.551224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:26:14.250662 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 20:26:14.250807 0.444360 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:14.695576 0.222554 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:14.918557 0.061250 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:14.980191 0.145507 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:15.126097 0.165025 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:15.291533 0.040256 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:15.332180 0.074149 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:15.406734 0.211284 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:15.618399 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:26:33.450860 0.031566 tcp 10.0.2.105 59728 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:33.482739 0.054410 tcp 10.0.2.105 59729 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:33.537461 0.147703 tcp 10.0.2.105 59730 -> 195.113.214.236 443 SRPA* 0 0 39 33404 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:33.685900 0.192080 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:33.878412 0.146664 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.025483 0.079693 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.105517 0.144625 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.250560 0.168385 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.419327 0.144611 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.564726 0.174907 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.740140 0.161268 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:34.901814 0.212126 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:35.114331 0.063979 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:35.178696 0.070722 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:35.249828 0.067839 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:35.318071 0.133626 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:35.452101 0.000000 udp 10.0.2.105 7010 -> 79.219.125.193 2430 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:26:54.368706 0.064413 tcp 10.0.2.105 59731 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:54.433489 0.052078 tcp 10.0.2.105 59732 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:54.485824 0.143926 tcp 10.0.2.105 59733 -> 195.113.214.236 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:26:54.630455 0.144897 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:54.775772 0.326231 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:55.102371 0.372480 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:55.475197 0.174131 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:26:55.649746 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:27:13.946827 0.051036 tcp 10.0.2.105 59734 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:13.998171 0.052570 tcp 10.0.2.105 59735 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:14.051029 0.138023 tcp 10.0.2.105 59736 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:14.189516 0.238590 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:14.428647 0.044154 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:14.473181 0.200658 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:14.674287 0.552639 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:15.227377 0.000000 udp 10.0.2.105 7010 -> 220.255.160.125 7213 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:27:34.216184 0.051529 tcp 10.0.2.105 59737 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:34.267984 0.053008 tcp 10.0.2.105 59738 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:34.321396 0.150652 tcp 10.0.2.105 59739 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:27:34.472562 0.216393 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:34.689346 0.053054 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:34.742782 0.258489 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:35.001685 0.370503 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:35.372627 0.120337 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:35.493352 0.179146 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:35.672905 0.108277 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:35.781617 0.374884 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:27:36.156954 0.103400 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:30:27.557767 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 20:30:34.565225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:30:42.566249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:30:58.569301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:31:30.575111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:37:34.581265 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:37:41.588527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:37:49.589900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:38:05.593164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:38:37.599171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:44:41.605441 3.004580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:44:48.612488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:44:56.613997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:45:12.617552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:45:44.623248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:46:30.690237 0.000219 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 20:46:30.690564 1.207604 tcp 10.0.2.105 59740 -> 162.210.27.16 8808 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:51:48.629470 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 20:51:55.636572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:52:03.638049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:52:19.641107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:52:51.647432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:57:51.658852 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 20:57:51.658971 0.181760 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:57:51.841159 0.000000 udp 10.0.2.105 7010 -> 79.219.125.193 2430 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:58:07.933868 0.054206 tcp 10.0.2.105 59741 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:07.988382 0.052110 tcp 10.0.2.105 59742 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:08.040744 0.144548 tcp 10.0.2.105 59743 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:08.186326 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:58:26.599440 0.050925 tcp 10.0.2.105 59744 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:26.650640 0.055165 tcp 10.0.2.105 59745 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:26.706066 0.146124 tcp 10.0.2.105 59746 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:26.852729 0.393935 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:27.247082 0.063516 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:27.311017 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 20:58:42.792505 0.051405 tcp 10.0.2.105 59747 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:42.844410 0.053051 tcp 10.0.2.105 59748 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:42.897753 0.147221 tcp 10.0.2.105 59749 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/01 20:58:43.045612 0.198500 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.244525 0.164411 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.409334 0.145438 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.555141 0.210585 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.766120 0.075291 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.841814 0.045071 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:43.887271 0.150201 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.037892 0.191585 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.229892 0.145625 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.375926 0.080613 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.456954 0.239650 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.697020 0.176517 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.873893 0.061982 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:44.936238 0.069467 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.006051 0.069718 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.076387 0.197767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.274539 0.145606 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.420641 0.211835 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.632903 0.132062 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.765330 0.137982 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:45.903691 0.328985 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:46.233056 0.172911 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:46.406415 0.362645 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:46.769468 2.974077 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:49.743923 0.047749 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:49.792035 0.240735 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:50.033180 0.203570 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:50.237133 0.213952 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:50.451477 0.055070 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:50.506955 0.359617 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:50.866920 0.172007 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:51.039323 0.118665 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:51.158366 0.370764 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:51.529522 0.099454 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:51.629349 0.356044 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:51.985805 0.106936 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/01 20:58:55.652763 3.002092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/01 20:59:02.660626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:59:10.662163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:59:26.665053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 20:59:58.671075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:06:11.680191 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:06:18.687509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:06:26.691571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:06:42.691957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:07:14.697960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:13:18.704225 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:13:25.711404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:13:33.713333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:13:49.716007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:14:21.721958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:16:31.899681 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 21:16:31.899920 0.900955 tcp 10.0.2.105 59750 -> 162.210.27.16 8808 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/01 21:20:25.728872 3.000659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:20:32.735614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:20:40.736965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:20:56.740115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:21:28.746346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:27:32.753097 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:27:39.759375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:27:47.760909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:28:03.763613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:28:35.770290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:29:04.481449 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 21:29:04.481590 0.223298 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:04.705333 0.181072 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:04.886798 0.000000 udp 10.0.2.105 7010 -> 220.255.160.125 7213 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/01 21:29:22.759102 0.053110 tcp 10.0.2.105 59751 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/01 21:29:22.812545 0.052487 tcp 10.0.2.105 59752 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/01 21:29:22.865390 0.149504 tcp 10.0.2.105 59753 -> 195.113.214.236 443 SRPA* 0 0 32 17246 flow=From-Botnet-V2-TCP-Established 1970/02/01 21:29:23.015128 0.063170 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.078692 0.202874 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.281980 0.164277 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.446717 0.134907 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.582068 0.211603 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.794020 0.073979 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.868476 0.045111 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:23.914024 0.140913 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.055355 0.186229 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.241976 0.144896 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.387252 0.083333 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.471033 0.159180 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.630632 0.173132 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.804169 0.061073 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.865617 0.069637 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.935643 0.063855 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:24.999925 0.168734 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:25.169123 0.143300 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:25.312793 0.215374 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:25.528678 0.131815 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:25.660888 0.137658 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:25.798964 0.360306 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:26.159703 0.363630 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:26.523733 0.176238 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:26.700353 0.540074 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.240757 0.047603 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.288737 0.240013 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.529164 0.200460 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.730083 0.216459 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.946955 0.052446 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:27.999793 0.191122 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:28.191362 0.369807 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:28.561565 0.098074 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:28.660036 0.371280 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:29.031687 0.117638 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:29.149675 0.204716 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:29:29.354840 0.121039 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:34:39.775868 3.065754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:34:46.812864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:34:54.794822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:35:10.797839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:35:42.803821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:41:46.809904 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:41:53.816983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:42:01.818627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:42:17.821829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:42:49.827658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:46:32.808942 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 21:46:32.809103 0.887116 tcp 10.0.2.105 59754 -> 162.210.27.16 8808 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/02/01 21:53:23.842179 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 21:53:30.849285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:53:38.850424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:53:54.874762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:54:26.879754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 21:59:33.320626 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 21:59:33.320796 0.375125 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:33.696346 0.225788 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:33.922594 0.180186 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.103155 0.065506 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.169008 0.203425 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.372857 0.164590 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.537861 0.154749 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.693040 0.211666 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.905086 0.067842 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:34.973327 0.039516 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.013243 0.144829 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.158531 0.080358 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.239264 0.183319 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.423005 0.177243 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.600625 0.061217 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.662397 0.071986 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.734749 0.064213 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.799308 0.185382 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:35.985116 0.147744 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.133236 0.167566 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.301194 0.144058 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.445738 0.210889 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.656984 0.137629 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.795051 0.131158 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:36.926642 0.175544 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:37.102606 0.361015 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:37.464073 0.326151 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:37.790630 2.580626 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:40.371660 0.045446 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:40.417487 0.241937 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:40.659864 0.200648 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:40.860912 0.217771 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:41.079060 0.053314 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:41.132826 0.111459 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:41.244663 0.357957 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:41.603085 0.230291 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:41.833765 0.371767 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:42.205910 0.100391 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:42.306718 0.119530 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/01 21:59:42.426637 0.167827 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:00:30.885933 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:00:37.892860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:00:45.894807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:01:01.897971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:01:33.904072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:07:37.909514 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:07:44.917234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:07:52.918982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:08:08.922082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:08:40.927350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:14:44.933866 3.001223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:14:51.941462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:14:59.943146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:15:15.946032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:15:47.952027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:16:33.698080 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 22:16:33.698251 0.875896 tcp 10.0.2.105 59755 -> 162.210.27.16 8808 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/01 22:21:51.957655 3.001495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:21:58.965768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:22:06.966864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:22:22.970597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:22:54.976022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:28:58.981094 3.002471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:29:05.989654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:29:13.990875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:29:29.993827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:30:01.999691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:30:04.203403 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 22:30:04.203516 0.396217 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:04.600105 0.060921 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:04.661404 0.206869 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:04.868671 0.165036 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.034102 0.150217 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.184726 0.210623 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.395772 0.216101 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.612332 0.179749 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.792476 0.071705 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.864582 0.045593 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:05.910564 0.145831 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.056800 0.081160 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.138426 0.160815 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.299655 0.174043 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.474157 0.060561 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.535118 0.066301 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.601865 0.066934 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.669208 0.188197 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:06.857816 0.144139 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.002472 0.166591 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.169442 0.144151 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.314019 0.212297 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.526687 0.134135 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.661204 0.123897 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.785482 0.175723 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:07.961576 0.357682 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:08.325086 0.318392 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:08.643927 0.236584 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:08.880867 0.715037 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:09.596308 0.044297 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:09.641051 0.203602 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:09.845025 0.219063 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.064496 0.055044 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.120024 0.099906 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.220438 0.386824 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.607630 0.192234 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.800320 0.107097 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:10.907835 0.333299 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:11.241515 0.372367 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:30:11.614276 0.114477 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/01 22:36:06.005509 3.013474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:36:13.023204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:36:21.024873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:36:37.027301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:37:09.033614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:43:13.040981 3.000426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:43:20.047040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:43:28.048517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:43:44.051684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:44:16.057783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:46:34.577791 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 22:46:34.577970 0.951399 tcp 10.0.2.105 59756 -> 162.210.27.16 8808 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/01 22:54:07.069759 3.002231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 22:54:14.077128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:54:22.078900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:54:38.082000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 22:55:10.088113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:00:29.668036 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 23:00:29.668153 1.071556 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:30.740197 0.164597 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:30.905188 0.376091 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:31.281700 0.058445 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:31.340568 0.153487 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:31.494424 0.212267 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:31.707103 0.213985 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:31.921445 0.182468 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.104407 0.085051 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.189869 0.045361 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.235646 0.149372 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.385407 0.176257 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.562067 0.064253 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.626729 0.071000 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.698184 0.067942 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.766553 0.188843 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:32.955729 0.142782 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.098905 0.083051 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.182482 0.162553 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.345408 0.168319 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.514147 0.142329 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.656863 0.211873 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:33.869169 0.132638 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:34.002148 0.144630 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:34.147139 0.174651 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:34.322214 0.243722 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:34.566320 0.362997 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:34.929724 0.328804 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:35.258932 2.745441 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.004739 0.051080 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.056186 0.202133 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.258740 0.217696 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.476854 0.056107 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.533358 0.208316 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.742094 0.105009 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.847478 0.103541 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:38.951421 1.412494 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:40.364328 0.117675 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:40.482451 0.243851 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:00:40.726714 0.374108 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:01:14.094402 3.001341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:01:21.101556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:01:29.103326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:01:45.106164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:02:17.112034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:08:21.118125 3.001723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:08:28.125563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:08:36.126838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:08:52.129800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:09:24.136033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:15:28.143109 3.000698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:15:35.149542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:15:43.151489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:15:59.154380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:16:31.159912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:16:35.537086 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 23:16:35.537199 0.804196 tcp 10.0.2.105 59757 -> 162.210.27.16 8808 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/02/01 23:22:35.166626 3.066612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:22:42.212462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:22:50.184901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:23:06.190112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:23:38.194015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:29:42.199825 3.001717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:29:49.207441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:29:57.208943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:30:13.212004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:30:45.221467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:30:45.481957 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 23:30:45.482114 0.393756 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:45.876660 0.197355 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.074393 0.165168 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.240020 0.211423 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.451895 0.238720 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.691012 0.066030 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.757507 0.145382 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:46.903282 0.182244 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.086004 0.074516 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.160912 0.040062 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.201445 0.150362 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.352200 0.175150 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.527721 0.062860 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.591003 0.069777 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.661129 0.143568 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.805136 0.078611 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:47.884142 0.325475 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:48.210114 0.066864 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:48.277316 0.191295 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:48.469080 0.171440 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:48.640949 0.144565 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:48.785995 0.213711 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:49.000116 0.133941 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:49.134467 0.130542 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:49.265378 0.175122 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:49.440891 0.237661 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:49.678906 0.371279 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:50.050654 0.326795 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:50.377823 0.205469 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:50.583731 2.582870 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.166966 0.046202 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.213554 0.216759 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.430706 0.053766 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.484879 0.296898 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.782112 0.100863 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.883391 0.114393 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:53.998135 0.180722 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:54.179300 0.372930 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:54.552640 0.117760 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:30:54.670808 0.374697 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/01 23:36:49.224165 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:36:56.231352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:37:04.232787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:37:20.235458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:37:52.241773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:43:56.247693 3.001916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:44:03.255478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:44:11.256884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:44:27.259902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:44:59.265955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:46:36.345748 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/01 23:46:36.345940 0.930162 tcp 10.0.2.105 59758 -> 162.210.27.16 8808 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/01 23:54:30.279520 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/01 23:54:37.287028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:54:45.289006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:55:01.291140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/01 23:55:33.297453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:01:04.954943 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 00:01:04.955113 0.367636 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:05.323163 0.204139 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:05.527681 0.220865 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:05.748991 0.064465 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:05.813838 0.140084 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:05.954338 0.182308 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.137131 0.165296 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.302829 0.211644 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.514892 0.064836 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.580160 0.040153 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.620756 0.140215 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.761387 0.171866 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:06.933634 0.072038 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.006108 0.069487 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.076002 0.146191 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.222595 0.080578 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.303542 0.163158 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.467169 0.069774 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.537341 0.203335 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.741036 0.168733 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:07.910166 0.143226 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:08.053752 0.214119 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:08.268355 0.173458 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:08.442221 0.235074 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:08.677653 0.357851 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:09.035945 0.132793 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:09.169199 0.131219 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:09.300834 0.440578 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:09.741828 0.205272 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:09.947521 0.546180 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:10.494126 0.046986 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:10.541518 0.219746 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:10.761675 0.056963 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:10.819062 0.254547 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:11.074006 0.104353 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:11.178791 0.103977 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:11.283186 0.112479 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:11.396070 0.371099 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:11.767549 0.248838 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:12.020425 0.373230 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:01:37.304292 3.000977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:01:44.311204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:01:52.312618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:02:08.315626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:02:40.321581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:08:44.327284 3.001892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:08:51.335156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:08:59.336473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:09:15.339286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:09:47.345350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:15:51.350998 3.002174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:15:58.358916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:16:06.360697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:16:22.363438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:16:37.278199 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 00:16:37.278376 0.870946 tcp 10.0.2.105 59759 -> 162.210.27.16 8808 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/02/02 00:16:54.369171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:22:58.376471 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:23:05.382898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:23:13.384618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:23:29.387537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:24:01.393507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:30:05.406840 2.997742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:30:12.406850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:30:20.408388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:30:36.411235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:31:08.417462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:31:29.788937 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 00:31:29.789025 0.397217 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:30.186679 0.063841 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:30.250953 0.154994 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:30.406328 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 00:31:45.623081 0.052451 tcp 10.0.2.105 59760 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 00:31:45.675845 0.052045 tcp 10.0.2.105 59761 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 00:31:45.728200 0.128630 tcp 10.0.2.105 59762 -> 195.113.214.236 443 SRPA* 0 0 63 42057 flow=From-Botnet-V2-TCP-Established 1970/02/02 00:31:45.857432 0.968704 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:46.826595 0.276744 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.103708 0.166545 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.270714 0.211204 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.482328 0.072941 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.555647 0.039861 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.595884 0.148008 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.744249 0.176487 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:47.921107 0.144360 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.065858 0.078528 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.144804 0.256849 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.402074 0.071895 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.474369 0.191230 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.666005 0.059581 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.725940 0.072138 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.798484 0.168991 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:48.967882 0.144833 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:49.113118 0.214544 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:49.328035 0.176352 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:49.504480 0.236139 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:49.740994 0.137979 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:49.879379 0.377418 udp 10.0.2.105 7010 <-> 210.186.56.74 1336 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:50.257239 0.132479 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:50.390118 0.608811 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:50.999325 0.045821 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:51.045561 0.376022 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:51.421984 0.200870 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:51.623287 0.219784 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:51.843507 0.053855 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:51.897782 0.223618 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:52.121815 0.768211 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:52.890420 0.101096 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:52.991962 0.109609 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:53.101971 0.359518 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:53.461914 0.370840 udp 10.0.2.105 7010 <-> 112.120.19.53 1809 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:31:53.833178 0.282084 udp 10.0.2.105 7010 <-> 74.196.216.197 9202 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/02 00:37:12.423435 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:37:19.430552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:37:27.432662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:37:43.435269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:38:15.441676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:44:19.448223 3.000793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:44:26.454695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:44:34.456451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:44:50.459382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:45:22.465376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:46:38.154928 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 00:46:38.155040 0.941078 tcp 10.0.2.105 59763 -> 162.210.27.16 8808 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/02/02 00:54:37.475915 3.063889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 00:54:44.515827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:54:52.494669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:55:08.497891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 00:55:40.503851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:01:44.510092 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:01:51.517413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:01:55.413899 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 01:01:55.414002 0.180813 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:55.595224 0.057163 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:55.652836 0.388159 udp 10.0.2.105 7010 <-> 220.255.160.125 7213 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:56.041390 0.139192 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:56.181002 0.582300 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:56.763761 0.222257 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:56.986428 0.165331 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.152108 0.212243 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.364821 0.066359 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.431597 0.044516 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.476544 0.139566 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.616650 0.174936 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.792177 0.144919 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:57.937464 0.083178 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.021077 0.163714 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.185234 0.064545 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.250196 0.181424 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.432070 0.063898 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.496394 0.073856 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.570613 0.168754 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.739778 0.144116 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:58.884278 0.239775 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:59.124418 0.131091 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:59.255874 0.211578 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:59.467839 0.175832 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:01:59.520017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:01:59.644105 0.541576 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:00.186039 0.046543 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:00.232953 0.000000 udp 10.0.2.105 7010 -> 210.186.56.74 1336 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:02:15.522205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:02:18.367681 0.052525 tcp 10.0.2.105 59764 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:18.420499 0.056618 tcp 10.0.2.105 59765 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:18.477395 0.164601 tcp 10.0.2.105 59766 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:18.642523 0.131922 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:18.774841 0.318232 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.093499 0.205071 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.298982 0.216847 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.516483 0.052483 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.569387 0.293705 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.863496 0.105176 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:19.969024 0.103058 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:20.072519 0.102494 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:20.175426 0.000000 udp 10.0.2.105 7010 -> 74.196.216.197 9202 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:02:38.668065 0.052144 tcp 10.0.2.105 59767 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:38.720483 0.054329 tcp 10.0.2.105 59768 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:38.775102 0.171265 tcp 10.0.2.105 59769 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:38.947034 0.351298 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:02:39.298770 0.000000 udp 10.0.2.105 7010 -> 112.120.19.53 1809 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:02:47.533584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:02:56.019954 0.052256 tcp 10.0.2.105 59770 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:56.072493 0.055011 tcp 10.0.2.105 59771 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:02:56.127769 0.156634 tcp 10.0.2.105 59772 -> 195.113.214.236 443 SRPA* 0 0 33 18094 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:08:51.534120 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:08:58.541203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:09:06.542945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:09:22.546129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:09:54.551763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:15:58.558128 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:16:05.565163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:16:13.566858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:16:29.569778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:16:39.103923 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 01:16:39.104118 0.893268 tcp 10.0.2.105 59773 -> 162.210.27.16 8808 FSPA* 0 0 14 1597 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:17:01.575925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:23:05.582628 3.000899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:23:12.589682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:23:20.590798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:23:36.593770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:24:08.599787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:30:12.607533 3.007200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:30:19.613304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:30:27.614801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:30:43.618764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:31:15.624818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:32:57.029350 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 01:32:57.029520 0.000000 udp 10.0.2.105 7010 -> 210.186.56.74 1336 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:33:14.846621 0.052538 tcp 10.0.2.105 59774 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:14.899514 0.052429 tcp 10.0.2.105 59775 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:14.952189 0.153103 tcp 10.0.2.105 59776 -> 195.113.214.236 443 SRPA* 0 0 35 19034 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:15.106108 0.000000 udp 10.0.2.105 7010 -> 112.120.19.53 1809 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:33:31.229423 0.050764 tcp 10.0.2.105 59777 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:31.280471 0.054311 tcp 10.0.2.105 59778 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:31.335114 0.169607 tcp 10.0.2.105 59779 -> 195.113.214.236 443 SRPA* 0 0 33 19362 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:31.505325 0.000000 udp 10.0.2.105 7010 -> 74.196.216.197 9202 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:33:47.754316 0.051390 tcp 10.0.2.105 59780 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:47.805995 0.052504 tcp 10.0.2.105 59781 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:47.858774 0.153728 tcp 10.0.2.105 59782 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:33:48.013046 0.134332 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:33:48.147795 0.000000 udp 10.0.2.105 7010 -> 220.255.160.125 7213 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 01:34:04.748147 0.051064 tcp 10.0.2.105 59783 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:34:04.799489 0.052425 tcp 10.0.2.105 59784 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:34:04.852173 0.150023 tcp 10.0.2.105 59785 -> 195.113.214.236 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:34:05.002360 0.056412 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.059221 0.180318 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.239879 0.202181 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.442488 0.072901 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.515786 0.045323 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.561560 0.139373 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.701314 0.170868 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:05.872743 0.144018 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.017181 0.082053 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.099661 0.164431 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.264528 0.068342 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.333278 0.246849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.580670 0.162980 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.744042 0.212221 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:06.956629 0.069870 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.026877 0.241058 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.268275 0.124167 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.392853 0.213353 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.606631 0.174997 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.781986 0.185883 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:07.968303 0.060901 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:08.029678 0.170848 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:08.200914 0.146287 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:08.347558 0.057562 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:08.405498 4.925147 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:13.331061 0.216741 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:13.548236 0.054958 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:13.603577 0.323582 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:13.927514 0.134995 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.062946 0.203170 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.266466 0.100271 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.367137 0.161876 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.529418 0.208899 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.738703 0.102571 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:34:14.841707 0.376824 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/02 01:37:19.629387 3.001976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 01:37:26.637249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:37:34.639127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:37:50.641997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:38:22.647861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:44:26.653853 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:44:33.661340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:44:41.662735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:44:57.665882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:45:29.671498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:46:40.003509 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 01:46:40.003624 0.885352 tcp 10.0.2.105 59786 -> 162.210.27.16 8808 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/02/02 01:54:41.678485 3.001267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 01:54:48.685209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:54:56.686861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:55:12.689806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 01:55:44.696204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:01:48.701771 3.001803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 02:01:55.709372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:02:03.711081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:02:19.713857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:02:51.720004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:04:33.366523 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:04:33.366712 0.000000 udp 10.0.2.105 7010 -> 220.255.160.125 7213 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 02:04:50.492356 0.056482 tcp 10.0.2.105 59787 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:04:50.549098 0.053856 tcp 10.0.2.105 59788 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:04:50.603259 0.149373 tcp 10.0.2.105 59789 -> 195.113.214.236 443 SRPA* 0 0 47 41046 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:04:50.753161 0.150236 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:50.903795 0.061103 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:50.965349 0.182296 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:51.148089 0.639145 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:51.787609 0.068981 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:51.856950 0.046077 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:51.903434 0.148177 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.052031 0.172847 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.225344 0.147052 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.372790 0.085188 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.458445 0.216022 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.674865 0.165155 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:52.840575 0.212276 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.053322 0.069599 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.123305 0.165685 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.289407 0.067625 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.357399 0.238148 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.595925 0.124249 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.720564 0.211504 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:53.932593 0.172649 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.105610 0.191581 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.297551 0.063815 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.361784 0.044863 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.407061 0.168799 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.576263 0.143696 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:54.720390 3.053888 udp 10.0.2.105 7010 <-> 172.162.109.59 7488 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:57.774733 0.213459 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:57.988661 0.058086 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.047171 0.321543 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.369129 0.131077 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.500588 0.112372 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.613360 0.250320 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.864143 0.101582 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:58.966128 0.201958 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:59.168500 0.108665 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:04:59.277521 0.355111 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:08:56.727333 3.001721 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 02:09:03.735091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:09:11.736543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:09:27.739312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:09:59.745789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:16:03.751576 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 02:16:10.758973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:16:18.760083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:16:34.763286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:16:40.891964 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:16:40.892125 3.004008 tcp 10.0.2.105 59790 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:16:49.894995 0.000000 tcp 10.0.2.105 59790 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:16:54.178165 0.009621 udp 10.0.2.105 51725 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/02/02 02:16:54.188263 0.009816 udp 10.0.2.105 62628 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/02/02 02:16:55.895345 0.060103 tcp 10.0.2.105 59791 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:16:55.955773 0.055943 tcp 10.0.2.105 59792 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:16:56.012000 0.147625 tcp 10.0.2.105 59793 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:16:56.199588 2.998469 tcp 10.0.2.105 59794 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:05.207148 0.000000 tcp 10.0.2.105 59794 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:06.769300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:17:11.196121 0.053186 tcp 10.0.2.105 59795 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:11.249630 0.057431 tcp 10.0.2.105 59796 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:11.307418 0.155319 tcp 10.0.2.105 59797 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:11.529537 2.990815 tcp 10.0.2.105 59798 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:20.518927 0.000000 tcp 10.0.2.105 59798 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:26.527977 0.053282 tcp 10.0.2.105 59799 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:26.581552 0.052725 tcp 10.0.2.105 59800 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:26.634570 0.168385 tcp 10.0.2.105 59801 -> 195.113.214.236 443 SRPA* 0 0 25 14790 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:26.846307 2.995979 tcp 10.0.2.105 59802 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:35.840916 0.000000 tcp 10.0.2.105 59802 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:41.839904 0.052927 tcp 10.0.2.105 59803 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:41.893207 0.060980 tcp 10.0.2.105 59804 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:41.954066 0.168708 tcp 10.0.2.105 59805 -> 195.113.214.236 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:42.241822 3.002689 tcp 10.0.2.105 59806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:51.243198 0.000000 tcp 10.0.2.105 59806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:17:57.242423 0.054415 tcp 10.0.2.105 59807 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:57.297150 0.104186 tcp 10.0.2.105 59808 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:57.401632 0.162985 tcp 10.0.2.105 59809 -> 195.113.214.236 443 SRPA* 0 0 33 24666 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:17:57.588588 3.007983 tcp 10.0.2.105 59810 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:06.595081 0.000000 tcp 10.0.2.105 59810 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:12.583903 2.994375 tcp 10.0.2.105 59811 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:21.589250 0.000000 tcp 10.0.2.105 59811 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:26.574096 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:18:27.585709 2.993886 tcp 10.0.2.105 59812 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:36.578588 0.000000 tcp 10.0.2.105 59812 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:42.587318 3.004143 tcp 10.0.2.105 59813 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:50.578724 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:18:51.589953 0.000000 tcp 10.0.2.105 59813 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:18:57.588747 3.004276 tcp 10.0.2.105 59814 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:19:06.591598 0.000000 tcp 10.0.2.105 59814 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:23:10.776060 3.004431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 02:23:17.782536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:23:25.784161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:23:41.786829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:24:12.591899 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:24:12.591988 3.003693 tcp 10.0.2.105 59815 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:13.794770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:24:21.594800 0.000000 tcp 10.0.2.105 59815 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:27.594931 0.053425 tcp 10.0.2.105 59816 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:27.648655 0.053145 tcp 10.0.2.105 59817 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:27.702085 0.153525 tcp 10.0.2.105 59818 -> 195.113.214.236 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:27.991290 2.996549 tcp 10.0.2.105 59819 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:36.996195 0.000000 tcp 10.0.2.105 59819 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:42.986507 0.050958 tcp 10.0.2.105 59820 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:43.037751 0.052451 tcp 10.0.2.105 59821 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:43.090499 0.144351 tcp 10.0.2.105 59822 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:43.401387 2.998095 tcp 10.0.2.105 59823 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:52.398170 0.000000 tcp 10.0.2.105 59823 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:24:58.397783 0.052238 tcp 10.0.2.105 59824 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:58.450446 0.077331 tcp 10.0.2.105 59825 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:58.528050 0.157088 tcp 10.0.2.105 59826 -> 195.113.214.236 443 SRPA* 0 0 42 37026 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:24:58.721719 3.000747 tcp 10.0.2.105 59827 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:07.720770 0.000000 tcp 10.0.2.105 59827 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:13.719919 0.051346 tcp 10.0.2.105 59828 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:13.771510 0.053839 tcp 10.0.2.105 59829 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:13.825652 0.148402 tcp 10.0.2.105 59830 -> 195.113.214.236 443 SRPA* 0 0 45 41170 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:14.015016 2.999047 tcp 10.0.2.105 59831 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:23.012398 0.000000 tcp 10.0.2.105 59831 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:29.011963 0.052616 tcp 10.0.2.105 59832 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:29.064942 0.055528 tcp 10.0.2.105 59833 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:29.120728 0.147759 tcp 10.0.2.105 59834 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:25:29.545272 3.001422 tcp 10.0.2.105 59835 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:38.545157 0.000000 tcp 10.0.2.105 59835 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:44.543853 2.994028 tcp 10.0.2.105 59836 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:53.546762 0.000000 tcp 10.0.2.105 59836 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:25:58.083220 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:25:59.545299 2.994191 tcp 10.0.2.105 59837 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:26:08.538020 0.000000 tcp 10.0.2.105 59837 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:26:14.547020 2.993851 tcp 10.0.2.105 59838 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:26:22.077118 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:26:23.539751 0.000000 tcp 10.0.2.105 59838 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:26:29.548888 3.003990 tcp 10.0.2.105 59839 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:26:38.551437 0.000000 tcp 10.0.2.105 59839 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:30:17.799617 3.002529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 02:30:24.806626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:30:32.807848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:30:48.813153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:31:20.817236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:31:44.551814 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:31:44.551958 3.003531 tcp 10.0.2.105 59840 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:31:53.554211 0.000000 tcp 10.0.2.105 59840 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:31:59.554743 0.052107 tcp 10.0.2.105 59841 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:31:59.607166 0.067662 tcp 10.0.2.105 59842 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:31:59.675087 0.172294 tcp 10.0.2.105 59843 -> 195.113.214.236 443 SRPA* 0 0 26 13660 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:31:59.976899 2.990954 tcp 10.0.2.105 59844 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:08.976461 0.000000 tcp 10.0.2.105 59844 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:14.975884 0.053374 tcp 10.0.2.105 59845 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:15.029506 0.053654 tcp 10.0.2.105 59846 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:15.083471 0.162410 tcp 10.0.2.105 59847 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:15.284962 2.994786 tcp 10.0.2.105 59848 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:24.278644 0.000000 tcp 10.0.2.105 59848 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:30.277752 0.051884 tcp 10.0.2.105 59849 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:30.329888 0.053314 tcp 10.0.2.105 59850 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:30.383541 0.142553 tcp 10.0.2.105 59851 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:32:30.544094 2.997660 tcp 10.0.2.105 59852 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:39.540167 0.000000 tcp 10.0.2.105 59852 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:45.539353 3.006096 tcp 10.0.2.105 59853 -> 59.99.73.142 9022 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:54.542156 0.000000 tcp 10.0.2.105 59853 -> 59.99.73.142 9022 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:32:59.078095 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:33:00.540618 3.004054 tcp 10.0.2.105 59854 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:33:09.543316 0.000000 tcp 10.0.2.105 59854 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:35:00.092688 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:35:00.092825 0.248283 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:00.333083 0.604227 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:00.891021 0.267641 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.137733 0.066735 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.269297 0.141162 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.406147 0.080387 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.552809 0.141105 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.769741 0.212929 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:01.945582 0.169396 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.091206 0.105521 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.243656 0.256157 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.466117 0.174499 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.634019 0.234581 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.845113 0.108852 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:02.917264 0.211172 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:03.193446 0.088502 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:03.264301 0.244144 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:03.589806 0.138986 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:03.829588 0.235601 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.042599 0.202642 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.221028 0.206296 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.502631 0.079485 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.563233 0.068338 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.687199 0.172730 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:04.856348 0.170368 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:05.002975 0.074750 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:05.106730 0.000000 udp 10.0.2.105 7010 -> 172.162.109.59 7488 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 02:35:21.502899 0.659785 udp 10.0.2.105 7010 <- 172.162.109.59 7488 RSP 0 0 5 2130 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 02:35:21.503382 0.225435 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:21.721380 0.377691 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:22.070043 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 02:35:26.079786 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:35:38.289034 0.052055 tcp 10.0.2.105 59855 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:35:38.341367 0.059102 tcp 10.0.2.105 59856 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:35:38.400856 0.151122 tcp 10.0.2.105 59857 -> 195.113.214.236 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:35:38.552603 0.154340 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:38.668936 0.222243 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:38.888475 0.109753 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:38.991544 0.213187 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:39.197139 0.163882 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:35:39.306294 0.399632 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/02 02:37:24.823457 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 02:37:31.830250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:37:39.832496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:37:55.835223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:38:15.543812 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:38:15.543890 2.993736 tcp 10.0.2.105 59858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:38:24.546478 0.000000 tcp 10.0.2.105 59858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:38:27.841154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:38:30.545853 0.052533 tcp 10.0.2.105 59859 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:30.598630 0.053119 tcp 10.0.2.105 59860 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:30.652033 0.153924 tcp 10.0.2.105 59861 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:31.152042 2.997593 tcp 10.0.2.105 59862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:38:40.148928 0.000000 tcp 10.0.2.105 59862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:38:46.149200 0.052796 tcp 10.0.2.105 59863 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:46.202274 0.052059 tcp 10.0.2.105 59864 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:46.254617 0.147579 tcp 10.0.2.105 59865 -> 195.113.214.236 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:38:46.411375 3.000634 tcp 10.0.2.105 59866 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:38:55.410490 0.000000 tcp 10.0.2.105 59866 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:01.409914 0.065118 tcp 10.0.2.105 59867 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:01.475330 0.053673 tcp 10.0.2.105 59868 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:01.529294 0.164599 tcp 10.0.2.105 59869 -> 195.113.214.236 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:01.705658 2.998226 tcp 10.0.2.105 59870 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:10.703034 0.000000 tcp 10.0.2.105 59870 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:16.701732 0.052158 tcp 10.0.2.105 59871 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:16.754233 0.053410 tcp 10.0.2.105 59872 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:16.807905 0.169890 tcp 10.0.2.105 59873 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:39:16.997178 3.009008 tcp 10.0.2.105 59874 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:26.004709 0.000000 tcp 10.0.2.105 59874 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:31.993423 3.004263 tcp 10.0.2.105 59875 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:41.006465 0.000000 tcp 10.0.2.105 59875 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:45.583016 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:39:46.995116 2.994112 tcp 10.0.2.105 59876 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:39:55.988673 0.000000 tcp 10.0.2.105 59876 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:40:01.996140 2.993972 tcp 10.0.2.105 59877 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:40:09.577464 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:40:10.989079 0.000000 tcp 10.0.2.105 59877 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:44:31.847590 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 02:44:38.854468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:44:46.855782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:45:02.858886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:45:16.999335 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:45:16.999478 3.004328 tcp 10.0.2.105 59878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:45:26.002200 0.000000 tcp 10.0.2.105 59878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:45:32.002593 0.054788 tcp 10.0.2.105 59879 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:32.057700 0.055348 tcp 10.0.2.105 59880 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:32.113316 0.150584 tcp 10.0.2.105 59881 -> 195.113.214.236 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:32.321241 3.004499 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:45:34.865141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:45:41.324544 0.000000 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:45:47.313312 0.051806 tcp 10.0.2.105 59883 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:47.365422 0.052383 tcp 10.0.2.105 59884 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:47.418104 0.147472 tcp 10.0.2.105 59885 -> 195.113.214.236 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:45:47.651003 2.996732 tcp 10.0.2.105 59886 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:45:56.658789 0.000000 tcp 10.0.2.105 59886 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:02.650078 0.053894 tcp 10.0.2.105 59887 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:46:02.704437 0.054374 tcp 10.0.2.105 59888 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:46:02.759198 0.146097 tcp 10.0.2.105 59889 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:46:02.930297 2.989384 tcp 10.0.2.105 59890 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:11.918068 0.000000 tcp 10.0.2.105 59890 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:17.926508 3.004725 tcp 10.0.2.105 59891 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:26.929674 0.000000 tcp 10.0.2.105 59891 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:31.576439 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:46:32.928936 3.004119 tcp 10.0.2.105 59892 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:46:41.932178 0.000000 tcp 10.0.2.105 59892 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:51:47.932135 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:51:47.932373 3.003255 tcp 10.0.2.105 59893 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:51:56.934663 0.000000 tcp 10.0.2.105 59893 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:02.942010 0.055312 tcp 10.0.2.105 59894 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:02.997647 0.052086 tcp 10.0.2.105 59895 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:03.050082 0.149224 tcp 10.0.2.105 59896 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:03.410789 2.987362 tcp 10.0.2.105 59897 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:12.406459 0.000000 tcp 10.0.2.105 59897 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:18.406038 0.054119 tcp 10.0.2.105 59898 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:18.460615 0.121002 tcp 10.0.2.105 59899 -> 195.113.214.236 80 SRPA* 0 0 18 13404 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:18.683994 2.995818 tcp 10.0.2.105 59900 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:27.678622 0.000000 tcp 10.0.2.105 59900 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:33.677968 0.054155 tcp 10.0.2.105 59901 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:33.731990 0.055444 tcp 10.0.2.105 59902 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:33.787742 0.153004 tcp 10.0.2.105 59903 -> 195.113.214.236 443 SRPA* 0 0 21 13070 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:52:33.954052 2.997991 tcp 10.0.2.105 59904 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:42.950633 0.000000 tcp 10.0.2.105 59904 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:48.951020 3.002524 tcp 10.0.2.105 59905 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:52:57.951968 0.000000 tcp 10.0.2.105 59905 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:53:02.578623 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:53:03.950803 3.004283 tcp 10.0.2.105 59906 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:53:12.953518 0.000000 tcp 10.0.2.105 59906 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:54:44.878982 3.003211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 02:54:51.885893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:54:59.887494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:55:15.890575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:55:47.896601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 02:58:18.953566 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:58:18.953705 2.994524 tcp 10.0.2.105 59907 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:58:27.956692 0.000000 tcp 10.0.2.105 59907 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:58:33.957239 0.053681 tcp 10.0.2.105 59908 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:34.011173 0.053857 tcp 10.0.2.105 59909 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:34.065291 0.141572 tcp 10.0.2.105 59910 -> 195.113.214.236 443 SRPA* 0 0 33 19362 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:34.217176 3.002290 tcp 10.0.2.105 59911 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:58:43.218360 0.000000 tcp 10.0.2.105 59911 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:58:49.219796 0.054986 tcp 10.0.2.105 59912 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:49.275117 0.057109 tcp 10.0.2.105 59913 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:49.332511 0.153819 tcp 10.0.2.105 59914 -> 195.113.214.236 443 SRPA* 0 0 38 29178 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:58:49.496606 2.995415 tcp 10.0.2.105 59915 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:58:58.490612 0.000000 tcp 10.0.2.105 59915 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:04.489621 0.057456 tcp 10.0.2.105 59916 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:59:04.547374 0.052414 tcp 10.0.2.105 59917 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:59:04.600096 0.151668 tcp 10.0.2.105 59918 -> 195.113.214.236 443 SRPA* 0 0 67 46676 flow=From-Botnet-V2-TCP-Established 1970/02/02 02:59:04.763383 3.000460 tcp 10.0.2.105 59919 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:13.763111 0.000000 tcp 10.0.2.105 59919 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:19.761480 3.003761 tcp 10.0.2.105 59920 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:28.763874 0.000000 tcp 10.0.2.105 59920 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:33.581089 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 02:59:34.763360 3.003467 tcp 10.0.2.105 59921 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 02:59:43.765991 0.000000 tcp 10.0.2.105 59921 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:01:51.902740 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:01:58.909847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:02:06.911413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:02:22.914318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:02:54.920538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:05:48.680548 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:05:48.680741 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 03:06:07.439256 0.053391 tcp 10.0.2.105 59922 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:07.492941 0.055738 tcp 10.0.2.105 59923 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:07.548969 0.166403 tcp 10.0.2.105 59924 -> 195.113.214.236 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:07.715903 0.092366 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:07.788473 0.189282 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:07.970457 1.150262 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.075327 0.078375 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.139377 0.165519 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.314734 0.210033 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.490567 0.171767 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.637271 0.060429 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.679439 0.142493 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.817724 0.174470 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:09.985071 0.237175 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:10.198623 0.107572 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:10.269936 0.309556 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2585 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:10.526666 0.261021 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:10.751248 0.102433 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:10.863173 0.152691 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.033669 0.236523 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.248957 0.241862 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.489250 0.090519 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.561180 0.076487 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.622086 0.052791 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.697902 0.175645 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:11.870063 0.169837 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:12.111744 0.098853 udp 10.0.2.105 7010 <-> 81.157.188.67 4637 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:12.196711 0.199946 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:12.374178 0.204697 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:12.572988 0.352848 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:12.895239 0.221730 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:13.109375 0.000000 udp 10.0.2.105 7010 -> 172.162.109.59 7488 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 03:06:19.775356 2.993863 tcp 10.0.2.105 59925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:06:28.307818 0.051904 tcp 10.0.2.105 59926 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:28.360004 0.056838 tcp 10.0.2.105 59927 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:28.417140 0.149075 tcp 10.0.2.105 59928 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:28.566690 0.113829 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:28.675967 0.159179 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:28.767847 0.000000 tcp 10.0.2.105 59925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:06:28.799263 0.344357 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:29.140769 0.397162 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:29.499574 0.215336 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:29.707142 0.161019 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:06:34.776949 0.055635 tcp 10.0.2.105 59929 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:34.832918 0.055551 tcp 10.0.2.105 59930 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:34.888761 0.172572 tcp 10.0.2.105 59931 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:35.083864 2.997450 tcp 10.0.2.105 59932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:06:44.079959 0.000000 tcp 10.0.2.105 59932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:06:50.078717 0.056532 tcp 10.0.2.105 59933 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:50.135616 0.059482 tcp 10.0.2.105 59934 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:50.195445 0.161822 tcp 10.0.2.105 59935 -> 195.113.214.236 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:06:50.377898 2.995401 tcp 10.0.2.105 59936 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:06:59.372182 0.000000 tcp 10.0.2.105 59936 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:05.371300 0.052638 tcp 10.0.2.105 59937 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:07:05.424295 0.052290 tcp 10.0.2.105 59938 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:07:05.476873 0.149922 tcp 10.0.2.105 59939 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:07:05.645496 3.000061 tcp 10.0.2.105 59940 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:14.643934 0.000000 tcp 10.0.2.105 59940 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:20.642912 3.004053 tcp 10.0.2.105 59941 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:29.645522 0.000000 tcp 10.0.2.105 59941 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:34.582642 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:07:35.644146 2.994728 tcp 10.0.2.105 59942 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:07:44.647100 0.000000 tcp 10.0.2.105 59942 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:09:00.930016 3.000473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:09:07.936350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:09:15.938242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:09:31.941301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:10:03.946895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:12:50.647486 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:12:50.647635 3.003798 tcp 10.0.2.105 59943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:12:59.649941 0.000000 tcp 10.0.2.105 59943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:05.650695 0.052971 tcp 10.0.2.105 59944 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:05.704004 0.055480 tcp 10.0.2.105 59945 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:05.759792 0.156328 tcp 10.0.2.105 59946 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:05.932787 3.000553 tcp 10.0.2.105 59947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:14.931801 0.000000 tcp 10.0.2.105 59947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:20.931187 0.106019 tcp 10.0.2.105 59948 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:21.037494 0.053924 tcp 10.0.2.105 59949 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:21.091708 0.145013 tcp 10.0.2.105 59950 -> 195.113.214.236 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:21.260524 3.004520 tcp 10.0.2.105 59951 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:30.263908 0.000000 tcp 10.0.2.105 59951 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:36.253560 0.052282 tcp 10.0.2.105 59952 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:36.306157 0.055372 tcp 10.0.2.105 59953 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:36.361875 0.160010 tcp 10.0.2.105 59954 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:13:36.538838 2.998477 tcp 10.0.2.105 59955 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:45.546046 0.000000 tcp 10.0.2.105 59955 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:13:51.535082 2.993810 tcp 10.0.2.105 59956 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:14:00.527279 0.000000 tcp 10.0.2.105 59956 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:14:05.073828 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:14:06.536110 2.994018 tcp 10.0.2.105 59957 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:14:15.528879 0.000000 tcp 10.0.2.105 59957 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:16:07.954275 3.000585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:16:14.960234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:16:22.962024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:16:38.965318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:17:10.971306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:19:21.539650 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:19:21.539748 3.003664 tcp 10.0.2.105 59958 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:19:30.541793 0.000000 tcp 10.0.2.105 59958 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:19:36.542489 0.055926 tcp 10.0.2.105 59959 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:36.598730 0.064604 tcp 10.0.2.105 59960 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:36.663672 0.159257 tcp 10.0.2.105 59961 -> 195.113.214.236 443 SRPA* 0 0 41 22612 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:37.027103 3.008309 tcp 10.0.2.105 59962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:19:46.034024 0.000000 tcp 10.0.2.105 59962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:19:52.023215 0.051634 tcp 10.0.2.105 59963 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:52.075181 0.053803 tcp 10.0.2.105 59964 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:52.129265 0.285332 tcp 10.0.2.105 59965 -> 195.113.214.236 443 SRPA* 0 0 73 76800 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:19:52.424342 3.003452 tcp 10.0.2.105 59966 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:01.441687 0.000000 tcp 10.0.2.105 59966 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:07.425745 0.051704 tcp 10.0.2.105 59967 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:20:07.477723 0.054698 tcp 10.0.2.105 59968 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:20:07.532777 0.155073 tcp 10.0.2.105 59969 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:20:07.747114 2.992627 tcp 10.0.2.105 59970 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:16.738757 0.000000 tcp 10.0.2.105 59970 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:22.748516 3.003268 tcp 10.0.2.105 59971 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:31.749829 0.000000 tcp 10.0.2.105 59971 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:36.576847 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:20:37.749661 3.003037 tcp 10.0.2.105 59972 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:20:46.751370 0.000000 tcp 10.0.2.105 59972 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:23:14.977471 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:23:21.991964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:23:29.985556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:23:45.994131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:24:17.995291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:25:52.752866 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:25:52.753052 3.005586 tcp 10.0.2.105 59973 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:01.754436 0.000000 tcp 10.0.2.105 59973 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:07.755524 0.052785 tcp 10.0.2.105 59974 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:07.808576 0.112417 tcp 10.0.2.105 59975 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:07.921263 0.150649 tcp 10.0.2.105 59976 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:08.112597 2.995524 tcp 10.0.2.105 59977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:17.116775 0.000000 tcp 10.0.2.105 59977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:23.105601 0.051355 tcp 10.0.2.105 59978 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:23.157244 0.051765 tcp 10.0.2.105 59979 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:23.209361 0.118856 tcp 10.0.2.105 59980 -> 195.113.214.236 443 SRPA* 0 0 61 39029 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:23.376929 3.002752 tcp 10.0.2.105 59981 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:32.378697 0.000000 tcp 10.0.2.105 59981 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:38.377528 0.060517 tcp 10.0.2.105 59982 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:38.438346 0.053354 tcp 10.0.2.105 59983 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:38.491991 0.147127 tcp 10.0.2.105 59984 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:26:38.675277 2.996469 tcp 10.0.2.105 59985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:47.670406 0.000000 tcp 10.0.2.105 59985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:26:53.669163 3.004109 tcp 10.0.2.105 59986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:27:02.671894 0.000000 tcp 10.0.2.105 59986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:27:07.578894 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:27:08.670748 3.004094 tcp 10.0.2.105 59987 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:27:17.673592 0.000000 tcp 10.0.2.105 59987 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:30:22.005334 2.997581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:30:29.008732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:30:37.009525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:30:53.012768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:31:25.018846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:36:39.571808 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 03:36:39.571924 0.000000 udp 10.0.2.105 7010 -> 172.162.109.59 7488 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 03:36:54.845646 0.055502 tcp 10.0.2.105 59988 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:36:54.901395 0.055071 tcp 10.0.2.105 59989 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:36:54.956955 0.146457 tcp 10.0.2.105 59990 -> 195.113.214.236 443 SRPA* 0 0 32 24081 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:36:55.104404 0.093620 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:55.178241 0.190154 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:55.360704 0.465628 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:55.779807 0.081699 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:55.847148 0.170468 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:55.994455 0.066106 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.038195 0.143757 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.181448 0.171998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.346357 0.140985 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.489111 0.213231 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.669767 0.234862 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:56.881577 0.295644 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.139429 0.118761 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.241396 0.138564 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.393762 0.259834 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.606762 0.110506 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.681151 0.094197 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.755666 0.077933 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.818828 0.058892 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:57.872708 0.177442 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:58.047171 0.172908 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:58.253431 0.243705 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:58.497408 0.233970 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:58.712020 0.365859 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:59.073233 0.225821 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:36:59.291461 0.000000 udp 10.0.2.105 7010 -> 81.157.188.67 4637 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 03:37:08.703499 2.994169 tcp 10.0.2.105 59991 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:37:17.456603 0.051224 tcp 10.0.2.105 59992 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:17.508090 0.052471 tcp 10.0.2.105 59993 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:17.560841 0.152371 tcp 10.0.2.105 59994 -> 195.113.214.236 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:17.706636 0.000000 tcp 10.0.2.105 59991 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 03:37:17.713883 0.202147 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:17.891519 0.210659 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:18.091321 0.111809 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:18.194552 0.165229 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:18.321024 0.281958 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:18.599984 0.175260 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:18.722335 0.412381 udp 10.0.2.105 7010 <-> 111.242.77.77 1084 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:19.095313 0.215252 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/02 03:37:23.705532 0.052508 tcp 10.0.2.105 59995 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:23.757876 0.052994 tcp 10.0.2.105 59996 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:23.811130 0.153474 tcp 10.0.2.105 59997 -> 195.113.214.236 443 SRPA* 0 0 68 48836 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:24.013174 0.691286 tcp 10.0.2.105 59998 -> 31.192.24.67 3527 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/02/02 03:37:29.025444 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 03:37:36.032746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:37:44.037059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:38:00.036618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:38:32.043002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:44:36.048456 3.002380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 03:44:43.056780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:44:51.057430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:45:07.061045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:45:39.067381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:54:47.079051 3.002773 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 03:54:54.092927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:55:02.086862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:55:18.100858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 03:55:50.115578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:01:54.122636 3.000866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:02:01.129061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:02:09.130103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:02:25.133529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:02:57.139580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:07:23.283120 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 04:07:23.283241 0.000000 udp 10.0.2.105 7010 -> 81.157.188.67 4637 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 04:07:24.705206 0.599189 tcp 10.0.2.105 59999 -> 31.192.24.67 3527 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:39.507133 0.052824 tcp 10.0.2.105 60000 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:39.560245 0.054338 tcp 10.0.2.105 60001 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:39.614933 0.151645 tcp 10.0.2.105 60002 -> 195.113.214.236 443 SRPA* 0 0 51 33778 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:39.767242 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 04:07:55.969423 0.053791 tcp 10.0.2.105 60003 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:56.023533 0.051664 tcp 10.0.2.105 60004 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:56.075478 0.169728 tcp 10.0.2.105 60005 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:07:56.245835 0.249128 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:56.448776 0.077907 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:56.511638 0.175597 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:56.663632 0.066850 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:56.778959 0.109802 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:56.869199 0.141606 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.006624 0.214467 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.183264 0.143074 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.362113 0.252659 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.581816 0.234699 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.795481 0.171969 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:57.960527 0.101161 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.083506 0.111613 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.157494 0.088185 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.227021 0.080576 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.288782 0.058393 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.374890 0.172400 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.544841 0.288697 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.789161 0.124481 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:58.940999 0.393518 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:59.304755 0.170195 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:59.451059 0.242889 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:59.692462 0.234951 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:07:59.907754 0.224818 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:00.125538 0.201920 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:00.302727 0.193322 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:00.490024 0.300436 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:00.787939 0.172797 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:00.912732 0.000000 udp 10.0.2.105 7010 -> 111.242.77.77 1084 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 04:08:16.329710 0.052539 tcp 10.0.2.105 60006 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:08:16.382596 0.055076 tcp 10.0.2.105 60007 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:08:16.437957 0.165763 tcp 10.0.2.105 60008 -> 195.113.214.236 443 SRPA* 0 0 40 21396 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:08:16.604273 0.109016 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:16.709136 0.195525 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:08:16.866600 0.211981 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:09:03.149867 3.000544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 04:09:10.155994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:09:18.157351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:09:34.159916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:10:06.166987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:16:10.172027 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:16:17.179349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:16:25.181036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:16:41.184148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:17:13.190631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:23:17.197430 3.000527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:23:24.204026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:23:32.205350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:23:48.208691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:24:20.214324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:30:24.222857 2.999146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:30:31.227978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:30:39.233585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:30:55.239249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:31:27.238854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:37:25.303660 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 04:37:25.303808 0.535708 tcp 10.0.2.105 60009 -> 31.192.24.67 3527 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:37:31.244231 3.001777 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:37:38.251755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:37:46.253263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:38:02.256313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:38:28.274181 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 04:38:28.274315 0.191074 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:28.457602 0.000000 udp 10.0.2.105 7010 -> 111.242.77.77 1084 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 04:38:34.262628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:38:46.761737 0.053078 tcp 10.0.2.105 60010 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:38:46.815075 0.033069 tcp 10.0.2.105 60011 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:38:46.848423 0.160610 tcp 10.0.2.105 60012 -> 195.113.214.236 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/02 04:38:47.009667 0.079609 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:47.075079 0.171445 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.063837 0.058675 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.106457 0.093639 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.181036 0.154967 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.330419 0.256306 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.539339 0.144591 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.679645 0.217969 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:50.859460 0.173793 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.026024 0.103184 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.167080 0.235187 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.380105 0.260359 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.605394 0.076248 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.667049 0.053487 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.715740 0.174813 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:51.886990 0.216617 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.054122 0.138621 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.194370 0.089411 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.262810 0.113047 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.337670 0.244679 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.580829 0.233092 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:52.794380 0.222035 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:53.008579 0.395462 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:53.377344 0.171756 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:53.558762 0.250686 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:53.806741 0.179757 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:53.931183 0.197371 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:54.106183 0.201451 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:54.299105 0.214334 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:54.505738 0.106711 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:38:54.607938 0.147314 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/02 04:44:38.269257 3.070783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:44:45.314312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:44:53.287193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:45:09.290219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:45:41.295954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:54:50.309265 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 04:54:57.315804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:55:05.317430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:55:21.320171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 04:55:53.326301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:01:57.332174 3.001618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 05:02:04.340031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:02:12.341425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:02:28.344330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:03:00.350121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:07:25.842647 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:07:25.842801 3.003232 tcp 10.0.2.105 60013 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:07:34.844820 0.000000 tcp 10.0.2.105 60013 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:07:40.845281 0.052159 tcp 10.0.2.105 60014 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:40.897733 0.031354 tcp 10.0.2.105 60015 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:40.929353 0.161946 tcp 10.0.2.105 60016 -> 195.113.214.236 443 SRPA* 0 0 41 22752 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:41.356486 2.991582 tcp 10.0.2.105 60017 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:07:50.357033 0.000000 tcp 10.0.2.105 60017 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:07:56.356843 0.051760 tcp 10.0.2.105 60018 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:56.408937 0.040940 tcp 10.0.2.105 60019 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:56.450214 0.151874 tcp 10.0.2.105 60020 -> 195.113.214.236 443 SRPA* 0 0 40 32088 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:07:56.613177 2.997114 tcp 10.0.2.105 60021 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:05.609007 0.000000 tcp 10.0.2.105 60021 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:11.608353 0.053641 tcp 10.0.2.105 60022 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:08:11.662335 0.033574 tcp 10.0.2.105 60023 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:08:11.696277 0.148902 tcp 10.0.2.105 60024 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:08:11.853933 2.998395 tcp 10.0.2.105 60025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:20.850922 0.000000 tcp 10.0.2.105 60025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:26.849857 3.004084 tcp 10.0.2.105 60026 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:35.852412 0.000000 tcp 10.0.2.105 60026 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:40.579451 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:08:41.851138 3.004294 tcp 10.0.2.105 60027 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:08:50.854049 0.000000 tcp 10.0.2.105 60027 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:09:06.358962 3.001786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:09:12.956287 0.190063 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.136874 0.069859 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.193202 0.173778 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.343159 0.059568 udp 10.0.2.105 7010 <-> 86.89.2.116 7245 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.367203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:09:13.391884 0.099041 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.471090 0.142175 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.609003 0.249289 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.813092 0.151705 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:13.959863 0.303844 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:14.226159 0.174502 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:14.393054 0.121361 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:14.545758 0.236721 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:14.758701 0.255840 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:14.981880 0.078097 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.045187 0.052971 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.101625 0.173696 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.272694 0.210841 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.436509 0.105355 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.506470 0.244830 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.749727 0.251426 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:15.979669 0.226579 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:16.199071 0.138264 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:16.354726 0.090822 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:16.426804 0.353926 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:16.752765 0.172551 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:16.932507 0.212891 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.142877 0.162214 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.251590 0.196486 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.427721 0.107836 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.530884 0.258062 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.572567 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:09:17.747208 0.203662 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:17.944431 0.218167 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:09:21.368440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:09:37.371226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:10:09.377066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:13:56.854639 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:13:56.854801 2.993823 tcp 10.0.2.105 60028 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:05.857010 0.000000 tcp 10.0.2.105 60028 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:11.857435 0.054982 tcp 10.0.2.105 60029 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:11.912724 0.054064 tcp 10.0.2.105 60030 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:11.967089 0.156493 tcp 10.0.2.105 60031 -> 195.113.214.236 443 SRPA* 0 0 33 24038 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:12.163226 2.997177 tcp 10.0.2.105 60032 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:21.159194 0.000000 tcp 10.0.2.105 60032 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:27.158332 0.050875 tcp 10.0.2.105 60033 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:27.209509 0.053496 tcp 10.0.2.105 60034 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:27.263298 0.154524 tcp 10.0.2.105 60035 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:27.429006 3.003549 tcp 10.0.2.105 60036 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:36.430866 0.000000 tcp 10.0.2.105 60036 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:42.430335 0.051574 tcp 10.0.2.105 60037 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:42.482158 0.052395 tcp 10.0.2.105 60038 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:42.534870 0.223064 tcp 10.0.2.105 60039 -> 195.113.214.236 443 SRPA* 0 0 41 21414 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:14:42.769040 2.995196 tcp 10.0.2.105 60040 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:51.763274 0.000000 tcp 10.0.2.105 60040 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:14:57.762130 3.003940 tcp 10.0.2.105 60041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:15:06.764510 0.000000 tcp 10.0.2.105 60041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:15:11.581283 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:15:12.763555 3.003961 tcp 10.0.2.105 60042 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:15:21.776682 0.000000 tcp 10.0.2.105 60042 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:16:13.382556 3.002396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:16:20.389878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:16:28.391980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:16:44.394992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:17:16.400965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:20:27.766872 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:20:27.767033 2.993367 tcp 10.0.2.105 60043 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:20:36.759160 0.000000 tcp 10.0.2.105 60043 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:20:42.769655 0.052675 tcp 10.0.2.105 60044 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:42.822584 0.053353 tcp 10.0.2.105 60045 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:42.876322 0.149314 tcp 10.0.2.105 60046 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:43.087102 2.995593 tcp 10.0.2.105 60047 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:20:52.081197 0.000000 tcp 10.0.2.105 60047 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:20:58.079910 0.052277 tcp 10.0.2.105 60048 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:58.132618 0.052351 tcp 10.0.2.105 60049 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:58.185298 0.159826 tcp 10.0.2.105 60050 -> 195.113.214.236 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:20:58.452158 3.002388 tcp 10.0.2.105 60051 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:07.453166 0.000000 tcp 10.0.2.105 60051 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:13.452580 0.051482 tcp 10.0.2.105 60052 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:21:13.504471 0.054884 tcp 10.0.2.105 60053 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:21:13.559763 0.150369 tcp 10.0.2.105 60054 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:21:13.737179 2.999449 tcp 10.0.2.105 60055 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:22.735059 0.000000 tcp 10.0.2.105 60055 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:28.733913 2.994221 tcp 10.0.2.105 60056 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:37.737165 0.000000 tcp 10.0.2.105 60056 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:42.573519 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:21:43.735377 2.993972 tcp 10.0.2.105 60057 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:21:52.728174 0.000000 tcp 10.0.2.105 60057 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:23:20.417468 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:23:27.424661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:23:35.426013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:23:51.429021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:24:23.435037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:26:58.739453 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:26:58.739624 3.003317 tcp 10.0.2.105 60058 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:07.741244 0.000000 tcp 10.0.2.105 60058 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:13.741350 0.052985 tcp 10.0.2.105 60059 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:13.794620 0.053515 tcp 10.0.2.105 60060 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:13.848410 0.148440 tcp 10.0.2.105 60061 -> 195.113.214.236 443 SRPA* 0 0 47 34082 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:14.227169 2.997862 tcp 10.0.2.105 60062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:23.223394 0.000000 tcp 10.0.2.105 60062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:29.222971 0.052262 tcp 10.0.2.105 60063 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:29.275511 0.052162 tcp 10.0.2.105 60064 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:29.328033 0.166336 tcp 10.0.2.105 60065 -> 195.113.214.236 443 SRPA* 0 0 42 24226 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:29.586152 3.000767 tcp 10.0.2.105 60066 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:38.585546 0.000000 tcp 10.0.2.105 60066 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:44.584980 0.052065 tcp 10.0.2.105 60067 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:44.637328 0.054135 tcp 10.0.2.105 60068 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:44.691722 0.146891 tcp 10.0.2.105 60069 -> 195.113.214.236 443 SRPA* 0 0 38 19014 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:27:44.862140 2.996662 tcp 10.0.2.105 60070 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:53.867498 0.000000 tcp 10.0.2.105 60070 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:27:59.856517 2.993806 tcp 10.0.2.105 60071 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:28:08.849067 0.000000 tcp 10.0.2.105 60071 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:28:13.575784 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:28:14.857241 3.004770 tcp 10.0.2.105 60072 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:28:23.860752 0.000000 tcp 10.0.2.105 60072 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:30:27.441390 3.001282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:30:34.448628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:30:42.449995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:30:58.453161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:31:30.462376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:33:29.864948 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:33:29.865055 3.001500 tcp 10.0.2.105 60073 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:33:38.863479 0.000000 tcp 10.0.2.105 60073 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:33:44.864584 0.053361 tcp 10.0.2.105 60074 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:33:44.918241 0.054167 tcp 10.0.2.105 60075 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:33:44.972780 0.167932 tcp 10.0.2.105 60076 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:33:45.250152 2.996763 tcp 10.0.2.105 60077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:33:54.245664 0.000000 tcp 10.0.2.105 60077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:00.245626 0.051561 tcp 10.0.2.105 60078 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:00.297495 0.054067 tcp 10.0.2.105 60079 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:00.351827 0.150732 tcp 10.0.2.105 60080 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:00.548924 2.999964 tcp 10.0.2.105 60081 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:09.547611 0.000000 tcp 10.0.2.105 60081 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:15.547202 0.052617 tcp 10.0.2.105 60082 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:15.600114 0.053681 tcp 10.0.2.105 60083 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:15.654075 0.145540 tcp 10.0.2.105 60084 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:34:15.810094 3.000951 tcp 10.0.2.105 60085 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:24.809573 0.000000 tcp 10.0.2.105 60085 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:30.808085 3.004556 tcp 10.0.2.105 60086 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:39.811033 0.000000 tcp 10.0.2.105 60086 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:44.578152 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:34:45.809939 3.004342 tcp 10.0.2.105 60087 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:34:54.812897 0.000000 tcp 10.0.2.105 60087 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:37:34.465470 3.001273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:37:41.472313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:37:49.473739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:38:05.476895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:38:37.482909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:39:32.261919 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:39:32.262057 0.190936 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:32.446153 0.082082 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:32.514000 0.168814 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:32.661331 0.000000 udp 10.0.2.105 7010 -> 86.89.2.116 7245 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 05:39:48.827278 0.053324 tcp 10.0.2.105 60088 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:39:48.880875 0.056472 tcp 10.0.2.105 60089 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:39:48.937602 0.151737 tcp 10.0.2.105 60090 -> 195.113.214.236 443 SRPA* 0 0 20 11272 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:39:49.089866 0.093697 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:49.163377 0.142484 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:49.301918 0.259024 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:49.510406 0.141776 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:49.671492 0.103639 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 1996 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:49.788729 0.236263 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:50.000468 0.251341 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:50.216652 0.076929 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:39:50.279288 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 05:40:00.813191 3.003920 tcp 10.0.2.105 60091 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:06.801799 0.123596 tcp 10.0.2.105 60092 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:06.925690 0.052601 tcp 10.0.2.105 60093 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:06.978550 0.150771 tcp 10.0.2.105 60094 -> 195.113.214.236 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:07.129877 0.214677 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:07.308982 0.175402 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:07.563809 0.172804 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:07.732971 0.213128 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:08.288315 0.108665 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:08.374669 0.244220 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:08.628583 0.238338 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:08.843763 0.083385 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:08.907557 0.356214 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:09.236123 0.169328 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:09.860767 0.000000 tcp 10.0.2.105 60091 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:10.375851 0.210207 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:10.583674 0.226674 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:10.803128 0.131426 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 1927 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.024891 0.283465 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.257909 0.203155 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.436544 0.111588 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.540361 0.147792 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.653635 0.194533 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:11.842647 0.214940 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2592 flow=From-Botnet-V2-UDP-Established 1970/02/02 05:40:15.822718 0.051939 tcp 10.0.2.105 60095 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:15.874962 0.052007 tcp 10.0.2.105 60096 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:15.927331 0.161579 tcp 10.0.2.105 60097 -> 195.113.214.236 443 SRPA* 0 0 35 27788 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:16.098486 2.990777 tcp 10.0.2.105 60098 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:25.087277 0.000000 tcp 10.0.2.105 60098 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:31.086756 0.050194 tcp 10.0.2.105 60099 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:31.137282 0.051977 tcp 10.0.2.105 60100 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:31.189555 0.261701 tcp 10.0.2.105 60101 -> 195.113.214.236 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:31.465206 2.985916 tcp 10.0.2.105 60102 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:40.449758 0.000000 tcp 10.0.2.105 60102 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:46.458902 0.051469 tcp 10.0.2.105 60103 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:46.510756 0.126050 tcp 10.0.2.105 60104 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:46.637071 0.148414 tcp 10.0.2.105 60105 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:40:46.826768 3.006561 tcp 10.0.2.105 60106 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:40:55.831823 0.000000 tcp 10.0.2.105 60106 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:41:01.820128 3.004552 tcp 10.0.2.105 60107 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:41:10.823382 0.000000 tcp 10.0.2.105 60107 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:41:15.580504 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:41:16.822328 3.004329 tcp 10.0.2.105 60108 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:41:25.824551 0.000000 tcp 10.0.2.105 60108 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:44:41.490711 2.999810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:44:48.496636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:44:56.498092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:45:12.501167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:45:44.507018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:46:31.825630 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 05:46:31.825722 2.993230 tcp 10.0.2.105 60109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:46:40.817932 0.000000 tcp 10.0.2.105 60109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:46:46.828156 0.052989 tcp 10.0.2.105 60110 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:46:46.881386 0.055991 tcp 10.0.2.105 60111 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:46:46.937720 0.149878 tcp 10.0.2.105 60112 -> 195.113.214.236 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:46:47.106628 2.994654 tcp 10.0.2.105 60113 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:46:56.099782 0.000000 tcp 10.0.2.105 60113 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 05:47:02.098728 0.054837 tcp 10.0.2.105 60114 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:47:02.153849 0.052971 tcp 10.0.2.105 60115 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:47:02.207102 0.161940 tcp 10.0.2.105 60116 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:47:02.430816 0.557413 tcp 10.0.2.105 60117 -> 176.73.126.145 3888 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/02/02 05:51:48.514142 2.999922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 05:51:55.520310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:52:03.521964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:52:19.526485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:52:51.531143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:58:55.536983 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 05:59:02.544137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:59:10.545903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:59:26.548913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 05:59:58.554956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:06:10.562449 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:06:17.569804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:06:25.571265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:06:41.574639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:07:13.580228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:10:17.785820 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 06:10:17.785933 0.000000 udp 10.0.2.105 7010 -> 86.89.2.116 7245 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 06:10:33.750489 0.052735 tcp 10.0.2.105 60118 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:10:33.803491 0.053593 tcp 10.0.2.105 60119 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:10:33.857341 0.152245 tcp 10.0.2.105 60120 -> 195.113.214.236 443 SRPA* 0 0 43 34856 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:10:34.010079 0.057225 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.174954 0.081049 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.241091 0.191281 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.424791 0.171117 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.573091 0.091814 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.656284 0.149219 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.806747 0.102108 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:34.928722 0.234191 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.140202 0.142492 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.284488 0.250436 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.490562 0.078245 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.553453 0.256204 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2589 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.771086 0.206562 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:35.974105 0.215351 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:36.152563 0.173147 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:36.318042 0.209941 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:36.486210 0.109124 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:36.555991 0.253885 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:36.808483 0.279740 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:37.068783 0.091220 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:37.141267 0.357320 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:37.467423 0.227067 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:37.687076 0.138350 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:37.827011 0.525705 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:38.373876 0.201106 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:38.571739 0.505021 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:39.029008 0.200530 udp 10.0.2.105 7010 <-> 71.52.126.139 3678 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:39.206951 0.110759 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:39.309799 0.140810 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 5 1762 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:39.421363 0.206094 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:10:39.621401 0.214580 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:13:17.586354 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:13:24.593790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:13:32.595436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:13:48.598321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:14:20.604104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:17:02.987648 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 06:17:02.987793 0.537613 tcp 10.0.2.105 60121 -> 176.73.126.145 3888 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:20:24.611132 3.000893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:20:31.618420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:20:39.619171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:20:55.622158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:21:27.628125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:27:31.634681 3.008232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:27:38.643690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:27:46.643144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:28:02.646026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:28:34.652114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:34:38.658443 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:34:45.665737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:34:53.667052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:35:09.670295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:35:41.676058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:40:41.708155 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 06:40:41.708343 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 06:40:59.144501 0.052669 tcp 10.0.2.105 60122 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:40:59.197431 0.032048 tcp 10.0.2.105 60123 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:40:59.229787 0.117433 tcp 10.0.2.105 60124 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:40:59.347943 0.075146 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:40:59.406683 0.188998 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:40:59.630932 0.171978 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:40:59.779600 0.097402 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:40:59.856590 0.145120 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:40:59.997486 0.103937 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.128179 0.236013 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.343249 0.078179 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.404172 0.261813 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.628954 0.172381 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.797925 0.215611 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:00.977485 0.152734 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:01.164857 0.608558 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:01.725959 0.173442 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:01.892410 0.221407 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:02.063297 0.111893 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:02.138399 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 06:41:17.819778 0.052585 tcp 10.0.2.105 60125 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:17.872631 0.031931 tcp 10.0.2.105 60126 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:17.904860 0.132219 tcp 10.0.2.105 60127 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:18.037569 0.236665 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:18.251157 0.084636 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:18.318079 0.145257 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:18.489432 0.355461 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:18.818094 0.228785 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.039577 0.171463 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.233779 0.240273 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.470392 0.151588 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.576160 0.138516 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.675042 0.191443 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:19.860363 0.214735 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:20.067784 0.000000 udp 10.0.2.105 7010 -> 71.52.126.139 3678 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 06:41:35.946110 0.051727 tcp 10.0.2.105 60128 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:35.998122 0.033106 tcp 10.0.2.105 60129 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:36.031566 0.136640 tcp 10.0.2.105 60130 -> 195.113.214.236 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:41:36.168742 0.105515 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/02 06:41:45.681970 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 06:41:52.689542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:42:00.691232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:42:16.694066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:42:48.700577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:47:03.527026 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 06:47:03.527117 0.489716 tcp 10.0.2.105 60131 -> 176.73.126.145 3888 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/02/02 06:53:24.707456 3.003261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 06:53:31.719339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:53:39.716253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:53:55.719264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 06:54:27.725700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:00:31.731239 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:00:38.738725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:00:46.740126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:01:02.744782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:01:34.749861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:07:38.756138 3.000751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:07:45.762758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:07:53.764009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:08:09.767194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:08:41.773210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:11:53.379128 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 07:11:53.379214 0.053065 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:11:53.473772 0.239167 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:11:53.711483 0.000000 udp 10.0.2.105 7010 -> 71.52.126.139 3678 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 07:12:12.688425 0.053450 tcp 10.0.2.105 60132 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 07:12:12.742166 0.036919 tcp 10.0.2.105 60133 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 07:12:12.779360 0.128907 tcp 10.0.2.105 60134 -> 195.113.214.236 443 SRPA* 0 0 41 22206 flow=From-Botnet-V2-TCP-Established 1970/02/02 07:12:12.908529 0.172030 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.057000 0.093029 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.164400 0.143518 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.356850 0.100779 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.567651 0.188939 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.749728 0.079312 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.813925 0.218451 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:13.997048 0.140954 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.133732 0.083514 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.246097 0.237394 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.459373 0.254291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.674578 0.172155 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.843312 0.109267 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:14.917007 0.716147 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:15.582537 0.295826 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:15.831129 0.174543 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:15.997668 0.152187 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:16.175782 0.352385 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:16.500516 0.229538 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:16.723081 0.234111 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:16.935644 0.091151 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.006852 0.155920 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.111559 0.141021 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.211333 0.190822 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.396143 0.215358 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.604808 0.224850 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:17.825967 0.172455 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:12:18.144654 0.109678 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:14:45.779849 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:14:52.786598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:15:00.788036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:15:16.791219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:15:48.797001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:17:04.015731 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 07:17:04.015831 0.489732 tcp 10.0.2.105 60135 -> 176.73.126.145 3888 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/02/02 07:21:52.802355 3.005338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:21:59.810593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:22:07.812122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:22:23.819240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:22:55.821293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:28:59.829443 2.999273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:29:06.834435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:29:14.835729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:29:30.838637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:30:02.845201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:36:06.850669 3.002363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:36:13.858451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:36:21.860030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:36:37.862848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:37:09.868992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:42:40.033899 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 07:42:40.034048 0.066496 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:40.160806 0.248206 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2615 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:40.407387 0.166089 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:40.551981 0.093661 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:41.243370 0.155239 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:41.489175 0.105126 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:41.661933 0.188321 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:41.843228 0.078254 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:41.905714 0.227552 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:42.098123 0.143682 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:42.325575 0.263426 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2536 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:42.551254 0.174825 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:42.722478 0.111572 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:42.793461 0.078160 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:43.037322 0.236124 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:43.249855 0.680218 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:43.883889 0.295022 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.127976 0.175613 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.296470 0.131335 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.456504 0.295108 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.731086 0.087349 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 1995 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.878962 0.163737 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:44.988344 0.354453 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:45.314461 0.227282 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:45.534151 0.150102 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:45.644824 0.199564 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:45.834966 0.215211 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:46.042689 0.211795 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:46.250917 0.170300 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:42:46.452871 0.114187 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 07:43:13.874879 3.064541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:43:20.915644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:43:28.894021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:43:44.896933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:44:16.903173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:47:04.504431 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 07:47:04.504529 0.601497 tcp 10.0.2.105 60136 -> 176.73.126.145 3888 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/02 07:54:04.914118 3.004531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 07:54:11.918792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:54:19.922671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:54:35.923031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 07:55:07.929086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:01:11.935287 3.001751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:01:18.942474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:01:26.944104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:01:42.947056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:02:14.953544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:08:18.958712 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:08:25.965986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:08:33.967950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:08:49.971124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:09:21.977267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:13:14.681747 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 08:13:14.681986 0.054455 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:14.901071 0.246712 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.146337 0.169130 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.293723 0.093213 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.376893 0.145356 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.517850 0.103989 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.634143 0.190356 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.817247 0.078590 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:15.879715 0.327844 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:16.170307 0.197792 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:16.365282 0.109292 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:16.453390 0.082139 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:16.517135 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 08:13:33.349937 0.054005 tcp 10.0.2.105 60137 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:33.404195 0.054615 tcp 10.0.2.105 60138 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:33.459085 0.241384 tcp 10.0.2.105 60139 -> 195.113.214.236 443 SRPA* 0 0 57 37415 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:33.701040 0.248568 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:33.917049 0.238092 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:35.354024 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 08:13:53.988880 0.053085 tcp 10.0.2.105 60140 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:54.042303 0.054108 tcp 10.0.2.105 60141 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:54.096705 0.152571 tcp 10.0.2.105 60142 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:13:54.249780 0.215260 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:54.418745 0.337801 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:54.736032 0.086292 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:54.803370 0.165964 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:54.917965 0.172880 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 1980 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:55.083766 0.131541 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:55.224874 0.358541 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:55.554651 0.223829 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:55.771651 0.147486 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:55.882539 0.190993 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:56.068650 0.215351 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:56.276541 0.108072 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:56.377058 0.198952 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:13:56.572871 0.171360 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:15:25.982652 3.001881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 08:15:32.990183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:15:40.991934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:15:56.994902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:16:29.001048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:17:05.113644 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 08:17:05.113859 0.573456 tcp 10.0.2.105 60143 -> 176.73.126.145 3888 FSPA* 0 0 14 1517 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:22:33.013841 2.995629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:22:40.014591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:22:48.015338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:23:04.018975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:23:36.024926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:29:40.030097 3.003344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:29:47.038706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:29:55.039739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:30:11.042958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:30:43.048790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:36:47.055690 3.000378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:36:54.062527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:37:02.063490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:37:18.066733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:37:50.073122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:43:54.079002 3.000908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:43:59.003642 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 08:43:59.003840 0.149090 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.148272 0.248701 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.350482 0.240459 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.589242 0.054897 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.664807 0.148690 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.815277 0.102559 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:43:59.935642 0.189640 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.117964 0.078574 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.219806 0.216043 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.399001 0.096078 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2594 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.476080 0.172477 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.624490 0.110600 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.696647 0.078467 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:00.758584 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 08:44:01.086854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:44:09.089495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:44:17.171134 0.052982 tcp 10.0.2.105 60144 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:44:17.224510 0.032834 tcp 10.0.2.105 60145 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:44:17.257671 0.148194 tcp 10.0.2.105 60146 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:44:17.406401 0.265299 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:17.633733 0.249228 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:17.858223 0.250906 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.088937 0.084111 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.153441 0.271231 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.369346 0.174211 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.535767 0.210980 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.700917 0.131590 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:18.840777 0.353387 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:19.167092 0.228954 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:19.388260 0.144892 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:19.497034 0.198009 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:19.686498 0.269468 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:19.953163 0.172094 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:20.178029 0.215440 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:20.386140 0.110433 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/02 08:44:25.090643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:44:57.096630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:47:05.691925 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 08:47:05.692009 0.462299 tcp 10.0.2.105 60147 -> 176.73.126.145 3888 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/02 08:54:25.106656 3.003502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 08:54:32.113483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:54:40.115072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:54:56.118134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 08:55:28.124264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:01:32.129948 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:01:39.137630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:01:47.139097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:02:03.142382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:02:35.147685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:08:39.154056 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:08:46.161067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:08:54.163274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:09:10.166130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:09:42.172096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:14:21.583882 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 09:14:21.584074 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 09:14:39.932142 0.052770 tcp 10.0.2.105 60148 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:14:39.985189 0.052940 tcp 10.0.2.105 60149 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:14:40.037989 0.183976 tcp 10.0.2.105 60150 -> 195.113.214.236 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:14:40.222143 0.142161 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:14:40.359776 0.096731 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:14:40.443879 0.155515 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:14:40.617506 0.108270 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:14:40.737982 0.188839 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:14:40.918972 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 09:14:59.879351 0.056749 tcp 10.0.2.105 60151 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:14:59.936454 0.054844 tcp 10.0.2.105 60152 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:14:59.991594 0.153002 tcp 10.0.2.105 60153 -> 195.113.214.236 443 SRPA* 0 0 52 40486 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:15:00.145437 0.239090 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.382971 0.093955 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.458932 0.167908 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.603996 0.104338 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.672498 0.074181 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.731831 0.081872 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.796914 0.211274 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:00.973878 0.261906 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:01.197484 0.236210 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:01.409095 0.269594 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:01.656929 0.085045 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:01.723380 0.213040 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:01.887669 0.138631 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:02.027768 0.374671 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:02.373232 0.164345 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:02.484711 0.173659 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:02.649561 0.224512 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:02.867085 0.170441 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:03.000882 0.199472 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:03.193600 0.273219 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:03.463366 0.172088 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:03.638001 0.215062 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:03.845064 0.106557 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:15:46.178443 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 09:15:53.185301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:16:01.187001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:16:17.189880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:16:49.205974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:17:06.160866 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 09:17:06.161031 0.624329 tcp 10.0.2.105 60154 -> 176.73.126.145 3888 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:22:53.212147 3.001420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:23:00.219473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:23:08.220896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:23:24.224040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:23:56.229946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:30:00.235800 3.005723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:30:07.243251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:30:15.248647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:30:31.247800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:31:03.253783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:37:07.259648 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:37:14.267075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:37:22.268360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:37:38.271874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:38:10.278118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:44:14.283882 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 09:44:21.291259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:44:29.293010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:44:45.295964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:45:04.243553 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 09:45:04.243668 0.259129 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:04.455185 0.102982 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:04.575682 0.188567 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:04.756663 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 09:45:17.303290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:45:22.050701 0.084465 tcp 10.0.2.105 60155 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:45:22.135441 0.052885 tcp 10.0.2.105 60156 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:45:22.188681 0.177732 tcp 10.0.2.105 60157 -> 195.113.214.236 443 SRPA* 0 0 40 22580 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:45:22.366906 0.149251 udp 10.0.2.105 7010 <-> 24.191.7.93 6209 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:22.512174 0.145253 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:22.653311 0.251893 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:22.903744 0.088034 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:23.035021 0.396028 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:23.410186 0.321038 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:23.696589 0.079286 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:23.758548 0.082203 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:23.888584 0.217522 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:24.068956 0.253522 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:24.285975 0.236544 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:24.499479 0.298618 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:24.778443 0.093011 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:24.911543 0.304101 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:25.168714 0.138386 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:25.379318 0.172890 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:25.544535 0.225838 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:25.763356 0.188811 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:25.914686 0.388283 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:26.274599 0.157646 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:26.382236 0.216314 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:26.591826 0.327965 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:26.916331 0.168660 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:27.061739 0.210697 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:45:27.265106 0.107647 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/02 09:47:06.789161 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 09:47:06.789252 0.554422 tcp 10.0.2.105 60158 -> 176.73.126.145 3888 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/02/02 09:54:37.312017 2.999303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 09:54:44.316902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:54:52.317919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:55:08.322097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 09:55:40.327689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:01:44.333730 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:01:51.341095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:01:59.342676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:02:15.345541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:02:47.351475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:08:51.357201 3.002103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:08:58.364708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:09:06.366584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:09:22.369353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:09:54.375660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:15:34.324891 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 10:15:34.325185 0.055842 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:34.379495 0.106497 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:34.510322 0.249657 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:34.715741 0.188993 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:34.897916 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 10:15:50.960380 0.053119 tcp 10.0.2.105 60159 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:15:51.013755 0.035848 tcp 10.0.2.105 60160 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:15:51.049931 0.151361 tcp 10.0.2.105 60161 -> 195.113.214.236 443 SRPA* 0 0 42 24148 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:15:51.201569 0.142814 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:51.640442 0.255803 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:51.894794 0.090845 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:51.966507 0.082342 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.030458 0.077344 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.092956 0.214278 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.272007 0.167661 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.417309 0.111872 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.489736 0.253538 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.707828 0.238897 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:52.922110 0.234518 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.135303 0.086965 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.204642 0.233619 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.389082 0.226601 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.608604 0.180722 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.751584 0.145371 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:53.898419 0.174724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:54.065119 0.350412 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:54.387745 0.181946 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:54.512269 0.189194 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:54.695210 0.252278 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:54.944335 0.167503 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:55.088954 0.213477 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:55.295170 0.109162 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:15:58.381167 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:16:05.388934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:16:13.390404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:16:29.393480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:17:01.399430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:17:07.348478 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 10:17:07.348682 0.521324 tcp 10.0.2.105 60162 -> 176.73.126.145 3888 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:23:05.406569 3.000774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:23:12.413117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:23:20.417167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:23:36.417438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:24:08.423429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:30:12.431378 3.003596 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:30:19.436619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:30:27.438722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:30:43.443699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:31:15.447542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:37:19.453499 3.001646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:37:26.460861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:37:34.462542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:37:50.465269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:38:22.471435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:44:26.478830 3.127282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 10:44:33.583178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:44:41.521015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:44:57.499189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:45:29.505430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:46:21.019887 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 10:46:21.019990 0.000000 udp 10.0.2.105 7010 -> 24.191.7.93 6209 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 10:46:37.715606 0.052796 tcp 10.0.2.105 60163 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:46:37.768758 0.031549 tcp 10.0.2.105 60164 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:46:37.800677 0.218296 tcp 10.0.2.105 60165 -> 195.113.214.236 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:46:38.020405 0.188675 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:38.201740 0.104994 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:38.534882 0.053625 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:38.752472 0.257270 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:38.961836 0.141110 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.143402 0.257175 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.398945 0.091956 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.512834 0.077865 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.577163 0.077135 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.649442 0.216269 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.827664 0.170211 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2552 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:39.973349 0.110413 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:40.302029 0.255743 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:40.524971 0.237432 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:40.739357 0.236840 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:40.954668 0.226149 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:41.174192 0.145453 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:41.280621 0.138653 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:41.521990 0.173365 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:41.688440 0.091508 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:42.145224 0.266966 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:42.365049 0.347324 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:42.770489 0.177456 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:43.378635 0.200824 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:43.573096 0.308957 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:43.878635 0.169288 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:44.026233 0.214026 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:46:44.232935 0.106171 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/02 10:47:07.877051 0.629694 tcp 10.0.2.105 60166 -> 176.73.126.145 3888 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/02 10:54:43.514962 3.011863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 10:54:50.531851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:54:58.533327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:55:14.536652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 10:55:46.542421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:01:50.550365 3.000484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:01:57.555901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:02:05.557507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:02:21.560635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:02:53.566335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:08:57.573733 3.000558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:09:04.579936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:09:12.581578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:09:28.584539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:10:00.590544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:16:04.596422 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:16:11.603708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:16:19.605218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:16:35.608631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:17:07.614236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:17:08.506250 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 11:17:08.506348 0.535252 tcp 10.0.2.105 60167 -> 176.73.126.145 3888 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:17:11.660643 0.189259 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:11.842172 0.256866 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.049242 0.149952 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.276858 0.104045 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.395168 0.052271 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.500535 0.243331 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.742724 0.092684 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.816997 0.079202 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.925667 0.084798 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:12.992716 0.212165 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:13.171228 0.172561 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:13.320120 0.111107 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:13.455601 0.264059 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:13.680471 0.237633 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:13.895271 0.237088 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.113518 0.225143 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.331277 0.174405 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.497916 0.090684 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.568736 0.149536 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.694727 0.138347 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:14.854120 0.210225 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:15.082969 0.356969 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:15.413250 0.178264 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:15.542225 0.197485 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:15.733390 0.293006 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:16.023726 0.167561 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:16.168549 0.213739 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:17:16.374262 0.120600 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:23:11.621658 3.026753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:23:18.637925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:23:26.639481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:23:42.642762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:24:14.648277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:30:18.655120 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:30:25.672509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:30:33.663386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:30:49.666174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:31:21.672329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:37:25.678596 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:37:32.686071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:37:40.687136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:37:56.690246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:38:28.696400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:44:32.702181 3.115033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 11:44:39.790071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:44:47.850115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:45:03.734293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:45:35.740948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:47:09.044862 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 11:47:09.045086 2.993728 tcp 10.0.2.105 60168 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:18.047486 0.000000 tcp 10.0.2.105 60168 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:24.047310 0.053565 tcp 10.0.2.105 60169 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:24.101218 0.034786 tcp 10.0.2.105 60170 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:24.136482 0.112731 tcp 10.0.2.105 60171 -> 195.113.214.236 443 SRPA* 0 0 35 26303 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:24.679697 3.001750 tcp 10.0.2.105 60172 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:32.850554 0.147833 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:33.077040 3.566494 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:33.681050 0.000000 tcp 10.0.2.105 60172 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:36.635445 0.257758 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:36.847083 0.103688 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:36.986881 0.057263 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.068596 0.242799 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.311351 0.089870 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.384733 0.082945 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.466651 0.083134 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.531643 0.211293 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.708650 0.170009 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.856652 0.112300 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:37.973689 0.260095 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:38.196869 0.235706 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:38.410230 0.327825 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:38.718580 0.088901 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:38.792776 0.148520 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:38.902991 0.145304 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:39.088993 0.211605 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:39.254833 0.225431 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:39.472866 0.176862 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:39.641390 0.362713 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:39.679029 0.063160 tcp 10.0.2.105 60173 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:39.742507 0.031648 tcp 10.0.2.105 60174 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:39.774415 0.131493 tcp 10.0.2.105 60175 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:39.936644 2.996448 tcp 10.0.2.105 60176 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:39.976713 0.164878 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:40.088740 0.195871 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:40.279012 0.200490 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:40.477002 0.168252 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:40.622572 0.210255 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:40.825571 0.159950 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/02 11:47:48.931720 0.000000 tcp 10.0.2.105 60176 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:47:54.930627 0.051737 tcp 10.0.2.105 60177 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:54.982631 0.032243 tcp 10.0.2.105 60178 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:55.015064 0.132377 tcp 10.0.2.105 60179 -> 195.113.214.236 443 SRPA* 0 0 50 32304 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:47:55.179217 3.005847 tcp 10.0.2.105 60180 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:48:04.183635 0.000000 tcp 10.0.2.105 60180 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:48:10.172560 3.004079 tcp 10.0.2.105 60181 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:48:19.175299 0.000000 tcp 10.0.2.105 60181 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:48:24.072534 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 11:48:25.174009 2.993967 tcp 10.0.2.105 60182 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:48:34.176948 0.000000 tcp 10.0.2.105 60182 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:53:40.178433 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 11:53:40.178555 3.002174 tcp 10.0.2.105 60183 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:53:49.179853 0.000000 tcp 10.0.2.105 60183 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:53:55.180422 0.053405 tcp 10.0.2.105 60184 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:53:55.234100 0.035522 tcp 10.0.2.105 60185 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:53:55.269953 0.141850 tcp 10.0.2.105 60186 -> 195.113.214.236 443 SRPA* 0 0 56 37361 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:53:55.451442 3.001489 tcp 10.0.2.105 60187 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:04.451841 0.000000 tcp 10.0.2.105 60187 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:10.450811 0.052633 tcp 10.0.2.105 60188 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:10.503768 0.033184 tcp 10.0.2.105 60189 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:10.537268 0.154606 tcp 10.0.2.105 60190 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:10.724958 3.000704 tcp 10.0.2.105 60191 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:19.723581 0.000000 tcp 10.0.2.105 60191 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:25.722757 0.051753 tcp 10.0.2.105 60192 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:25.774773 0.031664 tcp 10.0.2.105 60193 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:25.806764 0.154594 tcp 10.0.2.105 60194 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/02 11:54:26.004144 3.003223 tcp 10.0.2.105 60195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:35.005195 0.000000 tcp 10.0.2.105 60195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:41.004185 2.994314 tcp 10.0.2.105 60196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:47.747384 3.001162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 11:54:50.007291 0.000000 tcp 10.0.2.105 60196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:54:54.573752 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 11:54:54.754082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:54:56.009290 2.990717 tcp 10.0.2.105 60197 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:55:02.755778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:55:04.998878 0.000000 tcp 10.0.2.105 60197 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 11:55:18.758666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 11:55:50.764604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:00:11.008985 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:00:11.009156 3.004120 tcp 10.0.2.105 60198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:20.011500 0.000000 tcp 10.0.2.105 60198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:26.012731 0.052544 tcp 10.0.2.105 60199 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:26.065541 0.032013 tcp 10.0.2.105 60200 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:26.097832 0.134426 tcp 10.0.2.105 60201 -> 195.113.214.236 443 SRPA* 0 0 37 27873 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:26.242530 3.002485 tcp 10.0.2.105 60202 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:35.243536 0.000000 tcp 10.0.2.105 60202 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:41.243045 0.052694 tcp 10.0.2.105 60203 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:41.295989 0.031890 tcp 10.0.2.105 60204 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:41.328149 0.130130 tcp 10.0.2.105 60205 -> 195.113.214.236 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:41.469123 3.007607 tcp 10.0.2.105 60206 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:50.475647 0.000000 tcp 10.0.2.105 60206 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:00:56.464627 0.052376 tcp 10.0.2.105 60207 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:56.517283 0.033940 tcp 10.0.2.105 60208 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:56.551523 0.135207 tcp 10.0.2.105 60209 -> 195.113.214.236 443 SRPA* 0 0 46 40404 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:00:56.704165 2.994627 tcp 10.0.2.105 60210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:05.707427 0.000000 tcp 10.0.2.105 60210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:11.706063 2.994180 tcp 10.0.2.105 60211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:20.698745 0.000000 tcp 10.0.2.105 60211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:25.576166 0.000227 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:01:26.707745 3.004023 tcp 10.0.2.105 60212 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:35.710564 0.000000 tcp 10.0.2.105 60212 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:01:54.770499 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:02:01.777877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:02:09.779560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:02:25.782790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:02:57.788186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:06:41.711057 0.000182 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:06:41.711358 3.003535 tcp 10.0.2.105 60213 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:06:50.713293 0.000000 tcp 10.0.2.105 60213 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:06:56.713652 0.052292 tcp 10.0.2.105 60214 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:06:56.766234 0.055011 tcp 10.0.2.105 60215 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:06:56.821584 0.127650 tcp 10.0.2.105 60216 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:06:56.969321 3.007516 tcp 10.0.2.105 60217 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:05.975269 0.000000 tcp 10.0.2.105 60217 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:11.964336 0.053300 tcp 10.0.2.105 60218 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:12.017920 0.053480 tcp 10.0.2.105 60219 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:12.071718 0.133479 tcp 10.0.2.105 60220 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:12.236804 2.991636 tcp 10.0.2.105 60221 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:21.237384 0.000000 tcp 10.0.2.105 60221 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:27.236651 0.053341 tcp 10.0.2.105 60222 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:27.290290 0.081431 tcp 10.0.2.105 60223 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:27.372090 0.136552 tcp 10.0.2.105 60224 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:07:27.591024 2.999760 tcp 10.0.2.105 60225 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:36.589404 0.000000 tcp 10.0.2.105 60225 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:42.588171 3.004511 tcp 10.0.2.105 60226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:51.590924 0.000000 tcp 10.0.2.105 60226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:07:56.568080 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:07:57.589800 3.004118 tcp 10.0.2.105 60227 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:08:06.592700 0.000000 tcp 10.0.2.105 60227 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:09:02.796298 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:09:09.803219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:09:17.804998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:09:33.807517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:10:05.813981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:13:12.593131 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:13:12.593284 3.003677 tcp 10.0.2.105 60228 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:21.595399 0.000000 tcp 10.0.2.105 60228 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:27.595937 0.053610 tcp 10.0.2.105 60229 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:27.649828 0.055720 tcp 10.0.2.105 60230 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:27.705801 0.129881 tcp 10.0.2.105 60231 -> 195.113.214.236 443 SRPA* 0 0 41 22591 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:27.923205 2.995617 tcp 10.0.2.105 60232 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:36.920627 0.000000 tcp 10.0.2.105 60232 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:42.916919 0.051502 tcp 10.0.2.105 60233 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:42.968749 0.054092 tcp 10.0.2.105 60234 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:43.023090 0.129811 tcp 10.0.2.105 60235 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:13:43.178847 3.001574 tcp 10.0.2.105 60236 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:52.179426 0.000000 tcp 10.0.2.105 60236 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:13:58.177713 3.004898 tcp 10.0.2.105 60237 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:14:07.180956 0.000000 tcp 10.0.2.105 60237 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:14:12.067826 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:16:09.820980 3.000825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:16:16.827300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:16:24.828834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:16:40.832107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:17:12.840807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:17:44.193155 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:17:44.193261 0.144393 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:17:44.437971 0.104717 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:17:44.542984 0.054137 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:17:44.618167 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 12:18:03.551804 0.051829 tcp 10.0.2.105 60238 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:18:03.603925 0.052731 tcp 10.0.2.105 60239 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:18:03.656953 0.136263 tcp 10.0.2.105 60240 -> 195.113.214.236 443 SRPA* 0 0 57 37415 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:18:03.793956 0.399117 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.145818 0.264301 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.408641 0.088809 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.479460 0.080683 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.554808 0.080462 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.620166 0.213574 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.796980 0.170415 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:04.944884 0.328650 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.247301 0.114211 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2644 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.319038 0.250583 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.537563 0.235425 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.752502 0.084702 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.822319 0.165598 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:05.949117 0.138272 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:06.092852 0.316026 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:06.360631 0.228858 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:06.579565 0.175218 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:06.747113 0.351254 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.068128 0.213409 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.190079 0.198112 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.380752 0.227267 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.605335 0.104561 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.704733 0.168478 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:18:07.851292 0.212448 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:19:13.181166 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:19:13.181355 3.004061 tcp 10.0.2.105 60241 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:22.183809 0.000000 tcp 10.0.2.105 60241 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:28.183050 0.050918 tcp 10.0.2.105 60242 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:28.234330 0.052868 tcp 10.0.2.105 60243 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:28.287527 0.146818 tcp 10.0.2.105 60244 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:28.446249 2.990811 tcp 10.0.2.105 60245 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:37.448774 0.000000 tcp 10.0.2.105 60245 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:43.447397 0.054885 tcp 10.0.2.105 60246 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:43.502639 0.052863 tcp 10.0.2.105 60247 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:43.555811 0.150407 tcp 10.0.2.105 60248 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:43.784263 2.984838 tcp 10.0.2.105 60249 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:52.770835 0.000000 tcp 10.0.2.105 60249 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:19:58.776906 0.053744 tcp 10.0.2.105 60250 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:58.830938 0.052745 tcp 10.0.2.105 60251 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:58.883997 0.147631 tcp 10.0.2.105 60252 -> 195.113.214.236 443 SRPA* 0 0 41 23492 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:19:59.145252 2.986413 tcp 10.0.2.105 60253 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:20:08.129961 0.000000 tcp 10.0.2.105 60253 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:20:14.138671 3.004288 tcp 10.0.2.105 60254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:20:23.141512 0.000000 tcp 10.0.2.105 60254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:20:28.072552 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:20:29.142823 3.006380 tcp 10.0.2.105 60255 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:20:38.143209 0.000000 tcp 10.0.2.105 60255 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:23:16.843967 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:23:23.851401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:23:31.853117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:23:47.855941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:24:19.861819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:25:44.144417 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:25:44.144532 2.992765 tcp 10.0.2.105 60256 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:25:53.145661 0.000000 tcp 10.0.2.105 60256 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:25:59.147328 0.053969 tcp 10.0.2.105 60257 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:25:59.201591 0.056735 tcp 10.0.2.105 60258 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:25:59.258597 0.145467 tcp 10.0.2.105 60259 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:25:59.418670 3.000535 tcp 10.0.2.105 60260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:08.417731 0.000000 tcp 10.0.2.105 60260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:14.417180 0.051809 tcp 10.0.2.105 60261 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:14.469310 0.052823 tcp 10.0.2.105 60262 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:14.522434 0.147573 tcp 10.0.2.105 60263 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:14.685213 2.996221 tcp 10.0.2.105 60264 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:23.680072 0.000000 tcp 10.0.2.105 60264 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:29.678886 0.053641 tcp 10.0.2.105 60265 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:29.732827 0.054876 tcp 10.0.2.105 60266 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:29.788011 0.140944 tcp 10.0.2.105 60267 -> 195.113.214.236 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:26:30.022525 3.000691 tcp 10.0.2.105 60268 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:39.022174 0.000000 tcp 10.0.2.105 60268 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:45.020578 3.004345 tcp 10.0.2.105 60269 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:54.023479 0.000000 tcp 10.0.2.105 60269 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:26:58.570048 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:27:00.022498 3.003759 tcp 10.0.2.105 60270 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:27:09.025138 0.000000 tcp 10.0.2.105 60270 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:30:23.869497 2.999688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:30:30.876704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:30:38.877809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:30:54.879737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:31:26.885340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:32:15.025414 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:32:15.025510 2.993480 tcp 10.0.2.105 60271 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:32:24.022781 0.000000 tcp 10.0.2.105 60271 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:32:30.028645 0.052033 tcp 10.0.2.105 60272 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:30.080941 0.053139 tcp 10.0.2.105 60273 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:30.134406 0.150446 tcp 10.0.2.105 60274 -> 195.113.214.236 443 SRPA* 0 0 33 16794 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:30.690450 3.001458 tcp 10.0.2.105 60275 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:32:39.690121 0.000000 tcp 10.0.2.105 60275 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:32:45.689628 0.095103 tcp 10.0.2.105 60276 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:45.785069 0.053841 tcp 10.0.2.105 60277 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:45.839230 0.151438 tcp 10.0.2.105 60278 -> 195.113.214.236 443 SRPA* 0 0 40 21914 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:32:46.177294 2.977714 tcp 10.0.2.105 60279 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:32:55.149928 0.000000 tcp 10.0.2.105 60279 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:01.142303 0.050969 tcp 10.0.2.105 60280 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:33:01.193608 0.052050 tcp 10.0.2.105 60281 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:33:01.245924 0.145729 tcp 10.0.2.105 60282 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:33:01.416048 3.000030 tcp 10.0.2.105 60283 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:10.414692 0.000000 tcp 10.0.2.105 60283 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:16.413475 2.994009 tcp 10.0.2.105 60284 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:25.416572 0.000000 tcp 10.0.2.105 60284 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:30.075439 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:33:31.415682 2.993738 tcp 10.0.2.105 60285 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:33:40.412425 0.000000 tcp 10.0.2.105 60285 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:37:30.891450 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:37:37.899270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:37:45.901034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:38:01.903656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:38:33.909625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:38:46.418271 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:38:46.418365 3.003722 tcp 10.0.2.105 60286 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:38:55.420674 0.000000 tcp 10.0.2.105 60286 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:01.421240 0.052565 tcp 10.0.2.105 60287 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:01.474103 0.052750 tcp 10.0.2.105 60288 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:01.527236 0.147876 tcp 10.0.2.105 60289 -> 195.113.214.236 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:01.685301 2.998538 tcp 10.0.2.105 60290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:10.682797 0.000000 tcp 10.0.2.105 60290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:16.681781 0.051807 tcp 10.0.2.105 60291 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:16.733946 0.032390 tcp 10.0.2.105 60292 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:16.766583 0.152145 tcp 10.0.2.105 60293 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:16.942213 3.003714 tcp 10.0.2.105 60294 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:25.944712 0.000000 tcp 10.0.2.105 60294 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:31.944040 0.052309 tcp 10.0.2.105 60295 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:31.996691 0.032656 tcp 10.0.2.105 60296 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:32.029601 0.165497 tcp 10.0.2.105 60297 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:39:32.204229 2.993694 tcp 10.0.2.105 60298 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:41.206065 0.000000 tcp 10.0.2.105 60298 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:47.205204 2.994370 tcp 10.0.2.105 60299 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:39:56.197691 0.000000 tcp 10.0.2.105 60299 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:40:01.074925 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:40:02.207103 2.993835 tcp 10.0.2.105 60300 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:40:11.199626 0.000000 tcp 10.0.2.105 60300 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:44:37.916119 3.002240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:44:44.923181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:44:52.933509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:45:08.927987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:45:40.933639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:48:36.947131 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:48:36.947237 0.189893 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:37.129313 0.103755 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:37.239079 0.142960 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:37.412801 0.052759 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:37.497252 0.901984 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.351781 0.245711 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.596205 0.094159 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.671800 0.079793 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.734458 0.084132 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.802822 0.212264 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:38.980655 0.167973 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:39.123380 0.233812 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:39.334808 0.114226 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:39.453310 0.260155 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:39.677050 0.299647 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:39.955251 0.083124 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.018355 0.151212 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.127694 0.131360 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.269445 0.176717 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.437723 0.358021 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.766684 0.185899 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:40.897400 0.211594 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.063338 0.248086 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.304720 0.198517 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.497093 0.198383 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.693003 0.107886 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.796092 0.167209 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:41.942170 0.212369 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/02 12:48:47.231983 3.003894 tcp 10.0.2.105 60301 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:48:56.235048 0.000000 tcp 10.0.2.105 60301 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:01.071501 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:49:02.234826 0.053139 tcp 10.0.2.105 60302 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:02.288209 0.053284 tcp 10.0.2.105 60303 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:02.341776 0.150389 tcp 10.0.2.105 60304 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:02.600225 2.988112 tcp 10.0.2.105 60305 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:11.596902 0.000000 tcp 10.0.2.105 60305 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:17.595784 0.052101 tcp 10.0.2.105 60306 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:17.648198 0.052991 tcp 10.0.2.105 60307 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:17.701527 0.147834 tcp 10.0.2.105 60308 -> 195.113.214.236 443 SRPA* 0 0 40 34544 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:17.885539 2.994438 tcp 10.0.2.105 60309 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:26.878480 0.000000 tcp 10.0.2.105 60309 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:32.877781 0.051515 tcp 10.0.2.105 60310 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:32.929549 0.052897 tcp 10.0.2.105 60311 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:32.982773 0.147219 tcp 10.0.2.105 60312 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:49:33.211515 3.003269 tcp 10.0.2.105 60313 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:42.210692 0.000000 tcp 10.0.2.105 60313 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:48.209401 3.004126 tcp 10.0.2.105 60314 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:49:57.212123 0.000000 tcp 10.0.2.105 60314 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:50:02.069163 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:50:03.210975 3.004287 tcp 10.0.2.105 60315 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:50:12.213539 0.000000 tcp 10.0.2.105 60315 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:54:50.946784 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 12:54:57.954120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:55:05.956130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:55:18.214317 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:55:18.214480 2.993162 tcp 10.0.2.105 60316 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:55:21.959205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:55:27.216746 0.000000 tcp 10.0.2.105 60316 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:55:33.217594 0.052856 tcp 10.0.2.105 60317 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:33.270725 0.052298 tcp 10.0.2.105 60318 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:33.323282 0.149175 tcp 10.0.2.105 60319 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:33.523243 2.986662 tcp 10.0.2.105 60320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:55:42.508904 0.000000 tcp 10.0.2.105 60320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:55:48.517841 0.051517 tcp 10.0.2.105 60321 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:48.569640 0.051487 tcp 10.0.2.105 60322 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:48.621438 0.151749 tcp 10.0.2.105 60323 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:55:48.867069 3.005027 tcp 10.0.2.105 60324 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:55:53.965220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 12:55:57.870877 0.000000 tcp 10.0.2.105 60324 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:03.859944 0.051510 tcp 10.0.2.105 60325 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:56:03.911765 0.053364 tcp 10.0.2.105 60326 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:56:03.965399 0.147504 tcp 10.0.2.105 60327 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/02 12:56:04.450782 3.003925 tcp 10.0.2.105 60328 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:13.453407 0.000000 tcp 10.0.2.105 60328 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:19.451940 3.004507 tcp 10.0.2.105 60329 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:28.455180 0.000000 tcp 10.0.2.105 60329 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:33.071437 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 12:56:34.453396 2.994363 tcp 10.0.2.105 60330 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 12:56:43.456825 0.000000 tcp 10.0.2.105 60330 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:01:49.457205 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:01:49.457318 2.993359 tcp 10.0.2.105 60331 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:01:57.971543 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:01:58.449864 0.000000 tcp 10.0.2.105 60331 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:04.459416 0.052974 tcp 10.0.2.105 60332 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:04.512759 0.052523 tcp 10.0.2.105 60333 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:04.565613 0.152932 tcp 10.0.2.105 60334 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:04.734588 2.998192 tcp 10.0.2.105 60335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:04.980116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:02:12.980152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:02:13.731424 0.000000 tcp 10.0.2.105 60335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:19.730089 0.056152 tcp 10.0.2.105 60336 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:19.786473 0.051968 tcp 10.0.2.105 60337 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:19.838743 0.150228 tcp 10.0.2.105 60338 -> 195.113.214.236 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:20.009730 3.004944 tcp 10.0.2.105 60339 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:28.983255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:02:29.013149 0.000000 tcp 10.0.2.105 60339 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:35.002725 0.050804 tcp 10.0.2.105 60340 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:35.053808 0.053235 tcp 10.0.2.105 60341 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:35.107342 0.145714 tcp 10.0.2.105 60342 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:02:35.274923 3.001480 tcp 10.0.2.105 60343 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:44.275650 0.000000 tcp 10.0.2.105 60343 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:50.273936 2.994116 tcp 10.0.2.105 60344 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:02:59.276367 0.000000 tcp 10.0.2.105 60344 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:03:00.989423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:03:04.074531 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:03:05.275541 2.993999 tcp 10.0.2.105 60345 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:03:14.268186 0.000000 tcp 10.0.2.105 60345 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:20.278300 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:08:20.278447 3.004583 tcp 10.0.2.105 60346 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:29.281214 0.000000 tcp 10.0.2.105 60346 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:35.281403 0.052788 tcp 10.0.2.105 60347 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:35.334552 0.030926 tcp 10.0.2.105 60348 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:35.365741 0.206026 tcp 10.0.2.105 60349 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:35.582225 3.002479 tcp 10.0.2.105 60350 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:44.583123 0.000000 tcp 10.0.2.105 60350 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:50.582410 0.052248 tcp 10.0.2.105 60351 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:50.634509 0.031485 tcp 10.0.2.105 60352 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:50.666262 0.146838 tcp 10.0.2.105 60353 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:08:50.828527 3.007925 tcp 10.0.2.105 60354 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:08:59.835074 0.000000 tcp 10.0.2.105 60354 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:05.824616 0.051462 tcp 10.0.2.105 60355 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:09:05.876392 0.031621 tcp 10.0.2.105 60356 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:09:05.908412 0.145980 tcp 10.0.2.105 60357 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:09:06.081362 2.996999 tcp 10.0.2.105 60358 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:06.998689 3.000526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:09:14.005424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:09:15.086898 0.000000 tcp 10.0.2.105 60358 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:21.075810 2.993682 tcp 10.0.2.105 60359 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:22.006844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:09:30.068823 0.000000 tcp 10.0.2.105 60359 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:35.075683 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:09:36.077628 3.003749 tcp 10.0.2.105 60360 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:09:38.010059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:09:45.080112 0.000000 tcp 10.0.2.105 60360 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:10:10.015859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:16:14.022235 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 13:16:21.029547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:16:29.030790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:16:45.033622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:17:17.040087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:19:07.549444 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:19:07.549560 0.142713 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:07.705608 0.054560 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:07.812804 0.188386 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:07.993737 0.105007 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:08.129448 0.260971 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:08.342187 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 13:19:21.108817 3.003914 tcp 10.0.2.105 60361 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:19:25.176036 0.053041 tcp 10.0.2.105 60362 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:25.229388 0.053822 tcp 10.0.2.105 60363 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:25.283520 0.150205 tcp 10.0.2.105 60364 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:25.434257 0.089265 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:25.505648 0.079900 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:25.650616 0.076983 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:25.713438 0.212737 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:25.889098 0.169780 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.072564 0.262915 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.305009 0.240317 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.518164 0.110733 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.608051 0.236151 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.824682 0.089920 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:26.895855 0.191273 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.051138 0.145624 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.224786 0.175379 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.392824 0.210176 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.555930 0.356074 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.883507 0.167156 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:27.999065 0.224238 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:28.215336 0.199636 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:28.452934 0.236252 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:28.686670 0.214449 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:28.894261 0.110974 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:29.068585 0.169212 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:19:30.111177 0.000000 tcp 10.0.2.105 60361 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:19:36.110399 0.051403 tcp 10.0.2.105 60365 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:36.162104 0.098763 tcp 10.0.2.105 60366 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:36.261154 0.149807 tcp 10.0.2.105 60367 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:36.421714 3.003185 tcp 10.0.2.105 60368 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:19:45.423296 0.000000 tcp 10.0.2.105 60368 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:19:51.422416 0.051431 tcp 10.0.2.105 60369 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:51.474120 0.052391 tcp 10.0.2.105 60370 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:51.526793 0.142117 tcp 10.0.2.105 60371 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:19:51.854636 3.002407 tcp 10.0.2.105 60372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:20:00.854827 0.000000 tcp 10.0.2.105 60372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:20:06.855334 2.993149 tcp 10.0.2.105 60373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:20:15.857104 0.000000 tcp 10.0.2.105 60373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:20:20.573554 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:23:21.046688 3.000696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:23:28.053308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:23:36.054931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:23:52.058056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:24:24.063321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:25:21.857374 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:25:21.857519 3.003985 tcp 10.0.2.105 60374 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:25:30.859601 0.000000 tcp 10.0.2.105 60374 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:25:36.860104 0.052524 tcp 10.0.2.105 60375 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:36.912907 0.054440 tcp 10.0.2.105 60376 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:36.967624 0.147560 tcp 10.0.2.105 60377 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:37.134125 2.999053 tcp 10.0.2.105 60378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:25:46.131947 0.000000 tcp 10.0.2.105 60378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:25:52.130806 0.050813 tcp 10.0.2.105 60379 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:52.181941 0.053004 tcp 10.0.2.105 60380 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:52.235330 0.146821 tcp 10.0.2.105 60381 -> 195.113.214.236 443 SRPA* 0 0 26 16266 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:25:52.410894 3.004152 tcp 10.0.2.105 60382 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:01.413538 0.000000 tcp 10.0.2.105 60382 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:07.413258 0.050937 tcp 10.0.2.105 60383 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:26:07.464531 0.052200 tcp 10.0.2.105 60384 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:26:07.517103 0.146121 tcp 10.0.2.105 60385 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:26:07.681065 2.996198 tcp 10.0.2.105 60386 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:16.685779 0.000000 tcp 10.0.2.105 60386 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:22.674985 2.993953 tcp 10.0.2.105 60387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:31.677410 0.000000 tcp 10.0.2.105 60387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:36.574633 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:26:37.676507 2.993961 tcp 10.0.2.105 60388 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:26:46.668984 0.000000 tcp 10.0.2.105 60388 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:30:28.069872 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:30:35.077343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:30:43.078556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:30:59.081935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:31:31.089965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:31:52.679719 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:31:52.679825 3.003369 tcp 10.0.2.105 60389 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:01.681591 0.000000 tcp 10.0.2.105 60389 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:07.682618 0.052747 tcp 10.0.2.105 60390 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:07.735664 0.053635 tcp 10.0.2.105 60391 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:07.789627 0.145441 tcp 10.0.2.105 60392 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:08.194669 3.000853 tcp 10.0.2.105 60393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:17.193576 0.000000 tcp 10.0.2.105 60393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:23.193259 0.051801 tcp 10.0.2.105 60394 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:23.245340 0.052302 tcp 10.0.2.105 60395 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:23.297934 0.147807 tcp 10.0.2.105 60396 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:23.461565 3.005931 tcp 10.0.2.105 60397 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:32.476377 0.000000 tcp 10.0.2.105 60397 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:38.455194 0.052183 tcp 10.0.2.105 60398 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:38.507661 0.051971 tcp 10.0.2.105 60399 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:38.559934 0.150519 tcp 10.0.2.105 60400 -> 195.113.214.236 443 SRPA* 0 0 42 37026 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:32:38.722308 2.997007 tcp 10.0.2.105 60401 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:47.718083 0.000000 tcp 10.0.2.105 60401 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:32:53.716843 2.994182 tcp 10.0.2.105 60402 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:33:02.709239 0.000000 tcp 10.0.2.105 60402 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:33:07.579336 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:33:08.719162 3.003444 tcp 10.0.2.105 60403 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:33:17.721006 0.000000 tcp 10.0.2.105 60403 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:37:35.093724 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:37:42.103523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:37:50.102816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:38:06.105440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:38:23.721836 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:38:23.721930 3.003509 tcp 10.0.2.105 60404 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:38:32.724156 0.000000 tcp 10.0.2.105 60404 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:38:38.111949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:38:38.724699 0.052844 tcp 10.0.2.105 60405 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:38.777832 0.054414 tcp 10.0.2.105 60406 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:38.832572 0.149267 tcp 10.0.2.105 60407 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:38.993050 3.004216 tcp 10.0.2.105 60408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:38:48.006222 0.000000 tcp 10.0.2.105 60408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:38:53.995423 0.051694 tcp 10.0.2.105 60409 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:54.047399 0.053552 tcp 10.0.2.105 60410 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:54.101199 0.151994 tcp 10.0.2.105 60411 -> 195.113.214.236 443 SRPA* 0 0 46 34865 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:38:54.263636 2.995565 tcp 10.0.2.105 60412 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:03.257882 0.000000 tcp 10.0.2.105 60412 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:09.257627 0.052279 tcp 10.0.2.105 60413 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:39:09.310237 0.051872 tcp 10.0.2.105 60414 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:39:09.362447 0.149403 tcp 10.0.2.105 60415 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:39:09.537680 3.003978 tcp 10.0.2.105 60416 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:18.539901 0.000000 tcp 10.0.2.105 60416 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:24.538739 3.004195 tcp 10.0.2.105 60417 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:33.541418 0.000000 tcp 10.0.2.105 60417 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:38.067839 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:39:39.540496 3.004264 tcp 10.0.2.105 60418 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:39:48.543089 0.000000 tcp 10.0.2.105 60418 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:44:42.121305 2.997920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:44:49.125253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:44:54.543859 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:44:54.543997 3.003834 tcp 10.0.2.105 60419 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:44:57.127064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:45:03.556059 0.000000 tcp 10.0.2.105 60419 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:45:09.546851 0.054596 tcp 10.0.2.105 60420 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:45:09.601785 0.053106 tcp 10.0.2.105 60421 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:45:09.655165 0.150569 tcp 10.0.2.105 60422 -> 195.113.214.236 443 SRPA* 0 0 40 33954 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:45:09.834006 2.995096 tcp 10.0.2.105 60423 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:45:13.129320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:45:18.827801 0.000000 tcp 10.0.2.105 60423 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:45:45.137040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:49:37.990913 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:49:37.991101 0.241885 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:38.231442 0.188116 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:38.412163 0.104803 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:38.651463 0.168235 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:38.820954 0.058266 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:38.866217 0.248735 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.067566 0.079906 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.158683 0.210433 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.334715 0.171863 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.483445 0.091472 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.556759 0.079108 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.619452 0.274897 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2006 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:39.860337 0.238097 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.075191 0.112988 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.156572 0.414051 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.550389 0.093051 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.624610 0.132789 udp 10.0.2.105 7010 <-> 79.46.220.240 2977 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.722309 0.145522 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:40.923990 0.354256 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:41.250800 0.210391 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:41.405708 0.172672 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:41.570388 0.320497 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:41.845206 0.228971 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:42.066673 0.206355 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:42.263046 0.234918 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:42.495253 0.220069 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:42.705409 0.105714 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:49:42.805697 0.167404 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/02 13:50:24.828298 3.003860 tcp 10.0.2.105 60424 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:50:29.574778 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:50:33.830523 0.000000 tcp 10.0.2.105 60424 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:50:39.830914 0.053256 tcp 10.0.2.105 60425 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:39.884455 0.052916 tcp 10.0.2.105 60426 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:39.937628 0.151450 tcp 10.0.2.105 60427 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:40.167515 3.006706 tcp 10.0.2.105 60428 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:50:49.173065 0.000000 tcp 10.0.2.105 60428 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:50:55.161990 0.051802 tcp 10.0.2.105 60429 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:55.214045 0.052529 tcp 10.0.2.105 60430 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:55.266864 0.149102 tcp 10.0.2.105 60431 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:50:55.513470 3.003077 tcp 10.0.2.105 60432 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:04.515124 0.000000 tcp 10.0.2.105 60432 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:10.514157 0.050883 tcp 10.0.2.105 60433 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:51:10.565312 0.052835 tcp 10.0.2.105 60434 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:51:10.618426 0.147629 tcp 10.0.2.105 60435 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:51:10.793222 2.995065 tcp 10.0.2.105 60436 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:19.796878 0.000000 tcp 10.0.2.105 60436 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:25.785545 2.994002 tcp 10.0.2.105 60437 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:34.778306 0.000000 tcp 10.0.2.105 60437 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:39.575278 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:51:40.787018 3.004503 tcp 10.0.2.105 60438 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:49.141221 3.005007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:51:49.789514 0.000000 tcp 10.0.2.105 60438 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:51:56.152857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:52:04.153890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:52:20.153561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:52:52.159854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:56:55.790193 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:56:55.790356 3.004000 tcp 10.0.2.105 60439 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:04.792895 0.000000 tcp 10.0.2.105 60439 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:10.793237 0.052718 tcp 10.0.2.105 60440 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:10.846232 0.052466 tcp 10.0.2.105 60441 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:10.899055 0.147564 tcp 10.0.2.105 60442 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:11.075532 3.000926 tcp 10.0.2.105 60443 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:20.074814 0.000000 tcp 10.0.2.105 60443 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:26.074403 0.051947 tcp 10.0.2.105 60444 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:26.126678 0.052866 tcp 10.0.2.105 60445 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:26.179869 0.142952 tcp 10.0.2.105 60446 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:26.438772 2.999803 tcp 10.0.2.105 60447 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:35.447064 0.000000 tcp 10.0.2.105 60447 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:41.436087 0.052385 tcp 10.0.2.105 60448 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:41.488728 0.051602 tcp 10.0.2.105 60449 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:41.540610 0.221131 tcp 10.0.2.105 60450 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 13:57:41.781002 2.999397 tcp 10.0.2.105 60451 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:50.778734 0.000000 tcp 10.0.2.105 60451 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:57:56.777887 3.004347 tcp 10.0.2.105 60452 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:58:05.780146 0.000000 tcp 10.0.2.105 60452 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:58:10.567411 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 13:58:11.778908 3.007084 tcp 10.0.2.105 60453 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:58:20.782659 0.000000 tcp 10.0.2.105 60453 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 13:58:56.166009 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 13:59:03.173467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:59:11.174780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:59:27.178016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 13:59:59.183705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:03:26.782892 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:03:26.783137 3.003333 tcp 10.0.2.105 60454 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:03:35.784974 0.000000 tcp 10.0.2.105 60454 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:03:41.785300 0.052767 tcp 10.0.2.105 60455 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:41.838335 0.052715 tcp 10.0.2.105 60456 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:41.891340 0.145682 tcp 10.0.2.105 60457 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:42.047068 3.000991 tcp 10.0.2.105 60458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:03:51.057315 0.000000 tcp 10.0.2.105 60458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:03:57.046329 0.051608 tcp 10.0.2.105 60459 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:57.098223 0.053325 tcp 10.0.2.105 60460 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:57.151853 0.144645 tcp 10.0.2.105 60461 -> 195.113.214.236 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:03:57.308153 3.002538 tcp 10.0.2.105 60462 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:06.309017 0.000000 tcp 10.0.2.105 60462 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:12.308443 0.052267 tcp 10.0.2.105 60463 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:04:12.361079 0.052814 tcp 10.0.2.105 60464 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:04:12.414182 0.155080 tcp 10.0.2.105 60465 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:04:12.588524 3.004245 tcp 10.0.2.105 60466 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:21.591199 0.000000 tcp 10.0.2.105 60466 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:27.590020 3.007261 tcp 10.0.2.105 60467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:36.593100 0.000000 tcp 10.0.2.105 60467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:41.569983 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:04:42.591399 3.004260 tcp 10.0.2.105 60468 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:04:51.597304 0.000000 tcp 10.0.2.105 60468 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:06:13.194356 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:06:20.201597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:06:28.203143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:06:44.206009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:07:17.921684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:09:57.594737 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:09:57.594840 2.993553 tcp 10.0.2.105 60469 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:06.596922 0.000000 tcp 10.0.2.105 60469 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:12.597628 0.052856 tcp 10.0.2.105 60470 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:12.650765 0.053653 tcp 10.0.2.105 60471 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:12.704684 0.147327 tcp 10.0.2.105 60472 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:12.861630 2.998507 tcp 10.0.2.105 60473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:21.858744 0.000000 tcp 10.0.2.105 60473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:27.858177 0.051939 tcp 10.0.2.105 60474 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:27.910376 0.052885 tcp 10.0.2.105 60475 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:27.963579 0.149902 tcp 10.0.2.105 60476 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:28.134227 2.998123 tcp 10.0.2.105 60477 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:37.130521 0.000000 tcp 10.0.2.105 60477 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:43.130505 0.052266 tcp 10.0.2.105 60478 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:43.183023 0.053765 tcp 10.0.2.105 60479 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:43.237107 0.149548 tcp 10.0.2.105 60480 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:10:43.460879 3.003840 tcp 10.0.2.105 60481 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:52.463021 0.000000 tcp 10.0.2.105 60481 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:10:58.462166 3.003919 tcp 10.0.2.105 60482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:11:07.463989 0.000000 tcp 10.0.2.105 60482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:11:12.071314 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:11:13.463549 2.993838 tcp 10.0.2.105 60483 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:11:22.465925 0.000000 tcp 10.0.2.105 60483 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:13:20.228364 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:13:27.235650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:13:35.237002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:13:51.240303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:14:23.246218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:19:45.429547 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:19:45.429654 0.259373 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:45.687308 0.150842 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:45.833913 0.050829 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:45.972284 0.189689 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.154704 0.095349 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.282777 0.258202 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.493505 0.079054 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.556494 0.209945 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.731739 0.168315 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.876125 0.091958 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:46.950611 0.078802 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.057641 0.111957 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.130441 0.250083 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.347321 0.274791 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.597678 0.235880 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.813106 0.087536 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:19:47.916860 0.000000 udp 10.0.2.105 7010 -> 79.46.220.240 2977 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 14:19:58.488461 3.004158 tcp 10.0.2.105 60484 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:03.427573 0.054204 tcp 10.0.2.105 60485 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:03.482012 0.052663 tcp 10.0.2.105 60486 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:03.535051 0.149271 tcp 10.0.2.105 60487 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:03.684850 0.124735 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:03.901214 0.174196 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:04.067837 0.352910 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:04.392526 0.300726 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:04.584960 3.547885 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:07.492680 0.000000 tcp 10.0.2.105 60484 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:08.088265 0.228649 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:08.309756 0.202760 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:08.503667 0.106997 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:08.605566 0.169264 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:08.851188 0.258243 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:09.106305 0.213683 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:20:13.493977 0.051229 tcp 10.0.2.105 60488 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:13.545456 0.052529 tcp 10.0.2.105 60489 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:13.598243 0.205365 tcp 10.0.2.105 60490 -> 195.113.214.236 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:14.618677 3.002584 tcp 10.0.2.105 60491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:23.614117 0.000000 tcp 10.0.2.105 60491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:27.252641 3.000925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:20:29.613432 0.050573 tcp 10.0.2.105 60492 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:29.664270 0.053963 tcp 10.0.2.105 60493 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:29.718534 0.145374 tcp 10.0.2.105 60494 -> 195.113.214.236 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:29.955027 2.997925 tcp 10.0.2.105 60495 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:34.263176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:20:38.956384 0.000000 tcp 10.0.2.105 60495 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:42.260913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:20:44.955599 0.051932 tcp 10.0.2.105 60496 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:45.007846 0.053243 tcp 10.0.2.105 60497 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:45.061430 0.148825 tcp 10.0.2.105 60498 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:20:45.254295 2.995840 tcp 10.0.2.105 60499 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:54.247999 0.000000 tcp 10.0.2.105 60499 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:20:58.264009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:21:00.246990 2.994251 tcp 10.0.2.105 60500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:21:09.239983 0.000000 tcp 10.0.2.105 60500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:21:14.066664 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:21:15.248498 3.004155 tcp 10.0.2.105 60501 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:21:24.251440 0.000000 tcp 10.0.2.105 60501 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:21:30.270083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:26:30.251914 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:26:30.252012 3.003475 tcp 10.0.2.105 60502 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:26:39.254179 0.000000 tcp 10.0.2.105 60502 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:26:45.255015 0.052512 tcp 10.0.2.105 60503 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:26:45.307836 0.053265 tcp 10.0.2.105 60504 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:26:45.361442 0.151026 tcp 10.0.2.105 60505 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:26:45.576106 2.990946 tcp 10.0.2.105 60506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:26:54.576191 0.000000 tcp 10.0.2.105 60506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:00.575701 0.052927 tcp 10.0.2.105 60507 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:00.628946 0.053777 tcp 10.0.2.105 60508 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:00.682979 0.145259 tcp 10.0.2.105 60509 -> 195.113.214.236 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:00.842278 2.997089 tcp 10.0.2.105 60510 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:09.837814 0.000000 tcp 10.0.2.105 60510 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:15.837307 0.052955 tcp 10.0.2.105 60511 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:15.890578 0.051517 tcp 10.0.2.105 60512 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:15.942339 0.142168 tcp 10.0.2.105 60513 -> 195.113.214.236 443 SRPA* 0 0 45 41208 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:27:16.202433 2.999602 tcp 10.0.2.105 60514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:25.200365 0.000000 tcp 10.0.2.105 60514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:31.198930 3.004245 tcp 10.0.2.105 60515 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:34.276137 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:27:40.201804 0.000000 tcp 10.0.2.105 60515 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:41.283563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:27:45.068703 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:27:46.200603 3.004281 tcp 10.0.2.105 60516 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:27:49.284924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:27:55.203583 0.000000 tcp 10.0.2.105 60516 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:28:05.287666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:28:37.293946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:33:01.204082 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:33:01.204189 2.993594 tcp 10.0.2.105 60517 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:10.205821 0.000000 tcp 10.0.2.105 60517 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:16.206749 0.051969 tcp 10.0.2.105 60518 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:16.258988 0.052652 tcp 10.0.2.105 60519 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:16.311883 0.150807 tcp 10.0.2.105 60520 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:16.581638 2.998153 tcp 10.0.2.105 60521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:25.578687 0.000000 tcp 10.0.2.105 60521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:31.577741 0.051675 tcp 10.0.2.105 60522 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:31.629691 0.054289 tcp 10.0.2.105 60523 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:31.684372 0.148908 tcp 10.0.2.105 60524 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:31.921326 3.000642 tcp 10.0.2.105 60525 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:40.920534 0.000000 tcp 10.0.2.105 60525 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:46.919564 0.054377 tcp 10.0.2.105 60526 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:46.974224 0.053167 tcp 10.0.2.105 60527 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:47.027708 0.149416 tcp 10.0.2.105 60528 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:33:47.200604 3.003233 tcp 10.0.2.105 60529 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:33:56.202709 0.000000 tcp 10.0.2.105 60529 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:34:02.201290 3.004294 tcp 10.0.2.105 60530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:34:11.203792 0.000000 tcp 10.0.2.105 60530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:34:16.070658 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:34:17.202852 3.004179 tcp 10.0.2.105 60531 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:34:26.205483 0.000000 tcp 10.0.2.105 60531 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:34:41.300670 3.000916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:34:48.307525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:34:56.308523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:35:12.313000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:35:44.318032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:39:32.206292 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:39:32.206407 2.993287 tcp 10.0.2.105 60532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:39:41.197891 0.000000 tcp 10.0.2.105 60532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:39:47.208600 0.052453 tcp 10.0.2.105 60533 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:39:47.261389 0.052562 tcp 10.0.2.105 60534 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:39:47.314304 0.143549 tcp 10.0.2.105 60535 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:39:47.469283 3.002571 tcp 10.0.2.105 60536 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:39:56.470466 0.000000 tcp 10.0.2.105 60536 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:02.469692 0.051826 tcp 10.0.2.105 60537 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:02.521834 0.051987 tcp 10.0.2.105 60538 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:02.574124 0.146892 tcp 10.0.2.105 60539 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:02.730538 3.003180 tcp 10.0.2.105 60540 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:11.732508 0.000000 tcp 10.0.2.105 60540 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:17.732082 0.051328 tcp 10.0.2.105 60541 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:17.783707 0.053187 tcp 10.0.2.105 60542 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:17.837218 0.142459 tcp 10.0.2.105 60543 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:40:17.996643 2.999275 tcp 10.0.2.105 60544 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:26.994601 0.000000 tcp 10.0.2.105 60544 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:32.993211 2.993906 tcp 10.0.2.105 60545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:41.995745 0.000000 tcp 10.0.2.105 60545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:46.572803 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:40:47.994907 2.993805 tcp 10.0.2.105 60546 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:40:56.987314 0.000000 tcp 10.0.2.105 60546 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:41:48.323999 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:41:55.331456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:42:03.333177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:42:19.336117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:42:51.341833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:50:19.366638 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:50:19.366754 0.000000 udp 10.0.2.105 7010 -> 79.46.220.240 2977 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 14:50:37.884443 0.075963 tcp 10.0.2.105 60547 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:50:37.960701 0.052588 tcp 10.0.2.105 60548 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:50:38.013570 0.150955 tcp 10.0.2.105 60549 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:50:38.165450 0.051923 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:38.235373 0.188859 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:38.416181 0.245218 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:38.659273 0.140857 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:38.837656 0.252399 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:39.042692 0.076774 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:39.146843 0.211488 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:39.324605 0.101256 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:39.843529 0.089242 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:39.913779 0.082287 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:40.162359 0.110177 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:40.240998 0.173862 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:40.515983 0.262585 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:40.757106 0.090815 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:40.881882 0.244147 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 3 882 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:41.119737 0.259491 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:41.339543 0.124349 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:41.496788 0.172809 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:41.661918 0.353893 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:41.988272 0.176001 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:42.110312 0.277754 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:42.342062 0.225895 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:42.560438 0.199494 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:42.754473 0.106949 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:42.856182 0.167640 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:43.036044 0.263307 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:43.295460 0.210382 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/02 14:50:48.027673 3.004912 tcp 10.0.2.105 60550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:50:57.030164 0.000000 tcp 10.0.2.105 60550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:01.566936 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:51:03.029696 0.050554 tcp 10.0.2.105 60551 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:03.080619 0.053121 tcp 10.0.2.105 60552 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:03.134058 0.143728 tcp 10.0.2.105 60553 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:03.319200 3.004353 tcp 10.0.2.105 60554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:12.322204 0.000000 tcp 10.0.2.105 60554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:18.321132 0.051454 tcp 10.0.2.105 60555 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:18.372853 0.051775 tcp 10.0.2.105 60556 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:18.424907 0.146002 tcp 10.0.2.105 60557 -> 195.113.214.236 443 SRPA* 0 0 35 18828 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:18.623193 3.002370 tcp 10.0.2.105 60558 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:27.624222 0.000000 tcp 10.0.2.105 60558 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:33.623539 0.051813 tcp 10.0.2.105 60559 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:33.675569 0.051486 tcp 10.0.2.105 60560 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:33.727414 0.147637 tcp 10.0.2.105 60561 -> 195.113.214.236 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:51:33.902544 2.995021 tcp 10.0.2.105 60562 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:42.906328 0.000000 tcp 10.0.2.105 60562 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:48.894423 2.994796 tcp 10.0.2.105 60563 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:51:57.897667 0.000000 tcp 10.0.2.105 60563 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:52:02.574470 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:52:03.896572 2.993963 tcp 10.0.2.105 60564 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:52:12.889179 0.000000 tcp 10.0.2.105 60564 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:53:23.352317 3.002825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 14:53:30.364090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:53:38.362060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:53:54.365233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:54:26.371247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 14:57:18.899894 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:57:18.900002 3.003762 tcp 10.0.2.105 60565 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:57:27.902272 0.000000 tcp 10.0.2.105 60565 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:57:33.902118 0.052130 tcp 10.0.2.105 60566 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:33.954552 0.052775 tcp 10.0.2.105 60567 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:34.007566 0.149552 tcp 10.0.2.105 60568 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:34.181462 3.004315 tcp 10.0.2.105 60569 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:57:43.184237 0.000000 tcp 10.0.2.105 60569 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:57:49.183591 0.050676 tcp 10.0.2.105 60570 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:49.234535 0.051759 tcp 10.0.2.105 60571 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:49.286622 0.148265 tcp 10.0.2.105 60572 -> 195.113.214.236 443 SRPA* 0 0 29 19096 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:57:49.486907 3.000564 tcp 10.0.2.105 60573 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:57:58.496989 0.000000 tcp 10.0.2.105 60573 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:04.485400 0.051622 tcp 10.0.2.105 60574 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:58:04.537286 0.053169 tcp 10.0.2.105 60575 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:58:04.590849 0.146309 tcp 10.0.2.105 60576 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 14:58:04.781387 2.997686 tcp 10.0.2.105 60577 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:13.777968 0.000000 tcp 10.0.2.105 60577 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:19.776952 2.994282 tcp 10.0.2.105 60578 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:28.769643 0.000000 tcp 10.0.2.105 60578 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:33.566962 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 14:58:34.778129 3.004687 tcp 10.0.2.105 60579 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 14:58:43.781303 0.000000 tcp 10.0.2.105 60579 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:00:30.377746 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:00:37.384960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:00:45.387259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:01:01.389177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:01:33.395008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:03:49.781738 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:03:49.781937 3.004012 tcp 10.0.2.105 60580 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:03:58.784191 0.000000 tcp 10.0.2.105 60580 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:04.784792 0.052369 tcp 10.0.2.105 60581 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:04.837417 0.054589 tcp 10.0.2.105 60582 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:04.892266 0.143915 tcp 10.0.2.105 60583 -> 195.113.214.236 443 SRPA* 0 0 40 31068 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:05.047382 3.000014 tcp 10.0.2.105 60584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:14.056180 0.000000 tcp 10.0.2.105 60584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:20.045684 0.050928 tcp 10.0.2.105 60585 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:20.096865 0.052442 tcp 10.0.2.105 60586 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:20.149589 0.147039 tcp 10.0.2.105 60587 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:20.319954 2.999576 tcp 10.0.2.105 60588 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:29.318125 0.000000 tcp 10.0.2.105 60588 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:35.320684 0.051239 tcp 10.0.2.105 60589 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:35.372204 0.052534 tcp 10.0.2.105 60590 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:35.425029 0.145182 tcp 10.0.2.105 60591 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:04:35.583834 2.997704 tcp 10.0.2.105 60592 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:44.579877 0.000000 tcp 10.0.2.105 60592 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:50.578880 3.004228 tcp 10.0.2.105 60593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:04:59.581814 0.000000 tcp 10.0.2.105 60593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:05:04.568919 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:05:05.580425 3.004602 tcp 10.0.2.105 60594 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:05:14.583532 0.000000 tcp 10.0.2.105 60594 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:07:37.401915 3.001092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:07:44.408449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:07:52.409926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:08:08.413149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:08:40.419304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:10:20.583761 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:10:20.583912 2.993461 tcp 10.0.2.105 60595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:10:29.586141 0.000000 tcp 10.0.2.105 60595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:10:35.586430 0.053714 tcp 10.0.2.105 60596 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:35.640468 0.053044 tcp 10.0.2.105 60597 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:35.693873 0.148696 tcp 10.0.2.105 60598 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:35.853963 2.995910 tcp 10.0.2.105 60599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:10:44.847831 0.000000 tcp 10.0.2.105 60599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:10:50.847407 0.052262 tcp 10.0.2.105 60600 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:50.899960 0.052847 tcp 10.0.2.105 60601 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:50.953198 0.141137 tcp 10.0.2.105 60602 -> 195.113.214.236 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:10:51.103936 2.997354 tcp 10.0.2.105 60603 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:00.100168 0.000000 tcp 10.0.2.105 60603 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:06.098778 0.052744 tcp 10.0.2.105 60604 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:11:06.151792 0.052274 tcp 10.0.2.105 60605 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:11:06.204328 0.152077 tcp 10.0.2.105 60606 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:11:06.365896 2.997227 tcp 10.0.2.105 60607 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:15.361882 0.000000 tcp 10.0.2.105 60607 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:21.361115 3.003804 tcp 10.0.2.105 60608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:30.363521 0.000000 tcp 10.0.2.105 60608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:35.070332 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:11:36.362320 3.003700 tcp 10.0.2.105 60609 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:11:45.365243 0.000000 tcp 10.0.2.105 60609 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:14:44.426120 3.000762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:14:51.432661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:14:59.433832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:15:15.437005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:15:47.443401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:21:01.855549 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:21:01.855670 0.261697 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.116131 0.151469 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.283167 0.055242 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.414126 0.187275 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.593898 0.255129 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.797879 0.076111 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:02.960765 0.213811 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.139427 0.076073 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.316544 0.103932 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.581931 0.089314 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.654082 0.258578 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.890449 0.106173 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:03.959190 0.170586 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.106766 0.085742 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.201001 0.275499 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.453648 0.252874 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.670429 0.131513 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.849904 0.167884 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:04.962413 0.174992 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:05.129798 0.349770 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:05.449961 0.212061 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:05.614792 0.226407 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:05.833588 0.200721 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:06.024612 0.301845 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:06.322846 0.213783 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:06.392442 3.003885 tcp 10.0.2.105 60610 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:06.528628 0.105879 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:06.629355 0.169482 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:21:15.394457 0.000000 tcp 10.0.2.105 60610 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:21.394920 0.053445 tcp 10.0.2.105 60611 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:21.448630 0.052485 tcp 10.0.2.105 60612 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:21.501371 0.145167 tcp 10.0.2.105 60613 -> 195.113.214.236 443 SRPA* 0 0 21 11362 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:21.694248 2.993405 tcp 10.0.2.105 60614 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:30.696636 0.000000 tcp 10.0.2.105 60614 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:36.695824 0.051840 tcp 10.0.2.105 60615 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:36.747919 0.054463 tcp 10.0.2.105 60616 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:36.802689 0.144756 tcp 10.0.2.105 60617 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:36.969422 3.000542 tcp 10.0.2.105 60618 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:45.968938 0.000000 tcp 10.0.2.105 60618 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:51.448882 3.002095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:21:51.967533 0.052787 tcp 10.0.2.105 60619 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:52.020512 0.054554 tcp 10.0.2.105 60620 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:52.075425 0.151404 tcp 10.0.2.105 60621 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:21:52.274754 2.997394 tcp 10.0.2.105 60622 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:21:58.456713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:22:01.270772 0.000000 tcp 10.0.2.105 60622 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:22:06.457607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:22:07.269819 3.003747 tcp 10.0.2.105 60623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:22:16.272271 0.000000 tcp 10.0.2.105 60623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:22:21.068803 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:22:22.270413 3.004667 tcp 10.0.2.105 60624 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:22:22.460947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:22:31.274872 0.000000 tcp 10.0.2.105 60624 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:22:54.469702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:27:37.274120 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:27:37.274350 2.993347 tcp 10.0.2.105 60625 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:27:46.276682 0.000000 tcp 10.0.2.105 60625 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:27:52.277615 0.053202 tcp 10.0.2.105 60626 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:27:52.331103 0.054750 tcp 10.0.2.105 60627 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:27:52.386128 0.145797 tcp 10.0.2.105 60628 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:27:52.545787 2.994100 tcp 10.0.2.105 60629 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:01.538246 0.000000 tcp 10.0.2.105 60629 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:07.537905 0.053207 tcp 10.0.2.105 60630 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:07.591401 0.054194 tcp 10.0.2.105 60631 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:07.645859 0.150317 tcp 10.0.2.105 60632 -> 195.113.214.236 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:07.853116 2.998771 tcp 10.0.2.105 60633 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:16.850644 0.000000 tcp 10.0.2.105 60633 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:22.849523 0.052479 tcp 10.0.2.105 60634 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:22.902284 0.054480 tcp 10.0.2.105 60635 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:22.957069 0.149191 tcp 10.0.2.105 60636 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:28:23.116657 2.997247 tcp 10.0.2.105 60637 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:32.113174 0.000000 tcp 10.0.2.105 60637 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:38.121180 2.994261 tcp 10.0.2.105 60638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:47.114197 0.000000 tcp 10.0.2.105 60638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:52.070749 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:28:53.112722 3.004314 tcp 10.0.2.105 60639 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:28:58.473325 3.001604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:29:02.115664 0.000000 tcp 10.0.2.105 60639 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:29:05.480865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:29:13.482170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:29:29.485294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:30:01.491101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:34:08.116509 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:34:08.116598 2.993198 tcp 10.0.2.105 60640 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:17.108465 0.000000 tcp 10.0.2.105 60640 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:23.119072 0.053389 tcp 10.0.2.105 60641 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:23.172744 0.053692 tcp 10.0.2.105 60642 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:23.226744 0.144708 tcp 10.0.2.105 60643 -> 195.113.214.236 443 SRPA* 0 0 47 33484 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:23.381574 3.000437 tcp 10.0.2.105 60644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:32.380488 0.000000 tcp 10.0.2.105 60644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:38.379768 0.052213 tcp 10.0.2.105 60645 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:38.432395 0.053432 tcp 10.0.2.105 60646 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:38.486164 0.147842 tcp 10.0.2.105 60647 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:38.876376 2.997629 tcp 10.0.2.105 60648 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:47.873015 0.000000 tcp 10.0.2.105 60648 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:34:53.872020 0.052047 tcp 10.0.2.105 60649 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:53.924383 0.054827 tcp 10.0.2.105 60650 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:53.979501 0.148186 tcp 10.0.2.105 60651 -> 195.113.214.236 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:34:54.139530 3.006555 tcp 10.0.2.105 60652 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:35:03.144755 0.000000 tcp 10.0.2.105 60652 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:35:09.133011 3.004398 tcp 10.0.2.105 60653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:35:18.146596 0.000000 tcp 10.0.2.105 60653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:35:23.073359 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:35:24.135031 2.994425 tcp 10.0.2.105 60654 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:35:33.127372 0.000000 tcp 10.0.2.105 60654 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:36:05.497433 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:36:12.504368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:36:20.506064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:36:36.508990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:37:08.515379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:40:39.138654 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:40:39.138890 3.003216 tcp 10.0.2.105 60655 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:40:48.140641 0.000000 tcp 10.0.2.105 60655 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:40:54.141475 0.053002 tcp 10.0.2.105 60656 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:40:54.194757 0.054037 tcp 10.0.2.105 60657 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:40:54.249095 0.144461 tcp 10.0.2.105 60658 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:40:54.514753 2.999213 tcp 10.0.2.105 60659 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:03.512909 0.000000 tcp 10.0.2.105 60659 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:09.512423 0.052153 tcp 10.0.2.105 60660 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:09.564877 0.053970 tcp 10.0.2.105 60661 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:09.619132 0.150150 tcp 10.0.2.105 60662 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:09.801883 3.004112 tcp 10.0.2.105 60663 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:18.804728 0.000000 tcp 10.0.2.105 60663 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:24.794078 0.052491 tcp 10.0.2.105 60664 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:24.846844 0.053237 tcp 10.0.2.105 60665 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:24.900417 0.145267 tcp 10.0.2.105 60666 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:41:25.314083 2.994314 tcp 10.0.2.105 60667 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:34.316939 0.000000 tcp 10.0.2.105 60667 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:40.316142 2.993888 tcp 10.0.2.105 60668 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:49.309064 0.000000 tcp 10.0.2.105 60668 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:41:54.075371 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:41:55.317286 3.004576 tcp 10.0.2.105 60669 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:42:04.320602 0.000000 tcp 10.0.2.105 60669 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:43:12.520769 3.002206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:43:19.529314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:43:27.535824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:43:43.532897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:44:15.539071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:51:19.739714 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:51:19.739915 0.240759 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.089041 0.188767 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.270433 0.260014 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.482784 0.080623 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.559514 0.215803 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2625 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.736730 0.157629 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:20.989685 0.054643 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.087349 0.078377 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.145826 0.100592 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 1953 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.258666 0.090148 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.330723 0.253175 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.562554 0.113223 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.634055 0.171666 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.782880 0.087388 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:21.925858 0.138846 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:22.068753 0.187122 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2611 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:22.197261 0.173941 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:22.363780 0.255423 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:22.591582 0.252716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:22.806932 0.350990 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:23.132650 0.363148 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:23.448499 0.222162 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:23.663667 0.207759 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:23.861780 0.107128 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:23.964019 0.168150 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:24.109312 0.229189 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:24.335629 0.212452 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/02 15:51:25.347553 3.003748 tcp 10.0.2.105 60670 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:51:34.352116 0.000000 tcp 10.0.2.105 60670 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:51:40.350382 0.052345 tcp 10.0.2.105 60671 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:40.403014 0.052325 tcp 10.0.2.105 60672 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:40.455620 0.150855 tcp 10.0.2.105 60673 -> 195.113.214.236 443 SRPA* 0 0 38 21716 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:40.650604 3.002758 tcp 10.0.2.105 60674 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:51:49.651864 0.000000 tcp 10.0.2.105 60674 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:51:55.651194 0.052714 tcp 10.0.2.105 60675 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:55.703725 0.052639 tcp 10.0.2.105 60676 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:55.756734 0.147117 tcp 10.0.2.105 60677 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:51:55.934556 3.000170 tcp 10.0.2.105 60678 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:04.933944 0.000000 tcp 10.0.2.105 60678 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:10.934664 0.051146 tcp 10.0.2.105 60679 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:52:10.986152 0.053595 tcp 10.0.2.105 60680 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:52:11.040044 0.144836 tcp 10.0.2.105 60681 -> 195.113.214.236 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:52:11.240134 3.011390 tcp 10.0.2.105 60682 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:20.257039 0.000000 tcp 10.0.2.105 60682 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:26.235274 2.994213 tcp 10.0.2.105 60683 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:35.230856 0.000000 tcp 10.0.2.105 60683 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:40.074231 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:52:41.236628 2.993463 tcp 10.0.2.105 60684 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:52:50.228882 0.000000 tcp 10.0.2.105 60684 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:54:05.554015 2.997771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 15:54:12.557355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:54:20.559059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:54:36.562016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:55:08.569923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 15:57:56.239427 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:57:56.239655 3.003616 tcp 10.0.2.105 60685 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:05.241788 0.000000 tcp 10.0.2.105 60685 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:11.241703 0.053010 tcp 10.0.2.105 60686 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:11.295006 0.052401 tcp 10.0.2.105 60687 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:11.347663 0.141697 tcp 10.0.2.105 60688 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:11.646080 2.999159 tcp 10.0.2.105 60689 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:20.643951 0.000000 tcp 10.0.2.105 60689 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:26.643829 0.052080 tcp 10.0.2.105 60690 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:26.695922 0.052261 tcp 10.0.2.105 60691 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:26.748469 0.150586 tcp 10.0.2.105 60692 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:26.930750 3.006523 tcp 10.0.2.105 60693 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:35.946260 0.000000 tcp 10.0.2.105 60693 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:41.925465 0.050652 tcp 10.0.2.105 60694 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:41.976375 0.052436 tcp 10.0.2.105 60695 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:42.029082 0.144062 tcp 10.0.2.105 60696 -> 195.113.214.236 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/02 15:58:42.190032 2.999375 tcp 10.0.2.105 60697 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:51.188027 0.000000 tcp 10.0.2.105 60697 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:58:57.187032 2.993738 tcp 10.0.2.105 60698 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:59:06.179738 0.000000 tcp 10.0.2.105 60698 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:59:11.066694 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 15:59:12.188905 3.003871 tcp 10.0.2.105 60699 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 15:59:21.191257 0.000000 tcp 10.0.2.105 60699 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:01:12.573864 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:01:19.581895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:01:27.584099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:01:43.586208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:02:15.592024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:04:27.191783 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:04:27.191959 3.003590 tcp 10.0.2.105 60700 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:04:36.194011 0.000000 tcp 10.0.2.105 60700 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:04:42.194373 0.053376 tcp 10.0.2.105 60701 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:42.247988 0.053770 tcp 10.0.2.105 60702 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:42.302136 0.106976 tcp 10.0.2.105 60703 -> 195.113.214.236 443 SRPA* 0 0 74 58535 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:42.419066 2.998158 tcp 10.0.2.105 60704 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:04:51.425687 0.000000 tcp 10.0.2.105 60704 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:04:57.414998 0.051183 tcp 10.0.2.105 60705 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:57.466431 0.051996 tcp 10.0.2.105 60706 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:57.518717 0.125334 tcp 10.0.2.105 60707 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:04:57.665183 2.994169 tcp 10.0.2.105 60708 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:06.657992 0.000000 tcp 10.0.2.105 60708 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:12.667458 0.051736 tcp 10.0.2.105 60709 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:05:12.719488 0.053195 tcp 10.0.2.105 60710 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:05:12.772973 0.125905 tcp 10.0.2.105 60711 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:05:12.909554 3.001659 tcp 10.0.2.105 60712 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:21.909210 0.000000 tcp 10.0.2.105 60712 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:27.908816 3.003842 tcp 10.0.2.105 60713 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:36.911179 0.000000 tcp 10.0.2.105 60713 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:41.568000 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:05:42.909975 3.004411 tcp 10.0.2.105 60714 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:05:51.914988 0.000000 tcp 10.0.2.105 60714 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:08:19.597965 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:08:26.605345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:08:34.606938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:08:50.610033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:09:22.615724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:10:57.913351 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:10:57.913449 3.003903 tcp 10.0.2.105 60715 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:06.925894 0.000000 tcp 10.0.2.105 60715 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:12.916845 0.052437 tcp 10.0.2.105 60716 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:12.969579 0.054209 tcp 10.0.2.105 60717 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:13.024053 0.130406 tcp 10.0.2.105 60718 -> 195.113.214.236 443 SRPA* 0 0 35 26915 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:13.202669 2.986521 tcp 10.0.2.105 60719 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:22.197727 0.000000 tcp 10.0.2.105 60719 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:28.197078 0.052015 tcp 10.0.2.105 60720 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:28.249043 0.054270 tcp 10.0.2.105 60721 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:28.303478 0.140880 tcp 10.0.2.105 60722 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:28.490303 3.000940 tcp 10.0.2.105 60723 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:37.489611 0.000000 tcp 10.0.2.105 60723 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:43.489414 0.050654 tcp 10.0.2.105 60724 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:43.540459 0.053547 tcp 10.0.2.105 60725 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:43.594273 0.143242 tcp 10.0.2.105 60726 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:11:43.747843 3.005198 tcp 10.0.2.105 60727 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:52.751689 0.000000 tcp 10.0.2.105 60727 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:11:58.741323 3.003296 tcp 10.0.2.105 60728 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:12:07.743501 0.000000 tcp 10.0.2.105 60728 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:12:12.569977 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:12:13.742801 3.003595 tcp 10.0.2.105 60729 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:12:22.744814 0.000000 tcp 10.0.2.105 60729 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:15:26.622050 3.001524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:15:33.629359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:15:41.630764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:15:57.633819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:16:29.639896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:21:38.654326 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:21:38.654465 0.242640 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:38.895418 0.079451 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:38.987146 0.186539 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.166958 0.246122 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.365713 0.210824 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.539614 0.149165 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.690121 0.057892 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.750915 0.075701 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.808970 0.106139 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:39.974124 0.090023 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.043780 0.456915 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.478124 0.107409 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.546887 0.173246 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.696156 0.087711 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.766146 0.173943 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:40.932103 0.238941 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:41.146226 0.145419 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:41.356656 0.307079 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:41.555793 0.252325 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:41.773875 0.360435 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:42.103937 0.385246 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:42.438740 0.225085 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:42.656978 0.201522 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:42.853581 0.103457 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:42.952056 0.212632 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:43.156768 0.168738 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:43.302365 0.275255 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:21:43.772144 3.003414 tcp 10.0.2.105 60730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:21:52.774659 0.000000 tcp 10.0.2.105 60730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:21:58.774827 0.051283 tcp 10.0.2.105 60731 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:21:58.826371 0.052497 tcp 10.0.2.105 60732 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:21:58.879113 0.154675 tcp 10.0.2.105 60733 -> 195.113.214.236 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:21:59.095099 2.992212 tcp 10.0.2.105 60734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:08.097087 0.000000 tcp 10.0.2.105 60734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:14.095720 0.051516 tcp 10.0.2.105 60735 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:14.147602 0.052935 tcp 10.0.2.105 60736 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:14.200856 0.196790 tcp 10.0.2.105 60737 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:14.533193 2.990735 tcp 10.0.2.105 60738 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:23.518699 0.000000 tcp 10.0.2.105 60738 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:29.519700 0.051727 tcp 10.0.2.105 60739 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:29.571732 0.053438 tcp 10.0.2.105 60740 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:29.625495 0.151916 tcp 10.0.2.105 60741 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:22:29.872092 2.999888 tcp 10.0.2.105 60742 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:33.646186 3.006637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:22:38.870699 0.000000 tcp 10.0.2.105 60742 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:40.653609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:22:44.869242 3.004374 tcp 10.0.2.105 60743 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:48.655009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:22:53.871959 0.000000 tcp 10.0.2.105 60743 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:22:58.568930 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:22:59.870910 3.004155 tcp 10.0.2.105 60744 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:23:04.657742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:23:08.873834 0.000000 tcp 10.0.2.105 60744 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:23:36.663703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:28:14.874244 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:28:14.874328 2.993955 tcp 10.0.2.105 60745 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:28:23.881021 0.000000 tcp 10.0.2.105 60745 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:28:29.876864 0.052770 tcp 10.0.2.105 60746 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:29.929918 0.052322 tcp 10.0.2.105 60747 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:29.982657 0.143906 tcp 10.0.2.105 60748 -> 195.113.214.236 443 SRPA* 0 0 32 17616 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:30.454091 2.998891 tcp 10.0.2.105 60749 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:28:39.449203 0.000000 tcp 10.0.2.105 60749 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:28:45.448497 0.052527 tcp 10.0.2.105 60750 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:45.501359 0.053206 tcp 10.0.2.105 60751 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:45.554807 0.152023 tcp 10.0.2.105 60752 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:28:45.867678 3.005214 tcp 10.0.2.105 60753 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:28:54.879625 0.000000 tcp 10.0.2.105 60753 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:00.870386 0.051702 tcp 10.0.2.105 60754 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:29:00.922355 0.053340 tcp 10.0.2.105 60755 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:29:00.975999 0.154476 tcp 10.0.2.105 60756 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:29:01.179847 3.005204 tcp 10.0.2.105 60757 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:10.183263 0.000000 tcp 10.0.2.105 60757 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:16.172148 3.003680 tcp 10.0.2.105 60758 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:25.174513 0.000000 tcp 10.0.2.105 60758 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:30.071960 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:29:31.173593 2.993980 tcp 10.0.2.105 60759 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:40.176238 0.000000 tcp 10.0.2.105 60759 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:29:40.670106 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:29:47.677178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:29:55.678678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:30:11.681667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:30:43.687608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:34:46.177078 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:34:46.177182 2.993495 tcp 10.0.2.105 60760 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:34:55.169254 0.000000 tcp 10.0.2.105 60760 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:01.179773 0.053780 tcp 10.0.2.105 60761 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:01.233800 0.053844 tcp 10.0.2.105 60762 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:01.287897 0.147087 tcp 10.0.2.105 60763 -> 195.113.214.236 443 SRPA* 0 0 39 33404 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:01.506231 2.996497 tcp 10.0.2.105 60764 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:10.501444 0.000000 tcp 10.0.2.105 60764 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:16.500477 0.052699 tcp 10.0.2.105 60765 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:16.553452 0.053962 tcp 10.0.2.105 60766 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:16.607678 0.147873 tcp 10.0.2.105 60767 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:16.770714 3.003840 tcp 10.0.2.105 60768 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:25.773394 0.000000 tcp 10.0.2.105 60768 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:31.772684 0.052113 tcp 10.0.2.105 60769 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:31.825140 0.054773 tcp 10.0.2.105 60770 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:31.880251 0.147323 tcp 10.0.2.105 60771 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:35:32.038140 3.008636 tcp 10.0.2.105 60772 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:41.045357 0.000000 tcp 10.0.2.105 60772 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:47.034095 2.996137 tcp 10.0.2.105 60773 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:35:56.036715 0.000000 tcp 10.0.2.105 60773 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:36:00.573176 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:36:02.035363 2.994223 tcp 10.0.2.105 60774 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:36:11.028514 0.000000 tcp 10.0.2.105 60774 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:36:47.694212 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:36:54.701115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:37:02.702710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:37:18.705747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:37:50.712808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:41:17.039223 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:41:17.039420 3.003770 tcp 10.0.2.105 60775 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:41:26.041185 0.000000 tcp 10.0.2.105 60775 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:41:32.041813 0.052347 tcp 10.0.2.105 60776 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:32.094405 0.052513 tcp 10.0.2.105 60777 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:32.147236 0.143942 tcp 10.0.2.105 60778 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:32.320613 3.004036 tcp 10.0.2.105 60779 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:41:41.323423 0.000000 tcp 10.0.2.105 60779 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:41:47.322762 0.051844 tcp 10.0.2.105 60780 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:47.374965 0.053404 tcp 10.0.2.105 60781 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:47.428756 0.146158 tcp 10.0.2.105 60782 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:41:47.599071 3.007676 tcp 10.0.2.105 60783 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:41:56.605308 0.000000 tcp 10.0.2.105 60783 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:02.594348 0.051690 tcp 10.0.2.105 60784 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:42:02.646360 0.053320 tcp 10.0.2.105 60785 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:42:02.700026 0.151481 tcp 10.0.2.105 60786 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:42:02.961939 2.986770 tcp 10.0.2.105 60787 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:11.947266 0.000000 tcp 10.0.2.105 60787 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:17.956106 2.994180 tcp 10.0.2.105 60788 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:26.948866 0.000000 tcp 10.0.2.105 60788 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:31.565874 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:42:32.957751 3.003889 tcp 10.0.2.105 60789 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:42:41.959836 0.000000 tcp 10.0.2.105 60789 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:43:54.718804 3.000590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:44:01.725038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:44:09.726956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:44:25.729788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:44:57.735883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:51:47.144733 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:51:47.144876 0.189044 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:47.326159 0.246539 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:47.571017 0.077572 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:47.633641 0.262734 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:47.845799 0.215340 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:47.986017 2.999914 tcp 10.0.2.105 60790 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:51:48.021680 0.140859 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:48.249081 0.055384 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:48.373413 0.076340 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:48.431242 0.103616 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:48.565878 0.089211 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:48.633855 0.460183 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.071545 0.106663 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.202437 0.168019 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.350073 0.088305 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.418788 0.172515 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.583625 0.241914 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:49.804474 0.390629 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:50.159622 0.357970 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:50.490210 0.145275 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:50.761616 0.184627 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:50.888825 0.211625 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.056540 0.221533 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.271189 0.204481 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.538272 0.111411 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.641574 0.217917 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.852698 0.166095 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:51.998327 0.269910 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 16:51:56.980897 0.000000 tcp 10.0.2.105 60790 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:02.989212 0.053171 tcp 10.0.2.105 60791 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:03.042702 0.053935 tcp 10.0.2.105 60792 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:03.096930 0.150303 tcp 10.0.2.105 60793 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:03.259276 3.002715 tcp 10.0.2.105 60794 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:12.260568 0.000000 tcp 10.0.2.105 60794 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:18.259924 0.052516 tcp 10.0.2.105 60795 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:18.312735 0.053997 tcp 10.0.2.105 60796 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:18.366999 0.155475 tcp 10.0.2.105 60797 -> 195.113.214.236 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:52:18.564710 2.999012 tcp 10.0.2.105 60798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:27.562480 0.000000 tcp 10.0.2.105 60798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:33.561166 3.004303 tcp 10.0.2.105 60799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:42.563870 0.000000 tcp 10.0.2.105 60799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:52:47.069997 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:54:27.748757 3.000694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 16:54:34.762896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:54:42.756714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:54:58.759776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:55:30.768052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 16:57:48.564758 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:57:48.564876 2.993232 tcp 10.0.2.105 60800 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:57:57.566946 0.000000 tcp 10.0.2.105 60800 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:03.567541 0.052869 tcp 10.0.2.105 60801 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:03.620713 0.053091 tcp 10.0.2.105 60802 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:03.674080 0.152510 tcp 10.0.2.105 60803 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:03.837148 3.002852 tcp 10.0.2.105 60804 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:12.838818 0.000000 tcp 10.0.2.105 60804 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:18.838047 0.051179 tcp 10.0.2.105 60805 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:18.889549 0.053579 tcp 10.0.2.105 60806 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:18.943450 0.207634 tcp 10.0.2.105 60807 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:19.175488 2.996625 tcp 10.0.2.105 60808 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:28.171103 0.000000 tcp 10.0.2.105 60808 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:34.170438 0.053274 tcp 10.0.2.105 60809 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:34.223996 0.054167 tcp 10.0.2.105 60810 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:34.278512 0.143719 tcp 10.0.2.105 60811 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 16:58:34.439300 3.004732 tcp 10.0.2.105 60812 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:43.442753 0.000000 tcp 10.0.2.105 60812 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:49.431560 3.003991 tcp 10.0.2.105 60813 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:58:58.434655 0.000000 tcp 10.0.2.105 60813 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:59:03.071186 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 16:59:04.433353 2.995168 tcp 10.0.2.105 60814 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 16:59:13.436349 0.000000 tcp 10.0.2.105 60814 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:01:34.772548 3.000766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:01:41.779266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:01:49.780543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:02:05.783676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:02:37.789585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:04:19.436619 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:04:19.436874 2.993368 tcp 10.0.2.105 60815 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:04:28.430203 0.000000 tcp 10.0.2.105 60815 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:04:34.440029 0.052480 tcp 10.0.2.105 60816 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:34.492832 0.052638 tcp 10.0.2.105 60817 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:34.545770 0.106188 tcp 10.0.2.105 60818 -> 195.113.214.236 443 SRPA* 0 0 33 24451 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:34.671495 3.000468 tcp 10.0.2.105 60819 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:04:43.670792 0.000000 tcp 10.0.2.105 60819 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:04:49.670283 0.051367 tcp 10.0.2.105 60820 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:49.721917 0.052234 tcp 10.0.2.105 60821 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:49.774449 0.128507 tcp 10.0.2.105 60822 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:04:49.922474 3.001796 tcp 10.0.2.105 60823 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:04:58.923460 0.000000 tcp 10.0.2.105 60823 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:04.922125 0.051862 tcp 10.0.2.105 60824 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:05:04.974275 0.052328 tcp 10.0.2.105 60825 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:05:05.026879 0.127099 tcp 10.0.2.105 60826 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:05:05.163998 3.001854 tcp 10.0.2.105 60827 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:14.164990 0.000000 tcp 10.0.2.105 60827 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:20.163631 2.993900 tcp 10.0.2.105 60828 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:29.166246 0.000000 tcp 10.0.2.105 60828 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:34.075055 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:05:35.171081 2.989538 tcp 10.0.2.105 60829 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:05:44.157482 0.000000 tcp 10.0.2.105 60829 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:08:41.796965 3.000505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:08:48.803312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:08:56.804523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:09:12.807465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:09:44.813782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:10:50.168025 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:10:50.168148 3.003987 tcp 10.0.2.105 60830 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:10:59.170636 0.000000 tcp 10.0.2.105 60830 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:05.171144 0.052449 tcp 10.0.2.105 60831 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:05.223861 0.052593 tcp 10.0.2.105 60832 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:05.276758 0.138467 tcp 10.0.2.105 60833 -> 195.113.214.236 443 SRPA* 0 0 33 23865 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:05.425157 2.998726 tcp 10.0.2.105 60834 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:14.422746 0.000000 tcp 10.0.2.105 60834 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:20.422152 0.052208 tcp 10.0.2.105 60835 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:20.474670 0.053030 tcp 10.0.2.105 60836 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:20.528051 0.148639 tcp 10.0.2.105 60837 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:20.686398 2.999458 tcp 10.0.2.105 60838 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:29.685026 0.000000 tcp 10.0.2.105 60838 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:35.683921 0.051466 tcp 10.0.2.105 60839 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:35.735724 0.053857 tcp 10.0.2.105 60840 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:35.789926 0.148591 tcp 10.0.2.105 60841 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:11:35.972537 2.994705 tcp 10.0.2.105 60842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:44.976300 0.000000 tcp 10.0.2.105 60842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:50.965312 2.994218 tcp 10.0.2.105 60843 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:11:59.957954 0.000000 tcp 10.0.2.105 60843 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:12:04.574720 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:12:05.967235 2.993808 tcp 10.0.2.105 60844 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:12:14.959557 0.000000 tcp 10.0.2.105 60844 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:15:48.819411 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:15:55.827125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:16:03.828658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:16:19.831566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:16:51.837557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:17:20.970485 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:17:20.970596 3.003160 tcp 10.0.2.105 60845 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:17:29.972733 0.000000 tcp 10.0.2.105 60845 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:17:35.972245 0.053496 tcp 10.0.2.105 60846 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:17:36.026039 0.053348 tcp 10.0.2.105 60847 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:17:36.079695 0.152028 tcp 10.0.2.105 60848 -> 195.113.214.236 443 SRPA* 0 0 40 33458 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:17:36.290407 3.005529 tcp 10.0.2.105 60849 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:17:45.294716 0.000000 tcp 10.0.2.105 60849 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:22:14.261452 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:22:14.261617 0.080257 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:14.328154 0.361063 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:14.643915 0.189066 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:14.825557 0.241319 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.065636 0.211931 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.240675 0.141624 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.409638 0.051426 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.565405 0.075287 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.623396 0.105953 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.744471 0.107432 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.812592 0.089868 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:15.884796 0.503903 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:16.367949 0.172545 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:16.517600 0.087689 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:16.629670 0.174739 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:16.796683 0.239028 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:17.013105 0.256526 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2594 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:17.231833 0.351593 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:17.555178 1.027836 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2592 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:18.532502 0.131507 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:18.749551 0.175097 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:18.864748 0.228010 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:19.085876 0.194760 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:19.275775 0.104571 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:19.395560 0.217451 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:19.605700 0.165957 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:19.748861 0.257149 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:22:51.284634 2.994257 tcp 10.0.2.105 60850 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:22:55.843914 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:22:56.071404 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:23:00.287332 0.000000 tcp 10.0.2.105 60850 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:02.851053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:23:06.288111 0.053019 tcp 10.0.2.105 60851 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:06.341393 0.051619 tcp 10.0.2.105 60852 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:06.393298 0.151151 tcp 10.0.2.105 60853 -> 195.113.214.236 443 SRPA* 0 0 35 19217 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:06.650687 2.990339 tcp 10.0.2.105 60854 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:10.852790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:23:15.639376 0.000000 tcp 10.0.2.105 60854 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:21.648886 0.074474 tcp 10.0.2.105 60855 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:21.723681 0.053819 tcp 10.0.2.105 60856 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:21.777816 0.144982 tcp 10.0.2.105 60857 -> 195.113.214.236 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:22.069526 3.003471 tcp 10.0.2.105 60858 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:26.855492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:23:31.071770 0.000000 tcp 10.0.2.105 60858 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:37.070579 0.052006 tcp 10.0.2.105 60859 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:37.122844 0.052572 tcp 10.0.2.105 60860 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:37.175702 0.145546 tcp 10.0.2.105 60861 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:23:37.346997 2.998119 tcp 10.0.2.105 60862 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:46.343590 0.000000 tcp 10.0.2.105 60862 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:52.342194 3.004563 tcp 10.0.2.105 60863 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:23:58.861710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:24:01.345200 0.000000 tcp 10.0.2.105 60863 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:24:06.071846 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:24:07.343975 2.994112 tcp 10.0.2.105 60864 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:24:16.346814 0.000000 tcp 10.0.2.105 60864 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:29:22.347260 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:29:22.347430 3.003746 tcp 10.0.2.105 60865 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:29:31.349721 0.000000 tcp 10.0.2.105 60865 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:29:37.350650 0.051554 tcp 10.0.2.105 60866 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:37.402473 0.053460 tcp 10.0.2.105 60867 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:37.456418 0.146465 tcp 10.0.2.105 60868 -> 195.113.214.236 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:37.615949 2.997096 tcp 10.0.2.105 60869 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:29:46.611577 0.000000 tcp 10.0.2.105 60869 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:29:52.611356 0.052682 tcp 10.0.2.105 60870 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:52.663921 0.051949 tcp 10.0.2.105 60871 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:52.716131 0.147785 tcp 10.0.2.105 60872 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:29:52.905409 2.999478 tcp 10.0.2.105 60873 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:01.903782 0.000000 tcp 10.0.2.105 60873 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:02.867786 3.001456 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:30:07.904561 0.054978 tcp 10.0.2.105 60874 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:30:07.959783 0.052277 tcp 10.0.2.105 60875 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:30:08.012467 0.147536 tcp 10.0.2.105 60876 -> 195.113.214.236 443 SRPA* 0 0 36 18906 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:30:08.169556 3.007384 tcp 10.0.2.105 60877 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:09.875308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:30:17.178858 0.000000 tcp 10.0.2.105 60877 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:17.878723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:30:23.165735 2.992827 tcp 10.0.2.105 60878 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:32.170928 0.000000 tcp 10.0.2.105 60878 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:33.885956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:30:37.074357 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:30:38.166022 2.993544 tcp 10.0.2.105 60879 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:30:47.158881 0.000000 tcp 10.0.2.105 60879 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:31:05.887021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:35:53.169150 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:35:53.169361 3.003558 tcp 10.0.2.105 60880 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:02.171704 0.000000 tcp 10.0.2.105 60880 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:08.173181 0.052548 tcp 10.0.2.105 60881 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:08.226079 0.052262 tcp 10.0.2.105 60882 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:08.278598 0.150227 tcp 10.0.2.105 60883 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:08.540427 3.004478 tcp 10.0.2.105 60884 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:17.543584 0.000000 tcp 10.0.2.105 60884 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:23.533327 0.051316 tcp 10.0.2.105 60885 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:23.584928 0.053066 tcp 10.0.2.105 60886 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:23.638269 0.149115 tcp 10.0.2.105 60887 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:23.827910 3.009162 tcp 10.0.2.105 60888 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:32.835493 0.000000 tcp 10.0.2.105 60888 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:38.825112 0.052359 tcp 10.0.2.105 60889 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:38.877766 0.052975 tcp 10.0.2.105 60890 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:38.931033 0.146224 tcp 10.0.2.105 60891 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:36:39.196883 2.991984 tcp 10.0.2.105 60892 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:48.187521 0.000000 tcp 10.0.2.105 60892 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:36:54.196201 2.994018 tcp 10.0.2.105 60893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:37:03.189478 0.000000 tcp 10.0.2.105 60893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:37:08.065834 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:37:09.197961 3.004619 tcp 10.0.2.105 60894 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:37:09.892132 3.001261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:37:16.898949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:37:18.200996 0.000000 tcp 10.0.2.105 60894 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:37:24.899941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:37:40.903543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:38:12.909722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:42:24.202425 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:42:24.202628 3.004096 tcp 10.0.2.105 60895 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:42:33.211934 0.000000 tcp 10.0.2.105 60895 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:42:39.204456 0.053291 tcp 10.0.2.105 60896 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:39.258037 0.053524 tcp 10.0.2.105 60897 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:39.311889 0.105798 tcp 10.0.2.105 60898 -> 195.113.214.236 443 SRPA* 0 0 52 47393 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:39.518385 2.998774 tcp 10.0.2.105 60899 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:42:48.530802 0.000000 tcp 10.0.2.105 60899 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:42:54.522956 0.052450 tcp 10.0.2.105 60900 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:54.575684 0.053801 tcp 10.0.2.105 60901 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:54.629777 0.126972 tcp 10.0.2.105 60902 -> 195.113.214.236 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:42:54.834133 2.985034 tcp 10.0.2.105 60903 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:03.817733 0.000000 tcp 10.0.2.105 60903 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:09.827324 0.052201 tcp 10.0.2.105 60904 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:43:09.879876 0.053412 tcp 10.0.2.105 60905 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:43:09.933576 0.125003 tcp 10.0.2.105 60906 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:43:10.069735 2.991425 tcp 10.0.2.105 60907 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:19.059501 0.000000 tcp 10.0.2.105 60907 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:25.067930 3.004909 tcp 10.0.2.105 60908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:34.071168 0.000000 tcp 10.0.2.105 60908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:39.068810 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:43:40.069863 3.004637 tcp 10.0.2.105 60909 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:43:49.073056 0.000000 tcp 10.0.2.105 60909 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:44:16.916340 3.000877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:44:23.923120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:44:31.924698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:44:47.931491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:45:19.933636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:52:47.367492 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:52:47.367576 0.189139 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:47.547965 0.243044 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:47.789314 0.079863 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:47.856001 0.253028 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.061566 0.211641 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.236274 0.146254 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.378221 0.055463 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.453366 0.076274 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.514423 0.107659 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.637076 0.106287 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.706766 0.088786 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:48.776584 0.492791 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:49.249030 0.171009 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:49.398287 0.084708 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:49.467763 0.173833 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:49.633817 0.237020 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:49.847489 0.256661 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:50.071826 0.353758 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:50.396763 0.159197 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:50.503440 0.225656 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:50.721369 0.871510 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:51.544719 0.138247 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:51.716904 0.195848 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:51.908159 0.113481 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:52:55.098453 3.003645 tcp 10.0.2.105 60910 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:04.100750 0.000000 tcp 10.0.2.105 60910 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:09.675729 0.053802 tcp 10.0.2.105 60911 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:09.729829 0.031190 tcp 10.0.2.105 60912 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:09.761386 0.127280 tcp 10.0.2.105 60913 -> 195.113.214.236 443 SRPA* 0 0 35 26915 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:09.889217 0.220082 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:53:10.101563 0.169664 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:53:10.104512 0.051305 tcp 10.0.2.105 60914 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:10.156128 0.032048 tcp 10.0.2.105 60915 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:10.188524 0.146870 tcp 10.0.2.105 60916 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:10.246858 0.231849 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/02 17:53:10.348387 2.995803 tcp 10.0.2.105 60917 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:19.343032 0.000000 tcp 10.0.2.105 60917 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:25.343340 0.052365 tcp 10.0.2.105 60918 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:25.396062 0.031635 tcp 10.0.2.105 60919 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:25.428087 0.142353 tcp 10.0.2.105 60920 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:25.673313 3.002880 tcp 10.0.2.105 60921 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:34.682687 0.000000 tcp 10.0.2.105 60921 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:40.675313 0.053309 tcp 10.0.2.105 60922 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:40.728926 0.052706 tcp 10.0.2.105 60923 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:40.782032 0.150665 tcp 10.0.2.105 60924 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:53:41.179721 2.998540 tcp 10.0.2.105 60925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:50.190769 0.000000 tcp 10.0.2.105 60925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:53:56.180943 2.989754 tcp 10.0.2.105 60926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:54:05.168836 0.000000 tcp 10.0.2.105 60926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:54:10.067340 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:54:11.177589 3.004009 tcp 10.0.2.105 60927 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:54:20.180429 0.000000 tcp 10.0.2.105 60927 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:54:38.939861 3.001975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 17:54:45.947484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:54:53.948871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:55:09.951964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:55:41.961066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 17:59:26.180604 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 17:59:26.180824 3.003871 tcp 10.0.2.105 60928 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:59:35.183571 0.000000 tcp 10.0.2.105 60928 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:59:41.183545 0.052129 tcp 10.0.2.105 60929 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:41.235953 0.053834 tcp 10.0.2.105 60930 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:41.290109 0.145918 tcp 10.0.2.105 60931 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:41.458912 3.007734 tcp 10.0.2.105 60932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:59:50.464965 0.000000 tcp 10.0.2.105 60932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 17:59:56.454659 0.052103 tcp 10.0.2.105 60933 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:56.507112 0.054166 tcp 10.0.2.105 60934 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:56.561586 0.150549 tcp 10.0.2.105 60935 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 17:59:56.741233 2.997573 tcp 10.0.2.105 60936 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:05.747147 0.000000 tcp 10.0.2.105 60936 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:11.736586 0.052191 tcp 10.0.2.105 60937 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:00:11.789132 0.053367 tcp 10.0.2.105 60938 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:00:11.842796 0.145285 tcp 10.0.2.105 60939 -> 195.113.214.236 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:00:12.003154 2.997082 tcp 10.0.2.105 60940 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:20.998446 0.000000 tcp 10.0.2.105 60940 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:26.997901 3.004148 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:36.000536 0.000000 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:40.566981 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:00:41.998775 3.004792 tcp 10.0.2.105 60942 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:00:51.002562 0.000000 tcp 10.0.2.105 60942 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:01:45.964909 3.000716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:01:52.972072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:02:00.972799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:02:16.975946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:02:48.981675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:05:57.002494 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:05:57.002590 3.004006 tcp 10.0.2.105 60943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:06.005024 0.000000 tcp 10.0.2.105 60943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:12.007777 0.053522 tcp 10.0.2.105 60944 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:12.061547 0.052857 tcp 10.0.2.105 60945 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:12.114749 0.149713 tcp 10.0.2.105 60946 -> 195.113.214.236 443 SRPA* 0 0 61 42708 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:12.275264 2.992835 tcp 10.0.2.105 60947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:21.277896 0.000000 tcp 10.0.2.105 60947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:27.269595 0.052884 tcp 10.0.2.105 60948 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:27.322779 0.052800 tcp 10.0.2.105 60949 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:27.375886 0.148342 tcp 10.0.2.105 60950 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:27.534456 2.996178 tcp 10.0.2.105 60951 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:36.532978 0.000000 tcp 10.0.2.105 60951 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:42.531432 0.052568 tcp 10.0.2.105 60952 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:42.584333 0.053575 tcp 10.0.2.105 60953 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:42.638284 0.148944 tcp 10.0.2.105 60954 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:06:42.807396 2.994890 tcp 10.0.2.105 60955 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:51.800823 0.000000 tcp 10.0.2.105 60955 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:06:57.799365 3.004546 tcp 10.0.2.105 60956 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:07:06.802628 0.000000 tcp 10.0.2.105 60956 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:07:11.569370 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:07:12.801383 3.005618 tcp 10.0.2.105 60957 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:07:21.803891 0.000000 tcp 10.0.2.105 60957 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:08:52.988022 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:08:59.996702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:09:07.996973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:09:23.999376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:09:56.005219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:12:27.804702 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:12:27.805082 2.993386 tcp 10.0.2.105 60958 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:12:36.806962 0.000000 tcp 10.0.2.105 60958 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:12:42.809413 0.052815 tcp 10.0.2.105 60959 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:42.862495 0.054570 tcp 10.0.2.105 60960 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:42.916916 0.108732 tcp 10.0.2.105 60961 -> 195.113.214.236 443 SRPA* 0 0 73 51091 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:43.036886 2.993360 tcp 10.0.2.105 60962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:12:52.028249 0.000000 tcp 10.0.2.105 60962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:12:58.038222 0.052192 tcp 10.0.2.105 60963 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:58.090692 0.053384 tcp 10.0.2.105 60964 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:58.144516 0.125365 tcp 10.0.2.105 60965 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:12:58.289159 3.002992 tcp 10.0.2.105 60966 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:07.290873 0.000000 tcp 10.0.2.105 60966 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:13.289811 0.052913 tcp 10.0.2.105 60967 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:13:13.343033 0.054238 tcp 10.0.2.105 60968 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:13:13.397532 0.127353 tcp 10.0.2.105 60969 -> 195.113.214.236 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:13:13.536067 2.997816 tcp 10.0.2.105 60970 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:22.532693 0.000000 tcp 10.0.2.105 60970 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:28.532104 3.003557 tcp 10.0.2.105 60971 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:37.534109 0.000000 tcp 10.0.2.105 60971 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:42.070802 0.000176 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:13:43.533242 3.006681 tcp 10.0.2.105 60972 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:13:52.547380 0.000000 tcp 10.0.2.105 60972 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:16:00.012415 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:16:07.019024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:16:15.020635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:16:31.023897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:17:03.029239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:23:07.035718 3.001748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 18:23:14.045334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:23:22.048851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:23:30.414384 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:23:30.414550 0.103154 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:30.512955 0.187555 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:30.693012 0.254414 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:30.898017 0.208948 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.074261 0.157478 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.313208 0.070111 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.425374 0.248518 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2591 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.761974 0.078600 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 1926 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.824888 0.104988 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:31.909149 0.088197 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.039914 0.101393 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.205244 0.071715 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 1952 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.262183 0.085874 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.331750 0.172944 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.497450 0.171381 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:32.645925 0.388623 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:33.016116 0.236204 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:33.228525 0.257245 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:33.452761 0.351644 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:33.775593 0.166667 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:33.889155 0.225402 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:34.107059 0.138437 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:34.276934 0.299714 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:34.526574 0.195860 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:34.717658 0.218730 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:34.928995 0.168057 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:35.075758 0.270143 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:23:38.049769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:23:43.571240 2.990604 tcp 10.0.2.105 60973 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:23:52.558846 0.000000 tcp 10.0.2.105 60973 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:23:57.069325 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:23:58.571618 0.053892 tcp 10.0.2.105 60974 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:23:58.625801 0.052979 tcp 10.0.2.105 60975 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:23:58.679069 0.125754 tcp 10.0.2.105 60976 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:23:58.897740 2.994207 tcp 10.0.2.105 60977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:07.890524 0.000000 tcp 10.0.2.105 60977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:10.053705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:24:13.889588 0.053451 tcp 10.0.2.105 60978 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:13.942838 0.054181 tcp 10.0.2.105 60979 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:13.997321 0.128424 tcp 10.0.2.105 60980 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:14.201657 3.002365 tcp 10.0.2.105 60981 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:23.202562 0.000000 tcp 10.0.2.105 60981 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:29.201700 0.052625 tcp 10.0.2.105 60982 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:29.254612 0.031330 tcp 10.0.2.105 60983 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:29.286324 0.126141 tcp 10.0.2.105 60984 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:24:29.445096 3.002499 tcp 10.0.2.105 60985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:38.444551 0.000000 tcp 10.0.2.105 60985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:44.443497 3.004264 tcp 10.0.2.105 60986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:53.456157 0.000000 tcp 10.0.2.105 60986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:24:58.072961 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:24:59.445139 2.995726 tcp 10.0.2.105 60987 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:25:08.437789 0.000000 tcp 10.0.2.105 60987 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:14.060630 3.000727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:30:14.448429 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:30:14.448537 3.003246 tcp 10.0.2.105 60988 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:21.067268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:30:23.450761 0.000000 tcp 10.0.2.105 60988 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:29.068128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:30:29.451471 0.053685 tcp 10.0.2.105 60989 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:29.505499 0.054093 tcp 10.0.2.105 60990 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:29.559964 0.130817 tcp 10.0.2.105 60991 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:29.706378 2.997594 tcp 10.0.2.105 60992 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:38.702729 0.000000 tcp 10.0.2.105 60992 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:44.701954 0.052259 tcp 10.0.2.105 60993 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:44.754514 0.111013 tcp 10.0.2.105 60994 -> 195.113.214.236 80 SRPA* 0 0 35 33811 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:44.888548 3.006543 tcp 10.0.2.105 60995 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:45.071672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:30:53.894174 0.000000 tcp 10.0.2.105 60995 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:30:59.884097 0.052393 tcp 10.0.2.105 60996 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:59.936823 0.052932 tcp 10.0.2.105 60997 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:30:59.990116 0.142907 tcp 10.0.2.105 60998 -> 195.113.214.236 443 SRPA* 0 0 33 26044 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:31:00.174459 2.993387 tcp 10.0.2.105 60999 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:31:09.176593 0.000000 tcp 10.0.2.105 60999 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:31:15.175202 2.994071 tcp 10.0.2.105 61000 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:31:17.077743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:31:24.167920 0.000000 tcp 10.0.2.105 61000 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:31:29.064880 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:31:30.176995 2.993612 tcp 10.0.2.105 61001 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:31:39.170728 0.000000 tcp 10.0.2.105 61001 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:36:45.179925 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:36:45.180028 3.003635 tcp 10.0.2.105 61002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:36:54.184792 0.000000 tcp 10.0.2.105 61002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:00.182859 0.054438 tcp 10.0.2.105 61003 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:00.237627 0.031447 tcp 10.0.2.105 61004 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:00.269343 0.105942 tcp 10.0.2.105 61005 -> 195.113.214.236 443 SRPA* 0 0 36 26969 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:00.413704 3.001857 tcp 10.0.2.105 61006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:09.414370 0.000000 tcp 10.0.2.105 61006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:15.414086 0.052142 tcp 10.0.2.105 61007 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:15.466542 0.032810 tcp 10.0.2.105 61008 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:15.499632 0.128848 tcp 10.0.2.105 61009 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:15.655159 3.002366 tcp 10.0.2.105 61010 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:21.084167 3.001078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:37:24.666146 0.000000 tcp 10.0.2.105 61010 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:28.091125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:37:30.655569 0.051686 tcp 10.0.2.105 61011 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:30.707583 0.031614 tcp 10.0.2.105 61012 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:30.739591 0.124409 tcp 10.0.2.105 61013 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:37:30.875455 2.993816 tcp 10.0.2.105 61014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:36.093024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:37:39.867950 0.000000 tcp 10.0.2.105 61014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:45.876802 2.994153 tcp 10.0.2.105 61015 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:52.095485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:37:54.869447 0.000000 tcp 10.0.2.105 61015 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:37:59.566460 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:38:00.878461 3.004409 tcp 10.0.2.105 61016 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:38:09.881415 0.000000 tcp 10.0.2.105 61016 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:38:24.101622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:43:15.882059 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:43:15.882174 3.003321 tcp 10.0.2.105 61017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:43:24.884135 0.000000 tcp 10.0.2.105 61017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:43:30.885164 0.051974 tcp 10.0.2.105 61018 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:30.937491 0.052512 tcp 10.0.2.105 61019 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:30.990307 0.109538 tcp 10.0.2.105 61020 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:31.140428 3.006871 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:43:40.156646 0.000000 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:43:46.134934 0.051716 tcp 10.0.2.105 61022 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:46.187001 0.031188 tcp 10.0.2.105 61023 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:46.218502 0.147390 tcp 10.0.2.105 61024 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:43:46.402575 2.996715 tcp 10.0.2.105 61025 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:43:55.397816 0.000000 tcp 10.0.2.105 61025 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:01.404265 0.028373 tcp 10.0.2.105 61026 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:44:01.432950 0.031157 tcp 10.0.2.105 61027 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:44:01.464428 0.194187 tcp 10.0.2.105 61028 -> 195.113.214.236 443 SRPA* 0 0 73 78220 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:44:01.730383 2.991102 tcp 10.0.2.105 61029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:10.723518 0.000000 tcp 10.0.2.105 61029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:16.722580 3.000630 tcp 10.0.2.105 61030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:25.728497 0.000000 tcp 10.0.2.105 61030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:28.109613 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:44:30.571401 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:44:31.725865 3.000536 tcp 10.0.2.105 61031 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:35.115914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:44:40.723131 0.000000 tcp 10.0.2.105 61031 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:44:43.116203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:44:59.119246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:45:31.125716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:53:47.189097 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:53:47.189280 0.251672 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:47.390152 0.211492 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:47.562904 0.144003 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:47.724885 0.109671 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:47.829288 0.188321 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.010644 0.056832 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.062485 0.240264 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.301630 0.083143 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.368900 0.105479 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.439740 0.089038 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.511143 0.107509 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.637557 0.076588 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.694668 0.094894 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.768067 0.174769 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:48.934288 0.173597 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:49.084533 0.322006 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:49.387980 0.238692 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:49.602221 0.188054 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:49.730600 0.227439 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:49.949969 0.254376 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:50.172271 0.354757 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:50.499839 0.145319 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:50.653892 0.258548 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:50.865081 0.191661 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:51.051532 0.214270 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:51.258244 0.171298 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:53:51.412962 0.305637 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/02 18:54:01.750264 3.003681 tcp 10.0.2.105 61032 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:10.753141 0.000000 tcp 10.0.2.105 61032 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:15.569992 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:54:16.753422 0.053140 tcp 10.0.2.105 61033 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:16.806802 0.031101 tcp 10.0.2.105 61034 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:16.838218 0.109060 tcp 10.0.2.105 61035 -> 195.113.214.236 443 SRPA* 0 0 60 38125 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:16.974463 3.001002 tcp 10.0.2.105 61036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:25.974956 0.000000 tcp 10.0.2.105 61036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:31.973854 0.051457 tcp 10.0.2.105 61037 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:32.025568 0.032110 tcp 10.0.2.105 61038 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:32.058005 0.105146 tcp 10.0.2.105 61039 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:32.202476 2.995021 tcp 10.0.2.105 61040 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:41.206177 0.000000 tcp 10.0.2.105 61040 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:45.135326 3.003798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 18:54:47.199535 0.052835 tcp 10.0.2.105 61041 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:47.252668 0.032193 tcp 10.0.2.105 61042 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:47.285174 0.151086 tcp 10.0.2.105 61043 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 18:54:47.547013 2.983023 tcp 10.0.2.105 61044 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:54:52.142382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:54:56.533208 0.000000 tcp 10.0.2.105 61044 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:55:00.144295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:55:02.537438 3.006355 tcp 10.0.2.105 61045 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:55:11.540145 0.000000 tcp 10.0.2.105 61045 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:55:16.068044 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 18:55:16.148171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 18:55:17.538955 3.006674 tcp 10.0.2.105 61046 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:55:26.541858 0.000000 tcp 10.0.2.105 61046 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 18:55:48.152940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:00:32.542418 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:00:32.542526 3.003525 tcp 10.0.2.105 61047 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:00:41.544851 0.000000 tcp 10.0.2.105 61047 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:00:47.545114 0.053492 tcp 10.0.2.105 61048 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:00:47.598929 0.030929 tcp 10.0.2.105 61049 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:00:47.630179 0.128885 tcp 10.0.2.105 61050 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:00:47.785914 2.991852 tcp 10.0.2.105 61051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:00:56.786872 0.000000 tcp 10.0.2.105 61051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:02.785618 0.052643 tcp 10.0.2.105 61052 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:02.838549 0.053574 tcp 10.0.2.105 61053 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:02.892483 0.149309 tcp 10.0.2.105 61054 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:03.057630 3.001917 tcp 10.0.2.105 61055 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:12.058306 0.000000 tcp 10.0.2.105 61055 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:18.058065 0.053069 tcp 10.0.2.105 61056 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:18.111450 0.053187 tcp 10.0.2.105 61057 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:18.164974 0.145935 tcp 10.0.2.105 61058 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:01:18.322037 2.999602 tcp 10.0.2.105 61059 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:27.320425 0.000000 tcp 10.0.2.105 61059 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:33.319387 3.003764 tcp 10.0.2.105 61060 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:42.321907 0.000000 tcp 10.0.2.105 61060 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:47.068941 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:01:48.320784 3.004186 tcp 10.0.2.105 61061 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:52.158337 3.002300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:01:57.323483 0.000000 tcp 10.0.2.105 61061 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:01:59.166473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:02:07.167810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:02:23.171924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:02:55.177094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:07:03.324205 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:07:03.324307 2.993368 tcp 10.0.2.105 61062 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:12.326504 0.000000 tcp 10.0.2.105 61062 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:18.327126 0.053382 tcp 10.0.2.105 61063 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:18.380817 0.031080 tcp 10.0.2.105 61064 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:18.412351 0.107099 tcp 10.0.2.105 61065 -> 195.113.214.236 443 SRPA* 0 0 35 26915 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:18.537244 2.992655 tcp 10.0.2.105 61066 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:27.529089 0.000000 tcp 10.0.2.105 61066 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:33.537689 0.051354 tcp 10.0.2.105 61067 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:33.589352 0.030880 tcp 10.0.2.105 61068 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:33.620563 0.127016 tcp 10.0.2.105 61069 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:33.797075 3.004634 tcp 10.0.2.105 61070 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:42.799723 0.000000 tcp 10.0.2.105 61070 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:48.799236 0.052412 tcp 10.0.2.105 61071 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:48.851959 0.031210 tcp 10.0.2.105 61072 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:48.883451 0.124679 tcp 10.0.2.105 61073 -> 195.113.214.236 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:07:49.019248 3.004215 tcp 10.0.2.105 61074 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:07:58.022079 0.000000 tcp 10.0.2.105 61074 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:08:04.020692 3.004416 tcp 10.0.2.105 61075 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:08:13.023707 0.000000 tcp 10.0.2.105 61075 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:08:17.570451 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:08:19.022994 3.006501 tcp 10.0.2.105 61076 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:08:28.025454 0.000000 tcp 10.0.2.105 61076 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:08:59.182662 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:09:06.190226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:09:14.191817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:09:30.194714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:10:02.200569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:13:34.025802 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:13:34.025941 2.993655 tcp 10.0.2.105 61077 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:13:43.017816 0.000000 tcp 10.0.2.105 61077 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:13:49.028350 0.035504 tcp 10.0.2.105 61078 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:13:49.064160 0.031214 tcp 10.0.2.105 61079 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:13:49.095665 0.125681 tcp 10.0.2.105 61080 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:13:49.231107 3.000108 tcp 10.0.2.105 61081 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:13:58.229851 0.000000 tcp 10.0.2.105 61081 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:04.229391 0.030201 tcp 10.0.2.105 61082 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:04.259938 0.032688 tcp 10.0.2.105 61083 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:04.292943 0.125184 tcp 10.0.2.105 61084 -> 195.113.214.236 443 SRPA* 0 0 40 20888 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:04.429602 3.003875 tcp 10.0.2.105 61085 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:13.431722 0.000000 tcp 10.0.2.105 61085 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:19.431242 0.031038 tcp 10.0.2.105 61086 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:19.462566 0.031141 tcp 10.0.2.105 61087 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:19.494094 0.124963 tcp 10.0.2.105 61088 -> 195.113.214.236 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:14:19.640092 3.004972 tcp 10.0.2.105 61089 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:28.643593 0.000000 tcp 10.0.2.105 61089 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:34.632830 3.003879 tcp 10.0.2.105 61090 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:43.635356 0.000000 tcp 10.0.2.105 61090 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:48.572506 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:14:49.633949 2.994449 tcp 10.0.2.105 61091 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:14:58.636891 0.000000 tcp 10.0.2.105 61091 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:16:06.206779 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:16:13.214185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:16:21.215980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:16:37.218868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:17:09.224996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:23:13.230773 3.002749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 19:23:20.238255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:23:28.240638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:23:44.242937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:24:09.068408 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:24:09.068563 0.282705 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:09.302654 0.213662 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:09.582423 0.188181 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:09.763011 0.060640 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:09.837683 0.146166 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.073356 0.108066 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.176543 0.243829 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.418961 0.082751 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.485383 0.108965 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.916910 0.091112 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:10.987959 0.102364 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.282000 0.076972 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.340527 0.091922 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.427896 0.175293 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.596559 0.236885 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.809856 0.169270 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:11.958225 0.267317 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:12.205371 0.253783 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:12.426478 0.167812 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:12.539035 0.228814 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:12.760775 0.352501 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:13.085487 0.138024 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:13.289100 0.226695 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:13.464701 0.168742 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:13.609742 0.197194 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:13.801313 0.212263 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:14.005108 0.198149 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:24:16.248986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:24:19.663954 2.993742 tcp 10.0.2.105 61092 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:24:28.668925 0.000000 tcp 10.0.2.105 61092 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:24:33.573541 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:24:34.667265 0.053172 tcp 10.0.2.105 61093 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:34.720731 0.030870 tcp 10.0.2.105 61094 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:34.751959 0.127047 tcp 10.0.2.105 61095 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:35.014511 2.995299 tcp 10.0.2.105 61096 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:24:44.009034 0.000000 tcp 10.0.2.105 61096 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:24:50.007401 0.030023 tcp 10.0.2.105 61097 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:50.037652 0.031753 tcp 10.0.2.105 61098 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:50.069666 0.132273 tcp 10.0.2.105 61099 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:24:50.355546 2.996602 tcp 10.0.2.105 61100 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:24:59.350423 0.000000 tcp 10.0.2.105 61100 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:05.349966 0.030509 tcp 10.0.2.105 61101 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:25:05.380779 0.031673 tcp 10.0.2.105 61102 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:25:05.412815 0.124584 tcp 10.0.2.105 61103 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:25:05.562683 3.001136 tcp 10.0.2.105 61104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:14.562874 0.000000 tcp 10.0.2.105 61104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:20.561370 3.004086 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:29.564133 0.000000 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:34.070241 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:25:35.563309 3.003765 tcp 10.0.2.105 61106 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:25:44.565471 0.000000 tcp 10.0.2.105 61106 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:30:20.254574 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:30:27.262019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:30:35.280784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:30:50.573633 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:30:50.573835 2.987240 tcp 10.0.2.105 61107 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:30:51.270981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:30:59.565706 0.000000 tcp 10.0.2.105 61107 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:05.574579 0.052387 tcp 10.0.2.105 61108 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:05.627297 0.031392 tcp 10.0.2.105 61109 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:05.658992 0.128721 tcp 10.0.2.105 61110 -> 195.113.214.236 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:05.939406 2.992625 tcp 10.0.2.105 61111 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:14.934516 0.000000 tcp 10.0.2.105 61111 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:20.929382 0.051870 tcp 10.0.2.105 61112 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:20.981515 0.031099 tcp 10.0.2.105 61113 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:21.012904 0.128410 tcp 10.0.2.105 61114 -> 195.113.214.236 443 SRPA* 0 0 40 33106 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:21.356397 2.997724 tcp 10.0.2.105 61115 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:23.272931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:31:30.352934 0.000000 tcp 10.0.2.105 61115 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:36.352571 0.030021 tcp 10.0.2.105 61116 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:36.382844 0.031446 tcp 10.0.2.105 61117 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:36.414636 0.125260 tcp 10.0.2.105 61118 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:31:36.642821 3.003272 tcp 10.0.2.105 61119 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:45.644557 0.000000 tcp 10.0.2.105 61119 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:31:51.643949 2.993912 tcp 10.0.2.105 61120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:32:00.646709 0.000000 tcp 10.0.2.105 61120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:32:05.573266 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:32:06.644996 2.994161 tcp 10.0.2.105 61121 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:32:15.637922 0.000000 tcp 10.0.2.105 61121 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:21.648311 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:37:21.648447 3.003552 tcp 10.0.2.105 61122 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:27.278509 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:37:30.650742 0.000000 tcp 10.0.2.105 61122 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:34.286478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:37:36.650968 0.030924 tcp 10.0.2.105 61123 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:36.682207 0.031006 tcp 10.0.2.105 61124 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:36.713562 0.126426 tcp 10.0.2.105 61125 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:36.851265 3.002829 tcp 10.0.2.105 61126 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:42.287560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:37:45.853140 0.000000 tcp 10.0.2.105 61126 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:51.851833 0.051753 tcp 10.0.2.105 61127 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:51.903471 0.032220 tcp 10.0.2.105 61128 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:51.935545 0.125126 tcp 10.0.2.105 61129 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:37:52.071790 3.004252 tcp 10.0.2.105 61130 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:37:58.290758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:38:01.074272 0.000000 tcp 10.0.2.105 61130 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:07.073865 0.029994 tcp 10.0.2.105 61131 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:38:07.104219 0.032402 tcp 10.0.2.105 61132 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:38:07.136935 0.127735 tcp 10.0.2.105 61133 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:38:07.275393 2.992370 tcp 10.0.2.105 61134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:16.276473 0.000000 tcp 10.0.2.105 61134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:22.275342 2.994007 tcp 10.0.2.105 61135 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:30.296100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:38:31.268002 0.000000 tcp 10.0.2.105 61135 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:36.064774 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:38:37.276834 2.994092 tcp 10.0.2.105 61136 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:38:46.269707 0.000000 tcp 10.0.2.105 61136 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:43:52.280327 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:43:52.280432 3.003399 tcp 10.0.2.105 61137 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:01.282699 0.000000 tcp 10.0.2.105 61137 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:07.283233 0.053676 tcp 10.0.2.105 61138 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:07.337261 0.032061 tcp 10.0.2.105 61139 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:07.369614 0.128923 tcp 10.0.2.105 61140 -> 195.113.214.236 443 SRPA* 0 0 35 18224 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:07.692299 3.003729 tcp 10.0.2.105 61141 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:16.694742 0.000000 tcp 10.0.2.105 61141 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:22.693944 0.053156 tcp 10.0.2.105 61142 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:22.747348 0.031238 tcp 10.0.2.105 61143 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:22.778874 0.125090 tcp 10.0.2.105 61144 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:22.930810 2.997112 tcp 10.0.2.105 61145 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:31.936705 0.000000 tcp 10.0.2.105 61145 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:34.302751 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 19:44:37.925638 0.051921 tcp 10.0.2.105 61146 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:37.977804 0.033634 tcp 10.0.2.105 61147 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:38.011761 0.128870 tcp 10.0.2.105 61148 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:44:38.151708 2.997875 tcp 10.0.2.105 61149 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:41.309983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:44:47.148172 0.000000 tcp 10.0.2.105 61149 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:44:49.311734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:44:53.147169 3.003852 tcp 10.0.2.105 61150 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:45:02.150846 0.000000 tcp 10.0.2.105 61150 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:45:05.314626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:45:07.072711 0.076638 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:45:08.213179 2.986904 tcp 10.0.2.105 61151 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:45:17.163284 0.000000 tcp 10.0.2.105 61151 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:45:37.320551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:54:24.651419 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:54:24.651528 0.253434 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:24.857913 0.209991 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:25.034905 0.187291 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:25.214278 0.051823 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2022 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:25.886349 0.150527 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.116797 0.106889 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.218799 0.109998 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.290413 0.088360 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.417776 0.255522 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.671960 0.082225 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.784430 0.104223 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:26.942066 0.081556 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.006438 0.084878 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.072375 0.195148 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.259713 0.237922 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.474336 0.171239 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.622683 0.237046 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:27.839275 0.229020 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:28.060385 0.355977 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:28.388915 0.145601 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:28.628426 0.249235 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:28.844128 0.176411 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:28.969076 0.223884 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:29.146154 0.165964 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:29.291093 0.201412 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:29.483275 0.212580 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:29.687428 0.304647 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 19:54:38.178630 3.003678 tcp 10.0.2.105 61152 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:54:45.332283 3.000866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 19:54:47.181036 0.000000 tcp 10.0.2.105 61152 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:54:52.067703 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:54:52.338296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:54:53.181056 0.052132 tcp 10.0.2.105 61153 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:54:53.233460 0.031343 tcp 10.0.2.105 61154 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:54:53.265169 0.124389 tcp 10.0.2.105 61155 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:54:53.424731 2.999966 tcp 10.0.2.105 61156 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:00.340052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:55:02.422998 0.000000 tcp 10.0.2.105 61156 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:08.421981 0.040453 tcp 10.0.2.105 61157 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:08.462747 0.031370 tcp 10.0.2.105 61158 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:08.494402 0.125556 tcp 10.0.2.105 61159 -> 195.113.214.236 443 SRPA* 0 0 38 33350 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:08.690105 3.006655 tcp 10.0.2.105 61160 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:16.343054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:55:17.694781 0.000000 tcp 10.0.2.105 61160 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:23.684143 0.030018 tcp 10.0.2.105 61161 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:23.714489 0.051742 tcp 10.0.2.105 61162 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:23.766526 0.127608 tcp 10.0.2.105 61163 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 19:55:24.023373 2.994995 tcp 10.0.2.105 61164 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:33.027003 0.000000 tcp 10.0.2.105 61164 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:39.016166 2.993776 tcp 10.0.2.105 61165 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:48.008835 0.000000 tcp 10.0.2.105 61165 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:55:48.349293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 19:55:52.565008 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 19:55:54.017169 3.004341 tcp 10.0.2.105 61166 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 19:56:03.019538 0.000000 tcp 10.0.2.105 61166 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:09.020788 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:01:09.020937 3.002866 tcp 10.0.2.105 61167 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:18.023152 0.000000 tcp 10.0.2.105 61167 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:24.023620 0.031326 tcp 10.0.2.105 61168 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:24.055233 0.054156 tcp 10.0.2.105 61169 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:24.109628 0.107313 tcp 10.0.2.105 61170 -> 195.113.214.236 443 SRPA* 0 0 32 24681 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:24.227364 3.002578 tcp 10.0.2.105 61171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:33.225076 0.000000 tcp 10.0.2.105 61171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:39.224203 0.051758 tcp 10.0.2.105 61172 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:39.276343 0.031904 tcp 10.0.2.105 61173 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:39.308578 0.149152 tcp 10.0.2.105 61174 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:39.469312 2.998786 tcp 10.0.2.105 61175 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:48.477179 0.000000 tcp 10.0.2.105 61175 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:52.355366 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:01:54.466241 0.051961 tcp 10.0.2.105 61176 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:54.518454 0.032403 tcp 10.0.2.105 61177 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:54.551125 0.125455 tcp 10.0.2.105 61178 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:01:54.762831 2.997613 tcp 10.0.2.105 61179 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:01:59.362597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:02:03.759020 0.000000 tcp 10.0.2.105 61179 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:02:07.364026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:02:09.757564 3.004099 tcp 10.0.2.105 61180 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:02:18.760441 0.000000 tcp 10.0.2.105 61180 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:02:23.367261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:02:23.567157 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:02:24.759265 3.004316 tcp 10.0.2.105 61181 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:02:33.762383 0.000000 tcp 10.0.2.105 61181 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:02:55.373162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:07:39.764371 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:07:39.764472 3.001592 tcp 10.0.2.105 61182 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:07:48.764834 0.000000 tcp 10.0.2.105 61182 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:07:54.765073 0.051424 tcp 10.0.2.105 61183 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:07:54.816845 0.030954 tcp 10.0.2.105 61184 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:07:54.848153 0.108277 tcp 10.0.2.105 61185 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:07:54.967214 2.990715 tcp 10.0.2.105 61186 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:03.966597 0.000000 tcp 10.0.2.105 61186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:09.966001 0.029947 tcp 10.0.2.105 61187 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:09.996220 0.031144 tcp 10.0.2.105 61188 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:10.027689 0.126460 tcp 10.0.2.105 61189 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:10.211406 2.998689 tcp 10.0.2.105 61190 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:19.208603 0.000000 tcp 10.0.2.105 61190 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:25.207777 0.052699 tcp 10.0.2.105 61191 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:25.260742 0.032441 tcp 10.0.2.105 61192 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:25.293552 0.124988 tcp 10.0.2.105 61193 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:08:25.441415 3.000524 tcp 10.0.2.105 61194 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:34.440566 0.000000 tcp 10.0.2.105 61194 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:40.439638 3.003805 tcp 10.0.2.105 61195 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:49.442196 0.000000 tcp 10.0.2.105 61195 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:08:54.070869 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:08:55.441043 3.003882 tcp 10.0.2.105 61196 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:09:02.383887 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:09:04.443645 0.000000 tcp 10.0.2.105 61196 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:09:09.390762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:09:17.392499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:09:33.395285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:10:05.401324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:14:10.444143 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:14:10.444385 2.993709 tcp 10.0.2.105 61197 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:19.446620 0.000000 tcp 10.0.2.105 61197 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:25.446939 0.030951 tcp 10.0.2.105 61198 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:25.478210 0.053300 tcp 10.0.2.105 61199 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:25.531798 0.113966 tcp 10.0.2.105 61200 -> 195.113.214.236 443 SRPA* 0 0 60 37003 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:25.662137 2.987405 tcp 10.0.2.105 61201 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:34.648479 0.000000 tcp 10.0.2.105 61201 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:40.657861 0.052843 tcp 10.0.2.105 61202 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:40.710966 0.052715 tcp 10.0.2.105 61203 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:40.764054 0.125749 tcp 10.0.2.105 61204 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:40.899860 3.002086 tcp 10.0.2.105 61205 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:49.900406 0.000000 tcp 10.0.2.105 61205 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:14:55.899578 0.051095 tcp 10.0.2.105 61206 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:55.950992 0.052334 tcp 10.0.2.105 61207 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:56.003618 0.151628 tcp 10.0.2.105 61208 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:14:56.166443 2.997300 tcp 10.0.2.105 61209 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:15:05.162201 0.000000 tcp 10.0.2.105 61209 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:15:11.160993 3.004095 tcp 10.0.2.105 61210 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:15:20.163897 0.000000 tcp 10.0.2.105 61210 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:15:25.070775 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:15:26.162864 3.003884 tcp 10.0.2.105 61211 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:15:35.165293 0.000000 tcp 10.0.2.105 61211 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:16:09.407627 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:16:16.414903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:16:24.416270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:16:40.419293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:17:12.425556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:23:16.431698 3.001776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 20:23:23.438978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:23:31.440174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:23:47.443150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:24:19.454821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:24:41.090992 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:24:41.091099 0.188079 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:41.270660 0.260754 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:41.481976 0.211352 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2054 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:41.661375 0.053701 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:41.828175 0.161399 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:41.985006 0.103523 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.098714 0.107219 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.169259 0.087340 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.316534 0.241277 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.556177 0.078349 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.656773 0.107601 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.802584 0.079979 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.864116 0.089816 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:42.933363 0.175113 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:43.099902 0.239569 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:43.314171 0.225076 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:43.531681 0.167413 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:43.675560 0.233953 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:43.890071 0.355112 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:44.217263 0.138465 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:44.433038 0.262536 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2538 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:44.657603 0.168072 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:44.780077 0.796805 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:45.530446 0.165041 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:45.725885 0.195401 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2538 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:45.915579 0.211247 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:46.119573 0.269708 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:24:56.192343 3.003974 tcp 10.0.2.105 61212 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:05.194913 0.000000 tcp 10.0.2.105 61212 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:10.072349 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:25:11.195186 0.052381 tcp 10.0.2.105 61213 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:11.247891 0.031499 tcp 10.0.2.105 61214 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:11.279754 0.105240 tcp 10.0.2.105 61215 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:11.681251 2.997509 tcp 10.0.2.105 61216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:20.687041 0.000000 tcp 10.0.2.105 61216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:26.679282 0.052409 tcp 10.0.2.105 61217 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:26.731536 0.031866 tcp 10.0.2.105 61218 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:26.763704 0.126208 tcp 10.0.2.105 61219 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:26.920075 3.000084 tcp 10.0.2.105 61220 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:35.919322 0.000000 tcp 10.0.2.105 61220 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:41.918339 0.030723 tcp 10.0.2.105 61221 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:41.949364 0.054181 tcp 10.0.2.105 61222 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:42.003907 0.126613 tcp 10.0.2.105 61223 -> 195.113.214.236 443 SRPA* 0 0 23 12058 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:25:42.306817 2.995962 tcp 10.0.2.105 61224 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:51.301711 0.000000 tcp 10.0.2.105 61224 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:25:57.301191 3.002745 tcp 10.0.2.105 61225 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:26:06.302978 0.000000 tcp 10.0.2.105 61225 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:26:11.069845 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:26:12.303658 3.002358 tcp 10.0.2.105 61226 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:26:21.304011 0.000000 tcp 10.0.2.105 61226 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:30:23.456049 3.000739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:30:30.463222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:30:38.464121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:30:54.467506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:31:26.473182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:31:27.304834 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:31:27.304932 2.993668 tcp 10.0.2.105 61227 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:31:36.307486 0.000000 tcp 10.0.2.105 61227 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:31:42.307839 0.056514 tcp 10.0.2.105 61228 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:42.364602 0.052109 tcp 10.0.2.105 61229 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:42.416995 0.125060 tcp 10.0.2.105 61230 -> 195.113.214.236 443 SRPA* 0 0 33 24451 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:42.559586 3.000935 tcp 10.0.2.105 61231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:31:51.559236 0.000000 tcp 10.0.2.105 61231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:31:57.558759 0.053161 tcp 10.0.2.105 61232 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:57.611814 0.054573 tcp 10.0.2.105 61233 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:57.666711 0.153038 tcp 10.0.2.105 61234 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:31:57.830062 3.002627 tcp 10.0.2.105 61235 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:06.831151 0.000000 tcp 10.0.2.105 61235 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:12.837527 0.053106 tcp 10.0.2.105 61236 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:32:12.890887 0.053090 tcp 10.0.2.105 61237 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:32:12.944327 0.125175 tcp 10.0.2.105 61238 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:32:13.094124 3.000312 tcp 10.0.2.105 61239 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:22.092840 0.000000 tcp 10.0.2.105 61239 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:28.082197 3.008359 tcp 10.0.2.105 61240 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:37.087473 0.000000 tcp 10.0.2.105 61240 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:42.073182 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:32:43.083623 3.000774 tcp 10.0.2.105 61241 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:32:52.090301 0.000000 tcp 10.0.2.105 61241 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:37:30.478765 3.002171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:37:37.486963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:37:45.488814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:37:58.087016 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:37:58.087202 2.992709 tcp 10.0.2.105 61242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:01.491243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:38:07.079236 0.000000 tcp 10.0.2.105 61242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:13.089562 0.031809 tcp 10.0.2.105 61243 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:13.121697 0.031695 tcp 10.0.2.105 61244 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:13.153683 0.106166 tcp 10.0.2.105 61245 -> 195.113.214.236 443 SRPA* 0 0 33 23865 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:13.270705 3.001562 tcp 10.0.2.105 61246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:22.270855 0.000000 tcp 10.0.2.105 61246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:28.270122 0.052683 tcp 10.0.2.105 61247 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:28.323119 0.053304 tcp 10.0.2.105 61248 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:28.376789 0.125775 tcp 10.0.2.105 61249 -> 195.113.214.236 443 SRPA* 0 0 39 33052 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:28.513172 3.001128 tcp 10.0.2.105 61250 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:33.497294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:38:37.512983 0.000000 tcp 10.0.2.105 61250 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:43.512159 0.051794 tcp 10.0.2.105 61251 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:43.564362 0.053401 tcp 10.0.2.105 61252 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:43.618059 0.127901 tcp 10.0.2.105 61253 -> 195.113.214.236 443 SRPA* 0 0 40 22616 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:38:43.793822 3.002446 tcp 10.0.2.105 61254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:52.794679 0.000000 tcp 10.0.2.105 61254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:38:58.793817 2.993960 tcp 10.0.2.105 61255 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:39:07.796332 0.000000 tcp 10.0.2.105 61255 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:39:12.563262 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:39:13.795076 2.994296 tcp 10.0.2.105 61256 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:39:22.787874 0.000000 tcp 10.0.2.105 61256 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:44:28.801842 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:44:28.801992 3.000191 tcp 10.0.2.105 61257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:44:37.507005 2.997784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 20:44:37.803975 0.000000 tcp 10.0.2.105 61257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:44:43.804595 0.053516 tcp 10.0.2.105 61258 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:43.858399 0.031540 tcp 10.0.2.105 61259 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:43.890228 0.130316 tcp 10.0.2.105 61260 -> 195.113.214.236 443 SRPA* 0 0 36 26967 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:44.111878 2.996157 tcp 10.0.2.105 61261 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:44:44.517293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:44:52.512633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:44:53.103334 0.000000 tcp 10.0.2.105 61261 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:44:59.102440 0.051586 tcp 10.0.2.105 61262 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:59.154274 0.053664 tcp 10.0.2.105 61263 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:59.208225 0.174492 tcp 10.0.2.105 61264 -> 195.113.214.236 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:44:59.413763 3.005109 tcp 10.0.2.105 61265 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:08.415126 0.000000 tcp 10.0.2.105 61265 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:08.515094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:45:14.414185 0.032177 tcp 10.0.2.105 61266 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:45:14.446621 0.030700 tcp 10.0.2.105 61267 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:45:14.477646 0.126157 tcp 10.0.2.105 61268 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:45:14.619201 2.999075 tcp 10.0.2.105 61269 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:23.626754 0.000000 tcp 10.0.2.105 61269 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:29.615582 2.994253 tcp 10.0.2.105 61270 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:38.608595 0.000000 tcp 10.0.2.105 61270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:40.521214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:45:43.565575 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:45:44.617308 2.994059 tcp 10.0.2.105 61271 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:45:53.610003 0.000000 tcp 10.0.2.105 61271 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:54:47.530307 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 20:54:54.537712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:55:02.539211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:55:08.858555 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:55:08.858753 0.211030 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.035340 0.106798 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.172614 0.148426 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.330512 0.106367 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.429174 0.204994 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.596657 0.187313 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:09.776898 0.272013 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.001416 0.093442 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.076746 0.239877 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.332887 0.081423 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.396770 0.099922 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.571370 0.078614 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.635556 0.091337 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.705868 0.176187 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:10.873866 0.167687 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:11.020704 0.236220 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:11.236126 0.356092 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:11.563947 0.238108 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:11.778266 0.229732 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.000410 0.131710 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.133554 0.252807 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.349261 0.168329 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.464904 0.196641 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.655411 0.210935 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:12.858330 0.299622 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:13.107507 0.168027 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:13.253582 0.232398 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 20:55:14.647306 2.993521 tcp 10.0.2.105 61272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:55:18.542278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:55:23.639683 0.000000 tcp 10.0.2.105 61272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:55:29.649643 0.054861 tcp 10.0.2.105 61273 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:29.704789 0.056420 tcp 10.0.2.105 61274 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:29.761569 0.149014 tcp 10.0.2.105 61275 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:30.077344 2.995664 tcp 10.0.2.105 61276 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:55:39.071681 0.000000 tcp 10.0.2.105 61276 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:55:45.070638 0.052121 tcp 10.0.2.105 61277 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:45.123073 0.032340 tcp 10.0.2.105 61278 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:45.155703 0.151749 tcp 10.0.2.105 61279 -> 195.113.214.236 443 SRPA* 0 0 32 16640 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:55:45.366995 3.004397 tcp 10.0.2.105 61280 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:55:50.554759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 20:55:54.363535 0.000000 tcp 10.0.2.105 61280 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:00.363185 0.052663 tcp 10.0.2.105 61281 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:56:00.416149 0.053273 tcp 10.0.2.105 61282 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:56:00.469685 0.145916 tcp 10.0.2.105 61283 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/02 20:56:00.826063 3.002008 tcp 10.0.2.105 61284 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:09.836004 0.000000 tcp 10.0.2.105 61284 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:15.825104 2.993378 tcp 10.0.2.105 61285 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:24.827315 0.000000 tcp 10.0.2.105 61285 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:29.564295 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 20:56:30.826119 2.994256 tcp 10.0.2.105 61286 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 20:56:39.818844 0.000000 tcp 10.0.2.105 61286 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:01:45.829510 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:01:45.829664 3.003773 tcp 10.0.2.105 61287 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:01:54.553923 3.002482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 21:01:54.831853 0.000000 tcp 10.0.2.105 61287 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:00.832730 0.055072 tcp 10.0.2.105 61288 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:00.888052 0.053135 tcp 10.0.2.105 61289 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:00.941432 0.144124 tcp 10.0.2.105 61290 -> 195.113.214.236 443 SRPA* 0 0 40 33106 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:01.096137 2.999108 tcp 10.0.2.105 61291 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:01.561660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:02:09.563315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:02:10.094061 0.000000 tcp 10.0.2.105 61291 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:16.093448 0.052013 tcp 10.0.2.105 61292 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:16.145777 0.053165 tcp 10.0.2.105 61293 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:16.199173 0.147123 tcp 10.0.2.105 61294 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:16.367328 3.009913 tcp 10.0.2.105 61295 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:25.386128 0.000000 tcp 10.0.2.105 61295 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:25.566176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:02:31.365456 0.030585 tcp 10.0.2.105 61296 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:31.396443 0.031681 tcp 10.0.2.105 61297 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:31.428486 0.122189 tcp 10.0.2.105 61298 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:02:31.571048 2.998465 tcp 10.0.2.105 61299 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:40.567869 0.000000 tcp 10.0.2.105 61299 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:46.566961 2.993890 tcp 10.0.2.105 61300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:55.559354 0.000000 tcp 10.0.2.105 61300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:02:57.572885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:03:00.065598 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:03:01.568239 3.004589 tcp 10.0.2.105 61301 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:03:10.570808 0.000000 tcp 10.0.2.105 61301 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:16.571166 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:08:16.571265 3.004211 tcp 10.0.2.105 61302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:25.573600 0.000000 tcp 10.0.2.105 61302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:31.573892 0.052820 tcp 10.0.2.105 61303 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:31.626984 0.053441 tcp 10.0.2.105 61304 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:31.680734 0.149483 tcp 10.0.2.105 61305 -> 195.113.214.236 443 SRPA* 0 0 32 17452 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:31.840444 3.006433 tcp 10.0.2.105 61306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:40.855604 0.000000 tcp 10.0.2.105 61306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:46.834977 0.053506 tcp 10.0.2.105 61307 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:46.888710 0.053992 tcp 10.0.2.105 61308 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:46.942966 0.148834 tcp 10.0.2.105 61309 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:08:47.140619 2.998240 tcp 10.0.2.105 61310 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:08:56.137357 0.000000 tcp 10.0.2.105 61310 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:02.137603 0.053497 tcp 10.0.2.105 61311 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:09:02.191385 0.056196 tcp 10.0.2.105 61312 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:09:02.247900 0.146911 tcp 10.0.2.105 61313 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:09:02.406016 2.994998 tcp 10.0.2.105 61314 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:04.583139 3.000863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 21:09:11.399469 0.000000 tcp 10.0.2.105 61314 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:11.589884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:09:17.398422 3.004255 tcp 10.0.2.105 61315 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:19.591335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:09:26.401143 0.000000 tcp 10.0.2.105 61315 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:31.068098 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:09:32.400279 3.003735 tcp 10.0.2.105 61316 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:09:35.594278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:09:41.402725 0.000000 tcp 10.0.2.105 61316 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:10:07.600665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:14:47.403575 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:14:47.403792 3.003519 tcp 10.0.2.105 61317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:14:56.416050 0.000000 tcp 10.0.2.105 61317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:02.406161 0.052022 tcp 10.0.2.105 61318 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:02.458438 0.053020 tcp 10.0.2.105 61319 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:02.511709 0.148759 tcp 10.0.2.105 61320 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:02.687529 3.001438 tcp 10.0.2.105 61321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:11.687722 0.000000 tcp 10.0.2.105 61321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:17.687490 0.052921 tcp 10.0.2.105 61322 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:17.740709 0.053542 tcp 10.0.2.105 61323 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:17.794511 0.147881 tcp 10.0.2.105 61324 -> 195.113.214.236 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:17.951978 2.998578 tcp 10.0.2.105 61325 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:26.949592 0.000000 tcp 10.0.2.105 61325 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:32.948303 0.052501 tcp 10.0.2.105 61326 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:33.001090 0.051985 tcp 10.0.2.105 61327 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:33.053366 0.147072 tcp 10.0.2.105 61328 -> 195.113.214.236 443 SRPA* 0 0 21 11574 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:15:33.210824 3.002100 tcp 10.0.2.105 61329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:42.211713 0.000000 tcp 10.0.2.105 61329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:48.210357 3.003975 tcp 10.0.2.105 61330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:15:57.213184 0.000000 tcp 10.0.2.105 61330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:16:02.070031 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:16:03.211972 3.003925 tcp 10.0.2.105 61331 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:16:11.606679 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 21:16:12.214978 0.000000 tcp 10.0.2.105 61331 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:16:18.613981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:16:26.615511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:16:42.618759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:17:14.624644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:23:18.630802 3.002867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 21:23:25.638953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:23:33.641503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:23:49.642950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:24:21.648568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:25:14.524892 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:25:14.525002 0.224861 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:14.674610 0.209550 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:14.976744 0.051989 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.137401 0.115894 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.248227 0.103916 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.317591 0.189701 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.499965 0.260166 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.710691 0.083949 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:15.829421 0.101177 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.064130 0.078020 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.124897 0.089936 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 5 1840 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.244094 0.246724 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.569386 0.102792 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.674187 0.174784 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.841576 0.170969 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:16.991037 0.233562 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:17.204708 0.225834 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:17.423518 0.381323 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:17.776620 0.236785 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:17.990843 0.138617 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:18.165333 0.251270 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:18.240346 3.003644 tcp 10.0.2.105 61332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:25:18.382213 0.170503 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:18.500139 0.205588 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:18.698959 0.171238 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:18.846721 0.214976 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:19.054453 0.213393 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:19.219989 0.198378 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:25:27.242920 0.000000 tcp 10.0.2.105 61332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:25:33.242950 0.053210 tcp 10.0.2.105 61333 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:33.296445 0.051882 tcp 10.0.2.105 61334 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:33.348638 0.154959 tcp 10.0.2.105 61335 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:33.697398 3.008719 tcp 10.0.2.105 61336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:25:42.705143 0.000000 tcp 10.0.2.105 61336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:25:48.694059 0.053497 tcp 10.0.2.105 61337 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:48.747813 0.053683 tcp 10.0.2.105 61338 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:48.801750 0.151767 tcp 10.0.2.105 61339 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:25:48.986449 2.991833 tcp 10.0.2.105 61340 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:25:57.987112 0.000000 tcp 10.0.2.105 61340 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:03.986648 0.052868 tcp 10.0.2.105 61341 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:26:04.039904 0.053640 tcp 10.0.2.105 61342 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:26:04.093874 0.153390 tcp 10.0.2.105 61343 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:26:04.323025 2.987143 tcp 10.0.2.105 61344 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:13.308925 0.000000 tcp 10.0.2.105 61344 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:19.317857 3.003929 tcp 10.0.2.105 61345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:28.320285 0.000000 tcp 10.0.2.105 61345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:33.067383 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:26:34.319349 3.004061 tcp 10.0.2.105 61346 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:26:43.322479 0.000000 tcp 10.0.2.105 61346 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:30:25.653989 3.002055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/02 21:30:32.661696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:30:40.663445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:30:56.666592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:31:28.672585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:31:49.322846 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:31:49.322984 3.003540 tcp 10.0.2.105 61347 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:31:58.326601 0.000000 tcp 10.0.2.105 61347 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/02 21:32:04.325475 0.052888 tcp 10.0.2.105 61348 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:32:04.378653 0.053859 tcp 10.0.2.105 61349 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:32:04.432812 0.150625 tcp 10.0.2.105 61350 -> 195.113.214.236 443 SRPA* 0 0 32 22198 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:32:04.785257 0.631409 tcp 10.0.2.105 61351 -> 31.192.24.67 3527 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/02/02 21:37:32.678986 3.082642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 21:37:39.736628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:37:47.698850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:38:03.700461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:38:35.706676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:44:39.713373 3.000504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 21:44:46.719883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:44:54.721421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:45:10.724094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:45:42.730791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:54:48.738649 3.004618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 21:54:55.745345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:55:03.747077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:55:19.750082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 21:55:27.241016 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 21:55:27.241125 0.055486 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:27.349473 0.103337 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:27.447745 0.146014 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:27.710237 0.210485 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:27.888708 0.111376 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:28.103565 0.189194 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:28.284230 0.622140 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:29.908649 0.075206 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:30.103050 0.114281 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:30.477595 0.079347 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:30.538587 0.092858 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:30.956079 0.240380 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:32.266866 0.086575 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:32.335092 0.174078 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:32.501526 0.168607 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:32.646977 0.232186 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:34.555407 0.234836 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:34.768577 0.138220 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:34.949704 0.225484 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:35.168153 0.356241 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:35.494336 0.302778 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:35.760785 0.175230 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:35.875975 0.196665 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:36.066112 0.171272 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2592 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:36.212917 0.214247 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:36.418927 0.221810 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:36.838900 0.278813 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/02 21:55:51.755875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:01:55.762210 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:02:02.769420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:02:05.423659 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 22:02:05.423864 0.586709 tcp 10.0.2.105 61352 -> 31.192.24.67 3527 FSPA* 0 0 14 1496 flow=From-Botnet-V2-TCP-Established 1970/02/02 22:02:10.770761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:02:26.773920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:02:58.779801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:09:05.790602 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:09:12.797702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:09:20.799004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:09:36.802281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:10:08.807953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:16:12.815157 3.000645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:16:19.821552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:16:27.823313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:16:43.826294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:17:15.832455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:23:19.837834 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:23:26.845730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:23:34.847110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:23:50.850116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:24:22.856149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:25:50.743723 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 22:25:50.743925 0.149869 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:25:50.951313 0.212921 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:25:51.129040 0.065679 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:25:51.232407 0.112132 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:25:51.337874 0.107233 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:25:51.409663 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/02 22:26:09.191034 0.052928 tcp 10.0.2.105 61353 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/02 22:26:09.244468 0.051858 tcp 10.0.2.105 61354 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/02 22:26:09.296596 0.160401 tcp 10.0.2.105 61355 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/02 22:26:09.457626 0.101929 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:09.587169 0.078873 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:09.648711 0.260024 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:09.860232 0.088749 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:09.931415 0.093777 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.007152 0.240065 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.245790 0.088516 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.314554 0.175768 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.482541 0.172727 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.631423 0.232038 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:10.845232 0.220836 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:11.059150 0.237563 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:11.272728 0.138272 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:11.421236 0.359392 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:11.750696 0.281895 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:11.999178 0.165082 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:12.113920 0.210585 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:12.317388 0.187746 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:12.499588 0.167132 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:12.675363 0.248527 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:26:12.874657 0.273987 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:30:26.862002 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:30:33.869573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:30:41.879116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:30:57.874084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:31:29.883052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:32:06.012760 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 22:32:06.013073 0.598876 tcp 10.0.2.105 61356 -> 31.192.24.67 3527 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/02/02 22:37:33.886219 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:37:40.893635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:37:48.894992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:38:04.898178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:38:36.904128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:44:40.910348 3.002700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:44:47.928586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:44:55.928429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:45:11.932424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:45:43.938785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:54:49.945275 3.001889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 22:54:56.953251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:55:04.954270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:55:20.957591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:55:52.963550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 22:56:29.737552 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 22:56:29.737645 0.189090 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:29.919006 0.218571 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.098618 0.146098 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.240173 0.057317 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.439949 0.110742 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.544951 0.108162 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.624334 0.114042 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.769489 0.078306 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:30.833946 0.387994 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.176636 0.075810 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.251086 0.093369 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.325445 0.242170 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.566058 0.088878 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.674455 0.172938 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.839550 0.171046 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:31.987778 0.237327 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:32.334456 0.222113 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:32.548510 0.396935 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:32.917789 0.260940 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:33.143278 0.171828 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:33.275625 0.237161 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:33.490071 0.165007 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:33.712759 0.215598 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:33.915444 0.193268 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:34.120532 0.170885 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:34.390689 0.266491 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/02 22:56:34.608994 0.237923 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:01:56.970212 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:02:03.977260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:02:06.611517 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 23:02:06.611736 0.551651 tcp 10.0.2.105 61357 -> 31.192.24.67 3527 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/02 23:02:11.978910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:02:27.981516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:02:59.987414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:09:06.998841 3.000470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:09:14.004787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:09:22.007037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:09:38.010774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:10:10.016067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:16:14.289759 3.004315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:16:21.299851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:16:29.301285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:16:45.304498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:17:17.310449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:23:21.367484 3.000791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:23:28.377709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:23:36.376565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:23:52.378629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:24:24.384175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:26:53.689412 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 23:26:53.689542 0.145490 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:53.867327 0.189679 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.048941 0.215914 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.229715 0.053747 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.295755 0.109369 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.399459 0.110780 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.470889 0.102391 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.615971 0.074269 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.675442 0.091462 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:54.807146 0.247204 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.052674 0.086990 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.120113 0.256691 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.327472 0.084791 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.395059 0.177325 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.565197 0.170013 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.712171 0.234018 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:55.925583 0.226287 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:56.144961 0.356709 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:56.473585 0.258321 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:56.697451 0.178559 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2599 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:56.817751 0.237393 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:57.031356 0.138418 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:57.184773 0.171831 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:57.368016 0.221778 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:57.581602 0.196664 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:57.772883 0.316635 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:26:58.041357 0.244602 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:30:28.400322 3.001899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:30:35.412725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:30:43.409423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:30:59.412582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:31:31.418585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:32:07.400493 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 23:32:07.400781 0.527484 tcp 10.0.2.105 61358 -> 31.192.24.67 3527 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/02 23:37:35.425069 3.000885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:37:42.431848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:37:50.433149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:38:06.436546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:38:38.442874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:44:42.459384 2.993551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:44:49.456466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:44:57.457210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:45:13.460459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:45:45.466383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:51:49.472491 3.001404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:51:56.479792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:52:04.481428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:52:20.483998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:52:52.493207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:57:19.113906 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/02 23:57:19.114185 0.214149 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.292179 0.054056 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.393895 0.104544 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.493340 0.146433 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.649219 0.189113 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.831444 0.106701 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:19.906556 0.104790 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.065099 0.078253 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.127541 0.093840 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.200668 0.238618 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.437851 0.086709 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.512013 0.413084 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:20.879963 0.086518 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:21.009334 0.175264 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:21.176956 0.165942 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:21.319652 0.236870 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:21.534142 0.224900 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:21.751663 0.355179 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:22.076287 0.261462 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:22.302731 0.166088 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:22.419396 0.238382 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:22.634454 0.138773 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:22.831989 0.171626 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:23.079414 0.214961 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:23.247009 0.216435 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:23.460289 0.211885 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:57:23.664990 0.197636 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/02 23:58:56.495832 3.002195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/02 23:59:03.503485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:59:11.505316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:59:27.508047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/02 23:59:59.515810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:02:07.928726 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 00:02:07.928916 0.535712 tcp 10.0.2.105 61359 -> 31.192.24.67 3527 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/03 00:06:18.522789 3.000510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:06:25.529230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:06:33.530754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:06:49.533626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:07:21.540070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:13:25.545905 3.001650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:13:32.553436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:13:40.554701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:13:56.557711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:14:28.563650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:20:32.569833 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:20:39.576933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:20:47.578876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:21:03.581485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:21:35.587755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:27:39.593721 3.001462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:27:46.601133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:27:47.312902 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 00:27:47.313016 0.107590 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:47.415635 0.142226 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:47.558413 0.188855 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:47.740068 0.216512 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:47.920835 0.056644 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:47.993328 0.111798 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:48.396376 0.102349 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:49.256870 0.079021 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:49.321130 0.088286 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:50.169312 0.243672 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:50.814441 0.086057 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:51.263758 0.252726 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.004360 0.076600 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.227000 0.176074 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.395308 0.225937 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.612913 0.171432 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.761303 0.232577 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:52.973362 0.157409 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:53.081816 0.358044 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:53.410044 0.251678 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:53.627104 0.237716 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:53.840183 0.131551 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:53.976789 0.175063 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:54.165136 0.218251 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:54.372117 0.266039 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:54.592912 0.293396 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:27:54.602625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:27:55.161303 0.200257 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:28:10.605746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:28:42.611667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:32:08.469292 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 00:32:08.469401 0.565800 tcp 10.0.2.105 61360 -> 31.192.24.67 3527 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/02/03 00:34:46.617607 3.001833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:34:53.625125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:35:01.626669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:35:17.629506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:35:49.635715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:41:53.642891 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:42:00.649178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:42:08.650714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:42:24.653612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:42:56.659669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:53:28.670587 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 00:53:35.678136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:53:43.679824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:53:59.683276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:54:31.688719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 00:58:11.367630 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 00:58:11.367753 0.188477 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:11.549418 0.216277 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:11.754937 0.053122 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:11.986582 0.108119 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:12.089392 0.150585 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:12.235374 0.106053 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:12.305780 0.092006 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:12.471703 0.076894 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:12.533811 0.097805 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:16.251843 0.245794 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:16.715298 0.084352 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:16.806711 0.095311 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:17.202748 0.258858 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:17.412975 0.176103 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:17.650920 0.225244 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:17.868988 0.167181 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:18.014154 0.234648 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:18.227199 0.174939 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:19.605327 0.526873 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:22.428620 0.258378 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:22.658327 0.236265 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:23.420300 0.152451 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:23.605994 0.170613 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:23.992862 0.269659 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:24.258953 0.214116 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:24.542406 0.215972 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/03 00:58:24.819665 0.200456 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:00:35.720272 2.996352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:00:42.722953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:00:50.723570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:01:06.726921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:01:38.732857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:02:09.056700 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 01:02:09.056989 0.704391 tcp 10.0.2.105 61361 -> 31.192.24.67 3527 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/02/03 01:07:42.739298 3.001495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:07:49.746268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:07:57.747899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:08:13.750723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:08:45.756946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:14:49.762363 3.002358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:14:56.770660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:15:04.771652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:15:20.774747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:15:52.780407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:21:56.786233 3.002282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:22:03.793970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:22:11.795589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:22:27.801938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:22:59.804559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:28:27.245820 0.038459 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 01:28:27.284534 0.191758 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:27.468542 0.105326 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:27.606930 0.149037 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:27.860603 0.107362 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:27.930294 0.215516 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.113124 0.052714 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.200583 0.104705 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.485413 0.080490 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.550335 0.095314 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.628496 0.098868 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.706672 0.245562 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:28.950569 0.075996 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.011854 0.261916 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.224407 0.173704 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.391749 0.228263 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.612330 0.170136 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.759358 0.235898 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:29.974859 0.174541 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:30.094105 0.353426 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:30.420072 0.256776 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:30.642772 0.238226 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:30.855827 0.138285 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:31.093413 0.174932 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:31.335443 0.288569 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:31.620895 0.211328 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:31.824521 0.325507 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:28:32.104144 0.194707 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:29:03.821229 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:29:10.828097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:29:18.829377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:29:34.832792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:30:06.838732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:32:09.765820 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 01:32:09.766017 0.669142 tcp 10.0.2.105 61362 -> 31.192.24.67 3527 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/03 01:36:10.844405 3.002072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:36:17.852070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:36:25.853531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:36:41.856557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:37:13.862698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:43:17.868397 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:43:24.876161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:43:32.877446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:43:48.880693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:44:20.886447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:54:11.899124 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 01:54:18.906683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:54:26.908659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:54:42.911368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:55:14.917148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 01:58:46.872001 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 01:58:46.872094 0.144648 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.012492 0.113186 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.082167 0.213646 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.259862 0.057135 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.312184 0.189693 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.494786 0.108330 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.596347 0.092630 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.717332 0.078535 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.778460 0.093490 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.852612 0.090004 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:47.923030 0.240211 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.163407 0.076639 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.225566 0.255289 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.434599 0.175698 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.602575 0.226156 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.820746 0.168716 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:48.967607 0.232482 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:49.181862 0.169660 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:49.296126 0.236204 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:49.510483 0.131774 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:49.643854 0.347955 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:49.965947 0.255343 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:50.188672 0.173511 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:50.415359 0.202260 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:50.615019 0.218992 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:50.827410 0.214059 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 01:58:50.997313 0.197374 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:01:18.922900 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:01:25.930750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:01:33.932021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:01:49.935330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:02:10.435315 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 02:02:10.435460 0.519892 tcp 10.0.2.105 61363 -> 31.192.24.67 3527 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:02:21.940595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:08:25.946924 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:08:32.954168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:08:40.955950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:08:56.958914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:09:28.965181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:15:36.977314 3.001035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:15:43.984682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:15:51.986215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:16:07.988454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:16:39.994747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:22:44.000912 3.001766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:22:51.009865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:22:59.009614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:23:15.012593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:23:47.018870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:28:59.628427 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 02:28:59.628505 0.458447 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:00.051465 0.054184 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:01.514083 0.187788 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:01.719410 0.110326 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:01.821960 0.141284 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:02.069456 0.108278 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:02.140451 0.102667 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:02.336136 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 02:29:21.205620 0.128135 tcp 10.0.2.105 61364 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:29:21.343490 0.163155 tcp 10.0.2.105 61365 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:29:21.507011 0.197019 tcp 10.0.2.105 61366 -> 195.113.214.236 443 SRPA* 0 0 57 37625 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:29:21.704698 0.094856 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:21.780577 0.086678 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:21.849408 0.242966 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.091228 0.076823 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.153362 0.326153 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.428644 0.174220 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.595613 0.228226 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.816505 0.170295 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:22.963303 0.234049 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:23.175408 0.169399 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:23.293113 0.236595 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:23.506269 0.124912 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:23.648506 0.359521 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:23.978750 0.255774 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:24.231496 0.210729 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:24.434579 0.214992 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:24.599793 0.198340 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:24.790091 0.251443 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:25.006829 0.173040 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:29:51.025017 3.001302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:29:58.032158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:30:06.033523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:30:22.036919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:30:54.045911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:32:10.963575 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 02:32:10.963723 0.978539 tcp 10.0.2.105 61367 -> 31.192.24.67 3527 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:36:58.048994 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:37:05.056137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:37:13.074794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:37:29.070780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:38:01.076642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:44:05.082880 3.001306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:44:12.090224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:44:20.091782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:44:36.094664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:45:08.101051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:54:31.112443 3.002230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 02:54:38.120037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:54:46.123704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:55:02.124685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:55:34.130011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 02:59:33.645967 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 02:59:33.646124 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 02:59:49.089242 0.149946 tcp 10.0.2.105 61368 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:59:49.239529 0.144408 tcp 10.0.2.105 61369 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:59:49.384476 0.150249 tcp 10.0.2.105 61370 -> 195.113.214.236 443 SRPA* 0 0 35 29210 flow=From-Botnet-V2-TCP-Established 1970/02/03 02:59:49.535312 0.216065 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:59:49.714346 0.105405 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:59:49.813951 0.151651 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:59:49.962862 0.106926 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:59:50.030195 0.190079 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/03 02:59:50.212957 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 03:00:07.514394 0.070802 tcp 10.0.2.105 61371 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:07.585495 0.053189 tcp 10.0.2.105 61372 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:07.639004 0.149372 tcp 10.0.2.105 61373 -> 195.113.214.236 443 SRPA* 0 0 42 24228 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:07.788940 0.104060 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:07.903980 0.241217 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:08.143741 0.355479 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:08.483855 0.096173 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:08.560990 0.093614 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:08.634162 0.257321 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:08.845141 0.182445 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:09.019581 0.225643 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:09.237496 0.168799 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:09.384490 0.234342 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:09.597239 0.131890 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:09.738248 0.354137 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:10.063833 0.258095 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:10.318865 0.169734 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:10.435913 0.000000 udp 10.0.2.105 7010 -> 190.205.193.197 7746 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 03:00:28.093762 0.056000 tcp 10.0.2.105 61374 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:28.149992 0.081815 tcp 10.0.2.105 61375 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:28.232082 0.159048 tcp 10.0.2.105 61376 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:00:28.391640 0.214221 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:28.598497 0.262933 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:28.812806 0.195182 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:29.001589 0.247751 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:00:29.216672 0.171791 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:01:38.136089 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 03:01:45.144143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:01:53.144946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:02:09.149055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:02:11.943179 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 03:02:11.943327 0.525479 tcp 10.0.2.105 61377 -> 31.192.24.67 3527 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:02:41.154843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:08:45.160575 3.001615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:08:52.168087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:09:00.169688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:09:16.172618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:09:48.178156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:15:54.187856 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:16:01.194853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:16:09.196554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:16:25.199217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:16:57.205491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:23:01.211238 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:23:08.218964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:23:16.220319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:23:32.223324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:24:04.229455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:30:08.235432 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:30:15.242756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:30:23.244116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:30:39.249331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:30:49.722661 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 03:30:49.722753 0.055413 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:30:49.771752 0.000000 udp 10.0.2.105 7010 -> 190.205.193.197 7746 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 03:31:07.098535 0.053518 tcp 10.0.2.105 61378 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:31:07.152328 0.059680 tcp 10.0.2.105 61379 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:31:07.212312 0.149313 tcp 10.0.2.105 61380 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:31:07.448544 0.114531 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:07.520953 0.193197 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:07.706873 0.151458 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:07.909568 0.106557 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.011126 0.214273 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.187409 0.184570 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.412518 0.095603 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.488047 0.076588 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.550226 0.244678 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.793725 0.174317 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:08.959836 0.225213 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:09.176993 0.171469 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:09.325257 0.257575 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:09.535375 0.087337 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:09.633231 0.256392 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:09.885939 0.234415 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:10.099957 0.138469 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:10.335806 0.364772 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:10.672448 0.176397 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:10.804759 0.218806 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:11.015776 0.259734 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:11.244941 0.210848 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:11.259471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:31:11.411181 0.198034 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:31:11.601046 0.173935 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/03 03:32:12.471580 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 03:32:12.471775 0.604014 tcp 10.0.2.105 61381 -> 31.192.24.67 3527 FSPA* 0 0 14 1497 flow=From-Botnet-V2-TCP-Established 1970/02/03 03:37:15.260104 3.000855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:37:22.266685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:37:30.268195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:37:46.271433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:38:18.277409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:44:22.282643 3.002303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:44:29.290568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:44:37.292274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:44:53.295235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:45:25.301450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:54:41.313051 3.002108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 03:54:48.321004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:54:56.322554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:55:12.325408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 03:55:44.331404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:01:15.377697 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:01:15.377962 0.053852 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:15.427909 0.141800 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:15.590206 0.107822 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:15.692506 0.216970 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:15.871571 0.110859 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:15.945931 0.189500 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.127731 0.109120 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.244539 0.084549 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.310086 0.076743 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.372399 0.240782 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.611279 0.178702 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:16.783315 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:01:32.743824 0.052484 tcp 10.0.2.105 61382 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:32.796588 0.055414 tcp 10.0.2.105 61383 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:32.852268 0.150284 tcp 10.0.2.105 61384 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:33.003275 0.172442 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:33.152918 0.259158 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:33.363944 0.090320 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:33.434650 0.301381 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:33.731273 0.231907 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:33.943807 0.173189 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:34.063334 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:01:48.337019 3.002474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:01:49.406645 0.053103 tcp 10.0.2.105 61385 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:49.460030 0.060049 tcp 10.0.2.105 61386 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:49.520394 0.164458 tcp 10.0.2.105 61387 -> 195.113.214.236 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:01:49.685653 0.256800 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:49.906353 0.124599 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:50.041221 0.359029 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:50.372739 0.173654 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:50.562913 0.313205 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:50.829293 0.205378 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:01:55.344792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:02:03.346151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:02:13.079933 0.682859 tcp 10.0.2.105 61388 -> 31.192.24.67 3527 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:02:19.349472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:02:51.361125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:08:55.360967 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:09:02.368596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:09:10.369999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:09:26.373182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:09:58.379324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:16:02.386582 3.000742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:16:09.392654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:16:17.394316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:16:33.397333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:17:05.403272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:23:09.409258 3.095137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:23:16.482838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:23:24.438123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:23:40.441273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:24:12.447381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:30:16.453750 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:30:23.460729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:30:31.462209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:30:47.465413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:31:19.475875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:32:01.802704 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:32:01.802903 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:32:13.769738 0.576595 tcp 10.0.2.105 61389 -> 31.192.24.67 3527 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:18.887596 0.053791 tcp 10.0.2.105 61390 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:18.941635 0.055061 tcp 10.0.2.105 61391 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:18.996971 0.269416 tcp 10.0.2.105 61392 -> 195.113.214.236 443 SRPA* 0 0 42 23508 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:19.267038 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:32:36.322471 0.052190 tcp 10.0.2.105 61393 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:36.374978 0.052504 tcp 10.0.2.105 61394 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:36.427762 0.160535 tcp 10.0.2.105 61395 -> 195.113.214.236 443 SRPA* 0 0 77 70336 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:36.588949 0.107809 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:36.689633 0.215726 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:36.899179 0.108425 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:36.968357 0.148480 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.157106 0.107498 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.306630 0.091623 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.380269 0.078616 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.443916 0.055997 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.581087 0.190573 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:37.763334 0.240237 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:38.002147 0.176643 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:38.171197 0.272033 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:38.440350 0.238264 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:38.658158 0.169859 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:38.776731 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:32:55.870633 0.060997 tcp 10.0.2.105 61396 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:55.931880 0.054709 tcp 10.0.2.105 61397 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:55.986841 0.156629 tcp 10.0.2.105 61398 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 04:32:56.144004 0.168802 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:56.290990 0.091409 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:56.477934 0.252437 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:56.693941 0.172640 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:57.593009 0.217054 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:57.761085 0.199174 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:57.952394 0.124683 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:58.197545 0.352074 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:58.596034 1.302539 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 8 3237 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:32:59.903496 0.388559 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 8 3225 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:00.255816 0.216375 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 8 3238 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:00.432775 0.295371 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 8 3098 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:00.825219 0.228927 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 8 2948 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:01.047125 0.134380 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 8 3006 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:01.164897 0.141712 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 8 3126 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:01.289231 0.384313 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 8 2879 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:01.659406 0.366277 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 8 2970 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:02.018323 0.478127 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 8 2890 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:02.494804 0.334541 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3074 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:02.822167 0.140176 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 3027 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:03.034047 0.285824 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 8 3187 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:03.267333 0.450205 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 8 2885 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:03.697911 0.441602 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 8 2829 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:04.136972 0.202570 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 8 3000 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:04.319672 0.480677 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3142 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:04.763384 0.318203 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 2986 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:05.059758 0.386846 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 8 2918 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:05.399296 0.388611 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 8 3212 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:05.782335 0.357734 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 8 3177 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:06.150927 0.341152 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 8 2714 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:06.471222 0.679382 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 8 2993 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:07.121784 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:13.468769 0.267083 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 8 3170 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:33:13.781772 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:20.705579 0.000000 udp 10.0.2.105 7010 -> 222.96.230.154 4347 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:25.311909 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:33:26.444047 0.000000 udp 10.0.2.105 7010 -> 65.101.188.16 5576 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:32.412477 0.000000 udp 10.0.2.105 7010 -> 211.21.138.89 5029 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:40.614219 0.000000 udp 10.0.2.105 7010 -> 68.5.122.6 8214 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:49.116280 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1564 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:33:53.813146 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:33:55.235111 0.000000 udp 10.0.2.105 7010 -> 88.243.110.223 4072 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:01.884795 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:10.857905 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:18.318392 0.147582 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:18.465974 0.000000 icmp 80.241.249.86 0x0303 -> 10.0.2.105 0x4708 URP 192 1 270 flow=Background 1970/02/03 04:34:23.315639 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:34:23.486215 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:32.238414 0.000000 udp 10.0.2.105 7010 -> 82.29.99.200 9573 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:40.390504 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:47.059668 0.161180 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 8 3044 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:34:47.229328 0.000000 udp 10.0.2.105 7010 -> 50.84.63.126 9414 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:34:51.816206 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:34:53.929505 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:02.882822 0.000000 udp 10.0.2.105 7010 -> 188.218.81.23 2487 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:08.901113 0.000000 udp 10.0.2.105 7010 -> 88.231.46.167 2157 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:16.802763 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:21.319102 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:35:22.120180 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:30.652476 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:38.293515 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:44.873350 0.000000 udp 10.0.2.105 7010 -> 211.26.10.184 4600 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:49.809339 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:35:51.261779 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:35:58.923272 0.000000 udp 10.0.2.105 7010 -> 93.193.134.195 7662 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:06.173424 0.000000 udp 10.0.2.105 7010 -> 87.8.38.123 9555 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:11.360614 0.064191 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:11.424805 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 192 flow=Background 1970/02/03 04:36:16.317510 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:36:16.628564 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:22.136280 0.000000 udp 10.0.2.105 7010 -> 86.5.175.14 1691 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:31.028870 0.000000 udp 10.0.2.105 7010 -> 86.173.40.197 1962 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:37.318290 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:42.315661 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:36:45.380011 0.335833 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2951 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:36:45.746502 0.000000 udp 10.0.2.105 7010 -> 5.157.115.86 9630 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:36:53.401568 0.130554 udp 10.0.2.105 7010 <-> 78.55.150.127 1228 CON 0 0 8 3064 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:36:53.590171 0.000000 udp 10.0.2.105 7010 -> 77.176.214.204 9077 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:00.111173 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:05.659175 0.000000 udp 10.0.2.105 7010 -> 79.36.115.178 8561 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:10.315582 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:37:14.041088 0.000000 udp 10.0.2.105 7010 -> 86.98.90.69 8188 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:19.759260 0.307714 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 8 3130 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:37:20.078748 0.000000 udp 10.0.2.105 7010 -> 122.169.78.250 2397 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:23.478080 3.000735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 04:37:25.167360 0.383069 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 8 3122 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:37:25.551018 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:30.484830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:37:30.555183 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:35.311014 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:37:36.112972 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:38.485868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:37:43.633736 0.197022 udp 10.0.2.105 7010 <-> 81.155.249.248 7785 CON 0 0 8 2861 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:37:43.861484 0.000000 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:52.606688 0.000000 udp 10.0.2.105 7010 -> 172.13.6.157 3233 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:54.489157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:37:58.976000 0.124933 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:37:59.100933 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 153 flow=Background 1970/02/03 04:38:03.812185 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:38:04.753873 0.000000 udp 10.0.2.105 7010 -> 82.20.247.78 2403 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:10.532452 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:15.829419 0.000000 udp 10.0.2.105 7010 -> 24.181.212.213 3380 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:21.948695 0.000000 udp 10.0.2.105 7010 -> 94.94.96.81 2651 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:26.495413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:38:30.140610 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:34.817003 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:38:37.651309 0.118931 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 8 2842 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:38:37.800143 0.149822 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 8 2806 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:38:37.961822 0.350286 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 8 3327 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:38:38.331682 0.197835 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 8 3177 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:38:38.547469 0.000000 udp 10.0.2.105 7010 -> 176.221.167.25 1233 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:44.892067 0.187933 udp 10.0.2.105 7010 <-> 85.74.91.59 2536 CON 0 0 8 2936 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:38:45.067510 0.000000 udp 10.0.2.105 7010 -> 88.244.188.206 6778 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:51.831882 0.000000 udp 10.0.2.105 7010 -> 94.200.40.66 7209 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:38:58.151043 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:02.817181 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:39:03.188181 0.078223 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 8 3089 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:39:03.270292 0.000000 udp 10.0.2.105 7010 -> 190.100.23.138 5273 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:08.805967 0.000000 udp 10.0.2.105 7010 -> 93.46.222.173 3954 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:14.654390 0.000000 udp 10.0.2.105 7010 -> 109.158.13.56 5276 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:22.836218 0.000000 udp 10.0.2.105 7010 -> 79.42.91.175 4201 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:27.813283 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:39:28.604542 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:37.597466 0.000000 udp 10.0.2.105 7010 -> 176.198.66.204 5230 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:44.267455 0.000000 udp 10.0.2.105 7010 -> 209.44.18.43 6239 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:51.777691 0.000000 udp 10.0.2.105 7010 -> 68.125.34.205 2118 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:39:56.314145 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:40:00.512795 0.000000 udp 10.0.2.105 7010 -> 41.233.98.213 8752 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:05.938432 0.000000 udp 10.0.2.105 7010 -> 80.176.166.97 6550 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:14.661076 0.000000 udp 10.0.2.105 7010 -> 82.27.195.221 8740 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:20.249329 0.000000 udp 10.0.2.105 7010 -> 37.24.240.229 3741 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:24.815251 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:40:26.467943 0.113524 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 8 3104 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:40:26.599969 0.193994 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 8 3021 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:40:26.821352 0.793199 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 8 2973 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:40:27.623434 0.413606 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3148 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:40:28.056024 0.120669 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 8 3203 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:40:28.207236 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 4949 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:34.489334 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:41.789453 0.000000 udp 10.0.2.105 7010 -> 188.118.144.121 1366 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:49.982419 0.000000 udp 10.0.2.105 7010 -> 88.230.86.240 1037 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:40:54.817930 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:40:56.771529 0.000000 udp 10.0.2.105 7010 -> 79.24.69.89 5316 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:05.604019 0.000000 udp 10.0.2.105 7010 -> 87.208.134.202 7988 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:12.273753 0.000000 udp 10.0.2.105 7010 -> 85.102.55.45 6915 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:20.751176 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:25.311918 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:41:27.014375 0.176513 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 8 3058 flow=From-Botnet-V2-UDP-Established 1970/02/03 04:41:27.214402 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:34.024885 0.000000 udp 10.0.2.105 7010 -> 82.104.84.169 4248 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:41.595704 0.000000 udp 10.0.2.105 7010 -> 37.232.57.39 6943 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:49.837568 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:41:54.814464 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 04:41:56.667430 0.000000 udp 10.0.2.105 7010 -> 96.44.34.101 4364 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:42:03.527495 0.000000 udp 10.0.2.105 7010 -> 86.24.107.22 1230 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:42:12.450115 0.000000 udp 10.0.2.105 7010 -> 92.232.98.23 8223 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 04:44:30.501895 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 04:44:37.508944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:44:45.510296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:45:01.513397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:45:33.519147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:54:45.528372 2.998642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 04:54:52.532716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:55:00.534419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:55:16.537441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 04:55:48.543582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:01:52.550533 3.000736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:01:59.557200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:02:07.558686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:02:14.348542 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 05:02:14.348757 1.325444 tcp 10.0.2.105 61399 -> 31.192.24.67 3527 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:02:23.561139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:02:55.567546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:08:59.574301 3.000454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:09:06.580894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:09:14.582282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:09:30.585528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:10:02.591269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:12:34.790355 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 05:12:34.790510 0.262596 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.000430 0.215353 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.179996 0.104882 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.279948 0.092362 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.354634 0.107554 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.422212 0.159811 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.579470 0.103640 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.710156 0.192787 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.895321 0.079994 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:35.959275 0.058289 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.007713 0.166780 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.119737 0.244951 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.363179 0.173793 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.529479 0.237695 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.746675 0.213339 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:36.957001 0.168253 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.104090 0.087242 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.172694 0.258769 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.398738 0.145447 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.545769 0.227920 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.730348 0.193821 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:37.925991 0.350419 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.250298 0.171513 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.398663 0.109549 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.489945 0.095051 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.569573 0.173194 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.739463 0.080183 udp 10.0.2.105 7010 <-> 78.55.150.127 1228 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.798023 0.161967 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:38.976785 0.220866 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:39.151633 0.000000 udp 10.0.2.105 7010 -> 81.155.249.248 7785 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:12:55.521824 0.053732 tcp 10.0.2.105 61400 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:12:55.575927 0.059297 tcp 10.0.2.105 61401 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:12:55.635485 0.149695 tcp 10.0.2.105 61402 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:12:55.785664 0.086087 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:55.855927 0.058012 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:55.918841 0.176818 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:56.092950 0.099133 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:12:56.201355 0.000000 udp 10.0.2.105 7010 -> 85.74.91.59 2536 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:13:14.858387 0.055441 tcp 10.0.2.105 61403 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:14.914212 0.054266 tcp 10.0.2.105 61404 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:14.968768 0.150944 tcp 10.0.2.105 61405 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:15.120228 0.047745 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:13:15.151447 0.083292 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:13:15.249585 0.065263 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:13:15.307619 0.217809 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:13:15.517890 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:13:32.593744 0.055798 tcp 10.0.2.105 61406 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:32.649805 0.059482 tcp 10.0.2.105 61407 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:32.709652 0.150748 tcp 10.0.2.105 61408 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:13:32.860675 0.058922 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:13:33.285258 0.106167 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:16:06.598228 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 05:16:13.606939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:16:21.606195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:16:37.609334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:17:09.615355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:23:13.623475 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:23:20.631599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:23:28.630073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:23:44.633369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:24:16.639521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:30:20.646364 3.000557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:30:27.652797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:30:35.654154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:30:51.657327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:31:23.663003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:32:15.678427 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 05:32:15.678632 0.695964 tcp 10.0.2.105 61409 -> 31.192.24.67 3527 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:37:27.669504 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:37:34.676885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:37:42.678156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:37:58.681158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:38:30.687375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:43:55.995316 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 05:43:55.995442 0.000000 udp 10.0.2.105 7010 -> 81.155.249.248 7785 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:44:12.080183 0.053839 tcp 10.0.2.105 61410 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:12.134368 0.056815 tcp 10.0.2.105 61411 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:12.191444 0.152601 tcp 10.0.2.105 61412 -> 195.113.214.236 443 SRPA* 0 0 41 33796 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:12.344739 0.000000 udp 10.0.2.105 7010 -> 85.74.91.59 2536 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:44:28.256636 0.052669 tcp 10.0.2.105 61413 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:28.309576 0.053590 tcp 10.0.2.105 61414 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:28.363031 0.146200 tcp 10.0.2.105 61415 -> 195.113.214.236 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:28.509759 0.399612 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:28.893318 0.110192 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:28.966709 0.153264 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:29.274291 0.093459 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:29.347572 0.106252 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:29.447919 0.217292 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:29.628022 0.444276 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.023508 0.153927 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.127544 0.241677 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.367772 0.174078 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.533579 0.103026 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.737721 0.080494 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.804200 0.189216 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:30.985535 0.058436 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:31.098117 0.249379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:31.316324 0.131470 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:31.473205 0.216697 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:31.644170 0.242289 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:31.865469 0.171131 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.014807 0.088027 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.082335 0.270959 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.350653 0.088450 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.422553 0.172436 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.592008 0.353334 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:32.918850 0.193563 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.106913 0.091387 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.235900 0.171678 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.450087 0.157708 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.665882 0.077389 udp 10.0.2.105 7010 <-> 78.55.150.127 1228 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.719481 0.220216 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:33.887844 0.098543 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.052980 0.089562 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.127548 0.176377 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.301381 0.057121 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.433331 0.062604 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.495769 0.046519 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.571112 0.064535 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.626830 0.218781 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:44:34.697113 3.005907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 05:44:34.834331 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 05:44:41.700544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:44:49.702188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:44:52.026086 0.053371 tcp 10.0.2.105 61416 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:52.079778 0.052810 tcp 10.0.2.105 61417 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:52.132854 0.165642 tcp 10.0.2.105 61418 -> 195.113.214.236 443 SRPA* 0 0 65 44398 flow=From-Botnet-V2-TCP-Established 1970/02/03 05:44:52.299032 0.112296 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 05:45:05.705280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:45:37.711063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:54:47.724961 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 05:54:54.731927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:55:02.733474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:55:18.736684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 05:55:50.742296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:01:54.748520 3.002481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:02:01.756476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:02:09.757616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:02:16.380637 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 06:02:16.380739 0.543704 tcp 10.0.2.105 61419 -> 31.192.24.67 3527 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:02:25.760732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:02:57.766556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:09:01.772166 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:09:08.779742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:09:16.781418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:09:32.784520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:10:04.790579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:14:57.591647 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 06:14:57.591876 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 06:15:16.470991 0.053292 tcp 10.0.2.105 61420 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:16.525152 0.056231 tcp 10.0.2.105 61421 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:16.581670 0.153301 tcp 10.0.2.105 61422 -> 195.113.214.236 443 SRPA* 0 0 43 37080 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:16.735638 0.144320 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:16.882588 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 06:15:32.332060 0.051381 tcp 10.0.2.105 61423 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:32.383706 0.053869 tcp 10.0.2.105 61424 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:32.437819 0.148779 tcp 10.0.2.105 61425 -> 195.113.214.236 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:32.587235 0.112091 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:32.662588 0.115091 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:32.772874 0.218036 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:32.953197 0.256369 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:33.163180 0.171667 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:33.527905 0.093699 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:33.602831 0.076236 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:33.664404 0.189626 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:33.846628 0.173798 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.013288 0.243196 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.254997 0.052052 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.310485 0.102831 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.439161 0.249173 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.655136 0.308311 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:34.914112 0.339981 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 1967 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:35.234238 0.167041 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:35.379547 0.089535 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:35.448423 0.145530 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:35.612791 0.348612 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:35.934974 0.188309 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.124972 0.095705 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.201688 0.094746 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.275621 0.287864 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.560230 0.173228 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.730112 0.160099 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.891662 0.079861 udp 10.0.2.105 7010 <-> 78.55.150.127 1228 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:36.948088 0.000000 udp 10.0.2.105 7010 -> 108.195.136.148 7576 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 06:15:53.041254 0.052890 tcp 10.0.2.105 61426 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:53.094422 0.064672 tcp 10.0.2.105 61427 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:53.159402 0.155107 tcp 10.0.2.105 61428 -> 195.113.214.236 443 SRPA* 0 0 40 21276 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:15:53.314678 0.099237 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.426583 0.087637 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.498108 0.171730 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.680478 0.045497 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.710602 0.065472 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.768210 0.223633 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:53.977761 0.057015 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:54.044659 0.175144 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:54.216854 0.060943 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:15:54.278349 0.106284 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:16:08.796159 3.002051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 06:16:15.803680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:16:23.805203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:16:39.808599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:17:11.814188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:23:15.824742 2.997178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:23:22.827662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:23:30.829394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:23:46.832196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:24:18.838340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:30:22.844574 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:30:29.853457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:30:37.853126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:30:53.856580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:31:25.862299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:32:16.926247 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 06:32:16.926343 0.627189 tcp 10.0.2.105 61429 -> 31.192.24.67 3527 FSPA* 0 0 14 1511 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:37:29.868332 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:37:36.875615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:37:44.877221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:38:00.880135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:38:32.886144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:44:36.892665 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:44:43.899089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:44:51.901255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:45:07.904255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:45:39.912843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:46:21.109352 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 06:46:21.109450 0.403277 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:21.497409 0.220813 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:21.667005 0.142237 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:21.864369 0.108988 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:21.964346 0.110194 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.034882 0.179570 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.159311 0.097209 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.271803 0.077590 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.333832 0.258001 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.542432 0.209999 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.717201 0.244562 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:22.960142 0.054974 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:23.060787 0.120154 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:23.304330 0.258158 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:23.527179 0.175117 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:23.695326 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 06:46:42.231469 0.052153 tcp 10.0.2.105 61430 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:46:42.283911 0.032843 tcp 10.0.2.105 61431 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:46:42.317097 0.115216 tcp 10.0.2.105 61432 -> 195.113.214.236 443 SRPA* 0 0 60 39625 flow=From-Botnet-V2-TCP-Established 1970/02/03 06:46:42.433037 0.171544 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:42.581264 0.085784 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:42.658364 0.131426 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:42.828601 0.335432 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:43.143753 0.216843 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:43.316018 0.096199 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:43.408626 0.303861 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:43.709096 0.239248 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:43.940501 0.351934 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.263997 0.199315 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.458536 0.166332 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.608574 0.171223 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.784899 0.076016 udp 10.0.2.105 7010 <-> 78.55.150.127 1228 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.839302 0.098949 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:44.944908 0.087982 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.016484 0.170185 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.229222 0.047842 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.261050 0.065918 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.318976 0.217783 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.528170 0.063446 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.590563 0.107137 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.667711 0.058753 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:46:45.765120 0.175661 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/03 06:54:49.922780 3.067233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 06:54:56.963195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:55:04.952881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:55:20.955620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 06:55:52.961919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:01:56.967657 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:02:03.975226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:02:11.976274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:02:17.555502 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 07:02:17.555659 0.508456 tcp 10.0.2.105 61433 -> 31.192.24.67 3527 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:02:27.979393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:02:59.986131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:09:03.992956 3.000432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:09:10.999086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:09:19.000521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:09:35.003489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:10:07.008987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:16:11.015599 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:16:18.023158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:16:26.024613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:16:42.027108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:17:01.055328 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 07:17:01.055557 0.193843 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.241744 0.142218 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.417537 0.132500 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.539647 0.108435 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.608782 0.174014 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.776454 0.093371 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:01.850556 0.400502 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:02.233221 0.228011 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:02.410895 0.217269 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:02.592972 0.243389 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:02.834443 0.059217 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:02.907199 0.255362 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.112525 0.073017 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.171023 0.251102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.386854 0.086242 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.600358 0.191721 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.783944 0.167746 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.927929 0.089807 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:03.998915 0.131502 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:04.146561 0.342441 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:04.466751 0.223180 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:04.687272 0.173254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:04.856763 0.356891 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:05.185869 0.381921 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:05.522636 0.088031 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:05.594324 0.187202 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:05.775153 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 07:17:14.033663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:17:22.047071 0.054611 tcp 10.0.2.105 61434 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:22.101973 0.032504 tcp 10.0.2.105 61435 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:22.134727 0.146829 tcp 10.0.2.105 61436 -> 195.113.214.236 443 SRPA* 0 0 51 32122 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:22.282134 0.158826 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:22.549398 0.000000 udp 10.0.2.105 7010 -> 78.55.150.127 1228 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 07:17:39.310355 0.055895 tcp 10.0.2.105 61437 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:39.366552 0.033849 tcp 10.0.2.105 61438 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:39.400713 0.139645 tcp 10.0.2.105 61439 -> 195.113.214.236 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:39.541069 0.106550 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:57.436684 0.053583 tcp 10.0.2.105 61440 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:57.490529 0.037199 tcp 10.0.2.105 61441 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:57.527999 0.134091 tcp 10.0.2.105 61442 -> 195.113.214.236 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:17:57.662605 0.089604 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:57.734997 0.173808 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:57.921743 0.047065 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:57.952712 0.066878 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:58.032752 0.107506 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:58.106614 0.063449 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:58.171022 0.177453 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:58.344945 0.064971 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:17:58.402113 0.213567 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:23:18.040961 3.020139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 07:23:25.057196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:23:33.058742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:23:49.061695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:24:21.069320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:30:25.073312 3.002148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:30:32.081160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:30:40.082665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:30:56.085539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:31:28.097702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:32:18.063905 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 07:32:18.064017 0.646395 tcp 10.0.2.105 61443 -> 31.192.24.67 3527 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:37:32.097513 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:37:39.105271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:37:47.106922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:38:03.109643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:38:35.115614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:44:39.121686 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 07:44:46.128967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:44:54.130715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:45:10.133482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:45:42.139392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:48:11.254322 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 07:48:11.254587 0.000000 udp 10.0.2.105 7010 -> 78.55.150.127 1228 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 07:48:28.270335 0.050808 tcp 10.0.2.105 61444 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:28.321456 0.049656 tcp 10.0.2.105 61445 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:28.371441 0.139588 tcp 10.0.2.105 61446 -> 195.113.214.236 443 SRPA* 0 0 26 16263 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:28.511600 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 07:48:45.213599 0.049626 tcp 10.0.2.105 61447 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:45.263515 0.049963 tcp 10.0.2.105 61448 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:45.313786 0.133451 tcp 10.0.2.105 61449 -> 195.113.214.236 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/03 07:48:45.447775 0.098839 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:45.656867 0.106214 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:45.757678 0.145090 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:45.898835 0.189837 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.080838 0.112203 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.152562 0.218399 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.323777 0.214944 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.503707 0.266643 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.801194 0.066232 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:46.973122 0.174051 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.089570 0.400516 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.473594 0.095410 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.554393 0.174826 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.720520 0.172132 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.870854 0.085946 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:47.970790 0.253642 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:48.176963 0.109629 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:48.382941 0.080502 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:48.449257 0.257309 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:48.671828 0.349715 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:48.993935 0.268708 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:49.242130 0.138539 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:49.463793 0.173340 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:49.634138 0.213194 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:49.844654 0.096846 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:49.946515 0.202676 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:50.144066 0.220137 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:50.316413 0.154091 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:50.581022 0.088759 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:50.654702 0.172668 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.002641 0.133996 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.075528 0.083001 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.241280 0.108497 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.318251 0.057376 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.390442 0.217881 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.600120 0.180600 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:48:51.988963 0.065193 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/03 07:54:50.150847 3.040173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 07:54:57.170889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:55:05.169151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:55:21.173392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 07:55:53.177957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:01:57.184544 3.002969 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:02:04.191484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:02:12.192850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:02:18.713063 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 08:02:18.713216 0.580593 tcp 10.0.2.105 61450 -> 31.192.24.67 3527 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:02:28.196140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:03:00.202209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:09:15.214655 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:09:22.221470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:09:30.222770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:09:46.225500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:10:18.231781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:16:34.245569 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:16:41.252527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:16:49.253779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:17:05.257170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:17:37.263267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:19:15.314244 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 08:19:15.314394 0.142578 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:15.707973 0.189272 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:15.889493 0.100158 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.016645 0.109963 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.122345 0.110082 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.199835 0.293321 udp 10.0.2.105 7010 <-> 108.195.136.148 7576 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.446872 0.227960 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.637602 0.244649 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:16.880604 0.052648 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.010710 0.175676 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.131461 0.173682 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.298576 0.174053 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.448388 0.090369 udp 10.0.2.105 7010 <-> 86.140.120.36 4984 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.529606 0.405617 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:17.917422 0.090723 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.035535 0.375246 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.363292 0.105003 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.529319 0.081989 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.595419 0.257918 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.819744 0.145289 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:18.984192 0.346647 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:19.303309 0.233019 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:19.516839 0.096375 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:19.644858 0.173559 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:19.814766 0.235756 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.047661 0.204234 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.268809 0.218423 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.437792 0.164043 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.601763 0.087488 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.753590 0.059917 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.896371 0.108666 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:20.974597 0.070688 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:21.103404 0.171973 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:21.391621 0.047233 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:21.423392 0.065802 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:21.480877 0.212140 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:19:21.685183 0.204745 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:23:44.274378 3.026876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:23:51.290796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:23:59.292039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:24:15.295307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:24:47.301404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:30:51.307514 3.004145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:30:58.320491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:31:06.320850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:31:22.319560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:31:54.325150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:32:19.301897 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 08:32:19.302008 0.592374 tcp 10.0.2.105 61451 -> 31.192.24.67 3527 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:37:58.331061 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:38:05.338862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:38:13.340267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:38:29.343177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:39:01.349151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:45:05.356729 3.002276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:45:12.363996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:45:20.374566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:45:36.367119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:46:08.373148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:49:35.862040 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 08:49:35.862204 0.099578 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:35.983755 0.108295 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:36.086798 0.143865 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:36.248950 0.188814 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:36.430088 0.110183 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:36.502599 0.000000 udp 10.0.2.105 7010 -> 108.195.136.148 7576 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 08:49:55.461901 0.048991 tcp 10.0.2.105 61452 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:49:55.511161 0.050943 tcp 10.0.2.105 61453 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:49:55.562380 0.137728 tcp 10.0.2.105 61454 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:49:55.700525 0.210402 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:55.876403 0.243859 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.118706 0.052364 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.180823 0.174266 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.300059 0.175402 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.467433 0.402293 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.854781 0.089387 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:56.927701 0.263354 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:57.140251 0.243092 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:49:57.359976 0.000000 udp 10.0.2.105 7010 -> 86.140.120.36 4984 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 08:50:13.596395 0.048527 tcp 10.0.2.105 61455 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:13.645286 0.052055 tcp 10.0.2.105 61456 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:13.697638 0.134915 tcp 10.0.2.105 61457 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:13.832842 0.101286 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:14.004443 0.078968 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:14.068974 0.252485 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:14.286867 0.158050 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:14.501798 0.353115 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:14.826212 0.234781 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:15.040991 0.284199 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:15.322471 0.196625 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:15.541137 1.088462 udp 10.0.2.105 7010 <-> 75.90.102.249 6029 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:16.584738 0.160935 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:16.833625 0.093067 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:16.910544 0.172839 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.079977 0.088819 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.153332 0.061220 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.262854 0.105647 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.337959 0.073182 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.413824 0.170674 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:17.569188 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 08:50:36.188868 0.049418 tcp 10.0.2.105 61458 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:36.238602 0.051177 tcp 10.0.2.105 61459 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:36.289639 0.134818 tcp 10.0.2.105 61460 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:36.424643 0.065985 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:50:36.483259 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 08:50:51.601023 0.049192 tcp 10.0.2.105 61461 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:51.650566 0.050384 tcp 10.0.2.105 61462 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:51.701197 0.140240 tcp 10.0.2.105 61463 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 08:50:51.841914 0.177065 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/03 08:52:12.379034 3.001913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 08:52:19.386781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:52:27.388653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:52:43.391126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:53:15.397199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:59:19.403488 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 08:59:26.410922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:59:34.412492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 08:59:50.415319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:00:22.420977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:02:19.899967 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 09:02:19.900111 0.563624 tcp 10.0.2.105 61464 -> 31.192.24.67 3527 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:06:51.433253 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:06:58.440337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:07:06.441873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:07:22.445074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:07:54.451243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:13:58.457471 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:14:05.464462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:14:13.466070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:14:29.468984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:15:01.475144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:20:54.833428 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 09:20:54.833700 0.000000 udp 10.0.2.105 7010 -> 108.195.136.148 7576 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 09:21:06.483488 3.000391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:21:11.729767 0.055058 tcp 10.0.2.105 61465 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:11.785095 0.036132 tcp 10.0.2.105 61466 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:11.821528 0.136262 tcp 10.0.2.105 61467 -> 195.113.214.236 443 SRPA* 0 0 64 41471 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:11.957964 0.000000 udp 10.0.2.105 7010 -> 86.140.120.36 4984 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 09:21:13.489792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:21:21.491311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:21:30.725545 0.052814 tcp 10.0.2.105 61468 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:30.778616 0.033311 tcp 10.0.2.105 61469 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:30.812212 0.162995 tcp 10.0.2.105 61470 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:30.975754 0.046530 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.007194 0.211665 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.211833 0.100251 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.337051 0.118957 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.448566 0.190648 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.630872 0.142043 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.800929 0.110294 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:31.871683 0.214820 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.051940 0.174588 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.219646 0.070312 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.298165 0.176267 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.419564 0.241204 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.659155 0.092184 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:32.732235 0.400175 udp 10.0.2.105 7010 <-> 203.45.222.240 5574 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.115530 0.263028 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.329985 0.170464 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.477489 0.124160 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.616967 0.256751 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.836653 0.083176 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:33.907081 0.103229 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:34.085216 0.269002 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:34.332998 0.348081 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:34.654610 0.222562 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:34.873580 0.201804 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:35.070792 0.000000 udp 10.0.2.105 7010 -> 75.90.102.249 6029 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 09:21:37.494767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:21:53.958844 0.051888 tcp 10.0.2.105 61471 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:54.011005 0.040795 tcp 10.0.2.105 61472 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:54.052049 0.150710 tcp 10.0.2.105 61473 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:21:54.203280 0.087650 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.275594 0.072590 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.360908 0.162378 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.553198 0.172245 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.722103 0.091350 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.795976 0.108453 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:54.871296 0.173401 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:55.121046 0.085522 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:55.212818 0.065006 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:21:55.270162 0.177187 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:22:09.500349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:28:16.510248 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:28:23.519157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:28:31.519567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:28:47.522670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:29:19.528759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:32:20.469408 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 09:32:20.469555 0.637983 tcp 10.0.2.105 61474 -> 31.192.24.67 3527 FSPA* 0 0 14 1660 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:35:23.540628 2.996395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:35:30.542486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:35:38.543609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:35:54.546834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:36:26.552942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:42:30.559516 3.000759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 09:42:37.566226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:42:45.567499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:43:01.570944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:43:33.576760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:52:16.290018 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 09:52:16.290203 0.000000 udp 10.0.2.105 7010 -> 75.90.102.249 6029 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 09:52:34.005846 0.054097 tcp 10.0.2.105 61475 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:34.060384 0.055518 tcp 10.0.2.105 61476 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:34.116222 0.185053 tcp 10.0.2.105 61477 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:34.302056 0.045488 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:34.332107 0.098547 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:34.492788 0.137142 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:34.621341 0.190350 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:34.804456 0.142224 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:34.948947 0.108936 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.021440 0.215400 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.200670 0.213079 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.404762 0.055207 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.541070 0.231295 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.878002 0.092122 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:35.951104 0.000000 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 09:52:53.572767 0.077010 tcp 10.0.2.105 61478 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:53.650158 0.056052 tcp 10.0.2.105 61479 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:53.706563 0.167853 tcp 10.0.2.105 61480 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 09:52:53.874920 0.243168 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.116613 0.173323 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.235999 0.145569 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.404978 0.262849 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.631592 0.078323 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.722594 0.109189 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:54.876709 0.233745 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:55.090921 0.170119 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:55.239415 0.379408 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:55.571294 0.359570 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:55.902415 0.270798 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.170339 0.202542 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.363183 0.090375 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.435637 0.071758 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.551433 0.156804 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.729315 0.173880 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:56.899895 0.172156 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:57.101563 0.069821 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:57.188864 0.065560 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:57.246694 0.176622 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:57.419715 0.092238 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:52:57.495048 0.109946 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/03 09:53:43.586140 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 09:53:50.593724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:53:58.595243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:54:14.598182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 09:54:46.605499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:00:50.610464 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 10:00:57.617725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:01:05.619312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:01:21.622017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:01:53.628267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:02:21.108180 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:02:21.108359 0.561093 tcp 10.0.2.105 61481 -> 31.192.24.67 3527 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:07:57.635269 3.002307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 10:08:04.641737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:08:12.643146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:08:28.646108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:09:00.652122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:15:04.658306 3.001533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 10:15:11.665844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:15:19.667090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:15:35.669963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:16:07.676286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:22:16.690164 3.003054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 10:22:23.699008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:22:31.701152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:22:47.703083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:23:19.707341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:23:22.372933 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:23:22.373039 0.381736 udp 10.0.2.105 7010 -> 203.45.222.240 5574 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 10:23:22.754775 0.000000 icmp 203.45.222.240 0x0303 -> 10.0.2.105 0xc615 URP 192 1 226 flow=Background 1970/02/03 10:23:39.077349 0.053732 tcp 10.0.2.105 61482 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:23:39.131374 0.055419 tcp 10.0.2.105 61483 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:23:39.187112 0.159234 tcp 10.0.2.105 61484 -> 195.113.214.236 443 SRPA* 0 0 42 34630 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:23:39.347023 0.045819 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:39.378438 0.099742 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:39.479366 0.110550 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:39.582707 0.108666 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:39.694893 0.187286 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:39.874924 0.155879 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:40.111018 0.071487 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:40.209634 0.174148 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:40.376549 0.214448 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:41.191491 0.210841 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:41.370028 0.093729 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:41.447955 0.131343 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2560 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:41.666487 0.239433 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:41.904243 0.176745 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.023081 0.248282 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.237748 0.078089 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.301924 0.107652 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.452392 0.282686 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.714072 0.169652 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:42.861050 0.398045 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:43.208444 0.213440 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:43.416581 0.090504 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:43.536738 0.380108 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:43.890069 0.295896 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:44.182571 0.063367 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:44.259440 0.160384 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:44.502024 0.173550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:44.672230 0.172584 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:44.895692 0.174403 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:45.067480 0.094885 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:45.144298 0.108550 udp 10.0.2.105 7010 <-> 109.154.157.29 1971 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:45.275413 0.114552 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:23:45.401171 0.065179 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:29:23.726148 3.018391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 10:29:30.740937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:29:38.742273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:29:54.745493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:30:26.751631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:32:21.676999 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:32:21.677174 2.995450 tcp 10.0.2.105 61485 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:32:30.669526 0.000000 tcp 10.0.2.105 61485 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:32:36.845538 0.057868 tcp 10.0.2.105 61486 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:36.903747 0.053852 tcp 10.0.2.105 61487 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:36.957860 0.179071 tcp 10.0.2.105 61488 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:37.654424 2.979106 tcp 10.0.2.105 61489 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:32:46.576660 0.000000 tcp 10.0.2.105 61489 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:32:52.510222 0.061410 tcp 10.0.2.105 61490 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:52.571921 0.054436 tcp 10.0.2.105 61491 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:52.626698 0.167164 tcp 10.0.2.105 61492 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:32:53.042142 2.993821 tcp 10.0.2.105 61493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:02.034878 0.000000 tcp 10.0.2.105 61493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:08.023806 0.053723 tcp 10.0.2.105 61494 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:33:08.077851 0.054761 tcp 10.0.2.105 61495 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:33:08.132880 0.148721 tcp 10.0.2.105 61496 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:33:08.338974 2.998916 tcp 10.0.2.105 61497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:17.346404 0.000000 tcp 10.0.2.105 61497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:23.335880 2.993933 tcp 10.0.2.105 61498 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:32.328024 0.000000 tcp 10.0.2.105 61498 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:37.315432 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:33:38.336652 2.995986 tcp 10.0.2.105 61499 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:33:47.329615 0.000000 tcp 10.0.2.105 61499 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:36:30.758550 3.000479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 10:36:37.774859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:36:45.776384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:37:01.779170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:37:33.785313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:38:53.339803 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:38:53.339899 3.004066 tcp 10.0.2.105 61500 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:02.342759 0.000000 tcp 10.0.2.105 61500 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:08.342916 0.055118 tcp 10.0.2.105 61501 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:08.398296 0.032962 tcp 10.0.2.105 61502 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:08.431649 0.135723 tcp 10.0.2.105 61503 -> 195.113.214.236 443 SRPA* 0 0 64 41471 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:08.575918 3.000021 tcp 10.0.2.105 61504 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:17.574414 0.000000 tcp 10.0.2.105 61504 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:23.574146 0.065448 tcp 10.0.2.105 61505 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:23.639895 0.036916 tcp 10.0.2.105 61506 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:23.677114 0.137591 tcp 10.0.2.105 61507 -> 195.113.214.236 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:23.844914 2.992878 tcp 10.0.2.105 61508 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:32.846473 0.000000 tcp 10.0.2.105 61508 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:38.845595 0.053719 tcp 10.0.2.105 61509 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:38.899621 0.034985 tcp 10.0.2.105 61510 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:38.934851 0.139435 tcp 10.0.2.105 61511 -> 195.113.214.236 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:39:39.090500 2.999415 tcp 10.0.2.105 61512 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:48.088553 0.000000 tcp 10.0.2.105 61512 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:39:54.086915 3.004593 tcp 10.0.2.105 61513 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:40:03.089919 0.000000 tcp 10.0.2.105 61513 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:40:07.806421 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:40:09.088705 3.004133 tcp 10.0.2.105 61514 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:40:18.091550 0.000000 tcp 10.0.2.105 61514 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:43:37.791653 3.002231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 10:43:44.801975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:43:52.799894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:44:08.803309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:44:40.808960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:45:24.092323 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:45:24.092411 3.003201 tcp 10.0.2.105 61515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:45:33.094534 0.000000 tcp 10.0.2.105 61515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:45:39.099173 0.052584 tcp 10.0.2.105 61516 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:39.152044 0.132979 tcp 10.0.2.105 61517 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:39.285293 0.142307 tcp 10.0.2.105 61518 -> 195.113.214.236 443 SRPA* 0 0 42 37026 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:39.478039 2.990023 tcp 10.0.2.105 61519 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:45:48.476786 0.000000 tcp 10.0.2.105 61519 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:45:54.475949 0.054168 tcp 10.0.2.105 61520 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:54.530383 0.033299 tcp 10.0.2.105 61521 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:54.563968 0.138035 tcp 10.0.2.105 61522 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:45:54.771095 3.005349 tcp 10.0.2.105 61523 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:03.771214 0.000000 tcp 10.0.2.105 61523 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:09.767783 0.052278 tcp 10.0.2.105 61524 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:46:09.820574 0.031754 tcp 10.0.2.105 61525 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:46:09.852657 0.289724 tcp 10.0.2.105 61526 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:46:10.275888 2.996367 tcp 10.0.2.105 61527 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:19.270558 0.000000 tcp 10.0.2.105 61527 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:25.269906 3.003959 tcp 10.0.2.105 61528 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:34.272712 0.000000 tcp 10.0.2.105 61528 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:38.808720 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:46:40.271161 3.004262 tcp 10.0.2.105 61529 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:46:49.273893 0.000000 tcp 10.0.2.105 61529 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:51:55.275796 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:51:55.275955 2.992995 tcp 10.0.2.105 61530 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:04.277462 0.000000 tcp 10.0.2.105 61530 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:10.278053 0.057758 tcp 10.0.2.105 61531 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:10.336065 0.035100 tcp 10.0.2.105 61532 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:10.371544 0.139850 tcp 10.0.2.105 61533 -> 195.113.214.236 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:10.575205 2.998239 tcp 10.0.2.105 61534 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:19.570514 0.000000 tcp 10.0.2.105 61534 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:25.568012 0.051796 tcp 10.0.2.105 61535 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:25.620115 0.032571 tcp 10.0.2.105 61536 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:25.652985 0.270037 tcp 10.0.2.105 61537 -> 195.113.214.236 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:25.944405 2.997823 tcp 10.0.2.105 61538 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:34.940374 0.000000 tcp 10.0.2.105 61538 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:40.940158 0.058544 tcp 10.0.2.105 61539 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:40.998956 0.036516 tcp 10.0.2.105 61540 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:41.035762 0.131050 tcp 10.0.2.105 61541 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:52:41.231586 3.002697 tcp 10.0.2.105 61542 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:50.232674 0.000000 tcp 10.0.2.105 61542 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:52:56.231761 3.004064 tcp 10.0.2.105 61543 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:53:05.234546 0.000000 tcp 10.0.2.105 61543 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:53:09.811131 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:53:11.233264 3.004268 tcp 10.0.2.105 61544 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:53:20.246232 0.000000 tcp 10.0.2.105 61544 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:53:48.137147 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 10:53:52.812930 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:54:05.712475 0.053922 tcp 10.0.2.105 61545 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:05.766762 0.056026 tcp 10.0.2.105 61546 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:05.823129 0.142532 tcp 10.0.2.105 61547 -> 195.113.214.236 443 SRPA* 0 0 54 37674 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:05.966361 0.100677 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.111739 0.105059 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.211868 0.110567 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.308951 0.189106 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.489916 0.141285 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.671742 0.065229 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.764870 0.212410 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:06.941200 0.091196 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.014027 0.175022 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.182212 0.213664 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.389383 0.138291 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.580203 0.244580 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.823316 0.158282 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:07.931012 0.255725 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2560 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.148175 0.078421 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.211598 0.103377 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.380092 0.261469 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.593945 0.202249 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.785846 0.088142 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:08.856823 0.235554 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:09.071668 0.173814 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:09.222909 0.390352 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:09.581469 0.200346 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:09.779095 0.061089 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:09.846749 0.163571 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:10.032773 0.181190 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:10.210525 0.090115 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:10.283729 0.000000 udp 10.0.2.105 7010 -> 109.154.157.29 1971 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 10:54:17.825196 2.997570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 10:54:24.828666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:54:27.583270 0.053154 tcp 10.0.2.105 61548 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:27.636728 0.052831 tcp 10.0.2.105 61549 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:27.689857 0.221883 tcp 10.0.2.105 61550 -> 195.113.214.236 443 SRPA* 0 0 43 24396 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:54:27.910930 0.058764 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:28.045140 0.064746 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:28.581926 0.174465 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:28.821423 0.220209 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/03 10:54:32.831814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:54:48.838608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:55:20.839346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 10:58:26.236679 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 10:58:26.236851 2.993468 tcp 10.0.2.105 61551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:58:35.229095 0.000000 tcp 10.0.2.105 61551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:58:41.239926 0.053651 tcp 10.0.2.105 61552 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:41.293905 0.054421 tcp 10.0.2.105 61553 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:41.348699 0.144771 tcp 10.0.2.105 61554 -> 195.113.214.236 443 SRPA* 0 0 33 24735 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:41.716968 2.996280 tcp 10.0.2.105 61555 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:58:50.711783 0.000000 tcp 10.0.2.105 61555 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:58:56.710453 0.052677 tcp 10.0.2.105 61556 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:56.763372 0.056582 tcp 10.0.2.105 61557 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:56.820294 0.174210 tcp 10.0.2.105 61558 -> 195.113.214.236 443 SRPA* 0 0 42 28166 flow=From-Botnet-V2-TCP-Established 1970/02/03 10:58:57.019585 3.005100 tcp 10.0.2.105 61559 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:59:06.023290 0.000000 tcp 10.0.2.105 61559 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:59:12.012195 3.003740 tcp 10.0.2.105 61560 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:59:21.014206 0.000000 tcp 10.0.2.105 61560 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 10:59:25.811827 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:01:24.846299 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:01:31.852764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:01:39.854482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:01:55.857693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:02:27.863282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:04:27.015461 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:04:27.015590 2.993333 tcp 10.0.2.105 61561 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:04:36.007713 0.000000 tcp 10.0.2.105 61561 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:04:42.018126 0.051460 tcp 10.0.2.105 61562 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:42.069853 0.053433 tcp 10.0.2.105 61563 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:42.123563 0.150108 tcp 10.0.2.105 61564 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:42.282879 2.998386 tcp 10.0.2.105 61565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:04:51.279523 0.000000 tcp 10.0.2.105 61565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:04:57.278781 0.052438 tcp 10.0.2.105 61566 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:57.331630 0.051312 tcp 10.0.2.105 61567 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:57.383200 0.165375 tcp 10.0.2.105 61568 -> 195.113.214.236 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:04:57.559040 3.004066 tcp 10.0.2.105 61569 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:05:06.561799 0.000000 tcp 10.0.2.105 61569 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:05:12.560495 3.004104 tcp 10.0.2.105 61570 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:05:21.563688 0.000000 tcp 10.0.2.105 61570 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:05:26.310147 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:08:31.869221 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:08:38.876905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:08:46.877887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:09:02.881240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:09:34.886801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:10:27.563890 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:10:27.563987 2.993561 tcp 10.0.2.105 61571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:10:36.566148 0.000000 tcp 10.0.2.105 61571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:10:42.566473 0.053733 tcp 10.0.2.105 61572 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:42.620485 0.053643 tcp 10.0.2.105 61573 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:42.674490 0.154563 tcp 10.0.2.105 61574 -> 195.113.214.236 443 SRPA* 0 0 44 22776 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:42.838277 3.001013 tcp 10.0.2.105 61575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:10:51.837799 0.000000 tcp 10.0.2.105 61575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:10:57.836996 0.051823 tcp 10.0.2.105 61576 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:57.889115 0.058739 tcp 10.0.2.105 61577 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:57.948109 0.217222 tcp 10.0.2.105 61578 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:10:58.186168 2.995389 tcp 10.0.2.105 61579 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:11:07.180116 0.000000 tcp 10.0.2.105 61579 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:11:13.178913 3.004547 tcp 10.0.2.105 61580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:11:22.181688 0.000000 tcp 10.0.2.105 61580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:11:26.808138 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:15:38.892401 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:15:45.900616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:15:53.902699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:16:09.905246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:16:28.182229 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:16:28.182364 3.003421 tcp 10.0.2.105 61581 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:16:37.184743 0.000000 tcp 10.0.2.105 61581 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:16:41.911400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:16:43.184701 0.055367 tcp 10.0.2.105 61582 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:43.240519 0.054411 tcp 10.0.2.105 61583 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:43.295211 0.151478 tcp 10.0.2.105 61584 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:43.473328 2.994587 tcp 10.0.2.105 61585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:16:52.476169 0.000000 tcp 10.0.2.105 61585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:16:58.467477 0.053487 tcp 10.0.2.105 61586 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:58.521247 0.054948 tcp 10.0.2.105 61587 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:58.576716 0.168443 tcp 10.0.2.105 61588 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:16:58.782321 2.997347 tcp 10.0.2.105 61589 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:17:07.778177 0.000000 tcp 10.0.2.105 61589 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:17:13.777178 3.004441 tcp 10.0.2.105 61590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:17:22.779695 0.000000 tcp 10.0.2.105 61590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:17:27.306890 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:22:45.922549 2.998844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:22:52.927656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:23:00.926287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:23:16.929106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:23:48.935719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:24:54.650080 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:24:54.650229 0.048719 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:24:54.682430 0.000000 udp 10.0.2.105 7010 -> 109.154.157.29 1971 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 11:24:58.796099 2.994049 tcp 10.0.2.105 61591 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:25:07.788490 0.000000 tcp 10.0.2.105 61591 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:25:11.826179 0.057431 tcp 10.0.2.105 61592 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:11.883848 0.053373 tcp 10.0.2.105 61593 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:11.937484 0.154767 tcp 10.0.2.105 61594 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:12.092793 0.113857 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.169307 0.099562 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.284893 0.109224 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.387930 0.189767 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.570489 0.212086 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.748171 0.095112 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:12.821255 0.226183 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.044793 0.151544 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.245118 0.131390 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.443819 0.213733 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.650468 0.174169 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.797289 0.051571 tcp 10.0.2.105 61595 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:13.817785 0.160894 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:13.849301 0.060546 tcp 10.0.2.105 61596 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:13.910310 0.157692 tcp 10.0.2.105 61597 -> 195.113.214.236 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:25:13.923802 0.259014 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.146389 0.083372 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.184745 2.997868 tcp 10.0.2.105 61598 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:25:14.221498 0.244913 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.465089 0.088479 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.536750 0.124961 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.681795 0.256776 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:14.890012 0.202724 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:15.087253 0.234542 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:15.302384 0.171514 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:15.449294 0.350466 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:15.772394 0.159971 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:15.940968 0.178940 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.117167 0.091494 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.208431 0.062293 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.280594 0.249262 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 1964 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.527491 0.060454 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 1976 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.592794 0.066785 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.651151 0.169899 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:16.822434 0.231680 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:25:23.181027 0.000000 tcp 10.0.2.105 61598 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:29:52.940535 3.002287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 11:29:59.948772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:30:07.950229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:30:23.953398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:30:29.182753 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:30:29.182865 3.002662 tcp 10.0.2.105 61599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:30:38.183451 0.000000 tcp 10.0.2.105 61599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:30:44.185708 0.055400 tcp 10.0.2.105 61600 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:30:44.241333 0.053466 tcp 10.0.2.105 61601 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:30:44.295112 0.157042 tcp 10.0.2.105 61602 -> 195.113.214.236 443 SRPA* 0 0 42 23314 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:30:44.747706 2.992760 tcp 10.0.2.105 61603 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:30:53.750844 0.000000 tcp 10.0.2.105 61603 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:30:55.960887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:30:59.749243 0.056223 tcp 10.0.2.105 61604 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:30:59.805304 0.053967 tcp 10.0.2.105 61605 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:30:59.859606 0.157426 tcp 10.0.2.105 61606 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:31:00.156428 2.982827 tcp 10.0.2.105 61607 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:31:09.138872 0.000000 tcp 10.0.2.105 61607 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:31:15.147171 3.005104 tcp 10.0.2.105 61608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:31:24.149981 0.000000 tcp 10.0.2.105 61608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:31:28.806181 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:36:30.150290 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:36:30.150449 3.003241 tcp 10.0.2.105 61609 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:36:39.152536 0.000000 tcp 10.0.2.105 61609 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:36:45.152998 0.053784 tcp 10.0.2.105 61610 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:36:45.207193 0.054328 tcp 10.0.2.105 61611 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:36:45.261797 0.155118 tcp 10.0.2.105 61612 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:36:45.715012 3.001810 tcp 10.0.2.105 61613 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:36:54.715139 0.000000 tcp 10.0.2.105 61613 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:36:59.964967 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:37:00.714383 0.052755 tcp 10.0.2.105 61614 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:37:00.767379 0.059283 tcp 10.0.2.105 61615 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:37:00.826518 0.162017 tcp 10.0.2.105 61616 -> 195.113.214.236 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:37:01.146419 2.992339 tcp 10.0.2.105 61617 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:37:06.973024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:37:10.147058 0.000000 tcp 10.0.2.105 61617 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:37:14.974518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:37:16.146474 2.993164 tcp 10.0.2.105 61618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:37:25.138748 0.000000 tcp 10.0.2.105 61618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:37:29.805316 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:37:30.977015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:38:02.983873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:42:31.149502 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:42:31.149644 3.003750 tcp 10.0.2.105 61619 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:42:40.151785 0.000000 tcp 10.0.2.105 61619 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:42:46.152368 0.053696 tcp 10.0.2.105 61620 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:42:46.206356 0.054272 tcp 10.0.2.105 61621 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:42:46.260972 0.172766 tcp 10.0.2.105 61622 -> 195.113.214.236 443 SRPA* 0 0 43 35912 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:42:46.547458 3.013366 tcp 10.0.2.105 61623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:42:55.563026 0.000000 tcp 10.0.2.105 61623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:43:01.548039 0.070432 tcp 10.0.2.105 61624 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:43:01.618376 0.054164 tcp 10.0.2.105 61625 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:43:01.672836 0.148634 tcp 10.0.2.105 61626 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:43:01.900486 2.986851 tcp 10.0.2.105 61627 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:43:10.898891 0.000000 tcp 10.0.2.105 61627 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:43:16.884764 3.003265 tcp 10.0.2.105 61628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:43:25.877723 0.000000 tcp 10.0.2.105 61628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:43:30.814674 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:44:06.989581 3.000884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:44:13.996489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:44:21.998058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:44:38.001391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:45:10.007300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:48:31.888152 0.000207 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:48:31.888403 3.003294 tcp 10.0.2.105 61629 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:48:40.892514 0.000000 tcp 10.0.2.105 61629 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:48:46.890505 0.052762 tcp 10.0.2.105 61630 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:48:46.943527 0.054572 tcp 10.0.2.105 61631 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:48:46.998335 0.165545 tcp 10.0.2.105 61632 -> 195.113.214.236 443 SRPA* 0 0 34 25686 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:48:47.207346 3.006424 tcp 10.0.2.105 61633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:48:56.212758 0.000000 tcp 10.0.2.105 61633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:49:02.201315 0.051301 tcp 10.0.2.105 61634 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:49:02.252906 0.065056 tcp 10.0.2.105 61635 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:49:02.318292 0.157534 tcp 10.0.2.105 61636 -> 195.113.214.236 443 SRPA* 0 0 48 41326 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:49:02.486652 2.999128 tcp 10.0.2.105 61637 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:49:11.484720 0.000000 tcp 10.0.2.105 61637 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:49:17.483267 3.004187 tcp 10.0.2.105 61638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:49:26.495802 0.000000 tcp 10.0.2.105 61638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:49:31.312977 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:54:33.019190 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 11:54:40.026998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:54:48.028385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:55:04.031620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:55:36.037089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 11:55:44.399826 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 11:55:44.400017 0.047189 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:55:44.431295 0.112243 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:55:44.503951 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 11:55:47.494210 2.993760 tcp 10.0.2.105 61639 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:55:56.496676 0.000000 tcp 10.0.2.105 61639 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:01.896536 0.054089 tcp 10.0.2.105 61640 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:01.950892 0.032022 tcp 10.0.2.105 61641 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:01.983282 0.154897 tcp 10.0.2.105 61642 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:02.138708 0.106185 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:02.240079 0.187814 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:02.421133 0.210967 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:02.496459 0.053620 tcp 10.0.2.105 61643 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:02.550360 0.033342 tcp 10.0.2.105 61644 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:02.584070 0.151871 tcp 10.0.2.105 61645 -> 195.113.214.236 443 SRPA* 0 0 22 13123 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:02.598642 0.094172 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:02.724395 0.055352 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:02.783299 2.996528 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:02.792735 0.148025 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.037738 0.174193 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 1984 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.205161 0.197657 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.334620 0.257784 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.556562 0.079959 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.639253 0.138395 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:03.878777 0.212085 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.084064 0.239832 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.323058 0.090010 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.396145 0.102187 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.509552 0.257370 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.719195 0.196160 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:04.909016 0.336461 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:05.224031 0.167592 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:05.385572 0.351757 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:05.710408 0.154556 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:05.865870 4.992864 tcp 10.0.2.105 61647 -> 183.82.42.251 8449 SPA_* 0 0 270 244052 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:05.910927 0.172080 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.079944 0.094698 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.213889 0.068295 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.357836 0.064825 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.415243 0.170127 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.563147 0.174870 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.734264 0.265885 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:06.997408 0.059836 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 11:56:10.889974 4.987530 tcp 10.0.2.105 61647 -> 183.82.42.251 8449 A_PA 0 0 327 271610 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:11.778507 0.000000 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:15.893257 3.629002 tcp 10.0.2.105 61647 -> 183.82.42.251 8449 FPA_* 0 0 163 126015 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:17.777704 0.055277 tcp 10.0.2.105 61648 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:17.833261 0.034752 tcp 10.0.2.105 61649 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:17.868225 0.159534 tcp 10.0.2.105 61650 -> 195.113.214.236 443 SRPA* 0 0 49 30146 flow=From-Botnet-V2-TCP-Established 1970/02/03 11:56:18.046436 2.995670 tcp 10.0.2.105 61651 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:27.040507 0.000000 tcp 10.0.2.105 61651 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:33.039506 3.003964 tcp 10.0.2.105 61652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:42.042174 0.000000 tcp 10.0.2.105 61652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 11:56:46.808625 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:01:40.043467 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:01:47.050232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:01:48.042470 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:01:48.042645 3.004410 tcp 10.0.2.105 61653 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:01:55.052808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:01:57.045114 0.000000 tcp 10.0.2.105 61653 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:03.045398 0.057011 tcp 10.0.2.105 61654 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:03.102681 0.053111 tcp 10.0.2.105 61655 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:03.156075 0.150874 tcp 10.0.2.105 61656 -> 195.113.214.236 443 SRPA* 0 0 44 22776 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:03.324199 2.994538 tcp 10.0.2.105 61657 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:11.055584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:02:12.327091 0.000000 tcp 10.0.2.105 61657 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:18.316411 0.052758 tcp 10.0.2.105 61658 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:18.369475 0.054523 tcp 10.0.2.105 61659 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:18.424488 0.159820 tcp 10.0.2.105 61660 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:02:18.601958 2.999135 tcp 10.0.2.105 61661 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:27.599120 0.000000 tcp 10.0.2.105 61661 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:33.597962 3.004032 tcp 10.0.2.105 61662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:42.600755 0.000000 tcp 10.0.2.105 61662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:02:43.061376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:02:47.307560 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:07:48.601226 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:07:48.601329 3.003455 tcp 10.0.2.105 61663 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:07:57.603487 0.000000 tcp 10.0.2.105 61663 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:03.603950 0.054396 tcp 10.0.2.105 61664 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:03.658645 0.035930 tcp 10.0.2.105 61665 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:03.694890 0.154443 tcp 10.0.2.105 61666 -> 195.113.214.236 443 SRPA* 0 0 45 38322 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:04.212820 3.004659 tcp 10.0.2.105 61667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:13.226085 0.000000 tcp 10.0.2.105 61667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:19.205160 0.052440 tcp 10.0.2.105 61668 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:19.257933 0.032500 tcp 10.0.2.105 61669 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:19.290671 0.233150 tcp 10.0.2.105 61670 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:08:20.812929 2.998486 tcp 10.0.2.105 61671 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:29.809814 0.000000 tcp 10.0.2.105 61671 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:35.809362 3.003427 tcp 10.0.2.105 61672 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:43.809647 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:08:44.811222 0.000000 tcp 10.0.2.105 61672 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:08:47.067221 3.001989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:08:54.075158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:09:02.078505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:09:18.079296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:09:50.084863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:13:50.812086 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:13:50.812352 3.003207 tcp 10.0.2.105 61673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:13:59.814223 0.000000 tcp 10.0.2.105 61673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:05.815067 0.053325 tcp 10.0.2.105 61674 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:05.868722 0.054108 tcp 10.0.2.105 61675 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:05.923121 0.149979 tcp 10.0.2.105 61676 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:06.083180 2.984337 tcp 10.0.2.105 61677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:15.076354 0.000000 tcp 10.0.2.105 61677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:21.085500 0.052378 tcp 10.0.2.105 61678 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:21.138224 0.093881 tcp 10.0.2.105 61679 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:21.232553 0.144304 tcp 10.0.2.105 61680 -> 195.113.214.236 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:14:21.401614 2.998304 tcp 10.0.2.105 61681 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:30.398476 0.000000 tcp 10.0.2.105 61681 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:36.396841 3.004366 tcp 10.0.2.105 61682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:45.400127 0.000000 tcp 10.0.2.105 61682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:14:50.307135 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:15:56.094705 3.000999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:16:03.101760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:16:11.103457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:16:27.106007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:16:59.112112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:19:51.400627 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:19:51.400777 3.003429 tcp 10.0.2.105 61683 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:20:00.402805 0.000000 tcp 10.0.2.105 61683 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:20:06.403174 0.055832 tcp 10.0.2.105 61684 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:20:06.458982 0.052963 tcp 10.0.2.105 61685 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:20:06.512250 0.146667 tcp 10.0.2.105 61686 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:20:06.731355 3.005017 tcp 10.0.2.105 61687 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:20:15.735056 0.000000 tcp 10.0.2.105 61687 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:23:03.118558 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 12:23:10.125616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:23:18.127073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:23:34.130074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:24:06.135733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:26:19.037648 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:26:19.037763 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 12:26:37.525428 0.052386 tcp 10.0.2.105 61688 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:26:37.578155 0.052887 tcp 10.0.2.105 61689 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:26:37.631333 0.151933 tcp 10.0.2.105 61690 -> 195.113.214.236 443 SRPA* 0 0 39 34816 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:26:37.784467 0.053442 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:37.821591 0.108827 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:37.895375 0.106663 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:37.997530 0.188824 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.179360 0.252995 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.397837 0.092929 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.472949 0.124181 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.622145 0.188782 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.757334 0.258307 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:38.980775 0.162723 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.138640 0.175692 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.307352 0.213334 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.512554 0.076381 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.574424 0.144914 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.724859 0.245862 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2536 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:39.968916 0.085133 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.038515 0.108275 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.165707 0.258702 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.374257 0.182980 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.528071 0.186264 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.709471 0.249971 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:40.937524 1.040793 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:41.952893 0.155919 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.116894 0.172510 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.285710 0.092948 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.360007 0.171110 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.577768 0.236215 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.810760 0.061652 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.873510 0.063751 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:42.929267 0.309336 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:43.235953 0.058566 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:26:51.734523 2.993943 tcp 10.0.2.105 61691 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:00.737046 0.000000 tcp 10.0.2.105 61691 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:05.313595 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:27:06.736645 0.052974 tcp 10.0.2.105 61692 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:06.789926 0.053730 tcp 10.0.2.105 61693 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:06.844044 0.147722 tcp 10.0.2.105 61694 -> 195.113.214.236 443 SRPA* 0 0 67 44672 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:07.009942 3.000703 tcp 10.0.2.105 61695 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:16.009096 0.000000 tcp 10.0.2.105 61695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:22.008225 0.051741 tcp 10.0.2.105 61696 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:22.060436 0.052647 tcp 10.0.2.105 61697 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:22.113403 0.149245 tcp 10.0.2.105 61698 -> 195.113.214.236 443 SRPA* 0 0 33 19398 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:27:22.372367 3.000219 tcp 10.0.2.105 61699 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:31.371110 0.000000 tcp 10.0.2.105 61699 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:37.369945 3.004303 tcp 10.0.2.105 61700 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:46.372675 0.000000 tcp 10.0.2.105 61700 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:27:51.309759 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:30:10.142452 3.003109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:30:17.149139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:30:25.150542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:30:41.153979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:31:13.160092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:32:52.373327 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:32:52.373435 3.003855 tcp 10.0.2.105 61701 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:01.375600 0.000000 tcp 10.0.2.105 61701 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:07.375661 0.053729 tcp 10.0.2.105 61702 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:07.429657 0.053165 tcp 10.0.2.105 61703 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:07.483167 0.152746 tcp 10.0.2.105 61704 -> 195.113.214.236 443 SRPA* 0 0 46 40990 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:07.647551 3.001560 tcp 10.0.2.105 61705 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:16.647659 0.000000 tcp 10.0.2.105 61705 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:22.646825 0.052769 tcp 10.0.2.105 61706 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:22.699902 0.053916 tcp 10.0.2.105 61707 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:22.754068 0.238075 tcp 10.0.2.105 61708 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:33:23.216275 2.995163 tcp 10.0.2.105 61709 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:32.210229 0.000000 tcp 10.0.2.105 61709 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:38.208688 3.004423 tcp 10.0.2.105 61710 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:47.211599 0.000000 tcp 10.0.2.105 61710 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:33:51.808165 0.000285 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:37:17.166101 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:37:24.173428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:37:32.174958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:37:48.177952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:38:20.183797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:38:53.211912 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:38:53.212017 3.003886 tcp 10.0.2.105 61711 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:02.214298 0.000000 tcp 10.0.2.105 61711 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:08.214326 0.052949 tcp 10.0.2.105 61712 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:08.267581 0.052281 tcp 10.0.2.105 61713 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:08.320193 0.154478 tcp 10.0.2.105 61714 -> 195.113.214.236 443 SRPA* 0 0 41 22790 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:08.501005 2.996808 tcp 10.0.2.105 61715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:17.506638 0.000000 tcp 10.0.2.105 61715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:23.495563 0.051933 tcp 10.0.2.105 61716 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:23.547795 0.053660 tcp 10.0.2.105 61717 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:23.601766 0.148592 tcp 10.0.2.105 61718 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:39:23.774089 2.995964 tcp 10.0.2.105 61719 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:32.768515 0.000000 tcp 10.0.2.105 61719 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:38.767263 3.004198 tcp 10.0.2.105 61720 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:47.769862 0.000000 tcp 10.0.2.105 61720 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:39:52.306624 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:44:24.189651 3.001945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 12:44:31.201581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:44:39.198791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:44:53.771690 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:44:53.771791 3.008154 tcp 10.0.2.105 61721 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:44:55.203147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:45:02.772630 0.000000 tcp 10.0.2.105 61721 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:08.773425 0.053876 tcp 10.0.2.105 61722 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:08.827611 0.051580 tcp 10.0.2.105 61723 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:08.879542 0.154016 tcp 10.0.2.105 61724 -> 195.113.214.236 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:09.045561 2.999970 tcp 10.0.2.105 61725 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:18.044883 0.000000 tcp 10.0.2.105 61725 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:24.043951 0.051689 tcp 10.0.2.105 61726 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:24.095899 0.054124 tcp 10.0.2.105 61727 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:24.150273 0.147432 tcp 10.0.2.105 61728 -> 195.113.214.236 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:45:24.337073 3.001009 tcp 10.0.2.105 61729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:27.208048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:45:33.346829 0.000000 tcp 10.0.2.105 61729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:39.335447 2.994257 tcp 10.0.2.105 61730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:48.328655 0.000000 tcp 10.0.2.105 61730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:45:53.305393 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:54:42.221008 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 12:54:49.233629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:54:57.227529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:55:13.230371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:55:45.236872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 12:57:04.721118 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 12:57:04.721269 0.108143 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:04.824366 0.189531 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.006488 0.048368 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.271889 0.107373 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.421596 0.208290 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.595396 0.093902 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.671499 0.055927 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.775253 0.178146 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:05.897133 0.258717 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:06.123551 0.140585 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:06.259733 0.175615 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:06.427945 0.214362 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:06.633897 0.076669 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:06.693592 0.159298 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:07.272882 0.242478 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:07.513901 0.087381 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:07.766299 0.104482 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:08.189767 0.190270 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:08.373829 0.250991 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:08.603305 1.084572 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 4 1262 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:09.381841 2.999832 tcp 10.0.2.105 61731 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:09.665131 0.168251 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:09.817236 0.209672 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:10.023921 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 12:57:18.380983 0.000000 tcp 10.0.2.105 61731 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:24.380903 0.053409 tcp 10.0.2.105 61732 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:24.434571 0.052938 tcp 10.0.2.105 61733 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:24.487755 0.158058 tcp 10.0.2.105 61734 -> 195.113.214.236 443 SRPA* 0 0 39 31252 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:24.711284 3.002358 tcp 10.0.2.105 61735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:25.511249 0.062515 tcp 10.0.2.105 61736 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:25.574076 0.057321 tcp 10.0.2.105 61737 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:25.631674 0.144827 tcp 10.0.2.105 61738 -> 195.113.214.236 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:25.776999 0.165657 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:25.945261 0.090224 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.017634 0.169232 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.163993 0.174610 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.336014 0.061006 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.394818 0.066091 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.453054 0.296039 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:26.746236 0.059640 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/03 12:57:33.712486 0.000000 tcp 10.0.2.105 61735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:39.712076 0.052818 tcp 10.0.2.105 61739 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:39.765289 0.052229 tcp 10.0.2.105 61740 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:39.817859 0.153407 tcp 10.0.2.105 61741 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/03 12:57:40.065492 3.000072 tcp 10.0.2.105 61742 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:49.064514 0.000000 tcp 10.0.2.105 61742 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:57:55.063568 2.993669 tcp 10.0.2.105 61743 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:58:04.066122 0.000000 tcp 10.0.2.105 61743 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 12:58:08.813087 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:01:49.242252 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:01:56.250180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:02:04.251982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:02:20.254672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:02:52.260693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:03:10.066648 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:03:10.066796 2.993616 tcp 10.0.2.105 61744 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:19.059119 0.000000 tcp 10.0.2.105 61744 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:25.069828 0.055653 tcp 10.0.2.105 61745 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:25.125742 0.054847 tcp 10.0.2.105 61746 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:25.180837 0.152306 tcp 10.0.2.105 61747 -> 195.113.214.236 443 SRPA* 0 0 43 35314 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:25.345051 2.997180 tcp 10.0.2.105 61748 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:34.340916 0.000000 tcp 10.0.2.105 61748 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:40.340431 0.052882 tcp 10.0.2.105 61749 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:40.393619 0.053711 tcp 10.0.2.105 61750 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:40.447568 0.155006 tcp 10.0.2.105 61751 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:03:40.619352 3.004798 tcp 10.0.2.105 61752 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:49.623165 0.000000 tcp 10.0.2.105 61752 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:03:55.612065 3.004213 tcp 10.0.2.105 61753 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:04:04.614463 0.000000 tcp 10.0.2.105 61753 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:04:09.311259 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:09:00.272029 3.002017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:09:07.279792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:09:10.614928 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:09:10.615076 2.994171 tcp 10.0.2.105 61754 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:15.281424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:09:19.607310 0.000000 tcp 10.0.2.105 61754 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:25.618156 0.052665 tcp 10.0.2.105 61755 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:25.671126 0.053133 tcp 10.0.2.105 61756 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:25.724558 0.154839 tcp 10.0.2.105 61757 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:25.889294 3.001165 tcp 10.0.2.105 61758 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:31.284088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:09:34.889300 0.000000 tcp 10.0.2.105 61758 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:40.888727 0.052471 tcp 10.0.2.105 61759 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:40.941480 0.053755 tcp 10.0.2.105 61760 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:40.995516 0.151475 tcp 10.0.2.105 61761 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:09:41.158636 3.004359 tcp 10.0.2.105 61762 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:50.161385 0.000000 tcp 10.0.2.105 61762 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:09:56.160201 3.003944 tcp 10.0.2.105 61763 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:10:03.290986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:10:05.163262 0.000000 tcp 10.0.2.105 61763 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:10:09.809802 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:15:11.163315 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:15:11.163419 3.003968 tcp 10.0.2.105 61764 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:20.175889 0.000000 tcp 10.0.2.105 61764 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:26.166344 0.052459 tcp 10.0.2.105 61765 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:26.219060 0.053106 tcp 10.0.2.105 61766 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:26.272619 0.148056 tcp 10.0.2.105 61767 -> 195.113.214.236 443 SRPA* 0 0 40 34544 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:26.438936 3.000295 tcp 10.0.2.105 61768 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:35.437847 0.000000 tcp 10.0.2.105 61768 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:41.437339 0.052665 tcp 10.0.2.105 61769 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:41.490326 0.053333 tcp 10.0.2.105 61770 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:41.543958 0.149702 tcp 10.0.2.105 61771 -> 195.113.214.236 443 SRPA* 0 0 50 32850 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:15:41.704980 2.996118 tcp 10.0.2.105 61772 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:50.699897 0.000000 tcp 10.0.2.105 61772 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:15:56.698707 3.003913 tcp 10.0.2.105 61773 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:16:05.701576 0.000000 tcp 10.0.2.105 61773 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:16:10.307901 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:16:15.298022 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:16:22.305259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:16:30.306754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:16:46.309767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:17:18.315973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:21:11.701892 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:21:11.702056 3.003790 tcp 10.0.2.105 61774 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:21:20.704539 0.000000 tcp 10.0.2.105 61774 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:21:26.705077 0.052248 tcp 10.0.2.105 61775 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:21:26.757597 0.058007 tcp 10.0.2.105 61776 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:21:26.815844 0.150665 tcp 10.0.2.105 61777 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:21:27.044332 3.003260 tcp 10.0.2.105 61778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:21:36.056485 0.000000 tcp 10.0.2.105 61778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:23:22.323942 3.000734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 13:23:29.332722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:23:37.334036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:23:53.337387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:24:25.339984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:27:28.983972 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:27:28.984144 1.395094 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 851 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:30.373210 0.046538 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:30.405363 0.110492 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:30.476327 0.106999 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:30.578148 0.189757 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2673 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:30.759499 0.371511 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.153617 0.167858 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.267565 0.213264 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.447267 0.094888 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.521257 0.173095 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.687561 0.215752 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.895546 0.079235 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:31.958977 0.299237 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:32.222255 0.142965 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:32.405376 0.145388 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2608 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:32.573683 0.086767 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:32.642358 0.245128 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:32.886106 0.122986 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:33.123694 0.191784 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:33.309590 0.255856 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:33.544162 0.174399 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:33.694867 0.318228 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:33.963184 0.172993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.133048 0.158408 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.315293 0.092000 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.390341 0.061280 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.457804 0.062377 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.512837 0.312692 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.822459 0.171141 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:34.966675 0.216231 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:35.179950 0.056831 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:27:42.053024 3.004017 tcp 10.0.2.105 61779 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:27:51.055695 0.000000 tcp 10.0.2.105 61779 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:27:55.812490 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:27:57.055926 0.053713 tcp 10.0.2.105 61780 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:27:57.109912 0.053833 tcp 10.0.2.105 61781 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:27:57.163987 0.145563 tcp 10.0.2.105 61782 -> 195.113.214.236 443 SRPA* 0 0 41 33796 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:27:57.331349 2.997502 tcp 10.0.2.105 61783 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:06.327416 0.000000 tcp 10.0.2.105 61783 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:12.326675 0.051659 tcp 10.0.2.105 61784 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:28:12.378684 0.052322 tcp 10.0.2.105 61785 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:28:12.431285 0.149255 tcp 10.0.2.105 61786 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:28:12.619278 3.001547 tcp 10.0.2.105 61787 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:21.619586 0.000000 tcp 10.0.2.105 61787 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:27.618222 3.004321 tcp 10.0.2.105 61788 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:36.620933 0.000000 tcp 10.0.2.105 61788 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:28:41.307607 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:30:29.346249 3.001035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:30:36.353314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:30:44.354840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:31:00.357834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:31:32.363736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:33:42.621458 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:33:42.621631 3.003615 tcp 10.0.2.105 61789 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:33:51.623567 0.000000 tcp 10.0.2.105 61789 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:33:57.624504 0.052943 tcp 10.0.2.105 61790 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:33:57.677770 0.055571 tcp 10.0.2.105 61791 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:33:57.733598 0.155211 tcp 10.0.2.105 61792 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:33:57.906534 3.000591 tcp 10.0.2.105 61793 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:06.915230 0.000000 tcp 10.0.2.105 61793 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:12.905267 0.077676 tcp 10.0.2.105 61794 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:34:12.982838 0.052746 tcp 10.0.2.105 61795 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:34:13.035414 0.149480 tcp 10.0.2.105 61796 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:34:13.200678 2.998304 tcp 10.0.2.105 61797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:22.197167 0.000000 tcp 10.0.2.105 61797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:28.196996 2.993710 tcp 10.0.2.105 61798 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:37.189614 0.000000 tcp 10.0.2.105 61798 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:34:41.805851 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:37:36.369710 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:37:43.377431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:37:51.379020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:38:07.382274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:38:39.387575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:39:43.200266 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:39:43.200377 3.003279 tcp 10.0.2.105 61799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:39:52.202261 0.000000 tcp 10.0.2.105 61799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:39:58.202731 0.051819 tcp 10.0.2.105 61800 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:39:58.254833 0.053904 tcp 10.0.2.105 61801 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:39:58.309063 0.146003 tcp 10.0.2.105 61802 -> 195.113.214.236 443 SRPA* 0 0 46 41914 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:39:58.474528 3.001035 tcp 10.0.2.105 61803 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:07.474071 0.000000 tcp 10.0.2.105 61803 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:13.473567 0.051499 tcp 10.0.2.105 61804 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:40:13.525343 0.051988 tcp 10.0.2.105 61805 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:40:13.577628 0.147920 tcp 10.0.2.105 61806 -> 195.113.214.236 443 SRPA* 0 0 40 22580 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:40:13.735804 2.991842 tcp 10.0.2.105 61807 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:22.736124 0.000000 tcp 10.0.2.105 61807 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:28.734799 2.994489 tcp 10.0.2.105 61808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:37.727709 0.000000 tcp 10.0.2.105 61808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:40:42.304383 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:44:43.394195 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:44:50.408826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:44:58.405642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:45:14.406868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:45:43.738052 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:45:43.738202 3.003763 tcp 10.0.2.105 61809 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:45:46.411587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:45:52.740618 0.000000 tcp 10.0.2.105 61809 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:45:58.741016 0.052461 tcp 10.0.2.105 61810 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:45:58.793739 0.052014 tcp 10.0.2.105 61811 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:45:58.846098 0.146181 tcp 10.0.2.105 61812 -> 195.113.214.236 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:45:59.047304 3.006577 tcp 10.0.2.105 61813 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:08.052961 0.000000 tcp 10.0.2.105 61813 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:14.041935 0.053743 tcp 10.0.2.105 61814 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:46:14.095451 0.055118 tcp 10.0.2.105 61815 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:46:14.150926 0.146957 tcp 10.0.2.105 61816 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:46:14.323995 3.002099 tcp 10.0.2.105 61817 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:23.324679 0.000000 tcp 10.0.2.105 61817 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:29.323718 2.994030 tcp 10.0.2.105 61818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:38.326386 0.000000 tcp 10.0.2.105 61818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:46:43.313326 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:51:50.417678 3.001867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:51:57.425210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:52:05.426910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:52:21.429958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:52:53.435651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:57:41.108835 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:57:41.108988 1.196789 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:57:42.279850 0.045306 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:57:42.370162 0.109625 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:57:42.439127 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 13:57:44.364442 2.993710 tcp 10.0.2.105 61819 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:57:53.366522 0.000000 tcp 10.0.2.105 61819 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:57:59.367051 0.053363 tcp 10.0.2.105 61820 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:57:59.420721 0.053093 tcp 10.0.2.105 61821 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:57:59.474133 0.151071 tcp 10.0.2.105 61822 -> 195.113.214.236 443 SRPA* 0 0 21 13070 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:57:59.817337 3.002864 tcp 10.0.2.105 61823 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:00.557358 0.052578 tcp 10.0.2.105 61824 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:00.610217 0.052197 tcp 10.0.2.105 61825 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:00.662707 0.147804 tcp 10.0.2.105 61826 -> 195.113.214.236 443 SRPA* 0 0 28 15578 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:00.811006 0.187637 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:00.991358 0.099602 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:01.278166 0.168315 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:01.396105 0.173245 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:01.562968 0.219554 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:01.775449 0.079750 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:01.835844 0.266407 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.065066 0.211754 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.243853 0.098256 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.401717 0.144320 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.652509 0.138583 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.866746 0.088997 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:02.939241 0.241818 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:03.179525 0.097343 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:03.277192 0.201917 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:03.473916 0.257979 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:03.682606 0.172025 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:03.851480 0.159759 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.136851 0.273062 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.388482 0.172991 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.537929 0.093868 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.615695 0.060857 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.736524 0.063292 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:04.792707 0.218523 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:05.008199 0.169215 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:05.154654 0.174533 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:05.326455 0.058310 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 13:58:08.819017 0.000000 tcp 10.0.2.105 61823 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:14.818187 0.052784 tcp 10.0.2.105 61827 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:14.871242 0.054342 tcp 10.0.2.105 61828 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:14.925839 0.143836 tcp 10.0.2.105 61829 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 13:58:15.101739 3.000667 tcp 10.0.2.105 61830 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:24.100747 0.000000 tcp 10.0.2.105 61830 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:30.099842 3.004102 tcp 10.0.2.105 61831 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:39.102688 0.000000 tcp 10.0.2.105 61831 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 13:58:43.808885 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 13:58:57.442135 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 13:59:04.449058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:59:12.450403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 13:59:28.453383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:00:00.459646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:03:45.103210 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:03:45.103387 3.003475 tcp 10.0.2.105 61832 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:03:54.104943 0.000000 tcp 10.0.2.105 61832 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:00.105309 0.053576 tcp 10.0.2.105 61833 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:00.159203 0.053380 tcp 10.0.2.105 61834 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:00.212837 0.157290 tcp 10.0.2.105 61835 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:00.381144 2.997658 tcp 10.0.2.105 61836 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:09.379334 0.000000 tcp 10.0.2.105 61836 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:15.377366 0.052075 tcp 10.0.2.105 61837 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:15.429696 0.053978 tcp 10.0.2.105 61838 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:15.483932 0.149409 tcp 10.0.2.105 61839 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:04:15.644680 2.996303 tcp 10.0.2.105 61840 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:24.639281 0.000000 tcp 10.0.2.105 61840 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:30.638220 3.004457 tcp 10.0.2.105 61841 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:39.640853 0.000000 tcp 10.0.2.105 61841 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:04:44.307679 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:06:28.470739 3.001026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:06:35.477358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:06:43.478887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:06:59.481862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:07:31.488036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:09:45.641435 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:09:45.641520 3.003501 tcp 10.0.2.105 61842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:09:54.643663 0.000000 tcp 10.0.2.105 61842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:00.644537 0.052982 tcp 10.0.2.105 61843 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:00.697883 0.052801 tcp 10.0.2.105 61844 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:00.751028 0.149694 tcp 10.0.2.105 61845 -> 195.113.214.236 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:01.198086 3.009495 tcp 10.0.2.105 61846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:10.216385 0.000000 tcp 10.0.2.105 61846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:16.195166 0.052879 tcp 10.0.2.105 61847 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:16.248394 0.054109 tcp 10.0.2.105 61848 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:16.302785 0.148947 tcp 10.0.2.105 61849 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:10:17.059541 3.001419 tcp 10.0.2.105 61850 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:26.058338 0.000000 tcp 10.0.2.105 61850 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:32.057702 3.004201 tcp 10.0.2.105 61851 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:41.060724 0.000000 tcp 10.0.2.105 61851 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:10:45.807275 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:13:37.496975 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:13:44.504850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:13:52.505775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:14:08.508870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:14:40.514984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:15:47.061438 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:15:47.061545 3.003463 tcp 10.0.2.105 61852 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:15:56.063355 0.000000 tcp 10.0.2.105 61852 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:02.064211 0.053811 tcp 10.0.2.105 61853 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:02.118304 0.053390 tcp 10.0.2.105 61854 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:02.172000 0.145215 tcp 10.0.2.105 61855 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:02.326306 3.000496 tcp 10.0.2.105 61856 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:11.325270 0.000000 tcp 10.0.2.105 61856 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:17.324337 0.053575 tcp 10.0.2.105 61857 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:17.378290 0.052166 tcp 10.0.2.105 61858 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:17.430730 0.150404 tcp 10.0.2.105 61859 -> 195.113.214.236 443 SRPA* 0 0 35 19218 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:16:17.592651 2.996119 tcp 10.0.2.105 61860 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:26.597488 0.000000 tcp 10.0.2.105 61860 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:32.586166 2.994533 tcp 10.0.2.105 61861 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:41.578950 0.000000 tcp 10.0.2.105 61861 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:16:46.305773 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:20:50.530643 3.000527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:20:57.537056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:21:05.539015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:21:21.541606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:21:47.589401 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:21:47.589490 3.003804 tcp 10.0.2.105 61862 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:21:53.547576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:21:56.591788 0.000000 tcp 10.0.2.105 61862 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:22:02.591998 0.053661 tcp 10.0.2.105 61863 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:22:02.646000 0.053837 tcp 10.0.2.105 61864 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:22:02.700136 0.153161 tcp 10.0.2.105 61865 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:22:03.067510 3.007959 tcp 10.0.2.105 61866 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:22:12.073929 0.000000 tcp 10.0.2.105 61866 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:28:00.558141 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 14:28:07.565449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:28:07.785850 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:28:07.785962 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 14:28:15.566943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:28:22.938938 0.053748 tcp 10.0.2.105 61867 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:22.992967 0.052999 tcp 10.0.2.105 61868 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:23.046210 0.147707 tcp 10.0.2.105 61869 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:23.194390 0.046245 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:23.225749 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 14:28:31.569695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:28:33.072356 3.004131 tcp 10.0.2.105 61870 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:28:40.322846 0.052737 tcp 10.0.2.105 61871 -> 195.113.214.211 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:40.375490 0.053623 tcp 10.0.2.105 61872 -> 195.113.214.236 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:40.429438 0.401656 tcp 10.0.2.105 61873 -> 195.113.214.236 443 SRPA* 0 0 73 77631 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:40.832046 0.106920 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:40.899929 0.189120 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.081563 0.061075 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.152487 0.168420 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.269258 0.208998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.470718 0.262744 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.695207 0.207372 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.871729 0.089938 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:41.943844 0.218238 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.074955 0.000000 tcp 10.0.2.105 61870 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:28:42.151676 0.080901 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.218326 0.143327 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.399298 0.138386 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.593721 0.086815 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.663289 0.243820 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:42.905668 0.261985 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:43.119229 0.172654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:43.289041 0.105329 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2708 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:43.412796 0.193744 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:43.601874 0.160731 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:43.773033 0.251149 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.004090 0.171997 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.153745 0.091250 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.228035 0.308059 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.532157 0.168828 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.808847 0.176625 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:44.982642 0.073326 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:45.191813 0.065052 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:45.248465 0.059563 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:28:48.073912 0.052395 tcp 10.0.2.105 61874 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:48.126526 0.051952 tcp 10.0.2.105 61875 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:48.178792 0.150396 tcp 10.0.2.105 61876 -> 195.113.214.236 443 SRPA* 0 0 48 33842 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:28:48.398419 2.989642 tcp 10.0.2.105 61877 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:28:57.396668 0.000000 tcp 10.0.2.105 61877 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:29:03.575744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:34:03.397383 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:34:03.397556 3.003776 tcp 10.0.2.105 61878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:12.399717 0.000000 tcp 10.0.2.105 61878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:18.400443 0.052468 tcp 10.0.2.105 61879 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:18.453188 0.053506 tcp 10.0.2.105 61880 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:18.507048 0.147069 tcp 10.0.2.105 61881 -> 195.113.214.236 443 SRPA* 0 0 19 10006 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:18.682383 3.000798 tcp 10.0.2.105 61882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:27.683106 0.000000 tcp 10.0.2.105 61882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:33.680992 0.051364 tcp 10.0.2.105 61883 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:33.732626 0.053374 tcp 10.0.2.105 61884 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:33.786232 0.145106 tcp 10.0.2.105 61885 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:34:34.142800 3.002326 tcp 10.0.2.105 61886 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:43.143804 0.000000 tcp 10.0.2.105 61886 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:49.142549 3.004062 tcp 10.0.2.105 61887 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:34:58.145529 0.000000 tcp 10.0.2.105 61887 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:35:02.812506 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:35:07.581951 3.001474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:35:14.589349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:35:22.590499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:35:38.593671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:36:10.599729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:40:04.146381 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:40:04.146570 2.993046 tcp 10.0.2.105 61888 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:13.138475 0.000000 tcp 10.0.2.105 61888 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:19.148864 0.052915 tcp 10.0.2.105 61889 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:19.202038 0.053328 tcp 10.0.2.105 61890 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:19.255279 0.149639 tcp 10.0.2.105 61891 -> 195.113.214.236 443 SRPA* 0 0 42 34652 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:19.416334 2.995538 tcp 10.0.2.105 61892 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:28.410541 0.000000 tcp 10.0.2.105 61892 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:34.409593 0.051368 tcp 10.0.2.105 61893 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:34.461351 0.051758 tcp 10.0.2.105 61894 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:34.513389 0.142134 tcp 10.0.2.105 61895 -> 195.113.214.236 443 SRPA* 0 0 45 41568 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:40:34.669078 3.004503 tcp 10.0.2.105 61896 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:43.672445 0.000000 tcp 10.0.2.105 61896 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:49.661130 3.004128 tcp 10.0.2.105 61897 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:40:58.663779 0.000000 tcp 10.0.2.105 61897 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:41:03.310671 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:42:14.606522 3.000937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:42:21.613058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:42:29.614541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:42:45.617568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:43:17.623479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:46:04.664362 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:46:04.664521 2.993467 tcp 10.0.2.105 61898 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:13.666975 0.000000 tcp 10.0.2.105 61898 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:19.667763 0.054401 tcp 10.0.2.105 61899 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:19.722462 0.053006 tcp 10.0.2.105 61900 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:19.775719 0.150208 tcp 10.0.2.105 61901 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:19.960613 2.999419 tcp 10.0.2.105 61902 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:28.958110 0.000000 tcp 10.0.2.105 61902 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:34.958036 0.052342 tcp 10.0.2.105 61903 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:35.010676 0.053260 tcp 10.0.2.105 61904 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:35.064298 0.149586 tcp 10.0.2.105 61905 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:46:35.253559 2.998594 tcp 10.0.2.105 61906 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:44.250912 0.000000 tcp 10.0.2.105 61906 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:50.249778 3.003888 tcp 10.0.2.105 61907 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:46:59.252251 0.000000 tcp 10.0.2.105 61907 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:47:03.809813 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:52:05.253295 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:52:05.253489 3.003291 tcp 10.0.2.105 61908 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:52:14.255171 0.000000 tcp 10.0.2.105 61908 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:52:20.255621 0.053792 tcp 10.0.2.105 61909 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:52:20.309713 0.053057 tcp 10.0.2.105 61910 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:52:20.363103 0.148768 tcp 10.0.2.105 61911 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:52:20.594657 2.984114 tcp 10.0.2.105 61912 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:52:29.587360 0.000000 tcp 10.0.2.105 61912 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:53:34.634475 3.001031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 14:53:41.641587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:53:49.643657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:54:05.645471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:54:37.651510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 14:58:56.323741 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 14:58:56.323850 1.192220 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:57.516504 0.046171 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:57.546940 0.081873 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:57.671439 0.182150 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:57.793867 0.108843 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:57.889720 0.189657 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.071596 0.174764 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.238415 0.250066 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.455594 0.217188 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.636894 0.094232 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.721002 0.214391 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:58.925688 0.083069 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.020571 0.143951 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.202227 0.145242 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.396374 0.084856 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.465863 0.243846 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.708094 0.257721 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:58:59.918240 0.204520 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.114978 0.157835 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.274074 0.318065 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.570872 0.166809 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.717041 0.092312 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.790283 0.111681 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:00.922209 0.206701 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:01.113074 0.331395 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:01.441467 0.169548 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:01.596693 0.177347 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:01.771087 0.062468 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:01.957748 0.066515 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:02.016391 0.059636 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/03 14:59:05.607050 3.003932 tcp 10.0.2.105 61913 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:14.609661 0.000000 tcp 10.0.2.105 61913 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:20.610295 0.052646 tcp 10.0.2.105 61914 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:20.663214 0.053231 tcp 10.0.2.105 61915 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:20.716735 0.146546 tcp 10.0.2.105 61916 -> 195.113.214.236 443 SRPA* 0 0 40 34544 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:20.908756 3.004334 tcp 10.0.2.105 61917 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:29.912048 0.000000 tcp 10.0.2.105 61917 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:35.911043 0.052685 tcp 10.0.2.105 61918 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:35.964021 0.053268 tcp 10.0.2.105 61919 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:36.017611 0.143128 tcp 10.0.2.105 61920 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 14:59:36.193424 3.001890 tcp 10.0.2.105 61921 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:45.193446 0.000000 tcp 10.0.2.105 61921 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 14:59:51.192894 3.003776 tcp 10.0.2.105 61922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:00:00.195297 0.000000 tcp 10.0.2.105 61922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:00:04.811832 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:00:41.658338 3.000959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:00:48.665004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:00:56.666250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:01:12.671078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:01:44.675407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:05:06.195775 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:05:06.195930 2.993663 tcp 10.0.2.105 61923 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:15.188011 0.000000 tcp 10.0.2.105 61923 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:21.198433 0.053754 tcp 10.0.2.105 61924 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:21.252499 0.054295 tcp 10.0.2.105 61925 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:21.307223 0.149304 tcp 10.0.2.105 61926 -> 195.113.214.236 443 SRPA* 0 0 36 28558 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:21.466950 2.994573 tcp 10.0.2.105 61927 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:30.459975 0.000000 tcp 10.0.2.105 61927 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:36.469314 0.051301 tcp 10.0.2.105 61928 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:36.520852 0.052722 tcp 10.0.2.105 61929 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:36.573952 0.147968 tcp 10.0.2.105 61930 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:05:37.176690 2.997281 tcp 10.0.2.105 61931 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:46.172614 0.000000 tcp 10.0.2.105 61931 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:05:52.171391 3.004118 tcp 10.0.2.105 61932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:06:01.173947 0.000000 tcp 10.0.2.105 61932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:06:05.810585 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:07:48.681327 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:07:55.688787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:08:03.690680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:08:19.693305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:08:51.699419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:11:07.174584 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:11:07.174764 2.993675 tcp 10.0.2.105 61933 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:16.176895 0.000000 tcp 10.0.2.105 61933 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:22.177685 0.053698 tcp 10.0.2.105 61934 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:22.231678 0.054146 tcp 10.0.2.105 61935 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:22.286157 0.145829 tcp 10.0.2.105 61936 -> 195.113.214.236 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:22.451417 2.999135 tcp 10.0.2.105 61937 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:31.448790 0.000000 tcp 10.0.2.105 61937 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:37.448351 0.053081 tcp 10.0.2.105 61938 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:37.501721 0.053693 tcp 10.0.2.105 61939 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:37.555734 0.148468 tcp 10.0.2.105 61940 -> 195.113.214.236 443 SRPA* 0 0 35 19218 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:11:37.740899 3.001446 tcp 10.0.2.105 61941 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:46.741086 0.000000 tcp 10.0.2.105 61941 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:11:52.739847 3.003964 tcp 10.0.2.105 61942 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:12:01.742795 0.000000 tcp 10.0.2.105 61942 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:12:06.309171 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:14:55.705591 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:15:02.712871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:15:10.714069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:15:26.717343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:15:58.723275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:17:07.743119 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:17:07.743222 3.003544 tcp 10.0.2.105 61943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:16.745681 0.000000 tcp 10.0.2.105 61943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:22.746138 0.054244 tcp 10.0.2.105 61944 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:22.800687 0.054165 tcp 10.0.2.105 61945 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:22.855208 0.147785 tcp 10.0.2.105 61946 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:23.022801 2.995675 tcp 10.0.2.105 61947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:32.017474 0.000000 tcp 10.0.2.105 61947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:38.016873 0.069816 tcp 10.0.2.105 61948 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:38.087001 0.054458 tcp 10.0.2.105 61949 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:38.141826 0.146287 tcp 10.0.2.105 61950 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:17:38.313884 2.996816 tcp 10.0.2.105 61951 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:47.309378 0.000000 tcp 10.0.2.105 61951 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:17:53.308153 3.004453 tcp 10.0.2.105 61952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:18:02.311114 0.000000 tcp 10.0.2.105 61952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:18:07.308170 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:22:07.736340 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:22:14.743945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:22:22.745610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:22:38.748613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:23:10.758753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:29:14.762714 2.999842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 15:29:19.464635 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:29:19.464736 0.053006 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:19.572723 0.175145 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:19.695306 0.104733 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:19.763618 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 15:29:21.767936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:29:23.351196 3.003457 tcp 10.0.2.105 61953 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:29:29.769411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:29:32.352939 0.000000 tcp 10.0.2.105 61953 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:29:36.721312 0.053531 tcp 10.0.2.105 61954 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:36.775173 0.054225 tcp 10.0.2.105 61955 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:36.829796 0.143456 tcp 10.0.2.105 61956 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:36.973925 0.175046 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:37.141726 0.253634 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:37.359714 1.034251 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:38.352896 0.052670 tcp 10.0.2.105 61957 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:38.366239 0.046251 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:38.405937 0.054304 tcp 10.0.2.105 61958 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:38.440658 0.212477 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:38.460484 0.150655 tcp 10.0.2.105 61959 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:38.614334 0.095542 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:38.655449 3.001645 tcp 10.0.2.105 61960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:29:38.689973 0.239378 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:38.899725 0.084260 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.057817 0.150180 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.296636 0.131544 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.441181 0.088499 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.513447 0.244479 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.755976 0.257650 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:39.967497 0.173458 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.138261 0.159952 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.365071 0.245745 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.590340 0.170569 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.738609 0.089389 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.848513 0.106590 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:40.982299 0.194064 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2018 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.171994 0.198783 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.368434 0.060119 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.473138 0.062738 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.528148 0.057790 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.629185 0.169490 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:41.879317 0.178139 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:29:45.773051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:29:47.655366 0.000000 tcp 10.0.2.105 61960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:29:53.674526 0.051589 tcp 10.0.2.105 61961 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:53.726377 0.053220 tcp 10.0.2.105 61962 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:53.779878 0.142808 tcp 10.0.2.105 61963 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:29:53.990458 2.978042 tcp 10.0.2.105 61964 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:30:02.976799 0.000000 tcp 10.0.2.105 61964 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:30:08.965825 2.993723 tcp 10.0.2.105 61965 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:30:17.778704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:30:17.958803 0.000000 tcp 10.0.2.105 61965 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:30:22.805502 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:35:23.969132 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:35:23.969320 3.003352 tcp 10.0.2.105 61966 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:35:32.971404 0.000000 tcp 10.0.2.105 61966 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:35:38.971868 0.053050 tcp 10.0.2.105 61967 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:39.025191 0.052950 tcp 10.0.2.105 61968 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:39.078490 0.150263 tcp 10.0.2.105 61969 -> 195.113.214.236 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:39.336247 2.998816 tcp 10.0.2.105 61970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:35:48.333676 0.000000 tcp 10.0.2.105 61970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:35:54.333213 0.052363 tcp 10.0.2.105 61971 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:54.385889 0.052756 tcp 10.0.2.105 61972 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:54.438914 0.141938 tcp 10.0.2.105 61973 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:35:54.733103 3.004180 tcp 10.0.2.105 61974 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:36:03.745959 0.000000 tcp 10.0.2.105 61974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:36:09.734860 2.993589 tcp 10.0.2.105 61975 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:36:18.728832 0.000000 tcp 10.0.2.105 61975 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:36:21.783843 3.002292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:36:23.304178 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:36:28.791631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:36:36.793278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:36:52.796338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:37:24.802846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:41:24.737992 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:41:24.738095 3.005501 tcp 10.0.2.105 61976 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:41:33.740070 0.000000 tcp 10.0.2.105 61976 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:41:39.740744 0.053284 tcp 10.0.2.105 61977 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:39.794282 0.052514 tcp 10.0.2.105 61978 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:39.847076 0.150431 tcp 10.0.2.105 61979 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:40.089034 3.005009 tcp 10.0.2.105 61980 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:41:49.092644 0.000000 tcp 10.0.2.105 61980 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:41:55.081361 0.052091 tcp 10.0.2.105 61981 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:55.133776 0.052263 tcp 10.0.2.105 61982 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:55.186402 0.143371 tcp 10.0.2.105 61983 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:41:55.422643 3.003045 tcp 10.0.2.105 61984 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:42:04.424099 0.000000 tcp 10.0.2.105 61984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:42:10.423168 3.003986 tcp 10.0.2.105 61985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:42:19.435926 0.000000 tcp 10.0.2.105 61985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:42:24.313069 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:43:28.808838 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:43:35.815766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:43:43.817406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:43:59.820126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:44:31.826552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:47:25.426370 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:47:25.426518 2.993855 tcp 10.0.2.105 61986 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:47:34.419063 0.000000 tcp 10.0.2.105 61986 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:47:40.429256 0.051983 tcp 10.0.2.105 61987 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:40.481495 0.051513 tcp 10.0.2.105 61988 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:40.533313 0.151526 tcp 10.0.2.105 61989 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:40.707669 3.004884 tcp 10.0.2.105 61990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:47:49.710916 0.000000 tcp 10.0.2.105 61990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:47:55.700244 0.051636 tcp 10.0.2.105 61991 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:55.751893 0.054812 tcp 10.0.2.105 61992 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:55.806505 0.149586 tcp 10.0.2.105 61993 -> 195.113.214.236 443 SRPA* 0 0 37 22468 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:47:55.965081 2.999090 tcp 10.0.2.105 61994 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:48:04.962983 0.000000 tcp 10.0.2.105 61994 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:48:10.961683 3.003986 tcp 10.0.2.105 61995 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:48:19.964204 0.000000 tcp 10.0.2.105 61995 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:48:24.811175 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:53:25.964618 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:53:25.964725 2.993255 tcp 10.0.2.105 61996 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:53:34.967391 0.000000 tcp 10.0.2.105 61996 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:53:40.968011 0.051155 tcp 10.0.2.105 61997 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:53:41.019467 0.053303 tcp 10.0.2.105 61998 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:53:41.073038 0.148790 tcp 10.0.2.105 61999 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 15:53:41.249088 3.001012 tcp 10.0.2.105 62000 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:53:50.249244 0.000000 tcp 10.0.2.105 62000 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 15:54:11.833716 3.000809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 15:54:18.840043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:54:26.845559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:54:42.848733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:55:14.852859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 15:59:44.258977 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 15:59:44.259128 0.188891 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:44.440654 0.171844 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:44.559909 0.054214 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:44.638374 0.109436 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:44.712355 0.175092 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:44.880055 0.249940 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.094893 0.380918 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.448413 0.047637 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.479912 0.212474 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.657205 0.091673 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.729411 0.220766 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:45.942971 0.078399 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.004571 0.155305 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.161069 0.138549 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.301268 0.083971 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.368439 0.245403 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.613876 0.261953 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.825240 0.173103 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:46.994862 0.156057 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.152544 0.093706 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.229533 0.107453 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.352457 0.201623 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.549276 0.283016 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.811851 0.171940 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:47.961486 0.326550 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 15:59:48.285393 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 15:59:56.256177 2.993609 tcp 10.0.2.105 62001 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:03.858538 0.052237 tcp 10.0.2.105 62002 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:03.911034 0.053144 tcp 10.0.2.105 62003 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:03.964602 0.144605 tcp 10.0.2.105 62004 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:04.109757 0.070632 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:00:04.170955 0.057192 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:00:04.238452 0.170310 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:00:04.385025 0.176416 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:00:05.248849 0.000000 tcp 10.0.2.105 62001 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:11.257573 0.052121 tcp 10.0.2.105 62005 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:11.309944 0.053449 tcp 10.0.2.105 62006 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:11.363651 0.145463 tcp 10.0.2.105 62007 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:11.519208 3.002830 tcp 10.0.2.105 62008 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:20.520627 0.000000 tcp 10.0.2.105 62008 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:26.519600 0.051546 tcp 10.0.2.105 62009 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:26.571395 0.053119 tcp 10.0.2.105 62010 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:26.624810 0.144473 tcp 10.0.2.105 62011 -> 195.113.214.236 443 SRPA* 0 0 33 17506 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:00:26.781420 3.002231 tcp 10.0.2.105 62012 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:35.782648 0.000000 tcp 10.0.2.105 62012 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:41.781450 3.003615 tcp 10.0.2.105 62013 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:50.783835 0.000000 tcp 10.0.2.105 62013 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:00:55.310524 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:01:18.856745 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:01:25.864190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:01:33.865610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:01:49.868610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:02:21.875302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:05:56.784363 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:05:56.784504 2.993389 tcp 10.0.2.105 62014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:05.786802 0.000000 tcp 10.0.2.105 62014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:11.786651 0.053407 tcp 10.0.2.105 62015 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:11.840405 0.053066 tcp 10.0.2.105 62016 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:11.893734 0.225849 tcp 10.0.2.105 62017 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:12.133023 2.987479 tcp 10.0.2.105 62018 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:21.118274 0.000000 tcp 10.0.2.105 62018 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:27.127994 0.051599 tcp 10.0.2.105 62019 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:27.179853 0.053661 tcp 10.0.2.105 62020 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:27.233821 0.147711 tcp 10.0.2.105 62021 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:06:27.393492 2.998733 tcp 10.0.2.105 62022 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:36.390702 0.000000 tcp 10.0.2.105 62022 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:42.389536 3.004170 tcp 10.0.2.105 62023 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:51.392205 0.000000 tcp 10.0.2.105 62023 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:06:56.309254 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:08:25.881287 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:08:32.888633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:08:40.889976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:08:56.892848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:09:28.898829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:11:57.393163 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:11:57.393369 3.003157 tcp 10.0.2.105 62024 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:06.395050 0.000000 tcp 10.0.2.105 62024 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:12.397801 0.052518 tcp 10.0.2.105 62025 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:12.450589 0.051725 tcp 10.0.2.105 62026 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:12.502592 0.148564 tcp 10.0.2.105 62027 -> 195.113.214.236 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:12.727987 2.990870 tcp 10.0.2.105 62028 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:21.717210 0.000000 tcp 10.0.2.105 62028 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:27.726995 0.052220 tcp 10.0.2.105 62029 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:27.779513 0.053483 tcp 10.0.2.105 62030 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:27.833264 0.147612 tcp 10.0.2.105 62031 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:12:28.038589 3.001476 tcp 10.0.2.105 62032 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:37.039390 0.000000 tcp 10.0.2.105 62032 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:43.038245 3.004421 tcp 10.0.2.105 62033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:52.040218 0.000000 tcp 10.0.2.105 62033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:12:56.807957 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:15:32.904934 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:15:39.912567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:15:47.913723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:16:03.916421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:16:35.922596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:17:58.040821 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:17:58.040994 3.004228 tcp 10.0.2.105 62034 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:07.043508 0.000000 tcp 10.0.2.105 62034 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:13.044136 0.052056 tcp 10.0.2.105 62035 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:13.096699 0.052745 tcp 10.0.2.105 62036 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:13.149734 0.148310 tcp 10.0.2.105 62037 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:13.358128 3.009040 tcp 10.0.2.105 62038 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:22.375741 0.000000 tcp 10.0.2.105 62038 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:28.354954 0.052047 tcp 10.0.2.105 62039 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:28.407319 0.053460 tcp 10.0.2.105 62040 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:28.461062 0.166688 tcp 10.0.2.105 62041 -> 195.113.214.236 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:18:28.650510 2.998866 tcp 10.0.2.105 62042 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:37.647994 0.000000 tcp 10.0.2.105 62042 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:43.646644 2.994117 tcp 10.0.2.105 62043 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:52.639324 0.000000 tcp 10.0.2.105 62043 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:18:57.305967 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:22:39.929381 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:22:46.936116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:22:54.940192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:23:10.940857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:23:42.946830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:29:46.952922 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 16:29:53.960220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:30:01.961545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:30:07.890312 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:30:07.890488 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 16:30:17.964609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:30:25.146667 0.054100 tcp 10.0.2.105 62044 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:25.201040 0.053904 tcp 10.0.2.105 62045 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:25.255314 0.146674 tcp 10.0.2.105 62046 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:25.402575 0.054623 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:25.472483 0.108044 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:25.544935 0.176464 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:25.714649 0.189558 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:25.896330 0.178399 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.020774 0.357543 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.349177 0.043700 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 1959 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.379735 0.209245 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.557752 0.253779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.774023 0.219011 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:26.983793 0.083166 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.050333 0.096738 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.126903 0.086264 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.211027 0.245394 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.454953 0.279900 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.686484 0.173985 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.856982 0.146304 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:27.999121 0.138399 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:28.138928 0.108764 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:28.259576 0.187124 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:28.441817 0.337638 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:28.690301 3.004283 tcp 10.0.2.105 62047 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:30:28.758183 0.168642 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:28.905780 0.163007 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:29.099156 0.090889 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:29.173794 0.279146 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:29.450001 0.063856 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:29.505993 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 16:30:37.693369 0.000000 tcp 10.0.2.105 62047 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:30:43.692427 0.051471 tcp 10.0.2.105 62048 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:43.744401 0.053419 tcp 10.0.2.105 62049 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:43.798132 0.145348 tcp 10.0.2.105 62050 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:43.983032 3.003470 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:30:47.507590 0.053449 tcp 10.0.2.105 62052 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:47.561334 0.052546 tcp 10.0.2.105 62053 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:47.614159 0.144881 tcp 10.0.2.105 62054 -> 195.113.214.236 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:47.759544 0.167889 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:47.905197 0.651713 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/03 16:30:49.972817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:30:52.984759 0.000000 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:30:58.984647 0.052036 tcp 10.0.2.105 62055 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:59.036963 0.053753 tcp 10.0.2.105 62056 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:59.091011 0.151998 tcp 10.0.2.105 62057 -> 195.113.214.236 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:30:59.265738 2.992924 tcp 10.0.2.105 62058 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:31:08.266853 0.000000 tcp 10.0.2.105 62058 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:31:14.265859 2.995127 tcp 10.0.2.105 62059 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:31:23.259419 0.000000 tcp 10.0.2.105 62059 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:31:27.804958 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:36:29.269051 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:36:29.269191 3.003744 tcp 10.0.2.105 62060 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:36:38.270984 0.000000 tcp 10.0.2.105 62060 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:36:44.271769 0.054817 tcp 10.0.2.105 62061 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:44.326896 0.053288 tcp 10.0.2.105 62062 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:44.381105 0.147400 tcp 10.0.2.105 62063 -> 195.113.214.236 443 SRPA* 0 0 35 18262 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:44.542609 3.002389 tcp 10.0.2.105 62064 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:36:53.549956 0.000000 tcp 10.0.2.105 62064 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:36:53.982978 2.995733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:36:59.542358 0.053143 tcp 10.0.2.105 62065 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:59.595837 0.053572 tcp 10.0.2.105 62066 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:59.649668 0.143833 tcp 10.0.2.105 62067 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:36:59.911173 3.005076 tcp 10.0.2.105 62068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:37:00.983943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:37:08.915511 0.000000 tcp 10.0.2.105 62068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:37:08.985564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:37:14.904340 2.994165 tcp 10.0.2.105 62069 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:37:23.907188 0.000000 tcp 10.0.2.105 62069 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:37:24.988597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:37:28.803927 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:37:56.994883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:42:29.907737 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:42:29.907911 3.003390 tcp 10.0.2.105 62070 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:42:38.910161 0.000000 tcp 10.0.2.105 62070 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:42:44.910206 0.053296 tcp 10.0.2.105 62071 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:42:44.963875 0.054566 tcp 10.0.2.105 62072 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:42:45.018700 0.145400 tcp 10.0.2.105 62073 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:42:45.456265 2.997315 tcp 10.0.2.105 62074 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:42:54.452409 0.000000 tcp 10.0.2.105 62074 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:43:00.451738 0.052170 tcp 10.0.2.105 62075 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:43:00.504199 0.053920 tcp 10.0.2.105 62076 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:43:00.558378 0.147654 tcp 10.0.2.105 62077 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:43:00.815303 3.000515 tcp 10.0.2.105 62078 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:43:09.814258 0.000000 tcp 10.0.2.105 62078 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:43:15.812837 2.994387 tcp 10.0.2.105 62079 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:43:24.815795 0.000000 tcp 10.0.2.105 62079 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:43:29.802939 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:44:01.001807 3.000607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:44:08.007838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:44:16.011182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:44:32.015113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:45:04.019040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:48:30.816411 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:48:30.816516 2.993821 tcp 10.0.2.105 62080 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:48:39.808819 0.000000 tcp 10.0.2.105 62080 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:48:45.819195 0.052961 tcp 10.0.2.105 62081 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:48:45.872405 0.054546 tcp 10.0.2.105 62082 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:48:45.927235 0.140811 tcp 10.0.2.105 62083 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:48:46.110790 3.001751 tcp 10.0.2.105 62084 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:48:55.110350 0.000000 tcp 10.0.2.105 62084 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:49:01.110004 0.079274 tcp 10.0.2.105 62085 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:49:01.189583 0.054697 tcp 10.0.2.105 62086 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:49:01.244584 0.151084 tcp 10.0.2.105 62087 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 16:49:01.509638 3.005116 tcp 10.0.2.105 62088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:49:10.513113 0.000000 tcp 10.0.2.105 62088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:49:16.502290 3.003454 tcp 10.0.2.105 62089 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:49:25.504574 0.000000 tcp 10.0.2.105 62089 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 16:49:30.313555 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 16:54:29.034963 3.000506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 16:54:36.041214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:54:44.042663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:55:00.047218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 16:55:32.051588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:01:14.043618 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:01:14.043702 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 17:01:31.611049 0.141760 tcp 10.0.2.105 62090 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:31.753124 0.054075 tcp 10.0.2.105 62091 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:31.807509 0.106103 tcp 10.0.2.105 62092 -> 195.113.214.236 443 SRPA* 0 0 60 38125 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:31.914271 0.174929 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.081074 0.189098 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.263834 0.173875 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.384430 0.056373 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.467511 0.113972 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.573584 0.046473 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.654665 0.208622 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:32.827817 0.250867 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.044368 0.218813 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.254780 0.349920 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.577120 0.081789 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.643410 0.084245 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.710794 0.080138 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.773544 0.171175 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:33.941398 0.145296 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:34.082497 0.138672 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:34.239586 0.101646 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:34.357103 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 17:01:36.057448 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 17:01:43.065350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:01:46.550546 3.003891 tcp 10.0.2.105 62093 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:01:51.066498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:01:52.639453 0.051598 tcp 10.0.2.105 62094 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:52.691322 0.053340 tcp 10.0.2.105 62095 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:52.744941 0.124970 tcp 10.0.2.105 62096 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:01:52.870370 0.257080 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.082309 0.172343 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.231129 0.162490 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2661 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.404052 0.095869 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.480446 0.186206 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.661371 0.234463 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:53.876550 0.247358 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:54.120264 0.065727 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:54.179109 0.167517 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:54.323612 0.177091 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:01:55.553256 0.000000 tcp 10.0.2.105 62093 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:01.552102 0.051624 tcp 10.0.2.105 62097 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:01.604000 0.052462 tcp 10.0.2.105 62098 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:01.656735 0.127633 tcp 10.0.2.105 62099 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:01.794220 3.001933 tcp 10.0.2.105 62100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:07.069089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:02:10.794720 0.000000 tcp 10.0.2.105 62100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:16.793852 0.053520 tcp 10.0.2.105 62101 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:16.847692 0.052523 tcp 10.0.2.105 62102 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:16.900550 0.125106 tcp 10.0.2.105 62103 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:02:17.034973 2.992881 tcp 10.0.2.105 62104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:26.036944 0.000000 tcp 10.0.2.105 62104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:32.035168 2.994522 tcp 10.0.2.105 62105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:39.075798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:02:41.027905 0.000000 tcp 10.0.2.105 62105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:02:45.805040 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:07:47.039339 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:07:47.039528 3.003347 tcp 10.0.2.105 62106 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:07:56.041434 0.000000 tcp 10.0.2.105 62106 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:02.041374 0.053366 tcp 10.0.2.105 62107 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:02.094969 0.051877 tcp 10.0.2.105 62108 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:02.147110 0.124099 tcp 10.0.2.105 62109 -> 195.113.214.236 443 SRPA* 0 0 60 38125 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:02.394751 2.999981 tcp 10.0.2.105 62110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:11.393354 0.000000 tcp 10.0.2.105 62110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:17.392914 0.052634 tcp 10.0.2.105 62111 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:17.445843 0.052948 tcp 10.0.2.105 62112 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:17.499036 0.144402 tcp 10.0.2.105 62113 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:08:17.731125 3.005669 tcp 10.0.2.105 62114 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:26.735350 0.000000 tcp 10.0.2.105 62114 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:32.724532 2.993857 tcp 10.0.2.105 62115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:41.726934 0.000000 tcp 10.0.2.105 62115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:08:43.081565 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:08:46.303413 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:08:50.089300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:08:58.090597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:09:14.093543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:09:46.099559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:13:47.727934 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:13:47.728040 3.003369 tcp 10.0.2.105 62116 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:13:56.729825 0.000000 tcp 10.0.2.105 62116 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:02.730653 0.052917 tcp 10.0.2.105 62117 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:02.783859 0.031391 tcp 10.0.2.105 62118 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:02.815004 0.146955 tcp 10.0.2.105 62119 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:02.982660 3.000521 tcp 10.0.2.105 62120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:11.982142 0.000000 tcp 10.0.2.105 62120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:17.981573 0.051572 tcp 10.0.2.105 62121 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:18.033478 0.053716 tcp 10.0.2.105 62122 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:18.087425 0.149031 tcp 10.0.2.105 62123 -> 195.113.214.236 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:14:18.253465 3.001641 tcp 10.0.2.105 62124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:27.253691 0.000000 tcp 10.0.2.105 62124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:33.253052 3.003757 tcp 10.0.2.105 62125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:42.255242 0.000000 tcp 10.0.2.105 62125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:14:46.811959 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:15:50.105509 3.001701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:15:57.113358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:16:05.114623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:16:21.117402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:16:53.123506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:19:48.256050 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:19:48.256385 2.993274 tcp 10.0.2.105 62126 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:19:57.248722 0.000000 tcp 10.0.2.105 62126 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:03.258717 0.053382 tcp 10.0.2.105 62127 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:03.312390 0.054479 tcp 10.0.2.105 62128 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:03.367176 0.149475 tcp 10.0.2.105 62129 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:03.781883 2.999904 tcp 10.0.2.105 62130 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:12.780051 0.000000 tcp 10.0.2.105 62130 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:18.779262 0.051657 tcp 10.0.2.105 62131 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:18.831262 0.051833 tcp 10.0.2.105 62132 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:18.883384 0.149292 tcp 10.0.2.105 62133 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:20:19.423162 3.001437 tcp 10.0.2.105 62134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:28.422858 0.000000 tcp 10.0.2.105 62134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:34.421739 3.004294 tcp 10.0.2.105 62135 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:43.424549 0.000000 tcp 10.0.2.105 62135 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:20:48.311626 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:22:57.134368 2.996985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:23:04.137048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:23:12.138855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:23:28.142649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:24:00.147687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:30:04.154064 3.000980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 17:30:11.160825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:30:19.162379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:30:35.165194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:31:07.171839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:32:18.324192 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:32:18.324328 0.244133 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:18.566680 0.170236 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:18.797585 0.053002 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:18.922539 0.106205 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:18.990130 0.046901 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:19.069925 0.172759 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:19.235971 0.189174 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:19.417022 0.255843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2019 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:19.466185 2.993455 tcp 10.0.2.105 62136 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:32:19.641779 0.216200 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:19.848687 0.219360 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2592 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.030562 0.096185 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.106077 0.087829 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.225397 0.079066 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.287983 0.173140 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.457800 0.353473 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:20.783792 0.152292 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.033753 0.144354 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.261203 0.106647 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.397235 0.269885 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.619620 0.168739 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.765973 0.160305 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:21.983652 0.093142 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:22.059023 0.209948 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:22.521615 0.329898 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:22.831987 0.257872 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:23.086927 0.063416 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:23.154081 0.169332 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:23.370333 0.174746 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/03 17:32:28.458571 0.000000 tcp 10.0.2.105 62136 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:32:34.468926 0.041433 tcp 10.0.2.105 62137 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:34.510710 0.052987 tcp 10.0.2.105 62138 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:34.563987 0.145939 tcp 10.0.2.105 62139 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:34.741523 3.000867 tcp 10.0.2.105 62140 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:32:43.740517 0.000000 tcp 10.0.2.105 62140 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:32:49.739722 0.052749 tcp 10.0.2.105 62141 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:49.792777 0.052653 tcp 10.0.2.105 62142 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:49.845726 0.148038 tcp 10.0.2.105 62143 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:32:50.056880 2.996536 tcp 10.0.2.105 62144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:32:59.052261 0.000000 tcp 10.0.2.105 62144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:33:05.051027 3.003846 tcp 10.0.2.105 62145 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:33:14.053730 0.000000 tcp 10.0.2.105 62145 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:33:18.810338 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:37:11.178575 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:37:18.185004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:37:26.186634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:37:42.189465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:38:14.195574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:38:20.054282 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:38:20.054462 2.993002 tcp 10.0.2.105 62146 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:38:29.056740 0.000000 tcp 10.0.2.105 62146 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:38:35.056988 0.053404 tcp 10.0.2.105 62147 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:35.110729 0.052983 tcp 10.0.2.105 62148 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:35.163992 0.143215 tcp 10.0.2.105 62149 -> 195.113.214.236 443 SRPA* 0 0 45 41860 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:35.318112 3.002061 tcp 10.0.2.105 62150 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:38:44.318771 0.000000 tcp 10.0.2.105 62150 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:38:50.318035 0.052871 tcp 10.0.2.105 62151 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:50.371205 0.053679 tcp 10.0.2.105 62152 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:50.425158 0.145193 tcp 10.0.2.105 62153 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:38:50.586378 2.995691 tcp 10.0.2.105 62154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:38:59.580595 0.000000 tcp 10.0.2.105 62154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:39:05.579348 3.004253 tcp 10.0.2.105 62155 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:39:14.582756 0.000000 tcp 10.0.2.105 62155 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:39:19.309020 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:44:18.202282 3.000948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:44:20.582748 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:44:20.582929 3.004620 tcp 10.0.2.105 62156 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:44:25.210599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:44:29.589396 0.000000 tcp 10.0.2.105 62156 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:44:33.210893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:44:35.586435 0.053032 tcp 10.0.2.105 62157 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:35.639774 0.032386 tcp 10.0.2.105 62158 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:35.672446 0.148684 tcp 10.0.2.105 62159 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:35.832655 2.995883 tcp 10.0.2.105 62160 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:44:44.836960 0.000000 tcp 10.0.2.105 62160 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:44:49.213503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:44:50.826536 0.030164 tcp 10.0.2.105 62161 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:50.856973 0.031680 tcp 10.0.2.105 62162 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:50.889013 0.161340 tcp 10.0.2.105 62163 -> 195.113.214.236 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:44:51.236810 2.994073 tcp 10.0.2.105 62164 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:45:00.229110 0.000000 tcp 10.0.2.105 62164 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:45:06.238516 3.003595 tcp 10.0.2.105 62165 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:45:15.240753 0.000000 tcp 10.0.2.105 62165 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:45:19.807042 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:45:21.219424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:50:21.241546 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:50:21.241703 3.003330 tcp 10.0.2.105 62166 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:50:30.243436 0.000000 tcp 10.0.2.105 62166 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:50:36.244435 0.053196 tcp 10.0.2.105 62167 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:36.297954 0.052723 tcp 10.0.2.105 62168 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:36.350970 0.146858 tcp 10.0.2.105 62169 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:36.538788 3.008104 tcp 10.0.2.105 62170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:50:45.545601 0.000000 tcp 10.0.2.105 62170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:50:51.534864 0.052765 tcp 10.0.2.105 62171 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:51.587871 0.031222 tcp 10.0.2.105 62172 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:51.619444 0.145510 tcp 10.0.2.105 62173 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 17:50:51.781763 2.996791 tcp 10.0.2.105 62174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:51:00.777479 0.000000 tcp 10.0.2.105 62174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:51:06.776057 2.994748 tcp 10.0.2.105 62175 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:51:15.768999 0.000000 tcp 10.0.2.105 62175 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 17:51:20.305755 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 17:54:39.234674 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 17:54:46.241820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:54:54.243445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:55:10.251961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 17:55:42.253765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:01:46.258357 3.001425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 18:01:53.265751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:02:01.267383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:02:17.270790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:02:44.069631 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:02:44.069924 0.053460 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.146064 0.112092 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.219607 0.049301 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.275674 0.244861 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.519245 0.162852 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.626812 0.175084 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.794365 0.190018 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:44.975300 0.250134 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.191377 0.216192 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.399878 0.212503 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.576120 0.081538 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.641534 0.083630 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.707908 0.078106 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.769121 0.172656 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:45.937654 0.376544 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:46.285219 0.152208 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:46.438871 0.252472 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:46.649418 0.173044 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:46.796312 0.155609 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:46.953373 0.087595 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:47.024728 0.173871 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:47.207088 0.106233 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:47.328179 0.195170 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:47.517163 0.389481 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:47.886253 0.282404 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:48.164570 0.176768 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:48.335704 0.063746 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2631 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:48.390968 0.167349 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:02:49.276452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:02:51.820600 3.004752 tcp 10.0.2.105 62176 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:00.822681 0.000000 tcp 10.0.2.105 62176 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:06.823346 0.031182 tcp 10.0.2.105 62177 -> 195.113.214.211 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:06.854803 0.053238 tcp 10.0.2.105 62178 -> 195.113.214.236 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:06.908339 0.197761 tcp 10.0.2.105 62179 -> 195.113.214.236 443 SRPA* 0 0 36 26965 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:07.116615 2.998913 tcp 10.0.2.105 62180 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:16.114703 0.000000 tcp 10.0.2.105 62180 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:22.114123 0.053453 tcp 10.0.2.105 62181 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:22.167926 0.031901 tcp 10.0.2.105 62182 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:22.200165 0.125304 tcp 10.0.2.105 62183 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:03:22.349785 2.998266 tcp 10.0.2.105 62184 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:31.356676 0.000000 tcp 10.0.2.105 62184 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:37.345527 2.994211 tcp 10.0.2.105 62185 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:46.338605 0.000000 tcp 10.0.2.105 62185 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:03:51.305731 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:08:52.349133 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:08:52.349248 3.003392 tcp 10.0.2.105 62186 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:08:53.281697 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:09:00.289526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:09:01.351142 0.000000 tcp 10.0.2.105 62186 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:07.351412 0.053593 tcp 10.0.2.105 62187 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:07.405293 0.031251 tcp 10.0.2.105 62188 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:07.436824 0.107102 tcp 10.0.2.105 62189 -> 195.113.214.236 443 SRPA* 0 0 32 24705 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:07.553819 3.000895 tcp 10.0.2.105 62190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:08.291184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:09:16.553204 0.000000 tcp 10.0.2.105 62190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:22.552755 0.052692 tcp 10.0.2.105 62191 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:22.605240 0.031985 tcp 10.0.2.105 62192 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:22.637554 0.146838 tcp 10.0.2.105 62193 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:09:22.806840 2.999310 tcp 10.0.2.105 62194 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:24.294299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:09:31.804918 0.000000 tcp 10.0.2.105 62194 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:37.803925 2.994057 tcp 10.0.2.105 62195 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:46.806370 0.000000 tcp 10.0.2.105 62195 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:09:51.803720 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:09:56.299947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:14:52.806830 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:14:52.806991 2.993453 tcp 10.0.2.105 62196 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:01.802259 0.000000 tcp 10.0.2.105 62196 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:07.810262 0.031307 tcp 10.0.2.105 62197 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:07.841903 0.032409 tcp 10.0.2.105 62198 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:07.874624 0.106382 tcp 10.0.2.105 62199 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:07.991169 3.003903 tcp 10.0.2.105 62200 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:16.991093 0.000000 tcp 10.0.2.105 62200 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:22.990478 0.030689 tcp 10.0.2.105 62201 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:23.021529 0.032304 tcp 10.0.2.105 62202 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:23.054134 0.124089 tcp 10.0.2.105 62203 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:15:23.187735 3.006473 tcp 10.0.2.105 62204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:32.193129 0.000000 tcp 10.0.2.105 62204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:38.182055 3.004678 tcp 10.0.2.105 62205 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:47.184755 0.000000 tcp 10.0.2.105 62205 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:15:51.812613 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:16:00.313520 2.995107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:16:07.313677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:16:15.315121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:16:31.320012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:17:03.328689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:20:53.185327 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:20:53.185441 2.993571 tcp 10.0.2.105 62206 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:02.187726 0.000000 tcp 10.0.2.105 62206 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:08.187941 0.053561 tcp 10.0.2.105 62207 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:08.241811 0.031588 tcp 10.0.2.105 62208 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:08.273706 0.127967 tcp 10.0.2.105 62209 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:08.445320 2.995341 tcp 10.0.2.105 62210 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:17.439702 0.000000 tcp 10.0.2.105 62210 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:23.440466 0.031122 tcp 10.0.2.105 62211 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:23.471914 0.030919 tcp 10.0.2.105 62212 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:23.503119 0.125517 tcp 10.0.2.105 62213 -> 195.113.214.236 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:21:23.739345 2.994480 tcp 10.0.2.105 62214 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:32.731356 0.000000 tcp 10.0.2.105 62214 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:38.735645 3.003546 tcp 10.0.2.105 62215 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:47.732687 0.000000 tcp 10.0.2.105 62215 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:21:52.309613 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:23:07.332352 2.999347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:23:14.341008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:23:22.339115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:23:38.342818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:24:10.348446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:30:14.353910 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 18:30:21.361704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:30:29.363273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:30:45.366175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:31:17.372202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:33:11.255743 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:33:11.255844 0.054127 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:11.383041 0.245063 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:11.626903 0.157775 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:11.732978 0.176317 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:11.901461 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 18:33:23.774108 2.996954 tcp 10.0.2.105 62216 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:33:28.893553 0.031401 tcp 10.0.2.105 62217 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:28.925247 0.031483 tcp 10.0.2.105 62218 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:28.957091 0.128367 tcp 10.0.2.105 62219 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:29.086030 0.259178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:29.308808 0.106359 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:29.472524 0.047217 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:29.543424 0.216155 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:29.750705 0.215724 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:29.927784 0.091679 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.029374 0.084898 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.097451 0.080156 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.212156 0.175389 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.383356 0.356523 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.712506 0.152182 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:30.896846 0.262453 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.109308 0.170887 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.258064 0.156627 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.510481 0.096868 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.591010 0.150693 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.778055 0.105191 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:31.918470 0.196225 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:32.108888 0.177932 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:32.284050 0.065366 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:32.383831 0.165970 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:32.648275 0.241646 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:32.776951 0.000000 tcp 10.0.2.105 62216 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:33:32.869498 0.242215 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 18:33:38.777378 0.029846 tcp 10.0.2.105 62220 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:38.807519 0.053601 tcp 10.0.2.105 62221 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:38.861461 0.127960 tcp 10.0.2.105 62222 -> 195.113.214.236 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:39.216895 2.995030 tcp 10.0.2.105 62223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:33:48.208976 0.000000 tcp 10.0.2.105 62223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:33:54.218407 0.030008 tcp 10.0.2.105 62224 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:54.248713 0.053807 tcp 10.0.2.105 62225 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:54.302823 0.145941 tcp 10.0.2.105 62226 -> 195.113.214.236 443 SRPA* 0 0 20 10878 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:33:54.558253 3.003908 tcp 10.0.2.105 62227 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:34:03.563784 0.000000 tcp 10.0.2.105 62227 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:34:09.559786 3.004080 tcp 10.0.2.105 62228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:34:18.562939 0.000000 tcp 10.0.2.105 62228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:34:23.309474 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:37:21.379420 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:37:28.385428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:37:36.388789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:37:52.390061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:38:24.396195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:39:24.562630 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:39:24.562756 3.003968 tcp 10.0.2.105 62229 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:39:33.565606 0.000000 tcp 10.0.2.105 62229 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:39:39.566232 0.031919 tcp 10.0.2.105 62230 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:39.598387 0.031653 tcp 10.0.2.105 62231 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:39.630336 0.126667 tcp 10.0.2.105 62232 -> 195.113.214.236 443 SRPA* 0 0 32 17432 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:39.853411 2.987299 tcp 10.0.2.105 62233 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:39:48.837418 0.000000 tcp 10.0.2.105 62233 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:39:54.846569 0.030132 tcp 10.0.2.105 62234 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:54.877015 0.030836 tcp 10.0.2.105 62235 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:54.908134 0.123710 tcp 10.0.2.105 62236 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:39:55.139890 2.999264 tcp 10.0.2.105 62237 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:40:04.129086 0.000000 tcp 10.0.2.105 62237 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:40:10.138143 3.004513 tcp 10.0.2.105 62238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:40:19.140786 0.000000 tcp 10.0.2.105 62238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:40:23.807403 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:44:28.401586 3.002115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:44:35.409362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:44:43.411079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:44:59.414672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:45:25.141293 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:45:25.141463 3.003371 tcp 10.0.2.105 62239 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:45:31.420068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:45:34.143754 0.000000 tcp 10.0.2.105 62239 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:45:40.144779 0.030877 tcp 10.0.2.105 62240 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:40.175958 0.031469 tcp 10.0.2.105 62241 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:40.207689 0.129199 tcp 10.0.2.105 62242 -> 195.113.214.236 443 SRPA* 0 0 39 33052 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:40.360608 2.998412 tcp 10.0.2.105 62243 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:45:49.365781 0.000000 tcp 10.0.2.105 62243 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:45:55.354833 0.030976 tcp 10.0.2.105 62244 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:55.386069 0.031538 tcp 10.0.2.105 62245 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:55.417867 0.130922 tcp 10.0.2.105 62246 -> 195.113.214.236 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:45:55.665312 3.005208 tcp 10.0.2.105 62247 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:46:04.661474 0.000000 tcp 10.0.2.105 62247 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:46:10.666598 2.994193 tcp 10.0.2.105 62248 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:46:19.659440 0.000000 tcp 10.0.2.105 62248 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:46:24.305996 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:51:25.669985 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:51:25.670096 3.003685 tcp 10.0.2.105 62249 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:51:34.672064 0.000000 tcp 10.0.2.105 62249 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:51:40.672737 0.031098 tcp 10.0.2.105 62250 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:40.704100 0.031604 tcp 10.0.2.105 62251 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:40.736012 0.111092 tcp 10.0.2.105 62252 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:40.871321 3.004368 tcp 10.0.2.105 62253 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:51:49.874798 0.000000 tcp 10.0.2.105 62253 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:51:55.873981 0.031982 tcp 10.0.2.105 62254 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:55.906233 0.031369 tcp 10.0.2.105 62255 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:55.937860 0.124171 tcp 10.0.2.105 62256 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 18:51:56.078206 3.009104 tcp 10.0.2.105 62257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:52:05.096090 0.000000 tcp 10.0.2.105 62257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:52:11.075142 2.993569 tcp 10.0.2.105 62258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:52:20.067671 0.000000 tcp 10.0.2.105 62258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 18:52:24.804165 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 18:54:44.427096 3.005918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 18:54:51.435372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:54:59.436729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:55:15.443232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 18:55:47.445778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:01:51.452816 3.000540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 19:01:58.459126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:02:06.460800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:02:22.463762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:02:54.469828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:03:54.656749 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:03:54.656933 0.189705 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:03:54.838889 0.175051 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:03:55.007419 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 19:03:56.119064 3.003658 tcp 10.0.2.105 62259 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:05.121525 0.000000 tcp 10.0.2.105 62259 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:11.121577 0.031389 tcp 10.0.2.105 62260 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:11.153240 0.053685 tcp 10.0.2.105 62261 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:11.207217 0.108307 tcp 10.0.2.105 62262 -> 195.113.214.236 443 SRPA* 0 0 37 27871 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:11.329586 3.005148 tcp 10.0.2.105 62263 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:13.263401 0.031199 tcp 10.0.2.105 62264 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:13.294908 0.031642 tcp 10.0.2.105 62265 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:13.326899 0.127382 tcp 10.0.2.105 62266 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:13.454888 0.054310 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:13.512801 0.180902 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:13.635141 0.259213 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:13.858693 0.108861 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:13.929275 0.047950 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:13.984091 0.211917 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.188675 0.213716 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.366103 0.098990 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.449163 0.085663 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.520261 0.082298 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.633955 0.174079 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:14.804694 0.474636 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.249619 0.131781 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.382762 0.263665 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.599210 0.169993 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.747269 0.162530 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.925105 0.088151 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:15.997244 0.140762 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:16.139302 0.106736 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:16.255955 0.194062 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:16.445423 0.172033 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:16.639671 0.239251 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:16.859744 0.273411 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:17.129445 0.175936 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:17.302505 0.064921 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:04:20.333345 0.000000 tcp 10.0.2.105 62263 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:26.322324 0.030152 tcp 10.0.2.105 62267 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:26.352819 0.031953 tcp 10.0.2.105 62268 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:26.385028 0.124919 tcp 10.0.2.105 62269 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:04:26.519675 3.007015 tcp 10.0.2.105 62270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:35.525330 0.000000 tcp 10.0.2.105 62270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:41.513760 2.994203 tcp 10.0.2.105 62271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:50.516922 0.000000 tcp 10.0.2.105 62271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:04:55.303266 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:08:58.475896 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:09:05.483363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:09:13.484916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:09:29.487606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:09:56.517378 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:09:56.517549 2.993148 tcp 10.0.2.105 62272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:01.493576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:10:05.509285 0.000000 tcp 10.0.2.105 62272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:11.519692 0.052362 tcp 10.0.2.105 62273 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:11.572582 0.030890 tcp 10.0.2.105 62274 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:11.603782 0.106110 tcp 10.0.2.105 62275 -> 195.113.214.236 443 SRPA* 0 0 63 59085 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:11.726157 2.996447 tcp 10.0.2.105 62276 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:20.721473 0.000000 tcp 10.0.2.105 62276 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:26.720385 0.030401 tcp 10.0.2.105 62277 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:26.751066 0.032034 tcp 10.0.2.105 62278 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:26.783382 0.125929 tcp 10.0.2.105 62279 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:10:26.919733 3.004713 tcp 10.0.2.105 62280 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:35.923066 0.000000 tcp 10.0.2.105 62280 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:41.912052 3.004303 tcp 10.0.2.105 62281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:50.914859 0.000000 tcp 10.0.2.105 62281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:10:55.801861 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:15:56.914502 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:15:56.914645 2.994433 tcp 10.0.2.105 62282 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:05.499269 3.002125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:16:05.917459 0.000000 tcp 10.0.2.105 62282 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:11.918325 0.031128 tcp 10.0.2.105 62283 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:11.949738 0.031041 tcp 10.0.2.105 62284 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:11.981081 0.128679 tcp 10.0.2.105 62285 -> 195.113.214.236 443 SRPA* 0 0 44 40282 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:12.120456 3.000294 tcp 10.0.2.105 62286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:12.507288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:16:20.508621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:16:21.119026 0.000000 tcp 10.0.2.105 62286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:27.119129 0.030210 tcp 10.0.2.105 62287 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:27.149645 0.031216 tcp 10.0.2.105 62288 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:27.181108 0.125721 tcp 10.0.2.105 62289 -> 195.113.214.236 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:16:27.323181 2.999837 tcp 10.0.2.105 62290 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:36.321230 0.000000 tcp 10.0.2.105 62290 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:36.511481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:16:42.320663 3.003720 tcp 10.0.2.105 62291 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:51.323220 0.000000 tcp 10.0.2.105 62291 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:16:56.310005 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:17:08.517819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:21:57.323339 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:21:57.323562 3.003503 tcp 10.0.2.105 62292 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:06.335557 0.000000 tcp 10.0.2.105 62292 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:12.325983 0.030941 tcp 10.0.2.105 62293 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:12.357240 0.031954 tcp 10.0.2.105 62294 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:12.389487 0.125211 tcp 10.0.2.105 62295 -> 195.113.214.236 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:12.542790 2.996407 tcp 10.0.2.105 62296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:21.537688 0.000000 tcp 10.0.2.105 62296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:27.536861 0.030081 tcp 10.0.2.105 62297 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:27.567251 0.032688 tcp 10.0.2.105 62298 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:27.600238 0.128493 tcp 10.0.2.105 62299 -> 195.113.214.236 443 SRPA* 0 0 44 40054 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:22:27.741299 2.999754 tcp 10.0.2.105 62300 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:36.739588 0.000000 tcp 10.0.2.105 62300 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:42.743112 3.005907 tcp 10.0.2.105 62301 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:51.741096 0.000000 tcp 10.0.2.105 62301 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:22:56.312901 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:23:12.524769 3.000844 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:23:19.531115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:23:27.532196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:23:43.535450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:24:15.541697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:27:57.741504 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:27:57.741598 3.004076 tcp 10.0.2.105 62302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:28:06.743923 0.000000 tcp 10.0.2.105 62302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:28:12.744883 0.031276 tcp 10.0.2.105 62303 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:28:12.776484 0.031018 tcp 10.0.2.105 62304 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:28:12.807798 0.106517 tcp 10.0.2.105 62305 -> 195.113.214.236 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:28:12.981202 2.996327 tcp 10.0.2.105 62306 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:28:21.986097 0.000000 tcp 10.0.2.105 62306 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:30:19.547897 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 19:30:26.555054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:30:34.556425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:30:50.559562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:31:22.565686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:34:29.324448 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:34:29.324647 0.253962 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:29.683434 0.191209 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:29.867190 0.173842 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.033316 0.062231 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.082757 0.171562 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.228017 0.249999 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.443180 0.111919 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.514819 0.045723 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.615613 0.212850 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 1936 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:30.821316 0.215119 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.002511 0.091941 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.075874 0.198051 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.270494 0.086392 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.339956 0.084460 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.429016 0.359701 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.759874 0.131499 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:31.930217 0.957207 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:32.840283 0.595848 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:33.407875 0.161711 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:33.605206 0.085943 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:33.675599 0.143075 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:33.820759 0.102591 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:33.943980 0.190640 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:34.156926 0.174169 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:34.362077 0.175360 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2054 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:34.534613 0.064872 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:34.591720 0.238024 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:34.808206 0.234284 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/03 19:34:42.984097 2.993427 tcp 10.0.2.105 62307 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:34:51.986057 0.000000 tcp 10.0.2.105 62307 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:34:56.803535 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:34:57.987085 0.054325 tcp 10.0.2.105 62308 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:34:58.041652 0.054746 tcp 10.0.2.105 62309 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:34:58.096687 0.147408 tcp 10.0.2.105 62310 -> 195.113.214.236 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:34:58.254085 2.995929 tcp 10.0.2.105 62311 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:07.248024 0.000000 tcp 10.0.2.105 62311 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:13.248270 0.030297 tcp 10.0.2.105 62312 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:35:13.278895 0.053346 tcp 10.0.2.105 62313 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:35:13.332530 0.124531 tcp 10.0.2.105 62314 -> 195.113.214.236 443 SRPA* 0 0 32 17616 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:35:13.495091 2.996855 tcp 10.0.2.105 62315 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:22.490530 0.000000 tcp 10.0.2.105 62315 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:28.489431 3.004081 tcp 10.0.2.105 62316 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:37.492970 0.000000 tcp 10.0.2.105 62316 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:35:42.308890 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:37:26.574275 2.998773 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:37:33.582049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:37:41.580878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:37:57.583506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:38:29.589749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:40:43.492820 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:40:43.493045 3.003585 tcp 10.0.2.105 62317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:40:52.494803 0.000000 tcp 10.0.2.105 62317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:40:58.495472 0.031055 tcp 10.0.2.105 62318 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:40:58.526855 0.031246 tcp 10.0.2.105 62319 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:40:58.558409 0.122631 tcp 10.0.2.105 62320 -> 195.113.214.236 443 SRPA* 0 0 39 33052 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:40:58.699711 2.998585 tcp 10.0.2.105 62321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:07.706855 0.000000 tcp 10.0.2.105 62321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:13.695936 0.029742 tcp 10.0.2.105 62322 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:41:13.725908 0.033439 tcp 10.0.2.105 62323 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:41:13.759602 0.125908 tcp 10.0.2.105 62324 -> 195.113.214.236 443 SRPA* 0 0 27 11064 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:41:13.896495 2.993337 tcp 10.0.2.105 62325 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:22.888840 0.000000 tcp 10.0.2.105 62325 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:28.897279 3.004375 tcp 10.0.2.105 62326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:37.899829 0.000000 tcp 10.0.2.105 62326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:41:42.807059 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:44:33.596382 3.138048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:44:40.704469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:44:48.640002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:45:04.617906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:45:36.623418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:46:43.900825 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:46:43.900982 3.009170 tcp 10.0.2.105 62327 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:46:52.903151 0.000000 tcp 10.0.2.105 62327 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:46:58.906941 0.053658 tcp 10.0.2.105 62328 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:46:58.960957 0.031617 tcp 10.0.2.105 62329 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:46:58.992910 0.126423 tcp 10.0.2.105 62330 -> 195.113.214.236 443 SRPA* 0 0 40 34544 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:46:59.410644 3.008124 tcp 10.0.2.105 62331 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:08.415416 0.000000 tcp 10.0.2.105 62331 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:14.404528 0.029934 tcp 10.0.2.105 62332 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:47:14.434739 0.031585 tcp 10.0.2.105 62333 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:47:14.466576 0.130246 tcp 10.0.2.105 62334 -> 195.113.214.236 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:47:14.624959 2.993297 tcp 10.0.2.105 62335 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:23.617406 0.000000 tcp 10.0.2.105 62335 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:29.626172 2.993901 tcp 10.0.2.105 62336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:38.618891 0.000000 tcp 10.0.2.105 62336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:47:43.305627 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:52:44.628738 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:52:44.628874 3.004109 tcp 10.0.2.105 62337 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:52:53.632004 0.000000 tcp 10.0.2.105 62337 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:52:59.632913 0.052998 tcp 10.0.2.105 62338 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:52:59.686196 0.031078 tcp 10.0.2.105 62339 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:52:59.717526 0.149001 tcp 10.0.2.105 62340 -> 195.113.214.236 443 SRPA* 0 0 42 28882 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:52:59.973492 3.001673 tcp 10.0.2.105 62341 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:08.978651 0.000000 tcp 10.0.2.105 62341 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:14.974082 0.030021 tcp 10.0.2.105 62342 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:53:15.004624 0.031949 tcp 10.0.2.105 62343 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:53:15.036912 0.143066 tcp 10.0.2.105 62344 -> 195.113.214.236 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/03 19:53:15.338467 3.018558 tcp 10.0.2.105 62345 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:24.356034 0.000000 tcp 10.0.2.105 62345 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:30.337337 2.991726 tcp 10.0.2.105 62346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:39.327657 0.000000 tcp 10.0.2.105 62346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 19:53:44.304670 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 19:54:47.641493 2.998697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 19:54:54.651267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:55:02.647417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:55:18.650272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 19:55:50.656539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:01:54.662094 3.001848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 20:02:01.671528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:02:09.671475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:02:25.674274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:02:57.680677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:04:35.631989 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:04:35.632162 0.176347 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:35.800925 0.052224 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:35.857578 0.239712 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.095899 0.189762 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.278657 0.182218 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.399388 0.267944 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.628656 0.109271 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.701373 0.044886 udp 10.0.2.105 7010 <-> 79.219.111.23 2430 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.747845 0.214170 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:36.955009 0.216027 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.135638 0.086424 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.204187 0.173917 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.374094 0.087334 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.443509 0.083685 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.510769 0.431288 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:37.915648 0.124475 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.060841 0.261126 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.271416 0.091671 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.346529 0.151924 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.494294 0.103610 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.612062 0.167560 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.755329 0.163372 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:38.918546 0.200081 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:39.117663 0.169751 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:39.265028 0.174080 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:39.436452 0.066693 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2580 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:39.494697 0.232670 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:39.707910 0.236396 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:04:45.377409 2.991945 tcp 10.0.2.105 62347 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:04:54.368178 0.000000 tcp 10.0.2.105 62347 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:04:59.305092 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:05:00.379700 0.031481 tcp 10.0.2.105 62348 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:00.411453 0.031931 tcp 10.0.2.105 62349 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:00.443677 0.125346 tcp 10.0.2.105 62350 -> 195.113.214.236 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:00.579951 3.002162 tcp 10.0.2.105 62351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:09.580062 0.000000 tcp 10.0.2.105 62351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:15.579213 0.030165 tcp 10.0.2.105 62352 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:15.609676 0.030957 tcp 10.0.2.105 62353 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:15.640929 0.144504 tcp 10.0.2.105 62354 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:05:15.796883 2.996632 tcp 10.0.2.105 62355 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:24.791582 0.000000 tcp 10.0.2.105 62355 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:30.790436 3.004210 tcp 10.0.2.105 62356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:39.793384 0.000000 tcp 10.0.2.105 62356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:05:44.309603 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:09:02.688216 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:09:09.695216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:09:17.696762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:09:33.699666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:10:05.705984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:10:45.793939 0.000179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:10:45.794228 2.993018 tcp 10.0.2.105 62357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:10:54.796510 0.000000 tcp 10.0.2.105 62357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:00.796781 0.031538 tcp 10.0.2.105 62358 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:00.828672 0.030950 tcp 10.0.2.105 62359 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:00.859871 0.150424 tcp 10.0.2.105 62360 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:01.021748 2.997687 tcp 10.0.2.105 62361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:10.017763 0.000000 tcp 10.0.2.105 62361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:16.017322 0.052214 tcp 10.0.2.105 62362 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:16.069883 0.031182 tcp 10.0.2.105 62363 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:16.101394 0.204034 tcp 10.0.2.105 62364 -> 195.113.214.236 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:11:16.315047 2.996840 tcp 10.0.2.105 62365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:25.309960 0.000000 tcp 10.0.2.105 62365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:31.308860 3.004405 tcp 10.0.2.105 62366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:40.314958 0.000000 tcp 10.0.2.105 62366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:11:45.308312 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:16:09.715095 2.998284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:16:16.719286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:16:24.721091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:16:40.723558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:16:46.312132 0.000214 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:16:46.312406 3.003808 tcp 10.0.2.105 62367 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:16:55.314806 0.000000 tcp 10.0.2.105 62367 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:01.315004 0.053949 tcp 10.0.2.105 62368 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:01.369212 0.052596 tcp 10.0.2.105 62369 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:01.422079 0.131295 tcp 10.0.2.105 62370 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:01.567449 3.000301 tcp 10.0.2.105 62371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:10.576614 0.000000 tcp 10.0.2.105 62371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:12.729700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:17:16.565721 0.029422 tcp 10.0.2.105 62372 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:16.595401 0.052417 tcp 10.0.2.105 62373 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:16.648078 0.152376 tcp 10.0.2.105 62374 -> 195.113.214.236 443 SRPA* 0 0 45 42108 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:17:16.812023 2.997669 tcp 10.0.2.105 62375 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:25.808285 0.000000 tcp 10.0.2.105 62375 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:31.807073 3.004621 tcp 10.0.2.105 62376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:40.809658 0.000000 tcp 10.0.2.105 62376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:17:45.807131 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:22:46.810386 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:22:46.810544 3.003636 tcp 10.0.2.105 62377 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:22:55.812932 0.000000 tcp 10.0.2.105 62377 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:01.813142 0.053000 tcp 10.0.2.105 62378 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:01.866430 0.032109 tcp 10.0.2.105 62379 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:01.898833 0.151030 tcp 10.0.2.105 62380 -> 195.113.214.236 443 SRPA* 0 0 40 33106 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:02.133383 3.002495 tcp 10.0.2.105 62381 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:11.139114 0.000000 tcp 10.0.2.105 62381 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:16.736792 3.006778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:23:17.134462 0.052709 tcp 10.0.2.105 62382 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:17.187477 0.030892 tcp 10.0.2.105 62383 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:17.218656 0.126231 tcp 10.0.2.105 62384 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:23:17.423419 2.987398 tcp 10.0.2.105 62385 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:23.747339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:23:26.417217 0.000000 tcp 10.0.2.105 62385 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:31.745849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:23:32.415995 2.997498 tcp 10.0.2.105 62386 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:41.408261 0.000000 tcp 10.0.2.105 62386 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:23:46.306711 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:23:47.747723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:24:19.753662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:30:23.759495 3.001947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 20:30:30.767115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:30:38.768727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:30:54.771702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:31:26.777693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:35:05.212380 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:35:05.212594 0.588458 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:05.380157 0.054639 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:05.500010 0.242024 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:05.740781 0.189922 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:05.923136 0.158818 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:06.031449 0.258076 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:06.256895 0.115446 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:06.330517 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 20:35:17.459515 3.004039 tcp 10.0.2.105 62387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:35:25.031360 0.052450 tcp 10.0.2.105 62388 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:25.084067 0.053357 tcp 10.0.2.105 62389 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:25.137686 0.106550 tcp 10.0.2.105 62390 -> 195.113.214.236 443 SRPA* 0 0 36 26969 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:25.244753 0.215518 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:25.450849 0.214679 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:25.630321 0.091195 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:25.735301 0.173298 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2565 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:25.904627 0.088622 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.026023 0.078366 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.087580 0.368941 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.428027 0.145603 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.464889 0.000000 tcp 10.0.2.105 62387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:35:26.575280 0.258691 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.785119 0.091273 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:26.860565 0.148992 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.019072 0.100302 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.119636 0.173464 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.268585 0.157970 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.442617 0.175697 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.615279 0.068080 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.674755 0.231901 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:27.887905 0.277766 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:28.161738 0.201499 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:28.358682 0.170504 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/03 20:35:32.461351 0.051206 tcp 10.0.2.105 62391 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:32.512861 0.053477 tcp 10.0.2.105 62392 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:32.566188 0.126486 tcp 10.0.2.105 62393 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:32.709394 3.006277 tcp 10.0.2.105 62394 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:35:41.714231 0.000000 tcp 10.0.2.105 62394 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:35:47.703408 0.051082 tcp 10.0.2.105 62395 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:47.754845 0.052567 tcp 10.0.2.105 62396 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:47.807713 0.126040 tcp 10.0.2.105 62397 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:35:47.994755 2.992636 tcp 10.0.2.105 62398 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:35:56.995942 0.000000 tcp 10.0.2.105 62398 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:36:02.994630 2.994086 tcp 10.0.2.105 62399 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:36:11.987020 0.000000 tcp 10.0.2.105 62399 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:36:16.804703 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:37:30.783749 3.001602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:37:37.791613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:37:45.792777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:38:01.795390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:38:33.801494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:41:17.998541 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:41:17.998841 3.002970 tcp 10.0.2.105 62400 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:41:27.000507 0.000000 tcp 10.0.2.105 62400 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:41:33.000948 0.052051 tcp 10.0.2.105 62401 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:33.053306 0.052055 tcp 10.0.2.105 62402 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:33.105669 0.128710 tcp 10.0.2.105 62403 -> 195.113.214.236 443 SRPA* 0 0 63 42057 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:33.282985 3.000873 tcp 10.0.2.105 62404 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:41:42.282673 0.000000 tcp 10.0.2.105 62404 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:41:48.282082 0.051159 tcp 10.0.2.105 62405 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:48.333589 0.053712 tcp 10.0.2.105 62406 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:48.387629 0.145942 tcp 10.0.2.105 62407 -> 195.113.214.236 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:41:48.543463 3.002353 tcp 10.0.2.105 62408 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:41:57.544714 0.000000 tcp 10.0.2.105 62408 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:42:03.543314 3.004285 tcp 10.0.2.105 62409 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:42:12.556386 0.000000 tcp 10.0.2.105 62409 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:42:17.302921 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:44:37.816977 2.992319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:44:44.814939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:44:52.819577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:45:08.819437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:45:40.825545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:47:18.551697 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:47:18.551908 2.989301 tcp 10.0.2.105 62410 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:47:27.543202 0.000000 tcp 10.0.2.105 62410 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:47:33.552852 0.055560 tcp 10.0.2.105 62411 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:33.608740 0.053020 tcp 10.0.2.105 62412 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:33.662052 0.145005 tcp 10.0.2.105 62413 -> 195.113.214.236 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:33.962254 3.000713 tcp 10.0.2.105 62414 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:47:42.961822 0.000000 tcp 10.0.2.105 62414 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:47:48.960283 0.051099 tcp 10.0.2.105 62415 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:49.011660 0.041311 tcp 10.0.2.105 62416 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:49.053276 0.146938 tcp 10.0.2.105 62417 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:47:49.214446 2.999619 tcp 10.0.2.105 62418 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:47:58.212967 0.000000 tcp 10.0.2.105 62418 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:48:04.211887 3.004517 tcp 10.0.2.105 62419 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:48:13.214082 0.000000 tcp 10.0.2.105 62419 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:48:17.801304 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:53:19.215858 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:53:19.215985 2.992352 tcp 10.0.2.105 62420 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:53:28.219649 0.000000 tcp 10.0.2.105 62420 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:53:34.220124 0.052429 tcp 10.0.2.105 62421 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:34.272898 0.053154 tcp 10.0.2.105 62422 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:34.326338 0.150099 tcp 10.0.2.105 62423 -> 195.113.214.236 443 SRPA* 0 0 39 20854 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:34.668272 2.992994 tcp 10.0.2.105 62424 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:53:43.660664 0.000000 tcp 10.0.2.105 62424 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:53:49.659834 0.052110 tcp 10.0.2.105 62425 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:49.712241 0.052258 tcp 10.0.2.105 62426 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:49.764809 0.142085 tcp 10.0.2.105 62427 -> 195.113.214.236 443 SRPA* 0 0 33 18722 flow=From-Botnet-V2-TCP-Established 1970/02/03 20:53:49.958080 3.004980 tcp 10.0.2.105 62428 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:53:58.961579 0.000000 tcp 10.0.2.105 62428 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:54:04.950451 3.004362 tcp 10.0.2.105 62429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:54:13.953264 0.000000 tcp 10.0.2.105 62429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 20:54:18.809962 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 20:54:50.839110 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 20:54:57.846706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:55:05.847803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:55:21.850748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 20:55:53.861309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:01:57.862458 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 21:02:04.870123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:02:12.871983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:02:28.875758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:03:00.880440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:05:43.535191 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:05:43.535284 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 21:06:00.280749 0.052813 tcp 10.0.2.105 62430 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:00.333805 0.052528 tcp 10.0.2.105 62431 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:00.386625 0.153950 tcp 10.0.2.105 62432 -> 195.113.214.236 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:00.541133 0.241125 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:01.670477 0.191342 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2587 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:01.853758 0.190895 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:02.076904 0.174685 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:02.311856 0.053700 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:02.481706 0.343203 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:02.787042 0.105205 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:02.853961 0.092875 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:03.104362 0.206538 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:03.301995 0.084813 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:03.559110 0.084382 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:03.625848 0.211369 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:03.830224 0.213942 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:04.008794 0.883653 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:04.862675 0.138572 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:04.995955 2.993844 tcp 10.0.2.105 62433 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:05.133797 0.261542 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:05.348840 0.090766 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:05.490521 0.143910 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:05.681098 0.127861 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:06.142641 0.175714 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:06.314434 0.063658 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:06.566157 0.233616 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:06.779847 0.172137 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:06.928168 0.159469 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:07.092712 0.172062 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:07.412817 0.257914 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:07.666540 0.202392 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:06:13.987902 0.000000 tcp 10.0.2.105 62433 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:19.997445 0.052808 tcp 10.0.2.105 62434 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:20.050594 0.052111 tcp 10.0.2.105 62435 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:20.102966 0.152410 tcp 10.0.2.105 62436 -> 195.113.214.236 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:20.282094 3.002638 tcp 10.0.2.105 62437 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:29.279932 0.000000 tcp 10.0.2.105 62437 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:35.279503 0.051281 tcp 10.0.2.105 62438 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:35.331139 0.052590 tcp 10.0.2.105 62439 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:35.384015 0.147379 tcp 10.0.2.105 62440 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:06:35.659184 3.004781 tcp 10.0.2.105 62441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:44.662812 0.000000 tcp 10.0.2.105 62441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:50.651340 3.004326 tcp 10.0.2.105 62442 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:06:59.654096 0.000000 tcp 10.0.2.105 62442 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:07:04.300908 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:09:06.890559 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:09:13.897328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:09:21.898730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:09:37.901618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:10:09.908167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:12:05.654630 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:12:05.657055 2.991315 tcp 10.0.2.105 62443 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:14.657000 0.000000 tcp 10.0.2.105 62443 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:20.657622 0.052068 tcp 10.0.2.105 62444 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:20.709934 0.055301 tcp 10.0.2.105 62445 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:20.765520 0.146408 tcp 10.0.2.105 62446 -> 195.113.214.236 443 SRPA* 0 0 45 40084 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:20.997104 3.003510 tcp 10.0.2.105 62447 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:29.998516 0.000000 tcp 10.0.2.105 62447 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:35.997834 0.051764 tcp 10.0.2.105 62448 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:36.049901 0.053174 tcp 10.0.2.105 62449 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:36.103344 0.153095 tcp 10.0.2.105 62450 -> 195.113.214.236 443 SRPA* 0 0 46 34868 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:12:36.360072 3.002826 tcp 10.0.2.105 62451 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:45.361067 0.000000 tcp 10.0.2.105 62451 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:12:51.359977 3.004497 tcp 10.0.2.105 62452 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:13:00.362881 0.000000 tcp 10.0.2.105 62452 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:13:05.309940 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:16:13.914169 3.001148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:16:20.921344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:16:28.922881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:16:44.925630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:17:16.931960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:18:06.363385 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:18:06.363496 3.003602 tcp 10.0.2.105 62453 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:15.376030 0.000000 tcp 10.0.2.105 62453 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:21.366208 0.051561 tcp 10.0.2.105 62454 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:21.418012 0.052646 tcp 10.0.2.105 62455 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:21.470934 0.149236 tcp 10.0.2.105 62456 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:21.656847 2.992390 tcp 10.0.2.105 62457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:30.647776 0.000000 tcp 10.0.2.105 62457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:36.656590 0.051360 tcp 10.0.2.105 62458 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:36.708321 0.052593 tcp 10.0.2.105 62459 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:36.761206 0.151616 tcp 10.0.2.105 62460 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:18:36.933350 2.997323 tcp 10.0.2.105 62461 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:45.929516 0.000000 tcp 10.0.2.105 62461 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:18:51.928647 3.003988 tcp 10.0.2.105 62462 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:19:00.931298 0.000000 tcp 10.0.2.105 62462 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:19:05.808163 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:23:20.936819 3.008007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:23:27.947153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:23:35.946702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:23:51.951978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:24:06.931621 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:24:06.931763 3.003656 tcp 10.0.2.105 62463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:15.934065 0.000000 tcp 10.0.2.105 62463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:21.934454 0.052795 tcp 10.0.2.105 62464 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:21.987501 0.054114 tcp 10.0.2.105 62465 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:22.041889 0.144247 tcp 10.0.2.105 62466 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:22.331675 3.005855 tcp 10.0.2.105 62467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:23.955441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:24:31.346373 0.000000 tcp 10.0.2.105 62467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:37.325702 0.051686 tcp 10.0.2.105 62468 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:37.377666 0.051299 tcp 10.0.2.105 62469 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:37.429328 0.154644 tcp 10.0.2.105 62470 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:24:37.675084 2.994520 tcp 10.0.2.105 62471 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:46.668499 0.000000 tcp 10.0.2.105 62471 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:24:52.667489 3.003985 tcp 10.0.2.105 62472 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:25:01.669806 0.000000 tcp 10.0.2.105 62472 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:25:06.306673 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:30:27.966419 3.019761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:30:34.979116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:30:42.981287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:30:58.993234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:31:30.999672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:36:11.183128 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:36:11.183300 0.240466 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:11.422075 0.189895 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:11.728967 0.159994 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:11.838917 0.175053 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.007052 0.054418 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.120404 0.261825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.346042 0.105331 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.413517 0.093826 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.488244 0.171504 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.656836 0.215502 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:12.864607 0.214382 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:13.040485 0.087494 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:13.111998 0.078999 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:13.256399 0.551705 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:13.778657 0.131821 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:13.940912 0.261765 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:14.150248 0.088270 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:14.258247 0.141912 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:14.542956 0.100323 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:14.696628 0.174806 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:14.868569 0.065962 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.006061 0.238444 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.222498 0.173588 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.372992 0.163335 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.598984 0.203545 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.796740 0.171241 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:15.996489 0.278041 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/03 21:36:22.709702 3.005064 tcp 10.0.2.105 62473 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:36:31.711853 0.000000 tcp 10.0.2.105 62473 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:36:36.308822 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:36:37.712303 0.053203 tcp 10.0.2.105 62474 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:37.765790 0.063788 tcp 10.0.2.105 62475 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:37.829955 0.150782 tcp 10.0.2.105 62476 -> 195.113.214.236 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:38.147905 3.007572 tcp 10.0.2.105 62477 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:36:47.154772 0.000000 tcp 10.0.2.105 62477 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:36:53.143554 0.051561 tcp 10.0.2.105 62478 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:53.195416 0.053233 tcp 10.0.2.105 62479 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:53.248984 0.150118 tcp 10.0.2.105 62480 -> 195.113.214.236 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:36:53.424738 3.002739 tcp 10.0.2.105 62481 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:37:02.436313 0.000000 tcp 10.0.2.105 62481 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:37:08.425169 2.994908 tcp 10.0.2.105 62482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:37:17.427869 0.000000 tcp 10.0.2.105 62482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:37:22.304739 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:37:35.006088 3.000623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:37:42.013232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:37:50.014092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:38:06.017229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:38:38.023031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:42:23.428899 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:42:23.429002 3.003113 tcp 10.0.2.105 62483 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:42:32.430504 0.000000 tcp 10.0.2.105 62483 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:42:38.431191 0.087801 tcp 10.0.2.105 62484 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:38.519347 0.051163 tcp 10.0.2.105 62485 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:38.570774 0.146692 tcp 10.0.2.105 62486 -> 195.113.214.236 443 SRPA* 0 0 40 31462 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:38.854066 3.000070 tcp 10.0.2.105 62487 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:42:47.852868 0.000000 tcp 10.0.2.105 62487 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:42:53.852138 0.052815 tcp 10.0.2.105 62488 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:53.905251 0.052444 tcp 10.0.2.105 62489 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:53.957980 0.149167 tcp 10.0.2.105 62490 -> 195.113.214.236 443 SRPA* 0 0 43 24396 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:42:54.170049 3.005889 tcp 10.0.2.105 62491 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:43:03.174967 0.000000 tcp 10.0.2.105 62491 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:43:09.163832 2.994114 tcp 10.0.2.105 62492 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:43:18.166491 0.000000 tcp 10.0.2.105 62492 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:43:22.803127 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:44:42.039854 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:44:49.049863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:44:57.048607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:45:13.051535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:45:45.057975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:48:24.167144 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:48:24.167247 2.995033 tcp 10.0.2.105 62493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:48:33.159431 0.000000 tcp 10.0.2.105 62493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:48:39.170945 0.053737 tcp 10.0.2.105 62494 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:39.225028 0.052558 tcp 10.0.2.105 62495 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:39.277884 0.144974 tcp 10.0.2.105 62496 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:39.488352 3.004525 tcp 10.0.2.105 62497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:48:48.492567 0.000000 tcp 10.0.2.105 62497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:48:54.481251 0.052681 tcp 10.0.2.105 62498 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:54.534203 0.053867 tcp 10.0.2.105 62499 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:54.588355 0.149082 tcp 10.0.2.105 62500 -> 195.113.214.236 443 SRPA* 0 0 43 34060 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:48:55.461517 2.993958 tcp 10.0.2.105 62501 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:49:04.454423 0.000000 tcp 10.0.2.105 62501 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:49:10.463268 3.004225 tcp 10.0.2.105 62502 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:49:18.304082 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:49:19.475851 0.000000 tcp 10.0.2.105 62502 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:51:49.063186 3.002224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:51:56.071355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:52:04.072511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:52:20.075651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:52:52.081585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:54:25.466425 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:54:25.466587 2.993647 tcp 10.0.2.105 62503 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:54:34.459069 0.000000 tcp 10.0.2.105 62503 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:54:40.469587 0.054085 tcp 10.0.2.105 62504 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:40.523905 0.052905 tcp 10.0.2.105 62505 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:40.577161 0.144281 tcp 10.0.2.105 62506 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:40.737332 3.004885 tcp 10.0.2.105 62507 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:54:49.741055 0.000000 tcp 10.0.2.105 62507 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:54:55.730133 0.052382 tcp 10.0.2.105 62508 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:55.782859 0.054599 tcp 10.0.2.105 62509 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:55.837796 0.156138 tcp 10.0.2.105 62510 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 21:54:56.025876 2.998049 tcp 10.0.2.105 62511 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:55:05.022980 0.000000 tcp 10.0.2.105 62511 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:55:11.021596 3.004110 tcp 10.0.2.105 62512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:55:20.024114 0.000000 tcp 10.0.2.105 62512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 21:55:24.801353 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 21:58:56.088372 3.001157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 21:59:03.095204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:59:11.096592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:59:27.099541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 21:59:59.105679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:06:27.115975 3.001733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 22:06:34.123444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:06:42.125276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:06:46.190857 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:06:46.191014 0.180040 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:46.313630 0.175893 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:46.481212 0.056657 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:46.561505 0.242166 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:46.802223 0.191126 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:46.984986 0.653249 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:47.592717 0.107702 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:47.724629 0.093342 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:47.800769 0.174019 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:47.970449 0.215659 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:48.178086 0.214954 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:48.356201 0.089101 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:48.429090 0.081943 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:48.575059 0.517995 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.065879 0.131544 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.241050 0.147141 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.400905 0.103622 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.521813 0.175485 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.694028 0.063320 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.749263 0.262180 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:49.960795 0.094027 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.038023 0.235260 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.253185 0.173154 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.403303 0.165978 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.579156 0.201224 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.775656 0.172353 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:50.990180 0.296405 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:06:56.065752 2.993257 tcp 10.0.2.105 62513 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:06:58.128019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:07:05.057847 0.000000 tcp 10.0.2.105 62513 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:09.804664 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:07:11.068515 0.053424 tcp 10.0.2.105 62514 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:11.122177 0.052352 tcp 10.0.2.105 62515 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:11.174849 0.150123 tcp 10.0.2.105 62516 -> 195.113.214.236 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:11.345253 2.996226 tcp 10.0.2.105 62517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:20.339894 0.000000 tcp 10.0.2.105 62517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:26.341692 0.051277 tcp 10.0.2.105 62518 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:26.393239 0.052673 tcp 10.0.2.105 62519 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:26.445739 0.152600 tcp 10.0.2.105 62520 -> 195.113.214.236 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:07:26.732787 3.000744 tcp 10.0.2.105 62521 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:30.134884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:07:35.731880 0.000000 tcp 10.0.2.105 62521 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:41.730808 3.004357 tcp 10.0.2.105 62522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:50.733659 0.000000 tcp 10.0.2.105 62522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:07:55.300047 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:12:56.734232 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:12:56.734377 2.993550 tcp 10.0.2.105 62523 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:05.736467 0.000000 tcp 10.0.2.105 62523 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:11.737435 0.052911 tcp 10.0.2.105 62524 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:11.790714 0.054979 tcp 10.0.2.105 62525 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:11.846016 0.152017 tcp 10.0.2.105 62526 -> 195.113.214.236 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:12.083914 2.995535 tcp 10.0.2.105 62527 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:21.078259 0.000000 tcp 10.0.2.105 62527 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:27.077965 0.053785 tcp 10.0.2.105 62528 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:27.132002 0.052728 tcp 10.0.2.105 62529 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:27.185047 0.148381 tcp 10.0.2.105 62530 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:13:27.342994 2.998935 tcp 10.0.2.105 62531 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:36.340726 0.000000 tcp 10.0.2.105 62531 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:37.143983 3.001955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 22:13:42.339323 3.004265 tcp 10.0.2.105 62532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:44.151831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:13:51.342067 0.000000 tcp 10.0.2.105 62532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:13:52.153288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:13:56.309250 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:14:08.156251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:14:40.162231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:18:57.342521 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:18:57.342731 3.003944 tcp 10.0.2.105 62533 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:06.345190 0.000000 tcp 10.0.2.105 62533 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:12.345254 0.052167 tcp 10.0.2.105 62534 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:12.397725 0.056510 tcp 10.0.2.105 62535 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:12.454612 0.151278 tcp 10.0.2.105 62536 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:12.649705 2.998923 tcp 10.0.2.105 62537 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:21.657020 0.000000 tcp 10.0.2.105 62537 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:27.646301 0.052426 tcp 10.0.2.105 62538 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:27.698988 0.070528 tcp 10.0.2.105 62539 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:27.769893 0.146694 tcp 10.0.2.105 62540 -> 195.113.214.236 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:19:28.239771 3.047061 tcp 10.0.2.105 62541 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:37.243104 0.000000 tcp 10.0.2.105 62541 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:43.248233 3.004496 tcp 10.0.2.105 62542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:52.250927 0.000000 tcp 10.0.2.105 62542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:19:56.808517 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:20:44.168543 3.001461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 22:20:51.175814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:20:59.177323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:21:15.180581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:21:47.186417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:24:58.251253 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:24:58.251390 3.003753 tcp 10.0.2.105 62543 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:07.253913 0.000000 tcp 10.0.2.105 62543 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:13.254832 0.053693 tcp 10.0.2.105 62544 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:13.308801 0.053440 tcp 10.0.2.105 62545 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:13.362538 0.157133 tcp 10.0.2.105 62546 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:13.599314 2.998162 tcp 10.0.2.105 62547 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:22.605852 0.000000 tcp 10.0.2.105 62547 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:28.595183 0.051934 tcp 10.0.2.105 62548 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:28.647479 0.054493 tcp 10.0.2.105 62549 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:28.702287 0.147047 tcp 10.0.2.105 62550 -> 195.113.214.236 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:25:31.314722 2.998020 tcp 10.0.2.105 62551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:40.311400 0.000000 tcp 10.0.2.105 62551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:46.310022 3.004828 tcp 10.0.2.105 62552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:25:54.301821 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:25:55.316777 0.000000 tcp 10.0.2.105 62552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:27:51.192457 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 22:27:58.199785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:28:06.201210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:28:22.204481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:28:54.210262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:34:58.216142 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 22:35:05.223800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:35:13.225226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:35:29.228131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:36:01.234119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:37:09.923314 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:37:09.923429 0.065289 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:10.368608 0.199096 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:10.503293 0.175529 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:10.687261 0.255637 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:10.941335 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 22:37:16.353384 3.002784 tcp 10.0.2.105 62553 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:37:25.355073 0.000000 tcp 10.0.2.105 62553 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:37:27.760122 0.052949 tcp 10.0.2.105 62554 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:27.813449 0.053693 tcp 10.0.2.105 62555 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:27.867069 0.146460 tcp 10.0.2.105 62556 -> 195.113.214.236 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:28.014177 0.251228 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:28.229764 0.130119 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:28.399738 0.089551 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:28.472776 0.172386 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:28.642506 0.215116 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:28.849374 0.218244 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:29.034135 0.085628 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:29.152402 0.080860 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:29.218579 0.481014 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:29.673807 0.099573 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:29.856128 0.176516 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.029272 0.067468 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.089073 0.138513 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.322101 0.152178 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.549942 0.264284 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.763708 0.094365 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:30.911718 0.234373 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:31.124528 0.169704 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:31.272663 0.164515 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:31.353994 0.053143 tcp 10.0.2.105 62557 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:31.407372 0.052136 tcp 10.0.2.105 62558 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:31.459802 0.148731 tcp 10.0.2.105 62559 -> 195.113.214.236 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:31.536402 0.288942 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:31.625739 2.993273 tcp 10.0.2.105 62560 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:37:31.820921 0.200389 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:32.212835 0.173726 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/03 22:37:40.627163 0.000000 tcp 10.0.2.105 62560 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:37:46.626340 0.051855 tcp 10.0.2.105 62561 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:46.678540 0.052367 tcp 10.0.2.105 62562 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:46.731338 0.158058 tcp 10.0.2.105 62563 -> 195.113.214.236 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:37:47.366352 2.994981 tcp 10.0.2.105 62564 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:37:56.359936 0.000000 tcp 10.0.2.105 62564 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:38:02.358803 3.004015 tcp 10.0.2.105 62565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:38:10.299955 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:38:11.361165 0.000000 tcp 10.0.2.105 62565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:42:05.240667 3.000856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 22:42:12.247542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:42:20.249077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:42:36.252251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:43:08.258272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:43:17.361739 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:43:17.361854 3.004073 tcp 10.0.2.105 62566 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:43:26.364191 0.000000 tcp 10.0.2.105 62566 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:43:32.364581 0.053297 tcp 10.0.2.105 62567 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:32.418165 0.052690 tcp 10.0.2.105 62568 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:32.471138 0.149329 tcp 10.0.2.105 62569 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:32.687029 2.990932 tcp 10.0.2.105 62570 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:43:41.686299 0.000000 tcp 10.0.2.105 62570 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:43:47.685976 0.051257 tcp 10.0.2.105 62571 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:47.737498 0.053933 tcp 10.0.2.105 62572 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:47.791881 0.157519 tcp 10.0.2.105 62573 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:43:47.977009 2.992640 tcp 10.0.2.105 62574 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:43:56.968086 0.000000 tcp 10.0.2.105 62574 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:44:02.977408 3.003306 tcp 10.0.2.105 62575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:44:11.979455 0.000000 tcp 10.0.2.105 62575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:44:16.806449 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:49:17.980537 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:49:17.980755 3.003412 tcp 10.0.2.105 62576 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:49:26.982858 0.000000 tcp 10.0.2.105 62576 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:49:32.984921 0.053422 tcp 10.0.2.105 62577 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:33.038626 0.052140 tcp 10.0.2.105 62578 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:33.091058 0.156631 tcp 10.0.2.105 62579 -> 195.113.214.236 443 SRPA* 0 0 69 69904 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:33.284754 3.001669 tcp 10.0.2.105 62580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:49:42.284547 0.000000 tcp 10.0.2.105 62580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:49:48.283873 0.051615 tcp 10.0.2.105 62581 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:48.335871 0.053090 tcp 10.0.2.105 62582 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:48.389275 0.147104 tcp 10.0.2.105 62583 -> 195.113.214.236 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:49:48.634022 2.993962 tcp 10.0.2.105 62584 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:49:57.636984 0.000000 tcp 10.0.2.105 62584 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:50:03.635563 2.994193 tcp 10.0.2.105 62585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:50:12.628440 0.000000 tcp 10.0.2.105 62585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:50:17.305098 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:53:31.266189 3.002426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 22:53:38.273840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:53:46.275413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:54:02.278476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:54:34.285396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 22:55:18.641993 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 22:55:18.642223 3.001742 tcp 10.0.2.105 62586 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:55:27.641357 0.000000 tcp 10.0.2.105 62586 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:55:33.645585 0.052976 tcp 10.0.2.105 62587 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:33.698846 0.054230 tcp 10.0.2.105 62588 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:33.753386 0.148091 tcp 10.0.2.105 62589 -> 195.113.214.236 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:34.174437 3.000449 tcp 10.0.2.105 62590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:55:43.173754 0.000000 tcp 10.0.2.105 62590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:55:49.172890 0.052257 tcp 10.0.2.105 62591 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:49.225466 0.052955 tcp 10.0.2.105 62592 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:49.278772 0.147423 tcp 10.0.2.105 62593 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/03 22:55:49.530747 3.002259 tcp 10.0.2.105 62594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:55:58.525773 0.000000 tcp 10.0.2.105 62594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:56:04.524831 2.993969 tcp 10.0.2.105 62595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:56:13.527335 0.000000 tcp 10.0.2.105 62595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 22:56:18.304197 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:00:38.291199 3.001044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:00:45.297984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:00:53.299582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:01:09.302785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:01:41.308531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:07:45.314585 3.001814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 23:07:52.321995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:07:56.378542 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:07:56.378691 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 23:08:00.323511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:08:14.315098 0.057489 tcp 10.0.2.105 62596 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:14.372863 0.054282 tcp 10.0.2.105 62597 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:14.427447 0.152175 tcp 10.0.2.105 62598 -> 195.113.214.236 443 SRPA* 0 0 38 21714 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:14.580356 0.054230 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:14.695835 0.180427 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:14.868512 0.180287 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.069839 0.244796 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.333625 0.286378 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.585712 0.110236 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.657537 0.094137 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.731920 0.172863 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:15.901865 0.217744 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:16.110110 0.215488 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:16.289845 0.086027 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:16.326681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:08:16.360792 0.081064 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:16.426791 0.605291 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.005756 0.150778 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.221040 0.176100 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.393772 0.057442 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.514379 0.258012 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.727226 0.094323 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:17.802755 0.233598 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:18.015570 0.131552 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:18.156764 0.141232 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:18.376967 0.168661 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:18.523213 0.159752 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:18.744926 0.277898 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:19.020224 0.200458 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:19.212675 0.174762 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:08:19.571734 3.003608 tcp 10.0.2.105 62599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:08:28.574055 0.000000 tcp 10.0.2.105 62599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:08:34.573856 0.054269 tcp 10.0.2.105 62600 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:34.628429 0.053849 tcp 10.0.2.105 62601 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:34.682555 0.159267 tcp 10.0.2.105 62602 -> 195.113.214.236 443 SRPA* 0 0 78 70390 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:34.923875 2.993609 tcp 10.0.2.105 62603 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:08:43.926128 0.000000 tcp 10.0.2.105 62603 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:08:48.332412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:08:49.925627 0.054309 tcp 10.0.2.105 62604 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:49.979778 0.051752 tcp 10.0.2.105 62605 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:50.031820 0.161392 tcp 10.0.2.105 62606 -> 195.113.214.236 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:08:50.208176 3.001328 tcp 10.0.2.105 62607 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:08:59.207728 0.000000 tcp 10.0.2.105 62607 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:09:05.206778 2.994116 tcp 10.0.2.105 62608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:09:14.199359 0.000000 tcp 10.0.2.105 62608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:09:18.806200 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:14:20.210300 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:14:20.210407 3.003428 tcp 10.0.2.105 62609 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:14:29.212871 0.000000 tcp 10.0.2.105 62609 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:14:35.212789 0.057282 tcp 10.0.2.105 62610 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:35.270366 0.053733 tcp 10.0.2.105 62611 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:35.324461 0.145440 tcp 10.0.2.105 62612 -> 195.113.214.236 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:35.488075 3.007752 tcp 10.0.2.105 62613 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:14:44.494811 0.000000 tcp 10.0.2.105 62613 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:14:50.483910 0.056607 tcp 10.0.2.105 62614 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:50.540370 0.052186 tcp 10.0.2.105 62615 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:50.592907 0.145295 tcp 10.0.2.105 62616 -> 195.113.214.236 443 SRPA* 0 0 45 33376 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:14:50.754822 2.992854 tcp 10.0.2.105 62617 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:14:52.338802 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:14:59.345950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:14:59.756426 0.000000 tcp 10.0.2.105 62617 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:15:05.755297 2.994118 tcp 10.0.2.105 62618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:15:07.347581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:15:14.747963 0.000000 tcp 10.0.2.105 62618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:15:19.304634 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:15:23.350180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:15:55.356791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:20:20.758915 0.029857 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:20:20.789504 2.981449 tcp 10.0.2.105 62619 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:20:29.760992 0.000000 tcp 10.0.2.105 62619 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:20:35.774578 0.053312 tcp 10.0.2.105 62620 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:35.828189 0.054930 tcp 10.0.2.105 62621 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:35.883458 0.157940 tcp 10.0.2.105 62622 -> 195.113.214.236 443 SRPA* 0 0 45 40108 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:36.059604 2.994663 tcp 10.0.2.105 62623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:20:45.058454 0.000000 tcp 10.0.2.105 62623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:20:51.052106 0.051971 tcp 10.0.2.105 62624 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:51.104381 0.053288 tcp 10.0.2.105 62625 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:51.157971 0.144993 tcp 10.0.2.105 62626 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:20:51.325460 3.000787 tcp 10.0.2.105 62627 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:21:00.324903 0.000000 tcp 10.0.2.105 62627 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:21:06.323533 2.999627 tcp 10.0.2.105 62628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:21:15.326541 0.000000 tcp 10.0.2.105 62628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:21:20.303548 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:21:59.362163 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:22:06.369713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:22:14.371631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:22:30.374855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:23:02.382449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:26:21.327310 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:26:21.327464 2.993064 tcp 10.0.2.105 62629 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:26:30.319449 0.000000 tcp 10.0.2.105 62629 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:26:36.329677 0.057642 tcp 10.0.2.105 62630 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:36.387621 0.107119 tcp 10.0.2.105 62631 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:36.494997 0.153930 tcp 10.0.2.105 62632 -> 195.113.214.236 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:36.723622 2.999311 tcp 10.0.2.105 62633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:26:45.721405 0.000000 tcp 10.0.2.105 62633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:26:51.721095 0.052443 tcp 10.0.2.105 62634 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:51.773833 0.053630 tcp 10.0.2.105 62635 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:51.827818 0.160803 tcp 10.0.2.105 62636 -> 195.113.214.236 443 SRPA* 0 0 46 40082 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:26:52.011922 3.003050 tcp 10.0.2.105 62637 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:27:01.013328 0.000000 tcp 10.0.2.105 62637 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:27:07.012595 3.003301 tcp 10.0.2.105 62638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:27:16.015106 0.000000 tcp 10.0.2.105 62638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:27:20.801895 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:29:06.395281 2.992870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:29:13.397048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:29:21.395721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:29:37.398430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:30:09.404829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:36:13.410124 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/03 23:36:20.418165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:36:28.419350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:36:44.422328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:37:16.428549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:38:38.747633 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:38:38.747841 0.431133 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:39.131006 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/03 23:38:52.055863 2.994233 tcp 10.0.2.105 62639 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:38:55.281667 0.057462 tcp 10.0.2.105 62640 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:38:55.339457 0.054261 tcp 10.0.2.105 62641 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:38:55.394022 0.152429 tcp 10.0.2.105 62642 -> 195.113.214.236 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:38:55.547245 0.059837 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2614 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:55.593879 0.180719 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:55.762878 0.260252 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:55.986792 0.231034 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.182274 0.094287 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.258556 0.172901 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.428569 0.211720 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.633113 0.215619 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.812756 0.092273 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.889645 0.080818 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:56.975243 0.373729 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:57.316971 0.093202 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:57.552650 0.176785 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:57.726405 0.061123 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:57.860451 0.252008 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.064762 0.093781 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.141658 0.147025 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.320901 0.168239 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.466694 0.164297 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.632223 0.213373 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:58.842815 0.232750 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:59.055306 0.145886 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:59.204336 0.208363 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:38:59.402462 0.173421 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/03 23:39:01.051042 0.000000 tcp 10.0.2.105 62639 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:39:07.057657 0.114640 tcp 10.0.2.105 62643 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:39:07.172662 0.054857 tcp 10.0.2.105 62644 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:39:07.227830 0.158274 tcp 10.0.2.105 62645 -> 195.113.214.236 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:39:07.397477 3.005055 tcp 10.0.2.105 62646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:39:16.400920 0.000000 tcp 10.0.2.105 62646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:43:20.435144 3.000893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:43:27.441853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:43:35.443260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:43:51.446341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:44:22.402095 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:44:22.402262 3.002781 tcp 10.0.2.105 62647 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:44:23.452628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:44:31.405741 0.000000 tcp 10.0.2.105 62647 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:44:37.405217 0.071129 tcp 10.0.2.105 62648 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:37.476640 0.054559 tcp 10.0.2.105 62649 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:37.531466 0.152005 tcp 10.0.2.105 62650 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:37.715747 2.996757 tcp 10.0.2.105 62651 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:44:46.715739 0.000000 tcp 10.0.2.105 62651 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:44:52.705388 0.052558 tcp 10.0.2.105 62652 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:52.758310 0.053778 tcp 10.0.2.105 62653 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:52.812425 0.158461 tcp 10.0.2.105 62654 -> 195.113.214.236 443 SRPA* 0 0 69 69904 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:44:53.064365 2.994411 tcp 10.0.2.105 62655 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:45:02.057428 0.000000 tcp 10.0.2.105 62655 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:45:08.056480 2.994036 tcp 10.0.2.105 62656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:45:17.049189 0.000000 tcp 10.0.2.105 62656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:45:21.805999 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:50:23.059261 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:50:23.059460 3.003983 tcp 10.0.2.105 62657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:50:32.062150 0.000000 tcp 10.0.2.105 62657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:50:38.062277 0.053439 tcp 10.0.2.105 62658 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:38.116038 0.052975 tcp 10.0.2.105 62659 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:38.169323 0.230326 tcp 10.0.2.105 62660 -> 195.113.214.236 443 SRPA* 0 0 70 66624 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:38.479708 3.006158 tcp 10.0.2.105 62661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:50:47.484068 0.000000 tcp 10.0.2.105 62661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:50:53.474307 0.053241 tcp 10.0.2.105 62662 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:53.527928 0.057484 tcp 10.0.2.105 62663 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:53.585750 0.167781 tcp 10.0.2.105 62664 -> 195.113.214.236 443 SRPA* 0 0 45 24934 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:50:53.789013 2.998723 tcp 10.0.2.105 62665 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:51:02.796639 0.000000 tcp 10.0.2.105 62665 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:51:08.785463 2.993711 tcp 10.0.2.105 62666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:51:17.777921 0.000000 tcp 10.0.2.105 62666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:51:22.304604 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:54:09.467395 3.001968 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/03 23:54:16.474765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:54:24.476624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:54:40.479583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:55:12.485486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/03 23:56:23.788557 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/03 23:56:23.788780 3.003447 tcp 10.0.2.105 62667 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:56:32.791147 0.000000 tcp 10.0.2.105 62667 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:56:38.791552 0.053177 tcp 10.0.2.105 62668 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:38.844998 0.054315 tcp 10.0.2.105 62669 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:38.899675 0.150658 tcp 10.0.2.105 62670 -> 195.113.214.236 443 SRPA* 0 0 42 34064 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:39.063802 3.000645 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:56:48.062872 0.000000 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:56:54.062158 0.052012 tcp 10.0.2.105 62672 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:54.114402 0.054266 tcp 10.0.2.105 62673 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:54.168934 0.156440 tcp 10.0.2.105 62674 -> 195.113.214.236 443 SRPA* 0 0 54 34066 flow=From-Botnet-V2-TCP-Established 1970/02/03 23:56:54.458141 3.008165 tcp 10.0.2.105 62675 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:57:03.464933 0.000000 tcp 10.0.2.105 62675 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:57:09.453730 2.994107 tcp 10.0.2.105 62676 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:57:18.456758 0.000000 tcp 10.0.2.105 62676 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/03 23:57:23.303481 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:01:16.491944 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 00:01:23.499107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:01:31.505585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:01:47.503511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:02:19.509935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:02:24.456860 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:02:24.457043 3.003870 tcp 10.0.2.105 62677 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:02:33.460804 0.000000 tcp 10.0.2.105 62677 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:02:39.459740 0.053502 tcp 10.0.2.105 62678 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:02:39.513544 0.053908 tcp 10.0.2.105 62679 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:02:39.567766 0.150428 tcp 10.0.2.105 62680 -> 195.113.214.236 443 SRPA* 0 0 43 37080 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:02:39.729177 3.003804 tcp 10.0.2.105 62681 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:02:48.731304 0.000000 tcp 10.0.2.105 62681 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:08:23.515277 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 00:08:30.522926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:08:38.524448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:08:54.527486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:09:04.572006 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:09:04.572154 0.246471 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:04.816945 0.185850 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:04.939530 0.314485 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.218591 0.054451 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.308538 0.174714 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.475613 0.104574 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.544200 0.089994 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.615688 0.173709 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:05.786425 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 00:09:09.739606 3.003985 tcp 10.0.2.105 62682 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:18.742324 0.000000 tcp 10.0.2.105 62682 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:21.158034 0.053372 tcp 10.0.2.105 62683 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:21.211830 0.054300 tcp 10.0.2.105 62684 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:21.266534 0.162149 tcp 10.0.2.105 62685 -> 195.113.214.236 443 SRPA* 0 0 41 22272 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:21.429343 0.217409 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:21.608703 0.091394 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:21.683118 0.077784 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:21.745341 0.355584 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.072529 0.101547 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.186405 0.175504 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.358391 0.061652 udp 10.0.2.105 7010 <-> 217.34.34.57 3040 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.412552 0.250859 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.619118 0.098216 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.698129 0.160893 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:22.860153 0.244550 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.101112 0.235997 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.315660 0.152577 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.463725 0.165936 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.606371 0.174697 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.792932 0.145561 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:23.939894 0.202127 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:09:24.741060 0.052209 tcp 10.0.2.105 62686 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:24.793597 0.055973 tcp 10.0.2.105 62687 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:24.849870 0.154504 tcp 10.0.2.105 62688 -> 195.113.214.236 443 SRPA* 0 0 24 10458 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:25.021722 3.004386 tcp 10.0.2.105 62689 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:26.533582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:09:34.024085 0.000000 tcp 10.0.2.105 62689 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:40.023583 0.057365 tcp 10.0.2.105 62690 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:40.081228 0.054401 tcp 10.0.2.105 62691 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:40.135932 0.151831 tcp 10.0.2.105 62692 -> 195.113.214.236 443 SRPA* 0 0 41 33996 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:09:40.300179 2.997407 tcp 10.0.2.105 62693 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:49.305904 0.000000 tcp 10.0.2.105 62693 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:09:55.295047 2.993920 tcp 10.0.2.105 62694 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:10:04.287515 0.000000 tcp 10.0.2.105 62694 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:10:08.804099 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:15:10.298142 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:15:10.298356 3.003694 tcp 10.0.2.105 62695 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:19.300149 0.000000 tcp 10.0.2.105 62695 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:25.301572 0.054898 tcp 10.0.2.105 62696 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:25.356804 0.053981 tcp 10.0.2.105 62697 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:25.411089 0.167990 tcp 10.0.2.105 62698 -> 195.113.214.236 443 SRPA* 0 0 42 37614 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:25.595198 2.998519 tcp 10.0.2.105 62699 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:30.540015 3.001256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 00:15:34.592705 0.000000 tcp 10.0.2.105 62699 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:37.546858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:15:40.591745 0.052920 tcp 10.0.2.105 62700 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:40.644915 0.058131 tcp 10.0.2.105 62701 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:40.703389 0.164190 tcp 10.0.2.105 62702 -> 195.113.214.236 443 SRPA* 0 0 77 55998 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:15:40.878307 3.007689 tcp 10.0.2.105 62703 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:45.548381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:15:49.884559 0.000000 tcp 10.0.2.105 62703 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:15:55.873535 3.004057 tcp 10.0.2.105 62704 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:16:01.551364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:16:04.886102 0.000000 tcp 10.0.2.105 62704 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:16:09.803137 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:16:33.557422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:21:10.876642 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:21:10.876869 2.993182 tcp 10.0.2.105 62705 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:19.868845 0.000000 tcp 10.0.2.105 62705 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:25.879630 0.053575 tcp 10.0.2.105 62706 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:25.933511 0.055509 tcp 10.0.2.105 62707 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:25.989334 0.167224 tcp 10.0.2.105 62708 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:26.194913 2.997365 tcp 10.0.2.105 62709 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:35.191015 0.000000 tcp 10.0.2.105 62709 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:41.190116 0.052473 tcp 10.0.2.105 62710 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:41.242942 0.109511 tcp 10.0.2.105 62711 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:41.352812 0.153305 tcp 10.0.2.105 62712 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:21:41.549471 3.004931 tcp 10.0.2.105 62713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:50.553129 0.000000 tcp 10.0.2.105 62713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:21:56.541890 3.004288 tcp 10.0.2.105 62714 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:22:05.544689 0.000000 tcp 10.0.2.105 62714 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:22:10.301436 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:22:37.563515 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 00:22:44.570778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:22:52.572238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:23:08.575337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:23:40.588060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:27:11.545330 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:27:11.545445 2.993423 tcp 10.0.2.105 62715 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:27:20.547629 0.000000 tcp 10.0.2.105 62715 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 00:27:26.547633 0.052871 tcp 10.0.2.105 62716 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:27:26.600778 0.052312 tcp 10.0.2.105 62717 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:27:26.653346 0.159390 tcp 10.0.2.105 62718 -> 195.113.214.236 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:27:26.833168 0.612338 tcp 10.0.2.105 62719 -> 31.192.24.67 3527 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:29:44.587897 3.001284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 00:29:51.594720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:29:59.596102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:30:15.602494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:30:47.605385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:36:51.611294 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 00:36:58.618744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:37:06.620101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:37:22.623121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:37:54.629494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:39:29.205576 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:39:29.205734 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 00:39:46.411574 0.054207 tcp 10.0.2.105 62720 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:39:46.466105 0.053563 tcp 10.0.2.105 62721 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:39:46.519940 0.147245 tcp 10.0.2.105 62722 -> 195.113.214.236 443 SRPA* 0 0 25 14108 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:39:46.667756 0.250828 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:46.917307 0.163206 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:47.026613 0.254901 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:47.246841 0.826651 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.035994 0.096319 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.110828 0.172200 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.280537 0.176977 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.449202 0.055010 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.513071 0.076418 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.574854 0.439593 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:48.980803 0.211542 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:49.156007 0.094323 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:49.233152 0.105691 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:49.339107 0.175939 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:39:49.511413 0.000000 udp 10.0.2.105 7010 -> 217.34.34.57 3040 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 00:40:08.412508 0.053550 tcp 10.0.2.105 62723 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:40:08.465980 0.054253 tcp 10.0.2.105 62724 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:40:08.520645 0.162649 tcp 10.0.2.105 62725 -> 195.113.214.236 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/04 00:40:08.683882 0.257958 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:08.893381 0.093339 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:08.971212 0.160498 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:09.148593 0.228910 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:09.373235 0.170100 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:09.519971 0.176492 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:09.696719 0.124925 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:09.822942 0.199755 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:10.016647 0.235974 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:40:10.232190 0.144146 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/04 00:43:58.635501 3.029232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 00:44:05.652937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:44:13.654267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:44:29.657453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:45:01.662983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:54:29.674344 3.006686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 00:54:36.682709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:54:44.681556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:55:00.684569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:55:32.690602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 00:57:27.445876 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 00:57:27.446037 0.701710 tcp 10.0.2.105 62726 -> 31.192.24.67 3527 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:01:36.706154 3.002504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 01:01:43.713888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:01:51.715899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:02:07.718732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:02:39.724501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:08:43.730326 3.002142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 01:08:50.737799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:08:58.739370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:09:14.742714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:09:46.748385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:10:23.642058 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:10:23.642211 0.000000 udp 10.0.2.105 7010 -> 217.34.34.57 3040 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:10:39.516407 0.055637 tcp 10.0.2.105 62727 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:10:39.572439 0.052588 tcp 10.0.2.105 62728 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:10:39.625335 0.153396 tcp 10.0.2.105 62729 -> 195.113.214.236 443 SRPA* 0 0 34 17906 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:10:39.779303 4.774301 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 7 2572 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:40.021885 4.591896 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 14 5460 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:40.147874 0.259443 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:40.370050 4.667972 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 7 2392 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:40.985008 4.856600 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 14 5284 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:41.063427 0.175817 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:41.231918 0.172807 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:41.401815 0.078781 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:41.466047 0.471780 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:41.942895 0.212545 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.120069 0.051963 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.170065 0.175500 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.342157 0.103090 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.480297 0.095323 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.554740 0.155907 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.720399 0.260337 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:42.932129 0.095775 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.012425 0.249243 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.258511 0.168868 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.402841 0.176616 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.586734 0.138470 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.737364 0.198654 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:43.929934 0.235200 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:44.144665 0.149414 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:44.795590 0.245924 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 7 2957 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:45.393615 0.357777 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 7 2713 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:45.824166 0.485708 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 2965 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:46.273460 0.338881 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:46.602765 0.327500 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3059 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:46.927443 0.128261 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 8 2695 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:47.042980 0.807657 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 8 3171 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:47.822386 0.393324 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 8 3234 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:48.177089 0.109738 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:48.283441 0.341471 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 8 3184 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:48.622043 0.187283 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 8 2880 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:48.794795 0.139205 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 8 3158 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:48.918252 0.310600 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 8 3425 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:49.230341 0.464848 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 8 2785 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:49.649957 0.155877 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 8 3041 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:49.790027 0.315101 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 3115 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:50.082590 0.319375 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 8 3262 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:50.377729 0.277663 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 8 3227 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:50.656988 0.428900 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 8 3046 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:51.084642 0.542844 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 8 2982 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:51.607233 0.389430 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 8 3293 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:51.993073 0.295830 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 8 3206 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:10:52.290647 0.000000 udp 10.0.2.105 7010 -> 49.248.198.207 5060 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:10:58.542029 0.000000 udp 10.0.2.105 7010 -> 87.23.194.227 8571 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:03.308728 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:11:04.109871 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:09.257345 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:17.318787 0.000000 udp 10.0.2.105 7010 -> 87.22.58.162 3856 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:25.369910 0.000000 udp 10.0.2.105 7010 -> 115.248.17.98 1564 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:30.317408 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:11:31.399197 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:39.340554 0.000000 udp 10.0.2.105 7010 -> 86.173.47.132 6363 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:46.400209 0.000000 udp 10.0.2.105 7010 -> 90.244.146.95 7625 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:54.992973 0.000000 udp 10.0.2.105 7010 -> 217.125.155.231 5451 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:11:59.810437 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:12:00.571015 0.000000 udp 10.0.2.105 7010 -> 85.107.145.227 2982 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:09.223719 0.000000 udp 10.0.2.105 7010 -> 92.139.106.159 7556 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:16.714170 0.000000 udp 10.0.2.105 7010 -> 182.68.226.123 4781 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:23.173509 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:27.809993 0.006644 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:12:29.222135 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:34.279048 0.000000 udp 10.0.2.105 7010 -> 82.29.99.200 9573 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:42.381767 0.000000 udp 10.0.2.105 7010 -> 5.70.178.83 9470 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:47.508947 0.000000 udp 10.0.2.105 7010 -> 46.12.142.45 1978 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:52.316969 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:12:52.937046 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:12:58.614818 0.000000 udp 10.0.2.105 7010 -> 24.231.44.30 4317 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:05.374110 0.000000 udp 10.0.2.105 7010 -> 88.231.46.167 2157 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:13.305628 0.000000 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:17.811843 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:13:22.158488 0.000000 udp 10.0.2.105 7010 -> 67.101.181.10 6351 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:28.867865 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:36.598977 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:42.377571 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:47.314494 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:13:47.404607 0.279317 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 8 3018 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:13:47.703568 0.000000 udp 10.0.2.105 7010 -> 151.76.119.22 2973 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:13:55.846869 0.000000 udp 10.0.2.105 7010 -> 93.193.138.107 7662 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:04.121446 0.000000 udp 10.0.2.105 7010 -> 197.174.251.197 7500 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:12.820709 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:17.808226 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:14:21.513710 0.000000 udp 10.0.2.105 7010 -> 92.1.186.104 5270 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:27.331861 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:33.951531 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:41.482381 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:46.308945 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:14:48.963288 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:14:56.684879 0.000000 udp 10.0.2.105 7010 -> 93.46.222.173 3954 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:04.505689 0.000000 udp 10.0.2.105 7010 -> 86.5.175.14 1691 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:11.926208 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:16.812881 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:15:17.474458 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:26.407026 0.000000 udp 10.0.2.105 7010 -> 90.203.66.181 6271 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:33.757686 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:39.285633 0.000000 udp 10.0.2.105 7010 -> 184.243.167.4 9444 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:43.811723 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:15:47.316629 0.000000 udp 10.0.2.105 7010 -> 77.77.41.98 8117 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:50.754788 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 01:15:55.568693 0.000000 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:15:57.762078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:16:03.440219 0.000000 udp 10.0.2.105 7010 -> 59.33.248.74 7361 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:05.763401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:16:08.317302 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:16:10.480178 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:15.958314 0.000000 udp 10.0.2.105 7010 -> 172.13.6.157 3233 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:21.766657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:16:22.147028 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:29.457574 0.000000 udp 10.0.2.105 7010 -> 79.129.44.166 5092 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:34.314815 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:16:35.055840 0.000000 udp 10.0.2.105 7010 -> 120.139.105.33 3037 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:42.246182 0.000000 udp 10.0.2.105 7010 -> 94.93.90.202 4740 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:50.898598 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:16:53.772856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:16:56.546917 0.000000 udp 10.0.2.105 7010 -> 90.34.203.81 5368 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:01.313136 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:17:02.715925 0.000000 udp 10.0.2.105 7010 -> 84.85.147.75 4782 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:09.005191 0.000000 udp 10.0.2.105 7010 -> 77.103.237.46 4337 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:14.312121 0.000000 udp 10.0.2.105 7010 -> 151.77.2.88 4708 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:21.863020 0.000000 udp 10.0.2.105 7010 -> 121.138.146.213 4304 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:26.811100 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:17:30.285284 0.280697 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 8 3040 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:17:30.619410 0.000000 udp 10.0.2.105 7010 -> 94.68.230.176 3325 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:38.026015 0.000000 udp 10.0.2.105 7010 -> 197.87.231.99 7503 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:46.328643 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1056 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:17:51.315265 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:17:53.288614 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:01.830305 0.422787 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 2905 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:18:02.293344 0.000000 udp 10.0.2.105 7010 -> 81.137.249.215 7633 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:10.605857 0.000000 udp 10.0.2.105 7010 -> 209.44.18.43 6239 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:15.309125 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:18:16.080835 0.000000 udp 10.0.2.105 7010 -> 41.233.98.213 8752 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:23.922235 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:32.564846 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:38.543523 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:43.309287 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:18:45.433364 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:51.241427 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:18:56.769569 0.000000 udp 10.0.2.105 7010 -> 203.113.114.137 5727 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:05.732493 0.000000 udp 10.0.2.105 7010 -> 106.243.13.2 2975 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:10.308567 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:19:13.193489 0.000000 udp 10.0.2.105 7010 -> 77.29.144.89 5649 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:19.852697 0.000000 udp 10.0.2.105 7010 -> 24.39.137.138 2912 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:27.744065 0.000000 udp 10.0.2.105 7010 -> 24.211.218.253 7370 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:34.473487 0.126344 udp 10.0.2.105 7010 -> 71.163.179.66 5331 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:34.599831 0.000000 icmp 71.163.179.66 0x0303 -> 10.0.2.105 0xd314 URP 192 1 276 flow=Background 1970/02/04 01:19:39.310477 0.030430 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:19:42.184993 0.745665 udp 10.0.2.105 7010 <-> 1.20.137.192 8015 CON 0 0 8 2916 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:19:42.970921 0.000000 udp 10.0.2.105 7010 -> 115.242.28.43 1024 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:51.898656 0.000000 udp 10.0.2.105 7010 -> 79.38.25.78 2191 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:19:58.167399 0.000000 udp 10.0.2.105 7010 -> 88.244.167.59 6778 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:05.398361 0.000000 udp 10.0.2.105 7010 -> 95.104.112.138 8252 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:10.315070 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:20:11.326862 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 9668 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:19.241294 0.000000 udp 10.0.2.105 7010 -> 174.19.74.106 4177 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:26.908549 0.000000 udp 10.0.2.105 7010 -> 2.223.0.212 9233 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:35.691935 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:40.308163 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:20:40.778813 0.142585 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 8 3020 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:20:40.934320 0.384257 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 8 3099 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:20:41.356886 0.000000 udp 10.0.2.105 7010 -> 184.74.168.82 5338 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:49.661958 0.000000 udp 10.0.2.105 7010 -> 162.237.52.245 3340 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:20:56.721897 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:03.100965 0.000000 udp 10.0.2.105 7010 -> 116.14.91.176 3400 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:07.817539 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:21:09.259773 0.000000 udp 10.0.2.105 7010 -> 94.120.136.130 3260 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:17.321537 0.000000 udp 10.0.2.105 7010 -> 109.154.157.29 1971 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:25.723627 0.000000 udp 10.0.2.105 7010 -> 95.245.188.214 1024 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:32.363300 0.000000 udp 10.0.2.105 7010 -> 87.16.32.237 3768 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:37.309639 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:21:40.644882 0.000000 udp 10.0.2.105 7010 -> 80.176.166.97 6550 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:45.813051 0.000000 udp 10.0.2.105 7010 -> 166.127.176.80 6824 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:51.140038 0.442815 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3252 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:21:51.652484 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:21:56.787876 0.000000 udp 10.0.2.105 7010 -> 109.90.136.134 8739 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:01.314360 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:22:04.499370 0.000000 udp 10.0.2.105 7010 -> 82.89.175.71 6750 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:09.806812 0.205017 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 8 3075 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:22:10.025447 0.000000 udp 10.0.2.105 7010 -> 79.48.5.215 6835 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:15.424987 0.000000 udp 10.0.2.105 7010 -> 41.37.217.82 1633 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:21.894366 0.276527 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 8 3030 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:22:22.189924 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:26.811173 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:22:30.436923 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:38.378018 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5362 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:46.621084 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:51.316699 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:22:53.371725 0.000000 udp 10.0.2.105 7010 -> 111.242.43.63 1084 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:22:57.777925 3.004858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 01:22:59.821031 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:04.788385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:23:06.798862 0.000000 udp 10.0.2.105 7010 -> 75.187.240.100 3726 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:12.792229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:23:13.972611 0.047234 udp 10.0.2.105 7010 -> 87.195.147.110 2851 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:14.019845 0.000000 icmp 87.195.147.110 0x0303 -> 10.0.2.105 0x230b URP 192 1 223 flow=Background 1970/02/04 01:23:18.821021 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:23:21.773299 0.000000 udp 10.0.2.105 7010 -> 213.33.89.98 6737 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:28.790122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:23:30.083713 0.000000 udp 10.0.2.105 7010 -> 79.25.98.154 9555 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:37.963710 0.000000 udp 10.0.2.105 7010 -> 93.46.70.92 7716 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:42.810295 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:23:44.653305 0.155434 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 8 3086 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:23:44.856163 0.000000 udp 10.0.2.105 7010 -> 92.247.177.186 5056 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:50.926833 0.123776 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 8 3020 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:23:51.341993 0.000000 udp 10.0.2.105 7010 -> 31.198.22.98 6787 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:23:59.404691 0.000000 udp 10.0.2.105 7010 -> 99.113.208.131 6755 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:24:00.796506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:24:07.576612 0.085831 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 8 3113 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:24:07.928157 0.000000 udp 10.0.2.105 7010 -> 95.243.90.229 3701 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:24:12.313179 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:24:15.908304 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:27:28.165080 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:27:28.165311 0.544237 tcp 10.0.2.105 62730 -> 31.192.24.67 3527 FSPA* 0 0 12 1421 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:30:04.802189 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 01:30:11.809608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:30:19.811374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:30:35.814154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:31:07.820422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:37:11.826167 3.001840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 01:37:18.833668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:37:26.845218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:37:42.848185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:38:14.854458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:44:18.862057 3.027777 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 01:44:25.880126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:44:33.884996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:44:49.882257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:45:21.888612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:54:26.922476 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:54:26.922615 0.273393 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:27.165912 0.181978 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:27.290540 0.096592 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:27.368923 0.782250 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.109706 0.171752 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.278161 0.076506 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.338352 0.262488 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.563306 0.176009 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.732411 0.237487 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:28.932917 0.468721 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:29.371661 0.098066 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:29.517252 0.096423 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:29.594535 0.056361 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:29.666171 0.175749 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:29.838728 0.255643 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.046108 0.097715 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.125915 0.170228 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.272163 0.164774 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.447009 0.204700 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.642527 0.172880 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.819440 0.138711 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:30.976891 0.276550 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2540 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:31.250046 0.235299 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:31.462745 0.146688 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:31.628271 0.148888 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:31.766739 0.099577 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2641 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:31.844708 0.214374 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:32.049541 0.485637 udp 10.0.2.105 7010 <-> 1.20.137.192 8015 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:32.501003 0.085481 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:32.566026 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 01:54:39.902233 3.002823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 01:54:46.910905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:54:49.766564 0.053631 tcp 10.0.2.105 62731 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:54:49.820452 0.055340 tcp 10.0.2.105 62732 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:54:49.876118 0.148459 tcp 10.0.2.105 62733 -> 195.113.214.236 443 SRPA* 0 0 41 24094 flow=From-Botnet-V2-TCP-Established 1970/02/04 01:54:50.025175 0.228523 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:50.246616 0.125700 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:50.315231 0.138522 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:50.468962 0.084722 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:50.533797 0.061386 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:50.617810 0.046635 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/04 01:54:54.912473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:55:10.915049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:55:42.921289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 01:57:28.713520 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 01:57:28.713664 0.509785 tcp 10.0.2.105 62734 -> 31.192.24.67 3527 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:01:46.927336 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:01:53.934766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:02:01.936212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:02:17.939121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:02:49.944604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:08:53.950647 3.002180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:09:00.958662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:09:08.959471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:09:24.963275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:09:56.969473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:16:00.974569 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:16:07.983300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:16:15.984551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:16:31.987462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:17:03.993055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:23:07.998502 3.002938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:23:15.011863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:23:23.007417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:23:39.010971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:24:11.016829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:25:09.351456 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 02:25:09.351682 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 02:25:27.629129 0.058962 tcp 10.0.2.105 62735 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:27.688520 0.063078 tcp 10.0.2.105 62736 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:27.751918 0.145557 tcp 10.0.2.105 62737 -> 195.113.214.236 443 SRPA* 0 0 40 21276 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:27.898108 0.095513 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:27.972212 0.252845 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:28.223629 0.185088 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:28.358736 0.171841 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:28.526610 0.651770 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:29.137071 0.175903 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:29.305815 0.212649 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:29.482289 0.249482 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:29.697504 0.077524 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:29.826112 0.376333 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:30.174404 0.057060 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:30.298908 0.091073 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:30.388715 0.097714 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:30.944174 0.168680 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:31.087069 0.176864 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:31.261299 0.256708 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:31.469188 0.099419 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:31.550803 0.173373 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:32.226370 0.145512 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:32.405394 0.193252 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:32.592528 0.158786 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:32.802471 0.149530 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.041844 0.266821 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.305487 0.235354 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.519409 0.144643 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.656304 0.104218 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.782876 0.215329 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:33.990634 0.080492 udp 10.0.2.105 7010 <-> 79.77.219.124 2432 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:34.668966 0.000000 udp 10.0.2.105 7010 -> 1.20.137.192 8015 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 02:25:52.223362 0.051522 tcp 10.0.2.105 62738 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:52.275131 0.103936 tcp 10.0.2.105 62739 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:52.378934 0.162583 tcp 10.0.2.105 62740 -> 195.113.214.236 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:25:52.541067 0.126110 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:52.606714 0.225177 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:52.824645 0.063769 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2573 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:52.885882 0.046627 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:52.930364 0.147359 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:25:53.149116 0.088189 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:27:29.222264 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 02:27:29.222420 0.559949 tcp 10.0.2.105 62741 -> 31.192.24.67 3527 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:30:15.023047 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 02:30:22.030304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:30:30.034706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:30:46.035332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:31:18.041195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:37:22.046674 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:37:29.054821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:37:37.055862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:37:53.059228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:38:25.069147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:44:29.072209 3.062080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:44:36.106407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:44:44.089634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:45:00.094982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:45:32.098996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:54:46.108579 3.001047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 02:54:53.115871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:55:01.117306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:55:17.120125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:55:49.126264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 02:56:05.419900 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 02:56:05.420018 0.338278 udp 10.0.2.105 7010 -> 1.20.137.192 8015 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 02:56:05.758296 0.000000 icmp 1.20.137.192 0x0303 -> 10.0.2.105 0x4f1f URP 192 1 172 flow=Background 1970/02/04 02:56:22.606000 0.111551 tcp 10.0.2.105 62742 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:22.717773 0.053257 tcp 10.0.2.105 62743 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:22.771320 0.498947 tcp 10.0.2.105 62744 -> 195.113.214.236 443 SRPA* 0 0 20 9848 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:23.270738 0.095233 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:23.346469 0.173924 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:23.531718 0.609801 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:24.100841 0.256329 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:24.449519 0.186235 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:24.574719 0.174796 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:24.741743 0.079428 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:24.986827 0.559980 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:25.518567 0.270030 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:25.752317 0.225873 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2697 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:25.938904 0.099085 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.257168 0.168933 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.402914 0.089248 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.519017 0.060514 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2591 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.645672 0.252015 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.851370 0.096336 udp 10.0.2.105 7010 <-> 86.130.77.213 6503 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:26.986259 0.175851 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:27.158715 0.163022 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:27.373261 0.150320 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:27.819599 0.138467 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.057515 0.174313 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.273724 0.201099 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.468696 0.143692 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.606051 0.107702 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.692406 0.211337 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:28.896520 0.198280 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:29.128131 0.234509 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:29.342058 0.000000 udp 10.0.2.105 7010 -> 79.77.219.124 2432 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 02:56:47.991025 0.052106 tcp 10.0.2.105 62745 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:48.043463 0.053423 tcp 10.0.2.105 62746 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:48.097213 0.158610 tcp 10.0.2.105 62747 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/04 02:56:48.256483 0.221319 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:48.471282 0.061573 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:48.617488 0.046431 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:48.735264 0.149332 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:48.896610 0.119069 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:56:48.958453 0.085372 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/04 02:57:29.781187 0.609125 tcp 10.0.2.105 62748 -> 31.192.24.67 3527 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:01:53.132263 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 03:02:00.139185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:02:08.141164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:02:24.144166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:02:56.150142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:09:00.156085 3.001381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:09:07.163504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:09:15.165213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:09:31.168008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:10:03.174016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:16:07.180048 3.001909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:16:14.187504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:16:22.188959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:16:38.191966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:17:10.197775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:23:14.208049 2.997641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:23:21.218651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:23:29.215883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:23:45.215995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:24:17.221828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:26:58.484126 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 03:26:58.484285 0.000000 udp 10.0.2.105 7010 -> 79.77.219.124 2432 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:27:17.453404 0.103381 tcp 10.0.2.105 62749 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:17.557077 0.058801 tcp 10.0.2.105 62750 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:17.616203 0.167522 tcp 10.0.2.105 62751 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:17.783603 0.089488 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:17.856731 0.201490 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:18.055317 0.743454 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:18.761153 0.269156 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.040820 0.187937 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.165411 0.177571 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.334727 0.077398 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.397589 0.215817 udp 10.0.2.105 7010 <-> 76.226.133.17 7808 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.578074 0.335382 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:19.877365 0.354592 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.205396 0.092035 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.280875 0.053308 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.342661 0.252184 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.547438 0.132754 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.694031 0.169440 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:20.841997 0.159094 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:21.020928 0.140378 udp 10.0.2.105 7010 <-> 24.228.28.17 3495 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:21.190548 0.176506 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:21.364512 0.000000 udp 10.0.2.105 7010 -> 86.130.77.213 6503 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:27:30.390222 0.606659 tcp 10.0.2.105 62752 -> 31.192.24.67 3527 FSPA* 0 0 14 1497 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:37.029410 0.051656 tcp 10.0.2.105 62753 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:37.081319 0.055256 tcp 10.0.2.105 62754 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:37.136871 0.157372 tcp 10.0.2.105 62755 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:27:37.294772 0.131308 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:37.449679 0.143469 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:37.585184 0.130368 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:37.694163 0.174055 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:37.875742 0.198652 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.068124 0.233190 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.282672 0.212914 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.487782 0.244405 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.729138 0.063232 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.789882 0.045077 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:38.933634 0.225863 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:39.151806 0.087038 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:39.221658 0.143550 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:27:39.396916 0.128030 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:30:21.228347 3.001049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 03:30:28.235436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:30:36.237004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:30:52.239723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:31:24.249951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:37:28.252034 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:37:35.259401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:37:43.260938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:37:59.263911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:38:31.279906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:44:35.286490 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:44:42.293415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:44:50.295005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:45:06.297930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:45:38.303745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:54:45.314333 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 03:54:52.381260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:55:00.331989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:55:16.335089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:55:48.340949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 03:57:30.998480 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 03:57:30.998574 0.756252 tcp 10.0.2.105 62756 -> 31.192.24.67 3527 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:57:49.745945 0.000000 udp 10.0.2.105 7010 -> 86.130.77.213 6503 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:58:06.662113 0.054651 tcp 10.0.2.105 62757 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:06.717076 0.061571 tcp 10.0.2.105 62758 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:06.778951 0.163501 tcp 10.0.2.105 62759 -> 195.113.214.236 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:06.942876 0.095923 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:07.020069 0.173644 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:07.190235 0.173390 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:07.307528 0.601681 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:07.870757 0.244098 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:08.113391 0.262326 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:08.340410 0.078054 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:08.409679 0.174724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:08.576356 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:58:26.980015 0.051733 tcp 10.0.2.105 62760 -> 195.113.214.211 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:27.032089 0.052931 tcp 10.0.2.105 62761 -> 195.113.214.236 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:27.085270 0.155250 tcp 10.0.2.105 62762 -> 195.113.214.236 443 SRPA* 0 0 41 22612 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:27.241071 0.088653 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:27.313204 0.055071 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:27.367766 0.251119 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:27.571999 0.096989 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:27.697558 0.166347 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:27.842577 0.155470 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:58:28.012907 0.000000 udp 10.0.2.105 7010 -> 24.228.28.17 3495 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:58:46.267562 0.052245 tcp 10.0.2.105 62763 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:46.320123 0.054120 tcp 10.0.2.105 62764 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:46.374505 0.155052 tcp 10.0.2.105 62765 -> 195.113.214.236 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:58:46.530202 0.520864 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 4 1672 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:05.445261 0.056064 tcp 10.0.2.105 62766 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:59:05.501643 0.053912 tcp 10.0.2.105 62767 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:59:05.555861 0.160878 tcp 10.0.2.105 62768 -> 195.113.214.236 443 SRPA* 0 0 41 35512 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:59:05.717406 0.176126 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:05.890903 0.109713 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:06.034877 0.173582 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:06.267104 0.208111 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:06.468646 0.152102 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:06.731204 0.147018 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:06.869698 0.234537 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.082753 0.216810 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.290962 0.214698 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.502617 0.061824 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.598749 0.045717 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.642580 0.223132 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.857771 0.132973 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:07.929713 0.088684 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/04 03:59:08.017380 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 03:59:23.571338 0.081323 tcp 10.0.2.105 62769 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:59:23.652958 0.057225 tcp 10.0.2.105 62770 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 03:59:23.710452 0.154794 tcp 10.0.2.105 62771 -> 195.113.214.236 443 SRPA* 0 0 25 13876 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:01:52.347204 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 04:01:59.354772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:02:07.355798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:02:23.358886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:02:55.365336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:09:02.375301 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:09:09.383254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:09:17.384276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:09:33.387373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:10:05.393318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:16:09.399158 3.001747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:16:16.406796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:16:24.408540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:16:40.411710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:17:12.417120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:23:16.423693 3.001110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:23:23.430275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:23:31.432401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:23:47.435262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:24:19.441435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:27:31.758214 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 04:27:31.758459 0.526370 tcp 10.0.2.105 62772 -> 31.192.24.67 3527 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:29:34.964626 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 04:29:34.964725 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 04:29:50.739548 0.053221 tcp 10.0.2.105 62773 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:29:50.793148 0.059023 tcp 10.0.2.105 62774 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:29:50.852554 0.155677 tcp 10.0.2.105 62775 -> 195.113.214.236 443 SRPA* 0 0 41 21414 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:29:51.008644 0.388800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 5 1746 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:08.944581 0.054646 tcp 10.0.2.105 62776 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:08.999536 0.054487 tcp 10.0.2.105 62777 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:09.054325 0.157584 tcp 10.0.2.105 62778 -> 195.113.214.236 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:09.212522 0.000000 udp 10.0.2.105 7010 -> 24.228.28.17 3495 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 04:30:23.447061 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 04:30:25.648804 0.052223 tcp 10.0.2.105 62779 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:25.701337 0.054337 tcp 10.0.2.105 62780 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:25.755987 0.190748 tcp 10.0.2.105 62781 -> 195.113.214.236 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:25.947221 0.181886 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:26.124715 0.094786 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:26.198394 0.601721 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:26.761517 0.174347 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:26.876280 0.173646 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:27.047075 0.265584 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:27.353198 0.176348 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:27.522075 0.080007 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:27.683932 0.291565 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:27.939249 0.058615 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.020434 0.255154 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.228164 0.100796 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.352283 0.096590 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.431669 0.164852 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.608872 0.167539 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.753910 0.176034 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:28.927082 0.173984 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:29.269726 0.200876 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:29.461175 0.131431 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:29.748335 0.145891 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:29.886434 0.233190 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:30.099231 0.215818 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:30.307087 0.230989 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:30.455159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:30:30.535490 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 04:30:38.456126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:30:47.479495 0.053812 tcp 10.0.2.105 62782 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:47.533668 0.052632 tcp 10.0.2.105 62783 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:47.586630 0.155995 tcp 10.0.2.105 62784 -> 195.113.214.236 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:30:47.743306 0.126566 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:47.810005 0.086349 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:47.937147 0.047556 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:47.983383 0.060696 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/04 04:30:48.089520 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 04:30:54.459352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:31:06.046353 0.052031 tcp 10.0.2.105 62785 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:31:06.098278 0.054709 tcp 10.0.2.105 62786 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:31:06.153233 0.159745 tcp 10.0.2.105 62787 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 04:31:26.465140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:37:30.472160 3.006176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:37:37.478744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:37:45.480264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:38:01.483225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:38:33.489063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:44:37.496447 3.000618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:44:44.502780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:44:52.503943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:45:08.516844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:45:40.523153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:54:47.532192 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 04:54:54.539733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:55:02.541638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:55:18.544534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:55:50.550172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 04:57:32.286790 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 04:57:32.286946 0.562397 tcp 10.0.2.105 62788 -> 31.192.24.67 3527 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:01:26.853939 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:01:26.854131 0.096807 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:26.931933 0.229204 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:27.153819 0.142168 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:27.291599 0.083022 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:27.357513 0.172907 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:27.527279 0.161439 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:27.636062 0.617807 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:28.214408 0.056340 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:28.287729 0.280874 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:28.566695 0.174525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:28.733519 0.079795 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:28.800270 0.263138 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.023384 0.158726 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.196550 0.085776 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.265824 0.257794 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.474932 0.176689 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.648190 0.169800 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.794328 0.102236 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:29.899814 0.144910 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:30.036307 0.233677 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:30.251210 0.202478 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:30.443624 0.174991 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:30.660604 0.152787 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:30.820883 0.216909 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:31.024010 0.226627 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:31.247480 0.060538 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:31.306356 0.084842 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:31.373274 0.128383 udp 10.0.2.105 7010 <-> 109.157.64.148 7785 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:31.493732 0.047458 udp 10.0.2.105 7010 <-> 217.41.41.12 5678 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:01:54.556718 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 05:02:01.563916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:02:09.565269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:02:25.568258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:02:57.574064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:09:05.587029 3.000451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:09:12.593195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:09:20.594900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:09:36.597918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:10:08.603800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:16:12.609707 3.002119 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:16:19.617550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:16:27.618740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:16:43.621614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:17:15.627987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:23:19.634127 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:23:26.641224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:23:34.642587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:23:50.649477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:24:22.651708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:27:32.855726 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:27:32.855913 0.549059 tcp 10.0.2.105 62789 -> 31.192.24.67 3527 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:30:26.659178 3.000378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:30:33.665235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:30:41.666717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:30:57.669689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:31:29.675882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:31:46.309911 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:31:46.310011 0.139890 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:46.461438 0.092446 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:46.533368 0.106729 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:46.618297 0.229843 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:46.840538 0.680308 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:47.480570 0.053355 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:47.594910 0.173265 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:47.764113 0.275881 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:47.901749 0.253086 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.153556 0.176221 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.321658 0.076504 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.383481 0.261736 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.606546 0.158632 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.772942 0.093829 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:48.850592 0.253528 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.053260 0.102721 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2016 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.196190 0.146183 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.333405 0.233011 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.547756 0.207530 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.743471 0.172811 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:49.937102 0.177966 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.111874 0.169027 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.258898 0.138820 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.436660 0.216064 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.645078 0.259065 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.900641 0.062721 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:50.962257 0.089308 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/04 05:31:51.032103 0.000000 udp 10.0.2.105 7010 -> 109.157.64.148 7785 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:32:09.482981 0.051954 tcp 10.0.2.105 62790 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:32:09.535203 0.059403 tcp 10.0.2.105 62791 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:32:09.594999 0.152162 tcp 10.0.2.105 62792 -> 195.113.214.236 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:32:09.747741 0.000000 udp 10.0.2.105 7010 -> 217.41.41.12 5678 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:32:28.273415 0.054640 tcp 10.0.2.105 62793 -> 195.113.214.211 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:32:28.328317 0.052865 tcp 10.0.2.105 62794 -> 195.113.214.236 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:32:28.381517 0.146877 tcp 10.0.2.105 62795 -> 195.113.214.236 443 SRPA* 0 0 46 40404 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:37:33.682634 3.010774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 05:37:40.699242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:37:48.700780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:38:04.703641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:38:36.709758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:44:40.715199 3.012272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:44:47.733304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:44:55.734869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:45:11.737709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:45:43.743551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:54:49.751352 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 05:54:56.758924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:55:04.760281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:55:20.763244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:55:52.769643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 05:57:33.404636 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:57:33.404738 2.993886 tcp 10.0.2.105 62796 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:57:42.407180 0.000000 tcp 10.0.2.105 62796 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:57:48.408028 3.001781 tcp 10.0.2.105 62797 -> 195.113.214.211 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:57:57.408845 0.000000 tcp 10.0.2.105 62797 -> 195.113.214.211 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:58:02.305785 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:58:08.475439 4.004859 udp 10.0.2.105 63369 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:09.475823 3.004599 udp 10.0.2.105 63369 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:12.168918 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/02/04 05:58:16.485831 0.000000 udp 10.0.2.105 63369 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:16.485958 1.694782 udp 10.0.2.105 63369 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:18.180740 0.000000 icmp 147.32.83.216 0x0103 -> 10.0.2.105 0x0808 URH 192 1 100 flow=Background 1970/02/04 05:58:20.595332 1.500103 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:20.610646 1.484789 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/02/04 05:58:22.845489 2.993666 tcp 10.0.2.105 62798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:58:27.812085 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:58:31.838046 0.000000 tcp 10.0.2.105 62798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:58:37.847402 3.003603 tcp 10.0.2.105 62799 -> 195.113.214.237 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:58:46.850531 0.000000 tcp 10.0.2.105 62799 -> 195.113.214.237 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:58:51.806635 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:58:57.858691 4.002768 udp 10.0.2.105 63649 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:58:58.856831 3.004759 udp 10.0.2.105 63649 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:59:05.867028 0.000000 udp 10.0.2.105 63649 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:59:05.867141 0.000000 udp 10.0.2.105 63649 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:59:09.872272 1.502931 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:59:09.872380 1.502823 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/02/04 05:59:12.126046 2.994131 tcp 10.0.2.105 62800 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:59:16.812698 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 05:59:21.118829 0.000000 tcp 10.0.2.105 62800 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:59:27.127863 0.052442 tcp 10.0.2.105 62801 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:59:27.181120 3.752161 udp 10.0.2.105 137 -> 10.0.2.255 137 REQ 0 6 552 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 05:59:27.181187 3.752094 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 6 720 flow=Background 1970/02/04 05:59:31.684482 2.993765 tcp 10.0.2.105 62802 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:59:40.687012 0.000000 tcp 10.0.2.105 62802 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 05:59:46.686353 0.051234 tcp 10.0.2.105 62803 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:59:46.740017 0.011358 udp 10.0.2.105 55024 <-> 8.8.8.8 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/02/04 05:59:46.751866 0.078000 tcp 10.0.2.105 62804 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 05:59:46.830179 0.147196 tcp 10.0.2.105 62805 -> 195.113.214.251 443 SRPA* 0 0 36 26969 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:01:56.775319 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 06:02:03.782905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:02:11.784317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:02:27.787120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:02:47.315883 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 06:02:47.315978 0.000000 udp 10.0.2.105 7010 -> 217.41.41.12 5678 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 06:02:59.793295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:03:04.251787 0.058268 tcp 10.0.2.105 62806 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:04.310333 0.065914 tcp 10.0.2.105 62807 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:04.376537 0.156909 tcp 10.0.2.105 62808 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:04.534020 0.000000 udp 10.0.2.105 7010 -> 109.157.64.148 7785 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 06:03:23.498279 0.054943 tcp 10.0.2.105 62809 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:23.553514 0.070134 tcp 10.0.2.105 62810 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:23.623950 0.166984 tcp 10.0.2.105 62811 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:03:23.791561 0.228389 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.012328 0.107315 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.099334 0.087367 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.167311 0.143242 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.311781 0.168515 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.427753 0.260165 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.685162 0.054219 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.749292 0.106047 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.818734 0.173696 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:24.989060 0.157793 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.156800 0.086642 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.226316 0.174525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.392534 0.098266 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.496792 0.293059 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.754196 0.076276 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:25.816358 0.254651 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.024743 0.171360 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.204727 0.174432 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2014 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.376416 0.141531 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.524540 0.237501 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.741347 0.197180 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:26.932014 0.218270 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:27.147093 0.074107 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:27.234214 0.083866 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:27.300687 0.215578 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:27.488550 0.219849 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:03:27.700535 0.138390 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2606 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:04:47.057850 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 06:04:47.058021 0.541679 tcp 10.0.2.105 62812 -> 31.192.24.67 3527 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:09:07.806535 3.000215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 06:09:14.812690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:09:22.814173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:09:38.817046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:10:10.823012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:16:14.829103 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:16:21.836562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:16:29.837952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:16:45.841009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:17:17.847044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:23:21.853472 3.004900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:23:28.862591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:23:36.861667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:23:52.874970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:24:24.880906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:30:28.887384 3.001372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:30:35.894502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:30:43.895969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:30:59.898987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:31:31.905736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:33:51.736529 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 06:33:51.736686 0.095353 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:51.812356 0.152003 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:52.068895 0.235462 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:52.240721 0.230883 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:52.462313 0.114253 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:52.611875 0.257562 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:52.961259 0.052870 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:53.086399 0.864331 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:53.912479 0.174362 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:54.083850 0.160282 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:54.243961 0.090834 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:54.373594 0.175967 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:54.610625 0.095321 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:54.822590 0.255751 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.039992 0.082395 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.167076 0.253551 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.376211 0.145241 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.531683 0.234808 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.746107 0.170807 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:55.905863 0.177414 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.079532 0.208396 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.275479 0.263601 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.535527 0.064207 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.635959 0.095184 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.712513 0.168742 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:56.857972 0.213886 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:33:57.063941 0.145609 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/04 06:34:47.609223 0.565181 tcp 10.0.2.105 62813 -> 31.192.24.67 3527 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/04 06:37:35.911858 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 06:37:42.918578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:37:50.919807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:38:06.922773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:38:38.928349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:44:42.941334 2.995797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:44:49.942893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:44:57.943699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:45:13.946497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:45:45.953247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:51:49.958558 3.002255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:51:56.966261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:52:04.967926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:52:20.971031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:52:52.977289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:58:56.984454 3.000689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 06:59:03.990248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:59:11.992009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 06:59:27.994818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:00:00.000932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:04:04.242268 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 07:04:04.242450 0.085238 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:04.310600 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 07:04:22.520487 0.052951 tcp 10.0.2.105 62814 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:22.573706 0.075988 tcp 10.0.2.105 62815 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:22.650025 0.167544 tcp 10.0.2.105 62816 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:22.818080 0.209695 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:22.954520 0.226829 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.173914 0.095783 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.250756 0.255383 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.504908 0.060197 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.579422 0.159744 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.699407 0.208772 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:23.900266 0.156909 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:24.058423 0.086870 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:24.128869 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 07:04:41.406154 0.054627 tcp 10.0.2.105 62817 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:41.461090 0.074139 tcp 10.0.2.105 62818 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:41.535596 0.161622 tcp 10.0.2.105 62819 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:04:41.698326 0.105904 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 1966 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:41.843778 0.258700 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.066326 0.075922 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.129185 0.234376 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.343070 0.175550 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.540311 0.176250 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.713707 0.252449 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:42.919111 0.146927 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.056313 0.209858 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.254360 0.205096 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.456785 0.063010 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.547782 0.087333 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.615905 0.168617 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.759291 0.219088 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:43.970355 0.138555 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:04:48.175697 0.529195 tcp 10.0.2.105 62820 -> 31.192.24.67 3527 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:06:28.010772 3.002177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 07:06:35.018486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:06:43.020019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:06:59.023378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:07:31.028737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:13:39.041145 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:13:46.048847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:13:54.049361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:14:10.053201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:14:42.059004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:20:46.065233 3.007260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:20:53.072068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:21:01.073850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:21:17.076812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:21:49.082828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:27:53.089172 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:28:00.096460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:28:08.097353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:28:24.100562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:28:56.106878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:34:48.704767 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 07:34:48.704911 0.648550 tcp 10.0.2.105 62821 -> 31.192.24.67 3527 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:00.113281 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:35:07.120388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:35:11.757321 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 07:35:15.121956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:35:16.313535 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 07:35:28.773068 0.070839 tcp 10.0.2.105 62822 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:28.844187 0.070688 tcp 10.0.2.105 62823 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:28.915157 0.157775 tcp 10.0.2.105 62824 -> 195.113.214.251 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:29.073576 0.173714 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:29.240135 0.093212 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:29.315667 0.226024 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:29.534624 0.173790 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:29.648723 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 07:35:31.125260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:35:46.106645 0.049408 tcp 10.0.2.105 62825 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:46.156562 0.076414 tcp 10.0.2.105 62826 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:46.233301 0.164096 tcp 10.0.2.105 62827 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:35:46.396546 0.124442 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 3 979 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:46.515645 0.111652 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:46.586883 0.173895 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 1988 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:46.756948 0.156182 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:46.912744 0.068865 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:46.985341 0.089235 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.058368 0.086789 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.181906 0.251113 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.398488 0.084060 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.466498 0.177468 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.640876 0.256947 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.851820 0.145642 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:47.987989 0.235181 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:48.202863 0.176371 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:48.400062 0.209439 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:48.610920 0.224990 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:35:48.832944 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 07:36:03.131137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:36:05.925794 0.086140 tcp 10.0.2.105 62828 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:36:06.012305 0.071481 tcp 10.0.2.105 62829 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:36:06.084062 0.160309 tcp 10.0.2.105 62830 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 07:36:06.244882 0.094803 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:36:06.320197 0.165413 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:36:06.490200 0.220221 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:36:06.702283 0.145150 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/04 07:42:07.137836 3.000204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:42:14.144138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:42:22.146124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:42:38.149222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:43:10.154767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:53:34.164908 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 07:53:41.172310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:53:49.178834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:54:05.178882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 07:54:37.182735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:00:41.188889 3.001598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:00:48.196166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:00:56.197766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:01:12.200382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:01:44.206661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:04:49.353390 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 08:04:49.353506 0.537174 tcp 10.0.2.105 62831 -> 31.192.24.67 3527 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:13.754441 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 08:06:13.754616 0.264087 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:14.017621 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 08:06:32.903820 0.050008 tcp 10.0.2.105 62832 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:32.954097 0.070795 tcp 10.0.2.105 62833 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:33.025143 0.169280 tcp 10.0.2.105 62834 -> 195.113.214.251 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:33.193608 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 08:06:50.187219 0.049658 tcp 10.0.2.105 62835 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:50.237150 0.076967 tcp 10.0.2.105 62836 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:50.314408 0.154444 tcp 10.0.2.105 62837 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:06:50.469459 0.095508 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:50.544581 0.174528 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:50.711811 0.201654 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:50.851320 0.113892 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:50.923983 0.177639 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:51.098974 0.157208 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:51.448969 0.109829 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:51.538441 0.088934 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:06:51.711548 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 08:07:10.215982 0.049859 tcp 10.0.2.105 62838 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:07:10.266112 0.072320 tcp 10.0.2.105 62839 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:07:10.338743 0.155863 tcp 10.0.2.105 62840 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:07:10.495249 0.065837 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:10.569889 0.176914 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:10.743676 0.251978 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:10.950480 0.147072 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:11.087656 0.238232 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:11.306098 0.278007 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:11.545967 0.077203 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:11.661497 0.175899 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:11.972023 0.213808 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:12.192815 0.296885 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:12.484594 0.219255 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:12.695959 0.124505 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:12.897028 0.084841 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:12.965876 0.172179 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:07:48.213116 3.001623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 08:07:55.220028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:08:03.221617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:08:19.224663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:08:51.230498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:14:55.237096 3.001562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:15:02.243975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:15:10.245859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:15:26.247961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:15:58.254691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:22:02.261912 3.000437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:22:09.268022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:22:17.269548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:22:33.272732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:23:05.278385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:29:09.284696 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:29:16.292185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:29:24.293494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:29:40.301266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:30:12.303144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:34:49.892084 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 08:34:49.892195 0.652618 tcp 10.0.2.105 62841 -> 31.192.24.67 3527 FSPA* 0 0 12 1629 flow=From-Botnet-V2-TCP-Established 1970/02/04 08:36:16.308627 3.001514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:36:23.316103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:36:31.317568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:36:47.320854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:37:19.326558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:37:23.993359 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 08:37:23.993505 0.222105 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:24.207613 0.107231 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:24.708888 0.245117 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:24.952430 0.187625 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.080563 0.093926 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.355657 0.109261 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.425349 0.174046 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.592248 0.092994 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.678538 0.162348 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:25.929963 0.173615 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:26.100238 0.121181 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:26.199907 0.058780 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:26.508584 0.177851 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:26.682314 0.232593 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:26.895369 0.248304 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:27.139042 0.147259 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:27.276515 0.172502 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:27.427046 0.254092 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:27.644004 0.080753 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:28.032714 0.213499 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:28.240570 0.313583 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:28.550793 0.218944 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:28.908791 0.152279 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:29.153774 0.086663 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:37:29.221669 0.170070 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/04 08:43:23.335138 2.998972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:43:30.340033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:43:38.341562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:43:54.344451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:44:26.350564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:54:13.360012 3.123716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 08:54:20.454970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:54:28.394894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:54:44.379454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 08:55:16.385413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:01:20.391316 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 09:01:27.398649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:01:35.400570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:01:51.403121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:02:23.409308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:04:50.550935 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:04:50.551097 3.003794 tcp 10.0.2.105 62842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 09:04:59.553634 0.000000 tcp 10.0.2.105 62842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 09:05:05.554651 0.052502 tcp 10.0.2.105 62843 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:05:05.607406 0.071104 tcp 10.0.2.105 62844 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:05:05.678783 0.179438 tcp 10.0.2.105 62845 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:05:05.880412 0.981002 tcp 10.0.2.105 62846 -> 128.255.183.224 9027 FSPA* 0 0 15 1600 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:07:40.164834 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:07:40.164933 0.230616 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:07:40.386941 0.169176 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:07:40.505697 0.099263 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 1973 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:07:40.727970 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:07:58.351500 0.051864 tcp 10.0.2.105 62847 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:07:58.403676 0.071963 tcp 10.0.2.105 62848 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:07:58.476009 0.159341 tcp 10.0.2.105 62849 -> 195.113.214.251 443 SRPA* 0 0 25 9534 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:07:58.635839 0.092902 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:07:58.708851 0.112490 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:07:58.781141 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:08:15.446439 0.050244 tcp 10.0.2.105 62850 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:08:15.496975 0.074961 tcp 10.0.2.105 62851 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:08:15.572269 0.168973 tcp 10.0.2.105 62852 -> 195.113.214.251 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:08:15.741769 0.089877 udp 10.0.2.105 7010 <-> 31.54.193.181 2112 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:15.816145 0.157573 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.027426 0.172653 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.196767 0.108534 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.284326 0.054879 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.364835 0.175277 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.537678 0.239112 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.756020 0.265694 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:16.973739 0.262982 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:17.202428 0.078111 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:17.264554 0.146795 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:17.402591 0.172978 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:17.549580 0.204373 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:17.747893 0.259625 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:18.004777 0.218220 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:18.215808 0.152247 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:18.393181 0.086035 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:18.461633 0.169891 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:08:27.416487 3.000244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 09:08:34.422782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:08:42.425005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:08:58.427128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:09:30.433291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:15:34.439268 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 09:15:41.446221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:15:49.447914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:16:05.451071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:16:37.456934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:22:41.463813 3.001028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 09:22:48.470186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:22:56.472054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:23:12.488470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:23:44.480990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:29:48.486739 3.001787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 09:29:55.496452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:30:03.495863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:30:19.499015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:30:51.505011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:35:06.862632 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:35:06.862735 0.984646 tcp 10.0.2.105 62853 -> 128.255.183.224 9027 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:36:55.510326 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 09:37:02.518487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:37:10.519682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:37:26.523167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:37:58.528872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:38:29.403518 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:38:29.403621 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:38:47.251373 0.053335 tcp 10.0.2.105 62854 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:38:47.305226 0.078181 tcp 10.0.2.105 62855 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:38:47.383791 0.163997 tcp 10.0.2.105 62856 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:38:47.548575 0.172949 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:38:47.714405 0.157493 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:38:47.820000 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:03.833460 0.054380 tcp 10.0.2.105 62857 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:03.888108 0.073308 tcp 10.0.2.105 62858 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:03.961691 0.161394 tcp 10.0.2.105 62859 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:04.123758 0.133520 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:04.289559 0.173315 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:04.443460 0.180054 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:04.586952 0.000000 udp 10.0.2.105 7010 -> 31.54.193.181 2112 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:22.290024 0.057816 tcp 10.0.2.105 62860 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:22.348093 0.068596 tcp 10.0.2.105 62861 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:22.417055 0.160762 tcp 10.0.2.105 62862 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 09:39:22.578314 0.161707 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:22.758902 0.175734 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:22.931670 0.130774 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 4 1322 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:23.053036 0.053361 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:23.194916 0.178218 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:23.370290 0.234294 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:23.586420 0.253255 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:23.791237 0.259088 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.016132 0.085231 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.086249 0.144580 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.222897 0.173089 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.370334 0.201884 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.566082 0.131322 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.698995 0.084066 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.763730 0.172506 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:24.913073 0.252085 udp 10.0.2.105 7010 <-> 99.7.188.21 9751 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:25.162002 0.219499 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:25.391990 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 REQ 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:32.343667 0.000000 udp 10.0.2.105 7010 -> 31.54.193.181 2112 REQ 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:38.722986 0.274620 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 8 3202 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:38.948414 0.338364 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 2927 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:39.280190 0.192935 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 8 3172 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:39.434621 0.130817 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 8 3078 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:39.547556 0.182259 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 8 3079 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:39.714004 0.332171 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2978 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:40.043022 0.185999 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 8 3328 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:40.208201 0.104178 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 2871 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:40.299242 0.317820 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 8 2976 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:40.618421 0.346020 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:40.961155 0.453773 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 8 3199 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:41.394937 0.459167 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 8 3235 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:41.805616 0.490660 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3115 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:42.260645 0.134364 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 8 2984 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:42.380113 0.317300 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 8 3028 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:42.675722 0.404398 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 8 3196 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:43.074985 0.263238 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 8 3245 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:43.339782 0.148676 udp 10.0.2.105 7010 <-> 109.145.221.106 1878 CON 0 0 8 2766 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:43.471202 0.315883 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 3272 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:43.762577 0.000000 udp 10.0.2.105 7010 -> 99.7.188.21 9751 REQ 0 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:46.303677 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:39:51.191103 0.285647 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 8 2930 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:51.466900 0.424130 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 2917 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:39:51.884045 0.000000 udp 10.0.2.105 7010 -> 88.240.162.230 6019 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:39:58.200994 0.000000 udp 10.0.2.105 7010 -> 50.147.54.161 7355 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:06.392869 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:11.309576 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:40:14.894979 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:20.735415 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:26.191032 0.000000 udp 10.0.2.105 7010 -> 77.97.35.79 5736 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:34.843666 0.000000 udp 10.0.2.105 7010 -> 92.249.185.84 8794 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:39.810580 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:40:42.925371 0.111437 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 8 3034 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:40:43.059918 0.000000 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:49.935458 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:40:56.505120 0.134806 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 8 3175 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:40:56.658859 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:05.647910 0.000000 udp 10.0.2.105 7010 -> 2.39.177.30 4734 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:10.304132 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:41:14.470724 0.000000 udp 10.0.2.105 7010 -> 85.74.91.59 2536 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:19.529826 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:26.417846 0.000000 udp 10.0.2.105 7010 -> 87.102.3.56 1658 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:32.396205 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:37.303474 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:41:39.877080 0.883004 udp 10.0.2.105 7010 <-> 116.203.177.234 6514 CON 0 0 8 3324 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:41:40.582621 0.000000 udp 10.0.2.105 7010 -> 50.84.63.126 9414 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:47.217751 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:41:55.098912 0.000000 udp 10.0.2.105 7010 -> 82.33.230.34 6275 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:01.798532 0.235799 udp 10.0.2.105 7010 -> 202.111.6.9 3573 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:02.034331 0.000000 icmp 202.111.6.9 0x0303 -> 10.0.2.105 0xf50d URP 192 1 172 flow=Background 1970/02/04 09:42:06.305254 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:42:10.681372 0.000000 udp 10.0.2.105 7010 -> 88.231.46.167 2157 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:16.389104 0.000000 udp 10.0.2.105 7010 -> 93.177.150.152 1731 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:23.119121 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:29.318454 0.132509 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:29.450963 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 297 flow=Background 1970/02/04 09:42:34.305265 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:42:34.866386 0.000000 udp 10.0.2.105 7010 -> 78.164.100.85 5152 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:41.285472 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:47.324128 0.000000 udp 10.0.2.105 7010 -> 88.244.188.206 6778 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:42:56.106841 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:00.803108 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:43:02.826247 0.000000 udp 10.0.2.105 7010 -> 93.193.138.107 7662 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:10.928081 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:19.761051 0.000000 udp 10.0.2.105 7010 -> 79.219.111.23 2430 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:28.283517 0.056034 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:28.339551 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 236 flow=Background 1970/02/04 09:43:32.809195 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:43:35.023157 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:40.500716 0.000000 udp 10.0.2.105 7010 -> 177.5.244.82 3020 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:45.798288 0.000000 udp 10.0.2.105 7010 -> 88.241.166.178 5658 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:51.196028 0.000000 udp 10.0.2.105 7010 -> 93.46.222.173 3954 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:57.905834 0.169530 udp 10.0.2.105 7010 -> 182.71.212.214 3620 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:43:58.075364 0.000000 icmp 182.71.212.214 0x0303 -> 10.0.2.105 0x240e URP 192 1 217 flow=Background 1970/02/04 09:44:02.534706 3.001868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 09:44:02.812576 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:44:06.878551 0.000000 udp 10.0.2.105 7010 -> 174.19.74.106 4177 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:09.542500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:44:15.520805 0.000000 udp 10.0.2.105 7010 -> 86.180.155.39 6896 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:17.543529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:44:21.599940 0.000000 udp 10.0.2.105 7010 -> 2.223.0.212 9233 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:26.807066 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:31.804053 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:44:31.974878 0.000000 udp 10.0.2.105 7010 -> 94.180.117.138 6596 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:33.546757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:44:40.907630 0.384538 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 8 3011 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:44:41.302411 0.000000 udp 10.0.2.105 7010 -> 86.29.17.237 1126 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:47.797192 0.000000 udp 10.0.2.105 7010 -> 78.172.14.21 3632 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:54.055993 0.060767 udp 10.0.2.105 7010 -> 151.84.129.47 1184 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:44:54.116760 0.000000 icmp 151.84.129.47 0x0303 -> 10.0.2.105 0xa004 URP 192 1 333 flow=Background 1970/02/04 09:44:58.813025 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:45:01.647331 0.576473 udp 10.0.2.105 7010 <-> 75.222.22.208 5379 CON 0 0 8 3052 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:45:02.183456 0.000000 udp 10.0.2.105 7010 -> 79.6.176.181 3126 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:05.552691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:45:10.683641 0.000000 udp 10.0.2.105 7010 -> 108.35.112.228 4741 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:16.831637 0.000000 udp 10.0.2.105 7010 -> 94.34.131.89 9141 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:22.707654 0.313263 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:23.020917 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 161 flow=Background 1970/02/04 09:45:27.304044 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:45:29.928132 0.000000 udp 10.0.2.105 7010 -> 186.6.14.232 3659 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:36.056871 0.000000 udp 10.0.2.105 7010 -> 72.175.1.199 7045 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:43.426767 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:50.918277 0.086615 udp 10.0.2.105 7010 -> 86.137.93.212 1128 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:45:51.004892 0.000000 icmp 86.137.93.212 0x0303 -> 10.0.2.105 0x6804 URP 192 1 303 flow=Background 1970/02/04 09:45:55.805045 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:45:57.497571 0.000000 udp 10.0.2.105 7010 -> 172.13.6.157 3233 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:04.938363 0.361855 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 8 2970 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:05.341951 0.000000 udp 10.0.2.105 7010 -> 80.194.229.202 3009 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:13.921274 0.000000 udp 10.0.2.105 7010 -> 82.91.56.81 9874 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:19.429351 0.000000 udp 10.0.2.105 7010 -> 65.246.66.100 7380 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:24.305432 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:46:27.400945 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:33.940078 0.319005 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 8 3154 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:34.266892 0.000000 udp 10.0.2.105 7010 -> 184.183.191.63 9122 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:41.550940 0.065222 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:41.648977 0.075916 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:41.740142 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 9668 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:49.262306 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:46:53.808503 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:46:56.322223 0.101361 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:56.750785 0.158560 udp 10.0.2.105 7010 <-> 107.3.198.109 2228 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:56.973878 0.081975 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:46:57.090201 0.000000 udp 10.0.2.105 7010 -> 46.196.161.121 8513 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:04.995368 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:12.345437 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:20.289370 0.000000 udp 10.0.2.105 7010 -> 151.76.42.205 2525 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:24.813121 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:47:25.614273 0.000000 udp 10.0.2.105 7010 -> 71.42.140.232 3840 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:32.203672 0.000000 udp 10.0.2.105 7010 -> 79.11.222.23 9498 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:39.083604 0.000000 udp 10.0.2.105 7010 -> 78.6.121.163 1040 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:44.271317 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:48.807353 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:47:50.099307 0.000000 udp 10.0.2.105 7010 -> 41.135.167.222 1915 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:47:56.629012 0.000000 udp 10.0.2.105 7010 -> 200.223.31.39 1987 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:01.676154 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:07.063948 0.145973 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:48:07.246113 0.000000 udp 10.0.2.105 7010 -> 2.25.208.254 9305 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:13.733567 0.000000 udp 10.0.2.105 7010 -> 70.63.52.66 7057 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:18.309967 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:48:20.553433 0.000000 udp 10.0.2.105 7010 -> 151.53.190.4 5487 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:26.792358 0.000000 udp 10.0.2.105 7010 -> 64.198.99.165 3684 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:35.344635 0.187084 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:48:35.550744 0.103496 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:48:35.668048 0.000000 udp 10.0.2.105 7010 -> 71.183.79.16 8853 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:43.886267 0.000000 udp 10.0.2.105 7010 -> 117.222.218.40 7682 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:48.803626 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:48:49.575305 0.065712 udp 10.0.2.105 7010 <-> 86.150.58.5 5123 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:48:49.954711 0.326269 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:48:50.395072 0.000000 udp 10.0.2.105 7010 -> 76.172.26.214 4293 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:48:57.546186 0.000000 udp 10.0.2.105 7010 -> 82.23.10.57 7737 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:06.169124 0.000000 udp 10.0.2.105 7010 -> 68.197.197.146 4872 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:12.668431 0.406902 udp 10.0.2.105 7010 -> 200.125.191.22 1577 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:13.075333 0.000000 icmp 200.125.191.22 0x0303 -> 10.0.2.105 0x2906 URP 192 1 132 flow=Background 1970/02/04 09:49:17.304977 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:49:21.060524 0.000000 udp 10.0.2.105 7010 -> 79.169.15.118 7404 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:27.499607 0.000000 udp 10.0.2.105 7010 -> 173.12.0.222 6479 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:33.958882 0.000000 udp 10.0.2.105 7010 -> 216.188.255.42 1811 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:40.528643 0.000000 udp 10.0.2.105 7010 -> 109.89.181.108 3948 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:45.305266 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:49:47.908915 0.000000 udp 10.0.2.105 7010 -> 79.47.120.131 2448 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:49:54.749017 0.000000 udp 10.0.2.105 7010 -> 87.6.74.27 6242 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:00.046399 0.000000 udp 10.0.2.105 7010 -> 67.168.21.30 9969 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:08.047781 0.000000 udp 10.0.2.105 7010 -> 82.48.100.125 1835 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:12.804476 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:50:14.226418 0.062267 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:50:14.382379 0.000000 udp 10.0.2.105 7010 -> 75.90.158.234 7966 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:19.904857 1.190446 udp 10.0.2.105 7010 <-> 190.134.146.182 5258 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:50:21.104794 0.000000 udp 10.0.2.105 7010 -> 75.82.203.200 1351 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:29.648873 0.000000 udp 10.0.2.105 7010 -> 62.30.22.117 6964 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:36.438423 0.000000 udp 10.0.2.105 7010 -> 176.255.48.206 4350 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:41.305291 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:50:42.477148 0.000000 udp 10.0.2.105 7010 -> 76.105.149.13 1139 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:48.866704 0.000000 udp 10.0.2.105 7010 -> 94.170.106.40 7176 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:50:55.425921 0.000000 udp 10.0.2.105 7010 -> 162.218.40.62 8325 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:02.866731 0.000000 udp 10.0.2.105 7010 -> 189.218.14.164 7975 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:07.803607 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:51:11.158079 0.000000 udp 10.0.2.105 7010 -> 88.235.4.187 7725 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:18.399044 0.000000 udp 10.0.2.105 7010 -> 93.32.130.50 4437 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:25.288545 0.000000 udp 10.0.2.105 7010 -> 31.50.1.123 3274 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:32.689486 0.000000 udp 10.0.2.105 7010 -> 88.68.195.55 1535 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:37.306075 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:51:40.880828 0.000000 udp 10.0.2.105 7010 -> 98.198.27.240 3257 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:48.833040 0.000000 udp 10.0.2.105 7010 -> 78.225.81.228 4000 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:51:54.030371 0.078025 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/04 09:51:54.139015 0.000000 udp 10.0.2.105 7010 -> 79.11.141.127 3391 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:52:00.059183 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:52:04.805578 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 09:52:08.691470 0.000000 udp 10.0.2.105 7010 -> 89.158.24.147 8909 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 09:54:33.562481 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 09:54:40.569421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:54:48.571182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:55:04.573749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 09:55:36.580561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:01:40.585526 3.002299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:01:47.593550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:01:55.594702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:02:11.598326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:02:43.603856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:05:07.851747 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 10:05:07.851930 0.920468 tcp 10.0.2.105 62863 -> 128.255.183.224 9027 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:08:47.610733 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:08:54.617780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:09:02.619167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:09:18.622340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:09:50.628632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:15:54.634835 3.000987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:16:01.641457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:16:09.643085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:16:25.645861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:16:57.651933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:22:36.159452 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 10:22:36.159570 0.112730 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.272702 0.100944 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.397396 0.166769 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.564599 0.071032 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.636052 0.074853 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.711322 0.082568 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:36.794272 0.214754 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.009433 0.164022 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.173886 0.171040 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.345396 0.046063 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.391874 0.200504 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.592765 0.225119 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:37.818289 0.213378 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:38.032133 0.060906 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:38.093412 0.144177 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:38.237970 0.236394 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:38.474749 0.000000 udp 10.0.2.105 7010 -> 109.145.221.106 1878 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:22:54.036035 0.053978 tcp 10.0.2.105 62864 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:22:54.090310 0.076324 tcp 10.0.2.105 62865 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:22:54.167344 0.157818 tcp 10.0.2.105 62866 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:22:54.325826 0.146120 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:54.472504 0.123958 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:54.596792 0.213705 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:54.810910 0.132723 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:54.944001 0.055540 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:54.999983 0.057668 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:55.058060 0.102903 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:55.161381 0.070087 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:22:55.231935 0.000000 udp 10.0.2.105 7010 -> 107.3.198.109 2228 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:23:01.666253 2.993457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:23:08.667819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:23:13.102412 0.053440 tcp 10.0.2.105 62867 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:13.155702 0.073836 tcp 10.0.2.105 62868 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:13.229869 0.157013 tcp 10.0.2.105 62869 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:13.387419 0.000000 udp 10.0.2.105 7010 -> 116.203.177.234 6514 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:23:16.666846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:23:31.489520 0.052973 tcp 10.0.2.105 62870 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:31.542836 0.076541 tcp 10.0.2.105 62871 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:31.619695 0.163344 tcp 10.0.2.105 62872 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:31.783728 0.197856 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:31.981976 0.095537 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 217 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:32.077898 0.188447 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:32.266730 0.055139 udp 10.0.2.105 7010 <-> 86.150.58.5 5123 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:32.322233 0.327983 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:32.650621 0.185080 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:32.670053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:23:32.836093 0.292669 udp 10.0.2.105 7010 <-> 75.222.22.208 5379 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:33.129162 0.000000 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:23:50.306057 0.052632 tcp 10.0.2.105 62873 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:50.358955 0.075875 tcp 10.0.2.105 62874 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:50.435108 0.176498 tcp 10.0.2.105 62875 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:23:50.612198 0.057562 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:23:50.670179 0.000000 udp 10.0.2.105 7010 -> 190.134.146.182 5258 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:24:04.676030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:24:08.191780 0.052718 tcp 10.0.2.105 62876 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:24:08.244313 0.075772 tcp 10.0.2.105 62877 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:24:08.320543 0.164507 tcp 10.0.2.105 62878 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:24:08.485848 0.144533 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:24:08.630792 0.072419 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:24:08.703614 0.060854 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:24:08.764898 0.084748 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:30:08.682373 3.018196 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:30:15.699501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:30:23.701127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:30:39.703937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:31:11.710061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:35:08.781053 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 10:35:08.781158 0.915680 tcp 10.0.2.105 62879 -> 128.255.183.224 9027 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:37:15.715796 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:37:22.723215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:37:30.725040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:37:46.727950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:38:18.736864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:44:22.740924 3.000668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:44:29.748891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:44:37.748655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:44:53.751926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:45:25.758140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:54:12.475683 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 10:54:12.475831 0.000000 udp 10.0.2.105 7010 -> 109.145.221.106 1878 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:54:28.008992 0.050288 tcp 10.0.2.105 62880 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:28.059496 0.072224 tcp 10.0.2.105 62881 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:28.132067 0.166796 tcp 10.0.2.105 62882 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:28.299419 0.000000 udp 10.0.2.105 7010 -> 107.3.198.109 2228 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:54:38.766615 3.000527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 10:54:45.772822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:54:46.444541 0.048584 tcp 10.0.2.105 62883 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:46.493437 0.071588 tcp 10.0.2.105 62884 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:46.565374 0.157855 tcp 10.0.2.105 62885 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:54:46.723722 0.000000 udp 10.0.2.105 7010 -> 116.203.177.234 6514 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:54:53.774492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:55:04.651139 0.048849 tcp 10.0.2.105 62886 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:04.700235 0.078263 tcp 10.0.2.105 62887 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:04.778789 0.163806 tcp 10.0.2.105 62888 -> 195.113.214.251 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:04.943061 0.177167 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:05.120731 0.000000 udp 10.0.2.105 7010 -> 190.134.146.182 5258 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:55:09.777081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:55:20.724961 0.049807 tcp 10.0.2.105 62889 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:20.775014 0.086365 tcp 10.0.2.105 62890 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:20.861657 0.159164 tcp 10.0.2.105 62891 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:21.021318 0.071502 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:21.093216 0.158243 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:21.251854 0.165900 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:21.418144 0.078606 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:21.497133 0.699495 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.197023 0.167780 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.365183 0.073415 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.439055 0.102047 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.541503 0.212009 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.753942 0.213098 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:22.967464 0.170932 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.138821 0.046800 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.186084 0.064183 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.250711 0.221145 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.472313 0.213447 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.686225 0.147167 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.833802 0.059066 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.893257 0.102591 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:23.996213 0.213228 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.209861 0.144727 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.355024 0.145368 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.500779 0.131650 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.632799 0.055732 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.689063 0.069198 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.758672 0.141957 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.901033 0.097607 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:24.999050 0.319394 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:25.318820 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 10:55:41.790209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 10:55:43.397402 0.049335 tcp 10.0.2.105 62892 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:43.447088 0.075450 tcp 10.0.2.105 62893 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:43.522853 0.256516 tcp 10.0.2.105 62894 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 10:55:43.779901 0.327514 udp 10.0.2.105 7010 <-> 75.222.22.208 5379 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.107753 0.057628 udp 10.0.2.105 7010 <-> 86.150.58.5 5123 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.165786 0.188028 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.354214 0.058128 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.412688 0.060791 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.473843 0.075536 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.549773 0.145327 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/04 10:55:44.695508 0.338955 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:01:45.789469 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:01:52.797024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:02:00.798583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:02:16.801435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:02:48.807570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:05:09.700740 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 11:05:09.700965 0.995697 tcp 10.0.2.105 62895 -> 128.255.183.224 9027 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:08:52.813625 3.002945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:08:59.820931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:09:07.822746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:09:23.825420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:09:55.831708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:15:59.838125 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:16:06.844937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:16:14.846275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:16:30.849565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:17:02.855308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:23:06.862279 3.000557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:23:13.870958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:23:21.872327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:23:37.873483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:24:09.879641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:26:06.217240 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 11:26:06.217473 0.183155 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:06.401017 0.000000 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:26:21.560687 0.079870 tcp 10.0.2.105 62896 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:21.640837 0.077637 tcp 10.0.2.105 62897 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:21.718768 0.162815 tcp 10.0.2.105 62898 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:21.881815 0.071993 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:21.954236 0.092724 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:22.047403 0.165505 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:22.213314 0.164642 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:22.378373 0.180246 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:22.559022 0.093077 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:22.652493 0.561186 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.214105 0.213662 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.428358 0.084314 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.513082 0.127822 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.641299 0.065425 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.707124 0.217008 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:23.924510 0.193659 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.118628 0.171358 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.290345 0.163096 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.453858 0.101217 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.555419 0.206453 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.762287 0.124019 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.886746 0.057058 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:24.944161 0.144389 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.088948 0.073168 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.162519 0.167756 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.330702 0.096354 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.427506 0.142440 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.570331 0.133695 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.704625 0.055801 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:25.760874 0.317035 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:26.078352 0.000000 udp 10.0.2.105 7010 -> 75.222.22.208 5379 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:26:41.087651 0.057850 tcp 10.0.2.105 62899 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:41.145797 0.072501 tcp 10.0.2.105 62900 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:41.218621 0.160301 tcp 10.0.2.105 62901 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:41.379515 0.000000 udp 10.0.2.105 7010 -> 86.150.58.5 5123 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:26:59.103604 0.056296 tcp 10.0.2.105 62902 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:59.160156 0.075532 tcp 10.0.2.105 62903 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:59.236025 0.182743 tcp 10.0.2.105 62904 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:26:59.419321 0.188222 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:59.607995 0.059126 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:59.667570 0.145989 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:59.813970 0.120387 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:26:59.934765 0.058655 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:27:00.009093 0.080552 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:30:13.886251 3.000961 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 11:30:20.892885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:30:28.894294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:30:44.897547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:31:16.903377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:35:10.700230 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 11:35:10.700430 0.939786 tcp 10.0.2.105 62905 -> 128.255.183.224 9027 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:37:20.912631 2.998543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:37:27.917115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:37:35.918293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:37:51.921264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:38:23.927060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:44:27.933323 3.001074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:44:34.940158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:44:42.942273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:44:58.945409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:45:30.951653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:54:41.966386 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 11:54:48.974122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:54:56.975654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:55:12.978882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:55:44.986769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 11:57:24.908274 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 11:57:24.908481 0.175312 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:57:25.084180 0.000000 udp 10.0.2.105 7010 -> 75.222.22.208 5379 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:57:40.777659 0.049075 tcp 10.0.2.105 62906 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:57:40.827075 0.071367 tcp 10.0.2.105 62907 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:57:40.898803 0.155214 tcp 10.0.2.105 62908 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:57:41.054537 0.000000 udp 10.0.2.105 7010 -> 86.150.58.5 5123 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:57:59.358013 0.562931 tcp 10.0.2.105 62909 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:57:59.921225 0.478249 tcp 10.0.2.105 62910 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:58:00.399820 0.159288 tcp 10.0.2.105 62911 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:58:00.559744 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 11:58:16.282084 0.051953 tcp 10.0.2.105 62912 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:58:16.334366 0.075579 tcp 10.0.2.105 62913 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:58:16.410264 0.158345 tcp 10.0.2.105 62914 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 11:58:16.569274 0.075094 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:16.644735 0.071340 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:16.716606 0.157674 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:16.874758 0.208525 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:17.083669 0.165110 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:17.249190 0.168194 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:17.481244 0.085810 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:17.567441 0.218143 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:17.785990 0.249565 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.035950 0.224021 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.260428 0.072480 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.333280 0.060607 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.394296 0.135413 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.530142 0.101869 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.632421 0.202208 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.835021 0.137861 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:18.973241 0.057861 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.031483 0.144097 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.176005 0.075785 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.252161 0.172168 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.424713 0.044902 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.470048 0.055718 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.526202 0.335057 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.861679 0.108072 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:19.970134 0.148720 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.119322 0.143666 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.263364 0.137222 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.400986 0.190248 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.591648 0.053771 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.645766 0.144384 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.790546 0.073385 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.864339 0.059559 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/04 11:58:20.924382 0.080558 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:01:48.990135 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 12:01:55.997194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:02:03.999072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:02:20.002142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:02:52.008111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:05:11.639408 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:05:11.639599 0.595788 tcp 10.0.2.105 62915 -> 128.255.183.224 9027 FSPA* 0 0 13 1309 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:11.930564 0.053460 tcp 10.0.2.105 62916 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:11.984303 0.073860 tcp 10.0.2.105 62917 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:12.058407 0.155509 tcp 10.0.2.105 62918 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:12.235554 2.998363 tcp 10.0.2.105 62919 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:21.234029 0.000000 tcp 10.0.2.105 62919 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:27.232052 0.054239 tcp 10.0.2.105 62920 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:27.286549 0.074763 tcp 10.0.2.105 62921 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:27.361620 0.164015 tcp 10.0.2.105 62922 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:27.537718 2.998397 tcp 10.0.2.105 62923 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:36.534662 0.000000 tcp 10.0.2.105 62923 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:42.540398 0.052080 tcp 10.0.2.105 62924 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:42.592829 0.074550 tcp 10.0.2.105 62925 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:42.667679 0.167465 tcp 10.0.2.105 62926 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:42.846431 2.991707 tcp 10.0.2.105 62927 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:51.846444 0.000000 tcp 10.0.2.105 62927 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:05:57.836036 0.051956 tcp 10.0.2.105 62928 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:57.888242 0.074032 tcp 10.0.2.105 62929 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:57.962576 0.157237 tcp 10.0.2.105 62930 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:58.154862 0.261974 tcp 10.0.2.105 62931 -> 128.255.183.224 9027 FSPA* 0 0 13 1309 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:05:58.417081 2.993461 tcp 10.0.2.105 62932 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:06:07.409323 0.000000 tcp 10.0.2.105 62932 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:06:13.417791 3.004037 tcp 10.0.2.105 62933 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:06:22.420908 0.000000 tcp 10.0.2.105 62933 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:06:27.307879 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:06:28.419239 3.004201 tcp 10.0.2.105 62934 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:06:37.422334 0.000000 tcp 10.0.2.105 62934 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:08:57.015453 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 12:09:04.023025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:09:12.024505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:09:28.027296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:10:00.033823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:11:43.422900 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:11:43.423126 3.003710 tcp 10.0.2.105 62935 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:11:52.425095 0.000000 tcp 10.0.2.105 62935 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:11:58.425676 0.053781 tcp 10.0.2.105 62936 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:11:58.479846 0.072126 tcp 10.0.2.105 62937 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:11:58.552465 0.157874 tcp 10.0.2.105 62938 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:11:58.738511 3.000163 tcp 10.0.2.105 62939 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:07.747237 0.000000 tcp 10.0.2.105 62939 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:13.736325 0.051873 tcp 10.0.2.105 62940 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:13.788460 0.077644 tcp 10.0.2.105 62941 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:13.866421 0.166311 tcp 10.0.2.105 62942 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:14.118376 0.559544 tcp 10.0.2.105 62943 -> 128.255.183.224 9027 FSPA* 0 0 13 1446 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:14.380668 0.051345 tcp 10.0.2.105 62944 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:14.432377 0.075426 tcp 10.0.2.105 62945 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:14.508079 0.158539 tcp 10.0.2.105 62946 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:14.678184 3.003295 tcp 10.0.2.105 62947 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:23.680035 0.000000 tcp 10.0.2.105 62947 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:29.679723 0.053924 tcp 10.0.2.105 62948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:29.734000 0.074540 tcp 10.0.2.105 62949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:29.808922 0.158811 tcp 10.0.2.105 62950 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:12:29.998353 3.005140 tcp 10.0.2.105 62951 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:39.002169 0.000000 tcp 10.0.2.105 62951 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:44.991342 3.003832 tcp 10.0.2.105 62952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:53.993694 0.000000 tcp 10.0.2.105 62952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:12:58.810602 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:12:59.992420 0.139761 tcp 10.0.2.105 62953 -> 128.255.183.224 9027 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:13:20.268330 0.000300 tcp 10.0.2.105 62953 -> 128.255.183.224 9027 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:13:20.268843 3.006979 tcp 10.0.2.105 62954 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:13:29.274076 0.000000 tcp 10.0.2.105 62954 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:16:04.039222 3.001663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 12:16:11.046810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:16:19.048515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:16:35.051711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:17:07.057153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:18:35.265199 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:18:35.265456 2.993272 tcp 10.0.2.105 62955 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:18:44.267264 0.000000 tcp 10.0.2.105 62955 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:18:50.267551 0.054881 tcp 10.0.2.105 62956 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:18:50.322680 0.072316 tcp 10.0.2.105 62957 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:18:50.395347 0.165331 tcp 10.0.2.105 62958 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:18:50.624926 2.985665 tcp 10.0.2.105 62959 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:18:59.609373 0.000000 tcp 10.0.2.105 62959 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:05.618593 0.052955 tcp 10.0.2.105 62960 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:05.671869 0.075806 tcp 10.0.2.105 62961 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:05.747953 0.159882 tcp 10.0.2.105 62962 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:05.933515 0.594664 tcp 10.0.2.105 62963 -> 128.255.183.224 9027 FSPA* 0 0 13 1342 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:06.223567 0.053130 tcp 10.0.2.105 62964 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:06.277022 0.075711 tcp 10.0.2.105 62965 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:06.353106 0.163549 tcp 10.0.2.105 62966 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:06.528447 3.005114 tcp 10.0.2.105 62967 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:15.532492 0.000000 tcp 10.0.2.105 62967 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:21.523486 0.051169 tcp 10.0.2.105 62968 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:21.574902 0.070950 tcp 10.0.2.105 62969 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:21.645841 0.160496 tcp 10.0.2.105 62970 -> 195.113.214.251 443 SRPA* 0 0 20 11286 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:21.894300 3.001206 tcp 10.0.2.105 62971 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:30.894325 0.000000 tcp 10.0.2.105 62971 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:36.893665 2.993596 tcp 10.0.2.105 62972 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:45.895762 0.000000 tcp 10.0.2.105 62972 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:19:50.803040 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:19:51.894699 0.303956 tcp 10.0.2.105 62973 -> 128.255.183.224 9027 FSPA* 0 0 13 1342 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:19:52.198905 3.000486 tcp 10.0.2.105 62974 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:20:01.203118 0.000000 tcp 10.0.2.105 62974 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:23:11.063563 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 12:23:18.070971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:23:26.078894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:23:42.078632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:24:14.081542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:25:07.198389 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:25:07.198476 3.003810 tcp 10.0.2.105 62975 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:25:16.200763 0.000000 tcp 10.0.2.105 62975 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:25:22.201768 0.057021 tcp 10.0.2.105 62976 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:22.259079 0.070851 tcp 10.0.2.105 62977 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:22.330285 0.160918 tcp 10.0.2.105 62978 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:22.627472 3.006678 tcp 10.0.2.105 62979 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:25:31.632876 0.000000 tcp 10.0.2.105 62979 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/04 12:25:37.621953 0.053021 tcp 10.0.2.105 62980 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:37.675249 0.074932 tcp 10.0.2.105 62981 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:37.750477 0.151679 tcp 10.0.2.105 62982 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:25:37.959339 0.953392 tcp 10.0.2.105 62983 -> 128.255.183.224 9027 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:28:38.521989 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:28:38.522175 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 12:28:55.688600 0.052368 tcp 10.0.2.105 62984 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:28:55.741230 0.073980 tcp 10.0.2.105 62985 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:28:55.815527 0.158477 tcp 10.0.2.105 62986 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:28:55.974640 0.177483 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:28:56.276834 0.098911 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:28:56.354913 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 12:29:13.632562 0.050770 tcp 10.0.2.105 62987 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:29:13.683620 0.070952 tcp 10.0.2.105 62988 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:29:13.754942 0.154880 tcp 10.0.2.105 62989 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:29:13.910459 0.160697 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:14.133375 0.253643 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:14.341045 0.181546 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2569 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:14.574658 0.237916 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:14.789392 0.263902 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.017044 0.173371 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.182622 0.174281 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.353274 0.251263 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2554 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.584745 0.106739 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.672337 0.080236 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.736914 0.171830 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.849106 0.111416 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:15.999456 0.214561 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.206615 0.138517 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.358212 0.092638 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.427791 0.176514 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.600867 0.057867 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.693079 0.058329 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:16.833305 0.399304 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:17.203669 0.060300 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:17.428012 0.171709 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:17.595222 0.139498 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:17.701958 0.148650 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:17.860690 0.171527 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.009614 0.144214 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.146100 0.202685 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.338937 0.075500 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.592069 0.171818 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 6 2592 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.789147 0.088341 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.861549 0.093799 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:29:18.973602 0.075782 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:30:18.092151 2.996952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 12:30:25.101804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:30:33.096349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:30:49.099150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:31:21.105547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:37:25.111369 3.001848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 12:37:32.118899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:37:40.120434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:37:56.123240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:38:28.129549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:44:32.135421 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 12:44:39.142729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:44:47.144231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:45:03.147312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:45:35.158889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:54:45.167634 3.001008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 12:54:52.174088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:55:00.175642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:55:16.178694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:55:38.911881 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:55:38.912028 1.163846 tcp 10.0.2.105 62990 -> 128.255.183.224 9027 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:55:48.184743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 12:59:36.293115 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 12:59:36.293223 0.084764 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:36.378394 0.176444 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:36.555244 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 12:59:51.967341 0.053648 tcp 10.0.2.105 62991 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:59:52.021259 0.073769 tcp 10.0.2.105 62992 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:59:52.095320 0.164103 tcp 10.0.2.105 62993 -> 195.113.214.251 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/04 12:59:52.260242 0.154422 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:52.415012 0.211416 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:52.626816 0.285183 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:52.912552 0.211238 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.124200 0.220533 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.345143 0.166278 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.511882 0.075299 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.587623 0.064727 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.652758 0.115460 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.768688 0.102656 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:53.871684 0.202281 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.074333 0.167249 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.241953 0.195156 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.437506 0.137660 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.575558 0.075280 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.651233 0.171844 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.823431 0.104733 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.928634 0.055285 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:54.984264 0.323562 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.308296 0.107274 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.416030 0.145711 udp 10.0.2.105 7010 <-> 12.30.80.194 8342 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.562179 0.141465 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.704065 0.130641 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.835131 0.057661 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:55.893184 0.145625 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.039255 0.347481 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.387148 0.057907 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.445524 0.145086 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.590973 0.088612 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.679940 0.092174 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/04 12:59:56.772541 0.057404 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:01:52.191138 3.001484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:01:59.198045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:02:07.199512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:02:23.203274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:02:55.209209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:09:01.217702 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:09:08.225115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:09:16.226839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:09:32.229269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:10:04.235801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:16:08.241946 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:16:15.248879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:16:23.250345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:16:39.253546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:17:11.259794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:23:15.266700 3.000417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:23:22.273452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:23:30.280637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:23:46.281424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:24:18.283586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:25:40.081547 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 13:25:40.081742 1.067239 tcp 10.0.2.105 62994 -> 128.255.183.224 9027 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:30:22.298411 2.992571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:30:26.172985 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 13:30:26.173137 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 13:30:29.296907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:30:37.298267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:30:44.239904 0.052832 tcp 10.0.2.105 62995 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:30:44.293066 0.076322 tcp 10.0.2.105 62996 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:30:44.369701 0.160109 tcp 10.0.2.105 62997 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:30:44.530467 0.069949 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:30:44.600842 0.000000 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 13:30:53.301569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:31:02.615661 0.051227 tcp 10.0.2.105 62998 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:02.667171 0.066173 tcp 10.0.2.105 62999 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:02.733660 0.153606 tcp 10.0.2.105 63000 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:02.888297 0.152540 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.041293 0.279199 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.320905 0.075406 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.396708 0.212216 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.609381 0.230135 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.839886 0.060357 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:03.900659 0.123048 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.024063 0.103155 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.127622 0.201678 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.329745 0.168767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.498943 0.165748 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.665104 0.184521 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:04.850042 0.195818 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.046298 0.151712 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.198435 0.074889 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.273717 0.171605 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.445707 0.049801 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.495957 0.055690 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.552093 0.324581 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:05.877039 0.142820 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:06.020243 0.134502 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:06.155406 0.057592 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:06.213416 0.145249 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:06.359068 0.099217 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:06.458749 0.000000 udp 10.0.2.105 7010 -> 12.30.80.194 8342 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 13:31:24.807307 0.051869 tcp 10.0.2.105 63001 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:24.859461 0.071803 tcp 10.0.2.105 63002 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:24.931520 0.166263 tcp 10.0.2.105 63003 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:25.098300 0.188581 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:25.287352 0.056553 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:25.307812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:31:25.344366 0.143429 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:25.488177 0.082245 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:31:25.570787 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 13:31:44.455427 0.052276 tcp 10.0.2.105 63004 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:44.508040 0.072540 tcp 10.0.2.105 63005 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:44.580438 0.159290 tcp 10.0.2.105 63006 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:31:44.740644 0.062942 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/04 13:37:29.315227 3.067135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:37:36.358450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:37:44.332537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:38:00.335304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:38:32.341455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:44:36.347980 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:44:43.354881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:44:51.356393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:45:07.359529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:45:39.365661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:54:48.379596 3.005184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 13:54:55.384805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:55:03.386325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:55:19.389393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 13:55:41.150631 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 13:55:41.150777 0.955683 tcp 10.0.2.105 63007 -> 128.255.183.224 9027 FSPA* 0 0 14 1671 flow=From-Botnet-V2-TCP-Established 1970/02/04 13:55:51.395383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:01:55.402333 3.000795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:01:58.473581 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 14:01:58.473696 0.178013 udp 10.0.2.105 7010 <-> 187.162.38.22 1127 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:01:58.652185 0.000000 udp 10.0.2.105 7010 -> 12.30.80.194 8342 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 14:02:02.409020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:02:10.410312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:02:17.502462 0.052126 tcp 10.0.2.105 63008 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:02:17.554936 0.071475 tcp 10.0.2.105 63009 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:02:17.626767 0.155827 tcp 10.0.2.105 63010 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:02:17.783133 0.072913 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:17.856449 0.078507 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:17.935335 0.160965 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.096671 0.215720 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.312836 0.222114 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.535338 0.066889 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.602673 0.127527 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.730668 0.102994 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.834037 0.081837 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:18.916436 0.202796 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:19.119679 0.170342 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:19.290476 0.199566 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:19.490446 0.137678 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:19.628584 0.205123 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:19.834138 0.165413 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:20.000006 0.427924 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:20.428547 0.097288 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:20.526215 0.055415 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:20.582016 0.318604 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:20.901021 0.143692 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.045082 0.139554 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.185046 0.056965 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.242432 0.069784 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.312610 0.173968 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.487038 0.096354 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.583806 0.143912 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.728117 0.070919 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.799436 0.054537 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:21.854390 0.187654 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:22.042444 0.145591 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:22.188442 0.056560 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:02:26.413431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:02:58.419419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:09:04.431098 3.026216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:09:11.447660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:09:19.447086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:09:35.450236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:10:07.456402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:16:11.461863 3.002006 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:16:18.469625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:16:26.471142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:16:42.474165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:17:14.480599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:23:18.486870 3.001023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:23:25.493135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:23:33.495168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:23:49.497947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:24:21.504063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:25:42.100629 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 14:25:42.100860 1.004561 tcp 10.0.2.105 63011 -> 128.255.183.224 9027 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:30:25.510501 3.001461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:30:32.517667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:30:40.519329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:30:56.522095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:31:28.528507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:32:29.266051 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 14:32:29.266157 0.175483 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 14:32:29.441640 0.000000 icmp 187.162.38.22 0x0303 -> 10.0.2.105 0x6704 URP 192 1 171 flow=Background 1970/02/04 14:32:46.342463 0.052477 tcp 10.0.2.105 63012 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:32:46.395205 0.061432 tcp 10.0.2.105 63013 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:32:46.456941 0.155629 tcp 10.0.2.105 63014 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:32:46.613052 0.159355 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:32:46.772783 0.218454 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:32:46.991630 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 14:33:04.797137 0.052681 tcp 10.0.2.105 63015 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:33:04.850189 0.064431 tcp 10.0.2.105 63016 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:33:04.914978 0.154986 tcp 10.0.2.105 63017 -> 195.113.214.251 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:33:05.070562 0.074129 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.145078 0.223324 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.368865 0.066004 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.435254 0.124322 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.559969 0.098190 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.658572 0.077086 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.736016 0.197548 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:05.933984 0.169775 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:06.104162 0.200044 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:06.304735 0.137870 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:06.442977 0.202776 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:06.646129 0.166829 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:06.813343 0.354663 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.168529 0.044715 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.213670 0.055458 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.269527 0.389493 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.659467 0.144949 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.804836 0.133418 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.938665 0.056688 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:07.995767 0.068742 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.064911 0.170817 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.236121 0.098009 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.334534 0.056231 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.391242 0.190534 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.582144 0.142055 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.724653 0.059275 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.784359 0.143124 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:33:08.927959 0.073168 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/04 14:37:32.534273 3.040085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 14:37:39.552169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:37:47.552985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:38:03.556355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:38:35.562255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:44:39.568177 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:44:46.575680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:44:54.577310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:45:10.580117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:45:42.585908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:54:50.596138 3.017465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 14:54:57.614103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:55:05.615645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:55:21.618663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 14:55:43.109683 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 14:55:43.109778 0.991512 tcp 10.0.2.105 63018 -> 128.255.183.224 9027 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/02/04 14:55:53.624790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:01:57.631016 3.001135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:02:04.637845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:02:12.639387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:02:28.642679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:03:00.658827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:03:14.248797 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 15:03:14.248901 0.176654 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 15:03:14.425555 0.000000 icmp 187.162.38.22 0x0303 -> 10.0.2.105 0x6704 URP 192 1 304 flow=Background 1970/02/04 15:03:33.007081 0.052543 tcp 10.0.2.105 63019 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:03:33.059915 0.065679 tcp 10.0.2.105 63020 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:03:33.125876 0.158978 tcp 10.0.2.105 63021 -> 195.113.214.251 443 SRPA* 0 0 39 31852 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:03:33.285741 0.070487 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:33.356636 0.158907 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:33.515990 0.214847 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:33.731230 0.069425 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:33.801065 0.222753 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.024165 0.062982 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.087600 0.116745 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.204794 0.101543 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.306751 0.078221 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.385397 0.203331 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.589075 0.168377 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.757821 0.206277 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:34.964499 0.137777 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.102760 0.202552 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.305701 0.166200 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.472375 0.115594 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.588446 0.058750 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.647666 0.143903 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.791939 0.141440 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.933775 0.058045 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:35.992393 0.089835 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.082632 0.171555 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.254601 0.054907 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.309999 0.321960 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.632345 0.109376 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.742099 0.055362 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.797924 0.191181 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:36.989526 0.145774 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:37.135683 0.061770 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:37.197858 0.144390 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:03:37.342654 0.074130 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:09:06.667019 3.002220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:09:13.674799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:09:21.675942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:09:37.679536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:10:09.685536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:16:13.694819 2.998479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:16:20.698723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:16:28.700766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:16:44.703293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:17:16.709431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:23:20.715259 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:23:27.722893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:23:35.724389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:23:51.727246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:24:23.733141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:25:44.109398 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 15:25:44.109511 1.158244 tcp 10.0.2.105 63022 -> 128.255.183.224 9027 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:30:27.739092 3.002222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:30:34.746752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:30:42.748527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:30:58.751222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:31:30.757383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:33:47.483997 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 15:33:47.484090 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 15:34:05.841982 0.053118 tcp 10.0.2.105 63023 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:34:05.895293 0.067438 tcp 10.0.2.105 63024 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:34:05.963030 0.159291 tcp 10.0.2.105 63025 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:34:06.122829 0.156826 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.280057 0.214323 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.494847 0.077695 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.572931 0.216233 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.789605 0.061520 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.851603 0.084155 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:06.936193 0.200987 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.137573 0.169738 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.307760 0.109943 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.418152 0.100924 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.519491 0.185915 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.705862 0.138047 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:07.844382 0.205494 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.050334 0.166381 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.245580 0.439531 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.685471 0.045886 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.731805 0.056937 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.789149 0.074020 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:08.863582 0.172076 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.036066 0.054716 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.091141 0.144312 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.235878 0.134798 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.371078 0.326242 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.697673 0.127982 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.826055 0.056088 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:09.882549 0.187157 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:10.070134 0.142760 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:10.213263 0.063929 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:10.277614 0.144359 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:34:10.422418 0.084828 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/04 15:37:34.764493 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:37:41.771079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:37:49.772301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:38:05.775019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:38:37.781268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:44:41.787286 3.001184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:44:48.794557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:44:56.796278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:45:12.799254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:45:44.805077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:54:52.815259 3.005291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 15:54:59.823238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:55:07.824599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:55:23.828908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 15:55:45.269495 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 15:55:45.269599 0.955656 tcp 10.0.2.105 63026 -> 128.255.183.224 9027 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/04 15:55:55.838568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:01:59.839906 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:02:06.847295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:02:14.848808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:02:30.851712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:03:02.857566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:04:16.554256 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 16:04:16.554420 0.071169 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:16.626021 0.161377 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:16.787901 0.215253 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.003524 0.087699 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.091641 0.223156 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.315188 0.061446 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.377069 0.084902 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.462381 0.204937 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.667753 0.106564 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.774734 0.191296 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:17.966424 0.145033 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:18.111873 0.205395 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:18.317663 0.165239 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:18.483281 0.168927 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:18.652747 0.114848 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:18.768007 0.256455 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.024857 0.044717 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.069994 0.057565 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.127919 0.074468 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.202791 0.174411 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.377576 0.056488 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.434461 0.145522 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.580443 0.135914 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:19.716738 0.321213 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.038340 0.098272 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.137052 0.055905 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.193348 0.192346 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.386143 0.145386 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.531907 0.079326 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.611661 0.059788 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:04:20.671858 0.143499 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:09:09.868195 3.001537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:09:16.875226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:09:24.876886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:09:40.879900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:10:12.885820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:16:16.891618 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:16:23.899249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:16:31.900982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:16:47.904029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:17:19.909366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:23:23.915794 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:23:30.923600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:23:38.924990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:23:54.932906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:24:26.937250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:25:46.227935 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 16:25:46.228160 1.121292 tcp 10.0.2.105 63027 -> 128.255.183.224 9027 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/02/04 16:30:30.942166 3.000672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:30:37.947399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:30:45.948254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:31:01.951916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:31:33.957743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:34:30.021595 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 16:34:30.021709 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 16:34:48.799963 0.061480 tcp 10.0.2.105 63028 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 16:34:48.861733 0.063472 tcp 10.0.2.105 63029 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 16:34:48.925475 0.155570 tcp 10.0.2.105 63030 -> 195.113.214.251 443 SRPA* 0 0 59 37778 flow=From-Botnet-V2-TCP-Established 1970/02/04 16:34:49.081692 0.156716 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.238885 0.215185 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.454479 0.130887 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.585736 0.214485 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.800600 0.066767 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.867775 0.079356 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:49.947559 0.199347 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.147340 0.131032 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.278781 0.211036 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.490188 0.198153 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.688704 0.100955 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.790046 0.166395 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:50.956821 0.168817 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.126036 0.112849 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.239291 0.191624 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.431358 0.046763 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.478514 0.171681 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.650619 0.056386 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.707420 0.144928 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.852819 0.133464 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:51.986756 0.057352 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:52.044559 0.078458 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:52.123444 0.569171 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:52.693065 0.097254 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:52.790699 0.071258 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:52.862366 0.191474 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:53.054239 0.143338 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:53.198004 0.081939 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:53.280365 0.056035 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:34:53.336802 0.142512 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/04 16:37:37.964066 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:37:44.971870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:37:52.973335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:38:08.975825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:38:40.981788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:44:44.987962 3.001631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:44:51.995251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:44:59.997010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:45:15.999436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:45:48.005881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:51:52.013129 3.000295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:51:59.020902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:52:07.021142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:52:23.023735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:52:55.029834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:55:47.258185 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 16:55:47.258336 0.945397 tcp 10.0.2.105 63031 -> 128.255.183.224 9027 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/02/04 16:58:59.035622 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 16:59:06.043218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:59:14.044933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 16:59:30.047233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:00:02.053876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:04:59.942611 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 17:04:59.942754 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 17:05:16.047403 0.062951 tcp 10.0.2.105 63032 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:05:16.110683 0.061729 tcp 10.0.2.105 63033 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:05:16.172673 0.156448 tcp 10.0.2.105 63034 -> 195.113.214.251 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:05:16.329725 0.152494 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:16.482666 0.213890 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:16.697008 0.072136 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:16.769549 0.224104 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:16.994058 0.061994 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.056666 0.082023 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.139069 0.201097 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.340638 0.207091 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.548125 0.100997 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.649532 0.165486 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.815390 0.169101 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:17.984861 0.107501 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.092757 0.145082 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.238264 0.208159 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.446892 0.066107 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.513463 0.047529 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.561415 0.172057 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.733891 0.056814 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.791094 0.143890 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:18.935403 0.132311 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.068082 0.057436 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.125971 0.074339 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.200751 0.068057 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.269243 0.184886 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.454490 0.145145 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.600161 0.328415 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:19.929025 0.095980 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:20.025373 0.143923 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:20.169679 0.072810 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:05:20.242888 0.056465 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:06:31.066507 3.000695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:06:38.073521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:06:46.074504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:07:02.077921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:07:34.083123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:13:39.091946 3.000905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:13:46.098682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:13:54.099846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:14:10.103436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:14:42.109135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:20:46.115620 3.005822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:20:53.122811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:21:01.123889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:21:17.127153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:21:49.133253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:25:48.196788 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 17:25:48.197002 1.016611 tcp 10.0.2.105 63035 -> 128.255.183.224 9027 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:27:53.139571 3.001023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:28:00.146798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:28:08.148180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:28:24.150827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:28:56.157136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:35:00.162919 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:35:07.170287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:35:15.171879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:35:29.122534 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 17:35:29.122645 0.160747 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.283842 0.213078 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.497329 0.072492 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.570199 0.222230 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.792893 0.064432 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.857797 0.078244 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:29.936443 0.206879 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.143819 0.201407 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.345665 0.097701 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.443783 0.170581 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.614812 0.169068 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.784477 0.106718 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:30.891628 0.138036 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.030069 0.205107 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.174964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:35:31.235555 0.073110 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.309008 0.048181 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.357631 0.212107 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.570141 0.056570 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.627157 0.146965 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.774523 0.134318 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.909186 0.056901 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:31.966463 0.000000 udp 10.0.2.105 7010 -> 213.120.99.87 9496 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 17:35:49.022462 0.064079 tcp 10.0.2.105 63036 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:35:49.086350 0.062035 tcp 10.0.2.105 63037 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:35:49.148684 0.156674 tcp 10.0.2.105 63038 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 17:35:49.306017 0.058221 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:49.364649 0.319048 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:49.684093 0.094176 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:49.778713 0.142167 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:49.921306 0.084406 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:50.006048 0.057816 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:50.064205 0.201197 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:35:50.265797 0.143501 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/04 17:36:03.181179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:42:07.186265 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:42:14.194251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:42:22.195983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:42:38.198972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:43:10.205109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:53:31.221233 3.002523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 17:53:38.228414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:53:46.229441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:54:02.232292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:54:34.238753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 17:55:49.200430 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 17:55:49.200533 0.994216 tcp 10.0.2.105 63039 -> 128.255.183.224 9027 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/04 18:00:38.244667 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:00:45.251760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:00:53.253289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:01:09.256874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:01:41.263025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:06:02.370424 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 18:06:02.370587 0.069106 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:02.440349 0.214076 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:02.654850 0.070676 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:02.726037 0.216452 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:02.942967 0.060414 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:03.003808 0.530684 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:03.534971 0.188071 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:03.723582 0.154864 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:03.878870 0.165766 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.045048 0.167945 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.213365 0.196651 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.410421 0.144955 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.555773 0.206520 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.762682 0.115241 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.878405 0.097619 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:04.976521 0.172782 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.149727 0.059015 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.209170 0.144267 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.353925 0.131423 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.485814 0.058426 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.544649 0.044694 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.589785 0.066801 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.657056 0.097679 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.755133 0.142406 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.897993 0.071547 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:05.969902 0.061376 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:06.031697 0.186689 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:06.218788 0.055836 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:06.275030 0.330852 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:06:06.606307 0.145233 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:07:45.267886 3.001947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:07:52.275941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:08:00.277203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:08:16.279820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:08:48.288017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:14:52.294658 2.999358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:14:59.299991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:15:07.301443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:15:23.304322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:15:55.310193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:21:59.320652 2.997450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:22:06.324476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:22:14.328829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:22:30.328375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:23:02.334382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:25:50.186510 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 18:25:50.186636 0.972100 tcp 10.0.2.105 63040 -> 128.255.183.224 9027 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/04 18:29:06.340549 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:29:13.347670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:29:21.349478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:29:37.352612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:30:09.358409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:36:13.365119 3.000833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:36:20.371966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:36:21.173568 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 18:36:21.173738 0.068665 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.242891 0.214371 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.457728 0.072784 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.530907 0.211850 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.743128 0.060876 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.804472 0.078513 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:21.883431 0.186688 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:22.070572 0.156928 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:22.227965 0.167051 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:22.395455 0.171205 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:22.567059 0.286328 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:22.853802 0.151694 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.005895 0.200866 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.207196 0.104106 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.311680 0.097560 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.409642 0.172059 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.582106 0.056385 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.638944 0.145281 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.784689 0.138283 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.923359 0.056315 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:23.980072 0.047549 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.028060 0.068702 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.097186 0.098605 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.196186 0.144545 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.341159 0.079014 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.420601 0.057522 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.478491 0.185599 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.664576 0.054639 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:24.719574 0.325150 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:25.045149 0.223260 udp 10.0.2.105 7010 <-> 65.93.197.57 5656 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 18:36:28.373468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:36:44.376928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:37:16.382486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:43:20.389056 3.001029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:43:27.395744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:43:35.397101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:43:51.400055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:44:23.406436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:54:09.422146 3.019030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 18:54:16.439280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:54:24.440189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:54:40.443337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:55:12.449379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 18:55:51.165613 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 18:55:51.165724 0.975135 tcp 10.0.2.105 63041 -> 128.255.183.224 9027 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:01:16.455655 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:01:23.462816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:01:31.463940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:01:47.467882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:02:19.473565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:06:36.753387 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 19:06:36.753585 0.283084 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:37.037062 0.217865 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:37.255408 0.072484 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:37.328326 0.213131 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:37.541850 0.062592 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:37.604841 0.825638 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:38.430942 0.187094 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:38.618377 0.159069 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:38.777812 0.209943 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:38.988185 0.144770 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.133354 0.213270 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.347125 0.165665 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.513159 0.168297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.681878 0.101204 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.783473 0.110660 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:39.894494 0.174045 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.068919 0.056120 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.125394 0.145043 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.270841 0.134660 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.405878 0.056739 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.463061 0.043530 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.506994 0.068462 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.575906 0.101662 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.678020 0.057922 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.736361 0.189505 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.926208 0.062706 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:40.989326 0.321502 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:41.311181 0.000000 udp 10.0.2.105 7010 -> 65.93.197.57 5656 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 19:06:58.636594 0.060787 tcp 10.0.2.105 63042 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:06:58.697678 0.066974 tcp 10.0.2.105 63043 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:06:58.764902 0.162897 tcp 10.0.2.105 63044 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:06:58.928471 0.145756 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:06:59.074688 0.078172 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:08:23.479181 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:08:30.486790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:08:38.488444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:08:54.491444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:09:26.497535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:15:30.503151 3.003859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:15:37.510731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:15:45.512373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:16:01.515278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:16:33.521678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:22:37.527278 3.001868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:22:44.534180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:22:52.536617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:23:08.539274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:23:40.552485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:25:52.145237 0.000226 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 19:25:52.145627 0.974981 tcp 10.0.2.105 63045 -> 128.255.183.224 9027 FSPA* 0 0 14 1514 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:29:44.555241 2.997926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:29:51.559386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:29:59.560082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:30:15.563161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:30:47.569529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:36:51.576178 3.001067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:36:58.582965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:37:06.583979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:37:08.797577 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 19:37:08.797681 0.000000 udp 10.0.2.105 7010 -> 65.93.197.57 5656 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 19:37:22.587248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:37:27.375767 0.063086 tcp 10.0.2.105 63046 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:27.439142 0.063020 tcp 10.0.2.105 63047 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:27.502443 0.160941 tcp 10.0.2.105 63048 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:27.664012 0.067801 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:27.732266 0.212956 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:27.945710 0.062016 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.008113 0.222522 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.231027 0.071022 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.302424 0.083125 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.385937 0.154754 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.541098 0.200594 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.742135 0.164860 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:28.907416 0.130937 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.038753 0.202852 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.242035 0.124305 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.366748 0.168716 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.535869 0.204843 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.741084 0.171342 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:29.962565 0.056226 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:30.019206 0.145153 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:30.164859 0.136625 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:30.301994 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 19:37:47.643860 0.060816 tcp 10.0.2.105 63049 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:47.704976 0.060875 tcp 10.0.2.105 63050 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:47.766170 0.158447 tcp 10.0.2.105 63051 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 19:37:47.925114 0.048143 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:47.974216 0.086971 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.061597 0.098277 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.160483 0.097147 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.258010 0.322923 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.581329 0.065755 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.647519 0.187228 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.835167 0.055614 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:48.891226 0.143924 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:49.035614 0.077493 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/04 19:37:54.593280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:43:58.599210 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:44:05.606967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:44:13.607937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:44:29.611179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:45:01.617437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:54:29.627885 3.005264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 19:54:36.633806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:54:44.637801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:55:00.638527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:55:32.644597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 19:55:53.124504 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 19:55:53.124581 0.960299 tcp 10.0.2.105 63052 -> 128.255.183.224 9027 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:01:36.650095 3.012262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:01:43.667962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:01:51.669481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:02:07.672539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:02:39.678693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:07:55.532795 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 20:07:55.532948 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 20:08:13.200039 0.031350 tcp 10.0.2.105 63053 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:08:13.231717 0.069426 tcp 10.0.2.105 63054 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:08:13.301432 0.159419 tcp 10.0.2.105 63055 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:08:13.461345 0.067503 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:13.529239 0.214767 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:13.744564 0.071384 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:13.816487 0.210795 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.027705 0.091637 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.119718 0.154771 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.275289 0.185974 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.461637 0.165994 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.627992 0.072328 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.700739 0.209658 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:14.910788 0.151714 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.062867 0.211590 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.274836 0.171765 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.447014 0.057727 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.505118 0.145343 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.650874 0.138312 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.789576 0.167609 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:15.957660 0.132431 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.090572 0.107984 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.199012 0.099058 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.298487 0.045252 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 199 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.344175 0.075456 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.420358 0.317840 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.738601 0.063425 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.802407 0.187759 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:16.990621 0.063953 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:17.055030 0.147197 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:17.202641 0.078701 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:08:43.683928 3.002031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:08:50.693602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:08:58.693333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:09:14.696213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:09:46.702580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:15:50.708519 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:15:57.716237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:16:05.717451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:16:21.720313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:16:53.726589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:22:57.732548 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:23:04.739722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:23:12.741415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:23:28.744540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:24:00.750097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:25:54.073725 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 20:25:54.073847 1.002522 tcp 10.0.2.105 63056 -> 128.255.183.224 9027 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:30:04.757956 3.007677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:30:11.763802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:30:19.765213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:30:35.773101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:31:07.774415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:37:11.780435 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:37:18.790229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:37:26.788829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:37:42.792021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:38:14.798591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:38:35.658794 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 20:38:35.658902 0.063738 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:35.723120 0.221816 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:35.945408 0.098191 udp 10.0.2.105 7010 <-> 81.156.116.102 4918 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:36.043979 0.212531 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:36.256926 0.703560 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:36.960895 0.152452 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:37.113703 0.194708 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:37.308751 0.166184 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:37.475340 0.000000 udp 10.0.2.105 7010 -> 213.120.99.87 9496 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 20:38:53.755866 0.061007 tcp 10.0.2.105 63057 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:38:53.817126 0.070207 tcp 10.0.2.105 63058 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:38:53.887645 0.153307 tcp 10.0.2.105 63059 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 20:38:54.041458 0.276902 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:54.318785 0.124061 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:54.443269 0.204248 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:54.647935 0.172434 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:54.820776 0.061403 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:54.905586 0.143293 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.049262 0.117093 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.166805 0.167729 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.334987 0.131847 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.467284 0.162741 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.630442 0.101429 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.732480 0.048182 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.781069 0.077076 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:55.858551 0.322199 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:56.181099 0.060062 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:56.241578 0.190544 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:56.432529 0.057767 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:56.490707 0.147569 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:38:56.638807 0.077355 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/04 20:44:18.803751 3.002007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:44:25.811558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:44:33.813059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:44:49.815949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:45:21.822463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:54:39.836934 3.001719 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 20:54:46.844635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:54:54.846047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:55:10.850165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:55:42.855190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 20:55:55.083407 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 20:55:55.083495 0.991887 tcp 10.0.2.105 63060 -> 128.255.183.224 9027 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:01:46.860158 3.022157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:01:53.888831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:02:01.892112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:02:17.893323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:02:49.899334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:08:53.905985 3.000751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:09:00.912552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:09:08.913938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:09:13.590927 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 21:09:13.591093 0.070075 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:13.661629 0.221463 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:13.883512 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 21:09:24.917225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:09:31.268596 0.058669 tcp 10.0.2.105 63061 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:09:31.327557 0.069869 tcp 10.0.2.105 63062 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:09:31.397784 0.159271 tcp 10.0.2.105 63063 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:09:31.557575 0.212656 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:31.770688 0.072598 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:31.843668 0.157413 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.001477 0.279625 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.281544 0.199646 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.481644 0.166905 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.648964 0.209270 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.858682 0.138297 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:32.997425 0.203891 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.201728 0.170335 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.372416 0.057016 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.429854 0.145985 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.576239 0.105976 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.682593 0.169427 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.852450 0.131504 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:33.984344 0.099264 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.084072 0.098325 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.182792 0.043621 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.226819 0.069760 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.296974 0.321830 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.619275 0.063003 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.682742 0.147322 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.830432 0.094148 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:34.924952 0.187563 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:35.112880 0.054372 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:09:56.923093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:16:00.930232 3.000468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:16:07.936668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:16:15.937352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:16:31.940804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:17:03.946930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:23:07.953225 3.001018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:23:14.960065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:23:22.962137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:23:38.965198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:24:10.971763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:25:56.082481 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 21:25:56.082573 0.944081 tcp 10.0.2.105 63064 -> 128.255.183.224 9027 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:30:14.977436 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:30:21.984558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:30:29.986101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:30:45.988569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:31:17.994880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:37:22.001198 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:37:29.008456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:37:37.012043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:37:53.013341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:38:25.018323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:39:35.831171 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 21:39:35.831352 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 21:39:53.037548 0.051281 tcp 10.0.2.105 63065 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:39:53.089101 0.074088 tcp 10.0.2.105 63066 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:39:53.163513 0.156162 tcp 10.0.2.105 63067 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 21:39:53.320501 0.070064 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:53.390971 0.219901 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:53.611262 0.212268 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:53.823993 0.062144 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:53.886549 0.157126 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.044134 0.074315 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.118904 0.213673 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.332957 0.144923 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.478251 0.205357 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.684054 0.190836 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:54.875259 0.164248 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.039852 0.171055 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.211290 0.056220 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.267960 0.143020 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.411419 0.129385 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.541256 0.168800 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.710502 0.135995 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.846858 0.096456 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:55.943768 0.097309 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.041480 0.044337 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.086228 0.072493 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.159105 0.145614 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.305111 0.088295 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.393761 0.187211 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.581381 0.056945 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.642084 0.322535 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:39:56.964977 0.063118 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/04 21:44:29.025135 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:44:36.032764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:44:44.033372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:45:00.037051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:45:32.042913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:54:46.051715 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 21:54:53.059092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:55:01.061057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:55:17.063814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:55:49.070092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 21:55:57.031754 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 21:55:57.031899 0.986491 tcp 10.0.2.105 63068 -> 128.255.183.224 9027 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:01:53.076040 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:02:00.083437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:02:08.085057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:02:24.087929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:02:56.094140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:09:00.099539 3.002068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:09:07.107468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:09:15.108488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:09:31.111760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:10:03.117348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:10:09.036133 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 22:10:09.036342 0.210832 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:09.247622 0.000000 udp 10.0.2.105 7010 -> 31.52.60.84 4672 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 22:10:27.315213 0.053570 tcp 10.0.2.105 63069 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:10:27.369132 0.070576 tcp 10.0.2.105 63070 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:10:27.439604 0.159342 tcp 10.0.2.105 63071 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:10:27.599602 0.158622 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:27.758640 0.740583 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:28.499646 0.068149 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:28.568220 0.214535 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:28.783216 0.203577 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:28.987210 0.145116 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.132723 0.200752 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.333923 0.197670 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.532055 0.164422 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.696868 0.171676 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.868968 0.060300 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:29.929716 0.143378 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.073531 0.114503 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.188516 0.169617 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.358508 0.136287 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.495159 0.096575 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.592110 0.100886 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.693465 0.060849 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.754731 0.073515 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:30.828647 0.190754 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:31.019822 0.050748 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:31.071016 0.337443 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:31.408839 0.056690 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:31.465923 0.146894 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:10:31.613226 0.081322 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:16:07.123878 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:16:14.131285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:16:22.133346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:16:38.136217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:17:10.141828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:23:14.150396 3.013238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:23:21.168875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:23:29.166713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:23:45.170734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:24:17.175842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:25:58.001281 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 22:25:58.001399 0.961836 tcp 10.0.2.105 63072 -> 128.255.183.224 9027 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:30:21.181816 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:30:28.189459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:30:36.190896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:30:52.193991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:31:24.199948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:37:28.206118 3.002466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:37:35.213327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:37:43.214983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:37:59.217842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:38:31.225427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:41:00.358595 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 22:41:00.358790 0.071201 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:00.430423 0.212871 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:00.643689 0.155838 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:00.799899 0.213128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:01.013383 0.290695 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:01.304522 0.123960 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:01.428863 0.070412 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:01.499695 0.075437 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:01.575581 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 22:41:20.578599 0.054127 tcp 10.0.2.105 63073 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:41:20.633091 0.074822 tcp 10.0.2.105 63074 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:41:20.708213 0.169621 tcp 10.0.2.105 63075 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/04 22:41:20.878441 0.181432 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.060326 0.165184 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.225893 0.171649 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.397984 0.057462 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.455844 0.147092 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.603413 0.126729 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.730522 0.169757 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:21.900706 0.136302 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.037423 0.110996 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.148840 0.105668 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.254927 0.044724 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.300027 0.073196 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.373646 0.188180 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.562195 0.052229 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.614801 0.146980 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.762181 0.076367 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:22.838971 0.337949 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:41:23.177296 0.061352 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/04 22:44:35.230625 3.046069 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:44:42.258637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:44:50.248833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:45:06.251867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:45:38.257646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:54:44.268172 2.998574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 22:54:51.273047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:54:59.274325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:55:15.277277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:55:47.283442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 22:55:58.941023 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 22:55:58.941133 0.988122 tcp 10.0.2.105 63076 -> 128.255.183.224 9027 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:01:51.289600 3.013244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:01:58.307147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:02:06.308397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:02:22.311860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:02:54.317560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:09:00.326058 3.030400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:09:07.343789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:09:15.345195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:09:31.348448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:10:03.353942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:11:36.459086 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 23:11:36.459205 0.205383 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:36.665054 0.158654 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:36.824096 0.228128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:37.052646 0.068542 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:37.121571 0.212475 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:37.334446 0.080849 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:37.415700 0.000000 udp 10.0.2.105 7010 -> 213.120.99.87 9496 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 23:11:53.374690 0.052185 tcp 10.0.2.105 63077 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:11:53.427160 0.076031 tcp 10.0.2.105 63078 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:11:53.503468 0.159820 tcp 10.0.2.105 63079 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:11:53.663945 0.673256 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:54.337647 0.138183 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:54.476194 0.190812 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:54.667395 0.164543 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:54.832461 0.172343 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.005185 0.061009 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.066627 0.145291 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.212377 0.130016 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.342764 0.168240 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.511462 0.132953 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.644791 0.096992 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.742197 0.101256 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:55.843868 0.187002 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:56.031308 0.052369 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:56.084066 0.146739 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:56.231234 0.074385 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:56.306013 0.321202 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:11:56.627599 0.000000 udp 10.0.2.105 7010 -> 86.184.78.9 7427 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 23:12:15.294378 0.078180 tcp 10.0.2.105 63080 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:12:15.372884 0.075076 tcp 10.0.2.105 63081 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:12:15.448454 0.165283 tcp 10.0.2.105 63082 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:12:15.614349 0.049441 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:12:15.664174 0.073521 udp 10.0.2.105 7010 <-> 81.149.216.18 5752 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:16:07.360075 3.001955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/04 23:16:14.367922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:16:22.369373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:16:38.372430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:17:10.378173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:23:14.385016 3.001101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:23:21.391742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:23:29.393393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:23:45.398716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:24:17.402377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:25:59.919885 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 23:25:59.919993 0.983846 tcp 10.0.2.105 63083 -> 128.255.183.224 9027 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:30:21.408257 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:30:28.415665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:30:36.417246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:30:52.420077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:31:24.426243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:37:28.433242 3.000486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:37:35.439634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:37:43.441142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:37:59.443988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:38:31.450015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:42:25.176449 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 23:42:25.176628 0.228600 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:25.405613 0.100504 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:25.506515 0.201512 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:25.708609 0.250106 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:25.959100 0.158303 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.117805 0.061635 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.179813 0.099252 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.279413 0.211941 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.491718 0.131516 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.623635 0.186766 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.810860 0.165319 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:26.976649 0.171207 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:27.148433 0.059301 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:27.208138 0.145221 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:27.353836 0.605530 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:27.959751 0.168587 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.128774 0.136813 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.266006 0.096718 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.363127 0.108776 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.472372 0.203184 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.675940 0.055125 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.731442 0.145777 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.877581 0.079646 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:28.957661 0.129804 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:29.087869 0.448806 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:29.537139 0.048350 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/04 23:42:29.585910 0.000000 udp 10.0.2.105 7010 -> 81.149.216.18 5752 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/04 23:42:45.968457 0.052698 tcp 10.0.2.105 63084 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:42:46.021416 0.074313 tcp 10.0.2.105 63085 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:42:46.095975 0.158789 tcp 10.0.2.105 63086 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/04 23:44:35.455773 3.012287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:44:42.473518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:44:50.475262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:45:06.478092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:45:38.484227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:54:46.494654 3.053580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/04 23:54:53.526964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:55:01.513766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:55:17.516695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:55:49.523205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/04 23:56:00.869558 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/04 23:56:00.869666 0.942904 tcp 10.0.2.105 63087 -> 128.255.183.224 9027 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:01:53.528126 3.012464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:02:00.546698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:02:08.547763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:02:24.550738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:02:56.556977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:09:03.567118 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:09:10.574604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:09:18.575851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:09:34.579101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:10:06.584946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:13:09.388596 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 00:13:09.388702 0.000000 udp 10.0.2.105 7010 -> 81.149.216.18 5752 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 00:13:27.986691 0.052270 tcp 10.0.2.105 63088 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:13:28.039293 0.075695 tcp 10.0.2.105 63089 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:13:28.115299 0.224447 tcp 10.0.2.105 63090 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:13:28.340312 0.201998 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:28.542720 0.224944 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:28.768132 0.164068 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:28.932634 0.066670 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:28.999692 0.142609 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.142677 0.070623 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.213662 0.066489 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.280674 0.225724 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.506812 0.165673 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.672887 0.170958 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.844205 0.062202 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:29.906761 0.213050 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:30.120136 0.152103 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:30.272643 0.169447 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:30.442492 0.135218 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:30.578074 0.228002 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:30.806495 0.199765 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.006664 0.099116 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.106199 0.186747 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.293323 0.053865 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.347626 0.148000 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.496002 0.078080 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.574469 0.127981 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.702781 0.096418 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:31.869283 0.349325 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:13:32.218972 0.044725 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:16:10.590656 3.002310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:16:17.598813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:16:25.600005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:16:41.602982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:17:13.609021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:23:17.615176 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:23:24.622241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:23:32.629705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:23:48.630460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:24:20.632804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:26:01.790425 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 00:26:01.790606 0.963566 tcp 10.0.2.105 63091 -> 128.255.183.224 9027 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:30:24.639940 3.000673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:30:31.646340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:30:39.647749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:30:55.650654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:31:27.657322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:37:31.663942 3.000398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:37:38.670066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:37:46.671796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:38:02.674840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:38:34.680906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:43:38.828414 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 00:43:38.828569 0.206843 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.035854 0.222629 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.258883 0.158739 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.418022 0.064809 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.483223 0.075184 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.558811 0.072547 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:39.631764 0.000000 udp 10.0.2.105 7010 -> 86.184.78.9 7427 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 00:43:55.905199 0.058918 tcp 10.0.2.105 63092 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:43:55.964446 0.074818 tcp 10.0.2.105 63093 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:43:56.039553 0.168360 tcp 10.0.2.105 63094 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 00:43:56.208594 0.173217 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:56.382204 0.060125 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:56.442729 0.211999 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:56.655131 0.138164 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:56.793710 0.197572 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:56.991725 0.165324 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:57.157497 0.167693 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:57.325617 0.132420 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:57.458451 0.145050 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:57.603908 0.616039 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.220328 0.098947 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.319741 0.186878 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.507015 0.069449 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.576872 0.126590 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.703875 0.099065 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:58.803303 0.356189 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:59.159939 0.046557 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:59.206933 0.056219 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:43:59.263591 0.147431 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/05 00:44:38.687113 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:44:45.693936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:44:53.696307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:45:09.698992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:45:41.704851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:54:48.715987 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 00:54:55.721375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:55:03.725885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:55:19.987939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:55:51.741567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 00:56:02.758068 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 00:56:02.758235 0.995486 tcp 10.0.2.105 63095 -> 128.255.183.224 9027 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:01:55.767900 3.001859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:02:02.775166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:02:10.776645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:02:26.779496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:02:58.785644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:09:05.796055 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:09:12.803404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:09:20.804851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:09:36.807909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:10:08.814028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:14:21.057074 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 01:14:21.057213 0.066967 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:21.124765 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 01:14:39.545355 0.053750 tcp 10.0.2.105 63096 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:39.599379 0.076281 tcp 10.0.2.105 63097 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:39.675972 0.162513 tcp 10.0.2.105 63098 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:39.838983 0.221991 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.061369 0.302995 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.364780 0.338220 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.703412 0.158330 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.862139 0.065014 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.927526 0.058466 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:40.986454 0.212436 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:41.199292 0.151853 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:41.351538 0.196269 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:41.548187 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 01:14:56.969303 0.052619 tcp 10.0.2.105 63099 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:57.022168 0.074612 tcp 10.0.2.105 63100 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:57.097095 0.176534 tcp 10.0.2.105 63101 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:14:57.274260 0.172573 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:57.447232 0.169751 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:57.617436 0.132099 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:57.749919 0.142112 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:57.892622 0.207273 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:14:58.100318 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 01:15:15.536031 0.053880 tcp 10.0.2.105 63102 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:15:15.590211 0.071032 tcp 10.0.2.105 63103 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:15:15.661599 0.158863 tcp 10.0.2.105 63104 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:15:15.821104 0.186825 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.008366 0.073972 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.082750 0.131168 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.214348 0.095845 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.310594 0.323800 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.634814 0.046607 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.681793 0.052772 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:15:16.734951 0.147475 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:16:12.819501 3.002287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 01:16:19.827523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:16:27.828959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:16:43.832220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:17:15.838135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:23:19.845025 3.000798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:23:26.851598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:23:34.852905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:23:50.861546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:24:22.862312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:26:03.777352 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 01:26:03.777492 1.089026 tcp 10.0.2.105 63105 -> 128.255.183.224 9027 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:30:26.868205 3.014388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:30:33.884976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:30:41.887129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:30:57.890131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:31:29.896087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:37:33.901148 3.002720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:37:40.911217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:37:48.910920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:38:04.913976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:38:36.920082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:44:40.926320 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:44:47.933385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:44:55.934540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:45:11.937958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:45:43.944105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:45:45.776762 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 01:45:45.776954 0.201948 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:45:45.979274 0.166153 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:45:46.145795 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 01:46:01.761432 0.054050 tcp 10.0.2.105 63106 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:01.815700 0.077186 tcp 10.0.2.105 63107 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:01.893145 0.161568 tcp 10.0.2.105 63108 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:02.055219 0.065711 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.121307 0.215836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.337486 0.167720 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.505623 0.073180 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.579208 0.057147 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.636836 0.211698 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:02.848945 0.584749 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:03.434114 0.070720 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:03.505196 0.197194 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:03.702799 0.151773 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:03.854989 0.132360 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:03.987790 0.145100 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:04.133331 0.467363 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:04.601039 0.168280 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:04.769722 0.171439 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:04.941573 0.200792 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:05.142789 0.100705 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:05.243871 0.000000 udp 10.0.2.105 7010 -> 108.81.76.43 7364 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 01:46:21.388883 0.057848 tcp 10.0.2.105 63109 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:21.447085 0.075837 tcp 10.0.2.105 63110 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:21.523224 0.152853 tcp 10.0.2.105 63111 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/05 01:46:21.676714 0.087997 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:21.765129 0.056032 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:21.821522 0.146639 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:21.968507 0.345006 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:46:22.313962 0.045700 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/05 01:54:49.951730 3.011689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 01:54:56.969358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:55:04.970138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:55:20.973493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:55:52.979046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 01:56:04.867142 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 01:56:04.867282 0.907537 tcp 10.0.2.105 63112 -> 128.255.183.224 9027 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:01:56.985148 3.002803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:02:03.993662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:02:11.995183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:02:27.997173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:03:00.003530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:09:07.014799 3.000864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:09:14.021329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:09:22.023268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:09:38.026089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:10:10.031983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:16:14.038812 3.000323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:16:21.045176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:16:23.068063 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 02:16:23.068414 0.198979 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:23.267797 0.202417 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:23.470580 0.525206 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:23.996161 0.063382 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:24.059981 0.692340 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:24.752758 0.061151 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:24.814305 0.152820 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:24.967539 0.212037 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.179993 0.054681 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.235074 0.188064 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.423535 0.124252 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.548192 0.131718 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.680324 0.144700 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.825468 0.073810 udp 10.0.2.105 7010 <-> 213.120.99.87 9496 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.899675 0.079813 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:25.979923 0.131779 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:26.112151 0.098055 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:26.210618 0.634039 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:26.845019 0.166946 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.012363 0.172383 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.185102 0.086642 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.272151 0.099537 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.372043 0.146296 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.518763 0.321574 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:27.840728 0.044721 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:16:29.046423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:16:45.049954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:17:17.055787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:23:21.062258 3.017601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:23:28.079530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:23:36.080249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:23:52.083832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:24:24.089861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:26:05.776407 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 02:26:05.776599 0.920998 tcp 10.0.2.105 63113 -> 128.255.183.224 9027 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:30:28.095728 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:30:35.103377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:30:43.104432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:30:59.107417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:31:31.113949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:37:35.119332 3.002135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:37:42.127357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:37:50.130088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:38:06.131731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:38:38.137776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:44:42.143410 3.002389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:44:49.151163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:44:57.152740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:45:13.155643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:45:45.161988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:46:44.467281 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 02:46:44.467456 0.197491 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:46:44.665372 0.062229 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:46:44.728021 0.204518 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:46:44.932903 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 02:47:01.082632 0.032857 tcp 10.0.2.105 63114 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:01.115779 0.047686 tcp 10.0.2.105 63115 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:01.163720 0.132531 tcp 10.0.2.105 63116 -> 195.113.214.251 443 SRPA* 0 0 35 27722 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:01.296844 0.213761 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:01.511077 0.067000 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:01.578492 0.156471 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:01.735384 0.213556 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:01.949450 0.056540 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:02.006409 0.184054 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:02.190938 0.137732 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:02.329113 0.131807 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:02.461284 0.146335 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:02.608036 0.000000 udp 10.0.2.105 7010 -> 213.120.99.87 9496 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 02:47:17.675624 0.031594 tcp 10.0.2.105 63117 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:17.707558 0.048595 tcp 10.0.2.105 63118 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:17.756439 0.149238 tcp 10.0.2.105 63119 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:47:17.906382 0.076633 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:17.983418 0.129817 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:18.113631 0.110983 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:18.225041 0.171678 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:18.397167 0.084376 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:18.481982 0.479731 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:18.962100 0.169619 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:19.132163 0.326450 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:19.459042 0.044569 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:19.503991 0.056982 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:47:19.561438 0.146297 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/05 02:51:49.168186 3.093944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 02:51:56.235817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:52:04.186659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:52:20.189835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:52:52.195630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:56:06.705714 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 02:56:06.705801 1.012590 tcp 10.0.2.105 63120 -> 128.255.183.224 9027 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/05 02:58:56.202227 3.002599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 02:59:03.209353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:59:11.210100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:59:27.213492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 02:59:59.219624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:06:27.230153 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 03:06:34.237960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:06:42.239251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:06:58.241971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:07:30.248313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:13:39.262122 3.000933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 03:13:46.268631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:13:54.270376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:14:10.273334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:14:42.279363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:17:33.185440 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:17:33.185585 0.164034 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:33.350048 0.000000 udp 10.0.2.105 7010 -> 213.120.99.87 9496 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:17:49.650150 0.056961 tcp 10.0.2.105 63121 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:17:49.707383 0.075638 tcp 10.0.2.105 63122 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:17:49.783284 0.162168 tcp 10.0.2.105 63123 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:17:49.945948 4.479294 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1322 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.170419 4.026829 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 4 1261 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.329061 4.150551 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 4 1137 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.393696 4.220961 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 4 1053 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.527102 4.233596 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1023 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.671362 4.305306 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 4 1289 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.884421 4.146256 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1070 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:50.943542 4.278910 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 4 1208 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:51.154475 4.213246 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:51.299666 4.240035 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 4 1048 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:51.474359 4.144174 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 4 1134 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:51.558028 4.132871 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 4 1205 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:51.921373 3.931735 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 4 1096 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.030036 3.927029 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 4 1386 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.129054 4.036996 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 4 996 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.329144 4.240319 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1209 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.498316 3.814516 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 4 1036 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.646105 3.712745 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 4 1041 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.691520 3.715184 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 4 1170 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:52.750214 4.265548 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 3 477 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:53.376016 3.383471 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 4 1214 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:53.586653 3.374880 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1057 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:53.789937 3.225375 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 4 1199 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:53.870902 0.167212 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:17:57.839460 0.000000 udp 10.0.2.105 7010 <- 211.38.175.27 2833 RSP 0 0 1 544 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:17:57.840137 0.000000 udp 10.0.2.105 7010 -> 116.228.187.214 9920 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:04.039532 0.000000 udp 10.0.2.105 7010 -> 72.224.189.45 1919 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:12.852477 0.165105 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:13.017582 0.000000 icmp 66.55.26.130 0x0303 -> 10.0.2.105 0x2b20 URP 192 1 190 flow=Background 1970/02/05 03:18:17.819286 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:18:18.610745 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:26.712288 0.000000 udp 10.0.2.105 7010 -> 91.226.209.124 7446 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:33.882518 0.000000 udp 10.0.2.105 7010 -> 213.196.225.215 9700 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:42.325368 0.000000 udp 10.0.2.105 7010 -> 81.108.249.65 2974 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:47.321393 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:18:48.473436 0.000000 udp 10.0.2.105 7010 -> 95.224.103.10 8932 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:18:56.745352 0.000000 udp 10.0.2.105 7010 -> 50.124.178.238 4327 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:04.847020 0.000000 udp 10.0.2.105 7010 -> 217.79.123.16 1091 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:10.925512 0.000000 udp 10.0.2.105 7010 -> 79.10.112.157 5643 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:15.822836 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:19:16.323347 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:24.876041 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:31.915760 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:38.565560 0.000000 udp 10.0.2.105 7010 -> 188.169.121.119 8200 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:43.323655 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:19:45.936021 0.099995 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:19:46.060963 0.000000 udp 10.0.2.105 7010 -> 125.215.190.253 5233 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:52.765799 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:19:58.204060 0.000000 udp 10.0.2.105 7010 -> 156.83.1.68 6655 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:05.774889 0.227838 udp 10.0.2.105 7010 -> 122.55.25.106 1225 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:06.002727 0.000000 icmp 122.55.25.98 0x0303 -> 10.0.2.105 0xc904 URP 192 1 307 flow=Background 1970/02/05 03:20:10.320829 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:20:12.844736 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:19.544453 0.000000 udp 10.0.2.105 7010 -> 79.129.138.103 6161 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:25.543379 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:33.124037 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:37.820706 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:20:42.096908 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:46.285735 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 03:20:48.876478 0.000000 udp 10.0.2.105 7010 -> 88.244.82.243 6778 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:20:53.292931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:20:54.013832 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:00.493475 0.000000 udp 10.0.2.105 7010 -> 93.193.137.1 7662 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:01.294096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:21:05.319950 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:21:07.082875 0.000000 udp 10.0.2.105 7010 -> 59.90.163.240 2721 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:12.751210 0.032427 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:21:12.867797 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:17.298645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:21:20.082265 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:27.902651 0.000000 udp 10.0.2.105 7010 -> 92.2.66.114 8958 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:32.819514 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:21:34.131759 0.000000 udp 10.0.2.105 7010 -> 86.179.173.243 9633 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:39.950004 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:45.598414 0.000000 udp 10.0.2.105 7010 -> 109.155.180.196 4871 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:49.303298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:21:53.850270 0.000000 udp 10.0.2.105 7010 -> 93.46.211.168 3954 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:21:58.816790 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:22:02.564405 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:10.574010 0.407544 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:22:11.003839 0.000000 udp 10.0.2.105 7010 -> 91.125.39.225 9540 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:18.986061 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:23.822857 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:22:25.625915 0.000000 udp 10.0.2.105 7010 -> 118.44.163.92 4410 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:33.557104 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:38.644599 0.000000 udp 10.0.2.105 7010 -> 46.49.106.205 3516 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:44.753551 0.000000 udp 10.0.2.105 7010 -> 193.77.126.173 4131 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:49.319844 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:22:51.012125 0.000000 udp 10.0.2.105 7010 -> 93.43.226.170 5225 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:22:56.910719 0.000000 udp 10.0.2.105 7010 -> 121.54.22.85 2129 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:05.362850 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:13.294022 0.000000 udp 10.0.2.105 7010 -> 80.175.91.209 7359 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:17.820279 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:23:22.066282 0.000000 udp 10.0.2.105 7010 -> 72.234.28.173 4616 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:29.016856 0.000000 udp 10.0.2.105 7010 -> 95.87.124.199 2054 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:37.809346 0.000000 udp 10.0.2.105 7010 -> 107.199.178.121 6747 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:42.322804 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:23:44.069733 0.000000 udp 10.0.2.105 7010 -> 82.54.92.221 1675 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:49.716658 0.000000 udp 10.0.2.105 7010 -> 122.165.226.166 9971 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:23:57.439078 0.118227 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:23:57.575387 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:05.050781 0.000000 udp 10.0.2.105 7010 -> 68.5.122.6 8214 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:09.816814 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:24:12.571258 0.057993 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:24:12.737375 0.000000 udp 10.0.2.105 7010 -> 59.97.56.10 9768 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:19.362977 0.000000 udp 10.0.2.105 7010 -> 79.5.170.20 9095 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:27.610899 0.000000 udp 10.0.2.105 7010 -> 89.165.70.21 3445 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:34.931399 0.000000 udp 10.0.2.105 7010 -> 71.79.70.185 6658 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:39.824190 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:24:43.584040 0.000000 udp 10.0.2.105 7010 -> 188.247.72.163 3863 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:48.603287 0.000000 udp 10.0.2.105 7010 -> 194.255.18.49 2320 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:24:56.843040 0.000000 udp 10.0.2.105 7010 -> 117.198.215.196 9055 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:05.305032 0.000000 udp 10.0.2.105 7010 -> 84.104.134.48 9519 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:09.821535 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:25:14.077525 0.000000 udp 10.0.2.105 7010 -> 213.44.79.10 9925 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:22.680450 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:29.053353 0.182331 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:25:29.942512 0.086712 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:25:30.337107 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:33.815930 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:25:39.294015 0.404136 udp 10.0.2.105 7010 <-> 109.149.166.231 1971 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:25:39.884656 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:46.495391 0.000000 udp 10.0.2.105 7010 -> 80.120.98.154 6631 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:54.546063 0.000000 udp 10.0.2.105 7010 -> 122.200.17.222 1178 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:25:59.322622 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:26:00.544360 0.000000 udp 10.0.2.105 7010 -> 67.167.30.251 9503 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:06.883614 0.000000 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:07.725136 1.103964 tcp 10.0.2.105 63124 -> 128.255.183.224 9027 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:26:13.182937 0.000000 udp 10.0.2.105 7010 -> 81.136.140.132 7642 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:18.650959 0.053266 udp 10.0.2.105 7010 <-> 85.210.12.60 9805 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:26:18.823124 0.000000 udp 10.0.2.105 7010 -> 77.8.220.225 5096 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:26.394256 0.445716 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:26:26.855974 0.000000 udp 10.0.2.105 7010 -> 93.144.84.184 1853 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:33.592136 0.050554 udp 10.0.2.105 7010 -> 178.196.169.255 6676 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:33.642690 0.000000 icmp 178.196.169.255 0x0303 -> 10.0.2.105 0x141a URP 192 1 259 flow=Background 1970/02/05 03:26:38.318731 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:26:39.019442 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:45.288850 0.000000 udp 10.0.2.105 7010 -> 78.160.233.232 1028 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:26:52.389477 0.000000 udp 10.0.2.105 7010 -> 195.32.60.45 6955 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:01.222054 0.182496 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:27:01.429977 0.000000 udp 10.0.2.105 7010 -> 46.49.92.228 7855 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:05.818610 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:27:08.662432 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:14.831658 0.000000 udp 10.0.2.105 7010 -> 98.173.166.120 6897 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:22.712739 0.000000 udp 10.0.2.105 7010 -> 91.217.206.2 6803 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:29.883334 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:34.819585 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:27:37.874462 0.000000 udp 10.0.2.105 7010 -> 79.28.160.30 1508 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:46.637171 0.000000 udp 10.0.2.105 7010 -> 162.237.52.245 3340 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:53.310367 3.000232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 03:27:54.698819 0.000000 udp 10.0.2.105 7010 -> 5.96.75.42 6152 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:27:59.315416 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:27:59.966365 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:28:00.316912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:28:08.318249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:28:08.588907 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:28:24.321360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:28:56.327261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:35:00.332860 3.001982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 03:35:07.340209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:35:15.342676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:35:31.345313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:36:03.351563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:42:07.358164 3.000803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 03:42:14.364802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:42:22.368031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:42:38.369006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:43:10.375198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:53:35.386480 3.021647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 03:53:42.403712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:53:50.405266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:54:06.408533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:54:38.414086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 03:56:08.834639 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:56:08.834810 0.995258 tcp 10.0.2.105 63125 -> 128.255.183.224 9027 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:58:19.534898 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 03:58:19.535019 0.164428 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:19.699930 0.155537 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:19.855860 0.215374 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.071680 0.058246 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.130352 0.132905 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.263702 0.142761 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.406928 0.213933 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.621309 0.056850 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.678624 0.188338 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:20.867327 0.203960 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.071733 0.103095 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.175280 0.109875 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.285591 0.202943 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.488947 0.147245 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.636577 0.137969 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.775037 0.171540 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:21.946937 0.084108 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.031436 0.048941 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.080749 0.061234 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.142445 0.172184 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.315032 0.186972 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.502391 0.203375 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.706176 0.067717 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:22.774390 0.326631 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.101394 0.107136 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.208970 0.028706 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.238057 0.057761 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.296387 0.094456 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.473843 0.056986 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.531267 0.180536 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.712214 0.086626 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.799226 0.075302 udp 10.0.2.105 7010 <-> 109.149.166.231 1971 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:23.874929 0.000000 udp 10.0.2.105 7010 -> 85.210.12.60 9805 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 03:58:38.941918 0.056004 tcp 10.0.2.105 63126 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:58:38.998179 0.071119 tcp 10.0.2.105 63127 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:58:39.069887 0.173399 tcp 10.0.2.105 63128 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 03:58:39.243771 0.370599 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/05 03:58:39.614856 0.230200 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:00:42.420381 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 04:00:49.428012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:00:57.429644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:01:13.432652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:01:45.438810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:07:49.444875 3.001340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:07:56.451853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:08:04.453161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:08:20.456182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:08:52.462262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:14:56.468171 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:15:03.475638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:15:11.477168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:15:27.480577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:15:59.486306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:22:03.492332 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:22:10.501858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:22:18.501237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:22:34.503997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:23:06.510601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:26:09.836875 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 04:26:09.837025 0.966553 tcp 10.0.2.105 63129 -> 128.255.183.224 9027 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:08.821589 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 04:29:08.821754 0.000000 udp 10.0.2.105 7010 -> 85.210.12.60 9805 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 04:29:10.516985 3.000921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 04:29:17.523403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:29:25.525253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:29:26.778620 0.060351 tcp 10.0.2.105 63130 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:26.839297 0.072740 tcp 10.0.2.105 63131 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:26.912285 0.163686 tcp 10.0.2.105 63132 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:27.077071 0.157005 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.234488 0.220264 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.455148 0.064277 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.519860 0.133569 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.653894 0.143761 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.798081 0.163746 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:27.962228 0.195507 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.158197 0.074277 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.232925 0.212836 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.446129 0.098772 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.545313 0.207027 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.752729 0.057080 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.810176 0.144822 udp 10.0.2.105 7010 <-> 128.255.183.224 7850 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:28.955355 0.172266 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.128111 0.084545 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.213061 0.050056 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.263505 0.051747 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.315618 0.147637 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.463672 0.207549 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.671605 0.201185 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.873195 0.063221 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:29.936770 0.369552 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.306667 0.128515 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.435611 0.167935 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.604012 0.201176 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.805631 0.100370 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.906370 0.056852 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:30.963581 0.187865 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:31.151872 0.085077 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:31.237318 0.000000 udp 10.0.2.105 7010 -> 109.149.166.231 1971 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 04:29:41.528223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:29:50.120821 0.053111 tcp 10.0.2.105 63133 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:50.174295 0.069458 tcp 10.0.2.105 63134 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:50.244018 0.157195 tcp 10.0.2.105 63135 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:29:50.401454 0.056931 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:50.458804 0.044944 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:50.504198 0.462288 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:29:50.966913 0.182217 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/05 04:30:13.534020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:36:17.541973 2.999804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:36:24.547635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:36:32.549368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:36:48.552255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:37:20.558298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:43:24.564370 3.001605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:43:31.571721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:43:39.573156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:43:55.576178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:44:27.582310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:54:14.588317 3.029648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 04:54:21.608508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:54:29.607710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:54:45.611226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:55:17.616937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 04:56:10.803700 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 04:56:10.803805 3.003296 tcp 10.0.2.105 63136 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:19.816195 0.000000 tcp 10.0.2.105 63136 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:25.806566 0.050065 tcp 10.0.2.105 63137 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:25.856904 0.075245 tcp 10.0.2.105 63138 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:25.932455 0.157272 tcp 10.0.2.105 63139 -> 195.113.214.251 443 SRPA* 0 0 38 27927 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:26.123789 2.995822 tcp 10.0.2.105 63140 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:35.117898 0.000000 tcp 10.0.2.105 63140 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:41.119552 0.048357 tcp 10.0.2.105 63141 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:41.168168 0.071691 tcp 10.0.2.105 63142 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:41.240144 0.177253 tcp 10.0.2.105 63143 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:41.546854 2.995100 tcp 10.0.2.105 63144 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:50.542995 0.000000 tcp 10.0.2.105 63144 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:56:56.539507 0.057230 tcp 10.0.2.105 63145 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:56.596997 0.079484 tcp 10.0.2.105 63146 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:56.676754 0.175609 tcp 10.0.2.105 63147 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:57.001265 0.451224 tcp 10.0.2.105 63148 -> 82.20.121.6 1791 FSPA* 0 0 13 1238 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:57.091172 0.049818 tcp 10.0.2.105 63149 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:57.141346 0.074847 tcp 10.0.2.105 63150 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:57.216505 0.177669 tcp 10.0.2.105 63151 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:56:57.452746 3.002031 tcp 10.0.2.105 63152 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:06.453337 0.000000 tcp 10.0.2.105 63152 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:12.452902 0.097234 tcp 10.0.2.105 63153 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:12.550429 0.078921 tcp 10.0.2.105 63154 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:12.629606 0.177400 tcp 10.0.2.105 63155 -> 195.113.214.251 443 SRPA* 0 0 42 24266 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:13.014119 3.005098 tcp 10.0.2.105 63156 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:22.017655 0.000000 tcp 10.0.2.105 63156 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:28.014538 0.048453 tcp 10.0.2.105 63157 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:28.063232 0.080635 tcp 10.0.2.105 63158 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:28.144351 0.178143 tcp 10.0.2.105 63159 -> 195.113.214.251 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:28.356997 2.992001 tcp 10.0.2.105 63160 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:37.347456 0.000000 tcp 10.0.2.105 63160 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:43.357088 0.049940 tcp 10.0.2.105 63161 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:43.407340 0.075803 tcp 10.0.2.105 63162 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:43.483410 0.177639 tcp 10.0.2.105 63163 -> 195.113.214.251 443 SRPA* 0 0 36 27819 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:57:43.744701 2.996595 tcp 10.0.2.105 63164 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:52.739971 0.000000 tcp 10.0.2.105 63164 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:57:58.738837 3.003737 tcp 10.0.2.105 63165 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:07.741449 0.000000 tcp 10.0.2.105 63165 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:12.318356 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 04:58:13.740477 3.003964 tcp 10.0.2.105 63166 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:22.742714 0.000000 tcp 10.0.2.105 63166 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:28.741630 0.088139 tcp 10.0.2.105 63167 -> 82.20.121.6 1791 FSPA* 0 0 13 1238 flow=From-Botnet-V2-TCP-Established 1970/02/05 04:58:28.830016 3.010857 tcp 10.0.2.105 63168 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:37.834655 0.000000 tcp 10.0.2.105 63168 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:43.823586 2.993925 tcp 10.0.2.105 63169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:52.826261 0.000000 tcp 10.0.2.105 63169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:58:57.813340 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 04:58:58.824955 2.994166 tcp 10.0.2.105 63170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 04:59:07.828147 0.000000 tcp 10.0.2.105 63170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:00:02.897537 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:00:02.897698 0.000000 udp 10.0.2.105 7010 -> 109.149.166.231 1971 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 05:00:21.375019 0.100188 tcp 10.0.2.105 63171 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:21.475523 0.077447 tcp 10.0.2.105 63172 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:21.553278 0.187593 tcp 10.0.2.105 63173 -> 195.113.214.251 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:21.741343 0.159024 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:21.900738 0.067427 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:21.968520 0.150112 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:22.119112 0.143965 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:22.263526 0.166523 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:22.430501 0.180238 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:22.611167 0.335070 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:22.946643 0.213886 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:23.160903 0.139602 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:23.300881 0.108501 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:23.409795 0.210196 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:23.620549 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 05:00:41.623320 0.048445 tcp 10.0.2.105 63174 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:41.672046 0.071755 tcp 10.0.2.105 63175 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:41.744130 0.181544 tcp 10.0.2.105 63176 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:00:41.926269 0.171628 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.098307 0.087211 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.185994 0.046452 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.232856 0.053475 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.286765 0.057318 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.344522 0.065897 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.410830 0.326052 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.737288 0.202752 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:42.940571 0.147808 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.088810 0.206288 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.295525 0.169951 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.465896 0.256678 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.722960 0.124901 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.848219 0.057672 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:43.906305 0.190148 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.096833 0.083866 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.181166 0.082636 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.264241 0.449494 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.714165 0.180072 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.894582 0.056046 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:00:44.951035 0.029949 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:01:21.623462 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 05:01:28.630565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:01:36.631881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:01:52.634202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:02:24.640995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:04:13.827459 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:04:13.827629 3.004256 tcp 10.0.2.105 63177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:22.830323 0.000000 tcp 10.0.2.105 63177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:28.830912 0.050568 tcp 10.0.2.105 63178 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:28.881761 0.075767 tcp 10.0.2.105 63179 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:28.957835 0.142642 tcp 10.0.2.105 63180 -> 195.113.214.251 443 SRPA* 0 0 34 24813 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:29.111034 3.002940 tcp 10.0.2.105 63181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:38.112304 0.000000 tcp 10.0.2.105 63181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:44.112099 0.049682 tcp 10.0.2.105 63182 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:44.162073 0.067932 tcp 10.0.2.105 63183 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:44.230259 0.165312 tcp 10.0.2.105 63184 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:44.407984 3.007881 tcp 10.0.2.105 63185 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:53.414560 0.000000 tcp 10.0.2.105 63185 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:04:59.404165 0.048877 tcp 10.0.2.105 63186 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:59.453371 0.071543 tcp 10.0.2.105 63187 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:59.525191 0.171894 tcp 10.0.2.105 63188 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:04:59.730741 2.997406 tcp 10.0.2.105 63189 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:08.736617 0.000000 tcp 10.0.2.105 63189 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:14.725962 0.051386 tcp 10.0.2.105 63190 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:14.777665 0.077651 tcp 10.0.2.105 63191 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:14.855671 0.172396 tcp 10.0.2.105 63192 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:15.046140 2.994300 tcp 10.0.2.105 63193 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:24.038733 0.000000 tcp 10.0.2.105 63193 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:30.047861 0.049447 tcp 10.0.2.105 63194 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.097665 0.067744 tcp 10.0.2.105 63195 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.165706 0.157419 tcp 10.0.2.105 63196 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.430313 0.443698 tcp 10.0.2.105 63197 -> 82.20.121.6 1791 FSPA* 0 0 13 1384 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.513728 0.049643 tcp 10.0.2.105 63198 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.563645 0.072638 tcp 10.0.2.105 63199 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.636545 0.156927 tcp 10.0.2.105 63200 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:30.874244 3.003704 tcp 10.0.2.105 63201 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:39.871296 0.000000 tcp 10.0.2.105 63201 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:45.870711 0.048399 tcp 10.0.2.105 63202 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:45.919441 0.075264 tcp 10.0.2.105 63203 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:45.995001 0.160672 tcp 10.0.2.105 63204 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:05:46.454961 3.000421 tcp 10.0.2.105 63205 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:05:55.456003 0.000000 tcp 10.0.2.105 63205 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:01.453251 3.003538 tcp 10.0.2.105 63206 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:10.455481 0.000000 tcp 10.0.2.105 63206 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:15.322488 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:06:16.459861 2.988830 tcp 10.0.2.105 63207 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:25.456836 0.000000 tcp 10.0.2.105 63207 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:31.455746 2.994210 tcp 10.0.2.105 63208 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:39.316993 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:06:40.448502 0.000000 tcp 10.0.2.105 63208 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:46.457545 3.004086 tcp 10.0.2.105 63209 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:06:55.460018 0.000000 tcp 10.0.2.105 63209 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:07:01.458969 0.041515 tcp 10.0.2.105 63210 -> 82.20.121.6 1791 SPA_* 0 0 9 1168 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:07:21.415605 0.125378 tcp 10.0.2.105 63210 -> 82.20.121.6 1791 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:08:28.646886 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 05:08:35.654237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:08:43.655638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:08:59.658769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:09:31.664514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:15:35.671200 3.001116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:15:42.678171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:15:50.679675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:16:06.682828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:16:38.688649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:22:42.696026 3.002854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:22:49.702240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:22:57.706298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:23:13.707072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:23:45.712669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:29:49.719110 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:29:56.726117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:30:04.727447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:30:20.730707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:30:45.776935 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:30:45.777037 0.000000 udp 10.0.2.105 7010 -> 128.255.183.224 7850 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 05:30:52.736928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:31:02.562922 0.144327 tcp 10.0.2.105 63211 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:02.707569 0.076054 tcp 10.0.2.105 63212 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:02.783956 0.166704 tcp 10.0.2.105 63213 -> 195.113.214.251 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:02.951300 0.155046 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.106776 0.060376 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.167543 0.165292 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.333223 0.196327 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.529936 0.131155 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.661505 0.147327 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.809287 3.060163 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:03.809604 3.007253 tcp 10.0.2.105 63214 -> 70.52.124.21 3087 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:31:06.869882 0.095757 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:06.966016 0.706148 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:07.672747 0.332257 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.005356 0.212206 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.217959 0.170987 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.389664 0.085828 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.475879 0.046066 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.522309 0.053685 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.576402 0.058701 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:08.635452 0.000000 udp 10.0.2.105 7010 -> 86.184.78.9 7427 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 05:31:12.815247 0.000000 tcp 10.0.2.105 63214 -> 70.52.124.21 3087 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:31:26.397652 0.051599 tcp 10.0.2.105 63215 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:26.449554 0.078098 tcp 10.0.2.105 63216 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:26.527969 0.167051 tcp 10.0.2.105 63217 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:31:26.695486 0.146104 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:26.842050 0.335020 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:27.177535 0.203602 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:27.381546 0.206940 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:27.588869 0.206654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:27.795899 0.186872 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:27.983177 0.085882 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.069521 0.057049 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.127033 0.112875 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.240508 0.190381 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.431362 0.084532 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.516476 0.056400 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.573238 0.029107 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:28.602756 0.406363 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:31:29.009574 0.179742 udp 10.0.2.105 7010 <-> 108.236.234.31 9301 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/05 05:36:56.745900 3.018210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:37:03.759979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:37:11.761644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:37:21.546105 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 05:37:21.546196 0.465650 tcp 10.0.2.105 63218 -> 82.20.121.6 1791 FSPA* 0 0 13 1263 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:21.634436 0.059388 tcp 10.0.2.105 63219 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:21.694231 0.076290 tcp 10.0.2.105 63220 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:21.770842 0.172436 tcp 10.0.2.105 63221 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:22.012078 2.998652 tcp 10.0.2.105 63222 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:37:27.764083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:37:31.008769 0.000000 tcp 10.0.2.105 63222 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:37:37.008433 0.052473 tcp 10.0.2.105 63223 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:37.061206 0.074774 tcp 10.0.2.105 63224 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:37.136276 0.159284 tcp 10.0.2.105 63225 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:37.366246 2.996702 tcp 10.0.2.105 63226 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:37:46.361224 0.000000 tcp 10.0.2.105 63226 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 05:37:52.360819 0.055828 tcp 10.0.2.105 63227 -> 195.113.214.221 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:52.416899 0.076486 tcp 10.0.2.105 63228 -> 195.113.214.251 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:52.493740 0.162786 tcp 10.0.2.105 63229 -> 195.113.214.251 443 SRPA* 0 0 25 13910 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:52.677919 0.536469 tcp 10.0.2.105 63230 -> 31.192.24.67 3527 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/05 05:37:59.770936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:44:03.776302 3.001874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:44:10.783972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:44:18.785495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:44:34.788367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:45:06.794493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:54:29.807459 3.116029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 05:54:36.898165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:54:44.834078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:55:00.828716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 05:55:32.834844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:01:36.840283 3.002009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:01:38.981588 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 06:01:38.981688 0.062179 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:39.044249 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:01:43.847652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:01:51.849394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:01:57.589994 0.115863 tcp 10.0.2.105 63231 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:01:57.706212 0.076203 tcp 10.0.2.105 63232 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:01:57.782739 0.174188 tcp 10.0.2.105 63233 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:01:57.957405 0.160087 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.117925 0.057852 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.176265 0.136095 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.312820 0.146453 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.459709 0.199099 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.460045 3.003211 tcp 10.0.2.105 63234 -> 70.52.124.21 3087 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 06:01:58.659264 0.098783 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.758482 0.106774 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:58.865708 0.535065 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.401222 0.212159 udp 10.0.2.105 7010 <-> 207.119.2.108 8296 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.613782 0.220835 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.835007 0.044609 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.880060 0.057648 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.938108 0.058294 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:01:59.996800 0.077872 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:00.075058 0.204832 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:00.280437 0.566892 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:00.847741 0.148399 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:00.996582 0.210601 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.207622 0.214679 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.422788 0.167642 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.590823 0.187454 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.778723 0.075642 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.854763 0.073217 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:01.928434 0.088850 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:02.017690 0.073024 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:02.091141 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:02:07.462230 0.000000 tcp 10.0.2.105 63234 -> 70.52.124.21 3087 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 06:02:07.852673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:02:20.491364 0.052447 tcp 10.0.2.105 63235 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:20.544132 0.072719 tcp 10.0.2.105 63236 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:20.617166 0.168685 tcp 10.0.2.105 63237 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:20.786355 0.363042 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:21.149775 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:02:38.537489 0.052119 tcp 10.0.2.105 63238 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:38.589928 0.072251 tcp 10.0.2.105 63239 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:38.662513 0.238686 tcp 10.0.2.105 63240 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:02:38.901720 0.188263 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:39.090435 0.085506 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:02:39.858606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:07:53.219388 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 06:07:53.219600 0.575373 tcp 10.0.2.105 63241 -> 31.192.24.67 3527 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:08:43.864640 3.001884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:08:50.872081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:08:58.874887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:09:14.876495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:09:46.882737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:15:50.888635 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:15:57.896036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:16:05.897204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:16:21.900223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:16:53.906001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:22:57.912428 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:23:04.919704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:23:12.921419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:23:28.924750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:24:00.932866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:30:04.937088 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:30:11.944013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:30:19.945588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:30:35.949535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:31:07.954569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:33:07.587322 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 06:33:07.587432 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:33:22.799972 0.128195 tcp 10.0.2.105 63242 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:22.928391 0.067969 tcp 10.0.2.105 63243 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:22.996678 0.161685 tcp 10.0.2.105 63244 -> 195.113.214.251 443 SRPA* 0 0 29 17636 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:23.159142 0.029352 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:33:23.188904 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:33:41.696486 0.052719 tcp 10.0.2.105 63245 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:41.749575 0.071159 tcp 10.0.2.105 63246 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:41.821013 0.161261 tcp 10.0.2.105 63247 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:41.982765 0.000000 udp 10.0.2.105 7010 -> 86.184.78.9 7427 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:33:58.440480 0.053164 tcp 10.0.2.105 63248 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:58.493935 0.076220 tcp 10.0.2.105 63249 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:58.570406 0.169582 tcp 10.0.2.105 63250 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:33:58.741387 0.143349 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:33:58.885206 0.062177 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:33:58.885533 2.999038 tcp 10.0.2.105 63251 -> 70.52.124.21 3087 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 06:33:58.947759 0.000000 udp 10.0.2.105 7010 -> 183.82.42.251 7723 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:34:07.883326 0.000000 tcp 10.0.2.105 63251 -> 70.52.124.21 3087 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 06:34:15.334500 0.054249 tcp 10.0.2.105 63252 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:15.389049 0.074343 tcp 10.0.2.105 63253 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:15.463678 0.163482 tcp 10.0.2.105 63254 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:15.627743 0.131469 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:15.759550 0.134047 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:15.961281 0.082938 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.044620 0.098967 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.144079 0.220507 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.364958 0.187492 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.552870 0.060382 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.613634 0.055998 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.670079 0.089841 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:16.760347 0.000000 udp 10.0.2.105 7010 -> 207.119.2.108 8296 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 06:34:35.643719 0.053795 tcp 10.0.2.105 63255 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:35.697349 0.075127 tcp 10.0.2.105 63256 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:35.772738 0.177007 tcp 10.0.2.105 63257 -> 195.113.214.251 443 SRPA* 0 0 21 13070 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:35.950459 0.045845 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:35.996711 0.207545 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:36.204605 0.168946 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:36.373979 0.184879 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:36.559244 0.144843 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:36.704512 0.342591 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.047576 0.208811 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.256736 0.116546 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.373841 0.058000 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.374251 3.651085 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 SPA_* 0 0 14 5232 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:37.432683 0.079607 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.512738 0.210528 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.723760 0.057509 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:37.781692 0.370301 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:38.152512 0.184743 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:38.337687 0.083029 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/05 06:34:47.244615 3.621400 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 39 27926 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:52.295035 4.703916 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 61 36062 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:34:57.410176 4.676149 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 76 50588 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:02.595867 4.766961 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 82 54200 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:08.415285 4.851082 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 108 65844 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:13.441081 4.995780 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 88 51856 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:18.634889 4.726540 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 67 44954 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:23.682117 4.947250 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 33 21774 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:28.779378 4.626063 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 62 42560 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:34.130675 4.104141 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 88 52852 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:40.698899 4.853898 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 44 25092 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:45.784921 4.204540 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 98 61264 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:52.005275 4.976023 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 A_PA 0 0 165 101258 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:35:57.091290 1.504973 tcp 10.0.2.105 63258 -> 79.33.225.176 1576 FPA_* 0 0 36 18712 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:37:11.961042 3.001260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 06:37:18.967333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:37:26.969058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:37:42.972713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:37:53.798116 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 06:37:53.798205 0.662501 tcp 10.0.2.105 63259 -> 31.192.24.67 3527 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/05 06:38:14.978806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:44:18.984999 3.005121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:44:25.992270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:44:33.993408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:44:49.996927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:45:22.002779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:54:38.015451 3.000439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 06:54:45.021780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:54:53.033445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:55:09.036648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 06:55:41.042265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:01:45.047950 3.002276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:01:52.059152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:02:00.057021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:02:16.060543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:02:48.066213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:05:01.989858 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 07:05:01.989973 0.060559 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:02.050989 0.156941 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:02.208393 0.000000 udp 10.0.2.105 7010 -> 207.119.2.108 8296 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 07:05:20.887998 0.053260 tcp 10.0.2.105 63260 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:20.941502 0.078298 tcp 10.0.2.105 63261 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:21.020059 0.178288 tcp 10.0.2.105 63262 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:21.198962 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 07:05:39.404909 0.053528 tcp 10.0.2.105 63263 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:39.458730 0.071671 tcp 10.0.2.105 63264 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:39.530713 0.179223 tcp 10.0.2.105 63265 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:05:39.710674 0.060832 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:39.833316 0.148121 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:39.981852 0.107028 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.089304 0.140904 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.230733 0.096591 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.327685 0.235432 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.563526 0.082296 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.646213 0.086191 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.732835 0.052355 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.785634 0.180670 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:40.966722 0.058418 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:41.025577 0.042340 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:41.068527 0.207953 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:41.276922 0.169106 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:41.446465 0.855086 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:42.301994 0.210421 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:42.512792 0.170567 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:42.683823 0.147177 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:42.831360 0.170669 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.002445 0.086583 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.089412 0.074292 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.164124 0.187320 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.351818 0.057557 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.409824 0.353650 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.763946 0.183127 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:05:43.947452 0.089855 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:07:54.467418 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 07:07:54.467513 0.588752 tcp 10.0.2.105 63266 -> 31.192.24.67 3527 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:08:52.072816 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 07:08:59.079932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:09:07.081406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:09:23.084825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:09:55.090670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:15:59.096281 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:16:06.103732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:16:14.105522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:16:30.108665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:17:02.114541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:23:06.120134 3.002062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:23:13.128105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:23:21.129324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:23:37.132155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:24:09.138760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:30:13.144691 3.093117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:30:20.279874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:30:28.219091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:30:44.176414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:31:16.182388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:35:56.225474 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 07:35:56.225586 0.030148 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:35:56.256117 0.062386 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:35:56.318930 0.157740 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:35:56.477113 0.057706 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:35:56.535247 0.145453 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:35:56.681115 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 07:36:02.230885 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 07:36:02.231306 0.134832 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:02.366548 0.111336 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:02.478231 0.347805 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:02.826438 0.265645 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.092626 0.075907 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.168922 0.053644 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.222932 0.205840 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.429241 0.054791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.484579 0.044010 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:03.529045 0.708929 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:04.238433 0.207901 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:04.446773 0.171147 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:04.618299 0.209000 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:04.827692 0.170278 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:04.998357 0.147665 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.146443 0.100752 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.247631 0.057173 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.305210 0.078725 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.384434 0.188979 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.573797 0.057437 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:05.631699 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 07:36:22.755317 0.050110 tcp 10.0.2.105 63267 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:36:22.805678 0.070238 tcp 10.0.2.105 63268 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:36:22.876188 0.157205 tcp 10.0.2.105 63269 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:36:23.034023 0.182116 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:36:23.216583 0.085321 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/05 07:37:20.187944 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:37:27.195643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:37:35.197288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:37:51.199873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:37:55.056335 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 07:37:55.056439 0.623200 tcp 10.0.2.105 63270 -> 31.192.24.67 3527 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/05 07:38:23.205913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:44:27.212230 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:44:34.219568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:44:42.221155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:44:58.224228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:45:30.230198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:54:43.238088 3.003343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 07:54:50.245877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:54:58.257032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:55:14.260150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 07:55:46.265962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:01:50.273022 3.000468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:01:57.279661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:02:05.281096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:02:21.283832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:02:53.289846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:06:44.162374 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 08:06:44.162486 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 08:07:02.880551 0.051067 tcp 10.0.2.105 63271 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 08:07:02.931861 0.070310 tcp 10.0.2.105 63272 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 08:07:03.002418 0.133530 tcp 10.0.2.105 63273 -> 195.113.214.251 443 SRPA* 0 0 33 23627 flow=From-Botnet-V2-TCP-Established 1970/02/05 08:07:03.136791 0.030772 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.168024 0.059596 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.228088 0.154820 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.383308 0.062675 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.446406 0.144350 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.591203 0.139522 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:03.731198 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 08:07:10.569803 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 08:07:10.570286 0.187412 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:10.758140 0.089076 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:10.847563 0.061197 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:10.909121 0.307268 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:11.216804 0.176630 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:11.393846 0.048324 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:11.442596 0.508112 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:11.951178 0.058725 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.010392 0.195379 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.206233 0.171270 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.377918 0.207781 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.586054 0.221174 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.807620 0.147366 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:12.955411 0.082789 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.038611 0.057608 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.096725 0.201846 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.298961 0.193090 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.492626 0.075843 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.568843 0.068479 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.637702 0.183723 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:13.821843 0.096629 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:07:55.685209 0.617659 tcp 10.0.2.105 63274 -> 31.192.24.67 3527 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/02/05 08:08:58.298282 3.000829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 08:09:05.305023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:09:13.306901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:09:29.309301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:10:01.315130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:16:05.321272 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:16:12.329469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:16:20.330553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:16:36.332912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:17:08.339238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:23:12.348573 2.998134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:23:19.352942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:23:27.353923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:23:43.357382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:24:15.363363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:30:19.368736 3.002422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:30:26.381083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:30:34.378561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:30:50.381340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:31:22.387527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:37:17.578663 0.009215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 08:37:17.588055 0.159760 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:17.748211 0.063450 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:17.812110 0.030475 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:17.843044 0.065049 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:17.908696 0.145885 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:18.055000 0.131625 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:18.187030 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 08:37:24.650660 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 08:37:24.651123 0.190824 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:24.842329 0.107669 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:24.950394 0.195675 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:25.146462 0.044726 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:25.191655 0.056431 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:25.248509 0.225190 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:25.474096 0.554359 udp 10.0.2.105 7010 <-> 211.38.175.27 2833 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.028857 0.059553 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.088821 0.188748 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.277935 0.168453 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.402803 3.002170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:37:26.446800 0.171532 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.618806 0.210663 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.829921 0.148563 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:26.978907 0.080205 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.059504 0.057442 udp 10.0.2.105 7010 <-> 81.178.183.155 2432 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.117408 0.203069 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.320857 0.194715 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.516033 0.188931 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.705383 0.084673 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.790483 0.079474 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:27.870397 0.058046 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/05 08:37:33.410826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:37:41.412577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:37:56.303972 0.543588 tcp 10.0.2.105 63275 -> 31.192.24.67 3527 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/05 08:37:57.415322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:38:29.421354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:44:33.428083 3.000939 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:44:40.434516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:44:48.436183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:45:04.439163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:45:36.445207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:54:47.459487 3.069043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 08:54:54.502736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:55:02.478945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:55:18.482192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 08:55:50.488033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:01:54.494439 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:02:01.501332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:02:09.503126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:02:25.505945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:02:57.512173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:07:54.349306 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 09:07:54.349510 0.030606 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:07:54.380538 0.061131 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:07:54.442085 0.141917 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:07:54.584511 0.132296 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:07:54.717221 0.000000 udp 10.0.2.105 7010 -> 183.82.42.251 7723 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:07:56.852578 0.537099 tcp 10.0.2.105 63276 -> 31.192.24.67 3527 FSPA* 0 0 14 1518 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:12.356691 0.050387 tcp 10.0.2.105 63277 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:12.407413 0.071852 tcp 10.0.2.105 63278 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:12.479630 0.221612 tcp 10.0.2.105 63279 -> 195.113.214.251 443 SRPA* 0 0 60 38485 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:12.701917 0.065181 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:12.767508 4.704124 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:17.472021 0.214814 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:17.687241 0.080353 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:17.768005 0.109362 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:17.877824 0.084035 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:17.962283 0.056663 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:18.019334 0.215619 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:18.235374 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:08:36.129592 0.049627 tcp 10.0.2.105 63280 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:36.179573 0.071559 tcp 10.0.2.105 63281 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:36.251380 0.170188 tcp 10.0.2.105 63282 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:36.422097 0.059263 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:36.481813 0.192033 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:36.674308 0.169690 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:36.844528 0.170577 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:37.015539 0.205691 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:37.221659 0.147672 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:37.369742 0.118092 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:37.488275 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2432 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:08:56.137962 0.050208 tcp 10.0.2.105 63283 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:56.188636 0.075592 tcp 10.0.2.105 63284 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:56.264603 0.163112 tcp 10.0.2.105 63285 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:08:56.428547 0.206867 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:56.635800 0.088732 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:56.724929 0.074516 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:56.799793 0.057410 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:56.857575 0.192074 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:08:57.050089 0.183545 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:09:02.519504 3.001808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 09:09:09.527328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:09:17.528523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:09:33.531408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:10:05.537467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:16:09.544550 3.000695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:16:16.550843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:16:24.552362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:16:40.555443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:17:12.561300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:23:16.567920 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:23:23.574953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:23:31.576703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:23:47.579396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:24:19.588625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:30:23.591735 3.001803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:30:30.664512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:30:38.612668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:30:54.613372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:31:26.619428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:37:30.625407 3.001523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:37:37.632934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:37:45.634166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:37:57.391979 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 09:37:57.392140 0.729031 tcp 10.0.2.105 63286 -> 31.192.24.67 3527 FSPA* 0 0 14 1513 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:38:01.637235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:38:33.643620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:39:26.080767 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 09:39:26.080878 0.158279 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:39:26.239630 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:39:43.956108 0.069793 tcp 10.0.2.105 63287 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:39:44.026202 0.076864 tcp 10.0.2.105 63288 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:39:44.103324 0.157876 tcp 10.0.2.105 63289 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:39:44.261717 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2432 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:40:02.331828 0.052500 tcp 10.0.2.105 63290 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:02.384637 0.071286 tcp 10.0.2.105 63291 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:02.456226 0.165168 tcp 10.0.2.105 63292 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:02.622546 0.142402 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:02.765359 0.064053 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:02.829851 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:40:19.826340 0.054435 tcp 10.0.2.105 63293 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:19.881021 0.074930 tcp 10.0.2.105 63294 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:19.956330 0.164286 tcp 10.0.2.105 63295 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 09:40:20.121251 0.133561 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:20.255174 0.064540 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:20.320101 0.098631 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:20.419151 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:40:25.538199 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 09:40:25.538587 0.056002 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:25.594950 0.238194 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:25.833522 0.082276 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:25.916228 0.752950 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:26.669595 0.045332 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:26.715420 0.169933 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:26.885691 0.208801 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:27.094936 0.695348 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:27.790694 0.058833 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:27.849969 0.200053 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.050439 0.167892 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.218685 0.091139 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.310234 0.089014 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.399649 0.076246 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.476405 0.203342 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.680129 0.184706 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:28.865261 0.205706 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:40:29.071325 0.084331 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/05 09:44:37.650817 3.000185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 09:44:44.656558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:44:52.658544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:45:08.661326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:45:40.667393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:54:49.680539 3.000441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 09:54:56.686645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:55:04.698102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:55:20.701106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 09:55:52.707241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:01:56.713373 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:02:03.721066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:02:11.722938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:02:27.725177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:02:59.731246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:07:58.120537 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 10:07:58.120738 3.003890 tcp 10.0.2.105 63296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 10:08:07.122786 0.000000 tcp 10.0.2.105 63296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 10:08:13.123358 0.051494 tcp 10.0.2.105 63297 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:13.175217 0.075324 tcp 10.0.2.105 63298 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:13.250921 0.172394 tcp 10.0.2.105 63299 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:13.446655 2.999909 tcp 10.0.2.105 63300 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 10:08:22.445377 0.000000 tcp 10.0.2.105 63300 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 10:08:28.444598 0.049354 tcp 10.0.2.105 63301 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:28.494288 0.074021 tcp 10.0.2.105 63302 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:28.568572 0.156619 tcp 10.0.2.105 63303 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:08:28.737934 0.598905 tcp 10.0.2.105 63304 -> 176.73.115.123 1806 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:09:05.739856 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 10:09:12.747492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:09:20.748908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:09:36.752034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:10:08.758417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:10:38.821659 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 10:10:38.821757 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 10:10:56.817812 0.050096 tcp 10.0.2.105 63305 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:10:56.868231 0.068296 tcp 10.0.2.105 63306 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:10:56.936801 0.152155 tcp 10.0.2.105 63307 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:10:57.089590 0.156137 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.246155 0.147369 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.393919 0.066648 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.460937 0.134868 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.596254 0.067574 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.664165 0.119306 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:57.783897 0.221031 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.005382 0.072750 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.078538 0.207299 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.286282 0.082642 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.369352 0.183553 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.553361 0.045319 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.599066 0.172151 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.771630 0.203616 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:58.975591 0.191656 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:59.167704 0.170287 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:59.338443 0.086345 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:10:59.425252 0.840377 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:00.266111 0.061684 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:00.328437 0.074059 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:00.402958 0.056407 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:00.459898 0.191707 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:00.652048 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 10:11:18.349702 0.050316 tcp 10.0.2.105 63308 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:11:18.399768 0.075299 tcp 10.0.2.105 63309 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:11:18.475376 0.151715 tcp 10.0.2.105 63310 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:11:18.627737 0.204928 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:11:18.833110 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 10:11:36.785240 0.050039 tcp 10.0.2.105 63311 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:11:36.835641 0.071949 tcp 10.0.2.105 63312 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:11:36.907979 0.153386 tcp 10.0.2.105 63313 -> 195.113.214.251 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:16:12.764129 3.001426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 10:16:19.771593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:16:27.773401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:16:43.805967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:17:15.812102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:23:19.818492 3.001141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:23:26.825443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:23:34.827129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:23:50.829879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:24:22.835978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:30:26.842388 3.038868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:30:33.859488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:30:41.862002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:30:57.863889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:31:29.869968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:37:33.876278 3.000796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:37:40.883525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:37:48.885016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:38:04.887901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:38:29.373659 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 10:38:29.373766 0.828398 tcp 10.0.2.105 63314 -> 176.73.115.123 1806 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:38:36.893766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:41:49.951906 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 10:41:49.952070 0.086413 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.038951 0.191377 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.230670 0.162511 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.393605 0.146332 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.540347 0.065759 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.606488 0.111472 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.718364 0.227254 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:50.946046 0.078422 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:51.024883 4.049622 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:55.074905 0.060061 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:55.135398 0.062920 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:55.198804 0.144934 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:41:55.344194 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 10:42:11.173904 0.051170 tcp 10.0.2.105 63315 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:42:11.224934 0.076418 tcp 10.0.2.105 63316 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:42:11.301657 0.155761 tcp 10.0.2.105 63317 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/05 10:42:11.457960 0.201895 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:11.660284 0.170189 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:11.830909 0.081156 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:11.912470 0.058603 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:11.971448 0.171424 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.143250 0.125864 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.269508 0.147018 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.416922 0.059443 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.476778 0.056228 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.533378 0.079286 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.613105 0.186658 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:42:12.800205 0.207071 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/05 10:44:40.900761 3.000905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:44:47.907383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:44:55.908242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:45:11.912088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:45:43.917928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:54:51.929113 3.000951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 10:54:58.935466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:55:06.937509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:55:22.940682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 10:55:54.946766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:01:58.952939 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:02:05.959774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:02:13.961425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:02:29.964211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:03:01.970747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:08:30.203416 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 11:08:30.203530 0.741166 tcp 10.0.2.105 63318 -> 176.73.115.123 1806 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/02/05 11:09:13.987851 3.001235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:09:20.995314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:09:28.996861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:09:44.999703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:10:17.005267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:12:20.614143 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 11:12:20.614439 0.204479 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:20.819386 0.085387 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:20.905159 0.191256 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.096891 0.142963 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.240318 0.060535 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.301282 0.096578 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.398238 0.270388 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.669056 0.080644 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.750104 0.157348 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:21.907921 3.659963 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:25.568291 0.056449 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:25.625246 0.065294 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:25.690910 0.131784 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:25.823116 0.167974 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:25.991497 0.529771 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:26.521646 0.044460 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:26.566535 0.176119 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:26.743070 0.087030 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:26.887173 0.184987 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.072641 0.060184 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.133293 0.059304 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.192996 0.084304 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.277669 0.232671 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.510763 0.197557 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:12:27.708752 0.146877 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:16:21.012364 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:16:28.020174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:16:36.020210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:16:52.023793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:17:24.029732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:23:28.036903 3.000398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:23:35.043191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:23:43.044928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:23:59.047858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:24:31.053753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:30:35.059610 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:30:42.066982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:30:50.068772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:31:06.071706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:31:38.077437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:37:42.084478 3.128925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:37:49.179955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:37:57.116033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:38:13.105736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:38:30.955729 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 11:38:30.955857 0.630166 tcp 10.0.2.105 63319 -> 176.73.115.123 1806 FSPA* 0 0 15 1733 flow=From-Botnet-V2-TCP-Established 1970/02/05 11:38:45.111688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:42:53.879681 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 11:42:53.879788 0.203405 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.083557 0.090132 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.174039 0.189696 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.364142 0.148921 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.513476 0.070592 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.584496 0.098744 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.683656 0.154473 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:54.838514 0.222837 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:55.061720 0.087797 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:55.149900 0.707681 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:55.857970 0.057806 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:55.916179 0.061131 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:55.977700 0.131011 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.109063 0.170241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.279742 0.075832 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.355975 0.045372 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.401769 0.236043 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.638171 0.087252 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.725779 0.196193 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.922347 0.057763 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:56.980650 0.056690 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:57.037726 0.212022 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:57.250165 0.147572 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:42:57.398201 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 11:43:14.240817 0.053990 tcp 10.0.2.105 63320 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 11:43:14.295102 0.071699 tcp 10.0.2.105 63321 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 11:43:14.367137 0.158059 tcp 10.0.2.105 63322 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 11:43:14.525668 0.188436 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/02/05 11:44:49.118322 3.000903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:44:56.125100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:45:04.126892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:45:20.129639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:45:52.135637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:51:56.141883 3.001588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:52:03.149047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:52:11.150337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:52:27.153483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:52:59.159303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:59:03.165023 3.018454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 11:59:10.182758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:59:18.184693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 11:59:34.187854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:00:06.193788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:06:35.205339 3.002195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 12:06:42.212980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:06:50.214552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:07:06.217600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:07:38.223685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:08:31.591376 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:08:31.591561 3.003221 tcp 10.0.2.105 63323 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:08:40.593166 0.000000 tcp 10.0.2.105 63323 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:08:46.596193 0.055571 tcp 10.0.2.105 63324 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:08:46.652200 0.075524 tcp 10.0.2.105 63325 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:08:46.728036 0.158530 tcp 10.0.2.105 63326 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:08:47.373689 3.003571 tcp 10.0.2.105 63327 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:08:56.386125 0.000000 tcp 10.0.2.105 63327 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:02.375457 0.055790 tcp 10.0.2.105 63328 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:02.431539 0.070497 tcp 10.0.2.105 63329 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:02.502419 0.155181 tcp 10.0.2.105 63330 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:03.187601 0.636341 tcp 10.0.2.105 63331 -> 82.20.121.6 1791 FSPA* 0 0 13 1412 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:03.284846 0.055041 tcp 10.0.2.105 63332 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:03.340168 0.067408 tcp 10.0.2.105 63333 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:03.407965 0.158279 tcp 10.0.2.105 63334 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:03.824193 2.996682 tcp 10.0.2.105 63335 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:12.819326 0.000000 tcp 10.0.2.105 63335 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:18.818736 0.055993 tcp 10.0.2.105 63336 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:18.875014 0.073048 tcp 10.0.2.105 63337 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:18.948393 0.162664 tcp 10.0.2.105 63338 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:19.234138 2.998953 tcp 10.0.2.105 63339 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:28.231859 0.000000 tcp 10.0.2.105 63339 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:34.230858 0.053266 tcp 10.0.2.105 63340 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:34.284518 0.075907 tcp 10.0.2.105 63341 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:34.360750 0.155150 tcp 10.0.2.105 63342 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:34.826860 2.998591 tcp 10.0.2.105 63343 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:43.824023 0.000000 tcp 10.0.2.105 63343 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:49.822958 0.052164 tcp 10.0.2.105 63344 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:49.875382 0.075148 tcp 10.0.2.105 63345 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:49.950379 0.156253 tcp 10.0.2.105 63346 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:09:50.219750 3.007557 tcp 10.0.2.105 63347 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:09:59.236457 0.000000 tcp 10.0.2.105 63347 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:05.215908 0.053005 tcp 10.0.2.105 63348 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:10:05.269220 0.077342 tcp 10.0.2.105 63349 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:10:05.346853 0.156858 tcp 10.0.2.105 63350 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:10:05.519464 3.000243 tcp 10.0.2.105 63351 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:14.518217 0.000000 tcp 10.0.2.105 63351 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:20.517285 3.004382 tcp 10.0.2.105 63352 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:29.520317 0.000000 tcp 10.0.2.105 63352 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:34.346763 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:10:35.518857 0.083906 tcp 10.0.2.105 63353 -> 82.20.121.6 1791 FSPA* 0 0 13 1412 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:10:35.603002 2.999773 tcp 10.0.2.105 63354 -> 82.17.183.230 3113 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:44.604546 0.000000 tcp 10.0.2.105 63354 -> 82.17.183.230 3113 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:50.600402 3.003835 tcp 10.0.2.105 63355 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:10:59.603025 0.000000 tcp 10.0.2.105 63355 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:11:04.340030 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:11:05.602218 3.006547 tcp 10.0.2.105 63356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:11:14.604710 0.000000 tcp 10.0.2.105 63356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:11:20.603347 2.994418 tcp 10.0.2.105 63357 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:11:28.344658 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:11:29.606098 0.000000 tcp 10.0.2.105 63357 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:13:23.100243 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:13:23.100359 0.077982 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:23.178854 0.196306 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:23.375564 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 12:13:40.586859 0.054740 tcp 10.0.2.105 63358 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:13:40.641948 0.071855 tcp 10.0.2.105 63359 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:13:40.714183 0.156975 tcp 10.0.2.105 63360 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:13:40.871851 0.086057 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:40.958388 0.064423 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.067684 0.096957 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.165060 0.159198 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.324619 0.223318 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.548460 0.144385 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.693326 0.071059 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.764840 0.063904 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.829198 0.140428 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:41.970044 0.169863 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.140380 0.417766 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.229846 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 12:13:42.558618 0.059379 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.618450 0.114589 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.733446 0.169341 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.903200 0.084606 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:42.988389 0.184335 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:43.173073 0.058176 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:43.231593 0.114969 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:43.346907 0.563855 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:43.911126 0.047949 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:43.959571 0.144560 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:44.104680 0.186479 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:13:49.236837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:13:57.238983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:14:13.241590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:14:45.247674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:16:35.606492 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:16:35.606639 2.993564 tcp 10.0.2.105 63361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:16:44.599227 0.000000 tcp 10.0.2.105 63361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:16:50.609693 0.052992 tcp 10.0.2.105 63362 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:16:50.662977 0.078612 tcp 10.0.2.105 63363 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:16:50.741898 0.162919 tcp 10.0.2.105 63364 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:16:51.265923 2.997110 tcp 10.0.2.105 63365 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:00.261942 0.000000 tcp 10.0.2.105 63365 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:06.260868 0.053068 tcp 10.0.2.105 63366 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:06.314228 0.075048 tcp 10.0.2.105 63367 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:06.389086 0.158265 tcp 10.0.2.105 63368 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:06.796521 2.998833 tcp 10.0.2.105 63369 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:15.793977 0.000000 tcp 10.0.2.105 63369 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:21.793109 0.056228 tcp 10.0.2.105 63370 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:21.849639 0.071338 tcp 10.0.2.105 63371 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:21.921330 0.155676 tcp 10.0.2.105 63372 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:22.097644 0.396970 tcp 10.0.2.105 63373 -> 82.20.121.6 1791 FSPA* 0 0 13 1412 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:22.193491 0.052658 tcp 10.0.2.105 63374 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:22.246449 0.076804 tcp 10.0.2.105 63375 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:22.323108 0.157349 tcp 10.0.2.105 63376 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:17:22.494904 2.993030 tcp 10.0.2.105 63377 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:31.496693 0.000000 tcp 10.0.2.105 63377 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:37.495517 2.993946 tcp 10.0.2.105 63378 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:46.487940 0.000000 tcp 10.0.2.105 63378 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:17:51.346574 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:17:52.497479 2.993582 tcp 10.0.2.105 63379 -> 95.104.31.172 9016 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:18:01.489836 0.000000 tcp 10.0.2.105 63379 -> 95.104.31.172 9016 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:18:07.498334 0.113374 tcp 10.0.2.105 63380 -> 82.20.121.6 1791 FSPA* 0 0 13 1412 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:20:49.253989 3.001425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 12:20:56.261041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:21:04.262143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:21:20.265639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:21:52.271773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:23:07.610459 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:23:07.610602 3.003526 tcp 10.0.2.105 63381 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:23:16.612739 0.000000 tcp 10.0.2.105 63381 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:23:22.613602 0.116695 tcp 10.0.2.105 63382 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:22.730602 0.076125 tcp 10.0.2.105 63383 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:22.806539 0.164623 tcp 10.0.2.105 63384 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:23.108050 3.008008 tcp 10.0.2.105 63385 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:23:32.115165 0.000000 tcp 10.0.2.105 63385 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:23:38.104111 0.051940 tcp 10.0.2.105 63386 -> 195.113.214.221 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:38.156367 0.071816 tcp 10.0.2.105 63387 -> 195.113.214.251 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:38.228576 0.300638 tcp 10.0.2.105 63388 -> 195.113.214.251 443 SRPA* 0 0 21 12821 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:23:38.601986 0.042081 tcp 10.0.2.105 63389 -> 82.20.121.6 1791 SPA_* 0 0 9 1083 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:24:08.638623 0.052151 tcp 10.0.2.105 63390 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:24:08.691075 0.075034 tcp 10.0.2.105 63391 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:24:08.705472 0.266179 tcp 10.0.2.105 63389 -> 82.20.121.6 1791 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:24:08.766473 0.156896 tcp 10.0.2.105 63392 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:24:08.971883 3.000126 tcp 10.0.2.105 63393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:24:17.970382 0.000000 tcp 10.0.2.105 63393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:24:23.969680 3.004311 tcp 10.0.2.105 63394 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:24:32.972678 0.000000 tcp 10.0.2.105 63394 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:24:37.839558 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:24:38.971542 3.538351 tcp 10.0.2.105 63395 -> 82.20.121.6 1791 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:27:56.277860 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 12:28:03.284647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:28:11.286742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:28:27.289436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:28:59.305661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:35:03.321815 3.044951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 12:35:10.345833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:35:18.340561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:35:34.343394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:36:06.349661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:42:10.366343 3.054093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 12:42:17.398629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:42:25.384147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:42:41.397678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:43:13.413536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:43:59.410229 0.029234 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:43:59.439655 0.232544 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:43:59.644038 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 12:44:15.172387 0.053838 tcp 10.0.2.105 63396 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:15.226522 0.071494 tcp 10.0.2.105 63397 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:15.298343 0.158090 tcp 10.0.2.105 63398 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:15.456967 0.194163 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:15.645869 0.137061 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:15.745518 0.158675 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:15.951051 0.093306 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:16.034826 0.075591 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:16.198394 0.258311 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:16.421137 0.170031 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:16.567612 0.099661 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:17.092355 0.082173 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:17.159260 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 12:44:35.011726 0.052712 tcp 10.0.2.105 63399 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:35.064673 0.073198 tcp 10.0.2.105 63400 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:35.138101 0.152227 tcp 10.0.2.105 63401 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:44:35.290853 0.172014 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:35.459495 0.840887 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:36.489590 0.077364 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:36.549346 0.165167 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:36.817044 0.255620 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.256084 0.127600 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.341077 0.212135 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.552036 0.059732 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.610746 0.072036 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.777525 0.171900 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:38.950047 0.204098 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:39.140258 0.255188 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:44:39.504692 0.056307 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/05 12:53:40.644715 2.976377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 12:53:47.687236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:53:55.583186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:54:11.363807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:54:42.926427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 12:54:47.902350 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:54:47.902441 2.950649 tcp 10.0.2.105 63402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:54:56.785840 0.000000 tcp 10.0.2.105 63402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:02.702509 0.053612 tcp 10.0.2.105 63403 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:02.756497 0.076132 tcp 10.0.2.105 63404 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:02.832975 0.156644 tcp 10.0.2.105 63405 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:03.060422 2.949250 tcp 10.0.2.105 63406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:12.004834 0.000000 tcp 10.0.2.105 63406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:17.920377 0.051608 tcp 10.0.2.105 63407 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:17.972281 0.074362 tcp 10.0.2.105 63408 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:18.046984 0.154979 tcp 10.0.2.105 63409 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:18.385537 2.958589 tcp 10.0.2.105 63410 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:27.252269 0.000000 tcp 10.0.2.105 63410 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:33.157530 0.053314 tcp 10.0.2.105 63411 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:33.211141 0.066602 tcp 10.0.2.105 63412 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:33.278017 0.157927 tcp 10.0.2.105 63413 -> 195.113.214.251 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:33.826322 2.964561 tcp 10.0.2.105 63414 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:42.708645 0.000000 tcp 10.0.2.105 63414 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:48.627423 0.052553 tcp 10.0.2.105 63415 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:48.680375 0.070020 tcp 10.0.2.105 63416 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:48.750684 0.155984 tcp 10.0.2.105 63417 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:55:49.204375 2.959600 tcp 10.0.2.105 63418 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:55:58.129822 0.000000 tcp 10.0.2.105 63418 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:04.035982 0.052305 tcp 10.0.2.105 63419 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:56:04.088614 0.075029 tcp 10.0.2.105 63420 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:56:04.163908 0.151294 tcp 10.0.2.105 63421 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 12:56:04.412346 2.953623 tcp 10.0.2.105 63422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:13.290099 0.000000 tcp 10.0.2.105 63422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:19.208429 2.961648 tcp 10.0.2.105 63423 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:28.129379 0.000000 tcp 10.0.2.105 63423 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:32.994032 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:56:34.051294 2.964301 tcp 10.0.2.105 63424 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:42.930467 0.000000 tcp 10.0.2.105 63424 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:48.844988 2.970710 tcp 10.0.2.105 63425 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:56:56.661718 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 12:56:57.730501 0.000000 tcp 10.0.2.105 63425 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:57:03.644523 2.964952 tcp 10.0.2.105 63426 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 12:57:12.526305 0.000000 tcp 10.0.2.105 63426 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:00:42.119887 2.959715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:00:49.025096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:00:56.921208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:01:12.708649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:01:44.490976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:02:14.924687 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:02:14.924770 2.994279 tcp 10.0.2.105 63427 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:02:23.917725 0.000000 tcp 10.0.2.105 63427 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:02:29.931135 0.054894 tcp 10.0.2.105 63428 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:29.986422 0.069840 tcp 10.0.2.105 63429 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:30.056630 0.156300 tcp 10.0.2.105 63430 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:30.337448 2.994349 tcp 10.0.2.105 63431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:02:39.332110 0.000000 tcp 10.0.2.105 63431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:02:45.329376 0.052199 tcp 10.0.2.105 63432 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:45.381971 0.075295 tcp 10.0.2.105 63433 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:45.457532 0.154907 tcp 10.0.2.105 63434 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:02:45.713117 2.990083 tcp 10.0.2.105 63435 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:02:54.701940 0.000000 tcp 10.0.2.105 63435 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:00.701192 0.053382 tcp 10.0.2.105 63436 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:00.754443 0.074881 tcp 10.0.2.105 63437 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:00.829640 0.162936 tcp 10.0.2.105 63438 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:01.025311 3.000108 tcp 10.0.2.105 63439 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:10.099120 0.000000 tcp 10.0.2.105 63439 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:16.044296 0.052482 tcp 10.0.2.105 63440 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:16.097065 0.070221 tcp 10.0.2.105 63441 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:16.167629 0.151581 tcp 10.0.2.105 63442 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:03:16.358035 2.979465 tcp 10.0.2.105 63443 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:25.345907 0.000000 tcp 10.0.2.105 63443 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:31.334105 2.994873 tcp 10.0.2.105 63444 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:40.337396 0.000000 tcp 10.0.2.105 63444 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:44.844555 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:03:46.336551 2.993978 tcp 10.0.2.105 63445 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:03:55.329010 0.000000 tcp 10.0.2.105 63445 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:04:01.341723 3.000990 tcp 10.0.2.105 63446 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:04:09.339222 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:04:10.340933 0.000000 tcp 10.0.2.105 63446 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:07:48.497150 3.060076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:07:55.535676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:08:05.267467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:08:21.082523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:08:52.702731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:09:17.210694 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:09:17.210865 2.973383 tcp 10.0.2.105 63447 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:09:26.109723 0.000000 tcp 10.0.2.105 63447 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:09:32.035591 0.055714 tcp 10.0.2.105 63448 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:32.091600 0.077313 tcp 10.0.2.105 63449 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:32.169265 0.152637 tcp 10.0.2.105 63450 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:32.459834 2.966122 tcp 10.0.2.105 63451 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:09:41.365409 0.000000 tcp 10.0.2.105 63451 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:09:47.281759 0.053193 tcp 10.0.2.105 63452 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:47.335326 0.070720 tcp 10.0.2.105 63453 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:47.406373 0.158862 tcp 10.0.2.105 63454 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:09:47.594295 2.959391 tcp 10.0.2.105 63455 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:09:56.487122 0.000000 tcp 10.0.2.105 63455 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:02.414569 0.051936 tcp 10.0.2.105 63456 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:02.466837 0.075343 tcp 10.0.2.105 63457 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:02.542500 0.157535 tcp 10.0.2.105 63458 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:02.924901 2.956048 tcp 10.0.2.105 63459 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:11.809423 0.000000 tcp 10.0.2.105 63459 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:17.734689 0.052854 tcp 10.0.2.105 63460 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:17.787427 0.074513 tcp 10.0.2.105 63461 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:17.862288 0.154535 tcp 10.0.2.105 63462 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:10:18.239641 2.964222 tcp 10.0.2.105 63463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:27.126269 0.000000 tcp 10.0.2.105 63463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:33.111043 3.004366 tcp 10.0.2.105 63464 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:42.114021 0.000000 tcp 10.0.2.105 63464 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:46.840511 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:10:48.112949 3.003437 tcp 10.0.2.105 63465 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:10:57.115640 0.000000 tcp 10.0.2.105 63465 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:11:03.114549 2.993353 tcp 10.0.2.105 63466 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:11:10.845219 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:11:12.116995 0.000000 tcp 10.0.2.105 63466 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:14:55.540785 3.002181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:14:57.701695 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:14:57.701825 0.080024 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:14:57.782253 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:15:02.548129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:15:10.549883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:15:16.680686 0.053186 tcp 10.0.2.105 63467 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:16.734147 0.070511 tcp 10.0.2.105 63468 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:16.805030 0.150758 tcp 10.0.2.105 63469 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:16.956308 0.203124 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:17.159856 0.098443 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:17.258686 0.154108 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:17.413232 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:15:26.553051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:15:33.874058 0.053079 tcp 10.0.2.105 63470 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:33.927369 0.070351 tcp 10.0.2.105 63471 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:33.998007 0.155966 tcp 10.0.2.105 63472 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:34.154339 0.181856 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.336736 0.214609 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.551830 0.062861 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.615238 0.087118 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.702781 0.145022 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.848205 0.062389 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:34.910978 0.168803 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:35.080145 0.734325 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:35.814874 0.055961 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:35.871237 0.112857 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:35.984476 0.170985 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:36.155911 0.094020 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:36.250291 0.192882 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:36.443584 0.056499 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:36.500507 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:15:53.762500 0.052363 tcp 10.0.2.105 63473 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:53.815114 0.074881 tcp 10.0.2.105 63474 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:53.890296 0.149160 tcp 10.0.2.105 63475 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:15:54.040368 0.145647 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:54.186405 0.192720 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:54.379549 0.368525 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:54.748606 0.046329 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:15:55.127421 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 REQ 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:15:58.559070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:16:00.962696 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 REQ 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:07.876057 0.080879 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:07.957505 0.103757 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.061815 0.205096 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.267447 0.154959 udp 10.0.2.105 7010 <-> 183.82.42.251 7723 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.422912 0.182345 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.605808 0.084422 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.690717 0.056400 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:08.747624 0.287087 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.035209 0.051645 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.087346 0.169654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.257498 0.146383 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.404551 0.122858 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.527887 0.171550 udp 10.0.2.105 7010 <-> 76.216.212.201 7764 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.699980 0.088935 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.789452 0.045913 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:09.835975 0.349983 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.186374 0.190990 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.377801 0.052225 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.430458 0.189344 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.620307 0.147599 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.797323 0.048018 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:10.845907 0.302364 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:16:11.148854 0.000000 udp 10.0.2.105 7010 -> 69.117.174.147 5436 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:18.117863 3.003426 tcp 10.0.2.105 63476 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:16:18.497778 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:22.843703 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:16:23.565176 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:27.120056 0.000000 tcp 10.0.2.105 63476 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:16:32.036768 0.000000 udp 10.0.2.105 7010 -> 86.1.33.56 9963 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:33.118728 0.052575 tcp 10.0.2.105 63477 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:33.171687 0.074894 tcp 10.0.2.105 63478 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:33.246907 0.157080 tcp 10.0.2.105 63479 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:33.653182 3.000445 tcp 10.0.2.105 63480 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:16:40.880081 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:42.652155 0.000000 tcp 10.0.2.105 63480 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:16:48.050261 0.000000 udp 10.0.2.105 7010 -> 81.108.249.65 2974 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:48.652094 0.051738 tcp 10.0.2.105 63481 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:48.704170 0.072100 tcp 10.0.2.105 63482 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:48.776542 0.159002 tcp 10.0.2.105 63483 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:16:49.175178 3.000882 tcp 10.0.2.105 63484 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:16:53.788686 0.000000 udp 10.0.2.105 7010 -> 84.157.223.158 7219 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:16:58.174613 0.000000 tcp 10.0.2.105 63484 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:00.638699 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:04.173899 0.052733 tcp 10.0.2.105 63485 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:04.226896 0.070370 tcp 10.0.2.105 63486 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:04.297584 0.163389 tcp 10.0.2.105 63487 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:04.749308 2.999125 tcp 10.0.2.105 63488 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:09.030383 0.000000 udp 10.0.2.105 7010 -> 79.44.153.202 8969 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:13.756925 0.000000 tcp 10.0.2.105 63488 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:16.857595 0.000000 udp 10.0.2.105 7010 -> 93.148.160.109 5700 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:19.747370 0.052031 tcp 10.0.2.105 63489 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:19.799675 0.074314 tcp 10.0.2.105 63490 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:19.874319 0.164729 tcp 10.0.2.105 63491 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:17:20.156157 2.983861 tcp 10.0.2.105 63492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:24.212190 0.000000 udp 10.0.2.105 7010 -> 82.14.157.172 5510 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:29.138676 0.000000 tcp 10.0.2.105 63492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:31.317020 0.000000 udp 10.0.2.105 7010 -> 77.30.220.169 4294 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:35.148183 3.004172 tcp 10.0.2.105 63493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:36.541134 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 1029 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:41.777538 0.074423 udp 10.0.2.105 7010 -> 78.177.112.7 9899 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:41.851961 0.000000 icmp 78.177.112.7 0x0303 -> 10.0.2.105 0xab26 URP 192 1 314 flow=Background 1970/02/05 13:17:44.150486 0.000000 tcp 10.0.2.105 63493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:46.343861 0.109840 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:17:47.407470 0.000000 udp 10.0.2.105 7010 -> 81.137.205.62 2561 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:50.220319 2.980175 tcp 10.0.2.105 63494 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:53.071195 0.000000 udp 10.0.2.105 7010 -> 89.66.195.193 5899 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:17:59.153055 0.000000 tcp 10.0.2.105 63494 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:17:59.533266 0.000000 udp 10.0.2.105 7010 -> 193.120.46.36 3523 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:05.150494 3.004775 tcp 10.0.2.105 63495 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:18:08.215855 0.000000 udp 10.0.2.105 7010 -> 76.226.133.17 7808 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:12.841847 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:18:14.153815 0.000000 tcp 10.0.2.105 63495 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:18:15.546071 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:22.536030 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:31.489002 0.160429 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 8 3219 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:18:31.738605 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:37.868049 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:42.845067 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:18:45.459144 0.000000 udp 10.0.2.105 7010 -> 67.101.181.10 6351 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:18:54.231737 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:01.451973 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:08.221676 0.000000 udp 10.0.2.105 7010 -> 86.128.77.106 8153 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:12.838487 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:19:13.309330 0.076762 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 8 2957 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:19:13.736450 0.000000 udp 10.0.2.105 7010 -> 203.134.180.98 9063 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:18.987388 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:26.217686 0.000000 udp 10.0.2.105 7010 -> 208.124.117.254 6762 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:33.358119 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:38.344877 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:19:40.818486 0.000000 udp 10.0.2.105 7010 -> 93.46.211.168 3954 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:48.599684 0.000000 udp 10.0.2.105 7010 -> 81.96.12.143 3259 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:19:56.781549 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:03.971926 0.156386 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:20:04.377745 0.000000 udp 10.0.2.105 7010 -> 58.6.69.221 7479 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:08.838624 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:20:10.320931 0.000000 udp 10.0.2.105 7010 -> 96.237.109.8 9774 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:18.683246 0.000000 udp 10.0.2.105 7010 -> 109.156.102.200 6171 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:25.012590 0.000000 udp 10.0.2.105 7010 -> 90.203.66.181 6271 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:33.806762 0.000000 udp 10.0.2.105 7010 -> 121.97.49.118 4252 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:38.340759 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:20:39.927996 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:48.916675 0.000000 udp 10.0.2.105 7010 -> 97.66.8.138 4525 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:20:56.126449 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:01.614944 0.125228 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:01.740172 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 283 flow=Background 1970/02/05 13:21:06.343214 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:21:07.803725 0.000000 udp 10.0.2.105 7010 -> 94.9.204.103 5485 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:14.373227 0.000000 udp 10.0.2.105 7010 -> 201.247.102.50 9184 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:19.590250 0.000000 udp 10.0.2.105 7010 -> 70.59.255.141 8985 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:25.158878 0.000000 udp 10.0.2.105 7010 -> 93.34.182.128 1324 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:33.961171 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:38.844796 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:21:40.881341 0.000000 udp 10.0.2.105 7010 -> 82.0.26.58 4263 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:46.082874 0.000000 udp 10.0.2.105 7010 -> 109.151.79.2 1644 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:21:54.841445 0.000000 udp 10.0.2.105 7010 -> 82.54.92.221 1675 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:02.726133 3.000765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:22:03.683972 0.000000 udp 10.0.2.105 7010 -> 207.54.97.171 3116 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:08.340511 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:22:09.732678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:22:11.106020 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:17.734311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:22:18.699020 0.000000 udp 10.0.2.105 7010 -> 94.68.230.176 3325 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:23.903147 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1203 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:30.805032 0.000000 udp 10.0.2.105 7010 -> 92.0.98.107 9620 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:33.737292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:22:35.340222 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:22:39.355381 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:46.114739 0.000000 udp 10.0.2.105 7010 -> 37.116.177.233 5312 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:55.102194 0.000000 udp 10.0.2.105 7010 -> 23.24.137.233 5591 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:22:59.844586 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:23:02.579054 0.000000 udp 10.0.2.105 7010 -> 81.7.66.226 8867 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:05.749795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:23:08.468916 0.000000 udp 10.0.2.105 7010 -> 70.45.165.242 1606 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:13.474123 0.000000 udp 10.0.2.105 7010 -> 209.44.18.43 6239 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:19.863632 0.000000 udp 10.0.2.105 7010 -> 41.233.98.213 8752 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:20.154422 2.993726 tcp 10.0.2.105 63496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:23:24.840678 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:23:28.085332 0.000000 udp 10.0.2.105 7010 -> 190.85.215.138 9238 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:29.157163 0.000000 tcp 10.0.2.105 63496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:23:34.806812 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:35.186100 0.053102 tcp 10.0.2.105 63497 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:35.239509 0.067452 tcp 10.0.2.105 63498 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:35.307268 0.152751 tcp 10.0.2.105 63499 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:35.798892 2.971699 tcp 10.0.2.105 63500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:23:42.696363 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:44.769347 0.000000 tcp 10.0.2.105 63500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:23:48.224141 0.000000 udp 10.0.2.105 7010 -> 108.236.234.31 9301 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:23:50.770193 0.052458 tcp 10.0.2.105 63501 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:50.822945 0.076437 tcp 10.0.2.105 63502 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:50.899180 0.152255 tcp 10.0.2.105 63503 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:23:51.275174 3.097486 tcp 10.0.2.105 63504 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:23:55.446331 0.084712 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 8 2778 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:23:55.585557 0.000000 udp 10.0.2.105 7010 -> 79.20.178.83 3601 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:00.317394 0.000000 tcp 10.0.2.105 63504 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:24:03.369807 0.341584 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3060 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:24:03.788240 0.000000 udp 10.0.2.105 7010 -> 151.60.13.16 9196 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:06.280494 3.003830 tcp 10.0.2.105 63505 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:24:11.465216 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:15.413589 0.000000 tcp 10.0.2.105 63505 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:24:15.968687 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:24:20.112322 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:27.434377 0.000000 udp 10.0.2.105 7010 -> 206.217.86.130 8951 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:34.030241 0.000000 udp 10.0.2.105 7010 -> 82.59.219.32 2391 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:39.638680 0.000000 udp 10.0.2.105 7010 -> 82.18.65.99 9386 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:44.344960 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:24:44.745854 0.000000 udp 10.0.2.105 7010 -> 196.217.177.242 9737 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:50.263595 0.000000 udp 10.0.2.105 7010 -> 109.173.135.202 9318 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:24:58.725926 0.000000 udp 10.0.2.105 7010 -> 189.245.226.160 6807 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:04.974432 0.000000 udp 10.0.2.105 7010 -> 78.185.233.140 2204 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:09.841719 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:25:13.456536 0.000000 udp 10.0.2.105 7010 -> 173.25.102.96 9963 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:20.537035 0.000000 udp 10.0.2.105 7010 -> 62.30.127.41 5086 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:25.564400 0.000000 udp 10.0.2.105 7010 -> 120.151.164.197 5058 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:33.165338 0.436923 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 2993 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:25:33.704621 0.000000 udp 10.0.2.105 7010 -> 105.236.46.9 5334 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:37.841890 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:25:40.526074 0.000000 udp 10.0.2.105 7010 -> 67.175.131.36 4249 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:47.916532 0.140679 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3130 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:25:48.077666 0.000000 udp 10.0.2.105 7010 -> 92.241.68.222 7377 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:25:56.909302 0.000000 udp 10.0.2.105 7010 -> 93.43.226.170 5225 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:01.846075 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:26:05.120757 0.000000 udp 10.0.2.105 7010 -> 79.37.103.65 4201 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:11.259791 0.000000 udp 10.0.2.105 7010 -> 207.119.2.108 8296 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:18.405961 0.179251 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 8 3261 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:26:18.778020 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:27.504222 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:32.402063 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:26:33.282164 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5362 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:41.932046 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:49.975576 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:26:56.815554 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 2833 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:01.341826 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:27:05.528024 0.000000 udp 10.0.2.105 7010 -> 111.242.43.63 1084 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:14.420878 0.559063 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 8 3066 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:27:14.999779 0.447608 udp 10.0.2.105 7010 <-> 187.206.203.77 2527 CON 0 0 8 2928 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:27:15.492519 0.000000 udp 10.0.2.105 7010 -> 75.187.240.100 3726 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:21.763224 0.000000 udp 10.0.2.105 7010 -> 99.103.56.21 3499 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:26.347606 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:27:27.269335 0.000000 udp 10.0.2.105 7010 -> 87.195.147.110 2851 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:32.857368 0.000000 udp 10.0.2.105 7010 -> 64.198.99.165 3684 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:38.004498 0.000000 udp 10.0.2.105 7010 -> 124.254.77.63 7666 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:46.997602 0.000000 udp 10.0.2.105 7010 -> 108.12.49.100 8954 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:27:51.844347 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:27:54.388449 0.000000 udp 10.0.2.105 7010 -> 190.189.35.186 9043 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:00.997925 0.000000 udp 10.0.2.105 7010 -> 5.67.30.167 5450 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:09.209810 0.000000 udp 10.0.2.105 7010 -> 188.10.90.67 4180 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:16.049207 0.000000 udp 10.0.2.105 7010 -> 82.21.57.81 2107 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:20.845973 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:28:22.478725 0.499331 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:28:23.110664 0.778731 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 8 2981 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:28:24.196001 0.000000 udp 10.0.2.105 7010 -> 87.10.118.145 9265 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:31.851911 0.000000 udp 10.0.2.105 7010 -> 76.21.147.155 2295 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:39.375778 0.219872 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 8 2916 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:28:39.810347 0.000000 udp 10.0.2.105 7010 -> 82.144.250.33 8011 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:47.835158 0.000000 udp 10.0.2.105 7010 -> 181.65.11.247 4630 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:28:52.341236 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:28:55.085818 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:29:04.078463 0.000000 udp 10.0.2.105 7010 -> 94.122.136.216 5160 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:29:09.749574 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:29:11.889641 0.036221 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:29:11.925862 0.000000 icmp 217.91.253.138 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 289 flow=Background 1970/02/05 13:29:16.756746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:29:16.846641 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:29:17.978289 0.356255 udp 10.0.2.105 7010 <-> 68.170.233.169 6072 CON 0 0 8 3176 flow=From-Botnet-V2-UDP-Established 1970/02/05 13:29:18.397309 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:29:21.283619 3.003678 tcp 10.0.2.105 63506 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:29:23.927277 0.000000 udp 10.0.2.105 7010 -> 216.229.112.4 5872 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 13:29:24.758097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:29:30.296271 0.000000 tcp 10.0.2.105 63506 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:29:36.286986 0.052372 tcp 10.0.2.105 63507 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:36.339639 0.075972 tcp 10.0.2.105 63508 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:36.415928 0.149387 tcp 10.0.2.105 63509 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:36.639042 2.990364 tcp 10.0.2.105 63510 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:29:40.761268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:29:45.628099 0.000000 tcp 10.0.2.105 63510 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:29:51.637335 0.052456 tcp 10.0.2.105 63511 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:51.690096 0.071497 tcp 10.0.2.105 63512 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:51.761933 0.158522 tcp 10.0.2.105 63513 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:29:51.955847 2.995600 tcp 10.0.2.105 63514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:30:00.950126 0.000000 tcp 10.0.2.105 63514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:30:06.949063 3.003951 tcp 10.0.2.105 63515 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:30:12.846013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:30:16.000357 0.000000 tcp 10.0.2.105 63515 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:30:20.846865 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:35:21.952186 0.000216 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:35:21.952448 3.006155 tcp 10.0.2.105 63516 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:35:30.954471 0.000000 tcp 10.0.2.105 63516 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:35:36.954839 0.051758 tcp 10.0.2.105 63517 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:37.006898 0.076534 tcp 10.0.2.105 63518 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:37.083707 0.159109 tcp 10.0.2.105 63519 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:37.286533 2.992309 tcp 10.0.2.105 63520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:35:46.313926 0.000000 tcp 10.0.2.105 63520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:35:52.285894 0.052247 tcp 10.0.2.105 63521 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:52.338418 0.072662 tcp 10.0.2.105 63522 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:52.411358 0.153183 tcp 10.0.2.105 63523 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:35:52.890424 2.999720 tcp 10.0.2.105 63524 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:36:01.889044 0.000000 tcp 10.0.2.105 63524 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:36:07.970835 2.977355 tcp 10.0.2.105 63525 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:36:16.906455 2.979731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:36:17.023094 0.000000 tcp 10.0.2.105 63525 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:36:21.942390 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:36:23.855256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:36:31.793049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:36:48.146408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:37:19.800886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:41:22.891207 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:41:22.891321 3.003596 tcp 10.0.2.105 63526 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:41:31.893351 0.000000 tcp 10.0.2.105 63526 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:41:37.894296 0.052652 tcp 10.0.2.105 63527 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:37.947591 0.070240 tcp 10.0.2.105 63528 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:38.018140 0.157986 tcp 10.0.2.105 63529 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:38.267017 3.000088 tcp 10.0.2.105 63530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:41:47.265527 0.000000 tcp 10.0.2.105 63530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:41:53.266060 0.052751 tcp 10.0.2.105 63531 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:53.319152 0.075461 tcp 10.0.2.105 63532 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:53.394931 0.159596 tcp 10.0.2.105 63533 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:41:53.574229 2.994710 tcp 10.0.2.105 63534 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:42:02.578799 0.000000 tcp 10.0.2.105 63534 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:42:08.566410 2.994528 tcp 10.0.2.105 63535 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:42:17.559367 0.000000 tcp 10.0.2.105 63535 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:42:22.346064 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:43:23.806674 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:43:30.814554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:43:38.815965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:43:54.818809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:44:26.824977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:47:23.569857 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:47:23.569974 3.003658 tcp 10.0.2.105 63536 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:47:32.572345 0.000000 tcp 10.0.2.105 63536 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:47:38.572868 0.055235 tcp 10.0.2.105 63537 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:38.628515 0.072889 tcp 10.0.2.105 63538 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:38.701723 0.155766 tcp 10.0.2.105 63539 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:38.897525 3.007958 tcp 10.0.2.105 63540 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:47:47.904219 0.000000 tcp 10.0.2.105 63540 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:47:53.893407 0.051523 tcp 10.0.2.105 63541 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:53.945188 0.072101 tcp 10.0.2.105 63542 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:54.017587 0.156913 tcp 10.0.2.105 63543 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 13:47:54.318505 2.999175 tcp 10.0.2.105 63544 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:48:03.326547 0.000000 tcp 10.0.2.105 63544 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:48:09.315828 2.995168 tcp 10.0.2.105 63545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:48:18.307904 0.000000 tcp 10.0.2.105 63545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 13:48:22.844136 0.000243 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:54:10.836846 3.002101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 13:54:17.844733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:54:25.847997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:54:41.849564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:55:13.855350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 13:59:53.427553 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 13:59:53.427708 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:00:10.954860 0.053760 tcp 10.0.2.105 63546 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:11.008906 0.075546 tcp 10.0.2.105 63547 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:11.084814 0.151300 tcp 10.0.2.105 63548 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:11.236891 0.136133 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:11.335575 0.214846 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:11.541992 0.000000 udp 10.0.2.105 7010 -> 183.82.42.251 7723 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:00:24.362238 3.007133 tcp 10.0.2.105 63549 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:00:30.090382 0.052251 tcp 10.0.2.105 63550 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:30.142923 0.066857 tcp 10.0.2.105 63551 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:30.210073 0.160884 tcp 10.0.2.105 63552 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:30.371467 0.194851 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:30.561349 0.103943 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:30.712510 0.079741 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:31.057363 0.266423 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2700 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:31.283753 0.078589 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:31.484748 0.173821 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:31.655373 0.072947 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:31.780699 0.813507 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:32.677540 0.196717 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:32.868072 0.167816 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:33.011485 0.211750 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:33.146725 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:00:33.366831 0.000000 tcp 10.0.2.105 63549 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:00:39.363432 0.051908 tcp 10.0.2.105 63553 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:39.415638 0.070180 tcp 10.0.2.105 63554 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:39.486110 0.158473 tcp 10.0.2.105 63555 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:39.705268 2.993261 tcp 10.0.2.105 63556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:00:48.718147 0.000000 tcp 10.0.2.105 63556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:00:51.531625 0.185019 tcp 10.0.2.105 63557 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:51.716915 0.070838 tcp 10.0.2.105 63558 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:51.788084 0.157857 tcp 10.0.2.105 63559 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:51.946576 0.123684 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:52.031944 0.059445 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:52.090400 0.208646 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:52.280547 0.172714 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:52.477553 0.051990 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:52.589520 0.649229 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:53.186839 0.093559 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:53.287259 0.046674 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:00:53.319046 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:00:54.710412 0.053115 tcp 10.0.2.105 63560 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:54.763836 0.074608 tcp 10.0.2.105 63561 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:54.838827 0.150668 tcp 10.0.2.105 63562 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:00:55.354599 2.997667 tcp 10.0.2.105 63563 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:01:04.355940 0.000000 tcp 10.0.2.105 63563 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:01:08.747241 0.053784 tcp 10.0.2.105 63564 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:08.801399 0.066114 tcp 10.0.2.105 63565 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:08.867940 0.152997 tcp 10.0.2.105 63566 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:09.021582 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:01:10.351869 3.000799 tcp 10.0.2.105 63567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:01:17.867429 2.995547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:01:19.352720 0.000000 tcp 10.0.2.105 63567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:01:24.871854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:01:25.762446 0.051045 tcp 10.0.2.105 63568 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:25.813765 0.067984 tcp 10.0.2.105 63569 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:25.882001 0.149843 tcp 10.0.2.105 63570 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:01:26.032979 0.174693 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:26.200527 0.222558 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:26.415619 0.085088 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:26.478625 0.108359 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:26.586348 0.298161 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:26.938396 0.248576 udp 10.0.2.105 7010 <-> 187.206.203.77 2527 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:27.138366 0.246539 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:27.383292 0.406105 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:27.768336 0.104215 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:27.867439 0.169468 udp 10.0.2.105 7010 <-> 68.170.233.169 6072 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:01:32.870083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:01:48.873076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:02:20.879485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:06:25.351637 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:06:25.351752 3.003347 tcp 10.0.2.105 63571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:06:34.353545 0.000000 tcp 10.0.2.105 63571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:06:40.354229 0.052708 tcp 10.0.2.105 63572 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:40.407220 0.075339 tcp 10.0.2.105 63573 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:40.482870 0.159529 tcp 10.0.2.105 63574 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:40.935719 2.992198 tcp 10.0.2.105 63575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:06:49.936033 0.000000 tcp 10.0.2.105 63575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:06:55.934952 0.067869 tcp 10.0.2.105 63576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:56.003110 0.071320 tcp 10.0.2.105 63577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:56.074697 0.158355 tcp 10.0.2.105 63578 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:06:56.450625 2.999383 tcp 10.0.2.105 63579 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:05.448602 0.000000 tcp 10.0.2.105 63579 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:11.447846 0.051607 tcp 10.0.2.105 63580 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:11.499770 0.076272 tcp 10.0.2.105 63581 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:11.576457 0.156327 tcp 10.0.2.105 63582 -> 195.113.214.251 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:12.409352 3.003515 tcp 10.0.2.105 63583 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:21.411446 0.000000 tcp 10.0.2.105 63583 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:27.411038 0.051421 tcp 10.0.2.105 63584 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:27.462762 0.074375 tcp 10.0.2.105 63585 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:27.537444 0.156240 tcp 10.0.2.105 63586 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:07:27.823669 3.001166 tcp 10.0.2.105 63587 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:36.823592 0.000000 tcp 10.0.2.105 63587 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:42.822251 3.003979 tcp 10.0.2.105 63588 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:51.824899 0.000000 tcp 10.0.2.105 63588 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:07:56.341619 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:07:57.825444 2.992672 tcp 10.0.2.105 63589 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:08:06.826565 0.000000 tcp 10.0.2.105 63589 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:08:12.825336 2.994276 tcp 10.0.2.105 63590 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:08:20.346193 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:08:21.817809 0.000000 tcp 10.0.2.105 63590 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:08:24.886004 3.634484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:08:32.477373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:08:40.384602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:08:56.523659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:09:28.145404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:13:27.830706 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:13:27.830907 3.001577 tcp 10.0.2.105 63591 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:13:36.831010 0.000000 tcp 10.0.2.105 63591 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:13:42.831010 0.053264 tcp 10.0.2.105 63592 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:42.884571 0.071927 tcp 10.0.2.105 63593 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:42.956819 0.154938 tcp 10.0.2.105 63594 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:43.414613 2.983156 tcp 10.0.2.105 63595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:13:52.340860 0.000000 tcp 10.0.2.105 63595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:13:58.287632 0.052782 tcp 10.0.2.105 63596 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:58.340811 0.067631 tcp 10.0.2.105 63597 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:58.408763 0.159974 tcp 10.0.2.105 63598 -> 195.113.214.251 443 SRPA* 0 0 66 69742 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:13:58.733247 2.982684 tcp 10.0.2.105 63599 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:07.658141 0.000000 tcp 10.0.2.105 63599 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:13.614738 0.052304 tcp 10.0.2.105 63600 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:13.667325 0.073991 tcp 10.0.2.105 63601 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:13.741631 0.159948 tcp 10.0.2.105 63602 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:14.452367 2.997323 tcp 10.0.2.105 63603 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:23.448030 0.000000 tcp 10.0.2.105 63603 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:29.447557 0.051749 tcp 10.0.2.105 63604 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:29.499557 0.074609 tcp 10.0.2.105 63605 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:29.574486 0.154433 tcp 10.0.2.105 63606 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:14:30.050056 3.001795 tcp 10.0.2.105 63607 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:39.051574 0.000000 tcp 10.0.2.105 63607 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:45.049387 3.003629 tcp 10.0.2.105 63608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:54.051940 0.000000 tcp 10.0.2.105 63608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:14:58.838674 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:15:00.050377 3.005875 tcp 10.0.2.105 63609 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:15:09.053819 0.000000 tcp 10.0.2.105 63609 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:15:15.052649 3.005130 tcp 10.0.2.105 63610 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:15:22.844179 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:15:24.055181 0.000000 tcp 10.0.2.105 63610 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:15:36.936490 3.001718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:15:44.012336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:15:51.955509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:16:07.958583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:16:39.964658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:20:30.055983 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:20:30.056090 2.993680 tcp 10.0.2.105 63611 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:20:40.130390 0.000000 tcp 10.0.2.105 63611 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:20:46.073309 0.053173 tcp 10.0.2.105 63612 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:20:46.126787 0.044159 tcp 10.0.2.105 63613 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:20:46.171212 0.154675 tcp 10.0.2.105 63614 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:20:46.388210 2.951226 tcp 10.0.2.105 63615 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:20:55.263491 0.000000 tcp 10.0.2.105 63615 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:01.187835 0.056144 tcp 10.0.2.105 63616 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:01.244296 0.045378 tcp 10.0.2.105 63617 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:01.289916 0.157218 tcp 10.0.2.105 63618 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:01.478080 2.968051 tcp 10.0.2.105 63619 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:10.371506 0.000000 tcp 10.0.2.105 63619 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:16.586692 0.050791 tcp 10.0.2.105 63620 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:16.637752 0.043985 tcp 10.0.2.105 63621 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:16.682092 0.153814 tcp 10.0.2.105 63622 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:17.065830 2.968053 tcp 10.0.2.105 63623 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:25.962656 0.000000 tcp 10.0.2.105 63623 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:31.890867 0.052246 tcp 10.0.2.105 63624 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:31.943420 0.044729 tcp 10.0.2.105 63625 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:31.988507 0.156287 tcp 10.0.2.105 63626 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:21:32.229719 2.958278 tcp 10.0.2.105 63627 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:41.127791 0.000000 tcp 10.0.2.105 63627 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:47.054186 2.955736 tcp 10.0.2.105 63628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:21:55.940238 0.000000 tcp 10.0.2.105 63628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:22:00.749995 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:22:01.878299 2.951801 tcp 10.0.2.105 63629 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:22:10.757804 0.000000 tcp 10.0.2.105 63629 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:22:16.697304 2.965704 tcp 10.0.2.105 63630 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:22:24.453299 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:22:25.591513 0.000000 tcp 10.0.2.105 63630 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:22:43.969912 3.002145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:22:50.979589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:22:58.979971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:23:14.982427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:23:46.988281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:27:31.491803 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:27:31.491946 3.003606 tcp 10.0.2.105 63631 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:27:40.570460 0.000000 tcp 10.0.2.105 63631 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:27:46.518086 0.052800 tcp 10.0.2.105 63632 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:27:46.571146 0.066529 tcp 10.0.2.105 63633 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:27:46.637986 0.149276 tcp 10.0.2.105 63634 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:27:47.253681 2.974648 tcp 10.0.2.105 63635 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:27:56.236814 0.000000 tcp 10.0.2.105 63635 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:02.236131 0.051610 tcp 10.0.2.105 63636 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:02.288041 0.067580 tcp 10.0.2.105 63637 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:02.355950 0.157616 tcp 10.0.2.105 63638 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:02.902028 2.998479 tcp 10.0.2.105 63639 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:11.899343 0.000000 tcp 10.0.2.105 63639 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:18.805132 0.051025 tcp 10.0.2.105 63640 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:18.856650 0.069995 tcp 10.0.2.105 63641 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:18.926944 0.151490 tcp 10.0.2.105 63642 -> 195.113.214.251 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:19.090931 2.956713 tcp 10.0.2.105 63643 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:27.968387 0.000000 tcp 10.0.2.105 63643 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:33.899103 0.052443 tcp 10.0.2.105 63644 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:33.951842 0.068185 tcp 10.0.2.105 63645 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:34.020387 0.154677 tcp 10.0.2.105 63646 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:28:34.667603 2.970551 tcp 10.0.2.105 63647 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:43.565174 0.000000 tcp 10.0.2.105 63647 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:49.496443 2.968300 tcp 10.0.2.105 63648 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:28:57.286008 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:28:58.394580 0.000000 tcp 10.0.2.105 63648 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:29:04.324806 2.956998 tcp 10.0.2.105 63649 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:29:13.226395 0.000000 tcp 10.0.2.105 63649 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:29:19.154639 3.523137 tcp 10.0.2.105 63650 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:29:24.542985 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:29:28.611476 0.000000 tcp 10.0.2.105 63650 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:29:51.375306 2.967720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:29:58.383925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:30:06.288068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:30:22.096059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:30:54.022733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:31:54.870291 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:31:54.870456 0.113669 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 3 721 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:31:54.978558 0.000000 udp 10.0.2.105 7010 -> 183.82.42.251 7723 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:32:11.325194 0.053057 tcp 10.0.2.105 63651 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:11.378549 0.067638 tcp 10.0.2.105 63652 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:11.446466 0.149093 tcp 10.0.2.105 63653 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:11.596192 0.000000 udp 10.0.2.105 7010 -> 76.216.212.201 7764 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:32:29.620638 0.319264 tcp 10.0.2.105 63654 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:29.940261 0.067130 tcp 10.0.2.105 63655 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:30.007669 0.155205 tcp 10.0.2.105 63656 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:30.163616 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:32:48.701295 0.052256 tcp 10.0.2.105 63657 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:48.753838 0.067510 tcp 10.0.2.105 63658 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:48.821614 0.154340 tcp 10.0.2.105 63659 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:32:48.975770 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:33:05.481944 0.303341 tcp 10.0.2.105 63660 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:05.785555 0.068426 tcp 10.0.2.105 63661 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:05.854276 0.150962 tcp 10.0.2.105 63662 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:06.005782 0.218988 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:06.217725 0.192877 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:06.887304 0.082626 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:06.953228 0.106799 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:07.940985 0.199533 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:08.498245 0.072435 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:08.812840 0.250520 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:09.028142 0.231056 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:09.256567 0.081250 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:09.474592 0.169610 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:09.622404 0.197791 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:09.936918 0.766116 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:10.984574 0.210391 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:11.121093 0.122974 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:11.339840 0.058403 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:11.397085 0.171867 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:11.626592 2.149114 udp 10.0.2.105 7010 <-> 108.81.76.43 7364 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:13.760984 0.140073 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:14.053062 0.257697 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:14.261203 0.045980 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:14.770464 0.093678 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:14.846434 0.172775 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:15.201815 0.222046 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:15.416493 0.085468 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:15.804234 0.109994 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:15.874478 0.292174 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:16.158398 0.000000 udp 10.0.2.105 7010 -> 187.206.203.77 2527 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:33:31.819019 0.051466 tcp 10.0.2.105 63663 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:31.870775 0.068327 tcp 10.0.2.105 63664 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:31.939403 0.152330 tcp 10.0.2.105 63665 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:32.092561 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 14:33:48.855199 0.113389 tcp 10.0.2.105 63666 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:48.968981 0.069352 tcp 10.0.2.105 63667 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:49.038715 0.152384 tcp 10.0.2.105 63668 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:33:49.191755 0.169133 udp 10.0.2.105 7010 <-> 68.170.233.169 6072 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:49.435350 0.243136 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:33:49.676992 0.399470 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2611 flow=From-Botnet-V2-UDP-Established 1970/02/05 14:34:33.979110 3.046178 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:34:38.875345 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:34:42.984370 0.000000 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:34:48.990982 0.052910 tcp 10.0.2.105 63670 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:34:49.044146 0.069172 tcp 10.0.2.105 63671 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:34:49.113641 0.155474 tcp 10.0.2.105 63672 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:34:49.303369 3.001798 tcp 10.0.2.105 63673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:34:58.303541 0.000000 tcp 10.0.2.105 63673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:04.302921 0.052161 tcp 10.0.2.105 63674 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:04.355374 0.067402 tcp 10.0.2.105 63675 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:04.423138 0.159396 tcp 10.0.2.105 63676 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:04.620524 3.006675 tcp 10.0.2.105 63677 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:13.625670 0.000000 tcp 10.0.2.105 63677 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:19.615780 0.052647 tcp 10.0.2.105 63678 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:19.668693 0.069065 tcp 10.0.2.105 63679 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:19.738038 0.153358 tcp 10.0.2.105 63680 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:19.992312 2.996764 tcp 10.0.2.105 63681 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:28.987492 0.000000 tcp 10.0.2.105 63681 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:34.986813 0.052611 tcp 10.0.2.105 63682 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:35.039725 0.067695 tcp 10.0.2.105 63683 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:35.107719 0.154981 tcp 10.0.2.105 63684 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:35:35.422737 2.998607 tcp 10.0.2.105 63685 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:44.419900 0.000000 tcp 10.0.2.105 63685 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:50.418713 3.004039 tcp 10.0.2.105 63686 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:35:59.421529 0.000000 tcp 10.0.2.105 63686 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:36:04.338264 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:36:05.420157 3.004293 tcp 10.0.2.105 63687 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:36:14.422634 0.000000 tcp 10.0.2.105 63687 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:36:20.422194 3.003693 tcp 10.0.2.105 63688 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:36:28.342924 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:36:29.424868 0.000000 tcp 10.0.2.105 63688 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:36:58.028540 3.001379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:37:05.036035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:37:13.037068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:37:29.040358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:38:01.045777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:41:35.424708 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:41:35.424796 2.994298 tcp 10.0.2.105 63689 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:41:44.417535 0.000000 tcp 10.0.2.105 63689 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:41:50.428446 0.053532 tcp 10.0.2.105 63690 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:41:50.482240 0.068051 tcp 10.0.2.105 63691 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:41:50.550677 0.152435 tcp 10.0.2.105 63692 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:41:50.717001 2.993991 tcp 10.0.2.105 63693 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:41:59.709530 0.000000 tcp 10.0.2.105 63693 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:05.708724 0.052569 tcp 10.0.2.105 63694 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:05.761552 0.067316 tcp 10.0.2.105 63695 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:05.829215 0.156450 tcp 10.0.2.105 63696 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:06.123045 3.009682 tcp 10.0.2.105 63697 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:15.123089 0.000000 tcp 10.0.2.105 63697 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:21.121004 0.051159 tcp 10.0.2.105 63698 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:21.172589 0.067524 tcp 10.0.2.105 63699 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:21.240457 0.152309 tcp 10.0.2.105 63700 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:21.425902 2.999284 tcp 10.0.2.105 63701 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:30.428230 0.000000 tcp 10.0.2.105 63701 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:36.422822 0.052357 tcp 10.0.2.105 63702 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:36.475125 0.063044 tcp 10.0.2.105 63703 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:36.538489 0.151894 tcp 10.0.2.105 63704 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:42:36.862714 3.006065 tcp 10.0.2.105 63705 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:45.875768 0.000000 tcp 10.0.2.105 63705 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:42:51.854451 2.999404 tcp 10.0.2.105 63706 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:43:00.857346 0.000000 tcp 10.0.2.105 63706 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:43:05.844524 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:43:06.856204 2.994276 tcp 10.0.2.105 63707 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:43:15.848913 0.000000 tcp 10.0.2.105 63707 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:43:21.857716 3.004207 tcp 10.0.2.105 63708 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:43:29.838877 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:43:30.860569 0.000000 tcp 10.0.2.105 63708 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:44:05.052393 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:44:12.059312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:44:20.061368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:44:36.064397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:45:08.070348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:48:36.861050 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:48:36.861247 3.003642 tcp 10.0.2.105 63709 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:48:45.863427 0.000000 tcp 10.0.2.105 63709 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:48:51.863645 1.443358 tcp 10.0.2.105 63710 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:48:53.307274 0.062980 tcp 10.0.2.105 63711 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:48:53.370111 0.155466 tcp 10.0.2.105 63712 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:48:53.580616 2.998238 tcp 10.0.2.105 63713 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:02.577589 0.000000 tcp 10.0.2.105 63713 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:08.576718 0.051696 tcp 10.0.2.105 63714 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:08.628713 0.062700 tcp 10.0.2.105 63715 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:08.691282 0.149442 tcp 10.0.2.105 63716 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:08.989572 3.001675 tcp 10.0.2.105 63717 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:17.989334 0.000000 tcp 10.0.2.105 63717 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:23.988716 0.052371 tcp 10.0.2.105 63718 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:24.041392 0.062258 tcp 10.0.2.105 63719 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:24.103943 0.150138 tcp 10.0.2.105 63720 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:24.417551 3.005770 tcp 10.0.2.105 63721 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:33.423545 0.000000 tcp 10.0.2.105 63721 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:39.413965 0.051978 tcp 10.0.2.105 63722 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:39.466237 0.061613 tcp 10.0.2.105 63723 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:39.528146 0.154773 tcp 10.0.2.105 63724 -> 195.113.214.251 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:49:39.825751 2.999447 tcp 10.0.2.105 63725 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:48.823843 0.000000 tcp 10.0.2.105 63725 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:49:54.823067 3.003787 tcp 10.0.2.105 63726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:50:03.825803 0.000000 tcp 10.0.2.105 63726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:50:08.342192 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:50:09.824441 2.994119 tcp 10.0.2.105 63727 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:50:18.826822 0.000000 tcp 10.0.2.105 63727 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:50:24.825839 2.994124 tcp 10.0.2.105 63728 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:50:32.346596 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:50:33.818559 0.000000 tcp 10.0.2.105 63728 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:54:32.083601 3.001962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 14:54:39.091465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:54:47.093209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:55:03.106061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:55:35.112165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 14:55:39.829247 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:55:39.829468 3.003656 tcp 10.0.2.105 63729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:55:48.831589 0.000000 tcp 10.0.2.105 63729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:55:54.832455 0.052093 tcp 10.0.2.105 63730 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:55:54.884794 0.061458 tcp 10.0.2.105 63731 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:55:54.946556 0.155739 tcp 10.0.2.105 63732 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:55:55.190021 3.005111 tcp 10.0.2.105 63733 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:04.193808 0.000000 tcp 10.0.2.105 63733 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:10.183037 0.052636 tcp 10.0.2.105 63734 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:10.236018 0.065785 tcp 10.0.2.105 63735 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:10.302147 0.151781 tcp 10.0.2.105 63736 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:10.500309 3.006785 tcp 10.0.2.105 63737 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:19.515902 0.000000 tcp 10.0.2.105 63737 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:25.497542 0.052445 tcp 10.0.2.105 63738 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:25.550254 0.064805 tcp 10.0.2.105 63739 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:25.615370 0.158116 tcp 10.0.2.105 63740 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:25.859889 2.999187 tcp 10.0.2.105 63741 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:34.860213 0.000000 tcp 10.0.2.105 63741 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:40.857012 0.052982 tcp 10.0.2.105 63742 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:40.910289 0.060147 tcp 10.0.2.105 63743 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:40.970726 0.158174 tcp 10.0.2.105 63744 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 14:56:41.242459 2.988699 tcp 10.0.2.105 63745 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:50.257810 0.000000 tcp 10.0.2.105 63745 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:56:56.238470 3.004426 tcp 10.0.2.105 63746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:57:05.241474 0.000000 tcp 10.0.2.105 63746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:57:09.837809 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:57:11.240270 3.004307 tcp 10.0.2.105 63747 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:57:20.243104 0.000000 tcp 10.0.2.105 63747 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:57:26.241947 3.003872 tcp 10.0.2.105 63748 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 14:57:33.842731 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 14:57:35.244834 0.000000 tcp 10.0.2.105 63748 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:01:39.119362 3.003725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:01:46.126059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:01:54.126820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:02:10.132101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:02:42.141046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:04:18.704964 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:04:18.705231 0.000000 udp 10.0.2.105 7010 -> 187.206.203.77 2527 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:04:36.181179 0.054166 tcp 10.0.2.105 63749 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:36.235627 0.066532 tcp 10.0.2.105 63750 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:36.302469 0.151209 tcp 10.0.2.105 63751 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:36.454280 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:04:53.265440 0.052761 tcp 10.0.2.105 63752 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:53.318504 0.068743 tcp 10.0.2.105 63753 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:53.387538 0.155273 tcp 10.0.2.105 63754 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:04:53.543393 0.092988 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 1959 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:53.617801 0.220827 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:53.829378 0.084077 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:53.918790 0.135676 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.017984 0.197495 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.210220 0.109269 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.303972 0.249723 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.521894 0.077173 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.602808 0.076925 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.665852 0.173466 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.836563 0.171792 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:54.985890 0.197094 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:55.204888 0.058249 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:55.261685 0.145877 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:55.366724 0.217574 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:55.538403 0.262765 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:55.864997 0.170021 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:56.011518 0.053539 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:04:56.060763 0.000000 udp 10.0.2.105 7010 -> 108.81.76.43 7364 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:04:56.259222 3.004017 tcp 10.0.2.105 63755 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:05.261825 0.000000 tcp 10.0.2.105 63755 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:11.260492 0.052170 tcp 10.0.2.105 63756 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:11.312933 0.061501 tcp 10.0.2.105 63757 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:11.374765 0.154957 tcp 10.0.2.105 63758 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:11.545511 3.000135 tcp 10.0.2.105 63759 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:12.462280 0.052689 tcp 10.0.2.105 63760 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:12.515253 0.061270 tcp 10.0.2.105 63761 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:12.576797 0.153397 tcp 10.0.2.105 63762 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:12.730699 0.283731 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 5 1857 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:12.964628 0.222181 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.179125 0.128670 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.290191 0.046895 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.327811 0.173909 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.494110 0.084193 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.557162 0.104612 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.627636 0.284233 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:13.902642 0.175757 udp 10.0.2.105 7010 <-> 68.170.233.169 6072 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:14.105081 0.253974 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:14.357730 0.403070 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:05:20.543757 0.000000 tcp 10.0.2.105 63759 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:26.542796 0.052905 tcp 10.0.2.105 63763 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:26.595966 0.063347 tcp 10.0.2.105 63764 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:26.659622 0.153313 tcp 10.0.2.105 63765 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:26.876048 3.001023 tcp 10.0.2.105 63766 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:35.875447 0.000000 tcp 10.0.2.105 63766 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:41.874834 0.052514 tcp 10.0.2.105 63767 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:41.927641 0.062531 tcp 10.0.2.105 63768 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:41.990454 0.153028 tcp 10.0.2.105 63769 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:05:42.442579 2.996631 tcp 10.0.2.105 63770 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:51.437904 0.000000 tcp 10.0.2.105 63770 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:05:57.436942 2.994014 tcp 10.0.2.105 63771 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:06:06.429462 0.000000 tcp 10.0.2.105 63771 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:06:11.346418 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:06:12.438445 3.004077 tcp 10.0.2.105 63772 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:06:21.441363 0.000000 tcp 10.0.2.105 63772 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:08:46.141993 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:08:53.149292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:09:01.150902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:09:17.155707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:09:49.159805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:11:27.441824 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:11:27.442038 3.003496 tcp 10.0.2.105 63773 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:11:36.443784 0.000000 tcp 10.0.2.105 63773 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:11:42.444693 0.084679 tcp 10.0.2.105 63774 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:42.529703 0.064274 tcp 10.0.2.105 63775 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:42.593866 0.154317 tcp 10.0.2.105 63776 -> 195.113.214.251 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:43.017349 2.981383 tcp 10.0.2.105 63777 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:11:51.996390 0.000000 tcp 10.0.2.105 63777 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:11:57.995279 0.262709 tcp 10.0.2.105 63778 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:58.258267 0.061370 tcp 10.0.2.105 63779 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:58.319906 0.162237 tcp 10.0.2.105 63780 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:11:58.570783 2.999452 tcp 10.0.2.105 63781 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:07.568789 0.000000 tcp 10.0.2.105 63781 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:13.568106 0.052907 tcp 10.0.2.105 63782 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:12:13.621300 0.067932 tcp 10.0.2.105 63783 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:12:13.689480 0.149299 tcp 10.0.2.105 63784 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:12:14.031508 3.001204 tcp 10.0.2.105 63785 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:23.031989 0.000000 tcp 10.0.2.105 63785 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:29.029536 3.004479 tcp 10.0.2.105 63786 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:38.032571 0.000000 tcp 10.0.2.105 63786 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:42.839851 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:12:44.031285 3.004614 tcp 10.0.2.105 63787 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:12:53.034092 0.000000 tcp 10.0.2.105 63787 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:15:56.170271 3.001692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:16:03.177462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:16:11.179014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:16:27.182007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:16:59.188111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:17:59.034567 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:17:59.034876 2.993413 tcp 10.0.2.105 63788 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:08.037076 0.000000 tcp 10.0.2.105 63788 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:14.036850 0.053813 tcp 10.0.2.105 63789 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:14.090930 0.062457 tcp 10.0.2.105 63790 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:14.153709 0.152235 tcp 10.0.2.105 63791 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:14.344112 2.996744 tcp 10.0.2.105 63792 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:23.338940 0.000000 tcp 10.0.2.105 63792 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:29.338560 0.051688 tcp 10.0.2.105 63793 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:29.390568 0.063234 tcp 10.0.2.105 63794 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:29.454123 0.152799 tcp 10.0.2.105 63795 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:29.673187 2.999502 tcp 10.0.2.105 63796 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:38.671199 0.000000 tcp 10.0.2.105 63796 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:44.670360 0.052388 tcp 10.0.2.105 63797 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:44.723052 0.065640 tcp 10.0.2.105 63798 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:44.788979 0.154968 tcp 10.0.2.105 63799 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:18:45.217238 3.007295 tcp 10.0.2.105 63800 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:18:54.223375 0.000000 tcp 10.0.2.105 63800 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:19:00.212670 3.003512 tcp 10.0.2.105 63801 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:19:09.214931 0.000000 tcp 10.0.2.105 63801 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:19:14.043303 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:19:15.407222 2.965119 tcp 10.0.2.105 63802 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:19:24.325233 0.000000 tcp 10.0.2.105 63802 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:23:03.204063 3.004931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:23:10.211849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:23:18.213086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:23:34.216026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:24:06.223013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:24:30.217174 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:24:30.217267 3.003192 tcp 10.0.2.105 63803 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:24:39.219445 0.000000 tcp 10.0.2.105 63803 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:24:45.220073 0.053394 tcp 10.0.2.105 63804 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:24:45.273744 0.061390 tcp 10.0.2.105 63805 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:24:45.335014 0.166761 tcp 10.0.2.105 63806 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:24:45.637982 3.005155 tcp 10.0.2.105 63807 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:24:54.641809 0.000000 tcp 10.0.2.105 63807 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:00.631223 0.052991 tcp 10.0.2.105 63808 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:00.684488 0.061879 tcp 10.0.2.105 63809 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:00.746756 0.154692 tcp 10.0.2.105 63810 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:00.922484 3.002189 tcp 10.0.2.105 63811 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:09.923704 0.000000 tcp 10.0.2.105 63811 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:15.922715 0.052787 tcp 10.0.2.105 63812 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:15.975862 0.062964 tcp 10.0.2.105 63813 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:16.038667 0.261336 tcp 10.0.2.105 63814 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:25:16.357469 3.009615 tcp 10.0.2.105 63815 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:25.375825 0.000000 tcp 10.0.2.105 63815 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:31.354834 2.994091 tcp 10.0.2.105 63816 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:40.357256 0.000000 tcp 10.0.2.105 63816 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:45.344722 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:25:46.356101 2.994164 tcp 10.0.2.105 63817 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:25:55.348903 0.000000 tcp 10.0.2.105 63817 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:30:10.227940 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:30:17.235755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:30:25.237121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:30:41.242709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:31:01.359771 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:31:01.359872 3.003273 tcp 10.0.2.105 63818 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:31:10.361903 0.000000 tcp 10.0.2.105 63818 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:31:13.246167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:31:16.361916 0.053677 tcp 10.0.2.105 63819 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:31:16.415915 0.061137 tcp 10.0.2.105 63820 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:31:16.477391 0.155698 tcp 10.0.2.105 63821 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:31:16.745685 2.999668 tcp 10.0.2.105 63822 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:31:25.743751 0.000000 tcp 10.0.2.105 63822 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:35:25.819273 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:35:25.819478 0.000000 udp 10.0.2.105 7010 -> 108.81.76.43 7364 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:35:44.047521 0.052979 tcp 10.0.2.105 63823 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:35:44.100790 0.061193 tcp 10.0.2.105 63824 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:35:44.162209 0.150656 tcp 10.0.2.105 63825 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:35:44.313665 0.081651 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:35:44.380089 0.139632 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:35:44.770816 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:36:00.509699 0.052266 tcp 10.0.2.105 63826 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:00.562310 0.062766 tcp 10.0.2.105 63827 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:00.625366 0.152079 tcp 10.0.2.105 63828 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:00.777980 0.092516 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:00.855480 0.107278 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.050364 0.212751 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.255426 0.074934 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.335839 0.082039 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.401610 0.280376 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.646306 0.171190 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.795180 0.192931 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:01.981774 0.060215 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:02.091521 0.125361 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:02.176954 0.221162 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:02.349353 0.175830 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:02.624888 0.172215 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:02.844094 0.217644 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.166486 0.077169 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.326228 0.251984 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.527513 0.226326 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.746017 0.088415 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.815419 0.046043 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:03.876544 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:36:21.499745 0.051796 tcp 10.0.2.105 63829 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:21.551844 0.061897 tcp 10.0.2.105 63830 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:21.614079 0.151999 tcp 10.0.2.105 63831 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:21.766705 0.084128 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:21.829758 0.112351 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:21.902450 0.291720 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:22.182017 0.000000 udp 10.0.2.105 7010 -> 68.170.233.169 6072 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 15:36:31.744454 2.994231 tcp 10.0.2.105 63832 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:36:39.736586 0.052339 tcp 10.0.2.105 63833 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:39.789162 0.065723 tcp 10.0.2.105 63834 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:39.855213 0.154524 tcp 10.0.2.105 63835 -> 195.113.214.251 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:40.010331 0.245182 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:40.254095 0.400560 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/05 15:36:40.747601 0.000000 tcp 10.0.2.105 63832 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:36:46.746270 0.052819 tcp 10.0.2.105 63836 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:46.799351 0.060164 tcp 10.0.2.105 63837 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:46.859824 0.154105 tcp 10.0.2.105 63838 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:36:47.036736 2.992926 tcp 10.0.2.105 63839 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:36:56.028851 0.000000 tcp 10.0.2.105 63839 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:02.038302 0.052570 tcp 10.0.2.105 63840 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:02.091170 0.064932 tcp 10.0.2.105 63841 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:02.156389 0.155446 tcp 10.0.2.105 63842 -> 195.113.214.251 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:02.337706 3.004509 tcp 10.0.2.105 63843 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:11.340535 0.000000 tcp 10.0.2.105 63843 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:17.253363 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:37:17.340044 0.052782 tcp 10.0.2.105 63844 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:17.393112 0.060938 tcp 10.0.2.105 63845 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:17.454310 0.150536 tcp 10.0.2.105 63846 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:37:17.614761 2.999446 tcp 10.0.2.105 63847 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:24.259654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:37:26.613035 0.000000 tcp 10.0.2.105 63847 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:32.261530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:37:32.611681 3.010784 tcp 10.0.2.105 63848 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:41.614868 0.000000 tcp 10.0.2.105 63848 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:46.342775 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:37:47.613140 2.994156 tcp 10.0.2.105 63849 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:37:48.264175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:37:56.618886 0.000000 tcp 10.0.2.105 63849 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:38:20.269827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:43:02.616460 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:43:02.616630 2.993499 tcp 10.0.2.105 63850 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:11.609011 0.000000 tcp 10.0.2.105 63850 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:17.619245 0.053444 tcp 10.0.2.105 63851 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:17.673152 0.062237 tcp 10.0.2.105 63852 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:17.735655 0.154458 tcp 10.0.2.105 63853 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:17.977260 3.005030 tcp 10.0.2.105 63854 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:26.981166 0.000000 tcp 10.0.2.105 63854 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:32.971044 0.053192 tcp 10.0.2.105 63855 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:33.024581 0.061530 tcp 10.0.2.105 63856 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:33.086401 0.154358 tcp 10.0.2.105 63857 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:33.388830 3.005719 tcp 10.0.2.105 63858 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:42.392935 0.000000 tcp 10.0.2.105 63858 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:48.382240 0.053414 tcp 10.0.2.105 63859 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:48.435953 0.061084 tcp 10.0.2.105 63860 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:48.497291 0.154119 tcp 10.0.2.105 63861 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:43:48.727652 3.009762 tcp 10.0.2.105 63862 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:43:57.736922 0.000000 tcp 10.0.2.105 63862 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:44:03.727638 2.990625 tcp 10.0.2.105 63863 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:44:12.726812 0.000000 tcp 10.0.2.105 63863 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:44:17.343528 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:44:18.725805 2.993964 tcp 10.0.2.105 63864 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:44:24.275565 3.003262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:44:27.718669 0.000000 tcp 10.0.2.105 63864 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:44:31.283277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:44:39.288144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:44:55.288013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:45:27.293741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:49:33.729571 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:49:33.729792 3.003859 tcp 10.0.2.105 63865 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:49:42.731314 0.000000 tcp 10.0.2.105 63865 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:49:48.731858 0.053613 tcp 10.0.2.105 63866 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:49:48.785786 0.063194 tcp 10.0.2.105 63867 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:49:48.849327 0.156330 tcp 10.0.2.105 63868 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:49:49.067707 2.996986 tcp 10.0.2.105 63869 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:49:58.063143 0.000000 tcp 10.0.2.105 63869 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:04.062457 0.054156 tcp 10.0.2.105 63870 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:04.116898 0.067174 tcp 10.0.2.105 63871 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:04.184352 0.154363 tcp 10.0.2.105 63872 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:04.378958 3.008121 tcp 10.0.2.105 63873 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:13.385276 0.000000 tcp 10.0.2.105 63873 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:19.374552 0.083295 tcp 10.0.2.105 63874 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:19.458144 0.061434 tcp 10.0.2.105 63875 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:19.519388 0.158403 tcp 10.0.2.105 63876 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:50:19.800736 2.997622 tcp 10.0.2.105 63877 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:28.797526 0.000000 tcp 10.0.2.105 63877 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:34.796338 2.993630 tcp 10.0.2.105 63878 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:43.788700 0.000000 tcp 10.0.2.105 63878 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:48.345422 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:50:49.797676 3.004311 tcp 10.0.2.105 63879 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:50:58.800071 0.000000 tcp 10.0.2.105 63879 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:54:42.304921 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 15:54:49.311942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:54:57.313426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:55:13.316875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:55:45.322720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 15:56:04.801192 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:56:04.801366 3.003421 tcp 10.0.2.105 63880 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:13.803180 0.000000 tcp 10.0.2.105 63880 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:19.804096 0.055045 tcp 10.0.2.105 63881 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:19.859456 0.063271 tcp 10.0.2.105 63882 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:19.923137 0.152044 tcp 10.0.2.105 63883 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:20.187931 3.009135 tcp 10.0.2.105 63884 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:29.195674 0.000000 tcp 10.0.2.105 63884 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:35.184829 0.053108 tcp 10.0.2.105 63885 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:35.237820 0.063598 tcp 10.0.2.105 63886 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:35.301791 0.154061 tcp 10.0.2.105 63887 -> 195.113.214.251 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:35.530802 2.988228 tcp 10.0.2.105 63888 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:44.519424 0.000000 tcp 10.0.2.105 63888 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:50.526907 0.052459 tcp 10.0.2.105 63889 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:50.579686 0.061352 tcp 10.0.2.105 63890 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:50.641394 0.151270 tcp 10.0.2.105 63891 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 15:56:50.813601 2.997633 tcp 10.0.2.105 63892 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:56:59.809489 0.000000 tcp 10.0.2.105 63892 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:57:05.808249 3.004535 tcp 10.0.2.105 63893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:57:14.814118 0.000000 tcp 10.0.2.105 63893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:57:19.337593 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 15:57:20.809940 3.004065 tcp 10.0.2.105 63894 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 15:57:29.812788 0.000000 tcp 10.0.2.105 63894 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:01:49.329159 3.003471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:01:56.336143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:02:04.337519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:02:20.339994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:02:52.346539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:07:03.187643 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:07:03.187765 0.216775 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:03.386434 0.174807 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:03.774183 0.000000 udp 10.0.2.105 7010 -> 68.170.233.169 6072 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 16:07:05.841482 3.003781 tcp 10.0.2.105 63895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:07:14.843946 0.000000 tcp 10.0.2.105 63895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:07:18.820944 0.269511 tcp 10.0.2.105 63896 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:19.090690 0.062180 tcp 10.0.2.105 63897 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:19.153224 0.156508 tcp 10.0.2.105 63898 -> 195.113.214.251 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:19.310260 0.084472 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:19.376278 0.254292 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 5 1814 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:20.326587 0.079315 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:20.387188 0.102763 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:20.617120 0.097318 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:20.827963 0.216381 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:20.843114 0.053354 tcp 10.0.2.105 63899 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:20.896749 0.063135 tcp 10.0.2.105 63900 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:20.960177 0.154012 tcp 10.0.2.105 63901 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:07:21.036492 0.080921 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.133101 3.004421 tcp 10.0.2.105 63902 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:07:21.160410 0.059470 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.218962 0.137921 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.381306 0.184985 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.499063 0.171942 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.650401 0.288943 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:21.904597 0.198162 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:22.115232 0.174820 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:22.287213 0.392188 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:22.796906 0.172033 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:23.062233 0.053547 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:23.236049 0.045804 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:23.266807 0.228985 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:23.488384 0.429020 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:23.867422 0.088700 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:24.283146 0.104960 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:24.348367 0.081478 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:24.498956 0.298458 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:24.788445 0.254365 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:25.141344 0.405105 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:07:30.165973 0.000000 tcp 10.0.2.105 63902 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:08:58.354759 3.002261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 16:09:05.362952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:09:13.364504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:09:29.367791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:10:01.373420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:12:36.136452 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:12:36.136679 2.993411 tcp 10.0.2.105 63903 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:12:45.128809 0.000000 tcp 10.0.2.105 63903 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:12:51.139498 0.053699 tcp 10.0.2.105 63904 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:12:51.193497 0.062347 tcp 10.0.2.105 63905 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:12:51.256162 0.157578 tcp 10.0.2.105 63906 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:12:51.830160 3.002741 tcp 10.0.2.105 63907 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:00.831409 0.000000 tcp 10.0.2.105 63907 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:06.830859 0.052775 tcp 10.0.2.105 63908 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:06.883930 0.065164 tcp 10.0.2.105 63909 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:06.949404 0.156967 tcp 10.0.2.105 63910 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:07.319056 3.005958 tcp 10.0.2.105 63911 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:16.323654 0.000000 tcp 10.0.2.105 63911 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:22.313048 0.051430 tcp 10.0.2.105 63912 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:22.364736 0.065330 tcp 10.0.2.105 63913 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:22.430354 0.160251 tcp 10.0.2.105 63914 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:13:22.666088 3.000978 tcp 10.0.2.105 63915 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:31.676436 0.000000 tcp 10.0.2.105 63915 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:37.669471 2.989269 tcp 10.0.2.105 63916 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:46.667196 0.000000 tcp 10.0.2.105 63916 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:13:51.343997 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:13:52.665842 2.994618 tcp 10.0.2.105 63917 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:14:01.658843 0.000000 tcp 10.0.2.105 63917 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:16:05.379693 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:16:12.386659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:16:20.389020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:16:36.391300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:17:08.397374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:19:07.669485 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:19:07.669599 3.003434 tcp 10.0.2.105 63918 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:16.671864 0.000000 tcp 10.0.2.105 63918 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:22.674537 0.054447 tcp 10.0.2.105 63919 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:22.729220 0.066747 tcp 10.0.2.105 63920 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:22.796262 0.154710 tcp 10.0.2.105 63921 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:23.003777 3.001426 tcp 10.0.2.105 63922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:32.006064 0.000000 tcp 10.0.2.105 63922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:38.002581 0.052471 tcp 10.0.2.105 63923 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:38.055318 0.066263 tcp 10.0.2.105 63924 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:38.121846 0.162216 tcp 10.0.2.105 63925 -> 195.113.214.251 443 SRPA* 0 0 20 11518 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:38.409819 3.007570 tcp 10.0.2.105 63926 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:47.426180 0.000000 tcp 10.0.2.105 63926 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:19:53.405330 0.052351 tcp 10.0.2.105 63927 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:53.457996 0.062024 tcp 10.0.2.105 63928 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:53.520302 0.156933 tcp 10.0.2.105 63929 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:19:53.686765 2.992402 tcp 10.0.2.105 63930 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:20:02.682526 0.000000 tcp 10.0.2.105 63930 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:20:08.687207 2.993618 tcp 10.0.2.105 63931 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:20:17.679636 0.000000 tcp 10.0.2.105 63931 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:20:22.345581 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:20:23.693583 2.999319 tcp 10.0.2.105 63932 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:20:32.691350 0.000000 tcp 10.0.2.105 63932 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:23:12.402763 3.002407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:23:19.411188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:23:27.412485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:23:43.415574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:24:15.421588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:25:38.692814 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:25:38.692971 3.004355 tcp 10.0.2.105 63933 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:25:47.693755 0.000000 tcp 10.0.2.105 63933 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:25:53.694200 0.053424 tcp 10.0.2.105 63934 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:25:53.747851 0.062548 tcp 10.0.2.105 63935 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:25:53.810733 0.154638 tcp 10.0.2.105 63936 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:25:54.072827 2.994504 tcp 10.0.2.105 63937 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:03.076142 0.000000 tcp 10.0.2.105 63937 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:09.075247 0.531252 tcp 10.0.2.105 63938 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:09.606296 0.062268 tcp 10.0.2.105 63939 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:09.668843 0.155394 tcp 10.0.2.105 63940 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:10.184799 2.995890 tcp 10.0.2.105 63941 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:19.179058 0.000000 tcp 10.0.2.105 63941 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:25.178615 0.052391 tcp 10.0.2.105 63942 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:25.231283 0.063673 tcp 10.0.2.105 63943 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:25.295320 0.157991 tcp 10.0.2.105 63944 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:26:25.819685 3.003463 tcp 10.0.2.105 63945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:34.821433 0.000000 tcp 10.0.2.105 63945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:40.820072 3.004396 tcp 10.0.2.105 63946 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:49.823305 0.000000 tcp 10.0.2.105 63946 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:26:54.340027 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:26:55.825392 3.000688 tcp 10.0.2.105 63947 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:27:04.824918 0.000000 tcp 10.0.2.105 63947 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:30:19.426846 3.002281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:30:26.434623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:30:34.436236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:30:50.439100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:31:22.445362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:32:10.825339 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:32:10.825432 2.993535 tcp 10.0.2.105 63948 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:19.817656 0.000000 tcp 10.0.2.105 63948 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:25.828737 0.053297 tcp 10.0.2.105 63949 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:25.882308 0.062836 tcp 10.0.2.105 63950 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:25.945496 0.158129 tcp 10.0.2.105 63951 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:26.130100 3.002445 tcp 10.0.2.105 63952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:35.129727 0.000000 tcp 10.0.2.105 63952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:41.129224 0.052912 tcp 10.0.2.105 63953 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:41.182508 0.061261 tcp 10.0.2.105 63954 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:41.244054 0.152048 tcp 10.0.2.105 63955 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:41.481821 3.001075 tcp 10.0.2.105 63956 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:50.481502 0.000000 tcp 10.0.2.105 63956 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:32:56.481215 0.052306 tcp 10.0.2.105 63957 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:56.533882 0.061431 tcp 10.0.2.105 63958 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:56.595625 0.156812 tcp 10.0.2.105 63959 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:32:56.766351 2.999081 tcp 10.0.2.105 63960 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:33:05.763887 0.000000 tcp 10.0.2.105 63960 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:33:11.762736 3.004004 tcp 10.0.2.105 63961 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:33:20.765665 0.000000 tcp 10.0.2.105 63961 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:33:25.342058 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:33:26.764356 2.993923 tcp 10.0.2.105 63962 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:33:35.767057 0.000000 tcp 10.0.2.105 63962 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:37:26.451135 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:37:33.458904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:37:38.556410 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:37:38.556572 0.195423 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:38.747267 0.173646 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:38.912915 0.084738 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:38.980371 0.147378 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.089464 0.074327 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.149599 0.100526 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.233728 0.097760 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.310153 0.217899 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.519131 0.083558 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.584934 0.218458 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.695537 0.172406 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.844991 0.060641 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:39.931233 0.225724 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:40.119824 0.414870 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:40.500955 0.185960 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:40.725016 0.174879 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:40.897275 0.052931 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:40.952897 0.452437 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:41.406632 0.174009 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:41.460621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:37:41.599090 0.046726 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:41.630203 0.224821 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:41.848178 0.251905 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.054472 0.093916 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.152645 0.104844 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.219499 0.085818 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.283761 0.293659 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.571821 0.247262 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2001 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:42.817336 0.403610 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/05 16:37:57.463357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:38:29.469440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:38:41.767433 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:38:41.767575 3.003617 tcp 10.0.2.105 63963 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:38:50.770162 0.000000 tcp 10.0.2.105 63963 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:38:56.770428 0.052788 tcp 10.0.2.105 63964 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:38:56.823540 0.063280 tcp 10.0.2.105 63965 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:38:56.887166 0.154270 tcp 10.0.2.105 63966 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:38:57.066692 2.996553 tcp 10.0.2.105 63967 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:06.061823 0.000000 tcp 10.0.2.105 63967 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:12.061086 0.052698 tcp 10.0.2.105 63968 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:12.114102 0.063585 tcp 10.0.2.105 63969 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:12.177938 0.152900 tcp 10.0.2.105 63970 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:12.435900 2.999536 tcp 10.0.2.105 63971 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:21.434075 0.000000 tcp 10.0.2.105 63971 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:27.433530 0.053858 tcp 10.0.2.105 63972 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:27.487644 0.063709 tcp 10.0.2.105 63973 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:27.551650 0.157956 tcp 10.0.2.105 63974 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:39:27.774933 3.002091 tcp 10.0.2.105 63975 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:36.785907 0.000000 tcp 10.0.2.105 63975 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:42.774926 2.994017 tcp 10.0.2.105 63976 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:51.777302 0.000000 tcp 10.0.2.105 63976 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:39:56.344129 0.000216 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:39:57.776138 2.994515 tcp 10.0.2.105 63977 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:40:06.769187 0.000000 tcp 10.0.2.105 63977 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:44:33.475838 3.001040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:44:40.773223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:44:48.698766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:45:04.546291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:45:12.782815 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:45:12.783004 3.000379 tcp 10.0.2.105 63978 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:21.781981 0.000000 tcp 10.0.2.105 63978 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:27.785311 0.053432 tcp 10.0.2.105 63979 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:27.838996 0.062825 tcp 10.0.2.105 63980 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:27.902199 0.151905 tcp 10.0.2.105 63981 -> 195.113.214.251 443 SRPA* 0 0 38 32996 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:28.134668 3.000878 tcp 10.0.2.105 63982 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:36.493452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:45:37.134024 0.000000 tcp 10.0.2.105 63982 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:43.133490 0.051709 tcp 10.0.2.105 63983 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:43.185560 0.065206 tcp 10.0.2.105 63984 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:43.251061 0.150203 tcp 10.0.2.105 63985 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:43.422020 2.995373 tcp 10.0.2.105 63986 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:52.425898 0.000000 tcp 10.0.2.105 63986 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:45:58.415901 0.053273 tcp 10.0.2.105 63987 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:58.469419 0.066390 tcp 10.0.2.105 63988 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:58.536152 0.154005 tcp 10.0.2.105 63989 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:45:58.706560 2.992806 tcp 10.0.2.105 63990 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:46:07.698042 0.000000 tcp 10.0.2.105 63990 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:46:13.707174 2.993638 tcp 10.0.2.105 63991 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:46:22.699740 0.000000 tcp 10.0.2.105 63991 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:46:27.336562 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:46:28.708832 3.003861 tcp 10.0.2.105 63992 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:46:37.711080 0.000000 tcp 10.0.2.105 63992 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:51:43.711712 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:51:43.711852 3.003726 tcp 10.0.2.105 63993 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:51:52.714008 0.000000 tcp 10.0.2.105 63993 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:51:58.714637 0.032032 tcp 10.0.2.105 63994 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:51:58.746960 0.061932 tcp 10.0.2.105 63995 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:51:58.809154 0.191342 tcp 10.0.2.105 63996 -> 195.113.214.251 443 SRPA* 0 0 73 78220 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:51:59.274786 2.993151 tcp 10.0.2.105 63997 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:08.276734 0.000000 tcp 10.0.2.105 63997 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:14.275674 0.052158 tcp 10.0.2.105 63998 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:14.328066 0.062205 tcp 10.0.2.105 63999 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:14.390566 0.155459 tcp 10.0.2.105 64000 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:14.684872 2.995101 tcp 10.0.2.105 64001 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:23.678521 0.000000 tcp 10.0.2.105 64001 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:29.677668 0.052492 tcp 10.0.2.105 64002 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:29.730496 0.068298 tcp 10.0.2.105 64003 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:29.799132 0.153378 tcp 10.0.2.105 64004 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:52:30.042066 3.000047 tcp 10.0.2.105 64005 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:39.040413 0.000000 tcp 10.0.2.105 64005 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:45.039631 3.004085 tcp 10.0.2.105 64006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:54.042330 0.000000 tcp 10.0.2.105 64006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:52:58.838978 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:53:00.041088 3.004299 tcp 10.0.2.105 64007 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:53:09.043770 0.000000 tcp 10.0.2.105 64007 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:54:48.499753 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 16:54:55.507099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:55:03.508891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:55:19.511430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:55:51.517476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 16:58:15.044147 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:58:15.044369 2.993668 tcp 10.0.2.105 64008 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:58:24.046153 0.000000 tcp 10.0.2.105 64008 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:58:30.046371 0.052578 tcp 10.0.2.105 64009 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:30.099314 0.060930 tcp 10.0.2.105 64010 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:30.160713 0.156966 tcp 10.0.2.105 64011 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:30.370283 2.999933 tcp 10.0.2.105 64012 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:58:39.368645 0.000000 tcp 10.0.2.105 64012 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:58:45.368155 0.052940 tcp 10.0.2.105 64013 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:45.421460 0.066049 tcp 10.0.2.105 64014 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:45.487824 0.158641 tcp 10.0.2.105 64015 -> 195.113.214.251 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:58:45.656672 2.995361 tcp 10.0.2.105 64016 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:58:54.653516 0.000000 tcp 10.0.2.105 64016 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:00.650301 0.052069 tcp 10.0.2.105 64017 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:59:00.702646 0.065227 tcp 10.0.2.105 64018 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:59:00.768226 0.159278 tcp 10.0.2.105 64019 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 16:59:00.995614 3.001154 tcp 10.0.2.105 64020 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:09.992861 0.000000 tcp 10.0.2.105 64020 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:15.992039 3.004495 tcp 10.0.2.105 64021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:24.994712 0.000000 tcp 10.0.2.105 64021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:29.841284 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 16:59:30.993347 3.003939 tcp 10.0.2.105 64022 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 16:59:40.005972 0.000000 tcp 10.0.2.105 64022 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:01:55.524370 3.000732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:02:02.531029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:02:10.532710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:02:26.535573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:02:58.541603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:08:05.873722 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:08:05.873912 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 17:08:23.931085 0.053201 tcp 10.0.2.105 64023 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:23.984628 0.099202 tcp 10.0.2.105 64024 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:24.084147 0.164174 tcp 10.0.2.105 64025 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:24.249215 0.175271 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:24.416415 0.086323 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:24.661155 0.142893 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2601 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:24.761378 0.072942 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:24.903641 0.100704 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:25.222441 0.122369 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:25.325527 4.986032 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:30.435675 0.093887 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 4 1896 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 17:08:30.445659 0.169978 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:30.626857 0.060039 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:30.812057 0.151358 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:30.924376 0.212990 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.019551 3.004198 tcp 10.0.2.105 64026 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:08:31.129943 0.080192 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.224910 0.258743 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.449079 0.209483 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.653887 0.172846 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2550 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.823592 0.056952 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:31.951407 0.934641 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.001434 0.177465 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.215054 0.046249 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.245083 0.229195 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.467144 0.259531 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.678993 0.127450 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.839549 0.113765 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:33.908718 0.092517 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:34.145724 0.396684 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:34.522875 0.283835 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:34.801999 0.244696 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:08:40.022756 0.000000 tcp 10.0.2.105 64026 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:08:46.063670 0.031094 tcp 10.0.2.105 64027 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:46.095128 0.063685 tcp 10.0.2.105 64028 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:46.159082 0.154746 tcp 10.0.2.105 64029 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:08:46.631085 2.980730 tcp 10.0.2.105 64030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:08:55.594835 0.000000 tcp 10.0.2.105 64030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:09:01.593900 0.051666 tcp 10.0.2.105 64031 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:09:01.645815 0.063663 tcp 10.0.2.105 64032 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:09:01.709790 0.167954 tcp 10.0.2.105 64033 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:09:01.960453 2.998016 tcp 10.0.2.105 64034 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:09:07.555704 3.000545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:09:10.966892 0.000000 tcp 10.0.2.105 64034 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:09:14.562405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:09:16.955781 2.994109 tcp 10.0.2.105 64035 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:09:22.563443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:09:25.948654 0.000000 tcp 10.0.2.105 64035 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:09:30.845295 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:09:38.566699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:10:10.575176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:14:31.958929 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:14:31.959044 3.003536 tcp 10.0.2.105 64036 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:14:40.961428 0.000000 tcp 10.0.2.105 64036 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:14:46.961918 0.053491 tcp 10.0.2.105 64037 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:14:47.015728 0.061742 tcp 10.0.2.105 64038 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:14:47.077749 0.154520 tcp 10.0.2.105 64039 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:14:47.378033 3.006832 tcp 10.0.2.105 64040 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:14:56.383470 0.000000 tcp 10.0.2.105 64040 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:02.372757 0.052898 tcp 10.0.2.105 64041 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:02.425939 0.062562 tcp 10.0.2.105 64042 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:02.488770 0.162959 tcp 10.0.2.105 64043 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:02.854523 3.002679 tcp 10.0.2.105 64044 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:11.865645 0.000000 tcp 10.0.2.105 64044 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:17.858633 0.052894 tcp 10.0.2.105 64045 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:17.911841 0.061742 tcp 10.0.2.105 64046 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:17.973915 0.159183 tcp 10.0.2.105 64047 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:15:18.829036 2.992599 tcp 10.0.2.105 64048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:27.818615 0.000000 tcp 10.0.2.105 64048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:33.823407 2.998090 tcp 10.0.2.105 64049 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:42.820172 0.000000 tcp 10.0.2.105 64049 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:47.336355 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:15:48.818946 3.004351 tcp 10.0.2.105 64050 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:15:57.822052 0.000000 tcp 10.0.2.105 64050 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:16:14.578664 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:16:21.586144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:16:29.587528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:16:45.590479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:17:17.596591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:21:03.822249 0.072445 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:21:03.894822 2.974907 tcp 10.0.2.105 64051 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:12.828980 0.000000 tcp 10.0.2.105 64051 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:18.835746 0.052250 tcp 10.0.2.105 64052 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:18.888137 0.061274 tcp 10.0.2.105 64053 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:18.949662 0.154638 tcp 10.0.2.105 64054 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:19.113867 2.994824 tcp 10.0.2.105 64055 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:28.117109 0.000000 tcp 10.0.2.105 64055 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:34.116197 0.030246 tcp 10.0.2.105 64056 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:34.146807 0.060307 tcp 10.0.2.105 64057 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:34.207418 0.156552 tcp 10.0.2.105 64058 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:34.381165 2.998851 tcp 10.0.2.105 64059 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:43.378189 0.000000 tcp 10.0.2.105 64059 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:49.377936 0.053013 tcp 10.0.2.105 64060 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:49.431247 0.065753 tcp 10.0.2.105 64061 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:49.497282 0.151695 tcp 10.0.2.105 64062 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:21:49.751830 3.000726 tcp 10.0.2.105 64063 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:21:58.750870 0.000000 tcp 10.0.2.105 64063 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:22:04.749594 3.004030 tcp 10.0.2.105 64064 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:22:13.752568 0.000000 tcp 10.0.2.105 64064 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:22:18.338993 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:22:19.751486 3.003859 tcp 10.0.2.105 64065 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:22:28.753752 0.000000 tcp 10.0.2.105 64065 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:23:21.603232 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:23:28.610013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:23:36.612729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:23:52.614696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:24:24.620686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:27:34.754766 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:27:34.754893 2.993413 tcp 10.0.2.105 64066 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:27:43.756808 0.000000 tcp 10.0.2.105 64066 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:27:49.757318 0.053696 tcp 10.0.2.105 64067 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:27:49.811375 0.064389 tcp 10.0.2.105 64068 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:27:49.876114 0.156035 tcp 10.0.2.105 64069 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:27:50.059206 3.000930 tcp 10.0.2.105 64070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:27:59.058385 0.000000 tcp 10.0.2.105 64070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:05.058222 0.052097 tcp 10.0.2.105 64071 -> 195.113.214.221 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:05.110560 0.065043 tcp 10.0.2.105 64072 -> 195.113.214.251 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:05.175972 0.155236 tcp 10.0.2.105 64073 -> 195.113.214.251 443 SRPA* 0 0 20 11307 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:05.362714 2.999471 tcp 10.0.2.105 64074 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:14.360420 0.000000 tcp 10.0.2.105 64074 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:20.430890 0.051529 tcp 10.0.2.105 64075 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:20.482797 0.060731 tcp 10.0.2.105 64076 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:20.543850 0.155911 tcp 10.0.2.105 64077 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:28:20.719158 2.980296 tcp 10.0.2.105 64078 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:29.652921 0.000000 tcp 10.0.2.105 64078 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:35.653267 3.002807 tcp 10.0.2.105 64079 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:44.654301 0.000000 tcp 10.0.2.105 64079 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:49.343158 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:28:50.659020 2.988729 tcp 10.0.2.105 64080 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:28:59.655887 0.000000 tcp 10.0.2.105 64080 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:30:28.626598 3.002033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:30:35.634105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:30:43.635717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:30:59.638859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:31:31.645586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:34:05.656766 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:34:05.656979 2.992989 tcp 10.0.2.105 64081 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:34:14.648867 0.000000 tcp 10.0.2.105 64081 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:34:20.659342 0.031126 tcp 10.0.2.105 64082 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:34:20.690770 0.065846 tcp 10.0.2.105 64083 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:34:20.756939 0.160295 tcp 10.0.2.105 64084 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:34:20.995944 2.996504 tcp 10.0.2.105 64085 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:34:29.990839 0.000000 tcp 10.0.2.105 64085 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:37:35.651635 3.000963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 17:37:42.658232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:37:50.659488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:38:06.662537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:38:38.671047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:38:46.950298 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:38:46.950499 0.207694 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.152684 0.175036 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.321167 0.084182 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.386966 0.142420 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.488164 0.078648 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.554470 0.100151 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.657378 0.100747 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.737424 0.063098 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:47.964379 0.176128 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.154814 0.171623 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.303910 0.139243 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.402680 0.218148 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.612834 0.079728 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.762385 0.251782 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:48.978781 0.202996 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:49.176069 0.173332 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:49.345850 0.053503 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:38:49.425332 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 17:39:08.372886 0.032022 tcp 10.0.2.105 64086 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:08.405152 0.065248 tcp 10.0.2.105 64087 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:08.470685 0.155659 tcp 10.0.2.105 64088 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:08.626937 0.224822 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:08.845045 0.744284 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:09.634179 0.173633 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:09.783337 0.255699 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:09.991886 0.093266 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:10.080343 0.104743 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:10.148104 0.083549 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:10.274100 0.401410 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:10.654867 0.397996 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:11.043513 0.244496 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/05 17:39:35.991494 3.003574 tcp 10.0.2.105 64089 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:39:40.837858 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:39:44.993862 0.000000 tcp 10.0.2.105 64089 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:39:50.993502 0.052719 tcp 10.0.2.105 64090 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:51.046482 0.061958 tcp 10.0.2.105 64091 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:51.108724 0.160401 tcp 10.0.2.105 64092 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:39:51.282472 3.004684 tcp 10.0.2.105 64093 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:00.295920 0.000000 tcp 10.0.2.105 64093 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:06.275033 0.052284 tcp 10.0.2.105 64094 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:06.327580 0.062980 tcp 10.0.2.105 64095 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:06.390845 0.154326 tcp 10.0.2.105 64096 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:06.753252 2.996078 tcp 10.0.2.105 64097 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:15.748542 0.000000 tcp 10.0.2.105 64097 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:21.747375 0.030216 tcp 10.0.2.105 64098 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:21.777844 0.061467 tcp 10.0.2.105 64099 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:21.839565 0.156604 tcp 10.0.2.105 64100 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:40:22.018583 3.003392 tcp 10.0.2.105 64101 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:31.019769 0.000000 tcp 10.0.2.105 64101 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:37.019032 3.004326 tcp 10.0.2.105 64102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:46.021749 0.000000 tcp 10.0.2.105 64102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:40:50.840011 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:40:52.022030 3.003358 tcp 10.0.2.105 64103 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:41:01.022934 0.000000 tcp 10.0.2.105 64103 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:44:42.674472 3.002235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:44:49.682012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:44:57.685502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:45:13.686657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:45:45.693171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:46:07.023507 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:46:07.023655 3.003391 tcp 10.0.2.105 64104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:16.035943 0.000000 tcp 10.0.2.105 64104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:22.026223 0.052883 tcp 10.0.2.105 64105 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:22.079415 0.060353 tcp 10.0.2.105 64106 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:22.140134 0.154670 tcp 10.0.2.105 64107 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:22.319069 3.005718 tcp 10.0.2.105 64108 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:31.317955 0.000000 tcp 10.0.2.105 64108 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:37.316926 0.029859 tcp 10.0.2.105 64109 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:37.347085 0.062144 tcp 10.0.2.105 64110 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:37.409612 0.158765 tcp 10.0.2.105 64111 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:37.839047 3.002629 tcp 10.0.2.105 64112 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:46.840591 0.000000 tcp 10.0.2.105 64112 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:46:52.839456 0.053588 tcp 10.0.2.105 64113 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:52.893337 0.064965 tcp 10.0.2.105 64114 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:52.958624 0.158734 tcp 10.0.2.105 64115 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:46:53.282426 3.001605 tcp 10.0.2.105 64116 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:47:02.282739 0.000000 tcp 10.0.2.105 64116 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:47:08.281378 3.004263 tcp 10.0.2.105 64117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:47:17.284143 0.000000 tcp 10.0.2.105 64117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:47:21.840557 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:47:23.282938 3.003999 tcp 10.0.2.105 64118 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:47:32.285859 0.000000 tcp 10.0.2.105 64118 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:51:49.698984 3.029442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:51:56.716104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:52:04.717420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:52:20.720602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:52:38.286099 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:52:38.286227 2.993563 tcp 10.0.2.105 64119 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:52:47.278831 0.000000 tcp 10.0.2.105 64119 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:52:52.726347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:52:53.288911 0.031541 tcp 10.0.2.105 64120 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:52:53.320764 0.063234 tcp 10.0.2.105 64121 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:52:53.384407 0.153234 tcp 10.0.2.105 64122 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:52:53.572501 2.999446 tcp 10.0.2.105 64123 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:02.570528 0.000000 tcp 10.0.2.105 64123 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:08.569799 0.030154 tcp 10.0.2.105 64124 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:08.600237 0.062236 tcp 10.0.2.105 64125 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:08.662809 0.161658 tcp 10.0.2.105 64126 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:08.837353 3.006357 tcp 10.0.2.105 64127 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:17.842606 0.000000 tcp 10.0.2.105 64127 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:23.831604 0.051947 tcp 10.0.2.105 64128 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:23.883914 0.064279 tcp 10.0.2.105 64129 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:23.948564 0.152884 tcp 10.0.2.105 64130 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:53:24.128913 3.007142 tcp 10.0.2.105 64131 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:33.134662 0.000000 tcp 10.0.2.105 64131 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:39.123423 3.003898 tcp 10.0.2.105 64132 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:48.136141 0.000000 tcp 10.0.2.105 64132 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:53:52.842828 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:53:54.128864 2.990080 tcp 10.0.2.105 64133 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:54:03.127690 0.000000 tcp 10.0.2.105 64133 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:58:56.732146 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 17:59:03.739834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:59:09.127990 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 17:59:09.128209 3.003696 tcp 10.0.2.105 64134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:11.741642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:59:18.130913 0.000000 tcp 10.0.2.105 64134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:24.131079 0.031110 tcp 10.0.2.105 64135 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:24.162467 0.062903 tcp 10.0.2.105 64136 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:24.225709 0.153415 tcp 10.0.2.105 64137 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:24.392886 3.001032 tcp 10.0.2.105 64138 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:27.744547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 17:59:33.392709 0.000000 tcp 10.0.2.105 64138 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:39.412174 0.053753 tcp 10.0.2.105 64139 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:39.466270 0.065865 tcp 10.0.2.105 64140 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:39.532557 0.157437 tcp 10.0.2.105 64141 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:39.761458 2.986071 tcp 10.0.2.105 64142 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:48.744306 0.000000 tcp 10.0.2.105 64142 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:54.743846 0.030794 tcp 10.0.2.105 64143 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:54.774918 0.063884 tcp 10.0.2.105 64144 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:54.839072 0.156103 tcp 10.0.2.105 64145 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 17:59:55.101746 2.986249 tcp 10.0.2.105 64146 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 17:59:59.750243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:00:04.096585 0.000000 tcp 10.0.2.105 64146 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:00:10.095620 2.993659 tcp 10.0.2.105 64147 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:00:19.087777 0.000000 tcp 10.0.2.105 64147 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:00:23.844973 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:00:25.097220 2.993946 tcp 10.0.2.105 64148 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:00:34.089940 0.000000 tcp 10.0.2.105 64148 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:06:28.761788 3.024086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 18:06:35.779717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:06:43.781506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:06:59.784604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:07:31.801014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:09:12.565520 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:09:12.565634 0.144256 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:12.597322 0.112629 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:12.744575 0.202966 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:12.942577 0.173274 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:13.189467 0.076927 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:13.557676 0.105665 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:14.237025 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 18:09:25.123219 2.994337 tcp 10.0.2.105 64149 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:09:29.264039 0.053657 tcp 10.0.2.105 64150 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:29.318046 0.064758 tcp 10.0.2.105 64151 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:29.383158 0.152409 tcp 10.0.2.105 64152 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:29.536423 0.060836 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:29.769951 0.211123 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:29.934522 0.147174 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:30.111366 0.137101 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:30.210098 0.172141 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:30.471119 0.256835 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:30.694675 0.193437 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:30.882026 0.176752 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:31.066167 0.053765 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:31.526422 0.220408 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:31.738785 0.077023 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:32.593599 0.229206 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:32.815267 0.691963 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:33.867670 0.175876 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:34.126068 0.000000 tcp 10.0.2.105 64149 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:09:34.137362 0.260225 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:34.347649 0.094575 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:34.482862 0.107269 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:34.554000 0.084219 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:34.744624 0.248366 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:35.075022 0.400630 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:35.455094 0.284914 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:09:40.127161 0.030051 tcp 10.0.2.105 64153 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:40.157545 0.062630 tcp 10.0.2.105 64154 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:40.220534 0.150827 tcp 10.0.2.105 64155 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:40.506479 2.993144 tcp 10.0.2.105 64156 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:09:49.498723 0.000000 tcp 10.0.2.105 64156 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:09:55.497613 0.052483 tcp 10.0.2.105 64157 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:55.550401 0.062590 tcp 10.0.2.105 64158 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:55.612824 0.155022 tcp 10.0.2.105 64159 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:09:55.881290 3.002247 tcp 10.0.2.105 64160 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:10:04.880274 0.000000 tcp 10.0.2.105 64160 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:10:10.880082 3.003157 tcp 10.0.2.105 64161 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:10:19.882731 0.000000 tcp 10.0.2.105 64161 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:10:24.838768 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:13:35.807512 3.000484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:13:42.813679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:13:50.815465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:14:06.818276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:14:38.824583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:15:25.882815 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:15:25.883009 3.003234 tcp 10.0.2.105 64162 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:15:34.885032 0.000000 tcp 10.0.2.105 64162 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:15:40.888751 0.031673 tcp 10.0.2.105 64163 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:40.920731 0.061986 tcp 10.0.2.105 64164 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:40.983072 0.157376 tcp 10.0.2.105 64165 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:41.598030 2.990869 tcp 10.0.2.105 64166 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:15:50.589348 0.000000 tcp 10.0.2.105 64166 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:15:56.596907 0.030371 tcp 10.0.2.105 64167 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:56.627612 0.064284 tcp 10.0.2.105 64168 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:56.692052 0.151200 tcp 10.0.2.105 64169 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:15:57.014898 3.333965 tcp 10.0.2.105 64170 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:06.294818 0.000000 tcp 10.0.2.105 64170 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:12.248047 0.030359 tcp 10.0.2.105 64171 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:16:12.278765 0.063311 tcp 10.0.2.105 64172 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:16:12.342390 0.163740 tcp 10.0.2.105 64173 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:16:12.757791 2.977435 tcp 10.0.2.105 64174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:21.677470 0.000000 tcp 10.0.2.105 64174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:27.625607 2.986335 tcp 10.0.2.105 64175 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:36.557605 0.000000 tcp 10.0.2.105 64175 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:41.342972 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:16:42.533005 3.003969 tcp 10.0.2.105 64176 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:16:51.539322 0.000000 tcp 10.0.2.105 64176 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:20:42.830290 3.001724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:20:49.854877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:20:57.849183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:21:13.852665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:21:45.858296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:21:57.537126 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:21:57.537232 2.992203 tcp 10.0.2.105 64177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:06.528991 0.000000 tcp 10.0.2.105 64177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:12.538752 0.054807 tcp 10.0.2.105 64178 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:12.593860 0.063841 tcp 10.0.2.105 64179 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:12.657635 0.155950 tcp 10.0.2.105 64180 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:12.886238 2.995304 tcp 10.0.2.105 64181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:21.879652 0.000000 tcp 10.0.2.105 64181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:27.879365 0.030634 tcp 10.0.2.105 64182 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:27.910266 0.069615 tcp 10.0.2.105 64183 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:27.980198 0.153540 tcp 10.0.2.105 64184 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:28.149517 3.003945 tcp 10.0.2.105 64185 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:37.152168 0.000000 tcp 10.0.2.105 64185 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:43.151309 0.030736 tcp 10.0.2.105 64186 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:43.182337 0.062778 tcp 10.0.2.105 64187 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:43.245461 0.154593 tcp 10.0.2.105 64188 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:22:43.410295 3.004867 tcp 10.0.2.105 64189 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:52.414573 0.000000 tcp 10.0.2.105 64189 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:22:58.403048 3.007521 tcp 10.0.2.105 64190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:23:07.405296 0.000000 tcp 10.0.2.105 64190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:23:12.342693 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:23:13.404203 2.994662 tcp 10.0.2.105 64191 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:23:22.407145 0.000000 tcp 10.0.2.105 64191 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:27:49.864832 3.001106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:27:56.871774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:28:04.873189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:28:20.876060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:28:28.407845 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:28:28.407941 3.003444 tcp 10.0.2.105 64192 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:28:37.409811 0.000000 tcp 10.0.2.105 64192 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:28:43.410884 0.030792 tcp 10.0.2.105 64193 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:43.441933 0.062079 tcp 10.0.2.105 64194 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:43.504540 0.157207 tcp 10.0.2.105 64195 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:43.716718 2.996102 tcp 10.0.2.105 64196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:28:52.711911 0.000000 tcp 10.0.2.105 64196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:28:52.882235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:28:58.711545 0.051373 tcp 10.0.2.105 64197 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:58.763164 0.065784 tcp 10.0.2.105 64198 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:58.829233 0.157443 tcp 10.0.2.105 64199 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:28:59.053432 3.002014 tcp 10.0.2.105 64200 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:08.053952 0.000000 tcp 10.0.2.105 64200 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:14.053841 0.030646 tcp 10.0.2.105 64201 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:29:14.084781 0.065145 tcp 10.0.2.105 64202 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:29:14.150239 0.157927 tcp 10.0.2.105 64203 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:29:14.325702 2.991670 tcp 10.0.2.105 64204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:23.326075 0.000000 tcp 10.0.2.105 64204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:29.325011 2.994127 tcp 10.0.2.105 64205 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:38.317414 0.000000 tcp 10.0.2.105 64205 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:42.844046 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:29:44.326471 2.994033 tcp 10.0.2.105 64206 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:29:53.319043 0.000000 tcp 10.0.2.105 64206 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:34:56.888196 3.004566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:34:59.334264 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:34:59.334397 2.999265 tcp 10.0.2.105 64207 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:35:03.895702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:35:08.332009 0.000000 tcp 10.0.2.105 64207 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:35:11.897381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:35:14.332522 0.031347 tcp 10.0.2.105 64208 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:35:14.364132 0.062337 tcp 10.0.2.105 64209 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:35:14.426769 0.156166 tcp 10.0.2.105 64210 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:35:14.617813 3.007576 tcp 10.0.2.105 64211 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:35:23.623966 0.000000 tcp 10.0.2.105 64211 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:35:27.900978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:35:59.906005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:39:48.344441 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:39:48.344598 0.111947 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:39:48.456967 0.094387 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:39:48.527940 0.045155 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:39:48.691322 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 18:40:07.393789 0.031336 tcp 10.0.2.105 64212 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:07.425418 0.065528 tcp 10.0.2.105 64213 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:07.491204 0.159078 tcp 10.0.2.105 64214 -> 195.113.214.251 443 SRPA* 0 0 27 11666 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:07.650782 0.174685 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:07.817946 0.085440 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:07.887126 0.097746 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:07.968236 0.059581 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:08.174798 0.173637 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:08.387713 0.183845 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:08.533211 0.292090 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:08.791498 0.199439 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.046145 0.130543 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.136822 0.166990 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.282116 0.175034 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.453607 0.053297 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.579690 0.218159 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.874543 0.076942 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:09.937351 0.221865 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:10.152231 0.389266 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:10.597209 0.173105 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:10.746438 0.248579 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:10.948738 0.091256 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:11.023162 0.244439 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:11.266052 0.106902 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:11.335129 0.082358 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:11.423779 0.403038 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:11.804517 0.290874 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/05 18:40:29.614645 2.996324 tcp 10.0.2.105 64215 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:40:34.341234 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:40:38.617251 0.000000 tcp 10.0.2.105 64215 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:40:44.616011 0.030918 tcp 10.0.2.105 64216 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:44.646808 0.064370 tcp 10.0.2.105 64217 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:44.711466 0.157139 tcp 10.0.2.105 64218 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:40:44.913363 2.998532 tcp 10.0.2.105 64219 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:40:53.908991 0.000000 tcp 10.0.2.105 64219 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:40:59.908538 0.121291 tcp 10.0.2.105 64220 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:00.030159 0.087540 tcp 10.0.2.105 64221 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:00.118064 0.153153 tcp 10.0.2.105 64222 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:00.503888 3.000818 tcp 10.0.2.105 64223 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:09.501612 0.000000 tcp 10.0.2.105 64223 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:15.500696 0.030650 tcp 10.0.2.105 64224 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:15.531616 0.063030 tcp 10.0.2.105 64225 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:15.594977 0.188093 tcp 10.0.2.105 64226 -> 195.113.214.251 443 SRPA* 0 0 72 76186 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:41:15.844551 3.000394 tcp 10.0.2.105 64227 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:24.843368 0.000000 tcp 10.0.2.105 64227 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:30.842390 3.003643 tcp 10.0.2.105 64228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:39.845117 0.000000 tcp 10.0.2.105 64228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:44.842730 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:41:45.843923 2.994004 tcp 10.0.2.105 64229 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:41:54.846641 0.000000 tcp 10.0.2.105 64229 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:42:03.911736 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:42:10.919453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:42:18.921367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:42:34.924152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:43:06.930254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:47:00.847286 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:47:00.847373 2.993090 tcp 10.0.2.105 64230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:09.839271 0.000000 tcp 10.0.2.105 64230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:15.849723 0.030930 tcp 10.0.2.105 64231 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:15.880929 0.066457 tcp 10.0.2.105 64232 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:15.947706 0.158871 tcp 10.0.2.105 64233 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:16.151422 3.001437 tcp 10.0.2.105 64234 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:25.151228 0.000000 tcp 10.0.2.105 64234 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:31.150734 0.031235 tcp 10.0.2.105 64235 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:31.182278 0.062456 tcp 10.0.2.105 64236 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:31.245024 0.159348 tcp 10.0.2.105 64237 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:31.444836 2.999352 tcp 10.0.2.105 64238 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:40.443274 0.000000 tcp 10.0.2.105 64238 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:46.442742 0.030276 tcp 10.0.2.105 64239 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:46.473355 0.061654 tcp 10.0.2.105 64240 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:46.535321 0.153966 tcp 10.0.2.105 64241 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:47:46.763443 3.003465 tcp 10.0.2.105 64242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:47:55.765276 0.000000 tcp 10.0.2.105 64242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:48:01.764338 2.993898 tcp 10.0.2.105 64243 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:48:10.767137 0.000000 tcp 10.0.2.105 64243 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:48:15.343741 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:48:16.765791 2.994340 tcp 10.0.2.105 64244 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:48:25.758610 0.000000 tcp 10.0.2.105 64244 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:53:29.938757 3.001446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 18:53:31.769071 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:53:31.769175 3.003488 tcp 10.0.2.105 64245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:53:36.946108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:53:40.771621 0.000000 tcp 10.0.2.105 64245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:53:44.947386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:53:46.771957 0.030520 tcp 10.0.2.105 64246 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:53:46.802762 0.061896 tcp 10.0.2.105 64247 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:53:46.865043 0.156356 tcp 10.0.2.105 64248 -> 195.113.214.251 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:53:47.275712 2.999304 tcp 10.0.2.105 64249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:53:56.273768 0.000000 tcp 10.0.2.105 64249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:00.950574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:54:02.273927 0.029900 tcp 10.0.2.105 64250 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:02.304152 0.062634 tcp 10.0.2.105 64251 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:02.367039 0.157431 tcp 10.0.2.105 64252 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:02.571864 3.005327 tcp 10.0.2.105 64253 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:11.585751 0.000000 tcp 10.0.2.105 64253 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:17.565208 0.030196 tcp 10.0.2.105 64254 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:17.595281 0.063678 tcp 10.0.2.105 64255 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:17.659263 0.155537 tcp 10.0.2.105 64256 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 18:54:17.863577 2.995611 tcp 10.0.2.105 64257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:26.867714 0.000000 tcp 10.0.2.105 64257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:32.856755 2.993349 tcp 10.0.2.105 64258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:32.956642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 18:54:41.849205 0.000000 tcp 10.0.2.105 64258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:46.836457 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 18:54:47.857997 3.004613 tcp 10.0.2.105 64259 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 18:54:56.860841 0.000000 tcp 10.0.2.105 64259 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:02.861422 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:00:02.861576 3.003655 tcp 10.0.2.105 64260 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:11.863755 0.000000 tcp 10.0.2.105 64260 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:17.864186 0.031256 tcp 10.0.2.105 64261 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:17.895682 0.063121 tcp 10.0.2.105 64262 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:17.959127 0.155295 tcp 10.0.2.105 64263 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:18.130042 3.008021 tcp 10.0.2.105 64264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:27.145922 0.000000 tcp 10.0.2.105 64264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:33.124784 0.030221 tcp 10.0.2.105 64265 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:33.155308 0.062168 tcp 10.0.2.105 64266 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:33.217765 0.154526 tcp 10.0.2.105 64267 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:33.385954 2.993100 tcp 10.0.2.105 64268 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:36.962368 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:00:42.387602 0.000000 tcp 10.0.2.105 64268 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:43.969998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:00:48.386802 0.051977 tcp 10.0.2.105 64269 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:48.439073 0.062255 tcp 10.0.2.105 64270 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:48.501563 0.153055 tcp 10.0.2.105 64271 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:00:48.702150 2.998869 tcp 10.0.2.105 64272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:00:51.971727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:00:57.699891 0.000000 tcp 10.0.2.105 64272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:01:03.703220 2.999452 tcp 10.0.2.105 64273 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:01:07.974144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:01:12.704498 0.000000 tcp 10.0.2.105 64273 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:01:17.337750 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:01:18.699864 3.004230 tcp 10.0.2.105 64274 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:01:27.703998 0.000000 tcp 10.0.2.105 64274 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:01:39.980427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:07:43.986155 3.002248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 19:07:50.993798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:07:58.995430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:08:14.998320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:08:47.004504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:10:38.514963 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:10:38.515064 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 19:10:55.731470 0.031404 tcp 10.0.2.105 64275 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:10:55.763130 0.066319 tcp 10.0.2.105 64276 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:10:55.829695 0.134523 tcp 10.0.2.105 64277 -> 195.113.214.251 443 SRPA* 0 0 36 26926 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:10:55.964822 0.081125 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:56.028564 0.095549 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:56.400643 0.045762 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:56.483890 0.402409 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:56.879473 0.077052 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:57.174849 0.098766 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:57.257830 0.061905 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:57.439549 0.308317 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:57.711856 0.200853 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:58.141319 0.123436 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:58.228837 0.166592 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:58.422345 0.212467 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:58.555918 0.135247 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:58.853258 0.173693 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:59.023405 0.057766 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:59.314321 0.217521 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:59.524344 0.074645 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:59.642142 0.229980 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:10:59.864506 0.731129 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:00.626190 0.176429 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:00.779117 0.249289 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:00.980972 0.103907 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:01.153753 0.261593 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:01.414094 0.110935 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:01.614024 0.288491 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:01.893640 0.083442 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:02.035357 0.399505 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:11:03.731409 3.004143 tcp 10.0.2.105 64278 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:12.737964 0.000000 tcp 10.0.2.105 64278 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:18.733334 0.030293 tcp 10.0.2.105 64279 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:18.763893 0.065160 tcp 10.0.2.105 64280 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:18.829326 0.155156 tcp 10.0.2.105 64281 -> 195.113.214.251 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:19.238904 3.011136 tcp 10.0.2.105 64282 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:28.256235 0.000000 tcp 10.0.2.105 64282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:34.235090 0.051644 tcp 10.0.2.105 64283 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:34.286997 0.063042 tcp 10.0.2.105 64284 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:34.350344 0.150260 tcp 10.0.2.105 64285 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:35.070585 2.999724 tcp 10.0.2.105 64286 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:44.069153 0.000000 tcp 10.0.2.105 64286 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:50.068037 0.030853 tcp 10.0.2.105 64287 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:50.099164 0.066061 tcp 10.0.2.105 64288 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:50.165527 0.152982 tcp 10.0.2.105 64289 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:11:50.537591 3.005214 tcp 10.0.2.105 64290 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:11:59.541555 0.000000 tcp 10.0.2.105 64290 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:12:05.529879 3.004195 tcp 10.0.2.105 64291 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:12:14.532769 0.000000 tcp 10.0.2.105 64291 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:12:19.339745 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:12:20.531906 3.003958 tcp 10.0.2.105 64292 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:12:29.534676 0.000000 tcp 10.0.2.105 64292 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:14:51.016848 2.996635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:14:58.018332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:15:06.019450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:15:22.022575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:15:54.029003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:17:35.534554 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:17:35.534762 2.993994 tcp 10.0.2.105 64293 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:17:44.537234 0.000000 tcp 10.0.2.105 64293 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:17:50.537656 0.031137 tcp 10.0.2.105 64294 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:17:50.569067 0.063506 tcp 10.0.2.105 64295 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:17:50.632841 0.150295 tcp 10.0.2.105 64296 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:17:50.859736 2.990610 tcp 10.0.2.105 64297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:17:59.849196 0.000000 tcp 10.0.2.105 64297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:05.858670 0.030850 tcp 10.0.2.105 64298 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:05.889895 0.064372 tcp 10.0.2.105 64299 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:05.954556 0.151989 tcp 10.0.2.105 64300 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:06.415961 2.997195 tcp 10.0.2.105 64301 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:15.411782 0.000000 tcp 10.0.2.105 64301 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:21.411768 0.030469 tcp 10.0.2.105 64302 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:21.442537 0.060635 tcp 10.0.2.105 64303 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:21.503444 0.152503 tcp 10.0.2.105 64304 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:18:21.958573 3.006901 tcp 10.0.2.105 64305 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:30.964216 0.000000 tcp 10.0.2.105 64305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:36.953144 3.003356 tcp 10.0.2.105 64306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:45.954991 0.000000 tcp 10.0.2.105 64306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:18:50.842642 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:18:51.954801 2.993767 tcp 10.0.2.105 64307 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:19:00.957172 0.000000 tcp 10.0.2.105 64307 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:21:58.034694 3.000870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:22:05.042106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:22:13.043338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:22:29.046266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:23:01.052804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:24:06.957213 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:24:06.957329 3.004286 tcp 10.0.2.105 64308 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:15.959434 0.000000 tcp 10.0.2.105 64308 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:21.960597 0.031005 tcp 10.0.2.105 64309 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:21.991956 0.060396 tcp 10.0.2.105 64310 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:22.052701 0.153277 tcp 10.0.2.105 64311 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:22.244690 2.998672 tcp 10.0.2.105 64312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:31.241960 0.000000 tcp 10.0.2.105 64312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:37.241897 0.052529 tcp 10.0.2.105 64313 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:37.294687 0.062146 tcp 10.0.2.105 64314 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:37.357232 0.155619 tcp 10.0.2.105 64315 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:37.558762 3.006642 tcp 10.0.2.105 64316 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:46.564072 0.000000 tcp 10.0.2.105 64316 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:24:52.553431 0.030243 tcp 10.0.2.105 64317 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:52.583979 0.061461 tcp 10.0.2.105 64318 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:52.645733 0.150568 tcp 10.0.2.105 64319 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:24:52.834750 3.002326 tcp 10.0.2.105 64320 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:25:01.845838 0.000000 tcp 10.0.2.105 64320 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:25:07.834771 2.994250 tcp 10.0.2.105 64321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:25:16.827519 0.000000 tcp 10.0.2.105 64321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:25:21.344011 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:25:22.836467 2.994123 tcp 10.0.2.105 64322 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:25:31.829064 0.000000 tcp 10.0.2.105 64322 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:29:05.058525 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:29:12.067330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:29:20.067101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:29:36.070701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:30:08.080930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:30:37.839551 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:30:37.839789 3.003661 tcp 10.0.2.105 64323 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:30:46.841925 0.000000 tcp 10.0.2.105 64323 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:30:52.842079 0.030478 tcp 10.0.2.105 64324 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:30:52.872786 0.061572 tcp 10.0.2.105 64325 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:30:52.934623 0.150017 tcp 10.0.2.105 64326 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:30:53.097908 3.007474 tcp 10.0.2.105 64327 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:02.103920 0.000000 tcp 10.0.2.105 64327 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:08.093389 0.052225 tcp 10.0.2.105 64328 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:08.145880 0.062376 tcp 10.0.2.105 64329 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:08.208584 0.156921 tcp 10.0.2.105 64330 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:08.403389 3.003805 tcp 10.0.2.105 64331 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:17.416102 0.000000 tcp 10.0.2.105 64331 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:23.394760 0.029772 tcp 10.0.2.105 64332 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:23.424832 0.106864 tcp 10.0.2.105 64333 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:23.531961 0.147733 tcp 10.0.2.105 64334 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:31:23.719584 2.999895 tcp 10.0.2.105 64335 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:32.721465 0.000000 tcp 10.0.2.105 64335 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:38.720700 2.990266 tcp 10.0.2.105 64336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:47.709764 0.000000 tcp 10.0.2.105 64336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:31:52.338662 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:31:53.721393 3.003157 tcp 10.0.2.105 64337 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:32:02.727722 0.000000 tcp 10.0.2.105 64337 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:36:12.081696 3.002353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:36:19.089931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:36:27.090928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:36:43.094247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:37:15.100477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:41:27.984327 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:41:27.984417 0.045185 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.014844 0.088518 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.274657 0.097154 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.565591 0.102972 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.653513 0.060907 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.735982 0.293685 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:28.993630 0.171784 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.158396 0.075754 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.311997 0.228307 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.541602 0.124788 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.629786 0.177007 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.783383 0.214756 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:29.919042 0.132299 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.021929 0.174635 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.194198 0.080278 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.294398 0.228934 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.515769 0.052100 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.562599 0.215062 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:30.769032 0.346747 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:31.192758 0.171278 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:31.562995 0.267341 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:31.777454 0.094596 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:32.099773 0.246389 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:32.344566 0.112718 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:32.417975 0.299062 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:32.707394 0.087645 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:32.774876 0.400126 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/05 19:41:38.750035 3.003600 tcp 10.0.2.105 64338 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:41:47.752682 0.000000 tcp 10.0.2.105 64338 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:41:52.340790 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:41:53.752939 0.053835 tcp 10.0.2.105 64339 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:41:53.807077 0.064134 tcp 10.0.2.105 64340 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:41:53.871530 0.153409 tcp 10.0.2.105 64341 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:41:54.039115 3.006473 tcp 10.0.2.105 64342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:03.044124 0.000000 tcp 10.0.2.105 64342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:09.033539 0.033537 tcp 10.0.2.105 64343 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:09.067373 0.066783 tcp 10.0.2.105 64344 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:09.134434 0.151293 tcp 10.0.2.105 64345 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:09.603389 2.994797 tcp 10.0.2.105 64346 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:18.606509 0.000000 tcp 10.0.2.105 64346 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:24.596010 0.029931 tcp 10.0.2.105 64347 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:24.626245 0.062265 tcp 10.0.2.105 64348 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:24.688747 0.157354 tcp 10.0.2.105 64349 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:42:24.878867 3.001035 tcp 10.0.2.105 64350 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:33.878535 0.000000 tcp 10.0.2.105 64350 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:39.877424 3.004287 tcp 10.0.2.105 64351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:48.880364 0.000000 tcp 10.0.2.105 64351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:42:53.837265 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:42:54.878995 3.004231 tcp 10.0.2.105 64352 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:43:03.881795 0.000000 tcp 10.0.2.105 64352 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:43:19.106022 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:43:26.114764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:43:34.115278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:43:50.118189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:44:22.124163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:48:09.882422 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:48:09.882535 3.003513 tcp 10.0.2.105 64353 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:18.884762 0.000000 tcp 10.0.2.105 64353 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:24.885145 0.031019 tcp 10.0.2.105 64354 -> 195.113.214.221 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:24.916589 0.161225 tcp 10.0.2.105 64355 -> 195.113.214.251 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:25.078152 0.151604 tcp 10.0.2.105 64356 -> 195.113.214.251 443 SRPA* 0 0 20 11284 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:25.327055 2.968518 tcp 10.0.2.105 64357 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:34.253602 0.000000 tcp 10.0.2.105 64357 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:40.236162 0.030573 tcp 10.0.2.105 64358 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:40.267011 0.065163 tcp 10.0.2.105 64359 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:40.332521 0.151986 tcp 10.0.2.105 64360 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:40.599462 3.000895 tcp 10.0.2.105 64361 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:49.599053 0.000000 tcp 10.0.2.105 64361 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:48:55.598050 0.051909 tcp 10.0.2.105 64362 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:55.650246 0.061564 tcp 10.0.2.105 64363 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:55.712127 0.156817 tcp 10.0.2.105 64364 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:48:55.983847 3.001042 tcp 10.0.2.105 64365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:49:04.980645 0.000000 tcp 10.0.2.105 64365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:49:10.979749 3.004259 tcp 10.0.2.105 64366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:49:19.982677 0.000000 tcp 10.0.2.105 64366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:49:24.839500 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:49:25.981328 3.003935 tcp 10.0.2.105 64367 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:49:34.983978 0.000000 tcp 10.0.2.105 64367 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:54:08.139276 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 19:54:15.147086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:54:23.147861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:54:39.151678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:54:40.984684 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:54:40.984824 2.993324 tcp 10.0.2.105 64368 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:54:49.987095 0.000000 tcp 10.0.2.105 64368 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:54:55.987215 0.031066 tcp 10.0.2.105 64369 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:54:56.018505 0.061582 tcp 10.0.2.105 64370 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:54:56.080491 0.157810 tcp 10.0.2.105 64371 -> 195.113.214.251 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:54:56.269594 3.000335 tcp 10.0.2.105 64372 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:05.269476 0.000000 tcp 10.0.2.105 64372 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:11.157072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 19:55:11.267763 0.030155 tcp 10.0.2.105 64373 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:11.298155 0.062386 tcp 10.0.2.105 64374 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:11.360796 0.150374 tcp 10.0.2.105 64375 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:11.735439 2.997167 tcp 10.0.2.105 64376 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:20.731098 0.000000 tcp 10.0.2.105 64376 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:26.730590 0.052074 tcp 10.0.2.105 64377 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:26.782502 0.062847 tcp 10.0.2.105 64378 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:26.845600 0.153440 tcp 10.0.2.105 64379 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 19:55:27.009744 3.004955 tcp 10.0.2.105 64380 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:36.013285 0.000000 tcp 10.0.2.105 64380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:42.001929 3.004291 tcp 10.0.2.105 64381 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:51.004934 0.000000 tcp 10.0.2.105 64381 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:55:55.841806 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 19:55:57.004072 2.993773 tcp 10.0.2.105 64382 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 19:56:06.006392 0.000000 tcp 10.0.2.105 64382 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:12.007565 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:01:12.007669 3.002506 tcp 10.0.2.105 64383 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:15.163025 3.002033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:01:21.009051 0.000000 tcp 10.0.2.105 64383 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:22.170978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:01:27.009536 0.032626 tcp 10.0.2.105 64384 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:27.042510 0.060978 tcp 10.0.2.105 64385 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:27.103872 0.152675 tcp 10.0.2.105 64386 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:27.276570 2.995966 tcp 10.0.2.105 64387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:30.172457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:01:36.270951 0.000000 tcp 10.0.2.105 64387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:42.270531 0.029916 tcp 10.0.2.105 64388 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:42.300685 0.060923 tcp 10.0.2.105 64389 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:42.361880 0.161160 tcp 10.0.2.105 64390 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:42.540116 3.004007 tcp 10.0.2.105 64391 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:46.175492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:01:51.542977 0.000000 tcp 10.0.2.105 64391 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:01:57.532464 0.030227 tcp 10.0.2.105 64392 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:57.563003 0.061771 tcp 10.0.2.105 64393 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:57.625091 0.181236 tcp 10.0.2.105 64394 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:01:57.878994 3.007465 tcp 10.0.2.105 64395 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:02:06.885022 0.000000 tcp 10.0.2.105 64395 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:02:12.873826 2.994211 tcp 10.0.2.105 64396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:02:18.180993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:02:21.876753 0.000000 tcp 10.0.2.105 64396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:02:26.843896 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:02:27.875477 2.994329 tcp 10.0.2.105 64397 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:02:36.868170 0.000000 tcp 10.0.2.105 64397 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:08:22.189513 3.004265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 20:08:29.194882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:08:37.284407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:08:53.209254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:09:25.215602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:11:37.465934 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:11:37.466074 0.282368 udp 10.0.2.105 7010 <-> 79.219.98.97 2430 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:37.498127 0.250376 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:38.025012 0.060840 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:38.084460 0.257486 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2642 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:38.302615 0.174317 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:38.469170 0.069499 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:38.629989 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 20:11:42.903965 3.003707 tcp 10.0.2.105 64398 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:11:51.916612 0.000000 tcp 10.0.2.105 64398 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:11:55.072141 0.031238 tcp 10.0.2.105 64399 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:55.103607 0.071649 tcp 10.0.2.105 64400 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:55.175515 0.151727 tcp 10.0.2.105 64401 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:55.327762 0.103432 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:55.414684 0.189745 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:55.619169 0.164805 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:55.745825 0.180632 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:55.900875 0.177999 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:56.048524 0.169308 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:56.264390 0.173305 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:56.434797 0.082104 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:56.704480 0.214607 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:56.911968 0.491989 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:57.632919 0.227453 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:57.852092 0.059702 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:57.905332 0.052960 tcp 10.0.2.105 64402 -> 195.113.214.221 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:57.958539 0.073774 tcp 10.0.2.105 64403 -> 195.113.214.251 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:58.032652 0.208248 tcp 10.0.2.105 64404 -> 195.113.214.251 443 SRPA* 0 0 45 41857 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:11:58.101832 0.184144 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:58.385012 2.994944 tcp 10.0.2.105 64405 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:11:58.404625 0.259411 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:58.613170 0.095847 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:58.727021 0.245460 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:58.970660 0.088202 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:59.148638 0.397743 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:59.525873 0.108860 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:11:59.599618 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 20:12:07.377992 0.000000 tcp 10.0.2.105 64405 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:12:13.387918 0.030911 tcp 10.0.2.105 64406 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:13.419120 0.070211 tcp 10.0.2.105 64407 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:13.489690 0.155172 tcp 10.0.2.105 64408 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:13.794554 2.997427 tcp 10.0.2.105 64409 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:12:15.991037 0.052490 tcp 10.0.2.105 64410 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:16.043818 0.074641 tcp 10.0.2.105 64411 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:16.118742 0.154100 tcp 10.0.2.105 64412 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:12:22.790835 0.000000 tcp 10.0.2.105 64409 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:12:28.789022 3.004504 tcp 10.0.2.105 64413 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:12:37.792381 0.000000 tcp 10.0.2.105 64413 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:12:42.338821 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:15:34.229016 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:15:41.235972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:15:49.237568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:16:05.240042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:16:37.247485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:17:43.793238 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:17:43.793434 3.002977 tcp 10.0.2.105 64414 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:17:52.794957 0.000000 tcp 10.0.2.105 64414 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:17:58.795259 0.052294 tcp 10.0.2.105 64415 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:17:58.847865 0.072985 tcp 10.0.2.105 64416 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:17:58.921131 0.159598 tcp 10.0.2.105 64417 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:17:59.114472 2.993454 tcp 10.0.2.105 64418 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:08.107299 0.000000 tcp 10.0.2.105 64418 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:14.116099 0.051965 tcp 10.0.2.105 64419 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:14.168334 0.075311 tcp 10.0.2.105 64420 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:14.243831 0.158091 tcp 10.0.2.105 64421 -> 195.113.214.251 443 SRPA* 0 0 26 13536 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:14.454378 2.996357 tcp 10.0.2.105 64422 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:23.449318 0.000000 tcp 10.0.2.105 64422 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:29.448563 0.051193 tcp 10.0.2.105 64423 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:29.500001 0.069616 tcp 10.0.2.105 64424 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:29.569866 0.155800 tcp 10.0.2.105 64425 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:18:29.859504 3.003735 tcp 10.0.2.105 64426 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:38.861574 0.000000 tcp 10.0.2.105 64426 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:44.859839 3.004327 tcp 10.0.2.105 64427 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:53.863040 0.000000 tcp 10.0.2.105 64427 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:18:58.840145 0.000208 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:18:59.861929 3.003946 tcp 10.0.2.105 64428 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:19:08.864557 0.000000 tcp 10.0.2.105 64428 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:22:41.252202 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:22:48.259503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:22:56.261954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:23:12.264283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:23:44.270030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:24:14.864928 0.042892 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:24:14.907957 2.962747 tcp 10.0.2.105 64429 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:24:23.867509 0.000000 tcp 10.0.2.105 64429 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:24:29.877856 0.053442 tcp 10.0.2.105 64430 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:29.931604 0.069850 tcp 10.0.2.105 64431 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:30.001856 0.159172 tcp 10.0.2.105 64432 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:30.230284 2.990770 tcp 10.0.2.105 64433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:24:39.219207 0.000000 tcp 10.0.2.105 64433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:24:45.228559 0.053177 tcp 10.0.2.105 64434 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:45.282040 0.074908 tcp 10.0.2.105 64435 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:45.357249 0.152375 tcp 10.0.2.105 64436 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:24:45.557259 3.005564 tcp 10.0.2.105 64437 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:24:54.561657 0.000000 tcp 10.0.2.105 64437 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:00.550660 0.030768 tcp 10.0.2.105 64438 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:25:00.581233 0.073936 tcp 10.0.2.105 64439 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:25:00.655494 0.155302 tcp 10.0.2.105 64440 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:25:00.845499 2.999409 tcp 10.0.2.105 64441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:09.843497 0.000000 tcp 10.0.2.105 64441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:15.842231 3.004262 tcp 10.0.2.105 64442 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:24.845134 0.000000 tcp 10.0.2.105 64442 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:29.842186 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:25:30.843897 2.994058 tcp 10.0.2.105 64443 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:25:39.846794 0.000000 tcp 10.0.2.105 64443 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:29:48.276703 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:29:55.283844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:30:03.285537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:30:19.288627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:30:45.847247 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:30:45.847341 3.003332 tcp 10.0.2.105 64444 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:30:51.294698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:30:54.854856 0.000000 tcp 10.0.2.105 64444 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:00.850906 0.052904 tcp 10.0.2.105 64445 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:00.904124 0.074605 tcp 10.0.2.105 64446 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:00.979018 0.158111 tcp 10.0.2.105 64447 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:01.423185 3.000294 tcp 10.0.2.105 64448 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:10.422106 0.000000 tcp 10.0.2.105 64448 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:16.421466 0.052530 tcp 10.0.2.105 64449 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:16.474249 0.080071 tcp 10.0.2.105 64450 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:16.554647 0.159044 tcp 10.0.2.105 64451 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:16.767788 3.007336 tcp 10.0.2.105 64452 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:25.773968 0.000000 tcp 10.0.2.105 64452 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:31.763490 0.052667 tcp 10.0.2.105 64453 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:31.816583 0.073823 tcp 10.0.2.105 64454 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:31.890662 0.154082 tcp 10.0.2.105 64455 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:31:32.108960 3.008569 tcp 10.0.2.105 64456 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:41.126048 0.000000 tcp 10.0.2.105 64456 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:47.104886 2.993931 tcp 10.0.2.105 64457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:31:56.107192 0.000000 tcp 10.0.2.105 64457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:32:00.834113 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:32:02.106484 2.994433 tcp 10.0.2.105 64458 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:32:11.100235 0.000000 tcp 10.0.2.105 64458 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:36:55.300143 3.002884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:37:02.307967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:37:10.324564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:37:17.109807 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:37:17.109896 3.003003 tcp 10.0.2.105 64459 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:26.112314 0.000000 tcp 10.0.2.105 64459 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:26.322565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:37:32.111659 0.127871 tcp 10.0.2.105 64460 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:32.239910 0.074601 tcp 10.0.2.105 64461 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:32.314811 0.151391 tcp 10.0.2.105 64462 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:32.575148 2.985719 tcp 10.0.2.105 64463 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:41.519200 0.000000 tcp 10.0.2.105 64463 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:47.514224 0.051457 tcp 10.0.2.105 64464 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:47.565959 0.074449 tcp 10.0.2.105 64465 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:47.640702 0.149265 tcp 10.0.2.105 64466 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:37:47.994568 2.993366 tcp 10.0.2.105 64467 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:56.996578 0.000000 tcp 10.0.2.105 64467 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:37:58.328984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:38:02.995675 2.993799 tcp 10.0.2.105 64468 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:38:11.987999 0.000000 tcp 10.0.2.105 64468 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:38:16.834832 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:42:28.316942 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:42:28.317030 0.099959 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:42:28.395823 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 20:42:46.063764 0.055114 tcp 10.0.2.105 64469 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:42:46.119151 0.073366 tcp 10.0.2.105 64470 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:42:46.192825 0.153652 tcp 10.0.2.105 64471 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:42:46.347157 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 20:43:03.638399 0.062031 tcp 10.0.2.105 64472 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:03.700141 0.073769 tcp 10.0.2.105 64473 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:03.774265 0.155018 tcp 10.0.2.105 64474 -> 195.113.214.251 443 SRPA* 0 0 20 11286 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:03.929843 0.256464 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.151659 0.173267 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.316330 0.073248 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.391865 0.061896 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.509202 0.081151 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.574464 0.095539 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.653566 0.196934 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.868939 0.202168 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:04.999144 0.265446 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 4 1465 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.244394 0.181438 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.440413 0.123972 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.524917 0.173583 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.695201 0.212783 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.900690 0.078589 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:05.963498 0.228305 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:06.184510 0.662083 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:06.864399 0.998545 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 4 1733 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:17.998285 3.004296 tcp 10.0.2.105 64475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:43:22.986230 0.052098 tcp 10.0.2.105 64476 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:23.038222 0.073637 tcp 10.0.2.105 64477 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:23.112127 0.154486 tcp 10.0.2.105 64478 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:23.267131 0.193598 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:23.647923 0.052109 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:23.732915 0.094135 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:23.809613 0.242357 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:24.066740 0.083933 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:24.131883 0.398742 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:24.512331 0.110935 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/05 20:43:27.000853 0.000000 tcp 10.0.2.105 64475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:43:32.999634 0.053333 tcp 10.0.2.105 64479 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:33.053226 0.066723 tcp 10.0.2.105 64480 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:33.120281 0.159942 tcp 10.0.2.105 64481 -> 195.113.214.251 443 SRPA* 0 0 57 36348 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:33.305199 2.999222 tcp 10.0.2.105 64482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:43:42.302978 0.000000 tcp 10.0.2.105 64482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:43:48.305122 0.051176 tcp 10.0.2.105 64483 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:48.356609 0.074665 tcp 10.0.2.105 64484 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:48.431541 0.152060 tcp 10.0.2.105 64485 -> 195.113.214.251 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:43:48.698885 3.010558 tcp 10.0.2.105 64486 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:43:57.705196 0.000000 tcp 10.0.2.105 64486 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:02.334778 3.001409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:44:03.694288 0.051864 tcp 10.0.2.105 64487 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:44:03.746492 0.074380 tcp 10.0.2.105 64488 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:44:03.821125 0.158908 tcp 10.0.2.105 64489 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:44:04.016068 2.992073 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:09.341953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:44:13.016712 0.000000 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:17.343007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:44:19.015371 2.994659 tcp 10.0.2.105 64491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:28.008814 0.000000 tcp 10.0.2.105 64491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:32.835613 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:44:33.346637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:44:34.017338 3.004382 tcp 10.0.2.105 64492 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:44:43.020165 0.000000 tcp 10.0.2.105 64492 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:45:05.352726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:49:49.024951 0.000252 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:49:49.025326 2.999359 tcp 10.0.2.105 64493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:49:58.023364 0.000000 tcp 10.0.2.105 64493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:04.023304 0.053439 tcp 10.0.2.105 64494 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:04.076995 0.071676 tcp 10.0.2.105 64495 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:04.148957 0.155669 tcp 10.0.2.105 64496 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:04.463093 3.003608 tcp 10.0.2.105 64497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:13.465506 0.000000 tcp 10.0.2.105 64497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:19.464918 0.051586 tcp 10.0.2.105 64498 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:19.516757 0.073047 tcp 10.0.2.105 64499 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:19.590130 0.156858 tcp 10.0.2.105 64500 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:19.875427 2.993629 tcp 10.0.2.105 64501 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:28.867523 0.000000 tcp 10.0.2.105 64501 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:34.876986 0.053332 tcp 10.0.2.105 64502 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:34.930596 0.070039 tcp 10.0.2.105 64503 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:35.000900 0.150769 tcp 10.0.2.105 64504 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:50:35.213602 2.996979 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:44.209416 0.000000 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:50.207825 3.007337 tcp 10.0.2.105 64506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:50:59.211145 0.000000 tcp 10.0.2.105 64506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:51:03.837386 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:51:05.209880 3.004038 tcp 10.0.2.105 64507 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:51:14.212871 0.000000 tcp 10.0.2.105 64507 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:54:30.367575 3.001996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 20:54:37.375334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:54:45.376487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:55:01.379344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:55:33.385850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 20:56:20.213591 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:56:20.213791 3.003297 tcp 10.0.2.105 64508 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:56:29.215501 0.000000 tcp 10.0.2.105 64508 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:56:35.216190 0.031652 tcp 10.0.2.105 64509 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:35.248120 0.074941 tcp 10.0.2.105 64510 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:35.323343 0.149367 tcp 10.0.2.105 64511 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:35.593865 2.995393 tcp 10.0.2.105 64512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:56:44.587823 0.000000 tcp 10.0.2.105 64512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:56:50.587397 0.052105 tcp 10.0.2.105 64513 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:50.639770 0.074832 tcp 10.0.2.105 64514 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:50.714886 0.162941 tcp 10.0.2.105 64515 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:56:50.894915 2.996200 tcp 10.0.2.105 64516 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:56:59.889692 0.000000 tcp 10.0.2.105 64516 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:05.889404 0.052671 tcp 10.0.2.105 64517 -> 195.113.214.221 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:57:05.942356 0.076213 tcp 10.0.2.105 64518 -> 195.113.214.251 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:57:06.018929 0.158503 tcp 10.0.2.105 64519 -> 195.113.214.251 443 SRPA* 0 0 22 13123 flow=From-Botnet-V2-TCP-Established 1970/02/05 20:57:06.233708 2.999405 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:15.231668 0.000000 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:21.230866 3.003297 tcp 10.0.2.105 64521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:30.233554 0.000000 tcp 10.0.2.105 64521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:34.839582 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 20:57:36.232636 3.003287 tcp 10.0.2.105 64522 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 20:57:45.234901 0.000000 tcp 10.0.2.105 64522 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:01:37.391280 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:01:44.398776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:01:52.400364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:02:08.403301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:02:40.409814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:02:51.235544 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:02:51.235769 2.993492 tcp 10.0.2.105 64523 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:03:00.227349 0.000000 tcp 10.0.2.105 64523 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:03:06.237799 0.053765 tcp 10.0.2.105 64524 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:06.291917 0.066625 tcp 10.0.2.105 64525 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:06.358894 0.158355 tcp 10.0.2.105 64526 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:06.550637 3.000726 tcp 10.0.2.105 64527 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:03:15.550041 0.000000 tcp 10.0.2.105 64527 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:03:21.549371 0.030261 tcp 10.0.2.105 64528 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:21.579963 0.075539 tcp 10.0.2.105 64529 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:21.655784 0.152127 tcp 10.0.2.105 64530 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:03:21.833453 0.634321 tcp 10.0.2.105 64531 -> 31.192.27.210 7758 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:08:44.415721 3.162326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:08:51.543208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:08:59.469532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:09:15.437486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:09:47.443286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:13:45.245693 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:13:45.277163 0.000000 udp 10.0.2.105 7010 -> 79.219.98.97 2430 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 21:14:03.182754 0.055122 tcp 10.0.2.105 64532 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:03.238158 0.196773 tcp 10.0.2.105 64533 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:03.435282 0.157547 tcp 10.0.2.105 64534 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:03.593862 0.247861 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:03.797513 0.109777 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:04.005800 0.613669 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:04.582006 0.173922 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:04.892043 0.442756 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:05.317286 0.099829 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:05.590623 0.198347 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:05.782963 0.083683 udp 10.0.2.105 7010 <-> 31.52.60.84 4672 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.059198 0.067445 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.125338 0.154524 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.381946 0.155593 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.487737 0.175400 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.660371 0.216277 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:06.866969 0.083753 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:07.001152 0.229245 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:07.222813 0.126573 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:07.334482 0.180926 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:07.628302 0.470606 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:08.387732 0.097544 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:08.467942 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 21:14:23.530868 0.103004 tcp 10.0.2.105 64535 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:23.634156 0.072534 tcp 10.0.2.105 64536 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:23.706948 0.151909 tcp 10.0.2.105 64537 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:14:23.859358 0.125563 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:24.186651 0.184490 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:24.975679 0.053082 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:25.250326 0.398575 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:14:25.627598 0.165489 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:15:53.453792 3.000247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:16:00.459614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:16:08.462955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:16:24.463744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:16:56.479955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:23:00.486476 3.012149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 21:23:07.503648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:23:15.505089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:23:31.508121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:24:03.514223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:30:07.521385 3.000554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 21:30:14.527604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:30:22.529409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:30:38.532857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:31:10.538298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:33:22.467991 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:33:22.468128 3.003743 tcp 10.0.2.105 64538 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:33:31.470673 0.000000 tcp 10.0.2.105 64538 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:33:37.471624 0.052081 tcp 10.0.2.105 64539 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:37.524006 0.075457 tcp 10.0.2.105 64540 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:37.599866 0.157629 tcp 10.0.2.105 64541 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:38.041062 3.003540 tcp 10.0.2.105 64542 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:33:47.043035 0.000000 tcp 10.0.2.105 64542 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:33:53.042430 0.052569 tcp 10.0.2.105 64543 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:53.095316 0.075283 tcp 10.0.2.105 64544 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:53.170854 0.149254 tcp 10.0.2.105 64545 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:33:53.366210 3.000327 tcp 10.0.2.105 64546 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:02.365357 0.000000 tcp 10.0.2.105 64546 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:08.364612 0.052011 tcp 10.0.2.105 64547 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:34:08.416934 0.071242 tcp 10.0.2.105 64548 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:34:08.488711 0.152943 tcp 10.0.2.105 64549 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:34:08.690236 2.998451 tcp 10.0.2.105 64550 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:17.697239 0.000000 tcp 10.0.2.105 64550 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:23.685619 2.994806 tcp 10.0.2.105 64551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:32.678517 0.000000 tcp 10.0.2.105 64551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:37.335400 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:34:38.687509 3.004403 tcp 10.0.2.105 64552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:34:47.690520 0.000000 tcp 10.0.2.105 64552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:37:14.544257 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:37:21.551499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:37:29.553182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:37:45.556357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:38:17.562055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:39:53.691813 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:39:53.691944 3.004013 tcp 10.0.2.105 64553 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:02.694326 0.000000 tcp 10.0.2.105 64553 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:08.694413 0.053345 tcp 10.0.2.105 64554 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:08.748037 0.071877 tcp 10.0.2.105 64555 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:08.820279 0.158976 tcp 10.0.2.105 64556 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:09.050696 3.000763 tcp 10.0.2.105 64557 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:18.050817 0.000000 tcp 10.0.2.105 64557 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:24.044523 0.058557 tcp 10.0.2.105 64558 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:24.103442 0.072955 tcp 10.0.2.105 64559 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:24.176801 0.154747 tcp 10.0.2.105 64560 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:24.382788 2.996096 tcp 10.0.2.105 64561 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:33.402728 0.000000 tcp 10.0.2.105 64561 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:39.376523 0.051556 tcp 10.0.2.105 64562 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:39.428358 0.072057 tcp 10.0.2.105 64563 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:39.500731 0.151042 tcp 10.0.2.105 64564 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:40:39.999155 3.002053 tcp 10.0.2.105 64565 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:48.999786 0.000000 tcp 10.0.2.105 64565 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:40:54.998629 3.006545 tcp 10.0.2.105 64566 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:41:04.001370 0.000000 tcp 10.0.2.105 64566 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:41:08.838146 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:41:10.000379 3.004045 tcp 10.0.2.105 64567 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:41:19.003160 0.000000 tcp 10.0.2.105 64567 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:44:21.568124 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:44:26.452889 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:44:26.453082 0.241807 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:26.693116 0.255665 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:26.915372 0.254149 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.119243 0.136138 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 5 2024 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.248606 0.174212 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.414760 0.075588 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.534511 0.107092 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.625501 0.063999 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:27.740635 0.000000 udp 10.0.2.105 7010 -> 31.52.60.84 4672 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 21:44:28.579343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:44:36.577180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:44:43.118229 0.053564 tcp 10.0.2.105 64568 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:44:43.172121 0.073800 tcp 10.0.2.105 64569 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:44:43.246204 0.149311 tcp 10.0.2.105 64570 -> 195.113.214.251 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:44:43.396049 0.206969 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:43.596460 0.186766 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:43.725918 0.175063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:43.896136 0.141532 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:43.996599 0.122931 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:44.082589 0.177180 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:44.235838 0.082115 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2012 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:44.342367 0.217019 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:44.551752 0.226565 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:44.771507 1.082709 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:45.905496 0.097342 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:45.982781 0.086074 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:46.168171 0.187766 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:46.360547 0.053571 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:46.408721 0.395823 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:46.784924 0.110702 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/05 21:44:52.579804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:45:24.586105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:46:25.003249 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:46:25.003435 3.003326 tcp 10.0.2.105 64571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:46:34.015790 0.000000 tcp 10.0.2.105 64571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:46:40.006312 0.051358 tcp 10.0.2.105 64572 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:40.057993 0.074810 tcp 10.0.2.105 64573 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:40.133070 0.154811 tcp 10.0.2.105 64574 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:40.385582 2.993598 tcp 10.0.2.105 64575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:46:49.377859 0.000000 tcp 10.0.2.105 64575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:46:55.387434 0.052965 tcp 10.0.2.105 64576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:55.440653 0.076268 tcp 10.0.2.105 64577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:55.516779 0.154611 tcp 10.0.2.105 64578 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:46:55.823765 2.997788 tcp 10.0.2.105 64579 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:04.820046 0.000000 tcp 10.0.2.105 64579 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:10.819226 0.051921 tcp 10.0.2.105 64580 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:47:10.871476 0.075525 tcp 10.0.2.105 64581 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:47:10.947330 0.174771 tcp 10.0.2.105 64582 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:47:11.161911 3.001530 tcp 10.0.2.105 64583 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:20.162273 0.000000 tcp 10.0.2.105 64583 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:26.161002 3.004108 tcp 10.0.2.105 64584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:35.163858 0.000000 tcp 10.0.2.105 64584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:39.840487 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:47:41.162547 3.004533 tcp 10.0.2.105 64585 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:47:50.165220 0.000000 tcp 10.0.2.105 64585 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:52:56.165959 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:52:56.166165 2.993559 tcp 10.0.2.105 64586 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:05.158860 0.000000 tcp 10.0.2.105 64586 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:11.168504 0.051582 tcp 10.0.2.105 64587 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:11.220350 0.071693 tcp 10.0.2.105 64588 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:11.292422 0.154900 tcp 10.0.2.105 64589 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:11.474824 2.996848 tcp 10.0.2.105 64590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:20.470159 0.000000 tcp 10.0.2.105 64590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:26.469423 0.051952 tcp 10.0.2.105 64591 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:26.521627 0.070047 tcp 10.0.2.105 64592 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:26.591967 0.151986 tcp 10.0.2.105 64593 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:26.778003 3.005473 tcp 10.0.2.105 64594 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:35.782538 0.000000 tcp 10.0.2.105 64594 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:41.771602 0.051508 tcp 10.0.2.105 64595 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:41.823412 0.070352 tcp 10.0.2.105 64596 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:41.894015 0.159437 tcp 10.0.2.105 64597 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:53:42.066896 2.998820 tcp 10.0.2.105 64598 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:51.064491 0.000000 tcp 10.0.2.105 64598 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:53:57.063457 3.003668 tcp 10.0.2.105 64599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:54:06.075983 0.000000 tcp 10.0.2.105 64599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:54:10.842636 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:54:12.064716 2.994305 tcp 10.0.2.105 64600 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:54:21.067013 0.000000 tcp 10.0.2.105 64600 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:54:41.599378 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 21:54:48.607322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:54:56.608725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:55:12.617834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:55:44.617565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 21:59:27.067689 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 21:59:27.067843 3.003964 tcp 10.0.2.105 64601 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:59:36.069687 0.000000 tcp 10.0.2.105 64601 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:59:42.074094 0.052687 tcp 10.0.2.105 64602 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:42.127115 0.074522 tcp 10.0.2.105 64603 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:42.201982 0.160138 tcp 10.0.2.105 64604 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:42.466998 2.996653 tcp 10.0.2.105 64605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:59:51.462586 0.000000 tcp 10.0.2.105 64605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 21:59:57.461717 0.052371 tcp 10.0.2.105 64606 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:57.514346 0.070113 tcp 10.0.2.105 64607 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:57.584763 0.160085 tcp 10.0.2.105 64608 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 21:59:57.879441 3.006407 tcp 10.0.2.105 64609 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:06.884525 0.000000 tcp 10.0.2.105 64609 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:12.873761 0.052776 tcp 10.0.2.105 64610 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:00:12.926822 0.076826 tcp 10.0.2.105 64611 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:00:13.004008 0.155852 tcp 10.0.2.105 64612 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:00:13.294106 2.996517 tcp 10.0.2.105 64613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:22.296727 0.000000 tcp 10.0.2.105 64613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:28.295645 2.993915 tcp 10.0.2.105 64614 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:37.288051 0.000000 tcp 10.0.2.105 64614 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:41.834965 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:00:43.297484 3.004180 tcp 10.0.2.105 64615 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:00:52.299872 0.000000 tcp 10.0.2.105 64615 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:01:48.623907 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:01:55.631043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:02:03.632690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:02:19.635655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:02:51.641790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:05:58.303420 0.082639 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:05:58.386269 2.969837 tcp 10.0.2.105 64616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:07.306778 0.000000 tcp 10.0.2.105 64616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:13.316998 0.259830 tcp 10.0.2.105 64617 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:13.577048 0.076322 tcp 10.0.2.105 64618 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:13.653638 0.151766 tcp 10.0.2.105 64619 -> 195.113.214.251 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:14.346501 2.991583 tcp 10.0.2.105 64620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:23.345893 0.000000 tcp 10.0.2.105 64620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:29.335229 0.051773 tcp 10.0.2.105 64621 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:29.387286 0.076850 tcp 10.0.2.105 64622 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:29.464596 0.168398 tcp 10.0.2.105 64623 -> 195.113.214.251 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:29.773624 2.995762 tcp 10.0.2.105 64624 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:38.768145 0.000000 tcp 10.0.2.105 64624 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:44.766942 0.052221 tcp 10.0.2.105 64625 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:44.819398 0.071255 tcp 10.0.2.105 64626 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:44.890946 0.161492 tcp 10.0.2.105 64627 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:06:45.294251 2.997781 tcp 10.0.2.105 64628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:06:54.290167 0.000000 tcp 10.0.2.105 64628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:07:00.289300 3.003862 tcp 10.0.2.105 64629 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:07:09.291905 0.000000 tcp 10.0.2.105 64629 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:07:13.838494 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:07:15.290324 3.004248 tcp 10.0.2.105 64630 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:07:24.293384 0.000000 tcp 10.0.2.105 64630 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:08:56.649485 3.001009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:09:03.656271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:09:11.657880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:09:27.660721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:09:59.667460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:15:01.541441 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:15:01.541748 0.000000 udp 10.0.2.105 7010 -> 31.52.60.84 4672 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:20.470176 0.054555 tcp 10.0.2.105 64631 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:20.525006 0.072579 tcp 10.0.2.105 64632 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:20.597951 0.163760 tcp 10.0.2.105 64633 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:20.762312 4.852524 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 9 3188 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:20.984915 4.235440 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 14 5452 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.248217 4.156437 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 14 5199 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.325808 4.988581 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 14 5311 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.605384 4.812297 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 14 5357 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.666692 4.913703 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 9 3396 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.832039 4.982959 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 9 3036 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.899380 4.972097 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 7 2559 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:21.976626 0.196896 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.172146 0.171089 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.285783 0.172379 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.455339 0.153341 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.568413 0.118504 udp 10.0.2.105 7010 <-> 79.33.225.176 2977 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.652453 0.172716 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.804373 0.079240 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:22.867245 0.212793 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.072183 0.229622 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.294102 0.094935 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.447839 0.097485 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.528559 0.110739 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.617290 0.176697 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.847690 0.112087 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.919949 0.054775 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:23.987785 0.397618 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:25.835474 0.035257 udp 10.0.2.105 7010 <- 200.84.7.244 8376 RSP 0 0 5 1958 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:26.743453 0.008252 udp 10.0.2.105 7010 <- 99.135.106.151 4296 RSP 0 0 5 2323 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:26.871030 0.016071 udp 10.0.2.105 7010 <- 109.158.58.127 4349 RSP 0 0 5 2163 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:26.947605 0.092197 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 7 2741 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:27.024285 0.392747 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 8 2906 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:27.493280 0.290680 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 8 2913 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:27.730216 0.327807 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2969 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:28.055433 0.269596 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 8 3105 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:28.285306 0.000000 udp 10.0.2.105 7010 -> 79.33.225.176 2977 REQ 0 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:30.358224 2.984775 tcp 10.0.2.105 64634 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:15:34.666171 0.312956 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 2955 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:34.956789 0.174571 udp 10.0.2.105 7010 <-> 86.184.78.9 7427 CON 0 0 8 3083 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:35.115424 0.417575 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3020 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:35.522707 0.444636 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 2992 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:35.960240 0.233115 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 8 3242 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:36.175448 0.138495 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 2917 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:36.292999 0.318870 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 8 3121 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:36.586912 0.166403 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 8 2913 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:36.717320 0.111454 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 2824 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:36.840835 0.784368 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 8 2886 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:37.604643 1.803055 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 8 3236 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:15:39.315315 0.000000 tcp 10.0.2.105 64634 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:15:39.392868 0.000000 udp 10.0.2.105 7010 -> 87.23.194.227 8571 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:44.342616 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:15:45.314561 0.052280 tcp 10.0.2.105 64635 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:45.367163 0.076665 tcp 10.0.2.105 64636 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:45.443812 0.154801 tcp 10.0.2.105 64637 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:15:45.609896 2.998801 tcp 10.0.2.105 64638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:15:47.997844 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:53.585856 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:15:54.607677 0.000000 tcp 10.0.2.105 64638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:00.606468 0.052334 tcp 10.0.2.105 64639 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:00.659165 0.075927 tcp 10.0.2.105 64640 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:00.735445 0.176908 tcp 10.0.2.105 64641 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:01.147855 3.003190 tcp 10.0.2.105 64642 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:01.928109 0.000000 udp 10.0.2.105 7010 -> 98.82.1.161 8339 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:03.673778 3.001027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:16:07.045628 1.249883 udp 10.0.2.105 7010 <-> 183.4.245.168 1890 CON 0 0 8 3127 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:16:08.280004 0.000000 udp 10.0.2.105 7010 -> 61.84.176.19 5758 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:10.149829 0.000000 tcp 10.0.2.105 64642 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:10.680756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:16:14.386098 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 9315 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:16.148241 0.052409 tcp 10.0.2.105 64643 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:16.200911 0.071769 tcp 10.0.2.105 64644 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:16.272945 0.159815 tcp 10.0.2.105 64645 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:16:16.485106 2.997952 tcp 10.0.2.105 64646 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:18.681976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:16:22.157046 0.000000 udp 10.0.2.105 7010 -> 203.121.30.167 8970 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:25.481633 0.000000 tcp 10.0.2.105 64646 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:28.295866 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:31.480803 3.023044 tcp 10.0.2.105 64647 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:34.703107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:16:34.940976 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:39.842270 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:16:40.483073 0.000000 tcp 10.0.2.105 64647 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:43.167424 0.000000 udp 10.0.2.105 7010 -> 12.229.231.253 8493 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:46.492805 3.003327 tcp 10.0.2.105 64648 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:51.469079 0.000000 udp 10.0.2.105 7010 -> 95.234.163.232 8753 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:16:55.494663 0.000000 tcp 10.0.2.105 64648 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:16:58.929590 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:03.836922 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:17:05.409597 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:06.690905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:17:13.861499 0.000000 udp 10.0.2.105 7010 -> 114.34.173.203 4228 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:21.722816 0.000000 udp 10.0.2.105 7010 -> 27.54.177.213 7309 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:30.445787 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:35.342168 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:17:35.622695 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:43.534006 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:51.765791 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:17:58.175066 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:02.841750 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:18:03.302760 0.000000 udp 10.0.2.105 7010 -> 93.33.100.210 9249 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:08.670289 0.000000 udp 10.0.2.105 7010 -> 115.252.105.164 3229 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:17.322884 0.000000 udp 10.0.2.105 7010 -> 188.36.147.143 9845 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:25.364120 0.000000 udp 10.0.2.105 7010 -> 194.255.18.49 2320 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:30.340972 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:18:31.993770 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:37.191157 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:44.421811 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:49.868957 0.000000 udp 10.0.2.105 7010 -> 81.174.235.2 1471 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:18:54.836588 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:18:55.287327 0.151382 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 8 3044 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:18:55.469834 0.000000 udp 10.0.2.105 7010 -> 82.53.15.185 2142 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:00.755139 0.000000 udp 10.0.2.105 7010 -> 113.105.189.74 9101 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:08.846828 0.000000 udp 10.0.2.105 7010 -> 115.133.202.146 6464 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:14.414977 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:19.341481 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:19:23.408011 0.000000 udp 10.0.2.105 7010 -> 82.18.65.99 9386 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:29.486313 0.000000 udp 10.0.2.105 7010 -> 175.143.33.182 5876 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:35.765526 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:41.543636 0.000000 udp 10.0.2.105 7010 -> 36.70.117.202 6594 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:46.340448 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:19:50.106068 0.000000 udp 10.0.2.105 7010 -> 182.23.41.26 9840 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:19:58.898837 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:05.818865 0.000000 udp 10.0.2.105 7010 -> 203.45.164.22 8160 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:10.335097 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:20:12.087278 0.000000 udp 10.0.2.105 7010 -> 213.182.89.178 2702 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:18.296764 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:27.199593 0.000000 udp 10.0.2.105 7010 -> 162.237.52.245 3340 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:35.000406 0.304014 udp 10.0.2.105 7010 -> 115.132.43.235 2219 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:35.304420 0.000000 icmp 115.132.43.235 0x0303 -> 10.0.2.105 0xab08 URP 192 1 158 flow=Background 1970/02/05 22:20:39.837355 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:20:40.929067 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 1628 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:49.671591 0.000000 udp 10.0.2.105 7010 -> 82.54.92.221 1675 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:20:56.170524 0.000000 udp 10.0.2.105 7010 -> 122.179.161.222 9481 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:03.441365 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1203 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:08.338539 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:21:09.770509 0.000000 udp 10.0.2.105 7010 -> 175.136.202.177 9955 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:18.382927 0.000000 udp 10.0.2.105 7010 -> 59.99.8.28 1033 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:25.212572 0.000000 udp 10.0.2.105 7010 -> 37.116.177.233 5312 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:30.430282 0.000000 udp 10.0.2.105 7010 -> 31.52.60.84 4672 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:35.338681 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:21:36.589078 0.386016 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 8 2883 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:21:37.057051 0.000000 udp 10.0.2.105 7010 -> 85.16.75.4 6188 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:42.147229 0.000000 udp 10.0.2.105 7010 -> 205.151.201.249 5850 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:50.491008 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:21:59.241311 0.462207 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:21:59.726975 0.331662 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:00.092671 0.085197 udp 10.0.2.105 7010 -> 95.198.6.187 4811 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:00.177868 0.000000 icmp 95.198.6.187 0x0303 -> 10.0.2.105 0xcb12 URP 192 1 260 flow=Background 1970/02/05 22:22:01.495106 2.993895 tcp 10.0.2.105 64649 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:03.838079 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:22:07.613747 0.000000 udp 10.0.2.105 7010 -> 180.215.216.145 1855 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:10.487551 0.000000 tcp 10.0.2.105 64649 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:14.293490 0.069941 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:14.404550 0.000000 udp 10.0.2.105 7010 -> 213.44.79.10 9925 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:16.498276 0.054392 tcp 10.0.2.105 64650 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:16.552970 0.074913 tcp 10.0.2.105 64651 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:16.628187 0.154956 tcp 10.0.2.105 64652 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:16.808902 3.002095 tcp 10.0.2.105 64653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:21.153033 0.147329 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:21.313650 0.220578 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:21.552737 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:25.809153 0.000000 tcp 10.0.2.105 64653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:27.813004 0.000000 udp 10.0.2.105 7010 -> 36.82.76.247 5035 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:31.808935 0.054821 tcp 10.0.2.105 64654 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:31.864050 0.075766 tcp 10.0.2.105 64655 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:31.940091 0.158426 tcp 10.0.2.105 64656 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:32.140890 2.095124 tcp 10.0.2.105 64657 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:33.661289 0.418670 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:33.924325 0.052444 tcp 10.0.2.105 64658 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:33.977041 0.069733 tcp 10.0.2.105 64659 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:34.047142 0.179262 tcp 10.0.2.105 64660 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:34.094083 0.000000 udp 10.0.2.105 7010 -> 75.145.210.153 1365 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:34.236228 2.999902 tcp 10.0.2.105 64661 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:42.714126 0.049476 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:42.802976 0.098815 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:42.924727 0.000000 udp 10.0.2.105 7010 -> 103.6.50.94 6502 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:43.242493 0.000000 tcp 10.0.2.105 64661 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:49.233962 0.052662 tcp 10.0.2.105 64662 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:49.286902 0.077479 tcp 10.0.2.105 64663 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:49.313742 0.376955 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 688 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:22:49.364634 0.151358 tcp 10.0.2.105 64664 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:22:49.648657 2.999470 tcp 10.0.2.105 64665 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:22:49.745051 0.000000 udp 10.0.2.105 7010 -> 57.78.192.242 5247 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:58.016215 0.000000 udp 10.0.2.105 7010 -> 86.111.68.245 1203 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:22:58.657150 0.000000 tcp 10.0.2.105 64665 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:23:04.645947 2.993681 tcp 10.0.2.105 64666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:23:06.258146 0.275333 udp 10.0.2.105 7010 <-> 124.120.192.248 8909 CON 0 0 2 711 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:23:06.647794 0.182799 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:23:06.903452 0.000000 udp 10.0.2.105 7010 -> 88.171.142.120 7299 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:10.698387 3.000026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:23:12.747558 0.137657 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:23:13.029758 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:13.638596 0.000000 tcp 10.0.2.105 64666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:23:17.333680 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:23:17.704058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:23:18.896147 0.000000 udp 10.0.2.105 7010 -> 210.186.158.75 9572 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:19.647284 1.767093 tcp 10.0.2.105 64667 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:23:21.414590 2.999312 tcp 10.0.2.105 64668 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:23:24.994760 0.000000 udp 10.0.2.105 7010 -> 112.25.176.142 1191 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:25.705556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:23:30.412718 0.000000 tcp 10.0.2.105 64668 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:23:33.727575 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:40.146926 0.214321 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:23:40.605694 0.000000 udp 10.0.2.105 7010 -> 121.54.77.87 2821 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:41.708945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:23:45.334027 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:23:47.026724 0.000000 udp 10.0.2.105 7010 -> 90.200.122.184 8793 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:23:53.626253 0.000000 udp 10.0.2.105 7010 -> 122.180.141.142 5320 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:02.308586 0.307494 udp 10.0.2.105 7010 <-> 121.184.15.98 2373 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:24:02.669845 0.137113 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:24:02.826230 0.000000 udp 10.0.2.105 7010 -> 95.240.125.163 6576 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:11.451736 0.352011 udp 10.0.2.105 7010 -> 139.130.0.70 3634 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:11.803747 0.000000 icmp 139.130.0.70 0x0303 -> 10.0.2.105 0x320e URP 192 1 267 flow=Background 1970/02/05 22:24:13.715100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:24:16.338538 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:24:16.989430 0.265840 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:24:17.317407 0.000000 udp 10.0.2.105 7010 -> 79.39.246.137 4859 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:24.680851 0.000000 udp 10.0.2.105 7010 -> 211.120.147.181 6053 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:30.479244 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:37.649701 0.000000 udp 10.0.2.105 7010 -> 79.35.178.30 1742 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:42.335859 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:24:46.562411 0.000000 udp 10.0.2.105 7010 -> 178.128.201.5 4404 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:24:52.911635 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:01.794213 0.336599 udp 10.0.2.105 7010 -> 1.2.238.70 7932 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:02.130812 0.000000 icmp 1.2.238.70 0x0303 -> 10.0.2.105 0xfc1e URP 192 1 301 flow=Background 1970/02/05 22:25:06.342777 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:25:09.976110 0.000000 udp 10.0.2.105 7010 -> 108.12.49.100 8954 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:16.445212 0.147732 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:25:16.644331 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:24.477097 0.000000 udp 10.0.2.105 7010 -> 206.255.223.192 5754 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:32.017620 0.196887 udp 10.0.2.105 7010 -> 182.65.175.254 6982 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:32.214507 0.000000 icmp 182.65.175.254 0x0303 -> 10.0.2.105 0x461b URP 192 1 312 flow=Background 1970/02/05 22:25:36.834288 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:25:40.829966 0.000000 udp 10.0.2.105 7010 -> 122.178.180.151 5001 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:49.302878 0.134675 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:25:49.462064 0.462671 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:25:49.952559 0.159735 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:25:50.138156 0.000000 udp 10.0.2.105 7010 -> 187.189.14.139 4275 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:25:56.322802 0.000000 udp 10.0.2.105 7010 -> 14.136.74.189 5856 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:00.838859 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:26:04.895079 0.241531 udp 10.0.2.105 7010 <-> 14.97.50.5 9026 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:26:05.354555 0.351787 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 734 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:26:05.724501 0.400428 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:26:06.172039 0.000000 udp 10.0.2.105 7010 -> 113.193.186.206 6627 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:14.408942 0.000000 udp 10.0.2.105 7010 -> 87.24.143.192 7339 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:20.887714 0.153571 udp 10.0.2.105 7010 -> 2.50.41.144 2474 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:21.041285 0.000000 icmp 2.50.41.144 0x0303 -> 10.0.2.105 0xaa09 URP 192 1 179 flow=Background 1970/02/05 22:26:25.834772 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:26:26.475944 0.000000 udp 10.0.2.105 7010 -> 122.177.81.23 2857 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:34.297130 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:41.427278 0.000000 udp 10.0.2.105 7010 -> 2.231.96.156 4903 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:49.749585 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:26:54.340560 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:26:57.851293 0.000000 udp 10.0.2.105 7010 -> 92.97.202.100 1572 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:27:03.038371 0.000000 udp 10.0.2.105 7010 -> 14.97.236.78 9882 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:27:09.758139 0.000000 udp 10.0.2.105 7010 -> 122.173.209.139 1848 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:27:18.100166 0.050671 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:27:18.214789 0.290529 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 660 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:27:22.836527 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:28:36.413620 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:28:36.413738 3.002981 tcp 10.0.2.105 64669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:28:45.415702 0.000000 tcp 10.0.2.105 64669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:28:51.416469 0.053245 tcp 10.0.2.105 64670 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:28:51.470023 0.068694 tcp 10.0.2.105 64671 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:28:51.538984 0.156767 tcp 10.0.2.105 64672 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:28:51.706814 2.991943 tcp 10.0.2.105 64673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:00.703030 0.000000 tcp 10.0.2.105 64673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:06.706866 0.052757 tcp 10.0.2.105 64674 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:06.759911 0.071440 tcp 10.0.2.105 64675 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:06.831599 0.157861 tcp 10.0.2.105 64676 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:07.036077 3.904766 tcp 10.0.2.105 64677 -> 46.48.223.67 15494 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:10.637440 0.052284 tcp 10.0.2.105 64678 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:10.690026 0.070812 tcp 10.0.2.105 64679 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:10.761133 0.155123 tcp 10.0.2.105 64680 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:10.941082 3.005716 tcp 10.0.2.105 64681 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:19.945182 0.000000 tcp 10.0.2.105 64681 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:25.934298 0.053642 tcp 10.0.2.105 64682 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:25.987787 0.067585 tcp 10.0.2.105 64683 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:26.055636 0.156113 tcp 10.0.2.105 64684 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:26.306796 2.992227 tcp 10.0.2.105 64685 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:35.301109 0.000000 tcp 10.0.2.105 64685 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:41.305934 3.000488 tcp 10.0.2.105 64686 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:50.298729 0.000000 tcp 10.0.2.105 64686 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:29:54.835251 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:29:56.319130 2.688650 tcp 10.0.2.105 64687 -> 46.48.223.67 15494 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:29:59.008027 3.001174 tcp 10.0.2.105 64688 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:30:08.004042 0.000000 tcp 10.0.2.105 64688 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:30:17.721220 3.001428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:30:24.728278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:30:32.729749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:30:48.743168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:31:20.752844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:35:13.994660 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:35:13.994845 2.993025 tcp 10.0.2.105 64689 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:35:22.997116 0.000000 tcp 10.0.2.105 64689 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:35:28.997502 0.052696 tcp 10.0.2.105 64690 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:29.050500 0.074032 tcp 10.0.2.105 64691 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:29.124838 0.154866 tcp 10.0.2.105 64692 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:29.448450 3.002470 tcp 10.0.2.105 64693 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:35:38.449376 0.000000 tcp 10.0.2.105 64693 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:35:44.448641 0.053127 tcp 10.0.2.105 64694 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:44.502105 0.075862 tcp 10.0.2.105 64695 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:44.578245 0.158550 tcp 10.0.2.105 64696 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:44.783401 2.109238 tcp 10.0.2.105 64697 -> 46.48.223.67 15494 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:46.539961 0.057012 tcp 10.0.2.105 64698 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:46.597290 0.071477 tcp 10.0.2.105 64699 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:46.669133 0.157259 tcp 10.0.2.105 64700 -> 195.113.214.251 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:35:46.892886 3.002729 tcp 10.0.2.105 64701 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:35:55.894552 0.000000 tcp 10.0.2.105 64701 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:01.898488 0.073938 tcp 10.0.2.105 64702 -> 195.113.214.221 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:36:01.972776 0.068040 tcp 10.0.2.105 64703 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:36:02.041143 0.154930 tcp 10.0.2.105 64704 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:36:02.436937 2.991661 tcp 10.0.2.105 64705 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:11.436836 0.000000 tcp 10.0.2.105 64705 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:17.425677 2.994089 tcp 10.0.2.105 64706 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:26.420953 0.000000 tcp 10.0.2.105 64706 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:31.335392 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:36:32.427083 1.778424 tcp 10.0.2.105 64707 -> 46.48.223.67 15494 FSPA* 0 0 14 1749 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:36:34.205450 2.997998 tcp 10.0.2.105 64708 -> 31.192.27.210 7758 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:36:43.202220 0.000000 tcp 10.0.2.105 64708 -> 31.192.27.210 7758 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:37:24.754491 3.002079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:37:31.762242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:37:39.763759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:37:55.766815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:38:27.772975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:41:49.492570 0.129223 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:41:49.621959 2.959074 tcp 10.0.2.105 64709 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:41:58.552855 0.000000 tcp 10.0.2.105 64709 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:42:04.486678 0.055052 tcp 10.0.2.105 64710 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:04.541986 0.073872 tcp 10.0.2.105 64711 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:04.616169 0.158377 tcp 10.0.2.105 64712 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:04.921485 0.350588 tcp 10.0.2.105 64713 -> 46.48.223.67 15494 SPA_* 0 0 9 1160 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:18.229019 0.472466 tcp 10.0.2.105 64713 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:18.229871 0.053059 tcp 10.0.2.105 64714 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:18.283213 0.067856 tcp 10.0.2.105 64715 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:18.351418 0.161316 tcp 10.0.2.105 64716 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:18.701700 2.962697 tcp 10.0.2.105 64717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:42:27.610438 0.000000 tcp 10.0.2.105 64717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:42:33.608953 0.352033 tcp 10.0.2.105 64718 -> 46.48.223.67 15494 SPA_* 0 0 9 1160 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:42:53.060873 0.000349 tcp 10.0.2.105 64718 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:44:31.778154 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 22:44:38.786170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:44:46.787926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:45:02.790156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:45:34.796659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:54:47.804840 3.072362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 22:54:54.847269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:55:02.823434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:55:18.836760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:55:50.842530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 22:57:28.133026 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 22:57:28.133136 0.111452 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:28.223954 0.752498 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 5 1737 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:28.637969 0.338528 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:29.125128 0.255612 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:29.343495 0.062948 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:29.664924 0.173808 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:29.832084 0.072719 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:29.890101 0.091560 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:30.034914 0.153620 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:30.138212 0.173391 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:31.153829 0.206630 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:31.760150 0.189564 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:32.025344 0.171893 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:32.173349 0.101388 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:32.733489 0.083662 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:32.796342 0.252859 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 5 2052 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:57:38.117104 3.003899 tcp 10.0.2.105 64719 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:57:47.119389 0.000000 tcp 10.0.2.105 64719 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:57:48.874269 0.053229 tcp 10.0.2.105 64720 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:48.927738 0.077555 tcp 10.0.2.105 64721 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:49.005559 0.153522 tcp 10.0.2.105 64722 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:49.159612 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:57:53.118710 0.052256 tcp 10.0.2.105 64723 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:53.171233 0.071859 tcp 10.0.2.105 64724 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:53.243356 0.164444 tcp 10.0.2.105 64725 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:57:53.601348 3.002054 tcp 10.0.2.105 64726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:02.601936 0.000000 tcp 10.0.2.105 64726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:06.858107 0.052980 tcp 10.0.2.105 64727 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:06.911415 0.078234 tcp 10.0.2.105 64728 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:06.989955 0.160586 tcp 10.0.2.105 64729 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:07.151038 0.175954 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:07.301723 0.056080 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:07.351994 0.114501 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:07.427668 0.403743 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:07.812289 0.103350 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:07.959187 0.444954 udp 10.0.2.105 7010 <-> 183.4.245.168 1890 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:08.366836 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:58:08.600949 0.053350 tcp 10.0.2.105 64730 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:08.654676 0.078169 tcp 10.0.2.105 64731 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:08.733134 0.159876 tcp 10.0.2.105 64732 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:08.985995 2.999481 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:17.983689 0.000000 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:23.982852 3.004293 tcp 10.0.2.105 64734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:25.085037 0.054050 tcp 10.0.2.105 64735 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:25.139596 0.074514 tcp 10.0.2.105 64736 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:25.214401 0.162127 tcp 10.0.2.105 64737 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:25.377544 0.196714 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:25.571350 0.323520 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:25.912961 0.496123 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:26.263306 0.106703 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:26.368973 0.169436 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:26.546199 0.228980 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:26.767408 0.394802 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:27.019028 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 22:58:32.985600 0.000000 tcp 10.0.2.105 64734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 22:58:43.561663 0.055991 tcp 10.0.2.105 64738 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:43.617915 0.074150 tcp 10.0.2.105 64739 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:43.691931 0.158594 tcp 10.0.2.105 64740 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 22:58:43.851247 0.045111 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:43.881585 0.400624 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:44.278624 0.192912 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:44.461197 0.287117 udp 10.0.2.105 7010 <-> 124.120.192.248 8909 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:44.732245 0.138472 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:44.904790 0.241920 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:45.114736 0.984490 udp 10.0.2.105 7010 <-> 121.184.15.98 2373 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.094993 0.141417 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.232939 0.236828 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.476966 0.173806 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.622472 0.146499 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.755063 0.178466 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:46.911196 0.421555 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:47.364827 0.334253 udp 10.0.2.105 7010 <-> 14.97.50.5 9026 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:47.656957 0.464715 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:47.981349 1.280878 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:49.257206 0.067452 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/05 22:58:49.310052 0.288223 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:01:54.847954 3.012116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 23:02:01.866125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:02:09.866993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:02:25.870327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:02:57.876648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:03:38.985952 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 23:03:38.986097 2.993609 tcp 10.0.2.105 64741 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:03:47.978609 0.000000 tcp 10.0.2.105 64741 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:03:53.991140 0.057076 tcp 10.0.2.105 64742 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:03:54.048623 0.072216 tcp 10.0.2.105 64743 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:03:54.121198 0.149740 tcp 10.0.2.105 64744 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:03:54.408931 2.993166 tcp 10.0.2.105 64745 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:04:03.400859 0.000000 tcp 10.0.2.105 64745 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:04:09.400112 0.053180 tcp 10.0.2.105 64746 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:09.453661 0.075164 tcp 10.0.2.105 64747 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:09.529158 0.158454 tcp 10.0.2.105 64748 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:09.707993 3.006107 tcp 10.0.2.105 64749 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:04:18.712981 0.000000 tcp 10.0.2.105 64749 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/05 23:04:24.701989 0.053902 tcp 10.0.2.105 64750 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:24.756258 0.073985 tcp 10.0.2.105 64751 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:24.830496 0.159361 tcp 10.0.2.105 64752 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:25.046757 0.351616 tcp 10.0.2.105 64753 -> 46.48.223.67 15494 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:30.816713 0.378599 tcp 10.0.2.105 64753 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:30.817564 0.053875 tcp 10.0.2.105 64754 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:30.871739 0.073109 tcp 10.0.2.105 64755 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:30.945105 0.164744 tcp 10.0.2.105 64756 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:04:31.195589 0.653521 tcp 10.0.2.105 64757 -> 95.104.50.9 3421 FSPA* 0 0 15 1670 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:09:07.891842 3.070992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 23:09:14.935066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:09:22.909828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:09:38.913102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:10:10.918510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:16:15.927498 3.000610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:16:22.933956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:16:30.937052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:16:46.938652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:17:18.944439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:23:24.954407 3.000081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:23:31.960965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:23:39.962673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:23:55.965251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:24:27.971354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:29:04.298921 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 23:29:04.299089 0.220718 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:04.520263 0.203196 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:04.723868 0.058022 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:04.782241 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 23:29:20.703940 0.055410 tcp 10.0.2.105 64758 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:20.759726 0.074105 tcp 10.0.2.105 64759 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:20.834109 0.157068 tcp 10.0.2.105 64760 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:20.991923 0.126052 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:21.118363 0.202383 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:21.321209 0.342535 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:21.664145 0.236357 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:21.900870 0.168963 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.070233 0.077102 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.147768 0.057446 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.205595 0.060017 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.266012 0.165091 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.431554 0.168175 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.600383 0.096242 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.697062 0.146125 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:22.843628 0.181095 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.025189 0.082260 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.108254 0.063575 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.172202 0.045548 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.218349 0.375098 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.593826 0.147266 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.741486 0.074961 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:23.816794 0.280706 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:24.097904 0.367763 udp 10.0.2.105 7010 <-> 183.4.245.168 1890 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:24.466097 0.341220 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:24.807762 0.190442 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:24.998568 0.209299 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:25.208241 0.951888 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:26.160565 0.068250 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:26.229226 0.146403 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:26.376091 0.266340 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:26.643127 0.029511 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:26.673066 0.465541 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:27.139000 0.180172 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:27.319533 0.271422 udp 10.0.2.105 7010 <-> 124.120.192.248 8909 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:27.591363 0.137351 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:27.729170 0.218103 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:27.947673 0.000000 udp 10.0.2.105 7010 -> 121.184.15.98 2373 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/05 23:29:45.528924 0.052970 tcp 10.0.2.105 64761 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:45.582251 0.074593 tcp 10.0.2.105 64762 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:45.657214 0.158118 tcp 10.0.2.105 64763 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:29:45.815797 0.135491 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:45.951702 0.234968 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:46.187073 0.142310 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:46.329763 0.132136 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:46.462252 0.152795 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:46.615491 1.246237 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:47.862217 0.424315 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:48.286900 0.262971 udp 10.0.2.105 7010 <-> 14.97.50.5 9026 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:48.550291 0.280723 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:48.831430 0.407963 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:29:49.239832 0.046633 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/05 23:30:31.976783 3.062278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/05 23:30:39.015819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:30:46.996750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:31:02.998681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:31:35.005562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:34:31.857032 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/05 23:34:31.857192 0.649843 tcp 10.0.2.105 64764 -> 95.104.50.9 3421 FSPA* 0 0 15 1602 flow=From-Botnet-V2-TCP-Established 1970/02/05 23:37:39.011835 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:37:46.018834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:37:54.020771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:38:10.023231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:38:42.039463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:44:46.047279 2.999768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:44:53.054774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:45:01.058736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:45:17.061721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:45:49.062816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:51:53.069238 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:52:00.076800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:52:08.078119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:52:24.080781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:52:56.087466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:59:00.094313 3.000761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/05 23:59:07.100199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:59:15.102285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/05 23:59:31.105424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:00:03.111065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:00:09.070285 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 00:00:09.070479 0.000000 udp 10.0.2.105 7010 -> 121.184.15.98 2373 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:00:25.215060 0.053896 tcp 10.0.2.105 64765 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:25.269312 0.077100 tcp 10.0.2.105 64766 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:25.346802 0.161575 tcp 10.0.2.105 64767 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:25.508885 0.057367 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:25.566743 0.218696 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:25.785852 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:00:43.139433 0.105364 tcp 10.0.2.105 64768 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:43.245111 0.075016 tcp 10.0.2.105 64769 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:43.320381 0.164028 tcp 10.0.2.105 64770 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:00:43.485118 0.096099 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:43.581621 0.214140 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:43.796171 0.241072 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.037647 0.121893 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.159929 0.076993 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.237339 0.060897 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.298712 0.206598 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.505747 0.181448 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.687595 0.110834 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.798868 0.164896 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:44.964169 0.060521 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.025095 0.191455 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.217012 0.084107 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.301558 0.057603 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.359590 0.044463 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.404449 0.145094 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.549942 0.074474 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.624860 0.082566 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:45.707854 0.375919 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:46.084212 0.145550 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:46.230291 0.190727 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:46.421421 0.242176 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:46.663997 0.261080 udp 10.0.2.105 7010 <-> 183.4.245.168 1890 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:46.925474 0.345289 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:47.271271 0.321219 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:47.592927 0.064592 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:47.657912 0.029133 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:47.687432 0.452331 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:48.140177 0.144659 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:48.285239 0.217814 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:48.503515 0.217391 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:48.721342 0.176837 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:48.898655 0.270470 udp 10.0.2.105 7010 <-> 124.120.192.248 8909 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.169515 0.137048 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.307185 0.129614 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.437193 0.235663 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.673266 0.153701 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.827320 0.144066 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:49.971774 0.129873 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:50.101992 0.354176 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:50.456543 0.422466 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:00:50.879396 0.000000 udp 10.0.2.105 7010 -> 14.97.50.5 9026 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:01:06.994038 0.060445 tcp 10.0.2.105 64771 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:01:07.054784 0.077023 tcp 10.0.2.105 64772 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:01:07.132103 0.162950 tcp 10.0.2.105 64773 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:01:07.295657 0.276788 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:01:07.572855 0.392581 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:01:07.965883 0.050278 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:04:32.509009 0.022361 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 00:04:32.531509 0.575427 tcp 10.0.2.105 64774 -> 95.104.50.9 3421 FSPA* 0 0 15 1676 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:06:31.124285 3.064984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 00:06:38.168796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:06:46.140461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:07:02.143458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:07:34.149883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:13:43.162756 3.002269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 00:13:50.169929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:13:58.171810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:14:14.174947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:14:46.180790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:20:56.224555 2.952156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 00:21:03.130656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:21:11.020980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:21:26.812797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:21:58.387698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:28:01.758992 3.000248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 00:28:08.765107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:28:16.766576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:28:32.769395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:29:04.775075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:31:36.974499 0.022388 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 00:31:36.997042 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:31:55.161602 0.060477 tcp 10.0.2.105 64775 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:31:55.222358 0.070492 tcp 10.0.2.105 64776 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:31:55.293154 0.173648 tcp 10.0.2.105 64777 -> 195.113.214.251 443 SRPA* 0 0 74 78478 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:31:55.467399 0.000000 udp 10.0.2.105 7010 -> 14.97.50.5 9026 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:32:13.146215 0.068417 tcp 10.0.2.105 64778 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:13.214938 0.074418 tcp 10.0.2.105 64779 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:13.289282 0.160627 tcp 10.0.2.105 64780 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:13.450476 0.089608 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:13.540653 0.217673 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:13.758748 0.242839 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:14.002182 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 00:32:30.762030 0.080315 tcp 10.0.2.105 64781 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:30.842649 0.071364 tcp 10.0.2.105 64782 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:30.914375 0.167722 tcp 10.0.2.105 64783 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:32:31.082638 0.220953 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:31.303983 0.060772 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:31.365132 0.099543 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:31.465059 0.170620 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:31.636137 0.882400 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:32.518932 0.080698 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:32.600030 0.165800 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:32.766357 0.096368 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:32.863143 0.193604 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:33.057155 0.085795 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:33.143366 0.063487 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:33.207275 0.059766 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:33.267447 0.069864 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:33.337748 0.996437 udp 10.0.2.105 7010 <-> 81.174.154.246 1939 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:34.334549 0.046384 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:34.381371 0.145990 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:34.527767 0.190392 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:34.718504 0.230513 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:34.949420 0.437127 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:35.386958 0.147086 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:35.578291 0.272638 udp 10.0.2.105 7010 <-> 183.4.245.168 1890 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:35.851399 0.313064 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:36.164941 0.343778 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:36.509127 0.068793 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:36.578327 0.028528 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:36.607258 0.142416 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:36.750105 0.361792 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:37.112358 0.233005 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:37.345783 0.217626 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:37.563839 0.269000 udp 10.0.2.105 7010 <-> 124.120.192.248 8909 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:37.833255 0.137215 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:37.970889 0.186695 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:38.158017 0.141702 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:38.300117 0.132687 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:38.433224 0.233988 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:38.667570 0.141607 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:38.809613 0.284292 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:39.094320 0.649532 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:39.744394 0.426557 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:40.171433 0.050782 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:40.222631 0.275777 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:32:40.498882 0.400382 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/06 00:34:33.409102 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 00:34:33.409204 0.570159 tcp 10.0.2.105 64784 -> 95.104.50.9 3421 FSPA* 0 0 15 1696 flow=From-Botnet-V2-TCP-Established 1970/02/06 00:35:08.816540 3.008669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 00:35:15.828637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:35:23.830284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:35:39.833216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:36:11.839316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:42:15.845246 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 00:42:22.853054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:42:30.854125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:42:46.857140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:43:18.863299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:53:36.875138 3.000897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 00:53:43.881998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:53:51.883427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:54:07.886654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 00:54:39.892897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:00:44.951611 3.000095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:00:51.956880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:00:59.959038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:01:15.961908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:01:47.967622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:02:58.469890 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 01:02:58.470079 0.080974 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:58.551472 0.218748 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:58.770607 0.080406 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:58.851438 0.247511 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:59.099307 0.163980 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:59.263652 0.170476 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:59.434640 0.226953 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:59.661982 0.056001 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:02:59.718342 0.465578 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.184449 0.079436 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.264276 0.164493 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.429147 0.110520 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.540040 0.181827 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.722291 0.078299 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.800983 0.064089 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.865488 0.059491 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.925356 0.068327 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:00.994058 0.146436 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:01.140914 0.191283 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:01.332605 0.219021 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:01.552019 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:03:16.947826 0.060960 tcp 10.0.2.105 64785 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:17.009077 0.070606 tcp 10.0.2.105 64786 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:17.079971 0.161352 tcp 10.0.2.105 64787 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:17.241929 0.045554 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:17.287881 0.651057 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:17.939312 0.147335 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:18.087102 0.000000 udp 10.0.2.105 7010 -> 183.4.245.168 1890 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:03:36.554323 0.084917 tcp 10.0.2.105 64788 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:36.639601 0.074317 tcp 10.0.2.105 64789 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:36.714228 0.160242 tcp 10.0.2.105 64790 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:36.875124 0.329872 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:37.205414 0.405048 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:37.610891 0.065230 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:37.676599 0.027969 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:37.705012 0.252555 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:37.958004 0.208491 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:38.166948 0.000000 udp 10.0.2.105 7010 -> 124.120.192.248 8909 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:03:56.863909 0.054837 tcp 10.0.2.105 64791 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:56.919051 0.072425 tcp 10.0.2.105 64792 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:56.991765 0.164399 tcp 10.0.2.105 64793 -> 195.113.214.251 443 SRPA* 0 0 80 57594 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:03:57.156755 0.136856 udp 10.0.2.105 7010 <-> 64.135.103.251 9020 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:57.294017 0.179307 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:57.473991 0.145380 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:57.619774 0.464045 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.084433 0.142224 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.227172 0.133461 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.361050 0.234548 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.595978 0.138213 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.734598 0.155755 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:58.890735 0.553771 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:59.444892 0.286213 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:03:59.731494 0.412629 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:04:00.144538 0.435041 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:04:00.580000 0.048951 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:04:34.709823 0.571444 tcp 10.0.2.105 64794 -> 95.104.50.9 3421 FSPA* 0 0 15 1613 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:07:51.975167 3.002118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 01:07:58.981543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:08:06.982871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:08:22.985756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:08:54.991784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:15:01.002882 2.999420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:15:08.008393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:15:16.009704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:15:32.012810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:16:04.028706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:22:08.034883 3.032012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:22:15.053294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:22:23.059533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:22:39.669045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:23:11.271525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:29:15.079523 3.000326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:29:22.086331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:29:30.087550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:29:46.090144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:30:18.096161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:34:06.692947 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 01:34:06.693064 0.000000 udp 10.0.2.105 7010 -> 81.174.154.246 1939 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:34:23.320904 0.066175 tcp 10.0.2.105 64795 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:23.387357 0.082550 tcp 10.0.2.105 64796 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:23.470173 0.161379 tcp 10.0.2.105 64797 -> 195.113.214.251 443 SRPA* 0 0 33 17852 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:23.632409 0.000000 udp 10.0.2.105 7010 -> 183.4.245.168 1890 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:34:35.266488 0.477116 tcp 10.0.2.105 64798 -> 95.104.50.9 3421 FSPA* 0 0 15 1677 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:40.955482 0.053736 tcp 10.0.2.105 64799 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:41.009609 0.072152 tcp 10.0.2.105 64800 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:41.082079 0.231492 tcp 10.0.2.105 64801 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:41.314192 0.000000 udp 10.0.2.105 7010 -> 124.120.192.248 8909 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:34:58.780699 0.052773 tcp 10.0.2.105 64802 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:58.833793 0.075636 tcp 10.0.2.105 64803 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:58.909722 0.157448 tcp 10.0.2.105 64804 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:34:59.067648 0.243006 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:34:59.311100 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:35:15.254478 0.074694 tcp 10.0.2.105 64805 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:15.329042 0.076366 tcp 10.0.2.105 64806 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:15.405741 0.179974 tcp 10.0.2.105 64807 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:15.586376 0.217249 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:15.804105 0.087838 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:15.892578 0.115958 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.008989 0.215393 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.224853 0.168090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.393430 0.055328 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.449217 0.165122 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.614735 0.077667 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.692911 0.068207 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.761525 0.208918 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:16.970901 0.084852 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.056157 0.195321 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.251860 0.099341 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.351652 0.144332 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.496395 0.062680 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.559488 0.073783 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.633671 0.190218 udp 10.0.2.105 7010 <-> 99.172.36.100 5720 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:17.824422 0.229906 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:18.054797 0.044540 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:18.099791 0.409283 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:18.509441 0.149221 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:18.659158 0.318859 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:18.978397 0.028826 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:19.007621 0.255597 udp 10.0.2.105 7010 <-> 14.98.211.92 6114 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:19.263618 0.780394 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:20.044538 0.067777 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:20.112704 0.217035 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:20.330185 0.181337 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:20.511963 0.144941 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:20.657256 0.359200 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:21.016876 0.000000 udp 10.0.2.105 7010 -> 64.135.103.251 9020 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 01:35:38.738664 0.053603 tcp 10.0.2.105 64808 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:38.792605 0.071326 tcp 10.0.2.105 64809 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:38.863771 0.162133 tcp 10.0.2.105 64810 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 01:35:39.026544 0.132242 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:39.159172 0.234135 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:39.393731 0.135951 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:39.530071 0.157241 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:39.687776 0.147313 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:39.835522 0.288356 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:40.124267 0.444074 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:40.568710 0.456718 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:41.025785 0.434485 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:35:41.460705 0.050823 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/06 01:36:22.103283 3.011217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 01:36:29.121507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:36:37.121930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:36:53.125398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:37:25.140725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:43:29.146549 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:43:36.153833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:43:44.155762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:44:00.158503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:44:32.164958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:54:13.172314 3.002087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 01:54:20.179886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:54:28.181709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:54:44.184746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 01:55:16.191023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:01:20.197467 3.000682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:01:27.203714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:01:35.205474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:01:51.216212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:02:23.214177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:04:35.748235 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 02:04:35.748370 0.472062 tcp 10.0.2.105 64811 -> 95.104.50.9 3421 FSPA* 0 0 15 1734 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:05:45.465587 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 02:05:45.465743 0.057774 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:05:45.523962 0.000000 udp 10.0.2.105 7010 -> 64.135.103.251 9020 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:06:02.932423 0.053411 tcp 10.0.2.105 64812 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:02.986117 0.072037 tcp 10.0.2.105 64813 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:03.058544 0.156099 tcp 10.0.2.105 64814 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:03.215170 0.245784 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:03.461511 0.101944 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:03.563918 0.252736 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:03.817136 0.217629 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.035144 0.090785 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.126367 0.167805 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.294628 0.073463 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.368566 0.063777 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.432747 0.210480 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.705475 0.077678 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.783596 0.166134 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:04.950165 0.060246 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:05.010851 0.200251 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:05.211483 0.096654 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:05.308666 0.055938 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:05.364932 0.076237 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:05.441594 0.000000 udp 10.0.2.105 7010 -> 99.172.36.100 5720 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:06:22.860136 0.056259 tcp 10.0.2.105 64815 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:22.916684 0.072581 tcp 10.0.2.105 64816 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:22.989611 0.156901 tcp 10.0.2.105 64817 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:23.147139 0.229105 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:23.376663 0.090352 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:23.467452 0.141935 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:23.609793 0.029968 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:23.640200 0.000000 udp 10.0.2.105 7010 -> 14.98.211.92 6114 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:06:42.387918 0.054674 tcp 10.0.2.105 64818 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:42.442517 0.071565 tcp 10.0.2.105 64819 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:42.514428 0.162603 tcp 10.0.2.105 64820 -> 195.113.214.251 443 SRPA* 0 0 40 32780 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:06:42.677637 0.387773 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:43.065856 0.147690 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:43.213923 0.318072 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:43.532422 0.066731 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:43.599622 0.367460 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:43.967469 0.144636 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:44.112478 0.387604 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:44.500611 0.178461 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:44.679534 0.217948 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:44.897832 0.134373 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.032670 0.234416 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.267473 0.137017 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.404935 0.155712 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.561110 0.143870 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.705384 0.274098 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:45.979842 0.491404 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:46.471613 4.876855 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:51.348867 0.434269 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:06:51.783589 0.059646 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:08:27.220920 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 02:08:34.228148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:08:42.229582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:08:58.232675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:09:30.238833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:15:39.252635 3.000360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:15:46.259197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:15:54.261025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:16:10.263692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:16:42.269566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:22:46.275863 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:22:53.283221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:23:01.284915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:23:17.287837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:23:49.293628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:29:53.300932 3.000614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:30:00.307458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:30:08.308936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:30:24.311791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:30:56.317733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:34:36.227770 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 02:34:36.227954 0.943888 tcp 10.0.2.105 64821 -> 95.104.50.9 3421 FSPA* 0 0 15 1558 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:00.323879 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:37:07.331204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:37:10.386044 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 02:37:10.386143 0.000000 udp 10.0.2.105 7010 -> 99.172.36.100 5720 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:37:15.332679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:37:25.488704 0.054534 tcp 10.0.2.105 64822 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:25.543537 0.078588 tcp 10.0.2.105 64823 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:25.622482 0.160263 tcp 10.0.2.105 64824 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:25.783286 0.000000 udp 10.0.2.105 7010 -> 14.98.211.92 6114 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:37:31.335762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:37:42.913396 0.052429 tcp 10.0.2.105 64825 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:42.966090 0.072603 tcp 10.0.2.105 64826 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:43.039021 0.152002 tcp 10.0.2.105 64827 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:37:43.191538 0.057165 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:37:43.249135 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:38:00.678221 0.052183 tcp 10.0.2.105 64828 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:00.730851 0.075681 tcp 10.0.2.105 64829 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:00.806814 0.170059 tcp 10.0.2.105 64830 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:00.977364 0.085768 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.063594 0.150705 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.214684 0.243241 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.458347 0.214921 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.673700 0.078682 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.752846 0.081785 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:01.835041 0.169233 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.004702 0.056464 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.061520 0.184423 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.246287 0.098481 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.345113 0.203371 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.548941 0.061879 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.611192 0.163661 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.775313 0.070161 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.845846 0.061627 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:02.907858 0.143855 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:03.052099 0.029372 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:03.081865 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 02:38:03.341872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:38:20.497301 0.061090 tcp 10.0.2.105 64831 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:20.558739 0.072554 tcp 10.0.2.105 64832 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:20.631611 0.164856 tcp 10.0.2.105 64833 -> 195.113.214.251 443 SRPA* 0 0 33 15140 flow=From-Botnet-V2-TCP-Established 1970/02/06 02:38:20.796738 0.244961 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:21.042041 0.327342 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:21.369766 0.064972 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:21.435155 0.397333 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:21.832980 0.147053 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:21.980449 0.265250 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:22.246108 0.146231 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:22.392726 0.379907 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:22.773038 0.184040 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:22.957543 0.216183 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.174119 0.134970 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.309477 0.234526 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.544456 0.130834 udp 10.0.2.105 7010 <-> 85.29.177.46 8455 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.675691 0.155112 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.831240 0.145161 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:23.976794 0.289436 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:24.323604 0.504115 udp 10.0.2.105 7010 <-> 106.188.98.195 4240 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:24.828099 0.317229 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:25.145718 0.435268 udp 10.0.2.105 7010 <-> 123.109.208.38 5359 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:38:25.581378 0.051106 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/06 02:44:07.347539 3.003546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:44:14.355646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:44:22.356720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:44:38.359722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:45:10.367030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:54:34.379885 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 02:54:41.386202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:54:49.393089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:55:05.390749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 02:55:37.397002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:01:41.402667 3.002253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:01:48.410760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:01:56.411954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:02:12.419966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:02:44.422527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:04:37.174550 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 03:04:37.174671 0.557763 tcp 10.0.2.105 64834 -> 95.104.50.9 3421 FSPA* 0 0 15 1722 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:08:48.428355 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:08:54.804725 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 03:08:54.804847 0.217345 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:08:55.022703 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:08:55.435032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:09:03.436553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:09:12.741731 0.074585 tcp 10.0.2.105 64835 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:12.816577 0.068200 tcp 10.0.2.105 64836 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:12.885067 0.164637 tcp 10.0.2.105 64837 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:13.049442 0.057074 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:13.106892 0.146286 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:13.253554 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:09:19.439697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:09:30.836108 0.053156 tcp 10.0.2.105 64838 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:30.889515 0.071940 tcp 10.0.2.105 64839 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:30.961291 0.151759 tcp 10.0.2.105 64840 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:31.113716 0.072177 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.186279 0.083100 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.269852 0.168462 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.438787 0.056366 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.495580 0.214687 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.710644 0.253473 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:31.964540 0.195977 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.160945 0.165060 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.326460 0.071494 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.398346 0.058741 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.457568 0.147209 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.605156 0.028717 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.634364 0.097934 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.732715 0.206527 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:32.939659 0.062114 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:33.002259 0.228313 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:33.231005 0.341182 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:33.572603 0.066252 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:33.639274 0.375992 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:34.015692 0.146659 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:34.162856 0.296207 udp 10.0.2.105 7010 <-> 115.242.248.37 7553 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:34.459487 0.185920 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:34.645779 0.220430 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:34.866638 0.147343 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:35.072129 0.448595 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:35.521182 0.140014 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:35.661627 0.234212 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:35.896400 0.000000 udp 10.0.2.105 7010 -> 85.29.177.46 8455 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:09:51.125579 0.053345 tcp 10.0.2.105 64841 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:51.179319 0.075489 tcp 10.0.2.105 64842 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:51.255146 0.159483 tcp 10.0.2.105 64843 -> 195.113.214.251 443 SRPA* 0 0 37 31144 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:09:51.415363 0.155067 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:51.445184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:09:51.570816 0.146203 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:51.717387 0.000000 udp 10.0.2.105 7010 -> 5.238.184.77 3254 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:09:58.675289 0.000000 udp 10.0.2.105 7010 <- 5.238.184.77 3254 RSP 0 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:09:58.675852 0.277233 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:09:58.953448 0.000000 udp 10.0.2.105 7010 -> 106.188.98.195 4240 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:10:15.910567 0.154240 tcp 10.0.2.105 64844 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:16.065084 0.074603 tcp 10.0.2.105 64845 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:16.139626 0.151886 tcp 10.0.2.105 64846 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:16.292060 0.000000 udp 10.0.2.105 7010 -> 123.109.208.38 5359 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:10:32.094192 0.052787 tcp 10.0.2.105 64847 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:32.147303 0.072880 tcp 10.0.2.105 64848 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:32.220565 0.164918 tcp 10.0.2.105 64849 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:10:32.385989 0.044824 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:16:01.459821 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 03:16:08.467164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:16:16.468876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:16:32.475811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:17:04.477519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:23:10.486224 3.002468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:23:17.493909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:23:25.495495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:23:41.498611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:24:13.504677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:30:17.510100 3.001913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:30:24.517951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:30:32.519646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:30:48.522228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:31:20.528901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:34:37.642393 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 03:34:37.642489 0.762651 tcp 10.0.2.105 64850 -> 95.104.50.9 3421 FSPA* 0 0 15 1767 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:37:24.534104 3.002048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:37:31.541593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:37:39.543455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:37:55.546302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:38:27.552634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:40:53.923015 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 03:40:53.923180 0.074231 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:40:53.997804 0.000000 udp 10.0.2.105 7010 -> 85.29.177.46 8455 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:41:09.026341 0.053531 tcp 10.0.2.105 64851 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:09.080151 0.076549 tcp 10.0.2.105 64852 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:09.157017 0.152439 tcp 10.0.2.105 64853 -> 195.113.214.251 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:09.310040 0.000000 udp 10.0.2.105 7010 -> 106.188.98.195 4240 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:41:25.168038 0.052603 tcp 10.0.2.105 64854 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:25.220954 0.075904 tcp 10.0.2.105 64855 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:25.297131 0.159685 tcp 10.0.2.105 64856 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:25.457448 0.000000 udp 10.0.2.105 7010 -> 123.109.208.38 5359 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:41:41.932728 0.051371 tcp 10.0.2.105 64857 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:41.984400 0.072830 tcp 10.0.2.105 64858 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:42.057504 0.155705 tcp 10.0.2.105 64859 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:41:42.213966 0.221577 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.435998 0.056772 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.493164 0.132759 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.626356 0.078832 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.705630 0.081638 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.787719 0.201711 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:42.989793 0.219118 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.209315 0.169186 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.378921 0.053253 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.432716 0.241722 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.674872 0.074218 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.749500 0.097742 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:43.847664 0.209761 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.057829 0.058907 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.117109 0.220197 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.337696 0.029619 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.367720 0.145870 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.513991 0.055869 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.570245 0.165269 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:44.735968 0.344471 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:45.080857 0.067536 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:45.148752 0.429120 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:45.578242 0.149126 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:41:45.727803 0.000000 udp 10.0.2.105 7010 -> 115.242.248.37 7553 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:42:03.383624 0.052808 tcp 10.0.2.105 64860 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:42:03.436704 0.077090 tcp 10.0.2.105 64861 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:42:03.514096 0.163446 tcp 10.0.2.105 64862 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 03:42:03.677801 0.354054 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:04.032283 0.181331 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:04.214034 0.147105 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:04.361520 0.133664 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:04.495630 0.381382 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:04.877421 0.287695 udp 10.0.2.105 7010 <-> 218.16.58.52 6622 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:05.165582 0.155903 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:05.321920 0.192346 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:05.514668 0.000000 udp 10.0.2.105 7010 -> 5.238.184.77 3254 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:42:12.943046 0.000000 udp 10.0.2.105 7010 <- 5.238.184.77 3254 RSP 0 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 03:42:12.943465 0.274877 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:42:13.218717 0.051157 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 03:44:31.558501 3.002096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 03:44:38.566086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:44:46.570121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:45:02.575811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:45:34.578723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:54:46.582869 3.002008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 03:54:53.590109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:55:01.591816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:55:17.594867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 03:55:49.600718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:01:53.606351 3.012498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:02:00.624016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:02:08.625882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:02:24.628910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:02:56.635102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:04:38.411235 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 04:04:38.741360 0.962679 tcp 10.0.2.105 64863 -> 95.104.50.9 3421 FSPA* 0 0 15 1761 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:09:05.648349 3.002188 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:09:12.655347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:09:20.656944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:09:36.664017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:10:08.665732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:12:43.148253 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 04:12:43.148441 0.000000 udp 10.0.2.105 7010 -> 115.242.248.37 7553 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:13:01.095877 0.052303 tcp 10.0.2.105 64864 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:01.148475 0.071973 tcp 10.0.2.105 64865 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:01.220736 0.165884 tcp 10.0.2.105 64866 -> 195.113.214.251 443 SRPA* 0 0 47 41966 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:01.387356 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:13:16.616731 0.050600 tcp 10.0.2.105 64867 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:16.667646 0.077297 tcp 10.0.2.105 64868 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:16.745225 0.462603 tcp 10.0.2.105 64869 -> 195.113.214.251 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:17.208359 0.056285 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.264985 0.107644 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.373034 0.084355 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.457902 0.076614 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.534953 0.191331 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.726725 0.223847 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:17.951018 0.217991 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.169389 0.055750 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.225570 0.167850 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.393788 0.099334 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.493460 0.207965 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.701831 0.063483 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.765717 0.073059 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:18.839156 0.302124 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:19.141664 0.147752 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:19.289832 0.059056 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:19.349306 0.165993 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:19.515654 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:13:37.729396 0.051918 tcp 10.0.2.105 64870 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:37.781667 0.077391 tcp 10.0.2.105 64871 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:37.859381 0.168836 tcp 10.0.2.105 64872 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:38.029292 0.064876 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:38.094602 0.029760 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:38.124742 0.210287 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:38.335425 0.144807 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:38.480690 0.417168 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:38.898306 0.217621 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:39.116455 0.185043 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:39.301891 0.144511 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:39.446764 0.131921 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:39.579147 0.343151 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:39.922711 0.000000 udp 10.0.2.105 7010 -> 218.16.58.52 6622 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:13:56.485400 0.053507 tcp 10.0.2.105 64873 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:56.538733 0.075485 tcp 10.0.2.105 64874 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:56.614556 0.165770 tcp 10.0.2.105 64875 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:13:56.781050 0.156767 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:56.938236 0.688794 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:57.627469 0.049923 udp 10.0.2.105 7010 <-> 86.173.71.34 7691 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:13:57.677766 4.689492 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:14:02.367668 0.292265 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:16:14.675257 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 04:16:21.682000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:16:29.687366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:16:45.686813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:17:17.694692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:23:23.701847 3.001156 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:23:30.709033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:23:38.710701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:23:54.713697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:24:26.719533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:30:30.728506 2.998769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:30:37.736672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:30:45.734570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:31:01.738123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:31:33.745972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:34:39.711189 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 04:34:39.711416 0.654079 tcp 10.0.2.105 64876 -> 95.104.50.9 3421 FSPA* 0 0 15 1600 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:37:37.749056 3.002216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:37:44.757533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:37:52.760833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:38:08.761165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:38:40.767498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:44:21.528040 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 04:44:21.528139 0.095719 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:21.624286 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:44:37.582492 0.054275 tcp 10.0.2.105 64877 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:37.637070 0.075587 tcp 10.0.2.105 64878 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:37.712981 0.213122 tcp 10.0.2.105 64879 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:37.926734 0.000000 udp 10.0.2.105 7010 -> 218.16.58.52 6622 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:44:44.774487 3.140147 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:44:51.887095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:44:55.128268 0.055628 tcp 10.0.2.105 64880 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:55.184213 0.074185 tcp 10.0.2.105 64881 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:55.258801 0.157918 tcp 10.0.2.105 64882 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:44:55.417485 0.081813 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:55.499721 0.088739 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:55.588907 0.109850 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:55.699179 0.056143 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:55.755685 0.168887 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:55.925022 0.187607 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.113050 0.096277 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.209797 0.059304 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.269489 0.218022 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.487964 0.222027 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.710361 0.236215 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:56.947028 0.235491 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.183008 0.059066 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.242480 0.165096 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.407966 0.058568 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.466980 0.372031 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.839399 0.073320 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:57.913121 0.219504 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.133093 0.146942 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.280437 0.065733 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.369436 0.029960 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.399813 0.179020 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.579281 0.144817 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.724498 0.134515 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:58.859402 0.208763 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:59.068758 0.473591 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:59.542773 0.419461 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:44:59.827090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:44:59.962660 0.155171 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:45:00.118218 0.144423 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:45:00.263023 0.000000 udp 10.0.2.105 7010 -> 86.173.71.34 7691 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 04:45:15.795413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:45:16.437611 0.055214 tcp 10.0.2.105 64883 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:45:16.493077 0.080522 tcp 10.0.2.105 64884 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:45:16.573447 0.159805 tcp 10.0.2.105 64885 -> 195.113.214.251 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/06 04:45:16.733800 0.481481 udp 10.0.2.105 7010 <-> 5.238.184.77 3254 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:45:17.215680 0.279569 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/06 04:45:47.801695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:51:51.809446 2.999870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:51:58.815044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:52:06.828329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:52:22.819379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:52:54.825607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:58:58.830891 3.002296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 04:59:05.838660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:59:13.840784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 04:59:29.843286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:00:01.849222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:04:40.370193 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 05:04:40.370407 0.436857 tcp 10.0.2.105 64886 -> 95.104.50.9 3421 FSPA* 0 0 15 1681 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:06:29.859369 3.921204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:06:37.741552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:06:45.648958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:07:01.455716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:07:33.085014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:13:41.902458 3.000253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:13:48.908719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:13:56.910052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:14:12.923191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:14:44.929055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:15:46.237597 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 05:15:46.237692 0.000000 udp 10.0.2.105 7010 -> 86.173.71.34 7691 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 05:16:03.244108 0.280537 tcp 10.0.2.105 64887 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:03.524980 0.075725 tcp 10.0.2.105 64888 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:03.601012 0.143450 tcp 10.0.2.105 64889 -> 195.113.214.251 443 SRPA* 0 0 33 24714 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:03.745198 0.107982 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:03.853572 0.092709 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:03.946747 0.110310 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.057466 0.058503 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.116376 0.195118 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.311911 0.182341 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.509522 0.109981 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.619890 0.057315 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.677619 0.083323 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:04.761356 0.274831 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.036607 0.146899 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.183972 0.058892 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.243261 0.223798 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.467431 0.218622 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.686439 0.204152 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.891034 0.071023 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:05.962436 0.210888 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:06.173695 0.152446 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:06.326556 0.060929 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:06.387907 0.165038 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:06.553305 0.000000 udp 10.0.2.105 7010 -> 69.172.4.50 9850 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 05:16:22.410424 0.053521 tcp 10.0.2.105 64890 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:22.464280 0.074273 tcp 10.0.2.105 64891 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:22.538891 0.161696 tcp 10.0.2.105 64892 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:22.701120 0.143889 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:22.845469 0.136023 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:22.981946 0.210737 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:23.193125 0.067308 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:23.260927 0.000000 udp 10.0.2.105 7010 -> 79.219.117.112 2430 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 05:16:39.556359 0.053125 tcp 10.0.2.105 64893 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:39.609801 0.072902 tcp 10.0.2.105 64894 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:39.682953 0.165231 tcp 10.0.2.105 64895 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:39.848859 0.155185 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:40.004519 0.142462 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:40.147502 0.519735 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:40.667639 0.380148 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:16:41.048241 0.000000 udp 10.0.2.105 7010 -> 5.238.184.77 3254 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 05:16:57.139842 0.053845 tcp 10.0.2.105 64896 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:57.193988 0.072435 tcp 10.0.2.105 64897 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:57.266704 1.948013 tcp 10.0.2.105 64898 -> 195.113.214.251 443 SRPA* 0 0 53 40428 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:16:59.214322 0.291585 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:20:49.940562 2.997508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 05:20:57.129093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:21:05.060089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:21:20.968480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:21:52.975387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:27:56.980732 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:28:03.987822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:28:11.988822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:28:27.992590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:28:59.999055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:34:40.809275 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 05:34:40.809390 0.869470 tcp 10.0.2.105 64899 -> 95.104.50.9 3421 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:35:04.004481 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:35:11.012062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:35:19.013291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:35:35.016525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:36:07.022806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:42:11.029512 3.000356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:42:18.036328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:42:26.037516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:42:42.041127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:43:14.046302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:47:04.668066 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 05:47:04.668227 0.030406 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:04.699082 0.185123 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:04.884652 0.000000 udp 10.0.2.105 7010 -> 5.238.184.77 3254 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 05:47:19.911885 0.052319 tcp 10.0.2.105 64900 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:47:19.964552 0.077011 tcp 10.0.2.105 64901 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:47:20.041854 0.185069 tcp 10.0.2.105 64902 -> 195.113.214.251 443 SRPA* 0 0 75 78534 flow=From-Botnet-V2-TCP-Established 1970/02/06 05:47:20.227719 0.086145 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.314304 0.079553 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.394231 0.207026 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.601704 0.096484 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.698634 0.051603 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.750616 0.076043 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:20.827194 0.256071 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:21.083664 0.120349 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:21.204466 0.168672 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:21.373516 0.058223 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:21.432576 0.978173 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:22.411117 0.079932 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:22.491404 0.142202 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:22.634049 0.217784 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:22.852448 0.243451 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.096424 0.060330 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.157216 0.221569 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.379130 0.163371 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.542914 0.060508 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.603917 0.146011 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.604356 2.996096 tcp 10.0.2.105 64903 -> 213.123.178.217 2610 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 05:47:23.750283 0.149242 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:23.899872 0.133070 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:24.033391 0.066441 udp 10.0.2.105 7010 <-> 213.123.9.32 1534 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:24.100433 0.208085 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:24.308922 0.157268 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:24.466641 0.142552 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:24.609652 0.393758 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:25.003798 0.419136 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:25.601709 0.293652 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/06 05:47:32.598321 0.000000 tcp 10.0.2.105 64903 -> 213.123.178.217 2610 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 05:53:38.056107 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 05:53:45.073662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:53:53.075290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:54:09.078262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 05:54:41.084127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:00:45.090155 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:00:52.097755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:01:00.098694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:01:16.102739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:01:48.108158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:04:41.678224 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 06:04:41.678309 1.146867 tcp 10.0.2.105 64904 -> 95.104.50.9 3421 FSPA* 0 0 13 1534 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:07:52.114394 3.002395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:07:59.122023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:08:07.123219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:08:23.125764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:08:55.133165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:14:59.143862 2.996017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:15:06.145741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:15:14.149769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:15:30.152703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:16:02.156432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:17:41.829889 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 06:17:41.830172 0.029592 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:41.860495 0.182283 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:41.861041 3.003724 tcp 10.0.2.105 64905 -> 79.219.117.112 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:17:42.043316 0.073033 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.116827 0.081715 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.198925 0.191738 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.391023 0.295776 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.687257 0.058737 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.746469 0.075495 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:42.822392 0.248481 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.071310 0.061542 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.133317 0.108463 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.242217 0.171052 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.413719 0.211002 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.625123 0.076477 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.702100 0.142200 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:43.844692 0.220401 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:44.065533 0.655551 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:44.721591 0.058238 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:44.780301 0.218596 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:44.999387 0.164735 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:45.164556 0.060472 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:45.225405 0.147369 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:45.373209 0.145846 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:45.519507 0.135276 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:17:45.655217 0.000000 udp 10.0.2.105 7010 -> 213.123.9.32 1534 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 06:17:50.862739 0.000000 tcp 10.0.2.105 64905 -> 79.219.117.112 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:18:04.514113 0.051021 tcp 10.0.2.105 64906 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:18:04.565520 0.071178 tcp 10.0.2.105 64907 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:18:04.637055 0.165859 tcp 10.0.2.105 64908 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:18:04.801774 0.144168 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:04.946426 0.208468 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:04.946788 3.000177 tcp 10.0.2.105 64909 -> 70.52.239.176 2512 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:18:05.155296 0.161002 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:05.316731 0.359192 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:05.676455 0.418214 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:06.095018 0.286871 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:18:14.974185 0.000000 tcp 10.0.2.105 64909 -> 70.52.239.176 2512 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:22:08.164570 3.002104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 06:22:15.172617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:22:23.173557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:22:39.177035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:23:11.183061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:29:15.190601 2.999883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:29:22.196232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:29:30.198002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:29:46.202602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:30:18.206899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:34:42.827952 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 06:34:42.828060 1.004859 tcp 10.0.2.105 64910 -> 95.104.50.9 3421 FSPA* 0 0 15 1550 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:36:22.213299 3.001692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:36:29.220594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:36:37.221776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:36:53.224927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:37:25.230904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:43:29.236791 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 06:43:36.244163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:43:44.245921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:44:00.248516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:44:32.254451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:48:16.477835 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 06:48:16.478093 0.000000 udp 10.0.2.105 7010 -> 213.123.9.32 1534 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 06:48:35.236423 0.053791 tcp 10.0.2.105 64911 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:35.290550 0.075488 tcp 10.0.2.105 64912 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:35.366306 0.170827 tcp 10.0.2.105 64913 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:35.537769 0.119005 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:35.657192 0.104424 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:35.762139 0.194215 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:35.956786 0.028742 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:35.986057 0.000000 udp 10.0.2.105 7010 -> 69.172.4.50 9850 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 06:48:35.986480 2.993038 tcp 10.0.2.105 64914 -> 79.219.117.112 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:48:44.978084 0.000000 tcp 10.0.2.105 64914 -> 79.219.117.112 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:48:52.670009 0.062842 tcp 10.0.2.105 64915 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:52.733135 0.072882 tcp 10.0.2.105 64916 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:52.806317 0.160849 tcp 10.0.2.105 64917 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:48:52.966701 0.051048 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:53.018189 0.080887 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:53.099515 0.313526 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:53.413407 0.056493 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:53.470268 2.680848 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:56.151491 0.263185 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:56.415080 0.176001 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:56.591506 0.146408 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:56.738349 0.217430 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:56.956406 0.175090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:57.131903 0.973761 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:58.106030 0.230794 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:48:58.337323 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 06:49:14.431722 0.052606 tcp 10.0.2.105 64918 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:14.484173 0.077712 tcp 10.0.2.105 64919 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:14.562268 0.165293 tcp 10.0.2.105 64920 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:14.728369 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 06:49:30.524181 0.053456 tcp 10.0.2.105 64921 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:30.577998 0.070575 tcp 10.0.2.105 64922 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:30.648891 0.170162 tcp 10.0.2.105 64923 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 06:49:30.819631 0.059474 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:30.879525 0.143236 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.023257 0.133805 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.023619 2.995128 tcp 10.0.2.105 64924 -> 70.30.170.125 7404 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:49:31.157542 0.059928 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.217906 0.146690 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.365110 0.217995 udp 10.0.2.105 7010 <-> 107.208.6.50 4750 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.583580 0.142241 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:31.726239 0.420386 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:32.147117 0.156840 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:32.304433 0.352306 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:32.657205 0.290760 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/06 06:49:40.017098 0.000000 tcp 10.0.2.105 64924 -> 70.30.170.125 7404 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 06:54:12.260934 3.002209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 06:54:19.268993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:54:27.270344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:54:43.273204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 06:55:15.279538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:01:19.286513 3.000693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:01:26.292782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:01:34.294000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:01:50.298065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:02:22.303229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:04:43.837049 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:04:43.837231 0.537529 tcp 10.0.2.105 64925 -> 95.104.50.9 3421 FSPA* 0 0 15 1749 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:08:26.312901 2.998093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:08:33.317006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:08:41.318129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:08:57.321190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:09:29.327734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:15:39.343068 3.000544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:15:46.349458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:15:54.350981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:16:10.353503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:16:42.359917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:19:51.682182 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:19:51.682274 0.183846 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:51.866560 0.164457 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:52.031497 0.647476 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:52.031956 2.994845 tcp 10.0.2.105 64926 -> 99.135.106.151 4390 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 07:19:52.679398 0.181575 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:52.861414 0.239152 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:53.100967 0.116329 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:19:53.217660 0.000000 udp 10.0.2.105 7010 -> 79.219.117.112 2430 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:20:01.025706 0.000000 tcp 10.0.2.105 64926 -> 99.135.106.151 4390 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 07:20:08.278077 0.110850 tcp 10.0.2.105 64927 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:08.389274 0.069042 tcp 10.0.2.105 64928 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:08.458669 0.239726 tcp 10.0.2.105 64929 -> 195.113.214.251 443 SRPA* 0 0 73 77634 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:08.699088 0.058499 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:08.757978 0.084168 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:08.842615 0.056092 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:08.899206 0.331066 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:09.230676 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:20:16.345636 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:20:16.346113 0.144722 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:16.346480 2.976703 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 07:20:16.491208 0.072884 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:16.564671 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:20:23.223268 0.000353 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 PA_SA 0 0 4 300 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:30.767171 2.775565 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 9 3998 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:32.982038 0.048035 tcp 10.0.2.105 64931 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:33.030382 0.077040 tcp 10.0.2.105 64932 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:33.107796 0.165429 tcp 10.0.2.105 64933 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:33.273784 0.171307 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:33.445571 0.220828 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:33.666845 0.214846 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:33.882045 0.229682 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.112120 0.143060 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.255605 0.130984 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.389464 0.068537 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.458448 0.148032 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.606881 0.060854 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.668130 0.144004 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:34.812524 0.374531 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:35.187456 0.000000 udp 10.0.2.105 7010 -> 107.208.6.50 4750 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:20:38.153993 2.548465 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 9 5170 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:43.945524 3.248821 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 6 2372 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:49.497072 3.292340 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 12 6792 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:51.498703 0.049635 tcp 10.0.2.105 64934 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:51.548564 0.075298 tcp 10.0.2.105 64935 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:51.624143 0.155430 tcp 10.0.2.105 64936 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:20:51.780099 0.157087 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:51.937649 0.356724 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:52.294794 0.289708 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:20:58.221490 1.398276 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 9 4582 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:21:12.756976 1.253647 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:21:17.865864 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:21:32.883497 2.427504 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:21:42.075629 0.395920 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 7 4758 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:21:46.867565 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:21:56.061500 0.200219 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 5 4082 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:22:22.747061 0.392817 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 4 1676 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:22:27.866544 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:22:30.089826 0.200647 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 A_PA 0 0 5 3190 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:22:37.019696 0.200709 tcp 10.0.2.105 64930 -> 79.25.16.144 1027 FA_F* 0 0 7 4190 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:22:46.366197 3.001371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 07:22:53.373366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:23:01.375021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:23:17.377836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:23:49.384984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:29:53.390249 3.001369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:30:00.397411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:30:08.399123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:30:24.401978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:30:56.407757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:34:44.366185 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:34:44.366276 0.527048 tcp 10.0.2.105 64937 -> 95.104.50.9 3421 FSPA* 0 0 15 1668 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:37:00.414279 3.001120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:37:07.421186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:37:15.422864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:37:31.425705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:38:03.432008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:44:07.437721 3.001994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 07:44:14.445101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:44:22.446804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:44:38.449789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:45:10.462132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:51:12.246364 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:51:12.246563 0.028968 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:12.276391 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:51:12.276925 2.992813 tcp 10.0.2.105 64938 -> 79.219.117.112 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 07:51:21.269143 0.000000 tcp 10.0.2.105 64938 -> 79.219.117.112 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 07:51:29.452693 0.057236 tcp 10.0.2.105 64939 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:29.510267 0.071967 tcp 10.0.2.105 64940 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:29.582597 0.154918 tcp 10.0.2.105 64941 -> 195.113.214.251 443 SRPA* 0 0 53 41370 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:29.738626 0.000000 udp 10.0.2.105 7010 -> 107.208.6.50 4750 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:51:45.584491 0.052627 tcp 10.0.2.105 64942 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:45.636965 0.076418 tcp 10.0.2.105 64943 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:45.713743 0.173611 tcp 10.0.2.105 64944 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:45.887916 0.191297 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:46.079700 0.184762 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:46.264957 0.547207 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:46.812687 0.163043 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:46.813087 4.416214 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 SPA_* 0 0 10 2278 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:46.976170 0.083515 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.060090 0.091078 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.151556 0.057336 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.209281 0.058336 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.268093 0.078658 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.347284 0.247521 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:47.595222 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:51:52.666488 2.747482 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 26 17436 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:54.668254 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 07:51:54.668742 0.145062 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:54.814249 0.073472 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:54.888183 0.169047 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:55.057779 0.220426 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:55.278662 0.146877 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:55.426000 2.187426 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:57.613936 0.074152 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:57.688748 0.220636 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:57.909867 0.200751 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.111063 0.144634 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.256145 0.394750 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.651409 0.147682 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.799615 0.059338 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.859373 0.155101 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:58.905380 4.424328 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 10964 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:51:59.014894 0.294091 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:51:59.309383 0.280865 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/06 07:52:05.268221 4.800198 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 9444 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:10.352797 3.722189 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 35 18978 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:14.865756 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:52:22.967658 4.092533 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 21 9898 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:28.521027 3.789476 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 6466 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:33.934111 4.832559 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 19 7838 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:40.379583 4.779915 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:46.370334 4.637638 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 6990 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:52.477558 4.749207 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:52:54.863211 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:52:57.697047 4.907262 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 6682 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:04.323208 4.772786 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 6736 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:09.776470 0.929526 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:15.521000 3.374434 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:20.360192 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:53:20.541366 4.886192 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 20 7368 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:25.989583 4.515209 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 5 2890 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:31.022646 4.807860 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:36.032634 3.228324 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:41.268921 4.635036 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:46.571485 4.900097 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 33 13310 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:53:52.997828 0.199487 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 2 236 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:01.272075 3.672086 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 5514 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:06.328826 1.938364 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 10 4220 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:06.365889 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:54:12.472458 4.759366 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:18.874258 4.385633 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:24.828642 2.607828 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:30.361345 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:54:30.948488 4.950058 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:33.467800 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 07:54:36.098585 4.897487 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:40.475530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:54:41.477266 1.551368 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:46.861193 4.524953 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:54:48.476541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:54:54.865848 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:54:55.391005 0.206544 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:03.882328 2.920721 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:04.480151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:55:15.581847 2.807893 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 6 1896 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:20.362755 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:55:27.028466 4.994734 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 27 10366 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:32.033824 4.932563 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:36.485780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 07:55:37.418021 1.661543 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 8 4100 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:49.101577 4.727204 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:54.465690 4.933092 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 5310 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:55:57.866650 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:55:59.824954 4.958959 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:04.984528 4.558640 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 21 9518 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:11.095694 4.286009 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:16.927063 3.278355 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:21.861056 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:56:22.250158 3.556455 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:27.538734 4.740610 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:32.872052 4.289431 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 6682 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:38.473488 0.201898 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 2 424 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:56:59.706760 4.963768 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 5048 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:04.709994 4.711047 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 20 6920 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:04.862723 0.000230 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:57:12.955947 3.583541 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 5758 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:18.448882 4.897620 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 4316 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:24.045985 4.851583 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:29.097213 4.235071 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:35.094798 4.711832 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 9356 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:36.869000 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:57:40.264460 4.806121 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 6682 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:46.433674 4.094983 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 4316 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:52.018483 4.528458 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 5364 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:57:57.075537 3.116288 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 21 7946 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:00.863391 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:58:03.837454 4.540229 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 4662 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:09.134594 4.573058 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:14.361200 4.882497 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 22 8524 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:19.439979 4.490022 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 19 7838 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:27.930059 4.178202 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 25 10062 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:33.704382 4.582769 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 6084 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:42.439434 2.747592 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:42.863712 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:58:48.840366 4.688654 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 20 7368 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:54.259602 4.651365 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 16 8724 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:58:59.587626 3.833081 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 23 9102 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:04.868993 0.206944 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:06.868350 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:59:14.001536 4.452930 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 8832 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:26.599390 4.989353 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:31.363457 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 07:59:31.794080 2.220704 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:38.283155 4.404913 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:44.508285 4.984800 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 16 7676 flow=From-Botnet-V2-TCP-Established 1970/02/06 07:59:51.123565 0.198484 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:00.183517 4.888798 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:05.361765 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:00:05.382975 3.784530 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 4894 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:10.863135 0.858442 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:19.799126 4.476516 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:25.000131 3.705764 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 6990 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:29.867704 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:00:30.569858 2.071689 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:41.496326 4.868570 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 27 12462 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:46.561710 3.354851 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 20 7892 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:51.599207 4.676077 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 16 6460 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:00:58.305471 3.965730 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 7790 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:04.360829 4.286191 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 29 11510 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:10.393099 4.478992 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 21 8482 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:16.408126 4.383975 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 21 8994 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:17.365519 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:01:21.456825 1.627219 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 10 3224 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:26.714976 4.428796 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 14 6980 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:35.457069 3.343036 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 9 3106 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:40.492473 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 08:01:40.687700 0.893277 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:42.862648 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:01:47.499444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:01:50.810757 4.436300 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 20 7892 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:01:55.500776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:01:56.617228 4.813683 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 24 10204 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:02.171871 4.364771 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:08.601088 4.494757 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 4316 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:11.503712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:02:14.217034 3.906115 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 22 10096 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:20.653690 4.008460 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:25.363595 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:02:26.372444 4.859508 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 7622 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:31.759624 4.960280 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:37.205441 4.971963 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 5364 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:42.813417 3.431252 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:43.509834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:02:50.359360 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:02:50.709563 4.420842 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 6682 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:02:56.967793 3.327669 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:02.181688 2.177889 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 12 5364 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:08.947084 4.235401 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 4570 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:14.755003 4.822502 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:20.389872 2.787294 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:25.421501 4.575017 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:33.861920 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:03:39.017086 4.188583 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 17 7206 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:47.264627 4.620699 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:52.522780 4.607148 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 15 6574 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:03:57.866685 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:04:05.532097 2.652390 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:04:12.108567 4.805609 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:04:18.543920 4.278310 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 FPA_* 0 0 15 3771 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:04:21.861161 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:04:23.580585 0.000436 tcp 10.0.2.105 64945 -> 200.84.7.244 8038 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:04:44.894799 0.531450 tcp 10.0.2.105 64946 -> 95.104.50.9 3421 FSPA* 0 0 15 1802 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:08:47.516803 3.000501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 08:08:54.523119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:09:02.524905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:09:18.527907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:09:50.535256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:15:59.547260 3.001536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 08:16:06.554165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:16:14.555884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:16:30.559198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:17:02.564782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:22:13.242060 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:22:13.242158 0.029167 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:13.271824 0.188788 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:13.272262 3.003801 tcp 10.0.2.105 64947 -> 79.219.117.112 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 08:22:13.461015 0.181953 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:13.643391 0.756335 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:14.400171 0.165637 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:14.566300 0.080125 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:14.646881 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:22:22.274661 0.000000 tcp 10.0.2.105 64947 -> 79.219.117.112 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 08:22:32.046188 0.050891 tcp 10.0.2.105 64948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:32.097385 0.072942 tcp 10.0.2.105 64949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:32.170620 0.162690 tcp 10.0.2.105 64950 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:32.332142 0.059937 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 592 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:32.392744 0.056240 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:32.449519 0.079124 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:32.529104 0.327993 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:32.857490 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:22:39.975005 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:22:39.975560 0.233209 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:39.975990 2.998702 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 08:22:40.209182 0.071319 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:40.280959 0.168234 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:40.449712 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:22:47.221521 0.000476 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 PA_SA 0 0 4 387 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:54.272745 3.522784 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 9 3998 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:57.696317 0.049630 tcp 10.0.2.105 64952 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:57.746257 0.076992 tcp 10.0.2.105 64953 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:57.823609 0.176143 tcp 10.0.2.105 64954 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:22:58.000524 0.146565 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.147515 0.214458 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.362453 0.134411 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.497342 0.068036 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.565851 0.207578 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.773893 0.142524 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:58.916766 0.437117 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:59.354289 0.156160 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:22:59.510907 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:23:01.220870 0.200324 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 5 2598 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:08.575224 3.000095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 08:23:14.099854 0.312029 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 6 4140 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:15.582048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:23:17.915103 0.649368 tcp 10.0.2.105 64955 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:18.564842 0.068273 tcp 10.0.2.105 64956 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:18.633400 0.162014 tcp 10.0.2.105 64957 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:18.796692 0.147702 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:23:18.944807 0.058425 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:23:19.003651 0.291472 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:23:20.957346 0.236191 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 8 3916 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:24.113245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:23:28.467583 4.923816 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 9 5194 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:35.664810 4.815918 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 8 4528 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:39.938131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:23:42.804125 4.372940 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 11 6434 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:45.147612 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:23:50.043350 4.063484 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 12 7684 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:23:57.730712 0.201164 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 5 3778 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:24:07.756405 0.195850 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 2 696 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:24:11.591700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:24:12.863602 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:24:34.661387 0.204062 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 8 6576 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:24:39.862696 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:24:41.693124 4.958081 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 5 3190 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:24:46.845982 2.333298 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 6 3244 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:25:07.725977 0.199082 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 2 412 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:25:12.433042 0.436735 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:25:34.896928 0.399199 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 4 1676 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:25:39.639574 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:25:42.153400 0.400728 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 A_PA 0 0 7 5062 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:25:49.308284 0.202764 tcp 10.0.2.105 64951 -> 79.25.16.144 9148 FA_F* 0 0 6 2372 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:30:15.599038 3.000498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 08:30:22.605265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:30:30.606636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:30:46.609762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:31:18.615831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:34:45.433897 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:34:45.433992 0.639588 tcp 10.0.2.105 64958 -> 95.104.50.9 3421 FSPA* 0 0 15 1632 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:37:22.622119 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 08:37:29.628949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:37:37.640599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:37:53.643658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:38:25.649800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:44:29.657287 3.000295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 08:44:36.663196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:44:44.664498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:45:00.667858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:45:32.674135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:53:47.755732 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 08:53:47.755938 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:54:03.090121 0.053275 tcp 10.0.2.105 64959 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:03.143672 0.071180 tcp 10.0.2.105 64960 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:03.215233 0.164873 tcp 10.0.2.105 64961 -> 195.113.214.251 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:03.379086 0.225039 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:54:03.604756 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:54:19.211615 0.053836 tcp 10.0.2.105 64962 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:19.265770 0.077465 tcp 10.0.2.105 64963 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:19.343067 0.158722 tcp 10.0.2.105 64964 -> 195.113.214.251 443 SRPA* 0 0 43 21522 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:19.502616 0.031207 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:54:19.534354 0.000000 udp 10.0.2.105 7010 -> 69.172.4.50 9850 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:54:19.534728 3.000665 tcp 10.0.2.105 64965 -> 79.219.117.112 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 08:54:28.534675 0.000000 tcp 10.0.2.105 64965 -> 79.219.117.112 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 08:54:35.174308 0.052567 tcp 10.0.2.105 64966 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:35.227127 0.066174 tcp 10.0.2.105 64967 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:35.293586 0.157575 tcp 10.0.2.105 64968 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:35.450925 0.209225 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:54:35.660610 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:54:44.680806 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 08:54:51.087410 0.052593 tcp 10.0.2.105 64969 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:51.139877 0.074319 tcp 10.0.2.105 64970 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:51.214510 0.154497 tcp 10.0.2.105 64971 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:54:51.369648 0.078313 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:54:51.448517 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:54:51.687577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:54:59.689045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:55:08.572629 0.076123 tcp 10.0.2.105 64972 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:08.649098 0.075189 tcp 10.0.2.105 64973 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:08.724677 0.157298 tcp 10.0.2.105 64974 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:08.882729 0.080563 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:08.963763 0.056715 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:09.020990 0.057879 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:09.079248 0.285398 udp 10.0.2.105 7010 <-> 79.32.198.44 3147 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:09.365073 0.072242 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:09.365415 3.605909 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 SPA_* 0 0 56 31378 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:09.437738 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:55:14.787128 4.698014 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 38 22532 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:15.691951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:55:19.993082 4.753879 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 26 18352 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:24.545568 0.052395 tcp 10.0.2.105 64976 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:24.598248 0.074592 tcp 10.0.2.105 64977 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:24.673119 0.153076 tcp 10.0.2.105 64978 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:24.826760 0.144697 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:24.971887 0.169019 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:25.141312 0.145841 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:25.287560 0.065870 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:25.353855 0.944438 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:25.703632 4.002971 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 44 28436 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:26.298695 0.141123 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:26.440460 0.131635 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:26.572717 0.213715 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:26.786828 0.378559 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:27.165787 0.156946 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:27.323139 0.278492 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:27.602143 0.147143 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:27.749765 0.059601 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:55:30.624548 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:55:31.483905 3.338089 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 17 11966 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:36.681316 4.912291 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 57 42610 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:43.400917 4.968385 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 28 18272 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:47.697815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 08:55:48.569109 4.989733 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 32 20272 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:53.766814 4.913096 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 35 22878 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:55:59.360872 4.473057 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 23 14094 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:05.634174 3.745061 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 58 35580 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:12.559338 4.569023 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 24 15012 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:17.747122 3.382512 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 21 14850 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:22.880922 4.226159 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_PA 0 0 45 30482 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:28.944149 4.582569 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 FPA_* 0 0 51 29550 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:34.406058 0.000165 tcp 10.0.2.105 64975 -> 79.32.198.44 4341 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:56:49.824195 0.178912 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:56:50.003487 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:57:07.284522 0.051993 tcp 10.0.2.105 64979 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:07.336831 0.073023 tcp 10.0.2.105 64980 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:07.410189 0.157929 tcp 10.0.2.105 64981 -> 195.113.214.251 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:07.568952 0.714830 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:08.284368 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:57:15.445166 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:57:15.445524 0.225247 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:15.671142 0.028376 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:15.699913 0.206666 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:15.906993 0.070695 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:15.978182 0.048243 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:16.026955 0.064474 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:16.091915 0.055900 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:16.148273 0.000000 udp 10.0.2.105 7010 -> 79.32.198.44 3147 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 08:57:33.410604 0.053231 tcp 10.0.2.105 64982 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:33.463680 0.076688 tcp 10.0.2.105 64983 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:33.540670 0.156157 tcp 10.0.2.105 64984 -> 195.113.214.251 443 SRPA* 0 0 27 11234 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:33.696353 0.071798 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:33.768651 0.151074 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:33.920170 0.169441 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.090062 0.144816 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.235295 0.055223 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.290999 0.196738 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.488097 0.142088 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.630679 0.131731 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.762849 0.214580 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:34.792364 0.629356 tcp 10.0.2.105 64985 -> 95.104.50.9 3421 FSPA* 0 0 15 1741 flow=From-Botnet-V2-TCP-Established 1970/02/06 08:57:34.977882 0.379477 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:35.357832 0.143697 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:35.502001 0.053417 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:35.555856 0.156623 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/06 08:57:35.712896 0.277888 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:01:51.713602 3.055957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 09:01:58.748481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:02:06.732785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:02:22.736106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:02:54.741529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:09:03.756095 3.000220 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:09:10.762654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:09:19.230946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:09:35.048449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:10:07.870747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:16:12.782258 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:16:19.789207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:16:27.791567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:16:43.793873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:17:15.800249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:23:21.809090 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:23:28.816170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:23:36.818142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:23:52.820872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:24:24.826241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:27:35.421072 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 09:27:35.421374 0.735959 tcp 10.0.2.105 64986 -> 95.104.50.9 3421 FSPA* 0 0 15 1755 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:27:55.640062 0.000000 udp 10.0.2.105 7010 -> 79.32.198.44 3147 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:28:00.376694 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 09:28:13.467654 0.051927 tcp 10.0.2.105 64987 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:28:13.519888 0.076561 tcp 10.0.2.105 64988 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:28:13.596762 0.164981 tcp 10.0.2.105 64989 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:28:13.760205 0.180237 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:13.940876 0.617836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:14.559117 0.219701 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:14.779208 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:28:21.708764 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:28:21.709212 0.029604 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:21.739228 0.089958 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:21.829607 0.056935 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:21.886974 0.084510 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:21.971908 0.081550 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.053900 0.206043 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.260417 0.084609 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.345459 0.147285 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.493219 0.168665 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.662368 0.146643 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.809436 0.064226 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:22.874111 0.205321 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.079834 0.218634 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.298945 0.141819 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.441245 0.134297 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.575949 0.059791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.636125 0.155165 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:23.791656 0.372259 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:24.164366 0.146612 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:28:24.311410 0.277763 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:30:28.832247 3.002395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 09:30:35.840165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:30:43.841742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:30:59.844664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:31:31.850331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:37:35.857281 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:37:42.864028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:37:50.865352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:38:06.868863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:38:38.874814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:44:42.880709 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:44:49.888155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:44:57.889662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:45:13.892733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:45:45.898818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:54:51.906374 3.011672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 09:54:58.923868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:55:06.925426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:55:22.928201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:55:54.934648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 09:57:36.160474 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 09:57:36.160581 3.004080 tcp 10.0.2.105 64990 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:57:45.162998 0.000000 tcp 10.0.2.105 64990 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:57:51.163285 0.050851 tcp 10.0.2.105 64991 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:57:51.214391 0.079283 tcp 10.0.2.105 64992 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:57:51.294010 0.164681 tcp 10.0.2.105 64993 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:57:51.483655 3.005035 tcp 10.0.2.105 64994 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:00.484808 0.000000 tcp 10.0.2.105 64994 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:06.484417 0.049534 tcp 10.0.2.105 64995 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:06.534258 0.078058 tcp 10.0.2.105 64996 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:06.612137 0.165476 tcp 10.0.2.105 64997 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:06.810449 2.998034 tcp 10.0.2.105 64998 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:15.817100 0.000000 tcp 10.0.2.105 64998 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:21.806046 0.050401 tcp 10.0.2.105 64999 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:21.856780 0.075798 tcp 10.0.2.105 65000 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:21.932831 0.305917 tcp 10.0.2.105 65001 -> 195.113.214.251 443 SRPA* 0 0 29 14130 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:22.251889 2.988871 tcp 10.0.2.105 65002 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:31.239352 0.000000 tcp 10.0.2.105 65002 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:34.413988 0.183048 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:34.597478 0.641474 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:35.239345 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:58:37.248008 0.050366 tcp 10.0.2.105 65003 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:37.298625 0.076555 tcp 10.0.2.105 65004 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:37.374965 0.168830 tcp 10.0.2.105 65005 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:37.553867 3.104733 tcp 10.0.2.105 65006 -> 46.48.223.67 15494 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:40.365391 0.049670 tcp 10.0.2.105 65007 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:40.415368 0.067256 tcp 10.0.2.105 65008 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:40.482986 0.164488 tcp 10.0.2.105 65009 -> 195.113.214.251 443 SRPA* 0 0 43 22186 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:40.658934 3.008068 tcp 10.0.2.105 65010 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:49.665240 0.000000 tcp 10.0.2.105 65010 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:52.332108 0.049064 tcp 10.0.2.105 65011 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:52.380997 0.068404 tcp 10.0.2.105 65012 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:52.449757 0.161395 tcp 10.0.2.105 65013 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:58:52.612054 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:58:55.654284 2.994232 tcp 10.0.2.105 65014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:58:59.013912 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:58:59.014308 0.028911 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.043602 0.079994 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.124040 0.065964 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.190455 0.083745 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.274553 0.080827 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.355792 0.201041 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.557239 0.076488 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.634146 0.144212 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:58:59.778812 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:04.656663 0.000000 tcp 10.0.2.105 65014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:59:10.655897 2.994027 tcp 10.0.2.105 65015 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:59:16.524821 0.049652 tcp 10.0.2.105 65016 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:59:16.574707 0.079599 tcp 10.0.2.105 65017 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:59:16.654103 0.157115 tcp 10.0.2.105 65018 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:59:16.811903 0.145904 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:16.958268 0.066142 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:17.024816 0.203527 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:17.228778 0.217511 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:17.446694 0.059582 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:17.506894 0.155032 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:17.662288 0.379243 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:18.041946 0.149659 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:18.191976 0.493423 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:18.685841 0.135176 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:18.821392 0.276580 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:19.119553 0.370708 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:19.490727 0.169311 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:19.648920 0.000000 tcp 10.0.2.105 65015 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:59:19.660768 0.188547 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:19.849825 0.679630 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:20.529939 0.030888 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:20.561289 0.077840 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:20.639580 0.047630 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:20.687741 0.069213 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:20.757481 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 REQ 0 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:25.657596 3.004047 tcp 10.0.2.105 65019 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:59:25.827554 0.068070 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 863 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:25.896164 0.146706 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.043409 0.063525 udp 10.0.2.105 7010 <-> 81.178.183.155 2433 CON 0 0 2 736 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.107499 0.196875 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.304868 0.146898 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.452154 0.059328 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.511933 0.207499 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 2 853 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.719934 0.215132 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.935649 0.051479 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:26.987724 0.157881 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:27.146105 0.382271 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 2 860 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:27.528903 0.146602 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:27.676072 0.130883 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:27.807600 0.278261 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:27.861592 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 537 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:28.086367 0.234190 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/02/06 09:59:28.321172 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:34.660151 0.000000 tcp 10.0.2.105 65019 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 09:59:36.032393 0.165853 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:36.198246 0.000000 icmp 66.55.26.130 0x0303 -> 10.0.2.105 0x2b20 URP 192 1 141 flow=Background 1970/02/06 09:59:40.659042 3.899840 tcp 10.0.2.105 65020 -> 46.48.223.67 15494 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/02/06 09:59:40.868803 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 09:59:42.752106 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 7217 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:48.019759 0.000000 udp 10.0.2.105 7010 -> 86.173.47.132 6363 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 09:59:53.056839 0.000000 udp 10.0.2.105 7010 -> 86.138.11.206 6515 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:00.517745 0.000000 udp 10.0.2.105 7010 -> 105.237.57.168 6590 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:09.370141 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:14.377434 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:00:17.082654 0.000000 udp 10.0.2.105 7010 -> 24.212.198.198 1160 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:25.123210 0.000000 udp 10.0.2.105 7010 -> 173.170.97.89 2754 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:33.915525 0.165478 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:00:34.104429 0.391484 udp 10.0.2.105 7010 -> 120.151.43.201 1024 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:34.495913 0.000000 icmp 120.151.43.201 0x0303 -> 10.0.2.105 0x0004 URP 192 1 160 flow=Background 1970/02/06 10:00:38.872583 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:00:41.656411 0.000000 udp 10.0.2.105 7010 -> 141.237.68.36 4707 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:49.007344 0.000000 udp 10.0.2.105 7010 -> 190.219.1.134 3038 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:00:57.029289 0.000000 udp 10.0.2.105 7010 -> 24.120.135.140 8093 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:04.449928 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:09.376482 0.000168 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:01:09.627016 0.000000 udp 10.0.2.105 7010 -> 2.127.95.229 4190 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:15.585522 0.000000 udp 10.0.2.105 7010 -> 92.30.168.251 4215 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:24.207915 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:29.925569 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:34.873024 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:01:36.235311 0.074773 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:01:36.455062 0.000000 udp 10.0.2.105 7010 -> 216.36.159.17 6061 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:42.804474 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:48.062286 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:53.380100 0.044872 udp 10.0.2.105 7010 <-> 5.13.47.128 2778 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:01:53.441213 0.000000 udp 10.0.2.105 7010 -> 85.110.219.24 5152 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:01:58.940940 3.001069 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:02:01.621835 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:05.947760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:02:06.368510 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:02:06.899099 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:13.949473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:02:14.880188 0.000000 udp 10.0.2.105 7010 -> 173.212.182.129 1241 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:20.038270 0.000000 udp 10.0.2.105 7010 -> 178.204.28.6 2822 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:27.177925 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:29.951968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:02:31.874406 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:02:34.689423 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:40.567702 0.000000 udp 10.0.2.105 7010 -> 109.228.134.23 7400 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:48.949811 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:56.420443 0.186997 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:02:56.607440 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 325 flow=Background 1970/02/06 10:03:01.377356 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:03:01.958205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:03:04.042037 0.172681 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:03:04.250294 0.000000 udp 10.0.2.105 7010 -> 87.23.194.227 8571 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:10.159802 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:15.167385 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:23.039002 0.000000 udp 10.0.2.105 7010 -> 79.33.225.176 2977 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:27.875287 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:03:30.930229 0.000000 udp 10.0.2.105 7010 -> 78.146.6.232 3129 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:39.202297 0.053021 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:03:39.282516 0.000000 udp 10.0.2.105 7010 -> 67.167.30.251 9503 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:48.195010 0.072228 udp 10.0.2.105 7010 -> 80.145.47.88 8957 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:03:48.267238 0.000000 icmp 80.145.47.88 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 133 flow=Background 1970/02/06 10:03:52.871396 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:03:54.573999 0.000000 udp 10.0.2.105 7010 -> 79.35.30.63 2593 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:02.635586 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:10.529418 0.000000 udp 10.0.2.105 7010 -> 99.126.227.66 3840 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:16.936179 0.000000 udp 10.0.2.105 7010 -> 72.54.254.233 9680 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:21.873047 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:04:24.637327 0.063236 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:04:24.738608 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:30.605995 0.000000 udp 10.0.2.105 7010 -> 201.247.102.50 9184 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:38.928075 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:44.556303 2.998405 tcp 10.0.2.105 65021 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:04:46.969416 0.374204 udp 10.0.2.105 7010 -> 115.132.43.235 2219 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:47.343620 0.000000 icmp 115.132.43.235 0x0303 -> 10.0.2.105 0xab08 URP 192 1 151 flow=Background 1970/02/06 10:04:49.374601 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:04:53.548370 0.000000 tcp 10.0.2.105 65021 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:04:54.299954 0.075279 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:04:54.413879 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:04:59.559500 0.077310 tcp 10.0.2.105 65022 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:04:59.637107 0.077248 tcp 10.0.2.105 65023 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:04:59.714706 0.176075 tcp 10.0.2.105 65024 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:04:59.915889 2.996029 tcp 10.0.2.105 65025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:01.290283 0.000000 udp 10.0.2.105 7010 -> 66.240.7.34 7030 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:07.709334 0.000000 udp 10.0.2.105 7010 -> 80.2.53.164 2262 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:08.910579 0.000000 tcp 10.0.2.105 65025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:13.787799 0.000000 udp 10.0.2.105 7010 -> 213.23.227.92 6012 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:14.910281 0.050002 tcp 10.0.2.105 65026 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:14.960659 0.072833 tcp 10.0.2.105 65027 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:15.033825 0.157219 tcp 10.0.2.105 65028 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:15.248892 3.005363 tcp 10.0.2.105 65029 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:19.276095 0.090302 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:05:19.421376 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:24.252977 0.000000 tcp 10.0.2.105 65029 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:26.756422 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:30.242293 0.050541 tcp 10.0.2.105 65030 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:30.293170 0.068230 tcp 10.0.2.105 65031 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:30.361769 0.164709 tcp 10.0.2.105 65032 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:31.452598 2.457853 tcp 10.0.2.105 65033 -> 46.48.223.67 15494 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:33.125943 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:33.196600 0.052001 tcp 10.0.2.105 65034 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:33.249036 0.072456 tcp 10.0.2.105 65035 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:33.321851 0.174371 tcp 10.0.2.105 65036 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:33.910816 3.000816 tcp 10.0.2.105 65037 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:39.735248 0.000000 udp 10.0.2.105 7010 -> 87.2.63.194 6692 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:42.909560 0.000000 tcp 10.0.2.105 65037 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:48.598023 0.000000 udp 10.0.2.105 7010 -> 86.146.40.194 9510 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:48.909146 0.048954 tcp 10.0.2.105 65038 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:48.958451 0.074376 tcp 10.0.2.105 65039 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:49.033254 0.158428 tcp 10.0.2.105 65040 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:05:49.290491 3.002660 tcp 10.0.2.105 65041 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:05:56.419295 0.000000 udp 10.0.2.105 7010 -> 173.86.92.49 7891 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:05:58.291727 0.000000 tcp 10.0.2.105 65041 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:02.458192 0.000000 udp 10.0.2.105 7010 -> 176.61.121.157 8525 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:04.290930 3.004566 tcp 10.0.2.105 65042 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:10.799689 0.000000 udp 10.0.2.105 7010 -> 151.72.213.230 4626 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:13.293215 0.000000 tcp 10.0.2.105 65042 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:15.376383 0.012837 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:06:19.292099 3.004334 tcp 10.0.2.105 65043 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:19.643066 0.000000 udp 10.0.2.105 7010 -> 66.216.207.5 4340 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:26.292340 0.000000 udp 10.0.2.105 7010 -> 199.91.205.110 9259 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:28.294953 0.000000 tcp 10.0.2.105 65043 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:32.982927 0.000000 udp 10.0.2.105 7010 -> 2.34.219.232 1029 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:34.293779 0.353533 tcp 10.0.2.105 65044 -> 46.48.223.67 15494 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:06:40.352516 0.000000 udp 10.0.2.105 7010 -> 79.19.85.60 1226 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:40.417787 0.000732 tcp 10.0.2.105 65044 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:06:40.418347 3.007884 tcp 10.0.2.105 65045 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:48.153673 0.000000 udp 10.0.2.105 7010 -> 99.113.208.131 1643 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:06:49.425677 0.000000 tcp 10.0.2.105 65045 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:06:55.233860 0.000000 udp 10.0.2.105 7010 -> 95.244.103.63 1675 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:01.884858 0.000000 udp 10.0.2.105 7010 -> 158.108.232.83 1500 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:06.870617 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:07:08.452938 0.065878 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:07:09.340130 0.000000 udp 10.0.2.105 7010 -> 217.116.15.203 7632 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:15.172905 0.000000 udp 10.0.2.105 7010 -> 178.167.150.90 8966 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:21.902503 0.000000 udp 10.0.2.105 7010 -> 186.167.243.91 4722 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:30.644502 0.000000 udp 10.0.2.105 7010 -> 94.27.148.116 4662 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:35.371437 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:07:37.695095 0.000000 udp 10.0.2.105 7010 -> 85.96.2.102 7641 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:45.325895 0.000000 udp 10.0.2.105 7010 -> 86.180.195.81 9052 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:52.215555 0.000000 udp 10.0.2.105 7010 -> 219.74.86.103 9418 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:07:59.776643 0.000000 udp 10.0.2.105 7010 -> 91.55.165.231 8457 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:04.372955 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:08:07.598026 0.000000 udp 10.0.2.105 7010 -> 87.14.255.154 5907 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:15.570928 0.000000 udp 10.0.2.105 7010 -> 46.197.69.240 6253 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:23.510231 0.000000 udp 10.0.2.105 7010 -> 92.24.143.23 6671 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:28.377657 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:08:31.512872 0.000000 udp 10.0.2.105 7010 -> 70.54.88.112 4284 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:40.505480 0.000000 udp 10.0.2.105 7010 -> 188.13.62.92 8086 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:46.834330 0.244238 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:08:47.261004 0.000000 udp 10.0.2.105 7010 -> 80.111.159.155 5383 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:53.894509 0.032927 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:08:54.061322 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:08:58.871372 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:09:00.153354 0.000000 udp 10.0.2.105 7010 -> 87.143.196.150 9568 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:06.663178 0.000000 udp 10.0.2.105 7010 -> 110.143.73.245 5640 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:08.969749 3.000650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:09:15.285367 0.000000 udp 10.0.2.105 7010 -> 109.156.42.192 6659 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:15.975849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:09:20.783307 0.000000 udp 10.0.2.105 7010 -> 37.19.98.77 7225 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:23.977487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:09:25.369646 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:09:29.776164 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:38.688464 0.000000 udp 10.0.2.105 7010 -> 63.235.116.226 2966 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:39.980549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:09:45.688833 0.000000 udp 10.0.2.105 7010 -> 186.129.141.69 4747 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:50.376026 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:09:52.548880 0.000000 udp 10.0.2.105 7010 -> 94.123.54.58 1986 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:09:58.757636 0.000000 udp 10.0.2.105 7010 -> 87.126.159.30 6262 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:05.067362 0.000000 udp 10.0.2.105 7010 -> 77.100.83.165 1788 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:11.988300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:10:12.268518 0.000000 udp 10.0.2.105 7010 -> 95.254.98.207 5317 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:16.873574 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:10:19.467757 0.109931 udp 10.0.2.105 7010 <-> 188.29.42.200 5541 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:19.681803 0.000000 udp 10.0.2.105 7010 -> 63.120.127.134 4601 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:25.135784 0.000000 udp 10.0.2.105 7010 -> 80.229.184.159 7192 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:33.438053 0.000000 udp 10.0.2.105 7010 -> 125.215.190.253 6121 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:41.879564 0.047368 udp 10.0.2.105 7010 <-> 78.149.127.5 2973 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:42.203989 0.000000 udp 10.0.2.105 7010 -> 121.9.233.180 5737 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:46.876783 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:10:48.589652 0.147910 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:49.030462 0.000000 udp 10.0.2.105 7010 -> 92.234.13.84 2439 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:10:55.549852 0.229271 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 725 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:55.872602 0.396359 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:56.514745 0.054771 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:56.707454 0.172151 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 2 846 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:10:57.067868 0.000000 udp 10.0.2.105 7010 -> 86.24.80.186 4208 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:02.179038 0.000000 udp 10.0.2.105 7010 -> 46.117.142.212 8198 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:08.998976 0.000000 udp 10.0.2.105 7010 -> 177.102.101.174 9356 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:13.875625 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:11:17.991820 0.000000 udp 10.0.2.105 7010 -> 220.245.207.194 6147 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:25.963403 0.000000 udp 10.0.2.105 7010 -> 80.99.127.50 1813 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:34.385368 0.000000 udp 10.0.2.105 7010 -> 87.10.23.104 6577 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:39.372275 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:11:41.735748 0.000000 udp 10.0.2.105 7010 -> 79.39.194.144 1811 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:47.534179 0.171739 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:11:48.054973 0.000000 udp 10.0.2.105 7010 -> 90.204.26.193 1189 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:11:55.415733 2.993996 tcp 10.0.2.105 65046 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:11:55.705492 0.000000 udp 10.0.2.105 7010 -> 87.101.187.138 4973 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:12:03.376390 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:12:04.388391 0.000000 udp 10.0.2.105 7010 -> 72.54.156.29 6941 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:12:04.408418 0.000000 tcp 10.0.2.105 65046 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:10.419469 0.050703 tcp 10.0.2.105 65047 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:10.470466 0.077787 tcp 10.0.2.105 65048 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:10.548047 0.158990 tcp 10.0.2.105 65049 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:10.833422 2.998312 tcp 10.0.2.105 65050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:11.649034 0.000000 udp 10.0.2.105 7010 -> 82.10.76.233 9809 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:12:19.830222 0.000000 tcp 10.0.2.105 65050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:25.829516 0.049189 tcp 10.0.2.105 65051 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:25.879098 0.076037 tcp 10.0.2.105 65052 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:25.955437 0.153747 tcp 10.0.2.105 65053 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:26.266796 2.997002 tcp 10.0.2.105 65054 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:35.271989 0.000000 tcp 10.0.2.105 65054 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:41.261682 0.050909 tcp 10.0.2.105 65055 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:41.312427 0.077913 tcp 10.0.2.105 65056 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:41.390698 0.171086 tcp 10.0.2.105 65057 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:42.181225 4.364801 tcp 10.0.2.105 65058 -> 46.48.223.67 15494 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:45.945014 0.070882 tcp 10.0.2.105 65059 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:46.016154 0.072659 tcp 10.0.2.105 65060 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:46.089346 0.161419 tcp 10.0.2.105 65061 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:12:46.546306 2.996844 tcp 10.0.2.105 65062 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:12:55.541862 0.000000 tcp 10.0.2.105 65062 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:01.542663 0.069128 tcp 10.0.2.105 65063 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:13:01.612384 0.072585 tcp 10.0.2.105 65064 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:13:01.685271 0.253167 tcp 10.0.2.105 65065 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:13:02.834616 3.001819 tcp 10.0.2.105 65066 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:11.835960 0.000000 tcp 10.0.2.105 65066 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:17.824151 2.993807 tcp 10.0.2.105 65067 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:25.374563 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:13:26.826603 0.000000 tcp 10.0.2.105 65067 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:32.825950 2.993805 tcp 10.0.2.105 65068 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:41.817972 0.000000 tcp 10.0.2.105 65068 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:13:47.833114 3.776476 tcp 10.0.2.105 65069 -> 46.48.223.67 15494 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:13:51.609914 3.006615 tcp 10.0.2.105 65070 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:14:00.615403 0.000000 tcp 10.0.2.105 65070 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:16:15.997400 2.996708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:16:23.000171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:16:31.001350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:16:47.004827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:17:19.010014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:19:06.605741 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:19:06.605844 2.993830 tcp 10.0.2.105 65071 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:19:15.598051 0.000000 tcp 10.0.2.105 65071 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:19:21.608541 0.053221 tcp 10.0.2.105 65072 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:19:21.662056 0.077681 tcp 10.0.2.105 65073 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:19:21.739556 0.175638 tcp 10.0.2.105 65074 -> 195.113.214.251 443 SRPA* 0 0 32 24683 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:19:22.066869 3.005160 tcp 10.0.2.105 65075 -> 95.104.50.9 3421 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:19:31.070186 0.000000 tcp 10.0.2.105 65075 -> 95.104.50.9 3421 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:23:23.016864 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 10:23:30.024233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:23:38.025482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:23:54.028775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:24:26.034672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:30:30.041053 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 10:30:37.048576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:30:45.862313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:31:01.672702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:31:33.299375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:37:37.075407 3.000835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/06 10:37:44.081961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:37:52.083333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:38:08.086552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:38:40.092661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:42:25.937701 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:42:25.937948 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:42:43.405322 0.052991 tcp 10.0.2.105 65076 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:42:43.458621 0.112792 tcp 10.0.2.105 65077 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:42:43.571758 0.146614 tcp 10.0.2.105 65078 -> 195.113.214.251 443 SRPA* 0 0 36 26747 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:42:43.719225 0.172698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:42:43.889315 0.197179 udp 10.0.2.105 7010 <-> 69.172.4.50 9850 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:42:44.153413 0.363464 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:42:44.484947 0.000000 udp 10.0.2.105 7010 -> 79.219.117.112 2430 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:42:52.185456 2.993473 tcp 10.0.2.105 65079 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:43:01.177790 0.000000 tcp 10.0.2.105 65079 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:43:01.779492 0.049887 tcp 10.0.2.105 65080 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:01.829670 0.077801 tcp 10.0.2.105 65081 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:01.907784 0.163984 tcp 10.0.2.105 65082 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:02.070643 0.102530 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:02.157461 0.080654 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:02.219345 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:43:07.187196 0.049148 tcp 10.0.2.105 65083 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:07.236520 0.077014 tcp 10.0.2.105 65084 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:07.313848 0.175003 tcp 10.0.2.105 65085 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:07.497789 3.003430 tcp 10.0.2.105 65086 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:43:16.499903 0.000000 tcp 10.0.2.105 65086 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:43:18.934024 0.049617 tcp 10.0.2.105 65087 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:18.983993 0.071868 tcp 10.0.2.105 65088 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:19.056120 0.164427 tcp 10.0.2.105 65089 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:19.221102 0.114443 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:19.298658 0.166509 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:19.568425 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:43:34.667394 0.110748 tcp 10.0.2.105 65090 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:34.777970 0.085624 tcp 10.0.2.105 65091 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:34.863938 0.164547 tcp 10.0.2.105 65092 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:35.028211 0.190655 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:35.305973 0.170953 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:35.544777 0.080154 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:35.605823 0.256564 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:35.813069 0.063893 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:36.268028 0.175146 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:36.422557 0.395902 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:36.797958 0.174486 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:36.949187 0.151789 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:37.087473 0.291530 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:37.403693 0.227485 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:37.623735 0.174097 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:37.769681 0.172686 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:37.935450 0.105461 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.049386 0.047692 udp 10.0.2.105 7010 <-> 5.13.47.128 2778 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.182639 0.175295 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.355113 0.069814 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.447233 0.073090 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.587746 0.081951 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.806749 0.125942 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.890271 0.090530 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:38.946627 0.259023 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:39.204103 0.033979 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:39.329200 0.222130 udp 10.0.2.105 7010 <-> 188.29.42.200 5541 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:43:39.451290 0.000000 udp 10.0.2.105 7010 -> 78.149.127.5 2973 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:43:55.075736 0.049581 tcp 10.0.2.105 65093 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:55.125669 0.069697 tcp 10.0.2.105 65094 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:55.195682 0.167388 tcp 10.0.2.105 65095 -> 195.113.214.251 443 SRPA* 0 0 34 17706 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:43:55.363282 0.000000 udp 10.0.2.105 7010 -> 74.15.111.6 3208 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 10:44:13.242027 0.049878 tcp 10.0.2.105 65096 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:44:13.292241 0.077061 tcp 10.0.2.105 65097 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:44:13.369168 0.202686 tcp 10.0.2.105 65098 -> 195.113.214.251 443 SRPA* 0 0 55 32535 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:44:13.568606 0.238047 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:44:13.782927 0.070616 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:44:13.955496 0.085560 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:44:14.024689 0.177082 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:44:14.196868 0.176022 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 10:44:44.100094 3.000204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:44:51.106265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:44:59.107263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:45:15.110269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:45:47.116503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:48:22.500059 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:48:22.500170 3.009783 tcp 10.0.2.105 65099 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:48:31.502721 0.000000 tcp 10.0.2.105 65099 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:48:37.503421 1.900757 tcp 10.0.2.105 65100 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:39.404535 0.070495 tcp 10.0.2.105 65101 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:39.475402 0.214474 tcp 10.0.2.105 65102 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:40.514265 2.970793 tcp 10.0.2.105 65103 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:48:49.419072 0.000000 tcp 10.0.2.105 65103 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:48:55.336152 0.050420 tcp 10.0.2.105 65104 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:55.386358 0.071157 tcp 10.0.2.105 65105 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:55.457884 0.147398 tcp 10.0.2.105 65106 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:48:55.663885 2.961698 tcp 10.0.2.105 65107 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:04.550806 0.000000 tcp 10.0.2.105 65107 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:10.478438 0.049620 tcp 10.0.2.105 65108 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:10.528534 0.076222 tcp 10.0.2.105 65109 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:10.604500 0.188752 tcp 10.0.2.105 65110 -> 195.113.214.251 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:10.890751 2.955511 tcp 10.0.2.105 65111 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:19.772457 0.000000 tcp 10.0.2.105 65111 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:25.698853 0.048638 tcp 10.0.2.105 65112 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:25.747784 0.076007 tcp 10.0.2.105 65113 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:25.824097 0.142165 tcp 10.0.2.105 65114 -> 195.113.214.251 443 SRPA* 0 0 32 24683 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:26.005372 3.301380 tcp 10.0.2.105 65115 -> 46.48.247.67 29365 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:28.843796 0.126279 tcp 10.0.2.105 65116 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:28.970472 0.070718 tcp 10.0.2.105 65117 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:29.041053 0.164193 tcp 10.0.2.105 65118 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:49:29.307008 2.955550 tcp 10.0.2.105 65119 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:38.201845 0.000000 tcp 10.0.2.105 65119 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:44.129566 2.952115 tcp 10.0.2.105 65120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:53.135881 0.000000 tcp 10.0.2.105 65120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:49:57.888434 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:49:59.075616 2.967079 tcp 10.0.2.105 65121 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:50:07.967042 0.000000 tcp 10.0.2.105 65121 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:50:13.897654 2.970154 tcp 10.0.2.105 65122 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:50:21.593462 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:50:22.794673 0.000000 tcp 10.0.2.105 65122 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:50:28.720561 4.913139 tcp 10.0.2.105 65123 -> 46.48.247.67 29365 FSPA* 0 0 14 1705 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:51:51.122385 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:51:58.129511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:52:06.131522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:52:22.134105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:52:54.140572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:55:33.039367 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:55:33.039470 3.003665 tcp 10.0.2.105 65124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:55:42.042081 0.000000 tcp 10.0.2.105 65124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:55:48.043509 0.050760 tcp 10.0.2.105 65125 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:55:48.094601 0.072171 tcp 10.0.2.105 65126 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:55:48.167154 0.159777 tcp 10.0.2.105 65127 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:55:48.359674 3.005579 tcp 10.0.2.105 65128 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:55:57.363671 0.000000 tcp 10.0.2.105 65128 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:03.353195 0.049629 tcp 10.0.2.105 65129 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:03.403146 0.075251 tcp 10.0.2.105 65130 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:03.478732 0.168194 tcp 10.0.2.105 65131 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:03.657433 3.009835 tcp 10.0.2.105 65132 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:12.675830 0.000000 tcp 10.0.2.105 65132 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:18.654904 0.049739 tcp 10.0.2.105 65133 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:18.704913 0.070078 tcp 10.0.2.105 65134 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:18.775253 0.158147 tcp 10.0.2.105 65135 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:19.061928 2.997561 tcp 10.0.2.105 65136 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:28.058098 0.000000 tcp 10.0.2.105 65136 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:34.057474 0.050352 tcp 10.0.2.105 65137 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:34.108378 0.075782 tcp 10.0.2.105 65138 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:34.184479 0.174005 tcp 10.0.2.105 65139 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:35.181056 4.695030 tcp 10.0.2.105 65140 -> 46.48.247.67 29365 SPA_* 0 0 12 1416 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:39.873436 0.049711 tcp 10.0.2.105 65141 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:39.923477 0.071044 tcp 10.0.2.105 65142 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:39.994891 0.163829 tcp 10.0.2.105 65143 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:40.339705 0.000081 tcp 10.0.2.105 65140 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:56:40.340014 2.999785 tcp 10.0.2.105 65144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:49.338619 0.000000 tcp 10.0.2.105 65144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:56:55.337344 3.003990 tcp 10.0.2.105 65145 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:04.340362 0.000000 tcp 10.0.2.105 65145 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:08.876695 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:57:10.338940 3.004208 tcp 10.0.2.105 65146 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:19.341708 0.000000 tcp 10.0.2.105 65146 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:25.340758 3.003997 tcp 10.0.2.105 65147 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:32.871186 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 10:57:34.343545 0.000000 tcp 10.0.2.105 65147 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 10:57:40.343099 4.584750 tcp 10.0.2.105 65148 -> 46.48.247.67 29365 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/06 10:58:58.147612 3.000437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 10:59:05.153987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:59:13.155593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 10:59:29.157787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:00:01.163887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:02:44.919912 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:02:44.920018 3.004048 tcp 10.0.2.105 65149 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:02:53.922934 0.000000 tcp 10.0.2.105 65149 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:02:59.923134 0.054131 tcp 10.0.2.105 65150 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:02:59.977597 0.076388 tcp 10.0.2.105 65151 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:00.053818 0.155552 tcp 10.0.2.105 65152 -> 195.113.214.251 443 SRPA* 0 0 25 13912 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:00.227638 3.009331 tcp 10.0.2.105 65153 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:09.234970 0.000000 tcp 10.0.2.105 65153 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:15.224152 0.052266 tcp 10.0.2.105 65154 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:15.276719 0.066615 tcp 10.0.2.105 65155 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:15.343727 0.153226 tcp 10.0.2.105 65156 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:15.520002 2.998019 tcp 10.0.2.105 65157 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:24.526783 0.000000 tcp 10.0.2.105 65157 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:30.516159 0.067354 tcp 10.0.2.105 65158 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:30.583606 0.066725 tcp 10.0.2.105 65159 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:30.650641 0.155798 tcp 10.0.2.105 65160 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:30.816928 2.992918 tcp 10.0.2.105 65161 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:39.808568 0.000000 tcp 10.0.2.105 65161 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:45.817943 0.052604 tcp 10.0.2.105 65162 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:45.870874 0.075987 tcp 10.0.2.105 65163 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:45.947178 0.166309 tcp 10.0.2.105 65164 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:46.230751 4.752827 tcp 10.0.2.105 65165 -> 46.48.247.67 29365 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:50.689664 0.052149 tcp 10.0.2.105 65166 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:50.742091 0.070937 tcp 10.0.2.105 65167 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:50.813331 0.160507 tcp 10.0.2.105 65168 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:03:50.983814 2.994665 tcp 10.0.2.105 65169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:03:59.982564 0.000000 tcp 10.0.2.105 65169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:05.976332 2.993698 tcp 10.0.2.105 65170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:14.968880 0.000000 tcp 10.0.2.105 65170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:19.876386 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:04:20.978437 3.003858 tcp 10.0.2.105 65171 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:29.980599 0.000000 tcp 10.0.2.105 65171 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:35.979987 3.003837 tcp 10.0.2.105 65172 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:43.870421 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:04:44.982674 0.000000 tcp 10.0.2.105 65172 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:04:50.980912 4.275603 tcp 10.0.2.105 65173 -> 46.48.247.67 29365 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:06:13.172707 3.000911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:06:20.179271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:06:28.180453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:06:44.184382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:07:16.192051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:09:55.249043 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:09:55.249272 3.003752 tcp 10.0.2.105 65174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:04.251125 0.000000 tcp 10.0.2.105 65174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:10.251923 0.057749 tcp 10.0.2.105 65175 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:10.309492 0.067695 tcp 10.0.2.105 65176 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:10.377495 0.168997 tcp 10.0.2.105 65177 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:10.630709 3.004279 tcp 10.0.2.105 65178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:19.633691 0.000000 tcp 10.0.2.105 65178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:25.632658 0.053673 tcp 10.0.2.105 65179 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:25.686644 0.368959 tcp 10.0.2.105 65180 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:26.055895 0.159649 tcp 10.0.2.105 65181 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:26.250671 2.996903 tcp 10.0.2.105 65182 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:35.258970 0.000000 tcp 10.0.2.105 65182 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:41.245847 0.053715 tcp 10.0.2.105 65183 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:41.299872 0.109539 tcp 10.0.2.105 65184 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:41.409708 0.165991 tcp 10.0.2.105 65185 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:42.185280 2.995802 tcp 10.0.2.105 65186 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:51.178953 0.000000 tcp 10.0.2.105 65186 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:10:57.178259 0.052345 tcp 10.0.2.105 65187 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:57.230444 0.068932 tcp 10.0.2.105 65188 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:57.299703 0.173406 tcp 10.0.2.105 65189 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:10:57.644155 4.861741 tcp 10.0.2.105 65190 -> 46.48.247.67 29365 FSPA* 0 0 13 1620 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:11:01.826200 0.052153 tcp 10.0.2.105 65191 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:11:01.878656 0.068994 tcp 10.0.2.105 65192 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:11:01.947430 0.173307 tcp 10.0.2.105 65193 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:11:04.026231 0.000000 tcp 10.0.2.105 65190 -> 46.48.247.67 29365 _A 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:11:04.026895 2.955421 tcp 10.0.2.105 65194 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:12.915853 0.000000 tcp 10.0.2.105 65194 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:18.853367 2.965589 tcp 10.0.2.105 65195 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:27.748081 0.000000 tcp 10.0.2.105 65195 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:32.552987 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:11:33.682040 2.964497 tcp 10.0.2.105 65196 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:42.571203 0.000000 tcp 10.0.2.105 65196 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:48.501047 2.969980 tcp 10.0.2.105 65197 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:11:56.253128 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:11:57.394318 0.000000 tcp 10.0.2.105 65197 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:12:03.323058 4.157734 tcp 10.0.2.105 65198 -> 46.48.247.67 29365 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:13:20.195709 3.001458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:13:27.203450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:13:35.208619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:13:51.207600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:14:23.213908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:14:43.685525 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:14:43.685637 0.044628 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:14:43.715701 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:14:59.158325 0.076505 tcp 10.0.2.105 65199 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:14:59.234679 0.085087 tcp 10.0.2.105 65200 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:14:59.320090 0.162494 tcp 10.0.2.105 65201 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:14:59.483269 0.000000 udp 10.0.2.105 7010 -> 81.178.183.155 2433 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:15:18.154180 0.058630 tcp 10.0.2.105 65202 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:18.212586 0.073076 tcp 10.0.2.105 65203 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:18.285919 0.165763 tcp 10.0.2.105 65204 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:18.452395 0.000000 udp 10.0.2.105 7010 -> 78.149.127.5 2973 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:15:35.107217 0.053310 tcp 10.0.2.105 65205 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:35.160840 0.078131 tcp 10.0.2.105 65206 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:35.239256 0.203313 tcp 10.0.2.105 65207 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:35.442798 0.181625 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:35.853694 0.233111 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:36.078479 0.000000 udp 10.0.2.105 7010 -> 69.172.4.50 9850 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:15:51.271037 0.052219 tcp 10.0.2.105 65208 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:51.323556 0.074929 tcp 10.0.2.105 65209 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:51.398852 0.160641 tcp 10.0.2.105 65210 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:15:51.560194 0.295356 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 1988 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:51.824640 0.074917 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:51.999161 0.102176 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:52.085103 0.115506 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:52.237057 0.166349 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:52.791646 0.064223 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:52.854630 0.173007 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:53.272401 0.219498 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:53.624964 1.013010 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:54.576060 0.083450 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:54.844145 0.171224 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:55.065950 0.157451 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:55.204503 0.176401 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:55.359677 0.399732 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:55.740804 0.101905 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:15:55.812346 0.000000 udp 10.0.2.105 7010 -> 5.13.47.128 2778 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:16:11.180024 0.053393 tcp 10.0.2.105 65211 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:11.233750 0.077126 tcp 10.0.2.105 65212 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:11.311130 0.170902 tcp 10.0.2.105 65213 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:11.482574 0.273666 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.168871 0.174243 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.335195 0.172505 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.479119 0.224420 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.696404 0.075966 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.819321 0.082652 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:12.893550 0.124508 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:13.017080 0.087019 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2589 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:13.062990 0.175761 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:13.235858 0.072615 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2581 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:13.471499 0.259751 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:13.729501 0.000000 udp 10.0.2.105 7010 -> 188.29.42.200 5541 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:16:32.491016 0.059568 tcp 10.0.2.105 65214 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:32.550864 0.071786 tcp 10.0.2.105 65215 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:32.623047 0.161879 tcp 10.0.2.105 65216 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:16:32.785574 0.039220 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:33.221406 0.100777 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:33.304850 0.242225 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:33.524581 0.071705 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:33.672234 0.176497 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:16:33.844094 0.176954 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:17:06.719204 3.003857 tcp 10.0.2.105 65217 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:11.662535 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:17:15.966178 0.000000 tcp 10.0.2.105 65217 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:21.911388 0.053031 tcp 10.0.2.105 65218 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:21.964798 0.076669 tcp 10.0.2.105 65219 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:22.041839 0.156831 tcp 10.0.2.105 65220 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:22.440529 2.979886 tcp 10.0.2.105 65221 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:31.362502 0.000000 tcp 10.0.2.105 65221 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:37.309178 0.905199 tcp 10.0.2.105 65222 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:38.214705 0.125896 tcp 10.0.2.105 65223 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:38.340979 0.161529 tcp 10.0.2.105 65224 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:38.854595 2.970085 tcp 10.0.2.105 65225 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:47.808092 0.000000 tcp 10.0.2.105 65225 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:17:53.806885 0.052989 tcp 10.0.2.105 65226 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:53.860186 0.076291 tcp 10.0.2.105 65227 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:53.936807 0.160042 tcp 10.0.2.105 65228 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:17:54.154973 2.997009 tcp 10.0.2.105 65229 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:03.149638 0.000000 tcp 10.0.2.105 65229 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:09.150417 0.056405 tcp 10.0.2.105 65230 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:09.207192 0.071240 tcp 10.0.2.105 65231 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:09.278730 0.165920 tcp 10.0.2.105 65232 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:09.503525 4.599790 tcp 10.0.2.105 65233 -> 46.48.247.67 29365 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:13.583830 0.054881 tcp 10.0.2.105 65234 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:13.638524 0.077175 tcp 10.0.2.105 65235 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:13.716060 0.164633 tcp 10.0.2.105 65236 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:18:14.103140 2.997532 tcp 10.0.2.105 65237 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:23.098917 0.000000 tcp 10.0.2.105 65237 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:29.097369 3.004136 tcp 10.0.2.105 65238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:38.100289 0.000000 tcp 10.0.2.105 65238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:42.877281 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:18:44.098914 3.004619 tcp 10.0.2.105 65239 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:53.101973 0.000000 tcp 10.0.2.105 65239 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:18:59.101842 3.004828 tcp 10.0.2.105 65240 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:19:06.871522 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:19:08.103429 0.000000 tcp 10.0.2.105 65240 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:19:14.102379 4.028082 tcp 10.0.2.105 65241 -> 46.48.247.67 29365 FSPA* 0 0 12 1562 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:20:27.219720 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:20:34.227204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:20:42.290940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:20:58.241755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:21:30.247727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:24:18.119109 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:24:18.119305 3.009056 tcp 10.0.2.105 65242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:24:27.122098 0.000000 tcp 10.0.2.105 65242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:24:33.122872 0.054410 tcp 10.0.2.105 65243 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:33.177087 0.076464 tcp 10.0.2.105 65244 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:33.253867 0.155690 tcp 10.0.2.105 65245 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:33.847539 2.998560 tcp 10.0.2.105 65246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:24:42.844741 0.000000 tcp 10.0.2.105 65246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:24:48.843804 0.056410 tcp 10.0.2.105 65247 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:48.900500 0.077151 tcp 10.0.2.105 65248 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:48.977990 0.158482 tcp 10.0.2.105 65249 -> 195.113.214.251 443 SRPA* 0 0 52 34604 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:24:49.249384 2.988855 tcp 10.0.2.105 65250 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:24:58.246757 0.000000 tcp 10.0.2.105 65250 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:04.359607 0.052280 tcp 10.0.2.105 65251 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:04.411704 0.076640 tcp 10.0.2.105 65252 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:04.488816 0.222296 tcp 10.0.2.105 65253 -> 195.113.214.251 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:04.849298 2.975453 tcp 10.0.2.105 65254 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:13.776031 0.000000 tcp 10.0.2.105 65254 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:19.739015 0.053638 tcp 10.0.2.105 65255 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:19.792983 0.075020 tcp 10.0.2.105 65256 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:19.868411 0.161528 tcp 10.0.2.105 65257 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:20.233761 4.615938 tcp 10.0.2.105 65258 -> 46.48.247.67 29365 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:24.243745 0.055425 tcp 10.0.2.105 65259 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:24.299447 0.070609 tcp 10.0.2.105 65260 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:24.370322 0.160710 tcp 10.0.2.105 65261 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:25:24.849969 2.999305 tcp 10.0.2.105 65262 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:33.847927 0.000000 tcp 10.0.2.105 65262 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:39.846941 2.994690 tcp 10.0.2.105 65263 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:48.839513 0.000000 tcp 10.0.2.105 65263 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:25:53.376057 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:25:54.848507 3.004257 tcp 10.0.2.105 65264 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:26:03.851311 0.000000 tcp 10.0.2.105 65264 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:26:09.849963 3.003922 tcp 10.0.2.105 65265 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:26:17.370522 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:26:18.853324 0.000000 tcp 10.0.2.105 65265 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:26:24.852069 3.948857 tcp 10.0.2.105 65266 -> 46.48.247.67 29365 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:27:34.254952 3.000587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:27:41.261246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:27:49.263239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:28:05.265530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:28:37.271803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:31:28.798672 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:31:28.798771 3.003848 tcp 10.0.2.105 65267 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:31:37.801061 0.000000 tcp 10.0.2.105 65267 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:31:43.801989 0.058676 tcp 10.0.2.105 65268 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:43.860971 0.071658 tcp 10.0.2.105 65269 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:43.932897 0.169822 tcp 10.0.2.105 65270 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:44.207665 2.999404 tcp 10.0.2.105 65271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:31:53.203485 0.000000 tcp 10.0.2.105 65271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:31:59.203092 0.053322 tcp 10.0.2.105 65272 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:59.256723 0.072162 tcp 10.0.2.105 65273 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:59.329228 0.156061 tcp 10.0.2.105 65274 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:31:59.582606 3.004170 tcp 10.0.2.105 65275 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:08.585871 0.000000 tcp 10.0.2.105 65275 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:14.574866 0.053242 tcp 10.0.2.105 65276 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:14.628468 0.074451 tcp 10.0.2.105 65277 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:14.703319 0.159967 tcp 10.0.2.105 65278 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:15.175664 2.993574 tcp 10.0.2.105 65279 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:24.168768 0.000000 tcp 10.0.2.105 65279 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:30.167227 0.063481 tcp 10.0.2.105 65280 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:30.231071 0.070086 tcp 10.0.2.105 65281 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:30.301476 0.157811 tcp 10.0.2.105 65282 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:30.694970 4.237929 tcp 10.0.2.105 65283 -> 46.48.247.67 29365 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:34.594437 0.051959 tcp 10.0.2.105 65284 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:34.646773 0.073351 tcp 10.0.2.105 65285 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:34.720573 0.158591 tcp 10.0.2.105 65286 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:32:34.933147 2.994672 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:43.941859 0.000000 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:49.935069 2.994163 tcp 10.0.2.105 65288 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:32:58.930071 0.000000 tcp 10.0.2.105 65288 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:33:03.875178 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:33:04.936563 2.994462 tcp 10.0.2.105 65289 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:33:13.929218 0.000000 tcp 10.0.2.105 65289 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:33:19.938185 3.004351 tcp 10.0.2.105 65290 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:33:27.869453 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:33:28.941120 0.000000 tcp 10.0.2.105 65290 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:33:34.940057 0.347622 tcp 10.0.2.105 65291 -> 46.48.247.67 29365 SPA_* 0 0 9 1206 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:33:47.612086 0.003910 tcp 10.0.2.105 65291 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:34:41.278204 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:34:48.285508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:34:56.286583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:35:12.289734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:35:44.295991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:38:47.609502 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:38:47.609593 3.003883 tcp 10.0.2.105 65292 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:38:56.612512 0.000000 tcp 10.0.2.105 65292 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:02.613020 0.054814 tcp 10.0.2.105 65293 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:02.668177 0.071288 tcp 10.0.2.105 65294 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:02.739730 0.174703 tcp 10.0.2.105 65295 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:02.999881 3.005900 tcp 10.0.2.105 65296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:12.003698 0.000000 tcp 10.0.2.105 65296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:17.994105 0.052958 tcp 10.0.2.105 65297 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:18.047368 0.073541 tcp 10.0.2.105 65298 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:18.120733 0.169752 tcp 10.0.2.105 65299 -> 195.113.214.251 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:18.686078 2.992148 tcp 10.0.2.105 65300 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:27.686446 0.000000 tcp 10.0.2.105 65300 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:33.686281 0.054103 tcp 10.0.2.105 65301 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:33.740654 0.075391 tcp 10.0.2.105 65302 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:33.816379 0.155051 tcp 10.0.2.105 65303 -> 195.113.214.251 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:34.059806 3.000175 tcp 10.0.2.105 65304 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:43.058656 0.000000 tcp 10.0.2.105 65304 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:39:49.057630 0.053183 tcp 10.0.2.105 65305 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:49.111192 0.074396 tcp 10.0.2.105 65306 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:49.185915 0.157978 tcp 10.0.2.105 65307 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:49.414796 4.447398 tcp 10.0.2.105 65308 -> 46.48.247.67 29365 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:53.172024 0.051000 tcp 10.0.2.105 65309 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:53.223269 0.078026 tcp 10.0.2.105 65310 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:53.301588 0.156746 tcp 10.0.2.105 65311 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:39:53.862476 2.996527 tcp 10.0.2.105 65312 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:02.867534 0.000000 tcp 10.0.2.105 65312 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:08.856411 2.995986 tcp 10.0.2.105 65313 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:17.849178 0.000000 tcp 10.0.2.105 65313 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:22.375570 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:40:23.857742 3.004371 tcp 10.0.2.105 65314 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:32.860365 0.000000 tcp 10.0.2.105 65314 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:38.859063 3.004366 tcp 10.0.2.105 65315 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:46.369839 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:40:47.862250 0.000000 tcp 10.0.2.105 65315 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:40:53.860781 3.780155 tcp 10.0.2.105 65316 -> 46.48.247.67 29365 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:41:48.302089 3.001286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:41:55.309160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:42:03.310091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:42:19.313757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:42:51.319649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:46:50.383430 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:46:50.383536 0.000000 udp 10.0.2.105 7010 -> 69.172.4.50 9850 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:47:08.951750 0.054707 tcp 10.0.2.105 65317 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:09.006762 0.074897 tcp 10.0.2.105 65318 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:09.082017 0.152314 tcp 10.0.2.105 65319 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:09.234564 0.000000 udp 10.0.2.105 7010 -> 5.13.47.128 2778 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:47:25.434561 0.052164 tcp 10.0.2.105 65320 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:25.487078 0.074077 tcp 10.0.2.105 65321 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:25.561454 0.166702 tcp 10.0.2.105 65322 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:25.726577 0.000000 udp 10.0.2.105 7010 -> 188.29.42.200 5541 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:47:41.857962 0.053291 tcp 10.0.2.105 65323 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:41.911550 0.075267 tcp 10.0.2.105 65324 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:41.987160 0.156292 tcp 10.0.2.105 65325 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:42.144105 0.047876 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.175054 0.179388 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.328466 0.226715 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.547578 0.108664 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.639670 0.079126 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.659139 3.004053 tcp 10.0.2.105 65326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:47:42.702376 0.259670 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:42.928108 0.113534 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.003151 0.171500 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.152758 0.063406 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.215092 0.212210 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.417134 0.168473 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.561989 0.085701 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.660868 0.284528 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:43.900371 0.443075 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:44.520329 0.103088 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:44.591868 0.414193 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:44.986777 0.152539 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.130908 0.177844 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.288149 0.288561 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2071 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.614430 0.102205 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.732945 0.082088 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.806114 0.124628 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.890300 0.086187 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:45.952663 0.312786 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:47:46.236921 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:47:51.661613 0.000000 tcp 10.0.2.105 65326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:47:57.660618 0.056741 tcp 10.0.2.105 65327 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:57.717647 0.071677 tcp 10.0.2.105 65328 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:57.789186 0.161325 tcp 10.0.2.105 65329 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:47:58.024783 3.000297 tcp 10.0.2.105 65330 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:48:02.778424 0.054957 tcp 10.0.2.105 65331 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:02.833803 0.075034 tcp 10.0.2.105 65332 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:02.909286 0.155737 tcp 10.0.2.105 65333 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:03.065539 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 11:48:07.023704 0.000000 tcp 10.0.2.105 65330 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:48:13.022914 0.053237 tcp 10.0.2.105 65334 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:13.076442 0.074070 tcp 10.0.2.105 65335 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:13.150770 0.167761 tcp 10.0.2.105 65336 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:13.348991 3.007877 tcp 10.0.2.105 65337 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:48:19.041289 0.051969 tcp 10.0.2.105 65338 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:19.093542 0.073299 tcp 10.0.2.105 65339 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:19.167118 0.157810 tcp 10.0.2.105 65340 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:48:19.325408 0.280444 udp 10.0.2.105 7010 <-> 200.55.153.18 4376 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:19.604437 0.174856 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:19.776406 0.072076 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:19.833359 0.036786 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:20.001977 0.247937 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:20.241268 0.070125 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:20.331425 0.177144 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:20.504091 0.174783 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:20.674579 0.089455 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/06 11:48:22.355542 0.000000 tcp 10.0.2.105 65337 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:48:28.344562 2.993985 tcp 10.0.2.105 65341 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:48:37.337249 0.000000 tcp 10.0.2.105 65341 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:53:27.327242 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 11:53:34.333924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:53:42.335554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:53:43.348054 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:53:43.348166 3.003084 tcp 10.0.2.105 65342 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:53:52.349952 0.000000 tcp 10.0.2.105 65342 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:53:58.338905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:53:58.350930 0.054011 tcp 10.0.2.105 65343 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:53:58.405315 0.070234 tcp 10.0.2.105 65344 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:53:58.475861 0.163024 tcp 10.0.2.105 65345 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:53:58.769634 3.003805 tcp 10.0.2.105 65346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:07.771803 0.000000 tcp 10.0.2.105 65346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:13.761850 0.053777 tcp 10.0.2.105 65347 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:13.815951 0.076077 tcp 10.0.2.105 65348 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:13.891946 0.154802 tcp 10.0.2.105 65349 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:14.057639 3.007503 tcp 10.0.2.105 65350 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:23.063717 0.000000 tcp 10.0.2.105 65350 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:29.053255 0.054197 tcp 10.0.2.105 65351 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:29.107795 0.076009 tcp 10.0.2.105 65352 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:29.184116 0.158796 tcp 10.0.2.105 65353 -> 195.113.214.251 443 SRPA* 0 0 44 22776 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:29.464062 2.993412 tcp 10.0.2.105 65354 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:30.344681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 11:54:38.466215 0.000000 tcp 10.0.2.105 65354 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:44.465724 0.053576 tcp 10.0.2.105 65355 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:44.519683 0.074920 tcp 10.0.2.105 65356 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:44.594868 0.159052 tcp 10.0.2.105 65357 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:44.799279 4.105259 tcp 10.0.2.105 65358 -> 46.48.247.67 29365 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:48.530720 0.054346 tcp 10.0.2.105 65359 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:48.585358 0.072781 tcp 10.0.2.105 65360 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:48.658019 0.156687 tcp 10.0.2.105 65361 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 11:54:48.904779 3.000990 tcp 10.0.2.105 65362 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:54:57.904439 0.000000 tcp 10.0.2.105 65362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:03.902865 2.994594 tcp 10.0.2.105 65363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:12.905913 0.000000 tcp 10.0.2.105 65363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:17.872725 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:55:18.904865 2.993848 tcp 10.0.2.105 65364 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:27.897464 0.000000 tcp 10.0.2.105 65364 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:33.906272 2.993513 tcp 10.0.2.105 65365 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:41.867411 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 11:55:42.898637 0.000000 tcp 10.0.2.105 65365 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 11:55:48.907852 1.740821 tcp 10.0.2.105 65366 -> 46.48.247.67 29365 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:00:34.351047 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:00:41.358295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:00:49.359676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:00:50.641916 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:00:50.642012 3.003879 tcp 10.0.2.105 65367 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:00:59.644622 0.000000 tcp 10.0.2.105 65367 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:05.362861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:01:05.645041 0.056564 tcp 10.0.2.105 65368 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:05.701462 0.073200 tcp 10.0.2.105 65369 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:05.775031 0.224007 tcp 10.0.2.105 65370 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:06.098860 2.999293 tcp 10.0.2.105 65371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:15.106803 0.000000 tcp 10.0.2.105 65371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:21.096089 0.055376 tcp 10.0.2.105 65372 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:21.151792 0.071819 tcp 10.0.2.105 65373 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:21.223470 0.155380 tcp 10.0.2.105 65374 -> 195.113.214.251 443 SRPA* 0 0 24 9042 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:21.467903 2.992765 tcp 10.0.2.105 65375 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:30.458790 0.000000 tcp 10.0.2.105 65375 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:36.468381 0.059611 tcp 10.0.2.105 65376 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:36.528340 0.071982 tcp 10.0.2.105 65377 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:36.600746 0.164808 tcp 10.0.2.105 65378 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:36.866051 2.995961 tcp 10.0.2.105 65379 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:37.368837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:01:45.861013 0.000000 tcp 10.0.2.105 65379 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:01:51.860255 0.052498 tcp 10.0.2.105 65380 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:51.912711 0.071762 tcp 10.0.2.105 65381 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:51.984794 0.162200 tcp 10.0.2.105 65382 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:52.318011 4.350336 tcp 10.0.2.105 65383 -> 46.48.247.67 29365 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:56.021664 0.051949 tcp 10.0.2.105 65384 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:56.073425 0.075856 tcp 10.0.2.105 65385 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:56.149598 0.160953 tcp 10.0.2.105 65386 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:01:56.668644 3.002256 tcp 10.0.2.105 65387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:05.674835 0.000000 tcp 10.0.2.105 65387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:11.668351 3.004150 tcp 10.0.2.105 65388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:20.670924 0.000000 tcp 10.0.2.105 65388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:25.367682 0.000343 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:02:26.669702 3.004166 tcp 10.0.2.105 65389 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:35.672632 0.000000 tcp 10.0.2.105 65389 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:41.671970 3.003383 tcp 10.0.2.105 65390 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:49.372382 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:02:50.674040 0.000000 tcp 10.0.2.105 65390 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:02:56.672880 3.747360 tcp 10.0.2.105 65391 -> 46.48.247.67 29365 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:07:41.376403 2.999575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:07:48.382214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:07:56.383517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:08:00.409753 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:08:00.409919 3.003958 tcp 10.0.2.105 65392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:09.412516 0.000000 tcp 10.0.2.105 65392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:12.388668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:08:15.412934 0.060433 tcp 10.0.2.105 65393 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:15.473683 0.075850 tcp 10.0.2.105 65394 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:15.549856 0.163187 tcp 10.0.2.105 65395 -> 195.113.214.251 443 SRPA* 0 0 42 21426 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:15.799400 3.006421 tcp 10.0.2.105 65396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:24.805126 0.000000 tcp 10.0.2.105 65396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:30.794511 0.058690 tcp 10.0.2.105 65397 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:30.853022 0.072009 tcp 10.0.2.105 65398 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:30.925313 0.152844 tcp 10.0.2.105 65399 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:31.090979 2.997575 tcp 10.0.2.105 65400 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:40.096504 0.000000 tcp 10.0.2.105 65400 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:44.395813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:08:46.086396 0.052901 tcp 10.0.2.105 65401 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:46.139598 0.071997 tcp 10.0.2.105 65402 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:46.211919 0.156896 tcp 10.0.2.105 65403 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:08:46.851035 2.998990 tcp 10.0.2.105 65404 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:08:55.848995 0.000000 tcp 10.0.2.105 65404 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:01.847912 0.051694 tcp 10.0.2.105 65405 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:01.899900 0.071511 tcp 10.0.2.105 65406 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:01.971681 0.157138 tcp 10.0.2.105 65407 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:02.383577 4.008337 tcp 10.0.2.105 65408 -> 46.48.247.67 29365 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:06.069362 0.052063 tcp 10.0.2.105 65409 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:06.121725 0.075092 tcp 10.0.2.105 65410 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:06.197084 0.156157 tcp 10.0.2.105 65411 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:09:06.392198 2.996402 tcp 10.0.2.105 65412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:15.397207 0.000000 tcp 10.0.2.105 65412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:21.386150 2.993834 tcp 10.0.2.105 65413 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:32.164080 0.000000 tcp 10.0.2.105 65413 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:37.104637 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:09:38.103802 2.963358 tcp 10.0.2.105 65414 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:46.996474 0.000000 tcp 10.0.2.105 65414 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:09:52.928380 2.970829 tcp 10.0.2.105 65415 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:10:00.814874 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:10:01.826937 0.000000 tcp 10.0.2.105 65415 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:10:07.752399 3.714275 tcp 10.0.2.105 65416 -> 46.48.247.67 29365 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:14:48.398950 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:14:55.406587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:15:03.407610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:15:10.139132 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:15:10.139261 3.002294 tcp 10.0.2.105 65417 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:19.140649 0.000000 tcp 10.0.2.105 65417 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:19.410842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:15:25.140969 0.053305 tcp 10.0.2.105 65418 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:25.194626 0.070250 tcp 10.0.2.105 65419 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:25.264738 0.158362 tcp 10.0.2.105 65420 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:25.806847 3.007300 tcp 10.0.2.105 65421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:34.812853 0.000000 tcp 10.0.2.105 65421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:40.822200 0.052633 tcp 10.0.2.105 65422 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:40.875119 0.077640 tcp 10.0.2.105 65423 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:40.952614 0.160392 tcp 10.0.2.105 65424 -> 195.113.214.251 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:41.329190 3.009459 tcp 10.0.2.105 65425 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:50.335191 0.000000 tcp 10.0.2.105 65425 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:15:51.416110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:15:56.325451 0.051721 tcp 10.0.2.105 65426 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:56.377463 0.077520 tcp 10.0.2.105 65427 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:56.455186 0.184327 tcp 10.0.2.105 65428 -> 195.113.214.251 443 SRPA* 0 0 41 26996 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:15:56.829997 2.998548 tcp 10.0.2.105 65429 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:05.837382 0.000000 tcp 10.0.2.105 65429 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:11.826576 0.052421 tcp 10.0.2.105 65430 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:11.879374 0.075665 tcp 10.0.2.105 65431 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:11.954889 0.158489 tcp 10.0.2.105 65432 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:12.498139 4.218713 tcp 10.0.2.105 65433 -> 46.48.247.67 29365 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:16.173941 0.051982 tcp 10.0.2.105 65434 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:16.226301 0.076679 tcp 10.0.2.105 65435 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:16.303278 0.158904 tcp 10.0.2.105 65436 -> 195.113.214.251 443 SRPA* 0 0 39 33902 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:16:16.717457 2.982166 tcp 10.0.2.105 65437 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:25.659055 0.000000 tcp 10.0.2.105 65437 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:31.634912 2.993656 tcp 10.0.2.105 65438 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:40.637474 0.000000 tcp 10.0.2.105 65438 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:45.374194 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:16:46.636400 2.993833 tcp 10.0.2.105 65439 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:16:55.628998 0.000000 tcp 10.0.2.105 65439 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:17:01.637633 3.004383 tcp 10.0.2.105 65440 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:17:09.368543 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:17:10.641078 0.000000 tcp 10.0.2.105 65440 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:17:16.639391 3.683817 tcp 10.0.2.105 65441 -> 46.48.247.67 29365 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:18:36.334143 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:18:36.334295 0.174217 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:36.501918 0.226172 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.033941 0.086449 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.102629 0.172040 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.290501 0.195471 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.546054 0.047139 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.577456 0.099836 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.787837 0.060920 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:37.847578 0.207243 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:38.134946 0.115098 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:38.212136 0.272354 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:38.447590 0.170410 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:38.675421 0.245974 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:38.875367 0.085247 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:39.068852 0.170045 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:39.213096 0.173787 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:39.499465 0.099128 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:39.571627 0.179151 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:39.905602 1.896174 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:41.788409 0.397764 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:42.165891 0.079025 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 1995 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:42.258631 0.282520 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:42.589078 0.074608 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:42.881154 0.080934 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:42.953611 0.126210 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:43.092354 0.172420 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:18:43.236635 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 12:18:59.929009 0.052363 tcp 10.0.2.105 65442 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:18:59.981800 0.075264 tcp 10.0.2.105 65443 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:19:00.057361 0.156610 tcp 10.0.2.105 65444 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:19:00.213721 0.320452 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:00.668587 0.070141 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:00.724766 0.034344 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:00.983991 0.176784 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:01.156586 0.178442 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:01.351214 0.086165 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:01.421159 0.240108 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:19:01.636039 0.088380 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:21:55.425247 2.999649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:22:02.430248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:22:10.431671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:22:20.305724 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:22:20.305829 2.993899 tcp 10.0.2.105 65445 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:22:26.434514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:22:29.298619 0.000000 tcp 10.0.2.105 65445 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:22:35.309376 0.057171 tcp 10.0.2.105 65446 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:35.366906 0.072519 tcp 10.0.2.105 65447 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:35.439791 0.158403 tcp 10.0.2.105 65448 -> 195.113.214.251 443 SRPA* 0 0 31 14238 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:35.852391 2.999859 tcp 10.0.2.105 65449 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:22:44.850865 0.000000 tcp 10.0.2.105 65449 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:22:50.850307 0.052563 tcp 10.0.2.105 65450 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:50.902717 0.071827 tcp 10.0.2.105 65451 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:50.974887 0.150879 tcp 10.0.2.105 65452 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:22:51.295397 2.999265 tcp 10.0.2.105 65453 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:22:58.441179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:23:00.293012 0.000000 tcp 10.0.2.105 65453 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:06.293637 0.052251 tcp 10.0.2.105 65454 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:06.346272 0.071844 tcp 10.0.2.105 65455 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:06.418427 0.160224 tcp 10.0.2.105 65456 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:06.741518 3.005616 tcp 10.0.2.105 65457 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:15.755292 0.000000 tcp 10.0.2.105 65457 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:21.735316 0.054071 tcp 10.0.2.105 65458 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:21.789220 0.075708 tcp 10.0.2.105 65459 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:21.865313 0.157515 tcp 10.0.2.105 65460 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:22.040284 4.268200 tcp 10.0.2.105 65461 -> 46.48.247.67 29365 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:25.743649 0.053348 tcp 10.0.2.105 65462 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:25.796795 0.072530 tcp 10.0.2.105 65463 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:25.869652 0.162858 tcp 10.0.2.105 65464 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:23:26.308782 3.007858 tcp 10.0.2.105 65465 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:35.313389 0.000000 tcp 10.0.2.105 65465 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:41.302303 3.009128 tcp 10.0.2.105 65466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:50.305022 0.000000 tcp 10.0.2.105 65466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:23:54.871560 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:23:56.303750 2.994223 tcp 10.0.2.105 65467 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:24:05.306435 0.000000 tcp 10.0.2.105 65467 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:24:11.306199 2.993227 tcp 10.0.2.105 65468 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:24:18.876505 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:24:20.298379 0.000000 tcp 10.0.2.105 65468 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:24:26.307122 3.698178 tcp 10.0.2.105 65469 -> 46.48.247.67 29365 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:29:02.446537 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:29:09.453956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:29:17.630478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:29:30.037826 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:29:30.037926 2.964883 tcp 10.0.2.105 65470 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:29:33.480435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:29:38.996499 0.000000 tcp 10.0.2.105 65470 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:29:44.996914 0.057225 tcp 10.0.2.105 65471 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:29:45.054428 0.070640 tcp 10.0.2.105 65472 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:29:45.125362 0.154511 tcp 10.0.2.105 65473 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:29:45.315988 2.993502 tcp 10.0.2.105 65474 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:29:54.308619 0.000000 tcp 10.0.2.105 65474 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:00.317831 0.053579 tcp 10.0.2.105 65475 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:00.371500 0.072087 tcp 10.0.2.105 65476 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:00.443891 0.158817 tcp 10.0.2.105 65477 -> 195.113.214.251 443 SRPA* 0 0 57 36886 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:00.775815 2.996303 tcp 10.0.2.105 65478 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:05.474819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:30:09.770626 0.000000 tcp 10.0.2.105 65478 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:15.770316 0.053302 tcp 10.0.2.105 65479 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:15.823942 0.071111 tcp 10.0.2.105 65480 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:15.894882 0.154522 tcp 10.0.2.105 65481 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:16.193427 3.000701 tcp 10.0.2.105 65482 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:25.192718 0.000000 tcp 10.0.2.105 65482 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:31.192628 0.051967 tcp 10.0.2.105 65483 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:31.244921 0.133288 tcp 10.0.2.105 65484 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:31.378520 0.154028 tcp 10.0.2.105 65485 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:31.704726 4.148896 tcp 10.0.2.105 65486 -> 46.48.247.67 29365 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:35.391389 0.053550 tcp 10.0.2.105 65487 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:35.445233 0.071004 tcp 10.0.2.105 65488 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:35.516579 0.156963 tcp 10.0.2.105 65489 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:30:35.853906 2.998748 tcp 10.0.2.105 65490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:44.851395 0.000000 tcp 10.0.2.105 65490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:50.849852 3.003930 tcp 10.0.2.105 65491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:30:59.852725 0.000000 tcp 10.0.2.105 65491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:31:04.369330 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:31:05.851406 3.004269 tcp 10.0.2.105 65492 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:31:14.854236 0.000000 tcp 10.0.2.105 65492 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:31:20.853214 3.003586 tcp 10.0.2.105 65493 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:31:28.373595 0.000443 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:31:29.865949 0.000000 tcp 10.0.2.105 65493 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:31:35.854462 3.675636 tcp 10.0.2.105 65494 -> 46.48.247.67 29365 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:36:09.480085 3.002717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:36:16.488267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:36:24.489738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:36:39.521924 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:36:39.522052 3.003185 tcp 10.0.2.105 65495 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:36:40.492553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:36:48.524920 0.000000 tcp 10.0.2.105 65495 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:36:54.524553 0.054556 tcp 10.0.2.105 65496 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:36:54.579372 0.076509 tcp 10.0.2.105 65497 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:36:54.656216 0.161464 tcp 10.0.2.105 65498 -> 195.113.214.251 443 SRPA* 0 0 71 70012 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:36:55.151766 2.995954 tcp 10.0.2.105 65499 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:04.156525 0.000000 tcp 10.0.2.105 65499 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:10.146221 0.054142 tcp 10.0.2.105 65500 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:10.200664 0.072739 tcp 10.0.2.105 65501 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:10.273709 0.162456 tcp 10.0.2.105 65502 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:10.914473 2.996066 tcp 10.0.2.105 65503 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:12.498392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:37:19.908991 0.000000 tcp 10.0.2.105 65503 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:25.908139 0.052492 tcp 10.0.2.105 65504 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:25.960973 0.079787 tcp 10.0.2.105 65505 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:26.041074 0.152213 tcp 10.0.2.105 65506 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:26.413959 2.998678 tcp 10.0.2.105 65507 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:35.411428 0.000000 tcp 10.0.2.105 65507 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:41.410960 0.053892 tcp 10.0.2.105 65508 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:41.465127 0.073400 tcp 10.0.2.105 65509 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:41.538834 0.157098 tcp 10.0.2.105 65510 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:41.754677 4.057826 tcp 10.0.2.105 65511 -> 46.48.247.67 29365 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:45.402055 0.052538 tcp 10.0.2.105 65512 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:45.454946 0.067553 tcp 10.0.2.105 65513 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:45.522854 0.161162 tcp 10.0.2.105 65514 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:37:45.812795 2.997805 tcp 10.0.2.105 65515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:37:54.809126 0.000000 tcp 10.0.2.105 65515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:00.808058 3.004015 tcp 10.0.2.105 65516 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:09.810812 0.000000 tcp 10.0.2.105 65516 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:14.367546 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:38:15.809558 3.005173 tcp 10.0.2.105 65517 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:24.814677 0.000000 tcp 10.0.2.105 65517 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:30.814927 3.000674 tcp 10.0.2.105 65518 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:38.372988 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:38:39.813859 0.000000 tcp 10.0.2.105 65518 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:38:45.813434 3.695266 tcp 10.0.2.105 65519 -> 46.48.247.67 29365 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:43:16.505528 3.001019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:43:23.512019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:43:31.513584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:43:47.517174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:43:49.499830 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:43:49.499954 3.003773 tcp 10.0.2.105 65520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:43:58.502134 0.000000 tcp 10.0.2.105 65520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:04.503236 0.054263 tcp 10.0.2.105 65521 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:04.557823 0.075742 tcp 10.0.2.105 65522 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:04.634042 0.157638 tcp 10.0.2.105 65523 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:04.882745 3.002971 tcp 10.0.2.105 65524 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:13.884431 0.000000 tcp 10.0.2.105 65524 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:19.522734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:44:19.883679 0.052149 tcp 10.0.2.105 65525 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:19.935674 0.076150 tcp 10.0.2.105 65526 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:20.012140 0.153528 tcp 10.0.2.105 65527 -> 195.113.214.251 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:20.689514 2.999027 tcp 10.0.2.105 65528 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:29.697162 0.000000 tcp 10.0.2.105 65528 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:35.686707 0.052147 tcp 10.0.2.105 65529 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:35.739145 0.071666 tcp 10.0.2.105 65530 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:35.811116 0.154248 tcp 10.0.2.105 65531 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:36.070984 2.988971 tcp 10.0.2.105 65532 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:45.059003 0.000000 tcp 10.0.2.105 65532 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:44:51.068744 0.052328 tcp 10.0.2.105 65533 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:51.120903 0.071255 tcp 10.0.2.105 65534 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:51.192481 0.159563 tcp 10.0.2.105 49157 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:51.382561 4.047690 tcp 10.0.2.105 49158 -> 46.48.247.67 29365 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:55.030325 0.051765 tcp 10.0.2.105 49159 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:55.082396 0.070271 tcp 10.0.2.105 49160 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:55.152955 0.162214 tcp 10.0.2.105 49161 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:44:55.430480 2.997427 tcp 10.0.2.105 49162 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:04.436871 0.000000 tcp 10.0.2.105 49162 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:10.425839 2.993975 tcp 10.0.2.105 49163 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:19.418718 0.000000 tcp 10.0.2.105 49163 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:24.375830 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:45:25.427376 3.004278 tcp 10.0.2.105 49164 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:34.430153 0.000000 tcp 10.0.2.105 49164 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:40.428994 3.004098 tcp 10.0.2.105 49165 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:48.370843 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:45:49.431794 0.000000 tcp 10.0.2.105 49165 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:45:55.430882 3.628215 tcp 10.0.2.105 49166 -> 46.48.247.67 29365 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:49:24.611639 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:49:24.611877 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 12:49:41.617750 0.055332 tcp 10.0.2.105 49167 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:49:41.673376 0.075197 tcp 10.0.2.105 49168 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:49:41.748886 0.151490 tcp 10.0.2.105 49169 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:49:41.900915 0.079020 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:41.962632 0.171838 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.126945 0.226038 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.345281 0.046746 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.437092 0.093395 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.514867 0.061012 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.574748 0.201356 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.771343 0.174810 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:42.942297 0.166590 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.086247 0.164547 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.227876 0.278662 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.457116 0.084019 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.594859 0.112301 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.667529 0.248954 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.884226 0.098512 udp 10.0.2.105 7010 <-> 84.173.28.217 7912 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:43.952866 0.175024 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.108456 0.172365 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.309583 0.168186 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.531504 0.150585 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.668654 0.079222 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.736562 0.081713 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.808474 0.128032 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.894191 0.087589 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:44.945651 0.400074 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:45.325400 0.276535 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:45.620746 0.170946 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:45.765665 0.174847 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:45.937217 0.069939 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.025731 0.044099 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.160463 0.089249 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.230304 0.243095 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.452836 0.070887 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.504870 0.178571 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:49:46.679199 0.175930 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/06 12:50:59.047753 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:50:59.048061 3.002958 tcp 10.0.2.105 49170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:08.050076 0.000000 tcp 10.0.2.105 49170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:14.049270 0.052022 tcp 10.0.2.105 49171 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:14.101632 0.071105 tcp 10.0.2.105 49172 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:14.173022 0.159494 tcp 10.0.2.105 49173 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:14.458307 3.004996 tcp 10.0.2.105 49174 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:23.462050 0.000000 tcp 10.0.2.105 49174 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:29.451438 0.052439 tcp 10.0.2.105 49175 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:29.504197 0.075537 tcp 10.0.2.105 49176 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:29.580056 0.157865 tcp 10.0.2.105 49177 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:29.883207 3.002526 tcp 10.0.2.105 49178 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:38.884173 0.000000 tcp 10.0.2.105 49178 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:44.883424 0.052839 tcp 10.0.2.105 49179 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:44.936617 0.067823 tcp 10.0.2.105 49180 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:45.004757 0.161527 tcp 10.0.2.105 49181 -> 195.113.214.251 443 SRPA* 0 0 26 9776 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:51:45.190898 2.996715 tcp 10.0.2.105 49182 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:51:54.196181 0.000000 tcp 10.0.2.105 49182 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:00.185339 0.051359 tcp 10.0.2.105 49183 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:00.237010 0.075871 tcp 10.0.2.105 49184 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:00.313198 0.153458 tcp 10.0.2.105 49185 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:00.520091 4.065383 tcp 10.0.2.105 49186 -> 46.48.247.67 29365 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:04.132852 0.052609 tcp 10.0.2.105 49187 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:04.185795 0.075836 tcp 10.0.2.105 49188 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:04.262605 0.155234 tcp 10.0.2.105 49189 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:52:04.585724 2.999908 tcp 10.0.2.105 49190 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:13.584067 0.000000 tcp 10.0.2.105 49190 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:19.582711 3.004310 tcp 10.0.2.105 49191 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:28.585659 0.000000 tcp 10.0.2.105 49191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:33.372071 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:52:34.584433 2.994169 tcp 10.0.2.105 49192 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:43.587206 0.000000 tcp 10.0.2.105 49192 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:49.586102 2.994108 tcp 10.0.2.105 49193 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:52:57.367181 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:52:58.578614 0.000000 tcp 10.0.2.105 49193 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:53:04.587726 3.601507 tcp 10.0.2.105 49194 -> 46.48.247.67 29365 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:54:06.529796 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 12:54:13.537043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:54:21.538185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:54:37.540995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:55:09.547004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 12:58:08.184354 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:58:08.184448 2.993552 tcp 10.0.2.105 49195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:17.187081 0.000000 tcp 10.0.2.105 49195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:23.187290 0.053914 tcp 10.0.2.105 49196 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:23.241488 0.077053 tcp 10.0.2.105 49197 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:23.318373 0.151542 tcp 10.0.2.105 49198 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:23.525607 2.995066 tcp 10.0.2.105 49199 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:32.520276 0.000000 tcp 10.0.2.105 49199 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:38.528362 0.054095 tcp 10.0.2.105 49200 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:38.582790 0.074529 tcp 10.0.2.105 49201 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:38.657719 0.154864 tcp 10.0.2.105 49202 -> 195.113.214.251 443 SRPA* 0 0 40 34544 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:38.954058 2.998596 tcp 10.0.2.105 49203 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:47.950635 0.000000 tcp 10.0.2.105 49203 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:58:53.949936 0.055095 tcp 10.0.2.105 49204 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:54.005363 0.074445 tcp 10.0.2.105 49205 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:54.080162 0.157690 tcp 10.0.2.105 49206 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:58:54.318830 3.005807 tcp 10.0.2.105 49207 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:03.322767 0.000000 tcp 10.0.2.105 49207 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:09.312436 0.053020 tcp 10.0.2.105 49208 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:09.365734 0.066694 tcp 10.0.2.105 49209 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:09.432788 0.153559 tcp 10.0.2.105 49210 -> 195.113.214.251 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:09.763703 4.286522 tcp 10.0.2.105 49211 -> 46.48.247.67 29365 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:13.394866 0.053732 tcp 10.0.2.105 49212 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:13.448937 0.074979 tcp 10.0.2.105 49213 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:13.524226 0.155538 tcp 10.0.2.105 49214 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 12:59:14.050534 3.002316 tcp 10.0.2.105 49215 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:23.051634 0.000000 tcp 10.0.2.105 49215 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:29.050457 3.004086 tcp 10.0.2.105 49216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:38.053081 0.000000 tcp 10.0.2.105 49216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:42.870191 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 12:59:44.052020 3.004360 tcp 10.0.2.105 49217 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:53.054562 0.000000 tcp 10.0.2.105 49217 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 12:59:59.053514 2.993576 tcp 10.0.2.105 49218 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:00:06.874203 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:00:08.056440 0.000000 tcp 10.0.2.105 49218 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:00:14.055229 3.616636 tcp 10.0.2.105 49219 -> 46.48.247.67 29365 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:01:13.554155 3.000629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:01:20.560818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:01:28.561945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:01:44.565104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:02:16.570899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:05:17.662291 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:05:17.662477 3.003117 tcp 10.0.2.105 49220 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:05:26.664135 0.000000 tcp 10.0.2.105 49220 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:05:32.665311 0.054682 tcp 10.0.2.105 49221 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:32.719739 0.073229 tcp 10.0.2.105 49222 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:32.792824 0.157345 tcp 10.0.2.105 49223 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:33.161141 2.998439 tcp 10.0.2.105 49224 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:05:42.166816 0.000000 tcp 10.0.2.105 49224 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:05:48.155595 0.053081 tcp 10.0.2.105 49225 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:48.208971 0.067985 tcp 10.0.2.105 49226 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:48.277223 0.150699 tcp 10.0.2.105 49227 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:05:52.694844 3.001315 tcp 10.0.2.105 49228 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:01.694693 0.000000 tcp 10.0.2.105 49228 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:07.695115 0.052280 tcp 10.0.2.105 49229 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:07.747775 0.076166 tcp 10.0.2.105 49230 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:07.823696 0.150090 tcp 10.0.2.105 49231 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:08.897442 3.001819 tcp 10.0.2.105 49232 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:17.897948 0.000000 tcp 10.0.2.105 49232 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:23.897246 0.313615 tcp 10.0.2.105 49233 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:24.211177 0.071229 tcp 10.0.2.105 49234 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:24.282687 0.153871 tcp 10.0.2.105 49235 -> 195.113.214.251 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:24.608853 3.948639 tcp 10.0.2.105 49236 -> 46.48.247.67 29365 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:28.209850 0.053232 tcp 10.0.2.105 49237 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:28.263469 0.071234 tcp 10.0.2.105 49238 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:28.335339 0.160303 tcp 10.0.2.105 49239 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:06:28.557760 2.983286 tcp 10.0.2.105 49240 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:37.509853 0.000000 tcp 10.0.2.105 49240 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:43.435821 2.968097 tcp 10.0.2.105 49241 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:52.384755 0.000000 tcp 10.0.2.105 49241 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:06:56.888445 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:06:58.369286 2.981339 tcp 10.0.2.105 49242 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:07:07.349706 0.000000 tcp 10.0.2.105 49242 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:07:13.357922 3.004044 tcp 10.0.2.105 49243 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:07:20.868586 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:07:22.360606 0.000000 tcp 10.0.2.105 49243 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:07:28.359655 3.638201 tcp 10.0.2.105 49244 -> 46.48.247.67 29365 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:08:20.576882 3.001626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:08:27.584616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:08:35.585817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:08:51.588947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:09:23.595179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:12:31.987596 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:12:31.987701 2.992795 tcp 10.0.2.105 49245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:12:40.978273 0.000000 tcp 10.0.2.105 49245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:12:46.989543 0.053517 tcp 10.0.2.105 49246 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:12:47.042874 0.074324 tcp 10.0.2.105 49247 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:12:47.117553 0.157633 tcp 10.0.2.105 49248 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:12:47.870690 3.002242 tcp 10.0.2.105 49249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:12:56.872096 0.000000 tcp 10.0.2.105 49249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:02.870660 0.052444 tcp 10.0.2.105 49250 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:02.923401 0.075447 tcp 10.0.2.105 49251 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:02.999147 0.151263 tcp 10.0.2.105 49252 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:03.563252 3.002200 tcp 10.0.2.105 49253 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:12.563580 0.000000 tcp 10.0.2.105 49253 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:18.564180 0.052464 tcp 10.0.2.105 49254 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:18.616952 0.066217 tcp 10.0.2.105 49255 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:18.683629 0.149707 tcp 10.0.2.105 49256 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:18.943111 2.994583 tcp 10.0.2.105 49257 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:27.946041 0.000000 tcp 10.0.2.105 49257 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:33.936418 0.054490 tcp 10.0.2.105 49258 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:33.991268 0.070028 tcp 10.0.2.105 49259 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:34.061167 0.154322 tcp 10.0.2.105 49260 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:34.403358 4.005717 tcp 10.0.2.105 49261 -> 46.48.247.67 29365 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:37.971344 0.053315 tcp 10.0.2.105 49262 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:38.024969 0.070668 tcp 10.0.2.105 49263 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:38.096199 0.153405 tcp 10.0.2.105 49264 -> 195.113.214.251 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:13:38.409273 3.006362 tcp 10.0.2.105 49265 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:47.414257 0.000000 tcp 10.0.2.105 49265 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:13:53.406684 3.000476 tcp 10.0.2.105 49266 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:02.415855 0.000000 tcp 10.0.2.105 49266 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:07.372818 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:14:08.404768 2.993974 tcp 10.0.2.105 49267 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:17.408979 0.000000 tcp 10.0.2.105 49267 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:23.408676 2.991358 tcp 10.0.2.105 49268 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:31.368757 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:14:32.398994 0.000000 tcp 10.0.2.105 49268 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:14:38.407466 3.605135 tcp 10.0.2.105 49269 -> 46.48.247.67 29365 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:15:27.601855 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:15:34.611894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:15:42.612677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:15:58.612945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:16:30.619788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:20:11.256615 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:20:11.256731 0.077681 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:11.317755 0.046101 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:11.558824 0.102990 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:11.645757 0.062777 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:11.719264 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 13:20:12.009995 3.001663 tcp 10.0.2.105 49270 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:20:21.010135 0.000000 tcp 10.0.2.105 49270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:20:27.010722 0.052490 tcp 10.0.2.105 49271 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.063595 0.071938 tcp 10.0.2.105 49272 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.135900 0.157221 tcp 10.0.2.105 49273 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.456587 2.996880 tcp 10.0.2.105 49274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:20:27.679897 0.053079 tcp 10.0.2.105 49275 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.733334 0.073825 tcp 10.0.2.105 49276 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.807455 0.157867 tcp 10.0.2.105 49277 -> 195.113.214.251 443 SRPA* 0 0 28 11720 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:27.965693 0.225939 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:28.183777 0.195614 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:28.427596 0.325211 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:28.749604 0.171021 udp 10.0.2.105 7010 <-> 74.15.111.6 3208 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:29.277049 0.168133 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:29.486594 0.108962 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:29.556529 0.258252 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:29.777395 0.000000 udp 10.0.2.105 7010 -> 84.173.28.217 7912 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 13:20:36.452594 0.000000 tcp 10.0.2.105 49274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:20:47.939209 0.052320 tcp 10.0.2.105 49278 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:47.991858 0.072709 tcp 10.0.2.105 49279 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:48.064913 0.154746 tcp 10.0.2.105 49280 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:20:48.220501 0.715310 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:48.886266 0.082148 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:48.947533 0.178038 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:49.171919 0.173795 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:49.459106 0.171534 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:49.659826 0.149430 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:49.795907 0.234564 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:50.220816 0.079839 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:50.335972 0.398902 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:50.714362 0.072276 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:50.814708 0.080813 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:50.887166 0.281522 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:51.213930 0.174443 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:51.358993 0.175018 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:51.571232 0.086662 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:51.639750 0.250459 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:51.955824 0.073102 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:52.008429 0.177355 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:52.181262 0.068576 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:52.355633 0.037903 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:20:52.386406 0.175517 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:22:34.625340 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:22:41.632554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:22:49.633788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:23:05.636831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:23:37.656635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:25:42.452955 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:25:42.453142 3.005408 tcp 10.0.2.105 49281 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:25:51.455213 0.000000 tcp 10.0.2.105 49281 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:25:57.456549 0.052930 tcp 10.0.2.105 49282 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:25:57.509774 0.074660 tcp 10.0.2.105 49283 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:25:57.584260 0.157772 tcp 10.0.2.105 49284 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:25:57.859484 2.999325 tcp 10.0.2.105 49285 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:06.867382 0.000000 tcp 10.0.2.105 49285 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:12.857726 0.052367 tcp 10.0.2.105 49286 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:12.910419 0.071466 tcp 10.0.2.105 49287 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:12.982199 0.153158 tcp 10.0.2.105 49288 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:13.438399 3.002667 tcp 10.0.2.105 49289 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:22.439955 0.000000 tcp 10.0.2.105 49289 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:28.439050 0.052328 tcp 10.0.2.105 49290 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:28.491730 0.066273 tcp 10.0.2.105 49291 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:28.558356 0.156723 tcp 10.0.2.105 49292 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:29.353349 3.000610 tcp 10.0.2.105 49293 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:38.352664 0.000000 tcp 10.0.2.105 49293 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:44.352019 0.051731 tcp 10.0.2.105 49294 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:44.404115 0.074005 tcp 10.0.2.105 49295 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:44.478487 0.151807 tcp 10.0.2.105 49296 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:44.678603 4.136790 tcp 10.0.2.105 49297 -> 46.48.247.67 29365 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:48.275879 0.051684 tcp 10.0.2.105 49298 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:48.327879 0.071257 tcp 10.0.2.105 49299 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:48.399468 0.154334 tcp 10.0.2.105 49300 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:26:48.815671 2.996527 tcp 10.0.2.105 49301 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:26:57.813276 0.000000 tcp 10.0.2.105 49301 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:03.809349 3.004089 tcp 10.0.2.105 49302 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:12.812303 0.000000 tcp 10.0.2.105 49302 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:17.369039 0.000244 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:27:18.811377 3.003550 tcp 10.0.2.105 49303 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:27.813990 0.000000 tcp 10.0.2.105 49303 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:33.812882 3.003736 tcp 10.0.2.105 49304 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:41.373288 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:27:42.815382 0.000000 tcp 10.0.2.105 49304 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:27:48.814137 0.348516 tcp 10.0.2.105 49305 -> 46.48.247.67 29365 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:27:55.880487 1.501912 tcp 10.0.2.105 49305 -> 46.48.247.67 29365 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:29:41.661683 2.999020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:29:48.666735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:29:56.667836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:30:12.671161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:30:44.676913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:32:55.876090 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:32:55.876394 2.993194 tcp 10.0.2.105 49306 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:04.868449 0.000000 tcp 10.0.2.105 49306 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:10.879533 0.052659 tcp 10.0.2.105 49307 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:10.932542 0.071159 tcp 10.0.2.105 49308 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:11.003948 0.149711 tcp 10.0.2.105 49309 -> 195.113.214.251 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:11.183562 2.998399 tcp 10.0.2.105 49310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:20.180617 0.000000 tcp 10.0.2.105 49310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:26.179712 0.788949 tcp 10.0.2.105 49311 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:26.968964 0.077303 tcp 10.0.2.105 49312 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:27.046105 0.159183 tcp 10.0.2.105 49313 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:27.431332 3.003876 tcp 10.0.2.105 49314 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:36.433863 0.000000 tcp 10.0.2.105 49314 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:42.423500 0.052159 tcp 10.0.2.105 49315 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:42.476070 0.071975 tcp 10.0.2.105 49316 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:42.548372 0.158145 tcp 10.0.2.105 49317 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:42.906990 2.992007 tcp 10.0.2.105 49318 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:51.906177 0.000000 tcp 10.0.2.105 49318 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:33:57.905964 0.050982 tcp 10.0.2.105 49319 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:57.957316 0.074780 tcp 10.0.2.105 49320 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:58.032418 0.153407 tcp 10.0.2.105 49321 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:33:58.394474 2.410858 tcp 10.0.2.105 49322 -> 46.48.247.67 29365 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:34:00.131089 0.052580 tcp 10.0.2.105 49323 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:34:00.183939 0.073262 tcp 10.0.2.105 49324 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:34:00.257588 0.158498 tcp 10.0.2.105 49325 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:34:00.805556 2.997577 tcp 10.0.2.105 49326 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:09.802031 0.000000 tcp 10.0.2.105 49326 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:15.800602 3.004359 tcp 10.0.2.105 49327 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:24.803300 0.000000 tcp 10.0.2.105 49327 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:29.369656 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:34:30.802111 3.004353 tcp 10.0.2.105 49328 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:39.804807 0.000000 tcp 10.0.2.105 49328 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:45.804324 2.996560 tcp 10.0.2.105 49329 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:34:53.373995 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:34:54.806659 0.000000 tcp 10.0.2.105 49329 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:35:00.806998 1.872408 tcp 10.0.2.105 49330 -> 46.48.247.67 29365 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:36:48.683490 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:36:55.690827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:37:03.691795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:37:19.694949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:37:51.701210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:40:02.679795 0.000236 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:40:02.680142 3.003293 tcp 10.0.2.105 49331 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:11.682176 0.000000 tcp 10.0.2.105 49331 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:17.683122 0.053637 tcp 10.0.2.105 49332 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:17.737118 0.073930 tcp 10.0.2.105 49333 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:17.811402 0.160117 tcp 10.0.2.105 49334 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:18.055342 3.000347 tcp 10.0.2.105 49335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:27.054070 0.000000 tcp 10.0.2.105 49335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:33.053623 0.053043 tcp 10.0.2.105 49336 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:33.106969 0.075642 tcp 10.0.2.105 49337 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:33.182916 0.155895 tcp 10.0.2.105 49338 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:33.353786 2.993734 tcp 10.0.2.105 49339 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:42.356518 0.000000 tcp 10.0.2.105 49339 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:48.355444 0.053980 tcp 10.0.2.105 49340 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:48.409735 0.071669 tcp 10.0.2.105 49341 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:48.481706 0.160457 tcp 10.0.2.105 49342 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:40:48.653711 2.995917 tcp 10.0.2.105 49343 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:40:57.648111 0.000000 tcp 10.0.2.105 49343 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:03.647736 0.053197 tcp 10.0.2.105 49344 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:03.700761 0.076861 tcp 10.0.2.105 49345 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:03.777933 0.156476 tcp 10.0.2.105 49346 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:03.950333 3.887802 tcp 10.0.2.105 49347 -> 46.48.247.67 29365 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:07.518877 0.052426 tcp 10.0.2.105 49348 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:07.571586 0.075412 tcp 10.0.2.105 49349 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:07.647405 0.159312 tcp 10.0.2.105 49350 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:41:07.838337 2.998321 tcp 10.0.2.105 49351 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:16.845499 0.000000 tcp 10.0.2.105 49351 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:22.834761 2.994171 tcp 10.0.2.105 49352 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:31.827196 0.000000 tcp 10.0.2.105 49352 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:36.373756 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:41:37.836441 2.993868 tcp 10.0.2.105 49353 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:46.828455 0.000000 tcp 10.0.2.105 49353 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:41:52.837812 3.003886 tcp 10.0.2.105 49354 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:42:00.368169 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:42:01.840145 0.000000 tcp 10.0.2.105 49354 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:42:07.839218 3.505549 tcp 10.0.2.105 49355 -> 46.48.247.67 29365 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:43:55.717535 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:44:02.724302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:44:10.725649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:44:26.728674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:44:58.735039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:47:11.335820 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:47:11.336056 2.993799 tcp 10.0.2.105 49356 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:20.328235 0.000000 tcp 10.0.2.105 49356 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:26.339108 0.051738 tcp 10.0.2.105 49357 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:26.391182 0.076313 tcp 10.0.2.105 49358 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:26.467320 0.155275 tcp 10.0.2.105 49359 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:26.678351 3.003639 tcp 10.0.2.105 49360 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:35.680576 0.000000 tcp 10.0.2.105 49360 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:41.679376 0.054577 tcp 10.0.2.105 49361 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:41.734045 0.072816 tcp 10.0.2.105 49362 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:41.807206 0.153177 tcp 10.0.2.105 49363 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:41.993762 3.000130 tcp 10.0.2.105 49364 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:50.992534 0.000000 tcp 10.0.2.105 49364 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:47:56.991477 0.053775 tcp 10.0.2.105 49365 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:57.045537 0.076035 tcp 10.0.2.105 49366 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:57.121909 0.156874 tcp 10.0.2.105 49367 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:47:57.342224 3.007679 tcp 10.0.2.105 49368 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:06.344754 0.000000 tcp 10.0.2.105 49368 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:12.343864 0.052475 tcp 10.0.2.105 49369 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:12.396651 0.075725 tcp 10.0.2.105 49370 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:12.472689 0.154147 tcp 10.0.2.105 49371 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:12.637244 3.899252 tcp 10.0.2.105 49372 -> 46.48.247.67 29365 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:16.200088 0.053765 tcp 10.0.2.105 49373 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:16.254184 0.075798 tcp 10.0.2.105 49374 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:16.329944 0.157409 tcp 10.0.2.105 49375 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:48:16.536905 2.996681 tcp 10.0.2.105 49376 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:25.532008 0.000000 tcp 10.0.2.105 49376 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:31.531131 3.004222 tcp 10.0.2.105 49377 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:40.533775 0.000000 tcp 10.0.2.105 49377 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:45.370641 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:48:46.532763 3.003876 tcp 10.0.2.105 49378 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:48:55.535462 0.000000 tcp 10.0.2.105 49378 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:49:01.534941 2.993455 tcp 10.0.2.105 49379 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:49:09.375204 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:49:10.536671 0.000000 tcp 10.0.2.105 49379 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:49:16.536929 3.603466 tcp 10.0.2.105 49380 -> 46.48.247.67 29365 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:50:56.830064 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:50:56.830168 0.173383 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:50:56.995780 0.000000 udp 10.0.2.105 7010 -> 84.173.28.217 7912 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 13:51:13.457689 0.054388 tcp 10.0.2.105 49381 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:13.512442 0.076714 tcp 10.0.2.105 49382 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:13.589606 0.152388 tcp 10.0.2.105 49383 -> 195.113.214.251 443 SRPA* 0 0 39 18440 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:13.741180 0.047182 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:13.773199 0.076403 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:13.833152 0.097787 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:13.914670 0.057502 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:13.971474 0.174521 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:14.143372 0.201402 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:14.372838 0.226431 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:14.591468 0.331396 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:14.887741 0.000000 udp 10.0.2.105 7010 -> 74.15.111.6 3208 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 13:51:33.773605 0.051868 tcp 10.0.2.105 49384 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:33.825775 0.072320 tcp 10.0.2.105 49385 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:33.898422 0.151437 tcp 10.0.2.105 49386 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:51:34.050471 0.169812 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.198480 0.109362 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.271814 0.253712 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.478271 0.087103 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.544387 0.176434 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.699296 0.170903 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:34.845591 0.169819 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.057528 0.150601 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.194624 0.393004 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.570551 0.072371 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.645973 0.082214 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.719142 0.125522 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.800509 0.084805 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:35.872024 0.289612 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.248079 0.175395 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.394546 0.174699 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.565856 0.087869 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.704335 0.241471 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.921459 0.070132 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:36.972808 0.041192 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:37.050874 0.175542 udp 10.0.2.105 7010 <-> 24.207.228.156 6526 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:37.222004 0.177104 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:51:37.394626 0.070278 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/06 13:54:20.132524 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:54:20.132632 3.003658 tcp 10.0.2.105 49387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:54:26.744396 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 13:54:29.134691 0.000000 tcp 10.0.2.105 49387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:54:33.751569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:54:35.135130 0.053690 tcp 10.0.2.105 49388 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:35.189167 0.075972 tcp 10.0.2.105 49389 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:35.265426 0.159029 tcp 10.0.2.105 49390 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:35.455244 2.992997 tcp 10.0.2.105 49391 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:54:41.753220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:54:44.457147 0.000000 tcp 10.0.2.105 49391 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:54:50.456488 0.052953 tcp 10.0.2.105 49392 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:50.509785 0.076605 tcp 10.0.2.105 49393 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:50.586733 0.150912 tcp 10.0.2.105 49394 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:54:51.216912 2.995721 tcp 10.0.2.105 49395 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:54:57.756263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:55:00.209616 0.000000 tcp 10.0.2.105 49395 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:06.218890 0.052779 tcp 10.0.2.105 49396 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:06.271516 0.076057 tcp 10.0.2.105 49397 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:06.347405 0.160182 tcp 10.0.2.105 49398 -> 195.113.214.251 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:06.577782 3.005423 tcp 10.0.2.105 49399 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:15.581895 0.000000 tcp 10.0.2.105 49399 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:21.570952 0.053265 tcp 10.0.2.105 49400 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:21.624572 0.071910 tcp 10.0.2.105 49401 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:21.696931 0.150869 tcp 10.0.2.105 49402 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:21.968603 4.211915 tcp 10.0.2.105 49403 -> 46.48.247.67 29365 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:25.593722 0.053109 tcp 10.0.2.105 49404 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:25.647183 0.075327 tcp 10.0.2.105 49405 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:25.722799 0.156851 tcp 10.0.2.105 49406 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/06 13:55:26.180810 3.000465 tcp 10.0.2.105 49407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:29.762004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 13:55:35.179830 0.000000 tcp 10.0.2.105 49407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:41.178530 3.004861 tcp 10.0.2.105 49408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:50.181450 0.000000 tcp 10.0.2.105 49408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:55:54.867584 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:55:56.180264 3.004231 tcp 10.0.2.105 49409 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:56:05.183164 0.000000 tcp 10.0.2.105 49409 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:56:11.181859 3.004088 tcp 10.0.2.105 49410 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:56:18.872913 0.000233 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 13:56:20.184314 0.000000 tcp 10.0.2.105 49410 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 13:56:26.183570 3.521519 tcp 10.0.2.105 49411 -> 46.48.247.67 29365 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:01:29.700184 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:01:29.700395 3.003383 tcp 10.0.2.105 49412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:01:33.769251 3.000552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:01:38.702614 0.000000 tcp 10.0.2.105 49412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:01:40.775577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:01:44.703122 0.052829 tcp 10.0.2.105 49413 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:01:44.756261 0.077148 tcp 10.0.2.105 49414 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:01:44.833732 0.153264 tcp 10.0.2.105 49415 -> 195.113.214.251 443 SRPA* 0 0 42 22688 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:01:45.141267 3.007879 tcp 10.0.2.105 49416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:01:48.778579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:01:54.144692 0.000000 tcp 10.0.2.105 49416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:00.133823 0.052602 tcp 10.0.2.105 49417 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:00.186809 0.072011 tcp 10.0.2.105 49418 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:00.259116 0.148595 tcp 10.0.2.105 49419 -> 195.113.214.251 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:00.428119 2.999491 tcp 10.0.2.105 49420 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:04.780343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:02:09.436396 0.000000 tcp 10.0.2.105 49420 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:15.426331 0.053517 tcp 10.0.2.105 49421 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:15.479772 0.070777 tcp 10.0.2.105 49422 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:15.550859 0.156460 tcp 10.0.2.105 49423 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:16.047744 3.003031 tcp 10.0.2.105 49424 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:25.049130 0.000000 tcp 10.0.2.105 49424 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:31.048686 0.112865 tcp 10.0.2.105 49425 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:31.161876 0.067065 tcp 10.0.2.105 49426 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:31.229203 0.154297 tcp 10.0.2.105 49427 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:31.489651 4.045774 tcp 10.0.2.105 49428 -> 46.48.247.67 29365 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:35.074470 0.052332 tcp 10.0.2.105 49429 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:35.127153 0.071846 tcp 10.0.2.105 49430 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:35.199364 0.154275 tcp 10.0.2.105 49431 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:02:35.535641 3.066710 tcp 10.0.2.105 49432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:36.786083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:02:44.564851 0.000000 tcp 10.0.2.105 49432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:50.535948 2.993923 tcp 10.0.2.105 49433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:02:59.528911 0.000000 tcp 10.0.2.105 49433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:03:04.376094 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:03:05.537594 3.004386 tcp 10.0.2.105 49434 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:03:14.540367 0.000000 tcp 10.0.2.105 49434 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:03:20.539062 3.004327 tcp 10.0.2.105 49435 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:03:28.370275 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:03:29.541750 0.000000 tcp 10.0.2.105 49435 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:03:35.540853 3.577352 tcp 10.0.2.105 49436 -> 46.48.247.67 29365 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:08:39.109326 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:08:39.109444 3.001946 tcp 10.0.2.105 49437 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:08:40.812133 3.006222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:08:47.819544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:08:48.109896 0.000000 tcp 10.0.2.105 49437 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:08:54.111191 0.054559 tcp 10.0.2.105 49438 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:08:54.166103 0.075214 tcp 10.0.2.105 49439 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:08:54.241232 0.155417 tcp 10.0.2.105 49440 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:08:54.900652 3.003735 tcp 10.0.2.105 49441 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:08:55.822645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:09:03.906136 0.000000 tcp 10.0.2.105 49441 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:09.901639 0.528275 tcp 10.0.2.105 49442 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:10.430249 0.123342 tcp 10.0.2.105 49443 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:10.553999 0.154521 tcp 10.0.2.105 49444 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:11.100347 3.509020 tcp 10.0.2.105 49445 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:12.273959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:09:20.544046 0.000000 tcp 10.0.2.105 49445 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:26.476185 0.053212 tcp 10.0.2.105 49446 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:26.529218 0.072126 tcp 10.0.2.105 49447 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:26.601662 0.155019 tcp 10.0.2.105 49448 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:26.899063 2.957832 tcp 10.0.2.105 49449 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:35.797701 0.000000 tcp 10.0.2.105 49449 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:41.716408 0.052987 tcp 10.0.2.105 49450 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:41.769733 0.072263 tcp 10.0.2.105 49451 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:41.841830 0.157244 tcp 10.0.2.105 49452 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:42.082682 2.987521 tcp 10.0.2.105 49453 -> 46.48.247.67 29365 SPA_* 0 0 9 1027 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:45.068246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:09:48.296263 0.464629 tcp 10.0.2.105 49453 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:48.297266 0.052020 tcp 10.0.2.105 49454 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:48.349865 0.074523 tcp 10.0.2.105 49455 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:48.424678 0.158603 tcp 10.0.2.105 49456 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:09:48.760745 2.961731 tcp 10.0.2.105 49457 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:09:57.655256 0.000000 tcp 10.0.2.105 49457 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:03.589668 2.961237 tcp 10.0.2.105 49458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:12.489732 0.000000 tcp 10.0.2.105 49458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:17.229699 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:10:18.426543 2.965153 tcp 10.0.2.105 49459 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:27.327564 0.000000 tcp 10.0.2.105 49459 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:33.260569 2.968976 tcp 10.0.2.105 49460 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:40.958454 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:10:42.158031 0.000000 tcp 10.0.2.105 49460 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:10:48.078256 3.576107 tcp 10.0.2.105 49461 -> 46.48.247.67 29365 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:15:47.856715 3.005256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:15:51.192446 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:15:51.192565 3.000167 tcp 10.0.2.105 49462 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:15:54.863573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:16:00.193174 0.000000 tcp 10.0.2.105 49462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:02.866093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:16:06.192202 0.053752 tcp 10.0.2.105 49463 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:06.246298 0.074324 tcp 10.0.2.105 49464 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:06.320936 0.254946 tcp 10.0.2.105 49465 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:06.828672 3.006448 tcp 10.0.2.105 49466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:15.833596 0.000000 tcp 10.0.2.105 49466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:18.868085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:16:21.823377 0.052457 tcp 10.0.2.105 49467 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:21.876165 0.074957 tcp 10.0.2.105 49468 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:21.951451 0.156387 tcp 10.0.2.105 49469 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:22.219766 3.007547 tcp 10.0.2.105 49470 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:31.235759 0.000000 tcp 10.0.2.105 49470 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:37.216616 0.051691 tcp 10.0.2.105 49471 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:37.268645 0.070517 tcp 10.0.2.105 49472 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:37.339485 0.157103 tcp 10.0.2.105 49473 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:37.795497 2.994163 tcp 10.0.2.105 49474 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:46.803886 0.000000 tcp 10.0.2.105 49474 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:16:50.899274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:16:52.809278 0.051901 tcp 10.0.2.105 49475 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:52.861496 0.075089 tcp 10.0.2.105 49476 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:52.936971 0.153512 tcp 10.0.2.105 49477 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:53.242810 2.334859 tcp 10.0.2.105 49478 -> 46.48.247.67 29365 FSPA* 0 0 12 1541 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:55.010735 0.052756 tcp 10.0.2.105 49479 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:55.063771 0.076513 tcp 10.0.2.105 49480 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:55.139598 0.150435 tcp 10.0.2.105 49481 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:16:55.577916 2.994650 tcp 10.0.2.105 49482 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:04.564558 0.000000 tcp 10.0.2.105 49482 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:10.570322 2.996290 tcp 10.0.2.105 49483 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:19.565404 0.000000 tcp 10.0.2.105 49483 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:25.560267 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:17:26.740648 2.964976 tcp 10.0.2.105 49484 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:35.649467 0.000000 tcp 10.0.2.105 49484 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:41.579025 2.956036 tcp 10.0.2.105 49485 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:49.296960 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:17:50.473621 0.000000 tcp 10.0.2.105 49485 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:17:56.414395 0.353437 tcp 10.0.2.105 49486 -> 46.48.247.67 29365 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:18:01.427740 0.005002 tcp 10.0.2.105 49486 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:21:44.867250 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:21:44.867348 0.000000 udp 10.0.2.105 7010 -> 74.15.111.6 3208 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 14:22:00.170949 0.051621 tcp 10.0.2.105 49487 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:00.222868 0.070068 tcp 10.0.2.105 49488 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:00.293271 0.153215 tcp 10.0.2.105 49489 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:00.446697 0.174882 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:00.614318 0.046534 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:01.043261 0.076766 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:01.290387 0.174962 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:01.462248 0.199524 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:02.465831 0.061199 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:02.525270 0.099770 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:02.716891 0.258723 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2617 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:02.937279 0.226170 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:03.156195 0.256237 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:03.427619 0.169478 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:03.574946 0.113012 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:03.818254 0.090419 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:03.887307 0.182346 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:04.118893 0.169798 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:04.431098 0.166469 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:04.656760 0.151577 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:04.795665 0.081223 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:22.350759 0.053519 tcp 10.0.2.105 49490 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:22.404572 0.075895 tcp 10.0.2.105 49491 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:22.480766 0.154677 tcp 10.0.2.105 49492 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:22.636036 0.125008 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:22.719267 0.084811 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:23.077297 0.399845 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:23.456084 0.073751 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:26.163183 0.280768 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:28.011690 0.175511 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:28.324802 0.175590 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:28.497622 0.083142 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:29.985292 0.238966 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:30.982362 0.071370 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:31.792853 0.038100 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:32.024365 0.072240 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:32.081701 0.000000 udp 10.0.2.105 7010 -> 24.207.228.156 6526 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 14:22:50.041795 0.052170 tcp 10.0.2.105 49493 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:50.094349 0.070828 tcp 10.0.2.105 49494 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:50.165469 0.148509 tcp 10.0.2.105 49495 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:22:50.314668 0.176815 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:22:54.881005 3.000648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:23:00.636200 2.995303 tcp 10.0.2.105 49496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:01.887898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:23:09.628739 0.000000 tcp 10.0.2.105 49496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:09.889282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:23:14.375367 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:23:15.638165 0.053952 tcp 10.0.2.105 49497 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:15.692464 0.074374 tcp 10.0.2.105 49498 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:15.767202 0.158003 tcp 10.0.2.105 49499 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:16.370184 3.002535 tcp 10.0.2.105 49500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:25.371497 0.000000 tcp 10.0.2.105 49500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:25.892192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:23:31.370134 0.051448 tcp 10.0.2.105 49501 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:31.421972 0.074047 tcp 10.0.2.105 49502 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:31.496324 0.153932 tcp 10.0.2.105 49503 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:31.689217 3.005281 tcp 10.0.2.105 49504 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:40.693231 0.000000 tcp 10.0.2.105 49504 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:46.682707 0.052451 tcp 10.0.2.105 49505 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:46.735454 0.070790 tcp 10.0.2.105 49506 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:46.806527 0.180094 tcp 10.0.2.105 49507 -> 195.113.214.251 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:23:47.979532 2.998641 tcp 10.0.2.105 49508 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:56.986773 0.000000 tcp 10.0.2.105 49508 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:23:57.898155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:24:02.975976 0.052679 tcp 10.0.2.105 49509 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:03.028976 0.075380 tcp 10.0.2.105 49510 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:03.104658 0.146286 tcp 10.0.2.105 49511 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:03.269583 2.140290 tcp 10.0.2.105 49512 -> 46.48.247.67 29365 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:05.004499 0.051251 tcp 10.0.2.105 49513 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:05.056071 0.069631 tcp 10.0.2.105 49514 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:05.126002 0.143802 tcp 10.0.2.105 49515 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:24:05.410115 3.002984 tcp 10.0.2.105 49516 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:14.411849 0.000000 tcp 10.0.2.105 49516 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:20.410807 3.116498 tcp 10.0.2.105 49517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:29.478391 0.000000 tcp 10.0.2.105 49517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:34.392449 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:24:35.437804 2.990025 tcp 10.0.2.105 49518 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:44.662539 0.000000 tcp 10.0.2.105 49518 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:50.608717 2.966680 tcp 10.0.2.105 49519 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:24:59.842556 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:25:00.881447 0.000000 tcp 10.0.2.105 49519 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:25:06.809484 3.245063 tcp 10.0.2.105 49520 -> 46.48.247.67 29365 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:01.905221 3.000420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:30:07.209115 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:30:07.209224 3.004178 tcp 10.0.2.105 49521 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:08.911012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:30:16.211747 0.000000 tcp 10.0.2.105 49521 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:16.914007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:30:22.212568 0.046032 tcp 10.0.2.105 49522 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:22.258972 0.056433 tcp 10.0.2.105 49523 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:22.315766 0.143776 tcp 10.0.2.105 49524 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:22.694311 3.001426 tcp 10.0.2.105 49525 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:31.693926 0.000000 tcp 10.0.2.105 49525 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:32.915430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:30:37.693561 0.045276 tcp 10.0.2.105 49526 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:37.739151 0.055658 tcp 10.0.2.105 49527 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:37.795112 0.138003 tcp 10.0.2.105 49528 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:37.943776 3.003917 tcp 10.0.2.105 49529 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:46.955689 0.000000 tcp 10.0.2.105 49529 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:30:52.944784 0.044990 tcp 10.0.2.105 49530 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:52.990155 0.053974 tcp 10.0.2.105 49531 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:53.044963 0.135187 tcp 10.0.2.105 49532 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:30:53.265243 2.994169 tcp 10.0.2.105 49533 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:02.258133 0.000000 tcp 10.0.2.105 49533 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:04.922206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:31:08.266761 0.045475 tcp 10.0.2.105 49534 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:08.312503 0.053806 tcp 10.0.2.105 49535 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:08.366667 0.143129 tcp 10.0.2.105 49536 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:08.609067 2.817533 tcp 10.0.2.105 49537 -> 46.48.247.67 29365 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:10.340012 0.045369 tcp 10.0.2.105 49538 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:10.385650 0.052805 tcp 10.0.2.105 49539 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:10.438724 0.137642 tcp 10.0.2.105 49540 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:31:11.426894 2.998732 tcp 10.0.2.105 49541 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:20.423865 0.000000 tcp 10.0.2.105 49541 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:26.423361 3.003789 tcp 10.0.2.105 49542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:35.435459 0.000000 tcp 10.0.2.105 49542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:40.373098 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:31:41.424724 2.994048 tcp 10.0.2.105 49543 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:50.427510 0.000000 tcp 10.0.2.105 49543 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:31:56.426319 2.993917 tcp 10.0.2.105 49544 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:32:04.367265 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:32:05.418878 0.000000 tcp 10.0.2.105 49544 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:32:11.429104 1.749287 tcp 10.0.2.105 49545 -> 46.48.247.67 29365 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:08.927708 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:37:13.172065 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:37:13.172180 3.003587 tcp 10.0.2.105 49546 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:15.935676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:37:22.174679 0.000000 tcp 10.0.2.105 49546 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:23.936865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:37:28.174883 0.045258 tcp 10.0.2.105 49547 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:28.220552 0.052533 tcp 10.0.2.105 49548 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:28.273378 0.143078 tcp 10.0.2.105 49549 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:29.296481 2.992424 tcp 10.0.2.105 49550 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:38.287489 0.000000 tcp 10.0.2.105 49550 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:39.940051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:37:44.450200 0.044896 tcp 10.0.2.105 49551 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:44.495469 0.053159 tcp 10.0.2.105 49552 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:44.548997 0.144683 tcp 10.0.2.105 49553 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:45.071219 2.966400 tcp 10.0.2.105 49554 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:53.977427 0.000000 tcp 10.0.2.105 49554 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:37:59.926524 0.045219 tcp 10.0.2.105 49555 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:37:59.972088 0.052817 tcp 10.0.2.105 49556 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:00.025162 0.137993 tcp 10.0.2.105 49557 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:00.431696 3.002055 tcp 10.0.2.105 49558 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:09.432177 0.000000 tcp 10.0.2.105 49558 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:11.956031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:38:15.421422 0.045017 tcp 10.0.2.105 49559 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:15.466781 0.052645 tcp 10.0.2.105 49560 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:15.519786 0.163612 tcp 10.0.2.105 49561 -> 195.113.214.251 443 SRPA* 0 0 73 77632 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:15.729496 2.135276 tcp 10.0.2.105 49562 -> 46.48.247.67 29365 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:17.460076 0.044542 tcp 10.0.2.105 49563 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:17.504908 0.052721 tcp 10.0.2.105 49564 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:17.557927 0.143233 tcp 10.0.2.105 49565 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:38:17.864998 2.993732 tcp 10.0.2.105 49566 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:26.867232 0.000000 tcp 10.0.2.105 49566 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:32.856141 2.994116 tcp 10.0.2.105 49567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:41.849169 0.000000 tcp 10.0.2.105 49567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:46.375497 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:38:47.857782 3.004088 tcp 10.0.2.105 49568 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:38:56.860677 0.000000 tcp 10.0.2.105 49568 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:39:02.859413 3.004101 tcp 10.0.2.105 49569 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:39:10.369679 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:39:11.862046 0.000000 tcp 10.0.2.105 49569 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:39:17.860739 3.420295 tcp 10.0.2.105 49570 -> 46.48.247.67 29365 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:15.963240 3.000368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:44:21.278239 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:44:21.278419 3.002776 tcp 10.0.2.105 49571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:44:22.970024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:44:30.279835 0.000000 tcp 10.0.2.105 49571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:44:30.970780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:44:36.280720 0.046377 tcp 10.0.2.105 49572 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:36.327456 0.055193 tcp 10.0.2.105 49573 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:36.382930 0.143168 tcp 10.0.2.105 49574 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:36.881458 3.002435 tcp 10.0.2.105 49575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:44:45.882279 0.000000 tcp 10.0.2.105 49575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:44:46.974008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:44:51.881663 0.044846 tcp 10.0.2.105 49576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:51.926369 0.055613 tcp 10.0.2.105 49577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:51.982189 0.139898 tcp 10.0.2.105 49578 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:44:52.293175 3.002848 tcp 10.0.2.105 49579 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:01.293995 0.000000 tcp 10.0.2.105 49579 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:07.293459 0.044143 tcp 10.0.2.105 49580 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:07.337893 0.053508 tcp 10.0.2.105 49581 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:07.391254 0.139078 tcp 10.0.2.105 49582 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:07.749082 2.999426 tcp 10.0.2.105 49583 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:16.756886 0.000000 tcp 10.0.2.105 49583 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:18.980059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:45:22.746104 0.044630 tcp 10.0.2.105 49584 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:22.791019 0.055483 tcp 10.0.2.105 49585 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:22.846312 0.141953 tcp 10.0.2.105 49586 -> 195.113.214.251 443 SRPA* 0 0 29 15870 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:23.058801 3.362349 tcp 10.0.2.105 49587 -> 46.48.247.67 29365 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:26.144263 0.043719 tcp 10.0.2.105 49588 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:26.188416 0.059638 tcp 10.0.2.105 49589 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:26.248514 0.146580 tcp 10.0.2.105 49590 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:45:26.421380 3.003546 tcp 10.0.2.105 49591 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:35.423599 0.000000 tcp 10.0.2.105 49591 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:41.412286 3.005175 tcp 10.0.2.105 49592 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:50.415123 0.000000 tcp 10.0.2.105 49592 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:45:55.372184 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:45:56.414087 2.996778 tcp 10.0.2.105 49593 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:46:05.416910 0.000000 tcp 10.0.2.105 49593 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:46:11.415598 2.993622 tcp 10.0.2.105 49594 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:46:19.366153 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:46:20.408209 0.000000 tcp 10.0.2.105 49594 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:46:26.417098 3.444262 tcp 10.0.2.105 49595 -> 46.48.247.67 29365 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:52:58.090255 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:52:58.090360 0.081807 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:52:58.163079 0.000000 udp 10.0.2.105 7010 -> 24.207.228.156 6526 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 14:52:59.863125 3.003804 tcp 10.0.2.105 49596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:53:08.865347 0.000000 tcp 10.0.2.105 49596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:53:14.866157 0.045512 tcp 10.0.2.105 49597 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:14.911955 0.045552 tcp 10.0.2.105 49598 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:14.957857 0.140685 tcp 10.0.2.105 49599 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:15.314029 2.994676 tcp 10.0.2.105 49600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:53:16.126360 0.045339 tcp 10.0.2.105 49601 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:16.172033 0.050389 tcp 10.0.2.105 49602 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:16.222725 0.139770 tcp 10.0.2.105 49603 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:53:16.363336 0.172445 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:16.528006 0.046634 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:16.584274 0.081998 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:16.651726 0.172738 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:16.821161 0.092590 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:16.897890 0.266605 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.125871 0.207008 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.324907 0.060025 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.487335 0.088798 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.553901 0.174968 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.741513 0.170239 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:17.890422 0.225827 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.108967 0.254415 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.315943 0.111596 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.388715 0.173721 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.622976 0.150982 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.759895 0.168054 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:18.959748 0.088704 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:19.011891 0.135601 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:19.107221 0.393731 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:19.479773 0.077104 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:19.556995 0.290575 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:19.889244 0.176230 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.062045 0.177210 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.209199 0.082897 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.277484 0.235695 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.492478 0.039139 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.599899 0.075762 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.655288 0.069162 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:20.710269 0.175405 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/06 14:53:24.307892 0.000000 tcp 10.0.2.105 49600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:54:37.986756 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 14:54:44.993758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:54:52.995385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:55:08.998171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:55:41.005126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 14:58:30.308318 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 14:58:30.308478 3.003790 tcp 10.0.2.105 49604 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:58:39.310722 0.000000 tcp 10.0.2.105 49604 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:58:45.311342 0.045297 tcp 10.0.2.105 49605 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:58:45.357004 0.053144 tcp 10.0.2.105 49606 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:58:45.410430 0.139286 tcp 10.0.2.105 49607 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:58:45.731991 3.001911 tcp 10.0.2.105 49608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:58:54.733103 0.000000 tcp 10.0.2.105 49608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:00.732127 0.045225 tcp 10.0.2.105 49609 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:00.777653 0.045635 tcp 10.0.2.105 49610 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:00.823643 0.213923 tcp 10.0.2.105 49611 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:01.137627 2.999149 tcp 10.0.2.105 49612 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:10.134837 0.000000 tcp 10.0.2.105 49612 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:16.134478 0.044595 tcp 10.0.2.105 49613 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:16.179356 0.045796 tcp 10.0.2.105 49614 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:16.225484 0.140559 tcp 10.0.2.105 49615 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:16.375857 2.992372 tcp 10.0.2.105 49616 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:25.376936 0.000000 tcp 10.0.2.105 49616 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:31.376214 0.044967 tcp 10.0.2.105 49617 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:31.421473 0.049220 tcp 10.0.2.105 49618 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:31.470560 0.137790 tcp 10.0.2.105 49619 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:31.627352 1.983890 tcp 10.0.2.105 49620 -> 46.48.247.67 29365 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:33.354166 0.044862 tcp 10.0.2.105 49621 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:33.399320 0.046311 tcp 10.0.2.105 49622 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:33.445973 0.145579 tcp 10.0.2.105 49623 -> 195.113.214.251 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/06 14:59:33.611503 3.001563 tcp 10.0.2.105 49624 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:42.611677 0.000000 tcp 10.0.2.105 49624 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:48.610425 3.004138 tcp 10.0.2.105 49625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 14:59:57.613523 0.000000 tcp 10.0.2.105 49625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:00:02.369749 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:00:03.612219 3.004211 tcp 10.0.2.105 49626 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:00:12.614813 0.000000 tcp 10.0.2.105 49626 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:00:18.613431 2.994435 tcp 10.0.2.105 49627 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:00:26.374261 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:00:27.616456 0.000000 tcp 10.0.2.105 49627 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:00:33.615411 3.621553 tcp 10.0.2.105 49628 -> 46.48.247.67 29365 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:01:45.009654 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:01:52.017300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:02:00.019404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:02:16.022166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:02:48.029146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:05:37.231981 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:05:37.232083 3.003713 tcp 10.0.2.105 49629 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:05:46.234093 0.000000 tcp 10.0.2.105 49629 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:05:52.235243 0.046498 tcp 10.0.2.105 49630 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:05:52.282085 0.052902 tcp 10.0.2.105 49631 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:05:52.335314 0.132520 tcp 10.0.2.105 49632 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:05:53.094516 2.994133 tcp 10.0.2.105 49633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:02.086667 0.000000 tcp 10.0.2.105 49633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:08.101119 0.044724 tcp 10.0.2.105 49634 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:08.146161 0.054028 tcp 10.0.2.105 49635 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:08.200059 0.136451 tcp 10.0.2.105 49636 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:08.481640 2.979289 tcp 10.0.2.105 49637 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:17.459455 0.000000 tcp 10.0.2.105 49637 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:23.478460 0.044297 tcp 10.0.2.105 49638 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:23.523105 0.054304 tcp 10.0.2.105 49639 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:23.577718 0.146108 tcp 10.0.2.105 49640 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:23.734568 2.998403 tcp 10.0.2.105 49641 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:32.731422 0.000000 tcp 10.0.2.105 49641 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:38.730525 0.045439 tcp 10.0.2.105 49642 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:38.775950 0.048850 tcp 10.0.2.105 49643 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:38.824642 0.146038 tcp 10.0.2.105 49644 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:39.153985 3.786769 tcp 10.0.2.105 49645 -> 46.48.247.67 29365 FSPA* 0 0 15 1736 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:40.902865 0.045779 tcp 10.0.2.105 49646 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:40.948961 0.045040 tcp 10.0.2.105 49647 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:40.994329 0.144047 tcp 10.0.2.105 49648 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:06:41.164490 2.993206 tcp 10.0.2.105 49649 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:50.166267 0.000000 tcp 10.0.2.105 49649 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:06:56.165284 2.993789 tcp 10.0.2.105 49650 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:05.157362 0.000000 tcp 10.0.2.105 49650 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:09.874907 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:07:11.166835 2.994905 tcp 10.0.2.105 49651 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:20.159543 0.000000 tcp 10.0.2.105 49651 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:26.167828 3.004808 tcp 10.0.2.105 49652 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:33.869024 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:07:35.171041 0.000000 tcp 10.0.2.105 49652 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:07:41.170556 1.750723 tcp 10.0.2.105 49653 -> 46.48.247.67 29365 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:08:52.034047 3.001285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:08:59.042035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:09:07.043371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:09:23.047061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:09:55.052147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:12:42.914075 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:12:42.914199 2.993604 tcp 10.0.2.105 49654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:12:51.916618 0.000000 tcp 10.0.2.105 49654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:12:58.052121 0.046237 tcp 10.0.2.105 49655 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:12:58.098654 0.045433 tcp 10.0.2.105 49656 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:12:58.144591 0.142088 tcp 10.0.2.105 49657 -> 195.113.214.251 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:12:58.722457 2.967847 tcp 10.0.2.105 49658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:07.632030 0.000000 tcp 10.0.2.105 49658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:13.589291 0.044737 tcp 10.0.2.105 49659 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:13.634390 0.049294 tcp 10.0.2.105 49660 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:13.683997 0.135313 tcp 10.0.2.105 49661 -> 195.113.214.251 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:13.860304 3.001866 tcp 10.0.2.105 49662 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:22.860901 0.000000 tcp 10.0.2.105 49662 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:28.860276 0.045478 tcp 10.0.2.105 49663 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:28.906098 0.046487 tcp 10.0.2.105 49664 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:28.952869 0.136334 tcp 10.0.2.105 49665 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:29.934877 3.000638 tcp 10.0.2.105 49666 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:38.933985 0.000000 tcp 10.0.2.105 49666 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:13:44.933276 0.124740 tcp 10.0.2.105 49667 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:45.058387 0.045219 tcp 10.0.2.105 49668 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:45.103975 0.144922 tcp 10.0.2.105 49669 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:45.425372 0.348137 tcp 10.0.2.105 49670 -> 46.48.247.67 29365 SPA_* 0 0 9 1047 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:56.187150 0.603624 tcp 10.0.2.105 49670 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:56.187920 0.045328 tcp 10.0.2.105 49671 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:56.233600 0.047927 tcp 10.0.2.105 49672 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:56.281887 0.136862 tcp 10.0.2.105 49673 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:13:56.791005 3.002942 tcp 10.0.2.105 49674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:05.792634 0.000000 tcp 10.0.2.105 49674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:11.792818 3.002588 tcp 10.0.2.105 49675 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:20.794227 0.000000 tcp 10.0.2.105 49675 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:25.370856 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:14:26.793136 2.993993 tcp 10.0.2.105 49676 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:35.795824 0.000000 tcp 10.0.2.105 49676 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:41.794433 2.994201 tcp 10.0.2.105 49677 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:49.375304 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:14:50.787235 0.000000 tcp 10.0.2.105 49677 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:14:56.795935 1.814674 tcp 10.0.2.105 49678 -> 46.48.247.67 29365 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:15:59.058442 3.001286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:16:06.065833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:16:14.066804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:16:30.070111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:17:02.076332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:19:58.600504 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:19:58.600612 3.003437 tcp 10.0.2.105 49679 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:07.602993 0.000000 tcp 10.0.2.105 49679 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:13.604818 0.045228 tcp 10.0.2.105 49680 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:13.650343 0.046280 tcp 10.0.2.105 49681 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:13.696953 0.149442 tcp 10.0.2.105 49682 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:13.935093 3.001413 tcp 10.0.2.105 49683 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:22.935104 0.000000 tcp 10.0.2.105 49683 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:28.933865 0.044829 tcp 10.0.2.105 49684 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:28.979000 0.045600 tcp 10.0.2.105 49685 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:29.024905 0.140769 tcp 10.0.2.105 49686 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:29.520298 2.998359 tcp 10.0.2.105 49687 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:38.528044 0.000000 tcp 10.0.2.105 49687 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:44.516838 0.044650 tcp 10.0.2.105 49688 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:44.561763 0.044970 tcp 10.0.2.105 49689 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:44.607024 0.143574 tcp 10.0.2.105 49690 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:44.868267 3.002517 tcp 10.0.2.105 49691 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:53.869293 0.000000 tcp 10.0.2.105 49691 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:20:59.868824 0.044199 tcp 10.0.2.105 49692 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:59.913425 0.045310 tcp 10.0.2.105 49693 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:20:59.959063 0.140573 tcp 10.0.2.105 49694 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:00.251839 2.216472 tcp 10.0.2.105 49695 -> 46.48.247.67 29365 FSPA* 0 0 13 1581 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:01.998659 0.044440 tcp 10.0.2.105 49696 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:02.043332 0.047965 tcp 10.0.2.105 49697 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:02.091547 0.141014 tcp 10.0.2.105 49698 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:02.468621 3.007387 tcp 10.0.2.105 49699 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:10.149107 0.000158 tcp 10.0.2.105 49695 -> 46.48.247.67 29365 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:21:11.474967 0.000000 tcp 10.0.2.105 49699 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:17.463486 2.994040 tcp 10.0.2.105 49700 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:26.465900 0.000000 tcp 10.0.2.105 49700 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:31.373239 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:21:32.465110 2.993947 tcp 10.0.2.105 49701 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:41.457744 0.000000 tcp 10.0.2.105 49701 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:47.954628 2.953913 tcp 10.0.2.105 49702 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:21:55.759760 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:21:56.836491 0.000000 tcp 10.0.2.105 49702 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:22:02.772982 1.752410 tcp 10.0.2.105 49703 -> 46.48.247.67 29365 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:23:06.082753 3.000542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:23:13.089131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:23:21.090886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:23:37.094112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:23:45.486595 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:23:45.486699 0.083755 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:45.561718 0.103137 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:45.704899 0.173642 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:45.875396 0.093041 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.007227 0.173646 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.173192 0.047135 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.325309 0.264689 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.555474 0.198352 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.748983 0.060782 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.881760 0.087761 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:46.946811 0.178619 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:47.102479 0.252452 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:47.620658 0.110256 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:47.692987 0.168753 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:47.855369 0.230483 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:48.077899 0.176558 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:48.400597 0.149381 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:48.536493 0.167213 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:48.727329 0.087482 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:48.776663 0.099248 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 1887 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:49.055804 0.136113 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:49.152279 0.412519 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:49.544939 0.293465 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.058470 0.175371 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.230762 0.175670 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.375560 0.084872 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.524555 0.069775 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.576696 0.066048 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.815522 0.176023 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:50.988207 0.239754 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:23:51.203490 0.038135 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:24:09.100384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:27:04.242769 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:27:04.242881 3.003431 tcp 10.0.2.105 49704 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:13.245127 0.000000 tcp 10.0.2.105 49704 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:19.245207 0.046078 tcp 10.0.2.105 49705 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:19.291530 0.045288 tcp 10.0.2.105 49706 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:19.337209 0.138162 tcp 10.0.2.105 49707 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:19.590882 2.997663 tcp 10.0.2.105 49708 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:28.597138 0.000000 tcp 10.0.2.105 49708 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:34.586080 0.045390 tcp 10.0.2.105 49709 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:34.631285 0.045810 tcp 10.0.2.105 49710 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:34.677538 0.147906 tcp 10.0.2.105 49711 -> 195.113.214.251 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:35.128662 3.002059 tcp 10.0.2.105 49712 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:44.129383 0.000000 tcp 10.0.2.105 49712 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:50.128061 0.046191 tcp 10.0.2.105 49713 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:50.174181 0.045712 tcp 10.0.2.105 49714 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:50.220169 0.141199 tcp 10.0.2.105 49715 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:27:50.779822 3.003163 tcp 10.0.2.105 49716 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:27:59.781844 0.000000 tcp 10.0.2.105 49716 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:05.781204 0.047019 tcp 10.0.2.105 49717 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:05.828006 0.046986 tcp 10.0.2.105 49718 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:05.875278 0.146791 tcp 10.0.2.105 49719 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:06.089050 0.353033 tcp 10.0.2.105 49720 -> 46.48.247.67 29365 SPA_* 0 0 9 1068 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:16.318245 0.550098 tcp 10.0.2.105 49720 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:16.319152 0.102939 tcp 10.0.2.105 49721 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:16.422379 0.045266 tcp 10.0.2.105 49722 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:16.467973 0.136014 tcp 10.0.2.105 49723 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:28:16.868559 3.002332 tcp 10.0.2.105 49724 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:25.869303 0.000000 tcp 10.0.2.105 49724 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:31.868276 3.004061 tcp 10.0.2.105 49725 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:40.870889 0.000000 tcp 10.0.2.105 49725 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:45.868351 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:28:46.869663 3.004092 tcp 10.0.2.105 49726 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:28:55.872494 0.000000 tcp 10.0.2.105 49726 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:29:01.872935 3.002537 tcp 10.0.2.105 49727 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:29:09.872583 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:29:10.873943 0.000000 tcp 10.0.2.105 49727 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:29:16.872638 0.349881 tcp 10.0.2.105 49728 -> 46.48.247.67 29365 SPA_* 0 0 9 1068 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:29:26.066751 0.000451 tcp 10.0.2.105 49728 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:30:13.106815 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:30:20.113615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:30:28.115159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:30:44.117927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:31:16.124052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:34:26.067335 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:34:26.067438 3.004536 tcp 10.0.2.105 49729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:34:35.070956 0.000000 tcp 10.0.2.105 49729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:34:41.070811 0.045763 tcp 10.0.2.105 49730 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:41.116884 0.049020 tcp 10.0.2.105 49731 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:41.166186 0.143665 tcp 10.0.2.105 49732 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:41.372271 3.001232 tcp 10.0.2.105 49733 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:34:50.372288 0.000000 tcp 10.0.2.105 49733 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:34:56.371095 0.044977 tcp 10.0.2.105 49734 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:56.416532 0.045993 tcp 10.0.2.105 49735 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:56.462836 0.287729 tcp 10.0.2.105 49736 -> 195.113.214.251 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:34:56.925669 3.000062 tcp 10.0.2.105 49737 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:05.924108 0.000000 tcp 10.0.2.105 49737 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:11.923394 0.044175 tcp 10.0.2.105 49738 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:11.967416 0.046637 tcp 10.0.2.105 49739 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:12.014382 0.143147 tcp 10.0.2.105 49740 -> 195.113.214.251 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:12.403148 2.995122 tcp 10.0.2.105 49741 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:21.406877 0.000000 tcp 10.0.2.105 49741 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:27.395908 0.044460 tcp 10.0.2.105 49742 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:27.440665 0.046083 tcp 10.0.2.105 49743 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:27.487132 0.145611 tcp 10.0.2.105 49744 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:27.660723 2.118027 tcp 10.0.2.105 49745 -> 46.48.247.67 29365 FSPA* 0 0 12 1587 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:29.434393 0.091075 tcp 10.0.2.105 49746 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:29.525796 0.046606 tcp 10.0.2.105 49747 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:29.572714 0.142939 tcp 10.0.2.105 49748 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:35:29.779007 3.004752 tcp 10.0.2.105 49749 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:38.781749 0.000000 tcp 10.0.2.105 49749 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:44.780632 3.003859 tcp 10.0.2.105 49750 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:53.783262 0.000000 tcp 10.0.2.105 49750 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:35:58.369850 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:35:59.784733 3.003722 tcp 10.0.2.105 49751 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:36:08.784684 0.000000 tcp 10.0.2.105 49751 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:36:14.783725 2.994091 tcp 10.0.2.105 49752 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:36:22.375820 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:36:23.786471 0.000000 tcp 10.0.2.105 49752 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:36:29.785357 1.768628 tcp 10.0.2.105 49753 -> 46.48.247.67 29365 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:37:20.130928 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:37:27.137626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:37:35.139132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:37:51.142149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:38:23.148715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:41:31.549438 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:41:31.549522 3.003676 tcp 10.0.2.105 49754 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:41:40.551888 0.000000 tcp 10.0.2.105 49754 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:41:46.552383 0.371039 tcp 10.0.2.105 49755 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:41:46.923259 0.046376 tcp 10.0.2.105 49756 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:41:46.969928 0.139985 tcp 10.0.2.105 49757 -> 195.113.214.251 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:41:47.298229 2.975987 tcp 10.0.2.105 49758 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:41:56.219607 0.000000 tcp 10.0.2.105 49758 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:02.162385 0.045289 tcp 10.0.2.105 49759 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:02.207999 0.044931 tcp 10.0.2.105 49760 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:02.253231 0.135270 tcp 10.0.2.105 49761 -> 195.113.214.251 443 SRPA* 0 0 26 13094 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:02.466361 2.974004 tcp 10.0.2.105 49762 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:11.395938 0.000000 tcp 10.0.2.105 49762 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:17.334530 0.044404 tcp 10.0.2.105 49763 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:17.379244 0.047176 tcp 10.0.2.105 49764 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:17.426777 0.134628 tcp 10.0.2.105 49765 -> 195.113.214.251 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:17.651486 2.955299 tcp 10.0.2.105 49766 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:26.587937 0.000000 tcp 10.0.2.105 49766 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:32.597555 0.045414 tcp 10.0.2.105 49767 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:32.643231 0.049965 tcp 10.0.2.105 49768 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:32.693472 0.142110 tcp 10.0.2.105 49769 -> 195.113.214.251 443 SRPA* 0 0 35 18780 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:32.969017 0.347749 tcp 10.0.2.105 49770 -> 46.48.247.67 29365 SPA_* 0 0 9 1169 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:41.292283 1.008086 tcp 10.0.2.105 49770 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:41.293078 0.044527 tcp 10.0.2.105 49771 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:41.337424 0.045338 tcp 10.0.2.105 49772 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:41.383105 0.142206 tcp 10.0.2.105 49773 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:42:42.300951 2.982613 tcp 10.0.2.105 49774 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:51.223584 0.000000 tcp 10.0.2.105 49774 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:42:57.164192 2.977396 tcp 10.0.2.105 49775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:06.084129 0.000000 tcp 10.0.2.105 49775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:10.901507 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:43:12.044233 2.974420 tcp 10.0.2.105 49776 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:21.026171 0.000000 tcp 10.0.2.105 49776 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:27.025089 2.993654 tcp 10.0.2.105 49777 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:34.866528 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:43:36.018003 0.000000 tcp 10.0.2.105 49777 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:43:42.027281 1.749513 tcp 10.0.2.105 49778 -> 46.48.247.67 29365 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:44:27.154652 3.001162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:44:34.161497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:44:42.162968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:44:58.626843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:45:30.244110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:48:43.771017 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:48:43.771142 3.003146 tcp 10.0.2.105 49779 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:48:52.773511 0.000000 tcp 10.0.2.105 49779 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:48:58.773707 0.046389 tcp 10.0.2.105 49780 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:48:58.820403 0.044713 tcp 10.0.2.105 49781 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:48:58.865472 0.137033 tcp 10.0.2.105 49782 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:48:59.056119 3.000724 tcp 10.0.2.105 49783 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:08.055264 0.000000 tcp 10.0.2.105 49783 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:14.054603 0.045332 tcp 10.0.2.105 49784 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:14.100244 0.048156 tcp 10.0.2.105 49785 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:14.148758 0.137952 tcp 10.0.2.105 49786 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:14.343155 2.995738 tcp 10.0.2.105 49787 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:23.347221 0.000000 tcp 10.0.2.105 49787 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:29.336692 0.045443 tcp 10.0.2.105 49788 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:29.382496 0.045011 tcp 10.0.2.105 49789 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:29.427833 0.146532 tcp 10.0.2.105 49790 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:29.590437 3.000266 tcp 10.0.2.105 49791 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:38.589042 0.000000 tcp 10.0.2.105 49791 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:49:44.588615 0.045379 tcp 10.0.2.105 49792 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:44.634242 0.046710 tcp 10.0.2.105 49793 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:44.681274 0.139914 tcp 10.0.2.105 49794 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:44.924836 0.348955 tcp 10.0.2.105 49795 -> 46.48.247.67 29365 SPA_* 0 0 9 1043 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:52.645405 0.276278 tcp 10.0.2.105 49795 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:52.646479 0.044649 tcp 10.0.2.105 49796 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:52.691443 0.045425 tcp 10.0.2.105 49797 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:52.737143 0.134656 tcp 10.0.2.105 49798 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:49:52.921947 3.002089 tcp 10.0.2.105 49799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:01.922698 0.000000 tcp 10.0.2.105 49799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:07.921738 3.003925 tcp 10.0.2.105 49800 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:16.924415 0.000000 tcp 10.0.2.105 49800 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:21.871464 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:50:22.923238 3.003986 tcp 10.0.2.105 49801 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:31.936024 0.000000 tcp 10.0.2.105 49801 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:37.924839 2.994038 tcp 10.0.2.105 49802 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:45.865769 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:50:46.917295 0.000000 tcp 10.0.2.105 49802 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:50:52.926005 2.923090 tcp 10.0.2.105 49803 -> 46.48.247.67 29365 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:54:01.357550 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:54:01.357685 0.178952 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.533906 0.095606 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.614170 0.080371 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 1990 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.685436 0.076615 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.746500 0.171724 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2014 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.911204 0.045946 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:01.972425 0.272994 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:02.211411 0.200876 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:02.429016 0.062104 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:02.502663 0.083858 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:02.567288 0.176308 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:02.723563 0.309842 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.008652 0.223292 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.224577 0.252074 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.430216 0.109987 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.503240 0.171571 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.647823 0.156107 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.784811 0.167998 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:03.927548 0.091447 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:04.034033 0.073960 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:04.281903 0.291764 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:04.625756 0.141039 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:04.723116 0.400983 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.104485 0.175662 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.277220 0.170311 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.421407 0.088695 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.561227 0.070540 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.611634 0.067109 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:05.857811 0.179200 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:06.031600 0.242476 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:06.251697 0.037776 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/06 15:54:45.192620 3.001585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 15:54:52.200166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:55:00.201697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:55:16.204845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:55:48.210818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 15:55:55.842188 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:55:55.842345 3.003449 tcp 10.0.2.105 49804 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:04.844388 0.000000 tcp 10.0.2.105 49804 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:10.844868 0.044965 tcp 10.0.2.105 49805 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:10.890117 0.046379 tcp 10.0.2.105 49806 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:10.936828 0.143654 tcp 10.0.2.105 49807 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:11.228720 2.999184 tcp 10.0.2.105 49808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:20.236598 0.000000 tcp 10.0.2.105 49808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:26.226117 0.045192 tcp 10.0.2.105 49809 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:26.271642 0.045884 tcp 10.0.2.105 49810 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:26.317803 0.140102 tcp 10.0.2.105 49811 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:26.564478 2.995914 tcp 10.0.2.105 49812 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:35.558420 0.000000 tcp 10.0.2.105 49812 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:41.557953 0.045254 tcp 10.0.2.105 49813 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:41.603578 0.045199 tcp 10.0.2.105 49814 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:41.649123 0.136317 tcp 10.0.2.105 49815 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:41.863153 2.998844 tcp 10.0.2.105 49816 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:50.860898 0.000000 tcp 10.0.2.105 49816 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:56:56.860098 0.044932 tcp 10.0.2.105 49817 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:56.905487 0.048546 tcp 10.0.2.105 49818 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:56.954278 0.140134 tcp 10.0.2.105 49819 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:56:57.651906 3.578445 tcp 10.0.2.105 49820 -> 46.48.247.67 29365 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:57:00.941631 0.045073 tcp 10.0.2.105 49821 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:57:00.986994 0.048846 tcp 10.0.2.105 49822 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:57:01.036169 0.141245 tcp 10.0.2.105 49823 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 15:57:01.230590 2.976732 tcp 10.0.2.105 49824 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:10.198753 0.000000 tcp 10.0.2.105 49824 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:16.197444 3.003994 tcp 10.0.2.105 49825 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:25.199702 0.000000 tcp 10.0.2.105 49825 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:29.866680 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:57:31.199099 3.003898 tcp 10.0.2.105 49826 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:40.201668 0.000000 tcp 10.0.2.105 49826 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:46.200319 3.004525 tcp 10.0.2.105 49827 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:57:53.871338 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 15:57:55.203264 0.000000 tcp 10.0.2.105 49827 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 15:58:01.202046 4.997196 tcp 10.0.2.105 49828 -> 46.48.247.67 29365 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:01:52.217250 3.001484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:01:59.223834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:02:07.225908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:02:23.228391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:02:55.234900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:03:06.191200 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:03:06.191312 3.003448 tcp 10.0.2.105 49829 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:15.193299 0.000000 tcp 10.0.2.105 49829 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:21.193574 0.046273 tcp 10.0.2.105 49830 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:21.240189 0.051853 tcp 10.0.2.105 49831 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:21.292495 0.141064 tcp 10.0.2.105 49832 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:21.446880 2.999948 tcp 10.0.2.105 49833 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:30.445325 0.000000 tcp 10.0.2.105 49833 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:36.444772 0.044557 tcp 10.0.2.105 49834 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:36.489698 0.047431 tcp 10.0.2.105 49835 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:36.537439 0.137709 tcp 10.0.2.105 49836 -> 195.113.214.251 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:36.695992 2.992788 tcp 10.0.2.105 49837 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:45.697076 0.000000 tcp 10.0.2.105 49837 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:03:51.696273 0.045066 tcp 10.0.2.105 49838 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:51.741205 0.052655 tcp 10.0.2.105 49839 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:51.793699 0.133725 tcp 10.0.2.105 49840 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:03:51.942105 2.998071 tcp 10.0.2.105 49841 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:00.939101 0.000000 tcp 10.0.2.105 49841 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:06.938389 0.044266 tcp 10.0.2.105 49842 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:06.982958 0.048464 tcp 10.0.2.105 49843 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:07.031750 0.135716 tcp 10.0.2.105 49844 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:07.182100 4.828173 tcp 10.0.2.105 49845 -> 46.48.247.67 29365 SPA_* 0 0 12 1545 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:12.010920 0.045006 tcp 10.0.2.105 49846 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:12.056186 0.048586 tcp 10.0.2.105 49847 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:12.105068 0.143174 tcp 10.0.2.105 49848 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:12.257902 0.000094 tcp 10.0.2.105 49845 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:04:12.258238 3.001449 tcp 10.0.2.105 49849 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:21.258310 0.000000 tcp 10.0.2.105 49849 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:27.257156 3.003765 tcp 10.0.2.105 49850 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:36.259640 0.000000 tcp 10.0.2.105 49850 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:40.866485 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:04:42.259008 3.003728 tcp 10.0.2.105 49851 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:51.261301 0.000000 tcp 10.0.2.105 49851 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:04:57.260164 3.004301 tcp 10.0.2.105 49852 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:05:04.870994 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:05:06.263439 0.000000 tcp 10.0.2.105 49852 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:05:12.261915 1.728215 tcp 10.0.2.105 49853 -> 46.48.247.67 29365 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:08:59.240618 3.021626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:09:06.471529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:09:14.399053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:09:30.282820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:10:02.288320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:10:13.985445 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:10:13.985645 2.994083 tcp 10.0.2.105 49854 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:10:22.977757 0.000000 tcp 10.0.2.105 49854 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:10:28.988561 0.045801 tcp 10.0.2.105 49855 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:29.034631 0.047450 tcp 10.0.2.105 49856 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:29.082386 0.139923 tcp 10.0.2.105 49857 -> 195.113.214.251 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:30.330078 3.003151 tcp 10.0.2.105 49858 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:10:39.332043 0.000000 tcp 10.0.2.105 49858 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:10:45.331269 0.044472 tcp 10.0.2.105 49859 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:45.375607 0.046083 tcp 10.0.2.105 49860 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:45.422003 0.144404 tcp 10.0.2.105 49861 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:10:45.584261 3.001101 tcp 10.0.2.105 49862 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:10:54.583760 0.000000 tcp 10.0.2.105 49862 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:00.583302 0.045239 tcp 10.0.2.105 49863 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:00.628834 0.050868 tcp 10.0.2.105 49864 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:00.680049 0.142754 tcp 10.0.2.105 49865 -> 195.113.214.251 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:00.942397 3.004831 tcp 10.0.2.105 49866 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:09.956057 0.000000 tcp 10.0.2.105 49866 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:15.935232 0.045196 tcp 10.0.2.105 49867 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:15.980790 0.046023 tcp 10.0.2.105 49868 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:16.027163 0.139898 tcp 10.0.2.105 49869 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:16.403117 2.028088 tcp 10.0.2.105 49870 -> 46.48.247.67 29365 FSPA* 0 0 14 1768 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:18.147252 0.045224 tcp 10.0.2.105 49871 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:18.192871 0.046603 tcp 10.0.2.105 49872 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:18.240342 0.138015 tcp 10.0.2.105 49873 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:11:18.431484 3.003987 tcp 10.0.2.105 49874 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:27.430707 0.000000 tcp 10.0.2.105 49874 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:33.429779 3.004277 tcp 10.0.2.105 49875 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:42.432617 0.000000 tcp 10.0.2.105 49875 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:47.369863 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:11:48.431429 3.004079 tcp 10.0.2.105 49876 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:11:57.434684 0.000000 tcp 10.0.2.105 49876 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:12:03.433166 3.004009 tcp 10.0.2.105 49877 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:12:11.375149 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:12:12.446788 0.000000 tcp 10.0.2.105 49877 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:12:18.434585 4.469768 tcp 10.0.2.105 49878 -> 46.48.247.67 29365 FSPA* 0 0 14 1768 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:16:06.294998 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:16:13.302111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:16:21.305230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:16:37.306035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:17:09.312281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:17:22.892986 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:17:22.893098 3.003451 tcp 10.0.2.105 49879 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:17:31.895210 0.000000 tcp 10.0.2.105 49879 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:17:37.895017 0.045472 tcp 10.0.2.105 49880 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:37.940836 0.045970 tcp 10.0.2.105 49881 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:37.987160 0.141582 tcp 10.0.2.105 49882 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:38.409359 2.999232 tcp 10.0.2.105 49883 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:17:47.417573 0.000000 tcp 10.0.2.105 49883 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:17:53.406704 0.095606 tcp 10.0.2.105 49884 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:53.502566 0.047061 tcp 10.0.2.105 49885 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:53.549910 0.145208 tcp 10.0.2.105 49886 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:17:53.723982 2.996483 tcp 10.0.2.105 49887 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:02.719606 0.000000 tcp 10.0.2.105 49887 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:08.718836 0.044775 tcp 10.0.2.105 49888 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:08.763895 0.046077 tcp 10.0.2.105 49889 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:08.810260 0.141379 tcp 10.0.2.105 49890 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:09.458116 3.005291 tcp 10.0.2.105 49891 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:18.462536 0.000000 tcp 10.0.2.105 49891 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:24.450913 0.044417 tcp 10.0.2.105 49892 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:24.495685 0.048000 tcp 10.0.2.105 49893 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:24.543626 0.144973 tcp 10.0.2.105 49894 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:24.717888 0.345636 tcp 10.0.2.105 49895 -> 46.48.247.67 29365 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:31.110881 0.238343 tcp 10.0.2.105 49895 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:31.111521 0.044137 tcp 10.0.2.105 49896 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:31.155918 0.046609 tcp 10.0.2.105 49897 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:31.202830 0.135385 tcp 10.0.2.105 49898 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:18:31.349494 3.005448 tcp 10.0.2.105 49899 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:40.353439 0.000000 tcp 10.0.2.105 49899 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:46.342581 3.004082 tcp 10.0.2.105 49900 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:55.344951 0.000000 tcp 10.0.2.105 49900 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:18:59.872089 0.100678 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:19:01.425086 2.969416 tcp 10.0.2.105 49901 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:19:10.353762 0.000000 tcp 10.0.2.105 49901 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:19:16.346189 2.995120 tcp 10.0.2.105 49902 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:19:23.865944 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:19:25.337801 0.000000 tcp 10.0.2.105 49902 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:19:31.346963 0.349791 tcp 10.0.2.105 49903 -> 46.48.247.67 29365 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:19:37.455245 0.000374 tcp 10.0.2.105 49903 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:23:13.319030 3.011359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:23:20.336137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:23:28.337654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:23:44.340004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:24:16.346727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:24:31.618777 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:24:31.618865 0.173267 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:31.789239 0.076642 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:31.983481 0.173415 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:32.148904 0.046300 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:32.304650 0.376597 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:32.645505 0.104228 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:32.797720 0.089601 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:32.877528 0.199680 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:33.076138 0.062530 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:33.455961 0.083556 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:33.519064 0.176357 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:33.686320 0.258170 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:33.895180 0.113660 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:34.024851 0.169562 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:34.171341 0.227441 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:34.391332 0.174263 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:34.601132 0.221530 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:34.870357 0.167260 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:35.087413 0.086098 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:35.136272 0.083500 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:35.314839 0.277302 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:35.725749 0.146822 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:35.830317 0.402173 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:36.210647 0.175339 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:36.382741 0.175395 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:36.531272 0.088797 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:37.137700 0.178431 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:37.312088 0.520499 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:37.463762 2.997485 tcp 10.0.2.105 49904 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:24:37.809829 0.071560 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:37.931192 0.071364 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:37.987902 0.040612 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:24:46.460112 0.000000 tcp 10.0.2.105 49904 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:24:52.460990 0.046699 tcp 10.0.2.105 49905 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:24:52.507875 0.045851 tcp 10.0.2.105 49906 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:24:52.554132 0.144967 tcp 10.0.2.105 49907 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:24:52.905204 2.998137 tcp 10.0.2.105 49908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:01.901993 0.000000 tcp 10.0.2.105 49908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:07.901192 0.044694 tcp 10.0.2.105 49909 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:07.946212 0.046009 tcp 10.0.2.105 49910 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:07.992522 0.140448 tcp 10.0.2.105 49911 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:08.421122 3.004626 tcp 10.0.2.105 49912 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:17.424226 0.000000 tcp 10.0.2.105 49912 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:23.413949 0.044647 tcp 10.0.2.105 49913 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:23.458984 0.045726 tcp 10.0.2.105 49914 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:23.505022 0.142437 tcp 10.0.2.105 49915 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:23.730776 2.987124 tcp 10.0.2.105 49916 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:33.312335 0.000000 tcp 10.0.2.105 49916 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:39.233262 0.044485 tcp 10.0.2.105 49917 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:39.278128 0.046965 tcp 10.0.2.105 49918 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:39.325415 0.142046 tcp 10.0.2.105 49919 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:25:39.939519 2.960796 tcp 10.0.2.105 49920 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:48.822678 0.000000 tcp 10.0.2.105 49920 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:25:54.756129 2.965364 tcp 10.0.2.105 49921 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:26:02.589319 0.437256 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:26:04.073420 0.000000 tcp 10.0.2.105 49921 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:26:10.006626 2.969341 tcp 10.0.2.105 49922 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:26:18.902664 0.000000 tcp 10.0.2.105 49922 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:26:24.828164 2.971978 tcp 10.0.2.105 49923 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:26:29.699064 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:26:33.726087 0.000000 tcp 10.0.2.105 49923 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:30:20.352202 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:30:27.360032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:30:35.361639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:30:51.364504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:31:23.370270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:31:39.444551 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:31:39.444661 2.993066 tcp 10.0.2.105 49924 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:31:48.446759 0.000000 tcp 10.0.2.105 49924 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:31:54.447285 0.045890 tcp 10.0.2.105 49925 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:31:54.493495 0.045817 tcp 10.0.2.105 49926 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:31:54.539619 0.142341 tcp 10.0.2.105 49927 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:31:54.824844 2.994924 tcp 10.0.2.105 49928 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:03.818246 0.000000 tcp 10.0.2.105 49928 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:09.818006 0.045104 tcp 10.0.2.105 49929 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:09.863393 0.045884 tcp 10.0.2.105 49930 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:09.909598 0.142781 tcp 10.0.2.105 49931 -> 195.113.214.251 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:10.343697 2.998841 tcp 10.0.2.105 49932 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:19.341048 0.000000 tcp 10.0.2.105 49932 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:25.339931 0.045618 tcp 10.0.2.105 49933 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:25.385828 0.045004 tcp 10.0.2.105 49934 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:25.431083 0.140269 tcp 10.0.2.105 49935 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:25.656371 2.997879 tcp 10.0.2.105 49936 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:34.653039 0.000000 tcp 10.0.2.105 49936 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:40.652411 0.045618 tcp 10.0.2.105 49937 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:40.698256 0.046760 tcp 10.0.2.105 49938 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:40.745322 0.145407 tcp 10.0.2.105 49939 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:40.967115 0.351937 tcp 10.0.2.105 49940 -> 46.48.247.67 29365 SPA_* 0 0 9 1207 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:46.849759 0.688273 tcp 10.0.2.105 49940 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:46.850501 0.044573 tcp 10.0.2.105 49941 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:46.895342 0.047596 tcp 10.0.2.105 49942 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:46.942769 0.135111 tcp 10.0.2.105 49943 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:32:47.538261 3.007725 tcp 10.0.2.105 49944 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:32:56.544297 0.000000 tcp 10.0.2.105 49944 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:02.533147 2.994368 tcp 10.0.2.105 49945 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:11.538798 0.000000 tcp 10.0.2.105 49945 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:16.373003 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:33:17.534845 2.994226 tcp 10.0.2.105 49946 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:26.527494 0.000000 tcp 10.0.2.105 49946 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:32.536434 2.994063 tcp 10.0.2.105 49947 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:40.368029 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:33:41.528989 0.000000 tcp 10.0.2.105 49947 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:33:47.538023 0.346959 tcp 10.0.2.105 49948 -> 46.48.247.67 29365 SPA_* 0 0 9 1207 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:33:53.182762 0.003384 tcp 10.0.2.105 49948 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:37:27.376437 3.001889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:37:34.383800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:37:42.385429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:37:58.417627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:38:30.404920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:38:53.177771 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:38:53.177883 3.003757 tcp 10.0.2.105 49949 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:02.180108 0.000000 tcp 10.0.2.105 49949 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:08.180044 0.046645 tcp 10.0.2.105 49950 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:08.226528 0.045525 tcp 10.0.2.105 49951 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:08.272550 0.139919 tcp 10.0.2.105 49952 -> 195.113.214.251 443 SRPA* 0 0 35 22360 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:08.543320 3.000301 tcp 10.0.2.105 49953 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:17.542003 0.000000 tcp 10.0.2.105 49953 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:23.542362 0.044563 tcp 10.0.2.105 49954 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:23.587233 0.045387 tcp 10.0.2.105 49955 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:23.632977 0.144196 tcp 10.0.2.105 49956 -> 195.113.214.251 443 SRPA* 0 0 25 13250 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:23.795177 3.000383 tcp 10.0.2.105 49957 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:32.794628 0.000000 tcp 10.0.2.105 49957 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:38.793639 0.044487 tcp 10.0.2.105 49958 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:38.838450 0.046246 tcp 10.0.2.105 49959 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:38.884558 0.142292 tcp 10.0.2.105 49960 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:39.167870 2.999697 tcp 10.0.2.105 49961 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:48.176340 0.000000 tcp 10.0.2.105 49961 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:39:54.165743 0.045451 tcp 10.0.2.105 49962 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:54.211501 0.046508 tcp 10.0.2.105 49963 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:54.258344 0.133451 tcp 10.0.2.105 49964 -> 195.113.214.251 443 SRPA* 0 0 20 11520 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:39:54.590839 0.351285 tcp 10.0.2.105 49965 -> 46.48.247.67 29365 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:40:24.940406 0.045979 tcp 10.0.2.105 49966 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:40:24.986637 0.046263 tcp 10.0.2.105 49967 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:40:25.033195 0.140348 tcp 10.0.2.105 49968 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:40:25.503548 0.348540 tcp 10.0.2.105 49965 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:40:25.503923 3.000872 tcp 10.0.2.105 49969 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:40:34.503007 0.000000 tcp 10.0.2.105 49969 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:40:40.501644 3.004261 tcp 10.0.2.105 49970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:40:49.504724 0.000000 tcp 10.0.2.105 49970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:40:54.371454 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:40:55.503456 3.004084 tcp 10.0.2.105 49971 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:41:04.515880 0.000000 tcp 10.0.2.105 49971 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:41:10.504902 2.995956 tcp 10.0.2.105 49972 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:41:18.365843 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:41:19.497639 0.000000 tcp 10.0.2.105 49972 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:41:25.506262 0.366885 tcp 10.0.2.105 49973 -> 46.48.247.67 29365 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:41:30.863787 0.003058 tcp 10.0.2.105 49973 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:44:34.410934 3.022769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:44:41.428122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:44:49.429651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:45:05.432851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:45:37.438458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:46:30.865594 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:46:30.865819 2.993792 tcp 10.0.2.105 49974 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:46:39.858278 0.000000 tcp 10.0.2.105 49974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:46:45.868540 0.046465 tcp 10.0.2.105 49975 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:46:45.914786 0.049646 tcp 10.0.2.105 49976 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:46:45.964455 0.139326 tcp 10.0.2.105 49977 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:46:46.164010 2.997578 tcp 10.0.2.105 49978 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:46:55.160538 0.000000 tcp 10.0.2.105 49978 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:01.159377 0.045806 tcp 10.0.2.105 49979 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:01.205031 0.045553 tcp 10.0.2.105 49980 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:01.250881 0.145183 tcp 10.0.2.105 49981 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:01.437303 3.006314 tcp 10.0.2.105 49982 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:10.442227 0.000000 tcp 10.0.2.105 49982 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:16.431204 0.045965 tcp 10.0.2.105 49983 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:16.477478 0.046038 tcp 10.0.2.105 49984 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:16.523872 0.139897 tcp 10.0.2.105 49985 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:16.687004 2.998454 tcp 10.0.2.105 49986 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:25.683935 0.000000 tcp 10.0.2.105 49986 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:31.683242 0.044916 tcp 10.0.2.105 49987 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:31.728441 0.046303 tcp 10.0.2.105 49988 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:31.775091 0.134181 tcp 10.0.2.105 49989 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:31.925864 0.351607 tcp 10.0.2.105 49990 -> 46.48.247.67 29365 SPA_* 0 0 9 1203 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:37.089977 0.359191 tcp 10.0.2.105 49990 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:37.090829 0.045023 tcp 10.0.2.105 49991 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:37.136192 0.045346 tcp 10.0.2.105 49992 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:37.181902 0.146011 tcp 10.0.2.105 49993 -> 195.113.214.251 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:47:37.449415 3.005848 tcp 10.0.2.105 49994 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:46.454044 0.000000 tcp 10.0.2.105 49994 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:47:52.443371 3.003563 tcp 10.0.2.105 49995 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:01.445743 0.000000 tcp 10.0.2.105 49995 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:06.372769 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:48:07.444791 2.993719 tcp 10.0.2.105 49996 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:16.447186 0.000000 tcp 10.0.2.105 49996 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:22.446136 2.994019 tcp 10.0.2.105 49997 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:30.366998 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:48:31.438170 0.000000 tcp 10.0.2.105 49997 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:48:37.447518 0.350985 tcp 10.0.2.105 49998 -> 46.48.247.67 29365 SPA_* 0 0 7 1095 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:48:42.532817 0.003404 tcp 10.0.2.105 49998 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:42.527890 0.080957 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:53:42.608974 0.352389 tcp 10.0.2.105 49999 -> 46.48.247.67 29365 SPA_* 0 0 9 1213 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:47.720310 0.343022 tcp 10.0.2.105 49999 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:47.722455 0.045969 tcp 10.0.2.105 50000 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:47.768674 0.049389 tcp 10.0.2.105 50001 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:47.818366 0.146506 tcp 10.0.2.105 50002 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:48.063572 1.005550 tcp 10.0.2.105 50003 -> 46.48.247.67 29365 SPA_* 0 0 9 1213 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:53:55.809001 0.001349 tcp 10.0.2.105 50003 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:54:38.877146 0.173268 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.043320 0.174575 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.249526 0.081917 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.410632 0.046530 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.446984 0.261922 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.672828 0.095795 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.762030 0.081366 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:39.833970 0.202622 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:40.037556 0.061285 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:40.097563 0.262783 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:40.313032 0.108408 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:41.021887 0.091203 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:41.101718 0.175626 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:41.347432 0.171123 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:41.870233 0.226071 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.088890 0.174341 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.240423 0.150764 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.373499 0.170153 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.520492 0.084844 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.564843 0.139047 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.662434 0.074403 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:42.727858 0.275738 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.018028 0.398861 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.395911 0.175011 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.567585 0.177055 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.714799 0.085973 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.783272 0.072263 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:43.874693 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:54:44.010404 0.069795 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:44.149043 0.179147 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:44.323462 0.246563 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:44.545644 0.040516 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/06 16:54:49.447289 2.998796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 16:54:56.452398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:55:04.453968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:55:20.456750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:55:52.462965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 16:58:55.806737 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 16:58:55.806836 2.993302 tcp 10.0.2.105 50004 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:04.798878 0.000000 tcp 10.0.2.105 50004 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:10.809732 0.046615 tcp 10.0.2.105 50005 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:10.856616 0.052047 tcp 10.0.2.105 50006 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:10.908915 0.141497 tcp 10.0.2.105 50007 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:11.062228 3.000431 tcp 10.0.2.105 50008 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:20.061497 0.000000 tcp 10.0.2.105 50008 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:26.060434 0.044923 tcp 10.0.2.105 50009 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:26.105637 0.045807 tcp 10.0.2.105 50010 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:26.151810 0.149388 tcp 10.0.2.105 50011 -> 195.113.214.251 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:26.312221 3.002374 tcp 10.0.2.105 50012 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:35.313304 0.000000 tcp 10.0.2.105 50012 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:41.312607 0.046308 tcp 10.0.2.105 50013 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:41.359302 0.047365 tcp 10.0.2.105 50014 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:41.407023 0.188051 tcp 10.0.2.105 50015 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:41.612759 3.003996 tcp 10.0.2.105 50016 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:50.615378 0.000000 tcp 10.0.2.105 50016 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 16:59:56.614335 0.044699 tcp 10.0.2.105 50017 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:56.659333 0.049877 tcp 10.0.2.105 50018 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:56.709508 0.144450 tcp 10.0.2.105 50019 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 16:59:56.877494 0.351716 tcp 10.0.2.105 50020 -> 46.48.247.67 29365 SPA_* 0 0 9 1083 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:00:03.906805 0.248629 tcp 10.0.2.105 50020 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:00:03.907620 0.045371 tcp 10.0.2.105 50021 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:00:03.953248 0.047358 tcp 10.0.2.105 50022 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:00:04.000913 0.142876 tcp 10.0.2.105 50023 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:00:04.155721 2.992977 tcp 10.0.2.105 50024 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:13.147195 0.000000 tcp 10.0.2.105 50024 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:19.156639 3.003960 tcp 10.0.2.105 50025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:28.159362 0.000000 tcp 10.0.2.105 50025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:32.865825 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:00:34.158011 3.003908 tcp 10.0.2.105 50026 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:43.160678 0.000000 tcp 10.0.2.105 50026 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:49.159247 3.004451 tcp 10.0.2.105 50027 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:00:56.870449 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:00:58.162649 0.000000 tcp 10.0.2.105 50027 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:01:04.161171 0.339820 tcp 10.0.2.105 50028 -> 46.48.247.67 29365 SPA_* 0 0 9 1083 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:01:10.911556 0.002738 tcp 10.0.2.105 50028 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:01:56.469692 3.000518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:02:03.476075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:02:11.477589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:02:27.480650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:02:59.486957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:06:10.912577 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:06:10.912670 3.003938 tcp 10.0.2.105 50029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:19.914882 0.000000 tcp 10.0.2.105 50029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:25.915485 0.046266 tcp 10.0.2.105 50030 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:25.962311 0.046042 tcp 10.0.2.105 50031 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:26.008692 0.137988 tcp 10.0.2.105 50032 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:26.362667 2.995458 tcp 10.0.2.105 50033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:35.367045 0.000000 tcp 10.0.2.105 50033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:41.356596 0.045777 tcp 10.0.2.105 50034 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:41.402678 0.045987 tcp 10.0.2.105 50035 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:41.448972 0.139816 tcp 10.0.2.105 50036 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:41.708007 3.002640 tcp 10.0.2.105 50037 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:50.709201 0.000000 tcp 10.0.2.105 50037 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:06:56.709411 0.045458 tcp 10.0.2.105 50038 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:56.755120 0.046119 tcp 10.0.2.105 50039 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:56.801659 0.142430 tcp 10.0.2.105 50040 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:06:57.126047 2.996683 tcp 10.0.2.105 50041 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:06.121083 0.000000 tcp 10.0.2.105 50041 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:12.120628 0.045867 tcp 10.0.2.105 50042 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:12.166793 0.046203 tcp 10.0.2.105 50043 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:12.213338 0.135443 tcp 10.0.2.105 50044 -> 195.113.214.251 443 SRPA* 0 0 33 24276 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:12.883267 0.340846 tcp 10.0.2.105 50045 -> 46.48.247.67 29365 SPA_* 0 0 9 1142 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:19.335154 0.419362 tcp 10.0.2.105 50045 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:19.335941 0.045677 tcp 10.0.2.105 50046 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:19.381437 0.049161 tcp 10.0.2.105 50047 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:19.430874 0.141580 tcp 10.0.2.105 50048 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:07:19.754774 3.000489 tcp 10.0.2.105 50049 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:28.753726 0.000000 tcp 10.0.2.105 50049 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:34.752879 3.004065 tcp 10.0.2.105 50050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:43.755563 0.000000 tcp 10.0.2.105 50050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:48.372241 0.124780 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:07:49.860230 2.969200 tcp 10.0.2.105 50051 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:07:58.790630 0.000000 tcp 10.0.2.105 50051 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:08:04.755935 2.994042 tcp 10.0.2.105 50052 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:08:12.366662 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:08:13.748597 0.000000 tcp 10.0.2.105 50052 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:08:19.757488 1.351547 tcp 10.0.2.105 50053 -> 46.48.247.67 29365 SPA_* 0 0 9 1142 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:08:27.229870 0.003230 tcp 10.0.2.105 50053 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:09:04.494636 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:09:11.501650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:09:19.503300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:09:35.506099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:10:07.511989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:13:27.229703 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:13:27.229826 3.003752 tcp 10.0.2.105 50054 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:13:36.231975 0.000000 tcp 10.0.2.105 50054 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:13:42.232893 0.045666 tcp 10.0.2.105 50055 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:42.278809 0.046866 tcp 10.0.2.105 50056 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:42.325967 0.137566 tcp 10.0.2.105 50057 -> 195.113.214.251 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:42.707956 3.008682 tcp 10.0.2.105 50058 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:13:51.714529 0.000000 tcp 10.0.2.105 50058 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:13:57.703836 0.045621 tcp 10.0.2.105 50059 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:57.749277 0.046758 tcp 10.0.2.105 50060 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:57.796517 0.144625 tcp 10.0.2.105 50061 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:13:58.312679 3.155503 tcp 10.0.2.105 50062 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:07.420434 0.000000 tcp 10.0.2.105 50062 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:13.373271 0.044854 tcp 10.0.2.105 50063 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:13.418461 0.047257 tcp 10.0.2.105 50064 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:13.465586 0.139101 tcp 10.0.2.105 50065 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:13.624815 2.971367 tcp 10.0.2.105 50066 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:22.568539 0.000000 tcp 10.0.2.105 50066 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:28.568299 0.239628 tcp 10.0.2.105 50067 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:28.808262 0.046017 tcp 10.0.2.105 50068 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:28.854192 0.144708 tcp 10.0.2.105 50069 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:30.107650 0.347258 tcp 10.0.2.105 50070 -> 46.48.247.67 29365 SPA_* 0 0 9 1007 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:36.189440 0.887141 tcp 10.0.2.105 50070 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:36.190147 0.045177 tcp 10.0.2.105 50071 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:36.235602 0.047620 tcp 10.0.2.105 50072 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:36.283531 0.143130 tcp 10.0.2.105 50073 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:14:37.076866 2.972288 tcp 10.0.2.105 50074 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:45.986937 0.000000 tcp 10.0.2.105 50074 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:51.971379 3.003496 tcp 10.0.2.105 50075 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:14:59.872451 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:15:00.974215 0.000000 tcp 10.0.2.105 50075 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:15:06.973296 3.003665 tcp 10.0.2.105 50076 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:15:15.975533 0.000000 tcp 10.0.2.105 50076 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:15:21.974679 2.993518 tcp 10.0.2.105 50077 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:15:26.871192 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:15:30.967356 0.000000 tcp 10.0.2.105 50077 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:15:36.976132 0.347215 tcp 10.0.2.105 50078 -> 46.48.247.67 29365 SPA_* 0 0 9 1007 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:15:42.804439 0.003372 tcp 10.0.2.105 50078 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:16:11.518606 3.001275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:16:18.525576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:16:26.526907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:16:42.530330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:17:14.536488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:20:42.806064 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:20:42.806160 2.993359 tcp 10.0.2.105 50079 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:20:51.798305 0.000000 tcp 10.0.2.105 50079 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:20:57.809312 0.044859 tcp 10.0.2.105 50080 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:20:57.854508 0.045341 tcp 10.0.2.105 50081 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:20:57.900144 0.142616 tcp 10.0.2.105 50082 -> 195.113.214.251 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:20:58.322156 2.999701 tcp 10.0.2.105 50083 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:07.320844 0.000000 tcp 10.0.2.105 50083 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:13.320170 0.045227 tcp 10.0.2.105 50084 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:13.365734 0.047090 tcp 10.0.2.105 50085 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:13.413188 0.146416 tcp 10.0.2.105 50086 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:13.696976 2.997207 tcp 10.0.2.105 50087 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:22.693030 0.000000 tcp 10.0.2.105 50087 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:28.692285 0.044753 tcp 10.0.2.105 50088 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:28.736848 0.045713 tcp 10.0.2.105 50089 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:28.782593 0.139362 tcp 10.0.2.105 50090 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:29.042304 3.004017 tcp 10.0.2.105 50091 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:38.044995 0.000000 tcp 10.0.2.105 50091 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:44.045247 0.046487 tcp 10.0.2.105 50092 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:44.091551 0.046023 tcp 10.0.2.105 50093 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:44.137888 0.132947 tcp 10.0.2.105 50094 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:44.569601 0.345890 tcp 10.0.2.105 50095 -> 46.48.247.67 29365 SPA_* 0 0 7 904 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:50.200667 0.541978 tcp 10.0.2.105 50095 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:50.201360 0.044602 tcp 10.0.2.105 50096 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:50.246304 0.047517 tcp 10.0.2.105 50097 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:50.294140 0.144685 tcp 10.0.2.105 50098 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:21:50.742890 2.994479 tcp 10.0.2.105 50099 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:21:59.746002 0.000000 tcp 10.0.2.105 50099 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:05.734481 2.994701 tcp 10.0.2.105 50100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:14.727727 0.000000 tcp 10.0.2.105 50100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:19.364504 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:22:20.736813 2.994387 tcp 10.0.2.105 50101 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:29.729683 0.000000 tcp 10.0.2.105 50101 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:35.765001 2.978319 tcp 10.0.2.105 50102 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:43.368899 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:22:44.741106 0.000000 tcp 10.0.2.105 50102 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:22:50.739471 1.733712 tcp 10.0.2.105 50103 -> 46.48.247.67 29365 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:23:18.542298 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:23:25.549733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:23:33.551023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:23:49.554293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:24:21.560373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:25:10.921384 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:25:10.921631 0.075833 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:10.980530 0.046779 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:11.396860 0.174532 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:11.563377 0.173481 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:11.732752 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 17:25:27.446791 0.046598 tcp 10.0.2.105 50104 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:25:27.493203 0.050567 tcp 10.0.2.105 50105 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:25:27.544066 0.142944 tcp 10.0.2.105 50106 -> 195.113.214.251 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:25:27.687632 0.090577 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:27.761264 0.080619 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:27.945508 0.196887 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:28.344633 0.061543 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 1963 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:28.520933 0.262980 udp 10.0.2.105 7010 <-> 65.8.202.66 9193 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:28.732068 0.179378 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:28.890920 0.109543 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:29.105573 0.085662 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:29.168451 0.174400 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2566 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:29.541680 0.226343 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:29.872411 0.283952 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:31.039061 0.150269 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:31.719240 0.168795 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:31.864382 0.082983 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:31.917193 0.126462 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:32.123212 0.075197 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:32.304976 0.285282 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:32.758197 0.397063 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.133853 0.174475 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.305699 0.173525 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.511952 0.083479 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.579471 0.068954 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.762113 0.246433 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:33.984828 0.042452 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:34.198606 0.067049 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:25:34.249415 0.177589 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:27:52.463217 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:27:52.463411 3.004276 tcp 10.0.2.105 50107 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:01.476193 0.000000 tcp 10.0.2.105 50107 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:07.465642 0.045624 tcp 10.0.2.105 50108 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:07.511546 0.044958 tcp 10.0.2.105 50109 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:07.556889 0.137827 tcp 10.0.2.105 50110 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:07.876790 2.992569 tcp 10.0.2.105 50111 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:16.868949 0.000000 tcp 10.0.2.105 50111 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:22.878065 0.046567 tcp 10.0.2.105 50112 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:22.924462 0.051322 tcp 10.0.2.105 50113 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:22.976108 0.192020 tcp 10.0.2.105 50114 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:26.060039 3.006904 tcp 10.0.2.105 50115 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:35.064465 0.000000 tcp 10.0.2.105 50115 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:41.055420 0.045250 tcp 10.0.2.105 50116 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:41.100991 0.047035 tcp 10.0.2.105 50117 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:41.147859 0.142728 tcp 10.0.2.105 50118 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:41.672035 2.996580 tcp 10.0.2.105 50119 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:50.676948 0.000000 tcp 10.0.2.105 50119 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:28:56.666709 0.045787 tcp 10.0.2.105 50120 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:56.712808 0.046703 tcp 10.0.2.105 50121 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:56.759833 0.141196 tcp 10.0.2.105 50122 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:28:56.984849 0.353225 tcp 10.0.2.105 50123 -> 46.48.247.67 29365 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:29:02.310121 0.263644 tcp 10.0.2.105 50123 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:29:02.310914 0.044783 tcp 10.0.2.105 50124 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:29:02.356014 0.047550 tcp 10.0.2.105 50125 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:29:02.403979 0.141904 tcp 10.0.2.105 50126 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:29:02.574005 2.994588 tcp 10.0.2.105 50127 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:11.622312 0.000000 tcp 10.0.2.105 50127 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:17.566855 2.993096 tcp 10.0.2.105 50128 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:26.586011 0.000000 tcp 10.0.2.105 50128 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:31.365364 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:29:32.567398 3.004080 tcp 10.0.2.105 50129 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:41.570609 0.000000 tcp 10.0.2.105 50129 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:47.569251 3.003893 tcp 10.0.2.105 50130 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:29:55.369964 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:29:56.571625 0.000000 tcp 10.0.2.105 50130 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:30:02.570418 0.346626 tcp 10.0.2.105 50131 -> 46.48.247.67 29365 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:30:07.697689 0.002630 tcp 10.0.2.105 50131 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:30:25.567262 3.000658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:30:32.573845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:30:40.575665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:30:56.578057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:31:28.583935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:35:07.699533 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:35:07.699769 3.003551 tcp 10.0.2.105 50132 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:16.701778 0.000000 tcp 10.0.2.105 50132 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:22.702850 0.045775 tcp 10.0.2.105 50133 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:22.748972 0.045561 tcp 10.0.2.105 50134 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:22.794831 0.137968 tcp 10.0.2.105 50135 -> 195.113.214.251 443 SRPA* 0 0 25 13912 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:23.033435 3.001502 tcp 10.0.2.105 50136 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:32.033535 0.000000 tcp 10.0.2.105 50136 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:38.033607 0.044766 tcp 10.0.2.105 50137 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:38.078682 0.049145 tcp 10.0.2.105 50138 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:38.127648 0.140174 tcp 10.0.2.105 50139 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:38.281713 2.995569 tcp 10.0.2.105 50140 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:47.286098 0.000000 tcp 10.0.2.105 50140 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:35:53.275310 0.045736 tcp 10.0.2.105 50141 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:53.321386 0.046771 tcp 10.0.2.105 50142 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:53.368627 0.135944 tcp 10.0.2.105 50143 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:35:53.515417 2.993990 tcp 10.0.2.105 50144 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:02.507783 0.000000 tcp 10.0.2.105 50144 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:08.517247 0.045365 tcp 10.0.2.105 50145 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:08.562926 0.046324 tcp 10.0.2.105 50146 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:08.609610 0.141150 tcp 10.0.2.105 50147 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:08.771873 0.349256 tcp 10.0.2.105 50148 -> 46.48.247.67 29365 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:13.786075 0.288056 tcp 10.0.2.105 50148 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:13.786872 0.045595 tcp 10.0.2.105 50149 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:13.832306 0.047193 tcp 10.0.2.105 50150 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:13.879866 0.144147 tcp 10.0.2.105 50151 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:36:14.074438 2.994350 tcp 10.0.2.105 50152 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:23.076850 0.000000 tcp 10.0.2.105 50152 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:29.066191 2.994724 tcp 10.0.2.105 50153 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:38.058424 0.000000 tcp 10.0.2.105 50153 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:42.865956 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:36:44.067899 3.003996 tcp 10.0.2.105 50154 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:53.070442 0.000000 tcp 10.0.2.105 50154 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:36:59.069366 3.004131 tcp 10.0.2.105 50155 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:37:06.870577 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:37:08.071976 0.000000 tcp 10.0.2.105 50155 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:37:14.071049 4.855083 tcp 10.0.2.105 50156 -> 46.48.247.67 29365 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:37:32.591265 3.000225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:37:39.597599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:37:47.599118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:38:03.601891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:38:35.608350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:42:18.919466 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:42:18.919555 3.003892 tcp 10.0.2.105 50157 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:42:27.921964 0.000000 tcp 10.0.2.105 50157 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:42:33.921949 0.045310 tcp 10.0.2.105 50158 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:33.967486 0.046564 tcp 10.0.2.105 50159 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:34.014367 0.136072 tcp 10.0.2.105 50160 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:34.430589 3.005035 tcp 10.0.2.105 50161 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:42:43.434061 0.000000 tcp 10.0.2.105 50161 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:42:49.423401 0.044995 tcp 10.0.2.105 50162 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:49.468417 0.046795 tcp 10.0.2.105 50163 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:49.515546 0.180453 tcp 10.0.2.105 50164 -> 195.113.214.251 443 SRPA* 0 0 84 66238 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:42:50.266320 2.991924 tcp 10.0.2.105 50165 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:42:59.266947 0.000000 tcp 10.0.2.105 50165 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:05.266416 0.045305 tcp 10.0.2.105 50166 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:05.312071 0.049939 tcp 10.0.2.105 50167 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:05.362286 0.146991 tcp 10.0.2.105 50168 -> 195.113.214.251 443 SRPA* 0 0 36 19484 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:05.545923 2.994492 tcp 10.0.2.105 50169 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:14.539064 0.000000 tcp 10.0.2.105 50169 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:20.538357 0.045214 tcp 10.0.2.105 50170 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:20.583487 0.045599 tcp 10.0.2.105 50171 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:20.629437 0.136533 tcp 10.0.2.105 50172 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:20.785138 4.771766 tcp 10.0.2.105 50173 -> 46.48.247.67 29365 SPA_* 0 0 12 1596 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:25.553481 0.045244 tcp 10.0.2.105 50174 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:25.599028 0.045550 tcp 10.0.2.105 50175 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:25.644883 0.142699 tcp 10.0.2.105 50176 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:25.806227 0.000083 tcp 10.0.2.105 50173 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:43:25.806613 2.992795 tcp 10.0.2.105 50177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:34.798137 0.000000 tcp 10.0.2.105 50177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:40.806766 2.994415 tcp 10.0.2.105 50178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:49.799812 0.000000 tcp 10.0.2.105 50178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:43:54.366380 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:43:55.808444 3.004199 tcp 10.0.2.105 50179 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:44:04.811220 0.000000 tcp 10.0.2.105 50179 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:44:10.809850 3.004408 tcp 10.0.2.105 50180 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:44:18.370824 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:44:19.814532 0.000000 tcp 10.0.2.105 50180 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:44:25.812017 4.667951 tcp 10.0.2.105 50181 -> 46.48.247.67 29365 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:44:39.623995 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:44:46.631445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:44:54.632822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:45:10.635791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:45:42.642041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:49:30.470096 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:49:30.470242 3.003090 tcp 10.0.2.105 50182 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:49:39.472521 0.000000 tcp 10.0.2.105 50182 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:49:45.472990 0.045148 tcp 10.0.2.105 50183 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:49:45.518474 0.046801 tcp 10.0.2.105 50184 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:49:45.565634 0.182549 tcp 10.0.2.105 50185 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:49:45.925039 3.001130 tcp 10.0.2.105 50186 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:49:54.924671 0.000000 tcp 10.0.2.105 50186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:00.924330 0.045226 tcp 10.0.2.105 50187 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:00.969832 0.045498 tcp 10.0.2.105 50188 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:01.015617 0.140044 tcp 10.0.2.105 50189 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:01.423113 2.995404 tcp 10.0.2.105 50190 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:10.427018 0.000000 tcp 10.0.2.105 50190 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:16.416320 0.045343 tcp 10.0.2.105 50191 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:16.462035 0.046095 tcp 10.0.2.105 50192 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:16.508517 0.131674 tcp 10.0.2.105 50193 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:16.705105 2.995204 tcp 10.0.2.105 50194 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:25.699103 0.000000 tcp 10.0.2.105 50194 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:31.698197 0.044988 tcp 10.0.2.105 50195 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:31.743488 0.046946 tcp 10.0.2.105 50196 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:31.790783 0.143011 tcp 10.0.2.105 50197 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:31.949898 4.910238 tcp 10.0.2.105 50198 -> 46.48.247.67 29365 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:36.509253 0.044758 tcp 10.0.2.105 50199 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:36.554319 0.049420 tcp 10.0.2.105 50200 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:36.604095 0.139031 tcp 10.0.2.105 50201 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:50:36.860430 2.998567 tcp 10.0.2.105 50202 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:45.857997 0.000000 tcp 10.0.2.105 50202 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:50:51.856841 2.994055 tcp 10.0.2.105 50203 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:00.849186 0.000000 tcp 10.0.2.105 50203 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:05.365892 0.670732 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:51:07.496116 2.970235 tcp 10.0.2.105 50204 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:16.390927 0.000000 tcp 10.0.2.105 50204 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:22.318074 2.973700 tcp 10.0.2.105 50205 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:29.740726 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:51:31.218549 0.000000 tcp 10.0.2.105 50205 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:51:37.143535 0.349708 tcp 10.0.2.105 50206 -> 46.48.247.67 29365 SPA_* 0 0 9 1068 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:51:43.463997 0.001120 tcp 10.0.2.105 50206 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:54:52.655476 3.001727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 17:54:59.662766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:55:07.664313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:55:23.667416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:55:40.231086 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:55:40.231350 0.706500 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:40.938265 0.078548 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.000133 0.174512 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.167589 0.047757 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.221947 0.173422 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.391894 0.097819 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.474530 0.082807 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:41.548772 0.611747 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:42.150613 0.173152 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:42.303092 0.114265 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:42.379941 0.062035 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:42.441206 0.000000 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 17:55:55.673477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 17:55:59.159893 0.045715 tcp 10.0.2.105 50207 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:55:59.205906 0.045411 tcp 10.0.2.105 50208 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:55:59.251690 0.138271 tcp 10.0.2.105 50209 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:55:59.390631 0.229759 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:59.612674 0.084633 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:59.677280 0.167397 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:59.821559 0.172004 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:55:59.996534 0.092462 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.049785 0.126898 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.134516 0.075971 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.201866 0.149223 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.337582 0.167444 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.498888 0.273202 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:00.784901 0.396674 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.162190 0.176400 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.334489 0.172237 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.478947 0.083562 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.547335 0.072055 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.601292 0.244087 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.821430 0.038476 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.867694 0.070167 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:01.923626 0.610625 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/06 17:56:43.262110 3.004246 tcp 10.0.2.105 50210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:56:47.868610 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:56:52.264904 0.000000 tcp 10.0.2.105 50210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:56:58.263644 0.045711 tcp 10.0.2.105 50211 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:56:58.309192 0.049330 tcp 10.0.2.105 50212 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:56:58.358832 0.136548 tcp 10.0.2.105 50213 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:56:58.552915 2.995475 tcp 10.0.2.105 50214 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:07.556862 0.000000 tcp 10.0.2.105 50214 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:13.545851 0.045728 tcp 10.0.2.105 50215 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:13.591473 0.047282 tcp 10.0.2.105 50216 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:13.639148 0.135814 tcp 10.0.2.105 50217 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:13.874510 2.995482 tcp 10.0.2.105 50218 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:22.868816 0.000000 tcp 10.0.2.105 50218 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:28.868057 0.044581 tcp 10.0.2.105 50219 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:28.912940 0.049890 tcp 10.0.2.105 50220 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:28.963154 0.156310 tcp 10.0.2.105 50221 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:29.402594 2.999874 tcp 10.0.2.105 50222 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:38.401272 0.000000 tcp 10.0.2.105 50222 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:57:44.400550 0.044320 tcp 10.0.2.105 50223 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:44.445195 0.044697 tcp 10.0.2.105 50224 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:44.490216 0.136053 tcp 10.0.2.105 50225 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:44.990160 0.347651 tcp 10.0.2.105 50226 -> 46.48.247.67 29365 SPA_* 0 0 7 1098 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:57.056117 0.382258 tcp 10.0.2.105 50226 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:57.056826 0.044446 tcp 10.0.2.105 50227 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:57.101566 0.045260 tcp 10.0.2.105 50228 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:57.147144 0.136406 tcp 10.0.2.105 50229 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:57:57.438664 3.004298 tcp 10.0.2.105 50230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:06.441491 0.000000 tcp 10.0.2.105 50230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:12.440730 3.003746 tcp 10.0.2.105 50231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:21.442656 0.000000 tcp 10.0.2.105 50231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:26.370870 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:58:27.441783 3.003870 tcp 10.0.2.105 50232 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:36.444297 0.000000 tcp 10.0.2.105 50232 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:42.443481 3.003965 tcp 10.0.2.105 50233 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:50.364724 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 17:58:51.456037 0.000000 tcp 10.0.2.105 50233 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 17:58:57.445291 0.348612 tcp 10.0.2.105 50234 -> 46.48.247.67 29365 SPA_* 0 0 9 1206 flow=From-Botnet-V2-TCP-Established 1970/02/06 17:59:03.405253 0.003867 tcp 10.0.2.105 50234 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:01:59.679141 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:02:06.687074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:02:14.688315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:02:30.691230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:03:02.697549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:04:03.405251 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:04:03.405349 2.993836 tcp 10.0.2.105 50235 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:12.397444 0.000000 tcp 10.0.2.105 50235 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:18.408184 0.046201 tcp 10.0.2.105 50236 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:18.454804 0.046912 tcp 10.0.2.105 50237 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:18.502075 0.138447 tcp 10.0.2.105 50238 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:18.700973 3.000016 tcp 10.0.2.105 50239 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:27.699663 0.000000 tcp 10.0.2.105 50239 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:33.698907 0.044494 tcp 10.0.2.105 50240 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:33.743783 0.046589 tcp 10.0.2.105 50241 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:33.790696 0.145215 tcp 10.0.2.105 50242 -> 195.113.214.251 443 SRPA* 0 0 39 31854 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:33.962434 3.000365 tcp 10.0.2.105 50243 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:42.961348 0.000000 tcp 10.0.2.105 50243 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:48.960870 0.045213 tcp 10.0.2.105 50244 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:49.006368 0.046174 tcp 10.0.2.105 50245 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:49.052884 0.132209 tcp 10.0.2.105 50246 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:04:49.202412 3.002540 tcp 10.0.2.105 50247 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:04:58.203306 0.000000 tcp 10.0.2.105 50247 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:04.202675 0.044000 tcp 10.0.2.105 50248 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:04.246970 0.049312 tcp 10.0.2.105 50249 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:04.296555 0.142585 tcp 10.0.2.105 50250 -> 195.113.214.251 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:04.600988 0.353065 tcp 10.0.2.105 50251 -> 46.48.247.67 29365 SPA_* 0 0 9 1069 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:10.341077 0.261920 tcp 10.0.2.105 50251 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:10.341772 0.045629 tcp 10.0.2.105 50252 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:10.387692 0.045653 tcp 10.0.2.105 50253 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:10.433668 0.138843 tcp 10.0.2.105 50254 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:05:10.603284 3.005427 tcp 10.0.2.105 50255 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:19.604013 0.000000 tcp 10.0.2.105 50255 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:25.603014 3.004061 tcp 10.0.2.105 50256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:34.615760 0.000000 tcp 10.0.2.105 50256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:39.372710 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:05:40.604507 2.994116 tcp 10.0.2.105 50257 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:49.607467 0.000000 tcp 10.0.2.105 50257 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:05:55.606027 2.994411 tcp 10.0.2.105 50258 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:06:03.368820 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:06:04.599141 0.000000 tcp 10.0.2.105 50258 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:06:10.611963 0.349878 tcp 10.0.2.105 50259 -> 46.48.247.67 29365 SPA_* 0 0 9 1069 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:06:35.983390 0.000412 tcp 10.0.2.105 50259 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:09:08.706588 3.006449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:09:15.713674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:09:23.721280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:09:39.722790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:10:11.728508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:11:35.985825 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:11:35.985928 2.997105 tcp 10.0.2.105 50260 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:11:44.978486 0.000000 tcp 10.0.2.105 50260 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:11:50.989825 0.046276 tcp 10.0.2.105 50261 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:11:51.036384 0.046491 tcp 10.0.2.105 50262 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:11:51.083162 0.140409 tcp 10.0.2.105 50263 -> 195.113.214.251 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:11:51.346795 2.998814 tcp 10.0.2.105 50264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:00.342933 0.000000 tcp 10.0.2.105 50264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:06.339736 0.044663 tcp 10.0.2.105 50265 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:06.384340 0.046608 tcp 10.0.2.105 50266 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:06.429788 0.148579 tcp 10.0.2.105 50267 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:07.219195 3.009343 tcp 10.0.2.105 50268 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:16.226771 0.000000 tcp 10.0.2.105 50268 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:22.213632 0.045365 tcp 10.0.2.105 50269 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:22.259383 0.050445 tcp 10.0.2.105 50270 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:22.310167 0.143329 tcp 10.0.2.105 50271 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:22.576203 3.000583 tcp 10.0.2.105 50272 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:31.576529 0.000000 tcp 10.0.2.105 50272 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:37.577238 0.044584 tcp 10.0.2.105 50273 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:37.622089 0.127229 tcp 10.0.2.105 50274 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:37.749694 0.170171 tcp 10.0.2.105 50275 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:38.125144 0.343867 tcp 10.0.2.105 50276 -> 46.48.247.67 29365 SPA_* 0 0 9 1242 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:47.603057 0.708308 tcp 10.0.2.105 50276 -> 46.48.247.67 29365 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:47.603754 0.046032 tcp 10.0.2.105 50277 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:47.649627 0.046554 tcp 10.0.2.105 50278 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:47.696516 0.138728 tcp 10.0.2.105 50279 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:12:47.967795 3.005196 tcp 10.0.2.105 50280 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:12:57.020203 0.000000 tcp 10.0.2.105 50280 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:02.968487 2.996368 tcp 10.0.2.105 50281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:11.963228 0.000000 tcp 10.0.2.105 50281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:16.870268 0.423206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:13:18.370631 2.980600 tcp 10.0.2.105 50282 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:27.299280 0.000000 tcp 10.0.2.105 50282 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:33.244521 2.975196 tcp 10.0.2.105 50283 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:41.087386 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:13:42.178623 0.000000 tcp 10.0.2.105 50283 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:13:48.132673 0.350597 tcp 10.0.2.105 50284 -> 46.48.247.67 29365 SPA_* 0 0 9 1242 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:13:53.507862 0.004745 tcp 10.0.2.105 50284 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:16:15.733404 2.998302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:16:22.737420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:16:30.739282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:16:46.744134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:17:18.749815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:18:53.375366 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:18:53.375505 2.993906 tcp 10.0.2.105 50285 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:02.370127 0.000000 tcp 10.0.2.105 50285 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:08.378331 0.045715 tcp 10.0.2.105 50286 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:08.424335 0.044892 tcp 10.0.2.105 50287 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:08.469520 0.149284 tcp 10.0.2.105 50288 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:08.643721 2.997571 tcp 10.0.2.105 50289 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:17.639134 0.000000 tcp 10.0.2.105 50289 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:23.640493 0.044307 tcp 10.0.2.105 50290 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:23.685118 0.046628 tcp 10.0.2.105 50291 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:23.731525 0.136864 tcp 10.0.2.105 50292 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:23.879072 2.993431 tcp 10.0.2.105 50293 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:32.870964 0.000000 tcp 10.0.2.105 50293 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:38.870025 0.045052 tcp 10.0.2.105 50294 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:38.915419 0.046544 tcp 10.0.2.105 50295 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:38.962354 0.142027 tcp 10.0.2.105 50296 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:39.542165 3.004502 tcp 10.0.2.105 50297 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:48.547437 0.000000 tcp 10.0.2.105 50297 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:19:54.543954 0.045472 tcp 10.0.2.105 50298 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:54.589730 0.048120 tcp 10.0.2.105 50299 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:54.638154 0.146360 tcp 10.0.2.105 50300 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:19:54.909519 0.361289 tcp 10.0.2.105 50301 -> 46.48.247.67 29365 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:20:00.173772 0.292056 tcp 10.0.2.105 50301 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:20:00.174615 0.045422 tcp 10.0.2.105 50302 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:20:00.220572 0.045991 tcp 10.0.2.105 50303 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:20:00.266853 0.145202 tcp 10.0.2.105 50304 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:20:00.466070 3.002988 tcp 10.0.2.105 50305 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:09.463691 0.000000 tcp 10.0.2.105 50305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:15.462491 3.004414 tcp 10.0.2.105 50306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:24.465058 0.000000 tcp 10.0.2.105 50306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:29.372484 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:20:30.463906 3.000476 tcp 10.0.2.105 50307 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:39.471387 0.000000 tcp 10.0.2.105 50307 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:45.472739 2.986883 tcp 10.0.2.105 50308 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:20:53.436940 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:20:54.520068 0.000000 tcp 10.0.2.105 50308 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:21:00.494786 0.344448 tcp 10.0.2.105 50309 -> 46.48.247.67 29365 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:21:05.585839 0.004246 tcp 10.0.2.105 50309 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:23:22.760765 2.998242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:23:29.766027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:23:37.763110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:23:53.765891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:24:25.772199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:26:28.379061 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:26:28.379171 0.197774 udp 10.0.2.105 7010 -> 65.8.202.66 9193 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 18:26:28.576945 0.000000 icmp 65.8.202.66 0x0303 -> 10.0.2.105 0xe923 URP 192 1 126 flow=Background 1970/02/06 18:26:43.621993 0.045086 tcp 10.0.2.105 50310 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:26:43.667398 0.046871 tcp 10.0.2.105 50311 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:26:43.714634 0.139264 tcp 10.0.2.105 50312 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:26:43.854438 0.173338 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:44.020027 0.046444 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:44.286275 0.257325 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:44.509028 0.077230 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:44.570405 0.176358 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:44.963066 0.082890 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:46.265917 0.088940 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:46.371856 0.061824 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:46.432784 0.175545 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:46.587596 0.199482 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:46.779835 0.114855 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:47.024700 0.228269 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:47.373766 0.088932 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:47.438523 0.170733 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:47.752094 0.173467 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:48.167520 0.075109 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:26:48.245860 0.000000 udp 10.0.2.105 7010 -> 50.29.239.83 8927 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 18:26:50.590393 3.004303 tcp 10.0.2.105 50313 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:26:59.593087 0.000000 tcp 10.0.2.105 50313 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:05.593518 0.044991 tcp 10.0.2.105 50314 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:05.638773 0.046460 tcp 10.0.2.105 50315 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:05.685339 0.140971 tcp 10.0.2.105 50316 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:05.985804 3.001355 tcp 10.0.2.105 50317 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:06.072967 0.045913 tcp 10.0.2.105 50318 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:06.119203 0.047049 tcp 10.0.2.105 50319 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:06.166509 0.144185 tcp 10.0.2.105 50320 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:06.311205 0.168232 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:06.626762 0.093658 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:06.681002 0.129198 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:06.858449 0.283552 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:07.224760 0.396853 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:07.601210 0.176521 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:07.774743 0.172520 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:07.920952 0.087984 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:08.146871 0.121111 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:08.248527 0.237335 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:08.484785 0.038080 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:08.509484 0.069714 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:08.670635 0.178549 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:27:14.985896 0.000000 tcp 10.0.2.105 50317 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:20.984773 0.045306 tcp 10.0.2.105 50321 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:21.029724 0.046822 tcp 10.0.2.105 50322 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:21.076918 0.140028 tcp 10.0.2.105 50323 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:27:21.228618 3.000030 tcp 10.0.2.105 50324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:30.227361 0.000000 tcp 10.0.2.105 50324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:36.225927 2.994156 tcp 10.0.2.105 50325 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:45.218971 0.000000 tcp 10.0.2.105 50325 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:27:49.865502 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:30:29.779398 3.000369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:30:36.785501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:30:44.787212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:31:00.789859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:31:32.796074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:32:51.229915 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:32:51.230009 3.003273 tcp 10.0.2.105 50326 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:00.232048 0.000000 tcp 10.0.2.105 50326 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:06.231929 0.045380 tcp 10.0.2.105 50327 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:06.277706 0.046425 tcp 10.0.2.105 50328 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:06.324554 0.134149 tcp 10.0.2.105 50329 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:06.673901 3.001314 tcp 10.0.2.105 50330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:15.674523 0.000000 tcp 10.0.2.105 50330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:21.675383 0.045200 tcp 10.0.2.105 50331 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:21.720908 0.045922 tcp 10.0.2.105 50332 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:21.767133 0.135380 tcp 10.0.2.105 50333 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:21.960359 3.006809 tcp 10.0.2.105 50334 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:30.975961 0.000000 tcp 10.0.2.105 50334 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:36.955181 0.045541 tcp 10.0.2.105 50335 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:37.000552 0.046188 tcp 10.0.2.105 50336 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:37.047019 0.141370 tcp 10.0.2.105 50337 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:37.226521 2.992562 tcp 10.0.2.105 50338 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:46.218016 0.000000 tcp 10.0.2.105 50338 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:33:52.227187 0.045967 tcp 10.0.2.105 50339 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:52.273515 0.045821 tcp 10.0.2.105 50340 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:52.319604 0.139898 tcp 10.0.2.105 50341 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:52.775213 4.969900 tcp 10.0.2.105 50342 -> 46.48.247.67 29365 SPA_* 0 0 12 1473 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:57.743586 0.044795 tcp 10.0.2.105 50343 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:57.788340 0.049244 tcp 10.0.2.105 50344 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:57.837908 0.136626 tcp 10.0.2.105 50345 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:58.139258 0.226214 tcp 10.0.2.105 50342 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:33:58.365936 2.962254 tcp 10.0.2.105 50346 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:07.269630 0.000000 tcp 10.0.2.105 50346 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:13.221927 2.962049 tcp 10.0.2.105 50347 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:22.149253 0.000000 tcp 10.0.2.105 50347 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:26.865823 0.000210 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:34:28.158805 3.003808 tcp 10.0.2.105 50348 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:37.161074 0.000000 tcp 10.0.2.105 50348 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:43.159754 3.004365 tcp 10.0.2.105 50349 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:50.870763 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:34:52.162798 0.000000 tcp 10.0.2.105 50349 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:34:58.161045 1.364036 tcp 10.0.2.105 50350 -> 46.48.247.67 29365 SPA_* 0 0 7 943 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:35:04.052849 0.003435 tcp 10.0.2.105 50350 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:37:36.802027 3.001799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:37:43.810113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:37:51.810934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:38:07.813932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:38:39.819873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:40:04.051733 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:40:04.051843 3.003588 tcp 10.0.2.105 50351 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:13.054026 0.000000 tcp 10.0.2.105 50351 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:19.054531 0.045535 tcp 10.0.2.105 50352 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:19.100330 0.046948 tcp 10.0.2.105 50353 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:19.147593 0.139509 tcp 10.0.2.105 50354 -> 195.113.214.251 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:19.373811 2.993771 tcp 10.0.2.105 50355 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:28.375640 0.000000 tcp 10.0.2.105 50355 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:34.375381 0.044263 tcp 10.0.2.105 50356 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:34.419947 0.046162 tcp 10.0.2.105 50357 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:34.466689 0.139063 tcp 10.0.2.105 50358 -> 195.113.214.251 443 SRPA* 0 0 28 12094 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:34.719860 3.002881 tcp 10.0.2.105 50359 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:43.718270 0.000000 tcp 10.0.2.105 50359 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:49.720092 0.044711 tcp 10.0.2.105 50360 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:49.765130 0.046777 tcp 10.0.2.105 50361 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:49.812287 0.195606 tcp 10.0.2.105 50362 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:40:50.134205 2.997454 tcp 10.0.2.105 50363 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:40:59.129856 0.000000 tcp 10.0.2.105 50363 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:05.129655 0.044785 tcp 10.0.2.105 50364 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:05.174718 0.046873 tcp 10.0.2.105 50365 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:05.221965 0.139909 tcp 10.0.2.105 50366 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:05.473662 4.802205 tcp 10.0.2.105 50367 -> 46.48.247.67 29365 SPA_* 0 0 12 1506 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:10.273591 0.044856 tcp 10.0.2.105 50368 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:10.318434 0.045424 tcp 10.0.2.105 50369 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:10.364561 0.137120 tcp 10.0.2.105 50370 -> 195.113.214.251 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:10.568938 0.000080 tcp 10.0.2.105 50367 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:41:10.569247 3.001738 tcp 10.0.2.105 50371 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:19.569707 0.000000 tcp 10.0.2.105 50371 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:25.569046 3.004500 tcp 10.0.2.105 50372 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:34.571261 0.000000 tcp 10.0.2.105 50372 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:39.368285 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:41:40.569964 3.022295 tcp 10.0.2.105 50373 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:49.573099 0.000000 tcp 10.0.2.105 50373 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:41:55.581711 3.004266 tcp 10.0.2.105 50374 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:42:03.372845 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:42:04.584503 0.000000 tcp 10.0.2.105 50374 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:42:10.583230 4.772080 tcp 10.0.2.105 50375 -> 46.48.247.67 29365 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:44:43.829034 2.998803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:44:50.833400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:44:58.834916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:45:14.838143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:45:46.844503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:47:15.351762 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:47:15.351959 3.003369 tcp 10.0.2.105 50376 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:47:24.353937 0.000000 tcp 10.0.2.105 50376 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:47:30.354356 0.045073 tcp 10.0.2.105 50377 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:30.399712 0.045185 tcp 10.0.2.105 50378 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:30.445176 0.132760 tcp 10.0.2.105 50379 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:30.735157 3.002424 tcp 10.0.2.105 50380 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:47:39.746501 0.000000 tcp 10.0.2.105 50380 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:47:45.735444 0.044353 tcp 10.0.2.105 50381 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:45.780147 0.046122 tcp 10.0.2.105 50382 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:45.826095 0.145095 tcp 10.0.2.105 50383 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:47:45.997617 3.001993 tcp 10.0.2.105 50384 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:47:54.998263 0.000000 tcp 10.0.2.105 50384 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:00.997766 0.045074 tcp 10.0.2.105 50385 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:01.043132 0.046323 tcp 10.0.2.105 50386 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:01.089961 0.140164 tcp 10.0.2.105 50387 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:01.444551 2.997551 tcp 10.0.2.105 50388 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:10.440508 0.000000 tcp 10.0.2.105 50388 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:16.440027 0.045236 tcp 10.0.2.105 50389 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:16.485551 0.046088 tcp 10.0.2.105 50390 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:16.532044 0.136355 tcp 10.0.2.105 50391 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:16.681635 3.345450 tcp 10.0.2.105 50392 -> 46.48.247.67 29365 SPA_* 0 0 10 1070 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:24.239947 0.261762 tcp 10.0.2.105 50392 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:24.240814 0.044790 tcp 10.0.2.105 50393 -> 195.113.214.221 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:24.285924 0.047737 tcp 10.0.2.105 50394 -> 195.113.214.251 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:24.333908 0.145284 tcp 10.0.2.105 50395 -> 195.113.214.251 443 SRPA* 0 0 22 12875 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:48:24.501956 3.002888 tcp 10.0.2.105 50396 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:33.503568 0.000000 tcp 10.0.2.105 50396 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:39.502793 3.003928 tcp 10.0.2.105 50397 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:48.505343 0.000000 tcp 10.0.2.105 50397 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:48:53.372239 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:48:54.504133 2.994142 tcp 10.0.2.105 50398 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:49:03.506833 0.000000 tcp 10.0.2.105 50398 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:49:09.505745 2.994080 tcp 10.0.2.105 50399 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:49:17.366213 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:49:18.498378 0.000000 tcp 10.0.2.105 50399 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:49:24.507387 1.769355 tcp 10.0.2.105 50400 -> 46.48.247.67 29365 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:51:50.850190 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:51:57.857374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:52:05.859003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:52:21.861976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:52:53.868078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:54:26.271384 0.000226 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:54:26.271725 3.003435 tcp 10.0.2.105 50401 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:54:35.273750 0.000000 tcp 10.0.2.105 50401 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:54:41.274272 0.045610 tcp 10.0.2.105 50402 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:41.320390 0.045626 tcp 10.0.2.105 50403 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:41.366322 0.135657 tcp 10.0.2.105 50404 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:41.609785 2.997383 tcp 10.0.2.105 50405 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:54:50.615776 0.000000 tcp 10.0.2.105 50405 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:54:56.605223 0.044781 tcp 10.0.2.105 50406 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:56.649847 0.046671 tcp 10.0.2.105 50407 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:56.696819 0.141685 tcp 10.0.2.105 50408 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:54:56.851005 2.998329 tcp 10.0.2.105 50409 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:05.847601 0.000000 tcp 10.0.2.105 50409 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:11.847159 0.047066 tcp 10.0.2.105 50410 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:11.894568 0.045534 tcp 10.0.2.105 50411 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:11.940440 0.134302 tcp 10.0.2.105 50412 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:12.084721 4.718229 tcp 10.0.2.105 50413 -> 46.48.247.67 29365 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:16.556613 0.045509 tcp 10.0.2.105 50414 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:16.602435 0.046180 tcp 10.0.2.105 50415 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:16.648995 0.136025 tcp 10.0.2.105 50416 -> 195.113.214.251 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:55:16.803201 2.994150 tcp 10.0.2.105 50417 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:25.806467 0.000000 tcp 10.0.2.105 50417 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:31.795079 2.994234 tcp 10.0.2.105 50418 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:40.787594 0.000000 tcp 10.0.2.105 50418 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:45.364709 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:55:46.796635 2.994285 tcp 10.0.2.105 50419 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:55:55.789274 0.000000 tcp 10.0.2.105 50419 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 18:56:01.798402 4.371652 tcp 10.0.2.105 50420 -> 46.48.247.67 29365 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/06 18:57:18.248271 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 18:57:18.248392 0.148548 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:18.383170 0.174174 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:18.620551 0.177003 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:18.791287 0.048299 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:18.822892 0.259256 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.049073 0.079189 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.154345 0.060591 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.213772 0.102803 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.299926 0.082930 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.372711 0.185679 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.634739 0.111590 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.708469 0.176096 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:19.863679 0.167944 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.009456 0.170979 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.256408 0.086213 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.318670 0.223248 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.534761 0.074722 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.651138 0.127673 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:20.737549 0.279907 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:21.440892 0.168065 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:21.669691 0.090055 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:21.723546 0.403896 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.109093 0.176000 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.281576 0.171545 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.425267 0.092512 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.527421 0.037707 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.632721 0.069542 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.687801 0.178654 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.861714 0.069502 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:57:22.912837 0.237853 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/06 18:58:57.874448 3.001364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 18:59:04.881580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:59:12.882958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 18:59:28.886547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:00:00.892074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:01:06.166095 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:01:06.166192 2.993834 tcp 10.0.2.105 50421 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:15.158685 0.000000 tcp 10.0.2.105 50421 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:21.169258 0.045175 tcp 10.0.2.105 50422 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:21.214717 0.045493 tcp 10.0.2.105 50423 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:21.260600 0.137046 tcp 10.0.2.105 50424 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:21.437162 2.994850 tcp 10.0.2.105 50425 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:30.430690 0.000000 tcp 10.0.2.105 50425 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:36.430017 0.044682 tcp 10.0.2.105 50426 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:36.475117 0.049296 tcp 10.0.2.105 50427 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:36.524715 0.144525 tcp 10.0.2.105 50428 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:36.681205 3.002620 tcp 10.0.2.105 50429 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:45.682783 0.000000 tcp 10.0.2.105 50429 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:01:51.682079 0.044399 tcp 10.0.2.105 50430 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:51.726831 0.050581 tcp 10.0.2.105 50431 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:51.777681 0.138123 tcp 10.0.2.105 50432 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:01:51.951941 3.003875 tcp 10.0.2.105 50433 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:00.954285 0.000000 tcp 10.0.2.105 50433 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:06.953655 0.044506 tcp 10.0.2.105 50434 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:06.998472 0.048174 tcp 10.0.2.105 50435 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:07.046579 0.147511 tcp 10.0.2.105 50436 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:07.208204 0.345340 tcp 10.0.2.105 50437 -> 46.48.247.67 29365 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:12.284395 0.253596 tcp 10.0.2.105 50437 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:12.285089 0.044545 tcp 10.0.2.105 50438 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:12.329895 0.046819 tcp 10.0.2.105 50439 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:12.377051 0.138700 tcp 10.0.2.105 50440 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:02:12.538271 3.007196 tcp 10.0.2.105 50441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:21.544021 0.000000 tcp 10.0.2.105 50441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:27.533171 2.993895 tcp 10.0.2.105 50442 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:36.535715 0.000000 tcp 10.0.2.105 50442 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:41.372508 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:02:42.534763 2.993964 tcp 10.0.2.105 50443 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:51.538923 0.000000 tcp 10.0.2.105 50443 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:02:57.536061 2.994516 tcp 10.0.2.105 50444 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:03:05.367245 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:03:06.528820 0.000000 tcp 10.0.2.105 50444 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:03:12.537647 0.359044 tcp 10.0.2.105 50445 -> 46.48.247.67 29365 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:03:18.660228 0.000444 tcp 10.0.2.105 50445 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:06:12.899434 3.171887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:06:20.041480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:06:27.968236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:06:43.921639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:07:16.122600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:08:18.658799 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:08:18.658915 3.004624 tcp 10.0.2.105 50446 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:08:27.660260 0.000000 tcp 10.0.2.105 50446 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:08:33.660862 0.047078 tcp 10.0.2.105 50447 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:33.708267 0.049651 tcp 10.0.2.105 50448 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:33.758156 0.138516 tcp 10.0.2.105 50449 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:34.484619 3.000810 tcp 10.0.2.105 50450 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:08:43.483364 0.000000 tcp 10.0.2.105 50450 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:08:49.482621 0.045012 tcp 10.0.2.105 50451 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:49.527523 0.045819 tcp 10.0.2.105 50452 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:49.573650 0.143149 tcp 10.0.2.105 50453 -> 195.113.214.251 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:08:49.760548 3.006372 tcp 10.0.2.105 50454 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:08:58.765638 0.000000 tcp 10.0.2.105 50454 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:04.754613 0.044618 tcp 10.0.2.105 50455 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:04.799137 0.046209 tcp 10.0.2.105 50456 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:04.845645 0.140998 tcp 10.0.2.105 50457 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:05.147746 3.001189 tcp 10.0.2.105 50458 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:14.147300 0.000000 tcp 10.0.2.105 50458 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:20.147495 0.044480 tcp 10.0.2.105 50459 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:20.192573 0.046515 tcp 10.0.2.105 50460 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:20.239389 0.136573 tcp 10.0.2.105 50461 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:20.761999 0.360671 tcp 10.0.2.105 50462 -> 46.48.247.67 29365 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:26.679214 0.614369 tcp 10.0.2.105 50462 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:26.679905 0.044564 tcp 10.0.2.105 50463 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:26.724835 0.046650 tcp 10.0.2.105 50464 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:26.771810 0.145474 tcp 10.0.2.105 50465 -> 195.113.214.251 443 SRPA* 0 0 40 31908 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:09:27.293822 2.996659 tcp 10.0.2.105 50466 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:36.290813 0.000000 tcp 10.0.2.105 50466 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:42.288037 3.003942 tcp 10.0.2.105 50467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:51.290733 0.000000 tcp 10.0.2.105 50467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:09:55.867362 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:09:57.289277 3.004283 tcp 10.0.2.105 50468 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:10:06.292464 0.000000 tcp 10.0.2.105 50468 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:10:12.291266 3.004030 tcp 10.0.2.105 50469 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:10:19.871846 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:10:21.293908 0.000000 tcp 10.0.2.105 50469 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:10:27.292725 0.341418 tcp 10.0.2.105 50470 -> 46.48.247.67 29365 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:10:33.048146 0.004343 tcp 10.0.2.105 50470 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:13:19.943761 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:13:26.950856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:13:34.952723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:13:50.955283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:14:22.961358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:15:33.043233 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:15:33.043421 3.003264 tcp 10.0.2.105 50471 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:15:42.044946 0.000000 tcp 10.0.2.105 50471 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:15:48.046187 0.045835 tcp 10.0.2.105 50472 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:15:48.092382 0.049359 tcp 10.0.2.105 50473 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:15:48.142085 0.142799 tcp 10.0.2.105 50474 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:15:48.472806 2.995795 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:15:57.477332 0.000000 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:03.466637 0.046088 tcp 10.0.2.105 50476 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:03.513069 0.048265 tcp 10.0.2.105 50477 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:03.561152 0.141211 tcp 10.0.2.105 50478 -> 195.113.214.251 443 SRPA* 0 0 27 11834 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:03.811343 2.989355 tcp 10.0.2.105 50479 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:12.799337 0.000000 tcp 10.0.2.105 50479 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:18.808870 0.043888 tcp 10.0.2.105 50480 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:18.853068 0.048005 tcp 10.0.2.105 50481 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:18.901378 0.142423 tcp 10.0.2.105 50482 -> 195.113.214.251 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:19.181149 3.001860 tcp 10.0.2.105 50483 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:28.181551 0.000000 tcp 10.0.2.105 50483 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:34.180592 0.044764 tcp 10.0.2.105 50484 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:34.225670 0.046798 tcp 10.0.2.105 50485 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:34.272751 0.136256 tcp 10.0.2.105 50486 -> 195.113.214.251 443 SRPA* 0 0 26 12702 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:34.603607 0.363976 tcp 10.0.2.105 50487 -> 46.48.247.67 29365 SPA_* 0 0 7 1131 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:40.114315 0.418593 tcp 10.0.2.105 50487 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:40.115098 0.044874 tcp 10.0.2.105 50488 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:40.160281 0.048227 tcp 10.0.2.105 50489 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:40.208791 0.143911 tcp 10.0.2.105 50490 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:16:40.533222 3.000334 tcp 10.0.2.105 50491 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:49.532186 0.000000 tcp 10.0.2.105 50491 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:16:55.531054 3.004096 tcp 10.0.2.105 50492 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:04.533588 0.000000 tcp 10.0.2.105 50492 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:09.370046 0.711925 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:17:11.207687 2.970475 tcp 10.0.2.105 50493 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:20.104638 0.000000 tcp 10.0.2.105 50493 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:26.030835 2.957789 tcp 10.0.2.105 50494 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:33.769557 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:17:34.927352 0.000000 tcp 10.0.2.105 50494 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:17:40.852020 0.349600 tcp 10.0.2.105 50495 -> 46.48.247.67 29365 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:17:46.173262 0.003098 tcp 10.0.2.105 50495 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:20:26.967598 3.003346 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:20:33.974975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:20:41.976591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:20:57.979515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:21:29.986295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:22:45.925066 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:22:45.925160 2.993625 tcp 10.0.2.105 50496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:22:54.916978 0.000000 tcp 10.0.2.105 50496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:01.764816 0.046004 tcp 10.0.2.105 50497 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:01.810633 0.048936 tcp 10.0.2.105 50498 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:01.859858 0.145077 tcp 10.0.2.105 50499 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:02.554203 2.954553 tcp 10.0.2.105 50500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:11.434893 0.000000 tcp 10.0.2.105 50500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:17.362242 0.044105 tcp 10.0.2.105 50501 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:17.406626 0.048895 tcp 10.0.2.105 50502 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:17.455845 0.144986 tcp 10.0.2.105 50503 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:17.745605 2.967154 tcp 10.0.2.105 50504 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:26.637369 0.000000 tcp 10.0.2.105 50504 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:32.561492 0.045145 tcp 10.0.2.105 50505 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:32.607035 0.046552 tcp 10.0.2.105 50506 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:32.653929 0.142562 tcp 10.0.2.105 50507 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:33.191481 2.977024 tcp 10.0.2.105 50508 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:42.090094 0.000000 tcp 10.0.2.105 50508 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:23:48.003530 0.045618 tcp 10.0.2.105 50509 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:48.049497 0.046532 tcp 10.0.2.105 50510 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:48.096329 0.147132 tcp 10.0.2.105 50511 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:48.253129 0.344238 tcp 10.0.2.105 50512 -> 46.48.247.67 29365 SPA_* 0 0 9 1105 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:53.401461 0.789865 tcp 10.0.2.105 50512 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:53.402336 0.045245 tcp 10.0.2.105 50513 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:53.447405 0.045885 tcp 10.0.2.105 50514 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:53.493566 0.135729 tcp 10.0.2.105 50515 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:23:54.191627 2.973030 tcp 10.0.2.105 50516 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:03.086168 0.000000 tcp 10.0.2.105 50516 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:09.004537 2.993959 tcp 10.0.2.105 50517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:18.006740 0.000000 tcp 10.0.2.105 50517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:22.864732 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:24:24.005832 2.994175 tcp 10.0.2.105 50518 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:32.998651 0.000000 tcp 10.0.2.105 50518 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:39.007479 3.005213 tcp 10.0.2.105 50519 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:46.868064 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:24:48.010013 0.000000 tcp 10.0.2.105 50519 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:24:54.009056 0.533129 tcp 10.0.2.105 50520 -> 46.48.247.67 29365 SPA_* 0 0 9 1105 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:24:59.256688 0.000974 tcp 10.0.2.105 50520 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:27:33.991545 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:27:38.104837 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:27:38.105004 0.148828 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:38.239429 0.045551 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:38.538622 0.248973 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:38.751142 0.076128 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:38.922742 0.172164 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.087667 0.182079 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.259415 0.062774 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.321107 0.097027 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.552286 0.081587 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.624992 0.199533 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.818338 0.113873 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:39.984676 0.173931 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.286168 0.086591 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.350158 0.178845 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.545256 0.167947 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.691614 0.228697 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.912120 0.084889 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:40.998772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:27:41.023934 0.125477 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:41.108006 0.293884 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:41.542836 0.174692 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:41.877141 0.094576 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:41.932368 0.399538 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:42.309756 0.176430 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:42.482626 0.243480 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:42.697671 0.087687 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:43.166872 0.178926 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:43.345199 0.081604 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:43.653683 0.235781 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:43.868023 0.035759 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:44.257855 0.071344 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:27:49.000477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:28:05.003391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:28:37.009193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:29:59.259380 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:29:59.259532 3.002447 tcp 10.0.2.105 50521 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:08.260043 0.000000 tcp 10.0.2.105 50521 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:14.262784 0.046413 tcp 10.0.2.105 50522 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:14.309498 0.045836 tcp 10.0.2.105 50523 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:14.355585 0.138515 tcp 10.0.2.105 50524 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:15.030387 3.003826 tcp 10.0.2.105 50525 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:24.032942 0.000000 tcp 10.0.2.105 50525 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:30.022182 0.045240 tcp 10.0.2.105 50526 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:30.067756 0.046788 tcp 10.0.2.105 50527 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:30.114859 0.139815 tcp 10.0.2.105 50528 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:30.315643 3.000502 tcp 10.0.2.105 50529 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:39.315124 0.000000 tcp 10.0.2.105 50529 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:45.314418 0.045161 tcp 10.0.2.105 50530 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:45.359903 0.046024 tcp 10.0.2.105 50531 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:45.406218 0.143802 tcp 10.0.2.105 50532 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:30:45.773534 2.994969 tcp 10.0.2.105 50533 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:30:54.776978 0.000000 tcp 10.0.2.105 50533 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:01.197131 0.044835 tcp 10.0.2.105 50534 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:01.242289 0.046846 tcp 10.0.2.105 50535 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:01.288960 0.135973 tcp 10.0.2.105 50536 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:01.731623 4.994430 tcp 10.0.2.105 50537 -> 46.48.247.67 29365 SPA_* 0 0 12 1501 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:06.722690 0.044952 tcp 10.0.2.105 50538 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:06.767920 0.046434 tcp 10.0.2.105 50539 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:06.814155 0.140648 tcp 10.0.2.105 50540 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:07.009041 0.000090 tcp 10.0.2.105 50537 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:31:07.009363 2.958785 tcp 10.0.2.105 50541 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:15.893194 0.000000 tcp 10.0.2.105 50541 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:21.818872 2.953285 tcp 10.0.2.105 50542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:30.699364 0.000000 tcp 10.0.2.105 50542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:35.368167 0.073051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:31:36.697479 2.960036 tcp 10.0.2.105 50543 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:45.650821 0.000000 tcp 10.0.2.105 50543 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:51.649447 3.003813 tcp 10.0.2.105 50544 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:31:59.369892 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:32:00.651974 0.000000 tcp 10.0.2.105 50544 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:32:06.651156 4.881177 tcp 10.0.2.105 50545 -> 46.48.247.67 29365 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:34:41.015789 3.000860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:34:48.022790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:34:56.024395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:35:12.027502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:35:44.033260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:37:11.529542 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:37:11.529733 3.003680 tcp 10.0.2.105 50546 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:20.532119 0.000000 tcp 10.0.2.105 50546 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:26.532137 0.046057 tcp 10.0.2.105 50547 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:26.578538 0.047563 tcp 10.0.2.105 50548 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:26.625973 0.144003 tcp 10.0.2.105 50549 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:26.790784 3.004630 tcp 10.0.2.105 50550 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:35.793736 0.000000 tcp 10.0.2.105 50550 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:41.783652 0.046160 tcp 10.0.2.105 50551 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:41.830182 0.047393 tcp 10.0.2.105 50552 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:41.877921 0.142423 tcp 10.0.2.105 50553 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:42.065220 2.991620 tcp 10.0.2.105 50554 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:51.065524 0.000000 tcp 10.0.2.105 50554 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:37:57.065125 0.045736 tcp 10.0.2.105 50555 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:57.111156 0.049997 tcp 10.0.2.105 50556 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:57.161021 0.134299 tcp 10.0.2.105 50557 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:37:57.314306 2.994823 tcp 10.0.2.105 50558 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:06.307871 0.000000 tcp 10.0.2.105 50558 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:12.307336 0.044821 tcp 10.0.2.105 50559 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:12.352582 0.045751 tcp 10.0.2.105 50560 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:12.398654 0.147347 tcp 10.0.2.105 50561 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:12.570341 0.351067 tcp 10.0.2.105 50562 -> 46.48.247.67 29365 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:21.756201 0.504394 tcp 10.0.2.105 50562 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:21.757000 0.045684 tcp 10.0.2.105 50563 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:21.802958 0.047964 tcp 10.0.2.105 50564 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:21.851262 0.136181 tcp 10.0.2.105 50565 -> 195.113.214.251 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:38:22.260903 3.004115 tcp 10.0.2.105 50566 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:31.263711 0.000000 tcp 10.0.2.105 50566 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:37.262656 3.004094 tcp 10.0.2.105 50567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:46.265339 0.000000 tcp 10.0.2.105 50567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:38:50.871906 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:38:52.264006 2.994302 tcp 10.0.2.105 50568 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:39:01.266981 0.000000 tcp 10.0.2.105 50568 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:39:07.265758 2.993634 tcp 10.0.2.105 50569 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:39:14.866259 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:39:16.257945 0.000000 tcp 10.0.2.105 50569 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:39:22.267061 0.348714 tcp 10.0.2.105 50570 -> 46.48.247.67 29365 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:39:31.706260 0.002334 tcp 10.0.2.105 50570 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:41:48.039843 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:41:55.046879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:42:03.048253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:42:19.050947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:42:51.057597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:44:31.702428 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:44:31.702666 3.003573 tcp 10.0.2.105 50571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:44:40.704868 0.000000 tcp 10.0.2.105 50571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:44:46.705088 0.121308 tcp 10.0.2.105 50572 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:44:46.826652 0.045015 tcp 10.0.2.105 50573 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:44:46.871956 0.146646 tcp 10.0.2.105 50574 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:44:47.048643 2.999727 tcp 10.0.2.105 50575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:44:56.059180 0.000000 tcp 10.0.2.105 50575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:02.046303 0.045873 tcp 10.0.2.105 50576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:02.092677 0.044623 tcp 10.0.2.105 50577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:02.137608 0.146316 tcp 10.0.2.105 50578 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:02.324013 2.996132 tcp 10.0.2.105 50579 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:11.318491 0.000000 tcp 10.0.2.105 50579 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:17.318388 0.044886 tcp 10.0.2.105 50580 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:17.363585 0.045746 tcp 10.0.2.105 50581 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:17.409698 0.141165 tcp 10.0.2.105 50582 -> 195.113.214.251 443 SRPA* 0 0 38 24548 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:17.720315 3.002158 tcp 10.0.2.105 50583 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:26.721306 0.000000 tcp 10.0.2.105 50583 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:32.720573 0.045789 tcp 10.0.2.105 50584 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:32.766666 0.045211 tcp 10.0.2.105 50585 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:32.811838 0.139360 tcp 10.0.2.105 50586 -> 195.113.214.251 443 SRPA* 0 0 41 35208 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:32.973751 4.657617 tcp 10.0.2.105 50587 -> 46.48.247.67 29365 SPA_* 0 0 12 1556 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:37.631580 0.044768 tcp 10.0.2.105 50588 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:37.676611 0.045220 tcp 10.0.2.105 50589 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:37.722137 0.137615 tcp 10.0.2.105 50590 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:37.975572 0.000119 tcp 10.0.2.105 50587 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:45:37.975994 2.995311 tcp 10.0.2.105 50591 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:46.970526 0.000000 tcp 10.0.2.105 50591 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:45:52.969158 3.003563 tcp 10.0.2.105 50592 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:01.971645 0.000000 tcp 10.0.2.105 50592 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:06.868772 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:46:07.970240 3.004531 tcp 10.0.2.105 50593 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:16.972921 0.000000 tcp 10.0.2.105 50593 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:22.972047 3.004285 tcp 10.0.2.105 50594 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:30.863274 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:46:31.974423 0.000000 tcp 10.0.2.105 50594 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:46:37.973684 4.589811 tcp 10.0.2.105 50595 -> 46.48.247.67 29365 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:51:42.562248 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:51:42.562362 3.003469 tcp 10.0.2.105 50596 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:51:51.564176 0.000000 tcp 10.0.2.105 50596 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:51:57.564976 0.045581 tcp 10.0.2.105 50597 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:51:57.610916 0.045717 tcp 10.0.2.105 50598 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:51:57.656968 0.141153 tcp 10.0.2.105 50599 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:51:57.828798 2.998890 tcp 10.0.2.105 50600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:06.836561 0.000000 tcp 10.0.2.105 50600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:12.825569 0.044686 tcp 10.0.2.105 50601 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:12.870574 0.045485 tcp 10.0.2.105 50602 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:12.916481 0.142390 tcp 10.0.2.105 50603 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:13.070454 2.999281 tcp 10.0.2.105 50604 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:22.068608 0.000000 tcp 10.0.2.105 50604 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:28.067580 0.044147 tcp 10.0.2.105 50605 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:28.112034 0.046939 tcp 10.0.2.105 50606 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:28.159291 0.139541 tcp 10.0.2.105 50607 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:28.315844 2.995567 tcp 10.0.2.105 50608 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:37.310047 0.000000 tcp 10.0.2.105 50608 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:43.309778 0.045317 tcp 10.0.2.105 50609 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:43.355445 0.048295 tcp 10.0.2.105 50610 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:43.404063 0.138309 tcp 10.0.2.105 50611 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:43.555371 4.775063 tcp 10.0.2.105 50612 -> 46.48.247.67 29365 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:48.091976 0.045093 tcp 10.0.2.105 50613 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:48.137453 0.044794 tcp 10.0.2.105 50614 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:48.182601 0.136567 tcp 10.0.2.105 50615 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:52:48.330606 2.999412 tcp 10.0.2.105 50616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:52:57.328959 0.000000 tcp 10.0.2.105 50616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:03.327700 3.004319 tcp 10.0.2.105 50617 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:12.330568 0.000000 tcp 10.0.2.105 50617 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:16.866782 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:53:18.329199 3.004354 tcp 10.0.2.105 50618 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:22.067557 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 19:53:27.348410 0.000000 tcp 10.0.2.105 50618 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:29.094384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:53:33.330621 3.004382 tcp 10.0.2.105 50619 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:37.086124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:53:40.871541 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:53:42.333993 0.000000 tcp 10.0.2.105 50619 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:53:48.332419 0.350567 tcp 10.0.2.105 50620 -> 46.48.247.67 29365 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:53:53.089111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:53:56.167318 0.002613 tcp 10.0.2.105 50620 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:54:25.095232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 19:58:00.527324 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:58:00.527464 0.434799 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:00.926135 0.090404 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.001040 0.173647 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.167010 0.186570 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.334354 0.047509 udp 10.0.2.105 7010 <-> 79.219.117.112 2430 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.367067 0.175176 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.539334 0.063104 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.612061 0.088687 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.685834 0.086868 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.758548 0.196712 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:01.949786 0.114848 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.023898 0.173710 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.216319 0.088391 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.285319 0.181369 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.444956 0.167750 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2019 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.589910 0.232217 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.815164 0.088241 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.900886 0.130558 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:02.986231 0.085649 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:03.041189 0.275515 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:03.326215 0.174102 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:03.482821 0.404067 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:03.865905 0.176225 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.039396 0.174169 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.186229 0.085226 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.254327 0.240356 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.470121 0.179727 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.645273 0.075670 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.703179 0.041240 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:04.754925 0.071960 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/06 19:58:56.165666 2.993392 tcp 10.0.2.105 50621 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:00.871519 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 19:59:05.157452 0.000000 tcp 10.0.2.105 50621 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:11.168326 0.045242 tcp 10.0.2.105 50622 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:11.213887 0.044351 tcp 10.0.2.105 50623 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:11.258574 0.153823 tcp 10.0.2.105 50624 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:11.423849 2.997410 tcp 10.0.2.105 50625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:20.419786 0.000000 tcp 10.0.2.105 50625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:26.419018 0.044277 tcp 10.0.2.105 50626 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:26.463562 0.048617 tcp 10.0.2.105 50627 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:26.512703 0.135707 tcp 10.0.2.105 50628 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:26.664349 2.998748 tcp 10.0.2.105 50629 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:35.661594 0.000000 tcp 10.0.2.105 50629 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:41.660722 0.046214 tcp 10.0.2.105 50630 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:41.706722 0.044239 tcp 10.0.2.105 50631 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:41.751277 0.139821 tcp 10.0.2.105 50632 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:41.901961 3.002977 tcp 10.0.2.105 50633 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:50.903575 0.000000 tcp 10.0.2.105 50633 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 19:59:56.902920 0.044184 tcp 10.0.2.105 50634 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:56.947444 0.052892 tcp 10.0.2.105 50635 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:57.000694 0.139817 tcp 10.0.2.105 50636 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 19:59:57.162633 4.781763 tcp 10.0.2.105 50637 -> 46.48.247.67 29365 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:00:01.643277 0.045156 tcp 10.0.2.105 50638 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:00:01.688813 0.095171 tcp 10.0.2.105 50639 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:00:01.783995 0.145064 tcp 10.0.2.105 50640 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:00:01.944589 2.999294 tcp 10.0.2.105 50641 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:10.942584 0.000000 tcp 10.0.2.105 50641 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:16.941122 3.004230 tcp 10.0.2.105 50642 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:25.943791 0.000000 tcp 10.0.2.105 50642 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:29.102176 3.000605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:00:30.871016 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:00:31.942877 3.003607 tcp 10.0.2.105 50643 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:36.108789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:00:40.945527 0.000000 tcp 10.0.2.105 50643 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:44.109934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:00:46.944369 2.993796 tcp 10.0.2.105 50644 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:00:54.865472 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:00:55.946487 0.000000 tcp 10.0.2.105 50644 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:01:00.113188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:01:01.946014 0.799375 tcp 10.0.2.105 50645 -> 46.48.247.67 29365 SPA_* 0 0 9 1184 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:01:19.947831 0.000557 tcp 10.0.2.105 50645 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:01:32.118815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:06:19.943569 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:06:19.943676 3.003833 tcp 10.0.2.105 50646 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:06:28.955867 0.000000 tcp 10.0.2.105 50646 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:06:34.946170 0.051231 tcp 10.0.2.105 50647 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:34.997753 0.053219 tcp 10.0.2.105 50648 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:35.051235 0.144167 tcp 10.0.2.105 50649 -> 195.113.214.251 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:35.582649 2.996869 tcp 10.0.2.105 50650 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:06:44.578090 0.000000 tcp 10.0.2.105 50650 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:06:50.577471 0.227942 tcp 10.0.2.105 50651 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:50.805745 0.054222 tcp 10.0.2.105 50652 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:50.860404 0.142029 tcp 10.0.2.105 50653 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:06:51.435140 2.969737 tcp 10.0.2.105 50654 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:00.353984 0.000000 tcp 10.0.2.105 50654 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:06.308426 0.045571 tcp 10.0.2.105 50655 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:06.354344 0.053456 tcp 10.0.2.105 50656 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:06.408082 0.140026 tcp 10.0.2.105 50657 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:06.757262 2.981872 tcp 10.0.2.105 50658 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:15.712849 0.000000 tcp 10.0.2.105 50658 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:21.712759 0.045071 tcp 10.0.2.105 50659 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:21.758139 0.053660 tcp 10.0.2.105 50660 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:21.812170 0.148168 tcp 10.0.2.105 50661 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:22.213431 0.347725 tcp 10.0.2.105 50662 -> 46.48.247.67 29365 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:33.526340 0.447773 tcp 10.0.2.105 50662 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:33.527140 0.045010 tcp 10.0.2.105 50663 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:33.572432 0.053970 tcp 10.0.2.105 50664 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:33.626707 0.140520 tcp 10.0.2.105 50665 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:07:33.974391 2.999195 tcp 10.0.2.105 50666 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:36.126403 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:07:42.972426 0.000000 tcp 10.0.2.105 50666 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:43.132490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:07:48.970766 3.004517 tcp 10.0.2.105 50667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:07:51.134080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:07:57.973939 0.000000 tcp 10.0.2.105 50667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:08:02.872481 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:08:03.972790 3.004155 tcp 10.0.2.105 50668 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:08:07.137050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:08:12.975437 0.000000 tcp 10.0.2.105 50668 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:08:18.974110 2.994281 tcp 10.0.2.105 50669 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:08:26.865231 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:08:27.977091 0.000000 tcp 10.0.2.105 50669 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:08:33.975357 0.353350 tcp 10.0.2.105 50670 -> 46.48.247.67 29365 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:08:39.143362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:08:41.157080 0.002974 tcp 10.0.2.105 50670 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:13:41.157539 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:13:41.157771 3.003746 tcp 10.0.2.105 50671 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:13:50.160118 0.000000 tcp 10.0.2.105 50671 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:13:56.160756 0.046382 tcp 10.0.2.105 50672 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:13:56.207405 0.055467 tcp 10.0.2.105 50673 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:13:56.263178 0.145605 tcp 10.0.2.105 50674 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:13:56.490177 3.003536 tcp 10.0.2.105 50675 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:05.492362 0.000000 tcp 10.0.2.105 50675 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:11.491194 0.045807 tcp 10.0.2.105 50676 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:11.537263 0.055076 tcp 10.0.2.105 50677 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:11.592596 0.145729 tcp 10.0.2.105 50678 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:11.885548 3.000196 tcp 10.0.2.105 50679 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:20.884668 0.000000 tcp 10.0.2.105 50679 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:26.883999 0.045240 tcp 10.0.2.105 50680 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:26.929586 0.053653 tcp 10.0.2.105 50681 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:26.983576 0.141518 tcp 10.0.2.105 50682 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:27.184569 2.993115 tcp 10.0.2.105 50683 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:36.186650 0.000000 tcp 10.0.2.105 50683 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:14:42.185671 0.044382 tcp 10.0.2.105 50684 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:42.230365 0.054218 tcp 10.0.2.105 50685 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:42.284950 0.142437 tcp 10.0.2.105 50686 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:42.662037 0.358016 tcp 10.0.2.105 50687 -> 46.48.247.67 29365 SPA_* 0 0 9 1141 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:14:43.149500 3.001473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:14:50.156176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:14:58.157735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:15:05.725957 0.747860 tcp 10.0.2.105 50687 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:15:05.726831 0.044686 tcp 10.0.2.105 50688 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:15:05.771825 0.053402 tcp 10.0.2.105 50689 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:15:05.825082 0.146173 tcp 10.0.2.105 50690 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:15:06.474037 3.000245 tcp 10.0.2.105 50691 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:14.160771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:15:15.472898 0.000000 tcp 10.0.2.105 50691 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:21.471660 3.004070 tcp 10.0.2.105 50692 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:29.362927 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:15:30.474597 0.000000 tcp 10.0.2.105 50692 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:36.473306 2.994004 tcp 10.0.2.105 50693 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:45.475981 0.000000 tcp 10.0.2.105 50693 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:46.167179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:15:51.474771 2.994214 tcp 10.0.2.105 50694 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:15:56.371683 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:16:00.468090 0.000000 tcp 10.0.2.105 50694 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:16:06.476163 0.357937 tcp 10.0.2.105 50695 -> 46.48.247.67 29365 SPA_* 0 0 9 1141 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:16:36.829872 0.350319 tcp 10.0.2.105 50695 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:21:36.831723 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:21:36.831870 3.003783 tcp 10.0.2.105 50696 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:21:45.834321 0.000000 tcp 10.0.2.105 50696 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:21:50.174193 3.000523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:21:51.834337 0.100303 tcp 10.0.2.105 50697 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:21:51.934891 0.075943 tcp 10.0.2.105 50698 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:21:52.011146 0.158307 tcp 10.0.2.105 50699 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:21:52.615286 2.993370 tcp 10.0.2.105 50700 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:21:57.180591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:22:01.617040 0.000000 tcp 10.0.2.105 50700 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:05.182000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:22:07.616072 0.030557 tcp 10.0.2.105 50701 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:07.646959 0.076424 tcp 10.0.2.105 50702 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:07.723703 0.153103 tcp 10.0.2.105 50703 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:07.961136 2.998815 tcp 10.0.2.105 50704 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:16.958486 0.000000 tcp 10.0.2.105 50704 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:21.185196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:22:22.958148 0.030317 tcp 10.0.2.105 50705 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:22.988731 0.076126 tcp 10.0.2.105 50706 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:23.065122 0.154061 tcp 10.0.2.105 50707 -> 195.113.214.251 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:23.294059 2.998317 tcp 10.0.2.105 50708 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:32.291071 0.000000 tcp 10.0.2.105 50708 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:38.292030 0.053904 tcp 10.0.2.105 50709 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:38.346281 0.075716 tcp 10.0.2.105 50710 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:38.422302 0.153855 tcp 10.0.2.105 50711 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:38.859139 0.352265 tcp 10.0.2.105 50712 -> 46.48.247.67 29365 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:50.831674 0.424965 tcp 10.0.2.105 50712 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:50.832466 0.030259 tcp 10.0.2.105 50713 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:50.862645 0.076452 tcp 10.0.2.105 50714 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:50.939739 0.160632 tcp 10.0.2.105 50715 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:22:51.256844 2.995763 tcp 10.0.2.105 50716 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:22:53.191266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:23:00.251146 0.000000 tcp 10.0.2.105 50716 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:06.249885 3.004045 tcp 10.0.2.105 50717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:15.252881 0.000000 tcp 10.0.2.105 50717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:19.869365 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:23:21.251477 3.063363 tcp 10.0.2.105 50718 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:30.261669 0.000000 tcp 10.0.2.105 50718 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:36.262967 3.004162 tcp 10.0.2.105 50719 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:43.863940 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:23:45.275504 0.000000 tcp 10.0.2.105 50719 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:23:51.264707 0.350453 tcp 10.0.2.105 50720 -> 46.48.247.67 29365 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:24:07.916778 0.000347 tcp 10.0.2.105 50720 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:15.835157 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:28:15.835263 0.174259 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:16.002399 0.149789 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:16.138368 0.423093 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:16.527058 0.075553 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:16.877572 0.000000 udp 10.0.2.105 7010 -> 79.219.117.112 2430 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 20:28:33.452044 0.031127 tcp 10.0.2.105 50721 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:33.483455 0.077095 tcp 10.0.2.105 50722 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:33.560794 0.156832 tcp 10.0.2.105 50723 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:33.718303 0.174065 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:33.889547 0.064471 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:33.968409 0.236901 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:34.215655 0.082114 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:34.288395 0.209559 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:34.553444 0.439026 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:34.955717 0.174277 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:35.275764 0.087714 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:35.342878 0.181984 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:35.519442 0.168515 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:35.664242 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 20:28:53.770030 0.029641 tcp 10.0.2.105 50724 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:53.800013 0.076577 tcp 10.0.2.105 50725 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:53.876835 0.161860 tcp 10.0.2.105 50726 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:28:54.039208 0.073521 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:54.102487 0.281207 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:54.405213 0.170351 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:54.594016 0.127602 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:54.678122 0.092437 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:54.881298 0.397632 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:55.258575 0.176503 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:55.432120 0.172492 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:55.577764 0.086158 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:55.771642 0.237771 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:55.987852 0.038164 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:56.122407 0.067866 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:56.175801 0.179365 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:56.373321 0.071151 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:28:57.197608 3.001097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:29:04.204695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:29:07.909780 3.004409 tcp 10.0.2.105 50727 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:12.205809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:29:16.912889 0.000000 tcp 10.0.2.105 50727 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:21.869796 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:29:22.912537 0.030549 tcp 10.0.2.105 50728 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:22.943390 0.072731 tcp 10.0.2.105 50729 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:23.015991 0.154190 tcp 10.0.2.105 50730 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:23.594562 3.002258 tcp 10.0.2.105 50731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:28.208633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:29:32.595251 0.000000 tcp 10.0.2.105 50731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:38.594815 0.032126 tcp 10.0.2.105 50732 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:38.627284 0.071370 tcp 10.0.2.105 50733 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:38.699029 0.159108 tcp 10.0.2.105 50734 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:39.005177 2.993103 tcp 10.0.2.105 50735 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:47.997556 0.000000 tcp 10.0.2.105 50735 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:29:54.006917 0.030621 tcp 10.0.2.105 50736 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:54.037844 0.071931 tcp 10.0.2.105 50737 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:54.110107 0.177615 tcp 10.0.2.105 50738 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:29:54.383086 2.997862 tcp 10.0.2.105 50739 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:30:00.215878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:30:03.379523 0.000000 tcp 10.0.2.105 50739 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:30:09.379019 0.031077 tcp 10.0.2.105 50740 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:09.410388 0.075049 tcp 10.0.2.105 50741 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:09.485268 0.160651 tcp 10.0.2.105 50742 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:09.903363 0.358829 tcp 10.0.2.105 50743 -> 46.48.247.67 29365 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:35.970968 0.270101 tcp 10.0.2.105 50743 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:35.972048 0.030701 tcp 10.0.2.105 50744 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:36.003046 0.071026 tcp 10.0.2.105 50745 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:36.074396 0.155858 tcp 10.0.2.105 50746 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:30:36.241324 2.999838 tcp 10.0.2.105 50747 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:30:45.239282 0.000000 tcp 10.0.2.105 50747 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:30:51.237928 3.004943 tcp 10.0.2.105 50748 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:00.241164 0.000000 tcp 10.0.2.105 50748 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:04.868081 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:31:06.240066 3.004612 tcp 10.0.2.105 50749 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:15.242945 0.000000 tcp 10.0.2.105 50749 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:21.241721 3.003774 tcp 10.0.2.105 50750 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:28.872997 0.000316 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:31:30.244202 0.000000 tcp 10.0.2.105 50750 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:31:36.242924 0.352358 tcp 10.0.2.105 50751 -> 46.48.247.67 29365 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:32:00.512670 0.000313 tcp 10.0.2.105 50751 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:36:04.221072 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:36:11.228942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:36:19.230977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:36:35.232917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:37:00.509930 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:37:00.510099 3.003354 tcp 10.0.2.105 50752 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:07.239102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:37:09.512144 0.000000 tcp 10.0.2.105 50752 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:15.512428 0.031594 tcp 10.0.2.105 50753 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:15.544548 0.076804 tcp 10.0.2.105 50754 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:15.621670 0.156566 tcp 10.0.2.105 50755 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:16.039017 3.006779 tcp 10.0.2.105 50756 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:25.071066 0.000000 tcp 10.0.2.105 50756 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:31.033878 0.030199 tcp 10.0.2.105 50757 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:31.064349 0.071705 tcp 10.0.2.105 50758 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:31.136355 0.153779 tcp 10.0.2.105 50759 -> 195.113.214.251 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:31.325016 2.992853 tcp 10.0.2.105 50760 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:40.326494 0.000000 tcp 10.0.2.105 50760 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:46.325716 0.030139 tcp 10.0.2.105 50761 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:46.356158 0.076545 tcp 10.0.2.105 50762 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:46.432622 0.151306 tcp 10.0.2.105 50763 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:37:46.754258 2.995741 tcp 10.0.2.105 50764 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:37:55.748552 0.000000 tcp 10.0.2.105 50764 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:38:01.748194 0.030908 tcp 10.0.2.105 50765 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:01.779416 0.075427 tcp 10.0.2.105 50766 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:01.855218 0.157294 tcp 10.0.2.105 50767 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:02.132952 0.372950 tcp 10.0.2.105 50768 -> 46.48.247.67 29365 SPA_* 0 0 9 1162 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:24.990803 0.473825 tcp 10.0.2.105 50768 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:24.991791 0.030383 tcp 10.0.2.105 50769 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:25.022543 0.072325 tcp 10.0.2.105 50770 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:25.095172 0.157689 tcp 10.0.2.105 50771 -> 195.113.214.251 443 SRPA* 0 0 51 34744 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:38:25.464883 3.001000 tcp 10.0.2.105 50772 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:38:34.464371 0.000000 tcp 10.0.2.105 50772 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:38:40.463321 3.004103 tcp 10.0.2.105 50773 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:38:49.476081 0.000000 tcp 10.0.2.105 50773 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:38:54.362741 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:38:55.465018 2.993987 tcp 10.0.2.105 50774 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:39:04.457647 0.000000 tcp 10.0.2.105 50774 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:39:10.466180 2.994342 tcp 10.0.2.105 50775 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:39:18.367350 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:39:19.458723 0.000000 tcp 10.0.2.105 50775 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:39:25.467787 0.354497 tcp 10.0.2.105 50776 -> 46.48.247.67 29365 SPA_* 0 0 9 1162 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:39:47.040207 0.000342 tcp 10.0.2.105 50776 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:43:11.245384 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:43:18.252683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:43:26.253891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:43:42.256950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:44:14.262859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:44:47.041178 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:44:47.041420 3.003093 tcp 10.0.2.105 50777 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:44:56.043145 0.000000 tcp 10.0.2.105 50777 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:02.044043 0.031028 tcp 10.0.2.105 50778 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:02.075428 0.070974 tcp 10.0.2.105 50779 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:02.146691 0.158228 tcp 10.0.2.105 50780 -> 195.113.214.251 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:02.618475 3.008158 tcp 10.0.2.105 50781 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:11.625382 0.000000 tcp 10.0.2.105 50781 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:17.614582 0.085844 tcp 10.0.2.105 50782 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:17.700799 0.074081 tcp 10.0.2.105 50783 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:17.775200 0.150581 tcp 10.0.2.105 50784 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:18.099719 2.998898 tcp 10.0.2.105 50785 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:27.097723 0.000000 tcp 10.0.2.105 50785 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:33.097037 0.030968 tcp 10.0.2.105 50786 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:33.128271 0.074656 tcp 10.0.2.105 50787 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:33.203249 0.151276 tcp 10.0.2.105 50788 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:33.426746 2.994288 tcp 10.0.2.105 50789 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:42.419891 0.000000 tcp 10.0.2.105 50789 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:45:48.428919 0.032256 tcp 10.0.2.105 50790 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:48.461507 0.072249 tcp 10.0.2.105 50791 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:48.534108 0.151343 tcp 10.0.2.105 50792 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:48.847524 2.515347 tcp 10.0.2.105 50793 -> 46.48.247.67 29365 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:50.630752 0.029916 tcp 10.0.2.105 50794 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:50.660971 0.078332 tcp 10.0.2.105 50795 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:50.739606 0.151852 tcp 10.0.2.105 50796 -> 195.113.214.251 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:45:51.363119 3.003633 tcp 10.0.2.105 50797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:00.365491 0.000000 tcp 10.0.2.105 50797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:06.364189 2.994534 tcp 10.0.2.105 50798 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:15.367138 0.000000 tcp 10.0.2.105 50798 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:20.364113 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:46:21.365909 2.994221 tcp 10.0.2.105 50799 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:30.358630 0.000000 tcp 10.0.2.105 50799 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:36.367535 3.004213 tcp 10.0.2.105 50800 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:44.368959 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:46:45.369984 0.000000 tcp 10.0.2.105 50800 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:46:51.368992 0.352411 tcp 10.0.2.105 50801 -> 46.48.247.67 29365 SPA_* 0 0 9 1155 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:47:10.674329 0.000366 tcp 10.0.2.105 50801 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:10.668301 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:52:10.668404 3.004029 tcp 10.0.2.105 50802 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:19.671099 0.000000 tcp 10.0.2.105 50802 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:25.671469 0.080992 tcp 10.0.2.105 50803 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:25.752748 0.075293 tcp 10.0.2.105 50804 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:25.828499 0.146063 tcp 10.0.2.105 50805 -> 195.113.214.251 443 SRPA* 0 0 38 25196 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:26.183432 3.001261 tcp 10.0.2.105 50806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:35.182997 0.000000 tcp 10.0.2.105 50806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:41.182424 0.052934 tcp 10.0.2.105 50807 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:41.235658 0.076048 tcp 10.0.2.105 50808 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:41.312027 0.159627 tcp 10.0.2.105 50809 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:41.483718 3.002944 tcp 10.0.2.105 50810 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:50.485351 0.000000 tcp 10.0.2.105 50810 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:52:56.484640 0.030485 tcp 10.0.2.105 50811 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:56.514984 0.071376 tcp 10.0.2.105 50812 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:56.586725 0.155977 tcp 10.0.2.105 50813 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:52:56.762908 2.995771 tcp 10.0.2.105 50814 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:05.767063 0.000000 tcp 10.0.2.105 50814 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:11.756232 0.030424 tcp 10.0.2.105 50815 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:11.786937 0.075565 tcp 10.0.2.105 50816 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:11.862885 0.166921 tcp 10.0.2.105 50817 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:12.078601 0.369918 tcp 10.0.2.105 50818 -> 46.48.247.67 29365 SPA_* 0 0 9 1143 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:30.428390 0.375355 tcp 10.0.2.105 50818 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:30.429409 0.030335 tcp 10.0.2.105 50819 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:30.460000 0.071345 tcp 10.0.2.105 50820 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:30.531632 0.155848 tcp 10.0.2.105 50821 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:53:30.803935 3.003324 tcp 10.0.2.105 50822 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:39.815895 0.000000 tcp 10.0.2.105 50822 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:45.804917 2.993994 tcp 10.0.2.105 50823 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:54.797550 0.000000 tcp 10.0.2.105 50823 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:53:59.364138 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:54:00.806377 2.993944 tcp 10.0.2.105 50824 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:54:05.275905 3.001055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 20:54:09.798809 0.000000 tcp 10.0.2.105 50824 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:54:12.282749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:54:15.807925 3.004091 tcp 10.0.2.105 50825 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:54:20.284176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:54:23.368746 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:54:24.810616 0.000000 tcp 10.0.2.105 50825 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:54:30.809364 0.351062 tcp 10.0.2.105 50826 -> 46.48.247.67 29365 SPA_* 0 0 9 1143 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:54:36.287515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:54:48.895492 0.004565 tcp 10.0.2.105 50826 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:55:08.293329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 20:59:07.998401 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 20:59:07.998514 0.000000 udp 10.0.2.105 7010 -> 79.219.117.112 2430 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 20:59:23.051465 0.032455 tcp 10.0.2.105 50827 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:23.084207 0.075095 tcp 10.0.2.105 50828 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:23.159654 0.162635 tcp 10.0.2.105 50829 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:23.321155 0.229084 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:23.543016 0.152495 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:23.676645 0.173047 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:23.842688 0.078553 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:23.905698 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 20:59:40.845733 0.031480 tcp 10.0.2.105 50830 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:40.877578 0.070031 tcp 10.0.2.105 50831 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:40.947920 0.163697 tcp 10.0.2.105 50832 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 20:59:41.112168 0.063553 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.174389 0.188923 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.360408 0.116445 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.435215 0.081203 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.508596 0.100878 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.593609 0.207841 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.795466 0.175756 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:41.951541 0.170133 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.099741 0.171538 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.270182 0.087912 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.338229 0.075646 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.412923 0.173038 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.562426 0.127427 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.646417 0.085100 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:42.731782 0.276926 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.019096 0.400050 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.400205 0.175586 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.572541 0.174024 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.717061 0.085949 udp 10.0.2.105 7010 <-> 86.135.68.236 8649 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.784654 0.238953 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:43.999032 0.038465 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:44.070937 0.067521 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:44.124675 0.178456 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:44.299868 0.070808 udp 10.0.2.105 7010 <-> 109.150.246.251 1744 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/06 20:59:48.897251 3.003838 tcp 10.0.2.105 50833 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 20:59:57.899954 0.000000 tcp 10.0.2.105 50833 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:03.898732 0.030138 tcp 10.0.2.105 50834 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:03.929143 0.074135 tcp 10.0.2.105 50835 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:04.003578 0.158053 tcp 10.0.2.105 50836 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:04.184709 2.998232 tcp 10.0.2.105 50837 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:13.181756 0.000000 tcp 10.0.2.105 50837 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:19.180935 0.031054 tcp 10.0.2.105 50838 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:19.212296 0.074812 tcp 10.0.2.105 50839 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:19.287452 0.159296 tcp 10.0.2.105 50840 -> 195.113.214.251 443 SRPA* 0 0 19 7184 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:19.458682 3.006401 tcp 10.0.2.105 50841 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:28.463688 0.000000 tcp 10.0.2.105 50841 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:34.452849 0.053537 tcp 10.0.2.105 50842 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:34.506738 0.069750 tcp 10.0.2.105 50843 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:34.576858 0.155351 tcp 10.0.2.105 50844 -> 195.113.214.251 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:34.745219 3.001623 tcp 10.0.2.105 50845 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:43.745443 0.000000 tcp 10.0.2.105 50845 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:00:49.745368 0.030959 tcp 10.0.2.105 50846 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:49.776614 0.072053 tcp 10.0.2.105 50847 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:49.848955 0.162341 tcp 10.0.2.105 50848 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:00:50.022332 0.355209 tcp 10.0.2.105 50849 -> 46.48.247.67 29365 SPA_* 0 0 9 1085 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:01:06.467595 0.267640 tcp 10.0.2.105 50849 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:01:06.468547 0.030307 tcp 10.0.2.105 50850 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:01:06.499151 0.066530 tcp 10.0.2.105 50851 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:01:06.566003 0.157924 tcp 10.0.2.105 50852 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:01:06.735480 2.997456 tcp 10.0.2.105 50853 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:12.299203 3.001919 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:01:15.731431 0.000000 tcp 10.0.2.105 50853 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:19.306851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:01:21.730205 3.004540 tcp 10.0.2.105 50854 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:27.308000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:01:30.732995 0.000000 tcp 10.0.2.105 50854 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:35.369599 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:01:36.732081 3.003994 tcp 10.0.2.105 50855 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:43.311206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:01:45.734722 0.000000 tcp 10.0.2.105 50855 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:51.733400 2.994341 tcp 10.0.2.105 50856 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:01:59.364172 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:02:00.736189 0.000000 tcp 10.0.2.105 50856 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:02:06.735267 0.371002 tcp 10.0.2.105 50857 -> 46.48.247.67 29365 SPA_* 0 0 9 1085 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:02:15.317205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:02:22.663417 0.000381 tcp 10.0.2.105 50857 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:22.659758 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:07:22.659855 3.003645 tcp 10.0.2.105 50858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:07:31.662027 0.000000 tcp 10.0.2.105 50858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:07:37.662836 0.032507 tcp 10.0.2.105 50859 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:37.695604 0.076079 tcp 10.0.2.105 50860 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:37.771949 0.160922 tcp 10.0.2.105 50861 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:37.991690 3.003813 tcp 10.0.2.105 50862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:07:46.994054 0.000000 tcp 10.0.2.105 50862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:07:52.993320 0.031150 tcp 10.0.2.105 50863 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:53.024811 0.075185 tcp 10.0.2.105 50864 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:53.100333 0.156638 tcp 10.0.2.105 50865 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:07:53.552204 2.995689 tcp 10.0.2.105 50866 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:02.556765 0.000000 tcp 10.0.2.105 50866 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:08.545399 0.030303 tcp 10.0.2.105 50867 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:08.575999 0.070798 tcp 10.0.2.105 50868 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:08.647145 0.156055 tcp 10.0.2.105 50869 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:08.971018 2.999039 tcp 10.0.2.105 50870 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:17.968883 0.000000 tcp 10.0.2.105 50870 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:19.323670 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:08:23.967314 0.055829 tcp 10.0.2.105 50871 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:24.023391 0.078436 tcp 10.0.2.105 50872 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:24.101699 0.159879 tcp 10.0.2.105 50873 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:24.287981 0.355523 tcp 10.0.2.105 50874 -> 46.48.247.67 29365 SPA_* 0 0 9 1183 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:26.330194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:08:34.332165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:08:39.396713 0.441286 tcp 10.0.2.105 50874 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:39.397649 0.030908 tcp 10.0.2.105 50875 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:39.428864 0.075164 tcp 10.0.2.105 50876 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:39.504340 0.153875 tcp 10.0.2.105 50877 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:08:39.838168 3.005999 tcp 10.0.2.105 50878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:48.843048 0.000000 tcp 10.0.2.105 50878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:08:50.337080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:08:54.831925 3.004353 tcp 10.0.2.105 50879 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:03.834733 0.000000 tcp 10.0.2.105 50879 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:08.370898 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:09:09.833108 2.994188 tcp 10.0.2.105 50880 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:18.835976 0.000000 tcp 10.0.2.105 50880 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:22.340755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:09:24.834941 2.994255 tcp 10.0.2.105 50881 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:32.365573 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:09:33.837541 0.000000 tcp 10.0.2.105 50881 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:09:39.836734 0.351617 tcp 10.0.2.105 50882 -> 46.48.247.67 29365 SPA_* 0 0 9 1183 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:10:02.958785 0.000367 tcp 10.0.2.105 50882 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:02.951149 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:15:02.951250 3.003867 tcp 10.0.2.105 50883 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:11.953865 0.000000 tcp 10.0.2.105 50883 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:17.954458 0.031206 tcp 10.0.2.105 50884 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:17.985923 0.070863 tcp 10.0.2.105 50885 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:18.057106 0.160439 tcp 10.0.2.105 50886 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:18.891769 2.996288 tcp 10.0.2.105 50887 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:26.347516 3.001370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:15:27.896735 0.000000 tcp 10.0.2.105 50887 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:33.354353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:15:33.886348 0.031000 tcp 10.0.2.105 50888 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:33.917627 0.075542 tcp 10.0.2.105 50889 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:33.993507 0.159697 tcp 10.0.2.105 50890 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:34.354986 2.995075 tcp 10.0.2.105 50891 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:41.357625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:15:43.349017 0.000000 tcp 10.0.2.105 50891 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:49.348383 0.030229 tcp 10.0.2.105 50892 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:49.379005 0.071981 tcp 10.0.2.105 50893 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:49.451319 0.161273 tcp 10.0.2.105 50894 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:15:49.850512 3.002219 tcp 10.0.2.105 50895 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:15:57.359160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:15:58.852091 0.000000 tcp 10.0.2.105 50895 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:04.850426 0.031906 tcp 10.0.2.105 50896 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:04.882186 0.077074 tcp 10.0.2.105 50897 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:04.959592 0.161938 tcp 10.0.2.105 50898 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:05.222329 3.054154 tcp 10.0.2.105 50899 -> 46.48.247.67 29365 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:07.883107 0.030022 tcp 10.0.2.105 50900 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:07.913526 0.076751 tcp 10.0.2.105 50901 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:07.990116 0.158519 tcp 10.0.2.105 50902 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:16:08.276746 2.992310 tcp 10.0.2.105 50903 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:17.267709 0.000000 tcp 10.0.2.105 50903 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:23.277278 2.992803 tcp 10.0.2.105 50904 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:29.365308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:16:32.269213 0.000000 tcp 10.0.2.105 50904 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:36.865796 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:16:38.277768 3.004502 tcp 10.0.2.105 50905 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:47.280504 0.000000 tcp 10.0.2.105 50905 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:16:53.279584 3.004356 tcp 10.0.2.105 50906 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:17:00.870046 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:17:02.282733 0.000000 tcp 10.0.2.105 50906 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:17:08.281359 0.361589 tcp 10.0.2.105 50907 -> 46.48.247.67 29365 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:17:28.994755 0.000346 tcp 10.0.2.105 50907 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:28.992812 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:22:28.993043 3.003763 tcp 10.0.2.105 50908 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:22:33.370737 3.002788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:22:37.995076 0.000000 tcp 10.0.2.105 50908 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:22:40.378618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:22:43.995499 0.031542 tcp 10.0.2.105 50909 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:44.027336 0.072943 tcp 10.0.2.105 50910 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:44.100594 0.155629 tcp 10.0.2.105 50911 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:44.594866 2.994229 tcp 10.0.2.105 50912 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:22:48.379970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:22:53.587479 0.000000 tcp 10.0.2.105 50912 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:22:59.598184 0.030986 tcp 10.0.2.105 50913 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:59.629487 0.071982 tcp 10.0.2.105 50914 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:22:59.701779 0.165782 tcp 10.0.2.105 50915 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:00.086058 2.995060 tcp 10.0.2.105 50916 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:23:04.383370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:23:09.079832 0.000000 tcp 10.0.2.105 50916 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:23:15.079235 0.034188 tcp 10.0.2.105 50917 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:15.113251 0.073714 tcp 10.0.2.105 50918 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:15.187277 0.157192 tcp 10.0.2.105 50919 -> 195.113.214.251 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:15.594326 2.999334 tcp 10.0.2.105 50920 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:23:24.592621 0.000000 tcp 10.0.2.105 50920 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:23:30.591163 0.030079 tcp 10.0.2.105 50921 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:30.621521 0.076825 tcp 10.0.2.105 50922 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:30.698699 0.276024 tcp 10.0.2.105 50923 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:31.278148 0.359368 tcp 10.0.2.105 50924 -> 46.48.247.67 29365 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:36.389159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:23:51.226816 0.637392 tcp 10.0.2.105 50924 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:51.227828 0.031251 tcp 10.0.2.105 50925 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:51.259380 0.073580 tcp 10.0.2.105 50926 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:51.333303 0.157113 tcp 10.0.2.105 50927 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:23:51.864440 3.001147 tcp 10.0.2.105 50928 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:00.864448 0.000000 tcp 10.0.2.105 50928 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:06.863190 3.004015 tcp 10.0.2.105 50929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:14.864637 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:24:15.875783 0.000000 tcp 10.0.2.105 50929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:21.864723 2.993900 tcp 10.0.2.105 50930 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:30.857527 0.000000 tcp 10.0.2.105 50930 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:36.866201 2.993993 tcp 10.0.2.105 50931 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:41.865493 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:24:45.858971 0.000000 tcp 10.0.2.105 50931 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:24:51.867842 0.360133 tcp 10.0.2.105 50932 -> 46.48.247.67 29365 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:25:10.439006 0.000372 tcp 10.0.2.105 50932 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:29:40.395501 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:29:47.402605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:29:55.404058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:30:11.407451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:30:12.178010 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:30:12.178271 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 21:30:30.165844 0.031333 tcp 10.0.2.105 50933 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:30.197465 0.072514 tcp 10.0.2.105 50934 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:30.269877 0.157728 tcp 10.0.2.105 50935 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:30.428244 0.223148 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:30.643462 0.154507 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:30.778562 0.174152 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:31.172867 0.074483 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:31.330924 0.062065 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:31.391751 0.173324 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:31.712187 0.110202 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:31.784394 0.108717 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:32.010554 0.103580 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:32.098894 0.195085 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:32.480940 0.180564 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:32.639428 0.169324 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:33.163118 0.173601 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:33.394914 0.093410 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:33.465576 0.075408 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:33.677229 0.172551 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:33.912717 0.138717 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:34.009083 0.088787 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:34.248461 0.291623 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:34.696076 0.399745 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:35.074100 0.175499 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2582 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:35.366430 0.177303 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:35.517887 0.000000 udp 10.0.2.105 7010 -> 86.135.68.236 8649 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 21:30:40.439324 3.003912 tcp 10.0.2.105 50936 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:30:43.413095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:30:49.441933 0.000000 tcp 10.0.2.105 50936 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:30:54.048962 0.072736 tcp 10.0.2.105 50937 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:54.122020 0.083383 tcp 10.0.2.105 50938 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:54.205692 0.150680 tcp 10.0.2.105 50939 -> 195.113.214.251 443 SRPA* 0 0 37 22468 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:54.356628 0.237295 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:54.570115 0.040891 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:54.850840 0.068510 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:54.906247 0.178765 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/06 21:30:55.080544 0.000000 udp 10.0.2.105 7010 -> 109.150.246.251 1744 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 21:30:55.440968 0.030744 tcp 10.0.2.105 50940 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:55.472011 0.074776 tcp 10.0.2.105 50941 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:55.547156 0.182321 tcp 10.0.2.105 50942 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:30:55.861569 3.003973 tcp 10.0.2.105 50943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:04.864006 0.000000 tcp 10.0.2.105 50943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:10.863211 0.030663 tcp 10.0.2.105 50944 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:10.893740 0.071973 tcp 10.0.2.105 50945 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:10.966012 0.160724 tcp 10.0.2.105 50946 -> 195.113.214.251 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:11.254670 2.992772 tcp 10.0.2.105 50947 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:12.515199 0.033500 tcp 10.0.2.105 50948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:12.546770 0.078920 tcp 10.0.2.105 50949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:12.626003 0.163206 tcp 10.0.2.105 50950 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:20.255869 0.000000 tcp 10.0.2.105 50947 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:26.255250 0.031329 tcp 10.0.2.105 50951 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:26.286865 0.076276 tcp 10.0.2.105 50952 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:26.363440 0.162170 tcp 10.0.2.105 50953 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:31:26.594846 2.984384 tcp 10.0.2.105 50954 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:35.577928 0.000000 tcp 10.0.2.105 50954 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:41.587071 2.993885 tcp 10.0.2.105 50955 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:50.579834 0.000000 tcp 10.0.2.105 50955 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:31:55.366497 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:31:56.588396 3.004445 tcp 10.0.2.105 50956 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:32:05.591300 0.000000 tcp 10.0.2.105 50956 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:36:47.419481 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:36:54.426687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:37:02.428092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:37:11.591894 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:37:11.591990 3.003547 tcp 10.0.2.105 50957 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:18.430769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:37:20.594073 0.000000 tcp 10.0.2.105 50957 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:26.594680 0.046101 tcp 10.0.2.105 50958 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:26.641090 0.076977 tcp 10.0.2.105 50959 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:26.718372 0.158111 tcp 10.0.2.105 50960 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:26.908803 2.998696 tcp 10.0.2.105 50961 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:35.916172 0.000000 tcp 10.0.2.105 50961 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:41.905533 0.033398 tcp 10.0.2.105 50962 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:41.939302 0.076112 tcp 10.0.2.105 50963 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:42.015769 0.157062 tcp 10.0.2.105 50964 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:42.214564 2.994994 tcp 10.0.2.105 50965 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:50.437524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:37:51.207786 0.000000 tcp 10.0.2.105 50965 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:37:57.206789 0.031595 tcp 10.0.2.105 50966 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:57.238652 0.075372 tcp 10.0.2.105 50967 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:57.314318 0.162197 tcp 10.0.2.105 50968 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:37:57.531642 2.999825 tcp 10.0.2.105 50969 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:06.530119 0.000000 tcp 10.0.2.105 50969 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:12.529508 0.032296 tcp 10.0.2.105 50970 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:12.562097 0.074961 tcp 10.0.2.105 50971 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:12.637436 0.155301 tcp 10.0.2.105 50972 -> 195.113.214.251 443 SRPA* 0 0 28 11890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:12.821392 0.354808 tcp 10.0.2.105 50973 -> 46.48.247.67 29365 SPA_* 0 0 9 1129 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:30.498161 0.301194 tcp 10.0.2.105 50973 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:30.499238 0.030640 tcp 10.0.2.105 50974 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:30.530123 0.075966 tcp 10.0.2.105 50975 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:30.606391 0.158659 tcp 10.0.2.105 50976 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:38:30.799608 2.999468 tcp 10.0.2.105 50977 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:39.797921 0.000000 tcp 10.0.2.105 50977 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:45.796796 2.994196 tcp 10.0.2.105 50978 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:54.789285 0.000000 tcp 10.0.2.105 50978 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:38:59.365915 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:39:00.798057 3.004701 tcp 10.0.2.105 50979 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:39:09.800981 0.000000 tcp 10.0.2.105 50979 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:39:15.799846 3.004055 tcp 10.0.2.105 50980 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:39:23.370233 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:39:24.802644 0.000000 tcp 10.0.2.105 50980 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:39:30.801435 0.352742 tcp 10.0.2.105 50981 -> 46.48.247.67 29365 SPA_* 0 0 9 1129 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:39:47.608749 0.000364 tcp 10.0.2.105 50981 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:43:54.442805 3.002225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:44:01.450672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:44:09.451833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:44:25.454972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:44:47.607750 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:44:47.607860 3.003294 tcp 10.0.2.105 50982 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:44:56.609750 0.000000 tcp 10.0.2.105 50982 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:44:57.461274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:45:02.610157 0.053374 tcp 10.0.2.105 50983 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:02.663819 0.076787 tcp 10.0.2.105 50984 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:02.740929 0.159038 tcp 10.0.2.105 50985 -> 195.113.214.251 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:03.103945 2.999575 tcp 10.0.2.105 50986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:12.101967 0.000000 tcp 10.0.2.105 50986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:18.101535 0.052377 tcp 10.0.2.105 50987 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:18.153819 0.075979 tcp 10.0.2.105 50988 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:18.229635 0.165175 tcp 10.0.2.105 50989 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:18.454116 3.001430 tcp 10.0.2.105 50990 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:27.453961 0.000000 tcp 10.0.2.105 50990 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:33.453445 0.030988 tcp 10.0.2.105 50991 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:33.484743 0.070374 tcp 10.0.2.105 50992 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:33.555448 0.165446 tcp 10.0.2.105 50993 -> 195.113.214.251 443 SRPA* 0 0 25 13248 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:34.019528 2.998176 tcp 10.0.2.105 50994 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:43.026558 0.000000 tcp 10.0.2.105 50994 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:45:49.015593 0.031324 tcp 10.0.2.105 50995 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:49.047249 0.067696 tcp 10.0.2.105 50996 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:49.114855 0.152902 tcp 10.0.2.105 50997 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:45:49.290434 0.352619 tcp 10.0.2.105 50998 -> 46.48.247.67 29365 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:46:05.477105 0.278128 tcp 10.0.2.105 50998 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:46:05.478332 0.031124 tcp 10.0.2.105 50999 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:46:05.509959 0.069484 tcp 10.0.2.105 51000 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:46:05.579798 0.153616 tcp 10.0.2.105 51001 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:46:05.755557 2.997707 tcp 10.0.2.105 51002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:14.752138 0.000000 tcp 10.0.2.105 51002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:20.751094 3.004014 tcp 10.0.2.105 51003 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:29.753383 0.000000 tcp 10.0.2.105 51003 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:34.370225 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:46:35.752563 3.003510 tcp 10.0.2.105 51004 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:44.755134 0.000000 tcp 10.0.2.105 51004 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:50.754041 2.994406 tcp 10.0.2.105 51005 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:46:58.364858 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:46:59.756756 0.000000 tcp 10.0.2.105 51005 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:47:05.755795 0.350107 tcp 10.0.2.105 51006 -> 46.48.247.67 29365 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:47:21.044635 0.000346 tcp 10.0.2.105 51006 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:21.039236 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:52:21.039444 3.003411 tcp 10.0.2.105 51007 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:52:30.041867 0.000000 tcp 10.0.2.105 51007 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:52:36.043361 0.055997 tcp 10.0.2.105 51008 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:36.099645 0.075410 tcp 10.0.2.105 51009 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:36.175374 0.164128 tcp 10.0.2.105 51010 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:36.361070 3.004405 tcp 10.0.2.105 51011 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:52:45.363671 0.000000 tcp 10.0.2.105 51011 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:52:51.363236 0.030969 tcp 10.0.2.105 51012 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:51.394479 0.074973 tcp 10.0.2.105 51013 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:51.469776 0.159765 tcp 10.0.2.105 51014 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:52:51.650570 3.006499 tcp 10.0.2.105 51015 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:00.665707 0.000000 tcp 10.0.2.105 51015 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:06.644668 0.030184 tcp 10.0.2.105 51016 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:06.675237 0.070979 tcp 10.0.2.105 51017 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:06.746494 0.156017 tcp 10.0.2.105 51018 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:06.913119 2.995819 tcp 10.0.2.105 51019 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:15.907813 0.000000 tcp 10.0.2.105 51019 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:21.907075 0.052890 tcp 10.0.2.105 51020 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:21.960259 0.075323 tcp 10.0.2.105 51021 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:22.036640 0.156769 tcp 10.0.2.105 51022 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:22.215828 2.085960 tcp 10.0.2.105 51023 -> 46.48.247.67 29365 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:24.020108 0.030990 tcp 10.0.2.105 51024 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:24.051361 0.070900 tcp 10.0.2.105 51025 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:24.122592 0.168147 tcp 10.0.2.105 51026 -> 195.113.214.251 443 SRPA* 0 0 44 28266 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:53:24.301991 3.002000 tcp 10.0.2.105 51027 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:33.302734 0.000000 tcp 10.0.2.105 51027 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:39.301378 3.004413 tcp 10.0.2.105 51028 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:48.304181 0.000000 tcp 10.0.2.105 51028 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:53:52.870472 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:53:54.303041 3.004307 tcp 10.0.2.105 51029 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:54:03.315497 0.000000 tcp 10.0.2.105 51029 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:54:09.304904 2.993976 tcp 10.0.2.105 51030 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:54:16.865477 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:54:18.297480 0.000000 tcp 10.0.2.105 51030 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:54:24.306381 0.353126 tcp 10.0.2.105 51031 -> 46.48.247.67 29365 SPA_* 0 0 9 1058 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:54:27.473403 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 21:54:34.480922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:54:38.921230 0.004639 tcp 10.0.2.105 51031 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:54:42.482050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:54:58.484866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:55:30.491091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 21:59:38.918566 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 21:59:38.918664 3.003994 tcp 10.0.2.105 51032 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:59:47.921442 0.000000 tcp 10.0.2.105 51032 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 21:59:53.922338 0.053048 tcp 10.0.2.105 51033 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:59:53.975765 0.077187 tcp 10.0.2.105 51034 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:59:54.053250 0.155780 tcp 10.0.2.105 51035 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 21:59:54.220062 0.360847 tcp 10.0.2.105 51036 -> 46.48.247.67 29365 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:08.222663 0.279039 tcp 10.0.2.105 51036 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:08.223412 0.030852 tcp 10.0.2.105 51037 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:08.254627 0.071976 tcp 10.0.2.105 51038 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:08.326972 0.164372 tcp 10.0.2.105 51039 -> 195.113.214.251 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:08.501932 3.003435 tcp 10.0.2.105 51040 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:00:17.504044 0.000000 tcp 10.0.2.105 51040 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:00:23.502831 0.367459 tcp 10.0.2.105 51041 -> 46.48.247.67 29365 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:00:37.658192 0.000364 tcp 10.0.2.105 51041 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:20.214355 0.000000 udp 10.0.2.105 7010 -> 109.150.246.251 1744 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 22:01:24.870542 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:01:34.497678 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:01:36.828629 0.053061 tcp 10.0.2.105 51042 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:36.882044 0.075168 tcp 10.0.2.105 51043 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:36.957140 0.168997 tcp 10.0.2.105 51044 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:37.126704 0.000000 udp 10.0.2.105 7010 -> 86.135.68.236 8649 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 22:01:41.504879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:01:49.506303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:01:54.964658 0.035122 tcp 10.0.2.105 51045 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:55.000061 0.076368 tcp 10.0.2.105 51046 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:55.076794 0.162517 tcp 10.0.2.105 51047 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:01:55.240034 0.145740 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:55.371997 0.225665 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:55.590702 0.173035 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:55.756634 0.172850 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:55.926574 0.119168 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.006823 0.080464 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.077893 0.110455 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.172333 0.062660 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.233723 0.076118 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.293175 0.204604 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.520560 0.175646 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.675833 0.170087 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:56.821380 0.175353 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.082457 0.124359 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.167419 0.085034 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.285345 0.172992 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.482197 0.077660 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.576856 0.280643 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.867143 0.081602 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:57.912563 0.399535 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:58.290949 0.176443 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:58.464684 0.177079 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:58.613843 0.178738 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:58.789401 0.238710 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:59.004298 0.038950 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:01:59.068719 0.068552 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:02:05.508998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:02:37.516716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:05:37.654355 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:05:37.654520 2.993956 tcp 10.0.2.105 51048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:05:46.656946 0.000000 tcp 10.0.2.105 51048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:05:52.657916 0.108796 tcp 10.0.2.105 51049 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:05:52.767027 0.072747 tcp 10.0.2.105 51050 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:05:52.840076 0.168716 tcp 10.0.2.105 51051 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:05:53.020165 3.000409 tcp 10.0.2.105 51052 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:02.019169 0.000000 tcp 10.0.2.105 51052 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:08.018800 0.053115 tcp 10.0.2.105 51053 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:08.072231 0.070490 tcp 10.0.2.105 51054 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:08.143028 0.240302 tcp 10.0.2.105 51055 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:08.832618 3.000640 tcp 10.0.2.105 51056 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:17.831854 0.000000 tcp 10.0.2.105 51056 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:23.831251 0.624536 tcp 10.0.2.105 51057 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:24.456078 0.075827 tcp 10.0.2.105 51058 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:24.532347 0.164143 tcp 10.0.2.105 51059 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:24.744290 2.973198 tcp 10.0.2.105 51060 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:33.642365 0.000000 tcp 10.0.2.105 51060 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:06:39.566111 0.030087 tcp 10.0.2.105 51061 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:39.596541 0.125132 tcp 10.0.2.105 51062 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:39.721496 0.159183 tcp 10.0.2.105 51063 -> 195.113.214.251 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:39.957680 0.355854 tcp 10.0.2.105 51064 -> 46.48.247.67 29365 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:59.516430 0.342309 tcp 10.0.2.105 51064 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:59.517295 0.051338 tcp 10.0.2.105 51065 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:59.568914 0.070548 tcp 10.0.2.105 51066 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:59.639836 0.153818 tcp 10.0.2.105 51067 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:06:59.859056 2.969555 tcp 10.0.2.105 51068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:08.749497 0.000000 tcp 10.0.2.105 51068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:14.723864 2.994209 tcp 10.0.2.105 51069 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:23.727002 0.000000 tcp 10.0.2.105 51069 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:28.363351 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:07:29.725631 2.994833 tcp 10.0.2.105 51070 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:38.718836 0.000000 tcp 10.0.2.105 51070 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:44.727571 3.003496 tcp 10.0.2.105 51071 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:52.367743 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:07:53.729854 0.000000 tcp 10.0.2.105 51071 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:07:59.729342 0.353169 tcp 10.0.2.105 51072 -> 46.48.247.67 29365 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:08:17.979101 0.000329 tcp 10.0.2.105 51072 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:08:41.521599 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:08:48.529014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:08:56.529933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:09:12.533147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:09:44.539091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:13:17.976446 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:13:17.976554 2.993763 tcp 10.0.2.105 51073 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:13:26.970944 0.000000 tcp 10.0.2.105 51073 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:13:32.979771 0.035037 tcp 10.0.2.105 51074 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:33.015048 0.076364 tcp 10.0.2.105 51075 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:33.091727 0.154366 tcp 10.0.2.105 51076 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:33.257303 3.005189 tcp 10.0.2.105 51077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:13:42.260942 0.000000 tcp 10.0.2.105 51077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:13:48.250406 0.031443 tcp 10.0.2.105 51078 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:48.282150 0.074713 tcp 10.0.2.105 51079 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:48.357188 0.153400 tcp 10.0.2.105 51080 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:13:48.902083 3.002838 tcp 10.0.2.105 51081 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:13:57.903353 0.000000 tcp 10.0.2.105 51081 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:14:03.902664 0.053808 tcp 10.0.2.105 51082 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:03.956741 0.072034 tcp 10.0.2.105 51083 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:04.029093 0.157745 tcp 10.0.2.105 51084 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:04.594016 3.003294 tcp 10.0.2.105 51085 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:14:13.605756 0.000000 tcp 10.0.2.105 51085 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:14:19.595126 0.112191 tcp 10.0.2.105 51086 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:19.707636 0.078024 tcp 10.0.2.105 51087 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:19.785494 0.183149 tcp 10.0.2.105 51088 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:20.616332 0.355372 tcp 10.0.2.105 51089 -> 46.48.247.67 29365 SPA_* 0 0 9 1059 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:38.023045 0.455619 tcp 10.0.2.105 51089 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:38.024065 0.031258 tcp 10.0.2.105 51090 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:38.055679 0.071374 tcp 10.0.2.105 51091 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:38.127361 0.160216 tcp 10.0.2.105 51092 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:14:38.478960 3.007245 tcp 10.0.2.105 51093 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:14:47.484683 0.000000 tcp 10.0.2.105 51093 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:14:53.473568 2.995646 tcp 10.0.2.105 51094 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:02.476122 0.000000 tcp 10.0.2.105 51094 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:07.364054 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:15:08.475214 2.994017 tcp 10.0.2.105 51095 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:17.467672 0.000000 tcp 10.0.2.105 51095 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:23.476619 2.993633 tcp 10.0.2.105 51096 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:31.367960 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:15:32.469211 0.000000 tcp 10.0.2.105 51096 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:15:38.478212 0.361800 tcp 10.0.2.105 51097 -> 46.48.247.67 29365 SPA_* 0 0 9 1059 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:15:48.545183 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:15:55.552529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:15:55.718762 0.003501 tcp 10.0.2.105 51097 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:16:03.624883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:16:19.567069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:16:51.572827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:20:55.594269 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:20:55.594558 2.993839 tcp 10.0.2.105 51098 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:04.596975 0.000000 tcp 10.0.2.105 51098 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:10.597532 0.032100 tcp 10.0.2.105 51099 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:10.629538 0.070783 tcp 10.0.2.105 51100 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:10.700663 0.166805 tcp 10.0.2.105 51101 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:11.029446 3.001023 tcp 10.0.2.105 51102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:20.028820 0.000000 tcp 10.0.2.105 51102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:26.028399 0.031200 tcp 10.0.2.105 51103 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:26.059936 0.073555 tcp 10.0.2.105 51104 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:26.133771 0.163982 tcp 10.0.2.105 51105 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:26.643168 2.999887 tcp 10.0.2.105 51106 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:35.641445 0.000000 tcp 10.0.2.105 51106 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:41.640946 0.053023 tcp 10.0.2.105 51107 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:41.693826 0.070967 tcp 10.0.2.105 51108 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:41.765101 0.168688 tcp 10.0.2.105 51109 -> 195.113.214.251 443 SRPA* 0 0 38 20456 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:42.130504 3.004694 tcp 10.0.2.105 51110 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:51.133232 0.000000 tcp 10.0.2.105 51110 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:21:57.123327 0.034067 tcp 10.0.2.105 51111 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:57.157698 0.073673 tcp 10.0.2.105 51112 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:57.231664 0.156837 tcp 10.0.2.105 51113 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:21:57.451618 0.361153 tcp 10.0.2.105 51114 -> 46.48.247.67 29365 SPA_* 0 0 9 1078 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:22:13.169730 0.351137 tcp 10.0.2.105 51114 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:22:13.170635 0.032948 tcp 10.0.2.105 51115 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:22:13.203847 0.071425 tcp 10.0.2.105 51116 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:22:13.275663 0.159654 tcp 10.0.2.105 51117 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:22:13.521070 3.001669 tcp 10.0.2.105 51118 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:22.518790 0.000000 tcp 10.0.2.105 51118 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:28.517819 3.004149 tcp 10.0.2.105 51119 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:37.520648 0.000000 tcp 10.0.2.105 51119 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:42.367485 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:22:43.519235 3.178686 tcp 10.0.2.105 51120 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:52.639105 0.000000 tcp 10.0.2.105 51120 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:22:55.670935 2.968296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:22:58.589701 2.980359 tcp 10.0.2.105 51121 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:23:02.612129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:23:06.362125 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:23:07.533822 0.000000 tcp 10.0.2.105 51121 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:23:10.588154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:23:13.533020 2.765814 tcp 10.0.2.105 51122 -> 46.48.247.67 29365 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:23:26.591057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:23:58.597171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:28:16.288091 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:28:16.288182 3.003752 tcp 10.0.2.105 51123 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:28:25.290610 0.000000 tcp 10.0.2.105 51123 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:28:31.291141 0.054390 tcp 10.0.2.105 51124 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:31.345798 0.075343 tcp 10.0.2.105 51125 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:31.421469 0.155096 tcp 10.0.2.105 51126 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:31.706000 2.997916 tcp 10.0.2.105 51127 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:28:40.702693 0.000000 tcp 10.0.2.105 51127 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:28:46.701813 0.031330 tcp 10.0.2.105 51128 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:46.733472 0.070546 tcp 10.0.2.105 51129 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:46.804485 0.163851 tcp 10.0.2.105 51130 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:28:47.171721 3.004769 tcp 10.0.2.105 51131 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:28:56.184991 0.000000 tcp 10.0.2.105 51131 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:02.164084 0.032265 tcp 10.0.2.105 51132 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:02.196727 0.075027 tcp 10.0.2.105 51133 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:02.272145 0.164873 tcp 10.0.2.105 51134 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:02.574346 2.993858 tcp 10.0.2.105 51135 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:11.576870 0.000000 tcp 10.0.2.105 51135 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:17.576308 0.053726 tcp 10.0.2.105 51136 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:17.630327 0.071099 tcp 10.0.2.105 51137 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:17.701320 0.154587 tcp 10.0.2.105 51138 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:18.103360 0.359051 tcp 10.0.2.105 51139 -> 46.48.247.67 29365 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:33.206509 0.497816 tcp 10.0.2.105 51139 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:33.207409 0.052651 tcp 10.0.2.105 51140 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:33.260400 0.077028 tcp 10.0.2.105 51141 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:33.337720 0.164010 tcp 10.0.2.105 51142 -> 195.113.214.251 443 SRPA* 0 0 27 11834 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:29:33.704577 2.998674 tcp 10.0.2.105 51143 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:42.701977 0.000000 tcp 10.0.2.105 51143 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:48.701009 3.003558 tcp 10.0.2.105 51144 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:29:57.703228 0.000000 tcp 10.0.2.105 51144 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:30:02.369793 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:30:02.603038 3.880218 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:30:03.702131 3.870160 tcp 10.0.2.105 51145 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:30:10.440910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:30:13.497905 0.000000 tcp 10.0.2.105 51145 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:30:18.339068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:30:19.430057 2.958472 tcp 10.0.2.105 51146 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:30:26.991674 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:30:28.328506 0.000000 tcp 10.0.2.105 51146 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:30:34.160679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:30:34.260055 0.438727 tcp 10.0.2.105 51147 -> 46.48.247.67 29365 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:30:48.723921 0.004357 tcp 10.0.2.105 51147 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:31:05.841204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:32:19.768048 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:32:19.768157 0.149303 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:19.903790 0.229940 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:20.534584 0.172465 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:20.698637 0.175801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:20.871001 0.115588 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.045198 0.079884 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2030 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.116854 0.091194 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.193348 0.061991 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.254198 0.072391 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.310908 0.204814 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.556945 0.176553 udp 10.0.2.105 7010 <-> 96.237.22.160 9584 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.713103 0.170105 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:21.860080 0.172277 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:22.016928 0.127781 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:22.106716 0.090056 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:22.176466 0.176060 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:22.381803 0.080177 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:22.460855 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 22:32:39.558289 0.033643 tcp 10.0.2.105 51148 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:32:39.592203 0.074336 tcp 10.0.2.105 51149 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:32:39.666889 0.160343 tcp 10.0.2.105 51150 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:32:39.827566 0.087106 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:39.877255 0.419464 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.276498 0.177554 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.449270 0.238219 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.662556 0.038108 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.706444 0.069434 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.762427 0.176628 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:32:40.935683 0.177614 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/06 22:35:48.297937 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:35:48.298049 3.003603 tcp 10.0.2.105 51151 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:35:57.300133 0.000000 tcp 10.0.2.105 51151 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:36:03.300776 0.031332 tcp 10.0.2.105 51152 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:03.332436 0.071253 tcp 10.0.2.105 51153 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:03.404075 0.158484 tcp 10.0.2.105 51154 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:04.083875 3.000891 tcp 10.0.2.105 51155 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:36:13.083372 0.000000 tcp 10.0.2.105 51155 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:36:19.195178 0.864250 tcp 10.0.2.105 51156 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:20.059718 0.083413 tcp 10.0.2.105 51157 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:20.143411 0.156018 tcp 10.0.2.105 51158 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:20.826667 2.969181 tcp 10.0.2.105 51159 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:36:29.732871 0.000000 tcp 10.0.2.105 51159 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:36:35.639414 1.003560 tcp 10.0.2.105 51160 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:36.643380 0.071498 tcp 10.0.2.105 51161 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:36.715188 0.197760 tcp 10.0.2.105 51162 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:36:37.087667 0.357560 tcp 10.0.2.105 51163 -> 46.48.247.67 29365 SPA_* 0 0 9 1185 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:37:07.069987 0.111348 tcp 10.0.2.105 51164 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:37:07.181603 0.074215 tcp 10.0.2.105 51165 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:37:07.256089 0.155538 tcp 10.0.2.105 51166 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:37:07.480556 0.355238 tcp 10.0.2.105 51163 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:37:07.480864 2.964531 tcp 10.0.2.105 51167 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:10.835229 2.965440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:37:16.369496 0.000000 tcp 10.0.2.105 51167 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:17.757115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:37:22.289308 2.971727 tcp 10.0.2.105 51168 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:25.658044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:37:31.189981 0.000000 tcp 10.0.2.105 51168 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:35.762887 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:37:37.111940 2.968783 tcp 10.0.2.105 51169 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:41.465488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:37:46.003251 0.000000 tcp 10.0.2.105 51169 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:37:51.925353 0.350620 tcp 10.0.2.105 51170 -> 46.48.247.67 29365 SPA_* 0 0 9 1185 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:38:05.149917 0.000418 tcp 10.0.2.105 51170 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:38:13.071381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:43:04.637557 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:43:04.637732 2.986818 tcp 10.0.2.105 51171 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:13.619292 0.000000 tcp 10.0.2.105 51171 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:19.653677 0.052555 tcp 10.0.2.105 51172 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:19.706497 0.071831 tcp 10.0.2.105 51173 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:19.778644 0.160741 tcp 10.0.2.105 51174 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:20.508604 2.988268 tcp 10.0.2.105 51175 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:29.474663 0.000000 tcp 10.0.2.105 51175 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:35.518130 0.056626 tcp 10.0.2.105 51176 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:35.575062 0.074914 tcp 10.0.2.105 51177 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:35.650230 0.177252 tcp 10.0.2.105 51178 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:36.084771 2.996539 tcp 10.0.2.105 51179 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:45.063080 0.000000 tcp 10.0.2.105 51179 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:43:51.072233 0.030792 tcp 10.0.2.105 51180 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:51.103329 0.074634 tcp 10.0.2.105 51181 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:51.178259 0.156558 tcp 10.0.2.105 51182 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:43:51.395167 0.354756 tcp 10.0.2.105 51183 -> 46.48.247.67 29365 SPA_* 0 0 9 1018 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:44:16.665496 2.999776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:44:21.746480 0.052223 tcp 10.0.2.105 51184 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:44:21.799012 0.070258 tcp 10.0.2.105 51185 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:44:21.869520 0.156015 tcp 10.0.2.105 51186 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:44:22.065549 0.346803 tcp 10.0.2.105 51183 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:44:22.065834 2.994062 tcp 10.0.2.105 51187 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:44:23.668815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:44:31.059026 0.000000 tcp 10.0.2.105 51187 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:44:31.670019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:44:37.067869 3.004507 tcp 10.0.2.105 51188 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:44:46.070731 0.000000 tcp 10.0.2.105 51188 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:44:47.672934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:44:50.877503 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:44:52.069494 3.004152 tcp 10.0.2.105 51189 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:45:01.072182 0.000000 tcp 10.0.2.105 51189 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:45:07.071261 0.347869 tcp 10.0.2.105 51190 -> 46.48.247.67 29365 SPA_* 0 0 9 1018 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:45:14.324565 0.193348 tcp 10.0.2.105 51190 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:45:19.678977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:50:14.515716 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:50:14.515899 2.991434 tcp 10.0.2.105 51191 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:50:23.515684 0.000000 tcp 10.0.2.105 51191 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:50:29.515751 0.067701 tcp 10.0.2.105 51192 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:29.583754 0.072271 tcp 10.0.2.105 51193 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:29.656553 0.187618 tcp 10.0.2.105 51194 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:29.923406 2.995746 tcp 10.0.2.105 51195 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:50:38.920762 0.000000 tcp 10.0.2.105 51195 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:50:44.919348 0.051625 tcp 10.0.2.105 51196 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:44.971287 0.071615 tcp 10.0.2.105 51197 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:45.043281 0.152287 tcp 10.0.2.105 51198 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:50:45.351959 2.999487 tcp 10.0.2.105 51199 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:50:54.350056 0.000000 tcp 10.0.2.105 51199 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:00.349717 0.054790 tcp 10.0.2.105 51200 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:00.404802 0.074929 tcp 10.0.2.105 51201 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:00.480122 0.235474 tcp 10.0.2.105 51202 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:00.870070 0.360521 tcp 10.0.2.105 51203 -> 46.48.247.67 29365 SPA_* 0 0 7 965 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:15.173480 0.447328 tcp 10.0.2.105 51203 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:15.174283 0.052125 tcp 10.0.2.105 51204 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:15.226741 0.076314 tcp 10.0.2.105 51205 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:15.303342 0.161864 tcp 10.0.2.105 51206 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:51:15.621068 3.003945 tcp 10.0.2.105 51207 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:24.623584 0.000000 tcp 10.0.2.105 51207 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:30.622532 3.004097 tcp 10.0.2.105 51208 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:39.625268 0.000000 tcp 10.0.2.105 51208 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:45.296243 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:51:46.535793 2.957554 tcp 10.0.2.105 51209 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:51:55.432807 0.000000 tcp 10.0.2.105 51209 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:52:01.357620 0.553468 tcp 10.0.2.105 51210 -> 46.48.247.67 29365 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:52:08.252549 0.010641 tcp 10.0.2.105 51210 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:54:39.687093 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 22:54:46.694125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:54:54.695833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:55:10.698879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:55:42.704767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 22:57:07.407223 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:57:07.407466 3.003526 tcp 10.0.2.105 51211 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:16.409432 0.000000 tcp 10.0.2.105 51211 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:22.409973 0.032847 tcp 10.0.2.105 51212 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:22.443132 0.068062 tcp 10.0.2.105 51213 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:22.511545 0.164535 tcp 10.0.2.105 51214 -> 195.113.214.251 443 SRPA* 0 0 67 69794 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:22.692360 3.000507 tcp 10.0.2.105 51215 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:31.691686 0.000000 tcp 10.0.2.105 51215 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:37.690632 0.030121 tcp 10.0.2.105 51216 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:37.721033 0.076708 tcp 10.0.2.105 51217 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:37.798098 0.164645 tcp 10.0.2.105 51218 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:37.974563 3.000050 tcp 10.0.2.105 51219 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:46.973682 0.000000 tcp 10.0.2.105 51219 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:57:53.066057 0.031414 tcp 10.0.2.105 51220 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:53.097747 0.076162 tcp 10.0.2.105 51221 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:53.174204 0.172118 tcp 10.0.2.105 51222 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:57:53.357009 0.357818 tcp 10.0.2.105 51223 -> 46.48.247.67 29365 SPA_* 0 0 9 1154 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:58:17.595684 0.317548 tcp 10.0.2.105 51223 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:58:17.596839 0.051920 tcp 10.0.2.105 51224 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:58:17.649019 0.074585 tcp 10.0.2.105 51225 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:58:17.723946 0.159762 tcp 10.0.2.105 51226 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:58:17.913519 2.998744 tcp 10.0.2.105 51227 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:58:26.910405 0.000000 tcp 10.0.2.105 51227 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:58:32.909659 3.003957 tcp 10.0.2.105 51228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:58:41.912749 0.000000 tcp 10.0.2.105 51228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:58:46.879223 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 22:58:47.911265 3.003824 tcp 10.0.2.105 51229 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:58:56.913885 0.000000 tcp 10.0.2.105 51229 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 22:59:02.913055 0.354502 tcp 10.0.2.105 51230 -> 46.48.247.67 29365 SPA_* 0 0 7 1046 flow=From-Botnet-V2-TCP-Established 1970/02/06 22:59:25.920994 0.000319 tcp 10.0.2.105 51230 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:01:46.711708 3.000785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:01:53.718348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:02:01.719757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:02:17.722822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:02:47.265500 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:02:47.265617 0.284798 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:47.559288 0.148387 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:47.693786 0.110845 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:47.768693 0.081260 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:47.839844 0.225631 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.058942 0.175022 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.227248 0.172868 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.396630 0.062862 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.458101 0.133043 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2576 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.573528 0.192364 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:02:48.757420 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 9584 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 23:02:49.728990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:03:07.064733 0.031182 tcp 10.0.2.105 51231 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:03:07.096342 0.071588 tcp 10.0.2.105 51232 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:03:07.168449 0.155534 tcp 10.0.2.105 51233 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:03:07.324627 0.167253 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:07.470426 0.170323 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:07.623928 0.135269 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:07.712032 0.087622 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:07.780485 0.690512 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:08.454189 0.075298 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:08.544895 0.173345 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:08.695322 0.093296 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:08.747247 0.398781 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.126389 0.178292 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.300137 0.237195 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.514616 0.035383 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.571032 0.073137 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.634147 0.179393 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:03:09.810965 0.176195 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:04:25.917426 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:04:25.917625 3.003855 tcp 10.0.2.105 51234 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:04:34.919882 0.000000 tcp 10.0.2.105 51234 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:04:40.918941 0.031167 tcp 10.0.2.105 51235 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:40.950460 0.068206 tcp 10.0.2.105 51236 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:41.018988 0.164008 tcp 10.0.2.105 51237 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:41.193083 3.000094 tcp 10.0.2.105 51238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:04:50.192623 0.000000 tcp 10.0.2.105 51238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:04:56.191986 0.036545 tcp 10.0.2.105 51239 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:56.228334 0.074666 tcp 10.0.2.105 51240 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:56.303331 0.157019 tcp 10.0.2.105 51241 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:04:56.474076 3.001199 tcp 10.0.2.105 51242 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:05:05.473709 0.000000 tcp 10.0.2.105 51242 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:05:11.473236 0.032476 tcp 10.0.2.105 51243 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:11.506074 0.074900 tcp 10.0.2.105 51244 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:11.581263 0.166115 tcp 10.0.2.105 51245 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:11.827921 2.999227 tcp 10.0.2.105 51246 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:05:20.835822 0.000000 tcp 10.0.2.105 51246 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:05:26.826742 0.030498 tcp 10.0.2.105 51247 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:26.857547 0.071852 tcp 10.0.2.105 51248 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:26.929232 0.158356 tcp 10.0.2.105 51249 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:27.114944 0.361097 tcp 10.0.2.105 51250 -> 46.48.247.67 29365 SPA_* 0 0 9 1087 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:49.029747 0.340354 tcp 10.0.2.105 51250 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:49.030819 0.052156 tcp 10.0.2.105 51251 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:49.083301 0.085124 tcp 10.0.2.105 51252 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:49.168108 0.163296 tcp 10.0.2.105 51253 -> 195.113.214.251 443 SRPA* 0 0 48 25096 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:05:49.369919 3.009950 tcp 10.0.2.105 51254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:05:58.390346 0.000000 tcp 10.0.2.105 51254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:04.350487 2.992068 tcp 10.0.2.105 51255 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:13.341650 0.000000 tcp 10.0.2.105 51255 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:17.878028 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:06:19.340135 3.004028 tcp 10.0.2.105 51256 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:28.342621 0.000000 tcp 10.0.2.105 51256 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:34.341824 3.004035 tcp 10.0.2.105 51257 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:41.874794 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:06:43.345628 0.000000 tcp 10.0.2.105 51257 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:06:49.344938 0.361423 tcp 10.0.2.105 51258 -> 46.48.247.67 29365 SPA_* 0 0 9 1087 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:07:19.706976 0.353810 tcp 10.0.2.105 51258 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:08:53.735685 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:09:00.742881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:09:08.743691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:09:24.746887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:09:56.752890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:12:19.708918 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:12:19.709133 3.005599 tcp 10.0.2.105 51259 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:12:28.711764 0.000000 tcp 10.0.2.105 51259 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:12:34.712574 0.053398 tcp 10.0.2.105 51260 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:34.766205 0.072878 tcp 10.0.2.105 51261 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:34.839351 0.165815 tcp 10.0.2.105 51262 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:35.539484 3.005713 tcp 10.0.2.105 51263 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:12:44.543922 0.000000 tcp 10.0.2.105 51263 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:12:50.533625 0.031055 tcp 10.0.2.105 51264 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:50.564981 0.076893 tcp 10.0.2.105 51265 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:50.642182 0.157406 tcp 10.0.2.105 51266 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:12:51.157048 4.340303 tcp 10.0.2.105 51267 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:13:01.438526 0.000000 tcp 10.0.2.105 51267 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:13:07.370264 0.326762 tcp 10.0.2.105 51268 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:07.697355 0.077883 tcp 10.0.2.105 51269 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:07.775532 0.151351 tcp 10.0.2.105 51270 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:12.755636 2.976082 tcp 10.0.2.105 51271 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:13:21.669462 0.000000 tcp 10.0.2.105 51271 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:13:27.590516 0.062099 tcp 10.0.2.105 51272 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:27.652913 0.073590 tcp 10.0.2.105 51273 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:27.726317 0.163033 tcp 10.0.2.105 51274 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:27.956194 0.348790 tcp 10.0.2.105 51275 -> 46.48.247.67 29365 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:57.937052 0.030578 tcp 10.0.2.105 51276 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:57.967950 0.093465 tcp 10.0.2.105 51277 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:58.061733 0.168204 tcp 10.0.2.105 51278 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:59.029631 0.342008 tcp 10.0.2.105 51275 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:13:59.030039 2.970481 tcp 10.0.2.105 51279 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:07.928362 0.000000 tcp 10.0.2.105 51279 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:13.839813 2.971109 tcp 10.0.2.105 51280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:22.734731 0.000000 tcp 10.0.2.105 51280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:27.402741 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:14:28.662596 2.969477 tcp 10.0.2.105 51281 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:37.573959 0.000000 tcp 10.0.2.105 51281 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:43.492675 2.955463 tcp 10.0.2.105 51282 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:51.121648 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:14:52.377844 0.000000 tcp 10.0.2.105 51282 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:14:58.318695 0.348749 tcp 10.0.2.105 51283 -> 46.48.247.67 29365 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:15:28.510736 0.376565 tcp 10.0.2.105 51283 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:16:00.762121 2.997869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:16:07.768724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:16:15.782558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:16:31.770133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:17:03.778270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:20:28.511715 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:20:28.511817 3.003688 tcp 10.0.2.105 51284 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:20:37.516634 0.000000 tcp 10.0.2.105 51284 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:20:43.515200 0.032542 tcp 10.0.2.105 51285 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:43.548098 0.074259 tcp 10.0.2.105 51286 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:43.622753 0.169961 tcp 10.0.2.105 51287 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:43.981648 2.996813 tcp 10.0.2.105 51288 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:20:52.986775 0.000000 tcp 10.0.2.105 51288 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:20:58.979398 0.051677 tcp 10.0.2.105 51289 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:59.031355 0.071507 tcp 10.0.2.105 51290 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:59.103139 0.163533 tcp 10.0.2.105 51291 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:20:59.667902 2.992092 tcp 10.0.2.105 51292 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:21:08.658333 0.000000 tcp 10.0.2.105 51292 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:21:14.657826 0.032862 tcp 10.0.2.105 51293 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:14.690980 0.071669 tcp 10.0.2.105 51294 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:14.762884 0.155495 tcp 10.0.2.105 51295 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:15.352683 3.000093 tcp 10.0.2.105 51296 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:21:24.351815 0.000000 tcp 10.0.2.105 51296 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:21:30.349914 0.174151 tcp 10.0.2.105 51297 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:30.524382 0.073439 tcp 10.0.2.105 51298 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:30.598118 0.160723 tcp 10.0.2.105 51299 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:21:30.849337 0.361380 tcp 10.0.2.105 51300 -> 46.48.247.67 29365 SPA_* 0 0 9 1106 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:22:01.205385 0.050577 tcp 10.0.2.105 51301 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:22:01.256239 0.067235 tcp 10.0.2.105 51302 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:22:01.323730 0.167817 tcp 10.0.2.105 51303 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:22:02.163257 0.355065 tcp 10.0.2.105 51300 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:22:02.163546 2.996339 tcp 10.0.2.105 51304 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:11.158221 0.000000 tcp 10.0.2.105 51304 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:17.157254 3.004383 tcp 10.0.2.105 51305 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:26.159659 0.000000 tcp 10.0.2.105 51305 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:30.877001 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:22:32.159513 3.004034 tcp 10.0.2.105 51306 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:41.161643 0.000000 tcp 10.0.2.105 51306 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:47.161123 3.003681 tcp 10.0.2.105 51307 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:22:54.871533 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:22:56.163176 0.000000 tcp 10.0.2.105 51307 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:23:02.162887 0.452059 tcp 10.0.2.105 51308 -> 46.48.247.67 29365 SPA_* 0 0 9 1106 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:23:07.782634 3.005682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:23:14.790199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:23:22.792713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:23:32.615903 0.354564 tcp 10.0.2.105 51308 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:23:38.795499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:24:10.802556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:28:32.619650 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:28:32.619746 3.003752 tcp 10.0.2.105 51309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:28:41.619793 0.000000 tcp 10.0.2.105 51309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:28:48.469651 0.031860 tcp 10.0.2.105 51310 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:28:48.501756 0.075623 tcp 10.0.2.105 51311 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:28:48.577658 0.153782 tcp 10.0.2.105 51312 -> 195.113.214.251 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:28:48.749111 2.980175 tcp 10.0.2.105 51313 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:28:58.643450 0.000000 tcp 10.0.2.105 51313 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:29:04.557286 0.052673 tcp 10.0.2.105 51314 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:04.610334 0.076263 tcp 10.0.2.105 51315 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:04.686972 0.156831 tcp 10.0.2.105 51316 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:04.902612 2.977078 tcp 10.0.2.105 51317 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:29:13.805432 0.000000 tcp 10.0.2.105 51317 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:29:19.719037 0.093009 tcp 10.0.2.105 51318 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:19.812413 0.139699 tcp 10.0.2.105 51319 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:19.952396 0.157687 tcp 10.0.2.105 51320 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:20.123435 2.974361 tcp 10.0.2.105 51321 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:29:29.036565 0.000000 tcp 10.0.2.105 51321 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:29:34.944839 0.031368 tcp 10.0.2.105 51322 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:34.976551 0.072282 tcp 10.0.2.105 51323 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:35.049147 0.155061 tcp 10.0.2.105 51324 -> 195.113.214.251 443 SRPA* 0 0 35 17960 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:29:35.367692 0.444474 tcp 10.0.2.105 51325 -> 46.48.247.67 29365 SPA_* 0 0 9 1033 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:30:05.481289 0.031632 tcp 10.0.2.105 51326 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:30:05.512732 0.074847 tcp 10.0.2.105 51327 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:30:05.587888 0.166264 tcp 10.0.2.105 51328 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:30:06.127058 0.347813 tcp 10.0.2.105 51325 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:30:06.127335 2.985142 tcp 10.0.2.105 51329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:15.054825 0.000000 tcp 10.0.2.105 51329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:15.680922 2.971586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:30:20.994570 2.975109 tcp 10.0.2.105 51330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:22.622546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:30:29.906066 0.000000 tcp 10.0.2.105 51330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:30.541024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:30:34.547592 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:30:35.841530 2.957982 tcp 10.0.2.105 51331 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:44.744924 0.000000 tcp 10.0.2.105 51331 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:46.366454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:30:50.687991 2.973570 tcp 10.0.2.105 51332 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:30:58.334040 0.000389 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:30:59.610265 0.000000 tcp 10.0.2.105 51332 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:31:05.560679 0.349953 tcp 10.0.2.105 51333 -> 46.48.247.67 29365 SPA_* 0 0 9 1033 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:31:18.060730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:31:35.548776 0.344470 tcp 10.0.2.105 51333 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:33:21.353219 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:33:21.353312 0.000000 udp 10.0.2.105 7010 -> 96.237.22.160 9584 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/06 23:33:36.599577 0.034340 tcp 10.0.2.105 51334 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:33:36.633768 0.075455 tcp 10.0.2.105 51335 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:33:36.709488 0.169862 tcp 10.0.2.105 51336 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:33:36.877835 0.112125 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:36.953515 0.083172 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:37.195822 0.278681 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:37.727752 0.162399 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:37.864365 0.173773 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:38.035276 0.063817 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:38.150155 0.089654 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:38.223421 0.192184 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:38.626541 0.174341 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:38.792897 0.224322 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.009341 0.169861 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.157134 0.173925 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.416895 0.130123 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.502867 0.086921 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.729799 0.172061 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.879562 0.082507 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:39.924491 0.078534 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:40.282873 0.073721 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:40.346514 0.431662 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:40.757937 0.178982 udp 10.0.2.105 7010 <-> 99.90.158.235 1799 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:40.931456 0.235452 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:41.144793 0.035362 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:41.275328 0.070514 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:41.331846 0.177151 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:33:41.656760 0.178060 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/06 23:36:35.535379 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:36:35.535644 3.000998 tcp 10.0.2.105 51337 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:36:44.538996 0.000000 tcp 10.0.2.105 51337 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:36:50.537612 0.032938 tcp 10.0.2.105 51338 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:36:50.570846 0.074968 tcp 10.0.2.105 51339 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:36:50.645978 0.167881 tcp 10.0.2.105 51340 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:36:51.137625 3.015513 tcp 10.0.2.105 51341 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:00.172532 0.000000 tcp 10.0.2.105 51341 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:06.181855 0.052540 tcp 10.0.2.105 51342 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:06.234739 0.074702 tcp 10.0.2.105 51343 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:06.309764 0.170865 tcp 10.0.2.105 51344 -> 195.113.214.251 443 SRPA* 0 0 81 62548 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:06.597105 2.991490 tcp 10.0.2.105 51345 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:15.581298 0.000000 tcp 10.0.2.105 51345 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:21.581089 0.053017 tcp 10.0.2.105 51346 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:21.633900 0.071957 tcp 10.0.2.105 51347 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:21.706170 0.157849 tcp 10.0.2.105 51348 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:21.860112 2.986860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:37:22.075686 2.997012 tcp 10.0.2.105 51349 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:28.856781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:37:31.040532 0.000000 tcp 10.0.2.105 51349 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:37:36.852919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:37:37.043749 0.053660 tcp 10.0.2.105 51350 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:37.097812 0.071113 tcp 10.0.2.105 51351 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:37.168744 0.163284 tcp 10.0.2.105 51352 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:37.401970 0.362227 tcp 10.0.2.105 51353 -> 46.48.247.67 29365 SPA_* 0 0 9 1138 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:37:52.852599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:38:07.766050 0.057181 tcp 10.0.2.105 51354 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:38:07.823062 0.075778 tcp 10.0.2.105 51355 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:38:07.899226 0.160414 tcp 10.0.2.105 51356 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:38:08.248094 0.347650 tcp 10.0.2.105 51353 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:38:08.248551 3.000347 tcp 10.0.2.105 51357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:17.252053 0.000000 tcp 10.0.2.105 51357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:23.246774 2.999698 tcp 10.0.2.105 51358 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:24.861133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:38:32.239127 0.000000 tcp 10.0.2.105 51358 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:36.876457 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:38:38.247721 3.005254 tcp 10.0.2.105 51359 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:47.250557 0.000000 tcp 10.0.2.105 51359 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:38:53.249655 3.004151 tcp 10.0.2.105 51360 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:39:00.880379 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:39:02.252172 0.000000 tcp 10.0.2.105 51360 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:39:09.233836 1.772802 tcp 10.0.2.105 51361 -> 46.48.247.67 29365 FSPA* 0 0 14 1668 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:10.056288 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:44:10.056407 2.992426 tcp 10.0.2.105 51362 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:19.047741 0.000000 tcp 10.0.2.105 51362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:25.058584 0.053053 tcp 10.0.2.105 51363 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:25.111942 0.074420 tcp 10.0.2.105 51364 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:25.186622 0.165998 tcp 10.0.2.105 51365 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:25.565171 2.996127 tcp 10.0.2.105 51366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:28.865848 3.000385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:44:34.559928 0.000000 tcp 10.0.2.105 51366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:35.872057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:44:40.559847 0.055001 tcp 10.0.2.105 51367 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:40.615111 0.074252 tcp 10.0.2.105 51368 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:40.689660 0.161514 tcp 10.0.2.105 51369 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:40.919351 3.005178 tcp 10.0.2.105 51370 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:43.873441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:44:49.921747 0.000000 tcp 10.0.2.105 51370 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:55.921664 0.032137 tcp 10.0.2.105 51371 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:55.954133 0.071377 tcp 10.0.2.105 51372 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:56.025866 0.161674 tcp 10.0.2.105 51373 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:44:56.246674 3.003991 tcp 10.0.2.105 51374 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:44:59.880499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:45:05.247748 0.000000 tcp 10.0.2.105 51374 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:11.245528 0.065448 tcp 10.0.2.105 51375 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:11.311298 0.072164 tcp 10.0.2.105 51376 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:11.383735 0.161442 tcp 10.0.2.105 51377 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:11.774527 0.344305 tcp 10.0.2.105 51378 -> 46.48.247.67 29365 SPA_* 0 0 9 1140 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:19.527210 0.400547 tcp 10.0.2.105 51378 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:19.528179 0.030615 tcp 10.0.2.105 51379 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:19.559091 0.074694 tcp 10.0.2.105 51380 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:19.634070 0.164744 tcp 10.0.2.105 51381 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:45:19.928037 3.001156 tcp 10.0.2.105 51382 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:28.927752 0.000000 tcp 10.0.2.105 51382 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:31.882699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:45:34.926995 3.004199 tcp 10.0.2.105 51383 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:43.930826 0.000000 tcp 10.0.2.105 51383 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:48.878930 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:45:49.928621 3.008994 tcp 10.0.2.105 51384 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:45:58.931777 0.000000 tcp 10.0.2.105 51384 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:46:04.932700 3.001468 tcp 10.0.2.105 51385 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:46:12.871526 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:46:13.934654 0.000000 tcp 10.0.2.105 51385 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:46:19.932557 0.352086 tcp 10.0.2.105 51386 -> 46.48.247.67 29365 SPA_* 0 0 9 1140 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:46:25.324666 0.000348 tcp 10.0.2.105 51386 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:25.321024 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:51:25.321298 3.004649 tcp 10.0.2.105 51387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:51:34.323747 0.000000 tcp 10.0.2.105 51387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:51:40.324955 0.054183 tcp 10.0.2.105 51388 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:40.379442 0.074918 tcp 10.0.2.105 51389 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:40.454669 0.159410 tcp 10.0.2.105 51390 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:40.709408 2.997707 tcp 10.0.2.105 51391 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:51:49.715926 0.000000 tcp 10.0.2.105 51391 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:51:55.705349 0.031860 tcp 10.0.2.105 51392 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:55.737543 0.074768 tcp 10.0.2.105 51393 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:55.812269 0.161856 tcp 10.0.2.105 51394 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:51:56.003235 2.995758 tcp 10.0.2.105 51395 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:04.997640 0.000000 tcp 10.0.2.105 51395 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:10.996990 0.031139 tcp 10.0.2.105 51396 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:11.028383 0.071378 tcp 10.0.2.105 51397 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:11.100082 0.167164 tcp 10.0.2.105 51398 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:11.285854 2.995126 tcp 10.0.2.105 51399 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:20.279554 0.000000 tcp 10.0.2.105 51399 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:26.283406 0.030759 tcp 10.0.2.105 51400 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:26.314458 0.075051 tcp 10.0.2.105 51401 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:26.389772 0.154581 tcp 10.0.2.105 51402 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:26.578270 3.696839 tcp 10.0.2.105 51403 -> 46.48.247.67 29365 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:29.658606 0.032303 tcp 10.0.2.105 51404 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:29.690761 0.071237 tcp 10.0.2.105 51405 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:29.762365 0.162822 tcp 10.0.2.105 51406 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:52:30.275369 2.992607 tcp 10.0.2.105 51407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:39.276876 0.000000 tcp 10.0.2.105 51407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:45.858756 2.953575 tcp 10.0.2.105 51408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:54.735711 0.000000 tcp 10.0.2.105 51408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:52:59.284446 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:53:00.671131 2.961624 tcp 10.0.2.105 51409 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:53:09.566299 0.000000 tcp 10.0.2.105 51409 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:53:15.500816 2.970875 tcp 10.0.2.105 51410 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:53:23.225772 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:53:24.615510 0.000000 tcp 10.0.2.105 51410 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:53:30.549151 0.346419 tcp 10.0.2.105 51411 -> 46.48.247.67 29365 SPA_* 0 0 9 1144 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:54:00.627382 0.346672 tcp 10.0.2.105 51411 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:54:45.892717 3.000761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/06 23:54:52.899296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:55:00.903761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:55:16.907045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:55:48.909599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/06 23:59:00.626007 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/06 23:59:00.626122 2.993600 tcp 10.0.2.105 51412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:09.618281 0.000000 tcp 10.0.2.105 51412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:15.629109 0.030999 tcp 10.0.2.105 51413 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:15.660440 0.075014 tcp 10.0.2.105 51414 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:15.735725 0.168060 tcp 10.0.2.105 51415 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:15.927510 3.004200 tcp 10.0.2.105 51416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:24.930580 0.000000 tcp 10.0.2.105 51416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:30.929717 0.030990 tcp 10.0.2.105 51417 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:30.960541 0.076435 tcp 10.0.2.105 51418 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:31.037275 0.157297 tcp 10.0.2.105 51419 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:31.209571 3.003956 tcp 10.0.2.105 51420 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:40.212157 0.000000 tcp 10.0.2.105 51420 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:46.213524 0.053348 tcp 10.0.2.105 51421 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:46.267205 0.072543 tcp 10.0.2.105 51422 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:46.340008 0.153479 tcp 10.0.2.105 51423 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/06 23:59:46.567148 2.999359 tcp 10.0.2.105 51424 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/06 23:59:55.564422 0.000000 tcp 10.0.2.105 51424 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:00:01.563959 0.031401 tcp 10.0.2.105 51425 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:01.595680 0.071167 tcp 10.0.2.105 51426 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:01.667158 0.163169 tcp 10.0.2.105 51427 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:01.846678 0.347474 tcp 10.0.2.105 51428 -> 46.48.247.67 29365 SPA_* 0 0 9 1168 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:32.197849 0.033067 tcp 10.0.2.105 51429 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:32.231263 0.075130 tcp 10.0.2.105 51430 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:32.306646 0.169741 tcp 10.0.2.105 51431 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:32.499626 0.350538 tcp 10.0.2.105 51428 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:00:32.499928 2.995072 tcp 10.0.2.105 51432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:00:41.490762 0.000000 tcp 10.0.2.105 51432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:00:47.490995 3.002083 tcp 10.0.2.105 51433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:00:56.491838 0.000000 tcp 10.0.2.105 51433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:01:01.379030 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:01:02.490757 3.003978 tcp 10.0.2.105 51434 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:01:11.493269 0.000000 tcp 10.0.2.105 51434 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:01:17.495684 3.000753 tcp 10.0.2.105 51435 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:01:25.375140 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:01:26.494961 0.000000 tcp 10.0.2.105 51435 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:01:32.493848 0.348880 tcp 10.0.2.105 51436 -> 46.48.247.67 29365 SPA_* 0 0 9 1168 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:01:52.916066 3.001224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:01:59.922920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:02:02.838762 0.348913 tcp 10.0.2.105 51436 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:02:07.926863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:02:23.928872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:02:55.933694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:03:49.140468 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:03:49.140727 0.104280 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 1961 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:49.206925 0.082837 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:49.560194 0.289658 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:50.366044 0.145184 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:50.497520 0.191253 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:50.731965 0.064267 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:50.796723 0.173327 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:50.962053 0.227230 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.181229 0.172373 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.325792 0.110416 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.420796 0.195547 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.611502 0.171843 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.772172 0.215174 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:51.938888 0.082706 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.002775 0.173512 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.183056 0.083045 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.228727 0.075123 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.326033 0.074882 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 5 1897 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.392476 0.399148 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:03:52.769942 0.000000 udp 10.0.2.105 7010 -> 99.90.158.235 1799 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:04:10.704400 0.056953 tcp 10.0.2.105 51437 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:10.761681 0.071370 tcp 10.0.2.105 51438 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:10.833407 0.179442 tcp 10.0.2.105 51439 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:11.012163 0.247691 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:04:11.237937 0.177537 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:04:11.413311 0.178137 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:04:11.638218 0.409467 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:04:12.048233 0.081162 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:04:12.048662 4.256675 tcp 10.0.2.105 51440 -> 212.17.122.207 3945 SPA_* 0 0 21 8698 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:17.105643 0.194826 tcp 10.0.2.105 51440 -> 212.17.122.207 3945 A_PA 0 0 2 1004 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:47.104917 0.000349 tcp 10.0.2.105 51440 -> 212.17.122.207 3945 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:04:58.809068 0.000168 tcp 10.0.2.105 51440 -> 212.17.122.207 3945 RA_A 0 0 2 1528 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:02.839167 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:07:02.839283 3.003525 tcp 10.0.2.105 51441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:11.846771 0.000000 tcp 10.0.2.105 51441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:17.842126 0.054919 tcp 10.0.2.105 51442 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:17.896841 0.075696 tcp 10.0.2.105 51443 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:17.972852 0.156097 tcp 10.0.2.105 51444 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:18.226973 2.998173 tcp 10.0.2.105 51445 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:27.223496 0.000000 tcp 10.0.2.105 51445 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:33.223446 0.666307 tcp 10.0.2.105 51446 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:33.889580 0.075146 tcp 10.0.2.105 51447 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:33.965032 0.169246 tcp 10.0.2.105 51448 -> 195.113.214.251 443 SRPA* 0 0 35 18594 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:34.482908 2.958547 tcp 10.0.2.105 51449 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:43.381269 0.000000 tcp 10.0.2.105 51449 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:49.307328 0.053021 tcp 10.0.2.105 51450 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:49.360670 0.075080 tcp 10.0.2.105 51451 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:49.436077 0.154029 tcp 10.0.2.105 51452 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:07:49.662872 2.947288 tcp 10.0.2.105 51453 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:07:58.547808 0.000000 tcp 10.0.2.105 51453 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:04.489907 0.052188 tcp 10.0.2.105 51454 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:08:04.542376 0.078363 tcp 10.0.2.105 51455 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:08:04.621052 0.158944 tcp 10.0.2.105 51456 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:08:05.023328 2.964868 tcp 10.0.2.105 51457 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:13.924729 0.000000 tcp 10.0.2.105 51457 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:19.865952 2.972550 tcp 10.0.2.105 51458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:28.773323 0.000000 tcp 10.0.2.105 51458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:33.378654 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:08:34.770924 3.006217 tcp 10.0.2.105 51459 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:43.779802 0.000000 tcp 10.0.2.105 51459 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:49.775511 3.001432 tcp 10.0.2.105 51460 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:57.373115 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:08:58.777398 0.000000 tcp 10.0.2.105 51460 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:08:59.940772 3.000546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:09:06.946772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:09:14.947956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:09:30.951721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:10:02.959999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:14:04.776857 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:14:04.776944 2.993761 tcp 10.0.2.105 51461 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:13.768760 0.000000 tcp 10.0.2.105 51461 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:19.778191 0.037666 tcp 10.0.2.105 51462 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:19.816083 0.076336 tcp 10.0.2.105 51463 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:19.892744 0.160054 tcp 10.0.2.105 51464 -> 195.113.214.251 443 SRPA* 0 0 28 12100 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:20.391717 3.000297 tcp 10.0.2.105 51465 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:29.390021 0.000000 tcp 10.0.2.105 51465 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:35.389806 0.033974 tcp 10.0.2.105 51466 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:35.424073 0.067842 tcp 10.0.2.105 51467 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:35.492215 0.157080 tcp 10.0.2.105 51468 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:35.914011 3.000456 tcp 10.0.2.105 51469 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:46.472479 0.000000 tcp 10.0.2.105 51469 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:14:52.412314 0.052026 tcp 10.0.2.105 51470 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:52.464137 0.069223 tcp 10.0.2.105 51471 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:52.533786 0.173552 tcp 10.0.2.105 51472 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:14:52.805891 2.984290 tcp 10.0.2.105 51473 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:01.725028 0.000000 tcp 10.0.2.105 51473 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:07.647109 0.054575 tcp 10.0.2.105 51474 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:15:07.701999 0.071975 tcp 10.0.2.105 51475 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:15:07.774296 0.154462 tcp 10.0.2.105 51476 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:15:08.110957 2.962599 tcp 10.0.2.105 51477 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:17.004550 0.000000 tcp 10.0.2.105 51477 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:22.930476 2.960825 tcp 10.0.2.105 51478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:31.827963 0.000000 tcp 10.0.2.105 51478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:36.389745 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:15:37.765927 2.960312 tcp 10.0.2.105 51479 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:46.661034 0.000000 tcp 10.0.2.105 51479 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:15:52.589431 2.966176 tcp 10.0.2.105 51480 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:16:00.108777 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:16:01.480891 0.000000 tcp 10.0.2.105 51480 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:16:07.595226 2.971697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:16:14.516449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:16:22.423048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:16:38.250099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:17:09.981833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:21:06.773542 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:21:06.773792 3.002481 tcp 10.0.2.105 51481 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:15.775009 0.000000 tcp 10.0.2.105 51481 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:21.775635 0.057252 tcp 10.0.2.105 51482 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:21.833205 0.075791 tcp 10.0.2.105 51483 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:21.909286 0.171374 tcp 10.0.2.105 51484 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:22.155220 2.994536 tcp 10.0.2.105 51485 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:31.159571 0.000000 tcp 10.0.2.105 51485 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:37.146995 0.051667 tcp 10.0.2.105 51486 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:37.198990 0.076239 tcp 10.0.2.105 51487 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:37.275628 0.156307 tcp 10.0.2.105 51488 -> 195.113.214.251 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:37.495687 2.994998 tcp 10.0.2.105 51489 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:46.492685 0.000000 tcp 10.0.2.105 51489 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:21:52.488163 0.053065 tcp 10.0.2.105 51490 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:52.541095 0.132868 tcp 10.0.2.105 51491 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:52.673822 0.170263 tcp 10.0.2.105 51492 -> 195.113.214.251 443 SRPA* 0 0 26 13966 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:21:52.871392 3.001357 tcp 10.0.2.105 51493 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:01.871192 0.000000 tcp 10.0.2.105 51493 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:07.870625 0.052863 tcp 10.0.2.105 51494 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:22:07.923825 0.076084 tcp 10.0.2.105 51495 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:22:08.000208 0.154432 tcp 10.0.2.105 51496 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:22:08.328744 3.006804 tcp 10.0.2.105 51497 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:17.333767 0.000000 tcp 10.0.2.105 51497 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:23.322217 3.003931 tcp 10.0.2.105 51498 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:32.325026 0.000000 tcp 10.0.2.105 51498 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:36.871580 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:22:38.323584 2.994542 tcp 10.0.2.105 51499 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:47.326562 0.000000 tcp 10.0.2.105 51499 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:22:53.325903 2.993660 tcp 10.0.2.105 51500 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:23:00.876058 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:23:02.319867 0.000000 tcp 10.0.2.105 51500 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:23:13.986646 3.041054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:23:21.011326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:23:29.008712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:23:45.009477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:24:17.015646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:28:08.328687 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:28:08.328874 3.003726 tcp 10.0.2.105 51501 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:17.331025 0.000000 tcp 10.0.2.105 51501 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:23.332174 0.035004 tcp 10.0.2.105 51502 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:23.367522 0.071782 tcp 10.0.2.105 51503 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:23.439708 0.162394 tcp 10.0.2.105 51504 -> 195.113.214.251 443 SRPA* 0 0 29 14324 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:23.840944 4.652898 tcp 10.0.2.105 51505 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:34.418658 0.000000 tcp 10.0.2.105 51505 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:40.355587 0.032431 tcp 10.0.2.105 51506 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:40.388447 0.072505 tcp 10.0.2.105 51507 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:40.461378 0.155178 tcp 10.0.2.105 51508 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:40.674470 2.977156 tcp 10.0.2.105 51509 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:49.580350 0.000000 tcp 10.0.2.105 51509 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:28:55.513705 0.053431 tcp 10.0.2.105 51510 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:55.567508 0.075638 tcp 10.0.2.105 51511 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:55.643408 0.188347 tcp 10.0.2.105 51512 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:28:55.983640 2.965081 tcp 10.0.2.105 51513 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:05.989212 0.000000 tcp 10.0.2.105 51513 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:11.914850 0.034990 tcp 10.0.2.105 51514 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:29:11.950116 0.075992 tcp 10.0.2.105 51515 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:29:12.026364 0.169179 tcp 10.0.2.105 51516 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:29:12.305513 2.942408 tcp 10.0.2.105 51517 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:21.177886 0.000000 tcp 10.0.2.105 51517 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:27.122697 2.975375 tcp 10.0.2.105 51518 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:36.044927 0.000000 tcp 10.0.2.105 51518 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:40.831409 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:29:41.976678 2.978112 tcp 10.0.2.105 51519 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:50.888589 0.000000 tcp 10.0.2.105 51519 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:29:56.826784 2.974559 tcp 10.0.2.105 51520 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:30:04.569271 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:30:05.728924 0.000000 tcp 10.0.2.105 51520 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:30:22.500655 2.967060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:30:29.425185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:30:37.329355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:30:53.149932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:31:24.788982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:34:15.806909 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:34:15.807030 0.000000 udp 10.0.2.105 7010 -> 99.90.158.235 1799 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:34:34.475072 0.033864 tcp 10.0.2.105 51521 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:34.509329 0.071752 tcp 10.0.2.105 51522 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:34.581404 0.158467 tcp 10.0.2.105 51523 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:34.740446 0.118154 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:34.818927 1.413516 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:36.223224 0.208977 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:36.429600 0.061218 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:36.583640 0.206397 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:36.770762 0.294938 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.104402 1.964352 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 SPA_* 0 0 29 19689 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:37.122147 0.167387 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.268402 0.096037 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.347581 0.225761 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.573099 0.172637 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.738382 0.133851 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.931838 0.085164 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:37.996573 0.171984 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:38.173460 0.197204 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:38.363275 0.074010 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:38.646619 2.360890 udp 10.0.2.105 7010 <-> 1.160.227.76 7701 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:40.986308 0.171772 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:41.407338 0.081882 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:41.452687 0.075811 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:41.670284 0.235701 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:41.883732 0.175397 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:42.055100 0.180038 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:42.206923 0.401754 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 3 842 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:42.621566 0.069967 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:42.849966 0.073681 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:42.924187 0.164158 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:43.088861 0.050527 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:43.139844 0.130228 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:43.270582 0.292670 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:43.563753 1.154992 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:44.719212 0.146279 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:44.865959 0.076923 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:44.943448 0.215805 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 859 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.159814 0.164244 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.162134 4.430491 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 11 4938 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:45.324553 0.170875 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.496008 0.062485 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 820 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.558962 0.158032 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.717449 0.064677 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.782584 0.187619 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:45.970589 0.000000 udp 10.0.2.105 7010 -> 1.160.227.76 7701 REQ 0 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:34:52.369198 4.383939 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 13 6494 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:34:52.849662 0.146045 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 665 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:52.996167 0.055412 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.052017 0.046673 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.099288 0.217874 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.317636 0.168184 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.486283 0.148400 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.635118 0.047668 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:53.683271 0.450657 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:34:54.134610 0.000000 udp 10.0.2.105 7010 -> 216.176.233.194 1816 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:34:57.656926 4.306909 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 28 20648 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:01.372124 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:35:02.743379 4.577251 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 18 10260 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:02.974574 0.000000 udp 10.0.2.105 7010 -> 2.50.16.104 7283 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:08.125462 3.851560 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:10.045814 2.993079 tcp 10.0.2.105 51525 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:10.355356 0.000000 udp 10.0.2.105 7010 -> 115.240.81.66 3282 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:14.225448 2.667263 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:17.136843 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:19.038903 0.000000 tcp 10.0.2.105 51525 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:19.560465 3.212128 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:22.202182 0.000000 udp 10.0.2.105 7010 -> 87.23.194.227 8571 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:25.048459 0.059257 tcp 10.0.2.105 51526 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:25.088497 3.061551 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:25.108084 0.082853 tcp 10.0.2.105 51527 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:25.190767 0.168013 tcp 10.0.2.105 51528 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:25.879791 3.001660 tcp 10.0.2.105 51529 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:30.173430 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:30.402173 3.045855 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:34.879874 0.000000 tcp 10.0.2.105 51529 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:35.706135 3.069246 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:38.615666 0.000000 udp 10.0.2.105 7010 -> 109.151.46.15 9754 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:40.879193 0.051883 tcp 10.0.2.105 51530 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:40.931414 0.074311 tcp 10.0.2.105 51531 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:41.006098 0.157017 tcp 10.0.2.105 51532 -> 195.113.214.251 443 SRPA* 0 0 36 18262 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:41.025976 4.570797 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 30 18812 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:41.211211 3.002450 tcp 10.0.2.105 51533 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:45.916685 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:46.376552 4.656189 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3626 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:50.212765 0.000000 tcp 10.0.2.105 51533 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:53.167073 0.000000 udp 10.0.2.105 7010 -> 105.237.57.168 6590 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:35:56.211864 0.054210 tcp 10.0.2.105 51534 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:56.265939 0.068216 tcp 10.0.2.105 51535 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:56.334485 0.156833 tcp 10.0.2.105 51536 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:56.970217 2.998560 tcp 10.0.2.105 51537 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:35:57.453851 1.137642 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 5872 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:35:58.456996 0.000000 udp 10.0.2.105 7010 -> 188.39.108.130 9934 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:04.410189 2.453084 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:05.484530 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 1029 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:05.964758 0.000000 tcp 10.0.2.105 51537 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:11.835756 4.945731 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 11 6358 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:11.965599 0.054038 tcp 10.0.2.105 51538 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:12.019351 0.075943 tcp 10.0.2.105 51539 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:12.095617 0.211035 tcp 10.0.2.105 51540 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:12.615085 0.000000 udp 10.0.2.105 7010 -> 85.74.91.59 2536 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:12.690573 3.201932 tcp 10.0.2.105 51541 -> 46.48.247.67 29365 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:15.235466 0.053608 tcp 10.0.2.105 51542 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:15.289428 0.070282 tcp 10.0.2.105 51543 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:15.360100 0.162093 tcp 10.0.2.105 51544 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:15.892790 3.000673 tcp 10.0.2.105 51545 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:16.980019 3.838120 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 13 5074 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:18.443602 0.000000 udp 10.0.2.105 7010 -> 175.139.169.30 1036 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:22.241186 4.664695 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:24.944086 0.000000 tcp 10.0.2.105 51545 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:25.193042 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:27.469744 4.443475 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 23 15578 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:30.893961 3.000908 tcp 10.0.2.105 51546 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:31.202427 0.000000 udp 10.0.2.105 7010 -> 79.103.251.83 6056 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:33.036155 4.274767 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 23 14274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:38.421833 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:38.792626 4.851803 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:39.893535 0.000000 tcp 10.0.2.105 51546 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:45.063955 3.052106 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:45.894018 3.002489 tcp 10.0.2.105 51547 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:46.423627 0.000000 udp 10.0.2.105 7010 -> 79.33.225.176 2977 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:50.352442 3.050269 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:51.810482 1.022554 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:36:52.873921 0.166691 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:36:53.668629 0.000000 udp 10.0.2.105 7010 -> 210.148.158.192 6452 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:36:53.873272 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:36:54.894972 0.000000 tcp 10.0.2.105 51547 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:36:55.656555 3.036302 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:36:58.963074 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:00.893702 2.994382 tcp 10.0.2.105 51548 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:37:00.960349 3.837849 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:06.217748 4.867102 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 10 6304 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:07.934217 0.000000 udp 10.0.2.105 7010 -> 142.217.42.69 7001 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:09.897097 0.000000 tcp 10.0.2.105 51548 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:37:11.279488 2.473105 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 6 1800 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:15.425169 0.000000 udp 10.0.2.105 7010 -> 79.177.165.125 6117 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:15.895641 0.433613 tcp 10.0.2.105 51549 -> 46.48.247.67 29365 SPA_* 0 0 9 1002 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:16.419845 3.048013 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:21.724550 0.000171 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:22.725306 0.000000 udp 10.0.2.105 7010 -> 211.186.137.130 9022 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:26.856391 2.667724 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:28.046575 3.005043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:37:29.728501 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:34.672342 2.667525 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:35.052885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:37:38.528893 0.000000 udp 10.0.2.105 7010 -> 80.176.170.210 4753 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:39.879778 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:37:42.487677 2.909118 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:43.058047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:37:46.260144 0.354439 tcp 10.0.2.105 51549 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:46.770154 0.045606 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:37:46.901523 0.000000 udp 10.0.2.105 7010 -> 90.36.165.7 4370 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:50.584031 2.699187 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:54.261850 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:37:58.415302 2.636569 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:37:59.060749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:38:02.402356 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:06.183935 2.652206 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:10.584316 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:11.375074 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:38:18.944901 0.401991 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:19.176562 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:24.093014 0.401168 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:26.216912 0.000000 udp 10.0.2.105 7010 -> 114.198.144.114 1528 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:31.063655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:38:32.705957 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:34.201876 0.396882 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:37.372715 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:38:38.205264 0.000000 udp 10.0.2.105 7010 -> 91.125.39.225 9540 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:39.334091 0.401970 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:45.674925 0.000000 udp 10.0.2.105 7010 -> 82.89.175.71 6750 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:49.427485 3.697194 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 23 12826 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:51.052596 0.000000 udp 10.0.2.105 7010 -> 97.68.189.86 7844 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:38:54.825001 4.867572 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 21 14566 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:38:56.480767 0.000000 udp 10.0.2.105 7010 -> 82.18.65.99 9386 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:00.472363 3.775190 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:01.376908 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:39:02.940978 0.000000 udp 10.0.2.105 7010 -> 108.40.86.106 2488 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:07.195958 3.603708 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 14 9444 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:10.179882 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:12.203481 4.851754 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 13 6494 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:17.591502 0.467878 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:39:18.203934 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:19.691548 4.468025 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 11 4938 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:25.182857 4.227539 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 18 10716 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:26.423363 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:30.190527 3.743167 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 25 18726 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:32.892306 0.000000 udp 10.0.2.105 7010 -> 87.22.242.193 4057 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:35.338521 2.652040 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 6 3220 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:38.410451 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:40.642237 2.668020 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3690 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:43.377946 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:39:45.955676 4.499668 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 17 8158 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:46.492127 0.000000 udp 10.0.2.105 7010 -> 78.183.24.59 7209 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:51.250283 4.785036 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 15 10222 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:39:52.060060 0.000000 udp 10.0.2.105 7010 -> 123.231.247.78 8032 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:57.628194 0.000000 udp 10.0.2.105 7010 -> 183.63.11.107 1043 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:39:58.301543 3.073402 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:03.621514 4.040482 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 18 10384 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:04.898664 0.138294 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:40:05.248851 1.022611 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 652 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:40:06.436655 0.062200 udp 10.0.2.105 7010 <-> 86.160.30.118 7670 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:40:06.946654 0.000000 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:10.313558 3.043663 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:12.338660 0.272196 udp 10.0.2.105 7010 <-> 124.121.237.99 8909 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:40:12.769913 0.000000 udp 10.0.2.105 7010 -> 93.41.183.69 6234 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:15.602258 2.667652 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:20.922226 3.431758 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 20 11216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:21.327730 0.000000 udp 10.0.2.105 7010 -> 24.212.198.198 1160 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:27.005627 3.093418 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 9 4830 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:29.728158 0.000000 udp 10.0.2.105 7010 -> 88.252.158.249 1830 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:31.835169 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:40:32.294138 3.046521 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:35.569883 0.322808 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:40:36.219133 0.000000 udp 10.0.2.105 7010 -> 86.149.212.160 7502 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:37.585868 4.052794 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:42.219085 0.000000 udp 10.0.2.105 7010 -> 180.242.46.162 2020 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:43.058132 4.072206 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:48.599716 0.000000 udp 10.0.2.105 7010 -> 122.164.171.30 4003 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:49.922287 4.711251 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 22 11324 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:40:54.809161 0.066939 udp 10.0.2.105 7010 -> 84.173.23.19 7912 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:40:54.876100 0.000000 icmp 84.173.23.19 0x0303 -> 10.0.2.105 0xe81e URP 192 1 168 flow=Background 1970/02/07 00:40:55.616173 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:40:57.301065 0.398076 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:02.589534 0.000000 udp 10.0.2.105 7010 -> 62.103.214.8 4029 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:02.745296 3.101046 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:10.423236 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:10.592422 2.651886 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:18.376729 1.420105 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:18.654398 0.000000 udp 10.0.2.105 7010 -> 86.179.173.243 9633 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:23.370812 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:41:24.502886 0.000000 udp 10.0.2.105 7010 -> 46.190.95.194 4277 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:24.912938 3.046171 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:31.944826 0.373340 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:41:32.441982 0.000000 udp 10.0.2.105 7010 -> 84.177.1.43 4751 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:32.681795 3.047241 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:40.466311 0.400471 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:40.616930 0.000000 udp 10.0.2.105 7010 -> 59.90.0.252 1201 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:45.583393 0.780008 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:41:47.516171 0.000000 udp 10.0.2.105 7010 -> 82.53.15.185 2142 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:55.359499 3.428520 udp 10.0.2.105 7010 -> 175.140.177.196 6770 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:41:58.788019 0.000000 icmp 175.140.177.196 0x0103 -> 10.0.2.105 0xaf8c URH 192 1 185 flow=Background 1970/02/07 00:41:59.874643 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:42:04.250809 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9897 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:05.597334 0.000400 tcp 10.0.2.105 51524 -> 58.177.94.240 9222 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:42:09.878513 0.344031 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:42:10.579548 0.089774 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:42:10.730659 0.000000 udp 10.0.2.105 7010 -> 78.182.235.16 6681 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:18.730912 0.000000 udp 10.0.2.105 7010 -> 80.37.229.85 5794 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:27.152890 0.069633 udp 10.0.2.105 7010 -> 92.198.65.172 6016 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:27.222523 0.000000 icmp 92.198.65.172 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 118 flow=Background 1970/02/07 00:42:31.879438 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:42:33.041532 0.000000 udp 10.0.2.105 7010 -> 178.148.140.186 7939 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:40.692205 0.000000 udp 10.0.2.105 7010 -> 151.51.8.142 3242 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:46.261007 3.003730 tcp 10.0.2.105 51550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:42:47.632645 0.000000 udp 10.0.2.105 7010 -> 206.217.86.130 8951 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:53.691312 0.000000 udp 10.0.2.105 7010 -> 121.54.22.85 2129 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:42:55.263389 0.000000 tcp 10.0.2.105 51550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:42:58.377837 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:42:59.108929 0.329750 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:42:59.522344 0.000000 udp 10.0.2.105 7010 -> 88.232.32.213 1029 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:01.264823 0.053320 tcp 10.0.2.105 51551 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:01.318449 0.075324 tcp 10.0.2.105 51552 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:01.394073 0.168518 tcp 10.0.2.105 51553 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:01.583734 3.003222 tcp 10.0.2.105 51554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:07.110367 0.000000 udp 10.0.2.105 7010 -> 91.223.224.162 1055 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:10.585501 0.000000 tcp 10.0.2.105 51554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:14.641230 0.208774 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:43:14.985729 0.000000 udp 10.0.2.105 7010 -> 183.14.32.249 6315 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:16.584675 0.052074 tcp 10.0.2.105 51555 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:16.637063 0.076336 tcp 10.0.2.105 51556 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:16.713631 0.163983 tcp 10.0.2.105 51557 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:17.061952 2.996946 tcp 10.0.2.105 51558 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:23.844715 0.000000 udp 10.0.2.105 7010 -> 173.216.13.206 1949 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:26.057469 0.000000 tcp 10.0.2.105 51558 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:29.833678 0.000000 udp 10.0.2.105 7010 -> 77.239.149.134 7709 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:32.057105 0.053702 tcp 10.0.2.105 51559 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:32.110848 0.070955 tcp 10.0.2.105 51560 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:32.182146 0.156768 tcp 10.0.2.105 51561 -> 195.113.214.251 443 SRPA* 0 0 38 19830 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:32.620101 3.001285 tcp 10.0.2.105 51562 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:36.982935 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:41.620005 0.000000 tcp 10.0.2.105 51562 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:42.258541 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 539 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:42.327971 0.000000 udp 10.0.2.105 7010 -> 121.7.239.32 3616 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:47.619568 0.052688 tcp 10.0.2.105 51563 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:47.672585 0.075481 tcp 10.0.2.105 51564 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:47.748359 0.156372 tcp 10.0.2.105 51565 -> 195.113.214.251 443 SRPA* 0 0 45 40350 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:47.953169 4.444442 tcp 10.0.2.105 51566 -> 46.48.247.67 29365 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:50.052284 0.000000 udp 10.0.2.105 7010 -> 200.55.153.18 4376 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:43:51.806172 0.042558 tcp 10.0.2.105 51567 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:51.849102 0.070794 tcp 10.0.2.105 51568 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:51.920359 0.160601 tcp 10.0.2.105 51569 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:43:52.397643 3.002056 tcp 10.0.2.105 51570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:43:57.202438 0.000000 udp 10.0.2.105 7010 -> 78.147.168.80 8307 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:01.398591 0.000000 tcp 10.0.2.105 51570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:04.733479 0.000000 udp 10.0.2.105 7010 -> 85.39.108.122 2907 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:07.422515 2.986972 tcp 10.0.2.105 51571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:11.274079 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:15.930181 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:44:16.447578 0.000000 tcp 10.0.2.105 51571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:18.613664 0.000000 udp 10.0.2.105 7010 -> 176.61.121.157 8525 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:22.399109 3.003516 tcp 10.0.2.105 51572 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:24.381566 0.238429 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:44:24.935591 0.000000 udp 10.0.2.105 7010 -> 86.209.204.112 6495 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:31.401647 0.000000 tcp 10.0.2.105 51572 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:32.643344 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 1628 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:35.070562 3.000691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:44:37.400438 3.004083 tcp 10.0.2.105 51573 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:39.653483 0.000000 udp 10.0.2.105 7010 -> 95.244.103.63 1675 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:42.077883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:44:42.377907 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:44:46.403487 0.000000 tcp 10.0.2.105 51573 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:44:46.673871 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1203 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:44:50.078719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:44:52.403118 2.850894 tcp 10.0.2.105 51574 -> 46.48.247.67 29365 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:44:54.637111 0.000000 udp 10.0.2.105 7010 -> 37.116.177.233 5312 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:02.848195 0.000000 udp 10.0.2.105 7010 -> 98.174.84.93 6094 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:06.082888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:45:08.655424 0.000000 udp 10.0.2.105 7010 -> 82.36.214.47 7141 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:17.590845 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:22.374811 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:45:26.370818 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:35.223887 0.000000 udp 10.0.2.105 7010 -> 86.147.57.116 7463 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:38.087381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:45:41.915974 0.217313 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:45:42.170495 0.102053 udp 10.0.2.105 7010 -> 2.118.253.193 5461 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:42.272548 0.000000 icmp 82.189.163.114 0x0303 -> 10.0.2.105 0x5515 URP 192 1 300 flow=Background 1970/02/07 00:45:46.879530 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:45:49.233521 0.000000 udp 10.0.2.105 7010 -> 42.61.210.200 8794 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:45:57.555640 0.307215 udp 10.0.2.105 7010 <-> 121.129.137.8 2286 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:45:58.002983 0.000000 udp 10.0.2.105 7010 -> 94.33.35.200 9245 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:06.077984 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:10.874732 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:46:13.508091 0.000000 udp 10.0.2.105 7010 -> 93.67.209.214 5922 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:21.910907 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:27.679125 0.000000 udp 10.0.2.105 7010 -> 174.49.105.22 2340 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:34.408077 0.000000 udp 10.0.2.105 7010 -> 88.148.215.234 2745 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:39.375509 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:46:41.919236 0.316798 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/07 00:46:42.256145 0.000000 udp 10.0.2.105 7010 -> 96.37.197.118 6719 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:50.111296 0.000000 udp 10.0.2.105 7010 -> 1.55.94.217 3728 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:46:56.790454 0.000000 udp 10.0.2.105 7010 -> 109.170.129.24 7785 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:02.018265 0.000000 udp 10.0.2.105 7010 -> 76.187.42.197 8335 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:06.875035 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:47:08.787892 0.000000 udp 10.0.2.105 7010 -> 110.143.100.133 4715 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:17.570445 0.000000 udp 10.0.2.105 7010 -> 87.10.236.93 1101 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:26.103093 0.000000 udp 10.0.2.105 7010 -> 186.176.164.63 7619 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:30.879503 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:47:33.803921 0.000000 udp 10.0.2.105 7010 -> 88.45.216.34 2242 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:39.221845 0.000000 udp 10.0.2.105 7010 -> 108.238.166.38 8740 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:47:44.279714 0.000000 udp 10.0.2.105 7010 -> 95.237.98.145 7737 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 00:49:55.249362 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:49:55.249463 3.001987 tcp 10.0.2.105 51575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:04.250091 0.000000 tcp 10.0.2.105 51575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:10.250208 0.035012 tcp 10.0.2.105 51576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:10.285491 0.069826 tcp 10.0.2.105 51577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:10.355609 0.165979 tcp 10.0.2.105 51578 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:10.558921 3.004432 tcp 10.0.2.105 51579 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:19.562005 0.000000 tcp 10.0.2.105 51579 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:25.552507 0.075302 tcp 10.0.2.105 51580 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:25.628113 0.074994 tcp 10.0.2.105 51581 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:25.703435 0.163508 tcp 10.0.2.105 51582 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:25.878564 2.984087 tcp 10.0.2.105 51583 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:34.844040 0.000000 tcp 10.0.2.105 51583 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:40.843435 0.030274 tcp 10.0.2.105 51584 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:40.873979 0.075449 tcp 10.0.2.105 51585 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:40.949697 0.157479 tcp 10.0.2.105 51586 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:42.229349 2.999710 tcp 10.0.2.105 51587 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:51.227751 0.000000 tcp 10.0.2.105 51587 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:50:57.227130 0.033806 tcp 10.0.2.105 51588 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:57.261296 0.080510 tcp 10.0.2.105 51589 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:57.342066 0.158712 tcp 10.0.2.105 51590 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:50:57.564108 0.351411 tcp 10.0.2.105 51591 -> 46.48.247.67 29365 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:51:27.910863 0.057821 tcp 10.0.2.105 51592 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:51:27.969054 0.076960 tcp 10.0.2.105 51593 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:51:27.998115 0.255883 tcp 10.0.2.105 51591 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:51:28.046356 0.165685 tcp 10.0.2.105 51594 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:51:28.254299 3.000968 tcp 10.0.2.105 51595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:51:37.253654 0.000000 tcp 10.0.2.105 51595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:51:43.252432 3.003955 tcp 10.0.2.105 51596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:51:52.255527 0.000000 tcp 10.0.2.105 51596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:51:56.872152 0.000266 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:51:58.254735 2.994060 tcp 10.0.2.105 51597 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:52:07.257015 0.000000 tcp 10.0.2.105 51597 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:52:13.257595 2.991920 tcp 10.0.2.105 51598 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:52:22.125647 0.000320 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:52:23.481379 0.000000 tcp 10.0.2.105 51598 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:52:29.417020 0.354902 tcp 10.0.2.105 51599 -> 46.48.247.67 29365 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:52:58.837060 0.000337 tcp 10.0.2.105 51599 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:54:50.094457 3.000811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 00:54:57.101866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:55:05.102224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:55:21.105075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:55:53.111552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 00:57:58.031926 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 00:57:58.032028 3.004731 tcp 10.0.2.105 51600 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:07.034189 0.000000 tcp 10.0.2.105 51600 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:13.034852 0.056709 tcp 10.0.2.105 51601 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:13.091868 0.074966 tcp 10.0.2.105 51602 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:13.167161 0.161574 tcp 10.0.2.105 51603 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:13.352760 2.995033 tcp 10.0.2.105 51604 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:22.356021 0.000000 tcp 10.0.2.105 51604 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:28.346444 0.051949 tcp 10.0.2.105 51605 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:28.398739 0.067623 tcp 10.0.2.105 51606 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:28.466712 0.151518 tcp 10.0.2.105 51607 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:28.629859 2.999960 tcp 10.0.2.105 51608 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:37.628537 0.000000 tcp 10.0.2.105 51608 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:43.627765 0.053535 tcp 10.0.2.105 51609 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:43.681658 0.077613 tcp 10.0.2.105 51610 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:43.759615 0.162121 tcp 10.0.2.105 51611 -> 195.113.214.251 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:43.934180 2.998833 tcp 10.0.2.105 51612 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:52.930257 0.000000 tcp 10.0.2.105 51612 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:58:58.929613 0.086825 tcp 10.0.2.105 51613 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:59.016771 0.071845 tcp 10.0.2.105 51614 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:59.088467 0.156961 tcp 10.0.2.105 51615 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:58:59.262279 1.076591 tcp 10.0.2.105 51616 -> 46.48.247.67 29365 SPA_* 0 0 9 1048 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:59:30.152977 0.462171 tcp 10.0.2.105 51616 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:59:30.204731 0.052902 tcp 10.0.2.105 51617 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:59:30.258024 0.072289 tcp 10.0.2.105 51618 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:59:30.330584 0.160510 tcp 10.0.2.105 51619 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 00:59:30.615593 3.219982 tcp 10.0.2.105 51620 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:59:39.799313 0.000000 tcp 10.0.2.105 51620 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:59:45.732776 2.964352 tcp 10.0.2.105 51621 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:59:54.641456 0.000000 tcp 10.0.2.105 51621 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 00:59:59.132982 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:00:00.594732 2.970962 tcp 10.0.2.105 51622 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:00:09.508917 0.000000 tcp 10.0.2.105 51622 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:00:15.449050 2.973364 tcp 10.0.2.105 51623 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:00:22.906002 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:00:24.362949 0.000000 tcp 10.0.2.105 51623 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:00:30.350077 2.936675 tcp 10.0.2.105 51624 -> 46.48.247.67 29365 FSPA* 0 0 13 1264 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:01:57.118059 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:02:04.125067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:02:12.126766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:02:28.129776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:03:00.135818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:09:05.143394 3.177261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 01:09:12.286344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:09:20.215049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:09:36.165070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:10:08.181411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:16:12.187449 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 01:16:19.194238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:16:27.199151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:16:43.198822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:17:15.205491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:18:08.943402 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:18:08.943642 0.077229 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:09.022213 3.004465 tcp 10.0.2.105 51625 -> 81.156.70.255 6663 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:09.030829 0.110057 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:09.104043 0.193101 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:09.294285 0.150583 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:09.430284 0.297354 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:09.948235 0.087739 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:10.018879 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:18.024751 0.000000 tcp 10.0.2.105 51625 -> 81.156.70.255 6663 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:18.365909 2.994285 tcp 10.0.2.105 51626 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:26.770926 0.346160 tcp 10.0.2.105 51627 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:27.117358 0.071257 tcp 10.0.2.105 51628 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:27.188885 0.158047 tcp 10.0.2.105 51629 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:27.347516 0.083007 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:27.420830 0.166851 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:27.566429 0.173002 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:27.731622 0.126954 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:27.827629 0.087146 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:27.893258 0.173645 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:28.103448 0.075558 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:28.266610 0.197731 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:28.345540 0.000000 tcp 10.0.2.105 51626 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:28.461282 0.070754 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:28.516569 0.176556 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:29.475780 0.088414 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:29.526116 0.175132 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2016 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:29.806560 0.178579 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:29.956359 0.067491 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:30.381471 0.404349 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:30.839490 0.237087 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:31.052950 0.169401 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:31.217516 0.000000 udp 10.0.2.105 7010 -> 14.96.131.87 6114 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:34.289346 0.093083 tcp 10.0.2.105 51630 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:34.382791 0.077991 tcp 10.0.2.105 51631 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:34.461117 0.159178 tcp 10.0.2.105 51632 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:34.954447 2.967068 tcp 10.0.2.105 51633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:39.312804 0.518791 udp 10.0.2.105 7010 <- 14.96.131.87 6114 RSP 0 0 5 2025 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:39.313242 0.220090 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:39.313571 4.999114 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 SPA_* 0 0 132 74818 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:39.361625 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:43.851632 0.000000 tcp 10.0.2.105 51633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:44.380860 4.984037 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 A_PA 0 0 166 94980 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:44.602586 0.013558 udp 10.0.2.105 7010 <- 76.217.180.151 1314 RSP 0 0 5 2126 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:44.603030 0.144976 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:18:45.158646 0.000000 udp 10.0.2.105 7010 -> 86.160.30.118 7670 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:18:49.417092 4.991459 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 A_PA 0 0 200 124860 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:49.836208 0.035322 tcp 10.0.2.105 51635 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:49.871320 0.075375 tcp 10.0.2.105 51636 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:49.946951 0.158216 tcp 10.0.2.105 51637 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:50.192912 2.975568 tcp 10.0.2.105 51638 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:54.581304 4.916302 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 A_PA 0 0 157 93074 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:18:59.189428 0.000000 tcp 10.0.2.105 51638 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:18:59.616719 4.991997 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 A_PA 0 0 205 123710 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:00.722636 0.033882 tcp 10.0.2.105 51639 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:00.756825 0.074758 tcp 10.0.2.105 51640 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:00.832095 0.151687 tcp 10.0.2.105 51641 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:00.984468 0.371629 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:01.334506 0.000000 udp 10.0.2.105 7010 -> 124.121.237.99 8909 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:19:04.635091 4.833516 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 A_PA 0 0 160 106944 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:05.104524 0.052405 tcp 10.0.2.105 51642 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:05.157251 0.071239 tcp 10.0.2.105 51643 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:05.228814 0.152264 tcp 10.0.2.105 51644 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:05.746500 2.959878 tcp 10.0.2.105 51645 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:09.794783 4.278059 tcp 10.0.2.105 51634 -> 14.96.131.87 9641 FPA_* 0 0 92 55659 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:14.660225 0.000000 tcp 10.0.2.105 51645 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:19.963563 0.053506 tcp 10.0.2.105 51646 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:20.017362 0.071257 tcp 10.0.2.105 51647 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:20.088932 0.166907 tcp 10.0.2.105 51648 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:20.256530 0.322630 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:20.575980 3.564982 tcp 10.0.2.105 51649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:20.862455 0.374400 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:21.234286 0.099237 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:21.488386 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:19:30.079202 0.000000 tcp 10.0.2.105 51649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:36.007022 2.951863 tcp 10.0.2.105 51650 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:36.946275 0.054220 tcp 10.0.2.105 51651 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:37.000797 0.067952 tcp 10.0.2.105 51652 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:37.069119 0.171578 tcp 10.0.2.105 51653 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:37.242098 0.328280 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:37.834609 0.218905 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:38.045984 4.915660 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:42.860791 0.242038 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:43.225591 0.226549 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:19:43.441256 0.000000 udp 10.0.2.105 7010 -> 121.129.137.8 2286 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:19:44.889297 0.000000 tcp 10.0.2.105 51650 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:19:58.902471 0.052717 tcp 10.0.2.105 51654 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:58.955534 0.076303 tcp 10.0.2.105 51655 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:59.032141 0.166459 tcp 10.0.2.105 51656 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:19:59.199149 0.315484 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:23:19.211364 3.001625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:23:26.219095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:23:34.219786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:23:50.223114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:24:22.229781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:24:50.038841 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:24:50.038937 3.004537 tcp 10.0.2.105 51657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:24:59.041823 0.000000 tcp 10.0.2.105 51657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:05.042371 0.054817 tcp 10.0.2.105 51658 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:05.097425 0.146489 tcp 10.0.2.105 51659 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:05.244214 0.170416 tcp 10.0.2.105 51660 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:05.563792 3.001877 tcp 10.0.2.105 51661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:14.564243 0.000000 tcp 10.0.2.105 51661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:20.564231 0.033948 tcp 10.0.2.105 51662 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:20.598559 0.070725 tcp 10.0.2.105 51663 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:20.669141 0.172029 tcp 10.0.2.105 51664 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:20.867666 3.000394 tcp 10.0.2.105 51665 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:29.876175 0.000000 tcp 10.0.2.105 51665 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:35.865317 0.047524 tcp 10.0.2.105 51666 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:35.913162 0.082018 tcp 10.0.2.105 51667 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:35.995507 0.166279 tcp 10.0.2.105 51668 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:36.457576 1.420053 tcp 10.0.2.105 51669 -> 46.48.223.67 15494 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:50.202482 0.700295 tcp 10.0.2.105 51669 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:50.203244 0.054489 tcp 10.0.2.105 51670 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:50.258095 0.073347 tcp 10.0.2.105 51671 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:50.331739 0.162706 tcp 10.0.2.105 51672 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:25:50.903011 2.997585 tcp 10.0.2.105 51673 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:25:59.899430 0.000000 tcp 10.0.2.105 51673 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:26:05.898739 0.030502 tcp 10.0.2.105 51674 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:05.929566 0.077365 tcp 10.0.2.105 51675 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:06.007218 0.151530 tcp 10.0.2.105 51676 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:06.349006 3.003816 tcp 10.0.2.105 51677 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:26:15.351618 0.000000 tcp 10.0.2.105 51677 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:26:21.351404 0.055857 tcp 10.0.2.105 51678 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:21.407141 0.075623 tcp 10.0.2.105 51679 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:21.483163 0.168176 tcp 10.0.2.105 51680 -> 195.113.214.251 443 SRPA* 0 0 28 11890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:22.133631 1.601139 tcp 10.0.2.105 51681 -> 46.48.247.67 29365 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:36.342943 0.410169 tcp 10.0.2.105 51681 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:36.343721 0.051944 tcp 10.0.2.105 51682 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:36.396146 0.074884 tcp 10.0.2.105 51683 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:36.471320 0.157506 tcp 10.0.2.105 51684 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:26:36.753337 3.005438 tcp 10.0.2.105 51685 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:26:45.755413 0.000000 tcp 10.0.2.105 51685 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:26:51.755229 2.993412 tcp 10.0.2.105 51686 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:00.757282 0.000000 tcp 10.0.2.105 51686 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:05.373494 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:27:06.755954 2.993957 tcp 10.0.2.105 51687 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:15.750978 0.000000 tcp 10.0.2.105 51687 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:21.757288 3.748070 tcp 10.0.2.105 51688 -> 46.48.223.67 15494 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:27:25.503169 3.003539 tcp 10.0.2.105 51689 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:34.508478 0.000000 tcp 10.0.2.105 51689 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:40.504399 2.994172 tcp 10.0.2.105 51690 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:49.507096 0.000000 tcp 10.0.2.105 51690 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:27:54.375381 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:27:55.505794 0.375853 tcp 10.0.2.105 51691 -> 46.48.247.67 29365 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:28:22.811338 0.000358 tcp 10.0.2.105 51691 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:30:26.236103 3.001214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:30:33.242266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:30:41.243851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:30:57.246890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:31:29.263533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:33:22.807295 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:33:22.807478 2.993140 tcp 10.0.2.105 51692 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:33:31.798689 0.000000 tcp 10.0.2.105 51692 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:33:37.809879 0.030959 tcp 10.0.2.105 51693 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:37.841109 0.075338 tcp 10.0.2.105 51694 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:37.916829 0.155359 tcp 10.0.2.105 51695 -> 195.113.214.251 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:38.529207 2.993527 tcp 10.0.2.105 51696 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:33:47.522710 0.000000 tcp 10.0.2.105 51696 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:33:53.526158 0.031503 tcp 10.0.2.105 51697 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:53.557954 0.074531 tcp 10.0.2.105 51698 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:53.632753 0.158090 tcp 10.0.2.105 51699 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:33:54.763089 3.006493 tcp 10.0.2.105 51700 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:03.765498 0.000000 tcp 10.0.2.105 51700 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:09.754341 0.056338 tcp 10.0.2.105 51701 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:09.811019 0.076117 tcp 10.0.2.105 51702 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:09.887493 0.157902 tcp 10.0.2.105 51703 -> 195.113.214.251 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:10.107255 2.407005 tcp 10.0.2.105 51704 -> 46.48.223.67 15494 FSPA* 0 0 14 1692 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:11.885110 0.054662 tcp 10.0.2.105 51705 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:11.939606 0.104844 tcp 10.0.2.105 51706 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:12.044772 0.169257 tcp 10.0.2.105 51707 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:12.514546 3.000227 tcp 10.0.2.105 51708 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:21.510647 0.000000 tcp 10.0.2.105 51708 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:27.510012 0.055452 tcp 10.0.2.105 51709 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:27.565732 0.075314 tcp 10.0.2.105 51710 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:27.641382 0.165184 tcp 10.0.2.105 51711 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:28.081533 2.976596 tcp 10.0.2.105 51712 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:37.005562 0.000000 tcp 10.0.2.105 51712 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:34:42.955325 1.148158 tcp 10.0.2.105 51713 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:44.103784 0.074688 tcp 10.0.2.105 51714 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:44.178724 0.158698 tcp 10.0.2.105 51715 -> 195.113.214.251 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:34:44.524563 0.353578 tcp 10.0.2.105 51716 -> 46.48.247.67 29365 SPA_* 0 0 9 1162 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:35:11.123806 0.538125 tcp 10.0.2.105 51716 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:35:11.124727 0.031247 tcp 10.0.2.105 51717 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:35:11.155850 0.075291 tcp 10.0.2.105 51718 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:35:11.231438 0.158463 tcp 10.0.2.105 51719 -> 195.113.214.251 443 SRPA* 0 0 35 19570 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:35:11.662164 2.978561 tcp 10.0.2.105 51720 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:20.572143 0.000000 tcp 10.0.2.105 51720 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:26.487324 2.966168 tcp 10.0.2.105 51721 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:35.390832 0.000000 tcp 10.0.2.105 51721 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:39.839952 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:35:41.305895 2.957797 tcp 10.0.2.105 51722 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:50.191953 0.000000 tcp 10.0.2.105 51722 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:35:56.129104 1.126016 tcp 10.0.2.105 51723 -> 46.48.223.67 15494 SPA_* 0 0 9 1162 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:36:26.994445 0.350355 tcp 10.0.2.105 51723 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:36:26.994839 3.000310 tcp 10.0.2.105 51724 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:36:35.993802 0.000000 tcp 10.0.2.105 51724 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:36:41.994628 3.002267 tcp 10.0.2.105 51725 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:36:50.995920 0.000000 tcp 10.0.2.105 51725 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:36:55.872700 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:36:56.994134 1.045217 tcp 10.0.2.105 51726 -> 46.48.247.67 29365 SPA_* 0 0 9 1162 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:37:12.044669 0.000380 tcp 10.0.2.105 51726 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:37:33.268891 3.002617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:37:40.275893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:37:48.277896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:38:04.280981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:38:36.287085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:42:12.038236 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:42:12.038347 3.003266 tcp 10.0.2.105 51727 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:21.040205 0.000000 tcp 10.0.2.105 51727 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:27.040645 0.032051 tcp 10.0.2.105 51728 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:27.072978 0.076023 tcp 10.0.2.105 51729 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:27.149300 0.160316 tcp 10.0.2.105 51730 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:27.349552 3.003928 tcp 10.0.2.105 51731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:36.352086 0.000000 tcp 10.0.2.105 51731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:42.341092 0.054346 tcp 10.0.2.105 51732 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:42.395760 0.074849 tcp 10.0.2.105 51733 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:42.470905 0.157686 tcp 10.0.2.105 51734 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:42.638372 3.007427 tcp 10.0.2.105 51735 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:51.643836 0.000000 tcp 10.0.2.105 51735 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:42:57.633289 0.052858 tcp 10.0.2.105 51736 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:57.686414 0.072689 tcp 10.0.2.105 51737 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:57.759122 0.161760 tcp 10.0.2.105 51738 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:42:58.167934 0.428673 tcp 10.0.2.105 51739 -> 46.48.223.67 15494 SPA_* 0 0 9 1032 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:03.398815 0.308760 tcp 10.0.2.105 51739 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:03.399722 0.052000 tcp 10.0.2.105 51740 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:03.451519 0.076404 tcp 10.0.2.105 51741 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:03.527695 0.163133 tcp 10.0.2.105 51742 -> 195.113.214.251 443 SRPA* 0 0 40 33104 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:03.707862 3.007804 tcp 10.0.2.105 51743 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:43:12.716187 0.000000 tcp 10.0.2.105 51743 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:43:19.060960 0.059617 tcp 10.0.2.105 51744 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:19.120876 0.083496 tcp 10.0.2.105 51745 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:19.204071 0.166709 tcp 10.0.2.105 51746 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:19.743875 2.967644 tcp 10.0.2.105 51747 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:43:28.663895 0.000000 tcp 10.0.2.105 51747 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:43:34.596911 0.031498 tcp 10.0.2.105 51748 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:34.628157 0.072294 tcp 10.0.2.105 51749 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:34.700787 0.158503 tcp 10.0.2.105 51750 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:35.123070 0.800676 tcp 10.0.2.105 51751 -> 46.48.247.67 29365 SPA_* 0 0 9 1032 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:44.754377 1.907532 tcp 10.0.2.105 51751 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:44.755130 0.031578 tcp 10.0.2.105 51752 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:44.787038 0.139525 tcp 10.0.2.105 51753 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:44.927076 0.163092 tcp 10.0.2.105 51754 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:43:46.662192 2.984720 tcp 10.0.2.105 51755 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:43:55.597545 0.000000 tcp 10.0.2.105 51755 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:01.564868 2.993897 tcp 10.0.2.105 51756 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:10.567622 0.000000 tcp 10.0.2.105 51756 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:15.374715 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:44:16.567021 2.993564 tcp 10.0.2.105 51757 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:25.558838 0.000000 tcp 10.0.2.105 51757 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:31.569442 0.500357 tcp 10.0.2.105 51758 -> 46.48.223.67 15494 SPA_* 0 0 9 1032 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:44:36.888019 0.000579 tcp 10.0.2.105 51758 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:44:36.888724 3.000832 tcp 10.0.2.105 51759 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:40.293023 3.001732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:44:45.890290 0.000000 tcp 10.0.2.105 51759 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:47.301697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:44:51.887332 3.003860 tcp 10.0.2.105 51760 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:44:55.301882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:45:00.889744 0.000000 tcp 10.0.2.105 51760 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:45:05.877001 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:45:06.889063 2.802143 tcp 10.0.2.105 51761 -> 46.48.247.67 29365 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:45:11.305309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:45:43.310963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:50:09.684259 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:50:09.684450 2.993838 tcp 10.0.2.105 51762 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:50:18.686787 0.000000 tcp 10.0.2.105 51762 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:50:23.574345 0.221255 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:50:23.795962 0.000000 udp 10.0.2.105 7010 -> 86.160.30.118 7670 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:50:24.687880 0.054415 tcp 10.0.2.105 51763 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:24.742594 0.070526 tcp 10.0.2.105 51764 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:24.812944 0.167109 tcp 10.0.2.105 51765 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:25.019988 3.000172 tcp 10.0.2.105 51766 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:50:34.018463 0.000000 tcp 10.0.2.105 51766 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:50:39.887896 0.030688 tcp 10.0.2.105 51767 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:39.918878 0.074830 tcp 10.0.2.105 51768 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:39.993500 0.152329 tcp 10.0.2.105 51769 -> 195.113.214.251 443 SRPA* 0 0 35 19368 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:40.017867 0.063906 tcp 10.0.2.105 51770 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:40.082114 0.075693 tcp 10.0.2.105 51771 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:40.144477 0.000000 udp 10.0.2.105 7010 -> 124.121.237.99 8909 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:50:40.158104 0.185529 tcp 10.0.2.105 51772 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:40.528585 3.429864 tcp 10.0.2.105 51773 -> 46.48.223.67 15494 SPA_* 0 0 8 1072 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:48.548307 0.297390 tcp 10.0.2.105 51773 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:48.549348 0.032921 tcp 10.0.2.105 51774 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:48.582121 0.074263 tcp 10.0.2.105 51775 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:48.656716 0.156041 tcp 10.0.2.105 51776 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:48.845905 2.998707 tcp 10.0.2.105 51777 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:50:56.141262 0.055150 tcp 10.0.2.105 51778 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:56.196754 0.073299 tcp 10.0.2.105 51779 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:56.270393 0.232656 tcp 10.0.2.105 51780 -> 195.113.214.251 443 SRPA* 0 0 26 9774 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:50:56.502151 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:50:57.843179 0.000000 tcp 10.0.2.105 51777 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:51:03.842634 0.085399 tcp 10.0.2.105 51781 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:03.928531 0.074610 tcp 10.0.2.105 51782 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:04.003451 0.166294 tcp 10.0.2.105 51783 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:04.199749 3.006751 tcp 10.0.2.105 51784 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:51:13.206513 0.000000 tcp 10.0.2.105 51784 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:51:13.777000 0.041449 tcp 10.0.2.105 51785 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:13.818195 0.077212 tcp 10.0.2.105 51786 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:13.895765 0.166263 tcp 10.0.2.105 51787 -> 195.113.214.251 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:14.060827 0.000000 udp 10.0.2.105 7010 -> 121.129.137.8 2286 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:51:19.194758 0.042365 tcp 10.0.2.105 51788 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:19.237418 0.077669 tcp 10.0.2.105 51789 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:19.315412 0.161218 tcp 10.0.2.105 51790 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:19.509718 0.379790 tcp 10.0.2.105 51791 -> 46.48.247.67 29365 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:29.499487 0.035266 tcp 10.0.2.105 51792 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:29.535131 0.076106 tcp 10.0.2.105 51793 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:29.611027 0.166456 tcp 10.0.2.105 51794 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:29.775878 0.071642 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:29.847921 0.059329 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:29.907710 0.282410 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.190479 0.169072 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.360061 0.086093 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.446562 0.134298 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.581315 0.144642 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.726375 0.164016 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:30.890817 0.146465 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.037700 0.075714 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.113864 0.085365 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.199669 0.071387 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.271398 0.062435 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.334295 0.052140 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.386826 0.195943 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.583155 0.143993 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.727548 0.172819 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.900832 0.053217 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:31.954507 0.147769 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.102782 0.212523 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.315755 0.388995 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.705220 0.066911 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.772600 0.163464 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.936507 0.045457 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:32.982372 0.247330 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:33.230141 0.856601 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:34.087108 0.141606 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:34.229197 0.357554 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:34.587116 0.292521 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:34.880190 0.378338 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:35.258938 0.124171 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:35.383577 0.331776 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:35.715795 0.212567 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:35.928757 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:51:43.316140 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 01:51:43.316584 0.236164 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:43.553229 0.223693 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:43.777325 0.315461 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/07 01:51:49.888887 0.030754 tcp 10.0.2.105 51795 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:49.920000 0.072008 tcp 10.0.2.105 51796 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:49.992301 0.162318 tcp 10.0.2.105 51797 -> 195.113.214.251 443 SRPA* 0 0 70 69958 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:50.193102 0.000094 tcp 10.0.2.105 51791 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:51:50.193466 2.999109 tcp 10.0.2.105 51798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:51:59.191579 0.000000 tcp 10.0.2.105 51798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:00.782701 0.000148 tcp 10.0.2.105 51791 -> 46.48.247.67 29365 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:52:05.190203 3.003527 tcp 10.0.2.105 51799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:14.193183 0.000000 tcp 10.0.2.105 51799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:18.869196 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:52:20.191734 0.399941 tcp 10.0.2.105 51800 -> 46.48.223.67 15494 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:52:32.687596 4.236328 tcp 10.0.2.105 51800 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:52:32.688173 3.005683 tcp 10.0.2.105 51801 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:41.692487 0.000000 tcp 10.0.2.105 51801 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:47.684117 3.001175 tcp 10.0.2.105 51802 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:52:56.684133 0.000000 tcp 10.0.2.105 51802 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 01:53:01.370668 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 01:53:02.682964 0.403485 tcp 10.0.2.105 51803 -> 46.48.247.67 29365 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:53:09.160112 0.000521 tcp 10.0.2.105 51803 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 01:54:49.319380 3.000890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 01:54:56.327907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:55:04.327628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:55:20.330324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 01:55:52.336597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:01:56.347360 2.997559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 02:02:03.349941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:02:11.351615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:02:27.354663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:02:59.360312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:09:06.371490 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 02:09:13.378203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:09:21.379982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:09:37.382791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:10:09.388856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:16:13.395580 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 02:16:20.403412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:16:28.403459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:16:44.406606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:17:16.412735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:21:55.244021 0.078552 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:21:55.322800 0.225661 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:55.541787 0.287367 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:55.939995 0.112661 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:56.013014 0.063299 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:56.683927 0.172827 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:56.938904 0.095417 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.017406 0.147326 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.150936 0.169479 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.343599 0.174506 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.510762 0.125680 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.596088 0.081380 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:57.778503 0.072841 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.053342 0.074288 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.110966 0.171222 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.275640 0.084043 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.338872 0.188789 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.535828 0.183434 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.686592 0.175774 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:58.859595 0.082045 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.015497 0.171786 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.208358 0.075618 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.268960 0.238449 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.482373 0.036955 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.697271 0.382621 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:21:59.945433 0.171624 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:00.135811 0.066322 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:00.184688 0.230090 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:00.407369 0.162145 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:00.583431 0.360184 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:01.052916 0.286423 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:01.412989 0.669626 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:02.079520 0.127986 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:02.250240 0.360490 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:02.709050 0.215934 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:02.917925 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:22:09.304189 2.996515 tcp 10.0.2.105 51804 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:09.923211 0.062797 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 5 2069 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:22:09.923612 0.243287 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:10.172382 0.226534 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:10.388161 0.316542 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:22:18.306987 0.000000 tcp 10.0.2.105 51804 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:22.874513 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:22:24.307524 0.050326 tcp 10.0.2.105 51805 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:24.358205 0.072308 tcp 10.0.2.105 51806 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:24.430801 0.156705 tcp 10.0.2.105 51807 -> 195.113.214.251 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:25.109262 3.001672 tcp 10.0.2.105 51808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:34.109545 0.000000 tcp 10.0.2.105 51808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:40.109298 0.049590 tcp 10.0.2.105 51809 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:40.159154 0.071935 tcp 10.0.2.105 51810 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:40.230924 0.157639 tcp 10.0.2.105 51811 -> 195.113.214.251 443 SRPA* 0 0 21 11574 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:40.580839 3.001915 tcp 10.0.2.105 51812 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:49.581659 0.000000 tcp 10.0.2.105 51812 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:22:55.580948 0.049928 tcp 10.0.2.105 51813 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:55.630822 0.072542 tcp 10.0.2.105 51814 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:55.703192 0.246831 tcp 10.0.2.105 51815 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:22:56.451906 2.760571 tcp 10.0.2.105 51816 -> 46.48.223.67 15494 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:20.419242 3.000654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 02:23:27.426745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:23:29.209462 0.053554 tcp 10.0.2.105 51817 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:29.263294 0.071538 tcp 10.0.2.105 51818 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:29.335174 0.165457 tcp 10.0.2.105 51819 -> 195.113.214.251 443 SRPA* 0 0 27 11648 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:29.856984 0.402062 tcp 10.0.2.105 51816 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:29.857377 2.996452 tcp 10.0.2.105 51820 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:23:35.428584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:23:38.853207 0.000000 tcp 10.0.2.105 51820 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:23:44.852075 0.049548 tcp 10.0.2.105 51821 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:44.901943 0.074186 tcp 10.0.2.105 51822 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:44.976433 0.158262 tcp 10.0.2.105 51823 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:45.440973 0.401764 tcp 10.0.2.105 51824 -> 46.48.247.67 29365 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:23:51.430725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:24:15.836041 0.049700 tcp 10.0.2.105 51825 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:24:15.886123 0.070290 tcp 10.0.2.105 51826 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:24:15.956711 0.155321 tcp 10.0.2.105 51827 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:24:16.343140 0.000076 tcp 10.0.2.105 51824 -> 46.48.247.67 29365 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:24:16.343431 2.997552 tcp 10.0.2.105 51828 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:24:23.436729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:24:25.339494 0.000000 tcp 10.0.2.105 51828 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:24:31.338516 3.004241 tcp 10.0.2.105 51829 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:24:40.341335 0.000000 tcp 10.0.2.105 51829 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:24:44.877346 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:24:46.340000 3.003866 tcp 10.0.2.105 51830 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:24:55.427836 0.000000 tcp 10.0.2.105 51830 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:25:01.376498 0.398184 tcp 10.0.2.105 51831 -> 46.48.223.67 15494 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:25:18.740896 0.000386 tcp 10.0.2.105 51831 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:25:18.741574 2.999035 tcp 10.0.2.105 51832 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:25:27.739029 0.000000 tcp 10.0.2.105 51832 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:25:33.738671 0.729302 tcp 10.0.2.105 51833 -> 46.48.247.67 29365 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:25:40.452278 0.000374 tcp 10.0.2.105 51833 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:26:16.339141 0.000000 tcp 10.0.2.105 51824 ?> 46.48.247.67 29365 RA_ 0 1 54 flow=Background 1970/02/07 02:26:20.875533 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:30:27.443280 3.002057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 02:30:34.450241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:30:40.189175 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:30:40.189473 3.003237 tcp 10.0.2.105 51834 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:30:42.451806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:30:49.191588 0.000000 tcp 10.0.2.105 51834 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:30:55.191635 0.052006 tcp 10.0.2.105 51835 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:30:55.243471 0.076750 tcp 10.0.2.105 51836 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:30:55.320566 0.163891 tcp 10.0.2.105 51837 -> 195.113.214.251 443 SRPA* 0 0 35 19368 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:30:55.686516 2.998447 tcp 10.0.2.105 51838 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:30:58.454435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:31:04.684525 0.000000 tcp 10.0.2.105 51838 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:31:10.682950 0.048632 tcp 10.0.2.105 51839 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:10.731878 0.076385 tcp 10.0.2.105 51840 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:10.808599 0.159962 tcp 10.0.2.105 51841 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:11.240570 2.986772 tcp 10.0.2.105 51842 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:31:20.237108 0.000000 tcp 10.0.2.105 51842 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:31:26.235206 0.050586 tcp 10.0.2.105 51843 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:26.286113 0.067728 tcp 10.0.2.105 51844 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:26.354149 0.161114 tcp 10.0.2.105 51845 -> 195.113.214.251 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:26.674801 1.394308 tcp 10.0.2.105 51846 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:30.460965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:31:45.539948 0.450655 tcp 10.0.2.105 51846 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:45.540833 0.050916 tcp 10.0.2.105 51847 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:45.592046 0.076719 tcp 10.0.2.105 51848 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:45.668618 0.189767 tcp 10.0.2.105 51849 -> 195.113.214.251 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:31:45.990880 3.006591 tcp 10.0.2.105 51850 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:31:55.005815 0.000000 tcp 10.0.2.105 51850 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:00.985542 0.050115 tcp 10.0.2.105 51851 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:01.035989 0.075254 tcp 10.0.2.105 51852 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:01.111117 0.165472 tcp 10.0.2.105 51853 -> 195.113.214.251 443 SRPA* 0 0 35 19570 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:01.413483 2.996147 tcp 10.0.2.105 51854 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:10.408634 0.000000 tcp 10.0.2.105 51854 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:16.407804 0.050128 tcp 10.0.2.105 51855 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:16.458347 0.075071 tcp 10.0.2.105 51856 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:16.533713 0.164086 tcp 10.0.2.105 51857 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:16.861672 0.402274 tcp 10.0.2.105 51858 -> 46.48.247.67 29365 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:28.113730 0.440031 tcp 10.0.2.105 51858 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:28.114445 0.053025 tcp 10.0.2.105 51859 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:28.167137 0.071961 tcp 10.0.2.105 51860 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:28.239445 0.166177 tcp 10.0.2.105 51861 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:32:28.554145 2.995699 tcp 10.0.2.105 51862 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:37.557156 0.000000 tcp 10.0.2.105 51862 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:43.556116 2.994071 tcp 10.0.2.105 51863 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:52.549341 0.000000 tcp 10.0.2.105 51863 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:32:57.375895 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:32:58.558899 3.003909 tcp 10.0.2.105 51864 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:07.560344 0.000000 tcp 10.0.2.105 51864 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:13.560742 0.427428 tcp 10.0.2.105 51865 -> 46.48.223.67 15494 SPA_* 0 0 7 947 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:33:29.449554 0.000396 tcp 10.0.2.105 51865 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:33:29.450216 3.005841 tcp 10.0.2.105 51866 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:38.454949 0.000000 tcp 10.0.2.105 51866 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:44.444063 2.993461 tcp 10.0.2.105 51867 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:53.447328 0.000000 tcp 10.0.2.105 51867 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:33:58.373352 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:33:59.445844 1.398335 tcp 10.0.2.105 51868 -> 46.48.247.67 29365 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:34:28.549980 0.000424 tcp 10.0.2.105 51868 -> 46.48.247.67 29365 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:37:34.466438 3.012683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 02:37:41.486768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:37:49.485957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:38:05.488676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:38:37.494610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:39:28.549657 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:39:28.549762 3.003194 tcp 10.0.2.105 51869 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:39:37.551483 0.000000 tcp 10.0.2.105 51869 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:39:43.551560 0.096035 tcp 10.0.2.105 51870 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:39:43.647808 0.073158 tcp 10.0.2.105 51871 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:39:43.721327 0.229851 tcp 10.0.2.105 51872 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:39:44.172760 3.002010 tcp 10.0.2.105 51873 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:39:53.175092 0.000000 tcp 10.0.2.105 51873 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:39:59.172806 0.310753 tcp 10.0.2.105 51874 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:39:59.483870 0.070935 tcp 10.0.2.105 51875 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:39:59.555156 0.166316 tcp 10.0.2.105 51876 -> 195.113.214.251 443 SRPA* 0 0 35 18780 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:00.045732 2.984335 tcp 10.0.2.105 51877 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:40:08.987914 0.000000 tcp 10.0.2.105 51877 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:40:14.915402 0.051615 tcp 10.0.2.105 51878 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:14.967302 0.097245 tcp 10.0.2.105 51879 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:15.064828 0.160066 tcp 10.0.2.105 51880 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:15.451009 0.391622 tcp 10.0.2.105 51881 -> 46.48.223.67 15494 SPA_* 0 0 9 1169 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:45.740245 0.052325 tcp 10.0.2.105 51882 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:45.792881 0.072347 tcp 10.0.2.105 51883 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:45.865533 0.156226 tcp 10.0.2.105 51884 -> 195.113.214.251 443 SRPA* 0 0 36 18648 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:46.209993 0.356984 tcp 10.0.2.105 51881 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:40:46.210297 3.008535 tcp 10.0.2.105 51885 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:40:55.212907 0.000000 tcp 10.0.2.105 51885 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 02:41:01.212438 0.055555 tcp 10.0.2.105 51886 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:41:01.268351 0.070795 tcp 10.0.2.105 51887 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:41:01.338999 0.170533 tcp 10.0.2.105 51888 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:41:01.593745 0.913775 tcp 10.0.2.105 51889 -> 176.73.126.145 3888 FSPA* 0 0 15 1730 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:44:41.501404 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 02:44:48.509608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:44:56.509664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:45:12.514707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:45:44.518857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:52:24.233728 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 02:52:24.233837 0.073140 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:24.307462 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:52:40.819004 0.053955 tcp 10.0.2.105 51890 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:52:40.873292 0.070260 tcp 10.0.2.105 51891 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:52:40.943835 0.156464 tcp 10.0.2.105 51892 -> 195.113.214.251 443 SRPA* 0 0 29 14130 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:52:41.100829 0.284012 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.385293 0.076322 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.462120 0.133116 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.595646 0.055055 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.651089 0.168821 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.820359 0.145801 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:41.966524 0.165840 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.132795 0.084395 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.217652 0.071653 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.289759 0.187804 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.478020 0.055933 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.534427 0.145142 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.679989 0.064365 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.744869 0.194845 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:42.940351 0.145878 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.086723 0.173127 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.260239 0.041580 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.302253 0.148676 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.451280 0.055058 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.506843 0.254067 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.761906 0.166917 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.929216 0.048077 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:43.977755 0.212288 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:44.190524 0.036272 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:44.227178 0.344340 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:44.571974 0.270749 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:44.843157 0.132706 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:44.976365 0.340918 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:45.317777 0.386121 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:45.704331 0.137020 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:52:45.841783 0.000000 udp 10.0.2.105 7010 -> 218.164.99.158 7010 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:53:03.841178 0.030834 tcp 10.0.2.105 51893 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:53:03.872380 0.070626 tcp 10.0.2.105 51894 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:53:03.943288 0.151944 tcp 10.0.2.105 51895 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 02:53:04.095997 0.205148 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:53:04.301578 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:53:11.540813 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 02:53:11.541307 0.237274 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:53:11.779003 0.224169 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:53:12.003642 0.321759 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/07 02:54:50.526928 3.001986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 02:54:57.533769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:55:05.535458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:55:21.539416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 02:55:53.544173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:01:57.550479 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:02:04.557703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:02:12.559214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:02:28.562230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:03:00.569155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:09:08.580619 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:09:15.589008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:09:23.588901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:09:39.592418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:10:11.598308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:11:02.512798 0.001101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 03:11:02.514007 0.584380 tcp 10.0.2.105 51896 -> 176.73.126.145 3888 FSPA* 0 0 15 1758 flow=From-Botnet-V2-TCP-Established 1970/02/07 03:16:15.604687 3.001138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:16:22.611569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:16:30.612963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:16:46.616099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:17:18.722268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:23:22.640715 2.999170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:23:29.645363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:23:32.690132 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 03:23:32.690248 0.222112 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:32.912805 0.372870 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:33.286157 0.073400 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:33.360051 0.277344 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:33.637881 0.136923 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:33.775242 0.057520 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:33.833239 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 03:23:37.647004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:23:52.398098 0.054855 tcp 10.0.2.105 51897 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 03:23:52.453281 0.074811 tcp 10.0.2.105 51898 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 03:23:52.528549 0.165873 tcp 10.0.2.105 51899 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 03:23:52.692726 0.217373 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:52.910501 0.075658 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:52.986582 0.062264 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.049265 0.163650 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.213383 0.082335 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.296121 0.150346 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.446928 0.065849 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 199 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.513260 0.051817 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.565588 0.070490 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.636484 0.147021 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.653566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:23:53.784017 0.172705 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:53.957149 0.050052 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.007591 0.189703 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.197747 0.165934 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.364148 0.047033 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.412013 0.051705 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.464223 0.146362 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.611115 0.261134 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:54.872687 0.212310 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:55.117334 0.030980 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:55.148707 0.374449 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:55.523609 0.336107 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:55.860206 0.133243 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:55.993824 0.221235 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:56.215498 0.380206 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:56.844982 0.086673 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:56.932185 0.206575 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:57.139280 0.223031 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:23:57.362787 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 03:24:04.430815 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 03:24:04.431264 0.256601 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:24:04.688346 0.345328 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:24:25.656765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:30:29.662634 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:30:36.672767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:30:44.671035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:31:00.676537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:31:32.681597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:37:36.687739 2.999836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:37:43.693808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:37:51.694832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:38:07.698058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:38:39.761393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:41:03.090150 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 03:41:03.090243 0.541925 tcp 10.0.2.105 51900 -> 176.73.126.145 3888 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/02/07 03:44:43.722552 2.998926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:44:50.727281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:44:58.729020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:45:14.731682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:45:46.737726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:51:50.745081 3.000391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:51:57.751348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:52:05.752681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:52:21.755889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:52:53.761712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:54:18.594459 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 03:54:18.594666 0.170319 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:18.765364 0.214787 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:18.980610 0.285848 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:19.266870 1.304966 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:20.572455 0.057235 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:20.630167 0.072437 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:20.702967 0.371919 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.075363 0.064321 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.140085 0.165898 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.306379 0.145345 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.452146 0.084974 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.537581 0.082220 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.620208 0.145584 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.766239 0.064403 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.831026 0.055677 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.887110 0.070218 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:21.957798 0.144470 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.102691 0.172598 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.275701 0.045700 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.321929 0.193213 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.515624 0.050962 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.567041 0.146163 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:22.713665 0.313831 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.027909 0.212407 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.240707 0.024735 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.265916 0.163009 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.429447 0.047499 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.477416 0.379048 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:23.856878 0.302198 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:24.159487 0.131224 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:24.291148 0.221185 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:24.512809 0.203326 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:24.716639 0.378204 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:25.095204 0.089082 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:25.184672 0.215181 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:25.400288 0.323590 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:25.724275 0.515184 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:54:26.239843 0.298435 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 03:58:57.768877 3.000635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 03:59:04.775251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:59:12.776647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 03:59:28.779742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:00:00.785880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:06:13.796108 3.000245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 04:06:20.802066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:06:28.807625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:06:44.806806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:07:16.812797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:11:03.641245 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:11:03.641346 0.572924 tcp 10.0.2.105 51901 -> 176.73.126.145 3888 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:13:20.818900 3.001174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 04:13:27.827245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:13:35.829954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:13:51.830868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:14:23.836735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:20:27.842509 3.003942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 04:20:34.850126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:20:42.852064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:20:58.854622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:21:30.862479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:24:37.939459 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:24:37.939574 0.276184 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.216153 0.169102 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.385700 0.221352 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.607498 0.133544 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.741455 0.056966 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.798871 0.072991 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:38.872560 0.373801 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.246811 0.065029 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.312412 0.166174 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.479085 0.081197 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.560644 0.146405 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.707512 0.065854 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.773868 0.057661 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.831998 0.070891 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:39.903277 0.147359 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.051041 0.070951 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.122523 0.146565 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.269534 0.172792 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.442732 0.046675 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.489825 0.196284 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.686572 0.054809 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.741847 0.232136 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:40.974388 0.025183 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:41.000031 0.148594 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:41.149087 0.249818 udp 10.0.2.105 7010 <-> 14.96.131.87 6114 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:24:41.399289 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:25:00.115073 0.054064 tcp 10.0.2.105 51902 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:00.169406 0.079188 tcp 10.0.2.105 51903 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:00.248881 0.158825 tcp 10.0.2.105 51904 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:00.407101 0.166811 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:00.574366 0.046380 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:00.621199 0.350241 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:00.971857 0.131858 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:01.104145 0.311893 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:01.416526 0.110275 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:01.527212 0.207174 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:01.734772 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:25:17.639337 0.033750 tcp 10.0.2.105 51905 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:17.673443 0.075856 tcp 10.0.2.105 51906 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:17.749674 0.167104 tcp 10.0.2.105 51907 -> 195.113.214.251 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:25:17.917407 0.223443 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:18.141477 0.367483 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:18.509367 0.114675 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:25:18.624541 0.236983 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:27:34.868649 2.999758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 04:27:41.875096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:27:49.875695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:28:05.878743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:28:37.884680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:34:41.891540 3.000436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 04:34:48.897586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:34:56.899474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:35:12.902239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:35:44.908493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:41:04.218086 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:41:04.218182 3.003562 tcp 10.0.2.105 51908 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:13.220552 0.000000 tcp 10.0.2.105 51908 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:19.221025 0.031064 tcp 10.0.2.105 51909 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:19.252556 0.067085 tcp 10.0.2.105 51910 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:19.319967 0.157124 tcp 10.0.2.105 51911 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:19.809187 3.340736 tcp 10.0.2.105 51912 -> 46.48.247.67 29365 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:22.617753 0.053336 tcp 10.0.2.105 51913 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:22.671370 0.074723 tcp 10.0.2.105 51914 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:22.746414 0.167553 tcp 10.0.2.105 51915 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:23.150167 2.998950 tcp 10.0.2.105 51916 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:32.147654 0.000000 tcp 10.0.2.105 51916 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:38.148691 0.055827 tcp 10.0.2.105 51917 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:38.204869 0.075095 tcp 10.0.2.105 51918 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:38.280354 0.164492 tcp 10.0.2.105 51919 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:39.136156 2.995837 tcp 10.0.2.105 51920 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:48.132930 0.000000 tcp 10.0.2.105 51920 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:48.917916 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 04:41:54.129917 0.035672 tcp 10.0.2.105 51921 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:54.165953 0.076433 tcp 10.0.2.105 51922 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:54.242703 0.165189 tcp 10.0.2.105 51923 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:41:54.609270 3.007387 tcp 10.0.2.105 51924 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:41:55.922656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:42:03.615199 0.000000 tcp 10.0.2.105 51924 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:42:03.925045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:42:09.603759 0.052970 tcp 10.0.2.105 51925 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:09.657089 0.071248 tcp 10.0.2.105 51926 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:09.728754 0.172874 tcp 10.0.2.105 51927 -> 195.113.214.251 443 SRPA* 0 0 61 41212 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:10.556973 1.208062 tcp 10.0.2.105 51928 -> 46.48.223.67 15494 SPA_* 0 0 9 1182 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:17.892700 0.576354 tcp 10.0.2.105 51928 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:17.893719 0.056505 tcp 10.0.2.105 51929 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:17.949977 0.075681 tcp 10.0.2.105 51930 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:18.026000 0.161662 tcp 10.0.2.105 51931 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:18.469381 2.962563 tcp 10.0.2.105 51932 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:42:20.666631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:42:27.375559 0.000000 tcp 10.0.2.105 51932 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:42:33.291487 0.052264 tcp 10.0.2.105 51933 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:33.343572 0.073524 tcp 10.0.2.105 51934 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:33.417417 0.160684 tcp 10.0.2.105 51935 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:33.894011 2.954627 tcp 10.0.2.105 51936 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:42:42.777114 0.000000 tcp 10.0.2.105 51936 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:42:48.721852 0.349705 tcp 10.0.2.105 51937 -> 46.48.247.67 29365 SPA_* 0 0 7 1074 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:52.306575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:42:56.869201 0.005470 tcp 10.0.2.105 51937 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:42:56.869756 2.972494 tcp 10.0.2.105 51938 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:05.775487 0.000000 tcp 10.0.2.105 51938 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:11.698469 2.973992 tcp 10.0.2.105 51939 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:20.605133 0.000000 tcp 10.0.2.105 51939 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:25.375376 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:43:26.542800 3.011409 tcp 10.0.2.105 51940 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:35.544978 0.000000 tcp 10.0.2.105 51940 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:41.548359 3.748961 tcp 10.0.2.105 51941 -> 46.48.223.67 15494 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:43:45.297534 3.006214 tcp 10.0.2.105 51942 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:43:54.302097 0.000000 tcp 10.0.2.105 51942 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:00.292920 0.000186 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:49:00.293213 3.003309 tcp 10.0.2.105 51943 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:09.295248 0.000000 tcp 10.0.2.105 51943 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:15.295850 0.034075 tcp 10.0.2.105 51944 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:15.330197 0.074462 tcp 10.0.2.105 51945 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:15.404951 0.158394 tcp 10.0.2.105 51946 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:15.668142 2.990526 tcp 10.0.2.105 51947 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:24.670514 0.000000 tcp 10.0.2.105 51947 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:30.666331 0.055834 tcp 10.0.2.105 51948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:30.722017 0.074745 tcp 10.0.2.105 51949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:30.797125 0.159596 tcp 10.0.2.105 51950 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:31.115121 0.357326 tcp 10.0.2.105 51951 -> 46.48.247.67 29365 SPA_* 0 0 9 1155 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:41.786894 2.521971 tcp 10.0.2.105 51951 -> 46.48.247.67 29365 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:41.787724 0.051421 tcp 10.0.2.105 51952 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:41.839401 0.078804 tcp 10.0.2.105 51953 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:41.917971 0.161256 tcp 10.0.2.105 51954 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:49:42.172431 3.004095 tcp 10.0.2.105 51955 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:51.179903 0.000000 tcp 10.0.2.105 51955 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:49:57.163753 2.994388 tcp 10.0.2.105 51956 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:50:06.170492 0.000000 tcp 10.0.2.105 51956 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:50:10.874763 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:50:12.165632 0.349255 tcp 10.0.2.105 51957 -> 46.48.247.67 29365 SPA_* 0 0 9 1155 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:50:22.042396 0.012438 tcp 10.0.2.105 51957 -> 46.48.247.67 29365 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:53:24.947987 2.998778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 04:53:31.952714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:53:39.954206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:53:55.958649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:54:27.962806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 04:55:22.041560 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 04:55:22.041663 3.003802 tcp 10.0.2.105 51958 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:55:25.075660 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:55:31.043777 0.000000 tcp 10.0.2.105 51958 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:55:37.045232 0.054331 tcp 10.0.2.105 51959 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:37.099911 0.073437 tcp 10.0.2.105 51960 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:37.173526 0.157622 tcp 10.0.2.105 51961 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:37.478438 3.008949 tcp 10.0.2.105 51962 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:55:41.228969 0.032706 tcp 10.0.2.105 51963 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:41.261451 0.076237 tcp 10.0.2.105 51964 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:41.337985 0.164428 tcp 10.0.2.105 51965 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:41.503127 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:55:46.496027 0.000000 tcp 10.0.2.105 51962 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 04:55:56.953638 0.035116 tcp 10.0.2.105 51966 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:56.989072 0.071227 tcp 10.0.2.105 51967 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:57.060591 0.161228 tcp 10.0.2.105 51968 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:55:57.219673 0.287616 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:57.542606 0.062879 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:57.604400 0.117602 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:57.678708 0.230477 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2579 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:57.901418 0.172478 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.070455 0.147739 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.204622 0.175138 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.372085 0.131541 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.458009 0.076081 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.584789 0.092923 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.655102 0.079617 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:58.718918 0.377054 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.132390 0.172746 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.281881 0.101530 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.367991 0.172365 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.515498 0.080953 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.587435 0.086662 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.666825 0.209568 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.871181 0.071343 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:55:59.930219 0.236800 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:00.144237 0.034587 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:00.258247 0.172791 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:00.427567 0.183600 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:00.580876 0.175421 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:00.752076 0.000000 udp 10.0.2.105 7010 -> 14.96.131.87 6114 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:56:16.880822 0.034359 tcp 10.0.2.105 51969 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:16.915064 0.074499 tcp 10.0.2.105 51970 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:16.989481 0.173973 tcp 10.0.2.105 51971 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:17.162562 0.146849 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:17.298822 0.063104 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:17.372691 0.173181 udp 10.0.2.105 7010 <-> 99.37.204.150 7485 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:17.542125 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 04:56:32.703417 0.031070 tcp 10.0.2.105 51972 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:32.734848 0.072668 tcp 10.0.2.105 51973 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:32.807888 0.164398 tcp 10.0.2.105 51974 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/07 04:56:32.972857 0.219264 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:33.183772 0.116666 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 5 1719 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:33.297150 0.233950 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:33.523108 0.237376 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:33.749946 0.242366 udp 10.0.2.105 7010 <-> 41.190.238.210 9441 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:33.990234 0.317365 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/07 04:56:34.324078 0.152764 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:00:31.972765 3.008316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:00:38.988232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:00:46.988040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:00:52.476507 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:00:52.476781 2.993520 tcp 10.0.2.105 51975 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:01.468973 0.000000 tcp 10.0.2.105 51975 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:02.991438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:01:07.479897 0.053592 tcp 10.0.2.105 51976 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:07.533394 0.076573 tcp 10.0.2.105 51977 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:07.610298 0.169403 tcp 10.0.2.105 51978 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:07.815613 2.996958 tcp 10.0.2.105 51979 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:16.811186 0.000000 tcp 10.0.2.105 51979 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:22.810161 0.055135 tcp 10.0.2.105 51980 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:22.865582 0.117080 tcp 10.0.2.105 51981 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:22.982950 0.156267 tcp 10.0.2.105 51982 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:23.151594 3.003162 tcp 10.0.2.105 51983 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:32.153101 0.000000 tcp 10.0.2.105 51983 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:34.997496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:01:38.152949 0.030876 tcp 10.0.2.105 51984 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:38.184119 0.072500 tcp 10.0.2.105 51985 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:38.256442 0.161520 tcp 10.0.2.105 51986 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:38.437984 3.016272 tcp 10.0.2.105 51987 -> 46.48.223.67 15494 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:41.122986 0.054179 tcp 10.0.2.105 51988 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:41.177481 0.076392 tcp 10.0.2.105 51989 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:41.254247 0.171516 tcp 10.0.2.105 51990 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:41.454492 2.996435 tcp 10.0.2.105 51991 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:50.449645 0.000000 tcp 10.0.2.105 51991 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:01:56.453497 0.053024 tcp 10.0.2.105 51992 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:56.506355 0.072874 tcp 10.0.2.105 51993 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:56.579102 0.159182 tcp 10.0.2.105 51994 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:01:56.754693 3.002307 tcp 10.0.2.105 51995 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:05.751630 0.000000 tcp 10.0.2.105 51995 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:11.751660 0.033074 tcp 10.0.2.105 51996 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:02:11.785099 0.071189 tcp 10.0.2.105 51997 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:02:11.856607 0.160718 tcp 10.0.2.105 51998 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:02:12.037588 2.997174 tcp 10.0.2.105 51999 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:21.033235 0.000000 tcp 10.0.2.105 51999 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:27.032151 3.004566 tcp 10.0.2.105 52000 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:36.035243 0.000000 tcp 10.0.2.105 52000 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:40.872082 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:02:42.033557 2.994525 tcp 10.0.2.105 52001 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:51.036696 0.000000 tcp 10.0.2.105 52001 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:02:57.035346 3.359464 tcp 10.0.2.105 52002 -> 46.48.223.67 15494 SPA_* 0 0 10 1250 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:03:03.023602 0.000313 tcp 10.0.2.105 52002 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:03:03.024081 2.994784 tcp 10.0.2.105 52003 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:03:12.027380 0.000000 tcp 10.0.2.105 52003 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:03:18.025511 2.995034 tcp 10.0.2.105 52004 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:03:27.018296 0.000000 tcp 10.0.2.105 52004 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:03:31.875089 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:07:39.004919 3.005155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:07:46.010843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:07:54.012941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:08:10.015305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:08:33.029314 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:08:33.029403 3.003147 tcp 10.0.2.105 52005 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:08:42.022836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:08:42.032774 0.000000 tcp 10.0.2.105 52005 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:08:48.031646 0.032967 tcp 10.0.2.105 52006 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:08:48.064951 0.074191 tcp 10.0.2.105 52007 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:08:48.139539 0.162041 tcp 10.0.2.105 52008 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:08:48.338286 3.006469 tcp 10.0.2.105 52009 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:08:57.345731 0.000000 tcp 10.0.2.105 52009 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:09:03.337773 0.030638 tcp 10.0.2.105 52010 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:03.368811 0.076011 tcp 10.0.2.105 52011 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:03.445161 0.162320 tcp 10.0.2.105 52012 -> 195.113.214.251 443 SRPA* 0 0 59 41374 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:03.617329 3.001433 tcp 10.0.2.105 52013 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:09:12.615382 0.000000 tcp 10.0.2.105 52013 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:09:18.615487 0.052740 tcp 10.0.2.105 52014 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:18.668577 0.072739 tcp 10.0.2.105 52015 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:18.741617 0.168085 tcp 10.0.2.105 52016 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:18.966709 0.355575 tcp 10.0.2.105 52017 -> 46.48.223.67 15494 SPA_* 0 0 9 1082 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:34.514314 0.769674 tcp 10.0.2.105 52017 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:34.515346 0.052409 tcp 10.0.2.105 52018 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:34.568067 0.074199 tcp 10.0.2.105 52019 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:34.642068 0.162425 tcp 10.0.2.105 52020 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:35.284451 2.997855 tcp 10.0.2.105 52021 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:09:44.280303 0.000000 tcp 10.0.2.105 52021 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:09:50.279823 0.031944 tcp 10.0.2.105 52022 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:50.312115 0.074576 tcp 10.0.2.105 52023 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:50.387029 0.158872 tcp 10.0.2.105 52024 -> 195.113.214.251 443 SRPA* 0 0 35 17174 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:09:51.240236 3.005047 tcp 10.0.2.105 52025 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:00.243668 0.000000 tcp 10.0.2.105 52025 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:06.233523 0.054826 tcp 10.0.2.105 52026 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:10:06.288267 0.076548 tcp 10.0.2.105 52027 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:10:06.365094 0.164266 tcp 10.0.2.105 52028 -> 195.113.214.251 443 SRPA* 0 0 39 21208 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:10:06.565822 3.003330 tcp 10.0.2.105 52029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:15.575809 0.000000 tcp 10.0.2.105 52029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:21.565792 2.992913 tcp 10.0.2.105 52030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:30.567784 0.000000 tcp 10.0.2.105 52030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:35.376708 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:10:36.566780 2.994364 tcp 10.0.2.105 52031 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:45.558906 0.000000 tcp 10.0.2.105 52031 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:10:51.570741 0.358101 tcp 10.0.2.105 52032 -> 46.48.223.67 15494 SPA_* 0 0 9 1082 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:10:56.914536 0.000385 tcp 10.0.2.105 52032 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:10:56.915214 2.994268 tcp 10.0.2.105 52033 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:11:05.908095 0.000000 tcp 10.0.2.105 52033 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:11:11.920475 3.000608 tcp 10.0.2.105 52034 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:11:20.919864 0.000000 tcp 10.0.2.105 52034 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:11:25.876901 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:14:46.031014 2.997484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:14:53.034893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:15:01.036844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:15:17.039960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:15:49.046004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:16:26.921238 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:16:26.921340 3.002702 tcp 10.0.2.105 52035 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:16:35.922679 0.000000 tcp 10.0.2.105 52035 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:16:41.923350 0.058829 tcp 10.0.2.105 52036 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:41.982598 0.077124 tcp 10.0.2.105 52037 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:42.060114 0.164710 tcp 10.0.2.105 52038 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:42.359527 3.007831 tcp 10.0.2.105 52039 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:16:51.364684 0.000000 tcp 10.0.2.105 52039 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:16:57.358280 0.034339 tcp 10.0.2.105 52040 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:57.392907 0.077294 tcp 10.0.2.105 52041 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:57.470529 0.155311 tcp 10.0.2.105 52042 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:16:57.694229 2.986947 tcp 10.0.2.105 52043 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:06.686851 0.000000 tcp 10.0.2.105 52043 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:12.686520 0.062327 tcp 10.0.2.105 52044 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:12.749168 0.071520 tcp 10.0.2.105 52045 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:12.821015 0.153570 tcp 10.0.2.105 52046 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:13.623396 2.307350 tcp 10.0.2.105 52047 -> 46.48.223.67 15494 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:15.413828 0.106981 tcp 10.0.2.105 52048 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:15.521163 0.075340 tcp 10.0.2.105 52049 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:15.596858 0.167111 tcp 10.0.2.105 52050 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:15.931015 3.003295 tcp 10.0.2.105 52051 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:24.933023 0.000000 tcp 10.0.2.105 52051 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:30.933216 0.058228 tcp 10.0.2.105 52052 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:30.991221 0.072076 tcp 10.0.2.105 52053 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:31.063084 0.161789 tcp 10.0.2.105 52054 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:31.389098 3.007755 tcp 10.0.2.105 52055 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:40.749706 0.000000 tcp 10.0.2.105 52055 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:46.701258 0.055319 tcp 10.0.2.105 52056 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:46.756404 0.076067 tcp 10.0.2.105 52057 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:46.832780 0.162891 tcp 10.0.2.105 52058 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:17:47.313679 2.970433 tcp 10.0.2.105 52059 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:17:56.285314 0.000000 tcp 10.0.2.105 52059 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:02.235907 2.972427 tcp 10.0.2.105 52060 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:11.175790 0.000000 tcp 10.0.2.105 52060 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:16.021415 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:18:17.133138 2.981331 tcp 10.0.2.105 52061 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:26.062469 0.000000 tcp 10.0.2.105 52061 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:32.011513 4.941177 tcp 10.0.2.105 52062 -> 46.48.223.67 15494 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:18:36.952519 2.999226 tcp 10.0.2.105 52063 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:45.949304 0.000000 tcp 10.0.2.105 52063 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:18:51.948149 3.004527 tcp 10.0.2.105 52064 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:19:00.950568 0.000000 tcp 10.0.2.105 52064 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:19:06.304613 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:21:53.054857 2.997837 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:22:00.058457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:22:08.061900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:22:24.064022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:22:56.069345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:24:06.951605 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:24:06.951714 3.003523 tcp 10.0.2.105 52065 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:15.954945 0.000000 tcp 10.0.2.105 52065 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:22.084507 0.055035 tcp 10.0.2.105 52066 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:22.139906 0.070517 tcp 10.0.2.105 52067 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:22.210723 0.177773 tcp 10.0.2.105 52068 -> 195.113.214.251 443 SRPA* 0 0 25 13898 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:22.483015 2.974037 tcp 10.0.2.105 52069 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:31.437608 0.000000 tcp 10.0.2.105 52069 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:37.397793 0.053013 tcp 10.0.2.105 52070 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:37.451116 0.067780 tcp 10.0.2.105 52071 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:37.518679 0.155098 tcp 10.0.2.105 52072 -> 195.113.214.251 443 SRPA* 0 0 79 56386 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:37.830727 2.971973 tcp 10.0.2.105 52073 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:46.788072 0.000000 tcp 10.0.2.105 52073 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:24:52.787718 0.056942 tcp 10.0.2.105 52074 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:52.844964 0.076229 tcp 10.0.2.105 52075 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:52.921089 0.151628 tcp 10.0.2.105 52076 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:24:53.083716 0.346105 tcp 10.0.2.105 52077 -> 46.48.223.67 15494 SPA_* 0 0 9 1187 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:00.312340 0.644631 tcp 10.0.2.105 52077 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:00.313346 0.052751 tcp 10.0.2.105 52078 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:00.366465 0.074614 tcp 10.0.2.105 52079 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:00.441385 0.155253 tcp 10.0.2.105 52080 -> 195.113.214.251 443 SRPA* 0 0 24 10066 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:00.957209 2.997336 tcp 10.0.2.105 52081 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:09.952837 0.000000 tcp 10.0.2.105 52081 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:15.953286 0.057891 tcp 10.0.2.105 52082 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:16.011522 0.077539 tcp 10.0.2.105 52083 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:16.088866 0.152909 tcp 10.0.2.105 52084 -> 195.113.214.251 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:16.359003 3.007944 tcp 10.0.2.105 52085 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:25.364398 0.000000 tcp 10.0.2.105 52085 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:31.353204 0.052813 tcp 10.0.2.105 52086 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:31.405843 0.070533 tcp 10.0.2.105 52087 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:31.476678 0.157760 tcp 10.0.2.105 52088 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:25:32.017158 3.000102 tcp 10.0.2.105 52089 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:41.026317 0.000000 tcp 10.0.2.105 52089 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:47.014513 2.994738 tcp 10.0.2.105 52090 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:25:56.007447 0.000000 tcp 10.0.2.105 52090 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:00.879170 0.072543 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:26:02.078700 2.974597 tcp 10.0.2.105 52091 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:11.014548 0.000000 tcp 10.0.2.105 52091 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:17.022083 1.761931 tcp 10.0.2.105 52092 -> 46.48.223.67 15494 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:26:18.784458 3.000542 tcp 10.0.2.105 52093 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:27.783352 0.000000 tcp 10.0.2.105 52093 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:33.782246 3.004324 tcp 10.0.2.105 52094 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:42.785071 0.000000 tcp 10.0.2.105 52094 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:26:47.371955 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:26:58.818697 0.000000 udp 10.0.2.105 7010 -> 14.96.131.87 6114 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:27:17.147460 0.051949 tcp 10.0.2.105 52095 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:17.199760 0.067032 tcp 10.0.2.105 52096 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:17.267060 0.152143 tcp 10.0.2.105 52097 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:17.419918 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:27:36.259676 0.052695 tcp 10.0.2.105 52098 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:36.312187 0.075639 tcp 10.0.2.105 52099 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:36.387577 0.156166 tcp 10.0.2.105 52100 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:36.541776 0.064810 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:36.605206 0.284984 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:36.990610 0.109055 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:37.060920 0.147138 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:37.460664 0.178454 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:37.631347 0.127885 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:37.716473 0.176280 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:38.034738 0.226462 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:38.254020 0.085607 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:38.490387 0.378625 udp 10.0.2.105 7010 <-> 218.164.99.158 7010 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:38.891034 0.073011 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:38.947439 0.085011 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.110714 0.081926 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.183555 0.085022 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.360849 0.168972 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.508918 0.103618 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.698241 0.171588 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:39.924224 0.172405 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:40.211509 0.198350 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:40.402445 0.237663 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:40.615325 0.069743 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:40.898295 0.043469 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:40.956475 0.175647 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:41.128925 0.172239 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:41.275559 0.000000 udp 10.0.2.105 7010 -> 99.37.204.150 7485 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:27:58.083966 0.053849 tcp 10.0.2.105 52101 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:58.138153 0.075557 tcp 10.0.2.105 52102 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:58.214026 0.159032 tcp 10.0.2.105 52103 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:27:58.371890 0.062711 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:58.418306 0.141918 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 1988 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:27:58.761744 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:28:16.180161 0.054687 tcp 10.0.2.105 52104 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:16.235154 0.076314 tcp 10.0.2.105 52105 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:16.311294 0.153915 tcp 10.0.2.105 52106 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:16.463992 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:28:31.186689 0.007780 udp 10.0.2.105 7010 <- 76.217.180.151 1314 RSP 0 0 5 2124 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:28:31.187080 0.238578 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:28:31.416274 0.221315 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:28:31.776267 0.218254 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:28:31.945680 0.000000 udp 10.0.2.105 7010 -> 41.190.238.210 9441 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:28:49.497977 0.053012 tcp 10.0.2.105 52107 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:49.551319 0.074292 tcp 10.0.2.105 52108 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:49.625930 0.154439 tcp 10.0.2.105 52109 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:28:49.781028 0.318716 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:29:00.076177 3.000633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:29:07.083407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:29:15.084778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:29:31.087030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:30:03.182609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:31:48.785674 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:31:48.785882 2.993326 tcp 10.0.2.105 52110 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:31:57.996756 0.000000 tcp 10.0.2.105 52110 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:03.961165 0.032796 tcp 10.0.2.105 52111 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:03.994354 0.072395 tcp 10.0.2.105 52112 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:04.066501 0.164894 tcp 10.0.2.105 52113 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:04.367153 2.975393 tcp 10.0.2.105 52114 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:13.287123 0.000000 tcp 10.0.2.105 52114 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:19.236764 0.052564 tcp 10.0.2.105 52115 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:19.289596 0.070590 tcp 10.0.2.105 52116 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:19.360797 0.157598 tcp 10.0.2.105 52117 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:19.691620 2.982431 tcp 10.0.2.105 52118 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:28.664798 0.000000 tcp 10.0.2.105 52118 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:34.651601 0.051978 tcp 10.0.2.105 52119 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:34.703872 0.075443 tcp 10.0.2.105 52120 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:34.779299 0.155813 tcp 10.0.2.105 52121 -> 195.113.214.251 443 SRPA* 0 0 41 23282 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:35.130571 3.005357 tcp 10.0.2.105 52122 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:44.135189 0.000000 tcp 10.0.2.105 52122 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:50.123483 0.091959 tcp 10.0.2.105 52123 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:50.215804 0.075794 tcp 10.0.2.105 52124 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:50.291953 0.158814 tcp 10.0.2.105 52125 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:32:50.571610 2.996594 tcp 10.0.2.105 52126 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:32:59.577033 0.000000 tcp 10.0.2.105 52126 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:05.565994 0.053361 tcp 10.0.2.105 52127 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:33:05.619173 0.076631 tcp 10.0.2.105 52128 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:33:05.696169 0.148518 tcp 10.0.2.105 52129 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:33:05.879212 3.000606 tcp 10.0.2.105 52130 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:14.881343 0.000000 tcp 10.0.2.105 52130 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:20.878827 3.003278 tcp 10.0.2.105 52131 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:29.880091 0.000000 tcp 10.0.2.105 52131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:34.877049 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:33:35.878643 3.004639 tcp 10.0.2.105 52132 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:44.881795 0.000000 tcp 10.0.2.105 52132 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:50.880627 3.004265 tcp 10.0.2.105 52133 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:33:58.872047 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:33:59.883560 0.000000 tcp 10.0.2.105 52133 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:34:05.882433 3.601967 tcp 10.0.2.105 52134 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:34:15.422780 0.000000 tcp 10.0.2.105 52134 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:36:07.110257 3.000092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:36:14.116604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:36:22.117921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:36:38.120544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:37:10.127306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:39:20.895797 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:39:20.895906 2.993494 tcp 10.0.2.105 52135 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:39:29.888032 0.000000 tcp 10.0.2.105 52135 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:39:35.898361 0.053110 tcp 10.0.2.105 52136 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:35.951755 0.074849 tcp 10.0.2.105 52137 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:36.026928 0.161679 tcp 10.0.2.105 52138 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:36.210111 3.001248 tcp 10.0.2.105 52139 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:39:45.210177 0.000000 tcp 10.0.2.105 52139 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:39:51.209393 0.053910 tcp 10.0.2.105 52140 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:51.263640 0.077040 tcp 10.0.2.105 52141 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:51.340944 0.194091 tcp 10.0.2.105 52142 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:39:51.875763 2.998836 tcp 10.0.2.105 52143 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:00.872228 0.000000 tcp 10.0.2.105 52143 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:06.871976 0.055242 tcp 10.0.2.105 52144 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:06.927461 0.076009 tcp 10.0.2.105 52145 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:07.003793 0.151508 tcp 10.0.2.105 52146 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:07.163671 3.002170 tcp 10.0.2.105 52147 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:16.164681 0.000000 tcp 10.0.2.105 52147 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:22.163890 0.052226 tcp 10.0.2.105 52148 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:22.216572 0.070630 tcp 10.0.2.105 52149 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:22.287491 0.159404 tcp 10.0.2.105 52150 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:22.547226 2.994851 tcp 10.0.2.105 52151 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:31.546728 0.000000 tcp 10.0.2.105 52151 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:37.546164 0.052560 tcp 10.0.2.105 52152 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:37.598991 0.074407 tcp 10.0.2.105 52153 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:37.673691 0.149235 tcp 10.0.2.105 52154 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:40:37.893036 2.996744 tcp 10.0.2.105 52155 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:46.951848 0.000000 tcp 10.0.2.105 52155 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:40:52.907403 2.984376 tcp 10.0.2.105 52156 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:01.890139 0.000000 tcp 10.0.2.105 52156 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:06.877305 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:41:07.889128 3.003933 tcp 10.0.2.105 52157 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:17.060804 0.000000 tcp 10.0.2.105 52157 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:23.003204 2.978846 tcp 10.0.2.105 52158 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:24.061529 0.000177 tcp 10.0.2.105 52156 -> 31.192.24.67 3527 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:41:30.911705 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:41:31.924875 0.000000 tcp 10.0.2.105 52158 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:37.892689 3.003598 tcp 10.0.2.105 52159 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:41:46.894929 0.000000 tcp 10.0.2.105 52159 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:43:14.134953 2.999864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 05:43:21.142758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:43:29.142183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:43:45.145595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:44:17.150642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:46:52.895610 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:46:52.895710 2.993557 tcp 10.0.2.105 52160 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:47:01.888612 0.000000 tcp 10.0.2.105 52160 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 05:47:07.898534 0.055162 tcp 10.0.2.105 52161 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:47:07.954071 0.068172 tcp 10.0.2.105 52162 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:47:08.022557 0.152839 tcp 10.0.2.105 52163 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:47:08.377356 0.698278 tcp 10.0.2.105 52164 -> 31.192.24.67 3527 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:54:08.164598 3.000681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 05:54:15.171325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:54:23.172754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:54:39.175418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:55:11.182005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 05:59:10.986638 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 05:59:10.986756 0.000000 udp 10.0.2.105 7010 -> 99.37.204.150 7485 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:59:28.634512 0.051874 tcp 10.0.2.105 52165 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:28.686608 0.076379 tcp 10.0.2.105 52166 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:28.763382 0.158103 tcp 10.0.2.105 52167 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:28.922141 0.086737 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:29.009286 0.000000 udp 10.0.2.105 7010 -> 41.190.238.210 9441 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 05:59:46.367798 0.050057 tcp 10.0.2.105 52168 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:46.418171 0.072587 tcp 10.0.2.105 52169 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:46.491012 0.158097 tcp 10.0.2.105 52170 -> 195.113.214.251 443 SRPA* 0 0 34 15888 flow=From-Botnet-V2-TCP-Established 1970/02/07 05:59:46.647615 0.288155 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:46.936153 0.059499 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:46.995990 0.068265 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:47.064667 0.169355 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:47.234429 0.136434 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/07 05:59:47.371207 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:00:02.400560 0.049605 tcp 10.0.2.105 52171 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:02.450519 0.070557 tcp 10.0.2.105 52172 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:02.521415 0.157180 tcp 10.0.2.105 52173 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:02.679224 0.079425 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:02.759074 0.078027 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:02.837552 0.059614 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:02.897628 0.218529 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:03.116594 0.062648 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:03.179724 0.000000 udp 10.0.2.105 7010 -> 218.164.99.158 7010 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:00:20.536996 0.049728 tcp 10.0.2.105 52174 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:20.587052 0.072005 tcp 10.0.2.105 52175 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:20.658892 0.155596 tcp 10.0.2.105 52176 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:00:20.815084 0.064644 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:20.880136 0.148603 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.090176 0.086813 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.177446 0.153059 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.331038 0.050449 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.381982 0.148819 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.531214 0.172960 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.704642 0.183957 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.889070 0.057191 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:21.946681 0.213950 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:22.161093 0.025235 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:22.186713 0.141424 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:22.328636 0.046354 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:22.375488 0.132450 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:22.508424 3.017089 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:25.525919 0.205670 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:25.732068 0.215300 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:00:25.947809 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:00:31.168675 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:00:32.511181 0.313364 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:01:15.188897 3.000280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 06:01:22.194961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:01:30.196523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:01:46.199265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:02:18.205476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:08:22.213321 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:08:29.218971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:08:37.220622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:08:53.224900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:09:25.229530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:15:29.236126 3.002498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:15:36.243063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:15:44.244655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:16:00.247367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:16:32.254966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:17:09.077346 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 06:17:09.077460 0.656285 tcp 10.0.2.105 52177 -> 31.192.24.67 3527 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:22:36.259784 3.001242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:22:43.267668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:22:51.268739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:23:07.273481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:23:39.277552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:29:43.283598 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:29:50.291097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:29:58.292668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:30:14.298759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:30:46.301255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:30:52.309863 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 06:30:52.309953 0.164597 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:30:52.474932 0.000000 udp 10.0.2.105 7010 -> 218.164.99.158 7010 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:31:08.496426 0.056328 tcp 10.0.2.105 52178 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:31:08.553068 0.077096 tcp 10.0.2.105 52179 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:31:08.630450 0.164388 tcp 10.0.2.105 52180 -> 195.113.214.251 443 SRPA* 0 0 21 9904 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:31:08.795445 0.110054 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:08.905912 0.168516 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.074868 0.056921 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.132223 0.289896 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.422623 0.071999 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.495158 0.132138 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.627721 0.214799 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.842945 0.065016 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.908447 0.081618 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:09.990609 0.070885 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.061874 0.054405 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.116666 0.065007 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.182037 0.146432 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.328843 0.092587 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.421829 0.143746 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.566021 0.054703 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.621166 0.148145 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.769711 0.172641 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:10.942807 0.179786 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.123058 0.051529 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.175013 0.142529 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.317967 0.045587 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.363971 0.134827 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.499207 0.211487 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.711072 0.038479 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.749931 0.229300 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:11.979599 0.208639 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:12.188725 0.213608 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:31:12.402751 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:31:17.488510 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 06:31:17.488933 0.315717 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/07 06:36:50.308017 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:36:57.314688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:37:05.316870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:37:21.319508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:37:53.328727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:43:57.332152 3.000677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:44:04.338347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:44:12.340107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:44:28.343957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:45:00.349397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:47:09.735743 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 06:47:09.735857 0.621532 tcp 10.0.2.105 52181 -> 31.192.24.67 3527 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/07 06:54:31.362988 3.001580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 06:54:38.370405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:54:46.371674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:55:02.374845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 06:55:34.380664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:01:35.850581 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 07:01:35.850772 0.166557 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:36.017777 0.061711 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:36.079922 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:01:38.386274 3.002399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:01:45.394000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:01:53.217491 0.055206 tcp 10.0.2.105 52182 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:01:53.272997 0.073821 tcp 10.0.2.105 52183 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:01:53.346920 0.139974 tcp 10.0.2.105 52184 -> 195.113.214.251 443 SRPA* 0 0 60 56834 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:01:53.395984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:01:53.487908 0.169501 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:53.657788 0.287846 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:53.946104 0.071992 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:54.018513 0.133398 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:01:54.152353 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:02:09.398533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:02:09.409188 0.032857 tcp 10.0.2.105 52185 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:02:09.441916 0.071360 tcp 10.0.2.105 52186 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:02:09.513583 0.159096 tcp 10.0.2.105 52187 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:02:09.673346 0.067979 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:09.741769 0.170013 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:09.912255 0.072034 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:09.984762 0.057303 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.042509 0.065428 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.108583 0.148912 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.257944 0.093766 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.352140 0.147852 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.500387 0.061014 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.561770 0.148717 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.710976 0.173327 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:10.884695 0.204477 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.089685 0.056089 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.146146 0.145532 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.292093 0.047090 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.339640 0.132942 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.473048 0.212084 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.685562 0.023106 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.709088 0.220715 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:11.930223 0.208383 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:12.139039 0.222547 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:12.362063 0.390759 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:12.753251 0.314915 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:02:41.404750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:08:45.411193 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:08:52.418311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:09:00.420338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:09:16.422608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:09:48.428993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:15:52.435828 3.000397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:15:59.444104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:16:07.444000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:16:23.446948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:16:55.453128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:17:10.365082 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 07:17:10.365176 0.917521 tcp 10.0.2.105 52188 -> 31.192.24.67 3527 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:22:59.459428 3.001429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:23:06.465935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:23:14.467531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:23:30.471359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:24:02.476773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:30:06.482787 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:30:13.490728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:30:21.491682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:30:37.494962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:31:09.528824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:32:38.188659 0.000209 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 07:32:38.188966 0.108730 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:38.298165 0.213420 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:38.512017 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:32:56.217798 0.054245 tcp 10.0.2.105 52189 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:32:56.272529 0.075002 tcp 10.0.2.105 52190 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:32:56.347845 0.178333 tcp 10.0.2.105 52191 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:32:56.524592 0.057987 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:56.583101 0.074367 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:56.657947 0.134504 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:56.792874 0.289911 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.083199 0.168249 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.251849 0.071443 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.323720 0.059773 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.383919 0.062727 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.447071 0.063266 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.510766 0.080473 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.591665 0.148400 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.740532 0.083233 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.824236 0.148961 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:57.973631 0.045228 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:58.019402 0.156130 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:58.175954 0.172634 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:58.348967 0.185572 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:32:58.535013 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:33:17.145782 0.057373 tcp 10.0.2.105 52192 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:17.203452 0.075642 tcp 10.0.2.105 52193 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:17.278856 0.158863 tcp 10.0.2.105 52194 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:17.438290 0.145078 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:17.583781 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:33:34.149585 0.052409 tcp 10.0.2.105 52195 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:34.202325 0.076357 tcp 10.0.2.105 52196 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:34.279008 0.180391 tcp 10.0.2.105 52197 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:34.459976 0.131705 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:34.592083 0.211982 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:34.804568 0.029815 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:34.834801 0.213545 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:35.048955 0.136500 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:35.185970 0.312827 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:33:35.499283 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 07:33:53.417143 0.035790 tcp 10.0.2.105 52198 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:53.453243 0.072544 tcp 10.0.2.105 52199 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:53.525669 0.155407 tcp 10.0.2.105 52200 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:33:53.679550 0.206620 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/07 07:37:13.516682 3.001718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 07:37:20.526745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:37:28.528800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:37:44.528469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:38:16.536098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:44:20.541666 3.000380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:44:27.547929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:44:35.549275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:44:51.553452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:45:23.558731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:47:11.285047 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 07:47:11.285145 0.757373 tcp 10.0.2.105 52201 -> 31.192.24.67 3527 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/07 07:54:43.567361 3.000767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 07:54:50.573992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:54:58.577946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:55:14.578210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 07:55:46.585175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:01:50.590847 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 08:01:57.598047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:02:05.599361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:02:21.602305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:02:53.609093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:04:17.189291 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 08:04:17.189398 0.163563 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:04:17.353446 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 08:04:34.305469 0.054933 tcp 10.0.2.105 52202 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:34.360715 0.077623 tcp 10.0.2.105 52203 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:34.438662 0.162893 tcp 10.0.2.105 52204 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:34.602294 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 08:04:51.418464 0.053546 tcp 10.0.2.105 52205 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:51.471856 0.078046 tcp 10.0.2.105 52206 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:51.550357 0.156349 tcp 10.0.2.105 52207 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:04:51.707334 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 08:05:07.461166 0.054939 tcp 10.0.2.105 52208 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:05:07.516559 0.072970 tcp 10.0.2.105 52209 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:05:07.589829 0.185714 tcp 10.0.2.105 52210 -> 195.113.214.251 443 SRPA* 0 0 52 32612 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:05:07.773670 0.215750 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:07.989874 0.115775 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.106041 0.166062 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.272682 0.076871 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.349907 0.062333 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.412645 0.134387 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.547419 0.292851 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.840746 0.061531 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.902741 0.080323 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:08.983545 0.058547 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.042478 0.089480 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.132453 0.144786 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.277662 0.043799 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.321935 0.143761 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.466119 0.070721 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.537221 0.147006 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.684699 0.063336 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.748603 0.172011 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:09.920983 0.190898 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:10.112400 0.864445 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:10.977265 0.036766 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:11.014470 0.224118 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:11.239007 2.460595 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:13.700168 0.213551 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:13.914145 0.136555 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:14.051086 0.315181 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:05:14.366649 0.217486 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:08:57.615690 3.000422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 08:09:04.621778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:09:12.628755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:09:28.628766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:10:00.632350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:16:04.641022 2.998894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 08:16:11.646865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:16:19.647390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:16:35.650179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:17:07.659709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:17:12.043443 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 08:17:12.043550 0.541930 tcp 10.0.2.105 52211 -> 31.192.24.67 3527 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:23:11.662715 3.001706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 08:23:18.669823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:23:26.671164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:23:42.673969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:24:14.683615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:30:18.686667 3.051633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 08:30:25.714410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:30:33.705133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:30:49.707857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:31:21.713990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:35:38.794039 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 08:35:38.794148 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 08:35:56.962311 0.055553 tcp 10.0.2.105 52212 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:35:57.017680 0.077381 tcp 10.0.2.105 52213 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:35:57.095341 0.234233 tcp 10.0.2.105 52214 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:35:57.330183 0.168046 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:57.498667 0.073481 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:57.572512 0.214305 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:57.787210 0.104689 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:57.892487 0.059065 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:57.951916 0.134250 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.086537 0.281996 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.368999 0.065284 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.434702 0.080122 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.515314 0.057714 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.573487 0.082007 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.655916 0.144100 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.800533 0.043115 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.844089 0.146427 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:58.990973 0.072247 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:59.063699 0.171577 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:35:59.235765 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 08:36:14.976273 0.051677 tcp 10.0.2.105 52215 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:36:15.028425 0.076773 tcp 10.0.2.105 52216 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:36:15.105503 0.163379 tcp 10.0.2.105 52217 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:36:15.269433 0.148831 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:15.418640 0.061713 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:15.480770 0.143116 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:15.624320 0.025799 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:15.650537 0.223073 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:15.874154 0.133143 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:16.007657 0.313518 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:16.322115 0.207874 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:16.530480 0.108914 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:36:16.639837 0.221262 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/07 08:37:25.721404 3.004716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 08:37:32.727455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:37:40.728984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:37:56.732091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:38:28.739032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:44:32.744736 3.002070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 08:44:39.751425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:44:47.754848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:45:03.758671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:45:35.762074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:47:12.594103 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 08:47:12.594210 3.001438 tcp 10.0.2.105 52218 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:21.594540 0.000000 tcp 10.0.2.105 52218 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:27.595145 0.054013 tcp 10.0.2.105 52219 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:27.648906 0.072084 tcp 10.0.2.105 52220 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:27.721337 0.166330 tcp 10.0.2.105 52221 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:27.943438 2.994453 tcp 10.0.2.105 52222 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:36.946265 0.000000 tcp 10.0.2.105 52222 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:42.946212 0.098425 tcp 10.0.2.105 52223 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:43.044947 0.185049 tcp 10.0.2.105 52224 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:43.230351 0.163033 tcp 10.0.2.105 52225 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:43.830553 2.993225 tcp 10.0.2.105 52226 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:52.819130 0.000000 tcp 10.0.2.105 52226 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 08:47:58.818635 0.053823 tcp 10.0.2.105 52227 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:58.872311 0.073402 tcp 10.0.2.105 52228 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:58.946027 0.157829 tcp 10.0.2.105 52229 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:47:59.373289 0.720683 tcp 10.0.2.105 52230 -> 176.73.126.145 3888 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/02/07 08:54:45.776472 3.000494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 08:54:52.783018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:55:00.784459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:55:16.787492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 08:55:48.795407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:01:52.799692 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:01:59.806786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:02:07.808130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:02:23.811557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:02:55.817125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:06:43.515501 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 09:06:43.515617 0.165289 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:43.681381 0.191609 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:43.873447 0.096107 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:43.969957 0.060087 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.030451 0.136003 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.166942 0.167368 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.334775 0.070878 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.406107 0.215404 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.621897 0.062057 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:44.684513 0.284578 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.009167 0.056951 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.066561 0.088675 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.155618 0.144222 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.300306 0.051654 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.352510 0.146674 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.499609 0.071424 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.571496 0.172136 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.744072 0.093635 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.838233 0.146710 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:45.985356 0.062031 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.047806 0.142525 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.190751 0.036913 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.228085 0.222737 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.451246 0.135579 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.587197 0.128618 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.716168 0.249360 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:46.965947 0.312917 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:06:47.279244 0.211034 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:09:01.828577 2.999909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:09:08.833696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:09:16.835129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:09:32.838353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:10:04.846339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:16:08.850839 3.004728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:16:15.862051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:16:23.859231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:16:39.863649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:17:11.868211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:18:00.098704 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 09:18:00.098818 0.601151 tcp 10.0.2.105 52231 -> 176.73.126.145 3888 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/07 09:23:15.874687 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:23:22.881651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:23:30.882752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:23:46.887957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:24:18.892433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:30:22.898883 3.002468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:30:29.906292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:30:37.910771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:30:53.910056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:31:25.916339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:37:09.592385 0.000187 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 09:37:09.592687 0.073778 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:09.666993 0.062293 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:09.729747 0.135559 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:09.865679 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 09:37:27.097697 0.056407 tcp 10.0.2.105 52232 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 09:37:27.154518 0.075406 tcp 10.0.2.105 52233 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 09:37:27.229786 0.157669 tcp 10.0.2.105 52234 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 09:37:27.388413 0.184584 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:27.573434 0.168633 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:27.742429 0.076734 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:27.819591 0.212717 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.032815 0.062965 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.096419 0.281657 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.378531 0.059680 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.438666 0.088671 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.527866 0.146912 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.675288 0.042465 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.718116 0.146898 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.865361 0.070485 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:28.936514 0.173547 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.110608 0.081170 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.192276 0.146344 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.339062 0.064894 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.404571 0.351353 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.756516 0.023789 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.780919 0.114084 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.895475 0.213556 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:29.924727 2.999365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:37:30.109502 0.229231 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:30.339201 0.139042 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:30.478688 0.314653 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:30.793717 0.206157 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/07 09:37:36.931697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:37:44.931354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:38:00.934154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:38:32.940204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:44:36.946590 3.002232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:44:43.953572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:44:51.954908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:45:07.958801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:45:39.967370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:48:00.707083 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 09:48:00.707189 0.613888 tcp 10.0.2.105 52235 -> 176.73.126.145 3888 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/07 09:54:47.975213 3.001119 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 09:54:54.981985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:55:02.983542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:55:18.986537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 09:55:50.992841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:01:54.999679 3.000830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:02:02.005995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:02:10.007130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:02:26.010751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:02:58.016861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:07:32.781868 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:07:32.781972 0.166239 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:32.948647 0.059664 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.008749 0.073967 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.083105 0.132522 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.216100 0.188931 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.405434 0.169114 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.575003 0.076306 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.651809 0.218543 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.870827 0.069323 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:33.940741 0.289077 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.230267 0.058266 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.288974 0.089948 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.379299 0.147859 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.527623 0.056007 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.584060 0.146228 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:34.730717 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 10:07:50.609595 0.054235 tcp 10.0.2.105 52236 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:07:50.663678 0.074699 tcp 10.0.2.105 52237 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:07:50.738131 0.165652 tcp 10.0.2.105 52238 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:07:50.904071 0.171483 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.075983 0.097005 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.173393 0.147190 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.320933 0.077798 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.399098 0.145542 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.545058 0.023577 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.569043 0.116042 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:07:51.685509 0.000000 udp 10.0.2.105 7010 -> 190.205.193.197 7746 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 10:08:06.830894 0.056522 tcp 10.0.2.105 52239 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:08:06.887727 0.071162 tcp 10.0.2.105 52240 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:08:06.959259 0.161101 tcp 10.0.2.105 52241 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:08:07.119581 0.315202 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:08:07.435218 0.205400 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:08:07.641001 0.222289 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:08:07.863721 0.134374 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:09:04.025751 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 10:09:11.032754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:09:19.034710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:09:35.037462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:10:07.043510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:16:11.048763 3.002094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:16:18.056957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:16:26.058103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:16:42.061468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:17:14.067377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:18:01.325747 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:18:01.325849 0.655178 tcp 10.0.2.105 52242 -> 176.73.126.145 3888 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:23:18.073200 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:23:25.080279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:23:33.082816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:23:49.085281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:24:21.091356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:30:25.098399 3.000248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:30:32.104922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:30:40.106100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:30:56.109141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:31:28.115257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:37:32.121143 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:37:39.130901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:37:47.130438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:38:03.133308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:38:25.257358 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:38:25.257468 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 10:38:35.139226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:38:42.782220 0.051149 tcp 10.0.2.105 52243 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:38:42.833678 0.076577 tcp 10.0.2.105 52244 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:38:42.910243 0.156436 tcp 10.0.2.105 52245 -> 195.113.214.251 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:38:43.067394 0.214334 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:38:43.282197 0.073456 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:38:43.356034 0.059236 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:38:43.415737 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 10:38:59.754874 0.050023 tcp 10.0.2.105 52246 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:38:59.805216 0.076687 tcp 10.0.2.105 52247 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:38:59.882203 0.171467 tcp 10.0.2.105 52248 -> 195.113.214.251 443 SRPA* 0 0 52 30936 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:39:00.050974 0.135014 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:00.186368 0.086047 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:00.489679 0.215321 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:00.705405 0.166510 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:00.872366 0.285561 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.158377 0.196932 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.355764 0.062119 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.418389 0.044236 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.463081 0.153843 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.617296 0.059950 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.677704 0.086858 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.765008 0.144531 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.909952 0.080100 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:01.990470 0.170966 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.161868 0.144308 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.306529 0.023413 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.330305 0.126991 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.457748 0.063935 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.522095 0.148444 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.670938 0.214635 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:02.886016 0.131593 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:03.018033 0.311823 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:39:03.330277 0.207945 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/07 10:44:39.145688 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 10:44:46.153015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:44:54.154068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:45:10.157363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:45:42.163281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:48:01.985253 0.000217 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:48:01.985595 2.992385 tcp 10.0.2.105 52249 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:10.977245 0.000000 tcp 10.0.2.105 52249 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:16.987434 0.055633 tcp 10.0.2.105 52250 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:17.043213 0.076228 tcp 10.0.2.105 52251 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:17.119829 0.159780 tcp 10.0.2.105 52252 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:17.706399 2.994885 tcp 10.0.2.105 52253 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:26.701431 0.000000 tcp 10.0.2.105 52253 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:32.699401 0.052513 tcp 10.0.2.105 52254 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:32.752383 0.077428 tcp 10.0.2.105 52255 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:32.829658 0.163226 tcp 10.0.2.105 52256 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:33.208139 3.005753 tcp 10.0.2.105 52257 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:42.212116 0.000000 tcp 10.0.2.105 52257 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:48.200856 0.054539 tcp 10.0.2.105 52258 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:48.255765 0.075629 tcp 10.0.2.105 52259 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:48.331688 0.163277 tcp 10.0.2.105 52260 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:48:48.526640 2.998724 tcp 10.0.2.105 52261 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:48:57.524128 0.000000 tcp 10.0.2.105 52261 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:03.523690 0.053225 tcp 10.0.2.105 52262 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:03.576702 0.078075 tcp 10.0.2.105 52263 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:03.655101 0.161087 tcp 10.0.2.105 52264 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:03.914196 2.993300 tcp 10.0.2.105 52265 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:12.916448 0.000000 tcp 10.0.2.105 52265 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:18.915741 0.054105 tcp 10.0.2.105 52266 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:18.970164 0.076018 tcp 10.0.2.105 52267 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:19.046455 0.157273 tcp 10.0.2.105 52268 -> 195.113.214.251 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:49:19.217067 2.993433 tcp 10.0.2.105 52269 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:28.208743 0.000000 tcp 10.0.2.105 52269 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:34.217165 3.003973 tcp 10.0.2.105 52270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:43.219631 0.000000 tcp 10.0.2.105 52270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:47.865886 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:49:49.218513 3.004467 tcp 10.0.2.105 52271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:49:58.221123 0.000000 tcp 10.0.2.105 52271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:50:04.220456 3.003797 tcp 10.0.2.105 52272 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:50:11.871098 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:50:13.223026 0.000000 tcp 10.0.2.105 52272 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:50:19.221986 3.003818 tcp 10.0.2.105 52273 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:50:28.224581 0.000000 tcp 10.0.2.105 52273 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:54:50.173847 3.002154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 10:54:57.181065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:55:05.182666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:55:21.185785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:55:34.225539 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:55:34.225633 2.993071 tcp 10.0.2.105 52274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:55:43.217513 0.000000 tcp 10.0.2.105 52274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:55:49.228615 0.049622 tcp 10.0.2.105 52275 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:55:49.278504 0.073714 tcp 10.0.2.105 52276 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:55:49.352572 0.161377 tcp 10.0.2.105 52277 -> 195.113.214.251 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:55:50.823434 2.999167 tcp 10.0.2.105 52278 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:55:53.192187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 10:55:59.821245 0.000000 tcp 10.0.2.105 52278 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:56:05.820713 0.049295 tcp 10.0.2.105 52279 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:56:05.870296 0.075018 tcp 10.0.2.105 52280 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:56:05.945714 0.154739 tcp 10.0.2.105 52281 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/07 10:56:07.097724 3.008220 tcp 10.0.2.105 52282 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:56:16.105281 0.000000 tcp 10.0.2.105 52282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:56:22.093408 3.004276 tcp 10.0.2.105 52283 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 10:56:29.874240 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 10:56:31.106139 0.000000 tcp 10.0.2.105 52283 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:01:37.096763 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:01:37.096953 2.993182 tcp 10.0.2.105 52284 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:01:46.088626 0.000000 tcp 10.0.2.105 52284 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:01:52.100198 0.105170 tcp 10.0.2.105 52285 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:01:52.205657 0.074999 tcp 10.0.2.105 52286 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:01:52.280499 0.174133 tcp 10.0.2.105 52287 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:01:52.466047 2.996548 tcp 10.0.2.105 52288 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:01:57.198227 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:02:01.461294 0.000000 tcp 10.0.2.105 52288 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:02:04.205100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:02:07.460699 0.057655 tcp 10.0.2.105 52289 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:02:07.518578 0.080485 tcp 10.0.2.105 52290 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:02:07.599354 0.152521 tcp 10.0.2.105 52291 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:02:07.791040 3.003224 tcp 10.0.2.105 52292 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:02:12.206694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:02:16.793275 0.000000 tcp 10.0.2.105 52292 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:02:22.792448 3.003466 tcp 10.0.2.105 52293 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:02:28.209752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:02:31.794700 0.000000 tcp 10.0.2.105 52293 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:02:36.371527 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:03:00.215897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:07:37.795260 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:07:37.795371 2.993614 tcp 10.0.2.105 52294 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:07:46.787846 0.000000 tcp 10.0.2.105 52294 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:07:52.798251 0.057639 tcp 10.0.2.105 52295 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:07:52.856198 0.073247 tcp 10.0.2.105 52296 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:07:52.929778 0.169789 tcp 10.0.2.105 52297 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:07:53.146656 2.994729 tcp 10.0.2.105 52298 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:08:02.139437 0.000000 tcp 10.0.2.105 52298 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:09:07.225433 3.002179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 11:09:12.651782 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:09:12.652058 0.173089 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:12.817889 0.139504 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:12.937086 0.267419 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:13.327774 0.062319 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:13.438346 0.150397 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:13.751765 0.171572 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 1973 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:14.212099 0.287062 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:14.234308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:09:14.718850 0.115931 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:14.797068 0.225638 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.016125 0.205331 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.304890 0.090709 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.402726 0.090451 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.453998 0.174130 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.751177 0.076921 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:15.811572 0.171139 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.081460 0.170333 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.230530 0.127960 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.460937 0.177479 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.635445 0.172755 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.824359 0.038536 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:16.862272 0.203786 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:17.060451 0.073768 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:17.282360 0.174500 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:17.457125 0.230329 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:17.677794 0.149886 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:17.878633 0.314750 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:18.299123 0.211492 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:09:22.234859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:09:38.237872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:10:10.243889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:13:08.140473 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:13:08.140576 3.004254 tcp 10.0.2.105 52299 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:17.142706 0.000000 tcp 10.0.2.105 52299 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:23.143409 0.053735 tcp 10.0.2.105 52300 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:23.197396 0.076211 tcp 10.0.2.105 52301 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:23.273839 0.156220 tcp 10.0.2.105 52302 -> 195.113.214.251 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:23.549147 3.007453 tcp 10.0.2.105 52303 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:32.554966 0.000000 tcp 10.0.2.105 52303 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:38.544876 0.053060 tcp 10.0.2.105 52304 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:38.597805 0.423523 tcp 10.0.2.105 52305 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:39.021677 0.161886 tcp 10.0.2.105 52306 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:39.407772 3.001105 tcp 10.0.2.105 52307 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:48.407623 0.000000 tcp 10.0.2.105 52307 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:13:54.406499 0.053012 tcp 10.0.2.105 52308 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:54.459809 0.071192 tcp 10.0.2.105 52309 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:54.531299 0.159994 tcp 10.0.2.105 52310 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:13:55.247731 3.004080 tcp 10.0.2.105 52311 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:04.250617 0.000000 tcp 10.0.2.105 52311 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:10.249524 0.055499 tcp 10.0.2.105 52312 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:10.304903 0.076729 tcp 10.0.2.105 52313 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:10.380320 0.160877 tcp 10.0.2.105 52314 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:10.886491 2.997653 tcp 10.0.2.105 52315 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:20.052333 0.000000 tcp 10.0.2.105 52315 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:25.995903 0.053175 tcp 10.0.2.105 52316 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:26.049397 0.076251 tcp 10.0.2.105 52317 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:26.125947 0.161903 tcp 10.0.2.105 52318 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:14:26.572111 2.979878 tcp 10.0.2.105 52319 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:35.493957 0.000000 tcp 10.0.2.105 52319 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:41.464475 2.993689 tcp 10.0.2.105 52320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:50.468651 0.000000 tcp 10.0.2.105 52320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:14:55.373941 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:14:56.465685 2.994126 tcp 10.0.2.105 52321 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:15:05.458422 0.000000 tcp 10.0.2.105 52321 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:15:11.467124 3.004340 tcp 10.0.2.105 52322 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:15:19.368778 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:15:20.469994 0.000000 tcp 10.0.2.105 52322 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:15:26.468975 3.003903 tcp 10.0.2.105 52323 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:15:35.471794 0.000000 tcp 10.0.2.105 52323 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:16:14.251025 3.000537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:16:21.257547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:16:29.258743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:16:45.261850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:17:17.267755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:20:41.472094 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:20:41.472192 3.003799 tcp 10.0.2.105 52324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:20:50.476719 0.000000 tcp 10.0.2.105 52324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:20:56.474780 0.054178 tcp 10.0.2.105 52325 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:20:56.529309 0.068137 tcp 10.0.2.105 52326 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:20:56.597748 0.157748 tcp 10.0.2.105 52327 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:20:56.815241 2.992640 tcp 10.0.2.105 52328 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:05.816631 0.000000 tcp 10.0.2.105 52328 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:11.815878 0.052627 tcp 10.0.2.105 52329 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:11.868868 0.073107 tcp 10.0.2.105 52330 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:11.942322 0.160048 tcp 10.0.2.105 52331 -> 195.113.214.251 443 SRPA* 0 0 23 13140 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:12.148466 3.001385 tcp 10.0.2.105 52332 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:21.148995 0.000000 tcp 10.0.2.105 52332 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:27.148116 0.054169 tcp 10.0.2.105 52333 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:27.202169 0.077094 tcp 10.0.2.105 52334 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:27.279601 0.159983 tcp 10.0.2.105 52335 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:27.467913 3.004082 tcp 10.0.2.105 52336 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:36.470601 0.000000 tcp 10.0.2.105 52336 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:42.460342 0.057184 tcp 10.0.2.105 52337 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:42.517850 0.075679 tcp 10.0.2.105 52338 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:42.593832 0.166100 tcp 10.0.2.105 52339 -> 195.113.214.251 443 SRPA* 0 0 35 19368 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:43.058813 3.005906 tcp 10.0.2.105 52340 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:52.062791 0.000000 tcp 10.0.2.105 52340 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:21:58.052442 0.054045 tcp 10.0.2.105 52341 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:58.106294 0.072105 tcp 10.0.2.105 52342 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:58.178205 0.176985 tcp 10.0.2.105 52343 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:21:58.541027 3.005553 tcp 10.0.2.105 52344 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:07.545558 0.000000 tcp 10.0.2.105 52344 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:13.541106 2.988750 tcp 10.0.2.105 52345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:22.536985 0.000000 tcp 10.0.2.105 52345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:27.375018 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:22:28.535603 2.994068 tcp 10.0.2.105 52346 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:37.528738 0.000000 tcp 10.0.2.105 52346 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:43.537248 3.004124 tcp 10.0.2.105 52347 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:51.368129 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:22:52.539997 0.000000 tcp 10.0.2.105 52347 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:22:58.539121 3.003958 tcp 10.0.2.105 52348 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:23:07.541518 0.000000 tcp 10.0.2.105 52348 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:23:21.274243 3.002275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:23:28.281453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:23:36.283134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:23:52.285822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:24:24.292121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:28:13.542032 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:28:13.542134 3.003680 tcp 10.0.2.105 52349 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:22.544776 0.000000 tcp 10.0.2.105 52349 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:28.545612 0.054960 tcp 10.0.2.105 52350 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:28.600777 0.072432 tcp 10.0.2.105 52351 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:28.673527 0.171608 tcp 10.0.2.105 52352 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:28.992854 2.995102 tcp 10.0.2.105 52353 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:37.996135 0.000000 tcp 10.0.2.105 52353 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:43.986644 0.053575 tcp 10.0.2.105 52354 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:44.040552 0.148754 tcp 10.0.2.105 52355 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:44.189610 0.161691 tcp 10.0.2.105 52356 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:44.372708 2.997351 tcp 10.0.2.105 52357 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:53.369063 0.000000 tcp 10.0.2.105 52357 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:28:59.368499 0.055403 tcp 10.0.2.105 52358 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:59.424217 0.072688 tcp 10.0.2.105 52359 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:59.497237 0.159642 tcp 10.0.2.105 52360 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:28:59.785364 2.996903 tcp 10.0.2.105 52361 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:08.780907 0.000000 tcp 10.0.2.105 52361 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:14.780040 0.051879 tcp 10.0.2.105 52362 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:14.832260 0.075850 tcp 10.0.2.105 52363 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:14.908609 0.158435 tcp 10.0.2.105 52364 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:15.114028 3.000366 tcp 10.0.2.105 52365 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:24.113244 0.000000 tcp 10.0.2.105 52365 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:30.112380 0.059126 tcp 10.0.2.105 52366 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:30.171889 0.070220 tcp 10.0.2.105 52367 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:30.242386 0.184902 tcp 10.0.2.105 52368 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:29:30.585278 3.001418 tcp 10.0.2.105 52369 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:39.585193 0.000000 tcp 10.0.2.105 52369 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:45.584081 2.994181 tcp 10.0.2.105 52370 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:54.586865 0.000000 tcp 10.0.2.105 52370 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:29:59.373718 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:30:00.585460 2.994519 tcp 10.0.2.105 52371 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:09.578843 0.000000 tcp 10.0.2.105 52371 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:15.587569 3.003730 tcp 10.0.2.105 52372 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:23.368132 0.000248 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:30:24.589831 0.000000 tcp 10.0.2.105 52372 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:28.297949 3.003244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:30:30.588374 3.004764 tcp 10.0.2.105 52373 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:35.305606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:30:39.591411 0.000000 tcp 10.0.2.105 52373 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:30:43.306880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:30:59.310201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:31:31.315808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:35:45.592357 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:35:45.592476 3.003142 tcp 10.0.2.105 52374 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:35:54.597091 0.000000 tcp 10.0.2.105 52374 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:00.595395 0.053548 tcp 10.0.2.105 52375 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:00.649282 0.075665 tcp 10.0.2.105 52376 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:00.725253 0.264885 tcp 10.0.2.105 52377 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:01.077071 3.000919 tcp 10.0.2.105 52378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:10.086162 0.000000 tcp 10.0.2.105 52378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:16.158342 0.053193 tcp 10.0.2.105 52379 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:16.211838 0.072173 tcp 10.0.2.105 52380 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:16.284410 0.164251 tcp 10.0.2.105 52381 -> 195.113.214.251 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:16.728995 2.972764 tcp 10.0.2.105 52382 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:25.649684 0.000000 tcp 10.0.2.105 52382 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:31.649476 0.055702 tcp 10.0.2.105 52383 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:31.705520 0.072919 tcp 10.0.2.105 52384 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:31.778246 0.160829 tcp 10.0.2.105 52385 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:32.066556 2.995981 tcp 10.0.2.105 52386 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:41.061164 0.000000 tcp 10.0.2.105 52386 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:47.060451 0.053118 tcp 10.0.2.105 52387 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:47.113888 0.076418 tcp 10.0.2.105 52388 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:47.190685 0.159439 tcp 10.0.2.105 52389 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:36:47.713970 3.002020 tcp 10.0.2.105 52390 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:36:56.714957 0.000000 tcp 10.0.2.105 52390 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:02.712831 0.054683 tcp 10.0.2.105 52391 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:37:02.767846 0.073855 tcp 10.0.2.105 52392 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:37:02.842086 0.163713 tcp 10.0.2.105 52393 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:37:03.307588 2.999807 tcp 10.0.2.105 52394 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:12.316404 0.000000 tcp 10.0.2.105 52394 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:18.304980 2.994072 tcp 10.0.2.105 52395 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:27.297617 0.000000 tcp 10.0.2.105 52395 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:31.864195 0.000197 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:37:33.306482 2.994305 tcp 10.0.2.105 52396 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:35.322216 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:37:42.299340 0.000000 tcp 10.0.2.105 52396 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:42.329382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:37:48.308095 3.004221 tcp 10.0.2.105 52397 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:37:50.330871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:37:55.868731 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:37:57.311086 0.000000 tcp 10.0.2.105 52397 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:38:03.309618 3.004385 tcp 10.0.2.105 52398 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:38:06.334056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:38:12.312945 0.000000 tcp 10.0.2.105 52398 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:38:38.339977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:39:28.462426 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:39:28.462620 0.175266 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2648 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:28.629516 0.109380 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:28.826427 0.239835 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:29.040208 0.062882 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:29.122084 2.943395 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:32.051568 0.169278 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:32.218158 0.222908 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:32.433991 0.211503 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:32.632943 0.274106 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:33.187742 0.116811 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:33.265168 0.085236 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:33.426021 0.080035 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:33.946273 0.166842 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:34.182674 0.074740 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:34.243048 0.096869 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:34.662901 0.172005 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:34.813192 0.170084 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.035231 0.041962 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.064222 0.177602 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.330600 0.130064 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.416970 0.175579 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.588692 0.075374 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:35.770811 0.176187 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2550 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:36.004517 0.227989 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:36.221646 0.148606 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:36.455375 0.315206 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:39:36.933037 0.221426 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/07 11:43:18.313408 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:43:18.313539 3.003289 tcp 10.0.2.105 52399 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:43:27.315244 0.000000 tcp 10.0.2.105 52399 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:43:33.316381 0.054904 tcp 10.0.2.105 52400 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:33.371615 0.073594 tcp 10.0.2.105 52401 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:33.445564 0.157873 tcp 10.0.2.105 52402 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:33.933900 2.995432 tcp 10.0.2.105 52403 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:43:42.927912 0.000000 tcp 10.0.2.105 52403 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:43:48.926535 0.055242 tcp 10.0.2.105 52404 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:48.982097 0.074952 tcp 10.0.2.105 52405 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:49.057322 0.158189 tcp 10.0.2.105 52406 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:43:49.440603 3.243565 tcp 10.0.2.105 52407 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:43:58.629400 0.000000 tcp 10.0.2.105 52407 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:04.584809 0.053954 tcp 10.0.2.105 52408 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:04.639062 0.071762 tcp 10.0.2.105 52409 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:04.711222 0.156719 tcp 10.0.2.105 52410 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:05.517744 2.974108 tcp 10.0.2.105 52411 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:14.432358 0.000000 tcp 10.0.2.105 52411 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:20.392934 0.070237 tcp 10.0.2.105 52412 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:20.463570 0.071275 tcp 10.0.2.105 52413 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:20.535146 0.161529 tcp 10.0.2.105 52414 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:20.960758 3.006862 tcp 10.0.2.105 52415 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:29.964844 0.000000 tcp 10.0.2.105 52415 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:35.955970 0.055712 tcp 10.0.2.105 52416 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:36.011993 0.072594 tcp 10.0.2.105 52417 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:36.084866 0.173932 tcp 10.0.2.105 52418 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:44:36.483153 2.997327 tcp 10.0.2.105 52419 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:42.346946 3.000774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:44:45.477591 0.000000 tcp 10.0.2.105 52419 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:49.353287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:44:51.476436 2.994161 tcp 10.0.2.105 52420 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:44:57.354888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:45:00.470846 0.000000 tcp 10.0.2.105 52420 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:05.366217 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:45:06.478381 3.004130 tcp 10.0.2.105 52421 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:13.357968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:45:15.480853 0.000000 tcp 10.0.2.105 52421 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:21.479603 3.007158 tcp 10.0.2.105 52422 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:29.370836 0.912242 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:45:31.373845 0.000000 tcp 10.0.2.105 52422 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:37.296762 2.977344 tcp 10.0.2.105 52423 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:45:46.082183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:45:46.202246 0.000000 tcp 10.0.2.105 52423 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:50:51.484157 0.000212 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:50:51.484504 2.993606 tcp 10.0.2.105 52424 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:00.486992 0.000000 tcp 10.0.2.105 52424 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:06.487406 0.054762 tcp 10.0.2.105 52425 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:06.542455 0.071344 tcp 10.0.2.105 52426 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:06.614058 0.156122 tcp 10.0.2.105 52427 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:06.792238 2.997766 tcp 10.0.2.105 52428 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:15.788929 0.000000 tcp 10.0.2.105 52428 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:21.787899 0.052642 tcp 10.0.2.105 52429 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:21.840885 0.073502 tcp 10.0.2.105 52430 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:21.914662 0.160689 tcp 10.0.2.105 52431 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:22.148929 3.003547 tcp 10.0.2.105 52432 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:31.151750 0.000000 tcp 10.0.2.105 52432 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:37.150172 0.056076 tcp 10.0.2.105 52433 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:37.206502 0.070689 tcp 10.0.2.105 52434 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:37.277484 0.156641 tcp 10.0.2.105 52435 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:37.466515 2.997712 tcp 10.0.2.105 52436 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:46.463186 0.000000 tcp 10.0.2.105 52436 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:51:52.462478 0.056898 tcp 10.0.2.105 52437 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:52.519711 0.077599 tcp 10.0.2.105 52438 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:52.597602 0.158382 tcp 10.0.2.105 52439 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:51:52.827983 3.008445 tcp 10.0.2.105 52440 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:01.835056 0.000000 tcp 10.0.2.105 52440 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:07.824630 0.058216 tcp 10.0.2.105 52441 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:52:07.883157 0.076552 tcp 10.0.2.105 52442 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:52:07.959525 0.163487 tcp 10.0.2.105 52443 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:52:08.151007 2.997227 tcp 10.0.2.105 52444 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:17.156920 0.000000 tcp 10.0.2.105 52444 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:23.146038 2.993904 tcp 10.0.2.105 52445 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:32.138652 0.000000 tcp 10.0.2.105 52445 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:36.865345 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:52:38.147345 3.004177 tcp 10.0.2.105 52446 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:47.150110 0.000000 tcp 10.0.2.105 52446 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:52:53.149131 3.004021 tcp 10.0.2.105 52447 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:53:00.870175 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:53:02.151748 0.000000 tcp 10.0.2.105 52447 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:53:08.150462 3.004256 tcp 10.0.2.105 52448 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:53:17.153310 0.000000 tcp 10.0.2.105 52448 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:54:53.374249 3.001905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 11:55:00.381671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:55:08.383366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:55:24.386188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:55:56.392397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 11:58:23.154039 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 11:58:23.154154 2.993267 tcp 10.0.2.105 52449 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:58:32.156369 0.000000 tcp 10.0.2.105 52449 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:58:38.157016 0.056895 tcp 10.0.2.105 52450 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:38.214203 0.072504 tcp 10.0.2.105 52451 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:38.287029 0.157886 tcp 10.0.2.105 52452 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:38.460354 2.999493 tcp 10.0.2.105 52453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:58:47.458261 0.000000 tcp 10.0.2.105 52453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:58:53.457918 0.057286 tcp 10.0.2.105 52454 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:53.515583 0.076098 tcp 10.0.2.105 52455 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:53.591519 0.152814 tcp 10.0.2.105 52456 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:58:53.798989 3.002879 tcp 10.0.2.105 52457 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:02.800421 0.000000 tcp 10.0.2.105 52457 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:08.799547 0.055923 tcp 10.0.2.105 52458 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:08.855781 0.070408 tcp 10.0.2.105 52459 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:08.926514 0.159091 tcp 10.0.2.105 52460 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:09.112370 3.001156 tcp 10.0.2.105 52461 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:18.112418 0.000000 tcp 10.0.2.105 52461 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:24.111696 0.054019 tcp 10.0.2.105 52462 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:24.166055 0.075550 tcp 10.0.2.105 52463 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:24.242024 0.158163 tcp 10.0.2.105 52464 -> 195.113.214.251 443 SRPA* 0 0 48 27260 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:24.421870 3.004094 tcp 10.0.2.105 52465 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:33.424579 0.000000 tcp 10.0.2.105 52465 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:39.423451 0.052334 tcp 10.0.2.105 52466 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:39.476038 0.076520 tcp 10.0.2.105 52467 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:39.553093 0.155102 tcp 10.0.2.105 52468 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 11:59:39.830240 2.997734 tcp 10.0.2.105 52469 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:48.835963 0.000000 tcp 10.0.2.105 52469 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 11:59:54.825562 2.993666 tcp 10.0.2.105 52470 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:03.818218 0.000000 tcp 10.0.2.105 52470 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:08.364645 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:00:09.826919 2.995194 tcp 10.0.2.105 52471 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:18.819854 0.000000 tcp 10.0.2.105 52471 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:24.828488 3.004275 tcp 10.0.2.105 52472 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:32.369176 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:00:33.831244 0.000000 tcp 10.0.2.105 52472 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:39.830002 3.004063 tcp 10.0.2.105 52473 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:00:48.833068 0.000000 tcp 10.0.2.105 52473 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:02:00.399624 3.000300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:02:07.405752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:02:15.407503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:02:31.410241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:03:03.416275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:05:54.833738 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:05:54.833844 3.003161 tcp 10.0.2.105 52474 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:03.845639 0.000000 tcp 10.0.2.105 52474 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:09.835566 0.054628 tcp 10.0.2.105 52475 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:09.890161 0.072619 tcp 10.0.2.105 52476 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:09.963140 0.165520 tcp 10.0.2.105 52477 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:10.294240 2.995046 tcp 10.0.2.105 52478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:19.287793 0.000000 tcp 10.0.2.105 52478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:25.288787 0.052627 tcp 10.0.2.105 52479 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:25.341669 0.066876 tcp 10.0.2.105 52480 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:25.408842 0.167254 tcp 10.0.2.105 52481 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:25.682930 2.998511 tcp 10.0.2.105 52482 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:34.679989 0.000000 tcp 10.0.2.105 52482 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:40.679551 0.055105 tcp 10.0.2.105 52483 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:40.734494 0.073296 tcp 10.0.2.105 52484 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:40.808144 0.155290 tcp 10.0.2.105 52485 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:40.980667 3.002578 tcp 10.0.2.105 52486 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:49.982697 0.000000 tcp 10.0.2.105 52486 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:06:55.981416 0.056105 tcp 10.0.2.105 52487 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:56.037855 0.071279 tcp 10.0.2.105 52488 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:56.109448 0.161098 tcp 10.0.2.105 52489 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:06:56.310310 3.004997 tcp 10.0.2.105 52490 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:05.313891 0.000000 tcp 10.0.2.105 52490 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:11.303456 0.054909 tcp 10.0.2.105 52491 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:07:11.358657 0.071956 tcp 10.0.2.105 52492 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:07:11.430451 0.159838 tcp 10.0.2.105 52493 -> 195.113.214.251 443 SRPA* 0 0 46 41914 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:07:11.614647 3.003007 tcp 10.0.2.105 52494 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:20.626002 0.000000 tcp 10.0.2.105 52494 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:26.614891 2.994416 tcp 10.0.2.105 52495 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:35.607813 0.000000 tcp 10.0.2.105 52495 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:40.364561 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:07:41.616692 2.994606 tcp 10.0.2.105 52496 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:50.609366 0.000000 tcp 10.0.2.105 52496 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:07:56.618055 3.004061 tcp 10.0.2.105 52497 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:08:04.369710 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:08:05.620817 0.000000 tcp 10.0.2.105 52497 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:08:11.619833 3.003903 tcp 10.0.2.105 52498 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:08:20.622600 0.000000 tcp 10.0.2.105 52498 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:09:10.426565 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:09:17.435088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:09:25.437260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:09:41.438732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:09:47.808056 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:09:47.808350 0.243203 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:48.028526 0.061247 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:48.288884 0.174274 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:48.456289 0.100219 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:48.737738 0.149843 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:48.874083 0.246932 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:49.132422 0.277701 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:49.465487 0.112886 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:49.541263 0.223831 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:49.758415 0.213757 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:50.000867 0.090950 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:50.070550 0.079743 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:50.320864 0.170782 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:50.523251 0.077952 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:50.584592 0.596345 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:51.152854 0.042387 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:51.353370 0.095868 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:51.433035 0.172603 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:51.952775 0.234198 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:52.082371 0.133662 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:52.283359 0.176881 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:52.456849 0.074506 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:52.743656 0.173362 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:53.135135 0.238836 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:53.364787 0.212240 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:53.607332 0.143868 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:09:53.880982 0.317802 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:10:13.449243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:13:26.623125 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:13:26.623231 3.003685 tcp 10.0.2.105 52499 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:13:35.625379 0.000000 tcp 10.0.2.105 52499 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:13:41.627515 0.032119 tcp 10.0.2.105 52500 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:41.659926 0.073302 tcp 10.0.2.105 52501 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:41.733607 0.150748 tcp 10.0.2.105 52502 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:41.920627 2.998451 tcp 10.0.2.105 52503 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:13:50.917358 0.000000 tcp 10.0.2.105 52503 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:13:56.919478 0.053042 tcp 10.0.2.105 52504 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:56.972475 0.075228 tcp 10.0.2.105 52505 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:57.047525 0.161512 tcp 10.0.2.105 52506 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:13:57.481947 2.999143 tcp 10.0.2.105 52507 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:06.479664 0.000000 tcp 10.0.2.105 52507 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:12.478858 0.030162 tcp 10.0.2.105 52508 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:12.509355 0.075448 tcp 10.0.2.105 52509 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:12.585154 0.175369 tcp 10.0.2.105 52510 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:12.845855 2.997247 tcp 10.0.2.105 52511 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:21.841591 0.000000 tcp 10.0.2.105 52511 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:27.840834 0.053179 tcp 10.0.2.105 52512 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:27.894321 0.068389 tcp 10.0.2.105 52513 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:27.963076 0.156292 tcp 10.0.2.105 52514 -> 195.113.214.251 443 SRPA* 0 0 43 21522 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:28.337242 2.998327 tcp 10.0.2.105 52515 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:37.333801 0.000000 tcp 10.0.2.105 52515 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:43.333552 0.030791 tcp 10.0.2.105 52516 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:43.364699 0.075118 tcp 10.0.2.105 52517 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:43.440087 0.173116 tcp 10.0.2.105 52518 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:14:43.933964 2.993739 tcp 10.0.2.105 52519 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:52.937052 0.000000 tcp 10.0.2.105 52519 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:14:58.936874 2.992405 tcp 10.0.2.105 52520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:07.928017 0.000000 tcp 10.0.2.105 52520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:12.865095 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:15:13.937496 2.992984 tcp 10.0.2.105 52521 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:22.929388 0.000000 tcp 10.0.2.105 52521 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:28.938432 3.004465 tcp 10.0.2.105 52522 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:36.869667 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:15:37.941433 0.000000 tcp 10.0.2.105 52522 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:43.939928 3.004231 tcp 10.0.2.105 52523 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:15:52.943006 0.000000 tcp 10.0.2.105 52523 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:16:17.450328 3.002146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:16:24.457906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:16:32.459489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:16:48.462615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:17:20.468790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:20:58.943735 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:20:58.943842 3.002566 tcp 10.0.2.105 52524 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:07.945573 0.000000 tcp 10.0.2.105 52524 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:13.946233 0.034970 tcp 10.0.2.105 52525 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:13.981513 0.070979 tcp 10.0.2.105 52526 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:14.052852 0.163897 tcp 10.0.2.105 52527 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:14.369673 2.999862 tcp 10.0.2.105 52528 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:23.368737 0.000000 tcp 10.0.2.105 52528 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:29.367602 0.031149 tcp 10.0.2.105 52529 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:29.399127 0.078584 tcp 10.0.2.105 52530 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:29.478016 0.169165 tcp 10.0.2.105 52531 -> 195.113.214.251 443 SRPA* 0 0 74 76950 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:29.776868 2.995812 tcp 10.0.2.105 52532 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:38.769921 0.000000 tcp 10.0.2.105 52532 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:44.769853 0.062034 tcp 10.0.2.105 52533 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:44.832136 0.074300 tcp 10.0.2.105 52534 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:44.906724 0.174471 tcp 10.0.2.105 52535 -> 195.113.214.251 443 SRPA* 0 0 43 35912 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:21:45.461871 3.001895 tcp 10.0.2.105 52536 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:21:54.462590 0.000000 tcp 10.0.2.105 52536 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:00.461929 0.052625 tcp 10.0.2.105 52537 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:00.514847 0.075786 tcp 10.0.2.105 52538 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:00.590454 0.162329 tcp 10.0.2.105 52539 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:00.819046 2.996875 tcp 10.0.2.105 52540 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:09.814144 0.000000 tcp 10.0.2.105 52540 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:15.813919 0.030857 tcp 10.0.2.105 52541 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:15.845026 0.072303 tcp 10.0.2.105 52542 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:15.917163 0.167860 tcp 10.0.2.105 52543 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:22:16.483142 2.995485 tcp 10.0.2.105 52544 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:25.487283 0.000000 tcp 10.0.2.105 52544 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:31.476114 2.993710 tcp 10.0.2.105 52545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:40.468933 0.000000 tcp 10.0.2.105 52545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:45.365806 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:22:46.477558 3.004159 tcp 10.0.2.105 52546 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:22:55.480149 0.000000 tcp 10.0.2.105 52546 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:23:01.479276 3.003413 tcp 10.0.2.105 52547 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:23:09.372784 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:23:10.483511 0.000000 tcp 10.0.2.105 52547 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:23:16.480792 3.004059 tcp 10.0.2.105 52548 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:23:24.477259 2.999703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:23:25.483552 0.000000 tcp 10.0.2.105 52548 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:23:31.482044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:23:39.483416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:23:55.486569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:24:27.492719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:28:31.483634 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:28:31.483763 3.004008 tcp 10.0.2.105 52549 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:28:40.498630 0.000000 tcp 10.0.2.105 52549 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:28:46.488898 0.042646 tcp 10.0.2.105 52550 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:28:46.531826 0.075942 tcp 10.0.2.105 52551 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:28:46.607673 0.151864 tcp 10.0.2.105 52552 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:28:47.240803 2.999624 tcp 10.0.2.105 52553 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:28:56.238668 0.000000 tcp 10.0.2.105 52553 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:02.238254 0.052324 tcp 10.0.2.105 52554 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:02.290905 0.071897 tcp 10.0.2.105 52555 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:02.363053 0.161609 tcp 10.0.2.105 52556 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:02.823198 2.999406 tcp 10.0.2.105 52557 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:11.821422 0.000000 tcp 10.0.2.105 52557 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:17.820872 0.031902 tcp 10.0.2.105 52558 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:17.852590 0.072292 tcp 10.0.2.105 52559 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:17.925144 0.164990 tcp 10.0.2.105 52560 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:18.222634 3.002170 tcp 10.0.2.105 52561 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:27.225682 0.000000 tcp 10.0.2.105 52561 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:33.227664 0.031447 tcp 10.0.2.105 52562 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:33.259383 0.075405 tcp 10.0.2.105 52563 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:33.335189 0.157399 tcp 10.0.2.105 52564 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:33.587458 2.999441 tcp 10.0.2.105 52565 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:42.585640 0.000000 tcp 10.0.2.105 52565 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:48.584838 0.053569 tcp 10.0.2.105 52566 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:48.638747 0.079412 tcp 10.0.2.105 52567 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:48.718482 0.157381 tcp 10.0.2.105 52568 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:29:49.197654 3.002045 tcp 10.0.2.105 52569 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:29:58.199031 0.000000 tcp 10.0.2.105 52569 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:04.197546 2.993165 tcp 10.0.2.105 52570 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:13.189959 0.000000 tcp 10.0.2.105 52570 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:17.866228 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:30:19.198914 3.003812 tcp 10.0.2.105 52571 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:28.201292 0.000000 tcp 10.0.2.105 52571 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:31.498265 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:30:34.199946 3.005523 tcp 10.0.2.105 52572 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:38.505838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:30:41.870934 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:30:43.202672 0.000000 tcp 10.0.2.105 52572 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:46.507534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:30:49.201316 3.004461 tcp 10.0.2.105 52573 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:30:58.204489 0.000000 tcp 10.0.2.105 52573 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:31:02.512961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:31:34.516986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:36:04.204853 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:36:04.204953 2.997619 tcp 10.0.2.105 52574 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:13.196878 0.000000 tcp 10.0.2.105 52574 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:19.207365 0.054184 tcp 10.0.2.105 52575 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:19.261375 0.075551 tcp 10.0.2.105 52576 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:19.336795 0.162485 tcp 10.0.2.105 52577 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:20.075572 2.995665 tcp 10.0.2.105 52578 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:29.069894 0.000000 tcp 10.0.2.105 52578 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:35.069536 0.051819 tcp 10.0.2.105 52579 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:35.121679 0.074340 tcp 10.0.2.105 52580 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:35.196368 0.162405 tcp 10.0.2.105 52581 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:35.583217 3.003519 tcp 10.0.2.105 52582 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:44.582505 0.000000 tcp 10.0.2.105 52582 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:36:50.581324 0.030466 tcp 10.0.2.105 52583 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:50.612077 0.074923 tcp 10.0.2.105 52584 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:50.687304 0.166740 tcp 10.0.2.105 52585 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:36:51.074058 3.001451 tcp 10.0.2.105 52586 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:00.074851 0.000000 tcp 10.0.2.105 52586 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:06.073696 0.052648 tcp 10.0.2.105 52587 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:06.126591 0.107118 tcp 10.0.2.105 52588 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:06.234073 0.158530 tcp 10.0.2.105 52589 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:06.730683 2.999931 tcp 10.0.2.105 52590 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:15.737368 0.000000 tcp 10.0.2.105 52590 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:21.726516 0.084645 tcp 10.0.2.105 52591 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:21.811474 0.066538 tcp 10.0.2.105 52592 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:21.878306 0.174091 tcp 10.0.2.105 52593 -> 195.113.214.251 443 SRPA* 0 0 55 34194 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:37:22.577256 2.981597 tcp 10.0.2.105 52594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:31.539228 0.000000 tcp 10.0.2.105 52594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:37.538898 3.003684 tcp 10.0.2.105 52595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:38.522433 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:37:45.369388 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:37:45.529657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:37:46.541304 0.000000 tcp 10.0.2.105 52595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:52.540172 3.004663 tcp 10.0.2.105 52596 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:37:53.532083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:38:01.544335 0.000000 tcp 10.0.2.105 52596 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:38:07.541784 3.003994 tcp 10.0.2.105 52597 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:38:09.534647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:38:12.368621 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:38:16.544885 0.000000 tcp 10.0.2.105 52597 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:38:22.543283 2.993760 tcp 10.0.2.105 52598 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:38:31.546126 0.000000 tcp 10.0.2.105 52598 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:38:36.562461 0.150316 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:38:41.823158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:40:23.867637 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:40:23.867753 0.246294 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:24.091919 0.061408 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:24.382626 0.174465 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:24.549014 0.111985 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:24.641253 1.826936 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:26.455029 0.174390 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:26.695806 0.228025 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:26.985349 0.208445 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:27.187024 0.087891 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:27.555997 0.287084 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:27.984773 0.115471 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:28.060604 0.080227 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:28.541427 0.172884 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:29.123169 0.078164 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:30.539635 0.171265 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:31.023946 0.169000 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:31.171810 0.177687 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:31.748053 0.143719 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:32.634786 0.038184 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:32.893624 0.106038 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:32.983589 0.176029 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:33.182643 0.074011 udp 10.0.2.105 7010 <-> 93.72.74.19 6240 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:33.333000 0.172838 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:33.607220 0.147174 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:33.793814 0.315651 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:34.194687 0.237688 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:40:34.422436 0.218640 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/07 12:43:37.546858 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:43:37.546958 2.993010 tcp 10.0.2.105 52599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:43:46.541163 0.000000 tcp 10.0.2.105 52599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:43:52.549365 0.032673 tcp 10.0.2.105 52600 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:43:52.582343 0.072157 tcp 10.0.2.105 52601 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:43:52.654739 0.228156 tcp 10.0.2.105 52602 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:43:53.241139 3.001816 tcp 10.0.2.105 52603 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:02.241936 0.000000 tcp 10.0.2.105 52603 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:08.240403 0.051858 tcp 10.0.2.105 52604 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:08.292587 0.068017 tcp 10.0.2.105 52605 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:08.360902 0.169275 tcp 10.0.2.105 52606 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:08.643818 3.001364 tcp 10.0.2.105 52607 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:17.643615 0.000000 tcp 10.0.2.105 52607 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:23.643143 0.052352 tcp 10.0.2.105 52608 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:23.695803 0.076547 tcp 10.0.2.105 52609 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:23.772661 0.157231 tcp 10.0.2.105 52610 -> 195.113.214.251 443 SRPA* 0 0 51 32502 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:24.258183 3.010580 tcp 10.0.2.105 52611 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:33.276212 0.000000 tcp 10.0.2.105 52611 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:39.255690 0.052849 tcp 10.0.2.105 52612 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:39.308925 0.071639 tcp 10.0.2.105 52613 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:39.380880 0.164068 tcp 10.0.2.105 52614 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:39.718611 3.001245 tcp 10.0.2.105 52615 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:45.546646 3.003278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:44:48.719857 0.000000 tcp 10.0.2.105 52615 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:44:52.553984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:44:54.717701 0.052217 tcp 10.0.2.105 52616 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:54.770247 0.071647 tcp 10.0.2.105 52617 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:54.842149 0.152654 tcp 10.0.2.105 52618 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:44:55.488409 3.004028 tcp 10.0.2.105 52619 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:00.556750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:45:04.491146 0.000000 tcp 10.0.2.105 52619 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:10.489892 3.004248 tcp 10.0.2.105 52620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:16.558823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:45:18.370889 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:45:19.492696 0.000000 tcp 10.0.2.105 52620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:25.491323 3.004650 tcp 10.0.2.105 52621 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:34.494222 0.000000 tcp 10.0.2.105 52621 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:40.492932 2.994421 tcp 10.0.2.105 52622 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:45.369720 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:45:48.564559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:45:49.495645 0.000000 tcp 10.0.2.105 52622 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:45:55.494560 2.994320 tcp 10.0.2.105 52623 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:46:04.497341 0.000000 tcp 10.0.2.105 52623 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:46:09.364436 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:51:10.498559 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:51:10.498673 3.002934 tcp 10.0.2.105 52624 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:19.500495 0.000000 tcp 10.0.2.105 52624 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:25.500996 0.032171 tcp 10.0.2.105 52625 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:25.533425 0.070952 tcp 10.0.2.105 52626 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:25.604641 0.198659 tcp 10.0.2.105 52627 -> 195.113.214.251 443 SRPA* 0 0 31 14238 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:25.850891 3.002850 tcp 10.0.2.105 52628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:34.852978 0.000000 tcp 10.0.2.105 52628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:40.851576 0.033870 tcp 10.0.2.105 52629 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:40.885738 0.075709 tcp 10.0.2.105 52630 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:40.961740 0.159629 tcp 10.0.2.105 52631 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:41.179856 3.006004 tcp 10.0.2.105 52632 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:50.184299 0.000000 tcp 10.0.2.105 52632 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:52.570389 3.001757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:51:56.173329 0.030190 tcp 10.0.2.105 52633 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:56.203824 0.070990 tcp 10.0.2.105 52634 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:56.274634 0.162895 tcp 10.0.2.105 52635 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:51:56.531335 2.997009 tcp 10.0.2.105 52636 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:51:59.578540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:52:05.536421 0.000000 tcp 10.0.2.105 52636 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:07.579674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:52:11.525859 0.052688 tcp 10.0.2.105 52637 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:11.578866 0.071779 tcp 10.0.2.105 52638 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:11.650623 0.158750 tcp 10.0.2.105 52639 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:11.863040 2.996722 tcp 10.0.2.105 52640 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:20.858552 0.000000 tcp 10.0.2.105 52640 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:23.582444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:52:26.857806 0.031207 tcp 10.0.2.105 52641 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:26.889294 0.074598 tcp 10.0.2.105 52642 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:26.964240 0.152681 tcp 10.0.2.105 52643 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:52:27.130205 3.001649 tcp 10.0.2.105 52644 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:36.130199 0.000000 tcp 10.0.2.105 52644 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:42.129489 3.003605 tcp 10.0.2.105 52645 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:51.131919 0.000000 tcp 10.0.2.105 52645 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:52:55.588900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:52:55.868838 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:52:57.130794 3.004215 tcp 10.0.2.105 52646 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:53:06.133630 0.000000 tcp 10.0.2.105 52646 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:53:12.132416 3.004274 tcp 10.0.2.105 52647 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:53:19.872938 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:53:21.135387 0.000000 tcp 10.0.2.105 52647 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:53:27.133866 2.994394 tcp 10.0.2.105 52648 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:53:36.136744 0.000000 tcp 10.0.2.105 52648 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:58:42.137718 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 12:58:42.137828 3.003138 tcp 10.0.2.105 52649 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:58:51.139100 0.000000 tcp 10.0.2.105 52649 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:58:57.140276 0.081449 tcp 10.0.2.105 52650 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:58:57.222030 0.074726 tcp 10.0.2.105 52651 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:58:57.297064 0.163767 tcp 10.0.2.105 52652 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:58:57.482473 3.000534 tcp 10.0.2.105 52653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:58:59.594622 3.002630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 12:59:06.481696 0.000000 tcp 10.0.2.105 52653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:06.601878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:59:12.480819 0.034651 tcp 10.0.2.105 52654 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:12.515810 0.071353 tcp 10.0.2.105 52655 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:12.587463 0.151365 tcp 10.0.2.105 52656 -> 195.113.214.251 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:12.748345 3.006730 tcp 10.0.2.105 52657 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:14.603414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:59:21.753611 0.000000 tcp 10.0.2.105 52657 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:27.743272 0.031167 tcp 10.0.2.105 52658 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:27.774805 0.071070 tcp 10.0.2.105 52659 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:27.846148 0.168992 tcp 10.0.2.105 52660 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:28.025436 3.001194 tcp 10.0.2.105 52661 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:30.606219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 12:59:37.025560 0.000000 tcp 10.0.2.105 52661 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:43.025213 0.053679 tcp 10.0.2.105 52662 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:43.079216 0.075264 tcp 10.0.2.105 52663 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:43.154844 0.170109 tcp 10.0.2.105 52664 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:43.335018 2.993910 tcp 10.0.2.105 52665 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:52.327328 0.000000 tcp 10.0.2.105 52665 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 12:59:58.337466 0.031447 tcp 10.0.2.105 52666 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:58.369223 0.074608 tcp 10.0.2.105 52667 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:58.443653 0.156841 tcp 10.0.2.105 52668 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 12:59:58.612789 2.998051 tcp 10.0.2.105 52669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:02.612244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:00:07.609356 0.000000 tcp 10.0.2.105 52669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:13.608319 3.004243 tcp 10.0.2.105 52670 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:22.611261 0.000000 tcp 10.0.2.105 52670 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:27.367879 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:00:28.610311 3.003635 tcp 10.0.2.105 52671 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:37.612901 0.000000 tcp 10.0.2.105 52671 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:43.611482 3.004519 tcp 10.0.2.105 52672 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:51.372494 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:00:52.614304 0.000000 tcp 10.0.2.105 52672 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:00:58.613081 3.004110 tcp 10.0.2.105 52673 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:01:07.625905 0.000000 tcp 10.0.2.105 52673 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:13.616531 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:06:13.616633 2.993649 tcp 10.0.2.105 52674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:15.622443 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:06:22.608823 0.000000 tcp 10.0.2.105 52674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:22.628909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:06:28.619771 0.032751 tcp 10.0.2.105 52675 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:06:28.652792 0.087554 tcp 10.0.2.105 52676 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:06:28.740664 0.163474 tcp 10.0.2.105 52677 -> 195.113.214.251 443 SRPA* 0 0 47 41968 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:06:29.499426 3.003388 tcp 10.0.2.105 52678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:30.630264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:06:38.502327 0.000000 tcp 10.0.2.105 52678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:44.501394 0.001565 tcp 10.0.2.105 52679 -> 195.113.214.221 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:06:46.633582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:06:50.505985 0.000330 tcp 10.0.2.105 52679 -> 195.113.214.221 80 RA_F* 0 0 4 1361 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:06:50.540983 3.012650 tcp 10.0.2.105 52680 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:06:59.541916 0.000000 tcp 10.0.2.105 52680 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:07:05.540813 0.001603 tcp 10.0.2.105 52681 -> 195.113.214.221 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:11.544875 0.000261 tcp 10.0.2.105 52681 -> 195.113.214.221 80 RA_F* 0 0 4 1361 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:12.098249 3.008237 tcp 10.0.2.105 52682 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:07:18.639219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:07:21.103000 0.000000 tcp 10.0.2.105 52682 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:07:27.092715 0.001484 tcp 10.0.2.105 52683 -> 195.113.214.221 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:33.095876 0.000302 tcp 10.0.2.105 52683 -> 195.113.214.221 80 RA_F* 0 0 4 1361 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:33.122063 3.002400 tcp 10.0.2.105 52684 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:07:42.126632 0.000000 tcp 10.0.2.105 52684 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:07:48.122530 0.001380 tcp 10.0.2.105 52685 -> 195.113.214.221 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:54.126352 0.000330 tcp 10.0.2.105 52685 -> 195.113.214.221 80 RA_F* 0 0 4 1361 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:07:54.470945 3.004246 tcp 10.0.2.105 52686 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:03.473715 0.000000 tcp 10.0.2.105 52686 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:09.465271 3.003884 tcp 10.0.2.105 52687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:18.465193 0.000000 tcp 10.0.2.105 52687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:23.372594 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:08:24.464151 2.994052 tcp 10.0.2.105 52688 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:33.466485 0.000000 tcp 10.0.2.105 52688 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:39.468857 2.990785 tcp 10.0.2.105 52689 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:47.366403 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:08:48.458168 0.000000 tcp 10.0.2.105 52689 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:08:54.466922 3.085437 tcp 10.0.2.105 52690 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:09:03.506598 0.000000 tcp 10.0.2.105 52690 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:10:38.516814 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:10:38.516918 0.237465 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:38.730540 0.106549 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:38.815592 0.062046 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:38.941329 0.172576 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 1961 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:39.107237 0.152792 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:39.488205 0.172522 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:39.656870 0.300147 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:39.992562 0.226206 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:40.202775 0.108569 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2001 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:40.457662 0.086232 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:40.520686 0.274467 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:40.827296 0.086747 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:40.873882 0.170723 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:41.112923 0.075738 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:41.172923 0.652101 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:41.796780 0.165608 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.079657 0.181915 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.204030 0.131390 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.366835 0.036728 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.390254 0.102900 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.543038 0.175990 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:10:42.716473 0.000000 udp 10.0.2.105 7010 -> 93.72.74.19 6240 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 13:10:58.977881 0.032095 tcp 10.0.2.105 52691 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:10:59.010269 0.074329 tcp 10.0.2.105 52692 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:10:59.084961 0.160884 tcp 10.0.2.105 52693 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:10:59.246576 0.313031 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:11:00.006907 0.364095 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:11:01.427212 0.146088 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:11:01.565216 0.225744 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:11:01.999430 0.213889 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:13:22.645399 3.001696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:13:29.652854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:13:37.654262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:13:53.657483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:14:09.480194 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:14:09.480279 3.004239 tcp 10.0.2.105 52694 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:18.482871 0.000000 tcp 10.0.2.105 52694 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:24.483413 0.053298 tcp 10.0.2.105 52695 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:24.537095 0.074765 tcp 10.0.2.105 52696 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:24.612170 0.164379 tcp 10.0.2.105 52697 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:24.902594 3.003737 tcp 10.0.2.105 52698 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:25.663119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:14:33.905276 0.000000 tcp 10.0.2.105 52698 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:39.904920 0.031153 tcp 10.0.2.105 52699 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:39.936302 0.072028 tcp 10.0.2.105 52700 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:40.008651 0.156831 tcp 10.0.2.105 52701 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:40.439430 2.999332 tcp 10.0.2.105 52702 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:49.437561 0.000000 tcp 10.0.2.105 52702 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:14:55.436773 0.054141 tcp 10.0.2.105 52703 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:55.490710 0.075046 tcp 10.0.2.105 52704 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:55.566040 0.164019 tcp 10.0.2.105 52705 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:14:55.931109 2.999959 tcp 10.0.2.105 52706 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:04.929180 0.000000 tcp 10.0.2.105 52706 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:10.928863 0.054362 tcp 10.0.2.105 52707 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:10.983566 0.070992 tcp 10.0.2.105 52708 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:11.054900 0.163736 tcp 10.0.2.105 52709 -> 195.113.214.251 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:11.242251 3.000486 tcp 10.0.2.105 52710 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:20.241454 0.000000 tcp 10.0.2.105 52710 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:26.241032 0.053084 tcp 10.0.2.105 52711 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:26.294419 0.070376 tcp 10.0.2.105 52712 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:26.365090 0.157023 tcp 10.0.2.105 52713 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:15:26.606249 3.000857 tcp 10.0.2.105 52714 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:35.603819 0.000000 tcp 10.0.2.105 52714 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:41.602466 3.005264 tcp 10.0.2.105 52715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:50.605589 0.000000 tcp 10.0.2.105 52715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:15:55.372100 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:15:56.603808 2.995218 tcp 10.0.2.105 52716 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:16:05.606910 0.000000 tcp 10.0.2.105 52716 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:16:11.606891 2.993158 tcp 10.0.2.105 52717 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:16:19.366260 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:16:20.598579 0.000000 tcp 10.0.2.105 52717 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:16:26.607408 3.004065 tcp 10.0.2.105 52718 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:16:35.610298 0.000000 tcp 10.0.2.105 52718 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:20:29.670166 3.002481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:20:36.676950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:20:44.679178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:21:00.681307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:21:32.687699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:21:41.611482 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:21:41.611590 3.005968 tcp 10.0.2.105 52719 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:21:50.612609 0.000000 tcp 10.0.2.105 52719 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:21:56.615001 0.052086 tcp 10.0.2.105 52720 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:21:56.667397 0.071311 tcp 10.0.2.105 52721 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:21:56.739056 0.158656 tcp 10.0.2.105 52722 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:21:57.062759 2.994175 tcp 10.0.2.105 52723 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:06.055267 0.000000 tcp 10.0.2.105 52723 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:12.054286 0.030757 tcp 10.0.2.105 52724 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:12.085357 0.071180 tcp 10.0.2.105 52725 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:12.156928 0.155748 tcp 10.0.2.105 52726 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:12.582856 2.985971 tcp 10.0.2.105 52727 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:21.579231 0.000000 tcp 10.0.2.105 52727 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:27.578159 0.052971 tcp 10.0.2.105 52728 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:27.631495 0.073602 tcp 10.0.2.105 52729 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:27.705512 0.164848 tcp 10.0.2.105 52730 -> 195.113.214.251 443 SRPA* 0 0 27 11246 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:28.067408 3.003412 tcp 10.0.2.105 52731 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:37.069603 0.000000 tcp 10.0.2.105 52731 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:43.071023 0.031611 tcp 10.0.2.105 52732 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:43.102432 0.071088 tcp 10.0.2.105 52733 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:43.173872 0.165411 tcp 10.0.2.105 52734 -> 195.113.214.251 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:43.360454 3.002579 tcp 10.0.2.105 52735 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:52.363382 0.000000 tcp 10.0.2.105 52735 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:22:58.361629 0.031934 tcp 10.0.2.105 52736 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:58.393950 0.072760 tcp 10.0.2.105 52737 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:58.466494 0.161416 tcp 10.0.2.105 52738 -> 195.113.214.251 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:22:59.013215 3.003303 tcp 10.0.2.105 52739 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:08.014474 0.000000 tcp 10.0.2.105 52739 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:14.003174 3.004456 tcp 10.0.2.105 52740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:23.015879 0.000000 tcp 10.0.2.105 52740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:27.872734 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:23:29.004621 2.993859 tcp 10.0.2.105 52741 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:38.007681 0.000000 tcp 10.0.2.105 52741 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:44.006177 2.994099 tcp 10.0.2.105 52742 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:51.867283 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:23:52.998344 0.000000 tcp 10.0.2.105 52742 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:23:59.007927 3.004537 tcp 10.0.2.105 52743 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:24:08.010304 0.000000 tcp 10.0.2.105 52743 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:27:36.693771 3.001254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:27:43.700841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:27:51.702229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:28:07.706071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:28:39.711302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:29:14.010756 0.037813 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:29:14.048813 2.986336 tcp 10.0.2.105 52744 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:29:23.013451 0.000000 tcp 10.0.2.105 52744 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:29:29.023770 0.055552 tcp 10.0.2.105 52745 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:29.079670 0.070424 tcp 10.0.2.105 52746 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:29.150400 0.155341 tcp 10.0.2.105 52747 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:29.886515 2.991118 tcp 10.0.2.105 52748 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:29:38.886025 0.000000 tcp 10.0.2.105 52748 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:29:44.885497 0.036597 tcp 10.0.2.105 52749 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:44.922398 0.071529 tcp 10.0.2.105 52750 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:44.994018 0.173675 tcp 10.0.2.105 52751 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:29:45.482689 2.997453 tcp 10.0.2.105 52752 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:29:54.478811 0.000000 tcp 10.0.2.105 52752 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:00.501296 0.030384 tcp 10.0.2.105 52753 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:00.531951 0.070689 tcp 10.0.2.105 52754 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:00.602940 0.157214 tcp 10.0.2.105 52755 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:01.162395 2.980705 tcp 10.0.2.105 52756 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:10.141295 0.000000 tcp 10.0.2.105 52756 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:16.140586 0.031703 tcp 10.0.2.105 52757 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:16.172626 0.071375 tcp 10.0.2.105 52758 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:16.244330 0.152653 tcp 10.0.2.105 52759 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:16.831398 3.004580 tcp 10.0.2.105 52760 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:25.833325 0.000000 tcp 10.0.2.105 52760 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:31.832975 0.054126 tcp 10.0.2.105 52761 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:31.887050 0.076280 tcp 10.0.2.105 52762 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:31.963683 0.157964 tcp 10.0.2.105 52763 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:30:32.310328 2.997008 tcp 10.0.2.105 52764 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:41.316008 0.000000 tcp 10.0.2.105 52764 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:47.304464 2.994580 tcp 10.0.2.105 52765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:30:56.297601 0.000000 tcp 10.0.2.105 52765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:00.864032 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:31:02.306116 2.994276 tcp 10.0.2.105 52766 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:11.299067 0.000000 tcp 10.0.2.105 52766 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:17.307958 3.004258 tcp 10.0.2.105 52767 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:24.868683 0.000305 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:31:26.310891 0.000000 tcp 10.0.2.105 52767 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:32.309571 3.003952 tcp 10.0.2.105 52768 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:31:41.312234 0.000000 tcp 10.0.2.105 52768 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:34:43.717468 3.001462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:34:50.724983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:34:58.726112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:35:14.729333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:35:46.735020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:36:47.313259 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:36:47.313365 3.003032 tcp 10.0.2.105 52769 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:36:56.314918 0.000000 tcp 10.0.2.105 52769 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:02.315743 0.031856 tcp 10.0.2.105 52770 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:02.347881 0.074896 tcp 10.0.2.105 52771 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:02.423074 0.159960 tcp 10.0.2.105 52772 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:02.876173 2.992733 tcp 10.0.2.105 52773 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:11.867406 0.000000 tcp 10.0.2.105 52773 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:17.876891 0.030932 tcp 10.0.2.105 52774 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:17.908184 0.071720 tcp 10.0.2.105 52775 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:17.980179 0.155618 tcp 10.0.2.105 52776 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:18.207609 2.993294 tcp 10.0.2.105 52777 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:27.199940 0.000000 tcp 10.0.2.105 52777 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:33.209350 0.031015 tcp 10.0.2.105 52778 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:33.240735 0.074949 tcp 10.0.2.105 52779 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:33.316005 0.164377 tcp 10.0.2.105 52780 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:33.726692 2.996642 tcp 10.0.2.105 52781 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:42.721758 0.000000 tcp 10.0.2.105 52781 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:48.721342 0.052533 tcp 10.0.2.105 52782 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:48.774113 0.070746 tcp 10.0.2.105 52783 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:48.845218 0.159472 tcp 10.0.2.105 52784 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:37:49.041213 3.004236 tcp 10.0.2.105 52785 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:37:58.043875 0.000000 tcp 10.0.2.105 52785 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:04.033526 0.318963 tcp 10.0.2.105 52786 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:38:04.352812 0.074986 tcp 10.0.2.105 52787 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:38:04.428130 0.155989 tcp 10.0.2.105 52788 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:38:04.676481 2.967911 tcp 10.0.2.105 52789 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:13.599213 0.000000 tcp 10.0.2.105 52789 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:19.533964 2.966089 tcp 10.0.2.105 52790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:28.457218 0.000000 tcp 10.0.2.105 52790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:33.364893 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:38:34.416423 2.993892 tcp 10.0.2.105 52791 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:43.409047 0.000000 tcp 10.0.2.105 52791 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:49.417895 3.004380 tcp 10.0.2.105 52792 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:38:57.368769 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:38:58.420139 0.000000 tcp 10.0.2.105 52792 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:39:04.419551 3.004127 tcp 10.0.2.105 52793 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:39:13.422199 0.000000 tcp 10.0.2.105 52793 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:41:09.501213 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:41:09.501330 0.000000 udp 10.0.2.105 7010 -> 93.72.74.19 6240 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 13:41:25.854994 0.031312 tcp 10.0.2.105 52794 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:41:25.886594 0.075325 tcp 10.0.2.105 52795 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:41:25.961767 0.162469 tcp 10.0.2.105 52796 -> 195.113.214.251 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:41:26.122525 0.111819 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:26.214348 0.060426 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:26.356369 0.172344 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:26.521486 0.236824 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:26.734310 0.229090 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:26.957144 0.153293 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:27.091151 0.208444 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:27.282050 0.170973 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:27.450143 0.111947 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:27.694000 0.085661 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:27.742314 0.168157 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:28.139021 0.076593 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:28.198808 0.275583 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:28.808466 0.091730 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:28.873047 0.153760 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:29.033800 0.558290 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:29.564690 0.169913 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:29.710442 0.100193 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:29.841594 0.175017 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:30.034378 0.128645 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:30.116729 0.034807 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:30.363954 0.317715 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:30.925727 0.174509 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:31.166502 0.271711 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2553 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:31.374013 0.149868 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:31.612142 0.225151 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/07 13:41:50.742037 3.005216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:41:57.748658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:42:05.749630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:42:21.753132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:42:53.759110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:44:19.422893 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:44:19.423128 3.003775 tcp 10.0.2.105 52797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:44:28.425149 0.000000 tcp 10.0.2.105 52797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:44:34.425656 0.033209 tcp 10.0.2.105 52798 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:34.459145 0.076990 tcp 10.0.2.105 52799 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:34.536507 0.165849 tcp 10.0.2.105 52800 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:34.956369 2.992494 tcp 10.0.2.105 52801 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:44:43.957515 0.000000 tcp 10.0.2.105 52801 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:44:49.957217 0.030457 tcp 10.0.2.105 52802 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:49.987985 0.076107 tcp 10.0.2.105 52803 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:50.064410 0.159700 tcp 10.0.2.105 52804 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:44:50.326270 2.994688 tcp 10.0.2.105 52805 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:44:59.319522 0.000000 tcp 10.0.2.105 52805 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:05.318856 0.052692 tcp 10.0.2.105 52806 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:05.371904 0.071200 tcp 10.0.2.105 52807 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:05.443414 0.168825 tcp 10.0.2.105 52808 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:05.736944 2.996638 tcp 10.0.2.105 52809 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:14.731573 0.000000 tcp 10.0.2.105 52809 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:20.731312 0.053276 tcp 10.0.2.105 52810 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:20.784893 0.077956 tcp 10.0.2.105 52811 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:20.863213 0.154605 tcp 10.0.2.105 52812 -> 195.113.214.251 443 SRPA* 0 0 43 23406 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:21.128123 3.009137 tcp 10.0.2.105 52813 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:30.133918 0.000000 tcp 10.0.2.105 52813 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:36.123401 0.031351 tcp 10.0.2.105 52814 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:36.154592 0.072130 tcp 10.0.2.105 52815 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:36.227040 0.150616 tcp 10.0.2.105 52816 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:45:36.453862 3.003424 tcp 10.0.2.105 52817 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:45.466135 0.000000 tcp 10.0.2.105 52817 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:45:51.454958 2.993779 tcp 10.0.2.105 52818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:00.457595 0.000000 tcp 10.0.2.105 52818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:05.364824 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:46:06.456690 2.993905 tcp 10.0.2.105 52819 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:15.449001 0.000000 tcp 10.0.2.105 52819 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:21.457842 3.004124 tcp 10.0.2.105 52820 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:29.369084 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:46:30.460793 0.000000 tcp 10.0.2.105 52820 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:36.459092 3.004549 tcp 10.0.2.105 52821 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:46:45.462073 0.000000 tcp 10.0.2.105 52821 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:51:51.463188 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:51:51.463342 3.003979 tcp 10.0.2.105 52822 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:00.465388 0.000000 tcp 10.0.2.105 52822 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:06.465422 0.031419 tcp 10.0.2.105 52823 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:06.497158 0.074466 tcp 10.0.2.105 52824 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:06.571896 0.162460 tcp 10.0.2.105 52825 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:06.779320 2.999242 tcp 10.0.2.105 52826 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:15.787161 0.000000 tcp 10.0.2.105 52826 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:21.776418 0.030978 tcp 10.0.2.105 52827 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:21.807193 0.072018 tcp 10.0.2.105 52828 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:21.879478 0.152691 tcp 10.0.2.105 52829 -> 195.113.214.251 443 SRPA* 0 0 26 13342 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:22.073790 2.996907 tcp 10.0.2.105 52830 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:31.069080 0.000000 tcp 10.0.2.105 52830 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:37.068537 0.053515 tcp 10.0.2.105 52831 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:37.122358 0.070838 tcp 10.0.2.105 52832 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:37.193511 0.156793 tcp 10.0.2.105 52833 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:37.414324 2.998469 tcp 10.0.2.105 52834 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:46.411100 0.000000 tcp 10.0.2.105 52834 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:52:52.410117 0.052717 tcp 10.0.2.105 52835 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:52.463164 0.075583 tcp 10.0.2.105 52836 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:52.539059 0.155764 tcp 10.0.2.105 52837 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:52:52.824460 3.000336 tcp 10.0.2.105 52838 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:01.823210 0.000000 tcp 10.0.2.105 52838 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:07.822522 0.030699 tcp 10.0.2.105 52839 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:53:07.853106 0.074470 tcp 10.0.2.105 52840 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:53:07.927863 0.162491 tcp 10.0.2.105 52841 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:53:08.130988 3.005747 tcp 10.0.2.105 52842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:17.135427 0.000000 tcp 10.0.2.105 52842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:23.127045 2.991477 tcp 10.0.2.105 52843 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:28.774609 3.002152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 13:53:32.127077 0.000000 tcp 10.0.2.105 52843 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:35.782224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:53:36.863784 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:53:38.125643 2.994055 tcp 10.0.2.105 52844 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:43.783721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:53:47.118404 0.000000 tcp 10.0.2.105 52844 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:53.127165 3.004326 tcp 10.0.2.105 52845 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:53:59.787429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:54:00.868558 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:54:02.129772 0.000000 tcp 10.0.2.105 52845 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:54:08.129086 3.003722 tcp 10.0.2.105 52846 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:54:17.131499 0.000000 tcp 10.0.2.105 52846 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:54:31.792658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 13:59:23.132401 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 13:59:23.132519 3.003476 tcp 10.0.2.105 52847 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:59:32.134864 0.000000 tcp 10.0.2.105 52847 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:59:38.134970 0.054266 tcp 10.0.2.105 52848 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:38.189548 0.071582 tcp 10.0.2.105 52849 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:38.261445 0.161980 tcp 10.0.2.105 52850 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:38.433537 2.984192 tcp 10.0.2.105 52851 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:59:47.426115 0.000000 tcp 10.0.2.105 52851 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 13:59:53.435881 0.051766 tcp 10.0.2.105 52852 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:53.487932 0.067455 tcp 10.0.2.105 52853 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:53.555660 0.151751 tcp 10.0.2.105 52854 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 13:59:53.721940 2.997537 tcp 10.0.2.105 52855 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:02.718408 0.000000 tcp 10.0.2.105 52855 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:08.717721 0.073088 tcp 10.0.2.105 52856 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:08.791104 0.074114 tcp 10.0.2.105 52857 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:08.865518 0.164454 tcp 10.0.2.105 52858 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:09.054351 2.998248 tcp 10.0.2.105 52859 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:18.050453 0.000000 tcp 10.0.2.105 52859 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:24.049955 0.052826 tcp 10.0.2.105 52860 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:24.103096 0.076160 tcp 10.0.2.105 52861 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:24.179561 0.163710 tcp 10.0.2.105 52862 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:24.375123 2.998965 tcp 10.0.2.105 52863 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:33.372577 0.000000 tcp 10.0.2.105 52863 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:35.798390 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:00:39.371670 0.030835 tcp 10.0.2.105 52864 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:39.402799 0.071513 tcp 10.0.2.105 52865 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:39.474618 0.219198 tcp 10.0.2.105 52866 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:00:39.742422 3.003594 tcp 10.0.2.105 52867 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:42.806168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:00:48.744776 0.000000 tcp 10.0.2.105 52867 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:00:50.807663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:00:54.743496 3.003995 tcp 10.0.2.105 52868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:03.756634 0.000000 tcp 10.0.2.105 52868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:06.810664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:01:08.373059 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:01:09.745045 2.993937 tcp 10.0.2.105 52869 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:18.737926 0.000000 tcp 10.0.2.105 52869 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:24.749065 2.991622 tcp 10.0.2.105 52870 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:32.367556 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:01:33.739229 0.000000 tcp 10.0.2.105 52870 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:38.816775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:01:39.748160 3.004200 tcp 10.0.2.105 52871 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:01:48.751082 0.000000 tcp 10.0.2.105 52871 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:06:54.755121 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:06:54.755226 3.004346 tcp 10.0.2.105 52872 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:03.793489 0.000000 tcp 10.0.2.105 52872 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:09.769616 0.032157 tcp 10.0.2.105 52873 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:09.802206 0.075112 tcp 10.0.2.105 52874 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:09.877143 0.151606 tcp 10.0.2.105 52875 -> 195.113.214.251 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:10.098344 3.003761 tcp 10.0.2.105 52876 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:19.097262 0.000000 tcp 10.0.2.105 52876 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:25.107657 0.030523 tcp 10.0.2.105 52877 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:25.138481 0.075610 tcp 10.0.2.105 52878 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:25.213863 0.158493 tcp 10.0.2.105 52879 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:25.511317 3.023704 tcp 10.0.2.105 52880 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:34.557010 0.000000 tcp 10.0.2.105 52880 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:40.563824 0.051727 tcp 10.0.2.105 52881 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:40.615870 0.074848 tcp 10.0.2.105 52882 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:40.691014 0.157325 tcp 10.0.2.105 52883 -> 195.113.214.251 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:40.934360 2.983681 tcp 10.0.2.105 52884 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:42.895256 2.989425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:07:49.889427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:07:49.909245 0.000000 tcp 10.0.2.105 52884 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:55.888761 0.031539 tcp 10.0.2.105 52885 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:55.920621 0.076452 tcp 10.0.2.105 52886 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:55.996875 0.163259 tcp 10.0.2.105 52887 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:07:56.178744 2.993145 tcp 10.0.2.105 52888 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:07:57.858098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:08:05.164515 0.000000 tcp 10.0.2.105 52888 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:11.173605 0.053240 tcp 10.0.2.105 52889 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:08:11.227150 0.075001 tcp 10.0.2.105 52890 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:08:11.301973 0.166661 tcp 10.0.2.105 52891 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:08:11.494551 3.010321 tcp 10.0.2.105 52892 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:13.870632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:08:20.480812 0.000000 tcp 10.0.2.105 52892 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:26.475287 2.982906 tcp 10.0.2.105 52893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:35.470002 0.000000 tcp 10.0.2.105 52893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:40.375645 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:08:41.466194 2.996727 tcp 10.0.2.105 52894 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:45.841618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:08:50.476474 0.000000 tcp 10.0.2.105 52894 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:08:56.474249 3.002732 tcp 10.0.2.105 52895 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:09:04.390778 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:09:05.483248 0.000000 tcp 10.0.2.105 52895 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:09:11.507249 2.997282 tcp 10.0.2.105 52896 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:09:20.484623 0.000000 tcp 10.0.2.105 52896 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:11:58.447834 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:11:58.448085 0.097972 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:58.525981 0.059280 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:58.605328 0.172671 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:58.771586 0.239634 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:59.067981 0.228860 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:59.288128 0.154695 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:59.670357 0.206828 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:11:59.870648 0.088092 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:00.169133 0.170527 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:00.471880 0.078483 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:00.532970 0.173154 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:00.708999 0.110869 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:00.783809 0.285476 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.162311 0.087948 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.228810 0.206422 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.443684 0.109229 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.536506 0.176533 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.746157 0.140074 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:01.841641 0.170451 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:02.019146 0.168276 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:02.164407 0.041225 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:02.317911 0.316368 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:02.912990 0.172768 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:03.385065 0.235697 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:03.610848 0.268748 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:12:04.099718 0.151455 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:14:26.490685 0.000224 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:14:26.491015 3.012263 tcp 10.0.2.105 52897 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:14:35.474561 0.000000 tcp 10.0.2.105 52897 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:14:41.473397 0.032038 tcp 10.0.2.105 52898 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:41.505777 0.070733 tcp 10.0.2.105 52899 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:41.576811 0.167733 tcp 10.0.2.105 52900 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:41.790106 3.006738 tcp 10.0.2.105 52901 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:14:49.852025 2.999748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:14:50.797029 0.000000 tcp 10.0.2.105 52901 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:14:56.792579 0.030510 tcp 10.0.2.105 52902 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:56.823426 0.076394 tcp 10.0.2.105 52903 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:56.861991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:14:56.900118 0.156474 tcp 10.0.2.105 52904 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:14:57.085973 2.992677 tcp 10.0.2.105 52905 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:04.855784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:15:06.077482 0.000000 tcp 10.0.2.105 52905 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:12.076954 0.052830 tcp 10.0.2.105 52906 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:12.130079 0.077600 tcp 10.0.2.105 52907 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:12.207989 0.156704 tcp 10.0.2.105 52908 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:13.237282 2.994680 tcp 10.0.2.105 52909 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:20.862122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:15:22.231868 0.000000 tcp 10.0.2.105 52909 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:28.232459 0.030925 tcp 10.0.2.105 52910 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:28.263668 0.071272 tcp 10.0.2.105 52911 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:28.335242 0.162094 tcp 10.0.2.105 52912 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:29.187477 3.007452 tcp 10.0.2.105 52913 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:38.193450 0.000000 tcp 10.0.2.105 52913 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:44.183220 0.052821 tcp 10.0.2.105 52914 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:44.236528 0.070901 tcp 10.0.2.105 52915 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:44.307651 0.177363 tcp 10.0.2.105 52916 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:15:44.601335 3.005798 tcp 10.0.2.105 52917 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:52.866527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:15:53.617094 0.000000 tcp 10.0.2.105 52917 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:15:59.594208 2.996238 tcp 10.0.2.105 52918 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:08.587355 0.000000 tcp 10.0.2.105 52918 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:13.363969 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:16:14.597180 2.992728 tcp 10.0.2.105 52919 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:23.593378 0.000000 tcp 10.0.2.105 52919 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:29.597774 3.003910 tcp 10.0.2.105 52920 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:37.368734 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:16:38.600131 0.000000 tcp 10.0.2.105 52920 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:44.618773 2.984828 tcp 10.0.2.105 52921 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:16:53.605793 0.000000 tcp 10.0.2.105 52921 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:21:56.873084 3.000480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:21:59.602559 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:21:59.602661 3.003549 tcp 10.0.2.105 52922 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:05.640383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:22:10.313731 0.000000 tcp 10.0.2.105 52922 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:13.542928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:22:16.244195 0.053838 tcp 10.0.2.105 52923 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:16.298232 0.073660 tcp 10.0.2.105 52924 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:16.371676 0.168316 tcp 10.0.2.105 52925 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:16.769204 2.955864 tcp 10.0.2.105 52926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:25.672779 0.000000 tcp 10.0.2.105 52926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:29.374307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:22:31.606193 0.043271 tcp 10.0.2.105 52927 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:31.649217 0.075500 tcp 10.0.2.105 52928 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:31.725004 0.158092 tcp 10.0.2.105 52929 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:32.038038 2.960905 tcp 10.0.2.105 52930 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:40.977870 0.000000 tcp 10.0.2.105 52930 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:46.914400 0.030846 tcp 10.0.2.105 52931 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:46.945512 0.085434 tcp 10.0.2.105 52932 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:47.031241 0.156085 tcp 10.0.2.105 52933 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:22:47.473510 2.971152 tcp 10.0.2.105 52934 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:22:56.373540 0.000000 tcp 10.0.2.105 52934 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:01.073136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:23:02.298424 0.031272 tcp 10.0.2.105 52935 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:02.330022 0.075374 tcp 10.0.2.105 52936 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:02.405766 0.158126 tcp 10.0.2.105 52937 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:02.819455 2.972660 tcp 10.0.2.105 52938 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:11.723600 0.000000 tcp 10.0.2.105 52938 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:17.657771 0.053884 tcp 10.0.2.105 52939 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:17.711485 0.071195 tcp 10.0.2.105 52940 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:17.783045 0.156391 tcp 10.0.2.105 52941 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:23:18.133095 2.960714 tcp 10.0.2.105 52942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:27.029846 0.000000 tcp 10.0.2.105 52942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:32.946767 2.954606 tcp 10.0.2.105 52943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:41.830535 0.000000 tcp 10.0.2.105 52943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:46.518669 1.085974 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:23:48.842202 2.972373 tcp 10.0.2.105 52944 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:23:57.747307 0.000000 tcp 10.0.2.105 52944 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:24:03.684289 2.967816 tcp 10.0.2.105 52945 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:24:11.330371 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:24:12.576610 0.000000 tcp 10.0.2.105 52945 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:24:18.506417 2.969419 tcp 10.0.2.105 52946 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:24:27.397026 0.000000 tcp 10.0.2.105 52946 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:29:03.896229 2.999885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:29:10.903216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:29:18.905017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:29:32.133474 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:29:32.133776 3.002699 tcp 10.0.2.105 52947 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:29:34.906578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:29:41.135523 0.000000 tcp 10.0.2.105 52947 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:29:47.138654 0.053763 tcp 10.0.2.105 52948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:29:47.192404 0.072978 tcp 10.0.2.105 52949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:29:47.265165 0.213070 tcp 10.0.2.105 52950 -> 195.113.214.251 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:29:47.509855 2.999181 tcp 10.0.2.105 52951 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:29:56.586233 0.000000 tcp 10.0.2.105 52951 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:02.541870 0.056564 tcp 10.0.2.105 52952 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:02.598746 0.071862 tcp 10.0.2.105 52953 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:02.670972 0.156510 tcp 10.0.2.105 52954 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:03.108318 2.978137 tcp 10.0.2.105 52955 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:06.912820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:30:12.079627 0.000000 tcp 10.0.2.105 52955 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:18.079199 0.030872 tcp 10.0.2.105 52956 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:18.109972 0.071241 tcp 10.0.2.105 52957 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:18.181521 0.160457 tcp 10.0.2.105 52958 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:18.361579 3.001658 tcp 10.0.2.105 52959 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:27.362114 0.000000 tcp 10.0.2.105 52959 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:33.361587 0.086213 tcp 10.0.2.105 52960 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:33.447675 0.072114 tcp 10.0.2.105 52961 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:33.520121 0.162119 tcp 10.0.2.105 52962 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:33.984692 3.002688 tcp 10.0.2.105 52963 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:42.984446 0.000000 tcp 10.0.2.105 52963 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:48.983349 0.031517 tcp 10.0.2.105 52964 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:49.014740 0.076251 tcp 10.0.2.105 52965 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:49.090388 0.160267 tcp 10.0.2.105 52966 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:30:49.378195 2.989554 tcp 10.0.2.105 52967 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:30:58.376765 0.000000 tcp 10.0.2.105 52967 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:04.375337 2.994140 tcp 10.0.2.105 52968 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:13.367962 0.000000 tcp 10.0.2.105 52968 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:18.365363 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:31:19.376845 2.993918 tcp 10.0.2.105 52969 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:28.369937 0.000000 tcp 10.0.2.105 52969 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:34.378926 3.004449 tcp 10.0.2.105 52970 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:42.369702 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:31:43.381260 0.000000 tcp 10.0.2.105 52970 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:49.380220 3.004227 tcp 10.0.2.105 52971 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:31:58.382966 0.000000 tcp 10.0.2.105 52971 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:36:10.920188 2.999706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:36:17.925923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:36:25.927515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:36:41.930210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:37:04.384429 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:37:04.384547 3.002505 tcp 10.0.2.105 52972 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:13.395610 0.000000 tcp 10.0.2.105 52972 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:15.515004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:37:20.880969 0.045011 tcp 10.0.2.105 52973 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:20.926262 0.076469 tcp 10.0.2.105 52974 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:21.003109 0.155738 tcp 10.0.2.105 52975 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:21.424494 2.963107 tcp 10.0.2.105 52976 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:30.313383 0.000000 tcp 10.0.2.105 52976 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:36.239460 0.031195 tcp 10.0.2.105 52977 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:36.270979 0.075526 tcp 10.0.2.105 52978 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:36.346798 0.161980 tcp 10.0.2.105 52979 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:36.834342 2.953497 tcp 10.0.2.105 52980 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:45.713922 0.000000 tcp 10.0.2.105 52980 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:37:51.649802 0.053108 tcp 10.0.2.105 52981 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:51.702835 0.642965 tcp 10.0.2.105 52982 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:52.346103 0.158878 tcp 10.0.2.105 52983 -> 195.113.214.251 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:37:53.113072 2.972245 tcp 10.0.2.105 52984 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:02.013382 0.000000 tcp 10.0.2.105 52984 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:07.943545 0.029968 tcp 10.0.2.105 52985 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:07.973797 0.071272 tcp 10.0.2.105 52986 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:08.044844 0.157385 tcp 10.0.2.105 52987 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:08.635991 2.962415 tcp 10.0.2.105 52988 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:17.537717 0.000000 tcp 10.0.2.105 52988 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:23.455904 0.051855 tcp 10.0.2.105 52989 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:23.508063 0.071301 tcp 10.0.2.105 52990 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:23.579660 0.161110 tcp 10.0.2.105 52991 -> 195.113.214.251 443 SRPA* 0 0 40 33106 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:38:24.526943 2.958430 tcp 10.0.2.105 52992 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:33.409983 0.000000 tcp 10.0.2.105 52992 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:39.338171 2.972904 tcp 10.0.2.105 52993 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:46.832317 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:38:48.234983 0.000000 tcp 10.0.2.105 52993 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:38:54.159965 2.974807 tcp 10.0.2.105 52994 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:03.219999 0.000000 tcp 10.0.2.105 52994 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:09.145872 2.970185 tcp 10.0.2.105 52995 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:13.670925 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:39:18.042094 0.000000 tcp 10.0.2.105 52995 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:23.970164 2.961785 tcp 10.0.2.105 52996 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:32.870678 0.000000 tcp 10.0.2.105 52996 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:39:37.379560 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:42:30.061345 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:42:30.061441 0.172535 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:30.225814 0.338541 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:30.535493 0.223349 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:30.750990 0.096602 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:30.960807 0.064088 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.278539 0.090821 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.349892 0.160257 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.491131 0.222137 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.704169 0.169481 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.915659 0.081315 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:31.977199 0.174011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:32.148083 0.113205 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:32.350820 0.278663 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:32.646012 0.081132 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:32.873248 0.176433 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:33.046427 0.130396 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:33.411742 0.170981 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:33.686434 0.168506 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:33.832030 0.218759 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:33.978885 0.093783 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:34.464066 0.036033 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:34.640989 0.312910 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:34.953598 0.212620 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:35.158107 0.154629 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:35.369055 0.171573 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:42:36.584785 0.407919 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/07 14:43:17.963032 3.001160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:43:24.969993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:43:32.974218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:43:48.974601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:44:20.980467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:44:38.796624 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:44:38.796905 2.993270 tcp 10.0.2.105 52997 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:44:47.789016 0.000000 tcp 10.0.2.105 52997 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:44:53.799767 0.031417 tcp 10.0.2.105 52998 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:44:53.831451 0.071184 tcp 10.0.2.105 52999 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:44:53.902906 0.159983 tcp 10.0.2.105 53000 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:44:54.450879 3.004681 tcp 10.0.2.105 53001 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:03.451446 0.000000 tcp 10.0.2.105 53001 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:09.450745 0.052611 tcp 10.0.2.105 53002 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:09.503199 0.073760 tcp 10.0.2.105 53003 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:09.577269 0.155082 tcp 10.0.2.105 53004 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:10.139265 3.006189 tcp 10.0.2.105 53005 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:19.144082 0.000000 tcp 10.0.2.105 53005 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:25.133482 0.052439 tcp 10.0.2.105 53006 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:25.186196 0.070682 tcp 10.0.2.105 53007 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:25.257229 0.158780 tcp 10.0.2.105 53008 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:25.814818 2.993087 tcp 10.0.2.105 53009 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:34.816451 0.000000 tcp 10.0.2.105 53009 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:40.815847 0.052786 tcp 10.0.2.105 53010 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:40.868972 0.075196 tcp 10.0.2.105 53011 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:40.944018 0.154660 tcp 10.0.2.105 53012 -> 195.113.214.251 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:41.209543 3.000581 tcp 10.0.2.105 53013 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:50.208490 0.000000 tcp 10.0.2.105 53013 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:45:56.207982 0.030419 tcp 10.0.2.105 53014 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:56.238766 0.070270 tcp 10.0.2.105 53015 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:56.309387 0.159166 tcp 10.0.2.105 53016 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:45:56.860504 3.002297 tcp 10.0.2.105 53017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:05.862723 0.000000 tcp 10.0.2.105 53017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:11.862847 3.001333 tcp 10.0.2.105 53018 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:19.871305 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:46:20.862707 0.000000 tcp 10.0.2.105 53018 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:26.862542 3.003335 tcp 10.0.2.105 53019 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:35.864428 0.000000 tcp 10.0.2.105 53019 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:41.863090 2.994208 tcp 10.0.2.105 53020 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:46.870256 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:46:50.865923 0.000000 tcp 10.0.2.105 53020 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:46:56.864842 2.994009 tcp 10.0.2.105 53021 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:47:05.857439 0.000000 tcp 10.0.2.105 53021 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:11.868136 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:52:11.868303 3.003592 tcp 10.0.2.105 53022 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:20.870502 0.000000 tcp 10.0.2.105 53022 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:26.871082 0.053843 tcp 10.0.2.105 53023 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:26.925163 0.075022 tcp 10.0.2.105 53024 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:27.000519 0.158188 tcp 10.0.2.105 53025 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:27.410494 3.003798 tcp 10.0.2.105 53026 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:36.412749 0.000000 tcp 10.0.2.105 53026 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:42.412016 0.032438 tcp 10.0.2.105 53027 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:42.444746 0.071693 tcp 10.0.2.105 53028 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:42.516309 0.156355 tcp 10.0.2.105 53029 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:42.753566 3.002456 tcp 10.0.2.105 53030 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:51.755029 0.000000 tcp 10.0.2.105 53030 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:52:57.754377 0.031812 tcp 10.0.2.105 53031 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:57.785983 0.075368 tcp 10.0.2.105 53032 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:57.861651 0.157637 tcp 10.0.2.105 53033 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:52:58.069238 2.999508 tcp 10.0.2.105 53034 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:07.076722 0.000000 tcp 10.0.2.105 53034 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:13.066189 0.031659 tcp 10.0.2.105 53035 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:13.098106 0.074600 tcp 10.0.2.105 53036 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:13.173076 0.215842 tcp 10.0.2.105 53037 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:13.450664 2.999994 tcp 10.0.2.105 53038 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:22.448881 0.000000 tcp 10.0.2.105 53038 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:28.448474 0.030548 tcp 10.0.2.105 53039 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:28.479329 0.075436 tcp 10.0.2.105 53040 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:28.555106 0.155854 tcp 10.0.2.105 53041 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:53:28.766892 2.995036 tcp 10.0.2.105 53042 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:37.760590 0.000000 tcp 10.0.2.105 53042 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:43.759738 3.004116 tcp 10.0.2.105 53043 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:52.762567 0.000000 tcp 10.0.2.105 53043 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:53:57.369196 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:53:58.761388 3.004098 tcp 10.0.2.105 53044 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:07.764530 0.000000 tcp 10.0.2.105 53044 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:07.988953 2.999449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 14:54:13.763139 3.003893 tcp 10.0.2.105 53045 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:14.994553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:54:21.363491 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:54:22.775815 0.000000 tcp 10.0.2.105 53045 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:22.996171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:54:28.764350 2.994164 tcp 10.0.2.105 53046 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:37.767628 0.000000 tcp 10.0.2.105 53046 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:54:38.999211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:55:11.005145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 14:59:43.767983 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 14:59:43.768496 3.003070 tcp 10.0.2.105 53047 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:59:52.770016 0.000000 tcp 10.0.2.105 53047 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 14:59:58.771196 0.059515 tcp 10.0.2.105 53048 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:59:58.831031 0.068867 tcp 10.0.2.105 53049 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:59:58.900384 0.158247 tcp 10.0.2.105 53050 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 14:59:59.092709 3.000618 tcp 10.0.2.105 53051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:08.092061 0.000000 tcp 10.0.2.105 53051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:14.091294 0.057811 tcp 10.0.2.105 53052 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:14.149366 0.069697 tcp 10.0.2.105 53053 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:14.219379 0.151160 tcp 10.0.2.105 53054 -> 195.113.214.251 443 SRPA* 0 0 40 33956 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:14.455801 2.999871 tcp 10.0.2.105 53055 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:23.562644 0.000000 tcp 10.0.2.105 53055 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:29.513072 0.076749 tcp 10.0.2.105 53056 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:29.590147 0.069608 tcp 10.0.2.105 53057 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:29.660114 0.159389 tcp 10.0.2.105 53058 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:29.859944 2.968446 tcp 10.0.2.105 53059 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:38.806238 0.000000 tcp 10.0.2.105 53059 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:44.805603 0.058572 tcp 10.0.2.105 53060 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:44.864472 0.071366 tcp 10.0.2.105 53061 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:44.936249 0.159160 tcp 10.0.2.105 53062 -> 195.113.214.251 443 SRPA* 0 0 41 33160 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:00:45.282551 2.997503 tcp 10.0.2.105 53063 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:00:54.278871 0.000000 tcp 10.0.2.105 53063 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:00.277975 0.058001 tcp 10.0.2.105 53064 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:01:00.336378 0.068824 tcp 10.0.2.105 53065 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:01:00.405552 0.158923 tcp 10.0.2.105 53066 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:01:00.836472 2.996203 tcp 10.0.2.105 53067 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:09.831168 0.000000 tcp 10.0.2.105 53067 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:15.012105 3.000775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:01:15.829776 3.004163 tcp 10.0.2.105 53068 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:22.018837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:01:24.832549 0.000000 tcp 10.0.2.105 53068 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:29.369157 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:01:30.019918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:01:30.831444 3.004028 tcp 10.0.2.105 53069 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:39.833888 0.000000 tcp 10.0.2.105 53069 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:45.833066 3.004109 tcp 10.0.2.105 53070 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:01:46.023152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:01:53.363352 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:01:54.845939 0.000000 tcp 10.0.2.105 53070 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:02:00.834290 2.994425 tcp 10.0.2.105 53071 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:02:09.837380 0.000000 tcp 10.0.2.105 53071 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:02:18.028927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:07:15.837766 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:07:15.837976 3.003611 tcp 10.0.2.105 53072 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:07:24.839997 0.000000 tcp 10.0.2.105 53072 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:07:30.840516 0.059584 tcp 10.0.2.105 53073 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:30.900430 0.061559 tcp 10.0.2.105 53074 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:30.962324 0.242789 tcp 10.0.2.105 53075 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:31.218731 2.994984 tcp 10.0.2.105 53076 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:07:40.212852 0.000000 tcp 10.0.2.105 53076 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:07:46.211486 0.059118 tcp 10.0.2.105 53077 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:46.270968 0.064368 tcp 10.0.2.105 53078 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:46.335641 0.161595 tcp 10.0.2.105 53079 -> 195.113.214.251 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:07:46.526283 2.999520 tcp 10.0.2.105 53080 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:07:55.524270 0.000000 tcp 10.0.2.105 53080 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:01.523333 0.058824 tcp 10.0.2.105 53081 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:01.581998 0.063325 tcp 10.0.2.105 53082 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:01.645684 0.157927 tcp 10.0.2.105 53083 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:01.834132 2.993483 tcp 10.0.2.105 53084 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:10.836128 0.000000 tcp 10.0.2.105 53084 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:16.835983 0.060518 tcp 10.0.2.105 53085 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:16.896329 0.063745 tcp 10.0.2.105 53086 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:16.960597 0.158044 tcp 10.0.2.105 53087 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:17.174160 2.995417 tcp 10.0.2.105 53088 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:22.035526 3.002165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:08:26.167987 0.000000 tcp 10.0.2.105 53088 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:29.043717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:08:32.168178 0.058437 tcp 10.0.2.105 53089 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:32.226913 0.063751 tcp 10.0.2.105 53090 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:32.291006 0.156376 tcp 10.0.2.105 53091 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:08:32.462850 2.998726 tcp 10.0.2.105 53092 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:37.044066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:08:41.462752 0.000000 tcp 10.0.2.105 53092 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:47.459116 3.004023 tcp 10.0.2.105 53093 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:08:53.047164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:08:56.461887 0.000000 tcp 10.0.2.105 53093 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:01.368879 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:09:02.461607 3.003149 tcp 10.0.2.105 53094 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:11.463303 0.000000 tcp 10.0.2.105 53094 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:17.462550 3.006178 tcp 10.0.2.105 53095 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:25.053273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:09:25.363321 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:09:26.465123 0.000000 tcp 10.0.2.105 53095 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:32.464153 2.993851 tcp 10.0.2.105 53096 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:09:41.470738 0.000000 tcp 10.0.2.105 53096 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:12:45.020601 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:12:45.020719 0.174525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:12:45.187548 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 15:13:00.204807 0.058976 tcp 10.0.2.105 53097 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:13:00.264065 0.045613 tcp 10.0.2.105 53098 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:13:00.310021 0.215389 tcp 10.0.2.105 53099 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:13:00.526025 0.060504 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:01.343655 0.251713 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:01.569937 0.226604 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:01.788387 0.098094 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:02.216120 0.152712 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:02.355071 0.209879 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:02.634634 0.171146 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:02.925340 0.076320 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:02.986107 0.173744 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:03.156857 0.109125 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:03.402063 0.278689 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:03.701137 0.082840 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:03.764232 0.174535 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:03.935781 0.211844 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:04.127369 0.156499 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:04.318225 0.139249 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:04.412664 0.176107 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:04.707479 0.091425 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:04.784495 0.039069 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:05.019721 0.316827 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:05.533113 0.212381 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:05.737990 0.151446 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:05.878458 0.171782 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:13:06.061558 0.239840 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:14:47.467169 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:14:47.467408 3.003533 tcp 10.0.2.105 53100 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:14:56.469668 0.000000 tcp 10.0.2.105 53100 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:02.469107 0.059881 tcp 10.0.2.105 53101 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:02.528872 0.045953 tcp 10.0.2.105 53102 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:02.574648 0.160551 tcp 10.0.2.105 53103 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:02.957909 3.005629 tcp 10.0.2.105 53104 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:11.961492 0.000000 tcp 10.0.2.105 53104 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:17.951073 0.059575 tcp 10.0.2.105 53105 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:18.010988 0.046676 tcp 10.0.2.105 53106 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:18.057922 0.155948 tcp 10.0.2.105 53107 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:18.230381 3.004759 tcp 10.0.2.105 53108 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:27.233516 0.000000 tcp 10.0.2.105 53108 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:29.058919 3.087577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:15:33.292419 0.058122 tcp 10.0.2.105 53109 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:33.350816 0.045793 tcp 10.0.2.105 53110 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:33.396871 0.156447 tcp 10.0.2.105 53111 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:33.574014 2.983878 tcp 10.0.2.105 53112 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:36.124809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:15:42.516506 0.000000 tcp 10.0.2.105 53112 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:44.078010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:15:48.505882 0.057978 tcp 10.0.2.105 53113 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:48.564182 0.044798 tcp 10.0.2.105 53114 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:48.609287 0.158388 tcp 10.0.2.105 53115 -> 195.113.214.251 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:15:48.829845 2.989228 tcp 10.0.2.105 53116 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:15:57.817843 0.000000 tcp 10.0.2.105 53116 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:00.081068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:16:03.827726 0.058581 tcp 10.0.2.105 53117 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:16:03.886119 0.045392 tcp 10.0.2.105 53118 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:16:03.931851 0.153019 tcp 10.0.2.105 53119 -> 195.113.214.251 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:16:06.105096 2.998857 tcp 10.0.2.105 53120 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:15.102764 0.000000 tcp 10.0.2.105 53120 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:21.101300 3.003800 tcp 10.0.2.105 53121 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:28.862183 0.000204 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:16:30.104175 0.000000 tcp 10.0.2.105 53121 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:32.087658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:16:36.103451 3.004081 tcp 10.0.2.105 53122 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:45.115264 0.000000 tcp 10.0.2.105 53122 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:51.104763 2.993981 tcp 10.0.2.105 53123 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:16:55.871020 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:17:00.107548 0.000000 tcp 10.0.2.105 53123 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:17:06.106082 2.993979 tcp 10.0.2.105 53124 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:17:15.100907 0.000000 tcp 10.0.2.105 53124 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:17:19.865714 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:22:21.112472 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:22:21.112565 3.001018 tcp 10.0.2.105 53125 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:22:30.111516 0.000000 tcp 10.0.2.105 53125 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:22:36.092447 4.236114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:22:37.366702 0.060161 tcp 10.0.2.105 53126 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:37.427235 0.044840 tcp 10.0.2.105 53127 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:37.472410 0.155003 tcp 10.0.2.105 53128 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:37.992949 2.970768 tcp 10.0.2.105 53129 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:22:44.281730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:22:46.890070 0.000000 tcp 10.0.2.105 53129 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:22:52.190447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:22:52.816783 0.059724 tcp 10.0.2.105 53130 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:52.876813 0.045970 tcp 10.0.2.105 53131 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:52.923107 0.156280 tcp 10.0.2.105 53132 -> 195.113.214.251 443 SRPA* 0 0 41 19176 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:22:53.343016 2.955083 tcp 10.0.2.105 53133 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:02.234465 0.000000 tcp 10.0.2.105 53133 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:08.003493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:23:08.163068 0.058277 tcp 10.0.2.105 53134 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:08.221724 0.044545 tcp 10.0.2.105 53135 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:08.266583 0.156518 tcp 10.0.2.105 53136 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:08.896807 2.960080 tcp 10.0.2.105 53137 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:17.787663 0.000000 tcp 10.0.2.105 53137 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:23.716376 0.058923 tcp 10.0.2.105 53138 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:23.775650 0.045409 tcp 10.0.2.105 53139 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:23.821338 0.153378 tcp 10.0.2.105 53140 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:24.170975 2.968813 tcp 10.0.2.105 53141 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:33.063765 0.000000 tcp 10.0.2.105 53141 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:38.981171 0.058886 tcp 10.0.2.105 53142 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:39.040512 0.047878 tcp 10.0.2.105 53143 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:39.086955 0.160647 tcp 10.0.2.105 53144 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:23:39.559673 2.974706 tcp 10.0.2.105 53145 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:39.619446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:23:48.459649 0.000000 tcp 10.0.2.105 53145 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:23:54.382831 2.972157 tcp 10.0.2.105 53146 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:03.278826 0.000000 tcp 10.0.2.105 53146 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:08.016271 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:24:09.205366 2.956557 tcp 10.0.2.105 53147 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:18.102323 0.000000 tcp 10.0.2.105 53147 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:24.065995 2.995189 tcp 10.0.2.105 53148 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:31.866846 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:24:33.058725 0.000000 tcp 10.0.2.105 53148 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:39.067551 3.003882 tcp 10.0.2.105 53149 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:24:48.070707 0.000000 tcp 10.0.2.105 53149 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:29:43.127553 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:29:50.134162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:29:54.070759 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:29:54.070862 3.003365 tcp 10.0.2.105 53150 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:29:58.135849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:30:03.073049 0.000000 tcp 10.0.2.105 53150 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:09.073959 0.061466 tcp 10.0.2.105 53151 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:09.135752 0.063220 tcp 10.0.2.105 53152 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:09.199292 0.156385 tcp 10.0.2.105 53153 -> 195.113.214.251 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:09.465686 3.000869 tcp 10.0.2.105 53154 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:14.138573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:30:18.464843 0.000000 tcp 10.0.2.105 53154 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:24.464226 0.060097 tcp 10.0.2.105 53155 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:24.524601 0.064290 tcp 10.0.2.105 53156 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:24.589160 0.156868 tcp 10.0.2.105 53157 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:24.945122 2.993645 tcp 10.0.2.105 53158 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:33.937182 0.000000 tcp 10.0.2.105 53158 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:39.947458 0.059089 tcp 10.0.2.105 53159 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:40.006968 0.063711 tcp 10.0.2.105 53160 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:40.071014 0.155607 tcp 10.0.2.105 53161 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:40.735407 2.996571 tcp 10.0.2.105 53162 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:46.144976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:30:49.730498 0.000000 tcp 10.0.2.105 53162 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:30:55.731635 0.058814 tcp 10.0.2.105 53163 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:55.790774 0.063308 tcp 10.0.2.105 53164 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:55.854392 0.160112 tcp 10.0.2.105 53165 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:30:56.314368 2.999486 tcp 10.0.2.105 53166 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:05.313564 0.000000 tcp 10.0.2.105 53166 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:11.312123 0.059479 tcp 10.0.2.105 53167 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:31:11.371921 0.062446 tcp 10.0.2.105 53168 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:31:11.434683 0.157170 tcp 10.0.2.105 53169 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:31:11.730786 3.004758 tcp 10.0.2.105 53170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:20.734789 0.000000 tcp 10.0.2.105 53170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:26.723333 2.994350 tcp 10.0.2.105 53171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:35.726412 0.000000 tcp 10.0.2.105 53171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:40.362948 0.000223 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:31:41.725016 2.994878 tcp 10.0.2.105 53172 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:50.717772 0.000000 tcp 10.0.2.105 53172 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:31:56.727939 2.993526 tcp 10.0.2.105 53173 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:32:04.367427 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:32:05.719334 0.000000 tcp 10.0.2.105 53173 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:32:11.728007 3.004684 tcp 10.0.2.105 53174 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:32:20.731615 0.000000 tcp 10.0.2.105 53174 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:36:50.151596 3.000800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:36:57.158651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:37:05.159949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:37:21.162843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:37:26.733114 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:37:26.733233 3.002065 tcp 10.0.2.105 53175 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:37:35.733745 0.000000 tcp 10.0.2.105 53175 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:37:41.734331 0.060816 tcp 10.0.2.105 53176 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:41.795480 0.062516 tcp 10.0.2.105 53177 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:41.858287 0.158466 tcp 10.0.2.105 53178 -> 195.113.214.251 443 SRPA* 0 0 28 11890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:42.547642 2.990424 tcp 10.0.2.105 53179 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:37:51.546560 0.000000 tcp 10.0.2.105 53179 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:37:53.168575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:37:57.545752 0.743069 tcp 10.0.2.105 53180 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:58.288596 0.064554 tcp 10.0.2.105 53181 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:58.353473 0.158188 tcp 10.0.2.105 53182 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:37:59.026078 2.958109 tcp 10.0.2.105 53183 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:07.915198 0.000000 tcp 10.0.2.105 53183 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:13.844995 0.059679 tcp 10.0.2.105 53184 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:13.904492 0.067541 tcp 10.0.2.105 53185 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:13.972505 0.153019 tcp 10.0.2.105 53186 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:14.193921 2.964315 tcp 10.0.2.105 53187 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:23.088632 0.000000 tcp 10.0.2.105 53187 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:29.018316 0.059564 tcp 10.0.2.105 53188 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:29.078141 0.062997 tcp 10.0.2.105 53189 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:29.141427 0.156146 tcp 10.0.2.105 53190 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:29.847727 2.970735 tcp 10.0.2.105 53191 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:38.746677 0.000000 tcp 10.0.2.105 53191 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:44.674716 0.058760 tcp 10.0.2.105 53192 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:44.733822 0.066907 tcp 10.0.2.105 53193 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:44.801044 0.160473 tcp 10.0.2.105 53194 -> 195.113.214.251 443 SRPA* 0 0 69 69904 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:38:45.098841 2.958516 tcp 10.0.2.105 53195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:53.997547 0.000000 tcp 10.0.2.105 53195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:38:59.966674 2.992803 tcp 10.0.2.105 53196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:08.957761 0.000000 tcp 10.0.2.105 53196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:13.865028 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:39:14.966441 2.994305 tcp 10.0.2.105 53197 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:23.959495 0.000000 tcp 10.0.2.105 53197 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:29.968511 3.003923 tcp 10.0.2.105 53198 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:37.869256 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:39:38.971036 0.000000 tcp 10.0.2.105 53198 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:44.969904 3.004057 tcp 10.0.2.105 53199 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:39:53.972634 0.000000 tcp 10.0.2.105 53199 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:43:34.399982 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:43:34.400086 0.100676 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:34.501147 0.180016 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:34.673299 0.060550 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:34.764370 0.248356 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:34.989368 0.226081 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:35.437508 0.083648 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:35.503757 0.167395 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:35.698779 0.078127 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:35.759475 0.171426 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:35.927775 0.178226 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.142261 0.202331 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.338978 0.108637 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.406964 0.276148 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.712414 0.085568 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 1910 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.779248 0.177167 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:36.952880 0.171739 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:37.153025 0.175466 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:37.300000 0.104389 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:37.623217 0.041006 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:37.663530 0.208027 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:37.793578 0.129724 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:38.125989 0.316491 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:38.596882 0.217116 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:38.805574 0.153443 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:38.947235 0.172880 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:39.213220 0.319818 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/07 15:43:57.175047 3.000946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:44:04.182630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:44:12.183873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:44:28.186883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:44:59.973245 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:44:59.973355 3.002943 tcp 10.0.2.105 53200 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:00.192888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:45:08.975565 0.000000 tcp 10.0.2.105 53200 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:14.978791 0.059487 tcp 10.0.2.105 53201 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:15.038550 0.063230 tcp 10.0.2.105 53202 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:15.102091 0.321719 tcp 10.0.2.105 53203 -> 195.113.214.251 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:15.591752 2.997580 tcp 10.0.2.105 53204 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:24.587934 0.000000 tcp 10.0.2.105 53204 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:30.587468 0.060178 tcp 10.0.2.105 53205 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:30.647575 0.062122 tcp 10.0.2.105 53206 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:30.709529 0.160839 tcp 10.0.2.105 53207 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:31.019156 3.002373 tcp 10.0.2.105 53208 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:40.019835 0.000000 tcp 10.0.2.105 53208 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:46.019886 0.060111 tcp 10.0.2.105 53209 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:46.080415 0.061918 tcp 10.0.2.105 53210 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:46.142170 0.157821 tcp 10.0.2.105 53211 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:45:46.678644 3.005473 tcp 10.0.2.105 53212 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:45:55.682756 0.000000 tcp 10.0.2.105 53212 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:01.672519 0.059047 tcp 10.0.2.105 53213 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:01.731924 0.062412 tcp 10.0.2.105 53214 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:01.794650 0.155533 tcp 10.0.2.105 53215 -> 195.113.214.251 443 SRPA* 0 0 41 35024 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:02.139614 3.006527 tcp 10.0.2.105 53216 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:11.145035 0.000000 tcp 10.0.2.105 53216 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:17.135455 0.059913 tcp 10.0.2.105 53217 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:17.195769 0.061180 tcp 10.0.2.105 53218 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:17.257246 0.158941 tcp 10.0.2.105 53219 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:46:17.427223 2.990860 tcp 10.0.2.105 53220 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:26.426888 0.000000 tcp 10.0.2.105 53220 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:32.425920 2.993901 tcp 10.0.2.105 53221 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:41.418865 0.000000 tcp 10.0.2.105 53221 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:46.365726 0.000181 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:46:47.427203 3.004316 tcp 10.0.2.105 53222 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:46:56.429936 0.000000 tcp 10.0.2.105 53222 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:47:02.432971 3.000139 tcp 10.0.2.105 53223 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:47:10.370174 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:47:11.431344 0.000000 tcp 10.0.2.105 53223 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:47:17.430135 3.004587 tcp 10.0.2.105 53224 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:47:26.433224 0.000000 tcp 10.0.2.105 53224 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:52:32.434129 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:52:32.434236 2.993052 tcp 10.0.2.105 53225 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:52:41.435483 0.000000 tcp 10.0.2.105 53225 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:52:47.437336 0.060618 tcp 10.0.2.105 53226 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:52:47.498300 0.063438 tcp 10.0.2.105 53227 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:52:47.561530 0.159589 tcp 10.0.2.105 53228 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:52:47.934891 2.997698 tcp 10.0.2.105 53229 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:52:56.928548 0.000000 tcp 10.0.2.105 53229 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:02.927917 0.058346 tcp 10.0.2.105 53230 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:02.986602 0.060856 tcp 10.0.2.105 53231 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:03.047820 0.154589 tcp 10.0.2.105 53232 -> 195.113.214.251 443 SRPA* 0 0 27 11664 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:03.551666 3.518818 tcp 10.0.2.105 53233 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:12.995378 0.000000 tcp 10.0.2.105 53233 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:18.936251 0.059095 tcp 10.0.2.105 53234 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:18.995720 0.062261 tcp 10.0.2.105 53235 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:19.058288 0.596974 tcp 10.0.2.105 53236 -> 195.113.214.251 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:20.094965 2.970025 tcp 10.0.2.105 53237 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:28.996017 0.000000 tcp 10.0.2.105 53237 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:34.922704 0.058892 tcp 10.0.2.105 53238 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:34.981919 0.061224 tcp 10.0.2.105 53239 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:35.043461 0.417544 tcp 10.0.2.105 53240 -> 195.113.214.251 443 SRPA* 0 0 19 9210 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:35.674027 2.961050 tcp 10.0.2.105 53241 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:44.573291 0.000000 tcp 10.0.2.105 53241 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:53:50.490616 0.059350 tcp 10.0.2.105 53242 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:50.550265 0.066135 tcp 10.0.2.105 53243 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:50.616746 0.490370 tcp 10.0.2.105 53244 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 15:53:51.406802 3.004462 tcp 10.0.2.105 53245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:00.411785 0.000000 tcp 10.0.2.105 53245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:06.408252 3.004518 tcp 10.0.2.105 53246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:14.369592 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:54:15.411295 0.000000 tcp 10.0.2.105 53246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:21.410042 3.004039 tcp 10.0.2.105 53247 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:28.204602 3.001797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 15:54:30.412711 0.000000 tcp 10.0.2.105 53247 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:35.209629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:54:36.411777 3.004086 tcp 10.0.2.105 53248 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:41.368717 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:54:43.210703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:54:45.414239 0.000000 tcp 10.0.2.105 53248 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:51.412888 3.004546 tcp 10.0.2.105 53249 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:54:59.220794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 15:55:00.428623 0.000000 tcp 10.0.2.105 53249 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 15:55:05.362870 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 15:55:31.220243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:00:06.416348 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:00:06.416436 2.993793 tcp 10.0.2.105 53250 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:15.408921 0.000000 tcp 10.0.2.105 53250 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:21.419536 0.059958 tcp 10.0.2.105 53251 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:21.479844 0.063365 tcp 10.0.2.105 53252 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:21.543066 0.133369 tcp 10.0.2.105 53253 -> 195.113.214.251 443 SRPA* 0 0 34 23941 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:21.957506 3.005184 tcp 10.0.2.105 53254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:30.961220 0.000000 tcp 10.0.2.105 53254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:36.950585 0.058611 tcp 10.0.2.105 53255 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:37.009522 0.062439 tcp 10.0.2.105 53256 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:37.072431 0.160905 tcp 10.0.2.105 53257 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:37.290622 3.004058 tcp 10.0.2.105 53258 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:46.294780 0.000000 tcp 10.0.2.105 53258 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:00:52.292609 0.058655 tcp 10.0.2.105 53259 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:52.351540 0.060331 tcp 10.0.2.105 53260 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:52.411854 0.620782 tcp 10.0.2.105 53261 -> 195.113.214.251 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:00:53.061233 2.996105 tcp 10.0.2.105 53262 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:02.065557 0.000000 tcp 10.0.2.105 53262 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:08.055391 0.059943 tcp 10.0.2.105 53263 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:08.115164 0.067508 tcp 10.0.2.105 53264 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:08.183033 0.133988 tcp 10.0.2.105 53265 -> 195.113.214.251 443 SRPA* 0 0 33 23887 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:08.635034 2.996482 tcp 10.0.2.105 53266 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:17.628306 0.000000 tcp 10.0.2.105 53266 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:23.637750 0.059168 tcp 10.0.2.105 53267 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:23.697264 0.064941 tcp 10.0.2.105 53268 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:23.762569 0.158577 tcp 10.0.2.105 53269 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:01:24.127676 3.004185 tcp 10.0.2.105 53270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:33.130507 0.000000 tcp 10.0.2.105 53270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:35.227390 3.000246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:01:39.129466 3.003865 tcp 10.0.2.105 53271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:42.233617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:01:48.132023 0.000000 tcp 10.0.2.105 53271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:01:50.235269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:01:52.868859 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:01:54.130899 3.004260 tcp 10.0.2.105 53272 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:03.133578 0.000000 tcp 10.0.2.105 53272 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:06.238138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:02:09.132425 3.004349 tcp 10.0.2.105 53273 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:16.863212 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:02:18.145180 0.000000 tcp 10.0.2.105 53273 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:24.133879 2.994324 tcp 10.0.2.105 53274 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:33.136690 0.000000 tcp 10.0.2.105 53274 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:02:38.244160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:07:39.137632 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:07:39.137750 3.003834 tcp 10.0.2.105 53275 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:07:48.139696 0.000000 tcp 10.0.2.105 53275 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:07:54.139944 0.060196 tcp 10.0.2.105 53276 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:07:54.200463 0.063514 tcp 10.0.2.105 53277 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:07:54.263824 0.164044 tcp 10.0.2.105 53278 -> 195.113.214.251 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:07:54.576750 2.996582 tcp 10.0.2.105 53279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:03.571847 0.000000 tcp 10.0.2.105 53279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:09.570926 0.059728 tcp 10.0.2.105 53280 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:09.631114 0.063384 tcp 10.0.2.105 53281 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:09.694343 0.154791 tcp 10.0.2.105 53282 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:10.041246 3.004453 tcp 10.0.2.105 53283 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:19.044119 0.000000 tcp 10.0.2.105 53283 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:25.043846 0.105343 tcp 10.0.2.105 53284 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:25.149027 0.063566 tcp 10.0.2.105 53285 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:25.212849 0.155888 tcp 10.0.2.105 53286 -> 195.113.214.251 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:25.607687 2.981721 tcp 10.0.2.105 53287 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:34.576616 0.000000 tcp 10.0.2.105 53287 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:40.565862 0.059714 tcp 10.0.2.105 53288 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:40.626005 0.062706 tcp 10.0.2.105 53289 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:40.688656 0.164394 tcp 10.0.2.105 53290 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:41.089025 3.000711 tcp 10.0.2.105 53291 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:42.249852 3.003631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:08:49.258234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:08:50.088838 0.000000 tcp 10.0.2.105 53291 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:56.087857 0.059397 tcp 10.0.2.105 53292 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:56.147509 0.062525 tcp 10.0.2.105 53293 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:56.210313 0.156170 tcp 10.0.2.105 53294 -> 195.113.214.251 443 SRPA* 0 0 50 30200 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:08:56.460125 3.002860 tcp 10.0.2.105 53295 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:08:57.259185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:09:05.460483 0.000000 tcp 10.0.2.105 53295 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:11.463035 3.000670 tcp 10.0.2.105 53296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:13.262166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:09:20.462760 0.000000 tcp 10.0.2.105 53296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:25.369620 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:09:26.461381 3.004159 tcp 10.0.2.105 53297 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:35.463834 0.000000 tcp 10.0.2.105 53297 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:41.462896 3.004238 tcp 10.0.2.105 53298 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:45.321984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:09:49.391809 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:09:50.487173 0.000000 tcp 10.0.2.105 53298 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:09:56.464670 2.993866 tcp 10.0.2.105 53299 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:10:05.557301 0.000000 tcp 10.0.2.105 53299 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:13:55.461249 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:13:55.461378 0.059945 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:55.520179 0.242426 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:55.741090 0.135063 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 4 1382 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:55.917036 0.176679 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:56.084684 0.230723 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:56.308793 0.082895 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:56.558857 0.167120 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:56.807601 0.078163 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:56.866987 0.175297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:57.039512 0.148555 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:57.224273 0.208786 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:57.421009 0.107292 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:57.699288 0.293185 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.022912 0.084722 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.087132 0.177260 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.269796 0.170566 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.419006 0.174267 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.565018 0.293338 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.754091 0.127374 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.909772 0.093975 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:58.987312 0.035936 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:59.107681 0.315919 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:59.587662 0.224305 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:13:59.804185 0.146792 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:14:00.036805 0.176709 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2593 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:14:00.257914 0.226526 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:15:11.467556 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:15:11.467657 3.003907 tcp 10.0.2.105 53300 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:20.470003 0.000000 tcp 10.0.2.105 53300 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:26.470350 0.061755 tcp 10.0.2.105 53301 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:26.532471 0.061272 tcp 10.0.2.105 53302 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:26.594077 0.158353 tcp 10.0.2.105 53303 -> 195.113.214.251 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:26.858866 2.994385 tcp 10.0.2.105 53304 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:35.852476 0.000000 tcp 10.0.2.105 53304 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:41.850845 0.060266 tcp 10.0.2.105 53305 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:41.911435 0.064038 tcp 10.0.2.105 53306 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:41.975780 0.152935 tcp 10.0.2.105 53307 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:42.386199 2.999257 tcp 10.0.2.105 53308 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:49.275069 3.000729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:15:51.384488 0.000000 tcp 10.0.2.105 53308 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:15:56.281170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:15:57.383868 0.059582 tcp 10.0.2.105 53309 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:57.443299 0.059716 tcp 10.0.2.105 53310 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:57.503364 0.158707 tcp 10.0.2.105 53311 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:15:57.796908 2.991070 tcp 10.0.2.105 53312 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:04.283148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:16:06.796702 0.000000 tcp 10.0.2.105 53312 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:12.795878 0.059548 tcp 10.0.2.105 53313 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:12.855201 0.062453 tcp 10.0.2.105 53314 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:12.917921 0.155474 tcp 10.0.2.105 53315 -> 195.113.214.251 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:14.211093 3.000584 tcp 10.0.2.105 53316 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:20.286187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:16:23.210522 0.000000 tcp 10.0.2.105 53316 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:29.209888 0.058968 tcp 10.0.2.105 53317 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:29.269233 0.066313 tcp 10.0.2.105 53318 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:29.335888 0.160854 tcp 10.0.2.105 53319 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:16:30.264172 3.000441 tcp 10.0.2.105 53320 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:39.263153 0.000000 tcp 10.0.2.105 53320 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:45.262247 3.004301 tcp 10.0.2.105 53321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:16:52.293369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:16:52.862825 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:16:54.264902 0.000000 tcp 10.0.2.105 53321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:00.708555 2.970518 tcp 10.0.2.105 53322 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:09.634585 0.000000 tcp 10.0.2.105 53322 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:15.579387 2.963901 tcp 10.0.2.105 53323 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:20.139331 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:17:24.488031 0.000000 tcp 10.0.2.105 53323 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:30.440771 2.961961 tcp 10.0.2.105 53324 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:39.351040 0.000000 tcp 10.0.2.105 53324 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:17:43.916965 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:22:45.269977 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:22:45.270090 3.003898 tcp 10.0.2.105 53325 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:22:54.272677 0.000000 tcp 10.0.2.105 53325 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:22:56.300318 2.998951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:23:00.272603 0.060426 tcp 10.0.2.105 53326 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:00.333310 0.060674 tcp 10.0.2.105 53327 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:00.394348 0.153185 tcp 10.0.2.105 53328 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:00.969589 3.006923 tcp 10.0.2.105 53329 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:03.305603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:23:09.975116 0.000000 tcp 10.0.2.105 53329 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:11.307192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:23:15.963912 0.059482 tcp 10.0.2.105 53330 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:16.023687 0.068391 tcp 10.0.2.105 53331 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:16.092390 0.157993 tcp 10.0.2.105 53332 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:16.271694 2.996277 tcp 10.0.2.105 53333 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:25.277282 0.000000 tcp 10.0.2.105 53333 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:27.310271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:23:31.266581 0.058402 tcp 10.0.2.105 53334 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:31.325239 0.064311 tcp 10.0.2.105 53335 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:31.389827 0.154956 tcp 10.0.2.105 53336 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:31.631537 2.998967 tcp 10.0.2.105 53337 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:40.629281 0.000000 tcp 10.0.2.105 53337 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:46.628680 0.059955 tcp 10.0.2.105 53338 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:46.688966 0.066394 tcp 10.0.2.105 53339 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:46.755706 0.219116 tcp 10.0.2.105 53340 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:23:47.075674 2.997129 tcp 10.0.2.105 53341 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:56.071399 0.000000 tcp 10.0.2.105 53341 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:23:59.316079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:24:02.070675 0.059391 tcp 10.0.2.105 53342 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:24:02.130361 0.063196 tcp 10.0.2.105 53343 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:24:02.193488 0.153283 tcp 10.0.2.105 53344 -> 195.113.214.251 443 SRPA* 0 0 28 12094 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:24:02.493907 3.001056 tcp 10.0.2.105 53345 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:11.493314 0.000000 tcp 10.0.2.105 53345 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:17.492258 3.004273 tcp 10.0.2.105 53346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:26.495065 0.000000 tcp 10.0.2.105 53346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:31.361940 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:24:32.494004 2.994428 tcp 10.0.2.105 53347 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:41.496593 0.000000 tcp 10.0.2.105 53347 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:47.495520 2.994247 tcp 10.0.2.105 53348 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:24:55.366850 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:24:56.488840 0.000000 tcp 10.0.2.105 53348 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:25:02.497036 3.003928 tcp 10.0.2.105 53349 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:25:11.502077 0.000000 tcp 10.0.2.105 53349 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:03.322443 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:30:10.329740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:30:17.500518 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:30:17.500632 3.002917 tcp 10.0.2.105 53350 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:18.330836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:30:26.502912 0.000000 tcp 10.0.2.105 53350 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:32.503443 0.059737 tcp 10.0.2.105 53351 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:32.563556 0.064437 tcp 10.0.2.105 53352 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:32.628356 0.159339 tcp 10.0.2.105 53353 -> 195.113.214.251 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:32.843673 3.002875 tcp 10.0.2.105 53354 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:34.333558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:30:41.844807 0.000000 tcp 10.0.2.105 53354 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:47.844028 0.059176 tcp 10.0.2.105 53355 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:47.903709 0.064734 tcp 10.0.2.105 53356 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:47.968758 0.166312 tcp 10.0.2.105 53357 -> 195.113.214.251 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:30:48.236305 2.992153 tcp 10.0.2.105 53358 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:30:57.236988 0.000000 tcp 10.0.2.105 53358 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:03.236383 0.058968 tcp 10.0.2.105 53359 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:03.295637 0.068859 tcp 10.0.2.105 53360 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:03.364784 0.160828 tcp 10.0.2.105 53361 -> 195.113.214.251 443 SRPA* 0 0 48 36182 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:03.698190 3.002453 tcp 10.0.2.105 53362 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:06.340114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:31:12.699258 0.000000 tcp 10.0.2.105 53362 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:18.698336 0.380019 tcp 10.0.2.105 53363 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:19.078668 0.066015 tcp 10.0.2.105 53364 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:19.145002 0.148619 tcp 10.0.2.105 53365 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:19.450492 2.969068 tcp 10.0.2.105 53366 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:28.363368 0.000000 tcp 10.0.2.105 53366 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:34.306006 0.060222 tcp 10.0.2.105 53367 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:34.366510 0.061826 tcp 10.0.2.105 53368 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:34.428647 0.155933 tcp 10.0.2.105 53369 -> 195.113.214.251 443 SRPA* 0 0 24 12114 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:31:34.909109 2.983285 tcp 10.0.2.105 53370 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:43.836981 0.000000 tcp 10.0.2.105 53370 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:49.808232 2.983547 tcp 10.0.2.105 53371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:31:58.745469 0.000000 tcp 10.0.2.105 53371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:03.361817 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:32:04.744348 2.994223 tcp 10.0.2.105 53372 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:13.747048 0.000000 tcp 10.0.2.105 53372 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:19.745808 2.993961 tcp 10.0.2.105 53373 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:27.366902 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:32:28.738748 0.000000 tcp 10.0.2.105 53373 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:34.747493 3.003918 tcp 10.0.2.105 53374 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:32:43.750223 0.000000 tcp 10.0.2.105 53374 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:37:10.346460 3.002144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:37:17.353476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:37:25.354584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:37:41.357828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:37:49.750650 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:37:49.750761 3.004029 tcp 10.0.2.105 53375 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:37:58.753243 0.000000 tcp 10.0.2.105 53375 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:04.753462 0.060655 tcp 10.0.2.105 53376 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:04.813969 0.066014 tcp 10.0.2.105 53377 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:04.880306 0.153240 tcp 10.0.2.105 53378 -> 195.113.214.251 443 SRPA* 0 0 28 11890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:05.246849 2.999253 tcp 10.0.2.105 53379 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:13.364688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:38:14.245399 0.000000 tcp 10.0.2.105 53379 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:20.244460 0.059428 tcp 10.0.2.105 53380 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:20.304188 0.065805 tcp 10.0.2.105 53381 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:20.370315 0.161729 tcp 10.0.2.105 53382 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:20.665986 2.993212 tcp 10.0.2.105 53383 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:29.676424 0.000000 tcp 10.0.2.105 53383 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:35.666577 0.058719 tcp 10.0.2.105 53384 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:35.725585 0.065762 tcp 10.0.2.105 53385 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:35.791650 0.159802 tcp 10.0.2.105 53386 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:35.969091 3.001995 tcp 10.0.2.105 53387 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:44.969037 0.000000 tcp 10.0.2.105 53387 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:38:50.968891 0.059546 tcp 10.0.2.105 53388 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:51.028753 0.063120 tcp 10.0.2.105 53389 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:51.092176 0.156494 tcp 10.0.2.105 53390 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:38:51.568491 3.004635 tcp 10.0.2.105 53391 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:00.571697 0.000000 tcp 10.0.2.105 53391 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:06.560630 0.060124 tcp 10.0.2.105 53392 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:39:06.620596 0.068401 tcp 10.0.2.105 53393 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:39:06.689264 0.154305 tcp 10.0.2.105 53394 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:39:07.088053 3.007512 tcp 10.0.2.105 53395 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:16.094682 0.000000 tcp 10.0.2.105 53395 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:22.083787 3.003331 tcp 10.0.2.105 53396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:31.095916 0.000000 tcp 10.0.2.105 53396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:35.862477 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:39:37.084673 2.994299 tcp 10.0.2.105 53397 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:46.087053 0.000000 tcp 10.0.2.105 53397 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:52.085866 2.997514 tcp 10.0.2.105 53398 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:39:59.866960 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:40:01.079047 0.000000 tcp 10.0.2.105 53398 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:40:07.087722 3.004035 tcp 10.0.2.105 53399 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:40:16.093959 0.000000 tcp 10.0.2.105 53399 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:44:14.043126 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:44:14.043239 0.099171 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:14.120835 0.174351 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:14.315293 0.221973 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:14.530481 0.063675 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:15.059960 0.246482 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:15.284683 0.078757 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:15.452931 0.191140 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:15.968590 0.075083 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:16.028223 0.175674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:16.201299 0.148505 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2023 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:16.360775 0.198322 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:16.655424 0.108804 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:16.725516 0.284164 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.118745 0.088836 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.184223 0.175056 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.372355 2.999192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:44:17.381896 0.169030 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.528031 0.175967 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.676467 0.181303 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:17.833507 0.130756 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:18.073261 0.093020 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:18.151026 0.038765 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:18.304108 0.151484 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:18.442199 0.173978 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:18.762239 0.315347 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:19.353866 0.221379 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:19.568031 0.236442 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/07 16:44:24.377490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:44:32.378934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:44:48.381905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:45:20.387902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:45:22.090710 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:45:22.090856 3.003435 tcp 10.0.2.105 53400 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:45:31.093317 0.000000 tcp 10.0.2.105 53400 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:45:37.094182 0.059169 tcp 10.0.2.105 53401 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:37.153671 0.062101 tcp 10.0.2.105 53402 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:37.216020 0.181820 tcp 10.0.2.105 53403 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:37.881329 2.996073 tcp 10.0.2.105 53404 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:45:46.888963 0.000000 tcp 10.0.2.105 53404 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:45:52.875570 0.058717 tcp 10.0.2.105 53405 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:52.934547 0.062486 tcp 10.0.2.105 53406 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:52.997323 0.192502 tcp 10.0.2.105 53407 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:45:53.518433 3.001352 tcp 10.0.2.105 53408 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:02.518707 0.000000 tcp 10.0.2.105 53408 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:08.518139 0.058096 tcp 10.0.2.105 53409 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:08.576067 0.063001 tcp 10.0.2.105 53410 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:08.639326 0.158245 tcp 10.0.2.105 53411 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:09.242167 3.000855 tcp 10.0.2.105 53412 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:18.241463 0.000000 tcp 10.0.2.105 53412 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:24.240360 0.058888 tcp 10.0.2.105 53413 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:24.299553 0.062776 tcp 10.0.2.105 53414 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:24.362123 0.158351 tcp 10.0.2.105 53415 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:24.902967 3.002211 tcp 10.0.2.105 53416 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:33.903604 0.000000 tcp 10.0.2.105 53416 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:39.903123 0.059319 tcp 10.0.2.105 53417 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:39.962777 0.062738 tcp 10.0.2.105 53418 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:40.025821 0.159221 tcp 10.0.2.105 53419 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:46:40.693234 2.994876 tcp 10.0.2.105 53420 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:49.696519 0.000000 tcp 10.0.2.105 53420 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:46:55.685101 2.995991 tcp 10.0.2.105 53421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:04.677782 0.000000 tcp 10.0.2.105 53421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:09.364639 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:47:10.686856 2.994640 tcp 10.0.2.105 53422 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:19.679538 0.000000 tcp 10.0.2.105 53422 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:25.688377 3.004321 tcp 10.0.2.105 53423 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:33.368872 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:47:34.691140 0.000000 tcp 10.0.2.105 53423 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:40.689719 3.004193 tcp 10.0.2.105 53424 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:47:49.809730 0.000000 tcp 10.0.2.105 53424 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:52:55.693141 0.000209 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:52:55.693457 3.003443 tcp 10.0.2.105 53425 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:04.695623 0.000000 tcp 10.0.2.105 53425 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:10.697176 0.059420 tcp 10.0.2.105 53426 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:10.756845 0.065159 tcp 10.0.2.105 53427 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:10.822303 0.153158 tcp 10.0.2.105 53428 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:11.023341 2.994935 tcp 10.0.2.105 53429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:20.017533 0.000000 tcp 10.0.2.105 53429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:26.016977 0.058474 tcp 10.0.2.105 53430 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:26.075724 0.061795 tcp 10.0.2.105 53431 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:26.137816 0.153425 tcp 10.0.2.105 53432 -> 195.113.214.251 443 SRPA* 0 0 29 14432 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:26.475635 2.995681 tcp 10.0.2.105 53433 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:35.469734 0.000000 tcp 10.0.2.105 53433 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:41.468915 0.058288 tcp 10.0.2.105 53434 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:41.527472 0.063062 tcp 10.0.2.105 53435 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:41.590859 0.154981 tcp 10.0.2.105 53436 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:41.827421 3.005790 tcp 10.0.2.105 53437 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:50.832031 0.000000 tcp 10.0.2.105 53437 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:53:56.820698 0.057981 tcp 10.0.2.105 53438 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:56.878961 0.061878 tcp 10.0.2.105 53439 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:56.941117 0.154234 tcp 10.0.2.105 53440 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:53:57.183950 3.001292 tcp 10.0.2.105 53441 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:06.183826 0.000000 tcp 10.0.2.105 53441 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:12.183563 0.058649 tcp 10.0.2.105 53442 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:54:12.242587 0.062426 tcp 10.0.2.105 53443 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:54:12.305361 0.156564 tcp 10.0.2.105 53444 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 16:54:12.476123 2.991158 tcp 10.0.2.105 53445 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:21.475769 0.000000 tcp 10.0.2.105 53445 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:27.474966 2.993785 tcp 10.0.2.105 53446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:36.477482 0.000000 tcp 10.0.2.105 53446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:39.394670 3.001278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 16:54:41.364563 0.000184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:54:42.476280 2.994099 tcp 10.0.2.105 53447 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:46.401820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:54:51.469100 0.000000 tcp 10.0.2.105 53447 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:54:54.403212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:54:57.477809 3.004045 tcp 10.0.2.105 53448 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:55:05.368831 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 16:55:06.480525 0.000000 tcp 10.0.2.105 53448 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:55:10.406241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 16:55:12.479396 3.004315 tcp 10.0.2.105 53449 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:55:21.482194 0.000000 tcp 10.0.2.105 53449 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 16:55:42.412671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:00:27.482993 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:00:27.483087 3.003470 tcp 10.0.2.105 53450 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:00:36.485069 0.000000 tcp 10.0.2.105 53450 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:00:42.486208 0.059785 tcp 10.0.2.105 53451 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:42.546274 0.064724 tcp 10.0.2.105 53452 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:42.611383 0.158092 tcp 10.0.2.105 53453 -> 195.113.214.251 443 SRPA* 0 0 35 17840 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:42.993712 2.995207 tcp 10.0.2.105 53454 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:00:51.997471 0.000000 tcp 10.0.2.105 53454 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:00:57.986697 0.059242 tcp 10.0.2.105 53455 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:58.046273 0.065963 tcp 10.0.2.105 53456 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:58.112582 0.155185 tcp 10.0.2.105 53457 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:00:58.565933 2.995103 tcp 10.0.2.105 53458 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:07.559953 0.000000 tcp 10.0.2.105 53458 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:13.558883 0.058901 tcp 10.0.2.105 53459 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:13.618080 0.061733 tcp 10.0.2.105 53460 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:13.680080 0.157216 tcp 10.0.2.105 53461 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:13.922049 3.001076 tcp 10.0.2.105 53462 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:22.922539 0.000000 tcp 10.0.2.105 53462 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:28.921186 0.059486 tcp 10.0.2.105 53463 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:28.981107 0.062506 tcp 10.0.2.105 53464 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:29.043929 0.150805 tcp 10.0.2.105 53465 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:29.463351 3.002273 tcp 10.0.2.105 53466 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:38.464117 0.000000 tcp 10.0.2.105 53466 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:44.464015 0.058751 tcp 10.0.2.105 53467 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:44.523045 0.069585 tcp 10.0.2.105 53468 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:44.592652 0.154298 tcp 10.0.2.105 53469 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:01:44.915316 2.992262 tcp 10.0.2.105 53470 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:46.419082 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:01:53.425478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:01:53.916419 0.000000 tcp 10.0.2.105 53470 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:01:59.915276 2.994049 tcp 10.0.2.105 53471 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:01.427198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:02:08.907955 0.000000 tcp 10.0.2.105 53471 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:13.864990 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:02:14.916387 2.994097 tcp 10.0.2.105 53472 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:17.430199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:02:23.910107 0.000000 tcp 10.0.2.105 53472 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:29.918491 3.004130 tcp 10.0.2.105 53473 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:37.869378 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:02:38.921318 0.000000 tcp 10.0.2.105 53473 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:44.920143 3.003842 tcp 10.0.2.105 53474 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:02:49.436535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:02:53.922641 0.000000 tcp 10.0.2.105 53474 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:07:59.923500 0.000236 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:07:59.923883 3.003002 tcp 10.0.2.105 53475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:08.925426 0.000000 tcp 10.0.2.105 53475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:14.926054 0.060714 tcp 10.0.2.105 53476 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:14.987099 0.062339 tcp 10.0.2.105 53477 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:15.049714 0.246560 tcp 10.0.2.105 53478 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:15.630265 2.999222 tcp 10.0.2.105 53479 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:24.628583 0.000000 tcp 10.0.2.105 53479 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:30.627663 0.059657 tcp 10.0.2.105 53480 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:30.687649 0.061515 tcp 10.0.2.105 53481 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:30.749469 0.154634 tcp 10.0.2.105 53482 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:31.464534 2.998251 tcp 10.0.2.105 53483 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:40.460860 0.000000 tcp 10.0.2.105 53483 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:46.460453 0.059459 tcp 10.0.2.105 53484 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:46.520283 0.069308 tcp 10.0.2.105 53485 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:46.589077 0.160200 tcp 10.0.2.105 53486 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:08:46.782789 3.001366 tcp 10.0.2.105 53487 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:08:53.443646 3.000287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:08:55.782877 0.000000 tcp 10.0.2.105 53487 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:00.449824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:09:01.782285 0.059189 tcp 10.0.2.105 53488 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:01.841857 0.065288 tcp 10.0.2.105 53489 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:01.907056 0.156659 tcp 10.0.2.105 53490 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:02.090460 3.005566 tcp 10.0.2.105 53491 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:08.451556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:09:11.095021 0.000000 tcp 10.0.2.105 53491 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:17.084559 0.059199 tcp 10.0.2.105 53492 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:17.144058 0.061163 tcp 10.0.2.105 53493 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:17.205537 0.152001 tcp 10.0.2.105 53494 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:09:17.571462 2.997165 tcp 10.0.2.105 53495 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:24.454484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:09:26.577402 0.000000 tcp 10.0.2.105 53495 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:32.566230 2.993876 tcp 10.0.2.105 53496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:41.558883 0.000000 tcp 10.0.2.105 53496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:46.365768 0.000189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:09:47.567484 3.004404 tcp 10.0.2.105 53497 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:09:56.460111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:09:56.570201 0.000000 tcp 10.0.2.105 53497 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:10:02.569128 3.005989 tcp 10.0.2.105 53498 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:10:10.370051 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:10:11.571957 0.000000 tcp 10.0.2.105 53498 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:10:17.570635 3.004236 tcp 10.0.2.105 53499 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:10:26.574869 0.000000 tcp 10.0.2.105 53499 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:14:39.757749 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:14:39.757860 0.109918 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:39.847481 0.173239 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:40.013262 0.222189 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:40.227781 0.061990 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:40.442008 0.238988 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:40.658466 0.077149 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:40.829663 0.193637 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:41.014627 0.090319 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:41.177420 0.167572 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:41.602634 0.150177 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:41.738695 0.194949 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:41.977868 0.112334 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:42.050376 0.288498 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:42.868491 0.081182 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:43.617924 0.175451 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:43.790084 0.171721 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:43.982598 0.177998 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:44.130483 0.216971 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:44.351230 0.127269 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:44.437015 0.095087 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:46.196007 0.037552 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:46.306379 0.314420 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:46.703955 0.161439 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:46.851503 0.171754 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:47.033147 0.214008 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:14:47.239841 0.235273 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:15:32.573883 2.993774 tcp 10.0.2.105 53500 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:15:37.371601 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:15:41.576618 0.000000 tcp 10.0.2.105 53500 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:15:47.577000 0.060114 tcp 10.0.2.105 53501 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:15:47.637458 0.065602 tcp 10.0.2.105 53502 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:15:47.702936 0.156020 tcp 10.0.2.105 53503 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:15:47.899113 2.990941 tcp 10.0.2.105 53504 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:15:56.888458 0.000000 tcp 10.0.2.105 53504 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:00.466516 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:16:02.897880 0.058782 tcp 10.0.2.105 53505 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:02.956976 0.062778 tcp 10.0.2.105 53506 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:03.019532 0.158911 tcp 10.0.2.105 53507 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:03.278000 3.004039 tcp 10.0.2.105 53508 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:07.474674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:16:12.280458 0.000000 tcp 10.0.2.105 53508 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:15.475540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:16:18.280116 0.058961 tcp 10.0.2.105 53509 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:18.339722 0.064585 tcp 10.0.2.105 53510 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:18.404165 0.154550 tcp 10.0.2.105 53511 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:18.913666 3.625308 tcp 10.0.2.105 53512 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:28.468450 0.000000 tcp 10.0.2.105 53512 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:31.994796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:16:34.407459 0.059347 tcp 10.0.2.105 53513 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:34.467167 0.063668 tcp 10.0.2.105 53514 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:34.530701 0.159713 tcp 10.0.2.105 53515 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:35.314371 2.972587 tcp 10.0.2.105 53516 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:44.224807 0.000000 tcp 10.0.2.105 53516 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:16:50.134866 0.058779 tcp 10.0.2.105 53517 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:50.193401 0.065799 tcp 10.0.2.105 53518 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:50.258995 0.156758 tcp 10.0.2.105 53519 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:16:50.910828 2.953922 tcp 10.0.2.105 53520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:00.218692 0.000000 tcp 10.0.2.105 53520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:04.048134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:17:06.156500 2.961252 tcp 10.0.2.105 53521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:15.048292 0.000000 tcp 10.0.2.105 53521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:19.749940 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:17:20.986843 2.964174 tcp 10.0.2.105 53522 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:29.873580 0.000000 tcp 10.0.2.105 53522 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:35.806097 2.972292 tcp 10.0.2.105 53523 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:43.454434 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:17:44.705320 0.000000 tcp 10.0.2.105 53523 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:50.628627 2.998452 tcp 10.0.2.105 53524 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:17:59.624919 0.000000 tcp 10.0.2.105 53524 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:05.625300 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:23:05.625398 2.994670 tcp 10.0.2.105 53525 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:07.490303 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:23:14.497752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:23:14.617643 0.000000 tcp 10.0.2.105 53525 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:20.628271 0.059764 tcp 10.0.2.105 53526 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:20.688380 0.068340 tcp 10.0.2.105 53527 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:20.757078 0.161285 tcp 10.0.2.105 53528 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:20.936760 2.994442 tcp 10.0.2.105 53529 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:22.499223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:23:29.929603 0.000000 tcp 10.0.2.105 53529 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:35.928857 0.059952 tcp 10.0.2.105 53530 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:35.988649 0.065134 tcp 10.0.2.105 53531 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:36.054114 0.160535 tcp 10.0.2.105 53532 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:36.471154 3.002456 tcp 10.0.2.105 53533 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:38.502142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:23:45.472081 0.000000 tcp 10.0.2.105 53533 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:23:51.471092 0.059166 tcp 10.0.2.105 53534 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:51.530566 0.061369 tcp 10.0.2.105 53535 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:51.592384 0.160075 tcp 10.0.2.105 53536 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:23:51.782344 3.003036 tcp 10.0.2.105 53537 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:00.783756 0.000000 tcp 10.0.2.105 53537 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:06.784023 0.058431 tcp 10.0.2.105 53538 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:06.842770 0.062842 tcp 10.0.2.105 53539 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:06.905993 0.156847 tcp 10.0.2.105 53540 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:07.219354 2.998326 tcp 10.0.2.105 53541 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:10.508189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:24:16.226524 0.000000 tcp 10.0.2.105 53541 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:22.215834 0.058772 tcp 10.0.2.105 53542 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:22.274940 0.060559 tcp 10.0.2.105 53543 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:22.335814 0.151833 tcp 10.0.2.105 53544 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:24:22.696046 2.994443 tcp 10.0.2.105 53545 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:31.688733 0.000000 tcp 10.0.2.105 53545 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:37.697412 3.004291 tcp 10.0.2.105 53546 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:46.700061 0.000000 tcp 10.0.2.105 53546 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:24:51.366454 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:24:52.699169 3.003800 tcp 10.0.2.105 53547 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:25:01.701604 0.000000 tcp 10.0.2.105 53547 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:25:07.701029 3.003688 tcp 10.0.2.105 53548 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:25:15.361619 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:25:16.703231 0.000000 tcp 10.0.2.105 53548 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:25:22.702118 3.003908 tcp 10.0.2.105 53549 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:25:31.704857 0.000000 tcp 10.0.2.105 53549 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:30:14.514355 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:30:21.521782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:30:29.522804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:30:37.705494 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:30:37.705615 2.993687 tcp 10.0.2.105 53550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:30:45.526148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:30:46.697751 0.000000 tcp 10.0.2.105 53550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:30:52.708510 0.059929 tcp 10.0.2.105 53551 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:30:52.768696 0.063530 tcp 10.0.2.105 53552 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:30:52.832095 0.157503 tcp 10.0.2.105 53553 -> 195.113.214.251 443 SRPA* 0 0 41 33160 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:30:53.127374 3.004024 tcp 10.0.2.105 53554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:02.129572 0.000000 tcp 10.0.2.105 53554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:08.130052 0.060190 tcp 10.0.2.105 53555 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:08.190575 0.061464 tcp 10.0.2.105 53556 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:08.252378 0.163297 tcp 10.0.2.105 53557 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:08.540730 3.002510 tcp 10.0.2.105 53558 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:17.532242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:31:17.542092 0.000000 tcp 10.0.2.105 53558 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:23.541363 0.072997 tcp 10.0.2.105 53559 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:23.614657 0.066418 tcp 10.0.2.105 53560 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:23.681408 0.496319 tcp 10.0.2.105 53561 -> 195.113.214.251 443 SRPA* 0 0 87 70456 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:24.252671 3.003113 tcp 10.0.2.105 53562 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:33.254773 0.000000 tcp 10.0.2.105 53562 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:39.254060 0.060222 tcp 10.0.2.105 53563 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:39.314603 0.062195 tcp 10.0.2.105 53564 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:39.376663 0.153749 tcp 10.0.2.105 53565 -> 195.113.214.251 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:39.993979 2.994801 tcp 10.0.2.105 53566 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:48.997356 0.000000 tcp 10.0.2.105 53566 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:31:54.986628 0.058473 tcp 10.0.2.105 53567 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:55.045466 0.066569 tcp 10.0.2.105 53568 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:55.112427 0.152354 tcp 10.0.2.105 53569 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:31:55.338732 2.991480 tcp 10.0.2.105 53570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:04.329379 0.000000 tcp 10.0.2.105 53570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:10.720597 2.974832 tcp 10.0.2.105 53571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:19.635205 0.000000 tcp 10.0.2.105 53571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:24.122651 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:32:25.581002 2.979103 tcp 10.0.2.105 53572 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:34.504734 0.000000 tcp 10.0.2.105 53572 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:40.446193 3.939655 tcp 10.0.2.105 53573 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:48.841204 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:32:50.308439 0.000000 tcp 10.0.2.105 53573 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:32:56.242500 2.971378 tcp 10.0.2.105 53574 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:33:05.149044 0.000000 tcp 10.0.2.105 53574 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:37:21.539038 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:37:28.545522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:37:36.547043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:37:52.550040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:38:10.356177 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:38:10.356411 2.993512 tcp 10.0.2.105 53575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:19.348593 0.000000 tcp 10.0.2.105 53575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:24.556018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:38:25.359125 0.060008 tcp 10.0.2.105 53576 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:25.419463 0.062756 tcp 10.0.2.105 53577 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:25.482059 0.156076 tcp 10.0.2.105 53578 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:25.778297 3.003822 tcp 10.0.2.105 53579 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:34.780189 0.000000 tcp 10.0.2.105 53579 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:40.779522 0.059582 tcp 10.0.2.105 53580 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:40.839407 0.062801 tcp 10.0.2.105 53581 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:40.902477 0.151120 tcp 10.0.2.105 53582 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:41.278435 3.008038 tcp 10.0.2.105 53583 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:50.286916 0.000000 tcp 10.0.2.105 53583 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:38:56.272542 0.058314 tcp 10.0.2.105 53584 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:56.331163 0.066928 tcp 10.0.2.105 53585 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:56.397924 0.156269 tcp 10.0.2.105 53586 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:38:56.831094 3.005755 tcp 10.0.2.105 53587 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:05.835269 0.000000 tcp 10.0.2.105 53587 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:11.824819 0.058957 tcp 10.0.2.105 53588 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:11.884103 0.062063 tcp 10.0.2.105 53589 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:11.946448 0.159956 tcp 10.0.2.105 53590 -> 195.113.214.251 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:12.390996 2.998352 tcp 10.0.2.105 53591 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:21.387826 0.000000 tcp 10.0.2.105 53591 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:27.387416 0.057945 tcp 10.0.2.105 53592 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:27.445685 0.065297 tcp 10.0.2.105 53593 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:27.511310 0.157283 tcp 10.0.2.105 53594 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:39:27.795136 2.995949 tcp 10.0.2.105 53595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:36.789770 0.000000 tcp 10.0.2.105 53595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:42.788395 3.005156 tcp 10.0.2.105 53596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:51.791268 0.000000 tcp 10.0.2.105 53596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:39:56.368924 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:39:57.790086 3.004130 tcp 10.0.2.105 53597 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:40:06.793090 0.000000 tcp 10.0.2.105 53597 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:40:12.794970 3.001058 tcp 10.0.2.105 53598 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:40:20.362751 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:40:21.794932 0.000000 tcp 10.0.2.105 53598 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:40:27.793465 2.993708 tcp 10.0.2.105 53599 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:40:36.796512 0.000000 tcp 10.0.2.105 53599 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:44:28.562071 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:44:35.569602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:44:43.570956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:44:59.574303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:45:16.629075 0.000203 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:45:16.629389 0.230058 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:16.851627 0.123298 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 3 915 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:17.108584 0.174278 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:17.275218 0.060440 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:17.344972 0.249349 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:17.571288 0.076377 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:17.631001 0.174247 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.047702 0.086434 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.099355 0.198306 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.292045 0.113263 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.486825 0.170298 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.693511 0.156007 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:18.830206 0.278314 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:19.412343 0.091055 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:19.479888 0.175959 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:19.772357 0.171672 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:19.919248 0.174284 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.178859 0.171482 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.290567 0.130150 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.437140 0.103347 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.524678 0.037984 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.661483 0.315444 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:20.993552 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 17:45:31.582690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:45:39.603495 0.060441 tcp 10.0.2.105 53600 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:39.664407 0.066059 tcp 10.0.2.105 53601 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:39.730742 0.153369 tcp 10.0.2.105 53602 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:39.884677 0.173180 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:40.075502 0.217155 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:40.284974 0.225302 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/07 17:45:42.796582 2.993252 tcp 10.0.2.105 53603 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:45:51.788690 0.000000 tcp 10.0.2.105 53603 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:45:57.798375 0.058179 tcp 10.0.2.105 53604 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:57.856891 0.061126 tcp 10.0.2.105 53605 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:57.918356 0.153360 tcp 10.0.2.105 53606 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:45:58.419141 3.004038 tcp 10.0.2.105 53607 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:07.621671 0.000000 tcp 10.0.2.105 53607 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:13.564022 0.058844 tcp 10.0.2.105 53608 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:13.623143 0.065739 tcp 10.0.2.105 53609 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:13.689190 0.157525 tcp 10.0.2.105 53610 -> 195.113.214.251 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:13.907474 2.970562 tcp 10.0.2.105 53611 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:22.815508 0.000000 tcp 10.0.2.105 53611 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:28.762831 0.057496 tcp 10.0.2.105 53612 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:28.820662 0.061771 tcp 10.0.2.105 53613 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:28.882725 0.156531 tcp 10.0.2.105 53614 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:29.813236 2.994799 tcp 10.0.2.105 53615 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:38.816188 0.000000 tcp 10.0.2.105 53615 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:44.805851 0.037167 tcp 10.0.2.105 53616 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:44.843334 0.064788 tcp 10.0.2.105 53617 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:44.908582 0.185601 tcp 10.0.2.105 53618 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:46:45.272466 2.997823 tcp 10.0.2.105 53619 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:46:54.270585 0.000000 tcp 10.0.2.105 53619 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:00.269826 0.058232 tcp 10.0.2.105 53620 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:47:00.328558 0.061115 tcp 10.0.2.105 53621 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:47:00.389980 0.151137 tcp 10.0.2.105 53622 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:47:00.722724 2.999778 tcp 10.0.2.105 53623 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:09.721251 0.000000 tcp 10.0.2.105 53623 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:15.720152 3.004026 tcp 10.0.2.105 53624 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:24.722713 0.000000 tcp 10.0.2.105 53624 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:29.369493 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:47:30.723206 3.002247 tcp 10.0.2.105 53625 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:39.724802 0.000000 tcp 10.0.2.105 53625 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:45.723344 2.993683 tcp 10.0.2.105 53626 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:47:53.363884 0.000157 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:47:54.725426 0.000000 tcp 10.0.2.105 53626 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:48:00.724161 2.994732 tcp 10.0.2.105 53627 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:48:09.717410 0.000000 tcp 10.0.2.105 53627 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:15.728118 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:53:15.728237 3.003505 tcp 10.0.2.105 53628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:24.730080 0.000000 tcp 10.0.2.105 53628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:30.730505 0.031334 tcp 10.0.2.105 53629 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:30.762167 0.062490 tcp 10.0.2.105 53630 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:30.824921 0.156612 tcp 10.0.2.105 53631 -> 195.113.214.251 443 SRPA* 0 0 39 18440 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:31.011271 3.002232 tcp 10.0.2.105 53632 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:40.012617 0.000000 tcp 10.0.2.105 53632 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:46.011683 0.030960 tcp 10.0.2.105 53633 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:46.042928 0.065814 tcp 10.0.2.105 53634 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:46.108584 0.157519 tcp 10.0.2.105 53635 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:53:46.293706 3.001893 tcp 10.0.2.105 53636 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:53:55.294260 0.000000 tcp 10.0.2.105 53636 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:01.293475 0.032144 tcp 10.0.2.105 53637 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:01.325505 0.062999 tcp 10.0.2.105 53638 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:01.388873 0.155281 tcp 10.0.2.105 53639 -> 195.113.214.251 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:01.566182 3.001168 tcp 10.0.2.105 53640 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:10.575945 0.000000 tcp 10.0.2.105 53640 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:16.566598 0.030564 tcp 10.0.2.105 53641 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:16.597453 0.065312 tcp 10.0.2.105 53642 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:16.663107 0.151825 tcp 10.0.2.105 53643 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:16.916377 2.993037 tcp 10.0.2.105 53644 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:25.908470 0.000000 tcp 10.0.2.105 53644 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:31.917579 0.031601 tcp 10.0.2.105 53645 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:31.949111 0.065159 tcp 10.0.2.105 53646 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:32.014587 0.158479 tcp 10.0.2.105 53647 -> 195.113.214.251 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/02/07 17:54:32.321627 3.000297 tcp 10.0.2.105 53648 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:41.320624 0.000000 tcp 10.0.2.105 53648 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:45.589045 3.002577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 17:54:47.319337 3.004164 tcp 10.0.2.105 53649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:54:52.596362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:54:56.322009 0.000000 tcp 10.0.2.105 53649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:00.598743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:55:00.868145 0.000223 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:55:02.320900 3.003930 tcp 10.0.2.105 53650 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:11.323433 0.000000 tcp 10.0.2.105 53650 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:16.601162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 17:55:17.322244 3.003768 tcp 10.0.2.105 53651 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:24.862848 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 17:55:26.324825 0.000000 tcp 10.0.2.105 53651 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:32.324159 2.993885 tcp 10.0.2.105 53652 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:41.326173 0.000000 tcp 10.0.2.105 53652 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 17:55:48.607318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:00:47.327297 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:00:47.327473 3.003189 tcp 10.0.2.105 53653 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:00:56.329277 0.000000 tcp 10.0.2.105 53653 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:02.330008 0.032308 tcp 10.0.2.105 53654 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:02.362645 0.062594 tcp 10.0.2.105 53655 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:02.425530 0.153264 tcp 10.0.2.105 53656 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:02.798624 3.004673 tcp 10.0.2.105 53657 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:11.801909 0.000000 tcp 10.0.2.105 53657 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:17.801119 0.031393 tcp 10.0.2.105 53658 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:17.832824 0.066461 tcp 10.0.2.105 53659 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:17.899111 0.152461 tcp 10.0.2.105 53660 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:18.189803 3.005364 tcp 10.0.2.105 53661 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:27.193871 0.000000 tcp 10.0.2.105 53661 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:33.183608 0.030565 tcp 10.0.2.105 53662 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:33.214475 0.064790 tcp 10.0.2.105 53663 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:33.279573 0.161048 tcp 10.0.2.105 53664 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:33.511592 2.995899 tcp 10.0.2.105 53665 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:42.515922 0.000000 tcp 10.0.2.105 53665 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:48.504771 0.030972 tcp 10.0.2.105 53666 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:48.536089 0.063437 tcp 10.0.2.105 53667 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:48.599364 0.156103 tcp 10.0.2.105 53668 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:01:48.796504 2.992521 tcp 10.0.2.105 53669 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:52.614219 3.000654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:01:57.787853 0.000000 tcp 10.0.2.105 53669 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:01:59.620673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:02:03.797307 0.030304 tcp 10.0.2.105 53670 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:02:03.827939 0.061911 tcp 10.0.2.105 53671 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:02:03.889690 0.160480 tcp 10.0.2.105 53672 -> 195.113.214.251 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:02:04.072725 2.998618 tcp 10.0.2.105 53673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:07.622513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:02:13.069942 0.000000 tcp 10.0.2.105 53673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:19.068445 3.004579 tcp 10.0.2.105 53674 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:23.627889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:02:28.071546 0.000000 tcp 10.0.2.105 53674 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:32.868507 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:02:34.070279 3.004023 tcp 10.0.2.105 53675 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:43.073552 0.000000 tcp 10.0.2.105 53675 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:49.071913 3.004256 tcp 10.0.2.105 53676 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:02:55.631379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:02:56.862975 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:02:58.074728 0.000000 tcp 10.0.2.105 53676 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:03:04.073409 2.994140 tcp 10.0.2.105 53677 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:03:13.076086 0.000000 tcp 10.0.2.105 53677 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:19.081690 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:08:19.081780 2.991349 tcp 10.0.2.105 53678 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:28.069664 0.000000 tcp 10.0.2.105 53678 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:34.083417 0.033747 tcp 10.0.2.105 53679 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:34.117532 0.069613 tcp 10.0.2.105 53680 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:34.185276 0.160075 tcp 10.0.2.105 53681 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:34.489053 2.994493 tcp 10.0.2.105 53682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:43.483435 0.000000 tcp 10.0.2.105 53682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:49.480906 0.030657 tcp 10.0.2.105 53683 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:49.511939 0.065501 tcp 10.0.2.105 53684 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:49.577741 0.156640 tcp 10.0.2.105 53685 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:08:49.748118 2.996769 tcp 10.0.2.105 53686 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:08:59.188669 0.000000 tcp 10.0.2.105 53686 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:00.078889 2.981571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:09:05.144336 0.031041 tcp 10.0.2.105 53687 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:05.175197 0.066167 tcp 10.0.2.105 53688 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:05.241684 0.157975 tcp 10.0.2.105 53689 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:05.411405 2.986368 tcp 10.0.2.105 53690 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:07.035574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:09:14.351055 0.000000 tcp 10.0.2.105 53690 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:14.980174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:09:20.296610 0.030780 tcp 10.0.2.105 53691 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:20.327657 0.061081 tcp 10.0.2.105 53692 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:20.389052 0.155957 tcp 10.0.2.105 53693 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:20.577994 2.986355 tcp 10.0.2.105 53694 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:29.534499 0.000000 tcp 10.0.2.105 53694 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:30.876374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:09:35.481898 0.031730 tcp 10.0.2.105 53695 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:35.513913 0.062245 tcp 10.0.2.105 53696 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:35.575989 0.147561 tcp 10.0.2.105 53697 -> 195.113.214.251 443 SRPA* 0 0 27 11666 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:09:35.850389 2.985471 tcp 10.0.2.105 53698 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:44.781177 0.000000 tcp 10.0.2.105 53698 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:50.729276 2.982919 tcp 10.0.2.105 53699 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:09:59.664747 0.000000 tcp 10.0.2.105 53699 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:02.671804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:10:04.528493 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:10:05.809450 2.989105 tcp 10.0.2.105 53700 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:14.762678 0.000000 tcp 10.0.2.105 53700 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:20.714362 2.990004 tcp 10.0.2.105 53701 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:28.374234 0.000201 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:10:29.668003 0.000000 tcp 10.0.2.105 53701 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:35.669461 3.001027 tcp 10.0.2.105 53702 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:10:44.668922 0.000000 tcp 10.0.2.105 53702 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:16:06.680045 2.994668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:16:07.599182 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:16:07.599301 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 18:16:13.682536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:16:21.681690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:16:25.337468 0.031816 tcp 10.0.2.105 53703 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:25.369586 0.060787 tcp 10.0.2.105 53704 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:25.430684 0.200773 tcp 10.0.2.105 53705 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:25.632162 0.174420 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:25.800313 0.230777 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:26.266397 0.099893 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:26.490293 0.074693 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:26.549296 0.173793 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:26.901492 0.101148 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:26.960507 0.204912 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:27.164852 0.060936 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:27.680564 0.241943 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2549 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:27.897277 0.172130 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:28.076174 0.700900 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:29.514810 0.287999 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:29.839132 0.114346 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:29.913120 0.173893 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:30.061548 0.160843 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:30.628966 0.176488 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:30.815461 0.092253 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:30.885516 0.173149 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:31.034566 0.036122 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:31.205351 0.000000 udp 10.0.2.105 7010 -> 221.151.128.165 2676 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 18:16:35.674957 3.343376 tcp 10.0.2.105 53706 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:16:37.683038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:16:44.967501 0.000000 tcp 10.0.2.105 53706 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:16:49.194382 0.031455 tcp 10.0.2.105 53707 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:49.226155 0.062458 tcp 10.0.2.105 53708 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:49.288477 0.155328 tcp 10.0.2.105 53709 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:49.444579 0.138203 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:49.531358 0.096419 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:50.934491 0.030348 tcp 10.0.2.105 53710 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:50.965164 0.061730 tcp 10.0.2.105 53711 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:51.027185 0.158770 tcp 10.0.2.105 53712 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:16:52.162298 2.967254 tcp 10.0.2.105 53713 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:16:52.174854 0.171680 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:52.582229 0.235223 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:16:52.887822 0.226112 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:17:01.092822 0.000000 tcp 10.0.2.105 53713 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:07.060621 0.030227 tcp 10.0.2.105 53714 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:07.091130 0.062306 tcp 10.0.2.105 53715 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:07.153707 0.155231 tcp 10.0.2.105 53716 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:07.754773 2.967730 tcp 10.0.2.105 53717 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:09.830529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:17:16.677097 0.000000 tcp 10.0.2.105 53717 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:22.635794 0.032576 tcp 10.0.2.105 53718 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:22.668683 0.061576 tcp 10.0.2.105 53719 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:22.730581 0.160583 tcp 10.0.2.105 53720 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:23.166989 2.975456 tcp 10.0.2.105 53721 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:32.130872 0.000000 tcp 10.0.2.105 53721 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:38.132761 0.030186 tcp 10.0.2.105 53722 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:38.163311 0.061299 tcp 10.0.2.105 53723 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:38.224596 0.154930 tcp 10.0.2.105 53724 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:17:38.793374 3.001900 tcp 10.0.2.105 53725 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:47.801683 0.000000 tcp 10.0.2.105 53725 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:17:53.792689 3.004272 tcp 10.0.2.105 53726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:18:02.798659 0.000000 tcp 10.0.2.105 53726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:18:07.364925 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:18:08.796436 2.992535 tcp 10.0.2.105 53727 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:18:17.798598 0.000000 tcp 10.0.2.105 53727 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:18:23.800654 2.989849 tcp 10.0.2.105 53728 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:18:31.366599 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:18:32.788771 0.000000 tcp 10.0.2.105 53728 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:23:13.706060 3.131782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:23:20.813040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:23:28.769567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:23:38.799333 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:23:38.799456 3.016853 tcp 10.0.2.105 53729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:23:44.731589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:23:47.802077 0.000000 tcp 10.0.2.105 53729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:23:53.862149 0.031211 tcp 10.0.2.105 53730 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:23:53.893731 0.062146 tcp 10.0.2.105 53731 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:23:53.956188 0.163557 tcp 10.0.2.105 53732 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:23:54.223377 2.981666 tcp 10.0.2.105 53733 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:03.167213 0.000000 tcp 10.0.2.105 53733 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:09.174193 0.032065 tcp 10.0.2.105 53734 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:09.205987 0.062938 tcp 10.0.2.105 53735 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:09.269317 0.151380 tcp 10.0.2.105 53736 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:09.654117 2.996069 tcp 10.0.2.105 53737 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:16.738800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:24:18.659825 0.000000 tcp 10.0.2.105 53737 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:24.637766 0.031225 tcp 10.0.2.105 53738 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:24.669213 0.061693 tcp 10.0.2.105 53739 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:24.731239 0.155065 tcp 10.0.2.105 53740 -> 195.113.214.251 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:25.074712 2.995184 tcp 10.0.2.105 53741 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:34.070831 0.000000 tcp 10.0.2.105 53741 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:40.070011 0.031278 tcp 10.0.2.105 53742 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:40.101670 0.064077 tcp 10.0.2.105 53743 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:40.165500 0.160277 tcp 10.0.2.105 53744 -> 195.113.214.251 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:40.338268 2.993688 tcp 10.0.2.105 53745 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:49.329648 0.000000 tcp 10.0.2.105 53745 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:24:55.329472 0.032100 tcp 10.0.2.105 53746 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:55.361272 0.063075 tcp 10.0.2.105 53747 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:55.424650 0.165006 tcp 10.0.2.105 53748 -> 195.113.214.251 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:24:55.631134 3.007743 tcp 10.0.2.105 53749 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:04.632795 0.000000 tcp 10.0.2.105 53749 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:10.633345 3.012731 tcp 10.0.2.105 53750 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:19.638429 0.000000 tcp 10.0.2.105 53750 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:24.371713 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:25:25.647292 2.992692 tcp 10.0.2.105 53751 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:35.410283 0.000000 tcp 10.0.2.105 53751 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:41.353635 2.970700 tcp 10.0.2.105 53752 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:49.010514 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:25:50.268527 0.000000 tcp 10.0.2.105 53752 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:25:56.203012 2.961497 tcp 10.0.2.105 53753 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:26:05.102820 0.000000 tcp 10.0.2.105 53753 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:30:20.739468 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:30:27.747352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:30:35.753551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:30:51.751200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:31:10.639982 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:31:10.640094 3.002311 tcp 10.0.2.105 53754 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:19.641085 0.000000 tcp 10.0.2.105 53754 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:23.771142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:31:25.652137 0.031501 tcp 10.0.2.105 53755 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:25.683931 0.063842 tcp 10.0.2.105 53756 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:25.748069 0.154503 tcp 10.0.2.105 53757 -> 195.113.214.251 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:26.211414 3.004232 tcp 10.0.2.105 53758 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:35.206017 0.000000 tcp 10.0.2.105 53758 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:41.204503 0.845036 tcp 10.0.2.105 53759 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:42.049375 0.062582 tcp 10.0.2.105 53760 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:42.111806 0.156592 tcp 10.0.2.105 53761 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:42.289090 3.005130 tcp 10.0.2.105 53762 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:51.296794 0.000000 tcp 10.0.2.105 53762 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:31:57.285756 0.031365 tcp 10.0.2.105 53763 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:57.317352 0.062666 tcp 10.0.2.105 53764 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:57.380227 0.160994 tcp 10.0.2.105 53765 -> 195.113.214.251 443 SRPA* 0 0 32 16824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:31:58.027236 3.007168 tcp 10.0.2.105 53766 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:07.030452 0.000000 tcp 10.0.2.105 53766 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:13.028825 0.030873 tcp 10.0.2.105 53767 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:13.060018 0.065086 tcp 10.0.2.105 53768 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:13.125464 0.152604 tcp 10.0.2.105 53769 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:13.313681 3.002313 tcp 10.0.2.105 53770 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:22.313151 0.000000 tcp 10.0.2.105 53770 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:28.313144 0.030692 tcp 10.0.2.105 53771 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:28.344177 0.065252 tcp 10.0.2.105 53772 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:28.409201 0.151644 tcp 10.0.2.105 53773 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:32:28.635078 3.009810 tcp 10.0.2.105 53774 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:37.634870 0.000000 tcp 10.0.2.105 53774 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:43.633158 3.007200 tcp 10.0.2.105 53775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:52.636687 0.000000 tcp 10.0.2.105 53775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:32:57.361567 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:32:58.640694 2.990551 tcp 10.0.2.105 53776 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:33:07.639511 0.000000 tcp 10.0.2.105 53776 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:33:13.640794 2.988903 tcp 10.0.2.105 53777 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:33:21.367474 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:33:22.628004 0.000000 tcp 10.0.2.105 53777 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:33:28.644526 2.988832 tcp 10.0.2.105 53778 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:33:37.629652 0.000000 tcp 10.0.2.105 53778 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:37:27.764848 3.000106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:37:34.773423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:37:42.774565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:37:58.774948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:38:30.781187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:38:43.640093 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:38:43.640237 3.005453 tcp 10.0.2.105 53779 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:38:52.924160 0.000000 tcp 10.0.2.105 53779 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:38:58.875282 0.032697 tcp 10.0.2.105 53780 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:38:58.907912 0.061874 tcp 10.0.2.105 53781 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:38:58.969559 0.155184 tcp 10.0.2.105 53782 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:38:59.369813 2.991218 tcp 10.0.2.105 53783 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:08.306509 0.000000 tcp 10.0.2.105 53783 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:14.257184 0.031250 tcp 10.0.2.105 53784 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:14.288755 0.061768 tcp 10.0.2.105 53785 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:14.350810 0.156529 tcp 10.0.2.105 53786 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:14.604900 2.976089 tcp 10.0.2.105 53787 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:23.549862 0.000000 tcp 10.0.2.105 53787 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:29.498076 0.031280 tcp 10.0.2.105 53788 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:29.529722 0.059559 tcp 10.0.2.105 53789 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:29.589593 0.153818 tcp 10.0.2.105 53790 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:30.050768 2.992438 tcp 10.0.2.105 53791 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:39.044015 0.000000 tcp 10.0.2.105 53791 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:45.038969 0.031461 tcp 10.0.2.105 53792 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:45.070273 0.062627 tcp 10.0.2.105 53793 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:45.133293 0.155964 tcp 10.0.2.105 53794 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:39:45.391030 3.005622 tcp 10.0.2.105 53795 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:39:54.391164 0.000000 tcp 10.0.2.105 53795 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:00.390553 0.031368 tcp 10.0.2.105 53796 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:40:00.422222 0.074980 tcp 10.0.2.105 53797 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:40:00.497521 0.175054 tcp 10.0.2.105 53798 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:40:00.948204 3.008998 tcp 10.0.2.105 53799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:09.953765 0.000000 tcp 10.0.2.105 53799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:15.946867 3.000731 tcp 10.0.2.105 53800 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:24.944999 0.000000 tcp 10.0.2.105 53800 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:29.862896 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:40:30.943855 2.994209 tcp 10.0.2.105 53801 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:39.946777 0.000000 tcp 10.0.2.105 53801 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:45.945428 2.994414 tcp 10.0.2.105 53802 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:40:53.866179 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:40:54.937699 0.000000 tcp 10.0.2.105 53802 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:41:00.946958 3.004817 tcp 10.0.2.105 53803 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:41:09.952424 0.000000 tcp 10.0.2.105 53803 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:44:34.786629 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:44:41.794445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:44:49.795767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:45:05.798859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:45:37.804984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:46:15.953913 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:46:15.954200 3.000042 tcp 10.0.2.105 53804 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:46:24.952906 0.000000 tcp 10.0.2.105 53804 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:46:30.953549 0.031821 tcp 10.0.2.105 53805 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:30.985716 0.064087 tcp 10.0.2.105 53806 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:31.050067 0.156431 tcp 10.0.2.105 53807 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:34.728120 3.003029 tcp 10.0.2.105 53808 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:46:43.729540 0.000000 tcp 10.0.2.105 53808 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:46:49.730437 0.031003 tcp 10.0.2.105 53809 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:49.761745 0.060798 tcp 10.0.2.105 53810 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:49.822836 0.158465 tcp 10.0.2.105 53811 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:46:50.249499 3.007899 tcp 10.0.2.105 53812 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:46:59.252177 0.000000 tcp 10.0.2.105 53812 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:47:05.250379 3.004602 tcp 10.0.2.105 53813 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:47:09.126583 0.312998 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 1875 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:09.730087 0.174473 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:09.897370 0.231961 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.136834 0.173464 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.306765 0.087780 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.416749 0.200954 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.609420 0.098397 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.732474 0.077922 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.792735 0.172513 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:10.940458 0.060998 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:11.114357 0.243108 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:11.328888 0.149697 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:11.553215 0.177202 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:11.702180 0.114933 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:11.825436 0.287414 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.266914 0.172303 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.415405 0.036469 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.503191 0.206296 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.638911 0.177142 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.852858 0.086492 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:12.919129 0.134448 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:13.172156 0.103084 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:13.258689 0.174496 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:13.862415 0.221170 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:13.867737 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:47:14.072805 0.235571 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/07 18:47:14.257395 0.000000 tcp 10.0.2.105 53813 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:52:20.254149 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:52:20.254420 2.996287 tcp 10.0.2.105 53814 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:52:29.256172 0.000000 tcp 10.0.2.105 53814 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:52:35.256795 0.033276 tcp 10.0.2.105 53815 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:35.290419 0.063694 tcp 10.0.2.105 53816 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:35.354419 0.158742 tcp 10.0.2.105 53817 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:35.807647 3.002831 tcp 10.0.2.105 53818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:52:44.808426 0.000000 tcp 10.0.2.105 53818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:52:50.808059 0.031883 tcp 10.0.2.105 53819 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:50.840311 0.062334 tcp 10.0.2.105 53820 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:50.902519 0.158241 tcp 10.0.2.105 53821 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:52:51.256002 2.996596 tcp 10.0.2.105 53822 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:00.253335 0.000000 tcp 10.0.2.105 53822 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:06.250510 0.032061 tcp 10.0.2.105 53823 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:06.282901 0.068224 tcp 10.0.2.105 53824 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:06.350917 0.163522 tcp 10.0.2.105 53825 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:06.600141 3.003960 tcp 10.0.2.105 53826 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:15.603131 0.000000 tcp 10.0.2.105 53826 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:21.602273 0.030806 tcp 10.0.2.105 53827 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:21.633445 0.065791 tcp 10.0.2.105 53828 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:21.699069 0.152248 tcp 10.0.2.105 53829 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:22.085969 3.000966 tcp 10.0.2.105 53830 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:31.086668 0.000000 tcp 10.0.2.105 53830 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:37.085330 0.031490 tcp 10.0.2.105 53831 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:37.117121 0.062078 tcp 10.0.2.105 53832 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:37.179512 0.157303 tcp 10.0.2.105 53833 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 18:53:37.464909 2.994086 tcp 10.0.2.105 53834 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:46.457469 0.000000 tcp 10.0.2.105 53834 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:53:52.466239 2.995655 tcp 10.0.2.105 53835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:01.458825 0.000000 tcp 10.0.2.105 53835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:06.365861 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:54:07.467540 3.004586 tcp 10.0.2.105 53836 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:16.470550 0.000000 tcp 10.0.2.105 53836 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:22.469639 3.008928 tcp 10.0.2.105 53837 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:30.361569 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:54:31.472428 0.000000 tcp 10.0.2.105 53837 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:37.471011 3.004439 tcp 10.0.2.105 53838 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:46.473703 0.000000 tcp 10.0.2.105 53838 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 18:54:49.810826 3.002079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 18:54:56.818220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:55:04.820105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:55:20.823200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:55:52.828896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 18:59:52.474403 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 18:59:52.474661 2.993150 tcp 10.0.2.105 53839 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:01.476757 0.000000 tcp 10.0.2.105 53839 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:07.477568 0.032061 tcp 10.0.2.105 53840 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:07.509931 0.061786 tcp 10.0.2.105 53841 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:07.572039 0.159830 tcp 10.0.2.105 53842 -> 195.113.214.251 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:08.045224 2.995011 tcp 10.0.2.105 53843 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:17.039238 0.000000 tcp 10.0.2.105 53843 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:23.039000 0.386917 tcp 10.0.2.105 53844 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:23.426173 0.064394 tcp 10.0.2.105 53845 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:23.490905 0.157500 tcp 10.0.2.105 53846 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:23.756079 2.975853 tcp 10.0.2.105 53847 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:32.671562 0.000000 tcp 10.0.2.105 53847 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:38.615457 0.030768 tcp 10.0.2.105 53848 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:38.646620 0.062123 tcp 10.0.2.105 53849 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:38.709012 0.154173 tcp 10.0.2.105 53850 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:39.005287 2.981774 tcp 10.0.2.105 53851 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:47.927814 0.000000 tcp 10.0.2.105 53851 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:00:53.858496 0.031292 tcp 10.0.2.105 53852 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:53.890107 0.065979 tcp 10.0.2.105 53853 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:53.956576 0.160089 tcp 10.0.2.105 53854 -> 195.113.214.251 443 SRPA* 0 0 35 18432 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:00:54.184694 2.968860 tcp 10.0.2.105 53855 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:03.135515 0.000000 tcp 10.0.2.105 53855 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:09.134904 0.031350 tcp 10.0.2.105 53856 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:01:09.166563 0.064838 tcp 10.0.2.105 53857 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:01:09.231658 0.158134 tcp 10.0.2.105 53858 -> 195.113.214.251 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:01:09.432399 2.996150 tcp 10.0.2.105 53859 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:18.437403 0.000000 tcp 10.0.2.105 53859 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:24.426037 2.993888 tcp 10.0.2.105 53860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:33.418961 0.000000 tcp 10.0.2.105 53860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:38.366234 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:01:39.427703 3.004204 tcp 10.0.2.105 53861 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:48.429916 0.000000 tcp 10.0.2.105 53861 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:54.429258 3.004026 tcp 10.0.2.105 53862 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:01:56.836511 3.000405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:02:02.360975 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:02:03.431773 0.000000 tcp 10.0.2.105 53862 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:02:03.842782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:02:09.430366 3.004912 tcp 10.0.2.105 53863 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:02:11.844116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:02:18.433616 0.000000 tcp 10.0.2.105 53863 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:02:27.847135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:02:59.853141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:07:24.434613 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:07:24.434919 2.992883 tcp 10.0.2.105 53864 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:07:33.436783 0.000000 tcp 10.0.2.105 53864 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:07:39.437661 0.030996 tcp 10.0.2.105 53865 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:39.468958 0.064894 tcp 10.0.2.105 53866 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:39.533687 0.158445 tcp 10.0.2.105 53867 -> 195.113.214.251 443 SRPA* 0 0 26 13094 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:39.871807 2.998199 tcp 10.0.2.105 53868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:07:48.869065 0.000000 tcp 10.0.2.105 53868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:07:54.867994 0.031084 tcp 10.0.2.105 53869 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:54.898914 0.060562 tcp 10.0.2.105 53870 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:54.959850 0.157723 tcp 10.0.2.105 53871 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:07:55.139855 3.002114 tcp 10.0.2.105 53872 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:04.141076 0.000000 tcp 10.0.2.105 53872 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:10.139952 0.031273 tcp 10.0.2.105 53873 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:10.171526 0.061184 tcp 10.0.2.105 53874 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:10.232998 0.156657 tcp 10.0.2.105 53875 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:10.414758 2.999049 tcp 10.0.2.105 53876 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:19.412772 0.000000 tcp 10.0.2.105 53876 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:25.411694 0.030906 tcp 10.0.2.105 53877 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:25.442492 0.060854 tcp 10.0.2.105 53878 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:25.503621 0.150779 tcp 10.0.2.105 53879 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:25.681757 3.004246 tcp 10.0.2.105 53880 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:34.685205 0.000000 tcp 10.0.2.105 53880 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:40.683969 0.031326 tcp 10.0.2.105 53881 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:40.715558 0.061572 tcp 10.0.2.105 53882 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:40.777492 0.159157 tcp 10.0.2.105 53883 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:08:40.969290 2.999055 tcp 10.0.2.105 53884 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:49.976961 0.000000 tcp 10.0.2.105 53884 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:08:55.968227 2.991738 tcp 10.0.2.105 53885 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:04.861620 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:09:04.958059 0.000000 tcp 10.0.2.105 53885 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:09.865135 0.000379 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:09:10.966956 2.994183 tcp 10.0.2.105 53886 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:11.868189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:09:19.869628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:09:19.960583 0.000000 tcp 10.0.2.105 53886 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:25.968735 3.003980 tcp 10.0.2.105 53887 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:33.869673 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:09:34.971260 0.000000 tcp 10.0.2.105 53887 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:35.872785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:09:40.970767 3.003634 tcp 10.0.2.105 53888 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:09:49.972792 0.000000 tcp 10.0.2.105 53888 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:10:07.878859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:14:55.973714 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:14:55.973817 3.004828 tcp 10.0.2.105 53889 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:04.986551 0.000000 tcp 10.0.2.105 53889 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:10.978398 0.032816 tcp 10.0.2.105 53890 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:11.010983 0.065070 tcp 10.0.2.105 53891 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:11.076401 0.154075 tcp 10.0.2.105 53892 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:11.496545 2.992907 tcp 10.0.2.105 53893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:20.488112 0.000000 tcp 10.0.2.105 53893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:26.497266 0.030789 tcp 10.0.2.105 53894 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:26.528439 0.062258 tcp 10.0.2.105 53895 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:26.590937 0.155715 tcp 10.0.2.105 53896 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:26.770229 3.002407 tcp 10.0.2.105 53897 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:35.769892 0.000000 tcp 10.0.2.105 53897 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:41.769760 0.031391 tcp 10.0.2.105 53898 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:41.801455 0.065571 tcp 10.0.2.105 53899 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:41.866833 0.156641 tcp 10.0.2.105 53900 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:42.391482 3.005340 tcp 10.0.2.105 53901 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:51.392684 0.000000 tcp 10.0.2.105 53901 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:15:57.392760 0.030891 tcp 10.0.2.105 53902 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:57.423986 0.064635 tcp 10.0.2.105 53903 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:57.488937 0.158553 tcp 10.0.2.105 53904 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:15:57.686765 2.998982 tcp 10.0.2.105 53905 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:06.687420 0.000000 tcp 10.0.2.105 53905 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:11.885575 3.000711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:16:12.683622 0.031742 tcp 10.0.2.105 53906 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:16:12.715664 0.063972 tcp 10.0.2.105 53907 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:16:12.779905 0.158367 tcp 10.0.2.105 53908 -> 195.113.214.251 443 SRPA* 0 0 34 17894 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:16:13.058499 3.004101 tcp 10.0.2.105 53909 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:18.905811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:16:22.066851 0.000000 tcp 10.0.2.105 53909 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:26.903610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:16:28.055639 2.993897 tcp 10.0.2.105 53910 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:37.048102 0.000000 tcp 10.0.2.105 53910 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:41.865029 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:16:42.906708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:16:43.057076 2.993538 tcp 10.0.2.105 53911 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:52.049287 0.000000 tcp 10.0.2.105 53911 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:16:58.058424 3.004494 tcp 10.0.2.105 53912 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:17:05.869382 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:17:07.061173 0.000000 tcp 10.0.2.105 53912 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:17:13.059990 3.004137 tcp 10.0.2.105 53913 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:17:14.912713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:17:21.232015 0.312777 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:21.679110 0.174388 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:21.851077 0.085658 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:21.924853 0.173462 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:22.062928 0.000000 tcp 10.0.2.105 53913 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:17:22.200943 0.230975 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:22.424120 0.208552 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:22.656433 0.098483 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:22.735041 0.078622 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:22.918570 0.170157 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:23.272963 0.061054 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:23.332691 0.237783 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:23.547121 0.148711 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:23.681793 0.205088 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:23.856493 0.108984 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.029418 0.288546 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.339774 0.223731 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.485576 0.244498 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2565 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.785324 0.083682 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.847312 0.171910 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:24.997830 0.037982 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:25.197351 0.128972 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:25.279292 0.099455 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:25.401858 0.234719 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:25.627230 0.171853 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:25.843968 0.216293 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:17:29.864648 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:22:28.063709 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:22:28.063822 3.003015 tcp 10.0.2.105 53914 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:22:37.075736 0.000000 tcp 10.0.2.105 53914 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:22:43.066375 0.032618 tcp 10.0.2.105 53915 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:43.098821 0.063139 tcp 10.0.2.105 53916 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:43.162261 0.154414 tcp 10.0.2.105 53917 -> 195.113.214.251 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:43.486121 2.993120 tcp 10.0.2.105 53918 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:22:52.477903 0.000000 tcp 10.0.2.105 53918 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:22:58.487725 0.031198 tcp 10.0.2.105 53919 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:58.519227 0.061946 tcp 10.0.2.105 53920 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:58.581504 0.152448 tcp 10.0.2.105 53921 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:22:59.064391 2.997209 tcp 10.0.2.105 53922 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:08.060056 0.000000 tcp 10.0.2.105 53922 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:14.059596 0.030404 tcp 10.0.2.105 53923 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:14.090319 0.062065 tcp 10.0.2.105 53924 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:14.152752 0.152916 tcp 10.0.2.105 53925 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:14.491354 3.002414 tcp 10.0.2.105 53926 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:18.919587 3.000609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:23:23.492694 0.000000 tcp 10.0.2.105 53926 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:25.925991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:23:29.491850 0.031829 tcp 10.0.2.105 53927 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:29.523540 0.061865 tcp 10.0.2.105 53928 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:29.585374 0.155883 tcp 10.0.2.105 53929 -> 195.113.214.251 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:29.933246 3.004092 tcp 10.0.2.105 53930 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:33.927573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:23:38.934120 0.000000 tcp 10.0.2.105 53930 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:44.933987 0.032403 tcp 10.0.2.105 53931 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:44.966664 0.065495 tcp 10.0.2.105 53932 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:45.032498 0.153858 tcp 10.0.2.105 53933 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:23:45.451444 2.996971 tcp 10.0.2.105 53934 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:23:49.930121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:23:54.457066 0.000000 tcp 10.0.2.105 53934 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:00.445950 2.993851 tcp 10.0.2.105 53935 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:09.438976 0.000000 tcp 10.0.2.105 53935 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:14.365637 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:24:15.447510 3.007158 tcp 10.0.2.105 53936 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:21.936679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:24:24.450003 0.000000 tcp 10.0.2.105 53936 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:30.448922 3.003990 tcp 10.0.2.105 53937 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:38.359762 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:24:39.451814 0.000000 tcp 10.0.2.105 53937 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:45.450457 3.004486 tcp 10.0.2.105 53938 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:24:54.453137 0.000000 tcp 10.0.2.105 53938 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:00.454046 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:30:00.454172 2.993289 tcp 10.0.2.105 53939 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:09.456545 0.000000 tcp 10.0.2.105 53939 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:15.456792 0.032152 tcp 10.0.2.105 53940 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:15.489219 0.061525 tcp 10.0.2.105 53941 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:15.551021 0.159466 tcp 10.0.2.105 53942 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:16.050332 2.999374 tcp 10.0.2.105 53943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:25.048654 0.000000 tcp 10.0.2.105 53943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:25.942887 3.001631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:30:31.047829 0.031178 tcp 10.0.2.105 53944 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:31.079386 0.061539 tcp 10.0.2.105 53945 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:31.141304 0.156688 tcp 10.0.2.105 53946 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:31.473629 2.998568 tcp 10.0.2.105 53947 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:32.949941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:30:40.470887 0.000000 tcp 10.0.2.105 53947 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:40.951658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:30:46.470720 0.033099 tcp 10.0.2.105 53948 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:46.503652 0.066025 tcp 10.0.2.105 53949 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:46.570013 0.154661 tcp 10.0.2.105 53950 -> 195.113.214.251 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:30:46.849191 3.005227 tcp 10.0.2.105 53951 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:55.852849 0.000000 tcp 10.0.2.105 53951 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:30:56.954239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:31:01.842323 0.030995 tcp 10.0.2.105 53952 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:01.873595 0.063550 tcp 10.0.2.105 53953 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:01.937507 0.152974 tcp 10.0.2.105 53954 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:02.257622 3.011437 tcp 10.0.2.105 53955 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:11.265288 0.000000 tcp 10.0.2.105 53955 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:17.254345 0.030748 tcp 10.0.2.105 53956 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:17.285384 0.066901 tcp 10.0.2.105 53957 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:17.352612 0.146790 tcp 10.0.2.105 53958 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:31:17.615272 2.993256 tcp 10.0.2.105 53959 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:26.617252 0.000000 tcp 10.0.2.105 53959 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:28.960856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:31:32.615998 2.994060 tcp 10.0.2.105 53960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:41.608438 0.000000 tcp 10.0.2.105 53960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:46.365461 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:31:47.617813 3.004662 tcp 10.0.2.105 53961 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:31:56.620400 0.000000 tcp 10.0.2.105 53961 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:32:02.619245 3.003982 tcp 10.0.2.105 53962 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:32:03.773328 0.000153 tcp 10.0.2.105 53960 -> 31.192.24.67 3527 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:32:10.359718 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:32:11.621876 0.000000 tcp 10.0.2.105 53962 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:32:17.620939 3.003630 tcp 10.0.2.105 53963 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:32:26.625809 0.000000 tcp 10.0.2.105 53963 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:37:32.624208 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:37:32.624322 2.993560 tcp 10.0.2.105 53964 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:37:32.966942 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 19:37:39.973932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:37:41.626508 0.000000 tcp 10.0.2.105 53964 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/07 19:37:47.626675 0.032207 tcp 10.0.2.105 53965 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:37:47.658762 0.065195 tcp 10.0.2.105 53966 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:37:47.724354 0.165579 tcp 10.0.2.105 53967 -> 195.113.214.251 443 SRPA* 0 0 66 47288 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:37:47.975655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:37:48.273798 0.608928 tcp 10.0.2.105 53968 -> 31.192.24.67 3527 FSPA* 0 0 12 1521 flow=From-Botnet-V2-TCP-Established 1970/02/07 19:38:03.980393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:38:35.984389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:44:39.990932 3.001131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 19:44:46.999629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:44:54.999411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:45:11.002691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:45:43.008520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:47:45.304741 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 19:47:45.304840 0.064415 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:45.369673 0.164300 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:45.534429 0.312645 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:45.847468 0.167268 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.015277 0.223541 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.239201 0.192621 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.432165 0.074962 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.507606 0.056102 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.564378 0.143068 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.707866 0.059363 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.767633 0.213488 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:46.981451 0.134063 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.115946 0.146121 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.262594 0.073264 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.336379 0.286282 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.623097 0.147447 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.770997 0.169737 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:47.941199 0.067357 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.008945 0.143286 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.152662 0.034065 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.187077 0.081587 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.269115 0.146681 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.416242 0.206288 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.623080 0.088475 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:47:48.711968 0.213274 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/07 19:54:53.022076 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 19:55:00.032927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:55:08.034842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:55:24.034427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 19:55:56.040204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:02:00.045755 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:02:07.053235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:02:15.054348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:02:31.057770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:03:03.064024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:07:48.885720 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 20:07:48.885837 0.694283 tcp 10.0.2.105 53969 -> 31.192.24.67 3527 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/07 20:09:09.073055 3.000742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:09:16.080147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:09:24.081808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:09:40.084515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:10:12.090946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:16:16.096574 3.002113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:16:23.103536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:16:31.105571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:16:47.108089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:17:19.114295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:18:11.370064 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 20:18:11.370312 0.061440 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:11.432218 0.163056 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:11.595643 0.217871 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:11.813878 0.193512 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.007817 0.315489 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.323718 0.170203 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.494341 0.074848 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.569636 0.066821 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.636874 0.145084 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.782359 0.060850 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:12.843684 0.214493 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.058591 0.133993 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.192984 0.145135 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.338882 0.070192 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.409466 0.292127 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.702059 0.118972 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.821406 0.170351 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:13.992128 0.066280 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.058868 0.143204 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.202493 0.022885 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.225762 0.080773 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.306972 0.146203 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.453557 0.216485 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.670483 0.203660 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:18:14.874541 0.077550 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:23:23.120550 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:23:30.128069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:23:38.129821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:23:54.132795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:24:26.138734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:30:30.144665 3.002464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:30:37.152268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:30:45.153518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:31:01.156589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:31:33.162781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:37:37.169915 3.000483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:37:44.176494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:37:49.584358 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 20:37:49.584600 1.114909 tcp 10.0.2.105 53970 -> 31.192.24.67 3527 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/07 20:37:52.177260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:38:08.180591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:38:40.188443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:44:44.193124 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:44:51.200198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:44:59.201609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:45:15.204642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:45:47.210711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:48:33.980817 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 20:48:33.980937 0.221943 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:34.203295 0.178594 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:34.382311 0.311777 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:34.694537 0.042226 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:34.737149 0.165036 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:34.902568 0.170000 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.073002 0.224806 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.298176 0.060952 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.359568 0.145934 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.505971 0.059026 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.565430 0.212448 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.778244 0.130916 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:35.909553 0.147681 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.057669 0.071033 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.129204 0.289629 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.419193 0.121323 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.540962 0.172372 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.713830 0.063664 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.777964 0.145055 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.923477 0.044195 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:36.968060 0.081929 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:37.050364 0.205196 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:37.255976 0.080117 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:37.336715 0.147489 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:48:37.484682 0.214408 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/07 20:51:51.217979 3.000180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:51:58.223965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:52:06.225307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:52:22.228464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:52:54.234836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:58:58.240004 3.002141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 20:59:05.248010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:59:13.249418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 20:59:29.252541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:00:01.258318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:06:15.269406 4.142833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:06:23.377367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:06:31.282726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:06:47.092702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:07:18.726440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:07:50.751665 0.000228 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 21:07:50.752001 0.729496 tcp 10.0.2.105 53971 -> 31.192.24.67 3527 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:13:22.303141 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:13:29.310272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:13:37.312919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:13:53.314321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:14:25.320290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:18:51.543359 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 21:18:51.543613 0.222454 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:51.766418 0.047368 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:51.814197 0.164527 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:51.979101 0.195069 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.174590 0.314765 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.489713 0.169006 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.659151 0.103282 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.762802 0.056524 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.819754 0.145818 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:52.965910 0.066744 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.033006 0.213107 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.246502 0.131989 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.378848 0.146330 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.525655 0.074288 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.600409 0.279711 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:53.880554 0.145697 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.026714 0.172585 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.199694 0.061762 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.261855 0.147656 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.410012 0.025548 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.435996 0.085322 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.521709 0.146328 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.668551 0.096831 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:18:54.765811 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 21:19:12.175553 0.031390 tcp 10.0.2.105 53972 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:19:12.207195 0.074920 tcp 10.0.2.105 53973 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:19:12.282447 0.160571 tcp 10.0.2.105 53974 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:19:12.443798 0.215012 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:20:29.327896 3.000684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:20:36.334102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:20:44.336399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:21:00.338712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:21:32.345167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:27:36.350664 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:27:43.360496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:27:51.359526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:28:07.362673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:28:39.368870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:34:43.375599 3.100959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:34:50.448181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:34:58.393580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:35:14.396243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:35:46.403023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:37:51.442829 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 21:37:51.442915 0.670268 tcp 10.0.2.105 53975 -> 31.192.24.67 3527 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:41:50.408986 3.002055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:41:57.415919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:42:05.417792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:42:21.420799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:42:53.426830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:49:18.249767 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 21:49:18.249864 0.201360 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:18.451590 0.163820 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:18.615811 0.195694 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:18.811927 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 21:49:34.164637 0.049925 tcp 10.0.2.105 53976 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:49:34.214844 0.073900 tcp 10.0.2.105 53977 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:49:34.289042 0.163747 tcp 10.0.2.105 53978 -> 195.113.214.251 443 SRPA* 0 0 40 21958 flow=From-Botnet-V2-TCP-Established 1970/02/07 21:49:34.453728 0.047397 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:34.501590 0.168826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:34.726155 0.094901 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:34.821424 0.057315 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:34.879151 0.145811 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.025389 0.314999 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.340839 0.212224 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.553669 0.061070 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.615130 0.071804 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.687333 0.274669 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:35.962388 0.131796 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.094615 0.171474 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.266494 0.062060 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.328953 0.143830 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.473217 0.132837 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.606493 0.146550 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.753438 0.083808 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.837782 0.150297 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:36.988612 0.029773 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:37.018807 0.080796 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:49:37.100091 0.214397 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/07 21:53:25.438296 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 21:53:32.445410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:53:40.446900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:53:56.450715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 21:54:28.455611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:00:32.465609 2.997954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:00:39.469853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:00:47.471025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:01:03.473503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:01:35.479827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:07:39.486516 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:07:46.494449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:07:52.112164 0.000190 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 22:07:52.112464 1.072432 tcp 10.0.2.105 53979 -> 31.192.24.67 3527 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:07:54.495631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:08:10.497240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:08:42.504784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:14:46.511277 3.000226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:14:53.517365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:15:01.518773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:15:17.521867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:15:49.527666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:20:01.541722 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 22:20:01.541833 0.222243 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:01.764576 0.165406 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:01.930363 0.202258 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.133062 0.192546 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.326089 0.050271 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.376720 0.169576 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.546743 0.089094 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.636250 0.313978 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:02.950682 0.054322 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.005529 0.146899 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.152923 0.226467 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.380353 0.059722 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.440520 0.081414 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.522381 0.285522 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.808442 0.130506 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:03.939442 0.173083 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:04.112993 0.063462 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:04.176903 0.148054 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:04.325367 2.707853 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.033638 0.149426 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.183465 0.082319 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.266192 0.076945 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.343532 0.223657 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.567594 0.144147 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:20:07.712113 0.038044 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:21:53.534740 3.000732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:22:00.541286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:22:08.542665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:22:24.545715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:22:56.551974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:29:00.558845 3.000852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:29:07.565384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:29:15.567170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:29:31.569902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:30:03.591800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:36:07.592759 3.000731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:36:14.599279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:36:22.600847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:36:38.603712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:37:10.609844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:37:53.192236 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 22:37:53.192347 0.802731 tcp 10.0.2.105 53980 -> 31.192.24.67 3527 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:43:14.616582 3.001042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 22:43:21.623057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:43:29.630783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:43:45.627721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:44:17.633819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:50:35.376695 0.345685 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 22:50:35.722495 0.206180 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:39.449343 0.189030 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:39.638784 0.221832 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:39.860995 0.165616 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.027036 0.046048 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.073478 0.165804 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.239664 0.076146 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.433822 0.312959 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.747234 0.053471 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.801201 0.147356 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:40.949009 0.212815 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.162200 0.059006 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.221598 0.071512 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.293495 0.285468 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.579452 0.110304 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.690213 0.172781 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:50:41.863373 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 22:50:59.915098 0.051007 tcp 10.0.2.105 53981 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:50:59.966404 0.073597 tcp 10.0.2.105 53982 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:51:00.040508 0.158397 tcp 10.0.2.105 53983 -> 195.113.214.251 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:51:00.199450 0.147202 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:00.467989 0.081333 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:00.549726 0.081612 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:00.631751 0.134133 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:00.766300 0.147738 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:01.817169 0.037478 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:51:01.855102 0.000000 udp 10.0.2.105 7010 -> 162.202.134.145 3979 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 22:51:16.917465 0.049563 tcp 10.0.2.105 53984 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:51:16.967332 0.072592 tcp 10.0.2.105 53985 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:51:17.040240 0.175220 tcp 10.0.2.105 53986 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 22:51:17.215999 0.144067 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/07 22:54:07.645624 3.001768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 22:54:14.652039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:54:22.653597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:54:38.656551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 22:55:10.662901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:01:14.668770 3.008314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:01:21.680786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:01:29.682736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:01:45.680582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:02:17.688828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:07:54.000590 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 23:07:54.000726 1.112274 tcp 10.0.2.105 53987 -> 31.192.24.67 3527 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:08:21.692349 3.001836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:08:28.699939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:08:36.701658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:08:52.704582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:09:26.317188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:15:29.438868 3.114526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:15:36.503778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:15:44.397190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:16:00.178255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:16:31.764886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:21:39.937943 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 23:21:39.938086 0.183323 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:21:40.121761 0.224427 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:21:40.346575 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 23:21:57.685094 0.053123 tcp 10.0.2.105 53988 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:21:57.738198 0.074479 tcp 10.0.2.105 53989 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:21:57.813006 0.160097 tcp 10.0.2.105 53990 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:21:57.973746 0.192784 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:21:58.167005 0.166310 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:21:58.333762 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 23:22:13.656753 0.048989 tcp 10.0.2.105 53991 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:22:13.706084 0.074747 tcp 10.0.2.105 53992 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:22:13.781118 0.161335 tcp 10.0.2.105 53993 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:22:13.942978 0.164770 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.108200 0.046113 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.197220 0.049765 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.247434 0.315343 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.563182 0.080758 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.644530 0.145309 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:14.790292 0.272679 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:15.063337 0.059615 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:15.123355 0.213375 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:15.337168 0.068550 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:15.406091 0.171878 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:15.578428 1.194700 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:16.773547 0.101353 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:16.875261 0.132398 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:17.008067 0.093514 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:17.102006 0.144083 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:17.246475 0.040707 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:17.287544 0.147643 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:17.435563 0.147038 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:22:35.770400 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/07 23:22:42.777639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:22:50.779480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:23:06.784471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:23:38.788602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:29:42.795464 3.000672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:29:49.802091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:29:57.803323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:30:13.806468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:30:45.812813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:36:49.818411 3.001846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:36:56.825832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:37:04.827171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:37:20.832630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:37:52.840005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:37:55.120049 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 23:37:55.120144 0.792811 tcp 10.0.2.105 53994 -> 31.192.24.67 3527 FSPA* 0 0 15 1658 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:43:56.845252 2.998865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:44:03.849489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:44:11.851346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:44:27.854274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:44:59.860526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:52:46.020654 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/07 23:52:46.020776 0.205192 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:46.226398 0.219229 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:46.446025 0.065382 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:46.511782 0.223750 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:46.735978 0.170955 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:46.907331 0.201391 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.109206 0.057104 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.166736 0.165883 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.332999 0.048320 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.381730 0.312737 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.694827 0.075661 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.770869 0.146119 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:47.917336 0.293075 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.210749 0.059776 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.270897 0.211884 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.483195 0.073816 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.557465 0.172654 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.730500 0.106092 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.837027 0.082035 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:52:48.919446 0.000000 udp 10.0.2.105 7010 -> 50.29.239.83 8927 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/07 23:53:05.070201 0.050897 tcp 10.0.2.105 53995 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:53:05.121385 0.075187 tcp 10.0.2.105 53996 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:53:05.196907 0.154453 tcp 10.0.2.105 53997 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/07 23:53:05.352051 0.082568 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:53:05.435011 0.147970 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:53:05.583400 0.029130 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:53:05.612990 0.145541 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:53:05.759019 0.147124 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/07 23:54:29.872106 3.002900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/07 23:54:36.879430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:54:44.881427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:55:00.884506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/07 23:55:32.890007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:01:36.896821 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:01:43.903961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:01:51.905772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:02:07.908553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:02:39.914566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:07:55.919292 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:07:55.919398 0.772389 tcp 10.0.2.105 53998 -> 31.192.24.67 3527 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/08 00:08:43.920384 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:08:50.927862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:08:58.929386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:09:14.932640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:09:46.938735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:15:50.945193 3.118766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:15:58.034180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:16:05.969216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:16:21.966761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:16:53.972572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:22:57.979512 3.003611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:23:04.986036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:23:11.395394 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:23:11.395553 0.000000 udp 10.0.2.105 7010 -> 50.29.239.83 8927 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:23:12.986826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:23:28.990131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:23:29.182406 0.117723 tcp 10.0.2.105 53999 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 00:23:29.300433 0.112831 tcp 10.0.2.105 54000 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 00:23:29.413474 0.158556 tcp 10.0.2.105 54001 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 00:23:29.572744 4.537572 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 4 1058 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:29.640427 3.950774 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1213 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:29.850257 3.958293 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 4 1039 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:30.069861 3.936734 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 4 1143 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:30.264678 3.789884 udp 10.0.2.105 7010 <-> 109.158.58.127 4349 CON 0 0 4 1271 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:30.324801 4.006839 udp 10.0.2.105 7010 <-> 162.202.134.145 3979 CON 0 0 4 1170 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:30.548633 3.946627 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1226 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:30.717038 4.094780 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 4 1234 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.034266 3.879409 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 4 1084 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.127589 3.837430 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1169 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.174876 3.955806 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1089 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.341975 3.840423 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1306 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.398226 4.001617 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 4 1205 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.612823 3.857399 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 4 1141 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.687178 4.067659 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 998 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:31.970908 3.932740 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 4 1207 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.120621 3.952930 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 4 1237 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.292337 4.570379 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 4 1157 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.408230 3.752983 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 4 1135 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.487564 3.715425 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 4 1113 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.526318 3.825593 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 4 1229 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.673916 3.769450 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 4 1055 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.753538 3.838625 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 4 1113 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:32.899548 3.839052 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1345 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:36.863479 1.408427 udp 10.0.2.105 7010 <-> 49.248.205.148 5060 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:23:38.402472 0.000000 udp 10.0.2.105 7010 -> 88.240.147.9 6019 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:23:44.232773 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:23:51.462918 0.000000 udp 10.0.2.105 7010 -> 194.121.246.177 1101 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:23:56.359365 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:23:58.893249 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:00.996211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:24:06.624666 0.000000 udp 10.0.2.105 7010 -> 67.127.102.3 2739 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:12.062876 0.000000 udp 10.0.2.105 7010 -> 117.193.246.58 9731 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:17.309800 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:21.866198 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:24:26.222968 0.074276 udp 10.0.2.105 7010 <-> 86.130.32.70 4984 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:24:26.596809 0.000000 udp 10.0.2.105 7010 -> 105.237.57.168 6590 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:32.602154 0.000000 udp 10.0.2.105 7010 -> 61.12.5.98 8311 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:38.179957 0.000000 udp 10.0.2.105 7010 -> 88.252.147.19 1830 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:43.517812 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 1029 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:24:48.364448 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:24:52.129675 0.000000 udp 10.0.2.105 7010 -> 88.233.120.232 6085 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:00.582333 0.000000 udp 10.0.2.105 7010 -> 203.121.30.167 8970 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:08.132914 0.000000 udp 10.0.2.105 7010 -> 110.143.111.171 9758 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:12.859722 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:25:15.092768 0.000000 udp 10.0.2.105 7010 -> 64.134.191.197 1522 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:21.632459 0.000000 udp 10.0.2.105 7010 -> 182.74.88.214 4986 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:27.991892 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:36.163530 0.000000 udp 10.0.2.105 7010 -> 210.148.158.192 6452 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:40.860002 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:25:41.771532 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:50.343758 0.000000 udp 10.0.2.105 7010 -> 193.92.202.83 6285 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:25:55.411154 0.000000 udp 10.0.2.105 7010 -> 86.153.29.216 3574 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:01.019345 0.408339 udp 10.0.2.105 7010 <-> 124.120.197.218 6030 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:26:03.240556 0.000000 udp 10.0.2.105 7010 -> 78.179.135.183 7034 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:05.865862 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:26:10.142130 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:18.293522 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:25.985173 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:30.861919 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:26:34.216914 0.000000 udp 10.0.2.105 7010 -> 203.198.37.145 1784 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:42.028163 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:48.647976 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:26:55.537627 0.000000 udp 10.0.2.105 7010 -> 85.74.64.208 7047 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:00.364164 0.000203 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:27:04.390237 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:12.612054 0.169818 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:27:13.095886 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:19.271841 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:25.189732 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:29.866645 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:27:32.891544 0.000000 udp 10.0.2.105 7010 -> 175.139.169.30 1036 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:38.859622 0.077353 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:27:38.996104 0.304980 udp 10.0.2.105 7010 <-> 180.242.46.162 2020 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:27:39.790913 0.000000 udp 10.0.2.105 7010 -> 79.5.170.20 9095 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:48.597029 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:54.972962 0.000000 udp 10.0.2.105 7010 -> 151.76.28.144 2973 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:27:59.859775 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:28:01.001729 0.031601 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:01.417817 0.643960 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:02.199458 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:09.554045 0.357655 udp 10.0.2.105 7010 <-> 42.3.180.42 3238 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:10.330652 0.387369 udp 10.0.2.105 7010 <-> 112.207.185.64 9411 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:10.836921 0.098843 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:11.091584 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 5109 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:16.795300 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:23.784058 0.056080 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:24.489832 0.098406 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:25.157755 0.102764 udp 10.0.2.105 7010 -> 109.242.20.115 9282 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:25.260519 0.000000 icmp 109.242.20.115 0x0303 -> 10.0.2.105 0x4224 URP 192 1 341 flow=Background 1970/02/08 00:28:28.361072 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:28:30.233474 0.000000 udp 10.0.2.105 7010 -> 79.38.25.78 2191 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:35.661724 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:42.821751 0.000000 udp 10.0.2.105 7010 -> 151.51.8.142 3242 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:50.542790 0.000000 udp 10.0.2.105 7010 -> 195.110.137.234 6919 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:28:55.359571 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:28:56.942277 0.359911 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:28:57.713745 0.000000 udp 10.0.2.105 7010 -> 115.166.35.248 6760 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:06.165574 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:12.854975 0.386623 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 680 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:29:13.273017 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 1025 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:19.414535 0.074078 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:29:19.684514 0.256067 udp 10.0.2.105 7010 -> 210.210.158.142 7934 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:19.940581 0.000000 icmp 210.210.158.142 0x0303 -> 10.0.2.105 0xfe1e URP 192 1 135 flow=Background 1970/02/08 00:29:24.361235 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:29:25.332944 0.000000 udp 10.0.2.105 7010 -> 87.23.194.227 8571 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:32.452968 0.000000 udp 10.0.2.105 7010 -> 203.125.247.226 5590 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:39.833770 0.516082 udp 10.0.2.105 7010 <-> 183.4.231.137 1822 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:29:40.514778 0.000000 udp 10.0.2.105 7010 -> 115.42.128.138 2443 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:46.282872 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:50.859220 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:29:52.301934 0.000000 udp 10.0.2.105 7010 -> 85.39.108.122 2907 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:29:58.941149 0.000000 udp 10.0.2.105 7010 -> 46.176.22.92 5379 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:05.002724 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 00:30:07.874790 0.000000 udp 10.0.2.105 7010 -> 111.92.106.45 4800 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:12.009346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:30:15.425169 0.073726 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:15.498895 0.000000 icmp 151.58.244.201 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 128 flow=Background 1970/02/08 00:30:20.011425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:30:20.361687 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:30:21.103174 0.000000 udp 10.0.2.105 7010 -> 81.137.195.248 2873 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:26.300530 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:31.377652 0.000000 udp 10.0.2.105 7010 -> 87.248.45.54 7955 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:36.015080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:30:38.908753 0.372271 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:30:39.490594 0.000000 udp 10.0.2.105 7010 -> 95.237.53.233 5995 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:44.366233 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:30:47.040194 0.000000 udp 10.0.2.105 7010 -> 171.98.182.80 3308 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:30:53.669869 0.000000 udp 10.0.2.105 7010 -> 60.50.140.82 1055 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:03.120120 0.000000 udp 10.0.2.105 7010 -> 151.27.156.178 7192 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:08.794995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:31:09.559739 0.000000 udp 10.0.2.105 7010 -> 79.29.246.107 9258 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:14.173532 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:31:18.130016 0.000000 udp 10.0.2.105 7010 -> 176.198.66.204 5230 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:24.994252 0.000000 udp 10.0.2.105 7010 -> 95.241.29.16 1841 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:30.073828 0.000000 udp 10.0.2.105 7010 -> 213.175.189.10 8515 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:37.154721 0.086732 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:31:37.846872 0.059270 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:31:38.096986 0.224522 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:31:38.645050 0.070368 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:31:38.917638 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:41.826884 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:31:46.674283 0.000000 udp 10.0.2.105 7010 -> 81.130.73.215 8724 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:31:55.020600 0.000000 udp 10.0.2.105 7010 -> 90.202.104.63 7755 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:03.201456 0.231322 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:32:03.854748 0.000000 udp 10.0.2.105 7010 -> 219.74.177.125 5208 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:07.998726 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:32:11.910713 0.166859 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:32:12.595792 0.000000 udp 10.0.2.105 7010 -> 217.203.198.109 5641 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:17.638722 0.000000 udp 10.0.2.105 7010 -> 84.253.2.58 4080 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:25.090941 0.000000 udp 10.0.2.105 7010 -> 108.69.108.60 9293 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:31.620772 0.000000 udp 10.0.2.105 7010 -> 86.5.231.189 7490 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:36.358898 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:32:37.759613 0.000000 udp 10.0.2.105 7010 -> 185.30.65.165 7249 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:43.447771 0.000000 udp 10.0.2.105 7010 -> 82.127.255.252 3798 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:51.038799 0.054654 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:32:51.694315 0.238438 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:32:52.156975 0.057310 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:32:52.323407 0.000000 udp 10.0.2.105 7010 -> 79.48.5.215 6835 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:32:58.880102 0.000000 udp 10.0.2.105 7010 -> 76.10.128.162 2118 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:03.866427 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:33:07.251894 0.238652 udp 10.0.2.105 7010 <-> 2.193.30.133 1256 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:33:07.982792 0.000000 udp 10.0.2.105 7010 -> 123.236.244.130 6281 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:13.361261 0.000000 udp 10.0.2.105 7010 -> 31.140.94.64 1149 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:20.320452 0.000000 udp 10.0.2.105 7010 -> 65.125.151.30 4302 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:28.962898 0.000000 udp 10.0.2.105 7010 -> 5.67.30.167 5450 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:33.859960 0.116748 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:33:35.489404 0.000000 udp 10.0.2.105 7010 -> 1.160.227.76 7701 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:43.764198 0.000000 udp 10.0.2.105 7010 -> 95.76.248.6 2126 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:33:52.727271 0.000000 udp 10.0.2.105 7010 -> 206.255.223.192 5754 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:00.448624 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:05.369493 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:34:09.250866 0.217027 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:34:09.675755 0.000000 udp 10.0.2.105 7010 -> 196.215.97.194 6626 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:16.662849 0.000000 udp 10.0.2.105 7010 -> 124.191.169.96 5090 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:22.521983 0.000000 udp 10.0.2.105 7010 -> 84.27.168.47 5267 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:29.230100 0.000000 udp 10.0.2.105 7010 -> 93.41.218.76 3387 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:33.866476 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:34:35.358617 0.000000 udp 10.0.2.105 7010 -> 87.194.184.82 8561 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:41.467537 0.121616 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/02/08 00:34:42.365202 0.000000 udp 10.0.2.105 7010 -> 165.145.100.196 3215 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:49.058278 0.000000 udp 10.0.2.105 7010 -> 92.96.121.196 9131 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:34:57.941156 0.000000 udp 10.0.2.105 7010 -> 87.28.246.44 6821 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 00:35:02.857878 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:37:12.036625 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 00:37:19.043815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:37:27.068141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:37:43.057879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:37:56.698312 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 00:37:56.698410 0.642916 tcp 10.0.2.105 54002 -> 31.192.24.67 3527 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/02/08 00:38:15.064784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:44:19.071346 3.000724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:44:26.077391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:44:34.079101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:44:50.082385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:45:22.088368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:54:41.094663 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 00:54:48.102362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:54:56.105251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:55:12.106705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 00:55:44.113031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:01:48.129355 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:01:55.136178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:02:03.137675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:02:19.140666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:02:51.146533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:05:17.367395 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 01:05:17.367593 0.059321 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.427414 0.204723 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.632782 0.076021 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.709207 0.044298 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.753933 0.057715 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.812014 0.169045 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:17.981473 0.314118 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.296004 0.165292 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.461703 0.146174 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.608266 0.074767 udp 10.0.2.105 7010 <-> 86.43.189.215 8274 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.683400 0.023587 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.707449 0.214592 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:18.922516 0.172619 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.095529 0.071664 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.167532 0.286136 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.454022 0.145110 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.599506 0.159950 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.759879 0.105513 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.865732 0.080578 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:19.946673 0.146322 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:20.093419 0.375989 udp 10.0.2.105 7010 <-> 49.248.205.148 5060 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:20.469862 0.000000 udp 10.0.2.105 7010 -> 86.130.32.70 4984 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:05:39.420530 0.049527 tcp 10.0.2.105 54003 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:39.470341 0.075275 tcp 10.0.2.105 54004 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:39.545892 0.253871 tcp 10.0.2.105 54005 -> 195.113.214.251 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:39.800256 0.000000 udp 10.0.2.105 7010 -> 124.120.197.218 6030 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:05:56.894487 0.050230 tcp 10.0.2.105 54006 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:56.945092 0.090578 tcp 10.0.2.105 54007 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:57.035930 0.158556 tcp 10.0.2.105 54008 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:05:57.195076 0.168340 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:05:57.363841 0.000000 udp 10.0.2.105 7010 -> 180.242.46.162 2020 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:06:14.109173 0.050167 tcp 10.0.2.105 54009 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:14.159621 0.071198 tcp 10.0.2.105 54010 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:14.231095 0.164465 tcp 10.0.2.105 54011 -> 195.113.214.251 443 SRPA* 0 0 35 18782 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:14.394340 0.074876 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:14.469638 0.029973 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:14.499962 0.354297 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:14.854639 0.360446 udp 10.0.2.105 7010 <-> 42.3.180.42 3238 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:15.215437 0.366735 udp 10.0.2.105 7010 <-> 112.207.185.64 9411 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:15.582591 0.082637 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:15.665605 0.045861 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:15.711935 0.098059 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:15.810366 0.352290 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:16.163088 0.345918 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:16.509450 0.071778 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:16.581635 0.000000 udp 10.0.2.105 7010 -> 183.4.231.137 1822 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:06:32.795855 0.049949 tcp 10.0.2.105 54012 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:32.846120 0.072572 tcp 10.0.2.105 54013 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:32.918951 0.165506 tcp 10.0.2.105 54014 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:06:33.085056 0.387017 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:33.472723 0.080145 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:33.553253 0.067371 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:33.621003 0.222147 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:33.843544 0.051287 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:33.895251 0.229053 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.124738 0.070646 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.195750 0.049362 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.245533 0.057597 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.303542 0.214917 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.519000 0.115216 udp 10.0.2.105 7010 <-> 2.193.30.133 1256 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.634623 0.213712 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:06:34.848697 0.112846 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:07:57.346975 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 01:07:57.347115 0.653708 tcp 10.0.2.105 54015 -> 31.192.24.67 3527 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:08:55.152220 3.002372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 01:09:02.159693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:09:10.164846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:09:26.164802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:09:58.170833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:16:02.177172 3.000551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:16:09.188853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:16:17.185470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:16:33.188537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:17:05.194403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:23:09.201440 3.000928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:23:16.208141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:23:24.209670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:23:40.212714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:24:12.218822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:30:16.225259 3.000864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:30:23.231893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:30:31.233417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:30:47.236569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:31:19.242671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:36:51.069530 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 01:36:51.069780 0.000000 udp 10.0.2.105 7010 -> 86.130.32.70 4984 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:37:06.594071 0.050695 tcp 10.0.2.105 54016 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:06.645055 0.071609 tcp 10.0.2.105 54017 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:06.716953 0.163435 tcp 10.0.2.105 54018 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:06.880890 0.000000 udp 10.0.2.105 7010 -> 124.120.197.218 6030 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:37:23.248669 3.001123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:37:24.499714 0.049971 tcp 10.0.2.105 54019 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:24.549949 0.076018 tcp 10.0.2.105 54020 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:24.626252 0.160978 tcp 10.0.2.105 54021 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:24.787852 0.000000 udp 10.0.2.105 7010 -> 180.242.46.162 2020 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:37:30.437150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:37:38.362064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:37:42.381629 0.049441 tcp 10.0.2.105 54022 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:42.431338 0.071281 tcp 10.0.2.105 54023 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:42.502911 0.165950 tcp 10.0.2.105 54024 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:42.669521 0.000000 udp 10.0.2.105 7010 -> 183.4.231.137 1822 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:37:54.270190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:37:57.936499 0.049487 tcp 10.0.2.105 54025 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:57.986272 0.074726 tcp 10.0.2.105 54026 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:58.006527 0.881088 tcp 10.0.2.105 54027 -> 31.192.24.67 3527 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:58.061252 0.158998 tcp 10.0.2.105 54028 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:37:58.220730 0.055313 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:37:58.276641 0.041222 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:37:58.318324 0.099535 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:37:58.418260 0.204679 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:37:58.623335 0.062836 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:37:58.686557 0.000000 udp 10.0.2.105 7010 -> 86.43.189.215 8274 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:38:15.331698 0.050502 tcp 10.0.2.105 54029 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:15.382571 0.074607 tcp 10.0.2.105 54030 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:15.457479 0.170273 tcp 10.0.2.105 54031 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:15.628431 0.035983 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:15.664774 0.212531 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:15.877710 0.172243 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.050390 0.069568 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.120551 0.314946 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.435898 0.147709 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.584059 0.171480 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.755947 0.165413 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:16.921753 3.148651 udp 10.0.2.105 7010 <-> 49.248.205.148 5060 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.070834 0.137408 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.208591 0.285740 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.494725 0.146859 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.641960 0.084383 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.726714 0.150885 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:20.878000 0.145108 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:21.023514 0.168126 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:21.191996 0.391166 udp 10.0.2.105 7010 <-> 42.3.180.42 3238 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:21.583575 0.029643 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:21.613638 0.070978 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:21.685017 0.374535 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:22.059957 0.057946 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:22.118320 0.096439 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:22.215144 1.136025 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:23.351556 0.362175 udp 10.0.2.105 7010 <-> 112.207.185.64 9411 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:23.714182 0.081485 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:23.796068 0.355686 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:24.152174 0.077584 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:24.230126 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 01:38:26.276816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:38:42.270191 0.049605 tcp 10.0.2.105 54032 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:42.320115 0.074966 tcp 10.0.2.105 54033 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:42.395445 0.161605 tcp 10.0.2.105 54034 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 01:38:42.557700 0.078969 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:42.637096 0.068074 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:42.705585 0.225462 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:42.931440 0.053864 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:42.985666 0.226700 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.212742 0.072037 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.285205 0.047925 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.333552 0.058179 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.392169 0.213493 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.606063 0.099838 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.706275 0.236112 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:38:43.942766 0.177142 udp 10.0.2.105 7010 <-> 2.193.30.133 1256 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/08 01:44:30.283046 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:44:37.290028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:44:45.291580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:45:01.294326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:45:33.300657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:54:47.309939 3.001483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 01:54:54.317159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:55:02.318790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:55:18.321498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 01:55:50.327933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:01:54.334332 3.001076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 02:02:01.341452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:02:09.342717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:02:25.345809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:02:57.351824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:07:58.895847 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:07:58.895953 0.762945 tcp 10.0.2.105 54035 -> 31.192.24.67 3527 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:08:46.624054 0.000000 udp 10.0.2.105 7010 -> 86.43.189.215 8274 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:08:51.360786 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:09:01.358707 3.000400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 02:09:02.348194 0.050318 tcp 10.0.2.105 54036 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:02.398783 0.072230 tcp 10.0.2.105 54037 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:02.471340 0.139854 tcp 10.0.2.105 54038 -> 195.113.214.251 443 SRPA* 0 0 36 24856 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:02.611849 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:09:08.364907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:09:16.366680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:09:18.780547 0.050984 tcp 10.0.2.105 54039 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:18.831802 0.075835 tcp 10.0.2.105 54040 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:18.907902 0.163239 tcp 10.0.2.105 54041 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:19.071803 0.057437 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.129663 0.058416 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.188526 0.060224 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.249216 0.204787 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.454442 0.074504 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.529340 0.040407 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.570199 0.073005 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.643619 0.214263 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:19.858341 0.171815 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:20.030551 0.168365 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:20.199330 0.164129 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:20.363871 0.147083 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:20.511367 0.316747 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:20.828471 1.186202 udp 10.0.2.105 7010 <-> 49.248.205.148 5060 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.015095 0.118271 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.133778 0.082918 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.217073 0.144657 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.362138 0.144230 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.506782 0.172540 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.679716 0.291690 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:22.971815 0.146299 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.118493 0.071967 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.190856 0.379458 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.570669 0.083929 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.655052 0.097787 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.753189 0.030063 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:23.783646 0.360299 udp 10.0.2.105 7010 <-> 42.3.180.42 3238 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:24.144719 0.368277 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:24.513369 0.069891 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:24.583691 0.114487 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:24.698561 0.360525 udp 10.0.2.105 7010 <-> 112.207.185.64 9411 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:25.059479 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:09:32.369752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:09:42.314389 0.049776 tcp 10.0.2.105 54042 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:42.364648 0.070941 tcp 10.0.2.105 54043 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:42.435908 0.172473 tcp 10.0.2.105 54044 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:09:42.608992 0.077325 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:42.686705 0.067053 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:42.754158 0.222844 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:42.977411 0.054662 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.032545 0.210922 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.243855 0.260834 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.505108 0.050914 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.556454 0.116780 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.673641 0.224951 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:09:43.898995 0.000000 udp 10.0.2.105 7010 -> 2.193.30.133 1256 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:10:00.530687 0.048426 tcp 10.0.2.105 54045 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:10:00.579431 0.075799 tcp 10.0.2.105 54046 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:10:00.655625 0.177248 tcp 10.0.2.105 54047 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:10:00.833446 0.063374 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:10:00.897217 0.216791 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:10:04.375662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:16:08.382626 3.000419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 02:16:15.389165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:16:23.390083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:16:39.393386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:17:11.399487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:23:15.405846 3.003125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 02:23:22.412803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:23:30.414134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:23:46.417672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:24:18.423406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:30:22.430703 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 02:30:29.437321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:30:37.438777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:30:53.441419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:31:25.447493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:37:29.454401 3.000566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 02:37:36.461109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:37:44.462680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:37:59.664618 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:37:59.664716 2.994037 tcp 10.0.2.105 54048 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:00.465360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:38:08.667271 0.000000 tcp 10.0.2.105 54048 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:14.670931 0.052274 tcp 10.0.2.105 54049 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:14.723560 0.071491 tcp 10.0.2.105 54050 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:14.795459 0.151604 tcp 10.0.2.105 54051 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:15.098889 2.991790 tcp 10.0.2.105 54052 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:24.089360 0.000000 tcp 10.0.2.105 54052 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:30.099257 0.062022 tcp 10.0.2.105 54053 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:30.161582 0.075569 tcp 10.0.2.105 54054 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:30.237443 0.164460 tcp 10.0.2.105 54055 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:30.565103 2.997888 tcp 10.0.2.105 54056 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:32.471409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:38:39.561694 0.000000 tcp 10.0.2.105 54056 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:45.561108 0.049903 tcp 10.0.2.105 54057 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:45.611296 0.073795 tcp 10.0.2.105 54058 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:45.685373 0.152486 tcp 10.0.2.105 54059 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:38:45.942881 3.002123 tcp 10.0.2.105 54060 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:38:54.953904 0.000000 tcp 10.0.2.105 54060 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:00.943477 0.054551 tcp 10.0.2.105 54061 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:00.998336 0.074839 tcp 10.0.2.105 54062 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:01.073507 0.168221 tcp 10.0.2.105 54063 -> 195.113.214.251 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:01.557721 2.999995 tcp 10.0.2.105 54064 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:10.566139 0.000000 tcp 10.0.2.105 54064 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:16.555533 0.051940 tcp 10.0.2.105 54065 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:16.607828 0.075696 tcp 10.0.2.105 54066 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:16.683810 0.162863 tcp 10.0.2.105 54067 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:39:16.930146 2.999675 tcp 10.0.2.105 54068 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:25.928116 0.000000 tcp 10.0.2.105 54068 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:31.927152 3.004155 tcp 10.0.2.105 54069 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:40.929471 0.000000 tcp 10.0.2.105 54069 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:45.856973 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:39:46.928382 3.004404 tcp 10.0.2.105 54070 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:39:55.931498 0.000000 tcp 10.0.2.105 54070 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:40:01.930035 3.004170 tcp 10.0.2.105 54071 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:40:09.861377 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:40:10.933043 0.000000 tcp 10.0.2.105 54071 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:40:12.866454 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:40:16.931950 3.004052 tcp 10.0.2.105 54072 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:40:25.934928 0.000000 tcp 10.0.2.105 54072 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:40:31.503546 0.048276 tcp 10.0.2.105 54073 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:31.552124 0.081119 tcp 10.0.2.105 54074 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:31.633537 0.172884 tcp 10.0.2.105 54075 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:31.807087 0.000000 udp 10.0.2.105 7010 -> 2.193.30.133 1256 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:40:47.045796 0.050618 tcp 10.0.2.105 54076 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:47.096720 0.073546 tcp 10.0.2.105 54077 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:47.170627 0.168815 tcp 10.0.2.105 54078 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:40:47.339906 0.055158 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.395650 0.044774 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.440791 0.063685 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.504938 0.036838 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.542158 0.069386 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.611959 0.213490 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.825843 0.172803 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:47.999034 0.165632 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:48.165096 0.165680 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:48.331191 0.087946 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:48.419541 0.206412 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:48.626423 0.314938 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:48.941784 0.146019 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:49.088219 0.132933 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:49.221561 0.084656 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:49.306670 2.037046 udp 10.0.2.105 7010 <-> 49.248.205.148 5060 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:51.344092 0.145909 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:51.490405 0.278817 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:51.769616 0.147010 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:51.917025 0.074257 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:51.991653 0.168596 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:52.160724 0.147672 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:52.308815 0.029623 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:40:52.338846 0.000000 udp 10.0.2.105 7010 -> 42.3.180.42 3238 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:41:07.409682 0.050397 tcp 10.0.2.105 54079 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:07.460369 0.075279 tcp 10.0.2.105 54080 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:07.535985 0.159667 tcp 10.0.2.105 54081 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:07.696161 0.358536 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:08.055123 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:41:25.381823 0.049304 tcp 10.0.2.105 54082 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:25.431389 0.071887 tcp 10.0.2.105 54083 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:25.503557 0.163104 tcp 10.0.2.105 54084 -> 195.113.214.251 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:25.667482 0.050274 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:25.718139 0.000000 udp 10.0.2.105 7010 -> 112.207.185.64 9411 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:41:41.964664 0.049212 tcp 10.0.2.105 54085 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:42.014238 0.072849 tcp 10.0.2.105 54086 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:42.087443 0.157782 tcp 10.0.2.105 54087 -> 195.113.214.251 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:42.245867 0.069563 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:42.315806 0.613267 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:42.929444 0.102013 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:43.031862 0.218537 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:43.250842 0.056855 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:43.308094 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 02:41:59.589879 0.049301 tcp 10.0.2.105 54088 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:59.639457 0.068192 tcp 10.0.2.105 54089 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:59.707886 0.217603 tcp 10.0.2.105 54090 -> 195.113.214.251 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:41:59.926054 0.068250 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:41:59.994641 0.076605 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.071610 0.217411 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.289418 0.270598 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.560410 0.050920 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.611771 0.114382 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.726516 0.066698 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:42:00.793583 0.213200 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/08 02:44:36.478331 3.001049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 02:44:43.489475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:44:51.486621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:45:07.489310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:45:31.934794 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:45:31.934893 2.993858 tcp 10.0.2.105 54091 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:45:39.499889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:45:40.939176 0.000000 tcp 10.0.2.105 54091 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:45:46.938087 0.060851 tcp 10.0.2.105 54092 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:45:46.999236 0.072896 tcp 10.0.2.105 54093 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:45:47.072005 0.171819 tcp 10.0.2.105 54094 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:45:47.915209 2.996608 tcp 10.0.2.105 54095 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:45:56.910101 0.000000 tcp 10.0.2.105 54095 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:02.909415 0.049338 tcp 10.0.2.105 54096 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:02.959034 0.070780 tcp 10.0.2.105 54097 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:03.030154 0.158813 tcp 10.0.2.105 54098 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:03.258242 2.995534 tcp 10.0.2.105 54099 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:12.252705 0.000000 tcp 10.0.2.105 54099 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:18.251651 0.049309 tcp 10.0.2.105 54100 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:18.301374 0.128078 tcp 10.0.2.105 54101 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:18.429736 0.166461 tcp 10.0.2.105 54102 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:18.672744 3.003301 tcp 10.0.2.105 54103 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:27.674823 0.000000 tcp 10.0.2.105 54103 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:34.673305 0.049672 tcp 10.0.2.105 54104 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:34.723320 0.073484 tcp 10.0.2.105 54105 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:34.797111 0.165886 tcp 10.0.2.105 54106 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:46:34.973801 2.963777 tcp 10.0.2.105 54107 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:43.869778 0.000000 tcp 10.0.2.105 54107 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:49.782399 2.952932 tcp 10.0.2.105 54108 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:46:58.658449 0.000000 tcp 10.0.2.105 54108 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:47:03.492297 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:47:04.590172 2.969437 tcp 10.0.2.105 54109 -> 46.49.66.193 6223 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:47:13.487862 0.000000 tcp 10.0.2.105 54109 -> 46.49.66.193 6223 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:47:19.417332 2.969893 tcp 10.0.2.105 54110 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:47:27.199593 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:47:28.310904 0.000000 tcp 10.0.2.105 54110 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:52:33.982077 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:52:33.982171 3.003917 tcp 10.0.2.105 54111 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:52:42.984133 0.000000 tcp 10.0.2.105 54111 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:52:48.984577 0.050013 tcp 10.0.2.105 54112 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:52:49.034936 0.076266 tcp 10.0.2.105 54113 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:52:49.111523 0.159404 tcp 10.0.2.105 54114 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:52:49.281194 2.996476 tcp 10.0.2.105 54115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:52:58.285839 0.000000 tcp 10.0.2.105 54115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:54:51.501836 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 02:54:58.509172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:55:06.510781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:55:22.513708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:55:54.519805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 02:58:04.276742 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 02:58:04.276850 2.993335 tcp 10.0.2.105 54116 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:58:13.269090 0.000000 tcp 10.0.2.105 54116 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:58:19.279710 0.050470 tcp 10.0.2.105 54117 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:58:19.330520 0.076282 tcp 10.0.2.105 54118 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:58:19.407103 0.162911 tcp 10.0.2.105 54119 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 02:58:19.581126 3.001558 tcp 10.0.2.105 54120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 02:58:28.581076 0.000000 tcp 10.0.2.105 54120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:01:58.525332 3.002176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 03:02:05.532950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:02:13.534717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:02:29.537694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:03:01.543566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:09:05.550037 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 03:09:12.557171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:09:20.559028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:09:36.561496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:10:08.567470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:12:22.009106 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:12:22.009251 0.000000 udp 10.0.2.105 7010 -> 42.3.180.42 3238 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:12:38.785128 0.052286 tcp 10.0.2.105 54121 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:38.837650 0.075720 tcp 10.0.2.105 54122 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:38.913679 0.165837 tcp 10.0.2.105 54123 -> 195.113.214.251 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:39.080026 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:12:56.710279 0.054726 tcp 10.0.2.105 54124 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:56.765305 0.076303 tcp 10.0.2.105 54125 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:56.841636 0.157465 tcp 10.0.2.105 54126 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:12:56.999622 0.000000 udp 10.0.2.105 7010 -> 112.207.185.64 9411 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:13:14.345508 0.048572 tcp 10.0.2.105 54127 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:14.394410 0.075614 tcp 10.0.2.105 54128 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:14.469911 0.214048 tcp 10.0.2.105 54129 -> 195.113.214.251 443 SRPA* 0 0 42 27054 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:14.683053 0.228985 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:14.904304 0.236574 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.159897 0.089784 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.230415 0.170696 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.397514 0.173976 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.607169 0.093550 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.660362 0.113288 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.808501 0.034051 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:15.993064 0.178824 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:16.283318 0.059783 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:16.536976 0.142811 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:16.633822 0.121392 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:16.851681 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:13:19.642583 3.004164 tcp 10.0.2.105 54130 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:13:28.645275 0.000000 tcp 10.0.2.105 54130 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:13:33.593247 0.048188 tcp 10.0.2.105 54131 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:33.641717 0.072206 tcp 10.0.2.105 54132 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:33.714186 0.164801 tcp 10.0.2.105 54133 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:33.879513 0.314365 udp 10.0.2.105 7010 <-> 221.151.128.165 2676 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:34.644414 0.050644 tcp 10.0.2.105 54134 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:34.671635 0.176746 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:34.695421 0.076552 tcp 10.0.2.105 54135 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:34.772317 0.165437 tcp 10.0.2.105 54136 -> 195.113.214.251 443 SRPA* 0 0 33 17852 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:34.784749 0.170031 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:35.040369 2.987947 tcp 10.0.2.105 54137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:13:35.074009 0.000000 udp 10.0.2.105 7010 -> 49.248.205.148 5060 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:13:44.027481 0.000000 tcp 10.0.2.105 54137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:13:50.040616 0.049552 tcp 10.0.2.105 54138 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.090490 0.073983 tcp 10.0.2.105 54139 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.164790 0.160537 tcp 10.0.2.105 54140 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.249279 0.049324 tcp 10.0.2.105 54141 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.298877 0.072555 tcp 10.0.2.105 54142 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.371676 0.162866 tcp 10.0.2.105 54143 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:13:50.535225 0.234761 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:50.699561 2.992095 tcp 10.0.2.105 54144 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:13:50.741809 0.046201 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:51.017026 0.294367 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:51.550865 0.170794 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:51.873399 0.171019 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:52.021765 0.180097 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:52.354424 0.090583 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:52.427897 0.382963 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:52.808828 0.068418 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:53.035025 0.083326 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:53.108955 0.070119 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:53.580047 0.117694 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:53.661675 0.761571 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:54.413634 0.228924 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:54.638678 0.082981 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:54.829583 0.112802 udp 10.0.2.105 7010 <-> 88.45.249.122 1169 CON 0 0 6 2554 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:13:54.909817 0.000000 udp 10.0.2.105 7010 -> 108.64.212.115 1932 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:13:59.690046 0.000000 tcp 10.0.2.105 54144 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:05.700466 0.049340 tcp 10.0.2.105 54145 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:05.750096 0.076403 tcp 10.0.2.105 54146 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:05.826834 0.156047 tcp 10.0.2.105 54147 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:06.235604 2.998291 tcp 10.0.2.105 54148 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:10.876710 0.050174 tcp 10.0.2.105 54149 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:10.927146 0.073189 tcp 10.0.2.105 54150 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:11.000644 0.158699 tcp 10.0.2.105 54151 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:14:11.159867 0.153618 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:14:11.275245 0.060148 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:14:11.694380 0.246573 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:14:11.907351 0.097756 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2555 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:14:11.985591 0.071052 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:14:15.232883 0.000000 tcp 10.0.2.105 54148 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:21.231236 3.003986 tcp 10.0.2.105 54152 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:30.234939 0.000000 tcp 10.0.2.105 54152 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:34.860410 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:14:36.232854 3.003450 tcp 10.0.2.105 54153 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:14:45.235542 0.000000 tcp 10.0.2.105 54153 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:16:12.574351 3.001125 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 03:16:19.581127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:16:27.582639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:16:43.585530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:17:15.591680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:19:51.235970 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:19:51.236142 2.998672 tcp 10.0.2.105 54154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:00.233451 0.000000 tcp 10.0.2.105 54154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:06.238462 0.050370 tcp 10.0.2.105 54155 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:06.289121 0.073120 tcp 10.0.2.105 54156 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:06.362570 0.183766 tcp 10.0.2.105 54157 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:06.811569 3.000321 tcp 10.0.2.105 54158 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:15.810330 0.000000 tcp 10.0.2.105 54158 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:21.799796 0.048034 tcp 10.0.2.105 54159 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:21.848183 0.149320 tcp 10.0.2.105 54160 -> 195.113.214.251 80 SRPA* 0 0 19 13462 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:22.057900 3.006249 tcp 10.0.2.105 54161 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:31.062571 0.000000 tcp 10.0.2.105 54161 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:37.051690 0.051712 tcp 10.0.2.105 54162 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:37.103277 0.078664 tcp 10.0.2.105 54163 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:37.182286 0.207362 tcp 10.0.2.105 54164 -> 195.113.214.251 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:37.813687 3.002952 tcp 10.0.2.105 54165 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:46.815171 0.000000 tcp 10.0.2.105 54165 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:20:52.814338 0.050044 tcp 10.0.2.105 54166 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:52.864675 0.076121 tcp 10.0.2.105 54167 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:52.941133 0.154599 tcp 10.0.2.105 54168 -> 195.113.214.251 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:20:53.461464 2.997586 tcp 10.0.2.105 54169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:02.467787 0.000000 tcp 10.0.2.105 54169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:08.460922 2.989989 tcp 10.0.2.105 54170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:17.449250 0.000000 tcp 10.0.2.105 54170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:22.356358 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:21:23.458213 3.003892 tcp 10.0.2.105 54171 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:32.461080 0.000000 tcp 10.0.2.105 54171 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:38.459871 3.003805 tcp 10.0.2.105 54172 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:21:46.360917 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:21:47.462619 0.000000 tcp 10.0.2.105 54172 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:23:19.597647 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 03:23:26.605120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:23:34.606538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:23:50.609553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:24:22.625509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:26:53.463558 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:26:53.463664 3.003024 tcp 10.0.2.105 54173 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:02.465400 0.000000 tcp 10.0.2.105 54173 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:08.465727 0.050815 tcp 10.0.2.105 54174 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:08.516842 0.074478 tcp 10.0.2.105 54175 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:08.591618 0.164486 tcp 10.0.2.105 54176 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:09.321681 2.997678 tcp 10.0.2.105 54177 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:18.318019 0.000000 tcp 10.0.2.105 54177 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:24.317695 0.049783 tcp 10.0.2.105 54178 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:24.367344 0.071783 tcp 10.0.2.105 54179 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:24.439482 0.171058 tcp 10.0.2.105 54180 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:24.761023 3.000722 tcp 10.0.2.105 54181 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:33.760750 0.000000 tcp 10.0.2.105 54181 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:39.759697 0.049347 tcp 10.0.2.105 54182 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:39.809305 0.071640 tcp 10.0.2.105 54183 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:39.881248 0.160996 tcp 10.0.2.105 54184 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:40.111865 3.001879 tcp 10.0.2.105 54185 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:49.111864 0.000000 tcp 10.0.2.105 54185 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:27:55.111559 0.050382 tcp 10.0.2.105 54186 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:55.162238 0.076141 tcp 10.0.2.105 54187 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:55.238707 0.168013 tcp 10.0.2.105 54188 -> 195.113.214.251 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:27:55.462880 3.002888 tcp 10.0.2.105 54189 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:04.464591 0.000000 tcp 10.0.2.105 54189 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:10.463442 3.003887 tcp 10.0.2.105 54190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:19.476095 0.000000 tcp 10.0.2.105 54190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:24.362851 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:28:25.464941 2.994312 tcp 10.0.2.105 54191 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:34.459490 0.000000 tcp 10.0.2.105 54191 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:40.466467 3.085988 tcp 10.0.2.105 54192 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:28:48.412402 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:28:49.503998 0.000000 tcp 10.0.2.105 54192 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:30:26.631418 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 03:30:33.638977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:30:41.640820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:30:57.643571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:31:29.650718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:33:55.479907 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:33:55.479998 3.003338 tcp 10.0.2.105 54193 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:04.481925 0.000000 tcp 10.0.2.105 54193 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:10.482371 0.051634 tcp 10.0.2.105 54194 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:10.534370 0.071863 tcp 10.0.2.105 54195 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:10.606495 0.235317 tcp 10.0.2.105 54196 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:10.934210 3.001821 tcp 10.0.2.105 54197 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:19.934563 0.000000 tcp 10.0.2.105 54197 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:25.933334 0.048969 tcp 10.0.2.105 54198 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:25.982624 0.070592 tcp 10.0.2.105 54199 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:26.053505 0.247603 tcp 10.0.2.105 54200 -> 195.113.214.251 443 SRPA* 0 0 24 13844 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:26.403847 2.994230 tcp 10.0.2.105 54201 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:35.410363 0.000000 tcp 10.0.2.105 54201 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:41.405954 0.051019 tcp 10.0.2.105 54202 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:41.457284 0.067476 tcp 10.0.2.105 54203 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:41.525031 0.158690 tcp 10.0.2.105 54204 -> 195.113.214.251 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:41.787136 2.992820 tcp 10.0.2.105 54205 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:50.778508 0.000000 tcp 10.0.2.105 54205 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:34:56.787867 0.049071 tcp 10.0.2.105 54206 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:56.837256 0.075062 tcp 10.0.2.105 54207 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:56.912554 0.169400 tcp 10.0.2.105 54208 -> 195.113.214.251 443 SRPA* 0 0 34 14400 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:34:57.285396 2.997117 tcp 10.0.2.105 54209 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:35:06.280932 0.000000 tcp 10.0.2.105 54209 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 03:35:12.279980 0.748766 tcp 10.0.2.105 54210 -> 31.192.24.67 3527 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:35:14.172535 0.000142 tcp 10.0.2.105 54197 -> 31.192.24.67 3527 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:37:33.655396 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 03:37:40.663043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:37:48.664113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:38:04.671433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:38:36.673640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:44:19.266345 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 03:44:19.266450 0.213157 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:19.471932 0.000000 udp 10.0.2.105 7010 -> 49.248.205.148 5060 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:44:37.214726 0.051798 tcp 10.0.2.105 54211 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:37.266792 0.072442 tcp 10.0.2.105 54212 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:37.339596 0.163757 tcp 10.0.2.105 54213 -> 195.113.214.251 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:37.503951 0.221970 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:37.722683 0.238380 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:37.937202 0.236891 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.167480 0.082878 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.229519 0.116535 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.309143 0.037314 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.407820 0.176122 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.581236 0.058094 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.716055 0.081256 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.761184 0.173181 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:38.926828 0.172935 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:39.096600 0.103549 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:39.307861 0.132692 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:39.396758 0.000000 udp 10.0.2.105 7010 -> 221.151.128.165 2676 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:44:40.679518 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 03:44:47.689452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:44:55.688458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:44:57.101492 0.049749 tcp 10.0.2.105 54214 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:57.151562 0.070716 tcp 10.0.2.105 54215 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:57.222585 0.157467 tcp 10.0.2.105 54216 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:44:57.380586 0.174301 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:57.717303 0.154843 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:57.826145 0.282275 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:58.197431 0.047541 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:58.230208 0.168428 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:58.373078 0.179064 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:58.543204 0.173211 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:58.903429 0.175430 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.054875 0.067168 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.144279 0.081267 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.223825 0.160687 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.534096 0.374728 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.906097 0.075570 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:44:59.966304 0.128887 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 6 2538 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:00.051321 0.082258 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:00.203663 0.000000 udp 10.0.2.105 7010 -> 88.45.249.122 1169 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 03:45:11.691534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:45:17.310427 0.048803 tcp 10.0.2.105 54217 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:45:17.359494 0.072244 tcp 10.0.2.105 54218 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:45:17.432031 0.158663 tcp 10.0.2.105 54219 -> 195.113.214.251 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 03:45:17.591343 0.518165 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:18.185234 0.232937 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 6 2588 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:18.414470 0.160633 udp 10.0.2.105 7010 <-> 82.57.31.69 4918 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:18.536397 0.206152 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:18.725480 0.089099 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:18.945355 0.062797 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:19.024035 0.254704 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/08 03:45:43.697409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:54:49.706235 3.010760 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 03:54:56.722707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:55:04.724007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:55:20.727277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 03:55:52.732944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:01:56.740642 2.999999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:02:03.746676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:02:11.748055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:02:27.751243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:02:59.757249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:05:13.029567 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:05:13.029679 0.591234 tcp 10.0.2.105 54220 -> 31.192.24.67 3527 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:09:06.768066 3.001168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:09:13.774881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:09:21.778946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:09:37.778942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:10:09.785541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:15:39.540047 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:15:39.540155 0.000000 udp 10.0.2.105 7010 -> 221.151.128.165 2676 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:15:58.288144 0.050637 tcp 10.0.2.105 54221 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:15:58.339106 0.072928 tcp 10.0.2.105 54222 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:15:58.412304 0.196750 tcp 10.0.2.105 54223 -> 195.113.214.251 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:15:58.609553 0.000000 udp 10.0.2.105 7010 -> 88.45.249.122 1169 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:16:13.791017 3.001927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:16:17.514719 0.049347 tcp 10.0.2.105 54224 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:17.564411 0.085795 tcp 10.0.2.105 54225 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:17.650474 0.175232 tcp 10.0.2.105 54226 -> 195.113.214.251 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:17.826165 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:16:20.798630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:16:28.800221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:16:35.961087 0.049657 tcp 10.0.2.105 54227 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:36.010982 0.076241 tcp 10.0.2.105 54228 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:36.087553 0.168543 tcp 10.0.2.105 54229 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:36.256813 0.080667 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:36.337839 0.087142 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:36.425343 0.215760 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:36.641467 0.213254 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:36.855099 0.212067 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:37.067565 0.046917 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:37.114874 0.165062 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:37.280327 0.168256 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:37.449049 0.090742 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:37.540387 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:16:44.803365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:16:52.845383 0.050759 tcp 10.0.2.105 54230 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:52.896448 0.074988 tcp 10.0.2.105 54231 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:52.971735 0.172944 tcp 10.0.2.105 54232 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:16:53.145346 0.023688 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.169443 0.070583 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.240473 0.080235 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.321174 0.116172 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.437735 0.147246 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.585361 0.029425 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.615184 0.284365 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:53.899954 0.146947 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.047286 0.116583 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.164251 0.071952 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.236571 0.149701 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.386727 0.163988 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.551104 0.146840 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.698293 0.071274 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.769977 0.079563 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.849911 0.080983 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:54.931233 0.087196 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:16:55.018828 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:17:11.973364 0.049011 tcp 10.0.2.105 54233 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:12.022682 0.072540 tcp 10.0.2.105 54234 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:12.095511 0.159594 tcp 10.0.2.105 54235 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:12.255636 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:17:16.808891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:17:27.625708 0.049104 tcp 10.0.2.105 54236 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:27.675196 0.077715 tcp 10.0.2.105 54237 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:27.753194 0.166374 tcp 10.0.2.105 54238 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:27.920173 0.000000 udp 10.0.2.105 7010 -> 82.57.31.69 4918 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:17:43.708912 0.049670 tcp 10.0.2.105 54239 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:43.758866 0.075083 tcp 10.0.2.105 54240 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:43.833816 0.172274 tcp 10.0.2.105 54241 -> 195.113.214.251 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:17:44.006204 0.287877 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:17:44.294557 0.065778 udp 10.0.2.105 7010 <-> 86.146.138.242 7431 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:17:44.360724 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:18:01.438731 0.050450 tcp 10.0.2.105 54242 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:18:01.489487 0.077624 tcp 10.0.2.105 54243 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:18:01.567472 0.163385 tcp 10.0.2.105 54244 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:18:01.731415 0.212301 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:18:01.944111 0.218942 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:23:20.816380 3.000666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 04:23:27.822912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:23:35.825686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:23:51.827342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:24:23.833248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:30:27.839703 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:30:34.846661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:30:42.848209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:30:58.851268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:31:30.856852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:35:13.628121 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:35:13.628226 0.592630 tcp 10.0.2.105 54245 -> 31.192.24.67 3527 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:37:34.862964 3.002078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:37:41.870176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:37:49.872195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:38:05.875149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:38:37.881208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:44:41.887088 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 04:44:48.894610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:44:56.896376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:45:12.898860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:45:44.904989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:48:15.231896 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:48:15.231978 0.208772 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:48:15.441147 0.172033 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:48:15.613557 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:48:32.758714 0.050184 tcp 10.0.2.105 54246 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:32.809229 0.070638 tcp 10.0.2.105 54247 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:32.880149 0.159395 tcp 10.0.2.105 54248 -> 195.113.214.251 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:33.040164 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:48:51.434152 0.049820 tcp 10.0.2.105 54249 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:51.484397 0.070650 tcp 10.0.2.105 54250 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:51.555256 0.156854 tcp 10.0.2.105 54251 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:48:51.712791 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:49:10.526285 0.049463 tcp 10.0.2.105 54252 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:10.576041 0.071691 tcp 10.0.2.105 54253 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:10.648028 0.167938 tcp 10.0.2.105 54254 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:10.816752 0.000000 udp 10.0.2.105 7010 -> 82.57.31.69 4918 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:49:28.597407 0.088304 tcp 10.0.2.105 54255 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:28.686059 0.072038 tcp 10.0.2.105 54256 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:28.757978 0.171436 tcp 10.0.2.105 54257 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:28.930078 0.080422 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.010975 0.231904 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.011298 3.000207 tcp 10.0.2.105 54258 -> 213.123.178.217 7379 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 04:49:29.243254 0.212272 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.455900 0.086567 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.542850 0.164296 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.707510 0.043044 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.750920 0.233830 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:29.985171 0.169704 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.155277 0.115345 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.270993 0.371960 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.643310 0.070785 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.714523 0.083072 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.797944 0.065940 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.864296 0.070810 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:30.935443 0.148924 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.084740 0.274236 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.359403 0.030450 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.390242 0.146693 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.537304 0.109231 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.647009 0.143052 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.790480 0.089451 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.880364 0.081325 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:31.962068 0.071482 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:32.033992 0.144367 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:32.178731 0.170780 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:32.349951 0.084209 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:32.434558 0.253144 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:32.688096 0.000000 udp 10.0.2.105 7010 -> 86.146.138.242 7431 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:49:38.010060 0.000000 tcp 10.0.2.105 54258 -> 213.123.178.217 7379 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 04:49:50.298838 0.048970 tcp 10.0.2.105 54259 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:50.348111 0.071083 tcp 10.0.2.105 54260 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:50.419113 0.157261 tcp 10.0.2.105 54261 -> 195.113.214.251 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:50.576862 0.694119 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:51.271547 0.228791 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:49:51.271976 4.957143 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 SPA_* 0 0 28 13968 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:49:56.437096 0.000000 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:04.416078 0.392505 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:11.852901 0.396980 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 7 5074 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:16.855831 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:50:18.391879 0.668236 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:24.542529 4.923732 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 23 12798 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:29.664617 4.917090 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:34.782047 4.958989 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 35 19358 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:39.939488 1.592348 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 12 6192 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:42.362751 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:50:54.194292 4.988984 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 20 10444 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:50:59.879167 4.996116 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:05.314271 4.638240 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:11.681704 4.800155 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 8 3052 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:16.992728 4.949854 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:21.358894 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:51:22.139711 4.346406 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:28.373495 0.195502 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 2 200 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:37.877344 3.361155 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 12 4748 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:45.864096 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:51:49.412101 4.940561 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:54.556085 3.205143 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 9 3106 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:51:59.830898 4.073227 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:05.290132 4.866811 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:09.858504 0.049066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:52:11.717457 4.842678 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 12 6412 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:16.758383 0.000000 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:24.875984 3.469219 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 8 2528 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:30.355919 4.048043 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:35.355326 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:52:36.537175 4.375979 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 23 12234 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:42.516779 4.525229 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 16 8212 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:52:47.756449 4.743541 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:03.209251 0.206582 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 2 476 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:08.362679 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:53:12.939864 3.654867 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 11 3738 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:18.197957 4.755499 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 6 2944 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:23.454162 4.283695 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 21 7658 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:29.473764 3.283865 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 11 4550 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:32.357318 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:53:37.838511 3.480753 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 19 8886 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:45.406524 0.991066 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 4 1264 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:50.771885 4.848892 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 16 6104 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:53:56.361670 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:54:14.392510 1.777739 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 6 2944 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:20.214348 3.707125 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 4894 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:20.356044 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:54:26.207264 3.983389 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 19 8886 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:31.856684 4.532664 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 17 6158 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:36.954842 3.980986 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 9 3106 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:43.320951 4.682728 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:48.511946 1.826682 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:50.912705 3.001894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 04:54:54.962518 4.845853 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 17 8254 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:54:57.920390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:54:59.917043 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:54:59.972534 2.762079 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:05.943552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:55:06.600192 3.879659 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:11.909028 4.816052 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:17.408918 4.716322 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:21.935097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:55:22.554067 4.495177 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:23.857174 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:55:27.708950 4.339184 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:32.732997 4.917575 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 24 9680 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:38.214383 3.421820 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:43.411145 4.380642 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 9 2610 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:48.362920 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:55:48.850255 4.178151 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 17 7702 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:55:53.941109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 04:55:56.635751 4.434953 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 11 3726 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:04.907389 3.906120 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 27 12998 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:10.016152 4.815229 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 29 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:13.358858 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:56:15.030740 4.787444 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 10 4424 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:28.633691 4.764804 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:33.716689 3.663069 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 A_PA 0 0 34 14936 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:37.363123 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 04:56:38.839101 2.763029 tcp 10.0.2.105 54262 -> 200.84.7.244 8038 FPA_* 0 0 10 1854 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:56:57.944738 0.000000 udp 10.0.2.105 7010 -> 86.146.138.242 7431 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:57:15.269884 0.050759 tcp 10.0.2.105 54263 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:15.320851 0.072464 tcp 10.0.2.105 54264 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:15.393601 0.158541 tcp 10.0.2.105 54265 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:15.552865 0.207852 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:15.761112 0.171806 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:15.933255 0.079160 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.012840 0.090314 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.103564 0.165138 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.269149 0.062048 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.331596 0.211301 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.543325 0.254646 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.798335 0.077208 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:16.875962 0.168186 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:17.044738 0.000000 udp 10.0.2.105 7010 -> 108.64.212.115 1932 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:57:32.563329 0.050008 tcp 10.0.2.105 54266 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:32.613610 0.076861 tcp 10.0.2.105 54267 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:32.690745 0.461233 tcp 10.0.2.105 54268 -> 195.113.214.251 443 SRPA* 0 0 72 78368 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:33.152602 0.081772 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:33.234779 0.066585 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:33.301777 0.072703 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:33.374861 0.154145 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:33.529419 0.071936 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:33.601747 0.000000 udp 10.0.2.105 7010 -> 212.17.122.207 9755 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:57:42.817863 0.936284 tcp 10.0.2.105 54269 -> 31.192.24.67 3527 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:49.057148 0.049304 tcp 10.0.2.105 54270 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:49.106719 0.082422 tcp 10.0.2.105 54271 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:49.189412 0.152534 tcp 10.0.2.105 54272 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:57:49.343163 0.147489 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:49.491004 0.103664 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:49.595115 0.146870 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:49.742334 0.091371 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:49.834181 0.293062 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.127634 0.029169 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.157194 0.144607 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.302307 0.168543 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.471252 0.080370 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.552022 0.080758 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.633149 0.069847 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.703377 0.225756 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/08 04:57:50.929511 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 04:58:06.542180 0.049347 tcp 10.0.2.105 54273 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:58:06.591838 0.070814 tcp 10.0.2.105 54274 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:58:06.662974 0.165671 tcp 10.0.2.105 54275 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 04:58:06.829313 0.222249 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:01:57.976549 3.002060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 05:02:04.984436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:02:12.985368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:02:28.988217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:03:00.994949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:09:05.002089 3.000516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:09:12.008091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:09:20.010048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:09:36.012941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:10:08.018897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:16:12.024179 3.002126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:16:19.042449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:16:27.043739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:16:43.046506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:17:15.063441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:23:19.068329 3.012402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:23:26.092708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:23:34.088832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:23:50.090157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:24:22.097060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:27:43.758212 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 05:27:43.758322 0.738595 tcp 10.0.2.105 54276 -> 31.192.24.67 3527 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/08 05:28:14.272149 0.223788 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:14.717573 0.338021 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:15.055982 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 05:28:18.887291 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 05:28:31.607873 0.050413 tcp 10.0.2.105 54277 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 05:28:31.658591 0.075574 tcp 10.0.2.105 54278 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 05:28:31.734465 0.156262 tcp 10.0.2.105 54279 -> 195.113.214.251 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 05:28:31.891377 0.209600 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.101363 0.163240 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.264998 0.043943 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.309309 0.211602 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.521323 0.072356 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.594092 0.172137 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.766567 0.089883 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.856803 0.075167 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:32.932623 0.219486 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.152511 0.169292 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.322252 0.084510 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.407204 0.070670 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.478376 0.065259 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.544064 0.148131 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.692612 0.072161 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.765192 0.146149 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:33.911719 0.089270 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.001397 0.147743 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.149532 0.105105 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.255012 0.141928 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.397392 0.168988 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.566858 0.080468 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.647713 0.029002 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.677082 0.288820 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:34.966251 0.092516 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:35.059192 0.069384 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:35.128986 0.176761 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:28:35.306112 0.253567 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:30:26.102083 3.002672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 05:30:33.110127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:30:41.111705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:30:57.114679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:31:29.120979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:37:33.126689 3.001793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:37:40.133827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:37:48.145646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:38:04.148768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:38:36.154888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:44:40.160480 3.001701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:44:47.168084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:44:55.169542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:45:11.172654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:45:43.179029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:54:50.187899 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 05:54:57.195551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:55:05.196903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:55:21.199674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:55:53.205824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 05:57:44.496400 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 05:57:44.496605 0.760464 tcp 10.0.2.105 54280 -> 31.192.24.67 3527 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/02/08 05:58:45.604097 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 05:58:45.604387 0.220523 udp 10.0.2.105 7010 <-> 108.64.212.115 1932 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:45.825264 0.358274 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.184004 0.055543 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.239987 0.205574 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.445957 0.165377 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.611717 0.213782 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.825917 0.078153 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:46.904450 0.173974 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.078792 0.087676 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.166808 0.086195 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.253397 0.227411 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.481203 0.167706 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.649301 0.083677 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.733422 0.070454 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.804254 0.067045 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:47.871689 0.147263 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.019328 0.073005 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.092704 0.143539 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.236645 0.087925 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.324940 0.148997 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.474291 0.112488 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:48.587171 0.449449 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.036974 0.167783 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.205105 0.080985 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.286482 0.028618 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.315523 0.278365 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.594277 0.081774 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.676474 0.070916 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.747739 0.085751 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/08 05:58:49.833834 0.218574 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:01:57.211481 3.002005 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 06:02:04.219538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:02:12.220785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:02:28.223894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:03:00.229733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:09:04.235994 3.001532 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:09:11.247355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:09:19.245839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:09:35.247672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:10:07.253665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:16:11.259892 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:16:18.277209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:16:26.278757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:16:42.283174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:17:14.288014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:23:18.294100 3.001241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:23:25.302169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:23:33.312736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:23:49.315513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:24:21.321968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:27:45.265396 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 06:27:45.265559 0.747092 tcp 10.0.2.105 54281 -> 31.192.24.67 3527 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:04.849446 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 06:29:04.849591 0.049968 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:04.899922 0.207618 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:05.107905 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 06:29:22.826926 0.051203 tcp 10.0.2.105 54282 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:22.878390 0.075031 tcp 10.0.2.105 54283 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:22.953730 0.156510 tcp 10.0.2.105 54284 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:23.110806 0.212243 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:23.323414 0.077417 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:23.401223 0.000000 udp 10.0.2.105 7010 -> 108.64.212.115 1932 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 06:29:41.803167 0.049437 tcp 10.0.2.105 54285 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:41.852886 0.073274 tcp 10.0.2.105 54286 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:41.926469 0.159029 tcp 10.0.2.105 54287 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:42.086006 0.385391 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:42.471805 0.172602 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:29:42.644763 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 06:29:59.658529 0.049508 tcp 10.0.2.105 54288 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:59.708402 0.074942 tcp 10.0.2.105 54289 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:59.783630 0.160881 tcp 10.0.2.105 54290 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:29:59.945003 0.085331 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.030756 0.223799 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.347881 0.165767 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.514025 0.094464 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.608893 0.074157 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.683491 0.070796 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.754671 0.145977 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.901020 0.070598 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:00.972019 0.145994 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:01.118436 0.090061 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:01.208867 0.148876 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:01.358073 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 06:30:17.194205 0.049754 tcp 10.0.2.105 54291 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:30:17.244302 0.075369 tcp 10.0.2.105 54292 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:30:17.319964 0.154354 tcp 10.0.2.105 54293 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 06:30:17.474926 1.462602 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:18.937910 0.168891 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.107192 0.081858 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.189491 0.028756 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.218575 0.076152 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.295110 0.185795 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.481278 0.219447 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.701130 0.276173 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:19.977742 0.094608 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/08 06:30:25.327599 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 06:30:32.335092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:30:40.336774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:30:56.339633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:31:28.348522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:37:32.351394 3.001970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:37:39.359462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:37:47.360570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:38:03.363595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:38:35.369687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:44:39.375786 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:44:46.383154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:44:54.384603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:45:10.391791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:45:42.393521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:54:51.406196 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 06:54:58.413387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:55:06.414446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:55:22.417453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:55:54.423524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 06:57:46.014525 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 06:57:46.014716 0.583044 tcp 10.0.2.105 54294 -> 31.192.24.67 3527 FSPA* 0 0 14 1497 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:00:47.787281 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:00:47.787388 0.166407 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:00:47.954161 0.000000 udp 10.0.2.105 7010 -> 108.64.212.115 1932 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:01:04.781752 0.050847 tcp 10.0.2.105 54295 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:04.832843 0.073617 tcp 10.0.2.105 54296 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:04.906731 0.174221 tcp 10.0.2.105 54297 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:05.081610 0.089175 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.171149 0.149255 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.320826 0.207208 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.528502 0.047637 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.576566 0.213318 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.790328 0.076753 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:05.790668 3.004585 tcp 10.0.2.105 54298 -> 190.205.193.197 4858 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 07:01:05.867506 0.291760 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:06.159629 0.172289 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:06.332258 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:01:14.794240 0.000000 tcp 10.0.2.105 54298 -> 190.205.193.197 4858 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 07:01:21.544427 0.049511 tcp 10.0.2.105 54299 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:21.594315 0.072979 tcp 10.0.2.105 54300 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:21.667566 0.157740 tcp 10.0.2.105 54301 -> 195.113.214.251 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:21.825771 0.140897 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:21.967055 0.155488 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.122905 0.167515 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.290783 0.063767 udp 10.0.2.105 7010 <-> 86.136.207.119 8059 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.354950 0.146519 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.501855 0.070733 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.573004 0.145408 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.718796 0.084351 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.803513 0.148000 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:22.951928 0.078577 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:23.030867 0.587133 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:23.618390 0.169473 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:23.788366 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:01:42.384478 0.049774 tcp 10.0.2.105 54302 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:42.434485 0.076022 tcp 10.0.2.105 54303 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:42.510842 0.155151 tcp 10.0.2.105 54304 -> 195.113.214.251 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:42.666741 0.028930 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:42.695998 0.068107 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:42.764463 0.295158 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:43.060148 0.092044 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:43.060695 1.768192 tcp 10.0.2.105 54305 -> 58.177.94.240 9222 SPA_* 0 0 27 17470 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:01:43.152564 0.281848 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:43.434803 0.224472 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:01:58.429773 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 07:02:05.437019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:02:13.438791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:02:14.830587 0.294704 tcp 10.0.2.105 54305 -> 58.177.94.240 9222 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:02:29.445432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:03:01.453130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:09:05.454852 3.000782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 07:09:12.461404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:09:20.462959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:09:36.465407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:10:08.481688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:16:12.488903 3.003055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 07:16:19.494870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:16:27.496789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:16:43.499418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:17:15.505779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:23:19.512373 3.001921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 07:23:26.519052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:23:34.520220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:23:50.523581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:24:22.529442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:27:46.603351 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:27:46.603512 0.759003 tcp 10.0.2.105 54306 -> 31.192.24.67 3527 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:30:26.535660 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 07:30:33.543167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:30:41.544381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:30:57.549095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:31:29.558823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:31:52.887136 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:31:52.887240 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:32:11.004374 0.050649 tcp 10.0.2.105 54307 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:11.055307 0.075666 tcp 10.0.2.105 54308 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:11.131227 0.169177 tcp 10.0.2.105 54309 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:11.300949 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:32:28.458838 0.049274 tcp 10.0.2.105 54310 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:28.508432 0.076954 tcp 10.0.2.105 54311 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:28.585678 0.158406 tcp 10.0.2.105 54312 -> 195.113.214.251 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:28.744941 0.164257 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:28.909614 0.087903 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:28.997928 0.129013 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:29.127328 0.080002 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:29.233417 0.321514 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:29.555325 0.171535 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:29.727307 0.287071 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.014800 0.051861 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.015139 2.999530 tcp 10.0.2.105 54313 -> 190.205.193.197 4858 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 07:32:30.067053 0.205630 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.273063 0.163558 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.436982 0.076181 udp 10.0.2.105 7010 <-> 79.9.27.1 4734 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.513575 0.079779 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.593731 0.070364 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.664674 0.146092 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.811134 0.086233 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:30.897762 0.147552 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:31.045694 0.072678 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:31.118736 0.150081 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:31.269181 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 07:32:39.013161 0.000000 tcp 10.0.2.105 54313 -> 190.205.193.197 4858 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 07:32:50.199842 0.050880 tcp 10.0.2.105 54314 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:50.251000 0.070686 tcp 10.0.2.105 54315 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:50.321921 0.157560 tcp 10.0.2.105 54316 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:50.480132 0.171952 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:50.652500 0.222110 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:50.874965 0.289688 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:51.165140 0.089691 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:51.165520 2.657098 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 SPA_* 0 0 30 18260 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:32:51.255240 0.227223 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:51.482886 0.219529 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:51.702892 0.060662 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:32:51.763938 0.069994 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 07:33:05.152611 0.404244 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 2120 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:10.882464 0.396981 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 2264 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:15.888136 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:33:16.762624 0.399370 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:28.095263 4.777556 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 20 10968 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:33.682413 0.000231 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:38.962585 2.790299 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:43.888844 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:33:47.037765 2.789923 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:33:55.102447 0.400757 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:05.502660 0.395475 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:10.384882 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:34:10.782706 0.403122 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:21.497838 0.403220 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:26.777683 0.401189 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:32.062648 3.117818 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:36.892709 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:34:40.062817 2.650410 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:48.142564 3.120731 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:34:55.997733 2.790283 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:00.886937 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:35:04.067818 2.720165 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:12.067996 4.098739 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 16 11000 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:18.958171 3.905479 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 21 13238 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:27.997731 0.409006 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:33.422631 0.402063 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1768 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:43.822857 0.396577 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:48.886241 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:35:49.258042 0.409288 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:35:59.657951 0.398669 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:04.937899 0.401904 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:15.334119 0.401097 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:20.391746 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:36:20.612915 0.400737 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:31.328327 4.160070 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 11 4938 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:36.927923 4.640139 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 18 9660 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:43.008003 3.120702 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:45.387568 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:36:48.447962 3.128693 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:53.887888 4.960306 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 14 6548 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:36:59.647967 2.400075 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 12 6440 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:07.327968 0.401601 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:12.386292 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:37:17.737997 0.406742 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:23.028192 0.403909 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:33.428130 0.418990 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:33.559618 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 07:37:38.713212 4.900375 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 21 12718 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:40.567120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:37:43.891531 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:37:43.901109 1.442004 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 6 4092 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:48.568864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:37:50.778305 2.720056 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:37:58.778069 2.730189 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:04.571618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:38:06.788114 0.407168 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:11.891750 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:38:17.188010 0.402081 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:22.463170 0.394129 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:32.868267 0.404632 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:36.577589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:38:37.889206 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:38:38.293085 0.397604 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:43.573327 2.689998 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 17 10182 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:48.988408 0.407505 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:38:54.413314 3.124395 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 9 4814 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:39:01.883578 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:39:02.263346 3.055103 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:39:35.121592 1.138199 tcp 10.0.2.105 54317 -> 58.177.94.240 9222 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/08 07:44:40.583314 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 07:44:47.590944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:44:55.592229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:45:11.595308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:45:43.602477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:54:52.613558 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 07:54:59.620959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:55:07.622504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:55:23.625259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:55:55.631439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 07:57:47.362480 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 07:57:47.362591 0.594030 tcp 10.0.2.105 54318 -> 31.192.24.67 3527 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:01:59.637251 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 08:02:06.644735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:02:14.646204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:02:30.649191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:03:02.655342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:03:07.542499 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:03:07.542588 0.000000 udp 10.0.2.105 7010 -> 86.136.207.119 8059 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:03:23.937611 0.050110 tcp 10.0.2.105 54319 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:23.987980 0.073784 tcp 10.0.2.105 54320 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:24.062023 0.157736 tcp 10.0.2.105 54321 -> 195.113.214.251 443 SRPA* 0 0 33 23239 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:24.220635 0.140059 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.361134 0.078233 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.439759 0.164794 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.604967 0.087516 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.692909 0.212500 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.905836 0.048470 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:24.906151 2.995383 tcp 10.0.2.105 54322 -> 190.205.193.197 4858 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:03:24.954640 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:03:33.900186 0.000000 tcp 10.0.2.105 54322 -> 190.205.193.197 4858 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:03:40.490387 0.050476 tcp 10.0.2.105 54323 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:40.541132 0.078284 tcp 10.0.2.105 54324 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:40.619788 0.161311 tcp 10.0.2.105 54325 -> 195.113.214.251 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:40.781672 0.401080 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:41.183107 0.172941 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:41.356535 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:03:58.075539 0.050305 tcp 10.0.2.105 54326 -> 195.113.214.221 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:58.126108 0.075972 tcp 10.0.2.105 54327 -> 195.113.214.251 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:58.202375 0.159284 tcp 10.0.2.105 54328 -> 195.113.214.251 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:03:58.362172 0.078552 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.441084 0.070917 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.512453 0.147546 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.660555 0.088626 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.749678 0.145845 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.896103 0.073849 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:58.896533 2.994492 tcp 10.0.2.105 54329 -> 70.48.162.47 2124 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:03:58.970363 0.145681 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:59.116701 0.184255 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:59.301368 0.293949 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:59.595765 0.080432 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:59.676575 0.168901 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:03:59.845894 1.970301 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:04:01.816800 0.028943 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:04:01.846133 0.071326 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:04:01.917883 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:04:07.888667 0.000000 tcp 10.0.2.105 54329 -> 70.48.162.47 2124 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:04:17.683786 0.048287 tcp 10.0.2.105 54330 -> 195.113.214.221 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:04:17.732443 0.071422 tcp 10.0.2.105 54331 -> 195.113.214.251 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:04:17.804311 0.159485 tcp 10.0.2.105 54332 -> 195.113.214.251 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:04:17.964292 0.216199 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:09:06.661473 3.001405 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 08:09:13.669102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:09:21.670158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:09:37.673118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:10:09.871778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:16:13.695475 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 08:16:20.702680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:16:28.703672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:16:44.707012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:17:16.713331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:23:20.719181 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 08:23:27.727012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:23:35.728600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:23:51.731047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:24:23.737323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:27:47.961533 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:27:47.961640 0.754920 tcp 10.0.2.105 54333 -> 31.192.24.67 3527 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:30:27.745668 2.999281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 08:30:34.750727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:30:42.752980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:30:58.765150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:31:30.761173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:34:35.657147 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:34:35.657245 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:34:52.833569 3.003308 tcp 10.0.2.105 54334 -> 195.113.214.221 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:35:00.392638 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:35:01.834617 0.000000 tcp 10.0.2.105 54334 -> 195.113.214.221 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:35:13.003850 4.002844 udp 10.0.2.105 59089 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:14.005393 3.001417 udp 10.0.2.105 59089 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:15.493447 3.996502 udp 10.0.2.105 61721 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:16.485652 3.004400 udp 10.0.2.105 61721 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:21.012002 0.000000 udp 10.0.2.105 59089 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:21.012122 0.000000 udp 10.0.2.105 59089 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:23.495934 0.000000 udp 10.0.2.105 61721 -> 8.8.8.8 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:23.496036 0.000000 udp 10.0.2.105 61721 -> 8.8.4.4 53 REQ 0 1 76 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:24.387099 3.114608 arp 10.0.2.105 who 10.0.2.2 CON 4 168 flow=Background-ARP 1970/02/08 08:35:25.065000 1.495091 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:25.080062 1.480029 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/02/08 08:35:27.311401 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:35:43.074024 1.136861 tcp 10.0.2.105 54335 -> 195.113.214.234 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:36:14.739406 0.000112 tcp 10.0.2.105 54335 -> 195.113.214.234 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:36:14.743613 0.250234 udp 10.0.2.105 50237 <-> 8.8.8.8 53 CON 0 0 2 183 flow=From-Botnet-V2-DNS 1970/02/08 08:36:14.994299 2.999731 tcp 10.0.2.105 54336 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:36:23.992970 0.000000 tcp 10.0.2.105 54336 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:36:30.384717 4.003239 udp 10.0.2.105 64854 -> 8.8.8.8 53 INT 0 2 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:36:31.383796 3.245882 udp 10.0.2.105 64854 <-> 8.8.4.4 53 CON 0 0 4 320 flow=From-Botnet-V2-DNS 1970/02/08 08:36:34.630242 0.959161 udp 10.0.2.105 51606 -> 8.8.4.4 53 INT 0 3 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:36:34.999002 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:36:39.387105 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:36:50.294026 4.236045 tcp 10.0.2.105 54337 -> 195.113.214.234 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:36:54.293665 0.000000 udp 10.0.2.105 60385 -> 8.8.8.8 53 INT 0 1 73 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:36:55.289362 0.245793 udp 10.0.2.105 60385 <-> 8.8.4.4 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/02/08 08:36:55.535748 0.246105 tcp 10.0.2.105 54338 -> 195.113.214.226 80 SPA_* 0 0 5 578 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:37:26.283869 0.000120 tcp 10.0.2.105 54338 -> 195.113.214.226 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:37:26.385956 3.663611 tcp 10.0.2.105 54339 -> 204.79.197.200 80 SPA_* 0 0 6 603 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:37:34.767496 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 08:37:41.774628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:37:42.931444 0.000144 tcp 10.0.2.105 54338 -> 195.113.214.226 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:37:49.775792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:38:00.553129 0.000097 tcp 10.0.2.105 54339 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:00.553546 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:38:05.778952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:38:14.741933 0.000000 tcp 10.0.2.105 54335 ?> 195.113.214.234 80 RA_ 0 1 54 flow=Background 1970/02/08 08:38:15.744983 1.549359 tcp 10.0.2.105 54340 -> 195.113.214.234 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:17.054671 1.933237 tcp 10.0.2.105 54341 -> 195.113.214.226 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:18.757910 0.974124 tcp 10.0.2.105 54342 -> 195.113.214.226 443 SPA_* 0 0 24 11765 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:37.785349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:38:50.233052 0.000118 tcp 10.0.2.105 54342 -> 195.113.214.226 443 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:50.234236 4.847099 tcp 10.0.2.105 54343 -> 204.79.197.200 80 SRPA* 0 0 31 24263 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:38:55.081757 0.456158 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:38:55.538411 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:38:55.538800 3.006023 tcp 10.0.2.105 54344 -> 190.205.193.197 4858 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:39:04.543393 0.000000 tcp 10.0.2.105 54344 -> 190.205.193.197 4858 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:39:11.097348 1.455416 tcp 10.0.2.105 54345 -> 195.113.214.234 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:39:12.553152 3.506854 tcp 10.0.2.105 54346 -> 195.113.214.226 80 FSPA* 0 0 11 1987 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:39:16.060421 2.249310 tcp 10.0.2.105 54347 -> 195.113.214.226 443 FSRP* 0 0 26 6976 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:39:17.822700 0.389742 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:39:18.212940 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:39:18.213352 2.984208 tcp 10.0.2.105 54348 -> 99.135.106.151 4390 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:39:27.208553 0.000000 tcp 10.0.2.105 54348 -> 99.135.106.151 4390 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:39:34.838817 0.533059 tcp 10.0.2.105 54349 -> 195.113.214.234 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:39:35.372219 1.250959 tcp 10.0.2.105 54350 -> 195.113.214.226 80 SPA_* 0 0 5 578 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:00.553916 0.000000 tcp 10.0.2.105 54339 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 08:40:05.391124 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:40:07.123456 0.230491 tcp 10.0.2.105 54350 -> 195.113.214.226 80 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:07.124624 0.249110 tcp 10.0.2.105 54351 -> 204.79.197.200 80 SPA_* 0 0 5 541 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:15.959900 0.525607 tcp 10.0.2.105 54351 -> 204.79.197.200 80 FRA_* 0 0 10 3160 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:16.215956 0.308162 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:40:16.524489 0.394468 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:40:16.919330 0.568815 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:40:17.488796 0.326806 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:40:17.489193 0.268591 tcp 10.0.2.105 54352 -> 212.17.122.207 3945 SPA_* 0 0 5 443 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:17.816027 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:40:33.232087 4.736524 tcp 10.0.2.105 54353 -> 195.113.214.234 80 SPA_* 0 0 6 605 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:47.751935 0.000080 tcp 10.0.2.105 54352 -> 212.17.122.207 3945 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:40:50.235663 0.000000 tcp 10.0.2.105 54342 ?> 195.113.214.226 443 RA_ 0 1 54 flow=Background 1970/02/08 08:41:08.471932 0.000086 tcp 10.0.2.105 54353 -> 195.113.214.234 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:41:08.472778 3.003242 tcp 10.0.2.105 54354 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:41:16.947733 0.000434 tcp 10.0.2.105 54354 -> 204.79.197.200 80 PA_SA 0 0 4 479 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:41:22.765461 0.197138 tcp 10.0.2.105 54354 -> 204.79.197.200 80 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:41:53.269566 0.000096 tcp 10.0.2.105 54354 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:41:53.270016 0.000000 udp 10.0.2.105 7010 -> 70.48.162.47 5207 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:42:12.124986 2.992539 tcp 10.0.2.105 54355 -> 195.113.214.234 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:42:16.889978 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:42:21.131381 0.000000 tcp 10.0.2.105 54355 -> 195.113.214.234 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:42:27.397954 0.000425 tcp 10.0.2.105 54355 -> 195.113.214.234 80 PA_SA 0 0 4 481 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:42:37.686207 0.001202 tcp 10.0.2.105 54355 -> 195.113.214.234 80 FA_PA 0 0 3 1239 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:42:37.687838 3.006271 tcp 10.0.2.105 54356 -> 195.113.214.226 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:42:46.693203 0.000000 tcp 10.0.2.105 54356 -> 195.113.214.226 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:42:47.754145 0.000000 tcp 10.0.2.105 54352 ?> 212.17.122.207 3945 RA_ 0 1 54 flow=Background 1970/02/08 08:42:57.689532 3.669407 tcp 10.0.2.105 54357 -> 204.79.197.200 80 SPA_* 0 0 6 603 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:43:08.475038 0.000000 tcp 10.0.2.105 54353 ?> 195.113.214.234 80 RA_ 0 1 54 flow=Background 1970/02/08 08:43:08.991769 0.000166 tcp 10.0.2.105 54356 -> 195.113.214.226 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:43:31.857640 0.000092 tcp 10.0.2.105 54357 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:43:31.858126 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:43:47.511044 3.003521 tcp 10.0.2.105 54358 -> 195.113.214.234 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:43:53.258810 0.000000 tcp 10.0.2.105 54354 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 08:43:55.391593 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:43:56.513330 0.000000 tcp 10.0.2.105 54358 -> 195.113.214.234 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:44:07.520001 1.229618 tcp 10.0.2.105 54359 -> 204.79.197.200 80 SPA_* 0 0 5 541 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:44:37.692603 0.000000 tcp 10.0.2.105 54355 ?> 195.113.214.234 80 RA_ 0 1 54 flow=Background 1970/02/08 08:44:39.244924 0.000077 tcp 10.0.2.105 54359 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:44:39.245321 0.000000 udp 10.0.2.105 7010 -> 70.30.170.125 3161 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:44:41.790897 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 08:44:48.798491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:44:56.560590 3.003273 tcp 10.0.2.105 54360 -> 195.113.214.207 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:44:56.800130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:45:00.287192 0.000151 tcp 10.0.2.105 54358 -> 195.113.214.234 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:45:04.391139 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:45:05.562531 0.000000 tcp 10.0.2.105 54360 -> 195.113.214.207 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:45:11.821664 0.000402 tcp 10.0.2.105 54360 -> 195.113.214.207 80 PA_SA 0 0 4 481 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:45:12.803183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:45:22.100882 0.240407 tcp 10.0.2.105 54360 -> 195.113.214.207 80 FA_F* 0 0 5 1347 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:45:22.102486 2.998321 tcp 10.0.2.105 54361 -> 195.113.214.249 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:45:31.099325 0.000000 tcp 10.0.2.105 54361 -> 195.113.214.249 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:45:31.860040 0.000000 tcp 10.0.2.105 54357 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 08:45:42.107278 3.002298 tcp 10.0.2.105 54362 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:45:44.809126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:45:46.891913 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:45:51.108258 0.000000 tcp 10.0.2.105 54362 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:46:02.114099 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:46:17.727421 1.243281 tcp 10.0.2.105 54363 -> 195.113.214.207 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:46:39.237142 0.000000 tcp 10.0.2.105 54359 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 08:46:43.883875 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:46:49.472018 0.000101 tcp 10.0.2.105 54363 -> 195.113.214.207 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:46:49.472793 3.003716 tcp 10.0.2.105 54364 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:46:58.477050 0.000000 tcp 10.0.2.105 54364 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:47:09.482368 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:47:14.389094 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:47:27.857798 0.246125 tcp 10.0.2.105 54365 -> 195.113.214.207 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:47:52.854029 0.000149 tcp 10.0.2.105 54364 -> 204.79.197.200 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:47:57.389554 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:47:58.601452 0.000129 tcp 10.0.2.105 54365 -> 195.113.214.207 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:47:58.602430 3.003184 tcp 10.0.2.105 54366 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:48:07.604231 0.000000 tcp 10.0.2.105 54366 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:48:18.610721 0.000000 udp 10.0.2.105 7010 -> 99.128.195.100 7061 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:48:23.387274 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:48:29.909817 0.000127 tcp 10.0.2.105 54366 -> 204.79.197.200 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:48:35.795832 3.242466 tcp 10.0.2.105 54367 -> 195.113.214.207 80 SPA_* 0 0 6 605 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:48:49.474575 0.000000 tcp 10.0.2.105 54363 ?> 195.113.214.207 80 RA_ 0 1 54 flow=Background 1970/02/08 08:49:09.533284 0.000085 tcp 10.0.2.105 54367 -> 195.113.214.207 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:49:09.534981 2.992800 tcp 10.0.2.105 54368 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:49:18.536569 0.000000 tcp 10.0.2.105 54368 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:49:29.542479 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:49:34.388908 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:49:48.400159 4.553491 tcp 10.0.2.105 54369 -> 195.113.214.207 80 FSPA* 0 0 11 1952 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:49:52.953949 0.051186 tcp 10.0.2.105 54370 -> 195.113.214.226 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:49:53.005400 0.157124 tcp 10.0.2.105 54371 -> 195.113.214.226 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:49:53.163204 0.311498 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/08 08:49:53.475053 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:49:58.603940 0.000000 tcp 10.0.2.105 54365 ?> 195.113.214.207 80 RA_ 0 1 54 flow=Background 1970/02/08 08:50:09.800381 2.332463 tcp 10.0.2.105 54372 -> 195.113.214.207 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:50:42.627334 0.000074 tcp 10.0.2.105 54372 -> 195.113.214.207 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:50:42.628196 3.003425 tcp 10.0.2.105 54373 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:50:47.829696 0.000154 tcp 10.0.2.105 54372 -> 195.113.214.207 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:50:51.630182 0.000000 tcp 10.0.2.105 54373 -> 204.79.197.200 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:51:02.636452 0.000000 udp 10.0.2.105 7010 -> 79.227.136.221 2430 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:51:07.382792 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:51:09.535726 0.000000 tcp 10.0.2.105 54367 ?> 195.113.214.207 80 RA_ 0 1 54 flow=Background 1970/02/08 08:51:13.949533 0.000129 tcp 10.0.2.105 54373 -> 204.79.197.200 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:51:20.342435 3.003316 tcp 10.0.2.105 54374 -> 195.113.214.207 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:51:29.344385 0.000000 tcp 10.0.2.105 54374 -> 195.113.214.207 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:51:33.890261 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:51:40.350814 3.251008 tcp 10.0.2.105 54375 -> 204.79.197.200 80 SPA_* 0 0 6 603 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:51:49.173043 0.200391 tcp 10.0.2.105 54375 -> 204.79.197.200 80 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:51:58.895084 2.602059 tcp 10.0.2.105 54375 -> 204.79.197.200 80 FRA_* 0 0 7 1950 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:52:00.745610 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:52:17.795933 4.925496 tcp 10.0.2.105 54376 -> 195.113.214.251 80 FSPA* 0 0 8 1782 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:52:22.721885 1.249162 tcp 10.0.2.105 54377 -> 195.113.214.226 80 SPA_* 0 0 5 578 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:52:33.040053 0.000315 tcp 10.0.2.105 54374 -> 195.113.214.207 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:52:54.466964 0.000075 tcp 10.0.2.105 54377 -> 195.113.214.226 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:52:54.467901 3.003178 tcp 10.0.2.105 54378 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:53:02.173313 0.000402 tcp 10.0.2.105 54378 -> 204.79.197.200 80 PA_SA 0 0 4 479 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:53:20.478137 0.000813 tcp 10.0.2.105 54378 -> 204.79.197.200 80 FRA_* 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:53:20.479446 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:53:38.851204 2.446161 tcp 10.0.2.105 54379 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:54:11.797939 0.000101 tcp 10.0.2.105 54379 -> 195.113.214.251 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:54:11.798979 0.658129 tcp 10.0.2.105 54380 -> 204.79.197.200 80 SPA_* 0 0 5 541 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:54:22.723712 0.000000 tcp 10.0.2.105 54376 ?> 195.113.214.251 80 RA_ 0 1 54 flow=Background 1970/02/08 08:54:42.953182 0.000090 tcp 10.0.2.105 54380 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:54:42.953748 0.000000 udp 10.0.2.105 7010 -> 76.218.219.95 7916 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 08:54:53.825725 2.998399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 08:54:54.474404 0.000000 tcp 10.0.2.105 54377 ?> 195.113.214.226 80 RA_ 0 1 54 flow=Background 1970/02/08 08:54:58.796734 1.437661 tcp 10.0.2.105 54381 -> 195.113.214.251 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:55:00.234631 4.549520 tcp 10.0.2.105 54382 -> 195.113.214.226 80 FSPA* 0 0 11 1987 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:55:00.828585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:55:04.784774 0.135668 tcp 10.0.2.105 54383 -> 195.113.214.226 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:55:08.832514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:55:24.833372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:55:56.839159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 08:56:11.800570 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:56:11.800721 0.000000 tcp 10.0.2.105 54379 ?> 195.113.214.251 80 RA_ 0 1 54 flow=Background 1970/02/08 08:56:42.958114 0.000000 tcp 10.0.2.105 54380 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 08:56:47.892492 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:57:48.720259 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 08:57:48.720399 3.003696 tcp 10.0.2.105 54384 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:57:57.722775 0.220857 tcp 10.0.2.105 54384 -> 31.192.24.67 3527 SPA_* 0 0 9 1079 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:27.947716 1.269099 tcp 10.0.2.105 54385 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:33.323787 0.001195 tcp 10.0.2.105 54385 -> 195.113.214.251 80 FA_PA 0 0 3 1239 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:33.325363 2.998342 tcp 10.0.2.105 54386 -> 195.113.214.226 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:58:42.327154 0.551161 tcp 10.0.2.105 54386 -> 195.113.214.226 80 SPA_* 0 0 5 578 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:53.174926 0.000452 tcp 10.0.2.105 54386 -> 195.113.214.226 80 FA_PA 0 0 3 1239 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:53.175951 3.341921 tcp 10.0.2.105 54387 -> 195.113.214.226 443 FSRP* 0 0 20 5192 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:56.524732 0.000088 tcp 10.0.2.105 54384 -> 31.192.24.67 3527 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:58:56.525010 2.996730 tcp 10.0.2.105 54388 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:59:05.520732 0.000000 tcp 10.0.2.105 54388 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 08:59:11.519679 3.234192 tcp 10.0.2.105 54389 -> 195.113.214.251 80 SPA_* 0 0 6 605 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:59:15.670389 0.000123 tcp 10.0.2.105 54385 -> 195.113.214.251 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:59:53.699925 0.000100 tcp 10.0.2.105 54389 -> 195.113.214.251 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 08:59:53.700876 3.002919 tcp 10.0.2.105 54390 -> 204.79.197.200 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:00:00.983869 0.000428 tcp 10.0.2.105 54390 -> 204.79.197.200 80 PA_SA 0 0 4 479 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:00:31.483839 0.000080 tcp 10.0.2.105 54390 -> 204.79.197.200 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:00:31.484229 2.994010 tcp 10.0.2.105 54391 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:00:40.486905 0.000000 tcp 10.0.2.105 54391 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:00:46.486192 2.534135 tcp 10.0.2.105 54392 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:00:53.175033 0.000000 tcp 10.0.2.105 54386 ?> 195.113.214.226 80 RA_ 0 1 54 flow=Background 1970/02/08 09:00:56.519799 0.000000 tcp 10.0.2.105 54384 ?> 31.192.24.67 3527 RA_ 0 1 54 flow=Background 1970/02/08 09:01:18.371455 0.000100 tcp 10.0.2.105 54392 -> 195.113.214.251 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:01:18.372574 4.474758 tcp 10.0.2.105 54393 -> 204.79.197.200 80 SRPA* 0 0 29 24898 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:01:22.973273 2.999604 tcp 10.0.2.105 54394 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:01:31.971479 0.000000 tcp 10.0.2.105 54394 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:01:37.970935 0.665462 tcp 10.0.2.105 54395 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:01:53.701958 0.000000 tcp 10.0.2.105 54389 ?> 195.113.214.251 80 RA_ 0 1 54 flow=Background 1970/02/08 09:02:00.845758 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:02:07.852775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:02:15.853994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:02:22.733956 0.000096 tcp 10.0.2.105 54395 -> 195.113.214.251 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:02:22.734758 3.751535 tcp 10.0.2.105 54396 -> 204.79.197.200 80 FSRP* 0 0 12 3787 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:02:24.173264 2.986563 tcp 10.0.2.105 54397 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:02:31.486663 0.000000 tcp 10.0.2.105 54390 ?> 204.79.197.200 80 RA_ 0 1 54 flow=Background 1970/02/08 09:02:31.857072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:02:33.159203 0.269424 tcp 10.0.2.105 54397 -> 31.192.24.67 3527 SPA_* 0 0 9 1079 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:03.422587 0.000111 tcp 10.0.2.105 54397 -> 31.192.24.67 3527 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:03.422906 3.003580 tcp 10.0.2.105 54398 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:03:03.863304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:03:12.425495 0.000000 tcp 10.0.2.105 54398 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:03:18.374940 0.000000 tcp 10.0.2.105 54392 ?> 195.113.214.251 80 RA_ 0 1 54 flow=Background 1970/02/08 09:03:18.425861 2.992694 tcp 10.0.2.105 54399 -> 195.113.214.251 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:03:27.427090 0.539902 tcp 10.0.2.105 54399 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:38.035820 0.001106 tcp 10.0.2.105 54399 -> 195.113.214.251 80 FA_F* 0 0 5 1347 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:38.037443 0.050324 tcp 10.0.2.105 54400 -> 195.113.214.226 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:38.088141 0.246471 tcp 10.0.2.105 54401 -> 195.113.214.226 443 FSRP* 0 0 26 9148 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:03:38.384874 3.001943 tcp 10.0.2.105 54402 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:03:47.385661 0.000000 tcp 10.0.2.105 54402 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:03:53.384437 2.994292 tcp 10.0.2.105 54403 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:04:02.392950 0.000000 tcp 10.0.2.105 54403 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:04:07.385100 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:04:22.736842 0.000000 tcp 10.0.2.105 54395 ?> 195.113.214.251 80 RA_ 0 1 54 flow=Background 1970/02/08 09:05:03.424483 0.000000 tcp 10.0.2.105 54397 ?> 31.192.24.67 3527 RA_ 0 1 54 flow=Background 1970/02/08 09:05:08.391965 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:09:07.869137 3.001396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:09:08.387809 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:09:08.387902 3.003392 tcp 10.0.2.105 54404 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:09:14.876200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:09:17.389958 0.000000 tcp 10.0.2.105 54404 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:09:22.877955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:09:23.390870 1.230568 tcp 10.0.2.105 54405 -> 195.113.214.251 80 SPA_* 0 0 5 543 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:09:38.880827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:09:58.208769 0.000075 tcp 10.0.2.105 54405 -> 195.113.214.251 80 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:09:58.212032 4.002231 udp 10.0.2.105 50776 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:09:59.209712 3.004661 udp 10.0.2.105 50776 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:06.220417 0.000000 udp 10.0.2.105 50776 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:06.220559 0.000000 udp 10.0.2.105 50776 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:09.634121 0.000136 tcp 10.0.2.105 54405 -> 195.113.214.251 80 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:10:10.225914 1.502588 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:10.225993 1.502509 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/02/08 09:10:10.886616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:10:12.479572 3.003897 tcp 10.0.2.105 54406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:10:21.482080 0.000000 tcp 10.0.2.105 54406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:10:26.389300 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:10:27.481659 3.003464 tcp 10.0.2.105 54407 -> 195.113.214.251 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:10:36.483719 0.000000 tcp 10.0.2.105 54407 -> 195.113.214.251 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:10:47.493088 4.002192 udp 10.0.2.105 54497 -> 8.8.8.8 53 INT 0 2 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:48.490965 3.004413 udp 10.0.2.105 54497 -> 8.8.4.4 53 INT 0 3 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:52.386099 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:10:55.500885 0.000000 udp 10.0.2.105 54497 -> 8.8.8.8 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:55.500983 0.000000 udp 10.0.2.105 54497 -> 8.8.4.4 53 REQ 0 1 72 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:59.507145 1.502139 udp 10.0.2.105 137 -> 10.0.2.255 137 INT 0 3 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:10:59.507204 1.502080 icmp 10.0.2.2 0x0003 -> 10.0.2.105 0x0a00 URN 192 3 360 flow=Background 1970/02/08 09:11:01.760362 3.003760 tcp 10.0.2.105 54408 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:10.763110 0.000000 tcp 10.0.2.105 54408 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:16.761979 3.003927 tcp 10.0.2.105 54409 -> 195.113.214.245 80 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:21.388421 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:11:25.765368 0.000000 tcp 10.0.2.105 54409 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:30.589508 0.000201 tcp 10.0.2.105 54407 -> 195.113.214.251 80 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:31.789374 0.075438 tcp 10.0.2.105 54409 -> 195.113.214.245 80 FPA_* 0 0 9 1828 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:31.867949 0.011400 udp 10.0.2.105 63156 <-> 8.8.8.8 53 CON 0 0 2 386 flow=From-Botnet-V2-DNS 1970/02/08 09:11:31.879865 0.079757 tcp 10.0.2.105 54410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:31.959989 0.131359 tcp 10.0.2.105 54411 -> 195.113.214.249 443 SRPA* 0 0 36 27819 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:32.290492 2.997528 tcp 10.0.2.105 54412 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:41.297135 0.000000 tcp 10.0.2.105 54412 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:47.286305 0.075146 tcp 10.0.2.105 54413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:47.361815 0.074908 tcp 10.0.2.105 54414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:47.437013 0.165526 tcp 10.0.2.105 54415 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:11:47.889697 3.001058 tcp 10.0.2.105 54416 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:11:56.889278 0.000000 tcp 10.0.2.105 54416 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:12:02.888789 0.070656 tcp 10.0.2.105 54417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:12:02.959714 0.075907 tcp 10.0.2.105 54418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:12:03.035879 0.138178 tcp 10.0.2.105 54419 -> 195.113.214.249 443 SRPA* 0 0 33 23239 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:12:03.586194 0.552005 tcp 10.0.2.105 54420 -> 31.192.24.67 3527 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:16:14.893701 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:16:21.900644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:16:29.901700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:16:45.904935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:17:17.910934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:23:21.916540 3.001823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 09:23:28.924428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:23:36.925808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:23:52.928999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:24:24.934295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:25:24.931616 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:25:24.931705 0.206665 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:25.138789 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 4734 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:25:40.385750 0.076398 tcp 10.0.2.105 54421 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:40.462424 0.075397 tcp 10.0.2.105 54422 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:40.538086 0.165610 tcp 10.0.2.105 54423 -> 195.113.214.249 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:40.704499 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:25:56.247008 0.074396 tcp 10.0.2.105 54424 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:56.321671 0.071582 tcp 10.0.2.105 54425 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:56.393606 0.161142 tcp 10.0.2.105 54426 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:25:56.555268 4.212577 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1138 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:56.605710 3.523693 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 4 991 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:56.606055 2.994906 tcp 10.0.2.105 54427 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:25:56.695702 3.564876 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 4 1073 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:56.829563 3.519899 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 4 1099 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:56.920620 3.577130 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1003 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.066813 3.579785 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 4 1122 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.214495 3.497654 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 1259 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.288627 3.626710 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 4 1134 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.436443 3.553479 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 4 1272 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.508457 3.646197 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1197 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.677613 3.757767 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 4 1184 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:57.958171 3.647433 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 4 1002 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.126287 3.628428 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 4 949 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.269187 3.548249 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1280 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.339407 3.509901 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 4 1003 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.368214 0.225299 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.593888 3.473661 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 4 1129 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.807686 3.425213 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 4 1140 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:58.973889 3.428461 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 4 1280 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:59.146034 3.330605 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 4 1301 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:59.226049 3.251050 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 3 638 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:59.337271 0.356702 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:59.694411 0.083923 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:25:59.834457 0.208460 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:26:05.600922 0.000000 tcp 10.0.2.105 54427 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 09:26:10.446746 0.221692 udp 10.0.2.105 7010 <-> 76.218.219.95 7916 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:26:10.668872 0.131248 udp 10.0.2.105 7010 <-> 79.16.45.75 2977 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:26:10.800561 0.336885 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:26:11.137963 0.000000 udp 10.0.2.105 7010 -> 203.144.15.203 9044 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:16.575544 0.000000 udp 10.0.2.105 7010 -> 50.147.54.161 7355 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:21.392558 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:26:22.337060 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:29.624362 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:36.915058 0.000000 udp 10.0.2.105 7010 -> 187.162.113.149 6616 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:44.826052 0.097768 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:26:45.289223 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:49.384795 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:26:51.045362 0.000000 udp 10.0.2.105 7010 -> 79.53.65.9 1433 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:26:59.227255 0.000000 udp 10.0.2.105 7010 -> 195.234.148.228 7290 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:08.003581 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 4856 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:16.221297 0.000000 udp 10.0.2.105 7010 -> 184.71.56.226 7454 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:20.887813 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:27:24.072927 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:32.235274 0.000000 udp 10.0.2.105 7010 -> 176.221.167.25 1233 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:40.696860 0.000000 udp 10.0.2.105 7010 -> 86.138.11.206 6515 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:45.382993 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:27:49.038699 0.000000 udp 10.0.2.105 7010 -> 105.237.57.168 6590 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:27:56.719433 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:05.241664 0.000000 udp 10.0.2.105 7010 -> 173.166.247.149 7351 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:09.888520 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:28:14.154541 0.000000 udp 10.0.2.105 7010 -> 75.158.140.215 4320 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:20.113015 0.000000 udp 10.0.2.105 7010 -> 66.166.28.203 7822 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:27.323565 0.000000 udp 10.0.2.105 7010 -> 78.183.17.219 8882 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:35.645613 0.164619 udp 10.0.2.105 7010 -> 64.239.200.83 5081 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:35.810232 0.000000 icmp 64.239.192.74 0x000b -> 10.0.2.105 0x0000 TXD 192 1 251 flow=Background 1970/02/08 09:28:40.393074 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:28:41.463796 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 1029 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:49.986131 0.000000 udp 10.0.2.105 7010 -> 94.14.77.42 3614 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:28:55.415912 0.000000 udp 10.0.2.105 7010 -> 190.219.1.134 3038 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:03.341109 0.112451 udp 10.0.2.105 7010 <-> 85.74.89.27 7527 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:29:03.722235 0.000000 udp 10.0.2.105 7010 -> 171.99.231.154 9451 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:07.901960 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:29:09.473950 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:15.352787 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 1027 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:22.766177 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:30.033851 0.000000 udp 10.0.2.105 7010 -> 87.234.200.227 7696 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:34.890769 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:29:38.145339 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:45.325701 0.000000 udp 10.0.2.105 7010 -> 24.0.198.69 2078 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:53.938010 0.141116 udp 10.0.2.105 7010 -> 188.169.236.190 4092 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:29:54.079126 0.000000 icmp 188.169.236.190 0x0303 -> 10.0.2.105 0xfc0f URP 192 1 200 flow=Background 1970/02/08 09:29:58.884840 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:30:02.410175 0.000000 udp 10.0.2.105 7010 -> 62.103.214.8 4029 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:07.827899 0.000000 udp 10.0.2.105 7010 -> 98.230.205.175 8502 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:13.075539 0.000000 udp 10.0.2.105 7010 -> 93.193.140.128 7662 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:21.437703 0.000000 udp 10.0.2.105 7010 -> 79.42.157.52 2593 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:26.384033 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:30:28.940524 3.002181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:30:29.419070 0.000000 udp 10.0.2.105 7010 -> 66.161.182.130 5661 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:35.949459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:30:37.350458 0.000000 udp 10.0.2.105 7010 -> 82.211.186.210 8830 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:43.949661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:30:44.199889 0.000000 udp 10.0.2.105 7010 -> 83.4.137.92 7393 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:50.599803 0.056935 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:50.656738 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 304 flow=Background 1970/02/08 09:30:55.386256 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:30:58.130368 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:30:59.952690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:31:04.989084 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:10.558207 0.000000 udp 10.0.2.105 7010 -> 79.52.78.193 5580 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:17.969104 0.000000 udp 10.0.2.105 7010 -> 2.220.238.133 6698 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:22.885865 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:31:23.959001 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:31.968787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:31:32.770251 0.000000 udp 10.0.2.105 7010 -> 79.77.213.71 6034 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:41.252357 0.000000 udp 10.0.2.105 7010 -> 181.228.24.198 4919 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:50.005066 0.000000 udp 10.0.2.105 7010 -> 109.99.21.244 4784 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:31:54.891595 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:31:56.864776 0.000000 udp 10.0.2.105 7010 -> 91.183.201.190 6902 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:05.727803 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:11.095453 0.000000 udp 10.0.2.105 7010 -> 96.21.43.44 4475 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:18.606112 0.157683 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:18.763795 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 229 flow=Background 1970/02/08 09:32:23.382742 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:32:24.123992 0.000000 udp 10.0.2.105 7010 -> 122.170.105.70 5732 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:30.242908 0.235444 udp 10.0.2.105 7010 <-> 79.241.212.220 5162 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:32:30.498107 0.000000 udp 10.0.2.105 7010 -> 75.151.248.1 1025 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:37.693666 0.000000 udp 10.0.2.105 7010 -> 77.176.86.179 5139 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:45.695579 0.000000 udp 10.0.2.105 7010 -> 24.157.36.2 9575 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:32:50.391430 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:32:54.487527 0.000000 udp 10.0.2.105 7010 -> 82.79.66.92 2378 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:00.526768 0.000000 udp 10.0.2.105 7010 -> 84.253.2.58 4080 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:07.145818 0.000000 udp 10.0.2.105 7010 -> 162.237.52.245 3340 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:16.048600 0.000000 udp 10.0.2.105 7010 -> 88.78.136.78 4541 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:20.888730 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:33:24.721423 0.000000 udp 10.0.2.105 7010 -> 98.235.38.238 3480 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:31.160402 0.000000 udp 10.0.2.105 7010 -> 82.54.94.55 1675 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:36.508176 0.079527 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:33:36.807514 0.000000 udp 10.0.2.105 7010 -> 184.53.228.158 2936 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:44.269364 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:48.885825 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:33:49.597064 0.293074 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:33:49.906254 0.000000 udp 10.0.2.105 7010 -> 24.96.182.194 2475 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:33:56.997432 0.000000 udp 10.0.2.105 7010 -> 86.169.15.96 2915 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:05.739994 0.517182 udp 10.0.2.105 7010 <-> 188.253.71.131 9013 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:34:06.391978 0.000000 udp 10.0.2.105 7010 -> 190.87.190.58 4498 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:11.689046 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:16.385489 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:34:19.670382 0.000000 udp 10.0.2.105 7010 -> 2.193.237.163 4752 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:26.860690 2.368794 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:34:29.342821 0.000000 udp 10.0.2.105 7010 -> 108.69.108.60 9293 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:36.233976 0.000000 udp 10.0.2.105 7010 -> 87.12.203.18 1373 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:40.890355 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:34:44.906695 0.114628 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:34:45.058935 0.000000 udp 10.0.2.105 7010 -> 39.55.178.201 4862 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:34:53.969040 0.000000 udp 10.0.2.105 7010 -> 87.14.174.101 3126 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:02.752441 0.000000 udp 10.0.2.105 7010 -> 78.97.152.166 4185 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:07.388868 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:35:07.839088 0.000000 udp 10.0.2.105 7010 -> 216.36.190.176 9785 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:13.677638 0.163237 udp 10.0.2.105 7010 <-> 141.164.72.139 5264 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:35:13.890982 0.000000 udp 10.0.2.105 7010 -> 88.231.46.167 2157 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:19.987002 0.022979 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:35:20.195545 0.000000 udp 10.0.2.105 7010 -> 95.247.135.203 1682 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:27.880383 0.216856 udp 10.0.2.105 7010 -> 186.6.14.232 3659 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:28.097239 0.000000 icmp 186.6.14.232 0x0303 -> 10.0.2.105 0x4b0e URP 192 1 119 flow=Background 1970/02/08 09:35:32.384646 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:35:35.301310 0.000000 udp 10.0.2.105 7010 -> 87.7.252.199 2363 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:41.748226 0.000000 udp 10.0.2.105 7010 -> 93.167.107.63 5449 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:48.157186 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 1628 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:35:56.679570 0.000000 udp 10.0.2.105 7010 -> 24.178.204.173 9576 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:01.386490 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:36:05.552289 0.000000 udp 10.0.2.105 7010 -> 188.169.46.140 2195 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:13.584062 0.188861 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:36:13.882378 0.000000 udp 10.0.2.105 7010 -> 216.254.156.227 3017 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:20.914477 0.133801 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:36:21.086338 0.000000 udp 10.0.2.105 7010 -> 216.43.174.194 5087 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:25.891452 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:36:28.425206 0.000000 udp 10.0.2.105 7010 -> 122.161.71.94 1237 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:35.815737 0.092406 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:36:35.954236 0.042520 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:36:36.008619 0.066238 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:36:36.164538 0.000000 udp 10.0.2.105 7010 -> 189.164.8.50 6736 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:43.914363 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:49.936187 0.000000 udp 10.0.2.105 7010 -> 98.113.198.15 1690 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:36:54.883116 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:36:57.667284 0.000000 udp 10.0.2.105 7010 -> 190.100.23.138 5273 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:05.728942 0.000000 udp 10.0.2.105 7010 -> 186.155.88.115 2270 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:14.160435 0.000000 udp 10.0.2.105 7010 -> 182.237.17.227 8132 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:18.887421 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:37:19.488830 0.000000 udp 10.0.2.105 7010 -> 115.84.253.146 4252 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:28.481553 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:33.879356 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:35.974580 3.002252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:37:41.179574 0.000000 udp 10.0.2.105 7010 -> 24.66.140.112 7854 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:42.985208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:37:45.886528 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:37:48.572844 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:37:50.983167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:37:54.204016 0.047134 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/02/08 09:37:54.396045 0.000000 udp 10.0.2.105 7010 -> 184.149.59.13 8561 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:01.742949 0.000000 udp 10.0.2.105 7010 -> 81.174.38.201 6943 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:06.990818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:38:07.250710 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:11.883782 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:38:13.716806 0.000000 udp 10.0.2.105 7010 -> 189.245.148.195 1174 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:20.500700 0.000000 udp 10.0.2.105 7010 -> 37.37.85.212 6648 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:27.562122 0.000000 udp 10.0.2.105 7010 -> 82.50.44.80 8548 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:36.549691 0.000000 udp 10.0.2.105 7010 -> 82.58.139.24 2083 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:38.992814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:38:41.386357 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:38:45.402122 0.000000 udp 10.0.2.105 7010 -> 118.15.148.125 5294 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:38:52.682733 0.000000 udp 10.0.2.105 7010 -> 24.173.170.26 3750 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:00.654168 0.103584 udp 10.0.2.105 7010 -> 41.34.199.54 1558 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:00.757752 0.000000 icmp 41.34.199.54 0x0303 -> 10.0.2.105 0x1606 URP 192 1 276 flow=Background 1970/02/08 09:39:05.390507 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:39:07.413664 0.000000 udp 10.0.2.105 7010 -> 79.9.219.169 6028 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:13.063268 0.000000 udp 10.0.2.105 7010 -> 66.240.7.34 7030 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:21.725980 0.000000 udp 10.0.2.105 7010 -> 86.5.231.189 7490 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:28.093554 0.000000 udp 10.0.2.105 7010 -> 41.218.224.152 7728 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 09:39:32.893276 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:42:04.137823 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 09:42:04.137990 0.601722 tcp 10.0.2.105 54428 -> 31.192.24.67 3527 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/02/08 09:44:42.999097 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 09:44:50.006271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:44:58.007590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:45:14.010862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:45:46.016908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:54:50.030967 3.002494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 09:54:57.039084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:55:05.039964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:55:21.043744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 09:55:53.058887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:01:57.055172 3.002494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:02:04.063950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:02:12.064398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:02:28.067376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:03:00.076883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:09:04.080418 3.000601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:09:11.086924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:09:19.088708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:09:35.091454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:09:55.350988 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:09:55.351170 0.119835 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:09:55.471401 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:10:00.797941 0.000000 udp 10.0.2.105 7010 <- 79.25.16.144 9715 RSP 0 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:10:00.798607 0.090026 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:00.799151 3.003572 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 10:10:00.888991 0.267370 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.156763 0.146405 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.303600 0.149569 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.453623 0.074313 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.528495 0.045542 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.574406 0.146203 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.720989 0.070128 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.791456 0.169433 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:01.961248 0.212722 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:02.174322 0.167443 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:02.342223 0.272928 udp 10.0.2.105 7010 <-> 58.177.94.240 1685 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:02.615532 0.172901 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:02.788780 0.144093 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:02.933228 0.070091 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:03.003756 0.029309 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:03.033414 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:10:06.094791 0.000369 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 PA_SA 0 0 4 476 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:07.097452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:10:11.947298 3.505512 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 9 3998 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:18.135375 3.603152 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 11 7326 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:21.199829 0.075546 tcp 10.0.2.105 54430 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:21.275606 0.079494 tcp 10.0.2.105 54431 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:21.355455 0.180761 tcp 10.0.2.105 54432 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:21.536759 0.080703 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:21.617938 0.000000 udp 10.0.2.105 7010 -> 79.16.45.75 2977 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:10:24.403965 3.794161 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:30.587919 3.708505 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 17 9110 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:36.561363 3.813944 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:40.446206 0.074353 tcp 10.0.2.105 54433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:40.520832 0.075275 tcp 10.0.2.105 54434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:40.596384 0.159141 tcp 10.0.2.105 54435 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:40.756375 0.033859 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:10:40.790659 0.000000 udp 10.0.2.105 7010 -> 76.218.219.95 7916 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:10:42.535824 3.888106 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:48.530839 3.691309 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:54.625797 3.465109 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 10 8104 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:10:59.807757 4.843477 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 21 11374 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:00.532743 0.074200 tcp 10.0.2.105 54436 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:00.607198 0.075369 tcp 10.0.2.105 54437 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:00.683014 0.159175 tcp 10.0.2.105 54438 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:00.842762 0.097173 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:00.940514 0.099206 udp 10.0.2.105 7010 <-> 85.74.89.27 7527 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:01.040117 0.000000 udp 10.0.2.105 7010 -> 79.241.212.220 5162 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:11:07.103632 3.799991 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:13.357917 3.245005 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 17 9110 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:18.227715 0.070671 tcp 10.0.2.105 54439 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:18.298644 0.068301 tcp 10.0.2.105 54440 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:18.367213 0.158006 tcp 10.0.2.105 54441 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:18.525858 0.085917 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:18.612186 0.281988 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:18.894600 0.498759 udp 10.0.2.105 7010 <-> 188.253.71.131 9013 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:19.130933 3.313015 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:19.393717 0.165207 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:19.559299 0.114565 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:19.674230 0.165925 udp 10.0.2.105 7010 <-> 141.164.72.139 5264 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:19.840744 0.019439 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:19.860550 0.201538 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:20.062457 0.134613 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:20.197518 0.042005 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:20.239975 0.082978 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:20.373499 0.063455 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:20.437435 0.044655 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:11:24.804508 3.175145 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:30.795953 3.302950 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:37.222179 3.429976 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:42.103600 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:11:43.893031 3.023892 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:49.789122 3.155148 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:11:55.954314 3.071293 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:01.946575 3.096578 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:05.678877 0.566873 tcp 10.0.2.105 54442 -> 31.192.24.67 3527 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:08.117521 2.901820 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:14.157466 2.936557 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:20.278957 2.868721 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:26.278795 3.150568 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:31.006558 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:12:32.870918 3.227013 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:39.446423 2.872599 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:45.607839 3.037515 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:52.020918 2.999470 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:58.293072 3.146513 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:12:59.660637 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:13:04.673400 3.199002 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:10.941877 3.102105 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:17.399672 2.936744 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:23.789709 2.834417 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 14 8948 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:30.277289 2.726241 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:36.713103 2.689716 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:42.798787 2.492456 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:47.885081 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:13:48.407004 2.242057 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:53.616419 2.260259 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 12 8840 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:13:58.738578 4.908772 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 22 15524 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:05.334602 3.390335 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 18 9164 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:10.434579 3.217574 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 18 9164 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:15.547672 3.161455 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 16 9056 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:20.675407 4.953928 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 23 11482 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:26.913902 4.873809 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 34 16172 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:32.388373 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:14:33.690792 4.166067 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 22 11428 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:38.994242 4.570664 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 32 16064 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:45.353484 4.149944 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 22 11428 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:50.918083 4.343855 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 30 15956 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:14:56.931246 4.329574 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 21 11374 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:02.671818 4.246721 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 30 15956 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:07.389123 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:15:08.806614 4.400945 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 22 11428 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:14.585027 4.798733 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 26 15740 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:19.586732 4.065917 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 18 9164 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:25.141596 4.389555 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 22 11428 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:31.284498 4.475482 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 33 16118 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:36.390866 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:15:37.187190 3.970350 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 24 11536 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:42.447351 4.288452 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 33 16118 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:48.257101 4.697665 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 23 11482 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:15:54.078541 4.535447 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 32 16064 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:00.256625 4.196507 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 23 11482 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:05.642972 4.847647 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 32 16064 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:06.884636 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:16:11.103753 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 10:16:11.925041 4.042603 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 24 11536 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:17.711747 4.675349 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 33 16118 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:18.111044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:16:23.796908 4.518637 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_PA 0 0 24 11536 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:26.112579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:16:29.738961 4.704503 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 FPA_* 0 0 36 16010 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:37.936992 0.000139 tcp 10.0.2.105 54429 -> 79.25.16.144 9148 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:16:42.130080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:17:14.121615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:23:18.127819 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:23:25.135263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:23:33.136565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:23:49.139530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:24:21.145641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:30:25.150922 3.018361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:30:32.168715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:30:40.170062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:30:56.175277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:31:28.179498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:37:32.187030 3.000319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:37:39.193060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:37:47.194059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:38:03.197285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:38:35.203443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:41:35.933803 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 10:41:35.933901 0.172665 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:41:36.106973 0.000000 udp 10.0.2.105 7010 -> 76.218.219.95 7916 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:41:53.130283 0.075101 tcp 10.0.2.105 54443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:41:53.205720 0.125109 tcp 10.0.2.105 54444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:41:53.331088 0.153785 tcp 10.0.2.105 54445 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:41:53.485702 0.000000 udp 10.0.2.105 7010 -> 79.16.45.75 2977 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:42:05.326025 0.637654 tcp 10.0.2.105 54446 -> 31.192.24.67 3527 FSPA* 0 0 14 1555 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:09.943088 0.075048 tcp 10.0.2.105 54447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:10.018486 0.109827 tcp 10.0.2.105 54448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:10.128618 0.158441 tcp 10.0.2.105 54449 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:10.287593 0.000000 udp 10.0.2.105 7010 -> 79.241.212.220 5162 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:42:27.187752 0.130519 tcp 10.0.2.105 54450 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:27.318561 0.079174 tcp 10.0.2.105 54451 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:27.398085 0.162157 tcp 10.0.2.105 54452 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:27.560886 0.090111 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:27.651336 0.145522 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:27.797236 0.087213 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:27.884805 1.523535 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:29.408757 0.208386 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:29.617500 0.148868 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:29.766825 0.163753 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:29.930960 0.040713 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:29.972010 0.219423 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.191843 0.073541 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.265741 0.147993 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.414088 0.070440 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.484891 0.168992 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.654242 0.070324 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.724965 0.169269 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:30.894598 0.143500 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:31.038544 0.000000 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:42:48.900132 0.076598 tcp 10.0.2.105 54453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:48.977036 0.076103 tcp 10.0.2.105 54454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:49.053492 0.165888 tcp 10.0.2.105 54455 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:42:49.220044 0.029613 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.250078 0.077389 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.327897 0.167110 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.495432 0.097814 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.593761 0.104482 udp 10.0.2.105 7010 <-> 85.74.89.27 7527 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.698667 0.077831 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:49.776888 0.278185 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:42:50.055537 0.000000 udp 10.0.2.105 7010 -> 188.253.71.131 9013 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 10:43:08.476083 0.074578 tcp 10.0.2.105 54456 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:43:08.550935 0.076312 tcp 10.0.2.105 54457 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:43:08.627610 0.168129 tcp 10.0.2.105 54458 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 10:43:08.796413 0.168132 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:08.964952 0.114323 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.079682 0.166986 udp 10.0.2.105 7010 <-> 141.164.72.139 5264 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.247108 0.133218 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.380722 0.041941 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.423085 0.089828 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.513298 0.063845 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.577531 0.066296 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.644232 0.022073 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:43:09.666644 0.195817 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/08 10:44:39.210152 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 10:44:46.218774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:44:54.218381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:45:10.221315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:45:42.227470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:54:49.236937 3.029273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 10:54:56.254857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:55:04.255394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:55:20.258559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 10:55:52.274279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:01:56.285955 2.997140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 11:02:03.291283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:02:11.289236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:02:27.301325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:02:59.298624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:09:03.304853 3.001370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 11:09:10.312017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:09:18.313456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:09:34.319712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:10:06.322547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:12:05.964938 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:12:05.965021 0.559778 tcp 10.0.2.105 54459 -> 31.192.24.67 3527 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:13:34.261807 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:13:34.261903 0.287430 udp 10.0.2.105 7010 -> 58.177.94.240 1685 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 11:13:34.549333 0.000000 icmp 58.177.94.240 0x0303 -> 10.0.2.105 0x9506 URP 192 1 303 flow=Background 1970/02/08 11:13:50.096607 0.092921 tcp 10.0.2.105 54460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:13:50.189825 0.071512 tcp 10.0.2.105 54461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:13:50.261612 0.157501 tcp 10.0.2.105 54462 -> 195.113.214.249 443 SRPA* 0 0 35 18208 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:13:50.419804 0.000000 udp 10.0.2.105 7010 -> 188.253.71.131 9013 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 11:14:08.009967 0.076038 tcp 10.0.2.105 54463 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:14:08.086264 0.074421 tcp 10.0.2.105 54464 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:14:08.160990 0.156271 tcp 10.0.2.105 54465 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:14:08.317904 0.171976 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:08.490409 0.143359 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:08.634168 0.089625 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:08.724222 0.085964 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:08.810569 0.144269 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:08.955247 0.166767 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.122433 0.046361 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.169189 0.217777 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.387403 0.204519 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.592565 0.100098 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.693103 0.074497 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.767966 0.069037 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:09.837439 0.168273 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.006105 0.142329 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.148800 0.072228 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.221441 0.167949 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.389744 0.148749 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.538887 0.078497 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.617762 0.030026 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.648187 0.023608 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.672123 0.281119 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:10.953628 0.097335 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.051329 0.107520 udp 10.0.2.105 7010 <-> 85.74.89.27 7527 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.159236 0.077219 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.236845 0.164398 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.401657 0.102209 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.504272 0.165263 udp 10.0.2.105 7010 <-> 141.164.72.139 5264 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.669958 0.135217 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.805572 0.061999 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.867922 0.044182 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.912513 0.017786 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:11.930667 0.195026 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:12.126014 0.050546 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:14:12.176929 0.088340 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:16:10.328283 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 11:16:17.335813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:16:25.337343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:16:41.340813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:17:13.346354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:23:17.351907 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 11:23:24.359990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:23:32.361205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:23:48.364930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:24:20.370254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:30:24.376750 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 11:30:31.383580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:30:39.385340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:30:55.388502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:31:27.394323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:37:31.399863 3.002371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 11:37:38.407545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:37:46.410956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:38:02.412192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:38:34.418231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:42:06.523738 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:42:06.523902 3.003702 tcp 10.0.2.105 54466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:15.536260 0.000000 tcp 10.0.2.105 54466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:21.526646 0.073523 tcp 10.0.2.105 54467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:21.600422 0.077565 tcp 10.0.2.105 54468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:21.678326 0.144449 tcp 10.0.2.105 54469 -> 195.113.214.249 443 SRPA* 0 0 37 27023 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:22.030978 2.999222 tcp 10.0.2.105 54470 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:31.028556 0.000000 tcp 10.0.2.105 54470 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:37.028239 0.075335 tcp 10.0.2.105 54471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:37.103852 0.071746 tcp 10.0.2.105 54472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:37.175966 0.159214 tcp 10.0.2.105 54473 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:37.512543 3.000564 tcp 10.0.2.105 54474 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:46.511464 0.000000 tcp 10.0.2.105 54474 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:42:52.510322 0.074272 tcp 10.0.2.105 54475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:52.584845 0.075858 tcp 10.0.2.105 54476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:52.660972 0.165188 tcp 10.0.2.105 54477 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:42:53.022750 3.000972 tcp 10.0.2.105 54478 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:02.023024 0.000000 tcp 10.0.2.105 54478 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:08.022061 0.074203 tcp 10.0.2.105 54479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:43:08.096531 0.076879 tcp 10.0.2.105 54480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:43:08.173710 0.156325 tcp 10.0.2.105 54481 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:43:08.353335 3.007845 tcp 10.0.2.105 54482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:17.355116 0.000000 tcp 10.0.2.105 54482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:23.353894 2.994305 tcp 10.0.2.105 54483 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:32.356754 0.000000 tcp 10.0.2.105 54483 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:36.883183 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:43:38.355275 2.994257 tcp 10.0.2.105 54484 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:47.350951 0.000000 tcp 10.0.2.105 54484 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:43:53.357131 2.993962 tcp 10.0.2.105 54485 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:44:00.886937 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:44:02.349508 0.000000 tcp 10.0.2.105 54485 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:44:21.157090 0.088236 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.245736 0.087136 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.333325 0.147500 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.481279 0.165656 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.647416 0.043061 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.690896 0.212538 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:21.903828 0.172242 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.076525 0.144274 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.221203 0.205543 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.427146 0.105487 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.532997 0.070870 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.604257 0.068196 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.672845 0.166556 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.839773 0.143519 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:22.983630 0.070915 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.054933 0.168126 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.223410 0.145146 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.368954 0.073997 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.443346 0.028040 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.471762 0.028433 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.500705 0.288131 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:23.789209 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 11:44:25.886719 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:44:38.430864 2.999030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 11:44:39.109048 0.077310 tcp 10.0.2.105 54486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:39.186670 0.075662 tcp 10.0.2.105 54487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:39.262682 0.163472 tcp 10.0.2.105 54488 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:39.426698 0.000000 udp 10.0.2.105 7010 -> 85.74.89.27 7527 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 11:44:45.431775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:44:53.433173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:44:54.525300 0.074350 tcp 10.0.2.105 54489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:54.599954 0.071994 tcp 10.0.2.105 54490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:54.672314 0.156338 tcp 10.0.2.105 54491 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:44:54.829331 0.087729 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:54.917504 0.164930 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.082825 0.114378 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.351092 0.158835 udp 10.0.2.105 7010 <-> 141.164.72.139 5264 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.510417 0.141729 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.652558 0.062448 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.715448 0.045596 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.761443 0.020163 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.782018 0.188625 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:55.971020 0.042900 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:44:56.014278 0.092231 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/08 11:45:09.436440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:45:41.443741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:49:08.363377 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:49:08.363540 3.000579 tcp 10.0.2.105 54492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:17.362571 0.000000 tcp 10.0.2.105 54492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:23.363204 0.070929 tcp 10.0.2.105 54493 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:23.434405 0.068084 tcp 10.0.2.105 54494 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:23.502859 0.175968 tcp 10.0.2.105 54495 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:23.690779 3.005527 tcp 10.0.2.105 54496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:32.694575 0.000000 tcp 10.0.2.105 54496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:38.683985 0.066731 tcp 10.0.2.105 54497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:38.751085 0.075644 tcp 10.0.2.105 54498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:38.826948 0.163606 tcp 10.0.2.105 54499 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:39.098889 2.988710 tcp 10.0.2.105 54500 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:48.096801 0.000000 tcp 10.0.2.105 54500 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:49:54.096052 0.074317 tcp 10.0.2.105 54501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:54.170641 0.072083 tcp 10.0.2.105 54502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:54.243005 0.158117 tcp 10.0.2.105 54503 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:49:54.434993 2.995552 tcp 10.0.2.105 54504 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:03.429019 0.000000 tcp 10.0.2.105 54504 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:09.428190 0.071294 tcp 10.0.2.105 54505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:50:09.499770 0.071451 tcp 10.0.2.105 54506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:50:09.571577 0.162225 tcp 10.0.2.105 54507 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:50:09.808645 2.993469 tcp 10.0.2.105 54508 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:18.801141 0.000000 tcp 10.0.2.105 54508 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:24.799605 3.004501 tcp 10.0.2.105 54509 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:33.803092 0.000000 tcp 10.0.2.105 54509 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:38.389121 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:50:39.807462 3.000139 tcp 10.0.2.105 54510 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:48.810751 0.000000 tcp 10.0.2.105 54510 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:50:54.802959 3.009201 tcp 10.0.2.105 54511 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:51:02.386593 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:51:03.805560 0.000000 tcp 10.0.2.105 54511 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:54:50.454367 3.001840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 11:54:57.462008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:55:05.463552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:55:21.466090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:55:53.472335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 11:56:09.806209 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 11:56:09.806392 2.993186 tcp 10.0.2.105 54512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:56:18.798237 0.000000 tcp 10.0.2.105 54512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:56:24.809310 0.067661 tcp 10.0.2.105 54513 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:56:24.877216 0.075840 tcp 10.0.2.105 54514 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:56:24.953328 0.157829 tcp 10.0.2.105 54515 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/08 11:56:25.174651 2.998009 tcp 10.0.2.105 54516 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 11:56:34.170370 0.000000 tcp 10.0.2.105 54516 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:01:40.170878 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:01:40.171068 3.003811 tcp 10.0.2.105 54517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:01:49.173531 0.000000 tcp 10.0.2.105 54517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:01:55.173865 0.070770 tcp 10.0.2.105 54518 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:01:55.244888 0.070692 tcp 10.0.2.105 54519 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:01:55.315828 0.155697 tcp 10.0.2.105 54520 -> 195.113.214.249 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:01:55.507514 3.009746 tcp 10.0.2.105 54521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:01:57.478385 3.004305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:02:04.485773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:02:04.515771 0.000000 tcp 10.0.2.105 54521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:02:12.487198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:02:28.490534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:03:00.496615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:09:04.502115 3.001567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 12:09:11.509636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:09:19.511284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:09:35.514042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:10:07.520088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:15:24.285719 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:15:24.285895 0.000000 udp 10.0.2.105 7010 -> 85.74.89.27 7527 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:15:40.520757 0.065690 tcp 10.0.2.105 54522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:40.586674 0.062786 tcp 10.0.2.105 54523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:40.649752 0.158022 tcp 10.0.2.105 54524 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:40.808337 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:15:58.895968 0.063457 tcp 10.0.2.105 54525 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:58.959742 0.064444 tcp 10.0.2.105 54526 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:59.024527 0.164697 tcp 10.0.2.105 54527 -> 195.113.214.249 443 SRPA* 0 0 22 13086 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:15:59.189801 0.128208 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.279174 0.103462 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.366838 0.089274 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.416718 0.236694 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.629310 0.175975 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.801965 0.167672 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:15:59.949570 0.174998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.117350 0.171282 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.273240 0.076245 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.348472 0.215547 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.557153 0.181065 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.730714 0.172960 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.877331 0.081783 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:00.950352 0.173810 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.121908 0.170965 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.298407 0.165451 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.407304 0.087464 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.479829 0.098811 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.554839 0.041442 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.603568 0.044991 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.633013 0.289070 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:01.934136 0.116126 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:02.058773 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 8693 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:16:10.562540 3.004298 tcp 10.0.2.105 54528 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:11.526106 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:16:18.533448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:16:19.565014 0.000000 tcp 10.0.2.105 54528 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:20.787515 0.063788 tcp 10.0.2.105 54529 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:20.851601 0.065198 tcp 10.0.2.105 54530 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:20.917101 0.159317 tcp 10.0.2.105 54531 -> 195.113.214.249 443 SRPA* 0 0 20 11286 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:21.077248 0.167353 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:21.244411 0.000000 udp 10.0.2.105 7010 -> 141.164.72.139 5264 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:16:25.564138 0.060852 tcp 10.0.2.105 54532 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:25.625254 0.061573 tcp 10.0.2.105 54533 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:25.687089 0.156235 tcp 10.0.2.105 54534 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:25.853462 2.994502 tcp 10.0.2.105 54535 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:26.535222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:16:34.856824 0.000000 tcp 10.0.2.105 54535 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:37.481465 0.059963 tcp 10.0.2.105 54536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:37.541766 0.064859 tcp 10.0.2.105 54537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:37.606921 0.162629 tcp 10.0.2.105 54538 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:37.770076 0.146332 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:37.908369 0.525178 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:38.412878 0.058385 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:38.495735 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:16:40.845993 0.062775 tcp 10.0.2.105 54539 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:40.909036 0.065121 tcp 10.0.2.105 54540 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:40.974499 0.157157 tcp 10.0.2.105 54541 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:41.152485 2.997432 tcp 10.0.2.105 54542 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:42.538059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:16:50.149001 0.000000 tcp 10.0.2.105 54542 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:16:54.556649 0.060999 tcp 10.0.2.105 54543 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:54.617933 0.065560 tcp 10.0.2.105 54544 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:54.683771 0.154921 tcp 10.0.2.105 54545 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:54.839324 0.210059 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:55.048626 0.053972 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:55.230553 0.119360 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:16:56.147933 0.060871 tcp 10.0.2.105 54546 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:56.209059 0.064769 tcp 10.0.2.105 54547 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:56.274195 0.154689 tcp 10.0.2.105 54548 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:16:56.448451 3.004193 tcp 10.0.2.105 54549 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:17:05.451030 0.000000 tcp 10.0.2.105 54549 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:17:11.449764 3.004275 tcp 10.0.2.105 54550 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:17:14.544347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:17:20.452862 0.000000 tcp 10.0.2.105 54550 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:17:25.389606 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:17:26.451399 3.004204 tcp 10.0.2.105 54551 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:17:35.454187 0.000000 tcp 10.0.2.105 54551 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:22:41.454726 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:22:41.454997 2.993289 tcp 10.0.2.105 54552 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:22:50.459782 0.000000 tcp 10.0.2.105 54552 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:22:56.457797 0.061609 tcp 10.0.2.105 54553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:22:56.519653 0.080213 tcp 10.0.2.105 54554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:22:56.600138 0.166387 tcp 10.0.2.105 54555 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:22:56.886534 2.994002 tcp 10.0.2.105 54556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:05.879263 0.000000 tcp 10.0.2.105 54556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:11.893674 0.206799 tcp 10.0.2.105 54557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:12.100746 0.060211 tcp 10.0.2.105 54558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:12.161289 0.154764 tcp 10.0.2.105 54559 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:12.334167 2.969642 tcp 10.0.2.105 54560 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:18.636373 2.971286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:23:21.249444 0.000000 tcp 10.0.2.105 54560 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:25.582628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:23:27.198803 0.060395 tcp 10.0.2.105 54561 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:27.259469 0.061178 tcp 10.0.2.105 54562 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:27.320947 0.152745 tcp 10.0.2.105 54563 -> 195.113.214.249 443 SRPA* 0 0 38 32996 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:23:27.653771 3.001278 tcp 10.0.2.105 54564 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:33.559161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:23:36.653423 0.000000 tcp 10.0.2.105 54564 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:42.642253 3.004222 tcp 10.0.2.105 54565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:49.562000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:23:51.645981 0.000000 tcp 10.0.2.105 54565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:23:56.381829 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:23:57.643650 2.994312 tcp 10.0.2.105 54566 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:24:06.646631 0.000000 tcp 10.0.2.105 54566 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:24:21.568111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:29:12.647749 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:29:12.647928 2.993038 tcp 10.0.2.105 54567 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:21.639378 0.000000 tcp 10.0.2.105 54567 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:27.649593 0.064366 tcp 10.0.2.105 54568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:27.714257 0.061422 tcp 10.0.2.105 54569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:27.775988 0.156104 tcp 10.0.2.105 54570 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:28.038170 2.994991 tcp 10.0.2.105 54571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:37.031480 0.000000 tcp 10.0.2.105 54571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:43.030694 0.060205 tcp 10.0.2.105 54572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:43.091213 0.061527 tcp 10.0.2.105 54573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:43.153037 0.157160 tcp 10.0.2.105 54574 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:43.463146 3.001962 tcp 10.0.2.105 54575 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:52.465085 0.000000 tcp 10.0.2.105 54575 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:29:58.463596 0.063567 tcp 10.0.2.105 54576 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:58.527437 0.063060 tcp 10.0.2.105 54577 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:58.590771 0.165774 tcp 10.0.2.105 54578 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:29:58.787463 2.989734 tcp 10.0.2.105 54579 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:07.785552 0.000000 tcp 10.0.2.105 54579 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:13.784675 2.994360 tcp 10.0.2.105 54580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:22.787462 0.000000 tcp 10.0.2.105 54580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:25.574838 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:30:27.384119 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:30:28.785979 2.994448 tcp 10.0.2.105 54581 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:32.581436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:30:37.778920 0.000000 tcp 10.0.2.105 54581 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:30:40.582809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:30:56.585946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:31:28.591958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:35:43.788896 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:35:43.788993 3.004140 tcp 10.0.2.105 54582 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:35:52.791820 0.000000 tcp 10.0.2.105 54582 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:35:58.792867 0.064196 tcp 10.0.2.105 54583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:35:58.857319 0.062521 tcp 10.0.2.105 54584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:35:58.920212 0.152698 tcp 10.0.2.105 54585 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:35:59.179064 2.996231 tcp 10.0.2.105 54586 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:08.173808 0.000000 tcp 10.0.2.105 54586 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:14.173387 0.063607 tcp 10.0.2.105 54587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:14.237331 0.062639 tcp 10.0.2.105 54588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:14.300250 0.151535 tcp 10.0.2.105 54589 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:14.462103 3.005035 tcp 10.0.2.105 54590 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:23.479302 0.000000 tcp 10.0.2.105 54590 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:29.455868 0.061357 tcp 10.0.2.105 54591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:29.517568 0.064089 tcp 10.0.2.105 54592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:29.581984 0.156673 tcp 10.0.2.105 54593 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:36:29.780406 2.998950 tcp 10.0.2.105 54594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:38.777827 0.000000 tcp 10.0.2.105 54594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:44.776706 2.994301 tcp 10.0.2.105 54595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:53.769482 0.000000 tcp 10.0.2.105 54595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:36:58.386156 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:36:59.778252 3.004315 tcp 10.0.2.105 54596 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:37:08.781256 0.000000 tcp 10.0.2.105 54596 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:37:32.598382 3.001171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:37:39.605793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:37:47.611954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:38:03.610096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:38:35.616047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:42:14.781577 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:42:14.781760 3.003452 tcp 10.0.2.105 54597 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:42:23.783759 0.000000 tcp 10.0.2.105 54597 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:42:29.784289 0.061125 tcp 10.0.2.105 54598 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:29.845787 0.061051 tcp 10.0.2.105 54599 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:29.907178 0.158629 tcp 10.0.2.105 54600 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:30.191702 3.005531 tcp 10.0.2.105 54601 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:42:39.206019 0.000000 tcp 10.0.2.105 54601 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:42:45.185269 0.060466 tcp 10.0.2.105 54602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:45.246036 0.060569 tcp 10.0.2.105 54603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:45.306894 0.152044 tcp 10.0.2.105 54604 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:42:45.535433 2.984175 tcp 10.0.2.105 54605 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:42:54.518530 0.000000 tcp 10.0.2.105 54605 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:43:00.527078 2.994073 tcp 10.0.2.105 54606 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:43:09.520002 0.000000 tcp 10.0.2.105 54606 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:43:14.386425 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:44:39.621996 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:44:46.629738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:44:54.631056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:45:10.633744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:45:42.640136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:47:18.307979 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:47:18.308085 0.163819 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:18.472447 0.000000 udp 10.0.2.105 7010 -> 141.164.72.139 5264 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:47:35.354039 0.064565 tcp 10.0.2.105 54607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:35.418851 0.068658 tcp 10.0.2.105 54608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:35.487743 0.155835 tcp 10.0.2.105 54609 -> 195.113.214.249 443 SRPA* 0 0 42 21468 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:35.644425 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 12:47:50.975046 0.060507 tcp 10.0.2.105 54610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:51.035819 0.065274 tcp 10.0.2.105 54611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:51.101456 0.163818 tcp 10.0.2.105 54612 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:47:51.265807 0.127585 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:51.354791 0.105365 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:51.442987 0.170978 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:51.591955 0.173264 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:51.756854 0.172511 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:52.028254 0.075887 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:52.133183 0.590725 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:52.689241 0.177521 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:52.863839 0.236045 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:53.077747 0.173174 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:53.247153 0.172543 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:53.554851 0.191152 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:53.695924 0.217054 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:53.905238 0.171389 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.048187 0.179574 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.220183 0.082488 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.368421 0.103454 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.670764 0.102999 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.751088 0.084493 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.856835 0.046447 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.887980 0.035136 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:54.983697 0.290537 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:55.365957 0.166474 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:55.568944 0.144315 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:55.705417 0.858325 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:56.543618 0.056100 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:56.616936 0.119600 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:56.701298 0.191547 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:47:56.886361 0.049653 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/08 12:48:15.530120 3.004059 tcp 10.0.2.105 54613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:48:20.386889 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:48:24.532585 0.000000 tcp 10.0.2.105 54613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:48:30.532146 0.061046 tcp 10.0.2.105 54614 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:30.593486 0.061965 tcp 10.0.2.105 54615 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:30.655776 0.158084 tcp 10.0.2.105 54616 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:30.874632 3.001667 tcp 10.0.2.105 54617 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:48:39.874912 0.000000 tcp 10.0.2.105 54617 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:48:45.874181 0.059680 tcp 10.0.2.105 54618 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:45.934162 0.061283 tcp 10.0.2.105 54619 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:45.995759 0.161281 tcp 10.0.2.105 54620 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:48:46.402421 2.996343 tcp 10.0.2.105 54621 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:48:55.407123 0.000000 tcp 10.0.2.105 54621 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:01.396463 0.063587 tcp 10.0.2.105 54622 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:49:01.460330 0.059668 tcp 10.0.2.105 54623 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:49:01.520400 0.155427 tcp 10.0.2.105 54624 -> 195.113.214.249 443 SRPA* 0 0 41 36970 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:49:01.726304 2.994228 tcp 10.0.2.105 54625 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:10.719260 0.000000 tcp 10.0.2.105 54625 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:16.727860 3.004061 tcp 10.0.2.105 54626 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:25.731264 0.000000 tcp 10.0.2.105 54626 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:30.387230 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:49:31.729923 3.003644 tcp 10.0.2.105 54627 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:49:40.732838 0.000000 tcp 10.0.2.105 54627 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:54:46.733006 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:54:46.733088 3.003671 tcp 10.0.2.105 54628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:54:51.651767 3.001767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 12:54:55.735433 0.000000 tcp 10.0.2.105 54628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:54:58.659225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:55:01.735161 0.059683 tcp 10.0.2.105 54629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:01.795105 0.062357 tcp 10.0.2.105 54630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:01.857740 0.155540 tcp 10.0.2.105 54631 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:02.065079 2.993116 tcp 10.0.2.105 54632 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:06.661119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:55:11.067374 0.000000 tcp 10.0.2.105 54632 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:17.066547 0.063513 tcp 10.0.2.105 54633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:17.130316 0.061509 tcp 10.0.2.105 54634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:17.192068 0.158734 tcp 10.0.2.105 54635 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:17.420133 2.990775 tcp 10.0.2.105 54636 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:22.664025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:55:26.409152 0.000000 tcp 10.0.2.105 54636 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:32.418504 0.062864 tcp 10.0.2.105 54637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:32.481700 0.064335 tcp 10.0.2.105 54638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:32.546320 0.153942 tcp 10.0.2.105 54639 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 12:55:32.844966 2.997809 tcp 10.0.2.105 54640 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:41.841608 0.000000 tcp 10.0.2.105 54640 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:47.840198 3.003885 tcp 10.0.2.105 54641 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:55:54.670039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 12:55:56.843178 0.000000 tcp 10.0.2.105 54641 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:56:01.396464 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 12:56:02.842902 3.005733 tcp 10.0.2.105 54642 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 12:56:11.845844 0.000000 tcp 10.0.2.105 54642 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:17.845110 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:01:17.845320 2.996864 tcp 10.0.2.105 54643 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:26.847685 0.000000 tcp 10.0.2.105 54643 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:32.850250 0.062134 tcp 10.0.2.105 54644 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:32.912893 0.064935 tcp 10.0.2.105 54645 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:32.978084 0.159373 tcp 10.0.2.105 54646 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:33.162129 3.005989 tcp 10.0.2.105 54647 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:42.159416 0.000000 tcp 10.0.2.105 54647 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:48.159408 0.060536 tcp 10.0.2.105 54648 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:48.220363 0.064859 tcp 10.0.2.105 54649 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:48.285515 0.150576 tcp 10.0.2.105 54650 -> 195.113.214.249 443 SRPA* 0 0 23 12308 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:01:48.851061 3.002157 tcp 10.0.2.105 54651 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:57.852093 0.000000 tcp 10.0.2.105 54651 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:01:58.676021 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:02:03.850608 0.060783 tcp 10.0.2.105 54652 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:02:03.911682 0.062848 tcp 10.0.2.105 54653 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:02:03.974803 0.152711 tcp 10.0.2.105 54654 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:02:04.158123 3.007381 tcp 10.0.2.105 54655 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:02:05.683356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:02:13.163905 0.000000 tcp 10.0.2.105 54655 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:02:13.685012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:02:19.153092 3.003905 tcp 10.0.2.105 54656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:02:28.155759 0.000000 tcp 10.0.2.105 54656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:02:29.687814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:02:32.882518 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:02:34.154671 2.994307 tcp 10.0.2.105 54657 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:02:43.157368 0.000000 tcp 10.0.2.105 54657 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:03:01.693938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:07:49.157633 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:07:49.157816 3.003793 tcp 10.0.2.105 54658 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:07:58.160129 0.000000 tcp 10.0.2.105 54658 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:04.160529 0.060606 tcp 10.0.2.105 54659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:04.221437 0.064754 tcp 10.0.2.105 54660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:04.286533 0.153901 tcp 10.0.2.105 54661 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:04.515014 2.998396 tcp 10.0.2.105 54662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:13.511971 0.000000 tcp 10.0.2.105 54662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:19.511511 0.063612 tcp 10.0.2.105 54663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:19.575450 0.060891 tcp 10.0.2.105 54664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:19.636595 0.153979 tcp 10.0.2.105 54665 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:19.843374 3.002289 tcp 10.0.2.105 54666 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:28.844024 0.000000 tcp 10.0.2.105 54666 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:34.843510 0.060266 tcp 10.0.2.105 54667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:34.904077 0.113440 tcp 10.0.2.105 54668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:35.017836 0.150944 tcp 10.0.2.105 54669 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:08:35.242179 2.985307 tcp 10.0.2.105 54670 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:44.236496 0.000000 tcp 10.0.2.105 54670 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:50.235279 2.993901 tcp 10.0.2.105 54671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:08:59.227982 0.000000 tcp 10.0.2.105 54671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:09:03.886849 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:09:05.237006 2.993841 tcp 10.0.2.105 54672 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:09:05.700191 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:09:12.707273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:09:14.229530 0.000000 tcp 10.0.2.105 54672 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:09:20.708962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:09:36.711915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:10:08.722715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:16:12.723818 3.001971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 13:16:19.731327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:16:27.732896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:16:43.735737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:17:15.741769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:18:19.063531 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:18:19.063635 0.158563 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 3 626 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.218297 0.130487 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.309830 0.105220 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.397117 0.175954 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.602679 0.077700 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.679299 0.170701 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.828180 0.173481 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:19.994502 0.090700 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.046808 0.172478 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.216112 0.178875 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.265085 2.994248 tcp 10.0.2.105 54673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:18:20.391990 0.247053 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2569 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.614016 0.217745 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.824074 0.171940 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:20.967016 0.170961 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.144010 0.160343 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.251559 0.177755 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.422643 0.081381 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.494819 0.127362 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.631839 0.102637 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.712856 0.041577 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:21.757592 0.289781 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:22.065780 0.087213 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:22.135694 0.044969 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:22.203565 1.080100 udp 10.0.2.105 7010 <-> 96.47.201.9 7015 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:23.292578 0.146578 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:23.431592 0.115521 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:23.516474 0.758512 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:24.254314 0.053549 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:24.402604 0.205654 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:24.600476 0.043999 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:18:29.267534 0.000000 tcp 10.0.2.105 54673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:18:35.268061 0.064970 tcp 10.0.2.105 54674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:35.333278 0.061203 tcp 10.0.2.105 54675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:35.394799 0.150482 tcp 10.0.2.105 54676 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:35.557552 3.003326 tcp 10.0.2.105 54677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:18:44.559481 0.000000 tcp 10.0.2.105 54677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:18:50.558510 0.061008 tcp 10.0.2.105 54678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:50.619861 0.062466 tcp 10.0.2.105 54679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:50.682594 0.156655 tcp 10.0.2.105 54680 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:18:50.848572 3.004351 tcp 10.0.2.105 54681 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:18:59.851426 0.000000 tcp 10.0.2.105 54681 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:19:05.850248 3.004017 tcp 10.0.2.105 54682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:19:14.853107 0.000000 tcp 10.0.2.105 54682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:19:19.389580 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:23:19.749282 3.000123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:23:26.755281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:23:34.756904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:23:50.759730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:24:20.853694 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:24:20.853895 3.003375 tcp 10.0.2.105 54683 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:24:22.765793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:24:29.867050 0.000000 tcp 10.0.2.105 54683 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:24:35.857189 0.060435 tcp 10.0.2.105 54684 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:35.917875 0.060094 tcp 10.0.2.105 54685 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:35.978280 0.156557 tcp 10.0.2.105 54686 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:36.247751 3.003107 tcp 10.0.2.105 54687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:24:45.248790 0.000000 tcp 10.0.2.105 54687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:24:51.247346 0.063154 tcp 10.0.2.105 54688 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:51.310795 0.061652 tcp 10.0.2.105 54689 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:51.372709 0.153229 tcp 10.0.2.105 54690 -> 195.113.214.249 443 SRPA* 0 0 21 13032 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:24:51.561359 3.000320 tcp 10.0.2.105 54691 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:00.560193 0.000000 tcp 10.0.2.105 54691 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:06.560318 0.060881 tcp 10.0.2.105 54692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:25:06.621462 0.062532 tcp 10.0.2.105 54693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:25:06.684354 0.157606 tcp 10.0.2.105 54694 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:25:06.968798 3.004753 tcp 10.0.2.105 54695 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:15.973957 0.000000 tcp 10.0.2.105 54695 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:21.961052 3.004148 tcp 10.0.2.105 54696 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:30.963658 0.000000 tcp 10.0.2.105 54696 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:35.880793 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:25:36.962670 3.004068 tcp 10.0.2.105 54697 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:25:45.965635 0.000000 tcp 10.0.2.105 54697 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:30:26.771913 3.001104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:30:33.778997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:30:41.780821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:30:51.965325 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:30:51.965507 2.994167 tcp 10.0.2.105 54698 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:30:57.783874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:31:00.959336 0.000000 tcp 10.0.2.105 54698 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:06.968808 0.062590 tcp 10.0.2.105 54699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:07.031722 0.063433 tcp 10.0.2.105 54700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:07.095434 0.162026 tcp 10.0.2.105 54701 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:07.294439 2.998626 tcp 10.0.2.105 54702 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:16.290433 0.000000 tcp 10.0.2.105 54702 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:22.290248 0.068016 tcp 10.0.2.105 54703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:22.358524 0.063622 tcp 10.0.2.105 54704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:22.422422 0.159223 tcp 10.0.2.105 54705 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:22.632646 3.000949 tcp 10.0.2.105 54706 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:29.789766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:31:31.632095 0.000000 tcp 10.0.2.105 54706 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:37.632482 0.064399 tcp 10.0.2.105 54707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:37.697229 0.061916 tcp 10.0.2.105 54708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:37.759450 0.159791 tcp 10.0.2.105 54709 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:31:38.002020 3.004845 tcp 10.0.2.105 54710 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:47.004295 0.000000 tcp 10.0.2.105 54710 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:31:52.993359 3.004119 tcp 10.0.2.105 54711 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:32:02.005833 0.000000 tcp 10.0.2.105 54711 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:32:06.883760 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:32:07.994867 3.021795 tcp 10.0.2.105 54712 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:32:16.997110 0.000000 tcp 10.0.2.105 54712 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:37:23.008345 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:37:23.008576 3.004444 tcp 10.0.2.105 54713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:37:32.011263 0.000000 tcp 10.0.2.105 54713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:37:33.796973 3.000354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:37:38.010830 0.061724 tcp 10.0.2.105 54714 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:38.072821 0.067154 tcp 10.0.2.105 54715 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:38.140424 0.156064 tcp 10.0.2.105 54716 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:38.396859 2.996942 tcp 10.0.2.105 54717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:37:40.803043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:37:47.395430 0.000000 tcp 10.0.2.105 54717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:37:48.804860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:37:53.393855 0.060725 tcp 10.0.2.105 54718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:53.454925 0.062089 tcp 10.0.2.105 54719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:53.517298 0.163512 tcp 10.0.2.105 54720 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:37:53.810284 3.005658 tcp 10.0.2.105 54721 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:02.814695 0.000000 tcp 10.0.2.105 54721 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:04.807540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:38:08.804451 0.061233 tcp 10.0.2.105 54722 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:38:08.865975 0.065805 tcp 10.0.2.105 54723 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:38:08.932152 0.158529 tcp 10.0.2.105 54724 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:38:09.197715 2.990669 tcp 10.0.2.105 54725 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:18.197057 0.000000 tcp 10.0.2.105 54725 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:24.195915 2.993808 tcp 10.0.2.105 54726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:33.188714 0.000000 tcp 10.0.2.105 54726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:36.813240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:38:37.885309 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:38:39.197231 3.004441 tcp 10.0.2.105 54727 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:38:48.199950 0.000000 tcp 10.0.2.105 54727 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:43:54.201843 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:43:54.202029 3.005485 tcp 10.0.2.105 54728 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:44:03.203063 0.000000 tcp 10.0.2.105 54728 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:44:09.206732 0.061325 tcp 10.0.2.105 54729 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:44:09.268533 0.064764 tcp 10.0.2.105 54730 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:44:09.333613 0.154869 tcp 10.0.2.105 54731 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:44:09.634183 3.002508 tcp 10.0.2.105 54732 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:44:18.635300 0.000000 tcp 10.0.2.105 54732 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:44:40.819085 3.002323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:44:47.826922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:44:55.828583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:45:11.831514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:45:43.837437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:48:52.298415 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:48:52.298637 0.105424 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.387489 0.118308 udp 10.0.2.105 7010 <-> 79.9.27.1 8693 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.484188 0.124254 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.572504 0.174994 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.754813 0.072567 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.826250 0.169265 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:52.970054 0.174225 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.136866 0.096148 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.192115 0.168867 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.357564 0.175786 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.529947 0.176371 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.677518 0.169350 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.824386 0.289559 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:53.962479 0.241515 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.180787 0.216437 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.389189 0.176877 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.558681 0.078634 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 1956 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.629000 0.115633 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.746143 0.097262 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.824191 0.036868 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:54.907716 0.296473 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:55.212638 0.086243 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:55.283761 0.044693 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:48:55.314163 0.000000 udp 10.0.2.105 7010 -> 96.47.201.9 7015 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 13:49:10.486633 0.060660 tcp 10.0.2.105 54733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:10.547572 0.061788 tcp 10.0.2.105 54734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:10.609631 0.153947 tcp 10.0.2.105 54735 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:10.764316 0.086681 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:10.831018 0.065166 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:11.013382 0.144777 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:11.150112 0.115391 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:11.385684 0.220510 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:11.598461 0.052840 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/08 13:49:24.625481 2.993751 tcp 10.0.2.105 54736 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:49:33.618458 0.000000 tcp 10.0.2.105 54736 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:49:38.479561 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:49:39.711939 0.061601 tcp 10.0.2.105 54737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:39.773450 0.062183 tcp 10.0.2.105 54738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:39.835996 0.198806 tcp 10.0.2.105 54739 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:40.101863 2.968653 tcp 10.0.2.105 54740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:49:49.018968 0.000000 tcp 10.0.2.105 54740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:49:54.970762 0.060693 tcp 10.0.2.105 54741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:55.031736 0.059993 tcp 10.0.2.105 54742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:55.091991 0.162688 tcp 10.0.2.105 54743 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:49:55.430260 3.003366 tcp 10.0.2.105 54744 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:04.433206 0.000000 tcp 10.0.2.105 54744 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:10.431621 0.060221 tcp 10.0.2.105 54745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:50:10.492124 0.064851 tcp 10.0.2.105 54746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:50:10.557289 0.153655 tcp 10.0.2.105 54747 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:50:10.737081 2.998498 tcp 10.0.2.105 54748 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:19.734058 0.000000 tcp 10.0.2.105 54748 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:25.733218 3.004083 tcp 10.0.2.105 54749 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:34.745694 0.000000 tcp 10.0.2.105 54749 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:39.382636 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:50:40.734525 2.998136 tcp 10.0.2.105 54750 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:50:49.727204 0.000000 tcp 10.0.2.105 54750 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:54:52.849932 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 13:54:59.857204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:55:07.858537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:55:23.861657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:55:55.737902 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:55:55.738109 3.003661 tcp 10.0.2.105 54751 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:55:55.867475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 13:56:04.740539 0.000000 tcp 10.0.2.105 54751 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:10.743131 0.063389 tcp 10.0.2.105 54752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:10.806737 0.066625 tcp 10.0.2.105 54753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:10.873706 0.159969 tcp 10.0.2.105 54754 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:11.143490 3.000363 tcp 10.0.2.105 54755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:20.142632 0.000000 tcp 10.0.2.105 54755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:26.141638 0.063051 tcp 10.0.2.105 54756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:26.204554 0.062084 tcp 10.0.2.105 54757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:26.266944 0.153836 tcp 10.0.2.105 54758 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:26.492054 3.003703 tcp 10.0.2.105 54759 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:35.494734 0.000000 tcp 10.0.2.105 54759 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:41.493802 0.065784 tcp 10.0.2.105 54760 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:41.559973 0.060550 tcp 10.0.2.105 54761 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:41.620751 0.162409 tcp 10.0.2.105 54762 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 13:56:41.858327 2.999568 tcp 10.0.2.105 54763 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:50.866461 0.000000 tcp 10.0.2.105 54763 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:56:56.855433 2.994026 tcp 10.0.2.105 54764 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:57:05.848110 0.000000 tcp 10.0.2.105 54764 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:57:10.384740 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 13:57:11.856955 2.994266 tcp 10.0.2.105 54765 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 13:57:20.849686 0.000000 tcp 10.0.2.105 54765 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:01:59.873487 3.002066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:02:06.880973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:02:14.882763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:02:26.860446 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:02:26.860620 3.003420 tcp 10.0.2.105 54766 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:02:30.885625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:02:35.862711 0.000000 tcp 10.0.2.105 54766 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:02:41.863197 0.062692 tcp 10.0.2.105 54767 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:41.926234 0.063119 tcp 10.0.2.105 54768 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:41.989556 0.150271 tcp 10.0.2.105 54769 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:42.174436 3.001474 tcp 10.0.2.105 54770 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:02:51.174902 0.000000 tcp 10.0.2.105 54770 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:02:57.174142 0.062418 tcp 10.0.2.105 54771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:57.236835 0.060925 tcp 10.0.2.105 54772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:57.298042 0.159847 tcp 10.0.2.105 54773 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:02:57.491783 2.996558 tcp 10.0.2.105 54774 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:02.891657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:03:06.498891 0.000000 tcp 10.0.2.105 54774 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:12.486110 0.063485 tcp 10.0.2.105 54775 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:03:12.549872 0.062781 tcp 10.0.2.105 54776 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:03:12.612926 0.152112 tcp 10.0.2.105 54777 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:03:12.775534 2.999194 tcp 10.0.2.105 54778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:21.771762 0.000000 tcp 10.0.2.105 54778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:27.769212 3.002567 tcp 10.0.2.105 54779 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:36.770237 0.000000 tcp 10.0.2.105 54779 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:41.390707 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:03:42.770416 3.004651 tcp 10.0.2.105 54780 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:03:51.771716 0.000000 tcp 10.0.2.105 54780 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:08:57.772437 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:08:57.772540 3.003385 tcp 10.0.2.105 54781 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:06.774800 0.000000 tcp 10.0.2.105 54781 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:06.897801 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:09:12.775103 0.061210 tcp 10.0.2.105 54782 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:12.836660 0.063543 tcp 10.0.2.105 54783 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:12.900517 0.150799 tcp 10.0.2.105 54784 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:13.205193 2.993017 tcp 10.0.2.105 54785 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:13.905080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:09:21.906679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:09:22.206824 0.000000 tcp 10.0.2.105 54785 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:28.207176 0.059544 tcp 10.0.2.105 54786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:28.266990 0.059986 tcp 10.0.2.105 54787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:28.327253 0.159226 tcp 10.0.2.105 54788 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:28.583142 2.997615 tcp 10.0.2.105 54789 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:37.578884 0.000000 tcp 10.0.2.105 54789 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:37.909359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:09:43.582196 0.059790 tcp 10.0.2.105 54790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:43.642253 0.062462 tcp 10.0.2.105 54791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:43.705022 0.155941 tcp 10.0.2.105 54792 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:09:43.916578 2.996301 tcp 10.0.2.105 54793 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:52.910750 0.000000 tcp 10.0.2.105 54793 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:09:58.909587 3.003928 tcp 10.0.2.105 54794 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:10:07.912621 0.000000 tcp 10.0.2.105 54794 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:10:09.915232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:10:12.879807 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:10:13.911520 3.004142 tcp 10.0.2.105 54795 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:10:22.914081 0.000000 tcp 10.0.2.105 54795 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:16:13.921232 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 14:16:20.928870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:16:28.930437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:16:44.933291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:17:16.939469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:19:28.148684 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:19:28.148830 0.000000 udp 10.0.2.105 7010 -> 96.47.201.9 7015 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 14:19:45.915809 0.060828 tcp 10.0.2.105 54796 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:19:45.976937 0.061021 tcp 10.0.2.105 54797 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:19:46.038235 0.154602 tcp 10.0.2.105 54798 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:19:46.193349 0.125834 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:19:46.280375 0.109216 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:19:46.452502 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 8693 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 14:19:58.942892 3.003396 tcp 10.0.2.105 54799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:20:01.757321 0.060336 tcp 10.0.2.105 54800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:01.817879 0.068063 tcp 10.0.2.105 54801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:01.886221 0.158935 tcp 10.0.2.105 54802 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:02.045666 0.172081 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.195909 0.175009 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.362599 0.081898 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.409013 0.172885 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.696498 0.074455 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.769623 0.175954 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:02.916630 0.169006 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.062007 0.159411 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.226940 0.175117 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.398345 0.174570 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.569526 0.177329 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.792785 0.082712 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:03.866389 0.213354 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2606 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:04.071469 0.237277 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:04.284858 0.352215 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:04.661079 0.084407 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:04.729544 0.046800 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:04.860643 0.103730 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.158669 0.098528 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.237213 0.035689 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.336991 0.084877 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.399786 0.054118 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.468460 0.149318 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.607660 0.114172 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.691531 0.212660 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:05.967686 0.044895 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:20:07.945314 0.000000 tcp 10.0.2.105 54799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:20:13.944508 0.061574 tcp 10.0.2.105 54803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:14.006113 0.060663 tcp 10.0.2.105 54804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:14.067026 0.156677 tcp 10.0.2.105 54805 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:20:14.339078 3.000002 tcp 10.0.2.105 54806 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:20:23.337539 0.000000 tcp 10.0.2.105 54806 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:23:20.945479 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:23:27.953409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:23:35.954636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:23:51.957051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:24:23.963539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:25:29.338276 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:25:29.338401 3.003342 tcp 10.0.2.105 54807 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:25:38.340218 0.000000 tcp 10.0.2.105 54807 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:25:44.340601 0.062290 tcp 10.0.2.105 54808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:44.403199 0.064788 tcp 10.0.2.105 54809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:44.468244 0.153062 tcp 10.0.2.105 54810 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:44.633035 3.000700 tcp 10.0.2.105 54811 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:25:53.632541 0.000000 tcp 10.0.2.105 54811 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:25:59.631603 0.061278 tcp 10.0.2.105 54812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:59.693160 0.062381 tcp 10.0.2.105 54813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:59.756055 0.154792 tcp 10.0.2.105 54814 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:25:59.993715 3.001891 tcp 10.0.2.105 54815 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:08.994372 0.000000 tcp 10.0.2.105 54815 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:14.993881 0.061321 tcp 10.0.2.105 54816 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:26:15.055495 0.064447 tcp 10.0.2.105 54817 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:26:15.120312 0.156757 tcp 10.0.2.105 54818 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:26:15.480377 2.998291 tcp 10.0.2.105 54819 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:24.487008 0.000000 tcp 10.0.2.105 54819 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:30.475828 2.993897 tcp 10.0.2.105 54820 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:39.468526 0.000000 tcp 10.0.2.105 54820 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:44.385553 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:26:45.477204 3.003947 tcp 10.0.2.105 54821 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:26:54.479839 0.000000 tcp 10.0.2.105 54821 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:30:27.972061 2.999153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:30:34.976997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:30:42.979131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:30:58.981502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:31:30.987454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:32:00.480032 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:32:00.480131 3.003862 tcp 10.0.2.105 54822 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:09.482920 0.000000 tcp 10.0.2.105 54822 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:15.484755 0.063145 tcp 10.0.2.105 54823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:15.548198 0.065748 tcp 10.0.2.105 54824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:15.614203 0.159553 tcp 10.0.2.105 54825 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:16.511582 3.005624 tcp 10.0.2.105 54826 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:25.525885 0.000000 tcp 10.0.2.105 54826 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:31.505325 0.060787 tcp 10.0.2.105 54827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:31.566407 0.066120 tcp 10.0.2.105 54828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:31.632834 0.153550 tcp 10.0.2.105 54829 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:31.844693 2.994292 tcp 10.0.2.105 54830 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:40.863822 0.000000 tcp 10.0.2.105 54830 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:46.837131 0.060270 tcp 10.0.2.105 54831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:46.897708 0.060965 tcp 10.0.2.105 54832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:46.958941 0.152700 tcp 10.0.2.105 54833 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:32:47.135682 2.995016 tcp 10.0.2.105 54834 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:32:56.129363 0.000000 tcp 10.0.2.105 54834 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:33:02.128639 3.004033 tcp 10.0.2.105 54835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:33:11.133090 0.000000 tcp 10.0.2.105 54835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:33:15.888032 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:33:17.130132 3.004135 tcp 10.0.2.105 54836 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:33:26.133320 0.000000 tcp 10.0.2.105 54836 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:37:34.993213 3.002066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:37:42.000940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:37:50.002136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:38:06.005577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:38:32.137365 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:38:32.137509 3.006475 tcp 10.0.2.105 54837 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:38:38.017466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:38:41.152533 0.000000 tcp 10.0.2.105 54837 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:38:47.140579 0.060612 tcp 10.0.2.105 54838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:38:47.201459 0.064599 tcp 10.0.2.105 54839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:38:47.266333 0.154274 tcp 10.0.2.105 54840 -> 195.113.214.249 443 SRPA* 0 0 24 12114 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:38:47.820457 3.004570 tcp 10.0.2.105 54841 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:38:56.818974 0.000000 tcp 10.0.2.105 54841 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:02.817116 0.066707 tcp 10.0.2.105 54842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:02.884174 0.065027 tcp 10.0.2.105 54843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:02.949513 0.153040 tcp 10.0.2.105 54844 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:03.427020 2.998735 tcp 10.0.2.105 54845 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:12.420842 0.000000 tcp 10.0.2.105 54845 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:18.420533 0.061126 tcp 10.0.2.105 54846 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:18.481936 0.062584 tcp 10.0.2.105 54847 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:18.544834 0.152776 tcp 10.0.2.105 54848 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:39:18.740331 3.003959 tcp 10.0.2.105 54849 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:27.742777 0.000000 tcp 10.0.2.105 54849 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:33.741763 3.004069 tcp 10.0.2.105 54850 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:42.744594 0.000000 tcp 10.0.2.105 54850 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:47.381847 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:39:48.743197 3.004104 tcp 10.0.2.105 54851 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:39:57.756000 0.000000 tcp 10.0.2.105 54851 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:44:42.018425 3.000632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:44:49.024920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:44:57.025726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:45:03.746306 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:45:03.746466 2.993769 tcp 10.0.2.105 54852 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:12.738989 0.000000 tcp 10.0.2.105 54852 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:13.029304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:45:18.749648 0.061945 tcp 10.0.2.105 54853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:18.811883 0.062684 tcp 10.0.2.105 54854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:18.874851 0.153773 tcp 10.0.2.105 54855 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:19.137993 2.994700 tcp 10.0.2.105 54856 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:28.130533 0.000000 tcp 10.0.2.105 54856 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:34.140592 0.064728 tcp 10.0.2.105 54857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:34.205563 0.061578 tcp 10.0.2.105 54858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:34.267380 0.156507 tcp 10.0.2.105 54859 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:45:34.822270 3.002678 tcp 10.0.2.105 54860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:43.823470 0.000000 tcp 10.0.2.105 54860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:45.035551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:45:49.822315 3.004324 tcp 10.0.2.105 54861 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:45:58.827125 0.000000 tcp 10.0.2.105 54861 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:46:03.381509 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:50:22.134268 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:50:22.134375 0.000000 udp 10.0.2.105 7010 -> 79.9.27.1 8693 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 14:50:39.953151 0.061332 tcp 10.0.2.105 54862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:50:40.014834 0.064930 tcp 10.0.2.105 54863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:50:40.080058 0.184827 tcp 10.0.2.105 54864 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:50:40.265553 0.107897 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:40.334534 0.098136 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:40.734679 0.170997 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:40.881368 0.172063 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.046832 0.085051 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.322488 0.170431 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.525689 0.059435 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.583547 0.174151 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.729912 0.169216 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:41.986708 0.246014 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.123107 0.176606 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.341147 0.178246 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.516780 0.182312 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.692049 0.082694 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.764691 0.217078 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:42.973664 0.245170 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.194505 0.045556 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.232230 0.127927 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.480810 0.083575 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.541049 0.036913 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.629738 0.336831 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:43.966008 0.072036 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.077217 0.069263 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.126793 0.053629 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.226360 0.148254 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.361661 0.108489 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.474336 0.199604 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:50:44.669232 0.045009 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/08 14:51:04.825469 2.993862 tcp 10.0.2.105 54865 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:09.381457 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:51:13.817842 0.000000 tcp 10.0.2.105 54865 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:19.827243 0.061717 tcp 10.0.2.105 54866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:19.889270 0.066105 tcp 10.0.2.105 54867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:19.955665 0.153386 tcp 10.0.2.105 54868 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:20.275102 2.996572 tcp 10.0.2.105 54869 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:29.270619 0.000000 tcp 10.0.2.105 54869 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:35.269648 0.064012 tcp 10.0.2.105 54870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:35.333977 0.062368 tcp 10.0.2.105 54871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:35.396616 0.155325 tcp 10.0.2.105 54872 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:35.664462 2.999790 tcp 10.0.2.105 54873 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:44.662526 0.000000 tcp 10.0.2.105 54873 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:50.665656 0.064682 tcp 10.0.2.105 54874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:50.730598 0.061719 tcp 10.0.2.105 54875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:50.792603 0.150826 tcp 10.0.2.105 54876 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:51:50.958193 2.998757 tcp 10.0.2.105 54877 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:51:59.954529 0.000000 tcp 10.0.2.105 54877 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:52:05.953328 2.994018 tcp 10.0.2.105 54878 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:52:14.956076 0.000000 tcp 10.0.2.105 54878 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:52:19.883071 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:52:20.954844 2.994199 tcp 10.0.2.105 54879 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:52:29.952676 0.000000 tcp 10.0.2.105 54879 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:54:54.047344 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 14:55:01.055591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:55:09.056410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:55:25.059908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:55:57.065429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 14:57:35.958256 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:57:35.958533 3.005347 tcp 10.0.2.105 54880 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:57:44.960813 0.000000 tcp 10.0.2.105 54880 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:57:50.963508 0.063340 tcp 10.0.2.105 54881 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:57:51.027141 0.061705 tcp 10.0.2.105 54882 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:57:51.089207 0.157913 tcp 10.0.2.105 54883 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:57:51.333821 3.000043 tcp 10.0.2.105 54884 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:00.332602 0.000000 tcp 10.0.2.105 54884 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:06.331674 0.064818 tcp 10.0.2.105 54885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:06.396834 0.061568 tcp 10.0.2.105 54886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:06.458684 0.156569 tcp 10.0.2.105 54887 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:06.631869 3.004243 tcp 10.0.2.105 54888 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:15.634300 0.000000 tcp 10.0.2.105 54888 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:21.633972 0.064753 tcp 10.0.2.105 54889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:21.699037 0.063302 tcp 10.0.2.105 54890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:21.762660 0.155518 tcp 10.0.2.105 54891 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/08 14:58:21.946976 2.990720 tcp 10.0.2.105 54892 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:30.946659 0.000000 tcp 10.0.2.105 54892 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:36.945978 2.993439 tcp 10.0.2.105 54893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:45.938121 0.000000 tcp 10.0.2.105 54893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:58:50.885073 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 14:58:51.947041 2.994067 tcp 10.0.2.105 54894 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 14:59:00.939856 0.000000 tcp 10.0.2.105 54894 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:02:01.071165 3.001799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:02:08.078612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:02:16.080698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:02:32.083229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:03:04.090931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:04:06.950088 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:04:06.950204 3.003765 tcp 10.0.2.105 54895 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:15.952641 0.000000 tcp 10.0.2.105 54895 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:21.953049 0.062199 tcp 10.0.2.105 54896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:22.015535 0.062674 tcp 10.0.2.105 54897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:22.078490 0.154141 tcp 10.0.2.105 54898 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:22.272791 3.003623 tcp 10.0.2.105 54899 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:31.274789 0.000000 tcp 10.0.2.105 54899 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:37.273408 0.068663 tcp 10.0.2.105 54900 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:37.342328 0.061329 tcp 10.0.2.105 54901 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:37.403951 0.162597 tcp 10.0.2.105 54902 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:37.604900 2.993135 tcp 10.0.2.105 54903 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:46.606915 0.000000 tcp 10.0.2.105 54903 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:04:52.606204 0.062324 tcp 10.0.2.105 54904 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:52.668825 0.062708 tcp 10.0.2.105 54905 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:52.731792 0.154719 tcp 10.0.2.105 54906 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:04:52.905104 2.994841 tcp 10.0.2.105 54907 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:05:01.898000 0.000000 tcp 10.0.2.105 54907 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:05:07.897052 3.004526 tcp 10.0.2.105 54908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:05:16.900075 0.000000 tcp 10.0.2.105 54908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:05:21.887321 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:05:22.898829 3.007852 tcp 10.0.2.105 54909 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:05:31.901651 0.000000 tcp 10.0.2.105 54909 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:09:08.096236 3.000913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:09:15.102959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:09:23.103882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:09:39.107269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:10:11.123262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:10:37.902569 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:10:37.902697 3.003239 tcp 10.0.2.105 54910 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:10:46.904625 0.000000 tcp 10.0.2.105 54910 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:10:52.905285 0.065263 tcp 10.0.2.105 54911 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:10:52.970852 0.064423 tcp 10.0.2.105 54912 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:10:53.035542 0.156657 tcp 10.0.2.105 54913 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:10:53.235064 2.993148 tcp 10.0.2.105 54914 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:02.236579 0.000000 tcp 10.0.2.105 54914 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:08.236091 0.061986 tcp 10.0.2.105 54915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:08.298408 0.063768 tcp 10.0.2.105 54916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:08.362480 0.156297 tcp 10.0.2.105 54917 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:08.665840 2.994272 tcp 10.0.2.105 54918 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:17.659037 0.000000 tcp 10.0.2.105 54918 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:23.657975 0.065102 tcp 10.0.2.105 54919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:23.723372 0.060928 tcp 10.0.2.105 54920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:23.784571 0.158197 tcp 10.0.2.105 54921 -> 195.113.214.249 443 SRPA* 0 0 28 11720 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:11:24.119878 3.002805 tcp 10.0.2.105 54922 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:33.120523 0.000000 tcp 10.0.2.105 54922 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:39.119651 3.004840 tcp 10.0.2.105 54923 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:48.122728 0.000000 tcp 10.0.2.105 54923 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:11:52.881770 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:11:54.131416 3.004099 tcp 10.0.2.105 54924 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:12:03.134087 0.000000 tcp 10.0.2.105 54924 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:16:15.130026 3.001071 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:16:22.136681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:16:30.138572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:16:46.141237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:17:18.147157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:20:49.130364 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:20:49.130566 0.105426 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.198855 0.172880 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.364048 0.089478 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.435668 0.168272 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.581425 0.089216 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.632914 0.170436 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.809726 0.062414 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:49.870763 0.173082 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.017198 0.175417 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.189661 0.172821 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.359243 0.170425 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.512403 0.161808 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.619431 0.178121 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.789378 0.088645 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:50.869029 0.217825 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.080638 0.252432 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.306224 0.086265 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.368455 0.040469 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.413810 0.046122 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.444535 0.103564 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.552681 0.344849 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.898710 0.070327 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:51.954488 0.070667 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:52.005368 0.051951 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:52.057483 0.147204 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:52.196792 0.100860 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:52.265042 0.189480 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:20:52.446931 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 15:20:54.158335 3.003781 tcp 10.0.2.105 54925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:03.160388 0.000000 tcp 10.0.2.105 54925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:09.101281 0.061540 tcp 10.0.2.105 54926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.159941 0.067204 tcp 10.0.2.105 54927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.163043 0.061007 tcp 10.0.2.105 54928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.224369 0.158455 tcp 10.0.2.105 54929 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.227373 0.062229 tcp 10.0.2.105 54930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.289876 0.167878 tcp 10.0.2.105 54931 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:09.467855 3.006189 tcp 10.0.2.105 54932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:18.472695 0.000000 tcp 10.0.2.105 54932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:24.461845 0.064570 tcp 10.0.2.105 54933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:24.526661 0.062090 tcp 10.0.2.105 54934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:24.588989 0.156221 tcp 10.0.2.105 54935 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:24.758244 3.007818 tcp 10.0.2.105 54936 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:33.764692 0.000000 tcp 10.0.2.105 54936 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:39.754101 0.061741 tcp 10.0.2.105 54937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:39.816130 0.064765 tcp 10.0.2.105 54938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:39.881173 0.151162 tcp 10.0.2.105 54939 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:21:40.041947 2.995934 tcp 10.0.2.105 54940 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:49.046740 0.000000 tcp 10.0.2.105 54940 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:21:55.035158 2.993845 tcp 10.0.2.105 54941 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:22:04.028805 0.000000 tcp 10.0.2.105 54941 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:22:08.885223 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:22:10.037138 3.003698 tcp 10.0.2.105 54942 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:22:19.039477 0.000000 tcp 10.0.2.105 54942 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:23:22.153153 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:23:29.160502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:23:37.162092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:23:53.165169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:24:25.170830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:27:25.040393 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:27:25.040551 3.003276 tcp 10.0.2.105 54943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:27:34.042430 0.000000 tcp 10.0.2.105 54943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:27:40.043304 0.063297 tcp 10.0.2.105 54944 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:40.106907 0.062542 tcp 10.0.2.105 54945 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:40.169753 0.151118 tcp 10.0.2.105 54946 -> 195.113.214.249 443 SRPA* 0 0 21 11362 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:40.384468 3.001710 tcp 10.0.2.105 54947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:27:49.384966 0.000000 tcp 10.0.2.105 54947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:27:55.383532 0.061133 tcp 10.0.2.105 54948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:55.444930 0.062367 tcp 10.0.2.105 54949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:55.507604 0.152193 tcp 10.0.2.105 54950 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:27:55.674137 2.993885 tcp 10.0.2.105 54951 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:04.677116 0.000000 tcp 10.0.2.105 54951 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:10.676252 0.061697 tcp 10.0.2.105 54952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:28:10.738238 0.063312 tcp 10.0.2.105 54953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:28:10.801885 0.155167 tcp 10.0.2.105 54954 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:28:11.028272 2.992208 tcp 10.0.2.105 54955 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:20.018800 0.000000 tcp 10.0.2.105 54955 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:26.027260 3.008386 tcp 10.0.2.105 54956 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:35.030440 0.000000 tcp 10.0.2.105 54956 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:39.887630 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:28:41.029039 3.004456 tcp 10.0.2.105 54957 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:28:50.033298 0.000000 tcp 10.0.2.105 54957 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:30:29.177402 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:30:36.184701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:30:44.187300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:31:00.189221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:31:32.195916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:33:56.032826 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:33:56.032922 3.002812 tcp 10.0.2.105 54958 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:05.034831 0.000000 tcp 10.0.2.105 54958 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:11.035051 0.062072 tcp 10.0.2.105 54959 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:11.097397 0.061369 tcp 10.0.2.105 54960 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:11.158986 0.153238 tcp 10.0.2.105 54961 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:11.463256 2.995597 tcp 10.0.2.105 54962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:20.467180 0.000000 tcp 10.0.2.105 54962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:26.456846 0.062004 tcp 10.0.2.105 54963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:26.519170 0.062098 tcp 10.0.2.105 54964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:26.581547 0.158317 tcp 10.0.2.105 54965 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:26.812458 2.988194 tcp 10.0.2.105 54966 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:35.799042 0.000000 tcp 10.0.2.105 54966 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:41.808397 0.062996 tcp 10.0.2.105 54967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:41.871267 0.071374 tcp 10.0.2.105 54968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:41.942505 0.147737 tcp 10.0.2.105 54969 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:34:42.161167 3.001524 tcp 10.0.2.105 54970 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:51.161073 0.000000 tcp 10.0.2.105 54970 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:34:57.160550 3.003479 tcp 10.0.2.105 54971 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:35:06.162679 0.000000 tcp 10.0.2.105 54971 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:35:10.879378 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:35:12.163460 3.002149 tcp 10.0.2.105 54972 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:35:21.164134 0.000000 tcp 10.0.2.105 54972 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:37:36.200514 3.002329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:37:43.208844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:37:51.210142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:38:07.213133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:38:39.226650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:40:27.165007 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:40:27.165138 2.993460 tcp 10.0.2.105 54973 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:40:36.167149 0.000000 tcp 10.0.2.105 54973 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:40:42.167620 0.062845 tcp 10.0.2.105 54974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:42.230760 0.061262 tcp 10.0.2.105 54975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:42.292492 0.153153 tcp 10.0.2.105 54976 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:42.462526 2.998661 tcp 10.0.2.105 54977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:40:51.459543 0.000000 tcp 10.0.2.105 54977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:40:57.459325 0.061804 tcp 10.0.2.105 54978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:57.521402 0.061026 tcp 10.0.2.105 54979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:57.582809 0.159402 tcp 10.0.2.105 54980 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:40:57.825876 2.996875 tcp 10.0.2.105 54981 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:06.823151 0.000000 tcp 10.0.2.105 54981 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:12.820561 0.059966 tcp 10.0.2.105 54982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:41:12.880875 0.064466 tcp 10.0.2.105 54983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:41:12.945641 0.157926 tcp 10.0.2.105 54984 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:41:13.138777 3.005928 tcp 10.0.2.105 54985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:22.146702 0.000000 tcp 10.0.2.105 54985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:28.132766 3.002995 tcp 10.0.2.105 54986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:37.135014 0.000000 tcp 10.0.2.105 54986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:41.881632 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:41:43.133463 2.994439 tcp 10.0.2.105 54987 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:41:52.136270 0.000000 tcp 10.0.2.105 54987 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:44:43.224867 3.001910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:44:50.232661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:44:58.234058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:45:14.237090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:45:46.243316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:51:33.282467 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:51:33.282657 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 15:51:49.016554 0.065008 tcp 10.0.2.105 54988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:51:49.081846 0.061871 tcp 10.0.2.105 54989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:51:49.143982 0.220783 tcp 10.0.2.105 54990 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:51:49.365421 0.112823 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:49.438540 0.175072 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:49.605593 0.168441 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:49.752938 0.082317 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:49.857191 0.171920 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.156755 0.061260 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.312488 0.173900 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.456146 0.176043 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.628842 0.174598 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.799607 0.089101 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:50.898774 0.177065 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.068210 0.082012 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.140233 0.172132 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.263662 0.172029 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.485274 0.311861 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.768685 0.085921 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:51.883944 0.219470 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.095627 0.046579 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.161246 0.103401 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.397112 0.337540 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.752913 0.068748 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.807960 0.070060 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:52.942104 0.051183 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:53.141007 0.146827 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:53.277735 0.101849 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:53.400652 0.043853 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:53.442779 0.195714 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 15:51:58.168081 3.004132 tcp 10.0.2.105 54991 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:07.170813 0.000000 tcp 10.0.2.105 54991 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:13.170081 0.060701 tcp 10.0.2.105 54992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:13.231064 0.069280 tcp 10.0.2.105 54993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:13.300624 0.158103 tcp 10.0.2.105 54994 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:13.469603 3.004419 tcp 10.0.2.105 54995 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:22.472781 0.000000 tcp 10.0.2.105 54995 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:28.461942 0.059622 tcp 10.0.2.105 54996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:28.521857 0.061280 tcp 10.0.2.105 54997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:28.583432 0.146304 tcp 10.0.2.105 54998 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:29.093918 3.002050 tcp 10.0.2.105 54999 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:38.095134 0.000000 tcp 10.0.2.105 54999 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:44.094451 0.061717 tcp 10.0.2.105 55000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:44.156462 0.061625 tcp 10.0.2.105 55001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:44.218392 0.161740 tcp 10.0.2.105 55002 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:52:44.397932 3.000651 tcp 10.0.2.105 55003 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:53.407178 0.000000 tcp 10.0.2.105 55003 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:52:59.396157 2.997066 tcp 10.0.2.105 55004 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:53:08.393309 0.000000 tcp 10.0.2.105 55004 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:53:13.386226 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:53:14.397684 3.004036 tcp 10.0.2.105 55005 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:53:23.401457 0.000000 tcp 10.0.2.105 55005 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:54:50.258746 3.000924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 15:54:57.265453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:55:05.266994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:55:21.270446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:55:53.278586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 15:58:29.410942 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:58:29.411102 3.004278 tcp 10.0.2.105 55006 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:58:38.412960 0.000000 tcp 10.0.2.105 55006 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:58:44.414685 0.066758 tcp 10.0.2.105 55007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:58:44.481768 0.062256 tcp 10.0.2.105 55008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:58:44.544341 0.158735 tcp 10.0.2.105 55009 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:58:45.156358 2.990987 tcp 10.0.2.105 55010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:58:54.155900 0.000000 tcp 10.0.2.105 55010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:00.155235 0.065857 tcp 10.0.2.105 55011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:00.221407 0.064005 tcp 10.0.2.105 55012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:00.285720 0.149263 tcp 10.0.2.105 55013 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:00.698195 3.001586 tcp 10.0.2.105 55014 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:09.698214 0.000000 tcp 10.0.2.105 55014 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:15.697874 0.108917 tcp 10.0.2.105 55015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:15.807063 0.064078 tcp 10.0.2.105 55016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:15.871450 0.154786 tcp 10.0.2.105 55017 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/08 15:59:16.035448 2.996853 tcp 10.0.2.105 55018 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:25.029945 0.000000 tcp 10.0.2.105 55018 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:31.029154 3.004182 tcp 10.0.2.105 55019 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:40.031910 0.000000 tcp 10.0.2.105 55019 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:44.879039 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 15:59:46.030550 3.003777 tcp 10.0.2.105 55020 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 15:59:55.033530 0.000000 tcp 10.0.2.105 55020 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:01:57.282319 3.000810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:02:04.295743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:02:12.290802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:02:28.295843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:03:00.300023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:05:01.033320 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:05:01.033506 3.004307 tcp 10.0.2.105 55021 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:10.046686 0.000000 tcp 10.0.2.105 55021 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:16.037167 0.062973 tcp 10.0.2.105 55022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:16.100454 0.063531 tcp 10.0.2.105 55023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:16.164362 0.157324 tcp 10.0.2.105 55024 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:16.341376 2.998399 tcp 10.0.2.105 55025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:25.338479 0.000000 tcp 10.0.2.105 55025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:31.337901 0.060671 tcp 10.0.2.105 55026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:31.398848 0.241677 tcp 10.0.2.105 55027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:31.640822 0.155484 tcp 10.0.2.105 55028 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:32.788553 3.004226 tcp 10.0.2.105 55029 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:41.792042 0.000000 tcp 10.0.2.105 55029 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:47.791386 0.061375 tcp 10.0.2.105 55030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:47.853080 0.061167 tcp 10.0.2.105 55031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:47.914563 0.155988 tcp 10.0.2.105 55032 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:05:48.286818 2.998898 tcp 10.0.2.105 55033 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:05:57.284296 0.000000 tcp 10.0.2.105 55033 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:06:03.283137 3.004222 tcp 10.0.2.105 55034 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:06:12.295863 0.000000 tcp 10.0.2.105 55034 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:06:16.882554 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:06:18.284497 2.994589 tcp 10.0.2.105 55035 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:06:27.277483 0.000000 tcp 10.0.2.105 55035 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:09:04.305890 3.001433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:09:11.313304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:09:19.314807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:09:35.317677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:10:07.323510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:11:33.288075 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:11:33.288294 3.003530 tcp 10.0.2.105 55036 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:11:42.290247 0.000000 tcp 10.0.2.105 55036 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:11:48.294990 0.061156 tcp 10.0.2.105 55037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:11:48.356441 0.061689 tcp 10.0.2.105 55038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:11:48.418392 0.155867 tcp 10.0.2.105 55039 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:11:48.755431 2.998258 tcp 10.0.2.105 55040 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:11:57.752479 0.000000 tcp 10.0.2.105 55040 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:03.752059 0.061142 tcp 10.0.2.105 55041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:03.813447 0.064562 tcp 10.0.2.105 55042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:03.878287 0.152818 tcp 10.0.2.105 55043 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:04.046623 2.998782 tcp 10.0.2.105 55044 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:13.044514 0.000000 tcp 10.0.2.105 55044 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:19.043930 0.060148 tcp 10.0.2.105 55045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:19.104375 0.061357 tcp 10.0.2.105 55046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:19.166059 0.156098 tcp 10.0.2.105 55047 -> 195.113.214.249 443 SRPA* 0 0 27 13714 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:12:19.334445 2.993393 tcp 10.0.2.105 55048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:28.336879 0.000000 tcp 10.0.2.105 55048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:34.335487 2.994248 tcp 10.0.2.105 55049 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:43.328190 0.000000 tcp 10.0.2.105 55049 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:47.884634 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:12:49.337221 2.993787 tcp 10.0.2.105 55050 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:12:58.329823 0.000000 tcp 10.0.2.105 55050 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:16:11.329852 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:16:18.337320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:16:26.338959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:16:42.341666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:17:14.347618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:22:21.789866 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:22:21.790026 0.112029 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:21.863337 0.172763 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.029261 0.167217 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.173740 0.090707 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.223044 0.171280 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.396478 0.059879 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.455153 0.176119 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.628381 0.091795 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.701556 0.229725 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:22.923619 0.171432 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.068978 0.175904 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.241515 0.080716 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.313021 0.177467 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.437148 0.170682 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.583630 0.217527 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.793730 0.045050 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:23.823770 0.103347 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:24.181735 0.248600 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:24.405268 0.086429 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:24.495390 0.343655 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:24.851641 0.071756 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:24.908545 0.069129 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:25.016920 0.053602 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:25.084875 0.036096 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:25.113646 0.206672 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:25.310408 0.151844 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:25.448865 0.108283 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:22:34.368226 3.004247 tcp 10.0.2.105 55051 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:22:43.370947 0.000000 tcp 10.0.2.105 55051 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:22:47.887344 0.117845 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:22:49.466413 0.042409 tcp 10.0.2.105 55052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:22:49.509125 0.060742 tcp 10.0.2.105 55053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:22:49.570220 0.137366 tcp 10.0.2.105 55054 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:22:49.725645 2.978119 tcp 10.0.2.105 55055 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:22:58.652449 0.000000 tcp 10.0.2.105 55055 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:04.632160 0.041871 tcp 10.0.2.105 55056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:04.674347 0.042718 tcp 10.0.2.105 55057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:04.717370 0.141423 tcp 10.0.2.105 55058 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:04.902549 3.002976 tcp 10.0.2.105 55059 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:13.904737 0.000000 tcp 10.0.2.105 55059 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:18.354222 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:23:19.904024 0.044422 tcp 10.0.2.105 55060 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:19.948706 0.042339 tcp 10.0.2.105 55061 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:19.991299 0.139463 tcp 10.0.2.105 55062 -> 195.113.214.249 443 SRPA* 0 0 26 14268 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:23:20.209272 2.999037 tcp 10.0.2.105 55063 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:25.361182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:23:29.219945 0.000000 tcp 10.0.2.105 55063 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:33.362993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:23:35.205304 2.994084 tcp 10.0.2.105 55064 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:44.198566 0.000000 tcp 10.0.2.105 55064 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:48.890536 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:23:49.370884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:23:50.214098 2.998634 tcp 10.0.2.105 55065 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:23:59.209759 0.000000 tcp 10.0.2.105 55065 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:24:21.371801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:29:05.213344 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:29:05.213445 3.000433 tcp 10.0.2.105 55066 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:14.215113 0.000000 tcp 10.0.2.105 55066 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:20.213082 0.047047 tcp 10.0.2.105 55067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:20.260491 0.045798 tcp 10.0.2.105 55068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:20.306619 0.137067 tcp 10.0.2.105 55069 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:20.783718 3.002751 tcp 10.0.2.105 55070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:29.784867 0.000000 tcp 10.0.2.105 55070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:35.784400 0.042564 tcp 10.0.2.105 55071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:35.827225 0.046855 tcp 10.0.2.105 55072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:35.874373 0.144712 tcp 10.0.2.105 55073 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:36.352848 2.996066 tcp 10.0.2.105 55074 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:45.350715 0.000000 tcp 10.0.2.105 55074 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:29:51.346672 0.044536 tcp 10.0.2.105 55075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:51.391511 0.042629 tcp 10.0.2.105 55076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:51.434525 0.137788 tcp 10.0.2.105 55077 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:29:51.657969 2.993030 tcp 10.0.2.105 55078 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:00.649557 0.000000 tcp 10.0.2.105 55078 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:06.661222 3.001456 tcp 10.0.2.105 55079 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:15.661127 0.000000 tcp 10.0.2.105 55079 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:20.387699 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:30:21.659934 3.004755 tcp 10.0.2.105 55080 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:25.377730 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:30:30.662776 0.000000 tcp 10.0.2.105 55080 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:30:32.389220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:30:40.386673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:30:56.389832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:31:28.395947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:35:36.667873 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:35:36.668065 2.999766 tcp 10.0.2.105 55081 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:35:45.665561 0.000000 tcp 10.0.2.105 55081 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:35:51.665920 0.045711 tcp 10.0.2.105 55082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:35:51.711909 0.045877 tcp 10.0.2.105 55083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:35:51.758097 0.140719 tcp 10.0.2.105 55084 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:35:52.085440 2.993797 tcp 10.0.2.105 55085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:01.081546 0.000000 tcp 10.0.2.105 55085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:07.086804 0.042574 tcp 10.0.2.105 55086 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:07.129701 0.042758 tcp 10.0.2.105 55087 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:07.172826 0.134858 tcp 10.0.2.105 55088 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:07.345393 2.995859 tcp 10.0.2.105 55089 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:16.340089 0.000000 tcp 10.0.2.105 55089 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:22.339132 0.042016 tcp 10.0.2.105 55090 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:22.381444 0.042157 tcp 10.0.2.105 55091 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:22.423901 0.139972 tcp 10.0.2.105 55092 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:36:22.581816 3.001124 tcp 10.0.2.105 55093 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:31.581688 0.000000 tcp 10.0.2.105 55093 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:37.582954 3.001494 tcp 10.0.2.105 55094 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:46.585056 0.000000 tcp 10.0.2.105 55094 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:36:51.380125 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:36:52.582115 3.003939 tcp 10.0.2.105 55095 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:37:01.584672 0.000000 tcp 10.0.2.105 55095 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:37:32.401872 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:37:39.409534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:37:47.410615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:38:03.413494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:38:35.429761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:42:07.585234 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:42:07.585426 2.993713 tcp 10.0.2.105 55096 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:16.580802 0.000000 tcp 10.0.2.105 55096 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:22.589349 0.042363 tcp 10.0.2.105 55097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:22.632063 0.043478 tcp 10.0.2.105 55098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:22.675819 0.153696 tcp 10.0.2.105 55099 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:22.915831 2.995166 tcp 10.0.2.105 55100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:31.909607 0.000000 tcp 10.0.2.105 55100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:37.908400 0.041960 tcp 10.0.2.105 55101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:37.950675 0.046192 tcp 10.0.2.105 55102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:37.997141 0.141046 tcp 10.0.2.105 55103 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:38.195997 2.997264 tcp 10.0.2.105 55104 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:47.191470 0.000000 tcp 10.0.2.105 55104 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:42:53.190369 0.044775 tcp 10.0.2.105 55105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:53.235466 0.045151 tcp 10.0.2.105 55106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:53.280893 0.136088 tcp 10.0.2.105 55107 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:42:53.606191 2.998977 tcp 10.0.2.105 55108 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:43:02.603776 0.000000 tcp 10.0.2.105 55108 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:43:08.602682 3.004170 tcp 10.0.2.105 55109 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:43:17.605542 0.000000 tcp 10.0.2.105 55109 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:43:22.382769 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:43:23.604020 2.994735 tcp 10.0.2.105 55110 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:43:32.606921 0.000000 tcp 10.0.2.105 55110 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:44:39.436671 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:44:46.442944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:44:54.444843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:45:10.447660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:45:42.454044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:52:47.915159 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:52:47.915249 0.169091 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.063451 0.085936 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.150039 0.170562 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.364494 0.107028 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.435585 0.174949 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.602505 0.059138 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.664712 0.173805 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.835368 0.089195 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:48.908599 0.189567 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.090642 0.170785 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.234585 0.175736 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.406107 0.080273 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.477309 0.177199 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.600484 0.170009 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:49.887502 0.214287 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.093679 0.047098 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.193071 0.103378 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.312975 0.239307 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.528486 0.086577 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.594775 0.354708 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:50.991910 0.071538 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:51.047428 0.074079 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:51.166059 0.054499 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:51.269100 0.035363 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:51.303264 0.197873 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:52:51.495567 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 16:52:53.633970 2.993904 tcp 10.0.2.105 55111 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:02.636717 0.000000 tcp 10.0.2.105 55111 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:07.795532 0.042024 tcp 10.0.2.105 55112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:07.837823 0.043827 tcp 10.0.2.105 55113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:07.881901 0.134922 tcp 10.0.2.105 55114 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:08.017313 0.104366 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/08 16:53:08.636173 0.044873 tcp 10.0.2.105 55115 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:08.681357 0.045356 tcp 10.0.2.105 55116 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:08.727039 0.140744 tcp 10.0.2.105 55117 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:08.878661 3.001375 tcp 10.0.2.105 55118 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:17.878540 0.000000 tcp 10.0.2.105 55118 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:23.877945 0.041873 tcp 10.0.2.105 55119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:23.919778 0.048791 tcp 10.0.2.105 55120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:23.968859 0.139679 tcp 10.0.2.105 55121 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:24.172737 2.990536 tcp 10.0.2.105 55122 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:33.160975 0.000000 tcp 10.0.2.105 55122 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:39.163623 0.042972 tcp 10.0.2.105 55123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:39.206867 0.043054 tcp 10.0.2.105 55124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:39.250214 0.136508 tcp 10.0.2.105 55125 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:53:39.605058 3.003956 tcp 10.0.2.105 55126 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:48.604447 0.000000 tcp 10.0.2.105 55126 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:53:54.603036 3.007752 tcp 10.0.2.105 55127 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:54:03.606785 0.000000 tcp 10.0.2.105 55127 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:54:08.381007 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:54:09.603207 3.010562 tcp 10.0.2.105 55128 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:54:18.615823 0.000000 tcp 10.0.2.105 55128 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:54:49.463633 3.000702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 16:54:56.470319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:55:04.471722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:55:20.475509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:55:52.483566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 16:59:24.606436 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 16:59:24.606599 2.993270 tcp 10.0.2.105 55129 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:59:33.598609 0.000000 tcp 10.0.2.105 55129 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:59:39.609166 0.042632 tcp 10.0.2.105 55130 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:39.652105 0.042729 tcp 10.0.2.105 55131 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:39.695146 0.140657 tcp 10.0.2.105 55132 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:39.854600 2.997195 tcp 10.0.2.105 55133 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:59:48.850346 0.000000 tcp 10.0.2.105 55133 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 16:59:54.849666 0.041831 tcp 10.0.2.105 55134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:54.891866 0.046342 tcp 10.0.2.105 55135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:54.938566 0.133179 tcp 10.0.2.105 55136 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 16:59:55.182738 3.001192 tcp 10.0.2.105 55137 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:04.184901 0.000000 tcp 10.0.2.105 55137 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:10.181785 0.045057 tcp 10.0.2.105 55138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:00:10.227102 0.042792 tcp 10.0.2.105 55139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:00:10.270131 0.139355 tcp 10.0.2.105 55140 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:00:10.429457 3.006486 tcp 10.0.2.105 55141 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:19.438471 0.000000 tcp 10.0.2.105 55141 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:25.426172 2.991113 tcp 10.0.2.105 55142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:34.426178 0.000000 tcp 10.0.2.105 55142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:39.388548 0.030664 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:00:40.447326 2.981124 tcp 10.0.2.105 55143 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:00:49.417841 0.000000 tcp 10.0.2.105 55143 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:01:56.486722 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:02:03.494280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:02:11.496089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:02:27.499754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:02:59.507305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:05:55.429376 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:05:55.429483 3.003902 tcp 10.0.2.105 55144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:04.430805 0.000000 tcp 10.0.2.105 55144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:10.431211 0.042745 tcp 10.0.2.105 55145 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:10.474280 0.042330 tcp 10.0.2.105 55146 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:10.516944 0.136956 tcp 10.0.2.105 55147 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:10.750617 2.994658 tcp 10.0.2.105 55148 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:19.742811 0.000000 tcp 10.0.2.105 55148 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:25.741910 0.044202 tcp 10.0.2.105 55149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:25.786414 0.042819 tcp 10.0.2.105 55150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:25.829501 0.139136 tcp 10.0.2.105 55151 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:26.169387 3.007164 tcp 10.0.2.105 55152 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:35.174987 0.000000 tcp 10.0.2.105 55152 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:41.164080 0.041962 tcp 10.0.2.105 55153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:41.206354 0.043141 tcp 10.0.2.105 55154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:41.249775 0.138255 tcp 10.0.2.105 55155 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:06:41.407569 3.000562 tcp 10.0.2.105 55156 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:50.416612 0.000000 tcp 10.0.2.105 55156 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:06:56.405587 2.994081 tcp 10.0.2.105 55157 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:07:05.397909 0.000000 tcp 10.0.2.105 55157 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:07:10.385435 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:07:11.407043 2.994169 tcp 10.0.2.105 55158 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:07:20.399823 0.000000 tcp 10.0.2.105 55158 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:09:03.510906 3.002097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:09:10.518083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:09:18.519656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:09:34.526239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:10:06.531241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:12:26.410241 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:12:26.410344 3.003745 tcp 10.0.2.105 55159 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:12:35.412647 0.000000 tcp 10.0.2.105 55159 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:12:41.412924 0.042794 tcp 10.0.2.105 55160 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:41.456051 0.046431 tcp 10.0.2.105 55161 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:41.502764 0.137253 tcp 10.0.2.105 55162 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:41.659298 3.006981 tcp 10.0.2.105 55163 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:12:50.664569 0.000000 tcp 10.0.2.105 55163 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:12:56.654087 0.041277 tcp 10.0.2.105 55164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:56.695647 0.046197 tcp 10.0.2.105 55165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:56.742118 0.137326 tcp 10.0.2.105 55166 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:12:56.890613 2.987460 tcp 10.0.2.105 55167 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:05.886599 0.000000 tcp 10.0.2.105 55167 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:11.885795 0.041064 tcp 10.0.2.105 55168 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:13:11.927159 0.045483 tcp 10.0.2.105 55169 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:13:11.972964 0.136713 tcp 10.0.2.105 55170 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:13:12.120982 2.998924 tcp 10.0.2.105 55171 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:21.117927 0.000000 tcp 10.0.2.105 55171 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:27.117373 3.004025 tcp 10.0.2.105 55172 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:36.123449 0.000000 tcp 10.0.2.105 55172 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:40.887143 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:13:42.118764 3.004288 tcp 10.0.2.105 55173 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:13:51.121657 0.000000 tcp 10.0.2.105 55173 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:16:10.534166 3.002184 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:16:17.542002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:16:25.543606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:16:41.547033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:17:13.552907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:23:17.559023 3.015755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 17:23:24.576375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:23:29.853879 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:23:29.853975 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 17:23:32.577538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:23:47.370559 0.041557 tcp 10.0.2.105 55174 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:23:47.412424 0.089524 tcp 10.0.2.105 55175 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:23:47.502264 0.140577 tcp 10.0.2.105 55176 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:23:47.643388 0.168514 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:47.786480 0.083705 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:47.830233 0.174762 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:47.997961 0.059726 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.119105 0.175366 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.289444 0.095376 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.382866 0.169461 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.606843 0.113689 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.621662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:23:48.679860 0.176296 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:48.828384 0.176388 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.073116 0.082033 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.145810 0.227140 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2623 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.261176 0.177742 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.430180 0.215282 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.637875 0.171788 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.787324 0.047944 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.898853 0.083288 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:49.961540 0.115601 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:50.551916 0.531930 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:51.060408 0.332005 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:51.497503 0.053966 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:51.826124 0.036028 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:51.954945 0.193838 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:52.143641 0.067562 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2054 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:52.516141 0.066201 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:52.567700 0.102269 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:23:57.414330 2.975857 tcp 10.0.2.105 55177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:06.346614 0.000000 tcp 10.0.2.105 55177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:12.279153 0.042034 tcp 10.0.2.105 55178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:12.321484 0.043484 tcp 10.0.2.105 55179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:12.365246 0.135735 tcp 10.0.2.105 55180 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:12.732504 2.967279 tcp 10.0.2.105 55181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:20.633189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:24:21.644004 0.000000 tcp 10.0.2.105 55181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:27.607469 0.043478 tcp 10.0.2.105 55182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:27.651262 0.043070 tcp 10.0.2.105 55183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:27.694601 0.137024 tcp 10.0.2.105 55184 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:27.968657 3.002991 tcp 10.0.2.105 55185 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:36.970501 0.000000 tcp 10.0.2.105 55185 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:42.969663 0.042087 tcp 10.0.2.105 55186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:43.012038 0.046040 tcp 10.0.2.105 55187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:43.058354 0.138009 tcp 10.0.2.105 55188 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:24:43.221916 3.001496 tcp 10.0.2.105 55189 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:52.222179 0.000000 tcp 10.0.2.105 55189 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:24:58.222100 3.002968 tcp 10.0.2.105 55190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:25:07.224883 0.000000 tcp 10.0.2.105 55190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:25:11.880668 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:25:13.222518 3.004008 tcp 10.0.2.105 55191 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:25:22.225618 0.000000 tcp 10.0.2.105 55191 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:30:24.593083 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:30:28.225741 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:30:28.225898 2.993536 tcp 10.0.2.105 55192 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:30:31.600128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:30:37.218093 0.000000 tcp 10.0.2.105 55192 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:30:39.601559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:30:43.228723 0.045461 tcp 10.0.2.105 55193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:43.274549 0.042400 tcp 10.0.2.105 55194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:43.317276 0.138890 tcp 10.0.2.105 55195 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:43.486004 2.995499 tcp 10.0.2.105 55196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:30:52.481931 0.000000 tcp 10.0.2.105 55196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:30:55.604367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:30:58.479600 0.044781 tcp 10.0.2.105 55197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:58.524663 0.048163 tcp 10.0.2.105 55198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:58.573093 0.136350 tcp 10.0.2.105 55199 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:30:58.820258 3.003121 tcp 10.0.2.105 55200 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:07.822145 0.000000 tcp 10.0.2.105 55200 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:13.821111 0.041798 tcp 10.0.2.105 55201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:31:13.863199 0.043044 tcp 10.0.2.105 55202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:31:13.906528 0.140335 tcp 10.0.2.105 55203 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:31:14.289448 3.006487 tcp 10.0.2.105 55204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:23.294213 0.000000 tcp 10.0.2.105 55204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:27.610715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:31:29.283291 3.003892 tcp 10.0.2.105 55205 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:38.295950 0.000000 tcp 10.0.2.105 55205 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:42.882661 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:31:44.285040 2.994239 tcp 10.0.2.105 55206 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:31:53.288603 0.000000 tcp 10.0.2.105 55206 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:36:59.290107 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:36:59.290327 3.001340 tcp 10.0.2.105 55207 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:08.290545 0.000000 tcp 10.0.2.105 55207 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:14.291093 0.088595 tcp 10.0.2.105 55208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:14.379960 0.042509 tcp 10.0.2.105 55209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:14.422879 0.137288 tcp 10.0.2.105 55210 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:14.820909 3.002997 tcp 10.0.2.105 55211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:23.822765 0.000000 tcp 10.0.2.105 55211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:29.821939 0.041452 tcp 10.0.2.105 55212 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:29.863670 0.045511 tcp 10.0.2.105 55213 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:29.909031 0.137568 tcp 10.0.2.105 55214 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:30.315570 3.000902 tcp 10.0.2.105 55215 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:31.616548 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:37:38.623950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:37:39.315051 0.000000 tcp 10.0.2.105 55215 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:45.314041 0.041646 tcp 10.0.2.105 55216 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:45.355996 0.045841 tcp 10.0.2.105 55217 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:45.402077 0.139235 tcp 10.0.2.105 55218 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:37:45.639282 2.999361 tcp 10.0.2.105 55219 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:37:46.625685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:37:54.647160 0.000000 tcp 10.0.2.105 55219 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:38:00.635834 2.994169 tcp 10.0.2.105 55220 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:38:02.628975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:38:09.628717 0.000000 tcp 10.0.2.105 55220 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:38:14.385324 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:38:15.637419 3.004145 tcp 10.0.2.105 55221 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:38:24.639983 0.000000 tcp 10.0.2.105 55221 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:38:34.634651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:43:30.640752 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:43:30.640920 3.003666 tcp 10.0.2.105 55222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:43:39.643085 0.000000 tcp 10.0.2.105 55222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:43:45.643212 0.041827 tcp 10.0.2.105 55223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:43:45.685318 0.043194 tcp 10.0.2.105 55224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:43:45.728799 0.137084 tcp 10.0.2.105 55225 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:43:46.213810 3.005562 tcp 10.0.2.105 55226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:43:55.215589 0.000000 tcp 10.0.2.105 55226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:01.214834 0.041375 tcp 10.0.2.105 55227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:01.256505 0.042493 tcp 10.0.2.105 55228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:01.299292 0.367520 tcp 10.0.2.105 55229 -> 195.113.214.249 443 SRPA* 0 0 73 78220 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:01.707863 3.001351 tcp 10.0.2.105 55230 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:10.707698 0.000000 tcp 10.0.2.105 55230 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:16.706821 0.043121 tcp 10.0.2.105 55231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:16.749776 0.046259 tcp 10.0.2.105 55232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:16.796429 0.136662 tcp 10.0.2.105 55233 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:44:17.026016 2.985777 tcp 10.0.2.105 55234 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:26.009648 0.000000 tcp 10.0.2.105 55234 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:32.018713 3.003952 tcp 10.0.2.105 55235 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:38.640203 3.001997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 17:44:41.021269 0.000000 tcp 10.0.2.105 55235 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:45.648884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:44:45.878126 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:44:47.020190 3.003630 tcp 10.0.2.105 55236 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:44:53.649433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:44:56.022938 0.000000 tcp 10.0.2.105 55236 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:45:09.652796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:45:41.658910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:54:21.906932 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:54:21.907079 0.174095 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.073693 0.059869 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.163723 0.205063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.366049 0.090471 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.566603 0.168961 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.713225 0.090098 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:22.958776 0.171271 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.106207 0.112295 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.252222 0.172901 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.396094 0.175493 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.691862 0.082234 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.765364 0.168993 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:23.878039 0.180435 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:24.062066 0.225002 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:24.279818 0.167849 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:24.469438 0.047036 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:24.500938 0.086324 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:24.629669 0.347528 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.152090 0.103379 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.261342 0.236529 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.475394 0.063259 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.527605 0.040493 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.661556 0.207184 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.928093 0.074238 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:25.981329 0.069996 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:26.253361 0.102831 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/08 17:54:32.052009 3.003220 tcp 10.0.2.105 55237 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:54:41.053924 0.000000 tcp 10.0.2.105 55237 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:54:45.880940 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:54:47.055000 0.042642 tcp 10.0.2.105 55238 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:54:47.097902 0.041759 tcp 10.0.2.105 55239 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:54:47.139914 0.140248 tcp 10.0.2.105 55240 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:54:47.314035 3.003293 tcp 10.0.2.105 55241 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:54:49.668966 3.001898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 17:54:56.325919 0.000000 tcp 10.0.2.105 55241 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:54:56.676579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:55:02.315647 0.041490 tcp 10.0.2.105 55242 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:02.357414 0.046010 tcp 10.0.2.105 55243 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:02.403785 0.136787 tcp 10.0.2.105 55244 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:02.572588 2.996604 tcp 10.0.2.105 55245 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:04.678540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:55:11.568068 0.000000 tcp 10.0.2.105 55245 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:17.567407 0.041640 tcp 10.0.2.105 55246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:17.609369 0.042627 tcp 10.0.2.105 55247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:17.652268 0.138164 tcp 10.0.2.105 55248 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 17:55:17.850559 3.000714 tcp 10.0.2.105 55249 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:20.680955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:55:26.849913 0.000000 tcp 10.0.2.105 55249 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:32.848808 3.004272 tcp 10.0.2.105 55250 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:41.851323 0.000000 tcp 10.0.2.105 55250 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:46.377902 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 17:55:47.850060 3.004282 tcp 10.0.2.105 55251 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 17:55:52.686942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 17:55:56.857373 0.000000 tcp 10.0.2.105 55251 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:02.857775 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:01:02.857878 2.999289 tcp 10.0.2.105 55252 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:11.865877 0.000000 tcp 10.0.2.105 55252 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:17.861661 0.043693 tcp 10.0.2.105 55253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:17.905628 0.041597 tcp 10.0.2.105 55254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:17.947506 0.137918 tcp 10.0.2.105 55255 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:18.117246 2.995519 tcp 10.0.2.105 55256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:27.113764 0.000000 tcp 10.0.2.105 55256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:33.113573 0.042076 tcp 10.0.2.105 55257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:33.155935 0.044950 tcp 10.0.2.105 55258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:33.201171 0.135830 tcp 10.0.2.105 55259 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:33.504590 3.005353 tcp 10.0.2.105 55260 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:42.530856 0.000000 tcp 10.0.2.105 55260 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:48.499369 0.044358 tcp 10.0.2.105 55261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:48.544031 0.041707 tcp 10.0.2.105 55262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:48.586269 0.148524 tcp 10.0.2.105 55263 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:01:48.850430 3.003011 tcp 10.0.2.105 55264 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:01:56.692959 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:01:57.852042 0.000000 tcp 10.0.2.105 55264 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:02:03.700712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:02:03.850681 3.004667 tcp 10.0.2.105 55265 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:02:11.701894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:02:12.853599 0.000000 tcp 10.0.2.105 55265 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:02:17.380061 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:02:18.852344 3.004127 tcp 10.0.2.105 55266 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:02:27.704930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:02:27.855215 0.000000 tcp 10.0.2.105 55266 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:02:59.711175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:07:33.855825 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:07:33.855992 2.993282 tcp 10.0.2.105 55267 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:07:42.871209 0.000000 tcp 10.0.2.105 55267 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:07:48.858273 0.043005 tcp 10.0.2.105 55268 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:07:48.901528 0.045356 tcp 10.0.2.105 55269 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:07:48.947166 0.139064 tcp 10.0.2.105 55270 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:07:49.164091 2.997349 tcp 10.0.2.105 55271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:07:58.160058 0.000000 tcp 10.0.2.105 55271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:04.160144 0.041199 tcp 10.0.2.105 55272 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:04.201627 0.044973 tcp 10.0.2.105 55273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:04.246879 0.137876 tcp 10.0.2.105 55274 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:04.453171 2.999967 tcp 10.0.2.105 55275 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:13.452087 0.000000 tcp 10.0.2.105 55275 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:19.452156 0.041823 tcp 10.0.2.105 55276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:19.494376 0.042615 tcp 10.0.2.105 55277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:19.536870 0.138653 tcp 10.0.2.105 55278 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:08:19.690487 3.004860 tcp 10.0.2.105 55279 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:28.693850 0.000000 tcp 10.0.2.105 55279 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:34.683002 3.003861 tcp 10.0.2.105 55280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:43.685465 0.000000 tcp 10.0.2.105 55280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:48.382555 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:08:49.684164 2.994378 tcp 10.0.2.105 55281 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:08:58.687094 0.000000 tcp 10.0.2.105 55281 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:09:03.717690 3.001111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:09:10.724318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:09:18.727226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:09:34.728992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:10:06.737165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:14:04.689120 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:14:04.689217 3.002123 tcp 10.0.2.105 55282 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:13.690047 0.000000 tcp 10.0.2.105 55282 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:19.691025 0.046489 tcp 10.0.2.105 55283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:19.737753 0.042982 tcp 10.0.2.105 55284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:19.781085 0.135910 tcp 10.0.2.105 55285 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:19.938645 3.004745 tcp 10.0.2.105 55286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:28.941963 0.000000 tcp 10.0.2.105 55286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:34.941544 0.045409 tcp 10.0.2.105 55287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:34.987243 0.048178 tcp 10.0.2.105 55288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:35.035701 0.138546 tcp 10.0.2.105 55289 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:35.183649 3.001551 tcp 10.0.2.105 55290 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:44.183707 0.000000 tcp 10.0.2.105 55290 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:50.183389 0.041898 tcp 10.0.2.105 55291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:50.225587 0.044502 tcp 10.0.2.105 55292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:50.270372 0.134103 tcp 10.0.2.105 55293 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:14:50.415617 3.001578 tcp 10.0.2.105 55294 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:14:59.425938 0.000000 tcp 10.0.2.105 55294 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:15:05.414343 2.994368 tcp 10.0.2.105 55295 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:15:14.417363 0.000000 tcp 10.0.2.105 55295 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:15:19.384699 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:15:20.416425 2.993976 tcp 10.0.2.105 55296 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:15:29.408906 0.000000 tcp 10.0.2.105 55296 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:16:10.741328 3.001473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:16:17.748333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:16:25.749997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:16:41.753433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:17:13.758979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:23:17.765631 3.031526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 18:23:24.781247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:23:32.777892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:23:48.786844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:24:20.799480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:24:36.205712 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:24:36.205819 0.186055 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.372930 0.090506 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.446008 0.172228 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.595074 0.062207 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.706382 0.173550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.875824 0.085181 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:36.931126 0.167712 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.075929 0.110065 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.149027 0.176659 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.296042 0.167118 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.410427 0.185532 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.588192 0.175432 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.759994 0.080777 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:37.831035 0.217438 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.041170 0.175271 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.216522 0.048116 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.247933 0.086692 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.313138 0.365351 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.680799 0.115755 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:38.836507 0.241921 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.052128 0.053526 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.131349 0.036671 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.157610 0.204470 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.355506 0.072837 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.407067 0.072467 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:39.695287 0.106132 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:24:50.446043 2.994060 tcp 10.0.2.105 55297 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:24:59.438869 0.000000 tcp 10.0.2.105 55297 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:04.385352 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:25:05.448666 0.042933 tcp 10.0.2.105 55298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:05.491875 0.043260 tcp 10.0.2.105 55299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:05.535411 0.137698 tcp 10.0.2.105 55300 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:05.734378 2.997501 tcp 10.0.2.105 55301 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:14.730618 0.000000 tcp 10.0.2.105 55301 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:20.729530 0.042119 tcp 10.0.2.105 55302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:20.771943 0.045891 tcp 10.0.2.105 55303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:20.818205 0.136503 tcp 10.0.2.105 55304 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:21.022671 3.001217 tcp 10.0.2.105 55305 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:30.022582 0.000000 tcp 10.0.2.105 55305 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:36.021448 0.036801 tcp 10.0.2.105 55306 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:36.058503 0.043647 tcp 10.0.2.105 55307 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:36.101967 0.138396 tcp 10.0.2.105 55308 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:25:36.470763 3.008222 tcp 10.0.2.105 55309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:45.478826 0.000000 tcp 10.0.2.105 55309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:25:51.464055 3.006479 tcp 10.0.2.105 55310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:26:00.480746 0.000000 tcp 10.0.2.105 55310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:26:05.392445 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:26:06.474657 2.987461 tcp 10.0.2.105 55311 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:26:15.461276 0.000000 tcp 10.0.2.105 55311 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:30:24.798896 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:30:31.806275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:30:39.807701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:30:55.810585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:31:21.468662 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:31:21.468878 3.003307 tcp 10.0.2.105 55312 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:31:27.816828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:31:30.470851 0.000000 tcp 10.0.2.105 55312 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:31:36.471590 0.043988 tcp 10.0.2.105 55313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:36.515913 0.043028 tcp 10.0.2.105 55314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:36.559313 0.136618 tcp 10.0.2.105 55315 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:36.782877 3.001201 tcp 10.0.2.105 55316 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:31:45.782564 0.000000 tcp 10.0.2.105 55316 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:31:51.786007 0.041706 tcp 10.0.2.105 55317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:51.827987 0.049256 tcp 10.0.2.105 55318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:51.877573 0.136111 tcp 10.0.2.105 55319 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:31:52.413317 3.006409 tcp 10.0.2.105 55320 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:01.418678 0.000000 tcp 10.0.2.105 55320 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:07.408576 0.042008 tcp 10.0.2.105 55321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:32:07.450868 0.042446 tcp 10.0.2.105 55322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:32:07.493619 0.135458 tcp 10.0.2.105 55323 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:32:07.799670 2.991413 tcp 10.0.2.105 55324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:16.796986 0.000000 tcp 10.0.2.105 55324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:22.790393 2.989495 tcp 10.0.2.105 55325 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:31.778420 0.000000 tcp 10.0.2.105 55325 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:36.385443 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:32:37.787658 3.004116 tcp 10.0.2.105 55326 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:32:46.790436 0.000000 tcp 10.0.2.105 55326 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:37:31.821975 3.002358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:37:38.830120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:37:46.831701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:37:52.790496 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:37:52.790663 3.003797 tcp 10.0.2.105 55327 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:01.793208 0.000000 tcp 10.0.2.105 55327 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:02.834749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:38:07.794086 0.062877 tcp 10.0.2.105 55328 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:07.857249 0.060768 tcp 10.0.2.105 55329 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:07.918339 0.150787 tcp 10.0.2.105 55330 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:08.084382 3.001817 tcp 10.0.2.105 55331 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:17.085519 0.000000 tcp 10.0.2.105 55331 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:23.084151 0.059150 tcp 10.0.2.105 55332 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:23.143595 0.061226 tcp 10.0.2.105 55333 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:23.205097 0.148226 tcp 10.0.2.105 55334 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:23.448075 3.000665 tcp 10.0.2.105 55335 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:32.459519 0.000000 tcp 10.0.2.105 55335 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:34.840911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:38:38.446580 0.060021 tcp 10.0.2.105 55336 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:38.506932 0.060596 tcp 10.0.2.105 55337 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:38.567860 0.153297 tcp 10.0.2.105 55338 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:38:39.051401 2.999922 tcp 10.0.2.105 55339 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:48.049446 0.000000 tcp 10.0.2.105 55339 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:38:54.052589 3.000899 tcp 10.0.2.105 55340 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:39:03.051389 0.000000 tcp 10.0.2.105 55340 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:39:07.878524 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:39:09.050660 3.003853 tcp 10.0.2.105 55341 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:39:18.053168 0.000000 tcp 10.0.2.105 55341 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:44:24.059623 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:44:24.059717 2.999166 tcp 10.0.2.105 55342 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:44:33.065823 0.000000 tcp 10.0.2.105 55342 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:44:38.847123 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 18:44:39.056812 0.063956 tcp 10.0.2.105 55343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:39.121069 0.062287 tcp 10.0.2.105 55344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:39.183620 0.146880 tcp 10.0.2.105 55345 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:39.369505 2.999715 tcp 10.0.2.105 55346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:44:45.854463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:44:48.367663 0.000000 tcp 10.0.2.105 55346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:44:53.855666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:44:54.367447 0.061381 tcp 10.0.2.105 55347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:54.429102 0.120644 tcp 10.0.2.105 55348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:54.550195 0.146408 tcp 10.0.2.105 55349 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:44:54.713894 2.997378 tcp 10.0.2.105 55350 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:03.712687 0.000000 tcp 10.0.2.105 55350 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:09.709033 0.061404 tcp 10.0.2.105 55351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:45:09.770730 0.062525 tcp 10.0.2.105 55352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:45:09.833592 0.150797 tcp 10.0.2.105 55353 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:45:09.858737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:45:09.995842 2.997347 tcp 10.0.2.105 55354 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:18.991981 0.000000 tcp 10.0.2.105 55354 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:24.990873 3.003931 tcp 10.0.2.105 55355 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:33.993480 0.000000 tcp 10.0.2.105 55355 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:38.880735 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:45:39.992406 3.004065 tcp 10.0.2.105 55356 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:45:41.864655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:45:48.995445 0.000000 tcp 10.0.2.105 55356 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:54:50.877747 3.000676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 18:54:57.884108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:54:58.865739 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:54:58.865861 0.173739 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.032701 0.091359 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.106745 0.167901 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.250682 0.059694 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.309503 0.197779 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.504246 0.088734 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.555022 0.170132 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.701251 0.109459 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.794528 0.173944 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:54:59.939464 0.299499 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.135404 0.176322 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.304754 0.176177 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.477479 0.082267 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.550163 0.216483 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.757933 0.171576 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.906418 0.045470 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:00.967466 0.088605 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.032165 0.358258 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.389705 0.115654 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.536794 0.237634 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.750837 0.051835 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.823738 0.039474 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:01.849981 0.195718 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:02.048747 0.070054 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:02.097630 0.068032 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:02.151560 0.101214 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/08 18:55:05.885745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:55:10.022383 3.003501 tcp 10.0.2.105 55357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:19.024853 0.000000 tcp 10.0.2.105 55357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:21.888130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:55:23.881423 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:55:25.025261 0.060647 tcp 10.0.2.105 55358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:25.086163 0.061982 tcp 10.0.2.105 55359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:25.148414 0.148512 tcp 10.0.2.105 55360 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:25.323723 2.994359 tcp 10.0.2.105 55361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:34.326594 0.000000 tcp 10.0.2.105 55361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:40.325930 0.059844 tcp 10.0.2.105 55362 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:40.386082 0.063977 tcp 10.0.2.105 55363 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:40.450432 0.152310 tcp 10.0.2.105 55364 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:40.694174 2.996198 tcp 10.0.2.105 55365 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:49.688780 0.000000 tcp 10.0.2.105 55365 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:55:53.894758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 18:55:55.687693 0.060327 tcp 10.0.2.105 55366 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:55.748348 0.060628 tcp 10.0.2.105 55367 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:55.809344 0.154036 tcp 10.0.2.105 55368 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/08 18:55:56.015026 2.997393 tcp 10.0.2.105 55369 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:56:05.010175 0.000000 tcp 10.0.2.105 55369 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:56:11.009742 3.003996 tcp 10.0.2.105 55370 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:56:20.012022 0.000000 tcp 10.0.2.105 55370 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:56:24.878617 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 18:56:26.011214 3.004137 tcp 10.0.2.105 55371 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 18:56:35.013946 0.000000 tcp 10.0.2.105 55371 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:01:41.015437 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:01:41.015548 2.991943 tcp 10.0.2.105 55372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:01:50.020911 0.000000 tcp 10.0.2.105 55372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:01:56.022557 0.062825 tcp 10.0.2.105 55373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:01:56.085573 0.060936 tcp 10.0.2.105 55374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:01:56.146781 0.152617 tcp 10.0.2.105 55375 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:01:56.533986 2.986628 tcp 10.0.2.105 55376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:01:57.904181 2.998477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:02:04.907563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:02:05.519370 0.000000 tcp 10.0.2.105 55376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:11.518722 0.062202 tcp 10.0.2.105 55377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:11.581184 0.062091 tcp 10.0.2.105 55378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:11.643567 0.152244 tcp 10.0.2.105 55379 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:11.816507 2.996026 tcp 10.0.2.105 55380 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:12.909920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:02:20.810800 0.000000 tcp 10.0.2.105 55380 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:26.810278 0.063597 tcp 10.0.2.105 55381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:26.874153 0.060281 tcp 10.0.2.105 55382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:26.934718 0.149271 tcp 10.0.2.105 55383 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:02:27.140446 3.003557 tcp 10.0.2.105 55384 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:28.912724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:02:36.143099 0.000000 tcp 10.0.2.105 55384 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:42.142027 3.004072 tcp 10.0.2.105 55385 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:51.144761 0.000000 tcp 10.0.2.105 55385 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:02:55.881602 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:02:57.143495 3.004486 tcp 10.0.2.105 55386 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:03:00.918326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:03:06.156395 0.000000 tcp 10.0.2.105 55386 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:12.146568 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:08:12.146790 2.993276 tcp 10.0.2.105 55387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:21.139035 0.000000 tcp 10.0.2.105 55387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:27.149655 0.060291 tcp 10.0.2.105 55388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:27.210195 0.061800 tcp 10.0.2.105 55389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:27.272263 0.150752 tcp 10.0.2.105 55390 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:27.434045 2.998675 tcp 10.0.2.105 55391 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:36.431309 0.000000 tcp 10.0.2.105 55391 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:42.430364 0.065105 tcp 10.0.2.105 55392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:42.495781 0.059972 tcp 10.0.2.105 55393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:42.556050 0.152106 tcp 10.0.2.105 55394 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:42.934476 3.006111 tcp 10.0.2.105 55395 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:51.936834 0.000000 tcp 10.0.2.105 55395 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:08:57.932639 0.062049 tcp 10.0.2.105 55396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:57.995063 0.061924 tcp 10.0.2.105 55397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:58.057277 0.154474 tcp 10.0.2.105 55398 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:08:58.295868 3.000992 tcp 10.0.2.105 55399 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:09:04.925023 3.003149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:09:07.295427 0.000000 tcp 10.0.2.105 55399 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:09:11.932406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:09:13.294350 2.994681 tcp 10.0.2.105 55400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:09:19.933603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:09:22.297163 0.000000 tcp 10.0.2.105 55400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:09:26.883585 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:09:28.295990 2.994001 tcp 10.0.2.105 55401 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:09:35.936049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:09:37.288556 0.000000 tcp 10.0.2.105 55401 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:10:07.943244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:14:43.299317 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:14:43.299407 3.003657 tcp 10.0.2.105 55402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:14:52.301645 0.000000 tcp 10.0.2.105 55402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:14:58.302200 0.062014 tcp 10.0.2.105 55403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:14:58.364526 0.060555 tcp 10.0.2.105 55404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:14:58.425376 0.145539 tcp 10.0.2.105 55405 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:14:58.582018 3.002766 tcp 10.0.2.105 55406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:07.583383 0.000000 tcp 10.0.2.105 55406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:13.582854 0.060196 tcp 10.0.2.105 55407 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:13.643321 0.061983 tcp 10.0.2.105 55408 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:13.705593 0.147446 tcp 10.0.2.105 55409 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:13.862488 2.994261 tcp 10.0.2.105 55410 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:22.855409 0.000000 tcp 10.0.2.105 55410 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:28.864649 0.061993 tcp 10.0.2.105 55411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:28.926907 0.061130 tcp 10.0.2.105 55412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:28.988311 0.152741 tcp 10.0.2.105 55413 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:15:29.479794 2.999663 tcp 10.0.2.105 55414 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:38.478086 0.000000 tcp 10.0.2.105 55414 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:44.476880 2.993910 tcp 10.0.2.105 55415 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:53.469403 0.000000 tcp 10.0.2.105 55415 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:15:58.386410 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:15:59.478364 3.003998 tcp 10.0.2.105 55416 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:16:08.481251 0.000000 tcp 10.0.2.105 55416 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:16:11.947929 3.002419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:16:18.956242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:16:26.957617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:16:42.960576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:17:14.966731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:23:18.972100 3.064389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 19:23:26.013491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:23:34.001660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:23:50.004594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:24:22.011210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:25:18.936073 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:25:18.936226 0.168640 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.079746 0.059319 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.310102 0.173227 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.476216 0.092707 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.631797 0.173249 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.831185 0.090245 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:19.883203 0.171559 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.240801 0.115770 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.318640 0.173014 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.464760 0.176185 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.664932 0.082733 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.739511 0.165053 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:20.929635 0.201538 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:21.122545 0.218194 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:21.331844 0.180948 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:21.689784 0.047325 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:21.720491 0.085208 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:21.833073 0.394689 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:22.433788 0.127941 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:22.601153 0.240513 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:22.820238 0.053703 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:22.942430 0.035953 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:22.964892 0.070297 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:23.239091 0.104887 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:23.312858 0.189638 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:23.495597 0.070955 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:25:29.517090 2.994946 tcp 10.0.2.105 55417 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:25:38.511727 0.000000 tcp 10.0.2.105 55417 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:25:43.377494 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:25:44.510769 0.066644 tcp 10.0.2.105 55418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:25:44.577746 0.063517 tcp 10.0.2.105 55419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:25:44.641557 0.147905 tcp 10.0.2.105 55420 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:25:44.963001 3.007588 tcp 10.0.2.105 55421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:25:53.963711 0.000000 tcp 10.0.2.105 55421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:25:59.965736 0.060641 tcp 10.0.2.105 55422 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:00.026672 0.060737 tcp 10.0.2.105 55423 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:00.087689 0.145431 tcp 10.0.2.105 55424 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:00.407385 2.999666 tcp 10.0.2.105 55425 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:09.405326 0.000000 tcp 10.0.2.105 55425 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:15.404116 0.060867 tcp 10.0.2.105 55426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:15.465231 0.062873 tcp 10.0.2.105 55427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:15.528432 0.150279 tcp 10.0.2.105 55428 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:26:15.746190 2.992497 tcp 10.0.2.105 55429 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:24.752005 0.000000 tcp 10.0.2.105 55429 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:30.746046 2.994022 tcp 10.0.2.105 55430 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:39.738684 0.000000 tcp 10.0.2.105 55430 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:44.385391 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:26:45.747642 3.003908 tcp 10.0.2.105 55431 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:26:54.753553 0.000000 tcp 10.0.2.105 55431 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:30:26.015832 3.002413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:30:33.024131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:30:41.026777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:30:57.028503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:31:29.034650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:32:00.751293 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:32:00.751493 3.004328 tcp 10.0.2.105 55432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:09.752671 0.000000 tcp 10.0.2.105 55432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:15.754782 0.063039 tcp 10.0.2.105 55433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:15.818069 0.061943 tcp 10.0.2.105 55434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:15.880455 0.147779 tcp 10.0.2.105 55435 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:16.180495 3.006087 tcp 10.0.2.105 55436 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:25.185085 0.000000 tcp 10.0.2.105 55436 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:31.174436 0.061965 tcp 10.0.2.105 55437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:31.236676 0.062649 tcp 10.0.2.105 55438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:31.299585 0.145066 tcp 10.0.2.105 55439 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:31.461734 2.998013 tcp 10.0.2.105 55440 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:40.469903 0.000000 tcp 10.0.2.105 55440 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:46.457488 0.061537 tcp 10.0.2.105 55441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:46.519313 0.063494 tcp 10.0.2.105 55442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:46.583171 0.150906 tcp 10.0.2.105 55443 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:32:46.898966 3.001752 tcp 10.0.2.105 55444 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:32:55.899498 0.000000 tcp 10.0.2.105 55444 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:33:01.897632 3.007295 tcp 10.0.2.105 55445 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:33:10.901087 0.000000 tcp 10.0.2.105 55445 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:33:15.878603 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:33:16.899813 3.004069 tcp 10.0.2.105 55446 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:33:25.902936 0.000000 tcp 10.0.2.105 55446 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:37:33.040486 3.002552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:37:40.048794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:37:48.050125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:38:04.053466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:38:31.903563 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:38:31.903703 3.003243 tcp 10.0.2.105 55447 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:38:36.059078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:38:40.905480 0.000000 tcp 10.0.2.105 55447 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:38:46.905883 0.061454 tcp 10.0.2.105 55448 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:38:46.967638 0.061434 tcp 10.0.2.105 55449 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:38:47.029441 0.145877 tcp 10.0.2.105 55450 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:38:47.222324 2.996656 tcp 10.0.2.105 55451 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:38:56.227663 0.000000 tcp 10.0.2.105 55451 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:02.216666 0.060990 tcp 10.0.2.105 55452 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:02.277934 0.062457 tcp 10.0.2.105 55453 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:02.340669 0.151570 tcp 10.0.2.105 55454 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:02.517406 3.003581 tcp 10.0.2.105 55455 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:11.519501 0.000000 tcp 10.0.2.105 55455 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:17.518529 0.061488 tcp 10.0.2.105 55456 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:17.580326 0.064920 tcp 10.0.2.105 55457 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:17.645577 0.147823 tcp 10.0.2.105 55458 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:39:17.803737 2.999506 tcp 10.0.2.105 55459 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:26.801565 0.000000 tcp 10.0.2.105 55459 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:32.800170 3.004174 tcp 10.0.2.105 55460 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:41.803310 0.000000 tcp 10.0.2.105 55460 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:46.379637 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:39:47.801822 3.003900 tcp 10.0.2.105 55461 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:39:56.804492 0.000000 tcp 10.0.2.105 55461 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:44:40.064825 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:44:47.072083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:44:55.073452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:45:02.805144 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:45:02.805303 2.993679 tcp 10.0.2.105 55462 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:11.075904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:45:11.797726 0.000000 tcp 10.0.2.105 55462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:17.808042 0.064339 tcp 10.0.2.105 55463 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:17.872674 0.060521 tcp 10.0.2.105 55464 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:17.933534 0.152787 tcp 10.0.2.105 55465 -> 195.113.214.249 443 SRPA* 0 0 36 18442 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:18.137150 3.003936 tcp 10.0.2.105 55466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:27.139110 0.000000 tcp 10.0.2.105 55466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:33.139373 0.062598 tcp 10.0.2.105 55467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:33.202117 0.060478 tcp 10.0.2.105 55468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:33.262879 0.143294 tcp 10.0.2.105 55469 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:33.454738 2.998275 tcp 10.0.2.105 55470 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:42.451546 0.000000 tcp 10.0.2.105 55470 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:43.082705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:45:48.450915 0.061309 tcp 10.0.2.105 55471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:48.512571 0.063840 tcp 10.0.2.105 55472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:48.576706 0.150345 tcp 10.0.2.105 55473 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:45:48.822696 3.002088 tcp 10.0.2.105 55474 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:45:57.823630 0.000000 tcp 10.0.2.105 55474 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:46:03.822835 3.003779 tcp 10.0.2.105 55475 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:46:12.825242 0.000000 tcp 10.0.2.105 55475 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:46:17.381743 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:46:18.824140 2.993910 tcp 10.0.2.105 55476 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:46:27.826993 0.000000 tcp 10.0.2.105 55476 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:54:52.094688 3.001919 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 19:54:59.101792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:55:07.103618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:55:23.106808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:55:52.579144 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:55:52.579284 0.173498 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:52.729850 0.065346 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:52.964279 0.174277 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.130383 0.088716 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.253795 0.173021 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.423793 0.088235 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.547626 0.170164 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.792648 0.175017 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:53.964582 0.079799 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 1892 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:54.237017 0.393103 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:54.484796 0.180473 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:54.710651 0.113662 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:54.782711 0.200145 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:54.954928 0.217319 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:55.113104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 19:55:55.164654 0.175210 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:55.410294 0.045311 udp 10.0.2.105 7010 <-> 79.227.136.221 2430 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:55.439908 0.086146 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:55.570487 0.431802 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.001886 0.063865 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.350808 0.034331 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.383018 0.069987 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.439232 0.127709 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.576905 0.237329 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.791919 0.070394 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:56.973334 0.103666 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:55:57.044799 0.193650 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/08 19:56:03.855473 2.993934 tcp 10.0.2.105 55477 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:12.848108 0.000000 tcp 10.0.2.105 55477 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:17.388494 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:56:18.859306 0.063699 tcp 10.0.2.105 55478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:18.923289 0.062732 tcp 10.0.2.105 55479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:18.986413 0.151774 tcp 10.0.2.105 55480 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:19.154405 2.996987 tcp 10.0.2.105 55481 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:28.150159 0.000000 tcp 10.0.2.105 55481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:34.149428 0.060934 tcp 10.0.2.105 55482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:34.210616 0.059763 tcp 10.0.2.105 55483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:34.270647 0.146157 tcp 10.0.2.105 55484 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:34.462030 3.001450 tcp 10.0.2.105 55485 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:43.461995 0.000000 tcp 10.0.2.105 55485 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:49.461486 0.062865 tcp 10.0.2.105 55486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:49.524654 0.059540 tcp 10.0.2.105 55487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:49.584487 0.144869 tcp 10.0.2.105 55488 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 19:56:49.753935 3.001476 tcp 10.0.2.105 55489 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:56:58.754059 0.000000 tcp 10.0.2.105 55489 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:57:04.753001 3.003989 tcp 10.0.2.105 55490 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:57:13.755483 0.000000 tcp 10.0.2.105 55490 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:57:18.382039 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 19:57:19.754146 2.994583 tcp 10.0.2.105 55491 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 19:57:28.760633 0.000000 tcp 10.0.2.105 55491 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:01:59.118529 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:02:06.125736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:02:14.127542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:02:30.130590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:02:34.757860 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:02:34.758029 3.003349 tcp 10.0.2.105 55492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:02:43.759884 0.000000 tcp 10.0.2.105 55492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:02:49.760751 0.060796 tcp 10.0.2.105 55493 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:02:49.821782 0.061429 tcp 10.0.2.105 55494 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:02:49.883526 0.150553 tcp 10.0.2.105 55495 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:02:50.304168 2.999397 tcp 10.0.2.105 55496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:02:59.302520 0.000000 tcp 10.0.2.105 55496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:02.141012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:03:05.301464 0.059501 tcp 10.0.2.105 55497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:05.361241 0.064109 tcp 10.0.2.105 55498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:05.425621 0.154708 tcp 10.0.2.105 55499 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:05.597992 3.009745 tcp 10.0.2.105 55500 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:14.604567 0.000000 tcp 10.0.2.105 55500 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:20.593438 0.060338 tcp 10.0.2.105 55501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:20.654008 0.061646 tcp 10.0.2.105 55502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:20.715966 0.151943 tcp 10.0.2.105 55503 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:03:21.070808 2.996537 tcp 10.0.2.105 55504 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:30.076892 0.000000 tcp 10.0.2.105 55504 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:36.065467 2.993878 tcp 10.0.2.105 55505 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:45.058699 0.000000 tcp 10.0.2.105 55505 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:03:49.885102 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:03:51.067406 2.993565 tcp 10.0.2.105 55506 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:04:00.059770 0.000000 tcp 10.0.2.105 55506 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:06.070427 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:09:06.070533 3.003541 tcp 10.0.2.105 55507 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:06.143123 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:09:13.149899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:09:15.072929 0.000000 tcp 10.0.2.105 55507 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:21.073320 0.060896 tcp 10.0.2.105 55508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:21.134547 0.060807 tcp 10.0.2.105 55509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:21.151376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:09:21.195681 0.151253 tcp 10.0.2.105 55510 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:21.482230 3.004162 tcp 10.0.2.105 55511 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:30.484816 0.000000 tcp 10.0.2.105 55511 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:36.486256 0.061693 tcp 10.0.2.105 55512 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:36.548242 0.061131 tcp 10.0.2.105 55513 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:36.609636 0.144695 tcp 10.0.2.105 55514 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:36.765453 2.992679 tcp 10.0.2.105 55515 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:37.156202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:09:45.766698 0.000000 tcp 10.0.2.105 55515 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:09:51.756132 0.061046 tcp 10.0.2.105 55516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:51.817513 0.064303 tcp 10.0.2.105 55517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:51.882075 0.151900 tcp 10.0.2.105 55518 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:09:52.063297 2.996844 tcp 10.0.2.105 55519 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:10:01.058336 0.000000 tcp 10.0.2.105 55519 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:10:07.058138 3.003612 tcp 10.0.2.105 55520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:10:09.160738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:10:16.059934 0.000000 tcp 10.0.2.105 55520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:10:20.877240 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:10:22.059002 3.004380 tcp 10.0.2.105 55521 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:10:31.061869 0.000000 tcp 10.0.2.105 55521 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:15:37.062539 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:15:37.062694 3.004023 tcp 10.0.2.105 55522 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:15:46.064979 0.000000 tcp 10.0.2.105 55522 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:15:52.065840 0.061848 tcp 10.0.2.105 55523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:15:52.128012 0.060468 tcp 10.0.2.105 55524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:15:52.188757 0.144437 tcp 10.0.2.105 55525 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:15:52.412971 2.991209 tcp 10.0.2.105 55526 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:01.407049 0.000000 tcp 10.0.2.105 55526 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:07.406507 0.064678 tcp 10.0.2.105 55527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:07.471487 0.060442 tcp 10.0.2.105 55528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:07.532205 0.149248 tcp 10.0.2.105 55529 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:07.691703 2.998896 tcp 10.0.2.105 55530 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:13.166457 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:16:16.689013 0.000000 tcp 10.0.2.105 55530 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:20.173757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:16:22.687937 0.060376 tcp 10.0.2.105 55531 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:22.748606 0.061854 tcp 10.0.2.105 55532 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:22.810783 0.156608 tcp 10.0.2.105 55533 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:16:23.008977 3.003317 tcp 10.0.2.105 55534 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:28.175193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:16:32.010226 0.000000 tcp 10.0.2.105 55534 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:38.009650 3.004147 tcp 10.0.2.105 55535 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:44.178612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:16:47.012599 0.000000 tcp 10.0.2.105 55535 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:16:51.879143 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:16:53.011457 3.003405 tcp 10.0.2.105 55536 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:17:02.014092 0.000000 tcp 10.0.2.105 55536 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:17:16.184445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:23:20.190753 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 20:23:27.198151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:23:35.199375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:23:51.202411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:24:23.208369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:26:06.206308 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:26:06.206402 0.180896 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:06.380088 0.169527 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:06.655647 0.063929 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:06.718722 0.093601 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:06.794703 0.174137 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:06.965496 0.081739 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:07.303376 0.170669 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:07.451058 0.170773 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:07.602697 0.175483 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:07.775321 0.082294 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:07.847293 0.177823 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.017961 0.116230 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.041261 3.001984 tcp 10.0.2.105 55537 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:08.094338 0.177744 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.244088 0.213228 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.450400 0.087679 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.518204 0.176760 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:08.781041 0.000000 udp 10.0.2.105 7010 -> 79.227.136.221 2430 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 20:26:17.042525 0.000000 tcp 10.0.2.105 55537 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:23.046159 0.063454 tcp 10.0.2.105 55538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:23.109953 0.060833 tcp 10.0.2.105 55539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:23.171048 0.152870 tcp 10.0.2.105 55540 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:23.342025 3.007443 tcp 10.0.2.105 55541 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:25.379297 0.062604 tcp 10.0.2.105 55542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:25.442192 0.060614 tcp 10.0.2.105 55543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:25.503161 0.152638 tcp 10.0.2.105 55544 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:25.656443 0.393532 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.149670 0.051309 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.198673 0.039752 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.276864 0.071211 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.354871 0.072099 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.406043 0.105838 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.480713 0.114961 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.672543 0.237710 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:26.888709 0.194159 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:26:32.343942 0.000000 tcp 10.0.2.105 55541 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:38.336229 0.060527 tcp 10.0.2.105 55545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:38.397068 0.061130 tcp 10.0.2.105 55546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:38.458427 0.146948 tcp 10.0.2.105 55547 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:26:38.730783 3.010396 tcp 10.0.2.105 55548 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:47.746563 0.000000 tcp 10.0.2.105 55548 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:26:53.724858 2.994251 tcp 10.0.2.105 55549 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:27:02.717794 0.000000 tcp 10.0.2.105 55549 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:27:07.384382 0.000392 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:30:27.214967 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:30:34.221843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:30:42.223170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:30:58.226670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:31:30.232533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:32:08.728655 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:32:08.728808 3.003245 tcp 10.0.2.105 55550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:17.730883 0.000000 tcp 10.0.2.105 55550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:23.731013 0.063597 tcp 10.0.2.105 55551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:23.794893 0.059026 tcp 10.0.2.105 55552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:23.854184 0.144996 tcp 10.0.2.105 55553 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:24.071295 3.002693 tcp 10.0.2.105 55554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:33.072890 0.000000 tcp 10.0.2.105 55554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:39.071776 0.061241 tcp 10.0.2.105 55555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:39.133331 0.065504 tcp 10.0.2.105 55556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:39.199155 0.145607 tcp 10.0.2.105 55557 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:39.376804 2.999414 tcp 10.0.2.105 55558 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:48.374632 0.000000 tcp 10.0.2.105 55558 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:32:54.373939 0.060986 tcp 10.0.2.105 55559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:54.435210 0.063930 tcp 10.0.2.105 55560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:54.499426 0.150750 tcp 10.0.2.105 55561 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:32:54.669058 2.999144 tcp 10.0.2.105 55562 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:33:03.676765 0.000000 tcp 10.0.2.105 55562 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:33:09.666013 2.993432 tcp 10.0.2.105 55563 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:33:18.661193 0.000000 tcp 10.0.2.105 55563 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:33:23.390987 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:33:24.668685 2.992774 tcp 10.0.2.105 55564 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:33:33.659962 0.000000 tcp 10.0.2.105 55564 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:37:34.238649 3.001416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:37:41.245751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:37:49.247278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:38:05.250007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:38:37.256408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:38:39.670243 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:38:39.670388 3.003781 tcp 10.0.2.105 55565 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:38:48.673203 0.000000 tcp 10.0.2.105 55565 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:38:54.672951 0.065378 tcp 10.0.2.105 55566 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:38:54.738619 0.061371 tcp 10.0.2.105 55567 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:38:54.800283 0.150397 tcp 10.0.2.105 55568 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:38:54.960014 3.005671 tcp 10.0.2.105 55569 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:03.964908 0.000000 tcp 10.0.2.105 55569 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:09.953996 0.060638 tcp 10.0.2.105 55570 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:10.014935 0.060343 tcp 10.0.2.105 55571 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:10.075600 0.158087 tcp 10.0.2.105 55572 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:10.246986 2.991038 tcp 10.0.2.105 55573 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:19.246928 0.000000 tcp 10.0.2.105 55573 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:25.245977 0.059045 tcp 10.0.2.105 55574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:25.305317 0.063088 tcp 10.0.2.105 55575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:25.368690 0.147297 tcp 10.0.2.105 55576 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:39:25.529837 3.000066 tcp 10.0.2.105 55577 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:34.528510 0.000000 tcp 10.0.2.105 55577 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:40.527378 3.004154 tcp 10.0.2.105 55578 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:49.530147 0.000000 tcp 10.0.2.105 55578 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:39:54.377381 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:39:55.528939 3.004246 tcp 10.0.2.105 55579 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:40:04.532631 0.000000 tcp 10.0.2.105 55579 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:44:41.261946 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:44:48.269831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:44:56.273535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:45:10.532229 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:45:10.532394 3.003536 tcp 10.0.2.105 55580 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:12.274954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:45:19.534787 0.000000 tcp 10.0.2.105 55580 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:25.535020 0.059956 tcp 10.0.2.105 55581 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:25.595304 0.061295 tcp 10.0.2.105 55582 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:25.656903 0.150535 tcp 10.0.2.105 55583 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:25.914048 2.993862 tcp 10.0.2.105 55584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:34.916145 0.000000 tcp 10.0.2.105 55584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:40.915474 0.059543 tcp 10.0.2.105 55585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:40.975303 0.059680 tcp 10.0.2.105 55586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:41.035271 0.146393 tcp 10.0.2.105 55587 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:41.530813 2.999422 tcp 10.0.2.105 55588 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:44.279892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:45:50.529284 0.000000 tcp 10.0.2.105 55588 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:45:56.528706 0.062478 tcp 10.0.2.105 55589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:56.591528 0.061636 tcp 10.0.2.105 55590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:56.653517 0.151385 tcp 10.0.2.105 55591 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:45:56.965960 2.997218 tcp 10.0.2.105 55592 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:46:05.961319 0.000000 tcp 10.0.2.105 55592 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:46:11.960222 3.004312 tcp 10.0.2.105 55593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:46:20.962614 0.000000 tcp 10.0.2.105 55593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:46:25.880067 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:46:26.962037 3.004006 tcp 10.0.2.105 55594 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:46:35.964658 0.000000 tcp 10.0.2.105 55594 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:51:41.964972 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:51:41.965071 2.993695 tcp 10.0.2.105 55595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:51:50.978822 0.000000 tcp 10.0.2.105 55595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:51:56.968182 0.060848 tcp 10.0.2.105 55596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:51:57.029345 0.061382 tcp 10.0.2.105 55597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:51:57.091014 0.150245 tcp 10.0.2.105 55598 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:51:57.387256 2.993771 tcp 10.0.2.105 55599 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:06.379690 0.000000 tcp 10.0.2.105 55599 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:12.392379 0.063696 tcp 10.0.2.105 55600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:52:12.456391 0.060474 tcp 10.0.2.105 55601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:52:12.517172 0.150132 tcp 10.0.2.105 55602 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:52:12.741666 2.991798 tcp 10.0.2.105 55603 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:21.733973 0.000000 tcp 10.0.2.105 55603 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:27.749026 2.999512 tcp 10.0.2.105 55604 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:36.743504 0.000000 tcp 10.0.2.105 55604 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:52:41.380024 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:54:54.294649 3.000980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 20:55:01.301264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:55:09.302750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:55:25.305569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:55:57.313133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 20:56:53.062345 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:56:53.062512 0.000000 udp 10.0.2.105 7010 -> 79.227.136.221 2430 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/08 20:57:10.178986 0.059737 tcp 10.0.2.105 55605 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:10.239021 0.060125 tcp 10.0.2.105 55606 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:10.299421 0.145783 tcp 10.0.2.105 55607 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:10.445727 0.061808 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:10.506675 0.090245 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:10.579426 0.173902 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:10.750971 0.173084 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:10.916205 0.170443 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.061729 0.173351 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.257950 0.179760 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.375524 0.082444 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.547009 0.084605 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.659005 0.188903 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.841426 0.111747 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:11.954558 0.177655 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:12.129131 0.088087 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:12.272678 0.172711 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:12.478473 0.216673 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:12.688209 0.176009 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:12.836726 0.404393 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.321069 0.054256 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.370166 0.036285 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.393113 0.071249 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.448677 0.070186 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.575066 0.109523 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.651755 0.103346 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.770836 0.237796 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:13.984556 0.197902 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/08 20:57:42.743839 2.993682 tcp 10.0.2.105 55608 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:57:47.379887 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:57:51.746470 0.000000 tcp 10.0.2.105 55608 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:57:57.745457 0.060018 tcp 10.0.2.105 55609 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:57.805762 0.064318 tcp 10.0.2.105 55610 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:57.870370 0.144581 tcp 10.0.2.105 55611 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:57:58.114513 2.994570 tcp 10.0.2.105 55612 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:07.108125 0.000000 tcp 10.0.2.105 55612 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:13.107629 0.063848 tcp 10.0.2.105 55613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:13.171767 0.061218 tcp 10.0.2.105 55614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:13.233297 0.151179 tcp 10.0.2.105 55615 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:13.478084 3.003821 tcp 10.0.2.105 55616 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:22.480658 0.000000 tcp 10.0.2.105 55616 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:28.479721 0.060342 tcp 10.0.2.105 55617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:28.540551 0.059254 tcp 10.0.2.105 55618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:28.600064 0.143497 tcp 10.0.2.105 55619 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/08 20:58:28.955152 2.998679 tcp 10.0.2.105 55620 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:37.954856 0.000000 tcp 10.0.2.105 55620 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:43.955333 3.005479 tcp 10.0.2.105 55621 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:52.955881 0.000000 tcp 10.0.2.105 55621 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:58:57.881357 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 20:58:58.953741 3.005279 tcp 10.0.2.105 55622 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 20:59:07.965765 0.000000 tcp 10.0.2.105 55622 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:02:01.317198 3.002100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 21:02:08.325370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:02:16.326793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:02:32.329466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:03:04.335697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:04:13.956568 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:04:13.956672 2.993453 tcp 10.0.2.105 55623 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:04:22.951999 0.000000 tcp 10.0.2.105 55623 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:04:28.961052 0.060427 tcp 10.0.2.105 55624 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:29.021747 0.061195 tcp 10.0.2.105 55625 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:29.083218 0.146123 tcp 10.0.2.105 55626 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:29.404079 2.998913 tcp 10.0.2.105 55627 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:04:38.718225 0.000000 tcp 10.0.2.105 55627 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:04:44.665940 0.058754 tcp 10.0.2.105 55628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:44.724940 0.060895 tcp 10.0.2.105 55629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:44.786127 0.148952 tcp 10.0.2.105 55630 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:04:45.237968 2.985632 tcp 10.0.2.105 55631 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:04:54.168028 0.000000 tcp 10.0.2.105 55631 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:00.108547 0.060754 tcp 10.0.2.105 55632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:05:00.169557 0.060774 tcp 10.0.2.105 55633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:05:00.230608 0.145443 tcp 10.0.2.105 55634 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:05:00.516826 2.975682 tcp 10.0.2.105 55635 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:09.439671 0.000000 tcp 10.0.2.105 55635 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:15.394163 2.994410 tcp 10.0.2.105 55636 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:24.397025 0.000000 tcp 10.0.2.105 55636 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:29.384197 0.041748 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:05:30.424345 2.971788 tcp 10.0.2.105 55637 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:05:39.388569 0.000000 tcp 10.0.2.105 55637 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:09:08.341838 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 21:09:15.348956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:09:23.353260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:09:39.353482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:10:11.359725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:10:45.399085 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:10:45.399181 3.003697 tcp 10.0.2.105 55638 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:10:54.401362 0.000000 tcp 10.0.2.105 55638 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:00.401735 0.060471 tcp 10.0.2.105 55639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:00.462467 0.059273 tcp 10.0.2.105 55640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:00.522044 0.148288 tcp 10.0.2.105 55641 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:00.680280 2.994501 tcp 10.0.2.105 55642 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:09.673331 0.000000 tcp 10.0.2.105 55642 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:15.672945 0.060253 tcp 10.0.2.105 55643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:15.733490 0.060124 tcp 10.0.2.105 55644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:15.793957 0.150253 tcp 10.0.2.105 55645 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:15.964958 3.002299 tcp 10.0.2.105 55646 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:24.965528 0.000000 tcp 10.0.2.105 55646 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:30.964656 0.060869 tcp 10.0.2.105 55647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:31.025814 0.062469 tcp 10.0.2.105 55648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:31.088537 0.151985 tcp 10.0.2.105 55649 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:11:31.250902 2.998040 tcp 10.0.2.105 55650 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:40.247365 0.000000 tcp 10.0.2.105 55650 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:46.246250 2.993924 tcp 10.0.2.105 55651 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:55.239494 0.000000 tcp 10.0.2.105 55651 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:11:59.885232 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:12:01.247915 3.003870 tcp 10.0.2.105 55652 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:12:10.250504 0.000000 tcp 10.0.2.105 55652 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:16:15.365949 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 21:16:22.373003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:16:30.374717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:16:46.377503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:17:16.250601 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:17:16.250699 3.004096 tcp 10.0.2.105 55653 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:17:18.383561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:17:25.253334 0.000000 tcp 10.0.2.105 55653 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:17:31.253775 0.062137 tcp 10.0.2.105 55654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:31.316234 0.060366 tcp 10.0.2.105 55655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:31.376847 0.152006 tcp 10.0.2.105 55656 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:31.538050 3.009016 tcp 10.0.2.105 55657 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:17:40.545388 0.000000 tcp 10.0.2.105 55657 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:17:46.534915 0.061970 tcp 10.0.2.105 55658 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:46.597178 0.062265 tcp 10.0.2.105 55659 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:46.659804 0.149734 tcp 10.0.2.105 55660 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:17:46.821750 2.997267 tcp 10.0.2.105 55661 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:17:55.817246 0.000000 tcp 10.0.2.105 55661 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:01.816645 0.059853 tcp 10.0.2.105 55662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:18:01.876775 0.062322 tcp 10.0.2.105 55663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:18:01.939419 0.152136 tcp 10.0.2.105 55664 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:18:02.108194 3.002537 tcp 10.0.2.105 55665 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:11.109253 0.000000 tcp 10.0.2.105 55665 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:17.108081 3.004441 tcp 10.0.2.105 55666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:26.110890 0.000000 tcp 10.0.2.105 55666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:30.877135 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:18:32.109425 3.004487 tcp 10.0.2.105 55667 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:18:41.112639 0.000000 tcp 10.0.2.105 55667 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:23:22.390146 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 21:23:29.397033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:23:37.398874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:23:53.401641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:24:25.407777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:27:25.446424 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:27:25.446581 0.171029 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:25.613854 0.173634 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:25.780785 0.062392 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.046490 0.092496 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.122731 0.170213 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.269870 0.174058 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.472874 0.157062 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.577548 0.082978 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.734133 0.080434 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.805143 0.181123 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:26.976807 0.116665 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:27.183313 0.176862 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:27.356917 0.084097 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:27.441283 0.180986 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:27.593193 0.174499 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:27.801496 0.213454 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:28.007301 0.391981 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:28.456487 0.054911 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:28.585077 0.038927 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:28.622704 0.072372 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:28.981801 0.171300 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:29.254672 0.107801 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:29.586561 0.212410 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:29.787295 0.103435 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:29.976900 0.237756 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:27:32.136476 2.993161 tcp 10.0.2.105 55668 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:27:41.128757 0.000000 tcp 10.0.2.105 55668 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/08 21:27:47.138957 0.063623 tcp 10.0.2.105 55669 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:27:47.202825 0.062036 tcp 10.0.2.105 55670 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:27:47.265124 0.150300 tcp 10.0.2.105 55671 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:27:47.434017 0.538862 tcp 10.0.2.105 55672 -> 31.192.24.67 3527 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/08 21:30:29.413852 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 21:30:36.420945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:30:44.422569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:31:00.425748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:31:32.435768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:37:36.437642 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 21:37:43.445066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:37:51.446959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:38:07.449941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:38:39.455950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:44:43.462119 3.001023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 21:44:50.474889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:44:58.470772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:45:14.473327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:45:46.481290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:54:55.492420 3.010876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 21:55:02.509042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:55:10.513097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:55:26.513286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:55:58.521313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 21:57:43.140179 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 21:57:43.140287 0.072744 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.222330 0.091181 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.295024 0.173429 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.464814 0.173221 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.629592 0.170563 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.778057 0.172290 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:43.984158 0.693155 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:44.625894 0.080954 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:44.744845 0.083188 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:44.817551 0.182467 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:44.990073 0.116282 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.065781 0.175943 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.238878 0.084323 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.301967 0.179766 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.452338 0.171671 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.601369 0.216231 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:45.810029 0.393183 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.415573 0.052623 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.596421 0.039198 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.621961 0.070762 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.699360 0.073318 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.752300 0.115728 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:46.961921 0.235843 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:47.176360 0.110195 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:47.251431 0.197255 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/08 21:57:47.977703 0.564030 tcp 10.0.2.105 55673 -> 31.192.24.67 3527 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/02/08 22:02:02.526448 3.046757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:02:09.551741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:02:17.544456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:02:33.547240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:03:05.553554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:09:09.560421 3.000876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:09:16.571661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:09:24.568489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:09:40.571403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:10:12.577395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:16:16.584511 3.000556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:16:23.590929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:16:31.592178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:16:47.595126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:17:19.601451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:23:23.608502 3.059934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:23:30.647954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:23:38.626449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:23:54.629380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:24:26.635330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:27:48.549398 0.188921 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 22:27:48.738398 0.527929 tcp 10.0.2.105 55674 -> 31.192.24.67 3527 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/08 22:28:16.115596 0.174561 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.286230 0.062898 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.347326 0.091082 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.418623 0.172134 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.582646 0.165953 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2014 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.726818 0.172991 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.875224 0.096869 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:16.959621 1.216868 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.070774 0.082949 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.116525 0.183283 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.293332 0.108095 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.366823 0.177085 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.541150 0.085362 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.607465 0.178069 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:18.756630 0.402531 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.160701 0.212524 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.374668 0.212922 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.579058 0.053583 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.645336 0.036720 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.696877 0.068288 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.750485 0.071830 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.801370 0.115494 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:19.936500 0.201807 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:20.132479 0.240653 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:20.347469 0.117051 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:28:20.884858 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 22:30:30.642905 2.999959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 22:30:37.648656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:30:45.650386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:31:01.653198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:31:33.663561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:37:37.665594 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:37:44.672899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:37:52.674219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:38:08.677379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:38:40.683411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:44:44.690014 3.001000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:44:51.696742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:44:59.698335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:45:15.701188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:45:47.707216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:51:51.712573 3.014800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 22:51:58.730595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:52:06.732281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:52:22.735444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:52:54.743467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:57:49.094965 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 22:57:49.095056 0.540413 tcp 10.0.2.105 55675 -> 31.192.24.67 3527 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/08 22:58:36.923571 0.174501 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.094536 0.061272 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.154401 0.090885 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.228822 0.175495 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.396011 0.171041 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.544977 0.169840 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.730625 0.080748 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.802302 0.178763 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:37.923187 0.098738 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.001774 0.179980 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.174618 0.112312 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.293869 0.175991 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.466150 0.081648 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.593271 0.175681 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:38.740836 0.374158 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.124787 0.186471 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.373340 0.217042 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.582993 0.052256 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.629972 0.036280 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.658896 0.075218 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.743668 0.070515 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:39.881069 0.115864 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:40.056491 0.191891 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:40.260484 0.237045 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:40.475633 0.105357 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/08 22:58:41.880165 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 22:58:58.747649 3.001311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/08 22:59:05.754603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:59:13.756780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 22:59:29.760676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:00:01.768866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:06:21.776739 2.999072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:06:28.781536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:06:36.782883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:06:52.786015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:07:24.792484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:13:28.868720 3.000765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:13:35.875694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:13:43.877076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:13:59.880078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:14:31.886586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:20:35.892046 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:20:42.899605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:20:50.901127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:21:06.904348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:21:38.910046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:27:42.915730 3.002073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:27:49.713671 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 23:27:49.713870 0.595852 tcp 10.0.2.105 55676 -> 31.192.24.67 3527 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/08 23:27:49.923539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:27:57.953917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:28:13.938850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:28:45.944176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:28:59.613937 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 23:28:59.614158 0.173608 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:28:59.784623 0.062997 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:28:59.846289 0.090589 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.027066 0.173019 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.192739 0.169021 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.339548 0.173214 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.488481 0.082662 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.584040 0.173021 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.701862 0.091093 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:00.841433 0.181901 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:01.013172 0.111541 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:01.114406 0.176079 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:01.287527 0.083800 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:01.714928 0.177165 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:01.860947 0.371122 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:02.240879 0.171161 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:02.430442 0.791951 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.211069 0.053616 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.340538 0.035923 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.369557 0.072873 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.479105 0.072844 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.531049 0.116072 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.729348 0.201636 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:03.925718 0.236146 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:29:04.138999 0.111911 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:34:49.950085 3.044562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:34:56.978850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:35:04.971288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:35:20.971985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:35:52.978146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:41:56.984101 3.001825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:42:03.991394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:42:11.993102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:42:27.995917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:43:00.002011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:53:28.018019 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/08 23:53:35.025020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:53:43.026898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:53:59.029444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:54:31.035596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/08 23:57:50.242606 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 23:57:50.242754 0.586831 tcp 10.0.2.105 55677 -> 31.192.24.67 3527 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/08 23:59:29.544959 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/08 23:59:29.545123 0.094806 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:29.620062 0.172364 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:29.784748 0.174100 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:29.955032 0.062124 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.015755 0.167266 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.161848 0.175155 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.312965 0.082620 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.405148 0.248007 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.598560 0.104317 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.720613 0.181789 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.894702 0.109371 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:30.972764 0.177309 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:31.146946 0.083287 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:31.271212 0.176715 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:31.419324 0.386178 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.015923 0.171952 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.208719 0.213273 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.414487 0.052452 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.533766 0.041359 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.677183 0.077189 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.737756 0.069670 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.787749 0.103389 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:32.908846 0.187597 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:33.091819 0.258201 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/08 23:59:33.326681 0.107863 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:00:35.042674 3.002652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 00:00:42.049188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:00:50.050049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:01:06.053609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:01:38.059117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:07:42.065729 3.001572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:07:49.073312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:07:57.075001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:08:13.084443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:08:45.083372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:14:49.090440 3.000316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:14:56.096805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:15:04.098270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:15:20.101535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:15:52.107559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:21:57.115002 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:22:04.123196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:22:12.124467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:22:28.126990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:23:00.133089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:27:50.832731 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 00:27:50.832918 0.765388 tcp 10.0.2.105 55678 -> 31.192.24.67 3527 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/09 00:29:04.139989 3.000210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:29:11.146643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:29:19.147585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:29:35.151110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:29:40.469181 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 00:29:40.469289 0.173803 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:40.639555 0.062084 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:40.700249 0.170793 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:40.847271 0.172269 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.060519 0.084778 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.135441 0.093073 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.209487 0.173210 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.375389 0.187071 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.493922 0.083880 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.630541 0.184008 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.803392 0.117266 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:41.881612 0.177506 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:42.055428 0.089205 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:42.164121 0.176618 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:42.311387 0.384796 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:42.716852 0.172961 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:42.912825 0.212844 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.117561 0.052306 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.196968 0.037618 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.226809 0.075359 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.285064 0.071120 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.337182 0.115515 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.476891 0.191117 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.661620 0.238321 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:29:43.877243 0.103916 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/09 00:30:07.157152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:36:11.162312 3.002427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:36:18.170135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:36:26.171836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:36:42.175111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:37:14.182809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:43:18.187077 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:43:25.194009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:43:33.195860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:43:49.198790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:44:21.204973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:54:09.212918 3.014300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 00:54:16.230136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:54:24.231788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:54:40.234729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:55:12.241164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 00:57:51.600739 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 00:57:51.600879 0.516586 tcp 10.0.2.105 55679 -> 31.192.24.67 3527 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/02/09 01:00:13.012029 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 01:00:13.012403 0.173895 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.163214 0.171231 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.397232 0.081103 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.469262 0.095600 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.547931 0.174471 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.719327 0.057705 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2022 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.777910 0.172838 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:13.943001 0.190122 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.074017 0.092384 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.147297 0.178983 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.317873 0.117245 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.440073 0.177171 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.613825 0.085405 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.734501 0.178109 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:14.883118 0.364326 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.273935 0.173762 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.422143 0.214625 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.629175 0.053259 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.696780 0.042665 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.733830 0.072473 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.790918 0.200859 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:15.983666 0.236213 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:16.196677 0.105023 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:16.270675 0.071442 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:00:16.332257 0.115570 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:01:16.800398 2.998614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 01:01:23.805178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:01:31.806616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:01:47.810523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:02:19.815699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:08:23.820904 3.002423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:08:30.828856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:08:38.830580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:08:54.833644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:09:26.839508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:15:35.909264 2.995300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:15:42.910443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:15:50.911633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:16:06.914866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:16:38.922480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:22:42.927288 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:22:49.934588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:22:57.935844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:23:13.939019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:23:45.944862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:27:52.454356 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 01:27:52.454505 0.595632 tcp 10.0.2.105 55680 -> 31.192.24.67 3527 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/09 01:29:49.950878 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:29:56.958205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:30:04.959699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:30:20.963119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:30:25.439853 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 01:30:25.440060 0.168721 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:25.586936 0.283361 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:26.347806 0.082104 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:26.420020 0.100773 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:26.670127 0.173711 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:26.840249 0.063481 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:26.902506 0.170847 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.066876 0.176668 udp 10.0.2.105 7010 <-> 79.25.16.144 9715 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.188618 0.082888 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.312026 0.181597 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.486289 0.113517 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.688144 0.177469 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:27.862182 0.083274 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:28.003918 0.178064 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:28.152325 0.363619 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:28.622431 0.173535 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:28.971645 0.215795 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:29.180645 0.051540 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:30.014826 0.037733 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:30.288358 0.076037 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:30.348469 0.197160 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:30.805856 0.072429 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:30.989696 0.115383 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:31.229337 0.237420 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:31.443927 0.109604 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2585 flow=From-Botnet-V2-UDP-Established 1970/02/09 01:30:52.968806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:36:56.981089 2.995401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:37:03.982815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:37:11.983764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:37:27.986761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:37:59.992721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:44:03.998649 3.033864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:44:11.016300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:44:19.022527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:44:35.020176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:45:07.026237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:54:33.032741 3.004636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 01:54:40.041605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:54:48.045012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:55:04.045080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:55:36.050601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 01:57:53.048450 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 01:57:53.048593 0.601219 tcp 10.0.2.105 55681 -> 31.192.24.67 3527 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:00:34.980544 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:00:34.980688 0.168883 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:35.127855 0.175531 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:35.346994 0.081764 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:35.418610 0.087035 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 5 1901 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:53.082036 0.075474 tcp 10.0.2.105 55682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:00:53.157868 0.065917 tcp 10.0.2.105 55683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:00:53.224149 0.360004 tcp 10.0.2.105 55684 -> 195.113.214.249 443 SRPA* 0 0 97 89400 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:00:53.585041 0.171390 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:53.753099 0.061981 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:53.813749 0.172274 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:00:53.978955 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:01:11.934398 0.063883 tcp 10.0.2.105 55685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:01:11.998553 0.062826 tcp 10.0.2.105 55686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:01:12.061646 0.297740 tcp 10.0.2.105 55687 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:01:12.359889 0.089381 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:12.410652 0.177173 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:12.580730 0.109875 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:12.654521 0.176845 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:12.828165 0.083821 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:13.147815 0.174524 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:13.294753 0.227385 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:13.500386 0.410203 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:13.919990 0.171722 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.185453 0.065175 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.321710 0.040927 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.349011 0.077009 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.408714 0.103432 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.552849 0.189994 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.737138 0.069874 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:14.787286 0.234937 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:15.001133 0.108153 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:01:40.058839 3.003910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 02:01:47.065536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:01:55.068231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:02:11.069092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:02:43.075310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:08:47.081342 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 02:08:54.088756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:09:02.089861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:09:18.093376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:09:50.099001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:15:57.109348 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 02:16:04.116681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:16:12.118153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:16:28.121323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:17:00.127480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:23:04.133559 3.011689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 02:23:11.150283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:23:19.153588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:23:35.155458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:24:07.161233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:27:53.657618 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:27:53.657802 0.675589 tcp 10.0.2.105 55688 -> 31.192.24.67 3527 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:30:11.167579 3.001319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 02:30:18.174897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:30:26.176488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:30:42.179414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:31:14.185405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:31:32.141353 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:31:32.141534 0.096688 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:32.219680 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:31:50.249115 0.065001 tcp 10.0.2.105 55689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:31:50.314429 0.061932 tcp 10.0.2.105 55690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:31:50.376722 0.152511 tcp 10.0.2.105 55691 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:31:50.529747 0.169601 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:50.676989 0.174065 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:50.884877 0.085228 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:50.958258 0.060976 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.025101 0.175251 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.196589 0.172723 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.361306 0.085093 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.409989 0.179867 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.581830 0.109325 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:31:51.683651 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:10.336587 0.063652 tcp 10.0.2.105 55692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:32:10.400575 0.061974 tcp 10.0.2.105 55693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:32:10.462897 0.156682 tcp 10.0.2.105 55694 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 02:32:10.620088 0.083692 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:10.682452 0.401613 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:11.104669 0.176708 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:11.251367 0.795566 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.039224 0.180923 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.247198 0.054832 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.311160 0.035153 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.429371 0.074161 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.487148 0.103490 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.596788 0.197389 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.836850 0.070942 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:12.888289 0.240993 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:13.102980 0.107315 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:13.202738 0.347516 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 2911 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:13.546929 0.148300 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 8 3165 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:13.677712 0.319214 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 8 3412 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:13.971570 0.157196 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2901 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:14.120126 0.102599 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:14.272899 0.312310 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 3205 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:14.562219 0.334328 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 2956 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:14.888726 0.330709 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3218 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:15.216621 0.172476 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 8 3081 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:15.349379 0.359549 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 8 3307 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:15.700439 0.137746 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2951 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:15.798490 0.194590 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3187 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:15.970808 0.785695 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 8 2899 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:16.770327 0.320124 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 2859 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:17.064264 0.329471 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 3172 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:17.369740 0.144508 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 3315 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:17.584564 1.575408 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3220 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:19.150163 0.133587 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 8 2975 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:19.270581 0.111137 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 8 2978 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:19.368454 0.371518 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 8 2965 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:19.861921 0.388169 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 8 3260 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:20.243745 0.132802 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 8 2981 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:20.355604 0.457933 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 8 3173 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:20.787468 0.160905 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 8 3076 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:32:20.918146 0.000000 udp 10.0.2.105 7010 -> 27.96.221.122 9852 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:28.231878 0.000000 udp 10.0.2.105 7010 -> 79.179.164.228 6729 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:37.024650 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:41.781306 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:32:43.994748 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:51.034844 0.000000 udp 10.0.2.105 7010 -> 62.212.47.101 7176 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:32:59.156244 0.000000 udp 10.0.2.105 7010 -> 176.61.33.208 5734 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:06.021094 0.168257 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:06.189351 0.000000 icmp 66.55.26.130 0x0303 -> 10.0.2.105 0x2b20 URP 192 1 214 flow=Background 1970/02/09 02:33:10.782969 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:33:12.936203 0.000000 udp 10.0.2.105 7010 -> 106.188.108.216 6198 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:19.125283 0.677923 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 8 3126 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:33:19.881879 0.000000 udp 10.0.2.105 7010 -> 220.98.160.219 9894 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:27.066318 0.000000 udp 10.0.2.105 7010 -> 78.189.27.204 9027 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:35.952729 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:40.777038 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:33:44.683344 0.000000 udp 10.0.2.105 7010 -> 78.171.118.189 9381 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:52.573729 0.000000 udp 10.0.2.105 7010 -> 83.110.240.245 1027 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:33:58.561803 0.000000 udp 10.0.2.105 7010 -> 120.151.43.201 4489 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:07.351017 0.000000 udp 10.0.2.105 7010 -> 122.160.72.227 1029 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:12.282754 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:34:16.027032 0.000000 udp 10.0.2.105 7010 -> 122.150.211.150 2196 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:23.968649 0.000000 udp 10.0.2.105 7010 -> 112.207.217.159 9411 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:31.859509 0.000000 udp 10.0.2.105 7010 -> 82.12.153.71 3124 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:36.776557 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:34:36.867119 0.000000 udp 10.0.2.105 7010 -> 59.40.80.108 8041 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:42.945517 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:49.168720 0.000000 udp 10.0.2.105 7010 -> 78.188.103.174 5509 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:57.726676 0.173605 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 8 3073 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:34:57.919690 0.120894 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:34:58.040584 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 229 flow=Background 1970/02/09 02:35:02.283144 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:35:03.134325 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 3119 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:09.083135 0.000000 udp 10.0.2.105 7010 -> 69.28.46.62 2941 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:17.795577 0.000000 udp 10.0.2.105 7010 -> 74.94.175.201 7900 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:26.759092 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:31.274989 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:35:33.678865 0.117658 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 8 3027 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:35:33.900032 0.000000 udp 10.0.2.105 7010 -> 93.64.164.99 6772 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:40.368165 0.000000 udp 10.0.2.105 7010 -> 195.72.202.66 1964 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:47.680514 0.000000 udp 10.0.2.105 7010 -> 85.108.68.83 7740 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:35:55.750218 0.432905 udp 10.0.2.105 7010 <-> 1.23.42.92 8655 CON 0 0 8 3144 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:35:56.241577 0.000000 udp 10.0.2.105 7010 -> 87.146.133.199 7495 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:00.279084 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:36:04.363281 0.000000 udp 10.0.2.105 7010 -> 212.58.56.98 4670 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:10.651686 0.597102 udp 10.0.2.105 7010 <-> 14.96.131.3 6114 CON 0 0 8 3165 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:36:11.355011 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:19.355533 0.107357 udp 10.0.2.105 7010 -> 85.118.117.117 5402 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:19.462890 0.000000 icmp 85.118.117.117 0x0303 -> 10.0.2.105 0x1a15 URP 192 1 199 flow=Background 1970/02/09 02:36:24.288815 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:36:25.756761 0.000000 udp 10.0.2.105 7010 -> 88.246.107.31 6519 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:31.661926 0.000000 udp 10.0.2.105 7010 -> 87.12.203.18 1373 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:38.665101 0.000000 udp 10.0.2.105 7010 -> 79.47.116.187 8828 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:45.622112 0.000000 udp 10.0.2.105 7010 -> 80.108.184.129 7352 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:50.278311 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:36:53.082739 0.000000 udp 10.0.2.105 7010 -> 176.42.183.225 4238 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:36:59.281591 0.114718 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 8 2908 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:36:59.494159 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 5345 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:06.492998 0.253003 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 8 2995 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:37:07.147609 0.438924 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 2867 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:37:07.696813 0.195399 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 8 3029 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:37:08.044720 0.000000 udp 10.0.2.105 7010 -> 86.130.32.70 4984 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:16.796572 0.000000 udp 10.0.2.105 7010 -> 42.3.180.42 3238 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:18.191377 3.001404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 02:37:21.773722 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:37:25.079021 0.000000 udp 10.0.2.105 7010 -> 79.16.45.75 2977 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:25.198903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:37:32.279319 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:33.200080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:37:40.110293 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:46.114524 0.000000 udp 10.0.2.105 7010 -> 70.128.236.65 9001 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:37:49.203238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:37:50.775309 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:37:52.237836 0.000000 udp 10.0.2.105 7010 -> 178.137.91.248 5113 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:00.109251 0.000000 udp 10.0.2.105 7010 -> 108.12.49.100 8954 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:07.289446 0.225943 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 3245 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:38:07.554511 0.234592 udp 10.0.2.105 7010 <-> 2.27.179.136 8335 CON 0 0 8 3147 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:38:07.951248 0.596290 udp 10.0.2.105 7010 <-> 101.210.237.148 2266 CON 0 0 8 3107 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:38:08.605380 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:15.420664 0.000000 udp 10.0.2.105 7010 -> 31.146.62.35 6313 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:20.277866 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:38:21.209363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:38:24.223758 0.000000 udp 10.0.2.105 7010 -> 79.38.25.78 2191 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:33.116706 0.000000 udp 10.0.2.105 7010 -> 91.93.244.55 7865 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:41.097399 0.999324 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 8 3184 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:38:42.428587 0.000000 udp 10.0.2.105 7010 -> 113.193.186.206 6627 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:45.774501 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:38:51.273892 0.248921 udp 10.0.2.105 7010 <-> 87.5.195.200 4092 CON 0 0 8 2915 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:38:51.546729 0.000000 udp 10.0.2.105 7010 -> 65.183.101.216 5331 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:38:56.623292 0.000000 udp 10.0.2.105 7010 -> 188.9.38.6 6699 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:01.637664 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:10.290403 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:15.276923 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:39:17.710359 0.000000 udp 10.0.2.105 7010 -> 93.46.70.132 6292 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:23.449759 0.000000 udp 10.0.2.105 7010 -> 86.169.41.236 1721 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:31.761077 0.000000 udp 10.0.2.105 7010 -> 82.115.117.185 9604 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:39.722248 0.437439 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 8 3139 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:39:40.290392 0.480463 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 2909 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:39:40.745390 0.149525 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 3 943 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:39:44.278741 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:39:45.961028 0.000000 udp 10.0.2.105 7010 -> 87.12.223.163 2000 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:39:53.993082 0.000000 udp 10.0.2.105 7010 -> 122.177.174.16 2857 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:01.043313 0.000000 udp 10.0.2.105 7010 -> 87.18.47.75 3217 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:09.415001 0.000000 udp 10.0.2.105 7010 -> 87.0.155.227 5059 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:14.281712 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:40:17.776988 0.101358 udp 10.0.2.105 7010 <-> 84.169.104.249 7604 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:40:17.940827 0.000000 udp 10.0.2.105 7010 -> 86.148.37.89 4274 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:24.677126 0.135722 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 8 2902 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:40:24.847274 0.000000 udp 10.0.2.105 7010 -> 96.44.34.101 4364 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:30.845977 0.000000 udp 10.0.2.105 7010 -> 95.225.96.113 4940 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:35.883526 0.096209 udp 10.0.2.105 7010 -> 82.191.122.34 3179 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:35.979735 0.000000 icmp 82.191.122.34 0x0303 -> 10.0.2.105 0x6b0c URP 192 1 163 flow=Background 1970/02/09 02:40:40.779260 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:40:43.724327 0.000000 udp 10.0.2.105 7010 -> 2.231.177.54 7138 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:49.563189 0.000000 udp 10.0.2.105 7010 -> 188.217.101.69 8031 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:40:58.275244 0.000000 udp 10.0.2.105 7010 -> 2.220.0.149 1866 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:04.233705 0.000000 udp 10.0.2.105 7010 -> 202.136.155.2 8974 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:08.779843 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:41:12.025109 0.000000 udp 10.0.2.105 7010 -> 151.51.120.19 8764 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:20.427206 0.000000 udp 10.0.2.105 7010 -> 176.27.105.162 9673 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:27.757624 0.356927 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 8 3027 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:41:28.107689 0.879126 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 3084 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:41:29.037219 0.384488 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 8 2893 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:41:29.436255 0.000000 udp 10.0.2.105 7010 -> 86.5.231.189 7490 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:32.774691 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:41:36.189740 0.000000 udp 10.0.2.105 7010 -> 114.185.239.193 3366 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:41.577619 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:49.238496 0.000000 udp 10.0.2.105 7010 -> 71.6.51.194 6618 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:41:56.429052 0.000000 udp 10.0.2.105 7010 -> 195.151.244.93 8415 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:01.275780 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:42:04.800858 0.000000 udp 10.0.2.105 7010 -> 87.25.235.242 6925 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:11.480711 0.217270 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 8 2992 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:42:11.711281 0.000000 udp 10.0.2.105 7010 -> 122.173.209.139 1848 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:19.692363 0.000000 udp 10.0.2.105 7010 -> 115.133.14.8 4955 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:24.719546 0.000000 udp 10.0.2.105 7010 -> 176.26.206.158 4761 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:29.283415 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:42:30.480675 0.000000 udp 10.0.2.105 7010 -> 64.83.249.93 7498 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:38.779557 0.000000 udp 10.0.2.105 7010 -> 96.55.178.83 6344 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:44.077350 1.161378 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 8 3215 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:42:45.463189 0.000000 udp 10.0.2.105 7010 -> 93.45.106.192 1044 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:50.566866 0.000000 udp 10.0.2.105 7010 -> 88.253.161.240 8120 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:42:55.283413 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:42:56.375065 0.000000 udp 10.0.2.105 7010 -> 46.176.79.75 1001 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:05.247894 0.000000 udp 10.0.2.105 7010 -> 75.151.40.253 8391 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:12.007040 0.154374 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 8 3192 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:43:12.309270 0.000000 udp 10.0.2.105 7010 -> 87.18.38.166 2165 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:18.346506 0.031145 udp 10.0.2.105 7010 -> 62.179.9.14 4443 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:18.377651 0.000000 icmp 62.179.9.14 0x0303 -> 10.0.2.105 0x5b11 URP 192 1 138 flow=Background 1970/02/09 02:43:23.273318 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:43:26.027389 0.367974 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:43:26.738665 0.000000 udp 10.0.2.105 7010 -> 94.197.191.95 1669 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:33.408583 0.345681 udp 10.0.2.105 7010 <-> 36.239.221.28 7010 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:43:33.998684 0.000000 udp 10.0.2.105 7010 -> 77.176.65.110 5054 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:40.458441 0.000000 udp 10.0.2.105 7010 -> 117.220.192.156 2413 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:47.258378 0.000000 udp 10.0.2.105 7010 -> 95.243.3.35 9626 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:51.774506 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:43:52.716018 0.000000 udp 10.0.2.105 7010 -> 87.23.82.98 7553 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:43:59.084676 0.000000 udp 10.0.2.105 7010 -> 110.159.139.207 6799 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:44:05.314138 0.045846 udp 10.0.2.105 7010 <-> 193.13.107.232 5659 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/02/09 02:44:05.457995 0.000000 udp 10.0.2.105 7010 -> 81.139.138.4 8208 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:44:11.963582 0.000000 udp 10.0.2.105 7010 -> 203.189.157.182 6760 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 02:44:16.780547 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:44:25.215844 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 02:44:32.222643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:44:40.224088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:44:56.227265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:45:28.233099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:54:44.245471 3.007459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 02:54:51.252996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:54:59.254224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:55:15.257370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:55:47.263188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 02:57:54.336386 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 02:57:54.336540 0.665228 tcp 10.0.2.105 55695 -> 31.192.24.67 3527 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:01:51.279408 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:01:58.286622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:02:06.287978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:02:22.295516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:02:54.297154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:09:00.307695 2.999940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:09:07.313685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:09:15.315151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:09:31.317960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:10:03.323918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:14:48.013753 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 03:14:48.013920 0.057143 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.071442 0.075724 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.147631 0.149412 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.297444 0.173331 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.471147 0.165431 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.636944 0.168146 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.805692 0.072163 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:48.878292 0.143499 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.022211 0.039887 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.062485 0.168579 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.231477 0.144488 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.376368 0.155362 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.532142 0.411487 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.944057 0.051477 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:49.995893 0.053415 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.049696 0.205131 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.255226 0.031089 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.286672 0.050261 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.337312 0.114313 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.452039 0.189020 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.641478 0.212919 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.854769 0.076575 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:50.931689 0.239447 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:51.171527 0.066533 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:51.238455 0.056979 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:51.295804 0.245672 udp 10.0.2.105 7010 <-> 1.23.42.92 8655 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:14:51.541952 0.000000 udp 10.0.2.105 7010 -> 14.96.131.3 6114 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:15:10.247003 0.061927 tcp 10.0.2.105 55696 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:10.309234 0.062720 tcp 10.0.2.105 55697 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:10.372372 0.151804 tcp 10.0.2.105 55698 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:10.524744 0.069046 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:15:10.594178 0.125708 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:15:10.720423 0.097304 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:15:10.818119 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:15:27.139846 0.060243 tcp 10.0.2.105 55699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:27.200383 0.060850 tcp 10.0.2.105 55700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:27.261531 0.152567 tcp 10.0.2.105 55701 -> 195.113.214.249 443 SRPA* 0 0 78 70390 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:27.414766 0.000000 udp 10.0.2.105 7010 -> 2.27.179.136 8335 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:15:45.066171 0.061830 tcp 10.0.2.105 55702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:45.128278 0.082404 tcp 10.0.2.105 55703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:45.210937 0.161015 tcp 10.0.2.105 55704 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:15:45.372533 0.081009 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:15:45.453887 0.000000 udp 10.0.2.105 7010 -> 101.210.237.148 2266 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:16:01.269186 0.062969 tcp 10.0.2.105 55705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:01.332452 0.061429 tcp 10.0.2.105 55706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:01.394142 0.155313 tcp 10.0.2.105 55707 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:01.550540 0.363330 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:01.914290 0.105425 udp 10.0.2.105 7010 <-> 87.5.195.200 4092 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:02.020109 0.207206 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:02.227703 0.210593 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:02.438674 0.144139 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:02.583225 0.000000 udp 10.0.2.105 7010 -> 84.169.104.249 7604 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:16:08.331076 3.002279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 03:16:15.339231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:16:18.444573 0.062798 tcp 10.0.2.105 55708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:18.507646 0.063606 tcp 10.0.2.105 55709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:18.571541 0.154892 tcp 10.0.2.105 55710 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:16:18.727074 0.065555 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:18.793002 0.162676 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:18.956104 0.439361 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:19.395866 0.189535 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:19.585843 0.100658 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:19.686870 0.701681 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:20.388941 0.056705 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:20.446060 0.366595 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:20.813052 0.347052 udp 10.0.2.105 7010 <-> 36.239.221.28 7010 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:21.160691 0.039787 udp 10.0.2.105 7010 <-> 193.13.107.232 5659 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:16:23.340717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:16:39.344025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:17:11.349379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:23:15.355951 3.004970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:23:22.363089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:23:30.374629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:23:46.377631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:24:18.389015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:27:55.005535 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 03:27:55.005712 0.711690 tcp 10.0.2.105 55711 -> 31.192.24.67 3527 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:30:22.389678 3.001325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:30:29.397127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:30:37.398868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:30:53.401507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:31:25.407449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:37:29.414616 3.000598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:37:36.420997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:37:44.422280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:38:00.425437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:38:32.431348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:44:36.438255 3.000746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 03:44:43.445240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:44:51.447050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:45:07.450212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:45:39.455609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:46:29.629384 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 03:46:29.629576 0.000000 udp 10.0.2.105 7010 -> 14.96.131.3 6114 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:46:45.923469 0.065827 tcp 10.0.2.105 55712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:46:45.989564 0.061510 tcp 10.0.2.105 55713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:46:46.051420 0.150597 tcp 10.0.2.105 55714 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:46:46.202527 0.218419 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:46:46.421358 0.000000 udp 10.0.2.105 7010 -> 2.27.179.136 8335 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:47:03.039590 0.059919 tcp 10.0.2.105 55715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:03.099844 0.063187 tcp 10.0.2.105 55716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:03.163313 0.157429 tcp 10.0.2.105 55717 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:03.321448 0.000000 udp 10.0.2.105 7010 -> 101.210.237.148 2266 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:47:19.799652 0.060244 tcp 10.0.2.105 55718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:19.860135 0.061766 tcp 10.0.2.105 55719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:19.922212 0.159999 tcp 10.0.2.105 55720 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:20.083069 0.000000 udp 10.0.2.105 7010 -> 84.169.104.249 7604 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:47:37.425531 0.059467 tcp 10.0.2.105 55721 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:37.485309 0.068827 tcp 10.0.2.105 55722 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:37.554416 0.155617 tcp 10.0.2.105 55723 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:47:37.710662 0.074891 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:37.785944 0.056164 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:37.842458 0.149195 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:37.992000 0.047245 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.039627 0.169910 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.209919 0.147117 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.357434 0.168038 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.525877 0.165325 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.691657 0.171907 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:38.864012 0.145803 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:39.010216 0.070977 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:39.081586 0.046948 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:39.128917 0.204241 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:39.333552 0.487050 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.119641 0.153322 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.273340 0.024477 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.298168 0.055530 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.354100 0.048973 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.403431 0.055568 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.459409 0.189573 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.649379 0.222519 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.872256 0.073366 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:40.946013 0.212950 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:41.159319 0.114540 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:41.274197 0.066141 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:47:41.340793 0.000000 udp 10.0.2.105 7010 -> 1.23.42.92 8655 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:48:00.108215 0.061117 tcp 10.0.2.105 55724 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:00.169685 0.061051 tcp 10.0.2.105 55725 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:00.231089 0.154049 tcp 10.0.2.105 55726 -> 195.113.214.249 443 SRPA* 0 0 33 17670 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:00.385811 0.057400 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:00.443604 0.126390 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:00.570354 0.097689 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:00.668447 0.084633 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:00.753470 0.215689 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:00.969564 0.099672 udp 10.0.2.105 7010 <-> 87.5.195.200 4092 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:01.069665 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:48:16.481815 0.060160 tcp 10.0.2.105 55727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:16.542261 0.060374 tcp 10.0.2.105 55728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:16.602950 0.158476 tcp 10.0.2.105 55729 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:16.762129 0.212085 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:16.974616 0.148162 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:17.123217 0.065243 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:17.188805 0.165211 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:17.354425 0.108605 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:17.463426 0.438290 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:17.902089 0.189568 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:18.092106 0.371631 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:18.464211 0.345737 udp 10.0.2.105 7010 <-> 36.239.221.28 7010 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:18.810366 0.000000 udp 10.0.2.105 7010 -> 193.13.107.232 5659 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 03:48:35.829234 0.059747 tcp 10.0.2.105 55730 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:35.889250 0.061525 tcp 10.0.2.105 55731 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:35.950991 0.153275 tcp 10.0.2.105 55732 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 03:48:36.104814 0.806613 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:48:36.911806 0.057501 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/09 03:54:51.461726 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 03:54:58.469149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:55:06.470851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:55:22.473716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:55:54.482519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 03:57:55.724384 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 03:57:55.724554 0.625687 tcp 10.0.2.105 55733 -> 31.192.24.67 3527 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:01:58.485381 3.002169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:02:05.493043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:02:13.494487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:02:29.501995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:03:01.503698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:09:12.522295 2.998945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:09:19.527094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:09:27.528834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:09:43.531640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:10:15.537781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:16:19.543794 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:16:26.551013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:16:34.552534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:16:50.556008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:17:22.561571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:18:50.959127 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 04:18:50.959299 0.000000 udp 10.0.2.105 7010 -> 1.23.42.92 8655 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:19:07.704535 0.061883 tcp 10.0.2.105 55734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:07.766698 0.063950 tcp 10.0.2.105 55735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:07.830930 0.156125 tcp 10.0.2.105 55736 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:07.987730 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:19:24.657663 0.060591 tcp 10.0.2.105 55737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:24.718595 0.061502 tcp 10.0.2.105 55738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:24.780466 0.150961 tcp 10.0.2.105 55739 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:24.931948 0.000000 udp 10.0.2.105 7010 -> 193.13.107.232 5659 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:19:41.231742 0.060834 tcp 10.0.2.105 55740 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:41.292863 0.059865 tcp 10.0.2.105 55741 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:41.352574 0.149053 tcp 10.0.2.105 55742 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:41.502302 0.147354 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:41.650115 0.041807 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:41.692445 0.169456 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:41.862348 0.146234 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.009008 0.059237 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.068709 0.075237 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.144303 0.146278 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.290976 0.133798 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.425211 0.165896 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.591514 0.163607 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.755569 0.172392 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.928524 0.046204 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:42.975153 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:19:58.496413 0.059737 tcp 10.0.2.105 55743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:58.556465 0.061701 tcp 10.0.2.105 55744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:58.618451 0.151283 tcp 10.0.2.105 55745 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:19:58.770418 0.049588 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:58.820474 0.057311 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:58.878211 0.393866 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.272616 0.024453 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.297398 0.147020 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.444788 0.057026 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.502208 0.196385 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.698977 0.183480 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.882809 0.077701 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:19:59.960886 0.212583 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.173826 0.067258 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.241484 0.102011 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.343933 0.059263 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.403590 0.080952 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.484991 0.211273 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.696628 0.105570 udp 10.0.2.105 7010 <-> 87.5.195.200 4092 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.802567 0.097328 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:00.900363 0.125403 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.026140 0.144981 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.171537 0.218913 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.390838 0.163922 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.555184 0.102668 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.658214 0.066953 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:01.725528 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:20:19.005777 0.060026 tcp 10.0.2.105 55746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:19.066070 0.060205 tcp 10.0.2.105 55747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:19.126545 0.148196 tcp 10.0.2.105 55748 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:19.275204 0.429734 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:19.705316 0.188170 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:19.893872 0.000000 udp 10.0.2.105 7010 -> 36.239.221.28 7010 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:20:35.919573 0.061773 tcp 10.0.2.105 55749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:35.981594 0.061249 tcp 10.0.2.105 55750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:36.043238 0.150967 tcp 10.0.2.105 55751 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:20:36.194739 0.152808 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:36.347944 0.070832 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:20:36.419166 0.217180 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:23:26.572109 3.186432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 04:23:33.731699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:23:41.662628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:23:57.591980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:24:29.596799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:27:56.353625 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 04:27:56.353767 0.672335 tcp 10.0.2.105 55752 -> 31.192.24.67 3527 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:30:33.601672 3.001549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:30:40.609059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:30:48.610586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:31:04.623328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:31:36.629594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:37:40.635814 3.001350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:37:47.643275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:37:55.644282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:38:11.647492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:38:43.653363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:44:47.659757 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:44:54.667231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:45:02.668664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:45:18.671234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:45:50.678873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:51:06.060971 0.020405 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 04:51:06.081593 0.203901 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:06.285988 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:51:25.220264 0.061767 tcp 10.0.2.105 55753 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:25.282346 0.065277 tcp 10.0.2.105 55754 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:25.347880 0.152562 tcp 10.0.2.105 55755 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:25.501487 0.000000 udp 10.0.2.105 7010 -> 36.239.221.28 7010 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:51:40.541215 0.059866 tcp 10.0.2.105 55756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:40.601368 0.061385 tcp 10.0.2.105 55757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:40.663018 0.153064 tcp 10.0.2.105 55758 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:40.816781 0.058774 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:40.875950 0.047581 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:40.923955 0.143279 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:41.067689 0.206504 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:41.274540 0.146168 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:41.421110 0.073907 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:41.495405 0.179509 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:41.675306 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:51:54.684432 3.000897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 04:51:57.275030 0.063395 tcp 10.0.2.105 55759 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:57.338754 0.064048 tcp 10.0.2.105 55760 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:57.403146 0.151904 tcp 10.0.2.105 55761 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:51:57.555581 0.165174 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:57.721138 0.169461 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:57.891024 0.070768 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:57.962177 0.173583 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.136117 0.397376 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.533856 0.058642 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.592971 0.050415 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.643812 0.026936 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.671151 0.194011 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.865591 0.079474 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:58.945463 0.222028 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:51:59.167878 0.000000 udp 10.0.2.105 7010 -> 84.173.19.14 7912 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:52:01.691160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:52:09.692650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:52:17.614380 0.060115 tcp 10.0.2.105 55762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:17.674729 0.060785 tcp 10.0.2.105 55763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:17.735752 0.213524 tcp 10.0.2.105 55764 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:17.949759 0.101929 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:18.052082 0.148915 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:18.201351 0.053989 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:18.255695 0.211429 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:18.467474 0.000000 udp 10.0.2.105 7010 -> 87.5.195.200 4092 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 04:52:25.698816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:52:33.789717 0.064285 tcp 10.0.2.105 55765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:33.854296 0.062971 tcp 10.0.2.105 55766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:33.917565 0.147219 tcp 10.0.2.105 55767 -> 195.113.214.249 443 SRPA* 0 0 24 14850 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:52:34.065342 0.098083 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:34.163808 0.140853 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:34.305066 0.147389 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:34.452857 0.098222 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:34.551510 0.080568 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:34.632545 0.490294 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.141693 0.060938 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.203005 0.163975 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.367382 0.253543 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.621276 0.108080 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.729819 0.191908 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:35.922153 0.421954 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:36.344545 0.155396 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:36.500370 0.056386 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:36.557214 0.216991 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/09 04:52:57.703004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:57:57.032231 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 04:57:57.032413 0.605014 tcp 10.0.2.105 55768 -> 31.192.24.67 3527 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/02/09 04:59:01.713717 2.995970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 04:59:08.715068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:59:16.716636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 04:59:32.725760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:00:04.725163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:06:33.740976 2.997981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:06:40.744832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:06:48.746151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:07:04.749165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:07:36.755485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:13:40.761432 3.001648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:13:47.768676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:13:55.770995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:14:11.773361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:14:43.779241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:20:47.785602 3.001205 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:20:54.792601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:21:02.794024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:21:18.797190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:21:50.803375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:22:43.007050 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 05:22:43.007270 0.074323 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:22:43.082027 0.068719 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:22:43.151198 0.000000 udp 10.0.2.105 7010 -> 87.5.195.200 4092 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 05:23:02.137668 0.061924 tcp 10.0.2.105 55769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:23:02.199906 0.061924 tcp 10.0.2.105 55770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:23:02.262118 0.159638 tcp 10.0.2.105 55771 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:23:02.422245 0.203977 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:02.626608 0.054388 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:02.681362 0.040568 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:02.722329 0.171714 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:02.894459 0.145980 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.040878 0.074814 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.116189 0.146583 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.263157 0.142239 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.405808 0.172442 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.578641 0.163656 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.742744 0.168012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.911146 0.075520 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:03.987035 0.050354 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.037820 0.194809 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.233007 0.079689 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.313096 0.048644 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.362143 0.380260 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.742838 0.057304 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:04.800571 0.213848 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.014779 0.147047 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.162171 0.114318 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.276839 0.056416 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.333657 0.194855 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.528957 0.126492 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.655849 0.098038 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.754262 0.082096 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.836781 0.147110 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:05.984328 0.061330 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:06.046027 0.460136 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:06.506637 0.068294 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:06.575354 0.161487 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:06.737268 0.211658 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:06.949354 0.411705 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:07.361536 0.103126 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:07.465106 0.191650 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:07.657144 0.215233 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:07.872755 0.153931 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:23:08.027048 0.057655 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:27:54.814947 2.997013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:27:57.643085 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 05:27:57.643183 0.524787 tcp 10.0.2.105 55772 -> 31.192.24.67 3527 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:28:01.816719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:28:09.822446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:28:25.823035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:28:57.826759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:35:01.832693 3.002134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:35:08.840454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:35:16.842103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:35:32.845393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:36:04.851252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:42:08.856654 3.002044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:42:15.864395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:42:23.869104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:42:39.869196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:43:11.875186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:53:09.725157 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 05:53:09.725329 0.046510 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:09.772439 0.066079 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:09.838886 0.207035 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.046296 0.057394 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.104126 0.047332 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.151841 0.173419 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.325751 0.143106 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.469195 0.077805 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.547365 0.148113 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.695833 0.146697 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:10.842869 0.171931 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.015205 0.167583 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.183138 0.172090 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.355701 0.074999 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.431125 0.025150 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.456640 0.190427 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.647542 0.077901 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.725834 0.053247 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:11.779476 0.362422 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.142279 0.059124 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.201838 0.212143 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.414362 0.146437 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.561233 0.114350 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.675951 0.058501 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.734866 0.097593 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.832823 0.080500 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:12.913694 0.146884 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.060973 0.065392 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.126728 0.364199 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.491333 0.125358 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.617060 0.217880 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.835429 0.067624 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:13.903449 0.161206 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:14.065039 0.217666 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:14.283077 0.423105 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:14.706569 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 05:53:30.196347 0.062005 tcp 10.0.2.105 55773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:30.258651 0.066225 tcp 10.0.2.105 55774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:30.325185 0.157436 tcp 10.0.2.105 55775 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:30.483185 0.156456 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:30.640108 0.058529 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:30.699011 0.102074 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/09 05:53:30.801482 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 05:53:33.881896 3.024314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 05:53:40.909613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:53:47.659847 0.061466 tcp 10.0.2.105 55776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:47.721624 0.060624 tcp 10.0.2.105 55777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:47.782492 0.149638 tcp 10.0.2.105 55778 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/09 05:53:48.910957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:54:04.914107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:54:36.919668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 05:57:58.169910 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 05:57:58.170052 0.640550 tcp 10.0.2.105 55779 -> 31.192.24.67 3527 FSPA* 0 0 15 1756 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:00:40.926937 3.000568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:00:47.933650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:00:55.935020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:01:11.937983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:01:43.943969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:07:47.950664 3.000914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:07:54.957373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:08:02.959243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:08:18.962070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:08:50.968361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:14:54.974389 3.000679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:15:01.981349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:15:09.982815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:15:25.985964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:15:57.991922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:22:01.998202 3.231821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:22:09.198171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:22:17.122902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:22:33.020101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:23:05.025368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:24:10.550529 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 06:24:10.550661 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 06:24:26.104628 0.088824 tcp 10.0.2.105 55780 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:26.193735 0.063776 tcp 10.0.2.105 55781 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:26.257805 0.151200 tcp 10.0.2.105 55782 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:26.409564 0.214753 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:26.624693 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 06:24:44.483843 0.060208 tcp 10.0.2.105 55783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:44.544349 0.188973 tcp 10.0.2.105 55784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:44.733640 0.151762 tcp 10.0.2.105 55785 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:24:44.885818 0.205441 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.091630 0.067254 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.159321 0.046910 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.206589 0.055995 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.263026 0.074522 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.337947 0.146059 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.484610 0.145827 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.630842 0.148075 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.779340 0.177504 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:45.957270 0.077975 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.035684 0.021585 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.057663 0.166104 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.224135 0.172513 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.397061 0.170656 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.568139 0.353119 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.921676 0.055074 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:46.977157 0.053197 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.030754 0.182589 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.213703 0.075475 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.289577 0.057054 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.347005 0.098154 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.445618 0.102031 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.548081 0.146568 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.695104 0.213945 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:47.909492 0.198641 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:48.108603 0.083865 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:24:48.192920 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 06:25:06.603429 0.059733 tcp 10.0.2.105 55786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:25:06.663425 0.061523 tcp 10.0.2.105 55787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:25:06.725243 0.153845 tcp 10.0.2.105 55788 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:25:06.879734 0.064215 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:06.944404 0.059794 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:07.004656 0.165680 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:07.170757 0.209660 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:07.380823 0.125431 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:07.506633 0.411358 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:07.918378 0.218994 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:08.137804 0.059371 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:08.197573 0.154358 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:25:08.352269 0.102460 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:27:58.818672 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 06:27:58.818840 0.624063 tcp 10.0.2.105 55789 -> 31.192.24.67 3527 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:29:09.036292 2.996903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 06:29:16.038967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:29:24.041030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:29:40.043939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:30:12.049442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:36:16.056161 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:36:23.064888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:36:31.064826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:36:47.067884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:37:19.074012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:43:23.078965 3.002992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:43:30.087662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:43:38.088214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:43:54.091779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:44:26.097392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:54:11.111634 3.001661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 06:54:18.118998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:54:26.120910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:54:42.123392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:55:14.134772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 06:55:19.778940 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 06:55:19.779035 0.045932 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:19.825406 0.146489 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:19.972413 0.215420 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.188399 0.043309 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.232083 0.059152 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.291682 0.076158 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.368397 0.206526 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.575368 0.065598 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.641412 0.148385 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:20.790160 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 06:55:35.964284 0.063575 tcp 10.0.2.105 55790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:55:36.028122 0.068697 tcp 10.0.2.105 55791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:55:36.097128 0.157985 tcp 10.0.2.105 55792 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 06:55:36.255665 0.148069 udp 10.0.2.105 7010 <-> 70.48.162.47 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:36.404127 0.146752 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:36.551309 0.038483 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:36.590187 0.164651 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:36.755286 0.172174 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:36.927878 0.084052 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.012460 0.075255 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.088111 0.050568 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.139107 0.182842 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.322345 0.074592 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.397283 0.055189 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.452854 0.356922 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.810162 0.167716 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:37.978203 0.217421 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.196001 0.193908 udp 10.0.2.105 7010 <-> 186.95.4.7 3481 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.390300 0.182926 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.573610 0.097887 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.671849 0.114439 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.786806 0.146759 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.934001 0.064954 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:38.999341 0.066929 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:39.066679 0.163867 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:39.230926 0.218333 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:39.449684 0.219539 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:39.669620 0.070865 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:39.740830 0.781068 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:40.561328 0.125807 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:40.687569 0.411754 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:55:41.099682 0.103193 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/09 06:57:59.448185 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 06:57:59.448380 0.509169 tcp 10.0.2.105 55793 -> 31.192.24.67 3527 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:01:18.136887 3.000438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 07:01:25.143277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:01:33.144755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:01:49.147684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:02:21.153543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:08:25.159729 3.001881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:08:32.167067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:08:40.168493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:08:56.171619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:09:28.187809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:15:37.200226 3.002320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:15:44.207748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:15:52.209776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:16:08.212785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:16:40.218721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:22:44.225391 3.000764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:22:51.232014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:22:59.233443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:23:15.236351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:23:47.242834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:26:02.201632 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 07:26:02.201739 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:26:18.872619 0.101750 tcp 10.0.2.105 55794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:18.974679 0.066171 tcp 10.0.2.105 55795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:19.041018 0.155961 tcp 10.0.2.105 55796 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:19.197578 0.052023 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:19.249974 0.147843 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:19.398315 0.218367 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:19.617070 0.072879 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:19.690331 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:26:35.965893 0.061904 tcp 10.0.2.105 55797 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:36.028113 0.358523 tcp 10.0.2.105 55798 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:36.386912 0.174657 tcp 10.0.2.105 55799 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:36.562195 0.065336 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:36.627979 0.059765 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:36.688193 0.049456 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:36.738084 0.143054 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:36.881568 0.024074 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:36.906082 0.166363 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:37.072896 0.000000 udp 10.0.2.105 7010 -> 70.48.162.47 5207 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:26:54.453139 0.064390 tcp 10.0.2.105 55800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:54.517831 0.065604 tcp 10.0.2.105 55801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:54.583741 0.158208 tcp 10.0.2.105 55802 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:26:54.742448 0.148706 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:54.891563 0.173086 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:26:55.065032 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:27:14.000437 0.064771 tcp 10.0.2.105 55803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:14.065471 0.064460 tcp 10.0.2.105 55804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:14.130217 0.154265 tcp 10.0.2.105 55805 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:14.284969 0.058493 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.343797 0.050227 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.394386 0.183245 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.578063 0.077833 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.656461 0.168363 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.825171 0.053755 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:14.879314 0.334680 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:15.214334 0.080907 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:15.295623 0.098363 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:15.394432 0.214096 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:15.608891 0.000000 udp 10.0.2.105 7010 -> 186.95.4.7 3481 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:27:33.611734 0.059816 tcp 10.0.2.105 55806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:33.671885 0.062432 tcp 10.0.2.105 55807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:33.734625 0.152683 tcp 10.0.2.105 55808 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:27:33.887815 0.114412 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.002633 0.145545 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.148580 0.086579 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.235607 0.061686 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.297722 0.164912 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.463026 0.069607 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.533029 0.209132 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.742550 0.218930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:34.961811 0.664366 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:35.626575 0.125327 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:35.752622 0.412073 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:36.165097 0.106707 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:27:59.956881 1.069840 tcp 10.0.2.105 55809 -> 31.192.24.67 3527 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:29:51.248532 3.001789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 07:29:58.256715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:30:06.257640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:30:22.260822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:30:54.266680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:36:58.272171 3.002974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:37:05.279961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:37:13.281520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:37:29.284733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:38:01.290781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:44:05.295831 3.002545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:44:12.303897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:44:20.305691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:44:36.308947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:45:08.314897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:54:33.330016 3.001199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 07:54:40.337031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:54:48.338517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:55:04.341280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:55:36.347503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 07:57:56.609737 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 07:57:56.609966 0.205419 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:57:56.815771 0.000000 udp 10.0.2.105 7010 -> 70.48.162.47 5207 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:58:01.026117 0.568704 tcp 10.0.2.105 55810 -> 31.192.24.67 3527 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:13.454789 0.063689 tcp 10.0.2.105 55811 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:13.518718 0.064454 tcp 10.0.2.105 55812 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:13.583441 0.150556 tcp 10.0.2.105 55813 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:13.734668 0.084868 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:13.819912 0.000000 udp 10.0.2.105 7010 -> 186.95.4.7 3481 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:58:30.398247 0.064187 tcp 10.0.2.105 55814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:30.462741 0.068423 tcp 10.0.2.105 55815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:30.531489 0.182551 tcp 10.0.2.105 55816 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:30.714514 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:58:48.324017 0.060760 tcp 10.0.2.105 55817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:48.384993 0.114235 tcp 10.0.2.105 55818 -> 195.113.214.249 80 SRPA* 0 0 18 13409 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:58:48.499707 0.045128 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:48.545198 0.220746 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:48.766331 0.074753 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:48.841495 0.032900 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:48.874782 0.165921 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.041150 0.068280 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.109800 0.146604 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.256835 0.044873 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.302155 0.055727 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.358263 0.144401 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.503071 0.172872 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.676378 0.110264 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.787003 0.050835 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:49.838156 0.168359 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.006912 0.188629 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.195988 0.338114 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.534562 0.081264 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.616255 0.097109 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.713754 0.056061 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.770185 0.078436 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:50.849003 0.213462 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:58:51.062920 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 07:59:09.354229 0.062529 tcp 10.0.2.105 55819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:59:09.416988 0.065168 tcp 10.0.2.105 55820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:59:09.482433 0.153710 tcp 10.0.2.105 55821 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/09 07:59:09.636730 0.062157 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:09.699287 0.102088 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:09.801715 0.149162 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:09.951373 0.165032 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:10.116778 0.071321 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:10.188501 0.209174 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:10.398065 0.218867 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:10.617318 0.420874 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:11.038548 0.109913 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:11.148863 0.609030 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/09 07:59:11.758275 0.125861 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:01:40.362706 3.002241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 08:01:47.361306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:01:55.365381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:02:11.369098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:02:43.371803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:08:47.381040 2.998252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:08:54.385041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:09:02.386201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:09:18.389866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:09:50.395663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:15:56.404937 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:16:03.411828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:16:11.413369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:16:27.419009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:16:59.422589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:23:03.431846 3.117311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:23:10.522992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:23:18.467572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:23:34.450753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:24:06.456830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:28:01.594716 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 08:28:01.594856 0.678382 tcp 10.0.2.105 55822 -> 31.192.24.67 3527 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:29:29.200902 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 08:29:29.201124 0.146552 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:29:29.348076 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 08:29:46.577339 0.065584 tcp 10.0.2.105 55823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:29:46.643183 0.062088 tcp 10.0.2.105 55824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:29:46.705548 0.147349 tcp 10.0.2.105 55825 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:29:46.853516 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 08:30:04.281139 0.061305 tcp 10.0.2.105 55826 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:04.342841 0.066274 tcp 10.0.2.105 55827 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:04.409327 0.169105 tcp 10.0.2.105 55828 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:04.578269 0.077450 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:04.656086 0.217592 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:04.874123 0.079887 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:04.954393 0.027927 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:04.982692 0.165991 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.149054 0.067179 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.216600 0.144959 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.362009 0.045776 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.408159 0.059518 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.468131 0.043139 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:05.511690 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 08:30:10.462243 3.001478 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 08:30:17.469539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:30:22.868109 0.064421 tcp 10.0.2.105 55829 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:22.932802 0.065359 tcp 10.0.2.105 55830 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:22.998411 0.169512 tcp 10.0.2.105 55831 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:23.168607 0.060131 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:23.229113 0.143840 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:23.373373 0.169038 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:23.542757 0.190905 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:23.734023 0.319955 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.054383 0.083089 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.137861 0.098242 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.236500 0.056159 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.293104 0.078671 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.372139 0.049585 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.422102 0.408976 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.831416 0.148195 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:24.980058 0.222124 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.202605 0.068947 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.271970 0.078991 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.351365 0.113975 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.465754 0.209520 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.471167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:30:25.675664 0.220570 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:25.896639 0.420147 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:26.317152 0.100964 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:30:26.418505 0.000000 udp 10.0.2.105 7010 -> 99.26.224.9 5585 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 08:30:41.474214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:30:43.167648 0.061966 tcp 10.0.2.105 55832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:43.229877 0.063868 tcp 10.0.2.105 55833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:43.294104 0.151689 tcp 10.0.2.105 55834 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 08:30:43.446356 0.126717 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/09 08:31:13.482843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:37:17.487009 3.000831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:37:24.493553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:37:32.499376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:37:48.498509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:38:20.504031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:44:24.510000 3.067674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:44:31.552649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:44:39.529100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:44:55.532327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:45:27.538591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:54:44.552353 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 08:54:51.559043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:54:59.560473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:55:15.563698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:55:47.571628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 08:58:02.273835 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 08:58:02.274045 0.611820 tcp 10.0.2.105 55835 -> 31.192.24.67 3527 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:00:56.827424 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:00:56.827582 0.215287 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:00:57.043225 0.173202 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:00:57.216825 0.813483 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:00:58.030736 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 09:01:14.571933 0.062535 tcp 10.0.2.105 55836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:14.634744 0.063752 tcp 10.0.2.105 55837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:14.698755 0.151900 tcp 10.0.2.105 55838 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:14.851570 0.072978 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:14.924910 0.038450 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:14.963723 0.164030 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.128200 0.069059 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.197615 0.145062 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.343069 0.213790 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.557262 0.080582 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.638237 0.059130 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.697764 0.046629 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:15.744831 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 09:01:32.969461 0.059953 tcp 10.0.2.105 55839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:33.029637 0.064262 tcp 10.0.2.105 55840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:33.094242 0.167954 tcp 10.0.2.105 55841 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:01:33.262903 0.088034 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:33.351374 0.146385 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:33.498206 0.319086 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:33.817734 0.165938 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:33.984074 0.097745 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.082220 0.058053 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.140631 0.079771 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.220826 0.081209 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.302416 0.192566 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.517854 0.147932 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.666181 0.161754 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.828528 0.070491 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.899350 0.063859 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:34.963653 0.053700 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:35.017764 0.213252 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:35.231428 0.217016 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:35.448831 0.412271 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:35.861438 0.101846 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:35.963653 0.208718 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:36.172741 0.102687 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:36.275859 0.126315 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:01:51.576743 3.000448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 09:01:58.583254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:02:06.584983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:02:22.587593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:02:54.593813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:08:59.600640 3.002214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:09:06.608717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:09:14.613027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:09:30.613123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:10:02.619095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:16:06.625579 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:16:13.632766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:16:21.636124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:16:37.637075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:17:09.643069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:23:13.652066 3.182256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:23:20.806639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:23:28.735824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:23:44.681042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:24:16.686990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:28:02.892606 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:28:02.892845 0.714404 tcp 10.0.2.105 55842 -> 31.192.24.67 3527 FSPA* 0 0 12 1478 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:30:20.693321 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:30:27.700434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:30:35.702053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:30:51.705234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:31:23.711009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:31:52.863462 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:31:52.863547 0.148117 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:31:53.012119 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 09:32:09.969224 0.061669 tcp 10.0.2.105 55843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:32:10.031168 0.061355 tcp 10.0.2.105 55844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:32:10.092821 0.150342 tcp 10.0.2.105 55845 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:32:10.243737 0.170409 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:10.414525 0.208041 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:10.622984 0.731820 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:11.355218 0.072421 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:11.428095 0.038270 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:11.466731 0.172256 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:11.639347 0.306771 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:11.946559 0.213802 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.160720 0.074980 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.236154 0.059916 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.296536 0.049798 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.346723 0.067496 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.414659 0.058772 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.473876 0.144580 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.618852 0.313582 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:12.932836 0.170945 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.104187 0.096540 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.201030 0.059700 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.261165 0.077996 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.339560 0.094083 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.434049 0.189868 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.624490 0.159339 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.784247 0.162708 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:13.947352 0.070667 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.018360 0.060280 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.079007 0.050182 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.129579 0.324825 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.454825 0.212746 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.667974 0.208200 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.876584 0.108193 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:14.985166 0.125436 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:15.111051 0.422735 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:32:15.534192 0.114211 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 09:37:27.717308 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:37:34.727272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:37:42.725934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:37:58.729026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:38:30.735056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:44:34.741107 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:44:41.755030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:44:49.749825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:45:05.753200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:45:37.759414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:54:49.765920 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 09:54:56.772911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:55:04.774007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:55:20.780373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:55:52.783216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 09:58:03.611660 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:58:03.611762 3.003780 tcp 10.0.2.105 55846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:12.614216 0.000000 tcp 10.0.2.105 55846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:18.615119 0.067004 tcp 10.0.2.105 55847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:18.682395 0.065088 tcp 10.0.2.105 55848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:18.747748 0.152415 tcp 10.0.2.105 55849 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:18.924447 2.993116 tcp 10.0.2.105 55850 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:27.926233 0.000000 tcp 10.0.2.105 55850 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:33.925372 0.064856 tcp 10.0.2.105 55851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:33.990516 0.064028 tcp 10.0.2.105 55852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:34.054903 0.158711 tcp 10.0.2.105 55853 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:34.340254 2.999726 tcp 10.0.2.105 55854 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:43.338566 0.000000 tcp 10.0.2.105 55854 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:49.338076 0.063301 tcp 10.0.2.105 55855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:49.401706 0.062310 tcp 10.0.2.105 55856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:49.464386 0.148264 tcp 10.0.2.105 55857 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:58:49.663006 2.998866 tcp 10.0.2.105 55858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:58:58.665581 0.000000 tcp 10.0.2.105 55858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:04.659441 0.068681 tcp 10.0.2.105 55859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:59:04.728470 0.062592 tcp 10.0.2.105 55860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:59:04.791400 0.156022 tcp 10.0.2.105 55861 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 09:59:05.119911 3.004049 tcp 10.0.2.105 55862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:14.122990 0.000000 tcp 10.0.2.105 55862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:20.123462 3.002087 tcp 10.0.2.105 55863 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:29.124087 0.000000 tcp 10.0.2.105 55863 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:33.770971 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:59:35.123140 3.003964 tcp 10.0.2.105 55864 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:44.135550 0.000000 tcp 10.0.2.105 55864 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:50.124318 2.994891 tcp 10.0.2.105 55865 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 09:59:57.775233 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 09:59:59.127225 0.000000 tcp 10.0.2.105 55865 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:01:56.789481 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:02:03.796600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:02:11.797755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:02:27.801423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:02:29.013224 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:02:29.013453 0.146826 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:29.160652 0.899318 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.060392 0.172235 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.232978 0.207748 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.441095 0.072371 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.513841 0.022008 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.536192 0.165739 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.702346 0.144384 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:30.847140 0.213262 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.060797 0.077188 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.138392 0.059043 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.197766 0.041832 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.239952 0.066531 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.306905 0.055598 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.362862 0.143593 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.506841 0.284940 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.792193 0.165568 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:31.958143 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 10:02:47.902380 0.061461 tcp 10.0.2.105 55866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:02:47.964109 0.082886 tcp 10.0.2.105 55867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:02:48.047269 0.153415 tcp 10.0.2.105 55868 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:02:48.201228 0.057874 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.259502 0.074227 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.334135 0.157592 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.492241 0.162115 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.654766 0.056935 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.712128 0.065394 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.777934 0.052989 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:48.831322 1.185730 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.017495 0.185873 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.203718 0.215326 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.419451 0.214437 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.634238 0.217055 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.851664 0.102565 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:50.954596 0.126492 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:51.081499 0.413331 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:51.495295 0.114315 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:02:59.806901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:05:05.130301 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:05:05.130492 3.001321 tcp 10.0.2.105 55869 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:14.130140 0.000000 tcp 10.0.2.105 55869 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:20.129738 0.061271 tcp 10.0.2.105 55870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:20.191294 0.060489 tcp 10.0.2.105 55871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:20.252077 0.157724 tcp 10.0.2.105 55872 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:20.447138 2.996621 tcp 10.0.2.105 55873 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:29.443797 0.000000 tcp 10.0.2.105 55873 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:35.442604 0.061228 tcp 10.0.2.105 55874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:35.504121 0.421643 tcp 10.0.2.105 55875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:35.926072 0.155753 tcp 10.0.2.105 55876 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:36.290231 3.005523 tcp 10.0.2.105 55877 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:45.294924 0.000000 tcp 10.0.2.105 55877 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:05:51.285127 0.064154 tcp 10.0.2.105 55878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:51.349551 0.062257 tcp 10.0.2.105 55879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:51.412178 0.152577 tcp 10.0.2.105 55880 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:05:51.732898 2.995602 tcp 10.0.2.105 55881 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:00.737211 0.000000 tcp 10.0.2.105 55881 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:06.726742 0.065823 tcp 10.0.2.105 55882 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:06:06.792814 0.061063 tcp 10.0.2.105 55883 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:06:06.854132 0.152156 tcp 10.0.2.105 55884 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:06:07.264132 2.996638 tcp 10.0.2.105 55885 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:16.261530 0.000000 tcp 10.0.2.105 55885 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:22.257963 3.007271 tcp 10.0.2.105 55886 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:31.269851 0.000000 tcp 10.0.2.105 55886 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:35.777526 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:06:37.260130 3.003959 tcp 10.0.2.105 55887 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:46.262690 0.000000 tcp 10.0.2.105 55887 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:52.263142 3.002677 tcp 10.0.2.105 55888 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:06:59.771872 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:07:01.264353 0.000000 tcp 10.0.2.105 55888 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:09:08.826600 2.995201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:09:15.827728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:09:23.829201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:09:39.832471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:10:11.838328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:12:07.264932 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:12:07.265035 2.993860 tcp 10.0.2.105 55889 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:16.267182 0.000000 tcp 10.0.2.105 55889 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:22.267756 0.063343 tcp 10.0.2.105 55890 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:22.331416 0.067572 tcp 10.0.2.105 55891 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:22.399261 0.162555 tcp 10.0.2.105 55892 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:22.592782 2.997975 tcp 10.0.2.105 55893 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:31.589619 0.000000 tcp 10.0.2.105 55893 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:37.588770 0.060878 tcp 10.0.2.105 55894 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:37.649892 0.061209 tcp 10.0.2.105 55895 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:37.711378 0.151807 tcp 10.0.2.105 55896 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:37.882131 3.000697 tcp 10.0.2.105 55897 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:46.881077 0.000000 tcp 10.0.2.105 55897 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:12:52.880029 0.060308 tcp 10.0.2.105 55898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:52.940685 0.062948 tcp 10.0.2.105 55899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:53.003913 0.154010 tcp 10.0.2.105 55900 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:12:53.169659 3.005036 tcp 10.0.2.105 55901 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:02.173110 0.000000 tcp 10.0.2.105 55901 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:08.162363 0.058971 tcp 10.0.2.105 55902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:13:08.221610 0.061752 tcp 10.0.2.105 55903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:13:08.283637 0.153944 tcp 10.0.2.105 55904 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:13:08.470258 3.006321 tcp 10.0.2.105 55905 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:17.479693 0.000000 tcp 10.0.2.105 55905 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:23.464138 2.994010 tcp 10.0.2.105 55906 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:32.466849 0.000000 tcp 10.0.2.105 55906 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:37.273425 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:13:38.465662 2.994042 tcp 10.0.2.105 55907 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:47.458127 0.000000 tcp 10.0.2.105 55907 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:13:53.467165 3.004084 tcp 10.0.2.105 55908 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:14:01.278028 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:14:02.469836 0.000000 tcp 10.0.2.105 55908 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:16:15.845110 3.000972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:16:22.851666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:16:30.853282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:16:46.856251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:17:18.862148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:19:08.470689 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:19:08.470888 3.003076 tcp 10.0.2.105 55909 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:17.473014 0.000000 tcp 10.0.2.105 55909 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:23.473268 0.063647 tcp 10.0.2.105 55910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:23.537231 0.062316 tcp 10.0.2.105 55911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:23.599870 0.149847 tcp 10.0.2.105 55912 -> 195.113.214.249 443 SRPA* 0 0 23 12308 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:23.760103 3.006140 tcp 10.0.2.105 55913 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:32.764687 0.000000 tcp 10.0.2.105 55913 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:38.754031 0.060598 tcp 10.0.2.105 55914 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:38.814866 0.060222 tcp 10.0.2.105 55915 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:38.875389 0.154357 tcp 10.0.2.105 55916 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:39.040195 2.997834 tcp 10.0.2.105 55917 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:48.046880 0.000000 tcp 10.0.2.105 55917 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:19:54.036151 0.060472 tcp 10.0.2.105 55918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:54.096955 0.064340 tcp 10.0.2.105 55919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:54.161613 0.152540 tcp 10.0.2.105 55920 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:19:54.419998 2.990273 tcp 10.0.2.105 55921 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:03.409120 0.000000 tcp 10.0.2.105 55921 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:09.418203 0.062797 tcp 10.0.2.105 55922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:20:09.481287 0.062282 tcp 10.0.2.105 55923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:20:09.543916 0.156016 tcp 10.0.2.105 55924 -> 195.113.214.249 443 SRPA* 0 0 42 34596 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:20:09.864997 2.997053 tcp 10.0.2.105 55925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:18.860974 0.000000 tcp 10.0.2.105 55925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:24.859491 3.004383 tcp 10.0.2.105 55926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:33.862738 0.000000 tcp 10.0.2.105 55926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:38.769404 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:20:39.861475 3.004163 tcp 10.0.2.105 55927 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:48.864058 0.000000 tcp 10.0.2.105 55927 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:20:54.863276 3.003846 tcp 10.0.2.105 55928 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:21:02.774360 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:21:03.875739 0.000000 tcp 10.0.2.105 55928 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:23:22.867694 3.076710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:23:29.922396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:23:37.895335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:23:53.890117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:24:25.896100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:30:29.902912 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 10:30:36.909667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:30:44.911795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:31:00.914156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:31:32.922730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:33:20.929712 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:33:20.929853 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 10:33:38.234669 0.061225 tcp 10.0.2.105 55929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:38.296196 0.063960 tcp 10.0.2.105 55930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:38.360489 0.153207 tcp 10.0.2.105 55931 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:38.514277 0.174898 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:38.687065 0.150317 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:39.913913 3.003175 tcp 10.0.2.105 55932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:33:48.918662 0.000000 tcp 10.0.2.105 55932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:33:54.915052 0.060723 tcp 10.0.2.105 55933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:54.954796 0.062327 tcp 10.0.2.105 55934 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:54.976136 0.061892 tcp 10.0.2.105 55935 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:55.017356 0.064646 tcp 10.0.2.105 55936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:55.038286 0.159779 tcp 10.0.2.105 55937 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:55.082360 0.180686 tcp 10.0.2.105 55938 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:33:55.263570 0.366976 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:55.514993 2.994687 tcp 10.0.2.105 55939 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:33:55.616451 0.092847 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 1961 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:55.791874 0.039432 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:55.830202 0.172329 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:56.046556 0.169410 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:33:56.194676 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 10:34:04.510824 0.000000 tcp 10.0.2.105 55939 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:34:11.330691 0.059650 tcp 10.0.2.105 55940 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:34:11.390627 0.061229 tcp 10.0.2.105 55941 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:34:11.452105 0.154160 tcp 10.0.2.105 55942 -> 195.113.214.249 443 SRPA* 0 0 42 22478 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:34:11.606604 0.116119 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:11.683067 0.061406 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:11.899491 0.081869 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:11.943595 0.105206 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:12.039268 0.059326 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:12.150308 0.179548 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:12.300674 0.216675 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:12.513993 0.172229 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2004 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:12.683437 0.284888 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.101049 0.109912 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.179908 0.185184 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 1894 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.454595 0.186229 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.620351 0.068091 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.825849 0.069647 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:13.970876 0.074339 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:14.023272 0.073006 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:14.297750 0.200705 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:14.491473 0.260761 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:14.724743 0.146637 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2552 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:14.823395 0.226722 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:15.047628 0.107978 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:15.150796 0.129014 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:15.382330 0.437858 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:15.793368 0.115742 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:34:16.081549 0.256260 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/09 10:37:36.925808 3.012044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:37:43.943532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:37:51.944735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:38:07.948432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:38:39.954115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:39:10.508433 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 10:39:10.508522 3.004677 tcp 10.0.2.105 55943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:19.511158 0.000000 tcp 10.0.2.105 55943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:25.511346 0.064819 tcp 10.0.2.105 55944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:25.576636 0.060694 tcp 10.0.2.105 55945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:25.637627 0.152915 tcp 10.0.2.105 55946 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:25.799324 2.995090 tcp 10.0.2.105 55947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:34.793302 0.000000 tcp 10.0.2.105 55947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:40.792048 0.059647 tcp 10.0.2.105 55948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:40.851966 0.061753 tcp 10.0.2.105 55949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:40.913979 0.151985 tcp 10.0.2.105 55950 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:41.081852 3.004155 tcp 10.0.2.105 55951 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:50.084745 0.000000 tcp 10.0.2.105 55951 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 10:39:56.073953 0.060981 tcp 10.0.2.105 55952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:56.135183 0.061839 tcp 10.0.2.105 55953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:56.197285 0.154633 tcp 10.0.2.105 55954 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:39:56.361546 0.733199 tcp 10.0.2.105 55955 -> 176.73.126.145 3888 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/02/09 10:44:43.964836 3.117068 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 10:44:51.056411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:44:58.989584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:45:14.982293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:45:46.987597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:54:50.000835 3.002334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 10:54:57.009076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:55:05.010876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:55:21.013395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 10:55:53.019331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:01:57.025568 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:02:04.032995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:02:12.034273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:02:28.037214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:03:00.043081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:04:19.788464 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 11:04:19.788721 0.147089 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:19.936420 0.213822 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:20.150669 0.171834 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:20.322923 0.033491 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:20.356784 0.177258 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:20.534458 0.145205 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:20.680021 0.612607 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.293001 0.074443 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.367817 0.059338 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.427554 0.045106 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.473074 0.067396 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.540904 0.056598 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.597905 0.146382 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.744734 0.070577 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:21.815724 0.208200 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.024460 0.168217 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.193053 0.292193 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.485624 0.077741 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.563727 0.057276 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.621369 0.070819 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.692551 0.050701 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.743692 0.057436 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.801541 0.147197 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:22.949132 0.162598 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.112090 0.201042 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.313570 0.213956 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.527947 0.149167 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.677463 0.216080 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.893926 0.099197 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:23.993483 0.127101 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:24.120960 0.220123 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:24.341485 0.412747 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:04:24.765230 0.115157 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:09:15.055737 3.001088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:09:22.062723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:09:30.064376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:09:46.067183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:09:57.093615 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 11:09:57.093728 0.470183 tcp 10.0.2.105 55956 -> 176.73.126.145 3888 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/02/09 11:10:18.073215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:16:22.079333 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:16:29.086836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:16:37.087825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:16:53.091105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:17:25.097452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:23:29.103135 3.001232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:23:36.111038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:23:44.113141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:24:00.115151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:24:32.121445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:30:36.126774 3.002178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:30:43.144607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:30:51.146151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:31:07.149513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:31:39.155166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:34:49.817953 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 11:34:49.818154 0.172256 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:34:49.990809 0.037157 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:34:50.028404 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 11:35:08.681335 0.062362 tcp 10.0.2.105 55957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 11:35:08.744026 0.061667 tcp 10.0.2.105 55958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 11:35:08.805994 0.151082 tcp 10.0.2.105 55959 -> 195.113.214.249 443 SRPA* 0 0 38 27927 flow=From-Botnet-V2-TCP-Established 1970/02/09 11:35:08.957644 0.221064 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:09.179111 0.504163 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:09.683648 0.165467 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:09.849504 0.144977 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:09.994848 0.074246 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.069477 0.058522 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.128426 0.041235 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.170098 0.068689 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.239260 0.054702 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.294402 0.142804 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.437610 0.070716 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.508680 0.204443 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.713551 0.166576 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:10.880592 0.282617 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.163670 0.086502 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.250619 0.057127 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.308138 0.067025 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.375537 0.048520 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.424436 0.053962 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.478822 0.144948 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.624138 0.164868 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.789384 0.196386 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:11.986162 0.215667 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:12.202298 0.083558 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:12.286312 0.217247 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:12.503992 0.098099 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:12.602541 0.421444 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:13.024578 0.114224 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:13.139208 0.125483 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:35:13.265057 0.217986 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/09 11:37:43.163492 3.020482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:37:50.179276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:37:58.179812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:38:14.183332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:38:46.189046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:39:57.572329 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 11:39:57.572449 0.471556 tcp 10.0.2.105 55960 -> 176.73.126.145 3888 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/02/09 11:44:50.195626 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:44:57.202565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:45:05.204226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:45:21.207137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:45:53.213304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:51:57.219293 3.016004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:52:04.236667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:52:12.242822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:52:28.243197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:53:00.247315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:59:04.258639 2.996458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 11:59:11.261398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:59:19.265519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 11:59:35.264979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:00:07.271509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:05:43.364476 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:05:43.364614 0.146851 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:43.511968 0.173102 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:43.685507 0.033175 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:43.719125 0.220215 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:43.939704 0.733303 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:44.673415 0.163763 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:44.837596 0.144023 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:44.981998 0.069784 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.052407 0.057912 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.110734 0.040242 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.151388 0.069440 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.221249 0.054606 udp 10.0.2.105 7010 <-> 46.49.70.63 3114 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.276240 0.144203 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.420844 0.075347 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.496731 0.206942 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.704087 0.167727 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:45.872254 0.280726 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:46.153635 0.071613 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:46.225688 0.058020 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:46.284071 0.070938 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:46.355434 0.632701 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:46.988582 0.054703 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.043698 0.148124 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.192220 0.165541 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.358206 0.209980 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.568592 0.218310 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.787300 0.082367 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:47.870101 0.428311 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:48.298843 0.114418 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:48.413644 0.125865 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:48.539898 0.494031 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:49.034360 0.099367 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:05:49.134099 0.221397 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:06:36.283108 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 12:06:43.290197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:06:51.291843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:07:07.295052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:07:39.301233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:09:58.051338 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:09:58.051533 3.003309 tcp 10.0.2.105 55961 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:07.053234 0.000000 tcp 10.0.2.105 55961 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:13.055914 0.061886 tcp 10.0.2.105 55962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:13.118094 0.064812 tcp 10.0.2.105 55963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:13.183212 0.152361 tcp 10.0.2.105 55964 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:21.253086 2.994956 tcp 10.0.2.105 55965 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:30.256906 0.000000 tcp 10.0.2.105 55965 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:36.245942 0.061309 tcp 10.0.2.105 55966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:36.307596 0.064444 tcp 10.0.2.105 55967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:36.372356 0.171179 tcp 10.0.2.105 55968 -> 195.113.214.249 443 SRPA* 0 0 27 15012 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:36.564733 2.995340 tcp 10.0.2.105 55969 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:45.558959 0.000000 tcp 10.0.2.105 55969 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:10:51.558266 0.062230 tcp 10.0.2.105 55970 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:51.620859 0.066912 tcp 10.0.2.105 55971 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:51.688042 0.149076 tcp 10.0.2.105 55972 -> 195.113.214.249 443 SRPA* 0 0 28 13202 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:10:51.849983 3.001978 tcp 10.0.2.105 55973 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:00.850163 0.000000 tcp 10.0.2.105 55973 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:06.850209 0.060315 tcp 10.0.2.105 55974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:11:06.910771 0.066721 tcp 10.0.2.105 55975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:11:06.977746 0.156371 tcp 10.0.2.105 55976 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:11:07.153879 3.000170 tcp 10.0.2.105 55977 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:16.152631 0.000000 tcp 10.0.2.105 55977 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:22.151737 3.003778 tcp 10.0.2.105 55978 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:31.154520 0.000000 tcp 10.0.2.105 55978 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:35.771200 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:11:37.153486 2.993899 tcp 10.0.2.105 55979 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:46.155770 0.000000 tcp 10.0.2.105 55979 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:52.154305 2.994432 tcp 10.0.2.105 55980 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:11:59.775177 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:12:01.157631 0.000000 tcp 10.0.2.105 55980 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:13:43.306614 3.002396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 12:13:50.314273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:13:58.315878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:14:14.319243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:14:46.324913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:17:07.158058 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:17:07.158242 3.003370 tcp 10.0.2.105 55981 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:16.160139 0.000000 tcp 10.0.2.105 55981 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:22.161547 0.062372 tcp 10.0.2.105 55982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:22.224190 0.060651 tcp 10.0.2.105 55983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:22.285207 0.166972 tcp 10.0.2.105 55984 -> 195.113.214.249 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:22.469798 3.003873 tcp 10.0.2.105 55985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:31.472343 0.000000 tcp 10.0.2.105 55985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:37.461797 0.060294 tcp 10.0.2.105 55986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:37.522478 0.061775 tcp 10.0.2.105 55987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:37.584512 0.149854 tcp 10.0.2.105 55988 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:37.830248 3.005514 tcp 10.0.2.105 55989 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:46.834202 0.000000 tcp 10.0.2.105 55989 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:17:52.823844 0.065096 tcp 10.0.2.105 55990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:52.889237 0.064607 tcp 10.0.2.105 55991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:52.954237 0.159071 tcp 10.0.2.105 55992 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:17:53.123389 2.994569 tcp 10.0.2.105 55993 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:02.126166 0.000000 tcp 10.0.2.105 55993 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:08.125746 0.061792 tcp 10.0.2.105 55994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:18:08.187794 0.062499 tcp 10.0.2.105 55995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:18:08.250581 0.155191 tcp 10.0.2.105 55996 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:18:08.423117 2.996745 tcp 10.0.2.105 55997 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:17.418558 0.000000 tcp 10.0.2.105 55997 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:23.417290 3.003879 tcp 10.0.2.105 55998 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:32.419963 0.000000 tcp 10.0.2.105 55998 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:37.276988 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:18:38.418821 3.004301 tcp 10.0.2.105 55999 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:47.421734 0.000000 tcp 10.0.2.105 55999 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:18:53.420341 3.004330 tcp 10.0.2.105 56000 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:19:01.271264 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:19:02.423268 0.000000 tcp 10.0.2.105 56000 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:20:50.334257 2.998388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 12:20:57.338168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:21:05.339860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:21:21.346531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:21:53.349033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:24:08.423534 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:24:08.423731 3.003568 tcp 10.0.2.105 56001 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:17.435939 0.000000 tcp 10.0.2.105 56001 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:23.426547 0.061279 tcp 10.0.2.105 56002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:23.488079 0.063908 tcp 10.0.2.105 56003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:23.552242 0.151921 tcp 10.0.2.105 56004 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:23.828170 3.001313 tcp 10.0.2.105 56005 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:32.827878 0.000000 tcp 10.0.2.105 56005 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:38.827284 0.061255 tcp 10.0.2.105 56006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:38.888818 0.059490 tcp 10.0.2.105 56007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:38.948582 0.243024 tcp 10.0.2.105 56008 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:39.230310 2.991329 tcp 10.0.2.105 56009 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:48.223122 0.000000 tcp 10.0.2.105 56009 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:24:54.219837 0.061648 tcp 10.0.2.105 56010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:54.281581 0.062196 tcp 10.0.2.105 56011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:54.344065 0.147557 tcp 10.0.2.105 56012 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:24:54.546978 2.996635 tcp 10.0.2.105 56013 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:03.542633 0.000000 tcp 10.0.2.105 56013 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:09.542067 0.061108 tcp 10.0.2.105 56014 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:25:09.603493 0.067105 tcp 10.0.2.105 56015 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:25:09.670843 0.155309 tcp 10.0.2.105 56016 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:25:09.888437 3.007363 tcp 10.0.2.105 56017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:18.894245 0.000000 tcp 10.0.2.105 56017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:24.883634 2.993469 tcp 10.0.2.105 56018 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:33.885946 0.000000 tcp 10.0.2.105 56018 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:38.773015 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:25:39.885025 2.995964 tcp 10.0.2.105 56019 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:48.877409 0.000000 tcp 10.0.2.105 56019 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:25:54.889137 2.990985 tcp 10.0.2.105 56020 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:26:02.779285 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:26:03.879301 0.000000 tcp 10.0.2.105 56020 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:27:57.355850 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 12:28:04.362311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:28:12.363865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:28:28.366856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:29:00.372901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:31:09.889553 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:31:09.889719 3.013981 tcp 10.0.2.105 56021 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:31:18.891830 0.000000 tcp 10.0.2.105 56021 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:31:24.891621 0.059688 tcp 10.0.2.105 56022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:31:24.951585 0.061450 tcp 10.0.2.105 56023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:31:25.013280 0.148458 tcp 10.0.2.105 56024 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:31:25.213351 3.002082 tcp 10.0.2.105 56025 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:31:34.214007 0.000000 tcp 10.0.2.105 56025 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:35:04.386521 2.994260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 12:35:11.386074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:35:19.388075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:35:35.390948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:35:52.705872 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:35:52.706035 0.043433 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:52.742125 0.226470 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:52.961175 0.155576 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:53.109265 0.176644 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:53.660858 0.725564 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:54.371931 0.172831 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:54.569357 0.172027 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:54.717958 0.092045 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:54.857808 0.060543 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:54.917351 0.097158 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:55.037705 0.098058 udp 10.0.2.105 7010 <-> 84.173.19.14 7912 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:35:55.104927 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 3114 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 12:36:07.396893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:36:12.426236 0.062829 tcp 10.0.2.105 56026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:12.489368 0.061529 tcp 10.0.2.105 56027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:12.551200 0.154970 tcp 10.0.2.105 56028 -> 195.113.214.249 443 SRPA* 0 0 49 28904 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:12.706695 0.180872 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:12.857764 0.107828 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:13.142445 0.223859 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:13.358470 0.177910 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:13.724487 0.280852 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:14.183178 0.110464 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:14.263773 0.068921 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:14.461969 0.077369 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:14.601486 0.803401 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:15.382691 0.071281 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:15.482170 0.171749 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:15.629685 0.192272 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2606 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:15.831172 0.189132 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:16.014205 0.301286 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:16.290967 0.131121 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:16.484817 0.129574 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:16.651221 0.504539 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:17.148616 0.106539 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:17.625001 0.300382 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:17.887227 0.436729 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:18.301323 0.115989 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/09 12:36:40.215224 2.993561 tcp 10.0.2.105 56029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:36:44.770678 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:36:49.219849 0.000000 tcp 10.0.2.105 56029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:36:55.216078 0.062958 tcp 10.0.2.105 56030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:55.279318 0.060762 tcp 10.0.2.105 56031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:55.340382 0.153613 tcp 10.0.2.105 56032 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:36:55.541925 3.001495 tcp 10.0.2.105 56033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:04.538960 0.000000 tcp 10.0.2.105 56033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:10.537965 0.060062 tcp 10.0.2.105 56034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:10.598342 0.061831 tcp 10.0.2.105 56035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:10.660637 0.147746 tcp 10.0.2.105 56036 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:11.120438 3.002383 tcp 10.0.2.105 56037 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:20.121101 0.000000 tcp 10.0.2.105 56037 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:26.120094 0.059838 tcp 10.0.2.105 56038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:26.180261 0.059943 tcp 10.0.2.105 56039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:26.240561 0.155868 tcp 10.0.2.105 56040 -> 195.113.214.249 443 SRPA* 0 0 30 11810 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:26.437610 3.007229 tcp 10.0.2.105 56041 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:35.443421 0.000000 tcp 10.0.2.105 56041 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:41.432757 0.059766 tcp 10.0.2.105 56042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:41.492827 0.062688 tcp 10.0.2.105 56043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:41.555817 0.152336 tcp 10.0.2.105 56044 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:37:41.779832 2.996740 tcp 10.0.2.105 56045 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:50.782738 0.000000 tcp 10.0.2.105 56045 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:37:56.774433 3.000119 tcp 10.0.2.105 56046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:38:05.777115 0.000000 tcp 10.0.2.105 56046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:38:10.773940 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:38:11.775569 2.994231 tcp 10.0.2.105 56047 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:38:20.769094 0.000000 tcp 10.0.2.105 56047 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:38:26.779561 3.002882 tcp 10.0.2.105 56048 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:38:34.769130 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:38:35.779741 0.000000 tcp 10.0.2.105 56048 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:42:11.403144 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 12:42:18.410262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:42:26.411834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:42:42.414758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:43:14.420873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:43:41.782705 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:43:41.782846 3.001544 tcp 10.0.2.105 56049 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:43:50.785576 0.000000 tcp 10.0.2.105 56049 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:43:56.784044 0.063679 tcp 10.0.2.105 56050 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:43:56.848050 0.061113 tcp 10.0.2.105 56051 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:43:56.909523 0.156278 tcp 10.0.2.105 56052 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:43:57.182240 3.004223 tcp 10.0.2.105 56053 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:06.211037 0.000000 tcp 10.0.2.105 56053 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:12.174451 0.061957 tcp 10.0.2.105 56054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:12.236729 0.064008 tcp 10.0.2.105 56055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:12.301061 0.153020 tcp 10.0.2.105 56056 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:12.679154 2.999852 tcp 10.0.2.105 56057 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:21.687686 0.000000 tcp 10.0.2.105 56057 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:27.676833 0.060316 tcp 10.0.2.105 56058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:27.737467 0.060324 tcp 10.0.2.105 56059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:27.798032 0.152707 tcp 10.0.2.105 56060 -> 195.113.214.249 443 SRPA* 0 0 25 13876 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:28.050048 3.000369 tcp 10.0.2.105 56061 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:37.049774 0.000000 tcp 10.0.2.105 56061 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:43.048950 0.062637 tcp 10.0.2.105 56062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:43.111891 0.062432 tcp 10.0.2.105 56063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:43.174580 0.152460 tcp 10.0.2.105 56064 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:44:43.411394 3.001639 tcp 10.0.2.105 56065 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:52.411731 0.000000 tcp 10.0.2.105 56065 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:44:58.410536 3.004488 tcp 10.0.2.105 56066 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:45:07.413319 0.000000 tcp 10.0.2.105 56066 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:45:12.272182 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:45:13.412687 3.003414 tcp 10.0.2.105 56067 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:45:22.414871 0.000000 tcp 10.0.2.105 56067 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:45:28.413657 2.993975 tcp 10.0.2.105 56068 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:45:36.274873 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:45:37.416627 0.000000 tcp 10.0.2.105 56068 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:50:43.417373 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:50:43.417514 2.993773 tcp 10.0.2.105 56069 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:50:52.409305 0.000000 tcp 10.0.2.105 56069 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:50:58.419581 0.061597 tcp 10.0.2.105 56070 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:50:58.481463 0.062216 tcp 10.0.2.105 56071 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:50:58.544016 0.150343 tcp 10.0.2.105 56072 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:50:58.763627 2.999370 tcp 10.0.2.105 56073 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:07.761453 0.000000 tcp 10.0.2.105 56073 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:13.764903 0.063931 tcp 10.0.2.105 56074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:13.829121 0.060407 tcp 10.0.2.105 56075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:13.889816 0.187742 tcp 10.0.2.105 56076 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:14.109136 2.998053 tcp 10.0.2.105 56077 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:23.105430 0.000000 tcp 10.0.2.105 56077 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:29.104711 0.061081 tcp 10.0.2.105 56078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:29.166072 0.060926 tcp 10.0.2.105 56079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:29.227291 0.145820 tcp 10.0.2.105 56080 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:29.524131 3.007559 tcp 10.0.2.105 56081 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:38.528308 0.000000 tcp 10.0.2.105 56081 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:44.524906 0.061041 tcp 10.0.2.105 56082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:44.586146 0.061254 tcp 10.0.2.105 56083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:44.647705 0.155480 tcp 10.0.2.105 56084 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:51:44.846670 2.992003 tcp 10.0.2.105 56085 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:53.838755 0.000000 tcp 10.0.2.105 56085 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:51:59.846722 2.993781 tcp 10.0.2.105 56086 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:52:08.839175 0.000000 tcp 10.0.2.105 56086 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:52:13.776240 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:52:14.847969 3.004156 tcp 10.0.2.105 56087 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:52:23.850564 0.000000 tcp 10.0.2.105 56087 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:52:29.849807 3.003725 tcp 10.0.2.105 56088 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:52:37.771154 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:52:38.852263 0.000000 tcp 10.0.2.105 56088 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:53:36.433599 2.999601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 12:53:43.434902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:53:51.437324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:54:07.443434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:54:39.446395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 12:57:44.852672 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:57:44.852803 3.003928 tcp 10.0.2.105 56089 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:57:53.855337 0.000000 tcp 10.0.2.105 56089 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:57:59.855287 0.065590 tcp 10.0.2.105 56090 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:57:59.921123 0.063792 tcp 10.0.2.105 56091 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:57:59.985180 0.150172 tcp 10.0.2.105 56092 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:00.167230 3.001461 tcp 10.0.2.105 56093 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:09.177041 0.000000 tcp 10.0.2.105 56093 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:15.166613 0.064483 tcp 10.0.2.105 56094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:15.231455 0.062582 tcp 10.0.2.105 56095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:15.294291 0.156381 tcp 10.0.2.105 56096 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:15.489235 3.001383 tcp 10.0.2.105 56097 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:24.489160 0.000000 tcp 10.0.2.105 56097 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:30.488720 0.062527 tcp 10.0.2.105 56098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:30.551543 0.061220 tcp 10.0.2.105 56099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:30.613082 0.154426 tcp 10.0.2.105 56100 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:30.781998 3.000943 tcp 10.0.2.105 56101 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:39.781204 0.000000 tcp 10.0.2.105 56101 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:45.780119 0.061366 tcp 10.0.2.105 56102 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:45.841762 0.060849 tcp 10.0.2.105 56103 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:45.902872 0.151899 tcp 10.0.2.105 56104 -> 195.113.214.249 443 SRPA* 0 0 24 14656 flow=From-Botnet-V2-TCP-Established 1970/02/09 12:58:46.108534 3.006075 tcp 10.0.2.105 56105 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:58:55.113591 0.000000 tcp 10.0.2.105 56105 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:01.101975 3.004323 tcp 10.0.2.105 56106 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:10.105005 0.000000 tcp 10.0.2.105 56106 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:14.771474 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:59:16.103721 2.993991 tcp 10.0.2.105 56107 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:25.106605 0.000000 tcp 10.0.2.105 56107 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:31.105394 2.994091 tcp 10.0.2.105 56108 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 12:59:38.775831 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 12:59:40.098035 0.000000 tcp 10.0.2.105 56108 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:00:43.452394 3.006658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:00:50.459169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:00:58.460674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:01:14.463670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:01:46.469552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:06:47.613023 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:06:47.613132 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 3114 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 13:07:06.341798 0.060646 tcp 10.0.2.105 56109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:06.402776 0.062462 tcp 10.0.2.105 56110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:06.465558 0.152091 tcp 10.0.2.105 56111 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:06.618879 0.155010 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:06.766655 0.036629 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:06.983757 0.225904 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:07.201200 0.872447 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 5 1833 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:08.061741 0.174859 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:08.233818 0.091215 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:08.635456 0.059800 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:08.694397 0.099181 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:08.835698 0.000000 udp 10.0.2.105 7010 -> 84.173.19.14 7912 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 13:07:16.123915 2.994046 tcp 10.0.2.105 56112 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:25.127021 0.000000 tcp 10.0.2.105 56112 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:27.651130 0.060457 tcp 10.0.2.105 56113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:27.711896 0.061227 tcp 10.0.2.105 56114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:27.773405 0.158132 tcp 10.0.2.105 56115 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:27.932060 0.168614 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:28.076801 0.173623 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:28.243285 0.375684 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:28.927295 0.175231 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:29.072408 0.109119 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:29.143813 0.175095 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:29.635310 0.282451 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:30.017453 0.107150 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:30.092161 0.501659 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:30.574854 0.067932 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:30.681049 0.095082 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:30.951619 0.074089 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:31.009986 0.172177 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:31.125489 0.061550 tcp 10.0.2.105 56116 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:31.187308 0.062623 tcp 10.0.2.105 56117 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:31.195329 0.187060 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:31.250241 0.151498 tcp 10.0.2.105 56118 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:31.360741 0.196750 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:31.417192 2.992815 tcp 10.0.2.105 56119 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:31.549743 0.251054 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:31.773951 0.507767 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:32.270540 0.141188 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:32.469996 0.128274 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:32.816573 0.446392 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:33.240147 0.107774 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:33.388739 0.248970 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:33.602360 0.103397 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:07:40.408883 0.000000 tcp 10.0.2.105 56119 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:46.417711 0.060161 tcp 10.0.2.105 56120 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:46.478149 0.065369 tcp 10.0.2.105 56121 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:46.543832 0.151182 tcp 10.0.2.105 56122 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:07:46.779084 3.002827 tcp 10.0.2.105 56123 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:50.541086 2.982492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:07:55.807226 0.000000 tcp 10.0.2.105 56123 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:07:57.501541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:08:01.779456 0.061174 tcp 10.0.2.105 56124 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:08:01.840925 0.061977 tcp 10.0.2.105 56125 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:08:01.903181 0.149665 tcp 10.0.2.105 56126 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:08:02.114599 2.999229 tcp 10.0.2.105 56127 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:05.484737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:08:11.112589 0.000000 tcp 10.0.2.105 56127 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:17.111041 3.004604 tcp 10.0.2.105 56128 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:21.487613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:08:26.114034 0.000000 tcp 10.0.2.105 56128 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:30.770841 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:08:32.112981 2.993840 tcp 10.0.2.105 56129 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:41.115765 0.000000 tcp 10.0.2.105 56129 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:08:53.493450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:13:47.115870 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:13:47.116017 2.993913 tcp 10.0.2.105 56130 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:13:56.108146 0.000000 tcp 10.0.2.105 56130 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:02.119286 0.065328 tcp 10.0.2.105 56131 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:02.184950 0.062003 tcp 10.0.2.105 56132 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:02.247265 0.149666 tcp 10.0.2.105 56133 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:02.427497 3.005129 tcp 10.0.2.105 56134 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:11.430712 0.000000 tcp 10.0.2.105 56134 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:17.419965 0.060071 tcp 10.0.2.105 56135 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:17.480442 0.062869 tcp 10.0.2.105 56136 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:17.543614 0.152071 tcp 10.0.2.105 56137 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:17.715597 2.998360 tcp 10.0.2.105 56138 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:26.712611 0.000000 tcp 10.0.2.105 56138 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:32.711859 0.061233 tcp 10.0.2.105 56139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:32.772956 0.061243 tcp 10.0.2.105 56140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:32.834516 0.152020 tcp 10.0.2.105 56141 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:32.997353 3.008924 tcp 10.0.2.105 56142 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:42.004545 0.000000 tcp 10.0.2.105 56142 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:47.993829 0.059804 tcp 10.0.2.105 56143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:48.053901 0.064745 tcp 10.0.2.105 56144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:48.118910 0.153432 tcp 10.0.2.105 56145 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:14:48.298587 2.999152 tcp 10.0.2.105 56146 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:57.306425 0.000000 tcp 10.0.2.105 56146 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:14:57.499874 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:15:03.295848 2.993697 tcp 10.0.2.105 56147 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:15:04.506980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:15:12.288492 0.000000 tcp 10.0.2.105 56147 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:15:12.508819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:15:17.275426 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:15:18.297189 3.003912 tcp 10.0.2.105 56148 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:15:27.299712 0.000000 tcp 10.0.2.105 56148 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:15:28.511398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:15:33.298650 3.004389 tcp 10.0.2.105 56149 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:15:41.269783 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:15:42.301470 0.000000 tcp 10.0.2.105 56149 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:16:00.518217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:20:48.302049 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:20:48.302294 3.003479 tcp 10.0.2.105 56150 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:20:57.304435 0.000000 tcp 10.0.2.105 56150 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:03.304966 0.062227 tcp 10.0.2.105 56151 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:03.367429 0.065168 tcp 10.0.2.105 56152 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:03.432886 0.151881 tcp 10.0.2.105 56153 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:03.610619 2.997334 tcp 10.0.2.105 56154 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:12.616527 0.000000 tcp 10.0.2.105 56154 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:18.605538 0.062994 tcp 10.0.2.105 56155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:18.668839 0.061553 tcp 10.0.2.105 56156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:18.730676 0.146722 tcp 10.0.2.105 56157 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:18.887686 3.001899 tcp 10.0.2.105 56158 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:27.887973 0.000000 tcp 10.0.2.105 56158 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:33.886799 0.061753 tcp 10.0.2.105 56159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:33.948869 0.061023 tcp 10.0.2.105 56160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:34.010174 0.146287 tcp 10.0.2.105 56161 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:34.173153 2.998877 tcp 10.0.2.105 56162 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:43.170037 0.000000 tcp 10.0.2.105 56162 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:49.169556 0.061890 tcp 10.0.2.105 56163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:49.231717 0.061072 tcp 10.0.2.105 56164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:49.293087 0.152628 tcp 10.0.2.105 56165 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:21:49.455758 2.997824 tcp 10.0.2.105 56166 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:21:58.452276 0.000000 tcp 10.0.2.105 56166 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:04.451115 3.003879 tcp 10.0.2.105 56167 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:04.523573 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:22:11.530996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:22:13.453558 0.000000 tcp 10.0.2.105 56167 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:18.270619 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:22:19.453250 3.003450 tcp 10.0.2.105 56168 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:19.533114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:22:28.455462 0.000000 tcp 10.0.2.105 56168 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:34.454000 2.994177 tcp 10.0.2.105 56169 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:22:35.535836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:22:42.275291 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:22:43.457142 0.000000 tcp 10.0.2.105 56169 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:23:07.541503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:27:49.457428 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:27:49.457596 3.003476 tcp 10.0.2.105 56170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:27:58.459783 0.000000 tcp 10.0.2.105 56170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:04.460409 0.092292 tcp 10.0.2.105 56171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:04.552981 0.063683 tcp 10.0.2.105 56172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:04.616885 0.149471 tcp 10.0.2.105 56173 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:04.917102 3.004219 tcp 10.0.2.105 56174 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:13.927872 0.000000 tcp 10.0.2.105 56174 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:19.911175 0.063027 tcp 10.0.2.105 56175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:19.974496 0.059958 tcp 10.0.2.105 56176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:20.034703 0.148000 tcp 10.0.2.105 56177 -> 195.113.214.249 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:20.379272 3.009916 tcp 10.0.2.105 56178 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:29.386157 0.000000 tcp 10.0.2.105 56178 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:35.373663 0.061461 tcp 10.0.2.105 56179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:35.435399 0.063932 tcp 10.0.2.105 56180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:35.499603 0.151912 tcp 10.0.2.105 56181 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:35.918887 3.003584 tcp 10.0.2.105 56182 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:44.926758 0.000000 tcp 10.0.2.105 56182 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:28:50.919954 0.060064 tcp 10.0.2.105 56183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:50.980540 0.063868 tcp 10.0.2.105 56184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:51.044777 0.150795 tcp 10.0.2.105 56185 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:28:51.534346 2.996381 tcp 10.0.2.105 56186 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:00.529078 0.000000 tcp 10.0.2.105 56186 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:06.527839 3.004140 tcp 10.0.2.105 56187 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:11.548750 3.000392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:29:15.530755 0.000000 tcp 10.0.2.105 56187 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:18.561307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:29:20.281336 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:29:21.531592 3.001909 tcp 10.0.2.105 56188 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:26.556307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:29:30.532598 0.000000 tcp 10.0.2.105 56188 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:36.531163 3.750099 tcp 10.0.2.105 56189 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:29:43.266421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:29:44.957568 0.284636 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:29:46.481670 0.000000 tcp 10.0.2.105 56189 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:30:15.171734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:34:51.544175 0.000208 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:34:51.544509 2.993370 tcp 10.0.2.105 56190 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:00.548704 0.000000 tcp 10.0.2.105 56190 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:06.547318 0.061932 tcp 10.0.2.105 56191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:06.609544 0.064845 tcp 10.0.2.105 56192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:06.674708 0.152335 tcp 10.0.2.105 56193 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:07.013103 2.997072 tcp 10.0.2.105 56194 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:16.008863 0.000000 tcp 10.0.2.105 56194 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:22.011404 0.063445 tcp 10.0.2.105 56195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:22.075086 0.062079 tcp 10.0.2.105 56196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:22.137473 0.146684 tcp 10.0.2.105 56197 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:35:22.380775 3.001735 tcp 10.0.2.105 56198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:31.381449 0.000000 tcp 10.0.2.105 56198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:37.379639 3.005287 tcp 10.0.2.105 56199 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:46.382603 0.000000 tcp 10.0.2.105 56199 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:35:51.269585 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:36:18.571697 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:36:25.579153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:36:33.580504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:36:49.583335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:37:21.593875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:37:41.782070 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:37:41.782305 0.067746 udp 10.0.2.105 7010 -> 84.173.19.14 7912 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 13:37:41.850051 0.000000 icmp 84.173.19.14 0x0303 -> 10.0.2.105 0xe81e URP 192 1 299 flow=Background 1970/02/09 13:37:57.131470 0.062200 tcp 10.0.2.105 56200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:37:57.194029 0.062337 tcp 10.0.2.105 56201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:37:57.256663 0.150438 tcp 10.0.2.105 56202 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:37:57.407537 0.227287 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:57.626978 0.155259 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:57.811095 0.035703 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:57.870918 0.681592 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:58.536710 0.176564 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:58.710434 0.093703 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:58.923278 0.059444 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:58.981223 0.094156 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:59.175125 0.171452 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:59.324196 0.175188 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:59.491593 0.217348 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:59.702001 0.170786 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:37:59.869432 0.174973 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:00.017191 0.106923 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:00.466626 0.289900 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:01.108947 0.108878 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:01.247962 0.078684 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:01.326305 0.070388 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:01.640679 0.174051 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2663 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:01.947401 0.517944 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:02.442875 0.069959 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:02.943223 0.186745 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:03.109389 0.197337 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:03.301598 0.370435 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:03.644475 0.129070 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2590 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:03.825727 0.227925 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:04.049297 0.142328 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:04.145846 0.502159 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2071 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:04.624457 0.106235 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:04.725637 0.255984 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:38:04.947005 0.115749 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/09 13:40:52.382960 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:40:52.383149 3.003655 tcp 10.0.2.105 56203 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:01.385437 0.000000 tcp 10.0.2.105 56203 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:07.385687 0.063693 tcp 10.0.2.105 56204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:07.449688 0.061904 tcp 10.0.2.105 56205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:07.511959 0.153691 tcp 10.0.2.105 56206 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:07.898302 3.000953 tcp 10.0.2.105 56207 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:16.897129 0.000000 tcp 10.0.2.105 56207 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:22.897240 0.061641 tcp 10.0.2.105 56208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:22.959150 0.061733 tcp 10.0.2.105 56209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:23.021195 0.150424 tcp 10.0.2.105 56210 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:23.186133 2.994955 tcp 10.0.2.105 56211 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:32.179492 0.000000 tcp 10.0.2.105 56211 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:38.178692 0.062866 tcp 10.0.2.105 56212 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:38.241826 0.062017 tcp 10.0.2.105 56213 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:38.304115 0.161150 tcp 10.0.2.105 56214 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:38.509047 3.004151 tcp 10.0.2.105 56215 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:47.511907 0.000000 tcp 10.0.2.105 56215 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:41:53.511917 0.060305 tcp 10.0.2.105 56216 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:53.572645 0.062565 tcp 10.0.2.105 56217 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:53.635521 0.151473 tcp 10.0.2.105 56218 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:41:53.849451 3.005638 tcp 10.0.2.105 56219 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:02.853842 0.000000 tcp 10.0.2.105 56219 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:08.843361 3.003472 tcp 10.0.2.105 56220 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:17.845506 0.000000 tcp 10.0.2.105 56220 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:22.772498 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:42:23.844455 2.994035 tcp 10.0.2.105 56221 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:32.846887 0.000000 tcp 10.0.2.105 56221 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:38.846015 2.993506 tcp 10.0.2.105 56222 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:42:46.776815 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:42:47.838609 0.000000 tcp 10.0.2.105 56222 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:43:25.594835 3.002245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:43:32.603134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:43:40.604255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:43:56.607439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:44:28.613340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:47:53.849311 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:47:53.849502 3.003200 tcp 10.0.2.105 56223 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:02.851442 0.000000 tcp 10.0.2.105 56223 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:08.851807 0.061567 tcp 10.0.2.105 56224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:08.913697 0.061515 tcp 10.0.2.105 56225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:08.975572 0.154178 tcp 10.0.2.105 56226 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:09.206414 2.998774 tcp 10.0.2.105 56227 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:18.205685 0.000000 tcp 10.0.2.105 56227 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:24.202545 0.060463 tcp 10.0.2.105 56228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:24.263397 0.061002 tcp 10.0.2.105 56229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:24.324668 0.150914 tcp 10.0.2.105 56230 -> 195.113.214.249 443 SRPA* 0 0 26 13094 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:24.502246 3.004831 tcp 10.0.2.105 56231 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:33.506251 0.000000 tcp 10.0.2.105 56231 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:39.494693 0.060950 tcp 10.0.2.105 56232 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:39.555853 0.061447 tcp 10.0.2.105 56233 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:39.617594 0.148576 tcp 10.0.2.105 56234 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:39.902293 2.996106 tcp 10.0.2.105 56235 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:48.907765 0.000000 tcp 10.0.2.105 56235 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:48:54.897300 0.060531 tcp 10.0.2.105 56236 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:54.958075 0.061259 tcp 10.0.2.105 56237 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:55.019737 0.151053 tcp 10.0.2.105 56238 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:48:55.242585 2.988763 tcp 10.0.2.105 56239 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:04.231159 0.000000 tcp 10.0.2.105 56239 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:10.238670 3.003882 tcp 10.0.2.105 56240 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:19.241376 0.000000 tcp 10.0.2.105 56240 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:23.767799 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:49:25.240195 3.003910 tcp 10.0.2.105 56241 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:34.242684 0.000000 tcp 10.0.2.105 56241 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:40.241879 3.003972 tcp 10.0.2.105 56242 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:49:47.772322 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:49:49.244136 0.000000 tcp 10.0.2.105 56242 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:54:13.627499 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 13:54:20.634446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:54:28.636125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:54:44.640600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:54:55.245311 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:54:55.245495 2.997042 tcp 10.0.2.105 56243 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:04.247504 0.000000 tcp 10.0.2.105 56243 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:10.247322 0.061570 tcp 10.0.2.105 56244 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:10.309154 0.062068 tcp 10.0.2.105 56245 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:10.371482 0.153631 tcp 10.0.2.105 56246 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:10.541445 2.999414 tcp 10.0.2.105 56247 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:16.645352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 13:55:19.539624 0.000000 tcp 10.0.2.105 56247 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:25.538432 0.060531 tcp 10.0.2.105 56248 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:25.599275 0.066836 tcp 10.0.2.105 56249 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:25.666488 0.148184 tcp 10.0.2.105 56250 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:25.831503 3.001222 tcp 10.0.2.105 56251 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:34.834925 0.000000 tcp 10.0.2.105 56251 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:40.831357 0.061780 tcp 10.0.2.105 56252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:40.893417 0.061045 tcp 10.0.2.105 56253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:40.954825 0.151834 tcp 10.0.2.105 56254 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:41.123879 3.000602 tcp 10.0.2.105 56255 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:50.123325 0.000000 tcp 10.0.2.105 56255 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:55:56.122876 0.059457 tcp 10.0.2.105 56256 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:56.182750 0.062739 tcp 10.0.2.105 56257 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:56.245774 0.153275 tcp 10.0.2.105 56258 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/09 13:55:56.436680 2.999949 tcp 10.0.2.105 56259 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:05.435362 0.000000 tcp 10.0.2.105 56259 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:11.433953 2.994412 tcp 10.0.2.105 56260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:20.436979 0.000000 tcp 10.0.2.105 56260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:25.273704 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:56:26.436158 2.993765 tcp 10.0.2.105 56261 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:35.433274 0.000000 tcp 10.0.2.105 56261 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:41.437354 3.004135 tcp 10.0.2.105 56262 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 13:56:49.271420 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 13:56:50.441460 0.000000 tcp 10.0.2.105 56262 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:01:20.652137 3.000473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:01:27.659123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:01:35.660218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:01:51.663291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:01:56.441185 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:01:56.441376 3.002898 tcp 10.0.2.105 56263 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:05.443030 0.000000 tcp 10.0.2.105 56263 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:11.443764 0.060917 tcp 10.0.2.105 56264 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:11.504987 0.060942 tcp 10.0.2.105 56265 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:11.566211 0.152622 tcp 10.0.2.105 56266 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:11.739039 3.009537 tcp 10.0.2.105 56267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:20.745109 0.000000 tcp 10.0.2.105 56267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:23.669211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:02:26.734030 0.061658 tcp 10.0.2.105 56268 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:26.796029 0.062900 tcp 10.0.2.105 56269 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:26.859163 0.152066 tcp 10.0.2.105 56270 -> 195.113.214.249 443 SRPA* 0 0 25 13250 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:27.048044 3.000557 tcp 10.0.2.105 56271 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:36.057081 0.000000 tcp 10.0.2.105 56271 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:42.046295 0.060097 tcp 10.0.2.105 56272 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:42.106655 0.061341 tcp 10.0.2.105 56273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:42.168267 0.153300 tcp 10.0.2.105 56274 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:42.402547 2.998218 tcp 10.0.2.105 56275 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:51.399235 0.000000 tcp 10.0.2.105 56275 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:02:57.398350 0.062893 tcp 10.0.2.105 56276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:57.461534 0.064026 tcp 10.0.2.105 56277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:57.525822 0.145449 tcp 10.0.2.105 56278 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:02:57.718341 3.004138 tcp 10.0.2.105 56279 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:06.721331 0.000000 tcp 10.0.2.105 56279 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:12.719691 3.004140 tcp 10.0.2.105 56280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:21.722716 0.000000 tcp 10.0.2.105 56280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:26.268882 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:03:27.721705 3.003698 tcp 10.0.2.105 56281 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:36.724348 0.000000 tcp 10.0.2.105 56281 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:42.723116 3.003992 tcp 10.0.2.105 56282 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:03:50.273554 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:03:51.735924 0.000000 tcp 10.0.2.105 56282 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:08:06.091810 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:08:06.091992 0.039343 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:06.118092 0.228906 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:06.414510 0.148907 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 616 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:24.039086 0.061703 tcp 10.0.2.105 56283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:24.101074 0.060127 tcp 10.0.2.105 56284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:24.161486 0.153366 tcp 10.0.2.105 56285 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:24.315527 0.563375 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:24.863365 0.177119 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.037105 0.116009 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.251309 0.059996 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.331668 0.094822 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.547007 0.220222 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.759189 0.175164 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:25.972191 0.175009 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:26.119030 0.169997 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:26.273226 0.172318 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:26.438707 0.107491 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:26.895660 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 14:08:27.674730 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:08:34.682663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:08:42.684040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:08:44.517659 0.061119 tcp 10.0.2.105 56286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:44.579079 0.064579 tcp 10.0.2.105 56287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:44.643990 0.163832 tcp 10.0.2.105 56288 -> 195.113.214.249 443 SRPA* 0 0 73 77634 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:08:44.808448 0.111480 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:44.885585 0.172561 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.033511 0.084137 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.166520 0.070568 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.221427 0.188729 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.568745 0.192833 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.817638 0.069519 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:45.893478 0.120030 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:46.003945 0.237669 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:46.370740 0.127125 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:46.628822 0.487306 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:47.108697 0.225166 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:47.574235 0.257254 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:47.795361 0.103442 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:47.990069 0.440927 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:48.410043 0.105083 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:08:57.726127 2.993934 tcp 10.0.2.105 56289 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:08:58.687132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:09:06.718667 0.000000 tcp 10.0.2.105 56289 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:11.275185 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:09:12.727801 0.061349 tcp 10.0.2.105 56290 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:12.789390 0.063241 tcp 10.0.2.105 56291 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:12.852920 0.152165 tcp 10.0.2.105 56292 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:13.265162 2.997115 tcp 10.0.2.105 56293 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:22.264093 0.000000 tcp 10.0.2.105 56293 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:28.260437 0.059329 tcp 10.0.2.105 56294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:28.320129 0.065504 tcp 10.0.2.105 56295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:28.385943 0.156471 tcp 10.0.2.105 56296 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:29.019355 3.005166 tcp 10.0.2.105 56297 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:30.693036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:09:38.023413 0.000000 tcp 10.0.2.105 56297 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:44.012871 0.529988 tcp 10.0.2.105 56298 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:44.542692 0.063188 tcp 10.0.2.105 56299 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:44.606149 0.150029 tcp 10.0.2.105 56300 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:09:45.071276 2.973517 tcp 10.0.2.105 56301 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:09:53.994513 0.000000 tcp 10.0.2.105 56301 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:00.991978 0.060829 tcp 10.0.2.105 56302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:10:01.053083 0.061424 tcp 10.0.2.105 56303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:10:01.114814 0.148423 tcp 10.0.2.105 56304 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:10:01.515023 2.954123 tcp 10.0.2.105 56305 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:10.392734 0.000000 tcp 10.0.2.105 56305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:16.316871 2.961387 tcp 10.0.2.105 56306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:25.204443 0.000000 tcp 10.0.2.105 56306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:29.784087 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:10:31.129389 2.970775 tcp 10.0.2.105 56307 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:40.030662 0.000000 tcp 10.0.2.105 56307 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:45.956499 2.977072 tcp 10.0.2.105 56308 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:10:53.500393 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:10:54.858739 0.000000 tcp 10.0.2.105 56308 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:15:39.706231 3.001527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:15:46.713611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:15:54.715145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:16:00.143394 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:16:00.143474 3.003930 tcp 10.0.2.105 56309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:09.155955 0.000000 tcp 10.0.2.105 56309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:10.718352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:16:15.146689 0.060157 tcp 10.0.2.105 56310 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:15.207136 0.067097 tcp 10.0.2.105 56311 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:15.274573 0.146870 tcp 10.0.2.105 56312 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:15.751311 2.998383 tcp 10.0.2.105 56313 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:24.748570 0.000000 tcp 10.0.2.105 56313 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:30.747735 0.061742 tcp 10.0.2.105 56314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:30.809759 0.060442 tcp 10.0.2.105 56315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:30.870452 0.147912 tcp 10.0.2.105 56316 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:31.050012 3.002686 tcp 10.0.2.105 56317 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:40.050322 0.000000 tcp 10.0.2.105 56317 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:42.724029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:16:46.049689 0.063529 tcp 10.0.2.105 56318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:46.113498 0.060230 tcp 10.0.2.105 56319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:46.174041 0.148602 tcp 10.0.2.105 56320 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:16:46.903561 3.000642 tcp 10.0.2.105 56321 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:16:55.903185 0.000000 tcp 10.0.2.105 56321 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:01.902495 0.061653 tcp 10.0.2.105 56322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:17:01.964609 0.059440 tcp 10.0.2.105 56323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:17:02.024350 0.148628 tcp 10.0.2.105 56324 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:17:02.469001 3.007951 tcp 10.0.2.105 56325 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:11.475575 0.000000 tcp 10.0.2.105 56325 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:17.465979 2.992753 tcp 10.0.2.105 56326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:26.466974 0.000000 tcp 10.0.2.105 56326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:31.273873 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:17:32.465990 2.994017 tcp 10.0.2.105 56327 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:41.458718 0.000000 tcp 10.0.2.105 56327 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:47.467427 3.004061 tcp 10.0.2.105 56328 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:17:55.268349 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:17:56.470285 0.000000 tcp 10.0.2.105 56328 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:22:46.730133 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:22:53.737642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:23:01.739501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:23:02.470639 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:23:02.470782 3.003919 tcp 10.0.2.105 56329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:11.473124 0.000000 tcp 10.0.2.105 56329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:17.474046 0.061580 tcp 10.0.2.105 56330 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:17.535928 0.060569 tcp 10.0.2.105 56331 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:17.596756 0.152209 tcp 10.0.2.105 56332 -> 195.113.214.249 443 SRPA* 0 0 42 22666 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:17.742104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:23:17.874419 3.001716 tcp 10.0.2.105 56333 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:26.875275 0.000000 tcp 10.0.2.105 56333 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:32.874536 0.060887 tcp 10.0.2.105 56334 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:32.935659 0.063095 tcp 10.0.2.105 56335 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:32.999029 0.148907 tcp 10.0.2.105 56336 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:33.162031 2.996421 tcp 10.0.2.105 56337 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:42.167393 0.000000 tcp 10.0.2.105 56337 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:48.156103 0.060440 tcp 10.0.2.105 56338 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:48.216818 0.060885 tcp 10.0.2.105 56339 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:48.277984 0.146008 tcp 10.0.2.105 56340 -> 195.113.214.249 443 SRPA* 0 0 24 11930 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:23:48.434491 2.996294 tcp 10.0.2.105 56341 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:23:49.748148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:23:57.429475 0.000000 tcp 10.0.2.105 56341 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:03.428471 0.063737 tcp 10.0.2.105 56342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:24:03.492526 0.065532 tcp 10.0.2.105 56343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:24:03.558310 0.147116 tcp 10.0.2.105 56344 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:24:03.716149 2.996586 tcp 10.0.2.105 56345 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:12.711365 0.000000 tcp 10.0.2.105 56345 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:18.710150 3.003842 tcp 10.0.2.105 56346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:27.712857 0.000000 tcp 10.0.2.105 56346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:32.269223 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:24:33.711736 3.004065 tcp 10.0.2.105 56347 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:42.714577 0.000000 tcp 10.0.2.105 56347 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:48.713335 3.003895 tcp 10.0.2.105 56348 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:24:56.273720 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:24:57.726172 0.000000 tcp 10.0.2.105 56348 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:29:53.754389 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:30:00.761603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:30:03.716422 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:30:03.716555 2.993746 tcp 10.0.2.105 56349 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:08.763081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:30:12.709208 0.000000 tcp 10.0.2.105 56349 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:18.725039 0.065823 tcp 10.0.2.105 56350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:18.791103 0.061080 tcp 10.0.2.105 56351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:18.852472 0.155009 tcp 10.0.2.105 56352 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:19.321857 3.010621 tcp 10.0.2.105 56353 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:24.767630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:30:28.321226 0.000000 tcp 10.0.2.105 56353 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:34.310425 0.061320 tcp 10.0.2.105 56354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:34.372139 0.060205 tcp 10.0.2.105 56355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:34.432632 0.148234 tcp 10.0.2.105 56356 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:34.670069 3.004712 tcp 10.0.2.105 56357 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:43.673394 0.000000 tcp 10.0.2.105 56357 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:49.662678 0.060458 tcp 10.0.2.105 56358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:49.723460 0.061990 tcp 10.0.2.105 56359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:49.785748 0.148203 tcp 10.0.2.105 56360 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:30:49.957585 2.999067 tcp 10.0.2.105 56361 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:30:56.772297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:30:58.955140 0.000000 tcp 10.0.2.105 56361 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:04.954501 0.060652 tcp 10.0.2.105 56362 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:31:05.015433 0.063613 tcp 10.0.2.105 56363 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:31:05.079294 0.156634 tcp 10.0.2.105 56364 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:31:05.276163 2.992343 tcp 10.0.2.105 56365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:14.277289 0.000000 tcp 10.0.2.105 56365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:20.276451 2.993760 tcp 10.0.2.105 56366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:29.268522 0.000000 tcp 10.0.2.105 56366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:34.276075 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:31:35.277408 3.004833 tcp 10.0.2.105 56367 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:44.280525 0.000000 tcp 10.0.2.105 56367 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:50.279480 3.003967 tcp 10.0.2.105 56368 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:31:58.271195 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:31:59.281933 0.000000 tcp 10.0.2.105 56368 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:37:00.780642 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:37:07.785519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:37:15.786892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:37:31.790158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:38:03.796032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:39:12.575413 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:39:12.575516 0.155088 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:12.723167 0.280605 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.008880 0.041814 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.037618 0.226265 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.256926 0.175879 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.429766 0.087743 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.517939 0.059136 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:13.575479 0.786326 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:14.345964 0.227424 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:14.565971 0.173908 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:14.736412 0.094368 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:14.896781 0.108699 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:14.965720 0.170988 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.115288 0.172980 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.259922 0.176659 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.428976 0.106295 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.505915 0.169913 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.650261 0.078383 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.751682 0.070986 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.807961 0.186104 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:15.973715 0.200399 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.167994 0.070896 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.304662 0.071955 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.367968 0.237373 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.583820 0.131570 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.668049 0.253495 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:16.888670 0.128304 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:17.154796 0.212544 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:17.363466 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 14:39:20.297272 2.992656 tcp 10.0.2.105 56369 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:39:29.289195 0.000000 tcp 10.0.2.105 56369 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:39:33.767198 0.064913 tcp 10.0.2.105 56370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:33.832563 0.063406 tcp 10.0.2.105 56371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:33.896229 0.149370 tcp 10.0.2.105 56372 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:34.046196 0.127943 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:34.198975 0.494399 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/09 14:39:35.297932 0.061928 tcp 10.0.2.105 56373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:35.360217 0.064022 tcp 10.0.2.105 56374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:35.424508 0.150365 tcp 10.0.2.105 56375 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:35.696838 2.995899 tcp 10.0.2.105 56376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:39:44.973023 0.000000 tcp 10.0.2.105 56376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:39:50.917375 0.062355 tcp 10.0.2.105 56377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:50.980068 0.061565 tcp 10.0.2.105 56378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:51.042007 0.149334 tcp 10.0.2.105 56379 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:39:51.419126 2.981376 tcp 10.0.2.105 56380 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:00.340423 0.000000 tcp 10.0.2.105 56380 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:06.269793 0.063272 tcp 10.0.2.105 56381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:06.333277 0.061923 tcp 10.0.2.105 56382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:06.395474 0.146550 tcp 10.0.2.105 56383 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:06.646781 2.966896 tcp 10.0.2.105 56384 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:15.565614 0.000000 tcp 10.0.2.105 56384 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:21.565082 0.060403 tcp 10.0.2.105 56385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:21.625780 0.061218 tcp 10.0.2.105 56386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:21.687283 0.157718 tcp 10.0.2.105 56387 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:40:21.923759 2.995002 tcp 10.0.2.105 56388 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:30.917535 0.000000 tcp 10.0.2.105 56388 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:36.916606 2.993496 tcp 10.0.2.105 56389 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:45.909203 0.000000 tcp 10.0.2.105 56389 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:40:50.776019 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:40:51.918070 3.005784 tcp 10.0.2.105 56390 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:41:00.920165 0.000000 tcp 10.0.2.105 56390 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:41:06.919570 3.004060 tcp 10.0.2.105 56391 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:41:14.770784 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:41:15.922139 0.000000 tcp 10.0.2.105 56391 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:44:07.801800 3.001883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:44:14.812678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:44:22.811166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:44:38.813627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:45:10.820407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:46:21.923252 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:46:21.923401 3.003200 tcp 10.0.2.105 56392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:46:30.924818 0.000000 tcp 10.0.2.105 56392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:46:36.925553 0.061245 tcp 10.0.2.105 56393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:36.987010 0.060447 tcp 10.0.2.105 56394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:37.047715 0.149002 tcp 10.0.2.105 56395 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:37.685592 2.993834 tcp 10.0.2.105 56396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:46:46.678091 0.000000 tcp 10.0.2.105 56396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:46:52.687376 0.064059 tcp 10.0.2.105 56397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:52.751740 0.060405 tcp 10.0.2.105 56398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:52.812459 0.151789 tcp 10.0.2.105 56399 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:46:52.973941 2.997552 tcp 10.0.2.105 56400 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:01.969953 0.000000 tcp 10.0.2.105 56400 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:07.969164 0.058968 tcp 10.0.2.105 56401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:08.028505 0.061322 tcp 10.0.2.105 56402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:08.090122 0.146052 tcp 10.0.2.105 56403 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:08.247315 2.996571 tcp 10.0.2.105 56404 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:17.241881 0.000000 tcp 10.0.2.105 56404 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:23.240677 0.062245 tcp 10.0.2.105 56405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:23.303202 0.060317 tcp 10.0.2.105 56406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:23.363804 0.153178 tcp 10.0.2.105 56407 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:47:23.527598 3.007646 tcp 10.0.2.105 56408 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:32.533783 0.000000 tcp 10.0.2.105 56408 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:38.522747 3.003918 tcp 10.0.2.105 56409 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:47.525381 0.000000 tcp 10.0.2.105 56409 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:47:52.272569 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:47:53.524442 2.994046 tcp 10.0.2.105 56410 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:48:02.526980 0.000000 tcp 10.0.2.105 56410 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:48:08.525813 2.993916 tcp 10.0.2.105 56411 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:48:16.276995 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:48:17.518798 0.000000 tcp 10.0.2.105 56411 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:53:23.529139 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:53:23.529242 3.003922 tcp 10.0.2.105 56412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:53:32.531503 0.000000 tcp 10.0.2.105 56412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:53:38.532315 0.063013 tcp 10.0.2.105 56413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:38.595570 0.060361 tcp 10.0.2.105 56414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:38.656151 0.151289 tcp 10.0.2.105 56415 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:38.834130 3.000797 tcp 10.0.2.105 56416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:53:47.833431 0.000000 tcp 10.0.2.105 56416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:53:53.832909 0.060140 tcp 10.0.2.105 56417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:53.893307 0.061090 tcp 10.0.2.105 56418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:53.954688 0.147352 tcp 10.0.2.105 56419 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:53:54.123455 3.003290 tcp 10.0.2.105 56420 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:03.125365 0.000000 tcp 10.0.2.105 56420 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:09.124092 0.059800 tcp 10.0.2.105 56421 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:09.184137 0.060296 tcp 10.0.2.105 56422 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:09.244721 0.149369 tcp 10.0.2.105 56423 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:09.403297 2.995344 tcp 10.0.2.105 56424 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:18.407494 0.000000 tcp 10.0.2.105 56424 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:24.396673 0.059733 tcp 10.0.2.105 56425 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:24.456678 0.060357 tcp 10.0.2.105 56426 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:24.517288 0.156141 tcp 10.0.2.105 56427 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 14:54:24.698857 3.002057 tcp 10.0.2.105 56428 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:33.699572 0.000000 tcp 10.0.2.105 56428 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:35.835165 3.001525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 14:54:39.698241 3.004285 tcp 10.0.2.105 56429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:42.843097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:54:48.701010 0.000000 tcp 10.0.2.105 56429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:54:50.843702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:54:53.267623 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:54:54.699907 3.004193 tcp 10.0.2.105 56430 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:55:03.702910 0.000000 tcp 10.0.2.105 56430 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:55:06.847339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 14:55:09.701554 3.003920 tcp 10.0.2.105 56431 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:55:17.271906 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 14:55:18.703988 0.000000 tcp 10.0.2.105 56431 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 14:55:38.853501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:00:24.704491 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:00:24.704601 2.993634 tcp 10.0.2.105 56432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:00:33.707333 0.000000 tcp 10.0.2.105 56432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:00:39.707207 0.060989 tcp 10.0.2.105 56433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:39.768468 0.059788 tcp 10.0.2.105 56434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:39.828544 0.153240 tcp 10.0.2.105 56435 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:39.999805 3.000740 tcp 10.0.2.105 56436 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:00:48.998860 0.000000 tcp 10.0.2.105 56436 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:00:54.998444 0.059627 tcp 10.0.2.105 56437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:55.058428 0.062959 tcp 10.0.2.105 56438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:55.121662 0.156467 tcp 10.0.2.105 56439 -> 195.113.214.249 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:00:55.313730 2.998945 tcp 10.0.2.105 56440 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:04.310711 0.000000 tcp 10.0.2.105 56440 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:10.310415 0.060087 tcp 10.0.2.105 56441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:10.370775 0.060869 tcp 10.0.2.105 56442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:10.431871 0.149015 tcp 10.0.2.105 56443 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:10.618702 3.005751 tcp 10.0.2.105 56444 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:19.623115 0.000000 tcp 10.0.2.105 56444 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:25.615312 0.065545 tcp 10.0.2.105 56445 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:25.681114 0.061967 tcp 10.0.2.105 56446 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:25.743346 0.151574 tcp 10.0.2.105 56447 -> 195.113.214.249 443 SRPA* 0 0 34 19416 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:01:26.429993 3.011425 tcp 10.0.2.105 56448 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:35.445985 0.000000 tcp 10.0.2.105 56448 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:41.434518 2.985940 tcp 10.0.2.105 56449 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:42.862984 2.997756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:01:49.275711 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:01:49.866703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:01:50.430369 0.000000 tcp 10.0.2.105 56449 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:56.426190 2.994059 tcp 10.0.2.105 56450 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:01:57.867940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:02:05.425919 0.000000 tcp 10.0.2.105 56450 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:02:11.427537 3.004115 tcp 10.0.2.105 56451 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:02:13.870965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:02:16.274756 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:02:20.430685 0.000000 tcp 10.0.2.105 56451 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:02:45.877054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:08:49.883851 3.001055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 15:08:56.890630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:09:04.891817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:09:20.895099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:09:52.901238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:10:02.265611 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:10:02.265749 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 15:10:19.631053 0.062021 tcp 10.0.2.105 56452 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:19.693380 0.060335 tcp 10.0.2.105 56453 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:19.754030 0.151314 tcp 10.0.2.105 56454 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:19.905946 0.036277 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:19.929276 0.155546 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:20.077135 0.339033 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:20.560394 0.084557 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:20.658321 0.059175 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:20.715896 0.225638 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:20.955531 0.175012 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:21.127027 0.113825 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:21.425711 0.215623 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:21.634005 0.662924 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:22.281042 0.167158 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:22.568209 0.107226 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:22.638515 0.239795 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:23.019569 0.105168 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:23.091989 0.170080 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:23.237611 0.138594 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:24.039547 0.070153 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:24.094170 0.819266 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:24.933630 0.192474 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:25.120568 0.177460 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:25.322558 0.174004 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:25.489567 0.080394 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:25.779875 0.303438 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.057463 0.126253 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.159654 0.251357 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.404568 0.128115 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.449659 3.003793 tcp 10.0.2.105 56455 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:10:26.721174 0.070577 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.772151 0.221925 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:26.990219 0.127902 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:27.159644 0.459970 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:10:35.469563 0.000000 tcp 10.0.2.105 56455 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:10:41.451334 0.061123 tcp 10.0.2.105 56456 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:41.512715 0.061491 tcp 10.0.2.105 56457 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:41.574518 0.151683 tcp 10.0.2.105 56458 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:42.027204 3.008826 tcp 10.0.2.105 56459 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:10:51.034705 0.000000 tcp 10.0.2.105 56459 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:10:57.024688 0.062460 tcp 10.0.2.105 56460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:57.087397 0.061526 tcp 10.0.2.105 56461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:57.149205 0.150398 tcp 10.0.2.105 56462 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:10:57.417511 3.004685 tcp 10.0.2.105 56463 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:06.426363 0.000000 tcp 10.0.2.105 56463 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:12.415885 0.059761 tcp 10.0.2.105 56464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:12.475924 0.064148 tcp 10.0.2.105 56465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:12.540396 0.150150 tcp 10.0.2.105 56466 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:13.002810 2.997966 tcp 10.0.2.105 56467 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:21.998875 0.000000 tcp 10.0.2.105 56467 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:27.998082 0.062382 tcp 10.0.2.105 56468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:28.060719 0.060142 tcp 10.0.2.105 56469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:28.121160 0.149159 tcp 10.0.2.105 56470 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:11:28.691212 3.001829 tcp 10.0.2.105 56471 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:37.691918 0.000000 tcp 10.0.2.105 56471 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:43.690381 3.004162 tcp 10.0.2.105 56472 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:52.693023 0.000000 tcp 10.0.2.105 56472 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:11:57.269556 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:11:58.692306 3.003808 tcp 10.0.2.105 56473 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:12:07.695541 0.000000 tcp 10.0.2.105 56473 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:12:13.693831 2.993901 tcp 10.0.2.105 56474 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:12:21.274523 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:12:22.696215 0.000000 tcp 10.0.2.105 56474 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:16:01.915517 2.999848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:16:08.921708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:16:16.923205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:16:32.926020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:17:04.932214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:17:28.697190 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:17:28.697294 2.993417 tcp 10.0.2.105 56475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:17:37.689216 0.000000 tcp 10.0.2.105 56475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:17:43.701368 0.063536 tcp 10.0.2.105 56476 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:43.765246 0.065474 tcp 10.0.2.105 56477 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:43.831106 0.147408 tcp 10.0.2.105 56478 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:44.201276 3.001728 tcp 10.0.2.105 56479 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:17:53.201532 0.000000 tcp 10.0.2.105 56479 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:17:59.200565 0.063795 tcp 10.0.2.105 56480 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:59.264661 0.063760 tcp 10.0.2.105 56481 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:59.328771 0.151332 tcp 10.0.2.105 56482 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:17:59.668118 3.007076 tcp 10.0.2.105 56483 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:08.673825 0.000000 tcp 10.0.2.105 56483 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:14.663151 0.059728 tcp 10.0.2.105 56484 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:14.723143 0.062770 tcp 10.0.2.105 56485 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:14.786202 0.148766 tcp 10.0.2.105 56486 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:15.015928 3.001520 tcp 10.0.2.105 56487 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:24.030910 0.000000 tcp 10.0.2.105 56487 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:30.015422 0.063243 tcp 10.0.2.105 56488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:30.078928 0.061465 tcp 10.0.2.105 56489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:30.140670 0.151751 tcp 10.0.2.105 56490 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:18:30.689458 3.000433 tcp 10.0.2.105 56491 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:39.688786 0.000000 tcp 10.0.2.105 56491 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:45.687248 3.004596 tcp 10.0.2.105 56492 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:54.691819 0.000000 tcp 10.0.2.105 56492 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:18:59.276280 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:19:00.688764 3.004160 tcp 10.0.2.105 56493 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:19:09.691583 0.000000 tcp 10.0.2.105 56493 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:19:15.690408 3.004177 tcp 10.0.2.105 56494 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:19:23.271080 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:19:24.693154 0.000000 tcp 10.0.2.105 56494 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:23:11.942767 3.001339 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:23:18.949868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:23:26.951659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:23:42.954812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:24:14.960299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:24:30.693800 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:24:30.693952 2.993493 tcp 10.0.2.105 56495 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:24:39.696169 0.000000 tcp 10.0.2.105 56495 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:24:45.696600 0.060108 tcp 10.0.2.105 56496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:24:45.756996 0.061937 tcp 10.0.2.105 56497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:24:45.819247 0.150115 tcp 10.0.2.105 56498 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:24:45.990212 2.998820 tcp 10.0.2.105 56499 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:24:54.987721 0.000000 tcp 10.0.2.105 56499 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:00.987152 0.063273 tcp 10.0.2.105 56500 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:01.050781 0.061134 tcp 10.0.2.105 56501 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:01.112208 0.147496 tcp 10.0.2.105 56502 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:01.353265 2.998121 tcp 10.0.2.105 56503 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:10.350258 0.000000 tcp 10.0.2.105 56503 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:16.349558 0.060871 tcp 10.0.2.105 56504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:16.410749 0.061047 tcp 10.0.2.105 56505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:16.472060 0.150724 tcp 10.0.2.105 56506 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:16.634314 2.999031 tcp 10.0.2.105 56507 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:25.632103 0.000000 tcp 10.0.2.105 56507 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:31.631547 0.058997 tcp 10.0.2.105 56508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:31.690833 0.062037 tcp 10.0.2.105 56509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:31.753155 0.148025 tcp 10.0.2.105 56510 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:25:31.920435 3.005081 tcp 10.0.2.105 56511 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:40.923854 0.000000 tcp 10.0.2.105 56511 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:46.913189 3.003961 tcp 10.0.2.105 56512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:25:55.914972 0.000000 tcp 10.0.2.105 56512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:26:00.772902 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:26:01.914450 2.994240 tcp 10.0.2.105 56513 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:26:10.917053 0.000000 tcp 10.0.2.105 56513 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:26:16.915757 2.994413 tcp 10.0.2.105 56514 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:26:24.767553 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:26:25.908216 0.000000 tcp 10.0.2.105 56514 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:30:18.966415 3.001954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:30:25.974006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:30:33.975703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:30:49.980176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:31:21.984636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:31:31.923527 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:31:31.923620 2.999510 tcp 10.0.2.105 56515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:31:40.925203 0.000000 tcp 10.0.2.105 56515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:31:46.921972 0.060643 tcp 10.0.2.105 56516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:31:46.982902 0.063292 tcp 10.0.2.105 56517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:31:47.046490 0.151055 tcp 10.0.2.105 56518 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:31:47.221073 3.003926 tcp 10.0.2.105 56519 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:31:56.225424 0.000000 tcp 10.0.2.105 56519 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:02.223212 0.060451 tcp 10.0.2.105 56520 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:02.283926 0.060209 tcp 10.0.2.105 56521 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:02.344540 0.157135 tcp 10.0.2.105 56522 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:02.521056 3.005907 tcp 10.0.2.105 56523 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:11.525869 0.000000 tcp 10.0.2.105 56523 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:17.514986 0.063449 tcp 10.0.2.105 56524 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:17.578738 0.061190 tcp 10.0.2.105 56525 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:17.640194 0.147201 tcp 10.0.2.105 56526 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:17.861031 2.988078 tcp 10.0.2.105 56527 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:26.847588 0.000000 tcp 10.0.2.105 56527 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:32.856200 0.059911 tcp 10.0.2.105 56528 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:32.916388 0.069654 tcp 10.0.2.105 56529 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:32.986347 0.150407 tcp 10.0.2.105 56530 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:32:33.178825 3.002345 tcp 10.0.2.105 56531 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:42.180963 0.000000 tcp 10.0.2.105 56531 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:48.180946 3.001996 tcp 10.0.2.105 56532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:32:57.181443 0.000000 tcp 10.0.2.105 56532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:33:01.767801 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:33:03.180158 3.003949 tcp 10.0.2.105 56533 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:33:12.182994 0.000000 tcp 10.0.2.105 56533 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:33:18.181619 3.004110 tcp 10.0.2.105 56534 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:33:25.772486 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:33:27.184398 0.000000 tcp 10.0.2.105 56534 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:37:25.990426 3.003465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:37:32.998114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:37:40.999050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:37:57.002710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:38:29.008127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:40:45.675507 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:40:45.675699 0.329659 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.057788 0.039494 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.083811 0.153729 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.229750 0.084155 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.273735 0.058947 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.366872 0.225148 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.585039 0.177210 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.758617 0.092075 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:46.833355 0.212066 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.038176 0.368364 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.391922 0.172987 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.561849 0.109648 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.638634 0.168125 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.783812 0.105746 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:47.853741 0.169895 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.064110 0.081704 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.174906 0.070155 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.198711 3.004224 tcp 10.0.2.105 56535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:40:48.229672 0.210306 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.419794 0.174772 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.586794 0.069966 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.646632 0.203390 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.843847 0.172801 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:48.988565 0.499632 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:49.463265 0.124499 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:49.556609 0.245609 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:49.768601 0.128441 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:49.916739 0.071203 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:49.967786 0.464776 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:50.411703 0.212921 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:50.621932 0.115535 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/09 15:40:57.201582 0.000000 tcp 10.0.2.105 56535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:03.202551 0.060443 tcp 10.0.2.105 56536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:03.263328 0.065757 tcp 10.0.2.105 56537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:03.329397 0.150500 tcp 10.0.2.105 56538 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:03.510677 3.004459 tcp 10.0.2.105 56539 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:12.513607 0.000000 tcp 10.0.2.105 56539 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:18.502693 0.062384 tcp 10.0.2.105 56540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:18.565357 0.059913 tcp 10.0.2.105 56541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:18.625543 0.147487 tcp 10.0.2.105 56542 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:18.785609 3.001187 tcp 10.0.2.105 56543 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:27.785083 0.000000 tcp 10.0.2.105 56543 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:33.784856 0.060833 tcp 10.0.2.105 56544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:33.845987 0.060806 tcp 10.0.2.105 56545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:33.907101 0.150871 tcp 10.0.2.105 56546 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:41:34.089997 2.999059 tcp 10.0.2.105 56547 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:43.087182 0.000000 tcp 10.0.2.105 56547 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:49.085983 2.993907 tcp 10.0.2.105 56548 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:41:58.078678 0.000000 tcp 10.0.2.105 56548 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:42:02.778641 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:42:04.091022 3.001004 tcp 10.0.2.105 56549 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:42:13.092689 0.000000 tcp 10.0.2.105 56549 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:44:33.019419 2.997432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:44:40.022023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:44:48.023441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:45:04.031742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:45:36.032423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:47:19.090523 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:47:19.090702 3.004651 tcp 10.0.2.105 56550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:47:28.093439 0.000000 tcp 10.0.2.105 56550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:47:34.093633 0.063632 tcp 10.0.2.105 56551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:34.157585 0.064286 tcp 10.0.2.105 56552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:34.222216 0.152185 tcp 10.0.2.105 56553 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:34.397446 3.009586 tcp 10.0.2.105 56554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:47:43.405605 0.000000 tcp 10.0.2.105 56554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:47:49.394582 0.063623 tcp 10.0.2.105 56555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:49.458510 0.060540 tcp 10.0.2.105 56556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:49.519331 0.150320 tcp 10.0.2.105 56557 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:47:49.679913 2.998816 tcp 10.0.2.105 56558 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:47:58.677731 0.000000 tcp 10.0.2.105 56558 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:04.676621 0.061469 tcp 10.0.2.105 56559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:04.738357 0.062988 tcp 10.0.2.105 56560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:04.801591 0.148043 tcp 10.0.2.105 56561 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:04.966129 2.994574 tcp 10.0.2.105 56562 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:13.959504 0.000000 tcp 10.0.2.105 56562 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:19.968916 0.061841 tcp 10.0.2.105 56563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:20.031057 0.062636 tcp 10.0.2.105 56564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:20.093978 0.149774 tcp 10.0.2.105 56565 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:48:20.254591 2.998409 tcp 10.0.2.105 56566 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:29.251570 0.000000 tcp 10.0.2.105 56566 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:35.250394 3.004025 tcp 10.0.2.105 56567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:44.252898 0.000000 tcp 10.0.2.105 56567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:48.769435 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:48:50.251759 3.004197 tcp 10.0.2.105 56568 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:48:59.254814 0.000000 tcp 10.0.2.105 56568 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:49:05.253347 2.994307 tcp 10.0.2.105 56569 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:49:12.774549 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:49:14.255983 0.000000 tcp 10.0.2.105 56569 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:20.256777 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:54:20.256861 2.994597 tcp 10.0.2.105 56570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:29.249164 0.000000 tcp 10.0.2.105 56570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:35.259587 0.064202 tcp 10.0.2.105 56571 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:35.323999 0.061608 tcp 10.0.2.105 56572 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:35.385930 0.151689 tcp 10.0.2.105 56573 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:35.731625 3.001083 tcp 10.0.2.105 56574 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:44.735395 0.000000 tcp 10.0.2.105 56574 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:49.043505 2.998309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 15:54:50.731588 0.059129 tcp 10.0.2.105 56575 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:50.791024 0.063910 tcp 10.0.2.105 56576 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:50.855297 0.148176 tcp 10.0.2.105 56577 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:54:51.089312 3.005567 tcp 10.0.2.105 56578 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:54:56.046962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:55:00.093163 0.000000 tcp 10.0.2.105 56578 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:04.048971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:55:06.082693 0.060776 tcp 10.0.2.105 56579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:06.143718 0.066527 tcp 10.0.2.105 56580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:06.210481 0.149755 tcp 10.0.2.105 56581 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:06.463943 3.002941 tcp 10.0.2.105 56582 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:15.465404 0.000000 tcp 10.0.2.105 56582 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:20.052096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:55:21.464798 0.065427 tcp 10.0.2.105 56583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:21.530488 0.060209 tcp 10.0.2.105 56584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:21.591010 0.148663 tcp 10.0.2.105 56585 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/09 15:55:21.907209 2.991953 tcp 10.0.2.105 56586 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:30.897694 0.000000 tcp 10.0.2.105 56586 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:36.906872 2.993729 tcp 10.0.2.105 56587 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:45.899271 0.000000 tcp 10.0.2.105 56587 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:50.776118 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:55:51.907997 3.005146 tcp 10.0.2.105 56588 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:55:52.058170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 15:56:00.910167 0.000000 tcp 10.0.2.105 56588 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:56:06.909660 3.004287 tcp 10.0.2.105 56589 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 15:56:14.770966 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 15:56:15.912519 0.000000 tcp 10.0.2.105 56589 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:21.913414 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:01:21.913505 3.003081 tcp 10.0.2.105 56590 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:30.915336 0.000000 tcp 10.0.2.105 56590 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:36.917712 0.064355 tcp 10.0.2.105 56591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:36.982402 0.063708 tcp 10.0.2.105 56592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:37.046409 0.156641 tcp 10.0.2.105 56593 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:37.290394 2.998691 tcp 10.0.2.105 56594 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:46.287357 0.000000 tcp 10.0.2.105 56594 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:52.288067 0.059001 tcp 10.0.2.105 56595 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:52.347341 0.061415 tcp 10.0.2.105 56596 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:52.409018 0.150629 tcp 10.0.2.105 56597 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:01:52.744506 2.996765 tcp 10.0.2.105 56598 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:01:56.064220 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:02:01.740006 0.000000 tcp 10.0.2.105 56598 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:03.071538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:02:07.738705 0.062370 tcp 10.0.2.105 56599 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:07.801332 0.059988 tcp 10.0.2.105 56600 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:07.861617 0.145250 tcp 10.0.2.105 56601 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:08.021133 3.001928 tcp 10.0.2.105 56602 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:11.073105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:02:17.021627 0.000000 tcp 10.0.2.105 56602 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:23.021119 0.062885 tcp 10.0.2.105 56603 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:23.084300 0.061252 tcp 10.0.2.105 56604 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:23.145869 0.147574 tcp 10.0.2.105 56605 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:02:23.391849 3.005069 tcp 10.0.2.105 56606 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:27.076966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:02:32.393665 0.000000 tcp 10.0.2.105 56606 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:38.392621 3.004095 tcp 10.0.2.105 56607 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:47.395190 0.000000 tcp 10.0.2.105 56607 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:52.275166 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:02:53.395601 2.992909 tcp 10.0.2.105 56608 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:02:59.082274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:03:02.396710 0.000000 tcp 10.0.2.105 56608 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:03:08.395630 2.993939 tcp 10.0.2.105 56609 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:03:16.267247 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:03:17.388220 0.000000 tcp 10.0.2.105 56609 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:08:23.402638 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:08:23.402786 2.999848 tcp 10.0.2.105 56610 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:08:32.403771 0.000000 tcp 10.0.2.105 56610 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:08:38.401233 0.060562 tcp 10.0.2.105 56611 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:08:38.462048 0.061258 tcp 10.0.2.105 56612 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:08:38.523574 0.155881 tcp 10.0.2.105 56613 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:08:39.029718 3.005448 tcp 10.0.2.105 56614 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:08:48.035934 0.000000 tcp 10.0.2.105 56614 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:09:07.094026 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:09:14.101138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:09:22.105858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:09:38.106735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:10:10.111874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:11:01.205971 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:11:01.206167 0.148767 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:19.322245 0.061778 tcp 10.0.2.105 56615 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:11:19.384438 0.064072 tcp 10.0.2.105 56616 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:11:19.448838 0.148998 tcp 10.0.2.105 56617 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:11:19.598522 1.492740 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:21.531497 0.040533 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:21.558906 0.088484 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:21.773747 0.059429 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:21.831748 0.225524 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:22.050649 0.175975 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:22.337491 0.097455 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:22.417369 0.213758 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:22.622895 0.743540 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:23.327443 0.210623 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:23.534756 0.107661 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:23.802184 0.167200 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:23.947199 0.114030 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:24.285535 0.181673 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:24.574058 0.082377 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:24.655978 0.070832 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:24.767430 0.068220 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:24.826160 0.198691 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:25.018221 0.173213 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:25.251925 0.185553 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:25.416389 0.174501 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:25.582687 0.465920 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.025063 0.135949 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.232562 0.255375 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.453562 0.128043 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.618465 0.074545 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.671957 0.115721 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:26.924361 0.443052 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:11:27.344395 0.501139 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:13:54.030226 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:13:54.030389 2.992759 tcp 10.0.2.105 56618 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:03.026697 0.000000 tcp 10.0.2.105 56618 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:09.026903 0.064953 tcp 10.0.2.105 56619 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:09.092131 0.061258 tcp 10.0.2.105 56620 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:09.153676 0.153072 tcp 10.0.2.105 56621 -> 195.113.214.249 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:09.482544 2.997942 tcp 10.0.2.105 56622 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:18.478913 0.000000 tcp 10.0.2.105 56622 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:24.477997 0.060643 tcp 10.0.2.105 56623 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:24.538948 0.062060 tcp 10.0.2.105 56624 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:24.601279 0.150205 tcp 10.0.2.105 56625 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:25.188448 3.004264 tcp 10.0.2.105 56626 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:34.193528 0.000000 tcp 10.0.2.105 56626 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:40.190515 0.112974 tcp 10.0.2.105 56627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:40.303810 0.061282 tcp 10.0.2.105 56628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:40.365389 0.147977 tcp 10.0.2.105 56629 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:40.593847 3.001100 tcp 10.0.2.105 56630 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:49.593601 0.000000 tcp 10.0.2.105 56630 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:14:55.592850 0.061731 tcp 10.0.2.105 56631 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:55.654836 0.063471 tcp 10.0.2.105 56632 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:55.718586 0.146308 tcp 10.0.2.105 56633 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:14:56.058847 3.008463 tcp 10.0.2.105 56634 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:05.075696 0.000000 tcp 10.0.2.105 56634 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:11.054667 2.993934 tcp 10.0.2.105 56635 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:20.047225 0.000000 tcp 10.0.2.105 56635 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:24.774008 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:15:26.056391 3.038082 tcp 10.0.2.105 56636 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:35.056949 0.000000 tcp 10.0.2.105 56636 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:41.067714 3.004207 tcp 10.0.2.105 56637 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:15:48.768788 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:15:50.070524 0.000000 tcp 10.0.2.105 56637 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:16:16.120941 3.001626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:16:23.128379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:16:31.129458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:16:47.132007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:17:19.139022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:20:56.071241 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:20:56.071348 3.003493 tcp 10.0.2.105 56638 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:05.073417 0.000000 tcp 10.0.2.105 56638 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:11.073772 0.060800 tcp 10.0.2.105 56639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:11.134908 0.060968 tcp 10.0.2.105 56640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:11.196146 0.148034 tcp 10.0.2.105 56641 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:11.520965 3.006241 tcp 10.0.2.105 56642 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:20.525473 0.000000 tcp 10.0.2.105 56642 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:26.514456 0.060207 tcp 10.0.2.105 56643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:26.574955 0.064379 tcp 10.0.2.105 56644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:26.639623 0.149482 tcp 10.0.2.105 56645 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:26.878348 3.000770 tcp 10.0.2.105 56646 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:35.877760 0.000000 tcp 10.0.2.105 56646 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:41.876779 0.060615 tcp 10.0.2.105 56647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:41.937680 0.061449 tcp 10.0.2.105 56648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:41.999446 0.152430 tcp 10.0.2.105 56649 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:42.170787 3.000352 tcp 10.0.2.105 56650 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:51.169969 0.000000 tcp 10.0.2.105 56650 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:21:57.168696 0.064097 tcp 10.0.2.105 56651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:57.233062 0.060083 tcp 10.0.2.105 56652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:57.293511 0.153877 tcp 10.0.2.105 56653 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:21:57.480118 3.003082 tcp 10.0.2.105 56654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:06.481655 0.000000 tcp 10.0.2.105 56654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:12.480478 3.004395 tcp 10.0.2.105 56655 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:21.483446 0.000000 tcp 10.0.2.105 56655 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:26.269849 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:22:27.482012 3.004381 tcp 10.0.2.105 56656 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:36.484939 0.000000 tcp 10.0.2.105 56656 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:42.488207 2.991115 tcp 10.0.2.105 56657 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:22:50.274147 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:22:51.486550 0.000000 tcp 10.0.2.105 56657 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:23:25.147781 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:23:32.154877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:23:40.156016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:23:56.159328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:24:28.165646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:27:57.487048 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:27:57.487146 2.993496 tcp 10.0.2.105 56658 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:06.479305 0.000000 tcp 10.0.2.105 56658 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:12.489804 0.062359 tcp 10.0.2.105 56659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:12.552447 0.062813 tcp 10.0.2.105 56660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:12.615532 0.158377 tcp 10.0.2.105 56661 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:12.827880 3.005138 tcp 10.0.2.105 56662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:21.831423 0.000000 tcp 10.0.2.105 56662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:27.821001 0.063161 tcp 10.0.2.105 56663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:27.884438 0.063196 tcp 10.0.2.105 56664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:27.947925 0.155425 tcp 10.0.2.105 56665 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:28.242190 3.002941 tcp 10.0.2.105 56666 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:37.243773 0.000000 tcp 10.0.2.105 56666 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:43.243238 0.060700 tcp 10.0.2.105 56667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:43.304248 0.063383 tcp 10.0.2.105 56668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:43.367878 0.153303 tcp 10.0.2.105 56669 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:43.625245 3.001644 tcp 10.0.2.105 56670 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:52.625751 0.000000 tcp 10.0.2.105 56670 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:28:58.624923 0.060954 tcp 10.0.2.105 56671 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:58.686199 0.061281 tcp 10.0.2.105 56672 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:58.747764 0.146143 tcp 10.0.2.105 56673 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:28:58.948592 3.000670 tcp 10.0.2.105 56674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:07.947292 0.000000 tcp 10.0.2.105 56674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:13.945950 2.994605 tcp 10.0.2.105 56675 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:22.939357 0.000000 tcp 10.0.2.105 56675 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:27.766116 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:29:28.948393 3.004268 tcp 10.0.2.105 56676 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:37.950983 0.000000 tcp 10.0.2.105 56676 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:43.949501 3.006233 tcp 10.0.2.105 56677 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:29:51.770811 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:29:52.952285 0.000000 tcp 10.0.2.105 56677 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:30:32.171464 3.005776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:30:39.183542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:30:47.180745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:31:03.183411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:31:35.189716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:34:58.952964 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:34:58.953072 3.003491 tcp 10.0.2.105 56678 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:07.954920 0.000000 tcp 10.0.2.105 56678 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:13.956591 0.061169 tcp 10.0.2.105 56679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:14.018085 0.061706 tcp 10.0.2.105 56680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:14.080108 0.149808 tcp 10.0.2.105 56681 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:14.365925 2.993618 tcp 10.0.2.105 56682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:23.357519 0.000000 tcp 10.0.2.105 56682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:29.368175 0.060745 tcp 10.0.2.105 56683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:29.429119 0.185847 tcp 10.0.2.105 56684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:29.615376 0.152674 tcp 10.0.2.105 56685 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:30.475900 2.996113 tcp 10.0.2.105 56686 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:39.472698 0.000000 tcp 10.0.2.105 56686 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:45.469998 0.063655 tcp 10.0.2.105 56687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:45.533907 0.062402 tcp 10.0.2.105 56688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:45.596608 0.151786 tcp 10.0.2.105 56689 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:35:45.765038 2.998890 tcp 10.0.2.105 56690 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:35:54.762556 0.000000 tcp 10.0.2.105 56690 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:00.762084 0.059523 tcp 10.0.2.105 56691 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:36:00.821900 0.062133 tcp 10.0.2.105 56692 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:36:00.884372 0.151220 tcp 10.0.2.105 56693 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:36:01.060705 3.005467 tcp 10.0.2.105 56694 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:10.064830 0.000000 tcp 10.0.2.105 56694 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:16.053510 3.004013 tcp 10.0.2.105 56695 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:25.066012 0.000000 tcp 10.0.2.105 56695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:29.773109 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:36:31.055057 2.993958 tcp 10.0.2.105 56696 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:40.047529 0.000000 tcp 10.0.2.105 56696 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:46.056378 2.994001 tcp 10.0.2.105 56697 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:36:53.767635 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:36:55.049413 0.000000 tcp 10.0.2.105 56697 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:37:39.195659 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:37:46.202636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:37:54.204074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:38:10.207318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:38:42.213454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:41:36.223997 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:41:36.224095 0.157358 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:36.371543 0.084669 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:36.528548 0.060247 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:36.641185 0.228319 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:36.861781 0.353545 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:37.325110 0.039466 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:37.357364 0.175043 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:37.529999 0.087764 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:37.737704 0.214852 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:37.945057 0.110388 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:38.022038 0.170740 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:38.227106 0.109314 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:38.295489 0.722754 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.002316 0.176500 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.299922 0.292840 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.683904 0.076713 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.816521 0.072196 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.873234 0.068509 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:39.981394 0.196838 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.172494 0.173666 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.317891 0.209631 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.507536 0.130387 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.594133 0.249931 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.807833 0.174192 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:40.974940 0.303067 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:41.249377 0.127028 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:41.438055 0.070292 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:41.486845 0.115984 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:41.604996 0.436509 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:41:42.018269 0.491315 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/09 16:42:01.064583 2.998939 tcp 10.0.2.105 56698 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:05.766290 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:42:10.062315 0.000000 tcp 10.0.2.105 56698 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:16.066069 0.062144 tcp 10.0.2.105 56699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:16.128527 0.060753 tcp 10.0.2.105 56700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:16.189536 0.147785 tcp 10.0.2.105 56701 -> 195.113.214.249 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:16.406664 2.998964 tcp 10.0.2.105 56702 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:25.406729 0.000000 tcp 10.0.2.105 56702 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:31.393854 0.061001 tcp 10.0.2.105 56703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:31.455183 0.064958 tcp 10.0.2.105 56704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:31.520516 0.146416 tcp 10.0.2.105 56705 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:32.025048 2.992682 tcp 10.0.2.105 56706 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:41.026627 0.000000 tcp 10.0.2.105 56706 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:47.025810 0.060835 tcp 10.0.2.105 56707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:47.086928 0.063043 tcp 10.0.2.105 56708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:47.150304 0.147421 tcp 10.0.2.105 56709 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:42:47.342584 2.997554 tcp 10.0.2.105 56710 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:42:56.339052 0.000000 tcp 10.0.2.105 56710 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:02.337947 0.060679 tcp 10.0.2.105 56711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:43:02.398977 0.060597 tcp 10.0.2.105 56712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:43:02.459868 0.153208 tcp 10.0.2.105 56713 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:43:02.660733 3.001547 tcp 10.0.2.105 56714 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:11.661082 0.000000 tcp 10.0.2.105 56714 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:17.659715 3.003941 tcp 10.0.2.105 56715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:26.663059 0.000000 tcp 10.0.2.105 56715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:31.268893 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:43:32.664734 3.000510 tcp 10.0.2.105 56716 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:41.664089 0.000000 tcp 10.0.2.105 56716 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:47.662726 3.004295 tcp 10.0.2.105 56717 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:43:55.274818 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:43:56.665620 0.000000 tcp 10.0.2.105 56717 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:44:46.222289 2.999617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:44:53.227868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:45:01.230747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:45:17.231157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:45:49.237279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:49:02.670597 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:49:02.670738 2.989054 tcp 10.0.2.105 56718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:11.658250 0.000000 tcp 10.0.2.105 56718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:17.668957 0.060990 tcp 10.0.2.105 56719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:17.730216 0.061336 tcp 10.0.2.105 56720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:17.791828 0.147588 tcp 10.0.2.105 56721 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:18.121032 3.000843 tcp 10.0.2.105 56722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:27.120781 0.000000 tcp 10.0.2.105 56722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:33.119865 0.060564 tcp 10.0.2.105 56723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:33.180692 0.064917 tcp 10.0.2.105 56724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:33.245969 0.148257 tcp 10.0.2.105 56725 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:33.415244 2.998499 tcp 10.0.2.105 56726 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:42.413046 0.000000 tcp 10.0.2.105 56726 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:48.412012 0.061117 tcp 10.0.2.105 56727 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:48.473377 0.065146 tcp 10.0.2.105 56728 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:48.538817 0.151648 tcp 10.0.2.105 56729 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:49:48.715397 3.000713 tcp 10.0.2.105 56730 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:49:57.714414 0.000000 tcp 10.0.2.105 56730 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:03.713853 0.060362 tcp 10.0.2.105 56731 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:50:03.774477 0.063655 tcp 10.0.2.105 56732 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:50:03.838425 0.152637 tcp 10.0.2.105 56733 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:50:04.025866 2.992076 tcp 10.0.2.105 56734 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:13.026774 0.000000 tcp 10.0.2.105 56734 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:19.025480 2.993826 tcp 10.0.2.105 56735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:28.018116 0.000000 tcp 10.0.2.105 56735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:32.775254 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:50:34.026895 2.993566 tcp 10.0.2.105 56736 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:43.019108 0.000000 tcp 10.0.2.105 56736 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:49.028361 3.004742 tcp 10.0.2.105 56737 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:50:56.769424 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:50:58.031531 0.000000 tcp 10.0.2.105 56737 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:51:53.242587 3.002410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:52:00.250548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:52:08.252558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:52:24.255245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:52:56.261513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:56:04.032003 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:56:04.032190 3.003296 tcp 10.0.2.105 56738 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:13.034098 0.000000 tcp 10.0.2.105 56738 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:19.034830 0.064452 tcp 10.0.2.105 56739 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:19.099537 0.061405 tcp 10.0.2.105 56740 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:19.161277 0.152428 tcp 10.0.2.105 56741 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:19.326586 3.001191 tcp 10.0.2.105 56742 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:28.336679 0.000000 tcp 10.0.2.105 56742 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:34.325730 0.062745 tcp 10.0.2.105 56743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:34.388752 0.064429 tcp 10.0.2.105 56744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:34.453534 0.157311 tcp 10.0.2.105 56745 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:34.631315 2.998575 tcp 10.0.2.105 56746 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:43.628355 0.000000 tcp 10.0.2.105 56746 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:49.627599 0.061056 tcp 10.0.2.105 56747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:49.688943 0.064894 tcp 10.0.2.105 56748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:49.754189 0.150813 tcp 10.0.2.105 56749 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:56:50.014597 2.997205 tcp 10.0.2.105 56750 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:56:59.010342 0.000000 tcp 10.0.2.105 56750 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:05.009688 0.059795 tcp 10.0.2.105 56751 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:57:05.069754 0.059563 tcp 10.0.2.105 56752 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:57:05.129576 0.152104 tcp 10.0.2.105 56753 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/09 16:57:05.383567 3.000182 tcp 10.0.2.105 56754 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:14.382525 0.000000 tcp 10.0.2.105 56754 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:20.381389 3.003839 tcp 10.0.2.105 56755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:29.383836 0.000000 tcp 10.0.2.105 56755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:34.271195 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:57:35.382770 3.004159 tcp 10.0.2.105 56756 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:44.387818 0.000000 tcp 10.0.2.105 56756 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:50.391389 2.987083 tcp 10.0.2.105 56757 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:57:58.277018 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 16:57:59.389410 0.000000 tcp 10.0.2.105 56757 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 16:59:00.267201 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 16:59:07.274854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:59:15.276193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 16:59:31.279390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:00:03.293725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:03:05.387918 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:03:05.388097 3.003281 tcp 10.0.2.105 56758 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:14.390056 0.000000 tcp 10.0.2.105 56758 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:20.390812 0.060343 tcp 10.0.2.105 56759 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:20.451420 0.061169 tcp 10.0.2.105 56760 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:20.512926 0.153614 tcp 10.0.2.105 56761 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:20.738073 2.995186 tcp 10.0.2.105 56762 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:29.732808 0.000000 tcp 10.0.2.105 56762 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:35.731545 0.060969 tcp 10.0.2.105 56763 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:35.792787 0.061011 tcp 10.0.2.105 56764 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:35.854052 0.151131 tcp 10.0.2.105 56765 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:36.024575 3.000523 tcp 10.0.2.105 56766 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:45.023939 0.000000 tcp 10.0.2.105 56766 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:03:51.026748 0.058111 tcp 10.0.2.105 56767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:51.085147 0.064545 tcp 10.0.2.105 56768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:51.150000 0.149939 tcp 10.0.2.105 56769 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:03:51.627380 2.990650 tcp 10.0.2.105 56770 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:00.626652 0.000000 tcp 10.0.2.105 56770 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:06.625849 0.059929 tcp 10.0.2.105 56771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:04:06.686140 0.062934 tcp 10.0.2.105 56772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:04:06.749424 0.147873 tcp 10.0.2.105 56773 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:04:07.309284 3.000922 tcp 10.0.2.105 56774 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:16.312717 0.000000 tcp 10.0.2.105 56774 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:22.308015 3.003879 tcp 10.0.2.105 56775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:30.269299 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:04:31.310849 0.000000 tcp 10.0.2.105 56775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:37.309904 3.003507 tcp 10.0.2.105 56776 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:46.312357 0.000000 tcp 10.0.2.105 56776 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:52.310926 3.004104 tcp 10.0.2.105 56777 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:04:57.268108 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:05:01.313726 0.000000 tcp 10.0.2.105 56777 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:06:30.305583 3.000679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:06:37.312926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:06:45.313209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:07:01.316211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:07:33.323579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:11:56.330889 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:11:56.331051 0.060845 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:56.443157 0.226441 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:56.661520 0.354967 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.180995 0.154276 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.327726 0.083807 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.431574 0.038223 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.456548 0.266465 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.719611 0.087544 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:57.860926 0.213600 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:58.065483 0.106812 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:58.294373 0.169049 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:58.438612 0.104054 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:58.524704 0.532824 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.042963 0.174822 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.334290 0.171331 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.539424 0.157997 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.717029 0.071685 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.773771 0.070172 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:11:59.834186 0.195959 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.061975 0.132610 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.146503 0.255563 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.369022 0.173108 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.549499 0.193070 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 1954 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.754229 0.224207 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2588 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:00.956254 0.280098 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:01.212508 0.128754 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:01.419884 0.075481 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:01.473889 0.128125 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:01.853808 0.457472 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:02.288733 0.221309 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:12:07.326731 2.993988 tcp 10.0.2.105 56778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:16.319200 0.000000 tcp 10.0.2.105 56778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:21.266194 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:12:22.329538 0.062060 tcp 10.0.2.105 56779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:22.391826 0.061829 tcp 10.0.2.105 56780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:22.453974 0.145783 tcp 10.0.2.105 56781 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:22.818045 3.006097 tcp 10.0.2.105 56782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:31.824400 0.000000 tcp 10.0.2.105 56782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:37.811323 0.059699 tcp 10.0.2.105 56783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:37.871310 0.067624 tcp 10.0.2.105 56784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:37.939255 0.153802 tcp 10.0.2.105 56785 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:38.230095 3.005042 tcp 10.0.2.105 56786 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:47.237457 0.000000 tcp 10.0.2.105 56786 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:12:53.222915 0.060504 tcp 10.0.2.105 56787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:53.283735 0.060924 tcp 10.0.2.105 56788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:53.344964 0.148310 tcp 10.0.2.105 56789 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:12:53.607363 3.002321 tcp 10.0.2.105 56790 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:02.619476 0.000000 tcp 10.0.2.105 56790 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:08.604923 0.059978 tcp 10.0.2.105 56791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:13:08.665170 0.062275 tcp 10.0.2.105 56792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:13:08.727733 0.151313 tcp 10.0.2.105 56793 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:13:09.089763 2.999635 tcp 10.0.2.105 56794 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:18.088518 0.000000 tcp 10.0.2.105 56794 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:24.087043 2.993254 tcp 10.0.2.105 56795 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:33.082371 0.000000 tcp 10.0.2.105 56795 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:37.766555 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:13:39.088622 3.003970 tcp 10.0.2.105 56796 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:43.337144 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:13:48.091002 0.000000 tcp 10.0.2.105 56796 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:50.345744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:13:54.095613 2.998395 tcp 10.0.2.105 56797 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:13:58.356039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:14:01.771000 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:14:03.092781 0.000000 tcp 10.0.2.105 56797 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:14:14.359078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:14:46.365491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:19:09.093407 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:19:09.093581 3.003498 tcp 10.0.2.105 56798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:18.095711 0.000000 tcp 10.0.2.105 56798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:24.095760 0.065470 tcp 10.0.2.105 56799 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:24.161522 0.061728 tcp 10.0.2.105 56800 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:24.223534 0.149455 tcp 10.0.2.105 56801 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:24.942744 2.997142 tcp 10.0.2.105 56802 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:33.938164 0.000000 tcp 10.0.2.105 56802 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:39.937733 0.060060 tcp 10.0.2.105 56803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:39.998087 0.063858 tcp 10.0.2.105 56804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:40.062205 0.147507 tcp 10.0.2.105 56805 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:40.325091 2.996764 tcp 10.0.2.105 56806 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:49.320225 0.000000 tcp 10.0.2.105 56806 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:19:55.319489 0.060394 tcp 10.0.2.105 56807 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:55.380162 0.061658 tcp 10.0.2.105 56808 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:55.442116 0.151094 tcp 10.0.2.105 56809 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:19:56.435095 2.999678 tcp 10.0.2.105 56810 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:05.434988 0.000000 tcp 10.0.2.105 56810 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:11.432977 0.061800 tcp 10.0.2.105 56811 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:20:11.495056 0.060373 tcp 10.0.2.105 56812 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:20:11.555722 0.150425 tcp 10.0.2.105 56813 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:20:11.776550 3.000332 tcp 10.0.2.105 56814 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:20.785664 0.000000 tcp 10.0.2.105 56814 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:26.774246 2.994600 tcp 10.0.2.105 56815 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:35.777115 0.000000 tcp 10.0.2.105 56815 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:40.775016 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:20:41.776169 2.993963 tcp 10.0.2.105 56816 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:50.768751 0.000000 tcp 10.0.2.105 56816 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:52.374216 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:20:56.777564 3.004321 tcp 10.0.2.105 56817 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:20:59.381348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:21:04.768773 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:21:05.780062 0.000000 tcp 10.0.2.105 56817 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:21:07.383139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:21:23.386646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:21:55.391610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:26:11.780639 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:26:11.780816 3.003868 tcp 10.0.2.105 56818 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:20.783479 0.000000 tcp 10.0.2.105 56818 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:26.783524 0.062178 tcp 10.0.2.105 56819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:26.845976 0.062734 tcp 10.0.2.105 56820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:26.908979 0.147843 tcp 10.0.2.105 56821 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:27.081965 3.004788 tcp 10.0.2.105 56822 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:36.085336 0.000000 tcp 10.0.2.105 56822 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:42.074138 0.060098 tcp 10.0.2.105 56823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:42.134532 0.065225 tcp 10.0.2.105 56824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:42.200102 0.148402 tcp 10.0.2.105 56825 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:42.431794 2.986960 tcp 10.0.2.105 56826 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:51.427318 0.000000 tcp 10.0.2.105 56826 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:26:57.426618 0.064046 tcp 10.0.2.105 56827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:57.490940 0.060545 tcp 10.0.2.105 56828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:57.551752 0.153631 tcp 10.0.2.105 56829 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:26:57.730060 3.000998 tcp 10.0.2.105 56830 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:06.729752 0.000000 tcp 10.0.2.105 56830 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:12.728514 0.063385 tcp 10.0.2.105 56831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:27:12.792186 0.061933 tcp 10.0.2.105 56832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:27:12.854390 0.147753 tcp 10.0.2.105 56833 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:27:13.015221 2.997655 tcp 10.0.2.105 56834 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:22.011414 0.000000 tcp 10.0.2.105 56834 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:28.010181 3.004425 tcp 10.0.2.105 56835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:37.013215 0.000000 tcp 10.0.2.105 56835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:41.769984 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:27:43.011851 3.004369 tcp 10.0.2.105 56836 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:52.015734 0.000000 tcp 10.0.2.105 56836 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:58.013480 3.003370 tcp 10.0.2.105 56837 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:27:59.398554 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:28:05.774015 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:28:06.405380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:28:07.026270 0.000000 tcp 10.0.2.105 56837 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:28:14.406740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:28:30.410034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:29:02.415840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:33:13.016425 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:33:13.016567 2.993894 tcp 10.0.2.105 56838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:22.009753 0.000000 tcp 10.0.2.105 56838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:28.032358 0.060437 tcp 10.0.2.105 56839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:28.093130 0.059668 tcp 10.0.2.105 56840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:28.153102 0.150589 tcp 10.0.2.105 56841 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:28.622176 2.990638 tcp 10.0.2.105 56842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:37.611443 0.000000 tcp 10.0.2.105 56842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:43.610871 0.059833 tcp 10.0.2.105 56843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:43.671073 0.063944 tcp 10.0.2.105 56844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:43.735239 0.147998 tcp 10.0.2.105 56845 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:44.147550 3.007567 tcp 10.0.2.105 56846 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:53.153843 0.000000 tcp 10.0.2.105 56846 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:33:59.143105 0.063306 tcp 10.0.2.105 56847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:59.206725 0.061571 tcp 10.0.2.105 56848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:59.268613 0.154422 tcp 10.0.2.105 56849 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:33:59.441710 3.005506 tcp 10.0.2.105 56850 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:08.456076 0.000000 tcp 10.0.2.105 56850 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:14.437115 0.060589 tcp 10.0.2.105 56851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:34:14.497976 0.062520 tcp 10.0.2.105 56852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:34:14.560763 0.154327 tcp 10.0.2.105 56853 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:34:14.948863 3.000989 tcp 10.0.2.105 56854 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:23.947887 0.000000 tcp 10.0.2.105 56854 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:29.946839 2.994149 tcp 10.0.2.105 56855 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:38.939570 0.000000 tcp 10.0.2.105 56855 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:43.766549 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:34:44.948202 3.004625 tcp 10.0.2.105 56856 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:53.951275 0.000000 tcp 10.0.2.105 56856 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:34:59.950028 3.004155 tcp 10.0.2.105 56857 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:35:06.422019 3.001600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:35:07.770872 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:35:08.953213 0.000000 tcp 10.0.2.105 56857 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:35:13.429337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:35:21.430684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:35:37.433662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:36:09.440129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:42:13.453244 3.005483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 17:42:15.967038 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:42:15.967166 0.059791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.025806 0.228265 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.246423 0.372666 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.625033 0.153597 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.771463 0.088431 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.918147 0.039887 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:16.949745 0.176064 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:17.121761 0.091605 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:17.786259 0.211318 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:17.990318 0.107681 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:18.210724 0.104544 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:18.284848 0.171014 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:18.433715 0.689599 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.108063 0.173756 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.286059 0.169650 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.625823 0.066208 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.769212 0.074049 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.829463 0.129985 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:19.921256 0.258875 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:20.453214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:42:20.536512 0.174036 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:21.682779 0.069541 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:22.554055 0.204481 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:22.753674 0.174028 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.063401 0.187309 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.229688 0.236348 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.442709 0.126899 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.606407 0.072033 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.815910 0.115676 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:23.982197 0.524629 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:24.478025 0.220431 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/09 17:42:28.454728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:42:29.967230 3.003901 tcp 10.0.2.105 56858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:42:38.969145 0.000000 tcp 10.0.2.105 56858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:42:43.766816 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:42:44.457614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:42:44.970343 0.061225 tcp 10.0.2.105 56859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:42:45.031907 0.059884 tcp 10.0.2.105 56860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:42:45.092102 0.148313 tcp 10.0.2.105 56861 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:42:45.270340 3.002767 tcp 10.0.2.105 56862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:42:54.274528 0.000000 tcp 10.0.2.105 56862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:00.271398 0.059751 tcp 10.0.2.105 56863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:00.331008 0.061099 tcp 10.0.2.105 56864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:00.392408 0.146236 tcp 10.0.2.105 56865 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:01.083644 3.002063 tcp 10.0.2.105 56866 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:10.084760 0.000000 tcp 10.0.2.105 56866 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:16.085201 0.063281 tcp 10.0.2.105 56867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:16.148768 0.061875 tcp 10.0.2.105 56868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:16.211008 0.155813 tcp 10.0.2.105 56869 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:16.377365 2.981788 tcp 10.0.2.105 56870 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:16.469862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:43:25.366841 0.000000 tcp 10.0.2.105 56870 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:31.365751 0.060768 tcp 10.0.2.105 56871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:31.426848 0.059945 tcp 10.0.2.105 56872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:31.487052 0.149532 tcp 10.0.2.105 56873 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:43:32.074071 2.996216 tcp 10.0.2.105 56874 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:41.439380 0.000000 tcp 10.0.2.105 56874 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:47.382514 2.973396 tcp 10.0.2.105 56875 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:43:56.305554 0.000000 tcp 10.0.2.105 56875 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:44:00.966383 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:44:02.252143 2.980460 tcp 10.0.2.105 56876 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:44:11.174966 0.000000 tcp 10.0.2.105 56876 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:44:17.111495 2.977994 tcp 10.0.2.105 56877 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:44:24.777483 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:44:26.074657 0.000000 tcp 10.0.2.105 56877 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:49:32.074105 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:49:32.074277 2.993521 tcp 10.0.2.105 56878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:49:41.076632 0.000000 tcp 10.0.2.105 56878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:49:47.076899 0.060780 tcp 10.0.2.105 56879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:49:47.137958 0.060348 tcp 10.0.2.105 56880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:49:47.198593 0.147206 tcp 10.0.2.105 56881 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:49:47.595483 2.994838 tcp 10.0.2.105 56882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:49:56.588893 0.000000 tcp 10.0.2.105 56882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:02.598209 0.059310 tcp 10.0.2.105 56883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:02.657847 0.060339 tcp 10.0.2.105 56884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:02.718494 1.547436 tcp 10.0.2.105 56885 -> 195.113.214.249 443 SRPA* 0 0 71 76896 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:05.223095 3.002650 tcp 10.0.2.105 56886 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:14.224589 0.000000 tcp 10.0.2.105 56886 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:20.223769 0.059694 tcp 10.0.2.105 56887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:20.283738 0.060413 tcp 10.0.2.105 56888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:20.344630 0.150338 tcp 10.0.2.105 56889 -> 195.113.214.249 443 SRPA* 0 0 35 17960 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:20.533950 2.993906 tcp 10.0.2.105 56890 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:29.536585 0.000000 tcp 10.0.2.105 56890 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:35.535645 0.060270 tcp 10.0.2.105 56891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:35.596354 0.061859 tcp 10.0.2.105 56892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:35.658476 0.149180 tcp 10.0.2.105 56893 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:50:35.857680 3.002144 tcp 10.0.2.105 56894 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:44.859023 0.000000 tcp 10.0.2.105 56894 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:50.856992 3.004822 tcp 10.0.2.105 56895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:50:59.859581 0.000000 tcp 10.0.2.105 56895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:51:04.766924 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:51:05.858930 3.004259 tcp 10.0.2.105 56896 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:51:14.861489 0.000000 tcp 10.0.2.105 56896 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:51:20.860395 3.003964 tcp 10.0.2.105 56897 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:51:28.771316 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:51:29.863194 0.000000 tcp 10.0.2.105 56897 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:53:36.477296 3.002367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 17:53:43.485036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:53:51.486254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:54:07.489737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:54:39.495792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 17:56:35.863636 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:56:35.863816 3.003445 tcp 10.0.2.105 56898 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:56:44.875963 0.000000 tcp 10.0.2.105 56898 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:56:50.866465 0.061579 tcp 10.0.2.105 56899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:56:50.928331 0.063713 tcp 10.0.2.105 56900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:56:50.992495 0.150043 tcp 10.0.2.105 56901 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:56:51.203518 2.995888 tcp 10.0.2.105 56902 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:00.198294 0.000000 tcp 10.0.2.105 56902 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:06.197436 0.059726 tcp 10.0.2.105 56903 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:06.257462 0.061552 tcp 10.0.2.105 56904 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:06.319288 0.152190 tcp 10.0.2.105 56905 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:06.551502 3.001247 tcp 10.0.2.105 56906 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:15.550078 0.000000 tcp 10.0.2.105 56906 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:21.549896 0.060433 tcp 10.0.2.105 56907 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:21.610598 0.060829 tcp 10.0.2.105 56908 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:21.671768 0.153638 tcp 10.0.2.105 56909 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:21.846761 2.996833 tcp 10.0.2.105 56910 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:30.841841 0.000000 tcp 10.0.2.105 56910 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:36.841642 0.060023 tcp 10.0.2.105 56911 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:36.901972 0.061094 tcp 10.0.2.105 56912 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:36.963314 0.150201 tcp 10.0.2.105 56913 -> 195.113.214.249 443 SRPA* 0 0 22 11628 flow=From-Botnet-V2-TCP-Established 1970/02/09 17:57:37.129301 3.006263 tcp 10.0.2.105 56914 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:46.133879 0.000000 tcp 10.0.2.105 56914 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:57:52.128035 3.002522 tcp 10.0.2.105 56915 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:58:01.128838 0.000000 tcp 10.0.2.105 56915 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:58:05.780597 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:58:07.129368 2.989115 tcp 10.0.2.105 56916 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:58:16.127052 0.000000 tcp 10.0.2.105 56916 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:58:22.129257 2.991116 tcp 10.0.2.105 56917 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 17:58:29.766706 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 17:58:31.118287 0.000000 tcp 10.0.2.105 56917 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:00:43.502226 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:00:50.509346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:00:58.511028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:01:14.514063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:01:46.519697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:03:37.131160 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:03:37.131343 3.001917 tcp 10.0.2.105 56918 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:03:46.131799 0.000000 tcp 10.0.2.105 56918 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:03:52.131336 0.061883 tcp 10.0.2.105 56919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:03:52.193517 0.060979 tcp 10.0.2.105 56920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:03:52.254806 0.153626 tcp 10.0.2.105 56921 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:03:53.070177 3.007260 tcp 10.0.2.105 56922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:02.074624 0.000000 tcp 10.0.2.105 56922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:08.063928 0.105326 tcp 10.0.2.105 56923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:08.169555 0.060870 tcp 10.0.2.105 56924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:08.230706 0.154398 tcp 10.0.2.105 56925 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:08.453118 2.969014 tcp 10.0.2.105 56926 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:17.416996 0.000000 tcp 10.0.2.105 56926 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:23.415755 0.064001 tcp 10.0.2.105 56927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:23.480045 0.063728 tcp 10.0.2.105 56928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:23.543607 0.154199 tcp 10.0.2.105 56929 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:23.791579 2.998554 tcp 10.0.2.105 56930 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:32.788635 0.000000 tcp 10.0.2.105 56930 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:38.788173 0.063117 tcp 10.0.2.105 56931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:38.851608 0.062316 tcp 10.0.2.105 56932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:38.914197 0.153523 tcp 10.0.2.105 56933 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:04:39.105148 2.997379 tcp 10.0.2.105 56934 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:48.101122 0.000000 tcp 10.0.2.105 56934 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:04:54.099670 3.004840 tcp 10.0.2.105 56935 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:05:03.102393 0.000000 tcp 10.0.2.105 56935 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:05:07.768956 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:05:09.101350 3.004116 tcp 10.0.2.105 56936 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:05:18.103499 0.000000 tcp 10.0.2.105 56936 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:05:24.102840 3.004222 tcp 10.0.2.105 56937 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:05:31.773167 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:05:33.105464 0.000000 tcp 10.0.2.105 56937 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:07:50.526851 3.000365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:07:57.533207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:08:05.534832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:08:21.537594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:08:53.544820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:12:50.105496 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:12:50.105603 0.061195 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:50.164618 0.223275 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:50.380423 0.346992 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:50.833274 0.155845 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:51.174163 0.086849 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:51.221935 0.040367 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:51.364150 0.176778 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:51.538594 0.476434 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:51.975137 0.093269 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:52.205090 0.213760 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:52.412085 0.390017 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:52.787106 0.106135 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:53.228249 0.171194 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:53.376943 0.173076 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:53.623793 0.168146 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:53.888943 0.085404 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:54.100506 0.069767 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:54.124786 3.005670 tcp 10.0.2.105 56938 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:12:54.344140 0.130183 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:55.714443 0.252178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:56.040550 0.216374 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:56.482790 0.176750 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:56.630121 0.186615 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:56.796945 0.069757 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:56.976039 0.198998 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:57.169029 0.241080 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:57.797609 0.127316 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:58.045470 0.073611 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:58.099055 0.115916 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:58.259503 0.475490 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:12:58.710883 0.226102 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:13:03.122268 0.000000 tcp 10.0.2.105 56938 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:09.123462 0.063239 tcp 10.0.2.105 56939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:09.186988 0.061822 tcp 10.0.2.105 56940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:09.249147 0.153565 tcp 10.0.2.105 56941 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:09.558958 3.013216 tcp 10.0.2.105 56942 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:18.564440 0.000000 tcp 10.0.2.105 56942 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:24.553905 0.061483 tcp 10.0.2.105 56943 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:24.614708 0.062249 tcp 10.0.2.105 56944 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:24.677196 0.143566 tcp 10.0.2.105 56945 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:25.082196 2.996153 tcp 10.0.2.105 56946 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:34.087141 0.000000 tcp 10.0.2.105 56946 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:41.791500 0.063871 tcp 10.0.2.105 56947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:41.855644 0.059310 tcp 10.0.2.105 56948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:41.915332 0.150410 tcp 10.0.2.105 56949 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:13:42.533646 2.965404 tcp 10.0.2.105 56950 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:51.428777 0.000000 tcp 10.0.2.105 56950 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:13:57.364906 2.975192 tcp 10.0.2.105 56951 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:14:05.223022 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:14:06.268855 0.000000 tcp 10.0.2.105 56951 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:14:12.193432 2.979242 tcp 10.0.2.105 56952 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:14:21.103093 0.000000 tcp 10.0.2.105 56952 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:14:58.400256 2.961450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:15:05.324062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:15:13.226870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:15:29.032802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:16:01.037780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:19:25.833369 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:19:25.833476 3.006037 tcp 10.0.2.105 56953 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:19:34.836186 0.000000 tcp 10.0.2.105 56953 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:19:40.836317 0.061991 tcp 10.0.2.105 56954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:40.898588 0.064232 tcp 10.0.2.105 56955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:40.963085 0.148856 tcp 10.0.2.105 56956 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:41.168575 3.000284 tcp 10.0.2.105 56957 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:19:50.167871 0.000000 tcp 10.0.2.105 56957 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:19:56.167060 0.063511 tcp 10.0.2.105 56958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:56.230921 0.062819 tcp 10.0.2.105 56959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:56.294007 0.151282 tcp 10.0.2.105 56960 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:19:58.322017 3.001724 tcp 10.0.2.105 56961 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:07.322551 0.000000 tcp 10.0.2.105 56961 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:13.321625 0.061643 tcp 10.0.2.105 56962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:13.383542 0.064886 tcp 10.0.2.105 56963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:13.448698 0.154014 tcp 10.0.2.105 56964 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:14.182675 3.004015 tcp 10.0.2.105 56965 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:23.184860 0.000000 tcp 10.0.2.105 56965 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:29.174197 0.061233 tcp 10.0.2.105 56966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:29.235735 0.060289 tcp 10.0.2.105 56967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:29.296514 0.152066 tcp 10.0.2.105 56968 -> 195.113.214.249 443 SRPA* 0 0 32 17786 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:20:33.093584 2.999557 tcp 10.0.2.105 56969 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:42.094865 0.000000 tcp 10.0.2.105 56969 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:48.091150 3.004081 tcp 10.0.2.105 56970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:20:55.772000 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:20:57.093324 0.000000 tcp 10.0.2.105 56970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:21:03.092983 3.003950 tcp 10.0.2.105 56971 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:21:12.095418 0.000000 tcp 10.0.2.105 56971 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:21:18.095186 2.993470 tcp 10.0.2.105 56972 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:21:22.770812 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:21:27.097288 0.000000 tcp 10.0.2.105 56972 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:22:05.586547 3.002483 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:22:12.592489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:22:20.594058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:22:36.597036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:23:08.613447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:26:33.097812 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:26:33.097965 3.003601 tcp 10.0.2.105 56973 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:26:42.099611 0.000000 tcp 10.0.2.105 56973 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:26:48.100110 0.060618 tcp 10.0.2.105 56974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:26:48.161002 0.061346 tcp 10.0.2.105 56975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:26:48.222702 0.151319 tcp 10.0.2.105 56976 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:26:48.384372 2.998851 tcp 10.0.2.105 56977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:26:57.381995 0.000000 tcp 10.0.2.105 56977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:03.381167 0.060892 tcp 10.0.2.105 56978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:03.442360 0.062075 tcp 10.0.2.105 56979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:03.504723 0.144846 tcp 10.0.2.105 56980 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:03.678306 3.006931 tcp 10.0.2.105 56981 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:12.683902 0.000000 tcp 10.0.2.105 56981 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:18.673290 0.063541 tcp 10.0.2.105 56982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:18.737154 0.061274 tcp 10.0.2.105 56983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:18.798810 0.149160 tcp 10.0.2.105 56984 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:18.959832 3.007149 tcp 10.0.2.105 56985 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:27.975946 0.000000 tcp 10.0.2.105 56985 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:33.955313 0.060476 tcp 10.0.2.105 56986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:34.016168 0.062820 tcp 10.0.2.105 56987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:34.079234 0.152908 tcp 10.0.2.105 56988 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:27:34.251875 2.997730 tcp 10.0.2.105 56989 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:43.247714 0.000000 tcp 10.0.2.105 56989 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:49.246797 2.994146 tcp 10.0.2.105 56990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:27:58.239627 0.000000 tcp 10.0.2.105 56990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:28:02.766038 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:28:04.247787 3.004639 tcp 10.0.2.105 56991 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:28:13.251130 0.000000 tcp 10.0.2.105 56991 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:28:19.250127 3.003716 tcp 10.0.2.105 56992 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:28:26.770524 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:28:28.252699 0.000000 tcp 10.0.2.105 56992 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:29:12.619342 3.001701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:29:19.626648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:29:27.637993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:29:43.640788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:30:15.647082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:33:34.252904 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:33:34.253068 3.003873 tcp 10.0.2.105 56993 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:33:43.255497 0.000000 tcp 10.0.2.105 56993 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:33:49.255807 0.060953 tcp 10.0.2.105 56994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:33:49.317006 0.060807 tcp 10.0.2.105 56995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:33:49.378091 0.149443 tcp 10.0.2.105 56996 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:33:49.573412 2.995584 tcp 10.0.2.105 56997 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:33:58.577648 0.000000 tcp 10.0.2.105 56997 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:04.567231 0.064255 tcp 10.0.2.105 56998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:04.631754 0.064350 tcp 10.0.2.105 56999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:04.696526 0.148403 tcp 10.0.2.105 57000 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:04.992606 2.998708 tcp 10.0.2.105 57001 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:13.989201 0.000000 tcp 10.0.2.105 57001 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:19.988771 0.096331 tcp 10.0.2.105 57002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:20.085385 0.059709 tcp 10.0.2.105 57003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:20.145376 0.149686 tcp 10.0.2.105 57004 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:20.375366 2.997970 tcp 10.0.2.105 57005 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:29.371818 0.000000 tcp 10.0.2.105 57005 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:35.373632 0.061319 tcp 10.0.2.105 57006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:35.435198 0.063476 tcp 10.0.2.105 57007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:35.499033 0.149391 tcp 10.0.2.105 57008 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:34:36.026498 3.000799 tcp 10.0.2.105 57009 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:45.030855 0.000000 tcp 10.0.2.105 57009 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:34:51.042993 2.993495 tcp 10.0.2.105 57010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:35:00.038495 0.000000 tcp 10.0.2.105 57010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:35:04.772898 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:35:06.025619 2.993207 tcp 10.0.2.105 57011 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:35:15.017191 0.000000 tcp 10.0.2.105 57011 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:35:21.026268 2.994849 tcp 10.0.2.105 57012 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:35:28.767322 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:35:30.020602 0.000000 tcp 10.0.2.105 57012 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:36:19.653996 3.000744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:36:26.660673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:36:34.662396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:36:50.665017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:37:22.671022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:40:36.049885 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:40:36.050022 3.003511 tcp 10.0.2.105 57013 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:40:45.052086 0.000000 tcp 10.0.2.105 57013 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:40:51.053054 0.061513 tcp 10.0.2.105 57014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:40:51.114815 0.069065 tcp 10.0.2.105 57015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:40:51.184139 0.178935 tcp 10.0.2.105 57016 -> 195.113.214.249 443 SRPA* 0 0 74 77686 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:40:51.602437 3.003146 tcp 10.0.2.105 57017 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:41:00.604584 0.000000 tcp 10.0.2.105 57017 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:43:03.771727 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:43:03.771823 0.383357 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:04.202863 0.062065 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:04.406690 0.225539 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:04.625010 0.241112 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:04.858868 0.087699 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:04.909059 0.037316 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.008913 0.175952 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.181218 0.104738 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.337098 0.097762 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.414706 0.111152 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.525683 0.172566 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.675215 0.216497 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:05.883656 0.815135 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:06.683638 0.174794 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:06.855503 0.169453 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.034989 0.150830 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.196393 0.069886 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.251162 0.126665 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.334930 0.172817 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.479484 0.184923 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.643362 0.686058 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.714998 0.254877 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:07.934624 0.173956 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.101615 0.200215 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.293990 0.238101 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.508965 0.127772 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.664773 0.071654 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.715809 0.103439 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:08.836445 0.437408 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:09.252833 0.221882 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/09 18:43:26.677272 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:43:33.688610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:43:41.692896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:43:57.688945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:44:29.695162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:46:06.605092 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:46:06.605204 2.993626 tcp 10.0.2.105 57018 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:15.607345 0.000000 tcp 10.0.2.105 57018 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:21.667853 0.068489 tcp 10.0.2.105 57019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:21.736686 0.064989 tcp 10.0.2.105 57020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:21.801940 0.149994 tcp 10.0.2.105 57021 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:22.169689 3.001283 tcp 10.0.2.105 57022 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:31.169092 0.000000 tcp 10.0.2.105 57022 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:37.171537 0.061599 tcp 10.0.2.105 57023 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:37.233418 0.061485 tcp 10.0.2.105 57024 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:37.295192 0.150930 tcp 10.0.2.105 57025 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:37.626427 2.996849 tcp 10.0.2.105 57026 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:46.621712 0.000000 tcp 10.0.2.105 57026 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:46:52.620870 0.060712 tcp 10.0.2.105 57027 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:52.681863 0.062132 tcp 10.0.2.105 57028 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:52.744408 0.152774 tcp 10.0.2.105 57029 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:46:53.051708 3.004877 tcp 10.0.2.105 57030 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:02.053916 0.000000 tcp 10.0.2.105 57030 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:08.053313 0.064328 tcp 10.0.2.105 57031 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:47:08.118017 0.060692 tcp 10.0.2.105 57032 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:47:08.179082 0.147745 tcp 10.0.2.105 57033 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:47:08.352214 2.995120 tcp 10.0.2.105 57034 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:17.356019 0.000000 tcp 10.0.2.105 57034 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:23.344812 2.994023 tcp 10.0.2.105 57035 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:32.337845 0.000000 tcp 10.0.2.105 57035 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:37.274866 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:47:38.346850 2.993374 tcp 10.0.2.105 57036 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:47.339349 0.000000 tcp 10.0.2.105 57036 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:47:53.348833 3.003638 tcp 10.0.2.105 57037 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:48:01.285197 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:48:02.358491 0.000000 tcp 10.0.2.105 57037 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:08.351471 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:53:08.351666 3.003304 tcp 10.0.2.105 57038 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:17.355860 0.000000 tcp 10.0.2.105 57038 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:23.357898 0.060609 tcp 10.0.2.105 57039 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:23.418774 0.064149 tcp 10.0.2.105 57040 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:23.483204 0.151012 tcp 10.0.2.105 57041 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:23.705409 2.994178 tcp 10.0.2.105 57042 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:32.695717 0.000000 tcp 10.0.2.105 57042 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:38.695399 0.060751 tcp 10.0.2.105 57043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:38.756433 0.061533 tcp 10.0.2.105 57044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:38.818220 0.148642 tcp 10.0.2.105 57045 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:38.985979 2.993080 tcp 10.0.2.105 57046 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:47.977562 0.000000 tcp 10.0.2.105 57046 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:53:53.987251 0.060735 tcp 10.0.2.105 57047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:54.048329 0.064339 tcp 10.0.2.105 57048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:54.113018 0.150628 tcp 10.0.2.105 57049 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:53:54.698551 2.992996 tcp 10.0.2.105 57050 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:03.690294 0.000000 tcp 10.0.2.105 57050 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:09.689538 0.059230 tcp 10.0.2.105 57051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:54:09.749175 0.060225 tcp 10.0.2.105 57052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:54:09.809697 0.157929 tcp 10.0.2.105 57053 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 18:54:09.981750 3.001877 tcp 10.0.2.105 57054 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:13.707439 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 18:54:18.982351 0.000000 tcp 10.0.2.105 57054 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:20.715041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:54:24.980954 3.003581 tcp 10.0.2.105 57055 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:28.716334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:54:33.983647 0.000000 tcp 10.0.2.105 57055 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:38.770790 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:54:39.982866 3.003940 tcp 10.0.2.105 57056 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:44.719197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 18:54:48.985364 0.000000 tcp 10.0.2.105 57056 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:54:54.984164 2.994036 tcp 10.0.2.105 57057 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:55:02.765318 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 18:55:03.986768 0.000000 tcp 10.0.2.105 57057 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 18:55:16.725238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:00:09.987413 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:00:09.987610 3.003541 tcp 10.0.2.105 57058 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:18.990006 0.000000 tcp 10.0.2.105 57058 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:24.990124 0.063377 tcp 10.0.2.105 57059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:25.053785 0.080225 tcp 10.0.2.105 57060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:25.134288 0.146848 tcp 10.0.2.105 57061 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:25.328865 2.987668 tcp 10.0.2.105 57062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:34.312475 0.000000 tcp 10.0.2.105 57062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:40.311293 0.060072 tcp 10.0.2.105 57063 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:40.371722 0.061988 tcp 10.0.2.105 57064 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:40.434045 0.151043 tcp 10.0.2.105 57065 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:40.658713 2.996918 tcp 10.0.2.105 57066 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:49.653937 0.000000 tcp 10.0.2.105 57066 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:00:55.653248 0.060251 tcp 10.0.2.105 57067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:55.713788 0.062753 tcp 10.0.2.105 57068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:55.776861 0.146569 tcp 10.0.2.105 57069 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:00:55.943791 3.003427 tcp 10.0.2.105 57070 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:04.956025 0.000000 tcp 10.0.2.105 57070 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:10.939820 0.059979 tcp 10.0.2.105 57071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:01:11.000051 0.065226 tcp 10.0.2.105 57072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:01:11.065611 0.150380 tcp 10.0.2.105 57073 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:01:11.256616 2.995083 tcp 10.0.2.105 57074 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:20.250152 0.000000 tcp 10.0.2.105 57074 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:20.732857 2.999893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:01:26.246319 2.994315 tcp 10.0.2.105 57075 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:27.738569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:01:35.239483 0.000000 tcp 10.0.2.105 57075 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:35.740512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:01:39.771028 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:01:41.252157 3.001094 tcp 10.0.2.105 57076 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:50.252914 0.000000 tcp 10.0.2.105 57076 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:01:51.748646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:01:56.253308 3.006300 tcp 10.0.2.105 57077 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:02:03.770635 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:02:05.255590 0.000000 tcp 10.0.2.105 57077 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:02:23.751542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:07:11.253430 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:07:11.253531 3.003371 tcp 10.0.2.105 57078 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:20.255494 0.000000 tcp 10.0.2.105 57078 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:26.255734 0.060774 tcp 10.0.2.105 57079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:26.316862 0.059948 tcp 10.0.2.105 57080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:26.377091 0.153310 tcp 10.0.2.105 57081 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:26.544465 2.994411 tcp 10.0.2.105 57082 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:35.547444 0.000000 tcp 10.0.2.105 57082 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:41.536967 0.204503 tcp 10.0.2.105 57083 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:41.741806 0.064210 tcp 10.0.2.105 57084 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:41.806281 0.146751 tcp 10.0.2.105 57085 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:41.965507 2.994987 tcp 10.0.2.105 57086 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:50.959527 0.000000 tcp 10.0.2.105 57086 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:07:56.958745 0.060800 tcp 10.0.2.105 57087 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:57.019806 0.061342 tcp 10.0.2.105 57088 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:57.081493 0.144561 tcp 10.0.2.105 57089 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:07:57.352439 3.000932 tcp 10.0.2.105 57090 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:06.355073 0.000000 tcp 10.0.2.105 57090 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:12.350636 0.063224 tcp 10.0.2.105 57091 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:08:12.414145 0.062325 tcp 10.0.2.105 57092 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:08:12.476719 0.147576 tcp 10.0.2.105 57093 -> 195.113.214.249 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:08:12.689025 3.006266 tcp 10.0.2.105 57094 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:21.694007 0.000000 tcp 10.0.2.105 57094 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:27.686939 2.999835 tcp 10.0.2.105 57095 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:27.759441 2.997402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:08:34.762836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:08:36.685460 0.000000 tcp 10.0.2.105 57095 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:41.274876 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:08:42.685152 2.993019 tcp 10.0.2.105 57096 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:42.765016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:08:51.686915 0.000000 tcp 10.0.2.105 57096 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:57.685971 2.994079 tcp 10.0.2.105 57097 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:08:58.767333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:09:05.266663 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:09:06.678367 0.000000 tcp 10.0.2.105 57097 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:09:30.773409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:13:22.066362 0.000167 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:13:22.066631 0.412644 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:22.639690 0.060067 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:22.698579 0.226955 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:22.917657 0.153584 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.064031 0.083257 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.358974 0.038620 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.384559 0.174579 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.556047 0.109099 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.672729 0.170908 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:23.820292 0.211852 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:24.025617 0.106286 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:24.147887 0.091605 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:24.221059 0.703743 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:24.909246 0.172109 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.078710 0.173133 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.262639 0.068063 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.385633 0.072554 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.441827 0.185488 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.637409 0.067150 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.695713 0.248384 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:25.992170 0.173571 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:26.158237 0.126953 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:26.241762 0.173137 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:26.387192 0.207765 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:26.667443 0.235042 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:26.881453 0.127251 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:27.250473 0.073419 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:27.303227 0.103340 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:27.469988 0.434705 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:13:27.881717 0.224020 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:14:12.689098 3.003628 tcp 10.0.2.105 57098 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:17.265319 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:14:21.695316 0.000000 tcp 10.0.2.105 57098 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:27.691622 0.064964 tcp 10.0.2.105 57099 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:27.756918 0.063047 tcp 10.0.2.105 57100 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:27.820501 0.147793 tcp 10.0.2.105 57101 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:28.083214 3.001743 tcp 10.0.2.105 57102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:37.083671 0.000000 tcp 10.0.2.105 57102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:43.083158 0.060420 tcp 10.0.2.105 57103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:43.143831 0.060724 tcp 10.0.2.105 57104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:43.204833 0.151006 tcp 10.0.2.105 57105 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:43.486217 3.000953 tcp 10.0.2.105 57106 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:52.495581 0.000000 tcp 10.0.2.105 57106 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:14:58.490316 0.060894 tcp 10.0.2.105 57107 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:58.551457 0.061520 tcp 10.0.2.105 57108 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:58.613273 0.156030 tcp 10.0.2.105 57109 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:14:58.799884 2.992848 tcp 10.0.2.105 57110 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:07.787531 0.000000 tcp 10.0.2.105 57110 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:13.796823 0.059565 tcp 10.0.2.105 57111 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:15:13.856707 0.060748 tcp 10.0.2.105 57112 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:15:13.917744 0.143889 tcp 10.0.2.105 57113 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:15:14.335138 2.997386 tcp 10.0.2.105 57114 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:23.330809 0.000000 tcp 10.0.2.105 57114 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:29.331398 3.001758 tcp 10.0.2.105 57115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:38.331368 0.000000 tcp 10.0.2.105 57115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:40.787914 3.001279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:15:43.268572 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:15:44.329959 3.004626 tcp 10.0.2.105 57116 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:47.795127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:15:53.335045 0.000000 tcp 10.0.2.105 57116 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:15:55.796502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:15:59.331983 3.003643 tcp 10.0.2.105 57117 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:16:07.928880 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:16:08.978919 0.000000 tcp 10.0.2.105 57117 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:16:12.394827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:16:44.027501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:21:14.335391 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:21:14.335574 2.994373 tcp 10.0.2.105 57118 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:21:23.327859 0.000000 tcp 10.0.2.105 57118 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:21:29.338438 0.061182 tcp 10.0.2.105 57119 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:29.399926 0.061595 tcp 10.0.2.105 57120 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:29.461801 0.155318 tcp 10.0.2.105 57121 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:30.060212 3.001198 tcp 10.0.2.105 57122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:21:39.062819 0.000000 tcp 10.0.2.105 57122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:21:45.059643 0.060684 tcp 10.0.2.105 57123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:45.120581 0.063236 tcp 10.0.2.105 57124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:45.184112 0.150851 tcp 10.0.2.105 57125 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:21:45.480955 3.003008 tcp 10.0.2.105 57126 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:21:54.482705 0.000000 tcp 10.0.2.105 57126 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:00.481829 0.060575 tcp 10.0.2.105 57127 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:00.542704 0.060742 tcp 10.0.2.105 57128 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:00.603817 0.149966 tcp 10.0.2.105 57129 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:00.781982 3.003869 tcp 10.0.2.105 57130 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:09.784419 0.000000 tcp 10.0.2.105 57130 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:15.783275 0.060210 tcp 10.0.2.105 57131 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:15.843744 0.066688 tcp 10.0.2.105 57132 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:15.910743 0.150662 tcp 10.0.2.105 57133 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:22:16.165686 2.992317 tcp 10.0.2.105 57134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:25.166784 0.000000 tcp 10.0.2.105 57134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:31.202833 2.966498 tcp 10.0.2.105 57135 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:40.157881 0.000000 tcp 10.0.2.105 57135 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:44.764849 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:22:46.166991 2.993983 tcp 10.0.2.105 57136 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:22:47.811416 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:22:54.819427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:22:55.159712 0.000000 tcp 10.0.2.105 57136 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:23:01.168756 3.003736 tcp 10.0.2.105 57137 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:23:02.820287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:23:08.769539 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:23:10.171133 0.000000 tcp 10.0.2.105 57137 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:23:18.823636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:23:50.829973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:28:16.171776 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:28:16.171953 3.003403 tcp 10.0.2.105 57138 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:28:25.173994 0.000000 tcp 10.0.2.105 57138 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:28:31.174857 0.066737 tcp 10.0.2.105 57139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:31.241866 0.061499 tcp 10.0.2.105 57140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:31.303655 0.153981 tcp 10.0.2.105 57141 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:31.485480 2.992047 tcp 10.0.2.105 57142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:28:40.486177 0.000000 tcp 10.0.2.105 57142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:28:46.485351 0.060902 tcp 10.0.2.105 57143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:46.546509 0.060051 tcp 10.0.2.105 57144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:46.606852 0.146220 tcp 10.0.2.105 57145 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:28:46.898937 3.000652 tcp 10.0.2.105 57146 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:28:55.898436 0.000000 tcp 10.0.2.105 57146 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:01.897641 0.060705 tcp 10.0.2.105 57147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:01.958679 0.060686 tcp 10.0.2.105 57148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:02.019641 0.149277 tcp 10.0.2.105 57149 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:02.303620 2.998591 tcp 10.0.2.105 57150 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:11.300473 0.000000 tcp 10.0.2.105 57150 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:17.299945 0.065542 tcp 10.0.2.105 57151 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:17.365817 0.061072 tcp 10.0.2.105 57152 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:17.427229 0.152117 tcp 10.0.2.105 57153 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:29:17.600090 3.003904 tcp 10.0.2.105 57154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:26.602837 0.000000 tcp 10.0.2.105 57154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:32.601280 3.004004 tcp 10.0.2.105 57155 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:41.604036 0.000000 tcp 10.0.2.105 57155 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:46.271029 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:29:47.603017 3.004103 tcp 10.0.2.105 57156 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:29:54.836099 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:29:56.605638 0.000000 tcp 10.0.2.105 57156 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:30:01.843688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:30:02.604408 2.994918 tcp 10.0.2.105 57157 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:30:09.844989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:30:10.265321 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:30:11.607205 0.000000 tcp 10.0.2.105 57157 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:30:25.847587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:30:57.853768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:35:17.608009 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:35:17.608193 3.003459 tcp 10.0.2.105 57158 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:35:26.614422 0.000000 tcp 10.0.2.105 57158 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:35:32.610461 0.063171 tcp 10.0.2.105 57159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:32.673912 0.059925 tcp 10.0.2.105 57160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:32.734189 0.154345 tcp 10.0.2.105 57161 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:32.963391 3.000015 tcp 10.0.2.105 57162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:35:41.962154 0.000000 tcp 10.0.2.105 57162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:35:47.961469 0.062237 tcp 10.0.2.105 57163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:48.023986 0.061898 tcp 10.0.2.105 57164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:48.086179 0.147088 tcp 10.0.2.105 57165 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:35:48.311071 2.994745 tcp 10.0.2.105 57166 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:35:57.304132 0.000000 tcp 10.0.2.105 57166 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:03.303616 0.062346 tcp 10.0.2.105 57167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:03.365805 0.063172 tcp 10.0.2.105 57168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:03.429204 0.153793 tcp 10.0.2.105 57169 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:03.642868 2.994677 tcp 10.0.2.105 57170 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:12.646560 0.000000 tcp 10.0.2.105 57170 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:18.635474 0.060559 tcp 10.0.2.105 57171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:18.696331 0.060998 tcp 10.0.2.105 57172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:18.757649 0.146581 tcp 10.0.2.105 57173 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:36:18.933896 2.996032 tcp 10.0.2.105 57174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:27.928563 0.000000 tcp 10.0.2.105 57174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:33.927081 3.004026 tcp 10.0.2.105 57175 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:42.929473 0.000000 tcp 10.0.2.105 57175 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:47.766865 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:36:48.928845 3.004087 tcp 10.0.2.105 57176 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:36:57.931609 0.000000 tcp 10.0.2.105 57176 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:37:01.858751 3.002608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:37:03.930142 3.004339 tcp 10.0.2.105 57177 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:37:08.867227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:37:11.771400 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:37:12.933316 0.000000 tcp 10.0.2.105 57177 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:37:16.868606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:37:32.873079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:38:04.877842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:43:36.985600 0.043429 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:43:37.029134 0.389925 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:37.572230 0.149409 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 650 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:48.943470 3.003212 tcp 10.0.2.105 57178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:43:56.204900 0.061333 tcp 10.0.2.105 57179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:43:56.266500 0.061170 tcp 10.0.2.105 57180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:43:56.327952 0.150528 tcp 10.0.2.105 57181 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:43:56.479250 0.087793 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:56.526603 0.038499 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:56.849539 0.061457 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.115469 0.228018 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.336695 0.177011 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.510423 0.106447 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.584933 0.173131 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.732698 0.215000 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.940585 0.110494 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:57.945805 0.000000 tcp 10.0.2.105 57178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:43:58.010087 0.092279 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:58.158685 0.686245 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:58.830120 0.173327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.001052 0.170649 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.178141 0.083827 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 1908 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.261731 0.077380 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.328425 0.248585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.541820 0.176726 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:43:59.711578 0.217167 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.011209 0.069744 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.064858 0.188901 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.266166 0.237771 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.474372 0.202832 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.671554 0.239108 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:00.892909 0.126792 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:01.141289 0.461455 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:01.581225 0.073207 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:01.634149 0.128179 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:01.849548 0.213161 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2014 flow=From-Botnet-V2-UDP-Established 1970/02/09 19:44:03.944282 0.060043 tcp 10.0.2.105 57182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:44:04.004615 0.060488 tcp 10.0.2.105 57183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:44:04.065411 0.151732 tcp 10.0.2.105 57184 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:44:04.427512 2.991626 tcp 10.0.2.105 57185 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:44:08.884036 3.012856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:44:13.417430 0.000000 tcp 10.0.2.105 57185 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:44:15.901416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:44:23.903144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:44:39.905654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:45:11.911899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:49:19.417957 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:49:19.418071 3.003582 tcp 10.0.2.105 57186 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:49:28.420580 0.000000 tcp 10.0.2.105 57186 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:49:34.421252 0.061765 tcp 10.0.2.105 57187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:34.483385 0.063874 tcp 10.0.2.105 57188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:34.547518 0.148113 tcp 10.0.2.105 57189 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:34.707613 3.006050 tcp 10.0.2.105 57190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:49:43.712643 0.000000 tcp 10.0.2.105 57190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:49:49.701711 0.060858 tcp 10.0.2.105 57191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:49.762851 0.062218 tcp 10.0.2.105 57192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:49.825405 0.149019 tcp 10.0.2.105 57193 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:49:50.106223 2.999771 tcp 10.0.2.105 57194 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:49:59.104576 0.000000 tcp 10.0.2.105 57194 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:05.103950 0.061474 tcp 10.0.2.105 57195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:05.165714 0.064647 tcp 10.0.2.105 57196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:05.230652 0.152538 tcp 10.0.2.105 57197 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:05.398554 2.999472 tcp 10.0.2.105 57198 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:14.406762 0.000000 tcp 10.0.2.105 57198 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:20.395764 0.062170 tcp 10.0.2.105 57199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:20.458182 0.060851 tcp 10.0.2.105 57200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:20.519340 0.151868 tcp 10.0.2.105 57201 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:50:22.083311 2.998644 tcp 10.0.2.105 57202 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:31.082716 0.000000 tcp 10.0.2.105 57202 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:37.082861 3.000615 tcp 10.0.2.105 57203 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:44.770012 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:50:46.081892 0.000000 tcp 10.0.2.105 57203 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:50:52.080599 3.004588 tcp 10.0.2.105 57204 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:51:01.083610 0.000000 tcp 10.0.2.105 57204 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:51:07.082322 3.004386 tcp 10.0.2.105 57205 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:51:11.769011 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:51:16.085441 0.000000 tcp 10.0.2.105 57205 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:54:34.923804 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 19:54:41.931216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:54:49.932765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:55:05.935828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:55:37.941974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 19:56:22.085746 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:56:22.085905 2.993405 tcp 10.0.2.105 57206 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:56:31.081448 0.000000 tcp 10.0.2.105 57206 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:56:37.088978 0.085563 tcp 10.0.2.105 57207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:37.174785 0.060191 tcp 10.0.2.105 57208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:37.235359 0.147281 tcp 10.0.2.105 57209 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:37.451003 2.986412 tcp 10.0.2.105 57210 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:56:46.429990 0.000000 tcp 10.0.2.105 57210 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:56:52.429438 0.059090 tcp 10.0.2.105 57211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:52.488818 0.064979 tcp 10.0.2.105 57212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:52.554101 0.150024 tcp 10.0.2.105 57213 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:56:52.794213 2.999404 tcp 10.0.2.105 57214 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:01.792185 0.000000 tcp 10.0.2.105 57214 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:07.791444 0.061055 tcp 10.0.2.105 57215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:07.852845 0.060513 tcp 10.0.2.105 57216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:07.913646 0.148639 tcp 10.0.2.105 57217 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:08.279240 3.006760 tcp 10.0.2.105 57218 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:17.293938 0.000000 tcp 10.0.2.105 57218 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:23.273721 0.059944 tcp 10.0.2.105 57219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:23.333937 0.064636 tcp 10.0.2.105 57220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:23.398862 0.147211 tcp 10.0.2.105 57221 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 19:57:23.634420 2.997372 tcp 10.0.2.105 57222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:32.643129 0.000000 tcp 10.0.2.105 57222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:38.643280 2.988614 tcp 10.0.2.105 57223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:47.628741 0.000000 tcp 10.0.2.105 57223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:57:52.264864 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:57:53.637190 3.004254 tcp 10.0.2.105 57224 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:58:02.639752 0.000000 tcp 10.0.2.105 57224 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:58:08.638762 3.004267 tcp 10.0.2.105 57225 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 19:58:16.269401 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 19:58:17.641522 0.000000 tcp 10.0.2.105 57225 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:01:41.947397 3.001720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 20:01:48.955348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:01:56.956820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:02:12.959758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:02:44.965980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:03:23.641848 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:03:23.641951 3.003839 tcp 10.0.2.105 57226 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:03:32.651036 0.000000 tcp 10.0.2.105 57226 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:03:38.644690 0.065496 tcp 10.0.2.105 57227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:38.710470 0.063642 tcp 10.0.2.105 57228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:38.774409 0.149813 tcp 10.0.2.105 57229 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:38.949453 2.998288 tcp 10.0.2.105 57230 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:03:47.956121 0.000000 tcp 10.0.2.105 57230 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:03:53.945571 0.061109 tcp 10.0.2.105 57231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:54.006992 0.063750 tcp 10.0.2.105 57232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:54.071036 0.150229 tcp 10.0.2.105 57233 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:03:54.232666 2.996741 tcp 10.0.2.105 57234 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:03.227966 0.000000 tcp 10.0.2.105 57234 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:09.227591 0.059604 tcp 10.0.2.105 57235 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:09.287446 0.061448 tcp 10.0.2.105 57236 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:09.349169 0.148818 tcp 10.0.2.105 57237 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:09.514037 2.997502 tcp 10.0.2.105 57238 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:18.510264 0.000000 tcp 10.0.2.105 57238 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:24.509739 0.063660 tcp 10.0.2.105 57239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:24.573675 0.061370 tcp 10.0.2.105 57240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:24.635320 0.148169 tcp 10.0.2.105 57241 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:04:24.824050 2.999495 tcp 10.0.2.105 57242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:33.822430 0.000000 tcp 10.0.2.105 57242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:39.820914 3.004062 tcp 10.0.2.105 57243 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:48.824158 0.000000 tcp 10.0.2.105 57243 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:04:53.770925 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:04:54.822810 3.003841 tcp 10.0.2.105 57244 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:05:03.825439 0.000000 tcp 10.0.2.105 57244 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:05:09.824188 2.994296 tcp 10.0.2.105 57245 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:05:17.765676 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:05:18.826864 0.000000 tcp 10.0.2.105 57245 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:08:48.971092 3.005616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 20:08:55.979195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:09:03.980067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:09:19.983500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:09:51.989523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:10:24.827467 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:10:24.827574 3.003802 tcp 10.0.2.105 57246 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:10:33.829532 0.000000 tcp 10.0.2.105 57246 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:10:39.833552 0.063352 tcp 10.0.2.105 57247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:39.897253 0.060285 tcp 10.0.2.105 57248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:39.957866 0.147050 tcp 10.0.2.105 57249 -> 195.113.214.249 443 SRPA* 0 0 41 33160 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:40.814963 2.999231 tcp 10.0.2.105 57250 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:10:49.812684 0.000000 tcp 10.0.2.105 57250 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:10:55.812076 0.060865 tcp 10.0.2.105 57251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:55.873210 0.065724 tcp 10.0.2.105 57252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:55.939367 0.150744 tcp 10.0.2.105 57253 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:10:56.518527 3.008558 tcp 10.0.2.105 57254 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:05.527347 0.000000 tcp 10.0.2.105 57254 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:11.514367 0.061006 tcp 10.0.2.105 57255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:11:11.575638 0.062388 tcp 10.0.2.105 57256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:11:11.638293 0.145428 tcp 10.0.2.105 57257 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:11:12.259200 3.000244 tcp 10.0.2.105 57258 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:21.258036 0.000000 tcp 10.0.2.105 57258 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:27.257089 2.993889 tcp 10.0.2.105 57259 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:36.249657 0.000000 tcp 10.0.2.105 57259 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:40.766131 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:11:42.258361 3.004416 tcp 10.0.2.105 57260 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:11:51.261143 0.000000 tcp 10.0.2.105 57260 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:14:28.778001 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:14:28.778083 0.155823 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:28.925849 0.354377 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:29.523723 0.059043 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:29.581581 0.100987 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:30.573986 0.036101 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:30.610760 0.221393 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:30.824961 0.174479 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:31.102185 0.107871 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:31.177099 0.172474 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:31.326056 0.213399 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:31.586524 0.111614 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:31.657305 0.094806 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.001383 0.169961 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.250212 0.169881 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.406523 0.174312 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.576887 0.063896 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.683415 0.069499 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.744181 0.254793 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:32.965103 0.176661 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:33.141389 0.131833 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:33.225938 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 20:14:51.482252 0.062648 tcp 10.0.2.105 57261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:14:51.545293 0.065541 tcp 10.0.2.105 57262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:14:51.611113 0.149485 tcp 10.0.2.105 57263 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:14:51.761207 0.190285 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:51.929784 0.239612 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:52.271410 0.127161 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:52.604841 0.173577 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:52.882927 0.198609 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:53.074019 0.103568 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:53.199181 0.271037 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:53.466496 0.438452 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:14:53.881569 0.072980 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:16:01.003617 3.001027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 20:16:08.010279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:16:17.114417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:16:32.925018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:16:57.920166 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:16:57.920257 2.971435 tcp 10.0.2.105 57264 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:04.613043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:17:06.835687 0.000000 tcp 10.0.2.105 57264 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:12.758603 0.061822 tcp 10.0.2.105 57265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:12.820710 0.061220 tcp 10.0.2.105 57266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:12.882231 0.159307 tcp 10.0.2.105 57267 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:13.636720 2.962055 tcp 10.0.2.105 57268 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:22.534551 0.000000 tcp 10.0.2.105 57268 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:28.450591 0.063422 tcp 10.0.2.105 57269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:28.514245 0.060344 tcp 10.0.2.105 57270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:28.574920 0.149934 tcp 10.0.2.105 57271 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:29.203271 2.961371 tcp 10.0.2.105 57272 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:38.090638 0.000000 tcp 10.0.2.105 57272 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:44.015086 0.059569 tcp 10.0.2.105 57273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:44.074986 0.065773 tcp 10.0.2.105 57274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:44.141011 0.147447 tcp 10.0.2.105 57275 -> 195.113.214.249 443 SRPA* 0 0 36 17650 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:44.299340 2.963703 tcp 10.0.2.105 57276 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:53.191480 0.000000 tcp 10.0.2.105 57276 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:17:59.593493 0.061365 tcp 10.0.2.105 57277 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:59.655276 0.060640 tcp 10.0.2.105 57278 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:17:59.716360 0.147910 tcp 10.0.2.105 57279 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:18:00.211036 2.976995 tcp 10.0.2.105 57280 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:09.130486 0.000000 tcp 10.0.2.105 57280 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:15.071592 2.975780 tcp 10.0.2.105 57281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:24.248066 0.000000 tcp 10.0.2.105 57281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:29.156966 0.493494 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:18:30.670443 2.954678 tcp 10.0.2.105 57282 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:39.565754 0.000000 tcp 10.0.2.105 57282 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:45.493051 2.951979 tcp 10.0.2.105 57283 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:18:46.205907 0.000140 tcp 10.0.2.105 57281 -> 31.192.24.67 3527 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:18:53.353140 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:18:54.377099 0.000000 tcp 10.0.2.105 57283 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:23:11.060662 3.002086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 20:23:18.068733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:23:26.069668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:23:42.073210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:23:59.819291 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:23:59.819419 3.003525 tcp 10.0.2.105 57284 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:24:08.821658 0.000000 tcp 10.0.2.105 57284 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/09 20:24:14.079318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:24:14.821729 0.060626 tcp 10.0.2.105 57285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:24:14.882612 0.064216 tcp 10.0.2.105 57286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:24:14.947120 0.141731 tcp 10.0.2.105 57287 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:24:15.099735 0.521296 tcp 10.0.2.105 57288 -> 31.192.24.67 3527 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:30:18.085348 3.013245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 20:30:25.102652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:30:33.104921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:30:49.107407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:31:21.113140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:37:25.119489 3.001005 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 20:37:32.126820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:37:40.127977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:37:56.131238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:38:28.137253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:44:32.144022 3.006445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 20:44:39.149998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:44:47.152144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:45:03.155509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:45:20.540410 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:45:20.540589 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 20:45:35.160663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:45:36.905673 0.060955 tcp 10.0.2.105 57289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:45:36.966907 0.060470 tcp 10.0.2.105 57290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:45:37.027655 0.150688 tcp 10.0.2.105 57291 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:45:37.178948 0.057951 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:37.237255 0.145501 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:37.383127 0.345404 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:37.728988 0.221838 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:37.951179 0.046743 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:37.998235 0.025677 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.024240 0.203702 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.228362 0.072780 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.301536 0.171337 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.473256 0.069301 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.542930 0.069352 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.612724 0.143377 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.756604 0.221139 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:38.978088 0.071754 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.050286 0.057988 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.108613 0.209091 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.318159 0.167272 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.485844 0.145833 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.632074 0.157309 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.789746 0.083515 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:39.873623 0.164871 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:40.038871 0.213595 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:40.252846 0.128070 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:40.381327 0.145199 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:40.526923 0.190056 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:40.717414 0.447313 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:41.165133 0.102122 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:41.267667 0.208320 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:45:41.476547 0.050523 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/09 20:54:15.619775 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 20:54:15.619872 0.575140 tcp 10.0.2.105 57292 -> 31.192.24.67 3527 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/09 20:54:47.166860 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/09 20:54:54.175177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:55:02.176644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:55:18.181213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 20:55:50.185362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:01:54.191492 3.001544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:02:01.198670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:02:09.200387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:02:25.203431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:02:57.209606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:09:07.224014 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:09:14.236828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:09:22.233224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:09:38.236372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:10:10.241854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:16:03.680626 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 21:16:03.680732 0.058258 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:03.739386 0.213767 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:03.953510 0.054377 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.008239 0.027824 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.036700 0.201605 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.238718 0.146051 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.385129 0.344556 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.730051 0.073596 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.804041 0.171461 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:04.975919 0.074768 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.051052 0.070503 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.121962 0.146193 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.268545 0.167374 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.436400 0.089599 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 201 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.526417 0.058757 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.585541 0.146596 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.732555 0.155143 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.888106 0.097482 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:05.985975 0.164094 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:06.150491 0.213665 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:06.364682 0.219233 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:06.584401 0.197598 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:06.782409 0.124928 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:06.907730 0.145992 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:07.054140 0.188006 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:07.242532 0.411834 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:07.654775 0.101859 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:07.757098 0.208410 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:07.965914 0.051016 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:16:16.250354 3.002137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:16:23.257907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:16:31.259363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:16:47.262591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:17:19.269224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:23:24.276206 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:23:31.283564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:23:39.292614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:23:55.288548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:24:16.198494 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 21:24:16.198656 0.567866 tcp 10.0.2.105 57293 -> 31.192.24.67 3527 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/02/09 21:24:27.294048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:30:31.300144 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:30:38.312730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:30:46.309140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:31:02.312096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:31:34.318573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:37:38.324104 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:37:45.331511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:37:53.333489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:38:09.336007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:38:41.342164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:44:45.347668 3.003471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:44:52.355513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:45:00.357257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:45:16.359933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:45:48.366243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:46:23.006183 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 21:46:23.006276 0.060351 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.066989 0.030958 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.098386 0.205702 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.304514 0.147009 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.451941 0.354217 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.806555 0.071067 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:23.878001 0.213743 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.092216 0.041425 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.134023 0.172605 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.306996 0.074122 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.381565 0.066441 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.449346 0.146979 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.596692 0.166251 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.763323 0.081726 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.845413 0.059267 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:24.905059 0.145685 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.051133 0.153735 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.205253 0.212628 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.418274 0.216593 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.635267 0.163792 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.799438 0.125562 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:25.925418 0.081936 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:26.007794 0.162902 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:26.171080 0.144356 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:26.315833 0.180993 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:26.497251 0.425656 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:26.923274 0.114233 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:27.037861 0.217560 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:46:27.255766 0.049150 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 21:51:52.371781 3.024715 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:51:59.409176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:52:07.401170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:52:23.404008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:52:55.410160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:54:16.767660 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 21:54:16.767822 0.510915 tcp 10.0.2.105 57294 -> 31.192.24.67 3527 FSPA* 0 0 14 1502 flow=From-Botnet-V2-TCP-Established 1970/02/09 21:58:59.418716 2.999591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 21:59:06.423543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:59:14.424798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 21:59:30.428177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:00:02.434929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:06:30.444715 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:06:38.664832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:06:46.574416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:07:02.387265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:07:34.004270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:13:41.484303 3.001955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:13:48.491889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:13:56.493492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:14:12.499070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:14:44.502331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:16:54.669973 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 22:16:54.670059 0.057792 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:54.728267 0.030366 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:54.759016 0.395523 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.154937 0.076097 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.231396 0.211295 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.443062 0.039589 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.483066 0.201866 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.685350 0.147897 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:55.833614 0.171655 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.005679 0.072931 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.078992 0.070156 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.149593 0.146272 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.296402 0.192635 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.489411 0.063447 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.553246 0.057693 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.611326 0.152788 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.764656 0.154044 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:56.919118 0.165469 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.084932 0.126517 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.211819 0.082335 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.294497 0.161781 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.456664 0.213992 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.671026 0.237132 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:57.908587 0.144766 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:58.053733 0.200314 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:58.254449 0.425446 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:58.680349 0.102230 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:58.782978 0.219617 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:16:59.003031 0.049448 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:20:49.509640 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:20:56.517183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:21:04.518715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:21:20.521816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:21:52.527782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:24:17.286408 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 22:24:17.286617 0.619236 tcp 10.0.2.105 57295 -> 31.192.24.67 3527 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/09 22:27:56.533824 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:28:03.541358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:28:11.543028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:28:27.546077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:28:59.551862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:35:03.557670 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:35:10.565089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:35:18.568897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:35:34.569574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:36:06.575476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:42:10.581804 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:42:17.589004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:42:25.590602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:42:41.599001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:43:13.606881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:47:07.245926 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 22:47:07.246098 0.437560 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:07.684056 0.058354 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:07.742801 0.027136 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:07.770296 0.069872 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:07.840723 0.212609 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.053732 0.048901 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.103023 0.209806 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.313193 0.149836 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.463402 0.171989 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.635784 0.070021 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.706196 0.067976 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.774690 0.144199 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:08.919404 0.185326 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.105120 0.069911 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.175463 0.057131 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.233008 0.149625 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.383013 0.156790 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.540174 0.165202 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.705812 0.127356 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.833550 0.080274 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:09.914223 0.163512 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.078138 0.212411 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.290935 0.213887 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.505268 0.147229 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.652840 0.101900 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.755120 0.217406 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:10.972934 0.054589 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:11.027891 0.194097 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:47:11.222426 0.422399 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/09 22:53:38.611288 3.088097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 22:53:45.672570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:53:53.629845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:54:09.632713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 22:54:17.905293 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 22:54:17.905444 0.590511 tcp 10.0.2.105 57296 -> 31.192.24.67 3527 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/09 22:54:41.638996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:00:45.644878 3.014732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:00:52.662067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:01:00.663743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:01:16.666847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:01:48.673176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:07:52.688685 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:07:59.701941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:08:07.697635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:08:23.700764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:08:55.706839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:14:59.713533 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:15:06.720292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:15:14.721722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:15:30.724674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:16:02.735568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:17:22.085123 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 23:17:22.085295 0.025764 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.111444 0.078006 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.189870 0.375357 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.565687 0.057811 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.623943 0.217399 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.841700 0.060077 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:22.902121 0.205193 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.107694 0.146307 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.254402 0.173246 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.428018 0.073237 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.501637 0.069811 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.571842 0.143389 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.715600 0.166909 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.882876 0.061914 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:23.945212 0.058430 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.004037 0.147913 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.152359 0.155980 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.308719 0.164073 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.473198 0.127731 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.601297 0.084037 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.685783 0.163701 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:24.849942 0.212115 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.073147 0.213905 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.287429 0.147050 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.434881 0.052542 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.487820 0.193885 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.682139 0.102030 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.784621 0.208991 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:17:25.994058 0.442085 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:22:08.739678 3.001724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:22:15.746817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:22:23.748703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:22:39.751766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:23:11.757653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:24:18.514028 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 23:24:18.514122 0.652093 tcp 10.0.2.105 57297 -> 31.192.24.67 3527 FSPA* 0 0 14 1532 flow=From-Botnet-V2-TCP-Established 1970/02/09 23:29:15.764771 3.000449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:29:22.770982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:29:30.772557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:29:46.775416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:30:18.783017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:36:22.786969 3.002138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:36:29.794878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:36:37.796514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:36:53.799452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:37:25.805670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:43:29.810964 3.002230 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:43:36.818567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:43:44.820534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:44:00.824944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:44:32.829574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:47:42.843104 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 23:47:42.843210 0.358474 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.202055 0.059055 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.261557 0.221502 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.483454 0.050016 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.533857 0.023607 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.557809 0.077824 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.636021 0.201194 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:47:43.837670 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/09 23:48:01.095741 0.064562 tcp 10.0.2.105 57298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/09 23:48:01.160659 0.060688 tcp 10.0.2.105 57299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/09 23:48:01.221657 0.143801 tcp 10.0.2.105 57300 -> 195.113.214.249 443 SRPA* 0 0 32 24662 flow=From-Botnet-V2-TCP-Established 1970/02/09 23:48:01.365987 0.171006 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 197 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:01.537402 0.076536 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:01.614317 0.073253 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:01.687962 0.145095 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:01.833445 0.170164 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.004009 0.064083 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.068655 0.069930 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.139015 0.187311 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.326765 0.127317 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.454474 0.097422 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.552342 0.162931 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.715669 0.211988 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:02.928132 0.144065 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.072566 0.154447 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.227391 0.218172 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.446006 0.148431 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.594843 0.054123 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.649374 0.193206 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.842954 0.126515 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:03.969877 0.208520 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:48:04.178753 0.412663 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/09 23:54:13.837074 3.002093 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/09 23:54:19.173140 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/09 23:54:19.173260 0.577950 tcp 10.0.2.105 57301 -> 31.192.24.67 3527 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/02/09 23:54:20.844954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:54:28.846510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:54:44.849741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/09 23:55:16.855375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:01:20.861623 3.001364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:01:27.868871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:01:35.870675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:01:51.873037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:02:23.883964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:08:27.885519 3.002875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:08:34.897007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:08:42.894267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:08:58.898115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:09:30.903485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:15:40.917974 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:15:47.925335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:15:55.927157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:16:11.930040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:16:43.935925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:18:22.448259 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 00:18:22.448434 0.147259 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:22.596072 0.217557 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:22.814052 0.050892 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:22.865319 0.026845 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:22.892494 0.077381 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:22.970238 0.058553 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.029136 0.352117 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.381659 0.204699 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.586750 0.071452 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.658622 0.171920 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.830952 0.076018 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:23.907408 0.144169 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.051975 0.214612 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.267015 0.069182 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.336559 0.057618 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.394549 0.164161 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.559106 0.164681 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.724356 0.212803 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:24.937518 0.145869 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.083758 0.128157 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.212322 0.080943 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.293648 0.175485 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.469502 0.218123 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.688048 0.144804 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.854116 0.054142 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:25.908684 0.209516 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:26.118679 0.196799 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:26.315903 0.114404 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:18:26.430712 0.415795 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:22:48.943360 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:22:55.950837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:23:03.952558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:23:19.954870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:23:51.961424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:24:19.751942 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 00:24:19.752110 0.595473 tcp 10.0.2.105 57302 -> 31.192.24.67 3527 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/10 00:29:55.969349 2.999735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:30:02.974794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:30:10.976200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:30:26.979469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:30:58.985571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:37:02.992487 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:37:09.998853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:37:17.999637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:37:34.003319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:38:06.008948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:44:10.015572 3.001245 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 00:44:17.025834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:44:25.024084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:44:41.032464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:45:13.033042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:48:50.786648 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 00:48:50.786749 0.065812 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:50.853016 0.023126 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:50.876548 0.075333 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:50.952255 0.059428 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:51.012083 0.147948 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:51.160586 0.217667 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:51.378688 0.372176 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:51.751264 0.205642 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:51.957255 0.073097 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.030732 0.172309 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.203433 0.072687 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.276708 0.145002 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.422164 0.168361 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.590863 0.081149 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.672558 0.138173 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.811107 0.164803 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:52.976244 0.165181 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.141772 0.212508 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.354628 0.144612 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.499640 0.127222 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.627295 0.092642 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.720325 0.155684 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:53.876406 0.218123 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:54.094971 0.218075 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:54.313485 0.201531 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:54.515458 0.126580 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:54.642383 0.417057 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:55.059835 0.145557 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:48:55.205803 0.054687 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/10 00:54:20.350841 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 00:54:20.350985 0.583849 tcp 10.0.2.105 57303 -> 31.192.24.67 3527 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/10 00:54:34.042191 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 00:54:41.049858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:54:49.051468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:55:05.054262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 00:55:37.060507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:01:41.085719 3.002471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:01:48.094040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:01:56.095394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:02:12.098167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:02:44.114198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:08:48.110188 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:08:55.117779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:09:03.119331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:09:19.122415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:09:51.128882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:15:55.135551 3.000693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:16:02.141908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:16:10.142892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:16:26.146607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:16:58.162618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:19:13.717433 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 01:19:13.717595 0.079551 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:13.797596 0.047233 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:13.845217 0.034099 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:13.879667 0.059596 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:13.939614 0.148790 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:14.088778 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 01:19:32.656778 0.061468 tcp 10.0.2.105 57304 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:32.718544 0.064635 tcp 10.0.2.105 57305 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:32.783108 0.339700 tcp 10.0.2.105 57306 -> 195.113.214.249 443 SRPA* 0 0 37 27023 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:33.123348 0.073609 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:33.197387 0.172885 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:33.370678 0.075431 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:33.446471 0.381332 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:33.828171 0.204437 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:34.032955 0.146000 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:34.179307 0.168357 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:34.348010 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 01:19:52.132891 0.060068 tcp 10.0.2.105 57307 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:52.193252 0.064902 tcp 10.0.2.105 57308 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:52.258476 0.170752 tcp 10.0.2.105 57309 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:19:52.429763 0.121472 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:52.551678 0.214000 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:52.766049 0.154825 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:52.921292 0.125915 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.047582 0.167595 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.215534 0.162890 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.378823 0.085282 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.464643 0.155503 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.620715 0.218746 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.839841 0.102084 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:53.942338 0.218101 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:54.160828 0.186312 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:54.347531 0.051139 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:54.399088 0.451497 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:19:54.850954 0.145016 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:23:02.168108 3.001748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 01:23:09.175960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:23:17.177466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:23:33.180275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:24:05.186576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:24:20.959340 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 01:24:20.959482 0.550516 tcp 10.0.2.105 57310 -> 31.192.24.67 3527 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:30:09.191972 3.022104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:30:16.220079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:30:24.221181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:30:40.224708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:31:12.230236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:37:16.236003 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:37:23.243652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:37:31.245312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:37:47.248475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:38:19.254351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:44:23.260586 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 01:44:30.267723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:44:38.271455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:44:54.272391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:45:26.278543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:50:20.531783 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 01:50:20.531888 0.218650 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:20.750959 0.065915 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:20.817259 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 01:50:38.168424 0.067449 tcp 10.0.2.105 57311 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:50:38.236147 0.061617 tcp 10.0.2.105 57312 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:50:38.298054 0.155137 tcp 10.0.2.105 57313 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:50:38.453787 0.027935 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:38.482086 0.051512 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:38.533943 0.087306 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:38.621625 0.059863 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:38.681895 0.077786 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:38.760078 0.424627 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.185066 0.206007 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.391470 0.171648 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.563537 0.071541 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.635519 0.144830 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.780763 0.168991 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:39.950167 0.122354 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.072992 0.213374 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.286742 0.147266 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.434362 0.126830 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.561593 0.166298 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.728284 0.166381 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.895033 0.083615 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:40.979025 0.838100 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:41.817530 0.219705 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.037624 0.126781 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.164852 0.052127 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.217373 0.409739 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.627475 0.145737 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.773618 0.208565 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:50:42.982651 0.200895 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/10 01:54:21.518260 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 01:54:21.518468 0.524782 tcp 10.0.2.105 57314 -> 31.192.24.67 3527 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/02/10 01:54:42.290188 3.001641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 01:54:49.297643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:54:57.299313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:55:13.302444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 01:55:45.308445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:01:49.315596 3.015673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:01:56.331998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:02:04.333440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:02:20.336739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:02:52.346576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:08:56.355233 2.995984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:09:03.355690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:09:11.357286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:09:27.360185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:09:59.366541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:16:03.374409 2.999535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:16:10.379688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:16:18.381315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:16:34.383834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:17:06.390292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:20:52.039837 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 02:20:52.039926 0.144535 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.184864 0.217435 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.402692 0.069714 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.472846 0.034522 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.507793 0.055636 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.563882 0.076324 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.640608 0.056763 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.697745 0.074255 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:52.772364 0.390427 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.163279 0.202652 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.366390 0.173999 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.540831 0.074738 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.616014 0.145137 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.761595 0.166513 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.928494 0.056241 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:53.985139 0.127331 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.112917 0.164313 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.277637 0.213272 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.491276 0.150975 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.642687 0.165873 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.808927 0.083473 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:54.892796 0.768815 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:55.661982 0.212602 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:55.874965 0.102043 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:55.977448 0.145674 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:56.123520 0.055404 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:56.179398 0.418201 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:56.597996 0.216722 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:20:56.815161 0.191941 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:23:10.396735 3.001206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:23:17.403718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:23:25.405199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:23:41.408010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:24:13.414061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:24:22.047435 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 02:24:22.047580 0.520395 tcp 10.0.2.105 57315 -> 31.192.24.67 3527 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/02/10 02:30:17.423887 3.010900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:30:24.437856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:30:32.439121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:30:48.442055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:31:20.448166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:37:24.454401 3.001535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:37:31.463888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:37:39.463949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:37:55.466592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:38:27.476002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:44:31.478628 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 02:44:38.485479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:44:46.487150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:45:02.490352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:45:34.496148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:50:59.964406 0.045160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 02:51:00.009697 0.067894 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.077979 0.027882 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.106298 0.050995 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.157732 0.076280 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.234367 0.058819 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.293572 0.072059 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.365999 0.147011 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.513403 0.213630 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:00.727462 0.380143 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.107997 0.200471 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.308845 0.173291 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.482582 0.075722 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.558705 0.144367 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.703462 0.173751 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.877634 0.057490 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:01.935580 0.128244 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.064293 0.147922 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.212722 0.162592 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.375764 0.095315 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.471505 0.165839 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.637731 0.213033 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:02.851195 0.708624 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:03.560200 0.217021 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:03.777623 0.101906 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:03.879941 0.439591 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:04.337312 0.214725 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:04.552716 0.190650 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:04.743740 0.145038 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:51:04.889170 0.053775 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/10 02:54:22.575854 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 02:54:22.576004 0.582411 tcp 10.0.2.105 57316 -> 31.192.24.67 3527 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/10 02:54:47.503827 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 02:54:54.511248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:55:02.512791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:55:18.515909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 02:55:50.522173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:01:54.528886 3.000701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:02:01.535347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:02:09.536971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:02:25.539958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:02:57.545791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:09:01.553946 2.999528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:09:08.559406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:09:16.560691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:09:32.567265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:10:04.575301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:16:08.576542 3.000943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:16:15.582992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:16:23.584667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:16:39.587812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:17:11.593691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:21:21.833912 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 03:21:21.834077 0.065011 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:21.899465 0.029444 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:21.929294 0.046785 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:21.976635 0.079056 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:22.056085 0.059355 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:22.115811 0.076570 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:22.192850 0.147008 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:22.340272 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 03:21:37.458064 0.061918 tcp 10.0.2.105 57317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:37.520257 0.060209 tcp 10.0.2.105 57318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:37.580809 0.139964 tcp 10.0.2.105 57319 -> 195.113.214.249 443 SRPA* 0 0 37 27873 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:37.721308 0.383909 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:38.105612 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 03:21:56.313996 0.059268 tcp 10.0.2.105 57320 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:56.373601 0.061269 tcp 10.0.2.105 57321 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:56.435202 0.155070 tcp 10.0.2.105 57322 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:21:56.590784 0.171598 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:56.762726 0.077463 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:56.840612 0.143343 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:56.984355 0.166177 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.150966 0.057535 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.208894 0.125713 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.335023 0.093196 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.428616 0.164296 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.593326 0.147788 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.741532 0.162440 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:57.904535 0.214449 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:58.119382 0.885671 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:59.005442 0.220381 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:59.226254 0.114242 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:59.340905 0.421051 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:59.762344 0.218355 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:21:59.981063 0.053244 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:22:00.034716 0.193775 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:22:00.228897 0.142150 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:23:15.601454 2.999910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 03:23:22.607339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:23:30.609072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:23:46.611877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:24:18.617951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:24:23.164736 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 03:24:23.164968 0.603607 tcp 10.0.2.105 57323 -> 31.192.24.67 3527 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:30:22.623749 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:30:29.631270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:30:37.632459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:30:53.636005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:31:25.643839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:37:29.647701 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:37:36.662691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:37:44.658233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:38:00.661659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:38:32.665645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:44:36.672381 3.000740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 03:44:43.679082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:44:51.680724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:45:07.683569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:45:39.689576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:52:12.935523 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 03:52:12.935711 0.218378 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.154487 0.203213 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.358098 0.078680 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.437202 0.058685 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.496283 0.047204 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.543876 0.040189 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.584449 0.063257 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.648108 0.144063 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.792635 0.079534 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:13.872567 0.426573 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.299532 0.143453 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.443388 0.171777 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.615517 0.072735 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.688670 0.180794 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.869914 0.056894 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:14.927158 0.124959 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.052719 0.084396 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.137490 0.170357 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.308252 0.146143 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.454787 0.165815 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.620993 0.211399 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:15.832798 0.550484 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:16.383644 0.426837 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:16.810864 0.210626 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:17.021851 0.054558 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:17.076783 0.208642 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:17.285813 0.101930 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:17.388085 0.193545 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:52:17.582103 0.144639 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 03:54:23.773484 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 03:54:23.773667 0.546930 tcp 10.0.2.105 57324 -> 31.192.24.67 3527 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/10 03:54:50.704856 3.001911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 03:54:57.712136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:55:05.713303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:55:21.716183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 03:55:53.722940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:01:57.728689 3.005015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:02:04.736087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:02:12.737474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:02:28.740281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:03:00.746981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:09:05.758325 2.997326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:09:12.762251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:09:20.765696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:09:36.765894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:10:08.771973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:16:12.778024 3.000875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:16:19.785186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:16:27.786656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:16:43.789662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:17:15.795602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:22:43.977772 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 04:22:43.977871 0.215045 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:22:44.193331 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 04:23:01.865439 0.065430 tcp 10.0.2.105 57325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 04:23:01.931160 0.060066 tcp 10.0.2.105 57326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 04:23:01.991497 0.131300 tcp 10.0.2.105 57327 -> 195.113.214.249 443 SRPA* 0 0 62 40583 flow=From-Botnet-V2-TCP-Established 1970/02/10 04:23:02.123017 0.076336 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.199791 0.067537 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.267771 0.051479 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.319678 0.030992 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.351031 0.067908 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.419305 0.146546 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.566303 0.074934 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:02.641656 0.433644 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.075656 0.145209 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.221259 0.172041 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.393697 0.074777 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.468828 0.324658 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.793819 0.058418 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.852654 0.125840 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:03.978881 0.081074 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:04.060474 0.163558 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:04.224426 0.213997 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:04.438816 0.167985 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:04.607206 0.149216 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:04.756860 0.858675 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:05.615981 0.413508 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.029842 0.207352 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.237591 0.051996 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.290020 0.191328 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.481728 0.145159 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.627299 0.213218 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:06.840905 0.114371 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:23:19.801318 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:23:26.809290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:23:34.810519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:23:50.813887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:24:22.819299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:24:24.322481 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 04:24:24.322669 0.575406 tcp 10.0.2.105 57328 -> 31.192.24.67 3527 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/02/10 04:30:26.829126 3.101759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:30:33.910360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:30:41.849974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:30:57.847704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:31:29.875583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:37:33.880452 3.001170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:37:40.886546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:37:48.888508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:38:04.892239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:38:36.897802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:44:40.904543 3.000883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 04:44:47.911151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:44:55.912607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:45:11.915686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:45:43.921771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:53:12.497360 0.101130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 04:53:12.598574 0.205974 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:12.804981 0.221089 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.026446 0.076220 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.103037 0.058957 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.162356 0.052299 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.215108 0.029522 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.245052 0.065741 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.311213 0.143010 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.454593 0.075773 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:13.688105 0.442339 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.130822 0.143703 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.274961 0.172840 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.448203 0.072438 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.521042 0.167253 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.688731 0.058849 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.748001 0.124847 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.873281 0.081005 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:14.954730 0.164513 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:15.119571 0.219102 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:15.339117 0.167166 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:15.506706 0.212509 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:15.719577 0.832010 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:16.552036 0.420591 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:16.973012 0.207875 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:17.181302 0.051404 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:17.233079 0.189160 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:17.422615 0.148595 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:17.571631 0.213241 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:53:17.785301 0.114280 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/10 04:54:24.901225 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 04:54:24.901425 0.609129 tcp 10.0.2.105 57329 -> 31.192.24.67 3527 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/02/10 04:54:52.933481 3.002122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 04:54:59.945382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:55:07.942700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:55:23.951226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 04:55:55.951997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:01:59.957956 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:02:06.964745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:02:14.966713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:02:30.969518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:03:02.975656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:09:08.983995 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:09:16.118495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:09:24.056560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:09:40.005816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:10:12.012646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:16:16.023453 2.996544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:16:23.025825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:16:31.027320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:16:47.030492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:17:19.036685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:23:23.041809 3.002326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:23:29.278872 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 05:23:29.279079 0.076143 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.355641 0.059402 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.415386 0.200564 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.616377 0.220901 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.837622 0.051597 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.889634 0.033365 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.923337 0.067988 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:29.991700 0.146766 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:30.049412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:23:30.138862 0.078006 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:30.217259 0.171773 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:30.389409 0.077449 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:30.467203 0.425882 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:30.893450 0.146836 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.040665 0.168383 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.209475 0.057755 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.267676 0.124715 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.392780 0.081915 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.475145 0.164288 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.639906 0.212131 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:31.852651 0.302761 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:32.155808 0.167083 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:32.323330 0.355621 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:32.679321 0.462056 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.141743 0.222073 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.364152 0.050518 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.415015 0.189126 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.604706 0.147396 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.752581 0.218851 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:33.971836 0.126755 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:23:38.051443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:23:54.054379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:24:25.510178 0.553684 tcp 10.0.2.105 57330 -> 31.192.24.67 3527 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/10 05:24:26.060344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:30:30.066021 3.001966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:30:37.085723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:30:45.081728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:31:01.084007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:31:33.084214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:37:37.089977 3.002295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:37:44.098086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:37:52.102875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:38:08.102734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:38:40.108132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:44:44.114742 3.001165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 05:44:51.121585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:44:59.123262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:45:15.126101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:45:47.132675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:53:36.317287 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 05:53:36.317446 0.077002 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.394835 0.059990 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.455215 0.206090 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.661718 0.221746 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.883807 0.042747 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.926940 0.030451 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:36.957787 0.082275 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.040440 0.147543 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.188342 0.075120 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.263860 0.348276 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.612666 0.144251 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.757331 0.076286 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:37.834055 0.172824 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.007254 0.165829 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.173477 0.059109 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.232973 0.125081 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.358455 0.078914 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.437820 0.165507 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.603697 0.211356 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:38.815434 0.612926 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:39.428749 0.149075 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:39.578155 0.163271 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:39.741871 0.451187 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:40.193453 0.325177 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:40.519072 0.055935 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:40.575359 0.200541 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:40.776302 0.147261 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:40.923945 0.220165 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:53:41.144532 0.101719 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/10 05:54:26.069015 0.601315 tcp 10.0.2.105 57331 -> 31.192.24.67 3527 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/10 05:54:56.144434 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 05:55:03.151857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:55:11.153107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:55:27.155783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 05:55:59.162369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:02:03.168142 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:02:10.175649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:02:18.177265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:02:34.179966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:03:06.186254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:09:12.194901 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:09:19.202687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:09:27.204050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:09:43.207392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:10:15.213130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:16:19.218762 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:16:26.229005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:16:34.228433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:16:50.230594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:17:22.237135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:23:26.242514 3.002556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:23:33.250894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:23:41.251845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:23:57.254895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:24:01.020663 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 06:24:01.020859 0.077662 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.099147 0.058581 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.158064 0.207377 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.365782 0.214440 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.580654 0.041329 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.622363 0.026378 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.649128 0.071859 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:01.721395 0.345000 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:02.066786 0.065151 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:02.132423 0.146976 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:02.279767 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 06:24:20.350208 0.065609 tcp 10.0.2.105 57332 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:24:20.416083 0.060766 tcp 10.0.2.105 57333 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:24:20.477089 0.138231 tcp 10.0.2.105 57334 -> 195.113.214.249 443 SRPA* 0 0 56 47609 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:24:20.615989 0.071503 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:20.687907 0.172267 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:20.860741 0.163759 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.024839 0.129611 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.154897 0.165871 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.321134 0.210869 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.532448 0.125009 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.657848 0.082721 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:21.741014 0.688752 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:22.430167 0.147407 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:22.577918 0.162059 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:22.740393 0.412262 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:23.153015 0.180868 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:23.334259 0.146305 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:23.480973 0.207708 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:23.689105 0.052647 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:23.742167 0.788181 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:24.530771 0.120488 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:24:26.677715 0.607192 tcp 10.0.2.105 57335 -> 31.192.24.67 3527 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:24:29.260974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:30:33.267806 3.070876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:30:40.308989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:30:48.285882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:31:04.289067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:31:36.294955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:37:40.310652 3.024215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:37:47.331704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:37:55.329973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:38:11.333179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:38:43.340335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:44:47.344066 3.002404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:44:54.352600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:45:02.353746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:45:18.357035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:45:50.362992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:51:54.369664 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 06:52:01.376719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:52:09.377782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:52:25.381026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:52:57.387063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:54:27.290384 0.000190 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 06:54:27.290725 0.523310 tcp 10.0.2.105 57336 -> 31.192.24.67 3527 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:54:45.452614 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 06:55:04.321913 0.060940 tcp 10.0.2.105 57337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:55:04.383102 0.062028 tcp 10.0.2.105 57338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:55:04.445403 0.156171 tcp 10.0.2.105 57339 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 06:55:04.602101 0.073174 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:04.675721 0.221074 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:04.897186 0.046602 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:04.944194 0.060810 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.005370 0.070760 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.076478 0.349580 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.426406 0.062950 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.489770 0.023506 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.513666 0.202115 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.716196 0.145887 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:05.862460 0.167878 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.030706 0.078722 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.109824 0.172384 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.282650 0.058392 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.341441 0.165886 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.507689 0.222069 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.730153 0.126401 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.856992 0.083538 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:06.940935 0.162313 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:07.103637 0.684916 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:07.788956 0.145530 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:07.934921 0.425117 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:08.360462 0.197915 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:08.558791 0.150008 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:08.709275 0.336536 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:09.046228 0.055872 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:09.102478 0.216574 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:55:09.319392 0.114115 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/10 06:59:01.393154 3.001456 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 06:59:08.400502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:59:16.401745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 06:59:32.405056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:00:04.411049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:06:18.420509 3.002501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:06:25.433042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:06:33.435236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:06:49.433191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:07:21.439208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:13:25.445295 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:13:32.452730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:13:40.454319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:13:56.457439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:14:28.463533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:20:32.469644 3.001430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:20:39.476495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:20:47.478110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:21:03.481776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:21:35.487368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:24:27.815177 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 07:24:27.815351 0.569153 tcp 10.0.2.105 57340 -> 31.192.24.67 3527 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/02/10 07:25:21.532341 0.076331 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:21.609074 0.217590 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:21.827025 0.046340 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:21.873792 0.058968 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:21.933214 0.071392 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.005008 0.337220 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.342589 0.068474 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.411420 0.147742 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.559523 0.168495 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.728440 0.073706 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.802538 0.038164 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:22.841109 0.205165 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.046662 0.172214 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.219231 0.055602 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 199 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.275233 0.165266 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.440874 0.238328 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.679601 0.162411 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.842383 0.126407 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:23.969187 0.080670 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:24.050263 0.155547 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:24.206272 0.147186 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:24.377485 0.424709 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:24.802586 0.180606 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:24.983583 0.146365 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:25.130283 0.218399 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:25.349068 0.114243 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:25.463654 0.486239 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:25.950260 0.054956 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:25:26.289135 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 07:27:39.493498 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 07:27:46.500835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:27:54.501962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:28:10.505243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:28:42.510986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:34:46.517587 3.001159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:34:53.524821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:35:01.526288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:35:17.529065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:35:49.535610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:41:53.541640 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:42:00.548740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:42:08.549958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:42:24.553073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:42:56.559327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:53:27.569248 3.001413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 07:53:34.576675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:53:42.577783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:53:58.581093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:54:28.385115 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 07:54:28.385259 0.672082 tcp 10.0.2.105 57341 -> 31.192.24.67 3527 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/10 07:54:30.590096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 07:55:40.608313 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 07:55:40.608522 0.051108 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:40.659977 0.059250 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:40.719628 0.067635 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:40.787696 0.095665 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:40.883763 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 07:55:58.164847 0.064851 tcp 10.0.2.105 57342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 07:55:58.229901 0.062314 tcp 10.0.2.105 57343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 07:55:58.292588 0.132200 tcp 10.0.2.105 57344 -> 195.113.214.249 443 SRPA* 0 0 37 27023 flow=From-Botnet-V2-TCP-Established 1970/02/10 07:55:58.425318 0.296326 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:58.722066 0.071794 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:58.794243 0.147155 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:58.941845 0.166045 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.108236 0.077564 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.186164 0.026662 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.213163 0.208147 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.421704 0.172897 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.595076 0.057652 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.653168 0.163674 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:55:59.817270 0.212858 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.030560 0.163176 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.194113 0.126115 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.320580 0.093599 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.414572 0.156674 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.571639 0.146732 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:00.718795 0.472186 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:01.191377 0.185373 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:01.377116 0.148416 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:01.525976 0.483376 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:02.009713 0.053619 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:02.063716 0.212531 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/10 07:56:02.276664 0.101856 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:00:34.593416 3.031885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:00:41.610262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:00:49.611939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:01:05.615045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:01:37.620306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:07:41.626923 3.001907 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:07:48.644301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:07:56.645787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:08:12.649088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:08:44.655018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:14:48.660382 3.002160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:14:55.668439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:15:03.669689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:15:19.673120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:15:51.678897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:21:55.684810 3.001825 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:22:02.692539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:22:10.693816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:22:26.696939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:22:58.703272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:24:29.063668 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:24:29.063775 0.571354 tcp 10.0.2.105 57345 -> 31.192.24.67 3527 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:26:25.830745 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:26:25.830910 0.217507 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.048769 0.047443 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.096598 0.072306 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.169224 0.059227 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.228816 0.082199 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.311398 0.278306 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.590147 0.064833 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:26.655397 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 08:26:45.071269 0.063511 tcp 10.0.2.105 57346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:26:45.135073 0.062601 tcp 10.0.2.105 57347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:26:45.197967 0.153694 tcp 10.0.2.105 57348 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:26:45.352520 0.164943 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:45.517912 0.074771 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:45.593044 0.029825 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:26:45.623289 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 08:27:03.285362 0.066685 tcp 10.0.2.105 57349 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:03.352467 0.063591 tcp 10.0.2.105 57350 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:03.416365 0.156458 tcp 10.0.2.105 57351 -> 195.113.214.249 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:03.573484 0.172269 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:03.746106 0.056903 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:03.803397 0.164796 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.010083 0.246113 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.256603 0.083873 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.340903 0.155804 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.497072 0.162623 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.660047 0.126037 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.786492 0.145822 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:04.932719 0.424833 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:05.357939 1.684231 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:07.042599 0.144996 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:07.042916 3.555014 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 SPA_* 0 0 22 9338 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:07.187997 0.467809 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:07.656239 0.114532 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:07.771177 0.200331 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:07.971907 0.244331 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:27:12.297706 0.191810 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 2 708 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:18.143551 4.850810 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 20 12520 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:26.437619 1.656343 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:32.436414 4.983585 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 13 8646 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:32.796873 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:27:37.462313 4.367363 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:43.146499 2.208447 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 5236 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:53.575049 3.828011 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 12 7536 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:27:58.293477 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:28:01.312668 3.850541 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 18 12516 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:12.434551 3.726241 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 15 11650 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:19.504495 1.992610 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 14 10396 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:25.102720 1.774783 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:30.762713 4.303266 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 8 4280 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:39.793415 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:28:42.370706 0.406405 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:48.073661 0.401783 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:53.642471 4.046541 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 6882 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:28:59.099226 4.217834 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 5092 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:02.708765 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 08:29:03.787508 0.001247 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:29:04.689843 0.000150 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 3 2810 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:09.716385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:29:12.577752 0.403181 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 5922 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:17.717882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:29:20.452855 1.843076 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:26.104728 4.081164 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 7338 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:31.287180 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:29:31.551277 4.922883 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 27 16994 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:33.720858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:29:37.372465 3.378562 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 33 17566 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:42.397155 4.632857 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 9 6630 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:48.574665 1.950223 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 12 7392 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:29:54.636738 1.770871 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 4474 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:00.602057 3.544951 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 21 12966 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:01.292767 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:30:05.726912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:30:11.978362 3.802600 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 14 7996 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:19.438108 1.799679 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 5444 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:25.795487 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:30:28.992409 4.163728 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 9 5718 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:34.509675 4.274546 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:42.281805 3.823006 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 7402 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:47.438845 4.114130 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 5370 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:52.946766 0.012074 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 6 4340 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:30:56.290004 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:31:08.764956 4.238304 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:14.355407 2.203328 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:19.802242 2.213728 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 15 11402 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:21.295315 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:31:36.837055 3.906444 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:44.212135 4.212920 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:45.294646 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:31:49.776217 4.285905 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:31:55.461091 1.926418 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 9 7582 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:00.583352 2.191726 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 16 12552 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:10.251559 3.554368 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:17.673992 4.328765 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:22.793658 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:32:23.348183 1.712400 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 12 6048 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:28.963180 4.002035 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 17 11758 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:36.609442 1.874148 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 3874 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:42.239272 1.793091 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 7 4474 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:47.288807 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:32:48.082986 4.172986 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 8 4424 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:32:59.663592 2.006485 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:05.105284 4.436145 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 11 7194 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:10.868853 4.260153 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:18.507814 3.862968 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 17 9616 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:30.021568 2.061937 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 10 6530 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:34.786934 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:33:35.837102 0.402262 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:43.844089 4.282337 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:33:49.591223 0.000198 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:34:19.591754 0.000080 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:36:09.734588 2.999925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 08:36:16.740473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:36:19.594609 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:36:19.594702 0.000000 tcp 10.0.2.105 57352 -> 24.234.227.235 6773 RA_ 0 0 1 54 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:36:24.741561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:36:40.744875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:37:12.750894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:43:16.757538 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:43:23.764005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:43:31.765855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:43:47.768981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:44:19.774438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:54:09.785509 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 08:54:16.793208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:54:24.803155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:54:29.645321 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:54:29.645455 0.600321 tcp 10.0.2.105 57353 -> 31.192.24.67 3527 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/10 08:54:40.797007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:55:12.803565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 08:57:14.368801 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 08:57:14.368952 0.147605 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:14.517007 0.205248 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:14.722670 0.215242 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:14.938318 0.045302 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:14.984152 0.277407 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:14.984516 2.999131 tcp 10.0.2.105 57354 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 08:57:15.261933 0.060976 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.323283 0.071704 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.395356 0.064798 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.460880 0.080704 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.542027 0.077708 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.620176 0.169143 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:15.789706 0.429365 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.219438 0.171490 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.391353 0.057099 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.448842 0.166005 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.615210 0.154704 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.770255 0.162716 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:16.933336 0.129357 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:17.063130 0.145766 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:17.209283 0.213489 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:17.423241 0.082440 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:17.506131 0.413642 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:17.920139 1.693562 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:19.614121 0.101814 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:19.716430 0.052875 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:19.769701 0.142964 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:19.913024 0.483048 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:20.396493 0.210613 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 08:57:23.982359 0.000000 tcp 10.0.2.105 57354 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 09:01:16.809708 3.001683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:01:23.817197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:01:31.818384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:01:47.821569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:02:19.827549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:08:23.833173 3.004144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:08:30.840928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:08:38.842310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:08:54.845744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:09:26.851562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:15:30.858751 3.000795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:15:37.865307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:15:45.866606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:16:01.869707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:16:33.875611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:22:37.880658 3.002539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:22:44.888363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:22:52.890648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:23:08.893277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:23:40.899429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:24:30.251164 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 09:24:30.251308 0.551137 tcp 10.0.2.105 57355 -> 31.192.24.67 3527 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/02/10 09:27:27.025275 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 09:27:27.025432 0.147456 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.173440 0.045525 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.173779 2.995555 tcp 10.0.2.105 57356 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 09:27:27.219420 0.204039 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.423833 0.214175 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.638443 0.276330 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.915180 0.059104 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:27.974696 0.071564 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.046666 0.074884 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.121996 0.075743 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.198128 0.078342 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.276912 0.172039 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.449352 0.058187 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.507945 0.417577 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:28.925952 0.172925 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.099244 0.165018 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.264710 0.155591 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.420693 0.164157 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.585295 0.129543 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.715223 0.149479 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:29.865065 0.213484 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:30.079040 0.084984 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:30.164481 0.433149 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:30.598014 1.604644 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:32.203040 0.114221 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:32.317641 0.053399 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:32.371427 0.145007 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:32.516829 0.832191 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:33.349406 0.221250 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:27:36.167590 0.000000 tcp 10.0.2.105 57356 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 09:29:44.905927 3.004397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 09:29:51.913233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:29:59.914553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:30:15.917427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:30:47.923594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:36:51.929369 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:36:58.936496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:37:06.938070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:37:22.941247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:37:54.947330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:43:58.952959 3.002013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:44:05.960808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:44:13.962786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:44:29.965430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:45:01.973261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:54:30.809799 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 09:54:30.809945 0.561105 tcp 10.0.2.105 57357 -> 31.192.24.67 3527 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/10 09:54:30.981966 3.001974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 09:54:37.988977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:54:45.990732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:55:01.998787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:55:34.000072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 09:58:01.011927 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 09:58:01.012029 0.147892 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.160404 0.043470 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.160750 3.005340 tcp 10.0.2.105 57358 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 09:58:01.204699 0.203041 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.408144 0.217422 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.625964 0.293466 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.919819 0.059342 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:01.979560 0.069712 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.049712 0.063737 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.113837 0.168838 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.283030 0.056362 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.339793 0.379868 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.720045 0.171856 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.892295 0.077474 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:02.970130 0.078247 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.048757 0.163897 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.213093 0.157621 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.371088 0.201162 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.572684 0.126299 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.699405 0.160940 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:03.860726 0.212867 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.074013 0.079089 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.153450 0.409253 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.563118 0.052923 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.616422 0.146262 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.763094 0.197249 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:04.960731 0.114254 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:05.075436 0.412159 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:05.488016 0.256561 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/10 09:58:10.164604 0.000000 tcp 10.0.2.105 57358 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 10:01:38.006989 3.000430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:01:45.013357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:01:53.015068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:02:09.017611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:02:41.024015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:08:45.030578 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:08:52.037611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:09:00.038865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:09:16.042274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:09:48.047546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:15:52.054569 3.000660 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:15:59.061392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:16:07.062848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:16:23.067382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:16:55.072141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:22:59.077789 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:23:06.085298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:23:14.086932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:23:30.089862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:24:02.096004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:24:31.380110 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 10:24:31.380208 0.517197 tcp 10.0.2.105 57359 -> 31.192.24.67 3527 FSPA* 0 0 14 1510 flow=From-Botnet-V2-TCP-Established 1970/02/10 10:28:20.678141 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 10:28:20.678229 0.204546 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:20.883171 0.146494 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.030160 0.045139 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.030556 3.002054 tcp 10.0.2.105 57360 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 10:28:21.075710 0.216406 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.292710 0.282438 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.575575 0.060201 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.636142 0.072289 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.708820 0.067188 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.776443 0.052743 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:21.829582 0.171386 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.001410 0.167788 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.169604 0.070123 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.240098 0.078924 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.319431 0.080297 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.400183 0.165446 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:22.566007 0.637769 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.204182 0.162961 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.367493 0.236867 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.604835 0.083241 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.688519 0.128148 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.817050 0.149492 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:23.966982 0.410667 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:24.378029 0.054004 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:24.432451 0.145373 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:24.578217 0.202456 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:24.781109 0.102001 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:24.883555 0.538058 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:25.422041 0.213251 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:28:30.031135 0.000000 tcp 10.0.2.105 57360 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 10:30:06.107897 2.999605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 10:30:13.109907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:30:21.110696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:30:37.113838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:31:09.122889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:37:13.126747 3.000589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:37:20.133126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:37:28.134908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:37:44.137975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:38:16.143805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:44:20.150902 3.000571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:44:27.157414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:44:35.158841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:44:51.161757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:45:23.167655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:54:31.899817 0.167162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 10:54:32.067157 0.647870 tcp 10.0.2.105 57361 -> 31.192.24.67 3527 FSPA* 0 0 12 1565 flow=From-Botnet-V2-TCP-Established 1970/02/10 10:54:43.257613 2.983910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 10:54:50.215317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:54:58.184806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:55:14.187209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:55:46.193631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 10:58:49.697584 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 10:58:49.697689 0.043417 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:49.741549 0.205855 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:49.741878 2.999884 tcp 10.0.2.105 57362 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 10:58:49.947869 0.145181 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.093488 0.214915 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.308780 0.284885 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.594035 0.057614 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.652037 0.072908 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.725438 0.066868 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.792690 0.029659 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.822697 0.173496 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:50.996622 0.169203 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.166218 0.057592 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.224188 0.076776 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.301317 0.075364 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.377079 0.183712 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.561177 0.238287 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.799795 0.082184 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:51.882351 0.125982 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:52.008697 0.146107 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:52.155211 0.851381 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.006928 0.162213 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.169550 0.421047 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.591032 0.052474 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.643935 0.144115 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.788663 0.202521 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:53.991614 0.114315 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:54.106307 1.167117 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:55.273858 0.219647 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/10 10:58:58.743575 0.000000 tcp 10.0.2.105 57362 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:01:50.199615 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:01:57.206988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:02:05.208512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:02:21.211498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:02:53.217716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:08:57.223248 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:09:04.230813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:09:12.232694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:09:28.235636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:10:00.241253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:16:04.246981 3.014925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:16:11.264954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:16:19.266575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:16:35.269232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:17:07.275669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:23:11.281435 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:23:18.288733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:23:26.290417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:23:42.293460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:24:14.299602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:24:32.556203 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 11:24:32.556353 2.993726 tcp 10.0.2.105 57363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:24:41.548585 0.000000 tcp 10.0.2.105 57363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:24:47.558762 0.061903 tcp 10.0.2.105 57364 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:24:47.620869 0.065239 tcp 10.0.2.105 57365 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:24:47.686372 0.132440 tcp 10.0.2.105 57366 -> 195.113.214.249 443 SRPA* 0 0 67 42273 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:24:47.868955 3.002973 tcp 10.0.2.105 57367 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:24:56.870594 0.000000 tcp 10.0.2.105 57367 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:25:02.869765 0.061212 tcp 10.0.2.105 57368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:25:02.931296 0.066939 tcp 10.0.2.105 57369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:25:02.998585 0.154710 tcp 10.0.2.105 57370 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:25:03.170289 0.536990 tcp 10.0.2.105 57371 -> 176.73.126.145 3888 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:29:17.876272 0.018175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 11:29:17.894525 0.145821 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.040873 0.215089 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.041204 2.989607 tcp 10.0.2.105 57372 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:29:18.256513 0.291839 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.548764 0.058399 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.607553 0.204893 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.812816 0.057480 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.870655 0.075559 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:18.946613 0.078405 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.025427 0.026193 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.052029 0.172960 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.225374 0.167195 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.392964 0.058149 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.451539 0.077475 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.529417 0.077657 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.607432 0.164986 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.772804 0.212818 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:19.986032 0.147446 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:20.133850 0.677600 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:20.811861 0.082073 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:20.894364 0.126373 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.021158 0.165374 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.186921 0.409305 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.596686 0.051318 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.648470 0.144224 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.793055 0.183573 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:21.976982 0.114010 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:22.091400 0.886449 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:22.978206 0.209542 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:29:27.029560 0.000000 tcp 10.0.2.105 57372 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:30:18.307798 3.002769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 11:30:25.313062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:30:33.316779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:30:49.317407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:31:21.323247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:37:25.329285 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:37:32.340144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:37:40.338264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:37:56.341543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:38:28.347481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:44:32.353359 3.001928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:44:39.361096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:44:47.362350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:45:03.365471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:45:35.373209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:54:50.382123 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 11:54:57.389337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:55:03.721771 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 11:55:03.721855 0.615086 tcp 10.0.2.105 57373 -> 176.73.126.145 3888 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:55:05.406003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:55:21.404029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:55:53.409951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 11:59:36.511063 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 11:59:36.511240 0.000000 udp 10.0.2.105 7010 -> 99.45.44.111 8496 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 11:59:52.835943 0.065590 tcp 10.0.2.105 57374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:59:52.901857 0.066062 tcp 10.0.2.105 57375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:59:52.968239 0.148278 tcp 10.0.2.105 57376 -> 195.113.214.249 443 SRPA* 0 0 42 32016 flow=From-Botnet-V2-TCP-Established 1970/02/10 11:59:53.117235 0.220548 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:53.338227 0.289764 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:53.628377 0.043790 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:53.672683 0.205476 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:53.673021 2.996770 tcp 10.0.2.105 57377 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 11:59:53.878518 0.057207 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:53.936103 0.073651 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.010114 0.077382 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.087844 0.036236 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.124662 0.171343 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.296385 0.186943 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.483701 0.057173 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.541269 0.075350 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.617016 0.074681 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.692076 0.164399 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:54.856942 0.213958 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:55.071263 0.146607 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:55.218265 0.126689 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:55.345364 0.732867 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.078612 0.117899 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.196953 0.164335 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.361637 0.414441 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.776665 0.053660 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.830726 0.144624 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:56.975762 0.192974 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:57.169157 0.114279 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:57.283826 0.778567 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/10 11:59:58.062805 0.212969 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:00:02.668592 0.000000 tcp 10.0.2.105 57377 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 12:01:57.416041 3.001687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:02:04.423421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:02:12.425079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:02:28.427898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:03:00.434212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:09:04.440031 3.035924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:09:11.458385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:09:19.459537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:09:35.463746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:10:07.467975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:16:11.473728 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:16:18.481339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:16:26.483288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:16:42.486355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:17:14.495741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:23:18.498178 3.001526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:23:25.505567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:23:33.506928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:23:49.509897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:24:21.516129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:25:04.328086 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 12:25:04.328240 0.517924 tcp 10.0.2.105 57378 -> 176.73.126.145 3888 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/10 12:30:22.521696 0.030728 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 12:30:22.552593 0.145631 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:22.698751 0.220487 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:22.699220 2.989317 tcp 10.0.2.105 57379 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 12:30:22.919698 0.281237 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.201373 0.042706 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.244519 0.204901 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.449793 0.057509 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.507667 0.073062 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.581141 0.061362 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.642947 0.026088 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.669390 0.170603 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:23.840394 0.169098 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.009928 0.057419 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.067785 0.080118 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.148513 0.075160 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.224047 0.166024 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.390565 0.257673 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.648652 0.148869 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.797912 0.125979 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:24.924288 0.162349 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:25.087049 0.153970 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:25.241470 0.083931 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:25.325890 0.432938 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:25.541515 2.990018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 12:30:25.759238 0.676101 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:26.435834 0.145891 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:26.582160 0.200359 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:26.782947 0.114545 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:26.897904 0.209718 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:27.108037 0.219689 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/10 12:30:31.673332 0.000000 tcp 10.0.2.105 57379 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 12:30:32.530497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:30:40.530760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:30:56.549331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:31:28.541999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:37:32.545425 3.002302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:37:39.553237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:37:47.554930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:38:03.557785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:38:35.563701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:44:39.570435 3.001089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:44:46.577313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:44:54.579086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:45:10.582089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:45:42.587598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:54:49.596506 3.002367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 12:54:56.604171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:55:04.605829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:55:04.846756 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 12:55:04.846935 0.473926 tcp 10.0.2.105 57380 -> 176.73.126.145 3888 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/10 12:55:20.608930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 12:55:52.615066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:00:39.637756 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:00:39.637951 0.145293 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:39.783789 0.220561 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:39.784442 2.997560 tcp 10.0.2.105 57381 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:00:40.004677 0.282633 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.287759 0.047022 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.335215 0.201496 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.537171 0.063971 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.601580 0.070788 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.672784 0.068952 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.742153 0.025589 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.768134 0.171463 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:40.940009 0.166135 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.106558 0.056693 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.163641 0.074960 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.239008 0.066888 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.306337 0.163531 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.470248 0.218432 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.689122 0.145997 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.835523 0.125345 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:41.961371 0.163108 udp 10.0.2.105 7010 <-> 70.37.216.96 5995 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:42.124880 0.422584 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:42.547906 0.256868 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:42.805159 0.080685 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:42.886231 0.778734 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:43.665300 0.145654 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:43.811264 0.193303 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:44.004938 0.102059 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:44.107403 0.218466 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:44.326305 0.220281 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:00:48.780301 0.000000 tcp 10.0.2.105 57381 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:01:56.620781 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 13:02:03.628522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:02:11.629929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:02:27.632947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:02:59.639097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:09:06.649736 3.001129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 13:09:13.656659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:09:21.658031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:09:37.661287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:10:09.667104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:16:13.673437 3.001432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 13:16:20.680509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:16:28.681994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:16:44.685081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:17:16.691186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:23:20.697003 3.073689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 13:23:27.742997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:23:35.716428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:23:51.719141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:24:23.725028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:25:05.325245 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:25:05.325395 2.993829 tcp 10.0.2.105 57382 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:14.317447 0.000000 tcp 10.0.2.105 57382 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:20.328866 0.062851 tcp 10.0.2.105 57383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:20.392066 0.064774 tcp 10.0.2.105 57384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:20.457554 0.129403 tcp 10.0.2.105 57385 -> 195.113.214.249 443 SRPA* 0 0 65 41563 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:20.605250 2.995803 tcp 10.0.2.105 57386 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:29.599886 0.000000 tcp 10.0.2.105 57386 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:35.599355 0.060814 tcp 10.0.2.105 57387 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:35.660528 0.061310 tcp 10.0.2.105 57388 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:35.722188 0.153034 tcp 10.0.2.105 57389 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:35.890182 3.002868 tcp 10.0.2.105 57390 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:44.891517 0.000000 tcp 10.0.2.105 57390 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:25:50.890738 0.064600 tcp 10.0.2.105 57391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:50.955621 0.060009 tcp 10.0.2.105 57392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:51.015858 0.149410 tcp 10.0.2.105 57393 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:25:51.180524 3.004496 tcp 10.0.2.105 57394 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:00.183676 0.000000 tcp 10.0.2.105 57394 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:06.173361 0.060164 tcp 10.0.2.105 57395 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:26:06.233845 0.062738 tcp 10.0.2.105 57396 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:26:06.296876 0.148004 tcp 10.0.2.105 57397 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:26:06.454709 3.002639 tcp 10.0.2.105 57398 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:15.465992 0.000000 tcp 10.0.2.105 57398 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:21.454488 2.994298 tcp 10.0.2.105 57399 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:30.457064 0.000000 tcp 10.0.2.105 57399 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:35.294494 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:26:36.456516 2.993261 tcp 10.0.2.105 57400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:45.449097 0.000000 tcp 10.0.2.105 57400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:51.458034 3.003908 tcp 10.0.2.105 57401 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:26:59.288521 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:27:00.460532 0.000000 tcp 10.0.2.105 57401 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:30:27.731187 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 13:30:34.740175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:30:42.740115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:30:58.743091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:31:01.777420 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:31:01.777604 0.145534 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:01.923635 0.049191 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:01.924012 2.997814 tcp 10.0.2.105 57402 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:31:01.973222 0.201787 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.175380 0.056432 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.232187 0.222646 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.455222 0.286652 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.742438 0.070202 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.813030 0.077985 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.891458 0.028655 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:02.920677 0.172384 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.093427 0.166882 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.260703 0.059234 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.320319 0.073008 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.393735 0.071578 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.465700 0.164661 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.630770 0.216991 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.848128 0.145014 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:03.993543 0.428028 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:04.421932 0.125773 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:04.548102 0.000000 udp 10.0.2.105 7010 -> 70.37.216.96 5995 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 13:31:10.919860 0.000000 tcp 10.0.2.105 57402 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:31:22.288544 0.061746 tcp 10.0.2.105 57403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:31:22.350561 0.061746 tcp 10.0.2.105 57404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:31:22.412572 0.153627 tcp 10.0.2.105 57405 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:31:22.566721 0.536820 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.103992 0.085397 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.104472 2.997984 tcp 10.0.2.105 57406 -> 99.26.224.9 1538 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:31:23.189773 0.054334 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.244521 0.143499 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.388428 0.186264 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.575084 0.212339 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.787792 0.114423 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:23.902602 0.219190 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/10 13:31:30.748949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:31:32.102244 0.000000 tcp 10.0.2.105 57406 -> 99.26.224.9 1538 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:31:45.937241 0.009593 udp 10.0.2.105 63113 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/02/10 13:31:45.947274 0.009726 udp 10.0.2.105 61567 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/02/10 13:31:50.787721 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:32:06.465247 3.000028 tcp 10.0.2.105 57407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:15.468200 0.000000 tcp 10.0.2.105 57407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:20.289634 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:32:21.463305 0.063088 tcp 10.0.2.105 57408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:21.526672 0.061757 tcp 10.0.2.105 57409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:21.588727 0.151479 tcp 10.0.2.105 57410 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:22.038016 3.010922 tcp 10.0.2.105 57411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:31.045163 0.000000 tcp 10.0.2.105 57411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:37.034893 0.061627 tcp 10.0.2.105 57412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:37.096799 0.061652 tcp 10.0.2.105 57413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:37.158834 0.149785 tcp 10.0.2.105 57414 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:37.324638 2.994457 tcp 10.0.2.105 57415 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:46.317753 0.000000 tcp 10.0.2.105 57415 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:32:52.328095 0.060036 tcp 10.0.2.105 57416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:52.388450 0.064488 tcp 10.0.2.105 57417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:52.453296 0.148628 tcp 10.0.2.105 57418 -> 195.113.214.249 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:32:52.666710 3.007697 tcp 10.0.2.105 57419 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:01.659920 0.000000 tcp 10.0.2.105 57419 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:07.659502 0.059613 tcp 10.0.2.105 57420 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:33:07.719044 0.060958 tcp 10.0.2.105 57421 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:33:07.780500 0.151475 tcp 10.0.2.105 57422 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:33:08.186205 2.997050 tcp 10.0.2.105 57423 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:17.182208 0.000000 tcp 10.0.2.105 57423 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:23.181325 3.003668 tcp 10.0.2.105 57424 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:32.183533 0.000000 tcp 10.0.2.105 57424 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:36.789914 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:33:38.182480 3.004122 tcp 10.0.2.105 57425 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:47.185311 0.000000 tcp 10.0.2.105 57425 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:33:53.183339 2.994603 tcp 10.0.2.105 57426 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:34:00.784489 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:34:02.186608 0.000000 tcp 10.0.2.105 57426 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:37:34.755221 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 13:37:41.762935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:37:49.764023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:38:05.767567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:38:37.780081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:39:08.186991 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:39:08.187158 3.003736 tcp 10.0.2.105 57427 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:17.189704 0.000000 tcp 10.0.2.105 57427 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:23.189978 0.066046 tcp 10.0.2.105 57428 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:23.256294 0.059879 tcp 10.0.2.105 57429 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:23.316404 0.150631 tcp 10.0.2.105 57430 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:23.839870 3.003509 tcp 10.0.2.105 57431 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:32.841985 0.000000 tcp 10.0.2.105 57431 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:38.841422 0.062737 tcp 10.0.2.105 57432 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:38.904457 0.062360 tcp 10.0.2.105 57433 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:38.967117 0.148044 tcp 10.0.2.105 57434 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:39:39.136392 2.999125 tcp 10.0.2.105 57435 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:48.134097 0.000000 tcp 10.0.2.105 57435 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:39:54.133312 3.003684 tcp 10.0.2.105 57436 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:40:03.135740 0.000000 tcp 10.0.2.105 57436 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:40:07.792674 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:44:41.778995 3.001317 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 13:44:48.786169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:44:56.787972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:45:09.136117 0.000270 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 13:45:09.136470 2.993367 tcp 10.0.2.105 57437 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:45:12.791288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:45:18.128411 0.000000 tcp 10.0.2.105 57437 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:45:24.138947 0.060732 tcp 10.0.2.105 57438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:45:24.199966 0.062572 tcp 10.0.2.105 57439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:45:24.262834 0.147631 tcp 10.0.2.105 57440 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 13:45:24.500982 3.000829 tcp 10.0.2.105 57441 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:45:33.500703 0.000000 tcp 10.0.2.105 57441 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 13:45:44.796904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:54:50.804213 3.029098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 13:54:57.822632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:55:05.823591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:55:21.826662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 13:55:53.832793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:01:31.608343 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:01:31.608529 0.000000 udp 10.0.2.105 7010 -> 70.37.216.96 5995 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 14:01:48.163620 0.098986 tcp 10.0.2.105 57442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:01:48.262863 0.061221 tcp 10.0.2.105 57443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:01:48.323922 0.173161 tcp 10.0.2.105 57444 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:01:48.497833 0.215585 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:01:48.705687 0.150135 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:01:54.571608 3.003895 tcp 10.0.2.105 57445 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:01:57.838248 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 14:02:03.574068 0.000000 tcp 10.0.2.105 57445 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:02:04.845789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:02:07.621419 0.061457 tcp 10.0.2.105 57446 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:07.683182 0.061671 tcp 10.0.2.105 57447 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:07.745195 0.151327 tcp 10.0.2.105 57448 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:07.897131 0.088565 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:07.941495 0.219715 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:07.941816 3.002304 tcp 10.0.2.105 57449 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:02:08.153956 0.290779 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:08.444453 0.110141 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:08.517952 0.067131 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:08.859562 0.042334 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 1992 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:08.893436 0.059657 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.009837 0.176869 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2564 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.183829 0.107579 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.261260 0.091971 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.378041 0.175624 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.546841 0.245020 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.573081 0.060412 tcp 10.0.2.105 57450 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:09.633817 0.059863 tcp 10.0.2.105 57451 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:09.693970 0.149459 tcp 10.0.2.105 57452 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:02:09.767277 0.169254 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.907476 3.000249 tcp 10.0.2.105 57453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:02:09.939420 0.068253 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:09.998494 0.173398 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:10.168562 0.127499 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:10.359104 0.440736 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:10.777978 0.809475 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:11.572090 0.133039 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:11.657947 0.074005 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:11.711567 0.178926 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:11.861501 0.205618 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:12.062011 0.248945 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:12.276528 0.115887 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:12.433300 0.869166 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:02:12.847526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:02:16.943304 0.000000 tcp 10.0.2.105 57449 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:02:18.916488 0.000000 tcp 10.0.2.105 57453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:02:28.850596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:03:00.856929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:07:24.912213 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:07:24.912380 2.988329 tcp 10.0.2.105 57454 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:07:33.898888 0.000000 tcp 10.0.2.105 57454 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:07:39.909705 0.061448 tcp 10.0.2.105 57455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:39.971428 0.060624 tcp 10.0.2.105 57456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:40.032324 0.149324 tcp 10.0.2.105 57457 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:40.569538 3.003534 tcp 10.0.2.105 57458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:07:49.571626 0.000000 tcp 10.0.2.105 57458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:07:55.570740 0.061009 tcp 10.0.2.105 57459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:55.632109 0.064658 tcp 10.0.2.105 57460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:55.697060 0.150480 tcp 10.0.2.105 57461 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:07:55.936170 2.998524 tcp 10.0.2.105 57462 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:04.933820 0.000000 tcp 10.0.2.105 57462 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:10.933404 0.061181 tcp 10.0.2.105 57463 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:10.994922 0.060432 tcp 10.0.2.105 57464 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:11.055632 0.149888 tcp 10.0.2.105 57465 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:11.283240 3.003950 tcp 10.0.2.105 57466 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:20.295600 0.000000 tcp 10.0.2.105 57466 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:26.284827 0.059936 tcp 10.0.2.105 57467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:26.345038 0.060732 tcp 10.0.2.105 57468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:26.406072 0.151417 tcp 10.0.2.105 57469 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:08:26.647349 3.001674 tcp 10.0.2.105 57470 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:35.648065 0.000000 tcp 10.0.2.105 57470 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:41.646759 2.994254 tcp 10.0.2.105 57471 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:50.639940 0.000000 tcp 10.0.2.105 57471 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:08:55.286162 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:08:56.648595 3.004032 tcp 10.0.2.105 57472 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:09:05.650830 0.000000 tcp 10.0.2.105 57472 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:09:07.871546 4.845092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:09:13.480920 2.970052 tcp 10.0.2.105 57473 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:09:16.677096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:09:21.030347 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:09:22.381085 0.000000 tcp 10.0.2.105 57473 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:09:24.588553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:09:40.402500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:10:12.040352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:14:26.653105 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:14:26.653192 3.003642 tcp 10.0.2.105 57474 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:14:35.655782 0.000000 tcp 10.0.2.105 57474 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:14:45.501841 0.060202 tcp 10.0.2.105 57475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:14:45.562347 0.060221 tcp 10.0.2.105 57476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:14:45.622822 0.148663 tcp 10.0.2.105 57477 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:14:45.897893 2.959613 tcp 10.0.2.105 57478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:14:54.776708 0.000000 tcp 10.0.2.105 57478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:00.699016 0.094315 tcp 10.0.2.105 57479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:00.793421 0.062079 tcp 10.0.2.105 57480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:00.855786 0.150491 tcp 10.0.2.105 57481 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:01.193847 2.955166 tcp 10.0.2.105 57482 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:10.070054 0.000000 tcp 10.0.2.105 57482 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:15.987038 0.063397 tcp 10.0.2.105 57483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:16.050679 0.061261 tcp 10.0.2.105 57484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:16.112226 0.148959 tcp 10.0.2.105 57485 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:16.805953 2.964236 tcp 10.0.2.105 57486 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:25.730370 0.000000 tcp 10.0.2.105 57486 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:31.632317 0.059313 tcp 10.0.2.105 57487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:31.691922 0.059678 tcp 10.0.2.105 57488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:31.751891 0.149751 tcp 10.0.2.105 57489 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:15:31.984890 2.971962 tcp 10.0.2.105 57490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:40.873906 0.000000 tcp 10.0.2.105 57490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:46.794218 2.954665 tcp 10.0.2.105 57491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:15:55.674024 0.000000 tcp 10.0.2.105 57491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:16:00.163658 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:16:01.591376 2.954554 tcp 10.0.2.105 57492 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:16:10.462239 0.000000 tcp 10.0.2.105 57492 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:16:16.384144 2.950716 tcp 10.0.2.105 57493 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:16:17.530183 2.965017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:16:23.836643 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:16:24.445288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:16:25.258205 0.000000 tcp 10.0.2.105 57493 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:16:34.232938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:16:50.030676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:17:21.612315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:21:29.001098 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:21:29.001250 2.968092 tcp 10.0.2.105 57494 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:21:37.887463 0.000000 tcp 10.0.2.105 57494 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:21:43.806464 0.060941 tcp 10.0.2.105 57495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:43.867689 0.060057 tcp 10.0.2.105 57496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:43.927977 0.149247 tcp 10.0.2.105 57497 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:44.369674 2.968545 tcp 10.0.2.105 57498 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:21:53.314801 0.000000 tcp 10.0.2.105 57498 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:21:59.313965 0.061262 tcp 10.0.2.105 57499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:59.375530 0.061447 tcp 10.0.2.105 57500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:59.437263 0.153167 tcp 10.0.2.105 57501 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:21:59.681768 2.996457 tcp 10.0.2.105 57502 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:08.686889 0.000000 tcp 10.0.2.105 57502 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:14.676194 0.059998 tcp 10.0.2.105 57503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:14.736467 0.064395 tcp 10.0.2.105 57504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:14.801137 0.149409 tcp 10.0.2.105 57505 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:14.977785 3.002409 tcp 10.0.2.105 57506 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:23.978850 0.000000 tcp 10.0.2.105 57506 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:29.978219 0.058856 tcp 10.0.2.105 57507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:30.037372 0.063044 tcp 10.0.2.105 57508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:30.100679 0.155295 tcp 10.0.2.105 57509 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:22:30.451806 3.000754 tcp 10.0.2.105 57510 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:39.451111 0.000000 tcp 10.0.2.105 57510 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:45.450014 3.004433 tcp 10.0.2.105 57511 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:54.452779 0.000000 tcp 10.0.2.105 57511 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:22:59.289417 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:23:00.451580 3.004214 tcp 10.0.2.105 57512 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:23:09.454313 0.000000 tcp 10.0.2.105 57512 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:23:15.452907 3.004304 tcp 10.0.2.105 57513 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:23:21.924713 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:23:23.284011 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:23:24.465783 0.000000 tcp 10.0.2.105 57513 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:23:28.932599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:23:36.933976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:23:52.936690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:24:24.942705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:28:30.456793 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:28:30.456886 2.993463 tcp 10.0.2.105 57514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:28:39.448802 0.000000 tcp 10.0.2.105 57514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:28:45.459326 0.060663 tcp 10.0.2.105 57515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:28:45.520457 0.061357 tcp 10.0.2.105 57516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:28:45.582096 0.146011 tcp 10.0.2.105 57517 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:28:45.738513 3.003746 tcp 10.0.2.105 57518 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:28:54.740561 0.000000 tcp 10.0.2.105 57518 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:00.739898 0.061060 tcp 10.0.2.105 57519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:00.801216 0.060946 tcp 10.0.2.105 57520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:00.862425 0.272618 tcp 10.0.2.105 57521 -> 195.113.214.249 443 SRPA* 0 0 29 15746 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:01.157269 2.975935 tcp 10.0.2.105 57522 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:10.082779 0.000000 tcp 10.0.2.105 57522 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:16.052030 0.059814 tcp 10.0.2.105 57523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:16.112156 0.063732 tcp 10.0.2.105 57524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:16.176162 0.151210 tcp 10.0.2.105 57525 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:16.350594 3.005448 tcp 10.0.2.105 57526 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:25.354071 0.000000 tcp 10.0.2.105 57526 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:31.343817 0.064021 tcp 10.0.2.105 57527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:31.408155 0.062328 tcp 10.0.2.105 57528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:31.470736 0.145151 tcp 10.0.2.105 57529 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:29:31.635951 2.992198 tcp 10.0.2.105 57530 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:40.636918 0.000000 tcp 10.0.2.105 57530 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:46.635461 2.994182 tcp 10.0.2.105 57531 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:29:55.628011 0.000000 tcp 10.0.2.105 57531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:30:00.284940 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:30:01.637209 2.994025 tcp 10.0.2.105 57532 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:30:10.629824 0.000000 tcp 10.0.2.105 57532 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:30:16.639062 3.004015 tcp 10.0.2.105 57533 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:30:24.289744 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:30:25.641433 0.000000 tcp 10.0.2.105 57533 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:30:28.949399 3.000659 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:30:35.956398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:30:43.957854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:30:59.960288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:31:31.966994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:32:25.684184 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:32:25.684415 0.155287 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:25.832463 0.216541 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:25.832845 2.995628 tcp 10.0.2.105 57534 -> 99.45.44.111 1232 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:32:26.040929 0.086753 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.090022 0.230954 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.314396 0.278975 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.594451 0.113884 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.667362 0.083133 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.750768 0.039838 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.778596 0.059518 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:26.836584 0.175420 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.008999 0.109371 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.085965 0.093110 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.158982 0.175479 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.327088 0.248677 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.553509 0.170969 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.701787 0.069655 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.761563 0.173328 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:27.931610 0.127916 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:28.096511 0.442921 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:28.518258 0.806772 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:29.310865 0.135330 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:29.396890 0.072538 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:29.482382 0.256077 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:29.704069 0.115595 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:29.828743 1.032146 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:30.852323 0.176615 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:30.999587 0.193466 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/10 14:32:34.837076 0.000000 tcp 10.0.2.105 57534 -> 99.45.44.111 1232 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:35:31.641906 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:35:31.642039 3.003740 tcp 10.0.2.105 57535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:35:40.644485 0.000000 tcp 10.0.2.105 57535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:35:46.644980 0.062186 tcp 10.0.2.105 57536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:35:46.707452 0.062277 tcp 10.0.2.105 57537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:35:46.770025 0.151231 tcp 10.0.2.105 57538 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:35:46.950781 2.998807 tcp 10.0.2.105 57539 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:35:55.958036 0.000000 tcp 10.0.2.105 57539 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:01.947948 0.063850 tcp 10.0.2.105 57540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:02.012098 0.060039 tcp 10.0.2.105 57541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:02.072434 0.146363 tcp 10.0.2.105 57542 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:02.418043 2.991628 tcp 10.0.2.105 57543 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:11.408152 0.000000 tcp 10.0.2.105 57543 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:17.420195 0.063822 tcp 10.0.2.105 57544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:17.484284 0.059850 tcp 10.0.2.105 57545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:17.544419 0.147084 tcp 10.0.2.105 57546 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:17.701211 3.000767 tcp 10.0.2.105 57547 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:26.700714 0.000000 tcp 10.0.2.105 57547 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:32.703595 0.060478 tcp 10.0.2.105 57548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:32.764524 0.063725 tcp 10.0.2.105 57549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:32.828649 0.153988 tcp 10.0.2.105 57550 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:36:33.013194 3.000698 tcp 10.0.2.105 57551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:42.012706 0.000000 tcp 10.0.2.105 57551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:48.011300 3.004044 tcp 10.0.2.105 57552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:36:57.013970 0.000000 tcp 10.0.2.105 57552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:37:01.790996 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:37:03.013438 3.003710 tcp 10.0.2.105 57553 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:37:12.015171 0.000000 tcp 10.0.2.105 57553 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:37:18.014731 2.993799 tcp 10.0.2.105 57554 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:37:25.785265 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:37:27.017283 0.000000 tcp 10.0.2.105 57554 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:37:35.972774 3.007092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:37:42.980006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:37:50.982859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:38:06.990779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:38:38.990198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:42:33.017859 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:42:33.018038 3.003535 tcp 10.0.2.105 57555 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:42:42.020162 0.000000 tcp 10.0.2.105 57555 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:42:48.020358 0.060351 tcp 10.0.2.105 57556 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:42:48.080970 0.060913 tcp 10.0.2.105 57557 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:42:48.142181 0.149783 tcp 10.0.2.105 57558 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:42:48.317676 3.005709 tcp 10.0.2.105 57559 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:42:57.322247 0.000000 tcp 10.0.2.105 57559 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:03.311796 0.060166 tcp 10.0.2.105 57560 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:03.372325 0.060736 tcp 10.0.2.105 57561 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:03.433418 0.149039 tcp 10.0.2.105 57562 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:03.622218 3.003231 tcp 10.0.2.105 57563 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:12.623978 0.000000 tcp 10.0.2.105 57563 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:18.623568 0.061218 tcp 10.0.2.105 57564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:18.685030 0.060679 tcp 10.0.2.105 57565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:18.746049 0.147356 tcp 10.0.2.105 57566 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:18.906119 2.991372 tcp 10.0.2.105 57567 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:27.906148 0.000000 tcp 10.0.2.105 57567 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:33.904873 0.059619 tcp 10.0.2.105 57568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:33.964743 0.060233 tcp 10.0.2.105 57569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:34.025296 0.150329 tcp 10.0.2.105 57570 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:43:34.207385 3.002278 tcp 10.0.2.105 57571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:43.207724 0.000000 tcp 10.0.2.105 57571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:49.207431 2.993696 tcp 10.0.2.105 57572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:43:58.199674 0.000000 tcp 10.0.2.105 57572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:44:02.785896 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:44:04.208540 3.004025 tcp 10.0.2.105 57573 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:44:13.211137 0.000000 tcp 10.0.2.105 57573 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:44:19.211784 3.002190 tcp 10.0.2.105 57574 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:44:26.792903 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:44:28.212908 0.000000 tcp 10.0.2.105 57574 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:44:42.996182 3.002529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:44:50.003944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:44:58.009919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:45:14.009256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:45:46.015312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:49:34.213167 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:49:34.213271 3.003725 tcp 10.0.2.105 57575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:49:43.225866 0.000000 tcp 10.0.2.105 57575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:49:49.225431 0.062622 tcp 10.0.2.105 57576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:49:49.288500 0.060690 tcp 10.0.2.105 57577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:49:49.349479 0.157641 tcp 10.0.2.105 57578 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:49:49.591927 2.987784 tcp 10.0.2.105 57579 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:49:58.577653 0.000000 tcp 10.0.2.105 57579 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:04.577245 0.061563 tcp 10.0.2.105 57580 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:04.639099 0.064026 tcp 10.0.2.105 57581 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:04.703471 0.152040 tcp 10.0.2.105 57582 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:04.956626 2.994552 tcp 10.0.2.105 57583 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:13.949748 0.000000 tcp 10.0.2.105 57583 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:19.948977 0.059418 tcp 10.0.2.105 57584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:20.008748 0.062141 tcp 10.0.2.105 57585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:20.071144 0.203474 tcp 10.0.2.105 57586 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:20.338719 3.004544 tcp 10.0.2.105 57587 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:29.342104 0.000000 tcp 10.0.2.105 57587 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:35.331241 0.060051 tcp 10.0.2.105 57588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:35.391541 0.060655 tcp 10.0.2.105 57589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:35.452627 0.146206 tcp 10.0.2.105 57590 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:50:35.714802 3.000805 tcp 10.0.2.105 57591 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:44.714255 0.000000 tcp 10.0.2.105 57591 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:50.713044 3.004269 tcp 10.0.2.105 57592 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:50:59.715769 0.000000 tcp 10.0.2.105 57592 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:51:04.292562 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:51:05.714135 2.994543 tcp 10.0.2.105 57593 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:51:14.717599 0.000000 tcp 10.0.2.105 57593 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:51:20.716467 2.993619 tcp 10.0.2.105 57594 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:51:28.286883 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:51:29.708931 0.000000 tcp 10.0.2.105 57594 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:54:52.021835 3.002179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 14:54:59.029153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:55:07.031124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:55:23.034155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:55:55.039722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 14:56:35.719485 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:56:35.719625 3.003801 tcp 10.0.2.105 57595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:56:44.721699 0.000000 tcp 10.0.2.105 57595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:56:50.722590 0.060846 tcp 10.0.2.105 57596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:56:50.783663 0.103593 tcp 10.0.2.105 57597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:56:50.887580 0.147540 tcp 10.0.2.105 57598 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:56:51.259303 3.006259 tcp 10.0.2.105 57599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:00.263951 0.000000 tcp 10.0.2.105 57599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:06.253394 0.063005 tcp 10.0.2.105 57600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:06.316702 0.088446 tcp 10.0.2.105 57601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:06.405372 0.149451 tcp 10.0.2.105 57602 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:06.855163 2.992556 tcp 10.0.2.105 57603 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:15.856774 0.000000 tcp 10.0.2.105 57603 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:21.856008 0.059068 tcp 10.0.2.105 57604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:21.915462 0.061406 tcp 10.0.2.105 57605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:21.977131 0.158720 tcp 10.0.2.105 57606 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:22.214146 2.995807 tcp 10.0.2.105 57607 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:31.208758 0.000000 tcp 10.0.2.105 57607 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:37.207690 0.062428 tcp 10.0.2.105 57608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:37.270419 0.061558 tcp 10.0.2.105 57609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:37.332262 0.149594 tcp 10.0.2.105 57610 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 14:57:37.527195 3.004764 tcp 10.0.2.105 57611 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:46.530507 0.000000 tcp 10.0.2.105 57611 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:57:52.519642 3.003753 tcp 10.0.2.105 57612 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:58:01.522128 0.000000 tcp 10.0.2.105 57612 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:58:06.289042 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:58:07.521107 3.003915 tcp 10.0.2.105 57613 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:58:16.523682 0.000000 tcp 10.0.2.105 57613 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:58:22.522459 3.004265 tcp 10.0.2.105 57614 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 14:58:30.293461 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 14:58:31.525401 0.000000 tcp 10.0.2.105 57614 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:01:59.046595 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:02:06.053707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:02:14.055414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:02:30.058720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:02:59.273050 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:02:59.273199 0.083992 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:02:59.319068 0.156398 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:02:59.319418 3.003199 tcp 10.0.2.105 57615 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:02:59.502453 0.214500 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:02:59.709654 0.226526 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:02:59.928734 0.333079 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:00.312139 0.108098 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:00.384103 0.083589 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:00.557182 0.039772 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:00.709029 0.060280 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:00.869235 0.178950 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2549 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:01.041981 0.103492 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 1948 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:01.254313 0.088865 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:01.326033 0.173738 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:01.579520 0.249045 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:01.803703 0.170025 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:02.062569 0.081737 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:02.072346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:03:02.135137 0.175483 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:02.307117 0.127092 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:02.549043 0.461829 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:02.989785 0.733487 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:03.707859 0.129640 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:03.897300 0.073510 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:03.951051 0.244781 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:04.164079 0.115776 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:04.295197 0.192355 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:04.479588 1.091462 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:05.568279 0.174153 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:03:08.313331 0.000000 tcp 10.0.2.105 57615 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:03:37.525590 2.994092 tcp 10.0.2.105 57616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:03:42.292770 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:03:46.518376 0.000000 tcp 10.0.2.105 57616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:03:52.528934 0.064184 tcp 10.0.2.105 57617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:03:52.593470 0.063799 tcp 10.0.2.105 57618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:03:52.657518 0.152254 tcp 10.0.2.105 57619 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:03:52.868503 3.003055 tcp 10.0.2.105 57620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:01.869883 0.000000 tcp 10.0.2.105 57620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:07.869501 0.065071 tcp 10.0.2.105 57621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:07.934766 0.060604 tcp 10.0.2.105 57622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:07.995726 0.149466 tcp 10.0.2.105 57623 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:08.157722 3.005812 tcp 10.0.2.105 57624 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:17.162154 0.000000 tcp 10.0.2.105 57624 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:23.151182 0.059989 tcp 10.0.2.105 57625 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:23.211490 0.061063 tcp 10.0.2.105 57626 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:23.272759 0.153483 tcp 10.0.2.105 57627 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:23.441835 3.003685 tcp 10.0.2.105 57628 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:32.444154 0.000000 tcp 10.0.2.105 57628 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:38.443722 0.059758 tcp 10.0.2.105 57629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:38.503832 0.063763 tcp 10.0.2.105 57630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:38.567929 0.151838 tcp 10.0.2.105 57631 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:04:38.753772 2.993943 tcp 10.0.2.105 57632 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:47.756256 0.000000 tcp 10.0.2.105 57632 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:04:53.755128 2.993979 tcp 10.0.2.105 57633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:05:02.747803 0.000000 tcp 10.0.2.105 57633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:05:07.284534 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:05:08.762354 2.994512 tcp 10.0.2.105 57634 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:05:17.754682 0.000000 tcp 10.0.2.105 57634 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:05:23.759807 3.003322 tcp 10.0.2.105 57635 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:05:31.289084 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:05:32.761192 0.000000 tcp 10.0.2.105 57635 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:09:10.075083 3.002858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:09:17.083502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:09:25.084938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:09:41.087928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:10:13.093978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:10:38.761434 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:10:38.761523 3.003623 tcp 10.0.2.105 57636 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:10:47.764631 0.000000 tcp 10.0.2.105 57636 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:10:53.764930 0.060990 tcp 10.0.2.105 57637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:10:53.826197 0.066688 tcp 10.0.2.105 57638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:10:53.893215 0.150425 tcp 10.0.2.105 57639 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:10:54.269458 2.998537 tcp 10.0.2.105 57640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:05.207648 0.000000 tcp 10.0.2.105 57640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:11.124172 0.062953 tcp 10.0.2.105 57641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:11.187414 0.060581 tcp 10.0.2.105 57642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:11.248531 0.152365 tcp 10.0.2.105 57643 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:11.743551 2.954867 tcp 10.0.2.105 57644 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:20.629091 0.000000 tcp 10.0.2.105 57644 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:26.558965 0.059711 tcp 10.0.2.105 57645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:26.618961 0.059316 tcp 10.0.2.105 57646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:26.678521 0.155662 tcp 10.0.2.105 57647 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:26.888792 2.963207 tcp 10.0.2.105 57648 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:35.776497 0.000000 tcp 10.0.2.105 57648 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:41.705465 0.059550 tcp 10.0.2.105 57649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:41.765300 0.059254 tcp 10.0.2.105 57650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:41.824859 0.148255 tcp 10.0.2.105 57651 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:11:42.109196 2.967655 tcp 10.0.2.105 57652 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:50.999209 0.000000 tcp 10.0.2.105 57652 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:11:56.921416 3.214146 tcp 10.0.2.105 57653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:12:06.058800 0.000000 tcp 10.0.2.105 57653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:12:10.662360 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:12:11.995486 2.969783 tcp 10.0.2.105 57654 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:12:20.898944 0.000000 tcp 10.0.2.105 57654 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:12:26.812438 2.956653 tcp 10.0.2.105 57655 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:12:34.366236 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:12:35.702347 0.000000 tcp 10.0.2.105 57655 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:16:17.099492 3.002199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:16:24.107625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:16:32.108576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:16:48.111914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:17:20.661054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:17:40.924089 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:17:40.924395 2.960961 tcp 10.0.2.105 57656 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:17:49.810809 0.000000 tcp 10.0.2.105 57656 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:17:55.740229 0.061417 tcp 10.0.2.105 57657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:17:55.801915 0.062669 tcp 10.0.2.105 57658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:17:55.864851 0.153896 tcp 10.0.2.105 57659 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:17:56.143303 2.966141 tcp 10.0.2.105 57660 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:05.052067 0.000000 tcp 10.0.2.105 57660 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:11.051313 0.061733 tcp 10.0.2.105 57661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:11.113379 0.061070 tcp 10.0.2.105 57662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:11.174732 0.152013 tcp 10.0.2.105 57663 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:11.618354 3.008332 tcp 10.0.2.105 57664 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:20.624917 0.000000 tcp 10.0.2.105 57664 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:26.614138 0.059681 tcp 10.0.2.105 57665 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:26.674109 0.062153 tcp 10.0.2.105 57666 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:26.736519 0.149467 tcp 10.0.2.105 57667 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:26.901231 2.997018 tcp 10.0.2.105 57668 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:35.908816 0.000000 tcp 10.0.2.105 57668 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:41.900116 0.060099 tcp 10.0.2.105 57669 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:41.960536 0.061327 tcp 10.0.2.105 57670 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:42.022130 0.148745 tcp 10.0.2.105 57671 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:18:42.413181 2.997619 tcp 10.0.2.105 57672 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:51.418948 0.000000 tcp 10.0.2.105 57672 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:18:57.410953 3.001061 tcp 10.0.2.105 57673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:19:06.410584 0.000000 tcp 10.0.2.105 57673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:19:11.287861 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:19:12.409410 3.005701 tcp 10.0.2.105 57674 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:19:21.412452 0.000000 tcp 10.0.2.105 57674 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:19:27.411123 3.004004 tcp 10.0.2.105 57675 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:19:35.292216 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:19:36.413905 0.000000 tcp 10.0.2.105 57675 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:23:24.134308 3.007938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:23:31.141577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:23:39.142856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:23:55.151129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:24:27.153111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:24:42.414327 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:24:42.414545 2.993662 tcp 10.0.2.105 57676 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:24:51.416810 0.000000 tcp 10.0.2.105 57676 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:24:57.418127 0.062114 tcp 10.0.2.105 57677 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:24:57.480546 0.060879 tcp 10.0.2.105 57678 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:24:57.541708 0.149161 tcp 10.0.2.105 57679 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:24:58.242671 2.998229 tcp 10.0.2.105 57680 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:07.242704 0.000000 tcp 10.0.2.105 57680 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:13.248472 0.060406 tcp 10.0.2.105 57681 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:13.309149 0.062976 tcp 10.0.2.105 57682 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:13.372575 0.147948 tcp 10.0.2.105 57683 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:13.755529 2.997586 tcp 10.0.2.105 57684 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:22.751907 0.000000 tcp 10.0.2.105 57684 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:28.751220 0.069882 tcp 10.0.2.105 57685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:28.821342 0.064371 tcp 10.0.2.105 57686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:28.885989 0.154068 tcp 10.0.2.105 57687 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:29.478540 3.007562 tcp 10.0.2.105 57688 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:38.484290 0.000000 tcp 10.0.2.105 57688 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:44.478290 0.060876 tcp 10.0.2.105 57689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:44.539453 0.060302 tcp 10.0.2.105 57690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:44.600088 0.153977 tcp 10.0.2.105 57691 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:25:44.893034 2.984791 tcp 10.0.2.105 57692 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:53.886643 0.000000 tcp 10.0.2.105 57692 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:25:59.885333 2.993935 tcp 10.0.2.105 57693 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:26:08.878080 0.000000 tcp 10.0.2.105 57693 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:26:13.786231 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:26:14.886971 2.994419 tcp 10.0.2.105 57694 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:26:23.879582 0.000000 tcp 10.0.2.105 57694 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:26:29.888365 3.004202 tcp 10.0.2.105 57695 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:26:37.789411 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:26:38.891455 0.000000 tcp 10.0.2.105 57695 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:30:31.157698 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:30:38.165141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:30:46.167046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:31:02.169658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:31:34.175850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:33:07.239978 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:33:07.240154 0.092122 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:07.292044 0.157093 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:07.292527 3.001456 tcp 10.0.2.105 57696 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:07.441604 0.231487 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:07.664654 0.230312 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:07.888738 0.346825 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.244855 0.108884 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.316792 0.069496 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.391729 0.176014 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.563958 0.110293 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.694001 0.094856 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.769524 0.173720 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:08.936557 0.033922 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.061828 0.071049 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.167895 0.247442 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.392393 0.175728 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.577363 0.068529 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.636853 0.174123 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.806544 0.126280 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:09.972835 0.445884 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:10.397944 0.887647 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 3 788 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:11.282589 0.135308 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:11.369190 0.072644 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:11.441752 0.247065 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:11.655367 0.115646 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:11.824999 0.190166 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:12.008803 0.889242 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:12.891442 0.175849 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/10 15:33:14.900492 3.004447 tcp 10.0.2.105 57697 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:16.292929 0.000000 tcp 10.0.2.105 57696 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:23.903458 0.000000 tcp 10.0.2.105 57697 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:29.904127 0.061915 tcp 10.0.2.105 57698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:29.966357 0.061481 tcp 10.0.2.105 57699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:30.028149 0.145727 tcp 10.0.2.105 57700 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:30.222783 3.004335 tcp 10.0.2.105 57701 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:39.225213 0.000000 tcp 10.0.2.105 57701 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:45.225554 0.061001 tcp 10.0.2.105 57702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:45.286855 0.062264 tcp 10.0.2.105 57703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:45.349423 0.155242 tcp 10.0.2.105 57704 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:33:45.722581 2.996720 tcp 10.0.2.105 57705 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:33:54.717887 0.000000 tcp 10.0.2.105 57705 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:00.717335 0.061136 tcp 10.0.2.105 57706 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:00.778718 0.061411 tcp 10.0.2.105 57707 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:00.840403 0.151294 tcp 10.0.2.105 57708 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:01.017035 3.008280 tcp 10.0.2.105 57709 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:10.020893 0.000000 tcp 10.0.2.105 57709 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:16.019444 0.061675 tcp 10.0.2.105 57710 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:16.081410 0.060710 tcp 10.0.2.105 57711 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:16.142406 0.148077 tcp 10.0.2.105 57712 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:34:16.305639 2.997651 tcp 10.0.2.105 57713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:25.301996 0.000000 tcp 10.0.2.105 57713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:31.301226 3.003533 tcp 10.0.2.105 57714 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:40.303389 0.000000 tcp 10.0.2.105 57714 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:45.290859 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:34:46.302432 3.003965 tcp 10.0.2.105 57715 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:34:55.305128 0.000000 tcp 10.0.2.105 57715 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:35:01.303863 2.994268 tcp 10.0.2.105 57716 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:35:09.285257 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:35:10.306708 0.000000 tcp 10.0.2.105 57716 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:37:38.185074 2.998675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:37:45.189659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:37:53.191938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:38:09.193954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:38:41.199365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:40:16.307346 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:40:16.307446 3.003839 tcp 10.0.2.105 57717 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:40:25.309657 0.000000 tcp 10.0.2.105 57717 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:40:31.309702 0.060953 tcp 10.0.2.105 57718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:31.370937 0.060545 tcp 10.0.2.105 57719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:31.431836 0.152508 tcp 10.0.2.105 57720 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:31.714964 2.998028 tcp 10.0.2.105 57721 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:40:40.711615 0.000000 tcp 10.0.2.105 57721 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:40:46.711867 0.059816 tcp 10.0.2.105 57722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:46.772042 0.064061 tcp 10.0.2.105 57723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:46.836414 0.151348 tcp 10.0.2.105 57724 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:40:47.107925 3.007467 tcp 10.0.2.105 57725 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:40:56.113771 0.000000 tcp 10.0.2.105 57725 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:02.103278 0.062337 tcp 10.0.2.105 57726 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:02.165868 0.061292 tcp 10.0.2.105 57727 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:02.227470 0.152477 tcp 10.0.2.105 57728 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:02.390818 3.006466 tcp 10.0.2.105 57729 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:11.406095 0.000000 tcp 10.0.2.105 57729 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:17.384860 0.060046 tcp 10.0.2.105 57730 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:17.445147 0.062185 tcp 10.0.2.105 57731 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:17.507678 0.149894 tcp 10.0.2.105 57732 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:41:17.841234 2.997831 tcp 10.0.2.105 57733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:26.838012 0.000000 tcp 10.0.2.105 57733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:32.836680 3.004601 tcp 10.0.2.105 57734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:41.839381 0.000000 tcp 10.0.2.105 57734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:46.786448 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:41:47.838329 3.004257 tcp 10.0.2.105 57735 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:41:56.841309 0.000000 tcp 10.0.2.105 57735 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:42:02.840022 3.003929 tcp 10.0.2.105 57736 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:42:10.791081 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:42:11.843157 0.000000 tcp 10.0.2.105 57736 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:44:45.205492 3.003679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:44:52.213191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:45:00.217891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:45:16.217814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:45:48.225796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:47:17.849708 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:47:17.849847 2.999394 tcp 10.0.2.105 57737 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:47:26.848716 0.000000 tcp 10.0.2.105 57737 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:47:32.845658 0.060353 tcp 10.0.2.105 57738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:32.906239 0.062257 tcp 10.0.2.105 57739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:32.968756 0.149611 tcp 10.0.2.105 57740 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:33.203860 2.995270 tcp 10.0.2.105 57741 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:47:42.207728 0.000000 tcp 10.0.2.105 57741 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:47:48.196628 0.388442 tcp 10.0.2.105 57742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:48.585352 0.060327 tcp 10.0.2.105 57743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:48.645987 0.147293 tcp 10.0.2.105 57744 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:47:48.864415 3.000400 tcp 10.0.2.105 57745 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:47:57.859891 0.000000 tcp 10.0.2.105 57745 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:03.861715 0.059522 tcp 10.0.2.105 57746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:03.921486 0.064877 tcp 10.0.2.105 57747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:03.986662 0.154313 tcp 10.0.2.105 57748 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:04.214931 2.988639 tcp 10.0.2.105 57749 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:13.202589 0.000000 tcp 10.0.2.105 57749 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:19.201457 0.061375 tcp 10.0.2.105 57750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:19.263124 0.060702 tcp 10.0.2.105 57751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:19.324082 0.150349 tcp 10.0.2.105 57752 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:48:19.961118 3.005083 tcp 10.0.2.105 57753 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:28.964977 0.000000 tcp 10.0.2.105 57753 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:34.953638 2.995090 tcp 10.0.2.105 57754 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:43.956848 0.000000 tcp 10.0.2.105 57754 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:48.783438 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:48:49.955528 2.999824 tcp 10.0.2.105 57755 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:48:58.951595 0.000000 tcp 10.0.2.105 57755 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:49:04.957149 2.993838 tcp 10.0.2.105 57756 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:49:12.791826 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:49:13.950756 0.000000 tcp 10.0.2.105 57756 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:51:52.230267 3.001321 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:51:59.237497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:52:07.238868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:52:23.241760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:52:55.247776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:54:19.960069 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:54:19.960172 3.006677 tcp 10.0.2.105 57757 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:54:28.962567 0.000000 tcp 10.0.2.105 57757 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:54:34.962879 0.060253 tcp 10.0.2.105 57758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:35.023420 0.067737 tcp 10.0.2.105 57759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:35.091570 0.154125 tcp 10.0.2.105 57760 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:35.347046 3.006738 tcp 10.0.2.105 57761 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:54:44.345052 0.000000 tcp 10.0.2.105 57761 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:54:50.344081 0.061671 tcp 10.0.2.105 57762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:50.406041 0.060312 tcp 10.0.2.105 57763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:50.466693 0.153379 tcp 10.0.2.105 57764 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:54:50.834395 2.993846 tcp 10.0.2.105 57765 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:54:59.842610 0.000000 tcp 10.0.2.105 57765 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:05.836445 0.059737 tcp 10.0.2.105 57766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:05.896679 0.062821 tcp 10.0.2.105 57767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:05.959809 0.153542 tcp 10.0.2.105 57768 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:06.351899 3.000247 tcp 10.0.2.105 57769 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:15.349198 0.000000 tcp 10.0.2.105 57769 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:21.348529 0.063495 tcp 10.0.2.105 57770 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:21.412424 0.062312 tcp 10.0.2.105 57771 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:21.475045 0.155904 tcp 10.0.2.105 57772 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 15:55:21.817917 3.004877 tcp 10.0.2.105 57773 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:30.821412 0.000000 tcp 10.0.2.105 57773 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:36.810295 3.003853 tcp 10.0.2.105 57774 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:45.813069 0.000000 tcp 10.0.2.105 57774 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:55:50.790075 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:55:51.811988 3.009391 tcp 10.0.2.105 57775 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:56:00.814614 0.000000 tcp 10.0.2.105 57775 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:56:06.813464 2.996596 tcp 10.0.2.105 57776 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:56:14.784564 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 15:56:15.816011 0.000000 tcp 10.0.2.105 57776 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 15:58:59.254950 3.000949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 15:59:06.261211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:59:14.262712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 15:59:30.265594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:00:02.271933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:03:23.020917 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:03:23.021040 0.219489 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:23.232593 0.229747 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:23.453781 0.090954 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:23.505598 0.155204 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:23.506090 2.999536 tcp 10.0.2.105 57777 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:03:23.704829 0.301766 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.005837 0.110449 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.078501 0.076293 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2557 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.192291 0.176313 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.365782 0.102802 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.438896 0.090038 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.510916 0.173410 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.677703 0.037601 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.761394 0.059830 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:24.819999 0.282304 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:25.070286 0.165343 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:25.321216 0.068537 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:25.380307 0.265659 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:25.704599 0.127797 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:25.956496 0.444533 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:26.379045 0.532122 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:26.895171 0.133634 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:27.158610 0.074144 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:27.212288 0.246804 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:27.425392 0.115596 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:27.637001 0.199097 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:27.827973 1.139419 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 5 1744 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:28.965534 0.174071 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:03:32.510908 0.000000 tcp 10.0.2.105 57777 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:03:36.832443 3.002013 tcp 10.0.2.105 57778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:03:45.833164 0.000000 tcp 10.0.2.105 57778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:03:50.790381 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:03:51.833907 0.064940 tcp 10.0.2.105 57779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:03:51.899096 0.063664 tcp 10.0.2.105 57780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:03:51.963065 0.153871 tcp 10.0.2.105 57781 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:03:52.149135 3.007554 tcp 10.0.2.105 57782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:01.155396 0.000000 tcp 10.0.2.105 57782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:07.144818 0.065154 tcp 10.0.2.105 57783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:07.210247 0.064033 tcp 10.0.2.105 57784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:07.274589 0.172902 tcp 10.0.2.105 57785 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:07.603083 2.995728 tcp 10.0.2.105 57786 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:16.607204 0.000000 tcp 10.0.2.105 57786 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:22.596933 0.061279 tcp 10.0.2.105 57787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:22.658485 0.060631 tcp 10.0.2.105 57788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:22.719393 0.156612 tcp 10.0.2.105 57789 -> 195.113.214.249 443 SRPA* 0 0 35 18596 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:22.961704 2.998810 tcp 10.0.2.105 57790 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:31.958939 0.000000 tcp 10.0.2.105 57790 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:37.958765 0.060706 tcp 10.0.2.105 57791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:38.019795 0.060901 tcp 10.0.2.105 57792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:38.081044 0.148567 tcp 10.0.2.105 57793 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:04:38.289426 3.003689 tcp 10.0.2.105 57794 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:47.291790 0.000000 tcp 10.0.2.105 57794 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:04:53.290298 3.004915 tcp 10.0.2.105 57795 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:05:02.293315 0.000000 tcp 10.0.2.105 57795 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:05:07.290257 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:05:08.291923 3.006879 tcp 10.0.2.105 57796 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:05:17.299638 0.000000 tcp 10.0.2.105 57796 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:05:23.302327 2.986364 tcp 10.0.2.105 57797 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:05:31.284710 0.207103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:05:32.483841 0.000000 tcp 10.0.2.105 57797 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:06:15.293637 2.996984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:06:22.288078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:06:30.289809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:06:46.292745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:07:18.298539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:10:38.297346 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:10:38.297505 2.993038 tcp 10.0.2.105 57798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:10:47.289055 0.000000 tcp 10.0.2.105 57798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:10:53.300546 0.060719 tcp 10.0.2.105 57799 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:10:53.361541 0.061135 tcp 10.0.2.105 57800 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:10:53.423038 0.150435 tcp 10.0.2.105 57801 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:10:53.585456 2.997025 tcp 10.0.2.105 57802 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:02.582497 0.000000 tcp 10.0.2.105 57802 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:08.580591 0.061701 tcp 10.0.2.105 57803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:08.642539 0.061626 tcp 10.0.2.105 57804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:08.704638 0.151078 tcp 10.0.2.105 57805 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:08.960627 3.004165 tcp 10.0.2.105 57806 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:17.963308 0.000000 tcp 10.0.2.105 57806 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:23.964086 0.061256 tcp 10.0.2.105 57807 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:24.025188 0.061553 tcp 10.0.2.105 57808 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:24.087034 0.149837 tcp 10.0.2.105 57809 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:24.379170 3.007833 tcp 10.0.2.105 57810 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:33.385398 0.000000 tcp 10.0.2.105 57810 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:39.375968 0.060140 tcp 10.0.2.105 57811 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:39.436540 0.061180 tcp 10.0.2.105 57812 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:39.497940 0.148832 tcp 10.0.2.105 57813 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:11:39.835258 2.983758 tcp 10.0.2.105 57814 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:48.827388 0.000000 tcp 10.0.2.105 57814 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:11:54.826314 2.994293 tcp 10.0.2.105 57815 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:12:03.819042 0.000000 tcp 10.0.2.105 57815 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:12:08.786074 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:12:09.827892 3.004294 tcp 10.0.2.105 57816 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:12:18.830692 0.000000 tcp 10.0.2.105 57816 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:12:24.829623 3.010214 tcp 10.0.2.105 57817 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:12:32.790385 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:12:33.831998 0.000000 tcp 10.0.2.105 57817 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:13:22.305095 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:13:29.311943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:13:37.313528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:13:53.316913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:14:25.322841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:17:39.832899 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:17:39.832992 3.003588 tcp 10.0.2.105 57818 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:17:48.835090 0.000000 tcp 10.0.2.105 57818 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:17:54.835259 0.064365 tcp 10.0.2.105 57819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:17:54.899851 0.064377 tcp 10.0.2.105 57820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:17:54.964685 0.154335 tcp 10.0.2.105 57821 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:17:55.507407 3.002324 tcp 10.0.2.105 57822 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:04.507746 0.000000 tcp 10.0.2.105 57822 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:10.506920 0.059689 tcp 10.0.2.105 57823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:10.566912 0.070462 tcp 10.0.2.105 57824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:10.637641 0.152097 tcp 10.0.2.105 57825 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:10.992917 2.998505 tcp 10.0.2.105 57826 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:19.989954 0.000000 tcp 10.0.2.105 57826 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:25.989216 0.060734 tcp 10.0.2.105 57827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:26.050337 0.061453 tcp 10.0.2.105 57828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:26.112073 0.154609 tcp 10.0.2.105 57829 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:26.377604 3.005743 tcp 10.0.2.105 57830 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:35.382352 0.000000 tcp 10.0.2.105 57830 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:41.371443 0.060032 tcp 10.0.2.105 57831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:41.431776 0.060604 tcp 10.0.2.105 57832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:41.492659 0.149892 tcp 10.0.2.105 57833 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:18:41.754203 3.001358 tcp 10.0.2.105 57834 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:50.754201 0.000000 tcp 10.0.2.105 57834 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:18:56.752630 3.004431 tcp 10.0.2.105 57835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:19:05.765696 0.000000 tcp 10.0.2.105 57835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:19:10.292380 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:19:11.755018 2.993610 tcp 10.0.2.105 57836 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:19:20.757495 0.000000 tcp 10.0.2.105 57836 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:19:26.756280 2.994228 tcp 10.0.2.105 57837 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:19:34.287037 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:19:35.753689 0.000000 tcp 10.0.2.105 57837 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:20:29.327952 3.002712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:20:36.336048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:20:44.337525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:21:00.341471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:21:32.346514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:24:41.759926 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:24:41.760030 3.003103 tcp 10.0.2.105 57838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:24:50.762094 0.000000 tcp 10.0.2.105 57838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:24:56.762359 0.062720 tcp 10.0.2.105 57839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:24:56.825377 0.061455 tcp 10.0.2.105 57840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:24:56.887136 0.157496 tcp 10.0.2.105 57841 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:24:57.080921 3.004311 tcp 10.0.2.105 57842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:06.083761 0.000000 tcp 10.0.2.105 57842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:12.082651 0.060697 tcp 10.0.2.105 57843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:12.143633 0.062529 tcp 10.0.2.105 57844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:12.206425 0.150919 tcp 10.0.2.105 57845 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:12.392408 3.004856 tcp 10.0.2.105 57846 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:21.430656 0.000000 tcp 10.0.2.105 57846 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:27.384966 0.066734 tcp 10.0.2.105 57847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:27.451999 0.060323 tcp 10.0.2.105 57848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:27.512698 0.153672 tcp 10.0.2.105 57849 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:27.748077 3.001156 tcp 10.0.2.105 57850 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:36.748040 0.000000 tcp 10.0.2.105 57850 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:42.747458 0.060991 tcp 10.0.2.105 57851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:42.808701 0.060845 tcp 10.0.2.105 57852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:42.869807 0.150822 tcp 10.0.2.105 57853 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:25:43.166539 2.995044 tcp 10.0.2.105 57854 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:52.162273 0.000000 tcp 10.0.2.105 57854 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:25:58.159084 3.004047 tcp 10.0.2.105 57855 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:26:07.161812 0.000000 tcp 10.0.2.105 57855 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:26:11.792889 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:26:13.162119 3.002560 tcp 10.0.2.105 57856 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:26:22.163200 0.000000 tcp 10.0.2.105 57856 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:26:28.162329 3.003258 tcp 10.0.2.105 57857 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:26:35.782665 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:26:37.164859 0.000000 tcp 10.0.2.105 57857 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:27:36.363357 3.001083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:27:43.370080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:27:51.371613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:28:07.374788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:28:39.380286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:33:57.328124 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:33:57.328383 0.086334 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:57.376774 0.155406 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:57.377193 3.005616 tcp 10.0.2.105 57858 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:33:57.524682 0.224351 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:57.756800 0.226954 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:57.976696 0.349364 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.179458 3.003765 tcp 10.0.2.105 57859 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:33:58.356920 0.115310 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.432560 0.064483 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.597173 0.175582 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.769654 0.106030 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.869478 0.096304 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:58.985908 0.175290 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.153332 0.037500 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.283531 0.061425 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.378860 0.248713 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.605038 0.170398 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.848682 0.067817 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:33:59.907564 0.433474 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:00.319336 0.182448 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:00.497679 0.127509 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:00.708234 0.632507 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:01.325538 0.133252 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:01.413629 0.075229 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:01.514180 0.191152 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:01.788674 0.254379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:02.002972 0.127254 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:02.165204 0.952570 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:03.103811 0.178064 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/10 16:34:06.380943 0.000000 tcp 10.0.2.105 57858 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:34:07.182012 0.000000 tcp 10.0.2.105 57859 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:34:13.182916 0.061284 tcp 10.0.2.105 57860 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:34:13.244491 0.061063 tcp 10.0.2.105 57861 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:34:13.305827 0.150147 tcp 10.0.2.105 57862 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:34:13.534648 3.000694 tcp 10.0.2.105 57863 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:34:22.533784 0.000000 tcp 10.0.2.105 57863 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:34:43.386757 3.001791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 16:34:50.397070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:34:58.400638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:35:14.398699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:35:46.404763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:39:28.534289 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:39:28.534434 2.996293 tcp 10.0.2.105 57864 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:39:37.538755 0.000000 tcp 10.0.2.105 57864 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:39:43.537412 0.061328 tcp 10.0.2.105 57865 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:43.599039 0.061742 tcp 10.0.2.105 57866 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:43.661038 0.145408 tcp 10.0.2.105 57867 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:44.055703 2.995196 tcp 10.0.2.105 57868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:39:53.048534 0.000000 tcp 10.0.2.105 57868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:39:59.050367 0.059942 tcp 10.0.2.105 57869 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:59.110580 0.061992 tcp 10.0.2.105 57870 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:59.172826 0.149922 tcp 10.0.2.105 57871 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:39:59.422074 3.000450 tcp 10.0.2.105 57872 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:08.421185 0.000000 tcp 10.0.2.105 57872 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:14.422899 0.060369 tcp 10.0.2.105 57873 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:14.483550 0.060230 tcp 10.0.2.105 57874 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:14.544055 0.174496 tcp 10.0.2.105 57875 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:15.115210 2.997355 tcp 10.0.2.105 57876 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:24.107928 0.000000 tcp 10.0.2.105 57876 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:30.093659 0.062991 tcp 10.0.2.105 57877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:30.156906 0.060207 tcp 10.0.2.105 57878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:30.217016 0.151768 tcp 10.0.2.105 57879 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:40:30.734323 3.003281 tcp 10.0.2.105 57880 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:39.746644 0.000000 tcp 10.0.2.105 57880 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:45.735589 2.993779 tcp 10.0.2.105 57881 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:54.727820 0.000000 tcp 10.0.2.105 57881 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:40:59.284434 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:41:00.736908 2.993985 tcp 10.0.2.105 57882 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:41:09.729198 0.000000 tcp 10.0.2.105 57882 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:41:15.738453 3.003712 tcp 10.0.2.105 57883 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:41:23.288902 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:41:24.741285 0.000000 tcp 10.0.2.105 57883 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:41:50.410773 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:41:57.417948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:42:05.419667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:42:21.423079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:42:53.429003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:46:30.741655 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:46:30.741773 3.003354 tcp 10.0.2.105 57884 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:46:39.743691 0.000000 tcp 10.0.2.105 57884 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:46:45.744723 0.061273 tcp 10.0.2.105 57885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:46:45.806325 0.064466 tcp 10.0.2.105 57886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:46:45.871077 0.149851 tcp 10.0.2.105 57887 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:46:46.128692 2.998729 tcp 10.0.2.105 57888 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:46:55.136155 0.000000 tcp 10.0.2.105 57888 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:01.124819 0.063009 tcp 10.0.2.105 57889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:01.188190 0.061285 tcp 10.0.2.105 57890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:01.249738 0.152283 tcp 10.0.2.105 57891 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:01.422584 2.996984 tcp 10.0.2.105 57892 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:10.426005 0.000000 tcp 10.0.2.105 57892 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:16.421589 0.062186 tcp 10.0.2.105 57893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:16.484402 0.060575 tcp 10.0.2.105 57894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:16.545231 0.146273 tcp 10.0.2.105 57895 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:16.875577 2.996060 tcp 10.0.2.105 57896 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:25.870276 0.000000 tcp 10.0.2.105 57896 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:31.869436 0.060695 tcp 10.0.2.105 57897 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:31.930477 0.061024 tcp 10.0.2.105 57898 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:31.991796 0.150789 tcp 10.0.2.105 57899 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:47:32.415714 2.998419 tcp 10.0.2.105 57900 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:41.418928 0.000000 tcp 10.0.2.105 57900 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:47.411156 3.005738 tcp 10.0.2.105 57901 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:47:56.413958 0.000000 tcp 10.0.2.105 57901 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:48:01.291350 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:48:02.416453 3.000982 tcp 10.0.2.105 57902 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:48:11.425712 0.000000 tcp 10.0.2.105 57902 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:48:17.415127 2.996841 tcp 10.0.2.105 57903 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:48:25.285690 0.011230 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:48:26.407598 0.000000 tcp 10.0.2.105 57903 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:53:28.445130 3.000828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 16:53:32.417769 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:53:32.417891 3.005215 tcp 10.0.2.105 57904 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:53:35.453133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:53:41.420281 0.000000 tcp 10.0.2.105 57904 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:53:43.453299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:53:47.422436 0.066581 tcp 10.0.2.105 57905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:53:47.489272 0.061240 tcp 10.0.2.105 57906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:53:47.550829 0.153577 tcp 10.0.2.105 57907 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:53:47.874796 2.998792 tcp 10.0.2.105 57908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:53:57.031230 0.000000 tcp 10.0.2.105 57908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:53:59.592890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:54:02.984437 0.064301 tcp 10.0.2.105 57909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:03.048995 0.061027 tcp 10.0.2.105 57910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:03.110278 0.148108 tcp 10.0.2.105 57911 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:03.441908 2.977408 tcp 10.0.2.105 57912 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:12.360943 0.000000 tcp 10.0.2.105 57912 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:18.333847 0.061522 tcp 10.0.2.105 57913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:18.395634 0.061417 tcp 10.0.2.105 57914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:18.457360 0.152313 tcp 10.0.2.105 57915 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:18.634914 2.993149 tcp 10.0.2.105 57916 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:27.640437 0.000000 tcp 10.0.2.105 57916 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:31.462895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 16:54:33.636073 0.066379 tcp 10.0.2.105 57917 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:33.702735 0.061852 tcp 10.0.2.105 57918 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:33.764857 0.146690 tcp 10.0.2.105 57919 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 16:54:33.927988 3.001962 tcp 10.0.2.105 57920 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:42.928384 0.000000 tcp 10.0.2.105 57920 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:48.926987 3.004574 tcp 10.0.2.105 57921 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:54:57.930256 0.000000 tcp 10.0.2.105 57921 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:55:02.787207 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:55:03.929176 3.004012 tcp 10.0.2.105 57922 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:55:12.931704 0.000000 tcp 10.0.2.105 57922 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:55:18.930367 3.003682 tcp 10.0.2.105 57923 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 16:55:26.791576 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 16:55:27.933242 0.000000 tcp 10.0.2.105 57923 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:00:33.934116 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:00:33.934234 3.003007 tcp 10.0.2.105 57924 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:00:35.468158 3.001685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:00:42.476015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:00:42.946131 0.000000 tcp 10.0.2.105 57924 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:00:48.936578 0.060011 tcp 10.0.2.105 57925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:00:48.996866 0.059602 tcp 10.0.2.105 57926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:00:49.056722 0.147762 tcp 10.0.2.105 57927 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:00:49.310441 2.989489 tcp 10.0.2.105 57928 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:00:50.477386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:00:58.299975 0.000000 tcp 10.0.2.105 57928 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:04.307682 0.064143 tcp 10.0.2.105 57929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:04.372079 0.062459 tcp 10.0.2.105 57930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:04.434846 0.153535 tcp 10.0.2.105 57931 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:04.658583 3.003178 tcp 10.0.2.105 57932 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:06.480056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:01:13.660531 0.000000 tcp 10.0.2.105 57932 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:19.659470 0.061270 tcp 10.0.2.105 57933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:19.721020 0.062006 tcp 10.0.2.105 57934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:19.783287 0.150319 tcp 10.0.2.105 57935 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:01:19.975182 2.998522 tcp 10.0.2.105 57936 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:28.972714 0.000000 tcp 10.0.2.105 57936 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:34.971271 3.007146 tcp 10.0.2.105 57937 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:38.489186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:01:43.973846 0.000000 tcp 10.0.2.105 57937 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:48.792706 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:01:49.982151 2.998083 tcp 10.0.2.105 57938 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:01:58.982601 0.000000 tcp 10.0.2.105 57938 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:04:24.665312 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:04:24.665518 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 17:04:40.119060 0.062055 tcp 10.0.2.105 57939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:04:40.181407 0.060796 tcp 10.0.2.105 57940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:04:40.242472 0.150058 tcp 10.0.2.105 57941 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:04:40.393072 0.223749 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:40.606119 0.083649 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:40.698255 0.154365 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:40.699089 3.003729 tcp 10.0.2.105 57942 -> 88.111.35.230 7167 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:04:40.845007 0.341080 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.300560 0.113856 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.377457 0.069330 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.525558 0.177006 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.698751 0.110105 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2581 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.772653 0.087734 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:41.845526 0.175076 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.012792 0.038802 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.100546 0.061290 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.160980 0.244197 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.381587 0.170737 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.561025 0.069672 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.621303 0.126740 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:42.872911 0.435459 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:43.286518 0.178851 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:43.462601 0.696913 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.143673 0.263001 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.363702 0.074135 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.449431 0.193154 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.636422 0.253781 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.857460 0.115786 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:44.988538 1.119834 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:46.099995 0.174176 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:04:49.701120 0.000000 tcp 10.0.2.105 57942 -> 88.111.35.230 7167 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:04.975297 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:07:04.975438 2.994478 tcp 10.0.2.105 57943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:13.968855 0.000000 tcp 10.0.2.105 57943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:19.977300 0.062149 tcp 10.0.2.105 57944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:20.039726 0.060170 tcp 10.0.2.105 57945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:20.100263 0.193327 tcp 10.0.2.105 57946 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:20.359012 3.009597 tcp 10.0.2.105 57947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:29.360725 0.000000 tcp 10.0.2.105 57947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:35.359815 0.059841 tcp 10.0.2.105 57948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:35.419933 0.063071 tcp 10.0.2.105 57949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:35.483325 0.147803 tcp 10.0.2.105 57950 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:36.090094 3.004457 tcp 10.0.2.105 57951 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:42.492492 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:07:45.093163 0.000000 tcp 10.0.2.105 57951 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:49.499927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:07:51.194084 0.060430 tcp 10.0.2.105 57952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:51.254776 0.060189 tcp 10.0.2.105 57953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:51.315257 0.155182 tcp 10.0.2.105 57954 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:07:51.603449 2.978919 tcp 10.0.2.105 57955 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:07:57.577786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:08:00.551513 0.000000 tcp 10.0.2.105 57955 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:06.505190 0.062183 tcp 10.0.2.105 57956 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:08:06.567667 0.063532 tcp 10.0.2.105 57957 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:08:06.631484 0.155331 tcp 10.0.2.105 57958 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:08:06.998616 3.000496 tcp 10.0.2.105 57959 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:13.514206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:08:16.007211 0.000000 tcp 10.0.2.105 57959 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:21.996890 2.993688 tcp 10.0.2.105 57960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:30.989263 0.000000 tcp 10.0.2.105 57960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:35.786127 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:08:36.998220 3.003987 tcp 10.0.2.105 57961 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:45.520345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:08:46.000452 0.000000 tcp 10.0.2.105 57961 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:51.999906 3.005051 tcp 10.0.2.105 57962 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:08:59.793970 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:09:01.005595 0.000000 tcp 10.0.2.105 57962 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:07.002645 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:14:07.002853 3.003234 tcp 10.0.2.105 57963 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:16.005454 0.000000 tcp 10.0.2.105 57963 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:22.005504 0.061383 tcp 10.0.2.105 57964 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:22.067208 0.062431 tcp 10.0.2.105 57965 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:22.129988 0.150990 tcp 10.0.2.105 57966 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:22.516561 3.002340 tcp 10.0.2.105 57967 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:31.527456 0.000000 tcp 10.0.2.105 57967 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:37.516963 0.059479 tcp 10.0.2.105 57968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:37.576770 0.060432 tcp 10.0.2.105 57969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:37.637457 0.152267 tcp 10.0.2.105 57970 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:37.818330 3.004530 tcp 10.0.2.105 57971 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:46.819062 0.000000 tcp 10.0.2.105 57971 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:49.525800 3.005193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:14:52.823200 0.064074 tcp 10.0.2.105 57972 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:52.887117 0.061872 tcp 10.0.2.105 57973 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:52.949271 0.150956 tcp 10.0.2.105 57974 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:14:53.114036 3.001491 tcp 10.0.2.105 57975 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:14:56.535545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:15:02.111430 0.000000 tcp 10.0.2.105 57975 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:04.535090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:15:08.100639 0.060654 tcp 10.0.2.105 57976 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:15:08.161581 0.062548 tcp 10.0.2.105 57977 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:15:08.224646 0.151940 tcp 10.0.2.105 57978 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:15:08.421067 3.004062 tcp 10.0.2.105 57979 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:17.423407 0.000000 tcp 10.0.2.105 57979 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:20.538036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:15:23.422217 3.004816 tcp 10.0.2.105 57980 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:32.425007 0.000000 tcp 10.0.2.105 57980 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:37.292032 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:15:38.425229 2.992852 tcp 10.0.2.105 57981 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:47.426883 0.000000 tcp 10.0.2.105 57981 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:15:52.544042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:15:53.425504 2.997495 tcp 10.0.2.105 57982 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:16:01.286477 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:16:02.418297 0.000000 tcp 10.0.2.105 57982 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:08.429168 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:21:08.429315 3.003193 tcp 10.0.2.105 57983 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:17.431422 0.000000 tcp 10.0.2.105 57983 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:23.431612 0.061034 tcp 10.0.2.105 57984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:23.492906 0.060428 tcp 10.0.2.105 57985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:23.553681 0.147974 tcp 10.0.2.105 57986 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:23.761492 3.003217 tcp 10.0.2.105 57987 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:32.763038 0.000000 tcp 10.0.2.105 57987 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:38.765539 0.060338 tcp 10.0.2.105 57988 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:38.826156 0.061533 tcp 10.0.2.105 57989 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:38.888009 0.148393 tcp 10.0.2.105 57990 -> 195.113.214.249 443 SRPA* 0 0 20 10878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:39.098494 3.000656 tcp 10.0.2.105 57991 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:48.094811 0.000000 tcp 10.0.2.105 57991 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:54.094448 0.060350 tcp 10.0.2.105 57992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:54.155164 0.060456 tcp 10.0.2.105 57993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:54.215901 0.149618 tcp 10.0.2.105 57994 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:21:54.585290 2.993665 tcp 10.0.2.105 57995 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:21:56.550124 3.001625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:22:03.557472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:22:03.587944 0.000000 tcp 10.0.2.105 57995 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:09.586978 0.058970 tcp 10.0.2.105 57996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:22:09.646240 0.060260 tcp 10.0.2.105 57997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:22:09.706746 0.160111 tcp 10.0.2.105 57998 -> 195.113.214.249 443 SRPA* 0 0 36 19628 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:22:09.952890 2.998002 tcp 10.0.2.105 57999 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:11.560961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:22:18.949479 0.000000 tcp 10.0.2.105 57999 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:24.948298 3.004559 tcp 10.0.2.105 58000 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:27.561856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:22:33.951301 0.000000 tcp 10.0.2.105 58000 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:38.788032 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:22:39.949470 3.004763 tcp 10.0.2.105 58001 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:48.952990 0.000000 tcp 10.0.2.105 58001 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:54.955059 3.000658 tcp 10.0.2.105 58002 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:22:59.568037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:23:02.782652 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:23:03.954305 0.000000 tcp 10.0.2.105 58002 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:09.955174 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:28:09.955325 2.992780 tcp 10.0.2.105 58003 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:18.956690 0.000000 tcp 10.0.2.105 58003 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:24.956905 0.061192 tcp 10.0.2.105 58004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:25.018358 0.059901 tcp 10.0.2.105 58005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:25.078539 0.147429 tcp 10.0.2.105 58006 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:25.245916 2.994634 tcp 10.0.2.105 58007 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:34.239404 0.000000 tcp 10.0.2.105 58007 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:40.238675 0.063421 tcp 10.0.2.105 58008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:40.302430 0.065194 tcp 10.0.2.105 58009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:40.367885 0.150777 tcp 10.0.2.105 58010 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:40.817693 3.081531 tcp 10.0.2.105 58011 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:49.847024 0.000000 tcp 10.0.2.105 58011 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:28:55.830646 0.060378 tcp 10.0.2.105 58012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:55.891321 0.060485 tcp 10.0.2.105 58013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:55.952133 0.148293 tcp 10.0.2.105 58014 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:28:56.182121 3.002988 tcp 10.0.2.105 58015 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:03.574088 3.001558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:29:05.183624 0.000000 tcp 10.0.2.105 58015 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:10.581758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:29:11.182862 0.060802 tcp 10.0.2.105 58016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:29:11.243947 0.060569 tcp 10.0.2.105 58017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:29:11.304782 0.147398 tcp 10.0.2.105 58018 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:29:11.546150 3.000947 tcp 10.0.2.105 58019 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:18.582939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:29:20.555885 0.000000 tcp 10.0.2.105 58019 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:26.544370 2.994602 tcp 10.0.2.105 58020 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:34.585911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:29:35.537319 0.000000 tcp 10.0.2.105 58020 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:40.284070 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:29:41.546068 2.994003 tcp 10.0.2.105 58021 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:50.538974 0.000000 tcp 10.0.2.105 58021 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:29:56.547721 3.004333 tcp 10.0.2.105 58022 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:30:04.288656 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:30:05.550648 0.000000 tcp 10.0.2.105 58022 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:30:06.592164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:35:14.836969 0.081437 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:35:14.918548 0.322460 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:15.127886 0.154926 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:15.128344 2.978153 tcp 10.0.2.105 58023 -> 108.232.100.12 4892 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:15.356147 0.359724 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:15.723506 0.114886 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:15.799506 0.066579 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:15.891666 0.225679 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.109657 0.075483 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.151459 0.177338 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.324886 0.107577 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.399804 0.095397 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.609947 0.173153 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.775837 0.040713 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.869683 0.060281 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:16.928579 0.245015 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:17.148757 0.176164 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:17.464783 0.437868 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:17.879510 0.173965 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:18.050663 0.070003 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:18.159826 0.128861 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:18.501029 0.767675 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:19.252639 0.132717 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:19.343327 0.072838 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:19.576714 0.115727 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:20.005057 0.205470 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:20.237034 0.318729 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:20.517886 0.996054 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:21.508161 0.177182 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/10 17:35:24.070429 0.000000 tcp 10.0.2.105 58023 -> 108.232.100.12 4892 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:26.558801 3.000007 tcp 10.0.2.105 58024 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:35.561485 0.000000 tcp 10.0.2.105 58024 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:40.301197 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:35:41.559322 0.061137 tcp 10.0.2.105 58025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:41.620743 0.061652 tcp 10.0.2.105 58026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:41.682678 0.147587 tcp 10.0.2.105 58027 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:41.854206 2.994342 tcp 10.0.2.105 58028 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:50.858537 0.000000 tcp 10.0.2.105 58028 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:35:56.845934 0.064390 tcp 10.0.2.105 58029 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:56.910650 0.062142 tcp 10.0.2.105 58030 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:56.973064 0.144946 tcp 10.0.2.105 58031 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:35:57.260039 3.000957 tcp 10.0.2.105 58032 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:06.259011 0.000000 tcp 10.0.2.105 58032 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:10.598869 3.000927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:36:12.259520 0.064126 tcp 10.0.2.105 58033 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:12.323938 0.059749 tcp 10.0.2.105 58034 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:12.383964 0.151071 tcp 10.0.2.105 58035 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:12.659473 3.002501 tcp 10.0.2.105 58036 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:17.605518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:36:21.661335 0.000000 tcp 10.0.2.105 58036 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:25.612686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:36:27.662758 0.060177 tcp 10.0.2.105 58037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:27.723263 0.059512 tcp 10.0.2.105 58038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:27.783004 0.150367 tcp 10.0.2.105 58039 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:36:28.118847 3.006154 tcp 10.0.2.105 58040 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:37.123366 0.000000 tcp 10.0.2.105 58040 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:41.611765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:36:43.112431 3.004127 tcp 10.0.2.105 58041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:52.116534 0.000000 tcp 10.0.2.105 58041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:36:56.791626 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:36:58.113893 2.998581 tcp 10.0.2.105 58042 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:37:07.116735 0.000000 tcp 10.0.2.105 58042 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:37:13.115459 2.993538 tcp 10.0.2.105 58043 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:37:13.615871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:37:20.786725 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:37:22.107694 0.000000 tcp 10.0.2.105 58043 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:42:28.118732 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:42:28.118870 3.003450 tcp 10.0.2.105 58044 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:42:37.121094 0.000000 tcp 10.0.2.105 58044 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:42:43.120944 0.060264 tcp 10.0.2.105 58045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:43.181395 0.060939 tcp 10.0.2.105 58046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:43.242622 0.147638 tcp 10.0.2.105 58047 -> 195.113.214.249 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:43.402042 3.002497 tcp 10.0.2.105 58048 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:42:52.403233 0.000000 tcp 10.0.2.105 58048 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:42:58.402054 0.060894 tcp 10.0.2.105 58049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:58.463211 0.059773 tcp 10.0.2.105 58050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:58.523207 0.151541 tcp 10.0.2.105 58051 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:42:58.701190 3.005524 tcp 10.0.2.105 58052 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:07.705388 0.000000 tcp 10.0.2.105 58052 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:13.694326 0.059246 tcp 10.0.2.105 58053 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:13.753788 0.061450 tcp 10.0.2.105 58054 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:13.815517 0.152585 tcp 10.0.2.105 58055 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:13.986453 2.992067 tcp 10.0.2.105 58056 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:17.621678 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:43:22.987048 0.000000 tcp 10.0.2.105 58056 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:24.629356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:43:28.986265 0.060012 tcp 10.0.2.105 58057 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:29.046552 0.064798 tcp 10.0.2.105 58058 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:29.111631 0.150973 tcp 10.0.2.105 58059 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:43:29.481501 3.002679 tcp 10.0.2.105 58060 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:32.634354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:43:38.479262 0.000000 tcp 10.0.2.105 58060 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:44.478035 3.005155 tcp 10.0.2.105 58061 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:48.635238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:43:53.483220 0.000000 tcp 10.0.2.105 58061 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:43:58.288161 0.000186 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:43:59.483395 3.003821 tcp 10.0.2.105 58062 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:44:08.488073 0.000000 tcp 10.0.2.105 58062 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:44:14.482391 3.003216 tcp 10.0.2.105 58063 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:44:20.639882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:44:22.282247 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:44:23.491155 0.000000 tcp 10.0.2.105 58063 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:49:29.484627 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:49:29.484769 2.993786 tcp 10.0.2.105 58064 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:49:38.487133 0.000000 tcp 10.0.2.105 58064 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:49:44.487767 0.061603 tcp 10.0.2.105 58065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:49:44.549650 0.060843 tcp 10.0.2.105 58066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:49:44.610782 0.147898 tcp 10.0.2.105 58067 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:49:44.769179 3.001050 tcp 10.0.2.105 58068 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:49:53.768715 0.000000 tcp 10.0.2.105 58068 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:49:59.768371 0.060402 tcp 10.0.2.105 58069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:49:59.829022 0.059838 tcp 10.0.2.105 58070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:49:59.889100 0.146797 tcp 10.0.2.105 58071 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:00.050865 3.001215 tcp 10.0.2.105 58072 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:09.050628 0.000000 tcp 10.0.2.105 58072 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:15.049741 0.060624 tcp 10.0.2.105 58073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:15.110646 0.060396 tcp 10.0.2.105 58074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:15.171333 0.150722 tcp 10.0.2.105 58075 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:15.351863 3.002609 tcp 10.0.2.105 58076 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:24.352738 0.000000 tcp 10.0.2.105 58076 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:30.352458 0.058320 tcp 10.0.2.105 58077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:30.411025 0.060891 tcp 10.0.2.105 58078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:30.472403 0.147202 tcp 10.0.2.105 58079 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:50:30.629191 3.007090 tcp 10.0.2.105 58080 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:39.634934 0.000000 tcp 10.0.2.105 58080 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:45.623588 2.994187 tcp 10.0.2.105 58081 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:54.626263 0.000000 tcp 10.0.2.105 58081 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:50:59.283212 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:51:00.625219 2.993998 tcp 10.0.2.105 58082 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:51:09.617924 0.000000 tcp 10.0.2.105 58082 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:51:15.626766 2.993970 tcp 10.0.2.105 58083 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:51:23.287462 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:51:24.619404 0.000000 tcp 10.0.2.105 58083 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:54:12.654478 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 17:54:19.661393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:54:27.662776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:54:43.665747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:55:15.671809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 17:56:30.629992 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:56:30.630212 3.003549 tcp 10.0.2.105 58084 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:56:39.632700 0.000000 tcp 10.0.2.105 58084 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:56:45.633015 0.059679 tcp 10.0.2.105 58085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:56:45.692973 0.063683 tcp 10.0.2.105 58086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:56:45.756962 0.151818 tcp 10.0.2.105 58087 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:56:45.934564 3.000604 tcp 10.0.2.105 58088 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:56:54.934524 0.000000 tcp 10.0.2.105 58088 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:00.933976 0.062286 tcp 10.0.2.105 58089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:00.996525 0.061611 tcp 10.0.2.105 58090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:01.058430 0.149743 tcp 10.0.2.105 58091 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:01.238165 2.999506 tcp 10.0.2.105 58092 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:10.246748 0.000000 tcp 10.0.2.105 58092 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:16.236113 0.060834 tcp 10.0.2.105 58093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:16.297239 0.060975 tcp 10.0.2.105 58094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:16.358459 0.149692 tcp 10.0.2.105 58095 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:16.519177 3.000516 tcp 10.0.2.105 58096 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:25.518538 0.000000 tcp 10.0.2.105 58096 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:31.517608 0.059867 tcp 10.0.2.105 58097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:31.577764 0.063645 tcp 10.0.2.105 58098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:31.641718 0.154793 tcp 10.0.2.105 58099 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 17:57:31.813962 2.997667 tcp 10.0.2.105 58100 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:40.810009 0.000000 tcp 10.0.2.105 58100 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:46.809080 3.004145 tcp 10.0.2.105 58101 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:57:55.811898 0.000000 tcp 10.0.2.105 58101 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:58:00.788675 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:58:01.810617 3.003619 tcp 10.0.2.105 58102 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:58:10.813471 0.000000 tcp 10.0.2.105 58102 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:58:16.812328 3.004019 tcp 10.0.2.105 58103 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 17:58:24.783663 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 17:58:25.815155 0.000000 tcp 10.0.2.105 58103 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:01:19.677308 3.002233 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:01:26.685207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:01:34.687000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:01:50.689703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:02:22.695865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:05:31.637746 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:05:31.637901 0.214697 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:31.844073 0.115572 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:31.844466 2.998054 tcp 10.0.2.105 58104 -> 108.232.100.12 4892 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:05:33.027640 0.076785 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:33.677120 0.224485 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:33.893770 0.080458 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:34.018301 0.157583 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:34.168169 0.343521 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:34.524822 0.177229 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:34.698610 0.115525 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:35.252722 0.088032 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:35.323804 0.175179 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:35.568798 0.034737 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:35.602057 0.062356 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:35.823341 0.239220 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:36.038938 0.173661 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:36.250142 0.081054 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:36.338707 0.166940 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:36.644734 0.438473 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:37.056779 0.128576 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:37.457423 0.907787 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 4 1516 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:38.357756 0.131188 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:38.640618 0.074648 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:38.903923 0.103114 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:39.198218 0.199637 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:39.390339 0.745227 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:40.099408 0.813161 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:40.840448 0.000000 tcp 10.0.2.105 58104 -> 108.232.100.12 4892 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:05:40.905995 0.175678 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:05:46.829582 3.003696 tcp 10.0.2.105 58105 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:05:55.832576 0.000000 tcp 10.0.2.105 58105 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:00.789252 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:06:01.831686 0.063485 tcp 10.0.2.105 58106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:01.895517 0.061282 tcp 10.0.2.105 58107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:01.957130 0.152687 tcp 10.0.2.105 58108 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:02.126217 2.999255 tcp 10.0.2.105 58109 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:11.126622 0.000000 tcp 10.0.2.105 58109 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:17.123654 0.061144 tcp 10.0.2.105 58110 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:17.185067 0.064704 tcp 10.0.2.105 58111 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:17.249560 0.151260 tcp 10.0.2.105 58112 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:17.476594 3.001120 tcp 10.0.2.105 58113 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:26.490653 0.000000 tcp 10.0.2.105 58113 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:32.475503 0.061046 tcp 10.0.2.105 58114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:32.536905 0.060771 tcp 10.0.2.105 58115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:32.597965 0.151510 tcp 10.0.2.105 58116 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:32.969984 2.999775 tcp 10.0.2.105 58117 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:41.967845 0.000000 tcp 10.0.2.105 58117 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:47.969291 0.063884 tcp 10.0.2.105 58118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:48.033085 0.061607 tcp 10.0.2.105 58119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:48.094526 0.151296 tcp 10.0.2.105 58120 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:06:48.450761 3.001183 tcp 10.0.2.105 58121 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:06:57.450594 0.000000 tcp 10.0.2.105 58121 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:03.449404 3.004225 tcp 10.0.2.105 58122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:12.452174 0.000000 tcp 10.0.2.105 58122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:17.289999 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:07:18.451064 3.004007 tcp 10.0.2.105 58123 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:27.501750 0.000000 tcp 10.0.2.105 58123 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:33.456844 3.000013 tcp 10.0.2.105 58124 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:07:41.283655 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:07:42.455337 0.000000 tcp 10.0.2.105 58124 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:08:26.701724 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:08:33.709033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:08:41.710540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:08:57.714860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:09:29.719719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:12:48.456098 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:12:48.456180 2.993422 tcp 10.0.2.105 58125 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:12:57.451049 0.000000 tcp 10.0.2.105 58125 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:03.459460 0.064013 tcp 10.0.2.105 58126 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:03.523708 0.061591 tcp 10.0.2.105 58127 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:03.585648 0.145977 tcp 10.0.2.105 58128 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:03.827228 3.004501 tcp 10.0.2.105 58129 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:12.830495 0.000000 tcp 10.0.2.105 58129 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:18.829760 0.060276 tcp 10.0.2.105 58130 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:18.890428 0.061410 tcp 10.0.2.105 58131 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:18.952096 0.156993 tcp 10.0.2.105 58132 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:19.395372 2.999206 tcp 10.0.2.105 58133 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:28.393054 0.000000 tcp 10.0.2.105 58133 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:34.392051 0.065254 tcp 10.0.2.105 58134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:34.457139 0.060060 tcp 10.0.2.105 58135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:34.517571 0.150037 tcp 10.0.2.105 58136 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:34.931904 3.005281 tcp 10.0.2.105 58137 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:43.936141 0.000000 tcp 10.0.2.105 58137 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:13:49.925443 0.060152 tcp 10.0.2.105 58138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:49.985956 0.064402 tcp 10.0.2.105 58139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:50.050617 0.149300 tcp 10.0.2.105 58140 -> 195.113.214.249 443 SRPA* 0 0 32 16642 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:13:51.169066 3.000697 tcp 10.0.2.105 58141 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:00.168592 0.000000 tcp 10.0.2.105 58141 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:06.167514 3.003780 tcp 10.0.2.105 58142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:13.787753 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:14:15.169405 0.000000 tcp 10.0.2.105 58142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:21.169195 3.008812 tcp 10.0.2.105 58143 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:30.172372 0.000000 tcp 10.0.2.105 58143 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:36.170378 3.003587 tcp 10.0.2.105 58144 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:14:40.786582 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:14:45.173418 0.000000 tcp 10.0.2.105 58144 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:15:33.725613 3.001617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:15:40.733918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:15:48.734746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:16:04.737663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:16:36.743595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:19:51.173894 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:19:51.174059 3.003194 tcp 10.0.2.105 58145 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:00.186027 0.000000 tcp 10.0.2.105 58145 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:06.175991 0.061489 tcp 10.0.2.105 58146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:06.237648 0.064621 tcp 10.0.2.105 58147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:06.302493 0.154804 tcp 10.0.2.105 58148 -> 195.113.214.249 443 SRPA* 0 0 40 33956 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:06.534396 2.988286 tcp 10.0.2.105 58149 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:15.518766 0.000000 tcp 10.0.2.105 58149 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:21.527606 0.062293 tcp 10.0.2.105 58150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:21.590224 0.064215 tcp 10.0.2.105 58151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:21.654670 0.148137 tcp 10.0.2.105 58152 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:21.864848 2.996889 tcp 10.0.2.105 58153 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:30.860243 0.000000 tcp 10.0.2.105 58153 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:36.859461 0.063023 tcp 10.0.2.105 58154 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:36.922816 0.065381 tcp 10.0.2.105 58155 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:36.988660 0.150190 tcp 10.0.2.105 58156 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:37.201362 3.002114 tcp 10.0.2.105 58157 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:46.202179 0.000000 tcp 10.0.2.105 58157 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:20:52.201333 0.060846 tcp 10.0.2.105 58158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:52.262444 0.061000 tcp 10.0.2.105 58159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:52.323691 0.148892 tcp 10.0.2.105 58160 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:20:52.693859 3.002001 tcp 10.0.2.105 58161 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:01.694312 0.000000 tcp 10.0.2.105 58161 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:07.693669 3.003657 tcp 10.0.2.105 58162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:16.706080 0.000000 tcp 10.0.2.105 58162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:21.282969 0.105844 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:21:22.781802 2.969085 tcp 10.0.2.105 58163 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:31.704324 0.000000 tcp 10.0.2.105 58163 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:37.696722 2.993513 tcp 10.0.2.105 58164 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:21:45.287099 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:21:46.689310 0.000000 tcp 10.0.2.105 58164 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:22:40.749516 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:22:47.757103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:22:55.758541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:23:11.761664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:23:43.767682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:26:52.699667 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:26:52.699816 3.003624 tcp 10.0.2.105 58165 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:01.702877 0.000000 tcp 10.0.2.105 58165 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:07.702858 0.061447 tcp 10.0.2.105 58166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:07.764642 0.063794 tcp 10.0.2.105 58167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:07.828687 0.150910 tcp 10.0.2.105 58168 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:08.039464 3.006281 tcp 10.0.2.105 58169 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:17.044469 0.000000 tcp 10.0.2.105 58169 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:23.033341 0.060414 tcp 10.0.2.105 58170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:23.094027 0.061765 tcp 10.0.2.105 58171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:23.156225 0.156990 tcp 10.0.2.105 58172 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:23.381880 2.985888 tcp 10.0.2.105 58173 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:32.376088 0.000000 tcp 10.0.2.105 58173 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:38.375512 0.061086 tcp 10.0.2.105 58174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:38.436861 0.060642 tcp 10.0.2.105 58175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:38.497836 0.150212 tcp 10.0.2.105 58176 -> 195.113.214.249 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:38.717550 2.992071 tcp 10.0.2.105 58177 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:47.708589 0.000000 tcp 10.0.2.105 58177 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:27:53.717807 0.063635 tcp 10.0.2.105 58178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:53.781712 0.064060 tcp 10.0.2.105 58179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:53.846132 0.150223 tcp 10.0.2.105 58180 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:27:54.054003 2.997605 tcp 10.0.2.105 58181 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:03.050270 0.000000 tcp 10.0.2.105 58181 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:09.048782 3.004565 tcp 10.0.2.105 58182 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:18.051747 0.000000 tcp 10.0.2.105 58182 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:22.788321 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:28:24.051144 3.003541 tcp 10.0.2.105 58183 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:33.053519 0.000000 tcp 10.0.2.105 58183 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:39.052531 3.003830 tcp 10.0.2.105 58184 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:28:46.783440 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:28:48.055150 0.000000 tcp 10.0.2.105 58184 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:29:47.773904 3.001088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:29:54.781195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:30:02.782561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:30:18.785742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:30:50.791545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:35:44.513977 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:35:44.514069 0.251668 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:35:44.719644 0.117148 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:35:44.720126 2.998534 tcp 10.0.2.105 58185 -> 108.232.100.12 4892 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:35:44.970902 0.087422 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:35:45.053381 0.148753 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 643 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:35:53.727318 0.000000 tcp 10.0.2.105 58185 -> 108.232.100.12 4892 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:35:54.067949 3.004061 tcp 10.0.2.105 58186 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:00.758795 0.064797 tcp 10.0.2.105 58187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:00.823838 0.066368 tcp 10.0.2.105 58188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:00.890513 0.157107 tcp 10.0.2.105 58189 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:01.048542 0.069473 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:01.170276 0.226661 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:01.389130 0.333904 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:01.731819 0.178129 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:01.907072 0.110331 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.124062 0.097973 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.205795 0.174779 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.372798 0.034761 udp 10.0.2.105 7010 <-> 212.17.122.207 9755 CON 0 0 6 2031 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.417310 0.060557 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.476672 0.238796 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.691362 0.166701 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:02.975117 0.435804 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:03.070588 0.000000 tcp 10.0.2.105 58186 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:03.389456 0.202715 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:03.584412 0.068528 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:03.799985 0.127715 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:04.017375 0.823051 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:04.824020 0.130401 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:05.247980 0.073888 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:05.300060 0.115512 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:05.551183 0.199546 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:05.752349 4.977865 tcp 10.0.2.105 58190 -> 24.234.227.235 6773 SPA_* 0 0 322 212099 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:05.783604 0.257441 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:06.004879 0.879870 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:06.876302 0.171800 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/10 18:36:09.069671 0.060664 tcp 10.0.2.105 58191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:09.130627 0.060617 tcp 10.0.2.105 58192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:09.191538 0.149030 tcp 10.0.2.105 58193 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:09.472923 3.000956 tcp 10.0.2.105 58194 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:10.886010 4.961258 tcp 10.0.2.105 58190 -> 24.234.227.235 6773 A_PA 0 0 356 234264 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:15.893523 4.999970 tcp 10.0.2.105 58190 -> 24.234.227.235 6773 A_PA 0 0 349 233258 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:18.472742 0.000000 tcp 10.0.2.105 58194 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:20.893538 1.494630 tcp 10.0.2.105 58190 -> 24.234.227.235 6773 FPA_* 0 0 25 10318 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:24.659653 0.061099 tcp 10.0.2.105 58195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:24.721088 0.061793 tcp 10.0.2.105 58196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:24.783148 0.151458 tcp 10.0.2.105 58197 -> 195.113.214.249 443 SRPA* 0 0 38 19014 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:36:25.248060 2.973621 tcp 10.0.2.105 58198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:34.161080 0.000000 tcp 10.0.2.105 58198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:40.100516 2.965404 tcp 10.0.2.105 58199 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:49.069180 0.000000 tcp 10.0.2.105 58199 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:36:53.783475 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:36:54.798466 3.000732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:37:01.804883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:37:09.806332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:37:25.809408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:37:57.815444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:41:55.066868 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:41:55.066976 3.003877 tcp 10.0.2.105 58200 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:04.069239 0.000000 tcp 10.0.2.105 58200 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:10.069275 0.065376 tcp 10.0.2.105 58201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:10.134960 0.064771 tcp 10.0.2.105 58202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:10.199601 0.150601 tcp 10.0.2.105 58203 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:10.381126 3.001969 tcp 10.0.2.105 58204 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:19.381628 0.000000 tcp 10.0.2.105 58204 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:25.380625 0.064169 tcp 10.0.2.105 58205 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:25.444634 0.061554 tcp 10.0.2.105 58206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:25.506527 0.151251 tcp 10.0.2.105 58207 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:25.881065 3.004177 tcp 10.0.2.105 58208 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:34.885903 0.000000 tcp 10.0.2.105 58208 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:40.883506 0.060331 tcp 10.0.2.105 58209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:40.944107 0.062207 tcp 10.0.2.105 58210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:41.006670 0.151981 tcp 10.0.2.105 58211 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:41.239643 2.997710 tcp 10.0.2.105 58212 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:50.246018 0.000000 tcp 10.0.2.105 58212 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:42:56.236028 0.062020 tcp 10.0.2.105 58213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:56.298297 0.060380 tcp 10.0.2.105 58214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:56.358928 0.151054 tcp 10.0.2.105 58215 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:42:56.564722 2.994800 tcp 10.0.2.105 58216 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:05.557841 0.000000 tcp 10.0.2.105 58216 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:11.557299 2.993550 tcp 10.0.2.105 58217 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:20.549509 0.000000 tcp 10.0.2.105 58217 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:25.289033 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:43:26.559025 3.003652 tcp 10.0.2.105 58218 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:35.563003 0.000000 tcp 10.0.2.105 58218 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:41.559986 3.004078 tcp 10.0.2.105 58219 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:43:49.295121 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:43:50.568475 0.000000 tcp 10.0.2.105 58219 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:44:01.822007 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:44:08.833012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:44:16.830268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:44:32.834719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:45:04.839265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:48:56.563314 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:48:56.563426 3.003815 tcp 10.0.2.105 58220 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:05.565704 0.000000 tcp 10.0.2.105 58220 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:11.565730 0.064276 tcp 10.0.2.105 58221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:11.630264 0.064035 tcp 10.0.2.105 58222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:11.694239 0.150521 tcp 10.0.2.105 58223 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:11.856626 2.992438 tcp 10.0.2.105 58224 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:20.847579 0.000000 tcp 10.0.2.105 58224 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:26.857093 0.060053 tcp 10.0.2.105 58225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:26.917409 0.059489 tcp 10.0.2.105 58226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:26.977137 0.154304 tcp 10.0.2.105 58227 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:27.145411 2.995459 tcp 10.0.2.105 58228 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:36.139411 0.000000 tcp 10.0.2.105 58228 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:42.138868 0.063958 tcp 10.0.2.105 58229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:42.203168 0.063453 tcp 10.0.2.105 58230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:42.266900 0.148951 tcp 10.0.2.105 58231 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:42.426564 2.996706 tcp 10.0.2.105 58232 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:51.421579 0.000000 tcp 10.0.2.105 58232 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:49:57.420666 0.059758 tcp 10.0.2.105 58233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:57.480675 0.061383 tcp 10.0.2.105 58234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:57.542361 0.152290 tcp 10.0.2.105 58235 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:49:57.729599 3.005428 tcp 10.0.2.105 58236 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:06.733628 0.000000 tcp 10.0.2.105 58236 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:12.722506 3.003758 tcp 10.0.2.105 58237 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:21.725172 0.000000 tcp 10.0.2.105 58237 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:26.281644 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:50:27.723946 2.993768 tcp 10.0.2.105 58238 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:36.727229 0.000000 tcp 10.0.2.105 58238 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:42.725522 2.994076 tcp 10.0.2.105 58239 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:50:50.285959 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:50:51.718409 0.000000 tcp 10.0.2.105 58239 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:54:29.854211 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 18:54:36.862010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:54:44.863424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:55:00.866238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:55:32.872528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 18:55:57.728800 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:55:57.728922 3.003641 tcp 10.0.2.105 58240 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:06.731135 0.000000 tcp 10.0.2.105 58240 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:12.731892 0.061053 tcp 10.0.2.105 58241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:12.793226 0.061064 tcp 10.0.2.105 58242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:12.854589 0.148757 tcp 10.0.2.105 58243 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:13.120813 3.004068 tcp 10.0.2.105 58244 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:22.123187 0.000000 tcp 10.0.2.105 58244 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:28.122334 0.063744 tcp 10.0.2.105 58245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:28.186353 0.063932 tcp 10.0.2.105 58246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:28.250593 0.148762 tcp 10.0.2.105 58247 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:28.408891 3.007941 tcp 10.0.2.105 58248 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:37.415195 0.000000 tcp 10.0.2.105 58248 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:43.404199 0.065479 tcp 10.0.2.105 58249 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:43.469949 0.061973 tcp 10.0.2.105 58250 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:43.531799 0.158771 tcp 10.0.2.105 58251 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:43.701461 2.997373 tcp 10.0.2.105 58252 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:52.707387 0.000000 tcp 10.0.2.105 58252 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:56:58.696540 0.060391 tcp 10.0.2.105 58253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:58.757249 0.060519 tcp 10.0.2.105 58254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:58.818068 0.153182 tcp 10.0.2.105 58255 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 18:56:59.146646 2.994000 tcp 10.0.2.105 58256 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:08.139431 0.000000 tcp 10.0.2.105 58256 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:14.148236 3.004203 tcp 10.0.2.105 58257 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:23.151045 0.000000 tcp 10.0.2.105 58257 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:27.787673 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:57:29.149752 3.004010 tcp 10.0.2.105 58258 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:38.152658 0.000000 tcp 10.0.2.105 58258 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:44.151332 3.004255 tcp 10.0.2.105 58259 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 18:57:51.782069 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 18:57:53.153970 0.000000 tcp 10.0.2.105 58259 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:01:36.878007 3.012063 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:01:43.895862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:01:51.897431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:02:07.900472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:02:39.915363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:02:59.156494 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:02:59.156635 2.991976 tcp 10.0.2.105 58260 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:08.157591 0.000000 tcp 10.0.2.105 58260 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:14.157062 0.120363 tcp 10.0.2.105 58261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:14.277691 0.130635 tcp 10.0.2.105 58262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:14.408601 0.155561 tcp 10.0.2.105 58263 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:14.578221 2.973589 tcp 10.0.2.105 58264 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:23.499441 0.000000 tcp 10.0.2.105 58264 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:29.468235 0.060817 tcp 10.0.2.105 58265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:29.529334 0.060026 tcp 10.0.2.105 58266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:29.589659 0.152333 tcp 10.0.2.105 58267 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:03:29.769608 3.003006 tcp 10.0.2.105 58268 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:38.771215 0.000000 tcp 10.0.2.105 58268 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:44.770029 3.004056 tcp 10.0.2.105 58269 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:53.772746 0.000000 tcp 10.0.2.105 58269 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:03:58.289256 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:06:29.447240 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:06:29.447342 0.250215 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:29.596423 0.119499 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2604 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:29.766252 0.218727 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:29.977331 0.084681 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:30.160111 0.067353 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:30.346464 0.231754 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:30.570807 0.356016 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:30.977606 0.178072 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:31.152818 0.113824 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2566 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:31.283580 0.096154 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:31.362316 0.175449 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:31.585788 0.000000 udp 10.0.2.105 7010 -> 212.17.122.207 9755 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 19:06:50.078014 0.060688 tcp 10.0.2.105 58270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:06:50.139005 0.064157 tcp 10.0.2.105 58271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:06:50.203448 0.154425 tcp 10.0.2.105 58272 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:06:50.358562 0.060825 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:50.418108 0.239743 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:50.713293 0.172132 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:50.893185 0.068232 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:50.952354 0.127389 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:51.153321 0.452028 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:51.578447 0.174399 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:51.929895 0.751287 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:52.666011 0.125347 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:52.887916 0.073615 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:52.940542 0.127991 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:53.150485 0.199508 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:53.342674 0.249342 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:53.556333 1.131743 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 4 1193 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:06:54.681965 0.177846 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:08:43.912430 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:08:50.920021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:08:58.921290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:08:59.772839 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:08:59.772988 3.004033 tcp 10.0.2.105 58273 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:08.779054 0.000000 tcp 10.0.2.105 58273 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:14.774816 0.486756 tcp 10.0.2.105 58274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:15.261907 0.060124 tcp 10.0.2.105 58275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:15.322327 0.149223 tcp 10.0.2.105 58276 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:15.326754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:09:15.637158 2.964994 tcp 10.0.2.105 58277 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:24.544427 0.000000 tcp 10.0.2.105 58277 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:30.499235 0.061075 tcp 10.0.2.105 58278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:30.560599 0.063947 tcp 10.0.2.105 58279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:30.624824 0.153044 tcp 10.0.2.105 58280 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:30.996858 2.972446 tcp 10.0.2.105 58281 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:39.917109 0.000000 tcp 10.0.2.105 58281 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:45.859942 0.059605 tcp 10.0.2.105 58282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:45.919915 0.064040 tcp 10.0.2.105 58283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:45.984342 0.157695 tcp 10.0.2.105 58284 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:09:46.265999 2.973830 tcp 10.0.2.105 58285 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:09:47.034383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:09:55.181461 0.000000 tcp 10.0.2.105 58285 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:01.152558 0.060845 tcp 10.0.2.105 58286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:10:01.213711 0.063708 tcp 10.0.2.105 58287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:10:01.277707 0.148425 tcp 10.0.2.105 58288 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:10:01.590419 3.007471 tcp 10.0.2.105 58289 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:10.594460 0.000000 tcp 10.0.2.105 58289 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:16.583114 2.994139 tcp 10.0.2.105 58290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:25.585904 0.000000 tcp 10.0.2.105 58290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:30.282812 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:10:31.584942 2.993884 tcp 10.0.2.105 58291 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:40.577558 0.000000 tcp 10.0.2.105 58291 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:46.586213 2.994139 tcp 10.0.2.105 58292 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:10:54.287946 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:10:55.579074 0.000000 tcp 10.0.2.105 58292 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:15:50.936217 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:15:57.943757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:16:01.589668 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:16:01.589834 3.003511 tcp 10.0.2.105 58293 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:05.945389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:16:10.591940 0.000000 tcp 10.0.2.105 58293 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:16.595107 0.062147 tcp 10.0.2.105 58294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:16.657560 0.061656 tcp 10.0.2.105 58295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:16.719467 0.149279 tcp 10.0.2.105 58296 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:16.916724 2.998604 tcp 10.0.2.105 58297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:21.949945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:16:25.914098 0.000000 tcp 10.0.2.105 58297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:31.913233 0.060738 tcp 10.0.2.105 58298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:31.974271 0.066561 tcp 10.0.2.105 58299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:32.041114 0.152040 tcp 10.0.2.105 58300 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:32.325921 2.991875 tcp 10.0.2.105 58301 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:41.326003 0.000000 tcp 10.0.2.105 58301 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:47.330284 0.060349 tcp 10.0.2.105 58302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:47.390912 0.063708 tcp 10.0.2.105 58303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:47.454896 0.191854 tcp 10.0.2.105 58304 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:16:47.835872 2.993665 tcp 10.0.2.105 58305 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:16:53.954899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:16:56.828244 0.000000 tcp 10.0.2.105 58305 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:02.827815 0.060484 tcp 10.0.2.105 58306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:17:02.888581 0.064321 tcp 10.0.2.105 58307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:17:02.953187 0.159953 tcp 10.0.2.105 58308 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:17:03.402276 2.999728 tcp 10.0.2.105 58309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:12.401096 0.000000 tcp 10.0.2.105 58309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:18.401161 3.002757 tcp 10.0.2.105 58310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:27.414001 0.000000 tcp 10.0.2.105 58310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:32.289524 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:17:33.401444 3.004023 tcp 10.0.2.105 58311 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:42.405459 0.000000 tcp 10.0.2.105 58311 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:48.403363 3.006412 tcp 10.0.2.105 58312 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:17:56.283971 0.162812 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:17:57.550054 0.000000 tcp 10.0.2.105 58312 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:22:57.959934 3.002130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:23:03.405923 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:23:03.406071 2.993446 tcp 10.0.2.105 58313 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:04.967716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:23:12.400088 0.000000 tcp 10.0.2.105 58313 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:12.969496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:23:18.408724 0.062199 tcp 10.0.2.105 58314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:18.471213 0.061648 tcp 10.0.2.105 58315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:18.533114 0.151495 tcp 10.0.2.105 58316 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:18.893248 2.998738 tcp 10.0.2.105 58317 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:27.890784 0.000000 tcp 10.0.2.105 58317 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:28.972585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:23:33.889599 0.062558 tcp 10.0.2.105 58318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:33.952568 0.060457 tcp 10.0.2.105 58319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:34.013306 0.149207 tcp 10.0.2.105 58320 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:34.184506 2.999513 tcp 10.0.2.105 58321 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:43.182576 0.000000 tcp 10.0.2.105 58321 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:49.181906 0.060003 tcp 10.0.2.105 58322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:49.242201 0.061304 tcp 10.0.2.105 58323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:49.303747 0.147848 tcp 10.0.2.105 58324 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:23:49.566378 3.000244 tcp 10.0.2.105 58325 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:23:58.565113 0.000000 tcp 10.0.2.105 58325 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:00.978371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:24:04.563897 0.060072 tcp 10.0.2.105 58326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:24:04.624474 0.069641 tcp 10.0.2.105 58327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:24:04.694406 0.150461 tcp 10.0.2.105 58328 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:24:04.856704 2.991389 tcp 10.0.2.105 58329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:13.856834 0.000000 tcp 10.0.2.105 58329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:19.856205 2.993593 tcp 10.0.2.105 58330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:28.848694 0.000000 tcp 10.0.2.105 58330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:33.790637 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:24:34.861273 3.000001 tcp 10.0.2.105 58331 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:43.859562 0.000000 tcp 10.0.2.105 58331 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:49.859086 3.003674 tcp 10.0.2.105 58332 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:24:57.789770 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:24:58.861827 0.000000 tcp 10.0.2.105 58332 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:04.862388 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:30:04.862588 3.003402 tcp 10.0.2.105 58333 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:04.983957 3.002135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:30:11.991716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:30:13.864552 0.000000 tcp 10.0.2.105 58333 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:19.865831 0.060827 tcp 10.0.2.105 58334 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:19.926958 0.061401 tcp 10.0.2.105 58335 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:19.988671 0.150945 tcp 10.0.2.105 58336 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:19.993523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:30:20.157361 3.000270 tcp 10.0.2.105 58337 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:29.166812 0.000000 tcp 10.0.2.105 58337 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:35.156166 0.060635 tcp 10.0.2.105 58338 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:35.217107 0.061205 tcp 10.0.2.105 58339 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:35.278638 0.146852 tcp 10.0.2.105 58340 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:35.574506 2.995651 tcp 10.0.2.105 58341 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:35.996574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:30:44.568544 0.000000 tcp 10.0.2.105 58341 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:50.567596 0.059406 tcp 10.0.2.105 58342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:50.627394 0.060771 tcp 10.0.2.105 58343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:50.688547 0.146693 tcp 10.0.2.105 58344 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:30:50.897390 3.004463 tcp 10.0.2.105 58345 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:30:59.900825 0.000000 tcp 10.0.2.105 58345 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:05.889861 0.060635 tcp 10.0.2.105 58346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:31:05.950793 0.062422 tcp 10.0.2.105 58347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:31:06.013483 0.152518 tcp 10.0.2.105 58348 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:31:06.479258 3.007464 tcp 10.0.2.105 58349 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:08.006113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:31:15.486460 0.000000 tcp 10.0.2.105 58349 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:21.471917 3.004197 tcp 10.0.2.105 58350 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:30.474341 0.000000 tcp 10.0.2.105 58350 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:35.281650 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:31:36.473562 2.993834 tcp 10.0.2.105 58351 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:45.483170 0.000000 tcp 10.0.2.105 58351 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:51.475140 2.994103 tcp 10.0.2.105 58352 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:31:59.286245 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:32:00.467542 0.000000 tcp 10.0.2.105 58352 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:36:55.862902 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:36:55.863056 0.000000 udp 10.0.2.105 7010 -> 212.17.122.207 9755 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 19:37:12.008264 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:37:12.718850 0.061357 tcp 10.0.2.105 58353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:12.780502 0.061613 tcp 10.0.2.105 58354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:12.842380 0.151923 tcp 10.0.2.105 58355 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:12.994476 0.213940 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.200935 0.102290 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.262978 0.157084 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.413770 0.110423 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.521953 0.067686 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.701338 0.177068 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:13.875640 0.335823 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.210877 0.228950 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.431792 0.122178 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.651037 0.110407 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.727201 0.175393 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.895004 0.066528 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:14.958877 0.240031 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:15.850650 0.176355 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:16.112364 0.068896 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:16.171208 0.126122 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:16.389325 0.437214 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:16.805851 0.179464 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:16.981927 0.853575 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:17.820706 0.130114 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:17.941358 0.073691 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:17.995286 0.115275 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:18.193457 0.188185 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:18.421356 0.251396 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:18.637941 1.075026 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:19.015951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:37:19.706708 0.177660 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/10 19:37:21.479597 3.003799 tcp 10.0.2.105 58356 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:37:27.017348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:37:30.482224 0.000000 tcp 10.0.2.105 58356 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:37:36.481335 0.061140 tcp 10.0.2.105 58357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:36.542724 0.060915 tcp 10.0.2.105 58358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:36.603996 0.147656 tcp 10.0.2.105 58359 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:36.779825 3.005733 tcp 10.0.2.105 58360 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:37:43.020169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:37:45.784410 0.000000 tcp 10.0.2.105 58360 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:37:51.773309 0.060374 tcp 10.0.2.105 58361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:51.833980 0.067177 tcp 10.0.2.105 58362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:51.901407 0.155331 tcp 10.0.2.105 58363 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:37:52.135379 2.991609 tcp 10.0.2.105 58364 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:01.135763 0.000000 tcp 10.0.2.105 58364 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:07.135347 0.062139 tcp 10.0.2.105 58365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:07.197797 0.060330 tcp 10.0.2.105 58366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:07.258415 0.149258 tcp 10.0.2.105 58367 -> 195.113.214.249 443 SRPA* 0 0 48 42022 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:07.447167 2.992514 tcp 10.0.2.105 58368 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:15.026230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:38:16.438149 0.000000 tcp 10.0.2.105 58368 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:22.447757 0.061251 tcp 10.0.2.105 58369 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:22.509307 0.060012 tcp 10.0.2.105 58370 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:22.569659 0.151958 tcp 10.0.2.105 58371 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:38:23.178485 3.003816 tcp 10.0.2.105 58372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:32.182708 0.000000 tcp 10.0.2.105 58372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:38.179485 3.004469 tcp 10.0.2.105 58373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:47.182365 0.000000 tcp 10.0.2.105 58373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:38:51.788625 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:38:53.181011 3.004606 tcp 10.0.2.105 58374 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:39:02.185612 0.000000 tcp 10.0.2.105 58374 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:39:08.183326 3.003867 tcp 10.0.2.105 58375 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:39:15.783464 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:39:17.185769 0.000000 tcp 10.0.2.105 58375 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:44:19.033259 3.002246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:44:23.186260 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:44:23.186457 2.995348 tcp 10.0.2.105 58376 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:44:26.041406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:44:32.178888 0.000000 tcp 10.0.2.105 58376 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:44:34.040560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:44:38.197508 0.061008 tcp 10.0.2.105 58377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:38.258764 0.064516 tcp 10.0.2.105 58378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:38.323558 0.146405 tcp 10.0.2.105 58379 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:38.612230 2.989804 tcp 10.0.2.105 58380 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:44:47.600742 0.000000 tcp 10.0.2.105 58380 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:44:50.054212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:44:53.599963 0.059361 tcp 10.0.2.105 58381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:53.659694 0.060027 tcp 10.0.2.105 58382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:53.719956 0.152218 tcp 10.0.2.105 58383 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:44:54.747400 3.007770 tcp 10.0.2.105 58384 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:03.754015 0.000000 tcp 10.0.2.105 58384 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:09.743258 0.060555 tcp 10.0.2.105 58385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:09.804104 0.061393 tcp 10.0.2.105 58386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:09.865822 0.155437 tcp 10.0.2.105 58387 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:10.286538 2.990871 tcp 10.0.2.105 58388 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:19.285578 0.000000 tcp 10.0.2.105 58388 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:22.063309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:45:25.285761 0.059976 tcp 10.0.2.105 58389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:25.346036 0.062351 tcp 10.0.2.105 58390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:25.408713 0.150398 tcp 10.0.2.105 58391 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:45:25.878690 3.000849 tcp 10.0.2.105 58392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:34.884625 0.000000 tcp 10.0.2.105 58392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:40.878736 3.002778 tcp 10.0.2.105 58393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:49.880694 0.000000 tcp 10.0.2.105 58393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:45:54.787103 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:45:55.878659 3.004022 tcp 10.0.2.105 58394 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:46:04.881771 0.000000 tcp 10.0.2.105 58394 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:46:10.880338 3.003752 tcp 10.0.2.105 58395 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:46:18.781813 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:46:19.890021 0.000000 tcp 10.0.2.105 58395 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:51:25.885684 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:51:25.885882 3.004664 tcp 10.0.2.105 58396 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:51:34.896201 0.000000 tcp 10.0.2.105 58396 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:51:40.886607 0.060858 tcp 10.0.2.105 58397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:40.947660 0.063980 tcp 10.0.2.105 58398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:41.011933 0.157560 tcp 10.0.2.105 58399 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:41.181076 2.998347 tcp 10.0.2.105 58400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:51:50.178575 0.000000 tcp 10.0.2.105 58400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:51:56.177362 0.062560 tcp 10.0.2.105 58401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:56.240189 0.062735 tcp 10.0.2.105 58402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:56.303227 0.147718 tcp 10.0.2.105 58403 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:51:56.460604 3.001111 tcp 10.0.2.105 58404 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:05.460127 0.000000 tcp 10.0.2.105 58404 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:11.460041 0.062462 tcp 10.0.2.105 58405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:11.522800 0.062702 tcp 10.0.2.105 58406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:11.585772 0.150423 tcp 10.0.2.105 58407 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:11.752473 3.000928 tcp 10.0.2.105 58408 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:20.752552 0.000000 tcp 10.0.2.105 58408 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:26.751414 0.061118 tcp 10.0.2.105 58409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:26.812804 0.061180 tcp 10.0.2.105 58410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:26.874271 0.148179 tcp 10.0.2.105 58411 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:52:27.031734 3.003662 tcp 10.0.2.105 58412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:36.034217 0.000000 tcp 10.0.2.105 58412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:42.033321 3.003637 tcp 10.0.2.105 58413 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:51.045697 0.000000 tcp 10.0.2.105 58413 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:52:55.782532 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:52:57.034436 2.994351 tcp 10.0.2.105 58414 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:53:06.037112 0.000000 tcp 10.0.2.105 58414 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:53:12.035964 2.993677 tcp 10.0.2.105 58415 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:53:19.786738 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:53:21.028456 0.000000 tcp 10.0.2.105 58415 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:54:39.074429 3.000911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 19:54:46.080703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:54:54.083050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:55:10.085642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:55:42.091841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 19:58:27.039454 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:58:27.039591 3.003399 tcp 10.0.2.105 58416 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:58:36.041720 0.000000 tcp 10.0.2.105 58416 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:58:42.042171 0.083062 tcp 10.0.2.105 58417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:42.125537 0.060709 tcp 10.0.2.105 58418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:42.186535 0.148539 tcp 10.0.2.105 58419 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:42.349688 2.998779 tcp 10.0.2.105 58420 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:58:51.343574 0.000000 tcp 10.0.2.105 58420 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:58:57.333040 0.064343 tcp 10.0.2.105 58421 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:57.397662 0.060241 tcp 10.0.2.105 58422 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:57.458180 0.145781 tcp 10.0.2.105 58423 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:58:57.631399 3.005657 tcp 10.0.2.105 58424 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:06.646043 0.000000 tcp 10.0.2.105 58424 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:12.625290 0.059803 tcp 10.0.2.105 58425 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:12.685392 0.060897 tcp 10.0.2.105 58426 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:12.746593 0.153181 tcp 10.0.2.105 58427 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:13.091857 2.997641 tcp 10.0.2.105 58428 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:22.087760 0.000000 tcp 10.0.2.105 58428 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:28.089504 0.059966 tcp 10.0.2.105 58429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:28.149776 0.062849 tcp 10.0.2.105 58430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:28.212917 0.149033 tcp 10.0.2.105 58431 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/10 19:59:28.437399 2.995428 tcp 10.0.2.105 58432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:37.429807 0.000000 tcp 10.0.2.105 58432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:43.428860 3.006280 tcp 10.0.2.105 58433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:52.431901 0.000000 tcp 10.0.2.105 58433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 19:59:57.288212 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 19:59:58.430218 3.004515 tcp 10.0.2.105 58434 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:00:07.433288 0.000000 tcp 10.0.2.105 58434 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:00:13.432358 3.004343 tcp 10.0.2.105 58435 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:00:21.283366 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:00:22.434827 0.000000 tcp 10.0.2.105 58435 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:01:46.099176 3.000745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:01:53.113682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:02:01.107425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:02:17.109093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:02:49.115888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:07:35.407494 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:07:35.407662 0.212747 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:35.613490 0.084342 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:35.660367 0.157505 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:35.838413 0.109309 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:35.910744 0.115565 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:36.055417 0.177963 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:36.229657 0.340318 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:36.648294 0.111249 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:36.727192 0.175302 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:36.991090 0.062781 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:37.052653 0.228578 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:37.273917 0.087678 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:37.534813 0.241034 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:37.750523 0.179610 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:37.996549 0.068556 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:38.055517 0.172642 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:38.571260 0.129971 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:38.765393 0.447922 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:39.189215 0.170246 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:39.435330 0.178149 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:39.738995 0.069817 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:39.801810 0.128061 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:40.031532 0.190436 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:40.215772 0.390915 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:40.572845 0.878724 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:41.445265 0.172302 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:07:43.450750 3.002520 tcp 10.0.2.105 58436 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:07:52.451581 0.000000 tcp 10.0.2.105 58436 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:07:58.452092 0.060663 tcp 10.0.2.105 58437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:07:58.512993 0.060554 tcp 10.0.2.105 58438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:07:58.573839 0.155916 tcp 10.0.2.105 58439 -> 195.113.214.249 443 SRPA* 0 0 20 11482 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:07:58.753554 3.001675 tcp 10.0.2.105 58440 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:07.755045 0.000000 tcp 10.0.2.105 58440 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:13.753053 0.060791 tcp 10.0.2.105 58441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:13.814169 0.060441 tcp 10.0.2.105 58442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:13.874939 0.151783 tcp 10.0.2.105 58443 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:14.370710 3.007051 tcp 10.0.2.105 58444 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:23.386475 0.000000 tcp 10.0.2.105 58444 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:29.365606 0.064804 tcp 10.0.2.105 58445 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:29.430715 0.060544 tcp 10.0.2.105 58446 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:29.491554 0.152298 tcp 10.0.2.105 58447 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:29.914372 2.995413 tcp 10.0.2.105 58448 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:38.908460 0.000000 tcp 10.0.2.105 58448 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:44.907837 0.062502 tcp 10.0.2.105 58449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:44.970709 0.061841 tcp 10.0.2.105 58450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:45.032844 0.151142 tcp 10.0.2.105 58451 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:08:45.220141 3.001738 tcp 10.0.2.105 58452 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:08:53.121691 3.003216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:08:54.220091 0.000000 tcp 10.0.2.105 58452 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:00.129088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:09:00.219221 3.004103 tcp 10.0.2.105 58453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:08.130071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:09:09.222048 0.000000 tcp 10.0.2.105 58453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:13.788510 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:09:15.221063 3.004190 tcp 10.0.2.105 58454 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:24.133609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:09:24.223573 0.000000 tcp 10.0.2.105 58454 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:30.222847 3.003758 tcp 10.0.2.105 58455 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:37.783408 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:09:39.225377 0.000000 tcp 10.0.2.105 58455 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:09:56.139375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:14:45.227336 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:14:45.227481 2.992005 tcp 10.0.2.105 58456 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:14:54.217696 0.000000 tcp 10.0.2.105 58456 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:00.231906 0.060034 tcp 10.0.2.105 58457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:00.292386 0.060289 tcp 10.0.2.105 58458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:00.353022 0.152546 tcp 10.0.2.105 58459 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:00.902618 3.000150 tcp 10.0.2.105 58460 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:09.900181 0.000000 tcp 10.0.2.105 58460 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:15.899958 0.061756 tcp 10.0.2.105 58461 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:15.962037 0.067211 tcp 10.0.2.105 58462 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:16.029566 0.145586 tcp 10.0.2.105 58463 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:16.364029 3.000363 tcp 10.0.2.105 58464 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:25.362726 0.000000 tcp 10.0.2.105 58464 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:31.362255 0.062649 tcp 10.0.2.105 58465 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:31.425198 0.064570 tcp 10.0.2.105 58466 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:31.490052 0.149547 tcp 10.0.2.105 58467 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:31.661878 3.004757 tcp 10.0.2.105 58468 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:40.665271 0.000000 tcp 10.0.2.105 58468 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:46.654152 0.060921 tcp 10.0.2.105 58469 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:46.715445 0.064251 tcp 10.0.2.105 58470 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:46.780062 0.152678 tcp 10.0.2.105 58471 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:15:47.221072 2.997651 tcp 10.0.2.105 58472 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:15:56.227316 0.000000 tcp 10.0.2.105 58472 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:00.145195 3.002009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:16:02.216517 2.993664 tcp 10.0.2.105 58473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:07.153125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:16:11.208793 0.000000 tcp 10.0.2.105 58473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:15.154271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:16:15.785234 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:16:17.217630 3.004147 tcp 10.0.2.105 58474 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:26.219963 0.000000 tcp 10.0.2.105 58474 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:31.157699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:16:32.219170 3.004274 tcp 10.0.2.105 58475 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:16:39.790014 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:16:41.222205 0.000000 tcp 10.0.2.105 58475 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:17:03.163529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:21:47.222362 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:21:47.222450 3.003680 tcp 10.0.2.105 58476 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:21:56.225086 0.000000 tcp 10.0.2.105 58476 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:02.225289 0.065502 tcp 10.0.2.105 58477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:02.290606 0.071568 tcp 10.0.2.105 58478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:02.362507 0.155912 tcp 10.0.2.105 58479 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:02.660191 2.998246 tcp 10.0.2.105 58480 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:11.675010 0.000000 tcp 10.0.2.105 58480 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:17.656549 0.059882 tcp 10.0.2.105 58481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:17.716706 0.060370 tcp 10.0.2.105 58482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:17.777342 0.153930 tcp 10.0.2.105 58483 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:18.202464 2.997910 tcp 10.0.2.105 58484 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:27.199697 0.000000 tcp 10.0.2.105 58484 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:33.198729 0.060649 tcp 10.0.2.105 58485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:33.259706 0.063765 tcp 10.0.2.105 58486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:33.323826 0.149619 tcp 10.0.2.105 58487 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:33.779566 3.003560 tcp 10.0.2.105 58488 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:42.781993 0.000000 tcp 10.0.2.105 58488 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:48.781153 0.064342 tcp 10.0.2.105 58489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:48.845852 0.060533 tcp 10.0.2.105 58490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:48.906651 0.148234 tcp 10.0.2.105 58491 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:22:49.471451 3.004494 tcp 10.0.2.105 58492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:22:58.474215 0.000000 tcp 10.0.2.105 58492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:04.473210 3.004180 tcp 10.0.2.105 58493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:07.169752 3.001599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:23:13.486005 0.000000 tcp 10.0.2.105 58493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:14.177035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:23:18.283282 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:23:19.474786 2.994244 tcp 10.0.2.105 58494 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:22.178986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:23:28.467700 0.000000 tcp 10.0.2.105 58494 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:34.476870 2.993625 tcp 10.0.2.105 58495 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:23:38.181694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:23:42.287289 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:23:43.469274 0.000000 tcp 10.0.2.105 58495 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:24:10.187464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:28:49.479676 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:28:49.479834 3.007417 tcp 10.0.2.105 58496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:28:58.482107 0.000000 tcp 10.0.2.105 58496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:04.482447 0.061440 tcp 10.0.2.105 58497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:04.544134 0.061275 tcp 10.0.2.105 58498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:04.605683 0.184159 tcp 10.0.2.105 58499 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:04.838022 3.007434 tcp 10.0.2.105 58500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:13.844044 0.000000 tcp 10.0.2.105 58500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:19.833228 0.061910 tcp 10.0.2.105 58501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:19.895435 0.060230 tcp 10.0.2.105 58502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:19.955963 0.152770 tcp 10.0.2.105 58503 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:20.134553 3.003058 tcp 10.0.2.105 58504 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:29.146061 0.000000 tcp 10.0.2.105 58504 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:35.135663 0.059943 tcp 10.0.2.105 58505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:35.195870 0.061965 tcp 10.0.2.105 58506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:35.258135 0.154686 tcp 10.0.2.105 58507 -> 195.113.214.249 443 SRPA* 0 0 19 9796 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:35.465501 2.993928 tcp 10.0.2.105 58508 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:44.457966 0.000000 tcp 10.0.2.105 58508 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:50.467236 0.059452 tcp 10.0.2.105 58509 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:50.526947 0.061292 tcp 10.0.2.105 58510 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:50.588619 0.147813 tcp 10.0.2.105 58511 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:29:50.797529 3.003843 tcp 10.0.2.105 58512 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:29:59.800094 0.000000 tcp 10.0.2.105 58512 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:05.798873 3.004491 tcp 10.0.2.105 58513 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:14.193278 3.017766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:30:14.801871 0.000000 tcp 10.0.2.105 58513 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:19.792775 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:30:20.800185 3.004373 tcp 10.0.2.105 58514 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:21.200707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:30:29.202760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:30:29.806157 0.000000 tcp 10.0.2.105 58514 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:35.802088 3.004383 tcp 10.0.2.105 58515 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:43.783565 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:30:44.804785 0.000000 tcp 10.0.2.105 58515 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:30:45.231774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:31:17.211616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:37:21.217488 3.001456 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 20:37:28.224968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:37:36.226489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:37:46.631899 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:37:46.631991 0.158495 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:46.782565 0.110589 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 1939 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:46.865250 0.068728 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:46.944861 0.212895 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.150223 0.088094 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.222046 0.177875 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.396849 0.346586 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.742612 0.113530 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.823583 0.174990 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:47.990652 0.062679 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.051910 0.232158 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.276942 0.096617 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.355782 0.237738 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.569473 0.170919 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.740046 0.128810 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:48.859733 0.443970 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.278056 0.171529 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.446116 0.128027 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.592767 0.173802 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.750495 0.128857 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.837710 0.078834 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:49.892094 0.103299 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:50.052837 0.189792 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2580 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:50.236914 0.254933 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:50.456451 0.880316 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:50.817637 3.003918 tcp 10.0.2.105 58516 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:37:51.328718 0.209485 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/10 20:37:52.229547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:37:59.820040 0.000000 tcp 10.0.2.105 58516 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:05.820527 0.061100 tcp 10.0.2.105 58517 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:05.881899 0.059806 tcp 10.0.2.105 58518 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:05.942038 0.147740 tcp 10.0.2.105 58519 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:06.101481 3.002297 tcp 10.0.2.105 58520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:15.102501 0.000000 tcp 10.0.2.105 58520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:21.101582 0.063273 tcp 10.0.2.105 58521 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:21.165121 0.061289 tcp 10.0.2.105 58522 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:21.226691 0.149412 tcp 10.0.2.105 58523 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:21.401633 3.003821 tcp 10.0.2.105 58524 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:24.235658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:38:30.403999 0.000000 tcp 10.0.2.105 58524 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:36.403767 0.059799 tcp 10.0.2.105 58525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:36.463836 0.060400 tcp 10.0.2.105 58526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:36.524587 0.146438 tcp 10.0.2.105 58527 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:36.687347 3.000480 tcp 10.0.2.105 58528 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:45.696497 0.000000 tcp 10.0.2.105 58528 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:38:51.685705 0.059679 tcp 10.0.2.105 58529 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:51.745719 0.061836 tcp 10.0.2.105 58530 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:51.807816 0.150719 tcp 10.0.2.105 58531 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:38:52.008963 2.990314 tcp 10.0.2.105 58532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:00.998112 0.000000 tcp 10.0.2.105 58532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:07.006769 3.004668 tcp 10.0.2.105 58533 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:16.009266 0.000000 tcp 10.0.2.105 58533 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:20.787053 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:39:22.008269 3.004804 tcp 10.0.2.105 58534 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:31.011484 0.000000 tcp 10.0.2.105 58534 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:37.010286 3.004190 tcp 10.0.2.105 58535 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:39:44.781425 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:39:46.015525 0.000000 tcp 10.0.2.105 58535 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:44:28.242695 3.002869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:44:35.249067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:44:43.251245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:44:52.020241 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:44:52.020355 2.998476 tcp 10.0.2.105 58536 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:44:59.253512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:45:01.025474 0.000000 tcp 10.0.2.105 58536 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:07.016457 0.061842 tcp 10.0.2.105 58537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:07.078533 0.061440 tcp 10.0.2.105 58538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:07.140294 0.154969 tcp 10.0.2.105 58539 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:07.408113 3.001517 tcp 10.0.2.105 58540 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:16.411344 0.000000 tcp 10.0.2.105 58540 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:22.407510 0.063126 tcp 10.0.2.105 58541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:22.470991 0.060495 tcp 10.0.2.105 58542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:22.531796 0.146821 tcp 10.0.2.105 58543 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:22.855941 2.995738 tcp 10.0.2.105 58544 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:31.259482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:45:31.850231 0.000000 tcp 10.0.2.105 58544 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:37.857617 0.103104 tcp 10.0.2.105 58545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:37.961016 0.065453 tcp 10.0.2.105 58546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:38.026747 0.155706 tcp 10.0.2.105 58547 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:38.229052 2.994653 tcp 10.0.2.105 58548 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:47.222458 0.000000 tcp 10.0.2.105 58548 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:45:53.221411 0.060338 tcp 10.0.2.105 58549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:53.282078 0.061598 tcp 10.0.2.105 58550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:53.343984 0.151330 tcp 10.0.2.105 58551 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:45:53.903675 3.002271 tcp 10.0.2.105 58552 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:02.904982 0.000000 tcp 10.0.2.105 58552 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:08.903842 2.993985 tcp 10.0.2.105 58553 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:17.906496 0.000000 tcp 10.0.2.105 58553 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:22.783447 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:46:23.905192 2.994164 tcp 10.0.2.105 58554 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:32.898324 0.000000 tcp 10.0.2.105 58554 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:38.906870 2.994151 tcp 10.0.2.105 58555 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:46:46.787912 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:46:47.899426 0.000000 tcp 10.0.2.105 58555 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:51:53.910210 0.000181 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:51:53.910492 3.003530 tcp 10.0.2.105 58556 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:02.915340 0.000000 tcp 10.0.2.105 58556 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:08.912781 0.062255 tcp 10.0.2.105 58557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:08.975272 0.060958 tcp 10.0.2.105 58558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:09.036569 0.149464 tcp 10.0.2.105 58559 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:09.208692 3.007162 tcp 10.0.2.105 58560 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:18.214293 0.000000 tcp 10.0.2.105 58560 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:24.203873 0.064735 tcp 10.0.2.105 58561 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:24.268957 0.060431 tcp 10.0.2.105 58562 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:24.329752 0.146394 tcp 10.0.2.105 58563 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:24.492892 2.995185 tcp 10.0.2.105 58564 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:33.496811 0.000000 tcp 10.0.2.105 58564 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:39.485897 0.059235 tcp 10.0.2.105 58565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:39.545436 0.065703 tcp 10.0.2.105 58566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:39.611485 0.149753 tcp 10.0.2.105 58567 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:39.772593 2.997236 tcp 10.0.2.105 58568 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:48.768541 0.000000 tcp 10.0.2.105 58568 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:52:54.767777 0.063235 tcp 10.0.2.105 58569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:54.831237 0.063891 tcp 10.0.2.105 58570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:54.895452 0.151164 tcp 10.0.2.105 58571 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:52:55.491038 3.001536 tcp 10.0.2.105 58572 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:04.492098 0.000000 tcp 10.0.2.105 58572 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:10.489780 3.006464 tcp 10.0.2.105 58573 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:19.492570 0.000000 tcp 10.0.2.105 58573 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:24.289498 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:53:25.492110 3.003648 tcp 10.0.2.105 58574 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:34.495391 0.000000 tcp 10.0.2.105 58574 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:40.492921 3.004078 tcp 10.0.2.105 58575 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:53:48.283774 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:53:49.505896 0.000000 tcp 10.0.2.105 58575 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:54:45.268586 3.002057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 20:54:52.275871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:55:00.277589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:55:16.280851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:55:48.286780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 20:58:55.496281 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 20:58:55.496445 2.993592 tcp 10.0.2.105 58576 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:04.488780 0.000000 tcp 10.0.2.105 58576 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:10.503406 0.061335 tcp 10.0.2.105 58577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:10.565025 0.063691 tcp 10.0.2.105 58578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:10.629000 0.151816 tcp 10.0.2.105 58579 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:10.862766 2.999481 tcp 10.0.2.105 58580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:19.860461 0.000000 tcp 10.0.2.105 58580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:25.860156 0.059986 tcp 10.0.2.105 58581 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:25.920417 0.058856 tcp 10.0.2.105 58582 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:25.979569 0.147563 tcp 10.0.2.105 58583 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:26.138385 3.005715 tcp 10.0.2.105 58584 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:35.142657 0.000000 tcp 10.0.2.105 58584 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:41.134091 0.061533 tcp 10.0.2.105 58585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:41.195956 0.061518 tcp 10.0.2.105 58586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:41.257772 0.164104 tcp 10.0.2.105 58587 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:41.535165 3.009311 tcp 10.0.2.105 58588 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:50.540733 0.000000 tcp 10.0.2.105 58588 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 20:59:56.534031 0.061477 tcp 10.0.2.105 58589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:56.595824 0.064570 tcp 10.0.2.105 58590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:56.660683 0.149979 tcp 10.0.2.105 58591 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 20:59:57.119619 3.004804 tcp 10.0.2.105 58592 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:06.133443 0.000000 tcp 10.0.2.105 58592 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:12.116265 2.993941 tcp 10.0.2.105 58593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:21.108854 0.000000 tcp 10.0.2.105 58593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:25.786099 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:00:27.117794 3.004104 tcp 10.0.2.105 58594 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:36.120280 0.000000 tcp 10.0.2.105 58594 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:42.119270 3.004077 tcp 10.0.2.105 58595 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:00:49.791923 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:00:51.123080 0.000000 tcp 10.0.2.105 58595 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:01:52.299357 2.999664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:01:59.304015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:02:07.302625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:02:23.304959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:02:55.310705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:08:04.344918 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:08:04.345016 0.069903 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:04.533740 0.210037 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:04.736645 0.088164 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:04.783672 0.155845 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:05.030858 0.113036 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:05.105154 0.183951 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:05.411529 0.355876 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:05.820169 0.559955 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:06.349810 0.173974 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:06.516623 0.063228 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:06.699755 0.228818 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:06.921410 0.093416 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:06.997033 0.236545 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:07.211536 0.174386 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:07.550878 0.083163 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:07.623365 0.446009 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.046788 0.175750 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.219731 0.129526 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.432166 0.171943 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.589563 0.234014 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 4 1390 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.799383 0.076187 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:08.929687 0.115772 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:09.276056 0.195708 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:09.564623 0.253241 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:09.785024 0.906927 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:10.686071 0.178915 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:08:12.136556 2.993719 tcp 10.0.2.105 58596 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:21.128904 0.000000 tcp 10.0.2.105 58596 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:27.139912 0.066245 tcp 10.0.2.105 58597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:27.206466 0.063303 tcp 10.0.2.105 58598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:27.270409 0.149076 tcp 10.0.2.105 58599 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:27.558517 3.003982 tcp 10.0.2.105 58600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:36.561366 0.000000 tcp 10.0.2.105 58600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:42.560533 0.062545 tcp 10.0.2.105 58601 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:42.623366 0.063898 tcp 10.0.2.105 58602 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:42.687575 0.147699 tcp 10.0.2.105 58603 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:42.860999 3.003767 tcp 10.0.2.105 58604 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:51.863032 0.000000 tcp 10.0.2.105 58604 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:57.862357 0.060463 tcp 10.0.2.105 58605 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:57.923123 0.063381 tcp 10.0.2.105 58606 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:57.986830 0.146982 tcp 10.0.2.105 58607 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:08:58.351643 3.005141 tcp 10.0.2.105 58608 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:08:59.316654 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:09:06.323994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:09:07.355679 0.000000 tcp 10.0.2.105 58608 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:13.344673 0.063137 tcp 10.0.2.105 58609 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:09:13.408103 0.061646 tcp 10.0.2.105 58610 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:09:13.470035 0.156702 tcp 10.0.2.105 58611 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:09:13.691439 2.997462 tcp 10.0.2.105 58612 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:14.325454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:09:22.687448 0.000000 tcp 10.0.2.105 58612 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:28.686422 2.993885 tcp 10.0.2.105 58613 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:30.328812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:09:37.679167 0.000000 tcp 10.0.2.105 58613 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:42.285599 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:09:43.693375 2.998635 tcp 10.0.2.105 58614 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:52.690808 0.000000 tcp 10.0.2.105 58614 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:09:58.691063 3.002580 tcp 10.0.2.105 58615 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:10:02.334341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:10:06.290119 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:10:07.692532 0.000000 tcp 10.0.2.105 58615 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:13.692949 0.190586 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:15:13.883628 2.968131 tcp 10.0.2.105 58616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:22.793919 0.000000 tcp 10.0.2.105 58616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:28.747187 0.062196 tcp 10.0.2.105 58617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:28.809680 0.061983 tcp 10.0.2.105 58618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:28.871922 0.151062 tcp 10.0.2.105 58619 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:29.343963 2.970989 tcp 10.0.2.105 58620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:38.310754 0.000000 tcp 10.0.2.105 58620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:44.306823 0.062649 tcp 10.0.2.105 58621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:44.369744 0.060448 tcp 10.0.2.105 58622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:44.430477 0.148390 tcp 10.0.2.105 58623 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:15:44.984317 2.997244 tcp 10.0.2.105 58624 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:53.980160 0.000000 tcp 10.0.2.105 58624 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:15:59.979380 0.063390 tcp 10.0.2.105 58625 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:00.043064 0.060115 tcp 10.0.2.105 58626 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:00.103516 0.150898 tcp 10.0.2.105 58627 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:00.379295 3.004275 tcp 10.0.2.105 58628 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:06.341632 3.000541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:16:09.382044 0.000000 tcp 10.0.2.105 58628 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:13.347837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:16:15.384689 0.059552 tcp 10.0.2.105 58629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:15.444587 0.059975 tcp 10.0.2.105 58630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:15.504879 0.145761 tcp 10.0.2.105 58631 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:16:15.718702 3.001113 tcp 10.0.2.105 58632 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:21.349643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:16:24.714731 0.000000 tcp 10.0.2.105 58632 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:30.713182 2.997475 tcp 10.0.2.105 58633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:37.353272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:16:39.715719 0.000000 tcp 10.0.2.105 58633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:44.283858 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:16:45.714642 2.998510 tcp 10.0.2.105 58634 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:16:54.720631 0.000000 tcp 10.0.2.105 58634 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:17:00.716077 2.994648 tcp 10.0.2.105 58635 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:17:08.287011 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:17:09.358387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:17:09.709193 0.000000 tcp 10.0.2.105 58635 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:15.719647 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:22:15.719812 3.003591 tcp 10.0.2.105 58636 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:24.722072 0.000000 tcp 10.0.2.105 58636 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:30.722787 0.060707 tcp 10.0.2.105 58637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:30.783770 0.060929 tcp 10.0.2.105 58638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:30.844998 0.146973 tcp 10.0.2.105 58639 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:31.207175 2.998277 tcp 10.0.2.105 58640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:40.203620 0.000000 tcp 10.0.2.105 58640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:46.204399 0.063312 tcp 10.0.2.105 58641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:46.268063 0.064134 tcp 10.0.2.105 58642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:46.332521 0.148450 tcp 10.0.2.105 58643 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:22:46.714691 2.993317 tcp 10.0.2.105 58644 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:22:55.716571 0.000000 tcp 10.0.2.105 58644 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:01.715810 0.063832 tcp 10.0.2.105 58645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:01.779901 0.062644 tcp 10.0.2.105 58646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:01.842810 0.149174 tcp 10.0.2.105 58647 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:02.281448 2.998530 tcp 10.0.2.105 58648 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:11.278589 0.000000 tcp 10.0.2.105 58648 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:13.363924 3.002307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:23:17.277961 0.059755 tcp 10.0.2.105 58649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:17.337996 0.062492 tcp 10.0.2.105 58650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:17.400813 0.155361 tcp 10.0.2.105 58651 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:23:17.745256 2.997407 tcp 10.0.2.105 58652 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:20.371905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:23:26.746753 0.000000 tcp 10.0.2.105 58652 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:28.376866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:23:32.739890 3.003933 tcp 10.0.2.105 58653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:41.742860 0.000000 tcp 10.0.2.105 58653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:44.376531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:23:46.289007 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:23:47.741542 3.003928 tcp 10.0.2.105 58654 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:23:56.744046 0.000000 tcp 10.0.2.105 58654 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:24:02.742994 3.004051 tcp 10.0.2.105 58655 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:24:10.283651 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:24:11.756602 0.000000 tcp 10.0.2.105 58655 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:24:16.382778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:29:17.746158 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:29:17.746258 2.994208 tcp 10.0.2.105 58656 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:29:26.738749 0.000000 tcp 10.0.2.105 58656 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:29:32.749118 0.060814 tcp 10.0.2.105 58657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:32.810216 0.060022 tcp 10.0.2.105 58658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:32.870502 0.156382 tcp 10.0.2.105 58659 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:33.036553 2.995384 tcp 10.0.2.105 58660 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:29:42.030376 0.000000 tcp 10.0.2.105 58660 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:29:48.029985 0.065354 tcp 10.0.2.105 58661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:48.095633 0.063095 tcp 10.0.2.105 58662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:48.159071 0.151694 tcp 10.0.2.105 58663 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:29:48.329291 3.004364 tcp 10.0.2.105 58664 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:29:57.332643 0.000000 tcp 10.0.2.105 58664 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:03.321981 0.059709 tcp 10.0.2.105 58665 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:03.382007 0.062839 tcp 10.0.2.105 58666 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:03.445137 0.147551 tcp 10.0.2.105 58667 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:03.603529 3.002416 tcp 10.0.2.105 58668 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:12.604902 0.000000 tcp 10.0.2.105 58668 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:18.604068 0.061220 tcp 10.0.2.105 58669 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:18.665582 0.060870 tcp 10.0.2.105 58670 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:18.726714 0.152765 tcp 10.0.2.105 58671 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:30:18.921494 2.996378 tcp 10.0.2.105 58672 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:20.388192 3.002289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:30:27.395871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:30:27.927032 0.000000 tcp 10.0.2.105 58672 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:33.915227 2.994386 tcp 10.0.2.105 58673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:35.397273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:30:42.907970 0.000000 tcp 10.0.2.105 58673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:47.784820 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:30:48.917064 2.994418 tcp 10.0.2.105 58674 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:30:51.400682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:30:57.909500 0.000000 tcp 10.0.2.105 58674 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:31:03.918652 3.004110 tcp 10.0.2.105 58675 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:31:11.789706 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:31:12.921390 0.000000 tcp 10.0.2.105 58675 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:31:23.406567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:37:27.412554 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 21:37:34.422901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:37:42.421328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:37:58.424578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:38:30.430174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:38:39.994668 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:38:39.994776 0.079948 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.039051 0.157522 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.189277 0.112071 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.263264 0.075344 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.364188 0.210243 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.567181 0.175789 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:40.740154 0.345930 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.105684 0.071151 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.204723 0.229164 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.426523 0.092999 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.502772 0.239480 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.716185 0.103669 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.793976 0.175232 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:41.960799 0.172488 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:42.139101 0.068668 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:42.199080 0.458549 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:42.637277 0.174055 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:42.807687 0.128438 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.020540 0.168385 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.174676 0.129820 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.261538 0.075395 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.348717 0.103363 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.488280 0.197370 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.702556 0.264886 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:43.936112 0.823929 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:44.747386 0.178037 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/10 21:38:48.937605 3.003862 tcp 10.0.2.105 58676 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:38:57.939285 0.000000 tcp 10.0.2.105 58676 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:03.939519 0.062837 tcp 10.0.2.105 58677 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:04.002564 0.060991 tcp 10.0.2.105 58678 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:04.063857 0.150517 tcp 10.0.2.105 58679 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:04.360684 3.002729 tcp 10.0.2.105 58680 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:13.362309 0.000000 tcp 10.0.2.105 58680 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:19.361509 0.061054 tcp 10.0.2.105 58681 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:19.422891 0.064193 tcp 10.0.2.105 58682 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:19.487463 0.154891 tcp 10.0.2.105 58683 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:19.781386 3.004094 tcp 10.0.2.105 58684 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:28.783878 0.000000 tcp 10.0.2.105 58684 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:34.783487 0.060377 tcp 10.0.2.105 58685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:34.844124 0.061846 tcp 10.0.2.105 58686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:34.906231 0.148919 tcp 10.0.2.105 58687 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:35.106571 3.001078 tcp 10.0.2.105 58688 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:44.116083 0.000000 tcp 10.0.2.105 58688 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:50.105640 0.061893 tcp 10.0.2.105 58689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:50.167390 0.061620 tcp 10.0.2.105 58690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:50.229355 0.152722 tcp 10.0.2.105 58691 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:39:50.854280 2.996031 tcp 10.0.2.105 58692 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:39:59.851941 0.000000 tcp 10.0.2.105 58692 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:05.848620 3.003391 tcp 10.0.2.105 58693 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:13.788759 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:40:14.850538 0.000000 tcp 10.0.2.105 58693 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:20.849418 3.003967 tcp 10.0.2.105 58694 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:29.852606 0.000000 tcp 10.0.2.105 58694 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:35.850867 3.004175 tcp 10.0.2.105 58695 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:40:40.787474 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:40:44.853536 0.000000 tcp 10.0.2.105 58695 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:44:34.436021 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:44:41.443631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:44:49.445411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:45:05.448680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:45:37.457688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:45:50.858455 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:45:50.858600 2.989304 tcp 10.0.2.105 58696 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:45:59.856544 0.000000 tcp 10.0.2.105 58696 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:05.857413 0.064525 tcp 10.0.2.105 58697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:05.922181 0.064457 tcp 10.0.2.105 58698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:05.986921 0.160863 tcp 10.0.2.105 58699 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:06.338587 3.001449 tcp 10.0.2.105 58700 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:15.341093 0.000000 tcp 10.0.2.105 58700 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:21.338071 0.060743 tcp 10.0.2.105 58701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:21.399126 0.066097 tcp 10.0.2.105 58702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:21.465489 0.154602 tcp 10.0.2.105 58703 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:21.861743 3.000869 tcp 10.0.2.105 58704 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:30.861215 0.000000 tcp 10.0.2.105 58704 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:36.861128 0.060895 tcp 10.0.2.105 58705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:36.922355 0.064990 tcp 10.0.2.105 58706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:36.987680 0.155128 tcp 10.0.2.105 58707 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:37.231639 3.003129 tcp 10.0.2.105 58708 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:46.233478 0.000000 tcp 10.0.2.105 58708 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:46:52.232644 0.063118 tcp 10.0.2.105 58709 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:52.296061 0.061524 tcp 10.0.2.105 58710 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:52.357879 0.155465 tcp 10.0.2.105 58711 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:46:52.568789 3.008386 tcp 10.0.2.105 58712 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:01.575091 0.000000 tcp 10.0.2.105 58712 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:07.564163 2.994099 tcp 10.0.2.105 58713 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:16.566737 0.000000 tcp 10.0.2.105 58713 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:21.283527 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:47:22.565737 2.994210 tcp 10.0.2.105 58714 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:31.558763 0.000000 tcp 10.0.2.105 58714 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:37.567243 3.003997 tcp 10.0.2.105 58715 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:47:45.294083 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:47:46.573527 0.000000 tcp 10.0.2.105 58715 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:52:52.570613 0.000182 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:52:52.570894 3.003311 tcp 10.0.2.105 58716 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:01.572630 0.000000 tcp 10.0.2.105 58716 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:07.573265 0.061857 tcp 10.0.2.105 58717 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:07.635459 0.061908 tcp 10.0.2.105 58718 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:07.697622 0.157511 tcp 10.0.2.105 58719 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:08.078814 3.007955 tcp 10.0.2.105 58720 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:17.084976 0.000000 tcp 10.0.2.105 58720 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:23.074376 0.061249 tcp 10.0.2.105 58721 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:23.135867 0.063164 tcp 10.0.2.105 58722 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:23.199346 0.148750 tcp 10.0.2.105 58723 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:23.562421 2.996383 tcp 10.0.2.105 58724 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:32.557435 0.000000 tcp 10.0.2.105 58724 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:38.556768 0.065034 tcp 10.0.2.105 58725 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:38.622095 0.063980 tcp 10.0.2.105 58726 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:38.686395 0.162333 tcp 10.0.2.105 58727 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:38.902780 2.998160 tcp 10.0.2.105 58728 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:47.899456 0.000000 tcp 10.0.2.105 58728 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:53:53.898674 0.061946 tcp 10.0.2.105 58729 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:53.960881 0.066738 tcp 10.0.2.105 58730 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:54.027964 0.148649 tcp 10.0.2.105 58731 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 21:53:54.202350 3.000420 tcp 10.0.2.105 58732 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:03.201551 0.000000 tcp 10.0.2.105 58732 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:09.200293 3.004234 tcp 10.0.2.105 58733 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:18.202776 0.000000 tcp 10.0.2.105 58733 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:22.789586 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:54:24.201885 3.004126 tcp 10.0.2.105 58734 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:33.204759 0.000000 tcp 10.0.2.105 58734 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:39.203411 2.997322 tcp 10.0.2.105 58735 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:46.784021 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:54:48.206148 0.000000 tcp 10.0.2.105 58735 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 21:54:48.468906 3.002144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 21:54:55.481272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:55:03.478271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:55:19.483842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:55:51.487203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 21:59:54.206494 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 21:59:54.206675 2.994023 tcp 10.0.2.105 58736 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:03.200806 0.000000 tcp 10.0.2.105 58736 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:09.209628 0.065955 tcp 10.0.2.105 58737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:09.275922 0.061112 tcp 10.0.2.105 58738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:09.337289 0.150283 tcp 10.0.2.105 58739 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:09.510950 3.001515 tcp 10.0.2.105 58740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:18.511159 0.000000 tcp 10.0.2.105 58740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:24.510372 0.060728 tcp 10.0.2.105 58741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:24.571367 0.060817 tcp 10.0.2.105 58742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:24.632480 0.154215 tcp 10.0.2.105 58743 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:24.825845 2.998535 tcp 10.0.2.105 58744 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:33.823114 0.000000 tcp 10.0.2.105 58744 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:39.822552 0.060552 tcp 10.0.2.105 58745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:39.883388 0.061425 tcp 10.0.2.105 58746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:39.945064 0.153570 tcp 10.0.2.105 58747 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:40.122442 3.004111 tcp 10.0.2.105 58748 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:49.125071 0.000000 tcp 10.0.2.105 58748 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:00:55.124176 0.064655 tcp 10.0.2.105 58749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:55.189116 0.063003 tcp 10.0.2.105 58750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:55.252572 0.148579 tcp 10.0.2.105 58751 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:00:55.443336 2.995217 tcp 10.0.2.105 58752 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:04.447081 0.000000 tcp 10.0.2.105 58752 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:10.436050 2.994201 tcp 10.0.2.105 58753 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:19.428894 0.000000 tcp 10.0.2.105 58753 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:24.285680 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:01:25.437317 3.004470 tcp 10.0.2.105 58754 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:34.440256 0.000000 tcp 10.0.2.105 58754 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:40.441595 3.002170 tcp 10.0.2.105 58755 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:48.280403 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:01:49.441811 0.000000 tcp 10.0.2.105 58755 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:01:55.495855 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 22:02:02.503046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:02:10.502285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:02:26.505293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:02:58.511375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:08:55.975330 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:08:55.975496 0.090457 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:56.030255 0.156683 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:56.655699 0.217827 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:56.865828 0.180033 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:57.214558 0.341530 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:57.571343 0.064143 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:57.825583 0.115677 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:58.032279 0.067295 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:58.350258 0.230215 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:08:58.573065 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 22:09:03.521720 3.799858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:09:11.200546 2.955693 tcp 10.0.2.105 58756 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:11.279193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:09:15.074488 0.062541 tcp 10.0.2.105 58757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:15.137379 0.060657 tcp 10.0.2.105 58758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:15.198296 0.151253 tcp 10.0.2.105 58759 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:15.350071 0.238957 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:15.565424 0.102503 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:15.699370 0.174875 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:15.866013 0.179428 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:16.151441 0.068101 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:16.210400 0.129863 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:16.619852 0.172523 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:16.776433 0.435285 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:17.188109 0.172900 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:17.899029 0.320598 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1921 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:18.183253 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 22:09:19.186391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:09:20.087292 0.000000 tcp 10.0.2.105 58756 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:26.022702 0.061281 tcp 10.0.2.105 58760 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:26.084352 0.060725 tcp 10.0.2.105 58761 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:26.145353 0.155394 tcp 10.0.2.105 58762 -> 195.113.214.249 443 SRPA* 0 0 25 14108 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:26.377354 2.961563 tcp 10.0.2.105 58763 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:34.985729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:09:35.263497 0.000000 tcp 10.0.2.105 58763 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:36.187705 0.067539 tcp 10.0.2.105 58764 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:36.255534 0.060398 tcp 10.0.2.105 58765 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:36.316400 0.148875 tcp 10.0.2.105 58766 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:36.465777 0.103295 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2603 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:36.630259 0.199165 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:36.837717 0.472919 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 5 1907 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:37.282656 1.104224 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 4 1195 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:38.386120 0.174948 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:09:41.198393 0.061059 tcp 10.0.2.105 58767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:41.259723 0.062533 tcp 10.0.2.105 58768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:41.322544 0.150495 tcp 10.0.2.105 58769 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:09:41.537908 2.971557 tcp 10.0.2.105 58770 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:50.434700 0.000000 tcp 10.0.2.105 58770 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:09:56.359868 2.971642 tcp 10.0.2.105 58771 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:10:05.259284 0.000000 tcp 10.0.2.105 58771 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:10:06.625668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:10:09.816105 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:15:11.167799 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:15:11.167900 2.990999 tcp 10.0.2.105 58772 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:20.167312 0.000000 tcp 10.0.2.105 58772 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:26.167762 0.062148 tcp 10.0.2.105 58773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:26.230168 0.061443 tcp 10.0.2.105 58774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:26.291923 0.152833 tcp 10.0.2.105 58775 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:26.891425 3.000129 tcp 10.0.2.105 58776 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:36.159338 0.000000 tcp 10.0.2.105 58776 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:42.105118 0.064188 tcp 10.0.2.105 58777 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:42.169579 0.060638 tcp 10.0.2.105 58778 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:42.230473 0.156238 tcp 10.0.2.105 58779 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:42.739355 2.980640 tcp 10.0.2.105 58780 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:51.664508 0.000000 tcp 10.0.2.105 58780 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:15:57.605199 0.060495 tcp 10.0.2.105 58781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:57.666037 0.065408 tcp 10.0.2.105 58782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:57.731748 0.159758 tcp 10.0.2.105 58783 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:15:57.977732 2.981131 tcp 10.0.2.105 58784 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:06.904450 0.000000 tcp 10.0.2.105 58784 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:10.552794 3.002040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 22:16:12.895342 0.060864 tcp 10.0.2.105 58785 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:16:12.956513 0.060736 tcp 10.0.2.105 58786 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:16:13.017526 0.156634 tcp 10.0.2.105 58787 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:16:13.297986 2.999880 tcp 10.0.2.105 58788 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:17.559970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:16:22.309578 0.000000 tcp 10.0.2.105 58788 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:25.561606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:16:28.298461 2.991281 tcp 10.0.2.105 58789 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:37.288440 0.000000 tcp 10.0.2.105 58789 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:41.564469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:16:42.285912 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:16:43.297167 3.004035 tcp 10.0.2.105 58790 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:52.299845 0.000000 tcp 10.0.2.105 58790 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:16:58.298885 3.003897 tcp 10.0.2.105 58791 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:17:06.279933 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:17:07.301080 0.000000 tcp 10.0.2.105 58791 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:17:13.570770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:22:13.462092 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:22:13.462259 3.003621 tcp 10.0.2.105 58792 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:22:22.464888 0.000000 tcp 10.0.2.105 58792 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 22:22:28.464821 0.427747 tcp 10.0.2.105 58793 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:22:28.892872 0.060583 tcp 10.0.2.105 58794 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:22:28.953817 0.153747 tcp 10.0.2.105 58795 -> 195.113.214.249 443 SRPA* 0 0 41 35804 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:22:29.640121 0.696184 tcp 10.0.2.105 58796 -> 31.192.24.67 3527 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:23:17.746896 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:23:24.754474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:23:32.769810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:23:48.768824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:24:20.774694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:30:24.780548 3.002264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:30:31.793055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:30:39.789546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:30:55.792888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:31:27.798705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:37:31.804611 3.020790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:37:38.822235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:37:46.823582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:38:02.827055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:38:34.832820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:39:38.464656 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:39:38.464832 0.078990 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:38.544217 0.055162 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:38.599832 0.048301 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:38.648597 0.172784 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:38.821815 0.208124 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.030323 0.149414 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.180142 0.059894 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.240411 0.076673 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.317466 0.359277 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.677117 0.067827 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:39.745365 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/10 22:39:58.234557 0.062262 tcp 10.0.2.105 58797 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:39:58.297063 0.060348 tcp 10.0.2.105 58798 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:39:58.357712 0.155547 tcp 10.0.2.105 58799 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:39:58.513817 0.077174 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:58.591407 0.165079 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:58.756879 0.212308 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:58.969572 0.156645 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:59.126567 0.057945 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:59.184893 0.147189 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:59.332703 0.125682 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:59.458731 0.168225 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:39:59.627348 0.456195 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:00.083918 0.081879 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:00.166231 0.114539 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:00.281155 0.194187 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:00.475714 0.218131 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:00.694264 0.502287 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:40:01.196931 0.145387 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/10 22:44:38.838572 3.159347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:44:45.972985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:44:53.905940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:45:09.870288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:45:41.881302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:52:29.993874 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 22:52:29.994047 0.510549 tcp 10.0.2.105 58800 -> 31.192.24.67 3527 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/02/10 22:54:51.889793 3.002070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 22:54:58.897379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:55:06.899020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:55:22.902783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 22:55:54.908009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:01:58.914780 3.000634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 23:02:05.921632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:02:13.923063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:02:29.925447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:03:01.942072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:09:07.951203 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 23:09:14.958033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:09:23.034772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:09:38.973160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:10:10.978798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:10:29.185344 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:10:29.185497 0.216027 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:29.401885 0.057455 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:29.459761 0.046175 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:29.506268 0.171335 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:29.677969 0.204326 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:29.882757 0.147590 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.030756 0.058135 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.137434 0.075912 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.213745 0.080271 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.294389 0.333447 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.628486 0.064486 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.693360 0.081006 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.774732 0.167165 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:30.942230 0.213812 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.156631 0.156911 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.313911 0.058755 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.373033 0.148055 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.521474 0.127164 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.649067 0.168411 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:31.817846 0.406023 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:32.224385 0.121228 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:32.345997 0.101896 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:32.448352 0.785232 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:33.233937 0.143453 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:33.377792 0.192236 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:10:33.570477 0.220132 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:16:14.984671 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/10 23:16:21.994553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:16:29.995458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:16:45.998878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:17:18.003068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:22:30.512947 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:22:30.513098 3.003596 tcp 10.0.2.105 58801 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:22:39.515418 0.000000 tcp 10.0.2.105 58801 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:22:45.515800 0.064614 tcp 10.0.2.105 58802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:22:45.580677 0.070141 tcp 10.0.2.105 58803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:22:45.651176 0.138845 tcp 10.0.2.105 58804 -> 195.113.214.249 443 SRPA* 0 0 60 40475 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:22:46.513569 2.995995 tcp 10.0.2.105 58805 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:22:55.508288 0.000000 tcp 10.0.2.105 58805 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:01.507617 0.063448 tcp 10.0.2.105 58806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:01.571344 0.063727 tcp 10.0.2.105 58807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:01.635425 0.530801 tcp 10.0.2.105 58808 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:02.385424 2.996745 tcp 10.0.2.105 58809 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:11.380788 0.000000 tcp 10.0.2.105 58809 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:17.380432 0.068124 tcp 10.0.2.105 58810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:17.448823 0.082247 tcp 10.0.2.105 58811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:17.531404 0.157918 tcp 10.0.2.105 58812 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:17.711010 3.003250 tcp 10.0.2.105 58813 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:22.009165 3.002747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 23:23:26.714777 0.000000 tcp 10.0.2.105 58813 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:29.016617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:23:32.712418 0.065684 tcp 10.0.2.105 58814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:32.778438 0.064489 tcp 10.0.2.105 58815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:32.843288 0.162562 tcp 10.0.2.105 58816 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:23:33.476063 3.001108 tcp 10.0.2.105 58817 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:37.017508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:23:42.475862 0.000000 tcp 10.0.2.105 58817 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:48.474242 2.994190 tcp 10.0.2.105 58818 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:23:53.021032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:23:56.448066 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:23:57.477393 0.000000 tcp 10.0.2.105 58818 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:24:03.476056 2.994365 tcp 10.0.2.105 58819 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:24:12.468624 0.000000 tcp 10.0.2.105 58819 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:24:18.477555 3.004058 tcp 10.0.2.105 58820 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:24:23.444572 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:24:25.026791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:24:27.480529 0.000000 tcp 10.0.2.105 58820 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:29:33.481360 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:29:33.481503 3.003181 tcp 10.0.2.105 58821 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:29:42.483241 0.000000 tcp 10.0.2.105 58821 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:29:48.483588 0.066830 tcp 10.0.2.105 58822 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:29:48.550725 0.066735 tcp 10.0.2.105 58823 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:29:48.617746 0.162323 tcp 10.0.2.105 58824 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:29:48.794033 3.002523 tcp 10.0.2.105 58825 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:29:57.795503 0.000000 tcp 10.0.2.105 58825 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:03.794326 0.067710 tcp 10.0.2.105 58826 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:03.862338 0.066081 tcp 10.0.2.105 58827 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:03.928685 0.162842 tcp 10.0.2.105 58828 -> 195.113.214.249 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:04.183122 2.996022 tcp 10.0.2.105 58829 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:13.187522 0.000000 tcp 10.0.2.105 58829 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:19.176795 0.067554 tcp 10.0.2.105 58830 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:19.244656 0.066233 tcp 10.0.2.105 58831 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:19.311194 0.162978 tcp 10.0.2.105 58832 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:30:19.548057 3.002760 tcp 10.0.2.105 58833 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:28.549486 0.000000 tcp 10.0.2.105 58833 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:29.032788 3.001636 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 23:30:34.548671 3.003846 tcp 10.0.2.105 58834 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:36.040381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:30:43.550996 0.000000 tcp 10.0.2.105 58834 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:44.041744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:30:48.448164 0.000220 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:30:49.549867 3.004088 tcp 10.0.2.105 58835 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:30:58.552749 0.000000 tcp 10.0.2.105 58835 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:31:00.044914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:31:32.050531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:36:04.553319 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:36:04.553495 3.003548 tcp 10.0.2.105 58836 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:13.555619 0.000000 tcp 10.0.2.105 58836 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:19.557229 0.064039 tcp 10.0.2.105 58837 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:19.621599 0.109039 tcp 10.0.2.105 58838 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:19.730999 0.191136 tcp 10.0.2.105 58839 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:20.012119 2.997415 tcp 10.0.2.105 58840 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:29.007398 0.000000 tcp 10.0.2.105 58840 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:35.007535 0.066757 tcp 10.0.2.105 58841 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:35.074632 0.099106 tcp 10.0.2.105 58842 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:35.174109 0.160294 tcp 10.0.2.105 58843 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:35.586083 2.998759 tcp 10.0.2.105 58844 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:44.580295 0.000000 tcp 10.0.2.105 58844 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:50.579801 0.071337 tcp 10.0.2.105 58845 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:50.651469 0.065979 tcp 10.0.2.105 58846 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:50.717734 0.161163 tcp 10.0.2.105 58847 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:36:50.986320 2.997010 tcp 10.0.2.105 58848 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:36:59.982518 0.000000 tcp 10.0.2.105 58848 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:37:05.980667 3.003961 tcp 10.0.2.105 58849 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:37:14.983729 0.000000 tcp 10.0.2.105 58849 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:37:19.940909 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:37:20.982653 3.004320 tcp 10.0.2.105 58850 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:37:29.988647 0.000000 tcp 10.0.2.105 58850 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:37:36.056181 3.002161 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 23:37:43.064147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:37:51.066092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:38:07.068923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:38:39.075150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:40:46.769069 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:40:46.769215 0.221187 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:46.982861 0.094461 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.056379 0.083460 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.125558 0.177614 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.300007 0.212110 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.504177 0.158678 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.654381 0.065952 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.779853 0.108829 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.851452 0.104934 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:47.933271 0.345522 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:48.316895 0.070245 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:48.382475 0.101506 udp 10.0.2.105 7010 <-> 86.128.150.109 1971 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:48.488167 0.174134 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:48.654714 0.236972 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:48.867638 0.172862 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:49.025560 0.081036 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:49.097271 0.175514 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:49.268171 0.437897 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:49.684853 0.128358 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:49.767933 0.171555 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:50.010914 0.129547 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:50.169019 0.103762 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:50.340580 0.876588 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:51.209285 0.180347 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:51.360554 0.212209 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:40:51.595909 0.247906 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/10 23:42:35.985916 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:42:35.986025 2.993463 tcp 10.0.2.105 58851 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:42:44.978948 0.000000 tcp 10.0.2.105 58851 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:42:50.988830 0.065662 tcp 10.0.2.105 58852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:42:51.054777 0.065620 tcp 10.0.2.105 58853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:42:51.120699 0.160361 tcp 10.0.2.105 58854 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:42:51.294015 2.997712 tcp 10.0.2.105 58855 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:00.290384 0.000000 tcp 10.0.2.105 58855 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:06.289542 0.066226 tcp 10.0.2.105 58856 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:06.356072 0.066256 tcp 10.0.2.105 58857 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:06.422571 0.156040 tcp 10.0.2.105 58858 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:06.606230 2.998151 tcp 10.0.2.105 58859 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:15.602353 0.000000 tcp 10.0.2.105 58859 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:21.601883 0.064313 tcp 10.0.2.105 58860 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:21.666475 0.069323 tcp 10.0.2.105 58861 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:21.736093 0.161294 tcp 10.0.2.105 58862 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:21.929668 3.006093 tcp 10.0.2.105 58863 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:30.936961 0.000000 tcp 10.0.2.105 58863 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:36.923547 0.359621 tcp 10.0.2.105 58864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:37.283545 0.072338 tcp 10.0.2.105 58865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:37.356177 0.151963 tcp 10.0.2.105 58866 -> 195.113.214.249 443 SRPA* 0 0 38 21716 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:43:37.529908 2.967648 tcp 10.0.2.105 58867 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:46.449143 0.000000 tcp 10.0.2.105 58867 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:43:52.380239 2.963428 tcp 10.0.2.105 58868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:01.289119 0.000000 tcp 10.0.2.105 58868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:05.951104 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:44:07.246693 2.994415 tcp 10.0.2.105 58869 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:16.239518 0.000000 tcp 10.0.2.105 58869 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:22.248465 3.004031 tcp 10.0.2.105 58870 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:29.939291 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:44:31.252731 0.000000 tcp 10.0.2.105 58870 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:44:43.084152 2.998480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 23:44:50.087618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:44:58.091077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:45:14.093586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:45:46.099029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:49:37.251824 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:49:37.251928 3.003610 tcp 10.0.2.105 58871 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:49:46.253672 0.000000 tcp 10.0.2.105 58871 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:49:52.254559 0.066172 tcp 10.0.2.105 58872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:49:52.321004 0.072170 tcp 10.0.2.105 58873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:49:52.393460 0.155449 tcp 10.0.2.105 58874 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:49:52.562963 2.994906 tcp 10.0.2.105 58875 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:01.566066 0.000000 tcp 10.0.2.105 58875 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:07.555113 0.066709 tcp 10.0.2.105 58876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:07.622092 0.064612 tcp 10.0.2.105 58877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:07.687053 0.160661 tcp 10.0.2.105 58878 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:07.858241 3.000948 tcp 10.0.2.105 58879 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:16.857967 0.000000 tcp 10.0.2.105 58879 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:22.857212 0.063156 tcp 10.0.2.105 58880 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:22.920644 0.066978 tcp 10.0.2.105 58881 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:22.987929 0.155130 tcp 10.0.2.105 58882 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:23.165616 2.995857 tcp 10.0.2.105 58883 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:32.159734 0.000000 tcp 10.0.2.105 58883 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:38.159599 0.063772 tcp 10.0.2.105 58884 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:38.223604 0.066510 tcp 10.0.2.105 58885 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:38.290403 0.161292 tcp 10.0.2.105 58886 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:50:38.465320 2.998036 tcp 10.0.2.105 58887 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:47.461972 0.000000 tcp 10.0.2.105 58887 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:50:53.461033 3.003964 tcp 10.0.2.105 58888 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:51:02.463558 0.000000 tcp 10.0.2.105 58888 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:51:07.440919 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:51:08.462330 3.004537 tcp 10.0.2.105 58889 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:51:17.465269 0.000000 tcp 10.0.2.105 58889 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:51:23.463844 2.994238 tcp 10.0.2.105 58890 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:51:31.447152 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:51:32.467322 0.000000 tcp 10.0.2.105 58890 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:54:54.109652 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/10 23:55:01.117169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:55:09.118493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:55:25.121482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:55:57.127397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/10 23:56:38.467541 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:56:38.467717 3.003333 tcp 10.0.2.105 58891 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:56:47.469696 0.000000 tcp 10.0.2.105 58891 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:56:53.470281 0.072208 tcp 10.0.2.105 58892 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:56:53.542863 0.070650 tcp 10.0.2.105 58893 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:56:53.613803 0.167993 tcp 10.0.2.105 58894 -> 195.113.214.249 443 SRPA* 0 0 46 23962 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:56:53.913108 3.000390 tcp 10.0.2.105 58895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:02.912004 0.000000 tcp 10.0.2.105 58895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:10.508495 0.063504 tcp 10.0.2.105 58896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:10.572353 0.069583 tcp 10.0.2.105 58897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:10.642314 0.155371 tcp 10.0.2.105 58898 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:10.940567 2.970091 tcp 10.0.2.105 58899 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:19.833931 0.000000 tcp 10.0.2.105 58899 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:25.755632 0.066058 tcp 10.0.2.105 58900 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:25.822006 0.062962 tcp 10.0.2.105 58901 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:25.885289 0.161686 tcp 10.0.2.105 58902 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:26.057749 2.964595 tcp 10.0.2.105 58903 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:34.958328 0.000000 tcp 10.0.2.105 58903 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:40.871753 0.064984 tcp 10.0.2.105 58904 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:40.937025 0.099324 tcp 10.0.2.105 58905 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:41.036671 0.157148 tcp 10.0.2.105 58906 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/10 23:57:41.271627 2.958875 tcp 10.0.2.105 58907 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:50.155844 0.000000 tcp 10.0.2.105 58907 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:57:56.081189 2.960370 tcp 10.0.2.105 58908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:58:04.970921 0.000000 tcp 10.0.2.105 58908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:58:09.808455 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:58:10.895984 2.970131 tcp 10.0.2.105 58909 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:58:19.791636 0.000000 tcp 10.0.2.105 58909 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:58:25.718805 2.974201 tcp 10.0.2.105 58910 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/10 23:58:33.524702 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/10 23:58:34.626816 0.000000 tcp 10.0.2.105 58910 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:02:01.133595 3.001362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:02:08.140911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:02:16.142527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:02:32.145280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:03:04.150952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:03:40.053821 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:03:40.053916 3.003277 tcp 10.0.2.105 58911 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:03:49.065867 0.000000 tcp 10.0.2.105 58911 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:03:55.060523 0.066762 tcp 10.0.2.105 58912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:03:55.127596 0.069080 tcp 10.0.2.105 58913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:03:55.197013 0.164374 tcp 10.0.2.105 58914 -> 195.113.214.249 443 SRPA* 0 0 29 17636 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:03:55.399351 2.989819 tcp 10.0.2.105 58915 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:04.387846 0.000000 tcp 10.0.2.105 58915 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:10.397379 0.061995 tcp 10.0.2.105 58916 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:10.459704 0.063418 tcp 10.0.2.105 58917 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:10.523402 0.155476 tcp 10.0.2.105 58918 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:10.754718 2.996926 tcp 10.0.2.105 58919 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:19.749928 0.000000 tcp 10.0.2.105 58919 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:25.749327 0.068875 tcp 10.0.2.105 58920 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:25.818144 0.062750 tcp 10.0.2.105 58921 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:25.880923 0.156194 tcp 10.0.2.105 58922 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:30.067540 3.001376 tcp 10.0.2.105 58923 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:39.067644 0.000000 tcp 10.0.2.105 58923 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:45.067133 0.065646 tcp 10.0.2.105 58924 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:45.133093 0.066814 tcp 10.0.2.105 58925 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:45.200264 0.168837 tcp 10.0.2.105 58926 -> 195.113.214.249 443 SRPA* 0 0 25 13040 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:04:45.440652 3.000518 tcp 10.0.2.105 58927 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:04:54.440112 0.000000 tcp 10.0.2.105 58927 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:00.438784 3.003904 tcp 10.0.2.105 58928 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:09.441273 0.000000 tcp 10.0.2.105 58928 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:15.769458 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:05:16.747009 2.968081 tcp 10.0.2.105 58929 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:25.645357 0.000000 tcp 10.0.2.105 58929 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:31.568914 2.971818 tcp 10.0.2.105 58930 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:05:39.472849 1.132623 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:05:41.585744 0.000000 tcp 10.0.2.105 58930 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:09:10.160469 3.001564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:09:17.167267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:09:25.169043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:09:43.252555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:10:14.868650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:11:12.143424 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:11:12.143611 0.091965 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:12.193935 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 00:11:16.362473 2.967095 tcp 10.0.2.105 58931 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:11:25.253581 0.000000 tcp 10.0.2.105 58931 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:11:31.857502 0.068187 tcp 10.0.2.105 58932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:31.925999 0.065599 tcp 10.0.2.105 58933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:31.991927 0.158825 tcp 10.0.2.105 58934 -> 195.113.214.249 443 SRPA* 0 0 40 31306 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:32.151834 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 00:11:35.924049 0.118189 tcp 10.0.2.105 58935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:36.042493 0.071388 tcp 10.0.2.105 58936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:36.114325 0.157198 tcp 10.0.2.105 58937 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:36.653851 2.970175 tcp 10.0.2.105 58938 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:11:45.540836 0.000000 tcp 10.0.2.105 58938 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:11:47.798987 0.091735 tcp 10.0.2.105 58939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:47.890583 0.067189 tcp 10.0.2.105 58940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:47.958081 0.160876 tcp 10.0.2.105 58941 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:11:48.119597 0.076807 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:48.176709 0.215956 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:49.302747 0.157394 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:49.513096 0.062361 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:49.766720 0.112303 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:49.841174 0.109047 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:50.037283 0.355421 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:50.569279 0.301180 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 4 1387 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:11:50.982423 0.000000 udp 10.0.2.105 7010 -> 86.128.150.109 1971 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 00:12:07.367183 0.062757 tcp 10.0.2.105 58942 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:12:07.430245 0.065474 tcp 10.0.2.105 58943 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:12:07.496037 0.153119 tcp 10.0.2.105 58944 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:12:07.650101 0.174428 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:07.816381 0.237062 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:08.032078 0.171977 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:08.727576 0.081195 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:08.800645 0.169932 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:08.967667 0.444449 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:09.388731 0.127921 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:09.473028 0.183151 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:09.676194 0.128797 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:09.804612 0.103522 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:09.928467 0.457734 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:10.380126 0.180947 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:10.834204 0.189105 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:12:11.016562 0.285073 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:16:18.942401 3.282864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:16:26.175976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:16:34.074632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:16:47.870194 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:16:47.870292 2.963266 tcp 10.0.2.105 58945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:16:49.866291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:16:56.761160 0.000000 tcp 10.0.2.105 58945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:02.669904 0.068062 tcp 10.0.2.105 58946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:02.738266 0.065737 tcp 10.0.2.105 58947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:02.804414 0.156989 tcp 10.0.2.105 58948 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:03.180155 2.954248 tcp 10.0.2.105 58949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:12.055163 0.000000 tcp 10.0.2.105 58949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:17.972707 0.107568 tcp 10.0.2.105 58950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:18.080566 0.064185 tcp 10.0.2.105 58951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:18.145011 0.166435 tcp 10.0.2.105 58952 -> 195.113.214.249 443 SRPA* 0 0 28 14270 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:19.080161 2.956493 tcp 10.0.2.105 58953 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:21.433404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:17:27.953433 0.000000 tcp 10.0.2.105 58953 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:33.870313 0.065133 tcp 10.0.2.105 58954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:33.935725 0.067878 tcp 10.0.2.105 58955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:34.003941 0.163110 tcp 10.0.2.105 58956 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:34.267430 2.967917 tcp 10.0.2.105 58957 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:43.150701 0.000000 tcp 10.0.2.105 58957 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:49.063308 0.066499 tcp 10.0.2.105 58958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:49.130064 0.081928 tcp 10.0.2.105 58959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:49.212414 0.169642 tcp 10.0.2.105 58960 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:17:49.674617 2.964161 tcp 10.0.2.105 58961 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:17:58.563227 0.000000 tcp 10.0.2.105 58961 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:04.458677 0.000000 tcp 10.0.2.105 58962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:16.872192 0.000000 tcp 10.0.2.105 58962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:22.794049 0.000000 tcp 10.0.2.105 58962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:27.337311 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:18:28.728182 2.944555 tcp 10.0.2.105 58963 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:37.595817 0.000000 tcp 10.0.2.105 58963 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:43.520749 0.000000 tcp 10.0.2.105 58964 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:48.800207 0.000000 tcp 10.0.2.105 58964 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:18:53.315805 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:18:54.709704 0.000000 tcp 10.0.2.105 58964 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:23:32.272145 2.954600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:23:39.178841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:23:47.066913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:23:56.961186 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:23:56.961282 2.967740 tcp 10.0.2.105 58965 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:03.252912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:24:05.839756 0.000000 tcp 10.0.2.105 58965 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:11.759208 0.065864 tcp 10.0.2.105 58966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:11.825318 0.069985 tcp 10.0.2.105 58967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:11.895546 0.160078 tcp 10.0.2.105 58968 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:12.502177 2.952759 tcp 10.0.2.105 58969 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:21.384395 0.000000 tcp 10.0.2.105 58969 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:27.423678 0.067129 tcp 10.0.2.105 58970 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:27.491166 0.067408 tcp 10.0.2.105 58971 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:27.558885 0.152945 tcp 10.0.2.105 58972 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:27.922593 2.950690 tcp 10.0.2.105 58973 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:34.953841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:24:36.798312 0.000000 tcp 10.0.2.105 58973 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:42.717684 0.064616 tcp 10.0.2.105 58974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:42.782581 0.064105 tcp 10.0.2.105 58975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:42.847006 0.163202 tcp 10.0.2.105 58976 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:43.224024 2.959558 tcp 10.0.2.105 58977 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:52.097005 0.000000 tcp 10.0.2.105 58977 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:24:58.020574 0.063299 tcp 10.0.2.105 58978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:58.084188 0.068364 tcp 10.0.2.105 58979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:58.152890 0.161922 tcp 10.0.2.105 58980 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:24:58.383665 2.968377 tcp 10.0.2.105 58981 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:07.267970 0.000000 tcp 10.0.2.105 58981 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:13.183345 2.965307 tcp 10.0.2.105 58982 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:22.064089 0.000000 tcp 10.0.2.105 58982 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:26.923792 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:25:27.983488 2.962171 tcp 10.0.2.105 58983 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:36.877303 0.000000 tcp 10.0.2.105 58983 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:42.784148 2.948688 tcp 10.0.2.105 58984 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:25:50.608564 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:25:51.654716 0.000000 tcp 10.0.2.105 58984 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:30:34.008821 2.966675 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:30:40.925175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:30:48.813161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:30:53.499080 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:30:53.499163 2.959477 tcp 10.0.2.105 58985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:02.370006 0.000000 tcp 10.0.2.105 58985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:04.597664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:31:08.292649 0.067876 tcp 10.0.2.105 58986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:08.360809 0.063502 tcp 10.0.2.105 58987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:08.424575 0.169373 tcp 10.0.2.105 58988 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:08.930518 2.959271 tcp 10.0.2.105 58989 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:17.800869 0.000000 tcp 10.0.2.105 58989 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:23.712314 1.431725 tcp 10.0.2.105 58990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:25.144485 0.065557 tcp 10.0.2.105 58991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:25.210474 0.165333 tcp 10.0.2.105 58992 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:25.461587 2.967621 tcp 10.0.2.105 58993 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:34.344371 0.000000 tcp 10.0.2.105 58993 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:37.511486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:31:40.247400 0.062956 tcp 10.0.2.105 58994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:40.310629 0.067099 tcp 10.0.2.105 58995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:40.377983 0.157098 tcp 10.0.2.105 58996 -> 195.113.214.249 443 SRPA* 0 0 25 13040 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:40.548460 2.960410 tcp 10.0.2.105 58997 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:49.434038 0.000000 tcp 10.0.2.105 58997 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:31:55.345454 0.064333 tcp 10.0.2.105 58998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:55.410131 0.064512 tcp 10.0.2.105 58999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:55.474938 0.155779 tcp 10.0.2.105 59000 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:31:55.650744 2.949476 tcp 10.0.2.105 59001 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:05.355217 0.000000 tcp 10.0.2.105 59001 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:11.283652 2.962410 tcp 10.0.2.105 59002 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:20.160284 0.000000 tcp 10.0.2.105 59002 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:24.894043 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:32:26.089037 3.119224 tcp 10.0.2.105 59003 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:35.122132 0.000000 tcp 10.0.2.105 59003 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:41.046323 3.582068 tcp 10.0.2.105 59004 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:32:49.325543 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:32:50.543451 0.000000 tcp 10.0.2.105 59004 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:37:38.286566 3.000927 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:37:45.293169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:37:52.684768 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:37:52.684944 2.993402 tcp 10.0.2.105 59005 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:37:53.295067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:38:01.687069 0.000000 tcp 10.0.2.105 59005 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:07.688241 0.068665 tcp 10.0.2.105 59006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:07.757221 0.066984 tcp 10.0.2.105 59007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:07.824526 0.152179 tcp 10.0.2.105 59008 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:08.035066 2.995414 tcp 10.0.2.105 59009 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:09.300596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:38:17.028773 0.000000 tcp 10.0.2.105 59009 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:23.028480 0.064477 tcp 10.0.2.105 59010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:23.093232 0.066294 tcp 10.0.2.105 59011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:23.159836 0.155750 tcp 10.0.2.105 59012 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:23.351863 3.000747 tcp 10.0.2.105 59013 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:32.351096 0.000000 tcp 10.0.2.105 59013 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:38.353368 0.067556 tcp 10.0.2.105 59014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:38.421230 0.069457 tcp 10.0.2.105 59015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:38.491002 0.160678 tcp 10.0.2.105 59016 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:38.840612 2.996542 tcp 10.0.2.105 59017 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:41.309009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:38:47.834758 0.000000 tcp 10.0.2.105 59017 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:38:53.832517 0.063960 tcp 10.0.2.105 59018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:53.896820 0.066888 tcp 10.0.2.105 59019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:53.963957 0.163849 tcp 10.0.2.105 59020 -> 195.113.214.249 443 SRPA* 0 0 46 24988 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:38:54.190526 2.996402 tcp 10.0.2.105 59021 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:03.185563 0.000000 tcp 10.0.2.105 59021 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:09.184146 2.994394 tcp 10.0.2.105 59022 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:18.186970 0.000000 tcp 10.0.2.105 59022 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:22.943807 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:39:24.185914 2.993491 tcp 10.0.2.105 59023 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:33.178307 0.000000 tcp 10.0.2.105 59023 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:39.187376 3.004102 tcp 10.0.2.105 59024 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:39:46.948127 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:39:48.190293 0.000000 tcp 10.0.2.105 59024 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:42:09.956026 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:42:09.956147 0.227291 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1959 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:10.176845 0.178191 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:10.352169 0.000000 udp 10.0.2.105 7010 -> 86.128.150.109 1971 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 00:42:27.080397 0.063612 tcp 10.0.2.105 59025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:42:27.144367 0.065582 tcp 10.0.2.105 59026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:42:27.210251 0.197746 tcp 10.0.2.105 59027 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:42:27.435481 0.100130 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:27.495345 0.080192 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:27.562212 0.157726 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:27.712617 0.114059 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:27.840498 0.062725 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:27.902227 0.212623 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:28.106920 0.337453 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:28.506593 0.097547 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:28.586631 0.065631 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:28.676644 0.174713 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:28.844320 0.241547 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2580 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:29.495324 0.169323 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:29.705041 0.436184 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.118807 0.133475 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.202696 0.169832 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.356861 0.121817 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.468605 0.169302 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 1989 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.616650 0.128400 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.806746 0.103689 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:30.986367 0.951950 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:31.929642 0.247497 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:32.140668 0.178337 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:42:32.289982 0.203644 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/11 00:44:45.310351 3.001333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:44:52.317605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:44:54.190148 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:44:54.190313 3.004112 tcp 10.0.2.105 59028 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:00.318473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:45:03.193070 0.000000 tcp 10.0.2.105 59028 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:09.192534 0.065182 tcp 10.0.2.105 59029 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:09.258012 0.071000 tcp 10.0.2.105 59030 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:09.329414 0.231192 tcp 10.0.2.105 59031 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:09.647706 3.012099 tcp 10.0.2.105 59032 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:16.322083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:45:18.655261 0.000000 tcp 10.0.2.105 59032 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:24.643999 1.910745 tcp 10.0.2.105 59033 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:26.555018 0.063434 tcp 10.0.2.105 59034 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:26.618820 0.155715 tcp 10.0.2.105 59035 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:26.830875 2.956829 tcp 10.0.2.105 59036 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:35.726702 0.000000 tcp 10.0.2.105 59036 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:41.646524 0.063932 tcp 10.0.2.105 59037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:41.710752 0.064657 tcp 10.0.2.105 59038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:41.775696 0.159909 tcp 10.0.2.105 59039 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:41.973821 2.960158 tcp 10.0.2.105 59040 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:49.876753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:45:50.864365 0.000000 tcp 10.0.2.105 59040 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:45:56.792876 0.063711 tcp 10.0.2.105 59041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:56.856936 0.063978 tcp 10.0.2.105 59042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:56.921216 0.158097 tcp 10.0.2.105 59043 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:45:57.574449 2.967937 tcp 10.0.2.105 59044 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:06.582969 0.000000 tcp 10.0.2.105 59044 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:12.504883 2.972959 tcp 10.0.2.105 59045 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:21.400810 0.000000 tcp 10.0.2.105 59045 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:26.151493 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:46:27.322965 2.969563 tcp 10.0.2.105 59046 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:36.215824 0.000000 tcp 10.0.2.105 59046 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:43.280693 2.956259 tcp 10.0.2.105 59047 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:46:51.003053 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:46:52.170162 0.000000 tcp 10.0.2.105 59047 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:51:52.333805 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:51:56.129282 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:51:56.129471 3.001006 tcp 10.0.2.105 59048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:51:59.341622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:52:05.129771 0.000000 tcp 10.0.2.105 59048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:07.343146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:52:11.129730 0.063739 tcp 10.0.2.105 59049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:11.193736 0.062852 tcp 10.0.2.105 59050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:11.256924 0.182181 tcp 10.0.2.105 59051 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:11.686713 2.996750 tcp 10.0.2.105 59052 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:20.682759 0.000000 tcp 10.0.2.105 59052 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:23.345919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:52:26.999361 0.070924 tcp 10.0.2.105 59053 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:27.070617 0.065856 tcp 10.0.2.105 59054 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:27.136795 0.163043 tcp 10.0.2.105 59055 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:27.593154 2.980864 tcp 10.0.2.105 59056 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:36.516361 0.000000 tcp 10.0.2.105 59056 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:42.449953 0.064717 tcp 10.0.2.105 59057 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:42.515057 0.071115 tcp 10.0.2.105 59058 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:42.586487 0.160763 tcp 10.0.2.105 59059 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:52:45.838311 2.969086 tcp 10.0.2.105 59060 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:54.752140 0.000000 tcp 10.0.2.105 59060 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:52:55.418118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:53:00.700457 0.067550 tcp 10.0.2.105 59061 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:53:00.768320 0.069966 tcp 10.0.2.105 59062 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:53:00.838609 0.155287 tcp 10.0.2.105 59063 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:53:01.325823 2.999127 tcp 10.0.2.105 59064 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:10.323282 0.000000 tcp 10.0.2.105 59064 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:16.322447 3.282483 tcp 10.0.2.105 59065 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:25.547601 0.000000 tcp 10.0.2.105 59065 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:30.120054 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:53:31.501319 2.965634 tcp 10.0.2.105 59066 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:40.417721 0.000000 tcp 10.0.2.105 59066 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:46.358528 2.970801 tcp 10.0.2.105 59067 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:53:53.946068 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:53:55.328023 0.000000 tcp 10.0.2.105 59067 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:58:59.368561 3.001082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 00:59:01.338605 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 00:59:01.338705 3.003934 tcp 10.0.2.105 59068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:06.375102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:59:10.341045 0.000000 tcp 10.0.2.105 59068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:14.377099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:59:16.341678 0.065267 tcp 10.0.2.105 59069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:16.407368 0.066339 tcp 10.0.2.105 59070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:16.474086 0.157693 tcp 10.0.2.105 59071 -> 195.113.214.249 443 SRPA* 0 0 48 24412 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:16.641838 3.002332 tcp 10.0.2.105 59072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:25.643089 0.000000 tcp 10.0.2.105 59072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:30.381216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 00:59:31.642345 0.062692 tcp 10.0.2.105 59073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:31.705391 0.067720 tcp 10.0.2.105 59074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:31.773445 0.155699 tcp 10.0.2.105 59075 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:31.996495 3.000176 tcp 10.0.2.105 59076 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:40.995196 0.000000 tcp 10.0.2.105 59076 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:46.994618 0.065271 tcp 10.0.2.105 59077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:47.060189 0.065771 tcp 10.0.2.105 59078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:47.126291 0.153891 tcp 10.0.2.105 59079 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/11 00:59:47.653782 2.995048 tcp 10.0.2.105 59080 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 00:59:56.647934 0.000000 tcp 10.0.2.105 59080 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:02.982095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:00:03.240662 0.066725 tcp 10.0.2.105 59081 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:00:03.307756 0.062068 tcp 10.0.2.105 59082 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:00:03.370135 0.157719 tcp 10.0.2.105 59083 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:00:03.637939 2.945755 tcp 10.0.2.105 59084 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:12.509303 0.000000 tcp 10.0.2.105 59084 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:18.443359 2.970267 tcp 10.0.2.105 59085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:27.338391 0.000000 tcp 10.0.2.105 59085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:32.168435 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:00:33.264859 2.973850 tcp 10.0.2.105 59086 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:42.165341 0.000000 tcp 10.0.2.105 59086 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:48.090819 2.970487 tcp 10.0.2.105 59087 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:00:55.942933 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:00:57.054304 0.000000 tcp 10.0.2.105 59087 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:03.054719 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:06:03.054894 2.993856 tcp 10.0.2.105 59088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:12.047361 0.000000 tcp 10.0.2.105 59088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:18.058053 0.063514 tcp 10.0.2.105 59089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:18.121847 0.070987 tcp 10.0.2.105 59090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:18.193144 0.159959 tcp 10.0.2.105 59091 -> 195.113.214.249 443 SRPA* 0 0 28 18456 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:18.408797 3.002090 tcp 10.0.2.105 59092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:21.393724 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:06:27.409364 0.000000 tcp 10.0.2.105 59092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:28.401045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:06:33.408360 0.062541 tcp 10.0.2.105 59093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:33.471253 0.066321 tcp 10.0.2.105 59094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:33.537912 0.159407 tcp 10.0.2.105 59095 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:33.775982 2.996734 tcp 10.0.2.105 59096 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:36.402674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:06:42.771616 0.000000 tcp 10.0.2.105 59096 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:06:48.770646 0.064678 tcp 10.0.2.105 59097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:48.835621 0.064717 tcp 10.0.2.105 59098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:48.900535 0.161262 tcp 10.0.2.105 59099 -> 195.113.214.249 443 SRPA* 0 0 35 17760 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:06:52.405594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:07:01.538635 3.008981 tcp 10.0.2.105 59100 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:10.541576 0.000000 tcp 10.0.2.105 59100 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:15.438503 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:07:16.589775 0.067008 tcp 10.0.2.105 59101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:07:16.657059 0.063288 tcp 10.0.2.105 59102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:07:16.720629 0.158510 tcp 10.0.2.105 59103 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:07:16.915705 2.999188 tcp 10.0.2.105 59104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:24.411515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:07:25.913793 0.000000 tcp 10.0.2.105 59104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:31.912543 3.004207 tcp 10.0.2.105 59105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:40.915108 0.000000 tcp 10.0.2.105 59105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:45.441741 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:07:46.913562 2.994345 tcp 10.0.2.105 59106 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:07:55.916818 0.000000 tcp 10.0.2.105 59106 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:08:01.915518 2.994137 tcp 10.0.2.105 59107 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:08:09.447909 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:08:10.908172 0.000000 tcp 10.0.2.105 59107 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:12:43.303446 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:12:43.303559 0.230944 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:43.526999 0.176370 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:43.828729 0.089066 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:43.921792 0.082782 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:43.982388 0.157255 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:44.311402 0.110928 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:44.386535 0.063968 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:44.623013 0.215847 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:12:44.831971 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 01:13:02.730403 0.068131 tcp 10.0.2.105 59108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:02.798999 0.065231 tcp 10.0.2.105 59109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:02.864512 0.167897 tcp 10.0.2.105 59110 -> 195.113.214.249 443 SRPA* 0 0 42 24148 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:03.031428 0.176380 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:03.199764 0.338871 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:03.693035 0.099344 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:03.772773 0.242024 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:03.990073 0.176001 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:04.171114 0.438358 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:04.586422 0.142764 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:04.813809 0.169541 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:04.968496 0.128943 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:05.323193 0.115601 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:05.732921 0.068449 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:05.912012 0.172338 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:06.328844 0.178094 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:06.477325 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 01:13:16.918368 3.003643 tcp 10.0.2.105 59111 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:22.516976 0.064995 tcp 10.0.2.105 59112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:22.582266 0.064921 tcp 10.0.2.105 59113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:22.647470 0.164889 tcp 10.0.2.105 59114 -> 195.113.214.249 443 SRPA* 0 0 52 35192 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:22.813041 0.368172 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:23.145284 0.194665 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:13:25.921096 0.000000 tcp 10.0.2.105 59111 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:28.417202 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:13:31.920304 0.063492 tcp 10.0.2.105 59115 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:31.984178 0.070404 tcp 10.0.2.105 59116 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:32.054493 0.156076 tcp 10.0.2.105 59117 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:32.234375 3.000155 tcp 10.0.2.105 59118 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:35.424926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:13:41.233489 0.000000 tcp 10.0.2.105 59118 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:43.426398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:13:47.232463 0.063324 tcp 10.0.2.105 59119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:47.295769 0.065644 tcp 10.0.2.105 59120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:47.361721 0.171523 tcp 10.0.2.105 59121 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:13:47.639796 2.996557 tcp 10.0.2.105 59122 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:56.635514 0.000000 tcp 10.0.2.105 59122 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:13:59.429383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:14:02.634546 0.609195 tcp 10.0.2.105 59123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:03.244058 0.064147 tcp 10.0.2.105 59124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:03.308525 0.157644 tcp 10.0.2.105 59125 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:03.805298 2.960901 tcp 10.0.2.105 59126 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:12.694223 0.000000 tcp 10.0.2.105 59126 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:19.567314 0.076889 tcp 10.0.2.105 59127 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:19.644539 0.070828 tcp 10.0.2.105 59128 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:19.715670 0.179139 tcp 10.0.2.105 59129 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:14:20.199386 2.969327 tcp 10.0.2.105 59130 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:29.091657 0.000000 tcp 10.0.2.105 59130 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:32.570751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:14:35.019305 2.969217 tcp 10.0.2.105 59131 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:43.915573 0.000000 tcp 10.0.2.105 59131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:48.380406 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:14:49.839118 2.972267 tcp 10.0.2.105 59132 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:14:58.734336 0.000000 tcp 10.0.2.105 59132 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:15:04.656105 2.972275 tcp 10.0.2.105 59133 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:15:12.086416 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:15:13.550655 0.000000 tcp 10.0.2.105 59133 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:18.925635 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:20:18.925807 2.993471 tcp 10.0.2.105 59134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:27.917879 0.000000 tcp 10.0.2.105 59134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:33.928485 0.067357 tcp 10.0.2.105 59135 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:33.996151 0.065887 tcp 10.0.2.105 59136 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:34.062330 0.168547 tcp 10.0.2.105 59137 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:34.615765 2.996137 tcp 10.0.2.105 59138 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:35.441221 3.003729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:20:42.449103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:20:43.610638 0.000000 tcp 10.0.2.105 59138 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:49.611595 0.064024 tcp 10.0.2.105 59139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:49.675927 0.067464 tcp 10.0.2.105 59140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:49.743749 0.160516 tcp 10.0.2.105 59141 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:20:50.103830 3.000360 tcp 10.0.2.105 59142 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:20:50.450745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:20:59.102644 0.000000 tcp 10.0.2.105 59142 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:05.102134 0.080250 tcp 10.0.2.105 59143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:05.182679 0.064309 tcp 10.0.2.105 59144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:05.247266 0.169290 tcp 10.0.2.105 59145 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:05.480762 3.005511 tcp 10.0.2.105 59146 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:06.453442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:21:14.485050 0.000000 tcp 10.0.2.105 59146 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:20.474181 0.067585 tcp 10.0.2.105 59147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:20.542113 0.069746 tcp 10.0.2.105 59148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:20.612132 0.161253 tcp 10.0.2.105 59149 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:21:21.317303 3.001903 tcp 10.0.2.105 59150 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:30.328709 0.000000 tcp 10.0.2.105 59150 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:36.316480 2.994081 tcp 10.0.2.105 59151 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:38.459600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:21:45.309316 0.000000 tcp 10.0.2.105 59151 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:21:49.945975 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:21:51.317902 3.004033 tcp 10.0.2.105 59152 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:22:00.441909 0.000000 tcp 10.0.2.105 59152 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:22:06.393844 2.981320 tcp 10.0.2.105 59153 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:22:14.101729 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:22:15.473340 0.000000 tcp 10.0.2.105 59153 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:21.322843 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:27:21.323013 3.005866 tcp 10.0.2.105 59154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:30.325403 0.000000 tcp 10.0.2.105 59154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:36.325274 0.066812 tcp 10.0.2.105 59155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:36.392339 0.072539 tcp 10.0.2.105 59156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:36.465171 0.157648 tcp 10.0.2.105 59157 -> 195.113.214.249 443 SRPA* 0 0 34 22236 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:36.845872 2.993033 tcp 10.0.2.105 59158 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:42.465172 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:27:45.847657 0.000000 tcp 10.0.2.105 59158 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:49.472782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:27:52.423071 0.067137 tcp 10.0.2.105 59159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:52.490509 0.066190 tcp 10.0.2.105 59160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:52.557049 0.169888 tcp 10.0.2.105 59161 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:27:52.765124 2.959071 tcp 10.0.2.105 59162 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:27:57.994972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:28:01.650421 0.000000 tcp 10.0.2.105 59162 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:07.577099 0.065745 tcp 10.0.2.105 59163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:07.643114 0.065607 tcp 10.0.2.105 59164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:07.709009 0.158114 tcp 10.0.2.105 59165 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:08.753129 2.970719 tcp 10.0.2.105 59166 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:13.801040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:28:17.645160 0.000000 tcp 10.0.2.105 59166 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:23.558818 0.062959 tcp 10.0.2.105 59167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:23.622044 0.067928 tcp 10.0.2.105 59168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:23.690295 0.160021 tcp 10.0.2.105 59169 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:28:24.440135 2.971846 tcp 10.0.2.105 59170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:33.343915 0.000000 tcp 10.0.2.105 59170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:39.254672 2.993432 tcp 10.0.2.105 59171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:48.614944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:28:51.343101 0.000000 tcp 10.0.2.105 59171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:28:55.966739 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:28:57.262037 2.947652 tcp 10.0.2.105 59172 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:29:06.134372 0.000000 tcp 10.0.2.105 59172 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:29:15.849397 2.960786 tcp 10.0.2.105 59173 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:29:23.421716 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:29:24.723412 0.000000 tcp 10.0.2.105 59173 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:26.603616 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:34:26.603720 2.975317 tcp 10.0.2.105 59174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:35.495250 0.000000 tcp 10.0.2.105 59174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:41.410901 0.063776 tcp 10.0.2.105 59175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:41.474970 0.066541 tcp 10.0.2.105 59176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:41.541838 0.166303 tcp 10.0.2.105 59177 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:42.045160 2.960970 tcp 10.0.2.105 59178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:50.936217 0.000000 tcp 10.0.2.105 59178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:51.513746 2.954024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:34:56.842777 0.063991 tcp 10.0.2.105 59179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:56.907098 0.063433 tcp 10.0.2.105 59180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:56.970787 0.155426 tcp 10.0.2.105 59181 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:34:57.198680 2.940625 tcp 10.0.2.105 59182 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:34:58.425444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:35:06.119849 0.000000 tcp 10.0.2.105 59182 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:06.377596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:35:12.051111 0.066318 tcp 10.0.2.105 59183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:12.117699 0.068754 tcp 10.0.2.105 59184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:12.186782 0.156594 tcp 10.0.2.105 59185 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:12.927409 2.961906 tcp 10.0.2.105 59186 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:21.801124 0.000000 tcp 10.0.2.105 59186 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:22.158117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:35:27.713386 0.067181 tcp 10.0.2.105 59187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:27.780877 0.063826 tcp 10.0.2.105 59188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:27.844965 0.157340 tcp 10.0.2.105 59189 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:35:28.058020 2.966466 tcp 10.0.2.105 59190 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:36.939019 0.000000 tcp 10.0.2.105 59190 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:42.846920 0.000000 tcp 10.0.2.105 59191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:49.514594 0.000000 tcp 10.0.2.105 59191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:55.431713 0.000000 tcp 10.0.2.105 59191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:35:57.437248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:36:00.311744 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:36:01.351745 2.964406 tcp 10.0.2.105 59192 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:36:10.243514 0.000000 tcp 10.0.2.105 59192 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:36:16.148386 2.951403 tcp 10.0.2.105 59193 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:36:23.987199 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:36:25.023764 0.000000 tcp 10.0.2.105 59193 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:41:56.522814 3.002226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 01:42:03.531466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:42:11.532702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:42:27.535594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:42:59.541416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:43:44.776626 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:43:44.776722 0.169175 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:44.992451 0.822092 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:45.806512 0.072811 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:45.895984 0.156830 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.045011 0.082094 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.094126 0.177506 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.340836 0.223576 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.558143 0.213211 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.763118 0.061664 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:46.949043 0.110145 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:47.037411 0.175573 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:47.393045 0.239462 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:47.607517 0.168630 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:48.114950 0.102923 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:48.199168 0.330842 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:48.553430 0.127588 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:48.680804 0.437123 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:49.094115 0.130703 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:49.439067 0.169997 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:49.592589 0.171902 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:50.985662 0.068685 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:51.045941 0.128287 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:51.497024 0.174249 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:51.645289 0.255767 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:51.988078 0.205250 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/11 01:43:56.513546 2.993813 tcp 10.0.2.105 59194 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:05.515979 0.000000 tcp 10.0.2.105 59194 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:10.443279 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:44:11.516706 0.067283 tcp 10.0.2.105 59195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:11.584426 0.067523 tcp 10.0.2.105 59196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:11.652359 0.200355 tcp 10.0.2.105 59197 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:12.064184 2.995021 tcp 10.0.2.105 59198 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:21.058143 0.000000 tcp 10.0.2.105 59198 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:27.057062 0.067480 tcp 10.0.2.105 59199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:27.124827 0.069012 tcp 10.0.2.105 59200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:27.194113 0.168097 tcp 10.0.2.105 59201 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:27.496385 2.995642 tcp 10.0.2.105 59202 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:36.490093 0.000000 tcp 10.0.2.105 59202 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:42.489781 0.063713 tcp 10.0.2.105 59203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:42.553783 0.068324 tcp 10.0.2.105 59204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:42.622401 0.162486 tcp 10.0.2.105 59205 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:44:42.896657 2.997534 tcp 10.0.2.105 59206 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:44:56.338285 0.000000 tcp 10.0.2.105 59206 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:02.255786 0.065754 tcp 10.0.2.105 59207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:45:02.321845 0.064981 tcp 10.0.2.105 59208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:45:02.387097 0.165050 tcp 10.0.2.105 59209 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:45:02.731406 2.962167 tcp 10.0.2.105 59210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:11.611586 0.000000 tcp 10.0.2.105 59210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:17.528437 2.952949 tcp 10.0.2.105 59211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:26.410827 0.000000 tcp 10.0.2.105 59211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:30.922156 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:45:32.327784 2.948860 tcp 10.0.2.105 59212 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:41.197531 0.000000 tcp 10.0.2.105 59212 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:47.125543 2.946002 tcp 10.0.2.105 59213 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:45:54.599401 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:45:55.993444 0.000000 tcp 10.0.2.105 59213 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:50:58.370562 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:50:58.370760 3.003316 tcp 10.0.2.105 59214 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:07.372464 0.000000 tcp 10.0.2.105 59214 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:13.373840 0.065501 tcp 10.0.2.105 59215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:13.439647 0.064149 tcp 10.0.2.105 59216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:13.504117 0.164235 tcp 10.0.2.105 59217 -> 195.113.214.249 443 SRPA* 0 0 43 23406 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:14.126997 3.013528 tcp 10.0.2.105 59218 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:23.135163 0.000000 tcp 10.0.2.105 59218 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:29.124353 0.067359 tcp 10.0.2.105 59219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:29.192078 0.066117 tcp 10.0.2.105 59220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:29.258576 0.239986 tcp 10.0.2.105 59221 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:29.707133 2.991982 tcp 10.0.2.105 59222 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:38.734569 0.000000 tcp 10.0.2.105 59222 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:45.381063 0.063706 tcp 10.0.2.105 59223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:45.445087 0.065637 tcp 10.0.2.105 59224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:45.511007 0.154723 tcp 10.0.2.105 59225 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:51:45.696727 2.951674 tcp 10.0.2.105 59226 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:51:54.574211 0.000000 tcp 10.0.2.105 59226 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:00.499867 0.063442 tcp 10.0.2.105 59227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:52:00.563587 0.064899 tcp 10.0.2.105 59228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:52:00.628775 0.152323 tcp 10.0.2.105 59229 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:52:00.878497 2.969009 tcp 10.0.2.105 59230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:09.773465 0.000000 tcp 10.0.2.105 59230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:20.234248 2.970020 tcp 10.0.2.105 59231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:29.119832 0.000000 tcp 10.0.2.105 59231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:33.588400 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:52:35.035599 2.966736 tcp 10.0.2.105 59232 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:43.918733 0.000000 tcp 10.0.2.105 59232 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:49.837020 2.953370 tcp 10.0.2.105 59233 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:52:57.273595 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:52:58.717366 0.000000 tcp 10.0.2.105 59233 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:53:32.390971 2.956616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 01:53:39.300453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:53:47.191191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:54:02.971179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:54:34.526580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 01:58:00.537845 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:58:00.538035 2.957404 tcp 10.0.2.105 59234 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:09.424100 0.000000 tcp 10.0.2.105 59234 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:15.413138 0.065299 tcp 10.0.2.105 59235 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:15.478690 0.069832 tcp 10.0.2.105 59236 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:15.548840 0.156587 tcp 10.0.2.105 59237 -> 195.113.214.249 443 SRPA* 0 0 41 33160 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:15.841605 3.001684 tcp 10.0.2.105 59238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:24.843003 0.000000 tcp 10.0.2.105 59238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:30.840931 0.062983 tcp 10.0.2.105 59239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:30.904349 0.069492 tcp 10.0.2.105 59240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:30.974110 0.370688 tcp 10.0.2.105 59241 -> 195.113.214.249 443 SRPA* 0 0 35 18782 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:31.363161 3.002378 tcp 10.0.2.105 59242 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:40.364069 0.000000 tcp 10.0.2.105 59242 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:46.363357 0.065991 tcp 10.0.2.105 59243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:46.429672 0.067341 tcp 10.0.2.105 59244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:46.497311 0.161627 tcp 10.0.2.105 59245 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:58:46.778394 2.999115 tcp 10.0.2.105 59246 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:58:55.785949 0.000000 tcp 10.0.2.105 59246 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:04.105473 0.069212 tcp 10.0.2.105 59247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:59:04.174977 0.069708 tcp 10.0.2.105 59248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:59:04.244986 0.161232 tcp 10.0.2.105 59249 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 01:59:04.496288 2.961086 tcp 10.0.2.105 59250 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:13.385170 0.000000 tcp 10.0.2.105 59250 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:19.312165 2.960433 tcp 10.0.2.105 59251 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:28.198016 0.000000 tcp 10.0.2.105 59251 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:32.925912 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:59:34.132580 2.966573 tcp 10.0.2.105 59252 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:43.019019 0.000000 tcp 10.0.2.105 59252 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:48.944567 3.525978 tcp 10.0.2.105 59253 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 01:59:57.177132 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 01:59:58.396728 0.000000 tcp 10.0.2.105 59253 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:00:37.323979 2.967958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:00:44.249365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:00:52.150972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:01:08.324147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:01:39.925331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:05:02.183304 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:05:02.183410 2.993865 tcp 10.0.2.105 59254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:11.185979 0.000000 tcp 10.0.2.105 59254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:17.186465 0.065506 tcp 10.0.2.105 59255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:17.252341 0.067652 tcp 10.0.2.105 59256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:17.320538 0.162062 tcp 10.0.2.105 59257 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:17.503687 2.995547 tcp 10.0.2.105 59258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:26.498469 0.000000 tcp 10.0.2.105 59258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:32.497525 0.068034 tcp 10.0.2.105 59259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:32.565030 0.065335 tcp 10.0.2.105 59260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:32.630653 0.154520 tcp 10.0.2.105 59261 -> 195.113.214.249 443 SRPA* 0 0 29 17884 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:32.808015 3.003320 tcp 10.0.2.105 59262 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:41.809825 0.000000 tcp 10.0.2.105 59262 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:47.809060 0.067146 tcp 10.0.2.105 59263 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:47.876558 0.068693 tcp 10.0.2.105 59264 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:47.945114 0.160582 tcp 10.0.2.105 59265 -> 195.113.214.249 443 SRPA* 0 0 42 37026 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:05:48.320785 3.002831 tcp 10.0.2.105 59266 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:05:57.322552 0.000000 tcp 10.0.2.105 59266 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:09.229230 0.063848 tcp 10.0.2.105 59267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:06:09.293404 0.066078 tcp 10.0.2.105 59268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:06:09.359311 0.195263 tcp 10.0.2.105 59269 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:06:09.647159 2.968066 tcp 10.0.2.105 59270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:18.528496 0.000000 tcp 10.0.2.105 59270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:24.445034 2.964957 tcp 10.0.2.105 59271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:33.336462 0.000000 tcp 10.0.2.105 59271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:37.952343 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/02/11 02:06:43.239936 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/02/11 02:06:44.517985 2.951683 tcp 10.0.2.105 59272 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:53.396171 0.000000 tcp 10.0.2.105 59272 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:06:59.310765 2.948341 tcp 10.0.2.105 59273 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:07:06.900299 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:07:08.173563 0.000000 tcp 10.0.2.105 59273 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:07:52.414397 2.963514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:07:59.329932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:08:07.226073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:08:23.011095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:08:54.577927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:13:58.536762 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:13:58.797027 0.066996 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:13:59.173591 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 02:14:08.390861 2.969957 tcp 10.0.2.105 59274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:14:14.255088 0.102471 tcp 10.0.2.105 59275 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:14.357853 0.071753 tcp 10.0.2.105 59276 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:14.429959 0.171677 tcp 10.0.2.105 59277 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:14.602338 0.078956 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:14.661010 0.156616 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:14.911853 0.084563 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:14.959142 0.177421 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.131500 0.058394 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.194661 0.115238 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.268137 0.224539 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.576909 0.213841 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.783082 0.176951 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:15.951022 0.236971 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:16.164366 0.171700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:16.332630 0.103185 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:16.414368 0.444330 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:16.836479 0.346441 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:17.192234 0.129115 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:17.313970 0.000000 tcp 10.0.2.105 59274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:14:17.331661 0.144994 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:17.430307 0.848174 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:18.264281 0.178242 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:18.684852 0.080902 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:18.755177 0.252906 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:19.013720 0.189259 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:19.734331 0.115655 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:20.043772 0.179990 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:14:23.230718 0.067788 tcp 10.0.2.105 59278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:23.298312 0.065286 tcp 10.0.2.105 59279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:23.363881 0.162054 tcp 10.0.2.105 59280 -> 195.113.214.249 443 SRPA* 0 0 45 22830 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:14:23.536942 2.956725 tcp 10.0.2.105 59281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:14:32.426839 0.000000 tcp 10.0.2.105 59281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:14:55.278792 2.952527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:15:02.185897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:15:10.072498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:15:27.040185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:15:58.617513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:19:37.022085 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:19:37.022189 2.954477 tcp 10.0.2.105 59282 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:19:45.893469 0.000000 tcp 10.0.2.105 59282 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:19:51.811614 0.063787 tcp 10.0.2.105 59283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:19:51.875725 0.064960 tcp 10.0.2.105 59284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:19:51.941055 0.214681 tcp 10.0.2.105 59285 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:19:52.356211 2.958074 tcp 10.0.2.105 59286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:01.224884 0.000000 tcp 10.0.2.105 59286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:07.142738 0.068566 tcp 10.0.2.105 59287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:07.211577 0.065720 tcp 10.0.2.105 59288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:07.277630 0.154348 tcp 10.0.2.105 59289 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:07.670643 2.967395 tcp 10.0.2.105 59290 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:16.549254 0.000000 tcp 10.0.2.105 59290 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:22.464136 0.062953 tcp 10.0.2.105 59291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:22.527469 0.064482 tcp 10.0.2.105 59292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:22.592368 0.174939 tcp 10.0.2.105 59293 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:23.055441 2.960909 tcp 10.0.2.105 59294 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:31.940913 0.000000 tcp 10.0.2.105 59294 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:37.854130 0.070041 tcp 10.0.2.105 59295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:37.924620 0.064957 tcp 10.0.2.105 59296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:37.989898 0.158562 tcp 10.0.2.105 59297 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:20:38.337804 2.959114 tcp 10.0.2.105 59298 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:47.217821 0.000000 tcp 10.0.2.105 59298 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:20:57.172827 2.963607 tcp 10.0.2.105 59299 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:21:06.051952 0.000000 tcp 10.0.2.105 59299 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:21:10.683414 0.816269 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:21:12.782035 2.974728 tcp 10.0.2.105 59300 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:21:21.674004 0.000000 tcp 10.0.2.105 59300 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:21:27.590167 2.969068 tcp 10.0.2.105 59301 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:21:35.169701 0.151633 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:21:36.618128 0.000000 tcp 10.0.2.105 59301 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:22:02.656097 2.967062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:22:09.568724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:22:17.459787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:22:34.068502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:23:05.613760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:26:39.290125 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:26:39.290218 2.954247 tcp 10.0.2.105 59302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:26:48.173529 0.000000 tcp 10.0.2.105 59302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:26:54.093357 0.065778 tcp 10.0.2.105 59303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:26:54.159440 0.065127 tcp 10.0.2.105 59304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:26:54.224890 0.154788 tcp 10.0.2.105 59305 -> 195.113.214.249 443 SRPA* 0 0 25 13250 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:26:54.467670 2.954308 tcp 10.0.2.105 59306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:03.343526 0.000000 tcp 10.0.2.105 59306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:11.474480 0.067140 tcp 10.0.2.105 59307 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:11.541909 0.064837 tcp 10.0.2.105 59308 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:11.607006 0.157835 tcp 10.0.2.105 59309 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:11.931293 2.961458 tcp 10.0.2.105 59310 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:20.803214 0.000000 tcp 10.0.2.105 59310 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:26.722599 0.081787 tcp 10.0.2.105 59311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:26.804679 0.069181 tcp 10.0.2.105 59312 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:26.874154 0.162145 tcp 10.0.2.105 59313 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:27.089164 2.965347 tcp 10.0.2.105 59314 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:35.970124 0.000000 tcp 10.0.2.105 59314 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:41.887804 0.064703 tcp 10.0.2.105 59315 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:41.952813 0.062883 tcp 10.0.2.105 59316 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:42.015968 0.157682 tcp 10.0.2.105 59317 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:27:42.297780 2.961997 tcp 10.0.2.105 59318 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:51.178158 0.000000 tcp 10.0.2.105 59318 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:27:57.089064 2.951744 tcp 10.0.2.105 59319 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:28:05.973821 0.000000 tcp 10.0.2.105 59319 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:28:10.463859 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:28:11.887130 2.947727 tcp 10.0.2.105 59320 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:28:20.757062 0.000000 tcp 10.0.2.105 59320 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:28:26.690180 2.951637 tcp 10.0.2.105 59321 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:28:34.146265 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:28:35.561592 0.000000 tcp 10.0.2.105 59321 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:29:06.961158 2.959585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:29:13.878162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:29:21.768919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:29:37.550182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:30:09.126532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:33:37.890542 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:33:37.890703 3.003421 tcp 10.0.2.105 59322 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:33:46.892951 0.000000 tcp 10.0.2.105 59322 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:33:52.892881 0.067642 tcp 10.0.2.105 59323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:33:52.960848 0.067150 tcp 10.0.2.105 59324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:33:53.028333 0.163659 tcp 10.0.2.105 59325 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:33:53.284369 3.001609 tcp 10.0.2.105 59326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:02.284999 0.000000 tcp 10.0.2.105 59326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:08.283861 0.069699 tcp 10.0.2.105 59327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:08.353840 0.064175 tcp 10.0.2.105 59328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:08.417844 0.154343 tcp 10.0.2.105 59329 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:08.907407 3.001303 tcp 10.0.2.105 59330 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:17.917214 0.000000 tcp 10.0.2.105 59330 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:23.906562 0.065710 tcp 10.0.2.105 59331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:23.972552 0.072220 tcp 10.0.2.105 59332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:24.045062 0.187069 tcp 10.0.2.105 59333 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:24.525507 2.995560 tcp 10.0.2.105 59334 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:33.519829 0.000000 tcp 10.0.2.105 59334 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:40.250944 0.066683 tcp 10.0.2.105 59335 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:40.317963 0.147478 tcp 10.0.2.105 59336 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:40.465740 0.168558 tcp 10.0.2.105 59337 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:34:41.050316 2.968488 tcp 10.0.2.105 59338 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:49.942213 0.000000 tcp 10.0.2.105 59338 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:34:55.864057 2.972703 tcp 10.0.2.105 59339 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:35:04.762251 0.000000 tcp 10.0.2.105 59339 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:35:09.306121 2.125684 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:35:12.800967 2.969120 tcp 10.0.2.105 59340 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:35:21.693756 0.000000 tcp 10.0.2.105 59340 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:35:27.682042 2.955862 tcp 10.0.2.105 59341 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:35:35.199046 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:35:36.565060 0.000000 tcp 10.0.2.105 59341 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:36:12.522267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 1 146 flow=Background 1970/02/11 02:36:19.699044 1.983467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/11 02:36:25.631351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:36:33.522191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:36:49.315083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:37:20.890226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:40:44.705244 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:40:44.705338 2.958387 tcp 10.0.2.105 59342 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:40:53.581835 0.000000 tcp 10.0.2.105 59342 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:40:59.501497 0.066824 tcp 10.0.2.105 59343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:40:59.568617 0.065615 tcp 10.0.2.105 59344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:40:59.634543 0.162155 tcp 10.0.2.105 59345 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:00.161110 2.960724 tcp 10.0.2.105 59346 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:09.033111 0.000000 tcp 10.0.2.105 59346 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:14.950143 0.064465 tcp 10.0.2.105 59347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:15.014909 0.070840 tcp 10.0.2.105 59348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:15.086016 0.160618 tcp 10.0.2.105 59349 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:15.438017 3.876544 tcp 10.0.2.105 59350 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:25.235241 0.000000 tcp 10.0.2.105 59350 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:31.160818 0.070949 tcp 10.0.2.105 59351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:31.231793 0.063632 tcp 10.0.2.105 59352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:31.295780 0.159096 tcp 10.0.2.105 59353 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:41:31.786528 2.959825 tcp 10.0.2.105 59354 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:40.675560 0.000000 tcp 10.0.2.105 59354 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:46.586640 2.946517 tcp 10.0.2.105 59355 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:41:55.452759 0.000000 tcp 10.0.2.105 59355 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:42:00.197847 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:42:01.382706 2.960590 tcp 10.0.2.105 59356 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:42:10.257688 0.000000 tcp 10.0.2.105 59356 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:43:20.890392 2.963030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:43:27.799747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:43:35.688929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:43:51.485710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:44:23.081670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:44:36.200224 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:44:36.200431 0.836610 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.029816 0.075448 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2617 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.147428 0.075693 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.202940 0.156659 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.605860 0.084232 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.649093 0.175678 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:37.821710 0.060259 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.020133 0.114465 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.095997 0.229350 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.318577 0.212983 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.523246 0.175678 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.770647 0.239649 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:38.986596 0.173274 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:39.156131 0.097665 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:39.273920 0.436781 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:39.687686 0.127472 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:39.828867 0.347085 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:40.484222 0.127538 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:40.611710 0.632044 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:41.229216 0.170192 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2003 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:41.495430 0.067982 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:41.553258 0.252963 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:41.768512 0.202944 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:41.966537 0.115707 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:44:42.250880 0.176478 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/11 02:47:12.151065 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:47:12.151223 3.003479 tcp 10.0.2.105 59357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:47:21.153395 0.000000 tcp 10.0.2.105 59357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:47:27.153460 0.063327 tcp 10.0.2.105 59358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:27.217089 0.068514 tcp 10.0.2.105 59359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:27.285916 0.164652 tcp 10.0.2.105 59360 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:27.623231 3.003655 tcp 10.0.2.105 59361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:47:36.625469 0.000000 tcp 10.0.2.105 59361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:47:42.625139 0.063031 tcp 10.0.2.105 59362 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:42.688583 0.064844 tcp 10.0.2.105 59363 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:42.753752 0.160578 tcp 10.0.2.105 59364 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:42.923973 3.427506 tcp 10.0.2.105 59365 -> 46.48.223.67 15494 SPA_* 0 0 10 1157 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:50.390238 0.427737 tcp 10.0.2.105 59365 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:50.391079 0.063136 tcp 10.0.2.105 59366 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:50.454498 0.064357 tcp 10.0.2.105 59367 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:50.519162 0.150889 tcp 10.0.2.105 59368 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:47:50.818177 3.001838 tcp 10.0.2.105 59369 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:47:59.818493 0.000000 tcp 10.0.2.105 59369 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:05.818138 0.064078 tcp 10.0.2.105 59370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:05.882561 0.066628 tcp 10.0.2.105 59371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:05.949471 0.160370 tcp 10.0.2.105 59372 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:06.549422 3.003648 tcp 10.0.2.105 59373 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:15.551557 0.000000 tcp 10.0.2.105 59373 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:21.550660 0.064338 tcp 10.0.2.105 59374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:21.615368 0.063228 tcp 10.0.2.105 59375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:21.678966 0.157690 tcp 10.0.2.105 59376 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:48:21.867399 3.007004 tcp 10.0.2.105 59377 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:30.873614 0.000000 tcp 10.0.2.105 59377 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:36.862368 3.004376 tcp 10.0.2.105 59378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:45.891670 0.000000 tcp 10.0.2.105 59378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:48:50.441633 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:48:51.863817 0.471971 tcp 10.0.2.105 59379 -> 46.48.223.67 15494 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:49:16.028140 0.000422 tcp 10.0.2.105 59379 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:49:16.028855 3.004210 tcp 10.0.2.105 59380 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:49:25.031488 0.000000 tcp 10.0.2.105 59380 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:49:31.030192 3.003850 tcp 10.0.2.105 59381 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:49:40.033220 0.000000 tcp 10.0.2.105 59381 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:49:44.940467 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:54:09.785503 2.999771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 02:54:16.791043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:54:24.792800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:54:40.795471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:54:46.033351 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:54:46.033458 2.996813 tcp 10.0.2.105 59382 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:54:55.039273 0.000000 tcp 10.0.2.105 59382 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:01.037011 0.067481 tcp 10.0.2.105 59383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:01.104897 0.066320 tcp 10.0.2.105 59384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:01.171649 0.157762 tcp 10.0.2.105 59385 -> 195.113.214.249 443 SRPA* 0 0 44 21366 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:01.587339 3.002524 tcp 10.0.2.105 59386 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:10.588650 0.000000 tcp 10.0.2.105 59386 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:12.801587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 02:55:16.587819 0.063670 tcp 10.0.2.105 59387 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:16.651807 0.064590 tcp 10.0.2.105 59388 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:16.716665 0.170137 tcp 10.0.2.105 59389 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:17.002787 0.431371 tcp 10.0.2.105 59390 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:30.952609 0.434042 tcp 10.0.2.105 59390 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:30.953335 0.064753 tcp 10.0.2.105 59391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:31.018437 0.067411 tcp 10.0.2.105 59392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:31.086206 0.167888 tcp 10.0.2.105 59393 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:31.386894 2.995632 tcp 10.0.2.105 59394 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:40.381125 0.000000 tcp 10.0.2.105 59394 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:46.381377 0.063632 tcp 10.0.2.105 59395 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:46.445293 0.067091 tcp 10.0.2.105 59396 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:46.512696 0.168041 tcp 10.0.2.105 59397 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:55:46.822573 3.002247 tcp 10.0.2.105 59398 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:55:55.828503 0.000000 tcp 10.0.2.105 59398 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:01.832952 0.072220 tcp 10.0.2.105 59399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:56:01.905480 0.067792 tcp 10.0.2.105 59400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:56:01.973529 0.159326 tcp 10.0.2.105 59401 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:56:02.300594 2.996412 tcp 10.0.2.105 59402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:11.295537 0.000000 tcp 10.0.2.105 59402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:17.284396 2.993535 tcp 10.0.2.105 59403 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:26.287285 0.000000 tcp 10.0.2.105 59403 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:30.943661 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 02:56:32.285982 4.475838 tcp 10.0.2.105 59404 -> 46.48.223.67 15494 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/02/11 02:56:36.761711 3.005000 tcp 10.0.2.105 59405 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:45.764966 0.000000 tcp 10.0.2.105 59405 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:56:51.754114 2.994068 tcp 10.0.2.105 59406 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:57:00.761750 0.000000 tcp 10.0.2.105 59406 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 02:57:05.443381 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:01:16.808102 3.000754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:01:23.814914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:01:31.816548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:01:47.819182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:02:06.757773 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:02:06.757956 3.003117 tcp 10.0.2.105 59407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:02:15.759632 0.000000 tcp 10.0.2.105 59407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:02:19.825686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:02:21.759971 0.069858 tcp 10.0.2.105 59408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:21.830086 0.072463 tcp 10.0.2.105 59409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:21.902863 0.165608 tcp 10.0.2.105 59410 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:22.080764 3.002581 tcp 10.0.2.105 59411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:02:31.082172 0.000000 tcp 10.0.2.105 59411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:02:37.083575 0.071713 tcp 10.0.2.105 59412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:37.155649 0.066629 tcp 10.0.2.105 59413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:37.222577 0.154057 tcp 10.0.2.105 59414 -> 195.113.214.249 443 SRPA* 0 0 34 17906 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:37.405323 0.436764 tcp 10.0.2.105 59415 -> 46.48.223.67 15494 SPA_* 0 0 9 1227 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:53.507010 0.484954 tcp 10.0.2.105 59415 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:53.507979 0.070155 tcp 10.0.2.105 59416 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:53.578425 0.068251 tcp 10.0.2.105 59417 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:53.646974 0.153802 tcp 10.0.2.105 59418 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:02:53.992375 2.996653 tcp 10.0.2.105 59419 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:02.992793 0.000000 tcp 10.0.2.105 59419 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:08.986708 0.063763 tcp 10.0.2.105 59420 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:09.050736 0.064722 tcp 10.0.2.105 59421 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:09.115714 0.154622 tcp 10.0.2.105 59422 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:09.287616 3.003161 tcp 10.0.2.105 59423 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:18.289419 0.000000 tcp 10.0.2.105 59423 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:24.289189 0.065765 tcp 10.0.2.105 59424 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:24.355264 0.070486 tcp 10.0.2.105 59425 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:24.426106 0.160332 tcp 10.0.2.105 59426 -> 195.113.214.249 443 SRPA* 0 0 39 21208 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:03:24.605149 2.997693 tcp 10.0.2.105 59427 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:33.601665 0.000000 tcp 10.0.2.105 59427 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:39.600310 3.004139 tcp 10.0.2.105 59428 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:48.603202 0.000000 tcp 10.0.2.105 59428 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:03:53.439632 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:03:54.601762 1.443379 tcp 10.0.2.105 59429 -> 46.48.223.67 15494 SPA_* 0 0 9 1227 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:04:10.663543 0.000387 tcp 10.0.2.105 59429 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:04:10.664199 2.995238 tcp 10.0.2.105 59430 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:04:19.657824 0.000000 tcp 10.0.2.105 59430 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:04:25.656730 2.993995 tcp 10.0.2.105 59431 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:04:34.649373 0.000000 tcp 10.0.2.105 59431 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:04:39.446129 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:08:23.831478 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:08:30.839178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:08:38.840221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:08:54.843289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:09:26.849472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:09:40.660379 0.000210 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:09:40.660703 3.003215 tcp 10.0.2.105 59432 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:09:49.662482 0.000000 tcp 10.0.2.105 59432 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:09:55.662869 0.065835 tcp 10.0.2.105 59433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:09:55.728945 0.070509 tcp 10.0.2.105 59434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:09:55.799762 0.161221 tcp 10.0.2.105 59435 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:09:56.360441 3.005951 tcp 10.0.2.105 59436 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:10:05.364935 0.000000 tcp 10.0.2.105 59436 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:10:11.353906 0.063406 tcp 10.0.2.105 59437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:11.417621 0.066473 tcp 10.0.2.105 59438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:11.484436 0.427999 tcp 10.0.2.105 59439 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:11.951126 1.455478 tcp 10.0.2.105 59440 -> 46.48.223.67 15494 SPA_* 0 0 9 1237 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:29.182031 0.942508 tcp 10.0.2.105 59440 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:29.182869 0.063190 tcp 10.0.2.105 59441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:29.246342 0.064246 tcp 10.0.2.105 59442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:29.310451 0.164673 tcp 10.0.2.105 59443 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:30.124769 2.999352 tcp 10.0.2.105 59444 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:10:39.123257 0.000000 tcp 10.0.2.105 59444 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:10:45.122596 0.063286 tcp 10.0.2.105 59445 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:45.186270 0.067529 tcp 10.0.2.105 59446 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:45.254128 0.168203 tcp 10.0.2.105 59447 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:10:45.754107 3.002922 tcp 10.0.2.105 59448 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:10:54.765909 0.000000 tcp 10.0.2.105 59448 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:00.755191 0.064570 tcp 10.0.2.105 59449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:11:00.820115 0.067743 tcp 10.0.2.105 59450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:11:00.888157 0.239847 tcp 10.0.2.105 59451 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:11:01.166813 2.992274 tcp 10.0.2.105 59452 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:10.157820 0.000000 tcp 10.0.2.105 59452 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:16.167204 2.993777 tcp 10.0.2.105 59453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:25.159670 0.000000 tcp 10.0.2.105 59453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:29.946580 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:11:31.168524 0.422100 tcp 10.0.2.105 59454 -> 46.48.223.67 15494 SPA_* 0 0 9 1237 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:11:41.066916 0.000379 tcp 10.0.2.105 59454 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:11:41.067523 3.009508 tcp 10.0.2.105 59455 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:50.075377 0.000000 tcp 10.0.2.105 59455 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:11:56.064134 2.994167 tcp 10.0.2.105 59456 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:12:05.066902 0.000000 tcp 10.0.2.105 59456 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:12:09.943972 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:14:52.808360 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:14:52.808555 0.079507 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:52.867885 0.929942 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:53.773135 0.075605 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.116945 0.156452 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.264945 0.087137 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.331376 0.176056 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.504702 0.064804 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.661241 0.106891 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:14:54.728107 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 03:15:12.778666 0.066250 tcp 10.0.2.105 59457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:15:12.845255 0.067326 tcp 10.0.2.105 59458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:15:12.912907 0.163505 tcp 10.0.2.105 59459 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:15:13.077012 0.220426 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:13.290245 0.174086 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:13.551473 0.237626 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:13.766128 0.191617 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:13.948748 0.101204 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:14.151239 0.339877 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:14.627271 0.443080 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:15.050070 0.207869 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:15.212776 0.128817 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:15.379686 0.795199 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:16.159630 0.170614 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:16.347941 0.070501 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:16.410727 0.248932 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:16.623503 0.208086 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:16.961448 0.115547 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:17.212432 0.175996 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:15:30.855472 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:15:37.862845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:15:45.864557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:16:01.866800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:16:33.873488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:17:11.067007 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:17:11.067111 3.003974 tcp 10.0.2.105 59460 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:17:20.069581 0.000000 tcp 10.0.2.105 59460 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:17:26.069486 0.068934 tcp 10.0.2.105 59461 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:26.138632 0.090863 tcp 10.0.2.105 59462 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:26.229806 0.157345 tcp 10.0.2.105 59463 -> 195.113.214.249 443 SRPA* 0 0 51 42184 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:26.552689 3.000208 tcp 10.0.2.105 59464 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:17:35.552184 0.000000 tcp 10.0.2.105 59464 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:17:41.999247 1.798708 tcp 10.0.2.105 59465 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:43.798211 0.079128 tcp 10.0.2.105 59466 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:43.877628 0.231523 tcp 10.0.2.105 59467 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:17:44.524934 0.513131 tcp 10.0.2.105 59468 -> 46.48.223.67 15494 SPA_* 0 0 9 1141 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:12.888127 3.560168 tcp 10.0.2.105 59468 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:12.889075 0.065646 tcp 10.0.2.105 59469 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:12.955005 0.070550 tcp 10.0.2.105 59470 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:13.025877 0.166252 tcp 10.0.2.105 59471 -> 195.113.214.249 443 SRPA* 0 0 37 19136 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:16.448557 2.960409 tcp 10.0.2.105 59472 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:18:25.331400 0.000000 tcp 10.0.2.105 59472 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:18:31.263233 0.066939 tcp 10.0.2.105 59473 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:31.330513 0.065837 tcp 10.0.2.105 59474 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:31.396670 0.154872 tcp 10.0.2.105 59475 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:31.659196 2.966567 tcp 10.0.2.105 59476 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:18:40.550427 0.000000 tcp 10.0.2.105 59476 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:18:50.992908 4.651841 tcp 10.0.2.105 59477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:55.645067 0.063739 tcp 10.0.2.105 59478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:55.709068 0.158059 tcp 10.0.2.105 59479 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:18:56.365724 2.967515 tcp 10.0.2.105 59480 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:05.264382 0.000000 tcp 10.0.2.105 59480 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:11.162273 0.000000 tcp 10.0.2.105 59481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:18.305532 0.000000 tcp 10.0.2.105 59481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:24.220520 0.000000 tcp 10.0.2.105 59481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:28.744709 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:19:30.155986 0.433879 tcp 10.0.2.105 59482 -> 46.48.223.67 15494 SPA_* 0 0 9 1141 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:19:38.823536 0.000384 tcp 10.0.2.105 59482 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:19:38.824174 2.958169 tcp 10.0.2.105 59483 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:47.691895 0.000000 tcp 10.0.2.105 59483 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:19:53.614400 2.963292 tcp 10.0.2.105 59484 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:20:02.490524 0.000000 tcp 10.0.2.105 59484 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:20:07.197341 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:22:49.402800 2.958749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:22:56.315075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:23:04.208843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:23:19.995219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:23:51.580627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:25:04.328469 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:25:04.328566 2.954285 tcp 10.0.2.105 59485 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:13.208244 0.000000 tcp 10.0.2.105 59485 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:19.130428 0.065694 tcp 10.0.2.105 59486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:19.196465 0.064394 tcp 10.0.2.105 59487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:19.261171 0.173712 tcp 10.0.2.105 59488 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:19.496895 2.942820 tcp 10.0.2.105 59489 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:28.369154 0.000000 tcp 10.0.2.105 59489 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:34.299109 0.064608 tcp 10.0.2.105 59490 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:34.364040 0.066349 tcp 10.0.2.105 59491 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:34.430693 0.158664 tcp 10.0.2.105 59492 -> 195.113.214.249 443 SRPA* 0 0 42 21662 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:34.791395 0.423494 tcp 10.0.2.105 59493 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:43.120478 0.449070 tcp 10.0.2.105 59493 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:43.121420 0.064065 tcp 10.0.2.105 59494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:43.185792 0.069501 tcp 10.0.2.105 59495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:43.255629 0.156633 tcp 10.0.2.105 59496 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:43.569830 2.966554 tcp 10.0.2.105 59497 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:52.451772 0.000000 tcp 10.0.2.105 59497 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:25:58.367098 0.068660 tcp 10.0.2.105 59498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:58.436117 0.064420 tcp 10.0.2.105 59499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:58.500805 0.161391 tcp 10.0.2.105 59500 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:25:58.726481 2.970771 tcp 10.0.2.105 59501 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:07.627678 0.000000 tcp 10.0.2.105 59501 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:13.525567 0.074941 tcp 10.0.2.105 59502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:26:13.600821 0.066646 tcp 10.0.2.105 59503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:26:13.667719 0.155740 tcp 10.0.2.105 59504 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:26:14.280201 2.950587 tcp 10.0.2.105 59505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:23.149640 0.000000 tcp 10.0.2.105 59505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:29.067245 2.954430 tcp 10.0.2.105 59506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:37.941983 0.000000 tcp 10.0.2.105 59506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:26:42.774684 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:26:43.860854 0.431793 tcp 10.0.2.105 59507 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:27:13.882933 0.396859 tcp 10.0.2.105 59507 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:27:13.883249 2.963666 tcp 10.0.2.105 59508 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:27:22.761128 0.000000 tcp 10.0.2.105 59508 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:27:28.680225 2.950543 tcp 10.0.2.105 59509 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:27:37.561548 0.000000 tcp 10.0.2.105 59509 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:27:42.438404 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:29:50.642410 2.966105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:29:57.557575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:30:05.448567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:30:21.227318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:30:52.803093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:32:39.419051 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:32:39.419181 2.954979 tcp 10.0.2.105 59510 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:32:48.290858 0.000000 tcp 10.0.2.105 59510 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:32:54.210006 0.070333 tcp 10.0.2.105 59511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:32:54.280604 0.067015 tcp 10.0.2.105 59512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:32:54.347921 0.153650 tcp 10.0.2.105 59513 -> 195.113.214.249 443 SRPA* 0 0 51 37512 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:32:54.646263 2.967148 tcp 10.0.2.105 59514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:33:03.534225 0.000000 tcp 10.0.2.105 59514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:33:09.450501 0.066080 tcp 10.0.2.105 59515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:09.516967 0.064596 tcp 10.0.2.105 59516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:09.581964 0.158649 tcp 10.0.2.105 59517 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:09.846795 0.456642 tcp 10.0.2.105 59518 -> 46.48.223.67 15494 SPA_* 0 0 9 1196 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:39.904493 0.066065 tcp 10.0.2.105 59519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:39.970872 0.067203 tcp 10.0.2.105 59520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:40.038419 0.162652 tcp 10.0.2.105 59521 -> 195.113.214.249 443 SRPA* 0 0 42 34064 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:40.779502 0.426521 tcp 10.0.2.105 59518 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:40.779798 2.950560 tcp 10.0.2.105 59522 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:33:49.652056 0.000000 tcp 10.0.2.105 59522 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:33:55.570843 1.653374 tcp 10.0.2.105 59523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:57.224494 0.066760 tcp 10.0.2.105 59524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:57.291615 0.155127 tcp 10.0.2.105 59525 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:33:57.539134 2.960206 tcp 10.0.2.105 59526 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:06.413504 0.000000 tcp 10.0.2.105 59526 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:12.332778 0.063848 tcp 10.0.2.105 59527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:34:12.396916 0.063674 tcp 10.0.2.105 59528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:34:12.460915 0.221197 tcp 10.0.2.105 59529 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:34:12.813831 2.966636 tcp 10.0.2.105 59530 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:21.697607 0.000000 tcp 10.0.2.105 59530 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:27.612483 2.965560 tcp 10.0.2.105 59531 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:37.098159 0.000000 tcp 10.0.2.105 59531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:34:41.903296 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:34:43.012617 0.425581 tcp 10.0.2.105 59532 -> 46.48.223.67 15494 SPA_* 0 0 9 1196 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:34:57.787413 0.000390 tcp 10.0.2.105 59532 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:34:57.788072 2.951726 tcp 10.0.2.105 59533 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:35:06.654678 0.000000 tcp 10.0.2.105 59533 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:35:12.568987 2.946403 tcp 10.0.2.105 59534 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:35:21.433326 0.000000 tcp 10.0.2.105 59534 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:35:26.291367 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:36:54.098875 2.958298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:37:01.014303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:37:08.908490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:37:24.694834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:37:56.267082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:40:24.040424 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:40:24.040526 3.003488 tcp 10.0.2.105 59535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:40:33.042627 0.000000 tcp 10.0.2.105 59535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:40:39.044346 0.066495 tcp 10.0.2.105 59536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:39.111117 0.065278 tcp 10.0.2.105 59537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:39.176773 0.158946 tcp 10.0.2.105 59538 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:39.776597 3.001720 tcp 10.0.2.105 59539 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:40:48.775250 0.000000 tcp 10.0.2.105 59539 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:40:54.774590 0.063533 tcp 10.0.2.105 59540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:54.838423 0.063750 tcp 10.0.2.105 59541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:54.902445 0.159595 tcp 10.0.2.105 59542 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:40:55.089135 0.436267 tcp 10.0.2.105 59543 -> 46.48.223.67 15494 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:25.529131 0.068698 tcp 10.0.2.105 59544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:25.598142 0.070828 tcp 10.0.2.105 59545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:25.669267 0.270491 tcp 10.0.2.105 59546 -> 195.113.214.249 443 SRPA* 0 0 16 5772 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:26.281897 0.389611 tcp 10.0.2.105 59543 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:26.282215 3.001224 tcp 10.0.2.105 59547 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:41:35.283672 0.000000 tcp 10.0.2.105 59547 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:41:41.282620 0.063360 tcp 10.0.2.105 59548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:41.346330 0.115598 tcp 10.0.2.105 59549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:41.462231 0.157112 tcp 10.0.2.105 59550 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:41.913471 3.002420 tcp 10.0.2.105 59551 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:41:50.914681 0.000000 tcp 10.0.2.105 59551 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:41:56.914019 0.063180 tcp 10.0.2.105 59552 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:56.977493 0.070477 tcp 10.0.2.105 59553 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:57.048253 0.157455 tcp 10.0.2.105 59554 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:41:57.229872 2.997671 tcp 10.0.2.105 59555 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:42:06.236807 0.000000 tcp 10.0.2.105 59555 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:42:12.225251 2.994346 tcp 10.0.2.105 59556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:42:21.312962 0.000000 tcp 10.0.2.105 59556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:42:25.999262 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:42:27.271090 1.808735 tcp 10.0.2.105 59557 -> 46.48.223.67 15494 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:42:59.052657 0.409514 tcp 10.0.2.105 59557 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:42:59.053020 3.003830 tcp 10.0.2.105 59558 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:43:08.055785 0.000000 tcp 10.0.2.105 59558 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:43:14.054251 2.994380 tcp 10.0.2.105 59559 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:43:23.057119 0.000000 tcp 10.0.2.105 59559 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:43:27.944138 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:43:58.951721 3.000994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:44:05.958753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:44:13.960375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:44:29.963125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:45:01.969310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:45:46.103391 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:45:46.103553 0.227048 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:46.323415 0.081648 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:46.631069 0.156686 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:46.779405 1.010812 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:47.784822 0.088224 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:48.341252 0.067456 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:48.585825 0.063292 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:48.647673 0.177140 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:48.835949 0.437859 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:49.206165 0.214460 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:49.412717 0.174841 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:49.579690 0.234604 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:49.855270 0.172448 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:50.024845 0.100465 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:50.427703 0.137577 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:45:50.522404 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 03:46:07.385693 0.070954 tcp 10.0.2.105 59560 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:46:07.456951 0.069637 tcp 10.0.2.105 59561 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:46:07.526890 0.155839 tcp 10.0.2.105 59562 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:46:07.683315 0.435934 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:08.096646 0.129298 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:08.505073 0.892645 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:09.382094 0.164909 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 1989 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:09.573800 0.193427 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:09.761149 0.103256 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:10.079514 0.177498 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:10.229237 0.126656 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:46:10.347428 0.285315 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/11 03:48:29.057556 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:48:29.057764 3.003559 tcp 10.0.2.105 59563 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:48:38.059989 0.000000 tcp 10.0.2.105 59563 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:48:44.059835 0.063811 tcp 10.0.2.105 59564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:44.123934 0.063048 tcp 10.0.2.105 59565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:44.187258 0.159206 tcp 10.0.2.105 59566 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:44.385305 2.997779 tcp 10.0.2.105 59567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:48:53.382210 0.000000 tcp 10.0.2.105 59567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:48:59.380940 0.068206 tcp 10.0.2.105 59568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:59.449473 0.067763 tcp 10.0.2.105 59569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:59.517543 0.184113 tcp 10.0.2.105 59570 -> 195.113.214.249 443 SRPA* 0 0 15 4922 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:48:59.979584 3.006430 tcp 10.0.2.105 59571 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:08.984607 0.000000 tcp 10.0.2.105 59571 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:14.974268 0.063108 tcp 10.0.2.105 59572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:15.037733 0.076314 tcp 10.0.2.105 59573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:15.114320 0.162887 tcp 10.0.2.105 59574 -> 195.113.214.249 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:15.397461 3.000504 tcp 10.0.2.105 59575 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:24.406163 0.000000 tcp 10.0.2.105 59575 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:30.396026 0.063632 tcp 10.0.2.105 59576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:30.460000 0.066500 tcp 10.0.2.105 59577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:30.526812 0.152719 tcp 10.0.2.105 59578 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:49:30.698447 3.001396 tcp 10.0.2.105 59579 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:39.698973 0.000000 tcp 10.0.2.105 59579 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:45.698913 3.002563 tcp 10.0.2.105 59580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:54.700157 0.000000 tcp 10.0.2.105 59580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:49:59.436935 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:50:00.699225 3.003864 tcp 10.0.2.105 59581 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:50:09.701784 0.000000 tcp 10.0.2.105 59581 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:50:15.700572 3.004273 tcp 10.0.2.105 59582 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:50:23.441523 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:50:24.703088 0.000000 tcp 10.0.2.105 59582 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:54:30.980366 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 03:54:37.987462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:54:45.991592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:55:01.992220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:55:30.703826 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:55:30.703918 2.993471 tcp 10.0.2.105 59583 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:55:33.998319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 03:55:39.706583 0.000000 tcp 10.0.2.105 59583 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:55:45.707089 0.067480 tcp 10.0.2.105 59584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:55:45.774848 0.066697 tcp 10.0.2.105 59585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:55:45.841854 0.158021 tcp 10.0.2.105 59586 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:55:46.111051 2.988165 tcp 10.0.2.105 59587 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:55:55.097903 0.000000 tcp 10.0.2.105 59587 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:01.107894 0.069788 tcp 10.0.2.105 59588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:01.178035 0.069966 tcp 10.0.2.105 59589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:01.248308 0.161826 tcp 10.0.2.105 59590 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:01.450527 3.001714 tcp 10.0.2.105 59591 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:10.450499 0.000000 tcp 10.0.2.105 59591 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:16.449616 0.064432 tcp 10.0.2.105 59592 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:16.514325 0.065191 tcp 10.0.2.105 59593 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:16.579438 0.166362 tcp 10.0.2.105 59594 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:16.820937 3.002973 tcp 10.0.2.105 59595 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:25.822413 0.000000 tcp 10.0.2.105 59595 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:31.821736 0.076936 tcp 10.0.2.105 59596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:31.898981 0.069123 tcp 10.0.2.105 59597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:31.968406 0.154491 tcp 10.0.2.105 59598 -> 195.113.214.249 443 SRPA* 0 0 42 22726 flow=From-Botnet-V2-TCP-Established 1970/02/11 03:56:32.175189 3.001235 tcp 10.0.2.105 59599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:41.174793 0.000000 tcp 10.0.2.105 59599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:47.173273 3.004265 tcp 10.0.2.105 59600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:56:56.186035 0.000000 tcp 10.0.2.105 59600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:57:00.942971 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:57:02.175025 2.993909 tcp 10.0.2.105 59601 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:57:11.167775 0.000000 tcp 10.0.2.105 59601 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:57:17.176499 2.993956 tcp 10.0.2.105 59602 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 03:57:24.937666 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 03:57:26.169339 0.000000 tcp 10.0.2.105 59602 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:01:38.005184 3.000435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 04:01:45.012019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:01:53.013384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:02:09.016625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:02:32.179748 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:02:32.179873 3.003647 tcp 10.0.2.105 59603 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:02:41.023012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:02:41.182984 0.000000 tcp 10.0.2.105 59603 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:02:47.181850 0.108959 tcp 10.0.2.105 59604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:02:47.291086 0.071003 tcp 10.0.2.105 59605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:02:47.362458 0.154162 tcp 10.0.2.105 59606 -> 195.113.214.249 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:02:47.588312 2.997414 tcp 10.0.2.105 59607 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:02:56.584520 0.000000 tcp 10.0.2.105 59607 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:02.583795 0.088697 tcp 10.0.2.105 59608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:02.672799 0.067885 tcp 10.0.2.105 59609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:02.740976 0.153685 tcp 10.0.2.105 59610 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:02.914058 2.993797 tcp 10.0.2.105 59611 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:11.916439 0.000000 tcp 10.0.2.105 59611 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:17.915651 0.067844 tcp 10.0.2.105 59612 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:17.983760 0.065188 tcp 10.0.2.105 59613 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:18.049301 0.166499 tcp 10.0.2.105 59614 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:18.225620 2.994406 tcp 10.0.2.105 59615 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:27.218875 0.000000 tcp 10.0.2.105 59615 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:33.227807 0.067397 tcp 10.0.2.105 59616 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:33.295451 0.069423 tcp 10.0.2.105 59617 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:33.365157 0.163369 tcp 10.0.2.105 59618 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:03:33.646570 2.995633 tcp 10.0.2.105 59619 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:42.640808 0.000000 tcp 10.0.2.105 59619 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:48.639255 3.004386 tcp 10.0.2.105 59620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:03:57.642314 0.000000 tcp 10.0.2.105 59620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:04:02.438958 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:04:03.641098 3.004049 tcp 10.0.2.105 59621 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:04:12.643668 0.000000 tcp 10.0.2.105 59621 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:04:18.642881 3.003783 tcp 10.0.2.105 59622 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:04:26.443132 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:04:27.645410 0.000000 tcp 10.0.2.105 59622 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:08:45.028551 3.001108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 04:08:52.035545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:09:00.036509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:09:16.039822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:09:33.646044 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:09:33.646143 2.993196 tcp 10.0.2.105 59623 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:09:42.638503 0.000000 tcp 10.0.2.105 59623 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:09:48.046045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:09:48.648624 0.068900 tcp 10.0.2.105 59624 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:09:48.717795 0.104197 tcp 10.0.2.105 59625 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:09:48.822311 0.219145 tcp 10.0.2.105 59626 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:09:49.190200 3.001752 tcp 10.0.2.105 59627 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:09:58.190608 0.000000 tcp 10.0.2.105 59627 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:04.190095 0.066100 tcp 10.0.2.105 59628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:04.256524 0.066585 tcp 10.0.2.105 59629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:04.323505 0.166474 tcp 10.0.2.105 59630 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:05.143332 3.001513 tcp 10.0.2.105 59631 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:14.143444 0.000000 tcp 10.0.2.105 59631 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:20.142642 0.063310 tcp 10.0.2.105 59632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:20.206311 0.068645 tcp 10.0.2.105 59633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:20.275289 0.166685 tcp 10.0.2.105 59634 -> 195.113.214.249 443 SRPA* 0 0 37 18960 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:20.558845 3.008399 tcp 10.0.2.105 59635 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:29.565599 0.000000 tcp 10.0.2.105 59635 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:35.555028 0.066926 tcp 10.0.2.105 59636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:35.622235 0.064052 tcp 10.0.2.105 59637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:35.686655 0.161335 tcp 10.0.2.105 59638 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:10:36.301891 2.997717 tcp 10.0.2.105 59639 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:45.366987 0.000000 tcp 10.0.2.105 59639 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:10:51.316398 2.984783 tcp 10.0.2.105 59640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:11:00.303107 0.000000 tcp 10.0.2.105 59640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:11:04.946449 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:11:06.298954 3.004182 tcp 10.0.2.105 59641 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:11:15.301481 0.000000 tcp 10.0.2.105 59641 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:11:21.300793 3.009897 tcp 10.0.2.105 59642 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:11:28.940398 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:11:30.303039 0.000000 tcp 10.0.2.105 59642 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:15:52.051203 3.002476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 04:15:59.058771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:16:07.060938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:16:15.433101 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:16:15.433278 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:16:23.063829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:16:33.139599 0.064084 tcp 10.0.2.105 59643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:33.203520 0.065646 tcp 10.0.2.105 59644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:33.269455 0.168084 tcp 10.0.2.105 59645 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:33.438118 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:16:49.832894 0.061968 tcp 10.0.2.105 59646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:49.895142 0.068714 tcp 10.0.2.105 59647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:49.964159 0.158914 tcp 10.0.2.105 59648 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:16:50.123702 0.161906 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:16:50.278163 0.071951 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:16:50.480722 0.099346 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:16:50.541835 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:16:51.304776 2.993955 tcp 10.0.2.105 59649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:16:55.070215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:17:00.365657 0.000000 tcp 10.0.2.105 59649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:17:06.315588 0.067125 tcp 10.0.2.105 59650 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:06.383011 0.068405 tcp 10.0.2.105 59651 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:06.451756 0.151719 tcp 10.0.2.105 59652 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:07.072625 3.122654 tcp 10.0.2.105 59653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:17:07.561681 0.066365 tcp 10.0.2.105 59654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:07.628368 0.065047 tcp 10.0.2.105 59655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:07.693671 0.168442 tcp 10.0.2.105 59656 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:17:07.862674 0.088979 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.008017 0.113531 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.082627 0.175521 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.277411 0.063429 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.575765 0.239368 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.791978 0.173864 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:08.962116 0.174931 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:09.482941 0.216715 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:09.691077 0.129853 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:09.888278 0.098708 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:09.971765 0.472107 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:10.385321 0.127046 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:10.625312 0.535579 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:11.147482 0.170412 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:11.330984 0.196072 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:11.729469 0.103708 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:11.921079 0.178725 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:12.068458 0.078080 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:12.211206 0.257034 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:12.715267 0.216632 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:12.932344 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 REQ 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:17:16.144785 0.000000 tcp 10.0.2.105 59653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:17:20.539490 0.145825 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:20.685770 0.056361 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:20.742612 0.049025 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:20.792089 0.066781 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:20.859372 0.071589 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:20.931432 0.170349 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.102241 0.217779 udp 10.0.2.105 7010 <-> 190.205.193.197 7746 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.320593 0.163750 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.484807 0.163467 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.648819 0.050785 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.700049 0.202782 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:21.903284 0.111116 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:22.014910 0.068764 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:22.084342 0.413695 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:22.498557 0.800863 udp 10.0.2.105 7010 <-> 99.26.224.9 5585 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.299866 0.145579 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.445875 0.126500 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.572872 0.102087 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.675434 0.148985 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.824865 0.168576 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:23.993899 0.225650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:24.219992 0.190441 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:17:24.410956 0.000000 udp 10.0.2.105 7010 -> 203.47.38.157 1065 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:17:32.253447 0.089197 udp 10.0.2.105 7010 -> 213.82.216.82 7312 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:17:32.342644 0.000000 icmp 213.82.216.82 0x0303 -> 10.0.2.105 0x901c URP 192 1 153 flow=Background 1970/02/11 04:17:36.939993 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:17:39.524080 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:17:45.305684 0.000000 udp 10.0.2.105 7010 -> 95.224.148.88 1582 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:17:52.953409 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:01.205092 0.000000 udp 10.0.2.105 7010 -> 62.90.243.4 9221 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:05.941908 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:18:08.275362 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:17.267976 0.000000 udp 10.0.2.105 7010 -> 87.22.58.162 3856 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:24.286424 0.000000 udp 10.0.2.105 7010 -> 98.100.82.122 7676 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:29.416692 0.000000 udp 10.0.2.105 7010 -> 88.234.231.226 1285 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:33.933795 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:18:35.114609 0.000000 udp 10.0.2.105 7010 -> 86.173.47.132 6073 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:43.930775 0.000000 udp 10.0.2.105 7010 -> 2.50.12.200 4176 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:49.030894 0.000000 udp 10.0.2.105 7010 -> 88.252.29.67 1830 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:54.566179 0.042465 udp 10.0.2.105 7010 -> 82.36.145.189 1512 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:18:54.608644 0.000000 icmp 82.36.145.189 0x0303 -> 10.0.2.105 0xe805 URP 192 1 288 flow=Background 1970/02/11 04:18:59.119458 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:19:02.401646 0.000000 udp 10.0.2.105 7010 -> 79.190.175.106 1603 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:10.652615 0.000000 udp 10.0.2.105 7010 -> 85.101.227.247 7280 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:18.596191 0.095078 udp 10.0.2.105 7010 -> 82.51.118.7 2254 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:18.691269 0.000000 icmp 82.51.118.7 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 283 flow=Background 1970/02/11 04:19:23.443089 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:19:26.327623 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:33.608526 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:41.709619 0.000000 udp 10.0.2.105 7010 -> 78.185.95.34 7209 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:49.270873 0.044575 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:19:49.426202 0.000000 udp 10.0.2.105 7010 -> 94.162.253.205 1121 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:19:53.936702 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:19:57.832924 0.000000 udp 10.0.2.105 7010 -> 86.146.40.194 9510 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:05.964656 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:13.418917 0.165887 udp 10.0.2.105 7010 -> 93.64.195.65 1367 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:13.584804 0.000000 icmp 93.64.195.65 0x0303 -> 10.0.2.105 0x5705 URP 192 1 267 flow=Background 1970/02/11 04:20:17.941561 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:20:19.814391 0.000000 udp 10.0.2.105 7010 -> 93.193.158.198 7662 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:27.365192 0.050352 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:20:27.715414 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:33.584988 0.031468 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:20:33.884172 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:42.557121 0.073326 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:20:43.142698 0.147209 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:20:43.299945 0.000000 udp 10.0.2.105 7010 -> 86.29.5.111 4063 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:20:47.443944 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:20:52.111140 0.000000 udp 10.0.2.105 7010 -> 78.189.27.204 9027 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:00.993675 0.055696 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:21:01.085567 0.000000 udp 10.0.2.105 7010 -> 85.107.145.227 1029 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:09.085462 0.000000 udp 10.0.2.105 7010 -> 69.42.182.34 9439 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:13.941934 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:21:17.057019 0.290091 udp 10.0.2.105 7010 <-> 14.96.157.142 6114 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:21:17.732899 0.000000 udp 10.0.2.105 7010 -> 41.86.224.7 5073 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:26.169514 0.064718 udp 10.0.2.105 7010 <-> 86.143.30.116 7670 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:21:26.646438 0.057372 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:21:26.988153 0.000000 udp 10.0.2.105 7010 -> 194.121.246.177 1110 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:32.809332 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:38.367625 0.039265 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:21:38.574916 0.000000 udp 10.0.2.105 7010 -> 94.68.152.241 6497 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:42.943558 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:21:46.469259 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:21:54.721193 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:02.882897 0.077940 udp 10.0.2.105 7010 <-> 86.181.224.228 7785 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:03.094100 0.264314 udp 10.0.2.105 7010 <-> 115.242.18.252 5573 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:03.416313 0.167143 udp 10.0.2.105 7010 <-> 1.23.251.177 6353 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:03.789843 0.000000 udp 10.0.2.105 7010 -> 95.224.103.10 8932 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:07.444460 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:22:12.776545 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:19.861382 0.000000 udp 10.0.2.105 7010 -> 79.179.192.171 6117 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:22.080469 3.003709 tcp 10.0.2.105 59657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:22:26.547373 0.000000 udp 10.0.2.105 7010 -> 66.161.182.130 5661 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:31.083057 0.000000 tcp 10.0.2.105 59657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:22:31.443503 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:22:35.089004 0.000000 udp 10.0.2.105 7010 -> 58.10.70.179 3995 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:37.083028 0.191355 tcp 10.0.2.105 59658 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:37.274771 0.064780 tcp 10.0.2.105 59659 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:37.339851 0.167387 tcp 10.0.2.105 59660 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:37.707658 2.979685 tcp 10.0.2.105 59661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:22:41.974715 0.056755 udp 10.0.2.105 7010 <-> 86.176.88.244 1878 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:42.523720 0.168535 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:42.890188 0.100416 udp 10.0.2.105 7010 <-> 217.203.236.239 7449 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:22:43.109826 0.000000 udp 10.0.2.105 7010 -> 79.123.60.26 9321 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:46.635155 0.000000 tcp 10.0.2.105 59661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:22:49.613668 0.000000 udp 10.0.2.105 7010 -> 121.6.22.144 4508 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:52.594589 0.064506 tcp 10.0.2.105 59662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:52.659350 0.063633 tcp 10.0.2.105 59663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:52.723326 0.171646 tcp 10.0.2.105 59664 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:22:52.908229 3.000011 tcp 10.0.2.105 59665 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:22:55.338826 0.000000 udp 10.0.2.105 7010 -> 188.193.98.134 5226 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:22:59.085553 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 04:23:01.917157 0.000000 tcp 10.0.2.105 59665 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:03.169442 0.048022 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:23:03.494925 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:06.093177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:23:07.906422 0.073121 tcp 10.0.2.105 59666 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:07.979792 0.067197 tcp 10.0.2.105 59667 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:08.047352 0.163083 tcp 10.0.2.105 59668 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:08.237889 3.002954 tcp 10.0.2.105 59669 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:10.489909 0.052364 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:23:10.706872 0.110849 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:23:10.910260 0.000000 udp 10.0.2.105 7010 -> 117.214.5.194 9579 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:14.095070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:23:17.239048 0.000000 tcp 10.0.2.105 59669 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:21.011304 0.166582 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:23:21.385046 0.000000 udp 10.0.2.105 7010 -> 182.71.212.214 3620 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:24.348608 0.072286 tcp 10.0.2.105 59670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:24.421183 0.066488 tcp 10.0.2.105 59671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:24.487966 0.173086 tcp 10.0.2.105 59672 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:23:24.988513 2.967952 tcp 10.0.2.105 59673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:28.472865 0.000000 udp 10.0.2.105 7010 -> 2.38.66.111 5337 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:31.122335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:23:33.879023 0.000000 tcp 10.0.2.105 59673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:36.526576 0.000000 udp 10.0.2.105 7010 -> 12.161.106.217 1233 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:39.802533 2.972893 tcp 10.0.2.105 59674 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:42.895180 0.000000 udp 10.0.2.105 7010 -> 81.136.140.132 7642 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:47.758385 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:23:48.699418 0.000000 tcp 10.0.2.105 59674 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:49.957360 0.000000 udp 10.0.2.105 7010 -> 86.156.208.5 7256 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:23:54.626771 2.969181 tcp 10.0.2.105 59675 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:23:56.756385 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:02.737136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:24:03.522631 0.000000 tcp 10.0.2.105 59675 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:24:03.830602 0.000000 udp 10.0.2.105 7010 -> 218.164.140.10 7010 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:09.445050 2.958181 tcp 10.0.2.105 59676 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:24:10.416955 0.000000 udp 10.0.2.105 7010 -> 24.157.36.2 9575 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:13.937177 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:24:16.746775 0.000000 udp 10.0.2.105 7010 -> 209.156.227.34 5233 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:18.338629 0.000000 tcp 10.0.2.105 59676 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:24:22.066449 0.075882 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:24:22.323318 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 8693 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:28.674314 0.045566 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:24:28.778187 0.071898 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:24:29.013560 0.000000 udp 10.0.2.105 7010 -> 211.28.128.63 1279 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:34.502200 0.000000 udp 10.0.2.105 7010 -> 78.176.124.162 7153 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:39.129223 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:24:42.841058 0.000000 udp 10.0.2.105 7010 -> 62.249.247.156 2160 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:49.272003 0.000000 udp 10.0.2.105 7010 -> 88.244.17.132 4768 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:24:55.671068 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:01.158534 0.000000 udp 10.0.2.105 7010 -> 87.28.39.93 6207 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:05.945869 0.047081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:25:06.660910 0.000000 udp 10.0.2.105 7010 -> 81.133.180.227 1025 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:14.217669 0.000000 udp 10.0.2.105 7010 -> 95.147.111.124 6011 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:22.929967 0.055075 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 739 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:25:23.513833 0.000000 udp 10.0.2.105 7010 -> 184.149.59.13 8561 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:31.552665 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:36.439733 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:25:38.813229 0.000000 udp 10.0.2.105 7010 -> 121.6.167.182 8422 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:45.943156 0.000000 udp 10.0.2.105 7010 -> 88.233.98.173 1032 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:52.122188 0.000000 udp 10.0.2.105 7010 -> 195.151.244.93 8415 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:25:57.960856 0.000000 udp 10.0.2.105 7010 -> 2.25.205.18 9305 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:02.940134 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:26:04.700552 0.099344 udp 10.0.2.105 7010 <-> 84.94.121.189 4228 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:26:05.043494 0.085158 udp 10.0.2.105 7010 <-> 41.141.35.57 5386 CON 0 0 2 830 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:26:05.268347 0.000000 udp 10.0.2.105 7010 -> 79.242.141.13 8459 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:13.683291 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:19.301448 0.000000 udp 10.0.2.105 7010 -> 175.141.242.109 1647 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:24.679167 0.000000 udp 10.0.2.105 7010 -> 77.70.101.15 6213 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:29.445868 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:26:32.730623 0.000000 udp 10.0.2.105 7010 -> 190.174.146.167 4747 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:38.178170 0.000000 udp 10.0.2.105 7010 -> 82.10.158.98 8011 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:46.209791 0.260149 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:26:46.644950 0.176111 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:26:46.844428 0.000000 udp 10.0.2.105 7010 -> 218.210.106.130 2121 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:54.181411 0.131324 udp 10.0.2.105 7010 -> 65.206.10.1 1838 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:26:54.312735 0.000000 icmp 152.179.212.254 0x0303 -> 10.0.2.105 0x2e07 URP 192 1 245 flow=Background 1970/02/11 04:26:58.938199 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:27:02.575289 0.000000 udp 10.0.2.105 7010 -> 5.98.100.50 5475 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:08.562399 0.078688 udp 10.0.2.105 7010 <-> 78.82.98.69 5961 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:27:08.876793 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:15.852832 0.000000 udp 10.0.2.105 7010 -> 78.35.193.135 3361 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:22.312138 0.000000 udp 10.0.2.105 7010 -> 87.22.129.177 1178 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:26.938651 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:27:27.389217 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:35.354125 0.000000 udp 10.0.2.105 7010 -> 2.50.172.124 9250 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:43.272316 0.107010 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:27:43.640833 0.000000 udp 10.0.2.105 7010 -> 90.236.118.154 8248 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:52.585406 0.488342 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 731 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:27:53.282254 0.000000 udp 10.0.2.105 7010 -> 31.106.95.115 9981 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:27:57.442550 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:27:59.134977 0.000000 udp 10.0.2.105 7010 -> 66.184.94.82 1021 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:28:06.025097 0.000000 udp 10.0.2.105 7010 -> 87.6.47.244 1965 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:28:11.692892 0.276031 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:28:12.206791 0.000000 udp 10.0.2.105 7010 -> 171.100.204.82 7511 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:28:18.304930 0.098366 udp 10.0.2.105 7010 <-> 41.41.72.150 9367 CON 0 0 2 863 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:28:18.644316 0.071308 udp 10.0.2.105 7010 <-> 86.162.97.93 5460 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:28:18.952386 0.350216 udp 10.0.2.105 7010 -> 124.254.77.63 7666 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:28:19.302602 0.000000 icmp 124.254.77.63 0x0303 -> 10.0.2.105 0xf21d URP 192 1 267 flow=Background 1970/02/11 04:28:22.938799 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:28:26.283745 0.000000 udp 10.0.2.105 7010 -> 80.20.63.145 9509 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:29:23.896976 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:29:23.897204 3.003586 tcp 10.0.2.105 59677 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:29:32.899334 0.000000 tcp 10.0.2.105 59677 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:29:38.900031 0.073439 tcp 10.0.2.105 59678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:38.973724 0.071473 tcp 10.0.2.105 59679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:39.045496 0.301557 tcp 10.0.2.105 59680 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:39.508641 3.004844 tcp 10.0.2.105 59681 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:29:48.511986 0.000000 tcp 10.0.2.105 59681 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:29:54.501457 0.067671 tcp 10.0.2.105 59682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:54.569475 0.066544 tcp 10.0.2.105 59683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:54.636363 0.339223 tcp 10.0.2.105 59684 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:29:55.381416 3.004791 tcp 10.0.2.105 59685 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:30:04.384697 0.000000 tcp 10.0.2.105 59685 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 04:30:06.109871 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 04:30:10.375121 0.063742 tcp 10.0.2.105 59686 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:30:10.439165 0.064714 tcp 10.0.2.105 59687 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:30:10.504397 0.154194 tcp 10.0.2.105 59688 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:30:10.908403 0.504627 tcp 10.0.2.105 59689 -> 176.73.126.145 3888 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:30:13.117409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:30:21.118306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:30:37.122032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:31:09.128156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:37:13.136184 2.999306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 04:37:20.140820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:37:28.142770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:37:44.149605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:38:16.153445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:44:20.158201 3.001062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 04:44:27.165236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:44:35.167020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:44:51.169789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:45:23.175877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:54:42.182092 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 04:54:49.189689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:54:57.191285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:55:13.194085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:55:45.199611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 04:58:37.087749 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 04:58:37.087961 0.054056 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.142489 0.175425 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.318277 0.166554 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.485274 0.081363 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.567049 0.166775 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.734222 0.205179 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.939785 0.056646 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:37.996823 0.134474 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:38.131761 0.454529 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:38.586761 0.211297 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:38.798451 0.144697 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:38.943556 0.068976 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:39.030503 2.243149 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.274110 0.113971 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.388484 0.126525 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.515396 0.184361 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.700148 0.044349 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.744967 0.047082 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.792474 0.029057 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.821896 0.144381 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:41.966679 0.068947 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:42.036088 0.056655 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:58:42.093207 0.000000 udp 10.0.2.105 7010 -> 14.96.157.142 6114 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 04:58:59.941906 0.066096 tcp 10.0.2.105 59690 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:59:00.008276 0.066584 tcp 10.0.2.105 59691 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:59:00.075218 0.159216 tcp 10.0.2.105 59692 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 04:59:00.235103 0.061805 udp 10.0.2.105 7010 <-> 86.143.30.116 7670 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:00.297270 0.060844 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:00.358496 0.038690 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:00.397568 0.801122 udp 10.0.2.105 7010 <-> 86.181.224.228 7785 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.199089 0.243463 udp 10.0.2.105 7010 <-> 115.242.18.252 5573 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.442914 0.171471 udp 10.0.2.105 7010 <-> 1.23.251.177 6353 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.614759 0.050927 udp 10.0.2.105 7010 <-> 86.176.88.244 1878 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.666096 0.148817 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.815304 0.103238 udp 10.0.2.105 7010 <-> 217.203.236.239 7449 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.918932 0.045857 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:01.965209 0.052694 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.018282 0.097675 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.116528 0.317205 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.434136 0.079310 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.513831 0.041285 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.555477 0.063187 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:02.619049 0.413590 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.033073 0.083265 udp 10.0.2.105 7010 <-> 41.141.35.57 5386 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.116731 0.098738 udp 10.0.2.105 7010 <-> 84.94.121.189 4228 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.215916 0.185492 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.401744 0.176502 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.578642 0.074243 udp 10.0.2.105 7010 <-> 78.82.98.69 5961 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.653301 0.111974 udp 10.0.2.105 7010 <-> 95.9.146.51 7616 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:03.765705 0.824036 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:04.590141 0.290227 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:04.880716 0.214809 udp 10.0.2.105 7010 <-> 41.41.72.150 9367 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/11 04:59:05.095985 0.045449 udp 10.0.2.105 7010 <-> 86.162.97.93 5460 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:00:11.413584 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:00:11.413694 3.003485 tcp 10.0.2.105 59693 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:20.426123 0.000000 tcp 10.0.2.105 59693 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:26.415545 0.065143 tcp 10.0.2.105 59694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:26.481003 0.068039 tcp 10.0.2.105 59695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:26.549352 0.158768 tcp 10.0.2.105 59696 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:26.744164 2.995114 tcp 10.0.2.105 59697 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:35.738087 0.000000 tcp 10.0.2.105 59697 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:41.737418 0.067068 tcp 10.0.2.105 59698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:41.804794 0.067552 tcp 10.0.2.105 59699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:41.872628 0.166033 tcp 10.0.2.105 59700 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:42.050592 3.000153 tcp 10.0.2.105 59701 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:51.049963 0.000000 tcp 10.0.2.105 59701 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:00:57.049296 0.064482 tcp 10.0.2.105 59702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:57.114087 0.063872 tcp 10.0.2.105 59703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:57.178251 0.165817 tcp 10.0.2.105 59704 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:00:57.353984 2.999378 tcp 10.0.2.105 59705 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:06.352083 0.000000 tcp 10.0.2.105 59705 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:12.351113 0.066420 tcp 10.0.2.105 59706 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:01:12.417835 0.068915 tcp 10.0.2.105 59707 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:01:12.487035 0.171497 tcp 10.0.2.105 59708 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:01:12.667973 3.007231 tcp 10.0.2.105 59709 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:21.673728 0.000000 tcp 10.0.2.105 59709 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:27.662621 3.004323 tcp 10.0.2.105 59710 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:36.665420 0.000000 tcp 10.0.2.105 59710 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:41.442312 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:01:42.664160 2.994121 tcp 10.0.2.105 59711 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:49.207541 3.000224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:01:51.666915 0.000000 tcp 10.0.2.105 59711 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:01:56.213694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:01:57.666055 2.993746 tcp 10.0.2.105 59712 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:02:04.215156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:02:05.437172 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:02:06.658797 0.000000 tcp 10.0.2.105 59712 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:02:20.217829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:02:52.223788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:07:12.669099 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:07:12.669212 3.003530 tcp 10.0.2.105 59713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:21.671558 0.000000 tcp 10.0.2.105 59713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:27.674431 0.065707 tcp 10.0.2.105 59714 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:27.740471 0.069173 tcp 10.0.2.105 59715 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:27.809937 0.167434 tcp 10.0.2.105 59716 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:28.139641 3.005386 tcp 10.0.2.105 59717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:37.143121 0.000000 tcp 10.0.2.105 59717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:43.133019 0.063105 tcp 10.0.2.105 59718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:43.196448 0.066041 tcp 10.0.2.105 59719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:43.262831 0.159328 tcp 10.0.2.105 59720 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:43.665624 3.001891 tcp 10.0.2.105 59721 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:52.676731 0.000000 tcp 10.0.2.105 59721 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:07:58.667559 0.067163 tcp 10.0.2.105 59722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:58.735068 0.066862 tcp 10.0.2.105 59723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:58.802236 0.193849 tcp 10.0.2.105 59724 -> 195.113.214.249 443 SRPA* 0 0 41 21452 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:07:59.309519 3.000293 tcp 10.0.2.105 59725 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:08.615584 0.000000 tcp 10.0.2.105 59725 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:14.555341 0.065900 tcp 10.0.2.105 59726 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:08:14.621628 0.062792 tcp 10.0.2.105 59727 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:08:14.684690 0.251262 tcp 10.0.2.105 59728 -> 195.113.214.249 443 SRPA* 0 0 71 78316 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:08:15.019462 2.966482 tcp 10.0.2.105 59729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:23.927613 0.000000 tcp 10.0.2.105 59729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:29.873016 2.971339 tcp 10.0.2.105 59730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:38.785358 0.000000 tcp 10.0.2.105 59730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:43.439125 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:08:44.771130 3.003893 tcp 10.0.2.105 59731 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:53.773945 0.000000 tcp 10.0.2.105 59731 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:08:56.230419 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:08:59.772854 3.003961 tcp 10.0.2.105 59732 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:09:03.237514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:09:07.443533 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:09:08.775265 0.000000 tcp 10.0.2.105 59732 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:09:11.238817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:09:27.241892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:09:59.248489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:14:14.776125 0.000250 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:14:14.776475 2.993188 tcp 10.0.2.105 59733 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:14:23.769115 0.000000 tcp 10.0.2.105 59733 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:14:29.778432 0.065536 tcp 10.0.2.105 59734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:14:29.844241 0.064792 tcp 10.0.2.105 59735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:14:29.909334 0.159425 tcp 10.0.2.105 59736 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:14:30.276090 2.995960 tcp 10.0.2.105 59737 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:14:39.270465 0.000000 tcp 10.0.2.105 59737 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:16:03.254466 3.001067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 05:16:10.261570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:16:18.262801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:16:34.266004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:17:06.272020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:19:45.270891 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:19:45.271043 3.003988 tcp 10.0.2.105 59738 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:19:54.273380 0.000000 tcp 10.0.2.105 59738 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:20:00.273793 0.065002 tcp 10.0.2.105 59739 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:20:00.339156 0.067648 tcp 10.0.2.105 59740 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:20:00.407163 0.157498 tcp 10.0.2.105 59741 -> 195.113.214.249 443 SRPA* 0 0 41 23260 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:20:00.793634 3.003670 tcp 10.0.2.105 59742 -> 176.73.126.145 3888 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:20:09.805801 0.000000 tcp 10.0.2.105 59742 -> 176.73.126.145 3888 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:23:10.279011 3.000631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 05:23:17.285506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:23:25.287162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:23:41.290039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:24:13.295661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:29:28.289695 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:29:28.289965 0.000000 udp 10.0.2.105 7010 -> 14.96.157.142 6114 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:29:47.257515 0.099084 tcp 10.0.2.105 59743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:29:47.356906 0.069836 tcp 10.0.2.105 59744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:29:47.427093 0.165855 tcp 10.0.2.105 59745 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:29:47.593789 0.173497 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:47.759231 0.072854 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:48.404567 0.178949 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:48.580986 0.215827 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:48.826969 0.061955 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:48.887333 0.353199 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:49.194417 0.439001 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:49.611863 0.106673 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:49.699561 0.174605 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:50.538912 0.257459 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:50.760326 0.069674 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:51.753282 0.171243 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:51.898764 0.127560 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:52.421389 0.197164 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:52.659454 0.049580 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:52.974051 0.064255 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:53.022003 0.047226 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:53.224880 0.167778 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:53.370091 0.173843 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 1953 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:53.518008 0.115800 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:53.851919 0.055896 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:54.053055 0.091120 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:54.118742 0.078330 udp 10.0.2.105 7010 <-> 86.143.30.116 7670 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:54.266741 0.058207 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:54.408964 0.068480 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:29:54.463182 0.000000 udp 10.0.2.105 7010 -> 86.181.224.228 7785 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:30:00.826154 2.993420 tcp 10.0.2.105 59746 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:09.818746 0.000000 tcp 10.0.2.105 59746 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:10.720708 0.066983 tcp 10.0.2.105 59747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:10.788001 0.070967 tcp 10.0.2.105 59748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:10.859255 0.156530 tcp 10.0.2.105 59749 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:11.016479 0.374853 udp 10.0.2.105 7010 <-> 115.242.18.252 5573 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:11.257423 0.000000 udp 10.0.2.105 7010 -> 1.23.251.177 6353 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:30:15.829072 0.067254 tcp 10.0.2.105 59750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:15.896625 0.067750 tcp 10.0.2.105 59751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:15.964732 0.220863 tcp 10.0.2.105 59752 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:16.286846 2.995443 tcp 10.0.2.105 59753 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:17.302503 3.001224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:30:24.309358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:30:25.280364 0.000000 tcp 10.0.2.105 59753 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:28.385886 0.077235 tcp 10.0.2.105 59754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:28.463477 0.071600 tcp 10.0.2.105 59755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:28.535380 0.155014 tcp 10.0.2.105 59756 -> 195.113.214.249 443 SRPA* 0 0 25 13250 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:28.690887 0.074954 udp 10.0.2.105 7010 <-> 86.176.88.244 1878 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:28.748112 0.155700 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:29.552975 0.177991 udp 10.0.2.105 7010 <-> 217.203.236.239 7449 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:29.899266 0.065346 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:29.948239 0.072381 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.114737 0.143016 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.217873 0.156207 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.356437 0.082917 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.602134 0.047995 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.831865 0.081931 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:30.894037 0.473501 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:30:31.280088 0.091301 tcp 10.0.2.105 59757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:31.370362 0.000000 udp 10.0.2.105 7010 -> 41.141.35.57 5386 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:30:31.371739 0.066603 tcp 10.0.2.105 59758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:31.438653 0.154949 tcp 10.0.2.105 59759 -> 195.113.214.249 443 SRPA* 0 0 52 30936 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:31.809542 3.004722 tcp 10.0.2.105 59760 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:32.311030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:30:40.813166 0.000000 tcp 10.0.2.105 59760 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:46.802456 0.063315 tcp 10.0.2.105 59761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:46.866091 0.068041 tcp 10.0.2.105 59762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:46.934446 0.160034 tcp 10.0.2.105 59763 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:47.149357 3.006948 tcp 10.0.2.105 59764 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:30:47.273123 0.064726 tcp 10.0.2.105 59765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:47.338154 0.065122 tcp 10.0.2.105 59766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:47.403575 0.158018 tcp 10.0.2.105 59767 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:30:47.562514 0.000000 udp 10.0.2.105 7010 -> 84.94.121.189 4228 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:30:48.313915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:30:56.154907 0.000000 tcp 10.0.2.105 59764 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:31:02.143947 2.994340 tcp 10.0.2.105 59768 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:31:03.836732 0.073639 tcp 10.0.2.105 59769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:03.910662 0.064249 tcp 10.0.2.105 59770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:03.975222 0.167214 tcp 10.0.2.105 59771 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:04.143049 0.197625 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:04.333447 0.185142 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:04.736802 0.086551 udp 10.0.2.105 7010 <-> 78.82.98.69 5961 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:04.806819 0.000000 udp 10.0.2.105 7010 -> 95.9.146.51 7616 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 05:31:11.146757 0.000000 tcp 10.0.2.105 59768 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:31:17.149135 2.990564 tcp 10.0.2.105 59772 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:31:20.319769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:31:23.194587 0.064439 tcp 10.0.2.105 59773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:23.259367 0.068125 tcp 10.0.2.105 59774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:23.327781 0.159931 tcp 10.0.2.105 59775 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:31:23.488493 0.272685 udp 10.0.2.105 7010 <-> 41.41.72.150 9367 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:23.725065 0.065193 udp 10.0.2.105 7010 <-> 86.162.97.93 5460 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:23.992093 0.106057 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:24.065328 0.298405 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/11 05:31:26.138476 0.000000 tcp 10.0.2.105 59772 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:36:32.148576 0.131007 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:36:32.279706 2.967515 tcp 10.0.2.105 59776 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:36:41.194089 0.000000 tcp 10.0.2.105 59776 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:36:47.161646 0.065503 tcp 10.0.2.105 59777 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:36:47.227403 0.068444 tcp 10.0.2.105 59778 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:36:47.296118 0.164738 tcp 10.0.2.105 59779 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:36:47.761056 3.005856 tcp 10.0.2.105 59780 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:36:56.763658 0.000000 tcp 10.0.2.105 59780 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:02.763298 0.063552 tcp 10.0.2.105 59781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:02.827161 0.066265 tcp 10.0.2.105 59782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:02.893690 0.217677 tcp 10.0.2.105 59783 -> 195.113.214.249 443 SRPA* 0 0 74 77058 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:03.216680 3.212384 tcp 10.0.2.105 59784 -> 46.48.223.67 15494 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:06.059037 0.067606 tcp 10.0.2.105 59785 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:06.126993 0.067994 tcp 10.0.2.105 59786 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:06.195310 0.165436 tcp 10.0.2.105 59787 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:06.429243 3.002592 tcp 10.0.2.105 59788 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:15.430892 0.000000 tcp 10.0.2.105 59788 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:21.434237 0.066023 tcp 10.0.2.105 59789 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:21.500590 0.065701 tcp 10.0.2.105 59790 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:21.566571 0.163935 tcp 10.0.2.105 59791 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:21.899627 3.004462 tcp 10.0.2.105 59792 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:24.325788 3.001957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:37:30.902552 0.000000 tcp 10.0.2.105 59792 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:31.333370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:37:36.891501 3.005558 tcp 10.0.2.105 59793 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:39.336875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:37:45.894209 0.000000 tcp 10.0.2.105 59793 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:37:50.440378 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:37:51.893101 0.386557 tcp 10.0.2.105 59794 -> 46.48.223.67 15494 SPA_* 0 0 9 1083 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:55.339691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:37:57.375327 0.000380 tcp 10.0.2.105 59794 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:37:57.375955 3.000543 tcp 10.0.2.105 59795 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:38:06.373777 0.000000 tcp 10.0.2.105 59795 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:38:27.343868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:43:12.376357 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:43:12.376505 2.991976 tcp 10.0.2.105 59796 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:43:21.376732 0.000000 tcp 10.0.2.105 59796 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:43:27.377490 0.068976 tcp 10.0.2.105 59797 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:27.446766 0.067000 tcp 10.0.2.105 59798 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:27.514064 0.165234 tcp 10.0.2.105 59799 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:27.770727 3.001010 tcp 10.0.2.105 59800 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:43:36.771488 0.000000 tcp 10.0.2.105 59800 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:43:42.768288 0.063884 tcp 10.0.2.105 59801 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:42.832699 0.065862 tcp 10.0.2.105 59802 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:42.898465 0.154981 tcp 10.0.2.105 59803 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:43.145888 0.432742 tcp 10.0.2.105 59804 -> 46.48.223.67 15494 SPA_* 0 0 9 1171 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:48.953416 0.408059 tcp 10.0.2.105 59804 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:48.954264 0.064754 tcp 10.0.2.105 59805 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:49.019362 0.065373 tcp 10.0.2.105 59806 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:49.085036 0.157930 tcp 10.0.2.105 59807 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:43:49.361764 2.999522 tcp 10.0.2.105 59808 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:43:58.360032 0.000000 tcp 10.0.2.105 59808 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:04.359408 0.062916 tcp 10.0.2.105 59809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:44:04.422601 0.066751 tcp 10.0.2.105 59810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:44:04.489666 0.186720 tcp 10.0.2.105 59811 -> 195.113.214.249 443 SRPA* 0 0 49 34528 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:44:04.710773 3.002589 tcp 10.0.2.105 59812 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:13.712611 0.000000 tcp 10.0.2.105 59812 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:19.711003 3.003653 tcp 10.0.2.105 59813 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:28.713353 0.000000 tcp 10.0.2.105 59813 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:31.646782 2.967727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:44:33.714748 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:44:34.972682 0.478832 tcp 10.0.2.105 59814 -> 46.48.223.67 15494 SPA_* 0 0 9 1171 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:44:38.584589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:44:40.817682 0.000321 tcp 10.0.2.105 59814 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:44:40.818232 2.970509 tcp 10.0.2.105 59815 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:44:46.503829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:44:49.729855 0.000000 tcp 10.0.2.105 59815 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:45:02.361916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:45:34.368058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:49:55.614401 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:49:55.614546 2.993399 tcp 10.0.2.105 59816 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:04.616579 0.000000 tcp 10.0.2.105 59816 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:10.617665 0.079595 tcp 10.0.2.105 59817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:10.697556 0.067672 tcp 10.0.2.105 59818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:10.765559 0.161596 tcp 10.0.2.105 59819 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:11.042016 2.997804 tcp 10.0.2.105 59820 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:20.038553 0.000000 tcp 10.0.2.105 59820 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:26.037910 0.066956 tcp 10.0.2.105 59821 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:26.105180 0.073531 tcp 10.0.2.105 59822 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:26.178995 0.164664 tcp 10.0.2.105 59823 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:26.465594 3.328759 tcp 10.0.2.105 59824 -> 46.48.223.67 15494 FSPA* 0 0 13 1592 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:29.354827 0.070034 tcp 10.0.2.105 59825 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:29.425224 0.065789 tcp 10.0.2.105 59826 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:29.491288 0.158816 tcp 10.0.2.105 59827 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:29.794642 3.002307 tcp 10.0.2.105 59828 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:33.620981 0.000156 tcp 10.0.2.105 59824 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:38.795455 0.000000 tcp 10.0.2.105 59828 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:44.794751 0.081385 tcp 10.0.2.105 59829 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:44.875911 0.068882 tcp 10.0.2.105 59830 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:44.945134 0.163067 tcp 10.0.2.105 59831 -> 195.113.214.249 443 SRPA* 0 0 42 21258 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:50:45.192790 2.996434 tcp 10.0.2.105 59832 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:50:54.188909 0.000000 tcp 10.0.2.105 59832 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:51:00.188082 2.992696 tcp 10.0.2.105 59833 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:51:09.182463 0.000000 tcp 10.0.2.105 59833 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:51:13.936035 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:51:15.188055 0.388389 tcp 10.0.2.105 59834 -> 46.48.223.67 15494 SPA_* 0 0 9 1116 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:51:20.337209 0.000384 tcp 10.0.2.105 59834 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:51:20.337855 3.001806 tcp 10.0.2.105 59835 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:51:29.338169 0.000000 tcp 10.0.2.105 59835 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:54:48.377681 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 05:54:55.384515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:55:03.385994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:55:19.389197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:55:51.395048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 05:56:35.338713 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:56:35.338818 3.003929 tcp 10.0.2.105 59836 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:56:44.341309 0.000000 tcp 10.0.2.105 59836 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:56:50.341891 0.065616 tcp 10.0.2.105 59837 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:56:50.407798 0.069281 tcp 10.0.2.105 59838 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:56:50.477391 0.156782 tcp 10.0.2.105 59839 -> 195.113.214.249 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:56:50.651690 3.002716 tcp 10.0.2.105 59840 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:56:59.653317 0.000000 tcp 10.0.2.105 59840 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:57:05.652431 0.067717 tcp 10.0.2.105 59841 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:05.720438 0.065835 tcp 10.0.2.105 59842 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:05.786537 0.182728 tcp 10.0.2.105 59843 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:06.156046 0.386263 tcp 10.0.2.105 59844 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:11.778391 0.478473 tcp 10.0.2.105 59844 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:11.779177 0.069359 tcp 10.0.2.105 59845 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:11.848883 0.064524 tcp 10.0.2.105 59846 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:11.913696 0.157821 tcp 10.0.2.105 59847 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:12.257070 3.008714 tcp 10.0.2.105 59848 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:57:21.264331 0.000000 tcp 10.0.2.105 59848 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:57:27.253055 3.004236 tcp 10.0.2.105 59849 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:57:36.265711 0.000000 tcp 10.0.2.105 59849 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 05:57:40.942518 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 05:57:42.254356 0.388945 tcp 10.0.2.105 59850 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/11 05:57:47.596601 0.000424 tcp 10.0.2.105 59850 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:01:41.539184 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:01:41.539381 0.000000 udp 10.0.2.105 7010 -> 1.23.251.177 6353 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:01:55.401841 3.000936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:01:56.782067 0.067833 tcp 10.0.2.105 59851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:01:56.850182 0.062548 tcp 10.0.2.105 59852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:01:56.913036 0.158527 tcp 10.0.2.105 59853 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:01:57.072120 0.000000 udp 10.0.2.105 7010 -> 86.181.224.228 7785 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:02:02.408863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:02:10.410003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:02:14.907692 0.068286 tcp 10.0.2.105 59854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:14.976328 0.064593 tcp 10.0.2.105 59855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:15.041224 0.154684 tcp 10.0.2.105 59856 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:15.195262 0.000000 udp 10.0.2.105 7010 -> 41.141.35.57 5386 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:02:26.413258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:02:31.261682 0.064419 tcp 10.0.2.105 59857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:31.326392 0.066128 tcp 10.0.2.105 59858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:31.392805 0.171175 tcp 10.0.2.105 59859 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:31.564700 0.000000 udp 10.0.2.105 7010 -> 84.94.121.189 4228 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:02:48.895760 0.063028 tcp 10.0.2.105 59860 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:48.959069 0.064657 tcp 10.0.2.105 59861 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:49.024025 0.156985 tcp 10.0.2.105 59862 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:02:49.181204 0.000000 udp 10.0.2.105 7010 -> 95.9.146.51 7616 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:02:58.419333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:03:05.049837 0.064238 tcp 10.0.2.105 59863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:05.114330 0.065371 tcp 10.0.2.105 59864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:05.180009 0.156997 tcp 10.0.2.105 59865 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:05.337686 0.175932 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:05.505749 0.220847 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:05.718910 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:03:17.597436 2.993330 tcp 10.0.2.105 59866 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:03:22.343988 0.068471 tcp 10.0.2.105 59867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:22.412757 0.065143 tcp 10.0.2.105 59868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:22.478277 0.163334 tcp 10.0.2.105 59869 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:22.642101 0.076938 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:22.699552 0.058461 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:22.757565 0.147380 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:22.860074 0.093537 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:22.936446 0.445983 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:23.357907 0.173849 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:23.527894 0.254623 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:23.744214 0.082074 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:23.819012 0.127416 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:24.043490 0.170721 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:24.231894 0.069227 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:24.284499 0.169423 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:24.430969 0.048065 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:24.538951 1.710831 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 4 1281 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.242358 0.055333 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.243660 2.889609 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 SPA_* 0 0 9 2156 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:26.361571 0.177522 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.511471 0.076309 udp 10.0.2.105 7010 <-> 86.143.30.116 7670 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.571606 0.092944 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.589360 0.000000 tcp 10.0.2.105 59866 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:03:26.640719 0.056897 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2582 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.707960 0.103228 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.824818 0.057717 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 1978 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.896112 0.053574 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:26.931229 0.672228 udp 10.0.2.105 7010 <-> 115.242.18.252 5573 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:27.490207 0.075196 udp 10.0.2.105 7010 <-> 86.176.88.244 1878 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:27.546686 0.141708 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:27.687187 0.373766 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:28.043249 0.073230 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:28.127953 0.064449 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:28.176641 0.000000 udp 10.0.2.105 7010 -> 217.203.236.239 7449 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:03:31.390684 0.206480 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 5 3166 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:32.598711 0.069470 tcp 10.0.2.105 59871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:32.668095 0.063805 tcp 10.0.2.105 59872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:32.732194 0.194887 tcp 10.0.2.105 59873 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:33.009388 3.003799 tcp 10.0.2.105 59874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:03:36.681785 1.802919 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 17 10310 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:42.011753 0.000000 tcp 10.0.2.105 59874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:03:42.013312 3.904004 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 14 10996 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:46.078417 0.063922 tcp 10.0.2.105 59875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:46.142621 0.064950 tcp 10.0.2.105 59876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:46.208489 0.160506 tcp 10.0.2.105 59877 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:46.369476 0.160851 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:46.585545 0.094430 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:46.658795 0.044131 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:46.748387 0.081219 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:46.819175 0.527582 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:47.369036 0.196609 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:47.558908 0.179899 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:47.760860 0.083221 udp 10.0.2.105 7010 <-> 78.82.98.69 5961 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:47.826850 0.106859 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:47.936883 0.283981 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:48.212035 0.213762 udp 10.0.2.105 7010 <-> 41.41.72.150 9367 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:48.390704 0.064359 udp 10.0.2.105 7010 <-> 86.162.97.93 5460 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:03:51.071248 1.718838 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 10 6084 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:03:57.485328 3.320628 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 22 14076 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:04.156100 2.000490 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 13 9494 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:09.444806 1.770609 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 17 12606 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:10.943244 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:04:14.695691 1.650477 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 7176 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:19.900399 3.751385 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:26.801939 4.049774 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 11 6738 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:32.189570 4.050272 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:39.329807 0.404896 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:40.936875 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:04:46.791572 4.028915 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:53.959216 3.890885 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 12 7992 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:04:59.029155 2.066427 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 13 7942 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:05.441529 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:05:08.030721 0.405214 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 4 1664 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:22.468181 3.967399 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:30.938112 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:05:31.514319 3.850464 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 11 6594 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:36.619573 3.972529 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:41.859633 4.040145 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 10 6907 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:49.099848 4.180754 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:54.519642 4.238662 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 10 7780 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:05:57.937300 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:06:00.024262 0.000164 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:07.528506 1.735030 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 7 3859 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:12.859330 3.945242 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:31.387782 0.207801 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 5 3429 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:36.442549 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:06:46.578437 4.064645 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 8 3417 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:53.853942 1.668407 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 10 6243 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:06:59.132634 3.707918 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:00.437195 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:07:05.638690 4.958938 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 14 10913 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:10.802134 4.971293 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 12 6820 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:15.965352 3.940438 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 5 1718 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:21.205616 3.916664 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:24.441784 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:07:26.398978 0.000176 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:07:55.827972 3.232665 tcp 10.0.2.105 59870 -> 24.234.227.235 6773 FA_F* 0 0 16 7112 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:08:48.012716 3.003386 tcp 10.0.2.105 59878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:08:52.938176 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:08:57.014538 0.000000 tcp 10.0.2.105 59878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:02.425925 3.001013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:09:03.015590 0.065878 tcp 10.0.2.105 59879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:03.081761 0.072469 tcp 10.0.2.105 59880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:03.154555 0.156000 tcp 10.0.2.105 59881 -> 195.113.214.249 443 SRPA* 0 0 43 23954 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:03.393766 2.994321 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:09.432713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:09:12.404720 0.000000 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:17.434079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:09:18.395664 0.063847 tcp 10.0.2.105 59883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:18.459851 0.064855 tcp 10.0.2.105 59884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:18.524964 0.201081 tcp 10.0.2.105 59885 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:18.987916 2.619824 tcp 10.0.2.105 59886 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:21.046516 0.065530 tcp 10.0.2.105 59887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:21.112490 0.063466 tcp 10.0.2.105 59888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:21.176232 0.161436 tcp 10.0.2.105 59889 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:21.608022 2.976041 tcp 10.0.2.105 59890 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:30.532457 0.000000 tcp 10.0.2.105 59890 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:33.475946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:09:36.492070 0.070294 tcp 10.0.2.105 59891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:36.562643 0.066404 tcp 10.0.2.105 59892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:36.629400 0.162146 tcp 10.0.2.105 59893 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:09:37.157843 2.988773 tcp 10.0.2.105 59894 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:46.152530 0.000000 tcp 10.0.2.105 59894 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:09:52.144014 2.994258 tcp 10.0.2.105 59895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:10:01.146921 0.000000 tcp 10.0.2.105 59895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:10:05.442950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:10:05.943523 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:10:07.145628 1.877931 tcp 10.0.2.105 59896 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:10:09.022553 3.000878 tcp 10.0.2.105 59897 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:10:18.021245 0.000000 tcp 10.0.2.105 59897 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:15:24.021538 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:15:24.021745 3.003708 tcp 10.0.2.105 59898 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:15:33.023894 0.000000 tcp 10.0.2.105 59898 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:15:39.024643 0.063401 tcp 10.0.2.105 59899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:39.088462 0.072053 tcp 10.0.2.105 59900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:39.160821 0.155260 tcp 10.0.2.105 59901 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:39.370627 3.007005 tcp 10.0.2.105 59902 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:15:48.386243 0.000000 tcp 10.0.2.105 59902 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:15:54.366098 0.067300 tcp 10.0.2.105 59903 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:54.433707 0.065147 tcp 10.0.2.105 59904 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:54.499169 0.170411 tcp 10.0.2.105 59905 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:15:55.162186 0.387747 tcp 10.0.2.105 59906 -> 46.48.223.67 15494 SPA_* 0 0 9 1196 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:07.743173 0.430921 tcp 10.0.2.105 59906 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:07.744010 0.069379 tcp 10.0.2.105 59907 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:07.813703 0.070201 tcp 10.0.2.105 59908 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:07.884223 0.162417 tcp 10.0.2.105 59909 -> 195.113.214.249 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:08.174232 2.994725 tcp 10.0.2.105 59910 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:09.448988 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:16:16.456398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:16:17.167442 0.000000 tcp 10.0.2.105 59910 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:23.176813 0.065194 tcp 10.0.2.105 59911 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:23.242297 0.065314 tcp 10.0.2.105 59912 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:23.307938 0.166723 tcp 10.0.2.105 59913 -> 195.113.214.249 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:24.028968 3.002575 tcp 10.0.2.105 59914 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:24.457973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:16:33.030647 0.000000 tcp 10.0.2.105 59914 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:39.029292 3.003982 tcp 10.0.2.105 59915 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:40.460761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:16:46.941858 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:16:48.031696 0.000000 tcp 10.0.2.105 59915 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:16:54.030384 1.861795 tcp 10.0.2.105 59916 -> 46.48.223.67 15494 FSPA* 0 0 12 1618 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:16:55.892464 2.995003 tcp 10.0.2.105 59917 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:17:04.348576 0.000166 tcp 10.0.2.105 59916 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:17:04.895801 0.000000 tcp 10.0.2.105 59917 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:17:12.470566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:22:10.886738 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:22:10.886907 2.998221 tcp 10.0.2.105 59918 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:22:19.879857 0.000000 tcp 10.0.2.105 59918 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:22:25.889240 0.067705 tcp 10.0.2.105 59919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:25.957236 0.065790 tcp 10.0.2.105 59920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:26.023400 0.168422 tcp 10.0.2.105 59921 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:26.295914 2.996846 tcp 10.0.2.105 59922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:22:35.291111 0.000000 tcp 10.0.2.105 59922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:22:41.293286 0.064213 tcp 10.0.2.105 59923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:41.357790 0.089299 tcp 10.0.2.105 59924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:41.447407 0.161964 tcp 10.0.2.105 59925 -> 195.113.214.249 443 SRPA* 0 0 40 33272 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:41.799497 1.141754 tcp 10.0.2.105 59926 -> 46.48.223.67 15494 SPA_* 0 0 9 1152 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:54.704584 0.448372 tcp 10.0.2.105 59926 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:54.705385 0.070909 tcp 10.0.2.105 59927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:54.776626 0.066500 tcp 10.0.2.105 59928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:54.843495 0.161364 tcp 10.0.2.105 59929 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:22:55.153204 3.000778 tcp 10.0.2.105 59930 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:04.152579 0.000000 tcp 10.0.2.105 59930 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:10.976315 0.066141 tcp 10.0.2.105 59931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:23:11.042823 0.064412 tcp 10.0.2.105 59932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:23:11.107523 0.163549 tcp 10.0.2.105 59933 -> 195.113.214.249 443 SRPA* 0 0 42 22726 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:23:11.605051 2.965310 tcp 10.0.2.105 59934 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:17.222554 2.965899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:23:20.492686 0.000000 tcp 10.0.2.105 59934 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:24.143507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:23:26.417262 2.956232 tcp 10.0.2.105 59935 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:32.040543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:23:35.305647 0.000000 tcp 10.0.2.105 59935 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:39.909073 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:23:41.235539 4.770846 tcp 10.0.2.105 59936 -> 46.48.223.67 15494 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:23:46.006113 2.976461 tcp 10.0.2.105 59937 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:23:47.864004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:23:54.913700 0.000000 tcp 10.0.2.105 59937 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:24:19.490870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:29:00.616534 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:29:00.616644 2.992810 tcp 10.0.2.105 59938 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:09.608209 0.000000 tcp 10.0.2.105 59938 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:15.619803 0.065659 tcp 10.0.2.105 59939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:15.685768 0.066041 tcp 10.0.2.105 59940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:15.751673 0.166142 tcp 10.0.2.105 59941 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:16.399185 3.003420 tcp 10.0.2.105 59942 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:25.401535 0.000000 tcp 10.0.2.105 59942 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:31.400042 0.066722 tcp 10.0.2.105 59943 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:31.467136 0.069511 tcp 10.0.2.105 59944 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:31.536858 0.160748 tcp 10.0.2.105 59945 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:31.899558 2.705453 tcp 10.0.2.105 59946 -> 46.48.223.67 15494 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:33.790976 0.066093 tcp 10.0.2.105 59947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:33.857355 0.081612 tcp 10.0.2.105 59948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:33.939265 0.172680 tcp 10.0.2.105 59949 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:34.605392 2.964905 tcp 10.0.2.105 59950 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:43.522319 0.000000 tcp 10.0.2.105 59950 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:49.463923 0.064178 tcp 10.0.2.105 59951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:49.528476 0.068083 tcp 10.0.2.105 59952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:49.596927 0.156116 tcp 10.0.2.105 59953 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:29:49.899478 2.964937 tcp 10.0.2.105 59954 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:29:58.805686 0.000000 tcp 10.0.2.105 59954 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:30:04.748543 2.972054 tcp 10.0.2.105 59955 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:30:13.700192 0.000000 tcp 10.0.2.105 59955 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:30:18.437065 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:30:19.698959 0.388198 tcp 10.0.2.105 59956 -> 46.48.223.67 15494 SPA_* 0 0 9 1131 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:30:23.496937 3.006320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:30:30.504260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:30:38.505827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:30:49.071887 0.000541 tcp 10.0.2.105 59956 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:30:49.072692 3.002704 tcp 10.0.2.105 59957 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:30:54.508921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:30:58.073844 0.000000 tcp 10.0.2.105 59957 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:31:26.523771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:34:09.289731 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:34:09.289837 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:34:25.144076 0.064823 tcp 10.0.2.105 59958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:25.209180 0.066708 tcp 10.0.2.105 59959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:25.276369 0.157631 tcp 10.0.2.105 59960 -> 195.113.214.249 443 SRPA* 0 0 21 12200 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:25.434533 0.000000 udp 10.0.2.105 7010 -> 217.203.236.239 7449 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:34:42.156544 0.064053 tcp 10.0.2.105 59961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:42.220888 0.065439 tcp 10.0.2.105 59962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:42.286591 0.172256 tcp 10.0.2.105 59963 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:42.459436 0.175488 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:42.626591 0.219876 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:42.839515 0.119895 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:42.959819 0.099826 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:42.960148 4.699155 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 SPA_* 0 0 11 2822 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:43.042073 0.396854 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:43.420069 0.064753 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:43.536986 0.295308 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:43.796760 0.080395 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:43.894966 0.127881 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:44.073010 0.312061 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:44.394406 0.435472 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:44.805781 0.172004 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:45.035757 0.047475 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:45.066676 0.168250 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:45.213691 0.068108 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:45.266999 0.172433 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:45.411070 1.700077 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 3 789 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:47.329137 0.095485 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:47.399708 0.057406 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:47.611781 0.115750 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:47.836592 0.059231 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:34:47.968010 0.000000 udp 10.0.2.105 7010 -> 86.143.30.116 7670 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:34:48.490435 4.754805 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 46 33700 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:53.583678 4.996460 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 47 36858 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:34:58.615670 2.047292 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 15 9250 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:03.725929 3.406178 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 25 17486 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:05.890697 0.066844 tcp 10.0.2.105 59965 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:05.957938 0.068876 tcp 10.0.2.105 59966 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:06.027115 0.156642 tcp 10.0.2.105 59967 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:06.184465 0.048404 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:06.400455 0.144584 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:06.503454 0.054675 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:06.688721 0.000000 udp 10.0.2.105 7010 -> 115.242.18.252 5573 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:35:10.089902 4.845509 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 17 12006 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:15.169996 0.003446 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 3 2106 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:21.259515 3.998571 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 20 11216 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:24.881715 0.067017 tcp 10.0.2.105 59968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:24.949015 0.087965 tcp 10.0.2.105 59969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:25.037295 0.168844 tcp 10.0.2.105 59970 -> 195.113.214.249 443 SRPA* 0 0 44 36124 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:25.206657 0.000000 udp 10.0.2.105 7010 -> 86.176.88.244 1878 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:35:26.837206 4.641615 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 48 36064 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:32.391738 4.877242 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 65 51318 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:37.677642 2.072878 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 26 18636 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:42.923434 4.226087 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:43.355042 0.064089 tcp 10.0.2.105 59971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:43.419425 0.066765 tcp 10.0.2.105 59972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:43.486451 0.257931 tcp 10.0.2.105 59973 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:43.744977 0.073690 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:43.802679 0.101360 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:43.886637 0.069510 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:43.939509 0.895870 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:44.715547 0.086877 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:44.782241 0.042690 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:44.934219 0.082509 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.007312 0.177044 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.224088 0.085886 udp 10.0.2.105 7010 <-> 78.82.98.69 5961 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.291738 0.107837 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.380375 0.057137 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.520931 0.198293 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.711401 0.066890 udp 10.0.2.105 7010 <-> 86.162.97.93 5460 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:45.791999 0.296400 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/11 06:35:46.078790 0.000000 udp 10.0.2.105 7010 -> 41.41.72.150 9367 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 06:35:49.547335 1.138353 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 23 15290 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:35:55.648851 3.864854 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 A_PA 0 0 26 17228 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:03.684067 0.065801 tcp 10.0.2.105 59974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:03.750142 0.065724 tcp 10.0.2.105 59975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:03.816171 0.161177 tcp 10.0.2.105 59976 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:04.074327 2.994154 tcp 10.0.2.105 59977 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:13.076902 0.000000 tcp 10.0.2.105 59977 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:19.076068 0.063979 tcp 10.0.2.105 59978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:19.140338 0.069474 tcp 10.0.2.105 59979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:19.210091 0.232238 tcp 10.0.2.105 59980 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:19.487363 3.002838 tcp 10.0.2.105 59981 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:28.491139 0.000000 tcp 10.0.2.105 59981 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:29.511283 0.000112 tcp 10.0.2.105 59964 -> 88.34.50.180 8461 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:34.488470 0.064038 tcp 10.0.2.105 59982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:34.552875 0.065005 tcp 10.0.2.105 59983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:34.618212 0.161131 tcp 10.0.2.105 59984 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:34.874163 2.226476 tcp 10.0.2.105 59985 -> 46.48.223.67 15494 FSPA* 0 0 14 1770 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:36.779904 0.067210 tcp 10.0.2.105 59986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:36.847417 0.071030 tcp 10.0.2.105 59987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:36.918716 0.157970 tcp 10.0.2.105 59988 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:37.100872 3.004876 tcp 10.0.2.105 59989 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:46.104445 0.000000 tcp 10.0.2.105 59989 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:36:52.093722 0.066749 tcp 10.0.2.105 59990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:52.160792 0.068260 tcp 10.0.2.105 59991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:52.229394 0.160382 tcp 10.0.2.105 59992 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:36:52.462630 2.995197 tcp 10.0.2.105 59993 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:01.466684 0.000000 tcp 10.0.2.105 59993 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:07.459472 2.992034 tcp 10.0.2.105 59994 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:16.452564 0.000000 tcp 10.0.2.105 59994 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:21.451050 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:37:22.458520 4.582741 tcp 10.0.2.105 59995 -> 46.48.223.67 15494 FSPA* 0 0 14 1770 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:37:27.040979 2.986487 tcp 10.0.2.105 59996 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:30.520599 3.003538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:37:36.038934 0.000000 tcp 10.0.2.105 59996 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:37:37.533039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:37:45.545622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:38:01.532940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:38:29.512977 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:38:29.513091 0.000000 tcp 10.0.2.105 59964 ?> 88.34.50.180 8461 RA_ 0 1 54 flow=Background 1970/02/11 06:38:33.539042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:42:42.036938 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:42:42.037053 2.993142 tcp 10.0.2.105 59997 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:42:51.029207 0.000000 tcp 10.0.2.105 59997 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:42:57.043207 0.064328 tcp 10.0.2.105 59998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:42:57.107831 0.069841 tcp 10.0.2.105 59999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:42:57.177959 0.166877 tcp 10.0.2.105 60000 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:42:57.435045 2.997717 tcp 10.0.2.105 60001 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:06.431145 0.000000 tcp 10.0.2.105 60001 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:12.430415 0.067153 tcp 10.0.2.105 60002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:12.497863 0.064764 tcp 10.0.2.105 60003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:12.562931 0.162442 tcp 10.0.2.105 60004 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:12.833972 2.267359 tcp 10.0.2.105 60005 -> 46.48.223.67 15494 FSPA* 0 0 14 1558 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:14.723521 0.067800 tcp 10.0.2.105 60006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:14.791584 0.067066 tcp 10.0.2.105 60007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:14.858990 0.162916 tcp 10.0.2.105 60008 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:15.101549 2.996120 tcp 10.0.2.105 60009 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:24.106950 0.000000 tcp 10.0.2.105 60009 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:30.099945 0.064182 tcp 10.0.2.105 60010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:30.164500 0.068954 tcp 10.0.2.105 60011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:30.233772 0.174624 tcp 10.0.2.105 60012 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:43:30.805106 2.995257 tcp 10.0.2.105 60013 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:39.806420 0.000000 tcp 10.0.2.105 60013 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:45.798026 3.004128 tcp 10.0.2.105 60014 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:54.800513 0.000000 tcp 10.0.2.105 60014 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:43:59.437385 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:44:00.799334 0.379679 tcp 10.0.2.105 60015 -> 46.48.223.67 15494 SPA_* 0 0 9 1028 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:44:15.936236 0.000992 tcp 10.0.2.105 60015 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:44:15.936756 2.998706 tcp 10.0.2.105 60016 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:44:24.934109 0.000000 tcp 10.0.2.105 60016 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:44:37.548024 2.998594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:44:44.552244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:44:52.553821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:45:08.557047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:45:40.563033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:49:30.934316 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:49:30.934490 2.994230 tcp 10.0.2.105 60017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:49:39.936496 0.000000 tcp 10.0.2.105 60017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:49:45.937163 0.064750 tcp 10.0.2.105 60018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:49:46.002177 0.064157 tcp 10.0.2.105 60019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:49:46.066635 0.165108 tcp 10.0.2.105 60020 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:49:46.246337 2.994568 tcp 10.0.2.105 60021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:49:55.240766 0.000000 tcp 10.0.2.105 60021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:01.248118 0.071866 tcp 10.0.2.105 60022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:01.320279 0.066969 tcp 10.0.2.105 60023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:01.387638 0.158441 tcp 10.0.2.105 60024 -> 195.113.214.249 443 SRPA* 0 0 44 22756 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:01.578174 4.861855 tcp 10.0.2.105 60025 -> 46.48.223.67 15494 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:06.053751 0.080487 tcp 10.0.2.105 60026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:06.134550 0.067308 tcp 10.0.2.105 60027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:06.202160 0.156995 tcp 10.0.2.105 60028 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:06.440273 2.999172 tcp 10.0.2.105 60029 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:15.438209 0.000000 tcp 10.0.2.105 60029 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:21.437359 0.067493 tcp 10.0.2.105 60030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:21.505133 0.073280 tcp 10.0.2.105 60031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:21.578393 0.156050 tcp 10.0.2.105 60032 -> 195.113.214.249 443 SRPA* 0 0 25 13406 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:21.750790 3.000451 tcp 10.0.2.105 60033 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:30.752129 0.000000 tcp 10.0.2.105 60033 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:36.749739 3.009453 tcp 10.0.2.105 60034 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:45.751671 0.000000 tcp 10.0.2.105 60034 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:50:50.439097 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:50:51.750893 4.432001 tcp 10.0.2.105 60035 -> 46.48.223.67 15494 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:50:56.183080 2.997529 tcp 10.0.2.105 60036 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:51:05.179332 0.000000 tcp 10.0.2.105 60036 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:54:52.569210 3.001743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 06:54:59.576833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:55:07.577976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:55:23.581213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:55:55.587167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 06:56:11.180134 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:56:11.180337 3.003344 tcp 10.0.2.105 60037 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:56:20.182487 0.000000 tcp 10.0.2.105 60037 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:56:26.182794 0.068552 tcp 10.0.2.105 60038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:26.251621 0.075175 tcp 10.0.2.105 60039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:26.327058 0.158369 tcp 10.0.2.105 60040 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:26.495429 3.000743 tcp 10.0.2.105 60041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:56:35.493844 0.000000 tcp 10.0.2.105 60041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:56:41.493489 0.067757 tcp 10.0.2.105 60042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:41.561536 0.070032 tcp 10.0.2.105 60043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:41.631814 0.160280 tcp 10.0.2.105 60044 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:56:41.808057 0.378305 tcp 10.0.2.105 60045 -> 46.48.223.67 15494 SPA_* 0 0 9 1041 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:10.214592 0.311789 tcp 10.0.2.105 60045 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:10.215554 0.067061 tcp 10.0.2.105 60046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:10.282928 0.065709 tcp 10.0.2.105 60047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:10.348956 0.163178 tcp 10.0.2.105 60048 -> 195.113.214.249 443 SRPA* 0 0 40 21398 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:10.526538 2.992652 tcp 10.0.2.105 60049 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:19.517629 0.000000 tcp 10.0.2.105 60049 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:25.526842 0.071128 tcp 10.0.2.105 60050 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:25.598264 0.069092 tcp 10.0.2.105 60051 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:25.667644 0.175280 tcp 10.0.2.105 60052 -> 195.113.214.249 443 SRPA* 0 0 30 13714 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:57:25.852797 2.998187 tcp 10.0.2.105 60053 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:34.849665 0.000000 tcp 10.0.2.105 60053 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:40.848732 3.004017 tcp 10.0.2.105 60054 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:49.851265 0.000000 tcp 10.0.2.105 60054 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:57:54.437710 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 06:57:55.850206 0.383131 tcp 10.0.2.105 60055 -> 46.48.223.67 15494 SPA_* 0 0 9 1041 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:58:02.672834 0.000650 tcp 10.0.2.105 60055 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 06:58:02.673383 3.000349 tcp 10.0.2.105 60056 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 06:58:11.672666 0.000000 tcp 10.0.2.105 60056 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:01:59.594146 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 07:02:06.600617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:02:14.602377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:02:30.612665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:03:02.616489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:06:27.035321 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:06:27.035516 0.000000 udp 10.0.2.105 7010 -> 86.143.30.116 7670 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:06:45.563274 0.064648 tcp 10.0.2.105 60057 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:06:45.628391 0.068112 tcp 10.0.2.105 60058 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:06:45.696778 0.156249 tcp 10.0.2.105 60059 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:06:45.853575 0.000000 udp 10.0.2.105 7010 -> 86.176.88.244 1878 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:07:01.385084 0.064371 tcp 10.0.2.105 60060 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:01.449743 0.065729 tcp 10.0.2.105 60061 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:01.515786 0.167921 tcp 10.0.2.105 60062 -> 195.113.214.249 443 SRPA* 0 0 40 21958 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:01.684662 0.000000 udp 10.0.2.105 7010 -> 115.242.18.252 5573 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:07:19.390872 0.071291 tcp 10.0.2.105 60063 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:19.462478 0.065523 tcp 10.0.2.105 60064 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:19.528547 0.160430 tcp 10.0.2.105 60065 -> 195.113.214.249 443 SRPA* 0 0 46 24516 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:19.689694 0.000000 udp 10.0.2.105 7010 -> 41.41.72.150 9367 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:07:34.803598 0.085282 tcp 10.0.2.105 60066 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:34.889176 0.065351 tcp 10.0.2.105 60067 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:34.954797 0.153078 tcp 10.0.2.105 60068 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:35.108547 0.376620 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 3 941 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:07:35.474369 0.217639 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:07:35.474683 4.842877 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 SPA_* 0 0 56 37809 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:35.684651 0.102449 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:07:35.985987 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:07:40.791966 2.686950 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 A_PA 0 0 19 11618 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:47.701415 3.003982 tcp 10.0.2.105 60070 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:07:50.449903 4.872041 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 A_PA 0 0 37 27774 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:53.620647 0.064710 tcp 10.0.2.105 60071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:53.685638 0.071141 tcp 10.0.2.105 60072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:53.757129 0.161089 tcp 10.0.2.105 60073 -> 195.113.214.249 443 SRPA* 0 0 25 14790 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:07:53.918752 0.081428 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:07:53.990465 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:07:56.703820 0.000000 tcp 10.0.2.105 60070 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:01.174778 1.601167 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 A_PA 0 0 14 10396 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:02.703124 0.063398 tcp 10.0.2.105 60074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:02.766763 0.067805 tcp 10.0.2.105 60075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:02.834486 0.169243 tcp 10.0.2.105 60076 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:03.183255 2.995507 tcp 10.0.2.105 60077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:10.955647 0.089697 tcp 10.0.2.105 60078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:11.045695 0.069274 tcp 10.0.2.105 60079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:11.115261 0.151877 tcp 10.0.2.105 60080 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:11.267659 0.059404 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:11.714125 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:08:12.185852 0.000000 tcp 10.0.2.105 60077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:13.430886 4.837503 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 A_PA 0 0 47 32633 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:18.185845 0.063567 tcp 10.0.2.105 60081 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:18.249734 0.065433 tcp 10.0.2.105 60082 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:18.315573 0.156921 tcp 10.0.2.105 60083 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:18.475529 4.784888 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 A_PA 0 0 37 29247 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:18.569122 3.000690 tcp 10.0.2.105 60084 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:27.568861 0.000000 tcp 10.0.2.105 60084 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:30.252914 0.064364 tcp 10.0.2.105 60085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:30.317594 0.067243 tcp 10.0.2.105 60086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:30.385118 0.163580 tcp 10.0.2.105 60087 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:30.549523 0.170573 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:30.716492 0.127942 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:30.963010 0.174157 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:31.113486 0.046929 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:31.253761 0.172236 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:31.400978 0.436813 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:31.815912 0.064215 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:31.923260 0.176049 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:32.070941 1.722109 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 4 1271 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:33.569000 2.992223 tcp 10.0.2.105 60088 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:33.782025 0.091923 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:33.902367 0.074727 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.142557 0.078389 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.251582 0.115957 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.428896 0.047412 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.648120 0.147449 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.753885 0.057530 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:34.922734 0.612908 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:35.519075 0.298035 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:35.800176 0.071631 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:35.933299 0.087420 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.000124 0.046611 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.276519 0.081819 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.348351 0.186677 udp 10.0.2.105 7010 <-> 69.92.170.74 3729 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.621486 0.298834 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.783039 0.103364 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:36.894401 0.000000 udp 10.0.2.105 7010 -> 78.82.98.69 5961 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:08:42.560025 0.000000 tcp 10.0.2.105 60088 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:08:53.255252 0.147010 tcp 10.0.2.105 60069 -> 88.34.50.180 8461 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:55.760212 0.064464 tcp 10.0.2.105 60089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:55.824963 0.068232 tcp 10.0.2.105 60090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:55.893473 0.156354 tcp 10.0.2.105 60091 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:56.050306 0.284506 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:56.333693 0.199314 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:56.335174 4.866263 tcp 10.0.2.105 60092 -> 61.21.234.75 1632 SPA_* 0 0 244 136123 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:08:56.525911 0.124380 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:08:56.677605 0.000000 udp 10.0.2.105 7010 -> 86.162.97.93 5460 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:09:01.406785 4.926232 tcp 10.0.2.105 60092 -> 61.21.234.75 1632 A_PA 0 0 281 162630 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:06.538499 4.870084 tcp 10.0.2.105 60092 -> 61.21.234.75 1632 A_PA 0 0 254 161172 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:06.617209 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 07:09:11.597022 4.911610 tcp 10.0.2.105 60092 -> 61.21.234.75 1632 A_PA 0 0 258 161388 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:13.624441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:09:13.825447 0.067719 tcp 10.0.2.105 60093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:13.893524 0.066969 tcp 10.0.2.105 60094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:13.960789 0.164343 tcp 10.0.2.105 60095 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:16.648670 4.198960 tcp 10.0.2.105 60092 -> 61.21.234.75 1632 FPA_* 0 0 133 79816 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:09:21.625852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:09:37.629268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:10:09.635064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:13:48.570094 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:13:48.570295 3.008440 tcp 10.0.2.105 60096 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:13:57.574232 0.000000 tcp 10.0.2.105 60096 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:03.573169 0.068806 tcp 10.0.2.105 60097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:03.642326 0.067668 tcp 10.0.2.105 60098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:03.710311 0.160802 tcp 10.0.2.105 60099 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:04.054456 3.002022 tcp 10.0.2.105 60100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:13.054909 0.000000 tcp 10.0.2.105 60100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:19.053935 0.123668 tcp 10.0.2.105 60101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:19.177897 0.065356 tcp 10.0.2.105 60102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:19.243525 0.166041 tcp 10.0.2.105 60103 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:19.762241 0.381750 tcp 10.0.2.105 60104 -> 46.48.223.67 15494 SPA_* 0 0 7 1063 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:29.066008 0.794571 tcp 10.0.2.105 60104 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:29.066675 0.066569 tcp 10.0.2.105 60105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:29.133479 0.064680 tcp 10.0.2.105 60106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:29.198437 0.176561 tcp 10.0.2.105 60107 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:29.860743 3.002714 tcp 10.0.2.105 60108 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:38.861905 0.000000 tcp 10.0.2.105 60108 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:44.861588 0.062960 tcp 10.0.2.105 60109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:44.924820 0.084342 tcp 10.0.2.105 60110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:45.009467 0.161863 tcp 10.0.2.105 60111 -> 195.113.214.249 443 SRPA* 0 0 28 12100 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:14:45.279215 2.996244 tcp 10.0.2.105 60112 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:14:54.274032 0.000000 tcp 10.0.2.105 60112 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:15:00.273346 3.003851 tcp 10.0.2.105 60113 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:15:09.285718 0.000000 tcp 10.0.2.105 60113 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:15:13.942568 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:15:15.279137 4.444362 tcp 10.0.2.105 60114 -> 46.48.223.67 15494 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:15:19.714975 3.000258 tcp 10.0.2.105 60115 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:15:28.713652 0.000000 tcp 10.0.2.105 60115 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:16:13.641343 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 07:16:20.648857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:16:28.652032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:16:44.655911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:17:16.658918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:20:34.714276 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:20:34.714447 2.993651 tcp 10.0.2.105 60116 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:20:43.717148 0.000000 tcp 10.0.2.105 60116 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:20:49.719291 0.068206 tcp 10.0.2.105 60117 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:20:49.787782 0.071833 tcp 10.0.2.105 60118 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:20:49.859903 0.167674 tcp 10.0.2.105 60119 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:20:50.376908 2.993549 tcp 10.0.2.105 60120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:20:59.369140 0.000000 tcp 10.0.2.105 60120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:05.368607 0.064668 tcp 10.0.2.105 60121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:05.433607 0.065447 tcp 10.0.2.105 60122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:05.499327 0.403601 tcp 10.0.2.105 60123 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:06.067378 4.899271 tcp 10.0.2.105 60124 -> 46.48.223.67 15494 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:10.445846 0.064421 tcp 10.0.2.105 60125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:10.510628 0.066966 tcp 10.0.2.105 60126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:10.577914 0.159902 tcp 10.0.2.105 60127 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:10.966838 2.992654 tcp 10.0.2.105 60128 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:19.961214 0.000000 tcp 10.0.2.105 60128 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:25.967946 0.364824 tcp 10.0.2.105 60129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:26.333112 0.064950 tcp 10.0.2.105 60130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:26.398337 0.208533 tcp 10.0.2.105 60131 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:21:26.794877 2.974858 tcp 10.0.2.105 60132 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:35.708427 0.000000 tcp 10.0.2.105 60132 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:42.449359 2.969141 tcp 10.0.2.105 60133 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:51.344573 0.000000 tcp 10.0.2.105 60133 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:21:56.213529 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:21:57.270436 4.372463 tcp 10.0.2.105 60134 -> 46.48.223.67 15494 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:22:01.642799 2.957615 tcp 10.0.2.105 60135 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:22:10.524763 0.000000 tcp 10.0.2.105 60135 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:23:20.665893 3.000806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 07:23:27.672510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:23:35.673732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:23:51.677136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:24:23.682903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:27:15.930733 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:27:15.930821 3.004225 tcp 10.0.2.105 60136 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:27:24.933562 0.000000 tcp 10.0.2.105 60136 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:27:30.933650 0.065244 tcp 10.0.2.105 60137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:27:30.999316 0.068767 tcp 10.0.2.105 60138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:27:31.068375 0.161786 tcp 10.0.2.105 60139 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:27:31.522983 0.915257 tcp 10.0.2.105 60140 -> 31.192.24.67 3527 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:30:27.690001 3.000588 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 07:30:34.696235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:30:42.697798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:30:58.701156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:31:30.707215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:37:34.713469 3.005053 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 07:37:41.720395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:37:49.721815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:38:05.724359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:38:37.730875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:39:35.494461 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:39:35.494563 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:39:52.461120 0.068890 tcp 10.0.2.105 60141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:39:52.530270 0.066871 tcp 10.0.2.105 60142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:39:52.597463 0.172293 tcp 10.0.2.105 60143 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:39:52.770268 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:40:09.283065 0.067365 tcp 10.0.2.105 60144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:09.350776 0.064702 tcp 10.0.2.105 60145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:09.415794 0.164292 tcp 10.0.2.105 60146 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:09.580750 0.233002 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:40:09.814179 0.000000 udp 10.0.2.105 7010 -> 78.82.98.69 5961 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:40:27.289158 0.067017 tcp 10.0.2.105 60147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:27.356541 0.065651 tcp 10.0.2.105 60148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:27.422458 0.164369 tcp 10.0.2.105 60149 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:27.587882 0.000000 udp 10.0.2.105 7010 -> 86.162.97.93 5460 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:40:42.691405 0.064651 tcp 10.0.2.105 60150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:42.756384 0.069448 tcp 10.0.2.105 60151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:42.826043 0.157306 tcp 10.0.2.105 60152 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:42.983970 0.080029 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:40:43.064447 0.205148 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:40:43.270029 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:40:59.837733 0.096134 tcp 10.0.2.105 60153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:40:59.934082 0.068949 tcp 10.0.2.105 60154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:00.003307 0.171000 tcp 10.0.2.105 60155 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:00.174824 0.069259 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.244675 0.059457 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.304709 0.146898 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.452037 0.125728 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.578171 0.166915 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.745507 0.030505 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:00.776408 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:41:18.512554 0.064622 tcp 10.0.2.105 60156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:18.577480 0.066343 tcp 10.0.2.105 60157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:18.644097 0.158032 tcp 10.0.2.105 60158 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:18.802971 0.423312 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:19.226674 0.146476 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:19.373584 0.142281 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:19.516411 1.738717 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:19.516743 2.991151 tcp 10.0.2.105 60159 -> 70.52.239.176 2512 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:41:21.255537 0.114638 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.370606 0.044978 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.416005 0.054200 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.470593 0.069774 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.540748 0.058459 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.599612 0.121657 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.721698 0.038350 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.760546 0.046714 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.807718 0.041618 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.849749 0.072389 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:21.922533 0.181994 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:22.104976 0.055784 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:22.161148 0.064432 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:22.225983 0.000000 udp 10.0.2.105 7010 -> 69.92.170.74 3729 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 07:41:28.516608 0.000000 tcp 10.0.2.105 60159 -> 70.52.239.176 2512 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 07:41:38.601792 0.066357 tcp 10.0.2.105 60160 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:38.668602 0.069212 tcp 10.0.2.105 60161 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:38.738104 0.207314 tcp 10.0.2.105 60162 -> 195.113.214.249 443 SRPA* 0 0 40 21958 flow=From-Botnet-V2-TCP-Established 1970/02/11 07:41:38.946106 0.148449 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:39.095001 0.070379 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:39.165784 0.286439 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:39.452619 0.187187 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:41:39.640351 0.147058 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/11 07:44:41.736918 3.004267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 07:44:48.750114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:44:56.746285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:45:12.748793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:45:44.755050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:54:50.763931 3.000096 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 07:54:57.770032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:55:05.771660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:55:21.774209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:55:53.780523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 07:57:32.442949 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 07:57:32.443038 0.596095 tcp 10.0.2.105 60163 -> 31.192.24.67 3527 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:01:57.787017 3.000974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 08:02:04.794028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:02:12.795365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:02:28.800326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:03:00.806602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:09:04.810087 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 08:09:11.817838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:09:19.819099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:09:35.823045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:10:07.828505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:11:54.301638 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:11:54.301719 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:12:12.661571 0.069027 tcp 10.0.2.105 60164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:12.730892 0.069039 tcp 10.0.2.105 60165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:12.800191 0.160170 tcp 10.0.2.105 60166 -> 195.113.214.249 443 SRPA* 0 0 41 21414 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:12.960896 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:12:28.763978 0.064856 tcp 10.0.2.105 60167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:28.829169 0.074618 tcp 10.0.2.105 60168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:28.904070 0.158552 tcp 10.0.2.105 60169 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:29.063144 0.000000 udp 10.0.2.105 7010 -> 69.92.170.74 3729 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:12:45.155568 0.063626 tcp 10.0.2.105 60170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:45.219494 0.065781 tcp 10.0.2.105 60171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:45.285616 0.160876 tcp 10.0.2.105 60172 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:12:45.446997 0.335334 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:45.782747 0.080772 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:45.863957 0.210980 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:46.075310 0.068122 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:46.144016 0.059722 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:46.204166 0.128345 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:46.332897 0.147491 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:12:46.484397 0.000000 udp 10.0.2.105 7010 -> 79.227.131.224 2430 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:13:02.410159 0.063544 tcp 10.0.2.105 60173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:02.473973 0.066115 tcp 10.0.2.105 60174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:02.540428 0.160749 tcp 10.0.2.105 60175 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:02.701774 0.174466 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:02.876687 0.417916 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:03.295022 0.143210 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:03.438676 0.769516 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:04.208677 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:13:04.209016 3.007826 tcp 10.0.2.105 60176 -> 70.52.239.176 2512 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 08:13:13.214818 0.000000 tcp 10.0.2.105 60176 -> 70.52.239.176 2512 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 08:13:20.686378 0.068845 tcp 10.0.2.105 60177 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:20.755599 0.067912 tcp 10.0.2.105 60178 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:20.823847 0.162986 tcp 10.0.2.105 60179 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:20.987422 0.114386 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.102216 0.061800 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.164531 0.069586 udp 10.0.2.105 7010 <-> 95.149.162.242 4659 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.234463 0.057688 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.292643 0.104911 udp 10.0.2.105 7010 <-> 87.20.183.142 4918 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.397896 0.038125 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.436628 0.047029 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.483999 0.041375 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.525735 0.080926 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:21.607568 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:13:38.271264 0.202271 tcp 10.0.2.105 60180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:38.473873 0.069189 tcp 10.0.2.105 60181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:38.543365 0.159965 tcp 10.0.2.105 60182 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:13:38.704034 0.055723 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:38.760286 0.061218 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:38.760624 3.005182 tcp 10.0.2.105 60183 -> 86.161.61.195 5373 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 08:13:38.821953 0.043605 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:38.865954 0.186160 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:39.052687 0.073689 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:39.126755 0.056660 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:39.183775 0.280072 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:39.464155 0.187924 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:13:47.764643 0.000000 tcp 10.0.2.105 60183 -> 86.161.61.195 5373 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 08:13:56.028624 0.009665 udp 10.0.2.105 58623 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/02/11 08:13:56.038723 0.010171 udp 10.0.2.105 63110 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/02/11 08:16:11.834295 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 08:16:18.841666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:16:26.843510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:16:42.849030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:17:14.852300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:23:18.858402 3.001876 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 08:23:25.865854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:23:33.867368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:23:49.871975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:24:21.876285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:27:33.041615 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:27:33.041828 0.553527 tcp 10.0.2.105 60184 -> 31.192.24.67 3527 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:30:25.882260 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 08:30:32.889798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:30:40.891673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:30:56.894489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:31:28.900189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:37:32.906120 3.002234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 08:37:39.913623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:37:47.915140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:38:03.918155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:38:35.923679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:43:51.267867 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:43:51.268001 0.000000 udp 10.0.2.105 7010 -> 79.227.131.224 2430 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:44:10.027129 0.172254 tcp 10.0.2.105 60185 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:10.199715 0.074968 tcp 10.0.2.105 60186 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:10.274949 0.156752 tcp 10.0.2.105 60187 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:10.432497 1.851523 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:12.284497 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:44:12.284815 3.868614 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 SPA_* 0 0 10 2875 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:17.757885 1.983147 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 15 9002 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:23.219147 4.310535 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 9 6630 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:28.501909 0.073880 tcp 10.0.2.105 60189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:28.576059 0.073087 tcp 10.0.2.105 60190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:28.649449 0.157952 tcp 10.0.2.105 60191 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:28.807922 0.062050 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:28.870467 0.125476 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:28.996441 0.080636 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.077529 0.206888 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.284850 0.078943 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.364207 0.211585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.576466 0.149478 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.726330 0.167685 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:29.894380 0.414464 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:30.309221 0.147985 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:30.457632 0.146139 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:30.604521 0.000000 udp 10.0.2.105 7010 -> 95.149.162.242 4659 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:44:31.011427 4.219214 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:38.851111 3.890951 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 26 18388 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:39.929511 3.002506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 08:44:46.738147 0.074427 tcp 10.0.2.105 60192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:46.812868 0.075057 tcp 10.0.2.105 60193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:46.887740 0.157357 tcp 10.0.2.105 60194 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:46.937609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:44:47.045579 0.058090 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:44:47.104083 0.000000 udp 10.0.2.105 7010 -> 87.20.183.142 4918 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:44:51.039808 3.819592 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 15 9353 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:44:54.939432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:44:56.301908 1.633670 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 10 7181 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:01.950174 4.076245 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 14 7500 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:04.703883 0.077589 tcp 10.0.2.105 60195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:04.781831 0.077004 tcp 10.0.2.105 60196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:04.859126 0.158997 tcp 10.0.2.105 60197 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:05.018658 0.062450 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.081510 0.114246 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.196145 0.070536 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.267090 0.039569 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.307017 0.044667 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.352041 0.042805 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.395206 0.051188 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.446752 0.066426 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.513611 0.042562 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.556504 0.149289 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.706145 0.072278 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.778830 0.043677 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:05.822898 0.272352 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:06.095620 0.257188 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:45:09.318541 2.234587 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 15 11650 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:10.942172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:45:14.717510 3.695668 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 25 21830 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:20.032680 3.967834 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 14 12444 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:25.661734 0.402234 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 4 2864 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:41.889483 2.080696 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 11 8186 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:45:42.950154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:45:46.944145 0.805449 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:46:02.136020 1.861075 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:07.856506 4.447093 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:13.071941 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:46:15.276050 2.033862 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 9 6278 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:20.995301 3.960957 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 24 15136 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:26.990900 3.539012 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 35 20674 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:32.234778 4.958667 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 10 6084 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:37.393302 4.962216 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 7 5046 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:42.556614 0.000209 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 4 2892 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:47.159777 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:46:47.920101 3.975832 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 35 22370 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:46:53.355083 2.750439 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 21 11374 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:00.270835 4.346197 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 12 8240 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:06.816678 3.942074 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 12 6192 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:12.450463 4.723177 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:15.442946 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:47:18.234072 1.383104 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 9 6278 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:24.375718 4.034048 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 15 9106 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:32.328916 4.583252 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 8 3328 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:41.438701 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:47:45.277528 4.562881 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 9 5182 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:53.530034 1.867231 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:47:59.419539 3.705378 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 24 15136 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:06.510323 2.067140 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 11 8786 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:12.178148 4.130653 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 11 6386 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:18.095868 4.041179 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 21 14518 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:26.207787 4.091025 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 21 16774 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:26.944027 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 08:48:33.888846 4.351746 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 8 3928 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:41.915085 2.563976 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 12 9440 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:47.314390 2.011931 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 13 10342 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:48:58.640413 3.684641 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 A_PA 0 0 15 8050 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:03.913936 0.653016 tcp 10.0.2.105 60188 -> 24.234.227.235 6773 FPA_* 0 0 9 2620 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:21.329679 0.000000 udp 10.0.2.105 7010 -> 87.20.183.142 4918 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:49:37.436867 0.075677 tcp 10.0.2.105 60198 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:37.512848 0.070941 tcp 10.0.2.105 60199 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:37.584056 0.153214 tcp 10.0.2.105 60200 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:37.737905 0.000000 udp 10.0.2.105 7010 -> 95.149.162.242 4659 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 08:49:56.703965 0.074160 tcp 10.0.2.105 60201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:56.778388 0.076246 tcp 10.0.2.105 60202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:56.854974 0.165858 tcp 10.0.2.105 60203 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:49:57.021345 1.803610 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:58.825387 0.068922 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:58.894659 0.209384 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:59.104629 0.079124 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:59.184155 0.125363 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:59.309917 0.059366 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:59.369680 0.414841 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:49:59.784889 0.218867 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.004137 0.167254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.171838 0.149220 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.321448 0.146407 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.468288 0.144542 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.613253 0.058320 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.671966 0.126723 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.799095 0.070888 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.870347 0.038862 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.909550 0.045882 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.955860 0.040904 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:00.997164 0.065371 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.062967 0.065211 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.128662 0.044798 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.173855 0.146774 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.321043 0.072570 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.393975 0.058751 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.453063 0.284416 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.737889 0.188102 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:01.926360 0.053018 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/11 08:50:06.317405 0.590870 tcp 10.0.2.105 60204 -> 31.192.24.67 3527 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/11 08:54:49.987798 3.000664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 08:54:56.994643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:55:04.995925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:55:20.999295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 08:55:53.004882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:01:57.011389 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:02:04.019427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:02:12.019721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:02:28.023617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:03:00.029204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:09:04.036815 3.000177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:09:11.045439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:09:19.044208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:09:35.047338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:10:07.053860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:16:11.059377 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:16:18.066637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:16:26.068627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:16:42.071533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:17:14.077580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:20:06.916550 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 09:20:06.916657 0.803190 tcp 10.0.2.105 60205 -> 31.192.24.67 3527 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/02/11 09:20:17.942016 0.349724 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:18.292123 0.084631 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:18.377176 0.128237 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:18.505818 0.059721 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:18.565986 1.060822 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:19.627258 0.069432 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:19.697127 0.419054 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:20.116773 0.210457 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:20.451384 0.170393 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:20.622225 0.144744 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:20.767415 0.148334 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:20.916150 0.143086 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.059633 0.057537 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.117610 0.101783 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.219778 0.078876 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.299200 0.036301 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.335882 0.046589 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.382904 0.043611 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.426901 0.064654 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.491958 0.069724 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.562074 0.045227 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.607755 0.156177 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.764416 0.072342 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.837131 0.048722 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.886259 0.055945 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:21.942652 0.291456 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:20:22.234568 0.183786 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:23:18.084219 3.000755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:23:25.090695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:23:33.092067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:23:49.095031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:24:21.101106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:30:25.107550 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:30:32.114650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:30:40.115926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:30:56.119444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:31:28.125103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:37:32.132198 3.000846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:37:39.138844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:37:47.140027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:38:03.142992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:38:35.149148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:44:39.155764 3.006862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 09:44:46.165225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:44:54.163947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:45:10.167164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:45:42.173302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:50:07.725959 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 09:50:07.726138 0.604634 tcp 10.0.2.105 60206 -> 31.192.24.67 3527 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/02/11 09:50:48.944256 0.128852 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:49.073472 0.204863 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:49.278709 0.090467 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:49.369602 0.064096 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:49.434126 0.420993 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:49.855492 0.219454 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:50.075392 1.503222 udp 10.0.2.105 7010 <-> 24.234.227.235 1657 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:51.579044 0.069055 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:51.648492 0.168037 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:51.816918 0.146229 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:51.963549 0.651518 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:52.615477 0.144753 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:52.760649 0.100430 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:52.861438 0.126772 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:52.988567 0.072240 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.061203 0.033211 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.094750 0.047092 udp 10.0.2.105 7010 <-> 87.154.174.175 2253 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.142258 0.043981 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.186595 0.066823 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.253861 0.154199 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.408525 0.072491 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.470591 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 09:50:53.481416 0.046622 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.528458 0.055272 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.584116 0.289927 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:53.874419 0.185376 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:54.060191 0.070781 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:50:54.131393 0.045689 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/11 09:54:50.183953 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 09:54:57.191139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:55:05.193003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:55:21.196607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 09:55:53.201650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:01:57.207593 3.002120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:02:04.215142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:02:12.216672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:02:28.219721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:03:00.230670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:09:04.231718 3.001724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:09:11.239215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:09:19.239952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:09:35.243579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:10:07.249643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:16:11.255769 3.001499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:16:18.263133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:16:26.264316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:16:42.267480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:17:14.273460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:20:08.334067 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:20:08.334158 0.540776 tcp 10.0.2.105 60207 -> 31.192.24.67 3527 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:13.497650 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:21:13.497801 0.126792 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:13.624966 0.212137 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:13.837444 0.420157 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:14.258001 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:21:31.325751 0.069021 tcp 10.0.2.105 60208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:31.395100 0.075816 tcp 10.0.2.105 60209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:31.471188 0.137440 tcp 10.0.2.105 60210 -> 195.113.214.249 443 SRPA* 0 0 36 27174 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:31.609175 0.058660 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:31.668214 0.397226 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:32.065867 0.179377 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:32.245621 0.147279 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:32.393255 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:21:49.550019 0.104463 tcp 10.0.2.105 60211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:49.654771 0.068148 tcp 10.0.2.105 60212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:49.723248 0.193712 tcp 10.0.2.105 60213 -> 195.113.214.249 443 SRPA* 0 0 45 34814 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:21:49.917545 0.069349 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:49.987283 0.145485 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:50.133150 0.146431 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:50.280216 0.058955 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:50.339563 0.114386 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:21:50.454342 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:22:06.554607 0.063471 tcp 10.0.2.105 60214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:06.618419 0.067393 tcp 10.0.2.105 60215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:06.686153 0.163311 tcp 10.0.2.105 60216 -> 195.113.214.249 443 SRPA* 0 0 42 34652 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:06.850219 0.035313 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:06.885989 0.000000 udp 10.0.2.105 7010 -> 87.154.174.175 2253 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:22:24.179671 0.065701 tcp 10.0.2.105 60217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:24.245650 0.066261 tcp 10.0.2.105 60218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:24.312171 0.215337 tcp 10.0.2.105 60219 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:22:24.528059 0.059410 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:24.587848 0.065394 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:24.653629 0.086263 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:24.740329 0.056673 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:24.797430 0.281948 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:25.079786 0.152818 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:25.232923 0.073368 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:25.306677 0.064507 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:25.371519 0.187203 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:22:25.559124 0.061308 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:23:18.279933 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 10:23:25.286974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:23:33.288544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:23:49.291465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:24:21.297466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:30:25.303531 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:30:32.310713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:30:40.312973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:30:56.315337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:31:28.322224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:37:32.327671 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:37:39.334986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:37:47.336611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:38:03.339522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:38:35.345657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:44:39.352003 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 10:44:46.359078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:44:54.360165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:45:10.363261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:45:42.369391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:50:08.883474 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:50:08.883588 0.551569 tcp 10.0.2.105 60220 -> 31.192.24.67 3527 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:52:43.184586 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:52:43.184737 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:53:00.651841 0.068640 tcp 10.0.2.105 60221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:00.720763 0.070753 tcp 10.0.2.105 60222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:00.791829 0.156986 tcp 10.0.2.105 60223 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:00.949340 0.000000 udp 10.0.2.105 7010 -> 24.234.227.235 1657 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:53:17.594627 0.064973 tcp 10.0.2.105 60224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:17.659868 0.065254 tcp 10.0.2.105 60225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:17.725441 0.161253 tcp 10.0.2.105 60226 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:17.887199 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:53:35.560382 0.065167 tcp 10.0.2.105 60227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:35.625398 0.065783 tcp 10.0.2.105 60228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:35.691507 0.166344 tcp 10.0.2.105 60229 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:35.858486 0.000000 udp 10.0.2.105 7010 -> 87.154.174.175 2253 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:53:52.745165 0.066483 tcp 10.0.2.105 60230 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:52.811960 0.068393 tcp 10.0.2.105 60231 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:52.880654 0.177114 tcp 10.0.2.105 60232 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/11 10:53:53.058260 3.118131 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 4 1190 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:53.186243 3.619619 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1222 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:53.396495 3.203907 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 4 1115 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:53.817369 3.645052 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1184 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.030189 2.827025 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 4 944 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.090214 2.930414 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1240 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.259523 2.909982 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 4 1038 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.407462 2.835950 udp 10.0.2.105 7010 <-> 31.197.209.67 2790 CON 0 0 4 1308 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.477961 3.133544 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 4 1255 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.625336 3.101160 udp 10.0.2.105 7010 <-> 132.204.226.47 5293 CON 0 0 4 1164 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.740189 3.045962 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 4 1152 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.821992 3.111716 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 4 1208 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:54.967198 2.997634 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 4 1151 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.004859 3.009884 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 4 1331 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.052071 3.019089 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 4 1319 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.108381 3.037745 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 4 1319 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.156754 3.632484 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1052 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.211852 3.215531 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 4 1296 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.491926 2.997636 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 4 958 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.538876 3.135791 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 4 1127 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.725371 3.016035 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 4 1206 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.792643 3.882370 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 4 1316 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:55.943461 2.913639 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 4 1027 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:53:59.675715 0.000000 udp 10.0.2.105 7010 -> 76.176.207.247 1338 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:06.754771 0.000000 udp 10.0.2.105 7010 -> 78.168.57.50 9963 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:15.256973 0.000000 udp 10.0.2.105 7010 -> 187.162.113.149 7459 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:19.963609 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:54:23.028193 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:30.207879 0.000000 udp 10.0.2.105 7010 -> 184.180.239.226 1766 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:37.069039 0.000000 udp 10.0.2.105 7010 -> 24.222.96.117 1399 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:43.999326 0.154356 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:44.153682 0.000000 icmp 14.140.174.2 0x0303 -> 10.0.2.105 0x7017 URP 192 1 308 flow=Background 1970/02/11 10:54:48.965489 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:54:52.382573 3.002379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 10:54:52.911110 0.000000 udp 10.0.2.105 7010 -> 151.62.150.153 5261 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:54:59.390369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:55:01.002945 0.000000 udp 10.0.2.105 7010 -> 213.190.167.188 8443 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:07.391752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:55:08.123197 0.000000 udp 10.0.2.105 7010 -> 222.65.174.87 3458 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:12.969112 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:55:13.520508 0.000000 udp 10.0.2.105 7010 -> 108.58.145.163 8409 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:19.279377 0.045413 udp 10.0.2.105 7010 <-> 87.159.16.182 5887 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:55:19.834518 0.168362 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:55:20.097381 0.000000 udp 10.0.2.105 7010 -> 92.139.110.115 7556 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:23.394675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:55:27.610363 0.000000 udp 10.0.2.105 7010 -> 82.51.118.7 2254 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:36.554013 0.000000 udp 10.0.2.105 7010 -> 68.208.223.194 1281 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:41.470889 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:55:41.971638 0.000000 udp 10.0.2.105 7010 -> 4.71.253.162 1132 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:47.108884 0.000000 udp 10.0.2.105 7010 -> 86.133.118.227 6249 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:52.206597 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:55:55.401203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 10:56:00.197990 0.000000 udp 10.0.2.105 7010 -> 68.179.56.201 7253 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:08.129458 0.000000 udp 10.0.2.105 7010 -> 92.252.59.93 1366 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:12.969186 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:56:16.431267 0.072396 udp 10.0.2.105 7010 <-> 84.173.15.99 7912 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:56:16.746018 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:22.620139 0.000000 udp 10.0.2.105 7010 -> 186.6.14.232 3659 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:29.620099 0.000000 udp 10.0.2.105 7010 -> 76.184.74.218 1315 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:35.118569 0.000000 udp 10.0.2.105 7010 -> 112.209.136.61 1128 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:39.964223 0.000202 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:56:43.730456 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:51.031017 0.000000 udp 10.0.2.105 7010 -> 186.213.230.205 3220 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:56:56.809203 0.136546 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:56:56.972209 0.141189 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:56:57.170502 0.000000 udp 10.0.2.105 7010 -> 46.196.161.121 8513 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:05.171209 0.000000 udp 10.0.2.105 7010 -> 187.14.175.17 9735 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:09.967938 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:57:12.341514 0.000000 udp 10.0.2.105 7010 -> 190.219.1.134 3038 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:18.590778 0.000000 udp 10.0.2.105 7010 -> 82.85.237.145 8690 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:24.238876 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:32.521090 0.000000 udp 10.0.2.105 7010 -> 64.40.243.226 4203 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:37.470611 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:57:38.060011 0.000000 udp 10.0.2.105 7010 -> 78.188.103.174 5509 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:45.899204 0.021720 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:57:45.990436 0.000000 udp 10.0.2.105 7010 -> 188.169.131.141 8096 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:57:54.892981 0.000000 udp 10.0.2.105 7010 -> 93.193.158.198 7662 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:01.000846 0.101873 udp 10.0.2.105 7010 -> 176.58.158.225 4277 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:01.102719 0.000000 icmp 176.58.158.225 0x0303 -> 10.0.2.105 0xb510 URP 192 1 157 flow=Background 1970/02/11 10:58:05.968750 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:58:07.290982 0.000000 udp 10.0.2.105 7010 -> 90.213.21.38 6858 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:12.354644 0.308906 udp 10.0.2.105 7010 <-> 188.29.23.199 1669 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:58:12.787226 0.000000 udp 10.0.2.105 7010 -> 24.157.36.2 9575 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:20.549028 0.000000 udp 10.0.2.105 7010 -> 193.192.106.146 9854 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:26.639442 0.000000 udp 10.0.2.105 7010 -> 78.162.85.43 3806 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:31.464947 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:58:32.917524 0.000000 udp 10.0.2.105 7010 -> 2.27.179.136 8335 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:38.595813 0.000000 udp 10.0.2.105 7010 -> 194.247.234.202 5515 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:46.572940 0.000000 udp 10.0.2.105 7010 -> 88.75.130.108 1769 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:53.256820 0.054857 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:58:53.534092 0.000000 udp 10.0.2.105 7010 -> 212.19.100.78 3165 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:58:57.963077 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:59:02.169306 0.225335 udp 10.0.2.105 7010 <-> 2.193.202.156 4752 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:02.435008 0.000000 udp 10.0.2.105 7010 -> 69.198.95.41 5967 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:10.341093 0.000000 udp 10.0.2.105 7010 -> 68.224.219.72 8297 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:17.201179 0.174998 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:17.602822 0.000000 udp 10.0.2.105 7010 -> 75.117.117.149 9848 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:21.967884 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:59:25.132908 0.097652 udp 10.0.2.105 7010 <-> 31.192.18.180 3573 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:25.252846 0.041072 udp 10.0.2.105 7010 <-> 84.186.89.134 7869 CON 0 0 2 702 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:25.313152 0.000000 udp 10.0.2.105 7010 -> 86.18.105.221 6133 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:32.312964 0.000000 udp 10.0.2.105 7010 -> 64.213.188.62 5031 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:38.571922 0.032755 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:38.725919 0.099101 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:38.848896 0.154808 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:39.031063 0.000000 udp 10.0.2.105 7010 -> 79.25.244.152 6542 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:44.590748 0.229074 udp 10.0.2.105 7010 <-> 109.54.174.134 3965 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:44.863937 0.000000 udp 10.0.2.105 7010 -> 90.244.159.142 7625 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:49.467227 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 10:59:50.308972 0.000000 udp 10.0.2.105 7010 -> 81.149.144.46 2126 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 10:59:56.816039 0.095675 udp 10.0.2.105 7010 <-> 88.105.32.67 2481 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:57.129426 0.225773 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/02/11 10:59:57.457175 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:06.081965 0.000000 udp 10.0.2.105 7010 -> 87.7.39.14 8647 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:14.553512 0.000000 udp 10.0.2.105 7010 -> 85.210.15.145 9805 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:19.472816 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:00:21.103302 0.145112 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:00:21.476693 0.356543 udp 10.0.2.105 7010 <-> 217.201.153.118 8852 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:00:21.920425 0.000000 udp 10.0.2.105 7010 -> 82.50.127.130 1039 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:30.877138 0.000000 udp 10.0.2.105 7010 -> 67.188.20.253 9015 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:37.856990 0.000000 udp 10.0.2.105 7010 -> 189.164.6.155 1590 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:44.667126 0.000000 udp 10.0.2.105 7010 -> 81.102.193.222 6454 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:00:49.463369 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:00:52.758755 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:00.449786 0.000000 udp 10.0.2.105 7010 -> 109.82.0.40 5387 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:08.220702 0.000000 udp 10.0.2.105 7010 -> 76.10.140.57 3992 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:13.862957 0.000000 udp 10.0.2.105 7010 -> 74.7.250.177 3115 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:18.465268 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:01:19.802416 0.000000 udp 10.0.2.105 7010 -> 86.18.144.207 2192 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:27.950086 0.000000 udp 10.0.2.105 7010 -> 23.24.137.233 5591 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:35.239774 0.000000 udp 10.0.2.105 7010 -> 70.45.165.242 1606 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:42.339832 1.168695 udp 10.0.2.105 7010 <-> 190.142.167.215 3699 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:01:43.703129 0.000000 udp 10.0.2.105 7010 -> 67.185.95.78 9842 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:46.966134 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:01:51.363017 0.000000 udp 10.0.2.105 7010 -> 217.203.3.170 6391 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:59.234228 0.084578 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:01:59.378992 0.000000 udp 10.0.2.105 7010 -> 70.63.52.66 7057 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:01:59.407300 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 11:02:04.601694 0.134846 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:02:04.875322 0.000000 udp 10.0.2.105 7010 -> 78.97.152.166 4185 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:06.414103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:02:13.114366 0.000000 udp 10.0.2.105 7010 -> 173.221.33.243 3641 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:14.415800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:02:17.970809 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:02:19.262943 0.000000 udp 10.0.2.105 7010 -> 85.110.63.77 2100 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:27.003942 0.000000 udp 10.0.2.105 7010 -> 50.90.83.50 8741 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:30.419018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:02:35.589119 0.000000 udp 10.0.2.105 7010 -> 216.145.130.101 1611 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:42.657041 0.000000 udp 10.0.2.105 7010 -> 142.68.229.214 5730 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:47.463361 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:02:50.918378 0.000000 udp 10.0.2.105 7010 -> 79.46.147.46 6137 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:02:59.751100 0.000000 udp 10.0.2.105 7010 -> 60.40.96.217 5992 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:02.425241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:03:06.260074 0.000000 udp 10.0.2.105 7010 -> 71.200.101.188 3077 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:14.753138 0.066661 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:03:14.834485 0.000000 udp 10.0.2.105 7010 -> 107.0.209.52 7989 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:19.469295 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:03:22.183606 0.000000 udp 10.0.2.105 7010 -> 82.8.70.25 7242 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:28.923549 0.000000 udp 10.0.2.105 7010 -> 92.9.101.147 6531 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:36.994461 0.000000 udp 10.0.2.105 7010 -> 84.109.80.191 7653 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:45.557099 0.000000 udp 10.0.2.105 7010 -> 68.15.58.29 1904 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:03:50.463815 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:03:53.762837 0.000000 udp 10.0.2.105 7010 -> 88.229.96.149 4507 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:01.169605 0.000000 udp 10.0.2.105 7010 -> 201.158.221.5 1296 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:07.729124 0.000000 udp 10.0.2.105 7010 -> 46.196.41.205 1132 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:13.747725 0.059180 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 2 659 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:04:13.987909 0.172004 udp 10.0.2.105 7010 -> 50.78.238.2 8710 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:14.159913 0.000000 icmp 50.78.238.2 0x0303 -> 10.0.2.105 0x0622 URP 192 1 194 flow=Background 1970/02/11 11:04:18.463983 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:04:21.848965 0.000000 udp 10.0.2.105 7010 -> 91.191.22.74 6750 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:27.868035 0.000000 udp 10.0.2.105 7010 -> 62.103.25.191 5633 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:35.258531 0.000000 udp 10.0.2.105 7010 -> 24.79.14.98 5956 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:40.507053 0.000000 udp 10.0.2.105 7010 -> 95.248.78.76 3777 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:45.463021 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:04:47.656163 0.091690 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:04:47.784223 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:53.554739 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:04:58.561894 0.000000 udp 10.0.2.105 7010 -> 78.180.119.152 7244 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:04.270088 0.000000 udp 10.0.2.105 7010 -> 90.193.248.239 6334 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:13.203493 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:17.969710 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:05:18.430114 0.146032 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:05:18.613924 0.000000 udp 10.0.2.105 7010 -> 74.207.186.173 5618 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:26.272834 0.000000 udp 10.0.2.105 7010 -> 27.91.13.187 7194 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:31.960069 0.000000 udp 10.0.2.105 7010 -> 50.121.103.27 6400 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:05:38.550135 0.075824 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 714 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:05:38.640504 0.217145 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:05:43.466168 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:09:06.435190 2.997102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 11:09:13.440555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:09:21.439690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:09:37.449573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:10:09.448717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:16:13.454766 3.001702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 11:16:20.462106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:16:28.463872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:16:44.466802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:17:16.472716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:20:09.441928 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:20:09.442085 1.967980 tcp 10.0.2.105 60233 -> 31.192.24.67 3527 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:23:20.478531 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 11:23:27.486184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:23:35.487518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:23:51.490185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:24:23.497086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:30:27.511404 2.992762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 11:30:34.510531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:30:42.511453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:30:58.516958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:31:30.520835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:36:00.239173 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:36:00.239373 0.125472 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:00.365231 0.147540 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:00.513210 0.059600 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:00.573219 0.208736 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:00.782372 0.167342 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:00.974457 0.141321 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:01.116135 0.212986 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:01.329494 0.000000 udp 10.0.2.105 7010 -> 132.204.226.47 5293 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:36:17.334800 0.071622 tcp 10.0.2.105 60234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:17.406733 0.066417 tcp 10.0.2.105 60235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:17.473404 0.161477 tcp 10.0.2.105 60236 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:17.635394 0.062241 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:17.698079 0.044861 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:17.743301 0.143163 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:17.886878 0.039054 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:17.926409 0.049170 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:17.976006 0.056032 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.032429 0.056031 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.088806 0.272340 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.361554 0.186675 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.548576 0.072221 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.621187 0.055731 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.677405 0.070355 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.748169 0.151676 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:18.900178 0.000000 udp 10.0.2.105 7010 -> 87.159.16.182 5887 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:36:36.581736 0.065927 tcp 10.0.2.105 60237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:36.647935 0.072889 tcp 10.0.2.105 60238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:36.721209 0.164460 tcp 10.0.2.105 60239 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:36.886168 0.165142 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:37.051677 0.067249 udp 10.0.2.105 7010 <-> 84.173.15.99 7912 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:37.119359 0.144592 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:37.264512 0.136235 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:37.401159 0.024174 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:37.425699 0.000000 udp 10.0.2.105 7010 -> 188.29.23.199 1669 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:36:56.419921 0.064333 tcp 10.0.2.105 60240 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:56.484552 0.065936 tcp 10.0.2.105 60241 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:56.550855 0.172596 tcp 10.0.2.105 60242 -> 195.113.214.249 443 SRPA* 0 0 33 14346 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:36:56.724107 0.058450 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:36:56.782930 0.000000 udp 10.0.2.105 7010 -> 2.193.202.156 4752 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:37:14.436387 0.064824 tcp 10.0.2.105 60243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:14.501468 0.065252 tcp 10.0.2.105 60244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:14.566975 0.183417 tcp 10.0.2.105 60245 -> 195.113.214.249 443 SRPA* 0 0 45 37188 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:14.751257 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:37:32.331686 0.068253 tcp 10.0.2.105 60246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:32.400201 0.066314 tcp 10.0.2.105 60247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:32.466788 0.156090 tcp 10.0.2.105 60248 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:32.623545 0.039866 udp 10.0.2.105 7010 <-> 84.186.89.134 7869 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:37:32.663852 0.000000 udp 10.0.2.105 7010 -> 31.192.18.180 3573 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:37:34.526531 3.002073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 11:37:41.534125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:37:49.535968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:37:50.927590 0.064996 tcp 10.0.2.105 60249 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:50.992923 0.065006 tcp 10.0.2.105 60250 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:51.058222 0.165193 tcp 10.0.2.105 60251 -> 195.113.214.249 443 SRPA* 0 0 48 41730 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:37:51.224091 0.097772 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:37:51.322304 0.031119 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:37:51.353897 0.260395 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:37:51.614658 0.000000 udp 10.0.2.105 7010 -> 109.54.174.134 3965 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:38:05.538685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:38:08.053116 0.063918 tcp 10.0.2.105 60252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:08.117284 0.066596 tcp 10.0.2.105 60253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:08.184193 0.158933 tcp 10.0.2.105 60254 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:08.343831 0.000000 udp 10.0.2.105 7010 -> 88.105.32.67 2481 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 11:38:24.676974 0.065650 tcp 10.0.2.105 60255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:24.742896 0.066607 tcp 10.0.2.105 60256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:24.809775 0.164890 tcp 10.0.2.105 60257 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:38:24.975323 0.226292 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:25.202001 0.143385 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:25.345808 0.203842 udp 10.0.2.105 7010 <-> 217.201.153.118 8852 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:25.550088 0.776366 udp 10.0.2.105 7010 <-> 190.142.167.215 3699 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.326865 0.076561 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.403874 0.135619 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.539883 0.070046 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.610368 0.055718 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.666483 0.080477 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.747344 0.142673 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.890381 0.080450 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:26.971184 0.205974 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/11 11:38:37.544833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:44:41.550735 3.002784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 11:44:48.558267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:44:56.559560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:45:12.562698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:45:44.568718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:50:11.412548 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:50:11.412689 3.003928 tcp 10.0.2.105 60258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:20.420628 0.000000 tcp 10.0.2.105 60258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:26.415541 0.069422 tcp 10.0.2.105 60259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:26.485291 0.067073 tcp 10.0.2.105 60260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:26.552592 0.161480 tcp 10.0.2.105 60261 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:26.811250 2.465463 tcp 10.0.2.105 60262 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:28.610415 0.064026 tcp 10.0.2.105 60263 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:28.674682 0.067061 tcp 10.0.2.105 60264 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:28.742060 0.162561 tcp 10.0.2.105 60265 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:29.276969 2.995560 tcp 10.0.2.105 60266 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:38.270192 0.000000 tcp 10.0.2.105 60266 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:44.270308 0.077535 tcp 10.0.2.105 60267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:44.348111 0.067822 tcp 10.0.2.105 60268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:44.416431 0.166400 tcp 10.0.2.105 60269 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:44.684793 2.999724 tcp 10.0.2.105 60270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:53.683225 0.000000 tcp 10.0.2.105 60270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:50:59.682278 0.063242 tcp 10.0.2.105 60271 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:59.745760 0.069083 tcp 10.0.2.105 60272 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:50:59.815112 0.167166 tcp 10.0.2.105 60273 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:51:00.067131 3.009466 tcp 10.0.2.105 60274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:09.075252 0.000000 tcp 10.0.2.105 60274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:15.063858 1.749558 tcp 10.0.2.105 60275 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:51:16.813733 2.996749 tcp 10.0.2.105 60276 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:25.808896 0.000000 tcp 10.0.2.105 60276 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:31.810414 3.001727 tcp 10.0.2.105 60277 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:40.810561 0.000000 tcp 10.0.2.105 60277 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:51:45.467476 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:54:53.580542 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 11:55:00.587912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:55:08.589802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:55:24.592648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:55:56.598615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 11:56:46.811095 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 11:56:46.811230 3.003983 tcp 10.0.2.105 60278 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:56:55.813574 0.000000 tcp 10.0.2.105 60278 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:01.814468 0.063575 tcp 10.0.2.105 60279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:01.878374 0.065254 tcp 10.0.2.105 60280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:01.943901 0.165942 tcp 10.0.2.105 60281 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:02.162766 2.077915 tcp 10.0.2.105 60282 -> 46.48.223.67 15494 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:03.922124 0.066354 tcp 10.0.2.105 60283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:03.988780 0.067270 tcp 10.0.2.105 60284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:04.056378 0.174872 tcp 10.0.2.105 60285 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:04.240928 2.999112 tcp 10.0.2.105 60286 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:13.238774 0.000000 tcp 10.0.2.105 60286 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:19.238103 0.063121 tcp 10.0.2.105 60287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:19.301502 0.065077 tcp 10.0.2.105 60288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:19.366845 0.156571 tcp 10.0.2.105 60289 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:19.540815 3.001245 tcp 10.0.2.105 60290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:28.540994 0.000000 tcp 10.0.2.105 60290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:34.539549 3.493025 tcp 10.0.2.105 60291 -> 46.48.223.67 15494 FSPA* 0 0 14 1654 flow=From-Botnet-V2-TCP-Established 1970/02/11 11:57:38.032757 2.995240 tcp 10.0.2.105 60292 -> 82.20.121.6 1791 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 11:57:47.026632 0.000000 tcp 10.0.2.105 60292 -> 82.20.121.6 1791 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:02:00.604499 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:02:07.611995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:02:15.615756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:02:31.616542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:02:53.027305 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:02:53.027483 3.004007 tcp 10.0.2.105 60293 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:03:02.030253 0.000000 tcp 10.0.2.105 60293 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:03:03.622652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:03:08.030843 0.065405 tcp 10.0.2.105 60294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:03:08.096506 0.070975 tcp 10.0.2.105 60295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:03:08.167766 0.176092 tcp 10.0.2.105 60296 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:03:08.461584 3.002275 tcp 10.0.2.105 60297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:03:17.462544 0.000000 tcp 10.0.2.105 60297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:08:23.467545 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:08:23.467630 2.999203 tcp 10.0.2.105 60298 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:08:32.465275 0.000000 tcp 10.0.2.105 60298 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:08:38.466125 0.068384 tcp 10.0.2.105 60299 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:38.534818 0.062915 tcp 10.0.2.105 60300 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:38.598079 0.230746 tcp 10.0.2.105 60301 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:39.032196 2.996420 tcp 10.0.2.105 60302 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:08:39.035225 0.000000 udp 10.0.2.105 7010 -> 132.204.226.47 5293 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:08:48.027242 0.000000 tcp 10.0.2.105 60302 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:08:54.351230 0.089155 tcp 10.0.2.105 60303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:54.440349 0.063065 tcp 10.0.2.105 60304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:54.503693 0.154353 tcp 10.0.2.105 60305 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:08:54.658703 0.000000 udp 10.0.2.105 7010 -> 87.159.16.182 5887 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:09:07.629358 3.000683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:09:11.171858 0.066013 tcp 10.0.2.105 60306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:11.238175 0.063324 tcp 10.0.2.105 60307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:11.301780 0.168548 tcp 10.0.2.105 60308 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:11.470850 0.000000 udp 10.0.2.105 7010 -> 188.29.23.199 1669 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:09:14.639534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:09:22.638293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:09:29.868426 0.197686 tcp 10.0.2.105 60309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:30.065954 0.065775 tcp 10.0.2.105 60310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:30.132015 0.153024 tcp 10.0.2.105 60311 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:30.285557 0.000000 udp 10.0.2.105 7010 -> 2.193.202.156 4752 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:09:38.641124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:09:48.836054 0.068686 tcp 10.0.2.105 60312 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:48.905054 0.065214 tcp 10.0.2.105 60313 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:48.970551 0.214294 tcp 10.0.2.105 60314 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:09:49.185498 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:10:04.538092 0.448562 tcp 10.0.2.105 60315 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:04.986931 0.071428 tcp 10.0.2.105 60316 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:05.058219 0.163855 tcp 10.0.2.105 60317 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:05.222577 0.000000 udp 10.0.2.105 7010 -> 31.192.18.180 3573 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:10:10.965724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:10:22.335755 0.064652 tcp 10.0.2.105 60318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:22.400751 0.069565 tcp 10.0.2.105 60319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:22.470657 0.163173 tcp 10.0.2.105 60320 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:22.634362 0.000000 udp 10.0.2.105 7010 -> 109.54.174.134 3965 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:10:39.647885 0.064136 tcp 10.0.2.105 60321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:39.712539 0.064623 tcp 10.0.2.105 60322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:39.777441 0.210332 tcp 10.0.2.105 60323 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:39.988473 0.000000 udp 10.0.2.105 7010 -> 88.105.32.67 2481 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:10:58.506266 0.107034 tcp 10.0.2.105 60324 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:58.613600 0.064468 tcp 10.0.2.105 60325 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:58.678377 0.161064 tcp 10.0.2.105 60326 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:10:58.839978 0.064794 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:10:59.157094 0.221588 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:10:59.371455 0.171297 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:10:59.545443 0.172656 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:10:59.714604 0.180284 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:00.082524 0.127080 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:00.530923 0.249318 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:00.744517 0.047436 udp 10.0.2.105 7010 <-> 5.13.46.209 2778 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:00.842622 0.059207 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:01.134316 0.167672 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:01.278749 0.303718 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:01.624165 0.044473 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:01.690326 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:11:20.437253 0.338774 tcp 10.0.2.105 60327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:20.776497 0.068422 tcp 10.0.2.105 60328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:20.845169 0.153344 tcp 10.0.2.105 60329 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:20.999025 0.055899 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:21.347945 0.198277 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:21.538584 0.077317 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:21.679197 0.086226 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:21.744554 0.284122 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.019545 0.107844 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.112628 0.645461 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.325077 0.220603 udp 10.0.2.105 7010 <-> 84.173.15.99 7912 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.514678 0.175564 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.681710 0.166515 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:22.960882 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:11:39.219562 0.065056 tcp 10.0.2.105 60330 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:39.284963 0.064029 tcp 10.0.2.105 60331 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:39.349292 0.156197 tcp 10.0.2.105 60332 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:39.506111 0.152738 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:39.644114 0.058698 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 1916 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:39.808410 0.050884 udp 10.0.2.105 7010 <-> 84.186.89.134 7869 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:40.089796 0.000000 udp 10.0.2.105 7010 -> 79.227.131.224 2430 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:11:57.420540 0.064750 tcp 10.0.2.105 60333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:57.485632 0.068215 tcp 10.0.2.105 60334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:57.554164 0.161131 tcp 10.0.2.105 60335 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:11:57.715907 0.098859 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:58.137709 0.069730 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:58.205076 0.238554 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:11:58.435613 0.000000 udp 10.0.2.105 7010 -> 217.201.153.118 8852 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:12:15.206380 0.117331 tcp 10.0.2.105 60336 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:15.323988 0.065373 tcp 10.0.2.105 60337 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:15.389676 0.153150 tcp 10.0.2.105 60338 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:15.543435 0.166711 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:15.687473 2.338686 udp 10.0.2.105 7010 <-> 190.142.167.215 3699 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:18.019985 0.112521 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:18.095674 0.155891 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:18.386536 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:12:34.353792 0.072215 tcp 10.0.2.105 60339 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:34.426316 0.063297 tcp 10.0.2.105 60340 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:34.489961 0.196675 tcp 10.0.2.105 60341 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:12:34.687247 0.085767 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:34.743284 0.133300 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:35.181862 0.162687 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:35.322179 0.095693 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:12:35.481092 0.205231 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:13:54.027606 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:13:54.027814 3.003989 tcp 10.0.2.105 60342 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:03.036503 0.000000 tcp 10.0.2.105 60342 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:09.029816 0.063938 tcp 10.0.2.105 60343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:09.094045 0.063937 tcp 10.0.2.105 60344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:09.158299 0.162169 tcp 10.0.2.105 60345 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:09.649033 3.009840 tcp 10.0.2.105 60346 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:18.653118 0.000000 tcp 10.0.2.105 60346 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:24.642935 0.063618 tcp 10.0.2.105 60347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:24.706869 0.065015 tcp 10.0.2.105 60348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:24.772139 0.160070 tcp 10.0.2.105 60349 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:14:25.227915 3.377284 tcp 10.0.2.105 60350 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:34.544424 0.000000 tcp 10.0.2.105 60350 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:40.486390 2.964916 tcp 10.0.2.105 60351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:49.402929 0.000000 tcp 10.0.2.105 60351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:14:54.081152 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:16:14.652654 3.001347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:16:21.659794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:16:29.661741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:16:45.664727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:17:17.680472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:19:55.237540 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:19:55.237641 3.005122 tcp 10.0.2.105 60352 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:04.239836 0.000000 tcp 10.0.2.105 60352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:10.240687 0.067072 tcp 10.0.2.105 60353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:10.307988 0.064511 tcp 10.0.2.105 60354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:10.372871 0.159528 tcp 10.0.2.105 60355 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:10.714420 2.999175 tcp 10.0.2.105 60356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:19.712059 0.000000 tcp 10.0.2.105 60356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:25.713528 0.064543 tcp 10.0.2.105 60357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:25.778360 0.069085 tcp 10.0.2.105 60358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:25.847755 0.163743 tcp 10.0.2.105 60359 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:20:26.254597 3.001305 tcp 10.0.2.105 60360 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:35.254481 0.000000 tcp 10.0.2.105 60360 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:41.243380 3.006358 tcp 10.0.2.105 60361 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:50.256104 0.000000 tcp 10.0.2.105 60361 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:20:54.962963 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:23:21.686509 3.001838 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:23:28.693755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:23:36.695103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:23:52.698927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:24:24.704385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:25:56.246516 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:25:56.246658 2.993670 tcp 10.0.2.105 60362 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:05.238999 0.000000 tcp 10.0.2.105 60362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:11.249488 0.064181 tcp 10.0.2.105 60363 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:11.313910 0.065393 tcp 10.0.2.105 60364 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:11.379613 0.154159 tcp 10.0.2.105 60365 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:11.546341 2.996471 tcp 10.0.2.105 60366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:20.540841 0.000000 tcp 10.0.2.105 60366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:26.540499 0.067068 tcp 10.0.2.105 60367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:26.607848 0.069405 tcp 10.0.2.105 60368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:26.677533 0.153796 tcp 10.0.2.105 60369 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:26:26.857184 2.996813 tcp 10.0.2.105 60370 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:35.852993 0.000000 tcp 10.0.2.105 60370 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:41.851594 3.004571 tcp 10.0.2.105 60371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:50.854360 0.000000 tcp 10.0.2.105 60371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:26:55.471319 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:30:28.711472 3.000684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:30:35.717701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:30:43.719520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:30:59.722538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:31:31.728787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:31:56.854799 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:31:56.854893 2.993977 tcp 10.0.2.105 60372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:05.847382 0.000000 tcp 10.0.2.105 60372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:11.857073 0.065666 tcp 10.0.2.105 60373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:11.923052 0.068917 tcp 10.0.2.105 60374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:11.992351 0.160950 tcp 10.0.2.105 60375 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:12.264975 2.988567 tcp 10.0.2.105 60376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:21.249485 0.000000 tcp 10.0.2.105 60376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:27.259975 0.064291 tcp 10.0.2.105 60377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:27.324507 0.070582 tcp 10.0.2.105 60378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:27.395381 0.191442 tcp 10.0.2.105 60379 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:32:27.673953 2.999260 tcp 10.0.2.105 60380 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:36.675920 0.000000 tcp 10.0.2.105 60380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:42.673140 3.001427 tcp 10.0.2.105 60381 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:51.673124 0.000000 tcp 10.0.2.105 60381 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:32:56.470178 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:37:35.734216 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:37:42.741874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:37:50.746816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:38:06.746574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:38:38.752532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:42:53.018633 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:42:53.018737 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:43:11.205651 0.064679 tcp 10.0.2.105 60382 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:11.270644 0.066922 tcp 10.0.2.105 60383 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:11.337809 0.301674 tcp 10.0.2.105 60384 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:11.640075 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:43:30.602326 0.068975 tcp 10.0.2.105 60385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:30.671552 0.067096 tcp 10.0.2.105 60386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:30.739021 0.151294 tcp 10.0.2.105 60387 -> 195.113.214.249 443 SRPA* 0 0 28 13202 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:30.890658 0.045502 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:43:30.921826 0.000000 udp 10.0.2.105 7010 -> 217.201.153.118 8852 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:43:42.709657 3.005672 tcp 10.0.2.105 60388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:43:48.379530 0.071368 tcp 10.0.2.105 60389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:48.451175 0.064369 tcp 10.0.2.105 60390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:48.515938 0.160444 tcp 10.0.2.105 60391 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:48.676911 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:43:51.717046 0.000000 tcp 10.0.2.105 60388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:43:57.711619 0.069124 tcp 10.0.2.105 60392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:57.781065 0.068608 tcp 10.0.2.105 60393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:57.849959 0.154090 tcp 10.0.2.105 60394 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:43:58.382129 3.004129 tcp 10.0.2.105 60395 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:44:06.504147 0.066701 tcp 10.0.2.105 60396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:06.571113 0.063434 tcp 10.0.2.105 60397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:06.634788 0.159313 tcp 10.0.2.105 60398 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:06.794574 0.170046 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:07.064520 0.221215 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:07.278502 0.062430 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:07.386741 0.000000 tcp 10.0.2.105 60395 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:44:07.423489 0.214950 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:07.653867 0.177200 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:07.801526 0.249866 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:08.015740 0.172343 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:08.184778 0.053878 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2558 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:08.283093 0.094232 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:08.408962 0.171024 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:08.555014 0.000000 udp 10.0.2.105 7010 -> 5.13.46.209 2778 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:44:24.733411 0.061776 tcp 10.0.2.105 60399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:24.795495 0.064610 tcp 10.0.2.105 60400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:24.860457 0.160105 tcp 10.0.2.105 60401 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:25.021196 0.044980 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.084587 0.072090 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.139675 0.201362 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.359190 0.056766 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.643824 0.080807 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.704185 0.102359 udp 10.0.2.105 7010 <-> 84.173.15.99 7912 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:25.781562 0.883627 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:26.555441 0.106494 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:26.659004 0.290491 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:26.981649 0.190908 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:27.165664 0.165489 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:27.578361 0.159568 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:27.726150 0.056530 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:27.941025 0.049594 udp 10.0.2.105 7010 <-> 84.186.89.134 7869 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:27.983247 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:44:42.758822 3.001273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:44:43.126863 0.125505 tcp 10.0.2.105 60402 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:43.252687 0.063411 tcp 10.0.2.105 60403 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:43.316381 0.152637 tcp 10.0.2.105 60404 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:44:43.469528 0.100065 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:43.596010 0.237713 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:43.825373 0.167208 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:43.970554 1.141135 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:45.169429 0.116468 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:44:45.296495 0.000000 udp 10.0.2.105 7010 -> 190.142.167.215 3699 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 12:44:49.765774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:44:57.767380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:45:02.704991 0.063134 tcp 10.0.2.105 60405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:45:02.768458 0.066030 tcp 10.0.2.105 60406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:45:02.834792 0.158151 tcp 10.0.2.105 60407 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:45:02.993504 0.077807 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:45:03.044568 0.096838 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:45:03.346374 0.215645 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:45:03.554421 0.130913 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:45:03.639122 0.163886 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/11 12:45:13.770339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:45:45.776047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:49:13.385672 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:49:13.385778 2.993822 tcp 10.0.2.105 60408 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:49:22.377984 0.000000 tcp 10.0.2.105 60408 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:49:28.388375 0.065022 tcp 10.0.2.105 60409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:28.453684 0.064078 tcp 10.0.2.105 60410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:28.518051 0.156606 tcp 10.0.2.105 60411 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:28.685817 2.995314 tcp 10.0.2.105 60412 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:49:37.679985 0.000000 tcp 10.0.2.105 60412 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:49:43.679113 0.062412 tcp 10.0.2.105 60413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:43.741786 0.063383 tcp 10.0.2.105 60414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:43.805427 0.154476 tcp 10.0.2.105 60415 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:43.980822 2.108404 tcp 10.0.2.105 60416 -> 46.48.223.67 15494 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:45.792926 0.062759 tcp 10.0.2.105 60417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:45.855976 0.064299 tcp 10.0.2.105 60418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:45.920579 0.158720 tcp 10.0.2.105 60419 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:49:46.089456 3.007050 tcp 10.0.2.105 60420 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:49:55.094805 0.000000 tcp 10.0.2.105 60420 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:50:01.083646 2.994235 tcp 10.0.2.105 60421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:50:10.086891 0.000000 tcp 10.0.2.105 60421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:50:14.963499 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:50:16.085267 1.729004 tcp 10.0.2.105 60422 -> 46.48.223.67 15494 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:54:54.787899 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 12:55:01.795850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:55:09.797062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:55:17.809308 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:55:17.809439 3.003676 tcp 10.0.2.105 60423 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:55:25.799720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:55:26.811827 0.000000 tcp 10.0.2.105 60423 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:55:32.812094 0.065636 tcp 10.0.2.105 60424 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:32.877958 0.063586 tcp 10.0.2.105 60425 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:32.941932 0.154128 tcp 10.0.2.105 60426 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:33.113008 3.002013 tcp 10.0.2.105 60427 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:55:42.113647 0.000000 tcp 10.0.2.105 60427 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:55:48.113214 0.063701 tcp 10.0.2.105 60428 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:48.177247 0.063872 tcp 10.0.2.105 60429 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:48.241463 0.154257 tcp 10.0.2.105 60430 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:48.434200 1.991618 tcp 10.0.2.105 60431 -> 46.48.223.67 15494 FSPA* 0 0 14 1765 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:50.127593 0.064040 tcp 10.0.2.105 60432 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:50.191913 0.064115 tcp 10.0.2.105 60433 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:50.256301 0.159037 tcp 10.0.2.105 60434 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/11 12:55:50.426054 2.994516 tcp 10.0.2.105 60435 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:55:57.806609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 12:55:59.418464 0.000000 tcp 10.0.2.105 60435 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:56:05.427282 3.004101 tcp 10.0.2.105 60436 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:56:14.430153 0.000000 tcp 10.0.2.105 60436 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 12:56:18.966318 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 12:56:20.429195 3.168193 tcp 10.0.2.105 60437 -> 46.48.223.67 15494 FSPA* 0 0 14 1765 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:23.595072 0.037695 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:01:23.632874 2.973281 tcp 10.0.2.105 60438 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:01:32.587572 0.000000 tcp 10.0.2.105 60438 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:01:38.608986 0.118520 tcp 10.0.2.105 60439 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:38.727812 0.063813 tcp 10.0.2.105 60440 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:38.791930 0.159386 tcp 10.0.2.105 60441 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:39.001931 2.998886 tcp 10.0.2.105 60442 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:01:47.999734 0.000000 tcp 10.0.2.105 60442 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:01:53.998342 0.062629 tcp 10.0.2.105 60443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:54.061228 0.065900 tcp 10.0.2.105 60444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:54.127326 0.157499 tcp 10.0.2.105 60445 -> 195.113.214.249 443 SRPA* 0 0 42 22862 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:54.332735 3.030688 tcp 10.0.2.105 60446 -> 46.48.223.67 15494 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:57.060073 0.061972 tcp 10.0.2.105 60447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:57.122386 0.062589 tcp 10.0.2.105 60448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:57.185221 0.155760 tcp 10.0.2.105 60449 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:01:57.363721 3.003788 tcp 10.0.2.105 60450 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:02:01.811362 3.002434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:02:06.376462 0.000000 tcp 10.0.2.105 60450 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:02:08.819535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:02:12.365101 2.994162 tcp 10.0.2.105 60451 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:02:16.821147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:02:21.364598 0.000000 tcp 10.0.2.105 60451 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:02:25.964524 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:02:27.369811 3.055935 tcp 10.0.2.105 60452 -> 46.48.223.67 15494 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:02:32.824489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:03:04.830291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:07:30.422517 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:07:30.422715 3.003660 tcp 10.0.2.105 60453 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:07:39.425157 0.000000 tcp 10.0.2.105 60453 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:07:45.425159 0.127278 tcp 10.0.2.105 60454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:07:45.552731 0.062445 tcp 10.0.2.105 60455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:07:45.615418 0.150496 tcp 10.0.2.105 60456 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:07:45.890337 2.998267 tcp 10.0.2.105 60457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:07:54.897210 0.000000 tcp 10.0.2.105 60457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:08:00.886773 0.101643 tcp 10.0.2.105 60458 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:00.988680 0.065285 tcp 10.0.2.105 60459 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:01.054241 0.160818 tcp 10.0.2.105 60460 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:01.258190 2.634765 tcp 10.0.2.105 60461 -> 46.48.223.67 15494 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:03.007514 0.063282 tcp 10.0.2.105 60462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:03.071042 0.061792 tcp 10.0.2.105 60463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:03.133148 0.154560 tcp 10.0.2.105 60464 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:08:03.893147 3.005897 tcp 10.0.2.105 60465 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:08:12.893113 0.000000 tcp 10.0.2.105 60465 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:08:18.892357 3.003764 tcp 10.0.2.105 60466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:08:27.894651 0.000000 tcp 10.0.2.105 60466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:08:32.471380 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:08:33.893537 1.756753 tcp 10.0.2.105 60467 -> 46.48.223.67 15494 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:09:08.835743 3.002194 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:09:15.843684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:09:23.846895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:09:39.850190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:10:11.854157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:15:12.396997 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:15:12.397102 0.000000 udp 10.0.2.105 7010 -> 5.13.46.209 2778 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:15:27.980996 0.066533 tcp 10.0.2.105 60468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:28.047368 0.065186 tcp 10.0.2.105 60469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:28.112866 0.157237 tcp 10.0.2.105 60470 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:28.270598 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:15:45.665074 0.062889 tcp 10.0.2.105 60471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:45.728232 0.065315 tcp 10.0.2.105 60472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:45.793402 0.156513 tcp 10.0.2.105 60473 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:15:45.950541 0.000000 udp 10.0.2.105 7010 -> 190.142.167.215 3699 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:16:02.298756 0.064085 tcp 10.0.2.105 60474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:02.363134 0.064290 tcp 10.0.2.105 60475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:02.427742 0.157919 tcp 10.0.2.105 60476 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:02.586130 0.046333 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:02.617035 0.171046 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:02.842000 0.176692 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:02.988989 0.251792 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:03.204546 0.174083 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:03.416207 0.218878 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:03.627923 0.064710 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:03.845344 0.191380 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:04.233063 0.167404 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:04.460728 0.060840 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2611 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:04.667676 0.064755 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:04.864913 0.069639 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:04.920264 0.044832 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:05.146660 0.000000 udp 10.0.2.105 7010 -> 84.173.15.99 7912 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:16:05.663479 2.993743 tcp 10.0.2.105 60477 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:14.672578 0.000000 tcp 10.0.2.105 60477 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:15.861682 3.000108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:16:20.665236 0.064418 tcp 10.0.2.105 60478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:20.729937 0.062944 tcp 10.0.2.105 60479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:20.793177 0.154916 tcp 10.0.2.105 60480 -> 195.113.214.249 443 SRPA* 0 0 19 9210 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:21.068529 3.000362 tcp 10.0.2.105 60481 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:22.867604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:16:23.068713 0.064284 tcp 10.0.2.105 60482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:23.133277 0.063017 tcp 10.0.2.105 60483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:23.196598 0.153892 tcp 10.0.2.105 60484 -> 195.113.214.249 443 SRPA* 0 0 21 9318 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:23.350956 0.000000 udp 10.0.2.105 7010 -> 99.27.225.240 5572 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:16:30.067860 0.000000 tcp 10.0.2.105 60481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:30.868763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:16:36.067386 0.064224 tcp 10.0.2.105 60485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:36.131900 0.212801 tcp 10.0.2.105 60486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:36.344988 0.161172 tcp 10.0.2.105 60487 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:36.558513 2.194828 tcp 10.0.2.105 60488 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:38.309691 0.063536 tcp 10.0.2.105 60489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:38.373490 0.064454 tcp 10.0.2.105 60490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:38.438253 0.154838 tcp 10.0.2.105 60491 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:38.753550 3.001103 tcp 10.0.2.105 60492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:39.231450 0.063708 tcp 10.0.2.105 60493 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:39.295435 0.064283 tcp 10.0.2.105 60494 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:39.359995 0.164764 tcp 10.0.2.105 60495 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:39.525321 0.056834 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:39.871921 0.081605 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:39.932459 0.286900 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:40.210081 0.102874 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:40.540536 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:16:46.872177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:16:47.913666 0.000000 tcp 10.0.2.105 60492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:53.859322 2.981783 tcp 10.0.2.105 60496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:16:56.344388 0.063070 tcp 10.0.2.105 60497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:56.407703 0.064251 tcp 10.0.2.105 60498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:56.472262 0.155578 tcp 10.0.2.105 60499 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:16:56.628389 0.190576 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:16:56.811436 0.000000 udp 10.0.2.105 7010 -> 84.186.89.134 7869 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:17:02.787851 0.000000 tcp 10.0.2.105 60496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:17:08.753622 1.762722 tcp 10.0.2.105 60500 -> 46.48.223.67 15494 FSPA* 0 0 12 1613 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:13.250599 0.063425 tcp 10.0.2.105 60501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:13.314370 0.064380 tcp 10.0.2.105 60502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:13.378627 0.153580 tcp 10.0.2.105 60503 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:13.532760 0.147242 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:13.669681 0.166348 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:13.878002 0.058600 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:13.942628 0.210308 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:14.129135 0.268482 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:14.388334 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:17:18.890855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:17:29.756171 0.065839 tcp 10.0.2.105 60504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:29.822328 0.067050 tcp 10.0.2.105 60505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:29.889626 0.192998 tcp 10.0.2.105 60506 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:17:30.083144 0.150861 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.220664 0.115226 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.459406 0.082261 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.514142 0.142336 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.703797 0.167165 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.848999 0.096687 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:17:30.930525 0.216634 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:22:10.507789 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:22:10.507895 3.004006 tcp 10.0.2.105 60507 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:19.510582 0.000000 tcp 10.0.2.105 60507 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:25.510512 0.063355 tcp 10.0.2.105 60508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:25.574176 0.065913 tcp 10.0.2.105 60509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:25.640403 0.156091 tcp 10.0.2.105 60510 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:25.967540 3.006496 tcp 10.0.2.105 60511 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:34.972720 0.000000 tcp 10.0.2.105 60511 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:40.961772 0.062910 tcp 10.0.2.105 60512 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:41.024967 0.064196 tcp 10.0.2.105 60513 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:41.089538 0.158996 tcp 10.0.2.105 60514 -> 195.113.214.249 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:41.451605 2.977776 tcp 10.0.2.105 60515 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:43.845017 0.062264 tcp 10.0.2.105 60516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:43.907552 0.063745 tcp 10.0.2.105 60517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:43.971634 0.156756 tcp 10.0.2.105 60518 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:22:44.429604 3.001065 tcp 10.0.2.105 60519 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:53.429066 0.000000 tcp 10.0.2.105 60519 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:22:59.429071 3.006040 tcp 10.0.2.105 60520 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:23:08.430981 0.000000 tcp 10.0.2.105 60520 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:23:12.967331 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:23:14.429462 1.771353 tcp 10.0.2.105 60521 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:23:22.894184 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:23:29.901573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:23:37.903270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:23:53.906018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:24:25.912373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:28:16.194048 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:28:16.194139 2.993563 tcp 10.0.2.105 60522 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:28:25.196158 0.000000 tcp 10.0.2.105 60522 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:28:31.196429 0.064935 tcp 10.0.2.105 60523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:31.261576 0.063383 tcp 10.0.2.105 60524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:31.325252 0.151953 tcp 10.0.2.105 60525 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:31.514611 2.994974 tcp 10.0.2.105 60526 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:28:40.508348 0.000000 tcp 10.0.2.105 60526 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:28:46.507839 0.064781 tcp 10.0.2.105 60527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:46.572899 0.064232 tcp 10.0.2.105 60528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:46.638773 0.153115 tcp 10.0.2.105 60529 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:46.906507 2.203965 tcp 10.0.2.105 60530 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:48.729798 0.064302 tcp 10.0.2.105 60531 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:48.794387 0.065452 tcp 10.0.2.105 60532 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:48.860100 0.161911 tcp 10.0.2.105 60533 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:28:49.110706 2.978781 tcp 10.0.2.105 60534 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:28:58.036417 0.000000 tcp 10.0.2.105 60534 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:29:04.022510 3.004158 tcp 10.0.2.105 60535 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:29:13.025029 0.000000 tcp 10.0.2.105 60535 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:29:17.962053 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:29:19.023654 1.755004 tcp 10.0.2.105 60536 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:30:29.917126 3.002824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:30:36.925386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:30:44.927101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:31:00.932470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:31:32.936091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:34:20.777656 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:34:20.777874 3.003754 tcp 10.0.2.105 60537 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:34:29.780526 0.000000 tcp 10.0.2.105 60537 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:34:35.780674 0.064726 tcp 10.0.2.105 60538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:35.845665 0.066102 tcp 10.0.2.105 60539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:35.912087 0.158697 tcp 10.0.2.105 60540 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:36.105386 2.998412 tcp 10.0.2.105 60541 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:34:45.102529 0.000000 tcp 10.0.2.105 60541 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:34:51.101878 0.063874 tcp 10.0.2.105 60542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:51.165972 0.064861 tcp 10.0.2.105 60543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:51.231181 0.154482 tcp 10.0.2.105 60544 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:51.409641 4.542952 tcp 10.0.2.105 60545 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:55.652012 0.063449 tcp 10.0.2.105 60546 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:55.715895 0.068327 tcp 10.0.2.105 60547 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:55.784478 0.155566 tcp 10.0.2.105 60548 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:34:55.952841 2.999516 tcp 10.0.2.105 60549 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:35:04.951086 0.000000 tcp 10.0.2.105 60549 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:35:10.955026 3.002172 tcp 10.0.2.105 60550 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:35:19.953324 0.000000 tcp 10.0.2.105 60550 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:35:24.468787 0.068384 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:35:26.000719 1.743545 tcp 10.0.2.105 60551 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:37:36.942895 3.001076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:37:43.949062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:37:51.951176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:38:07.953895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:38:39.959490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:40:27.695683 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:40:27.695886 2.993299 tcp 10.0.2.105 60552 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:40:36.687875 0.000000 tcp 10.0.2.105 60552 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:40:42.698438 0.062772 tcp 10.0.2.105 60553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:42.761483 0.064801 tcp 10.0.2.105 60554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:42.826530 0.151417 tcp 10.0.2.105 60555 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:43.081181 3.000101 tcp 10.0.2.105 60556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:40:52.080186 0.000000 tcp 10.0.2.105 60556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:40:58.079507 0.063690 tcp 10.0.2.105 60557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:58.143473 0.064596 tcp 10.0.2.105 60558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:58.208364 0.157659 tcp 10.0.2.105 60559 -> 195.113.214.249 443 SRPA* 0 0 71 70012 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:40:58.552734 3.000869 tcp 10.0.2.105 60560 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:41:07.552611 0.000000 tcp 10.0.2.105 60560 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:41:13.550909 3.004207 tcp 10.0.2.105 60561 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:41:22.556256 0.000000 tcp 10.0.2.105 60561 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:41:27.470756 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:44:43.965844 3.002035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:44:50.973446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:44:58.975004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:45:14.977941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:45:46.984009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:48:00.776555 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:48:00.776709 0.000000 udp 10.0.2.105 7010 -> 99.27.225.240 5572 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:48:19.655678 0.066082 tcp 10.0.2.105 60562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:19.722100 0.062318 tcp 10.0.2.105 60563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:19.784773 0.153585 tcp 10.0.2.105 60564 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:19.938938 0.000000 udp 10.0.2.105 7010 -> 84.173.15.99 7912 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:48:36.348209 0.065048 tcp 10.0.2.105 60565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:36.413605 0.064324 tcp 10.0.2.105 60566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:36.478214 0.147733 tcp 10.0.2.105 60567 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:36.626467 0.165623 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:48:36.926003 0.000000 udp 10.0.2.105 7010 -> 84.186.89.134 7869 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:48:43.568217 3.004483 tcp 10.0.2.105 60568 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:48:52.571395 0.000000 tcp 10.0.2.105 60568 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:48:55.545894 0.064359 tcp 10.0.2.105 60569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:55.610525 0.064000 tcp 10.0.2.105 60570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:55.674770 0.158426 tcp 10.0.2.105 60571 -> 195.113.214.249 443 SRPA* 0 0 42 21258 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:55.833839 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:48:58.570053 0.063219 tcp 10.0.2.105 60572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:58.633587 0.064900 tcp 10.0.2.105 60573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:58.698804 0.153596 tcp 10.0.2.105 60574 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:48:58.864598 2.999819 tcp 10.0.2.105 60575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:49:07.862929 0.000000 tcp 10.0.2.105 60575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:49:12.289782 0.063940 tcp 10.0.2.105 60576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:12.354044 0.064877 tcp 10.0.2.105 60577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:12.419199 0.155652 tcp 10.0.2.105 60578 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:12.575361 0.179782 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:12.726116 0.170349 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:12.879242 0.046572 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:12.910063 0.255529 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:13.128000 0.218580 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:13.339377 0.174100 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:13.509907 0.064004 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:13.572697 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 13:49:32.448832 0.061664 tcp 10.0.2.105 60579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:32.510762 0.064087 tcp 10.0.2.105 60580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:32.575118 0.155858 tcp 10.0.2.105 60581 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:49:32.731525 0.169206 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:32.877055 0.127681 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.016475 0.069502 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.070622 0.058452 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.128809 0.042555 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.180493 0.055386 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.244348 0.291544 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.526703 0.104768 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.598864 0.083396 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.661066 0.191399 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 5 1850 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.844962 0.143923 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:33.981103 0.167298 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.126677 0.244393 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.362698 0.055848 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.427031 0.163456 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.568151 0.150914 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.705270 0.143235 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.804916 0.168439 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:34.950623 0.092586 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:35.028062 0.215067 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:35.235801 0.112736 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:49:35.311389 0.083738 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/11 13:54:13.863187 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:54:13.863270 2.993771 tcp 10.0.2.105 60582 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:22.865564 0.000000 tcp 10.0.2.105 60582 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:28.866263 0.063674 tcp 10.0.2.105 60583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:28.930222 0.063294 tcp 10.0.2.105 60584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:28.993837 0.153686 tcp 10.0.2.105 60585 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:29.197214 3.001965 tcp 10.0.2.105 60586 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:38.197956 0.000000 tcp 10.0.2.105 60586 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:44.196726 0.063951 tcp 10.0.2.105 60587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:44.260999 0.063732 tcp 10.0.2.105 60588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:44.324936 0.155052 tcp 10.0.2.105 60589 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:44.647020 4.152544 tcp 10.0.2.105 60590 -> 46.48.223.67 15494 FSPA* 0 0 14 1759 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:48.496802 0.064866 tcp 10.0.2.105 60591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:48.561934 0.063407 tcp 10.0.2.105 60592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:48.625673 0.155738 tcp 10.0.2.105 60593 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:54:48.799785 3.007474 tcp 10.0.2.105 60594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:50.998859 3.001250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 13:54:57.816065 0.000000 tcp 10.0.2.105 60594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:54:58.006066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:55:03.794722 2.993656 tcp 10.0.2.105 60595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:55:06.007771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:55:12.797682 0.000000 tcp 10.0.2.105 60595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 13:55:17.464389 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 13:55:18.796771 1.706675 tcp 10.0.2.105 60596 -> 46.48.223.67 15494 FSPA* 0 0 14 1759 flow=From-Botnet-V2-TCP-Established 1970/02/11 13:55:22.010530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 13:55:54.017145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:00:20.504630 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:00:20.504856 3.012109 tcp 10.0.2.105 60597 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:00:29.503050 0.000000 tcp 10.0.2.105 60597 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:00:35.503391 0.064803 tcp 10.0.2.105 60598 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:35.568475 0.064566 tcp 10.0.2.105 60599 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:35.633338 0.148914 tcp 10.0.2.105 60600 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:35.809749 3.006533 tcp 10.0.2.105 60601 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:00:44.817187 0.000000 tcp 10.0.2.105 60601 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:00:50.804065 0.062847 tcp 10.0.2.105 60602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:50.867162 0.063638 tcp 10.0.2.105 60603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:50.931082 0.149844 tcp 10.0.2.105 60604 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:51.235382 2.041373 tcp 10.0.2.105 60605 -> 46.48.223.67 15494 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:52.986939 0.062882 tcp 10.0.2.105 60606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:53.050075 0.064706 tcp 10.0.2.105 60607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:53.115107 0.149688 tcp 10.0.2.105 60608 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:00:53.276967 2.994495 tcp 10.0.2.105 60609 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:01:02.270119 0.000000 tcp 10.0.2.105 60609 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:01:08.278776 3.004681 tcp 10.0.2.105 60610 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:01:17.282158 0.000000 tcp 10.0.2.105 60610 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:01:21.967681 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:01:23.280793 1.724741 tcp 10.0.2.105 60611 -> 46.48.223.67 15494 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:01:58.021854 3.003365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:02:05.032988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:02:13.031892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:02:29.034792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:03:01.041170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:06:25.004356 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:06:25.004450 2.993221 tcp 10.0.2.105 60612 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:06:34.009068 0.000000 tcp 10.0.2.105 60612 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:06:40.007243 0.063670 tcp 10.0.2.105 60613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:40.071240 0.064651 tcp 10.0.2.105 60614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:40.136211 0.149741 tcp 10.0.2.105 60615 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:40.606141 2.994784 tcp 10.0.2.105 60616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:06:49.599887 0.000000 tcp 10.0.2.105 60616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:06:55.598658 0.064203 tcp 10.0.2.105 60617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:55.663149 0.063372 tcp 10.0.2.105 60618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:55.726827 0.152474 tcp 10.0.2.105 60619 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:55.923442 2.605237 tcp 10.0.2.105 60620 -> 46.48.223.67 15494 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:58.138916 0.063418 tcp 10.0.2.105 60621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:58.202629 0.063722 tcp 10.0.2.105 60622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:58.266643 0.150156 tcp 10.0.2.105 60623 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:06:58.528957 3.007672 tcp 10.0.2.105 60624 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:07:07.541923 0.000000 tcp 10.0.2.105 60624 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:07:13.523801 2.994388 tcp 10.0.2.105 60625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:07:22.526763 0.000000 tcp 10.0.2.105 60625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:07:27.463877 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:07:28.525601 2.455524 tcp 10.0.2.105 60626 -> 46.48.223.67 15494 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:09:05.046378 3.423000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:09:12.440618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:09:20.366190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:09:36.218464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:10:08.074825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:12:30.319620 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:12:30.319760 3.003861 tcp 10.0.2.105 60627 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:12:39.322116 0.000000 tcp 10.0.2.105 60627 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:12:45.323463 0.065295 tcp 10.0.2.105 60628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:12:45.389051 0.068106 tcp 10.0.2.105 60629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:12:45.457413 0.147807 tcp 10.0.2.105 60630 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:12:45.826685 2.998945 tcp 10.0.2.105 60631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:12:54.824423 0.000000 tcp 10.0.2.105 60631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:13:00.823523 0.063830 tcp 10.0.2.105 60632 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:01.035104 0.065313 tcp 10.0.2.105 60633 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:01.100684 0.150740 tcp 10.0.2.105 60634 -> 195.113.214.249 443 SRPA* 0 0 27 14019 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:01.663994 3.116970 tcp 10.0.2.105 60635 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:04.455159 0.064357 tcp 10.0.2.105 60636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:04.519779 0.062858 tcp 10.0.2.105 60637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:04.582962 0.149211 tcp 10.0.2.105 60638 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:13:04.781231 3.001610 tcp 10.0.2.105 60639 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:13:13.781886 0.000000 tcp 10.0.2.105 60639 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:13:19.780804 3.003675 tcp 10.0.2.105 60640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:13:28.783069 0.000000 tcp 10.0.2.105 60640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:13:33.470223 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:13:34.782183 1.754288 tcp 10.0.2.105 60641 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:16:12.080769 3.001883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:16:19.087738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:16:27.089221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:16:43.092709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:17:15.098805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:19:52.505389 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:19:52.505484 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 14:20:07.968857 0.063869 tcp 10.0.2.105 60642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:08.032977 0.062648 tcp 10.0.2.105 60643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:08.095880 0.153041 tcp 10.0.2.105 60644 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:08.249411 0.157053 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:08.444138 0.177287 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:08.593931 0.219829 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:08.805521 0.247151 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:09.035757 0.172461 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:09.342333 0.045105 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:09.392211 0.064219 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:10.440153 0.196400 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:11.296796 0.077657 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:11.361166 0.056001 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:11.659538 0.042888 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:11.758490 0.057351 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:11.880575 0.166294 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:12.026137 0.127985 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:12.598650 0.299366 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:12.888742 0.104716 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:13.061957 0.091062 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:13.422815 0.418660 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:13.835159 0.147011 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:13.972514 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 14:20:21.547112 3.003925 tcp 10.0.2.105 60645 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:20:30.549840 0.000000 tcp 10.0.2.105 60645 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:20:31.301534 0.064499 tcp 10.0.2.105 60646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:31.366323 0.063745 tcp 10.0.2.105 60647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:31.430511 0.149695 tcp 10.0.2.105 60648 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:31.580769 0.162772 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:32.082092 0.150897 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:32.379760 0.165053 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:32.851957 0.239112 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.087050 0.128140 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.171145 0.160174 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.334437 0.096514 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.441985 0.212123 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.646859 0.115504 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:33.721619 0.076351 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:20:36.549222 0.061494 tcp 10.0.2.105 60649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:36.611001 0.062552 tcp 10.0.2.105 60650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:36.673860 0.150052 tcp 10.0.2.105 60651 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:37.086890 2.996532 tcp 10.0.2.105 60652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:20:46.082029 0.000000 tcp 10.0.2.105 60652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:20:52.081571 0.064969 tcp 10.0.2.105 60653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:52.146371 0.064143 tcp 10.0.2.105 60654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:52.210808 0.155911 tcp 10.0.2.105 60655 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:52.895948 4.808227 tcp 10.0.2.105 60656 -> 46.48.223.67 15494 SPA_* 0 0 12 1490 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:57.704789 0.062560 tcp 10.0.2.105 60657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:57.767649 0.062781 tcp 10.0.2.105 60658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:57.830683 0.151935 tcp 10.0.2.105 60659 -> 195.113.214.249 443 SRPA* 0 0 35 18782 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:58.185108 0.000096 tcp 10.0.2.105 60656 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:20:58.185488 2.998316 tcp 10.0.2.105 60660 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:21:07.182660 0.000000 tcp 10.0.2.105 60660 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:21:13.181028 3.004442 tcp 10.0.2.105 60661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:21:22.183859 0.000000 tcp 10.0.2.105 60661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:21:26.970175 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:21:28.182322 1.750374 tcp 10.0.2.105 60662 -> 46.48.223.67 15494 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:23:19.105292 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:23:26.112108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:23:34.113663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:23:50.116538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:24:22.122809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:26:29.927057 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:26:29.927150 2.993342 tcp 10.0.2.105 60663 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:26:38.919350 0.000000 tcp 10.0.2.105 60663 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:26:44.929819 0.064807 tcp 10.0.2.105 60664 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:26:44.995006 0.063687 tcp 10.0.2.105 60665 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:26:45.058946 0.148087 tcp 10.0.2.105 60666 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:26:45.565440 2.997756 tcp 10.0.2.105 60667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:26:54.561517 0.000000 tcp 10.0.2.105 60667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:27:00.561066 0.063139 tcp 10.0.2.105 60668 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:00.624472 0.064125 tcp 10.0.2.105 60669 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:00.688881 0.148228 tcp 10.0.2.105 60670 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:01.160464 3.961832 tcp 10.0.2.105 60671 -> 46.48.223.67 15494 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:04.734010 0.062258 tcp 10.0.2.105 60672 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:04.796603 0.064178 tcp 10.0.2.105 60673 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:04.861040 0.149540 tcp 10.0.2.105 60674 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:05.122534 2.998159 tcp 10.0.2.105 60675 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:27:14.119986 0.000000 tcp 10.0.2.105 60675 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:27:20.118277 3.004810 tcp 10.0.2.105 60676 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:27:29.121583 0.000000 tcp 10.0.2.105 60676 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:27:33.967828 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:27:35.120416 0.350225 tcp 10.0.2.105 60677 -> 46.48.223.67 15494 SPA_* 0 0 9 1214 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:27:44.534538 0.000319 tcp 10.0.2.105 60677 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:30:26.128891 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:30:33.136112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:30:41.137474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:30:57.140306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:31:29.146054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:32:44.535288 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:32:44.535537 2.993800 tcp 10.0.2.105 60678 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:32:53.528193 0.000000 tcp 10.0.2.105 60678 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:32:59.537852 0.063772 tcp 10.0.2.105 60679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:32:59.601880 0.064347 tcp 10.0.2.105 60680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:32:59.666483 0.147519 tcp 10.0.2.105 60681 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:32:59.824717 2.996798 tcp 10.0.2.105 60682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:08.820001 0.000000 tcp 10.0.2.105 60682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:14.819291 0.063361 tcp 10.0.2.105 60683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:14.882902 0.064224 tcp 10.0.2.105 60684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:14.947397 0.153761 tcp 10.0.2.105 60685 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:15.122809 2.042210 tcp 10.0.2.105 60686 -> 46.48.223.67 15494 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:16.879554 0.063487 tcp 10.0.2.105 60687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:16.943320 0.062535 tcp 10.0.2.105 60688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:17.006094 0.148063 tcp 10.0.2.105 60689 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:33:17.165169 3.001197 tcp 10.0.2.105 60690 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:26.165057 0.000000 tcp 10.0.2.105 60690 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:32.163598 2.994196 tcp 10.0.2.105 60691 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:41.166558 0.000000 tcp 10.0.2.105 60691 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:33:45.963354 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:33:47.165326 1.772397 tcp 10.0.2.105 60692 -> 46.48.223.67 15494 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:37:33.152872 3.001924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:37:40.159513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:37:48.161768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:38:04.163964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:38:36.173360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:38:48.939401 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:38:48.939580 3.005833 tcp 10.0.2.105 60693 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:38:57.941749 0.000000 tcp 10.0.2.105 60693 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:03.941958 0.064478 tcp 10.0.2.105 60694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:04.006717 0.068062 tcp 10.0.2.105 60695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:04.075026 0.155630 tcp 10.0.2.105 60696 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:04.251984 3.003165 tcp 10.0.2.105 60697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:13.253894 0.000000 tcp 10.0.2.105 60697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:19.253403 0.065204 tcp 10.0.2.105 60698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:19.318894 0.063155 tcp 10.0.2.105 60699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:19.382335 0.152995 tcp 10.0.2.105 60700 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:19.622159 2.034478 tcp 10.0.2.105 60701 -> 46.48.223.67 15494 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:21.359573 0.063496 tcp 10.0.2.105 60702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:21.423343 0.065047 tcp 10.0.2.105 60703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:21.488624 0.153244 tcp 10.0.2.105 60704 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:39:21.656806 2.993958 tcp 10.0.2.105 60705 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:30.649090 0.000000 tcp 10.0.2.105 60705 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:36.657690 3.004162 tcp 10.0.2.105 60706 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:45.661008 0.000000 tcp 10.0.2.105 60706 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:39:50.467194 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:39:51.659490 1.780602 tcp 10.0.2.105 60707 -> 46.48.223.67 15494 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:44:40.176791 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:44:47.183878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:44:55.185705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:45:11.188932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:45:43.194785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:51:00.110477 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:51:00.110650 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 14:51:18.110903 0.065549 tcp 10.0.2.105 60708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:18.176826 0.062115 tcp 10.0.2.105 60709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:18.239257 0.151964 tcp 10.0.2.105 60710 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:18.391737 0.219708 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:18.603886 0.247018 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:18.815225 0.269238 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:19.317310 0.172266 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:19.461529 0.046404 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:19.571166 0.171013 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.021513 0.062052 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.082370 0.053297 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.159741 0.042343 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.292929 0.129085 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.487693 0.170333 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.635548 0.210650 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.913399 0.068622 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:20.965698 0.172322 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:21.545754 0.107355 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:21.618140 0.283984 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:21.893369 0.084560 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:21.960306 0.450108 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:22.401185 0.146380 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:22.599721 0.162219 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:22.739657 0.150441 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.017700 0.167868 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.162256 0.238380 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.392748 0.139886 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.482730 2.985304 tcp 10.0.2.105 60711 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:51:23.495335 0.214850 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.710771 0.118596 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.790686 0.082670 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:23.910974 0.162882 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:24.053255 0.101283 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/11 14:51:32.476899 0.000000 tcp 10.0.2.105 60711 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:51:38.476040 0.064702 tcp 10.0.2.105 60712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:38.540997 0.065338 tcp 10.0.2.105 60713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:38.606647 0.154532 tcp 10.0.2.105 60714 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:38.851245 2.998971 tcp 10.0.2.105 60715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:51:47.849018 0.000000 tcp 10.0.2.105 60715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:51:53.848185 0.063391 tcp 10.0.2.105 60716 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:53.911917 0.064832 tcp 10.0.2.105 60717 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:53.977077 0.154222 tcp 10.0.2.105 60718 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:54.298626 2.010905 tcp 10.0.2.105 60719 -> 46.48.223.67 15494 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:55.998383 0.063132 tcp 10.0.2.105 60720 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:56.061794 0.063929 tcp 10.0.2.105 60721 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:56.125982 0.152326 tcp 10.0.2.105 60722 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:51:56.309754 3.005570 tcp 10.0.2.105 60723 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:52:05.314038 0.000000 tcp 10.0.2.105 60723 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:52:11.302972 3.003742 tcp 10.0.2.105 60724 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:52:20.309350 0.000000 tcp 10.0.2.105 60724 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:52:24.962754 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:52:26.304862 1.737071 tcp 10.0.2.105 60725 -> 46.48.223.67 15494 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:54:50.203238 3.002261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 14:54:57.211398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:55:05.212822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:55:21.215641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:55:53.221937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 14:57:28.038665 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:57:28.038767 3.003686 tcp 10.0.2.105 60726 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:57:37.040731 0.000000 tcp 10.0.2.105 60726 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:57:43.042139 0.063763 tcp 10.0.2.105 60727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:43.106209 0.062480 tcp 10.0.2.105 60728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:43.168962 0.154365 tcp 10.0.2.105 60729 -> 195.113.214.249 443 SRPA* 0 0 36 18014 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:43.345656 2.998585 tcp 10.0.2.105 60730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:57:52.342937 0.000000 tcp 10.0.2.105 60730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:57:58.342336 0.063763 tcp 10.0.2.105 60731 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:58.406454 0.064554 tcp 10.0.2.105 60732 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:58.471321 0.153354 tcp 10.0.2.105 60733 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:57:58.681957 2.048218 tcp 10.0.2.105 60734 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:58:00.441138 0.062937 tcp 10.0.2.105 60735 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:58:00.504453 0.063953 tcp 10.0.2.105 60736 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:58:00.568775 0.151335 tcp 10.0.2.105 60737 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 14:58:00.730423 2.998863 tcp 10.0.2.105 60738 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:58:09.728137 0.000000 tcp 10.0.2.105 60738 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:58:15.726893 2.994445 tcp 10.0.2.105 60739 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:58:24.719321 0.000000 tcp 10.0.2.105 60739 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 14:58:29.466194 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 14:58:30.728756 1.764493 tcp 10.0.2.105 60740 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:01:57.228003 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:02:04.235359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:02:12.236420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:02:28.242131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:03:00.245600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:03:32.492711 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:03:32.492911 3.003243 tcp 10.0.2.105 60741 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:03:41.494654 0.000000 tcp 10.0.2.105 60741 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:03:47.495317 0.064714 tcp 10.0.2.105 60742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:03:47.560447 0.063230 tcp 10.0.2.105 60743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:03:47.623985 0.148710 tcp 10.0.2.105 60744 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:03:47.828084 3.000126 tcp 10.0.2.105 60745 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:03:56.837194 0.000000 tcp 10.0.2.105 60745 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:04:02.826053 0.063477 tcp 10.0.2.105 60746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:02.889774 0.064954 tcp 10.0.2.105 60747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:02.954974 0.151937 tcp 10.0.2.105 60748 -> 195.113.214.249 443 SRPA* 0 0 42 35858 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:03.131126 2.090729 tcp 10.0.2.105 60749 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:04.870189 0.061954 tcp 10.0.2.105 60750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:04.932423 0.062715 tcp 10.0.2.105 60751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:04.995451 0.155695 tcp 10.0.2.105 60752 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:04:05.222156 3.001282 tcp 10.0.2.105 60753 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:04:14.222265 0.000000 tcp 10.0.2.105 60753 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:04:20.220329 3.004652 tcp 10.0.2.105 60754 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:04:29.223470 0.000000 tcp 10.0.2.105 60754 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:04:33.970690 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:04:35.222347 1.741758 tcp 10.0.2.105 60755 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:09:04.252529 3.002436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:09:11.258634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:09:19.260040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:09:35.263401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:09:36.956457 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:09:36.956544 2.993906 tcp 10.0.2.105 60756 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:09:45.948265 0.000000 tcp 10.0.2.105 60756 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:09:51.958962 0.064183 tcp 10.0.2.105 60757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:09:52.023468 0.065515 tcp 10.0.2.105 60758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:09:52.089257 0.155121 tcp 10.0.2.105 60759 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:09:52.255156 2.997340 tcp 10.0.2.105 60760 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:01.250776 0.000000 tcp 10.0.2.105 60760 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:07.250305 0.063644 tcp 10.0.2.105 60761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:07.269791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:10:07.314232 0.064591 tcp 10.0.2.105 60762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:07.379086 0.149573 tcp 10.0.2.105 60763 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:07.725138 3.402330 tcp 10.0.2.105 60764 -> 46.48.223.67 15494 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:10.592205 0.063459 tcp 10.0.2.105 60765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:10.655979 0.063291 tcp 10.0.2.105 60766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:10.719531 0.151455 tcp 10.0.2.105 60767 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:10:11.127698 2.991241 tcp 10.0.2.105 60768 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:20.117807 0.000000 tcp 10.0.2.105 60768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:26.116591 2.994231 tcp 10.0.2.105 60769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:35.109533 0.000000 tcp 10.0.2.105 60769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:10:39.966489 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:10:41.118720 1.811976 tcp 10.0.2.105 60770 -> 46.48.223.67 15494 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:16:11.276483 3.000804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 15:16:18.283032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:16:26.736122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:16:42.551719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:17:14.303661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:21:35.710315 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:21:35.710494 0.221355 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:35.924465 0.574167 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:36.462189 0.161742 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:36.708364 0.179700 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:36.858673 0.046473 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:36.970842 0.172518 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:37.117241 0.064232 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:37.273382 0.060792 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:37.552987 0.042969 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:37.750683 0.056495 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:37.972905 0.169936 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.119531 0.130907 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.264186 0.071698 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.321432 0.173353 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.491445 0.108148 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.669770 0.295723 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:38.956359 0.088659 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.128606 0.191233 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.312436 0.150668 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.497217 0.173212 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.647297 0.161570 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.786332 0.150496 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:39.962999 0.744745 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:40.936786 0.132825 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:41.023369 0.219596 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:41.292970 0.114040 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:41.369176 0.083945 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:41.635373 0.169289 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:41.781794 0.110104 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:21:42.970270 3.003726 tcp 10.0.2.105 60771 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:21:51.974997 0.000000 tcp 10.0.2.105 60771 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:21:57.973265 0.064825 tcp 10.0.2.105 60772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:21:58.038341 0.063869 tcp 10.0.2.105 60773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:21:58.102512 0.152780 tcp 10.0.2.105 60774 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:21:58.337190 3.009552 tcp 10.0.2.105 60775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:07.344946 0.000000 tcp 10.0.2.105 60775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:13.334359 0.064823 tcp 10.0.2.105 60776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:13.399475 0.065578 tcp 10.0.2.105 60777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:13.465350 0.151212 tcp 10.0.2.105 60778 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:14.245210 3.383386 tcp 10.0.2.105 60779 -> 46.48.223.67 15494 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:17.155049 0.065061 tcp 10.0.2.105 60780 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:17.220460 0.064809 tcp 10.0.2.105 60781 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:17.285510 0.153866 tcp 10.0.2.105 60782 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:22:17.628921 3.004655 tcp 10.0.2.105 60783 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:26.632785 0.000000 tcp 10.0.2.105 60783 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:32.621437 3.004043 tcp 10.0.2.105 60784 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:41.624097 0.000000 tcp 10.0.2.105 60784 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:22:46.461011 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:22:47.622870 1.772959 tcp 10.0.2.105 60785 -> 46.48.223.67 15494 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:23:18.308925 3.002214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:23:25.317095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:23:33.318641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:23:49.321500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:24:21.327696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:27:49.400758 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:27:49.400902 3.000023 tcp 10.0.2.105 60786 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:27:58.399771 0.000000 tcp 10.0.2.105 60786 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:04.399757 0.064947 tcp 10.0.2.105 60787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:04.464972 0.063549 tcp 10.0.2.105 60788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:04.528794 0.153365 tcp 10.0.2.105 60789 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:04.819086 3.003869 tcp 10.0.2.105 60790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:13.821808 0.000000 tcp 10.0.2.105 60790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:19.822772 0.064031 tcp 10.0.2.105 60791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:19.887100 0.065293 tcp 10.0.2.105 60792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:19.952722 0.156410 tcp 10.0.2.105 60793 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:20.170290 2.216248 tcp 10.0.2.105 60794 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:21.899621 0.063310 tcp 10.0.2.105 60795 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:21.963224 0.064428 tcp 10.0.2.105 60796 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:22.028014 0.338039 tcp 10.0.2.105 60797 -> 195.113.214.249 443 SRPA* 0 0 73 77634 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:28:22.386731 2.991353 tcp 10.0.2.105 60798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:31.388112 0.000000 tcp 10.0.2.105 60798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:37.386021 2.993992 tcp 10.0.2.105 60799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:46.378844 0.000000 tcp 10.0.2.105 60799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:28:50.965147 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:28:52.387466 1.941415 tcp 10.0.2.105 60800 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:30:25.333640 3.003479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:30:32.340800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:30:40.342579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:30:56.345472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:31:28.351518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:33:54.321703 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:33:54.321792 3.003796 tcp 10.0.2.105 60801 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:03.324229 0.000000 tcp 10.0.2.105 60801 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:09.324937 0.065108 tcp 10.0.2.105 60802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:09.390320 0.064659 tcp 10.0.2.105 60803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:09.455284 0.151615 tcp 10.0.2.105 60804 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:11.161593 2.997644 tcp 10.0.2.105 60805 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:20.158652 0.000000 tcp 10.0.2.105 60805 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:26.157725 0.064051 tcp 10.0.2.105 60806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:26.222023 0.066308 tcp 10.0.2.105 60807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:26.288268 0.148119 tcp 10.0.2.105 60808 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:26.458813 2.049617 tcp 10.0.2.105 60809 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:28.195665 0.064446 tcp 10.0.2.105 60810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:28.259932 0.065346 tcp 10.0.2.105 60811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:28.325644 0.155214 tcp 10.0.2.105 60812 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:34:28.508621 3.006056 tcp 10.0.2.105 60813 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:37.513476 0.000000 tcp 10.0.2.105 60813 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:43.502230 3.004029 tcp 10.0.2.105 60814 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:52.505148 0.000000 tcp 10.0.2.105 60814 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:34:57.462221 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:34:58.503760 1.704341 tcp 10.0.2.105 60815 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:37:32.357580 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:37:39.365121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:37:47.368870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:38:03.369456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:38:35.376064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:40:00.218859 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:40:00.218943 2.995679 tcp 10.0.2.105 60816 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:09.210187 0.000000 tcp 10.0.2.105 60816 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:15.211370 0.064983 tcp 10.0.2.105 60817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:15.276680 0.064390 tcp 10.0.2.105 60818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:15.341364 0.154254 tcp 10.0.2.105 60819 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:15.667944 3.011222 tcp 10.0.2.105 60820 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:24.674831 0.000000 tcp 10.0.2.105 60820 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:30.661599 0.064304 tcp 10.0.2.105 60821 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:30.726206 0.064309 tcp 10.0.2.105 60822 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:30.790825 0.144823 tcp 10.0.2.105 60823 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:31.084824 2.020578 tcp 10.0.2.105 60824 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:32.807664 0.062641 tcp 10.0.2.105 60825 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:32.870560 0.066078 tcp 10.0.2.105 60826 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:32.936925 0.152503 tcp 10.0.2.105 60827 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:40:33.105630 2.994322 tcp 10.0.2.105 60828 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:42.102752 0.000000 tcp 10.0.2.105 60828 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:48.111655 2.988997 tcp 10.0.2.105 60829 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:40:57.098950 0.000000 tcp 10.0.2.105 60829 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:41:01.966069 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:41:03.108286 1.689397 tcp 10.0.2.105 60830 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:44:39.381909 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:44:46.393686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:44:54.390277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:45:10.393446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:45:42.399564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:51:42.447418 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:51:42.447560 0.217612 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 1969 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:42.657584 0.251777 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:42.877146 0.163043 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.087893 0.177291 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.238403 0.046789 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.308608 0.170935 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.464192 0.041543 udp 10.0.2.105 7010 <-> 82.20.121.6 2633 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.514398 0.056678 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.572287 0.169654 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.732659 0.062438 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.793894 0.053971 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.852713 0.127432 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:43.980014 0.067580 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.032651 0.172297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.201677 0.101940 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.299880 0.287148 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.577746 0.084041 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.639888 0.168409 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.785547 0.164257 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:44.965601 0.149064 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:45.100882 0.175368 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:45.268855 0.150345 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:45.406985 0.638576 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.037614 0.129190 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.120802 0.081911 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.212356 0.161052 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.350567 0.098998 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.432730 0.206526 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:46.631496 0.110011 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/11 15:51:49.828003 3.003863 tcp 10.0.2.105 60831 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:51:58.830392 0.000000 tcp 10.0.2.105 60831 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:04.831179 0.065096 tcp 10.0.2.105 60832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:04.896567 0.064183 tcp 10.0.2.105 60833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:04.961155 0.152731 tcp 10.0.2.105 60834 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:05.126674 2.997280 tcp 10.0.2.105 60835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:14.122721 0.000000 tcp 10.0.2.105 60835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:20.121851 0.063769 tcp 10.0.2.105 60836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:20.185935 0.065636 tcp 10.0.2.105 60837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:20.251893 0.154264 tcp 10.0.2.105 60838 -> 195.113.214.249 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:20.416569 2.102230 tcp 10.0.2.105 60839 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:22.227006 0.063311 tcp 10.0.2.105 60840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:22.290667 0.063498 tcp 10.0.2.105 60841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:22.354446 0.149041 tcp 10.0.2.105 60842 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:52:22.518973 2.999977 tcp 10.0.2.105 60843 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:31.517887 0.000000 tcp 10.0.2.105 60843 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:37.516853 2.993846 tcp 10.0.2.105 60844 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:46.509258 0.000000 tcp 10.0.2.105 60844 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:52:51.466600 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:52:52.518200 1.791081 tcp 10.0.2.105 60845 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:54:51.411777 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 15:54:58.418878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:55:06.420229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:55:22.423329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:55:54.429621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 15:57:54.302097 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:57:54.302188 3.003853 tcp 10.0.2.105 60846 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:03.304750 0.000000 tcp 10.0.2.105 60846 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:09.305352 0.064090 tcp 10.0.2.105 60847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:09.369695 0.066452 tcp 10.0.2.105 60848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:09.436616 0.152753 tcp 10.0.2.105 60849 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:09.616499 2.991515 tcp 10.0.2.105 60850 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:18.620491 0.000000 tcp 10.0.2.105 60850 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:24.616504 0.064892 tcp 10.0.2.105 60851 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:24.681777 0.064767 tcp 10.0.2.105 60852 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:24.746846 0.153534 tcp 10.0.2.105 60853 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:25.008174 2.046025 tcp 10.0.2.105 60854 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:26.717034 0.064204 tcp 10.0.2.105 60855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:26.781698 0.064773 tcp 10.0.2.105 60856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:26.846763 0.149754 tcp 10.0.2.105 60857 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:58:27.054465 2.998969 tcp 10.0.2.105 60858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:36.051714 0.000000 tcp 10.0.2.105 60858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:42.049982 3.004551 tcp 10.0.2.105 60859 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:51.053130 0.000000 tcp 10.0.2.105 60859 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 15:58:55.960502 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 15:58:57.052166 0.355452 tcp 10.0.2.105 60860 -> 46.48.223.67 15494 SPA_* 0 0 9 1194 flow=From-Botnet-V2-TCP-Established 1970/02/11 15:59:05.938623 0.001028 tcp 10.0.2.105 60860 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:01:58.435987 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:02:05.443423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:02:13.444539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:02:29.447355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:03:01.453494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:04:05.936520 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:04:05.936715 2.993410 tcp 10.0.2.105 60861 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:14.929027 0.000000 tcp 10.0.2.105 60861 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:20.939568 0.065172 tcp 10.0.2.105 60862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:21.004991 0.064135 tcp 10.0.2.105 60863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:21.069448 0.156505 tcp 10.0.2.105 60864 -> 195.113.214.249 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:21.379748 3.008843 tcp 10.0.2.105 60865 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:30.381274 0.000000 tcp 10.0.2.105 60865 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:36.380506 0.063865 tcp 10.0.2.105 60866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:36.444645 0.065245 tcp 10.0.2.105 60867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:36.510229 0.154711 tcp 10.0.2.105 60868 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:37.173830 2.046605 tcp 10.0.2.105 60869 -> 46.48.223.67 15494 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:38.918121 0.064914 tcp 10.0.2.105 60870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:38.983287 0.063754 tcp 10.0.2.105 60871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:39.047373 0.153715 tcp 10.0.2.105 60872 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:04:39.220733 2.987712 tcp 10.0.2.105 60873 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:48.218807 0.000000 tcp 10.0.2.105 60873 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:04:54.218470 2.991196 tcp 10.0.2.105 60874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:05:03.212654 0.000000 tcp 10.0.2.105 60874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:05:07.970510 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:05:09.220616 1.726579 tcp 10.0.2.105 60875 -> 46.48.223.67 15494 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:09:05.460373 3.000709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:09:12.472940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:09:20.468022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:09:36.478435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:10:08.487207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:10:10.941190 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:10:10.941327 3.003670 tcp 10.0.2.105 60876 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:19.943575 0.000000 tcp 10.0.2.105 60876 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:25.943897 0.063921 tcp 10.0.2.105 60877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:26.008128 0.064711 tcp 10.0.2.105 60878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:26.073133 0.149264 tcp 10.0.2.105 60879 -> 195.113.214.249 443 SRPA* 0 0 30 22090 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:26.362964 3.004523 tcp 10.0.2.105 60880 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:35.376048 0.000000 tcp 10.0.2.105 60880 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:41.365298 0.195413 tcp 10.0.2.105 60881 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:41.560971 0.063311 tcp 10.0.2.105 60882 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:41.624586 0.152902 tcp 10.0.2.105 60883 -> 195.113.214.249 443 SRPA* 0 0 32 16806 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:42.055744 2.218114 tcp 10.0.2.105 60884 -> 46.48.223.67 15494 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:43.823666 0.063646 tcp 10.0.2.105 60885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:43.887578 0.064212 tcp 10.0.2.105 60886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:43.952100 0.149374 tcp 10.0.2.105 60887 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:10:44.274046 2.972691 tcp 10.0.2.105 60888 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:53.196516 0.000000 tcp 10.0.2.105 60888 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:10:59.170293 3.004431 tcp 10.0.2.105 60889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:11:08.173264 0.000000 tcp 10.0.2.105 60889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:11:12.969879 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:11:14.171955 1.733912 tcp 10.0.2.105 60890 -> 46.48.223.67 15494 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:16:12.494251 3.000793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:16:19.500830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:16:27.502594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:16:43.505192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:17:15.511226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:21:57.026176 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:21:57.026375 0.159424 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:57.553673 0.217451 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:57.763403 0.246153 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:57.974241 0.176320 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:58.256811 0.046864 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:58.287346 0.173952 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:21:58.526120 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 16:22:00.942075 3.003258 tcp 10.0.2.105 60891 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:09.944696 0.000000 tcp 10.0.2.105 60891 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:15.584712 0.097884 tcp 10.0.2.105 60892 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:15.682843 0.065715 tcp 10.0.2.105 60893 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:15.748839 0.150032 tcp 10.0.2.105 60894 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:15.899428 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 16:22:15.943729 0.063022 tcp 10.0.2.105 60895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:16.007012 0.065012 tcp 10.0.2.105 60896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:16.072447 0.150515 tcp 10.0.2.105 60897 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:16.276402 2.991577 tcp 10.0.2.105 60898 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:25.276776 0.000000 tcp 10.0.2.105 60898 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:31.276386 0.117392 tcp 10.0.2.105 60899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:31.393623 0.065796 tcp 10.0.2.105 60900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:31.459734 0.153901 tcp 10.0.2.105 60901 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:31.802128 3.001100 tcp 10.0.2.105 60902 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:33.498701 0.063798 tcp 10.0.2.105 60903 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:33.562808 0.064098 tcp 10.0.2.105 60904 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:33.627186 0.149134 tcp 10.0.2.105 60905 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:22:33.776949 0.167321 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:34.121793 0.063318 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:34.312937 0.053798 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:34.552884 0.126870 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:34.824903 0.071071 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.214697 0.173184 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.384531 0.104620 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.456583 0.166690 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.620691 0.164798 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.761770 0.150064 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:35.898292 0.299188 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:36.187889 0.101077 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:36.345526 0.176234 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:36.514015 0.147711 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:36.726021 0.235642 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:36.990853 0.192393 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:37.138208 0.084058 udp 10.0.2.105 7010 <-> 79.249.12.70 5076 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:37.310098 0.163153 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:37.450982 0.097769 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:37.786854 0.203578 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:37.983052 0.115568 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:22:40.798565 0.000000 tcp 10.0.2.105 60902 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:46.797410 3.004559 tcp 10.0.2.105 60906 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:22:55.800189 0.000000 tcp 10.0.2.105 60906 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:23:00.467187 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:23:19.517998 3.001009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:23:26.524781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:23:34.526132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:23:50.529254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:24:22.535357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:28:01.801118 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:28:01.801265 3.003500 tcp 10.0.2.105 60907 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:10.803471 0.000000 tcp 10.0.2.105 60907 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:16.803477 0.064366 tcp 10.0.2.105 60908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:16.868117 0.065725 tcp 10.0.2.105 60909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:16.934170 0.151720 tcp 10.0.2.105 60910 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:17.483752 3.003556 tcp 10.0.2.105 60911 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:26.495927 0.000000 tcp 10.0.2.105 60911 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:32.485289 0.063486 tcp 10.0.2.105 60912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:32.549072 0.065631 tcp 10.0.2.105 60913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:32.615021 0.150386 tcp 10.0.2.105 60914 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:28:33.000493 2.999183 tcp 10.0.2.105 60915 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:41.998197 0.000000 tcp 10.0.2.105 60915 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:47.996802 3.004555 tcp 10.0.2.105 60916 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:28:56.999218 0.000000 tcp 10.0.2.105 60916 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:29:01.966951 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:30:26.541723 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:30:33.548747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:30:41.552641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:30:57.553137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:31:29.559413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:34:03.000455 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:34:03.000644 3.003316 tcp 10.0.2.105 60917 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:12.002770 0.000000 tcp 10.0.2.105 60917 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:18.002988 0.064918 tcp 10.0.2.105 60918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:18.068196 0.064560 tcp 10.0.2.105 60919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:18.133082 0.148689 tcp 10.0.2.105 60920 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:18.463590 3.003062 tcp 10.0.2.105 60921 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:27.464959 0.000000 tcp 10.0.2.105 60921 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:33.464299 0.063299 tcp 10.0.2.105 60922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:33.527890 0.064152 tcp 10.0.2.105 60923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:33.592450 0.149978 tcp 10.0.2.105 60924 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:34:33.781820 2.996435 tcp 10.0.2.105 60925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:42.787119 0.000000 tcp 10.0.2.105 60925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:48.775701 2.994249 tcp 10.0.2.105 60926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:34:57.773165 0.000000 tcp 10.0.2.105 60926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:35:02.465302 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:37:33.571529 2.996411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:37:40.572855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:37:48.576631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:38:04.580113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:38:36.583238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:40:03.778837 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:40:03.779037 3.003961 tcp 10.0.2.105 60927 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:12.781703 0.000000 tcp 10.0.2.105 60927 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:18.782197 0.065202 tcp 10.0.2.105 60928 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:18.847752 0.063571 tcp 10.0.2.105 60929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:18.911670 0.150099 tcp 10.0.2.105 60930 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:19.322063 3.003169 tcp 10.0.2.105 60931 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:28.323820 0.000000 tcp 10.0.2.105 60931 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:34.330537 0.061798 tcp 10.0.2.105 60932 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:34.392722 0.065667 tcp 10.0.2.105 60933 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:34.458742 0.152404 tcp 10.0.2.105 60934 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:40:34.790761 2.990068 tcp 10.0.2.105 60935 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:43.785907 0.000000 tcp 10.0.2.105 60935 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:49.787070 2.991544 tcp 10.0.2.105 60936 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:40:58.783352 0.000000 tcp 10.0.2.105 60936 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:41:03.465163 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:44:40.590591 3.000165 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:44:47.596739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:44:55.598003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:45:11.601028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:45:43.607474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:46:04.787731 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:46:04.787878 3.005425 tcp 10.0.2.105 60937 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:13.790545 0.000000 tcp 10.0.2.105 60937 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:19.794160 0.064573 tcp 10.0.2.105 60938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:19.859003 0.063240 tcp 10.0.2.105 60939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:19.922537 0.152941 tcp 10.0.2.105 60940 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:20.205020 3.002019 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:29.207922 0.000000 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:35.202142 0.062934 tcp 10.0.2.105 60942 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:35.265387 0.064086 tcp 10.0.2.105 60943 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:35.329780 0.151008 tcp 10.0.2.105 60944 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:46:35.623274 3.008798 tcp 10.0.2.105 60945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:44.638055 0.000000 tcp 10.0.2.105 60945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:50.627769 2.992798 tcp 10.0.2.105 60946 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:46:59.631701 0.000000 tcp 10.0.2.105 60946 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:47:04.463388 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:52:52.685070 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:52:52.685245 0.000000 udp 10.0.2.105 7010 -> 82.20.121.6 2633 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 16:53:09.129297 0.066451 tcp 10.0.2.105 60947 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:09.196019 0.065199 tcp 10.0.2.105 60948 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:09.261514 0.148732 tcp 10.0.2.105 60949 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:09.410787 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 16:53:26.724052 0.062710 tcp 10.0.2.105 60950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:26.787019 0.064059 tcp 10.0.2.105 60951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:26.851428 0.151491 tcp 10.0.2.105 60952 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:27.003468 0.462714 udp 10.0.2.105 7010 <-> 72.137.74.7 2421 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:27.350438 0.247067 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:27.564954 0.175460 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:27.713039 0.215681 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:27.921599 0.170465 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.089438 0.046104 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.121780 0.063187 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.184598 0.169665 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.332182 0.071385 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.394569 0.053533 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.456005 0.127054 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2580 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.591927 0.172786 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.761955 0.113058 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.839376 0.170659 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:28.989470 0.162108 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:29.274705 0.151371 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:29.412420 0.287800 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:29.694909 0.158708 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:29.840852 0.239118 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:30.072096 0.141143 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:30.170611 0.088875 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:30.239518 0.177539 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:30.409127 0.000000 udp 10.0.2.105 7010 -> 79.249.12.70 5076 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 16:53:35.636565 2.993687 tcp 10.0.2.105 60953 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:53:44.628716 0.000000 tcp 10.0.2.105 60953 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:53:49.296503 0.084142 tcp 10.0.2.105 60954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:49.380959 0.064244 tcp 10.0.2.105 60955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:49.445468 0.149440 tcp 10.0.2.105 60956 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:49.595952 0.165021 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:49.738999 0.102174 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:50.088924 0.208603 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:50.288073 0.114921 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/11 16:53:50.648696 0.062262 tcp 10.0.2.105 60957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:50.711265 0.065336 tcp 10.0.2.105 60958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:50.776862 0.152069 tcp 10.0.2.105 60959 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:53:51.268023 2.999307 tcp 10.0.2.105 60960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:00.261086 0.000000 tcp 10.0.2.105 60960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:06.261071 0.063901 tcp 10.0.2.105 60961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:54:06.325266 0.065242 tcp 10.0.2.105 60962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:54:06.390767 0.147351 tcp 10.0.2.105 60963 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:54:06.616619 2.998163 tcp 10.0.2.105 60964 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:15.613699 0.000000 tcp 10.0.2.105 60964 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:21.612161 3.004390 tcp 10.0.2.105 60965 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:30.614956 0.000000 tcp 10.0.2.105 60965 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:54:35.461805 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:54:52.619779 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 16:54:59.626822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:55:07.628014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:55:23.631578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:55:55.637794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 16:59:36.615532 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 16:59:36.615627 2.993576 tcp 10.0.2.105 60966 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:59:45.607694 0.000000 tcp 10.0.2.105 60966 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 16:59:51.618329 0.065511 tcp 10.0.2.105 60967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:59:51.684170 0.063686 tcp 10.0.2.105 60968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:59:51.748196 0.150295 tcp 10.0.2.105 60969 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 16:59:51.908350 3.002931 tcp 10.0.2.105 60970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:00.909304 0.000000 tcp 10.0.2.105 60970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:06.909022 0.062610 tcp 10.0.2.105 60971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:00:06.971948 0.063992 tcp 10.0.2.105 60972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:00:07.036418 0.151168 tcp 10.0.2.105 60973 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:00:07.206105 2.996925 tcp 10.0.2.105 60974 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:16.201812 0.000000 tcp 10.0.2.105 60974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:22.200752 3.004003 tcp 10.0.2.105 60975 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:31.203345 0.000000 tcp 10.0.2.105 60975 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:00:35.960060 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:01:59.643455 3.001286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:02:06.650764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:02:14.652300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:02:30.655207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:03:02.661640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:05:37.203886 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:05:37.203970 3.007005 tcp 10.0.2.105 60976 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:05:46.217163 0.000000 tcp 10.0.2.105 60976 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:05:52.208353 0.065355 tcp 10.0.2.105 60977 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:05:52.274012 0.064672 tcp 10.0.2.105 60978 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:05:52.338948 0.150941 tcp 10.0.2.105 60979 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:05:52.654366 2.995571 tcp 10.0.2.105 60980 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:01.649249 0.000000 tcp 10.0.2.105 60980 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:07.647694 0.063668 tcp 10.0.2.105 60981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:06:07.711661 0.064711 tcp 10.0.2.105 60982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:06:07.776626 0.150136 tcp 10.0.2.105 60983 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:06:08.011440 3.000285 tcp 10.0.2.105 60984 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:17.010560 0.000000 tcp 10.0.2.105 60984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:23.008915 3.004401 tcp 10.0.2.105 60985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:32.012014 0.000000 tcp 10.0.2.105 60985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:06:36.969219 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:09:06.667492 3.001267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:09:13.674613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:09:21.676089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:09:37.679343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:10:09.685174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:11:38.012799 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:11:38.012988 3.002764 tcp 10.0.2.105 60986 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:11:47.015006 0.000000 tcp 10.0.2.105 60986 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:11:53.015547 0.065884 tcp 10.0.2.105 60987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:11:53.081698 0.064442 tcp 10.0.2.105 60988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:11:53.146412 0.151439 tcp 10.0.2.105 60989 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:11:53.458290 3.000310 tcp 10.0.2.105 60990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:02.467067 0.000000 tcp 10.0.2.105 60990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:08.456518 0.063964 tcp 10.0.2.105 60991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:12:08.520739 0.063207 tcp 10.0.2.105 60992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:12:08.584378 0.152728 tcp 10.0.2.105 60993 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:12:08.892924 2.997179 tcp 10.0.2.105 60994 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:17.888736 0.000000 tcp 10.0.2.105 60994 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:23.888218 3.004148 tcp 10.0.2.105 60995 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:32.890291 0.000000 tcp 10.0.2.105 60995 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:12:37.467458 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:16:13.691663 3.084396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:16:20.749830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:16:28.710012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:16:44.712774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:17:16.719266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:23:20.725112 3.001614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 17:23:27.732680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:23:35.734123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:23:51.736982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:24:17.043774 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:24:17.043864 0.000000 udp 10.0.2.105 7010 -> 79.249.12.70 5076 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 17:24:23.742983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:24:32.538739 0.063634 tcp 10.0.2.105 60996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:32.602657 0.065896 tcp 10.0.2.105 60997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:32.668897 0.152736 tcp 10.0.2.105 60998 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:32.822166 0.180783 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:32.974835 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 17:24:38.935160 2.993902 tcp 10.0.2.105 60999 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:24:47.927734 0.000000 tcp 10.0.2.105 60999 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:24:49.641472 0.063929 tcp 10.0.2.105 61000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:49.705679 0.155976 tcp 10.0.2.105 61001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:49.861520 0.152226 tcp 10.0.2.105 61002 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:50.014231 0.273171 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:50.252782 0.184027 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:50.480333 0.046200 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:50.510595 0.063136 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:50.673818 0.226549 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:50.892860 0.168970 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:51.110978 0.127689 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:51.367334 0.172888 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:51.536675 0.102514 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:51.607236 0.171061 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:51.777215 0.053244 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.020888 0.071632 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.076930 0.164538 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.225692 0.148768 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.461134 0.282398 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.734598 0.166593 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:52.859642 0.086071 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:53.160958 0.238267 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:53.391015 0.149110 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:53.529999 0.173960 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:53.696305 0.208761 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:53.936952 0.062481 tcp 10.0.2.105 61003 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:53.999760 0.064591 tcp 10.0.2.105 61004 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:54.034117 0.111330 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:54.064629 0.147964 tcp 10.0.2.105 61005 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:24:54.110201 0.164544 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:24:54.263541 2.997680 tcp 10.0.2.105 61006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:24:54.290704 0.104376 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:25:03.259805 0.000000 tcp 10.0.2.105 61006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:09.260507 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:30:09.260654 3.003223 tcp 10.0.2.105 61007 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:18.263129 0.000000 tcp 10.0.2.105 61007 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:24.263210 0.063736 tcp 10.0.2.105 61008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:24.327268 0.066107 tcp 10.0.2.105 61009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:24.393683 0.147910 tcp 10.0.2.105 61010 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:24.573385 3.002838 tcp 10.0.2.105 61011 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:27.749824 3.000981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:30:33.574660 0.000000 tcp 10.0.2.105 61011 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:34.756537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:30:39.574094 0.064613 tcp 10.0.2.105 61012 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:39.639003 0.064071 tcp 10.0.2.105 61013 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:39.703386 0.155561 tcp 10.0.2.105 61014 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:30:40.052730 2.995953 tcp 10.0.2.105 61015 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:42.758854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:30:49.059409 0.000000 tcp 10.0.2.105 61015 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:55.045791 2.993696 tcp 10.0.2.105 61016 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:30:58.761166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:31:04.038579 0.000000 tcp 10.0.2.105 61016 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:31:08.965500 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:31:30.767090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:36:10.051588 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:36:10.051820 3.003372 tcp 10.0.2.105 61017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:19.051401 0.000000 tcp 10.0.2.105 61017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:25.051819 0.064418 tcp 10.0.2.105 61018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:25.116576 0.064486 tcp 10.0.2.105 61019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:25.181410 0.151744 tcp 10.0.2.105 61020 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:25.517841 2.997155 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:34.515409 0.000000 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:40.513142 0.065112 tcp 10.0.2.105 61022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:40.578641 0.064675 tcp 10.0.2.105 61023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:40.643583 0.150286 tcp 10.0.2.105 61024 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:36:40.931467 2.995744 tcp 10.0.2.105 61025 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:49.937042 0.000000 tcp 10.0.2.105 61025 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:36:55.929303 2.993532 tcp 10.0.2.105 61026 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:37:04.920186 0.000000 tcp 10.0.2.105 61026 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:37:09.464002 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:37:34.773934 3.000758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:37:41.780584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:37:49.782135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:38:05.784568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:38:37.791261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:42:10.927887 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:42:10.927992 3.003627 tcp 10.0.2.105 61027 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:19.930170 0.000000 tcp 10.0.2.105 61027 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:25.931042 0.064448 tcp 10.0.2.105 61028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:25.995791 0.064458 tcp 10.0.2.105 61029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:26.060512 0.154785 tcp 10.0.2.105 61030 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:26.255359 2.998395 tcp 10.0.2.105 61031 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:35.252828 0.000000 tcp 10.0.2.105 61031 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:41.251404 0.063091 tcp 10.0.2.105 61032 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:41.314737 0.063611 tcp 10.0.2.105 61033 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:41.378665 0.147392 tcp 10.0.2.105 61034 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:42:41.630848 2.995005 tcp 10.0.2.105 61035 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:50.624257 0.000000 tcp 10.0.2.105 61035 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:42:56.623174 3.007720 tcp 10.0.2.105 61036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:43:05.635973 0.000000 tcp 10.0.2.105 61036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:43:10.463023 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:44:41.796997 3.003539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:44:48.804497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:44:56.805685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:45:12.814199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:45:44.814895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:48:11.627852 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:48:11.627959 2.992648 tcp 10.0.2.105 61037 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:20.619000 0.000000 tcp 10.0.2.105 61037 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:26.630485 0.065064 tcp 10.0.2.105 61038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:26.695800 0.064418 tcp 10.0.2.105 61039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:26.760585 0.150329 tcp 10.0.2.105 61040 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:27.197101 3.008237 tcp 10.0.2.105 61041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:36.201492 0.000000 tcp 10.0.2.105 61041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:42.190345 0.064232 tcp 10.0.2.105 61042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:42.254868 0.063156 tcp 10.0.2.105 61043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:42.318306 0.150316 tcp 10.0.2.105 61044 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:48:42.576108 2.998911 tcp 10.0.2.105 61045 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:51.573474 0.000000 tcp 10.0.2.105 61045 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:48:57.572152 3.004244 tcp 10.0.2.105 61046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:49:06.574965 0.000000 tcp 10.0.2.105 61046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:49:11.461899 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:54:53.827539 3.000986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 17:55:00.834314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:55:08.415705 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 17:55:08.415882 0.000000 udp 10.0.2.105 7010 -> 72.137.74.7 2421 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 17:55:08.835881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:55:24.838566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 17:55:25.151206 0.064527 tcp 10.0.2.105 61047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:25.216023 0.065803 tcp 10.0.2.105 61048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:25.282225 0.152740 tcp 10.0.2.105 61049 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:25.435727 0.176972 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:25.585094 0.253701 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:25.824513 0.169284 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:26.223352 0.047278 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:26.254810 0.065769 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:26.371133 0.221961 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:26.585721 0.167606 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:26.732704 0.126637 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.007122 0.174842 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.179524 0.107436 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.365494 0.169977 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.512536 0.055213 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.561335 0.069483 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.585862 3.001217 tcp 10.0.2.105 61050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:55:27.615307 0.165437 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.857676 0.145668 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:27.956143 0.083399 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:28.101817 0.148256 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:28.349804 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 17:55:36.595611 0.000000 tcp 10.0.2.105 61050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:55:42.585089 0.064541 tcp 10.0.2.105 61051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:42.649965 0.066074 tcp 10.0.2.105 61052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:42.716368 0.151206 tcp 10.0.2.105 61053 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:42.898624 3.000356 tcp 10.0.2.105 61054 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:55:43.596033 0.062722 tcp 10.0.2.105 61055 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:43.659062 0.063465 tcp 10.0.2.105 61056 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:43.722772 0.149800 tcp 10.0.2.105 61057 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 17:55:43.873084 0.239474 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.104834 0.153009 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.242930 0.175012 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.409935 0.209922 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.612426 0.110494 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.685057 0.174123 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:44.836510 0.092043 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/11 17:55:51.897745 0.000000 tcp 10.0.2.105 61054 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 17:55:56.844705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:00:57.897684 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:00:57.897935 3.004188 tcp 10.0.2.105 61058 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:06.900467 0.000000 tcp 10.0.2.105 61058 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:12.900227 0.064830 tcp 10.0.2.105 61059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:12.965304 0.063279 tcp 10.0.2.105 61060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:13.028808 0.156427 tcp 10.0.2.105 61061 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:13.197733 3.006165 tcp 10.0.2.105 61062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:22.202867 0.000000 tcp 10.0.2.105 61062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:28.191833 0.064596 tcp 10.0.2.105 61063 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:28.256682 0.063848 tcp 10.0.2.105 61064 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:28.320855 0.151242 tcp 10.0.2.105 61065 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:01:28.810215 3.009191 tcp 10.0.2.105 61066 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:37.815001 0.000000 tcp 10.0.2.105 61066 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:43.804932 2.995512 tcp 10.0.2.105 61067 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:52.806409 0.000000 tcp 10.0.2.105 61067 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:01:57.463698 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:02:00.851498 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:02:07.858404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:02:15.859825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:02:31.862980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:03:03.868986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:06:58.806986 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:06:58.807190 3.003483 tcp 10.0.2.105 61068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:07.809321 0.000000 tcp 10.0.2.105 61068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:13.809676 0.064558 tcp 10.0.2.105 61069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:13.874509 0.064198 tcp 10.0.2.105 61070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:13.939016 0.154562 tcp 10.0.2.105 61071 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:14.212584 3.002018 tcp 10.0.2.105 61072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:23.211660 0.000000 tcp 10.0.2.105 61072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:29.210326 0.062466 tcp 10.0.2.105 61073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:29.273154 0.064987 tcp 10.0.2.105 61074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:29.338433 0.152722 tcp 10.0.2.105 61075 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:07:29.742353 3.003031 tcp 10.0.2.105 61076 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:38.748776 0.000000 tcp 10.0.2.105 61076 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:44.742818 3.004256 tcp 10.0.2.105 61077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:53.746632 0.000000 tcp 10.0.2.105 61077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:07:58.462491 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:09:07.876630 3.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:09:14.882697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:09:22.883682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:09:38.891149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:10:10.902747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:12:59.749253 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:12:59.749350 2.990667 tcp 10.0.2.105 61078 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:08.738571 0.000000 tcp 10.0.2.105 61078 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:14.748746 0.065074 tcp 10.0.2.105 61079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:14.814094 0.103727 tcp 10.0.2.105 61080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:14.917665 0.158060 tcp 10.0.2.105 61081 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:15.330786 3.001443 tcp 10.0.2.105 61082 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:24.330926 0.000000 tcp 10.0.2.105 61082 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:30.330170 0.064023 tcp 10.0.2.105 61083 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:30.394459 0.065554 tcp 10.0.2.105 61084 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:30.460428 0.153293 tcp 10.0.2.105 61085 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:13:31.695282 3.002163 tcp 10.0.2.105 61086 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:40.694120 0.000000 tcp 10.0.2.105 61086 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:46.692856 2.994466 tcp 10.0.2.105 61087 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:13:54.464108 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:13:55.695963 0.000000 tcp 10.0.2.105 61087 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:16:14.908541 3.004701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:16:21.916529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:16:29.922793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:16:45.920875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:17:17.927980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:19:01.696547 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:19:01.696756 2.994027 tcp 10.0.2.105 61088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:10.688760 0.000000 tcp 10.0.2.105 61088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:16.699424 0.066133 tcp 10.0.2.105 61089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:16.765814 0.066103 tcp 10.0.2.105 61090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:16.832188 0.157418 tcp 10.0.2.105 61091 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:17.248762 3.004382 tcp 10.0.2.105 61092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:26.251380 0.000000 tcp 10.0.2.105 61092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:32.250433 0.064646 tcp 10.0.2.105 61093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:32.315485 0.065387 tcp 10.0.2.105 61094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:32.381210 0.155490 tcp 10.0.2.105 61095 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:19:32.843702 3.001586 tcp 10.0.2.105 61096 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:41.843614 0.000000 tcp 10.0.2.105 61096 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:47.842319 3.004252 tcp 10.0.2.105 61097 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:19:56.845131 0.000000 tcp 10.0.2.105 61097 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:20:01.461959 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:23:21.932669 3.001451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:23:28.939937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:23:36.941593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:23:52.944729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:24:24.950975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:26:02.782963 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:26:02.783050 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:26:18.726034 0.067421 tcp 10.0.2.105 61098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:18.793737 0.066048 tcp 10.0.2.105 61099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:18.860050 0.154675 tcp 10.0.2.105 61100 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:19.015370 0.177047 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:19.169828 0.182535 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:19.394814 0.254492 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:19.614049 0.166966 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:20.054246 0.046587 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:20.086516 0.063185 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:20.268004 0.213984 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:20.473988 0.128653 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:20.734403 0.111754 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:21.732089 0.167908 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:22.559994 0.053139 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:22.612869 0.173950 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:22.782942 0.083548 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:22.843993 0.165389 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:23.071995 0.071159 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:23.128453 0.245891 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:23.329194 0.146886 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:23.680606 0.238501 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:23.910653 0.174613 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:24.077793 0.216427 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:24.285786 0.113275 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:24.397441 0.162227 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:24.537942 0.150175 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:25.053067 0.100794 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:25.214332 0.322921 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 2912 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:25.515167 0.327004 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3203 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:25.811948 0.481010 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3109 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:26.259305 0.314773 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 8 3023 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:26.551058 0.233218 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 8 3193 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:26.769224 0.283750 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 8 2968 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:27.051648 0.254784 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 8 3009 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:27.432943 0.760788 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3210 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:28.186357 0.175342 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 3044 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:28.327204 0.311739 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 8 2971 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:28.616868 0.191515 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 3117 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:28.916807 0.324366 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2879 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:29.238693 0.483423 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3005 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:29.700152 0.495878 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 8 3100 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:30.174296 0.106762 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 8 3019 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:30.266272 0.384307 udp 10.0.2.105 7010 <-> 50.29.239.83 8927 CON 0 0 8 2875 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:30.637238 0.465173 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 8 2901 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:31.094544 0.333257 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3156 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:31.420011 0.751100 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 2998 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:32.127419 0.421639 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 8 2856 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:32.541583 0.229475 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 8 3012 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:32.731366 0.360970 udp 10.0.2.105 7010 <-> 74.15.178.164 1520 CON 0 0 8 3199 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:32.855424 2.993574 tcp 10.0.2.105 61101 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:26:33.069467 0.827653 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 8 3054 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:33.887262 0.406823 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 8 3076 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:34.278867 0.000000 udp 10.0.2.105 7010 -> 199.231.252.163 2553 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:26:41.847380 0.000000 tcp 10.0.2.105 61101 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:26:41.897885 0.297547 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 8 3146 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:42.529559 0.161271 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:26:42.690830 0.000000 icmp 14.140.174.2 0x0303 -> 10.0.2.105 0x7017 URP 192 1 161 flow=Background 1970/02/11 18:26:46.467002 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:26:47.857622 0.063039 tcp 10.0.2.105 61102 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:47.920971 0.066313 tcp 10.0.2.105 61103 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:47.987596 0.153215 tcp 10.0.2.105 61104 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:26:48.454228 3.000658 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:26:50.530174 0.000000 udp 10.0.2.105 7010 -> 86.173.47.132 6759 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:26:57.169405 0.682673 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 8 3139 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:26:57.449814 0.000000 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:26:57.973039 0.000000 udp 10.0.2.105 7010 -> 174.101.38.86 3242 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:03.449101 0.068001 tcp 10.0.2.105 61106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:27:03.517473 0.064768 tcp 10.0.2.105 61107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:27:03.548744 0.000000 udp 10.0.2.105 7010 -> 197.87.60.217 3445 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:03.582584 0.155472 tcp 10.0.2.105 61108 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:27:03.762507 3.000901 tcp 10.0.2.105 61109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:27:10.828990 0.000000 udp 10.0.2.105 7010 -> 78.97.152.166 4185 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:12.761936 0.000000 tcp 10.0.2.105 61109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:27:18.760838 3.004086 tcp 10.0.2.105 61110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:27:19.361775 0.000000 udp 10.0.2.105 7010 -> 122.150.211.150 2196 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:27.605074 0.091056 udp 10.0.2.105 7010 -> 82.85.237.145 8690 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:27.696130 0.000000 icmp 82.85.237.145 0x0303 -> 10.0.2.105 0xf221 URP 192 1 263 flow=Background 1970/02/11 18:27:27.764726 0.000000 tcp 10.0.2.105 61110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:27:32.460220 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:27:35.800700 0.817390 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 8 2992 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:27:36.790008 0.000000 udp 10.0.2.105 7010 -> 219.76.180.167 5162 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:43.637302 0.469415 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 8 3000 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:27:44.409593 0.000000 udp 10.0.2.105 7010 -> 216.176.233.194 2082 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:52.499509 0.000000 udp 10.0.2.105 7010 -> 61.221.24.204 3248 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:27:57.466093 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:27:59.980397 0.000000 udp 10.0.2.105 7010 -> 95.246.38.22 2992 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:06.729961 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:15.622504 0.000000 udp 10.0.2.105 7010 -> 62.8.110.186 6219 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:22.782964 0.000000 udp 10.0.2.105 7010 -> 175.141.237.172 3570 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:27.459224 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:28:29.001629 0.414874 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:28:29.460774 0.055020 udp 10.0.2.105 7010 <-> 86.157.252.173 1878 CON 0 0 2 775 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:28:29.995082 0.382938 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:28:30.448507 0.235524 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 655 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:28:30.812150 0.000000 udp 10.0.2.105 7010 -> 218.103.35.77 6255 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:39.300337 0.000000 udp 10.0.2.105 7010 -> 175.143.38.145 9572 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:45.104898 0.335414 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:28:45.686248 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:52.085180 0.000000 udp 10.0.2.105 7010 -> 183.32.0.213 3209 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:28:56.961497 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:28:59.255437 0.000000 udp 10.0.2.105 7010 -> 115.166.9.88 8338 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:07.449128 0.000000 udp 10.0.2.105 7010 -> 166.183.7.67 1878 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:14.075985 0.000000 udp 10.0.2.105 7010 -> 203.45.99.250 9055 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:23.019282 0.000000 udp 10.0.2.105 7010 -> 95.230.10.88 1517 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:27.965984 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:29:29.849227 0.181138 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:29:30.439856 0.000000 udp 10.0.2.105 7010 -> 2.193.40.4 1256 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:38.111018 0.000000 udp 10.0.2.105 7010 -> 203.106.165.113 6337 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:46.062939 0.000000 udp 10.0.2.105 7010 -> 64.37.16.68 1211 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:54.995086 0.000000 udp 10.0.2.105 7010 -> 60.241.200.154 4967 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:29:59.962708 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:30:03.229148 0.185929 udp 10.0.2.105 7010 <-> 75.118.139.119 3113 CON 0 0 2 716 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:30:03.453912 0.000000 udp 10.0.2.105 7010 -> 58.248.243.48 8482 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:11.749715 0.000000 udp 10.0.2.105 7010 -> 98.101.83.154 5434 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:18.098066 0.000000 udp 10.0.2.105 7010 -> 68.125.35.119 2118 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:26.000105 0.000000 udp 10.0.2.105 7010 -> 61.192.185.193 9993 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:28.956810 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:30:30.966918 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:30:33.370963 0.227349 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:30:33.626770 0.000000 udp 10.0.2.105 7010 -> 115.245.229.125 1146 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:35.964814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:30:39.879947 0.149881 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:30:40.075615 0.000000 udp 10.0.2.105 7010 -> 124.96.0.89 1262 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:43.965811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:30:46.349497 0.611392 udp 10.0.2.105 7010 <-> 162.234.65.97 1895 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:30:47.146911 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:55.493906 0.175262 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:30:55.669168 0.000000 icmp 202.179.10.114 0x0303 -> 10.0.2.105 0x1a06 URP 192 1 201 flow=Background 1970/02/11 18:31:00.254844 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:31:00.255014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:31:03.323270 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5362 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:10.119291 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:15.972258 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:23.127357 0.325297 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:31:23.743007 0.000000 udp 10.0.2.105 7010 -> 111.242.43.63 1084 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:27.986043 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:31:31.974786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:31:32.355520 0.079475 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:31:32.599366 0.000000 udp 10.0.2.105 7010 -> 113.161.144.242 8604 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:41.257763 0.000000 udp 10.0.2.105 7010 -> 210.142.228.177 2260 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:46.785989 0.000000 udp 10.0.2.105 7010 -> 120.150.153.208 1802 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:55.369285 0.000000 udp 10.0.2.105 7010 -> 61.38.234.111 7007 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:31:59.964987 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:32:02.919416 0.149970 udp 10.0.2.105 7010 <-> 184.48.149.100 7982 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:32:03.098374 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:10.360102 0.000000 udp 10.0.2.105 7010 -> 93.33.100.210 9249 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:15.638231 0.000000 udp 10.0.2.105 7010 -> 72.190.127.157 4308 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:20.985336 0.000000 udp 10.0.2.105 7010 -> 24.157.36.2 9575 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:25.962760 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:32:26.413115 0.082431 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:32:26.515154 0.000000 udp 10.0.2.105 7010 -> 175.141.199.15 3630 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:32.291696 0.000000 udp 10.0.2.105 7010 -> 210.21.81.132 1540 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:33.763902 2.995918 tcp 10.0.2.105 61111 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:32:40.853727 0.331195 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:32:41.335261 0.000000 udp 10.0.2.105 7010 -> 60.40.96.217 5992 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:42.766891 0.000000 tcp 10.0.2.105 61111 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:32:48.767229 0.067194 tcp 10.0.2.105 61112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:32:48.815229 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:48.834769 0.064252 tcp 10.0.2.105 61113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:32:48.899317 0.149856 tcp 10.0.2.105 61114 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:32:49.061302 2.998265 tcp 10.0.2.105 61115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:32:57.197540 0.000000 udp 10.0.2.105 7010 -> 116.15.180.95 3616 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:32:58.058820 0.000000 tcp 10.0.2.105 61115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/11 18:33:04.057690 0.070923 tcp 10.0.2.105 61116 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:04.128892 0.064533 tcp 10.0.2.105 61117 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:04.193751 0.148558 tcp 10.0.2.105 61118 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:04.353932 0.364163 tcp 10.0.2.105 61119 -> 46.48.223.67 15494 SPA_* 0 0 9 1195 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:06.160519 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:10.495983 0.295569 tcp 10.0.2.105 61119 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:10.496804 0.065128 tcp 10.0.2.105 61120 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:10.562351 0.067670 tcp 10.0.2.105 61121 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:10.630339 0.151867 tcp 10.0.2.105 61122 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:10.791857 0.995903 tcp 10.0.2.105 61123 -> 162.210.27.16 8808 FSPA* 0 0 14 1702 flow=From-Botnet-V2-TCP-Established 1970/02/11 18:33:12.549457 0.000000 udp 10.0.2.105 7010 -> 42.61.219.109 5353 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:17.997149 0.000000 udp 10.0.2.105 7010 -> 220.128.242.220 1938 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:23.285393 0.000000 udp 10.0.2.105 7010 -> 201.230.77.114 4630 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:28.833022 0.000000 udp 10.0.2.105 7010 -> 217.91.253.138 3165 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:34.360628 0.000000 udp 10.0.2.105 7010 -> 122.40.92.18 1565 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:38.970713 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:33:40.811156 0.026392 udp 10.0.2.105 7010 <-> 46.232.152.199 2844 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:33:41.013763 0.000000 udp 10.0.2.105 7010 -> 92.13.117.10 3487 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:49.273850 0.000000 udp 10.0.2.105 7010 -> 67.143.241.87 6196 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:33:56.252276 0.000000 udp 10.0.2.105 7010 -> 190.72.187.63 7279 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:04.626131 0.187369 udp 10.0.2.105 7010 -> 189.154.205.158 8249 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:04.813500 0.000000 icmp 189.154.205.158 0x0303 -> 10.0.2.105 0x3920 URP 192 1 238 flow=Background 1970/02/11 18:34:09.461111 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:34:10.372756 0.000000 udp 10.0.2.105 7010 -> 186.32.92.84 5106 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:15.800537 0.000000 udp 10.0.2.105 7010 -> 202.219.84.250 5766 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:23.591380 0.000000 udp 10.0.2.105 7010 -> 109.242.199.76 4882 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:28.618925 0.000000 udp 10.0.2.105 7010 -> 210.18.204.162 2222 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:33.465434 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:34:33.816241 0.000000 udp 10.0.2.105 7010 -> 95.240.125.163 6576 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:42.108029 0.000000 udp 10.0.2.105 7010 -> 24.239.41.224 7684 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:50.780468 0.000000 udp 10.0.2.105 7010 -> 14.44.57.52 1470 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:58.181266 1.136419 udp 10.0.2.105 7010 -> 222.228.87.213 2323 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:34:59.317685 0.000000 icmp 222.228.87.213 0x0303 -> 10.0.2.105 0x1309 URP 192 1 278 flow=Background 1970/02/11 18:35:02.968174 0.000197 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:35:06.072956 0.215300 udp 10.0.2.105 7010 <-> 108.211.196.210 2490 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:06.313998 0.305058 udp 10.0.2.105 7010 <-> 14.53.189.151 5470 CON 0 0 2 722 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:06.641747 0.000000 udp 10.0.2.105 7010 -> 112.207.59.136 1052 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:14.755144 0.000000 udp 10.0.2.105 7010 -> 124.171.41.159 8522 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:21.014762 0.000000 udp 10.0.2.105 7010 -> 24.247.163.97 3237 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:27.934208 0.178024 udp 10.0.2.105 7010 <-> 68.169.167.149 7150 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:28.269760 0.072791 udp 10.0.2.105 7010 <-> 62.105.156.34 4374 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:28.352707 0.372899 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:29.078017 0.385510 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:29.592811 0.000000 udp 10.0.2.105 7010 -> 69.49.144.155 1058 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:32.460429 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:35:35.034322 0.000000 udp 10.0.2.105 7010 -> 107.0.209.52 7989 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:41.423491 0.203988 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:41.807198 0.229721 udp 10.0.2.105 7010 <-> 99.111.77.224 3239 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:35:42.140804 0.000000 udp 10.0.2.105 7010 -> 182.52.35.234 7490 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:48.124868 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:35:56.414807 0.000000 udp 10.0.2.105 7010 -> 66.196.207.90 9944 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:00.961387 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:36:04.967157 0.058968 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:05.082591 0.161410 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 832 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:05.275810 0.246126 udp 10.0.2.105 7010 <-> 75.253.173.155 8495 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:05.623477 0.337915 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:06.152914 0.000000 udp 10.0.2.105 7010 -> 99.115.134.101 6848 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:11.897267 0.308861 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:12.260849 0.000000 udp 10.0.2.105 7010 -> 107.217.62.161 3599 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:19.588528 0.000000 udp 10.0.2.105 7010 -> 213.193.92.206 2823 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:25.126274 0.000000 udp 10.0.2.105 7010 -> 96.3.107.238 6486 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:29.965710 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:36:31.252756 0.000000 udp 10.0.2.105 7010 -> 65.255.49.76 9766 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:38.791612 0.000000 udp 10.0.2.105 7010 -> 182.210.186.90 3666 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:43.933559 0.169931 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:36:44.212696 0.000000 udp 10.0.2.105 7010 -> 98.198.27.240 3257 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:49.561697 0.000000 udp 10.0.2.105 7010 -> 86.98.44.211 3528 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 18:36:54.471783 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 18:36:58.183791 0.252569 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/11 18:37:35.980848 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 18:37:42.988009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:37:50.989231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:38:06.992702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:38:39.000768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:44:43.004844 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 18:44:50.011938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:44:58.013424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:45:14.016998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:45:46.022593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:54:55.035316 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 18:55:02.041879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:55:10.043580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:55:26.047018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 18:55:58.052595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:02:02.059420 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:02:09.066015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:02:17.067349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:02:33.070728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:03:05.076197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:03:11.786655 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 19:03:11.786841 0.930724 tcp 10.0.2.105 61124 -> 162.210.27.16 8808 FSPA* 0 0 12 1525 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:10.242703 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 19:07:10.242864 0.146421 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:10.389733 0.146554 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:10.536710 0.290420 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:10.827498 0.144033 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:10.971948 0.028841 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.001213 0.059791 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.061396 0.126711 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.188668 0.207810 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.396884 0.052707 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.449940 0.167986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.618354 0.072334 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.691091 0.142196 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.833711 0.060085 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:11.894228 0.138060 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.032695 0.052410 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.085499 0.224103 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.310004 0.081655 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.392065 0.165583 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.558049 0.069545 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.628032 0.140324 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.768791 0.169242 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:12.938496 0.359376 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:13.298325 0.371641 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:13.670414 0.238297 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:13.909057 0.051337 udp 10.0.2.105 7010 <-> 86.157.252.173 1878 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:13.960757 0.386750 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:14.347900 0.409023 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:14.757331 0.234259 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:14.992007 0.331239 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:15.323635 0.224276 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:15.548346 0.186785 udp 10.0.2.105 7010 <-> 75.118.139.119 3113 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:15.735532 0.219404 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:15.955408 0.139036 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:16.094824 0.196178 udp 10.0.2.105 7010 <-> 162.234.65.97 1895 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:16.291397 0.402546 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:16.694337 0.073353 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:16.768111 0.000000 udp 10.0.2.105 7010 -> 184.48.149.100 7982 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:07:34.529421 0.063891 tcp 10.0.2.105 61125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:34.593553 0.110591 tcp 10.0.2.105 61126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:34.704551 0.146267 tcp 10.0.2.105 61127 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:34.851416 0.100429 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:34.952266 0.223571 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:35.176348 0.374367 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:35.551123 0.379551 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:35.931064 0.204069 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:36.135549 0.235525 udp 10.0.2.105 7010 <-> 99.111.77.224 3239 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:36.371492 0.161863 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:36.533751 0.055147 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:36.589303 0.000000 udp 10.0.2.105 7010 -> 75.253.173.155 8495 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:07:52.531677 0.064177 tcp 10.0.2.105 61128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:52.596180 0.069226 tcp 10.0.2.105 61129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:52.665754 0.156802 tcp 10.0.2.105 61130 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:07:52.823066 0.334126 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:53.157526 0.293264 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:53.451175 0.167238 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:07:53.618825 0.246532 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:09:09.085613 2.998546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 19:09:16.089452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:09:24.093722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:09:40.094544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:10:12.100780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:16:16.106759 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:16:23.113803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:16:31.115273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:16:47.118589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:17:19.123885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:23:23.130350 3.005585 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:23:30.137711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:23:38.139076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:23:54.142647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:24:26.148580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:30:30.155105 3.001025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:30:37.162282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:30:45.163417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:31:01.166583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:31:33.172640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:33:12.726654 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 19:33:12.726850 0.827154 tcp 10.0.2.105 61131 -> 162.210.27.16 8808 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:37:37.177768 3.004999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:37:44.193689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:37:52.193999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:38:08.193878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:38:12.056478 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 19:38:12.056620 3.146218 udp 10.0.2.105 7010 -> 184.48.149.100 7982 INT 0 1 92 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:38:15.202838 0.000000 icmp 12.216.158.34 0x0103 -> 10.0.2.105 0xb830 URH 192 1 120 flow=Background 1970/02/11 19:38:28.501987 0.062208 tcp 10.0.2.105 61132 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:28.564722 0.064275 tcp 10.0.2.105 61133 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:28.629377 0.149424 tcp 10.0.2.105 61134 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:28.779451 0.000000 udp 10.0.2.105 7010 -> 75.253.173.155 8495 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:38:40.195959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:38:45.054014 0.065136 tcp 10.0.2.105 61135 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:45.119446 0.066643 tcp 10.0.2.105 61136 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:45.186347 0.179182 tcp 10.0.2.105 61137 -> 195.113.214.249 443 SRPA* 0 0 72 76948 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:38:45.366012 0.152468 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:45.518904 0.148047 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:45.667364 0.029548 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:45.697338 0.059867 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:45.757580 0.132565 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:45.890571 0.205032 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:46.095964 0.045190 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:46.141552 0.165484 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:46.307465 0.142142 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:46.450008 0.221425 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:38:46.671855 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:39:03.330636 0.061570 tcp 10.0.2.105 61138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:03.392501 0.065575 tcp 10.0.2.105 61139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:03.458368 0.151128 tcp 10.0.2.105 61140 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:03.609985 0.071712 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:03.682090 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 3853 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:39:20.995043 0.060763 tcp 10.0.2.105 61141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:21.056147 0.062048 tcp 10.0.2.105 61142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:21.118550 0.154062 tcp 10.0.2.105 61143 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:21.273205 0.086079 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.359670 0.164669 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.524873 0.073885 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.599188 0.062332 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.661907 0.141956 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.804315 0.051769 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.856628 0.138513 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:21.995521 0.146762 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:22.142676 0.330165 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:22.473235 0.375366 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:22.848974 0.055390 udp 10.0.2.105 7010 <-> 86.157.252.173 1878 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:22.904738 0.219961 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:23.125098 1.756474 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:24.881983 0.175363 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:25.057725 0.349926 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:25.408039 0.234501 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:25.643022 0.330739 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:25.974211 0.185002 udp 10.0.2.105 7010 <-> 162.234.65.97 1895 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:26.159576 0.000000 udp 10.0.2.105 7010 -> 75.118.139.119 3113 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:39:42.807166 0.065207 tcp 10.0.2.105 61144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:42.872702 0.062851 tcp 10.0.2.105 61145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:42.935886 0.148276 tcp 10.0.2.105 61146 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:39:43.084833 0.219047 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:39:43.304341 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:40:00.982460 0.059977 tcp 10.0.2.105 61147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:01.042736 0.063082 tcp 10.0.2.105 61148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:01.106093 0.154596 tcp 10.0.2.105 61149 -> 195.113.214.249 443 SRPA* 0 0 21 11574 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:01.261252 0.359669 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:01.621373 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 19:40:17.016081 0.060765 tcp 10.0.2.105 61150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:17.077225 0.061521 tcp 10.0.2.105 61151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:17.139129 0.153639 tcp 10.0.2.105 61152 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 19:40:17.293337 0.244954 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:17.538668 0.083608 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:17.622734 0.204884 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:17.828001 0.223133 udp 10.0.2.105 7010 <-> 99.111.77.224 3239 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:18.051566 0.161351 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:18.213321 0.059498 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:18.273226 0.375967 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:18.649635 0.379941 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:19.029965 0.330490 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:19.360826 0.303106 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:19.664378 0.168323 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:40:19.954829 0.248680 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/11 19:44:44.202328 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 19:44:51.209967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:44:59.211714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:45:15.214270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:45:47.219891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:54:56.233388 3.001540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 19:55:03.239831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:55:11.241507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:55:27.244889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 19:55:59.250623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:02:03.256180 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:02:10.263589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:02:18.265217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:02:34.268185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:03:06.275851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:03:13.555276 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 20:03:13.555373 1.043979 tcp 10.0.2.105 61153 -> 162.210.27.16 8808 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:09:10.280442 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:09:17.287763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:09:25.289061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:09:41.292296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:10:13.298517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:10:39.396039 0.186030 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 20:10:39.582155 0.226503 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:10:39.809063 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:10:56.566844 0.061637 tcp 10.0.2.105 61154 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:10:56.628819 0.064860 tcp 10.0.2.105 61155 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:10:56.693979 0.146867 tcp 10.0.2.105 61156 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:10:56.841347 0.000000 udp 10.0.2.105 7010 -> 75.118.139.119 3113 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:11:14.186512 0.094016 tcp 10.0.2.105 61157 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:14.280821 0.061543 tcp 10.0.2.105 61158 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:14.342677 0.151403 tcp 10.0.2.105 61159 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:14.494752 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:11:31.671832 0.060084 tcp 10.0.2.105 61160 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:31.732382 0.063538 tcp 10.0.2.105 61161 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:31.796258 0.148970 tcp 10.0.2.105 61162 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:11:31.945774 0.076195 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.022384 0.059868 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.082906 0.028339 udp 10.0.2.105 7010 <-> 79.227.131.224 2430 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.111599 0.204347 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.316337 0.149260 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.466026 0.147010 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.613475 0.043630 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.657488 0.125503 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.783417 0.169198 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:32.953002 0.223222 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.176626 0.143445 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.320536 0.076221 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.397196 0.077453 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.474995 0.055770 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.531167 0.134036 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.665597 0.144477 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.810520 0.084029 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:33.894891 0.143048 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:34.038336 0.061919 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:34.100615 0.165825 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:34.266817 0.372699 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:34.639960 0.353381 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:34.993761 0.228988 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:35.223202 0.052611 udp 10.0.2.105 7010 <-> 86.157.252.173 1878 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:35.276246 0.176242 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:35.452849 0.370704 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:35.823927 0.185441 udp 10.0.2.105 7010 <-> 162.234.65.97 1895 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:36.009842 0.347191 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:36.357438 0.235015 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:36.592903 0.378781 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:36.972071 0.217361 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:37.189821 0.347499 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:37.537686 0.273646 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:37.811669 0.114149 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:37.926168 0.205656 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:38.132222 0.220377 udp 10.0.2.105 7010 <-> 99.111.77.224 3239 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:38.352955 0.161741 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:38.515138 0.076575 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:38.592153 0.374941 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:38.967490 0.381668 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:39.349616 0.167035 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:39.517085 0.248540 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:39.824932 0.329826 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:11:40.155186 0.292858 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:16:17.304378 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 20:16:24.313248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:16:32.313053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:16:48.316002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:17:20.322385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:23:24.327188 3.002800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:23:31.335642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:23:39.337017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:23:55.340118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:24:27.346108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:30:31.352648 3.001299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:30:38.359650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:30:46.361222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:31:02.364937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:31:34.370297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:33:14.604627 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 20:33:14.604773 0.832051 tcp 10.0.2.105 61163 -> 162.210.27.16 8808 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:37:38.376039 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:37:45.383610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:37:53.385131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:38:09.388152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:38:41.394112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:42:06.899949 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 20:42:06.900135 0.234722 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:07.135268 0.000000 udp 10.0.2.105 7010 -> 79.227.131.224 2430 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:42:25.628821 0.062572 tcp 10.0.2.105 61164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:25.691640 0.063481 tcp 10.0.2.105 61165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:25.755462 0.272514 tcp 10.0.2.105 61166 -> 195.113.214.249 443 SRPA* 0 0 35 23930 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:26.028503 0.202144 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.231069 0.147204 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.378662 0.144151 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.523183 0.063664 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.587235 0.059466 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.647069 0.044284 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.691787 0.125864 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.818097 0.167368 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:26.985889 0.236587 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:27.222852 0.142386 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:27.365666 0.074737 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:27.440819 0.070083 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:27.511266 0.054455 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:27.566113 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:42:46.016440 0.059374 tcp 10.0.2.105 61167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:46.076120 0.061420 tcp 10.0.2.105 61168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:46.137819 0.148764 tcp 10.0.2.105 61169 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:42:46.287050 0.142306 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:46.429764 0.060062 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:46.490251 0.166385 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:46.657029 0.133666 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:46.791073 0.147056 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:46.938544 0.372390 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:47.311327 0.342504 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:47.654202 0.226455 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:47.881063 0.050217 udp 10.0.2.105 7010 <-> 86.157.252.173 1878 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:42:47.931721 0.000000 udp 10.0.2.105 7010 -> 162.234.65.97 1895 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:43:04.663504 0.058874 tcp 10.0.2.105 61170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:04.722622 0.061136 tcp 10.0.2.105 61171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:04.784068 0.151830 tcp 10.0.2.105 61172 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:04.936696 0.175597 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:05.112664 0.368343 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:05.481369 0.365853 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:05.847626 0.218308 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:06.066380 0.332530 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:06.399288 0.235149 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:06.634822 0.384312 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.019496 0.244846 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.264763 0.078706 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.343855 0.205107 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.549328 0.056472 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.606206 0.348244 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:07.954851 0.000000 udp 10.0.2.105 7010 -> 99.111.77.224 3239 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 20:43:23.211537 0.060340 tcp 10.0.2.105 61173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:23.272160 0.065050 tcp 10.0.2.105 61174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:23.337565 0.148200 tcp 10.0.2.105 61175 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 20:43:23.486269 0.161635 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:23.648333 0.380564 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:24.029292 0.168217 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:24.197892 0.257420 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:24.455710 0.329539 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:43:24.785693 0.356480 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/11 20:44:45.401131 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 20:44:52.407712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:45:00.409324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:45:16.411826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:45:48.418687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:51:52.424704 3.001130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:51:59.431653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:52:07.432944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:52:23.435802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:52:55.442105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:58:59.448120 3.001908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 20:59:06.455468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:59:14.457319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 20:59:30.459966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:00:02.466297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:03:15.444165 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 21:03:15.444266 0.904698 tcp 10.0.2.105 61176 -> 162.210.27.16 8808 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:06:23.479822 2.999344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:06:30.483909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:06:38.487577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:06:54.562740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:07:26.506254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:13:30.510423 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:13:37.518065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:13:42.134512 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 21:13:42.134649 0.000000 udp 10.0.2.105 7010 -> 79.227.131.224 2430 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:13:45.519320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:13:58.800017 0.060457 tcp 10.0.2.105 61177 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:13:58.860727 0.061005 tcp 10.0.2.105 61178 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:13:58.922021 0.150108 tcp 10.0.2.105 61179 -> 195.113.214.249 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:13:59.072690 0.359608 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:13:59.432745 0.000000 udp 10.0.2.105 7010 -> 162.234.65.97 1895 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:14:01.523032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:14:16.638205 0.063117 tcp 10.0.2.105 61180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:16.701575 0.060787 tcp 10.0.2.105 61181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:16.762928 0.151338 tcp 10.0.2.105 61182 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:16.914764 0.000000 udp 10.0.2.105 7010 -> 99.111.77.224 3239 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:14:33.528797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:14:35.802396 0.118764 tcp 10.0.2.105 61183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:35.921443 0.061563 tcp 10.0.2.105 61184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:35.983246 0.150586 tcp 10.0.2.105 61185 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:36.134348 0.227526 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.362260 0.203637 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 200 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.566273 0.070464 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.637203 0.047702 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.685286 0.127988 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.813762 0.165194 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:36.979331 0.354710 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.334451 0.129288 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.464108 0.147078 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.611632 0.147341 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.759350 0.074990 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.834736 0.143795 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:37.978982 0.054048 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.033426 0.072714 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.106505 0.165241 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.272125 0.131122 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.403616 0.147141 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.551242 0.067768 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.619396 0.142526 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:38.762301 0.357121 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:39.119783 0.344622 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:39.464824 0.225235 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:39.690414 0.000000 udp 10.0.2.105 7010 -> 86.157.252.173 1878 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:14:58.014396 0.064136 tcp 10.0.2.105 61186 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:58.078818 0.090870 tcp 10.0.2.105 61187 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:58.169961 0.149875 tcp 10.0.2.105 61188 -> 195.113.214.249 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:14:58.320169 0.176729 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:58.497276 0.218230 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:58.715911 0.367215 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:59.083539 0.354294 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:59.438197 0.346076 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:14:59.784629 0.339431 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:00.124598 0.044367 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:00.169355 0.234642 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:00.404447 0.372833 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:00.777641 0.206268 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:00.984257 0.095970 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:01.080648 0.069364 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:01.150394 0.379372 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:01.530115 0.168257 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:01.698772 0.161505 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:01.860667 0.379911 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:02.240962 0.258309 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:15:02.499675 0.327007 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:20:37.535934 3.000253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:20:44.541822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:20:52.542986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:21:08.546730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:21:40.552537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:27:44.558914 3.001503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:27:51.566794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:27:59.567478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:28:15.570248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:28:47.576168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:33:16.353222 0.000173 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 21:33:16.353496 0.934587 tcp 10.0.2.105 61189 -> 162.210.27.16 8808 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:34:51.582141 3.001836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:34:58.590917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:35:06.591350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:35:22.594508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:35:54.600959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:41:58.605758 3.002164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 21:42:05.613876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:42:13.615347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:42:29.619439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:43:01.624159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:45:18.781950 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 21:45:18.782104 0.000000 udp 10.0.2.105 7010 -> 86.157.252.173 1878 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:45:36.510497 0.067549 tcp 10.0.2.105 61190 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:36.578506 0.059743 tcp 10.0.2.105 61191 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:36.638519 0.151852 tcp 10.0.2.105 61192 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:36.791132 0.100011 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:36.891558 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 3853 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 21:45:55.134353 0.064114 tcp 10.0.2.105 61193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:55.198715 0.066085 tcp 10.0.2.105 61194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:55.265112 0.151305 tcp 10.0.2.105 61195 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 21:45:55.416898 0.059564 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:55.476843 0.050844 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:55.528071 0.126911 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:55.655428 0.169370 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:55.825181 0.240793 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.066353 0.203620 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.270347 0.075058 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.345791 0.148361 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.494555 0.064742 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.559740 0.057882 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.618069 0.075161 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.693650 0.143737 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.837829 0.146905 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:56.985154 0.133118 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:57.118679 0.147316 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:57.266400 0.066497 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:57.333297 0.141989 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:57.475665 0.368979 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:57.845068 0.164021 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:58.009524 0.338228 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:58.348101 0.226206 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:58.574736 0.174003 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:58.749125 0.353041 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:59.102594 0.218901 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:45:59.321881 1.345735 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:00.717313 0.719667 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:01.437393 0.352913 udp 10.0.2.105 7010 <-> 49.144.60.160 2222 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:01.790875 0.047327 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:01.838537 0.234753 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:02.073725 0.378033 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:02.452378 0.203778 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:02.656684 0.082383 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:02.739531 0.055624 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:02.795584 0.378525 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:03.174524 0.167887 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:03.342803 0.161289 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:03.504529 0.329698 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:03.834642 0.417461 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:46:04.252640 0.254420 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/11 21:53:29.640344 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 21:53:36.647367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:53:44.649158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:54:00.653752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 21:54:32.657865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:00:36.664712 3.000736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:00:43.671473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:00:51.672703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:01:07.675739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:01:39.681966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:03:17.292560 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 22:03:17.292753 0.948139 tcp 10.0.2.105 61196 -> 162.210.27.16 8808 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:07:43.688312 3.001051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:07:50.695305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:07:58.701361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:08:14.699633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:08:46.705896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:14:50.712138 3.007648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:14:57.725914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:15:05.720772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:15:21.723602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:15:53.729865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:16:09.753202 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 22:16:09.753363 0.223118 udp 10.0.2.105 7010 <-> 190.222.147.144 3853 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:09.976909 0.111973 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.089270 0.126542 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.216179 0.168440 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.385069 0.240000 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.716997 0.206612 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.923993 0.059366 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:10.983720 0.044147 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.028289 0.075607 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.104473 0.149800 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.254681 0.076110 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.331223 0.054990 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.386572 0.604349 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:11.991321 0.146951 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.138678 0.155286 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.294354 0.134719 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.429527 0.146270 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.576175 0.065433 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.641975 0.140380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:12.782709 0.378447 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:13.161541 0.165267 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:13.327225 0.176613 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:13.504371 0.365782 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:13.870526 0.342971 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:14.213896 0.213941 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:14.428354 0.215500 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:14.644453 1.109678 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:15.754548 0.054903 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:15.809836 0.234782 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:16.045006 0.786033 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:16.831398 0.000000 udp 10.0.2.105 7010 -> 49.144.60.160 2222 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 22:16:33.018086 0.060405 tcp 10.0.2.105 61197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:16:33.078774 0.063029 tcp 10.0.2.105 61198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:16:33.142088 0.151036 tcp 10.0.2.105 61199 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:16:33.293913 0.372391 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:33.666739 0.202103 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:33.869210 0.085201 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:33.954833 0.054794 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:34.009977 0.378155 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:34.388494 0.329082 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:34.717946 0.359083 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:35.077415 0.168406 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:35.246196 0.162128 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:16:35.408764 0.257563 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:21:58.737080 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:22:05.744317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:22:13.746125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:22:29.748913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:23:01.755231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:29:05.761347 3.001722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:29:12.768778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:29:20.769979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:29:36.772982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:30:08.778903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:33:18.241587 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 22:33:18.241754 0.991653 tcp 10.0.2.105 61200 -> 162.210.27.16 8808 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:36:12.785129 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:36:19.792503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:36:27.794622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:36:43.796868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:37:15.803054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:43:20.029860 2.967642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 22:43:26.967315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:43:34.890807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:43:50.840970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:44:22.847086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:47:03.718582 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 22:47:03.718686 0.000000 udp 10.0.2.105 7010 -> 49.144.60.160 2222 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 22:47:21.045091 0.062277 tcp 10.0.2.105 61201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:21.107666 0.067915 tcp 10.0.2.105 61202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:21.175884 0.193637 tcp 10.0.2.105 61203 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:21.370112 0.125354 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:21.495885 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 3853 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 22:47:39.490162 0.063615 tcp 10.0.2.105 61204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:39.554078 0.062946 tcp 10.0.2.105 61205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:39.616874 0.151877 tcp 10.0.2.105 61206 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 22:47:39.769254 0.108087 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:39.877737 0.250366 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.128551 0.203764 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.332783 0.059290 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.392514 0.060256 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.453136 0.072775 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.526282 0.147783 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.674417 0.077761 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.752645 0.055997 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.809066 0.168029 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:40.977461 0.146421 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.124247 0.132003 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.256634 0.146439 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.403530 0.065405 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.469324 0.143059 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.612807 0.364309 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:41.977510 0.144193 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:42.122121 0.177407 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:42.299901 0.363639 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:42.663908 0.332801 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:42.997102 0.165799 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:43.163355 0.675741 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:43.839470 0.215978 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:44.055808 0.219478 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:44.275722 0.047446 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:44.323623 1.403248 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:45.727246 0.234154 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:45.961854 0.719730 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:46.682004 0.367816 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.050332 0.203578 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.254363 0.106634 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.361405 0.055477 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.417278 0.383833 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.801523 0.169102 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:47.971019 0.162165 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:48.133639 0.246895 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:48.380988 0.570153 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:47:48.951608 0.400098 udp 10.0.2.105 7010 <-> 59.99.74.10 9084 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/11 22:54:10.856065 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 22:54:17.862624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:54:25.864164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:54:41.867095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 22:55:13.873264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:01:17.879385 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:01:24.886777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:01:32.897847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:01:48.901064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:02:20.907153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:03:19.261230 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 23:03:19.261484 0.894959 tcp 10.0.2.105 61207 -> 162.210.27.16 8808 FSPA* 0 0 12 1476 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:08:24.913267 3.002058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:08:31.920626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:08:39.921877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:08:55.925123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:09:27.930560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:15:31.936710 3.002099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:15:38.968506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:15:46.956053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:16:02.959003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:16:34.965149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:18:11.293580 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 23:18:11.293744 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 3853 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:18:27.339656 0.130586 tcp 10.0.2.105 61208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:27.470553 0.062332 tcp 10.0.2.105 61209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:27.533202 0.150310 tcp 10.0.2.105 61210 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:27.684076 0.126973 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:27.811479 0.226725 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.038593 0.272152 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.311161 0.201598 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.513130 0.060138 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.573630 0.073242 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.647362 0.076686 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.724459 0.148648 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 590 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.873485 0.072068 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:28.945977 0.058880 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:29.005273 0.134833 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:29.140672 0.147812 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:29.288932 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:18:46.093860 0.065720 tcp 10.0.2.105 61211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:46.159868 0.062700 tcp 10.0.2.105 61212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:46.222830 0.154222 tcp 10.0.2.105 61213 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:18:46.377553 0.167643 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:46.545658 0.145081 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:46.691161 0.147286 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:46.838863 0.144727 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:46.984008 0.081817 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:47.066221 0.176771 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:47.243405 0.353399 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:47.597149 0.339755 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:47.937268 0.163997 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:48.101687 0.372733 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:48.474819 0.215585 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:48.690855 0.222836 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:48.914034 0.039536 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:48.953961 1.084441 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:50.038749 0.234620 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:50.273749 0.987698 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:51.261851 0.375819 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:51.638106 0.207156 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:51.845666 0.071792 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:51.917887 0.054931 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:51.973251 0.162197 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:52.135833 0.384732 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:52.521047 0.167773 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:52.689254 0.248054 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:52.937760 0.327946 udp 10.0.2.105 7010 <-> 190.134.162.175 1453 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:18:53.266057 0.000000 udp 10.0.2.105 7010 -> 59.99.74.10 9084 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:19:10.138178 0.065740 tcp 10.0.2.105 61214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:19:10.204417 0.062406 tcp 10.0.2.105 61215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:19:10.267140 0.151596 tcp 10.0.2.105 61216 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:22:39.972101 3.001835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 23:22:46.982074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:22:54.981196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:23:10.984461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:23:43.296831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:29:47.006426 3.086181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:29:54.065569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:30:02.025239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:30:18.028164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:30:50.034445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:33:20.160558 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 23:33:20.160774 0.956498 tcp 10.0.2.105 61217 -> 162.210.27.16 8808 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:36:54.040161 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:37:01.047726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:37:09.049239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:37:25.053104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:37:57.057853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:44:01.064378 3.001487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/11 23:44:08.071715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:44:16.073322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:44:32.076081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:45:04.082522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:49:22.834626 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/11 23:49:22.834723 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:49:41.783875 0.062494 tcp 10.0.2.105 61218 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:41.846652 0.060585 tcp 10.0.2.105 61219 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:41.907539 0.152695 tcp 10.0.2.105 61220 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:42.060753 0.000000 udp 10.0.2.105 7010 -> 59.99.74.10 9084 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:49:57.755494 0.062007 tcp 10.0.2.105 61221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:57.817805 0.066333 tcp 10.0.2.105 61222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:57.884481 0.145737 tcp 10.0.2.105 61223 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:49:58.030726 0.125398 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.156759 0.203653 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.360846 0.059131 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.420502 0.044003 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.464981 0.073341 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.538703 0.248850 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.787946 0.137682 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:58.926037 0.138214 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.064721 0.089344 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.154490 0.147917 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.466917 0.147626 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.614952 0.060067 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.675466 0.170241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.846114 0.142210 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:49:59.988711 0.078863 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:00.068035 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:50:17.163513 0.063325 tcp 10.0.2.105 61224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:17.227137 0.060383 tcp 10.0.2.105 61225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:17.287804 0.162283 tcp 10.0.2.105 61226 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:17.450598 0.148283 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:17.599314 0.145211 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:17.745006 0.343706 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:18.089153 0.374220 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:18.463782 0.219043 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:18.683284 0.167980 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:18.851904 0.357074 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:19.209388 0.042981 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:19.252833 0.223213 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:19.476476 0.385962 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:19.862882 0.234969 udp 10.0.2.105 7010 <-> 161.200.34.2 5040 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:20.098260 0.374426 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:20.473088 0.739536 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:21.213081 0.078885 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:21.292532 0.053233 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:21.346151 0.162246 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:21.508785 0.201031 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:21.710241 0.000000 udp 10.0.2.105 7010 -> 190.134.162.175 1453 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/11 23:50:39.798881 0.061458 tcp 10.0.2.105 61227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:39.860614 0.061984 tcp 10.0.2.105 61228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:39.922866 0.154408 tcp 10.0.2.105 61229 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/11 23:50:40.077813 0.167762 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:40.245968 0.380289 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:50:40.626634 0.246518 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/11 23:54:32.090865 3.002407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/11 23:54:39.099167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:54:47.100579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:55:03.103607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/11 23:55:35.109681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:01:39.115940 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:01:46.123001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:01:54.124852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:02:10.127378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:02:42.133753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:03:21.120041 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 00:03:21.120312 0.882955 tcp 10.0.2.105 61230 -> 162.210.27.16 8808 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:08:46.139247 3.002324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:08:53.146978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:09:01.148643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:09:17.151697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:09:49.157646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:15:54.165278 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:16:01.175470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:16:09.173273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:16:25.176965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:16:57.182970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:20:44.019195 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 00:20:44.019309 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 00:21:02.637761 0.064652 tcp 10.0.2.105 61231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:02.702770 0.067993 tcp 10.0.2.105 61232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:02.771080 0.146451 tcp 10.0.2.105 61233 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:02.918063 0.000000 udp 10.0.2.105 7010 -> 190.134.162.175 1453 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 00:21:19.250377 0.060061 tcp 10.0.2.105 61234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:19.310670 0.062103 tcp 10.0.2.105 61235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:19.373027 0.159637 tcp 10.0.2.105 61236 -> 195.113.214.249 443 SRPA* 0 0 38 30950 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:19.533294 0.071297 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:19.604956 0.057773 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:19.663075 0.205523 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:19.869024 0.126152 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:19.995646 0.042736 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.038834 0.132248 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.171457 0.069093 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.240967 0.215989 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.457373 0.195532 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.653308 0.146380 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.800081 0.080003 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.880555 0.064222 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:20.945163 0.151500 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:21.097047 0.148757 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:21.246220 0.167934 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:21.414523 0.354379 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:21.769313 0.147505 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:21.917224 0.145430 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:22.063043 0.371771 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:22.435222 0.215666 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:22.651310 0.165653 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:22.817333 0.333233 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:23.151023 0.042053 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:23.193642 0.223681 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:23.417696 0.000000 udp 10.0.2.105 7010 -> 161.200.34.2 5040 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 00:21:39.609665 0.065403 tcp 10.0.2.105 61237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:39.675369 0.060864 tcp 10.0.2.105 61238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:39.736648 0.154626 tcp 10.0.2.105 61239 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:21:39.891792 1.647437 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:41.539830 0.382845 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:41.923068 0.093301 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.016741 0.323602 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.340699 0.054163 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.395235 0.202848 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.598452 0.162477 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.761393 0.168905 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:42.930643 0.382688 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:21:43.313705 0.248439 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:23:01.188459 3.001822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 00:23:08.195968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:23:16.197930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:23:32.200738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:24:04.206964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:30:08.212923 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:30:15.220537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:30:23.221986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:30:39.224684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:31:11.230863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:33:22.009061 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 00:33:22.009296 0.969308 tcp 10.0.2.105 61240 -> 162.210.27.16 8808 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:37:15.236397 3.002594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:37:22.243903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:37:30.245737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:37:46.248783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:38:18.254789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:44:22.260647 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 00:44:29.268323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:44:37.269851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:44:53.273201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:45:25.278834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:52:12.514555 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 00:52:12.514743 0.000000 udp 10.0.2.105 7010 -> 161.200.34.2 5040 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 00:52:31.443958 0.062568 tcp 10.0.2.105 61241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:31.506854 0.064825 tcp 10.0.2.105 61242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:31.572018 0.150803 tcp 10.0.2.105 61243 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:31.723293 0.059427 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:31.783113 0.202615 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:31.986066 0.125970 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.112452 0.051012 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.163902 0.132682 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.296990 0.117113 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.414459 0.237483 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.652353 0.072554 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.725276 0.089936 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.815567 0.061154 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:32.877143 0.147094 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.024638 0.147421 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.172620 0.145872 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.318901 0.081202 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.400657 0.147299 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.548440 0.154681 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.703586 0.169217 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:33.873263 0.368074 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:34.241743 0.352063 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:34.594173 0.043543 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:34.638136 0.375933 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:35.014462 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 00:52:53.254080 0.060845 tcp 10.0.2.105 61244 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:53.315173 0.060938 tcp 10.0.2.105 61245 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:53.376487 0.150418 tcp 10.0.2.105 61246 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 00:52:53.527417 0.167081 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:53.694879 0.221814 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:53.917085 1.325610 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:55.243147 0.376115 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:55.619631 0.095505 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:55.715541 0.708043 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:56.423983 0.056989 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:56.481401 0.168668 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:56.650447 0.376388 udp 10.0.2.105 7010 <-> 112.120.19.37 1580 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:57.027287 0.201572 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:57.229284 0.162493 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:52:57.392140 0.258074 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 00:54:43.294646 3.000732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 00:54:50.301032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:54:58.303197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:55:14.305850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 00:55:46.311926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:01:50.618002 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:01:57.625407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:02:05.627200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:02:21.630570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:02:53.636320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:03:23.269415 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 01:03:23.269600 0.853976 tcp 10.0.2.105 61247 -> 162.210.27.16 8808 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:08:57.761041 3.002987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:09:04.769645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:09:12.771388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:09:28.774111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:10:00.779774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:16:04.786336 3.001360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:16:11.793422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:16:19.794976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:16:35.798114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:17:07.804120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:23:06.740525 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 01:23:06.740635 0.218267 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:06.959297 0.057784 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.017483 0.126414 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.144501 0.046713 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.191621 0.138424 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.330532 0.086039 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.417000 0.206083 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.623556 0.059972 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.683896 0.219967 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.904351 0.071295 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:07.976089 0.148805 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.125280 0.147301 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.273029 0.081215 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.354613 0.146784 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.501776 0.142895 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.645156 0.168193 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.813752 0.083871 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:08.898072 0.141888 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:09.040527 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 01:23:11.810281 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:23:18.817728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:23:26.480685 0.093613 tcp 10.0.2.105 61248 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:26.574576 0.060173 tcp 10.0.2.105 61249 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:26.635012 0.149103 tcp 10.0.2.105 61250 -> 195.113.214.249 443 SRPA* 0 0 43 22148 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:26.784885 0.344021 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:26.819003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:23:27.129271 0.396418 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:27.526055 0.047671 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:27.574088 0.164429 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:27.738905 0.219454 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:27.958750 1.622968 udp 10.0.2.105 7010 <-> 112.210.43.91 5414 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:29.582159 0.114987 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:29.697492 0.341354 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:30.039242 0.056368 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:30.096083 0.363055 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:30.459510 0.227985 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:30.687863 0.169728 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:30.857997 0.000000 udp 10.0.2.105 7010 -> 112.120.19.37 1580 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 01:23:42.824193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:23:46.257785 0.059996 tcp 10.0.2.105 61251 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:46.318080 0.062517 tcp 10.0.2.105 61252 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:46.380934 0.161314 tcp 10.0.2.105 61253 -> 195.113.214.249 443 SRPA* 0 0 24 13388 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:23:46.542743 0.161835 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:23:46.704962 0.249156 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:24:14.828092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:30:18.834824 3.000824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:30:25.841652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:30:33.843112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:30:49.846169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:31:21.852185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:33:24.128480 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 01:33:24.128598 1.026214 tcp 10.0.2.105 61254 -> 162.210.27.16 8808 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:37:25.858394 3.000966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:37:32.865627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:37:40.866849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:37:56.870095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:38:28.879510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:44:32.881708 3.008278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 01:44:39.892120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:44:47.890709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:45:03.894802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:45:35.900102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:53:48.488634 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 01:53:48.488773 0.343791 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:53:48.832923 0.000000 udp 10.0.2.105 7010 -> 112.120.19.37 1580 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 01:54:07.417906 0.061457 tcp 10.0.2.105 61255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:07.479642 0.064557 tcp 10.0.2.105 61256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:07.544535 0.153914 tcp 10.0.2.105 61257 -> 195.113.214.249 443 SRPA* 0 0 42 21468 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:07.699012 0.132534 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:07.831960 0.125908 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:07.958209 0.060345 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.018879 0.217616 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.236938 0.044856 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.282159 0.059680 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.342206 0.219587 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.562190 0.074381 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.636953 0.201992 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.839342 0.157529 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:08.997280 0.078302 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.075994 0.148812 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.225213 0.070426 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.296021 0.083023 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.379431 0.140952 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.520809 0.144917 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.666120 0.147348 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.813813 0.165450 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:09.979629 0.347285 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:10.327369 0.165838 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:10.493674 0.221699 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:10.715772 0.407600 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:11.123766 0.051679 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:11.175833 0.340305 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:11.516567 0.054559 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:11.571564 0.000000 udp 10.0.2.105 7010 -> 112.210.43.91 5414 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 01:54:29.257956 0.060292 tcp 10.0.2.105 61258 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:29.318570 0.062049 tcp 10.0.2.105 61259 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:29.380875 0.154900 tcp 10.0.2.105 61260 -> 195.113.214.249 443 SRPA* 0 0 23 13140 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:29.536427 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 01:54:45.030278 0.061597 tcp 10.0.2.105 61261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:45.092168 0.061478 tcp 10.0.2.105 61262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:45.153941 0.149690 tcp 10.0.2.105 61263 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 01:54:45.304394 0.666856 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:45.971589 0.202589 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:46.174571 0.169340 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:46.344264 0.162279 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:46.507000 0.257017 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/12 01:54:49.909156 3.001931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 01:54:56.916446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:55:04.918007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:55:20.921426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 01:55:52.927395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:01:56.944184 3.001365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:02:03.950784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:02:11.951970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:02:27.955321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:02:59.961255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:03:25.157997 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 02:03:25.158093 0.931772 tcp 10.0.2.105 61264 -> 162.210.27.16 8808 FSPA* 0 0 14 1499 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:09:03.967130 3.001814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:09:10.974454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:09:18.976177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:09:34.979200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:10:06.985316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:16:10.992806 2.999870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:16:17.998806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:16:26.042080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:16:42.012896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:17:14.019321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:23:18.025237 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:23:25.033316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:23:33.034023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:23:49.040854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:24:21.043091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:25:15.421468 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 02:25:15.421645 0.000000 udp 10.0.2.105 7010 -> 112.210.43.91 5414 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:25:32.547960 0.065229 tcp 10.0.2.105 61265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:32.613439 0.064133 tcp 10.0.2.105 61266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:32.677932 0.161555 tcp 10.0.2.105 61267 -> 195.113.214.249 443 SRPA* 0 0 42 22478 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:32.840129 0.086998 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:32.927519 0.379320 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.307243 0.055099 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.362798 0.125921 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.489139 0.133317 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.622824 0.075164 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.698361 0.044225 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.743003 0.215748 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:33.959123 0.061104 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:34.020592 0.211178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:34.232216 0.077781 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:34.310378 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:25:49.661550 0.104737 tcp 10.0.2.105 61268 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:49.766605 0.062408 tcp 10.0.2.105 61269 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:49.829335 0.161699 tcp 10.0.2.105 61270 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:25:49.991954 0.188692 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.181082 0.096652 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.278168 0.202909 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.481495 0.145915 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.627810 0.143792 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.772054 0.147770 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:50.920451 0.147759 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:51.068670 0.167190 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:51.236268 0.355495 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:51.592376 0.165336 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:51.758166 0.218545 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:51.977129 0.045561 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:25:52.023066 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:26:10.801239 0.065510 tcp 10.0.2.105 61271 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:26:10.867018 0.063255 tcp 10.0.2.105 61272 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:26:10.930578 0.152982 tcp 10.0.2.105 61273 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:26:11.083737 0.366626 udp 10.0.2.105 7010 <-> 113.28.179.100 5109 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:11.450778 0.055235 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:11.506435 0.412189 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:11.919015 0.161829 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:12.081230 0.257692 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:12.339317 0.203819 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:26:12.543568 0.168599 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:30:25.049525 3.137027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 02:30:32.162216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:30:40.094762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:30:56.071212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:31:28.077357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:33:26.097504 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 02:33:26.097618 0.903594 tcp 10.0.2.105 61274 -> 162.210.27.16 8808 FSPA* 0 0 15 1583 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:37:32.093810 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:37:39.103399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:37:47.105579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:38:03.109080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:38:35.111233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:44:39.118793 2.999848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:44:46.125058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:44:54.126273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:45:10.129178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:45:42.135269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:54:48.143683 3.000984 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 02:54:55.149777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:55:03.151755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:55:19.154824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:55:51.160658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 02:56:30.499596 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 02:56:30.499819 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:56:47.353989 0.065606 tcp 10.0.2.105 61275 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:56:47.419885 0.061490 tcp 10.0.2.105 61276 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:56:47.481679 0.150019 tcp 10.0.2.105 61277 -> 195.113.214.249 443 SRPA* 0 0 35 26670 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:56:47.632524 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:57:04.416398 0.062460 tcp 10.0.2.105 61278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:04.479165 0.060836 tcp 10.0.2.105 61279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:04.540488 0.205780 tcp 10.0.2.105 61280 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:04.746922 0.352301 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.099573 0.096267 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.196288 0.059620 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.256320 0.073380 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.330091 0.044568 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.375098 0.222574 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.598035 0.058968 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.657408 0.218598 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:05.876482 0.131815 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.008662 0.127006 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.136112 0.074112 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.210622 0.064991 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.276002 0.096470 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.372850 0.144178 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.517477 0.146147 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.664078 0.146061 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.810539 0.162965 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:06.973861 0.148386 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:07.122713 0.201890 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:07.325033 0.051635 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:07.377071 0.346401 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:07.723821 0.167038 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:07.891286 0.221627 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:08.113273 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 02:57:24.054997 0.061740 tcp 10.0.2.105 61281 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:24.117016 0.066768 tcp 10.0.2.105 61282 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:24.184114 0.156318 tcp 10.0.2.105 61283 -> 195.113.214.249 443 SRPA* 0 0 32 13666 flow=From-Botnet-V2-TCP-Established 1970/02/12 02:57:24.340857 0.075427 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:24.416662 0.327860 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:24.744933 0.162194 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:24.907562 0.257707 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:25.165683 0.215114 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 02:57:25.381197 0.169088 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:01:55.166284 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 03:02:02.173691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:02:10.176045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:02:26.178392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:02:58.189777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:03:27.006465 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 03:03:27.006662 0.873497 tcp 10.0.2.105 61284 -> 162.210.27.16 8808 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:09:05.205908 3.000854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:09:12.213071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:09:20.213711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:09:36.216959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:10:08.222797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:16:12.228623 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:16:19.236661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:16:27.237843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:16:43.240931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:17:15.257013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:23:19.263183 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:23:26.270117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:23:34.272023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:23:50.274679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:24:22.280964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:27:52.223520 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 03:27:52.223727 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 5109 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 03:28:10.771044 0.063926 tcp 10.0.2.105 61285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:10.835315 0.062889 tcp 10.0.2.105 61286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:10.898503 0.200896 tcp 10.0.2.105 61287 -> 195.113.214.249 443 SRPA* 0 0 42 22726 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:11.100027 0.059442 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:11.159864 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 03:28:29.997248 0.061886 tcp 10.0.2.105 61288 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:30.059433 0.098269 tcp 10.0.2.105 61289 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:30.157966 0.161603 tcp 10.0.2.105 61290 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:30.320118 0.108462 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:30.428962 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 03:28:48.897208 0.166819 tcp 10.0.2.105 61291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:49.064340 0.062618 tcp 10.0.2.105 61292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:49.127218 0.209364 tcp 10.0.2.105 61293 -> 195.113.214.249 443 SRPA* 0 0 41 22790 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:28:49.337108 0.066925 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.404518 0.215408 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.620420 0.070329 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.691101 0.054028 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.745533 0.075613 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.821631 0.070818 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:49.931533 0.093271 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.025195 0.144647 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.170298 0.126415 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.297114 0.132445 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.429960 0.168649 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.599047 0.149043 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.748490 0.144820 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:50.893703 0.147917 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:51.042032 0.164869 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:51.207311 0.203860 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:51.411628 0.048472 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:51.460598 0.344189 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:51.805234 0.226271 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:52.031940 0.055705 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:52.088084 0.249095 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:52.337603 0.327697 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:52.665714 0.163174 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:52.829288 0.202833 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:28:53.032706 0.168925 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:30:26.287312 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 03:30:33.294361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:30:41.296109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:30:57.299010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:31:29.304942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:33:27.885662 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 03:33:27.885954 0.946528 tcp 10.0.2.105 61294 -> 162.210.27.16 8808 FSPA* 0 0 15 1773 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:37:33.310641 3.004587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:37:40.318530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:37:48.319913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:38:04.322707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:38:36.328952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:44:40.335262 3.001822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:44:47.342485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:44:55.343935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:45:11.346715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:45:43.359191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:54:49.360562 3.001444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 03:54:56.368349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:55:04.372930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:55:20.372417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:55:52.378615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 03:59:12.506904 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 03:59:12.507066 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 03:59:31.275557 0.061945 tcp 10.0.2.105 61295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:31.337791 0.061851 tcp 10.0.2.105 61296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:31.399963 0.152597 tcp 10.0.2.105 61297 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:31.553069 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 03:59:48.778810 0.064234 tcp 10.0.2.105 61298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:48.843125 0.062749 tcp 10.0.2.105 61299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:48.906149 0.157999 tcp 10.0.2.105 61300 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 03:59:49.064702 0.057621 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.122718 0.105077 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.228365 0.059645 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.288576 0.211806 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.500786 0.073653 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.574850 0.048966 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.624361 0.074538 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.699287 0.074955 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.774723 0.086613 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:49.861735 0.144862 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.006985 0.128472 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.135867 0.132982 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.269254 0.169332 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.438986 0.151245 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.590743 0.146821 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.738006 0.149722 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:50.888102 0.166501 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:51.054975 0.201608 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:51.257020 0.043283 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:51.300707 0.063064 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:51.364169 0.254951 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/12 03:59:51.619552 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 04:00:09.238452 0.064795 tcp 10.0.2.105 61301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:00:09.303552 0.063711 tcp 10.0.2.105 61302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:00:09.367568 0.158802 tcp 10.0.2.105 61303 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:00:09.527275 0.225062 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:00:09.752864 0.203822 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:00:09.957035 0.168452 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:00:10.125909 0.329180 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:00:10.455502 0.162929 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:01:56.384804 3.001372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 04:02:03.391781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:02:11.393427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:02:27.396612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:02:59.405983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:03:28.835021 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 04:03:28.835122 0.974058 tcp 10.0.2.105 61304 -> 162.210.27.16 8808 FSPA* 0 0 15 1739 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:09:05.411053 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:09:12.418933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:09:20.420152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:09:36.425664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:10:08.429434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:16:12.435650 3.001464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:16:19.442619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:16:27.443931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:16:43.451334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:17:15.455532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:23:19.469126 3.033460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:23:26.492971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:23:34.487623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:23:50.491550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:24:22.497193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:30:26.507270 2.997648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:30:27.401103 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 04:30:27.401208 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 04:30:33.510759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:30:41.511948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:30:43.396924 0.062398 tcp 10.0.2.105 61305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:30:43.459614 0.061810 tcp 10.0.2.105 61306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:30:43.521670 0.152751 tcp 10.0.2.105 61307 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:30:43.674911 0.062652 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:43.738015 0.056533 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:43.794945 0.102183 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:43.897548 0.072790 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:43.970765 0.086222 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.057436 0.078283 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.136090 0.068378 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.204866 0.085080 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.290350 0.147814 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.438573 0.219663 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.658622 0.132879 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.791853 0.126473 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:44.918674 0.144996 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.064087 0.148952 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.213523 0.166400 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.213877 2.998015 tcp 10.0.2.105 61308 -> 174.93.8.134 2124 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 04:30:45.380376 0.207677 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.588476 0.050182 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.639128 0.055090 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.694584 0.168695 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:45.863671 0.144036 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:46.008131 0.248980 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:46.257572 0.168794 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:46.426712 0.223786 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:46.650964 0.201075 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:46.852567 1.042244 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:47.895207 0.162694 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 04:30:54.210463 0.000000 tcp 10.0.2.105 61308 -> 174.93.8.134 2124 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 04:30:57.515165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:31:29.521216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:33:29.814379 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 04:33:29.814607 1.116942 tcp 10.0.2.105 61309 -> 162.210.27.16 8808 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/12 04:37:33.526656 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:37:40.535835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:37:48.536333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:38:04.539060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:38:36.546656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:44:40.551427 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:44:47.558622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:44:55.560653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:45:11.563540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:45:43.573722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:54:51.579897 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 04:54:58.586980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:55:06.588619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:55:22.591730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 04:55:54.597741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:01:16.520925 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 05:01:16.521114 0.088231 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:16.609740 0.071248 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:16.681539 0.045813 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:16.682119 3.003047 tcp 10.0.2.105 61310 -> 86.133.231.238 8218 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 05:01:16.727756 0.202311 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:16.930454 0.082552 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.013393 0.092755 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.106532 0.057477 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.164651 0.061785 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.226831 0.144910 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.372162 0.483185 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.855739 0.133162 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:17.989288 0.126034 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.115753 0.224268 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.340558 0.147087 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.488026 0.163786 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.652354 0.202791 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.855555 0.050948 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.906923 0.056425 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:18.963712 0.169550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:19.133646 0.148166 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:19.282204 0.257815 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:19.540615 0.204591 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:19.745603 0.170409 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:19.916405 0.229621 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:20.146445 1.203886 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:21.350714 0.163446 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:01:25.683577 0.000000 tcp 10.0.2.105 61310 -> 86.133.231.238 8218 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 05:01:58.603943 3.011280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:02:05.621102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:02:13.622762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:02:29.625944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:03:01.635533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:03:30.934080 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 05:03:30.934268 0.974702 tcp 10.0.2.105 61311 -> 162.210.27.16 8808 FSPA* 0 0 15 1605 flow=From-Botnet-V2-TCP-Established 1970/02/12 05:09:14.642754 3.000735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:09:21.647913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:09:29.649434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:09:45.652786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:10:17.658353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:16:21.665564 3.000562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:16:28.672371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:16:36.673431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:16:52.678878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:17:24.692389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:23:28.698977 3.000978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:23:35.705869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:23:43.708818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:23:59.710683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:24:31.716390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:30:35.723271 3.000703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:30:42.729835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:30:50.731540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:31:06.734209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:31:33.253359 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 05:31:33.253520 0.047539 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:33.301452 0.086588 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:33.388667 0.072895 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:33.462122 0.841126 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:33.462670 3.004517 tcp 10.0.2.105 61312 -> 86.133.231.238 8218 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 05:31:34.303623 0.071082 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:34.375137 0.093339 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:34.468859 0.059140 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:34.528508 0.054605 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:34.583513 0.148048 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:34.781521 0.606998 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:35.388913 0.134965 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:35.524398 0.127115 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:35.652004 0.170002 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:35.822419 0.152282 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:35.975079 0.164953 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.140510 0.205989 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.346939 0.041713 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.389056 0.082172 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.471564 0.168968 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.640938 0.146651 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:36.787944 0.249633 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:37.037936 0.206620 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:37.244903 0.169015 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:37.414328 0.226878 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:37.641590 1.078959 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:38.720988 0.162711 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/12 05:31:38.740909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:31:42.475799 0.000000 tcp 10.0.2.105 61312 -> 86.133.231.238 8218 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 05:33:31.913625 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 05:33:31.913790 0.906235 tcp 10.0.2.105 61313 -> 162.210.27.16 8808 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/12 05:37:42.746364 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:37:49.760557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:37:57.755288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:38:13.758743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:38:45.764085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:44:49.770763 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:44:56.777691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:45:04.779067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:45:20.782112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:45:52.788175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:51:56.794249 3.001549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:52:03.801751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:52:11.803435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:52:27.806485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:52:59.812626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:59:03.818756 3.000954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 05:59:10.825750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:59:18.826979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 05:59:34.829911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:00:06.836253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:01:53.880416 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 06:01:53.880514 0.072127 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:01:53.953007 0.523884 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:01:54.477420 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 06:01:54.477953 3.007606 tcp 10.0.2.105 61314 -> 86.167.238.61 6047 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:02:03.483935 0.000000 tcp 10.0.2.105 61314 -> 86.167.238.61 6047 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:02:13.319918 0.065449 tcp 10.0.2.105 61315 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:02:13.385641 0.062175 tcp 10.0.2.105 61316 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:02:13.448140 0.277431 tcp 10.0.2.105 61317 -> 195.113.214.249 443 SRPA* 0 0 56 37989 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:02:13.726153 0.077723 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:13.804418 0.068838 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:13.873666 0.082029 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:13.961213 0.062110 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:14.023746 0.058963 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:14.083092 0.145522 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:14.229008 0.683238 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:14.912631 0.131526 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.044518 0.125815 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.170799 0.145925 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.317174 0.148857 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.466490 0.164647 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.631582 0.204903 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.836965 0.044866 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.837319 2.998808 tcp 10.0.2.105 61318 -> 108.232.100.12 4892 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:02:15.882248 0.054968 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:15.937651 0.168758 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:16.106866 0.144788 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:16.252100 0.259365 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:16.511893 0.210195 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:16.722453 0.168665 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:16.891490 0.221177 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:17.113085 0.731001 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:17.844498 0.162479 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:02:24.834772 0.000000 tcp 10.0.2.105 61318 -> 108.232.100.12 4892 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:03:32.823053 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 06:03:32.823221 0.991797 tcp 10.0.2.105 61319 -> 162.210.27.16 8808 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:06:35.848500 3.001280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 06:06:42.855803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:06:50.857180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:07:06.860211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:07:38.870626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:13:44.876433 3.000401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 06:13:51.882635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:13:59.884026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:14:15.887132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:14:47.893060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:20:51.899274 3.000793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 06:20:58.909989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:21:06.907444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:21:22.913443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:21:54.917123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:27:58.923131 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 06:28:05.929997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:28:13.931872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:28:29.934787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:29:01.941453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:32:22.289583 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 06:32:22.289748 0.087990 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:22.378320 0.068288 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:22.378826 4.945519 tcp 10.0.2.105 61320 -> 95.238.125.142 4306 SPA_* 0 0 169 105149 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:32:22.447015 0.879175 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.326575 0.069748 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.396689 0.077972 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.475042 0.084640 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.560098 0.062445 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.622927 0.063668 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.686963 0.143701 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:23.831020 0.277176 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:24.108594 0.137656 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:24.246598 0.127080 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:24.374090 0.314655 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:24.689207 0.147332 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:24.837040 0.164461 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.001823 0.206112 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.208322 0.052358 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.261037 0.082461 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.462078 0.166911 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.629398 0.147931 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:25.777736 0.249320 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:26.027481 0.202541 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:26.230379 0.169148 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:26.399893 0.228737 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:26.629014 0.338479 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:26.967896 0.162647 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:27.417575 4.945152 tcp 10.0.2.105 61320 -> 95.238.125.142 4306 A_PA 0 0 258 165224 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:32:32.946623 3.968458 tcp 10.0.2.105 61320 -> 95.238.125.142 4306 FPA_* 0 0 149 91360 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:32:54.115271 0.114103 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.229806 0.095392 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.325567 0.047837 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.373815 0.067164 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.441421 0.073972 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.515778 0.085410 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.601576 0.044683 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.646694 0.050262 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.697350 0.143088 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.840897 0.415965 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:54.841235 2.999018 tcp 10.0.2.105 61321 -> 70.52.124.21 3087 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:32:55.257267 0.133156 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:55.390816 0.127261 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:55.518606 0.246160 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:55.820152 0.144254 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:55.964760 0.163794 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.128924 0.200477 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.329783 0.055190 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.385341 0.072854 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.458586 0.166117 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.625102 0.144512 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:56.770072 0.248262 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:57.018701 0.213311 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:57.232584 0.324480 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:57.557503 0.160160 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:57.718047 0.167481 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:32:57.885955 0.226131 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 06:33:00.804456 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 06:33:03.838734 0.000000 tcp 10.0.2.105 61321 -> 70.52.124.21 3087 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/12 06:33:38.509282 0.852283 tcp 10.0.2.105 61322 -> 162.210.27.16 8808 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/12 06:35:05.986454 3.002357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 06:35:12.994684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:35:20.996021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:35:36.998686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:36:09.005258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:42:13.011528 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 06:42:20.018671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:42:28.019974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:42:44.025202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:43:16.028732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:53:39.037563 3.001508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 06:53:46.044927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:53:54.046247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:54:10.049272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 06:54:42.055232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:00:46.062466 3.000703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:00:53.068161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:01:01.069868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:01:17.073382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:01:49.079140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:03:05.529418 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 07:03:05.529549 0.049610 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.579556 0.074040 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.654015 0.072165 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.726555 0.068243 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.795177 0.087088 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.882706 0.082609 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:05.883082 4.986304 tcp 10.0.2.105 61323 -> 84.127.239.194 5825 SPA_* 0 0 715 452539 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:03:05.965637 0.055306 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.021373 0.059651 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.081404 0.144790 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.226537 0.217719 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.444680 0.138278 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.583286 0.128434 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.712104 0.146816 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:06.859317 0.149606 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.009330 0.163978 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.173670 0.203667 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.377721 0.042305 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.420604 0.055794 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.476708 0.166996 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.644063 0.146733 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:07.791196 0.239708 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:08.031312 0.211575 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:08.243214 0.169192 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:08.412809 0.225427 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:08.638605 0.318004 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:08.957052 0.163193 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:03:10.930036 3.613176 tcp 10.0.2.105 61323 -> 84.127.239.194 5825 FPA_* 0 0 387 245317 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:03:39.374896 1.067063 tcp 10.0.2.105 61324 -> 162.210.27.16 8808 FSPA* 0 0 14 1501 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:07:53.085139 3.001758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 07:08:00.092839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:08:08.094263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:08:24.097140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:08:56.103293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:15:00.109345 3.003656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:15:07.116547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:15:15.118075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:15:31.122598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:16:03.137214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:22:07.143605 3.001504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:22:14.150240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:22:22.152935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:22:38.154987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:23:10.161259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:29:14.166667 3.131274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:29:21.273386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:29:29.209214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:29:45.189172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:30:17.195305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:33:23.633668 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 07:33:23.633839 0.054721 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:23.688964 0.079977 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:23.769330 0.093112 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:23.862830 0.082146 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:23.945328 0.077569 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.023296 0.081033 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.104777 0.057232 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.162412 0.056703 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.219525 0.144154 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.364084 0.275875 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.640542 0.131930 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.772886 0.126336 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:24.899599 0.146737 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.046750 0.147948 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.195113 0.162978 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.358506 0.204368 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.563284 0.043381 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.607019 0.325558 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:25.932948 0.239111 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:26.172492 0.202058 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:26.374924 0.168661 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:26.543983 0.211431 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:26.755780 0.147779 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:26.903987 0.161588 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:27.065941 0.222564 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 07:33:27.288903 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 07:33:40.437687 0.864625 tcp 10.0.2.105 61325 -> 162.210.27.16 8808 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:33:45.456315 0.062410 tcp 10.0.2.105 61326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:33:45.518990 0.059979 tcp 10.0.2.105 61327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:33:45.579267 0.372934 tcp 10.0.2.105 61328 -> 195.113.214.249 443 SRPA* 0 0 38 27889 flow=From-Botnet-V2-TCP-Established 1970/02/12 07:36:21.201461 3.001749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:36:28.208154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:36:36.210075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:36:52.223146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:37:24.229142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:43:28.235437 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:43:35.245761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:43:43.243887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:43:59.247597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:44:31.253103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:54:17.269359 3.011548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 07:54:24.285670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:54:32.290809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:54:48.290081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 07:55:20.296570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:01:24.303209 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:01:31.311518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:01:39.311573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:01:55.314375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:02:27.320356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:03:41.307353 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 08:03:41.307492 0.954693 tcp 10.0.2.105 61329 -> 162.210.27.16 8808 FSPA* 0 0 14 1728 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:04:09.046477 1.290961 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.337817 0.077913 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.416135 0.089521 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.506048 0.075015 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.581489 0.075047 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.656884 0.304131 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:10.961411 0.053718 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.015533 0.059688 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.075563 0.144895 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.220827 0.066768 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.287936 0.135812 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.424092 0.125744 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.550363 0.142777 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:11.693498 0.433001 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:12.126900 0.163824 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:12.291167 0.144517 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:12.436121 0.276399 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:12.712947 0.206792 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:12.920154 0.203101 udp 10.0.2.105 7010 <-> 190.84.240.16 7704 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:13.123675 0.240398 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:13.364474 0.053040 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:13.417943 0.147329 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:13.565663 0.161842 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:13.727869 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 08:04:13.803196 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 08:04:31.423085 0.067531 tcp 10.0.2.105 61330 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:04:31.490926 0.068083 tcp 10.0.2.105 61331 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:04:31.559298 0.161293 tcp 10.0.2.105 61332 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:04:31.721130 0.166804 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:04:31.888533 0.169466 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:08:31.332042 2.999009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 08:08:38.333673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:08:46.335349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:09:02.340938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:09:34.352437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:15:43.356915 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:15:50.364877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:15:58.366445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:16:14.378572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:16:46.375974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:22:50.383899 2.999247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:22:57.389030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:23:05.390245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:23:21.393359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:23:53.400975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:29:57.407877 3.000735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:30:04.412598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:30:12.420850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:30:28.417535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:31:00.423485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:33:42.267405 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 08:33:42.267566 1.018482 tcp 10.0.2.105 61333 -> 162.210.27.16 8808 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:34:44.865871 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 08:34:44.866043 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 08:35:00.460526 0.065011 tcp 10.0.2.105 61334 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:00.525782 0.064426 tcp 10.0.2.105 61335 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:00.590467 0.158089 tcp 10.0.2.105 61336 -> 195.113.214.249 443 SRPA* 0 0 19 9796 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:00.749139 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 08:35:19.056024 0.066233 tcp 10.0.2.105 61337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:19.122545 0.061176 tcp 10.0.2.105 61338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:19.183940 0.156492 tcp 10.0.2.105 61339 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:19.340936 0.075537 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:19.416881 0.138307 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:19.555607 0.084742 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:19.640667 1.042891 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:20.684012 0.078946 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:20.763388 0.059496 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:20.823285 0.056461 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:20.880142 0.046286 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:20.926796 0.133123 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:21.060364 0.126171 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:21.186893 0.146490 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:21.333777 0.146498 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:21.480666 0.164273 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:21.645351 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 08:35:39.885780 0.063506 tcp 10.0.2.105 61340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:39.949459 0.063907 tcp 10.0.2.105 61341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:40.013664 0.185226 tcp 10.0.2.105 61342 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:40.199527 0.148527 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:40.348631 0.057621 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:40.406642 0.211236 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:40.618296 0.000000 udp 10.0.2.105 7010 -> 190.84.240.16 7704 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 08:35:58.306185 0.062023 tcp 10.0.2.105 61343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:58.368454 0.063928 tcp 10.0.2.105 61344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:58.432669 0.156405 tcp 10.0.2.105 61345 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 08:35:58.590009 0.148081 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:58.738516 0.162058 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:58.900996 0.610678 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:59.512144 0.277109 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:59.810425 0.170851 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:35:59.982317 0.169232 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/02/12 08:37:04.432691 2.998203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 08:37:11.436919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:37:19.438044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:37:35.441406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:38:07.447487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:44:11.454229 3.000862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:44:18.460995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:44:26.462048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:44:42.465311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:45:14.471233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:54:35.480856 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 08:54:42.488015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:54:50.490862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:55:06.495161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 08:55:38.498890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:01:42.504067 3.002075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 09:01:49.511917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:01:57.513568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:02:13.520983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:02:45.522923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:03:43.286094 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:03:43.286280 0.815106 tcp 10.0.2.105 61346 -> 162.210.27.16 8808 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:08.208092 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:06:08.208289 0.078849 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:08.287539 0.638493 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:08.926463 0.000000 udp 10.0.2.105 7010 -> 190.84.240.16 7704 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:06:24.949242 0.061618 tcp 10.0.2.105 61347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:25.011164 0.061446 tcp 10.0.2.105 61348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:25.072923 0.152370 tcp 10.0.2.105 61349 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:25.225896 0.091148 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:25.317422 0.084063 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:25.401885 0.092725 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:25.495079 0.056827 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:25.552360 0.382477 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:25.935229 0.133151 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.068823 0.131646 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.200864 0.142629 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.343876 0.059913 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.404159 0.078708 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.483202 0.066501 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.550251 0.164765 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.715458 0.145160 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:26.861046 0.145004 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.006427 0.057070 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.063882 0.213167 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.277387 0.148777 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.426530 0.162240 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.589230 0.167914 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.757529 0.169479 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:27.927439 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:06:45.728649 0.063252 tcp 10.0.2.105 61350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:45.792188 0.066892 tcp 10.0.2.105 61351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:45.859381 0.160127 tcp 10.0.2.105 61352 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:06:46.020124 4.815322 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 4 929 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:46.403527 0.313011 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:46.716989 0.713625 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:47.431076 0.100072 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:47.531593 0.101404 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 667 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:47.633448 0.049566 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:47.683435 0.559589 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.243507 0.075568 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.319459 0.067864 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.387718 0.134252 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.522371 0.148107 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.670921 0.050812 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.722145 0.067341 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.789891 0.080864 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:48.871358 0.164529 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.036465 0.145844 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.182761 0.145939 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.329114 0.132272 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.461800 0.368728 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.830938 0.160572 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 669 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:49.991910 0.164429 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 787 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:50.156848 0.170211 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:50.327530 0.060341 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:50.388309 0.204230 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:06:50.836128 0.000000 udp 10.0.2.105 7010 -> 124.38.192.98 2624 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:06:56.884930 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:05.177306 0.388335 udp 10.0.2.105 7010 <-> 115.69.242.244 5749 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:07:05.754650 0.000000 udp 10.0.2.105 7010 -> 76.108.1.135 8289 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:09.804119 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:07:13.397709 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:19.553605 0.000000 udp 10.0.2.105 7010 -> 84.198.141.137 3566 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:25.885112 0.000000 udp 10.0.2.105 7010 -> 94.178.228.104 1025 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:34.217725 0.219402 udp 10.0.2.105 7010 -> 119.42.152.68 8581 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:34.437127 0.000000 icmp 119.42.152.68 0x0303 -> 10.0.2.105 0x8521 URP 192 1 292 flow=Background 1970/02/12 09:07:38.804049 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:07:39.255008 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:45.082822 0.000000 udp 10.0.2.105 7010 -> 213.190.167.188 8443 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:53.925817 0.000000 udp 10.0.2.105 7010 -> 204.85.208.230 3590 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:07:59.784583 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:04.310886 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:08:07.355564 0.000000 udp 10.0.2.105 7010 -> 66.166.28.203 7822 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:15.927207 0.000000 udp 10.0.2.105 7010 -> 212.19.100.78 3165 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:22.517024 0.000000 udp 10.0.2.105 7010 -> 95.246.38.22 2992 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:28.976388 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:33.803284 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:08:36.712512 0.000000 udp 10.0.2.105 7010 -> 222.240.233.66 3487 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:42.055167 0.000000 udp 10.0.2.105 7010 -> 86.14.11.126 9459 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:48.083886 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:49.528807 3.001175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 09:08:54.803398 0.000000 udp 10.0.2.105 7010 -> 64.40.243.226 4203 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:08:56.535756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:08:59.810041 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:09:02.835022 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:04.541388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:09:10.951233 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:16.054209 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:20.540594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:09:22.813818 0.000000 udp 10.0.2.105 7010 -> 93.193.158.122 7662 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:27.810504 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:09:29.333385 0.171450 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 686 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:09:29.886265 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:37.425156 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:43.467115 0.000000 udp 10.0.2.105 7010 -> 74.115.3.62 8573 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:49.111732 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:09:52.546241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:09:53.807945 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:09:56.712495 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:05.214943 0.000000 udp 10.0.2.105 7010 -> 173.12.248.153 7029 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:13.947363 0.000000 udp 10.0.2.105 7010 -> 207.150.245.254 5351 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:18.803917 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:10:22.909925 0.000000 udp 10.0.2.105 7010 -> 95.7.80.229 2827 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:29.940080 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:37.871717 0.000000 udp 10.0.2.105 7010 -> 203.59.235.88 9173 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:42.809569 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:10:44.000827 0.000000 udp 10.0.2.105 7010 -> 107.7.19.194 3699 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:49.858808 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:10:57.509995 0.000000 udp 10.0.2.105 7010 -> 75.69.44.109 1195 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:02.947954 0.000000 udp 10.0.2.105 7010 -> 5.71.57.223 9233 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:07.804445 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:11:10.837938 0.000000 udp 10.0.2.105 7010 -> 216.212.230.102 1593 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:17.248467 0.000000 udp 10.0.2.105 7010 -> 216.58.41.148 3911 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:23.317429 0.000000 udp 10.0.2.105 7010 -> 195.32.93.106 1024 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:28.534463 0.096856 udp 10.0.2.105 7010 -> 93.67.209.214 5922 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:28.631319 0.000000 icmp 93.67.209.214 0x0303 -> 10.0.2.105 0x2217 URP 192 1 232 flow=Background 1970/02/12 09:11:33.311331 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:11:34.813583 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:42.655087 0.000000 udp 10.0.2.105 7010 -> 74.8.93.194 8477 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:51.427613 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:58.517536 0.132654 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:11:58.650190 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 149 flow=Background 1970/02/12 09:12:03.304451 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:12:05.567920 0.219846 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 693 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:06.097114 0.183513 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:06.356504 0.068892 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:06.604714 0.146855 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:06.940586 0.342068 udp 10.0.2.105 7010 <-> 117.201.103.171 3675 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:07.505434 0.000000 udp 10.0.2.105 7010 -> 74.7.112.25 6576 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:13.697913 0.000000 udp 10.0.2.105 7010 -> 94.34.143.166 9141 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:21.341703 0.073029 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:21.616732 0.000000 udp 10.0.2.105 7010 -> 95.13.77.225 8667 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:27.495258 0.000000 udp 10.0.2.105 7010 -> 87.22.242.193 4057 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:32.400408 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:12:36.455919 0.039760 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:36.930696 0.000000 udp 10.0.2.105 7010 -> 88.72.24.31 9103 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:43.932975 0.000000 udp 10.0.2.105 7010 -> 187.14.162.83 9735 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:52.815673 0.000000 udp 10.0.2.105 7010 -> 92.30.229.255 4469 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:12:57.802763 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:12:59.695741 0.018567 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:12:59.853771 0.215310 udp 10.0.2.105 7010 <-> 186.95.111.166 5166 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:00.156395 0.000000 udp 10.0.2.105 7010 -> 79.30.14.147 2494 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:06.475319 0.000000 udp 10.0.2.105 7010 -> 58.6.69.221 5664 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:11.833144 0.000000 udp 10.0.2.105 7010 -> 165.145.155.198 2816 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:19.747242 0.000000 udp 10.0.2.105 7010 -> 82.71.13.33 5660 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:24.310566 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:13:26.323747 0.000000 udp 10.0.2.105 7010 -> 46.12.124.146 6500 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:34.315596 0.000000 udp 10.0.2.105 7010 -> 195.191.202.211 5675 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:40.834676 0.050866 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:40.971191 0.066830 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:41.142389 0.169790 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:41.321398 0.223897 udp 10.0.2.105 7010 <-> 190.222.147.144 8775 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:41.558395 0.031670 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:13:41.922668 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 2782 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:47.403920 0.000000 udp 10.0.2.105 7010 -> 86.162.160.5 7929 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:52.311135 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:13:52.692043 0.000000 udp 10.0.2.105 7010 -> 65.68.190.51 7028 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:13:58.149677 0.000000 udp 10.0.2.105 7010 -> 84.190.6.177 8751 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:04.979915 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:10.347193 0.059605 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:10.421101 0.000000 udp 10.0.2.105 7010 -> 86.153.26.175 3077 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:16.936692 0.000000 udp 10.0.2.105 7010 -> 106.69.23.55 2747 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:21.803290 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:14:22.695156 0.088323 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:23.209609 0.000000 udp 10.0.2.105 7010 -> 94.240.198.62 7534 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:28.212957 0.069183 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:28.542609 0.072639 udp 10.0.2.105 7010 <-> 78.178.125.203 2797 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:28.918943 0.077808 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:29.384628 0.355290 udp 10.0.2.105 7010 <-> 190.73.235.69 3980 CON 0 0 2 779 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:29.750373 0.066261 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:29.926004 0.000000 udp 10.0.2.105 7010 -> 81.138.13.31 6439 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:36.645020 0.153905 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:14:36.917040 0.000000 udp 10.0.2.105 7010 -> 151.50.231.25 9783 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:45.367735 0.000000 udp 10.0.2.105 7010 -> 178.215.221.178 9435 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:14:50.304134 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:14:52.878333 0.000000 udp 10.0.2.105 7010 -> 78.97.152.166 4185 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:01.771341 0.000000 udp 10.0.2.105 7010 -> 196.214.71.74 2951 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:07.923289 0.000000 udp 10.0.2.105 7010 -> 194.54.63.175 5484 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:14.649992 0.000000 udp 10.0.2.105 7010 -> 76.184.74.218 1315 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:19.308508 0.020359 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:15:22.270689 0.000000 udp 10.0.2.105 7010 -> 195.110.137.234 6919 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:31.073366 0.000000 udp 10.0.2.105 7010 -> 64.58.240.254 9098 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:38.002795 0.000000 udp 10.0.2.105 7010 -> 79.21.97.76 9555 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:44.222395 0.000000 udp 10.0.2.105 7010 -> 201.148.55.181 6102 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:48.808173 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:15:49.999838 0.000000 udp 10.0.2.105 7010 -> 190.100.23.138 5273 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:56.770068 0.000000 udp 10.0.2.105 7010 -> 87.248.45.54 7955 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:15:57.554727 3.000626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 09:16:02.748815 0.000000 udp 10.0.2.105 7010 -> 186.155.140.212 2270 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:04.561555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:16:09.668716 0.000000 udp 10.0.2.105 7010 -> 76.10.140.57 3992 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:12.562663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:16:14.305268 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:16:15.547242 0.000000 udp 10.0.2.105 7010 -> 46.49.59.40 3829 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:23.408703 0.077541 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:16:23.786315 0.000000 udp 10.0.2.105 7010 -> 87.101.230.38 6343 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:28.565888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:16:31.570179 0.000000 udp 10.0.2.105 7010 -> 109.145.136.175 7001 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:40.503298 0.000000 udp 10.0.2.105 7010 -> 70.194.64.206 6843 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:45.309265 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:16:46.191478 0.000000 udp 10.0.2.105 7010 -> 70.128.236.65 9001 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:16:52.179609 0.000000 udp 10.0.2.105 7010 -> 66.18.243.50 3321 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:00.571748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:17:00.802502 0.000000 udp 10.0.2.105 7010 -> 195.77.163.161 1204 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:08.904837 0.000000 udp 10.0.2.105 7010 -> 24.239.41.224 7684 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:13.810491 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:17:16.004087 0.368950 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:17:16.585595 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:22.713820 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:29.133027 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:34.150089 0.000000 udp 10.0.2.105 7010 -> 82.89.175.71 6750 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:38.806602 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:17:39.527774 0.000000 udp 10.0.2.105 7010 -> 75.151.248.1 1025 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:45.716811 0.000000 udp 10.0.2.105 7010 -> 151.63.104.173 9606 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:53.858653 0.000000 udp 10.0.2.105 7010 -> 86.150.192.235 3805 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:17:59.596957 0.000000 udp 10.0.2.105 7010 -> 95.248.41.205 9512 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:18:04.305371 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:18:04.735780 0.203195 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:18:05.157607 0.000000 udp 10.0.2.105 7010 -> 81.138.7.133 9086 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:18:12.495313 0.000000 udp 10.0.2.105 7010 -> 79.49.95.250 3704 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:23:04.578142 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 09:23:11.585452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:23:19.586865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:23:35.589821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:24:07.595711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:30:11.601864 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 09:30:18.609253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:30:26.610576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:30:42.613653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:31:14.619783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:33:44.105290 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:33:44.105433 0.915205 tcp 10.0.2.105 61353 -> 162.210.27.16 8808 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:37:18.625964 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 09:37:25.637958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:37:33.634482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:37:49.637656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:38:21.643507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:44:25.651015 3.000620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 09:44:32.656956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:44:40.661472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:44:56.661495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:45:28.667637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:48:48.625416 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 09:48:48.625581 0.344643 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:48.970630 0.244146 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.215182 0.098593 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.314187 0.062418 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.377193 0.045870 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.423460 0.363118 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.787025 0.068626 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.856023 0.076116 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:49.932558 0.132475 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.065405 0.149113 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.214881 0.059971 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.275243 0.079245 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.354893 0.144819 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.500107 0.137816 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:50.638348 2.208043 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:52.846746 0.141680 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:52.988782 0.145573 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.134749 0.203709 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.338843 0.168921 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.508131 0.178592 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.687083 0.165846 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.853342 0.060527 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:53.914242 0.237788 udp 10.0.2.105 7010 <-> 71.39.70.171 8289 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.152457 0.146662 udp 10.0.2.105 7010 <-> 115.69.242.244 5749 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.299542 0.159660 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.459592 0.215422 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.675385 0.071281 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.747047 0.173418 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:54.920883 0.146666 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:48:55.067947 0.000000 udp 10.0.2.105 7010 -> 117.201.103.171 3675 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:49:10.759320 0.059885 tcp 10.0.2.105 61354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:10.819433 0.065867 tcp 10.0.2.105 61355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:10.885588 0.131843 tcp 10.0.2.105 61356 -> 195.113.214.249 443 SRPA* 0 0 36 27819 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:11.017945 0.089808 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:11.108095 0.036254 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:11.144742 0.000000 udp 10.0.2.105 7010 -> 186.95.111.166 5166 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:49:29.344541 0.063466 tcp 10.0.2.105 61357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:29.408287 0.065433 tcp 10.0.2.105 61358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:29.474118 0.149427 tcp 10.0.2.105 61359 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:29.624122 0.020699 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:29.645190 0.082299 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:29.727871 0.047448 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:29.775694 0.090898 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:29.866972 0.225952 udp 10.0.2.105 7010 <-> 190.222.147.144 8775 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:30.093332 0.063279 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:30.157005 0.000000 udp 10.0.2.105 7010 -> 95.160.227.82 1351 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 09:49:48.241969 0.059744 tcp 10.0.2.105 61360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:48.301964 0.065196 tcp 10.0.2.105 61361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:48.367450 0.156569 tcp 10.0.2.105 61362 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 09:49:48.524579 0.081039 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:48.606027 0.069759 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:48.676170 0.072600 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:48.749161 0.074622 udp 10.0.2.105 7010 <-> 78.178.125.203 2797 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:48.824225 0.066063 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:48.890711 0.470898 udp 10.0.2.105 7010 <-> 190.73.235.69 3980 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:49.362014 0.155399 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:49.517847 0.071610 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:49.589850 0.369215 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:49:49.959417 0.196354 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 09:54:42.679332 2.999162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 09:54:49.684107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:54:57.686081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:55:13.688793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 09:55:45.695026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:01:49.704169 2.998316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:01:56.708198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:02:04.709725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:02:20.712737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:02:52.718900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:03:45.024346 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 10:03:45.024506 0.901529 tcp 10.0.2.105 61363 -> 162.210.27.16 8808 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:09:01.731826 3.001755 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:09:08.739559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:09:16.741359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:09:32.743752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:10:04.750018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:16:08.767351 3.000030 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:16:15.778958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:16:23.776699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:16:39.777703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:17:11.784044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:20:00.577147 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 10:20:00.577252 0.000000 udp 10.0.2.105 7010 -> 117.201.103.171 3675 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:20:16.190945 0.064565 tcp 10.0.2.105 61364 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:16.255785 0.061604 tcp 10.0.2.105 61365 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:16.317677 0.175280 tcp 10.0.2.105 61366 -> 195.113.214.249 443 SRPA* 0 0 25 13912 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:16.493453 0.000000 udp 10.0.2.105 7010 -> 186.95.111.166 5166 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:20:33.454357 0.062837 tcp 10.0.2.105 61367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:33.517460 0.217832 tcp 10.0.2.105 61368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:33.735553 0.155621 tcp 10.0.2.105 61369 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:33.891676 0.000000 udp 10.0.2.105 7010 -> 95.160.227.82 1351 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:20:52.582745 0.061438 tcp 10.0.2.105 61370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:52.644519 0.063412 tcp 10.0.2.105 61371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:52.708182 0.157897 tcp 10.0.2.105 61372 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:20:52.866806 0.366833 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.234016 0.213717 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.448175 0.057223 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.505787 0.092174 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.598320 0.056864 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.655575 0.137724 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.793672 0.144940 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.938951 0.059335 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:53.998657 0.074709 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.073769 0.337465 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.411661 0.076635 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.488734 0.070091 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.559201 0.131144 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.797849 0.145943 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:54.944215 0.167491 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.112104 0.146537 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.259064 0.148588 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.408057 0.168897 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.577438 0.204794 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.782686 0.161849 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:55.944922 0.166067 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:20:56.111375 0.000000 udp 10.0.2.105 7010 -> 71.39.70.171 8289 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:21:12.020357 0.063770 tcp 10.0.2.105 61373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:21:12.084461 0.063157 tcp 10.0.2.105 61374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:21:12.147883 0.166149 tcp 10.0.2.105 61375 -> 195.113.214.249 443 SRPA* 0 0 69 69904 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:21:12.314595 0.059452 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:12.374429 0.359750 udp 10.0.2.105 7010 <-> 115.69.242.244 5749 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:12.734583 0.057345 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:12.792343 0.218771 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.011460 0.163508 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.175327 0.179309 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.354976 0.146416 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.501828 0.036741 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.539013 0.068225 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.607685 0.067683 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.675772 0.030331 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.706459 0.225327 udp 10.0.2.105 7010 <-> 190.222.147.144 8775 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.932202 0.029929 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:13.962516 0.141838 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.104774 0.155001 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.260362 0.063773 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.324590 0.070751 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.395766 0.071271 udp 10.0.2.105 7010 <-> 78.178.125.203 2797 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.467397 0.065832 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.533673 0.087988 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.622114 0.151667 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.774137 0.078030 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:14.852542 0.259865 udp 10.0.2.105 7010 <-> 190.73.235.69 3980 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:15.112788 0.371672 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:21:15.484853 0.457114 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:23:15.789274 3.006783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 10:23:22.797405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:23:30.798918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:23:46.801843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:24:18.807927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:30:22.813733 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:30:29.821350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:30:37.823063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:30:53.825891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:31:25.831931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:33:45.924214 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 10:33:45.924411 1.041065 tcp 10.0.2.105 61376 -> 162.210.27.16 8808 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:37:29.837411 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:37:36.845215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:37:44.846820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:38:00.850508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:38:32.855715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:44:36.863200 3.000288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 10:44:43.869163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:44:51.870700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:45:07.876758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:45:39.879940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:51:38.626016 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 10:51:38.626261 0.000000 udp 10.0.2.105 7010 -> 71.39.70.171 8289 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:51:56.443599 0.065940 tcp 10.0.2.105 61377 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:51:56.509815 0.065188 tcp 10.0.2.105 61378 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:51:56.575271 0.160910 tcp 10.0.2.105 61379 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:51:56.736769 0.559140 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.296349 0.057108 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.353888 0.087827 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.442157 0.046929 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.489469 0.133925 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.623797 0.141386 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.765582 0.060553 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:57.826533 0.269254 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.096129 0.079482 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.176047 0.065534 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.242016 0.126140 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.368562 0.146085 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.515079 0.166324 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.681862 0.147348 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:58.829598 0.341726 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.171752 0.075309 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.303231 0.163359 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.466987 0.165297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.636440 0.146644 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.783472 0.170305 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:51:59.954197 0.209053 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.163639 0.059163 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.223205 0.148494 udp 10.0.2.105 7010 <-> 115.69.242.244 5749 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.372117 0.084583 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.457221 0.209052 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.666668 0.163808 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:00.830911 0.177554 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.008897 0.145875 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.155152 0.034372 udp 10.0.2.105 7010 <-> 194.208.77.117 7724 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.189930 0.066432 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.256764 0.067625 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.324752 0.030107 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:01.355255 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 8775 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 10:52:18.774279 0.060232 tcp 10.0.2.105 61380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:52:18.834880 0.063259 tcp 10.0.2.105 61381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:52:18.898447 0.155621 tcp 10.0.2.105 61382 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 10:52:19.054538 0.029829 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.084726 0.047283 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.132542 0.469234 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.602214 0.068523 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.671117 0.073804 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.745304 0.075421 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.821120 0.150025 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:19.971558 0.077885 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:20.049884 0.266191 udp 10.0.2.105 7010 <-> 190.73.235.69 3980 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:20.316466 0.068948 udp 10.0.2.105 7010 <-> 78.178.125.203 2797 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:20.385753 0.065032 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:20.451194 0.372370 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:52:20.823956 0.197902 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/12 10:54:48.892541 3.001060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 10:54:55.899403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:55:03.900923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:55:19.903605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 10:55:51.909809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:01:55.916010 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:02:02.923263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:02:10.925422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:02:26.927052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:02:58.933701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:03:46.973886 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 11:03:46.973992 0.971024 tcp 10.0.2.105 61383 -> 162.210.27.16 8808 FSPA* 0 0 15 1783 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:09:10.951195 3.001347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:09:17.958884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:09:25.960046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:09:41.963311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:10:13.969241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:16:17.976730 3.000778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:16:24.982589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:16:32.984061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:16:48.986846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:17:20.993139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:22:47.873351 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 11:22:47.873464 0.000000 udp 10.0.2.105 7010 -> 190.222.147.144 8775 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:23:05.770575 0.065130 tcp 10.0.2.105 61384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:05.835939 0.063571 tcp 10.0.2.105 61385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:05.899823 0.162307 tcp 10.0.2.105 61386 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:06.062705 0.085498 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.148712 0.049233 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.198320 0.140876 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.339624 0.058152 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.398138 0.147064 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.545578 0.061719 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.607652 0.221041 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.829037 0.077188 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.906619 0.073654 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:06.980625 0.131542 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:07.112529 0.164451 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:07.277486 0.144961 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:07.422809 0.126736 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:07.549904 0.145338 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:07.695642 0.356290 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.052330 0.162423 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.215166 0.076279 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.291839 0.168498 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.460725 0.203829 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.664947 0.167310 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.832664 0.058074 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:08.891142 0.159742 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.051276 0.218133 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.269864 0.161381 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.431596 0.147582 udp 10.0.2.105 7010 <-> 115.69.242.244 5749 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.579575 0.097064 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.677148 0.067242 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.744845 0.054230 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.799499 0.033644 udp 10.0.2.105 7010 <-> 89.173.219.154 7663 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:09.833547 0.176120 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:10.010043 0.147161 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:10.157641 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:23:24.999573 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:23:29.103602 0.065325 tcp 10.0.2.105 61387 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:29.169172 0.061892 tcp 10.0.2.105 61388 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:29.231356 0.157530 tcp 10.0.2.105 61389 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:29.389499 0.028186 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:29.418182 0.040272 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:29.458859 2.353630 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:31.812890 0.064739 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:31.878006 0.069946 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:31.948541 0.077379 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:32.006563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:23:32.026316 0.155986 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:32.182753 0.071069 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:32.254200 0.065670 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:32.320400 0.375438 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:32.696229 0.000000 udp 10.0.2.105 7010 -> 190.73.235.69 3980 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:23:40.007907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:23:49.912807 0.062277 tcp 10.0.2.105 61390 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:49.975356 0.060688 tcp 10.0.2.105 61391 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:50.036370 0.159447 tcp 10.0.2.105 61392 -> 195.113.214.249 443 SRPA* 0 0 24 13844 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:23:50.196481 0.084816 udp 10.0.2.105 7010 <-> 78.178.125.203 2797 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:50.281683 0.191094 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:23:56.011226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:24:28.016696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:30:32.024320 2.999861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:30:39.030719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:30:47.032699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:31:03.035293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:31:35.040838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:33:47.952624 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 11:33:47.952827 1.032873 tcp 10.0.2.105 61393 -> 162.210.27.16 8808 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:37:39.048451 3.071201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:37:46.093909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:37:54.065892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:38:10.068560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:38:42.075174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:44:46.080649 3.008130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:44:53.088847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:45:01.090068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:45:17.092987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:45:49.099074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:51:53.105004 3.001991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 11:52:00.112594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:52:08.114034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:52:24.116848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:52:56.122649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:53:54.647516 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 11:53:54.647688 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:54:13.465974 0.060909 tcp 10.0.2.105 61394 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:13.527168 0.062141 tcp 10.0.2.105 61395 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:13.589717 0.153663 tcp 10.0.2.105 61396 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:13.743904 0.000000 udp 10.0.2.105 7010 -> 190.73.235.69 3980 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:54:29.898430 0.061180 tcp 10.0.2.105 61397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:29.959876 0.061306 tcp 10.0.2.105 61398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:30.021567 0.152505 tcp 10.0.2.105 61399 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:30.174571 0.266911 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.441868 0.046966 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.489210 0.106673 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.596272 0.055474 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.652100 0.218907 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.871402 0.081875 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:30.953687 0.062414 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.016500 0.139299 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.156155 0.165577 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.322097 0.059434 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.381893 0.143759 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.526113 0.164658 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.691197 0.076959 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.768705 0.145252 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:31.914327 0.144256 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.058995 0.126956 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.186359 0.346801 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.533543 0.106172 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.640095 0.144654 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.785140 0.207780 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:32.993338 0.169479 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.163224 0.168247 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.331865 0.207088 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.539403 0.058886 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.598700 0.066834 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.665894 0.054176 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:33.720523 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:54:52.150683 0.064392 tcp 10.0.2.105 61400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:52.215329 0.062469 tcp 10.0.2.105 61401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:52.278054 0.201258 tcp 10.0.2.105 61402 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:54:52.479844 0.176641 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:52.656902 0.145465 udp 10.0.2.105 7010 <-> 99.180.84.79 1464 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:54:52.802747 0.000000 udp 10.0.2.105 7010 -> 115.69.242.244 5749 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:55:09.785700 0.060494 tcp 10.0.2.105 61403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:09.846560 0.061612 tcp 10.0.2.105 61404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:09.908454 0.159706 tcp 10.0.2.105 61405 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:10.068668 0.159791 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.228790 0.040328 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.269510 0.034873 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.304743 0.075133 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.380316 0.130500 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.511219 0.148156 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.659789 0.072155 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.732577 0.060591 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.793612 0.077829 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.871815 0.061399 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:10.933624 0.374491 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:55:11.308715 0.000000 udp 10.0.2.105 7010 -> 78.178.125.203 2797 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 11:55:26.540348 0.060994 tcp 10.0.2.105 61406 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:26.601734 0.062178 tcp 10.0.2.105 61407 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:26.664283 0.166162 tcp 10.0.2.105 61408 -> 195.113.214.249 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/12 11:55:26.831045 0.193355 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 11:59:00.128646 3.011491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 11:59:07.146484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:59:15.147959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 11:59:31.150664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:00:03.157057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:03:48.992365 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 12:03:48.992566 0.921760 tcp 10.0.2.105 61409 -> 162.210.27.16 8808 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:06:31.167353 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:06:38.175044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:06:46.176715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:07:02.178901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:07:34.185641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:13:42.197322 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:13:49.204697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:13:57.205785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:14:13.209655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:14:45.215084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:20:49.220677 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:20:56.228224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:21:04.230218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:21:20.233027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:21:52.239316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:25:43.351801 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 12:25:43.351894 0.000000 udp 10.0.2.105 7010 -> 89.173.219.154 7663 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:26:00.017323 0.161574 tcp 10.0.2.105 61410 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:00.179161 0.061111 tcp 10.0.2.105 61411 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:00.240524 0.156333 tcp 10.0.2.105 61412 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:00.397427 0.000000 udp 10.0.2.105 7010 -> 115.69.242.244 5749 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:26:17.732004 0.059961 tcp 10.0.2.105 61413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:17.792265 0.067877 tcp 10.0.2.105 61414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:17.860585 0.157452 tcp 10.0.2.105 61415 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:18.018600 0.000000 udp 10.0.2.105 7010 -> 78.178.125.203 2797 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:26:36.949227 0.060687 tcp 10.0.2.105 61416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:37.010238 0.062982 tcp 10.0.2.105 61417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:37.073482 0.153913 tcp 10.0.2.105 61418 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:37.228055 0.095784 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.324411 0.045836 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.370672 0.237449 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.608506 0.057628 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.666523 0.131153 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.798067 0.167303 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:37.965773 0.060293 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.026501 0.211821 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.238744 0.064709 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.303826 0.075804 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.379997 0.145505 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.525902 0.073791 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.600125 0.144586 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.745091 0.162557 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:38.908061 0.145009 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.053462 0.378086 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.431986 0.125513 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.557915 0.057136 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.615493 0.147487 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.763348 0.167701 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:39.931423 0.224970 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.156795 0.166140 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.323311 0.055406 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.379099 0.068199 udp 10.0.2.105 7010 <-> 84.173.27.183 7912 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.447717 0.202487 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.650588 0.056629 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.721445 0.177824 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:40.899652 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:26:56.046580 0.062123 tcp 10.0.2.105 61419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:56.108997 0.061598 tcp 10.0.2.105 61420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:56.170943 0.151887 tcp 10.0.2.105 61421 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:26:56.323379 0.047726 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:56.371518 0.176507 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:56.548596 0.069201 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:56.618172 0.615292 udp 10.0.2.105 7010 <-> 92.40.119.248 4890 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.233883 0.150467 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.384732 0.070274 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.455374 0.065174 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.520952 0.029711 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.551068 0.075092 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.626593 0.065569 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:57.692629 0.365861 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:26:58.058893 0.191691 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:27:56.245627 3.001362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 12:28:03.252657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:28:11.254048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:28:27.257005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:28:59.263295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:33:49.921502 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 12:33:49.921603 1.062730 tcp 10.0.2.105 61422 -> 162.210.27.16 8808 FSPA* 0 0 15 1687 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:35:03.268620 3.002697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:35:10.277324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:35:18.278224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:35:34.280889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:36:06.287222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:42:10.297693 3.001618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:42:17.303890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:42:25.302284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:42:41.317105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:43:13.311407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:53:37.322095 3.000879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 12:53:44.328428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:53:52.329719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:54:08.332758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:54:40.338905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 12:57:02.253547 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 12:57:02.253698 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:57:17.396055 0.060664 tcp 10.0.2.105 61423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:17.457025 0.064891 tcp 10.0.2.105 61424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:17.522206 0.150722 tcp 10.0.2.105 61425 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:17.673466 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:57:34.720113 0.061218 tcp 10.0.2.105 61426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:34.781717 0.061933 tcp 10.0.2.105 61427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:34.844024 0.153501 tcp 10.0.2.105 61428 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:34.998100 0.044491 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.042959 0.055132 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.098435 0.137163 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.235966 0.164194 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.400572 0.059941 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.460950 0.210725 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.672072 0.066052 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.738567 0.075206 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:35.814127 0.666760 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:36.481329 0.143227 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:36.624996 0.162034 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:36.787442 0.147957 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:36.935846 0.144175 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.080452 0.072580 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.153421 0.126150 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.279948 0.056232 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.336750 0.150284 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.487393 0.167639 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.655461 0.218232 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:37.874115 0.167679 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:38.042165 0.057223 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:38.099777 0.351722 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:38.451853 0.175736 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:38.627973 0.000000 udp 10.0.2.105 7010 -> 84.173.27.183 7912 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:57:55.289872 0.060585 tcp 10.0.2.105 61429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:55.350816 0.062074 tcp 10.0.2.105 61430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:55.413149 0.161294 tcp 10.0.2.105 61431 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:57:55.574952 0.212282 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:57:55.787580 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:58:14.367330 0.061471 tcp 10.0.2.105 61432 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:14.429069 0.061896 tcp 10.0.2.105 61433 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:14.491239 0.154997 tcp 10.0.2.105 61434 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:14.646737 0.046269 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:14.693400 0.158647 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:14.852460 0.068821 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:14.921627 0.000000 udp 10.0.2.105 7010 -> 92.40.119.248 4890 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 12:58:29.983798 0.062615 tcp 10.0.2.105 61435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:30.046696 0.061395 tcp 10.0.2.105 61436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:30.108423 0.157242 tcp 10.0.2.105 61437 -> 195.113.214.249 443 SRPA* 0 0 45 39188 flow=From-Botnet-V2-TCP-Established 1970/02/12 12:58:30.266305 0.152803 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:30.419492 0.028274 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:30.448194 0.088666 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:30.537252 0.064946 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:30.602594 0.375245 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:30.978213 0.197241 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:31.175840 0.075703 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/12 12:58:31.251940 0.061487 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:00:44.355049 2.993520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 13:00:51.352468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:00:59.353664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:01:15.357510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:01:47.362859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:03:50.981248 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 13:03:50.981453 0.875507 tcp 10.0.2.105 61438 -> 162.210.27.16 8808 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:07:51.368893 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:07:58.376415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:08:06.377925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:08:22.380647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:08:54.396820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:14:58.402590 3.006226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:15:05.409603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:15:13.411689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:15:29.414912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:16:01.421034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:22:06.428242 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:22:13.439987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:22:21.437061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:22:37.439827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:23:09.446197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:28:52.920786 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 13:28:52.920919 0.094340 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:28:53.015699 0.000000 udp 10.0.2.105 7010 -> 84.173.27.183 7912 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 13:29:11.889319 0.060930 tcp 10.0.2.105 61439 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:11.950512 0.063576 tcp 10.0.2.105 61440 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:12.014416 0.153159 tcp 10.0.2.105 61441 -> 195.113.214.249 443 SRPA* 0 0 19 8778 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:12.168334 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 13:29:13.451863 3.001823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:29:20.459562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:29:28.460759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:29:30.875199 0.063887 tcp 10.0.2.105 61442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:30.939373 0.062787 tcp 10.0.2.105 61443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:31.002516 0.153677 tcp 10.0.2.105 61444 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:31.156914 0.000000 udp 10.0.2.105 7010 -> 92.40.119.248 4890 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 13:29:44.464001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:29:48.300398 0.064518 tcp 10.0.2.105 61445 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:48.365229 0.060116 tcp 10.0.2.105 61446 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:48.425660 0.148111 tcp 10.0.2.105 61447 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:29:48.574320 0.055417 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:48.630177 0.132598 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:48.763172 0.052936 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:48.816521 0.074408 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:48.891327 0.164865 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:49.056606 0.218279 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:49.275356 0.060384 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:49.336130 0.064872 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:49.401350 1.232025 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:50.633833 0.144851 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:50.779100 0.143834 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:50.923334 0.145174 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.068885 0.074811 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.144071 0.161944 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.306372 0.125642 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.432389 0.147363 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.580105 0.064892 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.645362 0.224806 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:51.870578 0.169226 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.040195 0.165948 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.206552 0.056136 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.263105 0.175755 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.439254 0.350650 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.790292 0.204085 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:52.994742 0.039405 udp 10.0.2.105 7010 <-> 77.170.128.192 9812 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.034523 0.159093 udp 10.0.2.105 7010 <-> 99.181.135.125 7576 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.193964 0.075740 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.270073 0.150854 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.421345 0.029948 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.451713 0.089284 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.541383 0.066464 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.608402 0.078086 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.686873 0.065126 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:53.752527 0.375330 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:29:54.128191 0.190227 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/12 13:30:16.469963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:33:51.859868 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 13:33:51.859964 0.890416 tcp 10.0.2.105 61448 -> 162.210.27.16 8808 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/12 13:36:20.476151 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:36:27.483423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:36:35.485017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:36:51.487945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:37:23.494016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:43:27.500471 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:43:34.507705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:43:42.509081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:43:58.511849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:44:30.520783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:54:16.533371 3.001571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 13:54:23.540663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:54:31.542245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:54:47.545621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 13:55:19.551371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:00:15.947800 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 14:00:15.947901 0.083697 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.032021 0.191197 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.223636 0.072265 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.296318 0.164285 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.461010 0.055481 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.516897 0.135465 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.652774 0.218614 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.871771 0.058116 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.930245 0.062009 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:16.992643 0.144299 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.137360 0.144804 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.282609 0.070203 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.353214 0.220610 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.574175 0.142950 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.717518 0.160580 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:17.878458 0.126426 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:18.005269 0.145485 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:18.151167 0.104271 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:18.255848 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 14:00:36.970050 0.063732 tcp 10.0.2.105 61449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:37.034054 0.066582 tcp 10.0.2.105 61450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:37.101013 0.151870 tcp 10.0.2.105 61451 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:37.253368 0.168194 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:37.421961 0.168240 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:37.590575 0.340740 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:37.931701 0.212267 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:00:38.144366 0.000000 udp 10.0.2.105 7010 -> 77.170.128.192 9812 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 14:00:56.586436 0.061870 tcp 10.0.2.105 61452 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:56.648608 0.061036 tcp 10.0.2.105 61453 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:56.709942 0.150768 tcp 10.0.2.105 61454 -> 195.113.214.249 443 SRPA* 0 0 21 13070 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:00:56.861203 0.000000 udp 10.0.2.105 7010 -> 99.181.135.125 7576 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 14:01:14.465263 0.062792 tcp 10.0.2.105 61455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:01:14.528370 0.060587 tcp 10.0.2.105 61456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:01:14.589245 0.153110 tcp 10.0.2.105 61457 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:01:14.742880 0.056965 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:14.800465 0.175349 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:14.976175 0.069527 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.046146 0.150010 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.196727 0.029756 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.226924 0.100681 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.328049 0.079167 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.407635 0.072493 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.480593 0.059900 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.540926 0.368143 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:15.909436 0.198966 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:01:23.556993 3.002075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 14:01:30.567326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:01:38.566153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:01:54.569184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:02:26.575320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:03:52.749133 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 14:03:52.749283 0.886719 tcp 10.0.2.105 61458 -> 162.210.27.16 8808 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:08:30.586378 2.996366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:08:37.587983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:08:45.590083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:09:01.592694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:09:33.599731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:15:42.612336 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:15:49.619616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:15:57.621330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:16:13.625741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:16:45.630225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:22:49.638109 3.106551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:22:56.722153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:23:04.667429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:23:20.658686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:23:52.664849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:29:56.671370 3.000437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:30:03.677703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:30:11.679173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:30:27.682080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:30:59.688376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:31:21.399801 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 14:31:21.399970 0.206279 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:21.606697 0.000000 udp 10.0.2.105 7010 -> 77.170.128.192 9812 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 14:31:39.798472 0.061264 tcp 10.0.2.105 61459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:39.860048 0.063123 tcp 10.0.2.105 61460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:39.923430 0.152438 tcp 10.0.2.105 61461 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:40.076414 0.000000 udp 10.0.2.105 7010 -> 99.181.135.125 7576 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 14:31:55.919031 0.060879 tcp 10.0.2.105 61462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:55.980158 0.064922 tcp 10.0.2.105 61463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:56.045331 0.156372 tcp 10.0.2.105 61464 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:31:56.202407 0.046515 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.249299 0.089504 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.339239 0.074018 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.413671 0.218423 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.632598 0.060783 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.693728 0.064353 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.758455 0.142999 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:56.901849 0.144679 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.046936 0.055600 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.102916 0.133431 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.236722 0.164721 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.401809 0.162048 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.564242 0.145322 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.709973 0.145494 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.855861 0.071305 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.927559 0.050508 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:57.978409 0.129053 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:58.107907 0.055309 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:58.163683 0.168040 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:58.332134 0.323669 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:58.656205 0.168802 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:58.825361 0.203688 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.029456 0.177876 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.207710 0.067257 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.275346 0.153179 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.428918 0.028734 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.458040 0.057934 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.516394 0.062054 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.578873 0.070533 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.649831 0.061238 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:31:59.711461 0.369613 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:32:00.081468 0.203566 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:32:00.285395 0.079284 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/12 14:33:53.639084 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 14:33:53.639194 0.872780 tcp 10.0.2.105 61465 -> 162.210.27.16 8808 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/02/12 14:37:03.694185 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 14:37:10.701880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:37:18.702839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:37:34.706358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:38:06.712560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:44:10.718878 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:44:17.725574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:44:25.726988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:44:41.730458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:45:13.736237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:54:38.751562 3.001615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 14:54:45.758684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:54:53.759977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:55:09.763462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 14:55:41.769738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:01:45.775705 3.001015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:01:52.782717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:02:00.783967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:02:16.787009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:02:27.202637 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 15:02:27.202741 0.207229 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.410441 0.044940 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.455826 0.084328 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.540541 0.072922 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.613859 0.249529 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.863748 0.057856 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.921990 0.068757 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:27.991148 0.143359 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.134977 0.144065 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.279456 0.052285 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.332134 0.132576 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.465168 0.166291 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.631852 0.161509 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.793746 0.145074 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:28.939165 0.148144 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.087672 0.071547 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.159549 0.229310 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.389250 0.126348 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.516008 0.055183 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.571650 0.171035 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.743116 0.211141 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:29.954622 0.176896 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:30.131969 0.166828 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:30.299192 0.487265 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:30.786785 0.120261 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:30.907522 0.149288 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.057255 0.030293 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.087920 0.056866 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.145249 0.069348 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.214988 0.070422 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.285790 0.062901 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.349129 0.369055 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.718536 0.202805 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:31.921741 0.091085 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:02:48.793252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:03:54.518265 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 15:03:54.518452 0.875984 tcp 10.0.2.105 61466 -> 162.210.27.16 8808 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/12 15:08:52.799224 3.000920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:08:59.806593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:09:07.807661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:09:23.811253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:09:55.816892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:16:05.831070 3.002275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:16:12.838767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:16:20.840619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:16:36.843739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:17:08.849738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:23:15.863985 2.997786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:23:22.867478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:23:30.868939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:23:46.872628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:24:19.525663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:30:22.894427 3.114106 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:30:29.979445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:30:37.917462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:30:53.918312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:31:25.923200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:32:49.122095 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 15:32:49.122222 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 15:33:06.251703 0.061892 tcp 10.0.2.105 61467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 15:33:06.313887 0.061650 tcp 10.0.2.105 61468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 15:33:06.375865 0.152633 tcp 10.0.2.105 61469 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 15:33:06.529092 0.073836 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:06.603307 0.217347 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:06.821055 0.045139 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:06.866636 0.248861 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.115950 0.059347 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.175711 0.065894 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.242059 0.141471 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.383950 0.144446 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.528830 0.056306 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.585524 0.132862 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.718778 0.164334 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:07.883519 0.161381 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.045290 0.148652 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.194339 0.145427 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.340201 0.073766 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.414354 0.043884 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.458625 0.129796 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.588766 0.057612 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.646751 0.168617 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:08.815771 0.204883 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.021093 0.176247 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.197725 0.167723 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.365858 0.383879 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.750178 0.073716 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.824261 0.149901 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:09.974556 0.030003 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.004966 0.056952 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.062300 0.063402 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.126090 0.080256 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.206701 0.062100 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.269158 0.364582 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.634155 0.199841 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:10.834363 0.085703 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 15:33:55.397421 1.089928 tcp 10.0.2.105 61470 -> 162.210.27.16 8808 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/02/12 15:37:29.927686 3.001915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 15:37:36.935425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:37:44.936847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:38:00.940022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:38:32.955933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:44:36.962237 3.001568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:44:43.969359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:44:51.970750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:45:07.974268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:45:39.982936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:54:47.990523 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 15:54:54.997884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:55:02.999041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:55:19.002269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 15:55:51.008183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:01:55.014615 3.001326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:02:02.022137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:02:10.023427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:02:26.026666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:02:58.032890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:03:32.753001 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 16:03:32.753111 0.120098 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:32.873590 0.045097 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:32.919067 0.319831 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.239299 0.058884 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.298624 0.070175 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.369255 0.206370 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.575997 0.063446 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.639813 0.144804 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.785005 0.144702 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.930047 0.054253 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:33.984678 0.133710 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.118774 0.164981 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.284163 0.162492 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.447062 0.145850 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.593299 0.149889 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.743594 0.073223 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.817193 0.052606 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.870162 0.126705 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:34.997257 0.099367 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:35.097181 0.171031 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:35.268606 0.210397 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:35.479430 0.175408 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:35.655227 0.169458 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:35.825064 0.427238 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.252695 0.074908 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.327986 0.149979 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.478340 0.029427 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.508109 0.057015 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.565549 0.062862 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.628839 0.071140 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.700483 0.198249 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.899069 0.088511 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:36.987972 0.058195 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:37.046570 0.372078 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:03:56.486980 0.882674 tcp 10.0.2.105 61471 -> 162.210.27.16 8808 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/12 16:09:11.041515 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:09:18.048683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:09:26.050433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:09:42.056705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:10:14.376385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:16:18.075713 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:16:25.082584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:16:33.085133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:16:49.087553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:17:21.092923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:23:26.100974 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:23:33.108269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:23:41.109828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:23:57.112771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:24:29.118097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:30:33.124878 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:30:40.132408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:30:48.133603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:31:04.136487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:31:36.142789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:33:55.243586 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 16:33:55.243772 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 16:33:57.376489 0.972217 tcp 10.0.2.105 61472 -> 162.210.27.16 8808 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/12 16:34:13.035696 0.039714 tcp 10.0.2.105 61473 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 16:34:13.075730 0.042549 tcp 10.0.2.105 61474 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 16:34:13.118633 0.158096 tcp 10.0.2.105 61475 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 16:34:13.277375 0.043914 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:13.321717 0.315650 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:13.637751 0.059886 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:13.697997 0.073099 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:13.771506 0.226342 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:13.998315 0.068745 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.067481 0.056339 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.124397 0.133197 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.257990 0.164522 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.422896 0.144665 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.567916 0.142369 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.710707 0.161263 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:14.872475 0.147156 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.019986 0.144699 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.165076 0.075360 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.240889 0.040584 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.281917 0.127479 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.409791 0.055131 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.465261 0.176118 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.641769 0.168229 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.810420 0.166517 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:15.977320 0.206739 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.184509 0.327713 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.512657 0.073896 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.586979 0.150410 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.737863 0.029114 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.767336 0.057333 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:16.825067 0.196304 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:17.021766 0.089495 udp 10.0.2.105 7010 <-> 79.31.16.194 3302 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:17.111638 0.059011 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:17.170978 0.067163 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:17.238545 0.071437 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:34:17.310348 0.367587 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/12 16:37:40.148205 3.001583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:37:47.155544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:37:55.157408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:38:11.160771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:38:43.166874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:44:47.172140 3.001930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:44:54.180383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:45:02.181772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:45:18.184455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:45:50.190322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:51:54.196034 3.002322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:52:01.204107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:52:09.205332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:52:25.208172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:52:57.215889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:59:01.221214 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 16:59:08.232662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:59:16.229435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 16:59:32.232611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:00:04.238770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:03:58.355604 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 17:03:58.355844 0.925336 tcp 10.0.2.105 61476 -> 162.210.27.16 8808 FSPA* 0 0 14 1508 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:04:38.713654 0.113985 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:38.828021 0.057970 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:38.886409 0.074763 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:38.961603 0.218287 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.180296 0.065094 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.245777 0.052803 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.298982 0.067488 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.366881 0.351664 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.718961 0.133086 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:39.852455 0.165016 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.017843 0.144335 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.162555 0.144398 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.307337 0.161602 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.469314 0.145626 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.615323 0.149905 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.765599 0.073285 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.839230 0.058635 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:40.898200 0.126152 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.024903 0.056162 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.081431 0.177376 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.259194 0.168829 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.428542 0.168663 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.597640 0.204080 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:41.802135 0.321066 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:42.123541 0.107734 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:42.231643 0.151350 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:42.383380 0.028529 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:42.412424 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 17:04:43.299648 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 17:04:57.491851 0.042657 tcp 10.0.2.105 61477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:04:57.534739 0.046034 tcp 10.0.2.105 61478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:04:57.581108 0.138802 tcp 10.0.2.105 61479 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:04:57.720611 0.633237 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:04:58.354222 0.000000 udp 10.0.2.105 7010 -> 79.31.16.194 3302 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 17:05:15.907033 0.041910 tcp 10.0.2.105 61480 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:05:15.949291 0.043851 tcp 10.0.2.105 61481 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:05:15.993381 0.135971 tcp 10.0.2.105 61482 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:05:16.129919 0.059642 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:05:16.189971 0.066550 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:05:16.256949 0.070071 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:05:16.327472 0.371924 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:06:32.248972 3.014296 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 17:06:39.258049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:06:47.257331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:07:03.261749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:07:35.266867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:13:41.276570 3.000705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:13:48.283093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:13:56.284469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:14:12.287772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:14:44.293885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:20:48.302822 3.102568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:20:55.379928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:21:03.318598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:21:19.321856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:21:51.337913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:27:55.344039 3.008626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:28:02.352706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:28:10.352709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:28:26.355989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:28:58.361698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:33:59.285225 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 17:33:59.285371 1.069105 tcp 10.0.2.105 61483 -> 162.210.27.16 8808 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:35:02.367364 3.002242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:35:09.375738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:35:17.377181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:35:30.616132 0.584965 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 17:35:31.201250 0.056225 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:31.257918 0.000000 udp 10.0.2.105 7010 -> 79.31.16.194 3302 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 17:35:33.917278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:35:48.726438 0.042489 tcp 10.0.2.105 61484 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:35:48.769229 0.043015 tcp 10.0.2.105 61485 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:35:48.812509 0.133326 tcp 10.0.2.105 61486 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:35:48.946363 0.224251 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.170996 0.066861 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.238221 0.054769 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.293381 0.049043 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.342804 0.073969 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.417133 0.058407 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.475996 0.089352 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.565800 0.143718 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.709884 0.133573 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:49.843837 0.329502 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.173731 0.147145 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.321232 0.165588 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.487254 0.146461 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.634108 0.072766 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.707300 0.147546 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.855232 0.127864 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:50.983574 0.056262 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.040446 0.176702 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.217603 0.168837 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.386845 0.162383 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.549614 0.049471 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.599492 0.066030 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:51.665948 2.243854 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:53.910244 0.029412 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:53.940042 0.206892 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:54.147341 0.165032 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:54.312731 0.328209 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:54.641344 0.204055 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:54.845835 0.074715 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:54.920952 0.373348 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:55.294667 0.061353 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 17:35:55.356470 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 17:36:05.532360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:36:10.398247 0.041709 tcp 10.0.2.105 61487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:36:10.440293 0.045509 tcp 10.0.2.105 61488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:36:10.486135 0.131966 tcp 10.0.2.105 61489 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/12 17:42:09.392475 3.079705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:42:16.444834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:42:24.410718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:42:40.413681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:43:12.419979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:53:36.430547 3.000726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 17:53:43.437029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:53:51.438977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:54:07.441452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 17:54:39.447458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:00:43.453689 3.001747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:00:50.461012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:00:58.462695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:01:14.465446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:01:46.471738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:04:00.354351 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 18:04:00.354446 0.980977 tcp 10.0.2.105 61490 -> 162.210.27.16 8808 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:06:10.761595 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 18:06:10.761728 0.066922 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:10.829092 0.055996 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:10.885537 0.116097 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.002057 0.056611 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.059020 0.048764 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.108134 0.073571 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.182138 0.059277 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.241839 0.083387 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:11.325673 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 18:06:28.791770 0.043768 tcp 10.0.2.105 61491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:06:28.835867 0.062142 tcp 10.0.2.105 61492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:06:28.898312 0.139435 tcp 10.0.2.105 61493 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:06:29.038520 0.145782 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:29.184720 0.163717 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:29.368828 0.132131 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:29.501429 0.144220 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:29.646024 0.211854 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:29.858275 0.145013 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.003650 0.069898 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.073962 0.146795 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.221229 0.055372 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.277006 0.175689 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.453035 0.168709 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.622116 0.161279 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.783822 0.127207 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.911369 0.046398 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:30.958098 0.068258 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.026765 0.205587 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.232757 0.167962 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.401194 0.150732 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.552548 0.029702 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.582693 0.069897 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:31.652953 0.372765 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:32.026136 0.059539 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:32.086060 0.324920 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:06:32.411494 0.208005 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:07:50.476936 3.002387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 18:07:57.484940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:08:05.490256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:08:21.489190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:08:53.505685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:14:57.512523 3.000379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:15:04.519070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:15:12.520727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:15:28.523498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:16:00.529654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:22:05.538563 3.002670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:22:12.547139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:22:20.545959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:22:36.548854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:23:08.557482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:29:12.560858 3.133951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:29:19.669597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:29:27.611729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:29:43.583075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:30:15.592394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:34:01.343921 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 18:34:01.344028 0.736868 tcp 10.0.2.105 61494 -> 162.210.27.16 8808 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:36:19.597424 2.999151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:36:26.602228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:36:34.603652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:36:41.884560 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 18:36:41.884650 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 18:36:50.607134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:36:58.089002 0.044213 tcp 10.0.2.105 61495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:36:58.133506 0.042165 tcp 10.0.2.105 61496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:36:58.175936 0.140456 tcp 10.0.2.105 61497 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/12 18:36:58.316865 0.056792 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.374059 0.065557 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.440065 0.054624 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.495087 0.045842 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.541271 0.072204 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.613816 0.060363 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.674623 0.084384 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.759474 0.063811 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.823657 0.134155 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:58.958173 0.143686 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.102200 0.212320 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.314981 0.145972 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.461326 0.075588 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.537345 0.146830 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.684616 0.164753 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:36:59.849824 0.151971 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.002128 0.054802 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.057272 0.177701 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.235332 0.168901 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.404597 0.164199 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.569200 0.125909 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.695539 0.059216 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.755147 0.074384 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:00.829942 0.203594 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.033896 0.168541 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.202838 0.153104 udp 10.0.2.105 7010 <-> 72.138.98.226 8272 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.356273 0.029845 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.386471 0.071270 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.458107 0.376226 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:01.834706 0.189881 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:02.024955 0.057140 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:02.082476 0.325661 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/12 18:37:22.614801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:43:26.621771 3.035074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:43:33.638508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:43:41.637952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:43:57.640950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:44:29.646685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:54:15.662084 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 18:54:22.669558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:54:30.671076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:54:46.673771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 18:55:18.680119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:01:22.685400 3.002248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:01:29.692795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:01:37.695008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:01:53.697711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:02:25.703985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:04:02.083406 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 19:04:02.083595 0.831669 tcp 10.0.2.105 61498 -> 162.210.27.16 8808 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:06.337810 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 19:07:06.338052 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 19:07:23.263777 0.043075 tcp 10.0.2.105 61499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:23.307110 0.038575 tcp 10.0.2.105 61500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:23.345943 0.136377 tcp 10.0.2.105 61501 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:23.482905 0.121404 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.604681 0.052695 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.657749 0.044855 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.702961 0.072337 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.775730 0.059914 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.836074 0.089217 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.925734 0.063470 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:23.989591 0.132514 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.122490 0.144037 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.266900 0.211936 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.479247 0.146914 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.626562 0.071810 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.698746 0.143409 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:24.842521 0.165435 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.008317 0.151730 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.160470 0.056810 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.217640 0.452750 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.670779 0.125313 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.796512 0.047334 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.844267 0.073704 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:25.918363 0.210027 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:26.128755 0.168967 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:26.298046 0.169289 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:26.467683 0.161899 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:26.629994 0.000000 udp 10.0.2.105 7010 -> 72.138.98.226 8272 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 19:07:43.662059 0.037711 tcp 10.0.2.105 61502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:43.700019 0.043375 tcp 10.0.2.105 61503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:43.743655 0.134866 tcp 10.0.2.105 61504 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:07:43.879083 0.029107 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:43.908558 0.070429 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:43.979344 0.373797 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:44.353533 0.199094 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:44.553083 0.062047 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:07:44.615577 0.322356 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:08:29.710823 3.110635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 19:08:36.801770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:08:44.748545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:09:00.731824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:09:32.738162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:15:41.754467 2.998268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:15:48.758510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:15:56.760139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:16:12.764873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:16:44.769097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:22:48.775697 3.003029 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:22:55.782424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:23:03.783759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:23:19.786635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:23:51.792995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:29:55.798831 3.001693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:30:02.806432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:30:10.807773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:30:26.811014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:30:58.816881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:34:02.922179 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 19:34:02.922263 1.122784 tcp 10.0.2.105 61505 -> 162.210.27.16 8808 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:37:02.823759 3.001107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:37:09.831004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:37:17.832160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:37:33.834974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:37:50.401187 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 19:37:50.401271 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 19:38:05.840615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:38:05.933121 0.041790 tcp 10.0.2.105 61506 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:05.975216 0.048498 tcp 10.0.2.105 61507 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:06.024067 0.132079 tcp 10.0.2.105 61508 -> 195.113.214.249 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:06.156634 0.000000 udp 10.0.2.105 7010 -> 72.138.98.226 8272 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 19:38:24.918995 0.041579 tcp 10.0.2.105 61509 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:24.960879 0.043847 tcp 10.0.2.105 61510 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:25.005053 0.137938 tcp 10.0.2.105 61511 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/12 19:38:25.143692 0.046705 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.190864 0.069195 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.260477 0.068479 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.329329 0.055073 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.384847 0.060587 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.445789 0.132561 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.578764 0.144640 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.723747 0.084896 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.809014 0.059646 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:25.869093 0.219072 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.088607 0.146511 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.235462 0.165273 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.401161 0.147773 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.549338 0.175396 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.725196 0.079046 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.804628 0.177942 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:26.982975 0.058321 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.041744 0.282881 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.325033 0.206913 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.532501 0.169503 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.702366 0.168628 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.871400 0.043855 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.915638 0.073307 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:27.989313 0.162814 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.152544 0.070545 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.223456 0.372514 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.596353 0.200903 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.797650 0.065651 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.863680 0.029537 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:38:28.893578 0.322948 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/12 19:44:09.847019 3.001599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:44:16.854296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:44:24.855912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:44:40.858583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:45:12.865198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:54:37.879400 3.002198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 19:54:44.887241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:54:52.888407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:55:08.891316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 19:55:40.897680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:01:44.903380 3.002335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:01:51.911126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:01:59.912654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:02:15.915964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:02:47.922058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:04:04.052160 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 20:04:04.052287 0.912597 tcp 10.0.2.105 61512 -> 162.210.27.16 8808 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:08:41.019361 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 20:08:41.019467 0.045112 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.064995 0.068882 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.134221 0.062304 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.196890 0.055409 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.252665 0.058830 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.311878 0.136772 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.449112 0.145488 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.595043 0.104510 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.699978 0.059194 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.759636 0.213180 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:41.973215 0.143559 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 215 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.117102 0.164655 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.282084 0.146283 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.428745 0.146430 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.575563 0.076835 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.652780 0.175181 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.828336 0.056804 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:42.885535 0.127657 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.013544 0.206431 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.220395 0.167742 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.388603 0.168748 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.557790 0.044867 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.603030 0.072500 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.675902 0.163125 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.839480 0.075956 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.915844 0.062498 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:43.978716 0.028863 udp 10.0.2.105 7010 <-> 79.227.189.222 2430 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:44.007988 0.339018 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:44.347423 0.369865 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:44.717733 0.189880 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:08:51.937514 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 20:08:58.945450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:09:06.951211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:09:22.949650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:09:54.955949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:16:03.968733 3.001853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:16:10.975831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:16:18.978793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:16:34.981965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:17:06.986549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:23:13.997896 3.000741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:23:21.004882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:23:29.006572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:23:45.009311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:24:17.203815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:30:21.042061 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:30:28.048854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:30:36.049781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:30:52.053078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:31:24.059183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:34:04.971371 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 20:34:04.971591 1.433510 tcp 10.0.2.105 61513 -> 162.210.27.16 8808 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:37:28.066095 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:37:35.072793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:37:43.073587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:37:59.077296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:38:31.085446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:38:58.590622 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 20:38:58.590721 0.067272 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:58.658376 0.057284 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:58.716073 0.063371 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:58.779814 0.043526 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:58.823757 0.071605 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:58.895747 0.132995 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.029136 0.145364 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.174912 0.099364 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.274648 0.059545 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.334592 0.220128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.555114 0.146784 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.777603 0.165128 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:38:59.943157 0.146281 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:00.089903 0.146674 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:00.236966 0.000000 udp 10.0.2.105 7010 -> 86.167.238.61 1971 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 20:39:17.402365 0.043193 tcp 10.0.2.105 61514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:17.445949 0.043514 tcp 10.0.2.105 61515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:17.489734 0.172530 tcp 10.0.2.105 61516 -> 195.113.214.249 443 SRPA* 0 0 36 26926 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:17.662891 0.180836 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:17.844080 0.055067 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:17.899600 0.128584 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.028733 0.206988 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.236119 0.168080 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.404667 0.168944 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.574035 0.050226 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.624640 0.072372 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.697487 0.162417 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.860228 0.070022 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.930669 0.059692 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:18.990729 0.000000 udp 10.0.2.105 7010 -> 79.227.189.222 2430 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 20:39:34.134292 0.042226 tcp 10.0.2.105 61517 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:34.176767 0.044063 tcp 10.0.2.105 61518 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:34.221138 0.136780 tcp 10.0.2.105 61519 -> 195.113.214.249 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/12 20:39:34.358394 0.369351 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:34.728164 0.378335 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:39:35.106881 0.198462 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 20:44:35.089503 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/12 20:44:42.096846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:44:50.097729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:45:06.100865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:45:38.107505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:54:51.114991 3.001856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 20:54:58.122290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:55:06.123963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:55:22.126912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 20:55:54.133268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:01:58.140039 3.000275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:02:05.146702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:02:13.147805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:02:29.150876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:03:01.156763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:04:06.411608 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 21:04:06.411796 0.917342 tcp 10.0.2.105 61520 -> 162.210.27.16 8808 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/02/12 21:09:09.169439 3.000674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:09:16.176423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:09:24.177603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:09:40.179979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:09:52.328490 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 21:09:52.328603 0.073604 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:09:52.402624 0.000000 udp 10.0.2.105 7010 -> 79.227.189.222 2430 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 21:10:08.913864 0.043437 tcp 10.0.2.105 61521 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 21:10:08.957610 0.047217 tcp 10.0.2.105 61522 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 21:10:09.005104 0.138151 tcp 10.0.2.105 61523 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/12 21:10:09.143796 0.042801 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.186955 0.059641 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.246973 0.131602 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.378962 0.144223 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.523546 0.097769 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.621728 0.074135 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.696280 0.068569 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.765301 0.069162 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:09.834843 0.268781 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.104030 0.164645 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.269046 0.154947 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.424375 0.147714 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.572445 0.060875 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.633718 0.145344 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.779473 0.205213 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:10.985091 0.177000 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.162543 0.055562 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.218497 0.129800 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.348732 0.167721 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.516792 0.040293 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.557451 0.071598 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.629502 0.162711 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.792607 0.070227 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.863202 0.066514 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:11.930074 0.168265 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:12.098689 0.355010 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:12.186712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:10:12.454073 0.372126 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:10:12.826552 0.202919 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:16:18.195741 3.001289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:16:25.202761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:16:33.204102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:16:49.207701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:17:21.212983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:23:27.222534 3.001431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:23:34.229452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:23:42.231816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:23:58.234610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:24:30.240053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:30:34.246151 3.001831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:30:41.253899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:30:49.255216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:31:05.260715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:31:37.264031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:34:07.330814 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 21:34:07.331047 1.007156 tcp 10.0.2.105 61524 -> 162.210.27.16 8808 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/02/12 21:37:41.270288 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:37:48.284481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:37:56.279141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:38:12.283401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:38:44.290051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:40:30.821527 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 21:40:30.821618 0.789985 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:31.612014 0.047533 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:31.659984 0.058582 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:31.718990 0.132681 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:31.852095 0.147255 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:31.999702 0.072230 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.072332 0.075760 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.148459 0.062161 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.211011 0.067949 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.279350 0.146495 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.426248 0.144288 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.570925 0.060039 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.631345 0.228285 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:32.860028 0.163458 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.023937 0.146080 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.170461 0.208512 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.379348 0.175954 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.555731 0.060752 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.616852 0.127891 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.745133 0.168215 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.913700 0.058338 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:33.972425 0.075320 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.048144 0.162167 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.210715 0.070785 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.281956 0.065815 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.348377 0.167833 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.516827 0.193036 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:34.710207 0.716801 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:40:35.427421 0.377823 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/12 21:44:48.294602 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:44:55.305692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:45:03.315821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:45:19.316362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:45:51.322271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:51:55.327683 3.002666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:52:02.335510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:52:10.337287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:52:26.340133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:52:58.346720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:59:02.352704 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 21:59:09.359415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:59:17.361135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 21:59:33.364828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:00:05.370819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:04:08.339770 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 22:04:08.339865 0.818326 tcp 10.0.2.105 61525 -> 162.210.27.16 8808 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/02/12 22:06:34.382734 3.001138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:06:41.389710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:06:49.392711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:07:05.394234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:07:37.401003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:11:03.577033 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 22:11:03.577155 0.058610 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:03.636231 0.134191 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:03.770770 0.147276 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:03.918498 0.102545 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.021490 0.069137 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.091044 0.061401 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.152845 0.073150 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.226366 0.048140 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.274939 0.080286 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.355590 0.148877 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.504877 0.148319 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.653599 0.061153 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.715215 0.214451 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:04.930039 0.165117 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.095504 0.147693 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.243634 0.204367 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.448434 0.176997 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.625817 0.055711 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.681966 0.126325 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.808732 0.169435 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:05.978560 0.041291 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:06.020202 0.072343 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:06.092922 0.162568 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:06.255927 0.167651 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:06.423977 0.203457 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:06.627816 0.818504 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:07.446767 0.063460 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:07.510617 0.349737 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:11:07.860816 0.369952 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:13:41.406367 3.001377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:13:48.413607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:13:56.414997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:14:12.420754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:14:44.423812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:20:48.431913 2.999748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:20:55.437370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:21:03.439213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:21:19.441928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:21:51.448134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:27:55.453625 3.002151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:28:02.461374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:28:10.462959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:28:26.465874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:28:58.472141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:34:09.159189 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 22:34:09.159373 1.056799 tcp 10.0.2.105 61526 -> 162.210.27.16 8808 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/02/12 22:35:02.479264 3.000616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:35:09.489518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:35:17.486990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:35:33.490489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:36:05.498935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:41:13.589358 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 22:41:13.589547 0.145254 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:13.735177 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 22:41:31.486411 0.061684 tcp 10.0.2.105 61527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 22:41:31.548392 0.065539 tcp 10.0.2.105 61528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 22:41:31.614209 0.138511 tcp 10.0.2.105 61529 -> 195.113.214.249 443 SRPA* 0 0 37 27023 flow=From-Botnet-V2-TCP-Established 1970/02/12 22:41:31.753248 0.053833 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:31.807441 0.145744 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:31.953652 0.073376 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.027418 0.070695 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.098496 0.173946 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.272809 0.048992 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.322218 0.066248 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.388816 0.151354 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.540607 0.147820 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.688796 0.060297 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.749493 0.205851 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:32.955711 0.164210 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.120337 0.149036 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.269775 0.207220 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.477395 0.176658 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.654458 0.056757 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.711673 0.125774 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:33.837843 0.168435 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.006640 0.044298 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.051304 0.074577 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.126254 0.163545 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.290237 0.168432 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.459316 0.106457 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.566214 0.198834 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:34.765445 0.450371 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:35.216198 0.390990 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:41:35.607630 0.372773 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 22:42:09.517515 2.996506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:42:16.519553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:42:24.521286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:42:40.523919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:43:12.530215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:53:35.538266 3.001813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 22:53:42.545848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:53:50.547114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:54:06.550585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 22:54:38.556328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:00:42.562310 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:00:49.570135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:00:57.571258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:01:13.574296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:01:45.580188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:04:10.218919 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 23:04:10.219025 0.899282 tcp 10.0.2.105 61530 -> 162.210.27.16 8808 FSPA* 0 0 14 1713 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:07:49.587586 3.000413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:07:56.593415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:08:04.595104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:08:20.598361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:08:52.605800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:12:02.076278 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 23:12:02.076428 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 23:12:19.053316 0.064952 tcp 10.0.2.105 61531 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:12:19.118554 0.068053 tcp 10.0.2.105 61532 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:12:19.186873 0.155067 tcp 10.0.2.105 61533 -> 195.113.214.249 443 SRPA* 0 0 45 40086 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:12:19.342597 0.147033 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.490009 0.071186 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.561634 0.062146 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.624170 0.078969 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.703489 0.057063 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.760952 0.132789 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.894645 0.046248 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:19.941258 0.062583 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.004191 0.147523 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.152143 0.146111 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.325461 0.056456 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.382283 0.212550 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.595197 0.163234 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.758797 0.147093 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.906284 0.056028 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:20.962701 0.128128 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.091187 0.169076 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.260719 0.044918 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.306009 0.072598 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.378974 0.205761 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.585075 0.175805 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.761258 0.163425 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:21.925062 0.166488 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:22.091955 0.081682 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:22.174090 0.208929 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:22.383436 0.077958 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:22.461762 0.329801 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:12:22.792015 0.373798 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:14:56.610286 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:15:03.617644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:15:11.619093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:15:27.622160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:16:00.478824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:22:04.648125 3.103012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:22:11.721583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:22:19.664428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:22:35.667756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:23:07.675279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:29:11.679320 3.003811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:29:18.687037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:29:26.688921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:29:42.691857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:30:14.697475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:34:11.117873 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 23:34:11.118103 0.910013 tcp 10.0.2.105 61534 -> 162.210.27.16 8808 FSPA* 0 0 15 1672 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:36:18.706268 2.998833 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:36:25.710899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:36:33.716855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:36:49.715442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:37:21.721520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:42:46.628908 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/12 23:42:46.629166 0.147857 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:46.777418 0.076897 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:46.854710 0.069163 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:46.924464 0.077199 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.002023 0.060239 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.062669 0.136706 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.199742 0.049973 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.250114 0.066093 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.316583 0.151105 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.468065 0.145494 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.613917 0.059637 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:47.673891 0.354699 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.028985 0.163073 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.192458 0.148324 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.341167 0.062271 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.403856 0.125938 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.530190 0.168057 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.698630 0.042933 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.741910 0.074255 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:48.816552 0.208546 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:42:49.025473 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/12 23:43:07.340394 0.064141 tcp 10.0.2.105 61535 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:43:07.404830 0.072038 tcp 10.0.2.105 61536 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:43:07.477211 0.207799 tcp 10.0.2.105 61537 -> 195.113.214.249 443 SRPA* 0 0 41 22594 flow=From-Botnet-V2-TCP-Established 1970/02/12 23:43:07.685669 0.161821 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:07.847905 0.167700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:08.016006 0.131208 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:08.147603 0.194416 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:08.342375 0.377417 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:08.720197 0.071619 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:08.792257 0.430589 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/12 23:43:25.727390 3.002129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:43:32.735292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:43:40.736750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:43:56.739231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:44:28.745519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:54:13.759128 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/12 23:54:20.767109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:54:28.768635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:54:44.771224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/12 23:55:16.776996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:01:20.783451 3.001362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:01:27.790377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:01:35.792477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:01:51.795257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:02:23.801393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:04:12.030253 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 00:04:12.030484 1.070347 tcp 10.0.2.105 61538 -> 162.210.27.16 8808 FSPA* 0 0 15 1722 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:08:27.808078 3.000422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:08:34.814708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:08:42.816053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:08:58.818830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:09:30.825037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:13:16.810404 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 00:13:16.810647 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 00:13:34.957491 0.060591 tcp 10.0.2.105 61539 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:35.018383 0.066789 tcp 10.0.2.105 61540 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:35.085420 0.164128 tcp 10.0.2.105 61541 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:35.250105 0.070015 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.320657 0.061893 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.382976 0.071906 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.455257 0.058376 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.514059 0.131582 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.646074 0.049779 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.696199 0.147900 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.844497 0.144787 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:35.989628 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 00:13:51.810927 0.063641 tcp 10.0.2.105 61542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:51.874925 0.064477 tcp 10.0.2.105 61543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:51.939692 0.185109 tcp 10.0.2.105 61544 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:13:52.125288 0.262640 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:52.388272 0.164471 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:52.553167 0.059237 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:52.612786 0.144148 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:52.757322 0.125623 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:52.883348 0.174802 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.058537 0.040272 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.099220 0.071179 udp 10.0.2.105 7010 <-> 86.149.187.134 6503 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.170802 0.206082 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.377254 0.059510 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.437175 0.146935 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.584701 0.066375 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.651458 0.161857 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.813741 0.168986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:53.983147 0.070911 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:54.054432 0.326380 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:54.440505 0.207262 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:13:54.648216 0.376737 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:15:39.838223 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 00:15:46.845625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:15:54.847360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:16:10.850171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:16:42.856398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:22:46.861731 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:22:53.869788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:23:01.871439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:23:17.874003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:23:49.879879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:29:53.886448 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:30:00.893529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:30:08.894994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:30:24.897891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:30:56.904160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:34:13.096961 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 00:34:13.097201 0.812050 tcp 10.0.2.105 61545 -> 162.210.27.16 8808 FSPA* 0 0 15 1579 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:37:00.910519 3.004624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:37:07.919208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:37:15.922744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:37:31.922203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:38:03.927581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:44:00.972271 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 00:44:00.972414 0.077554 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:01.050353 0.071154 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:01.121887 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 00:44:07.934390 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:44:14.941585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:44:16.135722 0.061062 tcp 10.0.2.105 61546 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:16.197008 0.060236 tcp 10.0.2.105 61547 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:16.257497 0.207514 tcp 10.0.2.105 61548 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:16.465517 0.082842 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:16.548717 0.043067 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:16.592165 0.145881 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:16.738392 0.144253 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:16.883014 0.137440 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.020825 0.059664 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.080931 0.215664 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.296999 0.165370 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.462725 0.059629 udp 10.0.2.105 7010 <-> 81.156.70.255 9755 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.522729 0.148799 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.671940 0.126577 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.798909 0.171650 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:17.970957 0.048750 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:18.020153 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 00:44:22.943193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:44:36.142809 0.165561 tcp 10.0.2.105 61549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:36.308679 0.060962 tcp 10.0.2.105 61550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:36.370000 0.158295 tcp 10.0.2.105 61551 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 00:44:36.528818 0.206737 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:36.735925 0.057540 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:36.793847 0.148092 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:36.942397 0.069507 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.012493 0.162381 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.175293 0.168495 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.344212 0.190938 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.535575 0.071834 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.607807 0.335174 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:37.943370 0.373258 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/13 00:44:38.946320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:45:10.953139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:54:35.968452 3.001099 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 00:54:42.974804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:54:50.976238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:55:06.979251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 00:55:39.278513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:01:43.291497 3.002073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:01:50.299010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:01:58.300888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:02:14.303836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:02:46.309393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:04:14.216216 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 01:04:14.216398 1.049602 tcp 10.0.2.105 61552 -> 162.210.27.16 8808 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:08:50.538834 2.998987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:08:57.543520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:09:05.544980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:09:21.549837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:09:53.555346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:15:01.547019 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 01:15:01.547107 0.067005 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:01.614537 0.000000 udp 10.0.2.105 7010 -> 86.149.187.134 6503 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 01:15:16.831861 0.064597 tcp 10.0.2.105 61553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:16.896729 0.066221 tcp 10.0.2.105 61554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:16.963352 0.155963 tcp 10.0.2.105 61555 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:17.119849 0.063117 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.183402 0.076653 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.260546 0.046836 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.307778 0.147855 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.456042 0.146151 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.602633 0.134388 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.737473 0.080677 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.818583 0.061545 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:17.880517 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 01:15:34.945615 0.062801 tcp 10.0.2.105 61556 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:35.008668 0.063199 tcp 10.0.2.105 61557 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:35.072157 0.154690 tcp 10.0.2.105 61558 -> 195.113.214.249 443 SRPA* 0 0 27 13984 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:35.227358 0.149466 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:35.377273 0.126038 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:35.503751 0.168017 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:35.672208 0.049905 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:35.722513 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 01:15:52.915510 0.061013 tcp 10.0.2.105 61559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:52.976813 0.061828 tcp 10.0.2.105 61560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:53.038915 0.156101 tcp 10.0.2.105 61561 -> 195.113.214.249 443 SRPA* 0 0 49 37404 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:15:53.195833 0.215833 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:53.412104 0.146522 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:53.559022 0.062927 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:53.622445 0.162027 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:53.784891 0.204315 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:53.989629 0.055583 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:54.045616 0.167039 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:54.212996 0.199657 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:54.413037 0.072709 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:54.486168 0.319140 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:54.805751 0.371320 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:15:57.559809 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 01:16:04.567422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:16:12.580237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:16:28.581873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:17:00.587776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:23:04.593272 3.002130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:23:11.601456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:23:19.602610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:23:35.605843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:24:07.611751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:30:11.618131 3.002674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:30:18.625223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:30:26.626996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:30:42.632412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:31:14.635609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:34:15.269964 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 01:34:15.270111 0.876587 tcp 10.0.2.105 61562 -> 162.210.27.16 8808 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:37:18.651742 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:37:25.659440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:37:33.660623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:37:49.667708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:38:21.670023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:44:25.676746 3.001209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:44:32.683032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:44:40.684637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:44:56.687435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:45:28.694064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:46:07.139163 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 01:46:07.139261 0.164123 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:07.303801 0.000000 udp 10.0.2.105 7010 -> 81.156.70.255 9755 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 01:46:25.497621 0.062415 tcp 10.0.2.105 61563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:46:25.560233 0.112848 tcp 10.0.2.105 61564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:46:25.673357 0.150679 tcp 10.0.2.105 61565 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/13 01:46:25.824649 0.059637 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:25.884644 0.070211 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:25.955257 0.071814 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:26.027536 0.044810 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:26.072780 0.132170 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:26.205350 0.760698 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:26.966440 0.221621 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.188471 0.146915 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.335795 0.077983 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.414386 0.147526 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.562251 0.048888 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.611532 0.168953 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.780882 0.126466 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:27.907673 0.215583 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.123689 0.146900 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.270958 0.063818 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.335134 0.162335 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.497909 0.204936 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.703238 0.055284 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.758875 0.168874 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:28.928135 0.478745 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:29.407279 0.375315 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:29.783015 0.204996 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:46:29.988458 0.070712 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 01:54:45.707682 3.001123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 01:54:52.714805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:55:00.716652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:55:16.719311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 01:55:48.725331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:01:52.732501 3.000505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:01:59.739128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:02:07.739881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:02:23.742951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:02:55.749092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:04:16.145156 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:04:16.145287 2.993579 tcp 10.0.2.105 61566 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 02:04:25.137536 0.000000 tcp 10.0.2.105 61566 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 02:04:31.148320 0.062587 tcp 10.0.2.105 61567 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:31.211218 0.065207 tcp 10.0.2.105 61568 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:31.276734 0.166572 tcp 10.0.2.105 61569 -> 195.113.214.249 443 SRPA* 0 0 46 41620 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:31.555251 2.985811 tcp 10.0.2.105 61570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 02:04:40.540885 0.000000 tcp 10.0.2.105 61570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 02:04:46.849302 0.060663 tcp 10.0.2.105 61571 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:46.910314 0.060802 tcp 10.0.2.105 61572 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:46.971380 0.153241 tcp 10.0.2.105 61573 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:04:47.556491 0.691739 tcp 10.0.2.105 61574 -> 31.192.24.67 3527 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:08:59.756198 3.000631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 02:09:06.762658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:09:14.763899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:09:30.767341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:10:02.773214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:16:06.780920 2.999523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:16:13.786370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:16:21.787849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:16:35.608393 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:16:35.608484 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:16:37.791110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:16:50.751042 0.115925 tcp 10.0.2.105 61575 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:16:50.867193 0.063668 tcp 10.0.2.105 61576 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:16:50.931119 0.153057 tcp 10.0.2.105 61577 -> 195.113.214.249 443 SRPA* 0 0 42 22882 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:16:51.084866 0.064229 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:16:51.149564 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:17:08.896415 0.061738 tcp 10.0.2.105 61578 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:08.958021 0.062115 tcp 10.0.2.105 61579 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:09.020445 0.164038 tcp 10.0.2.105 61580 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:09.184980 0.076976 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:09.262352 0.044269 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:09.306989 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:17:09.797033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:17:26.451533 1.545965 tcp 10.0.2.105 61581 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:27.997786 0.062959 tcp 10.0.2.105 61582 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:28.061009 0.150756 tcp 10.0.2.105 61583 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:17:28.212351 0.145409 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.358148 0.145220 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.503790 0.057411 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.561580 0.102720 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.664659 0.149323 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.814421 0.068429 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:28.883289 0.168248 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.051983 0.125142 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.177524 0.231190 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.409089 0.151798 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.561258 0.071351 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.633005 0.055152 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.688583 0.167773 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:29.856744 0.162346 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:30.019481 0.340838 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:30.360697 0.199229 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:30.560315 0.076458 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:30.637166 0.324908 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:17:30.962523 0.365269 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:23:13.802699 3.012028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:23:20.820211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:23:28.821714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:23:44.824899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:24:16.831003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:30:20.837505 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:30:27.845002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:30:35.845957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:30:51.849069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:31:23.865048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:34:47.968929 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:34:47.969118 0.598531 tcp 10.0.2.105 61584 -> 31.192.24.67 3527 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:37:27.871462 3.001506 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:37:34.878596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:37:42.879984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:37:58.883359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:38:30.890748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:44:34.895504 3.000577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 02:44:41.902754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:44:49.903858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:45:05.907021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:45:37.913328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:47:42.125113 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:47:42.125324 0.167204 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:42.292960 0.063124 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:42.356469 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:47:58.867736 0.062834 tcp 10.0.2.105 61585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:47:58.930919 0.064899 tcp 10.0.2.105 61586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:47:58.996382 0.152804 tcp 10.0.2.105 61587 -> 195.113.214.249 443 SRPA* 0 0 25 13040 flow=From-Botnet-V2-TCP-Established 1970/02/13 02:47:59.149665 4.232835 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 4 1107 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.212065 4.225157 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 4 1198 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.257101 4.251576 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 4 1122 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.329375 4.228722 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 4 1122 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.389273 4.240100 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 4 1322 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.465912 4.311654 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 4 1284 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.615883 4.821071 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 4 1212 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:47:59.763650 4.526821 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 4 1193 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:00.339082 4.154748 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1234 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:00.386249 4.277205 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 4 1002 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:00.554898 4.235831 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 4 1315 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:00.681733 4.333262 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1047 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:00.896394 4.288681 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 4 1200 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.044617 4.197938 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 4 1195 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.112572 4.223532 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 4 1191 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.169659 4.369826 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1279 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.378595 4.360217 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 4 1025 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.567991 4.244542 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 4 1009 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.639046 4.864668 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1044 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:01.855808 4.118080 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 4 1267 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:02.023522 4.317740 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1089 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:02.345210 4.537400 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 4 1169 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:03.050846 0.105468 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:03.156733 0.166347 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 694 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:06.883307 0.058246 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:48:07.075983 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:12.795711 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:21.678634 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:26.595531 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:48:29.880302 0.000000 udp 10.0.2.105 7010 -> 84.170.180.44 3546 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:36.940951 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:43.113361 0.000000 udp 10.0.2.105 7010 -> 62.90.243.4 9221 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:51.491380 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:48:56.097805 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:49:00.446194 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:06.362995 0.000000 udp 10.0.2.105 7010 -> 78.178.0.61 1040 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:14.414147 0.409662 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:49:14.951542 0.000000 udp 10.0.2.105 7010 -> 212.19.100.78 3165 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:20.453123 0.208196 udp 10.0.2.105 7010 -> 196.214.71.74 2951 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:20.661319 0.000000 icmp 196.214.71.74 0x0303 -> 10.0.2.105 0x870b URP 192 1 312 flow=Background 1970/02/13 02:49:25.099325 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:49:27.563546 0.000000 udp 10.0.2.105 7010 -> 188.14.195.35 9093 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:32.800666 0.000000 udp 10.0.2.105 7010 -> 86.141.65.171 8818 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:41.743683 0.000000 udp 10.0.2.105 7010 -> 78.175.203.193 4946 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:47.542501 0.409002 udp 10.0.2.105 7010 -> 150.101.103.149 7044 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:49:47.951503 0.000000 icmp 150.101.103.149 0x0303 -> 10.0.2.105 0x841b URP 192 1 334 flow=Background 1970/02/13 02:49:52.098292 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:49:56.054057 0.000000 udp 10.0.2.105 7010 -> 202.191.182.226 5366 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:01.321740 0.276813 udp 10.0.2.105 7010 <-> 14.98.60.249 6114 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:50:01.942873 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:09.683895 0.000000 udp 10.0.2.105 7010 -> 94.34.143.166 9141 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:15.492036 0.000000 udp 10.0.2.105 7010 -> 81.19.129.50 4323 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:20.098609 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:50:22.322187 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:30.323587 0.000000 udp 10.0.2.105 7010 -> 87.22.245.156 7052 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:38.715960 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:47.668720 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:50:52.595386 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:50:52.676009 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:00.277073 0.000000 udp 10.0.2.105 7010 -> 117.204.233.232 3289 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:08.999069 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:15.929211 0.000000 udp 10.0.2.105 7010 -> 176.221.158.108 6350 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:20.598914 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:51:22.208672 0.000000 udp 10.0.2.105 7010 -> 93.193.157.118 7662 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:30.820377 0.000000 udp 10.0.2.105 7010 -> 79.31.63.50 2593 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:39.062435 0.000000 udp 10.0.2.105 7010 -> 184.38.230.147 6778 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:44.192851 0.073261 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:44.266112 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 296 flow=Background 1970/02/13 02:51:49.096614 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:51:51.360109 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:51:56.717792 0.000000 udp 10.0.2.105 7010 -> 62.8.110.186 6219 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:05.680914 0.000000 udp 10.0.2.105 7010 -> 92.2.77.112 8958 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:13.512426 0.000000 udp 10.0.2.105 7010 -> 113.20.16.40 6742 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:18.101339 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:52:21.815560 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:29.765326 0.000000 udp 10.0.2.105 7010 -> 87.20.100.154 5580 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:36.614914 0.177445 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:52:36.969728 0.000000 udp 10.0.2.105 7010 -> 87.18.38.166 2165 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:43.394936 0.083747 udp 10.0.2.105 7010 -> 213.82.216.82 7312 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:43.478683 0.000000 icmp 213.82.216.82 0x0303 -> 10.0.2.105 0x901c URP 192 1 292 flow=Background 1970/02/13 02:52:48.101515 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:52:50.044834 0.000000 udp 10.0.2.105 7010 -> 95.241.129.212 7420 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:52:55.483206 0.000000 udp 10.0.2.105 7010 -> 90.244.159.142 7625 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:03.363652 0.254804 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 674 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:53:03.639603 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:12.447064 0.000000 udp 10.0.2.105 7010 -> 212.117.68.132 6508 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:17.093269 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:53:19.977475 0.000000 udp 10.0.2.105 7010 -> 80.145.53.162 8957 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:26.306837 0.000000 udp 10.0.2.105 7010 -> 41.101.215.166 2330 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:33.807457 0.000000 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:39.225426 0.000000 udp 10.0.2.105 7010 -> 86.153.26.175 3077 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:44.102071 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:53:46.055107 0.000000 udp 10.0.2.105 7010 -> 68.109.121.12 2079 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:53:54.407106 0.172906 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:53:54.589815 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:00.465711 0.000000 udp 10.0.2.105 7010 -> 124.117.210.182 1613 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:06.273970 0.047114 udp 10.0.2.105 7010 -> 89.12.212.43 2482 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:06.321084 0.000000 icmp 89.12.212.43 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 260 flow=Background 1970/02/13 02:54:11.100915 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:54:11.862878 0.360912 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:54:12.233103 0.000000 udp 10.0.2.105 7010 -> 79.53.229.108 8771 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:17.720506 0.000000 udp 10.0.2.105 7010 -> 86.129.191.157 9658 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:25.742276 0.104266 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:54:25.855995 0.000000 udp 10.0.2.105 7010 -> 95.112.82.187 7751 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:31.730329 0.000000 udp 10.0.2.105 7010 -> 77.96.161.186 4205 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:36.597766 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:54:40.623702 0.000000 udp 10.0.2.105 7010 -> 68.69.255.206 7571 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:46.471707 0.000000 udp 10.0.2.105 7010 -> 89.106.30.18 8755 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:50.920996 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 02:54:52.329738 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:57.928040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:54:59.279994 0.098815 udp 10.0.2.105 7010 -> 85.42.124.193 9584 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:54:59.378809 0.000000 icmp 82.188.216.182 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 127 flow=Background 1970/02/13 02:55:04.097018 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:55:04.367513 0.000000 udp 10.0.2.105 7010 -> 50.161.134.135 9921 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:05.929727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:55:09.454879 0.000000 udp 10.0.2.105 7010 -> 188.169.95.138 1170 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:15.053442 0.000000 udp 10.0.2.105 7010 -> 95.225.174.59 1439 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:21.933191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:55:23.865396 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:28.592424 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:55:30.385244 0.000000 udp 10.0.2.105 7010 -> 69.199.183.61 3687 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:36.513650 0.000000 udp 10.0.2.105 7010 -> 81.137.249.215 7633 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:44.295139 0.000000 udp 10.0.2.105 7010 -> 86.5.231.189 7490 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:50.797010 0.000000 udp 10.0.2.105 7010 -> 27.145.72.126 9915 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:55:53.938987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 02:55:55.601330 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:55:59.156396 0.000000 udp 10.0.2.105 7010 -> 82.107.83.44 6982 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:07.669092 0.146652 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/13 02:56:08.007233 0.000000 udp 10.0.2.105 7010 -> 95.240.125.163 6576 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:16.410963 0.206149 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:16.617112 0.000000 icmp 69.234.17.4 0x0303 -> 10.0.2.105 0xb61d URP 192 1 206 flow=Background 1970/02/13 02:56:21.097512 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:56:22.740331 0.000000 udp 10.0.2.105 7010 -> 82.56.162.122 2983 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:30.853433 0.000000 udp 10.0.2.105 7010 -> 120.63.185.132 8124 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:39.053191 0.000000 udp 10.0.2.105 7010 -> 195.101.136.241 8382 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:44.932836 3.516529 udp 10.0.2.105 7010 -> 84.222.243.253 7438 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:48.449365 0.000000 icmp 84.222.243.253 0x0303 -> 10.0.2.105 0x0e1d URP 192 1 181 flow=Background 1970/02/13 02:56:49.598827 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:56:51.321408 0.000000 udp 10.0.2.105 7010 -> 79.25.16.144 9715 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:56:57.490282 0.000000 udp 10.0.2.105 7010 -> 189.228.225.78 7675 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:57:04.900973 0.000000 udp 10.0.2.105 7010 -> 24.239.41.224 7684 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:57:11.890766 0.000000 udp 10.0.2.105 7010 -> 69.140.147.162 3941 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:57:16.597282 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 02:57:18.610489 0.000000 udp 10.0.2.105 7010 -> 67.221.125.2 8494 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:57:25.730652 0.000000 udp 10.0.2.105 7010 -> 79.36.107.196 9740 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 02:57:32.560540 0.000000 udp 10.0.2.105 7010 -> 79.36.16.43 9307 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:01:57.945163 3.001627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 03:02:04.952109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:02:12.953676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:02:28.956846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:03:00.962522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:04:48.571467 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:04:48.571659 0.609095 tcp 10.0.2.105 61588 -> 31.192.24.67 3527 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:09:04.969033 3.000960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 03:09:11.976256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:09:19.977408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:09:35.980564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:10:07.986488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:16:11.995742 2.998344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 03:16:18.999947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:16:27.001639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:16:43.004377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:17:15.020083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:23:19.026457 3.089447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 03:23:26.087440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:23:34.045455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:23:50.047950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:24:22.054342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:27:44.185629 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:27:44.185739 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:28:00.570606 0.061851 tcp 10.0.2.105 61589 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:00.632768 0.063653 tcp 10.0.2.105 61590 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:00.696701 0.136562 tcp 10.0.2.105 61591 -> 195.113.214.249 443 SRPA* 0 0 39 27571 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:00.833779 0.165215 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:00.999446 0.064503 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:01.064408 0.052119 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:01.116920 0.076737 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:01.193996 0.077463 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:01.271792 0.897368 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:02.169586 0.140934 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:02.310960 0.146208 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:02.457619 0.174308 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:02.632543 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:28:20.998798 0.060114 tcp 10.0.2.105 61592 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:21.059263 0.065505 tcp 10.0.2.105 61593 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:21.125082 0.163587 tcp 10.0.2.105 61594 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:21.289339 0.212578 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:21.502334 0.169751 udp 10.0.2.105 7010 <-> 70.52.124.21 4519 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:21.672478 0.041566 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:21.714451 0.210167 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:21.925071 0.149130 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:21.925398 2.998182 tcp 10.0.2.105 61595 -> 108.232.100.12 4892 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:28:22.074555 0.068111 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:22.143014 0.695463 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:22.838871 0.474139 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:23.313418 0.199940 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:23.513731 0.071304 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:23.585380 0.162588 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:23.748361 0.167998 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:23.916766 0.380267 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:24.297407 0.057119 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:24.354911 0.372295 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:24.777228 0.248521 udp 10.0.2.105 7010 <-> 14.98.60.249 6114 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:25.026167 0.170456 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:25.197012 0.225264 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:25.422695 0.170885 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:25.594006 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:28:30.922341 0.000000 tcp 10.0.2.105 61595 -> 108.232.100.12 4892 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:28:42.109634 0.063399 tcp 10.0.2.105 61596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:42.173320 0.062643 tcp 10.0.2.105 61597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:42.236382 0.176671 tcp 10.0.2.105 61598 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:28:42.413601 0.090980 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:28:42.504981 0.142611 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:30:26.060528 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 03:30:33.067912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:30:41.070771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:30:57.072798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:31:29.078913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:34:49.187026 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:34:49.187189 2.997359 tcp 10.0.2.105 61599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:34:58.179313 0.000000 tcp 10.0.2.105 61599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:35:04.419028 0.178274 tcp 10.0.2.105 61600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:04.597626 0.063717 tcp 10.0.2.105 61601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:04.661632 0.167458 tcp 10.0.2.105 61602 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:05.216630 0.566721 tcp 10.0.2.105 61603 -> 46.48.223.67 15494 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:22.495076 0.893847 tcp 10.0.2.105 61603 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:22.495866 0.068290 tcp 10.0.2.105 61604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:22.564598 0.065163 tcp 10.0.2.105 61605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:22.630037 0.253823 tcp 10.0.2.105 61606 -> 195.113.214.249 443 SRPA* 0 0 74 78482 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:23.389123 3.000429 tcp 10.0.2.105 61607 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:35:32.388145 0.000000 tcp 10.0.2.105 61607 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:35:38.387408 0.061086 tcp 10.0.2.105 61608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:38.448807 0.062790 tcp 10.0.2.105 61609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:38.511870 0.151879 tcp 10.0.2.105 61610 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:38.871682 3.001210 tcp 10.0.2.105 61611 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:35:47.870759 0.000000 tcp 10.0.2.105 61611 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:35:53.869807 0.064866 tcp 10.0.2.105 61612 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:53.934979 0.064928 tcp 10.0.2.105 61613 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:54.000221 0.184599 tcp 10.0.2.105 61614 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:35:54.209551 3.004360 tcp 10.0.2.105 61615 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:36:03.212898 0.000000 tcp 10.0.2.105 61615 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:36:09.201520 0.508900 tcp 10.0.2.105 61616 -> 46.48.223.67 15494 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:36:39.704971 0.406770 tcp 10.0.2.105 61616 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:36:39.705348 2.994222 tcp 10.0.2.105 61617 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:36:48.698004 0.000000 tcp 10.0.2.105 61617 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:36:54.706840 2.994132 tcp 10.0.2.105 61618 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:37:03.700034 0.000000 tcp 10.0.2.105 61618 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:37:08.596594 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:37:33.084889 3.001043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 03:37:40.092137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:37:48.093608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:38:04.098756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:38:36.102403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:42:09.710217 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:42:09.710324 3.005423 tcp 10.0.2.105 61619 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:42:18.712894 0.000000 tcp 10.0.2.105 61619 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:42:24.713577 0.063422 tcp 10.0.2.105 61620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:24.777301 0.062519 tcp 10.0.2.105 61621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:24.840119 0.167787 tcp 10.0.2.105 61622 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:25.186647 0.522090 tcp 10.0.2.105 61623 -> 46.48.223.67 15494 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:55.706651 0.063857 tcp 10.0.2.105 61624 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:55.770875 0.060994 tcp 10.0.2.105 61625 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:55.832224 0.170408 tcp 10.0.2.105 61626 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:56.275435 0.612835 tcp 10.0.2.105 61623 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:42:56.275772 2.994899 tcp 10.0.2.105 61627 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:43:05.269576 0.000000 tcp 10.0.2.105 61627 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:43:11.273482 0.069045 tcp 10.0.2.105 61628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:43:11.342806 0.063210 tcp 10.0.2.105 61629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:43:11.406302 0.167919 tcp 10.0.2.105 61630 -> 195.113.214.249 443 SRPA* 0 0 30 20180 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:43:11.697870 2.995181 tcp 10.0.2.105 61631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:43:20.691774 0.000000 tcp 10.0.2.105 61631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:43:26.690393 0.459784 tcp 10.0.2.105 61632 -> 46.48.223.67 15494 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:43:57.143639 0.451005 tcp 10.0.2.105 61632 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:43:57.144029 2.994438 tcp 10.0.2.105 61633 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:44:06.147084 0.000000 tcp 10.0.2.105 61633 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:44:40.108106 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 03:44:47.115615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:44:55.117492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:45:11.120321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:45:43.125805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:49:12.147640 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:49:12.147811 3.003646 tcp 10.0.2.105 61634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:49:21.149953 0.000000 tcp 10.0.2.105 61634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:49:27.163893 0.061931 tcp 10.0.2.105 61635 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:27.226099 0.064307 tcp 10.0.2.105 61636 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:27.290642 0.160676 tcp 10.0.2.105 61637 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:27.462229 1.462306 tcp 10.0.2.105 61638 -> 46.48.223.67 15494 SPA_* 0 0 9 1019 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:58.937673 0.062246 tcp 10.0.2.105 61639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:59.000237 0.065676 tcp 10.0.2.105 61640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:59.066176 0.168528 tcp 10.0.2.105 61641 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:59.319854 0.439361 tcp 10.0.2.105 61638 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:49:59.320155 2.989695 tcp 10.0.2.105 61642 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:50:08.310763 0.000000 tcp 10.0.2.105 61642 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:50:14.306662 0.061985 tcp 10.0.2.105 61643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:50:14.368970 0.072065 tcp 10.0.2.105 61644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:50:14.441308 0.168337 tcp 10.0.2.105 61645 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:50:14.819698 3.005530 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:50:23.819990 0.000000 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:50:29.818781 1.405225 tcp 10.0.2.105 61647 -> 46.48.223.67 15494 SPA_* 0 0 9 1019 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:50:48.295107 0.000362 tcp 10.0.2.105 61647 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:50:48.295728 2.993788 tcp 10.0.2.105 61648 -> 162.210.27.16 8808 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:50:57.287972 0.000000 tcp 10.0.2.105 61648 -> 162.210.27.16 8808 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:54:54.141421 3.001528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 03:55:01.148967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:55:09.150255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:55:25.153124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:55:57.159506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 03:56:03.298536 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:56:03.298697 3.003508 tcp 10.0.2.105 61649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:56:12.301092 0.000000 tcp 10.0.2.105 61649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:56:18.301278 0.103977 tcp 10.0.2.105 61650 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:56:18.405599 0.064093 tcp 10.0.2.105 61651 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:56:18.469987 0.217300 tcp 10.0.2.105 61652 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:56:18.697357 2.997330 tcp 10.0.2.105 61653 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:56:27.693403 0.000000 tcp 10.0.2.105 61653 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:58:45.842187 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 03:58:45.842329 0.070326 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:58:45.912475 0.128340 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:58:46.042075 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:59:04.089103 0.062876 tcp 10.0.2.105 61654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:04.152269 0.065053 tcp 10.0.2.105 61655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:04.217548 0.158712 tcp 10.0.2.105 61656 -> 195.113.214.249 443 SRPA* 0 0 25 14904 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:04.376795 0.060066 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.446830 0.119052 udp 10.0.2.105 7010 <-> 86.133.231.238 4575 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.526952 0.079107 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.527286 2.995802 tcp 10.0.2.105 61657 -> 86.133.231.238 8218 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:59:04.589040 0.173792 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.755326 0.086164 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.822683 0.108286 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:04.899243 0.176506 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:05.046247 0.178183 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:05.216266 0.175469 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:05.473835 0.262367 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:05.701493 0.219433 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:05.911926 0.174419 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:06.086661 0.075432 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:06.149476 0.079965 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:06.193750 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:59:13.521392 0.000000 tcp 10.0.2.105 61657 -> 86.133.231.238 8218 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 03:59:24.578721 0.067504 tcp 10.0.2.105 61658 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:24.646508 0.063564 tcp 10.0.2.105 61659 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:24.710354 0.161252 tcp 10.0.2.105 61660 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:24.872097 0.709887 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 3 828 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:25.577175 0.399522 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:25.577525 4.428875 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 SPA_* 0 0 10 2226 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:25.945428 0.081658 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:26.305736 0.171022 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:26.546433 0.181120 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:26.725037 0.522575 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:27.238005 0.059102 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:27.359332 0.591072 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:27.928126 0.385378 udp 10.0.2.105 7010 <-> 14.98.60.249 6114 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:28.193702 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 03:59:31.370291 3.441893 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 11200 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:37.670040 3.841604 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 22 12040 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:42.746990 4.999751 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 37 23822 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:43.355280 0.061048 tcp 10.0.2.105 61662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:43.416605 0.062431 tcp 10.0.2.105 61663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:43.479309 0.155218 tcp 10.0.2.105 61664 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:43.634926 0.181221 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:43.834850 0.176259 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:44.008032 0.234234 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:44.234329 0.110636 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:44.330965 0.167063 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/13 03:59:47.801819 4.645562 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 40 21296 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:52.885298 1.449894 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 8444 flow=From-Botnet-V2-TCP-Established 1970/02/13 03:59:58.331039 4.922529 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 8798 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:03.453774 4.830178 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 9470 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:08.480798 4.635315 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 34 19240 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:15.000178 4.976662 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 35 19434 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:16.592144 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:00:28.937553 4.814423 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 20 10332 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:33.957152 4.832727 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:38.993939 4.606715 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 6 1896 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:44.320730 4.922063 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 4154 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:49.439295 4.075788 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 20 7892 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:00:54.096469 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:00:54.699635 2.741668 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 3522 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:01.680945 4.632678 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 23 9102 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:06.893239 4.778070 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:12.111462 4.524965 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:18.465402 4.089591 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 23 9626 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:19.592734 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:01:24.050869 4.531480 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:29.230673 4.376547 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 6466 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:33.693904 2.993585 tcp 10.0.2.105 61665 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:01:34.275649 4.932560 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 22 9048 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:39.411411 3.955744 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:42.695925 0.000000 tcp 10.0.2.105 61665 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:01:44.627060 3.937396 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 5888 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:48.695296 0.061892 tcp 10.0.2.105 61666 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:48.757446 0.061296 tcp 10.0.2.105 61667 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:48.819049 0.161933 tcp 10.0.2.105 61668 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:49.003080 2.996692 tcp 10.0.2.105 61669 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:01:50.244759 4.696814 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 6520 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:55.622450 4.919199 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:01:57.998459 0.000000 tcp 10.0.2.105 61669 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:01.165865 3.001037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 04:02:02.397102 4.295624 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 6022 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:03.997466 0.063186 tcp 10.0.2.105 61670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:04.060998 0.061996 tcp 10.0.2.105 61671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:04.123313 0.160192 tcp 10.0.2.105 61672 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:04.314969 2.997081 tcp 10.0.2.105 61673 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:08.172906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:02:08.356078 4.893833 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 4814 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:13.310000 0.000000 tcp 10.0.2.105 61673 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:13.662785 4.966730 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:16.174021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:02:18.828132 4.626508 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 2206 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:19.309498 0.112282 tcp 10.0.2.105 61674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:19.422101 0.062315 tcp 10.0.2.105 61675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:19.484718 0.157966 tcp 10.0.2.105 61676 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:19.652947 3.000623 tcp 10.0.2.105 61677 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:25.205036 4.575134 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 32 15096 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:28.652424 0.000000 tcp 10.0.2.105 61677 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:30.326944 4.403824 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 32 12732 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:32.177137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:02:34.650873 3.004200 tcp 10.0.2.105 61678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:35.914125 4.454093 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 8832 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:42.112161 1.571596 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 3106 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:43.653520 0.000000 tcp 10.0.2.105 61678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:47.318337 4.997884 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 25 9210 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:49.652477 3.004242 tcp 10.0.2.105 61679 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:02:52.450942 4.144248 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 8200 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:58.094629 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:02:58.557755 4.937782 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 7098 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:02:58.655662 0.000000 tcp 10.0.2.105 61679 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:03:04.114241 3.291760 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:04.183720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:03:12.037118 3.512355 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:17.222322 3.532555 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:22.099015 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:03:25.056900 3.681971 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 4518 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:30.284248 2.770364 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 3374 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:37.207458 4.980328 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:42.723657 4.993417 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 5364 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:47.095033 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:03:47.916151 3.555117 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:53.138663 0.956106 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:03:58.140601 4.546745 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:03.171746 4.162139 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 4678 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:08.458605 3.532507 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 4154 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:13.662934 4.306409 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 3738 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:15.095436 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:04:19.902804 4.720892 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 23 9102 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:25.364805 4.201142 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:31.075819 4.939894 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:36.553970 4.808947 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:40.591789 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:04:41.834393 4.947123 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 4154 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:46.981054 4.146044 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 11 3738 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:52.767453 4.722337 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:04:58.208694 1.452448 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 6 2944 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:03.534783 2.991005 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:04.596562 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:05:08.654824 3.807597 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:14.459818 4.997784 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:20.993424 4.921052 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 22 9048 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:27.380791 4.185931 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 5888 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:32.641647 4.427410 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 6990 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:33.600948 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:05:37.705366 4.857181 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 6412 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:42.761177 4.316192 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 7784 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:48.243181 2.319079 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:05:58.583408 4.026573 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:03.601187 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:06:04.835196 2.681639 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:11.348154 4.489775 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:16.520373 4.355609 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 19 7838 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:22.042144 4.685159 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 6520 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:27.353363 4.438335 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:35.660698 3.622332 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:40.900478 4.412957 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:44.099505 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:06:46.057666 4.210547 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:51.904004 4.252266 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 6520 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:06:57.837098 2.932608 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 6844 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:06.078417 4.351215 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 8200 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:11.100375 4.165578 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 29 12046 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:11.145374 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:07:16.933830 4.723487 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 7784 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:22.380534 4.684093 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:27.755353 4.233139 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:33.347525 3.451441 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:07:55.614850 4.074058 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:00.599681 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:08:01.280228 0.665555 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 4 896 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:04.660784 2.998661 tcp 10.0.2.105 61680 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:10.024664 2.922885 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 6996 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:13.658456 0.000000 tcp 10.0.2.105 61680 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:18.250591 3.669166 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 22 10620 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:19.658803 0.065413 tcp 10.0.2.105 61681 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:19.724588 0.062648 tcp 10.0.2.105 61682 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:19.787499 0.156333 tcp 10.0.2.105 61683 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:20.147568 3.004286 tcp 10.0.2.105 61684 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:23.565998 3.561375 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 18 7784 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:28.983562 3.560943 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 27 10890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:29.150576 0.000000 tcp 10.0.2.105 61684 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:35.149740 0.108532 tcp 10.0.2.105 61685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:35.258571 0.069630 tcp 10.0.2.105 61686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:35.328501 0.157026 tcp 10.0.2.105 61687 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:35.585067 2.998869 tcp 10.0.2.105 61688 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:36.429784 0.401389 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:42.308211 4.977112 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:44.583076 0.000000 tcp 10.0.2.105 61688 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:47.344394 3.166536 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 6 1616 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:50.581859 0.045804 tcp 10.0.2.105 61689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:50.627962 0.045907 tcp 10.0.2.105 61690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:50.674134 0.172929 tcp 10.0.2.105 61691 -> 195.113.214.249 443 SRPA* 0 0 34 24284 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:08:51.237009 3.009554 tcp 10.0.2.105 61692 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:08:54.524373 4.548931 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 19 7170 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:00.245314 0.000000 tcp 10.0.2.105 61692 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:09:03.428070 4.875121 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 3 2106 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:06.234072 2.993677 tcp 10.0.2.105 61693 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:09:08.507103 4.305993 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 17 6210 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:09.190806 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 04:09:15.071093 4.932450 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 20 10512 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:15.237003 0.000000 tcp 10.0.2.105 61693 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:09:16.197895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:09:20.594569 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:09:21.235619 2.994121 tcp 10.0.2.105 61694 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:09:22.670607 3.097237 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 23 9102 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:24.199589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:09:28.099028 4.498493 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:30.263455 0.000000 tcp 10.0.2.105 61694 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:09:33.318902 0.962596 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:38.404387 3.550918 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 9 3630 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:40.202804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:09:43.907462 4.807294 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 20 7892 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:09:45.600545 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:09:51.039212 0.399614 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:00.114343 4.177105 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:06.334788 4.952348 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 25 9734 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:11.096933 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:10:12.208443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:10:12.545352 4.860566 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 19 6974 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:17.932539 4.819899 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 25 10598 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:22.953972 4.402343 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 A_PA 0 0 26 11360 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:10:31.658918 2.281021 tcp 10.0.2.105 61661 -> 85.228.168.150 6694 FPA_* 0 0 8 753 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:14:36.238696 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:14:36.238779 3.003803 tcp 10.0.2.105 61695 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:14:45.241150 0.000000 tcp 10.0.2.105 61695 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:14:51.245642 0.048602 tcp 10.0.2.105 61696 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:14:51.294512 0.046849 tcp 10.0.2.105 61697 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:14:51.341724 0.212819 tcp 10.0.2.105 61698 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:14:51.596847 2.997891 tcp 10.0.2.105 61699 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:00.593110 0.000000 tcp 10.0.2.105 61699 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:06.592544 0.045334 tcp 10.0.2.105 61700 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:06.638166 0.045600 tcp 10.0.2.105 61701 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:06.684039 0.164329 tcp 10.0.2.105 61702 -> 195.113.214.249 443 SRPA* 0 0 34 26942 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:07.063420 3.003236 tcp 10.0.2.105 61703 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:16.065707 0.000000 tcp 10.0.2.105 61703 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:22.064776 0.044931 tcp 10.0.2.105 61704 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:22.110087 0.045197 tcp 10.0.2.105 61705 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:22.155627 0.172270 tcp 10.0.2.105 61706 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:15:22.757981 3.001359 tcp 10.0.2.105 61707 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:31.757934 0.000000 tcp 10.0.2.105 61707 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:37.757209 2.993745 tcp 10.0.2.105 61708 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:46.749460 0.000000 tcp 10.0.2.105 61708 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:15:51.596679 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:15:52.759730 3.003084 tcp 10.0.2.105 61709 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:16:01.761092 0.000000 tcp 10.0.2.105 61709 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:16:16.214515 3.001884 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 04:16:23.222062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:16:31.223582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:16:47.226668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:17:19.232632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:21:07.761666 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:21:07.761764 3.003941 tcp 10.0.2.105 61710 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:21:16.765474 0.000000 tcp 10.0.2.105 61710 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 04:21:22.764701 0.065636 tcp 10.0.2.105 61711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:21:22.830603 0.063970 tcp 10.0.2.105 61712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:21:22.894454 0.158105 tcp 10.0.2.105 61713 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:21:23.173244 0.755386 tcp 10.0.2.105 61714 -> 31.192.24.67 3527 FSPA* 0 0 12 1468 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:23:23.238694 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 04:23:30.246154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:23:38.247687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:23:54.250124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:24:26.256723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:29:48.132751 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:29:48.132906 0.000000 udp 10.0.2.105 7010 -> 70.52.124.21 4519 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:30:05.065699 0.186013 tcp 10.0.2.105 61715 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:05.252034 0.249662 tcp 10.0.2.105 61716 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:05.502083 0.160792 tcp 10.0.2.105 61717 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:05.663536 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:30:24.181761 0.062882 tcp 10.0.2.105 61718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:24.245002 0.066105 tcp 10.0.2.105 61719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:24.311385 0.163313 tcp 10.0.2.105 61720 -> 195.113.214.249 443 SRPA* 0 0 25 12648 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:24.475304 0.068176 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:24.543266 0.127591 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:24.924237 0.119867 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:25.030291 0.172653 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:25.349506 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:30:30.262098 3.003193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 04:30:37.270170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:30:43.740017 0.119869 tcp 10.0.2.105 61721 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:43.860185 0.064167 tcp 10.0.2.105 61722 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:43.924664 0.154558 tcp 10.0.2.105 61723 -> 195.113.214.249 443 SRPA* 0 0 25 13406 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:30:44.079756 0.115184 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:44.160126 0.179057 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:44.395224 0.178791 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:30:44.681918 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:30:45.271922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:31:01.284691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:31:03.057664 0.061672 tcp 10.0.2.105 61724 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:03.119594 0.064891 tcp 10.0.2.105 61725 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:03.184773 0.153633 tcp 10.0.2.105 61726 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:03.338917 0.069802 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:03.395691 0.214429 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:03.602289 0.177105 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:04.212274 0.256752 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:04.431895 0.084994 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:04.850772 0.173652 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:05.311371 0.086141 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:05.380125 0.681482 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:06.043460 0.177646 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:06.216467 0.203764 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:06.409825 0.466305 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:06.848168 0.081100 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:06.957645 0.170538 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:07.247685 0.000000 udp 10.0.2.105 7010 -> 14.98.60.249 6114 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:31:22.706138 0.064729 tcp 10.0.2.105 61727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:22.771165 0.065886 tcp 10.0.2.105 61728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:22.837334 0.164251 tcp 10.0.2.105 61729 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:23.002180 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 04:31:33.290116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:31:38.208536 0.069014 tcp 10.0.2.105 61730 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:38.277869 0.063392 tcp 10.0.2.105 61731 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:38.341511 0.158387 tcp 10.0.2.105 61732 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:31:38.500566 0.615607 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:39.095587 0.295140 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:39.419062 0.187372 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:39.598411 0.174509 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:39.769160 0.110788 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:31:39.857547 0.170514 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/13 04:37:37.296118 3.024665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 04:37:44.313901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:37:52.380904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:38:08.328110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:38:40.337740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:44:44.340206 3.002041 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 04:44:51.347969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:44:59.349283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:45:15.352633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:45:47.358660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:51:23.933118 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 04:51:23.933222 1.553089 tcp 10.0.2.105 61733 -> 31.192.24.67 3527 FSPA* 0 0 14 1545 flow=From-Botnet-V2-TCP-Established 1970/02/13 04:54:52.364668 3.002359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 04:54:59.372038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:55:07.373931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:55:23.377174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 04:55:55.382864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:01:59.388953 3.000931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:02:06.356746 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 05:02:06.356834 0.082927 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:02:06.396553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:02:06.444247 0.000000 udp 10.0.2.105 7010 -> 86.133.231.238 4575 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:02:14.397619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:02:24.965109 0.045090 tcp 10.0.2.105 61734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:25.010459 0.049195 tcp 10.0.2.105 61735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:25.059960 0.153961 tcp 10.0.2.105 61736 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:25.214514 0.000000 udp 10.0.2.105 7010 -> 14.98.60.249 6114 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:02:30.400998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:02:43.069803 0.044813 tcp 10.0.2.105 61737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:43.114928 0.046083 tcp 10.0.2.105 61738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:43.161367 0.159959 tcp 10.0.2.105 61739 -> 195.113.214.249 443 SRPA* 0 0 19 9796 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:02:43.321939 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:03:00.955207 0.045248 tcp 10.0.2.105 61740 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:01.000817 0.046810 tcp 10.0.2.105 61741 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:01.047903 0.161884 tcp 10.0.2.105 61742 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:01.210409 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:03:02.406665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:03:18.570635 0.044551 tcp 10.0.2.105 61743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:18.615572 0.047977 tcp 10.0.2.105 61744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:18.663853 0.166170 tcp 10.0.2.105 61745 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:18.831075 0.085367 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:18.944383 0.085478 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:19.014623 0.127392 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:19.157650 0.210977 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:19.335297 0.176619 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:19.489826 0.185462 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:19.666663 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:03:38.409170 0.045923 tcp 10.0.2.105 61746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:38.455365 1.399753 tcp 10.0.2.105 61747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:39.855490 0.163595 tcp 10.0.2.105 61748 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:03:40.019723 0.298421 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:40.311002 0.179074 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:40.491413 0.091733 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:40.567088 0.170801 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:40.713536 0.085412 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:40.760587 0.293917 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:41.023452 0.722572 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 3 762 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:41.742449 0.175530 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:41.915319 0.089229 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:41.996188 0.364038 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:42.329638 0.215570 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:42.535952 0.173540 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:42.706842 0.630487 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:43.315371 0.177502 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:43.489971 0.111243 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:43.579795 0.168016 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:43.723271 0.233182 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:03:43.948836 0.184581 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:09:09.417376 3.002457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:09:16.424366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:09:24.425953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:09:40.429006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:10:12.435257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:16:16.440563 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:16:23.448310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:16:31.449896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:16:47.452907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:17:19.458832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:21:25.493350 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 05:21:25.493469 0.623619 tcp 10.0.2.105 61749 -> 31.192.24.67 3527 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:23:23.466170 3.000855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:23:30.472521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:23:38.473862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:23:54.480914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:24:26.483144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:30:30.489271 3.001416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:30:37.496762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:30:45.499616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:31:01.500814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:31:33.506852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:33:59.557153 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 05:33:59.557363 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:34:15.592492 0.064588 tcp 10.0.2.105 61750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:15.657318 0.061495 tcp 10.0.2.105 61751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:15.719164 0.164197 tcp 10.0.2.105 61752 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:15.883976 0.060070 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.078582 0.080685 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.139989 0.128094 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.322072 0.174570 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.482861 0.068179 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.712940 0.231848 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:16.930296 0.174286 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:17.077034 0.739757 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:17.785132 0.082771 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:18.064393 0.174424 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:18.289722 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:34:34.047265 0.060305 tcp 10.0.2.105 61753 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:34.107867 0.065485 tcp 10.0.2.105 61754 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:34.173669 0.154945 tcp 10.0.2.105 61755 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:34.329083 0.173891 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:34.707141 0.088268 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:34.754983 0.253117 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:34.972957 0.081778 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:35.145232 0.766456 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 5 1748 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:35.898346 0.173478 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:36.113192 0.169655 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:36.279673 0.381269 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 1962 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:36.661541 0.212332 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:36.863720 0.555858 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:37.400172 0.175942 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:37.600634 0.165590 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:37.744900 0.184183 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:37.921387 0.165938 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/13 05:34:38.144083 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 05:34:54.626755 0.061657 tcp 10.0.2.105 61756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:54.688699 0.061685 tcp 10.0.2.105 61757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:34:54.750652 0.158309 tcp 10.0.2.105 61758 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:37:37.512781 3.001917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 05:37:44.520110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:37:52.521614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:38:08.524930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:38:40.530990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:44:44.536358 3.002192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:44:51.544481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:44:59.545842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:45:15.548828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:45:47.555555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:51:26.122230 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 05:51:26.122321 0.915862 tcp 10.0.2.105 61759 -> 31.192.24.67 3527 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/13 05:54:53.562411 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 05:55:00.569828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:55:08.571181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:55:24.574422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 05:55:56.580676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:02:00.586560 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:02:07.593681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:02:15.595458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:02:31.598213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:03:03.604783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:05:16.135611 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 06:05:16.135824 0.215527 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:16.344259 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 06:05:31.779685 0.047812 tcp 10.0.2.105 61760 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:05:31.827743 0.045806 tcp 10.0.2.105 61761 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:05:31.873376 0.156172 tcp 10.0.2.105 61762 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:05:32.030250 0.127942 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.191644 0.082895 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.253983 0.207113 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.447923 0.201233 udp 10.0.2.105 7010 <-> 71.1.238.248 1264 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.641000 0.174829 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.786674 0.070622 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.869162 0.080466 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:32.932543 0.172216 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.109808 0.090503 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.184174 0.111193 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.265324 0.087597 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.342786 0.172829 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.540395 0.082221 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.611612 0.252977 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.829252 0.169242 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:33.995978 0.749035 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:34.745474 0.171661 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:34.914211 0.558166 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:35.450829 0.419591 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:35.787062 0.217071 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:35.994351 0.258637 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:36.229845 0.176117 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:36.403432 0.133820 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:05:36.537709 0.179721 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:09:07.609836 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:09:14.618287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:09:22.629683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:09:38.632699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:10:10.638391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:16:14.644723 3.001231 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:16:21.651744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:16:29.653206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:16:45.656393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:17:17.662802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:21:27.041156 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 06:21:27.041345 0.620900 tcp 10.0.2.105 61763 -> 31.192.24.67 3527 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:23:21.668796 3.001545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:23:28.675594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:23:36.677184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:23:52.680272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:24:24.686494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:30:28.695524 2.998255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:30:35.699592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:30:43.701221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:30:59.704791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:31:31.712725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:35:45.515363 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 06:35:45.515475 0.219285 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:35:45.726255 0.130218 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:35:46.080943 0.084458 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:35:46.145927 0.143715 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:35:46.408899 0.000000 udp 10.0.2.105 7010 -> 71.1.238.248 1264 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 06:36:02.401607 0.064857 tcp 10.0.2.105 61764 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:02.466716 0.062454 tcp 10.0.2.105 61765 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:02.529473 0.171484 tcp 10.0.2.105 61766 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:02.701479 0.176769 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:02.847736 0.066173 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:03.306422 0.077627 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:03.368817 0.173749 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:03.625940 0.000000 udp 10.0.2.105 7010 -> 86.140.77.20 5873 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 06:36:21.447613 0.064260 tcp 10.0.2.105 61767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:21.512165 0.064660 tcp 10.0.2.105 61768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:21.577114 0.153389 tcp 10.0.2.105 61769 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:36:21.731127 0.883042 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:22.580958 0.457784 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:22.999443 0.173982 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:23.456836 0.082117 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:23.529722 0.256105 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:23.748883 0.171994 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:24.066741 0.623019 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:24.672010 0.189475 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:25.226925 0.206443 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:25.422548 0.169640 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:25.571099 0.504248 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:26.055833 0.397999 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:26.427995 0.181980 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:26.726628 0.247580 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:36:26.970777 0.097421 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/13 06:37:35.716719 3.001123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 06:37:42.723789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:37:50.728914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:38:06.728106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:38:38.744091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:44:42.751082 3.000758 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:44:49.757602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:44:57.759162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:45:13.762860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:45:45.768215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:51:27.670369 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 06:51:27.670570 0.763137 tcp 10.0.2.105 61770 -> 31.192.24.67 3527 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/13 06:54:53.778350 3.002120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 06:55:00.786269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:55:08.787902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:55:24.790331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 06:55:56.796744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:02:00.802229 3.002563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 07:02:07.810179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:02:15.811969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:02:31.814846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:03:03.820494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:06:54.822962 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:06:54.823071 0.000000 udp 10.0.2.105 7010 -> 86.140.77.20 5873 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:07:10.067663 0.064137 tcp 10.0.2.105 61771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:10.132092 0.064032 tcp 10.0.2.105 61772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:10.196475 0.169101 tcp 10.0.2.105 61773 -> 195.113.214.249 443 SRPA* 0 0 47 25180 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:10.366222 0.000000 udp 10.0.2.105 7010 -> 71.1.238.248 1264 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:07:29.082954 0.061044 tcp 10.0.2.105 61774 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:29.144284 0.063523 tcp 10.0.2.105 61775 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:29.208189 0.157371 tcp 10.0.2.105 61776 -> 195.113.214.249 443 SRPA* 0 0 41 21172 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:29.366219 0.087640 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:29.432832 0.128279 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:29.433266 3.003766 tcp 10.0.2.105 61777 -> 213.123.178.217 7379 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:07:29.560687 0.213747 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:29.766683 0.258078 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:30.195153 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:07:38.435472 0.000000 tcp 10.0.2.105 61777 -> 213.123.178.217 7379 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:07:49.100950 0.061738 tcp 10.0.2.105 61778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:49.162530 0.065477 tcp 10.0.2.105 61779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:49.228545 0.161161 tcp 10.0.2.105 61780 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:07:49.390313 0.175913 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:49.538290 0.171809 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:50.004352 0.094843 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:50.084495 0.106811 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:50.502415 0.080335 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:50.739116 0.172549 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:51.211172 0.090626 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:51.290774 0.255747 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:51.510177 0.176000 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:51.683414 0.074009 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:51.955098 0.173230 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:52.125757 0.205529 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:52.351055 0.168318 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:52.496590 0.434281 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:52.910184 0.174833 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:07:53.185116 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:08:11.313334 0.062444 tcp 10.0.2.105 61781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:08:11.376108 0.068249 tcp 10.0.2.105 61782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:08:11.444644 0.168793 tcp 10.0.2.105 61783 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:08:11.614129 0.414457 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:12.002063 0.184096 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:12.204243 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:08:20.256221 0.109056 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 1108 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:25.363214 0.134792 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3180 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:25.477482 0.514393 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 8 2939 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:26.026829 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:08:34.185338 0.583749 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 2878 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:34.761563 0.448201 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 2910 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:35.185888 0.371344 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 2962 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:35.528958 0.109111 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 8 3101 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:35.623593 0.326299 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 8 3063 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:35.926907 0.169077 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 3095 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:36.086991 0.507718 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3194 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:36.557739 0.295294 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2806 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:36.815277 0.344926 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 3311 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:37.124008 0.334744 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2991 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:37.456146 0.405671 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 8 2947 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:37.852079 0.377784 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 3137 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:38.208673 0.357245 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 8 2979 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:38.562885 0.354384 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 8 3222 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:38.898852 0.403706 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:39.092494 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:08:39.299599 0.854052 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 8 3070 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:40.130115 0.372438 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 8 3168 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:40.493854 0.733217 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 2984 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:08:41.199615 0.000000 udp 10.0.2.105 7010 -> 2.51.143.4 2807 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:08:47.775122 0.000000 udp 10.0.2.105 7010 -> 213.82.216.82 7312 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:08:56.678189 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:04.479219 0.000000 udp 10.0.2.105 7010 -> 75.2.213.222 5231 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:07.826753 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 07:09:09.098673 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:09:12.560973 0.000000 udp 10.0.2.105 7010 -> 86.42.95.150 6606 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:14.834057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:09:20.282081 0.000000 udp 10.0.2.105 7010 -> 190.146.19.137 7040 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:22.835627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:09:27.062067 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:32.770218 0.000000 udp 10.0.2.105 7010 -> 216.254.156.227 3017 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:37.597141 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:09:38.838421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:09:41.532823 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:48.612937 0.000000 udp 10.0.2.105 7010 -> 86.165.116.81 6515 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:09:53.790154 0.000000 udp 10.0.2.105 7010 -> 212.19.100.78 3165 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:00.770247 0.000000 udp 10.0.2.105 7010 -> 69.42.182.34 9439 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:05.597015 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:10:07.690376 0.339413 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3032 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:10:08.173714 0.000000 udp 10.0.2.105 7010 -> 101.224.9.175 7221 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:10.844651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:10:17.055429 0.000000 udp 10.0.2.105 7010 -> 188.14.195.35 9093 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:23.347827 0.000000 udp 10.0.2.105 7010 -> 95.88.189.100 8040 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:31.665105 0.000000 udp 10.0.2.105 7010 -> 190.77.125.201 3490 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:38.920784 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:10:42.807305 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:47.760752 0.000000 udp 10.0.2.105 7010 -> 58.20.48.254 3487 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:10:54.733176 0.000000 udp 10.0.2.105 7010 -> 86.169.199.148 6503 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:03.106852 0.000000 udp 10.0.2.105 7010 -> 202.172.118.245 6428 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:07.566248 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:11:10.693969 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:17.871773 0.000000 udp 10.0.2.105 7010 -> 95.254.102.5 5985 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:23.081553 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:29.899120 0.000000 udp 10.0.2.105 7010 -> 24.172.96.6 2158 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:34.738613 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:11:38.367917 0.000000 udp 10.0.2.105 7010 -> 93.193.157.118 7662 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:45.669587 0.000000 udp 10.0.2.105 7010 -> 95.232.97.40 9555 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:11:53.425768 0.000000 udp 10.0.2.105 7010 -> 65.36.4.10 5064 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:01.869985 0.000000 udp 10.0.2.105 7010 -> 212.76.75.69 3070 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:06.370000 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:12:08.140400 0.000000 udp 10.0.2.105 7010 -> 50.195.153.65 4906 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:16.485121 0.000000 udp 10.0.2.105 7010 -> 2.89.217.253 4872 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:23.623941 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:32.142363 0.338854 udp 10.0.2.105 7010 <-> 113.20.16.40 6742 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:12:33.029754 0.194436 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:33.224190 0.000000 icmp 68.6.205.151 0x0303 -> 10.0.2.105 0x550a URP 192 1 273 flow=Background 1970/02/13 07:12:36.653548 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:12:39.031200 0.000000 udp 10.0.2.105 7010 -> 72.175.1.199 7045 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:45.403509 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:12:53.288178 0.000000 udp 10.0.2.105 7010 -> 89.106.30.18 8755 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:01.158768 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:05.794637 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:13:09.878150 0.000000 udp 10.0.2.105 7010 -> 176.61.121.157 8525 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:16.957719 0.000000 udp 10.0.2.105 7010 -> 190.41.165.80 1569 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:23.442350 0.000000 udp 10.0.2.105 7010 -> 94.65.237.74 4648 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:29.416186 0.000000 udp 10.0.2.105 7010 -> 96.21.43.44 4475 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:33.995110 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:13:37.977928 0.000000 udp 10.0.2.105 7010 -> 109.255.102.74 7460 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:46.507471 0.000000 udp 10.0.2.105 7010 -> 110.143.131.101 8100 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:53.177804 0.241415 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 8 3102 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:13:53.833079 0.000000 udp 10.0.2.105 7010 -> 2.216.194.67 9017 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:13:57.700908 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:14:02.135105 0.000000 udp 10.0.2.105 7010 -> 70.250.138.73 3333 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:10.595367 0.000000 udp 10.0.2.105 7010 -> 78.13.167.57 6455 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:18.849649 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:23.387054 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:14:27.073936 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 9979 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:32.029836 0.000000 udp 10.0.2.105 7010 -> 107.199.178.121 7392 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:40.808066 0.000000 udp 10.0.2.105 7010 -> 207.134.53.206 2816 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:48.276589 0.000000 udp 10.0.2.105 7010 -> 162.237.52.245 3340 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:14:53.014362 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:14:55.051574 0.000000 udp 10.0.2.105 7010 -> 108.252.225.250 1628 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:00.056620 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:05.546963 0.000000 udp 10.0.2.105 7010 -> 88.232.40.79 3484 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:11.788379 0.000000 udp 10.0.2.105 7010 -> 24.66.140.112 7854 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:17.177532 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:15:19.390086 0.000000 udp 10.0.2.105 7010 -> 93.155.253.139 9159 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:26.402125 0.000000 udp 10.0.2.105 7010 -> 88.251.140.219 6532 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:32.071637 0.000000 udp 10.0.2.105 7010 -> 75.89.250.47 9848 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:40.413756 0.000000 udp 10.0.2.105 7010 -> 69.199.183.61 3687 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:45.319223 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:15:47.575315 0.000000 udp 10.0.2.105 7010 -> 105.236.52.183 2285 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:15:53.923014 0.000000 udp 10.0.2.105 7010 -> 95.237.58.21 6477 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:00.123698 0.000000 udp 10.0.2.105 7010 -> 174.50.254.190 5870 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:07.797842 0.255190 udp 10.0.2.105 7010 <-> 109.53.81.198 2269 CON 0 0 8 3188 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:16:08.520033 0.000000 udp 10.0.2.105 7010 -> 99.180.84.79 1464 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:12.594865 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:16:14.850518 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 07:16:16.560717 0.169075 udp 10.0.2.105 7010 <-> 88.225.211.28 8793 CON 0 0 8 2980 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:16:16.929069 0.000000 udp 10.0.2.105 7010 -> 95.233.206.95 7472 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:21.858152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:16:23.418524 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:30.470796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:16:32.259371 0.000000 udp 10.0.2.105 7010 -> 150.101.103.149 7044 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:37.129483 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:16:39.375220 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:46.290326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:16:47.290432 0.000000 udp 10.0.2.105 7010 -> 86.145.211.103 8059 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:54.069057 0.000000 udp 10.0.2.105 7010 -> 76.184.74.218 1315 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:16:59.160070 0.000000 udp 10.0.2.105 7010 -> 95.225.123.210 5882 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:03.803321 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:17:06.461571 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:13.942029 0.109214 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 8 2912 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:17:14.705055 0.000000 udp 10.0.2.105 7010 -> 79.31.63.50 2593 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:17.907276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:17:19.885738 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:25.379520 0.120522 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:25.500042 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 192 flow=Background 1970/02/13 07:17:30.096024 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:17:33.511396 0.000000 udp 10.0.2.105 7010 -> 83.244.219.66 4683 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:42.183821 0.145483 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 8 3018 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:17:42.444540 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:50.885987 0.432262 udp 10.0.2.105 7010 -> 202.137.144.29 1387 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:17:51.318249 0.000000 icmp 202.137.144.29 0x0303 -> 10.0.2.105 0x6b05 URP 192 1 249 flow=Background 1970/02/13 07:17:55.592986 0.131901 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:17:59.190179 0.000000 udp 10.0.2.105 7010 -> 173.68.140.226 2854 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:07.710971 0.363581 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 2989 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:08.252732 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:15.561686 0.478558 udp 10.0.2.105 7010 <-> 108.195.136.230 7576 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:16.659091 0.076945 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 8 2961 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:16.968046 0.284424 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 8 3045 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:17.259836 0.000000 udp 10.0.2.105 7010 -> 2.50.16.104 4306 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:20.097448 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:18:25.035577 0.000000 udp 10.0.2.105 7010 -> 79.27.202.200 1373 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:31.063920 0.240607 udp 10.0.2.105 7010 <-> 79.55.125.200 7398 CON 0 0 8 3278 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:31.286329 0.000000 udp 10.0.2.105 7010 -> 79.48.122.15 6737 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:37.714006 0.000000 udp 10.0.2.105 7010 -> 84.170.150.35 3546 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:44.153077 0.670611 udp 10.0.2.105 7010 <-> 117.214.1.98 3675 CON 0 0 8 3162 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:45.046003 0.000000 udp 10.0.2.105 7010 -> 75.74.118.74 7848 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:49.090030 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:18:51.322858 0.151674 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 8 2834 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:51.727621 0.379788 udp 10.0.2.105 7010 <-> 2.193.235.152 4752 CON 0 0 8 3129 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:18:52.286426 0.000000 udp 10.0.2.105 7010 -> 99.157.201.237 1026 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:18:58.373355 0.000000 udp 10.0.2.105 7010 -> 173.11.62.229 1487 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:05.533549 0.000000 udp 10.0.2.105 7010 -> 70.75.185.170 9917 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:13.805361 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:18.592017 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:19:20.535248 0.000000 udp 10.0.2.105 7010 -> 79.33.30.203 2142 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:27.274857 0.237036 udp 10.0.2.105 7010 <-> 217.203.81.37 7449 CON 0 0 8 2939 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:19:27.921744 0.163779 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 8 3004 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:19:28.140078 0.000000 udp 10.0.2.105 7010 -> 87.13.70.243 3159 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:36.327752 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:42.406756 0.000000 udp 10.0.2.105 7010 -> 92.40.58.63 4819 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:47.093356 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:19:47.724039 0.000000 udp 10.0.2.105 7010 -> 86.135.211.70 7930 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:19:56.146264 0.000000 udp 10.0.2.105 7010 -> 203.168.200.51 9798 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:03.376707 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:10.907181 0.000000 udp 10.0.2.105 7010 -> 190.219.1.134 3038 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:15.594008 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:20:16.024993 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:22.494252 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:31.317016 0.000000 udp 10.0.2.105 7010 -> 69.198.95.41 5967 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:38.958194 0.112230 udp 10.0.2.105 7010 -> 5.166.191.174 1302 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:39.070424 0.000000 icmp 5.166.191.174 0x0303 -> 10.0.2.105 0x1605 URP 192 1 231 flow=Background 1970/02/13 07:20:43.594636 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:20:46.618800 0.332145 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 8 2913 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:20:47.061660 0.099972 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:20:47.170486 0.000000 udp 10.0.2.105 7010 -> 84.177.31.71 4751 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:20:53.869439 0.062552 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:20:53.943829 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:00.188759 0.000000 udp 10.0.2.105 7010 -> 2.234.97.206 8619 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:08.810734 0.142439 udp 10.0.2.105 7010 -> 41.242.50.122 3170 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:08.953173 0.000000 icmp 41.242.50.122 0x0303 -> 10.0.2.105 0x620c URP 192 1 310 flow=Background 1970/02/13 07:21:13.597471 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:21:13.837896 0.000000 udp 10.0.2.105 7010 -> 71.165.162.138 5593 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:19.526149 0.000000 udp 10.0.2.105 7010 -> 95.240.251.140 7109 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:24.934064 0.000000 udp 10.0.2.105 7010 -> 66.175.172.252 5982 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:21:28.439526 0.976030 tcp 10.0.2.105 61784 -> 31.192.24.67 3527 FSPA* 0 0 12 1406 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:21:32.024089 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:23:21.884689 3.001965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 07:23:28.892118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:23:36.893657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:23:52.896617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:24:24.902646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:30:28.908054 3.002139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 07:30:35.915990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:30:43.917604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:30:59.919925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:31:31.926558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:37:35.942349 3.002586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 07:37:42.949803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:37:50.951548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:38:06.954819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:38:38.960018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:44:42.966648 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 07:44:49.974139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:44:57.975380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:45:13.978628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:45:45.984724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:51:29.419180 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:51:29.419361 0.650509 tcp 10.0.2.105 61785 -> 31.192.24.67 3527 FSPA* 0 0 12 1474 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:51:42.146910 0.090973 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.238348 0.128567 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.367266 0.064327 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.432148 0.129043 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.432534 3.000518 tcp 10.0.2.105 61786 -> 213.123.178.217 7379 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:51:42.561645 0.145700 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.707739 0.264475 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:42.972637 0.148095 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:43.121226 0.620172 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:43.741769 0.147910 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:43.890121 0.070331 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:43.960781 0.169246 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:44.130403 0.327295 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:44.458147 0.074717 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:44.533222 0.150778 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:44.684485 0.461226 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:45.146114 0.071739 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:45.218259 0.162840 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:45.381500 0.171369 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:45.553247 0.369354 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:45.923006 0.171128 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:46.094530 0.328713 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:46.423668 0.167050 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:46.591120 0.160760 udp 10.0.2.105 7010 <-> 113.20.16.40 6742 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:46.752292 0.104800 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:51:46.857570 0.000000 udp 10.0.2.105 7010 -> 109.53.81.198 2269 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:51:51.430109 0.000000 tcp 10.0.2.105 61786 -> 213.123.178.217 7379 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:51:56.102513 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 07:52:04.525853 0.063659 tcp 10.0.2.105 61787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:04.589813 0.062287 tcp 10.0.2.105 61788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:04.652424 0.155947 tcp 10.0.2.105 61789 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:04.808902 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:52:21.685381 0.060573 tcp 10.0.2.105 61790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:21.746275 0.064763 tcp 10.0.2.105 61791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:21.811361 0.158702 tcp 10.0.2.105 61792 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:21.970676 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:52:37.145849 0.084696 tcp 10.0.2.105 61793 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:37.230832 0.063383 tcp 10.0.2.105 61794 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:37.294575 0.153653 tcp 10.0.2.105 61795 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:37.448760 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:52:52.538632 0.060692 tcp 10.0.2.105 61796 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:52.599578 0.075235 tcp 10.0.2.105 61797 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:52.675063 0.160887 tcp 10.0.2.105 61798 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:52:52.836456 0.186554 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:52:53.023355 0.164121 udp 10.0.2.105 7010 <-> 108.195.136.230 7576 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:52:53.187834 0.029414 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:52:53.217679 0.056263 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:52:53.217994 3.005189 tcp 10.0.2.105 61799 -> 79.227.129.202 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:52:53.274377 0.000000 udp 10.0.2.105 7010 -> 79.55.125.200 7398 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:53:02.221636 0.000000 tcp 10.0.2.105 61799 -> 79.227.129.202 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 07:53:09.185045 0.068833 tcp 10.0.2.105 61800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:53:09.254241 0.066064 tcp 10.0.2.105 61801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:53:09.320570 0.153279 tcp 10.0.2.105 61802 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 07:53:09.474600 0.000000 udp 10.0.2.105 7010 -> 117.214.1.98 3675 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:53:19.026325 0.000000 udp 10.0.2.105 7010 <- 117.214.1.98 3675 RSP 0 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 07:53:19.026681 0.091135 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.118215 0.204836 udp 10.0.2.105 7010 <-> 2.193.235.152 4752 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.323475 0.069754 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.393645 0.084214 udp 10.0.2.105 7010 <-> 217.203.81.37 7449 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.478239 0.098173 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.576869 0.064410 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:53:19.641738 0.072258 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/13 07:54:53.995217 3.006982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 07:55:01.002050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:55:09.003941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:55:25.007028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 07:55:57.013289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:02:01.019039 3.001579 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:02:08.026364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:02:16.027322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:02:32.030898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:03:04.036953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:09:08.045218 2.999629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:09:15.050121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:09:23.052119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:09:39.054966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:10:11.060589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:16:15.066927 3.002060 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:16:22.073882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:16:30.075918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:16:46.078965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:17:18.094776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:21:30.077730 0.000314 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 08:21:30.078164 0.676046 tcp 10.0.2.105 61803 -> 31.192.24.67 3527 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:23:22.101645 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:23:29.109989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:23:37.109791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:23:41.777349 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 08:23:41.777539 0.499108 udp 10.0.2.105 7010 -> 109.53.81.198 2269 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:23:42.276647 0.000000 icmp 109.53.81.198 0x0303 -> 10.0.2.105 0xdd08 URP 192 1 160 flow=Background 1970/02/13 08:23:53.112859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:24:00.883406 0.064171 tcp 10.0.2.105 61804 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:00.947942 0.065371 tcp 10.0.2.105 61805 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:01.013551 0.168743 tcp 10.0.2.105 61806 -> 195.113.214.249 443 SRPA* 0 0 24 13820 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:01.182925 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:24:17.218623 0.060672 tcp 10.0.2.105 61807 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:17.279655 0.060725 tcp 10.0.2.105 61808 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:17.340689 0.267233 tcp 10.0.2.105 61809 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:17.609794 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:24:25.339268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:24:35.800360 0.063832 tcp 10.0.2.105 61810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:35.864525 0.061104 tcp 10.0.2.105 61811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:35.925928 0.157142 tcp 10.0.2.105 61812 -> 195.113.214.249 443 SRPA* 0 0 36 18262 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:36.083617 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:24:54.712129 0.061154 tcp 10.0.2.105 61813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:54.773634 0.156497 tcp 10.0.2.105 61814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:54.930400 0.219780 tcp 10.0.2.105 61815 -> 195.113.214.249 443 SRPA* 0 0 68 51174 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:24:55.150718 0.000000 udp 10.0.2.105 7010 -> 79.55.125.200 7398 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:25:11.657070 0.065954 tcp 10.0.2.105 61816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:11.723392 0.063272 tcp 10.0.2.105 61817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:11.787022 0.158884 tcp 10.0.2.105 61818 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:11.946398 0.085371 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.032171 0.064071 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.096699 0.145465 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.242549 0.064497 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.307581 0.126122 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.307966 3.003098 tcp 10.0.2.105 61819 -> 213.123.178.217 7379 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 08:25:12.434134 0.141965 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.576523 0.147502 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.724574 0.170061 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:12.895017 0.501129 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:13.396699 0.078250 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:13.475380 0.148160 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:13.623990 0.145335 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:13.769682 0.079304 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:13.849369 0.445128 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:14.294941 0.072203 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:14.367562 0.162507 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:14.530464 0.172728 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:14.703630 0.247309 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:14.951289 0.369150 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:15.320811 0.179725 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:15.500910 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:25:21.309780 0.000000 tcp 10.0.2.105 61819 -> 213.123.178.217 7379 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 08:25:31.344709 0.064578 tcp 10.0.2.105 61820 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:31.409526 0.061697 tcp 10.0.2.105 61821 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:31.471565 0.170947 tcp 10.0.2.105 61822 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:31.642994 0.104906 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:31.748281 0.169575 udp 10.0.2.105 7010 <-> 113.20.16.40 6742 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:31.918207 1.241255 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.159913 0.176528 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.336791 0.051908 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.389125 0.029466 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.419009 0.192908 udp 10.0.2.105 7010 <-> 108.195.136.230 7576 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.419327 2.992095 tcp 10.0.2.105 61823 -> 79.227.129.202 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 08:25:33.612384 0.068503 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:33.681262 0.000000 udp 10.0.2.105 7010 -> 2.193.235.152 4752 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:25:42.410052 0.000000 tcp 10.0.2.105 61823 -> 79.227.129.202 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 08:25:49.781240 0.062702 tcp 10.0.2.105 61824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:49.844189 0.062341 tcp 10.0.2.105 61825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:49.906836 0.168389 tcp 10.0.2.105 61826 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:25:50.075949 0.060600 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:25:50.136998 0.000000 udp 10.0.2.105 7010 -> 217.203.81.37 7449 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:26:06.075349 0.061618 tcp 10.0.2.105 61827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:06.137221 0.060748 tcp 10.0.2.105 61828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:06.198276 0.156307 tcp 10.0.2.105 61829 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:06.355125 0.097475 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:26:06.452982 0.061877 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:26:06.515307 0.000000 udp 10.0.2.105 7010 -> 117.214.1.98 3675 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:26:24.993141 0.066096 tcp 10.0.2.105 61830 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:25.059149 0.062440 tcp 10.0.2.105 61831 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:25.121868 0.178223 tcp 10.0.2.105 61832 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:25.300796 0.064704 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:26:25.366718 4.995065 tcp 10.0.2.105 61833 -> 89.232.24.88 8222 SPA_* 0 0 966 629988 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:26:30.368884 1.835936 tcp 10.0.2.105 61833 -> 89.232.24.88 8222 FPA_* 0 0 144 90606 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:30:29.134634 3.002193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 08:30:36.142230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:30:44.143709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:31:00.146983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:31:32.153146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:37:36.158756 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:37:43.165780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:37:51.167883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:38:07.173126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:38:39.179258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:44:43.183941 3.017148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:44:50.200554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:44:58.202225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:45:14.205060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:45:46.210887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:51:30.757046 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 08:51:30.757229 1.623149 tcp 10.0.2.105 61834 -> 31.192.24.67 3527 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:54:55.222704 3.001842 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 08:55:02.229635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:55:10.232051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:55:26.234754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:55:58.240667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 08:56:46.300614 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 08:56:46.300707 0.165009 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:56:46.466176 0.000000 udp 10.0.2.105 7010 -> 217.203.81.37 7449 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:57:03.876725 0.066547 tcp 10.0.2.105 61835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:03.943513 0.063065 tcp 10.0.2.105 61836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:04.006908 0.158798 tcp 10.0.2.105 61837 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:04.166336 0.000000 udp 10.0.2.105 7010 -> 2.193.235.152 4752 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:57:22.202883 0.060542 tcp 10.0.2.105 61838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:22.263730 0.063594 tcp 10.0.2.105 61839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:22.327643 0.155645 tcp 10.0.2.105 61840 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:22.483820 0.000000 udp 10.0.2.105 7010 -> 117.214.1.98 3675 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:57:37.714257 0.065223 tcp 10.0.2.105 61841 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:37.779848 0.078954 tcp 10.0.2.105 61842 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:37.859122 0.155212 tcp 10.0.2.105 61843 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:38.014890 0.065803 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.081095 0.078927 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.160481 0.053479 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.214313 0.093578 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.308460 0.129633 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.438508 0.142984 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.581876 0.170665 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.752914 0.146399 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:38.899686 0.147553 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.047623 0.068286 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.116327 0.145038 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.261835 0.071788 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.333989 0.286816 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.621207 0.083760 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.705367 0.214480 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:39.920244 0.170968 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:40.091639 0.163687 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:40.255804 0.377049 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:40.633227 0.197610 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:40.831218 0.177173 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:41.008791 0.000000 udp 10.0.2.105 7010 -> 113.20.16.40 6742 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 08:57:57.363395 0.062387 tcp 10.0.2.105 61844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:57.426061 0.068999 tcp 10.0.2.105 61845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:57.495321 0.166896 tcp 10.0.2.105 61846 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 08:57:57.663124 0.103329 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:57.766858 0.175587 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:57.942842 1.271018 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.214258 0.049382 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.264067 0.030449 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.294873 0.123521 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.418838 0.277008 udp 10.0.2.105 7010 <-> 108.195.136.230 7576 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.696217 0.106915 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.803527 0.097064 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.900972 0.063976 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/13 08:57:59.965325 0.105940 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:02:02.247047 3.001576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 09:02:09.254276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:02:17.255710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:02:33.258968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:03:05.265160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:09:09.271343 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:09:16.282277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:09:24.279930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:09:40.283803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:10:12.292997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:16:16.294614 3.157011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:16:23.422787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:16:31.362395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:16:47.316631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:17:19.322721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:21:32.377162 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 09:21:32.377277 0.781290 tcp 10.0.2.105 61847 -> 31.192.24.67 3527 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:23:23.328771 3.001661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:23:30.336307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:23:38.337500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:23:54.340550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:24:26.346577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:28:28.805552 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 09:28:28.805651 0.000000 udp 10.0.2.105 7010 -> 113.20.16.40 6742 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 09:28:46.663177 0.062194 tcp 10.0.2.105 61848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:28:46.725652 0.062829 tcp 10.0.2.105 61849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:28:46.788776 0.156216 tcp 10.0.2.105 61850 -> 195.113.214.249 443 SRPA* 0 0 65 43652 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:28:46.943885 0.166098 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.110376 0.061402 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.172260 0.049531 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.222415 0.064592 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.287433 0.144604 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.432574 0.224506 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.657466 0.144577 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.802433 0.087929 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.890745 0.055617 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:47.946734 0.145840 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:48.093062 0.071661 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:48.165122 0.148284 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:48.313748 0.147569 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:48.461725 0.551723 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:49.013814 0.171993 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:49.186191 0.081748 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:49.268344 0.421950 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:49.690661 0.166467 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:49.857552 0.368608 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:50.226599 0.191956 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:50.418924 0.172606 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:50.591873 0.104877 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:50.697135 0.307842 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:51.005354 0.978582 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:51.984419 0.049351 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.034199 0.028965 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.063590 0.098783 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.162791 0.098431 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.261617 0.066609 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.328632 0.088030 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.417100 0.206619 udp 10.0.2.105 7010 <-> 108.195.136.230 7576 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:28:52.624080 0.093823 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:30:30.353542 3.000734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:30:37.360102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:30:45.361666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:31:01.364769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:31:33.375872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:37:37.376644 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:37:44.384000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:37:52.385771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:38:08.388233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:38:40.394350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:44:44.406249 2.996774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:44:51.408347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:44:59.409415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:45:15.412857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:45:47.418830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:51:33.165936 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 09:51:33.166054 2.041283 tcp 10.0.2.105 61851 -> 31.192.24.67 3527 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:54:56.430712 3.002183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 09:55:03.437917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:55:11.439585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:55:27.442693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:55:59.448942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 09:59:13.167401 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 09:59:13.167586 0.046931 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.214962 0.058240 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.273586 0.165289 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.439264 0.061555 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.501220 0.144668 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.646342 0.167313 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.814039 0.128252 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:13.942718 0.086005 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.029169 0.057681 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.087274 0.145331 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.233064 0.071012 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.304473 0.147225 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.452095 0.171821 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.624287 0.080705 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.705363 0.149429 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:14.855128 0.633637 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:15.489225 0.220521 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:15.710173 0.168452 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:15.879031 0.376664 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:16.256078 0.103737 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:16.360188 0.174711 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:16.535302 0.189884 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:16.725602 0.171009 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:16.897060 1.082092 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:17.979552 0.051081 udp 10.0.2.105 7010 <-> 31.53.219.230 1878 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.031047 0.029876 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.061314 0.103088 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.164778 0.098722 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.263910 0.066314 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.330635 0.096360 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/13 09:59:18.427417 0.000000 udp 10.0.2.105 7010 -> 108.195.136.230 7576 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 09:59:37.073644 0.065134 tcp 10.0.2.105 61852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:59:37.139034 0.062993 tcp 10.0.2.105 61853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:59:37.202283 0.153188 tcp 10.0.2.105 61854 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 09:59:37.355994 0.091860 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:02:03.455217 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:02:10.461789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:02:18.463322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:02:34.466679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:03:06.472483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:09:10.478550 3.001543 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:09:17.485998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:09:25.491092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:09:41.490410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:10:13.506389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:16:17.512981 3.002417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:16:24.519938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:16:32.521605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:16:48.524298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:17:20.530286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:21:35.207306 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:21:35.207485 0.581738 tcp 10.0.2.105 61855 -> 31.192.24.67 3527 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:23:24.536963 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:23:31.543704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:23:39.545375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:23:55.548618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:24:27.556960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:29:41.385813 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:29:41.385929 0.000000 udp 10.0.2.105 7010 -> 108.195.136.230 7576 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 10:29:59.533586 0.063873 tcp 10.0.2.105 61856 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:29:59.597744 0.064849 tcp 10.0.2.105 61857 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:29:59.662853 0.161194 tcp 10.0.2.105 61858 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:29:59.824813 0.058929 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:29:59.884107 0.164346 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.048871 0.062888 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.112138 0.145268 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.257777 0.170096 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.428265 0.128214 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.556946 0.096330 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.653729 0.078722 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.732827 0.045573 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.778741 0.071060 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.850156 0.148800 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:00.999299 0.143597 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:01.143320 0.078607 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:01.222298 0.147068 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:01.369762 0.759382 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.129515 0.171276 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.301189 0.104571 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.406175 0.197445 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.603993 0.198970 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.803403 0.174881 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:02.978691 0.162760 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.141912 0.275774 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.418095 0.368299 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.786801 0.028701 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.815840 0.064102 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.880300 0.098232 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:03.978894 0.060436 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:04.039751 0.058308 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:04.098445 0.334940 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:04.433795 0.000000 udp 10.0.2.105 7010 -> 31.53.219.230 1878 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 10:30:21.914602 0.061556 tcp 10.0.2.105 61859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:30:21.976636 0.066550 tcp 10.0.2.105 61860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:30:22.043441 0.231914 tcp 10.0.2.105 61861 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:30:22.275873 0.058234 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/13 10:30:31.562071 3.001126 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 10:30:38.570629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:30:46.569225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:31:02.572478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:31:34.578292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:37:38.584567 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:37:45.591870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:37:53.593405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:38:09.596198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:38:41.602520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:44:45.608765 3.001376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 10:44:52.616066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:45:00.617261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:45:16.620710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:45:48.626545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:51:35.795970 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:51:35.796078 2.993528 tcp 10.0.2.105 61862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:51:44.788382 0.000000 tcp 10.0.2.105 61862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:51:50.798682 0.046100 tcp 10.0.2.105 61863 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:51:50.845098 0.047372 tcp 10.0.2.105 61864 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:51:50.892741 0.192410 tcp 10.0.2.105 61865 -> 195.113.214.249 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:51:51.372303 3.000021 tcp 10.0.2.105 61866 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:00.370959 0.000000 tcp 10.0.2.105 61866 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:06.371800 0.045862 tcp 10.0.2.105 61867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:06.417990 0.060622 tcp 10.0.2.105 61868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:06.478879 0.159075 tcp 10.0.2.105 61869 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:07.043406 3.005455 tcp 10.0.2.105 61870 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:16.043130 0.000000 tcp 10.0.2.105 61870 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:22.042649 0.044504 tcp 10.0.2.105 61871 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:22.087432 0.088264 tcp 10.0.2.105 61872 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:22.176010 0.167768 tcp 10.0.2.105 61873 -> 195.113.214.249 443 SRPA* 0 0 23 13766 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:22.387685 3.011429 tcp 10.0.2.105 61874 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:31.395510 0.000000 tcp 10.0.2.105 61874 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:37.385164 0.044823 tcp 10.0.2.105 61875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:37.430289 0.046495 tcp 10.0.2.105 61876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:37.477059 0.161201 tcp 10.0.2.105 61877 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:52:38.004462 2.994253 tcp 10.0.2.105 61878 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:46.997714 0.000000 tcp 10.0.2.105 61878 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:52:52.996479 2.994469 tcp 10.0.2.105 61879 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:53:01.988718 0.000000 tcp 10.0.2.105 61879 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:53:06.595910 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:53:07.997677 3.004947 tcp 10.0.2.105 61880 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:53:17.000903 0.000000 tcp 10.0.2.105 61880 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:53:22.999801 3.003991 tcp 10.0.2.105 61881 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:53:30.590469 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:53:32.002888 0.000000 tcp 10.0.2.105 61881 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:54:52.642214 3.000706 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 10:54:59.648960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:55:07.650197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:55:23.653102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:55:55.659884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 10:58:38.002862 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 10:58:38.003054 3.004033 tcp 10.0.2.105 61882 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:58:47.005441 0.000000 tcp 10.0.2.105 61882 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:58:53.005722 0.045300 tcp 10.0.2.105 61883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:58:53.051333 0.046452 tcp 10.0.2.105 61884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:58:53.098013 0.163108 tcp 10.0.2.105 61885 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:58:53.451606 2.997572 tcp 10.0.2.105 61886 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:02.447826 0.000000 tcp 10.0.2.105 61886 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:08.446992 0.044422 tcp 10.0.2.105 61887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:08.491737 0.046641 tcp 10.0.2.105 61888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:08.538693 0.159127 tcp 10.0.2.105 61889 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:08.889752 3.001506 tcp 10.0.2.105 61890 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:17.889619 0.000000 tcp 10.0.2.105 61890 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:23.889178 0.044361 tcp 10.0.2.105 61891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:23.933830 0.045781 tcp 10.0.2.105 61892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:23.979466 0.161579 tcp 10.0.2.105 61893 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:24.155074 2.998225 tcp 10.0.2.105 61894 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:33.152147 0.000000 tcp 10.0.2.105 61894 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:39.150617 0.044596 tcp 10.0.2.105 61895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:39.195501 0.047587 tcp 10.0.2.105 61896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:39.243406 0.159326 tcp 10.0.2.105 61897 -> 195.113.214.249 443 SRPA* 0 0 42 22726 flow=From-Botnet-V2-TCP-Established 1970/02/13 10:59:39.421569 3.003523 tcp 10.0.2.105 61898 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:48.423559 0.000000 tcp 10.0.2.105 61898 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 10:59:54.423213 3.003527 tcp 10.0.2.105 61899 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:03.425420 0.000000 tcp 10.0.2.105 61899 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:08.092032 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:00:09.424129 2.995495 tcp 10.0.2.105 61900 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:18.426843 0.000000 tcp 10.0.2.105 61900 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:24.425777 2.993818 tcp 10.0.2.105 61901 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:32.096493 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:00:33.418723 0.000000 tcp 10.0.2.105 61901 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:00:46.878108 0.000000 udp 10.0.2.105 7010 -> 31.53.219.230 1878 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 11:01:05.234843 0.044834 tcp 10.0.2.105 61902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:01:05.280034 0.047685 tcp 10.0.2.105 61903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:01:05.328007 0.156358 tcp 10.0.2.105 61904 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:01:05.484898 0.064355 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:05.549752 0.143205 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:05.693388 0.058782 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:05.752717 0.165377 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:05.918536 0.126581 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.045523 0.126060 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.172011 0.056348 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.228736 0.175751 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.404933 0.071639 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.477006 0.147554 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.624958 0.143243 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.768586 0.078991 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:06.847928 0.152025 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:07.000532 0.043427 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:07.044385 0.170850 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:07.215680 0.471825 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:07.687872 0.191157 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:07.879497 0.168672 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.048606 0.162192 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.211222 0.105573 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.317209 0.241084 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.558722 0.271894 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.831056 0.071205 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:08.902592 0.100797 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:09.003817 0.058956 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:09.063139 0.071987 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:09.135479 0.029368 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:09.165174 0.376082 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:09.541631 0.468468 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:10.010477 0.070479 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:01:59.666095 3.001177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:02:06.672610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:02:14.673857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:02:30.677559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:03:02.683326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:05:39.429260 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:05:39.429369 3.005553 tcp 10.0.2.105 61905 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:05:48.431329 0.000000 tcp 10.0.2.105 61905 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:05:54.431600 0.062421 tcp 10.0.2.105 61906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:05:54.494284 0.061314 tcp 10.0.2.105 61907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:05:54.555418 0.158565 tcp 10.0.2.105 61908 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:05:54.754787 2.999957 tcp 10.0.2.105 61909 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:03.753263 0.000000 tcp 10.0.2.105 61909 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:09.752773 0.060145 tcp 10.0.2.105 61910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:09.813200 0.063051 tcp 10.0.2.105 61911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:09.876532 0.171329 tcp 10.0.2.105 61912 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:10.621750 3.009127 tcp 10.0.2.105 61913 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:19.640664 0.000000 tcp 10.0.2.105 61913 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:25.615683 0.061579 tcp 10.0.2.105 61914 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:25.677495 0.062524 tcp 10.0.2.105 61915 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:25.739850 0.153865 tcp 10.0.2.105 61916 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:25.934779 2.995041 tcp 10.0.2.105 61917 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:34.928190 0.000000 tcp 10.0.2.105 61917 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:40.937120 0.061683 tcp 10.0.2.105 61918 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:40.999064 0.062462 tcp 10.0.2.105 61919 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:41.061858 0.155707 tcp 10.0.2.105 61920 -> 195.113.214.249 443 SRPA* 0 0 48 42020 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:06:41.350157 3.002593 tcp 10.0.2.105 61921 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:50.350225 0.000000 tcp 10.0.2.105 61921 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:06:56.352820 3.000496 tcp 10.0.2.105 61922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:07:05.351877 0.000000 tcp 10.0.2.105 61922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:07:10.094694 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:07:11.353446 3.006235 tcp 10.0.2.105 61923 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:07:20.356539 0.000000 tcp 10.0.2.105 61923 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:07:26.352187 3.004215 tcp 10.0.2.105 61924 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:07:34.093358 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:07:35.354924 0.000000 tcp 10.0.2.105 61924 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:09:06.689258 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:09:13.697187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:09:21.697914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:09:37.701165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:10:09.707142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:12:41.355566 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:12:41.355767 2.993415 tcp 10.0.2.105 61925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:12:50.347904 0.000000 tcp 10.0.2.105 61925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:12:56.358503 0.064124 tcp 10.0.2.105 61926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:12:56.422924 0.066664 tcp 10.0.2.105 61927 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:12:56.489907 0.159716 tcp 10.0.2.105 61928 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:12:56.711858 2.999594 tcp 10.0.2.105 61929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:05.709979 0.000000 tcp 10.0.2.105 61929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:11.709655 0.065864 tcp 10.0.2.105 61930 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:11.775826 0.062850 tcp 10.0.2.105 61931 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:11.839008 0.154528 tcp 10.0.2.105 61932 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:12.151043 3.004726 tcp 10.0.2.105 61933 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:21.152345 0.000000 tcp 10.0.2.105 61933 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:27.151467 0.059896 tcp 10.0.2.105 61934 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:27.211661 0.061623 tcp 10.0.2.105 61935 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:27.273649 0.160150 tcp 10.0.2.105 61936 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:27.561660 3.004249 tcp 10.0.2.105 61937 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:36.564633 0.000000 tcp 10.0.2.105 61937 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:42.760797 0.064173 tcp 10.0.2.105 61938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:42.825226 0.065321 tcp 10.0.2.105 61939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:42.890887 0.154748 tcp 10.0.2.105 61940 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:13:43.067596 2.976849 tcp 10.0.2.105 61941 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:51.994930 0.000000 tcp 10.0.2.105 61941 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:13:57.916147 2.962262 tcp 10.0.2.105 61942 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:14:06.858213 0.000000 tcp 10.0.2.105 61942 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:14:11.595435 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:14:12.866787 2.993885 tcp 10.0.2.105 61943 -> 128.255.183.224 9027 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:14:21.859492 0.000000 tcp 10.0.2.105 61943 -> 128.255.183.224 9027 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:14:27.868685 3.003849 tcp 10.0.2.105 61944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:14:35.589175 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:14:36.871213 0.000000 tcp 10.0.2.105 61944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:16:13.712491 3.002365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:16:20.720694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:16:28.722035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:16:44.725024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:17:16.731063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:23:20.743884 2.997026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 11:23:27.744225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:23:35.746018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:23:51.754657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:24:23.755146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:30:27.760800 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 11:30:34.768541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:30:42.769871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:30:58.772940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:31:26.463095 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:31:26.463209 0.075414 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:26.525183 0.186384 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:26.879680 0.084543 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:26.971036 0.177032 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.117758 0.128054 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.385273 0.110387 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.475691 0.076918 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.678950 0.175939 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.848725 0.081235 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:27.944623 2.994480 tcp 10.0.2.105 61945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:31:27.968831 0.172877 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:28.244879 0.168568 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:28.392514 0.112551 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:28.473521 0.176461 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:28.732979 0.068437 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:28.940992 0.176481 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:29.114294 0.268396 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:29.349954 0.169601 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:29.641609 0.124903 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:29.748096 0.231495 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:30.381296 0.215200 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:30.634869 0.177517 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:30.778442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:31:30.804764 0.085685 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:31.338877 0.055362 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:31.530684 0.098089 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:31.762846 0.359625 udp 10.0.2.105 7010 <-> 2.27.34.34 4751 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:32.122920 0.060573 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:32.225280 0.046710 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:32.256876 0.392378 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:32.629514 0.395817 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/13 11:31:32.998191 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 11:31:36.937771 0.000000 tcp 10.0.2.105 61945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:31:42.948519 0.063029 tcp 10.0.2.105 61946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:43.011828 0.065765 tcp 10.0.2.105 61947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:43.077868 0.163355 tcp 10.0.2.105 61948 -> 195.113.214.249 443 SRPA* 0 0 24 10458 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:43.286653 2.994731 tcp 10.0.2.105 61949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:31:48.083986 0.064747 tcp 10.0.2.105 61950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:48.149006 0.068200 tcp 10.0.2.105 61951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:48.217521 0.157316 tcp 10.0.2.105 61952 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:52.279589 0.000000 tcp 10.0.2.105 61949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:31:58.279218 0.064164 tcp 10.0.2.105 61953 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:58.343666 0.061624 tcp 10.0.2.105 61954 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:58.405601 0.152613 tcp 10.0.2.105 61955 -> 195.113.214.249 443 SRPA* 0 0 19 9796 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:31:58.622255 3.000926 tcp 10.0.2.105 61956 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:32:07.651919 0.000000 tcp 10.0.2.105 61956 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:32:13.620688 3.003914 tcp 10.0.2.105 61957 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:32:23.062219 0.000000 tcp 10.0.2.105 61957 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:32:27.966016 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:37:28.624034 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:37:28.624368 2.998760 tcp 10.0.2.105 61958 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:37:34.785525 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:37:37.626222 0.000000 tcp 10.0.2.105 61958 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:37:41.792480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:37:43.626464 0.068650 tcp 10.0.2.105 61959 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:43.695408 0.061743 tcp 10.0.2.105 61960 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:43.757440 0.159499 tcp 10.0.2.105 61961 -> 195.113.214.249 443 SRPA* 0 0 25 14108 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:44.104555 2.995552 tcp 10.0.2.105 61962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:37:49.793791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:37:53.098889 0.000000 tcp 10.0.2.105 61962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:37:59.099799 0.059863 tcp 10.0.2.105 61963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:59.159968 0.064201 tcp 10.0.2.105 61964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:59.224602 0.153691 tcp 10.0.2.105 61965 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:37:59.635967 2.996107 tcp 10.0.2.105 61966 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:05.800066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:38:08.630915 0.000000 tcp 10.0.2.105 61966 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:14.630261 0.061681 tcp 10.0.2.105 61967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:38:14.692405 0.064767 tcp 10.0.2.105 61968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:38:14.757497 0.155266 tcp 10.0.2.105 61969 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:38:15.127132 2.997440 tcp 10.0.2.105 61970 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:24.123249 0.000000 tcp 10.0.2.105 61970 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:30.121889 3.004350 tcp 10.0.2.105 61971 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:37.802967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:38:39.124917 0.000000 tcp 10.0.2.105 61971 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:44.091747 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:38:45.123792 2.993682 tcp 10.0.2.105 61972 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:38:54.126636 0.000000 tcp 10.0.2.105 61972 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:00.126969 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:44:00.127072 2.994050 tcp 10.0.2.105 61973 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:09.118940 0.000000 tcp 10.0.2.105 61973 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:15.129829 0.068289 tcp 10.0.2.105 61974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:15.198410 0.063393 tcp 10.0.2.105 61975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:15.262104 0.160564 tcp 10.0.2.105 61976 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:15.475891 2.996539 tcp 10.0.2.105 61977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:24.471088 0.000000 tcp 10.0.2.105 61977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:30.470582 0.066580 tcp 10.0.2.105 61978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:30.537456 0.061978 tcp 10.0.2.105 61979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:30.599733 0.162690 tcp 10.0.2.105 61980 -> 195.113.214.249 443 SRPA* 0 0 32 17990 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:30.790340 3.004278 tcp 10.0.2.105 61981 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:39.793345 0.000000 tcp 10.0.2.105 61981 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:41.808409 3.002050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:44:45.792574 0.061456 tcp 10.0.2.105 61982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:45.854294 0.065743 tcp 10.0.2.105 61983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:45.920334 0.155861 tcp 10.0.2.105 61984 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:44:46.185624 3.001349 tcp 10.0.2.105 61985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:48.816670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:44:55.185600 0.000000 tcp 10.0.2.105 61985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:44:56.817668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:45:01.184311 2.994116 tcp 10.0.2.105 61986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:45:10.187252 0.000000 tcp 10.0.2.105 61986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:45:12.820622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:45:15.093947 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:45:16.186113 2.993790 tcp 10.0.2.105 61987 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:45:25.179203 0.000000 tcp 10.0.2.105 61987 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:45:44.826742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:50:31.189476 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:50:31.189699 3.003235 tcp 10.0.2.105 61988 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:50:40.191422 0.000000 tcp 10.0.2.105 61988 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:50:46.191713 0.065031 tcp 10.0.2.105 61989 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:50:46.256956 0.060797 tcp 10.0.2.105 61990 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:50:46.318009 0.147696 tcp 10.0.2.105 61991 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:50:46.545684 3.001336 tcp 10.0.2.105 61992 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:50:55.543927 0.000000 tcp 10.0.2.105 61992 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:01.542939 0.097157 tcp 10.0.2.105 61993 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:01.639954 0.107403 tcp 10.0.2.105 61994 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:01.747274 0.157593 tcp 10.0.2.105 61995 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:01.943034 2.994478 tcp 10.0.2.105 61996 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:10.925316 0.000000 tcp 10.0.2.105 61996 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:16.915453 0.064789 tcp 10.0.2.105 61997 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:16.980597 0.062502 tcp 10.0.2.105 61998 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:17.043419 0.173973 tcp 10.0.2.105 61999 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:51:17.343814 2.999079 tcp 10.0.2.105 62000 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:26.337806 0.000000 tcp 10.0.2.105 62000 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:32.336589 2.993927 tcp 10.0.2.105 62001 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:41.329277 0.000000 tcp 10.0.2.105 62001 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:46.096229 0.000196 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:51:47.338450 3.004030 tcp 10.0.2.105 62002 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:51:56.340975 0.000000 tcp 10.0.2.105 62002 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:54:51.836750 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 11:54:58.843177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:55:06.844993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:55:22.848107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:55:54.854003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 11:57:02.340910 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 11:57:02.341061 3.004356 tcp 10.0.2.105 62003 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:57:11.343891 0.000000 tcp 10.0.2.105 62003 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:57:17.344100 0.066467 tcp 10.0.2.105 62004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:57:17.410844 0.060386 tcp 10.0.2.105 62005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:57:17.471129 0.155123 tcp 10.0.2.105 62006 -> 195.113.214.249 443 SRPA* 0 0 51 39540 flow=From-Botnet-V2-TCP-Established 1970/02/13 11:57:17.680629 2.996716 tcp 10.0.2.105 62007 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 11:57:26.686570 0.000000 tcp 10.0.2.105 62007 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:01:58.860221 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 12:02:05.867355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:02:13.868626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:02:14.720357 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:02:14.720487 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:02:29.871817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:02:32.778205 0.066706 tcp 10.0.2.105 62008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:32.845214 0.063818 tcp 10.0.2.105 62009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:32.909340 0.150539 tcp 10.0.2.105 62010 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:33.060586 0.081926 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.122252 0.168528 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2022 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.264719 0.127265 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.401745 0.073978 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.461639 0.173922 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.628970 0.075960 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.687981 0.174714 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.860124 0.081273 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:33.932302 0.170662 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.079158 0.171868 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.228492 0.109607 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.317971 0.066945 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.372834 0.176773 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.546561 0.110359 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.624983 0.172571 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.779776 0.249082 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:34.997656 0.166941 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:35.161522 0.182136 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:35.339101 0.125792 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:35.445308 0.209489 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:35.644738 0.185486 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:35.819320 0.238517 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:36.020441 0.059993 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:02:36.082758 0.000000 udp 10.0.2.105 7010 -> 2.27.34.34 4751 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:02:47.678098 3.003542 tcp 10.0.2.105 62011 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:02:54.388064 0.064144 tcp 10.0.2.105 62012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:54.452610 0.061749 tcp 10.0.2.105 62013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:54.514599 0.166451 tcp 10.0.2.105 62014 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:02:54.681546 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:02:56.680584 0.000000 tcp 10.0.2.105 62011 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:01.878045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:03:02.679547 0.064388 tcp 10.0.2.105 62015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:02.744193 0.062673 tcp 10.0.2.105 62016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:02.807129 0.162351 tcp 10.0.2.105 62017 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:03.037214 2.996497 tcp 10.0.2.105 62018 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:10.490564 0.062178 tcp 10.0.2.105 62019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:10.553029 0.061961 tcp 10.0.2.105 62020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:10.615382 0.160994 tcp 10.0.2.105 62021 -> 195.113.214.249 443 SRPA* 0 0 40 21360 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:10.777078 0.050489 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:03:10.811732 0.098855 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:03:10.915224 0.396919 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:03:11.291045 0.367374 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:03:12.032490 0.000000 tcp 10.0.2.105 62018 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:18.031600 0.060960 tcp 10.0.2.105 62022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:18.092893 0.063348 tcp 10.0.2.105 62023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:18.156159 0.156727 tcp 10.0.2.105 62024 -> 195.113.214.249 443 SRPA* 0 0 24 14656 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:18.397079 3.008855 tcp 10.0.2.105 62025 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:27.404103 0.000000 tcp 10.0.2.105 62025 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:33.394038 0.065074 tcp 10.0.2.105 62026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:33.459401 0.060574 tcp 10.0.2.105 62027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:33.520415 0.146036 tcp 10.0.2.105 62028 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:03:33.741900 2.986369 tcp 10.0.2.105 62029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:42.736657 0.000000 tcp 10.0.2.105 62029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:48.735531 2.993709 tcp 10.0.2.105 62030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:03:57.728919 0.000000 tcp 10.0.2.105 62030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:04:02.595226 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:04:03.737232 2.994216 tcp 10.0.2.105 62031 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:04:12.729431 0.000000 tcp 10.0.2.105 62031 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:05.886687 3.001050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:09:12.891439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:09:18.740338 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:09:18.740510 3.011370 tcp 10.0.2.105 62032 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:20.892642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:09:27.742440 0.000000 tcp 10.0.2.105 62032 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:33.743109 0.084480 tcp 10.0.2.105 62033 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:33.827867 0.064491 tcp 10.0.2.105 62034 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:33.892750 0.158127 tcp 10.0.2.105 62035 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:34.491119 3.005592 tcp 10.0.2.105 62036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:36.895901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:09:43.500099 0.000000 tcp 10.0.2.105 62036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:49.486897 0.064141 tcp 10.0.2.105 62037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:49.551378 0.061319 tcp 10.0.2.105 62038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:49.613109 0.166590 tcp 10.0.2.105 62039 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:09:50.126303 2.992806 tcp 10.0.2.105 62040 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:09:59.117750 0.000000 tcp 10.0.2.105 62040 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:05.127188 0.083688 tcp 10.0.2.105 62041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:10:05.211214 0.065246 tcp 10.0.2.105 62042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:10:05.276660 0.159943 tcp 10.0.2.105 62043 -> 195.113.214.249 443 SRPA* 0 0 47 36376 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:10:05.793619 2.997974 tcp 10.0.2.105 62044 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:08.901994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:10:14.790262 0.000000 tcp 10.0.2.105 62044 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:20.790352 3.002752 tcp 10.0.2.105 62045 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:29.791791 0.000000 tcp 10.0.2.105 62045 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:34.588761 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:10:35.790615 3.004084 tcp 10.0.2.105 62046 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:10:44.793242 0.000000 tcp 10.0.2.105 62046 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:15:50.793612 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:15:50.793757 2.993687 tcp 10.0.2.105 62047 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:15:59.796554 0.000000 tcp 10.0.2.105 62047 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:05.796854 0.063195 tcp 10.0.2.105 62048 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:05.860482 0.063858 tcp 10.0.2.105 62049 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:05.924725 0.158236 tcp 10.0.2.105 62050 -> 195.113.214.249 443 SRPA* 0 0 45 24504 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:06.598195 3.002432 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:12.907500 3.002028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:16:15.598901 0.000000 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:19.915227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:16:21.603561 0.064131 tcp 10.0.2.105 62052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:21.667993 0.062293 tcp 10.0.2.105 62053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:21.730691 0.157768 tcp 10.0.2.105 62054 -> 195.113.214.249 443 SRPA* 0 0 45 38890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:22.058341 2.994428 tcp 10.0.2.105 62055 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:27.917485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:16:31.051264 0.000000 tcp 10.0.2.105 62055 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:37.050438 0.063098 tcp 10.0.2.105 62056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:37.113797 0.065129 tcp 10.0.2.105 62057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:37.179194 0.157865 tcp 10.0.2.105 62058 -> 195.113.214.249 443 SRPA* 0 0 48 42270 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:16:37.841322 3.003899 tcp 10.0.2.105 62059 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:43.919482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:16:46.843766 0.000000 tcp 10.0.2.105 62059 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:16:52.843075 3.003749 tcp 10.0.2.105 62060 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:17:01.845560 0.000000 tcp 10.0.2.105 62060 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:17:06.592558 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:17:07.844422 2.993858 tcp 10.0.2.105 62061 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:17:15.929437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:17:16.848870 0.000000 tcp 10.0.2.105 62061 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:22:22.847622 0.000183 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:22:22.847916 3.003381 tcp 10.0.2.105 62062 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:22:31.849815 0.000000 tcp 10.0.2.105 62062 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:22:37.850594 0.061534 tcp 10.0.2.105 62063 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:37.912617 0.061709 tcp 10.0.2.105 62064 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:37.974579 0.154866 tcp 10.0.2.105 62065 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:38.150503 3.003023 tcp 10.0.2.105 62066 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:22:47.151882 0.000000 tcp 10.0.2.105 62066 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:22:53.151222 0.060828 tcp 10.0.2.105 62067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:53.212448 0.060018 tcp 10.0.2.105 62068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:53.272766 0.153756 tcp 10.0.2.105 62069 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:22:53.629386 3.013225 tcp 10.0.2.105 62070 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:02.634507 0.000000 tcp 10.0.2.105 62070 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:08.623268 0.062935 tcp 10.0.2.105 62071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:23:08.686547 0.065901 tcp 10.0.2.105 62072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:23:08.752717 0.155016 tcp 10.0.2.105 62073 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:23:09.099351 2.998386 tcp 10.0.2.105 62074 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:18.106618 0.000000 tcp 10.0.2.105 62074 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:19.931355 3.002056 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:23:24.095468 2.994008 tcp 10.0.2.105 62075 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:26.939495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:23:33.087958 0.000000 tcp 10.0.2.105 62075 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:34.940510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:23:38.095296 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:23:39.096902 2.994141 tcp 10.0.2.105 62076 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:48.089566 0.000000 tcp 10.0.2.105 62076 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:23:50.943544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:24:22.950003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:30:26.956696 3.000618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 12:30:33.963267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:30:41.964789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:30:57.967644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:31:29.983628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:33:29.305730 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:33:29.305904 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:33:44.464579 0.219795 tcp 10.0.2.105 62077 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:33:44.730183 0.065301 tcp 10.0.2.105 62078 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:33:44.795738 0.154293 tcp 10.0.2.105 62079 -> 195.113.214.249 443 SRPA* 0 0 22 12874 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:33:44.950562 0.000000 udp 10.0.2.105 7010 -> 2.27.34.34 4751 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:34:00.270661 0.060606 tcp 10.0.2.105 62080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:00.331626 0.063552 tcp 10.0.2.105 62081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:00.395521 0.155087 tcp 10.0.2.105 62082 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:00.551116 0.128901 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:00.700642 0.075427 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:00.758225 0.173314 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:00.924333 0.098771 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.004552 0.177407 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.152400 0.081149 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.289589 0.175689 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.479734 0.170560 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.628678 0.140192 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:01.747020 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:34:09.133463 3.003527 tcp 10.0.2.105 62083 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:17.134495 0.061535 tcp 10.0.2.105 62084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:17.196339 0.064948 tcp 10.0.2.105 62085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:17.261559 0.156714 tcp 10.0.2.105 62086 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:17.418799 0.174064 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:17.589032 0.113634 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:17.704115 0.173205 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:17.966637 0.256933 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:18.135596 0.000000 tcp 10.0.2.105 62083 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:18.186917 0.166096 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:18.422948 0.181914 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:18.600783 0.124892 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:18.985661 0.206976 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:19.183490 0.245521 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:19.554687 0.052364 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:19.846180 0.185103 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:20.023279 0.055036 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:20.109219 0.534015 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2557 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:20.602910 0.063026 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:20.677130 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 12:34:24.134515 0.063313 tcp 10.0.2.105 62087 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:24.197737 0.060882 tcp 10.0.2.105 62088 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:24.258996 0.156131 tcp 10.0.2.105 62089 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:24.535239 2.993652 tcp 10.0.2.105 62090 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:33.527626 0.000000 tcp 10.0.2.105 62090 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:37.834611 0.060230 tcp 10.0.2.105 62091 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:37.895134 0.063335 tcp 10.0.2.105 62092 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:37.958788 0.159739 tcp 10.0.2.105 62093 -> 195.113.214.249 443 SRPA* 0 0 23 13140 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:38.119216 0.390937 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:38.489432 0.368943 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/13 12:34:39.536621 0.062213 tcp 10.0.2.105 62094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:39.599122 0.062178 tcp 10.0.2.105 62095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:39.661230 0.153264 tcp 10.0.2.105 62096 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:40.104517 2.997298 tcp 10.0.2.105 62097 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:49.100048 0.000000 tcp 10.0.2.105 62097 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:34:55.099366 0.061878 tcp 10.0.2.105 62098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:55.161477 0.065947 tcp 10.0.2.105 62099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:55.227711 0.157718 tcp 10.0.2.105 62100 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:34:55.459199 3.004165 tcp 10.0.2.105 62101 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:35:04.462353 0.000000 tcp 10.0.2.105 62101 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:35:10.460961 3.004123 tcp 10.0.2.105 62102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:35:19.463523 0.000000 tcp 10.0.2.105 62102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:35:24.089861 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:35:25.463243 3.004107 tcp 10.0.2.105 62103 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:35:34.465366 0.000000 tcp 10.0.2.105 62103 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:37:33.990100 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:37:40.997190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:37:48.998574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:38:05.001773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:38:37.007868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:40:40.471822 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:40:40.472003 2.988488 tcp 10.0.2.105 62104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:40:49.458249 0.000000 tcp 10.0.2.105 62104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:40:55.474070 0.062945 tcp 10.0.2.105 62105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:40:55.537274 0.065014 tcp 10.0.2.105 62106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:40:55.602586 0.152602 tcp 10.0.2.105 62107 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:40:55.835053 2.997865 tcp 10.0.2.105 62108 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:04.830046 0.000000 tcp 10.0.2.105 62108 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:10.830847 0.061523 tcp 10.0.2.105 62109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:10.892350 0.063832 tcp 10.0.2.105 62110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:10.956475 0.157685 tcp 10.0.2.105 62111 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:11.486203 2.998024 tcp 10.0.2.105 62112 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:20.482892 0.000000 tcp 10.0.2.105 62112 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:26.482112 0.059059 tcp 10.0.2.105 62113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:26.541464 0.063392 tcp 10.0.2.105 62114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:26.605193 0.158988 tcp 10.0.2.105 62115 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:41:26.900084 2.996462 tcp 10.0.2.105 62116 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:35.899132 0.000000 tcp 10.0.2.105 62116 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:41.893507 2.994322 tcp 10.0.2.105 62117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:50.896005 0.000000 tcp 10.0.2.105 62117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:41:55.593168 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:41:56.895501 2.994388 tcp 10.0.2.105 62118 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:42:05.888463 0.000000 tcp 10.0.2.105 62118 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:44:41.013520 3.001611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:44:48.020851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:44:56.023142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:45:12.025596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:45:44.031970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:47:11.898699 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:47:11.898807 3.003883 tcp 10.0.2.105 62119 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:20.902288 0.000000 tcp 10.0.2.105 62119 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:26.901577 0.064574 tcp 10.0.2.105 62120 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:26.966444 0.063995 tcp 10.0.2.105 62121 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:27.030769 0.156781 tcp 10.0.2.105 62122 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:27.368259 3.005953 tcp 10.0.2.105 62123 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:36.373519 0.000000 tcp 10.0.2.105 62123 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:42.362416 0.064850 tcp 10.0.2.105 62124 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:42.427621 0.064484 tcp 10.0.2.105 62125 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:42.492450 0.153128 tcp 10.0.2.105 62126 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:42.685564 3.001000 tcp 10.0.2.105 62127 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:51.685318 0.000000 tcp 10.0.2.105 62127 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:47:57.684549 0.061304 tcp 10.0.2.105 62128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:57.746146 0.064523 tcp 10.0.2.105 62129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:57.810982 0.163270 tcp 10.0.2.105 62130 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:47:58.112530 2.996252 tcp 10.0.2.105 62131 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:48:07.108835 0.000000 tcp 10.0.2.105 62131 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:48:13.109063 2.991180 tcp 10.0.2.105 62132 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:48:22.099103 0.000000 tcp 10.0.2.105 62132 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:48:27.096297 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:48:28.107678 3.004825 tcp 10.0.2.105 62133 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:48:37.110074 0.000000 tcp 10.0.2.105 62133 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:53:43.110918 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:53:43.111024 3.003204 tcp 10.0.2.105 62134 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:53:52.113533 0.000000 tcp 10.0.2.105 62134 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:53:58.114243 0.059982 tcp 10.0.2.105 62135 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:53:58.174504 0.063726 tcp 10.0.2.105 62136 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:53:58.238489 0.150761 tcp 10.0.2.105 62137 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:53:58.411388 3.005864 tcp 10.0.2.105 62138 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:07.415356 0.000000 tcp 10.0.2.105 62138 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:13.406786 0.061213 tcp 10.0.2.105 62139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:13.468516 0.065567 tcp 10.0.2.105 62140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:13.534384 0.151001 tcp 10.0.2.105 62141 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:13.716292 2.992783 tcp 10.0.2.105 62142 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:22.707746 0.000000 tcp 10.0.2.105 62142 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:28.716842 0.059362 tcp 10.0.2.105 62143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:28.776465 0.061632 tcp 10.0.2.105 62144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:28.838409 0.147439 tcp 10.0.2.105 62145 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 12:54:28.996576 2.993816 tcp 10.0.2.105 62146 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:37.989518 0.000000 tcp 10.0.2.105 62146 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:43.997788 3.004845 tcp 10.0.2.105 62147 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:52.041699 3.002353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 12:54:53.000937 0.000000 tcp 10.0.2.105 62147 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:57.587596 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 12:54:58.999346 3.004614 tcp 10.0.2.105 62148 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:54:59.049222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:55:07.051317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:55:08.002982 0.000000 tcp 10.0.2.105 62148 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 12:55:23.053987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 12:55:55.060172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:01:59.066738 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 13:02:06.073594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:02:14.075198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:02:30.077691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:03:02.083743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:05:02.287507 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:05:02.287634 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 13:05:19.102955 0.061333 tcp 10.0.2.105 62149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:19.164556 0.064480 tcp 10.0.2.105 62150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:19.229366 0.151983 tcp 10.0.2.105 62151 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:19.381910 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 13:05:37.739373 0.063202 tcp 10.0.2.105 62152 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:37.802918 0.064934 tcp 10.0.2.105 62153 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:37.868149 0.166487 tcp 10.0.2.105 62154 -> 195.113.214.249 443 SRPA* 0 0 32 17990 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:38.033776 0.080747 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:38.099113 0.174410 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:38.648122 0.080885 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:40.197644 0.172341 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:40.733519 0.073105 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:40.789437 0.127526 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:41.395722 0.167656 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:43.079386 0.108090 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:43.608338 0.173333 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:44.269615 3.002073 tcp 10.0.2.105 62155 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:05:44.332908 0.172813 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:44.494674 0.254322 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:44.713150 0.105977 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:46.551573 0.172658 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:47.436590 0.215022 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:48.238387 0.219765 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:48.449718 0.181870 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:50.511684 0.124306 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:50.957537 0.180177 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:51.130158 0.059965 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:51.195751 0.052689 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:52.509560 0.175667 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:52.681326 0.045367 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:53.270277 0.000000 tcp 10.0.2.105 62155 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:05:53.808625 0.755884 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:54.524309 0.385886 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:54.891026 0.366272 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:05:59.269860 0.061761 tcp 10.0.2.105 62156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:59.331877 0.062954 tcp 10.0.2.105 62157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:59.395171 0.160758 tcp 10.0.2.105 62158 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:05:59.698377 3.005647 tcp 10.0.2.105 62159 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:08.702792 0.000000 tcp 10.0.2.105 62159 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:14.759204 0.059811 tcp 10.0.2.105 62160 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:14.819308 0.061361 tcp 10.0.2.105 62161 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:14.880971 0.152353 tcp 10.0.2.105 62162 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:15.268474 2.978593 tcp 10.0.2.105 62163 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:24.204674 0.000000 tcp 10.0.2.105 62163 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:30.204037 0.060081 tcp 10.0.2.105 62164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:30.264454 0.060887 tcp 10.0.2.105 62165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:30.325669 0.182008 tcp 10.0.2.105 62166 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:06:30.591806 2.996536 tcp 10.0.2.105 62167 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:39.597509 0.000000 tcp 10.0.2.105 62167 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:47.740055 2.954867 tcp 10.0.2.105 62168 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:06:56.621857 0.000000 tcp 10.0.2.105 62168 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:07:01.082158 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:07:02.563441 2.969610 tcp 10.0.2.105 62169 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:07:11.462152 0.000000 tcp 10.0.2.105 62169 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:09:06.549117 2.962377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:09:13.472098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:09:21.375656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:09:37.182670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:10:09.423269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:12:15.590443 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:12:15.590580 3.003513 tcp 10.0.2.105 62170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:12:24.595005 0.000000 tcp 10.0.2.105 62170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:12:30.593533 0.061954 tcp 10.0.2.105 62171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:30.655785 0.060401 tcp 10.0.2.105 62172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:30.716531 0.154623 tcp 10.0.2.105 62173 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:30.898837 3.007623 tcp 10.0.2.105 62174 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:12:39.905165 0.000000 tcp 10.0.2.105 62174 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:12:45.894259 0.063613 tcp 10.0.2.105 62175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:45.958170 0.061311 tcp 10.0.2.105 62176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:46.019784 0.151698 tcp 10.0.2.105 62177 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:12:46.265412 2.993346 tcp 10.0.2.105 62178 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:12:55.267057 0.000000 tcp 10.0.2.105 62178 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:01.266805 0.061224 tcp 10.0.2.105 62179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:13:01.328315 0.060545 tcp 10.0.2.105 62180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:13:01.389146 0.151442 tcp 10.0.2.105 62181 -> 195.113.214.249 443 SRPA* 0 0 37 26778 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:13:01.586492 2.993748 tcp 10.0.2.105 62182 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:10.579126 0.000000 tcp 10.0.2.105 62182 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:16.587721 3.004365 tcp 10.0.2.105 62183 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:25.590659 0.000000 tcp 10.0.2.105 62183 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:30.587802 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:13:31.589500 3.004121 tcp 10.0.2.105 62184 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:13:40.592140 0.000000 tcp 10.0.2.105 62184 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:16:13.123742 3.009008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:16:20.131898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:16:28.133329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:16:44.136063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:17:16.141993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:18:46.593370 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:18:46.593505 3.003309 tcp 10.0.2.105 62185 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:18:55.595000 0.000000 tcp 10.0.2.105 62185 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:01.595219 0.061526 tcp 10.0.2.105 62186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:01.657009 0.060596 tcp 10.0.2.105 62187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:01.717881 0.149726 tcp 10.0.2.105 62188 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:01.973963 2.984950 tcp 10.0.2.105 62189 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:10.966767 0.000000 tcp 10.0.2.105 62189 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:16.975986 0.064512 tcp 10.0.2.105 62190 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:17.040747 0.064994 tcp 10.0.2.105 62191 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:17.106092 0.153429 tcp 10.0.2.105 62192 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:17.501607 2.999621 tcp 10.0.2.105 62193 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:26.499545 0.000000 tcp 10.0.2.105 62193 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:32.498848 0.060089 tcp 10.0.2.105 62194 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:32.559215 0.061261 tcp 10.0.2.105 62195 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:32.620772 0.152570 tcp 10.0.2.105 62196 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:19:32.825956 2.996942 tcp 10.0.2.105 62197 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:41.821726 0.000000 tcp 10.0.2.105 62197 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:47.820136 3.005081 tcp 10.0.2.105 62198 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:19:56.822981 0.000000 tcp 10.0.2.105 62198 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:20:01.589886 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:20:02.821906 3.004036 tcp 10.0.2.105 62199 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:20:11.824751 0.000000 tcp 10.0.2.105 62199 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:23:20.148357 3.001295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:23:27.158968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:23:35.157350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:23:51.160033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:24:23.166383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:25:17.825119 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:25:17.825298 2.993460 tcp 10.0.2.105 62200 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:25:26.819213 0.000000 tcp 10.0.2.105 62200 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:25:32.827673 0.059958 tcp 10.0.2.105 62201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:32.887870 0.064153 tcp 10.0.2.105 62202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:32.952418 0.156492 tcp 10.0.2.105 62203 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:33.222742 2.998354 tcp 10.0.2.105 62204 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:25:42.219371 0.000000 tcp 10.0.2.105 62204 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:25:48.218454 0.060434 tcp 10.0.2.105 62205 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:48.278803 0.062577 tcp 10.0.2.105 62206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:48.341682 0.152695 tcp 10.0.2.105 62207 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:25:48.721243 3.339400 tcp 10.0.2.105 62208 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:25:57.996969 0.000000 tcp 10.0.2.105 62208 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:03.947474 0.061516 tcp 10.0.2.105 62209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:26:04.009240 0.062385 tcp 10.0.2.105 62210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:26:04.071954 0.152720 tcp 10.0.2.105 62211 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:26:04.786908 2.978837 tcp 10.0.2.105 62212 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:13.707720 0.000000 tcp 10.0.2.105 62212 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:19.647310 2.966425 tcp 10.0.2.105 62213 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:28.586487 0.000000 tcp 10.0.2.105 62213 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:33.092968 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:26:34.589068 2.991964 tcp 10.0.2.105 62214 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:26:43.577850 0.000000 tcp 10.0.2.105 62214 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:30:27.172036 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:30:34.179524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:30:42.181207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:30:58.188977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:31:30.190914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:36:11.003991 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:36:11.004168 0.073558 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:11.060941 0.171900 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:11.344587 0.068905 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:11.399618 0.089552 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2602 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:11.897189 0.173204 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:12.062433 0.129828 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:12.322563 0.170380 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:12.471731 0.129277 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1659 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:12.625947 0.254240 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:12.846035 0.172581 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:13.355918 0.173945 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:13.503624 0.115299 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:13.583373 0.173045 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:13.752870 0.216415 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:13.959378 0.174353 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:14.130797 0.220173 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:14.391579 0.124531 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:14.496753 0.187879 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:14.677731 0.057261 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:14.949456 0.084737 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:15.124906 0.174594 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:15.296254 0.045138 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:15.939487 0.351711 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:16.252805 0.389029 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:16.621208 0.354422 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/13 13:36:19.616774 2.993938 tcp 10.0.2.105 62215 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:36:28.609076 0.000000 tcp 10.0.2.105 62215 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:36:34.619620 0.060991 tcp 10.0.2.105 62216 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:34.680861 0.060744 tcp 10.0.2.105 62217 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:34.741915 0.130195 tcp 10.0.2.105 62218 -> 195.113.214.249 443 SRPA* 0 0 36 26926 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:34.887122 2.995349 tcp 10.0.2.105 62219 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:36:43.881288 0.000000 tcp 10.0.2.105 62219 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:36:49.880243 0.064581 tcp 10.0.2.105 62220 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:49.945078 0.068730 tcp 10.0.2.105 62221 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:50.014116 0.147759 tcp 10.0.2.105 62222 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:36:50.199018 3.005144 tcp 10.0.2.105 62223 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:36:59.203173 0.000000 tcp 10.0.2.105 62223 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:05.192339 0.063960 tcp 10.0.2.105 62224 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:37:05.256635 0.064127 tcp 10.0.2.105 62225 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:37:05.321020 0.157003 tcp 10.0.2.105 62226 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:37:05.591483 2.995293 tcp 10.0.2.105 62227 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:14.585714 0.000000 tcp 10.0.2.105 62227 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:20.583937 2.994219 tcp 10.0.2.105 62228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:29.586967 0.000000 tcp 10.0.2.105 62228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:34.195938 3.001988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:37:34.593840 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:37:35.585911 2.993811 tcp 10.0.2.105 62229 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:41.203433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:37:44.578710 0.000000 tcp 10.0.2.105 62229 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:37:49.204990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:38:05.208040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:38:37.214106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:42:50.588818 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:42:50.589044 3.003614 tcp 10.0.2.105 62230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:42:59.591660 0.000000 tcp 10.0.2.105 62230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:05.595080 0.063430 tcp 10.0.2.105 62231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:05.658823 0.062720 tcp 10.0.2.105 62232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:05.721906 0.153286 tcp 10.0.2.105 62233 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:06.032722 3.002115 tcp 10.0.2.105 62234 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:15.033375 0.000000 tcp 10.0.2.105 62234 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:21.032929 0.062200 tcp 10.0.2.105 62235 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:21.095436 0.061355 tcp 10.0.2.105 62236 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:21.157103 0.152089 tcp 10.0.2.105 62237 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:21.455899 3.001217 tcp 10.0.2.105 62238 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:30.455433 0.000000 tcp 10.0.2.105 62238 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:36.454816 0.066435 tcp 10.0.2.105 62239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:36.521539 0.065073 tcp 10.0.2.105 62240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:36.586902 0.155499 tcp 10.0.2.105 62241 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:43:36.759925 2.999040 tcp 10.0.2.105 62242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:45.757702 0.000000 tcp 10.0.2.105 62242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:43:51.756551 2.994028 tcp 10.0.2.105 62243 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:44:00.749190 0.000000 tcp 10.0.2.105 62243 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:44:05.586319 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:44:06.758136 3.003834 tcp 10.0.2.105 62244 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:44:15.760990 0.000000 tcp 10.0.2.105 62244 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:44:41.219918 3.001952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:44:48.227511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:44:56.228950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:45:12.231900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:45:44.237995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:49:21.767373 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:49:21.767578 2.997616 tcp 10.0.2.105 62245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:49:30.768506 0.000000 tcp 10.0.2.105 62245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:49:36.772604 0.066156 tcp 10.0.2.105 62246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:36.839059 0.061350 tcp 10.0.2.105 62247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:36.900666 0.150331 tcp 10.0.2.105 62248 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:37.191709 2.995665 tcp 10.0.2.105 62249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:49:46.201417 0.000000 tcp 10.0.2.105 62249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:49:52.185063 0.060747 tcp 10.0.2.105 62250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:52.246101 0.116462 tcp 10.0.2.105 62251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:52.362377 0.159422 tcp 10.0.2.105 62252 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:49:52.573479 2.995744 tcp 10.0.2.105 62253 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:01.567862 0.000000 tcp 10.0.2.105 62253 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:07.567810 0.061670 tcp 10.0.2.105 62254 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:50:07.629413 0.061889 tcp 10.0.2.105 62255 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:50:07.691588 0.162445 tcp 10.0.2.105 62256 -> 195.113.214.249 443 SRPA* 0 0 23 13802 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:50:07.901532 3.006483 tcp 10.0.2.105 62257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:16.900024 0.000000 tcp 10.0.2.105 62257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:22.898888 3.004215 tcp 10.0.2.105 62258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:31.901444 0.000000 tcp 10.0.2.105 62258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:36.588133 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:50:37.900099 3.004322 tcp 10.0.2.105 62259 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:50:46.903139 0.000000 tcp 10.0.2.105 62259 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:54:52.248524 3.002213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 13:54:59.256887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:55:07.257868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:55:23.261232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:55:52.903584 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:55:52.903752 2.992990 tcp 10.0.2.105 62260 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:55:55.266895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 13:56:01.906086 0.000000 tcp 10.0.2.105 62260 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:07.906524 0.060643 tcp 10.0.2.105 62261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:07.967476 0.061473 tcp 10.0.2.105 62262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:08.029230 0.152278 tcp 10.0.2.105 62263 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:08.245851 2.993556 tcp 10.0.2.105 62264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:17.237946 0.000000 tcp 10.0.2.105 62264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:23.247204 0.059972 tcp 10.0.2.105 62265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:23.307593 0.062763 tcp 10.0.2.105 62266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:23.370669 0.156143 tcp 10.0.2.105 62267 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:23.536687 2.994780 tcp 10.0.2.105 62268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:32.530120 0.000000 tcp 10.0.2.105 62268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:38.529358 0.061597 tcp 10.0.2.105 62269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:38.591293 0.064123 tcp 10.0.2.105 62270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:38.655710 0.150305 tcp 10.0.2.105 62271 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/13 13:56:38.815302 2.997964 tcp 10.0.2.105 62272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:47.812400 0.000000 tcp 10.0.2.105 62272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:56:53.810803 3.004025 tcp 10.0.2.105 62273 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:57:02.813624 0.000000 tcp 10.0.2.105 62273 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:57:07.590419 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 13:57:08.812563 3.003893 tcp 10.0.2.105 62274 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 13:57:17.815192 0.000000 tcp 10.0.2.105 62274 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:01:59.272563 3.001734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:02:06.279921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:02:14.281408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:02:30.284567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:03:02.290400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:06:34.766416 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:06:34.766527 0.073114 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:34.825803 0.075089 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:34.953712 0.173270 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:35.628629 0.082645 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:35.701440 0.172569 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:36.234060 0.128787 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:36.440500 0.245659 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:36.653635 0.171994 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:36.854324 0.172618 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:37.003896 0.134330 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:37.116147 0.178009 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:37.452752 0.111976 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:37.528991 0.173712 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:37.699947 0.247187 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:38.074610 0.173261 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:38.245308 0.241372 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:38.481975 0.125497 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:38.588810 0.185387 udp 10.0.2.105 7010 <-> 207.161.107.110 2451 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:38.927823 3.008469 tcp 10.0.2.105 62275 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:06:38.938437 0.055190 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:39.159604 0.051894 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:39.650084 0.176224 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:39.846424 0.047630 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:39.877966 0.479504 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:40.318182 0.397821 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:40.693424 0.494082 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:06:47.934964 0.000000 tcp 10.0.2.105 62275 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:06:53.925183 0.062894 tcp 10.0.2.105 62276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:06:53.988345 0.060880 tcp 10.0.2.105 62277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:06:54.049581 0.156788 tcp 10.0.2.105 62278 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:06:54.309051 2.989285 tcp 10.0.2.105 62279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:03.306806 0.000000 tcp 10.0.2.105 62279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:09.306056 0.060021 tcp 10.0.2.105 62280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:09.366431 0.059622 tcp 10.0.2.105 62281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:09.426357 0.155766 tcp 10.0.2.105 62282 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:09.646671 2.993967 tcp 10.0.2.105 62283 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:18.639169 0.000000 tcp 10.0.2.105 62283 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:24.649904 0.060070 tcp 10.0.2.105 62284 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:24.710250 0.066128 tcp 10.0.2.105 62285 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:24.776735 0.163420 tcp 10.0.2.105 62286 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:07:25.095724 2.996917 tcp 10.0.2.105 62287 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:34.091068 0.000000 tcp 10.0.2.105 62287 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:40.089615 3.004570 tcp 10.0.2.105 62288 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:49.093103 0.000000 tcp 10.0.2.105 62288 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:07:54.089883 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:07:55.091578 3.004187 tcp 10.0.2.105 62289 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:08:04.094517 0.000000 tcp 10.0.2.105 62289 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:09:06.296208 3.001764 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:09:13.306744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:09:21.307851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:09:37.308518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:10:09.314376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:13:10.095096 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:13:10.095203 2.993377 tcp 10.0.2.105 62290 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:19.097244 0.000000 tcp 10.0.2.105 62290 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:25.098133 0.063621 tcp 10.0.2.105 62291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:25.162033 0.337795 tcp 10.0.2.105 62292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:25.500142 0.151856 tcp 10.0.2.105 62293 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:26.014519 2.996998 tcp 10.0.2.105 62294 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:35.010188 0.000000 tcp 10.0.2.105 62294 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:41.009763 0.061074 tcp 10.0.2.105 62295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:41.071154 0.062630 tcp 10.0.2.105 62296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:41.134115 0.157626 tcp 10.0.2.105 62297 -> 195.113.214.249 443 SRPA* 0 0 31 16516 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:42.074839 2.999751 tcp 10.0.2.105 62298 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:51.073429 0.000000 tcp 10.0.2.105 62298 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:13:57.072483 0.063498 tcp 10.0.2.105 62299 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:57.136397 0.062597 tcp 10.0.2.105 62300 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:57.199281 0.155901 tcp 10.0.2.105 62301 -> 195.113.214.249 443 SRPA* 0 0 32 17786 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:13:57.453325 3.003398 tcp 10.0.2.105 62302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:14:06.455726 0.000000 tcp 10.0.2.105 62302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:14:12.454248 2.994135 tcp 10.0.2.105 62303 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:14:21.457071 0.000000 tcp 10.0.2.105 62303 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:14:26.093558 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:14:27.455842 2.994132 tcp 10.0.2.105 62304 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:14:36.448481 0.000000 tcp 10.0.2.105 62304 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:16:13.320651 3.001443 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:16:20.328609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:16:28.329397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:16:44.335206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:17:16.338315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:19:42.459406 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:19:42.459746 3.005533 tcp 10.0.2.105 62305 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:19:51.464483 0.000000 tcp 10.0.2.105 62305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:19:57.461803 0.063682 tcp 10.0.2.105 62306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:19:57.525799 0.063479 tcp 10.0.2.105 62307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:19:57.589539 0.150980 tcp 10.0.2.105 62308 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:19:58.178226 3.007167 tcp 10.0.2.105 62309 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:07.183821 0.000000 tcp 10.0.2.105 62309 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:13.173408 0.062845 tcp 10.0.2.105 62310 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:13.236515 0.059658 tcp 10.0.2.105 62311 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:13.296475 0.149926 tcp 10.0.2.105 62312 -> 195.113.214.249 443 SRPA* 0 0 46 20884 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:13.787293 3.000095 tcp 10.0.2.105 62313 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:22.796497 0.000000 tcp 10.0.2.105 62313 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:28.785498 0.063039 tcp 10.0.2.105 62314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:28.848875 0.063051 tcp 10.0.2.105 62315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:28.912416 0.148806 tcp 10.0.2.105 62316 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:20:29.538693 3.001614 tcp 10.0.2.105 62317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:38.539182 0.000000 tcp 10.0.2.105 62317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:44.538037 3.003920 tcp 10.0.2.105 62318 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:53.540603 0.000000 tcp 10.0.2.105 62318 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:20:58.087272 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:20:59.539455 3.004055 tcp 10.0.2.105 62319 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:21:08.542585 0.000000 tcp 10.0.2.105 62319 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:23:20.345811 3.001891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:23:27.351877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:23:35.357632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:23:51.356647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:24:24.281830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:26:14.542528 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:26:14.542735 3.003763 tcp 10.0.2.105 62320 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:26:23.545176 0.000000 tcp 10.0.2.105 62320 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:26:29.545856 0.060913 tcp 10.0.2.105 62321 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:29.607041 0.065131 tcp 10.0.2.105 62322 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:29.672468 0.152508 tcp 10.0.2.105 62323 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:30.427541 3.001678 tcp 10.0.2.105 62324 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:26:39.428142 0.000000 tcp 10.0.2.105 62324 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:26:45.427454 0.060151 tcp 10.0.2.105 62325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:45.487903 0.060615 tcp 10.0.2.105 62326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:45.548831 0.152102 tcp 10.0.2.105 62327 -> 195.113.214.249 443 SRPA* 0 0 42 21506 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:26:46.159046 3.004079 tcp 10.0.2.105 62328 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:26:55.160644 0.000000 tcp 10.0.2.105 62328 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:01.159626 1.445017 tcp 10.0.2.105 62329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:27:02.604900 0.063219 tcp 10.0.2.105 62330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:27:02.668581 0.151649 tcp 10.0.2.105 62331 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:27:03.086056 2.969609 tcp 10.0.2.105 62332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:11.981420 0.000000 tcp 10.0.2.105 62332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:17.892234 2.972611 tcp 10.0.2.105 62333 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:26.791874 0.000000 tcp 10.0.2.105 62333 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:31.602786 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:27:32.714159 2.960965 tcp 10.0.2.105 62334 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:27:42.559659 0.000000 tcp 10.0.2.105 62334 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:30:27.378585 3.001534 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:30:34.929955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:30:42.832732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:30:58.634482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:31:30.406186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:37:03.105006 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:37:03.105177 0.070794 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:03.159612 0.073622 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:03.363721 0.177315 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:03.510904 0.086913 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:03.720930 0.172623 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:04.037933 0.127930 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:04.262384 0.325095 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:04.553134 0.109226 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 1951 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:04.751769 0.169473 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:04.896768 0.169302 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:05.046923 0.175574 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:05.309573 0.105798 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:05.629454 0.171683 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:05.796901 0.209118 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:06.124782 0.167717 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:06.289778 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 14:37:16.744994 2.993837 tcp 10.0.2.105 62335 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:37:21.482743 0.063687 tcp 10.0.2.105 62336 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:21.546769 0.061191 tcp 10.0.2.105 62337 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:21.608234 0.150737 tcp 10.0.2.105 62338 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:21.759578 0.057212 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.056844 0.183794 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.235645 0.123757 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.340594 0.054051 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.500170 0.176724 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.674112 0.047077 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:22.819955 0.451654 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:23.271959 0.394089 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:23.647133 0.579957 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/13 14:37:25.747295 0.000000 tcp 10.0.2.105 62335 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:37:31.746502 0.061608 tcp 10.0.2.105 62339 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:31.808048 0.073689 tcp 10.0.2.105 62340 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:31.882089 0.152692 tcp 10.0.2.105 62341 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:32.523831 3.228643 tcp 10.0.2.105 62342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:37:34.412655 3.228038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 14:37:41.610412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:37:41.700028 0.000000 tcp 10.0.2.105 62342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:37:47.646250 0.063556 tcp 10.0.2.105 62343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:47.710106 0.063570 tcp 10.0.2.105 62344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:47.774008 0.146479 tcp 10.0.2.105 62345 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:37:47.968007 2.978638 tcp 10.0.2.105 62346 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:37:49.535734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:37:56.885306 0.000000 tcp 10.0.2.105 62346 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:02.841230 0.063489 tcp 10.0.2.105 62347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:38:02.904993 0.061061 tcp 10.0.2.105 62348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:38:02.966382 0.156996 tcp 10.0.2.105 62349 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:38:03.232838 3.002734 tcp 10.0.2.105 62350 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:05.434338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:38:12.238861 0.000000 tcp 10.0.2.105 62350 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:18.232875 3.004187 tcp 10.0.2.105 62351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:27.235710 0.000000 tcp 10.0.2.105 62351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:32.092609 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:38:33.233845 2.995015 tcp 10.0.2.105 62352 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:38:37.440494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:38:42.237281 0.000000 tcp 10.0.2.105 62352 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:43:48.237836 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:43:48.237996 3.003365 tcp 10.0.2.105 62353 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:43:57.239772 0.000000 tcp 10.0.2.105 62353 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:03.241108 0.064134 tcp 10.0.2.105 62354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:03.305540 0.063321 tcp 10.0.2.105 62355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:03.369203 0.148797 tcp 10.0.2.105 62356 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:03.835482 2.998214 tcp 10.0.2.105 62357 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:12.832597 0.000000 tcp 10.0.2.105 62357 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:18.831735 0.060157 tcp 10.0.2.105 62358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:18.892182 0.060531 tcp 10.0.2.105 62359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:18.952986 0.154421 tcp 10.0.2.105 62360 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:19.445335 3.000849 tcp 10.0.2.105 62361 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:28.446396 0.000000 tcp 10.0.2.105 62361 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:34.443789 0.066626 tcp 10.0.2.105 62362 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:34.510710 0.061702 tcp 10.0.2.105 62363 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:34.572750 0.150598 tcp 10.0.2.105 62364 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:44:35.453696 2.995626 tcp 10.0.2.105 62365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:41.445965 3.002086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:44:44.447916 0.000000 tcp 10.0.2.105 62365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:48.453554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:44:50.446870 2.993919 tcp 10.0.2.105 62366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:44:56.455181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:44:58.087780 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:44:59.439544 0.000000 tcp 10.0.2.105 62366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:45:05.448287 3.004262 tcp 10.0.2.105 62367 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:45:12.458530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:45:14.451215 0.000000 tcp 10.0.2.105 62367 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:45:44.464550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:50:20.453517 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:50:20.453671 3.001704 tcp 10.0.2.105 62368 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:50:29.453837 0.000000 tcp 10.0.2.105 62368 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:50:35.454522 0.066278 tcp 10.0.2.105 62369 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:35.521102 0.060477 tcp 10.0.2.105 62370 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:35.581953 0.153194 tcp 10.0.2.105 62371 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:35.761793 3.005454 tcp 10.0.2.105 62372 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:50:44.775971 0.000000 tcp 10.0.2.105 62372 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:50:50.755387 0.061966 tcp 10.0.2.105 62373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:50.817639 0.064857 tcp 10.0.2.105 62374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:50.882834 0.155089 tcp 10.0.2.105 62375 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:50:51.243538 2.996081 tcp 10.0.2.105 62376 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:00.237645 0.000000 tcp 10.0.2.105 62376 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:06.243282 0.065497 tcp 10.0.2.105 62377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:51:06.309110 0.064089 tcp 10.0.2.105 62378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:51:06.373557 0.159340 tcp 10.0.2.105 62379 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:51:06.689324 2.992409 tcp 10.0.2.105 62380 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:15.681376 0.000000 tcp 10.0.2.105 62380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:21.679343 3.004135 tcp 10.0.2.105 62381 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:30.683060 0.000000 tcp 10.0.2.105 62381 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:35.589079 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:51:36.681457 3.003586 tcp 10.0.2.105 62382 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:51:45.683619 0.000000 tcp 10.0.2.105 62382 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:54:54.477486 3.002154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 14:55:01.485311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:55:09.487944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:55:25.489628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:55:57.495734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 14:56:51.684355 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:56:51.684512 2.993411 tcp 10.0.2.105 62383 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:00.686656 0.000000 tcp 10.0.2.105 62383 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:06.687633 0.062420 tcp 10.0.2.105 62384 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:06.750327 0.061505 tcp 10.0.2.105 62385 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:06.812136 0.151997 tcp 10.0.2.105 62386 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:06.996529 2.993424 tcp 10.0.2.105 62387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:15.988596 0.000000 tcp 10.0.2.105 62387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:21.997432 0.059848 tcp 10.0.2.105 62388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:22.057627 0.061930 tcp 10.0.2.105 62389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:22.119846 0.152835 tcp 10.0.2.105 62390 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:22.304749 2.997175 tcp 10.0.2.105 62391 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:31.302916 0.000000 tcp 10.0.2.105 62391 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:37.299844 0.065181 tcp 10.0.2.105 62392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:37.365298 0.061459 tcp 10.0.2.105 62393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:37.426621 0.150568 tcp 10.0.2.105 62394 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 14:57:37.589706 3.004157 tcp 10.0.2.105 62395 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:46.593037 0.000000 tcp 10.0.2.105 62395 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:57:52.593729 3.001680 tcp 10.0.2.105 62396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:58:01.601035 0.000000 tcp 10.0.2.105 62396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:58:06.591259 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 14:58:07.593596 3.007125 tcp 10.0.2.105 62397 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 14:58:16.595606 0.000000 tcp 10.0.2.105 62397 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:02:01.503102 3.000017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:02:08.509083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:02:16.510808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:02:32.513520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:03:04.519571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:07:47.627170 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:07:47.627288 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:08:03.741793 0.064299 tcp 10.0.2.105 62398 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:03.806392 0.060777 tcp 10.0.2.105 62399 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:03.867475 0.154310 tcp 10.0.2.105 62400 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:04.022355 0.069896 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:04.077146 0.082723 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:04.141904 0.174991 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:04.417665 0.127910 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:04.696172 0.189215 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:04.980970 0.081564 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.054071 0.249309 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.266845 0.167083 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.511367 0.173665 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.660348 0.169015 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.807080 0.112989 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 1985 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:05.901077 0.203241 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:06.094788 0.173682 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2587 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:06.265474 0.172975 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:06.435741 0.110929 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:06.527490 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:08:07.625816 2.993937 tcp 10.0.2.105 62401 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:16.618992 0.000000 tcp 10.0.2.105 62401 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:22.327195 0.064712 tcp 10.0.2.105 62402 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.392200 0.063946 tcp 10.0.2.105 62403 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.456596 0.150353 tcp 10.0.2.105 62404 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.607504 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:08:22.627340 0.060993 tcp 10.0.2.105 62405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.688705 0.061985 tcp 10.0.2.105 62406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.750961 0.153633 tcp 10.0.2.105 62407 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:22.941643 3.000102 tcp 10.0.2.105 62408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:31.940553 0.000000 tcp 10.0.2.105 62408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:37.939575 0.061738 tcp 10.0.2.105 62409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:38.001604 0.063170 tcp 10.0.2.105 62410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:38.065005 0.147844 tcp 10.0.2.105 62411 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:38.634855 2.999322 tcp 10.0.2.105 62412 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:40.823389 0.060933 tcp 10.0.2.105 62413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:40.884696 0.060806 tcp 10.0.2.105 62414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:40.945790 0.154916 tcp 10.0.2.105 62415 -> 195.113.214.249 443 SRPA* 0 0 40 20518 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:41.100482 0.184774 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:41.280232 0.052845 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:41.482089 0.174782 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:41.654116 0.045326 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:41.739236 0.343349 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:42.042462 0.394322 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:42.416247 0.354854 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2575 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:42.835157 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 REQ 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:08:47.633015 0.000000 tcp 10.0.2.105 62412 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:48.123314 0.233677 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 8 3113 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:48.336913 0.196893 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 8 3117 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:48.515986 0.188895 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 8 2860 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:48.690809 0.322346 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3210 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:48.983698 0.206632 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2887 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:49.181149 0.490586 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3018 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:49.638883 0.254693 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 8 2999 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:49.954245 0.346734 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3136 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:50.399127 0.230918 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 2882 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:50.609853 0.405037 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 8 2968 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:51.005102 0.326735 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 8 2893 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:51.329585 0.410101 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 8 3048 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:51.718638 0.324329 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 3214 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:52.018536 0.313152 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 2944 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:52.308606 0.331422 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2888 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:52.637629 0.165311 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 2871 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:52.769945 0.360019 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 2824 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:53.125508 0.168451 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 8 2928 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:53.289077 0.340771 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 3060 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:53.627337 0.157467 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 8 3090 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:53.632423 0.064895 tcp 10.0.2.105 62416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:53.697603 0.061913 tcp 10.0.2.105 62417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:53.759816 0.154575 tcp 10.0.2.105 62418 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:08:53.769354 0.766383 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 8 3239 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:53.939605 3.006757 tcp 10.0.2.105 62419 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:08:54.514948 0.710212 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3004 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:55.194991 0.624199 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:08:55.793440 0.000000 udp 10.0.2.105 7010 -> 217.237.180.235 9008 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:02.234070 0.000000 udp 10.0.2.105 7010 -> 50.147.54.161 7355 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:02.945270 0.000000 tcp 10.0.2.105 62419 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:09:08.525738 3.001567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:09:08.703359 0.000000 udp 10.0.2.105 7010 -> 187.162.113.149 6533 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:08.933863 2.993815 tcp 10.0.2.105 62420 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:09:15.535094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:09:15.794976 0.000000 udp 10.0.2.105 7010 -> 208.69.109.110 7998 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:17.936418 0.000000 tcp 10.0.2.105 62420 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:09:20.590252 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:09:23.534636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:09:23.775115 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:23.935272 2.994059 tcp 10.0.2.105 62421 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:09:31.235725 0.000000 udp 10.0.2.105 7010 -> 75.2.213.222 5231 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:32.928272 0.000000 tcp 10.0.2.105 62421 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:09:36.533400 0.000000 udp 10.0.2.105 7010 -> 67.139.122.122 6163 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:39.537655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:09:44.034227 0.000000 udp 10.0.2.105 7010 -> 68.200.234.68 1891 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:09:48.590674 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:09:51.995165 0.000000 udp 10.0.2.105 7010 -> 79.4.18.195 3489 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:00.948717 0.000000 udp 10.0.2.105 7010 -> 216.254.156.227 3017 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:07.878408 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:11.543648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:10:12.596797 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:10:16.793671 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:22.569623 0.000000 udp 10.0.2.105 7010 -> 86.165.116.81 6515 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:31.153508 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:38.692950 0.000000 udp 10.0.2.105 7010 -> 212.19.100.78 3165 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:43.589702 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:10:47.064958 0.000000 udp 10.0.2.105 7010 -> 41.133.213.35 3445 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:52.442759 0.368265 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 8 2972 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:10:52.838067 0.000000 udp 10.0.2.105 7010 -> 179.98.174.231 5286 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:10:58.561307 0.000000 udp 10.0.2.105 7010 -> 79.167.68.204 7641 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:06.263001 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:11.088564 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:11:14.344145 0.000000 udp 10.0.2.105 7010 -> 94.34.143.166 9141 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:20.293183 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:26.551522 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:32.570415 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:37.086424 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:11:37.827619 0.134407 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:11:38.039783 0.000000 udp 10.0.2.105 7010 -> 93.193.157.118 7662 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:45.999691 0.000000 udp 10.0.2.105 7010 -> 184.38.230.147 6778 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:52.142978 0.000000 udp 10.0.2.105 7010 -> 120.150.247.158 6336 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:11:57.205694 0.000000 udp 10.0.2.105 7010 -> 75.79.49.114 8301 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:02.092626 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:12:03.094193 0.000000 udp 10.0.2.105 7010 -> 99.116.82.65 9095 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:08.872587 0.000000 udp 10.0.2.105 7010 -> 201.148.55.181 6102 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:15.142859 0.000000 udp 10.0.2.105 7010 -> 177.15.120.18 3020 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:20.829721 0.000000 udp 10.0.2.105 7010 -> 203.59.235.88 9173 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:29.482011 0.000000 udp 10.0.2.105 7010 -> 2.177.154.17 4373 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:34.088617 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:12:37.984437 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:45.845587 0.000000 udp 10.0.2.105 7010 -> 2.121.147.253 1134 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:51.356497 0.000000 udp 10.0.2.105 7010 -> 72.38.244.178 9047 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:12:59.765722 0.000000 udp 10.0.2.105 7010 -> 173.73.23.11 5805 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:04.592653 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:13:07.757184 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:13.435297 0.000000 udp 10.0.2.105 7010 -> 5.69.145.134 7992 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:19.414630 0.000000 udp 10.0.2.105 7010 -> 85.210.7.77 9805 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:25.723071 0.000000 udp 10.0.2.105 7010 -> 90.211.204.205 2565 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:30.589736 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:13:34.415566 0.000000 udp 10.0.2.105 7010 -> 88.78.136.78 4573 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:41.586029 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:49.006757 0.000000 udp 10.0.2.105 7010 -> 82.54.103.33 1675 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:54.264409 0.000000 udp 10.0.2.105 7010 -> 108.2.175.67 7071 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:13:59.090896 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:14:02.075364 0.143582 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:14:02.299686 0.000000 udp 10.0.2.105 7010 -> 2.227.113.242 9809 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:07.483032 0.000000 udp 10.0.2.105 7010 -> 187.162.38.22 1127 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:14.523053 0.000000 udp 10.0.2.105 7010 -> 106.69.23.55 2747 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:22.584972 0.000000 udp 10.0.2.105 7010 -> 74.7.250.177 3115 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:27.090557 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:14:31.377115 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1998 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:38.938285 3.004262 tcp 10.0.2.105 62422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:14:39.999801 0.000000 udp 10.0.2.105 7010 -> 218.219.242.122 2979 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:45.968373 0.000000 udp 10.0.2.105 7010 -> 23.24.137.233 5591 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:47.940654 0.000000 tcp 10.0.2.105 62422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:14:51.126033 0.000000 udp 10.0.2.105 7010 -> 69.199.183.61 3687 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:14:52.590827 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:14:53.941438 0.065445 tcp 10.0.2.105 62423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:14:54.007173 0.062789 tcp 10.0.2.105 62424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:14:54.070228 0.150782 tcp 10.0.2.105 62425 -> 195.113.214.249 443 SRPA* 0 0 32 17990 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:14:54.395967 2.998450 tcp 10.0.2.105 62426 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:14:57.444839 0.258777 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:14:58.021325 0.000000 udp 10.0.2.105 7010 -> 88.240.99.2 5783 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:03.395120 0.000000 tcp 10.0.2.105 62426 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:04.095046 0.000000 udp 10.0.2.105 7010 -> 80.227.210.2 6120 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:09.392475 0.069202 tcp 10.0.2.105 62427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:09.461994 0.062787 tcp 10.0.2.105 62428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:09.525092 0.151811 tcp 10.0.2.105 62429 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:10.062705 0.364555 tcp 10.0.2.105 62430 -> 46.48.223.67 15494 SPA_* 0 0 9 1104 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:11.404937 0.000000 udp 10.0.2.105 7010 -> 86.30.201.23 5092 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:17.032949 0.198830 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:15:17.318751 0.180918 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:15:17.931776 0.000000 udp 10.0.2.105 7010 -> 125.255.18.94 7727 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:22.687547 0.301587 tcp 10.0.2.105 62430 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:22.688398 0.064804 tcp 10.0.2.105 62431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:22.753509 0.067229 tcp 10.0.2.105 62432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:22.821017 0.150351 tcp 10.0.2.105 62433 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:22.989374 3.006546 tcp 10.0.2.105 62434 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:26.446746 0.000000 udp 10.0.2.105 7010 -> 79.192.10.212 4600 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:31.994025 0.000000 tcp 10.0.2.105 62434 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:32.334842 0.526086 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:15:33.195837 0.000000 udp 10.0.2.105 7010 -> 108.211.212.54 3385 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:38.236982 0.063957 tcp 10.0.2.105 62435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:38.301226 0.061093 tcp 10.0.2.105 62436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:38.362705 0.147172 tcp 10.0.2.105 62437 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:15:38.750395 2.967836 tcp 10.0.2.105 62438 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:40.717181 0.217943 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:15:41.224671 0.140948 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 773 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:15:41.375866 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:46.638979 0.000000 udp 10.0.2.105 7010 -> 66.166.28.203 7822 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:15:47.670444 0.000000 tcp 10.0.2.105 62438 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:53.604174 2.963553 tcp 10.0.2.105 62439 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:15:55.159790 0.000000 udp 10.0.2.105 7010 -> 95.245.229.169 2254 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:01.151138 0.000000 udp 10.0.2.105 7010 -> 213.104.249.211 4325 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:02.510078 0.000000 tcp 10.0.2.105 62439 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:16:06.093404 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:16:08.207023 0.000000 udp 10.0.2.105 7010 -> 94.200.40.66 7209 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:08.497167 3.699448 tcp 10.0.2.105 62440 -> 46.48.223.67 15494 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:16:12.196830 2.999937 tcp 10.0.2.105 62441 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:16:15.603109 2.977804 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:16:15.769313 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:20.853840 0.000000 udp 10.0.2.105 7010 -> 72.24.124.108 5751 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:21.212345 0.000000 tcp 10.0.2.105 62441 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:16:22.566492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:16:29.697491 0.000000 udp 10.0.2.105 7010 -> 87.188.191.167 3885 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:30.558736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:16:35.846230 0.345927 udp 10.0.2.105 7010 -> 190.178.22.45 8957 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:36.192157 0.000000 icmp 190.178.22.45 0x0303 -> 10.0.2.105 0xfd22 URP 192 1 170 flow=Background 1970/02/13 15:16:40.592933 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:16:44.208321 0.000000 udp 10.0.2.105 7010 -> 94.6.255.5 4044 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:46.569077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:16:52.180937 0.000000 udp 10.0.2.105 7010 -> 87.21.5.18 3768 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:16:57.988627 0.000000 udp 10.0.2.105 7010 -> 87.18.45.254 3217 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:05.048511 0.000000 udp 10.0.2.105 7010 -> 72.16.245.225 7369 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:09.594495 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:17:11.757733 0.000000 udp 10.0.2.105 7010 -> 92.227.128.42 2544 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:18.567728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:17:19.329029 0.000000 udp 10.0.2.105 7010 -> 2.27.179.136 8335 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:25.147222 0.000000 udp 10.0.2.105 7010 -> 87.22.77.107 8311 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:30.775181 0.222112 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:17:31.423229 0.000000 udp 10.0.2.105 7010 -> 76.76.71.25 3611 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:35.591911 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:17:39.498030 0.065348 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:17:39.847812 0.000000 udp 10.0.2.105 7010 -> 99.121.104.252 9848 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:45.178831 0.000000 udp 10.0.2.105 7010 -> 108.80.244.126 3318 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:17:52.907242 0.000000 udp 10.0.2.105 7010 -> 24.146.199.108 5436 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:01.209115 0.000000 udp 10.0.2.105 7010 -> 216.106.214.14 9546 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:06.085729 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:18:08.028675 0.000000 udp 10.0.2.105 7010 -> 96.21.140.216 1783 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:14.819534 0.000000 udp 10.0.2.105 7010 -> 69.114.191.16 9669 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:22.860279 0.000000 udp 10.0.2.105 7010 -> 79.39.238.59 7473 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:30.231193 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:35.087362 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:18:35.297684 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:41.466736 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:48.036257 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5362 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:18:53.654508 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:02.306858 0.061567 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 2 812 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:19:02.493417 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:07.093602 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:19:11.260011 0.000000 udp 10.0.2.105 7010 -> 111.242.43.63 1084 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:19.741921 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:27.833642 0.079304 udp 10.0.2.105 7010 <-> 93.177.131.160 5667 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:19:27.922710 0.186450 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:19:28.482217 0.000000 udp 10.0.2.105 7010 -> 75.187.240.100 3726 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:32.590611 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:19:35.774892 0.000000 udp 10.0.2.105 7010 -> 87.195.147.110 2851 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:42.625009 0.392333 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:19:43.199006 0.000000 udp 10.0.2.105 7010 -> 109.173.135.202 9318 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:49.434683 0.000000 udp 10.0.2.105 7010 -> 109.52.205.217 5448 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:19:56.855274 0.000000 udp 10.0.2.105 7010 -> 77.31.105.146 1492 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:01.591934 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:20:03.669346 0.000000 udp 10.0.2.105 7010 -> 112.208.45.38 1050 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:09.062934 0.000000 udp 10.0.2.105 7010 -> 69.182.101.158 8191 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:16.213102 0.102355 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:20:16.831782 0.106346 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:20:17.020640 0.000000 udp 10.0.2.105 7010 -> 72.233.209.145 8448 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:24.024608 0.000000 udp 10.0.2.105 7010 -> 82.16.144.171 9353 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:28.590929 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:20:32.226257 0.000000 udp 10.0.2.105 7010 -> 41.190.244.115 9158 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:37.313519 0.000000 udp 10.0.2.105 7010 -> 31.24.139.60 3949 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:44.884349 0.000000 udp 10.0.2.105 7010 -> 213.175.34.150 7460 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:51.874455 0.000000 udp 10.0.2.105 7010 -> 91.59.64.139 5078 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:20:56.590932 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:21:00.697291 0.000000 udp 10.0.2.105 7010 -> 162.156.179.43 2458 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:21:06.555828 0.000000 udp 10.0.2.105 7010 -> 98.102.153.89 1338 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:21:14.817548 0.000000 udp 10.0.2.105 7010 -> 74.45.143.178 6675 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:21:20.725965 0.427271 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:21:21.391666 0.000000 udp 10.0.2.105 7010 -> 219.190.58.205 3542 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 15:21:25.592853 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:21:27.195775 2.993504 tcp 10.0.2.105 62442 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:21:28.156651 0.249643 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 2 766 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:21:36.188120 0.000000 tcp 10.0.2.105 62442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:21:42.198635 0.064725 tcp 10.0.2.105 62443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:42.263696 0.062078 tcp 10.0.2.105 62444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:42.326085 0.151754 tcp 10.0.2.105 62445 -> 195.113.214.249 443 SRPA* 0 0 43 34706 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:42.704485 2.999775 tcp 10.0.2.105 62446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:21:51.700416 0.000000 tcp 10.0.2.105 62446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:21:57.699469 0.062345 tcp 10.0.2.105 62447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:57.762097 0.191900 tcp 10.0.2.105 62448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:57.954376 0.155050 tcp 10.0.2.105 62449 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:21:58.342164 1.026861 tcp 10.0.2.105 62450 -> 46.48.223.67 15494 SPA_* 0 0 9 1222 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:09.051960 0.311222 tcp 10.0.2.105 62450 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:09.052995 0.061632 tcp 10.0.2.105 62451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:09.114926 0.062697 tcp 10.0.2.105 62452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:09.177963 0.154717 tcp 10.0.2.105 62453 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:09.363451 2.996314 tcp 10.0.2.105 62454 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:18.358271 0.000000 tcp 10.0.2.105 62454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:25.701494 0.061111 tcp 10.0.2.105 62455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:25.762965 0.062710 tcp 10.0.2.105 62456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:25.825923 0.153835 tcp 10.0.2.105 62457 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:22:26.172406 2.966196 tcp 10.0.2.105 62458 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:35.058837 0.000000 tcp 10.0.2.105 62458 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:40.974361 2.967525 tcp 10.0.2.105 62459 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:49.869645 0.000000 tcp 10.0.2.105 62459 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:22:54.571323 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:22:55.795789 4.373796 tcp 10.0.2.105 62460 -> 46.48.223.67 15494 FSPA* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:23:00.169851 2.958740 tcp 10.0.2.105 62461 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:23:09.447746 0.000000 tcp 10.0.2.105 62461 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:23:23.603715 2.973727 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:23:30.530822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:23:38.439659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:23:54.255178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:24:25.866355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:28:14.251062 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:28:14.251195 3.003554 tcp 10.0.2.105 62462 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:28:23.253090 0.000000 tcp 10.0.2.105 62462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:28:29.253621 0.064386 tcp 10.0.2.105 62463 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:29.318236 0.069648 tcp 10.0.2.105 62464 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:29.388147 0.203217 tcp 10.0.2.105 62465 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:29.774196 3.004542 tcp 10.0.2.105 62466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:28:38.775623 0.000000 tcp 10.0.2.105 62466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:28:44.774771 0.294436 tcp 10.0.2.105 62467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:45.069556 0.061301 tcp 10.0.2.105 62468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:45.131124 0.205113 tcp 10.0.2.105 62469 -> 195.113.214.249 443 SRPA* 0 0 25 11558 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:45.639408 0.354807 tcp 10.0.2.105 62470 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:55.028131 0.557440 tcp 10.0.2.105 62470 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:55.290317 0.062178 tcp 10.0.2.105 62471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:55.352785 0.062309 tcp 10.0.2.105 62472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:55.415469 0.147274 tcp 10.0.2.105 62473 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:28:55.585818 2.970740 tcp 10.0.2.105 62474 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:04.495470 0.000000 tcp 10.0.2.105 62474 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:10.461778 0.060441 tcp 10.0.2.105 62475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:29:10.522574 0.061924 tcp 10.0.2.105 62476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:29:10.584819 0.148814 tcp 10.0.2.105 62477 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:29:11.458448 3.008618 tcp 10.0.2.105 62478 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:20.465487 0.000000 tcp 10.0.2.105 62478 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:26.454348 2.993831 tcp 10.0.2.105 62479 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:35.457193 0.000000 tcp 10.0.2.105 62479 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:40.093641 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:29:41.456025 4.355961 tcp 10.0.2.105 62480 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:29:45.812194 3.004039 tcp 10.0.2.105 62481 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:29:54.814708 0.000000 tcp 10.0.2.105 62481 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:30:29.601099 3.203420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:30:36.778488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:30:44.706852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:31:00.622705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:31:32.625695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:35:00.815301 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:35:00.815489 2.993813 tcp 10.0.2.105 62482 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:09.807830 0.000000 tcp 10.0.2.105 62482 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:15.818155 0.061190 tcp 10.0.2.105 62483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:15.879626 0.061261 tcp 10.0.2.105 62484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:15.941163 0.152454 tcp 10.0.2.105 62485 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:16.145909 2.998110 tcp 10.0.2.105 62486 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:25.139411 0.000000 tcp 10.0.2.105 62486 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:31.138524 0.061838 tcp 10.0.2.105 62487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:31.200683 0.067613 tcp 10.0.2.105 62488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:31.268612 0.153185 tcp 10.0.2.105 62489 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:31.529735 4.640078 tcp 10.0.2.105 62490 -> 46.48.223.67 15494 FSPA* 0 0 12 1488 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:35.851289 0.061345 tcp 10.0.2.105 62491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:35.912566 0.061109 tcp 10.0.2.105 62492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:35.974023 0.155834 tcp 10.0.2.105 62493 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:35:36.170011 2.999499 tcp 10.0.2.105 62494 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:45.168191 0.000000 tcp 10.0.2.105 62494 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:35:51.167564 3.003903 tcp 10.0.2.105 62495 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:36:00.170044 0.000000 tcp 10.0.2.105 62495 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:36:05.089267 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:36:06.169059 0.378225 tcp 10.0.2.105 62496 -> 46.48.223.67 15494 SPA_* 0 0 9 1066 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:36:21.475664 0.000463 tcp 10.0.2.105 62496 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:37:36.631821 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:37:43.639145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:37:51.640472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:38:07.643404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:38:39.649499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:44:43.656381 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 15:44:50.663167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:44:58.664658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:45:14.667533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:45:46.673534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:51:31.599853 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:51:31.600025 0.075392 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:31.659618 0.123482 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:31.764113 0.073364 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:31.853613 0.350190 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.168017 0.175031 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.314359 0.082084 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.386731 0.129361 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.521555 0.174843 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.688683 0.109657 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 728 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:32.793822 0.528370 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:33.311825 0.192629 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2606 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:33.312414 3.015943 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 SPA_* 0 0 31 15373 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:33.477434 0.169093 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:33.643443 0.172745 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:33.858601 0.104915 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:33.931917 0.166053 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.075791 0.174904 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.247994 0.174947 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.419286 0.047558 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.541104 0.183228 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.719337 0.061368 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:34.825646 0.389472 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:35.195505 0.353419 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:35.519329 0.263808 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:35.747940 0.187486 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:35.931942 0.149095 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:36.071243 0.292578 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:36.444695 0.196559 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:36.537514 2.993717 tcp 10.0.2.105 62498 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:51:36.633032 0.211610 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 1918 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:36.824039 0.253659 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:37.109432 0.230017 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:37.332165 0.237489 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:37.548308 0.164924 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:37.731317 0.229562 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:37.953152 0.065731 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.036652 0.062561 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.152900 0.080744 udp 10.0.2.105 7010 <-> 93.177.131.160 5667 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.288605 0.187439 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.472929 0.299831 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.664717 4.792783 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 27 14450 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:38.828896 0.126586 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:38.912844 0.149408 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:39.055940 0.469154 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:39.499445 0.226304 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/13 15:51:43.993060 4.810033 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 45 34326 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:45.529244 0.000000 tcp 10.0.2.105 62498 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:51:50.910593 4.551497 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 80 56448 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:51.539907 0.061149 tcp 10.0.2.105 62499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:51.601345 0.060903 tcp 10.0.2.105 62500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:51.662541 0.152595 tcp 10.0.2.105 62501 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:51:51.841210 3.001743 tcp 10.0.2.105 62502 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:51:55.953389 4.969770 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 76 50440 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:00.841567 0.000000 tcp 10.0.2.105 62502 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:01.474378 4.947216 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 28 15992 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:06.840614 0.060504 tcp 10.0.2.105 62503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:06.901466 0.065726 tcp 10.0.2.105 62504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:06.967485 0.152204 tcp 10.0.2.105 62505 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:07.377433 4.544977 tcp 10.0.2.105 62506 -> 46.48.223.67 15494 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:07.490642 4.769608 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 30 18996 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:11.631244 0.060871 tcp 10.0.2.105 62507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:11.692591 0.065351 tcp 10.0.2.105 62508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:11.758280 0.151769 tcp 10.0.2.105 62509 -> 195.113.214.249 443 SRPA* 0 0 44 40642 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:11.922626 3.002448 tcp 10.0.2.105 62510 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:12.791947 2.293212 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 20 10896 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:18.264012 4.458776 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 33 20926 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:20.920385 0.000000 tcp 10.0.2.105 62510 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:23.864957 1.544311 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 21 17062 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:26.923024 0.064949 tcp 10.0.2.105 62511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:26.988291 0.061843 tcp 10.0.2.105 62512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:27.050441 0.152393 tcp 10.0.2.105 62513 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:27.315708 2.998184 tcp 10.0.2.105 62514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:29.089602 4.710384 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 94 61548 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:34.290867 3.631136 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 76 48992 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:36.313617 0.000000 tcp 10.0.2.105 62514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:39.366354 4.827058 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 36 22216 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:42.321225 2.995750 tcp 10.0.2.105 62515 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:44.669190 4.294945 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 45 27046 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:50.549523 4.149316 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 22 12380 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:51.313898 0.000000 tcp 10.0.2.105 62515 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:52:55.863949 3.812135 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 40 22640 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:57.312894 1.825671 tcp 10.0.2.105 62516 -> 46.48.223.67 15494 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:52:59.138833 3.009623 tcp 10.0.2.105 62517 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:53:01.065593 4.681502 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 58 38068 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:06.587803 4.525142 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 71 51618 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:08.145019 0.000000 tcp 10.0.2.105 62517 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:53:13.198618 3.697409 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 29 18942 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:20.466835 4.842965 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 40 28224 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:25.820053 4.022747 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 35 22162 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:30.870101 4.807520 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 20 14112 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:36.197054 4.405098 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 17 9606 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:42.034027 1.547444 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 23 14274 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:47.238381 4.963293 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 A_PA 0 0 38 23772 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:53:52.543566 3.312637 tcp 10.0.2.105 62497 -> 208.57.252.81 8150 FPA_* 0 0 67 34009 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:54:55.685746 3.004226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 15:55:02.697743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:55:10.694186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:55:26.697351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:55:58.703257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 15:58:14.138733 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:58:14.138889 3.003538 tcp 10.0.2.105 62518 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:58:23.141163 0.000000 tcp 10.0.2.105 62518 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:58:29.141607 0.063594 tcp 10.0.2.105 62519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:29.205536 0.065524 tcp 10.0.2.105 62520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:29.271442 0.157654 tcp 10.0.2.105 62521 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:29.443626 3.000966 tcp 10.0.2.105 62522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:58:38.443370 0.000000 tcp 10.0.2.105 62522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:58:44.442457 0.060387 tcp 10.0.2.105 62523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:44.503143 0.061389 tcp 10.0.2.105 62524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:44.564854 0.150130 tcp 10.0.2.105 62525 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:44.736358 0.363986 tcp 10.0.2.105 62526 -> 46.48.223.67 15494 SPA_* 0 0 9 1016 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:55.290463 0.393960 tcp 10.0.2.105 62526 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:55.291228 0.065974 tcp 10.0.2.105 62527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:55.357526 0.065633 tcp 10.0.2.105 62528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:55.423483 0.153729 tcp 10.0.2.105 62529 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:58:55.684621 2.997447 tcp 10.0.2.105 62530 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:04.681386 0.000000 tcp 10.0.2.105 62530 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:10.680304 0.061047 tcp 10.0.2.105 62531 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:59:10.741632 0.062019 tcp 10.0.2.105 62532 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:59:10.803955 0.155362 tcp 10.0.2.105 62533 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:59:11.126300 2.998255 tcp 10.0.2.105 62534 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:20.123214 0.000000 tcp 10.0.2.105 62534 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:26.121854 3.003865 tcp 10.0.2.105 62535 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:35.124120 0.000000 tcp 10.0.2.105 62535 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:40.091781 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 15:59:41.123522 1.785975 tcp 10.0.2.105 62536 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/13 15:59:42.909763 3.002718 tcp 10.0.2.105 62537 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 15:59:51.908691 0.000000 tcp 10.0.2.105 62537 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:02:02.709588 3.002201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:02:09.717182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:02:17.718516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:02:33.721572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:03:05.727487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:04:57.909302 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:04:57.909426 3.003324 tcp 10.0.2.105 62538 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:06.911630 0.000000 tcp 10.0.2.105 62538 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:12.912018 0.065203 tcp 10.0.2.105 62539 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:12.977535 0.062371 tcp 10.0.2.105 62540 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:13.040388 0.148979 tcp 10.0.2.105 62541 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:13.215000 2.999944 tcp 10.0.2.105 62542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:22.213544 0.000000 tcp 10.0.2.105 62542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:28.212756 0.061339 tcp 10.0.2.105 62543 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:28.274404 0.061648 tcp 10.0.2.105 62544 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:28.336466 0.159188 tcp 10.0.2.105 62545 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:29.084697 2.396974 tcp 10.0.2.105 62546 -> 46.48.223.67 15494 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:30.948972 0.061354 tcp 10.0.2.105 62547 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:31.010573 0.062467 tcp 10.0.2.105 62548 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:31.073354 0.155244 tcp 10.0.2.105 62549 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:31.481921 2.999500 tcp 10.0.2.105 62550 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:40.479705 0.000000 tcp 10.0.2.105 62550 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:46.479136 0.062294 tcp 10.0.2.105 62551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:46.541348 0.061833 tcp 10.0.2.105 62552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:46.603542 0.150785 tcp 10.0.2.105 62553 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:05:46.771360 3.001648 tcp 10.0.2.105 62554 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:05:55.771867 0.000000 tcp 10.0.2.105 62554 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:06:01.771258 3.003507 tcp 10.0.2.105 62555 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:06:10.773545 0.000000 tcp 10.0.2.105 62555 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:06:15.590570 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:06:16.772196 1.934683 tcp 10.0.2.105 62556 -> 46.48.223.67 15494 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:06:18.685424 2.993743 tcp 10.0.2.105 62557 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:06:27.678001 0.000000 tcp 10.0.2.105 62557 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:09:09.734433 3.000571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:09:16.741205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:09:24.742535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:09:40.745521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:10:12.751556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:11:33.688619 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:11:33.688816 3.003363 tcp 10.0.2.105 62558 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:11:42.691048 0.000000 tcp 10.0.2.105 62558 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:11:48.690855 0.062331 tcp 10.0.2.105 62559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:11:48.753505 0.061221 tcp 10.0.2.105 62560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:11:48.815027 0.153531 tcp 10.0.2.105 62561 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:11:49.072795 3.001154 tcp 10.0.2.105 62562 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:11:58.072825 0.000000 tcp 10.0.2.105 62562 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:04.072159 0.063862 tcp 10.0.2.105 62563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:04.136320 0.064547 tcp 10.0.2.105 62564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:04.201180 0.156343 tcp 10.0.2.105 62565 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:04.870157 2.143444 tcp 10.0.2.105 62566 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:06.643128 0.059281 tcp 10.0.2.105 62567 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:06.702822 0.065249 tcp 10.0.2.105 62568 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:06.768500 0.153481 tcp 10.0.2.105 62569 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:07.013844 2.995999 tcp 10.0.2.105 62570 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:16.008773 0.000000 tcp 10.0.2.105 62570 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:22.007524 0.061946 tcp 10.0.2.105 62571 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:22.069738 0.068211 tcp 10.0.2.105 62572 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:22.137755 0.153912 tcp 10.0.2.105 62573 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:12:22.669704 3.002801 tcp 10.0.2.105 62574 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:31.671710 0.000000 tcp 10.0.2.105 62574 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:37.669976 3.004095 tcp 10.0.2.105 62575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:46.672828 0.000000 tcp 10.0.2.105 62575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:12:51.589838 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:12:52.671925 0.351433 tcp 10.0.2.105 62576 -> 46.48.223.67 15494 SPA_* 0 0 9 1191 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:13:01.255051 0.000365 tcp 10.0.2.105 62576 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:13:01.255649 2.995449 tcp 10.0.2.105 62577 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:13:10.256002 0.000000 tcp 10.0.2.105 62577 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:16:16.758064 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:16:23.764901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:16:31.766506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:16:47.770991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:17:19.775287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:21:48.301780 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:21:48.301915 0.072875 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:48.358314 0.073821 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:48.570851 0.125288 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:48.676646 0.381226 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:49.022553 0.175423 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:49.203639 0.086784 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:49.281187 0.126941 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:21:49.456563 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 16:22:01.280194 3.004257 tcp 10.0.2.105 62578 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:05.263605 0.060894 tcp 10.0.2.105 62579 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:05.324859 0.064628 tcp 10.0.2.105 62580 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:05.389809 0.149672 tcp 10.0.2.105 62581 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:05.540209 0.119452 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:05.639635 0.402209 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:06.031284 0.172477 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:06.241590 0.170164 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:06.409063 0.174536 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:06.857927 0.112282 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:06.934690 0.175995 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:07.221077 0.046876 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:07.251829 0.167831 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:07.465935 0.174754 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:07.635918 0.391783 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:08.009196 0.183033 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:08.254925 0.053117 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:08.532329 0.450913 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:08.953475 0.334317 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:09.251824 0.189875 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:09.570148 0.148983 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:09.708413 0.150754 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:10.016193 0.213591 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:10.196148 0.273645 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:10.283200 0.000000 tcp 10.0.2.105 62578 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:10.462760 0.215665 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:10.653663 0.163928 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:10.859885 0.221163 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:11.071183 0.239464 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:11.289225 0.229515 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:11.736229 0.160179 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:11.962887 0.052669 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:12.264708 0.000000 udp 10.0.2.105 7010 -> 93.177.131.160 5667 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 16:22:16.281936 0.059964 tcp 10.0.2.105 62582 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:16.342195 0.061181 tcp 10.0.2.105 62583 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:16.403686 0.155144 tcp 10.0.2.105 62584 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:16.601027 3.005547 tcp 10.0.2.105 62585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:25.752396 0.000000 tcp 10.0.2.105 62585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:29.706152 0.062622 tcp 10.0.2.105 62586 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:29.769046 0.060987 tcp 10.0.2.105 62587 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:29.830299 0.154971 tcp 10.0.2.105 62588 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:29.986215 0.187239 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:30.170266 0.221143 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:31.684742 0.059832 tcp 10.0.2.105 62589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:31.728861 0.278676 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:31.744857 0.060167 tcp 10.0.2.105 62590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:31.805312 0.152446 tcp 10.0.2.105 62591 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:22:32.194491 2.970497 tcp 10.0.2.105 62592 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:32.219971 0.143374 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:32.699090 0.535652 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:33.212265 0.209859 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:22:41.118602 0.000000 tcp 10.0.2.105 62592 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:47.105962 2.993807 tcp 10.0.2.105 62593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:22:56.098584 0.000000 tcp 10.0.2.105 62593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:23:01.086014 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:23:23.781703 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:23:30.788803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:23:38.790262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:23:54.793139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:24:26.800134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:28:02.109583 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:28:02.109692 3.003673 tcp 10.0.2.105 62594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:11.111723 0.000000 tcp 10.0.2.105 62594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:17.112489 0.065261 tcp 10.0.2.105 62595 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:17.178003 0.061233 tcp 10.0.2.105 62596 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:17.239559 0.155240 tcp 10.0.2.105 62597 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:17.807886 3.007829 tcp 10.0.2.105 62598 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:26.814484 0.000000 tcp 10.0.2.105 62598 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:32.803908 0.059992 tcp 10.0.2.105 62599 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:32.864245 0.061173 tcp 10.0.2.105 62600 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:32.925692 0.147922 tcp 10.0.2.105 62601 -> 195.113.214.249 443 SRPA* 0 0 27 12276 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:33.168040 2.710125 tcp 10.0.2.105 62602 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:34.992458 0.062481 tcp 10.0.2.105 62603 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:35.055225 0.060914 tcp 10.0.2.105 62604 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:35.116718 0.153281 tcp 10.0.2.105 62605 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:35.878428 3.003374 tcp 10.0.2.105 62606 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:44.880217 0.000000 tcp 10.0.2.105 62606 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:28:50.879825 0.060235 tcp 10.0.2.105 62607 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:50.939892 0.061664 tcp 10.0.2.105 62608 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:51.001867 0.154129 tcp 10.0.2.105 62609 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:28:51.343812 3.000422 tcp 10.0.2.105 62610 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:29:00.342677 0.000000 tcp 10.0.2.105 62610 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:29:06.341587 3.003933 tcp 10.0.2.105 62611 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:29:15.523621 0.000000 tcp 10.0.2.105 62611 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:29:20.219812 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:29:21.462868 1.853216 tcp 10.0.2.105 62612 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:29:23.316367 2.967509 tcp 10.0.2.105 62613 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:29:32.226290 0.000000 tcp 10.0.2.105 62613 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:30:30.806188 3.000545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:30:37.812694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:30:45.814314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:31:01.817175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:31:33.823574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:34:38.209225 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:34:38.209419 3.003425 tcp 10.0.2.105 62614 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:34:47.211221 0.000000 tcp 10.0.2.105 62614 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:34:53.211307 0.060802 tcp 10.0.2.105 62615 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:34:53.272519 0.065558 tcp 10.0.2.105 62616 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:34:53.338369 0.149389 tcp 10.0.2.105 62617 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:34:53.620636 3.004216 tcp 10.0.2.105 62618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:02.623516 0.000000 tcp 10.0.2.105 62618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:08.622940 0.062968 tcp 10.0.2.105 62619 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:08.686225 0.060182 tcp 10.0.2.105 62620 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:08.746668 0.159945 tcp 10.0.2.105 62621 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:09.219050 2.757611 tcp 10.0.2.105 62622 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:11.487533 0.060918 tcp 10.0.2.105 62623 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:11.548731 0.060371 tcp 10.0.2.105 62624 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:11.609394 0.151670 tcp 10.0.2.105 62625 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:11.976977 2.972234 tcp 10.0.2.105 62626 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:20.892813 0.000000 tcp 10.0.2.105 62626 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:26.837298 0.060551 tcp 10.0.2.105 62627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:26.898128 0.063631 tcp 10.0.2.105 62628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:26.962013 0.154478 tcp 10.0.2.105 62629 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:27.421633 2.976751 tcp 10.0.2.105 62630 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:36.340559 0.000000 tcp 10.0.2.105 62630 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:42.281100 2.979964 tcp 10.0.2.105 62631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:51.201938 0.000000 tcp 10.0.2.105 62631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:35:56.090101 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:35:57.151975 1.892123 tcp 10.0.2.105 62632 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:35:59.044385 2.994755 tcp 10.0.2.105 62633 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:36:08.044690 0.000000 tcp 10.0.2.105 62633 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:37:37.829026 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:37:44.836698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:37:52.838173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:38:08.841409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:38:40.850279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:41:14.037735 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:41:14.037937 3.003881 tcp 10.0.2.105 62634 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:41:23.040256 0.000000 tcp 10.0.2.105 62634 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:41:29.040877 0.060708 tcp 10.0.2.105 62635 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:29.101877 0.064401 tcp 10.0.2.105 62636 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:29.166586 0.148765 tcp 10.0.2.105 62637 -> 195.113.214.249 443 SRPA* 0 0 24 12114 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:29.962813 3.002131 tcp 10.0.2.105 62638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:41:38.963352 0.000000 tcp 10.0.2.105 62638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:41:44.963858 0.060106 tcp 10.0.2.105 62639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:45.024327 0.061410 tcp 10.0.2.105 62640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:45.086043 0.152741 tcp 10.0.2.105 62641 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:45.383817 3.011552 tcp 10.0.2.105 62642 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:48.014260 0.066188 tcp 10.0.2.105 62643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:48.080666 0.061039 tcp 10.0.2.105 62644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:48.141525 0.151728 tcp 10.0.2.105 62645 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:41:48.395592 2.995750 tcp 10.0.2.105 62646 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:41:57.391573 0.000000 tcp 10.0.2.105 62646 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:03.389126 0.066288 tcp 10.0.2.105 62647 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:42:03.455756 0.065211 tcp 10.0.2.105 62648 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:42:03.521239 0.148942 tcp 10.0.2.105 62649 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:42:04.275951 2.998043 tcp 10.0.2.105 62650 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:13.272677 0.000000 tcp 10.0.2.105 62650 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:19.271557 3.004128 tcp 10.0.2.105 62651 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:27.092552 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:42:28.274092 0.000000 tcp 10.0.2.105 62651 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:34.273182 2.030751 tcp 10.0.2.105 62652 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:42:36.304349 2.968686 tcp 10.0.2.105 62653 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:42:45.221762 0.000000 tcp 10.0.2.105 62653 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:44:44.852722 3.002175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:44:51.861821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:44:59.862030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:45:15.865172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:45:47.872596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:47:51.158962 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:47:51.159072 3.003795 tcp 10.0.2.105 62654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:00.161664 0.000000 tcp 10.0.2.105 62654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:06.161844 0.061257 tcp 10.0.2.105 62655 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:06.223364 0.062601 tcp 10.0.2.105 62656 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:06.286226 0.149479 tcp 10.0.2.105 62657 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:06.500157 3.004737 tcp 10.0.2.105 62658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:15.503427 0.000000 tcp 10.0.2.105 62658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:21.492626 0.059702 tcp 10.0.2.105 62659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:21.552621 0.061131 tcp 10.0.2.105 62660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:21.614103 0.155076 tcp 10.0.2.105 62661 -> 195.113.214.249 443 SRPA* 0 0 43 36160 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:21.861744 0.397367 tcp 10.0.2.105 62662 -> 46.48.223.67 15494 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:32.908954 0.338541 tcp 10.0.2.105 62662 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:32.909906 0.061078 tcp 10.0.2.105 62663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:32.971284 0.061563 tcp 10.0.2.105 62664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:33.033171 0.157727 tcp 10.0.2.105 62665 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:33.247759 3.005435 tcp 10.0.2.105 62666 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:42.252273 0.000000 tcp 10.0.2.105 62666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:48.241567 0.059967 tcp 10.0.2.105 62667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:48.301914 0.060939 tcp 10.0.2.105 62668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:48.363136 0.148684 tcp 10.0.2.105 62669 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:48:48.549786 3.006074 tcp 10.0.2.105 62670 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:48:57.554793 0.000000 tcp 10.0.2.105 62670 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:49:03.542785 3.005996 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:49:12.545769 0.000000 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:49:17.091971 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:49:18.544082 0.366105 tcp 10.0.2.105 62672 -> 46.48.223.67 15494 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:49:38.851385 0.000480 tcp 10.0.2.105 62672 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:49:38.852123 2.998647 tcp 10.0.2.105 62673 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:49:47.856312 0.000000 tcp 10.0.2.105 62673 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:52:43.309006 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:52:43.309201 0.172921 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:52:43.474680 0.000000 udp 10.0.2.105 7010 -> 93.177.131.160 5667 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 16:53:02.227482 0.062515 tcp 10.0.2.105 62674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:02.290304 0.062501 tcp 10.0.2.105 62675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:02.353123 0.152953 tcp 10.0.2.105 62676 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:02.506714 0.075255 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:02.563972 0.172696 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.079748 0.081472 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.151495 0.084252 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.272804 0.127269 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2556 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.378968 0.345113 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.688792 0.128458 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.893020 0.106919 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:03.980332 0.199820 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.170460 0.172526 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.459319 0.109863 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.537468 0.177355 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.734598 0.047364 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.766503 0.174861 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:04.945620 0.170195 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:05.113269 0.388298 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:05.482921 0.181804 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:05.659655 0.055337 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 1948 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:05.804400 0.176104 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:05.977949 0.166200 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:06.337984 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 16:53:21.474116 0.059819 tcp 10.0.2.105 62677 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:21.534251 0.066473 tcp 10.0.2.105 62678 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:21.600811 0.148348 tcp 10.0.2.105 62679 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:53:21.749710 0.335223 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 3 913 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:22.075575 0.144501 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:22.310094 0.213730 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:22.490239 0.359680 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:22.841234 0.146205 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:22.978116 0.163895 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:23.225511 0.198382 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2006 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:23.417574 0.270691 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:23.690848 0.230606 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:23.914297 0.219554 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:24.110520 0.077220 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:24.280500 0.226457 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:24.499403 0.063327 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:24.626673 0.187047 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:24.810513 0.312939 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:25.073965 0.133586 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:25.215719 0.212111 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:25.420737 0.141618 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:53:25.517459 0.448086 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/13 16:54:51.886359 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 16:54:53.846480 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:54:53.846628 2.993955 tcp 10.0.2.105 62680 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:54:58.894814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:55:02.840570 0.000000 tcp 10.0.2.105 62680 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:06.898645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:55:08.848721 0.061486 tcp 10.0.2.105 62681 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:08.910504 0.062514 tcp 10.0.2.105 62682 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:08.973277 0.148975 tcp 10.0.2.105 62683 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:09.313409 2.999442 tcp 10.0.2.105 62684 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:18.310919 0.000000 tcp 10.0.2.105 62684 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:22.900537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:55:24.311962 0.059856 tcp 10.0.2.105 62685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:24.372133 0.062041 tcp 10.0.2.105 62686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:24.434497 0.154793 tcp 10.0.2.105 62687 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:24.801236 0.616948 tcp 10.0.2.105 62688 -> 46.48.223.67 15494 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:32.444345 0.291934 tcp 10.0.2.105 62688 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:32.445150 0.065126 tcp 10.0.2.105 62689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:32.510597 0.059923 tcp 10.0.2.105 62690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:32.570850 0.155579 tcp 10.0.2.105 62691 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:32.736507 2.974672 tcp 10.0.2.105 62692 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:41.648384 0.000000 tcp 10.0.2.105 62692 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:47.585257 0.061954 tcp 10.0.2.105 62693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:47.647478 0.061266 tcp 10.0.2.105 62694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:47.709056 0.151497 tcp 10.0.2.105 62695 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:55:47.886094 2.992131 tcp 10.0.2.105 62696 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:55:54.903963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 16:55:56.886732 0.000000 tcp 10.0.2.105 62696 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:56:02.875644 2.993937 tcp 10.0.2.105 62697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:56:11.868316 0.000000 tcp 10.0.2.105 62697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:56:16.585228 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 16:56:17.877087 0.358921 tcp 10.0.2.105 62698 -> 46.48.223.67 15494 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:56:28.948089 0.000582 tcp 10.0.2.105 62698 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 16:56:28.948933 3.007764 tcp 10.0.2.105 62699 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 16:56:37.965963 0.000000 tcp 10.0.2.105 62699 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:01:43.946041 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:01:43.946137 2.993678 tcp 10.0.2.105 62700 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:01:52.938415 0.000000 tcp 10.0.2.105 62700 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:01:58.910064 3.001502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:01:58.949206 0.061941 tcp 10.0.2.105 62701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:01:59.011446 0.061137 tcp 10.0.2.105 62702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:01:59.072875 0.151675 tcp 10.0.2.105 62703 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:01:59.299190 3.002979 tcp 10.0.2.105 62704 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:05.917308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:02:08.300987 0.000000 tcp 10.0.2.105 62704 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:13.918516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:02:14.300010 0.064928 tcp 10.0.2.105 62705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:14.365257 0.060834 tcp 10.0.2.105 62706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:14.426328 0.150153 tcp 10.0.2.105 62707 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:14.586727 0.382943 tcp 10.0.2.105 62708 -> 46.48.223.67 15494 SPA_* 0 0 9 1066 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:23.505046 0.296248 tcp 10.0.2.105 62708 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:23.505873 0.065798 tcp 10.0.2.105 62709 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:23.572023 0.065141 tcp 10.0.2.105 62710 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:23.637473 0.153320 tcp 10.0.2.105 62711 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:23.801583 2.996022 tcp 10.0.2.105 62712 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:29.921879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:02:32.806184 0.000000 tcp 10.0.2.105 62712 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:38.795339 0.059540 tcp 10.0.2.105 62713 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:38.855182 0.062194 tcp 10.0.2.105 62714 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:38.917654 0.153488 tcp 10.0.2.105 62715 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:02:39.082480 2.996952 tcp 10.0.2.105 62716 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:48.083075 0.000000 tcp 10.0.2.105 62716 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:02:54.077092 2.995901 tcp 10.0.2.105 62717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:03:01.927901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:03:03.070137 0.000000 tcp 10.0.2.105 62717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:03:07.586255 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:03:09.078503 2.088373 tcp 10.0.2.105 62718 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:03:11.167107 2.998082 tcp 10.0.2.105 62719 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:03:20.163746 0.000000 tcp 10.0.2.105 62719 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:08:26.164701 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:08:26.164895 2.993355 tcp 10.0.2.105 62720 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:08:35.167071 0.000000 tcp 10.0.2.105 62720 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:08:41.310125 0.061378 tcp 10.0.2.105 62721 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:41.371783 0.061757 tcp 10.0.2.105 62722 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:41.433833 0.149522 tcp 10.0.2.105 62723 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:42.055391 2.972538 tcp 10.0.2.105 62724 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:08:50.967428 0.000000 tcp 10.0.2.105 62724 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:08:56.918819 0.059924 tcp 10.0.2.105 62725 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:56.979063 0.060959 tcp 10.0.2.105 62726 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:57.040450 0.159116 tcp 10.0.2.105 62727 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:08:57.363937 3.944956 tcp 10.0.2.105 62728 -> 46.48.223.67 15494 FSPA* 0 0 14 1759 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:01.007060 0.060176 tcp 10.0.2.105 62729 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:01.067540 0.059333 tcp 10.0.2.105 62730 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:01.127187 0.152591 tcp 10.0.2.105 62731 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:01.309127 3.001890 tcp 10.0.2.105 62732 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:05.938221 2.997181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:09:10.307605 0.000000 tcp 10.0.2.105 62732 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:12.941369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:09:16.306759 0.060614 tcp 10.0.2.105 62733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:16.367680 0.063069 tcp 10.0.2.105 62734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:16.430996 0.155531 tcp 10.0.2.105 62735 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:16.883604 2.997841 tcp 10.0.2.105 62736 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:20.942764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:09:25.879563 0.000000 tcp 10.0.2.105 62736 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:31.878270 3.004587 tcp 10.0.2.105 62737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:36.945604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:09:40.881556 0.000000 tcp 10.0.2.105 62737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:45.588172 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:09:46.880485 3.855899 tcp 10.0.2.105 62738 -> 46.48.223.67 15494 FSPA* 0 0 10 1543 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:09:50.736605 2.993197 tcp 10.0.2.105 62739 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:09:59.728808 0.000000 tcp 10.0.2.105 62739 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:10:08.952033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:10:48.778919 0.000163 tcp 10.0.2.105 62738 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:10:53.586066 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:15:05.741658 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:15:05.741809 3.001066 tcp 10.0.2.105 62740 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:15:14.741913 0.000000 tcp 10.0.2.105 62740 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:15:20.744833 0.065446 tcp 10.0.2.105 62741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:20.810649 0.062486 tcp 10.0.2.105 62742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:20.873472 0.153082 tcp 10.0.2.105 62743 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:21.190811 3.004164 tcp 10.0.2.105 62744 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:15:30.193628 0.000000 tcp 10.0.2.105 62744 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:15:36.183075 0.554146 tcp 10.0.2.105 62745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:36.737530 0.062244 tcp 10.0.2.105 62746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:36.800081 0.151926 tcp 10.0.2.105 62747 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:37.196763 0.354624 tcp 10.0.2.105 62748 -> 46.48.223.67 15494 SPA_* 0 0 9 1050 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:57.380742 0.589609 tcp 10.0.2.105 62748 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:57.381712 0.060018 tcp 10.0.2.105 62749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:57.442077 0.061820 tcp 10.0.2.105 62750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:57.503782 0.146571 tcp 10.0.2.105 62751 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:15:57.970570 2.997517 tcp 10.0.2.105 62752 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:06.976812 0.000000 tcp 10.0.2.105 62752 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:12.956941 3.002434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:16:12.965208 0.061244 tcp 10.0.2.105 62753 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:16:13.026686 0.059874 tcp 10.0.2.105 62754 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:16:13.086389 0.156576 tcp 10.0.2.105 62755 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:16:13.348750 2.991407 tcp 10.0.2.105 62756 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:19.964728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:16:22.339203 0.000000 tcp 10.0.2.105 62756 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:27.969149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:16:28.349756 3.001828 tcp 10.0.2.105 62757 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:37.467634 0.000000 tcp 10.0.2.105 62757 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:16:42.167868 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:16:43.420425 0.720313 tcp 10.0.2.105 62758 -> 46.48.223.67 15494 SPA_* 0 0 9 1050 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:16:44.033535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:16:53.075152 0.000358 tcp 10.0.2.105 62758 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:16:53.075679 3.005438 tcp 10.0.2.105 62759 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:17:02.086206 0.000000 tcp 10.0.2.105 62759 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:17:15.975800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:23:19.982001 3.004779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 17:23:26.988834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:23:33.479068 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:23:33.479260 1.095806 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:34.545722 0.172779 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:34.743284 0.074261 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:34.799920 0.175068 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:34.990419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:23:35.027874 0.379556 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:35.374298 0.080254 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:35.608115 0.072028 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:35.661077 0.125569 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:35.975814 0.202001 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:36.169041 0.179944 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:36.432448 0.129218 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:36.610859 0.116851 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:36.705882 0.047704 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:37.112700 0.171659 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:37.550291 0.170197 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:37.717688 0.109077 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:37.792375 0.176574 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:38.014813 0.180781 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:38.085969 2.993073 tcp 10.0.2.105 62760 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:23:38.190771 0.394099 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:38.601371 0.056984 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:38.772883 0.168584 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:38.919533 0.182541 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:39.093976 0.341835 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:39.399261 0.733941 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:40.128613 0.143139 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:40.346953 0.218126 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:40.626654 0.191503 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:40.813823 0.237505 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:41.030536 0.163798 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:41.521887 0.199969 udp 10.0.2.105 7010 <-> 99.27.225.240 5572 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:41.713580 0.223013 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:41.927357 0.214196 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:42.118728 0.064871 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:43.285247 0.190433 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:43.471903 0.398427 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:43.759577 0.226104 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:43.977782 0.072800 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:44.157093 0.124487 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:44.241427 0.134657 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:44.369061 0.219995 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:44.622303 0.462007 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:23:47.078201 0.000000 tcp 10.0.2.105 62760 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:23:50.993808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:23:53.088644 0.064775 tcp 10.0.2.105 62761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:23:53.153755 0.061966 tcp 10.0.2.105 62762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:23:53.215993 0.149614 tcp 10.0.2.105 62763 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:23:53.506826 2.994911 tcp 10.0.2.105 62764 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:02.500576 0.000000 tcp 10.0.2.105 62764 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:08.499845 0.062470 tcp 10.0.2.105 62765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:24:08.562653 0.061456 tcp 10.0.2.105 62766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:24:08.624451 0.154875 tcp 10.0.2.105 62767 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:24:08.868907 3.004826 tcp 10.0.2.105 62768 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:17.876606 0.000000 tcp 10.0.2.105 62768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:22.999786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:24:23.861252 3.003938 tcp 10.0.2.105 62769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:32.863997 0.000000 tcp 10.0.2.105 62769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:24:37.590969 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:29:38.865750 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:29:38.865934 2.992062 tcp 10.0.2.105 62770 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:29:47.866858 0.000000 tcp 10.0.2.105 62770 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:29:53.867603 0.046390 tcp 10.0.2.105 62771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:29:53.914319 0.045937 tcp 10.0.2.105 62772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:29:53.960533 0.140074 tcp 10.0.2.105 62773 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:29:54.351314 2.999424 tcp 10.0.2.105 62774 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:03.349216 0.000000 tcp 10.0.2.105 62774 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:09.348481 0.075418 tcp 10.0.2.105 62775 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:09.424196 0.045488 tcp 10.0.2.105 62776 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:09.469959 0.133304 tcp 10.0.2.105 62777 -> 195.113.214.249 443 SRPA* 0 0 22 12875 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:10.243087 0.481018 tcp 10.0.2.105 62778 -> 46.48.223.67 15494 SPA_* 0 0 9 1062 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:16.424477 0.257036 tcp 10.0.2.105 62778 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:16.425436 0.045048 tcp 10.0.2.105 62779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:16.470885 0.045938 tcp 10.0.2.105 62780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:16.517135 0.134412 tcp 10.0.2.105 62781 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:16.681745 3.000818 tcp 10.0.2.105 62782 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:25.681101 0.000000 tcp 10.0.2.105 62782 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:27.006069 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:30:31.680302 0.045507 tcp 10.0.2.105 62783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:31.725615 0.046375 tcp 10.0.2.105 62784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:31.772261 0.133458 tcp 10.0.2.105 62785 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:30:32.440550 3.004725 tcp 10.0.2.105 62786 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:34.013461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:30:41.443730 0.000000 tcp 10.0.2.105 62786 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:42.014811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:30:47.432956 3.004099 tcp 10.0.2.105 62787 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:56.435457 0.000000 tcp 10.0.2.105 62787 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:30:58.032000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:31:01.094611 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:31:02.434108 4.207432 tcp 10.0.2.105 62788 -> 46.48.223.67 15494 FSPA* 0 0 12 1484 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:31:06.641424 3.003364 tcp 10.0.2.105 62789 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:31:15.642930 0.000000 tcp 10.0.2.105 62789 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:31:30.023806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:36:21.643483 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:36:21.643681 2.993597 tcp 10.0.2.105 62790 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:36:30.645827 0.000000 tcp 10.0.2.105 62790 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:36:36.646442 0.049521 tcp 10.0.2.105 62791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:36.696343 0.045847 tcp 10.0.2.105 62792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:36.742467 0.138835 tcp 10.0.2.105 62793 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:37.058211 3.001236 tcp 10.0.2.105 62794 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:36:46.060516 0.000000 tcp 10.0.2.105 62794 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:36:52.057568 0.047559 tcp 10.0.2.105 62795 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:52.105455 0.046364 tcp 10.0.2.105 62796 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:52.152152 0.133115 tcp 10.0.2.105 62797 -> 195.113.214.249 443 SRPA* 0 0 20 11306 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:52.657773 4.503337 tcp 10.0.2.105 62798 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:56.795276 0.068323 tcp 10.0.2.105 62799 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:56.863850 0.049286 tcp 10.0.2.105 62800 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:56.913448 0.139913 tcp 10.0.2.105 62801 -> 195.113.214.249 443 SRPA* 0 0 40 21148 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:36:57.161273 2.997281 tcp 10.0.2.105 62802 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:06.169231 0.000000 tcp 10.0.2.105 62802 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:12.156196 0.045175 tcp 10.0.2.105 62803 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:37:12.201658 0.048459 tcp 10.0.2.105 62804 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:37:12.250427 0.135302 tcp 10.0.2.105 62805 -> 195.113.214.249 443 SRPA* 0 0 21 11362 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:37:12.579992 3.000606 tcp 10.0.2.105 62806 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:21.579557 0.000000 tcp 10.0.2.105 62806 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:27.578033 3.003999 tcp 10.0.2.105 62807 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:34.029253 3.002360 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:37:36.580658 0.000000 tcp 10.0.2.105 62807 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:41.036881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:37:41.087076 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:37:42.579640 4.271751 tcp 10.0.2.105 62808 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:37:46.851664 3.000186 tcp 10.0.2.105 62809 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:37:49.040208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:37:55.848540 0.000000 tcp 10.0.2.105 62809 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:38:05.041809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:38:37.047632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:43:01.849054 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:43:01.849243 3.003716 tcp 10.0.2.105 62810 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:10.851425 0.000000 tcp 10.0.2.105 62810 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:16.851454 0.046541 tcp 10.0.2.105 62811 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:16.898328 0.045503 tcp 10.0.2.105 62812 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:16.944101 0.133841 tcp 10.0.2.105 62813 -> 195.113.214.249 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:17.177253 2.997611 tcp 10.0.2.105 62814 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:26.201704 0.000000 tcp 10.0.2.105 62814 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:32.172726 0.045384 tcp 10.0.2.105 62815 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:32.218455 0.046895 tcp 10.0.2.105 62816 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:32.265673 0.137368 tcp 10.0.2.105 62817 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:32.460307 0.405041 tcp 10.0.2.105 62818 -> 46.48.223.67 15494 SPA_* 0 0 9 1196 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:41.186550 0.326598 tcp 10.0.2.105 62818 -> 46.48.223.67 15494 FA_PA 0 0 4 476 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:41.187395 0.045853 tcp 10.0.2.105 62819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:41.233087 0.048630 tcp 10.0.2.105 62820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:41.282036 0.135770 tcp 10.0.2.105 62821 -> 195.113.214.249 443 SRPA* 0 0 33 16696 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:41.513426 2.996278 tcp 10.0.2.105 62822 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:50.508659 0.000000 tcp 10.0.2.105 62822 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:43:52.726017 0.000157 tcp 10.0.2.105 62818 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:56.507632 0.045125 tcp 10.0.2.105 62823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:56.553138 0.048281 tcp 10.0.2.105 62824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:56.601682 0.137146 tcp 10.0.2.105 62825 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:43:57.009569 3.003423 tcp 10.0.2.105 62826 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:06.010163 0.000000 tcp 10.0.2.105 62826 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:12.009106 3.004596 tcp 10.0.2.105 62827 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:21.012164 0.000000 tcp 10.0.2.105 62827 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:25.589124 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:44:27.012194 0.745960 tcp 10.0.2.105 62828 -> 46.48.223.67 15494 SPA_* 0 0 9 1196 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:44:34.641609 0.000406 tcp 10.0.2.105 62828 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:44:34.642226 3.004196 tcp 10.0.2.105 62829 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:41.053663 3.002981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:44:43.646807 0.000000 tcp 10.0.2.105 62829 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:44:48.061237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:44:56.062921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:45:12.065879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:45:44.072004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:49:49.645501 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:49:49.645695 0.432639 tcp 10.0.2.105 62830 -> 46.48.223.67 15494 SPA_* 0 0 9 1005 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:20.080429 0.065217 tcp 10.0.2.105 62831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:20.145923 0.060074 tcp 10.0.2.105 62832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:20.206304 0.155087 tcp 10.0.2.105 62833 -> 195.113.214.249 443 SRPA* 0 0 44 35966 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:20.393273 0.407408 tcp 10.0.2.105 62830 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:20.393585 2.999654 tcp 10.0.2.105 62834 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:50:29.391938 0.000000 tcp 10.0.2.105 62834 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:50:35.391648 0.061262 tcp 10.0.2.105 62835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:35.453217 0.061149 tcp 10.0.2.105 62836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:35.514661 0.149170 tcp 10.0.2.105 62837 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:50:35.687525 0.409591 tcp 10.0.2.105 62838 -> 46.48.223.67 15494 SPA_* 0 0 9 1005 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:51:06.095520 0.384201 tcp 10.0.2.105 62838 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:51:06.095893 2.996756 tcp 10.0.2.105 62839 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:51:15.093117 0.000000 tcp 10.0.2.105 62839 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:54:06.954387 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:54:06.954573 1.115881 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.041148 0.173228 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.301280 0.101595 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.384081 0.178118 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.575051 0.265371 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 1995 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.807041 0.123798 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:08.927117 0.209960 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.126636 0.089339 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.206307 0.074051 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.319216 0.180399 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.570184 0.127624 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2566 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.773480 0.108662 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.860533 0.045237 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.913637 0.112877 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:09.993246 0.177063 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:10.166678 0.182096 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:10.446643 0.170541 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:10.674384 0.168392 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:10.840121 0.391258 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:11.211126 0.052973 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:11.290096 0.165028 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:11.435293 0.177198 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:11.659354 0.145052 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:11.796019 0.379533 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:12.139119 0.151774 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:12.316080 0.269400 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:12.562708 0.218064 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:13.100240 0.596966 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:13.688808 0.163579 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:13.988986 0.000000 udp 10.0.2.105 7010 -> 99.27.225.240 5572 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 17:54:32.288027 0.061151 tcp 10.0.2.105 62840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:54:32.349500 0.064285 tcp 10.0.2.105 62841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:54:32.414096 0.161609 tcp 10.0.2.105 62842 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:54:32.576282 0.220438 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:32.789790 0.215162 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:32.979830 0.070706 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:33.101015 0.190705 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:33.288830 0.264523 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:33.567668 0.229329 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:33.789127 0.049306 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:33.987788 0.131842 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:34.081602 0.448283 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:34.257768 0.208095 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:34.458772 0.442400 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/13 17:54:51.081230 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 17:54:58.087921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:55:06.089786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:55:22.096660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:55:54.098665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 17:56:21.098039 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:56:21.098280 3.003655 tcp 10.0.2.105 62843 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:56:30.100807 0.000000 tcp 10.0.2.105 62843 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:56:36.100437 0.064596 tcp 10.0.2.105 62844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:36.165323 0.064342 tcp 10.0.2.105 62845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:36.229982 0.154602 tcp 10.0.2.105 62846 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:36.394704 2.999049 tcp 10.0.2.105 62847 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:56:45.392622 0.000000 tcp 10.0.2.105 62847 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:56:51.391915 0.060426 tcp 10.0.2.105 62848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:51.452622 0.062222 tcp 10.0.2.105 62849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:51.515188 0.149338 tcp 10.0.2.105 62850 -> 195.113.214.249 443 SRPA* 0 0 31 15978 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:51.692067 2.077883 tcp 10.0.2.105 62851 -> 46.48.223.67 15494 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:53.445686 0.061275 tcp 10.0.2.105 62852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:53.507258 0.062504 tcp 10.0.2.105 62853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:53.570115 0.151755 tcp 10.0.2.105 62854 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:56:53.770158 2.998950 tcp 10.0.2.105 62855 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:02.777510 0.000000 tcp 10.0.2.105 62855 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:08.767384 0.060227 tcp 10.0.2.105 62856 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:57:08.828004 0.063533 tcp 10.0.2.105 62857 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:57:08.891820 0.152563 tcp 10.0.2.105 62858 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:57:09.060688 3.000374 tcp 10.0.2.105 62859 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:18.059535 0.000000 tcp 10.0.2.105 62859 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:24.058483 3.004425 tcp 10.0.2.105 62860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:33.060545 0.000000 tcp 10.0.2.105 62860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:37.587544 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 17:57:39.059504 1.733552 tcp 10.0.2.105 62861 -> 46.48.223.67 15494 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/13 17:57:40.793321 3.003232 tcp 10.0.2.105 62862 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 17:57:49.794987 0.000000 tcp 10.0.2.105 62862 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:01:58.104995 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:02:05.112228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:02:13.115746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:02:29.116848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:02:55.795814 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:02:55.795930 2.993341 tcp 10.0.2.105 62863 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:01.123234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:03:04.787911 0.000000 tcp 10.0.2.105 62863 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:10.798916 0.065234 tcp 10.0.2.105 62864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:10.864579 0.063931 tcp 10.0.2.105 62865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:10.928888 0.152582 tcp 10.0.2.105 62866 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:11.095045 2.996355 tcp 10.0.2.105 62867 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:20.090026 0.000000 tcp 10.0.2.105 62867 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:26.088866 0.060123 tcp 10.0.2.105 62868 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:26.149253 0.061928 tcp 10.0.2.105 62869 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:26.211459 0.149059 tcp 10.0.2.105 62870 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:26.378577 2.054410 tcp 10.0.2.105 62871 -> 46.48.223.67 15494 FSPA* 0 0 14 1755 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:28.145948 0.059490 tcp 10.0.2.105 62872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:28.205704 0.060361 tcp 10.0.2.105 62873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:28.266355 0.157435 tcp 10.0.2.105 62874 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:28.433216 3.003298 tcp 10.0.2.105 62875 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:37.435182 0.000000 tcp 10.0.2.105 62875 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:43.433834 0.060620 tcp 10.0.2.105 62876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:43.494784 0.062596 tcp 10.0.2.105 62877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:43.557663 0.153942 tcp 10.0.2.105 62878 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:03:43.722906 2.995823 tcp 10.0.2.105 62879 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:52.727191 0.000000 tcp 10.0.2.105 62879 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:03:58.715708 2.993993 tcp 10.0.2.105 62880 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:04:07.708669 0.000000 tcp 10.0.2.105 62880 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:04:12.585500 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:04:13.717321 1.725127 tcp 10.0.2.105 62881 -> 46.48.223.67 15494 FSPA* 0 0 14 1755 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:04:15.442626 3.001374 tcp 10.0.2.105 62882 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:04:24.442750 0.000000 tcp 10.0.2.105 62882 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:09:05.129397 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:09:12.136404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:09:20.137831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:09:30.443566 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:09:30.443681 3.005186 tcp 10.0.2.105 62883 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:09:36.140245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:09:39.445710 0.000000 tcp 10.0.2.105 62883 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:09:45.445772 0.064683 tcp 10.0.2.105 62884 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:09:45.510289 0.060909 tcp 10.0.2.105 62885 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:09:45.571479 0.149503 tcp 10.0.2.105 62886 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:09:45.744596 2.994251 tcp 10.0.2.105 62887 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:09:54.747432 0.000000 tcp 10.0.2.105 62887 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:00.749221 0.060616 tcp 10.0.2.105 62888 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:00.810179 0.061741 tcp 10.0.2.105 62889 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:00.872329 0.149328 tcp 10.0.2.105 62890 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:01.046505 4.239383 tcp 10.0.2.105 62891 -> 46.48.223.67 15494 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:04.858555 0.061153 tcp 10.0.2.105 62892 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:04.920040 0.060985 tcp 10.0.2.105 62893 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:04.981308 0.152635 tcp 10.0.2.105 62894 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:05.286141 3.001140 tcp 10.0.2.105 62895 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:08.146747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:10:14.288735 0.000000 tcp 10.0.2.105 62895 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:20.284988 0.061089 tcp 10.0.2.105 62896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:20.346403 0.061206 tcp 10.0.2.105 62897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:20.407932 0.151868 tcp 10.0.2.105 62898 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:21.353028 2.997084 tcp 10.0.2.105 62899 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:30.350017 0.000000 tcp 10.0.2.105 62899 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:36.349095 3.002570 tcp 10.0.2.105 62900 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:44.087945 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:10:45.350161 0.000000 tcp 10.0.2.105 62900 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:10:51.353821 0.434848 tcp 10.0.2.105 62901 -> 46.48.223.67 15494 SPA_* 0 0 9 1178 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:58.529683 0.000366 tcp 10.0.2.105 62901 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:10:58.530289 3.004513 tcp 10.0.2.105 62902 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:11:07.531981 0.000000 tcp 10.0.2.105 62902 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:12.152588 3.001855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:16:13.532828 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:16:13.532946 3.003589 tcp 10.0.2.105 62903 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:19.159875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:16:22.534864 0.000000 tcp 10.0.2.105 62903 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:27.161544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:16:28.536711 0.064178 tcp 10.0.2.105 62904 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:28.601103 0.066236 tcp 10.0.2.105 62905 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:28.667626 0.151295 tcp 10.0.2.105 62906 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:28.971076 2.997523 tcp 10.0.2.105 62907 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:37.968234 0.000000 tcp 10.0.2.105 62907 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:43.166859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:16:43.967370 0.061049 tcp 10.0.2.105 62908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:44.028744 0.060934 tcp 10.0.2.105 62909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:44.089932 0.150899 tcp 10.0.2.105 62910 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:44.829187 2.128803 tcp 10.0.2.105 62911 -> 46.48.223.67 15494 FSPA* 0 0 12 1595 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:46.560572 0.061239 tcp 10.0.2.105 62912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:46.622210 0.061035 tcp 10.0.2.105 62913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:46.683565 0.153895 tcp 10.0.2.105 62914 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:16:46.958330 2.996300 tcp 10.0.2.105 62915 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:16:55.953029 0.000000 tcp 10.0.2.105 62915 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:01.952347 0.064785 tcp 10.0.2.105 62916 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:17:02.017436 0.059786 tcp 10.0.2.105 62917 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:17:02.077508 0.155392 tcp 10.0.2.105 62918 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:17:02.401957 3.004897 tcp 10.0.2.105 62919 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:11.405652 0.000000 tcp 10.0.2.105 62919 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:15.170880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:17:17.394143 2.993965 tcp 10.0.2.105 62920 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:26.396640 0.000000 tcp 10.0.2.105 62920 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:31.083584 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:17:32.396031 3.264934 tcp 10.0.2.105 62921 -> 46.48.223.67 15494 FSPA* 0 0 15 1757 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:17:34.159286 3.003332 tcp 10.0.2.105 62922 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:17:43.161229 0.000000 tcp 10.0.2.105 62922 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:23:19.176378 3.001635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 18:23:26.184331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:23:34.185687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:23:50.188518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:24:22.194574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:24:52.838529 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:24:52.838766 0.000000 udp 10.0.2.105 7010 -> 99.27.225.240 5572 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 18:25:08.933909 0.063152 tcp 10.0.2.105 62923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:08.997430 0.062121 tcp 10.0.2.105 62924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:09.059915 0.153265 tcp 10.0.2.105 62925 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:09.213748 0.374400 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:09.559704 0.174489 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:09.828007 0.274272 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.069517 0.122365 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.262069 0.074969 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.319738 0.172186 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 1994 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.538784 0.076187 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.597560 0.171612 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.744431 0.080104 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:10.927303 0.213354 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:11.131254 0.046891 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:11.380162 0.111670 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:11.458316 0.175165 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:11.734545 0.126907 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1812 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:11.846773 0.127105 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:12.128716 0.169569 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:12.388766 0.183263 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:12.567439 0.168752 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:13.289028 0.169811 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:13.435036 0.172801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:13.604818 0.053941 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:14.524502 0.393761 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:14.897669 0.144851 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:15.034598 0.393277 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1472 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:15.405324 0.167941 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:15.655618 0.237031 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:15.869328 0.218827 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:16.050609 0.583735 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:16.624689 0.160412 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:16.833615 0.216986 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:17.043465 0.215228 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:17.235326 0.068370 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:17.338393 0.190946 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:17.526194 0.272601 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:17.907601 0.223380 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:18.085743 0.128185 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:18.511525 0.233426 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:18.738592 0.062831 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:18.912869 0.208827 udp 10.0.2.105 7010 <-> 99.106.123.19 8089 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:19.115380 0.451156 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:25:19.177656 2.993108 tcp 10.0.2.105 62926 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:25:28.169368 0.000000 tcp 10.0.2.105 62926 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:25:33.086669 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:25:34.178821 0.059638 tcp 10.0.2.105 62927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:34.238741 0.068228 tcp 10.0.2.105 62928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:34.306902 0.153117 tcp 10.0.2.105 62929 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:34.712938 3.000116 tcp 10.0.2.105 62930 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:25:43.711812 0.000000 tcp 10.0.2.105 62930 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:25:49.821430 0.064361 tcp 10.0.2.105 62931 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:49.886062 0.063186 tcp 10.0.2.105 62932 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:49.949512 0.155052 tcp 10.0.2.105 62933 -> 195.113.214.249 443 SRPA* 0 0 20 11285 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:50.764380 2.642485 tcp 10.0.2.105 62934 -> 46.48.223.67 15494 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:52.533521 0.061526 tcp 10.0.2.105 62935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:52.594903 0.061439 tcp 10.0.2.105 62936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:52.656663 0.152906 tcp 10.0.2.105 62937 -> 195.113.214.249 443 SRPA* 0 0 32 16806 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:25:53.407205 2.969489 tcp 10.0.2.105 62938 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:02.334934 0.000000 tcp 10.0.2.105 62938 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:08.327807 0.063953 tcp 10.0.2.105 62939 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:26:08.392040 0.062020 tcp 10.0.2.105 62940 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:26:08.454404 0.151621 tcp 10.0.2.105 62941 -> 195.113.214.249 443 SRPA* 0 0 20 11307 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:26:08.940477 3.003007 tcp 10.0.2.105 62942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:17.941755 0.000000 tcp 10.0.2.105 62942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:23.939744 3.004847 tcp 10.0.2.105 62943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:32.944475 0.000000 tcp 10.0.2.105 62943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:37.590517 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:26:38.941411 2.444076 tcp 10.0.2.105 62944 -> 46.48.223.67 15494 FSPA* 0 0 14 1610 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:26:41.385680 2.993204 tcp 10.0.2.105 62945 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:26:50.377554 0.000000 tcp 10.0.2.105 62945 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:30:26.201100 3.001196 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:30:33.213282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:30:41.210893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:30:57.212662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:31:29.218612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:31:56.388054 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:31:56.388197 3.003794 tcp 10.0.2.105 62946 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:05.390755 0.000000 tcp 10.0.2.105 62946 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:11.390684 0.064434 tcp 10.0.2.105 62947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:11.455370 0.060755 tcp 10.0.2.105 62948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:11.516445 0.158432 tcp 10.0.2.105 62949 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:11.749417 3.004537 tcp 10.0.2.105 62950 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:20.752773 0.000000 tcp 10.0.2.105 62950 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:26.744060 0.061708 tcp 10.0.2.105 62951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:26.806099 0.064379 tcp 10.0.2.105 62952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:26.870247 0.155641 tcp 10.0.2.105 62953 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:27.174532 2.551061 tcp 10.0.2.105 62954 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:28.918917 0.063552 tcp 10.0.2.105 62955 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:28.982782 0.061886 tcp 10.0.2.105 62956 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:29.044925 0.151959 tcp 10.0.2.105 62957 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:29.725886 2.995276 tcp 10.0.2.105 62958 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:38.718584 0.000000 tcp 10.0.2.105 62958 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:44.727851 0.060645 tcp 10.0.2.105 62959 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:44.788802 0.061799 tcp 10.0.2.105 62960 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:44.850870 0.153060 tcp 10.0.2.105 62961 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:32:45.014293 2.997613 tcp 10.0.2.105 62962 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:32:54.010597 0.000000 tcp 10.0.2.105 62962 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:33:00.008802 3.004480 tcp 10.0.2.105 62963 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:33:09.012108 0.000000 tcp 10.0.2.105 62963 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:33:13.588939 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:33:15.011106 1.705387 tcp 10.0.2.105 62964 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:33:16.716702 3.000786 tcp 10.0.2.105 62965 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:33:25.726167 0.000000 tcp 10.0.2.105 62965 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:37:33.225154 3.000873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:37:40.235182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:37:48.233554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:38:04.236816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:38:31.890835 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:38:31.890936 2.957911 tcp 10.0.2.105 62966 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:38:36.370673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:38:40.774672 0.000000 tcp 10.0.2.105 62966 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:38:46.721870 0.061439 tcp 10.0.2.105 62967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:38:46.783627 0.061272 tcp 10.0.2.105 62968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:38:46.845130 0.152924 tcp 10.0.2.105 62969 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:38:47.350342 3.002331 tcp 10.0.2.105 62970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:38:56.351487 0.000000 tcp 10.0.2.105 62970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:02.350782 0.060670 tcp 10.0.2.105 62971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:02.411389 0.061366 tcp 10.0.2.105 62972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:02.473075 0.156250 tcp 10.0.2.105 62973 -> 195.113.214.249 443 SRPA* 0 0 35 17596 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:02.800484 0.350390 tcp 10.0.2.105 62974 -> 46.48.223.67 15494 SPA_* 0 0 9 1005 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:10.935412 0.560322 tcp 10.0.2.105 62974 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:10.936167 0.059733 tcp 10.0.2.105 62975 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:10.996340 0.062442 tcp 10.0.2.105 62976 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:11.059091 0.151318 tcp 10.0.2.105 62977 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:11.495947 2.991560 tcp 10.0.2.105 62978 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:21.518387 0.000000 tcp 10.0.2.105 62978 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:27.447001 0.062246 tcp 10.0.2.105 62979 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:27.509612 0.064829 tcp 10.0.2.105 62980 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:27.574756 0.155780 tcp 10.0.2.105 62981 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:27.971569 2.960555 tcp 10.0.2.105 62982 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:36.861964 0.000000 tcp 10.0.2.105 62982 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:42.792047 2.965380 tcp 10.0.2.105 62983 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:51.686133 0.000000 tcp 10.0.2.105 62983 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:39:56.195344 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:39:57.615797 1.723466 tcp 10.0.2.105 62984 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:39:59.339082 2.968917 tcp 10.0.2.105 62985 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:40:08.236604 0.000000 tcp 10.0.2.105 62985 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:44:40.258627 3.006168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:44:47.265574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:44:55.270925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:45:11.270286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:45:13.774710 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:45:13.774859 2.993738 tcp 10.0.2.105 62986 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:45:22.776454 0.000000 tcp 10.0.2.105 62986 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:45:28.782012 0.062592 tcp 10.0.2.105 62987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:28.844905 0.061710 tcp 10.0.2.105 62988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:28.906847 0.156442 tcp 10.0.2.105 62989 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:29.299762 3.001001 tcp 10.0.2.105 62990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:45:38.299386 0.000000 tcp 10.0.2.105 62990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:45:43.276491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:45:44.298559 0.061796 tcp 10.0.2.105 62991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:44.360672 0.061237 tcp 10.0.2.105 62992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:44.422275 0.149294 tcp 10.0.2.105 62993 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:44.731537 2.099236 tcp 10.0.2.105 62994 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:46.461232 0.063662 tcp 10.0.2.105 62995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:46.525203 0.061493 tcp 10.0.2.105 62996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:46.586935 0.153981 tcp 10.0.2.105 62997 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:45:46.831058 3.004951 tcp 10.0.2.105 62998 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:45:55.834722 0.000000 tcp 10.0.2.105 62998 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:01.824109 0.061164 tcp 10.0.2.105 62999 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:46:01.885575 0.060791 tcp 10.0.2.105 63000 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:46:01.946623 0.150563 tcp 10.0.2.105 63001 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:46:02.450910 2.997501 tcp 10.0.2.105 63002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:11.457261 0.000000 tcp 10.0.2.105 63002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:17.446102 2.994010 tcp 10.0.2.105 63003 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:26.438658 0.000000 tcp 10.0.2.105 63003 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:31.085115 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:46:32.447478 1.785868 tcp 10.0.2.105 63004 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:46:34.233664 3.000496 tcp 10.0.2.105 63005 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:46:43.232686 0.000000 tcp 10.0.2.105 63005 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:54:51.286615 3.002258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 18:54:58.294636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:55:06.295831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:55:22.299207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:55:26.415527 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:55:26.415679 0.254900 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:26.636169 0.126034 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:26.978604 0.073469 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:27.035596 0.358434 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:27.362396 0.173840 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:27.529107 0.178747 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:27.676116 0.075335 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 1967 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:27.835648 0.173692 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.070148 0.081559 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.142630 0.215877 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.348056 0.045295 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.439673 0.110882 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.515522 0.175596 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.688015 0.146314 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1737 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:28.818320 0.127970 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:29.061450 0.173086 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:30.343298 0.182696 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:30.521224 0.170574 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:31.036645 0.167866 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:31.327264 0.173392 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:31.497585 0.053245 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:31.659934 0.399448 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:32.038633 0.147806 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:32.174705 0.236048 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:32.390279 0.216856 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:32.657661 0.536070 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:33.151623 0.142235 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:33.328972 0.187531 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:33.513248 0.161531 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:33.724920 0.214702 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:33.931126 0.218115 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:34.126727 0.075735 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:34.254551 0.186226 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:34.257632 2.992417 tcp 10.0.2.105 63006 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:55:34.396963 0.188626 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:34.638616 0.336326 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:34.935431 0.052591 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:35.008148 0.000000 udp 10.0.2.105 7010 -> 99.106.123.19 8089 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 18:55:43.249247 0.000000 tcp 10.0.2.105 63006 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:55:49.260085 0.064453 tcp 10.0.2.105 63007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:49.324841 0.063158 tcp 10.0.2.105 63008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:49.388272 0.151490 tcp 10.0.2.105 63009 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:49.635858 2.996966 tcp 10.0.2.105 63010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:55:53.203778 0.061532 tcp 10.0.2.105 63011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:53.265626 0.060972 tcp 10.0.2.105 63012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:53.326990 0.153964 tcp 10.0.2.105 63013 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:55:53.481452 0.252925 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:53.659765 0.225896 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:53.914081 0.456019 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/13 18:55:54.305815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 18:55:58.631413 0.000000 tcp 10.0.2.105 63010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:04.630749 0.060794 tcp 10.0.2.105 63014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:04.691854 0.060431 tcp 10.0.2.105 63015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:04.752598 0.153668 tcp 10.0.2.105 63016 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:04.964446 2.252544 tcp 10.0.2.105 63017 -> 46.48.223.67 15494 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:06.760575 0.060086 tcp 10.0.2.105 63018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:06.820972 0.060738 tcp 10.0.2.105 63019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:06.881995 0.150981 tcp 10.0.2.105 63020 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:07.217153 3.000439 tcp 10.0.2.105 63021 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:16.231901 0.000000 tcp 10.0.2.105 63021 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:22.217401 0.064362 tcp 10.0.2.105 63022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:22.282140 0.064413 tcp 10.0.2.105 63023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:22.346908 0.148919 tcp 10.0.2.105 63024 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:22.782976 2.997418 tcp 10.0.2.105 63025 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:31.778322 0.000000 tcp 10.0.2.105 63025 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:37.777627 3.004210 tcp 10.0.2.105 63026 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:46.780451 0.000000 tcp 10.0.2.105 63026 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:56:51.589013 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 18:56:52.779333 1.708929 tcp 10.0.2.105 63027 -> 46.48.223.67 15494 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/13 18:56:54.483414 3.002340 tcp 10.0.2.105 63028 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 18:57:03.484465 0.000000 tcp 10.0.2.105 63028 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:01:58.311352 3.002282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:02:05.318060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:02:09.484791 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:02:09.484897 2.994002 tcp 10.0.2.105 63029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:13.319920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:02:18.477389 0.000000 tcp 10.0.2.105 63029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:24.488653 0.062231 tcp 10.0.2.105 63030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:24.551158 0.061048 tcp 10.0.2.105 63031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:24.612570 0.149951 tcp 10.0.2.105 63032 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:24.772063 2.998924 tcp 10.0.2.105 63033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:29.323085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:02:33.769539 0.000000 tcp 10.0.2.105 63033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:39.768843 0.064951 tcp 10.0.2.105 63034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:39.834061 0.063484 tcp 10.0.2.105 63035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:39.897871 0.150779 tcp 10.0.2.105 63036 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:40.058333 2.022559 tcp 10.0.2.105 63037 -> 46.48.223.67 15494 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:41.787985 0.065439 tcp 10.0.2.105 63038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:41.853740 0.062189 tcp 10.0.2.105 63039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:41.916209 0.148439 tcp 10.0.2.105 63040 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:42.081150 3.004608 tcp 10.0.2.105 63041 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:51.084307 0.000000 tcp 10.0.2.105 63041 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:02:57.073570 0.062604 tcp 10.0.2.105 63042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:57.136636 0.064129 tcp 10.0.2.105 63043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:57.201087 0.149898 tcp 10.0.2.105 63044 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:02:57.372645 3.005069 tcp 10.0.2.105 63045 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:03:01.328955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:03:06.386563 0.000000 tcp 10.0.2.105 63045 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:03:12.365289 2.993998 tcp 10.0.2.105 63046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:03:21.357749 0.000000 tcp 10.0.2.105 63046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:03:26.084337 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:03:27.366437 1.716426 tcp 10.0.2.105 63047 -> 46.48.223.67 15494 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:03:29.083057 3.000393 tcp 10.0.2.105 63048 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:03:38.082103 0.000000 tcp 10.0.2.105 63048 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:08:44.082448 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:08:44.082672 3.003413 tcp 10.0.2.105 63049 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:08:53.084953 0.000000 tcp 10.0.2.105 63049 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:08:59.085123 0.062027 tcp 10.0.2.105 63050 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:08:59.147448 0.060047 tcp 10.0.2.105 63051 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:08:59.207835 0.154640 tcp 10.0.2.105 63052 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:08:59.477087 3.001464 tcp 10.0.2.105 63053 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:05.335459 3.001288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:09:08.486853 0.000000 tcp 10.0.2.105 63053 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:12.342656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:09:14.476175 0.063835 tcp 10.0.2.105 63054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:14.540351 0.060417 tcp 10.0.2.105 63055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:14.601086 0.153365 tcp 10.0.2.105 63056 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:14.903999 0.380051 tcp 10.0.2.105 63057 -> 46.48.223.67 15494 SPA_* 0 0 9 1085 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:20.343835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:09:22.513421 0.781881 tcp 10.0.2.105 63057 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:22.514219 0.060624 tcp 10.0.2.105 63058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:22.575185 0.061652 tcp 10.0.2.105 63059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:22.637093 0.148921 tcp 10.0.2.105 63060 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:23.295587 2.997112 tcp 10.0.2.105 63061 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:32.290960 0.000000 tcp 10.0.2.105 63061 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:36.346990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:09:38.290556 0.060246 tcp 10.0.2.105 63062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:38.351094 0.062496 tcp 10.0.2.105 63063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:38.413958 0.148842 tcp 10.0.2.105 63064 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:09:38.890307 3.004674 tcp 10.0.2.105 63065 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:47.893707 0.000000 tcp 10.0.2.105 63065 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:09:53.892411 3.004122 tcp 10.0.2.105 63066 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:10:02.895239 0.000000 tcp 10.0.2.105 63066 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:10:07.591896 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:10:08.353084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:10:08.894078 1.753305 tcp 10.0.2.105 63067 -> 46.48.223.67 15494 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:10:10.647606 3.003139 tcp 10.0.2.105 63068 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:10:19.649284 0.000000 tcp 10.0.2.105 63068 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:15:25.649944 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:15:25.650114 3.003218 tcp 10.0.2.105 63069 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:15:34.652171 0.000000 tcp 10.0.2.105 63069 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:15:40.652848 0.061081 tcp 10.0.2.105 63070 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:40.714281 0.060786 tcp 10.0.2.105 63071 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:40.775457 0.154574 tcp 10.0.2.105 63072 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:41.264639 3.001286 tcp 10.0.2.105 63073 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:15:50.264947 0.000000 tcp 10.0.2.105 63073 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:15:56.264690 0.060149 tcp 10.0.2.105 63074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:56.325153 0.060873 tcp 10.0.2.105 63075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:56.386337 0.152438 tcp 10.0.2.105 63076 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:56.989571 2.081509 tcp 10.0.2.105 63077 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:58.758866 0.061147 tcp 10.0.2.105 63078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:58.820380 0.060130 tcp 10.0.2.105 63079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:58.880856 0.147898 tcp 10.0.2.105 63080 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:15:59.071313 3.000117 tcp 10.0.2.105 63081 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:08.069675 0.000000 tcp 10.0.2.105 63081 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:12.359085 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:16:14.069553 0.061226 tcp 10.0.2.105 63082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:16:14.131082 0.062260 tcp 10.0.2.105 63083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:16:14.193642 0.148618 tcp 10.0.2.105 63084 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:16:14.614785 2.999023 tcp 10.0.2.105 63085 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:19.366707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:16:23.612630 0.000000 tcp 10.0.2.105 63085 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:27.368027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:16:29.611223 3.004384 tcp 10.0.2.105 63086 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:38.614841 0.000000 tcp 10.0.2.105 63086 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:43.371048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:16:43.591193 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:16:44.613127 1.754569 tcp 10.0.2.105 63087 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:16:46.367956 3.001799 tcp 10.0.2.105 63088 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:16:55.368044 0.000000 tcp 10.0.2.105 63088 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:17:15.376964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:23:19.382540 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 19:23:26.390437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:23:34.392131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:23:50.394955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:24:22.400850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:26:13.100443 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:26:13.100597 0.000000 udp 10.0.2.105 7010 -> 99.106.123.19 8089 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 19:26:29.586019 0.060725 tcp 10.0.2.105 63089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:29.647015 0.061486 tcp 10.0.2.105 63090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:29.708789 0.149819 tcp 10.0.2.105 63091 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:29.858877 0.253171 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:30.075769 0.357242 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:30.797528 0.123857 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:30.901897 0.075965 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.010625 0.073552 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.069090 0.174272 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.276807 0.082043 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.349218 0.177512 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.397162 2.993409 tcp 10.0.2.105 63092 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:26:31.724906 0.172702 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.870151 0.047499 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:31.964780 0.210012 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 1982 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:32.165671 0.114962 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:32.259284 0.176459 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:32.432916 0.115642 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:32.839653 0.129689 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:32.969214 0.182501 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:33.262989 0.171920 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:33.493229 0.174161 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:33.642383 0.175674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:33.815420 0.170221 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:33.982633 0.403136 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:34.364045 0.055971 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:34.518533 0.142867 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:34.653470 0.232718 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:34.866609 0.378694 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:35.213756 0.147103 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:35.453630 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 19:26:40.389271 0.000000 tcp 10.0.2.105 63092 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:26:46.398587 0.060014 tcp 10.0.2.105 63093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:46.458870 0.062342 tcp 10.0.2.105 63094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:46.521489 0.157757 tcp 10.0.2.105 63095 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:46.691124 3.001750 tcp 10.0.2.105 63096 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:26:54.260359 0.065452 tcp 10.0.2.105 63097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:54.326142 0.062230 tcp 10.0.2.105 63098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:54.388157 0.151215 tcp 10.0.2.105 63099 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:26:54.539975 0.189015 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:54.726528 0.163320 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:55.363093 0.216535 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:55.554943 0.215812 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:55.694267 0.000000 tcp 10.0.2.105 63096 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:26:55.834684 0.226234 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:56.014996 0.072661 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:56.324718 0.187846 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:56.509812 0.063680 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:56.754462 0.276477 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:57.182241 0.280973 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:57.444402 0.238938 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:26:57.675320 0.445994 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:27:01.690735 0.061277 tcp 10.0.2.105 63100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:27:01.752473 0.063454 tcp 10.0.2.105 63101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:27:01.816352 0.153700 tcp 10.0.2.105 63102 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:27:02.391759 3.003724 tcp 10.0.2.105 63103 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:27:11.393840 0.000000 tcp 10.0.2.105 63103 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:27:17.392875 3.003778 tcp 10.0.2.105 63104 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:27:26.395374 0.000000 tcp 10.0.2.105 63104 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:27:31.092109 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:30:26.407858 3.000891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:30:33.414330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:30:41.415841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:30:57.419142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:31:29.435246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:32:32.395851 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:32:32.396036 2.997594 tcp 10.0.2.105 63105 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:32:41.388263 0.000000 tcp 10.0.2.105 63105 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:32:47.399307 0.062876 tcp 10.0.2.105 63106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:32:47.462519 0.062122 tcp 10.0.2.105 63107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:32:47.524977 0.150976 tcp 10.0.2.105 63108 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:32:50.606322 2.999477 tcp 10.0.2.105 63109 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:32:59.604757 0.000000 tcp 10.0.2.105 63109 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:33:05.604123 0.060177 tcp 10.0.2.105 63110 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:05.664659 0.061691 tcp 10.0.2.105 63111 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:05.726619 0.147907 tcp 10.0.2.105 63112 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:06.588495 0.356918 tcp 10.0.2.105 63113 -> 46.48.223.67 15494 SPA_* 0 0 9 1153 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:20.957068 0.591657 tcp 10.0.2.105 63113 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:20.957953 0.059338 tcp 10.0.2.105 63114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:21.017634 0.061917 tcp 10.0.2.105 63115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:21.079823 0.151033 tcp 10.0.2.105 63116 -> 195.113.214.249 443 SRPA* 0 0 40 20888 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:21.548957 3.001537 tcp 10.0.2.105 63117 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:33:30.552085 0.000000 tcp 10.0.2.105 63117 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:33:36.548595 0.063946 tcp 10.0.2.105 63118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:36.612822 0.061784 tcp 10.0.2.105 63119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:36.674933 0.153700 tcp 10.0.2.105 63120 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:33:36.922108 3.000351 tcp 10.0.2.105 63121 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:33:45.921870 0.000000 tcp 10.0.2.105 63121 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:33:51.919914 3.005499 tcp 10.0.2.105 63122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:34:00.923527 0.000000 tcp 10.0.2.105 63122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:34:05.593250 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:34:06.923195 1.755204 tcp 10.0.2.105 63123 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:34:08.678550 2.999650 tcp 10.0.2.105 63124 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:34:17.688635 0.000000 tcp 10.0.2.105 63124 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:37:33.441336 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:37:40.448319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:37:48.449863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:38:04.452893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:38:36.458909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:39:23.677657 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:39:23.677830 3.005424 tcp 10.0.2.105 63125 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:39:32.679771 0.000000 tcp 10.0.2.105 63125 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:39:38.680100 0.062992 tcp 10.0.2.105 63126 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:38.743352 0.061297 tcp 10.0.2.105 63127 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:38.804921 0.155476 tcp 10.0.2.105 63128 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:39.396131 2.997406 tcp 10.0.2.105 63129 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:39:49.162494 0.000000 tcp 10.0.2.105 63129 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:39:55.086220 0.064138 tcp 10.0.2.105 63130 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:55.150706 0.060678 tcp 10.0.2.105 63131 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:55.211617 0.153093 tcp 10.0.2.105 63132 -> 195.113.214.249 443 SRPA* 0 0 42 36106 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:39:55.500642 0.350628 tcp 10.0.2.105 63133 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:06.826761 0.854712 tcp 10.0.2.105 63133 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:06.827506 0.063694 tcp 10.0.2.105 63134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:06.891497 0.060590 tcp 10.0.2.105 63135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:06.952542 0.149813 tcp 10.0.2.105 63136 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:07.681729 2.977036 tcp 10.0.2.105 63137 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:16.580969 0.000000 tcp 10.0.2.105 63137 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:22.504017 0.063599 tcp 10.0.2.105 63138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:22.567904 0.062653 tcp 10.0.2.105 63139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:22.630820 0.149163 tcp 10.0.2.105 63140 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:23.149722 2.970428 tcp 10.0.2.105 63141 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:32.044158 0.000000 tcp 10.0.2.105 63141 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:37.969826 2.956575 tcp 10.0.2.105 63142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:46.861172 0.000000 tcp 10.0.2.105 63142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:40:51.589114 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:40:52.794789 1.751664 tcp 10.0.2.105 63143 -> 46.48.223.67 15494 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:40:54.546694 2.995040 tcp 10.0.2.105 63144 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:41:03.542991 0.000000 tcp 10.0.2.105 63144 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:44:40.464442 3.002396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:44:47.472693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:44:55.473697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:45:11.477043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:45:43.482935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:46:09.541210 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:46:09.541336 3.003303 tcp 10.0.2.105 63145 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:18.543422 0.000000 tcp 10.0.2.105 63145 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:24.544215 0.061831 tcp 10.0.2.105 63146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:24.606332 0.061632 tcp 10.0.2.105 63147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:24.668265 0.154413 tcp 10.0.2.105 63148 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:25.040825 3.009587 tcp 10.0.2.105 63149 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:34.045483 0.000000 tcp 10.0.2.105 63149 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:40.034706 0.060138 tcp 10.0.2.105 63150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:40.095159 0.063910 tcp 10.0.2.105 63151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:40.159378 0.154096 tcp 10.0.2.105 63152 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:40.485757 2.896910 tcp 10.0.2.105 63153 -> 46.48.223.67 15494 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:42.422560 0.064741 tcp 10.0.2.105 63154 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:42.487621 0.063761 tcp 10.0.2.105 63155 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:42.551753 0.149280 tcp 10.0.2.105 63156 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:43.383107 3.000276 tcp 10.0.2.105 63157 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:52.381836 0.000000 tcp 10.0.2.105 63157 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:46:58.381329 0.061772 tcp 10.0.2.105 63158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:58.443388 0.065088 tcp 10.0.2.105 63159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:58.508753 0.150513 tcp 10.0.2.105 63160 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:46:58.678801 3.006405 tcp 10.0.2.105 63161 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:47:07.683874 0.000000 tcp 10.0.2.105 63161 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:47:13.672954 3.003788 tcp 10.0.2.105 63162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:47:22.675377 0.000000 tcp 10.0.2.105 63162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:47:27.592843 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:47:28.674213 1.793855 tcp 10.0.2.105 63163 -> 46.48.223.67 15494 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:47:30.468411 3.002820 tcp 10.0.2.105 63164 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:47:39.469418 0.000000 tcp 10.0.2.105 63164 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:52:45.474013 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:52:45.474214 3.007869 tcp 10.0.2.105 63165 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:52:54.479666 0.000000 tcp 10.0.2.105 63165 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:00.474711 0.068119 tcp 10.0.2.105 63166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:00.543106 0.060697 tcp 10.0.2.105 63167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:00.604157 0.150411 tcp 10.0.2.105 63168 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:01.183430 2.274827 tcp 10.0.2.105 63169 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:02.932111 0.065119 tcp 10.0.2.105 63170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:02.997498 0.063481 tcp 10.0.2.105 63171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:03.061274 0.152089 tcp 10.0.2.105 63172 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:03.458471 2.991262 tcp 10.0.2.105 63173 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:12.449196 0.000000 tcp 10.0.2.105 63173 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:18.451465 0.061692 tcp 10.0.2.105 63174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:18.513498 0.061679 tcp 10.0.2.105 63175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:18.575466 0.152330 tcp 10.0.2.105 63176 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:18.755508 2.996284 tcp 10.0.2.105 63177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:27.750631 0.000000 tcp 10.0.2.105 63177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:33.751261 1.826712 tcp 10.0.2.105 63178 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:53:35.578236 3.007745 tcp 10.0.2.105 63179 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:53:44.584566 0.000000 tcp 10.0.2.105 63179 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:54:52.497997 2.998695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 19:54:59.502473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:55:07.503790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:55:23.506928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:55:55.512911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 19:57:08.087654 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:57:08.087809 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 19:57:23.951874 0.064869 tcp 10.0.2.105 63180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:24.017057 0.064499 tcp 10.0.2.105 63181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:24.081799 0.148150 tcp 10.0.2.105 63182 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:24.230502 0.387620 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:24.581641 0.071589 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:24.637383 0.075132 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:24.793775 0.172365 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:24.958812 0.080353 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.060606 0.354085 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.388895 0.125792 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.495373 0.047476 udp 10.0.2.105 7010 <-> 79.227.129.202 2430 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.603507 0.216315 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.809151 0.173237 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:25.956714 0.175909 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:26.103088 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 19:57:43.638921 0.064536 tcp 10.0.2.105 63183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:43.703731 0.062048 tcp 10.0.2.105 63184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:43.765690 0.151194 tcp 10.0.2.105 63185 -> 195.113.214.249 443 SRPA* 0 0 33 22252 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:57:43.917472 0.127221 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.044564 0.181816 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.308650 0.176335 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.482293 0.111386 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.560649 0.174569 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.732422 0.169342 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:44.898997 0.410204 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:45.289814 0.172029 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:45.440645 0.174318 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:45.677028 0.213734 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:45.891096 0.053733 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:45.944857 0.142238 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:46.079044 0.238661 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:46.296297 0.313664 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:46.571930 0.187561 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:46.759337 0.167357 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:46.967206 0.212876 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:47.157237 0.215901 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:47.365917 0.220386 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:47.601610 0.065687 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:47.666910 0.339548 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:47.966700 0.192203 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:48.155814 0.072900 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:48.363976 0.464871 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:48.808133 0.125577 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:57:49.239513 0.229242 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/13 19:58:50.574867 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 19:58:50.575063 2.993966 tcp 10.0.2.105 63186 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:58:59.577321 0.000000 tcp 10.0.2.105 63186 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:05.577148 0.061149 tcp 10.0.2.105 63187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:05.638588 0.060292 tcp 10.0.2.105 63188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:05.699298 0.154067 tcp 10.0.2.105 63189 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:05.873922 2.996248 tcp 10.0.2.105 63190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:14.869637 0.000000 tcp 10.0.2.105 63190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:20.868636 0.063942 tcp 10.0.2.105 63191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:20.932840 0.060816 tcp 10.0.2.105 63192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:20.993946 0.146361 tcp 10.0.2.105 63193 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:21.166532 2.124877 tcp 10.0.2.105 63194 -> 46.48.223.67 15494 FSPA* 0 0 14 1668 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:22.967899 0.060157 tcp 10.0.2.105 63195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:23.028343 0.060342 tcp 10.0.2.105 63196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:23.088945 0.148936 tcp 10.0.2.105 63197 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:23.291641 3.004400 tcp 10.0.2.105 63198 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:32.294775 0.000000 tcp 10.0.2.105 63198 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:38.294050 0.064394 tcp 10.0.2.105 63199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:38.358736 0.060432 tcp 10.0.2.105 63200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:38.419485 0.155864 tcp 10.0.2.105 63201 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/13 19:59:38.587959 2.999920 tcp 10.0.2.105 63202 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:47.596888 0.000000 tcp 10.0.2.105 63202 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 19:59:53.585249 2.994347 tcp 10.0.2.105 63203 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:00:02.577876 0.000000 tcp 10.0.2.105 63203 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:00:07.084527 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:00:08.586978 0.651177 tcp 10.0.2.105 63204 -> 46.48.223.67 15494 SPA_* 0 0 9 1138 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:00:21.415434 0.000371 tcp 10.0.2.105 63204 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:00:21.416070 2.993505 tcp 10.0.2.105 63205 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:00:30.408053 0.000000 tcp 10.0.2.105 63205 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:01:59.519043 3.001635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 20:02:06.526239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:02:14.527799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:02:30.530902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:03:02.537121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:05:36.418461 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:05:36.418631 3.003995 tcp 10.0.2.105 63206 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:05:45.420969 0.000000 tcp 10.0.2.105 63206 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:05:51.421765 0.060960 tcp 10.0.2.105 63207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:05:51.483060 0.064573 tcp 10.0.2.105 63208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:05:51.547930 0.154496 tcp 10.0.2.105 63209 -> 195.113.214.249 443 SRPA* 0 0 31 15376 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:05:51.723033 3.001446 tcp 10.0.2.105 63210 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:00.722962 0.000000 tcp 10.0.2.105 63210 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:06.722187 0.063988 tcp 10.0.2.105 63211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:06.786475 0.061377 tcp 10.0.2.105 63212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:06.847733 0.157418 tcp 10.0.2.105 63213 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:07.041973 4.993788 tcp 10.0.2.105 63214 -> 46.48.223.67 15494 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:11.684068 0.061239 tcp 10.0.2.105 63215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:11.745588 0.061132 tcp 10.0.2.105 63216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:11.807025 0.152652 tcp 10.0.2.105 63217 -> 195.113.214.249 443 SRPA* 0 0 28 13768 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:12.036004 2.997598 tcp 10.0.2.105 63218 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:21.032240 0.000000 tcp 10.0.2.105 63218 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:27.030996 0.061124 tcp 10.0.2.105 63219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:27.092398 0.060022 tcp 10.0.2.105 63220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:27.152706 0.152158 tcp 10.0.2.105 63221 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:27.350052 3.005474 tcp 10.0.2.105 63222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:36.353707 0.000000 tcp 10.0.2.105 63222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:42.343072 3.004325 tcp 10.0.2.105 63223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:51.355786 0.000000 tcp 10.0.2.105 63223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:06:56.082690 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:06:57.344704 2.528350 tcp 10.0.2.105 63224 -> 46.48.223.67 15494 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:06:59.872905 2.999567 tcp 10.0.2.105 63225 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:07:08.870825 0.000000 tcp 10.0.2.105 63225 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:09:06.543497 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 20:09:13.550149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:09:21.551586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:09:37.555091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:10:09.562882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:12:14.871604 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:12:14.871813 3.003323 tcp 10.0.2.105 63226 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:12:23.873689 0.000000 tcp 10.0.2.105 63226 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/13 20:12:29.874289 0.061760 tcp 10.0.2.105 63227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:12:29.936394 0.061721 tcp 10.0.2.105 63228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:12:29.998420 0.145991 tcp 10.0.2.105 63229 -> 195.113.214.249 443 SRPA* 0 0 42 35858 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:12:30.638575 0.639994 tcp 10.0.2.105 63230 -> 31.192.24.67 3527 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:16:13.566578 3.003104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 20:16:20.574189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:16:28.575780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:16:44.578982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:17:16.584329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:23:20.591318 3.007638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 20:23:27.598878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:23:35.599809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:23:51.602578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:24:23.608850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:27:55.964543 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:27:55.964716 0.073795 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:56.038988 0.358735 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:56.398104 0.070457 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:56.468959 0.059206 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:56.528602 0.412512 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:56.941476 0.165750 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:57.107599 0.071115 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:57.179109 0.202696 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:57.382253 0.144432 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:27:57.527106 0.000000 udp 10.0.2.105 7010 -> 79.227.129.202 2430 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 20:28:14.092597 0.064102 tcp 10.0.2.105 63231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:14.156983 0.063912 tcp 10.0.2.105 63232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:14.221279 0.153166 tcp 10.0.2.105 63233 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:14.374999 0.104425 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:14.479779 0.146385 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:14.626593 0.125506 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:14.752640 0.083435 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:14.836561 0.175480 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:15.012453 0.170844 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:15.183755 0.372328 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:15.556606 0.165989 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:15.723026 0.163278 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:15.886749 0.144467 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.031592 0.147050 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.179045 0.177563 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.356984 0.043650 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.401029 0.232709 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.634160 0.132785 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.767300 0.212994 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:16.980738 0.191144 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:17.172318 0.205573 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:17.378317 0.183170 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:17.561949 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 20:28:35.351728 0.059991 tcp 10.0.2.105 63234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:35.412025 0.064008 tcp 10.0.2.105 63235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:35.476484 0.149651 tcp 10.0.2.105 63236 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:28:35.626684 0.081223 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:35.708278 0.066674 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:35.775324 0.407184 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:36.182930 0.183378 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:36.366676 0.065350 udp 10.0.2.105 7010 <-> 5.12.211.18 2760 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:36.432489 0.442251 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:36.875214 0.195709 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:28:37.071327 0.215562 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:30:27.614983 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 20:30:34.622137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:30:42.629402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:30:58.626599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:31:30.632751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:37:34.638648 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 20:37:41.646085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:37:49.648913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:38:05.650699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:38:37.656966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:42:31.285418 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:42:31.285598 0.916352 tcp 10.0.2.105 63237 -> 31.192.24.67 3527 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:44:41.662240 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 20:44:48.669847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:44:56.672012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:45:12.674278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:45:44.680642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:54:53.695898 3.000322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 20:55:00.699913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:55:08.701624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:55:24.704750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:55:56.710855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 20:58:51.402417 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 20:58:51.402609 0.000000 udp 10.0.2.105 7010 -> 79.227.129.202 2430 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 20:59:10.050440 0.061770 tcp 10.0.2.105 63238 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:10.112508 0.061224 tcp 10.0.2.105 63239 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:10.174118 0.153121 tcp 10.0.2.105 63240 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:10.327785 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 20:59:27.624333 0.061033 tcp 10.0.2.105 63241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:27.685641 0.063795 tcp 10.0.2.105 63242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:27.749739 0.149496 tcp 10.0.2.105 63243 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:27.899855 0.085621 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:27.985835 0.060322 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:28.046521 0.710447 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:28.757371 0.165198 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:28.922947 0.070598 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:28.993927 0.213709 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.208045 0.054973 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.263464 0.145933 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.409785 0.200574 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.610787 0.125359 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.736597 0.081133 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.818138 0.175441 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:29.994032 0.173533 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.167910 0.144856 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.313161 0.104589 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.418102 0.163468 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.581966 0.146760 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.729118 0.146634 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:30.876147 0.229325 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:31.105874 0.366328 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:31.472609 0.131977 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:31.604951 0.213446 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:31.818836 0.190152 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:32.009400 0.180346 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:32.190096 0.044680 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:32.235127 0.052557 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:32.288055 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 20:59:47.633417 0.060380 tcp 10.0.2.105 63244 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:47.694074 0.061320 tcp 10.0.2.105 63245 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:47.755716 0.150330 tcp 10.0.2.105 63246 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/13 20:59:47.906615 0.180367 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:48.087335 0.083836 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/13 20:59:48.171631 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 21:00:04.232607 0.059452 tcp 10.0.2.105 63247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:04.292442 0.061024 tcp 10.0.2.105 63248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:04.353823 0.153524 tcp 10.0.2.105 63249 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:04.508025 0.280803 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:00:04.789307 0.419040 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:00:05.208832 0.195202 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:00:05.404593 0.181130 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:00:05.586075 0.000000 udp 10.0.2.105 7010 -> 5.12.211.18 2760 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 21:00:24.436434 0.059717 tcp 10.0.2.105 63250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:24.496554 0.061885 tcp 10.0.2.105 63251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:24.558723 0.152909 tcp 10.0.2.105 63252 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:00:24.712149 0.214386 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:02:00.717223 3.001311 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/13 21:02:07.723978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:02:15.725525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:02:31.728680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:03:03.734810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:09:07.742679 2.999629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:09:14.749339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:09:22.749826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:09:38.752642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:10:10.758832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:12:32.202184 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 21:12:32.202283 0.747366 tcp 10.0.2.105 63253 -> 31.192.24.67 3527 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:16:14.765700 3.000308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:16:21.771852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:16:29.773377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:16:45.776378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:17:17.782551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:23:21.789036 3.000618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:23:28.795662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:23:36.797615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:23:52.800186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:24:24.806240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:30:28.815194 3.017524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:30:30.017249 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 21:30:30.017403 0.207334 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:30:30.225136 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 21:30:35.829702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:30:43.831222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:30:46.747646 0.061957 tcp 10.0.2.105 63254 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:30:46.809900 0.066463 tcp 10.0.2.105 63255 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:30:46.876697 0.150793 tcp 10.0.2.105 63256 -> 195.113.214.249 443 SRPA* 0 0 51 24572 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:30:47.028427 0.000000 udp 10.0.2.105 7010 -> 5.12.211.18 2760 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 21:30:59.834186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:31:02.709183 0.061574 tcp 10.0.2.105 63257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:31:02.771088 0.062886 tcp 10.0.2.105 63258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:31:02.834218 0.158826 tcp 10.0.2.105 63259 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:31:02.993562 0.071960 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.065922 0.060303 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.280885 0.242737 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.524028 0.055467 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.579944 0.149388 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.729717 0.193016 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:03.923101 0.127224 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:04.050731 0.894999 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:04.946157 0.070982 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.017563 0.332295 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.350238 0.175805 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.526407 0.165143 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.692006 0.148827 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.841203 0.146091 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:05.987685 0.168948 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.157087 0.119629 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.277079 0.174003 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.451519 0.186331 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.638250 0.162189 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.800844 0.173682 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:06.974958 0.055588 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:07.030938 0.044831 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:07.076133 0.213468 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:07.289979 0.387953 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:07.678297 0.132497 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:07.811167 0.192202 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:08.003711 0.182476 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:08.186530 0.083406 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:08.270325 0.285172 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:08.555897 0.497716 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:09.054013 0.422643 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:09.493060 0.183547 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:09.676947 0.218094 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/13 21:31:31.840530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:37:35.846220 3.001896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:37:42.853780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:37:50.855399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:38:06.858395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:38:38.864351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:42:32.951241 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 21:42:32.951431 0.730918 tcp 10.0.2.105 63260 -> 31.192.24.67 3527 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/02/13 21:44:42.870686 3.001177 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:44:49.877720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:44:57.878734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:45:13.882736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:45:45.888641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:54:54.899445 3.003152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 21:55:01.908119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:55:09.909299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:55:25.912902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 21:55:57.918490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:01:23.076257 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 22:01:23.076435 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 22:01:38.980856 0.064331 tcp 10.0.2.105 63261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:01:39.045540 0.065803 tcp 10.0.2.105 63262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:01:39.111731 0.164627 tcp 10.0.2.105 63263 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:01:39.276928 0.095535 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.372898 0.055685 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.428967 0.146308 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.575700 0.195065 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.771201 0.126634 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.898236 0.059006 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:39.957647 0.475600 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:40.433604 0.078417 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:40.512466 0.070393 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:40.583271 0.165088 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:40.748778 0.146742 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:40.895942 0.147455 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.043767 0.168257 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.212625 0.329220 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.542262 0.175368 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.718027 0.107140 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.825569 0.172210 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:41.998172 0.145343 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.143949 0.162407 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.306693 0.174150 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.481224 0.044165 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.525781 0.048943 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.575097 0.135962 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.711462 0.194776 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:42.906653 0.180489 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:43.087531 0.211435 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:43.299382 0.378454 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:43.678238 0.368498 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:44.053098 0.318955 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:44.372424 0.396025 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:44.768949 0.214861 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:44.984158 0.422142 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:01:45.406740 0.183413 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:02:01.924933 3.000921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:02:08.931984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:02:16.933620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:02:32.936290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:03:04.942653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:09:08.948044 3.001634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:09:15.955572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:09:23.956748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:09:39.959944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:10:11.965881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:12:33.680243 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 22:12:33.680423 0.750732 tcp 10.0.2.105 63264 -> 31.192.24.67 3527 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:16:15.972056 3.002074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:16:22.979652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:16:30.981107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:16:46.983964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:17:18.991775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:23:22.996575 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:23:30.003801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:23:38.005350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:23:54.007526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:24:26.024192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:30:30.029557 3.002476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:30:37.041132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:30:45.039241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:31:01.042283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:31:33.048539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:32:08.179124 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 22:32:08.179246 0.208097 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:08.387760 0.084961 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:08.473161 0.061265 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:08.534883 0.150259 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:08.685547 0.193735 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:08.879639 0.125281 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.005306 0.059308 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.064965 0.288433 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.353802 0.084681 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.438858 0.146108 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.585342 0.145159 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.730939 0.170263 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:09.901610 0.317420 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.219396 0.070194 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.290017 0.163630 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.454099 0.177961 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.632491 0.110810 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.743759 0.172416 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:10.916581 0.145346 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.062322 0.162160 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.224846 0.176695 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.401919 0.046675 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.449033 0.096697 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.546171 0.131759 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.678304 0.190340 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:11.868997 0.368927 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:12.238397 0.187122 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:12.425916 0.183734 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:12.610037 0.212759 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:12.823146 0.273271 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:13.096752 0.199094 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:13.296241 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 22:32:31.754107 0.064114 tcp 10.0.2.105 63265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:32:31.818475 0.061020 tcp 10.0.2.105 63266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:32:31.879776 0.161797 tcp 10.0.2.105 63267 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:32:32.042119 0.651902 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:32:32.694475 0.181807 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/13 22:37:37.053814 3.002000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:37:44.061663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:37:52.062932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:38:08.068652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:38:40.072136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:42:34.439680 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 22:42:34.439940 0.670574 tcp 10.0.2.105 63268 -> 31.192.24.67 3527 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/13 22:44:44.078073 3.001173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:44:51.085801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:44:59.087164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:45:15.091975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:45:47.096072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:54:56.108364 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 22:55:03.115328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:55:11.117200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:55:27.120130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 22:55:59.127857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:02:03.131689 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:02:10.139143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:02:18.140932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:02:34.143993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:02:57.447939 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 23:02:57.448174 0.221308 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:57.669867 0.092121 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:57.762458 0.063227 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:57.826071 0.149219 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:57.975694 0.191590 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.167716 0.126255 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.294352 0.058315 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.353022 0.202519 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.556042 0.144415 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.700838 0.212324 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:58.913559 0.169439 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.083357 0.324092 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.407825 0.147271 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.555504 0.081243 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.637162 0.175258 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.812837 0.103131 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:02:59.916407 0.172755 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.089540 0.148967 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.238944 0.162109 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.401448 0.165146 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.567010 0.071098 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.638495 0.046506 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.685495 0.132454 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:00.818371 0.188139 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.006943 0.175641 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.182936 0.044116 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.227423 0.183413 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.411263 0.211275 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.622901 0.285455 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.908818 0.083138 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:01.992387 0.367243 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:02.360014 0.196164 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:02.556568 0.429249 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:02.986244 0.182537 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:03:06.149835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:09:10.155795 3.001832 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:09:17.163449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:09:25.164966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:09:41.167955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:10:13.174040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:12:35.118078 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 23:12:35.118278 0.670529 tcp 10.0.2.105 63269 -> 31.192.24.67 3527 FSPA* 0 0 14 1742 flow=From-Botnet-V2-TCP-Established 1970/02/13 23:16:17.180028 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:16:24.187559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:16:32.188706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:16:48.193316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:17:20.201012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:23:24.203939 3.001580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:23:31.210855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:23:39.215078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:23:55.218713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:24:27.228518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:30:31.228010 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:30:38.235436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:30:46.236942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:31:02.239674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:31:34.250091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:33:28.199736 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 23:33:28.199963 0.221387 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:28.421802 0.096129 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:28.518344 0.055060 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:28.573765 0.147533 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:28.721659 0.193695 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:28.915721 0.125488 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.041592 0.097688 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.139625 0.206649 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.346659 0.144933 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.491968 0.231166 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.723566 0.147633 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.871650 0.080229 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:29.952305 0.176237 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:30.128929 0.117365 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:30.293483 0.172608 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:30.466504 0.168781 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:30.635675 0.797967 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:31.433991 0.144194 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:31.578585 0.161507 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:31.740477 0.165587 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:31.906428 0.071611 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:31.978457 0.092672 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:32.071501 0.131581 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:32.203515 0.188400 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:32.392493 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/13 23:33:49.552484 0.060929 tcp 10.0.2.105 63270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/13 23:33:49.613751 0.062463 tcp 10.0.2.105 63271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/13 23:33:49.676552 0.141879 tcp 10.0.2.105 63272 -> 195.113.214.249 443 SRPA* 0 0 66 54259 flow=From-Botnet-V2-TCP-Established 1970/02/13 23:33:49.819135 0.044103 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:49.863635 1.276346 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:51.140471 0.096841 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:51.237725 0.391230 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:51.629329 0.183561 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:51.813613 0.212176 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:52.026444 0.180756 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:52.207592 0.390073 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:33:52.598061 0.516271 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/13 23:37:38.251732 3.002294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:37:45.259722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:37:53.261522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:38:09.264925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:38:41.271071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:42:35.788920 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/13 23:42:35.789028 0.584841 tcp 10.0.2.105 63273 -> 31.192.24.67 3527 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/02/13 23:44:45.275694 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:44:52.283278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:45:00.287707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:45:16.287806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:45:48.293963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:54:53.300510 3.001384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/13 23:55:00.307541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:55:08.309161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:55:24.312401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/13 23:55:56.318622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:02:00.324729 3.000985 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:02:07.331487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:02:15.333410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:02:31.336068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:03:03.342071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:03:53.784780 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 00:03:53.784890 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 00:04:12.323011 0.062946 tcp 10.0.2.105 63274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:04:12.386253 0.065586 tcp 10.0.2.105 63275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:04:12.452156 0.154119 tcp 10.0.2.105 63276 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:04:12.607008 0.056078 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:12.663482 0.145875 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:12.809811 0.199605 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.009796 0.126289 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.136467 0.183401 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.320331 0.212060 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.532795 0.102811 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.635987 0.144150 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:13.780699 0.297831 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.078919 0.146730 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.226077 0.078040 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.304564 0.203680 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.508682 0.176377 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.685496 0.105930 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.791776 0.172759 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:14.964935 0.168336 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.133671 0.144132 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.278211 0.162271 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.440896 0.164271 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.605590 0.079210 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.685228 0.045478 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.731104 0.134019 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:15.865589 0.620529 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:16.486499 0.190482 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:16.677469 0.050226 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:16.728111 0.256791 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:16.985251 0.095205 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:17.080838 0.370709 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:17.451917 0.182687 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:17.635038 0.210833 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:17.846264 0.181584 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:18.028365 0.225389 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:04:18.254117 0.546256 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:09:07.348624 3.000663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:09:14.355548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:09:22.357087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:09:38.360971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:10:10.365906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:12:36.376501 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 00:12:36.376692 0.663976 tcp 10.0.2.105 63277 -> 31.192.24.67 3527 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:16:14.371553 3.001962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:16:21.379437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:16:29.380391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:16:45.383822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:17:17.389482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:23:21.405332 3.002110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:23:28.415846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:23:36.415237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:23:52.419889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:24:24.423951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:30:28.430174 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:30:35.437422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:30:43.438858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:30:59.442046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:31:31.447878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:34:26.289530 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 00:34:26.289718 0.191113 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:26.481215 0.128247 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:26.609849 0.068837 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:26.679029 0.056220 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:26.735696 0.147813 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:26.883901 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 00:34:45.788903 0.063684 tcp 10.0.2.105 63278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:34:45.852898 0.069886 tcp 10.0.2.105 63279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:34:45.923086 0.159095 tcp 10.0.2.105 63280 -> 195.113.214.249 443 SRPA* 0 0 42 22688 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:34:46.082798 0.093303 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:46.176514 0.145819 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:46.322792 0.267306 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:34:46.590470 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 00:35:02.822395 0.066255 tcp 10.0.2.105 63281 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:35:02.888957 0.062139 tcp 10.0.2.105 63282 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:35:02.951380 0.167880 tcp 10.0.2.105 63283 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:35:03.119765 0.176532 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.296667 0.103826 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.400942 0.146267 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.547611 0.073250 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.621296 0.172715 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.794464 0.169100 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:03.963956 0.146442 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:04.110797 0.162494 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:04.345315 0.163915 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:04.509612 0.071903 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:04.581937 0.745313 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:05.327628 0.039506 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:05.367623 0.133745 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:05.501802 0.192589 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:05.694768 0.044216 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:05.739437 0.406664 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:06.146561 0.080865 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:06.227860 0.211763 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:06.439999 0.183574 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:06.623992 0.370845 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:06.995235 0.182589 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:07.178213 1.262298 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:35:08.440909 0.626799 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/14 00:37:35.453837 3.003457 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 00:37:42.461289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:37:51.228349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:38:07.037339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:38:38.656082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:42:37.045551 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 00:42:37.045710 0.816185 tcp 10.0.2.105 63284 -> 31.192.24.67 3527 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/02/14 00:44:42.488578 3.000947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:44:49.495309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:44:57.502048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:45:13.500784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:45:45.510937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:54:52.517776 2.998751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 00:54:59.524573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:55:07.523734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:55:23.527280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 00:55:55.533365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:01:59.539608 3.000778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:02:06.546108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:02:14.547713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:02:30.550958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:03:02.556904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:05:30.700067 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 01:05:30.700162 0.220253 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:30.920859 0.202865 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.124175 0.056790 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.181410 0.309399 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.491232 0.126085 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.617703 0.190948 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.809061 0.184000 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:31.993452 0.084870 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.078779 0.147498 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.226700 0.209125 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.436186 0.176180 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.612863 0.104172 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.717413 0.145992 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.863762 0.096935 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:32.961095 0.172559 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.134287 0.170275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.304913 0.146372 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.451719 0.071410 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.523582 0.162220 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.686217 0.165549 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:33.852158 0.427289 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.279801 0.042628 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.322867 0.133581 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.456840 0.189887 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.647173 0.041730 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.689330 0.257460 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:34.947149 0.084851 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:35.032570 0.379954 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:35.412925 0.183852 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:35.597177 0.211249 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:35.808844 0.183687 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:35.992906 0.174922 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:05:36.168239 0.473301 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:09:06.562897 3.001419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:09:13.570247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:09:21.573113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:09:37.574720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:10:09.580802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:12:37.864695 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 01:12:37.864898 0.623546 tcp 10.0.2.105 63285 -> 31.192.24.67 3527 FSPA* 0 0 14 1549 flow=From-Botnet-V2-TCP-Established 1970/02/14 01:16:13.587082 3.005995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:16:20.594052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:16:28.595608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:16:44.603428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:17:16.605580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:23:20.611443 3.064025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:23:27.647779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:23:35.629769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:23:51.632820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:24:23.639026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:30:27.644850 3.003714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:30:34.656409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:30:42.653977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:30:58.657096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:31:30.662896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:35:49.966071 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 01:35:49.966254 0.221177 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:35:50.187828 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 01:36:05.674340 0.062107 tcp 10.0.2.105 63286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 01:36:05.736726 0.062906 tcp 10.0.2.105 63287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 01:36:05.799943 0.142882 tcp 10.0.2.105 63288 -> 195.113.214.249 443 SRPA* 0 0 62 38593 flow=From-Botnet-V2-TCP-Established 1970/02/14 01:36:05.943363 0.058410 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.002636 0.147346 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.150426 0.128168 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.279039 0.203981 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.483410 0.216569 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.700558 0.078564 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.779463 0.145771 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:06.925590 0.208559 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.134531 0.175420 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.310325 0.105007 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.415725 0.147043 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.563159 0.084328 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.647994 0.173143 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.821553 0.169735 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:07.991680 0.144140 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.136216 0.085233 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.221908 0.162072 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.384434 0.165380 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.550258 0.328844 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.879479 0.043978 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:08.923840 0.133627 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.057815 0.188081 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.246361 0.048248 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.295024 0.273363 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.568772 0.084100 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.653317 0.212324 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:09.933808 0.187192 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:10.121430 0.171046 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:10.292848 0.376196 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:10.669482 0.184685 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:36:10.854579 0.524013 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/14 01:37:34.668699 3.029784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:37:41.686286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:37:49.687507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:38:05.691090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:38:37.696684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:42:38.493566 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 01:42:38.493664 0.702835 tcp 10.0.2.105 63289 -> 31.192.24.67 3527 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/14 01:44:41.705918 3.001492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:44:48.714218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:44:56.711583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:45:12.714605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:45:44.720963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:54:52.736724 2.996469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 01:54:59.738768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:55:07.740142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:55:23.743523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 01:55:55.749615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:01:59.755718 3.001181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 02:02:06.762775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:02:14.764182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:02:30.767445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:03:02.773255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:06:37.101731 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:06:37.101843 0.201773 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:37.304025 0.218124 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:37.522571 0.056790 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:37.579775 0.145396 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:37.725579 0.126199 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:37.852182 0.191807 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.044530 0.054570 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.099553 0.074034 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.173960 0.146143 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.320636 0.212409 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.533469 0.176126 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.710020 0.105095 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.815510 0.147764 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:38.963691 0.075152 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:39.039259 0.172185 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:39.211808 0.167146 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:39.379326 0.144940 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:39.524682 0.084094 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:39.609196 0.561032 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.170629 0.043088 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.214111 0.132437 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.346979 0.189120 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.536493 0.162602 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.699531 0.191719 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:40.891745 0.248668 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:41.140857 0.280668 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:41.421980 0.093872 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:41.516187 0.211462 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:41.728108 0.183574 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:41.912085 0.182956 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:42.095422 0.181924 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:42.277819 0.378094 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:06:42.656378 0.466178 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:09:06.778946 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 02:09:13.786429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:09:21.789505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:09:37.791298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:10:09.813068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:12:39.202438 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:12:39.202544 3.003459 tcp 10.0.2.105 63290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:12:48.204997 0.000000 tcp 10.0.2.105 63290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:12:54.205319 0.062167 tcp 10.0.2.105 63291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:54.267782 0.062874 tcp 10.0.2.105 63292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:54.330962 0.169414 tcp 10.0.2.105 63293 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:54.627866 4.654906 tcp 10.0.2.105 63294 -> 46.48.223.67 15494 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:57.719792 0.065308 tcp 10.0.2.105 63295 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:57.785415 0.061771 tcp 10.0.2.105 63296 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:57.847480 0.152921 tcp 10.0.2.105 63297 -> 195.113.214.249 443 SRPA* 0 0 24 13232 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:12:59.283010 3.002159 tcp 10.0.2.105 63298 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:08.283519 0.000000 tcp 10.0.2.105 63298 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:14.283431 0.062505 tcp 10.0.2.105 63299 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:14.346297 0.061919 tcp 10.0.2.105 63300 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:14.408447 0.160001 tcp 10.0.2.105 63301 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:14.805434 3.001830 tcp 10.0.2.105 63302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:23.815707 0.000000 tcp 10.0.2.105 63302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:29.805382 0.061986 tcp 10.0.2.105 63303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:29.867654 0.083006 tcp 10.0.2.105 63304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:29.950947 0.180950 tcp 10.0.2.105 63305 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:30.179937 2.989576 tcp 10.0.2.105 63306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:39.169183 0.000000 tcp 10.0.2.105 63306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:13:45.176872 1.395911 tcp 10.0.2.105 63307 -> 46.48.223.67 15494 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:52.258349 0.000373 tcp 10.0.2.105 63307 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:13:52.258960 3.002168 tcp 10.0.2.105 63308 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:14:01.259976 0.000000 tcp 10.0.2.105 63308 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:14:07.258762 3.004000 tcp 10.0.2.105 63309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:14:16.261548 0.000000 tcp 10.0.2.105 63309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:14:21.090525 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:16:13.812509 3.002178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 02:16:20.820206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:16:28.821893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:16:44.825109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:17:16.831141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:19:22.262147 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:19:22.262326 3.003243 tcp 10.0.2.105 63310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:19:31.264476 0.000000 tcp 10.0.2.105 63310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:19:37.265090 0.067456 tcp 10.0.2.105 63311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:19:37.332798 0.063606 tcp 10.0.2.105 63312 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:19:37.396833 0.161894 tcp 10.0.2.105 63313 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:19:37.738856 0.915355 tcp 10.0.2.105 63314 -> 46.48.223.67 15494 SPA_* 0 0 9 1114 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:08.649364 0.060931 tcp 10.0.2.105 63315 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:08.710604 0.063634 tcp 10.0.2.105 63316 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:08.774531 0.166867 tcp 10.0.2.105 63317 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:09.243975 0.373935 tcp 10.0.2.105 63314 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:09.244494 2.998691 tcp 10.0.2.105 63318 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:20:18.243440 0.000000 tcp 10.0.2.105 63318 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:20:24.242820 0.064965 tcp 10.0.2.105 63319 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:24.308066 0.063003 tcp 10.0.2.105 63320 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:24.371439 0.167712 tcp 10.0.2.105 63321 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:24.653097 3.002525 tcp 10.0.2.105 63322 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:20:33.654051 0.000000 tcp 10.0.2.105 63322 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:20:39.653240 0.385379 tcp 10.0.2.105 63323 -> 46.48.223.67 15494 SPA_* 0 0 9 1114 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:45.590583 0.000660 tcp 10.0.2.105 63323 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:20:45.591083 3.004294 tcp 10.0.2.105 63324 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:20:54.594220 0.000000 tcp 10.0.2.105 63324 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:23:20.838498 3.000191 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 02:23:27.845020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:23:35.845913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:23:51.848978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:24:23.854894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:26:00.594530 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:26:00.594761 2.994003 tcp 10.0.2.105 63325 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:26:09.596717 0.000000 tcp 10.0.2.105 63325 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:26:15.597723 0.063285 tcp 10.0.2.105 63326 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:26:15.661345 0.060051 tcp 10.0.2.105 63327 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:26:15.721663 0.157355 tcp 10.0.2.105 63328 -> 195.113.214.249 443 SRPA* 0 0 48 41970 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:26:16.085639 2.994858 tcp 10.0.2.105 63329 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:26:25.078896 0.000000 tcp 10.0.2.105 63329 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:30:27.860677 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 02:30:34.868576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:30:42.869947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:30:58.873046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:31:30.878971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:31:31.079645 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:31:31.079750 3.007198 tcp 10.0.2.105 63330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:31:40.082266 0.000000 tcp 10.0.2.105 63330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:31:46.084567 0.060616 tcp 10.0.2.105 63331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:31:46.145441 0.061821 tcp 10.0.2.105 63332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:31:46.207615 0.154001 tcp 10.0.2.105 63333 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:31:46.545166 3.004671 tcp 10.0.2.105 63334 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:31:55.544696 0.000000 tcp 10.0.2.105 63334 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:36:46.082926 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:36:46.083041 0.075255 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:46.139959 0.178101 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:46.315505 0.127301 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:46.718018 0.210444 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:46.918611 0.216982 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:47.128334 0.227040 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:47.375547 0.185558 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:47.546332 0.132973 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 925 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:47.839503 0.185346 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.001686 0.371817 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.339968 0.181471 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.517104 0.105339 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.621983 0.176638 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.795550 0.173690 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:48.966597 0.121958 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 1998 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:49.230976 0.187510 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:49.569018 0.184919 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:49.724518 0.094946 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:49.825767 0.356684 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.153939 0.082979 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.206099 0.168736 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.414760 0.173517 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.580595 0.148540 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.719402 0.223286 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:50.917865 0.056844 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:51.109532 0.768092 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:51.437562 0.146094 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:51.535223 0.187988 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:51.782497 0.497959 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:52.273537 0.234871 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:52.488825 0.190608 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:53.059128 0.410221 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:36:53.446996 0.450987 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/14 02:37:01.544698 2.999818 tcp 10.0.2.105 63335 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:10.537484 0.000000 tcp 10.0.2.105 63335 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:15.083733 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:37:16.547659 0.063383 tcp 10.0.2.105 63336 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:16.611346 0.063395 tcp 10.0.2.105 63337 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:16.674671 0.161073 tcp 10.0.2.105 63338 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:16.877011 2.994935 tcp 10.0.2.105 63339 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:25.869339 0.000000 tcp 10.0.2.105 63339 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:31.878635 0.061634 tcp 10.0.2.105 63340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:31.940565 0.067531 tcp 10.0.2.105 63341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:32.008587 0.168947 tcp 10.0.2.105 63342 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:32.435899 2.997408 tcp 10.0.2.105 63343 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:34.884912 3.001955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 02:37:41.431937 0.000000 tcp 10.0.2.105 63343 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:41.892728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:37:47.431259 0.060810 tcp 10.0.2.105 63344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:47.492391 0.062206 tcp 10.0.2.105 63345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:47.554974 0.160524 tcp 10.0.2.105 63346 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:37:47.935620 2.999783 tcp 10.0.2.105 63347 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:37:49.893977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:37:56.935077 0.000000 tcp 10.0.2.105 63347 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:38:02.932846 3.004139 tcp 10.0.2.105 63348 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:38:05.896968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:38:11.935043 0.000000 tcp 10.0.2.105 63348 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:38:16.582967 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:38:17.934423 2.994435 tcp 10.0.2.105 63349 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:38:26.937072 0.000000 tcp 10.0.2.105 63349 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:38:37.902837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:43:32.937898 0.000144 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:43:32.938147 3.006379 tcp 10.0.2.105 63350 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:43:41.940282 0.000000 tcp 10.0.2.105 63350 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:43:47.940670 0.069717 tcp 10.0.2.105 63351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:43:48.010668 0.064224 tcp 10.0.2.105 63352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:43:48.075201 0.202241 tcp 10.0.2.105 63353 -> 195.113.214.249 443 SRPA* 0 0 49 40566 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:43:48.390751 3.002368 tcp 10.0.2.105 63354 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:43:57.392139 0.000000 tcp 10.0.2.105 63354 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:03.391580 0.064297 tcp 10.0.2.105 63355 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:03.456226 0.064536 tcp 10.0.2.105 63356 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:03.521051 0.153950 tcp 10.0.2.105 63357 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:03.920431 3.005662 tcp 10.0.2.105 63358 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:12.924657 0.000000 tcp 10.0.2.105 63358 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:18.913185 0.063568 tcp 10.0.2.105 63359 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:18.976960 0.061231 tcp 10.0.2.105 63360 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:19.038542 0.164742 tcp 10.0.2.105 63361 -> 195.113.214.249 443 SRPA* 0 0 44 35580 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:44:19.450602 2.997958 tcp 10.0.2.105 63362 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:28.457304 0.000000 tcp 10.0.2.105 63362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:34.445667 2.996167 tcp 10.0.2.105 63363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:41.909937 3.000272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 02:44:43.438554 0.000000 tcp 10.0.2.105 63363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:48.086801 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:44:48.922131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:44:49.451275 3.000215 tcp 10.0.2.105 63364 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:44:56.918995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:44:58.450000 0.000000 tcp 10.0.2.105 63364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:45:12.921008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:45:44.927229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:50:04.452886 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:50:04.453068 3.001230 tcp 10.0.2.105 63365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:13.452671 0.000000 tcp 10.0.2.105 63365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:19.454497 0.063159 tcp 10.0.2.105 63366 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:19.517990 0.062478 tcp 10.0.2.105 63367 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:19.580801 0.156579 tcp 10.0.2.105 63368 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:19.774606 3.002079 tcp 10.0.2.105 63369 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:28.774817 0.000000 tcp 10.0.2.105 63369 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:34.777728 0.065971 tcp 10.0.2.105 63370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:34.843991 0.075141 tcp 10.0.2.105 63371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:34.919548 0.156673 tcp 10.0.2.105 63372 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:35.148204 2.989771 tcp 10.0.2.105 63373 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:44.147068 0.000000 tcp 10.0.2.105 63373 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:50.146169 0.064660 tcp 10.0.2.105 63374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:50.211097 0.062661 tcp 10.0.2.105 63375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:50.274085 0.153537 tcp 10.0.2.105 63376 -> 195.113.214.249 443 SRPA* 0 0 41 22634 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:50:50.506393 2.984406 tcp 10.0.2.105 63377 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:50:59.489431 0.000000 tcp 10.0.2.105 63377 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:51:05.508383 3.003783 tcp 10.0.2.105 63378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:51:14.510719 0.000000 tcp 10.0.2.105 63378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:51:19.087468 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:51:20.509865 3.005533 tcp 10.0.2.105 63379 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:51:29.517485 0.000000 tcp 10.0.2.105 63379 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:54:53.939271 3.000723 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 02:55:00.946567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:55:08.947892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:55:24.950265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:55:56.962312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 02:56:35.513038 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:56:35.513216 3.004112 tcp 10.0.2.105 63380 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:56:44.515322 0.000000 tcp 10.0.2.105 63380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:56:50.517453 0.068435 tcp 10.0.2.105 63381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:56:50.586181 0.068866 tcp 10.0.2.105 63382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:56:50.654877 0.153774 tcp 10.0.2.105 63383 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:56:50.978511 3.000234 tcp 10.0.2.105 63384 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:56:59.977529 0.000000 tcp 10.0.2.105 63384 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:05.977365 0.067552 tcp 10.0.2.105 63385 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:06.045220 0.068370 tcp 10.0.2.105 63386 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:06.113843 0.164507 tcp 10.0.2.105 63387 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:06.293880 2.997112 tcp 10.0.2.105 63388 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:15.289391 0.000000 tcp 10.0.2.105 63388 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:21.288873 0.065414 tcp 10.0.2.105 63389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:21.354589 0.063024 tcp 10.0.2.105 63390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:21.417864 0.157504 tcp 10.0.2.105 63391 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/14 02:57:21.597043 2.995664 tcp 10.0.2.105 63392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:30.591539 0.000000 tcp 10.0.2.105 63392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:36.590469 3.004189 tcp 10.0.2.105 63393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:45.593434 0.000000 tcp 10.0.2.105 63393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:57:50.580466 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 02:57:51.592355 3.004258 tcp 10.0.2.105 63394 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 02:58:00.594825 0.000000 tcp 10.0.2.105 63394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:02:00.962394 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 03:02:07.969709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:02:15.971868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:02:31.974931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:03:03.980418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:07:16.854461 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:07:16.854619 0.087285 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:16.922777 0.207093 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:17.192917 0.213633 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:17.398640 0.179635 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:17.701850 0.128578 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:17.859933 0.225034 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.077762 0.076558 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.269081 0.144016 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.392654 0.185886 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.555591 0.114039 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.636409 0.177668 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.810769 0.175378 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:18.980907 0.124908 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:19.209776 0.244441 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:19.421391 0.181828 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:19.650429 0.183445 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:19.903665 0.187717 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:20.062379 0.094039 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:20.147645 0.364749 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:20.482478 0.083596 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:20.646509 0.166512 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:20.843977 0.213712 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:21.120184 0.051597 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:21.213360 0.169871 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:21.420536 0.174967 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:21.623377 3.002187 tcp 10.0.2.105 63395 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:07:21.678326 0.409902 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:21.993844 0.127260 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:22.078361 0.188610 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:22.263828 0.190337 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:22.735186 0.183129 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:22.889266 0.232014 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:23.102388 0.442604 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:23.525538 0.461253 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:07:30.624301 0.000000 tcp 10.0.2.105 63395 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:07:36.624458 0.065248 tcp 10.0.2.105 63396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:36.689969 0.062868 tcp 10.0.2.105 63397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:36.753135 0.252627 tcp 10.0.2.105 63398 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:37.226840 2.991152 tcp 10.0.2.105 63399 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:07:46.226749 0.000000 tcp 10.0.2.105 63399 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:07:52.225902 0.082664 tcp 10.0.2.105 63400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:52.308860 0.066721 tcp 10.0.2.105 63401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:52.375883 0.161020 tcp 10.0.2.105 63402 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:07:52.640794 2.989654 tcp 10.0.2.105 63403 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:01.628892 0.000000 tcp 10.0.2.105 63403 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:07.642283 0.074135 tcp 10.0.2.105 63404 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:08:07.716728 0.062507 tcp 10.0.2.105 63405 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:08:07.779527 0.159540 tcp 10.0.2.105 63406 -> 195.113.214.249 443 SRPA* 0 0 24 13857 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:08:08.042335 2.999880 tcp 10.0.2.105 63407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:17.040321 0.000000 tcp 10.0.2.105 63407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:23.039752 3.004091 tcp 10.0.2.105 63408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:32.042656 0.000000 tcp 10.0.2.105 63408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:36.578994 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:08:38.041079 3.004047 tcp 10.0.2.105 63409 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:08:47.043937 0.000000 tcp 10.0.2.105 63409 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:09:07.987216 3.001558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 03:09:14.996726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:09:22.995935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:09:39.000802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:10:11.004942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:13:53.044145 0.000332 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:13:53.044661 2.993055 tcp 10.0.2.105 63410 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:02.046928 0.000000 tcp 10.0.2.105 63410 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:08.047681 0.060711 tcp 10.0.2.105 63411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:08.108656 0.063064 tcp 10.0.2.105 63412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:08.172025 0.158069 tcp 10.0.2.105 63413 -> 195.113.214.249 443 SRPA* 0 0 44 37114 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:08.353757 2.996114 tcp 10.0.2.105 63414 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:17.348974 0.000000 tcp 10.0.2.105 63414 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:23.348254 0.064021 tcp 10.0.2.105 63415 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:23.412547 0.063206 tcp 10.0.2.105 63416 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:23.476025 0.161616 tcp 10.0.2.105 63417 -> 195.113.214.249 443 SRPA* 0 0 42 24148 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:23.754964 2.997712 tcp 10.0.2.105 63418 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:32.754639 0.000000 tcp 10.0.2.105 63418 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:38.750495 0.071493 tcp 10.0.2.105 63419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:38.822384 0.061441 tcp 10.0.2.105 63420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:38.884136 0.162767 tcp 10.0.2.105 63421 -> 195.113.214.249 443 SRPA* 0 0 38 18370 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:14:39.241954 3.002833 tcp 10.0.2.105 63422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:48.243315 0.000000 tcp 10.0.2.105 63422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:14:54.245381 3.001783 tcp 10.0.2.105 63423 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:15:03.245141 0.000000 tcp 10.0.2.105 63423 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:15:08.085453 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:15:09.245254 2.999565 tcp 10.0.2.105 63424 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:15:18.250721 0.000000 tcp 10.0.2.105 63424 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:16:15.010950 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 03:16:22.018769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:16:30.020745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:16:46.022950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:17:18.028836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:20:24.247152 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:20:24.247245 2.993729 tcp 10.0.2.105 63425 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:20:33.239297 0.000000 tcp 10.0.2.105 63425 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:20:39.250199 0.064678 tcp 10.0.2.105 63426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:39.315213 0.078110 tcp 10.0.2.105 63427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:39.393678 0.161813 tcp 10.0.2.105 63428 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:39.638693 3.004436 tcp 10.0.2.105 63429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:20:48.641678 0.000000 tcp 10.0.2.105 63429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:20:54.641089 0.402481 tcp 10.0.2.105 63430 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:55.043851 0.066758 tcp 10.0.2.105 63431 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:55.110916 0.153965 tcp 10.0.2.105 63432 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:20:55.649442 2.973336 tcp 10.0.2.105 63433 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:04.562906 0.000000 tcp 10.0.2.105 63433 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:10.500929 0.063135 tcp 10.0.2.105 63434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:21:10.564573 0.064870 tcp 10.0.2.105 63435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:21:10.629814 0.189384 tcp 10.0.2.105 63436 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:21:10.836193 2.979467 tcp 10.0.2.105 63437 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:19.766485 0.000000 tcp 10.0.2.105 63437 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:25.687358 2.966860 tcp 10.0.2.105 63438 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:34.647879 0.000000 tcp 10.0.2.105 63438 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:39.584961 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:21:40.656999 2.993686 tcp 10.0.2.105 63439 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:21:49.649496 0.000000 tcp 10.0.2.105 63439 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:23:22.035231 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 03:23:29.092601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:23:37.053838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:23:53.056523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:24:25.062733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:26:55.660182 0.000229 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:26:55.660519 3.003124 tcp 10.0.2.105 63440 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:04.662181 0.000000 tcp 10.0.2.105 63440 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:10.662906 0.063557 tcp 10.0.2.105 63441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:10.726737 0.063311 tcp 10.0.2.105 63442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:10.790364 0.168794 tcp 10.0.2.105 63443 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:11.589599 3.007025 tcp 10.0.2.105 63444 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:20.596750 0.000000 tcp 10.0.2.105 63444 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:26.584143 0.070363 tcp 10.0.2.105 63445 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:26.654802 0.062165 tcp 10.0.2.105 63446 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:26.717253 0.187248 tcp 10.0.2.105 63447 -> 195.113.214.249 443 SRPA* 0 0 23 12538 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:27.124457 2.994329 tcp 10.0.2.105 63448 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:36.127560 0.000000 tcp 10.0.2.105 63448 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:42.126846 0.062911 tcp 10.0.2.105 63449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:42.190060 0.063157 tcp 10.0.2.105 63450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:42.253522 0.172519 tcp 10.0.2.105 63451 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:27:42.579546 3.001507 tcp 10.0.2.105 63452 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:51.583183 0.000000 tcp 10.0.2.105 63452 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:27:57.578389 3.004083 tcp 10.0.2.105 63453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:28:06.581268 0.000000 tcp 10.0.2.105 63453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:28:11.588254 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:28:12.579953 3.004191 tcp 10.0.2.105 63454 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:28:21.685557 0.000000 tcp 10.0.2.105 63454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:30:29.072680 2.997306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 03:30:36.076822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:30:44.077263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:31:00.080430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:31:32.087029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:37:36.092432 3.002417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 03:37:43.102623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:37:43.573168 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:37:43.573337 0.214045 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2030 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:37:43.780785 0.076147 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:37:44.028150 0.213774 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:37:44.232258 0.175518 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:37:44.383835 0.129546 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:37:44.513480 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 03:37:51.101952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:37:57.611421 3.004140 tcp 10.0.2.105 63455 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:37:59.975989 0.061397 tcp 10.0.2.105 63456 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:00.037712 0.066962 tcp 10.0.2.105 63457 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:00.104996 0.166908 tcp 10.0.2.105 63458 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:00.272587 0.240775 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:00.498694 0.117914 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:00.728807 0.183541 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:00.888201 0.172530 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.112375 0.125792 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.218719 0.251864 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.437855 0.112058 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.559182 0.176104 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.732042 0.184706 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:01.910838 0.188321 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:02.076771 0.185407 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:02.392729 0.095117 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:02.478396 0.391230 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2031 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:02.845131 0.112315 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:02.979433 0.054861 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:03.204851 0.169828 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:03.371854 0.172842 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:03.537618 0.147333 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:03.837380 0.218948 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:04.031868 0.403527 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:04.344565 0.129567 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:04.556778 0.189702 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:04.742866 0.188534 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:04.936464 0.447601 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:05.363409 0.462394 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:05.802877 0.222137 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:05.950541 0.231474 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/14 03:38:06.613992 0.000000 tcp 10.0.2.105 63455 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:38:07.104656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:38:12.613338 0.061840 tcp 10.0.2.105 63459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:12.675457 0.075034 tcp 10.0.2.105 63460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:12.750818 0.169341 tcp 10.0.2.105 63461 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:38:13.220771 2.996889 tcp 10.0.2.105 63462 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:38:22.226591 0.000000 tcp 10.0.2.105 63462 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:38:39.110631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:43:28.216555 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 03:43:28.216654 2.993946 tcp 10.0.2.105 63463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:43:37.212855 0.000000 tcp 10.0.2.105 63463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 03:43:43.219908 0.064785 tcp 10.0.2.105 63464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:43:43.284947 0.068389 tcp 10.0.2.105 63465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:43:43.353592 0.152824 tcp 10.0.2.105 63466 -> 195.113.214.249 443 SRPA* 0 0 34 25686 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:43:43.609679 0.671572 tcp 10.0.2.105 63467 -> 31.192.24.67 3527 FSPA* 0 0 12 1506 flow=From-Botnet-V2-TCP-Established 1970/02/14 03:44:43.116474 3.005754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 03:44:50.124219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:44:58.125811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:45:14.129084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:45:46.134534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:54:55.147660 3.010926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 03:55:02.164123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:55:10.165361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:55:26.168788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 03:55:58.174709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:02:02.180642 3.001656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:02:09.187749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:02:17.189689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:02:33.192781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:03:05.198506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:08:35.804261 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 04:08:35.804574 0.229752 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:36.026098 0.073698 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:36.478485 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 04:08:55.243664 0.069843 tcp 10.0.2.105 63468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:08:55.313866 0.064201 tcp 10.0.2.105 63469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:08:55.378006 0.162417 tcp 10.0.2.105 63470 -> 195.113.214.249 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:08:55.538677 0.204999 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:55.733704 0.179680 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:56.089189 0.131587 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:56.365576 0.159798 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:56.509852 0.111145 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:56.701168 0.182194 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:56.861739 0.204212 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:57.062500 0.125527 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:57.345608 0.177231 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:57.518970 0.183606 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:57.697669 0.185823 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:57.974304 0.255107 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:58.194474 0.107776 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:58.272196 0.187676 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:58.480141 0.095821 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:58.565144 0.355380 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.063729 0.096546 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.122430 0.053042 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2585 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.274081 0.144110 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.410192 0.213359 udp 10.0.2.105 7010 <-> 75.0.226.74 6426 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.601235 0.169422 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.768109 0.174085 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:08:59.937516 0.000000 udp 10.0.2.105 7010 -> 41.151.133.217 3799 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 04:09:09.207074 2.999772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:09:16.212317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:09:18.856971 0.065152 tcp 10.0.2.105 63471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:09:18.922474 0.068747 tcp 10.0.2.105 63472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:09:18.991479 0.171134 tcp 10.0.2.105 63473 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:09:19.163150 0.184661 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:19.304211 0.188466 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:19.623827 0.193017 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:19.813105 0.203551 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:19.916150 0.233043 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:20.272702 0.440030 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:20.691419 0.479628 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:09:24.213657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:09:40.216632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:10:12.222493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:13:44.287639 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 04:13:44.287728 0.739033 tcp 10.0.2.105 63474 -> 31.192.24.67 3527 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:16:16.229044 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:16:23.235947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:16:31.237600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:16:47.240468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:17:19.656703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:23:23.262543 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:23:30.269947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:23:38.271251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:23:54.274692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:24:26.280327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:30:30.286150 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:30:37.293984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:30:45.295448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:31:01.298805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:31:33.304545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:37:37.311272 3.000726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:37:44.318026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:37:52.321743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:38:08.322243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:38:40.338647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:39:47.054786 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 04:39:47.054942 0.215993 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:47.264268 0.627131 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:47.651525 0.222449 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:47.866881 0.071461 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:48.091992 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 04:39:58.111057 0.000352 udp 10.0.2.105 7010 <- 204.15.30.249 8065 RSP 0 0 5 2098 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 04:39:58.113186 0.210789 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:58.310423 0.174638 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:58.526777 0.211503 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:58.728019 0.183403 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:58.890301 0.111897 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:58.981350 0.123517 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.086216 0.172703 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.255979 0.178088 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.431475 0.185495 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.623550 0.247035 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.835646 0.104422 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:39:59.925238 0.182999 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:00.103950 0.089858 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:00.162145 0.190220 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:00.320106 0.107559 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:00.439368 0.417713 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:00.828509 0.000000 udp 10.0.2.105 7010 -> 75.0.226.74 6426 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 04:40:19.103401 0.067012 tcp 10.0.2.105 63475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:40:19.170739 0.067212 tcp 10.0.2.105 63476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:40:19.238309 0.171642 tcp 10.0.2.105 63477 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:40:19.410652 0.168776 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:19.575801 0.173887 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:19.742473 0.081889 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:20.036713 0.146684 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:20.173589 0.191321 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:20.362280 0.130724 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1885 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:20.526718 0.233583 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:20.740673 0.435932 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:21.155883 0.188399 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:21.340854 0.173152 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:40:21.439835 0.465639 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/14 04:43:45.027065 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 04:43:45.027282 0.914146 tcp 10.0.2.105 63478 -> 31.192.24.67 3527 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/02/14 04:44:44.344667 3.002449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 04:44:51.352183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:44:59.353361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:45:15.356514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:45:47.362551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:54:57.376094 3.001700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 04:55:04.383412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:55:12.384638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:55:28.387751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 04:56:00.393884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:02:04.399400 3.002133 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:02:11.407281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:02:19.408819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:02:35.411841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:03:07.417918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:09:11.424045 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:09:18.433581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:09:26.432651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:09:42.435802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:10:14.442687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:10:24.647110 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 05:10:24.647284 0.184067 udp 10.0.2.105 7010 -> 75.0.226.74 6426 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:10:24.831351 0.000000 icmp 75.0.226.74 0x0303 -> 10.0.2.105 0x1a19 URP 192 1 155 flow=Background 1970/02/14 05:10:39.920274 0.064851 tcp 10.0.2.105 63479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:39.985365 0.064969 tcp 10.0.2.105 63480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:40.050671 0.166425 tcp 10.0.2.105 63481 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:40.217628 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:10:58.205661 0.061740 tcp 10.0.2.105 63482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:58.267715 0.062718 tcp 10.0.2.105 63483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:58.330772 0.191851 tcp 10.0.2.105 63484 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:10:58.523112 0.421308 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:10:58.884771 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:11:13.917903 0.063823 tcp 10.0.2.105 63485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:13.981985 0.066026 tcp 10.0.2.105 63486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:14.047957 0.161848 tcp 10.0.2.105 63487 -> 195.113.214.249 443 SRPA* 0 0 20 11520 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:14.210384 0.076853 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:14.269377 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:11:30.802037 0.064435 tcp 10.0.2.105 63488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:30.866760 0.066127 tcp 10.0.2.105 63489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:30.933183 0.159584 tcp 10.0.2.105 63490 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:31.093236 0.212118 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:31.295391 0.186926 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:31.766427 0.178235 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:31.918865 0.252597 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:32.156330 0.126603 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:32.603689 0.173347 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:32.773813 0.136473 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:32.889044 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:11:47.992100 0.063076 tcp 10.0.2.105 63491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:48.055559 0.064962 tcp 10.0.2.105 63492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:48.120825 0.153981 tcp 10.0.2.105 63493 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:11:48.275347 0.119482 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:48.359268 0.197362 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2617 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.016203 0.136468 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.112229 0.184783 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.271876 0.177486 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.446508 0.187475 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.603376 0.094286 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:49.787549 0.532462 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:50.293882 0.053389 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2638 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:50.524997 0.147524 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:50.663938 0.169028 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:50.914455 0.177555 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:51.084913 0.189390 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:51.429030 0.219054 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 4 1387 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:51.626151 0.234545 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:11:51.838962 0.000000 udp 10.0.2.105 7010 -> 1.160.229.107 7701 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 05:12:08.386211 0.063221 tcp 10.0.2.105 63494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:12:08.449744 0.066369 tcp 10.0.2.105 63495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:12:08.516452 0.171886 tcp 10.0.2.105 63496 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:12:08.689041 0.475584 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:12:09.140788 0.188640 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:12:09.351331 0.143818 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:13:45.946182 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 05:13:45.946435 0.903748 tcp 10.0.2.105 63497 -> 31.192.24.67 3527 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:16:18.448762 3.002255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 05:16:25.455424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:16:33.456580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:16:49.459589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:17:21.465689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:23:25.471632 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:23:32.479054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:23:40.480681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:23:56.483743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:24:28.491033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:30:32.495592 3.001980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:30:39.503344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:30:47.504054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:31:03.507894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:31:35.513762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:37:39.520036 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:37:46.527092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:37:54.528775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:38:10.531386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:38:42.537716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:42:37.445893 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 05:42:37.445998 0.218542 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:37.656754 0.224827 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:37.874703 0.129929 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:38.067290 0.253484 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:38.283746 0.442766 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:38.705453 0.395215 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:39.060477 0.079118 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:39.268919 0.207563 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:39.466118 0.182701 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.030131 0.124640 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.135307 0.184980 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.297857 0.075331 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.358323 0.090117 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 717 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.509199 0.173686 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.679750 0.110712 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:40.860943 0.190298 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:41.179992 0.177239 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:41.398953 0.082415 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:41.441774 0.181638 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:41.653615 0.366806 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:41.991630 0.185189 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.148744 0.094584 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.257520 0.169062 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.423746 0.064144 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.526425 0.172529 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.691510 0.143609 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.826020 0.131865 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:42.911465 0.188313 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:43.096990 0.234763 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:43.310089 0.273824 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:43.429609 0.479676 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:42:43.884673 0.189197 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/14 05:43:46.855531 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 05:43:46.855716 0.567488 tcp 10.0.2.105 63498 -> 31.192.24.67 3527 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/02/14 05:44:46.544016 3.001747 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 05:44:53.551049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:45:01.552640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:45:17.555629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:45:49.562079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:51:53.567530 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:52:00.575113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:52:08.577285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:52:24.579501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:52:56.588590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:59:00.591524 3.001705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 05:59:07.599253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:59:15.603584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 05:59:31.603570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:00:03.609471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:06:23.619084 3.000909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:06:30.626133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:06:38.627648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:06:54.630787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:07:26.636643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:13:08.718815 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 06:13:08.718919 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:13:14.790259 0.000128 udp 10.0.2.105 7010 <- 204.15.30.249 8065 RSP 0 0 5 2045 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:13:15.289937 0.240031 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:15.522556 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:13:30.642997 3.001139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:13:33.977146 0.062748 tcp 10.0.2.105 63499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:34.040211 0.062037 tcp 10.0.2.105 63500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:34.102535 0.154226 tcp 10.0.2.105 63501 -> 195.113.214.249 443 SRPA* 0 0 52 44649 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:34.257318 0.449680 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:34.647044 0.616185 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:35.244059 0.251224 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:35.471469 0.000000 udp 10.0.2.105 7010 -> 1.160.229.107 7701 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:13:37.650631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:13:45.651734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:13:47.424433 0.517305 tcp 10.0.2.105 63502 -> 31.192.24.67 3527 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:51.700790 0.063167 tcp 10.0.2.105 63503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:51.764274 0.061683 tcp 10.0.2.105 63504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:51.826259 0.162927 tcp 10.0.2.105 63505 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:13:51.989881 0.213380 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:52.193583 0.193072 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:52.502172 0.126673 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:52.607987 0.112420 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:52.871994 0.176628 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:53.045693 0.896543 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:53.908381 0.185067 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.108455 0.184554 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.269109 0.077652 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.411196 0.176076 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.583918 0.093445 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.667590 0.185615 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:54.848428 0.350225 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:55.170555 0.185447 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:55.327616 0.094603 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:55.441272 0.174860 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:55.613187 0.115409 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:55.837012 0.173899 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:56.003686 0.144751 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:56.140560 0.127146 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:56.327238 0.188018 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:56.512389 0.440903 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:56.932477 0.189594 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:57.119184 0.236414 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:13:57.335404 0.421022 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:14:01.654844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:14:33.660757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:20:37.667046 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:20:44.680565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:20:52.675212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:21:08.678604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:21:40.684707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:27:44.695810 2.996173 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:27:51.697952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:27:59.699325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:28:15.702451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:28:47.708463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:34:51.715073 3.001293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:34:58.721922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:35:06.723378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:35:22.726995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:35:54.732573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:41:58.738297 3.002228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 06:42:05.745865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:42:13.747312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:42:29.750568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:43:01.758704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:43:47.942978 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 06:43:47.943153 0.642669 tcp 10.0.2.105 63506 -> 31.192.24.67 3527 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:44:13.639771 0.226832 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:13.858124 0.439934 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:14.408854 0.128134 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:14.613861 0.218188 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:14.825376 0.000000 udp 10.0.2.105 7010 -> 41.151.133.217 3799 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:44:18.576819 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 06:44:31.866870 0.449719 udp 10.0.2.105 7010 <- 41.151.133.217 3799 RSP 0 0 5 2084 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:44:31.867293 0.244150 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.135340 0.076564 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.195281 0.211990 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.429209 0.095179 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.504969 0.173712 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.675519 0.177407 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.839561 0.123968 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:32.944557 0.893996 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:33.803724 0.184904 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.013758 0.183827 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.174860 0.270449 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.485091 0.176490 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.658879 0.079402 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 1979 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.767610 0.183632 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:34.922810 0.097957 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:35.038339 0.167382 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:35.203083 0.051696 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:35.370661 0.184695 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:35.550823 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 06:44:53.057747 0.071505 tcp 10.0.2.105 63507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:44:53.129534 0.078003 tcp 10.0.2.105 63508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:44:53.207908 0.174527 tcp 10.0.2.105 63509 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/14 06:44:53.383001 0.173106 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:53.548004 0.145940 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:53.928923 0.177262 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:54.060107 0.186895 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:54.363210 0.445636 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:54.786542 0.326168 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:54.938205 0.188287 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:44:55.326114 0.233106 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/14 06:53:30.763500 3.017082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 06:53:37.780746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:53:45.782493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:54:01.785474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 06:54:33.791578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:00:37.799528 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 07:00:44.804716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:00:52.806338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:01:08.808994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:01:40.815286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:07:44.821088 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 07:07:51.828640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:07:59.830178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:08:15.833293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:08:47.849305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:13:48.592891 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:13:48.592979 0.954260 tcp 10.0.2.105 63510 -> 31.192.24.67 3527 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:14:51.856020 3.002839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 07:14:58.865106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:15:06.864152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:15:07.545435 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:15:07.545585 0.369332 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2628 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:07.884012 0.228204 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:08.104860 0.215135 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:08.326788 0.435863 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:08.741219 0.132526 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:08.991001 0.000000 udp 10.0.2.105 7010 -> 41.151.133.217 3799 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 07:15:22.595525 0.010102 udp 10.0.2.105 7010 <- 41.151.133.217 3799 RSP 0 0 5 2152 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 07:15:22.597524 0.609043 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 5 2009 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:22.867173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:15:23.179453 0.078026 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:23.239940 0.171125 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:23.425609 0.200718 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:23.959017 0.527824 udp 10.0.2.105 7010 <-> 208.57.252.81 4092 CON 0 0 4 1246 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:24.481908 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 07:15:24.482328 2.126625 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 SPA_* 0 0 32 14221 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:39.645326 0.072892 tcp 10.0.2.105 63512 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:39.718493 0.074451 tcp 10.0.2.105 63513 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:39.793240 0.157778 tcp 10.0.2.105 63514 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:39.951594 0.124713 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:40.057067 0.185513 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:40.328290 0.887414 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:40.385781 0.197348 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 2 632 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:41.182198 0.183624 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:41.670635 0.149656 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:41.937766 0.185659 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:42.095273 0.094222 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:42.561304 0.173135 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:42.731840 0.085983 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:42.816355 0.175905 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:42.988905 0.183120 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:43.167053 0.242963 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:43.585186 0.138626 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:43.678449 0.174918 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:43.845810 0.146865 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:44.042318 0.189414 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:44.228700 0.459220 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:44.657059 0.239675 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:44.834115 0.192321 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:45.037301 0.233495 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:15:46.646645 4.897437 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 11880 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:52.080932 4.064061 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 8454 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:15:54.873546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:15:57.545477 4.948556 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 17 10294 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:03.855730 3.944125 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:04.577117 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:16:09.175518 4.124201 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:14.600145 4.906193 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:20.560665 4.937669 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 23 10674 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:25.697661 3.805278 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 25 11830 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:30.740299 4.741577 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 20 9196 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:36.756565 3.896679 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 7 3266 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:41.902017 4.857654 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 43 18566 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:47.059704 4.184487 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 27 15606 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:48.581116 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:16:52.437919 3.833691 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 5930 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:16:57.480320 4.173167 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:02.908752 4.689076 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 21 10578 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:11.050923 4.485942 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 25 10246 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:17.375413 4.873339 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 21 11626 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:23.407901 4.696354 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:25.082609 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:17:28.577669 3.735690 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 21 10042 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:35.694321 4.640467 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 24 10204 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:43.305959 4.813012 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 20 8416 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:48.326570 4.446040 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 22 9048 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:53.580946 4.967415 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 8886 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:17:58.973842 1.994000 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:04.204528 2.832408 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 6520 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:10.663076 4.761950 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 7514 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:15.585536 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:18:16.763642 3.284440 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 7838 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:23.435737 2.380053 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:29.944974 4.973669 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 6466 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:35.123695 3.732195 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 17 8254 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:40.080940 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:18:40.148308 4.887375 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 15 7622 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:45.491254 4.811616 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 27 11414 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:50.508887 4.207171 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 23 9626 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:18:56.073694 4.901258 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 6892 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:01.171401 2.379264 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 8984 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:06.766678 4.659239 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 26 10312 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:11.586038 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:19:12.294587 3.822698 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 8308 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:17.465086 4.605822 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 24 10324 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:22.866373 4.331929 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 9814 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:28.400225 0.670849 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 4 2312 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:44.938366 4.758801 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 15 8158 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:50.081450 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:19:50.199143 4.688365 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 21 9518 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:19:56.426587 4.980824 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 23 9626 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:01.961215 4.849868 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 25 10258 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:07.015886 4.915586 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 28 11992 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:13.313232 4.918447 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 12 4840 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:14.577031 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:20:18.567285 4.841987 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 15 7098 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:23.609641 4.828909 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:29.435707 4.817894 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 12 6936 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:34.455298 2.603978 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 9 4154 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:43.923214 3.759280 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 32 16924 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:48.938768 4.216300 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 7588 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:20:49.577080 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:20:53.998698 0.000160 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 4 3556 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:00.761650 4.903655 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:05.860194 4.996351 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 22 8524 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:10.869303 2.100316 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 27 10070 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:13.581402 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:21:16.459580 4.212490 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 31 13486 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:21.956674 3.782260 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 7580 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:27.081809 4.699554 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 5942 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:32.331784 3.406966 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:37.352037 4.925589 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 15 5526 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:40.585514 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:21:42.475773 4.704029 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:47.533518 4.810230 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 12 4828 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:52.537248 4.296822 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 7056 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:58.074897 4.969851 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 41 16886 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:21:58.879196 3.319576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 07:22:03.136525 2.270417 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 31 15822 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:06.169791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:22:09.109609 4.568329 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 35 15514 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:14.092011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:22:14.465266 4.600462 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 8616 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:19.525131 4.980438 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 18 8832 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:24.704306 4.893770 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 21 7946 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:26.669309 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:22:29.950503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:22:30.112775 4.651556 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 36 15044 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:35.763563 3.639956 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 15 8146 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:42.947980 4.587631 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 8886 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:48.044933 4.959702 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 25 10258 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:53.204767 4.701902 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 7838 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:22:58.403688 4.896763 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 14 6892 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:01.086001 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:23:01.897214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:23:03.501503 0.000235 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 4 1940 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:17.274627 3.928421 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 16 7676 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:22.617059 3.755285 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 13 6466 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:25.080617 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:23:27.722751 4.914438 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 10 4732 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:32.841438 3.845710 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 10 3684 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:37.913684 4.839324 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 23 10674 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:42.956187 4.867269 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:23:48.303234 1.561255 tcp 10.0.2.105 63511 -> 208.57.252.81 8150 FRPA* 0 0 13 2289 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:29:05.903598 3.001186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 07:29:12.910725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:29:20.912212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:29:36.915142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:30:08.921342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:36:12.927654 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 07:36:19.934807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:36:27.938088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:36:43.939047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:37:15.945169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:43:19.951033 3.001863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 07:43:26.958523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:43:34.960100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:43:49.392414 0.000206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:43:49.392718 1.341114 tcp 10.0.2.105 63515 -> 31.192.24.67 3527 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:43:50.963152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:44:22.973109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:46:11.345296 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 07:46:11.345484 0.130280 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1280 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:11.466273 0.227524 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:11.686847 1.127609 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1456 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:12.800619 0.232311 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:13.025698 0.127705 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:13.374482 0.396023 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:13.750161 0.000000 udp 10.0.2.105 7010 -> 41.151.133.217 3799 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 07:46:31.361383 0.064186 tcp 10.0.2.105 63516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:31.425853 0.059994 tcp 10.0.2.105 63517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:31.486128 0.151383 tcp 10.0.2.105 63518 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:31.638069 0.173677 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:31.808729 0.178622 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:31.959972 0.075697 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:32.043800 0.248646 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:32.259546 0.000000 udp 10.0.2.105 7010 -> 208.57.252.81 4092 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 07:46:50.040940 0.068534 tcp 10.0.2.105 63519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:50.109739 0.124573 tcp 10.0.2.105 63520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:50.234592 0.162046 tcp 10.0.2.105 63521 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 07:46:50.397294 0.126232 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:50.503899 0.182511 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:50.678305 0.113784 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:50.758791 0.187230 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:50.973732 0.078426 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:51.034664 0.185976 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:51.192101 0.370989 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:51.523924 0.175270 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:51.695840 0.182020 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:51.947968 0.071833 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:52.111981 0.094372 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:52.196534 0.170571 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:52.361327 0.138781 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2663 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:52.448763 0.190336 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:52.631841 1.317354 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:53.944417 0.188304 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:54.129067 0.188661 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:54.363699 0.236085 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:55.330225 0.471056 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:46:55.779698 0.174756 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 07:54:10.978449 3.033920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 07:54:17.994783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:54:25.995668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:54:42.002302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 07:55:14.005435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:01:18.011046 3.001803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:01:25.018662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:01:33.019819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:01:49.023121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:02:21.028652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:08:25.035972 3.001004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:08:32.042498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:08:40.044066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:08:56.046937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:09:28.053095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:13:50.743097 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 08:13:50.743245 0.752337 tcp 10.0.2.105 63522 -> 31.192.24.67 3527 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:15:32.059230 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:15:39.069344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:15:47.067440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:16:03.071273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:16:35.078199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:17:04.289670 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 08:17:04.289832 0.000000 udp 10.0.2.105 7010 -> 41.151.133.217 3799 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 08:17:12.134823 0.119998 udp 10.0.2.105 7010 <- 41.151.133.217 3799 RSP 0 0 2 610 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 08:17:12.135213 0.000000 udp 10.0.2.105 7010 -> 208.57.252.81 4092 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 08:17:29.208795 0.065528 tcp 10.0.2.105 63523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:29.274659 0.068500 tcp 10.0.2.105 63524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:29.343424 0.158200 tcp 10.0.2.105 63525 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:29.502170 0.187963 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:29.687099 0.145043 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:30.233947 0.192222 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:30.422888 0.235427 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:30.665219 0.443577 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:31.087661 0.135863 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:31.223181 0.220671 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:31.463804 0.109946 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:31.552728 0.129100 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:31.851975 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 08:17:50.436159 0.103005 tcp 10.0.2.105 63526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:50.539442 0.062665 tcp 10.0.2.105 63527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:50.602439 0.152798 tcp 10.0.2.105 63528 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:17:50.755762 0.227131 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:50.975188 0.394174 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:51.350382 0.099096 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:51.478086 0.740781 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 3 696 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:52.211077 0.183691 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:52.561244 0.173814 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:52.730443 0.179952 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2019 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:52.891353 0.257059 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:53.133724 0.123769 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:53.257719 0.180829 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:53.412434 0.185826 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:53.723042 0.873909 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:54.561832 0.321638 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:54.846165 0.177528 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.050397 0.093451 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.135307 0.184271 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.314010 0.064653 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.511115 0.172554 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.675723 0.132069 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:17:55.789741 0.171973 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:22:41.085967 3.159603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 08:22:48.217942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:22:56.157608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:23:12.109004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:23:44.113714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:29:48.123034 3.000008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:29:55.127278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:30:03.129070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:30:19.131744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:30:51.139401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:36:55.144483 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:37:02.151464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:37:10.154833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:37:26.155649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:37:58.165298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:43:51.500327 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 08:43:51.500484 0.639223 tcp 10.0.2.105 63529 -> 31.192.24.67 3527 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:44:02.167689 3.001748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:44:09.175484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:44:17.176445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:44:33.179567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:45:05.185764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:48:04.133622 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 08:48:04.133810 1.378334 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 2012 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:05.491323 1.016459 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:06.532925 0.189305 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:06.719737 0.199367 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:06.913588 0.143605 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.072189 0.233722 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.286538 0.147522 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.381763 0.216795 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.591896 0.098166 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2579 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.668128 0.131964 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:07.873223 0.482818 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:08.316405 0.076581 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:08.418558 0.227181 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:08.638063 0.394463 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:09.011435 0.680847 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:09.658338 0.174505 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:09.875070 0.173666 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.045541 0.181432 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.206290 0.185116 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.470959 0.186557 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.782643 0.083044 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.851263 0.123887 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:10.976193 0.112064 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:11.054559 0.394224 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:28.079385 0.068158 tcp 10.0.2.105 63530 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:48:28.147838 0.068582 tcp 10.0.2.105 63531 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:48:28.216703 0.167031 tcp 10.0.2.105 63532 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 08:48:28.384508 0.176891 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:28.558933 0.100399 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:28.650674 0.175615 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:28.818568 0.127934 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:29.175094 0.170059 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:29.501614 0.182536 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:48:29.679294 0.054974 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/14 08:54:32.193758 3.001846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 08:54:39.201132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:54:47.202469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:55:03.205896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 08:55:35.211636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:01:39.218080 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:01:46.225036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:01:54.225960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:02:10.229758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:02:42.235670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:08:46.242031 3.001251 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:08:53.249505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:09:01.252562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:09:17.254146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:09:49.259661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:13:52.139357 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 09:13:52.139447 0.540716 tcp 10.0.2.105 63533 -> 31.192.24.67 3527 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:15:54.268020 3.001089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:16:01.274631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:16:09.275975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:16:25.278792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:16:57.285057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:18:44.999812 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 09:18:45.000025 0.357872 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:45.321997 1.091135 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:46.385768 0.477784 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:46.693973 0.188304 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:46.890078 0.192066 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:47.078985 0.191103 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:47.293130 0.220253 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:47.505047 0.235925 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:47.720774 0.152373 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:47.861243 0.133183 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:48.062367 0.120119 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:48.161884 0.450866 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:48.658086 0.700433 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:49.340646 0.224756 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:49.558016 0.397232 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:49.933991 0.170849 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:50.101513 0.185195 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:50.263896 0.176856 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:50.566410 0.705533 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:51.216626 0.185984 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:51.373811 0.181127 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:51.588548 0.079537 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:51.652897 0.124566 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.118184 0.118582 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.203009 0.175463 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.379641 0.095182 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.465031 0.174231 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.782962 0.144276 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:52.879060 0.170474 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:53.046468 0.182891 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:18:53.223885 0.054172 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 1964 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:23:01.291178 3.056162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:23:08.326452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:23:16.309973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:23:32.312737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:24:04.318938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:30:08.325406 3.001448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:30:15.332788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:30:23.333909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:30:39.337206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:31:11.342906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:37:15.349208 3.001460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:37:22.356294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:37:30.357962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:37:46.360694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:38:18.368615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:43:52.692118 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 09:43:52.692219 0.927144 tcp 10.0.2.105 63534 -> 31.192.24.67 3527 FSPA* 0 0 14 1505 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:44:22.372431 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 09:44:29.380089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:44:37.381877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:44:53.385045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:45:25.390973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:48:53.870505 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 09:48:53.870597 0.321078 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:54.151665 1.051263 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:55.203332 0.191075 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:55.389669 0.244106 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:55.558217 0.220189 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:55.770262 0.446510 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:56.073351 0.185976 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:56.323076 0.236482 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:56.539416 0.150205 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:56.678345 0.126618 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:48:56.882333 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 09:49:12.289693 0.075107 tcp 10.0.2.105 63535 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:12.365132 0.070635 tcp 10.0.2.105 63536 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:12.436110 0.134466 tcp 10.0.2.105 63537 -> 195.113.214.249 443 SRPA* 0 0 63 41207 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:12.571177 0.226238 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:12.789678 0.446738 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:13.213890 0.450597 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:13.647653 0.393231 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:14.022127 0.189731 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:14.208491 0.183414 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:14.368747 0.174006 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:14.881608 0.186751 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:15.121502 0.078685 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:15.185506 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 09:49:31.787393 0.073389 tcp 10.0.2.105 63538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:31.861051 0.070551 tcp 10.0.2.105 63539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:31.931918 0.160781 tcp 10.0.2.105 63540 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 09:49:32.093220 0.184124 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:32.248093 0.126037 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:32.439859 0.119127 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:32.523421 0.193912 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:32.714241 0.094917 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:32.885062 0.177701 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:33.055633 0.133284 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:33.145317 0.169204 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:33.311649 0.181732 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:49:33.488891 0.057080 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/14 09:54:44.397276 3.001771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 09:54:51.404680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:54:59.406228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:55:15.409309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 09:55:47.415253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:01:51.422067 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:01:58.429127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:02:06.430312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:02:22.433620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:02:54.439197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:08:58.444838 3.002337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:09:05.452771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:09:13.453956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:09:29.456964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:10:01.473214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:13:53.617239 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 10:13:53.617370 0.424216 tcp 10.0.2.105 63541 -> 31.192.24.67 3527 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/02/14 10:16:10.485787 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:16:17.493537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:16:25.495203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:16:41.497944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:17:13.503987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:19:56.989479 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 10:19:56.989578 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 10:20:14.386171 0.065286 tcp 10.0.2.105 63542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 10:20:14.451688 0.063045 tcp 10.0.2.105 63543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 10:20:14.515045 0.158018 tcp 10.0.2.105 63544 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/14 10:20:14.673633 0.631905 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 3 770 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:15.297346 0.255157 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:15.672942 0.193898 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:15.864212 1.080201 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:16.915645 0.441973 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:17.277355 0.212184 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:17.481550 0.248014 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 1909 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:17.675197 0.234718 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:17.888334 0.188367 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:18.073708 0.130676 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:18.474190 0.160984 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:18.617034 0.223276 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:18.910500 0.458444 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:19.347609 0.402428 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:19.727794 0.158531 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:19.945404 0.306249 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:20.399696 0.174696 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:20.571658 0.181175 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:20.859539 0.075875 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:20.920148 0.187828 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.131794 0.123440 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.236947 0.116765 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.393831 0.176501 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.566916 0.183505 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.722196 0.175457 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:21.888911 0.228891 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 4 1188 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:22.096981 0.170112 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:22.264421 0.096639 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:22.351196 0.182385 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:20:22.528734 0.062292 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:23:17.510463 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:23:24.517763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:23:32.521985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:23:48.522418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:24:20.533137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:30:24.534691 3.001435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:30:31.541736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:30:39.543228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:30:55.546049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:31:27.552581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:37:31.559235 3.001034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:37:38.565833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:37:46.568918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:38:02.570137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:38:34.576347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:43:54.045704 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 10:43:54.045894 0.573674 tcp 10.0.2.105 63545 -> 31.192.24.67 3527 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/14 10:44:38.581836 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:44:45.589777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:44:53.590971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:45:09.594118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:45:41.600271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:50:39.098402 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 10:50:39.098556 0.190952 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:39.286729 0.284908 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:39.539798 0.089697 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:39.625225 0.385070 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:39.981820 1.086942 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:40.829073 0.218337 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.040086 0.195362 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.209249 0.235520 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.422091 0.187936 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.607252 0.129265 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.748885 0.151027 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:41.886950 0.225472 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:42.104178 0.074429 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:42.162193 0.451109 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:42.590702 0.396576 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:42.968054 0.183443 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.130734 0.173774 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.301127 0.189881 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.492391 0.093266 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.569096 0.185327 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.731492 0.125300 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.837570 0.115173 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:43.921778 0.179069 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:44.095340 0.883038 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:44.950625 0.175032 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:45.117983 0.131224 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:45.204656 0.171983 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2593 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:45.373002 0.114500 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:45.513144 0.101987 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:50:45.605450 0.182393 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 10:54:52.616147 3.038038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 10:54:59.633508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:55:07.633973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:55:23.637165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 10:55:55.643321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:01:59.649706 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:02:06.656667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:02:14.657916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:02:30.661409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:03:02.666893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:09:16.676805 3.002195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:09:23.685091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:09:31.686397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:09:47.689115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:10:19.695355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:13:54.624868 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 11:13:54.625120 0.572950 tcp 10.0.2.105 63546 -> 31.192.24.67 3527 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/14 11:16:34.707935 3.000827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:16:41.714679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:16:49.716020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:17:05.718915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:17:37.725085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:20:54.167510 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 11:20:54.167651 0.188992 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:54.351624 0.384972 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:54.710662 0.479855 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:55.156837 0.078372 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:55.289298 0.150890 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:55.426122 0.418648 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:55.936392 0.218317 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:56.146278 0.234621 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:56.360563 0.189225 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:56.643248 0.129120 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:56.976756 0.150973 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:57.114148 0.519460 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:57.605989 0.229913 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:57.828345 0.085546 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:57.979208 0.397479 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:58.356685 0.184782 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:58.582940 0.171170 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:58.751006 0.186241 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.113493 0.124455 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.219081 0.116874 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.353223 0.180385 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.507976 0.080211 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.764941 0.174848 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:20:59.937465 0.183211 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.094986 0.174691 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.262853 0.130599 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.452469 0.095247 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.537494 0.182206 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.715009 0.170200 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:21:00.923644 0.052465 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:23:44.735779 3.003292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:23:51.743337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:23:59.745144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:24:15.747173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:24:47.753562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:30:51.759401 3.001449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:30:58.766782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:31:06.768563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:31:22.771169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:31:54.777236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:37:58.782715 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:38:05.790404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:38:13.792464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:38:29.795224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:39:01.801288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:43:55.205481 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 11:43:55.205592 1.073179 tcp 10.0.2.105 63547 -> 31.192.24.67 3527 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/14 11:45:05.807098 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:45:12.814708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:45:20.816661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:45:36.819347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:46:09.332175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:51:14.284923 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 11:51:14.285121 0.190817 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:14.473143 1.574032 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:16.007979 0.177794 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2071 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:16.159712 0.361020 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:16.492548 0.247905 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:16.705996 0.321946 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:16.977075 0.215813 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:17.185216 0.234863 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:17.398483 0.188579 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:17.584057 0.445367 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.007277 0.128010 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.138777 0.150230 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.276965 0.227686 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.496497 0.073877 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.553397 0.398754 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:18.930963 0.184405 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.092819 0.125150 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.198987 0.117035 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.280087 0.176521 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.462738 0.194116 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.695366 0.186471 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.929095 0.078212 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:19.991327 0.176001 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.163480 0.185344 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.318882 0.175856 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.487557 0.132432 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.573841 0.095876 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.660201 0.073045 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:20.831668 0.240105 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:51:21.066709 0.169388 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/14 11:52:12.845793 2.999856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:52:19.859410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:52:27.850319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:52:43.853304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:53:15.859176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:59:19.865823 3.000976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 11:59:26.872678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:59:34.874038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 11:59:50.877407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:00:22.883544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:06:50.893410 3.001931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:06:57.901062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:07:05.902604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:07:21.905223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:07:53.911822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:13:56.283074 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 12:13:56.283198 0.623041 tcp 10.0.2.105 63548 -> 31.192.24.67 3527 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/02/14 12:13:57.918139 3.002444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:14:04.925161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:14:12.926258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:14:28.929323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:15:00.935060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:21:06.944228 3.002288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:21:13.951806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:21:21.953439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:21:25.489039 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 12:21:25.489127 0.192825 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:25.678108 0.355141 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:26.157350 1.684895 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:27.802861 0.157140 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:27.925594 0.250444 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:28.142722 0.375697 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:28.438767 0.219330 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 1996 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:29.132755 0.236519 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:29.579708 0.589458 udp 10.0.2.105 7010 <-> 108.210.14.113 4384 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:30.161122 0.145566 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:30.448882 0.227680 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:30.668870 0.442639 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:31.088555 0.127052 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:31.382220 0.076418 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:31.439470 0.390663 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:31.809717 0.181621 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:31.966182 0.123050 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:32.086094 0.175553 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:32.258829 0.120713 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:32.343380 0.181800 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2581 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:32.773848 0.185173 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:32.934865 0.077465 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:33.205019 0.176855 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:33.379398 0.186574 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:33.536927 0.172542 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:33.749954 0.057490 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:34.007255 0.182702 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:34.185287 0.127851 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:34.398375 0.094265 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:34.482756 0.168770 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:21:37.958723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:22:09.962728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:28:17.975302 3.001918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:28:24.981785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:28:32.983070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:28:48.986478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:29:20.992180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:35:24.997262 3.002075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:35:32.005101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:35:40.007352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:35:56.009717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:36:28.026390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:42:32.036140 2.997701 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 12:42:39.039625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:42:47.040540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:43:03.391319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:43:35.098430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:43:56.916066 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 12:43:56.916212 0.759762 tcp 10.0.2.105 63549 -> 31.192.24.67 3527 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/02/14 12:51:56.040320 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 12:51:56.040513 0.190894 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:56.228521 0.350649 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:56.712190 1.753316 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:58.428093 0.805359 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:58.763974 0.175580 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:58.909727 0.255604 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:59.127943 0.215899 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:59.336602 0.232932 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:59.549527 0.229789 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:51:59.770499 0.000000 udp 10.0.2.105 7010 -> 108.210.14.113 4384 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 12:52:16.211207 0.065172 tcp 10.0.2.105 63550 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 12:52:16.276651 0.062124 tcp 10.0.2.105 63551 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 12:52:16.339057 0.142915 tcp 10.0.2.105 63552 -> 195.113.214.249 443 SRPA* 0 0 37 27873 flow=From-Botnet-V2-TCP-Established 1970/02/14 12:52:16.483200 0.148356 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:16.620839 0.075145 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:16.769385 0.400423 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:17.148996 0.449075 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:17.576018 0.129829 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:17.705415 0.177265 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:17.862138 0.123260 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:17.967514 0.172858 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:18.137296 0.120273 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:18.295552 0.183095 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:18.476810 0.184448 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:18.674995 0.188281 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:18.835773 0.174962 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.003684 0.083825 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.068765 0.176480 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.241908 0.052200 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.301936 0.184614 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.481696 0.175394 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.609216 0.095266 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:52:19.704817 0.204587 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/14 12:53:45.085312 2.996004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 12:53:52.081383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:54:00.079481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:54:16.083832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 12:54:48.088180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:00:52.094746 3.001143 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 13:00:59.101367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:01:07.102927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:01:23.105870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:01:55.111657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:07:59.118625 3.000875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 13:08:06.125391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:08:14.127083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:08:30.129642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:09:02.136114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:13:57.671228 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:13:57.671334 3.003568 tcp 10.0.2.105 63553 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:06.673601 0.000000 tcp 10.0.2.105 63553 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:12.674202 0.065852 tcp 10.0.2.105 63554 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:12.740394 0.061526 tcp 10.0.2.105 63555 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:12.802211 0.163457 tcp 10.0.2.105 63556 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:13.286243 2.991224 tcp 10.0.2.105 63557 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:22.286057 0.000000 tcp 10.0.2.105 63557 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:28.546442 0.063883 tcp 10.0.2.105 63558 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:28.610549 0.065110 tcp 10.0.2.105 63559 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:28.675929 0.154615 tcp 10.0.2.105 63560 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:29.701453 2.967210 tcp 10.0.2.105 63561 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:38.614951 0.000000 tcp 10.0.2.105 63561 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:44.558353 0.061235 tcp 10.0.2.105 63562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:44.619448 0.066479 tcp 10.0.2.105 63563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:44.686175 0.149314 tcp 10.0.2.105 63564 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:14:45.113348 2.974246 tcp 10.0.2.105 63565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:14:54.028899 0.000000 tcp 10.0.2.105 63565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:15:00.009898 3.004732 tcp 10.0.2.105 63566 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:15:06.142254 3.001260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:15:09.013353 0.000000 tcp 10.0.2.105 63566 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:15:13.154513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:15:13.584854 0.000165 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:15:15.014357 3.002028 tcp 10.0.2.105 63567 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:15:21.151150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:15:24.015074 0.000000 tcp 10.0.2.105 63567 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:15:37.153599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:16:09.159571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:20:30.015238 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:20:30.015426 2.993704 tcp 10.0.2.105 63568 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:20:39.010259 0.000000 tcp 10.0.2.105 63568 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:20:45.019051 0.067183 tcp 10.0.2.105 63569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:20:45.086038 0.062825 tcp 10.0.2.105 63570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:20:45.149151 0.156337 tcp 10.0.2.105 63571 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:20:45.502517 2.999213 tcp 10.0.2.105 63572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:20:54.500108 0.000000 tcp 10.0.2.105 63572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:00.500227 0.061787 tcp 10.0.2.105 63573 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:00.562324 0.066211 tcp 10.0.2.105 63574 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:00.628817 0.150390 tcp 10.0.2.105 63575 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:00.996871 2.999744 tcp 10.0.2.105 63576 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:09.992500 0.000000 tcp 10.0.2.105 63576 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:15.991224 0.080618 tcp 10.0.2.105 63577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:16.072121 0.065959 tcp 10.0.2.105 63578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:16.138346 0.155826 tcp 10.0.2.105 63579 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:21:16.437530 3.008244 tcp 10.0.2.105 63580 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:25.444572 0.000000 tcp 10.0.2.105 63580 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:31.433320 2.994124 tcp 10.0.2.105 63581 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:40.436056 0.000000 tcp 10.0.2.105 63581 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:45.082564 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:21:46.434989 2.994958 tcp 10.0.2.105 63582 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:21:55.430005 0.000000 tcp 10.0.2.105 63582 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:22:18.173305 3.001342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:22:25.180652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:22:33.182977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:22:36.306599 0.000000 udp 10.0.2.105 7010 -> 108.210.14.113 4384 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 13:22:41.073149 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:22:49.184890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:22:52.151728 0.064134 tcp 10.0.2.105 63583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:22:52.216195 0.064745 tcp 10.0.2.105 63584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:22:52.281258 0.162680 tcp 10.0.2.105 63585 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:22:52.443481 0.190973 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:52.631351 0.384519 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:52.987017 0.132112 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:53.113482 0.099034 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:53.527893 0.452229 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:53.839966 0.237283 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:54.142424 0.217848 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:54.352648 0.252716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:54.568091 0.224598 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:54.785085 0.145342 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:55.052957 0.071970 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:55.108453 0.212722 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:55.362067 0.395589 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:55.739053 0.500555 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:56.219035 0.187641 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:56.686958 0.132365 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:56.800464 0.217321 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:57.009286 0.115684 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:57.272004 0.187296 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:57.430054 0.173687 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:57.596108 0.183389 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:57.876696 0.188365 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:58.173755 0.080418 udp 10.0.2.105 7010 <-> 86.161.61.195 8116 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:58.234499 0.176021 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:58.538255 0.058613 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:58.759095 0.185398 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:58.938365 0.174206 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:59.219224 0.093582 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:22:59.304344 0.169923 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:23:21.194724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:27:01.437865 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:27:01.438034 3.003755 tcp 10.0.2.105 63586 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:10.440655 0.000000 tcp 10.0.2.105 63586 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:16.440684 0.061212 tcp 10.0.2.105 63587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:16.502171 0.062196 tcp 10.0.2.105 63588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:16.564670 0.155423 tcp 10.0.2.105 63589 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:16.876007 2.998070 tcp 10.0.2.105 63590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:25.872746 0.000000 tcp 10.0.2.105 63590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:31.872138 0.201066 tcp 10.0.2.105 63591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:32.073536 0.064735 tcp 10.0.2.105 63592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:32.138569 0.150882 tcp 10.0.2.105 63593 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:32.374886 3.001417 tcp 10.0.2.105 63594 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:41.375083 0.000000 tcp 10.0.2.105 63594 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:47.374203 0.063313 tcp 10.0.2.105 63595 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:47.437738 0.066778 tcp 10.0.2.105 63596 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:47.504769 0.153269 tcp 10.0.2.105 63597 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:27:47.765347 2.993382 tcp 10.0.2.105 63598 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:27:56.767164 0.000000 tcp 10.0.2.105 63598 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:28:02.765928 2.993994 tcp 10.0.2.105 63599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:28:11.758633 0.000000 tcp 10.0.2.105 63599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:28:16.575330 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:28:17.768139 3.003587 tcp 10.0.2.105 63600 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:28:26.770154 0.000000 tcp 10.0.2.105 63600 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:29:25.196425 3.008252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:29:32.204458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:29:40.205499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:29:56.208764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:30:28.215028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:33:32.770929 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:33:32.771132 3.003529 tcp 10.0.2.105 63601 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:33:41.773166 0.000000 tcp 10.0.2.105 63601 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:33:47.772815 0.066240 tcp 10.0.2.105 63602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:33:47.839356 0.067467 tcp 10.0.2.105 63603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:33:47.907140 0.148835 tcp 10.0.2.105 63604 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:33:48.455884 3.001113 tcp 10.0.2.105 63605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:33:57.465631 0.000000 tcp 10.0.2.105 63605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:03.455018 0.064254 tcp 10.0.2.105 63606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:03.519560 0.062633 tcp 10.0.2.105 63607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:03.582478 0.159709 tcp 10.0.2.105 63608 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:03.990458 2.998716 tcp 10.0.2.105 63609 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:13.117165 0.000000 tcp 10.0.2.105 63609 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:19.059246 0.060919 tcp 10.0.2.105 63610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:19.120682 0.068866 tcp 10.0.2.105 63611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:19.189896 0.162218 tcp 10.0.2.105 63612 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:34:19.453847 2.966822 tcp 10.0.2.105 63613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:28.380048 0.000000 tcp 10.0.2.105 63613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:34.379164 3.003875 tcp 10.0.2.105 63614 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:43.381715 0.000000 tcp 10.0.2.105 63614 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:48.078731 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:34:49.380854 3.003926 tcp 10.0.2.105 63615 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:34:58.384081 0.000000 tcp 10.0.2.105 63615 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:36:32.221612 3.007073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:36:39.231628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:36:47.229723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:37:03.233203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:37:35.238751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:40:04.384554 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:40:04.384640 3.003096 tcp 10.0.2.105 63616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:13.396089 0.000000 tcp 10.0.2.105 63616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:19.386693 0.061995 tcp 10.0.2.105 63617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:19.448966 0.064714 tcp 10.0.2.105 63618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:19.513996 0.152738 tcp 10.0.2.105 63619 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:19.803796 2.995941 tcp 10.0.2.105 63620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:28.798263 0.000000 tcp 10.0.2.105 63620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:34.797383 0.065450 tcp 10.0.2.105 63621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:34.862685 0.064433 tcp 10.0.2.105 63622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:34.927389 0.151869 tcp 10.0.2.105 63623 -> 195.113.214.249 443 SRPA* 0 0 42 36098 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:35.121745 3.000064 tcp 10.0.2.105 63624 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:44.120332 0.000000 tcp 10.0.2.105 63624 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:50.119600 0.060226 tcp 10.0.2.105 63625 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:50.180070 0.067220 tcp 10.0.2.105 63626 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:50.247557 0.150581 tcp 10.0.2.105 63627 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:40:50.606740 2.997172 tcp 10.0.2.105 63628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:40:59.604814 0.000000 tcp 10.0.2.105 63628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:41:05.601427 3.004113 tcp 10.0.2.105 63629 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:41:14.606970 0.000000 tcp 10.0.2.105 63629 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:41:19.583454 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:41:20.610338 2.986972 tcp 10.0.2.105 63630 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:41:29.613407 0.000000 tcp 10.0.2.105 63630 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:43:39.246201 3.000614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:43:46.252765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:43:54.255450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:44:10.256928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:44:42.262948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:46:35.606270 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:46:35.606430 2.995473 tcp 10.0.2.105 63631 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:46:44.598607 0.000000 tcp 10.0.2.105 63631 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:46:50.609365 0.061699 tcp 10.0.2.105 63632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:46:50.671311 0.065373 tcp 10.0.2.105 63633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:46:50.736986 0.160069 tcp 10.0.2.105 63634 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:46:50.958614 3.003659 tcp 10.0.2.105 63635 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:46:59.961195 0.000000 tcp 10.0.2.105 63635 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:05.960806 0.064333 tcp 10.0.2.105 63636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:06.025379 0.061034 tcp 10.0.2.105 63637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:06.086657 0.162852 tcp 10.0.2.105 63638 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:06.261229 3.002928 tcp 10.0.2.105 63639 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:15.263117 0.000000 tcp 10.0.2.105 63639 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:21.261988 0.062738 tcp 10.0.2.105 63640 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:21.325037 0.063754 tcp 10.0.2.105 63641 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:21.389090 0.153481 tcp 10.0.2.105 63642 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:47:21.553345 3.002689 tcp 10.0.2.105 63643 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:30.554703 0.000000 tcp 10.0.2.105 63643 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:36.553612 3.004322 tcp 10.0.2.105 63644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:45.566629 0.000000 tcp 10.0.2.105 63644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:47:50.073136 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:47:51.555167 2.994011 tcp 10.0.2.105 63645 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:48:00.547991 0.000000 tcp 10.0.2.105 63645 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:53:21.011170 0.000188 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:53:21.011486 0.188968 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 1972 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:21.197287 0.085450 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:21.491411 0.351197 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:21.561369 3.008926 tcp 10.0.2.105 63646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:53:21.812635 0.151475 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:21.947774 0.428704 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:22.285839 0.235838 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:22.502830 0.213307 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:22.726392 0.259041 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:22.950926 0.074460 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:23.026375 0.127824 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:23.261037 0.223644 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:23.476814 0.159910 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:23.686410 0.401950 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:24.068238 0.444940 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:24.490268 0.181202 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:24.648638 0.130983 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:24.761560 0.170615 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:24.973786 0.109134 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:25.050051 0.187099 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:25.210126 0.183895 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:25.461448 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 13:53:30.562186 0.000000 tcp 10.0.2.105 63646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:53:36.562980 0.062391 tcp 10.0.2.105 63647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:36.625663 0.061662 tcp 10.0.2.105 63648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:36.687603 0.150504 tcp 10.0.2.105 63649 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:36.958657 3.007144 tcp 10.0.2.105 63650 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:53:41.588654 0.061326 tcp 10.0.2.105 63651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:41.650290 0.068636 tcp 10.0.2.105 63652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:41.719300 0.158076 tcp 10.0.2.105 63653 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:53:41.878007 0.174127 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.044441 0.172946 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.191747 0.176982 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.365994 0.052233 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.429734 0.184450 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.608993 0.128557 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.714395 0.093343 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:42.798756 0.171621 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/14 13:53:45.964339 0.000000 tcp 10.0.2.105 63650 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:54:19.275317 3.003911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 13:54:26.282624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:54:34.283943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:54:50.287084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:55:22.293027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 13:58:51.955146 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 13:58:51.955279 2.993573 tcp 10.0.2.105 63654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:00.957377 0.000000 tcp 10.0.2.105 63654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:06.957921 0.065984 tcp 10.0.2.105 63655 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:07.024112 0.065917 tcp 10.0.2.105 63656 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:07.090342 0.163466 tcp 10.0.2.105 63657 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:07.263606 2.997385 tcp 10.0.2.105 63658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:16.259477 0.000000 tcp 10.0.2.105 63658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:22.258901 0.066094 tcp 10.0.2.105 63659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:22.325324 0.066843 tcp 10.0.2.105 63660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:22.392528 0.162830 tcp 10.0.2.105 63661 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:22.566518 2.996862 tcp 10.0.2.105 63662 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:31.561460 0.000000 tcp 10.0.2.105 63662 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:37.560882 0.060017 tcp 10.0.2.105 63663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:37.621159 0.062420 tcp 10.0.2.105 63664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:37.683881 0.160140 tcp 10.0.2.105 63665 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/14 13:59:37.866589 2.998360 tcp 10.0.2.105 63666 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:46.863292 0.000000 tcp 10.0.2.105 63666 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 13:59:52.862234 3.004123 tcp 10.0.2.105 63667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:00:01.865050 0.000000 tcp 10.0.2.105 63667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:00:06.582149 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:00:07.863955 2.993681 tcp 10.0.2.105 63668 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:00:16.866601 0.000000 tcp 10.0.2.105 63668 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:01:26.302527 2.998605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:01:33.306414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:01:41.310711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:01:57.311261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:02:29.317351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:05:22.867219 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:05:22.867361 2.993098 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:05:31.859089 0.000000 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:05:37.874019 0.062094 tcp 10.0.2.105 63670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:37.936537 0.065071 tcp 10.0.2.105 63671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:38.001933 0.161652 tcp 10.0.2.105 63672 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:38.191845 3.000976 tcp 10.0.2.105 63673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:05:47.191568 0.000000 tcp 10.0.2.105 63673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:05:53.190710 0.065078 tcp 10.0.2.105 63674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:53.255635 0.063223 tcp 10.0.2.105 63675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:53.319163 0.150775 tcp 10.0.2.105 63676 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:05:53.497322 3.007421 tcp 10.0.2.105 63677 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:02.503408 0.000000 tcp 10.0.2.105 63677 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:08.492805 0.062660 tcp 10.0.2.105 63678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:06:08.555742 0.065143 tcp 10.0.2.105 63679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:06:08.621132 0.158650 tcp 10.0.2.105 63680 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:06:08.802025 3.009990 tcp 10.0.2.105 63681 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:17.805325 0.000000 tcp 10.0.2.105 63681 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:23.794078 2.993969 tcp 10.0.2.105 63682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:32.797421 0.000000 tcp 10.0.2.105 63682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:37.573917 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:06:38.795663 2.994201 tcp 10.0.2.105 63683 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:06:47.788824 0.000000 tcp 10.0.2.105 63683 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:08:33.323217 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:08:40.330305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:08:48.331869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:09:04.334854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:09:36.765842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:11:53.799164 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:11:53.799370 3.003479 tcp 10.0.2.105 63684 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:02.801400 0.000000 tcp 10.0.2.105 63684 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:08.802401 0.061669 tcp 10.0.2.105 63685 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:08.864343 0.065744 tcp 10.0.2.105 63686 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:08.930352 0.151096 tcp 10.0.2.105 63687 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:09.132852 3.001686 tcp 10.0.2.105 63688 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:18.133486 0.000000 tcp 10.0.2.105 63688 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:24.132697 0.061349 tcp 10.0.2.105 63689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:24.194357 0.062193 tcp 10.0.2.105 63690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:24.256812 0.149188 tcp 10.0.2.105 63691 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:24.448642 3.008333 tcp 10.0.2.105 63692 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:33.455918 0.000000 tcp 10.0.2.105 63692 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:39.444984 0.061541 tcp 10.0.2.105 63693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:39.506777 0.062350 tcp 10.0.2.105 63694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:39.569445 0.149327 tcp 10.0.2.105 63695 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:12:39.747117 3.001859 tcp 10.0.2.105 63696 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:48.747677 0.000000 tcp 10.0.2.105 63696 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:12:54.746397 2.993972 tcp 10.0.2.105 63697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:13:03.739272 0.000000 tcp 10.0.2.105 63697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:13:08.576187 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:13:09.747860 3.004169 tcp 10.0.2.105 63698 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:13:18.750892 0.000000 tcp 10.0.2.105 63698 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:15:40.356525 3.002108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:15:47.365218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:15:55.366589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:16:11.369015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:16:43.374906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:18:24.751497 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:18:24.751616 3.003390 tcp 10.0.2.105 63699 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:18:33.753378 0.000000 tcp 10.0.2.105 63699 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:18:39.754332 0.060883 tcp 10.0.2.105 63700 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:39.815547 0.065312 tcp 10.0.2.105 63701 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:39.881214 0.160113 tcp 10.0.2.105 63702 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:40.409910 2.997732 tcp 10.0.2.105 63703 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:18:49.418867 0.000000 tcp 10.0.2.105 63703 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:18:55.405303 0.061287 tcp 10.0.2.105 63704 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:55.466866 0.060783 tcp 10.0.2.105 63705 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:55.528030 0.152710 tcp 10.0.2.105 63706 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:18:55.815747 2.994001 tcp 10.0.2.105 63707 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:04.811552 0.000000 tcp 10.0.2.105 63707 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:10.817487 0.064861 tcp 10.0.2.105 63708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:19:10.882592 0.062809 tcp 10.0.2.105 63709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:19:10.945676 0.151262 tcp 10.0.2.105 63710 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:19:11.288491 2.993498 tcp 10.0.2.105 63711 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:20.280063 0.000000 tcp 10.0.2.105 63711 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:26.279407 3.003845 tcp 10.0.2.105 63712 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:35.282432 0.000000 tcp 10.0.2.105 63712 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:40.079057 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:19:41.280366 3.004844 tcp 10.0.2.105 63713 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:19:50.285628 0.000000 tcp 10.0.2.105 63713 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:22:47.381545 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:22:54.388531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:23:02.390069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:23:18.393161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:23:50.400618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:23:58.712176 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:23:58.712350 0.000000 udp 10.0.2.105 7010 -> 86.161.61.195 8116 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 14:24:16.117366 0.062161 tcp 10.0.2.105 63714 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:24:16.179734 0.061470 tcp 10.0.2.105 63715 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:24:16.241473 0.221355 tcp 10.0.2.105 63716 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:24:16.463512 0.193926 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:16.650800 0.118436 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:16.893939 0.343539 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:17.025475 0.410387 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:17.442704 0.217315 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:17.652303 0.237863 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:17.870537 0.291507 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:18.132397 0.127443 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:18.390196 0.225281 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:18.608900 0.076536 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:18.843452 0.318231 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:19.128763 0.147874 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:19.521140 0.399208 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:19.899018 0.130879 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:20.011545 0.180681 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:20.278879 0.438093 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:20.695937 0.179911 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.149976 0.174135 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.321427 0.111659 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.399191 0.187929 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.623567 0.173377 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.788457 0.179196 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:21.954926 0.175334 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:22.126429 0.055084 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:22.735384 0.182724 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:22.934645 0.145096 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:23.034779 0.105992 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:23.131280 0.170573 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:24:56.283964 3.586761 tcp 10.0.2.105 63717 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:01.645933 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:25:05.809924 0.000000 tcp 10.0.2.105 63717 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:11.750547 0.063581 tcp 10.0.2.105 63718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:11.814422 0.065443 tcp 10.0.2.105 63719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:11.880154 0.151376 tcp 10.0.2.105 63720 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:12.160948 2.961039 tcp 10.0.2.105 63721 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:21.051744 0.000000 tcp 10.0.2.105 63721 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:26.981746 0.060640 tcp 10.0.2.105 63722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:27.042708 0.068082 tcp 10.0.2.105 63723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:27.111103 0.154690 tcp 10.0.2.105 63724 -> 195.113.214.249 443 SRPA* 0 0 32 22996 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:27.367735 2.955434 tcp 10.0.2.105 63725 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:36.245181 0.000000 tcp 10.0.2.105 63725 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:42.171895 0.064237 tcp 10.0.2.105 63726 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:42.236430 0.065804 tcp 10.0.2.105 63727 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:42.302517 0.163934 tcp 10.0.2.105 63728 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:25:42.501317 2.966138 tcp 10.0.2.105 63729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:51.422820 0.000000 tcp 10.0.2.105 63729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:25:57.421871 3.004060 tcp 10.0.2.105 63730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:26:06.424517 0.000000 tcp 10.0.2.105 63730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:26:11.495331 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:26:12.827561 2.966100 tcp 10.0.2.105 63731 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:26:21.743267 0.000000 tcp 10.0.2.105 63731 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:29:54.405163 3.001204 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:30:01.412627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:30:09.413643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:30:25.416834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:30:57.422766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:31:27.426457 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:31:27.426633 2.993524 tcp 10.0.2.105 63732 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:31:36.418923 0.000000 tcp 10.0.2.105 63732 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:31:42.429288 0.061370 tcp 10.0.2.105 63733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:42.490922 0.068119 tcp 10.0.2.105 63734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:42.559325 0.153622 tcp 10.0.2.105 63735 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:43.009841 3.005296 tcp 10.0.2.105 63736 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:31:52.011351 0.000000 tcp 10.0.2.105 63736 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:31:58.010571 0.061111 tcp 10.0.2.105 63737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:58.071967 0.067028 tcp 10.0.2.105 63738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:58.139272 0.154070 tcp 10.0.2.105 63739 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:31:58.494499 3.000391 tcp 10.0.2.105 63740 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:07.493692 0.000000 tcp 10.0.2.105 63740 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:13.493045 0.066533 tcp 10.0.2.105 63741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:32:13.559904 0.062299 tcp 10.0.2.105 63742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:32:13.622509 0.156940 tcp 10.0.2.105 63743 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:32:13.825123 3.003019 tcp 10.0.2.105 63744 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:22.825539 0.000000 tcp 10.0.2.105 63744 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:28.824445 2.993744 tcp 10.0.2.105 63745 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:37.827253 0.000000 tcp 10.0.2.105 63745 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:42.574167 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:32:43.825975 2.993753 tcp 10.0.2.105 63746 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:32:53.195090 0.000000 tcp 10.0.2.105 63746 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:37:01.429271 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:37:08.437092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:37:16.437662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:37:32.440891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:37:58.829319 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:37:58.829421 3.004068 tcp 10.0.2.105 63747 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:04.450849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:38:07.831539 0.000000 tcp 10.0.2.105 63747 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:13.834582 0.068662 tcp 10.0.2.105 63748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:13.903602 0.065627 tcp 10.0.2.105 63749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:13.969480 0.186095 tcp 10.0.2.105 63750 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:14.276638 2.998703 tcp 10.0.2.105 63751 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:23.275378 0.000000 tcp 10.0.2.105 63751 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:29.274887 0.061016 tcp 10.0.2.105 63752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:29.336149 0.061629 tcp 10.0.2.105 63753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:29.398123 0.152881 tcp 10.0.2.105 63754 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:29.941164 2.999621 tcp 10.0.2.105 63755 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:38.951402 0.000000 tcp 10.0.2.105 63755 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:44.935860 0.060425 tcp 10.0.2.105 63756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:44.996534 0.064704 tcp 10.0.2.105 63757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:45.061554 0.162713 tcp 10.0.2.105 63758 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:38:45.350175 3.000617 tcp 10.0.2.105 63759 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:38:54.350785 0.000000 tcp 10.0.2.105 63759 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:39:00.347376 3.004129 tcp 10.0.2.105 63760 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:39:09.350073 0.000000 tcp 10.0.2.105 63760 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:39:14.094946 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:39:15.358072 2.995028 tcp 10.0.2.105 63761 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:39:24.351781 0.000000 tcp 10.0.2.105 63761 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:44:08.454770 2.999703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:44:15.460556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:44:23.462873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:44:30.352659 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:44:30.352765 3.003029 tcp 10.0.2.105 63762 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:44:39.354779 0.000000 tcp 10.0.2.105 63762 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:44:39.465043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:44:45.355008 0.061192 tcp 10.0.2.105 63763 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:44:45.416551 0.061498 tcp 10.0.2.105 63764 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:44:45.478324 0.153534 tcp 10.0.2.105 63765 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:44:45.754618 2.996780 tcp 10.0.2.105 63766 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:44:54.757194 0.000000 tcp 10.0.2.105 63766 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:00.756104 0.060643 tcp 10.0.2.105 63767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:00.817020 0.060245 tcp 10.0.2.105 63768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:00.877560 0.148528 tcp 10.0.2.105 63769 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:01.187245 3.002975 tcp 10.0.2.105 63770 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:10.189077 0.000000 tcp 10.0.2.105 63770 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:11.470819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:45:16.188051 0.063905 tcp 10.0.2.105 63771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:16.252372 0.070221 tcp 10.0.2.105 63772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:16.322878 0.153295 tcp 10.0.2.105 63773 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:45:16.988918 3.004297 tcp 10.0.2.105 63774 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:25.994127 0.000000 tcp 10.0.2.105 63774 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:31.994744 2.999642 tcp 10.0.2.105 63775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:40.993271 0.000000 tcp 10.0.2.105 63775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:45.579932 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:45:46.992241 3.006663 tcp 10.0.2.105 63776 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:45:55.994969 0.000000 tcp 10.0.2.105 63776 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:54:35.484886 3.005399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 14:54:42.492029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:54:50.433349 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 14:54:50.433448 0.124284 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:54:50.493348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:54:50.534050 0.188777 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:54:50.720017 0.117431 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:54:50.798210 0.356757 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:54:51.126586 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 14:55:02.020382 3.003716 tcp 10.0.2.105 63777 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:55:06.496565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 14:55:07.699566 0.064262 tcp 10.0.2.105 63778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:07.764132 0.060950 tcp 10.0.2.105 63779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:07.825375 0.148737 tcp 10.0.2.105 63780 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:07.974651 0.234387 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:08.187523 0.330138 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:08.487572 0.073508 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:08.547195 0.128371 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:08.675515 0.226427 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:08.894957 0.251875 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:09.112393 0.148211 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:09.248272 0.395289 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:09.622288 0.131832 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:09.773672 0.184322 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:09.934482 0.586494 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:10.432134 0.117102 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2619 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:10.581340 0.184463 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:10.844520 0.172482 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.013998 0.191088 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.022603 0.000000 tcp 10.0.2.105 63777 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:55:11.213725 0.175741 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.381319 0.177007 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.532446 0.176836 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.706803 0.142436 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.850373 0.095256 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:11.935321 0.055671 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:12.030486 0.183255 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:12.208995 0.169478 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 14:55:17.022126 0.060063 tcp 10.0.2.105 63781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:17.082039 0.062945 tcp 10.0.2.105 63782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:17.145325 0.150238 tcp 10.0.2.105 63783 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 14:55:17.421731 3.004770 tcp 10.0.2.105 63784 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:55:26.425069 0.000000 tcp 10.0.2.105 63784 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 14:55:38.502581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:00:32.415753 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:00:32.415948 2.993190 tcp 10.0.2.105 63785 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:00:41.407726 0.000000 tcp 10.0.2.105 63785 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:00:47.418775 0.060852 tcp 10.0.2.105 63786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:00:47.479895 0.061696 tcp 10.0.2.105 63787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:00:47.541895 0.157372 tcp 10.0.2.105 63788 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:00:47.746908 2.994299 tcp 10.0.2.105 63789 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:00:56.740087 0.000000 tcp 10.0.2.105 63789 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:02.739442 0.060273 tcp 10.0.2.105 63790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:02.799970 0.061612 tcp 10.0.2.105 63791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:02.861855 0.157220 tcp 10.0.2.105 63792 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:03.048475 3.004705 tcp 10.0.2.105 63793 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:12.051926 0.000000 tcp 10.0.2.105 63793 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:18.040753 0.060928 tcp 10.0.2.105 63794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:18.101958 0.060483 tcp 10.0.2.105 63795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:18.162714 0.162344 tcp 10.0.2.105 63796 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:01:18.335948 2.999516 tcp 10.0.2.105 63797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:27.333714 0.000000 tcp 10.0.2.105 63797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:33.333200 3.003741 tcp 10.0.2.105 63798 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:42.335650 0.000000 tcp 10.0.2.105 63798 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:42.508889 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:01:47.072395 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:01:48.333999 2.994509 tcp 10.0.2.105 63799 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:49.516428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:01:57.337119 0.000000 tcp 10.0.2.105 63799 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:01:57.570695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:02:13.520541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:02:45.526791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:07:03.337861 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:07:03.338036 3.003166 tcp 10.0.2.105 63800 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:12.339944 0.000000 tcp 10.0.2.105 63800 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:18.340553 0.061496 tcp 10.0.2.105 63801 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:18.402319 0.062984 tcp 10.0.2.105 63802 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:18.465596 0.155506 tcp 10.0.2.105 63803 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:18.687355 2.995842 tcp 10.0.2.105 63804 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:27.681880 0.000000 tcp 10.0.2.105 63804 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:33.680934 0.061055 tcp 10.0.2.105 63805 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:33.742305 0.061243 tcp 10.0.2.105 63806 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:33.803854 0.161309 tcp 10.0.2.105 63807 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:34.109638 3.006121 tcp 10.0.2.105 63808 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:43.113998 0.000000 tcp 10.0.2.105 63808 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:49.103378 0.061106 tcp 10.0.2.105 63809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:49.164729 0.064486 tcp 10.0.2.105 63810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:49.229499 0.155925 tcp 10.0.2.105 63811 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:07:49.443266 3.007722 tcp 10.0.2.105 63812 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:07:58.456145 0.000000 tcp 10.0.2.105 63812 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:08:04.445102 2.994142 tcp 10.0.2.105 63813 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:08:13.439727 0.000000 tcp 10.0.2.105 63813 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:08:18.074419 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:08:19.447012 2.993706 tcp 10.0.2.105 63814 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:08:28.439283 0.000000 tcp 10.0.2.105 63814 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:08:49.533273 3.000615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:08:56.539725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:09:04.541427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:09:20.544201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:09:52.550623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:13:34.450263 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:13:34.450362 3.003232 tcp 10.0.2.105 63815 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:13:43.452250 0.000000 tcp 10.0.2.105 63815 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:13:49.452802 0.060984 tcp 10.0.2.105 63816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:13:49.514046 0.061896 tcp 10.0.2.105 63817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:13:49.576382 0.155438 tcp 10.0.2.105 63818 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:13:49.757975 3.007487 tcp 10.0.2.105 63819 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:13:58.763985 0.000000 tcp 10.0.2.105 63819 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:04.753375 0.678205 tcp 10.0.2.105 63820 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:05.431830 1.064545 tcp 10.0.2.105 63821 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:06.496350 4.171261 tcp 10.0.2.105 63822 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:10.719906 3.010842 tcp 10.0.2.105 63823 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:19.724622 0.000000 tcp 10.0.2.105 63823 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:25.713619 0.066530 tcp 10.0.2.105 63824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:25.780566 0.071025 tcp 10.0.2.105 63825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:25.851861 0.166218 tcp 10.0.2.105 63826 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:14:26.093689 2.993644 tcp 10.0.2.105 63827 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:35.096747 0.000000 tcp 10.0.2.105 63827 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:41.095191 2.993717 tcp 10.0.2.105 63828 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:50.088151 0.000000 tcp 10.0.2.105 63828 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:14:55.075431 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:14:56.096728 2.994413 tcp 10.0.2.105 63829 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:15:05.094796 0.000000 tcp 10.0.2.105 63829 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:15:58.561618 2.999195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:16:05.566701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:16:13.568164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:16:29.571397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:17:01.577212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:20:11.101525 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:20:11.101643 3.002275 tcp 10.0.2.105 63830 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:20.102758 0.000000 tcp 10.0.2.105 63830 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:26.102631 0.062682 tcp 10.0.2.105 63831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:26.165599 0.064965 tcp 10.0.2.105 63832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:26.230834 0.154649 tcp 10.0.2.105 63833 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:26.596418 3.000048 tcp 10.0.2.105 63834 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:35.594794 0.000000 tcp 10.0.2.105 63834 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:41.593982 0.062923 tcp 10.0.2.105 63835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:41.657255 0.061823 tcp 10.0.2.105 63836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:41.719365 0.156761 tcp 10.0.2.105 63837 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:20:41.981713 2.986099 tcp 10.0.2.105 63838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:51.082408 0.000000 tcp 10.0.2.105 63838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:20:57.038060 2.965889 tcp 10.0.2.105 63839 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:21:05.968720 0.000000 tcp 10.0.2.105 63839 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:21:10.575215 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:23:05.583137 3.002009 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:23:12.590652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:23:20.591924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:23:36.595016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:24:08.603127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:25:38.801236 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:25:38.801341 0.216213 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.009868 0.190247 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.197101 0.137508 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.337370 0.081171 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.383030 0.358604 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.714313 0.232146 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2018 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:39.928134 0.335061 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:40.203187 0.074750 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:40.406797 0.131358 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:40.587983 0.167826 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:40.835869 0.227797 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:41.056182 0.299831 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:41.321148 0.392993 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:41.694247 0.124829 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:41.848950 0.183316 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:42.011296 0.452523 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:42.441761 0.108542 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:42.684778 0.189027 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:42.843707 0.172730 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.008561 0.184861 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.212460 0.199545 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.407438 0.197920 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.631143 0.174773 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.802936 0.182257 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:43.991446 0.093898 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:44.075584 0.051876 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:44.188129 0.182292 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:25:44.365611 0.170213 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:26:11.981119 3.001446 tcp 10.0.2.105 63840 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:16.574987 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:26:20.981412 0.000000 tcp 10.0.2.105 63840 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:26.981796 0.061004 tcp 10.0.2.105 63841 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:27.043060 0.059960 tcp 10.0.2.105 63842 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:27.103304 0.150480 tcp 10.0.2.105 63843 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:27.371555 3.005405 tcp 10.0.2.105 63844 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:36.373592 0.000000 tcp 10.0.2.105 63844 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:42.372781 0.065193 tcp 10.0.2.105 63845 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:42.438258 0.062510 tcp 10.0.2.105 63846 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:42.501048 0.159597 tcp 10.0.2.105 63847 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:42.808440 3.008365 tcp 10.0.2.105 63848 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:51.828692 0.000000 tcp 10.0.2.105 63848 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:26:57.804972 0.059841 tcp 10.0.2.105 63849 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:57.865096 0.064364 tcp 10.0.2.105 63850 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:57.929293 0.151106 tcp 10.0.2.105 63851 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:26:58.493272 2.996437 tcp 10.0.2.105 63852 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:27:07.488188 0.000000 tcp 10.0.2.105 63852 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:27:13.487008 3.004183 tcp 10.0.2.105 63853 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:27:22.489866 0.000000 tcp 10.0.2.105 63853 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:27:27.076082 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:27:28.488700 3.009799 tcp 10.0.2.105 63854 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:27:37.491364 0.000000 tcp 10.0.2.105 63854 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:30:12.608092 3.000729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:30:19.614999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:30:27.616152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:30:43.619093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:31:15.625279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:32:43.491739 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:32:43.491821 3.004035 tcp 10.0.2.105 63855 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:32:52.494509 0.000000 tcp 10.0.2.105 63855 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:32:58.494324 0.064617 tcp 10.0.2.105 63856 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:32:58.559174 0.062048 tcp 10.0.2.105 63857 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:32:58.621531 0.155847 tcp 10.0.2.105 63858 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:32:58.839227 2.998369 tcp 10.0.2.105 63859 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:07.846332 0.000000 tcp 10.0.2.105 63859 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:13.839586 0.061013 tcp 10.0.2.105 63860 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:13.900968 0.062101 tcp 10.0.2.105 63861 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:13.963382 0.149767 tcp 10.0.2.105 63862 -> 195.113.214.249 443 SRPA* 0 0 22 11416 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:14.159007 2.995543 tcp 10.0.2.105 63863 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:23.152807 0.000000 tcp 10.0.2.105 63863 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:29.159838 0.059655 tcp 10.0.2.105 63864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:29.219780 0.061130 tcp 10.0.2.105 63865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:29.281173 0.151115 tcp 10.0.2.105 63866 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:33:29.448806 2.992535 tcp 10.0.2.105 63867 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:38.440581 0.000000 tcp 10.0.2.105 63867 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:44.439446 3.003698 tcp 10.0.2.105 63868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:53.442065 0.000000 tcp 10.0.2.105 63868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:33:58.078600 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:33:59.441121 3.003720 tcp 10.0.2.105 63869 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:34:08.443518 0.000000 tcp 10.0.2.105 63869 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:37:19.630958 3.003856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:37:26.639407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:37:34.644461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:37:50.643021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:38:22.649464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:39:14.444044 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:39:14.444204 2.993689 tcp 10.0.2.105 63870 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:39:23.446760 0.000000 tcp 10.0.2.105 63870 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:39:29.446475 0.095789 tcp 10.0.2.105 63871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:29.542513 0.060863 tcp 10.0.2.105 63872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:29.603639 0.151642 tcp 10.0.2.105 63873 -> 195.113.214.249 443 SRPA* 0 0 51 33374 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:29.977534 3.002844 tcp 10.0.2.105 63874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:39:38.978855 0.000000 tcp 10.0.2.105 63874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:39:44.978335 0.067199 tcp 10.0.2.105 63875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:45.045806 0.066271 tcp 10.0.2.105 63876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:45.112515 0.152721 tcp 10.0.2.105 63877 -> 195.113.214.249 443 SRPA* 0 0 25 11142 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:39:45.417041 2.995354 tcp 10.0.2.105 63878 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:39:54.410888 0.000000 tcp 10.0.2.105 63878 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:00.410332 0.780508 tcp 10.0.2.105 63879 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:40:01.191155 0.064144 tcp 10.0.2.105 63880 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:40:01.255560 0.164451 tcp 10.0.2.105 63881 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:40:01.625709 2.967080 tcp 10.0.2.105 63882 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:10.516648 0.000000 tcp 10.0.2.105 63882 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:16.439648 2.972089 tcp 10.0.2.105 63883 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:25.349781 0.000000 tcp 10.0.2.105 63883 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:29.945968 0.271339 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:40:31.535237 2.956601 tcp 10.0.2.105 63884 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:40:40.430406 0.000000 tcp 10.0.2.105 63884 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:44:26.655415 3.001470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:44:33.662779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:44:41.663929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:44:57.666995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:45:29.672865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:45:45.930906 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:45:45.931069 2.989565 tcp 10.0.2.105 63885 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:45:54.918924 0.000000 tcp 10.0.2.105 63885 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:00.931703 0.142661 tcp 10.0.2.105 63886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:01.074718 0.070738 tcp 10.0.2.105 63887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:01.145790 0.150329 tcp 10.0.2.105 63888 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:01.486024 2.983412 tcp 10.0.2.105 63889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:10.429945 0.000000 tcp 10.0.2.105 63889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:16.410823 0.060952 tcp 10.0.2.105 63890 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:16.472040 0.061738 tcp 10.0.2.105 63891 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:16.534100 0.157757 tcp 10.0.2.105 63892 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:16.754929 3.000154 tcp 10.0.2.105 63893 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:25.753563 0.000000 tcp 10.0.2.105 63893 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:31.753218 0.063509 tcp 10.0.2.105 63894 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:31.817123 0.063764 tcp 10.0.2.105 63895 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:31.881169 0.153811 tcp 10.0.2.105 63896 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:46:32.223027 3.005012 tcp 10.0.2.105 63897 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:41.235853 0.000000 tcp 10.0.2.105 63897 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:47.214590 2.994348 tcp 10.0.2.105 63898 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:46:56.217627 0.000000 tcp 10.0.2.105 63898 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:47:01.080703 1.157759 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:47:03.356715 2.955409 tcp 10.0.2.105 63899 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:47:12.243984 0.000000 tcp 10.0.2.105 63899 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:54:45.685921 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 15:54:52.692469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:55:00.693977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:55:16.697340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:55:48.703057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 15:56:06.028531 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:56:06.028674 0.213982 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:06.235291 0.188264 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:06.420426 0.145573 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:06.527167 0.093337 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:06.643367 0.353829 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:06.968963 0.235733 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:07.183703 0.315791 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:07.439658 0.150715 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:07.609200 0.226058 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1990 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:07.828138 0.362770 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:08.158114 0.075077 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:08.246097 0.128713 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:08.374685 0.398374 udp 10.0.2.105 7010 <-> 1.160.229.107 7701 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:08.752441 0.125538 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:08.857658 0.182286 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:09.017713 0.185570 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:09.176250 0.173240 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:09.341945 0.184371 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:09.557249 0.487552 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:10.181515 0.114546 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:10.259212 0.175231 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:10.431193 0.177959 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:10.694911 0.176968 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:10.868844 0.182074 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:11.003795 0.097621 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:11.089032 0.051761 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:11.220442 0.181638 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:11.397281 0.169341 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 15:56:17.244845 2.993642 tcp 10.0.2.105 63900 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:56:26.247142 0.000000 tcp 10.0.2.105 63900 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:56:31.074059 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:56:32.247908 0.061871 tcp 10.0.2.105 63901 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:32.310058 0.070993 tcp 10.0.2.105 63902 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:32.381285 0.147815 tcp 10.0.2.105 63903 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:32.567786 3.002766 tcp 10.0.2.105 63904 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:56:41.568845 0.000000 tcp 10.0.2.105 63904 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:56:47.568528 0.060616 tcp 10.0.2.105 63905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:47.629436 0.064621 tcp 10.0.2.105 63906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:47.694300 0.153834 tcp 10.0.2.105 63907 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:56:48.102011 3.001016 tcp 10.0.2.105 63908 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:56:57.101274 0.000000 tcp 10.0.2.105 63908 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:03.100715 0.063759 tcp 10.0.2.105 63909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:57:03.164688 0.061876 tcp 10.0.2.105 63910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:57:03.226846 0.155870 tcp 10.0.2.105 63911 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 15:57:03.512917 3.001953 tcp 10.0.2.105 63912 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:12.513368 0.000000 tcp 10.0.2.105 63912 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:18.513463 3.003248 tcp 10.0.2.105 63913 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:27.515116 0.000000 tcp 10.0.2.105 63913 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:32.081515 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 15:57:33.513720 2.994433 tcp 10.0.2.105 63914 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 15:57:42.516820 0.000000 tcp 10.0.2.105 63914 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:01:52.710512 3.000236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:01:59.716749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:02:07.717928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:02:23.721037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:02:48.517399 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:02:48.517563 3.007120 tcp 10.0.2.105 63915 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:02:55.733086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:02:57.523249 0.000000 tcp 10.0.2.105 63915 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:03.522719 0.060481 tcp 10.0.2.105 63916 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:03.583470 0.061121 tcp 10.0.2.105 63917 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:03.644875 0.157725 tcp 10.0.2.105 63918 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:03.841138 3.001867 tcp 10.0.2.105 63919 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:12.841611 0.000000 tcp 10.0.2.105 63919 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:18.840837 0.066943 tcp 10.0.2.105 63920 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:18.908089 0.069413 tcp 10.0.2.105 63921 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:18.977788 0.147780 tcp 10.0.2.105 63922 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:19.213543 3.001885 tcp 10.0.2.105 63923 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:28.213685 0.000000 tcp 10.0.2.105 63923 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:34.213649 0.065361 tcp 10.0.2.105 63924 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:34.279291 0.064677 tcp 10.0.2.105 63925 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:34.344342 0.152712 tcp 10.0.2.105 63926 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:03:34.508140 3.009126 tcp 10.0.2.105 63927 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:43.515582 0.000000 tcp 10.0.2.105 63927 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:49.504884 2.993750 tcp 10.0.2.105 63928 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:03:58.507445 0.000000 tcp 10.0.2.105 63928 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:04:03.073873 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:04:04.505902 2.994364 tcp 10.0.2.105 63929 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:04:13.498490 0.000000 tcp 10.0.2.105 63929 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:03.739236 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:09:10.746244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:09:18.747747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:09:19.509187 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:09:19.509376 3.003838 tcp 10.0.2.105 63930 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:28.511943 0.000000 tcp 10.0.2.105 63930 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:34.512280 0.061517 tcp 10.0.2.105 63931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:34.574062 0.061863 tcp 10.0.2.105 63932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:34.636391 0.160438 tcp 10.0.2.105 63933 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:34.750685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:09:35.084066 3.001366 tcp 10.0.2.105 63934 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:44.083771 0.000000 tcp 10.0.2.105 63934 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:50.083294 0.061624 tcp 10.0.2.105 63935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:50.145181 0.065109 tcp 10.0.2.105 63936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:50.210543 0.151527 tcp 10.0.2.105 63937 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:09:50.781625 2.996443 tcp 10.0.2.105 63938 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:09:59.786662 0.000000 tcp 10.0.2.105 63938 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:05.775869 0.061000 tcp 10.0.2.105 63939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:10:05.837146 0.061663 tcp 10.0.2.105 63940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:10:05.899081 0.157164 tcp 10.0.2.105 63941 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:10:06.070164 2.999677 tcp 10.0.2.105 63942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:06.757019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:10:15.068559 0.000000 tcp 10.0.2.105 63942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:21.083142 2.988622 tcp 10.0.2.105 63943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:30.070212 0.000000 tcp 10.0.2.105 63943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:34.576707 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:10:36.069155 3.004124 tcp 10.0.2.105 63944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:10:45.071886 0.000000 tcp 10.0.2.105 63944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:15:51.072345 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:15:51.072427 3.004527 tcp 10.0.2.105 63945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:00.075066 0.000000 tcp 10.0.2.105 63945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:06.075209 0.065473 tcp 10.0.2.105 63946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:06.140976 0.065315 tcp 10.0.2.105 63947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:06.206450 0.154862 tcp 10.0.2.105 63948 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:06.715383 2.993549 tcp 10.0.2.105 63949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:15.717247 0.000000 tcp 10.0.2.105 63949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:18.774304 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:16:21.716445 0.352810 tcp 10.0.2.105 63950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:22.069615 0.063725 tcp 10.0.2.105 63951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:22.133654 0.155819 tcp 10.0.2.105 63952 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:22.334942 2.965095 tcp 10.0.2.105 63953 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:26.035392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:16:31.244580 0.000000 tcp 10.0.2.105 63953 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:33.963990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:16:37.190777 0.064060 tcp 10.0.2.105 63954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:37.255190 0.065199 tcp 10.0.2.105 63955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:37.320647 0.148941 tcp 10.0.2.105 63956 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:16:37.508428 2.974213 tcp 10.0.2.105 63957 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:46.426680 0.000000 tcp 10.0.2.105 63957 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:16:49.820219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:16:52.380176 3.003907 tcp 10.0.2.105 63958 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:17:01.382694 0.000000 tcp 10.0.2.105 63958 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:17:06.080798 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:17:07.381758 3.004120 tcp 10.0.2.105 63959 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:17:16.384431 0.000000 tcp 10.0.2.105 63959 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:17:21.812394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:23:25.827879 3.002179 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 16:23:32.838819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:23:40.837084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:23:56.840051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:24:28.846145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:26:40.345450 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:26:40.345588 0.148326 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:40.477320 0.095196 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:40.554437 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 16:26:52.413268 3.003724 tcp 10.0.2.105 63960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:26:56.990915 0.068056 tcp 10.0.2.105 63961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:26:57.059254 0.063598 tcp 10.0.2.105 63962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:26:57.123118 0.150878 tcp 10.0.2.105 63963 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:26:57.274678 0.190108 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:57.459195 0.375980 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:57.805829 0.233908 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:58.018895 0.276952 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:58.341226 0.145198 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:58.476520 0.230688 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:58.788035 0.126680 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:58.984949 0.348489 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:59.301967 0.074127 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:26:59.428759 0.000000 udp 10.0.2.105 7010 -> 1.160.229.107 7701 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 16:27:01.420854 0.000000 tcp 10.0.2.105 63960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:27:07.415285 0.061955 tcp 10.0.2.105 63964 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:07.477562 0.061704 tcp 10.0.2.105 63965 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:07.539556 0.162376 tcp 10.0.2.105 63966 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:07.975476 2.993146 tcp 10.0.2.105 63967 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:27:16.685130 0.064360 tcp 10.0.2.105 63968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:16.749769 0.067176 tcp 10.0.2.105 63969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:16.817306 0.153158 tcp 10.0.2.105 63970 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:27:16.970998 0.124321 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:16.972692 0.000000 tcp 10.0.2.105 63967 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:27:17.077018 0.181755 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:17.460119 0.191408 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:17.623619 0.172204 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:18.048934 0.187093 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:18.259658 0.174389 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:18.431545 0.443653 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:18.852216 0.133263 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:18.953774 0.179440 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:19.353018 0.174565 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:19.525025 0.128250 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:19.609220 0.094314 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:19.731617 0.051779 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:19.996714 0.182823 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:27:20.174753 0.171083 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:30:32.851847 3.003160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:30:39.931996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:30:47.887793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:31:03.874160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:31:35.880380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:32:22.977756 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:32:22.977896 3.005025 tcp 10.0.2.105 63971 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:32:31.980183 0.000000 tcp 10.0.2.105 63971 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:32:37.981681 0.065223 tcp 10.0.2.105 63972 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:38.047232 0.061210 tcp 10.0.2.105 63973 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:38.108738 0.157288 tcp 10.0.2.105 63974 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:39.030545 3.004861 tcp 10.0.2.105 63975 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:32:48.033739 0.000000 tcp 10.0.2.105 63975 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:32:54.023562 0.064331 tcp 10.0.2.105 63976 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:54.088405 0.065463 tcp 10.0.2.105 63977 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:54.154167 0.150678 tcp 10.0.2.105 63978 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:32:54.655874 2.993052 tcp 10.0.2.105 63979 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:03.658688 0.000000 tcp 10.0.2.105 63979 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:09.655540 0.060546 tcp 10.0.2.105 63980 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:33:09.716357 0.061581 tcp 10.0.2.105 63981 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:33:09.778194 0.154765 tcp 10.0.2.105 63982 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:33:10.009889 2.999883 tcp 10.0.2.105 63983 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:19.008528 0.000000 tcp 10.0.2.105 63983 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:25.009540 3.001367 tcp 10.0.2.105 63984 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:34.009581 0.000000 tcp 10.0.2.105 63984 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:38.576600 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:33:40.008855 3.003952 tcp 10.0.2.105 63985 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:33:49.011479 0.000000 tcp 10.0.2.105 63985 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:37:39.887504 2.999981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:37:46.894566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:37:54.895168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:38:10.897936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:38:42.904482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:38:55.012445 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:38:55.012548 3.003106 tcp 10.0.2.105 63986 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:04.015075 0.000000 tcp 10.0.2.105 63986 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:10.014644 0.067418 tcp 10.0.2.105 63987 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:10.082353 0.060671 tcp 10.0.2.105 63988 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:10.142858 0.151844 tcp 10.0.2.105 63989 -> 195.113.214.249 443 SRPA* 0 0 23 12058 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:10.795161 2.993102 tcp 10.0.2.105 63990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:19.796815 0.000000 tcp 10.0.2.105 63990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:25.796330 0.063540 tcp 10.0.2.105 63991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:25.860061 0.062912 tcp 10.0.2.105 63992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:25.923224 0.151939 tcp 10.0.2.105 63993 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:26.413574 2.997354 tcp 10.0.2.105 63994 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:35.409412 0.000000 tcp 10.0.2.105 63994 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:41.408683 0.064040 tcp 10.0.2.105 63995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:41.473056 0.064847 tcp 10.0.2.105 63996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:41.538203 0.152082 tcp 10.0.2.105 63997 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:39:42.039233 3.004181 tcp 10.0.2.105 63998 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:51.042093 0.000000 tcp 10.0.2.105 63998 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:39:57.040608 3.004343 tcp 10.0.2.105 63999 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:40:06.043738 0.000000 tcp 10.0.2.105 63999 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:40:10.580494 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:40:12.042564 3.008374 tcp 10.0.2.105 64000 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:40:21.045575 0.000000 tcp 10.0.2.105 64000 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:44:46.914579 2.996608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:44:53.917023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:45:01.918797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:45:17.922030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:45:27.045725 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:45:27.045938 2.993631 tcp 10.0.2.105 64001 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:45:36.041982 0.000000 tcp 10.0.2.105 64001 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:45:42.048596 0.063957 tcp 10.0.2.105 64002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:42.112882 0.066725 tcp 10.0.2.105 64003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:42.179882 0.155560 tcp 10.0.2.105 64004 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:42.397447 2.994021 tcp 10.0.2.105 64005 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:45:49.928156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:45:51.390083 0.000000 tcp 10.0.2.105 64005 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:45:57.399420 0.063531 tcp 10.0.2.105 64006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:57.463206 0.067528 tcp 10.0.2.105 64007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:57.531040 0.165583 tcp 10.0.2.105 64008 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:45:57.886995 3.006939 tcp 10.0.2.105 64009 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:06.892703 0.000000 tcp 10.0.2.105 64009 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:12.881585 0.060049 tcp 10.0.2.105 64010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:46:12.941965 0.060502 tcp 10.0.2.105 64011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:46:13.002846 0.161282 tcp 10.0.2.105 64012 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:46:13.186165 2.999599 tcp 10.0.2.105 64013 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:22.184596 0.000000 tcp 10.0.2.105 64013 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:28.183321 2.994250 tcp 10.0.2.105 64014 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:37.186058 0.000000 tcp 10.0.2.105 64014 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:42.072999 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:46:43.184817 2.994240 tcp 10.0.2.105 64015 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:46:52.178031 0.000000 tcp 10.0.2.105 64015 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:51:53.936800 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:51:58.189406 0.000160 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:51:58.189658 3.002111 tcp 10.0.2.105 64016 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:00.941554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:52:07.192516 0.000000 tcp 10.0.2.105 64016 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:08.942673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:52:13.193164 0.061189 tcp 10.0.2.105 64017 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:13.254612 0.061376 tcp 10.0.2.105 64018 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:13.316396 0.151302 tcp 10.0.2.105 64019 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:13.550625 3.004861 tcp 10.0.2.105 64020 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:22.552655 0.000000 tcp 10.0.2.105 64020 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:24.946093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:52:28.552811 0.060494 tcp 10.0.2.105 64021 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:28.613135 0.062251 tcp 10.0.2.105 64022 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:28.675673 0.158788 tcp 10.0.2.105 64023 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:28.937073 3.003744 tcp 10.0.2.105 64024 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:37.934529 0.000000 tcp 10.0.2.105 64024 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:43.933878 0.062253 tcp 10.0.2.105 64025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:43.996593 0.061309 tcp 10.0.2.105 64026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:44.058202 0.153968 tcp 10.0.2.105 64027 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:52:44.275398 2.992651 tcp 10.0.2.105 64028 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:53.276989 0.000000 tcp 10.0.2.105 64028 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:52:56.951983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:52:59.275977 2.994007 tcp 10.0.2.105 64029 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:53:08.268756 0.000000 tcp 10.0.2.105 64029 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:53:13.075061 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:53:14.277089 3.004186 tcp 10.0.2.105 64030 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:53:23.279979 0.000000 tcp 10.0.2.105 64030 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:57:22.123802 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:57:22.124014 0.216435 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:22.332517 0.000000 udp 10.0.2.105 7010 -> 1.160.229.107 7701 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 16:57:41.182122 0.062023 tcp 10.0.2.105 64031 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:57:41.244433 0.067175 tcp 10.0.2.105 64032 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:57:41.311945 0.157819 tcp 10.0.2.105 64033 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:57:41.470365 0.125057 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:41.581777 0.080913 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:41.625159 0.359016 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:41.954897 0.270605 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:42.205666 0.189605 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:42.392138 0.498175 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:42.700678 0.347738 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.012898 0.220272 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.225805 0.143214 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.361009 0.126916 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.496484 0.075077 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.553071 0.124110 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.659387 0.186260 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:43.822828 0.187134 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:44.041817 0.190331 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:44.201949 0.190072 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:44.384464 0.109458 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:44.462694 0.173986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:44.633553 0.444852 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.055114 0.186123 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.251349 0.176049 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.424524 0.130641 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.510358 0.094342 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.596459 0.059071 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.650401 0.182845 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:57:45.828328 0.169715 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/14 16:58:29.280323 3.004166 tcp 10.0.2.105 64034 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:58:34.076795 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:58:38.283011 0.000000 tcp 10.0.2.105 64034 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:58:44.281963 0.064382 tcp 10.0.2.105 64035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:44.346616 0.069301 tcp 10.0.2.105 64036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:44.416407 0.149385 tcp 10.0.2.105 64037 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:44.587089 3.009415 tcp 10.0.2.105 64038 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:58:53.595140 0.000000 tcp 10.0.2.105 64038 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:58:59.584093 0.061194 tcp 10.0.2.105 64039 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:59.645537 0.061410 tcp 10.0.2.105 64040 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:59.707262 0.156730 tcp 10.0.2.105 64041 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:58:59.948940 2.999283 tcp 10.0.2.105 64042 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:00.958129 3.001171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 16:59:07.965094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:59:08.957204 0.000000 tcp 10.0.2.105 64042 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:14.946102 0.067297 tcp 10.0.2.105 64043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:59:15.013665 0.061144 tcp 10.0.2.105 64044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:59:15.075094 0.162615 tcp 10.0.2.105 64045 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 16:59:15.255790 2.994658 tcp 10.0.2.105 64046 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:15.966561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:59:24.249091 0.000000 tcp 10.0.2.105 64046 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:30.248528 3.003412 tcp 10.0.2.105 64047 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:31.969920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 16:59:39.250043 0.000000 tcp 10.0.2.105 64047 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:44.077306 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 16:59:45.249894 3.003315 tcp 10.0.2.105 64048 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 16:59:54.252121 0.000000 tcp 10.0.2.105 64048 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:00:03.975897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:05:00.252793 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:05:00.253027 3.003516 tcp 10.0.2.105 64049 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:09.255201 0.000000 tcp 10.0.2.105 64049 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:15.255046 0.064754 tcp 10.0.2.105 64050 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:15.320081 0.065112 tcp 10.0.2.105 64051 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:15.385487 0.170327 tcp 10.0.2.105 64052 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:15.569045 2.989321 tcp 10.0.2.105 64053 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:24.567077 0.000000 tcp 10.0.2.105 64053 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:30.567346 0.065277 tcp 10.0.2.105 64054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:30.632925 0.061206 tcp 10.0.2.105 64055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:30.693958 0.164708 tcp 10.0.2.105 64056 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:30.868899 3.001080 tcp 10.0.2.105 64057 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:39.869002 0.000000 tcp 10.0.2.105 64057 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:45.868065 0.063823 tcp 10.0.2.105 64058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:45.932102 0.061101 tcp 10.0.2.105 64059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:45.993523 0.158483 tcp 10.0.2.105 64060 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:05:46.161513 3.000614 tcp 10.0.2.105 64061 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:05:55.160904 0.000000 tcp 10.0.2.105 64061 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:06:01.159779 3.004197 tcp 10.0.2.105 64062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:06:10.162382 0.000000 tcp 10.0.2.105 64062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:06:15.079389 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:06:16.161141 3.004516 tcp 10.0.2.105 64063 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:06:25.164084 0.000000 tcp 10.0.2.105 64063 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:06:30.995619 3.001166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:06:38.002630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:06:46.004094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:07:02.007155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:07:34.013187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:11:31.164779 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:11:31.164873 2.996413 tcp 10.0.2.105 64064 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:11:40.168477 0.000000 tcp 10.0.2.105 64064 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:11:46.167635 0.062955 tcp 10.0.2.105 64065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:11:46.230859 0.062893 tcp 10.0.2.105 64066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:11:46.294069 0.155784 tcp 10.0.2.105 64067 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:11:46.747298 2.994174 tcp 10.0.2.105 64068 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:11:55.739421 0.000000 tcp 10.0.2.105 64068 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:01.748884 0.064192 tcp 10.0.2.105 64069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:01.813353 0.062812 tcp 10.0.2.105 64070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:01.876615 0.161107 tcp 10.0.2.105 64071 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:02.567880 3.009152 tcp 10.0.2.105 64072 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:11.579692 0.000000 tcp 10.0.2.105 64072 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:17.561574 0.062097 tcp 10.0.2.105 64073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:17.624064 0.062991 tcp 10.0.2.105 64074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:17.687363 0.157698 tcp 10.0.2.105 64075 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:12:17.894362 3.000997 tcp 10.0.2.105 64076 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:26.894187 0.000000 tcp 10.0.2.105 64076 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:32.893519 3.003536 tcp 10.0.2.105 64077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:41.905864 0.000000 tcp 10.0.2.105 64077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:46.572549 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:12:47.894757 2.997756 tcp 10.0.2.105 64078 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:12:56.897255 0.000000 tcp 10.0.2.105 64078 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:13:43.032859 2.996075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:13:50.033699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:13:58.035459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:14:14.038236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:14:46.044162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:18:02.897938 0.000217 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:18:02.898262 3.003229 tcp 10.0.2.105 64079 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:11.899935 0.000000 tcp 10.0.2.105 64079 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:17.900167 0.064099 tcp 10.0.2.105 64080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:17.964565 0.065791 tcp 10.0.2.105 64081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:18.030650 0.151063 tcp 10.0.2.105 64082 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:18.509457 3.004518 tcp 10.0.2.105 64083 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:27.512673 0.000000 tcp 10.0.2.105 64083 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:33.512158 0.064496 tcp 10.0.2.105 64084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:33.576903 0.061477 tcp 10.0.2.105 64085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:33.638688 0.157904 tcp 10.0.2.105 64086 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:33.919189 3.007113 tcp 10.0.2.105 64087 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:42.925680 0.000000 tcp 10.0.2.105 64087 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:48.914366 0.067811 tcp 10.0.2.105 64088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:48.982462 0.065153 tcp 10.0.2.105 64089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:49.047942 0.148225 tcp 10.0.2.105 64090 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:18:49.338480 3.000103 tcp 10.0.2.105 64091 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:18:58.346962 0.000000 tcp 10.0.2.105 64091 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:19:04.335802 2.994216 tcp 10.0.2.105 64092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:19:13.328837 0.000000 tcp 10.0.2.105 64092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:19:18.075382 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:19:19.337306 3.004315 tcp 10.0.2.105 64093 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:19:28.339999 0.000000 tcp 10.0.2.105 64093 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:20:50.050038 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:20:57.057060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:21:05.058996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:21:21.062300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:21:53.067718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:27:57.075142 3.000941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 17:28:04.081923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:28:08.919227 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:28:08.919412 0.218683 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:09.130371 0.134415 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:09.487228 0.082171 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:09.531898 0.187658 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:09.716548 0.362826 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:10.050835 0.404281 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:10.436512 0.361196 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:10.818007 0.274411 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.058754 0.228898 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.280413 0.146009 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.416876 0.128709 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.742498 0.073419 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.797825 0.124143 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:11.960181 0.185550 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:12.083445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:28:12.121446 0.174319 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:12.513086 0.113192 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:12.592803 0.188499 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:12.926072 0.186703 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:13.084690 0.174513 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:13.255831 0.446488 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:13.679730 0.177242 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:13.898735 0.177684 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:14.073847 0.132855 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:14.356158 0.094854 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:14.441529 0.054476 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:14.823735 0.181939 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:15.000656 0.169949 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:28:19.363967 2.993920 tcp 10.0.2.105 64094 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:28:28.090877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:28:28.372543 0.000000 tcp 10.0.2.105 64094 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:28:33.073267 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:28:34.367200 0.062268 tcp 10.0.2.105 64095 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:34.429842 0.067227 tcp 10.0.2.105 64096 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:34.497350 0.151575 tcp 10.0.2.105 64097 -> 195.113.214.249 443 SRPA* 0 0 26 13342 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:34.774011 2.996191 tcp 10.0.2.105 64098 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:28:43.773120 0.000000 tcp 10.0.2.105 64098 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:28:49.768164 0.064771 tcp 10.0.2.105 64099 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:49.833217 0.067672 tcp 10.0.2.105 64100 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:49.901183 0.161846 tcp 10.0.2.105 64101 -> 195.113.214.249 443 SRPA* 0 0 60 43438 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:28:50.469976 3.002771 tcp 10.0.2.105 64102 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:28:59.471391 0.000000 tcp 10.0.2.105 64102 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:00.092118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:29:05.470653 0.063433 tcp 10.0.2.105 64103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:29:05.534389 0.066266 tcp 10.0.2.105 64104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:29:05.600947 0.158885 tcp 10.0.2.105 64105 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:29:05.825727 2.999487 tcp 10.0.2.105 64106 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:14.823306 0.000000 tcp 10.0.2.105 64106 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:20.822187 3.004190 tcp 10.0.2.105 64107 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:29.824866 0.000000 tcp 10.0.2.105 64107 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:34.573075 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:29:35.828189 2.989447 tcp 10.0.2.105 64108 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:29:45.000370 0.000000 tcp 10.0.2.105 64108 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:34:50.827017 0.035506 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:34:50.862680 2.969731 tcp 10.0.2.105 64109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:34:59.821798 0.000000 tcp 10.0.2.105 64109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:04.097601 3.001835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:35:05.840686 0.062528 tcp 10.0.2.105 64110 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:05.903497 0.065617 tcp 10.0.2.105 64111 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:05.969508 0.148906 tcp 10.0.2.105 64112 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:06.417073 2.996034 tcp 10.0.2.105 64113 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:11.105839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:35:15.413056 0.000000 tcp 10.0.2.105 64113 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:19.107163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:35:21.410813 0.060711 tcp 10.0.2.105 64114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:21.471827 0.065705 tcp 10.0.2.105 64115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:21.537751 0.149351 tcp 10.0.2.105 64116 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:21.768839 3.006502 tcp 10.0.2.105 64117 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:30.773684 0.000000 tcp 10.0.2.105 64117 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:35.110252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:35:36.763117 0.060589 tcp 10.0.2.105 64118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:36.823988 0.061429 tcp 10.0.2.105 64119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:36.885685 0.158799 tcp 10.0.2.105 64120 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:35:37.345957 2.991832 tcp 10.0.2.105 64121 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:46.346487 0.000000 tcp 10.0.2.105 64121 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:35:52.345227 2.994309 tcp 10.0.2.105 64122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:36:01.337900 0.000000 tcp 10.0.2.105 64122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:36:06.074691 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:36:07.116119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:36:07.346781 2.994088 tcp 10.0.2.105 64123 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:36:16.339450 0.000000 tcp 10.0.2.105 64123 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:41:22.350131 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:41:22.350229 3.003258 tcp 10.0.2.105 64124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:41:31.352170 0.000000 tcp 10.0.2.105 64124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:41:37.352747 0.065915 tcp 10.0.2.105 64125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:37.418942 0.065698 tcp 10.0.2.105 64126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:37.484894 0.154409 tcp 10.0.2.105 64127 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:37.679481 2.996088 tcp 10.0.2.105 64128 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:41:46.675176 0.000000 tcp 10.0.2.105 64128 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:41:52.691297 0.068075 tcp 10.0.2.105 64129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:52.759728 0.062501 tcp 10.0.2.105 64130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:52.822510 0.156553 tcp 10.0.2.105 64131 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:41:53.042296 2.996764 tcp 10.0.2.105 64132 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:02.028572 0.000000 tcp 10.0.2.105 64132 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:08.030398 0.063536 tcp 10.0.2.105 64133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:42:08.094271 0.061843 tcp 10.0.2.105 64134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:42:08.156441 0.151634 tcp 10.0.2.105 64135 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:42:08.566666 2.997740 tcp 10.0.2.105 64136 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:11.122130 3.001817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:42:17.570226 0.000000 tcp 10.0.2.105 64136 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:18.138266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:42:23.557480 3.008206 tcp 10.0.2.105 64137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:26.135424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:42:32.561300 0.000000 tcp 10.0.2.105 64137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:37.079199 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:42:38.560914 3.004889 tcp 10.0.2.105 64138 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:42:42.135598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:42:47.562658 0.000000 tcp 10.0.2.105 64138 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:43:14.140194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:47:53.562333 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:47:53.562524 3.003674 tcp 10.0.2.105 64139 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:02.564790 0.000000 tcp 10.0.2.105 64139 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:08.565348 0.061667 tcp 10.0.2.105 64140 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:08.627293 0.066763 tcp 10.0.2.105 64141 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:08.694409 0.162593 tcp 10.0.2.105 64142 -> 195.113.214.249 443 SRPA* 0 0 28 13768 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:08.912308 2.996513 tcp 10.0.2.105 64143 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:17.921891 0.000000 tcp 10.0.2.105 64143 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:23.905954 0.061110 tcp 10.0.2.105 64144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:23.967340 0.064019 tcp 10.0.2.105 64145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:24.031595 0.153338 tcp 10.0.2.105 64146 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:24.282041 2.998096 tcp 10.0.2.105 64147 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:33.278956 0.000000 tcp 10.0.2.105 64147 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:39.278402 0.060300 tcp 10.0.2.105 64148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:39.338978 0.099899 tcp 10.0.2.105 64149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:39.439299 0.149827 tcp 10.0.2.105 64150 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:48:39.859043 3.003927 tcp 10.0.2.105 64151 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:48.861470 0.000000 tcp 10.0.2.105 64151 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:48:54.859661 3.004723 tcp 10.0.2.105 64152 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:49:03.863287 0.000000 tcp 10.0.2.105 64152 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:49:08.579538 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:49:09.861791 3.004209 tcp 10.0.2.105 64153 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:49:18.864451 0.000000 tcp 10.0.2.105 64153 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:53:40.153126 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 17:53:47.160222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:53:55.163088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:54:11.164401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:54:43.170435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 17:58:30.588067 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:58:30.588173 0.086101 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:30.637167 0.187769 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:30.821954 0.421743 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:31.214133 0.217907 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:31.422879 0.127917 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:31.517891 0.428057 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:31.923338 0.540781 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:32.363015 0.254774 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:32.582285 0.126833 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:32.709204 0.074436 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:32.765785 0.123308 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:32.871140 0.220554 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.084775 0.148526 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.223775 0.180203 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.380437 0.174509 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.547435 0.120552 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.636204 0.184723 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.822956 0.185018 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:33.979967 0.187242 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:34.166194 0.175979 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:34.338225 0.174840 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:34.510127 0.447633 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:34.933175 0.141687 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:35.019805 0.093587 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:35.103926 0.053670 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:35.167888 0.182985 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:35.346128 0.170049 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 17:58:39.892437 3.002460 tcp 10.0.2.105 64154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:58:48.894140 0.000000 tcp 10.0.2.105 64154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:58:54.894440 0.062669 tcp 10.0.2.105 64155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:58:54.957370 0.064773 tcp 10.0.2.105 64156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:58:55.022493 0.160449 tcp 10.0.2.105 64157 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:58:55.193463 2.994278 tcp 10.0.2.105 64158 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:04.195626 0.000000 tcp 10.0.2.105 64158 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:10.196594 0.064181 tcp 10.0.2.105 64159 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:10.261080 0.061754 tcp 10.0.2.105 64160 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:10.323108 0.150179 tcp 10.0.2.105 64161 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:10.502463 2.996940 tcp 10.0.2.105 64162 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:19.501978 0.000000 tcp 10.0.2.105 64162 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:25.497242 0.063221 tcp 10.0.2.105 64163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:25.560766 0.066420 tcp 10.0.2.105 64164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:25.627100 0.148725 tcp 10.0.2.105 64165 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 17:59:25.798381 3.003065 tcp 10.0.2.105 64166 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:34.799843 0.000000 tcp 10.0.2.105 64166 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:40.798986 3.004210 tcp 10.0.2.105 64167 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:49.801493 0.000000 tcp 10.0.2.105 64167 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 17:59:54.578631 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 17:59:55.799966 3.009426 tcp 10.0.2.105 64168 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:00:04.805856 0.000000 tcp 10.0.2.105 64168 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:00:47.176180 3.002415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:00:54.184098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:01:02.185654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:01:18.189006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:01:50.195026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:05:10.803234 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:05:10.803449 2.994123 tcp 10.0.2.105 64169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:19.806132 0.000000 tcp 10.0.2.105 64169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:25.806599 0.061782 tcp 10.0.2.105 64170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:25.868670 0.063345 tcp 10.0.2.105 64171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:25.932387 0.158523 tcp 10.0.2.105 64172 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:26.100748 2.999066 tcp 10.0.2.105 64173 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:35.097774 0.000000 tcp 10.0.2.105 64173 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:41.097073 0.065395 tcp 10.0.2.105 64174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:41.162828 0.065557 tcp 10.0.2.105 64175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:41.228728 0.154629 tcp 10.0.2.105 64176 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:41.601103 3.000444 tcp 10.0.2.105 64177 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:50.600733 0.000000 tcp 10.0.2.105 64177 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:05:56.599751 0.063825 tcp 10.0.2.105 64178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:56.663858 0.066665 tcp 10.0.2.105 64179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:56.730828 0.156732 tcp 10.0.2.105 64180 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:05:56.986694 2.997192 tcp 10.0.2.105 64181 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:06:05.982359 0.000000 tcp 10.0.2.105 64181 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:06:11.981190 3.004134 tcp 10.0.2.105 64182 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:06:20.984783 0.000000 tcp 10.0.2.105 64182 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:06:25.571529 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:06:26.982926 3.004097 tcp 10.0.2.105 64183 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:06:35.985559 0.000000 tcp 10.0.2.105 64183 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:07:54.200365 3.002612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:08:01.212734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:08:09.209815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:08:25.212719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:08:57.218818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:11:41.987974 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:11:41.988080 2.991737 tcp 10.0.2.105 64184 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:11:50.977979 0.000000 tcp 10.0.2.105 64184 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:11:56.989025 0.065473 tcp 10.0.2.105 64185 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:11:57.054725 0.062127 tcp 10.0.2.105 64186 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:11:57.117150 0.157691 tcp 10.0.2.105 64187 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:11:57.479050 3.003142 tcp 10.0.2.105 64188 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:06.480973 0.000000 tcp 10.0.2.105 64188 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:12.479974 0.064782 tcp 10.0.2.105 64189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:12.544619 0.061401 tcp 10.0.2.105 64190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:12.606352 0.155856 tcp 10.0.2.105 64191 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:13.037426 3.007270 tcp 10.0.2.105 64192 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:22.043017 0.000000 tcp 10.0.2.105 64192 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:28.032363 0.062121 tcp 10.0.2.105 64193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:28.094769 0.064938 tcp 10.0.2.105 64194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:28.160069 0.157921 tcp 10.0.2.105 64195 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:12:28.345865 3.003233 tcp 10.0.2.105 64196 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:37.346619 0.000000 tcp 10.0.2.105 64196 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:43.344059 2.993851 tcp 10.0.2.105 64197 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:52.346761 0.000000 tcp 10.0.2.105 64197 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:12:57.074759 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:12:58.345523 2.993982 tcp 10.0.2.105 64198 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:13:07.344053 0.000000 tcp 10.0.2.105 64198 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:15:01.224759 3.001446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:15:08.232252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:15:16.233655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:15:32.236589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:16:04.242941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:18:13.348768 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:18:13.348860 3.004308 tcp 10.0.2.105 64199 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:22.351246 0.000000 tcp 10.0.2.105 64199 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:28.351533 0.062066 tcp 10.0.2.105 64200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:28.413877 0.063024 tcp 10.0.2.105 64201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:28.477178 0.149326 tcp 10.0.2.105 64202 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:29.119269 3.006200 tcp 10.0.2.105 64203 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:38.123364 0.000000 tcp 10.0.2.105 64203 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:44.113280 0.065098 tcp 10.0.2.105 64204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:44.178661 0.064609 tcp 10.0.2.105 64205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:44.243572 0.153583 tcp 10.0.2.105 64206 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:44.635268 2.992345 tcp 10.0.2.105 64207 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:53.636659 0.000000 tcp 10.0.2.105 64207 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:18:59.635543 0.060605 tcp 10.0.2.105 64208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:59.696482 0.065796 tcp 10.0.2.105 64209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:59.762575 0.164961 tcp 10.0.2.105 64210 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:18:59.954689 2.994277 tcp 10.0.2.105 64211 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:19:08.948043 0.000000 tcp 10.0.2.105 64211 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:19:14.946994 2.997739 tcp 10.0.2.105 64212 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:19:23.942520 0.000000 tcp 10.0.2.105 64212 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:19:28.576750 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:19:29.948342 3.004364 tcp 10.0.2.105 64213 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:19:38.951198 0.000000 tcp 10.0.2.105 64213 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:22:08.252717 2.998784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:22:15.256038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:22:23.257533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:22:39.260381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:23:11.266888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:28:57.815004 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:28:57.815176 0.080223 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:57.856898 0.219870 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:58.068988 0.112588 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:58.361404 0.187736 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:58.546493 0.347383 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:58.867320 0.247600 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:59.081365 0.372841 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:59.431715 0.447719 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:59.758838 0.132658 udp 10.0.2.105 7010 <-> 204.15.30.249 8065 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:28:59.984272 2.998770 tcp 10.0.2.105 64214 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:00.019973 0.073188 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:00.075332 0.123510 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:00.429527 0.234588 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:00.656398 0.146554 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:00.828507 0.182676 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:00.987104 0.183806 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:01.163583 0.191691 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:01.326258 0.176592 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:01.517568 0.175613 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:01.690170 0.174820 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:01.862040 0.120518 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:02.020407 0.184818 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:02.182410 0.443930 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:02.635619 0.133565 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:02.722894 0.095696 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:02.869748 0.052491 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:03.247474 0.203156 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:03.445596 0.165610 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:29:08.980683 0.000000 tcp 10.0.2.105 64214 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:14.981312 0.061838 tcp 10.0.2.105 64215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:15.043435 0.068365 tcp 10.0.2.105 64216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:15.112064 0.150813 tcp 10.0.2.105 64217 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:15.272072 3.002331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 18:29:15.409404 3.005067 tcp 10.0.2.105 64218 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:22.279827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:29:24.413244 0.000000 tcp 10.0.2.105 64218 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:30.281818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:29:30.402200 0.060818 tcp 10.0.2.105 64219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:30.463289 0.062760 tcp 10.0.2.105 64220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:30.526309 0.236823 tcp 10.0.2.105 64221 -> 195.113.214.249 443 SRPA* 0 0 72 76746 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:29:31.267204 3.000349 tcp 10.0.2.105 64222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:40.276878 0.000000 tcp 10.0.2.105 64222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:46.272913 2.989540 tcp 10.0.2.105 64223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:29:46.292587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:29:55.267737 0.000000 tcp 10.0.2.105 64223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:30:00.074466 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:30:18.296608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:35:01.267899 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:35:01.268117 3.015439 tcp 10.0.2.105 64224 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:10.270188 0.000000 tcp 10.0.2.105 64224 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:16.273049 0.061998 tcp 10.0.2.105 64225 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:16.335339 0.062148 tcp 10.0.2.105 64226 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:16.397832 0.153904 tcp 10.0.2.105 64227 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:17.090980 3.003796 tcp 10.0.2.105 64228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:26.096742 0.000000 tcp 10.0.2.105 64228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:32.093512 0.061527 tcp 10.0.2.105 64229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:32.155312 0.064192 tcp 10.0.2.105 64230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:32.219835 0.157123 tcp 10.0.2.105 64231 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:32.609806 3.009177 tcp 10.0.2.105 64232 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:41.915797 0.000000 tcp 10.0.2.105 64232 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:47.845629 0.062852 tcp 10.0.2.105 64233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:47.908781 0.060774 tcp 10.0.2.105 64234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:47.969860 0.163376 tcp 10.0.2.105 64235 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:35:48.222496 2.962059 tcp 10.0.2.105 64236 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:35:57.133455 0.000000 tcp 10.0.2.105 64236 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:36:03.084313 2.961196 tcp 10.0.2.105 64237 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:36:11.987003 0.000000 tcp 10.0.2.105 64237 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:36:16.575755 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:36:17.993125 2.999540 tcp 10.0.2.105 64238 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:36:22.296972 3.001553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:36:26.990778 0.000000 tcp 10.0.2.105 64238 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:36:29.303532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:36:37.305606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:36:53.308736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:37:25.314553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:41:32.991376 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:41:32.991461 3.003599 tcp 10.0.2.105 64239 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:41:41.993522 0.000000 tcp 10.0.2.105 64239 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:41:47.994116 0.062135 tcp 10.0.2.105 64240 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:41:48.056606 0.061075 tcp 10.0.2.105 64241 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:41:48.117927 0.155259 tcp 10.0.2.105 64242 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:41:48.477245 3.002760 tcp 10.0.2.105 64243 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:41:57.485845 0.000000 tcp 10.0.2.105 64243 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:03.475700 0.062021 tcp 10.0.2.105 64244 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:03.538029 0.065215 tcp 10.0.2.105 64245 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:03.603531 0.155991 tcp 10.0.2.105 64246 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:04.035117 2.994111 tcp 10.0.2.105 64247 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:13.028187 0.000000 tcp 10.0.2.105 64247 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:19.037633 0.066170 tcp 10.0.2.105 64248 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:19.104132 0.061847 tcp 10.0.2.105 64249 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:19.166299 0.162699 tcp 10.0.2.105 64250 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:42:19.446398 2.995401 tcp 10.0.2.105 64251 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:28.440435 0.000000 tcp 10.0.2.105 64251 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:34.439082 3.004386 tcp 10.0.2.105 64252 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:43.441753 0.000000 tcp 10.0.2.105 64252 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:48.078335 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:42:49.440304 3.004796 tcp 10.0.2.105 64253 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:42:58.443499 0.000000 tcp 10.0.2.105 64253 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:43:29.320876 3.001309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:43:36.328130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:43:44.329460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:44:00.333155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:44:32.338765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:48:04.444421 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:48:04.444613 2.993566 tcp 10.0.2.105 64254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:13.446595 0.000000 tcp 10.0.2.105 64254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:19.447221 0.064602 tcp 10.0.2.105 64255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:19.512150 0.062360 tcp 10.0.2.105 64256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:19.574796 0.161790 tcp 10.0.2.105 64257 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:19.747471 2.992479 tcp 10.0.2.105 64258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:28.738746 0.000000 tcp 10.0.2.105 64258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:34.748286 0.062652 tcp 10.0.2.105 64259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:34.811206 0.060569 tcp 10.0.2.105 64260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:34.872109 0.154862 tcp 10.0.2.105 64261 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:35.041698 2.999898 tcp 10.0.2.105 64262 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:44.040919 0.000000 tcp 10.0.2.105 64262 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:50.039515 0.067519 tcp 10.0.2.105 64263 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:50.107370 0.066612 tcp 10.0.2.105 64264 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:50.174311 0.152598 tcp 10.0.2.105 64265 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:48:50.415190 2.998676 tcp 10.0.2.105 64266 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:48:59.412613 0.000000 tcp 10.0.2.105 64266 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:49:05.411141 3.004504 tcp 10.0.2.105 64267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:49:14.413955 0.000000 tcp 10.0.2.105 64267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:49:19.070790 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:49:20.413293 3.003975 tcp 10.0.2.105 64268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:49:29.418808 0.000000 tcp 10.0.2.105 64268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:54:14.348218 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 18:54:21.355629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:54:29.362724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:54:35.416134 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:54:35.416386 2.993645 tcp 10.0.2.105 64269 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:54:44.408889 0.000000 tcp 10.0.2.105 64269 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:54:45.359862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:54:50.418756 0.061801 tcp 10.0.2.105 64270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:54:50.480803 0.063707 tcp 10.0.2.105 64271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:54:50.544777 0.154766 tcp 10.0.2.105 64272 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:54:50.791863 3.000234 tcp 10.0.2.105 64273 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:54:59.790278 0.000000 tcp 10.0.2.105 64273 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 18:55:17.365899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 18:59:28.667797 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 18:59:28.667931 0.083878 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:28.713718 0.218357 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:28.924073 0.117056 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:29.034284 0.188815 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:29.220232 0.352326 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:29.541468 0.246550 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:29.753434 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 18:59:48.016856 0.064289 tcp 10.0.2.105 64274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:59:48.081440 0.061967 tcp 10.0.2.105 64275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:59:48.143688 0.153593 tcp 10.0.2.105 64276 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/14 18:59:48.297875 0.075589 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:48.356256 0.302169 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 1995 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:48.640946 0.373595 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:48.914526 0.124708 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.027229 0.234093 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.254195 0.147426 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.391565 0.185298 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.552622 0.179359 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.724685 0.174947 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:49.896956 0.173300 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:50.067554 0.122058 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:50.152982 0.173907 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:50.319654 0.188780 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:50.477819 0.185130 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:50.690221 0.446570 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:51.114678 0.127383 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:51.197625 0.099537 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2016 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:51.288713 0.058375 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:51.334651 0.184169 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/14 18:59:51.513707 0.170521 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:00:05.790879 3.004015 tcp 10.0.2.105 64277 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:13.571875 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:00:14.793560 0.000000 tcp 10.0.2.105 64277 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:20.792886 0.067110 tcp 10.0.2.105 64278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:20.860427 0.062222 tcp 10.0.2.105 64279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:20.922926 0.149449 tcp 10.0.2.105 64280 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:21.108565 3.008300 tcp 10.0.2.105 64281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:30.115863 0.000000 tcp 10.0.2.105 64281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:36.105365 0.060702 tcp 10.0.2.105 64282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:36.166412 0.064322 tcp 10.0.2.105 64283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:36.231010 0.152275 tcp 10.0.2.105 64284 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:36.394023 2.995119 tcp 10.0.2.105 64285 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:45.397539 0.000000 tcp 10.0.2.105 64285 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:00:51.387112 0.060858 tcp 10.0.2.105 64286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:51.448367 0.066353 tcp 10.0.2.105 64287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:51.514998 0.152488 tcp 10.0.2.105 64288 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:00:51.682191 2.998640 tcp 10.0.2.105 64289 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:00.679986 0.000000 tcp 10.0.2.105 64289 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:06.678594 3.004145 tcp 10.0.2.105 64290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:15.680906 0.000000 tcp 10.0.2.105 64290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:20.578154 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:01:21.372859 3.000724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:01:21.680127 3.003781 tcp 10.0.2.105 64291 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:28.379507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:01:30.682953 0.000000 tcp 10.0.2.105 64291 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:01:36.380894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:01:52.383736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:02:24.390031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:06:36.683395 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:06:36.683500 3.003687 tcp 10.0.2.105 64292 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:06:45.685814 0.000000 tcp 10.0.2.105 64292 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:06:51.686490 0.062640 tcp 10.0.2.105 64293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:06:51.749394 0.064300 tcp 10.0.2.105 64294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:06:51.813998 0.154682 tcp 10.0.2.105 64295 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:06:51.989656 2.999077 tcp 10.0.2.105 64296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:00.987155 0.000000 tcp 10.0.2.105 64296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:06.986851 0.063998 tcp 10.0.2.105 64297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:07.051168 0.062170 tcp 10.0.2.105 64298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:07.113682 0.161597 tcp 10.0.2.105 64299 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:07.371641 2.999432 tcp 10.0.2.105 64300 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:16.369688 0.000000 tcp 10.0.2.105 64300 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:22.369133 0.061887 tcp 10.0.2.105 64301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:22.431315 0.064354 tcp 10.0.2.105 64302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:22.495945 0.148957 tcp 10.0.2.105 64303 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:07:22.665902 2.997228 tcp 10.0.2.105 64304 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:31.661634 0.000000 tcp 10.0.2.105 64304 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:37.660755 3.003784 tcp 10.0.2.105 64305 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:46.663221 0.000000 tcp 10.0.2.105 64305 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:07:51.570618 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:07:52.662033 3.004491 tcp 10.0.2.105 64306 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:08:01.664676 0.000000 tcp 10.0.2.105 64306 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:08:28.395617 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:08:35.405663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:08:43.404401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:08:59.407995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:09:31.413959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:13:07.665378 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:13:07.665559 2.997077 tcp 10.0.2.105 64307 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:16.657760 0.000000 tcp 10.0.2.105 64307 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:22.668686 0.356748 tcp 10.0.2.105 64308 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:23.025712 0.066266 tcp 10.0.2.105 64309 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:23.092428 0.153417 tcp 10.0.2.105 64310 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:23.505107 2.965674 tcp 10.0.2.105 64311 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:32.411322 0.000000 tcp 10.0.2.105 64311 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:38.357133 0.060645 tcp 10.0.2.105 64312 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:38.418022 0.060806 tcp 10.0.2.105 64313 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:38.479141 0.147562 tcp 10.0.2.105 64314 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:39.544529 2.982783 tcp 10.0.2.105 64315 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:48.471081 0.000000 tcp 10.0.2.105 64315 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:13:54.413607 0.060382 tcp 10.0.2.105 64316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:54.474284 0.062071 tcp 10.0.2.105 64317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:54.536659 0.147039 tcp 10.0.2.105 64318 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:13:55.801164 2.997196 tcp 10.0.2.105 64319 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:14:04.806850 0.000000 tcp 10.0.2.105 64319 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:14:10.809426 2.990354 tcp 10.0.2.105 64320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:14:18.576687 0.000164 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:14:19.798193 0.000000 tcp 10.0.2.105 64320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:14:25.807078 3.004426 tcp 10.0.2.105 64321 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:14:34.809980 0.000000 tcp 10.0.2.105 64321 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:15:35.419715 3.001888 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:15:42.427466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:15:50.428864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:16:06.431831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:16:38.438121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:19:40.810314 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:19:40.810590 3.008506 tcp 10.0.2.105 64322 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:19:49.812842 0.000000 tcp 10.0.2.105 64322 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:19:55.814846 0.061058 tcp 10.0.2.105 64323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:19:55.876177 0.061589 tcp 10.0.2.105 64324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:19:55.938111 0.161063 tcp 10.0.2.105 64325 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:19:56.543666 3.003502 tcp 10.0.2.105 64326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:05.545667 0.000000 tcp 10.0.2.105 64326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:11.551227 0.060747 tcp 10.0.2.105 64327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:11.612260 0.065662 tcp 10.0.2.105 64328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:11.678257 0.161286 tcp 10.0.2.105 64329 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:12.486866 3.515414 tcp 10.0.2.105 64330 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:21.928425 0.000000 tcp 10.0.2.105 64330 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:27.864067 0.061104 tcp 10.0.2.105 64331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:27.925511 0.067454 tcp 10.0.2.105 64332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:27.993260 0.151602 tcp 10.0.2.105 64333 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:20:28.272078 2.961702 tcp 10.0.2.105 64334 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:37.154028 0.000000 tcp 10.0.2.105 64334 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:43.081791 2.968288 tcp 10.0.2.105 64335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:51.970685 0.000000 tcp 10.0.2.105 64335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:20:56.595646 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:20:57.900588 3.004657 tcp 10.0.2.105 64336 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:21:06.903771 0.000000 tcp 10.0.2.105 64336 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:22:42.443624 3.001824 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:22:49.466535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:22:57.463171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:23:13.465632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:23:45.471707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:29:49.478572 3.001040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 19:29:56.485215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:30:04.487302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:30:10.565790 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:30:10.565992 0.000000 udp 10.0.2.105 7010 -> 204.15.30.249 8065 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 19:30:20.494576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:30:26.111342 0.063499 tcp 10.0.2.105 64337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:26.175051 0.066826 tcp 10.0.2.105 64338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:26.242274 0.149559 tcp 10.0.2.105 64339 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:26.392676 0.217733 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:26.601936 0.087252 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:27.021585 0.114879 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:27.130408 0.453250 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:27.549922 0.355809 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:27.877558 0.188269 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:27.930876 3.003849 tcp 10.0.2.105 64340 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:30:28.091310 0.289007 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:28.351320 0.075098 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:28.664537 0.261660 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:28.905697 0.124768 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:29.224675 0.225222 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:29.441395 0.145582 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:29.577136 0.185009 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:30.559335 0.175504 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:31.060349 0.175222 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:31.232092 0.173696 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:31.553976 0.188386 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:31.713515 0.182423 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:32.231910 0.445258 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:32.654880 0.114121 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:32.840137 0.175751 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:33.008744 0.202629 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1791 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:33.225508 0.094108 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:33.310827 0.050917 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:33.537677 0.183328 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2598 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:33.715937 0.170173 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/14 19:30:36.933287 0.000000 tcp 10.0.2.105 64340 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:30:42.933214 0.062227 tcp 10.0.2.105 64341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:42.995732 0.062673 tcp 10.0.2.105 64342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:43.058655 0.152713 tcp 10.0.2.105 64343 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:30:43.510387 2.996911 tcp 10.0.2.105 64344 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:30:52.495821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:30:52.515809 0.000000 tcp 10.0.2.105 64344 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:35:58.506269 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:35:58.506350 2.993831 tcp 10.0.2.105 64345 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:07.498809 0.000000 tcp 10.0.2.105 64345 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:13.509440 0.064222 tcp 10.0.2.105 64346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:13.573938 0.061526 tcp 10.0.2.105 64347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:13.635779 0.152424 tcp 10.0.2.105 64348 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:13.817988 3.003805 tcp 10.0.2.105 64349 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:22.820264 0.000000 tcp 10.0.2.105 64349 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:28.819907 0.061749 tcp 10.0.2.105 64350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:28.881969 0.061038 tcp 10.0.2.105 64351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:28.943320 0.277469 tcp 10.0.2.105 64352 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:29.736490 2.998388 tcp 10.0.2.105 64353 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:38.733534 0.000000 tcp 10.0.2.105 64353 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:44.732950 0.066578 tcp 10.0.2.105 64354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:44.799846 0.064571 tcp 10.0.2.105 64355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:44.864741 0.157994 tcp 10.0.2.105 64356 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:36:45.079123 3.008053 tcp 10.0.2.105 64357 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:54.085551 0.000000 tcp 10.0.2.105 64357 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:36:56.502293 3.001153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:37:00.074437 2.994101 tcp 10.0.2.105 64358 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:37:03.509166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:37:09.070581 0.000000 tcp 10.0.2.105 64358 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:37:11.510747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:37:13.573682 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:37:15.075732 2.993828 tcp 10.0.2.105 64359 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:37:24.070188 0.000000 tcp 10.0.2.105 64359 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:37:27.513863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:37:59.519870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:42:30.081083 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:42:30.081216 3.001588 tcp 10.0.2.105 64360 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:42:39.081678 0.000000 tcp 10.0.2.105 64360 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:42:45.083355 0.065354 tcp 10.0.2.105 64361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:42:45.148997 0.061866 tcp 10.0.2.105 64362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:42:45.211133 0.151780 tcp 10.0.2.105 64363 -> 195.113.214.249 443 SRPA* 0 0 47 40458 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:42:45.535506 3.003007 tcp 10.0.2.105 64364 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:42:54.533864 0.000000 tcp 10.0.2.105 64364 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:00.533783 0.059876 tcp 10.0.2.105 64365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:00.593965 0.062458 tcp 10.0.2.105 64366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:00.656911 0.151069 tcp 10.0.2.105 64367 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:00.867779 3.008209 tcp 10.0.2.105 64368 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:09.877384 0.000000 tcp 10.0.2.105 64368 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:15.865456 0.059922 tcp 10.0.2.105 64369 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:15.925659 0.061015 tcp 10.0.2.105 64370 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:15.987016 0.152436 tcp 10.0.2.105 64371 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:43:16.178705 3.001123 tcp 10.0.2.105 64372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:25.178045 0.000000 tcp 10.0.2.105 64372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:31.176300 2.994852 tcp 10.0.2.105 64373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:40.169473 0.000000 tcp 10.0.2.105 64373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:45.076674 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:43:46.181755 3.000621 tcp 10.0.2.105 64374 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:43:55.181232 0.000000 tcp 10.0.2.105 64374 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:44:03.525846 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:44:10.533230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:44:18.534680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:44:34.537667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:45:06.543657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:49:01.182782 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:49:01.182922 3.002426 tcp 10.0.2.105 64375 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:10.188047 0.000000 tcp 10.0.2.105 64375 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:16.184932 0.064253 tcp 10.0.2.105 64376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:16.249454 0.061023 tcp 10.0.2.105 64377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:16.310779 0.187152 tcp 10.0.2.105 64378 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:16.523282 3.004117 tcp 10.0.2.105 64379 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:25.538997 0.000000 tcp 10.0.2.105 64379 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:31.525608 0.060433 tcp 10.0.2.105 64380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:31.586333 0.066576 tcp 10.0.2.105 64381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:31.653171 0.155853 tcp 10.0.2.105 64382 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:31.888096 3.001261 tcp 10.0.2.105 64383 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:40.888079 0.000000 tcp 10.0.2.105 64383 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:46.887651 0.065293 tcp 10.0.2.105 64384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:46.953223 0.060443 tcp 10.0.2.105 64385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:47.013944 0.151561 tcp 10.0.2.105 64386 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:49:47.245606 2.996097 tcp 10.0.2.105 64387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:49:56.240866 0.000000 tcp 10.0.2.105 64387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:50:02.239236 3.003895 tcp 10.0.2.105 64388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:50:11.243012 0.000000 tcp 10.0.2.105 64388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:50:16.078987 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:50:17.240833 3.004186 tcp 10.0.2.105 64389 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:50:26.243300 0.000000 tcp 10.0.2.105 64389 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:54:32.550174 3.001660 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 19:54:39.557505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:54:47.559325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:55:03.563008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:55:32.244449 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 19:55:32.244593 2.993181 tcp 10.0.2.105 64390 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:55:35.568392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 19:55:41.246070 0.000000 tcp 10.0.2.105 64390 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:55:47.246949 0.065766 tcp 10.0.2.105 64391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:55:47.312916 0.062047 tcp 10.0.2.105 64392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:55:47.375291 0.160633 tcp 10.0.2.105 64393 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:55:47.673726 2.996159 tcp 10.0.2.105 64394 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:55:56.668619 0.000000 tcp 10.0.2.105 64394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:56:02.667794 0.070782 tcp 10.0.2.105 64395 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:56:02.738834 0.062073 tcp 10.0.2.105 64396 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:56:02.801264 0.154510 tcp 10.0.2.105 64397 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/14 19:56:02.984155 2.997495 tcp 10.0.2.105 64398 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:56:11.980852 0.000000 tcp 10.0.2.105 64398 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:56:17.978612 3.004588 tcp 10.0.2.105 64399 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:56:26.981917 0.000000 tcp 10.0.2.105 64399 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 19:56:31.578707 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:00:34.327909 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:00:34.328053 0.213327 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:34.533954 0.094752 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:34.632793 0.366309 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:34.972923 0.190369 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:35.160384 0.114362 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:35.262866 0.251314 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:35.478336 1.278009 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:36.336640 0.073979 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:36.393087 0.234671 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:36.606647 0.145114 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:36.743900 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 20:00:54.598602 0.061133 tcp 10.0.2.105 64400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:00:54.660002 0.061052 tcp 10.0.2.105 64401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:00:54.721308 0.153619 tcp 10.0.2.105 64402 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:00:54.875522 0.227120 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.096144 0.183017 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.258758 0.184770 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.466416 0.189536 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.627947 0.175544 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.799781 0.174537 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:55.970965 0.186388 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:56.132604 0.443836 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:56.553969 0.115222 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:56.639985 0.175065 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:56.807519 0.056576 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:56.851341 0.182902 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:57.030265 0.167804 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:57.195016 0.119540 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1918 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:00:57.279339 0.094814 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:01:32.982608 3.003910 tcp 10.0.2.105 64403 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:01:37.578588 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:01:39.574258 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:01:41.984916 0.000000 tcp 10.0.2.105 64403 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:01:46.581923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:01:47.984309 0.060711 tcp 10.0.2.105 64404 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:01:48.045344 0.061822 tcp 10.0.2.105 64405 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:01:48.107416 0.149970 tcp 10.0.2.105 64406 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:01:48.550162 2.998574 tcp 10.0.2.105 64407 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:01:54.583351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:01:57.557710 0.000000 tcp 10.0.2.105 64407 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:03.546566 0.064097 tcp 10.0.2.105 64408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:03.610950 0.067343 tcp 10.0.2.105 64409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:03.678552 0.150655 tcp 10.0.2.105 64410 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:03.839689 3.000934 tcp 10.0.2.105 64411 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:10.586196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:02:12.838913 0.000000 tcp 10.0.2.105 64411 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:18.838381 0.061472 tcp 10.0.2.105 64412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:18.899710 0.061312 tcp 10.0.2.105 64413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:18.961281 0.157610 tcp 10.0.2.105 64414 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:02:19.137475 3.005548 tcp 10.0.2.105 64415 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:28.141328 0.000000 tcp 10.0.2.105 64415 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:34.129820 3.004266 tcp 10.0.2.105 64416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:42.592680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:02:43.132885 0.000000 tcp 10.0.2.105 64416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:48.070038 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:02:49.131920 3.003932 tcp 10.0.2.105 64417 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:02:58.134525 0.000000 tcp 10.0.2.105 64417 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:04.134791 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:08:04.134901 2.993812 tcp 10.0.2.105 64418 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:13.137472 0.000000 tcp 10.0.2.105 64418 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:19.137560 0.062379 tcp 10.0.2.105 64419 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:19.200212 0.065523 tcp 10.0.2.105 64420 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:19.266037 0.156624 tcp 10.0.2.105 64421 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:20.086536 2.994978 tcp 10.0.2.105 64422 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:29.082959 0.000000 tcp 10.0.2.105 64422 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:35.079965 0.059721 tcp 10.0.2.105 64423 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:35.139977 0.064261 tcp 10.0.2.105 64424 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:35.204545 0.165928 tcp 10.0.2.105 64425 -> 195.113.214.249 443 SRPA* 0 0 24 13858 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:35.496649 2.997216 tcp 10.0.2.105 64426 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:44.492343 0.000000 tcp 10.0.2.105 64426 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:46.598219 3.001708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:08:50.491630 0.216077 tcp 10.0.2.105 64427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:50.708043 0.062583 tcp 10.0.2.105 64428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:50.770973 0.155295 tcp 10.0.2.105 64429 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:08:51.153226 2.985952 tcp 10.0.2.105 64430 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:08:53.733541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:09:00.091717 0.000000 tcp 10.0.2.105 64430 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:09:01.672687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:09:06.030040 2.968869 tcp 10.0.2.105 64431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:09:15.006441 0.000000 tcp 10.0.2.105 64431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:09:17.609989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:09:19.573312 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:09:21.004916 2.994237 tcp 10.0.2.105 64432 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:09:30.000507 0.000000 tcp 10.0.2.105 64432 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:09:49.616227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:14:36.009196 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:14:36.009297 3.002793 tcp 10.0.2.105 64433 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:14:45.012133 0.000000 tcp 10.0.2.105 64433 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:14:51.011610 0.060925 tcp 10.0.2.105 64434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:14:51.072792 0.065494 tcp 10.0.2.105 64435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:14:51.138645 0.152233 tcp 10.0.2.105 64436 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:14:51.776614 2.998794 tcp 10.0.2.105 64437 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:00.773274 0.000000 tcp 10.0.2.105 64437 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:06.772815 0.061258 tcp 10.0.2.105 64438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:06.834437 0.061385 tcp 10.0.2.105 64439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:06.896132 0.157576 tcp 10.0.2.105 64440 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:07.331646 3.005236 tcp 10.0.2.105 64441 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:16.345913 0.000000 tcp 10.0.2.105 64441 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:22.324790 0.069934 tcp 10.0.2.105 64442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:22.394975 0.061404 tcp 10.0.2.105 64443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:22.456656 0.158170 tcp 10.0.2.105 64444 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:15:23.046896 2.994299 tcp 10.0.2.105 64445 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:32.037981 0.000000 tcp 10.0.2.105 64445 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:38.047306 3.003943 tcp 10.0.2.105 64446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:47.049965 0.000000 tcp 10.0.2.105 64446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:51.576405 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:15:53.048507 3.004476 tcp 10.0.2.105 64447 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:15:53.622175 3.001551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:16:00.629406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:16:02.051647 0.000000 tcp 10.0.2.105 64447 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:16:08.634824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:16:24.634047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:16:56.640115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:21:08.051895 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:21:08.052021 3.003830 tcp 10.0.2.105 64448 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:17.054505 0.000000 tcp 10.0.2.105 64448 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:23.054468 0.061551 tcp 10.0.2.105 64449 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:23.116470 0.064995 tcp 10.0.2.105 64450 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:23.181754 0.157848 tcp 10.0.2.105 64451 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:23.536091 2.991840 tcp 10.0.2.105 64452 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:32.536797 0.000000 tcp 10.0.2.105 64452 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:38.536088 0.061890 tcp 10.0.2.105 64453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:38.598253 0.066396 tcp 10.0.2.105 64454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:38.664968 0.161979 tcp 10.0.2.105 64455 -> 195.113.214.249 443 SRPA* 0 0 34 22306 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:39.175052 2.999760 tcp 10.0.2.105 64456 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:48.168637 0.000000 tcp 10.0.2.105 64456 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:21:54.168263 0.061584 tcp 10.0.2.105 64457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:54.230102 0.061835 tcp 10.0.2.105 64458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:54.292187 0.163694 tcp 10.0.2.105 64459 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:21:54.686124 2.997082 tcp 10.0.2.105 64460 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:22:03.681421 0.000000 tcp 10.0.2.105 64460 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:22:09.680547 3.004370 tcp 10.0.2.105 64461 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:22:18.683572 0.000000 tcp 10.0.2.105 64461 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:22:23.570095 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:22:24.682280 3.003661 tcp 10.0.2.105 64462 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:22:33.684515 0.000000 tcp 10.0.2.105 64462 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:23:00.648676 2.999279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:23:07.653276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:23:15.654855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:23:31.659494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:24:03.664983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:30:07.669870 3.001830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 20:30:14.677499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:30:22.678917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:30:38.685454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:31:10.687788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:31:17.537910 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:31:17.538059 0.125018 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:17.644350 0.222912 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:18.115107 0.191065 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:18.302775 0.529726 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:18.570183 0.081056 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:18.613991 0.460366 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:19.047265 0.246667 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:19.259477 0.374428 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 1966 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:19.542492 0.075885 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:19.673175 0.234101 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:19.887066 0.146605 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:20.149707 0.224672 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:20.367663 0.183300 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:20.529795 0.181336 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:20.772857 0.192640 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:20.937311 0.185189 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:21.173433 0.178115 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:21.349530 0.172740 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:21.518406 0.442605 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:21.938924 0.117673 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.050009 0.173222 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.215436 0.053016 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.400917 0.182956 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.579222 0.167954 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.744587 0.161692 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:22.875714 0.095049 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/14 20:31:24.708353 3.004334 tcp 10.0.2.105 64463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:31:33.711127 0.000000 tcp 10.0.2.105 64463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:31:39.711842 0.062641 tcp 10.0.2.105 64464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:39.774809 0.060293 tcp 10.0.2.105 64465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:39.835409 0.157208 tcp 10.0.2.105 64466 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:40.266780 3.002751 tcp 10.0.2.105 64467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:31:49.263317 0.000000 tcp 10.0.2.105 64467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:31:55.262436 0.059461 tcp 10.0.2.105 64468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:55.322177 0.061673 tcp 10.0.2.105 64469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:55.384134 0.168018 tcp 10.0.2.105 64470 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:31:55.737986 3.008857 tcp 10.0.2.105 64471 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:04.745819 0.000000 tcp 10.0.2.105 64471 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:10.734886 0.123500 tcp 10.0.2.105 64472 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:32:10.858685 0.061797 tcp 10.0.2.105 64473 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:32:10.920786 0.159243 tcp 10.0.2.105 64474 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:32:11.279234 3.000084 tcp 10.0.2.105 64475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:20.277890 0.000000 tcp 10.0.2.105 64475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:26.276787 2.993665 tcp 10.0.2.105 64476 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:35.269322 0.000000 tcp 10.0.2.105 64476 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:40.078707 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:32:41.279011 3.003593 tcp 10.0.2.105 64477 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:32:50.284893 0.000000 tcp 10.0.2.105 64477 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:37:14.695028 3.000467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:37:21.701427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:37:29.702983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:37:45.706070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:37:56.284174 0.000243 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:37:56.284505 3.004568 tcp 10.0.2.105 64478 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:05.283889 0.000000 tcp 10.0.2.105 64478 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:11.284803 0.065408 tcp 10.0.2.105 64479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:11.350525 0.060834 tcp 10.0.2.105 64480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:11.411653 0.149545 tcp 10.0.2.105 64481 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:11.811021 2.996693 tcp 10.0.2.105 64482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:17.726981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:38:20.816642 0.000000 tcp 10.0.2.105 64482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:26.807210 0.058986 tcp 10.0.2.105 64483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:26.866516 0.062593 tcp 10.0.2.105 64484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:26.929450 0.153155 tcp 10.0.2.105 64485 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:27.145094 2.997963 tcp 10.0.2.105 64486 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:36.143032 0.000000 tcp 10.0.2.105 64486 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:42.138165 0.064863 tcp 10.0.2.105 64487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:42.203331 0.061493 tcp 10.0.2.105 64488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:42.265092 0.209038 tcp 10.0.2.105 64489 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:38:42.789803 3.002315 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:51.790801 0.000000 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:38:57.789303 3.004399 tcp 10.0.2.105 64491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:39:06.792774 0.000000 tcp 10.0.2.105 64491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:39:11.569256 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:39:12.791467 3.004149 tcp 10.0.2.105 64492 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:39:21.794009 0.000000 tcp 10.0.2.105 64492 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:44:21.718272 3.009737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:44:27.794531 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:44:27.794623 2.993529 tcp 10.0.2.105 64493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:44:28.725412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:44:36.727994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:44:36.797410 0.000000 tcp 10.0.2.105 64493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:44:42.798658 0.061449 tcp 10.0.2.105 64494 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:42.860413 0.061612 tcp 10.0.2.105 64495 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:42.922282 0.158821 tcp 10.0.2.105 64496 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:43.493797 2.997066 tcp 10.0.2.105 64497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:44:52.489744 0.000000 tcp 10.0.2.105 64497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:44:52.729872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:44:58.488616 0.062813 tcp 10.0.2.105 64498 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:58.551744 0.061830 tcp 10.0.2.105 64499 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:58.613940 0.162682 tcp 10.0.2.105 64500 -> 195.113.214.249 443 SRPA* 0 0 41 22612 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:44:58.942943 3.000312 tcp 10.0.2.105 64501 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:07.942655 0.000000 tcp 10.0.2.105 64501 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:13.940787 0.061489 tcp 10.0.2.105 64502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:45:14.002147 0.065157 tcp 10.0.2.105 64503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:45:14.067569 0.152042 tcp 10.0.2.105 64504 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:45:14.498380 3.007026 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:23.504018 0.000000 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:24.735940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:45:29.493185 3.003902 tcp 10.0.2.105 64506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:38.495530 0.000000 tcp 10.0.2.105 64506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:43.072190 0.000212 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:45:44.494801 2.993938 tcp 10.0.2.105 64507 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:45:53.497080 0.000000 tcp 10.0.2.105 64507 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:50:59.503529 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:50:59.503684 2.997813 tcp 10.0.2.105 64508 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:08.499993 0.000000 tcp 10.0.2.105 64508 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:14.500643 0.061851 tcp 10.0.2.105 64509 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:14.562769 0.066347 tcp 10.0.2.105 64510 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:14.629471 0.156074 tcp 10.0.2.105 64511 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:14.846816 3.000872 tcp 10.0.2.105 64512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:23.843622 0.000000 tcp 10.0.2.105 64512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:29.841313 0.060735 tcp 10.0.2.105 64513 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:29.902299 0.063071 tcp 10.0.2.105 64514 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:29.965650 0.163720 tcp 10.0.2.105 64515 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:30.199112 3.006563 tcp 10.0.2.105 64516 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:39.207099 0.000000 tcp 10.0.2.105 64516 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:45.193742 0.066206 tcp 10.0.2.105 64517 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:45.260246 0.061704 tcp 10.0.2.105 64518 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:45.321817 0.162625 tcp 10.0.2.105 64519 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/14 20:51:45.592835 2.987553 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:51:54.586789 0.000000 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:52:00.585138 2.994176 tcp 10.0.2.105 64521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:52:09.578020 0.000000 tcp 10.0.2.105 64521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:52:14.575183 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 20:52:15.587262 2.993641 tcp 10.0.2.105 64522 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:52:24.579776 0.000000 tcp 10.0.2.105 64522 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 20:54:41.749304 3.002043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 20:54:48.757010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:54:56.759011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:55:12.763934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 20:55:44.767512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:01:23.314308 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 21:01:23.314473 0.124928 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:23.419656 0.215056 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:23.626787 0.190580 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:23.813949 0.147334 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.024175 0.091747 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.077787 0.354767 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.405335 0.072633 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.532825 0.236657 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.747108 0.248866 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:24.959637 0.863714 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:25.332923 0.151800 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:25.481087 0.229271 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:25.726540 0.184109 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:25.888065 0.181132 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:26.040333 0.209835 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:26.221099 0.174176 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:26.390903 0.513476 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:26.882783 0.182597 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.026476 0.186683 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.255953 0.176141 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.428521 0.173956 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.595424 0.052164 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.732281 0.184217 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:27.911579 0.167624 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:28.076462 0.131552 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:28.161940 0.092297 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:01:30.614456 2.994572 tcp 10.0.2.105 64523 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 21:01:39.617599 0.000000 tcp 10.0.2.105 64523 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/14 21:01:45.617838 0.065525 tcp 10.0.2.105 64524 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 21:01:45.683632 0.061061 tcp 10.0.2.105 64525 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 21:01:45.744979 0.153488 tcp 10.0.2.105 64526 -> 195.113.214.249 443 SRPA* 0 0 19 9796 flow=From-Botnet-V2-TCP-Established 1970/02/14 21:01:45.914002 0.780141 tcp 10.0.2.105 64527 -> 31.192.24.67 3527 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/14 21:01:48.773495 3.001334 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:01:55.780543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:02:03.782291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:02:19.785046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:02:51.791536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:08:55.797839 3.000808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:09:02.804776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:09:10.806387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:09:26.809293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:09:58.822107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:16:02.821594 3.001477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:16:09.828280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:16:17.830128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:16:33.833107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:17:05.839265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:23:09.845591 3.001381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:23:16.852868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:23:24.854291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:23:40.857041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:24:12.863160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:30:16.870756 3.004746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:30:23.876820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:30:31.878273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:30:47.881293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:31:19.887245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:31:32.575795 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 21:31:32.575961 0.125277 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:32.681110 0.224144 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:32.958924 0.190231 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:33.146074 0.430502 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:33.243064 0.087019 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:33.525652 0.435045 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:33.937713 0.075641 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:34.134869 0.274961 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:34.564941 0.144411 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:34.723747 0.235168 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:34.986420 0.253433 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:35.205915 0.226821 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:35.425287 0.187626 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:35.706635 0.186855 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:35.897383 0.188548 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:36.059058 0.170327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:36.226087 0.185690 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:36.491016 0.175720 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:36.663698 0.176455 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:36.830247 0.446156 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:37.253634 0.110543 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:37.441393 0.055321 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:37.508874 0.182590 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:37.686648 0.167401 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:37.872004 0.227855 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1694 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:38.065798 0.094395 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/14 21:31:46.696525 0.672353 tcp 10.0.2.105 64528 -> 31.192.24.67 3527 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/14 21:37:23.892088 3.002711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:37:30.899990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:37:38.902093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:37:54.904606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:38:26.911120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:44:30.921394 2.997464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:44:37.928679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:44:45.926296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:45:01.928999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:45:33.935185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:54:46.942386 3.002432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 21:54:53.950344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:55:01.951799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:55:17.955312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 21:55:49.961064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:01:47.375463 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 22:01:47.375570 0.567714 tcp 10.0.2.105 64529 -> 31.192.24.67 3527 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/14 22:01:48.035997 0.124459 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:48.141479 0.213372 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:48.346923 0.188013 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:48.532033 0.152657 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:48.685960 0.092828 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:48.736221 0.382282 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:49.089681 0.095981 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:49.147800 0.233614 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:49.362310 0.370346 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:49.715065 0.143539 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:49.856226 0.277651 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.100267 0.226828 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.319281 0.188443 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.482998 0.174750 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.633676 0.189902 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.794765 0.176083 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:50.968072 0.174998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:51.135520 0.173826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:51.305261 0.188949 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:51.494496 0.445320 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:51.914804 0.116463 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:51.996266 0.053071 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:52.044951 0.182419 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:52.222459 0.169123 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:52.388623 0.178395 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:52.521840 0.094796 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:01:53.966618 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:02:00.974923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:02:08.975613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:02:24.978821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:02:56.984869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:09:00.990249 3.002418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:09:07.998399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:09:15.999552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:09:32.003151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:10:04.009036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:16:08.015073 3.029559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:16:15.032590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:16:23.036876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:16:39.041857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:17:11.043309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:23:15.048397 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:23:22.056962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:23:30.057528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:23:46.060422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:24:18.066555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:30:22.072764 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:30:29.080194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:30:37.081481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:30:53.084453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:31:25.090341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:31:47.943960 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 22:31:47.944124 0.784061 tcp 10.0.2.105 64530 -> 31.192.24.67 3527 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/02/14 22:31:56.376074 0.290098 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:56.901296 0.125240 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:57.008155 0.216452 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:57.216562 0.222800 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:57.500974 0.086542 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:57.549116 0.357693 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:57.877202 0.072133 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2014 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:58.137501 0.233724 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:58.351896 0.349670 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:58.620627 0.164279 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:58.974222 0.250439 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:59.187362 0.226905 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:59.406787 0.185820 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:59.607492 0.180090 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:31:59.943009 0.244009 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:00.155228 0.175449 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:00.366075 0.173476 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:00.532796 0.171955 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:00.701513 0.116801 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:00.829783 0.077011 udp 10.0.2.105 7010 <-> 95.89.175.2 6418 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:01.017052 0.183969 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:01.196691 0.168359 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:01.362345 0.256302 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:01.569224 0.095421 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:01.708089 0.185873 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:32:02.116049 0.444092 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/14 22:37:29.096169 3.075103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:37:36.142313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:37:44.116934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:38:00.118770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:38:32.124648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:44:36.140270 3.002525 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:44:43.148057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:44:51.149392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:45:07.155970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:45:39.158873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:54:51.166112 3.013116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 22:54:58.182800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:55:06.183638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:55:22.187024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 22:55:54.193094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:01:48.733605 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 23:01:48.733793 0.584582 tcp 10.0.2.105 64531 -> 31.192.24.67 3527 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:01:58.199080 3.001634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:02:05.206641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:02:13.208122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:02:28.039463 0.192115 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:28.227756 0.126568 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:28.333908 0.213032 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:28.539795 0.224428 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:28.714067 0.085261 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:28.758311 0.937369 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:29.210849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:02:29.692665 0.073585 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:29.748594 0.147860 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:29.886533 0.233862 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:30.101275 0.437298 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:30.397828 0.280525 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:30.784620 0.220276 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:30.997348 0.185481 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:31.160570 0.190958 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:31.605904 0.174228 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:31.772380 0.174131 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:31.941889 0.898855 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:32.575830 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 23:02:32.807586 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 23:02:49.061781 0.062878 tcp 10.0.2.105 64532 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:02:49.124996 0.067016 tcp 10.0.2.105 64533 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:02:49.192515 0.151984 tcp 10.0.2.105 64534 -> 195.113.214.249 443 SRPA* 0 0 37 27828 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:02:49.345153 0.190171 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:49.505170 0.174914 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:49.677585 0.184712 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:49.857667 0.168310 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:50.023279 0.145306 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1738 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:50.137704 0.095004 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:50.223347 0.185050 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:02:50.384201 0.447521 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:03:01.216812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:09:05.222394 3.002235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:09:12.230582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:09:20.231726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:09:36.234806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:10:08.241359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:16:12.247363 3.005954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:16:19.254176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:16:27.255625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:16:44.017178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:17:15.654047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:23:19.280789 3.093115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:23:26.358412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:23:34.299743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:23:50.303040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:24:22.308734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:30:26.314899 3.001215 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:30:33.331012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:30:41.323646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:30:57.327105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:31:29.342737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:31:49.325864 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 23:31:49.325970 0.691199 tcp 10.0.2.105 64535 -> 31.192.24.67 3527 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:33:15.155440 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/14 23:33:15.155644 0.000000 udp 10.0.2.105 7010 -> 95.89.175.2 6418 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/14 23:33:33.903508 0.064667 tcp 10.0.2.105 64536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:33:33.968505 0.064915 tcp 10.0.2.105 64537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:33:34.033741 0.167165 tcp 10.0.2.105 64538 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/14 23:33:34.201400 0.217107 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:34.410196 0.189335 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:34.531541 0.092965 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:34.788982 0.187627 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:34.973863 0.122877 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 1990 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:35.079465 0.086821 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:35.345455 0.149993 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:35.484288 0.513712 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:35.967267 0.527715 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:36.274324 0.279176 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:36.573131 0.229500 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:36.796094 0.234997 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:37.010390 0.173525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:37.267028 0.171947 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:37.435363 0.176020 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:37.592600 0.184772 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:37.767762 0.695523 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:38.427717 0.184441 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:38.606518 0.186085 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:38.779713 0.177511 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:38.954180 0.168563 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:39.120277 0.129097 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:39.288568 0.095313 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:39.374929 0.184896 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:33:39.573786 0.459124 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/14 23:37:33.349274 3.018148 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/14 23:37:40.366208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:37:48.367671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:38:04.370801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:38:36.379137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:44:40.382713 3.001981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:44:47.390400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:44:55.391865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:45:11.401958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:45:43.401983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:54:54.415750 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/14 23:55:01.423087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:55:09.424527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:55:25.427591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/14 23:55:57.433596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:01:50.010534 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:01:50.010739 0.545367 tcp 10.0.2.105 64539 -> 31.192.24.67 3527 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:02:01.440027 3.001186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 00:02:08.446820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:02:16.448479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:02:32.451700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:03:04.457420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:03:56.172051 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:03:56.172341 0.086807 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:03:56.222706 0.188396 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:04.080972 0.125093 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:04.186678 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:04:20.418217 0.061007 tcp 10.0.2.105 64540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:20.479500 0.065272 tcp 10.0.2.105 64541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:20.545135 0.164585 tcp 10.0.2.105 64542 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:20.710359 0.151174 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:20.853244 0.074893 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:20.911160 0.143948 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:21.065757 0.357167 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:21.389119 0.226978 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:21.608774 0.234201 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:21.822591 0.488224 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:22.130446 0.315122 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:22.409400 0.174002 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:22.575481 0.171605 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:22.742738 0.184238 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:22.936810 0.187263 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:23.100328 0.949400 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 4 1489 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:24.031940 0.000000 udp 10.0.2.105 7010 -> 65.114.199.182 4317 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:04:41.657894 0.069447 tcp 10.0.2.105 64543 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:41.727706 0.063110 tcp 10.0.2.105 64544 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:41.790786 0.181781 tcp 10.0.2.105 64545 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:04:41.973143 0.281254 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:42.227446 0.176155 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:42.401252 0.171718 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:42.569373 0.187319 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:42.763083 0.439783 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:43.182826 0.127590 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:04:43.265449 0.096699 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:09:09.465439 3.234936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 00:09:16.669299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:09:24.599497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:09:40.487411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:10:12.493183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:16:16.498865 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 00:16:23.506169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:16:31.507975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:16:53.998180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:17:28.497713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:23:31.348689 2.960674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 00:23:38.258424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:23:46.146969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:24:02.265261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:24:33.836177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:30:32.849063 2.959255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 00:30:39.873608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:30:47.765214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:31:03.542417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:31:35.097816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:31:51.815266 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:31:51.815355 0.587796 tcp 10.0.2.105 64546 -> 31.192.24.67 3527 SPA_* 0 0 12 1505 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:32:12.753007 0.000069 tcp 10.0.2.105 64546 -> 31.192.24.67 3527 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:34:47.373667 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:34:47.373815 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:35:03.618474 3.950990 tcp 10.0.2.105 64547 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:07.569764 0.069340 tcp 10.0.2.105 64548 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:07.639380 0.150618 tcp 10.0.2.105 64549 -> 195.113.214.249 443 SRPA* 0 0 44 32124 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:07.790568 0.182297 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:07.967825 0.080484 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:14.735861 0.123064 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:33.240422 0.000000 tcp 10.0.2.105 64550 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 00:35:42.042762 0.063383 tcp 10.0.2.105 64550 -> 195.113.214.245 80 FPA_* 0 0 9 1828 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:42.106404 0.065233 tcp 10.0.2.105 64551 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:42.171947 0.177430 tcp 10.0.2.105 64552 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:35:42.452468 0.189687 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:42.916762 0.145535 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:43.144124 0.574196 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:43.690887 0.075124 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:45.419758 0.248473 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:45.663606 0.282379 udp 10.0.2.105 7010 <-> 41.151.133.217 3799 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:35:46.068879 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:36:04.508716 0.000000 tcp 10.0.2.105 64553 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 00:36:18.960173 0.062803 tcp 10.0.2.105 64553 -> 195.113.214.245 80 FPA_* 0 0 9 1828 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:19.023296 0.062846 tcp 10.0.2.105 64554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:19.086465 0.163353 tcp 10.0.2.105 64555 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:19.250385 0.234777 udp 10.0.2.105 7010 <-> 207.119.6.81 8296 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:19.463729 0.174107 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:19.634118 0.188669 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:19.984710 0.172442 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:20.149975 0.278918 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:20.394467 0.186508 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:20.561725 0.752883 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:21.283055 0.187206 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:38.593676 0.124075 tcp 10.0.2.105 64556 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:38.718078 0.066403 tcp 10.0.2.105 64557 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:38.784807 1.721530 tcp 10.0.2.105 64558 -> 195.113.214.249 443 SRPA* 0 0 81 77522 flow=From-Botnet-V2-TCP-Established 1970/02/15 00:36:40.507375 0.176045 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:40.680773 0.168304 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:40.846319 0.184562 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:41.103927 0.093456 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:41.188676 0.444171 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:41.610129 0.132487 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:41.850068 0.231745 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 8 2996 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:42.062868 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:36:47.164781 2.240579 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3098 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:49.374552 0.430682 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 2982 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:49.800364 2.862840 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2866 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:52.626493 0.458295 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 8 2934 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:53.081521 0.290864 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 8 2831 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:53.364342 0.839622 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3088 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:54.176541 0.167321 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 8 2949 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:36:54.327657 0.232698 udp 10.0.2.105 7010 <-> 213.213.103.242 4595 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:19.502274 0.336237 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 2838 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:19.830656 0.558664 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:20.352219 0.517607 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 3172 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:20.844470 0.326854 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 3186 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:21.146848 1.679344 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3061 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:22.822701 1.558002 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 3246 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:24.344630 0.160567 udp 10.0.2.105 7010 <-> 172.15.87.16 8431 CON 0 0 2 657 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:25.099632 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:37:31.102530 0.341025 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 8 3180 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:31.419145 0.246817 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2890 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:31.657407 0.345639 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 3174 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:32.000438 1.615253 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 2922 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:33.573130 0.878927 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 3039 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:37:34.430162 0.000000 udp 10.0.2.105 7010 -> 80.179.7.22 2606 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:37:42.313882 0.000000 udp 10.0.2.105 7010 -> 206.116.22.27 6299 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:37:51.023873 0.000000 udp 10.0.2.105 7010 -> 216.254.156.227 3017 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:37:55.687576 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:37:59.832975 0.000000 udp 10.0.2.105 7010 -> 91.55.220.224 7290 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:05.602325 2.960377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 00:38:07.779802 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:14.187322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:38:17.737903 0.000000 udp 10.0.2.105 7010 -> 195.29.217.146 4392 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:22.082339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:38:22.501168 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:38:25.747795 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:31.890220 0.000000 udp 10.0.2.105 7010 -> 88.3.146.106 5451 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:38.995610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:38:41.700777 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:49.959478 0.000000 udp 10.0.2.105 7010 -> 79.181.181.58 6219 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:38:54.692553 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:38:57.013642 0.000000 udp 10.0.2.105 7010 -> 65.125.140.130 5771 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:02.015264 0.000000 udp 10.0.2.105 7010 -> 49.147.72.159 9574 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:09.599930 0.000000 udp 10.0.2.105 7010 -> 98.173.166.120 9081 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:11.949066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:39:17.582422 0.000000 udp 10.0.2.105 7010 -> 85.74.90.62 2536 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:22.220604 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:39:25.435714 0.857354 udp 10.0.2.105 7010 <-> 112.210.73.25 5414 CON 0 0 8 3158 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:39:26.359237 0.000000 udp 10.0.2.105 7010 -> 36.72.15.108 1837 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:33.618033 0.000000 udp 10.0.2.105 7010 -> 41.241.128.149 9009 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:38.765863 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:45.012139 0.130223 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:39:45.142362 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 120 flow=Background 1970/02/15 00:39:49.802867 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:39:53.713625 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:01.126774 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:09.229529 0.000000 udp 10.0.2.105 7010 -> 62.103.214.8 4029 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:13.935041 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:40:14.195398 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:22.576815 0.000000 udp 10.0.2.105 7010 -> 84.134.170.52 7822 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:30.845323 0.000000 udp 10.0.2.105 7010 -> 74.94.175.201 7900 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:39.646353 0.000000 udp 10.0.2.105 7010 -> 95.230.96.137 9692 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:44.492627 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:40:44.968075 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:40:52.083575 0.000000 udp 10.0.2.105 7010 -> 103.1.182.78 1167 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:41:03.109970 0.000000 udp 10.0.2.105 7010 -> 109.152.47.5 7670 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:41:14.906010 0.070122 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 7 3186 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:41:15.135362 0.151225 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:42:40.708710 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:42:40.708828 0.000000 udp 10.0.2.105 7010 -> 101.173.198.50 5033 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:42:48.055397 0.000000 udp 10.0.2.105 7010 -> 90.18.227.162 5368 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:42:53.458682 0.000000 udp 10.0.2.105 7010 -> 58.185.236.154 4953 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:02.149390 0.000000 udp 10.0.2.105 7010 -> 68.65.131.154 5750 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:06.751074 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:43:10.326309 0.000000 udp 10.0.2.105 7010 -> 74.124.162.176 2342 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:15.275594 0.000000 udp 10.0.2.105 7010 -> 68.81.49.233 8558 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:23.525130 0.000000 udp 10.0.2.105 7010 -> 76.218.219.95 7916 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:29.059098 0.120686 udp 10.0.2.105 7010 -> 83.63.205.173 5172 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:29.179784 0.000000 icmp 83.63.205.173 0x0303 -> 10.0.2.105 0x3414 URP 192 1 337 flow=Background 1970/02/15 00:43:33.854115 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:43:35.320952 0.388135 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 8 2900 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:43:35.910886 0.414276 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3178 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:43:36.553789 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:43.158438 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:51.068573 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:43:58.257953 0.377341 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 8 3128 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:43:59.071988 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:02.865858 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:44:05.828949 0.000000 udp 10.0.2.105 7010 -> 90.210.208.189 3452 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:12.863011 0.000000 udp 10.0.2.105 7010 -> 202.172.118.245 6428 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:20.048791 0.000000 udp 10.0.2.105 7010 -> 79.248.157.57 9278 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:33.214350 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:38.148250 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:44:41.376009 0.000000 udp 10.0.2.105 7010 -> 79.41.92.43 9555 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:50.001773 0.000000 udp 10.0.2.105 7010 -> 38.109.47.130 4646 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:44:57.508122 0.000000 udp 10.0.2.105 7010 -> 58.22.152.222 1799 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:02.265612 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:45:04.459177 0.000000 udp 10.0.2.105 7010 -> 62.8.110.186 6219 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:11.154182 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:20.000334 1.316896 udp 10.0.2.105 7010 <-> 2.192.28.154 8574 CON 0 0 8 2952 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:45:21.146850 0.793602 udp 10.0.2.105 7010 <-> 110.169.220.109 8909 CON 0 0 8 2972 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:45:21.980673 0.000000 udp 10.0.2.105 7010 -> 95.226.112.35 7469 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:25.967411 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:45:28.474053 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:36.877862 2.961428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 00:45:37.042485 0.207315 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 3241 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:45:37.379187 0.000000 udp 10.0.2.105 7010 -> 95.20.153.248 3969 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:42.607197 0.196373 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 8 3135 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:45:43.201351 0.000000 udp 10.0.2.105 7010 -> 92.135.252.62 7556 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:45:43.785879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:45:51.671151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:45:51.807411 0.000000 udp 10.0.2.105 7010 -> 95.246.38.22 2992 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:09.476669 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:46:12.280920 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:29.949967 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:31.985514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:46:35.803590 0.000000 udp 10.0.2.105 7010 -> 58.251.10.138 1964 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:42.806106 0.059447 udp 10.0.2.105 7010 -> 213.123.239.197 5688 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:42.865553 0.000000 icmp 213.123.239.197 0x0303 -> 10.0.2.105 0x3816 URP 192 1 140 flow=Background 1970/02/15 00:46:47.675775 0.866926 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:46:50.001947 0.000000 udp 10.0.2.105 7010 -> 156.83.1.68 6655 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:46:56.344458 0.000000 udp 10.0.2.105 7010 -> 188.219.133.30 1958 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:04.415275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:47:04.968929 0.000000 udp 10.0.2.105 7010 -> 31.70.2.228 9221 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:09.916826 0.000000 udp 10.0.2.105 7010 -> 173.86.67.244 7891 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:14.670838 2.657475 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:47:20.506061 0.000000 udp 10.0.2.105 7010 -> 98.110.147.210 5171 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:29.358457 0.373240 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 677 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:29.953552 0.335571 udp 10.0.2.105 7010 <-> 49.144.103.145 2222 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:30.561309 0.000000 udp 10.0.2.105 7010 -> 110.172.180.40 8076 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:37.073686 0.000000 udp 10.0.2.105 7010 -> 195.174.204.4 7464 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:41.977835 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:47:42.424149 0.311592 udp 10.0.2.105 7010 <-> 107.18.131.167 9968 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:42.831704 0.000000 udp 10.0.2.105 7010 -> 95.224.148.88 1582 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:47:49.373657 0.818546 udp 10.0.2.105 7010 <-> 141.196.131.87 4588 CON 0 0 2 744 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:52.491244 0.259363 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:52.769507 0.031866 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:47:52.999331 0.000000 udp 10.0.2.105 7010 -> 79.33.30.203 2142 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:01.819871 0.000000 udp 10.0.2.105 7010 -> 94.66.24.211 3480 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:06.619857 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:48:10.000125 0.000000 udp 10.0.2.105 7010 -> 121.54.22.85 2129 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:17.390072 0.000000 udp 10.0.2.105 7010 -> 38.96.42.178 2801 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:24.715290 0.000000 udp 10.0.2.105 7010 -> 79.55.157.14 5995 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:31.929998 0.000000 udp 10.0.2.105 7010 -> 75.99.239.234 5937 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:48:48.793377 2.243613 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:48:53.742508 0.000000 udp 10.0.2.105 7010 -> 79.129.11.125 4486 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:00.020381 0.000000 udp 10.0.2.105 7010 -> 112.204.219.47 4737 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:06.160712 0.000000 udp 10.0.2.105 7010 -> 195.67.143.122 9832 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:16.809955 0.331940 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:49:17.970294 0.078326 udp 10.0.2.105 7010 -> 85.107.160.235 2982 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:18.048620 0.000000 icmp 85.107.160.235 0x0303 -> 10.0.2.105 0xa60b URP 192 1 155 flow=Background 1970/02/15 00:49:21.381643 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:49:23.266874 0.306070 udp 10.0.2.105 7010 <-> 116.202.78.100 1855 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:49:23.957071 0.269948 udp 10.0.2.105 7010 <-> 115.184.78.169 1146 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:49:24.310873 0.000000 udp 10.0.2.105 7010 -> 82.49.112.129 9485 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:30.311798 0.222652 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:49:35.827035 0.000000 udp 10.0.2.105 7010 -> 105.224.70.106 1285 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:40.828999 0.056431 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:49:41.624951 0.000000 udp 10.0.2.105 7010 -> 58.60.70.36 3891 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:45.512119 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:49:47.316608 0.000000 udp 10.0.2.105 7010 -> 79.5.121.56 2091 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:52.466838 0.000000 udp 10.0.2.105 7010 -> 79.48.141.17 5716 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:49:59.074073 0.000000 udp 10.0.2.105 7010 -> 197.211.23.38 7386 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:15.087442 2.731376 udp 10.0.2.105 7010 -> 84.173.11.85 7912 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:17.818818 0.000000 icmp 84.173.11.85 0x0303 -> 10.0.2.105 0xe81e URP 192 1 148 flow=Background 1970/02/15 00:50:22.239856 0.882216 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:50:24.823234 0.000000 udp 10.0.2.105 7010 -> 83.10.248.33 7247 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:33.346167 0.000000 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:41.981390 0.000000 udp 10.0.2.105 7010 -> 79.129.44.166 5092 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:50.175538 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:50:52.872541 0.356151 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:50:53.281991 0.000000 udp 10.0.2.105 7010 -> 109.144.159.88 1711 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:50:58.824934 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:51:06.713597 0.000000 udp 10.0.2.105 7010 -> 24.13.63.209 8611 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:51:13.062218 0.000000 udp 10.0.2.105 7010 -> 87.248.45.54 7955 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:51:17.742258 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/02/15 00:51:26.018779 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/02/15 00:51:26.512847 0.000000 udp 10.0.2.105 7010 -> 79.48.5.215 6835 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:51:32.096603 0.263944 udp 10.0.2.105 7010 <-> 115.240.29.97 5573 CON 0 0 2 713 flow=From-Botnet-V2-UDP-Established 1970/02/15 00:51:57.706693 0.000000 udp 10.0.2.105 7010 -> 183.11.248.117 1054 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:52:02.466131 0.629905 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 00:52:05.127258 0.000000 udp 10.0.2.105 7010 -> 59.92.3.109 2486 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 00:53:46.638724 2.950377 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 00:53:53.536873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:54:01.416928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:54:17.170462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 00:54:53.118170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:01:14.640349 2.971584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:01:21.641979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:01:29.591887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:01:45.390929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:02:16.940917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:04:02.290130 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 01:04:02.290249 0.640561 tcp 10.0.2.105 64559 -> 31.192.24.67 3527 FSPA* 0 0 14 1680 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:08:22.534312 2.950138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:08:29.432998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:08:37.307451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:08:53.063515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:09:24.580943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:15:23.422193 2.954781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:15:30.319301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:15:38.203142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:15:53.972748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:16:25.489235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:22:12.968723 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 01:22:12.968870 0.104939 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.074195 0.176147 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.250746 0.158967 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.410115 0.049394 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.459967 0.186062 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.646424 0.132349 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.779178 0.055808 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:13.835344 0.322734 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:14.158463 0.233908 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:14.392859 0.164194 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:14.557432 0.159990 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:14.717800 0.150297 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:14.868574 0.170050 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:15.039018 0.653510 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:15.692939 0.160860 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:15.854266 0.083281 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:15.937942 0.171862 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:16.110267 0.081152 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:16.191854 0.475067 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:16.667358 0.384961 udp 10.0.2.105 7010 <-> 112.210.73.25 5414 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:17.052726 0.056646 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:17.109818 0.173660 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:17.283931 0.203313 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:17.487618 0.185570 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:17.673625 0.000000 udp 10.0.2.105 7010 -> 2.192.28.154 8574 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:22:24.350286 3.007223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:22:31.306209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:22:35.916792 0.064858 tcp 10.0.2.105 64560 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:35.981981 0.063093 tcp 10.0.2.105 64561 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:36.045375 0.140239 tcp 10.0.2.105 64562 -> 195.113.214.249 443 SRPA* 0 0 40 28035 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:36.186214 0.398587 udp 10.0.2.105 7010 <-> 110.169.220.109 8909 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:36.585199 0.084532 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:36.670124 0.097617 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:36.768126 0.369554 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:37.138063 0.341713 udp 10.0.2.105 7010 <-> 49.144.103.145 2222 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:37.480349 0.161025 udp 10.0.2.105 7010 <-> 107.18.131.167 9968 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:37.641779 0.000000 udp 10.0.2.105 7010 -> 141.196.131.87 4588 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:22:39.186368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:22:54.534117 0.061583 tcp 10.0.2.105 64563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:54.595993 0.062453 tcp 10.0.2.105 64564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:54.659055 0.156329 tcp 10.0.2.105 64565 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:22:54.815995 0.030432 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:54.846811 0.248498 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:54.956647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:22:55.095742 0.344636 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:55.440869 0.260761 udp 10.0.2.105 7010 <-> 116.202.78.100 1855 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:55.702096 0.249864 udp 10.0.2.105 7010 <-> 115.184.78.169 1146 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:55.952398 0.230487 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:56.183271 0.057257 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:56.241004 0.371419 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:22:56.612828 0.284963 udp 10.0.2.105 7010 <-> 115.240.29.97 5573 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:23:26.505034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:29:25.061850 2.961441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:29:31.960769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:29:39.841842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:29:55.918253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:30:27.465462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:33:36.403219 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/02/15 01:33:41.973135 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/02/15 01:33:41.973247 1.334131 tcp 10.0.2.105 64566 -> 31.192.24.67 3527 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:36:32.098004 2.950977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:36:39.535526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:36:47.418577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:37:03.177619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:37:45.810462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:43:44.396532 2.958277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 01:43:51.299748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:43:59.184305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:44:14.956418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:44:48.967304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:53:10.668163 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 01:53:10.668314 1.824799 udp 10.0.2.105 7010 -> 2.192.28.154 8574 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:53:12.493113 0.000000 icmp 2.192.28.154 0x0303 -> 10.0.2.105 0x7e21 URP 192 1 218 flow=Background 1970/02/15 01:53:26.939052 0.073152 tcp 10.0.2.105 64567 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:27.012511 0.064876 tcp 10.0.2.105 64568 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:27.077672 0.154111 tcp 10.0.2.105 64569 -> 195.113.214.249 443 SRPA* 0 0 39 25373 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:27.232470 0.000000 udp 10.0.2.105 7010 -> 141.196.131.87 4588 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:53:43.662409 0.060324 tcp 10.0.2.105 64570 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:43.723055 0.060980 tcp 10.0.2.105 64571 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:43.784394 0.168024 tcp 10.0.2.105 64572 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:53:43.952960 0.183087 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.136489 0.142743 udp 10.0.2.105 7010 <-> 162.210.27.16 3261 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.279631 0.153322 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.433384 0.176866 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.610643 0.104038 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.715133 0.051377 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.767123 0.164876 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:44.932530 0.158716 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:45.091707 0.058581 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:45.150676 0.325621 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:45.476746 0.216035 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:46.129759 0.160809 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:46.290968 0.839390 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:47.130825 0.168230 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:47.299527 0.171739 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:47.471662 0.083923 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:47.555970 0.445038 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:48.001442 0.157844 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:48.159709 0.085572 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:48.245685 0.182298 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:48.428373 1.355949 udp 10.0.2.105 7010 <-> 112.210.73.25 5414 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:49.784755 0.170031 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:49.955232 0.057160 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:50.012856 0.205696 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:53:50.218938 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:54:07.596544 0.068380 tcp 10.0.2.105 64573 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:07.665194 0.068925 tcp 10.0.2.105 64574 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:07.734364 0.283066 tcp 10.0.2.105 64575 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:08.018052 1.319722 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:09.338144 0.336416 udp 10.0.2.105 7010 <-> 49.144.103.145 2222 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:09.675001 0.000000 udp 10.0.2.105 7010 -> 110.169.220.109 8909 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 01:54:26.087366 0.100391 tcp 10.0.2.105 64576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:26.187774 0.068958 tcp 10.0.2.105 64577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:26.257017 0.154137 tcp 10.0.2.105 64578 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 01:54:26.411662 0.157358 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:26.569455 0.224068 udp 10.0.2.105 7010 <-> 107.18.131.167 9968 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:26.793903 0.252320 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.046653 0.029201 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.076550 0.297627 udp 10.0.2.105 7010 <-> 116.202.78.100 1855 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.374634 0.286714 udp 10.0.2.105 7010 <-> 115.184.78.169 1146 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.661726 0.231681 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.893851 0.054196 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:27.948461 0.344761 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:28.293595 0.345645 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:54:28.639658 0.240154 udp 10.0.2.105 7010 <-> 115.240.29.97 5573 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/15 01:56:04.851846 2.950561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 01:56:11.756928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:56:19.641944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:56:35.407758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 01:57:06.943794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:03:05.542478 2.956284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 02:03:12.438994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:03:22.247741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:03:32.623543 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:03:32.623630 2.954564 tcp 10.0.2.105 64579 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:03:38.023858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:03:41.493563 0.000000 tcp 10.0.2.105 64579 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:03:47.414244 0.066106 tcp 10.0.2.105 64580 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:03:47.480661 0.065090 tcp 10.0.2.105 64581 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:03:47.546059 0.159119 tcp 10.0.2.105 64582 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:02.501096 2.786384 tcp 10.0.2.105 64583 -> 46.48.223.67 15494 FSPA* 0 0 15 1699 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:04.550430 0.065332 tcp 10.0.2.105 64584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:04.616090 0.062884 tcp 10.0.2.105 64585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:04.679304 0.171894 tcp 10.0.2.105 64586 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:04.874606 2.951853 tcp 10.0.2.105 64587 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:04:09.556519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:04:13.747232 0.000000 tcp 10.0.2.105 64587 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:04:24.723244 0.065926 tcp 10.0.2.105 64588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:24.789496 0.063272 tcp 10.0.2.105 64589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:24.853107 0.163968 tcp 10.0.2.105 64590 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:25.842163 2.950381 tcp 10.0.2.105 64591 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:04:34.708956 0.000000 tcp 10.0.2.105 64591 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:04:40.621200 0.000000 tcp 10.0.2.105 64592 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:04:47.464042 0.071287 tcp 10.0.2.105 64592 -> 195.113.214.245 80 PA_S* 0 0 5 1612 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:53.689629 0.000758 tcp 10.0.2.105 64592 -> 195.113.214.245 80 FA_F* 0 0 7 2532 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:53.691023 0.064236 tcp 10.0.2.105 64593 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:04:53.755538 0.164496 tcp 10.0.2.105 64594 -> 195.113.214.249 443 SRPA* 0 0 70 69958 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:05:01.166059 2.949288 tcp 10.0.2.105 64595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:10.017899 0.000000 tcp 10.0.2.105 64595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:17.842784 4.369100 tcp 10.0.2.105 64596 -> 46.48.223.67 15494 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:05:22.212195 2.942584 tcp 10.0.2.105 64597 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:31.065221 0.000000 tcp 10.0.2.105 64597 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:37.179038 2.954400 tcp 10.0.2.105 64598 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:46.034969 0.000000 tcp 10.0.2.105 64598 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:05:50.521769 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:10:42.834272 2.950797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 02:10:47.444649 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:10:47.444754 2.963598 tcp 10.0.2.105 64599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:10:49.728569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:10:56.311474 0.000000 tcp 10.0.2.105 64599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:10:57.606357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:11:02.221948 0.065465 tcp 10.0.2.105 64600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:02.287687 0.062512 tcp 10.0.2.105 64601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:02.350492 0.159766 tcp 10.0.2.105 64602 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:13.365609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:11:32.174008 2.969030 tcp 10.0.2.105 64603 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:11:36.995986 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:11:41.056187 0.000000 tcp 10.0.2.105 64603 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:11:46.956900 0.622339 tcp 10.0.2.105 64604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:47.579543 0.067459 tcp 10.0.2.105 64605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:47.647317 0.154828 tcp 10.0.2.105 64606 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:47.898105 2.379160 tcp 10.0.2.105 64607 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:49.796779 0.062893 tcp 10.0.2.105 64608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:49.860061 0.066610 tcp 10.0.2.105 64609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:49.926979 0.158044 tcp 10.0.2.105 64610 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:11:50.277518 2.956279 tcp 10.0.2.105 64611 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:11:55.072526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:11:59.140949 0.000000 tcp 10.0.2.105 64611 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:05.059102 0.061119 tcp 10.0.2.105 64612 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:12:05.120520 0.063296 tcp 10.0.2.105 64613 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:12:05.184144 0.158909 tcp 10.0.2.105 64614 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:12:05.365354 2.961272 tcp 10.0.2.105 64615 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:14.237725 0.000000 tcp 10.0.2.105 64615 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:20.152160 2.967193 tcp 10.0.2.105 64616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:29.026169 0.000000 tcp 10.0.2.105 64616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:33.713953 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:12:34.933083 1.897961 tcp 10.0.2.105 64617 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:12:36.831283 2.946286 tcp 10.0.2.105 64618 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:12:45.694484 0.000000 tcp 10.0.2.105 64618 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:17:47.141079 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:17:47.141175 2.955810 tcp 10.0.2.105 64619 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:17:53.670165 2.953335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 02:17:56.000198 0.000000 tcp 10.0.2.105 64619 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:00.570290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:18:01.912373 0.065787 tcp 10.0.2.105 64620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:01.978471 0.069128 tcp 10.0.2.105 64621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:02.047454 0.155836 tcp 10.0.2.105 64622 -> 195.113.214.249 443 SRPA* 0 0 47 41562 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:02.253061 2.961993 tcp 10.0.2.105 64623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:08.450085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:18:11.122869 0.000000 tcp 10.0.2.105 64623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:17.032671 0.061543 tcp 10.0.2.105 64624 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:17.094510 0.068420 tcp 10.0.2.105 64625 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:17.163232 0.167205 tcp 10.0.2.105 64626 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:17.924004 3.536556 tcp 10.0.2.105 64627 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:20.809478 0.078199 tcp 10.0.2.105 64628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:20.887940 0.061505 tcp 10.0.2.105 64629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:20.949749 0.156310 tcp 10.0.2.105 64630 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:21.460861 2.951558 tcp 10.0.2.105 64631 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:24.214210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:18:30.316449 0.000000 tcp 10.0.2.105 64631 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:36.227797 0.060009 tcp 10.0.2.105 64632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:36.288091 0.062635 tcp 10.0.2.105 64633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:36.351037 0.160306 tcp 10.0.2.105 64634 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:18:36.529956 2.963110 tcp 10.0.2.105 64635 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:45.398400 0.000000 tcp 10.0.2.105 64635 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:51.305350 2.959915 tcp 10.0.2.105 64636 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:18:55.735609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:19:00.169664 0.000000 tcp 10.0.2.105 64636 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:19:04.781094 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:19:06.077033 4.611190 tcp 10.0.2.105 64637 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:19:10.688514 2.972282 tcp 10.0.2.105 64638 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:19:19.574367 0.000000 tcp 10.0.2.105 64638 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:24:21.069749 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:24:21.069936 2.957388 tcp 10.0.2.105 64639 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:24:29.951417 0.000000 tcp 10.0.2.105 64639 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:24:34.606766 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:24:35.959188 0.061487 tcp 10.0.2.105 64640 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:36.020953 0.062209 tcp 10.0.2.105 64641 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:36.083420 0.158469 tcp 10.0.2.105 64642 -> 195.113.214.249 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:37.312801 2.954335 tcp 10.0.2.105 64643 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:24:46.176005 0.000000 tcp 10.0.2.105 64643 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:24:51.017012 0.061273 tcp 10.0.2.105 64644 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:51.078568 0.066477 tcp 10.0.2.105 64645 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:51.145326 0.161795 tcp 10.0.2.105 64646 -> 195.113.214.249 443 SRPA* 0 0 22 11416 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:51.307872 0.000000 udp 10.0.2.105 7010 -> 110.169.220.109 8909 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:24:52.090530 0.148120 tcp 10.0.2.105 64647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:52.238912 0.070563 tcp 10.0.2.105 64648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:52.309840 0.164456 tcp 10.0.2.105 64649 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:52.826448 3.364715 tcp 10.0.2.105 64650 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:54.894526 2.963616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 02:24:55.241803 0.066843 tcp 10.0.2.105 64651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:55.308943 0.065425 tcp 10.0.2.105 64652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:55.374676 0.168797 tcp 10.0.2.105 64653 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:24:56.191456 2.951704 tcp 10.0.2.105 64654 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:01.802586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:25:05.062028 0.000000 tcp 10.0.2.105 64654 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:07.170959 0.067574 tcp 10.0.2.105 64655 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:07.238366 0.064627 tcp 10.0.2.105 64656 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:07.303299 0.166757 tcp 10.0.2.105 64657 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:07.470716 0.183113 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:07.654218 0.103969 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:07.758652 0.057521 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:07.861793 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:25:09.685755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:25:10.970825 0.065283 tcp 10.0.2.105 64658 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:11.036504 0.079222 tcp 10.0.2.105 64659 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:11.116042 0.168692 tcp 10.0.2.105 64660 -> 195.113.214.249 443 SRPA* 0 0 42 23044 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:11.314174 2.940994 tcp 10.0.2.105 64661 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:20.169100 0.000000 tcp 10.0.2.105 64661 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:25.455935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:25:26.094457 2.956632 tcp 10.0.2.105 64662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:26.530931 0.067008 tcp 10.0.2.105 64663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:26.598281 0.062410 tcp 10.0.2.105 64664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:26.661003 0.170202 tcp 10.0.2.105 64665 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:26.831713 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:25:34.960675 0.000000 tcp 10.0.2.105 64662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:40.873361 0.374243 tcp 10.0.2.105 64666 -> 46.48.223.67 15494 SPA_* 0 0 9 1156 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:42.510304 0.064236 tcp 10.0.2.105 64667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:42.574839 0.061956 tcp 10.0.2.105 64668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:42.637122 0.157985 tcp 10.0.2.105 64669 -> 195.113.214.249 443 SRPA* 0 0 50 28958 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:42.795780 0.175590 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:42.971764 0.321489 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:43.293683 0.057356 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:43.351531 0.164456 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:43.516571 0.160384 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:43.677353 0.213764 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:43.891493 0.151071 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:44.043037 0.168912 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:44.212588 0.441706 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:44.654713 0.083555 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:44.738696 0.173316 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:44.912504 0.432950 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:45.346079 0.181431 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 206 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:45.527961 0.083730 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:45.612060 0.157843 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:45.770305 0.170985 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:45.941751 0.059682 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:46.001837 0.632543 udp 10.0.2.105 7010 <-> 112.210.73.25 5414 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:46.634828 0.202787 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:25:46.837999 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:25:47.414301 0.000373 tcp 10.0.2.105 64666 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:25:47.414913 2.957125 tcp 10.0.2.105 64670 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:56.275259 0.000000 tcp 10.0.2.105 64670 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:25:56.988866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:26:02.510807 0.068361 tcp 10.0.2.105 64671 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:02.579469 0.065355 tcp 10.0.2.105 64672 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:02.645103 0.163117 tcp 10.0.2.105 64673 -> 195.113.214.249 443 SRPA* 0 0 42 24342 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:02.808888 0.331827 udp 10.0.2.105 7010 <-> 49.144.103.145 2222 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:03.141110 0.122243 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:03.263732 0.188959 udp 10.0.2.105 7010 <-> 107.18.131.167 9968 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:03.453129 0.243369 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:03.696924 0.030255 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:03.727528 0.297276 udp 10.0.2.105 7010 <-> 116.202.78.100 1855 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:04.025166 0.055064 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:04.080675 0.000000 udp 10.0.2.105 7010 -> 115.184.78.169 1146 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:26:18.993807 0.062912 tcp 10.0.2.105 64674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:19.057049 0.066960 tcp 10.0.2.105 64675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:19.124381 0.165522 tcp 10.0.2.105 64676 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:19.290480 0.224836 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:19.516804 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:26:36.384700 0.071928 tcp 10.0.2.105 64677 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:36.456940 0.066034 tcp 10.0.2.105 64678 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:36.523299 0.155219 tcp 10.0.2.105 64679 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:26:36.679096 0.376333 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:26:37.055825 0.249935 udp 10.0.2.105 7010 <-> 115.240.29.97 5573 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:31:55.638941 2.950281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 02:32:02.542873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:32:10.428769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:32:26.193749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:32:57.735529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:38:56.450537 2.959045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 02:39:03.350966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:39:11.229855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:39:27.001457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:39:58.543895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:45:57.256058 2.958123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 02:46:04.158712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:46:12.040828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:46:27.800305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:46:59.309517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:53:03.296038 3.007610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 02:53:10.303880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:53:18.304709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:53:34.308075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:54:06.314096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 02:56:41.868026 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 02:56:41.868176 0.187433 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:56:42.027200 0.000000 udp 10.0.2.105 7010 -> 162.210.27.16 3261 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:56:43.660741 2.993904 tcp 10.0.2.105 64680 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:56:52.653257 0.000000 tcp 10.0.2.105 64680 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:56:58.663669 0.069885 tcp 10.0.2.105 64681 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:58.733889 0.063852 tcp 10.0.2.105 64682 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:58.797570 0.173052 tcp 10.0.2.105 64683 -> 195.113.214.249 443 SRPA* 0 0 28 14076 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:59.182990 0.061088 tcp 10.0.2.105 64684 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:59.244470 0.064593 tcp 10.0.2.105 64685 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:59.309363 0.253963 tcp 10.0.2.105 64686 -> 195.113.214.249 443 SRPA* 0 0 73 78220 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:56:59.357427 2.999874 tcp 10.0.2.105 64687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:56:59.563895 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:57:08.358479 0.000000 tcp 10.0.2.105 64687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 02:57:17.079341 0.066311 tcp 10.0.2.105 64688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:17.145939 0.061632 tcp 10.0.2.105 64689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:17.207876 0.168458 tcp 10.0.2.105 64690 -> 195.113.214.249 443 SRPA* 0 0 26 13498 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:17.376869 0.000000 udp 10.0.2.105 7010 -> 115.184.78.169 1146 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:57:35.900916 0.067686 tcp 10.0.2.105 64691 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:35.969025 0.066591 tcp 10.0.2.105 64692 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:36.035924 0.160993 tcp 10.0.2.105 64693 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:36.197490 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:57:51.458467 0.068063 tcp 10.0.2.105 64694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:51.526873 0.065304 tcp 10.0.2.105 64695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:51.592557 0.167132 tcp 10.0.2.105 64696 -> 195.113.214.249 443 SRPA* 0 0 25 14866 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:57:51.760449 0.126481 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:51.866506 0.187203 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:52.322099 0.088965 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:52.373998 0.183574 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:52.551797 0.076110 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:52.692865 0.484043 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:53.146003 0.308316 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:53.417152 0.186613 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2588 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:53.737615 0.173043 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:53.903167 0.172963 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:54.402251 0.174761 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:54.765006 0.176365 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:54.937995 0.149057 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:55.059797 0.103615 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:55.153824 0.442524 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:55.574324 0.131561 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1658 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:55.675566 0.189201 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:55.861168 0.209922 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:56.037079 0.184688 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:56.282122 0.075037 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:57:56.342148 0.000000 udp 10.0.2.105 7010 -> 112.210.73.25 5414 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:58:13.154409 0.064448 tcp 10.0.2.105 64697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:13.219113 0.064098 tcp 10.0.2.105 64698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:13.283568 0.170880 tcp 10.0.2.105 64699 -> 195.113.214.249 443 SRPA* 0 0 24 14656 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:13.455104 0.215732 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:13.663251 0.393287 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:13.924689 0.045367 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:13.955255 0.415788 udp 10.0.2.105 7010 <-> 116.202.78.100 1855 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:14.223257 0.000000 udp 10.0.2.105 7010 -> 107.18.131.167 9968 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 02:58:31.326007 0.063806 tcp 10.0.2.105 64700 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:31.389643 0.064616 tcp 10.0.2.105 64701 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:31.454566 0.166065 tcp 10.0.2.105 64702 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:31.621283 0.176860 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:31.777675 0.381318 udp 10.0.2.105 7010 <-> 49.144.103.145 2222 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:32.141580 0.057723 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:32.298996 0.244732 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:32.819008 0.376796 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:33.192379 0.350612 udp 10.0.2.105 7010 <-> 115.240.29.97 5573 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/15 02:58:48.761202 0.066847 tcp 10.0.2.105 64703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:48.828381 0.065234 tcp 10.0.2.105 64704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 02:58:48.894005 0.174109 tcp 10.0.2.105 64705 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:00:10.320651 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:00:17.331688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:00:25.328993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:00:41.332452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:01:13.338109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:02:14.356125 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:02:14.356422 3.007029 tcp 10.0.2.105 64706 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:02:23.358774 0.000000 tcp 10.0.2.105 64706 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:02:29.358966 0.063932 tcp 10.0.2.105 64707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:29.423166 0.063129 tcp 10.0.2.105 64708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:29.486543 0.169860 tcp 10.0.2.105 64709 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:29.830598 3.001663 tcp 10.0.2.105 64710 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:02:38.830396 0.000000 tcp 10.0.2.105 64710 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:02:44.832033 0.658171 tcp 10.0.2.105 64711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:45.490022 0.065527 tcp 10.0.2.105 64712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:45.555816 0.161689 tcp 10.0.2.105 64713 -> 195.113.214.249 443 SRPA* 0 0 41 31962 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:02:45.854463 2.961012 tcp 10.0.2.105 64714 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:02:54.900428 0.000000 tcp 10.0.2.105 64714 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:00.829072 0.061953 tcp 10.0.2.105 64715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:03:00.891299 0.067996 tcp 10.0.2.105 64716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:03:00.959593 0.202105 tcp 10.0.2.105 64717 -> 195.113.214.249 443 SRPA* 0 0 45 33376 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:03:01.514582 2.966320 tcp 10.0.2.105 64718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:10.411324 0.000000 tcp 10.0.2.105 64718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:16.344474 2.969106 tcp 10.0.2.105 64719 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:25.304925 0.000000 tcp 10.0.2.105 64719 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:30.170654 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:03:31.236504 2.975853 tcp 10.0.2.105 64720 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:03:40.136288 0.000000 tcp 10.0.2.105 64720 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:07:19.347187 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:07:26.354497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:07:34.366215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:07:50.369145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:08:22.375071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:08:45.969623 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:08:45.969790 3.002848 tcp 10.0.2.105 64721 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:08:54.981758 0.000000 tcp 10.0.2.105 64721 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:00.972598 0.066461 tcp 10.0.2.105 64722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:01.039358 0.060837 tcp 10.0.2.105 64723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:01.100129 0.164350 tcp 10.0.2.105 64724 -> 195.113.214.249 443 SRPA* 0 0 43 23406 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:01.421091 2.994425 tcp 10.0.2.105 64725 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:10.413621 0.000000 tcp 10.0.2.105 64725 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:16.413426 0.065816 tcp 10.0.2.105 64726 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:16.479509 0.074461 tcp 10.0.2.105 64727 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:16.554346 0.173590 tcp 10.0.2.105 64728 -> 195.113.214.249 443 SRPA* 0 0 27 13148 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:16.749207 2.998293 tcp 10.0.2.105 64729 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:25.745866 0.000000 tcp 10.0.2.105 64729 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:31.745472 0.070515 tcp 10.0.2.105 64730 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:31.815846 0.061168 tcp 10.0.2.105 64731 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:31.877308 0.168218 tcp 10.0.2.105 64732 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:09:32.217139 3.002592 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:41.218399 0.000000 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:47.217318 3.003864 tcp 10.0.2.105 64734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:09:56.219918 0.000000 tcp 10.0.2.105 64734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:10:00.886671 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:10:02.218855 3.003862 tcp 10.0.2.105 64735 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:10:11.231705 0.000000 tcp 10.0.2.105 64735 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:14:26.381260 3.001477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:14:33.388563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:14:41.390054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:14:57.392717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:15:17.222274 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:15:17.222400 2.993306 tcp 10.0.2.105 64736 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:15:26.214520 0.000000 tcp 10.0.2.105 64736 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:15:29.399426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:15:32.225461 0.075664 tcp 10.0.2.105 64737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:32.301424 0.063539 tcp 10.0.2.105 64738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:32.365233 0.158765 tcp 10.0.2.105 64739 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:32.544890 3.003111 tcp 10.0.2.105 64740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:15:41.546674 0.000000 tcp 10.0.2.105 64740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:15:47.545704 0.063893 tcp 10.0.2.105 64741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:47.609885 0.062593 tcp 10.0.2.105 64742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:47.672766 0.170682 tcp 10.0.2.105 64743 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:15:47.956479 3.003403 tcp 10.0.2.105 64744 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:15:56.958847 0.000000 tcp 10.0.2.105 64744 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:02.958411 0.064896 tcp 10.0.2.105 64745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:16:03.023151 0.065662 tcp 10.0.2.105 64746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:16:03.088726 0.160514 tcp 10.0.2.105 64747 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:16:03.449182 3.003037 tcp 10.0.2.105 64748 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:12.450658 0.000000 tcp 10.0.2.105 64748 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:18.455180 2.990000 tcp 10.0.2.105 64749 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:27.452329 0.000000 tcp 10.0.2.105 64749 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:32.389494 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:16:33.451042 2.995952 tcp 10.0.2.105 64750 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:16:42.443679 0.000000 tcp 10.0.2.105 64750 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:21:33.414943 3.002061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:21:40.422386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:21:48.423955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:21:48.454563 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:21:48.454748 3.003641 tcp 10.0.2.105 64751 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:21:57.457124 0.000000 tcp 10.0.2.105 64751 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:03.463865 0.066566 tcp 10.0.2.105 64752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:03.530741 0.070386 tcp 10.0.2.105 64753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:03.601417 0.162521 tcp 10.0.2.105 64754 -> 195.113.214.249 443 SRPA* 0 0 49 25344 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:03.945848 3.408069 tcp 10.0.2.105 64755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:04.432077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:22:13.293672 0.000000 tcp 10.0.2.105 64755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:19.236373 0.062952 tcp 10.0.2.105 64756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:19.299667 0.063520 tcp 10.0.2.105 64757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:19.363446 0.172001 tcp 10.0.2.105 64758 -> 195.113.214.249 443 SRPA* 0 0 36 23998 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:19.766954 2.974425 tcp 10.0.2.105 64759 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:28.693736 0.000000 tcp 10.0.2.105 64759 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:34.623774 0.075362 tcp 10.0.2.105 64760 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:34.699481 0.061236 tcp 10.0.2.105 64761 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:34.761002 0.153967 tcp 10.0.2.105 64762 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:22:35.385672 2.964758 tcp 10.0.2.105 64763 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:36.578293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:22:44.292123 0.000000 tcp 10.0.2.105 64763 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:50.232825 3.004083 tcp 10.0.2.105 64764 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:22:59.235955 0.000000 tcp 10.0.2.105 64764 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:23:03.882276 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:23:05.234863 3.004063 tcp 10.0.2.105 64765 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:23:14.237432 0.000000 tcp 10.0.2.105 64765 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:28:40.449741 3.100814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 03:28:47.522632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:28:55.469589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:29:11.470942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:29:13.925088 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:29:13.925321 0.000000 udp 10.0.2.105 7010 -> 112.210.73.25 5414 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:29:30.119801 0.065064 tcp 10.0.2.105 64766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:30.185109 0.067592 tcp 10.0.2.105 64767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:30.253005 0.159078 tcp 10.0.2.105 64768 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:30.412859 0.000000 udp 10.0.2.105 7010 -> 107.18.131.167 9968 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:29:43.477267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:29:48.334442 0.069447 tcp 10.0.2.105 64769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:48.404202 0.064150 tcp 10.0.2.105 64770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:48.468371 0.155116 tcp 10.0.2.105 64771 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:29:48.624068 0.000000 udp 10.0.2.105 7010 -> 115.240.29.97 5573 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:30:06.220093 0.062321 tcp 10.0.2.105 64772 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:06.282733 0.061263 tcp 10.0.2.105 64773 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:06.344276 0.163621 tcp 10.0.2.105 64774 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:06.508605 0.187178 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:06.669784 0.123581 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:07.145015 0.186154 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:07.545334 0.079365 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:07.589241 0.277755 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:07.848616 0.182812 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:08.026544 0.260008 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:08.320372 0.395637 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:08.687598 0.184198 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:08.994103 0.175262 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:09.162538 0.171693 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:09.330561 0.176806 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:09.510271 0.614249 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:10.090998 0.182207 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:10.430351 0.099697 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:10.624042 0.449261 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.052045 0.132417 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.164756 0.183480 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.371087 0.187482 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.555018 0.210134 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.868323 0.074308 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:11.927560 0.219447 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:12.551961 0.000000 udp 10.0.2.105 7010 -> 116.202.78.100 1855 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:30:20.250353 2.996340 tcp 10.0.2.105 64775 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:30:29.254828 0.000000 tcp 10.0.2.105 64775 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:30:31.086131 0.065987 tcp 10.0.2.105 64776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:31.152276 0.068381 tcp 10.0.2.105 64777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:31.220953 0.161843 tcp 10.0.2.105 64778 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:31.383468 0.045109 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:31.412795 0.368711 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:31.651428 0.110738 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:31.866301 0.057015 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:32.028751 0.000000 udp 10.0.2.105 7010 -> 49.144.103.145 2222 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:30:35.253131 0.062975 tcp 10.0.2.105 64779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:35.316407 0.064517 tcp 10.0.2.105 64780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:35.381267 0.162223 tcp 10.0.2.105 64781 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:36.011670 2.994669 tcp 10.0.2.105 64782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:30:45.005342 0.000000 tcp 10.0.2.105 64782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:30:50.463943 0.062077 tcp 10.0.2.105 64783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:50.526297 0.061030 tcp 10.0.2.105 64784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:50.587693 0.156869 tcp 10.0.2.105 64785 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:50.745076 0.230740 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 1963 flow=From-Botnet-V2-UDP-Established 1970/02/15 03:30:51.004358 0.060285 tcp 10.0.2.105 64786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:51.064987 0.066461 tcp 10.0.2.105 64787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:51.131776 0.155566 tcp 10.0.2.105 64788 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:30:51.310528 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 03:30:51.329037 3.000824 tcp 10.0.2.105 64789 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:00.327290 0.000000 tcp 10.0.2.105 64789 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:06.326579 0.065339 tcp 10.0.2.105 64790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:06.392169 0.066939 tcp 10.0.2.105 64791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:06.459391 0.162245 tcp 10.0.2.105 64792 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:07.101480 3.000047 tcp 10.0.2.105 64793 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:07.837946 0.069782 tcp 10.0.2.105 64794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:07.908000 0.062525 tcp 10.0.2.105 64795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:07.970776 0.165293 tcp 10.0.2.105 64796 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:31:16.100180 0.000000 tcp 10.0.2.105 64793 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:22.098978 3.004141 tcp 10.0.2.105 64797 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:31.111607 0.000000 tcp 10.0.2.105 64797 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:35.893006 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:31:37.101319 2.992701 tcp 10.0.2.105 64798 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:31:46.096715 0.000000 tcp 10.0.2.105 64798 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:35:47.482760 3.001952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:35:54.490659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:36:02.491882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:36:18.495137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:36:50.501160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:36:52.104042 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:36:52.104151 3.003334 tcp 10.0.2.105 64799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:01.105842 0.000000 tcp 10.0.2.105 64799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:07.106660 0.068139 tcp 10.0.2.105 64800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:07.175154 0.071571 tcp 10.0.2.105 64801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:07.247093 0.164911 tcp 10.0.2.105 64802 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:07.432009 2.997559 tcp 10.0.2.105 64803 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:16.428033 0.000000 tcp 10.0.2.105 64803 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:22.431227 0.061491 tcp 10.0.2.105 64804 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:22.493056 0.069932 tcp 10.0.2.105 64805 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:22.563272 0.165813 tcp 10.0.2.105 64806 -> 195.113.214.249 443 SRPA* 0 0 41 21452 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:23.411022 3.007741 tcp 10.0.2.105 64807 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:32.411135 0.000000 tcp 10.0.2.105 64807 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:38.410428 0.060872 tcp 10.0.2.105 64808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:38.471695 0.062623 tcp 10.0.2.105 64809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:38.534654 0.161813 tcp 10.0.2.105 64810 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:37:38.919660 2.995096 tcp 10.0.2.105 64811 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:47.923348 0.000000 tcp 10.0.2.105 64811 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:37:53.912067 2.994163 tcp 10.0.2.105 64812 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:38:02.905046 0.000000 tcp 10.0.2.105 64812 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:38:07.882119 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:38:08.913645 3.004202 tcp 10.0.2.105 64813 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:38:17.916718 0.000000 tcp 10.0.2.105 64813 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:42:54.506433 3.002436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:43:01.514624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:43:09.515931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:43:23.917023 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:43:23.917225 3.003705 tcp 10.0.2.105 64814 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:43:25.518928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:43:32.919703 0.000000 tcp 10.0.2.105 64814 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:43:38.920189 0.063049 tcp 10.0.2.105 64815 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:38.983553 0.066744 tcp 10.0.2.105 64816 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:39.050581 0.335883 tcp 10.0.2.105 64817 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:39.542440 2.992100 tcp 10.0.2.105 64818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:43:48.542008 0.000000 tcp 10.0.2.105 64818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:43:54.541398 0.067384 tcp 10.0.2.105 64819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:54.609066 0.084455 tcp 10.0.2.105 64820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:54.693814 0.158515 tcp 10.0.2.105 64821 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:43:54.938652 2.996506 tcp 10.0.2.105 64822 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:43:57.524735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:44:03.934058 0.000000 tcp 10.0.2.105 64822 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:09.933392 0.062096 tcp 10.0.2.105 64823 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:44:09.995805 0.068380 tcp 10.0.2.105 64824 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:44:10.064093 0.181996 tcp 10.0.2.105 64825 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:44:10.532693 2.998410 tcp 10.0.2.105 64826 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:19.526267 0.000000 tcp 10.0.2.105 64826 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:25.525606 3.003831 tcp 10.0.2.105 64827 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:34.528002 0.000000 tcp 10.0.2.105 64827 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:39.385006 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:44:40.527172 3.003633 tcp 10.0.2.105 64828 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:44:49.529654 0.000000 tcp 10.0.2.105 64828 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:49:55.530213 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:49:55.530403 2.993333 tcp 10.0.2.105 64829 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:04.532693 0.000000 tcp 10.0.2.105 64829 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:10.537069 0.069342 tcp 10.0.2.105 64830 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:10.606707 0.071478 tcp 10.0.2.105 64831 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:10.678022 0.168163 tcp 10.0.2.105 64832 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:10.919424 2.996550 tcp 10.0.2.105 64833 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:19.914581 0.000000 tcp 10.0.2.105 64833 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:25.913938 0.062144 tcp 10.0.2.105 64834 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:25.976441 0.061407 tcp 10.0.2.105 64835 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:26.038168 0.505537 tcp 10.0.2.105 64836 -> 195.113.214.249 443 SRPA* 0 0 25 13406 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:26.667076 3.001605 tcp 10.0.2.105 64837 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:35.667558 0.000000 tcp 10.0.2.105 64837 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:41.666417 0.062390 tcp 10.0.2.105 64838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:41.729115 0.067061 tcp 10.0.2.105 64839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:41.796528 0.155934 tcp 10.0.2.105 64840 -> 195.113.214.249 443 SRPA* 0 0 26 13342 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:50:42.101818 2.999212 tcp 10.0.2.105 64841 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:51.099775 0.000000 tcp 10.0.2.105 64841 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:50:57.098220 3.005224 tcp 10.0.2.105 64842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:51:06.103189 0.000000 tcp 10.0.2.105 64842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:51:10.887539 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:51:12.100073 2.999312 tcp 10.0.2.105 64843 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:51:21.104741 0.000000 tcp 10.0.2.105 64843 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:55:37.534604 3.001087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 03:55:44.541594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:55:52.543691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:56:08.545768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:56:27.102990 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 03:56:27.103090 3.003908 tcp 10.0.2.105 64844 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:56:36.105578 0.000000 tcp 10.0.2.105 64844 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:56:40.552125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 03:56:42.106462 0.068305 tcp 10.0.2.105 64845 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:56:42.175042 0.063613 tcp 10.0.2.105 64846 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:56:42.238921 0.168539 tcp 10.0.2.105 64847 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 03:56:42.746286 3.008168 tcp 10.0.2.105 64848 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 03:56:51.749568 0.000000 tcp 10.0.2.105 64848 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:01:36.878275 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:01:36.878458 0.000000 udp 10.0.2.105 7010 -> 116.202.78.100 1855 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:01:53.946273 0.063740 tcp 10.0.2.105 64849 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:01:54.010269 0.064631 tcp 10.0.2.105 64850 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:01:54.075219 0.167025 tcp 10.0.2.105 64851 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:01:54.242796 0.000000 udp 10.0.2.105 7010 -> 49.144.103.145 2222 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:02:12.169394 0.062659 tcp 10.0.2.105 64852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:12.232530 0.065699 tcp 10.0.2.105 64853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:12.298518 0.155298 tcp 10.0.2.105 64854 -> 195.113.214.249 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:12.454825 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:02:29.534462 0.067024 tcp 10.0.2.105 64855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:29.601799 0.061142 tcp 10.0.2.105 64856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:29.663207 0.162361 tcp 10.0.2.105 64857 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:29.826129 1.167267 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:30.965972 0.124566 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:31.179492 0.181542 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 1988 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:31.356622 0.250885 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:31.586425 0.188537 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:31.836431 0.290911 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:32.111090 0.088985 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:32.418801 0.670440 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:33.067491 0.178080 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:33.334576 0.182801 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:33.492941 0.175192 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:33.809383 0.177867 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:33.984461 0.114655 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:34.066034 0.242393 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:34.403079 0.202639 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:34.556704 0.096302 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:34.873355 0.444107 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:35.295116 0.186997 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:35.595062 0.188979 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:35.780323 0.207796 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:35.953685 0.075384 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.057711 0.214995 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.264926 0.047742 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.411841 0.107368 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.499991 0.394509 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.758568 0.055533 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:02:36.916868 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:02:42.753179 3.003970 tcp 10.0.2.105 64858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:02:44.558398 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 04:02:51.565424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:02:51.755586 0.000000 tcp 10.0.2.105 64858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:02:53.047950 0.130512 tcp 10.0.2.105 64859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:53.178761 0.063169 tcp 10.0.2.105 64860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:53.242246 0.187126 tcp 10.0.2.105 64861 -> 195.113.214.249 443 SRPA* 0 0 34 17906 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:57.755199 0.064205 tcp 10.0.2.105 64862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:57.819696 0.065200 tcp 10.0.2.105 64863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:57.885192 0.157920 tcp 10.0.2.105 64864 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:02:58.166147 3.002996 tcp 10.0.2.105 64865 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:02:59.566834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:03:07.167957 0.000000 tcp 10.0.2.105 64865 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:13.167066 0.065862 tcp 10.0.2.105 64866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:13.233206 0.062055 tcp 10.0.2.105 64867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:13.295564 0.190045 tcp 10.0.2.105 64868 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:13.593879 2.997871 tcp 10.0.2.105 64869 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:15.571616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:03:22.590063 0.000000 tcp 10.0.2.105 64869 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:28.590303 0.062695 tcp 10.0.2.105 64870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:28.653266 0.065276 tcp 10.0.2.105 64871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:28.718799 0.197512 tcp 10.0.2.105 64872 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:03:29.315447 2.998493 tcp 10.0.2.105 64873 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:38.322550 0.000000 tcp 10.0.2.105 64873 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:44.311639 3.151976 tcp 10.0.2.105 64874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:47.732013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:03:53.408560 0.000000 tcp 10.0.2.105 64874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:03:57.950895 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:03:59.370433 2.970113 tcp 10.0.2.105 64875 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:04:08.325895 0.000000 tcp 10.0.2.105 64875 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:14.326371 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:09:14.326565 3.003331 tcp 10.0.2.105 64876 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:23.328624 0.000000 tcp 10.0.2.105 64876 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:29.329282 0.069938 tcp 10.0.2.105 64877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:29.399505 0.067245 tcp 10.0.2.105 64878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:29.467242 0.155589 tcp 10.0.2.105 64879 -> 195.113.214.249 443 SRPA* 0 0 27 14022 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:29.894874 3.002774 tcp 10.0.2.105 64880 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:38.893003 0.000000 tcp 10.0.2.105 64880 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:44.890507 0.068149 tcp 10.0.2.105 64881 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:44.958909 0.071367 tcp 10.0.2.105 64882 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:45.030558 0.157663 tcp 10.0.2.105 64883 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:09:45.549465 2.995311 tcp 10.0.2.105 64884 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:09:54.543528 0.000000 tcp 10.0.2.105 64884 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:00.542494 0.061057 tcp 10.0.2.105 64885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:10:00.603793 0.066167 tcp 10.0.2.105 64886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:10:00.669894 0.171133 tcp 10.0.2.105 64887 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:10:00.992138 2.995167 tcp 10.0.2.105 64888 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:09.985726 0.000000 tcp 10.0.2.105 64888 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:15.585936 3.002330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 04:10:15.984788 3.006411 tcp 10.0.2.105 64889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:22.593960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:10:24.987517 0.000000 tcp 10.0.2.105 64889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:29.884395 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:10:30.595425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:10:30.985474 3.004813 tcp 10.0.2.105 64890 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:39.988783 0.000000 tcp 10.0.2.105 64890 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:10:46.598733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:11:18.604546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:15:45.990356 0.000218 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:15:45.990679 3.002360 tcp 10.0.2.105 64891 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:15:55.001623 0.000000 tcp 10.0.2.105 64891 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:00.992502 0.067525 tcp 10.0.2.105 64892 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:01.060470 0.063890 tcp 10.0.2.105 64893 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:01.124281 0.166818 tcp 10.0.2.105 64894 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:01.386187 2.999269 tcp 10.0.2.105 64895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:10.383734 0.000000 tcp 10.0.2.105 64895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:16.383241 0.063747 tcp 10.0.2.105 64896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:16.447239 0.064851 tcp 10.0.2.105 64897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:16.512452 0.162416 tcp 10.0.2.105 64898 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:16.784211 3.002953 tcp 10.0.2.105 64899 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:25.785792 0.000000 tcp 10.0.2.105 64899 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:31.785065 0.063562 tcp 10.0.2.105 64900 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:31.848926 0.066289 tcp 10.0.2.105 64901 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:31.915544 0.175999 tcp 10.0.2.105 64902 -> 195.113.214.249 443 SRPA* 0 0 25 13444 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:16:32.186733 3.002784 tcp 10.0.2.105 64903 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:41.199088 0.000000 tcp 10.0.2.105 64903 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:47.189430 3.001577 tcp 10.0.2.105 64904 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:16:56.189878 0.000000 tcp 10.0.2.105 64904 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:17:00.890043 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:17:02.193118 2.999441 tcp 10.0.2.105 64905 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:17:11.191369 0.000000 tcp 10.0.2.105 64905 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:17:23.710177 2.968993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 04:17:30.632454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:17:38.539210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:17:54.356169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:18:26.502790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:22:17.192010 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:22:17.192194 2.993536 tcp 10.0.2.105 64906 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:22:26.184622 0.000000 tcp 10.0.2.105 64906 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:22:32.194193 0.065742 tcp 10.0.2.105 64907 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:32.260168 0.062706 tcp 10.0.2.105 64908 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:32.323185 0.174592 tcp 10.0.2.105 64909 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:32.683014 3.004955 tcp 10.0.2.105 64910 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:22:41.686094 0.000000 tcp 10.0.2.105 64910 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:22:47.675751 0.335130 tcp 10.0.2.105 64911 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:48.362077 0.061633 tcp 10.0.2.105 64912 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:48.424033 0.163802 tcp 10.0.2.105 64913 -> 195.113.214.249 443 SRPA* 0 0 22 12874 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:22:49.186667 2.984838 tcp 10.0.2.105 64914 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:22:58.113858 0.000000 tcp 10.0.2.105 64914 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:04.046942 0.063984 tcp 10.0.2.105 64915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:23:04.111221 0.063010 tcp 10.0.2.105 64916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:23:04.174556 0.231496 tcp 10.0.2.105 64917 -> 195.113.214.249 443 SRPA* 0 0 23 13768 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:23:04.563138 2.965949 tcp 10.0.2.105 64918 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:13.484885 0.000000 tcp 10.0.2.105 64918 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:19.451059 2.994045 tcp 10.0.2.105 64919 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:28.443428 0.000000 tcp 10.0.2.105 64919 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:33.393569 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:23:34.453718 2.992896 tcp 10.0.2.105 64920 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:23:43.445247 0.000000 tcp 10.0.2.105 64920 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:24:29.644459 3.001705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 04:24:36.651711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:24:44.653231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:25:00.656238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:25:32.662868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:31:36.669025 4.119797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/15 04:31:42.767090 3.942830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/15 04:31:54.603900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:32:10.391031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:32:41.952467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:33:11.969341 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 04:33:11.969495 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:33:29.139026 0.074549 tcp 10.0.2.105 64921 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:29.213860 0.070070 tcp 10.0.2.105 64922 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:29.284422 0.153653 tcp 10.0.2.105 64923 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:29.438691 0.182506 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:29.616779 0.250313 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:29.867719 0.187822 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:30.024051 0.121997 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:30.306253 0.075601 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:30.588201 0.086175 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:30.637028 0.376459 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:30.984588 0.173788 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:31.151215 0.191512 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:31.339298 0.175665 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:31.511389 0.892036 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:32.370834 0.185270 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:32.567462 0.174720 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:32.739041 0.175090 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:33.038547 0.242753 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1874 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:33.523041 0.094227 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:33.608178 0.186296 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:33.769219 0.187835 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:33.952504 0.208794 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:34.132962 0.078123 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:34.196445 0.447915 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:34.620075 0.433254 udp 10.0.2.105 7010 <-> 14.98.122.225 6114 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:34.886245 0.057731 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:35.026927 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:33:36.012315 2.965213 tcp 10.0.2.105 64924 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:33:44.895945 0.000000 tcp 10.0.2.105 64924 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 04:33:50.711096 0.064418 tcp 10.0.2.105 64925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:50.775816 0.061885 tcp 10.0.2.105 64926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:50.809763 0.062682 tcp 10.0.2.105 64927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:50.837952 0.167117 tcp 10.0.2.105 64928 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:50.872704 0.061488 tcp 10.0.2.105 64929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:50.934486 0.334181 tcp 10.0.2.105 64930 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:33:51.005651 0.046482 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/15 04:33:51.036304 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 04:33:51.302174 0.988719 tcp 10.0.2.105 64931 -> 31.192.24.67 3527 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:34:06.249188 0.062772 tcp 10.0.2.105 64932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:34:06.312348 0.061413 tcp 10.0.2.105 64933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:34:06.374050 0.167924 tcp 10.0.2.105 64934 -> 195.113.214.249 443 SRPA* 0 0 41 21608 flow=From-Botnet-V2-TCP-Established 1970/02/15 04:38:43.703138 3.153288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 04:38:50.830388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:38:58.764632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:39:14.724017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:39:46.730443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:45:50.736196 3.001710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 04:45:57.743775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:46:05.745125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:46:21.748061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:46:53.754221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:57:05.766678 3.021951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 04:57:12.794109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:57:20.795582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:57:38.654383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 04:58:10.264048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:03:50.986756 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 05:03:50.986858 0.585948 tcp 10.0.2.105 64935 -> 31.192.24.67 3527 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:04:12.830821 3.001609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:04:13.699651 0.159472 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:13.859530 0.216893 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:14.068628 0.196760 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:14.260799 0.614514 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:14.841511 0.075868 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:14.934926 0.084285 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:14.983401 0.124553 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:15.089922 0.185707 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:15.249365 0.176701 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:15.422228 0.416694 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:15.818842 0.173341 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:15.984300 0.188414 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.169621 0.113151 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.249667 0.181356 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.409006 0.175406 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.581235 0.095293 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.667139 0.133261 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.783571 0.179287 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2605 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:16.935965 0.182702 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:17.203168 0.442190 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:17.622339 0.000000 udp 10.0.2.105 7010 -> 14.98.122.225 6114 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 05:04:18.386752 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 05:04:19.838240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:04:27.839657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:04:34.130712 0.068116 tcp 10.0.2.105 64936 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:04:34.199166 0.062964 tcp 10.0.2.105 64937 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:04:34.262416 0.172784 tcp 10.0.2.105 64938 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:04:34.435866 0.072315 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:34.493916 0.190565 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:34.681258 0.206145 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:34.851924 0.056625 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:34.920704 0.046263 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:04:43.842697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:05:15.859087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:11:19.855609 3.000399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:11:26.862423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:11:34.863754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:11:50.866659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:12:24.105055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:18:27.900469 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:18:34.907601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:18:42.909067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:18:58.912902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:19:30.918554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:25:34.924465 3.001951 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:25:41.934679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:25:49.932776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:26:05.935574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:26:37.942030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:32:41.947357 3.002271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:32:48.955792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:32:56.957688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:33:12.960516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:33:44.965839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:33:51.576256 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 05:33:51.576449 0.810887 tcp 10.0.2.105 64939 -> 31.192.24.67 3527 FSPA* 0 0 14 1542 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:34:40.716376 0.000000 udp 10.0.2.105 7010 -> 14.98.122.225 6114 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 05:34:45.385866 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 05:34:58.944370 0.067721 tcp 10.0.2.105 64940 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:34:59.012350 0.063793 tcp 10.0.2.105 64941 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:34:59.076482 0.156059 tcp 10.0.2.105 64942 -> 195.113.214.249 443 SRPA* 0 0 40 33106 flow=From-Botnet-V2-TCP-Established 1970/02/15 05:34:59.233092 0.182025 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:34:59.410678 0.115355 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:34:59.659282 0.294195 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:00.071952 0.084497 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:00.119628 0.250063 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:00.447452 0.073980 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:00.502916 0.127056 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:00.758078 0.438788 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:01.169439 0.176488 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:01.342292 0.188494 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:01.959659 0.118446 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:02.043925 0.184280 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:02.207652 0.177709 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:02.569660 0.173014 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:02.734371 0.190770 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:02.922148 0.182315 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:03.082596 0.094688 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:03.206074 0.173768 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:03.882080 0.177496 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:04.035449 0.503711 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:04.517040 0.077191 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:04.743464 0.187493 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:04.927073 0.210787 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:05.102692 0.079724 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:35:05.326336 0.046806 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/15 05:39:48.979734 2.993548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 05:39:55.979509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:40:03.981705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:40:19.984122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:40:51.991188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:46:55.995301 3.002564 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:47:03.003516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:47:11.005068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:47:27.007945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:47:59.013972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:54:03.021403 3.000282 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 05:54:10.027672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:54:18.028933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:54:34.033117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 05:55:06.038153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:01:10.043720 3.004105 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 06:01:17.051362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:01:25.052906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:01:41.638627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:02:13.263684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:03:52.394961 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:03:52.395128 3.003973 tcp 10.0.2.105 64943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:01.397701 0.000000 tcp 10.0.2.105 64943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:07.398631 0.067173 tcp 10.0.2.105 64944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:07.466106 0.061888 tcp 10.0.2.105 64945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:07.528549 0.179491 tcp 10.0.2.105 64946 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:08.117974 3.006613 tcp 10.0.2.105 64947 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:17.119779 0.000000 tcp 10.0.2.105 64947 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:23.119721 0.067412 tcp 10.0.2.105 64948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:23.187445 0.063488 tcp 10.0.2.105 64949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:23.251264 0.175261 tcp 10.0.2.105 64950 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:23.513793 2.999894 tcp 10.0.2.105 64951 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:32.524082 0.000000 tcp 10.0.2.105 64951 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:38.512679 0.065300 tcp 10.0.2.105 64952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:38.578307 0.073516 tcp 10.0.2.105 64953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:38.652134 0.157771 tcp 10.0.2.105 64954 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:04:38.857824 2.998143 tcp 10.0.2.105 64955 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:47.854273 0.000000 tcp 10.0.2.105 64955 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:04:53.853289 3.004124 tcp 10.0.2.105 64956 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:02.855787 0.000000 tcp 10.0.2.105 64956 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:07.384877 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:05:08.854878 4.431525 tcp 10.0.2.105 64957 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:19.212685 0.000000 tcp 10.0.2.105 64957 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:22.054064 0.222434 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:22.267868 0.091595 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:22.649287 0.182407 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:22.880156 0.121052 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:23.436640 0.247760 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:24.173468 0.073462 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:24.698522 0.123535 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:24.889441 0.402454 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:25.450292 0.210836 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:26.084594 0.185243 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 1974 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:26.399145 0.190185 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:26.559046 0.113580 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:27.703152 0.178373 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:27.878710 0.174000 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:28.451919 0.192622 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:28.639772 0.187231 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:28.640118 2.960363 tcp 10.0.2.105 64958 -> 99.41.90.165 8158 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:32.605992 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:05:33.836090 0.103666 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:33.928846 0.140875 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:34.962439 0.192465 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:37.525750 0.000000 tcp 10.0.2.105 64958 -> 99.41.90.165 8158 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:05:38.051375 0.187122 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:40.648861 0.283186 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:43.511100 0.055919 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:44.877388 1.471921 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:46.324785 0.070903 udp 10.0.2.105 7010 <-> 109.152.47.5 7670 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:05:47.238745 0.064300 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:08:17.387217 3.280003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 06:08:24.625694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:08:32.538500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:08:48.347438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:09:20.115744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:10:23.877909 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:10:23.878015 3.003941 tcp 10.0.2.105 64959 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:10:32.880611 0.000000 tcp 10.0.2.105 64959 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:10:38.882693 0.061872 tcp 10.0.2.105 64960 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:38.944831 0.063859 tcp 10.0.2.105 64961 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:39.008980 0.170921 tcp 10.0.2.105 64962 -> 195.113.214.249 443 SRPA* 0 0 35 17960 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:39.356697 2.997576 tcp 10.0.2.105 64963 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:10:48.362896 0.000000 tcp 10.0.2.105 64963 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:10:54.353977 0.061893 tcp 10.0.2.105 64964 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:54.416214 0.066093 tcp 10.0.2.105 64965 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:54.482560 0.198760 tcp 10.0.2.105 64966 -> 195.113.214.249 443 SRPA* 0 0 41 21608 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:10:55.021295 2.994837 tcp 10.0.2.105 64967 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:04.015045 0.000000 tcp 10.0.2.105 64967 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:10.015214 0.061317 tcp 10.0.2.105 64968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:11:10.076816 0.062624 tcp 10.0.2.105 64969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:11:10.139698 0.167179 tcp 10.0.2.105 64970 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:11:10.329513 3.001301 tcp 10.0.2.105 64971 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:19.327247 0.000000 tcp 10.0.2.105 64971 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:25.326209 3.004730 tcp 10.0.2.105 64972 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:34.331531 0.000000 tcp 10.0.2.105 64972 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:38.885116 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:11:40.327677 3.294030 tcp 10.0.2.105 64973 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:11:49.565187 0.000000 tcp 10.0.2.105 64973 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:15:24.128283 2.996362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 06:15:31.129308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:15:39.130766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:15:55.134087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:16:27.140196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:16:55.341522 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:16:55.341761 2.993164 tcp 10.0.2.105 64974 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:04.333663 0.000000 tcp 10.0.2.105 64974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:10.343742 0.061704 tcp 10.0.2.105 64975 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:10.405697 0.061195 tcp 10.0.2.105 64976 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:10.467199 0.175423 tcp 10.0.2.105 64977 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:10.690812 2.996238 tcp 10.0.2.105 64978 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:19.685380 0.000000 tcp 10.0.2.105 64978 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:25.684921 0.083094 tcp 10.0.2.105 64979 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:25.768382 0.064316 tcp 10.0.2.105 64980 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:25.832586 0.163811 tcp 10.0.2.105 64981 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:26.091067 2.997852 tcp 10.0.2.105 64982 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:35.087761 0.000000 tcp 10.0.2.105 64982 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:41.087354 0.066415 tcp 10.0.2.105 64983 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:41.153967 0.061710 tcp 10.0.2.105 64984 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:41.216007 0.165847 tcp 10.0.2.105 64985 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:17:41.530154 3.001351 tcp 10.0.2.105 64986 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:50.532632 0.000000 tcp 10.0.2.105 64986 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:17:56.528443 3.003875 tcp 10.0.2.105 64987 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:18:05.541399 0.000000 tcp 10.0.2.105 64987 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:18:10.388453 0.045688 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:18:11.559768 3.445903 tcp 10.0.2.105 64988 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:18:20.941168 0.000000 tcp 10.0.2.105 64988 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:18:59.708221 0.000184 tcp 10.0.2.105 64987 -> 31.192.24.67 3527 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:19:04.386139 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:22:34.149894 3.003460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 06:22:41.157736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:22:49.159186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:23:05.162230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:23:26.543656 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:23:26.543756 3.003558 tcp 10.0.2.105 64989 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:23:35.545610 0.000000 tcp 10.0.2.105 64989 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:23:37.168272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:23:41.552848 0.061617 tcp 10.0.2.105 64990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:23:41.614755 0.065810 tcp 10.0.2.105 64991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:23:41.680833 0.199747 tcp 10.0.2.105 64992 -> 195.113.214.249 443 SRPA* 0 0 45 27210 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:23:41.993460 0.799186 tcp 10.0.2.105 64993 -> 31.192.24.67 3527 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:29:41.175488 3.000558 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 06:29:48.181912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:29:56.183350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:30:12.186045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:30:44.202178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:35:56.741978 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:35:56.742092 0.217487 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:56.952175 0.087307 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.073061 0.253594 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.292041 0.183245 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.470484 0.158360 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.633708 0.075533 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.690825 0.124600 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:57.795250 0.428548 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:58.196827 0.457337 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:58.626511 0.176977 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:58.800883 0.186886 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:58.964912 0.106833 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:59.147235 0.276462 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:59.414851 0.174998 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2514 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:59.581864 0.193421 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:35:59.582229 3.000320 tcp 10.0.2.105 64994 -> 99.135.106.151 9604 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:35:59.978055 0.189386 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:00.370621 0.103732 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:00.465407 0.106709 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 4 1361 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:00.830500 0.177080 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:01.090775 0.189185 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:01.275837 0.214314 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:01.454922 0.056408 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:01.769476 0.582474 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:02.328897 0.000000 udp 10.0.2.105 7010 -> 109.152.47.5 7670 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 06:36:08.578679 0.000000 tcp 10.0.2.105 64994 -> 99.135.106.151 9604 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:36:20.537711 0.061254 tcp 10.0.2.105 64995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:36:20.599206 0.063113 tcp 10.0.2.105 64996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:36:20.662570 0.164474 tcp 10.0.2.105 64997 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:36:20.827583 0.045331 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/15 06:36:20.858182 3.002551 tcp 10.0.2.105 64998 -> 79.219.121.215 3023 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:36:29.859080 0.000000 tcp 10.0.2.105 64998 -> 79.219.121.215 3023 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 06:36:37.035625 0.010463 udp 10.0.2.105 61056 <-> 8.8.8.8 53 CON 0 0 2 168 flow=From-Botnet-V2-DNS 1970/02/15 06:36:37.046600 0.009768 udp 10.0.2.105 58785 <-> 8.8.8.8 53 CON 0 0 2 180 flow=From-Botnet-V2-DNS 1970/02/15 06:36:48.207529 3.002396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 06:36:55.215746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:37:03.217238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:37:19.220446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:37:51.225687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:43:55.235568 2.997867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 06:44:02.239609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:44:10.375704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:44:26.254036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:44:58.260212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:53:42.795631 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 06:53:42.795722 0.628009 tcp 10.0.2.105 64999 -> 31.192.24.67 3527 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/15 06:56:04.270398 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 06:56:11.277646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:56:19.279495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:56:35.282315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 06:57:07.288934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:03:11.295398 3.000640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 07:03:18.301719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:03:26.303248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:03:42.306384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:04:14.322618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:06:39.512500 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:06:39.512616 0.000000 udp 10.0.2.105 7010 -> 109.152.47.5 7670 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:06:58.080444 0.065927 tcp 10.0.2.105 65000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:06:58.146693 0.063802 tcp 10.0.2.105 65001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:06:58.210788 0.162801 tcp 10.0.2.105 65002 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:06:58.374134 0.257205 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:58.593070 0.221606 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:59.088545 0.085124 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:59.132273 0.076319 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:59.437858 0.123750 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:59.543841 0.403150 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:06:59.917297 0.233404 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:00.873400 0.107032 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:01.004526 0.175470 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:01.893233 0.185319 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:02.958901 0.112610 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:03.037633 0.185820 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:03.358700 0.183460 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:03.600865 0.174432 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:03.767567 0.176929 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:03.767892 3.004831 tcp 10.0.2.105 65003 -> 99.135.106.151 9604 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 07:07:03.941385 0.187474 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:04.125923 0.175800 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:04.303984 0.189577 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:04.490329 0.096468 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:04.609580 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:07:12.769016 0.000000 tcp 10.0.2.105 65003 -> 99.135.106.151 9604 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 07:07:22.469227 0.060428 tcp 10.0.2.105 65004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:07:22.529969 0.062773 tcp 10.0.2.105 65005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:07:22.593112 0.161397 tcp 10.0.2.105 65006 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:07:22.755203 0.062824 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:22.843139 0.212516 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:23.021538 0.542511 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:23.541540 0.045244 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:24.153294 0.559474 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 5 1884 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:29.352923 0.465779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3144 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:29.781353 0.362632 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 8 3017 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:30.125412 0.293177 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 8 3260 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:30.397592 0.520998 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3012 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:30.911152 0.361622 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2927 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:31.236060 0.764088 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3197 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:31.971419 0.419285 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 2867 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:32.386461 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 REQ 0 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:07:39.798056 0.341955 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 2988 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:40.137492 0.790503 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 2957 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:40.900874 0.524704 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 2965 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:41.403248 0.189458 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 2940 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:41.559079 0.338148 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3191 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:41.893686 0.366197 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 8 2923 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:42.257000 0.338940 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 3257 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:42.588845 0.336816 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 8 2720 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:42.904936 0.183917 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2891 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:43.079949 0.324448 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 2926 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:43.379783 0.375696 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 8 2943 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:43.751465 0.386997 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 8 3191 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:44.101584 0.483835 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 8 3127 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:44.705962 0.861825 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 3018 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:45.547435 0.355310 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 8 2928 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:07:45.887731 0.000000 udp 10.0.2.105 7010 -> 80.179.7.22 2606 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:07:46.387066 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:07:52.696638 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:07:59.646926 0.107173 udp 10.0.2.105 7010 <-> 178.26.224.81 4126 CON 0 0 8 2643 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:08:00.165118 0.196665 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 8 2988 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:08:00.816241 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:09.400975 0.148019 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:08:10.151772 0.000000 udp 10.0.2.105 7010 -> 71.204.57.248 6597 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:14.387505 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:08:16.700805 0.000000 udp 10.0.2.105 7010 -> 216.254.156.227 3017 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:24.121590 0.000000 udp 10.0.2.105 7010 -> 217.231.108.77 4878 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:29.319177 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:34.566886 0.000000 udp 10.0.2.105 7010 -> 95.146.156.196 5843 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:39.383156 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:08:40.555768 0.000000 udp 10.0.2.105 7010 -> 50.133.156.135 3594 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:49.238245 0.000000 udp 10.0.2.105 7010 -> 197.27.29.221 2138 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:08:56.718848 0.000000 udp 10.0.2.105 7010 -> 65.125.140.130 5771 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:02.196879 0.000000 udp 10.0.2.105 7010 -> 88.233.50.251 6085 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:06.883006 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:09:08.755312 0.000000 udp 10.0.2.105 7010 -> 85.74.90.62 2536 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:14.985229 0.000000 udp 10.0.2.105 7010 -> 188.121.218.101 1995 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:22.871377 0.000000 udp 10.0.2.105 7010 -> 193.151.128.128 4631 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:29.165236 0.106578 udp 10.0.2.105 7010 -> 82.51.112.124 2254 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:29.271814 0.000000 icmp 82.51.112.124 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 193 flow=Background 1970/02/15 07:09:33.881391 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:09:36.135168 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:43.395731 0.000000 udp 10.0.2.105 7010 -> 105.236.160.19 6436 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:09:51.947837 0.000000 udp 10.0.2.105 7010 -> 87.3.43.74 5383 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:00.460392 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:05.387243 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:10:08.581729 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:15.401734 0.000000 udp 10.0.2.105 7010 -> 66.254.40.14 1199 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:23.323020 0.000000 udp 10.0.2.105 7010 -> 75.67.154.24 4924 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:27.331335 3.001594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 07:10:29.772331 0.125966 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:29.898297 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 263 flow=Background 1970/02/15 07:10:34.338854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:10:34.388675 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:10:35.009797 0.000000 udp 10.0.2.105 7010 -> 173.34.174.169 2857 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:42.340502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:10:43.712280 0.045637 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 801 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:10:44.075454 0.000000 udp 10.0.2.105 7010 -> 77.2.164.223 7751 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:51.043089 0.000000 udp 10.0.2.105 7010 -> 187.162.113.149 6533 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:57.151676 0.000000 udp 10.0.2.105 7010 -> 209.234.215.166 4728 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:10:58.343338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:11:01.888145 0.000228 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:11:05.894330 0.554749 udp 10.0.2.105 7010 <-> 1.23.248.186 6353 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:11:06.633785 0.000000 udp 10.0.2.105 7010 -> 190.43.176.248 3153 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:14.546853 0.000000 udp 10.0.2.105 7010 -> 50.166.141.98 1287 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:23.069262 0.000000 udp 10.0.2.105 7010 -> 80.181.185.190 3641 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:27.885699 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:11:30.349295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:11:30.880066 0.077788 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 735 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:11:31.185586 0.000000 udp 10.0.2.105 7010 -> 218.186.88.244 4064 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:37.649991 0.000000 udp 10.0.2.105 7010 -> 75.145.100.73 8729 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:45.661393 0.000000 udp 10.0.2.105 7010 -> 65.36.4.10 5064 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:54.313497 0.000000 udp 10.0.2.105 7010 -> 81.102.193.222 6454 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:11:58.880124 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:12:01.213608 0.000000 udp 10.0.2.105 7010 -> 79.31.82.96 3777 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:08.984742 0.000000 udp 10.0.2.105 7010 -> 24.222.32.138 2014 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:15.164964 0.151212 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:12:15.539780 0.000000 udp 10.0.2.105 7010 -> 24.21.158.204 6873 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:21.082251 0.000000 udp 10.0.2.105 7010 -> 79.241.212.220 5162 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:25.889280 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:12:26.880729 0.000000 udp 10.0.2.105 7010 -> 93.197.185.131 7512 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:33.821439 0.000000 udp 10.0.2.105 7010 -> 162.207.85.105 6815 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:40.380296 0.000000 udp 10.0.2.105 7010 -> 79.1.119.249 3792 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:48.732137 0.131708 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:12:48.987911 0.000000 udp 10.0.2.105 7010 -> 96.21.140.216 1783 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:12:53.416483 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:12:57.318119 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:02.843789 0.000000 udp 10.0.2.105 7010 -> 109.28.97.170 4327 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:11.718193 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:18.905584 0.405562 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:13:19.540819 0.812473 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:13:20.451368 0.000000 udp 10.0.2.105 7010 -> 37.116.141.157 1160 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:23.882393 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:13:28.839700 0.000000 udp 10.0.2.105 7010 -> 87.2.205.74 2524 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:37.412088 0.000000 udp 10.0.2.105 7010 -> 93.64.164.99 6772 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:46.004264 0.104405 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:13:46.685302 0.000000 udp 10.0.2.105 7010 -> 189.135.31.249 8369 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:13:50.880780 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:13:55.057571 0.076923 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:13:55.668864 0.000000 udp 10.0.2.105 7010 -> 41.242.50.122 3170 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:00.805704 0.113605 udp 10.0.2.105 7010 <-> 79.10.139.68 8847 CON 0 0 2 851 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:14:01.058365 0.000000 udp 10.0.2.105 7010 -> 46.177.43.97 9874 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:09.087689 0.000000 udp 10.0.2.105 7010 -> 190.219.1.134 3038 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:14.645849 0.000000 udp 10.0.2.105 7010 -> 82.91.133.58 1460 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:19.382513 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:14:21.615949 0.000000 udp 10.0.2.105 7010 -> 105.225.95.151 3276 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:30.418582 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:38.309764 0.000000 udp 10.0.2.105 7010 -> 188.9.0.37 4685 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:44.027919 0.000000 udp 10.0.2.105 7010 -> 37.0.92.41 9101 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:48.884188 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:14:50.717579 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:14:57.196420 0.000000 udp 10.0.2.105 7010 -> 120.150.247.158 6348 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:02.804310 0.000000 udp 10.0.2.105 7010 -> 98.110.147.210 5171 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:10.205530 0.184372 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:15:10.794454 0.051654 udp 10.0.2.105 7010 -> 109.168.31.46 6125 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:10.846108 0.000000 icmp 109.168.31.46 0x0303 -> 10.0.2.105 0xed17 URP 192 1 290 flow=Background 1970/02/15 07:15:14.881864 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:15:18.046408 0.000000 udp 10.0.2.105 7010 -> 94.55.23.58 5240 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:25.136762 0.000000 udp 10.0.2.105 7010 -> 80.13.218.234 6144 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:30.644957 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:37.214142 0.057095 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:15:37.342948 0.000000 udp 10.0.2.105 7010 -> 60.174.193.32 7193 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:41.880771 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:15:44.645034 0.000000 udp 10.0.2.105 7010 -> 188.153.106.221 8920 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:51.114251 0.000000 udp 10.0.2.105 7010 -> 86.169.15.96 2915 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:15:59.476885 0.000000 udp 10.0.2.105 7010 -> 4.71.253.162 3986 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:05.094438 0.000000 udp 10.0.2.105 7010 -> 190.118.0.113 7910 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:09.881279 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:16:12.465095 0.000000 udp 10.0.2.105 7010 -> 84.183.16.190 9283 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:17.542267 0.000000 udp 10.0.2.105 7010 -> 173.221.33.243 3719 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:26.354912 0.093576 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:16:26.606260 0.218144 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:16:26.833705 0.000000 udp 10.0.2.105 7010 -> 173.58.11.234 2897 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:33.965430 0.000000 udp 10.0.2.105 7010 -> 206.219.124.114 9936 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:38.882515 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:16:41.376711 0.000000 udp 10.0.2.105 7010 -> 36.86.164.74 3619 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:47.294945 0.054655 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 753 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:16:47.493541 0.000000 udp 10.0.2.105 7010 -> 92.139.1.51 2023 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:16:53.834772 0.000000 udp 10.0.2.105 7010 -> 79.39.168.28 6502 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:02.576990 0.213683 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:17:03.022551 0.000000 udp 10.0.2.105 7010 -> 95.246.38.22 2992 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:07.383847 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:17:09.016072 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:17.278105 0.000000 udp 10.0.2.105 7010 -> 76.176.156.99 4020 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:22.596074 0.000000 udp 10.0.2.105 7010 -> 50.75.14.152 2021 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:28.464389 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9946 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:33.381108 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:17:34.355434 3.001616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 07:17:36.606125 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1998 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:41.638866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:17:45.653112 0.165262 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:17:46.115365 0.000000 udp 10.0.2.105 7010 -> 69.138.198.63 5089 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:49.562200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:17:52.516622 0.949563 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:17:53.646167 0.000000 udp 10.0.2.105 7010 -> 86.134.253.70 5460 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:17:58.221678 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:18:02.476602 0.000000 udp 10.0.2.105 7010 -> 66.252.67.65 4753 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:06.113101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:18:10.267946 0.000000 udp 10.0.2.105 7010 -> 202.179.10.114 1562 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:16.360636 0.000000 udp 10.0.2.105 7010 -> 199.36.180.78 5362 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:21.801221 0.000000 udp 10.0.2.105 7010 -> 94.138.191.144 4570 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:26.442940 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:18:26.770692 0.000000 udp 10.0.2.105 7010 -> 81.156.116.102 4918 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:33.093486 0.000000 udp 10.0.2.105 7010 -> 111.242.43.63 1084 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:37.822497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:18:39.727996 0.156768 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 809 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:18:40.044800 0.000000 udp 10.0.2.105 7010 -> 75.187.240.100 3726 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:45.030964 0.000000 udp 10.0.2.105 7010 -> 87.195.147.110 2851 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:51.267889 0.000000 udp 10.0.2.105 7010 -> 209.90.159.58 4428 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:18:56.088445 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:18:58.621998 0.000000 udp 10.0.2.105 7010 -> 195.200.106.141 1616 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:06.861476 0.184336 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:19:07.083362 0.000000 udp 10.0.2.105 7010 -> 93.42.147.4 1260 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:15.057630 0.000000 udp 10.0.2.105 7010 -> 68.77.176.182 1243 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:19.884129 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:19:20.806023 0.000000 udp 10.0.2.105 7010 -> 98.101.83.154 5434 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:28.456516 0.000000 udp 10.0.2.105 7010 -> 85.179.113.158 6147 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:36.875754 0.000000 udp 10.0.2.105 7010 -> 106.140.97.31 4026 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:42.926630 0.000000 udp 10.0.2.105 7010 -> 95.243.3.35 9626 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:19:47.884731 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:19:51.589939 0.309010 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:19:51.941461 0.000000 udp 10.0.2.105 7010 -> 79.218.36.151 6766 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:23:43.423621 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:23:43.423709 0.757702 tcp 10.0.2.105 65007 -> 31.192.24.67 3527 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:24:41.398650 3.002217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 07:24:48.406803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:24:56.408051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:25:12.411417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:25:44.417340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:31:48.424047 3.001166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 07:31:55.430714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:32:03.431994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:32:19.435050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:32:51.443168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:38:55.447061 3.001852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 07:39:02.454659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:39:10.456040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:39:26.458950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:39:58.465106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:46:02.471713 3.020418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 07:46:09.488542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:46:17.489931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:46:33.493122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:47:05.499026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:50:01.953141 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:50:01.953248 0.233662 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:02.187304 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 90 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:50:20.533899 0.065989 tcp 10.0.2.105 65008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:20.600168 0.063370 tcp 10.0.2.105 65009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:20.663813 0.154628 tcp 10.0.2.105 65010 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:20.818967 0.103699 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:20.923048 0.210820 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:21.134238 0.054640 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:21.189263 0.052788 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:21.242498 0.174125 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:21.417065 0.876868 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:22.294455 1.155701 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:22.294878 4.985774 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 SPA_* 0 0 15 4451 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:23.450608 0.171851 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:23.622810 0.080495 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:23.703678 0.168346 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:23.872610 0.158954 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.031988 0.166236 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.198643 0.186396 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.385447 0.180934 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.566834 0.158452 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.725766 0.082704 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.808957 0.149667 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:24.959040 0.070037 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.029440 0.173667 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.203469 0.504527 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.708555 0.028933 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.737867 0.097778 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.836108 0.049513 udp 10.0.2.105 7010 <-> 178.26.224.81 4126 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:25.886045 0.140663 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.027133 0.046861 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.074407 0.174553 udp 10.0.2.105 7010 <-> 1.23.248.186 6353 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.249404 0.173671 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.423521 0.148564 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.572651 0.055826 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:26.628880 0.431194 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:27.060524 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:50:33.375022 3.941752 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 45 27006 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:39.384218 3.829344 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 18 11212 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:43.214348 0.065518 tcp 10.0.2.105 65012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:43.280180 0.067004 tcp 10.0.2.105 65013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:43.347512 0.215697 tcp 10.0.2.105 65014 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:43.563806 0.098925 udp 10.0.2.105 7010 <-> 77.242.55.161 1044 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:43.663226 0.073644 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:50:43.737315 0.000000 udp 10.0.2.105 7010 -> 79.10.139.68 8847 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 07:50:45.262018 4.715556 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 14 8348 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:51.865174 4.506154 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 24 16832 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:50:57.085310 3.642524 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 10 4884 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:01.738426 0.065508 tcp 10.0.2.105 65015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:01.804385 0.062920 tcp 10.0.2.105 65016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:01.867575 0.160042 tcp 10.0.2.105 65017 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:02.028309 0.182227 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.210974 0.055718 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.267111 0.130996 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.398478 0.217819 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.616741 0.052986 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.670141 0.217182 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:02.887733 0.174296 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:03.062402 0.197941 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:03.072549 0.404704 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:03.260766 0.151194 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:03.412539 0.180358 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:03.593272 0.289879 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/15 07:51:08.423427 2.875464 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 16 8560 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:13.556277 4.028648 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 31 22154 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:19.164236 3.925403 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 24 15280 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:25.143248 4.195690 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 21 15118 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:27.385869 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:51:30.157539 4.308277 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 51 30082 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:35.160635 3.953572 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 71 38050 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:40.372704 4.378040 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 30 22700 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:47.028745 4.601711 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 49 27222 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:52.251243 4.881786 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 30 18004 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:51:57.338953 4.456771 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 16 7856 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:04.177558 3.775006 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 20 11216 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:10.393475 3.189451 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 24 14288 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:15.545431 4.860703 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 27 19262 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:20.612075 4.867128 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 53 32762 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:22.384927 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:52:27.590359 3.183799 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 18 10612 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:33.456924 1.124464 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 7 3274 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:39.962867 3.165863 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 19 12466 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:45.426990 4.747929 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 26 17788 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:47.881549 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:52:51.038084 3.773126 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 29 18550 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:52:56.820557 4.256544 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 31 19506 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:02.315275 1.251069 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 18 11212 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:09.505620 3.001289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 07:53:14.290929 4.634137 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 21 13670 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:16.512670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:53:19.386903 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:53:20.219133 4.237904 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 35 24170 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:24.518905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:53:27.066400 4.658961 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 31 20706 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:32.565063 4.537202 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 77 41022 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:38.740386 2.106977 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 37 22478 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:40.517291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:53:44.182424 0.568290 tcp 10.0.2.105 65018 -> 31.192.24.67 3527 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:45.666796 4.494110 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 43 24850 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:50.857073 3.300544 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 54 28940 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:53:56.805784 4.611911 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 19 10314 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:02.083408 0.000165 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 3 1610 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:07.142132 4.059022 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 40 22744 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:12.143335 4.766246 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 30 18004 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:12.523064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 07:54:16.879466 0.000333 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 07:54:17.714178 3.511200 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_PA 0 0 24 15632 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:23.279720 4.788258 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 FPA_* 0 0 21 11951 flow=From-Botnet-V2-TCP-Established 1970/02/15 07:54:28.972395 0.000153 tcp 10.0.2.105 65011 -> 211.38.175.27 4598 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:00:16.529551 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:00:23.536668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:00:31.537993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:00:47.541030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:01:19.547287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:07:23.554949 3.000384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:07:30.560736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:07:38.562229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:07:54.573250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:08:26.581025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:14:30.586942 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:14:37.594516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:14:45.598766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:15:01.599143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:15:33.605038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:21:06.073081 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:21:06.073250 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 08:21:23.309978 0.066527 tcp 10.0.2.105 65019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:23.376779 0.068395 tcp 10.0.2.105 65020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:23.445464 0.191887 tcp 10.0.2.105 65021 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:23.637945 0.000000 udp 10.0.2.105 7010 -> 79.10.139.68 8847 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 08:21:37.611688 3.001059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:21:38.930794 0.064709 tcp 10.0.2.105 65022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:38.995832 0.606862 tcp 10.0.2.105 65023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:39.603050 0.155326 tcp 10.0.2.105 65024 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:39.758902 0.811003 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:40.570388 0.103144 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:40.570735 3.815753 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 SPA_* 0 0 34 18075 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:40.673906 0.041522 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:40.715828 0.202010 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:40.918185 0.204904 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:41.123434 0.056011 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:41.179846 1.078632 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.258873 0.076236 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.335532 0.153270 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.489213 0.173334 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.662997 0.163099 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.826518 0.164541 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:42.991446 0.420309 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:43.412143 0.184194 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:43.596769 0.148941 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:43.746067 0.068229 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:43.814729 0.180786 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:43.995957 0.085168 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.081494 0.188942 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.270797 0.029246 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.300500 0.173906 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.474767 0.423619 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.618609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:21:44.898838 0.050307 udp 10.0.2.105 7010 <-> 178.26.224.81 4126 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:44.949590 0.195599 udp 10.0.2.105 7010 <-> 1.23.248.186 6353 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.145654 0.066388 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.212430 0.097204 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.310003 0.072655 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.383157 0.141400 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.524918 0.147975 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:45.673369 0.412859 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:46.086569 0.057835 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:21:46.144769 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 08:21:47.264847 2.811577 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 9462 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:21:52.620335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:21:55.729646 4.651995 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 31 22402 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:02.011929 4.936226 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 44 24096 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:02.754678 0.064479 tcp 10.0.2.105 65026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:02.819364 0.076089 tcp 10.0.2.105 65027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:02.895704 0.158793 tcp 10.0.2.105 65028 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:03.055053 0.075651 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.131166 0.051315 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.182897 0.096250 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.279594 0.183533 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.463488 0.051820 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.515689 0.217493 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:03.733593 0.568884 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:04.302928 0.208847 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:04.512180 0.183489 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:04.696027 0.295059 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:04.991502 0.198141 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:05.190007 0.149307 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:22:07.150991 2.042738 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 12 5304 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:08.622742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:22:12.985070 4.456944 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 21 12222 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:19.566585 4.819319 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 16 11000 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:24.585999 4.646055 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 28 16552 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:29.947282 3.162128 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 39 24634 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:30.884858 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:22:34.986966 3.867776 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 23 14026 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:40.346417 4.661075 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 10 6332 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:40.721438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:22:49.600581 4.853232 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 36 19880 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:55.100973 4.895711 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 29 16854 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:22:57.383023 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:23:01.862021 4.575717 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 28 14544 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:07.114836 4.556406 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 34 19772 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:13.872433 2.927881 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 21 13174 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:18.891357 4.421976 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 37 23926 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:24.977936 4.933727 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 43 23402 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:30.151547 1.696957 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 23 15578 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:44.751523 0.558049 tcp 10.0.2.105 65029 -> 31.192.24.67 3527 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:49.592778 0.406181 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 7 4722 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:23:57.946472 4.218698 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 9 4678 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:06.304695 4.416089 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:11.379594 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:24:11.407173 4.378407 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 6146 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:16.880158 4.983334 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 5846 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:22.478823 4.973511 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 4250 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:31.505557 3.557778 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 8 3588 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:36.787088 0.399538 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 4 1788 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:45.830782 4.887806 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 7 2474 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:51.391786 4.650125 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 13 5418 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:56.618220 4.522778 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 27 10354 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:24:57.886511 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:25:02.735810 4.838123 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 21 9006 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:08.227923 3.609088 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 5310 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:13.649584 4.455692 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 18 7260 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:19.554333 4.068481 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 24 9668 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:21.880736 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:25:24.728811 4.700354 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 26 11896 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:29.752136 4.430300 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 21 8470 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:35.527232 4.782142 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 9826 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:40.966624 4.845905 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 6 2420 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:46.005621 1.259154 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:51.177411 3.139971 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 7 2998 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:56.304479 4.562547 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 15 6050 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:25:57.882592 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:26:02.397664 4.833224 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 22 9048 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:07.426244 4.775700 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:12.841396 1.985362 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 5 1842 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:22.849386 3.373905 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 4262 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:27.885574 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:26:28.659564 4.854383 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 25 12354 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:33.714023 4.345653 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:39.163117 4.385327 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 16 8188 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:44.784917 4.691871 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 20 9476 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:50.003237 4.700880 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 11 4786 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:26:56.559204 3.022092 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 7194 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:01.775536 4.485238 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 9314 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:06.902548 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:27:08.045196 4.885309 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 16 6104 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:14.569851 4.587570 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 14 6520 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:19.783591 4.864493 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 22 9572 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:25.387394 4.852534 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 19 7314 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:30.435931 4.310667 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 18 6736 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:30.886254 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:27:35.991115 4.734710 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:41.407645 4.798855 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 14 7044 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:46.911281 4.891096 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 19 8362 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:51.996071 4.948061 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 16 6628 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:27:57.607637 3.562299 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 24 9144 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:03.883608 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:28:10.800402 4.072942 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 15 6586 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:16.162901 4.959988 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 15 7622 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:21.803241 4.763704 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 6158 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:27.557592 4.527496 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 15 7622 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:28.879594 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:28:32.744670 3.748664 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 14 5472 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:38.412569 4.793310 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 21 10042 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:44.636079 3.101855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 08:28:45.099260 4.964821 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 28 11992 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:50.344658 2.022420 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 16 7152 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:28:51.747056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:28:59.681294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:29:00.703856 4.347905 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:06.593087 3.045376 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 10 4208 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:07.385130 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:29:13.487073 4.646119 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 14 5996 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:15.659601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:29:19.971060 4.453544 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 8 3576 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:26.370114 4.971574 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 12 5364 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:31.379331 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:29:31.539931 4.404987 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 17 7730 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:36.609448 3.262517 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 18 6736 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:43.513504 4.694631 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 A_PA 0 0 18 7784 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:29:47.662869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:29:48.903376 2.447085 tcp 10.0.2.105 65025 -> 200.84.7.244 8038 FPA_* 0 0 9 1302 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:35:51.669253 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:35:58.681132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:36:06.677943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:36:22.680889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:36:54.687337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:42:58.693084 3.001581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 08:43:05.700217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:43:13.701864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:43:29.705027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:44:01.711038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:52:09.151946 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:52:09.152032 0.000000 udp 10.0.2.105 7010 -> 77.242.55.161 1044 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 08:52:24.995734 0.066311 tcp 10.0.2.105 65030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:52:25.062387 0.063860 tcp 10.0.2.105 65031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:52:25.126527 0.158011 tcp 10.0.2.105 65032 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:52:25.285072 0.104756 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:25.390230 0.050266 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:25.440899 0.176033 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:25.617333 0.206101 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:25.823837 0.059923 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:25.884187 0.600061 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:26.484636 0.082703 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:26.567706 1.038177 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:27.606249 0.157750 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:27.764386 0.164564 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:27.929433 0.172032 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:28.101910 0.972303 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:29.074615 0.251716 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:29.326751 0.070486 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:29.397638 0.180992 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:29.579096 0.084246 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:29.663726 0.159832 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.044883 0.028339 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.073645 0.155449 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.361320 0.185363 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.547064 0.050098 udp 10.0.2.105 7010 <-> 178.26.224.81 4126 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.597606 0.179424 udp 10.0.2.105 7010 <-> 1.23.248.186 6353 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.777491 0.067213 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:30.845134 0.097515 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:31.163028 0.045746 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:31.209207 0.479032 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:31.688605 0.170176 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:31.859227 0.065448 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:31.925102 0.139883 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.065351 0.200109 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.265902 0.345896 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.612159 0.099340 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.711991 0.073704 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.786129 0.051319 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:32.837926 0.184490 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.022834 0.052851 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.076089 0.221766 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.298233 0.126575 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.425205 0.285163 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.710752 0.202093 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:33.913194 0.151852 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:34.065446 0.216217 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:52:34.282082 0.185267 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/15 08:53:45.310174 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 08:53:45.310310 0.546794 tcp 10.0.2.105 65033 -> 31.192.24.67 3527 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/15 08:55:37.724910 3.001132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 08:55:44.731771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:55:52.732846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:56:08.736529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 08:56:40.742289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:02:44.747783 3.003045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:02:51.755388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:02:59.757223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:03:15.763394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:03:47.766313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:10:15.776836 3.001320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:10:22.784086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:10:30.785536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:10:46.788718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:11:18.794711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:17:22.800156 3.002028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:17:29.809566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:17:37.809779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:17:53.812767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:18:25.818813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:22:51.961655 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 09:22:51.961763 0.177278 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:52.139410 0.104877 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:52.244767 0.051906 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:52.297051 0.207349 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:52.504823 0.058057 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:52.563290 0.695349 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:53.259016 0.083756 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:22:53.343150 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 09:23:12.032134 0.065600 tcp 10.0.2.105 65034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:12.098091 0.064194 tcp 10.0.2.105 65035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:12.162646 0.159795 tcp 10.0.2.105 65036 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:12.323055 0.159195 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:12.482675 0.164481 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:12.647678 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 09:23:31.398717 0.062406 tcp 10.0.2.105 65037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:31.461436 0.062530 tcp 10.0.2.105 65038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:31.524301 0.154431 tcp 10.0.2.105 65039 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:31.679232 0.068182 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:31.747926 0.274840 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.023138 0.094678 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.118257 0.158968 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.277640 0.168218 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.446201 0.151862 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.598463 0.157835 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.756768 0.029572 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.786752 0.183072 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:32.970302 0.000000 udp 10.0.2.105 7010 -> 178.26.224.81 4126 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 09:23:45.859205 0.635392 tcp 10.0.2.105 65040 -> 31.192.24.67 3527 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:48.513251 0.060979 tcp 10.0.2.105 65041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:48.574569 0.066146 tcp 10.0.2.105 65042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:48.641030 0.154117 tcp 10.0.2.105 65043 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:23:48.795819 0.169497 udp 10.0.2.105 7010 <-> 1.23.248.186 6353 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:48.965667 0.073566 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.039657 0.391287 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.431309 0.096155 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.527883 0.045384 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.573626 0.138864 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.712851 0.147547 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:49.860794 0.632294 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:50.493419 0.058045 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:50.551838 0.359870 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:50.912074 0.094466 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.006950 0.074034 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.081371 0.055738 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.137474 0.219234 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.357122 0.084622 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.442122 0.182497 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.624965 0.054179 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.679533 0.294716 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:51.974616 0.199092 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:52.174067 0.149766 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:52.324352 0.209206 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:23:52.534009 0.183770 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:24:29.825135 3.001064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 09:24:36.832136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:24:44.834755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:25:00.836695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:25:32.842731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:31:36.855635 2.994413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:31:43.855931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:31:51.857585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:32:07.862919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:32:39.866238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:38:43.872849 3.001335 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:38:51.152977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:38:59.080480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:39:14.931085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:39:46.900714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:45:50.907224 3.004092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 09:45:57.913773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:46:05.915403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:46:21.918927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:46:53.924386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:53:46.498365 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 09:53:46.498548 0.593094 tcp 10.0.2.105 65044 -> 31.192.24.67 3527 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:03.272194 0.359363 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:03.631943 0.170820 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:03.803166 0.000000 udp 10.0.2.105 7010 -> 178.26.224.81 4126 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 09:54:19.006405 0.071523 tcp 10.0.2.105 65045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:19.078258 0.073625 tcp 10.0.2.105 65046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:19.152173 0.168071 tcp 10.0.2.105 65047 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:19.320761 0.103755 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:19.424915 0.056243 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:19.481541 0.174955 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:19.656905 0.205330 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:19.862575 0.509796 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.372791 0.059617 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.432855 0.081598 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.514833 0.158434 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.673630 0.165286 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.839290 0.083415 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:20.923110 0.770786 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 226 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:21.694342 0.181631 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:21.876416 0.067921 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:21.944696 0.158463 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:22.103560 0.029700 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:22.133656 0.187664 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:22.321763 0.172036 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:22.494233 0.160531 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:22.655193 0.000000 udp 10.0.2.105 7010 -> 1.23.248.186 6353 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 09:54:37.882054 0.074265 tcp 10.0.2.105 65048 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:37.956570 0.076911 tcp 10.0.2.105 65049 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:38.033736 0.159230 tcp 10.0.2.105 65050 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 09:54:38.193549 0.068194 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:38.262149 0.045507 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:38.308012 0.141253 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:38.449748 0.147142 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:38.597272 0.424499 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.022122 0.097090 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.119630 0.170902 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.290962 0.056729 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.348131 0.348013 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.696506 0.099650 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.796700 0.072617 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.869701 0.056130 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:39.926184 0.218241 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.144801 0.053316 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.198499 0.298511 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.497376 0.198985 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.696718 0.150716 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.847866 0.149292 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:40.997619 0.182978 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:41.181007 0.219157 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:54:41.400541 0.180746 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/15 09:57:04.935162 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 09:57:11.943024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:57:20.930076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:57:36.753342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 09:58:08.390437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:04:11.969542 3.002643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:04:18.976975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:04:26.978640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:04:42.981653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:05:14.989316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:11:18.993665 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:11:26.001109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:11:34.002229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:11:50.005449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:12:22.011637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:18:26.027364 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:18:33.035103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:18:41.036445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:18:57.038948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:19:29.045698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:23:47.097066 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 10:23:47.097169 0.674298 tcp 10.0.2.105 65051 -> 31.192.24.67 3527 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:24:51.639165 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 10:24:51.639267 0.174018 udp 10.0.2.105 7010 -> 1.23.248.186 6353 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 10:24:51.813285 0.000000 icmp 1.23.248.186 0x0303 -> 10.0.2.105 0xd118 URP 192 1 190 flow=Background 1970/02/15 10:25:10.338051 0.064636 tcp 10.0.2.105 65052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:25:10.402914 0.060297 tcp 10.0.2.105 65053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:25:10.463092 0.160885 tcp 10.0.2.105 65054 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:25:10.624681 0.333105 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:10.958407 0.173236 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.132033 0.055174 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.187634 0.104131 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.292205 0.176581 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.469128 0.209354 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.678860 0.080683 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.759905 0.158767 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.919080 0.055325 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:11.974830 0.215982 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.191200 0.166291 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.357866 0.087965 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.446279 0.182190 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.628971 0.073920 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.703257 0.158992 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.862734 0.029731 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:12.892909 0.158688 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.051985 0.166602 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.218973 0.182940 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.402355 0.149524 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.552433 0.074302 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.627125 0.045263 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.672775 0.140843 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.814065 0.146958 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:13.961419 0.173483 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:14.135308 0.062220 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:14.197953 0.444155 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:14.701047 0.097237 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:14.798648 0.350311 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.149371 0.135668 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.285416 0.073747 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.359578 0.056908 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.416901 0.221248 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.638508 0.198857 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.837784 0.053882 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:15.892077 0.301560 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:16.194014 0.182824 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:16.377224 0.208845 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:16.586446 0.153604 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:16.740551 0.395997 udp 10.0.2.105 7010 <-> 217.201.55.34 2269 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:17.136908 0.181026 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:25:33.051831 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 10:25:40.058857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:25:48.060258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:26:04.064867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:26:36.069496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:32:40.076102 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:32:47.082758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:32:55.809385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:33:11.622193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:33:43.255680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:39:47.110023 3.000940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:39:54.117038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:40:02.118544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:40:19.016584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:40:50.633656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:46:54.143847 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:47:01.150876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:47:09.151884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:47:25.159147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:47:57.161740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:53:47.776046 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 10:53:47.776183 0.673679 tcp 10.0.2.105 65055 -> 31.192.24.67 3527 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:54:01.167726 3.001366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 10:54:08.175100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:54:16.176191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:54:32.179316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:55:04.185427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 10:55:35.941183 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 10:55:35.941326 0.083747 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:36.025459 0.466296 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:36.492210 0.173110 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:36.665712 0.105291 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:36.771404 0.176252 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:36.948105 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 10:55:53.688464 0.075455 tcp 10.0.2.105 65056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:55:53.764196 0.073369 tcp 10.0.2.105 65057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:55:53.837932 0.165767 tcp 10.0.2.105 65058 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:55:54.004413 0.081532 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.086389 0.159959 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.246789 0.057231 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.304563 0.216232 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.521236 0.181939 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.703502 0.064786 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.768662 0.158257 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.927414 0.029754 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:54.957610 0.156059 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:55.114038 0.220032 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:55.334446 0.166038 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:55.500840 0.083214 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:55.677526 0.185717 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:55.863632 0.151372 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.015356 0.069070 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.084834 0.064662 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.149891 0.280479 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.430814 0.148015 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.579244 0.174515 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.754204 0.055906 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:56.810472 0.349204 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.160055 0.484640 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.645058 0.097186 udp 10.0.2.105 7010 <-> 31.192.24.67 6539 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.742610 0.087170 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.830187 0.074000 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.904781 0.056683 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:57.961856 0.217081 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:58.179353 0.200881 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:58.380668 0.052707 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:58.433777 0.291011 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:58.725158 0.149329 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:55:58.874827 0.000000 udp 10.0.2.105 7010 -> 217.201.55.34 2269 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 10:56:16.620196 0.073276 tcp 10.0.2.105 65059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:56:16.693710 0.071780 tcp 10.0.2.105 65060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:56:16.765754 0.167237 tcp 10.0.2.105 65061 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 10:56:16.933496 0.182428 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:56:17.116425 0.217499 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/15 10:56:17.334300 0.183034 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:01:08.191022 3.002190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 11:01:15.198798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:01:23.200501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:01:39.203187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:02:11.209372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:08:15.216218 3.000815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 11:08:22.222588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:08:30.224210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:08:46.227360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:09:18.233334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:15:22.239425 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 11:15:29.246806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:15:37.248288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:15:53.251543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:16:25.257276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:22:33.269692 3.000803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 11:22:40.276776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:22:48.278000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:23:04.280980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:23:36.286837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:23:48.455083 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:23:48.455189 3.003601 tcp 10.0.2.105 65062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:23:57.457640 0.000000 tcp 10.0.2.105 65062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:03.458254 0.279841 tcp 10.0.2.105 65063 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:03.738377 0.062975 tcp 10.0.2.105 65064 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:03.801650 0.159540 tcp 10.0.2.105 65065 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:04.252348 2.542113 tcp 10.0.2.105 65066 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:06.072566 0.065894 tcp 10.0.2.105 65067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:06.138746 0.061332 tcp 10.0.2.105 65068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:06.200382 0.158395 tcp 10.0.2.105 65069 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:06.794787 2.990469 tcp 10.0.2.105 65070 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:15.783596 0.000000 tcp 10.0.2.105 65070 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:21.783406 0.064352 tcp 10.0.2.105 65071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:21.848093 0.064646 tcp 10.0.2.105 65072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:21.913063 0.174631 tcp 10.0.2.105 65073 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:22.528419 2.999263 tcp 10.0.2.105 65074 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:31.526516 0.000000 tcp 10.0.2.105 65074 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:37.525798 0.061188 tcp 10.0.2.105 65075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:37.586867 0.062597 tcp 10.0.2.105 65076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:37.649818 0.158452 tcp 10.0.2.105 65077 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:37.860362 2.999409 tcp 10.0.2.105 65078 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:46.858678 0.000000 tcp 10.0.2.105 65078 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:24:52.857473 1.731418 tcp 10.0.2.105 65079 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:24:54.589093 2.994846 tcp 10.0.2.105 65080 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:25:03.622952 0.000000 tcp 10.0.2.105 65080 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:25:09.581522 2.993943 tcp 10.0.2.105 65081 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:25:18.573942 0.000000 tcp 10.0.2.105 65081 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:25:23.381098 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:26:39.551364 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:26:39.551450 0.208436 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:39.760456 0.000000 udp 10.0.2.105 7010 -> 217.201.55.34 2269 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:26:56.715692 0.065408 tcp 10.0.2.105 65082 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:26:56.781319 0.064041 tcp 10.0.2.105 65083 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:26:56.845748 0.159221 tcp 10.0.2.105 65084 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:26:57.005552 0.072073 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.078010 0.343384 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.421792 0.173985 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.596139 0.105418 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.701947 0.178579 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.880925 0.083008 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:57.964557 0.254255 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.219179 0.183238 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.402783 0.057363 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.460511 0.157504 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.618359 0.029435 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.648151 0.154588 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.803099 0.168568 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:58.972075 0.158993 udp 10.0.2.105 7010 <-> 174.93.8.134 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.131438 0.055889 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.187844 0.085036 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.273308 0.183491 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.457184 0.151387 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.609024 0.166125 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.775600 0.147163 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:26:59.923190 0.067616 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.065330 0.044965 udp 10.0.2.105 7010 <-> 5.13.50.47 2778 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.110679 0.143312 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.254356 0.347389 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.602135 0.172482 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.774988 0.057462 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.832914 0.090443 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:00.923730 0.425767 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:01.349917 0.056817 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:01.407133 0.078538 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:01.486050 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:27:18.547994 0.069378 tcp 10.0.2.105 65085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:27:18.617657 0.066652 tcp 10.0.2.105 65086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:27:18.684633 0.168051 tcp 10.0.2.105 65087 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:27:18.853170 0.202426 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.056008 0.212888 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.269285 0.053241 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.322908 0.150975 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.474287 0.297862 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.772577 0.182959 udp 10.0.2.105 7010 <-> 23.114.13.50 6744 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:19.955987 0.209570 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:27:20.271441 0.179956 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:29:40.293296 3.001523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 11:29:47.301660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:29:55.302116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:30:11.304874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:30:24.584334 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:30:24.584442 3.004221 tcp 10.0.2.105 65088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:30:33.587053 0.000000 tcp 10.0.2.105 65088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:30:39.586933 0.064609 tcp 10.0.2.105 65089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:39.651792 0.067851 tcp 10.0.2.105 65090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:39.719522 0.163310 tcp 10.0.2.105 65091 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:40.073142 3.007823 tcp 10.0.2.105 65092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:30:44.026308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:30:49.722323 0.000000 tcp 10.0.2.105 65092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:30:55.635782 0.064025 tcp 10.0.2.105 65093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:55.700150 0.061829 tcp 10.0.2.105 65094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:55.762225 0.157532 tcp 10.0.2.105 65095 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:56.136097 2.408318 tcp 10.0.2.105 65096 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:57.952100 0.062271 tcp 10.0.2.105 65097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:58.014711 0.064995 tcp 10.0.2.105 65098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:58.079980 0.155227 tcp 10.0.2.105 65099 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:30:58.544735 2.958474 tcp 10.0.2.105 65100 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:07.431276 0.000000 tcp 10.0.2.105 65100 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:13.359553 0.062762 tcp 10.0.2.105 65101 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:31:13.422614 0.063744 tcp 10.0.2.105 65102 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:31:13.486671 0.156691 tcp 10.0.2.105 65103 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:31:13.779571 2.963112 tcp 10.0.2.105 65104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:22.665334 0.000000 tcp 10.0.2.105 65104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:28.592646 2.968376 tcp 10.0.2.105 65105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:37.482881 0.000000 tcp 10.0.2.105 65105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:42.385895 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:31:43.429408 2.725280 tcp 10.0.2.105 65106 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:31:46.154953 3.000695 tcp 10.0.2.105 65107 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:31:55.154121 0.000000 tcp 10.0.2.105 65107 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:36:47.316697 3.001908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 11:36:54.324833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:37:01.154284 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:37:01.154375 3.004329 tcp 10.0.2.105 65108 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:02.325985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:37:10.157245 0.000000 tcp 10.0.2.105 65108 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:16.160238 0.066375 tcp 10.0.2.105 65109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:16.226898 0.062046 tcp 10.0.2.105 65110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:16.289243 0.160277 tcp 10.0.2.105 65111 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:16.711540 2.999242 tcp 10.0.2.105 65112 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:18.328946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:37:25.709366 0.000000 tcp 10.0.2.105 65112 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:31.708662 0.061962 tcp 10.0.2.105 65113 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:31.770924 0.062794 tcp 10.0.2.105 65114 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:31.834017 0.152457 tcp 10.0.2.105 65115 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:32.430108 2.220677 tcp 10.0.2.105 65116 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:34.170264 0.064887 tcp 10.0.2.105 65117 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:34.235446 0.062329 tcp 10.0.2.105 65118 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:34.298106 0.153680 tcp 10.0.2.105 65119 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:34.651096 2.995672 tcp 10.0.2.105 65120 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:43.645351 0.000000 tcp 10.0.2.105 65120 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:49.644550 0.062851 tcp 10.0.2.105 65121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:49.707692 0.063575 tcp 10.0.2.105 65122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:49.771504 0.160889 tcp 10.0.2.105 65123 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:37:50.319592 2.999525 tcp 10.0.2.105 65124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:37:50.335141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:37:59.317705 0.000000 tcp 10.0.2.105 65124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:38:05.317005 3.003661 tcp 10.0.2.105 65125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:38:14.319277 0.000000 tcp 10.0.2.105 65125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:38:18.885941 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:38:20.318100 3.395832 tcp 10.0.2.105 65126 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:38:23.714260 2.992840 tcp 10.0.2.105 65127 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:38:32.705697 0.000000 tcp 10.0.2.105 65127 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:43:38.706106 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:43:38.706277 3.003708 tcp 10.0.2.105 65128 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:43:47.708757 0.000000 tcp 10.0.2.105 65128 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:43:53.709120 0.068195 tcp 10.0.2.105 65129 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:43:53.777633 0.070591 tcp 10.0.2.105 65130 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:43:53.848654 0.160389 tcp 10.0.2.105 65131 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:43:54.036271 3.006029 tcp 10.0.2.105 65132 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:43:54.341211 3.001754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 11:44:01.348016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:44:03.040860 0.000000 tcp 10.0.2.105 65132 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:09.029789 0.062042 tcp 10.0.2.105 65133 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:09.092090 0.063439 tcp 10.0.2.105 65134 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:09.155831 0.272437 tcp 10.0.2.105 65135 -> 195.113.214.249 443 SRPA* 0 0 36 18834 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:09.425295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:44:09.589463 2.199879 tcp 10.0.2.105 65136 -> 46.48.223.67 15494 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:11.345666 0.060320 tcp 10.0.2.105 65137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:11.406292 0.061853 tcp 10.0.2.105 65138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:11.468428 0.164886 tcp 10.0.2.105 65139 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:11.789579 2.977310 tcp 10.0.2.105 65140 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:20.738683 0.000000 tcp 10.0.2.105 65140 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:25.362982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:44:26.734984 0.068770 tcp 10.0.2.105 65141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:26.804076 0.060235 tcp 10.0.2.105 65142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:26.864595 0.154387 tcp 10.0.2.105 65143 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:27.294693 3.005143 tcp 10.0.2.105 65144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:36.299234 0.000000 tcp 10.0.2.105 65144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:42.287629 3.005068 tcp 10.0.2.105 65145 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:51.290276 0.000000 tcp 10.0.2.105 65145 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:44:55.888759 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:44:57.289129 1.765041 tcp 10.0.2.105 65146 -> 46.48.223.67 15494 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:44:57.369000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:44:59.054383 2.991346 tcp 10.0.2.105 65147 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:45:08.046443 0.000000 tcp 10.0.2.105 65147 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:56:08.376523 3.001979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 11:56:15.387037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:56:23.385274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:56:39.388192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:57:11.394300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 11:57:48.577802 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 11:57:48.577968 0.000000 udp 10.0.2.105 7010 -> 31.192.24.67 6539 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:58:04.363537 0.061569 tcp 10.0.2.105 65148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:04.425407 0.061613 tcp 10.0.2.105 65149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:04.487310 0.135979 tcp 10.0.2.105 65150 -> 195.113.214.249 443 SRPA* 0 0 69 42492 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:04.624093 0.235738 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:04.852647 0.089267 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:05.071858 0.176704 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:05.245624 0.126762 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:05.528084 0.181883 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:05.705442 0.121135 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:05.793553 0.393153 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:06.150778 0.365077 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:06.489124 0.046486 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:06.677980 0.000000 udp 10.0.2.105 7010 -> 85.228.168.150 1204 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:58:14.104930 3.003717 tcp 10.0.2.105 65151 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:58:23.107435 0.000000 tcp 10.0.2.105 65151 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:58:24.100981 0.066944 tcp 10.0.2.105 65152 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:24.168207 0.061418 tcp 10.0.2.105 65153 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:24.229916 0.203523 tcp 10.0.2.105 65154 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:24.434106 0.187689 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:24.617793 0.178439 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:24.912197 0.000000 udp 10.0.2.105 7010 -> 174.93.8.134 5207 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:58:29.106008 0.064497 tcp 10.0.2.105 65155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:29.170757 0.067591 tcp 10.0.2.105 65156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:29.238649 0.159068 tcp 10.0.2.105 65157 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:29.627058 3.004171 tcp 10.0.2.105 65158 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:58:38.745145 0.000000 tcp 10.0.2.105 65158 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 11:58:42.050746 0.066762 tcp 10.0.2.105 65159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:42.117873 0.061628 tcp 10.0.2.105 65160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:42.179811 0.158540 tcp 10.0.2.105 65161 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:58:42.338923 0.056270 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:42.493743 1.438617 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:43.903378 0.184496 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:44.163507 0.174494 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:44.373445 0.172650 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:44.539032 0.169890 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:44.885899 0.102401 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:58:44.954495 0.000000 udp 10.0.2.105 7010 -> 5.13.50.47 2778 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:59:03.666331 0.066490 tcp 10.0.2.105 65162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:03.733087 0.062536 tcp 10.0.2.105 65163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:03.795929 0.147667 tcp 10.0.2.105 65164 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:03.944097 0.189115 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:04.130090 0.095117 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:04.484167 0.058808 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2013 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:04.809575 0.187292 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:04.973179 0.165806 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:05.514379 0.353716 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:05.919064 0.210033 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:06.094411 0.055557 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:06.147318 0.446411 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:06.572670 0.093863 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:06.786776 0.222035 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:07.013240 0.152600 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:07.281961 0.292910 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:07.574461 0.000000 udp 10.0.2.105 7010 -> 23.114.13.50 6744 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 11:59:23.334484 0.065153 tcp 10.0.2.105 65165 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:23.399931 0.065079 tcp 10.0.2.105 65166 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:23.465369 0.155590 tcp 10.0.2.105 65167 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/15 11:59:23.621614 0.229422 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:23.843698 0.057206 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:23.997567 0.227347 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/15 11:59:24.217246 0.189171 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:03:15.400976 3.145980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:03:22.523902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:03:30.461676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:03:44.630345 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:03:44.630503 2.994910 tcp 10.0.2.105 65168 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:03:46.422495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:03:53.697697 0.000000 tcp 10.0.2.105 65168 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:03:59.651368 0.064716 tcp 10.0.2.105 65169 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:03:59.716480 0.064053 tcp 10.0.2.105 65170 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:03:59.780873 0.159932 tcp 10.0.2.105 65171 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:00.119069 2.989845 tcp 10.0.2.105 65172 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:09.104877 0.000000 tcp 10.0.2.105 65172 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:15.105352 0.064456 tcp 10.0.2.105 65173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:15.170084 0.067514 tcp 10.0.2.105 65174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:15.237909 0.158426 tcp 10.0.2.105 65175 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:15.908304 3.000556 tcp 10.0.2.105 65176 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:18.428208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:04:24.907411 0.000000 tcp 10.0.2.105 65176 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:30.907038 0.067022 tcp 10.0.2.105 65177 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:30.974431 0.061655 tcp 10.0.2.105 65178 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:31.036548 0.150857 tcp 10.0.2.105 65179 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:04:31.306175 3.004930 tcp 10.0.2.105 65180 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:40.310688 0.000000 tcp 10.0.2.105 65180 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:46.298793 3.004011 tcp 10.0.2.105 65181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:55.301320 0.000000 tcp 10.0.2.105 65181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:04:59.877216 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:05:01.300072 2.994162 tcp 10.0.2.105 65182 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:05:10.302860 0.000000 tcp 10.0.2.105 65182 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:16.303316 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:10:16.303537 3.003543 tcp 10.0.2.105 65183 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:25.305403 0.000000 tcp 10.0.2.105 65183 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:31.305993 0.067949 tcp 10.0.2.105 65184 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:31.374231 0.063009 tcp 10.0.2.105 65185 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:31.437556 0.161956 tcp 10.0.2.105 65186 -> 195.113.214.249 443 SRPA* 0 0 42 31414 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:31.832888 3.006462 tcp 10.0.2.105 65187 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:33.440398 3.029554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:10:40.447494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:10:40.837927 0.000000 tcp 10.0.2.105 65187 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:46.827077 0.063007 tcp 10.0.2.105 65188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:46.889894 0.060788 tcp 10.0.2.105 65189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:46.951003 0.162096 tcp 10.0.2.105 65190 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:10:47.273732 3.007824 tcp 10.0.2.105 65191 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:10:48.449007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:10:56.280077 0.000000 tcp 10.0.2.105 65191 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:02.269741 0.065277 tcp 10.0.2.105 65192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:11:02.335321 0.064354 tcp 10.0.2.105 65193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:11:02.399970 0.159402 tcp 10.0.2.105 65194 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:11:02.663369 2.990359 tcp 10.0.2.105 65195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:04.451883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:11:11.662772 0.000000 tcp 10.0.2.105 65195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:17.661170 2.994119 tcp 10.0.2.105 65196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:26.653884 0.000000 tcp 10.0.2.105 65196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:31.381122 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:11:32.662785 2.994092 tcp 10.0.2.105 65197 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:11:36.457884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:11:41.655582 0.000000 tcp 10.0.2.105 65197 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:16:47.666103 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:16:47.666258 3.003568 tcp 10.0.2.105 65198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:16:56.668444 0.000000 tcp 10.0.2.105 65198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:02.668790 0.064912 tcp 10.0.2.105 65199 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:02.733977 0.059682 tcp 10.0.2.105 65200 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:02.793961 0.158000 tcp 10.0.2.105 65201 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:03.053492 3.001225 tcp 10.0.2.105 65202 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:12.050479 0.000000 tcp 10.0.2.105 65202 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:18.049816 0.068869 tcp 10.0.2.105 65203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:18.119011 0.067055 tcp 10.0.2.105 65204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:18.186433 0.158696 tcp 10.0.2.105 65205 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:18.357257 2.996582 tcp 10.0.2.105 65206 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:27.362548 0.000000 tcp 10.0.2.105 65206 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:33.351767 0.062703 tcp 10.0.2.105 65207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:33.414844 0.066919 tcp 10.0.2.105 65208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:33.482100 0.155722 tcp 10.0.2.105 65209 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:17:33.666260 2.999621 tcp 10.0.2.105 65210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:40.463984 3.002031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:17:42.666647 0.000000 tcp 10.0.2.105 65210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:47.471636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:17:48.663492 3.007382 tcp 10.0.2.105 65211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:17:55.472943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:17:57.666028 0.000000 tcp 10.0.2.105 65211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:18:02.382859 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:18:03.664881 3.004329 tcp 10.0.2.105 65212 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:18:11.476049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:18:12.667624 0.000000 tcp 10.0.2.105 65212 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:18:43.482411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:23:18.668056 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:23:18.668229 3.003643 tcp 10.0.2.105 65213 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:23:27.670218 0.000000 tcp 10.0.2.105 65213 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:23:33.670943 0.103792 tcp 10.0.2.105 65214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:33.774991 0.060779 tcp 10.0.2.105 65215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:33.836058 0.153624 tcp 10.0.2.105 65216 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:34.152776 2.991656 tcp 10.0.2.105 65217 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:23:43.154989 0.000000 tcp 10.0.2.105 65217 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:23:49.152058 0.060443 tcp 10.0.2.105 65218 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:49.212828 0.062401 tcp 10.0.2.105 65219 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:49.275542 0.174218 tcp 10.0.2.105 65220 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:23:49.642051 2.994501 tcp 10.0.2.105 65221 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:23:58.635338 0.000000 tcp 10.0.2.105 65221 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:04.644250 0.064181 tcp 10.0.2.105 65222 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:24:04.708702 0.069434 tcp 10.0.2.105 65223 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:24:04.778437 0.156822 tcp 10.0.2.105 65224 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:24:05.409602 3.000061 tcp 10.0.2.105 65225 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:14.407677 0.000000 tcp 10.0.2.105 65225 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:20.407033 3.003822 tcp 10.0.2.105 65226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:28.377857 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:24:29.409511 0.000000 tcp 10.0.2.105 65226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:35.407953 3.004748 tcp 10.0.2.105 65227 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:44.413083 0.000000 tcp 10.0.2.105 65227 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:24:47.487568 3.003957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:24:54.495291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:25:02.496857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:25:18.500794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:25:50.510035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:29:27.297905 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:29:27.298041 0.000000 udp 10.0.2.105 7010 -> 174.93.8.134 5207 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 12:29:44.984907 0.062047 tcp 10.0.2.105 65228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:29:45.047342 0.062331 tcp 10.0.2.105 65229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:29:45.110033 0.154401 tcp 10.0.2.105 65230 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:29:45.265086 0.076629 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:29:45.323030 0.000000 udp 10.0.2.105 7010 -> 5.13.50.47 2778 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 12:29:50.410520 2.998601 tcp 10.0.2.105 65231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:29:59.403787 0.000000 tcp 10.0.2.105 65231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:30:01.867827 0.065501 tcp 10.0.2.105 65232 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:01.933638 0.063542 tcp 10.0.2.105 65233 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:01.997547 0.171245 tcp 10.0.2.105 65234 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:02.169327 0.000000 udp 10.0.2.105 7010 -> 23.114.13.50 6744 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 12:30:05.413045 0.065608 tcp 10.0.2.105 65235 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:05.478932 0.066016 tcp 10.0.2.105 65236 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:05.545211 0.155425 tcp 10.0.2.105 65237 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:05.788433 2.998762 tcp 10.0.2.105 65238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:30:14.785902 0.000000 tcp 10.0.2.105 65238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:30:19.113004 0.067018 tcp 10.0.2.105 65239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:19.180457 0.066527 tcp 10.0.2.105 65240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:19.247245 0.157066 tcp 10.0.2.105 65241 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:19.404930 0.089812 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:19.453663 0.218483 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:19.888379 0.176691 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:20.060820 0.124786 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:20.165757 0.115492 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:20.346693 0.226378 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:20.568152 0.250649 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:20.924845 0.356064 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:21.253305 0.048101 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:21.368010 0.173982 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:21.538798 0.187705 udp 10.0.2.105 7010 <-> 99.45.219.20 8011 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:21.751701 0.055452 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:21.920854 0.183252 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:22.075896 0.175197 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:22.555787 0.175062 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:22.789599 0.186046 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:22.953711 0.169410 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.102856 0.096247 udp 10.0.2.105 7010 <-> 84.173.62.178 7912 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.251739 0.063607 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.311994 0.190294 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.499387 0.094039 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.800980 0.116960 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:23.914799 0.443217 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:24.358315 0.212892 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:24.535013 0.349831 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:24.991877 0.056137 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:25.045460 0.153304 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:25.313276 0.455667 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:25.749142 0.091788 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:25.825590 0.201792 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:26.052947 0.293005 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:26.518671 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 12:30:45.390454 0.063460 tcp 10.0.2.105 65242 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:45.454238 0.065739 tcp 10.0.2.105 65243 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:45.520542 0.157298 tcp 10.0.2.105 65244 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:30:45.678858 0.187433 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:45.863313 0.056966 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:30:46.257392 0.226894 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/15 12:31:54.512006 3.432402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:32:01.912586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:32:09.844362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:32:25.697212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:32:57.539928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:35:20.786133 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:35:20.786246 3.003932 tcp 10.0.2.105 65245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:35:29.799126 0.000000 tcp 10.0.2.105 65245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:35:35.789664 0.066822 tcp 10.0.2.105 65246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:35.856754 0.075966 tcp 10.0.2.105 65247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:35.932623 0.153624 tcp 10.0.2.105 65248 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:36.258952 3.006032 tcp 10.0.2.105 65249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:35:45.262881 0.000000 tcp 10.0.2.105 65249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:35:51.260129 0.060723 tcp 10.0.2.105 65250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:51.321147 0.139352 tcp 10.0.2.105 65251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:51.460801 0.156455 tcp 10.0.2.105 65252 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:35:51.879770 2.994686 tcp 10.0.2.105 65253 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:00.873341 0.000000 tcp 10.0.2.105 65253 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:06.873263 0.064372 tcp 10.0.2.105 65254 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:36:06.937927 0.077195 tcp 10.0.2.105 65255 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:36:07.015409 0.162866 tcp 10.0.2.105 65256 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:36:07.500484 2.996869 tcp 10.0.2.105 65257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:16.495975 0.000000 tcp 10.0.2.105 65257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:22.495016 3.003955 tcp 10.0.2.105 65258 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:31.497430 0.000000 tcp 10.0.2.105 65258 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:36.384580 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:36:37.496285 3.007071 tcp 10.0.2.105 65259 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:36:46.498870 0.000000 tcp 10.0.2.105 65259 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:39:01.546215 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:39:08.580558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:39:16.564940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:39:32.567944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:40:04.576825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:41:52.499798 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:41:52.500000 3.003453 tcp 10.0.2.105 65260 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:01.512163 0.000000 tcp 10.0.2.105 65260 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:07.502108 0.064616 tcp 10.0.2.105 65261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:07.567050 0.065041 tcp 10.0.2.105 65262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:07.632400 0.164017 tcp 10.0.2.105 65263 -> 195.113.214.249 443 SRPA* 0 0 38 19014 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:08.164632 3.001288 tcp 10.0.2.105 65264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:17.164710 0.000000 tcp 10.0.2.105 65264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:23.163622 0.063650 tcp 10.0.2.105 65265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:23.227526 0.063595 tcp 10.0.2.105 65266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:23.291412 0.158973 tcp 10.0.2.105 65267 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:23.936174 3.527196 tcp 10.0.2.105 65268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:33.388660 0.000000 tcp 10.0.2.105 65268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:39.332357 0.063505 tcp 10.0.2.105 65269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:39.396153 0.062643 tcp 10.0.2.105 65270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:39.459081 0.151872 tcp 10.0.2.105 65271 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:42:39.776905 2.977298 tcp 10.0.2.105 65272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:48.682314 0.000000 tcp 10.0.2.105 65272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:42:54.603764 2.971098 tcp 10.0.2.105 65273 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:43:03.501836 0.000000 tcp 10.0.2.105 65273 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:43:08.415053 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:43:09.427563 2.966360 tcp 10.0.2.105 65274 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:43:18.402243 0.000000 tcp 10.0.2.105 65274 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:46:08.583357 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:46:15.587476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:46:23.589531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:46:39.591783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:47:11.598026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:48:24.403194 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:48:24.403354 3.003373 tcp 10.0.2.105 65275 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:48:33.405527 0.000000 tcp 10.0.2.105 65275 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:48:39.405419 0.061659 tcp 10.0.2.105 65276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:39.467346 0.067145 tcp 10.0.2.105 65277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:39.534780 0.155462 tcp 10.0.2.105 65278 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:39.978381 3.000957 tcp 10.0.2.105 65279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:48:48.977926 0.000000 tcp 10.0.2.105 65279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:48:54.977175 0.061466 tcp 10.0.2.105 65280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:55.038221 0.065995 tcp 10.0.2.105 65281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:55.104556 0.158980 tcp 10.0.2.105 65282 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:48:55.340961 3.000243 tcp 10.0.2.105 65283 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:04.340950 0.000000 tcp 10.0.2.105 65283 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:10.339443 0.060528 tcp 10.0.2.105 65284 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:49:10.400258 0.066849 tcp 10.0.2.105 65285 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:49:10.467408 0.155018 tcp 10.0.2.105 65286 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:49:10.813536 3.003853 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:19.822646 0.000000 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:25.811053 2.994211 tcp 10.0.2.105 65288 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:34.803834 0.000000 tcp 10.0.2.105 65288 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:39.384977 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:49:40.814748 2.993628 tcp 10.0.2.105 65289 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:49:49.807571 0.000000 tcp 10.0.2.105 65289 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:53:15.606124 3.006539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 12:53:22.611724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:53:30.618433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:53:46.615711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:54:18.621810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 12:54:55.819908 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:54:55.820056 3.000787 tcp 10.0.2.105 65290 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:04.823263 0.000000 tcp 10.0.2.105 65290 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:10.818788 0.065048 tcp 10.0.2.105 65291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:10.884146 0.068285 tcp 10.0.2.105 65292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:10.952737 0.168341 tcp 10.0.2.105 65293 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:11.187983 3.005439 tcp 10.0.2.105 65294 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:20.190679 0.000000 tcp 10.0.2.105 65294 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:26.189802 0.063734 tcp 10.0.2.105 65295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:26.253839 0.064372 tcp 10.0.2.105 65296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:26.318493 0.330271 tcp 10.0.2.105 65297 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:27.111941 2.992595 tcp 10.0.2.105 65298 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:36.112936 0.000000 tcp 10.0.2.105 65298 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:42.114200 0.068418 tcp 10.0.2.105 65299 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:42.182929 0.062579 tcp 10.0.2.105 65300 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:42.245767 0.168911 tcp 10.0.2.105 65301 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/15 12:55:42.548210 2.998905 tcp 10.0.2.105 65302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:51.545528 0.000000 tcp 10.0.2.105 65302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:55:57.544173 3.004240 tcp 10.0.2.105 65303 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:56:06.547190 0.000000 tcp 10.0.2.105 65303 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:56:11.384045 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 12:56:12.549140 3.001087 tcp 10.0.2.105 65304 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 12:56:21.548726 0.000000 tcp 10.0.2.105 65304 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:00:22.630236 2.999592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:00:29.635297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:00:37.636834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:00:53.640005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:01:03.784764 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:01:03.784956 0.230128 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:04.007613 0.339179 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:04.591068 0.176935 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:04.764685 0.124457 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:04.869901 0.089550 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:05.035384 0.221904 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:05.331898 0.254396 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:05.548393 0.182651 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:05.811929 0.116447 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:05.894660 0.437625 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:06.305305 0.000000 udp 10.0.2.105 7010 -> 99.45.219.20 8011 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:01:22.723448 0.061386 tcp 10.0.2.105 65305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:22.785045 0.067970 tcp 10.0.2.105 65306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:22.853335 0.159825 tcp 10.0.2.105 65307 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:23.013794 0.057782 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:23.142783 0.246741 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:23.360219 0.174126 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:23.531304 0.047316 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:23.736661 0.181802 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:23.894642 0.168376 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:24.043672 0.000000 udp 10.0.2.105 7010 -> 84.173.62.178 7912 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:01:25.645651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:01:27.549196 3.003682 tcp 10.0.2.105 65308 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:01:36.561435 0.000000 tcp 10.0.2.105 65308 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:01:42.430406 0.105335 tcp 10.0.2.105 65309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.536019 0.066077 tcp 10.0.2.105 65310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.551061 0.059976 tcp 10.0.2.105 65311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.602369 0.156658 tcp 10.0.2.105 65312 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.611345 0.060172 tcp 10.0.2.105 65313 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.671864 0.238097 tcp 10.0.2.105 65314 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:42.812143 0.193985 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:42.965728 2.998986 tcp 10.0.2.105 65315 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:01:43.167212 0.209978 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:43.370314 0.095243 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:43.529695 0.147499 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:43.761738 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:01:51.963635 0.000000 tcp 10.0.2.105 65315 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:01:57.962823 0.059654 tcp 10.0.2.105 65316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:58.022807 0.061884 tcp 10.0.2.105 65317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:58.084966 0.159639 tcp 10.0.2.105 65318 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:58.602337 2.995077 tcp 10.0.2.105 65319 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:01:59.124210 0.063891 tcp 10.0.2.105 65320 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:59.188586 0.069083 tcp 10.0.2.105 65321 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:59.258005 0.163549 tcp 10.0.2.105 65322 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:01:59.422034 0.189761 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:59.608924 0.166736 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:59.934570 0.055704 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:01:59.987034 0.213524 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:00.164777 0.353007 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:00.712425 0.093818 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:00.789560 0.201260 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:01.208725 0.448962 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:01.636950 0.153948 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:01.804849 0.302814 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:02.193805 0.188302 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:02.377940 0.056938 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:02.455339 0.229695 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:02:07.596928 0.000000 tcp 10.0.2.105 65319 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:02:13.594544 3.004665 tcp 10.0.2.105 65323 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:02:22.597609 0.000000 tcp 10.0.2.105 65323 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:02:27.384214 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:07:28.598282 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:07:28.598444 3.005412 tcp 10.0.2.105 65324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:07:29.653998 2.999563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:07:36.659417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:07:37.600784 0.000000 tcp 10.0.2.105 65324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:07:43.603063 0.071661 tcp 10.0.2.105 65325 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:43.674700 0.061353 tcp 10.0.2.105 65326 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:43.736350 0.175450 tcp 10.0.2.105 65327 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:43.951306 2.992755 tcp 10.0.2.105 65328 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:07:44.661074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:07:52.952535 0.000000 tcp 10.0.2.105 65328 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:07:58.952117 0.060851 tcp 10.0.2.105 65329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:59.013215 0.066578 tcp 10.0.2.105 65330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:59.080119 0.161334 tcp 10.0.2.105 65331 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:07:59.378915 2.997291 tcp 10.0.2.105 65332 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:00.663649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:08:08.375015 0.000000 tcp 10.0.2.105 65332 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:14.373876 0.061734 tcp 10.0.2.105 65333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:08:14.435921 0.061352 tcp 10.0.2.105 65334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:08:14.497577 0.169021 tcp 10.0.2.105 65335 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:08:14.750133 2.998117 tcp 10.0.2.105 65336 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:23.747068 0.000000 tcp 10.0.2.105 65336 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:29.745525 3.004365 tcp 10.0.2.105 65337 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:32.669714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:08:38.748586 0.000000 tcp 10.0.2.105 65337 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:43.385714 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:08:44.747367 3.003981 tcp 10.0.2.105 65338 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:08:53.750077 0.000000 tcp 10.0.2.105 65338 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:13:59.750444 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:13:59.750552 2.993607 tcp 10.0.2.105 65339 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:08.752739 0.000000 tcp 10.0.2.105 65339 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:14.753322 0.066949 tcp 10.0.2.105 65340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:14.820592 0.067403 tcp 10.0.2.105 65341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:14.888199 0.147497 tcp 10.0.2.105 65342 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:15.377582 2.999336 tcp 10.0.2.105 65343 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:24.375327 0.000000 tcp 10.0.2.105 65343 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:30.375272 1.477273 tcp 10.0.2.105 65344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:31.852816 0.063194 tcp 10.0.2.105 65345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:31.916357 0.162123 tcp 10.0.2.105 65346 -> 195.113.214.249 443 SRPA* 0 0 34 18150 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:32.314188 2.961579 tcp 10.0.2.105 65347 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:38.011870 2.958866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:14:41.199058 0.000000 tcp 10.0.2.105 65347 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:44.930551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:14:47.139414 0.133432 tcp 10.0.2.105 65348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:47.273127 0.062612 tcp 10.0.2.105 65349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:47.336037 0.158507 tcp 10.0.2.105 65350 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:14:48.459995 2.968450 tcp 10.0.2.105 65351 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:14:52.857617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:14:57.351572 0.000000 tcp 10.0.2.105 65351 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:15:03.275137 2.959188 tcp 10.0.2.105 65352 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:15:08.662844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:15:10.821765 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:15:12.167830 0.000000 tcp 10.0.2.105 65352 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:15:18.093760 2.953464 tcp 10.0.2.105 65353 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:15:26.972461 0.000000 tcp 10.0.2.105 65353 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:15:40.271422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:20:32.244613 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:20:32.244768 3.004236 tcp 10.0.2.105 65354 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:20:41.311746 0.000000 tcp 10.0.2.105 65354 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:20:47.262313 0.063530 tcp 10.0.2.105 65355 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:20:47.326124 0.064697 tcp 10.0.2.105 65356 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:20:47.391078 0.158398 tcp 10.0.2.105 65357 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:20:47.558749 2.992161 tcp 10.0.2.105 65358 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:20:56.549815 0.000000 tcp 10.0.2.105 65358 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:02.538369 0.060023 tcp 10.0.2.105 65359 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:02.598663 0.064381 tcp 10.0.2.105 65360 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:02.663344 0.149435 tcp 10.0.2.105 65361 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:03.004769 3.008438 tcp 10.0.2.105 65362 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:12.154675 0.000000 tcp 10.0.2.105 65362 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:18.077207 0.064981 tcp 10.0.2.105 65363 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:18.142493 0.061485 tcp 10.0.2.105 65364 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:18.204349 0.157420 tcp 10.0.2.105 65365 -> 195.113.214.249 443 SRPA* 0 0 29 13660 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:21:18.823361 2.970292 tcp 10.0.2.105 65366 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:27.754088 0.000000 tcp 10.0.2.105 65366 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:33.752950 3.004246 tcp 10.0.2.105 65367 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:42.755563 0.000000 tcp 10.0.2.105 65367 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:43.719938 3.001361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:21:47.382549 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:21:48.759389 2.999219 tcp 10.0.2.105 65368 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:50.728804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:21:57.757593 0.000000 tcp 10.0.2.105 65368 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:21:58.728814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:22:14.731554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:22:46.737901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:27:03.763476 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:27:03.763585 2.998544 tcp 10.0.2.105 65369 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:12.760389 0.000000 tcp 10.0.2.105 65369 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:18.760851 0.068999 tcp 10.0.2.105 65370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:18.830118 0.068334 tcp 10.0.2.105 65371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:18.898705 0.161177 tcp 10.0.2.105 65372 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:19.303841 2.999929 tcp 10.0.2.105 65373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:28.312755 0.000000 tcp 10.0.2.105 65373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:34.301708 0.064551 tcp 10.0.2.105 65374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:34.366118 0.130377 tcp 10.0.2.105 65375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:34.496793 0.156512 tcp 10.0.2.105 65376 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:27:34.931591 2.984734 tcp 10.0.2.105 65377 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:43.920459 0.000000 tcp 10.0.2.105 65377 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:49.933205 3.005543 tcp 10.0.2.105 65378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:27:58.936089 0.000000 tcp 10.0.2.105 65378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:28:03.883570 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:28:50.744998 3.000007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:28:57.751094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:29:05.752138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:29:21.755640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:29:53.761327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:32:04.540144 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:32:04.540395 0.000000 udp 10.0.2.105 7010 -> 99.45.219.20 8011 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:32:22.006332 0.062479 tcp 10.0.2.105 65379 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:22.069112 0.062120 tcp 10.0.2.105 65380 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:22.131531 0.159334 tcp 10.0.2.105 65381 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:22.291362 0.000000 udp 10.0.2.105 7010 -> 84.173.62.178 7912 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:32:38.449338 0.067193 tcp 10.0.2.105 65382 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:38.516820 0.066498 tcp 10.0.2.105 65383 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:38.583623 0.157308 tcp 10.0.2.105 65384 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:38.741489 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 13:32:57.536774 0.064250 tcp 10.0.2.105 65385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:57.601296 0.061372 tcp 10.0.2.105 65386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:57.662964 0.157025 tcp 10.0.2.105 65387 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:32:57.820820 0.231138 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2558 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:58.044222 0.434750 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:58.461143 0.124853 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:58.670528 0.177286 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:58.844131 0.085128 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:58.891882 0.218394 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:59.102709 0.250037 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:59.329456 0.354136 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:59.657482 0.119559 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:59.815490 0.182665 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:32:59.993577 0.176254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.164973 0.059229 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.420797 0.186019 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.575935 0.179810 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.733250 0.045402 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.829293 0.167181 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:00.977657 0.189553 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:01.262117 0.175389 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:01.429411 0.196826 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:01.560038 0.094166 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:02.014310 0.056260 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:02.067228 0.209319 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:02.239755 0.190905 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:02.866869 0.170108 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:03.139314 0.348636 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:03.568467 0.095473 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:03.648485 0.205234 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:04.043116 0.302727 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:04.499597 0.185706 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:04.681275 0.057099 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:04.756807 0.468575 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:04.936850 3.004193 tcp 10.0.2.105 65388 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:05.202157 0.156362 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:05.520168 0.228151 udp 10.0.2.105 7010 <-> 76.217.180.151 1314 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/15 13:33:13.939570 0.000000 tcp 10.0.2.105 65388 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:19.938774 0.063774 tcp 10.0.2.105 65389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:20.002845 0.063411 tcp 10.0.2.105 65390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:20.066601 0.151411 tcp 10.0.2.105 65391 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:20.906642 2.997052 tcp 10.0.2.105 65392 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:29.912641 0.000000 tcp 10.0.2.105 65392 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:35.901372 0.060923 tcp 10.0.2.105 65393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:35.962543 0.062617 tcp 10.0.2.105 65394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:36.025522 0.170019 tcp 10.0.2.105 65395 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:36.235484 3.000659 tcp 10.0.2.105 65396 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:45.233915 0.000000 tcp 10.0.2.105 65396 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:33:51.233704 0.060729 tcp 10.0.2.105 65397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:51.294686 0.064856 tcp 10.0.2.105 65398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:51.359830 0.217807 tcp 10.0.2.105 65399 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:33:51.981263 2.997499 tcp 10.0.2.105 65400 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:34:00.977184 0.000000 tcp 10.0.2.105 65400 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:34:06.980092 3.000709 tcp 10.0.2.105 65401 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:34:14.877097 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:34:15.978802 0.000000 tcp 10.0.2.105 65401 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:34:21.977412 3.005349 tcp 10.0.2.105 65402 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:34:30.980642 0.000000 tcp 10.0.2.105 65402 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:35:57.768082 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:36:04.775098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:36:12.776794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:36:28.779638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:37:00.785857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:39:36.981213 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:39:36.981502 2.992970 tcp 10.0.2.105 65403 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:39:45.973231 0.000000 tcp 10.0.2.105 65403 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:39:51.983293 0.060482 tcp 10.0.2.105 65404 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:39:52.044052 0.062175 tcp 10.0.2.105 65405 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:39:52.106531 0.143979 tcp 10.0.2.105 65406 -> 195.113.214.249 443 SRPA* 0 0 57 54281 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:39:52.460417 2.996101 tcp 10.0.2.105 65407 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:01.455443 0.000000 tcp 10.0.2.105 65407 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:07.454501 0.059927 tcp 10.0.2.105 65408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:07.514712 0.068165 tcp 10.0.2.105 65409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:07.583178 0.159426 tcp 10.0.2.105 65410 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:07.848858 3.000109 tcp 10.0.2.105 65411 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:16.847557 0.000000 tcp 10.0.2.105 65411 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:22.846834 0.070345 tcp 10.0.2.105 65412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:22.917471 0.120508 tcp 10.0.2.105 65413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:23.038276 0.156314 tcp 10.0.2.105 65414 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:40:23.527964 3.003366 tcp 10.0.2.105 65415 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:32.530245 0.000000 tcp 10.0.2.105 65415 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:38.528984 3.004124 tcp 10.0.2.105 65416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:47.541833 0.000000 tcp 10.0.2.105 65416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:40:52.381301 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:40:53.531488 2.992602 tcp 10.0.2.105 65417 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:41:02.533115 0.000000 tcp 10.0.2.105 65417 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:43:04.792462 3.000962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:43:11.799175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:43:19.800748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:43:35.803640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:44:07.810728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:46:08.536793 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:46:08.536902 3.000599 tcp 10.0.2.105 65418 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:17.540882 0.000000 tcp 10.0.2.105 65418 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:23.536970 0.064234 tcp 10.0.2.105 65419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:23.601476 0.063782 tcp 10.0.2.105 65420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:23.665516 0.148469 tcp 10.0.2.105 65421 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:24.194486 3.006578 tcp 10.0.2.105 65422 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:33.198627 0.000000 tcp 10.0.2.105 65422 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:39.189205 0.059953 tcp 10.0.2.105 65423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:39.249477 0.063134 tcp 10.0.2.105 65424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:39.312926 0.210554 tcp 10.0.2.105 65425 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:39.726544 3.006058 tcp 10.0.2.105 65426 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:48.730902 0.000000 tcp 10.0.2.105 65426 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:46:54.720145 0.061667 tcp 10.0.2.105 65427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:54.782053 0.065058 tcp 10.0.2.105 65428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:54.847369 0.166970 tcp 10.0.2.105 65429 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:46:55.150464 2.993974 tcp 10.0.2.105 65430 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:47:04.143282 0.000000 tcp 10.0.2.105 65430 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:47:10.152145 2.994060 tcp 10.0.2.105 65431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:47:19.144913 0.000000 tcp 10.0.2.105 65431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:47:23.881603 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:47:25.153603 3.004185 tcp 10.0.2.105 65432 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:47:34.156649 0.000000 tcp 10.0.2.105 65432 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:52:40.156481 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:52:40.156626 3.004104 tcp 10.0.2.105 65433 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:52:49.159094 0.000000 tcp 10.0.2.105 65433 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:52:55.160126 0.065854 tcp 10.0.2.105 65434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:52:55.226243 0.066185 tcp 10.0.2.105 65435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:52:55.292720 0.159888 tcp 10.0.2.105 65436 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:52:55.719767 3.002956 tcp 10.0.2.105 65437 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:04.731812 0.000000 tcp 10.0.2.105 65437 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:10.722381 0.069726 tcp 10.0.2.105 65438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:10.792542 0.061343 tcp 10.0.2.105 65439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:10.854258 0.185301 tcp 10.0.2.105 65440 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:11.234072 3.377118 tcp 10.0.2.105 65441 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:20.554025 0.000000 tcp 10.0.2.105 65441 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:26.504847 0.064238 tcp 10.0.2.105 65442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:26.569364 0.064662 tcp 10.0.2.105 65443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:26.634278 0.163141 tcp 10.0.2.105 65444 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 13:53:27.115034 2.966083 tcp 10.0.2.105 65445 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:36.023177 0.000000 tcp 10.0.2.105 65445 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:41.966567 2.975989 tcp 10.0.2.105 65446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:50.883519 0.000000 tcp 10.0.2.105 65446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:53:55.389098 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 13:53:56.858038 3.002417 tcp 10.0.2.105 65447 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:54:05.859317 0.000000 tcp 10.0.2.105 65447 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 13:55:39.817319 3.005531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 13:55:46.824025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:55:54.826146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:56:10.828871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 13:56:42.835306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:02:46.841628 3.026437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 14:02:53.858819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:03:01.861049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:03:17.862782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:03:23.041142 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:03:23.041255 0.222953 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.257164 0.175850 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.429792 0.086101 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.513233 0.215924 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.721504 0.075800 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.781532 0.125017 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:23.885929 0.254539 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:24.104597 0.357072 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:24.434901 0.112887 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:24.516074 0.184350 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:24.787254 0.167993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:24.952578 0.181732 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.111691 0.045812 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.244173 0.167244 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.392425 0.056532 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.511214 0.185848 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.668829 0.199563 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:25.916698 0.172997 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.082596 0.167926 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.170245 0.094819 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.280459 0.056656 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.333818 0.207189 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.505118 0.187068 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.689647 0.170350 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:26.938773 3.001243 tcp 10.0.2.105 65448 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:03:26.949907 0.202991 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:27.171602 0.353844 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:27.521333 0.097025 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:27.605060 0.307433 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:27.997243 0.187976 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:28.180966 0.061513 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:28.305511 0.512147 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:28.784110 0.154222 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:03:29.037425 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 14:03:35.939206 0.000000 tcp 10.0.2.105 65448 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:03:41.944845 0.061188 tcp 10.0.2.105 65449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:42.006338 0.062429 tcp 10.0.2.105 65450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:42.069091 0.153910 tcp 10.0.2.105 65451 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:42.445494 2.997284 tcp 10.0.2.105 65452 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:03:47.797088 0.064777 tcp 10.0.2.105 65453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:47.862156 0.065723 tcp 10.0.2.105 65454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:47.928308 0.154253 tcp 10.0.2.105 65455 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:49.869457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:03:51.441616 0.000000 tcp 10.0.2.105 65452 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:03:57.440780 0.066649 tcp 10.0.2.105 65456 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:57.507788 0.062818 tcp 10.0.2.105 65457 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:57.570876 0.166009 tcp 10.0.2.105 65458 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:03:57.777541 2.997244 tcp 10.0.2.105 65459 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:06.773454 0.000000 tcp 10.0.2.105 65459 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:12.772660 0.058997 tcp 10.0.2.105 65460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:04:12.831949 0.064671 tcp 10.0.2.105 65461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:04:12.896920 0.171816 tcp 10.0.2.105 65462 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:04:13.196375 3.000801 tcp 10.0.2.105 65463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:22.202538 0.000000 tcp 10.0.2.105 65463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:28.194499 3.004283 tcp 10.0.2.105 65464 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:37.197274 0.000000 tcp 10.0.2.105 65464 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:41.883831 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:04:43.196028 3.004167 tcp 10.0.2.105 65465 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:04:52.198933 0.000000 tcp 10.0.2.105 65465 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:09:58.199504 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:09:58.199601 2.993423 tcp 10.0.2.105 65466 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:07.201632 0.000000 tcp 10.0.2.105 65466 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:13.203821 0.063535 tcp 10.0.2.105 65467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:13.267636 0.060743 tcp 10.0.2.105 65468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:13.328643 0.155045 tcp 10.0.2.105 65469 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:13.566736 2.998387 tcp 10.0.2.105 65470 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:15.876561 3.002054 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:10:22.563765 0.000000 tcp 10.0.2.105 65470 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:22.884145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:10:28.563462 0.061568 tcp 10.0.2.105 65471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:28.625299 0.064891 tcp 10.0.2.105 65472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:28.690557 0.152880 tcp 10.0.2.105 65473 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:28.899369 2.997662 tcp 10.0.2.105 65474 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:30.885752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:10:37.895762 0.000000 tcp 10.0.2.105 65474 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:43.895499 0.066677 tcp 10.0.2.105 65475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:43.962466 0.061667 tcp 10.0.2.105 65476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:44.024481 0.163961 tcp 10.0.2.105 65477 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:10:44.278221 3.001035 tcp 10.0.2.105 65478 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:46.889228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:10:53.278007 0.000000 tcp 10.0.2.105 65478 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:10:59.641949 2.981304 tcp 10.0.2.105 65479 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:11:08.565314 0.000000 tcp 10.0.2.105 65479 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:11:13.114958 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:11:14.506806 2.977717 tcp 10.0.2.105 65480 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:11:19.077697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:11:23.424138 0.000000 tcp 10.0.2.105 65480 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:16:29.281486 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:16:29.281659 2.993594 tcp 10.0.2.105 65481 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:16:38.273857 0.000000 tcp 10.0.2.105 65481 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:16:45.096788 0.060602 tcp 10.0.2.105 65482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:16:45.157667 0.065225 tcp 10.0.2.105 65483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:16:45.223215 0.217550 tcp 10.0.2.105 65484 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:16:45.591330 2.962057 tcp 10.0.2.105 65485 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:16:54.478929 0.000000 tcp 10.0.2.105 65485 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:00.407731 0.067435 tcp 10.0.2.105 65486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:00.475467 0.063034 tcp 10.0.2.105 65487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:00.538884 0.170333 tcp 10.0.2.105 65488 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:00.996908 2.965246 tcp 10.0.2.105 65489 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:09.887159 0.000000 tcp 10.0.2.105 65489 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:15.812246 0.063887 tcp 10.0.2.105 65490 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:15.876417 0.063721 tcp 10.0.2.105 65491 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:15.940604 0.150738 tcp 10.0.2.105 65492 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:17:16.342483 2.965419 tcp 10.0.2.105 65493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:23.243465 2.967140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:17:25.231741 0.000000 tcp 10.0.2.105 65493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:30.162926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:17:31.153684 2.956017 tcp 10.0.2.105 65494 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:38.066213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:17:40.044365 0.000000 tcp 10.0.2.105 65494 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:44.951201 0.018985 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:17:45.979446 2.952548 tcp 10.0.2.105 65495 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:17:53.912735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:17:54.904409 0.000000 tcp 10.0.2.105 65495 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:18:25.918868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:23:00.914465 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:23:00.914600 3.004103 tcp 10.0.2.105 65496 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:09.916927 0.000000 tcp 10.0.2.105 65496 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:15.916934 0.061226 tcp 10.0.2.105 65497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:15.978709 0.060025 tcp 10.0.2.105 65498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:16.038970 0.161583 tcp 10.0.2.105 65499 -> 195.113.214.249 443 SRPA* 0 0 36 18460 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:16.358369 3.003036 tcp 10.0.2.105 65500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:25.359353 0.000000 tcp 10.0.2.105 65500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:31.358717 0.059678 tcp 10.0.2.105 65501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:31.418658 0.063769 tcp 10.0.2.105 65502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:31.482710 0.688713 tcp 10.0.2.105 65503 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:32.339756 2.993798 tcp 10.0.2.105 65504 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:41.342144 0.000000 tcp 10.0.2.105 65504 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:47.341441 0.063335 tcp 10.0.2.105 65505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:47.405074 0.119111 tcp 10.0.2.105 65506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:47.524637 0.156385 tcp 10.0.2.105 65507 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:23:47.899280 2.996038 tcp 10.0.2.105 65508 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:23:56.894793 0.000000 tcp 10.0.2.105 65508 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:24:02.893223 3.004279 tcp 10.0.2.105 65509 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:24:11.895995 0.000000 tcp 10.0.2.105 65509 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:24:16.882709 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:24:17.895180 3.003692 tcp 10.0.2.105 65510 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:24:26.897297 0.000000 tcp 10.0.2.105 65510 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:24:29.925609 3.002574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:24:36.933853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:24:44.933585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:25:00.936856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:25:32.942499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:31:36.949392 3.001433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 14:31:43.956421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:31:51.957415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:32:07.960659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:32:39.966705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:33:48.585318 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:33:48.585401 0.000000 udp 10.0.2.105 7010 -> 76.217.180.151 1314 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 14:34:04.691075 0.061939 tcp 10.0.2.105 65511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:04.753309 0.064107 tcp 10.0.2.105 65512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:04.817705 0.157124 tcp 10.0.2.105 65513 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:04.975514 0.085275 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:05.023472 0.212910 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:05.229498 0.271416 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:05.515713 0.176086 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:05.688096 0.125656 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:05.795568 0.248078 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.008417 0.353256 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.332715 0.132738 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.430479 0.074030 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.630006 0.046012 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.660100 0.169807 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:06.864976 0.180743 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:07.020732 0.173674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:07.361605 0.182766 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:07.539447 0.187104 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:07.698672 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 14:34:17.927840 3.004155 tcp 10.0.2.105 65514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:34:23.616168 0.062385 tcp 10.0.2.105 65515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:23.678869 0.067345 tcp 10.0.2.105 65516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:23.746486 0.159769 tcp 10.0.2.105 65517 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:23.906837 0.173855 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:24.072953 0.184215 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:24.262993 0.096121 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:24.348789 0.061378 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:24.471172 0.188238 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:24.743784 0.180585 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:25.121483 0.203473 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 1949 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:25.493213 0.208340 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:25.665435 0.189321 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:25.895392 0.358820 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:26.285986 0.304162 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:26.866891 0.097360 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:26.929937 0.000000 tcp 10.0.2.105 65514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:34:26.947795 0.057756 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:27.048081 0.187816 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:27.232004 0.478656 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:27.689922 0.153122 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/15 14:34:32.935102 0.064638 tcp 10.0.2.105 65518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:33.000068 0.065288 tcp 10.0.2.105 65519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:33.065627 0.152244 tcp 10.0.2.105 65520 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:33.365457 2.989083 tcp 10.0.2.105 65521 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:34:42.364638 0.000000 tcp 10.0.2.105 65521 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:34:48.362222 0.061059 tcp 10.0.2.105 65522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:48.423579 0.063623 tcp 10.0.2.105 65523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:48.487512 0.152868 tcp 10.0.2.105 65524 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:34:48.737103 2.998835 tcp 10.0.2.105 65525 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:34:57.734669 0.000000 tcp 10.0.2.105 65525 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:35:03.733308 3.004649 tcp 10.0.2.105 65526 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:35:12.736527 0.000000 tcp 10.0.2.105 65526 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:35:17.383093 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:38:43.973786 3.000709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:38:50.980046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:38:58.981379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:39:14.986209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:39:46.990761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:40:18.736643 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:40:18.736730 3.003761 tcp 10.0.2.105 65527 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:40:27.739153 0.000000 tcp 10.0.2.105 65527 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:40:33.739590 0.066525 tcp 10.0.2.105 65528 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:33.806487 0.063298 tcp 10.0.2.105 65529 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:33.869628 0.151228 tcp 10.0.2.105 65530 -> 195.113.214.249 443 SRPA* 0 0 42 21506 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:34.202168 2.990568 tcp 10.0.2.105 65531 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:40:43.201642 0.000000 tcp 10.0.2.105 65531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:40:49.200709 0.063778 tcp 10.0.2.105 65532 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:49.264784 0.061657 tcp 10.0.2.105 65533 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:49.326746 0.152548 tcp 10.0.2.105 65534 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:40:49.679503 2.995562 tcp 10.0.2.105 49157 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:40:58.673631 0.000000 tcp 10.0.2.105 49157 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:04.673174 0.063980 tcp 10.0.2.105 49158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:41:04.737418 0.064899 tcp 10.0.2.105 49159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:41:04.802663 0.157871 tcp 10.0.2.105 49160 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:41:05.061676 2.995449 tcp 10.0.2.105 49161 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:14.055862 0.000000 tcp 10.0.2.105 49161 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:20.054442 3.004862 tcp 10.0.2.105 49162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:29.057453 0.000000 tcp 10.0.2.105 49162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:33.884220 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:41:35.056081 3.004157 tcp 10.0.2.105 49163 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:41:44.058999 0.000000 tcp 10.0.2.105 49163 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:45:50.996533 3.003551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:45:58.003898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:46:06.005776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:46:22.008604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:46:50.059521 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:46:50.059604 3.003142 tcp 10.0.2.105 49164 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:46:54.024157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:46:59.071680 0.000000 tcp 10.0.2.105 49164 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:05.062816 0.061904 tcp 10.0.2.105 49165 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:05.125083 0.061684 tcp 10.0.2.105 49166 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:05.187080 0.158598 tcp 10.0.2.105 49167 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:05.556358 2.999565 tcp 10.0.2.105 49168 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:14.554100 0.000000 tcp 10.0.2.105 49168 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:20.553831 0.061629 tcp 10.0.2.105 49169 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:20.615744 0.061912 tcp 10.0.2.105 49170 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:20.677973 0.153432 tcp 10.0.2.105 49171 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:20.936649 3.001172 tcp 10.0.2.105 49172 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:29.936026 0.000000 tcp 10.0.2.105 49172 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:35.935366 0.064358 tcp 10.0.2.105 49173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:36.000003 0.065273 tcp 10.0.2.105 49174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:36.065545 0.157765 tcp 10.0.2.105 49175 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:47:36.329514 3.000217 tcp 10.0.2.105 49176 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:45.328476 0.000000 tcp 10.0.2.105 49176 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:47:51.326765 3.004401 tcp 10.0.2.105 49177 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:48:00.329853 0.000000 tcp 10.0.2.105 49177 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:48:04.876523 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:48:06.328974 2.993995 tcp 10.0.2.105 49178 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:48:15.331583 0.000000 tcp 10.0.2.105 49178 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:53:21.332038 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:53:21.332181 2.993592 tcp 10.0.2.105 49179 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:53:30.324585 0.000000 tcp 10.0.2.105 49179 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:53:36.335041 0.064779 tcp 10.0.2.105 49180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:36.400109 0.063852 tcp 10.0.2.105 49181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:36.464270 0.157351 tcp 10.0.2.105 49182 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:36.854998 3.003853 tcp 10.0.2.105 49183 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:53:45.856109 0.000000 tcp 10.0.2.105 49183 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:53:51.860431 0.308079 tcp 10.0.2.105 49184 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:52.168829 0.062014 tcp 10.0.2.105 49185 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:52.231149 0.155831 tcp 10.0.2.105 49186 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:53:52.598474 2.975883 tcp 10.0.2.105 49187 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:01.516966 0.000000 tcp 10.0.2.105 49187 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:07.449502 0.060592 tcp 10.0.2.105 49188 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:54:07.510406 0.061836 tcp 10.0.2.105 49189 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:54:07.572514 0.148395 tcp 10.0.2.105 49190 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 14:54:07.912784 2.979099 tcp 10.0.2.105 49191 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:16.836100 0.000000 tcp 10.0.2.105 49191 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:22.820081 2.994036 tcp 10.0.2.105 49192 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:31.823072 0.000000 tcp 10.0.2.105 49192 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:36.379522 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:54:37.823325 2.992341 tcp 10.0.2.105 49193 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:54:46.814096 0.000000 tcp 10.0.2.105 49193 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 14:57:04.035035 3.000428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 14:57:11.041380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:57:19.042907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:57:35.046166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:58:07.052343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 14:59:52.827407 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 14:59:52.827490 3.001425 tcp 10.0.2.105 49194 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:00:01.829281 0.000000 tcp 10.0.2.105 49194 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:00:07.827735 0.064452 tcp 10.0.2.105 49195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:00:07.892483 0.060369 tcp 10.0.2.105 49196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:00:07.953137 0.152948 tcp 10.0.2.105 49197 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:00:08.507364 3.003747 tcp 10.0.2.105 49198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:00:17.509961 0.000000 tcp 10.0.2.105 49198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:04:11.067213 2.992930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 15:04:18.066022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:04:26.067544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:04:42.071949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:04:43.162285 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:04:43.162438 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 15:04:59.813023 0.064746 tcp 10.0.2.105 49199 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:04:59.878040 0.065984 tcp 10.0.2.105 49200 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:04:59.944469 0.156202 tcp 10.0.2.105 49201 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:00.101356 0.085666 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:00.147792 0.218056 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:00.357137 0.247029 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:00.569657 0.221894 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:00.784482 0.176246 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:00.969160 0.123906 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:01.074327 0.124661 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:01.245632 0.422168 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:01.640215 0.045755 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:01.730028 0.168797 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:01.878536 0.180014 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:02.165187 0.457840 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:02.615509 0.075356 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:02.774953 0.181988 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:02.999100 0.185287 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:03.221890 0.174427 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:03.389009 0.061342 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:03.514567 0.176146 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:03.720276 0.168061 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:03.968271 0.150982 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:04.067455 0.096177 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:04.531910 0.200610 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:04.772630 0.210671 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:04.946634 0.187150 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:05.131144 0.094654 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:05.266660 0.058905 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:05.323752 0.187147 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:05.506932 0.363795 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:05.898403 0.293609 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:06.214203 0.450980 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:06.642354 0.155588 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:05:14.075912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:05:23.510231 2.994042 tcp 10.0.2.105 49202 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:05:28.376646 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:05:32.514637 0.000000 tcp 10.0.2.105 49202 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:05:38.512002 0.061790 tcp 10.0.2.105 49203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:38.574087 0.061537 tcp 10.0.2.105 49204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:38.635963 0.150632 tcp 10.0.2.105 49205 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:39.674120 3.003284 tcp 10.0.2.105 49206 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:05:48.676043 0.000000 tcp 10.0.2.105 49206 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:05:55.788589 0.063053 tcp 10.0.2.105 49207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:55.851999 0.062092 tcp 10.0.2.105 49208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:55.914352 0.166862 tcp 10.0.2.105 49209 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:05:57.365269 2.976564 tcp 10.0.2.105 49210 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:06.266179 0.000000 tcp 10.0.2.105 49210 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:12.180395 0.063440 tcp 10.0.2.105 49211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:06:12.244362 0.061261 tcp 10.0.2.105 49212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:06:12.305979 0.154193 tcp 10.0.2.105 49213 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:06:13.124632 2.962515 tcp 10.0.2.105 49214 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:22.025441 0.000000 tcp 10.0.2.105 49214 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:27.954446 2.953444 tcp 10.0.2.105 49215 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:36.836753 0.000000 tcp 10.0.2.105 49215 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:41.454293 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:06:42.781436 2.959673 tcp 10.0.2.105 49216 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:06:51.670988 0.000000 tcp 10.0.2.105 49216 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:11:18.083286 3.000670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:11:25.089615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:11:33.090786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:11:49.094122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:11:57.226627 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:11:57.226953 3.003047 tcp 10.0.2.105 49217 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:06.228733 0.000000 tcp 10.0.2.105 49217 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:12.229667 0.062354 tcp 10.0.2.105 49218 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:12.292449 0.064158 tcp 10.0.2.105 49219 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:12.357075 0.158325 tcp 10.0.2.105 49220 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:12.780446 3.002107 tcp 10.0.2.105 49221 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:21.100394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:12:21.780971 0.000000 tcp 10.0.2.105 49221 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:27.780206 0.062788 tcp 10.0.2.105 49222 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:27.843314 0.061367 tcp 10.0.2.105 49223 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:27.905011 0.159707 tcp 10.0.2.105 49224 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:28.315552 2.999313 tcp 10.0.2.105 49225 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:37.313481 0.000000 tcp 10.0.2.105 49225 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:43.312650 0.073144 tcp 10.0.2.105 49226 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:43.386055 0.065067 tcp 10.0.2.105 49227 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:43.451399 0.153002 tcp 10.0.2.105 49228 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:12:43.826403 3.000929 tcp 10.0.2.105 49229 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:52.825632 0.000000 tcp 10.0.2.105 49229 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:12:58.824859 3.004046 tcp 10.0.2.105 49230 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:13:07.827400 0.000000 tcp 10.0.2.105 49230 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:13:12.383875 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:13:13.826037 3.003958 tcp 10.0.2.105 49231 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:13:22.829087 0.000000 tcp 10.0.2.105 49231 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:18:25.106350 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:18:28.829341 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:18:28.829538 3.003382 tcp 10.0.2.105 49232 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:18:32.113068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:18:37.841793 0.000000 tcp 10.0.2.105 49232 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:18:40.114948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:18:43.832018 0.063966 tcp 10.0.2.105 49233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:43.896310 0.062329 tcp 10.0.2.105 49234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:43.958902 0.234812 tcp 10.0.2.105 49235 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:44.203422 2.991625 tcp 10.0.2.105 49236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:18:53.193561 0.000000 tcp 10.0.2.105 49236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:18:56.117998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:18:59.203027 0.059023 tcp 10.0.2.105 49237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:59.262341 0.065738 tcp 10.0.2.105 49238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:59.328360 0.154450 tcp 10.0.2.105 49239 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:18:59.958965 2.999118 tcp 10.0.2.105 49240 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:08.956823 0.000000 tcp 10.0.2.105 49240 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:14.956081 0.061481 tcp 10.0.2.105 49241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:19:15.017834 0.064587 tcp 10.0.2.105 49242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:19:15.082740 0.158797 tcp 10.0.2.105 49243 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:19:15.429961 3.000183 tcp 10.0.2.105 49244 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:24.429015 0.000000 tcp 10.0.2.105 49244 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:28.124416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:19:30.427658 3.004292 tcp 10.0.2.105 49245 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:39.430401 0.000000 tcp 10.0.2.105 49245 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:44.377488 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:19:45.429393 3.003858 tcp 10.0.2.105 49246 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:19:54.441961 0.000000 tcp 10.0.2.105 49246 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:00.433516 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:25:00.433644 2.992490 tcp 10.0.2.105 49247 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:09.424873 0.000000 tcp 10.0.2.105 49247 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:15.435161 0.060989 tcp 10.0.2.105 49248 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:15.496587 0.061479 tcp 10.0.2.105 49249 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:15.558283 0.174482 tcp 10.0.2.105 49250 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:15.967336 3.001212 tcp 10.0.2.105 49251 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:24.967235 0.000000 tcp 10.0.2.105 49251 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:30.966454 0.060485 tcp 10.0.2.105 49252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:31.027252 0.063877 tcp 10.0.2.105 49253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:31.091381 0.151754 tcp 10.0.2.105 49254 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:31.571176 2.999819 tcp 10.0.2.105 49255 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:32.130217 3.001717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:25:39.137518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:25:40.569573 0.000000 tcp 10.0.2.105 49255 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:46.568881 0.062501 tcp 10.0.2.105 49256 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:46.631758 0.061584 tcp 10.0.2.105 49257 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:46.693701 0.155946 tcp 10.0.2.105 49258 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:25:47.031629 2.991498 tcp 10.0.2.105 49259 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:25:47.139044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:25:56.031926 0.000000 tcp 10.0.2.105 49259 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:26:02.030728 2.993572 tcp 10.0.2.105 49260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:26:03.142141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:26:11.023324 0.000000 tcp 10.0.2.105 49260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:26:15.882603 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:26:17.032831 2.992918 tcp 10.0.2.105 49261 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:26:26.025021 0.000000 tcp 10.0.2.105 49261 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:26:35.148523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:32:39.154525 3.000730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 15:32:46.162260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:32:54.168480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:33:10.166127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:33:42.172343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:35:24.369403 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:35:24.369613 0.099530 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:24.431632 0.211976 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:25.125517 0.261557 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:25.351742 0.226059 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.169526 0.175951 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.342205 0.122938 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.446821 0.046413 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.559102 0.167664 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.707925 0.180413 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:26.865525 0.110686 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.021971 0.358412 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.353536 0.170181 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.520092 0.080138 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.595815 0.183324 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.774153 0.190444 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:27.934378 0.172737 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:28.099492 0.061940 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:28.268058 0.175524 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:28.819721 0.097164 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:28.910594 0.202060 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:29.201333 0.205795 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:29.371881 0.190099 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:29.558966 0.166578 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:29.823286 0.127163 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:29.912595 0.093848 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:30.252950 0.062082 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:30.825380 0.188561 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:31.051164 0.360279 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:31.711004 0.292931 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:32.021070 0.469786 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:32.060718 2.993882 tcp 10.0.2.105 49262 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:35:32.462316 0.154538 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/15 15:35:41.063146 0.000000 tcp 10.0.2.105 49262 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:35:47.063218 0.061398 tcp 10.0.2.105 49263 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:35:47.124892 0.062334 tcp 10.0.2.105 49264 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:35:47.187550 0.160828 tcp 10.0.2.105 49265 -> 195.113.214.249 443 SRPA* 0 0 39 32630 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:35:47.591001 2.995302 tcp 10.0.2.105 49266 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:35:56.585578 0.000000 tcp 10.0.2.105 49266 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:02.584481 0.061978 tcp 10.0.2.105 49267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:02.646301 0.061048 tcp 10.0.2.105 49268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:02.707706 0.155188 tcp 10.0.2.105 49269 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:02.926681 3.001976 tcp 10.0.2.105 49270 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:11.927366 0.000000 tcp 10.0.2.105 49270 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:17.926780 0.062974 tcp 10.0.2.105 49271 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:17.990040 0.060834 tcp 10.0.2.105 49272 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:18.051165 0.150829 tcp 10.0.2.105 49273 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:36:18.348536 3.002431 tcp 10.0.2.105 49274 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:27.349427 0.000000 tcp 10.0.2.105 49274 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:33.348406 3.004232 tcp 10.0.2.105 49275 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:42.351103 0.000000 tcp 10.0.2.105 49275 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:46.877443 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:36:48.349661 2.994287 tcp 10.0.2.105 49276 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:36:57.358083 0.000000 tcp 10.0.2.105 49276 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:39:46.177647 3.002118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:39:53.185358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:40:01.192910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:40:17.189719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:40:49.196266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:42:03.356371 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:42:03.356462 3.000427 tcp 10.0.2.105 49277 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:12.355644 0.000000 tcp 10.0.2.105 49277 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:18.357553 0.062324 tcp 10.0.2.105 49278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:18.420164 0.066430 tcp 10.0.2.105 49279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:18.486921 0.156630 tcp 10.0.2.105 49280 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:18.806854 3.003664 tcp 10.0.2.105 49281 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:27.807730 0.000000 tcp 10.0.2.105 49281 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:33.807325 0.063641 tcp 10.0.2.105 49282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:33.871265 0.319823 tcp 10.0.2.105 49283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:34.191389 0.157575 tcp 10.0.2.105 49284 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:34.658593 3.003271 tcp 10.0.2.105 49285 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:43.660610 0.000000 tcp 10.0.2.105 49285 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:49.659638 0.064091 tcp 10.0.2.105 49286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:49.723980 0.062086 tcp 10.0.2.105 49287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:49.786370 0.161611 tcp 10.0.2.105 49288 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:42:50.217789 2.996840 tcp 10.0.2.105 49289 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:42:59.222876 0.000000 tcp 10.0.2.105 49289 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:43:05.211925 2.993998 tcp 10.0.2.105 49290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:43:14.204454 0.000000 tcp 10.0.2.105 49290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:43:18.881299 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:43:20.213409 3.008573 tcp 10.0.2.105 49291 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:43:29.216003 0.000000 tcp 10.0.2.105 49291 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:46:53.213306 3.000429 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:47:00.223250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:47:08.269067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:47:24.233975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:47:56.240128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:48:35.216921 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:48:35.217033 3.003297 tcp 10.0.2.105 49292 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:48:44.219257 0.000000 tcp 10.0.2.105 49292 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:48:50.219586 0.065098 tcp 10.0.2.105 49293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:48:50.284980 0.065618 tcp 10.0.2.105 49294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:48:50.350905 0.153920 tcp 10.0.2.105 49295 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:48:50.692774 3.002223 tcp 10.0.2.105 49296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:48:59.691295 0.000000 tcp 10.0.2.105 49296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:05.695408 0.059998 tcp 10.0.2.105 49297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:05.755687 0.062594 tcp 10.0.2.105 49298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:05.818559 0.154582 tcp 10.0.2.105 49299 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:05.983327 2.981244 tcp 10.0.2.105 49300 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:15.226829 0.000000 tcp 10.0.2.105 49300 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:21.171033 0.062300 tcp 10.0.2.105 49301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:21.233626 0.067970 tcp 10.0.2.105 49302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:21.301910 0.141526 tcp 10.0.2.105 49303 -> 195.113.214.249 443 SRPA* 0 0 34 23919 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:49:21.705750 2.962100 tcp 10.0.2.105 49304 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:30.610724 0.000000 tcp 10.0.2.105 49304 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:36.553140 2.973776 tcp 10.0.2.105 49305 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:45.507253 0.000000 tcp 10.0.2.105 49305 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:49:50.383984 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:49:51.506119 3.003959 tcp 10.0.2.105 49306 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:50:00.508849 0.000000 tcp 10.0.2.105 49306 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:54:00.245662 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 15:54:07.252977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:54:15.254862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:54:31.379440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:55:03.273757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 15:55:06.510095 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:55:06.510240 2.992602 tcp 10.0.2.105 49307 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:15.511658 0.000000 tcp 10.0.2.105 49307 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:21.512373 0.064106 tcp 10.0.2.105 49308 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:21.576743 0.068588 tcp 10.0.2.105 49309 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:21.645589 0.152041 tcp 10.0.2.105 49310 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:22.026776 3.000050 tcp 10.0.2.105 49311 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:31.023769 0.000000 tcp 10.0.2.105 49311 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:37.025017 0.064171 tcp 10.0.2.105 49312 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:37.089517 0.064281 tcp 10.0.2.105 49313 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:37.154052 0.153526 tcp 10.0.2.105 49314 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:37.667462 3.000220 tcp 10.0.2.105 49315 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:46.666532 0.000000 tcp 10.0.2.105 49315 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:55:52.673590 0.061218 tcp 10.0.2.105 49316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:52.735173 0.066452 tcp 10.0.2.105 49317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:52.802030 0.156748 tcp 10.0.2.105 49318 -> 195.113.214.249 443 SRPA* 0 0 33 17852 flow=From-Botnet-V2-TCP-Established 1970/02/15 15:55:53.145834 2.994172 tcp 10.0.2.105 49319 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:56:02.139272 0.000000 tcp 10.0.2.105 49319 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:56:08.143770 2.997895 tcp 10.0.2.105 49320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:56:17.140020 0.000000 tcp 10.0.2.105 49320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:56:21.876935 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 15:56:23.139167 2.993805 tcp 10.0.2.105 49321 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 15:56:32.143038 0.000000 tcp 10.0.2.105 49321 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:01:07.283942 2.997809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:01:14.287472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:01:22.298814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:01:38.291968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:02:10.298045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:05:42.564289 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:05:42.564373 0.080182 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:42.608120 0.213397 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:42.939760 0.251272 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.158522 0.228964 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.380384 0.179824 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 1950 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.557732 0.123583 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.663449 0.047133 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.735390 0.169139 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:43.884904 0.183190 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:44.165253 0.111820 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:44.245332 0.388115 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:44.603701 0.174217 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:45.201091 0.074062 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:45.358207 0.182953 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:45.536632 0.186290 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:45.694114 0.174525 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:45.861304 0.061578 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:46.062640 0.205278 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:46.390500 0.178520 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:46.756721 0.094464 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:46.842191 0.204583 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.011382 0.190895 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.199551 0.167417 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.411151 0.200389 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.541677 0.093710 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.727237 0.057507 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.783056 0.184185 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:47.963832 0.358717 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:48.511695 0.302983 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:48.898313 0.441651 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:49.316409 0.230053 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:05:53.171758 3.001010 tcp 10.0.2.105 49322 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:02.176093 0.000000 tcp 10.0.2.105 49322 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:06.878002 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:06:08.172077 0.064376 tcp 10.0.2.105 49323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:08.236803 0.063863 tcp 10.0.2.105 49324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:08.301023 0.159345 tcp 10.0.2.105 49325 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:08.531199 2.983300 tcp 10.0.2.105 49326 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:17.513400 0.000000 tcp 10.0.2.105 49326 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:23.522538 0.060551 tcp 10.0.2.105 49327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:23.583459 0.062645 tcp 10.0.2.105 49328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:23.646358 0.158709 tcp 10.0.2.105 49329 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:23.862208 2.994561 tcp 10.0.2.105 49330 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:32.858311 0.000000 tcp 10.0.2.105 49330 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:38.854737 0.059932 tcp 10.0.2.105 49331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:38.914964 0.065845 tcp 10.0.2.105 49332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:38.980627 0.150853 tcp 10.0.2.105 49333 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:06:39.761388 2.998319 tcp 10.0.2.105 49334 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:48.758447 0.000000 tcp 10.0.2.105 49334 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:06:54.757034 3.004303 tcp 10.0.2.105 49335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:07:03.759761 0.000000 tcp 10.0.2.105 49335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:07:08.376142 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:07:09.758874 3.005165 tcp 10.0.2.105 49336 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:07:18.771308 0.000000 tcp 10.0.2.105 49336 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:08:14.304111 3.001630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:08:21.311414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:08:29.313108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:08:45.315887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:09:17.322020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:12:24.761677 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:12:24.761878 2.993815 tcp 10.0.2.105 49337 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:12:33.754262 0.000000 tcp 10.0.2.105 49337 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:12:39.764611 0.064521 tcp 10.0.2.105 49338 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:39.829470 0.067794 tcp 10.0.2.105 49339 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:39.897589 0.219832 tcp 10.0.2.105 49340 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:40.189495 2.998566 tcp 10.0.2.105 49341 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:12:49.186460 0.000000 tcp 10.0.2.105 49341 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:12:55.185895 0.063793 tcp 10.0.2.105 49342 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:55.250075 0.065095 tcp 10.0.2.105 49343 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:55.314954 0.147657 tcp 10.0.2.105 49344 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:12:55.507056 3.002821 tcp 10.0.2.105 49345 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:04.508623 0.000000 tcp 10.0.2.105 49345 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:10.508008 0.060434 tcp 10.0.2.105 49346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:13:10.568753 0.061221 tcp 10.0.2.105 49347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:13:10.630222 0.163803 tcp 10.0.2.105 49348 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:13:10.969470 3.003081 tcp 10.0.2.105 49349 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:19.970875 0.000000 tcp 10.0.2.105 49349 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:25.969875 2.993649 tcp 10.0.2.105 49350 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:34.971786 0.000000 tcp 10.0.2.105 49350 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:39.879311 0.005558 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:13:40.971344 2.993742 tcp 10.0.2.105 49351 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:13:49.963759 0.000000 tcp 10.0.2.105 49351 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:15:21.328566 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:15:28.335378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:15:36.336811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:15:52.339876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:16:24.345806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:18:55.974438 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:18:55.974543 3.003680 tcp 10.0.2.105 49352 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:04.976716 0.000000 tcp 10.0.2.105 49352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:10.976730 0.064454 tcp 10.0.2.105 49353 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:11.041534 0.064030 tcp 10.0.2.105 49354 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:11.105891 0.166022 tcp 10.0.2.105 49355 -> 195.113.214.249 443 SRPA* 0 0 23 12928 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:11.595881 3.004994 tcp 10.0.2.105 49356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:20.599309 0.000000 tcp 10.0.2.105 49356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:26.592319 0.066730 tcp 10.0.2.105 49357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:26.659403 0.064811 tcp 10.0.2.105 49358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:26.724117 0.158480 tcp 10.0.2.105 49359 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:27.071672 3.001350 tcp 10.0.2.105 49360 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:36.081676 0.000000 tcp 10.0.2.105 49360 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:42.071305 0.060537 tcp 10.0.2.105 49361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:42.132155 0.067031 tcp 10.0.2.105 49362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:42.199494 0.151631 tcp 10.0.2.105 49363 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:19:42.367242 3.000110 tcp 10.0.2.105 49364 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:51.363450 0.000000 tcp 10.0.2.105 49364 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:19:57.362207 2.994058 tcp 10.0.2.105 49365 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:20:06.354944 0.000000 tcp 10.0.2.105 49365 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:20:10.882038 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:20:12.363951 3.006781 tcp 10.0.2.105 49366 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:20:21.367833 0.000000 tcp 10.0.2.105 49366 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:22:32.358727 3.000530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:22:39.365194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:22:47.366745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:23:03.369639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:23:35.375717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:25:27.366711 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:25:27.366817 3.003990 tcp 10.0.2.105 49367 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:25:36.369684 0.000000 tcp 10.0.2.105 49367 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:25:42.370446 0.063994 tcp 10.0.2.105 49368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:42.434758 0.062150 tcp 10.0.2.105 49369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:42.497248 0.150865 tcp 10.0.2.105 49370 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:42.780765 2.991959 tcp 10.0.2.105 49371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:25:51.781721 0.000000 tcp 10.0.2.105 49371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:25:57.780326 0.063374 tcp 10.0.2.105 49372 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:57.843982 0.061215 tcp 10.0.2.105 49373 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:57.905471 0.153957 tcp 10.0.2.105 49374 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:25:58.349000 2.996503 tcp 10.0.2.105 49375 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:07.343987 0.000000 tcp 10.0.2.105 49375 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:13.343316 0.063808 tcp 10.0.2.105 49376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:26:13.407481 0.062095 tcp 10.0.2.105 49377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:26:13.469864 0.151854 tcp 10.0.2.105 49378 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:26:13.667642 2.999772 tcp 10.0.2.105 49379 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:22.666186 0.000000 tcp 10.0.2.105 49379 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:28.664992 3.004091 tcp 10.0.2.105 49380 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:38.951450 0.000000 tcp 10.0.2.105 49380 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:43.612883 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:26:44.877719 2.968900 tcp 10.0.2.105 49381 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:26:53.767627 0.000000 tcp 10.0.2.105 49381 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:29:39.382090 3.001281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:29:46.392788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:29:54.390751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:30:10.393403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:30:42.399617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:35:54.678825 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:35:54.679067 0.253973 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:54.899661 0.222324 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:55.305906 0.090959 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:55.359533 0.218961 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:55.926134 0.174444 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:56.180893 0.125298 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:56.287817 0.045358 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:56.487553 0.624220 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:57.121275 0.183711 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:57.283115 0.111477 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:57.458397 0.352599 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:57.782894 0.171871 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.065268 0.074574 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.121641 0.182415 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.299095 0.184003 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.455432 0.172975 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.620183 0.061959 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.694655 3.007973 tcp 10.0.2.105 49382 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:35:58.726356 0.200578 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:58.965340 0.178236 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:35:59.667150 0.093262 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.079779 0.205533 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.250590 0.190583 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.438514 0.167052 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.676511 0.115352 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.766328 0.092548 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:00.916305 0.362447 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:01.275118 0.290378 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:01.585514 0.056797 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:01.640718 0.187847 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:01.824723 0.458128 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:02.262549 0.153932 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/15 16:36:07.701574 0.000000 tcp 10.0.2.105 49382 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:13.697477 0.064194 tcp 10.0.2.105 49383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:13.761941 0.060434 tcp 10.0.2.105 49384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:13.822651 0.160840 tcp 10.0.2.105 49385 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:14.123710 3.007303 tcp 10.0.2.105 49386 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:23.130575 0.000000 tcp 10.0.2.105 49386 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:29.118638 0.063243 tcp 10.0.2.105 49387 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:29.182204 0.060642 tcp 10.0.2.105 49388 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:29.243194 0.160288 tcp 10.0.2.105 49389 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:36:29.726530 2.996543 tcp 10.0.2.105 49390 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:38.731858 0.000000 tcp 10.0.2.105 49390 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:44.720719 2.994011 tcp 10.0.2.105 49391 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:46.405787 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:36:53.413191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:36:53.713227 0.000000 tcp 10.0.2.105 49391 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:36:58.380352 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:37:01.414848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:37:17.417703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:37:49.423579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:41:59.723931 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:41:59.724072 3.008472 tcp 10.0.2.105 49392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:08.726114 0.000000 tcp 10.0.2.105 49392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:14.726389 0.067737 tcp 10.0.2.105 49393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:14.794461 0.061500 tcp 10.0.2.105 49394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:14.856311 0.152154 tcp 10.0.2.105 49395 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:15.291344 2.998779 tcp 10.0.2.105 49396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:24.288693 0.000000 tcp 10.0.2.105 49396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:30.288060 0.063764 tcp 10.0.2.105 49397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:30.352119 0.064971 tcp 10.0.2.105 49398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:30.417539 0.149095 tcp 10.0.2.105 49399 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:30.931486 3.000737 tcp 10.0.2.105 49400 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:39.931291 0.000000 tcp 10.0.2.105 49400 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:45.932286 0.062364 tcp 10.0.2.105 49401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:45.994930 0.065545 tcp 10.0.2.105 49402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:46.060783 0.150996 tcp 10.0.2.105 49403 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:42:46.522372 2.992757 tcp 10.0.2.105 49404 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:42:55.513658 0.000000 tcp 10.0.2.105 49404 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:43:01.522290 2.994331 tcp 10.0.2.105 49405 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:43:10.515116 0.000000 tcp 10.0.2.105 49405 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:43:15.382500 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:43:16.523887 3.004523 tcp 10.0.2.105 49406 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:43:25.527059 0.000000 tcp 10.0.2.105 49406 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:43:53.431080 3.000224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:44:00.437097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:44:08.438738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:44:24.441632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:44:56.447502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:48:31.529248 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:48:31.529402 3.001585 tcp 10.0.2.105 49407 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:48:40.529732 0.000000 tcp 10.0.2.105 49407 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:48:46.535077 0.064814 tcp 10.0.2.105 49408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:48:46.600361 0.062049 tcp 10.0.2.105 49409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:48:46.662664 0.160819 tcp 10.0.2.105 49410 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:48:46.834476 2.998202 tcp 10.0.2.105 49411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:48:55.844983 0.000000 tcp 10.0.2.105 49411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:01.831236 0.059900 tcp 10.0.2.105 49412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:01.891410 0.064490 tcp 10.0.2.105 49413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:01.956156 0.156213 tcp 10.0.2.105 49414 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:02.206434 2.998797 tcp 10.0.2.105 49415 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:11.203864 0.000000 tcp 10.0.2.105 49415 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:17.203424 0.199987 tcp 10.0.2.105 49416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:17.403726 0.066212 tcp 10.0.2.105 49417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:17.470294 0.151694 tcp 10.0.2.105 49418 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:49:17.815146 2.977626 tcp 10.0.2.105 49419 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:26.739664 0.000000 tcp 10.0.2.105 49419 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:32.694859 3.281075 tcp 10.0.2.105 49420 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:41.915480 0.000000 tcp 10.0.2.105 49420 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:46.550701 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:49:47.864413 2.978590 tcp 10.0.2.105 49421 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:49:56.781382 0.000000 tcp 10.0.2.105 49421 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:02.715289 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:55:02.715407 2.989024 tcp 10.0.2.105 49422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:11.712622 0.000000 tcp 10.0.2.105 49422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:18.035610 0.062866 tcp 10.0.2.105 49423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:18.098739 0.066362 tcp 10.0.2.105 49424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:18.165384 0.164198 tcp 10.0.2.105 49425 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:18.583407 2.969063 tcp 10.0.2.105 49426 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:27.491406 0.000000 tcp 10.0.2.105 49426 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:33.431473 0.065764 tcp 10.0.2.105 49427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:33.497752 0.061854 tcp 10.0.2.105 49428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:33.559861 0.158930 tcp 10.0.2.105 49429 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:33.940850 2.971518 tcp 10.0.2.105 49430 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:42.855774 0.000000 tcp 10.0.2.105 49430 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:48.797119 0.061298 tcp 10.0.2.105 49431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:48.858693 0.069687 tcp 10.0.2.105 49432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:48.928659 0.160582 tcp 10.0.2.105 49433 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/15 16:55:49.298150 2.982388 tcp 10.0.2.105 49434 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:55:58.279084 0.000000 tcp 10.0.2.105 49434 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:56:04.277886 3.003974 tcp 10.0.2.105 49435 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:56:07.454626 3.001761 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 16:56:13.280550 0.000000 tcp 10.0.2.105 49435 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:56:14.462206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:56:17.877459 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 16:56:19.279312 2.994176 tcp 10.0.2.105 49436 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:56:22.672209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:56:28.434944 0.000000 tcp 10.0.2.105 49436 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 16:56:38.522194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 16:57:10.473101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:01:34.283220 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:01:34.283451 3.002678 tcp 10.0.2.105 49437 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:01:43.289854 0.000000 tcp 10.0.2.105 49437 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:01:49.285592 0.062042 tcp 10.0.2.105 49438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:01:49.347990 0.061244 tcp 10.0.2.105 49439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:01:49.409550 0.158626 tcp 10.0.2.105 49440 -> 195.113.214.249 443 SRPA* 0 0 30 11850 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:01:49.686746 3.001820 tcp 10.0.2.105 49441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:01:58.687210 0.000000 tcp 10.0.2.105 49441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:03:14.479319 3.001348 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 17:03:21.486238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:03:29.487833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:03:45.490914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:04:17.497068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:06:22.797542 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:06:22.797667 0.253241 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:23.015736 0.272512 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:23.297244 0.356589 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:23.645562 0.223282 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:23.861280 0.094420 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:23.919917 0.125606 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.025667 0.046075 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.108080 0.169773 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.257612 0.356133 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.585108 0.173161 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.755309 0.073460 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.811630 0.180694 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:24.968719 0.117740 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:25.055253 0.181372 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:25.232197 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 17:06:43.488707 0.070323 tcp 10.0.2.105 49442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:06:43.559319 0.063819 tcp 10.0.2.105 49443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:06:43.623596 0.155402 tcp 10.0.2.105 49444 -> 195.113.214.249 443 SRPA* 0 0 60 40690 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:06:43.777544 0.175629 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:43.945885 0.061012 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:44.004116 0.199854 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:44.228761 0.207062 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:44.402228 0.177200 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:45.597963 0.096119 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2540 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:45.684410 0.188286 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:45.870110 0.166668 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.013768 0.161043 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.118489 0.095584 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.229904 0.058963 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.286788 0.184455 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.467767 0.471217 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:46.917640 0.363279 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:06:47.277051 0.000000 udp 10.0.2.105 7010 -> 59.148.222.37 9956 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 17:07:04.687381 3.005642 tcp 10.0.2.105 49445 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:05.038622 0.062095 tcp 10.0.2.105 49446 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:05.101106 0.063492 tcp 10.0.2.105 49447 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:05.164930 0.155417 tcp 10.0.2.105 49448 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:05.321039 0.152216 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:07:13.690439 0.000000 tcp 10.0.2.105 49445 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:19.689295 0.061838 tcp 10.0.2.105 49449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:19.751421 0.063460 tcp 10.0.2.105 49450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:19.815203 0.158124 tcp 10.0.2.105 49451 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:20.020538 2.993050 tcp 10.0.2.105 49452 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:29.022420 0.000000 tcp 10.0.2.105 49452 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:35.011405 0.064218 tcp 10.0.2.105 49453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:35.075880 0.065060 tcp 10.0.2.105 49454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:35.141278 0.157575 tcp 10.0.2.105 49455 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:35.316182 2.999334 tcp 10.0.2.105 49456 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:44.314097 0.000000 tcp 10.0.2.105 49456 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:50.313682 0.060217 tcp 10.0.2.105 49457 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:50.374257 0.062515 tcp 10.0.2.105 49458 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:50.437104 0.163288 tcp 10.0.2.105 49459 -> 195.113.214.249 443 SRPA* 0 0 43 24334 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:07:50.664914 3.002535 tcp 10.0.2.105 49460 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:07:59.666664 0.000000 tcp 10.0.2.105 49460 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:08:05.665079 3.004444 tcp 10.0.2.105 49461 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:08:14.667846 0.000000 tcp 10.0.2.105 49461 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:08:19.374569 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:08:20.666881 3.003896 tcp 10.0.2.105 49462 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:08:29.669362 0.000000 tcp 10.0.2.105 49462 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:10:32.508340 3.002232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:10:39.516009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:10:47.517454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:11:03.520493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:11:35.536815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:13:35.670174 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:13:35.670288 2.993334 tcp 10.0.2.105 49463 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:13:44.672575 0.000000 tcp 10.0.2.105 49463 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:13:50.672716 0.065706 tcp 10.0.2.105 49464 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:13:50.738813 0.064827 tcp 10.0.2.105 49465 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:13:50.803920 0.154369 tcp 10.0.2.105 49466 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:13:51.111444 2.994293 tcp 10.0.2.105 49467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:00.104398 0.000000 tcp 10.0.2.105 49467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:06.103328 0.065224 tcp 10.0.2.105 49468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:06.168844 0.064315 tcp 10.0.2.105 49469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:06.233424 0.149155 tcp 10.0.2.105 49470 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:06.438520 2.999426 tcp 10.0.2.105 49471 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:15.436412 0.000000 tcp 10.0.2.105 49471 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:21.435960 0.061374 tcp 10.0.2.105 49472 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:21.497653 0.065126 tcp 10.0.2.105 49473 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:21.563118 0.147967 tcp 10.0.2.105 49474 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:14:22.045829 3.004323 tcp 10.0.2.105 49475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:31.053547 0.000000 tcp 10.0.2.105 49475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:37.047953 3.003946 tcp 10.0.2.105 49476 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:46.050739 0.000000 tcp 10.0.2.105 49476 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:14:50.877586 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:14:52.049389 2.994111 tcp 10.0.2.105 49477 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:15:01.052182 0.000000 tcp 10.0.2.105 49477 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:17:39.542374 3.010740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:17:46.550799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:17:54.553652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:18:10.555164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:18:42.560880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:20:07.053982 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:20:07.054088 2.992513 tcp 10.0.2.105 49478 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:16.044972 0.000000 tcp 10.0.2.105 49478 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:22.055380 0.063484 tcp 10.0.2.105 49479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:22.119174 0.061569 tcp 10.0.2.105 49480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:22.181076 0.151016 tcp 10.0.2.105 49481 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:22.369249 2.999053 tcp 10.0.2.105 49482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:31.367128 0.000000 tcp 10.0.2.105 49482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:37.366237 0.061817 tcp 10.0.2.105 49483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:37.427926 0.061620 tcp 10.0.2.105 49484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:37.489843 0.155701 tcp 10.0.2.105 49485 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:37.899742 3.001058 tcp 10.0.2.105 49486 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:46.898911 0.000000 tcp 10.0.2.105 49486 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:20:52.898820 0.060382 tcp 10.0.2.105 49487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:52.959489 0.061320 tcp 10.0.2.105 49488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:53.021103 0.162173 tcp 10.0.2.105 49489 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:20:53.424017 2.999258 tcp 10.0.2.105 49490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:21:02.431657 0.000000 tcp 10.0.2.105 49490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:21:08.420936 2.993069 tcp 10.0.2.105 49491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:21:17.413259 0.000000 tcp 10.0.2.105 49491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:21:22.380494 0.000159 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:21:23.422250 2.994418 tcp 10.0.2.105 49492 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:21:32.414967 0.000000 tcp 10.0.2.105 49492 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:24:46.566613 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:24:53.573596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:25:01.575721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:25:17.578681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:25:49.584713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:26:38.425288 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:26:38.425410 3.003801 tcp 10.0.2.105 49493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:26:47.427632 0.000000 tcp 10.0.2.105 49493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:26:53.427954 0.063514 tcp 10.0.2.105 49494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:26:53.491734 0.065655 tcp 10.0.2.105 49495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:26:53.557670 0.163335 tcp 10.0.2.105 49496 -> 195.113.214.249 443 SRPA* 0 0 38 19196 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:26:54.144355 2.997310 tcp 10.0.2.105 49497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:03.140482 0.000000 tcp 10.0.2.105 49497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:09.139672 0.061890 tcp 10.0.2.105 49498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:09.201844 0.064484 tcp 10.0.2.105 49499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:09.266630 0.153795 tcp 10.0.2.105 49500 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:09.641218 2.992847 tcp 10.0.2.105 49501 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:18.642686 0.000000 tcp 10.0.2.105 49501 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:24.745286 0.061659 tcp 10.0.2.105 49502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:24.807214 0.061331 tcp 10.0.2.105 49503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:24.868903 0.152262 tcp 10.0.2.105 49504 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:27:25.034195 2.972485 tcp 10.0.2.105 49505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:33.956202 0.000000 tcp 10.0.2.105 49505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:39.933086 3.004481 tcp 10.0.2.105 49506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:48.938826 0.000000 tcp 10.0.2.105 49506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:27:53.888228 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:27:54.938090 3.001076 tcp 10.0.2.105 49507 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:28:03.939135 0.000000 tcp 10.0.2.105 49507 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:31:53.591157 3.001100 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:32:00.598312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:32:08.599534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:32:24.602702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:32:56.608961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:37:13.659085 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:37:13.659171 0.187193 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:13.816873 0.296823 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:14.148401 0.220196 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:14.360203 0.245407 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:14.571740 0.175048 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:14.744106 0.124036 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:14.977426 0.046795 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:15.008755 0.169252 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:15.245436 0.356012 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:15.573000 0.078020 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:15.823558 0.225122 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.041574 0.116428 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.144081 0.182115 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.320966 0.073974 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.429987 0.178050 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.586083 0.170416 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.753455 0.174186 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:16.950933 0.056409 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:17.763536 0.202350 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 1963 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:17.969231 0.206748 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:18.143260 0.094119 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:18.228274 0.185820 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:18.442621 0.164977 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:18.692562 0.097465 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:18.774921 0.057004 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:19.154012 0.184479 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:19.334426 0.208491 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:19.478424 0.188323 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:19.664031 0.353709 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:20.111310 0.449628 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:20.539147 0.156628 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/15 17:37:24.965045 3.003795 tcp 10.0.2.105 49508 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:37:33.967588 0.000000 tcp 10.0.2.105 49508 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:37:38.874277 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:37:39.968025 0.067564 tcp 10.0.2.105 49509 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:40.035944 0.067279 tcp 10.0.2.105 49510 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:40.103498 0.172970 tcp 10.0.2.105 49511 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:40.485567 3.005325 tcp 10.0.2.105 49512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:37:49.489745 0.000000 tcp 10.0.2.105 49512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:37:55.479114 0.060688 tcp 10.0.2.105 49513 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:55.540154 0.061903 tcp 10.0.2.105 49514 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:55.602336 0.156385 tcp 10.0.2.105 49515 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:37:55.894349 2.998653 tcp 10.0.2.105 49516 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:04.901836 0.000000 tcp 10.0.2.105 49516 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:10.891205 0.066783 tcp 10.0.2.105 49517 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:38:10.958377 0.061692 tcp 10.0.2.105 49518 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:38:11.020470 0.161777 tcp 10.0.2.105 49519 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:38:11.511078 2.994571 tcp 10.0.2.105 49520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:20.504276 0.000000 tcp 10.0.2.105 49520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:26.503265 3.004059 tcp 10.0.2.105 49521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:35.505687 0.000000 tcp 10.0.2.105 49521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:40.382739 0.000193 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:38:41.504777 3.004149 tcp 10.0.2.105 49522 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:38:50.507235 0.000000 tcp 10.0.2.105 49522 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:39:00.614566 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:39:07.622081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:39:15.623432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:39:31.626512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:40:03.632823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:43:56.508008 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:43:56.508159 3.004932 tcp 10.0.2.105 49523 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:05.512884 0.000000 tcp 10.0.2.105 49523 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:11.510524 0.064132 tcp 10.0.2.105 49524 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:11.574906 0.065304 tcp 10.0.2.105 49525 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:11.640544 0.152652 tcp 10.0.2.105 49526 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:11.990655 2.994192 tcp 10.0.2.105 49527 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:20.992784 0.000000 tcp 10.0.2.105 49527 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:26.991727 0.061387 tcp 10.0.2.105 49528 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:27.053421 0.068485 tcp 10.0.2.105 49529 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:27.122181 0.160133 tcp 10.0.2.105 49530 -> 195.113.214.249 443 SRPA* 0 0 42 25884 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:27.426276 2.999944 tcp 10.0.2.105 49531 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:36.424686 0.000000 tcp 10.0.2.105 49531 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:42.424061 0.062741 tcp 10.0.2.105 49532 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:42.487077 0.062492 tcp 10.0.2.105 49533 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:42.549883 0.150717 tcp 10.0.2.105 49534 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:44:42.878186 3.000307 tcp 10.0.2.105 49535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:51.877015 0.000000 tcp 10.0.2.105 49535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:44:57.875822 3.004286 tcp 10.0.2.105 49536 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:45:06.878732 0.000000 tcp 10.0.2.105 49536 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:45:11.875765 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:45:12.883727 2.999201 tcp 10.0.2.105 49537 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:45:21.880126 0.000000 tcp 10.0.2.105 49537 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:46:07.638798 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:46:14.646052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:46:22.647638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:46:38.650773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:47:10.656477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:50:27.880811 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:50:27.880906 2.993162 tcp 10.0.2.105 49538 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:50:36.882967 0.000000 tcp 10.0.2.105 49538 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:50:42.883501 0.062882 tcp 10.0.2.105 49539 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:42.946758 0.065123 tcp 10.0.2.105 49540 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:43.012161 0.156844 tcp 10.0.2.105 49541 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:43.255078 3.001462 tcp 10.0.2.105 49542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:50:52.255072 0.000000 tcp 10.0.2.105 49542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:50:58.254195 0.063700 tcp 10.0.2.105 49543 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:58.318187 0.064863 tcp 10.0.2.105 49544 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:58.382927 0.147315 tcp 10.0.2.105 49545 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:50:58.722185 2.995884 tcp 10.0.2.105 49546 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:07.717241 0.000000 tcp 10.0.2.105 49546 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:13.716079 0.064558 tcp 10.0.2.105 49547 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:51:13.780893 0.066508 tcp 10.0.2.105 49548 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:51:13.847664 0.160399 tcp 10.0.2.105 49549 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:51:14.342558 2.998849 tcp 10.0.2.105 49550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:23.339770 0.000000 tcp 10.0.2.105 49550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:29.338955 3.003784 tcp 10.0.2.105 49551 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:38.341378 0.000000 tcp 10.0.2.105 49551 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:42.878048 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:51:44.340712 2.993511 tcp 10.0.2.105 49552 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:51:53.342877 0.000000 tcp 10.0.2.105 49552 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:53:14.663435 3.000332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 17:53:21.670069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:53:29.671425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:53:45.674698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:54:17.680922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 17:56:59.345422 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:56:59.345631 3.001756 tcp 10.0.2.105 49553 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:08.345711 0.000000 tcp 10.0.2.105 49553 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:14.346168 0.062323 tcp 10.0.2.105 49554 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:14.408763 0.060967 tcp 10.0.2.105 49555 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:14.469982 0.156615 tcp 10.0.2.105 49556 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:14.681809 2.997319 tcp 10.0.2.105 49557 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:23.678568 0.000000 tcp 10.0.2.105 49557 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:29.677240 0.065440 tcp 10.0.2.105 49558 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:29.742992 0.062535 tcp 10.0.2.105 49559 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:29.805444 0.157035 tcp 10.0.2.105 49560 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:30.302184 3.245979 tcp 10.0.2.105 49561 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:39.491406 0.000000 tcp 10.0.2.105 49561 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:45.443547 0.063355 tcp 10.0.2.105 49562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:45.507164 0.066248 tcp 10.0.2.105 49563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:45.573763 0.164827 tcp 10.0.2.105 49564 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 17:57:46.446544 2.965905 tcp 10.0.2.105 49565 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:57:55.357601 0.000000 tcp 10.0.2.105 49565 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:58:01.312180 2.993925 tcp 10.0.2.105 49566 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:58:10.304813 0.000000 tcp 10.0.2.105 49566 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:58:14.881474 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 17:58:16.313742 3.005089 tcp 10.0.2.105 49567 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 17:58:25.316129 0.000000 tcp 10.0.2.105 49567 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:00:21.685740 3.002711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:00:28.693863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:00:36.695314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:00:52.699526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:01:24.709021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:07:28.711380 3.000650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 18:07:35.717996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:07:43.719367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:07:47.245153 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:07:47.245262 0.186642 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:47.403727 0.293911 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:48.106563 0.216795 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:48.315272 0.254361 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:48.531562 0.175293 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2584 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:48.703405 0.125291 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:48.808630 0.044418 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.007928 0.169990 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.157394 0.230331 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.380476 0.114483 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.457686 0.357246 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.786505 0.084668 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:49.864840 0.181591 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.041543 0.074017 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.097067 0.180872 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.252808 0.172222 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.421683 0.172751 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.587161 0.206917 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.758675 0.094083 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.844905 0.055995 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:50.897904 0.199195 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.114238 0.176876 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.290129 0.169129 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.471507 0.095314 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.550418 0.056836 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.613696 0.187441 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:51.798218 0.349411 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:52.225080 0.184240 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:52.405338 0.187387 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:53.112824 0.522544 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:53.610857 0.153929 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:07:59.722547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:08:01.345370 3.003722 tcp 10.0.2.105 49568 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:10.347748 0.000000 tcp 10.0.2.105 49568 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:14.874004 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:08:16.349558 0.062277 tcp 10.0.2.105 49569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:16.412129 0.068440 tcp 10.0.2.105 49570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:16.480825 0.159829 tcp 10.0.2.105 49571 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:16.731675 2.999470 tcp 10.0.2.105 49572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:25.729688 0.000000 tcp 10.0.2.105 49572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:31.729004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:08:31.729685 0.069435 tcp 10.0.2.105 49573 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:31.799458 0.068034 tcp 10.0.2.105 49574 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:31.867797 0.152628 tcp 10.0.2.105 49575 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:32.163027 2.990402 tcp 10.0.2.105 49576 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:41.161960 0.000000 tcp 10.0.2.105 49576 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:47.161138 0.061566 tcp 10.0.2.105 49577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:47.222994 0.065766 tcp 10.0.2.105 49578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:47.288599 0.154707 tcp 10.0.2.105 49579 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:08:47.466198 2.999027 tcp 10.0.2.105 49580 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:08:56.463689 0.000000 tcp 10.0.2.105 49580 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:09:02.462870 2.993994 tcp 10.0.2.105 49581 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:09:11.455467 0.000000 tcp 10.0.2.105 49581 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:09:16.382504 0.000192 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:09:17.464606 3.004131 tcp 10.0.2.105 49582 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:09:26.467206 0.000000 tcp 10.0.2.105 49582 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:14:32.467623 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:14:32.467777 3.003504 tcp 10.0.2.105 49583 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:14:35.734026 3.031813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:14:41.477783 0.000000 tcp 10.0.2.105 49583 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:14:42.751422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:14:47.471047 0.062584 tcp 10.0.2.105 49584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:14:47.533998 0.066219 tcp 10.0.2.105 49585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:14:47.600045 0.153383 tcp 10.0.2.105 49586 -> 195.113.214.249 443 SRPA* 0 0 21 11574 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:14:47.828074 2.985285 tcp 10.0.2.105 49587 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:14:50.753267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:14:56.822127 0.000000 tcp 10.0.2.105 49587 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:02.821347 0.061442 tcp 10.0.2.105 49588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:02.883069 0.060674 tcp 10.0.2.105 49589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:02.944019 0.158729 tcp 10.0.2.105 49590 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:03.540422 2.995804 tcp 10.0.2.105 49591 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:06.756060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:15:12.534972 0.000000 tcp 10.0.2.105 49591 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:18.533830 0.061840 tcp 10.0.2.105 49592 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:18.595971 0.062658 tcp 10.0.2.105 49593 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:18.658969 0.148599 tcp 10.0.2.105 49594 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:15:19.738518 3.000663 tcp 10.0.2.105 49595 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:28.737860 0.000000 tcp 10.0.2.105 49595 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:34.736155 3.004851 tcp 10.0.2.105 49596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:38.762637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:15:42.377611 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:15:43.742277 0.000000 tcp 10.0.2.105 49596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:49.739259 3.003251 tcp 10.0.2.105 49597 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:15:58.741718 0.000000 tcp 10.0.2.105 49597 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:04.741562 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:21:04.741758 2.993479 tcp 10.0.2.105 49598 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:13.733995 0.000000 tcp 10.0.2.105 49598 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:19.744780 0.062745 tcp 10.0.2.105 49599 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:19.807763 0.067203 tcp 10.0.2.105 49600 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:19.875234 0.149548 tcp 10.0.2.105 49601 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:20.069688 2.997613 tcp 10.0.2.105 49602 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:29.065945 0.000000 tcp 10.0.2.105 49602 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:35.064964 0.065051 tcp 10.0.2.105 49603 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:35.130297 0.064280 tcp 10.0.2.105 49604 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:35.194872 0.163120 tcp 10.0.2.105 49605 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:35.787735 3.001750 tcp 10.0.2.105 49606 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:42.768101 3.037544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:21:44.788678 0.000000 tcp 10.0.2.105 49606 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:49.781969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:21:50.795032 0.064774 tcp 10.0.2.105 49607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:50.860130 0.064823 tcp 10.0.2.105 49608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:50.925204 0.152210 tcp 10.0.2.105 49609 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:21:51.315138 2.998265 tcp 10.0.2.105 49610 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:21:57.787509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:22:00.310985 0.000000 tcp 10.0.2.105 49610 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:22:06.309968 2.994013 tcp 10.0.2.105 49611 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:22:13.790122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:22:15.312496 0.000000 tcp 10.0.2.105 49611 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:22:19.879331 0.033933 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:22:21.330996 2.980715 tcp 10.0.2.105 49612 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:22:30.304162 0.000000 tcp 10.0.2.105 49612 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:22:45.796463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:27:36.314448 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:27:36.314596 3.003691 tcp 10.0.2.105 49613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:27:45.316997 0.000000 tcp 10.0.2.105 49613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:27:51.317526 0.065816 tcp 10.0.2.105 49614 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:27:51.383644 0.064768 tcp 10.0.2.105 49615 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:27:51.448719 0.157332 tcp 10.0.2.105 49616 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:27:51.777266 3.003424 tcp 10.0.2.105 49617 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:00.779619 0.000000 tcp 10.0.2.105 49617 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:06.778598 0.064917 tcp 10.0.2.105 49618 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:06.843830 0.062780 tcp 10.0.2.105 49619 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:06.906986 0.153731 tcp 10.0.2.105 49620 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:07.267605 3.005468 tcp 10.0.2.105 49621 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:16.281470 0.000000 tcp 10.0.2.105 49621 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:22.260700 0.060698 tcp 10.0.2.105 49622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:22.321652 0.067302 tcp 10.0.2.105 49623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:22.389246 0.163784 tcp 10.0.2.105 49624 -> 195.113.214.249 443 SRPA* 0 0 41 33602 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:28:22.747070 2.998147 tcp 10.0.2.105 49625 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:31.743664 0.000000 tcp 10.0.2.105 49625 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:37.742761 2.993913 tcp 10.0.2.105 49626 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:46.735006 0.000000 tcp 10.0.2.105 49626 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:49.802687 3.000812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:28:51.382012 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:28:52.743662 3.004398 tcp 10.0.2.105 49627 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:28:56.809934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:29:01.746891 0.000000 tcp 10.0.2.105 49627 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:29:04.811490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:29:20.815174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:29:52.820288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:35:56.826045 3.006682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 18:36:03.833507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:36:11.836424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:36:27.838175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:36:59.843698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:37:53.952887 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:37:53.953046 0.187171 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:54.109070 0.290165 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:54.727601 0.212098 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:54.932252 0.251748 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:55.147240 0.176770 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:55.686981 0.125951 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:55.793001 0.046284 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:55.861351 0.110333 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:55.941039 0.352975 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:56.267458 0.082044 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:56.783927 0.170774 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:56.933948 0.227961 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:57.154351 0.181393 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:57.331520 0.073883 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:57.418985 0.180097 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:57.578000 0.175665 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:57.852213 0.174967 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:58.019382 0.209682 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:58.193743 0.096495 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:58.585414 0.176975 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:58.873765 0.166083 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:59.340469 0.095190 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:37:59.493491 0.056854 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:00.132196 0.055882 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:00.184658 0.201104 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:01.014806 0.190166 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:01.201848 0.349458 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:01.547453 0.184114 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:01.727720 0.167500 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:01.827093 0.473269 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:02.260059 0.152329 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/15 18:38:07.772160 2.994006 tcp 10.0.2.105 49628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:16.764548 0.000000 tcp 10.0.2.105 49628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:21.381360 0.374838 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:38:23.123849 0.065131 tcp 10.0.2.105 49629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:23.189260 0.062080 tcp 10.0.2.105 49630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:23.251699 0.157645 tcp 10.0.2.105 49631 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:23.438510 2.965223 tcp 10.0.2.105 49632 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:32.340809 0.000000 tcp 10.0.2.105 49632 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:38.282471 0.065354 tcp 10.0.2.105 49633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:38.348150 0.068511 tcp 10.0.2.105 49634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:38.416969 0.238357 tcp 10.0.2.105 49635 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:38.881533 2.977990 tcp 10.0.2.105 49636 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:47.797641 0.000000 tcp 10.0.2.105 49636 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:38:53.735651 0.060878 tcp 10.0.2.105 49637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:53.796855 0.062347 tcp 10.0.2.105 49638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:53.859447 0.152254 tcp 10.0.2.105 49639 -> 195.113.214.249 443 SRPA* 0 0 45 33376 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:38:54.551390 2.975185 tcp 10.0.2.105 49640 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:39:03.521978 0.000000 tcp 10.0.2.105 49640 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:39:09.511061 2.993897 tcp 10.0.2.105 49641 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:39:17.382122 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:39:18.503552 0.000000 tcp 10.0.2.105 49641 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:39:24.513107 2.992919 tcp 10.0.2.105 49642 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:39:33.505143 0.000000 tcp 10.0.2.105 49642 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:43:03.849847 3.002974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:43:10.857700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:43:18.859406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:43:34.862196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:44:06.868357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:44:39.517330 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:44:39.517438 3.002084 tcp 10.0.2.105 49643 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:44:48.518302 0.000000 tcp 10.0.2.105 49643 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:44:54.519151 0.063057 tcp 10.0.2.105 49644 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:44:54.582525 0.060667 tcp 10.0.2.105 49645 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:44:54.643584 0.164008 tcp 10.0.2.105 49646 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:44:55.139343 3.003822 tcp 10.0.2.105 49647 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:04.140631 0.000000 tcp 10.0.2.105 49647 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:10.140033 0.060128 tcp 10.0.2.105 49648 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:10.200478 0.063578 tcp 10.0.2.105 49649 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:10.264464 0.160171 tcp 10.0.2.105 49650 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:10.933759 3.000762 tcp 10.0.2.105 49651 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:19.932745 0.000000 tcp 10.0.2.105 49651 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:25.932588 0.068682 tcp 10.0.2.105 49652 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:26.001560 0.061862 tcp 10.0.2.105 49653 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:26.063711 0.157030 tcp 10.0.2.105 49654 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:45:26.530541 2.998573 tcp 10.0.2.105 49655 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:35.525782 0.000000 tcp 10.0.2.105 49655 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:41.524626 3.004083 tcp 10.0.2.105 49656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:50.527378 0.000000 tcp 10.0.2.105 49656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:45:55.374922 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:45:56.530961 2.999309 tcp 10.0.2.105 49657 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:46:05.528886 0.000000 tcp 10.0.2.105 49657 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:11.529471 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:51:11.529610 3.003573 tcp 10.0.2.105 49658 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:20.541800 0.000000 tcp 10.0.2.105 49658 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:26.535344 0.071755 tcp 10.0.2.105 49659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:26.607406 0.061733 tcp 10.0.2.105 49660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:26.669499 0.163771 tcp 10.0.2.105 49661 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:27.047842 2.997454 tcp 10.0.2.105 49662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:36.044156 0.000000 tcp 10.0.2.105 49662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:42.043032 0.066966 tcp 10.0.2.105 49663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:42.110303 0.065017 tcp 10.0.2.105 49664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:42.175603 0.151535 tcp 10.0.2.105 49665 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:42.897143 3.001283 tcp 10.0.2.105 49666 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:51.896946 0.000000 tcp 10.0.2.105 49666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:51:57.896700 0.061837 tcp 10.0.2.105 49667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:57.958812 0.061561 tcp 10.0.2.105 49668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:58.020679 0.161139 tcp 10.0.2.105 49669 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:51:58.636505 2.994309 tcp 10.0.2.105 49670 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:52:07.629415 0.000000 tcp 10.0.2.105 49670 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:52:13.632419 3.002619 tcp 10.0.2.105 49671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:52:22.631191 0.000000 tcp 10.0.2.105 49671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:52:27.377763 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:52:28.629797 2.994024 tcp 10.0.2.105 49672 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:52:37.632913 0.000000 tcp 10.0.2.105 49672 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:55:43.882087 3.002200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 18:55:50.890724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:55:58.891896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:56:14.895220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:56:46.901022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 18:57:43.633349 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:57:43.633434 2.993606 tcp 10.0.2.105 49673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:57:52.625471 0.000000 tcp 10.0.2.105 49673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:57:58.636058 0.066192 tcp 10.0.2.105 49674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:57:58.702459 0.064494 tcp 10.0.2.105 49675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:57:58.767288 0.152448 tcp 10.0.2.105 49676 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:57:59.011940 2.997289 tcp 10.0.2.105 49677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:08.007431 0.000000 tcp 10.0.2.105 49677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:14.010111 0.064756 tcp 10.0.2.105 49678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:14.075109 0.072598 tcp 10.0.2.105 49679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:14.147528 0.149494 tcp 10.0.2.105 49680 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:14.469421 3.001693 tcp 10.0.2.105 49681 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:23.469849 0.000000 tcp 10.0.2.105 49681 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:29.469170 0.077285 tcp 10.0.2.105 49682 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:29.546738 0.061629 tcp 10.0.2.105 49683 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:29.608619 0.151467 tcp 10.0.2.105 49684 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/15 18:58:29.902220 2.991110 tcp 10.0.2.105 49685 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:38.901830 0.000000 tcp 10.0.2.105 49685 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:44.901518 2.992812 tcp 10.0.2.105 49686 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:53.893604 0.000000 tcp 10.0.2.105 49686 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:58:58.883286 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 18:58:59.903277 2.993453 tcp 10.0.2.105 49687 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 18:59:08.894991 0.000000 tcp 10.0.2.105 49687 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:02:50.907229 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:02:57.913951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:03:05.915945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:03:21.919036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:03:53.925201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:08:16.403010 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:08:16.403120 0.189046 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:16.562527 0.249677 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:16.776818 0.304079 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.107688 0.216977 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.317030 0.177023 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.490482 0.124476 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.595973 0.046789 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.667282 0.109124 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:17.743434 0.353329 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.068679 0.226652 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.287088 0.085825 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.483560 0.170587 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.632853 0.182752 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.810594 0.116739 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:18.909955 0.182754 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.071481 0.171801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.240565 0.174158 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.407683 0.208973 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.579634 0.095873 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.728187 0.175195 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.917415 0.056415 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:19.971757 0.055344 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.036798 0.168044 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.235868 0.095893 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.314810 0.201287 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.520759 0.190686 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.708878 0.170764 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:20.835878 0.446949 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:21.260961 0.352504 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:21.662228 0.185693 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:21.843545 0.154951 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:08:29.932480 2.993795 tcp 10.0.2.105 49688 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:08:38.924206 0.000000 tcp 10.0.2.105 49688 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:08:43.881945 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:08:44.934805 0.066671 tcp 10.0.2.105 49689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:08:45.001831 0.065066 tcp 10.0.2.105 49690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:08:45.067240 0.151486 tcp 10.0.2.105 49691 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:08:45.229322 2.998747 tcp 10.0.2.105 49692 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:08:54.226816 0.000000 tcp 10.0.2.105 49692 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:00.225891 0.060560 tcp 10.0.2.105 49693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:00.286792 0.064902 tcp 10.0.2.105 49694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:00.352060 0.149750 tcp 10.0.2.105 49695 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:00.558450 3.001892 tcp 10.0.2.105 49696 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:09.558788 0.000000 tcp 10.0.2.105 49696 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:15.558041 2.287372 tcp 10.0.2.105 49697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:17.845778 2.598122 tcp 10.0.2.105 49698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:20.444402 0.156936 tcp 10.0.2.105 49699 -> 195.113.214.249 443 SRPA* 0 0 18 7302 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:09:20.613760 3.005226 tcp 10.0.2.105 49700 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:29.617442 0.000000 tcp 10.0.2.105 49700 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:35.606286 3.004308 tcp 10.0.2.105 49701 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:44.609254 0.000000 tcp 10.0.2.105 49701 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:49.376086 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:09:50.607798 3.004532 tcp 10.0.2.105 49702 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:09:59.610896 0.000000 tcp 10.0.2.105 49702 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:10:21.935586 3.002207 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:10:28.942640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:10:36.944384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:10:52.947832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:11:24.953895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:15:05.611458 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:15:05.611547 2.993516 tcp 10.0.2.105 49703 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:14.603563 0.000000 tcp 10.0.2.105 49703 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:20.614083 0.061348 tcp 10.0.2.105 49704 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:20.675682 0.065373 tcp 10.0.2.105 49705 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:20.741367 0.153774 tcp 10.0.2.105 49706 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:21.048250 2.999072 tcp 10.0.2.105 49707 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:30.045616 0.000000 tcp 10.0.2.105 49707 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:36.045884 0.061352 tcp 10.0.2.105 49708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:36.107570 0.065827 tcp 10.0.2.105 49709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:36.173693 0.265046 tcp 10.0.2.105 49710 -> 195.113.214.249 443 SRPA* 0 0 72 78166 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:36.677424 3.004315 tcp 10.0.2.105 49711 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:45.678240 0.000000 tcp 10.0.2.105 49711 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:15:51.681390 0.065313 tcp 10.0.2.105 49712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:51.746983 0.067457 tcp 10.0.2.105 49713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:51.814729 0.156648 tcp 10.0.2.105 49714 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:15:52.050419 3.001233 tcp 10.0.2.105 49715 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:16:01.050728 0.000000 tcp 10.0.2.105 49715 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:16:07.041038 2.992245 tcp 10.0.2.105 49716 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:16:16.043329 0.000000 tcp 10.0.2.105 49716 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:16:20.878688 0.051383 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:16:22.074522 2.973279 tcp 10.0.2.105 49717 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:16:31.033528 0.000000 tcp 10.0.2.105 49717 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:17:28.959555 3.001924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:17:35.967002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:17:43.968537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:17:59.972654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:18:31.977317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:21:37.044111 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:21:37.044327 3.003517 tcp 10.0.2.105 49718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:21:46.046464 0.000000 tcp 10.0.2.105 49718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:21:52.046943 0.060974 tcp 10.0.2.105 49719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:21:52.108343 0.061992 tcp 10.0.2.105 49720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:21:52.170169 0.160174 tcp 10.0.2.105 49721 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:21:52.802894 3.007390 tcp 10.0.2.105 49722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:01.809030 0.000000 tcp 10.0.2.105 49722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:07.798248 0.062467 tcp 10.0.2.105 49723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:07.861022 0.068490 tcp 10.0.2.105 49724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:07.929836 0.171196 tcp 10.0.2.105 49725 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:08.324351 3.008578 tcp 10.0.2.105 49726 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:18.124519 0.000000 tcp 10.0.2.105 49726 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:24.030513 0.068115 tcp 10.0.2.105 49727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:24.098924 0.068579 tcp 10.0.2.105 49728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:24.167818 0.152369 tcp 10.0.2.105 49729 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:22:24.333903 2.960564 tcp 10.0.2.105 49730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:33.219432 0.000000 tcp 10.0.2.105 49730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:39.142681 2.954323 tcp 10.0.2.105 49731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:48.021311 0.000000 tcp 10.0.2.105 49731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:22:52.727126 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:22:53.956628 2.960143 tcp 10.0.2.105 49732 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:23:02.937445 0.000000 tcp 10.0.2.105 49732 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:24:35.983197 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:24:42.990753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:24:50.992570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:25:06.995397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:25:39.616048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:28:08.627219 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:28:08.627402 3.003542 tcp 10.0.2.105 49733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:18.923033 0.000000 tcp 10.0.2.105 49733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:24.850756 0.063861 tcp 10.0.2.105 49734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:24.914964 0.142269 tcp 10.0.2.105 49735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:25.057491 0.159995 tcp 10.0.2.105 49736 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:25.725337 2.968397 tcp 10.0.2.105 49737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:34.631063 0.000000 tcp 10.0.2.105 49737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:40.548491 0.059636 tcp 10.0.2.105 49738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:40.608411 0.060163 tcp 10.0.2.105 49739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:40.668856 0.153904 tcp 10.0.2.105 49740 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:40.975468 2.960101 tcp 10.0.2.105 49741 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:49.865554 0.000000 tcp 10.0.2.105 49741 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:28:55.794659 0.061374 tcp 10.0.2.105 49742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:55.856330 0.060709 tcp 10.0.2.105 49743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:55.917370 0.157456 tcp 10.0.2.105 49744 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:28:56.444661 2.960692 tcp 10.0.2.105 49745 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:29:05.332466 0.000000 tcp 10.0.2.105 49745 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:29:11.261819 2.969174 tcp 10.0.2.105 49746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:29:20.159174 0.000000 tcp 10.0.2.105 49746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:29:24.876582 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:29:26.081390 2.972636 tcp 10.0.2.105 49747 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:29:34.980024 0.000000 tcp 10.0.2.105 49747 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:31:43.017689 3.001101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:31:50.024460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:31:58.025878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:32:14.029545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:32:46.035388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:38:25.814178 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:38:25.814264 0.293270 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:26.245992 0.216364 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:26.454124 0.175289 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:26.626346 0.123836 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:26.731381 0.182897 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:26.905638 0.245486 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:27.116726 0.046768 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:27.277557 0.149086 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:27.388111 0.373666 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:27.732962 0.232465 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:27.958178 0.895924 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:28.814557 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 19:38:40.625709 3.003686 tcp 10.0.2.105 49748 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:38:47.336939 0.061152 tcp 10.0.2.105 49749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:47.398348 0.062293 tcp 10.0.2.105 49750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:47.460939 0.152356 tcp 10.0.2.105 49751 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:47.613985 0.181731 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:47.791173 0.073459 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.025423 0.183324 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.240854 0.221286 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.453563 0.172472 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.618677 0.205990 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.790227 0.099939 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:48.955221 0.179013 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:49.184003 0.056890 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:49.238816 0.055611 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:49.401414 0.164482 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:49.544402 0.095031 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:49.628083 0.000000 tcp 10.0.2.105 49748 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:38:49.667729 0.205152 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:50.024764 0.192081 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:50.041443 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 19:38:50.279293 0.180540 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:50.414169 0.440565 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:50.834325 0.151983 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:50.985255 0.350298 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:51.807137 0.185270 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/15 19:38:55.627062 0.063489 tcp 10.0.2.105 49752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:55.690432 0.064587 tcp 10.0.2.105 49753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:55.755324 0.153412 tcp 10.0.2.105 49754 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:38:56.242718 3.208702 tcp 10.0.2.105 49755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:38:57.049152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:39:05.209252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:39:05.397902 0.000000 tcp 10.0.2.105 49755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:39:21.069080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:39:53.069486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:44:11.241445 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:44:11.241533 2.993189 tcp 10.0.2.105 49756 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:20.233315 0.000000 tcp 10.0.2.105 49756 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:26.244646 0.065010 tcp 10.0.2.105 49757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:26.309935 0.061818 tcp 10.0.2.105 49758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:26.372079 0.160016 tcp 10.0.2.105 49759 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:26.779856 2.997369 tcp 10.0.2.105 49760 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:35.775897 0.000000 tcp 10.0.2.105 49760 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:41.778971 0.059657 tcp 10.0.2.105 49761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:41.838917 0.067566 tcp 10.0.2.105 49762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:41.906829 0.443836 tcp 10.0.2.105 49763 -> 195.113.214.249 443 SRPA* 0 0 74 77686 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:42.553096 2.996866 tcp 10.0.2.105 49764 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:51.551021 0.000000 tcp 10.0.2.105 49764 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:44:57.548839 0.061998 tcp 10.0.2.105 49765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:57.610669 0.062022 tcp 10.0.2.105 49766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:57.672954 0.153212 tcp 10.0.2.105 49767 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:44:57.846588 3.005181 tcp 10.0.2.105 49768 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:06.850351 0.000000 tcp 10.0.2.105 49768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:12.843061 2.990294 tcp 10.0.2.105 49769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:21.842070 0.000000 tcp 10.0.2.105 49769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:26.378460 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:45:27.840954 2.993436 tcp 10.0.2.105 49770 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:36.833494 0.000000 tcp 10.0.2.105 49770 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:45:57.075969 3.001127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:46:04.082865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:46:12.084079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:46:28.087125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:47:00.093256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:50:42.844062 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:50:42.844395 3.003633 tcp 10.0.2.105 49771 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:50:51.846605 0.000000 tcp 10.0.2.105 49771 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:50:57.846894 0.064502 tcp 10.0.2.105 49772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:50:57.911732 0.065791 tcp 10.0.2.105 49773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:50:57.977810 0.158951 tcp 10.0.2.105 49774 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:50:58.178942 3.000961 tcp 10.0.2.105 49775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:07.178529 0.000000 tcp 10.0.2.105 49775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:13.335008 0.063540 tcp 10.0.2.105 49776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:13.398908 0.060692 tcp 10.0.2.105 49777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:13.459877 0.149734 tcp 10.0.2.105 49778 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:13.837924 2.980391 tcp 10.0.2.105 49779 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:22.757791 0.000000 tcp 10.0.2.105 49779 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:28.695982 0.059841 tcp 10.0.2.105 49780 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:28.756156 0.062678 tcp 10.0.2.105 49781 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:28.819181 0.161796 tcp 10.0.2.105 49782 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:51:29.296712 2.988180 tcp 10.0.2.105 49783 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:38.293294 0.000000 tcp 10.0.2.105 49783 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:44.282045 3.006960 tcp 10.0.2.105 49784 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:53.274219 0.000000 tcp 10.0.2.105 49784 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:51:57.881434 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:51:59.293677 3.010791 tcp 10.0.2.105 49785 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:52:08.296645 0.000000 tcp 10.0.2.105 49785 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:53:04.098674 3.002573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 19:53:11.106606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:53:19.108195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:53:35.111035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:54:07.117375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 19:57:14.306336 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:57:14.306525 3.003626 tcp 10.0.2.105 49786 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:57:24.583228 0.000000 tcp 10.0.2.105 49786 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:57:30.511980 0.065672 tcp 10.0.2.105 49787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:30.577984 0.069559 tcp 10.0.2.105 49788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:30.647897 0.155378 tcp 10.0.2.105 49789 -> 195.113.214.249 443 SRPA* 0 0 27 14324 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:31.323792 2.957149 tcp 10.0.2.105 49790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:57:40.216934 0.000000 tcp 10.0.2.105 49790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:57:46.142239 0.061525 tcp 10.0.2.105 49791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:46.204068 0.061963 tcp 10.0.2.105 49792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:46.266366 0.157563 tcp 10.0.2.105 49793 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:57:46.732646 2.952866 tcp 10.0.2.105 49794 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:57:55.613032 0.000000 tcp 10.0.2.105 49794 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:01.542249 0.061866 tcp 10.0.2.105 49795 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:58:01.604426 0.060394 tcp 10.0.2.105 49796 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:58:01.665104 0.149191 tcp 10.0.2.105 49797 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 19:58:02.355377 2.957479 tcp 10.0.2.105 49798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:11.239660 0.000000 tcp 10.0.2.105 49798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:17.171100 2.967815 tcp 10.0.2.105 49799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:24.951475 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 19:58:26.102108 0.000000 tcp 10.0.2.105 49799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:32.022592 2.973172 tcp 10.0.2.105 49800 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 19:58:40.918663 0.000000 tcp 10.0.2.105 49800 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:00:11.126339 3.001480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:00:18.130788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:00:26.142503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:00:42.136223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:01:14.141494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:03:46.540919 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:03:46.541091 2.993642 tcp 10.0.2.105 49801 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:03:55.533305 0.000000 tcp 10.0.2.105 49801 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:01.543971 0.064723 tcp 10.0.2.105 49802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:01.608935 0.064277 tcp 10.0.2.105 49803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:01.673511 0.156526 tcp 10.0.2.105 49804 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:01.840593 2.996171 tcp 10.0.2.105 49805 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:10.835308 0.000000 tcp 10.0.2.105 49805 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:16.833873 0.063700 tcp 10.0.2.105 49806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:16.897935 0.064417 tcp 10.0.2.105 49807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:16.962574 0.157871 tcp 10.0.2.105 49808 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:04:17.152143 2.996843 tcp 10.0.2.105 49809 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:26.147493 0.000000 tcp 10.0.2.105 49809 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:32.146030 3.004440 tcp 10.0.2.105 49810 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:41.148822 0.000000 tcp 10.0.2.105 49810 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:04:45.875462 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:07:18.148363 3.000574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:07:25.154244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:07:33.156272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:07:49.159229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:08:21.165213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:09:04.568087 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:09:04.568249 0.168890 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:04.717354 0.301082 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:05.039963 0.176602 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:05.444805 0.124246 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:05.549817 0.185617 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:05.706768 0.220749 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:05.919351 0.048390 udp 10.0.2.105 7010 <-> 79.219.121.215 2430 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:06.129792 0.278249 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:06.370805 0.382973 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:06.727656 0.115520 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:06.808393 0.227416 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.228042 0.090360 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.278271 0.180690 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.437683 0.182877 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.615653 0.076013 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.779647 0.174612 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:07.950386 0.172790 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.115679 0.216054 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.293819 0.095745 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.413912 0.179088 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.667297 0.057295 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.723147 0.241941 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:08.949264 0.200975 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:09.161810 0.189440 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:09.348264 0.062106 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:09.449800 0.167409 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:09.706483 0.213230 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:09.853848 0.457537 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:10.288545 0.153388 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:10.518794 0.353541 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:10.868377 0.184215 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:09:47.149679 3.003547 tcp 10.0.2.105 49811 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:09:51.875450 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:09:56.161839 0.000000 tcp 10.0.2.105 49811 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:02.156977 0.061439 tcp 10.0.2.105 49812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:02.218679 0.060619 tcp 10.0.2.105 49813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:02.279649 0.151968 tcp 10.0.2.105 49814 -> 195.113.214.249 443 SRPA* 0 0 30 15924 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:02.539632 2.985719 tcp 10.0.2.105 49815 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:11.523895 0.000000 tcp 10.0.2.105 49815 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:17.533251 0.071959 tcp 10.0.2.105 49816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:17.605509 0.062399 tcp 10.0.2.105 49817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:17.668156 0.154731 tcp 10.0.2.105 49818 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:17.962456 2.994984 tcp 10.0.2.105 49819 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:26.956099 0.000000 tcp 10.0.2.105 49819 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:32.955351 0.063718 tcp 10.0.2.105 49820 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:33.019373 0.064864 tcp 10.0.2.105 49821 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:33.084565 0.150562 tcp 10.0.2.105 49822 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:10:33.422080 3.001732 tcp 10.0.2.105 49823 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:42.418547 0.000000 tcp 10.0.2.105 49823 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:48.417333 3.003977 tcp 10.0.2.105 49824 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:10:57.419778 0.000000 tcp 10.0.2.105 49824 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:11:02.377034 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:11:03.418802 3.003945 tcp 10.0.2.105 49825 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:11:12.431582 0.000000 tcp 10.0.2.105 49825 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:14:25.172295 3.000667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:14:32.178713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:14:40.180437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:14:56.183514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:15:28.189608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:16:18.421702 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:16:18.421878 2.993813 tcp 10.0.2.105 49826 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:16:27.414358 0.000000 tcp 10.0.2.105 49826 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:16:33.425222 0.063094 tcp 10.0.2.105 49827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:33.488603 0.069194 tcp 10.0.2.105 49828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:33.558092 0.151009 tcp 10.0.2.105 49829 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:34.042357 2.997680 tcp 10.0.2.105 49830 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:16:43.036407 0.000000 tcp 10.0.2.105 49830 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:16:49.035597 0.064114 tcp 10.0.2.105 49831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:49.100032 0.061524 tcp 10.0.2.105 49832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:49.161865 0.153256 tcp 10.0.2.105 49833 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:16:49.625794 3.004741 tcp 10.0.2.105 49834 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:16:58.710329 0.000000 tcp 10.0.2.105 49834 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:04.645750 0.064250 tcp 10.0.2.105 49835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:17:04.710279 0.066559 tcp 10.0.2.105 49836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:17:04.777130 0.154888 tcp 10.0.2.105 49837 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:17:05.184876 2.982008 tcp 10.0.2.105 49838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:14.171531 0.000000 tcp 10.0.2.105 49838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:20.150919 2.992941 tcp 10.0.2.105 49839 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:29.143223 0.000000 tcp 10.0.2.105 49839 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:33.879847 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:17:35.151899 2.994034 tcp 10.0.2.105 49840 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:17:44.144059 0.000000 tcp 10.0.2.105 49840 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:21:32.195622 3.000724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:21:39.202527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:21:47.204151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:22:03.207262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:22:35.213296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:22:50.155403 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:22:50.155560 3.003155 tcp 10.0.2.105 49841 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:22:59.157562 0.000000 tcp 10.0.2.105 49841 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:05.158092 0.061263 tcp 10.0.2.105 49842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:05.219687 0.069250 tcp 10.0.2.105 49843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:05.289256 0.152964 tcp 10.0.2.105 49844 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:05.570006 3.001116 tcp 10.0.2.105 49845 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:14.569604 0.000000 tcp 10.0.2.105 49845 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:20.569244 0.061257 tcp 10.0.2.105 49846 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:20.630878 0.064622 tcp 10.0.2.105 49847 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:20.695730 0.149708 tcp 10.0.2.105 49848 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:21.137572 2.995833 tcp 10.0.2.105 49849 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:30.141997 0.000000 tcp 10.0.2.105 49849 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:36.131472 0.060888 tcp 10.0.2.105 49850 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:36.192707 0.064329 tcp 10.0.2.105 49851 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:36.257364 0.159834 tcp 10.0.2.105 49852 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:23:36.432881 3.002581 tcp 10.0.2.105 49853 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:45.433705 0.000000 tcp 10.0.2.105 49853 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:23:51.432812 3.003766 tcp 10.0.2.105 49854 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:24:00.435876 0.000000 tcp 10.0.2.105 49854 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:24:05.372635 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:24:06.434377 3.004901 tcp 10.0.2.105 49855 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:24:15.437310 0.000000 tcp 10.0.2.105 49855 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:28:39.218504 3.002524 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:28:46.226183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:28:54.228221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:29:10.231188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:29:21.437826 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:29:21.437961 3.003722 tcp 10.0.2.105 49856 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:29:30.440186 0.000000 tcp 10.0.2.105 49856 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:29:36.440523 0.064529 tcp 10.0.2.105 49857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:36.505376 0.061770 tcp 10.0.2.105 49858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:36.567420 0.155171 tcp 10.0.2.105 49859 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:37.034904 2.999045 tcp 10.0.2.105 49860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:29:42.237171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:29:46.042075 0.000000 tcp 10.0.2.105 49860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:29:52.031926 0.060247 tcp 10.0.2.105 49861 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:52.092437 0.063100 tcp 10.0.2.105 49862 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:52.155857 0.152846 tcp 10.0.2.105 49863 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:29:52.802541 2.993990 tcp 10.0.2.105 49864 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:01.795291 0.000000 tcp 10.0.2.105 49864 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:07.804565 0.064685 tcp 10.0.2.105 49865 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:30:07.869493 0.062370 tcp 10.0.2.105 49866 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:30:07.932142 0.161224 tcp 10.0.2.105 49867 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:30:08.451510 2.997676 tcp 10.0.2.105 49868 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:17.447747 0.000000 tcp 10.0.2.105 49868 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:23.446182 3.004705 tcp 10.0.2.105 49869 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:32.449274 0.000000 tcp 10.0.2.105 49869 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:37.376076 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:30:38.448144 3.004324 tcp 10.0.2.105 49870 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:30:47.451813 0.000000 tcp 10.0.2.105 49870 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:35:46.243905 3.000900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:35:53.251036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:36:01.251982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:36:17.255167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:36:49.261331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:39:38.114175 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:39:38.114371 0.175339 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:38.286903 0.124608 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:38.513428 3.005509 tcp 10.0.2.105 49871 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:39:38.533241 0.183774 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:38.690176 0.170558 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:38.839381 0.308195 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:39.224561 0.216478 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:39.432928 0.000000 udp 10.0.2.105 7010 -> 79.219.121.215 2430 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 20:39:47.517291 0.000000 tcp 10.0.2.105 49871 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:39:53.507427 0.066127 tcp 10.0.2.105 49872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:53.573805 0.067698 tcp 10.0.2.105 49873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:53.641809 0.157073 tcp 10.0.2.105 49874 -> 195.113.214.249 443 SRPA* 0 0 60 42946 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:53.926254 3.004543 tcp 10.0.2.105 49875 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:39:56.100133 0.061757 tcp 10.0.2.105 49876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:56.161730 0.061534 tcp 10.0.2.105 49877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:56.223570 0.155767 tcp 10.0.2.105 49878 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:39:56.380502 0.253068 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:56.600955 0.363469 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:56.985491 0.115686 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.066329 0.228173 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.286765 0.094339 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.378431 0.177707 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.532168 0.183926 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.711410 0.074555 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.810520 0.177910 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:57.982184 0.174589 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.149326 0.210225 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.322508 0.092783 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.428974 0.177312 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.714229 0.056364 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.768972 0.096008 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:58.927569 0.203066 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:59.336970 0.192166 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:39:59.526137 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 20:40:02.929971 0.000000 tcp 10.0.2.105 49875 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:40:17.180818 0.060867 tcp 10.0.2.105 49879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:17.241988 0.061367 tcp 10.0.2.105 49880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:17.303656 0.161187 tcp 10.0.2.105 49881 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:17.465486 0.163447 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:40:17.861323 0.145324 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:40:17.951154 0.346549 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 624 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:40:34.645770 0.070544 tcp 10.0.2.105 49882 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:34.716602 0.069669 tcp 10.0.2.105 49883 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:34.786527 0.157627 tcp 10.0.2.105 49884 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:40:34.944646 0.187392 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:40:35.128666 0.502118 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:40:35.603484 0.153297 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/15 20:42:53.266703 3.002496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:43:00.278938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:43:08.275882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:43:25.357028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:43:56.983343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:45:08.919892 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:45:08.920004 2.993581 tcp 10.0.2.105 49885 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:17.922583 0.000000 tcp 10.0.2.105 49885 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:23.929976 0.200915 tcp 10.0.2.105 49886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:24.131175 0.060442 tcp 10.0.2.105 49887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:24.191885 0.223764 tcp 10.0.2.105 49888 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:25.628139 2.972421 tcp 10.0.2.105 49889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:34.557071 0.000000 tcp 10.0.2.105 49889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:40.512686 0.064203 tcp 10.0.2.105 49890 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:40.577178 0.063959 tcp 10.0.2.105 49891 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:40.641418 0.157594 tcp 10.0.2.105 49892 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:40.958325 3.001486 tcp 10.0.2.105 49893 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:49.958391 0.000000 tcp 10.0.2.105 49893 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:45:55.957785 0.063718 tcp 10.0.2.105 49894 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:56.021894 0.065957 tcp 10.0.2.105 49895 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:56.088151 0.149957 tcp 10.0.2.105 49896 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:45:56.260704 3.001193 tcp 10.0.2.105 49897 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:46:05.260099 0.000000 tcp 10.0.2.105 49897 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:46:11.259257 2.994118 tcp 10.0.2.105 49898 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:46:20.262258 0.000000 tcp 10.0.2.105 49898 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:46:24.880688 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:46:26.260954 2.994000 tcp 10.0.2.105 49899 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:46:35.253468 0.000000 tcp 10.0.2.105 49899 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:51:41.264213 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:51:41.264443 3.003226 tcp 10.0.2.105 49900 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:51:50.266548 0.000000 tcp 10.0.2.105 49900 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:51:56.266822 0.066201 tcp 10.0.2.105 49901 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:51:56.333305 0.060470 tcp 10.0.2.105 49902 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:51:56.394058 0.152815 tcp 10.0.2.105 49903 -> 195.113.214.249 443 SRPA* 0 0 37 26260 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:51:56.873722 3.006623 tcp 10.0.2.105 49904 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:05.879061 0.000000 tcp 10.0.2.105 49904 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:11.868204 0.119308 tcp 10.0.2.105 49905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:11.987837 0.064351 tcp 10.0.2.105 49906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:12.052649 0.160952 tcp 10.0.2.105 49907 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:12.373065 3.009808 tcp 10.0.2.105 49908 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:21.381069 0.000000 tcp 10.0.2.105 49908 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:27.370601 0.060625 tcp 10.0.2.105 49909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:27.431501 0.064927 tcp 10.0.2.105 49910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:27.496681 0.156649 tcp 10.0.2.105 49911 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:52:28.020937 2.994120 tcp 10.0.2.105 49912 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:37.013670 0.000000 tcp 10.0.2.105 49912 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:43.022965 2.993352 tcp 10.0.2.105 49913 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:52.015254 0.000000 tcp 10.0.2.105 49913 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:52:56.872415 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:52:58.024151 3.004096 tcp 10.0.2.105 49914 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:53:07.026579 0.000000 tcp 10.0.2.105 49914 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:55:35.302581 3.001938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 20:55:42.310110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:55:50.311797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:56:06.314834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:56:38.320998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 20:58:13.026952 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:58:13.027136 3.007085 tcp 10.0.2.105 49915 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:22.029768 0.000000 tcp 10.0.2.105 49915 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:28.029745 0.067312 tcp 10.0.2.105 49916 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:28.097370 0.061482 tcp 10.0.2.105 49917 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:28.159117 0.157217 tcp 10.0.2.105 49918 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:28.499205 3.010228 tcp 10.0.2.105 49919 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:37.511973 0.000000 tcp 10.0.2.105 49919 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:43.501381 0.064726 tcp 10.0.2.105 49920 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:43.566457 0.065174 tcp 10.0.2.105 49921 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:43.631957 0.157558 tcp 10.0.2.105 49922 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:43.938873 2.996758 tcp 10.0.2.105 49923 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:52.934133 0.000000 tcp 10.0.2.105 49923 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:58:58.933653 0.060084 tcp 10.0.2.105 49924 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:58.994017 0.065110 tcp 10.0.2.105 49925 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:59.059451 0.145815 tcp 10.0.2.105 49926 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 20:58:59.282535 2.995112 tcp 10.0.2.105 49927 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:59:08.276310 0.000000 tcp 10.0.2.105 49927 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:59:14.275067 3.004080 tcp 10.0.2.105 49928 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:59:23.277723 0.000000 tcp 10.0.2.105 49928 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:59:27.874279 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 20:59:29.276828 3.004012 tcp 10.0.2.105 49929 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 20:59:38.279899 0.000000 tcp 10.0.2.105 49929 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:02:42.326424 3.001768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:02:49.333733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:02:57.336043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:03:13.339204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:03:45.344842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:04:44.280316 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:04:44.280415 2.993191 tcp 10.0.2.105 49930 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:04:53.282200 0.000000 tcp 10.0.2.105 49930 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:04:59.282781 0.065413 tcp 10.0.2.105 49931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:04:59.348487 0.062045 tcp 10.0.2.105 49932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:04:59.410894 0.163047 tcp 10.0.2.105 49933 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:04:59.737416 2.998277 tcp 10.0.2.105 49934 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:08.734565 0.000000 tcp 10.0.2.105 49934 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:14.733719 0.059684 tcp 10.0.2.105 49935 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:14.793693 0.061543 tcp 10.0.2.105 49936 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:14.855458 0.159442 tcp 10.0.2.105 49937 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:15.033809 3.003939 tcp 10.0.2.105 49938 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:24.036110 0.000000 tcp 10.0.2.105 49938 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:30.035413 0.063684 tcp 10.0.2.105 49939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:30.099379 0.064214 tcp 10.0.2.105 49940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:30.163883 0.159496 tcp 10.0.2.105 49941 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:05:31.089290 3.001675 tcp 10.0.2.105 49942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:40.089483 0.000000 tcp 10.0.2.105 49942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:46.089549 3.002387 tcp 10.0.2.105 49943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:05:53.879864 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/02/15 21:05:58.992658 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/02/15 21:06:00.178786 0.000000 tcp 10.0.2.105 49943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:06:07.736784 2.957241 tcp 10.0.2.105 49944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:06:16.631092 0.000000 tcp 10.0.2.105 49944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:10:16.651426 2.954333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:10:23.564105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:10:31.452953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:10:47.228221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:10:57.411853 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:10:57.412020 0.000000 udp 10.0.2.105 7010 -> 79.219.121.215 2430 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 21:11:15.525046 0.069177 tcp 10.0.2.105 49945 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:15.594465 0.068198 tcp 10.0.2.105 49946 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:15.662955 0.155264 tcp 10.0.2.105 49947 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:15.818851 0.061063 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:15.877164 0.349745 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2646 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:16.344986 0.176821 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:16.519356 0.304693 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:16.856454 0.187995 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.015126 0.168259 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.164542 0.125064 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.269630 0.210912 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.513296 0.117960 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.595199 0.374967 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:17.941576 0.253195 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:18.159181 0.227476 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:18.380258 0.074528 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:18.511884 2.958111 tcp 10.0.2.105 49948 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:11:18.578194 0.173282 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:18.789299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:11:18.872599 0.171883 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:19.037329 0.180009 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:19.196829 0.086659 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:19.245181 0.179789 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:19.446389 0.058508 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:19.502845 0.099256 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:20.203864 0.203581 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:20.585426 0.209660 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:20.757532 0.099954 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:20.873052 0.178365 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:21.208351 0.187234 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:21.392528 0.165292 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:21.635296 0.144684 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:21.738290 0.642749 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:22.545902 0.459437 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:22.984410 0.153819 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:11:27.387458 0.000000 tcp 10.0.2.105 49948 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:11:33.303041 0.067861 tcp 10.0.2.105 49949 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:33.371165 0.061152 tcp 10.0.2.105 49950 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:33.432898 0.157245 tcp 10.0.2.105 49951 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:11:33.624019 2.955538 tcp 10.0.2.105 49952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:11:42.495373 0.000000 tcp 10.0.2.105 49952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:16:46.418050 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:16:46.418230 3.003680 tcp 10.0.2.105 49953 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:16:55.420482 0.000000 tcp 10.0.2.105 49953 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:01.423938 0.064797 tcp 10.0.2.105 49954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:01.489078 0.063387 tcp 10.0.2.105 49955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:01.553361 0.165314 tcp 10.0.2.105 49956 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:02.082675 2.991532 tcp 10.0.2.105 49957 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:11.085242 0.000000 tcp 10.0.2.105 49957 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:17.082148 0.063569 tcp 10.0.2.105 49958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:17.146020 0.062456 tcp 10.0.2.105 49959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:17.208764 0.159826 tcp 10.0.2.105 49960 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:17.405088 3.000993 tcp 10.0.2.105 49961 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:20.379004 3.002247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:17:26.405139 0.000000 tcp 10.0.2.105 49961 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:27.389813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:17:32.404875 0.060059 tcp 10.0.2.105 49962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:32.465238 0.063730 tcp 10.0.2.105 49963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:32.529262 0.233153 tcp 10.0.2.105 49964 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:17:32.948662 3.000372 tcp 10.0.2.105 49965 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:35.388070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:17:41.951433 0.000000 tcp 10.0.2.105 49965 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:47.946765 3.003631 tcp 10.0.2.105 49966 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:17:51.391857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:17:56.948796 0.000000 tcp 10.0.2.105 49966 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:18:01.876109 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:18:02.950572 3.001372 tcp 10.0.2.105 49967 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:18:11.950167 0.000000 tcp 10.0.2.105 49967 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:18:23.408292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:23:17.951198 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:23:17.951288 2.993480 tcp 10.0.2.105 49968 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:23:26.943384 0.000000 tcp 10.0.2.105 49968 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:23:32.954710 0.068194 tcp 10.0.2.105 49969 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:33.023261 0.063527 tcp 10.0.2.105 49970 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:33.086652 0.158879 tcp 10.0.2.105 49971 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:33.333236 3.003856 tcp 10.0.2.105 49972 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:23:42.335445 0.000000 tcp 10.0.2.105 49972 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:23:48.334981 0.060770 tcp 10.0.2.105 49973 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:48.396126 0.062652 tcp 10.0.2.105 49974 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:48.459148 0.158890 tcp 10.0.2.105 49975 -> 195.113.214.249 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:23:48.649211 3.000008 tcp 10.0.2.105 49976 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:23:57.647609 0.000000 tcp 10.0.2.105 49976 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:03.647175 1.085387 tcp 10.0.2.105 49977 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:24:04.732857 0.062684 tcp 10.0.2.105 49978 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:24:04.795837 0.154652 tcp 10.0.2.105 49979 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:24:05.154480 2.969337 tcp 10.0.2.105 49980 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:14.046215 0.000000 tcp 10.0.2.105 49980 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:19.969757 2.968124 tcp 10.0.2.105 49981 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:28.122372 2.962650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:24:28.870564 0.000000 tcp 10.0.2.105 49981 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:33.529962 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:24:34.788912 2.955834 tcp 10.0.2.105 49982 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:35.046752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:24:42.953837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:24:43.684654 0.000000 tcp 10.0.2.105 49982 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:24:58.765068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:25:30.420963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:29:49.153593 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:29:49.153751 3.009043 tcp 10.0.2.105 49983 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:29:58.156109 0.000000 tcp 10.0.2.105 49983 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:04.155632 0.065145 tcp 10.0.2.105 49984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:04.221076 0.063461 tcp 10.0.2.105 49985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:04.284842 0.162226 tcp 10.0.2.105 49986 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:04.505925 3.003701 tcp 10.0.2.105 49987 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:13.508311 0.000000 tcp 10.0.2.105 49987 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:19.512216 0.062136 tcp 10.0.2.105 49988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:19.574685 0.064167 tcp 10.0.2.105 49989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:19.639116 0.152712 tcp 10.0.2.105 49990 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:19.919347 3.005572 tcp 10.0.2.105 49991 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:28.920059 0.000000 tcp 10.0.2.105 49991 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:34.909569 0.065234 tcp 10.0.2.105 49992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:34.975082 0.061743 tcp 10.0.2.105 49993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:35.037104 0.161565 tcp 10.0.2.105 49994 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:30:35.315989 2.997796 tcp 10.0.2.105 49995 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:44.322648 0.000000 tcp 10.0.2.105 49995 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:50.311187 2.993710 tcp 10.0.2.105 49996 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:30:59.303758 0.000000 tcp 10.0.2.105 49996 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:31:03.880492 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:31:05.312496 2.993999 tcp 10.0.2.105 49997 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:31:14.305578 0.000000 tcp 10.0.2.105 49997 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:31:34.427093 3.006718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:31:41.434474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:31:49.435931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:32:05.441862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:32:37.446212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:36:20.315910 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:36:20.315990 3.003983 tcp 10.0.2.105 49998 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:36:29.318468 0.000000 tcp 10.0.2.105 49998 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:36:35.319041 0.066527 tcp 10.0.2.105 49999 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:35.385873 0.064310 tcp 10.0.2.105 50000 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:35.450483 0.153071 tcp 10.0.2.105 50001 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:35.709116 3.002694 tcp 10.0.2.105 50002 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:36:44.710770 0.000000 tcp 10.0.2.105 50002 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:36:50.709729 0.061290 tcp 10.0.2.105 50003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:50.771339 0.065492 tcp 10.0.2.105 50004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:50.837131 0.153900 tcp 10.0.2.105 50005 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:36:51.012177 2.991455 tcp 10.0.2.105 50006 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:37:00.012616 0.000000 tcp 10.0.2.105 50006 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:37:06.011248 2.993892 tcp 10.0.2.105 50007 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:37:15.004125 0.000000 tcp 10.0.2.105 50007 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:37:19.880688 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:38:41.451246 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:38:48.458781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:38:56.460061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:39:12.462715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:39:44.469120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:41:32.704759 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:41:32.704950 0.061515 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:32.763567 0.353412 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:33.684637 0.177733 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:33.859820 0.000000 udp 10.0.2.105 7010 -> 59.148.222.37 9956 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 21:41:51.493381 0.065946 tcp 10.0.2.105 50008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:41:51.559633 0.063482 tcp 10.0.2.105 50009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:41:51.623393 0.166274 tcp 10.0.2.105 50010 -> 195.113.214.249 443 SRPA* 0 0 44 32124 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:41:51.790622 0.188627 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:51.952180 0.285611 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:52.367580 0.124266 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:52.471456 0.366746 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:52.810859 0.249585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:53.026703 0.211167 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:53.230093 0.118335 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:53.405927 0.225369 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:53.623881 0.076424 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2591 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:53.870213 0.172399 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.039044 0.174470 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.205723 0.185700 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.416246 0.081772 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.473396 0.095573 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.725116 0.182773 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.903177 0.057559 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:54.959216 0.201668 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:55.194819 0.213134 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:55.371947 0.095682 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:55.459284 0.174520 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:55.669464 0.198846 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:55.798072 0.188372 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:56.152123 0.166208 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:56.437325 0.169761 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:56.808869 0.184698 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:41:56.989738 0.452999 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/15 21:42:21.013902 3.004417 tcp 10.0.2.105 50011 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:42:25.880430 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:42:30.016661 0.000000 tcp 10.0.2.105 50011 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:42:36.016435 0.064484 tcp 10.0.2.105 50012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:36.081287 0.070173 tcp 10.0.2.105 50013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:36.151703 0.170430 tcp 10.0.2.105 50014 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:37.143135 3.008601 tcp 10.0.2.105 50015 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:42:46.150014 0.000000 tcp 10.0.2.105 50015 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:42:52.139497 0.064236 tcp 10.0.2.105 50016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:52.204057 0.066106 tcp 10.0.2.105 50017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:52.270447 0.162436 tcp 10.0.2.105 50018 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:42:52.597965 2.995574 tcp 10.0.2.105 50019 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:01.602975 0.000000 tcp 10.0.2.105 50019 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:07.591894 0.065375 tcp 10.0.2.105 50020 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:43:07.657647 0.061986 tcp 10.0.2.105 50021 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:43:07.719952 0.156952 tcp 10.0.2.105 50022 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:43:08.283278 3.002824 tcp 10.0.2.105 50023 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:17.284886 0.000000 tcp 10.0.2.105 50023 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:23.283437 3.004499 tcp 10.0.2.105 50024 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:32.286588 0.000000 tcp 10.0.2.105 50024 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:36.872675 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:43:38.285603 3.003837 tcp 10.0.2.105 50025 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:43:47.288249 0.000000 tcp 10.0.2.105 50025 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:45:48.475191 3.001455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:45:55.482809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:46:03.484017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:46:19.487019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:46:51.492994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:48:53.288504 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:48:53.288689 3.003395 tcp 10.0.2.105 50026 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:02.291138 0.000000 tcp 10.0.2.105 50026 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:08.291375 0.062214 tcp 10.0.2.105 50027 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:08.353866 0.064503 tcp 10.0.2.105 50028 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:08.418678 0.156282 tcp 10.0.2.105 50029 -> 195.113.214.249 443 SRPA* 0 0 22 12874 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:09.196794 2.998017 tcp 10.0.2.105 50030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:18.193632 0.000000 tcp 10.0.2.105 50030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:24.193409 0.062504 tcp 10.0.2.105 50031 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:24.256376 0.064860 tcp 10.0.2.105 50032 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:24.321610 0.159449 tcp 10.0.2.105 50033 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:24.588243 2.999081 tcp 10.0.2.105 50034 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:33.585823 0.000000 tcp 10.0.2.105 50034 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:39.585256 0.063613 tcp 10.0.2.105 50035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:39.649144 0.138840 tcp 10.0.2.105 50036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:39.788369 0.155418 tcp 10.0.2.105 50037 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:49:40.132465 3.008543 tcp 10.0.2.105 50038 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:49.138653 0.000000 tcp 10.0.2.105 50038 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:49:55.126832 3.004186 tcp 10.0.2.105 50039 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:50:04.129770 0.000000 tcp 10.0.2.105 50039 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:50:08.876139 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:50:10.128980 3.003756 tcp 10.0.2.105 50040 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:50:19.141653 0.000000 tcp 10.0.2.105 50040 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:55:25.132508 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:55:25.132603 2.992781 tcp 10.0.2.105 50041 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:55:34.124328 0.000000 tcp 10.0.2.105 50041 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:55:40.134371 0.062615 tcp 10.0.2.105 50042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:40.197300 0.065170 tcp 10.0.2.105 50043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:40.262707 0.153417 tcp 10.0.2.105 50044 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:40.683273 3.000108 tcp 10.0.2.105 50045 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:55:49.676795 0.000000 tcp 10.0.2.105 50045 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:55:55.675720 0.064562 tcp 10.0.2.105 50046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:55.740580 0.061161 tcp 10.0.2.105 50047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:55.802063 0.158854 tcp 10.0.2.105 50048 -> 195.113.214.249 443 SRPA* 0 0 27 9832 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:55:56.223557 3.007251 tcp 10.0.2.105 50049 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:05.228982 0.000000 tcp 10.0.2.105 50049 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:11.218590 0.061544 tcp 10.0.2.105 50050 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:56:11.280469 0.064820 tcp 10.0.2.105 50051 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:56:11.345549 0.158718 tcp 10.0.2.105 50052 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 21:56:11.534178 3.008486 tcp 10.0.2.105 50053 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:20.546523 0.000000 tcp 10.0.2.105 50053 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:26.529624 2.994191 tcp 10.0.2.105 50054 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:35.532684 0.000000 tcp 10.0.2.105 50054 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:40.379489 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 21:56:41.531644 2.993948 tcp 10.0.2.105 50055 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:56:50.527068 0.000000 tcp 10.0.2.105 50055 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 21:57:03.511269 2.996075 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 21:57:10.512783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:57:18.514345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:57:34.518754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 21:58:06.522945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:01:56.534765 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:01:56.534986 3.003711 tcp 10.0.2.105 50056 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:05.537098 0.000000 tcp 10.0.2.105 50056 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:11.537988 0.063772 tcp 10.0.2.105 50057 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:11.602060 0.064932 tcp 10.0.2.105 50058 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:11.667316 0.152779 tcp 10.0.2.105 50059 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:11.971734 2.999202 tcp 10.0.2.105 50060 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:20.969429 0.000000 tcp 10.0.2.105 50060 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:26.969868 0.064294 tcp 10.0.2.105 50061 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:27.034530 0.061032 tcp 10.0.2.105 50062 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:27.095903 0.157420 tcp 10.0.2.105 50063 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:27.287850 3.004877 tcp 10.0.2.105 50064 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:36.291351 0.000000 tcp 10.0.2.105 50064 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:42.280585 0.158657 tcp 10.0.2.105 50065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:42.439527 0.062772 tcp 10.0.2.105 50066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:42.502585 0.156053 tcp 10.0.2.105 50067 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:02:42.745602 2.998903 tcp 10.0.2.105 50068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:51.743068 0.000000 tcp 10.0.2.105 50068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:02:57.742819 2.993732 tcp 10.0.2.105 50069 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:03:06.735073 0.000000 tcp 10.0.2.105 50069 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:03:11.371702 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:03:12.743750 3.005381 tcp 10.0.2.105 50070 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:03:21.746760 0.000000 tcp 10.0.2.105 50070 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:04:10.530402 3.000841 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:04:17.536966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:04:25.538760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:04:41.541720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:05:13.547996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:11:17.554441 3.000679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 22:11:24.563840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:11:32.562297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:11:48.897322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:12:20.607822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:12:24.947957 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:12:24.948032 0.302624 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:25.337831 0.055917 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:25.390602 0.349278 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:25.735874 0.175408 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:26.189951 0.191072 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2557 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:26.351361 0.170208 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:26.619457 0.124937 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:26.726213 0.380647 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:27.080160 0.278910 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:27.320239 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 22:12:27.772479 2.993361 tcp 10.0.2.105 50071 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:12:36.764660 0.000000 tcp 10.0.2.105 50071 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:12:42.775214 0.067827 tcp 10.0.2.105 50072 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:42.843429 0.068384 tcp 10.0.2.105 50073 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:42.912064 0.164091 tcp 10.0.2.105 50074 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:43.197294 3.001057 tcp 10.0.2.105 50075 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:12:45.057560 0.063353 tcp 10.0.2.105 50076 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:45.121214 0.065607 tcp 10.0.2.105 50077 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:45.187161 0.172425 tcp 10.0.2.105 50078 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:12:45.360161 0.080165 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:45.424451 0.173405 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:45.595217 0.173079 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:45.761655 0.116836 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:12:45.842436 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 22:12:52.196721 0.000000 tcp 10.0.2.105 50075 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:13:04.443809 0.063746 tcp 10.0.2.105 50079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:13:04.507841 0.065510 tcp 10.0.2.105 50080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:13:04.573741 0.158316 tcp 10.0.2.105 50081 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:13:04.732830 0.187310 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2596 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:04.895213 0.093205 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:04.997339 0.094263 udp 10.0.2.105 7010 <-> 86.171.39.32 5698 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:05.077168 0.182364 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:05.327718 0.057001 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:05.567376 0.200884 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:05.978268 0.215085 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:06.155503 0.095448 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:06.406048 0.179624 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:06.682644 0.168991 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:06.809936 0.190251 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:07.077558 0.184476 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:07.259047 0.170516 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:07.472758 0.153204 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:13:07.661077 0.446725 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:17:58.197204 0.147296 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:17:58.344674 2.972625 tcp 10.0.2.105 50082 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:07.265031 0.000000 tcp 10.0.2.105 50082 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:13.223992 0.061440 tcp 10.0.2.105 50083 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:13.285721 0.065717 tcp 10.0.2.105 50084 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:13.351773 0.156374 tcp 10.0.2.105 50085 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:13.574637 2.980812 tcp 10.0.2.105 50086 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:22.562016 0.000000 tcp 10.0.2.105 50086 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:24.586650 3.002551 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:18:28.561084 0.063279 tcp 10.0.2.105 50087 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:28.624664 0.061051 tcp 10.0.2.105 50088 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:28.686072 0.155123 tcp 10.0.2.105 50089 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:29.207083 2.998492 tcp 10.0.2.105 50090 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:31.595466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:18:38.237747 0.000000 tcp 10.0.2.105 50090 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:39.619664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:18:44.205122 0.064444 tcp 10.0.2.105 50091 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:44.269823 0.068628 tcp 10.0.2.105 50092 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:44.338731 0.157668 tcp 10.0.2.105 50093 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:18:44.805464 3.002514 tcp 10.0.2.105 50094 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:53.806847 0.000000 tcp 10.0.2.105 50094 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:18:55.599419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:18:59.805417 3.004174 tcp 10.0.2.105 50095 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:19:08.808232 0.000000 tcp 10.0.2.105 50095 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:19:13.374720 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:19:14.807388 3.003439 tcp 10.0.2.105 50096 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:19:23.809756 0.000000 tcp 10.0.2.105 50096 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:19:27.605474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:24:29.810512 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:24:29.810601 2.993432 tcp 10.0.2.105 50097 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:24:38.812729 0.000000 tcp 10.0.2.105 50097 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:24:44.813245 0.061249 tcp 10.0.2.105 50098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:24:44.874756 0.066644 tcp 10.0.2.105 50099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:24:44.941731 0.156250 tcp 10.0.2.105 50100 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:24:45.169998 2.986325 tcp 10.0.2.105 50101 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:24:54.154815 0.000000 tcp 10.0.2.105 50101 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:00.163783 0.060432 tcp 10.0.2.105 50102 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:00.224529 0.064288 tcp 10.0.2.105 50103 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:00.289139 0.153745 tcp 10.0.2.105 50104 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:00.567481 3.001118 tcp 10.0.2.105 50105 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:09.567264 0.000000 tcp 10.0.2.105 50105 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:15.566469 0.064643 tcp 10.0.2.105 50106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:15.631377 0.062823 tcp 10.0.2.105 50107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:15.694505 0.161993 tcp 10.0.2.105 50108 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:25:16.172645 3.008215 tcp 10.0.2.105 50109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:25.179614 0.000000 tcp 10.0.2.105 50109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:31.168352 3.004504 tcp 10.0.2.105 50110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:31.611827 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:25:38.618825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:25:40.171184 0.000000 tcp 10.0.2.105 50110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:44.877841 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:25:46.172947 2.990983 tcp 10.0.2.105 50111 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:25:46.622838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:25:55.172690 0.000000 tcp 10.0.2.105 50111 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:26:02.623377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:26:34.631498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:31:01.173273 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:31:01.173417 3.007434 tcp 10.0.2.105 50112 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:10.175365 0.000000 tcp 10.0.2.105 50112 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:16.176476 0.065680 tcp 10.0.2.105 50113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:16.242529 0.063671 tcp 10.0.2.105 50114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:16.306541 0.150844 tcp 10.0.2.105 50115 -> 195.113.214.249 443 SRPA* 0 0 20 10060 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:16.663318 3.005891 tcp 10.0.2.105 50116 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:25.673390 0.000000 tcp 10.0.2.105 50116 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:31.657342 0.071752 tcp 10.0.2.105 50117 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:31.729585 0.061062 tcp 10.0.2.105 50118 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:31.790909 0.157112 tcp 10.0.2.105 50119 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:32.635469 3.491742 tcp 10.0.2.105 50120 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:42.053676 0.000000 tcp 10.0.2.105 50120 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:47.982258 0.068045 tcp 10.0.2.105 50121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:48.050585 0.066594 tcp 10.0.2.105 50122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:48.117493 0.171750 tcp 10.0.2.105 50123 -> 195.113.214.249 443 SRPA* 0 0 43 35520 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:31:48.305247 2.958181 tcp 10.0.2.105 50124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:31:57.203593 0.000000 tcp 10.0.2.105 50124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:32:03.122616 2.953139 tcp 10.0.2.105 50125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:32:12.006199 0.000000 tcp 10.0.2.105 50125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:32:16.871185 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:32:17.962849 3.004426 tcp 10.0.2.105 50126 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:32:26.965441 0.000000 tcp 10.0.2.105 50126 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:32:38.636461 3.000593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:32:45.642909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:32:53.644394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:33:09.647227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:33:41.653414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:37:32.966301 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:37:32.966397 3.003909 tcp 10.0.2.105 50127 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:37:41.969030 0.000000 tcp 10.0.2.105 50127 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:37:47.968939 0.072696 tcp 10.0.2.105 50128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:37:48.041900 0.062374 tcp 10.0.2.105 50129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:37:48.104595 0.161174 tcp 10.0.2.105 50130 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:37:48.519666 3.002998 tcp 10.0.2.105 50131 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:37:57.521174 0.000000 tcp 10.0.2.105 50131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:03.520908 0.061257 tcp 10.0.2.105 50132 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:03.582410 0.067696 tcp 10.0.2.105 50133 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:03.650345 0.156042 tcp 10.0.2.105 50134 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:03.979156 2.995135 tcp 10.0.2.105 50135 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:12.972933 0.000000 tcp 10.0.2.105 50135 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:18.972168 0.064199 tcp 10.0.2.105 50136 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:19.036649 0.064483 tcp 10.0.2.105 50137 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:19.101415 0.158994 tcp 10.0.2.105 50138 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:38:19.299061 2.997133 tcp 10.0.2.105 50139 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:29.110448 0.000000 tcp 10.0.2.105 50139 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:35.037800 2.964630 tcp 10.0.2.105 50140 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:43.924708 0.000000 tcp 10.0.2.105 50140 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:48.447679 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:38:49.851747 2.968432 tcp 10.0.2.105 50141 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:38:58.741219 0.000000 tcp 10.0.2.105 50141 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:39:45.658975 3.002526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:39:52.666733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:40:00.668211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:40:16.673097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:40:48.677520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:43:17.455145 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:43:17.455340 0.214713 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:17.662354 0.230839 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:17.885926 0.055698 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:17.996068 0.307519 udp 10.0.2.105 7010 <-> 59.148.222.37 9956 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:18.493996 0.350139 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:18.992469 0.167975 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:19.141050 0.125422 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:19.256669 0.190122 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:19.415640 0.351507 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:19.739444 0.177671 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:19.913991 0.253653 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:20.133347 0.075415 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:20.545275 0.175133 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:20.713028 0.170839 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:20.880731 0.111044 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:21.120051 0.184411 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:21.282836 0.085047 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:21.418924 0.000000 udp 10.0.2.105 7010 -> 86.171.39.32 5698 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 22:43:38.743422 0.066127 tcp 10.0.2.105 50142 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:38.809848 0.062166 tcp 10.0.2.105 50143 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:38.872445 0.170103 tcp 10.0.2.105 50144 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:39.043040 0.203569 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:39.261186 0.181832 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:39.604456 0.057285 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:39.659577 0.180547 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:40.234023 0.237282 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:40.436235 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 22:43:57.809920 0.063917 tcp 10.0.2.105 50145 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:57.874107 0.067074 tcp 10.0.2.105 50146 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:57.941475 0.162108 tcp 10.0.2.105 50147 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:43:58.104132 0.138962 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:58.193310 0.186763 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:58.458086 0.188549 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:43:58.643054 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 22:44:04.299020 3.003846 tcp 10.0.2.105 50148 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:13.311467 0.000000 tcp 10.0.2.105 50148 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:16.626895 0.060268 tcp 10.0.2.105 50149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:16.687497 0.071480 tcp 10.0.2.105 50150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:16.759305 0.167347 tcp 10.0.2.105 50151 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:16.927357 0.157895 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:44:17.151756 0.482033 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/15 22:44:19.300563 0.061243 tcp 10.0.2.105 50152 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:19.362094 0.064257 tcp 10.0.2.105 50153 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:19.426644 0.154723 tcp 10.0.2.105 50154 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:19.794549 3.000674 tcp 10.0.2.105 50155 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:28.793776 0.000000 tcp 10.0.2.105 50155 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:34.793323 0.064069 tcp 10.0.2.105 50156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:34.857696 0.062655 tcp 10.0.2.105 50157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:34.920685 0.165750 tcp 10.0.2.105 50158 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:44:35.225294 3.002010 tcp 10.0.2.105 50159 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:44.226074 0.000000 tcp 10.0.2.105 50159 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:50.225065 3.004083 tcp 10.0.2.105 50160 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:44:59.227431 0.000000 tcp 10.0.2.105 50160 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:45:03.874011 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:46:52.685529 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:46:59.690652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:47:07.692184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:47:23.695042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:47:55.701150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:50:05.228077 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:50:05.228169 3.003506 tcp 10.0.2.105 50161 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:14.230222 0.000000 tcp 10.0.2.105 50161 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:20.231220 0.066018 tcp 10.0.2.105 50162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:20.297546 0.064304 tcp 10.0.2.105 50163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:20.362120 0.161313 tcp 10.0.2.105 50164 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:20.720136 2.994101 tcp 10.0.2.105 50165 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:29.722599 0.000000 tcp 10.0.2.105 50165 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:35.722118 0.124632 tcp 10.0.2.105 50166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:35.846573 0.066941 tcp 10.0.2.105 50167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:35.913788 0.197758 tcp 10.0.2.105 50168 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:50:37.302516 2.996243 tcp 10.0.2.105 50169 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:46.300505 0.000000 tcp 10.0.2.105 50169 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:52.295165 3.004333 tcp 10.0.2.105 50170 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:50:59.876158 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:51:01.298222 0.000000 tcp 10.0.2.105 50170 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:53:59.708123 3.000914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 22:54:06.714662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:54:14.716099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:54:30.719735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:55:02.724988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 22:56:07.301323 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 22:56:07.301457 3.001358 tcp 10.0.2.105 50171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:16.300954 0.000000 tcp 10.0.2.105 50171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:22.301525 0.066107 tcp 10.0.2.105 50172 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:22.367928 0.061751 tcp 10.0.2.105 50173 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:22.430058 0.166585 tcp 10.0.2.105 50174 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:22.858324 2.996268 tcp 10.0.2.105 50175 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:31.853484 0.000000 tcp 10.0.2.105 50175 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:37.852685 0.066036 tcp 10.0.2.105 50176 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:37.918969 0.063002 tcp 10.0.2.105 50177 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:37.982264 0.166165 tcp 10.0.2.105 50178 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 22:56:38.331808 2.995086 tcp 10.0.2.105 50179 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:47.325693 0.000000 tcp 10.0.2.105 50179 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:56:53.324843 3.004176 tcp 10.0.2.105 50180 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:57:02.327113 0.000000 tcp 10.0.2.105 50180 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 22:57:06.873510 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:01:06.732191 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:01:13.738516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:01:21.740255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:01:37.742804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:02:08.337510 0.000215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:02:08.337825 2.993430 tcp 10.0.2.105 50181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:09.769273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:02:17.330486 0.000000 tcp 10.0.2.105 50181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:23.330174 0.065003 tcp 10.0.2.105 50182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:23.395468 0.068587 tcp 10.0.2.105 50183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:23.464505 0.158492 tcp 10.0.2.105 50184 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:23.638843 3.004694 tcp 10.0.2.105 50185 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:32.652047 0.000000 tcp 10.0.2.105 50185 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:38.631505 0.062562 tcp 10.0.2.105 50186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:38.694321 0.063642 tcp 10.0.2.105 50187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:38.758249 0.157592 tcp 10.0.2.105 50188 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:02:38.930044 2.995002 tcp 10.0.2.105 50189 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:47.924109 0.000000 tcp 10.0.2.105 50189 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:02:53.927085 3.008951 tcp 10.0.2.105 50190 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:03:02.924997 0.000000 tcp 10.0.2.105 50190 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:03:07.872779 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:08:13.775652 3.001018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:08:20.782733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:08:28.784054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:08:44.787367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:09:16.793390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:14:21.972132 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:14:21.972362 0.000000 udp 10.0.2.105 7010 -> 86.171.39.32 5698 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:14:37.716606 0.064056 tcp 10.0.2.105 50191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:37.781007 0.062428 tcp 10.0.2.105 50192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:37.843738 0.168019 tcp 10.0.2.105 50193 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:38.012793 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:14:56.552587 0.063292 tcp 10.0.2.105 50194 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:56.616123 0.066947 tcp 10.0.2.105 50195 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:56.683390 0.153501 tcp 10.0.2.105 50196 -> 195.113.214.249 443 SRPA* 0 0 24 13196 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:14:56.837476 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:15:15.579869 0.063210 tcp 10.0.2.105 50197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:15.643456 0.062038 tcp 10.0.2.105 50198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:15.705765 0.163548 tcp 10.0.2.105 50199 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:15.870019 0.055879 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:15.922938 0.229725 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:16.483338 0.212219 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:16.688450 0.000000 udp 10.0.2.105 7010 -> 59.148.222.37 9956 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:15:20.798553 3.002323 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:15:23.971515 2.993234 tcp 10.0.2.105 50200 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:15:27.806553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:15:32.963946 0.000000 tcp 10.0.2.105 50200 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:15:33.665768 0.061569 tcp 10.0.2.105 50201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:33.727610 0.139479 tcp 10.0.2.105 50202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:33.867452 0.163145 tcp 10.0.2.105 50203 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:34.031180 0.349624 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:34.545346 0.124027 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:34.650309 0.166416 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:34.907297 0.351066 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:35.231177 0.187916 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:35.388636 0.176385 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:35.560773 0.253483 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:35.779181 0.184235 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:35.807974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:15:35.995706 0.173837 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.162573 0.074002 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.268593 0.173580 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.438114 0.152896 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.560068 0.081176 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.689258 0.201026 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.920696 0.058175 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:36.977110 0.182298 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:37.183450 0.178913 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:37.475180 0.212194 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:37.651213 0.189486 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:37.791330 0.186150 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:37.974204 0.190270 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:38.183823 0.154503 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:38.430776 0.443728 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:15:38.973233 0.119906 tcp 10.0.2.105 50204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:39.093452 0.064766 tcp 10.0.2.105 50205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:39.158529 0.173914 tcp 10.0.2.105 50206 -> 195.113.214.249 443 SRPA* 0 0 43 38408 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:15:39.432394 2.995295 tcp 10.0.2.105 50207 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:15:48.426353 0.000000 tcp 10.0.2.105 50207 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:15:51.810987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:16:23.817360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:20:54.426705 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:20:54.426806 3.003742 tcp 10.0.2.105 50208 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:03.429302 0.000000 tcp 10.0.2.105 50208 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:09.432651 0.065859 tcp 10.0.2.105 50209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:09.498807 0.061855 tcp 10.0.2.105 50210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:09.560956 0.159762 tcp 10.0.2.105 50211 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:09.827140 2.997830 tcp 10.0.2.105 50212 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:18.822628 0.000000 tcp 10.0.2.105 50212 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:24.820808 0.065990 tcp 10.0.2.105 50213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:24.887080 0.063666 tcp 10.0.2.105 50214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:24.951039 0.174209 tcp 10.0.2.105 50215 -> 195.113.214.249 443 SRPA* 0 0 40 32438 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:21:25.625323 3.000057 tcp 10.0.2.105 50216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:34.623963 0.000000 tcp 10.0.2.105 50216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:40.622909 3.003961 tcp 10.0.2.105 50217 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:49.625546 0.000000 tcp 10.0.2.105 50217 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:21:54.372443 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:22:31.829864 3.000738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:22:38.836531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:22:46.837634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:23:02.840911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:23:34.846737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:26:55.626291 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:26:55.626457 3.003354 tcp 10.0.2.105 50218 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:04.628482 0.000000 tcp 10.0.2.105 50218 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:10.628672 0.065136 tcp 10.0.2.105 50219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:10.694055 0.066419 tcp 10.0.2.105 50220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:10.760730 0.158004 tcp 10.0.2.105 50221 -> 195.113.214.249 443 SRPA* 0 0 52 39876 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:11.171107 3.001079 tcp 10.0.2.105 50222 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:20.170262 0.000000 tcp 10.0.2.105 50222 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:26.170110 0.061838 tcp 10.0.2.105 50223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:26.232314 0.068395 tcp 10.0.2.105 50224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:26.301020 0.167545 tcp 10.0.2.105 50225 -> 195.113.214.249 443 SRPA* 0 0 20 10060 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:27:26.811102 2.993621 tcp 10.0.2.105 50226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:35.803308 0.000000 tcp 10.0.2.105 50226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:41.812082 2.994072 tcp 10.0.2.105 50227 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:50.804713 0.000000 tcp 10.0.2.105 50227 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:27:55.371511 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:29:38.853401 3.002631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:29:45.860114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:29:53.862164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:30:09.864601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:30:41.870966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:32:56.815444 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:32:56.815609 3.003460 tcp 10.0.2.105 50228 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:05.817587 0.000000 tcp 10.0.2.105 50228 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:11.818698 0.061987 tcp 10.0.2.105 50229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:11.881016 0.065345 tcp 10.0.2.105 50230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:11.947118 0.154631 tcp 10.0.2.105 50231 -> 195.113.214.249 443 SRPA* 0 0 35 29044 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:12.609836 3.001811 tcp 10.0.2.105 50232 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:21.610440 0.000000 tcp 10.0.2.105 50232 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:27.609635 0.061362 tcp 10.0.2.105 50233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:27.671210 0.065179 tcp 10.0.2.105 50234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:27.736176 0.246489 tcp 10.0.2.105 50235 -> 195.113.214.249 443 SRPA* 0 0 74 77688 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:33:28.133782 3.000033 tcp 10.0.2.105 50236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:37.142929 0.000000 tcp 10.0.2.105 50236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:43.131568 2.993682 tcp 10.0.2.105 50237 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:52.124212 0.000000 tcp 10.0.2.105 50237 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:33:56.871211 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:36:45.876682 3.001883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:36:52.884195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:37:00.885670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:37:16.889009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:37:48.895060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:38:58.134780 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:38:58.134937 3.003557 tcp 10.0.2.105 50238 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:39:07.137304 0.000000 tcp 10.0.2.105 50238 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:39:13.138323 0.061642 tcp 10.0.2.105 50239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:39:13.200276 0.062399 tcp 10.0.2.105 50240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:39:13.262949 0.167242 tcp 10.0.2.105 50241 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:39:13.524707 3.006435 tcp 10.0.2.105 50242 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:39:22.529507 0.000000 tcp 10.0.2.105 50242 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:43:52.900796 3.001867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/15 23:43:59.908508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:44:07.912796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:44:23.912982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:44:55.921039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:45:51.639280 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:45:51.639483 0.000000 udp 10.0.2.105 7010 -> 59.148.222.37 9956 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:46:08.294891 0.127959 tcp 10.0.2.105 50243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:08.423096 0.071026 tcp 10.0.2.105 50244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:08.494485 0.836670 tcp 10.0.2.105 50245 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:09.332038 0.054211 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:09.383526 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/15 23:46:13.552651 2.974930 tcp 10.0.2.105 50246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:46:22.523356 0.000000 tcp 10.0.2.105 50246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:46:27.240556 0.061421 tcp 10.0.2.105 50247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:27.302255 0.071811 tcp 10.0.2.105 50248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:27.374396 0.175436 tcp 10.0.2.105 50249 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:27.550360 0.214637 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:27.757825 0.353514 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:28.532214 0.064537 tcp 10.0.2.105 50250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:28.538694 0.122911 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:28.597037 0.064598 tcp 10.0.2.105 50251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:28.643580 0.186388 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:28.661896 0.148429 tcp 10.0.2.105 50252 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:46:28.801327 0.176043 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:29.344137 3.003426 tcp 10.0.2.105 50253 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:46:29.483440 0.170144 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:29.658622 0.368821 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:29.998416 0.251016 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:30.300718 0.181664 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:30.460578 0.173958 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:30.719090 0.075902 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:30.778343 0.173246 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:30.948000 0.114014 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:31.139688 0.085330 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:31.187844 0.182153 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:31.380899 0.196320 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:31.696012 0.199852 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:32.009300 0.060987 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:32.326856 0.219947 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:32.510726 0.167364 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:32.735636 0.189010 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:32.921407 0.187912 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:33.106103 0.152233 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:33.476940 0.449960 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/15 23:46:38.345793 0.000000 tcp 10.0.2.105 50253 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:51:44.346487 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:51:44.346665 3.003642 tcp 10.0.2.105 50254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:51:53.349203 0.000000 tcp 10.0.2.105 50254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:51:59.349280 0.061832 tcp 10.0.2.105 50255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:51:59.411449 0.062004 tcp 10.0.2.105 50256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:51:59.473787 0.156852 tcp 10.0.2.105 50257 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:51:59.747706 3.004899 tcp 10.0.2.105 50258 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:08.751040 0.000000 tcp 10.0.2.105 50258 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:14.740074 0.061156 tcp 10.0.2.105 50259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:52:14.801509 0.066165 tcp 10.0.2.105 50260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:52:14.867940 0.158889 tcp 10.0.2.105 50261 -> 195.113.214.249 443 SRPA* 0 0 31 14750 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:52:15.149181 2.995643 tcp 10.0.2.105 50262 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:24.206735 0.000000 tcp 10.0.2.105 50262 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:30.157036 2.978848 tcp 10.0.2.105 50263 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:39.155886 0.000000 tcp 10.0.2.105 50263 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:52:43.871613 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:56:06.925347 3.002537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/15 23:56:13.933695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:56:21.935081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:56:37.938346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:57:09.944383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/15 23:57:45.145373 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/15 23:57:45.145457 3.003553 tcp 10.0.2.105 50264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:57:54.147670 0.000000 tcp 10.0.2.105 50264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:00.147949 0.061252 tcp 10.0.2.105 50265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:00.209492 0.061614 tcp 10.0.2.105 50266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:00.271453 0.169985 tcp 10.0.2.105 50267 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:00.543026 2.998289 tcp 10.0.2.105 50268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:09.539782 0.000000 tcp 10.0.2.105 50268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:15.539217 0.064060 tcp 10.0.2.105 50269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:15.603590 0.066219 tcp 10.0.2.105 50270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:15.670118 0.165213 tcp 10.0.2.105 50271 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/15 23:58:16.168607 2.995076 tcp 10.0.2.105 50272 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:25.172339 0.000000 tcp 10.0.2.105 50272 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:31.161145 2.994445 tcp 10.0.2.105 50273 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:40.153789 0.000000 tcp 10.0.2.105 50273 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/15 23:58:44.870809 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:03:13.950248 3.001559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:03:20.957506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:03:28.960736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:03:44.961539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:03:46.164183 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:03:46.164374 3.008401 tcp 10.0.2.105 50274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:03:55.166861 0.000000 tcp 10.0.2.105 50274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:01.167219 0.064038 tcp 10.0.2.105 50275 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:01.231510 0.065494 tcp 10.0.2.105 50276 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:01.297359 0.151715 tcp 10.0.2.105 50277 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:01.587962 3.002538 tcp 10.0.2.105 50278 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:10.589088 0.000000 tcp 10.0.2.105 50278 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:16.588172 0.066692 tcp 10.0.2.105 50279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:16.655175 0.064685 tcp 10.0.2.105 50280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:16.720120 0.161016 tcp 10.0.2.105 50281 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:04:16.968383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:04:17.006251 3.006002 tcp 10.0.2.105 50282 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:26.010866 0.000000 tcp 10.0.2.105 50282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:31.999884 2.993940 tcp 10.0.2.105 50283 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:41.002704 0.000000 tcp 10.0.2.105 50283 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:04:45.879707 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:09:47.005953 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:09:47.006131 3.000801 tcp 10.0.2.105 50284 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:09:56.006172 0.000000 tcp 10.0.2.105 50284 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:02.005686 0.069968 tcp 10.0.2.105 50285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:02.075638 0.066244 tcp 10.0.2.105 50286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:02.142202 0.163790 tcp 10.0.2.105 50287 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:02.391247 2.997980 tcp 10.0.2.105 50288 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:11.387597 0.000000 tcp 10.0.2.105 50288 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:17.388339 0.069113 tcp 10.0.2.105 50289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:17.457746 0.068727 tcp 10.0.2.105 50290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:17.526778 0.191621 tcp 10.0.2.105 50291 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:10:17.736018 3.005131 tcp 10.0.2.105 50292 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:26.739778 0.000000 tcp 10.0.2.105 50292 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:32.728854 3.004037 tcp 10.0.2.105 50293 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:32.982196 3.000943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:10:39.988380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:10:41.731377 0.000000 tcp 10.0.2.105 50293 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:10:46.378055 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:10:47.990567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:11:03.992719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:11:35.999144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:16:46.629137 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:16:46.629302 0.231674 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:16:46.853198 0.055964 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:16:47.158596 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 00:16:47.739185 3.002975 tcp 10.0.2.105 50294 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:16:56.740582 0.000000 tcp 10.0.2.105 50294 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:17:02.741325 0.064612 tcp 10.0.2.105 50295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:02.806232 0.065564 tcp 10.0.2.105 50296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:02.859696 0.065232 tcp 10.0.2.105 50297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:02.872072 0.154892 tcp 10.0.2.105 50298 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:02.925220 0.065757 tcp 10.0.2.105 50299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:02.991272 0.255136 tcp 10.0.2.105 50300 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:17:03.246927 0.349037 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:03.338161 2.996110 tcp 10.0.2.105 50301 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:17:03.870410 0.125732 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:03.975433 0.187067 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:04.241916 0.356551 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:04.571623 0.248049 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:04.973069 0.177352 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:05.146245 0.168332 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:05.660160 0.184957 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:05.821924 0.174533 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:05.987897 0.073403 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:06.295505 0.181492 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:06.474171 0.113028 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:06.572096 0.087013 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:06.621754 0.199609 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:06.829020 0.181158 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.005577 0.178537 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.318420 0.057828 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.374608 0.215205 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.628948 0.142456 udp 10.0.2.105 7010 <-> 109.55.15.125 5025 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.731336 0.188536 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:07.995676 0.188971 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:08.207856 0.170432 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:08.377252 0.442690 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:17:12.342776 0.000000 tcp 10.0.2.105 50301 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:17:40.005499 3.744745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 00:17:47.710963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:17:55.615825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:18:11.433785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:18:43.072621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:22:18.333479 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:22:18.333573 3.003647 tcp 10.0.2.105 50302 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:22:27.335966 0.000000 tcp 10.0.2.105 50302 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:22:33.336648 0.061114 tcp 10.0.2.105 50303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:33.398022 0.064615 tcp 10.0.2.105 50304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:33.462972 0.167981 tcp 10.0.2.105 50305 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:34.172780 3.007085 tcp 10.0.2.105 50306 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:22:43.178648 0.000000 tcp 10.0.2.105 50306 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:22:49.170450 0.066262 tcp 10.0.2.105 50307 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:49.237041 0.069337 tcp 10.0.2.105 50308 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:49.306657 0.155583 tcp 10.0.2.105 50309 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:22:49.599716 3.002311 tcp 10.0.2.105 50310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:22:58.600963 0.000000 tcp 10.0.2.105 50310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:23:04.599411 3.146101 tcp 10.0.2.105 50311 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:23:13.699897 0.000000 tcp 10.0.2.105 50311 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:23:18.440908 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:24:47.039934 3.001026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:24:54.046796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:25:02.048306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:25:18.051224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:25:50.057292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:28:19.613200 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:28:19.613383 3.006072 tcp 10.0.2.105 50312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:28:28.619410 0.000000 tcp 10.0.2.105 50312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:28:34.615361 0.064614 tcp 10.0.2.105 50313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:34.680314 0.063575 tcp 10.0.2.105 50314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:34.744385 0.161866 tcp 10.0.2.105 50315 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:35.290786 2.998240 tcp 10.0.2.105 50316 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:28:44.287601 0.000000 tcp 10.0.2.105 50316 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:28:50.287348 0.064940 tcp 10.0.2.105 50317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:50.352610 0.061288 tcp 10.0.2.105 50318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:50.414223 0.222543 tcp 10.0.2.105 50319 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:28:50.757986 3.003553 tcp 10.0.2.105 50320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:28:59.759996 0.000000 tcp 10.0.2.105 50320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:29:05.758824 3.003934 tcp 10.0.2.105 50321 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:29:14.771564 0.000000 tcp 10.0.2.105 50321 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:29:19.378115 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:31:54.063035 3.003262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:32:01.070785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:32:09.073397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:32:25.078490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:32:57.091170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:34:20.762191 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:34:20.762273 2.993168 tcp 10.0.2.105 50322 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:34:29.754268 0.000000 tcp 10.0.2.105 50322 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:34:35.765324 0.061593 tcp 10.0.2.105 50323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:35.826852 0.065477 tcp 10.0.2.105 50324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:35.892669 0.153441 tcp 10.0.2.105 50325 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:36.182449 2.995759 tcp 10.0.2.105 50326 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:34:45.176873 0.000000 tcp 10.0.2.105 50326 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:34:51.175692 0.061085 tcp 10.0.2.105 50327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:51.237048 0.063905 tcp 10.0.2.105 50328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:51.301267 0.162888 tcp 10.0.2.105 50329 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:34:51.699185 3.001377 tcp 10.0.2.105 50330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:35:00.863277 0.000000 tcp 10.0.2.105 50330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:35:06.801995 2.976274 tcp 10.0.2.105 50331 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:35:15.719695 0.000000 tcp 10.0.2.105 50331 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:35:20.377247 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:39:01.096736 3.002117 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:39:08.104199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:39:16.105971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:39:32.109295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:40:04.115185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:40:21.701223 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:40:21.701415 2.994001 tcp 10.0.2.105 50332 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:40:30.693531 0.000000 tcp 10.0.2.105 50332 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:40:36.706401 0.069255 tcp 10.0.2.105 50333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:36.775979 0.065400 tcp 10.0.2.105 50334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:36.841696 0.160975 tcp 10.0.2.105 50335 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:37.282528 2.994769 tcp 10.0.2.105 50336 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:40:46.302146 0.000000 tcp 10.0.2.105 50336 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:40:52.275292 0.061900 tcp 10.0.2.105 50337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:52.337498 0.065655 tcp 10.0.2.105 50338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:52.403452 0.169256 tcp 10.0.2.105 50339 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:40:52.582660 2.996335 tcp 10.0.2.105 50340 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:41:01.577694 0.000000 tcp 10.0.2.105 50340 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:41:07.576755 3.010631 tcp 10.0.2.105 50341 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:41:16.580771 0.000000 tcp 10.0.2.105 50341 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:41:21.376159 0.000202 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:46:08.121710 3.000999 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:46:15.128669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:46:23.130254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:46:39.133367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:47:11.139309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:47:26.611816 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:47:26.611929 0.216810 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:26.821498 0.223880 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:27.075327 0.062019 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:27.134527 0.351427 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:27.539442 0.124199 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:27.645355 0.183748 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:27.801951 0.352545 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:28.125309 0.253868 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:28.371352 0.183182 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:28.530291 0.177717 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:28.805477 0.170726 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:28.955086 0.175063 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:29.122863 0.091229 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:29.238968 0.177494 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:29.411602 0.111336 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:29.588511 0.083493 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:29.636309 0.181962 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:30.229646 0.058959 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:30.286986 0.211654 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:30.464343 0.200998 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:30.711119 0.182333 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:30.888569 0.000000 udp 10.0.2.105 7010 -> 109.55.15.125 5025 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 00:47:37.587785 3.003782 tcp 10.0.2.105 50342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:47:46.590295 0.000000 tcp 10.0.2.105 50342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:47:48.144446 0.068587 tcp 10.0.2.105 50343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:48.213306 0.076998 tcp 10.0.2.105 50344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:48.290610 0.154672 tcp 10.0.2.105 50345 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:48.445794 0.186112 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:48.628572 0.190535 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:48.816308 0.155925 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:48.982124 0.510081 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 00:47:52.589412 0.064378 tcp 10.0.2.105 50346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:52.654125 0.064583 tcp 10.0.2.105 50347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:52.719060 0.178475 tcp 10.0.2.105 50348 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:47:53.043627 3.000106 tcp 10.0.2.105 50349 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:02.052561 0.000000 tcp 10.0.2.105 50349 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:08.041620 0.068556 tcp 10.0.2.105 50350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:48:08.110012 0.067872 tcp 10.0.2.105 50351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:48:08.178193 0.162301 tcp 10.0.2.105 50352 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:48:08.528961 2.996870 tcp 10.0.2.105 50353 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:17.524214 0.000000 tcp 10.0.2.105 50353 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:23.523596 3.003836 tcp 10.0.2.105 50354 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:32.526095 0.000000 tcp 10.0.2.105 50354 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:48:37.373206 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:53:15.144456 3.002718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 00:53:22.152738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:53:30.154048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:53:38.529497 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:53:38.529599 3.005168 tcp 10.0.2.105 50355 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:53:46.157294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:53:47.528943 0.000000 tcp 10.0.2.105 50355 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:53:53.529443 0.066241 tcp 10.0.2.105 50356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:53:53.595984 0.061854 tcp 10.0.2.105 50357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:53:53.658109 0.176509 tcp 10.0.2.105 50358 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:53:53.874287 3.008369 tcp 10.0.2.105 50359 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:02.881201 0.000000 tcp 10.0.2.105 50359 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:08.870454 0.064816 tcp 10.0.2.105 50360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:54:08.935120 0.064033 tcp 10.0.2.105 50361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:54:08.999403 0.155720 tcp 10.0.2.105 50362 -> 195.113.214.249 443 SRPA* 0 0 41 22012 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:54:09.329580 2.995095 tcp 10.0.2.105 50363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:18.162962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 00:54:18.323428 0.000000 tcp 10.0.2.105 50363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:24.322296 2.994210 tcp 10.0.2.105 50364 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:33.314764 0.000000 tcp 10.0.2.105 50364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:54:37.871391 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:59:39.335400 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 00:59:39.335628 3.003661 tcp 10.0.2.105 50365 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:59:48.337769 0.000000 tcp 10.0.2.105 50365 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 00:59:54.338216 0.066118 tcp 10.0.2.105 50366 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:59:54.404707 0.063787 tcp 10.0.2.105 50367 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:59:54.468754 0.161606 tcp 10.0.2.105 50368 -> 195.113.214.249 443 SRPA* 0 0 51 33091 flow=From-Botnet-V2-TCP-Established 1970/02/16 00:59:54.714611 3.006637 tcp 10.0.2.105 50369 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:03.722772 0.000000 tcp 10.0.2.105 50369 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:09.718140 0.242279 tcp 10.0.2.105 50370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:00:09.960711 0.065416 tcp 10.0.2.105 50371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:00:10.026419 0.165388 tcp 10.0.2.105 50372 -> 195.113.214.249 443 SRPA* 0 0 21 10346 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:00:10.425613 2.992104 tcp 10.0.2.105 50373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:19.422782 0.000000 tcp 10.0.2.105 50373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:22.179521 3.001216 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:00:25.411478 2.994244 tcp 10.0.2.105 50374 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:29.186279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:00:34.404162 0.000000 tcp 10.0.2.105 50374 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:00:37.187947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:00:39.386805 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:00:53.191166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:01:25.197008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:05:40.414505 0.004623 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:05:40.419252 2.999252 tcp 10.0.2.105 50375 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:05:49.417066 0.000000 tcp 10.0.2.105 50375 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:05:55.417498 0.063316 tcp 10.0.2.105 50376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:05:55.481129 0.066094 tcp 10.0.2.105 50377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:05:55.547575 0.156744 tcp 10.0.2.105 50378 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:05:55.713994 3.005901 tcp 10.0.2.105 50379 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:04.718950 0.000000 tcp 10.0.2.105 50379 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:10.709287 0.064243 tcp 10.0.2.105 50380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:06:10.773822 0.062982 tcp 10.0.2.105 50381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:06:10.837084 0.160860 tcp 10.0.2.105 50382 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:06:11.247161 3.008224 tcp 10.0.2.105 50383 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:20.252810 0.000000 tcp 10.0.2.105 50383 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:26.239955 2.994154 tcp 10.0.2.105 50384 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:35.242352 0.000000 tcp 10.0.2.105 50384 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:06:39.889517 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:07:29.203673 3.001286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:07:36.210835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:07:44.211565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:08:00.215171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:08:32.221203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:14:37.228601 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 01:14:44.236167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:14:52.237538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:15:08.512162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:15:40.256792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:18:08.279667 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:18:08.279775 0.000000 udp 10.0.2.105 7010 -> 109.55.15.125 5025 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 01:18:25.034996 0.132093 tcp 10.0.2.105 50385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:25.167381 0.065517 tcp 10.0.2.105 50386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:25.233199 0.158793 tcp 10.0.2.105 50387 -> 195.113.214.249 443 SRPA* 0 0 49 41154 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:25.392757 0.061515 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:25.451094 0.214371 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:25.673174 0.225069 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:25.890982 0.437225 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:26.330969 0.365376 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:26.331842 2.984318 tcp 10.0.2.105 50388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:18:26.691869 0.125416 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:26.798005 0.185216 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:27.020027 0.182940 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:27.276334 0.251440 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:27.492042 0.168116 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:27.827793 0.174503 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:27.995027 0.082135 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:28.058158 0.175605 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:28.288074 0.179531 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:29.610493 0.060113 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:29.773244 0.119314 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:30.012847 0.208965 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:30.213349 0.084615 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:30.434788 0.183294 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:30.613350 0.209864 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:30.836515 0.207718 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:31.193272 0.155633 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:31.441068 0.185160 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:31.622024 0.197187 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:31.816582 0.473564 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:18:35.288131 0.000000 tcp 10.0.2.105 50388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:18:41.287462 0.067582 tcp 10.0.2.105 50389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:41.355335 0.062425 tcp 10.0.2.105 50390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:41.418079 0.163932 tcp 10.0.2.105 50391 -> 195.113.214.249 443 SRPA* 0 0 49 32924 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:18:41.803993 3.007940 tcp 10.0.2.105 50392 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:18:50.810442 0.000000 tcp 10.0.2.105 50392 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:21:44.263295 3.000471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:21:51.271782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:21:59.271674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:22:15.274549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:22:47.280728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:23:56.801139 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:23:56.801242 2.993794 tcp 10.0.2.105 50393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:05.803435 0.000000 tcp 10.0.2.105 50393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:11.804010 0.067117 tcp 10.0.2.105 50394 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:11.871498 0.065455 tcp 10.0.2.105 50395 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:11.937196 0.165779 tcp 10.0.2.105 50396 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:12.292169 2.994991 tcp 10.0.2.105 50397 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:21.286106 0.000000 tcp 10.0.2.105 50397 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:27.284632 0.540477 tcp 10.0.2.105 50398 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:27.825027 0.066055 tcp 10.0.2.105 50399 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:27.891384 0.175859 tcp 10.0.2.105 50400 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:24:28.186958 2.975884 tcp 10.0.2.105 50401 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:37.100036 0.000000 tcp 10.0.2.105 50401 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:43.038587 2.979742 tcp 10.0.2.105 50402 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:51.956676 0.000000 tcp 10.0.2.105 50402 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:24:56.567680 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:28:51.296197 3.002115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:28:58.303893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:29:06.305453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:29:22.309066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:29:54.314547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:29:57.733011 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:29:57.733107 2.990801 tcp 10.0.2.105 50403 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:06.733046 0.000000 tcp 10.0.2.105 50403 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:12.732583 0.068117 tcp 10.0.2.105 50404 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:12.800978 0.068979 tcp 10.0.2.105 50405 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:12.870264 0.157858 tcp 10.0.2.105 50406 -> 195.113.214.249 443 SRPA* 0 0 40 22618 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:13.130886 2.994656 tcp 10.0.2.105 50407 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:22.125711 0.000000 tcp 10.0.2.105 50407 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:28.123476 0.060434 tcp 10.0.2.105 50408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:28.183786 0.061637 tcp 10.0.2.105 50409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:28.245682 0.164559 tcp 10.0.2.105 50410 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:30:28.550629 2.997599 tcp 10.0.2.105 50411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:37.548435 0.000000 tcp 10.0.2.105 50411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:43.545368 3.004199 tcp 10.0.2.105 50412 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:52.548116 0.000000 tcp 10.0.2.105 50412 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:30:57.385134 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:35:58.320175 3.001942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:35:58.548862 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:35:58.548944 3.003693 tcp 10.0.2.105 50413 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:05.327840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:36:07.551177 0.000000 tcp 10.0.2.105 50413 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:13.329607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:36:13.551724 0.061791 tcp 10.0.2.105 50414 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:13.613777 0.062674 tcp 10.0.2.105 50415 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:13.676787 0.156574 tcp 10.0.2.105 50416 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:13.916923 2.997343 tcp 10.0.2.105 50417 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:22.913115 0.000000 tcp 10.0.2.105 50417 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:28.912753 0.065971 tcp 10.0.2.105 50418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:28.978578 0.062763 tcp 10.0.2.105 50419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:29.041656 0.166920 tcp 10.0.2.105 50420 -> 195.113.214.249 443 SRPA* 0 0 32 17012 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:36:29.332899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:36:29.528431 2.998486 tcp 10.0.2.105 50421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:38.525528 0.000000 tcp 10.0.2.105 50421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:44.524053 3.004421 tcp 10.0.2.105 50422 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:53.527011 0.000000 tcp 10.0.2.105 50422 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:36:58.383809 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:37:01.338402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:41:59.527671 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:41:59.527874 3.003744 tcp 10.0.2.105 50423 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:42:08.532618 0.000000 tcp 10.0.2.105 50423 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:42:14.530336 0.066976 tcp 10.0.2.105 50424 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:42:14.597636 0.062732 tcp 10.0.2.105 50425 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:42:14.660727 0.166993 tcp 10.0.2.105 50426 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:42:15.074210 3.022259 tcp 10.0.2.105 50427 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:42:24.081954 0.000000 tcp 10.0.2.105 50427 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:43:05.344071 3.002342 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 01:43:12.351746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:43:20.353010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:43:36.356618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:44:08.363984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:48:51.674637 0.000178 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:48:51.674930 0.226162 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:51.894291 0.413345 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:52.736494 0.061410 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:52.794710 0.212313 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:52.998997 0.188062 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:53.228376 0.184423 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:53.389061 0.365473 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:53.750647 0.126758 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:53.912703 0.250124 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.128361 0.169336 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.384025 0.176381 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.552651 0.073161 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.686608 0.178074 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.861867 0.110510 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:54.945112 0.174859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:55.124136 0.179944 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:55.587659 0.061341 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:55.773705 0.082282 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:55.818852 0.183783 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2550 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:55.997186 0.210096 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:56.172936 0.213539 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:56.534450 0.191092 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:56.722593 0.450311 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:57.150567 0.153355 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:48:57.539090 0.188229 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/16 01:49:00.082222 2.993877 tcp 10.0.2.105 50428 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:09.074706 0.000000 tcp 10.0.2.105 50428 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:15.084461 0.062637 tcp 10.0.2.105 50429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:15.147387 0.063620 tcp 10.0.2.105 50430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:15.211313 0.157733 tcp 10.0.2.105 50431 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:15.521135 2.997381 tcp 10.0.2.105 50432 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:24.517128 0.000000 tcp 10.0.2.105 50432 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:30.516125 0.065132 tcp 10.0.2.105 50433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:30.581707 0.066826 tcp 10.0.2.105 50434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:30.648885 0.152159 tcp 10.0.2.105 50435 -> 195.113.214.249 443 SRPA* 0 0 63 39842 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:49:31.271662 2.999460 tcp 10.0.2.105 50436 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:40.269784 0.000000 tcp 10.0.2.105 50436 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:46.268298 3.004417 tcp 10.0.2.105 50437 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:55.271382 0.000000 tcp 10.0.2.105 50437 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:49:59.887672 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:55:01.271913 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:55:01.272020 2.993268 tcp 10.0.2.105 50438 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:10.263574 0.000000 tcp 10.0.2.105 50438 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:16.274970 0.063817 tcp 10.0.2.105 50439 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:16.339061 0.061936 tcp 10.0.2.105 50440 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:16.401308 0.242056 tcp 10.0.2.105 50441 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:16.653282 2.995834 tcp 10.0.2.105 50442 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:25.648758 0.000000 tcp 10.0.2.105 50442 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:31.649615 0.064260 tcp 10.0.2.105 50443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:31.714126 0.068994 tcp 10.0.2.105 50444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:31.783407 0.159180 tcp 10.0.2.105 50445 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 01:55:32.243511 2.996451 tcp 10.0.2.105 50446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:40.370673 3.001042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 01:55:41.238664 0.000000 tcp 10.0.2.105 50446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:47.239051 3.002555 tcp 10.0.2.105 50447 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:55:47.378854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:55:55.378898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:55:56.239983 0.000000 tcp 10.0.2.105 50447 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 01:56:00.886856 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 01:56:11.382163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 01:56:43.387859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:01:02.240503 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:01:02.240685 2.993257 tcp 10.0.2.105 50448 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:11.242829 0.000000 tcp 10.0.2.105 50448 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:17.243975 0.064879 tcp 10.0.2.105 50449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:17.309186 0.068590 tcp 10.0.2.105 50450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:17.378106 0.154806 tcp 10.0.2.105 50451 -> 195.113.214.249 443 SRPA* 0 0 25 13444 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:17.663340 3.003363 tcp 10.0.2.105 50452 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:26.665019 0.000000 tcp 10.0.2.105 50452 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:32.670195 0.063601 tcp 10.0.2.105 50453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:32.734111 0.064380 tcp 10.0.2.105 50454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:32.798886 0.161483 tcp 10.0.2.105 50455 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:01:33.082821 2.996041 tcp 10.0.2.105 50456 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:42.077429 0.000000 tcp 10.0.2.105 50456 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:48.076539 3.003885 tcp 10.0.2.105 50457 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:01:57.079130 0.000000 tcp 10.0.2.105 50457 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:02:01.885898 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:02:47.394464 3.004460 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:02:54.401631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:03:02.402959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:03:18.405962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:03:50.412110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:07:03.079473 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:07:03.079572 2.994233 tcp 10.0.2.105 50458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:12.086660 0.000000 tcp 10.0.2.105 50458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:18.085903 0.067055 tcp 10.0.2.105 50459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:18.153237 0.062147 tcp 10.0.2.105 50460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:18.215687 0.161976 tcp 10.0.2.105 50461 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:18.419478 2.995880 tcp 10.0.2.105 50462 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:27.416731 0.000000 tcp 10.0.2.105 50462 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:33.413670 0.061350 tcp 10.0.2.105 50463 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:33.474859 0.063611 tcp 10.0.2.105 50464 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:33.538791 0.161953 tcp 10.0.2.105 50465 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:07:33.726856 3.000350 tcp 10.0.2.105 50466 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:42.725695 0.000000 tcp 10.0.2.105 50466 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:48.724741 3.004296 tcp 10.0.2.105 50467 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:07:57.727602 0.000000 tcp 10.0.2.105 50467 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:08:02.383562 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:10:02.419775 3.004250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:10:09.426755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:10:17.428657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:10:33.431322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:11:05.437461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:17:09.444149 3.000975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 02:17:16.450950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:17:24.452382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:17:40.455348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:18:12.461471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:19:00.470798 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:19:00.470901 0.228149 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:00.691283 0.355275 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:01.021361 0.186681 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:01.181532 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 02:19:03.765412 3.003973 tcp 10.0.2.105 50468 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:19:12.767891 0.000000 tcp 10.0.2.105 50468 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:19:18.767818 0.063086 tcp 10.0.2.105 50469 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:18.831252 0.065471 tcp 10.0.2.105 50470 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:18.897125 0.157874 tcp 10.0.2.105 50471 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:19.187632 0.060496 tcp 10.0.2.105 50472 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:19.248435 0.069755 tcp 10.0.2.105 50473 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:19.318456 0.167852 tcp 10.0.2.105 50474 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:19:19.437105 3.004679 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:19:19.486931 0.222678 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:19.700724 0.181783 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:19.861015 0.350735 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.207738 0.124795 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.369024 0.175339 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.537185 0.250346 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.753199 0.171104 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.935647 0.079528 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:20.997292 0.178696 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:21.173780 0.116104 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:21.354270 0.176085 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:21.524967 0.086586 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:21.854275 0.181722 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.089010 0.058412 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.145321 0.181734 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.322246 0.211679 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.539711 0.203556 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.738918 0.187157 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:22.922285 0.586865 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:23.486251 0.155696 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:23.656628 0.186591 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:19:28.440831 0.000000 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:24:16.467470 3.005260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 02:24:23.475001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:24:31.476501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:24:34.431059 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:24:34.431157 2.993685 tcp 10.0.2.105 50476 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:24:43.423245 0.000000 tcp 10.0.2.105 50476 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:24:47.479900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:24:49.434001 0.321350 tcp 10.0.2.105 50477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:24:49.755726 0.065635 tcp 10.0.2.105 50478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:24:49.821627 0.198561 tcp 10.0.2.105 50479 -> 195.113.214.249 443 SRPA* 0 0 23 10848 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:24:50.477733 2.972912 tcp 10.0.2.105 50480 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:24:59.390530 0.000000 tcp 10.0.2.105 50480 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:25:05.337268 0.110315 tcp 10.0.2.105 50481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:25:05.447933 0.133697 tcp 10.0.2.105 50482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:25:05.581920 0.377187 tcp 10.0.2.105 50483 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:25:06.043255 2.975890 tcp 10.0.2.105 50484 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:25:14.960259 0.000000 tcp 10.0.2.105 50484 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:25:19.485421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:25:20.947662 3.004993 tcp 10.0.2.105 50485 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:25:30.073845 0.000000 tcp 10.0.2.105 50485 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:25:34.968073 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:30:35.951021 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:30:35.951098 2.992949 tcp 10.0.2.105 50486 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:30:44.953132 0.000000 tcp 10.0.2.105 50486 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:30:50.953992 0.061607 tcp 10.0.2.105 50487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:30:51.015897 0.065435 tcp 10.0.2.105 50488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:30:51.081627 0.154695 tcp 10.0.2.105 50489 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:30:51.735225 3.002368 tcp 10.0.2.105 50490 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:00.735694 0.000000 tcp 10.0.2.105 50490 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:06.735213 0.065461 tcp 10.0.2.105 50491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:31:06.800947 0.060569 tcp 10.0.2.105 50492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:31:06.861803 0.158663 tcp 10.0.2.105 50493 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:31:07.230924 2.999934 tcp 10.0.2.105 50494 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:16.228386 0.000000 tcp 10.0.2.105 50494 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:22.227449 3.006134 tcp 10.0.2.105 50495 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:23.491693 3.003805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:31:30.498934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:31:31.230023 0.000000 tcp 10.0.2.105 50495 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:31:35.886343 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:31:38.500410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:31:54.504005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:32:26.509506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:36:37.230306 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:36:37.230405 2.993599 tcp 10.0.2.105 50496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:36:46.232793 0.000000 tcp 10.0.2.105 50496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:36:52.233452 0.065589 tcp 10.0.2.105 50497 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:36:52.299317 0.066517 tcp 10.0.2.105 50498 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:36:52.366137 0.160585 tcp 10.0.2.105 50499 -> 195.113.214.249 443 SRPA* 0 0 41 22668 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:36:52.838079 2.998425 tcp 10.0.2.105 50500 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:01.834974 0.000000 tcp 10.0.2.105 50500 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:07.839214 0.061328 tcp 10.0.2.105 50501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:37:07.900831 0.060513 tcp 10.0.2.105 50502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:37:07.961639 0.241118 tcp 10.0.2.105 50503 -> 195.113.214.249 443 SRPA* 0 0 41 21452 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:37:08.359424 2.999510 tcp 10.0.2.105 50504 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:17.357328 0.000000 tcp 10.0.2.105 50504 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:23.356586 3.003925 tcp 10.0.2.105 50505 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:32.359045 0.000000 tcp 10.0.2.105 50505 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:37:36.886699 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:38:30.515904 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:38:37.522725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:38:45.523824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:39:01.527529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:39:33.533304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:42:38.359551 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:42:38.359633 2.993673 tcp 10.0.2.105 50506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:42:47.361867 0.000000 tcp 10.0.2.105 50506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:42:53.362597 0.063969 tcp 10.0.2.105 50507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:42:53.426906 0.068549 tcp 10.0.2.105 50508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:42:53.495739 0.158911 tcp 10.0.2.105 50509 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:42:53.785753 2.999797 tcp 10.0.2.105 50510 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:02.784087 0.000000 tcp 10.0.2.105 50510 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:08.783154 0.063211 tcp 10.0.2.105 50511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:43:08.846685 0.063751 tcp 10.0.2.105 50512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:43:08.910275 0.157002 tcp 10.0.2.105 50513 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:43:09.118702 2.998874 tcp 10.0.2.105 50514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:18.116337 0.000000 tcp 10.0.2.105 50514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:24.114436 3.004567 tcp 10.0.2.105 50515 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:33.117576 0.000000 tcp 10.0.2.105 50515 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:43:37.884535 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:45:37.539718 3.003717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:45:44.549199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:45:52.548074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:46:08.551681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:46:40.557914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:49:31.563466 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:49:31.563564 0.055578 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:31.616024 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 02:49:39.124193 3.004095 tcp 10.0.2.105 50516 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:49:48.126996 0.000000 tcp 10.0.2.105 50516 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:49:48.189278 0.064851 tcp 10.0.2.105 50517 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:48.254490 0.066363 tcp 10.0.2.105 50518 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:48.321113 0.194356 tcp 10.0.2.105 50519 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:48.516113 0.388514 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:48.875354 0.182869 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:49.112505 0.216168 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:49.320835 0.182237 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:49.570948 0.350927 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:49.917675 0.125822 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:50.119520 0.177576 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:50.367070 0.254203 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:50.583294 0.170745 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:50.759221 0.076505 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:50.817710 0.176901 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.040992 0.131441 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.138977 0.173304 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.316971 0.088265 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.366914 0.182248 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.600493 0.206698 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:51.773029 0.206659 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:52.027143 0.191108 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:52.214002 0.059914 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:52.272345 0.183267 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:52.476646 0.189061 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:52.661831 0.542196 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:53.183970 0.165723 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 02:49:54.126286 0.064384 tcp 10.0.2.105 50520 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:54.191013 0.062038 tcp 10.0.2.105 50521 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:54.253397 0.162630 tcp 10.0.2.105 50522 -> 195.113.214.249 443 SRPA* 0 0 36 19630 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:49:54.730495 3.000102 tcp 10.0.2.105 50523 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:50:03.729118 0.000000 tcp 10.0.2.105 50523 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:09.729884 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:55:09.730088 2.993370 tcp 10.0.2.105 50524 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:18.732308 0.000000 tcp 10.0.2.105 50524 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:24.732519 0.065688 tcp 10.0.2.105 50525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:24.798470 0.062745 tcp 10.0.2.105 50526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:24.861545 0.173877 tcp 10.0.2.105 50527 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:25.259174 2.996879 tcp 10.0.2.105 50528 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:34.254025 0.000000 tcp 10.0.2.105 50528 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:40.253899 0.062717 tcp 10.0.2.105 50529 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:40.316907 0.062210 tcp 10.0.2.105 50530 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:40.379409 0.367384 tcp 10.0.2.105 50531 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/16 02:55:40.973150 3.009705 tcp 10.0.2.105 50532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:49.977107 0.000000 tcp 10.0.2.105 50532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:55:55.965843 3.006769 tcp 10.0.2.105 50533 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:56:04.968669 0.000000 tcp 10.0.2.105 50533 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 02:56:09.885127 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 02:56:56.565714 3.001518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 02:57:03.572995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:57:11.574721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:57:28.122986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 02:57:59.751122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:01:10.969314 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:01:10.969502 3.003247 tcp 10.0.2.105 50534 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:19.981476 0.000000 tcp 10.0.2.105 50534 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:25.971857 0.064923 tcp 10.0.2.105 50535 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:26.037088 0.063516 tcp 10.0.2.105 50536 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:26.100890 0.154663 tcp 10.0.2.105 50537 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:26.371168 2.994051 tcp 10.0.2.105 50538 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:35.363772 0.000000 tcp 10.0.2.105 50538 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:41.373141 0.062471 tcp 10.0.2.105 50539 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:41.435944 0.062624 tcp 10.0.2.105 50540 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:41.498849 0.161610 tcp 10.0.2.105 50541 -> 195.113.214.249 443 SRPA* 0 0 23 13332 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:01:41.686802 3.000235 tcp 10.0.2.105 50542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:50.685489 0.000000 tcp 10.0.2.105 50542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:01:56.688149 3.000580 tcp 10.0.2.105 50543 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:02:05.687370 0.000000 tcp 10.0.2.105 50543 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:02:10.383637 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:04:03.599558 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:04:10.607065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:04:18.608995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:04:34.611846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:05:06.617578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:07:11.687877 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:07:11.688139 3.003205 tcp 10.0.2.105 50544 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:20.692385 0.000000 tcp 10.0.2.105 50544 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:26.693429 0.062699 tcp 10.0.2.105 50545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:26.756543 0.062168 tcp 10.0.2.105 50546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:26.819081 0.167138 tcp 10.0.2.105 50547 -> 195.113.214.249 443 SRPA* 0 0 29 12154 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:27.003702 2.989904 tcp 10.0.2.105 50548 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:36.002142 0.000000 tcp 10.0.2.105 50548 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:42.001636 0.061315 tcp 10.0.2.105 50549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:42.063275 0.065660 tcp 10.0.2.105 50550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:42.129291 0.161250 tcp 10.0.2.105 50551 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:07:42.327181 2.998552 tcp 10.0.2.105 50552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:51.324369 0.000000 tcp 10.0.2.105 50552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:07:57.322647 3.004536 tcp 10.0.2.105 50553 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:08:06.325248 0.000000 tcp 10.0.2.105 50553 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:08:10.882253 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:11:10.624163 3.001077 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:11:17.630944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:11:25.632635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:11:41.635215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:12:13.641488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:13:12.327519 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:13:12.327626 3.002583 tcp 10.0.2.105 50554 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:13:21.328842 0.000000 tcp 10.0.2.105 50554 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:13:27.329301 0.062308 tcp 10.0.2.105 50555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:13:27.391922 0.062545 tcp 10.0.2.105 50556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:13:27.454308 0.156354 tcp 10.0.2.105 50557 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:13:27.689937 3.002297 tcp 10.0.2.105 50558 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:13:36.690686 0.000000 tcp 10.0.2.105 50558 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:18:17.647205 3.001816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 03:18:24.654890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:18:32.656626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:18:48.659525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:19:20.666059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:19:55.646011 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:19:55.646118 0.229515 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:55.867500 0.055748 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:56.146422 0.391035 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:56.506902 0.182740 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:56.695216 0.215357 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:56.902787 0.183843 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:57.064408 0.173720 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:57.240632 0.362280 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:57.599267 0.125132 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:57.699446 3.003396 tcp 10.0.2.105 50559 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:19:57.704979 0.247400 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:57.917478 0.166580 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:58.295089 0.075628 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:58.351623 0.176972 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:58.525011 0.118591 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:58.683190 0.180578 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:58.865160 0.211563 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:59.041317 0.206236 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:59.248800 0.105561 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:59.318990 0.199465 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:59.694911 0.190239 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:19:59.881721 0.057095 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:20:00.052992 0.182077 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:20:00.230365 0.186410 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:20:00.412799 0.481323 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:20:00.870464 0.153140 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:20:06.711486 0.000000 tcp 10.0.2.105 50559 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:12.757456 0.065496 tcp 10.0.2.105 50560 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:12.823234 0.063632 tcp 10.0.2.105 50561 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:12.887194 0.164322 tcp 10.0.2.105 50562 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:13.205633 2.974275 tcp 10.0.2.105 50563 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:22.153235 0.000000 tcp 10.0.2.105 50563 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:28.153374 0.062363 tcp 10.0.2.105 50564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:28.216036 0.063083 tcp 10.0.2.105 50565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:28.279416 0.167755 tcp 10.0.2.105 50566 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:20:28.493191 3.004055 tcp 10.0.2.105 50567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:37.497005 0.000000 tcp 10.0.2.105 50567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:43.494063 3.008994 tcp 10.0.2.105 50568 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:52.497347 0.000000 tcp 10.0.2.105 50568 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:20:57.384178 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:25:24.671336 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:25:31.678810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:25:39.680268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:25:55.682940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:25:58.498041 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:25:58.498176 3.003681 tcp 10.0.2.105 50569 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:07.500769 0.000000 tcp 10.0.2.105 50569 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:13.500720 0.071154 tcp 10.0.2.105 50570 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:13.572124 0.064514 tcp 10.0.2.105 50571 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:13.636985 0.163441 tcp 10.0.2.105 50572 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:14.305675 2.408079 tcp 10.0.2.105 50573 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:16.215841 0.064690 tcp 10.0.2.105 50574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:16.280811 0.065908 tcp 10.0.2.105 50575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:16.347007 0.158534 tcp 10.0.2.105 50576 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:16.713943 3.003922 tcp 10.0.2.105 50577 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:25.716508 0.000000 tcp 10.0.2.105 50577 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:27.689510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:26:31.715694 0.061818 tcp 10.0.2.105 50578 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:31.777857 0.066111 tcp 10.0.2.105 50579 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:31.844252 0.187263 tcp 10.0.2.105 50580 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:32.269116 3.001035 tcp 10.0.2.105 50581 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:41.268917 0.000000 tcp 10.0.2.105 50581 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:26:47.267949 4.228539 tcp 10.0.2.105 50582 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:26:51.496725 3.001006 tcp 10.0.2.105 50583 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:27:00.499321 0.000000 tcp 10.0.2.105 50583 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:06.497079 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:32:06.497241 3.003440 tcp 10.0.2.105 50584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:15.499534 0.000000 tcp 10.0.2.105 50584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:21.504640 0.063049 tcp 10.0.2.105 50585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:21.567933 0.066447 tcp 10.0.2.105 50586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:21.634655 0.160103 tcp 10.0.2.105 50587 -> 195.113.214.249 443 SRPA* 0 0 54 37674 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:22.134146 0.381237 tcp 10.0.2.105 50588 -> 46.48.223.67 15494 SPA_* 0 0 9 1000 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:31.694779 3.002307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:32:34.247664 0.692518 tcp 10.0.2.105 50588 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:34.248446 0.062254 tcp 10.0.2.105 50589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:34.310981 0.062392 tcp 10.0.2.105 50590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:34.373730 0.165883 tcp 10.0.2.105 50591 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:34.940458 3.000869 tcp 10.0.2.105 50592 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:38.702776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:32:43.939725 0.000000 tcp 10.0.2.105 50592 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:46.704510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:32:49.939745 0.061276 tcp 10.0.2.105 50593 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:50.001327 0.063737 tcp 10.0.2.105 50594 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:50.065422 0.162456 tcp 10.0.2.105 50595 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:32:50.569531 2.996040 tcp 10.0.2.105 50596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:32:59.572856 0.000000 tcp 10.0.2.105 50596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:33:02.707541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:33:05.563167 4.970103 tcp 10.0.2.105 50597 -> 46.48.223.67 15494 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:33:10.533526 3.010549 tcp 10.0.2.105 50598 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:33:19.551679 0.000000 tcp 10.0.2.105 50598 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:33:34.713003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:38:25.531890 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:38:25.531984 2.993881 tcp 10.0.2.105 50599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:38:34.524482 0.000000 tcp 10.0.2.105 50599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:38:40.534590 0.064727 tcp 10.0.2.105 50600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:40.599600 0.061632 tcp 10.0.2.105 50601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:40.661520 0.168260 tcp 10.0.2.105 50602 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:41.048941 0.385912 tcp 10.0.2.105 50603 -> 46.48.223.67 15494 SPA_* 0 0 9 1213 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:51.909474 1.073422 tcp 10.0.2.105 50603 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:51.910205 0.069823 tcp 10.0.2.105 50604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:51.980336 0.064442 tcp 10.0.2.105 50605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:52.045062 0.185387 tcp 10.0.2.105 50606 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:38:52.983171 3.002213 tcp 10.0.2.105 50607 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:01.983841 0.000000 tcp 10.0.2.105 50607 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:07.983487 0.064335 tcp 10.0.2.105 50608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:39:08.048095 0.103755 tcp 10.0.2.105 50609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:39:08.152143 0.172216 tcp 10.0.2.105 50610 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:39:08.431122 2.996534 tcp 10.0.2.105 50611 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:17.426917 0.000000 tcp 10.0.2.105 50611 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:23.425285 4.779104 tcp 10.0.2.105 50612 -> 46.48.223.67 15494 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:39:28.204624 3.001522 tcp 10.0.2.105 50613 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:37.204153 0.000000 tcp 10.0.2.105 50613 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:39:38.719327 3.039253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:39:45.741883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:39:53.738491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:40:09.742877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:40:41.747338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:44:43.204772 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:44:43.204952 4.651548 tcp 10.0.2.105 50614 -> 46.48.223.67 15494 SPA_* 0 0 12 1457 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:44:47.858180 0.309981 tcp 10.0.2.105 50615 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:44:48.168459 0.063033 tcp 10.0.2.105 50616 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:44:48.231786 0.164812 tcp 10.0.2.105 50617 -> 195.113.214.249 443 SRPA* 0 0 36 18844 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:44:48.630517 0.000079 tcp 10.0.2.105 50614 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:44:48.630859 4.465805 tcp 10.0.2.105 50618 -> 46.48.223.67 15494 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:46:45.757713 2.997254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 03:46:52.760787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:47:00.762518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:47:16.765092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:47:48.771346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:50:03.434896 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:50:03.435053 0.227061 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:03.654147 0.055633 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:03.731281 0.376508 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:04.079109 0.733312 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:04.782053 0.216508 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:05.345553 0.184582 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:05.507907 0.124136 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:05.796838 0.250709 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:06.013006 0.175179 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:06.180011 0.370137 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:06.638087 0.170282 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:06.788062 0.075433 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:07.555671 0.178464 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:07.730442 0.115893 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:07.913511 0.174985 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:08.091836 2.993899 tcp 10.0.2.105 50619 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:09.225988 0.216213 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:09.403828 0.172271 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:09.658360 0.083632 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:10.026542 0.199965 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:10.324858 0.190490 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:10.511504 0.058889 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:11.007735 0.467221 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:11.453085 0.152111 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:11.907361 0.183359 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:12.099761 0.188010 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 03:50:17.084582 0.000000 tcp 10.0.2.105 50619 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:23.094447 0.061480 tcp 10.0.2.105 50620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:23.156217 0.065465 tcp 10.0.2.105 50621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:23.222007 0.161728 tcp 10.0.2.105 50622 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:23.845583 3.003089 tcp 10.0.2.105 50623 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:32.847433 0.000000 tcp 10.0.2.105 50623 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:38.846597 0.093305 tcp 10.0.2.105 50624 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:38.940187 0.062645 tcp 10.0.2.105 50625 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:39.003143 0.158266 tcp 10.0.2.105 50626 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:50:39.173372 3.006947 tcp 10.0.2.105 50627 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:48.181124 0.000000 tcp 10.0.2.105 50627 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:50:54.168070 3.004448 tcp 10.0.2.105 50628 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:51:03.171053 0.000000 tcp 10.0.2.105 50628 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:51:07.887457 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:53:52.777879 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 03:53:59.784168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:54:07.786174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:54:23.789219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:54:55.795045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 03:56:09.171707 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 03:56:09.171920 2.993121 tcp 10.0.2.105 50629 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:56:18.163847 0.000000 tcp 10.0.2.105 50629 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:56:24.174769 0.064666 tcp 10.0.2.105 50630 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:24.239705 0.068905 tcp 10.0.2.105 50631 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:24.308908 0.169053 tcp 10.0.2.105 50632 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:24.669021 0.383674 tcp 10.0.2.105 50633 -> 46.48.223.67 15494 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:35.907118 0.323217 tcp 10.0.2.105 50633 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:35.907878 0.065005 tcp 10.0.2.105 50634 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:35.973165 0.063110 tcp 10.0.2.105 50635 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:36.036592 0.152349 tcp 10.0.2.105 50636 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:36.230600 2.993283 tcp 10.0.2.105 50637 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:56:45.232424 0.000000 tcp 10.0.2.105 50637 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:56:51.231829 0.060710 tcp 10.0.2.105 50638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:51.292897 0.061483 tcp 10.0.2.105 50639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:51.354615 0.163723 tcp 10.0.2.105 50640 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:56:51.555487 3.000582 tcp 10.0.2.105 50641 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:57:00.554771 0.000000 tcp 10.0.2.105 50641 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:57:06.554106 4.316129 tcp 10.0.2.105 50642 -> 46.48.223.67 15494 FSPA* 0 0 13 1469 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:57:10.870103 2.993548 tcp 10.0.2.105 50643 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 03:57:12.371817 0.000200 tcp 10.0.2.105 50642 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 03:57:19.872079 0.000000 tcp 10.0.2.105 50643 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:00:59.802125 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:01:06.808675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:01:14.810080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:01:30.813215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:02:02.819489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:02:25.865994 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:02:25.866148 3.001768 tcp 10.0.2.105 50644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:02:34.865557 0.000000 tcp 10.0.2.105 50644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:02:40.873997 0.062761 tcp 10.0.2.105 50645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:02:40.937125 0.063392 tcp 10.0.2.105 50646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:02:41.000811 0.158038 tcp 10.0.2.105 50647 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:02:41.197841 0.389740 tcp 10.0.2.105 50648 -> 46.48.223.67 15494 SPA_* 0 0 9 1134 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:10.211038 0.447603 tcp 10.0.2.105 50648 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:10.212129 0.074797 tcp 10.0.2.105 50649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:10.287250 0.068680 tcp 10.0.2.105 50650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:10.356216 0.188467 tcp 10.0.2.105 50651 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:10.658862 3.002297 tcp 10.0.2.105 50652 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:03:19.659759 0.000000 tcp 10.0.2.105 50652 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:03:25.665395 0.061257 tcp 10.0.2.105 50653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:25.726938 0.062780 tcp 10.0.2.105 50654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:25.790066 0.159684 tcp 10.0.2.105 50655 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:26.231307 2.993337 tcp 10.0.2.105 50656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:03:35.231805 0.000000 tcp 10.0.2.105 50656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:03:41.223996 4.806543 tcp 10.0.2.105 50657 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:03:46.030770 3.001142 tcp 10.0.2.105 50658 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:03:55.033661 0.000000 tcp 10.0.2.105 50658 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:08:06.825375 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:08:13.832656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:08:21.834230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:08:37.837325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:09:01.031185 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:09:01.031288 2.993502 tcp 10.0.2.105 50659 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:09:09.843020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:09:10.023456 0.000000 tcp 10.0.2.105 50659 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:09:16.033407 0.063318 tcp 10.0.2.105 50660 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:16.097023 0.065157 tcp 10.0.2.105 50661 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:16.162498 0.162637 tcp 10.0.2.105 50662 -> 195.113.214.249 443 SRPA* 0 0 23 14602 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:16.406911 0.394912 tcp 10.0.2.105 50663 -> 46.48.223.67 15494 SPA_* 0 0 9 1206 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:46.796711 0.065926 tcp 10.0.2.105 50664 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:46.862935 0.066279 tcp 10.0.2.105 50665 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:46.929523 0.156089 tcp 10.0.2.105 50666 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:47.194357 1.709723 tcp 10.0.2.105 50663 -> 46.48.223.67 15494 FRA_* 0 0 7 638 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:09:47.194677 3.006498 tcp 10.0.2.105 50667 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:09:56.199411 0.000000 tcp 10.0.2.105 50667 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:10:02.189335 0.062544 tcp 10.0.2.105 50668 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:10:02.252251 0.066661 tcp 10.0.2.105 50669 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:10:02.318775 0.172474 tcp 10.0.2.105 50670 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:10:02.620829 2.992364 tcp 10.0.2.105 50671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:10:11.621793 0.000000 tcp 10.0.2.105 50671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:10:17.620890 4.866685 tcp 10.0.2.105 50672 -> 46.48.223.67 15494 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:10:22.487428 3.004383 tcp 10.0.2.105 50673 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:10:31.490566 0.000000 tcp 10.0.2.105 50673 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:15:13.849644 3.001515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:15:20.856069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:15:28.857969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:15:37.491183 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:15:37.491284 4.871520 tcp 10.0.2.105 50674 -> 46.48.223.67 15494 SPA_* 0 0 12 1459 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:42.364764 0.061115 tcp 10.0.2.105 50675 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:42.426155 0.061347 tcp 10.0.2.105 50676 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:42.487967 0.158168 tcp 10.0.2.105 50677 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:42.850084 0.000078 tcp 10.0.2.105 50674 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:42.850397 1.949610 tcp 10.0.2.105 50678 -> 46.48.223.67 15494 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:15:44.861346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:16:16.867173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:20:21.038564 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:20:21.038659 0.227305 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:21.258142 0.055766 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:21.497144 0.354073 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:21.822615 0.181335 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:22.147424 0.216524 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2576 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:22.355602 0.182574 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:22.516178 0.179120 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:22.725770 0.122969 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:22.830679 0.248739 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:23.044192 0.396888 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:23.569753 0.168317 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:23.718166 0.075766 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:23.801982 0.180762 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:23.980054 0.120989 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:24.069228 0.172646 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:24.257731 0.186864 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:24.633023 0.208036 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:24.805368 0.083018 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:25.002848 0.198167 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:25.562612 0.187243 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:25.746695 0.058696 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:25.872965 0.647054 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:26.493308 0.185068 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 1961 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:26.675107 0.155271 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:27.052876 0.181616 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:20:44.792490 3.003549 tcp 10.0.2.105 50679 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:20:49.378885 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:20:53.797630 0.000000 tcp 10.0.2.105 50679 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:20:59.998634 0.082880 tcp 10.0.2.105 50680 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:00.081803 0.065223 tcp 10.0.2.105 50681 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:00.147327 0.235000 tcp 10.0.2.105 50682 -> 195.113.214.249 443 SRPA* 0 0 44 37134 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:01.092284 4.380754 tcp 10.0.2.105 50683 -> 46.48.223.67 15494 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:04.987340 0.062551 tcp 10.0.2.105 50684 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:05.050162 0.064574 tcp 10.0.2.105 50685 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:05.115054 0.170985 tcp 10.0.2.105 50686 -> 195.113.214.249 443 SRPA* 0 0 42 33214 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:05.473264 2.967222 tcp 10.0.2.105 50687 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:21:14.389029 0.000000 tcp 10.0.2.105 50687 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:21:20.339042 0.069270 tcp 10.0.2.105 50688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:20.408620 0.062142 tcp 10.0.2.105 50689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:20.471058 0.155029 tcp 10.0.2.105 50690 -> 195.113.214.249 443 SRPA* 0 0 42 22094 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:20.840528 2.977745 tcp 10.0.2.105 50691 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:21:29.816997 0.000000 tcp 10.0.2.105 50691 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:21:35.815592 3.871816 tcp 10.0.2.105 50692 -> 46.48.223.67 15494 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:21:39.687633 2.997807 tcp 10.0.2.105 50693 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:21:48.683854 0.000000 tcp 10.0.2.105 50693 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:22:21.100621 2.961288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:22:28.021061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:22:35.924970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:22:51.885068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:23:23.891145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:26:54.684263 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:26:54.684357 3.004290 tcp 10.0.2.105 50694 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:03.687021 0.000000 tcp 10.0.2.105 50694 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:10.284944 0.063780 tcp 10.0.2.105 50695 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:10.349070 0.061700 tcp 10.0.2.105 50696 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:10.411083 0.168582 tcp 10.0.2.105 50697 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:10.627211 2.306266 tcp 10.0.2.105 50698 -> 46.48.223.67 15494 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:12.558471 0.060739 tcp 10.0.2.105 50699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:12.619493 0.067121 tcp 10.0.2.105 50700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:12.686896 0.159638 tcp 10.0.2.105 50701 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:12.933732 2.955395 tcp 10.0.2.105 50702 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:21.834771 0.000000 tcp 10.0.2.105 50702 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:27.760865 0.063408 tcp 10.0.2.105 50703 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:27.824559 0.081170 tcp 10.0.2.105 50704 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:27.906044 0.157222 tcp 10.0.2.105 50705 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:28.364751 2.959614 tcp 10.0.2.105 50706 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:37.256884 0.000000 tcp 10.0.2.105 50706 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:27:43.183216 1.382536 tcp 10.0.2.105 50707 -> 46.48.223.67 15494 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:51.886035 0.000386 tcp 10.0.2.105 50707 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:27:51.886635 2.966848 tcp 10.0.2.105 50708 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:28:00.789073 0.000000 tcp 10.0.2.105 50708 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:29:27.896657 3.002213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:29:34.904062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:29:42.908219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:29:58.909734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:30:30.925310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:33:06.791428 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:33:06.791582 2.991891 tcp 10.0.2.105 50709 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:33:15.791935 0.000000 tcp 10.0.2.105 50709 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:33:21.792779 0.064147 tcp 10.0.2.105 50710 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:21.857235 0.069293 tcp 10.0.2.105 50711 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:21.926818 0.412087 tcp 10.0.2.105 50712 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:22.687731 0.932038 tcp 10.0.2.105 50713 -> 46.48.223.67 15494 SPA_* 0 0 9 996 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:52.031423 1.486029 tcp 10.0.2.105 50713 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:52.032324 0.075447 tcp 10.0.2.105 50714 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:52.108088 0.063862 tcp 10.0.2.105 50715 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:52.172227 0.168268 tcp 10.0.2.105 50716 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:33:53.145929 3.004116 tcp 10.0.2.105 50717 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:34:02.148838 0.000000 tcp 10.0.2.105 50717 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:34:08.149870 0.072574 tcp 10.0.2.105 50718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:34:08.222713 0.063332 tcp 10.0.2.105 50719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:34:08.286353 0.160354 tcp 10.0.2.105 50720 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:34:08.605819 3.006798 tcp 10.0.2.105 50721 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:34:17.612942 0.000000 tcp 10.0.2.105 50721 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:34:23.603253 0.373498 tcp 10.0.2.105 50722 -> 46.48.223.67 15494 SPA_* 0 0 9 996 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:34:38.735590 0.000350 tcp 10.0.2.105 50722 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:34:38.736144 3.003180 tcp 10.0.2.105 50723 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:34:47.734136 0.000000 tcp 10.0.2.105 50723 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:36:34.932113 3.000605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:36:41.938723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:36:49.940127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:37:05.942604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:37:37.949316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:39:53.735070 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:39:53.735177 3.003322 tcp 10.0.2.105 50724 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:02.737023 0.000000 tcp 10.0.2.105 50724 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:08.738640 0.060746 tcp 10.0.2.105 50725 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:08.799656 0.069846 tcp 10.0.2.105 50726 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:08.869756 0.165280 tcp 10.0.2.105 50727 -> 195.113.214.249 443 SRPA* 0 0 23 13802 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:09.165933 3.351000 tcp 10.0.2.105 50728 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:12.036218 0.061575 tcp 10.0.2.105 50729 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:12.098172 0.068730 tcp 10.0.2.105 50730 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:12.167173 0.166624 tcp 10.0.2.105 50731 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:12.517149 2.998435 tcp 10.0.2.105 50732 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:21.514202 0.000000 tcp 10.0.2.105 50732 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:27.513290 0.065671 tcp 10.0.2.105 50733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:27.579329 0.065594 tcp 10.0.2.105 50734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:27.645181 0.157865 tcp 10.0.2.105 50735 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:27.841000 2.996709 tcp 10.0.2.105 50736 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:36.836869 0.000000 tcp 10.0.2.105 50736 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:40:42.834750 0.380924 tcp 10.0.2.105 50737 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:54.154525 0.000550 tcp 10.0.2.105 50737 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:40:54.155346 3.000064 tcp 10.0.2.105 50738 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:41:03.153699 0.000000 tcp 10.0.2.105 50738 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:43:41.954368 3.002477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:43:48.964795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:43:56.964102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:44:12.967193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:44:44.973215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:50:28.757534 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:50:28.757669 0.464452 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:29.900512 0.224658 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:30.482226 0.060931 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:30.724124 0.186370 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:30.883156 0.218607 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:31.609925 0.187289 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:31.893658 0.173570 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:32.060398 0.124613 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:32.206203 0.248749 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:32.418603 0.408105 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:32.954608 0.169470 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.104411 0.075974 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.177439 0.175864 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.350375 0.118524 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.443561 0.208885 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.617915 0.082681 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:33.847207 0.173446 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:34.017567 0.180320 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:34.251753 0.201849 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:34.712573 0.186934 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:34.896562 0.060046 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:34.994683 0.154399 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:35.184926 0.442928 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:35.604570 0.185365 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:35.786228 0.182756 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/16 04:50:39.183126 3.003477 tcp 10.0.2.105 50739 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:50:48.185450 0.000000 tcp 10.0.2.105 50739 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:50:52.881943 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:50:54.185641 0.073430 tcp 10.0.2.105 50740 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:50:54.259380 0.064225 tcp 10.0.2.105 50741 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:50:54.323911 0.158592 tcp 10.0.2.105 50742 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:50:54.538333 0.386909 tcp 10.0.2.105 50743 -> 46.48.223.67 15494 SPA_* 0 0 9 1091 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:01.005785 0.842304 tcp 10.0.2.105 50743 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:01.006578 0.063840 tcp 10.0.2.105 50744 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:01.070747 0.066388 tcp 10.0.2.105 50745 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:01.137428 0.219698 tcp 10.0.2.105 50746 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:01.469218 2.999551 tcp 10.0.2.105 50747 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:51:10.467220 0.000000 tcp 10.0.2.105 50747 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:51:16.466476 0.061077 tcp 10.0.2.105 50748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:16.527803 0.064265 tcp 10.0.2.105 50749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:16.592330 0.154368 tcp 10.0.2.105 50750 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:17.314565 3.008496 tcp 10.0.2.105 50751 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:51:26.320157 0.000000 tcp 10.0.2.105 50751 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:51:32.308948 3.072124 tcp 10.0.2.105 50752 -> 46.48.223.67 15494 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:51:35.381299 2.996169 tcp 10.0.2.105 50753 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:51:44.375920 0.000000 tcp 10.0.2.105 50753 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:55:59.985635 3.002711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 04:56:06.993448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:56:14.994646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:56:31.008353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:56:50.381571 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 04:56:50.381676 2.998888 tcp 10.0.2.105 50754 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:56:59.378892 0.000000 tcp 10.0.2.105 50754 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:57:03.014256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 04:57:05.379668 0.061214 tcp 10.0.2.105 50755 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:05.441226 0.061574 tcp 10.0.2.105 50756 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:05.503095 0.171191 tcp 10.0.2.105 50757 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:06.029662 0.376023 tcp 10.0.2.105 50758 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:13.096660 0.302984 tcp 10.0.2.105 50758 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:13.097416 0.061294 tcp 10.0.2.105 50759 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:13.159068 0.069775 tcp 10.0.2.105 50760 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:13.229137 0.160881 tcp 10.0.2.105 50761 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:13.399861 2.993403 tcp 10.0.2.105 50762 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:57:22.402397 0.000000 tcp 10.0.2.105 50762 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:57:28.405369 0.140873 tcp 10.0.2.105 50763 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:28.546488 0.063259 tcp 10.0.2.105 50764 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:28.610050 0.157536 tcp 10.0.2.105 50765 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:28.934008 2.991799 tcp 10.0.2.105 50766 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:57:37.926961 0.000000 tcp 10.0.2.105 50766 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:57:43.923081 0.384277 tcp 10.0.2.105 50767 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:52.047941 0.000608 tcp 10.0.2.105 50767 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 04:57:52.048884 2.991602 tcp 10.0.2.105 50768 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 04:58:01.037477 0.000000 tcp 10.0.2.105 50768 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:07.020585 3.001201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:03:07.038218 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:03:07.038336 3.003494 tcp 10.0.2.105 50769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:14.027572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:03:16.040765 0.000000 tcp 10.0.2.105 50769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:22.032648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:03:22.044490 0.065328 tcp 10.0.2.105 50770 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:22.110092 0.064447 tcp 10.0.2.105 50771 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:22.174835 0.160541 tcp 10.0.2.105 50772 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:22.558094 4.283183 tcp 10.0.2.105 50773 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:26.524783 0.064855 tcp 10.0.2.105 50774 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:26.590175 0.063149 tcp 10.0.2.105 50775 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:26.653673 0.168628 tcp 10.0.2.105 50776 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:26.841511 2.998635 tcp 10.0.2.105 50777 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:35.838739 0.000000 tcp 10.0.2.105 50777 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:38.032094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:03:41.838552 0.062678 tcp 10.0.2.105 50778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:41.901509 0.066278 tcp 10.0.2.105 50779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:41.968171 0.154204 tcp 10.0.2.105 50780 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:03:42.278041 3.004672 tcp 10.0.2.105 50781 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:51.282514 0.000000 tcp 10.0.2.105 50781 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:03:57.269806 3.164781 tcp 10.0.2.105 50782 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:04:00.063019 3.001471 tcp 10.0.2.105 50783 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:04:09.056727 0.000000 tcp 10.0.2.105 50783 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:04:10.040662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:09:15.057365 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:09:15.057448 3.003293 tcp 10.0.2.105 50784 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:09:24.059635 0.000000 tcp 10.0.2.105 50784 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:09:30.059901 0.065609 tcp 10.0.2.105 50785 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:30.125805 0.067907 tcp 10.0.2.105 50786 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:30.193971 0.154160 tcp 10.0.2.105 50787 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:30.365530 2.201134 tcp 10.0.2.105 50788 -> 46.48.223.67 15494 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:32.260433 0.062278 tcp 10.0.2.105 50789 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:32.323061 0.061636 tcp 10.0.2.105 50790 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:32.384976 0.158815 tcp 10.0.2.105 50791 -> 195.113.214.249 443 SRPA* 0 0 25 13912 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:32.566931 2.998976 tcp 10.0.2.105 50792 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:09:41.564307 0.000000 tcp 10.0.2.105 50792 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:09:47.564035 0.060684 tcp 10.0.2.105 50793 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:47.625015 0.065115 tcp 10.0.2.105 50794 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:47.690446 0.155089 tcp 10.0.2.105 50795 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:09:47.931345 2.996864 tcp 10.0.2.105 50796 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:09:56.926823 0.000000 tcp 10.0.2.105 50796 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:10:02.925535 0.380820 tcp 10.0.2.105 50797 -> 46.48.223.67 15494 SPA_* 0 0 9 1098 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:10:08.585820 0.000419 tcp 10.0.2.105 50797 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:10:08.586480 3.001355 tcp 10.0.2.105 50798 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:10:17.586583 0.000000 tcp 10.0.2.105 50798 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:10:18.050618 3.000880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:10:25.057465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:10:33.058959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:10:49.061934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:11:21.067950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:17:25.074719 3.425705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 05:17:32.468194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:17:40.394531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:17:56.242255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:18:28.101687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:20:51.548449 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:20:51.548603 0.406248 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:51.926629 0.186659 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.123347 0.222302 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.339302 0.061008 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.399440 0.215773 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.607342 0.186753 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.772185 0.172238 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:52.936449 0.124212 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:53.083635 0.249770 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:53.297034 0.430870 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:53.643486 2.974474 tcp 10.0.2.105 50799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:20:53.723939 0.169893 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:53.873663 0.077295 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:54.045432 0.177177 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:54.219406 0.119529 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:54.378471 0.173871 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:54.549611 0.187704 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:54.899047 0.212286 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:55.076860 0.084508 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:55.338970 0.223072 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:55.604941 0.187182 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:55.788591 0.060599 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:55.868614 0.153541 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:56.211129 0.182793 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:56.388928 0.458722 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:20:56.825485 0.188869 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:21:02.613999 0.000000 tcp 10.0.2.105 50799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:08.624773 0.067901 tcp 10.0.2.105 50800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:08.692910 0.064911 tcp 10.0.2.105 50801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:08.758053 0.151108 tcp 10.0.2.105 50802 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:09.042403 2.994941 tcp 10.0.2.105 50803 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:18.036071 0.000000 tcp 10.0.2.105 50803 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:24.035267 0.064188 tcp 10.0.2.105 50804 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:24.099768 0.063481 tcp 10.0.2.105 50805 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:24.163567 0.158598 tcp 10.0.2.105 50806 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:21:24.448704 3.000876 tcp 10.0.2.105 50807 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:33.448552 0.000000 tcp 10.0.2.105 50807 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:39.447243 3.005738 tcp 10.0.2.105 50808 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:48.454693 0.000000 tcp 10.0.2.105 50808 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:21:53.387011 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:24:32.107884 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:24:39.121756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:24:47.116820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:25:03.119832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:25:35.125196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:26:54.450361 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:26:54.450527 2.993728 tcp 10.0.2.105 50809 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:03.452745 0.000000 tcp 10.0.2.105 50809 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:09.453337 0.068266 tcp 10.0.2.105 50810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:09.521935 0.067636 tcp 10.0.2.105 50811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:09.589850 0.154499 tcp 10.0.2.105 50812 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:09.894324 0.377578 tcp 10.0.2.105 50813 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:18.846630 0.362424 tcp 10.0.2.105 50813 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:18.847435 0.062997 tcp 10.0.2.105 50814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:18.910704 0.072821 tcp 10.0.2.105 50815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:18.983775 0.155946 tcp 10.0.2.105 50816 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:19.209308 3.003347 tcp 10.0.2.105 50817 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:28.208439 0.000000 tcp 10.0.2.105 50817 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:34.207479 0.061524 tcp 10.0.2.105 50818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:34.269368 0.068500 tcp 10.0.2.105 50819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:34.338158 0.159523 tcp 10.0.2.105 50820 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:27:34.759709 3.002387 tcp 10.0.2.105 50821 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:43.760925 0.000000 tcp 10.0.2.105 50821 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:27:49.759525 0.377992 tcp 10.0.2.105 50822 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:28:10.878533 0.351886 tcp 10.0.2.105 50822 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:28:10.879065 2.995746 tcp 10.0.2.105 50823 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:28:19.886604 0.000000 tcp 10.0.2.105 50823 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:31:39.131524 3.162910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:31:46.267054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:31:54.436357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:32:10.283806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:32:42.169807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:33:25.875950 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:33:25.876093 3.001719 tcp 10.0.2.105 50824 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:33:34.878919 0.000000 tcp 10.0.2.105 50824 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:33:40.875448 0.065247 tcp 10.0.2.105 50825 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:33:40.941029 0.063600 tcp 10.0.2.105 50826 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:33:41.004907 0.163918 tcp 10.0.2.105 50827 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:33:41.661080 0.386838 tcp 10.0.2.105 50828 -> 46.48.223.67 15494 SPA_* 0 0 7 1101 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:09.134403 0.559910 tcp 10.0.2.105 50828 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:09.135526 0.065509 tcp 10.0.2.105 50829 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:09.201424 0.067781 tcp 10.0.2.105 50830 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:09.269542 0.155088 tcp 10.0.2.105 50831 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:09.694533 3.005399 tcp 10.0.2.105 50832 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:34:18.698606 0.000000 tcp 10.0.2.105 50832 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:34:24.687759 0.062199 tcp 10.0.2.105 50833 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:24.750262 0.061353 tcp 10.0.2.105 50834 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:24.811962 0.156733 tcp 10.0.2.105 50835 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:25.154123 3.007926 tcp 10.0.2.105 50836 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:34:34.160849 0.000000 tcp 10.0.2.105 50836 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:34:40.149523 3.582400 tcp 10.0.2.105 50837 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:34:43.732133 2.996895 tcp 10.0.2.105 50838 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:34:52.727501 0.000000 tcp 10.0.2.105 50838 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:38:46.176686 3.000744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:38:53.183348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:39:01.184189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:39:17.187612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:39:49.195467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:39:58.731755 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:39:58.731862 3.001302 tcp 10.0.2.105 50839 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:07.730590 0.000000 tcp 10.0.2.105 50839 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:13.730813 0.066913 tcp 10.0.2.105 50840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:13.798010 0.060760 tcp 10.0.2.105 50841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:13.859094 0.159408 tcp 10.0.2.105 50842 -> 195.113.214.249 443 SRPA* 0 0 77 65764 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:14.401138 2.411285 tcp 10.0.2.105 50843 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:16.300389 0.060712 tcp 10.0.2.105 50844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:16.361524 0.064811 tcp 10.0.2.105 50845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:16.426595 0.160878 tcp 10.0.2.105 50846 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:16.812672 2.995079 tcp 10.0.2.105 50847 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:25.805859 0.000000 tcp 10.0.2.105 50847 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:31.805829 0.061802 tcp 10.0.2.105 50848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:31.867481 0.065217 tcp 10.0.2.105 50849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:31.932968 0.154640 tcp 10.0.2.105 50850 -> 195.113.214.249 443 SRPA* 0 0 25 14866 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:32.193348 2.996370 tcp 10.0.2.105 50851 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:41.188755 0.000000 tcp 10.0.2.105 50851 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:47.187637 1.907823 tcp 10.0.2.105 50852 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:40:49.095614 2.998264 tcp 10.0.2.105 50853 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:40:58.102729 0.000000 tcp 10.0.2.105 50853 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:45:53.205498 2.997941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:46:00.207272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:46:04.093298 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:46:04.093383 0.373693 tcp 10.0.2.105 50854 -> 46.48.223.67 15494 SPA_* 0 0 9 1017 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:08.215050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:46:13.518664 0.807957 tcp 10.0.2.105 50854 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:13.520534 0.064140 tcp 10.0.2.105 50855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:13.585009 0.066403 tcp 10.0.2.105 50856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:13.651707 0.158890 tcp 10.0.2.105 50857 -> 195.113.214.249 443 SRPA* 0 0 35 18594 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:14.326869 0.376349 tcp 10.0.2.105 50858 -> 46.48.223.67 15494 SPA_* 0 0 9 1017 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:24.214791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:46:44.702660 0.374098 tcp 10.0.2.105 50858 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:46:56.217704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:51:16.261833 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:51:16.262033 0.351314 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:16.585116 0.182752 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:16.790611 0.230627 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.013099 0.055865 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.196632 0.218274 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.407010 0.183308 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.636753 0.172769 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.871854 0.123266 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2012 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:17.977544 0.167649 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2018 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:18.126447 0.075995 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:18.290282 0.255651 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:18.508481 0.401674 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:18.906548 0.176914 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:19.080921 0.118836 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:19.275935 0.181188 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:19.451402 0.178257 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:19.693734 0.209986 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:19.869386 0.187359 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:20.280542 0.058345 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:20.337195 0.151967 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:20.764022 0.084539 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:20.809109 0.205612 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:21.132861 0.000000 udp 10.0.2.105 7010 -> 99.30.172.208 1178 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 05:51:38.520606 0.068666 tcp 10.0.2.105 50859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:51:38.589548 0.061397 tcp 10.0.2.105 50860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:51:38.651260 0.164480 tcp 10.0.2.105 50861 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:51:38.816352 0.183642 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:38.995401 0.450561 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 1978 flow=From-Botnet-V2-UDP-Established 1970/02/16 05:51:44.702161 3.004606 tcp 10.0.2.105 50862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:51:53.705565 0.000000 tcp 10.0.2.105 50862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:51:59.704616 0.064870 tcp 10.0.2.105 50863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:51:59.769746 0.069540 tcp 10.0.2.105 50864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:51:59.839574 0.155375 tcp 10.0.2.105 50865 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:00.226671 4.282317 tcp 10.0.2.105 50866 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:03.878465 0.066448 tcp 10.0.2.105 50867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:03.945179 0.068015 tcp 10.0.2.105 50868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:04.013100 0.167326 tcp 10.0.2.105 50869 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:04.509215 2.996157 tcp 10.0.2.105 50870 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:52:13.504022 0.000000 tcp 10.0.2.105 50870 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:52:19.506335 0.066919 tcp 10.0.2.105 50871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:19.573548 0.061854 tcp 10.0.2.105 50872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:19.635795 0.154983 tcp 10.0.2.105 50873 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:19.920548 2.998133 tcp 10.0.2.105 50874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:52:28.915505 0.000000 tcp 10.0.2.105 50874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:52:34.914398 3.567067 tcp 10.0.2.105 50875 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:52:38.481619 2.992437 tcp 10.0.2.105 50876 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:52:47.482622 0.000000 tcp 10.0.2.105 50876 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:53:00.223245 3.002365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 05:53:07.231078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:53:15.232743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:53:31.235779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:54:03.241809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 05:57:53.483157 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 05:57:53.483318 3.008454 tcp 10.0.2.105 50877 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:02.485592 0.000000 tcp 10.0.2.105 50877 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:08.485801 0.062985 tcp 10.0.2.105 50878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:08.549057 0.065648 tcp 10.0.2.105 50879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:08.615033 0.162120 tcp 10.0.2.105 50880 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:08.833404 0.386953 tcp 10.0.2.105 50881 -> 46.48.223.67 15494 SPA_* 0 0 9 1132 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:15.950133 0.523838 tcp 10.0.2.105 50881 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:15.950919 0.064832 tcp 10.0.2.105 50882 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:16.016013 0.064666 tcp 10.0.2.105 50883 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:16.080983 0.168620 tcp 10.0.2.105 50884 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:16.474218 3.005936 tcp 10.0.2.105 50885 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:25.479044 0.000000 tcp 10.0.2.105 50885 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:31.467954 0.064655 tcp 10.0.2.105 50886 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:31.532916 0.063802 tcp 10.0.2.105 50887 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:31.597003 0.182653 tcp 10.0.2.105 50888 -> 195.113.214.249 443 SRPA* 0 0 24 13194 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:31.928101 3.004118 tcp 10.0.2.105 50889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:40.931109 0.000000 tcp 10.0.2.105 50889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:58:46.929533 0.385116 tcp 10.0.2.105 50890 -> 46.48.223.67 15494 SPA_* 0 0 9 1132 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:55.345210 0.000305 tcp 10.0.2.105 50890 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 05:58:55.345725 3.000343 tcp 10.0.2.105 50891 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 05:59:04.344780 0.000000 tcp 10.0.2.105 50891 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:00:07.248635 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:00:14.255150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:00:22.256568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:00:38.259555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:01:10.265634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:04:10.345693 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:04:10.345798 3.002920 tcp 10.0.2.105 50892 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:04:19.347566 0.000000 tcp 10.0.2.105 50892 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:04:25.347347 0.061838 tcp 10.0.2.105 50893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:25.409433 0.064549 tcp 10.0.2.105 50894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:25.474248 0.153879 tcp 10.0.2.105 50895 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:25.777817 4.238233 tcp 10.0.2.105 50896 -> 46.48.223.67 15494 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:29.415775 0.061752 tcp 10.0.2.105 50897 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:29.477800 0.064408 tcp 10.0.2.105 50898 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:29.542579 0.166880 tcp 10.0.2.105 50899 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:30.016422 3.000721 tcp 10.0.2.105 50900 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:04:39.015394 0.000000 tcp 10.0.2.105 50900 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:04:45.014901 0.064469 tcp 10.0.2.105 50901 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:45.079649 0.064689 tcp 10.0.2.105 50902 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:45.144573 0.153180 tcp 10.0.2.105 50903 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:04:45.390846 2.998449 tcp 10.0.2.105 50904 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:04:54.388005 0.000000 tcp 10.0.2.105 50904 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:05:00.386997 1.981717 tcp 10.0.2.105 50905 -> 46.48.223.67 15494 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:05:02.366765 2.996953 tcp 10.0.2.105 50906 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:05:11.372613 0.000000 tcp 10.0.2.105 50906 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:07:21.276550 2.996250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:07:28.279060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:07:36.280341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:07:52.283616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:08:24.289895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:10:17.365184 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:10:17.365284 2.991111 tcp 10.0.2.105 50907 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:10:26.355486 0.000000 tcp 10.0.2.105 50907 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:10:32.365588 0.063839 tcp 10.0.2.105 50908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:32.429734 0.064273 tcp 10.0.2.105 50909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:32.494316 0.155913 tcp 10.0.2.105 50910 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:32.833382 2.526951 tcp 10.0.2.105 50911 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:34.813170 0.060854 tcp 10.0.2.105 50912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:34.874286 0.062563 tcp 10.0.2.105 50913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:34.937133 0.157614 tcp 10.0.2.105 50914 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:35.360563 3.002831 tcp 10.0.2.105 50915 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:10:44.363318 0.000000 tcp 10.0.2.105 50915 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:10:50.360358 0.073699 tcp 10.0.2.105 50916 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:50.434353 0.063049 tcp 10.0.2.105 50917 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:50.497676 0.160328 tcp 10.0.2.105 50918 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:10:50.834079 3.000618 tcp 10.0.2.105 50919 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:10:59.833321 0.000000 tcp 10.0.2.105 50919 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:11:05.832708 4.209263 tcp 10.0.2.105 50920 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:11:09.643048 3.008846 tcp 10.0.2.105 50921 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:11:18.650213 0.000000 tcp 10.0.2.105 50921 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:14:28.295229 3.002221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:14:35.302879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:14:43.304033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:14:59.307516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:15:31.313375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:21:35.319662 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 06:21:42.327263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:21:50.328968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:22:04.509140 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:22:04.509330 0.185696 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:04.691206 0.371747 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:05.036220 0.185360 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:05.239815 0.229924 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:05.462185 0.061559 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:05.628786 0.213079 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:05.833698 0.124976 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:06.073358 0.187962 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:06.331286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:22:06.358177 0.183989 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:06.519557 0.245601 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:06.760609 0.168885 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:06.908784 0.078643 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:07.267697 0.119380 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:07.354761 0.354150 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:07.868894 0.177881 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:08.042945 0.382789 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:08.862781 0.206841 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:09.037619 0.178914 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:09.329848 0.154873 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:09.677169 3.003581 tcp 10.0.2.105 50922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:09.677591 0.059181 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:09.734925 0.186804 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:09.918509 0.096080 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:10.113765 0.202323 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:10.490760 0.182740 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:10.668347 0.498795 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:22:18.679323 0.000000 tcp 10.0.2.105 50922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:24.680171 0.068775 tcp 10.0.2.105 50923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:24.749301 0.063403 tcp 10.0.2.105 50924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:24.812979 0.150758 tcp 10.0.2.105 50925 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:25.565887 2.997540 tcp 10.0.2.105 50926 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:34.572158 0.000000 tcp 10.0.2.105 50926 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:38.337848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:22:40.561378 0.060651 tcp 10.0.2.105 50927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:40.622287 0.068961 tcp 10.0.2.105 50928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:40.691597 0.237466 tcp 10.0.2.105 50929 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:22:41.230564 2.995539 tcp 10.0.2.105 50930 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:50.224602 0.000000 tcp 10.0.2.105 50930 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:22:56.222996 3.004630 tcp 10.0.2.105 50931 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:23:05.225774 0.000000 tcp 10.0.2.105 50931 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:23:09.882898 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:28:11.227345 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:28:11.227456 3.003235 tcp 10.0.2.105 50932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:20.229140 0.000000 tcp 10.0.2.105 50932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:26.229296 0.065064 tcp 10.0.2.105 50933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:26.294670 0.065421 tcp 10.0.2.105 50934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:26.360485 0.174625 tcp 10.0.2.105 50935 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:26.773883 4.100099 tcp 10.0.2.105 50936 -> 46.48.223.67 15494 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:30.368223 0.137532 tcp 10.0.2.105 50937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:30.506077 0.063880 tcp 10.0.2.105 50938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:30.570235 0.154899 tcp 10.0.2.105 50939 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:30.874281 3.004618 tcp 10.0.2.105 50940 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:39.877463 0.000000 tcp 10.0.2.105 50940 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:42.345350 2.999773 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:28:45.866602 0.064702 tcp 10.0.2.105 50941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:45.931602 0.065805 tcp 10.0.2.105 50942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:45.997713 0.155085 tcp 10.0.2.105 50943 -> 195.113.214.249 443 SRPA* 0 0 21 11536 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:28:46.330001 3.004873 tcp 10.0.2.105 50944 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:49.354974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:28:55.329803 0.000000 tcp 10.0.2.105 50944 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:28:57.353683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:29:01.328550 1.106979 tcp 10.0.2.105 50945 -> 46.48.223.67 15494 SPA_* 0 0 9 1069 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:29:13.355523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:29:32.432578 0.386307 tcp 10.0.2.105 50945 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:29:32.432946 3.004534 tcp 10.0.2.105 50946 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:29:41.435853 0.000000 tcp 10.0.2.105 50946 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:29:45.361303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:34:47.436184 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:34:47.436422 3.010597 tcp 10.0.2.105 50947 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:34:56.438753 0.000000 tcp 10.0.2.105 50947 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:02.439100 0.063239 tcp 10.0.2.105 50948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:02.502605 0.063541 tcp 10.0.2.105 50949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:02.566465 0.162098 tcp 10.0.2.105 50950 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:02.740671 3.017766 tcp 10.0.2.105 50951 -> 46.48.223.67 15494 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:05.366101 0.067890 tcp 10.0.2.105 50952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:05.434260 0.062214 tcp 10.0.2.105 50953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:05.496796 0.165928 tcp 10.0.2.105 50954 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:05.758636 2.997730 tcp 10.0.2.105 50955 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:14.754970 0.000000 tcp 10.0.2.105 50955 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:20.754265 0.067598 tcp 10.0.2.105 50956 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:20.822210 0.062690 tcp 10.0.2.105 50957 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:20.885225 0.163580 tcp 10.0.2.105 50958 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:21.378090 3.001116 tcp 10.0.2.105 50959 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:30.377583 0.000000 tcp 10.0.2.105 50959 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:36.376176 1.886234 tcp 10.0.2.105 50960 -> 46.48.223.67 15494 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:35:38.262659 3.001823 tcp 10.0.2.105 50961 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:47.271782 0.000000 tcp 10.0.2.105 50961 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:35:49.367578 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:35:56.375015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:36:04.376420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:36:20.379412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:36:52.385472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:40:53.262748 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:40:53.262908 2.993174 tcp 10.0.2.105 50962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:02.255024 0.000000 tcp 10.0.2.105 50962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:08.265208 0.068199 tcp 10.0.2.105 50963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:08.333663 0.063191 tcp 10.0.2.105 50964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:08.397142 0.157977 tcp 10.0.2.105 50965 -> 195.113.214.249 443 SRPA* 0 0 39 28004 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:08.716988 2.284869 tcp 10.0.2.105 50966 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:10.631033 0.060614 tcp 10.0.2.105 50967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:10.691886 0.062809 tcp 10.0.2.105 50968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:10.754532 0.156502 tcp 10.0.2.105 50969 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:11.002113 2.999412 tcp 10.0.2.105 50970 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:20.000331 0.000000 tcp 10.0.2.105 50970 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:26.003515 0.060698 tcp 10.0.2.105 50971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:26.064536 0.066918 tcp 10.0.2.105 50972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:26.131739 0.163544 tcp 10.0.2.105 50973 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:26.637050 2.997231 tcp 10.0.2.105 50974 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:35.643011 0.000000 tcp 10.0.2.105 50974 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:41.633621 0.381821 tcp 10.0.2.105 50975 -> 46.48.223.67 15494 SPA_* 0 0 9 1195 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:50.981580 0.000347 tcp 10.0.2.105 50975 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:41:50.982149 2.996933 tcp 10.0.2.105 50976 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:41:59.977904 0.000000 tcp 10.0.2.105 50976 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:42:56.391132 3.002137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:43:03.399158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:43:11.668841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:43:27.521641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:43:59.419597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:47:05.978694 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:47:05.978881 0.376899 tcp 10.0.2.105 50977 -> 46.48.223.67 15494 SPA_* 0 0 9 1034 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:47:15.598672 0.295952 tcp 10.0.2.105 50977 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:47:15.601103 0.065714 tcp 10.0.2.105 50978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:47:15.667096 0.063596 tcp 10.0.2.105 50979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:47:15.731026 0.152789 tcp 10.0.2.105 50980 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:47:15.894914 1.924369 tcp 10.0.2.105 50981 -> 46.48.223.67 15494 FSPA* 0 0 14 1564 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:52:41.220050 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:52:41.220221 0.187937 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:52:41.404699 0.351260 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 1964 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:52:41.730682 0.188564 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:52:41.890250 0.228586 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:52:42.110555 0.062855 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:52:42.291537 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 06:52:47.828775 2.984398 tcp 10.0.2.105 50982 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:52:56.822069 0.000000 tcp 10.0.2.105 50982 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:53:00.870214 0.065670 tcp 10.0.2.105 50983 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:00.936170 0.070761 tcp 10.0.2.105 50984 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:01.007231 0.171916 tcp 10.0.2.105 50985 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:01.179825 0.126334 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:01.285566 0.246439 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:01.594769 0.168061 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:01.742948 0.174179 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:01.909718 0.182279 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:02.067920 0.075355 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:02.126203 0.111773 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:02.568170 0.172867 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:02.737888 0.175183 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:02.821266 0.134733 tcp 10.0.2.105 50986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:02.956455 0.065123 tcp 10.0.2.105 50987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:02.970281 0.419903 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:03.021896 0.156624 tcp 10.0.2.105 50988 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:53:03.222315 2.992741 tcp 10.0.2.105 50989 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:53:03.386005 0.213967 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:03.564710 0.177162 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:03.834313 0.164280 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:04.038132 0.060064 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:04.096664 0.189295 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:04.295169 0.079976 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:04.340597 0.471955 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:04.784497 0.199117 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:05.011364 0.182025 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/16 06:53:12.214640 0.000000 tcp 10.0.2.105 50989 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:55:39.428740 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 06:55:46.435902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:55:54.437581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:56:10.440750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:56:42.446574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 06:58:18.224748 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 06:58:18.224925 3.006211 tcp 10.0.2.105 50990 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:58:27.226971 0.000000 tcp 10.0.2.105 50990 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:58:33.230621 0.066103 tcp 10.0.2.105 50991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:33.297003 0.067971 tcp 10.0.2.105 50992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:33.365244 0.156959 tcp 10.0.2.105 50993 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:33.698423 2.693161 tcp 10.0.2.105 50994 -> 46.48.223.67 15494 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:35.583911 0.063933 tcp 10.0.2.105 50995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:35.648094 0.062895 tcp 10.0.2.105 50996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:35.711272 0.167580 tcp 10.0.2.105 50997 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:36.391854 2.992736 tcp 10.0.2.105 50998 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:58:45.383066 0.000000 tcp 10.0.2.105 50998 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:58:51.392532 0.063934 tcp 10.0.2.105 50999 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:51.456730 0.062821 tcp 10.0.2.105 51000 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:51.519851 0.204962 tcp 10.0.2.105 51001 -> 195.113.214.249 443 SRPA* 0 0 29 14926 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:58:51.900871 2.987977 tcp 10.0.2.105 51002 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:59:00.885124 0.000000 tcp 10.0.2.105 51002 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:59:06.894414 2.922710 tcp 10.0.2.105 51003 -> 46.48.223.67 15494 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/16 06:59:09.817318 3.005385 tcp 10.0.2.105 51004 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 06:59:18.821583 0.000000 tcp 10.0.2.105 51004 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:02:46.453023 3.002690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:02:53.460048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:03:01.461561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:03:17.464532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:03:49.472579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:04:24.811856 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:04:24.811977 2.993812 tcp 10.0.2.105 51005 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:04:33.804904 0.000000 tcp 10.0.2.105 51005 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:04:39.814444 0.068372 tcp 10.0.2.105 51006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:39.883147 0.061653 tcp 10.0.2.105 51007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:39.945112 0.150881 tcp 10.0.2.105 51008 -> 195.113.214.249 443 SRPA* 0 0 34 18154 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:40.108831 2.220653 tcp 10.0.2.105 51009 -> 46.48.223.67 15494 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:42.033975 0.061498 tcp 10.0.2.105 51010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:42.095735 0.071449 tcp 10.0.2.105 51011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:42.167479 0.153068 tcp 10.0.2.105 51012 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:42.329695 3.001494 tcp 10.0.2.105 51013 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:04:51.329557 0.000000 tcp 10.0.2.105 51013 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:04:57.328783 0.069596 tcp 10.0.2.105 51014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:57.398672 0.062898 tcp 10.0.2.105 51015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:57.461873 0.188954 tcp 10.0.2.105 51016 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:04:57.664961 3.008181 tcp 10.0.2.105 51017 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:05:06.681661 0.000000 tcp 10.0.2.105 51017 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:05:12.660398 1.893362 tcp 10.0.2.105 51018 -> 46.48.223.67 15494 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:05:14.553970 3.003366 tcp 10.0.2.105 51019 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:05:23.556206 0.000000 tcp 10.0.2.105 51019 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:10:02.480549 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:10:09.489701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:10:17.488779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:10:29.556307 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:10:29.556404 3.003587 tcp 10.0.2.105 51020 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:10:33.491372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:10:38.558730 0.000000 tcp 10.0.2.105 51020 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:10:44.755463 0.072001 tcp 10.0.2.105 51021 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:44.827740 0.066441 tcp 10.0.2.105 51022 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:44.894448 0.158845 tcp 10.0.2.105 51023 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:45.151193 2.257080 tcp 10.0.2.105 51024 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:47.065334 0.061571 tcp 10.0.2.105 51025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:47.127261 0.062259 tcp 10.0.2.105 51026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:47.189798 0.172894 tcp 10.0.2.105 51027 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:10:47.408515 2.970668 tcp 10.0.2.105 51028 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:10:56.321502 0.000000 tcp 10.0.2.105 51028 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:11:02.261665 0.091395 tcp 10.0.2.105 51029 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:11:02.353392 0.065614 tcp 10.0.2.105 51030 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:11:02.419290 0.161733 tcp 10.0.2.105 51031 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:11:02.598474 2.969166 tcp 10.0.2.105 51032 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:11:05.497564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:11:11.566077 0.000000 tcp 10.0.2.105 51032 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:11:17.565092 1.909764 tcp 10.0.2.105 51033 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:11:19.475143 3.007575 tcp 10.0.2.105 51034 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:11:28.480586 0.000000 tcp 10.0.2.105 51034 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:16:34.471085 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:16:34.471239 2.993600 tcp 10.0.2.105 51035 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:16:43.463444 0.000000 tcp 10.0.2.105 51035 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:16:49.473687 0.066234 tcp 10.0.2.105 51036 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:16:49.540410 0.065582 tcp 10.0.2.105 51037 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:16:49.606288 0.157164 tcp 10.0.2.105 51038 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:16:49.842159 0.376219 tcp 10.0.2.105 51039 -> 46.48.223.67 15494 SPA_* 0 0 9 1156 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:02.424669 0.678530 tcp 10.0.2.105 51039 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:02.425588 0.061414 tcp 10.0.2.105 51040 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:02.487259 0.062645 tcp 10.0.2.105 51041 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:02.550177 0.163669 tcp 10.0.2.105 51042 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:03.103478 2.992179 tcp 10.0.2.105 51043 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:17:09.503688 3.001690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:17:12.094582 0.000000 tcp 10.0.2.105 51043 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:17:16.511025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:17:18.093834 0.064455 tcp 10.0.2.105 51044 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:18.158657 0.066193 tcp 10.0.2.105 51045 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:18.225144 0.170681 tcp 10.0.2.105 51046 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:18.487447 3.000645 tcp 10.0.2.105 51047 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:17:24.512567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:17:27.486683 0.000000 tcp 10.0.2.105 51047 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:17:33.485631 0.388056 tcp 10.0.2.105 51048 -> 46.48.223.67 15494 SPA_* 0 0 9 1156 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:40.515799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:17:41.775367 0.000332 tcp 10.0.2.105 51048 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:17:41.775918 3.007226 tcp 10.0.2.105 51049 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:17:50.779953 0.000000 tcp 10.0.2.105 51049 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:18:12.521631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:23:30.158338 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:23:30.158533 0.214907 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:30.366018 0.185769 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:30.761840 0.188768 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:30.946267 0.390876 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:31.308556 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 07:23:41.774863 3.008909 tcp 10.0.2.105 51050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:23:48.426382 0.066145 tcp 10.0.2.105 51051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:48.492751 0.066839 tcp 10.0.2.105 51052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:48.559974 0.161067 tcp 10.0.2.105 51053 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:48.721514 0.055869 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:48.774459 0.126109 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:48.953266 0.176105 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.121874 0.251165 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.343075 0.167650 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.545577 0.182960 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.705791 0.076006 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.813956 0.113507 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:49.895187 0.173964 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:50.066307 0.178171 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:50.240932 0.193477 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:50.410615 0.390233 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:50.783929 0.000000 tcp 10.0.2.105 51050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:23:50.797056 0.211551 udp 10.0.2.105 7010 <-> 108.73.162.35 2335 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:50.971503 0.155409 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:51.285113 0.058071 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:51.341239 0.188902 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:51.551680 0.085863 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2012 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:51.600855 0.180176 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:51.776391 0.602061 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:52.354503 0.201341 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:23:56.776701 0.063822 tcp 10.0.2.105 51054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:56.840824 0.062159 tcp 10.0.2.105 51055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:56.903329 0.173993 tcp 10.0.2.105 51056 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:23:57.196643 3.004629 tcp 10.0.2.105 51057 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:24:06.199950 0.000000 tcp 10.0.2.105 51057 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:24:16.528078 3.001466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:24:23.535016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:24:31.536604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:24:47.539219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:25:19.545566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:29:12.194460 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:29:12.194562 2.989974 tcp 10.0.2.105 51058 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:29:21.193105 0.000000 tcp 10.0.2.105 51058 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:29:27.193789 0.068814 tcp 10.0.2.105 51059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:27.262887 0.064479 tcp 10.0.2.105 51060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:27.327746 0.157258 tcp 10.0.2.105 51061 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:27.555542 0.385625 tcp 10.0.2.105 51062 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:37.701542 0.370590 tcp 10.0.2.105 51062 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:37.702394 0.060961 tcp 10.0.2.105 51063 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:37.763639 0.067256 tcp 10.0.2.105 51064 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:37.831156 0.158861 tcp 10.0.2.105 51065 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:38.072329 2.999005 tcp 10.0.2.105 51066 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:29:47.069868 0.000000 tcp 10.0.2.105 51066 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:29:53.069818 0.064778 tcp 10.0.2.105 51067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:53.134847 0.064299 tcp 10.0.2.105 51068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:53.199381 0.152698 tcp 10.0.2.105 51069 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:29:53.535704 2.987931 tcp 10.0.2.105 51070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:30:02.532025 0.000000 tcp 10.0.2.105 51070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:30:08.531815 0.382254 tcp 10.0.2.105 51071 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:30:17.316163 0.000364 tcp 10.0.2.105 51071 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:30:17.316742 3.001243 tcp 10.0.2.105 51072 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:30:26.315921 0.000000 tcp 10.0.2.105 51072 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:31:23.551978 3.001718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:31:30.558832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:31:38.560347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:31:54.563406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:32:26.569476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:35:32.317029 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:35:32.317211 3.003510 tcp 10.0.2.105 51073 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:35:41.319530 0.000000 tcp 10.0.2.105 51073 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:35:47.319568 0.063472 tcp 10.0.2.105 51074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:47.383311 0.067796 tcp 10.0.2.105 51075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:47.451426 0.305282 tcp 10.0.2.105 51076 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:47.779195 0.377304 tcp 10.0.2.105 51077 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:58.160261 0.457603 tcp 10.0.2.105 51077 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:58.160996 0.063099 tcp 10.0.2.105 51078 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:58.224389 0.061832 tcp 10.0.2.105 51079 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:58.286498 0.160279 tcp 10.0.2.105 51080 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:35:58.618082 3.000643 tcp 10.0.2.105 51081 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:36:07.617274 0.000000 tcp 10.0.2.105 51081 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:36:13.616396 0.194094 tcp 10.0.2.105 51082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:36:13.810917 0.060935 tcp 10.0.2.105 51083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:36:13.872237 0.174131 tcp 10.0.2.105 51084 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:36:14.270757 3.000204 tcp 10.0.2.105 51085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:36:23.269570 0.000000 tcp 10.0.2.105 51085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:36:29.268823 4.359713 tcp 10.0.2.105 51086 -> 46.48.223.67 15494 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:36:33.628780 2.999988 tcp 10.0.2.105 51087 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:36:42.627712 0.000000 tcp 10.0.2.105 51087 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:38:30.575171 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:38:37.583083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:38:45.588905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:39:01.587303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:39:33.593349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:41:48.627992 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:41:48.628094 3.008455 tcp 10.0.2.105 51088 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:41:57.630507 0.000000 tcp 10.0.2.105 51088 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:42:03.630698 0.154292 tcp 10.0.2.105 51089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:03.785309 0.061242 tcp 10.0.2.105 51090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:03.846802 0.154079 tcp 10.0.2.105 51091 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:04.150410 0.382026 tcp 10.0.2.105 51092 -> 46.48.223.67 15494 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:14.263603 0.967289 tcp 10.0.2.105 51092 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:14.264541 0.064685 tcp 10.0.2.105 51093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:14.329083 0.061411 tcp 10.0.2.105 51094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:14.390756 0.167264 tcp 10.0.2.105 51095 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:15.231156 2.999626 tcp 10.0.2.105 51096 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:42:24.228697 0.000000 tcp 10.0.2.105 51096 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:42:30.227687 0.060814 tcp 10.0.2.105 51097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:30.288785 0.069203 tcp 10.0.2.105 51098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:30.358305 0.163044 tcp 10.0.2.105 51099 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:30.630515 3.001962 tcp 10.0.2.105 51100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:42:39.630725 0.000000 tcp 10.0.2.105 51100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:42:45.629811 0.385683 tcp 10.0.2.105 51101 -> 46.48.223.67 15494 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:54.472789 0.000339 tcp 10.0.2.105 51101 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:42:54.473402 3.003226 tcp 10.0.2.105 51102 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:43:03.474611 0.000000 tcp 10.0.2.105 51102 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:45:37.601286 3.002511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:45:44.607065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:45:52.613101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:46:08.611584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:46:40.617306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:48:09.475886 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:48:09.476008 0.387626 tcp 10.0.2.105 51103 -> 46.48.223.67 15494 SPA_* 0 0 9 1190 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:19.282426 0.462740 tcp 10.0.2.105 51103 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:19.284359 0.061519 tcp 10.0.2.105 51104 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:19.346208 0.065925 tcp 10.0.2.105 51105 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:19.412486 0.176058 tcp 10.0.2.105 51106 -> 195.113.214.249 443 SRPA* 0 0 43 22720 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:19.745389 2.999267 tcp 10.0.2.105 51107 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:48:28.752339 0.000000 tcp 10.0.2.105 51107 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:48:34.742128 0.073300 tcp 10.0.2.105 51108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:34.815707 0.120855 tcp 10.0.2.105 51109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:34.936891 0.163564 tcp 10.0.2.105 51110 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:35.349196 4.879729 tcp 10.0.2.105 51111 -> 46.48.223.67 15494 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:48:40.229122 2.994347 tcp 10.0.2.105 51112 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:48:49.385149 0.000000 tcp 10.0.2.105 51112 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:53:55.322565 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:53:55.322676 0.226445 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:55.541576 0.186732 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:56.041368 0.215865 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:56.248707 0.189114 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:56.469717 0.354815 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:56.793632 0.174403 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:53:56.989470 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 07:54:10.224000 3.003898 tcp 10.0.2.105 51113 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:54:15.896635 0.066803 tcp 10.0.2.105 51114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:15.963702 0.067226 tcp 10.0.2.105 51115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:16.031205 0.161456 tcp 10.0.2.105 51116 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:16.191592 0.124729 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:16.297146 0.250692 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:16.510546 0.167977 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:16.659371 0.180805 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:16.818629 0.078814 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:17.005641 0.117894 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:17.237832 0.171961 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:17.406473 0.374179 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:17.776652 0.000000 udp 10.0.2.105 7010 -> 108.73.162.35 2335 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 07:54:19.226755 0.000000 tcp 10.0.2.105 51113 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:54:25.225652 0.060506 tcp 10.0.2.105 51117 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:25.286531 0.068153 tcp 10.0.2.105 51118 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:25.354944 0.156638 tcp 10.0.2.105 51119 -> 195.113.214.249 443 SRPA* 0 0 22 11628 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:25.737739 3.002684 tcp 10.0.2.105 51120 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:54:33.978700 0.062904 tcp 10.0.2.105 51121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:34.041881 0.065715 tcp 10.0.2.105 51122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:34.107882 0.165508 tcp 10.0.2.105 51123 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:54:34.273933 0.152037 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:34.425126 0.177755 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:34.598848 0.174616 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:34.739037 0.000000 tcp 10.0.2.105 51120 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:54:34.875317 0.059028 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:34.932958 0.191054 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:35.120146 0.093800 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:35.256340 0.182463 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:35.434037 0.443246 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:54:35.860115 0.205650 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/16 07:57:00.632552 3.000668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 07:57:07.638772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:57:15.642732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:57:31.643172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:58:03.649413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 07:59:40.739353 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 07:59:40.739529 2.993359 tcp 10.0.2.105 51124 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:59:49.741919 0.000000 tcp 10.0.2.105 51124 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 07:59:55.742181 0.070814 tcp 10.0.2.105 51125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:59:55.813218 0.078972 tcp 10.0.2.105 51126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:59:55.892614 0.154175 tcp 10.0.2.105 51127 -> 195.113.214.249 443 SRPA* 0 0 21 11574 flow=From-Botnet-V2-TCP-Established 1970/02/16 07:59:56.197588 0.375158 tcp 10.0.2.105 51128 -> 46.48.223.67 15494 SPA_* 0 0 9 992 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:03.898974 0.305405 tcp 10.0.2.105 51128 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:03.899775 0.067600 tcp 10.0.2.105 51129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:03.967665 0.061217 tcp 10.0.2.105 51130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:04.029210 0.158904 tcp 10.0.2.105 51131 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:04.204623 3.002276 tcp 10.0.2.105 51132 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:00:13.205148 0.000000 tcp 10.0.2.105 51132 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:00:19.204761 0.063694 tcp 10.0.2.105 51133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:19.268712 0.065842 tcp 10.0.2.105 51134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:19.334828 0.240499 tcp 10.0.2.105 51135 -> 195.113.214.249 443 SRPA* 0 0 44 26620 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:19.655489 3.003737 tcp 10.0.2.105 51136 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:00:28.657703 0.000000 tcp 10.0.2.105 51136 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:00:34.656735 1.939232 tcp 10.0.2.105 51137 -> 46.48.223.67 15494 FSPA* 0 0 14 1522 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:00:36.587523 2.995960 tcp 10.0.2.105 51138 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:00:45.593190 0.000000 tcp 10.0.2.105 51138 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:04:07.655548 3.001364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:04:14.662871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:04:22.668716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:04:38.667305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:05:10.673165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:05:51.582802 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:05:51.582910 2.993581 tcp 10.0.2.105 51139 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:00.574585 0.000000 tcp 10.0.2.105 51139 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:06.589058 0.064615 tcp 10.0.2.105 51140 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:06.654062 0.065982 tcp 10.0.2.105 51141 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:06.720367 0.157666 tcp 10.0.2.105 51142 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:06.891019 0.379985 tcp 10.0.2.105 51143 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:13.717225 0.303212 tcp 10.0.2.105 51143 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:13.718118 0.066236 tcp 10.0.2.105 51144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:13.784668 0.065962 tcp 10.0.2.105 51145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:13.850912 0.160347 tcp 10.0.2.105 51146 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:14.020739 2.998279 tcp 10.0.2.105 51147 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:23.017877 0.000000 tcp 10.0.2.105 51147 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:29.020929 0.066516 tcp 10.0.2.105 51148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:29.087332 0.065895 tcp 10.0.2.105 51149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:29.153501 0.181032 tcp 10.0.2.105 51150 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:29.349582 3.003306 tcp 10.0.2.105 51151 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:38.349527 0.000000 tcp 10.0.2.105 51151 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:44.338106 0.381967 tcp 10.0.2.105 51152 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:49.640780 0.000327 tcp 10.0.2.105 51152 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:06:49.641327 3.002192 tcp 10.0.2.105 51153 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:06:58.638824 0.000000 tcp 10.0.2.105 51153 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:11:14.679563 3.002923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:11:21.687020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:11:29.688905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:11:45.691040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:12:04.639261 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:12:04.639414 3.003358 tcp 10.0.2.105 51154 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:12:13.651497 0.000000 tcp 10.0.2.105 51154 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:12:17.697274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:12:19.641943 0.064794 tcp 10.0.2.105 51155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:19.707013 0.064007 tcp 10.0.2.105 51156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:19.771316 0.169621 tcp 10.0.2.105 51157 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:20.363662 0.371173 tcp 10.0.2.105 51158 -> 46.48.223.67 15494 SPA_* 0 0 9 1193 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:35.597873 0.600570 tcp 10.0.2.105 51158 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:35.598699 0.062340 tcp 10.0.2.105 51159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:35.661332 0.062707 tcp 10.0.2.105 51160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:35.724332 0.162395 tcp 10.0.2.105 51161 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:36.198734 2.999344 tcp 10.0.2.105 51162 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:12:45.196414 0.000000 tcp 10.0.2.105 51162 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:12:51.196059 0.067339 tcp 10.0.2.105 51163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:51.263708 0.064111 tcp 10.0.2.105 51164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:51.328176 0.162717 tcp 10.0.2.105 51165 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:12:51.538515 3.001517 tcp 10.0.2.105 51166 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:13:00.538996 0.000000 tcp 10.0.2.105 51166 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:13:06.537610 0.380910 tcp 10.0.2.105 51167 -> 46.48.223.67 15494 SPA_* 0 0 9 1193 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:13:14.374728 0.000338 tcp 10.0.2.105 51167 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:13:14.375267 2.997686 tcp 10.0.2.105 51168 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:13:23.383070 0.000000 tcp 10.0.2.105 51168 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:18:21.704498 3.000294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:18:28.710568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:18:29.372411 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:18:29.372563 2.992987 tcp 10.0.2.105 51169 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:18:36.712463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:18:38.364668 0.000000 tcp 10.0.2.105 51169 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:18:44.377103 0.067025 tcp 10.0.2.105 51170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:44.444404 0.061794 tcp 10.0.2.105 51171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:44.506463 0.175630 tcp 10.0.2.105 51172 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:45.055149 0.374673 tcp 10.0.2.105 51173 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:51.663134 0.332948 tcp 10.0.2.105 51173 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:51.664060 0.059447 tcp 10.0.2.105 51174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:51.723766 0.061354 tcp 10.0.2.105 51175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:51.785394 0.159311 tcp 10.0.2.105 51176 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:18:51.996552 3.002116 tcp 10.0.2.105 51177 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:18:52.715874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:19:00.997243 0.000000 tcp 10.0.2.105 51177 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:19:06.996549 0.061460 tcp 10.0.2.105 51178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:19:07.057852 0.066779 tcp 10.0.2.105 51179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:19:07.124981 0.157272 tcp 10.0.2.105 51180 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:19:07.416062 3.004908 tcp 10.0.2.105 51181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:19:16.419451 0.000000 tcp 10.0.2.105 51181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:19:22.418231 1.883528 tcp 10.0.2.105 51182 -> 46.48.223.67 15494 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:19:24.301958 2.992989 tcp 10.0.2.105 51183 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:19:24.721308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:19:33.293631 0.000000 tcp 10.0.2.105 51183 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:24:46.395148 0.000208 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:24:46.395465 0.055699 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:24:46.448431 0.000000 udp 10.0.2.105 7010 -> 108.73.162.35 2335 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:24:54.305603 3.003842 tcp 10.0.2.105 51184 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:25:02.638489 0.061712 tcp 10.0.2.105 51185 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:02.700550 0.065101 tcp 10.0.2.105 51186 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:02.765936 0.159730 tcp 10.0.2.105 51187 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:02.926233 0.227616 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:03.145997 0.187259 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:03.308098 0.000000 tcp 10.0.2.105 51184 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:25:03.720106 0.214424 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:03.926016 0.185694 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:04.107501 0.394393 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:04.471801 0.172808 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:04.694407 0.246167 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:04.908239 0.125262 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.062652 0.075913 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.121182 0.170703 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.356957 0.186640 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2682 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.518660 0.189411 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.804125 0.117711 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:05.889735 0.379289 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:06.265238 0.153139 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:06.472781 0.175994 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:06.645168 0.178942 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:06.927540 0.058647 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:06.984213 0.195181 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:07.176756 0.091861 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:07.428793 0.180666 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:07.604673 0.445428 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:08.028173 0.204352 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:08.366950 0.106147 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 8 3073 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:08.470351 0.438904 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3053 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:08.902075 0.411368 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 8 3066 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:09.305483 0.359662 udp 10.0.2.105 7010 <-> 99.30.172.208 1178 CON 0 0 8 3023 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:09.306566 0.063827 tcp 10.0.2.105 51188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:09.370660 0.063878 tcp 10.0.2.105 51189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:09.434897 0.157801 tcp 10.0.2.105 51190 -> 195.113.214.249 443 SRPA* 0 0 25 10514 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:25:09.662094 0.345347 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3162 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:09.769273 3.002119 tcp 10.0.2.105 51191 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:25:09.979196 0.709670 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 2938 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:10.662250 0.335852 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 8 2852 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:10.990850 0.467554 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3033 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:11.422859 0.233261 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 8 2970 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:11.636437 0.267899 udp 10.0.2.105 7010 <-> 85.228.168.150 1204 CON 0 0 8 3115 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:11.885823 0.344677 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 8 3183 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:12.209249 0.401820 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 3112 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:12.588269 0.421606 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2968 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:13.007342 0.185198 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 8 3126 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:13.160229 0.579136 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 8 2884 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:14.060206 0.340497 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 8 3001 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:14.398366 0.450683 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 8 3031 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:14.824849 0.109690 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 8 3097 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:14.933209 0.749985 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 8 3198 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:15.825072 0.374393 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 8 3138 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:16.196509 0.407618 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3082 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:16.566992 0.439828 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 3146 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:17.001918 0.875075 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 3151 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:17.856113 0.399167 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 3407 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:18.265335 0.000000 udp 10.0.2.105 7010 -> 174.130.17.123 8966 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:18.773663 0.000000 tcp 10.0.2.105 51191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:25:25.109745 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:28.727698 3.001036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:25:31.909300 0.168182 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:32.077482 0.000000 icmp 66.55.26.130 0x0303 -> 10.0.2.105 0x2b20 URP 192 1 259 flow=Background 1970/02/16 08:25:35.734293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:25:36.875694 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:25:38.392810 0.314042 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 8 3156 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:25:38.801983 0.000000 udp 10.0.2.105 7010 -> 204.14.77.88 9631 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:43.736009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:25:45.608852 0.000000 udp 10.0.2.105 7010 -> 81.214.28.29 7203 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:51.219852 0.000000 udp 10.0.2.105 7010 -> 76.114.73.14 1042 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:57.866992 0.357529 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:25:58.224521 0.000000 icmp 161.43.220.14 0x0303 -> 10.0.2.105 0xa726 URP 192 1 215 flow=Background 1970/02/16 08:25:59.739208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:26:02.383091 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:26:06.438936 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:13.259030 0.000000 udp 10.0.2.105 7010 -> 95.146.156.196 5843 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:21.752499 0.069682 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:26:21.977273 0.000000 udp 10.0.2.105 7010 -> 75.75.80.218 1082 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:26.377345 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:26:27.511743 0.000000 udp 10.0.2.105 7010 -> 65.125.140.130 5771 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:31.744990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:26:34.339250 0.000000 udp 10.0.2.105 7010 -> 112.209.238.218 9574 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:43.252117 0.154788 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:26:43.836584 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:48.909777 0.226525 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:26:49.464001 0.380171 udp 10.0.2.105 7010 -> 203.125.247.226 5590 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:26:49.844172 0.000000 icmp 203.125.247.226 0x0303 -> 10.0.2.105 0xd615 URP 192 1 189 flow=Background 1970/02/16 08:26:53.876940 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:26:56.460861 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:03.562951 0.295415 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:27:04.223834 0.000000 udp 10.0.2.105 7010 -> 67.188.20.253 9015 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:11.101644 0.000000 udp 10.0.2.105 7010 -> 93.147.173.142 5372 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:19.033425 0.000000 udp 10.0.2.105 7010 -> 174.102.37.32 5006 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:24.656802 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:27:25.053950 0.000000 udp 10.0.2.105 7010 -> 14.97.74.31 8564 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:33.089791 0.000000 udp 10.0.2.105 7010 -> 96.21.140.216 1783 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:40.215154 0.177087 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 696 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:27:40.577981 0.000000 udp 10.0.2.105 7010 -> 174.75.66.37 7814 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:49.150544 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:27:53.810567 0.540015 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:27:58.323434 0.000000 udp 10.0.2.105 7010 -> 190.119.45.242 7667 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:04.949038 0.000000 udp 10.0.2.105 7010 -> 84.17.28.238 3256 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:10.391658 0.000000 udp 10.0.2.105 7010 -> 92.3.139.247 1606 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:16.661941 0.000000 udp 10.0.2.105 7010 -> 68.15.62.245 1093 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:21.500433 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:28:23.536363 0.000000 udp 10.0.2.105 7010 -> 203.92.119.40 9946 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:29.553521 0.000000 udp 10.0.2.105 7010 -> 86.160.32.117 7375 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:36.530214 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1203 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:42.047199 0.220012 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:28:42.455296 0.000000 udp 10.0.2.105 7010 -> 62.212.44.70 7424 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:46.688824 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:28:47.759426 0.000000 udp 10.0.2.105 7010 -> 88.2.171.136 9390 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:28:56.536389 0.000000 udp 10.0.2.105 7010 -> 81.208.118.75 6166 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:03.803244 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 1065 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:13.764013 0.000000 udp 10.0.2.105 7010 -> 91.187.115.39 7453 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:18.250285 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:29:20.096110 0.000000 udp 10.0.2.105 7010 -> 99.55.196.93 8046 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:27.749999 0.000000 udp 10.0.2.105 7010 -> 190.56.54.202 8575 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:36.321498 0.000000 udp 10.0.2.105 7010 -> 190.117.233.180 9732 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:41.819179 0.000000 udp 10.0.2.105 7010 -> 79.39.246.137 4859 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:46.414580 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:29:49.186418 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:29:55.657933 0.000000 udp 10.0.2.105 7010 -> 86.5.231.189 7490 INT 0 1 310 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:01.623242 0.021099 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 833 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:30:01.749870 0.000000 udp 10.0.2.105 7010 -> 2.113.199.233 1999 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:08.355793 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:13.095096 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:30:16.603848 0.000000 udp 10.0.2.105 7010 -> 79.5.41.32 2505 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:22.873298 0.000000 udp 10.0.2.105 7010 -> 93.33.254.80 2267 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:25.331588 2.955507 tcp 10.0.2.105 51192 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:30:28.336904 0.000000 udp 10.0.2.105 7010 -> 82.191.122.34 3179 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:34.214520 0.000000 tcp 10.0.2.105 51192 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:30:35.479779 0.000000 udp 10.0.2.105 7010 -> 82.43.189.207 4352 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:38.778015 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:30:40.153556 0.068508 tcp 10.0.2.105 51193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:40.222312 0.062553 tcp 10.0.2.105 51194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:40.285234 0.162912 tcp 10.0.2.105 51195 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:40.653718 2.957881 tcp 10.0.2.105 51196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:30:40.688433 0.076949 udp 10.0.2.105 7010 <-> 37.229.170.13 1760 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:30:40.836441 0.091995 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:30:41.182122 0.067874 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:30:41.360794 0.000000 udp 10.0.2.105 7010 -> 27.7.194.230 1092 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:49.539811 0.000000 tcp 10.0.2.105 51196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:30:50.511587 0.000000 udp 10.0.2.105 7010 -> 112.209.153.68 1038 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:30:56.112516 0.058845 tcp 10.0.2.105 51197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:56.171653 0.062499 tcp 10.0.2.105 51198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:56.234465 0.161993 tcp 10.0.2.105 51199 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:56.819619 0.370967 tcp 10.0.2.105 51200 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:30:58.690228 0.000000 udp 10.0.2.105 7010 -> 99.121.104.252 9848 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:02.513359 0.479923 tcp 10.0.2.105 51200 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:02.514215 0.060852 tcp 10.0.2.105 51201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:02.575334 0.061687 tcp 10.0.2.105 51202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:02.637333 0.150560 tcp 10.0.2.105 51203 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:02.993182 2.956582 tcp 10.0.2.105 51204 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:03.902947 0.000000 udp 10.0.2.105 7010 -> 79.33.152.161 2593 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:10.467611 0.209312 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:31:10.950439 0.000000 udp 10.0.2.105 7010 -> 129.49.145.228 3578 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:11.870353 0.000000 tcp 10.0.2.105 51204 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:17.799528 0.097920 tcp 10.0.2.105 51205 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:17.897739 0.065941 tcp 10.0.2.105 51206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:17.963939 0.165001 tcp 10.0.2.105 51207 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:18.453853 2.966737 tcp 10.0.2.105 51208 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:19.113627 0.142777 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 661 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:31:19.622401 0.000000 udp 10.0.2.105 7010 -> 186.26.159.184 1452 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:27.342275 0.000000 tcp 10.0.2.105 51208 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:27.878547 0.000000 udp 10.0.2.105 7010 -> 202.52.224.110 2859 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:32.966853 0.079568 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:31:33.239227 0.000000 udp 10.0.2.105 7010 -> 87.28.246.44 6821 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:33.273704 2.968734 tcp 10.0.2.105 51209 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:38.834363 0.000000 udp 10.0.2.105 7010 -> 180.49.143.149 3373 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:42.166636 0.000000 tcp 10.0.2.105 51209 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:43.631510 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:31:44.480656 0.071145 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:31:44.730531 0.000000 udp 10.0.2.105 7010 -> 105.225.49.132 1443 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:48.089775 0.378757 tcp 10.0.2.105 51210 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:53.094714 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:31:56.828416 0.000317 tcp 10.0.2.105 51210 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:31:56.829002 2.966178 tcp 10.0.2.105 51211 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:31:58.164028 0.000000 udp 10.0.2.105 7010 -> 189.238.51.123 9425 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:05.745509 0.000000 tcp 10.0.2.105 51211 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:32:06.196421 0.000000 udp 10.0.2.105 7010 -> 66.148.180.210 9002 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:14.227866 0.000000 udp 10.0.2.105 7010 -> 173.177.162.188 8919 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:20.306721 0.000000 udp 10.0.2.105 7010 -> 5.102.170.111 2158 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:24.882788 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:32:29.229472 0.000000 udp 10.0.2.105 7010 -> 181.65.5.242 9005 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:35.751887 3.001086 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:32:37.721665 0.000000 udp 10.0.2.105 7010 -> 88.246.184.60 7868 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:42.758816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:32:44.483508 0.000000 udp 10.0.2.105 7010 -> 69.89.210.145 3654 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:49.378201 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:32:50.762082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:32:50.882172 0.000000 udp 10.0.2.105 7010 -> 96.228.21.69 6148 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:32:56.167959 0.182482 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:32:56.410111 0.000000 udp 10.0.2.105 7010 -> 31.24.139.60 3949 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:03.012927 0.000000 udp 10.0.2.105 7010 -> 90.201.20.131 1162 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:06.762999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:33:11.731611 0.000000 udp 10.0.2.105 7010 -> 79.59.196.134 1990 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:16.377115 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:33:16.978162 0.157189 udp 10.0.2.105 7010 <-> 168.187.218.7 2151 CON 0 0 2 818 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:33:17.278315 0.000000 udp 10.0.2.105 7010 -> 64.42.66.154 6753 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:23.757811 0.000000 udp 10.0.2.105 7010 -> 70.247.187.225 1203 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:29.015387 0.000000 udp 10.0.2.105 7010 -> 174.48.133.58 5075 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:37.107118 0.106702 udp 10.0.2.105 7010 <-> 109.55.127.64 6459 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:33:37.223548 0.000000 udp 10.0.2.105 7010 -> 105.249.84.247 2352 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:38.776725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:33:41.882994 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:33:44.548952 0.000000 udp 10.0.2.105 7010 -> 85.154.9.20 7136 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:50.747553 0.150478 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 2 741 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:33:51.047840 0.000000 udp 10.0.2.105 7010 -> 91.97.239.211 9298 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:33:58.809843 0.000000 udp 10.0.2.105 7010 -> 84.106.31.149 5774 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:04.486025 0.000000 udp 10.0.2.105 7010 -> 94.82.164.227 9497 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:09.383227 0.049694 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:34:09.702186 0.825299 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:10.850553 0.077551 udp 10.0.2.105 7010 <-> 95.104.50.9 9760 CON 0 0 2 835 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:11.028426 0.000000 udp 10.0.2.105 7010 -> 114.26.40.110 2574 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:17.635261 0.283836 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:18.228723 0.037303 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:18.397703 0.000000 udp 10.0.2.105 7010 -> 139.190.111.62 8803 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:27.109053 0.049385 udp 10.0.2.105 7010 <-> 84.169.99.138 7604 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:27.331741 0.000000 udp 10.0.2.105 7010 -> 82.72.229.155 2429 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:33.808752 0.021758 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:34:33.974882 0.000000 udp 10.0.2.105 7010 -> 99.237.224.53 4244 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:38.384552 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:34:42.952082 0.000000 udp 10.0.2.105 7010 -> 86.143.82.49 8615 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:50.412830 0.000000 udp 10.0.2.105 7010 -> 77.85.88.103 5787 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:34:58.470000 0.000000 udp 10.0.2.105 7010 -> 190.113.215.120 7670 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:03.380845 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:35:05.414075 0.000000 udp 10.0.2.105 7010 -> 173.175.15.124 2181 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:13.485687 0.000000 udp 10.0.2.105 7010 -> 2.134.62.108 1877 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:19.143570 0.000000 udp 10.0.2.105 7010 -> 2.33.22.27 8122 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:26.654662 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:31.381203 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:35:33.244083 0.000000 udp 10.0.2.105 7010 -> 216.46.148.189 4364 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:40.704914 0.172913 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:35:41.226071 0.059376 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:35:41.548074 0.000000 udp 10.0.2.105 7010 -> 178.59.48.64 2255 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:46.562931 0.118536 udp 10.0.2.105 7010 <-> 158.148.149.61 9390 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:35:47.006917 0.000000 udp 10.0.2.105 7010 -> 190.119.22.15 9157 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:55.606226 0.291083 udp 10.0.2.105 7010 -> 187.75.61.202 1096 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:35:55.897309 0.000000 icmp 187.75.61.202 0x0303 -> 10.0.2.105 0x4804 URP 192 1 302 flow=Background 1970/02/16 08:36:00.382788 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:36:03.457634 0.000000 udp 10.0.2.105 7010 -> 188.14.0.65 6176 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:36:11.238718 0.142692 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:36:11.675644 0.000000 udp 10.0.2.105 7010 -> 2.234.31.69 2531 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:36:18.238843 0.000000 udp 10.0.2.105 7010 -> 93.71.35.21 2422 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 08:36:24.277417 0.066330 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/16 08:36:28.883734 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:37:11.746141 3.004923 tcp 10.0.2.105 51212 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:37:16.381908 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:37:20.748593 0.000000 tcp 10.0.2.105 51212 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:37:26.748645 0.065071 tcp 10.0.2.105 51213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:26.813982 0.065201 tcp 10.0.2.105 51214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:26.879514 0.165481 tcp 10.0.2.105 51215 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:27.514459 3.007984 tcp 10.0.2.105 51216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:37:36.520857 0.000000 tcp 10.0.2.105 51216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:37:42.510315 0.063038 tcp 10.0.2.105 51217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:42.573643 0.065241 tcp 10.0.2.105 51218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:42.639182 0.166967 tcp 10.0.2.105 51219 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:42.925386 3.518062 tcp 10.0.2.105 51220 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:45.786254 0.059914 tcp 10.0.2.105 51221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:45.846524 0.065192 tcp 10.0.2.105 51222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:45.911972 0.159917 tcp 10.0.2.105 51223 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:37:46.443812 3.005944 tcp 10.0.2.105 51224 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:37:55.448456 0.000000 tcp 10.0.2.105 51224 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:01.437599 0.126771 tcp 10.0.2.105 51225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:38:01.564676 0.066206 tcp 10.0.2.105 51226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:38:01.631204 0.159416 tcp 10.0.2.105 51227 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:38:01.858876 3.002798 tcp 10.0.2.105 51228 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:10.860651 0.000000 tcp 10.0.2.105 51228 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:16.860982 3.002183 tcp 10.0.2.105 51229 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:25.871513 0.000000 tcp 10.0.2.105 51229 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:30.378689 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:38:31.860964 0.373183 tcp 10.0.2.105 51230 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:38:38.808700 0.000412 tcp 10.0.2.105 51230 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:38:38.809345 2.995424 tcp 10.0.2.105 51231 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:38:47.803515 0.000000 tcp 10.0.2.105 51231 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:39:42.777324 3.003783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:39:49.784071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:39:57.784531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:40:13.787267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:40:45.793231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:43:53.804011 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:43:53.804165 3.003497 tcp 10.0.2.105 51232 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:02.806305 0.000000 tcp 10.0.2.105 51232 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:08.806856 0.062528 tcp 10.0.2.105 51233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:08.869651 0.062125 tcp 10.0.2.105 51234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:08.932059 0.157088 tcp 10.0.2.105 51235 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:09.623133 3.007631 tcp 10.0.2.105 51236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:18.629214 0.000000 tcp 10.0.2.105 51236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:24.618369 0.069141 tcp 10.0.2.105 51237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:24.687756 0.067496 tcp 10.0.2.105 51238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:24.755514 0.154235 tcp 10.0.2.105 51239 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:25.102004 0.371273 tcp 10.0.2.105 51240 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:34.667717 0.458732 tcp 10.0.2.105 51240 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:34.668497 0.063671 tcp 10.0.2.105 51241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:34.732601 0.068503 tcp 10.0.2.105 51242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:34.801394 0.169885 tcp 10.0.2.105 51243 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:35.126599 3.000620 tcp 10.0.2.105 51244 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:44.125947 0.000000 tcp 10.0.2.105 51244 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:50.124833 0.061433 tcp 10.0.2.105 51245 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:50.186593 0.063209 tcp 10.0.2.105 51246 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:50.250050 0.158543 tcp 10.0.2.105 51247 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:44:50.739030 3.000507 tcp 10.0.2.105 51248 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:44:59.738554 0.000000 tcp 10.0.2.105 51248 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:45:05.739653 3.722985 tcp 10.0.2.105 51249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:45:15.389898 0.000000 tcp 10.0.2.105 51249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:45:19.972346 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:45:21.331281 0.377894 tcp 10.0.2.105 51250 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:45:26.357843 0.000343 tcp 10.0.2.105 51250 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:45:26.358463 2.968292 tcp 10.0.2.105 51251 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:45:35.253332 0.000000 tcp 10.0.2.105 51251 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:46:49.798490 3.002453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:46:56.806346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:47:04.807900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:47:20.811103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:47:52.827089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:50:40.841001 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:50:40.841106 3.001876 tcp 10.0.2.105 51252 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:50:49.851530 0.000000 tcp 10.0.2.105 51252 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:50:55.842077 0.061253 tcp 10.0.2.105 51253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:50:55.903599 0.068440 tcp 10.0.2.105 51254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:50:55.972536 0.153527 tcp 10.0.2.105 51255 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:50:56.227839 2.997236 tcp 10.0.2.105 51256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:05.223679 0.000000 tcp 10.0.2.105 51256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:11.222877 0.060047 tcp 10.0.2.105 51257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:11.283233 0.933992 tcp 10.0.2.105 51258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:12.217576 0.165850 tcp 10.0.2.105 51259 -> 195.113.214.249 443 SRPA* 0 0 29 14130 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:13.012916 0.370485 tcp 10.0.2.105 51260 -> 46.48.223.67 15494 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:20.640548 0.654002 tcp 10.0.2.105 51260 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:20.641305 0.065515 tcp 10.0.2.105 51261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:20.707100 0.069312 tcp 10.0.2.105 51262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:20.776711 0.153351 tcp 10.0.2.105 51263 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:21.294792 3.006530 tcp 10.0.2.105 51264 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:30.299844 0.000000 tcp 10.0.2.105 51264 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:36.289368 0.062734 tcp 10.0.2.105 51265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:36.352512 0.063843 tcp 10.0.2.105 51266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:36.416697 0.164871 tcp 10.0.2.105 51267 -> 195.113.214.249 443 SRPA* 0 0 41 22400 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:51:36.970284 2.993223 tcp 10.0.2.105 51268 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:45.972640 0.000000 tcp 10.0.2.105 51268 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:51:51.972849 2.991900 tcp 10.0.2.105 51269 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:52:00.964067 0.000000 tcp 10.0.2.105 51269 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:52:05.880996 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 08:52:06.972726 0.374659 tcp 10.0.2.105 51270 -> 46.48.223.67 15494 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:52:16.390579 0.000334 tcp 10.0.2.105 51270 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 08:52:16.391085 3.002324 tcp 10.0.2.105 51271 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:52:25.388946 0.000000 tcp 10.0.2.105 51271 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 08:53:56.836062 2.998111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 08:54:03.840463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:54:11.842050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:54:27.845081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 08:54:59.851217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:01:03.856906 3.002091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 09:01:10.864640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:01:18.865464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:01:34.868833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:02:06.874469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:06:38.307120 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:06:38.307261 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:06:56.146551 0.065354 tcp 10.0.2.105 51272 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:06:56.212353 0.064894 tcp 10.0.2.105 51273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:06:56.278016 0.161360 tcp 10.0.2.105 51274 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:06:56.440097 0.189983 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2542 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:06:56.599307 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:07:01.448991 3.314686 tcp 10.0.2.105 51275 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:07:10.722992 0.000000 tcp 10.0.2.105 51275 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:07:13.438460 0.062007 tcp 10.0.2.105 51276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:13.500753 0.061294 tcp 10.0.2.105 51277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:13.562328 0.153803 tcp 10.0.2.105 51278 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:13.716746 0.173754 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:13.882679 0.359653 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:14.214262 0.123143 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2046 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:14.401877 0.183075 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:14.563056 0.173456 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:14.733934 0.133369 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:15.435902 0.170131 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:15.584681 0.154624 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:15.841146 0.060082 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:15.900045 0.171726 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:16.111796 0.176823 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:16.283564 0.359018 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:16.665032 0.060696 tcp 10.0.2.105 51279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:16.725976 0.070522 tcp 10.0.2.105 51280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:16.796923 0.194991 tcp 10.0.2.105 51281 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:16.993052 0.090990 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:17.046605 0.192653 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:17.298149 2.976106 tcp 10.0.2.105 51282 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:07:17.819400 0.183219 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:17.997863 0.445357 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:18.422546 0.203829 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:18.754252 0.166133 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:18.994002 0.071385 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:19.124889 0.177101 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:19.279519 0.243329 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:19.505446 0.283800 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:19.893031 0.184428 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.070787 0.240862 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.290124 0.022186 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.338506 0.069904 udp 10.0.2.105 7010 <-> 37.229.170.13 1760 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.437022 0.084060 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.498838 0.131029 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.614142 0.222627 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.833415 0.189033 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:20.961285 0.077593 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:21.040432 0.097647 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:21.121868 0.190096 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:21.305161 0.154316 udp 10.0.2.105 7010 <-> 168.187.218.7 2151 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:21.619096 0.000000 udp 10.0.2.105 7010 -> 109.55.127.64 6459 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:07:26.226249 0.000000 tcp 10.0.2.105 51282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:07:37.877161 0.066461 tcp 10.0.2.105 51283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:37.943920 0.063585 tcp 10.0.2.105 51284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:38.007836 0.156204 tcp 10.0.2.105 51285 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:38.164708 0.166948 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 1958 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:38.388465 0.193807 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:38.576248 0.071619 udp 10.0.2.105 7010 <-> 95.104.50.9 9760 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:38.664323 0.290479 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:38.945936 0.050791 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:39.005962 0.000000 udp 10.0.2.105 7010 -> 84.169.99.138 7604 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:07:55.987454 0.065810 tcp 10.0.2.105 51286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:56.053638 0.068760 tcp 10.0.2.105 51287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:56.122705 0.186924 tcp 10.0.2.105 51288 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:07:56.310166 0.030094 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:56.336001 0.122440 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:56.421845 0.064020 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:07:56.486840 0.000000 udp 10.0.2.105 7010 -> 158.148.149.61 9390 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:08:10.881230 3.001035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:08:12.922324 0.110487 tcp 10.0.2.105 51289 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:08:13.033132 0.073482 tcp 10.0.2.105 51290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:08:13.106860 0.174361 tcp 10.0.2.105 51291 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:08:13.281877 0.122136 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2018 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:08:13.398289 0.082770 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:08:17.888783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:08:25.889807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:08:41.893027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:09:13.899051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:12:32.104688 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:12:32.104869 3.003257 tcp 10.0.2.105 51292 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:12:41.107052 0.000000 tcp 10.0.2.105 51292 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:12:47.107123 0.067221 tcp 10.0.2.105 51293 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:12:47.174580 0.064614 tcp 10.0.2.105 51294 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:12:47.239497 0.159558 tcp 10.0.2.105 51295 -> 195.113.214.249 443 SRPA* 0 0 41 22670 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:12:47.414347 3.005983 tcp 10.0.2.105 51296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:12:56.419114 0.000000 tcp 10.0.2.105 51296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:02.408020 0.065735 tcp 10.0.2.105 51297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:02.474015 0.061242 tcp 10.0.2.105 51298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:02.535551 0.163953 tcp 10.0.2.105 51299 -> 195.113.214.249 443 SRPA* 0 0 28 14872 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:03.414347 3.105735 tcp 10.0.2.105 51300 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:06.211994 0.063713 tcp 10.0.2.105 51301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:06.276027 0.064794 tcp 10.0.2.105 51302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:06.341175 0.169341 tcp 10.0.2.105 51303 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:06.520490 2.997478 tcp 10.0.2.105 51304 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:15.516709 0.000000 tcp 10.0.2.105 51304 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:21.515409 0.066564 tcp 10.0.2.105 51305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:21.582285 0.064255 tcp 10.0.2.105 51306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:21.646839 0.153743 tcp 10.0.2.105 51307 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:21.822831 2.997002 tcp 10.0.2.105 51308 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:30.818498 0.000000 tcp 10.0.2.105 51308 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:36.817367 3.003963 tcp 10.0.2.105 51309 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:45.819937 0.000000 tcp 10.0.2.105 51309 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:13:50.376112 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:13:51.819116 3.073944 tcp 10.0.2.105 51310 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:13:54.893285 3.003852 tcp 10.0.2.105 51311 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:14:03.895458 0.000000 tcp 10.0.2.105 51311 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:15:17.905106 3.001145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:15:24.912672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:15:32.913891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:15:48.916935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:16:20.926849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:19:09.896547 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:19:09.896641 3.005957 tcp 10.0.2.105 51312 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:18.898604 0.000000 tcp 10.0.2.105 51312 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:24.898791 0.187230 tcp 10.0.2.105 51313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:25.086295 0.128795 tcp 10.0.2.105 51314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:25.215375 0.162011 tcp 10.0.2.105 51315 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:25.491786 3.007012 tcp 10.0.2.105 51316 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:34.493164 0.000000 tcp 10.0.2.105 51316 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:40.490792 0.066493 tcp 10.0.2.105 51317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:40.557611 0.069890 tcp 10.0.2.105 51318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:40.627859 0.166259 tcp 10.0.2.105 51319 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:40.855814 3.875151 tcp 10.0.2.105 51320 -> 46.48.223.67 15494 FSPA* 0 0 14 1758 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:44.386427 0.063508 tcp 10.0.2.105 51321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:44.450215 0.072693 tcp 10.0.2.105 51322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:44.523179 0.156821 tcp 10.0.2.105 51323 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:44.731181 2.999019 tcp 10.0.2.105 51324 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:53.729041 0.000000 tcp 10.0.2.105 51324 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:19:59.728437 0.060961 tcp 10.0.2.105 51325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:59.789812 0.061426 tcp 10.0.2.105 51326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:19:59.851563 0.168804 tcp 10.0.2.105 51327 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:20:00.067399 3.004327 tcp 10.0.2.105 51328 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:20:09.070776 0.000000 tcp 10.0.2.105 51328 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:20:15.059772 2.997126 tcp 10.0.2.105 51329 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:20:24.062691 0.000000 tcp 10.0.2.105 51329 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:20:28.879417 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:20:30.061330 2.908391 tcp 10.0.2.105 51330 -> 46.48.223.67 15494 FSPA* 0 0 14 1758 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:20:32.969937 3.000903 tcp 10.0.2.105 51331 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:20:41.968443 0.000000 tcp 10.0.2.105 51331 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:22:24.928897 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:22:31.936487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:22:39.939439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:22:55.943265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:23:27.946549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:25:47.969205 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:25:47.969394 3.003220 tcp 10.0.2.105 51332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:25:56.973790 0.000000 tcp 10.0.2.105 51332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:02.971591 0.063218 tcp 10.0.2.105 51333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:03.035177 0.069137 tcp 10.0.2.105 51334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:03.104615 0.159782 tcp 10.0.2.105 51335 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:03.481880 2.992947 tcp 10.0.2.105 51336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:12.473263 0.000000 tcp 10.0.2.105 51336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:18.482693 0.066421 tcp 10.0.2.105 51337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:18.549511 0.065554 tcp 10.0.2.105 51338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:18.615443 0.167800 tcp 10.0.2.105 51339 -> 195.113.214.249 443 SRPA* 0 0 41 20812 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:18.884142 4.026260 tcp 10.0.2.105 51340 -> 46.48.223.67 15494 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:22.301549 0.061742 tcp 10.0.2.105 51341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:22.363580 0.065536 tcp 10.0.2.105 51342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:22.429456 0.158182 tcp 10.0.2.105 51343 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:22.910273 3.004874 tcp 10.0.2.105 51344 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:31.920990 0.000000 tcp 10.0.2.105 51344 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:37.910839 0.061545 tcp 10.0.2.105 51345 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:37.972080 0.065116 tcp 10.0.2.105 51346 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:38.037545 0.152512 tcp 10.0.2.105 51347 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:26:38.308892 2.996222 tcp 10.0.2.105 51348 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:47.303596 0.000000 tcp 10.0.2.105 51348 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:26:53.302905 2.993712 tcp 10.0.2.105 51349 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:27:02.295230 0.000000 tcp 10.0.2.105 51349 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:27:06.881677 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:27:08.303876 2.885412 tcp 10.0.2.105 51350 -> 46.48.223.67 15494 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:27:11.189592 3.002096 tcp 10.0.2.105 51351 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:27:20.190814 0.000000 tcp 10.0.2.105 51351 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:29:31.952883 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:29:38.960684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:29:46.965017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:30:02.964277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:30:34.971095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:32:26.191346 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:32:26.191442 2.993662 tcp 10.0.2.105 51352 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:32:35.183544 0.000000 tcp 10.0.2.105 51352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:32:41.194380 0.071056 tcp 10.0.2.105 51353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:41.265732 0.069645 tcp 10.0.2.105 51354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:41.335638 0.190045 tcp 10.0.2.105 51355 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:41.586460 3.002565 tcp 10.0.2.105 51356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:32:50.586066 0.000000 tcp 10.0.2.105 51356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:32:56.585290 0.061523 tcp 10.0.2.105 51357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:56.647078 0.068176 tcp 10.0.2.105 51358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:56.715518 0.298947 tcp 10.0.2.105 51359 -> 195.113.214.249 443 SRPA* 0 0 74 79106 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:32:57.187528 3.814996 tcp 10.0.2.105 51360 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:00.452377 0.063733 tcp 10.0.2.105 51361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:00.516439 0.061336 tcp 10.0.2.105 51362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:00.578058 0.164068 tcp 10.0.2.105 51363 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:01.002802 2.992237 tcp 10.0.2.105 51364 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:09.993615 0.000000 tcp 10.0.2.105 51364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:16.003332 0.064512 tcp 10.0.2.105 51365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:16.068100 0.065594 tcp 10.0.2.105 51366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:16.134024 0.152096 tcp 10.0.2.105 51367 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:16.679670 2.998021 tcp 10.0.2.105 51368 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:25.676870 0.000000 tcp 10.0.2.105 51368 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:31.675122 3.004193 tcp 10.0.2.105 51369 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:40.677983 0.000000 tcp 10.0.2.105 51369 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:45.384676 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:33:46.676969 2.766793 tcp 10.0.2.105 51370 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:33:49.443963 3.000975 tcp 10.0.2.105 51371 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:33:58.445024 0.000000 tcp 10.0.2.105 51371 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:36:38.976470 3.002322 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:36:45.984262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:36:53.985740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:37:09.988980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:37:41.994890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:38:35.431922 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:38:35.432082 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:38:51.726419 0.063035 tcp 10.0.2.105 51372 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:38:51.789707 0.063785 tcp 10.0.2.105 51373 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:38:51.853787 0.156021 tcp 10.0.2.105 51374 -> 195.113.214.249 443 SRPA* 0 0 41 24056 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:38:52.010052 0.221660 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:38:52.223221 0.000000 udp 10.0.2.105 7010 -> 109.55.127.64 6459 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:39:04.443517 3.004257 tcp 10.0.2.105 51375 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:39:07.278099 0.064802 tcp 10.0.2.105 51376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:07.343204 0.068244 tcp 10.0.2.105 51377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:07.411751 0.168766 tcp 10.0.2.105 51378 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:07.581168 0.054501 udp 10.0.2.105 7010 <-> 84.169.99.138 7604 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:07.628202 0.000000 udp 10.0.2.105 7010 -> 158.148.149.61 9390 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 09:39:13.446736 0.000000 tcp 10.0.2.105 51375 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:39:19.445720 0.068123 tcp 10.0.2.105 51379 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:19.514091 0.158074 tcp 10.0.2.105 51380 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:19.672640 0.163574 tcp 10.0.2.105 51381 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:20.143796 3.006791 tcp 10.0.2.105 51382 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:39:23.081027 0.068503 tcp 10.0.2.105 51383 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:23.149813 0.064132 tcp 10.0.2.105 51384 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:23.214275 0.162607 tcp 10.0.2.105 51385 -> 195.113.214.249 443 SRPA* 0 0 41 22632 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:39:23.377567 0.187378 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:23.536640 0.173913 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:23.848436 0.360821 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:24.184769 0.184673 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:24.509528 0.173577 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:24.679953 0.124974 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:24.786730 0.116864 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:24.870307 0.174802 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:25.294409 0.156520 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:25.499959 0.168906 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:25.816345 0.059340 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.034768 0.176990 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.216949 0.101971 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.281211 0.350155 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.627530 0.189142 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.812780 0.180836 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:26.988696 0.202704 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:27.195181 0.444792 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:27.619271 0.174545 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:27.872602 0.167468 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:28.235622 0.074949 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:28.409810 0.239847 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:28.642272 0.184612 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:28.819303 0.285473 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:29.149158 0.000000 tcp 10.0.2.105 51382 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:39:29.260621 0.132208 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:29.345047 0.220350 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:29.802199 0.237840 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.162694 0.073295 udp 10.0.2.105 7010 <-> 37.229.170.13 1760 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.356955 0.022367 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.393376 0.084233 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.456314 0.091967 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.593821 0.071691 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.794076 0.163502 udp 10.0.2.105 7010 <-> 168.187.218.7 2151 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:30.975114 0.198275 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:31.112686 0.192913 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:31.298770 0.194261 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:31.484726 0.168162 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:31.876498 0.074473 udp 10.0.2.105 7010 <-> 95.104.50.9 9760 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.046832 0.051359 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.082915 0.291358 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.432419 0.062812 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.493989 0.135220 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.875107 0.027700 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:32.922290 0.116302 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2632 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:39:33.028497 0.102678 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/16 09:43:46.001188 3.001404 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:43:53.008614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:44:01.010000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:44:17.012690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:44:35.139538 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:44:35.139720 2.993019 tcp 10.0.2.105 51386 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:44:44.145495 0.000000 tcp 10.0.2.105 51386 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:44:49.022730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:44:50.144457 0.062900 tcp 10.0.2.105 51387 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:44:50.207636 0.060465 tcp 10.0.2.105 51388 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:44:50.268428 0.157414 tcp 10.0.2.105 51389 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:44:50.718606 2.996533 tcp 10.0.2.105 51390 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:44:59.714113 0.000000 tcp 10.0.2.105 51390 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:05.713148 0.061074 tcp 10.0.2.105 51391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:05.774518 0.063233 tcp 10.0.2.105 51392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:05.838048 0.156945 tcp 10.0.2.105 51393 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:06.339184 0.344480 tcp 10.0.2.105 51394 -> 46.48.223.67 15494 SPA_* 0 0 9 1200 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:12.189733 0.673007 tcp 10.0.2.105 51394 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:12.190480 0.063487 tcp 10.0.2.105 51395 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:12.254267 0.069170 tcp 10.0.2.105 51396 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:12.323710 0.170109 tcp 10.0.2.105 51397 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:12.862926 3.005574 tcp 10.0.2.105 51398 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:21.866146 0.000000 tcp 10.0.2.105 51398 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:27.865320 0.066002 tcp 10.0.2.105 51399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:27.931642 0.066417 tcp 10.0.2.105 51400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:27.998336 0.155116 tcp 10.0.2.105 51401 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:45:28.271105 2.998587 tcp 10.0.2.105 51402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:37.273019 0.000000 tcp 10.0.2.105 51402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:43.267216 3.008094 tcp 10.0.2.105 51403 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:52.269629 0.000000 tcp 10.0.2.105 51403 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:45:56.876441 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:45:58.268979 2.718019 tcp 10.0.2.105 51404 -> 46.48.223.67 15494 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:46:00.987213 2.999688 tcp 10.0.2.105 51405 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:46:09.985040 0.000000 tcp 10.0.2.105 51405 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:51:15.985932 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:51:15.986118 3.003629 tcp 10.0.2.105 51406 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:51:24.988072 0.000000 tcp 10.0.2.105 51406 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:51:30.987957 0.070363 tcp 10.0.2.105 51407 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:31.058671 0.062351 tcp 10.0.2.105 51408 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:31.121336 0.166731 tcp 10.0.2.105 51409 -> 195.113.214.249 443 SRPA* 0 0 52 37564 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:31.796087 3.006115 tcp 10.0.2.105 51410 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:51:40.800843 0.000000 tcp 10.0.2.105 51410 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:51:46.790478 0.061381 tcp 10.0.2.105 51411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:46.852116 0.066194 tcp 10.0.2.105 51412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:46.918623 0.153030 tcp 10.0.2.105 51413 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:47.432993 3.774808 tcp 10.0.2.105 51414 -> 46.48.223.67 15494 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:50.732159 0.063852 tcp 10.0.2.105 51415 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:50.796313 0.065964 tcp 10.0.2.105 51416 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:50.862545 0.160183 tcp 10.0.2.105 51417 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:51:51.208104 2.980144 tcp 10.0.2.105 51418 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:00.136562 0.000000 tcp 10.0.2.105 51418 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:06.087957 0.063161 tcp 10.0.2.105 51419 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:52:06.150989 0.061685 tcp 10.0.2.105 51420 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:52:06.212953 0.167381 tcp 10.0.2.105 51421 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:52:06.825388 3.007322 tcp 10.0.2.105 51422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:15.831877 0.000000 tcp 10.0.2.105 51422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:21.820423 2.993608 tcp 10.0.2.105 51423 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:30.822701 0.000000 tcp 10.0.2.105 51423 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:35.379261 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:52:36.821477 2.653639 tcp 10.0.2.105 51424 -> 46.48.223.67 15494 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:52:39.475424 3.004189 tcp 10.0.2.105 51425 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:52:48.477991 0.000000 tcp 10.0.2.105 51425 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:56:01.027775 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 09:56:08.034836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:56:16.036583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:56:32.041043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:57:04.045798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 09:57:54.478633 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:57:54.478823 3.003650 tcp 10.0.2.105 51426 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:03.481195 0.000000 tcp 10.0.2.105 51426 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:09.851107 0.069039 tcp 10.0.2.105 51427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:09.920412 0.066141 tcp 10.0.2.105 51428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:09.986897 0.173047 tcp 10.0.2.105 51429 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:10.430575 2.966553 tcp 10.0.2.105 51430 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:19.339841 0.000000 tcp 10.0.2.105 51430 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:25.281945 0.061447 tcp 10.0.2.105 51431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:25.343701 0.063633 tcp 10.0.2.105 51432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:25.407604 0.155185 tcp 10.0.2.105 51433 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:25.650306 4.250505 tcp 10.0.2.105 51434 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:28.846367 0.061150 tcp 10.0.2.105 51435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:28.907807 0.068989 tcp 10.0.2.105 51436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:28.977050 0.194401 tcp 10.0.2.105 51437 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:29.901065 2.969467 tcp 10.0.2.105 51438 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:38.821955 0.000000 tcp 10.0.2.105 51438 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:44.753652 0.061109 tcp 10.0.2.105 51439 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:44.815123 0.061693 tcp 10.0.2.105 51440 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:44.877063 0.177249 tcp 10.0.2.105 51441 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:58:45.257910 2.967238 tcp 10.0.2.105 51442 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:58:54.223960 0.000000 tcp 10.0.2.105 51442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:59:00.222971 3.004156 tcp 10.0.2.105 51443 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:59:09.225642 0.000000 tcp 10.0.2.105 51443 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:59:13.882557 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 09:59:15.223964 2.622374 tcp 10.0.2.105 51444 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 09:59:17.846493 3.005940 tcp 10.0.2.105 51445 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 09:59:26.850791 0.000000 tcp 10.0.2.105 51445 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:03:08.054081 2.999012 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:03:15.059070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:03:23.060857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:03:39.063115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:04:11.069659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:04:32.841533 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:04:32.841704 2.996302 tcp 10.0.2.105 51446 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:04:41.833831 0.000000 tcp 10.0.2.105 51446 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:04:47.844768 0.060781 tcp 10.0.2.105 51447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:04:47.905856 0.060984 tcp 10.0.2.105 51448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:04:47.967235 0.159496 tcp 10.0.2.105 51449 -> 195.113.214.249 443 SRPA* 0 0 42 22890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:04:48.201950 2.997741 tcp 10.0.2.105 51450 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:04:57.196062 0.000000 tcp 10.0.2.105 51450 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:03.197560 0.063158 tcp 10.0.2.105 51451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:03.261031 0.065823 tcp 10.0.2.105 51452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:03.327168 0.162062 tcp 10.0.2.105 51453 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:03.584960 3.737453 tcp 10.0.2.105 51454 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:06.829149 0.062120 tcp 10.0.2.105 51455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:06.891584 0.060542 tcp 10.0.2.105 51456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:06.952667 0.160592 tcp 10.0.2.105 51457 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:07.322665 2.991596 tcp 10.0.2.105 51458 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:16.313254 0.000000 tcp 10.0.2.105 51458 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:22.322700 0.062263 tcp 10.0.2.105 51459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:22.385270 0.065632 tcp 10.0.2.105 51460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:22.451190 0.161262 tcp 10.0.2.105 51461 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:22.624030 3.003813 tcp 10.0.2.105 51462 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:31.625312 0.000000 tcp 10.0.2.105 51462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:37.624378 3.003846 tcp 10.0.2.105 51463 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:46.626851 0.000000 tcp 10.0.2.105 51463 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:05:51.387963 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:05:52.626943 2.665469 tcp 10.0.2.105 51464 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:05:55.292664 2.990913 tcp 10.0.2.105 51465 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:06:04.292517 0.000000 tcp 10.0.2.105 51465 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:09:38.701089 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:09:38.701342 0.213799 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:38.908369 0.054853 udp 10.0.2.105 7010 <-> 84.169.99.138 7604 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:38.976493 0.188052 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:39.135972 0.173798 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:39.302187 0.357591 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:39.634627 0.180066 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:39.791791 0.173127 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:39.962040 0.123664 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.101252 0.110302 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.179947 0.175921 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.386164 0.153226 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.584896 0.170589 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.734465 0.059621 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:40.877876 0.352940 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:41.300249 0.193053 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:41.490769 0.182311 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:41.667989 0.177045 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:41.841445 0.089802 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:41.892966 0.178643 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:42.047396 0.202810 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:42.264777 0.449482 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:42.692839 0.169269 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:42.875496 0.073673 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:43.053269 0.237597 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:43.282374 0.188145 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:43.462555 0.282304 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:43.912551 0.236715 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.128710 0.172512 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.267324 0.213799 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.478009 0.068457 udp 10.0.2.105 7010 <-> 37.229.170.13 1760 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.547784 0.024204 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.581632 0.086057 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.647073 0.089806 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.720785 0.071177 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 1898 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:44.877583 0.158727 udp 10.0.2.105 7010 <-> 168.187.218.7 2151 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.045130 0.199562 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.184969 0.189424 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.367340 0.193133 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.554066 0.170460 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.703873 0.076143 udp 10.0.2.105 7010 <-> 95.104.50.9 9760 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.844837 0.051923 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.880787 0.117759 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:45.963295 0.021303 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:46.007375 0.119146 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:46.119406 0.290085 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:46.400147 0.067116 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:09:46.533623 0.085061 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:10:18.080678 3.001244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:10:25.087343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:10:33.088986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:10:49.091833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:11:10.293226 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:11:10.293336 3.003448 tcp 10.0.2.105 51466 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:11:19.295299 0.000000 tcp 10.0.2.105 51466 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:11:21.102722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:11:25.295357 0.066677 tcp 10.0.2.105 51467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:25.362276 0.060460 tcp 10.0.2.105 51468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:25.423020 0.158966 tcp 10.0.2.105 51469 -> 195.113.214.249 443 SRPA* 0 0 26 14162 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:25.860776 2.998311 tcp 10.0.2.105 51470 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:11:34.857625 0.000000 tcp 10.0.2.105 51470 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:11:40.856700 0.061696 tcp 10.0.2.105 51471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:40.918680 0.060793 tcp 10.0.2.105 51472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:40.979783 0.160963 tcp 10.0.2.105 51473 -> 195.113.214.249 443 SRPA* 0 0 30 14146 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:41.320168 3.757691 tcp 10.0.2.105 51474 -> 46.48.223.67 15494 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:44.610731 0.065350 tcp 10.0.2.105 51475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:44.676360 0.068181 tcp 10.0.2.105 51476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:44.744847 0.159873 tcp 10.0.2.105 51477 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:11:45.078132 3.000739 tcp 10.0.2.105 51478 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:11:54.074899 0.000000 tcp 10.0.2.105 51478 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:00.074402 0.066983 tcp 10.0.2.105 51479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:12:00.141653 0.061860 tcp 10.0.2.105 51480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:12:00.203896 0.166329 tcp 10.0.2.105 51481 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:12:00.438649 3.000063 tcp 10.0.2.105 51482 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:09.437538 0.000000 tcp 10.0.2.105 51482 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:15.436051 3.004202 tcp 10.0.2.105 51483 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:24.439012 0.000000 tcp 10.0.2.105 51483 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:29.376186 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:12:30.437667 2.609474 tcp 10.0.2.105 51484 -> 46.48.223.67 15494 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:12:33.046981 2.998870 tcp 10.0.2.105 51485 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:12:42.044212 0.000000 tcp 10.0.2.105 51485 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:17:25.104200 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:17:32.111235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:17:40.112859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:17:48.044690 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:17:48.044841 3.003829 tcp 10.0.2.105 51486 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:17:56.115437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:17:57.047271 0.000000 tcp 10.0.2.105 51486 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:03.047630 0.063646 tcp 10.0.2.105 51487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:03.111543 0.065367 tcp 10.0.2.105 51488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:03.177250 0.161374 tcp 10.0.2.105 51489 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:03.447586 3.003347 tcp 10.0.2.105 51490 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:12.449462 0.000000 tcp 10.0.2.105 51490 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:18.448854 0.067513 tcp 10.0.2.105 51491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:18.516609 0.070455 tcp 10.0.2.105 51492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:18.587325 0.169845 tcp 10.0.2.105 51493 -> 195.113.214.249 443 SRPA* 0 0 25 13004 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:18.769273 0.353350 tcp 10.0.2.105 51494 -> 46.48.223.67 15494 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:26.594350 0.416327 tcp 10.0.2.105 51494 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:26.595068 0.062602 tcp 10.0.2.105 51495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:26.657986 0.066041 tcp 10.0.2.105 51496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:26.724407 0.160050 tcp 10.0.2.105 51497 -> 195.113.214.249 443 SRPA* 0 0 41 21452 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:27.010968 2.993611 tcp 10.0.2.105 51498 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:28.124922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:18:36.003346 0.000000 tcp 10.0.2.105 51498 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:42.003946 0.066241 tcp 10.0.2.105 51499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:42.070476 0.062584 tcp 10.0.2.105 51500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:42.133530 0.173226 tcp 10.0.2.105 51501 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:18:42.642134 2.994902 tcp 10.0.2.105 51502 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:51.635596 0.000000 tcp 10.0.2.105 51502 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:18:57.635957 3.002852 tcp 10.0.2.105 51503 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:19:06.637185 0.000000 tcp 10.0.2.105 51503 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:19:11.384070 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:19:12.636310 2.270936 tcp 10.0.2.105 51504 -> 46.48.223.67 15494 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:19:14.907474 2.995981 tcp 10.0.2.105 51505 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:19:23.912106 0.000000 tcp 10.0.2.105 51505 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:24:29.902977 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:24:29.903173 2.992998 tcp 10.0.2.105 51506 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:24:32.128946 3.000563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:24:38.894529 0.000000 tcp 10.0.2.105 51506 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:24:39.134652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:24:44.905369 0.064459 tcp 10.0.2.105 51507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:24:44.970057 0.117629 tcp 10.0.2.105 51508 -> 195.113.214.249 80 SRPA* 0 0 25 13586 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:24:45.126576 3.001613 tcp 10.0.2.105 51509 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:24:47.136711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:24:54.126690 0.000000 tcp 10.0.2.105 51509 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:00.125989 0.064071 tcp 10.0.2.105 51510 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:00.189926 0.063704 tcp 10.0.2.105 51511 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:00.253942 0.152643 tcp 10.0.2.105 51512 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:00.694162 0.349562 tcp 10.0.2.105 51513 -> 46.48.223.67 15494 SPA_* 0 0 9 1056 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:03.140013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:25:06.103807 0.509158 tcp 10.0.2.105 51513 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:06.104759 0.064228 tcp 10.0.2.105 51514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:06.169316 0.070976 tcp 10.0.2.105 51515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:06.240606 0.166057 tcp 10.0.2.105 51516 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:06.613231 2.974284 tcp 10.0.2.105 51517 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:15.570204 0.000000 tcp 10.0.2.105 51517 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:21.500965 0.074255 tcp 10.0.2.105 51518 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:21.575467 0.067722 tcp 10.0.2.105 51519 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:21.643537 0.165946 tcp 10.0.2.105 51520 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:22.293050 2.979291 tcp 10.0.2.105 51521 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:31.212455 0.000000 tcp 10.0.2.105 51521 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:35.249627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:25:37.157993 2.966632 tcp 10.0.2.105 51522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:46.081462 0.000000 tcp 10.0.2.105 51522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:25:50.878714 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:25:52.080510 1.733139 tcp 10.0.2.105 51523 -> 46.48.223.67 15494 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:25:53.813804 3.003201 tcp 10.0.2.105 51524 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:26:02.820678 0.000000 tcp 10.0.2.105 51524 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:08.815880 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:31:08.815979 3.004126 tcp 10.0.2.105 51525 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:17.818582 0.000000 tcp 10.0.2.105 51525 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:23.819069 0.068035 tcp 10.0.2.105 51526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:23.887343 0.082659 tcp 10.0.2.105 51527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:23.970313 0.231051 tcp 10.0.2.105 51528 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:24.548890 3.003781 tcp 10.0.2.105 51529 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:33.551190 0.000000 tcp 10.0.2.105 51529 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:39.162523 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:31:39.550907 0.222766 tcp 10.0.2.105 51530 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:39.773993 0.066031 tcp 10.0.2.105 51531 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:39.840321 0.158404 tcp 10.0.2.105 51532 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:40.214139 2.269478 tcp 10.0.2.105 51533 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:41.927354 0.067178 tcp 10.0.2.105 51534 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:41.994846 0.066049 tcp 10.0.2.105 51535 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:42.061166 0.148685 tcp 10.0.2.105 51536 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:42.483823 3.004193 tcp 10.0.2.105 51537 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:46.169240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:31:51.486853 0.000000 tcp 10.0.2.105 51537 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:31:54.172796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:31:57.476112 0.067665 tcp 10.0.2.105 51538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:57.543950 0.065430 tcp 10.0.2.105 51539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:57.609635 0.153698 tcp 10.0.2.105 51540 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:31:57.952779 3.007177 tcp 10.0.2.105 51541 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:06.959187 0.000000 tcp 10.0.2.105 51541 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:10.173378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:32:12.948375 3.003744 tcp 10.0.2.105 51542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:21.950633 0.000000 tcp 10.0.2.105 51542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:26.877760 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:32:27.953366 1.738326 tcp 10.0.2.105 51543 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:32:29.691947 2.995439 tcp 10.0.2.105 51544 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:38.684571 0.000000 tcp 10.0.2.105 51544 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:32:42.179739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:38:46.185797 3.001711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 10:38:53.193323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:39:01.194229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:39:17.199134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:39:49.203888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:40:13.659546 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:40:13.659698 0.187054 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:13.816515 0.217451 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:14.373184 0.056934 udp 10.0.2.105 7010 <-> 84.169.99.138 7604 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:14.422182 0.183473 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:14.583161 0.175455 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:14.700995 2.993947 tcp 10.0.2.105 51545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:14.781299 0.124590 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:14.886898 0.175463 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:15.166220 0.354994 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:15.491247 0.112620 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:15.591435 0.177153 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:15.885751 0.153387 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:16.090787 0.168326 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:16.240186 0.057770 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:16.327994 0.350014 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.124541 0.190111 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.311244 0.181580 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.488484 0.177516 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.662966 0.084879 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.808458 0.179191 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:17.965797 0.166579 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:18.656306 0.084084 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:18.811742 0.203043 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:19.045130 0.448050 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:19.472026 0.237558 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:19.702840 0.187289 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:19.882539 0.280933 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:20.168418 0.248049 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:20.394041 0.000000 udp 10.0.2.105 7010 -> 37.229.170.13 1760 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 10:40:23.709593 0.000000 tcp 10.0.2.105 51545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:29.703575 0.063378 tcp 10.0.2.105 51546 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:29.767314 0.062346 tcp 10.0.2.105 51547 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:29.829906 0.159462 tcp 10.0.2.105 51548 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:30.189493 2.998420 tcp 10.0.2.105 51549 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:36.422139 0.060806 tcp 10.0.2.105 51550 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:36.483180 0.063041 tcp 10.0.2.105 51551 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:36.546596 0.238032 tcp 10.0.2.105 51552 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:36.785165 0.021254 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:37.112878 0.083560 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:37.368131 0.099423 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:37.449613 0.075094 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:37.841132 0.158198 udp 10.0.2.105 7010 <-> 168.187.218.7 2151 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.078668 0.132203 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.238509 0.212721 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 1902 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.456395 0.174795 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.577514 0.215187 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.783447 0.197696 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:38.994825 0.173109 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:39.168401 0.000000 udp 10.0.2.105 7010 -> 95.104.50.9 9760 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 10:40:39.185753 0.000000 tcp 10.0.2.105 51549 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:45.184896 0.065016 tcp 10.0.2.105 51553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:45.250274 0.066166 tcp 10.0.2.105 51554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:45.316732 0.150367 tcp 10.0.2.105 51555 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:45.555540 3.003423 tcp 10.0.2.105 51556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:55.055212 0.000000 tcp 10.0.2.105 51556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:40:58.513492 0.069650 tcp 10.0.2.105 51557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:58.583413 0.063620 tcp 10.0.2.105 51558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:58.647281 0.171715 tcp 10.0.2.105 51559 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:40:58.819561 0.051406 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:58.856271 0.133423 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:58.985669 0.026669 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 1980 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:59.027803 0.108663 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:59.128525 0.083870 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:59.517258 0.283412 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:40:59.799004 0.064226 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/16 10:41:00.992052 2.966771 tcp 10.0.2.105 51560 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:41:09.891212 0.000000 tcp 10.0.2.105 51560 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:45:53.209871 3.001583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:46:00.217409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:46:08.218212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:46:15.560155 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:46:15.560349 2.993239 tcp 10.0.2.105 51561 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:46:24.221787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:46:24.562095 0.000000 tcp 10.0.2.105 51561 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:46:30.563162 0.064038 tcp 10.0.2.105 51562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:30.627433 0.062406 tcp 10.0.2.105 51563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:30.690166 0.154775 tcp 10.0.2.105 51564 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:31.379325 2.997095 tcp 10.0.2.105 51565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:46:40.374379 0.000000 tcp 10.0.2.105 51565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:46:46.373897 0.061716 tcp 10.0.2.105 51566 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:46.435898 0.063631 tcp 10.0.2.105 51567 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:46.499812 0.165897 tcp 10.0.2.105 51568 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:46.860952 2.153019 tcp 10.0.2.105 51569 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:48.618947 0.064720 tcp 10.0.2.105 51570 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:48.683981 0.065446 tcp 10.0.2.105 51571 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:48.749697 0.167425 tcp 10.0.2.105 51572 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:46:49.014238 3.007353 tcp 10.0.2.105 51573 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:46:56.227705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:46:58.020632 0.000000 tcp 10.0.2.105 51573 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:04.009480 0.065095 tcp 10.0.2.105 51574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:47:04.074543 0.088144 tcp 10.0.2.105 51575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:47:04.162513 0.161520 tcp 10.0.2.105 51576 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:47:04.436234 2.987616 tcp 10.0.2.105 51577 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:13.432622 0.000000 tcp 10.0.2.105 51577 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:19.431400 2.994030 tcp 10.0.2.105 51578 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:28.429302 0.000000 tcp 10.0.2.105 51578 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:33.380989 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:47:34.434933 0.356050 tcp 10.0.2.105 51579 -> 46.48.223.67 15494 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:47:43.287154 0.000362 tcp 10.0.2.105 51579 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:47:43.287757 3.001965 tcp 10.0.2.105 51580 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:47:52.290613 0.000000 tcp 10.0.2.105 51580 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:52:58.289253 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:52:58.289343 3.010448 tcp 10.0.2.105 51581 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:00.234619 3.000367 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 10:53:07.243271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:53:07.293247 0.000000 tcp 10.0.2.105 51581 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:13.291849 0.063818 tcp 10.0.2.105 51582 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:13.355914 0.062138 tcp 10.0.2.105 51583 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:13.418326 0.177096 tcp 10.0.2.105 51584 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:13.813843 3.000441 tcp 10.0.2.105 51585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:15.242631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:53:22.813459 0.000000 tcp 10.0.2.105 51585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:28.812522 0.064613 tcp 10.0.2.105 51586 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:28.877453 0.068669 tcp 10.0.2.105 51587 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:28.946371 0.152214 tcp 10.0.2.105 51588 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:29.126208 2.164924 tcp 10.0.2.105 51589 -> 46.48.223.67 15494 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:30.856420 0.067490 tcp 10.0.2.105 51590 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:30.923836 0.063864 tcp 10.0.2.105 51591 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:30.988009 0.155917 tcp 10.0.2.105 51592 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:31.245929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:53:31.291395 2.998734 tcp 10.0.2.105 51593 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:40.288751 0.000000 tcp 10.0.2.105 51593 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:46.288079 0.070399 tcp 10.0.2.105 51594 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:46.358757 0.067563 tcp 10.0.2.105 51595 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:46.426609 0.153479 tcp 10.0.2.105 51596 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:53:46.770685 3.001550 tcp 10.0.2.105 51597 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:53:55.772900 0.000000 tcp 10.0.2.105 51597 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:54:01.771071 2.992816 tcp 10.0.2.105 51598 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:54:03.251596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 10:54:10.772505 0.000000 tcp 10.0.2.105 51598 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:54:15.379118 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:54:16.771509 1.742652 tcp 10.0.2.105 51599 -> 46.48.223.67 15494 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:54:18.514320 3.003521 tcp 10.0.2.105 51600 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:54:27.516777 0.000000 tcp 10.0.2.105 51600 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:59:33.517199 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 10:59:33.517362 3.003344 tcp 10.0.2.105 51601 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:59:42.519781 0.000000 tcp 10.0.2.105 51601 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:59:48.520161 0.061844 tcp 10.0.2.105 51602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:59:48.582327 0.129825 tcp 10.0.2.105 51603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:59:48.712525 0.158732 tcp 10.0.2.105 51604 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 10:59:48.882135 3.000577 tcp 10.0.2.105 51605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 10:59:57.891658 0.000000 tcp 10.0.2.105 51605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:03.880938 0.279670 tcp 10.0.2.105 51606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:04.160870 0.060976 tcp 10.0.2.105 51607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:04.222141 0.166797 tcp 10.0.2.105 51608 -> 195.113.214.249 443 SRPA* 0 0 40 20284 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:04.740666 2.493047 tcp 10.0.2.105 51609 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:06.470803 0.064710 tcp 10.0.2.105 51610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:06.535793 0.062432 tcp 10.0.2.105 51611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:06.598516 0.153764 tcp 10.0.2.105 51612 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:07.233960 2.978224 tcp 10.0.2.105 51613 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:07.426910 2.974198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:00:14.367762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:00:16.152314 0.000000 tcp 10.0.2.105 51613 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:22.081886 0.065014 tcp 10.0.2.105 51614 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:22.147230 0.063924 tcp 10.0.2.105 51615 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:22.211446 0.158717 tcp 10.0.2.105 51616 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:22.290386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:00:22.843404 2.988488 tcp 10.0.2.105 51617 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:31.830485 0.000000 tcp 10.0.2.105 51617 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:37.819186 2.993881 tcp 10.0.2.105 51618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:38.269927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:00:46.821982 0.000000 tcp 10.0.2.105 51618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:00:51.378759 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:00:52.820964 1.747528 tcp 10.0.2.105 51619 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:00:54.568418 2.998830 tcp 10.0.2.105 51620 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:01:03.566094 0.000000 tcp 10.0.2.105 51620 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:01:10.275740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:06:09.566518 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:06:09.566686 3.003845 tcp 10.0.2.105 51621 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:18.568975 0.000000 tcp 10.0.2.105 51621 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:24.569381 0.064089 tcp 10.0.2.105 51622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:24.633816 0.065070 tcp 10.0.2.105 51623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:24.699194 0.158305 tcp 10.0.2.105 51624 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:24.868084 3.004544 tcp 10.0.2.105 51625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:33.874814 0.000000 tcp 10.0.2.105 51625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:39.870236 0.065012 tcp 10.0.2.105 51626 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:39.935571 0.062025 tcp 10.0.2.105 51627 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:39.997907 0.169902 tcp 10.0.2.105 51628 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:40.258600 2.450237 tcp 10.0.2.105 51629 -> 46.48.223.67 15494 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:41.993125 0.066903 tcp 10.0.2.105 51630 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:42.060401 0.064882 tcp 10.0.2.105 51631 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:42.125587 0.175334 tcp 10.0.2.105 51632 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:06:42.709105 3.002246 tcp 10.0.2.105 51633 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:51.706299 0.000000 tcp 10.0.2.105 51633 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:06:57.705745 3.005849 tcp 10.0.2.105 51634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:07:06.709868 0.000000 tcp 10.0.2.105 51634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:07:11.374277 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:07:12.707116 1.716025 tcp 10.0.2.105 51635 -> 46.48.223.67 15494 FSPA* 0 0 14 1586 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:07:19.288857 3.237633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:07:26.501615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:07:34.436329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:07:50.310858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:08:22.318820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:11:23.548186 0.000242 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:11:23.548519 0.000000 udp 10.0.2.105 7010 -> 37.229.170.13 1760 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:11:39.301959 0.064609 tcp 10.0.2.105 51636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:39.366918 0.067538 tcp 10.0.2.105 51637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:39.434769 0.158182 tcp 10.0.2.105 51638 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:39.593533 0.000000 udp 10.0.2.105 7010 -> 95.104.50.9 9760 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:11:55.443846 0.061654 tcp 10.0.2.105 51639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:55.505791 0.064697 tcp 10.0.2.105 51640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:55.570338 0.163645 tcp 10.0.2.105 51641 -> 195.113.214.249 443 SRPA* 0 0 35 29210 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:11:55.734588 0.188555 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:11:55.894633 0.185266 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:11:56.057619 0.173882 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:11:56.228443 0.123760 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:11:56.333650 0.172691 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:11:56.500785 0.000000 udp 10.0.2.105 7010 -> 84.169.99.138 7604 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:12:13.209571 0.060542 tcp 10.0.2.105 51642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:13.270429 0.063334 tcp 10.0.2.105 51643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:13.334163 0.160644 tcp 10.0.2.105 51644 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:13.494516 0.212021 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:13.699860 0.175118 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:13.851578 0.153563 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:14.089432 0.116293 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:14.171782 0.353503 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:14.421202 2.994928 tcp 10.0.2.105 51645 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:12:14.496065 0.169549 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:14.870736 0.352465 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.219107 0.058706 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.275768 0.182571 udp 10.0.2.105 7010 <-> 76.71.128.82 7549 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.435201 0.177177 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.608499 0.182061 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.785693 0.187613 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:15.970471 0.083198 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:16.102864 0.200044 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:16.468832 0.168538 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:16.820850 0.057474 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:17.111826 0.182193 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:17.285612 0.236473 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:17.634924 0.558274 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:18.170921 0.274049 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:18.494439 0.247698 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:18.720808 0.021978 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:19.057174 0.000000 udp 10.0.2.105 7010 -> 168.187.218.7 2151 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:12:23.412895 0.000000 tcp 10.0.2.105 51645 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:12:29.422715 0.064711 tcp 10.0.2.105 51646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:29.487721 0.069283 tcp 10.0.2.105 51647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:29.557286 0.158179 tcp 10.0.2.105 51648 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:29.960217 2.997243 tcp 10.0.2.105 51649 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:12:36.283030 0.067730 tcp 10.0.2.105 51650 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:36.350638 0.064839 tcp 10.0.2.105 51651 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:36.415820 0.151022 tcp 10.0.2.105 51652 -> 195.113.214.249 443 SRPA* 0 0 27 11834 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:36.566433 0.082621 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:36.627341 0.090350 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:36.999090 0.062575 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:37.163141 0.130250 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:37.246451 0.205989 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:37.593689 0.189000 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:37.775091 0.193448 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:37.962207 0.169633 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.294175 0.214175 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.504456 0.022938 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.654429 0.110303 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.756027 0.085470 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.865006 0.050564 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.900942 0.122217 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:38.955847 0.000000 tcp 10.0.2.105 51649 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:12:39.063259 0.305944 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:39.360028 0.058406 udp 10.0.2.105 7010 <-> 95.104.76.77 6527 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:12:44.954790 0.060993 tcp 10.0.2.105 51653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:45.015718 0.064142 tcp 10.0.2.105 51654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:45.080145 0.160132 tcp 10.0.2.105 51655 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:12:45.416324 3.003009 tcp 10.0.2.105 51656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:12:54.418277 0.000000 tcp 10.0.2.105 51656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:13:00.416832 3.004019 tcp 10.0.2.105 51657 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:13:09.419696 0.000000 tcp 10.0.2.105 51657 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:13:14.376908 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:14:26.323971 3.000432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:14:33.330947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:14:41.331934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:14:57.334737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:15:29.341140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:18:15.420185 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:18:15.420402 2.993205 tcp 10.0.2.105 51658 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:18:24.422797 0.000000 tcp 10.0.2.105 51658 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:18:30.423291 0.066793 tcp 10.0.2.105 51659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:30.490388 0.065369 tcp 10.0.2.105 51660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:30.556058 0.155523 tcp 10.0.2.105 51661 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:30.779446 2.996418 tcp 10.0.2.105 51662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:18:39.774446 0.000000 tcp 10.0.2.105 51662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:18:45.774038 0.064201 tcp 10.0.2.105 51663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:45.838653 0.060810 tcp 10.0.2.105 51664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:45.899743 0.238640 tcp 10.0.2.105 51665 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:46.235438 2.633623 tcp 10.0.2.105 51666 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:48.014807 0.060861 tcp 10.0.2.105 51667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:48.075979 0.062650 tcp 10.0.2.105 51668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:48.138903 0.172927 tcp 10.0.2.105 51669 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:18:48.869137 3.002728 tcp 10.0.2.105 51670 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:18:57.870665 0.000000 tcp 10.0.2.105 51670 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:03.873298 0.062462 tcp 10.0.2.105 51671 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:19:03.936061 0.071355 tcp 10.0.2.105 51672 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:19:04.007687 0.193199 tcp 10.0.2.105 51673 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:19:04.732503 2.991861 tcp 10.0.2.105 51674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:13.722887 0.000000 tcp 10.0.2.105 51674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:19.732006 2.994508 tcp 10.0.2.105 51675 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:28.724614 0.000000 tcp 10.0.2.105 51675 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:33.381591 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:19:34.733553 1.770756 tcp 10.0.2.105 51676 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:19:36.504518 3.006283 tcp 10.0.2.105 51677 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:19:45.508983 0.000000 tcp 10.0.2.105 51677 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:21:33.347832 3.000751 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:21:40.354170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:21:48.355902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:22:04.361978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:22:36.365127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:24:51.499634 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:24:51.499807 3.003558 tcp 10.0.2.105 51678 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:00.511958 0.000000 tcp 10.0.2.105 51678 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:06.502699 0.065452 tcp 10.0.2.105 51679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:06.568603 0.071424 tcp 10.0.2.105 51680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:06.640501 0.157804 tcp 10.0.2.105 51681 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:07.297432 2.998397 tcp 10.0.2.105 51682 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:16.294185 0.000000 tcp 10.0.2.105 51682 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:22.293518 0.062405 tcp 10.0.2.105 51683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:22.356204 0.063066 tcp 10.0.2.105 51684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:22.419186 0.159173 tcp 10.0.2.105 51685 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:22.637953 2.837782 tcp 10.0.2.105 51686 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:24.566308 0.062520 tcp 10.0.2.105 51687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:24.629108 0.147108 tcp 10.0.2.105 51688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:24.776597 0.163148 tcp 10.0.2.105 51689 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:25.475932 3.006183 tcp 10.0.2.105 51690 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:34.481040 0.000000 tcp 10.0.2.105 51690 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:40.470153 0.063716 tcp 10.0.2.105 51691 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:40.533822 0.063021 tcp 10.0.2.105 51692 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:40.597139 0.162004 tcp 10.0.2.105 51693 -> 195.113.214.249 443 SRPA* 0 0 22 11628 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:25:40.805592 2.998477 tcp 10.0.2.105 51694 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:49.812775 0.000000 tcp 10.0.2.105 51694 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:25:55.801810 2.993992 tcp 10.0.2.105 51695 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:26:04.794239 0.000000 tcp 10.0.2.105 51695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:26:09.380820 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:26:10.802872 1.722167 tcp 10.0.2.105 51696 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:26:12.525284 3.004658 tcp 10.0.2.105 51697 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:26:21.528619 0.000000 tcp 10.0.2.105 51697 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:28:40.370976 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:28:47.378235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:28:55.379938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:29:11.382633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:29:43.388927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:31:27.519328 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:31:27.519435 3.003282 tcp 10.0.2.105 51698 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:31:36.521442 0.000000 tcp 10.0.2.105 51698 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:31:42.522047 0.064712 tcp 10.0.2.105 51699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:42.587038 0.061923 tcp 10.0.2.105 51700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:42.648877 0.151969 tcp 10.0.2.105 51701 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:42.902104 2.992795 tcp 10.0.2.105 51702 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:31:51.892879 0.000000 tcp 10.0.2.105 51702 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:31:57.902409 0.060932 tcp 10.0.2.105 51703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:57.963625 0.065755 tcp 10.0.2.105 51704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:58.029683 0.159527 tcp 10.0.2.105 51705 -> 195.113.214.249 443 SRPA* 0 0 28 11914 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:31:58.306554 2.592199 tcp 10.0.2.105 51706 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:00.043449 0.063448 tcp 10.0.2.105 51707 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:00.107181 0.066605 tcp 10.0.2.105 51708 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:00.173808 0.168284 tcp 10.0.2.105 51709 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:00.899049 3.001706 tcp 10.0.2.105 51710 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:09.899460 0.000000 tcp 10.0.2.105 51710 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:15.898799 0.061436 tcp 10.0.2.105 51711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:15.960489 0.064720 tcp 10.0.2.105 51712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:16.025453 0.155982 tcp 10.0.2.105 51713 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:16.478638 2.994030 tcp 10.0.2.105 51714 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:25.481884 0.000000 tcp 10.0.2.105 51714 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:31.471098 2.993666 tcp 10.0.2.105 51715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:40.463417 0.000000 tcp 10.0.2.105 51715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:45.380537 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:32:46.472359 1.702131 tcp 10.0.2.105 51716 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:32:48.174655 3.004049 tcp 10.0.2.105 51717 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:32:57.183229 0.000000 tcp 10.0.2.105 51717 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:35:47.395648 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:35:54.402101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:36:02.403043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:36:18.406313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:36:50.416434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:38:03.177993 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:38:03.178172 3.003502 tcp 10.0.2.105 51718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:12.180164 0.000000 tcp 10.0.2.105 51718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:18.180971 0.063101 tcp 10.0.2.105 51719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:18.244630 0.067670 tcp 10.0.2.105 51720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:18.312585 0.157927 tcp 10.0.2.105 51721 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:18.761911 2.992087 tcp 10.0.2.105 51722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:27.762700 0.000000 tcp 10.0.2.105 51722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:33.762150 0.065654 tcp 10.0.2.105 51723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:33.828049 0.061053 tcp 10.0.2.105 51724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:33.889398 0.167331 tcp 10.0.2.105 51725 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:34.205482 2.620529 tcp 10.0.2.105 51726 -> 46.48.223.67 15494 FSPA* 0 0 14 1761 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:36.054099 0.060680 tcp 10.0.2.105 51727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:36.115160 0.068299 tcp 10.0.2.105 51728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:36.183773 0.162441 tcp 10.0.2.105 51729 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:38:36.826272 3.003769 tcp 10.0.2.105 51730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:45.828682 0.000000 tcp 10.0.2.105 51730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:38:51.827703 3.005080 tcp 10.0.2.105 51731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:39:00.830489 0.000000 tcp 10.0.2.105 51731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:39:05.376597 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:39:06.829049 1.782637 tcp 10.0.2.105 51732 -> 46.48.223.67 15494 FSPA* 0 0 14 1761 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:42:54.418392 3.001894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:43:01.426554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:43:05.952834 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:43:05.952929 0.000000 udp 10.0.2.105 7010 -> 84.169.99.138 7604 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:43:09.427626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:43:23.830237 0.062066 tcp 10.0.2.105 51733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:23.892692 0.064097 tcp 10.0.2.105 51734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:23.957093 0.182066 tcp 10.0.2.105 51735 -> 195.113.214.249 443 SRPA* 0 0 72 76746 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:24.139736 0.000000 udp 10.0.2.105 7010 -> 168.187.218.7 2151 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:43:25.430756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:43:40.873494 0.064274 tcp 10.0.2.105 51736 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:40.938026 0.060956 tcp 10.0.2.105 51737 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:40.999275 0.190423 tcp 10.0.2.105 51738 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:43:41.189878 0.188091 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:41.355131 0.188324 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:41.662859 0.125906 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:41.769386 0.172327 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:41.938609 0.172848 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:42.348845 0.154179 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:42.744863 0.216571 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:42.954500 0.114867 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:43.036527 0.183590 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2637 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:43.235659 0.358348 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:43.563872 0.168263 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:43.897417 0.452309 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:43:44.605444 0.000000 udp 10.0.2.105 7010 -> 76.71.128.82 7549 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:43:57.437036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:44:02.484565 0.065107 tcp 10.0.2.105 51739 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:02.550004 0.065490 tcp 10.0.2.105 51740 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:02.615801 0.164008 tcp 10.0.2.105 51741 -> 195.113.214.249 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:02.779239 0.176346 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:02.952712 0.180171 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:03.128240 0.189247 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:03.346763 0.093554 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:03.399455 0.059354 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:03.829733 0.056143 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:03.912977 0.165867 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:04.189610 0.199834 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:04.400391 0.242223 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:04.635045 0.186472 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:04.814494 0.448494 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:05.240878 0.019976 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:05.488456 0.288006 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:05.898835 0.286654 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:06.164764 0.057731 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:06.286061 0.082336 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:06.347149 0.103659 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:06.874554 0.129766 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:06.958142 0.165688 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:07.086205 0.192574 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:07.270984 0.192867 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:07.457838 0.167785 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:07.650091 0.212801 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:07.860679 0.568640 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:08.414029 0.113565 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:08.613111 3.003894 tcp 10.0.2.105 51742 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:44:08.669520 0.092252 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:08.743028 0.050325 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:08.901457 0.130810 udp 10.0.2.105 7010 <-> 79.26.196.64 9307 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:09.202163 0.281070 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/16 11:44:09.474276 0.000000 udp 10.0.2.105 7010 -> 95.104.76.77 6527 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 11:44:17.615588 0.000000 tcp 10.0.2.105 51742 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:44:23.614883 0.062951 tcp 10.0.2.105 51743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:23.678139 0.064481 tcp 10.0.2.105 51744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:23.742922 0.174578 tcp 10.0.2.105 51745 -> 195.113.214.249 443 SRPA* 0 0 41 22672 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:24.006756 3.002295 tcp 10.0.2.105 51746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:44:27.991031 0.062139 tcp 10.0.2.105 51747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:28.053451 0.065216 tcp 10.0.2.105 51748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:28.118999 0.161389 tcp 10.0.2.105 51749 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:33.007905 0.000000 tcp 10.0.2.105 51746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:44:39.007087 0.065663 tcp 10.0.2.105 51750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:39.073054 0.066091 tcp 10.0.2.105 51751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:39.139012 0.166437 tcp 10.0.2.105 51752 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:39.387994 0.353229 tcp 10.0.2.105 51753 -> 46.48.223.67 15494 SPA_* 0 0 9 1243 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:47.352517 0.537341 tcp 10.0.2.105 51753 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:47.353319 0.069845 tcp 10.0.2.105 51754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:47.422992 0.063042 tcp 10.0.2.105 51755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:47.486330 0.149927 tcp 10.0.2.105 51756 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:44:47.890135 2.993358 tcp 10.0.2.105 51757 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:44:56.892174 0.000000 tcp 10.0.2.105 51757 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:02.891361 0.061004 tcp 10.0.2.105 51758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:45:02.952679 0.066004 tcp 10.0.2.105 51759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:45:03.019056 0.168469 tcp 10.0.2.105 51760 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:45:03.673008 3.003414 tcp 10.0.2.105 51761 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:12.675994 0.000000 tcp 10.0.2.105 51761 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:18.673468 3.004296 tcp 10.0.2.105 51762 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:27.676720 0.000000 tcp 10.0.2.105 51762 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:32.388489 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:45:33.675069 1.807201 tcp 10.0.2.105 51763 -> 46.48.223.67 15494 FSPA* 0 0 14 1773 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:45:35.482505 2.999646 tcp 10.0.2.105 51764 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:45:44.480774 0.000000 tcp 10.0.2.105 51764 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:50:50.481032 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:50:50.481117 2.993897 tcp 10.0.2.105 51765 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:50:59.473380 0.000000 tcp 10.0.2.105 51765 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:05.484093 0.065804 tcp 10.0.2.105 51766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:05.550148 0.064883 tcp 10.0.2.105 51767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:05.615346 0.132799 tcp 10.0.2.105 51768 -> 195.113.214.249 443 SRPA* 0 0 33 23844 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:06.098895 2.998667 tcp 10.0.2.105 51769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:15.095932 0.000000 tcp 10.0.2.105 51769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:21.095162 0.061148 tcp 10.0.2.105 51770 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:21.156489 0.059873 tcp 10.0.2.105 51771 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:21.216700 0.156133 tcp 10.0.2.105 51772 -> 195.113.214.249 443 SRPA* 0 0 45 23648 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:21.843159 2.745825 tcp 10.0.2.105 51773 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:23.619157 0.067863 tcp 10.0.2.105 51774 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:23.687299 0.068662 tcp 10.0.2.105 51775 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:23.756317 0.192920 tcp 10.0.2.105 51776 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:24.589263 2.994544 tcp 10.0.2.105 51777 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:33.592747 0.000000 tcp 10.0.2.105 51777 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:39.581571 0.085292 tcp 10.0.2.105 51778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:39.667179 0.068526 tcp 10.0.2.105 51779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:39.735975 0.170827 tcp 10.0.2.105 51780 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:51:39.950608 2.995404 tcp 10.0.2.105 51781 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:48.943936 0.000000 tcp 10.0.2.105 51781 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:51:54.943439 3.006817 tcp 10.0.2.105 51782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:52:03.946273 0.000000 tcp 10.0.2.105 51782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:52:08.885570 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:52:09.952495 1.728330 tcp 10.0.2.105 51783 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:52:11.681175 3.000372 tcp 10.0.2.105 51784 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:52:20.680157 0.000000 tcp 10.0.2.105 51784 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:55:37.446275 3.002730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 11:55:44.452791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:55:52.454775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:56:08.457553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:56:40.465727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 11:57:26.681118 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:57:26.681375 2.993140 tcp 10.0.2.105 51785 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:57:35.690858 0.000000 tcp 10.0.2.105 51785 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:57:41.683377 0.061538 tcp 10.0.2.105 51786 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:41.745193 0.068218 tcp 10.0.2.105 51787 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:41.813700 0.165278 tcp 10.0.2.105 51788 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:42.114818 3.001849 tcp 10.0.2.105 51789 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:57:51.114768 0.000000 tcp 10.0.2.105 51789 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:57:57.114619 0.059863 tcp 10.0.2.105 51790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:57.174758 0.065233 tcp 10.0.2.105 51791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:57.239898 0.166137 tcp 10.0.2.105 51792 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:57.517948 2.218155 tcp 10.0.2.105 51793 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:59.291548 0.066166 tcp 10.0.2.105 51794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:59.357996 0.065285 tcp 10.0.2.105 51795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:59.423574 0.156474 tcp 10.0.2.105 51796 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:57:59.736455 3.005358 tcp 10.0.2.105 51797 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:08.740864 0.000000 tcp 10.0.2.105 51797 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:14.730364 0.060759 tcp 10.0.2.105 51798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:58:14.791374 0.063733 tcp 10.0.2.105 51799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:58:14.855472 0.158934 tcp 10.0.2.105 51800 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:58:16.775288 3.001264 tcp 10.0.2.105 51801 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:25.775052 0.000000 tcp 10.0.2.105 51801 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:31.774016 3.003985 tcp 10.0.2.105 51802 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:39.374735 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 11:58:40.776793 0.000000 tcp 10.0.2.105 51802 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:46.775449 1.751122 tcp 10.0.2.105 51803 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/16 11:58:48.526902 3.005258 tcp 10.0.2.105 51804 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 11:58:57.530791 0.000000 tcp 10.0.2.105 51804 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:02:44.469622 3.009964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:02:51.477258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:02:59.478756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:03:15.481882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:03:47.487627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:04:03.521495 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:04:03.521610 2.993518 tcp 10.0.2.105 51805 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:12.513571 0.000000 tcp 10.0.2.105 51805 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:18.524200 0.062112 tcp 10.0.2.105 51806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:18.586609 0.065545 tcp 10.0.2.105 51807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:18.652012 0.157141 tcp 10.0.2.105 51808 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:19.001138 2.997862 tcp 10.0.2.105 51809 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:27.995319 0.000000 tcp 10.0.2.105 51809 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:33.994587 0.067364 tcp 10.0.2.105 51810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:34.062230 0.065325 tcp 10.0.2.105 51811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:34.127898 0.151877 tcp 10.0.2.105 51812 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:34.479144 2.214838 tcp 10.0.2.105 51813 -> 46.48.223.67 15494 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:36.201037 0.065967 tcp 10.0.2.105 51814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:36.266862 0.067930 tcp 10.0.2.105 51815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:36.335032 0.173399 tcp 10.0.2.105 51816 -> 195.113.214.249 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:36.694255 3.008479 tcp 10.0.2.105 51817 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:45.701514 0.000000 tcp 10.0.2.105 51817 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:04:51.690533 0.064064 tcp 10.0.2.105 51818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:51.754881 0.061943 tcp 10.0.2.105 51819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:51.817088 0.179647 tcp 10.0.2.105 51820 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:04:52.062944 2.991943 tcp 10.0.2.105 51821 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:05:01.053391 0.000000 tcp 10.0.2.105 51821 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:05:07.062358 2.994141 tcp 10.0.2.105 51822 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:05:16.055185 0.000000 tcp 10.0.2.105 51822 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:05:20.882072 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:05:22.063652 1.744446 tcp 10.0.2.105 51823 -> 46.48.223.67 15494 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:05:23.808450 3.002242 tcp 10.0.2.105 51824 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:05:32.814673 0.000000 tcp 10.0.2.105 51824 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:10:00.496707 3.002031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:10:07.504052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:10:15.505762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:10:31.508926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:11:03.514347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:14:31.744373 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:14:31.744525 0.000000 udp 10.0.2.105 7010 -> 76.71.128.82 7549 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 12:14:47.652324 0.066579 tcp 10.0.2.105 51825 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:14:47.719187 0.063941 tcp 10.0.2.105 51826 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:14:47.783429 0.161336 tcp 10.0.2.105 51827 -> 195.113.214.249 443 SRPA* 0 0 34 17906 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:14:47.945322 0.000000 udp 10.0.2.105 7010 -> 95.104.76.77 6527 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 12:15:05.703254 0.066050 tcp 10.0.2.105 51828 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:05.769615 0.068744 tcp 10.0.2.105 51829 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:05.838646 0.160442 tcp 10.0.2.105 51830 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:05.999587 0.191384 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:06.185858 0.184714 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:06.626091 0.125462 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:06.731875 0.186781 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:06.974933 0.109989 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:07.053088 0.174759 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:07.249097 0.155666 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:07.508024 0.216453 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:07.717506 0.179617 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:08.021874 0.369154 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:08.364817 0.167501 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 1998 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:08.513200 0.349140 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:08.837595 3.003401 tcp 10.0.2.105 51831 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:08.858175 0.182698 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.035772 0.175312 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.235802 0.057768 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.487307 0.087538 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.534844 0.191302 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.746839 0.058558 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:09.803476 0.202865 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:10.205298 0.169369 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:10.542897 0.517780 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:11.052985 0.234028 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:11.279664 0.289198 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:11.682504 0.313995 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:11.976120 0.022388 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:12.238844 0.452004 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:12.669893 0.086713 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:12.754665 0.133747 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:12.840252 0.162169 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:13.053859 0.055146 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:13.305834 0.085557 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:13.370103 0.189023 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:13.551896 0.168838 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:14.268280 0.214649 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:14.479578 0.196190 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:15.084740 0.052637 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:15.120893 0.109591 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:15.269837 0.021755 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:15.497149 0.096409 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:15.576958 0.000000 udp 10.0.2.105 7010 -> 79.26.196.64 9307 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 12:15:17.840790 0.000000 tcp 10.0.2.105 51831 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:23.839340 0.070318 tcp 10.0.2.105 51832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:23.909978 0.065470 tcp 10.0.2.105 51833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:23.975701 0.157420 tcp 10.0.2.105 51834 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:24.494671 2.998882 tcp 10.0.2.105 51835 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:32.653480 0.065701 tcp 10.0.2.105 51836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:32.719462 0.066257 tcp 10.0.2.105 51837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:32.786021 0.157022 tcp 10.0.2.105 51838 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:32.943594 0.287488 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:15:33.503073 0.000000 tcp 10.0.2.105 51835 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:39.491979 0.065858 tcp 10.0.2.105 51839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:39.558111 0.066580 tcp 10.0.2.105 51840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:39.624605 0.152743 tcp 10.0.2.105 51841 -> 195.113.214.249 443 SRPA* 0 0 38 21716 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:15:39.792814 3.003620 tcp 10.0.2.105 51842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:48.794126 0.000000 tcp 10.0.2.105 51842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:15:54.793557 3.004353 tcp 10.0.2.105 51843 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:16:03.796345 0.000000 tcp 10.0.2.105 51843 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:16:08.382991 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:17:07.520833 3.002065 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:17:14.528146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:17:22.529481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:17:38.532828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:18:10.538822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:21:09.797080 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:21:09.797168 3.003547 tcp 10.0.2.105 51844 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:18.799093 0.000000 tcp 10.0.2.105 51844 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:24.799720 0.063896 tcp 10.0.2.105 51845 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:24.863900 0.066362 tcp 10.0.2.105 51846 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:24.930605 0.158199 tcp 10.0.2.105 51847 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:25.151912 3.000856 tcp 10.0.2.105 51848 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:34.151223 0.000000 tcp 10.0.2.105 51848 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:40.150669 0.071712 tcp 10.0.2.105 51849 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:40.222727 0.067555 tcp 10.0.2.105 51850 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:40.290547 0.154550 tcp 10.0.2.105 51851 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:40.848405 2.020219 tcp 10.0.2.105 51852 -> 46.48.223.67 15494 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:42.572275 0.064050 tcp 10.0.2.105 51853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:42.636655 0.062515 tcp 10.0.2.105 51854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:42.699520 0.159519 tcp 10.0.2.105 51855 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:42.868854 2.999258 tcp 10.0.2.105 51856 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:51.866834 0.000000 tcp 10.0.2.105 51856 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:21:57.865776 0.066407 tcp 10.0.2.105 51857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:57.932475 0.067603 tcp 10.0.2.105 51858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:58.000525 0.161412 tcp 10.0.2.105 51859 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:21:58.187670 3.002362 tcp 10.0.2.105 51860 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:22:07.188714 0.000000 tcp 10.0.2.105 51860 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:22:13.187446 3.004524 tcp 10.0.2.105 51861 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:22:22.190471 0.000000 tcp 10.0.2.105 51861 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:22:26.876907 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:22:28.189196 1.757738 tcp 10.0.2.105 51862 -> 46.48.223.67 15494 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:22:29.947209 2.998071 tcp 10.0.2.105 51863 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:22:38.944713 0.000000 tcp 10.0.2.105 51863 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:24:14.545065 3.005627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:24:21.552646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:24:29.554086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:24:45.556642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:25:17.562545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:27:44.944983 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:27:44.945161 3.003714 tcp 10.0.2.105 51864 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:27:54.029126 0.000000 tcp 10.0.2.105 51864 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:27:59.979262 0.159273 tcp 10.0.2.105 51865 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:00.138846 0.067817 tcp 10.0.2.105 51866 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:00.207031 0.159677 tcp 10.0.2.105 51867 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:00.615734 2.981420 tcp 10.0.2.105 51868 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:09.590018 0.000000 tcp 10.0.2.105 51868 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:15.589429 0.064762 tcp 10.0.2.105 51869 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:15.654118 0.063445 tcp 10.0.2.105 51870 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:15.717860 0.162518 tcp 10.0.2.105 51871 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:16.200836 3.057012 tcp 10.0.2.105 51872 -> 46.48.223.67 15494 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:17.959724 0.064700 tcp 10.0.2.105 51873 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:18.024701 0.064964 tcp 10.0.2.105 51874 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:18.089983 0.148878 tcp 10.0.2.105 51875 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:19.258165 2.999897 tcp 10.0.2.105 51876 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:28.262472 0.000000 tcp 10.0.2.105 51876 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:34.262194 0.061585 tcp 10.0.2.105 51877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:34.324085 0.066731 tcp 10.0.2.105 51878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:34.391130 0.157211 tcp 10.0.2.105 51879 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:28:34.740682 3.001504 tcp 10.0.2.105 51880 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:43.738963 0.000000 tcp 10.0.2.105 51880 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:49.737856 3.004063 tcp 10.0.2.105 51881 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:28:58.740614 0.000000 tcp 10.0.2.105 51881 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:29:03.377160 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:29:04.739313 1.755148 tcp 10.0.2.105 51882 -> 46.48.223.67 15494 FSPA* 0 0 14 1708 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:29:06.494723 3.001200 tcp 10.0.2.105 51883 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:29:15.494730 0.000000 tcp 10.0.2.105 51883 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:31:21.573488 2.997108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:31:28.575926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:31:36.577488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:31:52.580847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:32:25.231352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:34:21.495341 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:34:21.495545 3.003340 tcp 10.0.2.105 51884 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:34:30.497584 0.000000 tcp 10.0.2.105 51884 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:34:36.498113 0.062972 tcp 10.0.2.105 51885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:36.561391 0.065324 tcp 10.0.2.105 51886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:36.627001 0.155594 tcp 10.0.2.105 51887 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:36.968571 3.002735 tcp 10.0.2.105 51888 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:34:45.969587 0.000000 tcp 10.0.2.105 51888 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:34:51.969405 0.066755 tcp 10.0.2.105 51889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:52.036614 0.067464 tcp 10.0.2.105 51890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:52.104408 0.167355 tcp 10.0.2.105 51891 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:52.363122 2.331640 tcp 10.0.2.105 51892 -> 46.48.223.67 15494 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:54.121434 0.060830 tcp 10.0.2.105 51893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:54.182578 0.065668 tcp 10.0.2.105 51894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:54.248550 0.229715 tcp 10.0.2.105 51895 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:34:54.695030 3.001661 tcp 10.0.2.105 51896 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:03.694893 0.000000 tcp 10.0.2.105 51896 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:09.694444 0.066208 tcp 10.0.2.105 51897 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:35:09.760938 0.066062 tcp 10.0.2.105 51898 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:35:09.827373 0.157587 tcp 10.0.2.105 51899 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:35:10.098786 3.000087 tcp 10.0.2.105 51900 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:19.097313 0.000000 tcp 10.0.2.105 51900 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:25.096213 3.004345 tcp 10.0.2.105 51901 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:34.098866 0.000000 tcp 10.0.2.105 51901 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:38.875612 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:35:40.099671 1.747344 tcp 10.0.2.105 51902 -> 46.48.223.67 15494 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:35:41.847248 2.997106 tcp 10.0.2.105 51903 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:35:50.843041 0.000000 tcp 10.0.2.105 51903 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:38:28.603711 3.000481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:38:35.609934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:38:43.612975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:38:59.614394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:39:31.620701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:40:56.843660 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:40:56.843825 3.003456 tcp 10.0.2.105 51904 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:05.845984 0.000000 tcp 10.0.2.105 51904 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:11.846304 0.063851 tcp 10.0.2.105 51905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:11.910429 0.062082 tcp 10.0.2.105 51906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:11.972837 0.148123 tcp 10.0.2.105 51907 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:12.524708 3.005168 tcp 10.0.2.105 51908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:21.531425 0.000000 tcp 10.0.2.105 51908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:27.517692 0.068167 tcp 10.0.2.105 51909 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:27.586178 0.065933 tcp 10.0.2.105 51910 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:27.652544 0.375018 tcp 10.0.2.105 51911 -> 195.113.214.249 443 SRPA* 0 0 73 78422 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:28.224645 2.413816 tcp 10.0.2.105 51912 -> 46.48.223.67 15494 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:29.951742 0.065383 tcp 10.0.2.105 51913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:30.017425 0.070489 tcp 10.0.2.105 51914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:30.088194 0.162822 tcp 10.0.2.105 51915 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:41:30.638715 2.996870 tcp 10.0.2.105 51916 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:39.634860 0.000000 tcp 10.0.2.105 51916 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:45.634180 3.003329 tcp 10.0.2.105 51917 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:54.636030 0.000000 tcp 10.0.2.105 51917 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:41:59.383081 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:42:00.635242 3.784472 tcp 10.0.2.105 51918 -> 46.48.223.67 15494 FSPA* 0 0 14 1641 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:45:35.626088 3.003707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:45:42.633777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:45:50.635494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:45:55.477130 0.000171 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:45:55.477431 0.000000 udp 10.0.2.105 7010 -> 79.26.196.64 9307 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 12:46:06.638712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:46:14.240792 0.064643 tcp 10.0.2.105 51919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:46:14.305702 0.062164 tcp 10.0.2.105 51920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:46:14.368162 0.156345 tcp 10.0.2.105 51921 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:46:14.523219 0.182999 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:14.682671 0.123683 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:15.231019 0.186457 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:15.390247 0.113296 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:15.469665 0.173199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:15.638988 0.176257 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:15.797439 0.181052 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:16.015394 0.152460 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:16.405147 0.221770 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:16.619482 0.167278 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:16.768638 0.356278 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:17.099486 0.179828 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:17.275362 0.353237 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:17.796925 0.190609 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:17.984920 0.060323 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.043377 0.215653 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.278207 0.057343 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.530559 0.176154 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.703618 0.088899 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.796561 0.183910 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:18.973032 0.166128 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:19.177124 0.341393 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:19.497095 0.239532 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2010 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:19.728955 0.288888 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.077565 0.084619 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.146305 0.022546 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.345334 0.187131 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.469079 0.056371 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.592536 0.142452 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:20.688644 0.444697 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:21.111286 0.199999 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:21.302969 0.084807 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:21.509763 0.050722 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:21.546213 0.171975 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:21.805559 0.213631 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:22.017016 0.210065 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:22.468983 0.021518 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:22.486073 0.105079 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:22.681484 0.088398 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:22.751921 0.286142 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/16 12:46:38.644778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:47:04.655409 2.961139 tcp 10.0.2.105 51922 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:09.570125 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:47:13.557104 0.000000 tcp 10.0.2.105 51922 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:19.777981 0.062058 tcp 10.0.2.105 51923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:19.840486 0.063951 tcp 10.0.2.105 51924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:19.904716 0.153930 tcp 10.0.2.105 51925 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:20.318318 2.967143 tcp 10.0.2.105 51926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:29.224391 0.000000 tcp 10.0.2.105 51926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:35.165215 0.061093 tcp 10.0.2.105 51927 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:35.226602 0.068325 tcp 10.0.2.105 51928 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:35.295239 0.160381 tcp 10.0.2.105 51929 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:36.193449 2.256876 tcp 10.0.2.105 51930 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:37.962894 0.064451 tcp 10.0.2.105 51931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:38.027787 0.063540 tcp 10.0.2.105 51932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:38.091664 0.215658 tcp 10.0.2.105 51933 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:38.450588 2.963287 tcp 10.0.2.105 51934 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:47.353920 0.000000 tcp 10.0.2.105 51934 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:47:53.303053 0.064452 tcp 10.0.2.105 51935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:53.367800 0.069764 tcp 10.0.2.105 51936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:53.437840 0.169278 tcp 10.0.2.105 51937 -> 195.113.214.249 443 SRPA* 0 0 43 34118 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:47:53.920641 2.976565 tcp 10.0.2.105 51938 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:48:02.895619 0.000000 tcp 10.0.2.105 51938 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:48:08.897734 3.003515 tcp 10.0.2.105 51939 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:48:17.897207 0.000000 tcp 10.0.2.105 51939 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:48:22.874188 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:48:23.895767 1.735958 tcp 10.0.2.105 51940 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:48:25.631894 3.000789 tcp 10.0.2.105 51941 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:48:34.631367 0.000000 tcp 10.0.2.105 51941 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:53:40.631801 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:53:40.631970 2.993645 tcp 10.0.2.105 51942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:53:49.623958 0.000000 tcp 10.0.2.105 51942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:53:55.634247 0.063137 tcp 10.0.2.105 51943 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:53:55.697719 0.061509 tcp 10.0.2.105 51944 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:53:55.759560 0.155840 tcp 10.0.2.105 51945 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:53:56.271354 2.996536 tcp 10.0.2.105 51946 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:05.266739 0.000000 tcp 10.0.2.105 51946 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:11.265817 0.060886 tcp 10.0.2.105 51947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:11.327086 0.127300 tcp 10.0.2.105 51948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:11.454292 0.151083 tcp 10.0.2.105 51949 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:12.412873 2.222546 tcp 10.0.2.105 51950 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:14.305842 0.064499 tcp 10.0.2.105 51951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:14.370633 0.062195 tcp 10.0.2.105 51952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:14.433177 0.156265 tcp 10.0.2.105 51953 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:14.635697 2.998553 tcp 10.0.2.105 51954 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:23.642920 0.000000 tcp 10.0.2.105 51954 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:29.632367 0.061210 tcp 10.0.2.105 51955 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:29.693630 0.062009 tcp 10.0.2.105 51956 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:29.755494 0.150981 tcp 10.0.2.105 51957 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:54:30.535527 3.001702 tcp 10.0.2.105 51958 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:39.535311 0.000000 tcp 10.0.2.105 51958 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:45.534641 3.004163 tcp 10.0.2.105 51959 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:54:54.211647 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 12:54:55.356558 0.000000 tcp 10.0.2.105 51959 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:55:01.289168 0.347657 tcp 10.0.2.105 51960 -> 46.48.223.67 15494 SPA_* 0 0 9 1114 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:55:09.455200 0.000351 tcp 10.0.2.105 51960 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 12:55:09.455800 2.966149 tcp 10.0.2.105 51961 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:55:18.348399 0.000000 tcp 10.0.2.105 51961 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 12:56:58.668902 3.001261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 12:57:05.675855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:57:13.677418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:57:29.680666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 12:58:01.686276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:00:23.813757 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:00:23.813870 2.993139 tcp 10.0.2.105 51962 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:00:32.804852 0.000000 tcp 10.0.2.105 51962 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:00:38.814342 0.061763 tcp 10.0.2.105 51963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:38.876439 0.065111 tcp 10.0.2.105 51964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:38.941935 0.152395 tcp 10.0.2.105 51965 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:39.366347 3.000858 tcp 10.0.2.105 51966 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:00:48.371643 0.000000 tcp 10.0.2.105 51966 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:00:54.365768 0.062191 tcp 10.0.2.105 51967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:54.428277 0.067113 tcp 10.0.2.105 51968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:54.495652 0.192069 tcp 10.0.2.105 51969 -> 195.113.214.249 443 SRPA* 0 0 59 42168 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:54.733799 2.254825 tcp 10.0.2.105 51970 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:56.466225 0.062793 tcp 10.0.2.105 51971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:56.529277 0.062744 tcp 10.0.2.105 51972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:56.592395 0.163640 tcp 10.0.2.105 51973 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:00:56.988832 3.004313 tcp 10.0.2.105 51974 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:06.001579 0.000000 tcp 10.0.2.105 51974 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:11.990681 0.069471 tcp 10.0.2.105 51975 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:01:12.060456 0.061122 tcp 10.0.2.105 51976 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:01:12.121400 0.155957 tcp 10.0.2.105 51977 -> 195.113.214.249 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:01:12.489225 2.995990 tcp 10.0.2.105 51978 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:21.483645 0.000000 tcp 10.0.2.105 51978 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:27.482976 2.993528 tcp 10.0.2.105 51979 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:36.475681 0.000000 tcp 10.0.2.105 51979 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:41.384810 0.000224 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:01:42.484925 1.711266 tcp 10.0.2.105 51980 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:01:44.196414 3.004295 tcp 10.0.2.105 51981 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:01:53.199175 0.000000 tcp 10.0.2.105 51981 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:04:05.692022 3.002158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:04:12.702825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:04:20.701258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:04:36.704675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:05:08.710792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:06:59.200057 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:06:59.200403 2.993250 tcp 10.0.2.105 51982 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:08.202578 0.000000 tcp 10.0.2.105 51982 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:14.203198 0.067806 tcp 10.0.2.105 51983 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:14.271276 0.067066 tcp 10.0.2.105 51984 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:14.338731 0.152338 tcp 10.0.2.105 51985 -> 195.113.214.249 443 SRPA* 0 0 27 11834 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:14.499443 2.987393 tcp 10.0.2.105 51986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:23.483809 0.000000 tcp 10.0.2.105 51986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:29.497570 0.060727 tcp 10.0.2.105 51987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:29.558564 0.063111 tcp 10.0.2.105 51988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:29.621997 0.151017 tcp 10.0.2.105 51989 -> 195.113.214.249 443 SRPA* 0 0 39 31854 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:29.801641 2.029178 tcp 10.0.2.105 51990 -> 46.48.223.67 15494 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:31.546620 0.060190 tcp 10.0.2.105 51991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:31.607162 0.061003 tcp 10.0.2.105 51992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:31.668451 0.151908 tcp 10.0.2.105 51993 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:31.831137 2.999139 tcp 10.0.2.105 51994 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:40.829043 0.000000 tcp 10.0.2.105 51994 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:46.828346 0.061632 tcp 10.0.2.105 51995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:46.889816 0.063193 tcp 10.0.2.105 51996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:46.953419 0.154658 tcp 10.0.2.105 51997 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:07:47.132981 2.999743 tcp 10.0.2.105 51998 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:07:56.135944 0.000000 tcp 10.0.2.105 51998 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:08:02.130150 2.993720 tcp 10.0.2.105 51999 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:08:11.132417 0.000000 tcp 10.0.2.105 51999 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:08:15.879430 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:08:17.131462 1.730182 tcp 10.0.2.105 52000 -> 46.48.223.67 15494 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:08:18.861829 2.995869 tcp 10.0.2.105 52001 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:08:27.856663 0.000000 tcp 10.0.2.105 52001 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:11:12.716125 3.004730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:11:19.723514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:11:27.725191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:11:43.729915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:12:15.744555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:16:47.395377 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:16:47.395531 0.182306 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:47.557543 0.125137 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:47.763955 0.301461 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.037695 0.126701 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.132691 0.175713 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.369088 0.175755 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.600291 0.182371 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.774427 0.152507 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:48.877864 3.004083 tcp 10.0.2.105 52002 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:16:48.983786 0.349581 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:49.306297 0.214766 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:49.514185 0.169954 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:49.715225 0.191664 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:49.904367 0.058209 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:49.961002 0.183051 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:50.136536 0.350335 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:50.483037 0.205720 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:50.820643 0.056270 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.029623 0.175801 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.203312 0.079477 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2018 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.247090 0.190565 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.428900 0.167803 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.574315 0.283224 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.858936 0.088670 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:51.935360 0.255808 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.169655 0.242280 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.404351 0.022671 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.505990 0.185457 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.630127 0.057793 udp 10.0.2.105 7010 <-> 176.73.226.233 1530 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.818844 0.133121 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:52.903903 0.440618 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:53.323302 0.198012 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:53.838657 0.084707 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:53.903942 0.050472 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:54.086016 0.170066 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:54.350199 0.223373 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:54.571158 0.111425 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:54.792692 0.097042 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:54.873509 0.297309 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:55.161490 0.205223 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:55.359823 0.022425 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:16:57.880047 0.000000 tcp 10.0.2.105 52002 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:03.881046 0.061723 tcp 10.0.2.105 52003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:03.943046 0.066263 tcp 10.0.2.105 52004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:04.009647 0.160683 tcp 10.0.2.105 52005 -> 195.113.214.249 443 SRPA* 0 0 40 20518 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:04.233556 2.990002 tcp 10.0.2.105 52006 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:13.232200 0.000000 tcp 10.0.2.105 52006 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:19.231416 0.258607 tcp 10.0.2.105 52007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:19.490335 0.061870 tcp 10.0.2.105 52008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:19.552705 0.154928 tcp 10.0.2.105 52009 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:17:20.126894 2.962476 tcp 10.0.2.105 52010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:29.033932 0.000000 tcp 10.0.2.105 52010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:34.977727 2.973044 tcp 10.0.2.105 52011 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:43.946222 0.000000 tcp 10.0.2.105 52011 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:17:48.872840 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:18:19.750538 3.001662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:18:26.757880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:18:34.759250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:18:50.762105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:19:22.772954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:22:49.947322 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:22:49.947430 3.003206 tcp 10.0.2.105 52012 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:22:58.949065 0.000000 tcp 10.0.2.105 52012 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:04.949715 0.061220 tcp 10.0.2.105 52013 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:05.011217 0.065630 tcp 10.0.2.105 52014 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:05.077163 0.163917 tcp 10.0.2.105 52015 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:05.573982 3.010799 tcp 10.0.2.105 52016 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:14.591781 0.000000 tcp 10.0.2.105 52016 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:20.571084 0.061422 tcp 10.0.2.105 52017 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:20.632805 0.061126 tcp 10.0.2.105 52018 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:20.694256 0.452537 tcp 10.0.2.105 52019 -> 195.113.214.249 443 SRPA* 0 0 75 78536 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:21.159949 2.180427 tcp 10.0.2.105 52020 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:22.891341 0.065518 tcp 10.0.2.105 52021 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:22.957240 0.061179 tcp 10.0.2.105 52022 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:23.018701 0.151847 tcp 10.0.2.105 52023 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:23.340617 2.998108 tcp 10.0.2.105 52024 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:32.337205 0.000000 tcp 10.0.2.105 52024 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:38.336520 0.060274 tcp 10.0.2.105 52025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:38.397132 0.062531 tcp 10.0.2.105 52026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:38.459959 0.153222 tcp 10.0.2.105 52027 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:23:38.666097 3.004735 tcp 10.0.2.105 52028 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:47.669230 0.000000 tcp 10.0.2.105 52028 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:23:53.658272 3.003986 tcp 10.0.2.105 52029 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:24:02.660658 0.000000 tcp 10.0.2.105 52029 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:24:07.377705 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:24:08.659963 1.802637 tcp 10.0.2.105 52030 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:24:10.462849 2.993612 tcp 10.0.2.105 52031 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:24:19.455117 0.000000 tcp 10.0.2.105 52031 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:25:26.774352 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:25:33.781983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:25:41.783292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:25:57.786214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:26:29.792200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:29:25.455694 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:29:25.455881 3.003202 tcp 10.0.2.105 52032 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:29:34.457910 0.000000 tcp 10.0.2.105 52032 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:29:40.458724 0.062892 tcp 10.0.2.105 52033 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:40.521911 0.075370 tcp 10.0.2.105 52034 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:40.597582 0.154676 tcp 10.0.2.105 52035 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:40.839125 3.001837 tcp 10.0.2.105 52036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:29:49.840047 0.000000 tcp 10.0.2.105 52036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:29:55.839276 0.298584 tcp 10.0.2.105 52037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:56.138169 0.064558 tcp 10.0.2.105 52038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:56.203006 0.156078 tcp 10.0.2.105 52039 -> 195.113.214.249 443 SRPA* 0 0 31 14540 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:56.484055 2.160491 tcp 10.0.2.105 52040 -> 46.48.223.67 15494 FSPA* 0 0 14 1773 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:58.223668 0.060135 tcp 10.0.2.105 52041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:58.284115 0.065442 tcp 10.0.2.105 52042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:58.349865 0.170081 tcp 10.0.2.105 52043 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:29:58.644790 2.962635 tcp 10.0.2.105 52044 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:07.552148 0.000000 tcp 10.0.2.105 52044 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:13.496160 0.069391 tcp 10.0.2.105 52045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:30:13.565831 0.064229 tcp 10.0.2.105 52046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:30:13.630331 0.153382 tcp 10.0.2.105 52047 -> 195.113.214.249 443 SRPA* 0 0 40 21398 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:30:14.024874 2.970635 tcp 10.0.2.105 52048 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:22.967531 0.000000 tcp 10.0.2.105 52048 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:28.966125 3.004372 tcp 10.0.2.105 52049 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:37.969272 0.000000 tcp 10.0.2.105 52049 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:42.875607 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:30:43.968161 3.237528 tcp 10.0.2.105 52050 -> 46.48.223.67 15494 FSPA* 0 0 15 1827 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:30:45.704092 3.000493 tcp 10.0.2.105 52051 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:30:54.713504 0.000000 tcp 10.0.2.105 52051 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:32:33.798529 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:32:40.805718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:32:48.807351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:33:04.811526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:33:36.816142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:36:00.703821 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:36:00.704057 3.003264 tcp 10.0.2.105 52052 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:09.705978 0.000000 tcp 10.0.2.105 52052 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:15.706291 0.065092 tcp 10.0.2.105 52053 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:15.771632 0.063345 tcp 10.0.2.105 52054 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:15.835302 0.150457 tcp 10.0.2.105 52055 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:16.334946 3.005013 tcp 10.0.2.105 52056 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:25.338700 0.000000 tcp 10.0.2.105 52056 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:31.327763 0.064330 tcp 10.0.2.105 52057 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:31.392418 0.065607 tcp 10.0.2.105 52058 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:31.458330 0.148906 tcp 10.0.2.105 52059 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:31.617632 2.327544 tcp 10.0.2.105 52060 -> 46.48.223.67 15494 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:33.348095 0.061305 tcp 10.0.2.105 52061 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:33.409690 0.159633 tcp 10.0.2.105 52062 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:33.569610 0.161610 tcp 10.0.2.105 52063 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:33.945483 2.999910 tcp 10.0.2.105 52064 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:42.943952 0.000000 tcp 10.0.2.105 52064 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:48.942908 0.062896 tcp 10.0.2.105 52065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:49.006144 0.064654 tcp 10.0.2.105 52066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:49.071169 0.159112 tcp 10.0.2.105 52067 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:36:49.495178 3.007813 tcp 10.0.2.105 52068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:36:58.496681 0.000000 tcp 10.0.2.105 52068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:37:04.495256 3.003988 tcp 10.0.2.105 52069 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:37:13.498015 0.000000 tcp 10.0.2.105 52069 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:37:18.374883 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:37:19.496968 1.758455 tcp 10.0.2.105 52070 -> 46.48.223.67 15494 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:37:21.255253 3.007829 tcp 10.0.2.105 52071 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:37:30.276788 0.000000 tcp 10.0.2.105 52071 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:39:40.822528 3.001504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:39:47.829720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:39:55.831289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:40:11.838396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:40:43.840377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:42:36.252480 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:42:36.252578 2.994273 tcp 10.0.2.105 52072 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:42:45.244984 0.000000 tcp 10.0.2.105 52072 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:42:51.254793 0.062893 tcp 10.0.2.105 52073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:51.318001 0.064510 tcp 10.0.2.105 52074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:51.382858 0.154384 tcp 10.0.2.105 52075 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:51.925442 3.287447 tcp 10.0.2.105 52076 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:54.759214 0.067700 tcp 10.0.2.105 52077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:54.827223 0.068050 tcp 10.0.2.105 52078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:54.895598 0.154214 tcp 10.0.2.105 52079 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:42:55.213137 3.000017 tcp 10.0.2.105 52080 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:43:04.222622 0.000000 tcp 10.0.2.105 52080 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:43:10.211050 3.112145 tcp 10.0.2.105 52081 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:46:47.846426 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:46:54.956954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:47:02.888376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:47:18.868665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:47:23.515264 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:47:23.515364 0.190777 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:23.677885 0.113897 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:24.309894 0.181938 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:24.467756 0.123157 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:24.838549 0.184409 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:25.103819 0.155034 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:25.357434 0.189744 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:25.666643 0.176389 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:26.055581 0.363667 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:26.391655 0.212628 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:26.597003 0.171360 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:26.809928 0.189616 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:26.996448 0.058000 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:27.213855 0.182468 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:27.444538 0.055473 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:27.609909 0.353731 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:27.960003 0.206198 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:28.160154 0.177624 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:28.334967 0.083797 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:28.433715 0.182044 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:28.608114 0.165002 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:29.727148 0.299693 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:30.071639 0.084095 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:30.142050 0.249859 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:30.371506 0.202881 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:30.664432 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 13:47:47.982154 0.061967 tcp 10.0.2.105 52082 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:47:48.044432 0.065121 tcp 10.0.2.105 52083 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:47:48.109850 0.156820 tcp 10.0.2.105 52084 -> 195.113.214.249 443 SRPA* 0 0 30 14182 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:47:48.267049 0.141310 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:48.362280 0.233998 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:48.849490 0.020406 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:48.878238 0.447249 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:49.303670 0.200716 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:49.497264 0.084768 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:49.678415 0.053066 udp 10.0.2.105 7010 <-> 87.139.192.113 3162 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:49.718300 0.110119 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:49.820812 0.088976 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:47:50.026727 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 13:47:50.874292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:48:06.988374 0.061601 tcp 10.0.2.105 52085 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:07.050329 0.061384 tcp 10.0.2.105 52086 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:07.112030 0.163008 tcp 10.0.2.105 52087 -> 195.113.214.249 443 SRPA* 0 0 46 40990 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:07.275675 0.192355 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2590 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:48:07.443130 0.222731 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:48:07.662445 0.204080 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:48:07.872972 0.021260 udp 10.0.2.105 7010 <-> 84.119.231.128 3741 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/16 13:48:13.316944 3.003862 tcp 10.0.2.105 52088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:48:22.319303 0.000000 tcp 10.0.2.105 52088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:48:28.321416 0.060214 tcp 10.0.2.105 52089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:28.381950 0.065190 tcp 10.0.2.105 52090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:28.447422 0.149339 tcp 10.0.2.105 52091 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:28.687063 3.006020 tcp 10.0.2.105 52092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:48:37.701651 0.000000 tcp 10.0.2.105 52092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:48:43.683660 0.067369 tcp 10.0.2.105 52093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:43.751331 0.062756 tcp 10.0.2.105 52094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:43.814386 0.153673 tcp 10.0.2.105 52095 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:44.071341 3.827224 tcp 10.0.2.105 52096 -> 46.48.223.67 15494 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:47.358840 0.063810 tcp 10.0.2.105 52097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:47.422976 0.060439 tcp 10.0.2.105 52098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:47.483725 0.168780 tcp 10.0.2.105 52099 -> 195.113.214.249 443 SRPA* 0 0 23 11472 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:48:47.898858 3.002755 tcp 10.0.2.105 52100 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:48:56.900521 0.000000 tcp 10.0.2.105 52100 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:02.898422 0.060413 tcp 10.0.2.105 52101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:49:02.959119 0.061937 tcp 10.0.2.105 52102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:49:03.021343 0.163834 tcp 10.0.2.105 52103 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:49:03.552045 3.001154 tcp 10.0.2.105 52104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:12.561663 0.000000 tcp 10.0.2.105 52104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:18.555110 2.989461 tcp 10.0.2.105 52105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:27.543284 0.000000 tcp 10.0.2.105 52105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:32.380426 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:49:33.552569 3.373282 tcp 10.0.2.105 52106 -> 46.48.223.67 15494 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:49:36.926070 3.005076 tcp 10.0.2.105 52107 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:49:45.930008 0.000000 tcp 10.0.2.105 52107 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:53:54.880235 3.213549 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 13:54:02.060031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:54:09.985012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:54:25.904291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:54:52.077013 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:54:52.077106 2.963892 tcp 10.0.2.105 52108 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:54:58.016905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 13:55:00.993254 0.000000 tcp 10.0.2.105 52108 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:07.453466 0.061433 tcp 10.0.2.105 52109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:07.515202 0.064431 tcp 10.0.2.105 52110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:07.579941 0.159893 tcp 10.0.2.105 52111 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:08.187395 2.961425 tcp 10.0.2.105 52112 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:17.208294 0.000000 tcp 10.0.2.105 52112 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:23.138970 0.060707 tcp 10.0.2.105 52113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:23.199998 0.061082 tcp 10.0.2.105 52114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:23.261424 0.151688 tcp 10.0.2.105 52115 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:23.451910 3.737429 tcp 10.0.2.105 52116 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:26.892620 0.061249 tcp 10.0.2.105 52117 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:26.954154 0.063171 tcp 10.0.2.105 52118 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:27.017643 0.150181 tcp 10.0.2.105 52119 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:27.189575 2.962186 tcp 10.0.2.105 52120 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:36.091132 0.000000 tcp 10.0.2.105 52120 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:42.013222 0.064048 tcp 10.0.2.105 52121 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:42.077574 0.060472 tcp 10.0.2.105 52122 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:42.138363 0.151369 tcp 10.0.2.105 52123 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:55:42.655563 2.954367 tcp 10.0.2.105 52124 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:51.542785 0.000000 tcp 10.0.2.105 52124 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:55:57.472796 2.965679 tcp 10.0.2.105 52125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:56:06.408018 0.000000 tcp 10.0.2.105 52125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:56:11.373665 0.071886 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 13:56:12.459705 3.498003 tcp 10.0.2.105 52126 -> 46.48.223.67 15494 FSPA* 0 0 14 1725 flow=From-Botnet-V2-TCP-Established 1970/02/16 13:56:15.957984 2.976072 tcp 10.0.2.105 52127 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 13:56:24.933393 0.000000 tcp 10.0.2.105 52127 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:01:01.927663 2.998101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:01:08.931783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:01:16.932774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:01:30.924157 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:01:30.924520 3.003038 tcp 10.0.2.105 52128 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:01:32.936244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:01:39.926113 0.000000 tcp 10.0.2.105 52128 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:01:45.926331 0.061598 tcp 10.0.2.105 52129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:01:45.988171 0.064275 tcp 10.0.2.105 52130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:01:46.052760 0.152255 tcp 10.0.2.105 52131 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:01:46.237728 3.002009 tcp 10.0.2.105 52132 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:01:55.239214 0.000000 tcp 10.0.2.105 52132 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:01.237540 0.063431 tcp 10.0.2.105 52133 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:01.301223 0.067577 tcp 10.0.2.105 52134 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:01.369068 0.152939 tcp 10.0.2.105 52135 -> 195.113.214.249 443 SRPA* 0 0 23 13998 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:01.817370 3.953677 tcp 10.0.2.105 52136 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:04.942253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:02:05.361034 0.063765 tcp 10.0.2.105 52137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:05.425074 0.064568 tcp 10.0.2.105 52138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:05.489986 0.149048 tcp 10.0.2.105 52139 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:05.771262 2.996310 tcp 10.0.2.105 52140 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:14.766553 0.000000 tcp 10.0.2.105 52140 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:20.765490 0.063817 tcp 10.0.2.105 52141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:20.829644 0.062819 tcp 10.0.2.105 52142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:20.892754 0.154124 tcp 10.0.2.105 52143 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:21.186916 3.002632 tcp 10.0.2.105 52144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:30.188890 0.000000 tcp 10.0.2.105 52144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:36.187419 3.004072 tcp 10.0.2.105 52145 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:45.189922 0.000000 tcp 10.0.2.105 52145 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:02:49.876386 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:02:51.188915 3.560770 tcp 10.0.2.105 52146 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:02:54.749905 2.998259 tcp 10.0.2.105 52147 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:03:03.746776 0.000000 tcp 10.0.2.105 52147 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:08.948470 3.001947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:08:09.747473 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:08:09.747578 3.003322 tcp 10.0.2.105 52148 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:15.955557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:08:18.749664 0.000000 tcp 10.0.2.105 52148 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:23.957229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:08:24.750685 0.065153 tcp 10.0.2.105 52149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:24.816145 0.065541 tcp 10.0.2.105 52150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:24.881991 0.155310 tcp 10.0.2.105 52151 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:25.073673 2.999671 tcp 10.0.2.105 52152 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:34.081808 0.000000 tcp 10.0.2.105 52152 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:39.960180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:08:40.070912 0.151974 tcp 10.0.2.105 52153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:40.223174 0.061410 tcp 10.0.2.105 52154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:40.284859 0.152879 tcp 10.0.2.105 52155 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:40.575613 2.206324 tcp 10.0.2.105 52156 -> 46.48.223.67 15494 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:42.317342 0.063565 tcp 10.0.2.105 52157 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:42.381277 0.066724 tcp 10.0.2.105 52158 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:42.447861 0.163024 tcp 10.0.2.105 52159 -> 195.113.214.249 443 SRPA* 0 0 84 69436 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:42.782230 2.980120 tcp 10.0.2.105 52160 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:51.727337 0.000000 tcp 10.0.2.105 52160 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:08:57.726406 0.061111 tcp 10.0.2.105 52161 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:57.787890 0.065917 tcp 10.0.2.105 52162 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:57.853745 0.158140 tcp 10.0.2.105 52163 -> 195.113.214.249 443 SRPA* 0 0 41 21204 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:08:58.121225 2.999477 tcp 10.0.2.105 52164 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:09:07.119240 0.000000 tcp 10.0.2.105 52164 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:09:11.965695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:09:13.118205 3.004013 tcp 10.0.2.105 52165 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:09:22.120969 0.000000 tcp 10.0.2.105 52165 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:09:28.180081 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:09:29.409570 1.773277 tcp 10.0.2.105 52166 -> 46.48.223.67 15494 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:09:31.183087 2.958405 tcp 10.0.2.105 52167 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:09:40.069687 0.000000 tcp 10.0.2.105 52167 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:15:15.973164 3.000687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 14:15:22.979749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:15:31.199159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:15:47.050482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:16:19.000589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:18:14.696422 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:18:14.696626 0.000000 udp 10.0.2.105 7010 -> 176.73.226.233 1530 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:18:32.323412 0.064259 tcp 10.0.2.105 52168 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:32.387973 0.065557 tcp 10.0.2.105 52169 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:32.453859 0.147701 tcp 10.0.2.105 52170 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:32.602329 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:18:51.580507 0.064027 tcp 10.0.2.105 52171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:51.644816 0.066617 tcp 10.0.2.105 52172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:51.711796 0.158745 tcp 10.0.2.105 52173 -> 195.113.214.249 443 SRPA* 0 0 41 21414 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:18:51.870050 0.222161 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:18:52.088448 0.206781 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:18:52.512538 0.167819 udp 10.0.2.105 7010 <-> 174.93.182.228 8886 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:18:52.658539 0.000000 udp 10.0.2.105 7010 -> 84.119.231.128 3741 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:18:59.941958 2.996732 tcp 10.0.2.105 52174 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:19:08.936754 0.000000 tcp 10.0.2.105 52174 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:19:10.848085 0.066841 tcp 10.0.2.105 52175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:10.915208 0.067494 tcp 10.0.2.105 52176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:10.983090 0.166325 tcp 10.0.2.105 52177 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:11.150073 0.193111 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:11.314001 0.125343 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:11.487749 0.187160 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:11.651097 0.111728 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:11.838622 0.181808 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:12.013470 0.174160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:12.679210 0.181376 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:13.016534 0.000000 udp 10.0.2.105 7010 -> 24.172.31.174 1679 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:19:14.943148 0.064040 tcp 10.0.2.105 52178 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:15.007505 0.065384 tcp 10.0.2.105 52179 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:15.073219 0.176946 tcp 10.0.2.105 52180 -> 195.113.214.249 443 SRPA* 0 0 72 76744 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:15.787325 2.036715 tcp 10.0.2.105 52181 -> 46.48.223.67 15494 FSPA* 0 0 12 1531 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:17.514099 0.060619 tcp 10.0.2.105 52182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:17.575042 0.065029 tcp 10.0.2.105 52183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:17.640407 0.156031 tcp 10.0.2.105 52184 -> 195.113.214.249 443 SRPA* 0 0 29 12006 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:17.824465 3.007218 tcp 10.0.2.105 52185 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:19:26.830251 0.000000 tcp 10.0.2.105 52185 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:19:29.467475 0.061495 tcp 10.0.2.105 52186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:29.529248 0.061447 tcp 10.0.2.105 52187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:29.590989 0.183279 tcp 10.0.2.105 52188 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:29.775011 0.222089 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:29.990191 0.190263 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2566 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:30.481930 0.168761 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:30.723644 0.438848 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:31.133499 0.182728 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:31.332218 0.058390 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:31.388213 0.202188 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:31.640540 0.350064 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:31.987194 0.056613 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:32.226159 0.186826 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:32.405542 0.091871 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:32.604070 0.174813 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:32.788019 0.299270 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:32.818418 0.343927 tcp 10.0.2.105 52189 -> 46.48.223.67 15494 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:33.086722 0.169911 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2595 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:35.019934 0.088918 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:35.092639 0.193062 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:35.218434 0.240211 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:36.249887 0.233177 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:36.476304 0.022279 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:36.507416 0.144038 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:19:36.604677 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:19:38.045130 0.000387 tcp 10.0.2.105 52189 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:52.056624 0.065970 tcp 10.0.2.105 52190 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:52.122878 0.063952 tcp 10.0.2.105 52191 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:52.187134 0.157042 tcp 10.0.2.105 52192 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:19:52.344742 0.000000 udp 10.0.2.105 7010 -> 87.139.192.113 3162 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:20:10.203346 0.064233 tcp 10.0.2.105 52193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:20:10.267429 0.061656 tcp 10.0.2.105 52194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:20:10.329368 0.146157 tcp 10.0.2.105 52195 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:20:10.476053 0.085857 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:20:10.542263 0.082954 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:20:11.090721 0.477377 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:20:11.537989 0.198837 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:22:23.006382 3.001402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:22:30.013688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:22:38.015084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:22:54.018304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:23:26.024135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:24:38.038257 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:24:38.038371 3.003433 tcp 10.0.2.105 52196 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:24:47.040083 0.000000 tcp 10.0.2.105 52196 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:24:53.041187 0.065109 tcp 10.0.2.105 52197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:24:53.106623 0.062816 tcp 10.0.2.105 52198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:24:53.169718 0.155032 tcp 10.0.2.105 52199 -> 195.113.214.249 443 SRPA* 0 0 42 22726 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:24:53.547369 2.996917 tcp 10.0.2.105 52200 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:02.552929 0.000000 tcp 10.0.2.105 52200 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:08.542478 0.192465 tcp 10.0.2.105 52201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:08.735264 0.065887 tcp 10.0.2.105 52202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:08.801418 0.152074 tcp 10.0.2.105 52203 -> 195.113.214.249 443 SRPA* 0 0 36 20144 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:09.100421 2.782203 tcp 10.0.2.105 52204 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:10.857211 0.061433 tcp 10.0.2.105 52205 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:10.918927 0.063381 tcp 10.0.2.105 52206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:10.982232 0.152439 tcp 10.0.2.105 52207 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:11.883028 2.984109 tcp 10.0.2.105 52208 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:20.819879 0.000000 tcp 10.0.2.105 52208 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:26.788493 0.061090 tcp 10.0.2.105 52209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:26.849869 0.065125 tcp 10.0.2.105 52210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:26.915357 0.153692 tcp 10.0.2.105 52211 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:27.283338 3.009426 tcp 10.0.2.105 52212 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:36.301481 0.000000 tcp 10.0.2.105 52212 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:42.280458 2.994059 tcp 10.0.2.105 52213 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:51.282974 0.000000 tcp 10.0.2.105 52213 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:25:55.879479 0.000150 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:25:57.281985 1.743215 tcp 10.0.2.105 52214 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:25:59.025116 3.003438 tcp 10.0.2.105 52215 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:26:08.026856 0.000000 tcp 10.0.2.105 52215 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:29:30.031191 3.000195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:29:37.037655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:29:45.039117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:30:01.041913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:30:33.048073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:31:14.027341 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:31:14.027443 3.003842 tcp 10.0.2.105 52216 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:31:23.032172 0.000000 tcp 10.0.2.105 52216 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:31:29.030264 1.661768 tcp 10.0.2.105 52217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:30.692333 0.061092 tcp 10.0.2.105 52218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:30.753733 0.162198 tcp 10.0.2.105 52219 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:31.516404 2.951327 tcp 10.0.2.105 52220 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:31:40.406061 0.000000 tcp 10.0.2.105 52220 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:31:46.335349 0.064604 tcp 10.0.2.105 52221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:46.400263 0.062976 tcp 10.0.2.105 52222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:46.463493 0.153082 tcp 10.0.2.105 52223 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:47.004645 2.412819 tcp 10.0.2.105 52224 -> 46.48.223.67 15494 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:49.057818 0.063941 tcp 10.0.2.105 52225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:49.122083 0.063694 tcp 10.0.2.105 52226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:49.186129 0.165510 tcp 10.0.2.105 52227 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:31:49.417730 2.976429 tcp 10.0.2.105 52228 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:31:58.319587 0.000000 tcp 10.0.2.105 52228 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:04.234098 0.064394 tcp 10.0.2.105 52229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:32:04.298765 0.063844 tcp 10.0.2.105 52230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:32:04.362963 0.154691 tcp 10.0.2.105 52231 -> 195.113.214.249 443 SRPA* 0 0 25 13040 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:32:04.653889 2.967122 tcp 10.0.2.105 52232 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:13.548100 0.000000 tcp 10.0.2.105 52232 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:19.473036 2.959325 tcp 10.0.2.105 52233 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:28.368345 0.000000 tcp 10.0.2.105 52233 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:33.215104 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:32:34.294953 0.350470 tcp 10.0.2.105 52234 -> 46.48.223.67 15494 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:32:40.995513 0.000368 tcp 10.0.2.105 52234 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:32:40.996146 2.953180 tcp 10.0.2.105 52235 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:32:49.881980 0.000000 tcp 10.0.2.105 52235 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:36:37.055787 2.999709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:36:44.061591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:36:52.885271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:37:08.691617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:37:40.327344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:37:55.319503 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:37:55.319668 2.964412 tcp 10.0.2.105 52236 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:04.256902 0.000000 tcp 10.0.2.105 52236 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:10.257776 0.064915 tcp 10.0.2.105 52237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:10.322986 0.065289 tcp 10.0.2.105 52238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:10.388545 0.165996 tcp 10.0.2.105 52239 -> 195.113.214.249 443 SRPA* 0 0 42 23654 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:10.846445 3.004125 tcp 10.0.2.105 52240 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:19.849266 0.000000 tcp 10.0.2.105 52240 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:25.848437 0.060227 tcp 10.0.2.105 52241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:25.908922 0.061650 tcp 10.0.2.105 52242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:25.970977 0.156053 tcp 10.0.2.105 52243 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:26.514256 2.217037 tcp 10.0.2.105 52244 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:28.273426 0.063696 tcp 10.0.2.105 52245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:28.337418 0.061628 tcp 10.0.2.105 52246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:28.399313 0.149987 tcp 10.0.2.105 52247 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:28.731578 2.994587 tcp 10.0.2.105 52248 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:37.724954 0.000000 tcp 10.0.2.105 52248 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:43.724055 0.067386 tcp 10.0.2.105 52249 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:43.791734 0.064402 tcp 10.0.2.105 52250 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:43.856047 0.155903 tcp 10.0.2.105 52251 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:38:44.244648 3.004113 tcp 10.0.2.105 52252 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:53.247417 0.000000 tcp 10.0.2.105 52252 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:38:59.245620 3.004421 tcp 10.0.2.105 52253 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:39:08.248845 0.000000 tcp 10.0.2.105 52253 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:39:12.875619 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:39:14.247711 1.739698 tcp 10.0.2.105 52254 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:39:15.987692 2.996482 tcp 10.0.2.105 52255 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:39:24.992812 0.000000 tcp 10.0.2.105 52255 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:43:44.087886 3.001894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:43:51.094979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:43:59.096869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:44:15.100017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:44:30.983340 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:44:30.983450 3.004011 tcp 10.0.2.105 52256 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:44:39.985188 0.000000 tcp 10.0.2.105 52256 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:44:45.985885 0.068924 tcp 10.0.2.105 52257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:44:46.055078 0.068548 tcp 10.0.2.105 52258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:44:46.123880 0.162644 tcp 10.0.2.105 52259 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:44:46.649227 3.002056 tcp 10.0.2.105 52260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:44:47.106393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:44:55.648524 0.000000 tcp 10.0.2.105 52260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:01.647689 0.066678 tcp 10.0.2.105 52261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:01.714696 0.064002 tcp 10.0.2.105 52262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:01.778555 0.158712 tcp 10.0.2.105 52263 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:02.114365 3.748426 tcp 10.0.2.105 52264 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:05.190065 0.066151 tcp 10.0.2.105 52265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:05.256516 0.065868 tcp 10.0.2.105 52266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:05.322637 0.152854 tcp 10.0.2.105 52267 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:05.863091 3.003997 tcp 10.0.2.105 52268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:14.865970 0.000000 tcp 10.0.2.105 52268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:20.865331 0.065216 tcp 10.0.2.105 52269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:20.930831 0.062098 tcp 10.0.2.105 52270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:20.993195 0.162768 tcp 10.0.2.105 52271 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:21.289453 3.000318 tcp 10.0.2.105 52272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:30.531830 0.000000 tcp 10.0.2.105 52272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:36.471780 2.979331 tcp 10.0.2.105 52273 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:45.390849 0.000000 tcp 10.0.2.105 52273 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:45:49.928262 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:45:51.329906 3.287618 tcp 10.0.2.105 52274 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:45:54.617821 2.989503 tcp 10.0.2.105 52275 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:46:03.606153 0.000000 tcp 10.0.2.105 52275 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:50:37.339764 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:50:37.339851 0.000000 udp 10.0.2.105 7010 -> 84.119.231.128 3741 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:50:54.255447 0.651468 tcp 10.0.2.105 52276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:50:54.907179 0.069948 tcp 10.0.2.105 52277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:50:54.977435 0.157111 tcp 10.0.2.105 52278 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:50:55.135167 0.152896 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:50:55.742181 0.000000 udp 10.0.2.105 7010 -> 87.139.192.113 3162 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:51:09.606515 3.003995 tcp 10.0.2.105 52279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:51:12.621158 0.063175 tcp 10.0.2.105 52280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:12.684620 0.070354 tcp 10.0.2.105 52281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:12.755271 0.153558 tcp 10.0.2.105 52282 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:12.909441 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:51:18.608757 0.000000 tcp 10.0.2.105 52279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:51:24.608165 0.121079 tcp 10.0.2.105 52283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:24.729567 0.061646 tcp 10.0.2.105 52284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:24.791519 0.160421 tcp 10.0.2.105 52285 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:25.037642 2.987220 tcp 10.0.2.105 52286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:51:28.184801 0.064261 tcp 10.0.2.105 52287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:28.249372 0.063694 tcp 10.0.2.105 52288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:28.313375 0.151105 tcp 10.0.2.105 52289 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:28.465220 0.222894 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:28.684899 0.000000 udp 10.0.2.105 7010 -> 174.93.182.228 8886 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:51:33.990919 0.000000 tcp 10.0.2.105 52286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:51:46.293751 0.064132 tcp 10.0.2.105 52290 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:46.358178 0.062579 tcp 10.0.2.105 52291 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:46.421101 0.160447 tcp 10.0.2.105 52292 -> 195.113.214.249 443 SRPA* 0 0 38 30950 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:51:46.582064 0.203510 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:46.776739 0.179940 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:46.967506 0.112237 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:47.047462 0.183670 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:47.202952 0.184164 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:47.418576 0.124643 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:47.733699 0.172770 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:47.903068 0.177167 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:48.054929 0.212898 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:48.259993 0.169114 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:48.408879 0.186602 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:48.607860 0.356566 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:48.936091 0.353251 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:51:49.477218 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 14:52:06.608983 0.064715 tcp 10.0.2.105 52293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:52:06.673966 0.064927 tcp 10.0.2.105 52294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:52:06.739156 0.158149 tcp 10.0.2.105 52295 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:52:06.897936 0.182205 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:07.075267 0.057929 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:07.362397 0.201442 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:07.838253 0.293053 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:08.334330 0.083610 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:08.381446 0.185060 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:08.568759 0.177402 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:08.742014 0.166348 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:09.078224 0.083234 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:09.146483 0.188587 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:09.352223 0.127728 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:09.816152 0.023961 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:09.841145 0.255409 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:10.074278 0.237874 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2643 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:10.303851 0.083003 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:10.432380 0.085652 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:10.496768 0.490359 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:52:10.960128 0.198324 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/16 14:55:59.116005 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 14:56:06.124851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:56:14.123858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:56:30.126738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:56:39.981434 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:56:39.981571 2.993717 tcp 10.0.2.105 52296 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:56:48.974038 0.000000 tcp 10.0.2.105 52296 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:56:54.983793 0.201034 tcp 10.0.2.105 52297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:56:55.185098 0.068393 tcp 10.0.2.105 52298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:56:55.253785 0.163412 tcp 10.0.2.105 52299 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:56:55.826347 2.976447 tcp 10.0.2.105 52300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:02.203046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 14:57:04.751887 0.000000 tcp 10.0.2.105 52300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:10.705161 0.064416 tcp 10.0.2.105 52301 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:10.769865 0.061894 tcp 10.0.2.105 52302 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:10.832119 0.161062 tcp 10.0.2.105 52303 -> 195.113.214.249 443 SRPA* 0 0 20 11306 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:11.288690 4.038504 tcp 10.0.2.105 52304 -> 46.48.223.67 15494 FSPA* 0 0 14 1766 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:14.760002 0.064709 tcp 10.0.2.105 52305 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:14.824976 0.065553 tcp 10.0.2.105 52306 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:14.890830 0.175602 tcp 10.0.2.105 52307 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:15.327460 2.999012 tcp 10.0.2.105 52308 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:24.324716 0.000000 tcp 10.0.2.105 52308 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:30.323894 1.418563 tcp 10.0.2.105 52309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:31.742771 0.064072 tcp 10.0.2.105 52310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:31.807194 0.156316 tcp 10.0.2.105 52311 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:57:32.338827 2.971337 tcp 10.0.2.105 52312 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:41.334975 0.000000 tcp 10.0.2.105 52312 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:47.256059 2.976290 tcp 10.0.2.105 52313 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:57:56.158027 0.000000 tcp 10.0.2.105 52313 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:58:00.973435 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 14:58:02.084655 3.548205 tcp 10.0.2.105 52314 -> 46.48.223.67 15494 FSPA* 0 0 14 1766 flow=From-Botnet-V2-TCP-Established 1970/02/16 14:58:05.633177 2.958852 tcp 10.0.2.105 52315 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 14:58:14.520963 0.000000 tcp 10.0.2.105 52315 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:03:06.138867 3.002049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:03:13.146194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:03:19.586128 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:03:19.586239 3.003720 tcp 10.0.2.105 52316 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:03:21.147729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:03:28.588619 0.000000 tcp 10.0.2.105 52316 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:03:34.588994 0.061701 tcp 10.0.2.105 52317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:34.650960 0.063831 tcp 10.0.2.105 52318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:34.715107 0.156330 tcp 10.0.2.105 52319 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:35.006376 3.005632 tcp 10.0.2.105 52320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:03:37.150631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:03:44.010796 0.000000 tcp 10.0.2.105 52320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:03:50.000444 0.062201 tcp 10.0.2.105 52321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:50.062930 0.114835 tcp 10.0.2.105 52322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:50.177609 0.156645 tcp 10.0.2.105 52323 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:50.590876 3.985548 tcp 10.0.2.105 52324 -> 46.48.223.67 15494 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:54.184437 0.061578 tcp 10.0.2.105 52325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:54.246382 0.063666 tcp 10.0.2.105 52326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:54.310396 0.156563 tcp 10.0.2.105 52327 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:03:54.576693 3.003480 tcp 10.0.2.105 52328 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:03.578921 0.000000 tcp 10.0.2.105 52328 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:09.156808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:04:09.577951 0.061423 tcp 10.0.2.105 52329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:04:09.639648 0.066018 tcp 10.0.2.105 52330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:04:09.705948 0.155134 tcp 10.0.2.105 52331 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:04:09.986978 3.005431 tcp 10.0.2.105 52332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:18.990741 0.000000 tcp 10.0.2.105 52332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:24.979703 2.994146 tcp 10.0.2.105 52333 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:33.982067 0.000000 tcp 10.0.2.105 52333 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:38.879708 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:04:39.981301 3.611549 tcp 10.0.2.105 52334 -> 46.48.223.67 15494 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:04:43.593074 3.007545 tcp 10.0.2.105 52335 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:04:52.599249 0.000000 tcp 10.0.2.105 52335 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:09:58.589936 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:09:58.590049 2.993381 tcp 10.0.2.105 52336 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:07.592280 0.000000 tcp 10.0.2.105 52336 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:13.593233 0.067874 tcp 10.0.2.105 52337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:13.661366 0.068057 tcp 10.0.2.105 52338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:13.729702 0.149771 tcp 10.0.2.105 52339 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:13.944107 3.001045 tcp 10.0.2.105 52340 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:16.167254 3.001709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:10:22.944101 0.000000 tcp 10.0.2.105 52340 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:23.174721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:10:28.943247 0.060769 tcp 10.0.2.105 52341 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:29.004337 0.060821 tcp 10.0.2.105 52342 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:29.065448 0.150511 tcp 10.0.2.105 52343 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:29.744301 4.066296 tcp 10.0.2.105 52344 -> 46.48.223.67 15494 FSPA* 0 0 12 1645 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:31.175483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:10:33.335894 0.060595 tcp 10.0.2.105 52345 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:33.396775 0.062529 tcp 10.0.2.105 52346 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:33.459664 0.156214 tcp 10.0.2.105 52347 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:33.810828 2.993138 tcp 10.0.2.105 52348 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:42.812627 0.000000 tcp 10.0.2.105 52348 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:47.179073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:10:48.812049 0.060123 tcp 10.0.2.105 52349 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:48.871952 0.062111 tcp 10.0.2.105 52350 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:48.934380 0.155342 tcp 10.0.2.105 52351 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:10:49.123594 3.002447 tcp 10.0.2.105 52352 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:10:58.138495 0.000000 tcp 10.0.2.105 52352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:11:04.123657 3.004924 tcp 10.0.2.105 52353 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:11:13.126464 0.000000 tcp 10.0.2.105 52353 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:11:17.872718 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:11:19.125001 1.771448 tcp 10.0.2.105 52354 -> 46.48.223.67 15494 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:11:19.184956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:11:20.896689 3.005133 tcp 10.0.2.105 52355 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:11:29.899949 0.000000 tcp 10.0.2.105 52355 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:16:35.890922 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:16:35.891121 2.993855 tcp 10.0.2.105 52356 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:16:44.883370 0.000000 tcp 10.0.2.105 52356 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:16:50.893732 0.060909 tcp 10.0.2.105 52357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:16:50.954903 0.061657 tcp 10.0.2.105 52358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:16:51.016906 0.159254 tcp 10.0.2.105 52359 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:16:51.285084 2.991924 tcp 10.0.2.105 52360 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:00.275227 0.000000 tcp 10.0.2.105 52360 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:06.284414 0.060817 tcp 10.0.2.105 52361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:06.345599 0.061818 tcp 10.0.2.105 52362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:06.407659 0.165403 tcp 10.0.2.105 52363 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:06.953677 2.257300 tcp 10.0.2.105 52364 -> 46.48.223.67 15494 FSPA* 0 0 14 1759 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:08.744536 0.065283 tcp 10.0.2.105 52365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:08.810088 0.061539 tcp 10.0.2.105 52366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:08.871921 0.155045 tcp 10.0.2.105 52367 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:09.211218 3.001337 tcp 10.0.2.105 52368 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:18.211308 0.000000 tcp 10.0.2.105 52368 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:23.190989 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:17:24.210521 0.062928 tcp 10.0.2.105 52369 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:24.273738 0.067725 tcp 10.0.2.105 52370 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:24.341756 0.160795 tcp 10.0.2.105 52371 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:24.683348 3.003241 tcp 10.0.2.105 52372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:30.198798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:17:33.683655 0.000000 tcp 10.0.2.105 52372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:38.201286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:17:39.682268 2.994370 tcp 10.0.2.105 52373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:48.675090 0.000000 tcp 10.0.2.105 52373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:17:53.382016 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:17:54.203181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:17:54.683930 3.694776 tcp 10.0.2.105 52374 -> 46.48.223.67 15494 FSPA* 0 0 14 1759 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:17:58.378943 2.994506 tcp 10.0.2.105 52375 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:18:07.381876 0.000000 tcp 10.0.2.105 52375 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:18:26.209028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:22:20.536614 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:22:20.536744 0.000000 udp 10.0.2.105 7010 -> 174.93.182.228 8886 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 15:22:35.729860 0.064055 tcp 10.0.2.105 52376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:35.794168 0.069271 tcp 10.0.2.105 52377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:35.863792 0.156608 tcp 10.0.2.105 52378 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:36.019158 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 15:22:53.896814 0.064360 tcp 10.0.2.105 52379 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:53.961145 0.065274 tcp 10.0.2.105 52380 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:54.026677 0.150959 tcp 10.0.2.105 52381 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:22:54.178265 0.152528 udp 10.0.2.105 7010 <-> 24.172.31.174 1679 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:54.793598 0.213458 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.003546 0.204204 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.212583 0.192095 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.375976 0.182043 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.533077 0.115613 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.803955 0.182627 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:55.978812 0.180219 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:56.384896 0.124033 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:56.489308 0.172253 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:56.658472 0.170649 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:56.808912 0.213384 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:57.013886 0.189460 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:57.200319 0.368926 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:57.541517 0.353480 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:57.891129 0.182627 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:58.068942 0.058335 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:58.340047 0.201185 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:58.608764 0.327778 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:59.076885 0.176628 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:59.250474 0.086639 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:59.491323 0.221697 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:59.770838 0.201621 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:22:59.910389 0.166907 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.054708 0.084929 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.350420 0.141943 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.447217 0.021606 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.557024 0.239520 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.777940 0.085818 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:00.998759 0.234396 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:01.369097 1.692348 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:03.041858 0.467871 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:03.484957 0.195226 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:23:13.382286 2.993823 tcp 10.0.2.105 52382 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:23:18.378830 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:23:22.374955 0.000000 tcp 10.0.2.105 52382 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:23:28.384376 0.068693 tcp 10.0.2.105 52383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:28.453425 0.066454 tcp 10.0.2.105 52384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:28.520138 0.160310 tcp 10.0.2.105 52385 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:29.007737 3.001058 tcp 10.0.2.105 52386 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:23:38.007851 0.000000 tcp 10.0.2.105 52386 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:23:44.006800 0.062083 tcp 10.0.2.105 52387 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:44.069174 0.061584 tcp 10.0.2.105 52388 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:44.131051 0.150441 tcp 10.0.2.105 52389 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:44.532632 4.049395 tcp 10.0.2.105 52390 -> 46.48.223.67 15494 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:48.212664 0.063321 tcp 10.0.2.105 52391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:48.275890 0.065339 tcp 10.0.2.105 52392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:48.341484 0.159101 tcp 10.0.2.105 52393 -> 195.113.214.249 443 SRPA* 0 0 32 22198 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:23:48.582332 2.994695 tcp 10.0.2.105 52394 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:23:57.575496 0.000000 tcp 10.0.2.105 52394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:03.574271 0.065710 tcp 10.0.2.105 52395 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:24:03.640414 0.060746 tcp 10.0.2.105 52396 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:24:03.701464 0.155676 tcp 10.0.2.105 52397 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:24:04.043992 3.005124 tcp 10.0.2.105 52398 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:13.048668 0.000000 tcp 10.0.2.105 52398 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:19.036665 3.004471 tcp 10.0.2.105 52399 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:28.039264 0.000000 tcp 10.0.2.105 52399 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:30.215454 3.001439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:24:32.876362 0.000327 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:24:34.038180 3.577264 tcp 10.0.2.105 52400 -> 46.48.223.67 15494 FSPA* 0 0 14 1690 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:24:37.222659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:24:37.615285 3.002005 tcp 10.0.2.105 52401 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:24:45.224053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:24:46.616015 0.000000 tcp 10.0.2.105 52401 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:25:01.227139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:25:33.233247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:29:52.616844 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:29:52.616933 3.004610 tcp 10.0.2.105 52402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:01.618679 0.000000 tcp 10.0.2.105 52402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:07.619920 0.065840 tcp 10.0.2.105 52403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:07.686086 0.062264 tcp 10.0.2.105 52404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:07.748188 0.157670 tcp 10.0.2.105 52405 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:08.210692 3.006236 tcp 10.0.2.105 52406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:17.211323 0.000000 tcp 10.0.2.105 52406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:23.210613 0.062270 tcp 10.0.2.105 52407 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:23.273205 0.063031 tcp 10.0.2.105 52408 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:23.336621 0.160091 tcp 10.0.2.105 52409 -> 195.113.214.249 443 SRPA* 0 0 27 17528 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:23.885770 2.134588 tcp 10.0.2.105 52410 -> 46.48.223.67 15494 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:25.581218 0.063157 tcp 10.0.2.105 52411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:25.644668 0.060937 tcp 10.0.2.105 52412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:25.705941 0.150754 tcp 10.0.2.105 52413 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:26.020673 2.997910 tcp 10.0.2.105 52414 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:35.016627 0.000000 tcp 10.0.2.105 52414 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:41.015753 0.063699 tcp 10.0.2.105 52415 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:41.079719 0.064201 tcp 10.0.2.105 52416 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:41.144274 0.159719 tcp 10.0.2.105 52417 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:30:41.459789 3.000424 tcp 10.0.2.105 52418 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:50.459094 0.000000 tcp 10.0.2.105 52418 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:30:56.458173 3.004403 tcp 10.0.2.105 52419 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:31:05.460813 0.000000 tcp 10.0.2.105 52419 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:31:10.380709 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:31:11.460786 3.612010 tcp 10.0.2.105 52420 -> 46.48.223.67 15494 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:31:15.073007 2.995750 tcp 10.0.2.105 52421 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:31:24.067490 0.000000 tcp 10.0.2.105 52421 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:31:37.238617 3.002298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:31:44.246474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:31:52.248129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:32:08.251112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:32:40.257345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:36:30.071612 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:36:30.071790 2.999932 tcp 10.0.2.105 52422 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:36:39.070180 0.000000 tcp 10.0.2.105 52422 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:36:45.070521 0.061257 tcp 10.0.2.105 52423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:36:45.132066 0.065732 tcp 10.0.2.105 52424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:36:45.198153 0.151226 tcp 10.0.2.105 52425 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:36:46.112792 2.991557 tcp 10.0.2.105 52426 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:36:55.103467 0.000000 tcp 10.0.2.105 52426 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:01.112712 0.063220 tcp 10.0.2.105 52427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:01.176214 0.064887 tcp 10.0.2.105 52428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:01.241360 0.151662 tcp 10.0.2.105 52429 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:01.686261 4.317321 tcp 10.0.2.105 52430 -> 46.48.223.67 15494 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:05.303756 0.063078 tcp 10.0.2.105 52431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:05.366708 0.067329 tcp 10.0.2.105 52432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:05.434320 0.157371 tcp 10.0.2.105 52433 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:06.003785 2.999633 tcp 10.0.2.105 52434 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:15.011877 0.000000 tcp 10.0.2.105 52434 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:21.001666 0.061068 tcp 10.0.2.105 52435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:21.062599 0.065041 tcp 10.0.2.105 52436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:21.127944 0.151801 tcp 10.0.2.105 52437 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:21.808531 2.997684 tcp 10.0.2.105 52438 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:30.804573 0.000000 tcp 10.0.2.105 52438 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:36.803691 3.004020 tcp 10.0.2.105 52439 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:45.805900 0.000000 tcp 10.0.2.105 52439 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:37:50.372948 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:37:51.804933 3.689459 tcp 10.0.2.105 52440 -> 46.48.223.67 15494 FSPA* 0 0 12 1551 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:37:55.494684 2.999910 tcp 10.0.2.105 52441 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:38:04.509573 0.000000 tcp 10.0.2.105 52441 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:38:44.264438 3.000692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:38:51.270700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:38:59.272082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:39:15.274893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:39:47.281034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:43:10.493755 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:43:10.493851 3.003455 tcp 10.0.2.105 52442 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:43:19.496218 0.000000 tcp 10.0.2.105 52442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:43:25.496622 0.062996 tcp 10.0.2.105 52443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:25.559930 0.068842 tcp 10.0.2.105 52444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:25.629052 0.170889 tcp 10.0.2.105 52445 -> 195.113.214.249 443 SRPA* 0 0 74 78274 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:26.358384 3.002225 tcp 10.0.2.105 52446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:43:35.358721 0.000000 tcp 10.0.2.105 52446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:43:41.358188 0.063664 tcp 10.0.2.105 52447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:41.422231 0.066815 tcp 10.0.2.105 52448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:41.489334 0.151195 tcp 10.0.2.105 52449 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:41.850855 4.059279 tcp 10.0.2.105 52450 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:45.486890 0.061131 tcp 10.0.2.105 52451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:45.548297 0.062091 tcp 10.0.2.105 52452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:45.610818 0.153361 tcp 10.0.2.105 52453 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:43:45.910359 2.997806 tcp 10.0.2.105 52454 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:43:54.907051 0.000000 tcp 10.0.2.105 52454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:00.906491 0.066110 tcp 10.0.2.105 52455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:44:00.972962 0.065420 tcp 10.0.2.105 52456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:44:01.038715 0.158017 tcp 10.0.2.105 52457 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:44:01.475909 3.005163 tcp 10.0.2.105 52458 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:10.480966 0.000000 tcp 10.0.2.105 52458 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:16.468506 3.004039 tcp 10.0.2.105 52459 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:25.471511 0.000000 tcp 10.0.2.105 52459 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:30.378125 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:44:31.469577 1.745697 tcp 10.0.2.105 52460 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:44:33.215570 3.000219 tcp 10.0.2.105 52461 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:44:42.215213 0.000000 tcp 10.0.2.105 52461 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:45:51.288102 3.000463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:45:58.294686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:46:06.295780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:46:22.299054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:46:54.304931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:53:11.501431 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:53:11.501579 0.000000 udp 10.0.2.105 7010 -> 24.172.31.174 1679 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 15:53:27.113362 0.064714 tcp 10.0.2.105 52462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:27.178385 0.060816 tcp 10.0.2.105 52463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:27.239511 0.148340 tcp 10.0.2.105 52464 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:27.388565 0.212765 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:27.597854 0.188463 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:27.795860 0.112361 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:27.874360 0.182593 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:28.062630 0.205343 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2582 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:28.259404 0.189970 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:28.599018 0.188752 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:29.513291 0.123252 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:29.618259 0.174187 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:29.941072 0.168391 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:30.236020 0.214932 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:30.444124 0.353335 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:30.896768 0.181570 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:31.073395 0.191293 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:31.565781 0.372128 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:31.909702 0.059204 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:32.147470 0.201143 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:32.613562 0.344837 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:32.959376 0.186773 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:33.138936 0.190995 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:33.238970 3.006135 tcp 10.0.2.105 52465 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:53:33.269751 0.167795 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:33.437812 0.175395 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:33.609729 0.083923 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:33.982703 0.106563 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:34.075634 0.127898 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:34.330674 0.024136 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:34.535174 0.258321 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:34.771927 0.085753 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:34.893666 0.233913 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:35.117211 0.083499 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:35.345542 0.445633 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:35.766812 0.196563 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/16 15:53:42.251679 0.000000 tcp 10.0.2.105 52465 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:53:48.240524 0.061635 tcp 10.0.2.105 52466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:48.302535 0.062853 tcp 10.0.2.105 52467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:48.365256 0.156283 tcp 10.0.2.105 52468 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:53:48.832069 2.993227 tcp 10.0.2.105 52469 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:53:57.823786 0.000000 tcp 10.0.2.105 52469 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:54:03.833391 0.061498 tcp 10.0.2.105 52470 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:54:03.894736 0.062566 tcp 10.0.2.105 52471 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:54:03.957560 0.155569 tcp 10.0.2.105 52472 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:54:04.811169 2.996846 tcp 10.0.2.105 52473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:54:13.806886 0.000000 tcp 10.0.2.105 52473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:54:19.805891 3.003652 tcp 10.0.2.105 52474 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:54:29.177810 0.000000 tcp 10.0.2.105 52474 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:54:33.702305 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:57:04.314762 3.001350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 15:57:11.322061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:57:19.323539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:57:35.330511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:58:07.332893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 15:59:34.809142 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 15:59:34.809275 3.010551 tcp 10.0.2.105 52475 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:59:43.812279 0.000000 tcp 10.0.2.105 52475 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:59:49.811476 0.062897 tcp 10.0.2.105 52476 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:59:49.874647 0.061341 tcp 10.0.2.105 52477 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:59:49.936419 0.155969 tcp 10.0.2.105 52478 -> 195.113.214.249 443 SRPA* 0 0 20 11520 flow=From-Botnet-V2-TCP-Established 1970/02/16 15:59:50.549489 2.996019 tcp 10.0.2.105 52479 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 15:59:59.544641 0.000000 tcp 10.0.2.105 52479 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:05.543495 0.065999 tcp 10.0.2.105 52480 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:05.609801 0.066332 tcp 10.0.2.105 52481 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:05.676490 0.154144 tcp 10.0.2.105 52482 -> 195.113.214.249 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:06.001748 3.966454 tcp 10.0.2.105 52483 -> 46.48.223.67 15494 FSPA* 0 0 13 1480 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:09.539837 0.066616 tcp 10.0.2.105 52484 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:09.606885 0.066091 tcp 10.0.2.105 52485 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:09.673339 0.161900 tcp 10.0.2.105 52486 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:09.968443 2.994318 tcp 10.0.2.105 52487 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:14.509208 0.000156 tcp 10.0.2.105 52483 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:18.971692 0.000000 tcp 10.0.2.105 52487 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:24.963673 0.060147 tcp 10.0.2.105 52488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:25.024120 0.064517 tcp 10.0.2.105 52489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:25.088944 0.155402 tcp 10.0.2.105 52490 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:00:25.652236 2.993702 tcp 10.0.2.105 52491 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:34.644328 0.000000 tcp 10.0.2.105 52491 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:40.645417 3.001942 tcp 10.0.2.105 52492 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:49.833678 0.000000 tcp 10.0.2.105 52492 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:00:54.515852 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:00:55.775959 0.343657 tcp 10.0.2.105 52493 -> 46.48.223.67 15494 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:01:18.181420 0.008032 tcp 10.0.2.105 52493 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:01:18.182042 2.999201 tcp 10.0.2.105 52494 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:01:27.179885 0.000000 tcp 10.0.2.105 52494 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:04:11.338917 3.001964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:04:18.346277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:04:26.354985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:04:42.356854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:05:14.360054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:06:33.180398 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:06:33.180501 2.993510 tcp 10.0.2.105 52495 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:06:42.182892 0.000000 tcp 10.0.2.105 52495 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:06:48.184998 0.064444 tcp 10.0.2.105 52496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:06:48.249817 0.061257 tcp 10.0.2.105 52497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:06:48.311406 0.158563 tcp 10.0.2.105 52498 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:06:48.536587 2.989232 tcp 10.0.2.105 52499 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:06:57.524888 0.000000 tcp 10.0.2.105 52499 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:03.536691 0.061467 tcp 10.0.2.105 52500 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:03.598015 0.065189 tcp 10.0.2.105 52501 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:03.663056 0.232893 tcp 10.0.2.105 52502 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:04.471800 4.090947 tcp 10.0.2.105 52503 -> 46.48.223.67 15494 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:07.862257 0.060619 tcp 10.0.2.105 52504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:07.923269 0.066261 tcp 10.0.2.105 52505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:07.989335 0.151869 tcp 10.0.2.105 52506 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:08.563052 2.992143 tcp 10.0.2.105 52507 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:17.553978 0.000000 tcp 10.0.2.105 52507 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:23.553005 0.080401 tcp 10.0.2.105 52508 -> 195.113.214.245 80 FSPA* 0 0 10 1531 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:23.633702 0.068097 tcp 10.0.2.105 52509 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:23.702094 0.155000 tcp 10.0.2.105 52510 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:24.219890 2.997738 tcp 10.0.2.105 52511 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:33.215908 0.000000 tcp 10.0.2.105 52511 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:39.214931 3.004395 tcp 10.0.2.105 52512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:48.218066 0.000000 tcp 10.0.2.105 52512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:07:52.874031 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:07:54.216074 3.560390 tcp 10.0.2.105 52513 -> 46.48.223.67 15494 FSPA* 0 0 14 1609 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:07:57.737087 3.002875 tcp 10.0.2.105 52514 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:08:06.734554 0.000000 tcp 10.0.2.105 52514 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:11:18.362288 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:11:25.369956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:11:33.371470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:11:49.374835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:12:21.380454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:13:12.734226 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:13:12.734329 3.004382 tcp 10.0.2.105 52515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:13:21.737286 0.000000 tcp 10.0.2.105 52515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:13:27.737554 0.066907 tcp 10.0.2.105 52516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:27.804779 0.064684 tcp 10.0.2.105 52517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:27.870106 0.167516 tcp 10.0.2.105 52518 -> 195.113.214.249 443 SRPA* 0 0 42 34652 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:28.321079 3.000004 tcp 10.0.2.105 52519 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:13:37.319687 0.000000 tcp 10.0.2.105 52519 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:13:43.319062 0.063342 tcp 10.0.2.105 52520 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:43.382696 0.071382 tcp 10.0.2.105 52521 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:43.454499 0.149522 tcp 10.0.2.105 52522 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:44.005842 4.139587 tcp 10.0.2.105 52523 -> 46.48.223.67 15494 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:47.583107 0.060200 tcp 10.0.2.105 52524 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:47.643604 0.061660 tcp 10.0.2.105 52525 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:47.705097 0.150019 tcp 10.0.2.105 52526 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:13:48.145662 3.004091 tcp 10.0.2.105 52527 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:13:57.148493 0.000000 tcp 10.0.2.105 52527 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:03.147365 0.065150 tcp 10.0.2.105 52528 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:14:03.212841 0.065140 tcp 10.0.2.105 52529 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:14:03.278299 0.152843 tcp 10.0.2.105 52530 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:14:03.468467 3.003295 tcp 10.0.2.105 52531 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:12.471139 0.000000 tcp 10.0.2.105 52531 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:18.469068 3.004057 tcp 10.0.2.105 52532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:27.599667 0.000000 tcp 10.0.2.105 52532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:32.446006 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:14:33.528920 1.163823 tcp 10.0.2.105 52533 -> 46.48.223.67 15494 SPA_* 0 0 9 1158 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:14:45.598094 0.010452 tcp 10.0.2.105 52533 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:14:45.598649 3.003491 tcp 10.0.2.105 52534 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:14:54.600687 0.000000 tcp 10.0.2.105 52534 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:18:25.386840 3.001503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:18:32.393795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:18:40.395746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:18:56.399014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:19:28.404674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:20:00.601670 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:20:00.601785 2.993232 tcp 10.0.2.105 52535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:20:09.594101 0.000000 tcp 10.0.2.105 52535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:20:15.603925 0.061301 tcp 10.0.2.105 52536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:15.665489 0.061514 tcp 10.0.2.105 52537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:15.726870 0.158676 tcp 10.0.2.105 52538 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:16.010392 4.943135 tcp 10.0.2.105 52539 -> 46.48.223.67 15494 SPA_* 0 0 12 1521 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:20.944553 0.063454 tcp 10.0.2.105 52540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:21.008344 0.061842 tcp 10.0.2.105 52541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:21.070446 0.152655 tcp 10.0.2.105 52542 -> 195.113.214.249 443 SRPA* 0 0 39 33888 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:21.465454 0.000477 tcp 10.0.2.105 52539 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:20:21.465736 2.999347 tcp 10.0.2.105 52543 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:20:30.463296 0.000000 tcp 10.0.2.105 52543 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:20:36.462460 4.879652 tcp 10.0.2.105 52544 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:24:05.713551 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:24:05.713650 0.000000 udp 10.0.2.105 7010 -> 24.172.31.174 1679 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 16:24:24.311689 0.067290 tcp 10.0.2.105 52545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:24:24.379262 0.064349 tcp 10.0.2.105 52546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:24:24.443930 0.151318 tcp 10.0.2.105 52547 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:24:24.595741 0.110261 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:24.672207 0.180909 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:24.995449 0.222396 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:25.214407 0.184381 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:25.375970 0.211329 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:25.573319 0.190380 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:25.796429 0.179319 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:25.949926 0.125850 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:26.256063 0.174800 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:26.427109 0.168948 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:26.600337 0.212723 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:26.804662 0.350815 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:27.151536 0.182695 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:27.525887 0.192528 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:27.715386 0.349327 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:28.038202 0.058424 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:28.094276 0.200701 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:28.506120 0.183101 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:28.628308 0.322766 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:29.396319 0.185613 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:29.574749 0.085303 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:29.798034 0.088160 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:29.869135 0.165448 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:30.223831 0.176013 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:30.396488 0.128508 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:30.478494 0.027515 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2538 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:30.623528 0.231946 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:30.848359 0.082907 udp 10.0.2.105 7010 <-> 82.48.225.107 3302 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:31.080269 0.477351 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:31.536138 0.085848 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:31.620226 0.442217 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:24:32.041819 0.196881 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:25:32.410320 3.001952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:25:39.417938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:25:41.331002 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:25:41.331173 2.995290 tcp 10.0.2.105 52548 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:25:47.419396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:25:50.323427 0.000000 tcp 10.0.2.105 52548 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:25:56.333474 0.064731 tcp 10.0.2.105 52549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:25:56.398502 0.065340 tcp 10.0.2.105 52550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:25:56.464156 0.163059 tcp 10.0.2.105 52551 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:25:56.855878 3.001387 tcp 10.0.2.105 52552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:03.422472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:26:05.855862 0.000000 tcp 10.0.2.105 52552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:11.855165 0.064771 tcp 10.0.2.105 52553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:11.920434 0.066859 tcp 10.0.2.105 52554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:11.987603 0.153206 tcp 10.0.2.105 52555 -> 195.113.214.249 443 SRPA* 0 0 24 12114 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:12.416457 0.347718 tcp 10.0.2.105 52556 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:19.902816 0.512021 tcp 10.0.2.105 52556 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:19.903659 0.060088 tcp 10.0.2.105 52557 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:19.964021 0.064984 tcp 10.0.2.105 52558 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:20.029333 0.199753 tcp 10.0.2.105 52559 -> 195.113.214.249 443 SRPA* 0 0 75 78326 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:20.415074 3.006031 tcp 10.0.2.105 52560 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:29.419886 0.000000 tcp 10.0.2.105 52560 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:35.409127 0.061175 tcp 10.0.2.105 52561 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:35.428583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:26:35.470603 0.070849 tcp 10.0.2.105 52562 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:35.541748 0.155750 tcp 10.0.2.105 52563 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:26:35.946697 2.996909 tcp 10.0.2.105 52564 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:44.952052 0.000000 tcp 10.0.2.105 52564 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:50.940888 2.994175 tcp 10.0.2.105 52565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:26:59.933326 0.000000 tcp 10.0.2.105 52565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:27:04.880910 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:27:05.942409 4.636856 tcp 10.0.2.105 52566 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:27:10.579493 2.993854 tcp 10.0.2.105 52567 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:27:19.581919 0.000000 tcp 10.0.2.105 52567 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:32:25.582409 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:32:25.582567 2.995174 tcp 10.0.2.105 52568 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:32:34.575029 0.000000 tcp 10.0.2.105 52568 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:32:39.437655 2.998921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:32:40.586420 0.067293 tcp 10.0.2.105 52569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:40.654014 0.063517 tcp 10.0.2.105 52570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:40.717876 0.166551 tcp 10.0.2.105 52571 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:40.940465 2.997894 tcp 10.0.2.105 52572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:32:46.441791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:32:49.936698 0.000000 tcp 10.0.2.105 52572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:32:54.443513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:32:55.935644 0.064593 tcp 10.0.2.105 52573 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:56.000600 0.064780 tcp 10.0.2.105 52574 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:56.065681 0.161427 tcp 10.0.2.105 52575 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:32:56.482874 4.910524 tcp 10.0.2.105 52576 -> 46.48.223.67 15494 SPA_* 0 0 12 1535 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:01.394001 0.061057 tcp 10.0.2.105 52577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:01.455363 0.063652 tcp 10.0.2.105 52578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:01.519303 0.148401 tcp 10.0.2.105 52579 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:01.697099 0.000092 tcp 10.0.2.105 52576 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:01.697482 2.969964 tcp 10.0.2.105 52580 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:10.607730 0.000000 tcp 10.0.2.105 52580 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:10.627668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:33:16.557768 0.061105 tcp 10.0.2.105 52581 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:16.619124 0.069229 tcp 10.0.2.105 52582 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:16.688676 0.166311 tcp 10.0.2.105 52583 -> 195.113.214.249 443 SRPA* 0 0 69 69904 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:16.963159 2.979994 tcp 10.0.2.105 52584 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:25.885660 0.000000 tcp 10.0.2.105 52584 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:31.837252 3.004290 tcp 10.0.2.105 52585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:40.840387 0.000000 tcp 10.0.2.105 52585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:33:42.452660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:33:45.376528 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:33:46.838340 0.362519 tcp 10.0.2.105 52586 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:56.332150 0.000531 tcp 10.0.2.105 52586 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:33:56.332835 2.993948 tcp 10.0.2.105 52587 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:34:05.325609 0.000000 tcp 10.0.2.105 52587 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:11.335516 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:39:11.335622 3.004069 tcp 10.0.2.105 52588 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:20.337993 0.000000 tcp 10.0.2.105 52588 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:26.338559 0.064721 tcp 10.0.2.105 52589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:26.403564 0.062806 tcp 10.0.2.105 52590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:26.466197 0.150332 tcp 10.0.2.105 52591 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:26.932805 3.259559 tcp 10.0.2.105 52592 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:36.135807 0.000000 tcp 10.0.2.105 52592 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:42.085501 0.060988 tcp 10.0.2.105 52593 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:42.146881 0.065622 tcp 10.0.2.105 52594 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:42.212822 0.153894 tcp 10.0.2.105 52595 -> 195.113.214.249 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:42.653740 2.026246 tcp 10.0.2.105 52596 -> 46.48.223.67 15494 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:44.366895 0.066814 tcp 10.0.2.105 52597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:44.434051 0.064583 tcp 10.0.2.105 52598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:44.499052 0.155134 tcp 10.0.2.105 52599 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:44.680365 2.967743 tcp 10.0.2.105 52600 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:46.562374 2.972732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:39:53.501558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:39:53.590917 0.000000 tcp 10.0.2.105 52600 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:39:59.555466 0.068098 tcp 10.0.2.105 52601 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:59.623848 0.063043 tcp 10.0.2.105 52602 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:59.687202 0.150593 tcp 10.0.2.105 52603 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:39:59.949037 3.000586 tcp 10.0.2.105 52604 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:01.467518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:40:08.953309 0.000000 tcp 10.0.2.105 52604 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:14.947492 3.003517 tcp 10.0.2.105 52605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:17.470568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:40:23.952615 0.000000 tcp 10.0.2.105 52605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:28.876995 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:40:29.949199 1.759935 tcp 10.0.2.105 52606 -> 46.48.223.67 15494 FSPA* 0 0 12 1531 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:40:31.709358 2.995765 tcp 10.0.2.105 52607 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:37.108496 0.798124 tcp 10.0.2.105 52606 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:40:40.703770 0.000000 tcp 10.0.2.105 52607 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:40:49.476537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:45:46.703893 0.000174 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:45:46.704164 3.004015 tcp 10.0.2.105 52608 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:45:55.706456 0.000000 tcp 10.0.2.105 52608 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:01.707317 0.063065 tcp 10.0.2.105 52609 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:01.770740 0.064770 tcp 10.0.2.105 52610 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:01.835902 0.150401 tcp 10.0.2.105 52611 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:02.033806 3.006220 tcp 10.0.2.105 52612 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:11.038521 0.000000 tcp 10.0.2.105 52612 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:17.027921 0.253726 tcp 10.0.2.105 52613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:17.282006 0.065476 tcp 10.0.2.105 52614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:17.347849 0.161048 tcp 10.0.2.105 52615 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:17.722012 3.174641 tcp 10.0.2.105 52616 -> 46.48.223.67 15494 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:20.447551 0.061871 tcp 10.0.2.105 52617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:20.509689 0.061939 tcp 10.0.2.105 52618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:20.571951 0.284514 tcp 10.0.2.105 52619 -> 195.113.214.249 443 SRPA* 0 0 79 78748 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:20.896887 3.000365 tcp 10.0.2.105 52620 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:29.895734 0.000000 tcp 10.0.2.105 52620 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:35.895269 0.065191 tcp 10.0.2.105 52621 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:35.960747 0.064026 tcp 10.0.2.105 52622 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:36.025144 0.151619 tcp 10.0.2.105 52623 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:46:36.668169 3.001785 tcp 10.0.2.105 52624 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:45.668629 0.000000 tcp 10.0.2.105 52624 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:51.667131 3.004386 tcp 10.0.2.105 52625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:46:53.483391 3.000744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 16:47:00.490775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:47:00.670821 0.000000 tcp 10.0.2.105 52625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:47:05.376803 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:47:06.669124 1.810559 tcp 10.0.2.105 52626 -> 46.48.223.67 15494 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:47:08.479532 2.995872 tcp 10.0.2.105 52627 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:47:08.491402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:47:17.474187 0.000000 tcp 10.0.2.105 52627 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:47:24.494176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:47:56.500683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:54:00.506473 3.002722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 16:54:07.513733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:54:15.515397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:54:31.518368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:54:35.584599 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 16:54:35.584729 0.111009 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:35.748304 0.180601 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:35.921833 0.205782 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:36.117940 0.187720 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:36.468169 0.176349 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:36.638521 0.220846 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:36.855957 0.183969 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:37.057258 0.125947 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:37.163975 0.173261 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:37.427747 0.168642 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:37.577167 0.212375 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:37.782396 0.350692 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:38.129203 0.350442 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:38.451958 0.059167 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:38.489548 3.003161 tcp 10.0.2.105 52628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:54:38.776067 0.182315 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:38.953668 0.191138 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:39.142482 0.202553 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:39.616179 0.203161 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:39.753383 0.090341 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:39.894164 0.080632 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:39.960553 0.341279 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:40.532720 0.248998 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2590 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:40.810274 0.168063 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:41.268381 0.175444 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:41.440843 0.127149 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:41.628781 0.025193 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:41.722950 0.241771 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:41.957735 0.000000 udp 10.0.2.105 7010 -> 82.48.225.107 3302 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 16:54:47.491263 0.000000 tcp 10.0.2.105 52628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:54:53.654648 0.060568 tcp 10.0.2.105 52629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:53.715529 0.061349 tcp 10.0.2.105 52630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:53.777159 0.159807 tcp 10.0.2.105 52631 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:53.969753 2.964848 tcp 10.0.2.105 52632 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:54:58.114168 0.063863 tcp 10.0.2.105 52633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:58.178285 0.064892 tcp 10.0.2.105 52634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:58.243444 0.149168 tcp 10.0.2.105 52635 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:54:58.393283 0.442436 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:58.814328 0.403778 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:59.197541 0.085585 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:54:59.261511 0.197335 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/16 16:55:02.879662 0.000000 tcp 10.0.2.105 52632 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:55:03.595824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 16:55:08.832796 0.062050 tcp 10.0.2.105 52636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:55:08.895153 0.061911 tcp 10.0.2.105 52637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:55:08.957380 0.151775 tcp 10.0.2.105 52638 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 16:55:09.135386 2.981351 tcp 10.0.2.105 52639 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:55:18.115327 0.000000 tcp 10.0.2.105 52639 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:55:24.119012 2.999436 tcp 10.0.2.105 52640 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:55:33.117017 0.000000 tcp 10.0.2.105 52640 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 16:55:37.873479 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:00:39.116785 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:00:39.116982 3.004230 tcp 10.0.2.105 52641 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:00:48.119549 0.000000 tcp 10.0.2.105 52641 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:00:54.120339 0.062922 tcp 10.0.2.105 52642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:00:54.183540 0.063494 tcp 10.0.2.105 52643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:00:54.247348 0.162379 tcp 10.0.2.105 52644 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:00:54.649894 3.003516 tcp 10.0.2.105 52645 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:03.662063 0.000000 tcp 10.0.2.105 52645 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:07.531274 3.003657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:01:09.653563 0.067721 tcp 10.0.2.105 52646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:09.721561 0.065496 tcp 10.0.2.105 52647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:09.787445 0.288273 tcp 10.0.2.105 52648 -> 195.113.214.249 443 SRPA* 0 0 56 37746 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:10.110483 4.746204 tcp 10.0.2.105 52649 -> 46.48.223.67 15494 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:14.249516 0.064036 tcp 10.0.2.105 52650 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:14.313808 0.064590 tcp 10.0.2.105 52651 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:14.378243 0.151891 tcp 10.0.2.105 52652 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:14.537925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:01:14.856900 3.005512 tcp 10.0.2.105 52653 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:22.539501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:01:23.861243 0.000000 tcp 10.0.2.105 52653 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:29.850374 0.063386 tcp 10.0.2.105 52654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:29.914078 0.062530 tcp 10.0.2.105 52655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:29.976969 0.155997 tcp 10.0.2.105 52656 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:01:30.282521 2.992206 tcp 10.0.2.105 52657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:38.542594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:01:39.273376 0.000000 tcp 10.0.2.105 52657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:45.282128 2.993920 tcp 10.0.2.105 52658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:54.274861 0.000000 tcp 10.0.2.105 52658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:01:58.871465 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:02:00.284864 1.752965 tcp 10.0.2.105 52659 -> 46.48.223.67 15494 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:02:02.038055 3.006745 tcp 10.0.2.105 52660 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:02:10.553821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:02:11.043200 0.000000 tcp 10.0.2.105 52660 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:07:17.039391 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:07:17.039567 2.993605 tcp 10.0.2.105 52661 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:07:26.043010 0.000000 tcp 10.0.2.105 52661 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:07:32.042732 0.064245 tcp 10.0.2.105 52662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:32.107337 0.066157 tcp 10.0.2.105 52663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:32.173783 0.158352 tcp 10.0.2.105 52664 -> 195.113.214.249 443 SRPA* 0 0 44 30430 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:32.778298 2.997709 tcp 10.0.2.105 52665 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:07:41.774639 0.000000 tcp 10.0.2.105 52665 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:07:47.773550 0.359818 tcp 10.0.2.105 52666 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:48.133669 0.064751 tcp 10.0.2.105 52667 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:48.198674 0.160280 tcp 10.0.2.105 52668 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:48.518533 4.472875 tcp 10.0.2.105 52669 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:52.674076 0.062219 tcp 10.0.2.105 52670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:52.736319 0.065222 tcp 10.0.2.105 52671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:52.801878 0.150599 tcp 10.0.2.105 52672 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:07:52.991669 2.960964 tcp 10.0.2.105 52673 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:01.910227 0.000000 tcp 10.0.2.105 52673 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:07.865385 0.060032 tcp 10.0.2.105 52674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:08:07.925696 0.069937 tcp 10.0.2.105 52675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:08:07.995961 0.152929 tcp 10.0.2.105 52676 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:08:08.916446 2.975006 tcp 10.0.2.105 52677 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:14.618214 2.970120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:08:17.832085 0.000000 tcp 10.0.2.105 52677 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:21.561611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:08:23.804893 3.006567 tcp 10.0.2.105 52678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:29.563296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:08:32.807765 0.000000 tcp 10.0.2.105 52678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:37.374613 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:08:38.806111 0.347578 tcp 10.0.2.105 52679 -> 46.48.223.67 15494 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:08:45.332853 0.000346 tcp 10.0.2.105 52679 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:08:45.333465 3.008838 tcp 10.0.2.105 52680 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:08:45.566139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:08:54.338935 0.000000 tcp 10.0.2.105 52680 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:09:18.182707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:14:00.329725 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:14:00.329834 2.992954 tcp 10.0.2.105 52681 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:09.331780 0.000000 tcp 10.0.2.105 52681 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:15.332436 0.066635 tcp 10.0.2.105 52682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:15.399413 0.067719 tcp 10.0.2.105 52683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:15.467442 0.157512 tcp 10.0.2.105 52684 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:16.172225 2.993478 tcp 10.0.2.105 52685 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:25.164608 0.000000 tcp 10.0.2.105 52685 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:31.173828 0.067011 tcp 10.0.2.105 52686 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:31.241223 0.068511 tcp 10.0.2.105 52687 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:31.310061 0.166815 tcp 10.0.2.105 52688 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:31.645966 3.281986 tcp 10.0.2.105 52689 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:34.377366 0.063258 tcp 10.0.2.105 52690 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:34.440919 0.064372 tcp 10.0.2.105 52691 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:34.505596 0.157252 tcp 10.0.2.105 52692 -> 195.113.214.249 443 SRPA* 0 0 25 10514 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:34.928215 3.004474 tcp 10.0.2.105 52693 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:43.944617 0.000000 tcp 10.0.2.105 52693 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:49.924386 0.063038 tcp 10.0.2.105 52694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:49.987711 0.066187 tcp 10.0.2.105 52695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:50.054240 0.159794 tcp 10.0.2.105 52696 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:14:50.694604 3.000481 tcp 10.0.2.105 52697 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:14:59.694174 0.000000 tcp 10.0.2.105 52697 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:15:05.692922 3.004280 tcp 10.0.2.105 52698 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:15:14.695690 0.000000 tcp 10.0.2.105 52698 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:15:19.372784 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:15:20.694423 1.723320 tcp 10.0.2.105 52699 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:15:21.578301 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:15:22.417981 3.003338 tcp 10.0.2.105 52700 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:15:28.585709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:15:31.419728 0.000000 tcp 10.0.2.105 52700 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:15:36.587293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:15:52.590486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:16:24.596204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:20:37.420671 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:20:37.420788 2.993195 tcp 10.0.2.105 52701 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:20:46.422709 0.000000 tcp 10.0.2.105 52701 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:20:52.423145 0.061625 tcp 10.0.2.105 52702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:20:52.485074 0.062202 tcp 10.0.2.105 52703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:20:52.547576 0.157951 tcp 10.0.2.105 52704 -> 195.113.214.249 443 SRPA* 0 0 39 19860 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:20:52.850601 2.995428 tcp 10.0.2.105 52705 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:01.844842 0.000000 tcp 10.0.2.105 52705 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:07.843905 0.064510 tcp 10.0.2.105 52706 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:07.908744 0.061002 tcp 10.0.2.105 52707 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:07.970081 0.151085 tcp 10.0.2.105 52708 -> 195.113.214.249 443 SRPA* 0 0 20 11520 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:08.164397 2.039007 tcp 10.0.2.105 52709 -> 46.48.223.67 15494 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:09.908757 0.064014 tcp 10.0.2.105 52710 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:09.973100 0.065297 tcp 10.0.2.105 52711 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:10.038768 0.154962 tcp 10.0.2.105 52712 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:21:10.203645 3.007731 tcp 10.0.2.105 52713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:19.209648 0.000000 tcp 10.0.2.105 52713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:25.198699 3.004033 tcp 10.0.2.105 52714 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:34.201377 0.000000 tcp 10.0.2.105 52714 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:21:38.878050 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:21:40.200162 1.793794 tcp 10.0.2.105 52715 -> 46.48.223.67 15494 FSPA* 0 0 14 1594 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:22:28.602307 3.001510 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:22:35.609756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:22:43.611206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:22:59.614238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:23:31.620415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:25:25.745057 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:25:25.745249 0.000000 udp 10.0.2.105 7010 -> 82.48.225.107 3302 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 17:25:42.259970 0.063541 tcp 10.0.2.105 52716 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:25:42.323795 0.063342 tcp 10.0.2.105 52717 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:25:42.387414 0.157834 tcp 10.0.2.105 52718 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:25:42.546010 0.114973 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:42.627234 0.183096 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:42.835852 0.190479 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:42.996590 0.219537 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:43.200119 0.180655 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:43.674712 0.124079 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:43.888994 0.223089 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:44.508157 0.180479 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:44.664108 0.176609 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:44.838167 0.212491 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:45.507703 0.167686 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:45.656641 0.352760 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:45.980916 0.349791 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:46.327402 0.189409 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:46.623997 0.183103 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:46.801950 0.057934 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.033891 0.186543 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.159640 0.202315 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.439624 0.086714 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.484943 0.341164 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.925948 0.083909 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:47.993126 0.183642 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:48.225708 0.172966 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:48.376944 0.026955 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:48.522575 0.136747 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:48.617504 0.177091 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:25:48.850993 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 17:26:07.254575 0.062460 tcp 10.0.2.105 52719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:07.317331 0.060375 tcp 10.0.2.105 52720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:07.378035 0.153899 tcp 10.0.2.105 52721 -> 195.113.214.249 443 SRPA* 0 0 43 20722 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:07.532159 0.085293 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:26:07.598145 0.449319 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:26:08.019837 0.397756 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:26:08.397221 0.194680 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 1999 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:26:41.994329 3.003756 tcp 10.0.2.105 52722 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:26:46.870448 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:26:50.996676 0.000000 tcp 10.0.2.105 52722 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:26:56.996524 0.063146 tcp 10.0.2.105 52723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:57.060019 0.060846 tcp 10.0.2.105 52724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:57.121160 0.153679 tcp 10.0.2.105 52725 -> 195.113.214.249 443 SRPA* 0 0 29 14130 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:26:57.312018 2.998458 tcp 10.0.2.105 52726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:06.308920 0.000000 tcp 10.0.2.105 52726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:12.308021 0.067465 tcp 10.0.2.105 52727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:12.375348 0.066607 tcp 10.0.2.105 52728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:12.442232 0.152136 tcp 10.0.2.105 52729 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:12.914422 2.210161 tcp 10.0.2.105 52730 -> 46.48.223.67 15494 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:14.648332 0.059621 tcp 10.0.2.105 52731 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:14.708208 0.066806 tcp 10.0.2.105 52732 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:14.775357 0.150735 tcp 10.0.2.105 52733 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:15.124807 3.001037 tcp 10.0.2.105 52734 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:24.124455 0.000000 tcp 10.0.2.105 52734 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:30.123777 0.064506 tcp 10.0.2.105 52735 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:30.188140 0.060275 tcp 10.0.2.105 52736 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:30.249106 0.153173 tcp 10.0.2.105 52737 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:27:30.684565 3.003806 tcp 10.0.2.105 52738 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:39.688642 0.000000 tcp 10.0.2.105 52738 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:45.685629 3.005082 tcp 10.0.2.105 52739 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:54.688500 0.000000 tcp 10.0.2.105 52739 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:27:59.375015 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:28:00.687278 1.766911 tcp 10.0.2.105 52740 -> 46.48.223.67 15494 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:28:02.454417 2.999570 tcp 10.0.2.105 52741 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:28:11.462641 0.000000 tcp 10.0.2.105 52741 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:29:35.625533 3.002529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:29:42.633538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:29:50.635433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:30:06.638200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:30:38.643665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:33:17.453409 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:33:17.453534 3.003415 tcp 10.0.2.105 52742 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:33:26.455232 0.000000 tcp 10.0.2.105 52742 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:33:32.456102 0.061541 tcp 10.0.2.105 52743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:32.517932 0.069798 tcp 10.0.2.105 52744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:32.588024 0.159722 tcp 10.0.2.105 52745 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:32.822310 3.011314 tcp 10.0.2.105 52746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:33:41.827601 0.000000 tcp 10.0.2.105 52746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:33:47.816669 0.063896 tcp 10.0.2.105 52747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:47.880854 0.066717 tcp 10.0.2.105 52748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:47.947916 0.153897 tcp 10.0.2.105 52749 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:48.284991 2.555962 tcp 10.0.2.105 52750 -> 46.48.223.67 15494 FSPA* 0 0 15 1749 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:50.045775 0.060665 tcp 10.0.2.105 52751 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:50.106807 0.062753 tcp 10.0.2.105 52752 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:50.169865 0.164960 tcp 10.0.2.105 52753 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:33:50.480681 2.993441 tcp 10.0.2.105 52754 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:33:59.473036 0.000000 tcp 10.0.2.105 52754 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:05.472160 0.061729 tcp 10.0.2.105 52755 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:34:05.534175 0.063413 tcp 10.0.2.105 52756 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:34:05.597890 0.297444 tcp 10.0.2.105 52757 -> 195.113.214.249 443 SRPA* 0 0 32 17786 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:34:05.956129 3.000554 tcp 10.0.2.105 52758 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:14.954704 0.000000 tcp 10.0.2.105 52758 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:20.953803 3.009019 tcp 10.0.2.105 52759 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:29.956904 0.000000 tcp 10.0.2.105 52759 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:34.873831 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:34:35.955146 1.762997 tcp 10.0.2.105 52760 -> 46.48.223.67 15494 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:34:37.718431 3.003668 tcp 10.0.2.105 52761 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:34:46.720634 0.000000 tcp 10.0.2.105 52761 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:36:42.649955 3.001909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:36:49.657494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:36:57.658996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:37:13.662348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:37:45.668519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:39:52.721258 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:39:52.721437 2.993617 tcp 10.0.2.105 52762 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:01.713754 0.000000 tcp 10.0.2.105 52762 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:07.723923 0.062087 tcp 10.0.2.105 52763 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:07.786278 0.066479 tcp 10.0.2.105 52764 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:07.853100 0.152713 tcp 10.0.2.105 52765 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:08.341262 2.996366 tcp 10.0.2.105 52766 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:17.336026 0.000000 tcp 10.0.2.105 52766 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:23.335548 0.064146 tcp 10.0.2.105 52767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:23.400006 0.063179 tcp 10.0.2.105 52768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:23.463475 0.154119 tcp 10.0.2.105 52769 -> 195.113.214.249 443 SRPA* 0 0 44 28266 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:23.734901 0.351612 tcp 10.0.2.105 52770 -> 46.48.223.67 15494 SPA_* 0 0 9 1136 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:30.550518 0.432394 tcp 10.0.2.105 52770 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:30.551556 0.062689 tcp 10.0.2.105 52771 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:30.614537 0.063437 tcp 10.0.2.105 52772 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:30.678341 0.158672 tcp 10.0.2.105 52773 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:30.983176 3.007105 tcp 10.0.2.105 52774 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:39.988820 0.000000 tcp 10.0.2.105 52774 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:45.978073 0.063392 tcp 10.0.2.105 52775 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:46.041776 0.065719 tcp 10.0.2.105 52776 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:46.107801 0.157703 tcp 10.0.2.105 52777 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:40:46.432117 3.000447 tcp 10.0.2.105 52778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:40:55.430896 0.000000 tcp 10.0.2.105 52778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:41:01.435019 2.990081 tcp 10.0.2.105 52779 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:41:10.432728 0.000000 tcp 10.0.2.105 52779 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:41:15.379315 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:41:16.431442 1.766669 tcp 10.0.2.105 52780 -> 46.48.223.67 15494 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:41:18.197873 2.999923 tcp 10.0.2.105 52781 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:41:27.196020 0.000000 tcp 10.0.2.105 52781 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:43:49.675047 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:43:56.681829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:44:04.688794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:44:20.685815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:44:52.692180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:46:33.197375 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:46:33.197477 3.003172 tcp 10.0.2.105 52782 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:46:42.205545 0.000000 tcp 10.0.2.105 52782 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:46:48.200154 0.064709 tcp 10.0.2.105 52783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:46:48.265161 0.064140 tcp 10.0.2.105 52784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:46:48.329594 0.156490 tcp 10.0.2.105 52785 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:46:48.821181 2.992231 tcp 10.0.2.105 52786 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:46:57.824345 0.000000 tcp 10.0.2.105 52786 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:03.821267 0.060470 tcp 10.0.2.105 52787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:03.882029 0.064421 tcp 10.0.2.105 52788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:03.946747 0.160849 tcp 10.0.2.105 52789 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:04.599889 2.334905 tcp 10.0.2.105 52790 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:06.366036 0.061102 tcp 10.0.2.105 52791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:06.427405 0.065552 tcp 10.0.2.105 52792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:06.493276 0.152412 tcp 10.0.2.105 52793 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:06.935168 2.977550 tcp 10.0.2.105 52794 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:15.853711 0.000000 tcp 10.0.2.105 52794 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:21.792128 0.793380 tcp 10.0.2.105 52795 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:22.585827 0.060859 tcp 10.0.2.105 52796 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:22.646960 0.155391 tcp 10.0.2.105 52797 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:22.855264 2.971813 tcp 10.0.2.105 52798 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:31.756468 0.000000 tcp 10.0.2.105 52798 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:37.679342 2.968686 tcp 10.0.2.105 52799 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:46.570186 0.000000 tcp 10.0.2.105 52799 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:47:51.302388 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:47:52.491818 1.757838 tcp 10.0.2.105 52800 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:47:54.249921 2.959713 tcp 10.0.2.105 52801 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:48:04.301421 0.000000 tcp 10.0.2.105 52801 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:56:04.701047 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 17:56:08.664537 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:56:08.664658 0.242961 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:08.899671 0.189647 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.061671 0.207926 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.294819 0.106723 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.369236 0.181127 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.572085 0.183614 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.732662 0.124190 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:09.838615 0.177981 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:10.205031 0.223089 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2536 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:10.424806 0.177554 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:10.628195 0.353648 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2529 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:10.950755 0.214921 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:11.556912 0.168736 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:11.706068 0.182102 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:11.708591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:56:12.006476 0.056904 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:12.678968 0.206658 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:12.817524 0.186476 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:13.223625 0.354187 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:13.692277 0.342768 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:14.049465 0.084830 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:14.119110 0.201663 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:14.404898 0.086258 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:14.452618 0.021002 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:14.722970 0.137965 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:15.013339 0.175268 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:15.185618 0.168891 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:15.517892 0.187468 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:15.696709 0.086561 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:15.849899 0.440139 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:16.269486 0.296758 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:16.546833 0.200436 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/16 17:56:19.709459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:56:23.875890 3.004297 tcp 10.0.2.105 52802 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:56:32.878292 0.000000 tcp 10.0.2.105 52802 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:56:35.712762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:56:37.875585 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:56:38.879101 0.062366 tcp 10.0.2.105 52803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:38.941818 0.063565 tcp 10.0.2.105 52804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:39.005654 0.157426 tcp 10.0.2.105 52805 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:39.444544 3.008149 tcp 10.0.2.105 52806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:56:48.451155 0.000000 tcp 10.0.2.105 52806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:56:54.440689 0.064822 tcp 10.0.2.105 52807 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:54.505815 0.060894 tcp 10.0.2.105 52808 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:54.566988 0.155607 tcp 10.0.2.105 52809 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:56:54.951254 0.346278 tcp 10.0.2.105 52810 -> 46.48.223.67 15494 SPA_* 0 0 9 997 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:05.204276 0.539658 tcp 10.0.2.105 52810 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:05.205111 0.066667 tcp 10.0.2.105 52811 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:05.272171 0.064555 tcp 10.0.2.105 52812 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:05.337035 0.146570 tcp 10.0.2.105 52813 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:05.744199 3.005880 tcp 10.0.2.105 52814 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:07.718962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 17:57:14.749037 0.000000 tcp 10.0.2.105 52814 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:20.738034 0.066739 tcp 10.0.2.105 52815 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:20.805059 0.064799 tcp 10.0.2.105 52816 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:20.870146 0.152404 tcp 10.0.2.105 52817 -> 195.113.214.249 443 SRPA* 0 0 39 20856 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:21.043139 3.008817 tcp 10.0.2.105 52818 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:30.051175 0.000000 tcp 10.0.2.105 52818 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:36.040031 2.993938 tcp 10.0.2.105 52819 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:45.042257 0.000000 tcp 10.0.2.105 52819 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:57:49.879501 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 17:57:51.041356 1.738328 tcp 10.0.2.105 52820 -> 46.48.223.67 15494 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/02/16 17:57:52.779868 2.998137 tcp 10.0.2.105 52821 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 17:58:01.776517 0.000000 tcp 10.0.2.105 52821 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:07.777297 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:03:07.777392 3.003693 tcp 10.0.2.105 52822 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:11.725108 3.001121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:03:16.779503 0.000000 tcp 10.0.2.105 52822 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:18.732338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:03:22.782875 0.065361 tcp 10.0.2.105 52823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:22.848553 0.067468 tcp 10.0.2.105 52824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:22.916413 0.149842 tcp 10.0.2.105 52825 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:23.579160 2.995575 tcp 10.0.2.105 52826 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:26.733887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:03:32.582448 0.000000 tcp 10.0.2.105 52826 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:38.571733 0.060143 tcp 10.0.2.105 52827 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:38.632161 0.061752 tcp 10.0.2.105 52828 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:38.694247 0.163236 tcp 10.0.2.105 52829 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:39.197031 2.396617 tcp 10.0.2.105 52830 -> 46.48.223.67 15494 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:40.975741 0.060123 tcp 10.0.2.105 52831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:41.036142 0.060525 tcp 10.0.2.105 52832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:41.096943 0.147068 tcp 10.0.2.105 52833 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:41.593925 3.005564 tcp 10.0.2.105 52834 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:42.736699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:03:50.598100 0.000000 tcp 10.0.2.105 52834 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:03:56.589516 0.060643 tcp 10.0.2.105 52835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:56.650481 0.068813 tcp 10.0.2.105 52836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:56.719608 0.161644 tcp 10.0.2.105 52837 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:03:56.930745 3.000812 tcp 10.0.2.105 52838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:04:05.930222 0.000000 tcp 10.0.2.105 52838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:04:11.929076 3.004072 tcp 10.0.2.105 52839 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:04:14.742874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:04:20.941534 0.000000 tcp 10.0.2.105 52839 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:04:25.879050 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:04:26.930429 1.807884 tcp 10.0.2.105 52840 -> 46.48.223.67 15494 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:04:28.738465 2.999120 tcp 10.0.2.105 52841 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:04:37.735836 0.000000 tcp 10.0.2.105 52841 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:09:43.736105 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:09:43.736252 3.004185 tcp 10.0.2.105 52842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:09:52.738716 0.000000 tcp 10.0.2.105 52842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:09:58.739297 0.062348 tcp 10.0.2.105 52843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:09:58.801902 0.062680 tcp 10.0.2.105 52844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:09:58.864869 0.150550 tcp 10.0.2.105 52845 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:09:59.246466 3.006170 tcp 10.0.2.105 52846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:08.251187 0.000000 tcp 10.0.2.105 52846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:14.240388 0.063598 tcp 10.0.2.105 52847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:14.303928 0.065188 tcp 10.0.2.105 52848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:14.369416 0.151718 tcp 10.0.2.105 52849 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:14.793426 2.384053 tcp 10.0.2.105 52850 -> 46.48.223.67 15494 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:16.530894 0.064454 tcp 10.0.2.105 52851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:16.595709 0.062766 tcp 10.0.2.105 52852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:16.658779 0.160017 tcp 10.0.2.105 52853 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:17.177716 3.000662 tcp 10.0.2.105 52854 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:20.751860 3.001533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:10:26.177050 0.000000 tcp 10.0.2.105 52854 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:27.759214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:10:32.176109 0.060827 tcp 10.0.2.105 52855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:32.237265 0.065256 tcp 10.0.2.105 52856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:32.302445 0.162079 tcp 10.0.2.105 52857 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:10:32.728065 3.002391 tcp 10.0.2.105 52858 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:35.760672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:10:41.732901 0.000000 tcp 10.0.2.105 52858 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:47.728129 3.003823 tcp 10.0.2.105 52859 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:10:51.763716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:10:56.730914 0.000000 tcp 10.0.2.105 52859 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:11:01.377321 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:11:02.729699 1.740132 tcp 10.0.2.105 52860 -> 46.48.223.67 15494 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:11:04.470179 2.996057 tcp 10.0.2.105 52861 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:11:13.464877 0.000000 tcp 10.0.2.105 52861 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:11:23.769520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:16:19.465572 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:16:19.465681 3.003622 tcp 10.0.2.105 52862 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:16:28.467787 0.000000 tcp 10.0.2.105 52862 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:16:34.468871 0.102380 tcp 10.0.2.105 52863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:34.571591 0.065315 tcp 10.0.2.105 52864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:34.637220 0.165614 tcp 10.0.2.105 52865 -> 195.113.214.249 443 SRPA* 0 0 40 33458 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:35.159838 3.001771 tcp 10.0.2.105 52866 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:16:44.162938 0.000000 tcp 10.0.2.105 52866 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:16:50.159636 0.061351 tcp 10.0.2.105 52867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:50.221268 0.067839 tcp 10.0.2.105 52868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:50.289376 0.160920 tcp 10.0.2.105 52869 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:50.789284 2.933745 tcp 10.0.2.105 52870 -> 46.48.223.67 15494 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:53.431872 0.061075 tcp 10.0.2.105 52871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:53.493261 0.061132 tcp 10.0.2.105 52872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:53.554774 0.153061 tcp 10.0.2.105 52873 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:16:53.723225 3.005309 tcp 10.0.2.105 52874 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:02.726785 0.000000 tcp 10.0.2.105 52874 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:08.715896 0.070651 tcp 10.0.2.105 52875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:17:08.786804 0.067036 tcp 10.0.2.105 52876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:17:08.854095 0.153102 tcp 10.0.2.105 52877 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:17:09.071430 2.999252 tcp 10.0.2.105 52878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:18.069528 0.000000 tcp 10.0.2.105 52878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:24.068030 3.004070 tcp 10.0.2.105 52879 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:27.775735 3.001716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:17:33.070590 0.000000 tcp 10.0.2.105 52879 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:34.783102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:17:37.877488 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:17:39.069432 1.807664 tcp 10.0.2.105 52880 -> 46.48.223.67 15494 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:17:40.877383 3.001272 tcp 10.0.2.105 52881 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:42.790165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:17:49.874649 0.000000 tcp 10.0.2.105 52881 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:17:58.787740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:18:30.793721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:24:34.799746 3.001575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 18:24:41.807165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:24:49.808734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:25:05.811581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:25:37.817739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:26:35.303969 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:26:35.304076 0.265428 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:35.622870 0.187186 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:35.781448 0.183294 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:35.957261 0.181830 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:36.113709 0.205610 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:36.310460 0.112334 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:36.484769 0.125197 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:36.591024 0.178932 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:37.146011 0.212850 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:37.356080 0.171689 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:37.655198 0.356447 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:37.981807 0.215923 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:38.317418 0.169830 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:38.467615 0.182511 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:38.824502 0.060621 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:38.883618 0.200837 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:39.023136 0.186798 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:39.206399 0.349688 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:39.654047 0.201620 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:39.918136 0.090379 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:40.324787 0.340872 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:40.898686 3.004151 tcp 10.0.2.105 52882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:26:40.962049 0.085878 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:41.030808 0.021469 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:41.444589 0.130762 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:41.855910 0.185534 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:42.033261 0.175350 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:42.205143 0.168038 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:42.688580 0.085907 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:42.768478 0.450618 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:43.198663 0.426765 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:43.665560 0.199252 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:26:49.911376 0.000000 tcp 10.0.2.105 52882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:26:55.901916 0.062621 tcp 10.0.2.105 52883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:26:55.964868 0.063061 tcp 10.0.2.105 52884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:26:56.028226 0.155292 tcp 10.0.2.105 52885 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:26:56.294959 2.989573 tcp 10.0.2.105 52886 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:05.282806 0.000000 tcp 10.0.2.105 52886 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:11.293489 0.062084 tcp 10.0.2.105 52887 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:27:11.355889 0.067221 tcp 10.0.2.105 52888 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:27:11.423430 0.155678 tcp 10.0.2.105 52889 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:27:11.597511 2.999134 tcp 10.0.2.105 52890 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:20.595584 0.000000 tcp 10.0.2.105 52890 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:26.593918 3.007173 tcp 10.0.2.105 52891 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:35.596923 0.000000 tcp 10.0.2.105 52891 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:27:40.373322 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:31:41.823178 3.002374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:31:48.831209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:31:56.832585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:32:12.835547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:32:41.597855 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:32:41.598111 3.003097 tcp 10.0.2.105 52892 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:32:44.841019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:32:50.599978 0.000000 tcp 10.0.2.105 52892 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:32:56.600545 0.061513 tcp 10.0.2.105 52893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:32:56.662326 0.063939 tcp 10.0.2.105 52894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:32:56.726649 0.151034 tcp 10.0.2.105 52895 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:32:57.050015 2.993205 tcp 10.0.2.105 52896 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:06.052093 0.000000 tcp 10.0.2.105 52896 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:12.052419 0.064587 tcp 10.0.2.105 52897 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:12.117268 0.066341 tcp 10.0.2.105 52898 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:12.183917 0.156175 tcp 10.0.2.105 52899 -> 195.113.214.249 443 SRPA* 0 0 47 41968 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:12.466283 4.522938 tcp 10.0.2.105 52900 -> 46.48.223.67 15494 FSPA* 0 0 14 1769 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:16.546747 0.066373 tcp 10.0.2.105 52901 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:16.613606 0.067392 tcp 10.0.2.105 52902 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:16.681283 0.154235 tcp 10.0.2.105 52903 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:16.989435 3.003114 tcp 10.0.2.105 52904 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:25.990926 0.000000 tcp 10.0.2.105 52904 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:31.989567 0.065615 tcp 10.0.2.105 52905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:32.055469 0.069590 tcp 10.0.2.105 52906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:32.125370 0.163590 tcp 10.0.2.105 52907 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:33:32.592503 2.992425 tcp 10.0.2.105 52908 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:41.585057 0.000000 tcp 10.0.2.105 52908 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:47.582051 2.993931 tcp 10.0.2.105 52909 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:33:56.574564 0.000000 tcp 10.0.2.105 52909 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:34:01.372020 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:34:02.583462 1.768660 tcp 10.0.2.105 52910 -> 46.48.223.67 15494 FSPA* 0 0 14 1769 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:34:04.351976 2.998161 tcp 10.0.2.105 52911 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:34:13.348788 0.000000 tcp 10.0.2.105 52911 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:38:48.847331 3.005343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:38:55.855111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:39:03.856725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:39:19.349393 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:39:19.349513 3.003663 tcp 10.0.2.105 52912 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:39:19.859457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:39:28.361722 0.000000 tcp 10.0.2.105 52912 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:39:34.352162 0.065137 tcp 10.0.2.105 52913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:34.417557 0.064901 tcp 10.0.2.105 52914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:34.482289 0.155244 tcp 10.0.2.105 52915 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:34.828939 2.996383 tcp 10.0.2.105 52916 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:39:43.823958 0.000000 tcp 10.0.2.105 52916 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:39:49.822619 0.060809 tcp 10.0.2.105 52917 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:49.883219 0.068216 tcp 10.0.2.105 52918 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:49.951696 0.155257 tcp 10.0.2.105 52919 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:50.787161 4.514607 tcp 10.0.2.105 52920 -> 46.48.223.67 15494 SPA_* 0 0 12 1443 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:51.865584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:39:55.302076 0.063640 tcp 10.0.2.105 52921 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:55.366008 0.065465 tcp 10.0.2.105 52922 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:55.431758 0.151443 tcp 10.0.2.105 52923 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:56.138170 0.000076 tcp 10.0.2.105 52920 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:39:56.138509 2.997505 tcp 10.0.2.105 52924 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:05.134845 0.000000 tcp 10.0.2.105 52924 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:11.133818 0.065921 tcp 10.0.2.105 52925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:40:11.200046 0.064578 tcp 10.0.2.105 52926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:40:11.264933 0.164508 tcp 10.0.2.105 52927 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:40:11.553861 3.004269 tcp 10.0.2.105 52928 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:20.556632 0.000000 tcp 10.0.2.105 52928 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:26.555609 3.004311 tcp 10.0.2.105 52929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:35.558662 0.000000 tcp 10.0.2.105 52929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:40.375360 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:40:41.557086 4.466739 tcp 10.0.2.105 52930 -> 46.48.223.67 15494 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:40:46.024071 3.005654 tcp 10.0.2.105 52931 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:40:55.025909 0.000000 tcp 10.0.2.105 52931 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:45:55.871750 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:46:01.027279 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:46:01.027457 3.003396 tcp 10.0.2.105 52932 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:02.879140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:46:10.029268 0.000000 tcp 10.0.2.105 52932 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:10.880599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:46:16.029679 0.062829 tcp 10.0.2.105 52933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:16.092775 0.068815 tcp 10.0.2.105 52934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:16.161521 0.160378 tcp 10.0.2.105 52935 -> 195.113.214.249 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:16.682212 2.992946 tcp 10.0.2.105 52936 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:25.681584 0.000000 tcp 10.0.2.105 52936 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:26.883608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:46:31.681083 0.061034 tcp 10.0.2.105 52937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:31.742280 0.064735 tcp 10.0.2.105 52938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:31.807290 0.169907 tcp 10.0.2.105 52939 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:32.287558 2.147049 tcp 10.0.2.105 52940 -> 46.48.223.67 15494 FSPA* 0 0 12 1606 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:34.012678 0.065728 tcp 10.0.2.105 52941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:34.078701 0.062652 tcp 10.0.2.105 52942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:34.141715 0.152962 tcp 10.0.2.105 52943 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:34.434830 3.004014 tcp 10.0.2.105 52944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:43.437209 0.000000 tcp 10.0.2.105 52944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:49.436553 0.064986 tcp 10.0.2.105 52945 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:49.501816 0.063880 tcp 10.0.2.105 52946 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:49.565968 0.229943 tcp 10.0.2.105 52947 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:46:49.836396 3.004473 tcp 10.0.2.105 52948 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:58.839352 0.000000 tcp 10.0.2.105 52948 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:46:58.889523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:47:04.828585 3.094322 tcp 10.0.2.105 52949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:47:13.870014 0.000000 tcp 10.0.2.105 52949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:47:18.379320 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:47:19.839858 0.395581 tcp 10.0.2.105 52950 -> 46.48.223.67 15494 SPA_* 0 0 9 1184 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:47:26.090155 0.000476 tcp 10.0.2.105 52950 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:47:26.090948 3.001754 tcp 10.0.2.105 52951 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:47:35.101941 0.000000 tcp 10.0.2.105 52951 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:52:41.092409 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:52:41.092523 2.993156 tcp 10.0.2.105 52952 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:52:50.083831 0.000000 tcp 10.0.2.105 52952 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:52:56.094820 0.061448 tcp 10.0.2.105 52953 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:52:56.156572 0.061450 tcp 10.0.2.105 52954 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:52:56.218310 0.154454 tcp 10.0.2.105 52955 -> 195.113.214.249 443 SRPA* 0 0 25 13004 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:52:56.609217 0.350568 tcp 10.0.2.105 52956 -> 46.48.223.67 15494 SPA_* 0 0 9 1022 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:02.895776 3.005937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 18:53:06.796386 0.719664 tcp 10.0.2.105 52956 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:06.797241 0.060396 tcp 10.0.2.105 52957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:06.857911 0.061540 tcp 10.0.2.105 52958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:06.919833 0.150950 tcp 10.0.2.105 52959 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:07.516526 2.997031 tcp 10.0.2.105 52960 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:53:09.902895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:53:16.527169 0.000000 tcp 10.0.2.105 52960 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:53:17.906126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:53:22.511567 0.362278 tcp 10.0.2.105 52961 -> 46.48.223.67 15494 SPA_* 0 0 9 1022 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:28.373059 0.000425 tcp 10.0.2.105 52961 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:53:33.907379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:54:05.913698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 18:57:06.183114 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:57:06.183238 0.210383 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:06.783997 0.183731 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:06.945379 0.237317 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:07.175130 0.189481 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:07.415551 0.212243 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:07.616722 0.108262 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:07.839835 0.124020 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:07.945757 0.175711 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:08.274169 0.376174 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:08.619993 0.222135 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:08.838459 0.174574 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:09.008214 0.218013 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:09.352155 0.168789 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:09.500073 0.182193 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:10.249689 0.058551 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:10.306236 0.203195 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:10.513705 0.186966 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:10.697753 0.353499 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:11.263195 0.216648 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:11.498827 0.086834 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:11.570148 0.088245 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:11.669690 0.344245 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:12.105869 0.027652 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:12.288399 0.125397 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:12.372008 0.183216 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:12.695708 0.176106 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:12.868159 0.448032 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:13.291802 0.166425 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:13.569010 0.085089 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:13.632994 0.242056 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:57:13.883865 0.196293 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 18:58:28.371323 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:58:28.371434 2.993689 tcp 10.0.2.105 52962 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:58:37.363622 0.000000 tcp 10.0.2.105 52962 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:58:43.374344 0.065116 tcp 10.0.2.105 52963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:58:43.439745 0.061284 tcp 10.0.2.105 52964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:58:43.501394 0.157116 tcp 10.0.2.105 52965 -> 195.113.214.249 443 SRPA* 0 0 37 18350 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:58:44.438651 2.999996 tcp 10.0.2.105 52966 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:58:53.436970 0.000000 tcp 10.0.2.105 52966 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:58:59.436140 0.064479 tcp 10.0.2.105 52967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:58:59.500968 0.060105 tcp 10.0.2.105 52968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:58:59.561345 0.163951 tcp 10.0.2.105 52969 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:00.064155 2.121419 tcp 10.0.2.105 52970 -> 46.48.223.67 15494 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:01.800103 0.063893 tcp 10.0.2.105 52971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:01.864436 0.070750 tcp 10.0.2.105 52972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:01.935468 0.158546 tcp 10.0.2.105 52973 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:02.185828 2.997961 tcp 10.0.2.105 52974 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:11.192186 0.000000 tcp 10.0.2.105 52974 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:17.181473 0.066942 tcp 10.0.2.105 52975 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:17.248769 0.064222 tcp 10.0.2.105 52976 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:17.313315 0.167484 tcp 10.0.2.105 52977 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:17.720962 2.994916 tcp 10.0.2.105 52978 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:26.714554 0.000000 tcp 10.0.2.105 52978 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:32.713664 3.004018 tcp 10.0.2.105 52979 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:41.716138 0.000000 tcp 10.0.2.105 52979 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 18:59:46.372933 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 18:59:47.715201 0.349422 tcp 10.0.2.105 52980 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:53.155965 0.000381 tcp 10.0.2.105 52980 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 18:59:53.156564 3.000409 tcp 10.0.2.105 52981 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:00:02.155847 0.000000 tcp 10.0.2.105 52981 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:00:09.920414 3.000743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:00:17.217543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:00:25.145264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:00:40.998555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:01:12.947874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:05:08.156419 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:05:08.156536 3.007328 tcp 10.0.2.105 52982 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:17.158929 0.000000 tcp 10.0.2.105 52982 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:23.159052 0.061048 tcp 10.0.2.105 52983 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:23.220413 0.061844 tcp 10.0.2.105 52984 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:23.282518 0.160043 tcp 10.0.2.105 52985 -> 195.113.214.249 443 SRPA* 0 0 27 14324 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:23.473429 3.008481 tcp 10.0.2.105 52986 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:32.480516 0.000000 tcp 10.0.2.105 52986 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:38.473611 0.061864 tcp 10.0.2.105 52987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:38.534427 0.065032 tcp 10.0.2.105 52988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:38.599799 0.151291 tcp 10.0.2.105 52989 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:38.831671 2.796144 tcp 10.0.2.105 52990 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:40.859286 0.067191 tcp 10.0.2.105 52991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:40.926382 0.064258 tcp 10.0.2.105 52992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:40.990941 0.162035 tcp 10.0.2.105 52993 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:41.627977 3.001143 tcp 10.0.2.105 52994 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:50.628546 0.000000 tcp 10.0.2.105 52994 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:05:56.627548 0.063155 tcp 10.0.2.105 52995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:56.690990 0.061494 tcp 10.0.2.105 52996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:56.752841 0.161001 tcp 10.0.2.105 52997 -> 195.113.214.249 443 SRPA* 0 0 41 34598 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:05:57.128478 3.010475 tcp 10.0.2.105 52998 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:06:06.131312 0.000000 tcp 10.0.2.105 52998 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:06:12.131145 3.006088 tcp 10.0.2.105 52999 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:06:21.130596 0.000000 tcp 10.0.2.105 52999 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:06:25.879606 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:06:27.131933 1.765814 tcp 10.0.2.105 53000 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:06:28.897594 3.003120 tcp 10.0.2.105 53001 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:06:37.894663 0.000000 tcp 10.0.2.105 53001 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:07:21.963228 3.217859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:07:29.150502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:07:37.077291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:07:52.982856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:08:24.998856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:11:43.897434 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:11:43.897560 3.001549 tcp 10.0.2.105 53002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:11:52.897618 0.000000 tcp 10.0.2.105 53002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:11:58.898195 0.063384 tcp 10.0.2.105 53003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:11:58.961841 0.066703 tcp 10.0.2.105 53004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:11:59.028404 0.156141 tcp 10.0.2.105 53005 -> 195.113.214.249 443 SRPA* 0 0 24 10458 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:11:59.242752 2.998007 tcp 10.0.2.105 53006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:08.242571 0.000000 tcp 10.0.2.105 53006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:14.238831 0.063164 tcp 10.0.2.105 53007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:14.302296 0.061226 tcp 10.0.2.105 53008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:14.363370 0.156396 tcp 10.0.2.105 53009 -> 195.113.214.249 443 SRPA* 0 0 51 31744 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:14.643599 2.793936 tcp 10.0.2.105 53010 -> 46.48.223.67 15494 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:16.442766 0.064035 tcp 10.0.2.105 53011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:16.507053 0.065564 tcp 10.0.2.105 53012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:16.572926 0.156903 tcp 10.0.2.105 53013 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:17.438031 2.999105 tcp 10.0.2.105 53014 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:26.436079 0.000000 tcp 10.0.2.105 53014 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:32.437423 0.063362 tcp 10.0.2.105 53015 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:32.501168 0.066376 tcp 10.0.2.105 53016 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:32.567900 0.224524 tcp 10.0.2.105 53017 -> 195.113.214.249 443 SRPA* 0 0 40 21147 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:12:33.331610 2.998545 tcp 10.0.2.105 53018 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:42.449667 0.000000 tcp 10.0.2.105 53018 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:48.398309 2.983386 tcp 10.0.2.105 53019 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:12:57.343010 0.000000 tcp 10.0.2.105 53019 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:13:01.880794 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:13:03.334401 1.731194 tcp 10.0.2.105 53020 -> 46.48.223.67 15494 FSPA* 0 0 14 1580 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:13:05.065472 2.990061 tcp 10.0.2.105 53021 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:13:14.054485 0.000000 tcp 10.0.2.105 53021 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:14:29.004159 3.002378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:14:36.012102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:14:44.013031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:15:00.016748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:15:32.022728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:18:20.064269 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:18:20.064365 3.004438 tcp 10.0.2.105 53022 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:18:29.067239 0.000000 tcp 10.0.2.105 53022 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:18:35.070199 0.062454 tcp 10.0.2.105 53023 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:35.132949 0.065656 tcp 10.0.2.105 53024 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:35.198891 0.152733 tcp 10.0.2.105 53025 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:36.421472 4.092609 tcp 10.0.2.105 53026 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:18:46.443326 0.000000 tcp 10.0.2.105 53026 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:18:52.379553 0.060942 tcp 10.0.2.105 53027 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:52.440818 0.065022 tcp 10.0.2.105 53028 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:52.506140 0.154451 tcp 10.0.2.105 53029 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:52.784179 0.343651 tcp 10.0.2.105 53030 -> 46.48.223.67 15494 SPA_* 0 0 9 1019 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:59.760179 0.473814 tcp 10.0.2.105 53030 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:59.760972 0.061237 tcp 10.0.2.105 53031 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:59.822553 0.061260 tcp 10.0.2.105 53032 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:18:59.884114 0.155830 tcp 10.0.2.105 53033 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:00.234291 2.962568 tcp 10.0.2.105 53034 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:09.125111 0.000000 tcp 10.0.2.105 53034 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:15.054766 0.066769 tcp 10.0.2.105 53035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:15.121892 0.061344 tcp 10.0.2.105 53036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:15.183519 0.161066 tcp 10.0.2.105 53037 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:15.844834 2.964804 tcp 10.0.2.105 53038 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:24.732788 0.000000 tcp 10.0.2.105 53038 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:30.662394 2.971331 tcp 10.0.2.105 53039 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:39.558094 0.000000 tcp 10.0.2.105 53039 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:19:44.196099 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:19:45.480104 0.352073 tcp 10.0.2.105 53040 -> 46.48.223.67 15494 SPA_* 0 0 9 1019 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:53.947475 0.000368 tcp 10.0.2.105 53040 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:19:53.948117 2.953119 tcp 10.0.2.105 53041 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:20:02.836191 0.000000 tcp 10.0.2.105 53041 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:21:36.027854 3.002508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:21:43.036098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:21:51.037472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:22:07.040757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:22:39.046028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:27:23.446053 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:27:23.446264 0.181233 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:23.619772 0.183950 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:23.817636 3.002843 tcp 10.0.2.105 53042 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:27:23.822093 0.212485 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.023697 0.241750 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2595 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.257031 0.192195 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.419036 0.112170 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.497730 0.123934 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.602835 0.176478 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:24.754578 0.356714 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:25.083904 0.221837 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:25.302725 0.170420 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:25.452961 0.174002 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.159715 0.211265 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.363818 0.183473 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.562358 0.059041 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.637871 0.183404 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.765101 0.186115 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:26.947572 0.096487 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:27.090512 0.078705 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:27.132735 0.346569 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:27.513727 0.210915 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:27.769299 0.332113 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.101034 0.029456 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.313991 0.133509 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.402616 0.185175 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.579504 0.174808 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.751470 0.086871 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:28.954859 0.440572 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:29.374880 0.163620 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:29.825158 0.240114 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:30.043884 0.197818 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:27:32.818898 0.000000 tcp 10.0.2.105 53042 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:27:38.819467 0.061778 tcp 10.0.2.105 53043 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:27:38.881509 0.061009 tcp 10.0.2.105 53044 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:27:38.942827 0.150992 tcp 10.0.2.105 53045 -> 195.113.214.249 443 SRPA* 0 0 24 9664 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:27:39.105598 3.006857 tcp 10.0.2.105 53046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:27:48.121047 0.000000 tcp 10.0.2.105 53046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:28:43.053363 3.000490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 19:28:50.059928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:28:58.061448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:29:14.415894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:29:46.121674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:32:54.101558 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:32:54.101672 2.993705 tcp 10.0.2.105 53047 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:03.093823 0.000000 tcp 10.0.2.105 53047 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:09.104718 0.064166 tcp 10.0.2.105 53048 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:09.169170 0.062917 tcp 10.0.2.105 53049 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:09.232587 0.165917 tcp 10.0.2.105 53050 -> 195.113.214.249 443 SRPA* 0 0 67 67636 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:09.550947 2.996554 tcp 10.0.2.105 53051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:18.546374 0.000000 tcp 10.0.2.105 53051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:24.548985 0.059977 tcp 10.0.2.105 53052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:24.609215 0.064552 tcp 10.0.2.105 53053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:24.674084 0.149740 tcp 10.0.2.105 53054 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:24.964391 4.623333 tcp 10.0.2.105 53055 -> 46.48.223.67 15494 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:29.049702 0.061548 tcp 10.0.2.105 53056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:29.111518 0.065432 tcp 10.0.2.105 53057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:29.177245 0.150387 tcp 10.0.2.105 53058 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:29.587996 2.998240 tcp 10.0.2.105 53059 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:38.585005 0.000000 tcp 10.0.2.105 53059 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:44.584522 0.064231 tcp 10.0.2.105 53060 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:44.649065 0.061392 tcp 10.0.2.105 53061 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:44.710673 0.159143 tcp 10.0.2.105 53062 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:33:45.014699 3.003705 tcp 10.0.2.105 53063 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:33:54.017093 0.000000 tcp 10.0.2.105 53063 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:34:00.018998 3.000608 tcp 10.0.2.105 53064 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:34:09.018677 0.000000 tcp 10.0.2.105 53064 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:34:13.875689 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:34:15.017514 0.347896 tcp 10.0.2.105 53065 -> 46.48.223.67 15494 SPA_* 0 0 9 1053 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:34:21.893593 0.000364 tcp 10.0.2.105 53065 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:34:21.894207 2.997273 tcp 10.0.2.105 53066 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:34:30.889974 0.000000 tcp 10.0.2.105 53066 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:35:50.086464 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:35:57.093861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:36:05.409498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:36:21.261606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:36:53.124761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:39:36.890428 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:39:36.890599 2.993487 tcp 10.0.2.105 53067 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:39:45.892501 0.000000 tcp 10.0.2.105 53067 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:39:51.893905 0.062801 tcp 10.0.2.105 53068 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:39:51.956968 0.060703 tcp 10.0.2.105 53069 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:39:52.017965 0.151558 tcp 10.0.2.105 53070 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:39:52.279639 2.986653 tcp 10.0.2.105 53071 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:01.264966 0.000000 tcp 10.0.2.105 53071 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:07.274307 0.062521 tcp 10.0.2.105 53072 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:07.337149 0.061490 tcp 10.0.2.105 53073 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:07.398959 0.155152 tcp 10.0.2.105 53074 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:07.699611 0.350230 tcp 10.0.2.105 53075 -> 46.48.223.67 15494 SPA_* 0 0 9 1156 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:16.848123 0.399468 tcp 10.0.2.105 53075 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:16.849019 0.064038 tcp 10.0.2.105 53076 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:16.913348 0.067066 tcp 10.0.2.105 53077 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:16.980656 0.151226 tcp 10.0.2.105 53078 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:17.247853 3.004786 tcp 10.0.2.105 53079 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:26.251190 0.000000 tcp 10.0.2.105 53079 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:32.240249 0.059459 tcp 10.0.2.105 53080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:32.299989 0.066061 tcp 10.0.2.105 53081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:32.366282 0.156304 tcp 10.0.2.105 53082 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:40:33.099667 2.995504 tcp 10.0.2.105 53083 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:42.093259 0.000000 tcp 10.0.2.105 53083 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:48.092488 2.994406 tcp 10.0.2.105 53084 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:40:57.085503 0.000000 tcp 10.0.2.105 53084 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:41:01.872430 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:41:03.094104 1.728565 tcp 10.0.2.105 53085 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:41:04.822957 2.997818 tcp 10.0.2.105 53086 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:41:13.819293 0.000000 tcp 10.0.2.105 53086 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:42:57.130847 3.001380 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:43:04.137908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:43:12.139388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:43:28.142145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:44:00.148643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:46:19.819837 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:46:19.819942 2.993744 tcp 10.0.2.105 53087 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:46:28.822134 0.000000 tcp 10.0.2.105 53087 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:46:34.821970 0.063324 tcp 10.0.2.105 53088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:34.885979 0.067414 tcp 10.0.2.105 53089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:34.953767 0.162214 tcp 10.0.2.105 53090 -> 195.113.214.249 443 SRPA* 0 0 40 26422 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:35.280739 2.995249 tcp 10.0.2.105 53091 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:46:44.274011 0.000000 tcp 10.0.2.105 53091 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:46:50.274071 0.065026 tcp 10.0.2.105 53092 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:50.339386 0.068410 tcp 10.0.2.105 53093 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:50.408113 0.161021 tcp 10.0.2.105 53094 -> 195.113.214.249 443 SRPA* 0 0 32 16806 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:46:50.826040 0.360411 tcp 10.0.2.105 53095 -> 46.48.223.67 15494 SPA_* 0 0 9 1098 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:04.776806 0.552741 tcp 10.0.2.105 53095 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:04.777603 0.062509 tcp 10.0.2.105 53096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:04.840530 0.065097 tcp 10.0.2.105 53097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:04.905547 0.148416 tcp 10.0.2.105 53098 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:05.329750 3.003283 tcp 10.0.2.105 53099 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:14.327644 0.000000 tcp 10.0.2.105 53099 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:20.326909 0.061317 tcp 10.0.2.105 53100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:20.388501 0.064430 tcp 10.0.2.105 53101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:20.453236 0.149124 tcp 10.0.2.105 53102 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:47:20.730535 3.000595 tcp 10.0.2.105 53103 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:29.729861 0.000000 tcp 10.0.2.105 53103 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:35.728767 3.003878 tcp 10.0.2.105 53104 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:44.745327 0.000000 tcp 10.0.2.105 53104 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:47:49.377899 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:47:50.730319 0.347675 tcp 10.0.2.105 53105 -> 46.48.223.67 15494 SPA_* 0 0 9 1098 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:48:06.267249 0.000354 tcp 10.0.2.105 53105 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:48:06.267828 2.998376 tcp 10.0.2.105 53106 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:48:15.267359 0.000000 tcp 10.0.2.105 53106 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:53:21.266015 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:53:21.266130 3.003515 tcp 10.0.2.105 53107 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:53:30.272871 0.000000 tcp 10.0.2.105 53107 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:53:36.268624 0.061192 tcp 10.0.2.105 53108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:36.330109 0.059711 tcp 10.0.2.105 53109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:36.390103 0.153736 tcp 10.0.2.105 53110 -> 195.113.214.249 443 SRPA* 0 0 24 10254 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:37.031419 2.269956 tcp 10.0.2.105 53111 -> 46.48.223.67 15494 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:38.722892 0.065737 tcp 10.0.2.105 53112 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:38.788979 0.062160 tcp 10.0.2.105 53113 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:38.851469 0.154086 tcp 10.0.2.105 53114 -> 195.113.214.249 443 SRPA* 0 0 20 11307 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:39.301629 2.994216 tcp 10.0.2.105 53115 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:53:48.294064 0.000000 tcp 10.0.2.105 53115 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:53:54.303580 0.067028 tcp 10.0.2.105 53116 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:54.370930 0.065658 tcp 10.0.2.105 53117 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:54.436943 0.153486 tcp 10.0.2.105 53118 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:53:54.930271 2.997674 tcp 10.0.2.105 53119 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:54:03.925997 0.000000 tcp 10.0.2.105 53119 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:54:10.637430 1.726930 tcp 10.0.2.105 53120 -> 46.48.223.67 15494 FSPA* 0 0 14 1567 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:54:12.364617 2.971604 tcp 10.0.2.105 53121 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:54:21.258925 0.000000 tcp 10.0.2.105 53121 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:55:40.157467 3.003283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 19:55:47.170663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:55:55.166702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:56:11.170584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:56:43.175551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 19:57:45.265054 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:57:45.265157 0.207366 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:45.461543 0.183064 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.007195 0.182909 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.165909 0.232039 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.400571 0.189037 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.560432 0.109521 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.638117 0.124920 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:46.868318 0.182094 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:47.149539 0.349912 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:47.470883 0.173931 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:47.663455 0.225574 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:47.883804 0.171636 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:48.298204 0.216301 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:48.507348 0.180215 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:48.682433 0.058673 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:48.997712 0.183418 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:49.123847 0.186983 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:49.307667 0.097278 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:49.389125 0.088483 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:49.663209 0.330815 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:50.466064 0.352857 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:50.815308 0.204705 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:51.255750 0.024011 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:51.447393 0.125685 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:51.530137 0.183957 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:52.020845 0.175563 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:52.192756 0.085487 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:52.255568 0.239655 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:52.595683 0.456488 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:53.029839 0.166078 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:57:53.344668 0.197613 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/16 19:59:26.671326 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 19:59:26.671427 2.993563 tcp 10.0.2.105 53122 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:59:35.664709 0.000000 tcp 10.0.2.105 53122 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:59:41.674528 0.062518 tcp 10.0.2.105 53123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:41.737336 0.061270 tcp 10.0.2.105 53124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:41.798879 0.152115 tcp 10.0.2.105 53125 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:42.022167 2.994555 tcp 10.0.2.105 53126 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:59:51.015555 0.000000 tcp 10.0.2.105 53126 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 19:59:57.015091 0.060134 tcp 10.0.2.105 53127 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:57.075561 0.068101 tcp 10.0.2.105 53128 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:57.143961 0.342807 tcp 10.0.2.105 53129 -> 195.113.214.249 443 SRPA* 0 0 73 77004 flow=From-Botnet-V2-TCP-Established 1970/02/16 19:59:57.699873 3.242070 tcp 10.0.2.105 53130 -> 46.48.223.67 15494 FSPA* 0 0 14 1770 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:00.426462 0.061040 tcp 10.0.2.105 53131 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:00.487834 0.062136 tcp 10.0.2.105 53132 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:00.550237 0.154780 tcp 10.0.2.105 53133 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:00.942150 2.991459 tcp 10.0.2.105 53134 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:09.932720 0.000000 tcp 10.0.2.105 53134 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:15.942540 0.061305 tcp 10.0.2.105 53135 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:16.004140 0.067266 tcp 10.0.2.105 53136 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:16.071320 0.155965 tcp 10.0.2.105 53137 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:00:16.322070 2.994453 tcp 10.0.2.105 53138 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:25.315229 0.000000 tcp 10.0.2.105 53138 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:31.323765 3.004184 tcp 10.0.2.105 53139 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:40.326683 0.000000 tcp 10.0.2.105 53139 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:00:44.872700 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:00:46.325373 0.351019 tcp 10.0.2.105 53140 -> 46.48.223.67 15494 SPA_* 0 0 9 1240 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:01:03.035829 0.000496 tcp 10.0.2.105 53140 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:01:03.036523 2.996655 tcp 10.0.2.105 53141 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:01:12.042359 0.000000 tcp 10.0.2.105 53141 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:02:47.181889 3.001557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:02:54.189062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:03:02.190667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:03:18.193177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:03:50.204552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:06:18.032466 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:06:18.032574 2.993848 tcp 10.0.2.105 53142 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:06:27.025049 0.000000 tcp 10.0.2.105 53142 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:06:33.035479 0.323091 tcp 10.0.2.105 53143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:33.358824 0.062475 tcp 10.0.2.105 53144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:33.421617 0.154966 tcp 10.0.2.105 53145 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:33.971754 2.978436 tcp 10.0.2.105 53146 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:06:42.904563 0.000000 tcp 10.0.2.105 53146 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:06:48.844400 0.060984 tcp 10.0.2.105 53147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:48.905709 0.068159 tcp 10.0.2.105 53148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:48.974192 0.244052 tcp 10.0.2.105 53149 -> 195.113.214.249 443 SRPA* 0 0 35 18782 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:49.434747 2.056955 tcp 10.0.2.105 53150 -> 46.48.223.67 15494 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:51.148171 0.060478 tcp 10.0.2.105 53151 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:51.209029 0.062870 tcp 10.0.2.105 53152 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:51.271305 0.155661 tcp 10.0.2.105 53153 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:06:51.492085 2.965177 tcp 10.0.2.105 53154 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:00.410456 0.000000 tcp 10.0.2.105 53154 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:06.387332 0.060054 tcp 10.0.2.105 53155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:07:06.447712 0.064954 tcp 10.0.2.105 53156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:07:06.513035 0.152888 tcp 10.0.2.105 53157 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:07:07.016950 3.000159 tcp 10.0.2.105 53158 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:16.015100 0.000000 tcp 10.0.2.105 53158 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:22.015009 3.012856 tcp 10.0.2.105 53159 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:31.017017 0.000000 tcp 10.0.2.105 53159 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:35.873906 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:07:37.015452 3.638230 tcp 10.0.2.105 53160 -> 46.48.223.67 15494 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:07:40.653921 3.001578 tcp 10.0.2.105 53161 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:07:49.653785 0.000000 tcp 10.0.2.105 53161 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:10:04.209521 3.002097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:10:11.222632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:10:19.218932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:10:35.221844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:11:07.228085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:12:55.654216 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:12:55.654416 3.003693 tcp 10.0.2.105 53162 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:04.656894 0.000000 tcp 10.0.2.105 53162 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:10.657018 0.065204 tcp 10.0.2.105 53163 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:10.722165 0.064532 tcp 10.0.2.105 53164 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:10.786919 0.152137 tcp 10.0.2.105 53165 -> 195.113.214.249 443 SRPA* 0 0 21 11362 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:11.494159 3.006752 tcp 10.0.2.105 53166 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:20.499537 0.000000 tcp 10.0.2.105 53166 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:26.489100 0.060679 tcp 10.0.2.105 53167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:26.550138 0.064509 tcp 10.0.2.105 53168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:26.614925 0.154914 tcp 10.0.2.105 53169 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:27.191816 0.352296 tcp 10.0.2.105 53170 -> 46.48.223.67 15494 SPA_* 0 0 9 1225 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:37.142923 0.494964 tcp 10.0.2.105 53170 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:37.143668 0.061872 tcp 10.0.2.105 53171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:37.205825 0.063637 tcp 10.0.2.105 53172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:37.269796 0.151701 tcp 10.0.2.105 53173 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:37.638178 2.990375 tcp 10.0.2.105 53174 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:46.626965 0.000000 tcp 10.0.2.105 53174 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:13:52.626575 0.059909 tcp 10.0.2.105 53175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:52.686750 0.062552 tcp 10.0.2.105 53176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:52.749658 0.161944 tcp 10.0.2.105 53177 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:13:53.327830 3.003258 tcp 10.0.2.105 53178 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:14:02.329891 0.000000 tcp 10.0.2.105 53178 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:14:08.328444 3.004275 tcp 10.0.2.105 53179 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:14:17.331351 0.000000 tcp 10.0.2.105 53179 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:14:21.877666 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:14:23.330069 1.760921 tcp 10.0.2.105 53180 -> 46.48.223.67 15494 FSPA* 0 0 14 1755 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:14:25.091188 2.995343 tcp 10.0.2.105 53181 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:14:34.085393 0.000000 tcp 10.0.2.105 53181 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:17:11.233939 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:17:18.241236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:17:26.242861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:17:42.246078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:18:14.252703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:19:40.085944 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:19:40.086041 3.003503 tcp 10.0.2.105 53182 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:19:49.967057 0.000000 tcp 10.0.2.105 53182 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:19:55.890442 0.061789 tcp 10.0.2.105 53183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:19:55.952567 0.063813 tcp 10.0.2.105 53184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:19:56.016703 0.153159 tcp 10.0.2.105 53185 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:19:56.395240 2.977412 tcp 10.0.2.105 53186 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:05.295740 0.000000 tcp 10.0.2.105 53186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:11.208714 0.060404 tcp 10.0.2.105 53187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:11.269409 0.061896 tcp 10.0.2.105 53188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:11.331607 0.155223 tcp 10.0.2.105 53189 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:11.889000 2.658996 tcp 10.0.2.105 53190 -> 46.48.223.67 15494 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:13.653846 0.063077 tcp 10.0.2.105 53191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:13.717266 0.062111 tcp 10.0.2.105 53192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:13.779676 0.154744 tcp 10.0.2.105 53193 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:14.548477 2.956659 tcp 10.0.2.105 53194 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:25.001316 0.000000 tcp 10.0.2.105 53194 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:30.928955 0.060505 tcp 10.0.2.105 53195 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:30.989716 0.067743 tcp 10.0.2.105 53196 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:31.057807 0.161914 tcp 10.0.2.105 53197 -> 195.113.214.249 443 SRPA* 0 0 39 33052 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:20:32.530488 2.970946 tcp 10.0.2.105 53198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:41.427117 0.000000 tcp 10.0.2.105 53198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:47.352324 2.958427 tcp 10.0.2.105 53199 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:20:55.054305 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:20:56.253066 0.000000 tcp 10.0.2.105 53199 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:21:02.180184 1.776671 tcp 10.0.2.105 53200 -> 46.48.223.67 15494 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:21:03.957101 2.961284 tcp 10.0.2.105 53201 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:21:12.846801 0.000000 tcp 10.0.2.105 53201 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:24:18.258102 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:24:25.265383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:24:33.266908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:24:49.269793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:25:21.275768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:28:16.367714 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:28:16.367875 0.246155 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:16.604107 0.181063 udp 10.0.2.105 7010 <-> 99.135.106.151 4296 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:16.977857 0.183138 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:17.135599 0.112286 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:17.389892 2.993376 tcp 10.0.2.105 53202 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:28:17.663453 0.123462 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:17.768011 0.236941 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:18.006972 0.193580 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:18.172060 0.181909 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:18.452113 0.355856 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:18.781889 0.175184 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:18.953219 0.221818 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:19.171873 0.180464 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:19.347279 0.169410 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:19.496315 0.214307 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:20.309446 0.058309 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:20.365758 0.170838 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:20.537955 0.185752 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:20.720844 0.085591 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:21.115473 0.084385 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:21.163287 0.342656 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:21.645047 0.353563 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:22.144661 0.133189 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:22.230439 0.202490 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:22.502064 0.027068 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:22.535839 0.185452 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:22.713596 0.177455 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:23.142408 0.086434 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:23.207386 0.244245 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:23.432514 0.197257 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:23.622493 0.444024 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:24.043214 0.167784 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:28:26.392100 0.000000 tcp 10.0.2.105 53202 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:28:32.396195 0.064135 tcp 10.0.2.105 53203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:32.460739 0.066729 tcp 10.0.2.105 53204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:32.527832 0.158105 tcp 10.0.2.105 53205 -> 195.113.214.249 443 SRPA* 0 0 32 22198 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:33.205287 3.000836 tcp 10.0.2.105 53206 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:28:42.204206 0.000000 tcp 10.0.2.105 53206 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:28:48.203908 0.061944 tcp 10.0.2.105 53207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:48.266177 0.064675 tcp 10.0.2.105 53208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:48.331151 0.154448 tcp 10.0.2.105 53209 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:28:48.538752 2.999425 tcp 10.0.2.105 53210 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:28:57.536603 0.000000 tcp 10.0.2.105 53210 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:29:03.535377 3.004405 tcp 10.0.2.105 53211 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:29:12.538649 0.000000 tcp 10.0.2.105 53211 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:29:17.375383 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:31:25.281624 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:31:32.289283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:31:40.291622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:31:56.293919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:32:28.299790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:34:18.538887 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:34:18.539010 3.003875 tcp 10.0.2.105 53212 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:34:27.543587 0.000000 tcp 10.0.2.105 53212 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:34:33.541640 0.060904 tcp 10.0.2.105 53213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:33.602637 0.066335 tcp 10.0.2.105 53214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:33.669280 0.146506 tcp 10.0.2.105 53215 -> 195.113.214.249 443 SRPA* 0 0 32 16806 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:33.944948 2.999294 tcp 10.0.2.105 53216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:34:42.943538 0.000000 tcp 10.0.2.105 53216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:34:48.942770 0.064687 tcp 10.0.2.105 53217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:49.007753 0.063858 tcp 10.0.2.105 53218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:49.071899 0.160798 tcp 10.0.2.105 53219 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:49.390204 3.462541 tcp 10.0.2.105 53220 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:52.050810 0.060433 tcp 10.0.2.105 53221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:52.111526 0.064833 tcp 10.0.2.105 53222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:52.176686 0.150480 tcp 10.0.2.105 53223 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:34:52.853078 2.978897 tcp 10.0.2.105 53224 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:01.771311 0.000000 tcp 10.0.2.105 53224 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:07.710741 0.061265 tcp 10.0.2.105 53225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:35:07.771932 0.061304 tcp 10.0.2.105 53226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:35:07.833531 0.162987 tcp 10.0.2.105 53227 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:35:08.021785 2.973300 tcp 10.0.2.105 53228 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:16.946040 0.000000 tcp 10.0.2.105 53228 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:22.930813 2.993866 tcp 10.0.2.105 53229 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:32.043146 0.000000 tcp 10.0.2.105 53229 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:36.942310 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:35:37.993774 1.811352 tcp 10.0.2.105 53230 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:35:39.805378 2.973045 tcp 10.0.2.105 53231 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:35:48.757883 0.000000 tcp 10.0.2.105 53231 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:38:32.305734 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:38:39.313518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:38:47.314837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:39:03.318237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:39:35.323663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:40:54.758744 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:40:54.758856 3.003469 tcp 10.0.2.105 53232 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:03.760851 0.000000 tcp 10.0.2.105 53232 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:09.761644 0.065824 tcp 10.0.2.105 53233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:09.827844 0.065105 tcp 10.0.2.105 53234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:09.893263 0.153862 tcp 10.0.2.105 53235 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:10.158014 2.985806 tcp 10.0.2.105 53236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:19.142744 0.000000 tcp 10.0.2.105 53236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:25.152401 0.060712 tcp 10.0.2.105 53237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:25.213422 0.064682 tcp 10.0.2.105 53238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:25.278403 0.156432 tcp 10.0.2.105 53239 -> 195.113.214.249 443 SRPA* 0 0 32 22198 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:25.586144 2.439901 tcp 10.0.2.105 53240 -> 46.48.223.67 15494 FSPA* 0 0 14 1637 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:27.391843 0.060551 tcp 10.0.2.105 53241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:27.452712 0.064290 tcp 10.0.2.105 53242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:27.517289 0.329537 tcp 10.0.2.105 53243 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:28.026288 3.003638 tcp 10.0.2.105 53244 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:37.028532 0.000000 tcp 10.0.2.105 53244 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:43.028138 0.141270 tcp 10.0.2.105 53245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:43.169739 0.064007 tcp 10.0.2.105 53246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:43.234049 0.152993 tcp 10.0.2.105 53247 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:41:43.656450 3.008349 tcp 10.0.2.105 53248 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:52.661152 0.000000 tcp 10.0.2.105 53248 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:41:59.085529 2.957690 tcp 10.0.2.105 53249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:42:07.979507 0.000000 tcp 10.0.2.105 53249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:42:12.637086 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:42:13.905060 0.375901 tcp 10.0.2.105 53250 -> 46.48.223.67 15494 SPA_* 0 0 9 1107 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:42:20.888788 0.000424 tcp 10.0.2.105 53250 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:42:20.889521 2.957997 tcp 10.0.2.105 53251 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:42:29.775259 0.000000 tcp 10.0.2.105 53251 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:45:39.329629 3.003559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:45:46.337364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:45:54.338836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:46:10.341641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:46:42.347770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:47:35.725138 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:47:35.725328 3.003475 tcp 10.0.2.105 53252 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:47:44.727600 0.000000 tcp 10.0.2.105 53252 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:47:50.727561 0.062342 tcp 10.0.2.105 53253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:47:50.790134 0.065092 tcp 10.0.2.105 53254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:47:50.855494 0.155274 tcp 10.0.2.105 53255 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:47:51.164341 3.008325 tcp 10.0.2.105 53256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:00.172696 0.000000 tcp 10.0.2.105 53256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:06.158856 0.059885 tcp 10.0.2.105 53257 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:06.219033 0.066095 tcp 10.0.2.105 53258 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:06.284964 0.155717 tcp 10.0.2.105 53259 -> 195.113.214.249 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:06.450794 2.434186 tcp 10.0.2.105 53260 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:08.268263 0.064296 tcp 10.0.2.105 53261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:08.332904 0.061422 tcp 10.0.2.105 53262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:08.394628 0.156875 tcp 10.0.2.105 53263 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:08.885263 3.001108 tcp 10.0.2.105 53264 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:17.885033 0.000000 tcp 10.0.2.105 53264 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:23.884570 0.065504 tcp 10.0.2.105 53265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:23.950452 0.064912 tcp 10.0.2.105 53266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:24.015785 0.154640 tcp 10.0.2.105 53267 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:24.274782 3.004016 tcp 10.0.2.105 53268 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:33.277465 0.000000 tcp 10.0.2.105 53268 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:39.276063 3.007660 tcp 10.0.2.105 53269 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:48.278921 0.000000 tcp 10.0.2.105 53269 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:48:52.875413 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:48:54.277520 1.855547 tcp 10.0.2.105 53270 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:48:56.133329 3.000938 tcp 10.0.2.105 53271 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:49:05.142993 0.000000 tcp 10.0.2.105 53271 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:54:11.133407 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:54:11.133552 3.003716 tcp 10.0.2.105 53272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:54:20.135618 0.000000 tcp 10.0.2.105 53272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:54:26.136416 0.065668 tcp 10.0.2.105 53273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:26.202328 0.064792 tcp 10.0.2.105 53274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:26.267391 0.155014 tcp 10.0.2.105 53275 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:26.743715 2.248879 tcp 10.0.2.105 53276 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:28.583668 0.063395 tcp 10.0.2.105 53277 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:28.647380 0.064279 tcp 10.0.2.105 53278 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:28.712029 0.167883 tcp 10.0.2.105 53279 -> 195.113.214.249 443 SRPA* 0 0 36 18906 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:54:28.992811 3.000293 tcp 10.0.2.105 53280 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:54:38.001691 0.000000 tcp 10.0.2.105 53280 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:54:43.990424 1.838692 tcp 10.0.2.105 53281 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:57:02.365280 2.998299 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 20:57:09.369183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:57:17.370809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:57:33.373840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:58:05.382213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 20:58:31.196883 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:58:31.197073 0.184091 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:31.359380 0.206547 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:31.755052 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 20:58:49.294314 0.060934 tcp 10.0.2.105 53282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:58:49.355510 0.060262 tcp 10.0.2.105 53283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:58:49.416063 0.158826 tcp 10.0.2.105 53284 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:58:49.575368 0.113864 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:49.652400 0.124231 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:50.136357 0.233491 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:50.362320 0.193352 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:50.566388 0.173252 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:50.736761 0.222312 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:50.956193 0.188347 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:51.351771 0.449906 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:51.774361 0.181345 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:52.036353 0.169962 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:52.186787 0.218088 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:52.397261 0.059417 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:52.633424 0.197047 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:52.761721 0.187052 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:53.104778 0.086296 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:53.176378 0.089328 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:53.382995 0.142842 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:53.479513 0.337172 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:53.888883 0.352795 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:54.237714 0.205239 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:54.585075 0.025002 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:54.878745 0.185168 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:55.056999 0.175197 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:55.228811 0.086267 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:55.464449 0.449884 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:55.893227 0.237307 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:56.123022 0.195825 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/16 20:58:56.312108 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 20:59:15.140653 0.061720 tcp 10.0.2.105 53285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:59:15.202281 0.063950 tcp 10.0.2.105 53286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:59:15.266534 0.155618 tcp 10.0.2.105 53287 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 20:59:45.824621 3.004270 tcp 10.0.2.105 53288 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 20:59:50.370632 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 20:59:54.827102 0.000000 tcp 10.0.2.105 53288 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:00.826789 0.060024 tcp 10.0.2.105 53289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:00.886780 0.061963 tcp 10.0.2.105 53290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:00.949059 0.153657 tcp 10.0.2.105 53291 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:01.167462 3.003153 tcp 10.0.2.105 53292 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:10.169252 0.000000 tcp 10.0.2.105 53292 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:16.168581 0.062209 tcp 10.0.2.105 53293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:16.231058 0.061341 tcp 10.0.2.105 53294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:16.292255 0.166462 tcp 10.0.2.105 53295 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:16.882079 0.374097 tcp 10.0.2.105 53296 -> 46.48.223.67 15494 SPA_* 0 0 9 1185 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:26.527565 0.512217 tcp 10.0.2.105 53296 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:26.528450 0.065083 tcp 10.0.2.105 53297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:26.593815 0.061659 tcp 10.0.2.105 53298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:26.655872 0.152188 tcp 10.0.2.105 53299 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:27.040016 2.997814 tcp 10.0.2.105 53300 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:36.036335 0.000000 tcp 10.0.2.105 53300 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:42.035473 0.064494 tcp 10.0.2.105 53301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:42.100398 0.067389 tcp 10.0.2.105 53302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:42.168184 0.147652 tcp 10.0.2.105 53303 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:00:42.371788 2.998046 tcp 10.0.2.105 53304 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:51.368251 0.000000 tcp 10.0.2.105 53304 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:00:57.367454 3.003996 tcp 10.0.2.105 53305 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:01:06.372514 0.000000 tcp 10.0.2.105 53305 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:01:11.377190 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:01:12.368976 1.817768 tcp 10.0.2.105 53306 -> 46.48.223.67 15494 FSPA* 0 0 14 1715 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:01:14.186942 2.998558 tcp 10.0.2.105 53307 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:01:23.183665 0.000000 tcp 10.0.2.105 53307 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:04:09.385667 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:04:16.393149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:04:24.394908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:04:40.397930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:05:12.403760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:06:29.184558 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:06:29.184756 3.003795 tcp 10.0.2.105 53308 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:06:38.187106 0.000000 tcp 10.0.2.105 53308 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:06:44.310687 0.063509 tcp 10.0.2.105 53309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:06:44.374520 0.078229 tcp 10.0.2.105 53310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:06:44.453041 0.156761 tcp 10.0.2.105 53311 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:06:44.899025 2.991018 tcp 10.0.2.105 53312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:06:53.850276 0.000000 tcp 10.0.2.105 53312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:06:59.793107 0.060883 tcp 10.0.2.105 53313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:06:59.854306 0.066728 tcp 10.0.2.105 53314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:06:59.921388 0.154497 tcp 10.0.2.105 53315 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:00.191031 3.289961 tcp 10.0.2.105 53316 -> 46.48.223.67 15494 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:02.995036 0.115743 tcp 10.0.2.105 53317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:03.111086 0.064447 tcp 10.0.2.105 53318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:03.175865 0.154584 tcp 10.0.2.105 53319 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:03.481286 2.996459 tcp 10.0.2.105 53320 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:12.478835 0.000000 tcp 10.0.2.105 53320 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:18.477119 0.060044 tcp 10.0.2.105 53321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:18.537435 0.065723 tcp 10.0.2.105 53322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:18.603471 0.160069 tcp 10.0.2.105 53323 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:18.970172 2.999983 tcp 10.0.2.105 53324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:27.968911 0.000000 tcp 10.0.2.105 53324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:33.967549 3.005322 tcp 10.0.2.105 53325 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:42.973697 0.000000 tcp 10.0.2.105 53325 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:07:47.877612 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:07:48.969193 2.290158 tcp 10.0.2.105 53326 -> 46.48.223.67 15494 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:07:51.259593 2.968212 tcp 10.0.2.105 53327 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:08:00.657846 0.000000 tcp 10.0.2.105 53327 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:11:16.410962 3.000656 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:11:23.417096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:11:31.420006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:11:47.421589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:12:19.427558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:13:05.834958 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:13:05.835167 3.003400 tcp 10.0.2.105 53328 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:14.837419 0.000000 tcp 10.0.2.105 53328 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:20.837229 0.060460 tcp 10.0.2.105 53329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:20.897959 0.061109 tcp 10.0.2.105 53330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:20.959344 0.147872 tcp 10.0.2.105 53331 -> 195.113.214.249 443 SRPA* 0 0 45 20812 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:21.432214 2.999322 tcp 10.0.2.105 53332 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:30.429766 0.000000 tcp 10.0.2.105 53332 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:36.429002 0.065639 tcp 10.0.2.105 53333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:36.494488 0.060036 tcp 10.0.2.105 53334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:36.554804 0.157579 tcp 10.0.2.105 53335 -> 195.113.214.249 443 SRPA* 0 0 26 14270 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:37.140978 2.351910 tcp 10.0.2.105 53336 -> 46.48.223.67 15494 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:39.157243 0.060899 tcp 10.0.2.105 53337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:39.218425 0.064771 tcp 10.0.2.105 53338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:39.283685 0.158202 tcp 10.0.2.105 53339 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:39.493141 3.004124 tcp 10.0.2.105 53340 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:48.499345 0.000000 tcp 10.0.2.105 53340 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:13:54.495139 0.071205 tcp 10.0.2.105 53341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:54.566664 0.064543 tcp 10.0.2.105 53342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:54.631501 0.158306 tcp 10.0.2.105 53343 -> 195.113.214.249 443 SRPA* 0 0 32 17198 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:13:54.950394 2.999060 tcp 10.0.2.105 53344 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:14:03.948135 0.000000 tcp 10.0.2.105 53344 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:14:09.953901 2.997312 tcp 10.0.2.105 53345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:14:18.951196 0.000000 tcp 10.0.2.105 53345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:14:23.876179 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:14:24.948518 1.811074 tcp 10.0.2.105 53346 -> 46.48.223.67 15494 FSPA* 0 0 14 1630 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:14:26.759381 2.995550 tcp 10.0.2.105 53347 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:14:35.753547 0.000000 tcp 10.0.2.105 53347 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:18:23.433994 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:18:30.441087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:18:38.442777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:18:54.446083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:19:26.451782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:19:41.754119 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:19:41.754219 3.003673 tcp 10.0.2.105 53348 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:19:50.756534 0.000000 tcp 10.0.2.105 53348 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:19:56.756609 0.065332 tcp 10.0.2.105 53349 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:19:56.822205 0.066487 tcp 10.0.2.105 53350 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:19:56.888518 0.148540 tcp 10.0.2.105 53351 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:19:57.192700 2.998383 tcp 10.0.2.105 53352 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:06.188874 0.000000 tcp 10.0.2.105 53352 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:12.187878 0.067838 tcp 10.0.2.105 53353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:12.255995 0.062722 tcp 10.0.2.105 53354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:12.319000 0.151128 tcp 10.0.2.105 53355 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:12.711800 3.147859 tcp 10.0.2.105 53356 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:15.280802 0.061687 tcp 10.0.2.105 53357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:15.342890 0.062378 tcp 10.0.2.105 53358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:15.405585 0.152834 tcp 10.0.2.105 53359 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:15.859873 2.998865 tcp 10.0.2.105 53360 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:24.855555 0.000000 tcp 10.0.2.105 53360 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:30.854778 0.065253 tcp 10.0.2.105 53361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:30.920417 0.062549 tcp 10.0.2.105 53362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:30.983219 0.161951 tcp 10.0.2.105 53363 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:20:31.258527 3.000545 tcp 10.0.2.105 53364 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:40.260071 0.000000 tcp 10.0.2.105 53364 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:46.256333 3.004502 tcp 10.0.2.105 53365 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:55.259297 0.000000 tcp 10.0.2.105 53365 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:20:59.876119 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:21:01.258323 1.932342 tcp 10.0.2.105 53366 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:21:03.190911 2.977507 tcp 10.0.2.105 53367 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:21:12.238463 0.000000 tcp 10.0.2.105 53367 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:25:30.457401 3.001970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:25:37.465339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:25:45.466815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:26:01.469613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:26:33.475734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:29:30.880922 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:29:30.881181 0.000000 udp 10.0.2.105 7010 -> 99.135.106.151 4296 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 21:29:46.445110 0.061273 tcp 10.0.2.105 53368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:29:46.506768 0.061639 tcp 10.0.2.105 53369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:29:46.568425 0.155558 tcp 10.0.2.105 53370 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:29:46.723746 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/16 21:30:01.826026 0.060881 tcp 10.0.2.105 53371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:01.887263 0.066400 tcp 10.0.2.105 53372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:01.954030 0.154036 tcp 10.0.2.105 53373 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:02.108686 0.182453 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:02.269744 0.215752 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:02.475102 0.115147 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:02.693595 0.188522 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:02.853258 0.303222 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:03.137641 0.237698 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:03.184532 3.199007 tcp 10.0.2.105 53374 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:03.367773 0.173431 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:03.537422 0.176656 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:03.717801 0.221128 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:03.936549 0.182526 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:04.113959 0.402903 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:04.579742 0.269802 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:04.847622 0.215942 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.055406 0.166915 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.203886 0.088248 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.275963 0.077889 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.342283 0.192812 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.471631 0.187093 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.655226 0.131252 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:05.739305 0.343366 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:06.133195 0.026738 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:06.175046 0.352751 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:06.523957 0.204009 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:06.728822 0.176277 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:06.902064 0.184216 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:07.078165 0.775495 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:07.831470 0.084921 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:07.895388 0.238069 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:08.113898 0.197301 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/16 21:30:12.325106 0.000000 tcp 10.0.2.105 53374 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:18.258739 0.061031 tcp 10.0.2.105 53375 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:18.320106 0.063179 tcp 10.0.2.105 53376 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:18.383564 0.153070 tcp 10.0.2.105 53377 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:18.582676 2.970024 tcp 10.0.2.105 53378 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:27.512055 0.000000 tcp 10.0.2.105 53378 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:33.501294 0.060959 tcp 10.0.2.105 53379 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:33.562581 0.066140 tcp 10.0.2.105 53380 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:33.629000 0.156356 tcp 10.0.2.105 53381 -> 195.113.214.249 443 SRPA* 0 0 40 22368 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:30:33.907501 2.998095 tcp 10.0.2.105 53382 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:42.904062 0.000000 tcp 10.0.2.105 53382 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:48.903154 3.003933 tcp 10.0.2.105 53383 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:30:57.905826 0.000000 tcp 10.0.2.105 53383 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:31:02.873122 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:32:37.482606 3.000490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:32:44.489669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:32:52.490676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:33:08.493591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:33:40.501129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:36:03.906589 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:36:03.906802 3.003431 tcp 10.0.2.105 53384 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:36:12.908753 0.000000 tcp 10.0.2.105 53384 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:36:18.909304 0.061334 tcp 10.0.2.105 53385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:18.970916 0.065060 tcp 10.0.2.105 53386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:19.036503 0.152948 tcp 10.0.2.105 53387 -> 195.113.214.249 443 SRPA* 0 0 43 35912 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:19.267032 2.995342 tcp 10.0.2.105 53388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:36:28.260649 0.000000 tcp 10.0.2.105 53388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:36:34.260029 0.063904 tcp 10.0.2.105 53389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:34.324348 0.062123 tcp 10.0.2.105 53390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:34.386312 0.149170 tcp 10.0.2.105 53391 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:34.844961 0.844470 tcp 10.0.2.105 53392 -> 46.48.223.67 15494 SPA_* 0 0 9 991 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:46.594641 0.513945 tcp 10.0.2.105 53392 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:46.595390 0.063108 tcp 10.0.2.105 53393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:46.658795 0.062751 tcp 10.0.2.105 53394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:46.721860 0.206613 tcp 10.0.2.105 53395 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:36:47.108854 2.977989 tcp 10.0.2.105 53396 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:36:56.028045 0.000000 tcp 10.0.2.105 53396 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:01.969474 0.066752 tcp 10.0.2.105 53397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:37:02.036567 0.061409 tcp 10.0.2.105 53398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:37:02.098293 0.156642 tcp 10.0.2.105 53399 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:37:02.406025 2.955068 tcp 10.0.2.105 53400 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:11.312234 0.000000 tcp 10.0.2.105 53400 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:17.252576 2.967479 tcp 10.0.2.105 53401 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:26.183598 0.000000 tcp 10.0.2.105 53401 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:30.870921 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:37:32.192823 2.895789 tcp 10.0.2.105 53402 -> 46.48.223.67 15494 FSPA* 0 0 14 1521 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:37:35.088820 3.002558 tcp 10.0.2.105 53403 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:37:44.090047 0.000000 tcp 10.0.2.105 53403 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:39:44.505966 3.000752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:39:51.512921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:39:59.514400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:40:15.517544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:40:47.523246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:42:50.090521 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:42:50.090735 2.995390 tcp 10.0.2.105 53404 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:42:59.092820 0.000000 tcp 10.0.2.105 53404 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:05.093447 0.061541 tcp 10.0.2.105 53405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:05.155259 0.064689 tcp 10.0.2.105 53406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:05.220304 0.156672 tcp 10.0.2.105 53407 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:05.673625 3.002888 tcp 10.0.2.105 53408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:14.675112 0.000000 tcp 10.0.2.105 53408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:20.674494 0.060328 tcp 10.0.2.105 53409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:20.735102 0.066253 tcp 10.0.2.105 53410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:20.801631 0.149756 tcp 10.0.2.105 53411 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:21.264530 2.674980 tcp 10.0.2.105 53412 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:23.376776 0.060207 tcp 10.0.2.105 53413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:23.437277 0.061631 tcp 10.0.2.105 53414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:23.499238 0.158446 tcp 10.0.2.105 53415 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:23.939737 3.002998 tcp 10.0.2.105 53416 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:32.941384 0.000000 tcp 10.0.2.105 53416 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:38.940863 0.068237 tcp 10.0.2.105 53417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:39.009388 0.068562 tcp 10.0.2.105 53418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:39.078250 0.160608 tcp 10.0.2.105 53419 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:43:39.533170 3.002045 tcp 10.0.2.105 53420 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:48.533850 0.000000 tcp 10.0.2.105 53420 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:43:54.532650 2.994729 tcp 10.0.2.105 53421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:44:03.525366 0.000000 tcp 10.0.2.105 53421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:44:08.372624 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:44:09.534410 3.075904 tcp 10.0.2.105 53422 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:44:12.610586 3.002235 tcp 10.0.2.105 53423 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:44:21.611467 0.000000 tcp 10.0.2.105 53423 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:46:51.529915 3.001263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:46:58.537102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:47:06.541335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:47:22.542056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:47:54.548144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:49:27.611852 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:49:27.612126 2.993505 tcp 10.0.2.105 53424 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:49:36.604517 0.000000 tcp 10.0.2.105 53424 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:49:42.614763 0.066054 tcp 10.0.2.105 53425 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:42.681109 0.063028 tcp 10.0.2.105 53426 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:42.744395 0.152297 tcp 10.0.2.105 53427 -> 195.113.214.249 443 SRPA* 0 0 40 33104 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:43.222040 2.997505 tcp 10.0.2.105 53428 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:49:52.223935 0.000000 tcp 10.0.2.105 53428 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:49:58.216300 0.068098 tcp 10.0.2.105 53429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:58.284712 0.066547 tcp 10.0.2.105 53430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:58.351597 0.151649 tcp 10.0.2.105 53431 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:49:58.588922 2.481885 tcp 10.0.2.105 53432 -> 46.48.223.67 15494 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:00.466353 0.061221 tcp 10.0.2.105 53433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:00.527903 0.060803 tcp 10.0.2.105 53434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:00.589021 0.161870 tcp 10.0.2.105 53435 -> 195.113.214.249 443 SRPA* 0 0 24 9668 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:01.071051 2.992667 tcp 10.0.2.105 53436 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:10.071867 0.000000 tcp 10.0.2.105 53436 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:16.071675 0.063291 tcp 10.0.2.105 53437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:16.135285 0.065010 tcp 10.0.2.105 53438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:16.200645 0.160623 tcp 10.0.2.105 53439 -> 195.113.214.249 443 SRPA* 0 0 48 42022 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:16.675813 3.000173 tcp 10.0.2.105 53440 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:25.674557 0.000000 tcp 10.0.2.105 53440 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:31.673625 3.004006 tcp 10.0.2.105 53441 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:40.676515 0.000000 tcp 10.0.2.105 53441 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:45.373231 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:50:46.675199 1.880303 tcp 10.0.2.105 53442 -> 46.48.223.67 15494 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:50:48.555685 3.006364 tcp 10.0.2.105 53443 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:50:57.560609 0.000000 tcp 10.0.2.105 53443 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:53:58.554047 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 21:54:05.560850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:54:13.562738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:54:29.565427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:55:01.571357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 21:56:03.552069 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 21:56:03.552211 2.992734 tcp 10.0.2.105 53444 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:56:12.543628 0.000000 tcp 10.0.2.105 53444 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:56:18.554317 0.065139 tcp 10.0.2.105 53445 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:18.619721 0.062046 tcp 10.0.2.105 53446 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:18.682153 0.147908 tcp 10.0.2.105 53447 -> 195.113.214.249 443 SRPA* 0 0 37 26980 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:19.310204 3.371635 tcp 10.0.2.105 53448 -> 46.48.223.67 15494 SPA_* 0 0 10 1195 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:25.302960 0.348097 tcp 10.0.2.105 53448 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:25.303833 0.064959 tcp 10.0.2.105 53449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:25.369096 0.067950 tcp 10.0.2.105 53450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:25.437372 0.153118 tcp 10.0.2.105 53451 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 21:56:25.651256 3.000077 tcp 10.0.2.105 53452 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:56:34.645276 0.000000 tcp 10.0.2.105 53452 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 21:56:40.644018 1.818153 tcp 10.0.2.105 53453 -> 46.48.223.67 15494 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:00:19.088261 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:00:19.088370 0.109824 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:19.166447 0.192117 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:19.329723 0.136782 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:19.517116 0.183059 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:19.676939 0.207736 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:20.120712 0.234591 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:20.347910 0.172698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:20.516705 0.175926 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:20.807482 0.214964 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:21.019900 0.183172 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:21.197847 0.358010 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:21.527677 0.058908 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:21.723677 0.211920 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:21.929035 0.169569 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:22.078655 0.086059 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:22.173134 0.090032 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:22.224012 0.128460 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:22.682547 0.387211 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:23.135339 0.021490 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:23.345840 0.185063 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:23.469752 0.187630 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:23.743375 0.349340 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:24.223549 0.199427 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:24.688420 0.176933 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:24.862483 0.186829 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:25.140947 0.237846 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:25.358363 0.196545 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:25.547825 0.449260 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:00:26.027194 0.083803 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:01:05.577701 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:01:12.584941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:01:20.586563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:01:36.591062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:01:42.458417 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:01:42.458546 3.003487 tcp 10.0.2.105 53454 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:01:51.460976 0.000000 tcp 10.0.2.105 53454 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:01:57.461720 0.063710 tcp 10.0.2.105 53455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:01:57.525715 0.061408 tcp 10.0.2.105 53456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:01:57.587381 0.154121 tcp 10.0.2.105 53457 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:01:58.229189 2.995558 tcp 10.0.2.105 53458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:07.223559 0.000000 tcp 10.0.2.105 53458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:08.595508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:02:13.222724 0.063799 tcp 10.0.2.105 53459 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:13.286873 0.095481 tcp 10.0.2.105 53460 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:13.382639 0.152744 tcp 10.0.2.105 53461 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:13.670071 2.470299 tcp 10.0.2.105 53462 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:15.483563 0.064649 tcp 10.0.2.105 53463 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:15.548547 0.063325 tcp 10.0.2.105 53464 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:15.612174 0.156249 tcp 10.0.2.105 53465 -> 195.113.214.249 443 SRPA* 0 0 48 41324 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:16.140595 2.999983 tcp 10.0.2.105 53466 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:25.139438 0.000000 tcp 10.0.2.105 53466 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:31.138708 0.066852 tcp 10.0.2.105 53467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:31.205867 0.062249 tcp 10.0.2.105 53468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:31.268549 0.155987 tcp 10.0.2.105 53469 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:02:31.638023 3.010445 tcp 10.0.2.105 53470 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:40.651619 0.000000 tcp 10.0.2.105 53470 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:46.630361 2.994386 tcp 10.0.2.105 53471 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:02:55.633004 0.000000 tcp 10.0.2.105 53471 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:03:00.369884 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:03:01.631594 4.501406 tcp 10.0.2.105 53472 -> 46.48.223.67 15494 FSPA* 0 0 15 1737 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:03:04.631710 2.998894 tcp 10.0.2.105 53473 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:03:13.629076 0.000000 tcp 10.0.2.105 53473 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:08:12.602478 3.000718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:08:19.612623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:08:19.633111 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:08:19.633272 2.989907 tcp 10.0.2.105 53474 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:08:27.611676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:08:28.634711 0.000000 tcp 10.0.2.105 53474 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:08:34.632456 0.061343 tcp 10.0.2.105 53475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:34.694072 0.065757 tcp 10.0.2.105 53476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:34.760093 0.234367 tcp 10.0.2.105 53477 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:35.093978 3.001490 tcp 10.0.2.105 53478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:08:43.613252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:08:44.094011 0.000000 tcp 10.0.2.105 53478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:08:50.093440 0.063447 tcp 10.0.2.105 53479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:50.157143 0.067506 tcp 10.0.2.105 53480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:50.224932 0.155600 tcp 10.0.2.105 53481 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:50.405706 0.375379 tcp 10.0.2.105 53482 -> 46.48.223.67 15494 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:57.106776 0.480311 tcp 10.0.2.105 53482 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:57.107607 0.060535 tcp 10.0.2.105 53483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:57.168423 0.064884 tcp 10.0.2.105 53484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:57.233652 0.157810 tcp 10.0.2.105 53485 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:08:57.587329 3.000417 tcp 10.0.2.105 53486 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:06.586117 0.000000 tcp 10.0.2.105 53486 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:12.585729 0.063594 tcp 10.0.2.105 53487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:09:12.649628 0.061665 tcp 10.0.2.105 53488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:09:12.711553 0.159378 tcp 10.0.2.105 53489 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:09:13.594736 3.006099 tcp 10.0.2.105 53490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:15.619587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:09:22.599582 0.000000 tcp 10.0.2.105 53490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:28.588555 3.004226 tcp 10.0.2.105 53491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:36.369218 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:09:37.591120 0.000000 tcp 10.0.2.105 53491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:43.589964 1.849581 tcp 10.0.2.105 53492 -> 46.48.223.67 15494 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:09:45.439829 2.996230 tcp 10.0.2.105 53493 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:09:54.435065 0.000000 tcp 10.0.2.105 53493 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:00.435862 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:15:00.436025 3.003293 tcp 10.0.2.105 53494 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:09.441060 0.000000 tcp 10.0.2.105 53494 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:15.438631 0.062628 tcp 10.0.2.105 53495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:15.501509 0.064477 tcp 10.0.2.105 53496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:15.566305 0.156595 tcp 10.0.2.105 53497 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:15.733787 3.007642 tcp 10.0.2.105 53498 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:19.626165 3.001103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:15:24.740151 0.000000 tcp 10.0.2.105 53498 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:26.632878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:15:30.729463 0.060198 tcp 10.0.2.105 53499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:30.789929 0.064528 tcp 10.0.2.105 53500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:30.854766 0.156826 tcp 10.0.2.105 53501 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:31.334661 4.743407 tcp 10.0.2.105 53502 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:34.634573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:15:35.556560 0.065436 tcp 10.0.2.105 53503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:35.622464 0.065393 tcp 10.0.2.105 53504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:35.688209 0.149950 tcp 10.0.2.105 53505 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:36.078257 3.002707 tcp 10.0.2.105 53506 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:45.079518 0.000000 tcp 10.0.2.105 53506 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:15:50.637376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:15:51.078597 0.060238 tcp 10.0.2.105 53507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:51.139118 0.065215 tcp 10.0.2.105 53508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:51.204366 0.154006 tcp 10.0.2.105 53509 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:15:51.965238 2.997946 tcp 10.0.2.105 53510 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:16:00.973313 0.000000 tcp 10.0.2.105 53510 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:16:06.960944 2.994318 tcp 10.0.2.105 53511 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:16:14.871627 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:16:15.953428 0.000000 tcp 10.0.2.105 53511 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:16:21.962764 0.367967 tcp 10.0.2.105 53512 -> 46.48.223.67 15494 SPA_* 0 0 9 1013 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:16:22.643252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:16:28.827590 0.000405 tcp 10.0.2.105 53512 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:16:28.828185 2.998113 tcp 10.0.2.105 53513 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:16:37.825031 0.000000 tcp 10.0.2.105 53513 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:21:43.825651 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:21:43.825749 3.003740 tcp 10.0.2.105 53514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:21:52.828135 0.000000 tcp 10.0.2.105 53514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:21:58.829001 0.066274 tcp 10.0.2.105 53515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:21:58.895614 0.062658 tcp 10.0.2.105 53516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:21:58.958643 0.162022 tcp 10.0.2.105 53517 -> 195.113.214.249 443 SRPA* 0 0 24 10254 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:21:59.312138 2.999345 tcp 10.0.2.105 53518 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:08.313510 0.000000 tcp 10.0.2.105 53518 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:14.309651 0.062226 tcp 10.0.2.105 53519 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:14.372176 0.065539 tcp 10.0.2.105 53520 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:14.438091 0.152906 tcp 10.0.2.105 53521 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:15.185489 3.719506 tcp 10.0.2.105 53522 -> 46.48.223.67 15494 FSPA* 0 0 15 1697 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:17.021872 0.064885 tcp 10.0.2.105 53523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:17.087060 0.064849 tcp 10.0.2.105 53524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:17.152139 0.151946 tcp 10.0.2.105 53525 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:17.432851 3.004942 tcp 10.0.2.105 53526 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:26.435970 0.000000 tcp 10.0.2.105 53526 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:26.649435 3.001653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:22:32.425775 0.061081 tcp 10.0.2.105 53527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:32.487182 0.062709 tcp 10.0.2.105 53528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:32.550214 0.151678 tcp 10.0.2.105 53529 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:22:32.890013 2.999991 tcp 10.0.2.105 53530 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:33.656855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:22:41.658473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:22:41.888627 0.000000 tcp 10.0.2.105 53530 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:47.887605 3.004121 tcp 10.0.2.105 53531 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:56.890056 0.000000 tcp 10.0.2.105 53531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:22:57.661444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:23:01.877382 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:23:02.888877 1.821421 tcp 10.0.2.105 53532 -> 46.48.223.67 15494 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:23:04.710565 2.994971 tcp 10.0.2.105 53533 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:23:13.703894 0.000000 tcp 10.0.2.105 53533 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:23:29.667713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:29:33.675800 2.999615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/16 22:29:40.680834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:29:48.682556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:30:04.685079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:30:27.508754 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:30:27.508891 0.112318 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:27.587223 0.185437 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:27.751353 0.191567 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:27.914544 0.124463 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:28.074781 0.207139 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:28.271369 0.242380 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:28.702235 0.170926 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:28.870653 0.183490 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:29.090309 0.178691 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:29.622471 0.216158 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:29.835179 0.217761 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:30.495873 0.362013 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:30.829105 0.058671 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.053646 0.170073 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.202893 0.086500 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.350150 0.090561 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.401448 0.025998 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.622613 0.145252 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:31.721739 0.348552 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:32.076890 0.161550 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:32.184557 0.190457 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:32.371979 0.353845 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:32.722057 0.201759 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:32.974942 0.176907 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:33.148491 0.186950 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:33.328196 0.237171 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:33.544957 0.195299 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:33.733077 0.448548 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:34.157365 0.082339 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/16 22:30:34.718718 3.004233 tcp 10.0.2.105 53534 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:30:36.691350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:30:43.734591 0.000000 tcp 10.0.2.105 53534 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:30:49.722107 0.062013 tcp 10.0.2.105 53535 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:30:49.784382 0.063845 tcp 10.0.2.105 53536 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:30:49.848532 0.155454 tcp 10.0.2.105 53537 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:30:50.115670 2.999455 tcp 10.0.2.105 53538 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:30:59.114655 0.000000 tcp 10.0.2.105 53538 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:31:05.112778 0.066407 tcp 10.0.2.105 53539 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:05.179544 0.061600 tcp 10.0.2.105 53540 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:05.241428 0.155058 tcp 10.0.2.105 53541 -> 195.113.214.249 443 SRPA* 0 0 33 16086 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:05.463135 0.379146 tcp 10.0.2.105 53542 -> 46.48.223.67 15494 SPA_* 0 0 9 1154 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:24.464313 0.327729 tcp 10.0.2.105 53542 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:24.465375 0.065533 tcp 10.0.2.105 53543 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:24.531248 0.062410 tcp 10.0.2.105 53544 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:24.593949 0.159269 tcp 10.0.2.105 53545 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:24.792339 2.992351 tcp 10.0.2.105 53546 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:31:33.793659 0.000000 tcp 10.0.2.105 53546 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:31:39.782691 0.062424 tcp 10.0.2.105 53547 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:39.845436 0.064908 tcp 10.0.2.105 53548 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:39.910670 0.151440 tcp 10.0.2.105 53549 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:31:40.101911 2.994272 tcp 10.0.2.105 53550 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:31:49.095180 0.000000 tcp 10.0.2.105 53550 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:31:55.094249 3.004142 tcp 10.0.2.105 53551 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:32:04.097028 0.000000 tcp 10.0.2.105 53551 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:32:08.873884 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:32:10.095527 0.382764 tcp 10.0.2.105 53552 -> 46.48.223.67 15494 SPA_* 0 0 9 1154 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:32:36.337086 0.000376 tcp 10.0.2.105 53552 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:32:36.337679 3.003734 tcp 10.0.2.105 53553 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:32:45.337663 0.000000 tcp 10.0.2.105 53553 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:36:40.696678 3.002176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:36:47.704789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:36:55.705739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:37:11.709024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:37:43.714928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:37:51.336839 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:37:51.336993 3.005643 tcp 10.0.2.105 53554 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:00.339225 0.000000 tcp 10.0.2.105 53554 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:06.339992 0.063802 tcp 10.0.2.105 53555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:06.404050 0.066703 tcp 10.0.2.105 53556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:06.471048 0.161773 tcp 10.0.2.105 53557 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:07.096858 2.996287 tcp 10.0.2.105 53558 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:16.101746 0.000000 tcp 10.0.2.105 53558 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:22.094252 0.060672 tcp 10.0.2.105 53559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:22.155240 0.064334 tcp 10.0.2.105 53560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:22.219872 0.159434 tcp 10.0.2.105 53561 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:22.777795 0.382499 tcp 10.0.2.105 53562 -> 46.48.223.67 15494 SPA_* 0 0 9 1089 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:36.532162 0.764650 tcp 10.0.2.105 53562 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:36.533094 0.061455 tcp 10.0.2.105 53563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:36.594838 0.063615 tcp 10.0.2.105 53564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:36.658753 0.156109 tcp 10.0.2.105 53565 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:37.297047 2.999029 tcp 10.0.2.105 53566 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:46.301816 0.000000 tcp 10.0.2.105 53566 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:38:52.294558 0.063000 tcp 10.0.2.105 53567 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:52.357880 0.064868 tcp 10.0.2.105 53568 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:52.423086 0.149857 tcp 10.0.2.105 53569 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:38:53.022886 3.156200 tcp 10.0.2.105 53570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:39:02.117933 0.000000 tcp 10.0.2.105 53570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:39:08.056655 4.461710 tcp 10.0.2.105 53571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:39:18.441808 0.000000 tcp 10.0.2.105 53571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:39:23.224419 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:39:24.374959 1.889659 tcp 10.0.2.105 53572 -> 46.48.223.67 15494 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:39:26.264864 2.955085 tcp 10.0.2.105 53573 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:39:35.144379 0.000000 tcp 10.0.2.105 53573 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:43:47.721327 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:43:54.728869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:44:02.730754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:44:18.733416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:44:39.947977 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:44:39.948087 2.999788 tcp 10.0.2.105 53574 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:44:48.946771 0.000000 tcp 10.0.2.105 53574 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:44:50.749296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:44:54.946682 0.065984 tcp 10.0.2.105 53575 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:44:55.012943 0.062226 tcp 10.0.2.105 53576 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:44:55.075438 0.170711 tcp 10.0.2.105 53577 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:44:55.287234 3.002974 tcp 10.0.2.105 53578 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:04.288895 0.000000 tcp 10.0.2.105 53578 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:10.288075 0.062108 tcp 10.0.2.105 53579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:10.350496 0.063908 tcp 10.0.2.105 53580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:10.414711 0.159314 tcp 10.0.2.105 53581 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:10.871468 2.258674 tcp 10.0.2.105 53582 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:12.711864 0.060677 tcp 10.0.2.105 53583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:12.772889 0.065094 tcp 10.0.2.105 53584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:12.838242 0.159991 tcp 10.0.2.105 53585 -> 195.113.214.249 443 SRPA* 0 0 43 34706 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:13.130362 2.995460 tcp 10.0.2.105 53586 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:22.123875 0.000000 tcp 10.0.2.105 53586 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:28.123342 1.254613 tcp 10.0.2.105 53587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:29.378275 0.069061 tcp 10.0.2.105 53588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:29.447573 0.156927 tcp 10.0.2.105 53589 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:45:30.569132 2.965203 tcp 10.0.2.105 53590 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:39.460718 0.000000 tcp 10.0.2.105 53590 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:45.384278 2.973153 tcp 10.0.2.105 53591 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:45:53.144889 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:45:54.284772 0.000000 tcp 10.0.2.105 53591 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:46:00.209934 0.373002 tcp 10.0.2.105 53592 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:46:13.864133 0.000488 tcp 10.0.2.105 53592 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:46:13.864886 2.972133 tcp 10.0.2.105 53593 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:46:22.762035 0.000000 tcp 10.0.2.105 53593 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:51:28.343233 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:51:28.343405 2.991723 tcp 10.0.2.105 53594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:51:37.336014 0.000000 tcp 10.0.2.105 53594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:51:43.344640 0.069093 tcp 10.0.2.105 53595 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:43.413987 0.063008 tcp 10.0.2.105 53596 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:43.477269 0.178645 tcp 10.0.2.105 53597 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:43.709979 2.997384 tcp 10.0.2.105 53598 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:51:52.706015 0.000000 tcp 10.0.2.105 53598 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:51:58.705229 0.062024 tcp 10.0.2.105 53599 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:58.767550 0.066460 tcp 10.0.2.105 53600 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:58.834348 0.159046 tcp 10.0.2.105 53601 -> 195.113.214.249 443 SRPA* 0 0 25 13442 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:51:59.022252 4.398724 tcp 10.0.2.105 53602 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:02.649839 0.065555 tcp 10.0.2.105 53603 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:02.715681 0.064454 tcp 10.0.2.105 53604 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:02.780592 0.160756 tcp 10.0.2.105 53605 -> 195.113.214.249 443 SRPA* 0 0 43 37080 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:03.421438 2.962127 tcp 10.0.2.105 53606 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:12.328049 0.000000 tcp 10.0.2.105 53606 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:18.279443 0.063541 tcp 10.0.2.105 53607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:18.343292 0.064834 tcp 10.0.2.105 53608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:18.408416 0.154941 tcp 10.0.2.105 53609 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:18.695108 2.962063 tcp 10.0.2.105 53610 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:27.602762 0.000000 tcp 10.0.2.105 53610 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:33.548061 2.972680 tcp 10.0.2.105 53611 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:42.477675 0.000000 tcp 10.0.2.105 53611 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:47.374597 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 22:52:48.476181 1.846215 tcp 10.0.2.105 53612 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/16 22:52:50.322664 2.990478 tcp 10.0.2.105 53613 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:52:59.321723 0.000000 tcp 10.0.2.105 53613 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 22:56:02.763276 2.996745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 22:56:09.765656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:56:17.767022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:56:33.770026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 22:57:05.776176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:00:54.154299 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:00:54.154393 0.190542 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:54.315897 0.123376 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:54.421929 0.114402 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:54.563500 0.401557 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:55.053082 0.214911 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:55.255574 0.238530 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:55.486206 0.169010 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:55.652420 0.183214 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:55.830974 0.173648 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:56.282090 0.225694 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:56.504400 0.058313 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:56.952169 0.168062 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:57.101935 0.211381 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:57.306625 0.355997 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:57.635406 0.082850 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:57.858893 0.085727 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:57.906284 0.030276 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:58.051504 0.140004 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:58.147889 0.355660 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:58.650284 0.195027 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:58.777965 0.205129 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:58.978152 0.174879 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:59.216795 0.186867 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:59.400937 0.423969 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:00:59.934352 0.186419 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:01:00.114400 0.237021 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:01:00.333099 0.198306 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:01:00.523553 0.444972 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:01:00.945706 0.086470 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:01:05.341342 2.993517 tcp 10.0.2.105 53614 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:14.333564 0.000000 tcp 10.0.2.105 53614 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:18.869937 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:01:20.344135 0.061556 tcp 10.0.2.105 53615 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:20.405960 0.072325 tcp 10.0.2.105 53616 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:20.478580 0.148856 tcp 10.0.2.105 53617 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:21.093414 3.007354 tcp 10.0.2.105 53618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:30.095966 0.000000 tcp 10.0.2.105 53618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:36.095367 0.065113 tcp 10.0.2.105 53619 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:36.160794 0.063643 tcp 10.0.2.105 53620 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:36.224716 0.157986 tcp 10.0.2.105 53621 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:36.780319 2.206626 tcp 10.0.2.105 53622 -> 46.48.223.67 15494 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:38.627939 0.064609 tcp 10.0.2.105 53623 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:38.692953 0.064229 tcp 10.0.2.105 53624 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:38.757438 0.155267 tcp 10.0.2.105 53625 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:38.987163 2.996242 tcp 10.0.2.105 53626 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:47.991694 0.000000 tcp 10.0.2.105 53626 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:01:53.981414 0.061576 tcp 10.0.2.105 53627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:54.043315 0.061185 tcp 10.0.2.105 53628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:54.104796 0.162013 tcp 10.0.2.105 53629 -> 195.113.214.249 443 SRPA* 0 0 41 21452 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:01:54.399742 2.985751 tcp 10.0.2.105 53630 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:02:03.383769 0.000000 tcp 10.0.2.105 53630 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:02:09.392683 3.004239 tcp 10.0.2.105 53631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:02:18.395714 0.000000 tcp 10.0.2.105 53631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:02:23.372996 0.752855 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:02:25.124138 4.382173 tcp 10.0.2.105 53632 -> 46.48.223.67 15494 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:02:29.506605 2.959066 tcp 10.0.2.105 53633 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:02:38.398772 0.000000 tcp 10.0.2.105 53633 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:03:09.956467 2.964644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:03:16.875733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:03:24.791023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:03:40.794232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:04:12.800098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:07:43.823509 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:07:43.823680 3.004120 tcp 10.0.2.105 53634 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:07:52.826582 0.000000 tcp 10.0.2.105 53634 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:07:58.826735 1.373667 tcp 10.0.2.105 53635 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:00.200708 0.060711 tcp 10.0.2.105 53636 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:00.261739 0.161217 tcp 10.0.2.105 53637 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:03.399941 2.965333 tcp 10.0.2.105 53638 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:08:12.298452 0.000000 tcp 10.0.2.105 53638 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:08:19.567522 0.453640 tcp 10.0.2.105 53639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:20.021437 0.065557 tcp 10.0.2.105 53640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:20.087294 0.153566 tcp 10.0.2.105 53641 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:22.148546 1.858263 tcp 10.0.2.105 53642 -> 46.48.223.67 15494 SPA_* 0 0 12 1422 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:24.007257 0.060142 tcp 10.0.2.105 53643 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:24.067725 0.061897 tcp 10.0.2.105 53644 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:24.129981 0.152617 tcp 10.0.2.105 53645 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:30.068584 0.000079 tcp 10.0.2.105 53642 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:30.068980 2.976591 tcp 10.0.2.105 53646 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:08:38.987890 0.000000 tcp 10.0.2.105 53646 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:08:44.921633 0.061279 tcp 10.0.2.105 53647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:44.983265 0.065831 tcp 10.0.2.105 53648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:45.049405 0.155506 tcp 10.0.2.105 53649 -> 195.113.214.249 443 SRPA* 0 0 40 34524 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:08:47.262776 2.956621 tcp 10.0.2.105 53650 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:08:56.159838 0.000000 tcp 10.0.2.105 53650 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:09:02.382262 2.968028 tcp 10.0.2.105 53651 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:09:10.895262 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:09:12.152809 0.000000 tcp 10.0.2.105 53651 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:09:18.096150 3.017771 tcp 10.0.2.105 53652 -> 46.48.223.67 15494 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:09:21.114161 2.960469 tcp 10.0.2.105 53653 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:09:30.008947 0.000000 tcp 10.0.2.105 53653 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:10:21.425174 2.969681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:10:28.341830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:10:36.233792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:10:52.013364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:11:23.578496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:14:32.872193 0.000200 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:14:32.872499 2.993567 tcp 10.0.2.105 53654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:14:41.864005 0.000000 tcp 10.0.2.105 53654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:14:47.874493 0.064579 tcp 10.0.2.105 53655 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:14:47.939376 0.065383 tcp 10.0.2.105 53656 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:14:48.005018 0.157649 tcp 10.0.2.105 53657 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:14:48.352618 2.995539 tcp 10.0.2.105 53658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:14:57.346234 0.000000 tcp 10.0.2.105 53658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:03.345365 0.066453 tcp 10.0.2.105 53659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:03.412114 0.061319 tcp 10.0.2.105 53660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:03.473731 0.163455 tcp 10.0.2.105 53661 -> 195.113.214.249 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:03.837572 2.284274 tcp 10.0.2.105 53662 -> 46.48.223.67 15494 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:05.654345 0.065743 tcp 10.0.2.105 53663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:05.720453 0.066274 tcp 10.0.2.105 53664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:05.787025 0.165176 tcp 10.0.2.105 53665 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:06.122041 2.992102 tcp 10.0.2.105 53666 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:15.122629 0.000000 tcp 10.0.2.105 53666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:21.121646 0.059682 tcp 10.0.2.105 53667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:21.181653 0.060930 tcp 10.0.2.105 53668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:21.242873 0.232019 tcp 10.0.2.105 53669 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:21.871728 2.994819 tcp 10.0.2.105 53670 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:30.867851 0.000000 tcp 10.0.2.105 53670 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:36.863798 3.003855 tcp 10.0.2.105 53671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:45.866601 0.000000 tcp 10.0.2.105 53671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:15:50.533156 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:15:51.865297 1.834633 tcp 10.0.2.105 53672 -> 46.48.223.67 15494 FSPA* 0 0 14 1726 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:15:53.700240 3.001789 tcp 10.0.2.105 53673 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:16:03.106156 0.000000 tcp 10.0.2.105 53673 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:17:25.992813 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:17:33.000568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:17:41.003052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:17:57.005200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:18:29.035985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:21:08.701791 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:21:08.701906 2.992546 tcp 10.0.2.105 53674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:21:17.693593 0.000000 tcp 10.0.2.105 53674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:21:23.704530 0.068708 tcp 10.0.2.105 53675 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:23.773488 0.068139 tcp 10.0.2.105 53676 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:23.841919 0.155753 tcp 10.0.2.105 53677 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:24.007930 2.998860 tcp 10.0.2.105 53678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:21:33.005766 0.000000 tcp 10.0.2.105 53678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:21:39.005058 0.059130 tcp 10.0.2.105 53679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:39.064685 0.063990 tcp 10.0.2.105 53680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:39.129040 0.151341 tcp 10.0.2.105 53681 -> 195.113.214.249 443 SRPA* 0 0 26 13094 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:39.524106 0.376377 tcp 10.0.2.105 53682 -> 46.48.223.67 15494 SPA_* 0 0 9 1091 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:55.763134 0.469450 tcp 10.0.2.105 53682 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:55.764101 0.068275 tcp 10.0.2.105 53683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:55.832766 0.068566 tcp 10.0.2.105 53684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:55.901640 0.154450 tcp 10.0.2.105 53685 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:21:56.232897 2.999970 tcp 10.0.2.105 53686 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:05.241860 0.000000 tcp 10.0.2.105 53686 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:11.231566 0.063872 tcp 10.0.2.105 53687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:22:11.295713 0.060858 tcp 10.0.2.105 53688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:22:11.356900 0.167987 tcp 10.0.2.105 53689 -> 195.113.214.249 443 SRPA* 0 0 28 11304 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:22:11.725278 3.000069 tcp 10.0.2.105 53690 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:20.724209 0.000000 tcp 10.0.2.105 53690 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:26.723004 3.004124 tcp 10.0.2.105 53691 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:35.725562 0.000000 tcp 10.0.2.105 53691 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:40.532766 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:22:41.724717 1.869276 tcp 10.0.2.105 53692 -> 46.48.223.67 15494 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:22:43.594173 3.007485 tcp 10.0.2.105 53693 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:22:52.600046 0.000000 tcp 10.0.2.105 53693 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:24:33.026614 3.005890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:24:40.033928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:24:48.036034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:25:04.039356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:25:36.044983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:31:05.428918 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:31:05.429081 0.187293 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:05.590787 0.123239 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:05.830182 0.111831 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:05.911756 0.190616 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:06.077668 0.170993 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:06.271126 0.210973 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:06.469353 0.230294 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:06.692507 0.183704 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:06.871689 0.179218 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:07.075527 0.168882 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:07.224608 0.223095 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:07.444809 0.060084 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:07.541425 0.216854 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:07.751560 0.356819 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:08.082221 0.088202 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:08.210860 0.091899 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:08.263573 0.021895 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:08.500210 0.129345 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:08.880887 0.201193 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:09.088932 0.483156 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:09.653949 0.207858 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:09.794961 0.174652 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:10.107517 0.186857 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:10.291568 0.353079 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:10.640777 0.190315 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:10.823305 0.237545 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:11.041562 0.195446 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:11.229035 0.441804 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:11.648813 0.082680 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/16 23:31:13.610714 2.994241 tcp 10.0.2.105 53694 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:31:22.603414 0.000000 tcp 10.0.2.105 53694 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:31:28.613744 0.061643 tcp 10.0.2.105 53695 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:28.675664 0.064823 tcp 10.0.2.105 53696 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:28.740764 0.178678 tcp 10.0.2.105 53697 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:29.202531 2.994568 tcp 10.0.2.105 53698 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:31:38.195703 0.000000 tcp 10.0.2.105 53698 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:31:40.051414 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:31:44.204909 0.065642 tcp 10.0.2.105 53699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:44.270842 0.068130 tcp 10.0.2.105 53700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:44.339234 0.160527 tcp 10.0.2.105 53701 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:44.517957 0.377865 tcp 10.0.2.105 53702 -> 46.48.223.67 15494 SPA_* 0 0 9 1220 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:47.058767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:31:52.626371 0.348486 tcp 10.0.2.105 53702 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:52.627027 0.065526 tcp 10.0.2.105 53703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:52.692866 0.067739 tcp 10.0.2.105 53704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:52.760897 0.152229 tcp 10.0.2.105 53705 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:31:52.975084 3.005849 tcp 10.0.2.105 53706 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:31:55.061490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:32:01.980722 0.000000 tcp 10.0.2.105 53706 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:07.972101 0.064365 tcp 10.0.2.105 53707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:32:08.036789 0.069249 tcp 10.0.2.105 53708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:32:08.106326 0.163820 tcp 10.0.2.105 53709 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:32:08.846522 2.997446 tcp 10.0.2.105 53710 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:11.063019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:32:17.852649 0.000000 tcp 10.0.2.105 53710 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:23.841767 2.993905 tcp 10.0.2.105 53711 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:32.834011 0.000000 tcp 10.0.2.105 53711 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:37.531048 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:32:38.842880 0.374144 tcp 10.0.2.105 53712 -> 46.48.223.67 15494 SPA_* 0 0 9 1220 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:32:43.069280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:32:44.322616 0.000403 tcp 10.0.2.105 53712 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:32:44.323185 2.991858 tcp 10.0.2.105 53713 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:32:53.314976 0.000000 tcp 10.0.2.105 53713 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:37:59.323719 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:37:59.323824 3.004235 tcp 10.0.2.105 53714 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:08.326098 0.000000 tcp 10.0.2.105 53714 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:14.326521 0.065296 tcp 10.0.2.105 53715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:14.392075 0.069410 tcp 10.0.2.105 53716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:14.461783 0.154577 tcp 10.0.2.105 53717 -> 195.113.214.249 443 SRPA* 0 0 40 21958 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:14.925200 3.005272 tcp 10.0.2.105 53718 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:23.932709 0.000000 tcp 10.0.2.105 53718 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:29.918294 0.064666 tcp 10.0.2.105 53719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:29.983236 0.063126 tcp 10.0.2.105 53720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:30.046650 0.175283 tcp 10.0.2.105 53721 -> 195.113.214.249 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:30.552892 2.290374 tcp 10.0.2.105 53722 -> 46.48.223.67 15494 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:32.396582 0.064651 tcp 10.0.2.105 53723 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:32.461530 0.061800 tcp 10.0.2.105 53724 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:32.523641 0.163788 tcp 10.0.2.105 53725 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:32.843552 2.992824 tcp 10.0.2.105 53726 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:41.834456 0.000000 tcp 10.0.2.105 53726 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:47.074307 3.002818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:38:47.843742 0.061271 tcp 10.0.2.105 53727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:47.905346 0.062297 tcp 10.0.2.105 53728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:47.967591 0.154525 tcp 10.0.2.105 53729 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:38:48.372780 3.005796 tcp 10.0.2.105 53730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:38:54.082355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:38:57.380700 0.000000 tcp 10.0.2.105 53730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:39:02.083543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:39:04.285195 2.968908 tcp 10.0.2.105 53731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:39:13.175364 0.000000 tcp 10.0.2.105 53731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:39:17.787156 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:39:18.832834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:39:19.100947 0.369783 tcp 10.0.2.105 53732 -> 46.48.223.67 15494 SPA_* 0 0 9 1213 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:39:29.460525 0.000671 tcp 10.0.2.105 53732 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:39:29.461059 2.957292 tcp 10.0.2.105 53733 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:39:38.346586 0.000000 tcp 10.0.2.105 53733 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:39:50.455869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:44:43.855898 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:44:43.856000 3.003570 tcp 10.0.2.105 53734 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:44:52.858510 0.000000 tcp 10.0.2.105 53734 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:44:58.858633 0.061007 tcp 10.0.2.105 53735 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:44:58.919954 0.067918 tcp 10.0.2.105 53736 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:44:58.988181 0.160856 tcp 10.0.2.105 53737 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:44:59.168501 2.994127 tcp 10.0.2.105 53738 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:08.160211 0.000000 tcp 10.0.2.105 53738 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:14.159504 0.062433 tcp 10.0.2.105 53739 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:14.222298 0.069784 tcp 10.0.2.105 53740 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:14.292413 0.167536 tcp 10.0.2.105 53741 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:14.508082 2.585817 tcp 10.0.2.105 53742 -> 46.48.223.67 15494 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:16.794976 0.068543 tcp 10.0.2.105 53743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:16.863803 0.064954 tcp 10.0.2.105 53744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:16.928597 0.155017 tcp 10.0.2.105 53745 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:17.094136 3.003286 tcp 10.0.2.105 53746 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:26.096172 0.000000 tcp 10.0.2.105 53746 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:32.094866 0.066485 tcp 10.0.2.105 53747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:32.161657 0.145792 tcp 10.0.2.105 53748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:32.307727 0.151352 tcp 10.0.2.105 53749 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:45:32.524071 3.005544 tcp 10.0.2.105 53750 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:41.528123 0.000000 tcp 10.0.2.105 53750 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:47.516535 3.004752 tcp 10.0.2.105 53751 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:45:54.110201 3.000922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:45:56.519789 0.000000 tcp 10.0.2.105 53751 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:46:01.036158 0.000286 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:46:01.116255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:46:02.518827 0.378868 tcp 10.0.2.105 53752 -> 46.48.223.67 15494 SPA_* 0 0 9 1181 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:46:08.758099 0.000372 tcp 10.0.2.105 53752 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:46:08.758801 3.002892 tcp 10.0.2.105 53753 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:46:09.117873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:46:17.760996 0.000000 tcp 10.0.2.105 53753 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:46:25.121630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:46:57.126622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:51:23.761886 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:51:23.762000 2.992138 tcp 10.0.2.105 53754 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:51:32.753047 0.000000 tcp 10.0.2.105 53754 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:51:38.763567 0.061348 tcp 10.0.2.105 53755 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:38.825201 0.067736 tcp 10.0.2.105 53756 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:38.893239 0.169576 tcp 10.0.2.105 53757 -> 195.113.214.249 443 SRPA* 0 0 32 17638 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:39.228561 2.997864 tcp 10.0.2.105 53758 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:51:48.225255 0.000000 tcp 10.0.2.105 53758 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:51:54.224837 0.062687 tcp 10.0.2.105 53759 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:54.287879 0.062968 tcp 10.0.2.105 53760 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:54.351153 0.166470 tcp 10.0.2.105 53761 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:51:54.545850 0.382020 tcp 10.0.2.105 53762 -> 46.48.223.67 15494 SPA_* 0 0 9 1116 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:01.365033 1.291110 tcp 10.0.2.105 53762 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:01.645642 0.063279 tcp 10.0.2.105 53763 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:01.709248 0.066932 tcp 10.0.2.105 53764 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:01.776148 0.163313 tcp 10.0.2.105 53765 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:02.656570 3.003648 tcp 10.0.2.105 53766 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:11.659360 0.000000 tcp 10.0.2.105 53766 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:17.659175 0.060579 tcp 10.0.2.105 53767 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:17.720062 0.067987 tcp 10.0.2.105 53768 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:17.788592 0.164177 tcp 10.0.2.105 53769 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:18.028965 3.003946 tcp 10.0.2.105 53770 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:27.031302 0.000000 tcp 10.0.2.105 53770 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:33.030305 2.993914 tcp 10.0.2.105 53771 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:43.669708 0.000000 tcp 10.0.2.105 53771 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:52:48.608433 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/16 23:52:49.598111 3.653024 tcp 10.0.2.105 53772 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/16 23:52:53.251270 2.978981 tcp 10.0.2.105 53773 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:53:02.157905 0.000000 tcp 10.0.2.105 53773 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/16 23:53:02.548569 2.961359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/16 23:53:09.475179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:53:17.383812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:53:33.191701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/16 23:54:04.805432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:00:08.157128 3.001485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 00:00:15.164921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:00:23.175946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:00:39.182951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:01:11.184936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:01:14.193816 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:01:14.194035 0.194862 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:14.354062 0.185995 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:14.634679 0.171046 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:14.802543 0.190064 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:14.998891 0.125227 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:15.104781 0.213820 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:15.308627 0.229092 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:15.530536 0.182219 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:15.777541 0.177540 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:15.930161 0.168695 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:16.236515 0.223244 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:16.457148 0.061969 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:16.673363 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 00:01:21.754996 2.989214 tcp 10.0.2.105 53774 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:01:30.744061 0.000000 tcp 10.0.2.105 53774 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:01:33.319021 0.065171 tcp 10.0.2.105 53775 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:33.384593 0.063358 tcp 10.0.2.105 53776 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:33.448437 0.156380 tcp 10.0.2.105 53777 -> 195.113.214.249 443 SRPA* 0 0 51 29600 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:33.605336 0.352031 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:33.928170 0.083521 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:34.109445 0.089120 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:34.159932 0.214034 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:34.533172 0.023167 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:34.561572 0.143148 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:34.844849 0.341550 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:35.401337 0.183906 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:35.525151 0.330562 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:36.083459 0.187858 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:36.267611 0.238479 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:36.485716 0.200272 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:36.677646 0.353771 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:36.753072 0.070045 tcp 10.0.2.105 53778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:36.823414 0.070477 tcp 10.0.2.105 53779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:36.894307 0.154906 tcp 10.0.2.105 53780 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:37.027859 0.194377 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:37.185851 3.000548 tcp 10.0.2.105 53781 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:01:37.214021 0.444349 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:37.636950 0.083876 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:01:46.185252 0.000000 tcp 10.0.2.105 53781 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:01:52.183996 1.489769 tcp 10.0.2.105 53782 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:53.674061 0.063100 tcp 10.0.2.105 53783 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:53.737469 0.154417 tcp 10.0.2.105 53784 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:01:53.971331 2.960425 tcp 10.0.2.105 53785 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:02:02.853785 0.000000 tcp 10.0.2.105 53785 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:02:08.779734 2.968056 tcp 10.0.2.105 53786 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:02:17.669155 0.000000 tcp 10.0.2.105 53786 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:02:22.582446 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:07:20.199777 3.167198 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:07:22.559707 0.180579 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:07:22.740415 2.975993 tcp 10.0.2.105 53787 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:07:27.344070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:07:31.680981 0.000000 tcp 10.0.2.105 53787 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:07:35.282685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:07:37.632980 0.067804 tcp 10.0.2.105 53788 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:37.701135 0.061480 tcp 10.0.2.105 53789 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:37.762957 0.155718 tcp 10.0.2.105 53790 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:38.083706 2.976753 tcp 10.0.2.105 53791 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:07:47.023940 0.000000 tcp 10.0.2.105 53791 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:07:51.210052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:07:53.023360 0.063015 tcp 10.0.2.105 53792 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:53.086671 0.065084 tcp 10.0.2.105 53793 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:53.152089 0.174274 tcp 10.0.2.105 53794 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:07:53.482803 0.377672 tcp 10.0.2.105 53795 -> 46.48.223.67 15494 SPA_* 0 0 9 1038 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:00.791976 1.060385 tcp 10.0.2.105 53795 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:00.792772 0.100589 tcp 10.0.2.105 53796 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:00.893709 0.076627 tcp 10.0.2.105 53797 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:00.970601 0.170792 tcp 10.0.2.105 53798 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:01.852606 2.996507 tcp 10.0.2.105 53799 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:10.848484 0.000000 tcp 10.0.2.105 53799 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:16.847567 4.164279 tcp 10.0.2.105 53800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:21.012177 0.064892 tcp 10.0.2.105 53801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:21.077277 0.190441 tcp 10.0.2.105 53802 -> 195.113.214.249 443 SRPA* 0 0 40 20888 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:08:21.394824 2.970746 tcp 10.0.2.105 53803 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:27.226854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:08:30.291113 0.000000 tcp 10.0.2.105 53803 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:36.209873 2.955257 tcp 10.0.2.105 53804 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:45.093559 0.000000 tcp 10.0.2.105 53804 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:08:49.747588 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:08:51.014044 1.368972 tcp 10.0.2.105 53805 -> 46.48.223.67 15494 SPA_* 0 0 9 1038 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:09:04.422022 0.000943 tcp 10.0.2.105 53805 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:09:04.422579 2.954975 tcp 10.0.2.105 53806 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:09:13.297277 0.000000 tcp 10.0.2.105 53806 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:15.903334 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:14:15.903502 3.003858 tcp 10.0.2.105 53807 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:24.906197 0.000000 tcp 10.0.2.105 53807 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:27.221771 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:14:30.907023 0.063035 tcp 10.0.2.105 53808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:30.970404 0.064000 tcp 10.0.2.105 53809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:31.034426 0.266456 tcp 10.0.2.105 53810 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:31.412376 2.997389 tcp 10.0.2.105 53811 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:34.229577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:14:40.408357 0.000000 tcp 10.0.2.105 53811 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:42.231100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:14:46.407372 0.065370 tcp 10.0.2.105 53812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:46.472615 0.061940 tcp 10.0.2.105 53813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:46.534873 0.168666 tcp 10.0.2.105 53814 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:47.300668 1.372541 tcp 10.0.2.105 53815 -> 46.48.223.67 15494 SPA_* 0 0 9 1088 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:53.991188 0.633188 tcp 10.0.2.105 53815 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:53.991995 0.068322 tcp 10.0.2.105 53816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:54.060580 0.060886 tcp 10.0.2.105 53817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:54.121791 0.165814 tcp 10.0.2.105 53818 -> 195.113.214.249 443 SRPA* 0 0 41 21414 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:14:54.624647 2.969401 tcp 10.0.2.105 53819 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:14:59.078713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:15:03.520580 0.000000 tcp 10.0.2.105 53819 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:09.446401 0.061413 tcp 10.0.2.105 53820 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:15:09.507747 0.070735 tcp 10.0.2.105 53821 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:15:09.578748 0.160297 tcp 10.0.2.105 53822 -> 195.113.214.249 443 SRPA* 0 0 23 11838 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:15:09.822659 2.957623 tcp 10.0.2.105 53823 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:18.713625 0.000000 tcp 10.0.2.105 53823 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:24.626783 2.953141 tcp 10.0.2.105 53824 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:30.686706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:15:33.506194 0.000000 tcp 10.0.2.105 53824 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:38.382775 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:15:39.441249 0.389116 tcp 10.0.2.105 53825 -> 46.48.223.67 15494 SPA_* 0 0 9 1088 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:15:45.031447 0.001847 tcp 10.0.2.105 53825 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:15:45.031940 2.954606 tcp 10.0.2.105 53826 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:15:53.927058 0.000000 tcp 10.0.2.105 53826 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:20:59.754320 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:20:59.754556 3.003572 tcp 10.0.2.105 53827 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:08.756630 0.000000 tcp 10.0.2.105 53827 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:14.756758 0.061393 tcp 10.0.2.105 53828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:14.818429 0.066493 tcp 10.0.2.105 53829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:14.885238 0.156736 tcp 10.0.2.105 53830 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:15.447865 3.006676 tcp 10.0.2.105 53831 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:24.449271 0.000000 tcp 10.0.2.105 53831 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:30.448585 0.105185 tcp 10.0.2.105 53832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:30.553629 0.066888 tcp 10.0.2.105 53833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:30.620366 0.179817 tcp 10.0.2.105 53834 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:31.056465 0.373014 tcp 10.0.2.105 53835 -> 46.48.223.67 15494 SPA_* 0 0 9 1197 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:34.245691 3.001840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:21:38.818994 0.550738 tcp 10.0.2.105 53835 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:38.820072 0.070271 tcp 10.0.2.105 53836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:38.890655 0.076873 tcp 10.0.2.105 53837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:38.967809 0.162170 tcp 10.0.2.105 53838 -> 195.113.214.249 443 SRPA* 0 0 38 21716 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:39.369959 2.995328 tcp 10.0.2.105 53839 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:41.253532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:21:48.363567 0.000000 tcp 10.0.2.105 53839 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:21:49.254992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:21:54.363125 0.070460 tcp 10.0.2.105 53840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:54.433503 0.063702 tcp 10.0.2.105 53841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:54.497505 0.161698 tcp 10.0.2.105 53842 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:21:54.769229 2.997902 tcp 10.0.2.105 53843 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:22:03.765812 0.000000 tcp 10.0.2.105 53843 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:22:05.258762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:22:09.764700 3.004040 tcp 10.0.2.105 53844 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:22:18.767001 0.000000 tcp 10.0.2.105 53844 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:22:23.538854 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:22:24.768396 0.386097 tcp 10.0.2.105 53845 -> 46.48.223.67 15494 SPA_* 0 0 9 1197 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:22:32.229431 0.000336 tcp 10.0.2.105 53845 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:22:32.229934 3.000717 tcp 10.0.2.105 53846 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:22:37.263979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:22:41.232699 0.000000 tcp 10.0.2.105 53846 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:27:47.230237 0.000237 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:27:47.230613 2.993381 tcp 10.0.2.105 53847 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:27:56.232250 0.000000 tcp 10.0.2.105 53847 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:02.233061 0.064401 tcp 10.0.2.105 53848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:02.297862 0.064215 tcp 10.0.2.105 53849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:02.362382 0.176121 tcp 10.0.2.105 53850 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:02.749287 2.996928 tcp 10.0.2.105 53851 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:11.744635 0.000000 tcp 10.0.2.105 53851 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:17.743715 0.202874 tcp 10.0.2.105 53852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:17.946841 0.065498 tcp 10.0.2.105 53853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:18.012656 0.200032 tcp 10.0.2.105 53854 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:18.716631 0.391272 tcp 10.0.2.105 53855 -> 46.48.223.67 15494 SPA_* 0 0 9 1220 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:25.879823 0.642963 tcp 10.0.2.105 53855 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:25.880703 0.060777 tcp 10.0.2.105 53856 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:25.941787 0.117452 tcp 10.0.2.105 53857 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:26.059528 0.155188 tcp 10.0.2.105 53858 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:28:26.523054 2.975954 tcp 10.0.2.105 53859 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:35.469601 0.000000 tcp 10.0.2.105 53859 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:41.269044 3.002707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:28:41.467370 3.004914 tcp 10.0.2.105 53860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:48.277341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:28:50.470002 0.000000 tcp 10.0.2.105 53860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:28:55.037255 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:28:56.278998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:28:56.469362 0.382051 tcp 10.0.2.105 53861 -> 46.48.223.67 15494 SPA_* 0 0 9 1220 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:29:03.364497 0.000353 tcp 10.0.2.105 53861 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:29:12.282116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:29:44.287750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:31:45.495407 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:31:45.495509 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 00:32:02.508323 0.069054 tcp 10.0.2.105 53862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:32:02.577659 0.064841 tcp 10.0.2.105 53863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:32:02.642766 0.165086 tcp 10.0.2.105 53864 -> 195.113.214.249 443 SRPA* 0 0 32 17990 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:32:02.808567 0.112938 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:02.887055 0.187036 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:03.587389 0.125150 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:03.691792 0.210132 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:03.889012 0.187909 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:04.091833 0.170392 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:04.259655 0.177747 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:04.681562 0.245689 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:04.918758 0.182335 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:05.378247 0.216651 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:05.591945 0.168561 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:05.739083 0.058802 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:06.217968 0.380614 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:06.932894 0.090504 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.008640 0.094028 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.322236 0.131901 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.410306 0.201260 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.691441 0.025162 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.717742 0.177333 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2622 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:07.891935 0.351026 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:08.242574 0.161161 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:08.537406 0.188432 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:08.723004 0.237396 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:09.027776 0.201060 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:09.220847 0.448770 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:09.646282 0.083747 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:10.453978 0.352964 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:32:10.802939 0.188881 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/17 00:34:03.360882 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:34:03.361055 2.993565 tcp 10.0.2.105 53865 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:12.363332 0.000000 tcp 10.0.2.105 53865 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:18.363035 0.069619 tcp 10.0.2.105 53866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:18.432997 0.061646 tcp 10.0.2.105 53867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:18.494933 0.160769 tcp 10.0.2.105 53868 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:19.199555 3.004059 tcp 10.0.2.105 53869 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:28.195826 0.000000 tcp 10.0.2.105 53869 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:34.195704 0.059744 tcp 10.0.2.105 53870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:34.255756 0.063899 tcp 10.0.2.105 53871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:34.319971 0.166696 tcp 10.0.2.105 53872 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:34.593752 3.428149 tcp 10.0.2.105 53873 -> 46.48.223.67 15494 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:37.378088 0.064129 tcp 10.0.2.105 53874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:37.442507 0.064210 tcp 10.0.2.105 53875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:37.506622 0.167232 tcp 10.0.2.105 53876 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:38.022139 2.992579 tcp 10.0.2.105 53877 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:47.012772 0.000000 tcp 10.0.2.105 53877 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:34:53.022551 0.061471 tcp 10.0.2.105 53878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:53.084394 0.059697 tcp 10.0.2.105 53879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:53.144448 0.153850 tcp 10.0.2.105 53880 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:34:53.365044 2.991664 tcp 10.0.2.105 53881 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:02.355150 0.000000 tcp 10.0.2.105 53881 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:08.363922 3.004206 tcp 10.0.2.105 53882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:17.367004 0.000000 tcp 10.0.2.105 53882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:22.271039 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:35:23.589735 0.380446 tcp 10.0.2.105 53883 -> 46.48.223.67 15494 SPA_* 0 0 9 994 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:35:33.346756 0.000337 tcp 10.0.2.105 53883 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:35:33.347341 2.969250 tcp 10.0.2.105 53884 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:42.268405 0.000000 tcp 10.0.2.105 53884 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:35:48.293997 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:35:55.301776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:36:03.302855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:36:19.305982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:36:51.311871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:40:48.213313 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:40:48.213472 3.003509 tcp 10.0.2.105 53885 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:40:57.215420 0.000000 tcp 10.0.2.105 53885 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:03.215914 0.130407 tcp 10.0.2.105 53886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:03.346607 0.066228 tcp 10.0.2.105 53887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:03.413135 0.164678 tcp 10.0.2.105 53888 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:03.700380 3.007455 tcp 10.0.2.105 53889 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:12.697780 0.000000 tcp 10.0.2.105 53889 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:18.696868 0.061368 tcp 10.0.2.105 53890 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:18.758068 0.074444 tcp 10.0.2.105 53891 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:18.832343 0.164283 tcp 10.0.2.105 53892 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:19.556488 0.373527 tcp 10.0.2.105 53893 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:31.102379 0.585528 tcp 10.0.2.105 53893 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:31.103248 0.061234 tcp 10.0.2.105 53894 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:31.164802 0.069023 tcp 10.0.2.105 53895 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:31.234099 0.158283 tcp 10.0.2.105 53896 -> 195.113.214.249 443 SRPA* 0 0 37 18350 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:31.688137 3.001127 tcp 10.0.2.105 53897 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:40.687970 0.000000 tcp 10.0.2.105 53897 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:46.687773 0.066074 tcp 10.0.2.105 53898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:46.754196 0.062956 tcp 10.0.2.105 53899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:46.817447 0.160198 tcp 10.0.2.105 53900 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:41:47.247818 3.004136 tcp 10.0.2.105 53901 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:41:56.249980 0.000000 tcp 10.0.2.105 53901 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:42:02.249111 3.051934 tcp 10.0.2.105 53902 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:42:11.261004 0.000000 tcp 10.0.2.105 53902 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:42:16.028890 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:42:17.260786 0.378456 tcp 10.0.2.105 53903 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:42:26.146840 0.000472 tcp 10.0.2.105 53903 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:42:26.147569 3.000133 tcp 10.0.2.105 53904 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:42:35.145768 0.000000 tcp 10.0.2.105 53904 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:42:55.319097 3.000393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:43:02.325364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:43:10.326799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:43:26.330016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:43:58.335879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:47:41.146762 0.000177 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:47:41.147141 3.005333 tcp 10.0.2.105 53905 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:47:50.149195 0.000000 tcp 10.0.2.105 53905 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:47:56.149821 0.087631 tcp 10.0.2.105 53906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:47:56.237721 0.063971 tcp 10.0.2.105 53907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:47:56.301982 0.180586 tcp 10.0.2.105 53908 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:47:56.552265 3.000561 tcp 10.0.2.105 53909 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:48:05.551460 0.000000 tcp 10.0.2.105 53909 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:48:11.551020 0.063835 tcp 10.0.2.105 53910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:11.615158 0.065863 tcp 10.0.2.105 53911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:11.681328 0.157612 tcp 10.0.2.105 53912 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:11.896676 0.673902 tcp 10.0.2.105 53913 -> 46.48.223.67 15494 SPA_* 0 0 9 1120 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:42.565255 0.064697 tcp 10.0.2.105 53914 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:42.630274 0.127471 tcp 10.0.2.105 53915 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:42.758014 0.163365 tcp 10.0.2.105 53916 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:42.979739 0.365259 tcp 10.0.2.105 53913 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:42.980031 3.002107 tcp 10.0.2.105 53917 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:48:51.978108 0.000000 tcp 10.0.2.105 53917 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:48:57.977073 0.061510 tcp 10.0.2.105 53918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:58.038901 0.062312 tcp 10.0.2.105 53919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:58.101560 0.158072 tcp 10.0.2.105 53920 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:48:58.331878 2.999808 tcp 10.0.2.105 53921 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:49:07.330095 0.000000 tcp 10.0.2.105 53921 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:49:13.329023 2.993995 tcp 10.0.2.105 53922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:49:22.331553 0.000000 tcp 10.0.2.105 53922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:49:27.378578 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:49:28.669523 0.375709 tcp 10.0.2.105 53923 -> 46.48.223.67 15494 SPA_* 0 0 9 1120 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:49:34.019990 0.000425 tcp 10.0.2.105 53923 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:49:34.020666 2.975918 tcp 10.0.2.105 53924 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:49:42.948732 0.000000 tcp 10.0.2.105 53924 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:54:48.731770 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:54:48.731881 2.993223 tcp 10.0.2.105 53925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:54:57.723838 0.000000 tcp 10.0.2.105 53925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:55:03.734460 0.060725 tcp 10.0.2.105 53926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:03.795553 0.065049 tcp 10.0.2.105 53927 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:03.860981 0.159210 tcp 10.0.2.105 53928 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:04.210608 2.996891 tcp 10.0.2.105 53929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:55:13.506490 0.000000 tcp 10.0.2.105 53929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:55:19.451053 0.059868 tcp 10.0.2.105 53930 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:19.511208 0.062354 tcp 10.0.2.105 53931 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:19.573931 0.154636 tcp 10.0.2.105 53932 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:19.994322 0.381829 tcp 10.0.2.105 53933 -> 46.48.223.67 15494 SPA_* 0 0 9 1030 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:38.415903 2.968040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 00:55:40.010546 0.350637 tcp 10.0.2.105 53933 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:40.011565 0.111482 tcp 10.0.2.105 53934 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:40.123338 0.061932 tcp 10.0.2.105 53935 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:40.185614 0.163039 tcp 10.0.2.105 53936 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:40.361433 2.969959 tcp 10.0.2.105 53937 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:55:45.355640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:55:49.308188 0.000000 tcp 10.0.2.105 53937 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:55:53.353797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:55:55.308550 0.061524 tcp 10.0.2.105 53938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:55.369912 0.064606 tcp 10.0.2.105 53939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:55.434819 0.161071 tcp 10.0.2.105 53940 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:55:55.603917 3.007620 tcp 10.0.2.105 53941 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:56:04.612603 0.000000 tcp 10.0.2.105 53941 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:56:09.358819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:56:10.599252 3.003668 tcp 10.0.2.105 53942 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:56:19.611605 0.000000 tcp 10.0.2.105 53942 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:56:24.531104 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 00:56:25.601077 1.379045 tcp 10.0.2.105 53943 -> 46.48.223.67 15494 SPA_* 0 0 9 1030 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:56:34.214423 0.000357 tcp 10.0.2.105 53943 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 00:56:34.215055 3.001466 tcp 10.0.2.105 53944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 00:56:41.363065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 00:56:43.215706 0.000000 tcp 10.0.2.105 53944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:02:34.853619 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:02:34.853723 0.105503 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:34.925754 0.209863 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:35.123837 0.183964 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:35.370072 0.172663 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:35.538875 0.187065 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:35.698903 0.123118 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:35.827211 0.176131 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:36.241815 0.231552 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:36.465630 0.191786 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:36.757031 0.060018 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:36.815085 0.184814 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.006823 0.214806 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.218769 0.375832 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.566560 0.113107 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.738177 0.089599 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.786917 0.026791 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:37.996938 0.175683 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:38.169542 0.341547 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:38.664876 0.130376 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:38.748030 0.202269 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:38.964846 0.174132 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:39.086041 0.189995 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:39.332895 0.237565 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:39.550797 0.197551 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:39.821994 0.454057 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:40.252695 0.187786 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:40.473096 0.084347 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:40.535528 0.353482 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:02:45.389331 3.001518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 01:02:49.242544 2.993463 tcp 10.0.2.105 53945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:02:52.396551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:02:58.234918 0.000000 tcp 10.0.2.105 53945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:00.398224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:03:03.051675 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:03:04.245494 0.061731 tcp 10.0.2.105 53946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:04.307441 0.070795 tcp 10.0.2.105 53947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:04.378517 0.158224 tcp 10.0.2.105 53948 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:04.582607 2.995549 tcp 10.0.2.105 53949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:13.576794 0.000000 tcp 10.0.2.105 53949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:16.400941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:03:19.576490 0.068553 tcp 10.0.2.105 53950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:19.645309 0.061490 tcp 10.0.2.105 53951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:19.707098 0.167224 tcp 10.0.2.105 53952 -> 195.113.214.249 443 SRPA* 0 0 39 31854 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:20.075997 2.438863 tcp 10.0.2.105 53953 -> 46.48.223.67 15494 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:21.948199 0.067438 tcp 10.0.2.105 53954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:22.015949 0.076982 tcp 10.0.2.105 53955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:22.093226 0.164784 tcp 10.0.2.105 53956 -> 195.113.214.249 443 SRPA* 0 0 24 14656 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:22.515136 2.998887 tcp 10.0.2.105 53957 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:31.522702 0.000000 tcp 10.0.2.105 53957 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:37.511981 0.525797 tcp 10.0.2.105 53958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:38.038064 0.067184 tcp 10.0.2.105 53959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:38.105089 0.166900 tcp 10.0.2.105 53960 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:03:38.336047 2.953976 tcp 10.0.2.105 53961 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:47.231694 0.000000 tcp 10.0.2.105 53961 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:03:48.748534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:03:53.184208 3.803648 tcp 10.0.2.105 53962 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:04:02.912688 0.000000 tcp 10.0.2.105 53962 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:04:07.528719 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:04:08.853075 0.388637 tcp 10.0.2.105 53963 -> 46.48.223.67 15494 SPA_* 0 0 9 1223 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:04:15.870358 0.000367 tcp 10.0.2.105 53963 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:04:15.870970 2.962648 tcp 10.0.2.105 53964 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:04:24.756436 0.000000 tcp 10.0.2.105 53964 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:09:29.998795 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:09:29.998892 3.003594 tcp 10.0.2.105 53965 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:09:39.000565 0.000000 tcp 10.0.2.105 53965 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:09:47.004768 0.064145 tcp 10.0.2.105 53966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:09:47.069239 0.068083 tcp 10.0.2.105 53967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:09:47.137621 0.157512 tcp 10.0.2.105 53968 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:09:47.465136 2.957870 tcp 10.0.2.105 53969 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:09:56.347289 0.000000 tcp 10.0.2.105 53969 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:02.270856 0.367967 tcp 10.0.2.105 53970 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:02.639163 0.062068 tcp 10.0.2.105 53971 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:02.701507 0.152453 tcp 10.0.2.105 53972 -> 195.113.214.249 443 SRPA* 0 0 44 37134 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:03.133543 0.384019 tcp 10.0.2.105 53973 -> 46.48.223.67 15494 SPA_* 0 0 9 1058 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:07.137098 2.969330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:10:09.842846 0.342366 tcp 10.0.2.105 53973 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:09.843602 0.061622 tcp 10.0.2.105 53974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:09.905534 0.069132 tcp 10.0.2.105 53975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:09.974981 0.162113 tcp 10.0.2.105 53976 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:10.185461 2.959215 tcp 10.0.2.105 53977 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:14.920074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:10:19.925451 0.000000 tcp 10.0.2.105 53977 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:22.830197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:10:25.855839 0.063882 tcp 10.0.2.105 53978 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:25.920031 0.065342 tcp 10.0.2.105 53979 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:25.985695 0.160384 tcp 10.0.2.105 53980 -> 195.113.214.249 443 SRPA* 0 0 41 22076 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:10:26.299131 2.976173 tcp 10.0.2.105 53981 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:35.201461 0.000000 tcp 10.0.2.105 53981 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:38.651182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:10:41.132906 2.970263 tcp 10.0.2.105 53982 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:50.029566 0.000000 tcp 10.0.2.105 53982 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:10:54.580706 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:10:55.959442 0.380588 tcp 10.0.2.105 53983 -> 46.48.223.67 15494 SPA_* 0 0 9 1058 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:11:02.409630 0.000328 tcp 10.0.2.105 53983 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:11:02.410226 2.971174 tcp 10.0.2.105 53984 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:11:10.277971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:11:11.307962 0.000000 tcp 10.0.2.105 53984 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:16:15.481685 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:16:15.481855 2.993415 tcp 10.0.2.105 53985 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:16:24.480068 0.000000 tcp 10.0.2.105 53985 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:16:30.484474 0.061010 tcp 10.0.2.105 53986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:30.545766 0.064409 tcp 10.0.2.105 53987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:30.610504 0.158519 tcp 10.0.2.105 53988 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:30.871505 2.996109 tcp 10.0.2.105 53989 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:16:39.866157 0.000000 tcp 10.0.2.105 53989 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:16:45.864881 0.065231 tcp 10.0.2.105 53990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:45.930362 0.063930 tcp 10.0.2.105 53991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:45.994615 0.160227 tcp 10.0.2.105 53992 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:16:46.607410 1.223217 tcp 10.0.2.105 53993 -> 46.48.223.67 15494 SPA_* 0 0 9 1064 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:15.450331 3.001395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:17:17.831332 0.062855 tcp 10.0.2.105 53994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:17.894055 0.444287 tcp 10.0.2.105 53995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:18.338617 0.159385 tcp 10.0.2.105 53996 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:18.703894 0.236673 tcp 10.0.2.105 53993 -> 46.48.223.67 15494 FRA_* 0 0 7 638 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:18.704183 3.002238 tcp 10.0.2.105 53997 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:17:22.457750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:17:27.707445 0.000000 tcp 10.0.2.105 53997 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:17:30.469117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:17:33.706912 0.067304 tcp 10.0.2.105 53998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:33.774529 0.061966 tcp 10.0.2.105 53999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:33.836782 0.164437 tcp 10.0.2.105 54000 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:17:34.321901 2.996631 tcp 10.0.2.105 54001 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:17:43.317574 0.000000 tcp 10.0.2.105 54001 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:17:46.472775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:17:49.316329 3.004120 tcp 10.0.2.105 54002 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:17:58.318963 0.000000 tcp 10.0.2.105 54002 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:18:03.055469 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:18:04.318084 0.375497 tcp 10.0.2.105 54003 -> 46.48.223.67 15494 SPA_* 0 0 9 1064 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:18:10.419374 0.001011 tcp 10.0.2.105 54003 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:18:10.420008 3.000670 tcp 10.0.2.105 54004 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:18:18.478137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:18:19.419328 0.000000 tcp 10.0.2.105 54004 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:23:25.419746 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:23:25.419992 2.992935 tcp 10.0.2.105 54005 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:23:34.422494 0.000000 tcp 10.0.2.105 54005 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:23:40.422585 0.069854 tcp 10.0.2.105 54006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:40.492753 0.061422 tcp 10.0.2.105 54007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:40.554488 0.162572 tcp 10.0.2.105 54008 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:41.123750 3.002124 tcp 10.0.2.105 54009 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:23:50.124542 0.000000 tcp 10.0.2.105 54009 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:23:56.124469 0.063873 tcp 10.0.2.105 54010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:56.188649 0.061440 tcp 10.0.2.105 54011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:56.250367 0.159378 tcp 10.0.2.105 54012 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:23:56.817543 0.371398 tcp 10.0.2.105 54013 -> 46.48.223.67 15494 SPA_* 0 0 9 1143 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:02.700138 0.792283 tcp 10.0.2.105 54013 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:02.950364 0.065353 tcp 10.0.2.105 54014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:03.016060 0.064728 tcp 10.0.2.105 54015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:03.081035 0.163583 tcp 10.0.2.105 54016 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:03.492659 2.995961 tcp 10.0.2.105 54017 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:12.487011 0.000000 tcp 10.0.2.105 54017 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:18.486200 0.080832 tcp 10.0.2.105 54018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:18.567341 0.069084 tcp 10.0.2.105 54019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:18.636775 0.167762 tcp 10.0.2.105 54020 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:18.983349 3.007263 tcp 10.0.2.105 54021 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:22.485023 3.000574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:24:28.016914 0.000000 tcp 10.0.2.105 54021 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:29.520397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:24:33.978176 3.003945 tcp 10.0.2.105 54022 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:37.503064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:24:43.411803 0.000000 tcp 10.0.2.105 54022 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:24:47.918586 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:24:49.335391 0.378161 tcp 10.0.2.105 54023 -> 46.48.223.67 15494 SPA_* 0 0 9 1143 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:53.814615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:24:57.852035 0.000395 tcp 10.0.2.105 54023 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:24:57.852701 2.955493 tcp 10.0.2.105 54024 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:25:06.733432 0.000000 tcp 10.0.2.105 54024 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:25:25.524858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:31:29.528692 3.001058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 01:31:36.535232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:31:44.536878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:32:00.540068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:32:32.545959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:33:08.958233 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:33:08.958353 0.116917 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:09.040193 0.216876 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:09.253873 0.185508 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:09.411938 0.123734 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:09.553682 0.181238 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:09.838975 0.219274 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:10.037903 0.187009 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:10.352138 0.242335 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:10.726109 0.168663 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:10.875137 0.060404 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:11.027125 0.184429 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:11.206478 0.213347 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:11.416774 0.349362 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:11.738968 0.092650 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:12.182927 0.087772 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:12.234133 0.347286 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:12.617395 3.000499 tcp 10.0.2.105 54025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:12.912832 0.133846 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:12.999505 0.200446 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:13.347301 0.172628 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:13.460156 0.022220 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:13.724941 0.176538 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:13.897621 0.189651 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:14.084636 0.238436 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:14.328274 0.194707 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:14.515350 0.442104 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:15.203721 0.187587 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:15.384342 0.084472 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:15.446936 0.354074 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/17 01:33:21.616442 0.000000 tcp 10.0.2.105 54025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:27.616759 0.071041 tcp 10.0.2.105 54026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:27.688079 0.071093 tcp 10.0.2.105 54027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:27.759479 0.163380 tcp 10.0.2.105 54028 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:28.687404 3.003245 tcp 10.0.2.105 54029 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:37.689928 0.000000 tcp 10.0.2.105 54029 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:43.689271 0.061584 tcp 10.0.2.105 54030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:43.751140 0.067790 tcp 10.0.2.105 54031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:43.818863 0.156209 tcp 10.0.2.105 54032 -> 195.113.214.249 443 SRPA* 0 0 44 38290 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:33:44.066865 2.996350 tcp 10.0.2.105 54033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:53.071604 0.000000 tcp 10.0.2.105 54033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:33:59.060291 2.994361 tcp 10.0.2.105 54034 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:34:08.052883 0.000000 tcp 10.0.2.105 54034 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:34:13.050609 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:38:36.551640 3.001838 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:38:43.559240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:38:51.562866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:39:07.563706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:39:14.651600 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:39:14.651705 2.965278 tcp 10.0.2.105 54035 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:39:23.544326 0.000000 tcp 10.0.2.105 54035 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:39:29.474554 0.073918 tcp 10.0.2.105 54036 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:29.548792 0.065589 tcp 10.0.2.105 54037 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:29.614744 0.168952 tcp 10.0.2.105 54038 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:29.946534 2.962794 tcp 10.0.2.105 54039 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:39:38.832037 0.000000 tcp 10.0.2.105 54039 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:39:39.865354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:39:44.756743 0.061922 tcp 10.0.2.105 54040 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:44.818980 0.065173 tcp 10.0.2.105 54041 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:44.884615 0.164940 tcp 10.0.2.105 54042 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:45.089414 0.379898 tcp 10.0.2.105 54043 -> 46.48.223.67 15494 SPA_* 0 0 9 1061 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:54.369466 0.495720 tcp 10.0.2.105 54043 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:54.370208 0.066449 tcp 10.0.2.105 54044 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:54.436937 0.064802 tcp 10.0.2.105 54045 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:54.501569 0.169958 tcp 10.0.2.105 54046 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:39:54.865485 2.950015 tcp 10.0.2.105 54047 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:03.754556 0.000000 tcp 10.0.2.105 54047 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:09.764163 0.126769 tcp 10.0.2.105 54048 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:40:09.890713 0.069899 tcp 10.0.2.105 54049 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:40:09.960980 0.160442 tcp 10.0.2.105 54050 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:40:10.275193 3.003082 tcp 10.0.2.105 54051 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:19.277085 0.000000 tcp 10.0.2.105 54051 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:25.275911 3.004960 tcp 10.0.2.105 54052 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:34.278537 0.000000 tcp 10.0.2.105 54052 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:40:39.055197 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:40:40.277244 0.374750 tcp 10.0.2.105 54053 -> 46.48.223.67 15494 SPA_* 0 0 9 1061 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:40:59.410259 0.000333 tcp 10.0.2.105 54053 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:40:59.410853 2.997973 tcp 10.0.2.105 54054 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:41:08.407773 0.000000 tcp 10.0.2.105 54054 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:45:43.585767 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:45:50.593353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:45:58.599040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:46:14.408011 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:46:14.408160 3.003617 tcp 10.0.2.105 54055 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:46:14.597992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:46:23.410762 0.000000 tcp 10.0.2.105 54055 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:46:29.411269 0.061368 tcp 10.0.2.105 54056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:29.472892 0.063739 tcp 10.0.2.105 54057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:29.536992 0.196289 tcp 10.0.2.105 54058 -> 195.113.214.249 443 SRPA* 0 0 47 41676 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:29.801793 2.994444 tcp 10.0.2.105 54059 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:46:38.802554 0.000000 tcp 10.0.2.105 54059 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:46:44.801713 0.061873 tcp 10.0.2.105 54060 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:44.863857 0.067151 tcp 10.0.2.105 54061 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:44.931284 0.167393 tcp 10.0.2.105 54062 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:45.233012 0.381749 tcp 10.0.2.105 54063 -> 46.48.223.67 15494 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:46.603342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:46:59.789601 0.311945 tcp 10.0.2.105 54063 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:59.790583 0.062420 tcp 10.0.2.105 54064 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:59.853394 0.067143 tcp 10.0.2.105 54065 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:46:59.920925 0.155737 tcp 10.0.2.105 54066 -> 195.113.214.249 443 SRPA* 0 0 23 12306 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:00.101825 2.995493 tcp 10.0.2.105 54067 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:09.096279 0.000000 tcp 10.0.2.105 54067 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:15.095321 0.063825 tcp 10.0.2.105 54068 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:15.159428 0.071229 tcp 10.0.2.105 54069 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:15.230987 0.175618 tcp 10.0.2.105 54070 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:15.931522 2.999049 tcp 10.0.2.105 54071 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:24.929130 0.000000 tcp 10.0.2.105 54071 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:30.927731 3.004197 tcp 10.0.2.105 54072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:39.930417 0.000000 tcp 10.0.2.105 54072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:47:44.547340 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:47:45.929392 0.380758 tcp 10.0.2.105 54073 -> 46.48.223.67 15494 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:58.626466 0.000372 tcp 10.0.2.105 54073 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:47:58.627078 3.004847 tcp 10.0.2.105 54074 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:48:07.630411 0.000000 tcp 10.0.2.105 54074 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:53:13.630795 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:53:13.630940 2.993801 tcp 10.0.2.105 54075 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:53:22.633444 0.000000 tcp 10.0.2.105 54075 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:53:28.633472 0.066853 tcp 10.0.2.105 54076 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:28.700576 0.066994 tcp 10.0.2.105 54077 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:28.767870 0.175620 tcp 10.0.2.105 54078 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:29.520557 2.997020 tcp 10.0.2.105 54079 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:53:38.516036 0.000000 tcp 10.0.2.105 54079 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:53:44.515403 0.274857 tcp 10.0.2.105 54080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:44.790110 0.065008 tcp 10.0.2.105 54081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:44.855390 0.183965 tcp 10.0.2.105 54082 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:53:45.071137 4.840012 tcp 10.0.2.105 54083 -> 46.48.223.67 15494 SPA_* 0 0 10 1102 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:19.906594 0.061577 tcp 10.0.2.105 54084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:19.968515 0.063063 tcp 10.0.2.105 54085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:20.031906 0.150974 tcp 10.0.2.105 54086 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:20.422915 0.000101 tcp 10.0.2.105 54083 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:20.423223 2.997286 tcp 10.0.2.105 54087 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:54:29.419235 0.000000 tcp 10.0.2.105 54087 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:54:35.421748 0.190846 tcp 10.0.2.105 54088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:35.612833 0.066406 tcp 10.0.2.105 54089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:35.679689 0.163981 tcp 10.0.2.105 54090 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/17 01:54:36.134849 2.998528 tcp 10.0.2.105 54091 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:54:45.141913 0.000000 tcp 10.0.2.105 54091 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:54:51.130718 2.994156 tcp 10.0.2.105 54092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:55:00.129202 0.000000 tcp 10.0.2.105 54092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:55:05.050242 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:55:06.132219 2.995327 tcp 10.0.2.105 54093 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:55:15.125274 0.000000 tcp 10.0.2.105 54093 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:55:21.133779 3.004010 tcp 10.0.2.105 54094 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:55:29.055163 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:55:30.136164 0.000000 tcp 10.0.2.105 54094 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 01:56:20.418794 0.000000 tcp 10.0.2.105 54083 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/17 01:56:25.055337 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 01:57:02.613394 3.000582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 01:57:09.619735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:57:17.621096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:57:33.825909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 01:58:05.640146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:00:36.137147 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:00:36.137315 3.003370 tcp 10.0.2.105 54095 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:00:45.139466 0.000000 tcp 10.0.2.105 54095 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:00:51.140591 0.065210 tcp 10.0.2.105 54096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:00:51.206129 0.062657 tcp 10.0.2.105 54097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:00:51.269071 0.165607 tcp 10.0.2.105 54098 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:00:51.721121 1.372944 tcp 10.0.2.105 54099 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:01:23.094586 0.063914 tcp 10.0.2.105 54100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:01:23.158830 0.066783 tcp 10.0.2.105 54101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:01:23.225929 0.159706 tcp 10.0.2.105 54102 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:01:23.436699 0.373396 tcp 10.0.2.105 54099 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:01:23.437058 3.001756 tcp 10.0.2.105 54103 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:01:32.437604 0.000000 tcp 10.0.2.105 54103 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:01:38.437525 1.846048 tcp 10.0.2.105 54104 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:03:24.678973 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:03:24.679132 0.108407 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:24.752866 0.171859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.003928 0.190991 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.163456 0.123182 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.268723 0.175916 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.445213 0.218745 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.644037 0.188563 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.808538 0.059020 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:25.941279 0.182097 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:26.118579 0.239328 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:26.350737 0.167320 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:26.598629 0.222758 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:26.815912 0.353823 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:27.142802 0.128665 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:27.670473 0.079829 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 1958 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:27.716688 0.200379 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:27.963641 0.346829 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:28.425137 0.131056 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:28.507617 0.180724 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:29.449811 0.021191 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:29.481302 0.178140 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:29.653888 0.192714 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:30.140195 0.236167 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:30.357936 0.187342 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:30.599057 0.194693 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:30.786103 0.446844 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:31.209513 0.082797 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:03:31.454393 0.349262 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:04:09.646328 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:04:16.653539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:04:24.655111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:04:40.658072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:05:12.664087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:06:40.281188 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:06:40.281353 2.992782 tcp 10.0.2.105 54105 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:06:49.283127 0.000000 tcp 10.0.2.105 54105 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:06:55.287060 0.063728 tcp 10.0.2.105 54106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:06:55.351093 0.066765 tcp 10.0.2.105 54107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:06:55.417791 0.169481 tcp 10.0.2.105 54108 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:06:55.996169 2.990628 tcp 10.0.2.105 54109 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:04.987111 0.000000 tcp 10.0.2.105 54109 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:10.985239 0.063009 tcp 10.0.2.105 54110 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:11.048574 0.066063 tcp 10.0.2.105 54111 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:11.114444 0.167849 tcp 10.0.2.105 54112 -> 195.113.214.249 443 SRPA* 0 0 27 11666 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:11.502789 0.372075 tcp 10.0.2.105 54113 -> 46.48.223.67 15494 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:18.045133 0.893894 tcp 10.0.2.105 54113 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:18.045927 0.065015 tcp 10.0.2.105 54114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:18.111188 0.066307 tcp 10.0.2.105 54115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:18.177823 0.234520 tcp 10.0.2.105 54116 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:18.939248 3.000688 tcp 10.0.2.105 54117 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:27.944761 0.000000 tcp 10.0.2.105 54117 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:33.940403 0.069775 tcp 10.0.2.105 54118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:34.010537 0.111004 tcp 10.0.2.105 54119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:34.121863 0.155998 tcp 10.0.2.105 54120 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:07:34.521009 3.001507 tcp 10.0.2.105 54121 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:43.521034 0.000000 tcp 10.0.2.105 54121 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:49.511810 2.992207 tcp 10.0.2.105 54122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:07:58.512604 0.000000 tcp 10.0.2.105 54122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:08:03.049056 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:08:04.511460 0.385485 tcp 10.0.2.105 54123 -> 46.48.223.67 15494 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:08:10.857762 0.000362 tcp 10.0.2.105 54123 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:08:10.858341 2.996306 tcp 10.0.2.105 54124 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:08:19.862679 0.000000 tcp 10.0.2.105 54124 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:11:16.670417 3.001237 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:11:23.677516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:11:31.679104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:11:47.682665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:12:19.698044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:13:25.853612 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:13:25.853719 3.003645 tcp 10.0.2.105 54125 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:13:34.856093 0.000000 tcp 10.0.2.105 54125 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:13:40.855700 0.069508 tcp 10.0.2.105 54126 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:40.925478 0.065269 tcp 10.0.2.105 54127 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:40.991015 0.175748 tcp 10.0.2.105 54128 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:41.557004 3.003847 tcp 10.0.2.105 54129 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:13:50.558670 0.000000 tcp 10.0.2.105 54129 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:13:56.557847 0.065875 tcp 10.0.2.105 54130 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:56.624029 0.064481 tcp 10.0.2.105 54131 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:56.688878 0.156602 tcp 10.0.2.105 54132 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:13:57.333803 0.376621 tcp 10.0.2.105 54133 -> 46.48.223.67 15494 SPA_* 0 0 9 1218 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:04.165247 0.655869 tcp 10.0.2.105 54133 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:04.166074 0.064977 tcp 10.0.2.105 54134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:04.230883 0.064206 tcp 10.0.2.105 54135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:04.295433 0.153782 tcp 10.0.2.105 54136 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:04.821437 2.992209 tcp 10.0.2.105 54137 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:13.822163 0.000000 tcp 10.0.2.105 54137 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:19.820821 0.064171 tcp 10.0.2.105 54138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:19.885274 0.061917 tcp 10.0.2.105 54139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:19.947453 0.159873 tcp 10.0.2.105 54140 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:20.611841 2.994264 tcp 10.0.2.105 54141 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:29.605012 0.000000 tcp 10.0.2.105 54141 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:35.605131 3.031902 tcp 10.0.2.105 54142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:43.555031 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:14:44.606654 0.000000 tcp 10.0.2.105 54142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:14:50.615633 1.896606 tcp 10.0.2.105 54143 -> 46.48.223.67 15494 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:14:52.512495 2.999564 tcp 10.0.2.105 54144 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:15:01.510777 0.000000 tcp 10.0.2.105 54144 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:18:23.703705 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:18:30.711491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:18:38.712759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:18:54.715715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:19:26.722383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:20:07.511436 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:20:07.511612 2.993491 tcp 10.0.2.105 54145 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:16.503581 0.000000 tcp 10.0.2.105 54145 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:22.514512 0.061891 tcp 10.0.2.105 54146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:22.576729 0.101622 tcp 10.0.2.105 54147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:22.678609 0.159347 tcp 10.0.2.105 54148 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:23.010851 2.999516 tcp 10.0.2.105 54149 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:32.005729 0.000000 tcp 10.0.2.105 54149 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:38.005530 0.535846 tcp 10.0.2.105 54150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:38.541677 0.073769 tcp 10.0.2.105 54151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:38.615794 0.175372 tcp 10.0.2.105 54152 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:38.889811 2.981481 tcp 10.0.2.105 54153 -> 46.48.223.67 15494 FSPA* 0 0 14 1758 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:41.433101 0.063130 tcp 10.0.2.105 54154 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:41.496571 0.066993 tcp 10.0.2.105 54155 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:41.563500 0.156339 tcp 10.0.2.105 54156 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:41.871539 2.971072 tcp 10.0.2.105 54157 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:50.825379 0.000000 tcp 10.0.2.105 54157 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:20:56.757653 0.061490 tcp 10.0.2.105 54158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:56.819417 0.061166 tcp 10.0.2.105 54159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:56.880867 0.163481 tcp 10.0.2.105 54160 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:20:57.160981 2.964808 tcp 10.0.2.105 54161 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:21:06.069853 0.000000 tcp 10.0.2.105 54161 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:21:12.014611 2.973755 tcp 10.0.2.105 54162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:21:20.927005 0.000000 tcp 10.0.2.105 54162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:21:25.604345 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:21:26.870291 0.389058 tcp 10.0.2.105 54163 -> 46.48.223.67 15494 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:21:41.560390 0.004083 tcp 10.0.2.105 54163 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:21:41.564688 3.005838 tcp 10.0.2.105 54164 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:21:50.569008 0.000000 tcp 10.0.2.105 54164 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:25:30.732229 2.997444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:25:37.735765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:25:45.736815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:26:01.739927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:26:33.745873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:26:56.559475 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:26:56.559625 2.993705 tcp 10.0.2.105 54165 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:05.561741 0.000000 tcp 10.0.2.105 54165 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:11.562470 0.068618 tcp 10.0.2.105 54166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:11.631399 0.068323 tcp 10.0.2.105 54167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:11.700164 0.161453 tcp 10.0.2.105 54168 -> 195.113.214.249 443 SRPA* 0 0 51 33948 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:11.879047 2.995616 tcp 10.0.2.105 54169 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:20.873862 0.000000 tcp 10.0.2.105 54169 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:26.873201 0.064308 tcp 10.0.2.105 54170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:26.937341 0.063933 tcp 10.0.2.105 54171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:27.001572 0.169749 tcp 10.0.2.105 54172 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:27.596661 2.455326 tcp 10.0.2.105 54173 -> 46.48.223.67 15494 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:29.450964 0.067842 tcp 10.0.2.105 54174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:29.519071 0.069271 tcp 10.0.2.105 54175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:29.588674 0.161370 tcp 10.0.2.105 54176 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:30.052393 2.998768 tcp 10.0.2.105 54177 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:39.049828 0.000000 tcp 10.0.2.105 54177 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:45.049494 0.229326 tcp 10.0.2.105 54178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:45.279068 0.064267 tcp 10.0.2.105 54179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:45.343651 0.157936 tcp 10.0.2.105 54180 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:27:45.526314 2.970443 tcp 10.0.2.105 54181 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:27:54.459236 0.000000 tcp 10.0.2.105 54181 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:28:00.409455 2.968127 tcp 10.0.2.105 54182 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:28:09.363534 0.000000 tcp 10.0.2.105 54182 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:28:14.050298 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:28:15.372410 1.827551 tcp 10.0.2.105 54183 -> 46.48.223.67 15494 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:28:17.200406 2.998876 tcp 10.0.2.105 54184 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:28:26.197696 0.000000 tcp 10.0.2.105 54184 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:32:37.752313 3.001226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:32:44.759495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:32:52.760988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:33:08.773670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:33:40.779900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:33:58.745927 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:33:58.746155 0.119014 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:58.831000 0.124700 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.020074 0.178691 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.281202 0.202926 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.472439 0.174458 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.643894 0.190603 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.806473 0.187445 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:33:59.997910 0.059621 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2620 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:00.055693 0.182205 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:00.267166 0.236297 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2558 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:00.495723 0.169470 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:00.850565 0.222534 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:01.069966 0.349398 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:01.391722 0.085028 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:01.558160 0.088128 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:01.608130 0.200152 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:02.052958 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 02:34:02.201392 2.993774 tcp 10.0.2.105 54185 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:11.193540 0.000000 tcp 10.0.2.105 54185 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:17.204339 0.072145 tcp 10.0.2.105 54186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:17.276699 0.065643 tcp 10.0.2.105 54187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:17.342624 0.156711 tcp 10.0.2.105 54188 -> 195.113.214.249 443 SRPA* 0 0 22 13088 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:17.782481 2.995120 tcp 10.0.2.105 54189 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:19.778262 0.067289 tcp 10.0.2.105 54190 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:19.845866 0.064228 tcp 10.0.2.105 54191 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:19.910450 0.151317 tcp 10.0.2.105 54192 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:20.062327 0.143410 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:20.159386 0.175944 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:20.418108 0.187350 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:20.602852 0.168672 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:20.748123 0.024259 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:20.790144 0.236613 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:21.006148 0.188580 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:21.187067 0.192091 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:21.371538 0.352060 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:21.905499 0.445689 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:22.327341 0.086313 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/17 02:34:26.775736 0.000000 tcp 10.0.2.105 54189 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:32.775420 0.422990 tcp 10.0.2.105 54193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:33.198670 0.062019 tcp 10.0.2.105 54194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:33.260992 0.162964 tcp 10.0.2.105 54195 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:34:33.890610 2.974690 tcp 10.0.2.105 54196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:42.803257 0.000000 tcp 10.0.2.105 54196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:48.742876 2.978888 tcp 10.0.2.105 54197 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:34:56.658371 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:34:57.663185 0.000000 tcp 10.0.2.105 54197 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:39:44.790489 2.997283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:39:51.793424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:39:59.794971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:40:03.561406 0.000242 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:40:03.561778 2.992964 tcp 10.0.2.105 54198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:12.563315 0.000000 tcp 10.0.2.105 54198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:15.797920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:40:18.564042 0.081163 tcp 10.0.2.105 54199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:18.645513 0.065226 tcp 10.0.2.105 54200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:18.711033 0.155840 tcp 10.0.2.105 54201 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:19.089763 2.997200 tcp 10.0.2.105 54202 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:28.085466 0.000000 tcp 10.0.2.105 54202 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:34.085088 0.061720 tcp 10.0.2.105 54203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:34.147021 0.063642 tcp 10.0.2.105 54204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:34.210913 0.164627 tcp 10.0.2.105 54205 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:34.677587 2.381616 tcp 10.0.2.105 54206 -> 46.48.223.67 15494 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:36.540823 0.065988 tcp 10.0.2.105 54207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:36.607109 0.067577 tcp 10.0.2.105 54208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:36.674971 0.156528 tcp 10.0.2.105 54209 -> 195.113.214.249 443 SRPA* 0 0 51 42184 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:37.059486 3.003243 tcp 10.0.2.105 54210 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:46.071418 0.000000 tcp 10.0.2.105 54210 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:40:47.804119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:40:52.060491 0.066199 tcp 10.0.2.105 54211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:52.126967 0.070410 tcp 10.0.2.105 54212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:52.197207 0.160038 tcp 10.0.2.105 54213 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:40:52.595006 3.000193 tcp 10.0.2.105 54214 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:41:01.593736 0.000000 tcp 10.0.2.105 54214 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:41:07.592682 2.994173 tcp 10.0.2.105 54215 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:41:16.585236 0.000000 tcp 10.0.2.105 54215 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:41:21.552674 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:41:22.594182 0.374730 tcp 10.0.2.105 54216 -> 46.48.223.67 15494 SPA_* 0 0 9 1216 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:41:36.161113 0.000384 tcp 10.0.2.105 54216 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:41:36.161776 2.995900 tcp 10.0.2.105 54217 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:41:45.156431 0.000000 tcp 10.0.2.105 54217 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:46:51.158308 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:46:51.158468 3.006118 tcp 10.0.2.105 54218 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:46:51.818197 2.996356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:46:58.817616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:47:00.159371 0.000000 tcp 10.0.2.105 54218 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:06.159712 0.071634 tcp 10.0.2.105 54219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:06.231690 0.060662 tcp 10.0.2.105 54220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:06.292679 0.172397 tcp 10.0.2.105 54221 -> 195.113.214.249 443 SRPA* 0 0 66 69742 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:06.741766 2.990970 tcp 10.0.2.105 54222 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:06.819008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:47:15.741675 0.000000 tcp 10.0.2.105 54222 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:21.741074 0.073204 tcp 10.0.2.105 54223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:21.814545 0.062317 tcp 10.0.2.105 54224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:21.877168 0.150410 tcp 10.0.2.105 54225 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:22.158330 2.683048 tcp 10.0.2.105 54226 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:22.821903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:47:24.076805 0.099178 tcp 10.0.2.105 54227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:24.176276 0.063517 tcp 10.0.2.105 54228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:24.240102 0.174872 tcp 10.0.2.105 54229 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:24.841657 2.964794 tcp 10.0.2.105 54230 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:33.727839 0.000000 tcp 10.0.2.105 54230 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:39.656770 0.062040 tcp 10.0.2.105 54231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:39.719083 0.070526 tcp 10.0.2.105 54232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:39.789920 0.163934 tcp 10.0.2.105 54233 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:47:40.393460 2.973258 tcp 10.0.2.105 54234 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:49.292842 0.000000 tcp 10.0.2.105 54234 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:47:55.056988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:47:55.206001 2.969325 tcp 10.0.2.105 54235 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:48:04.102494 0.000000 tcp 10.0.2.105 54235 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:48:08.588121 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:48:10.024731 1.960652 tcp 10.0.2.105 54236 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:48:11.985636 3.001006 tcp 10.0.2.105 54237 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:48:20.984918 0.000000 tcp 10.0.2.105 54237 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:53:26.986132 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:53:26.986307 3.003560 tcp 10.0.2.105 54238 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:53:35.988049 0.000000 tcp 10.0.2.105 54238 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:53:41.989123 0.069437 tcp 10.0.2.105 54239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:42.058883 0.063840 tcp 10.0.2.105 54240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:42.122999 0.162359 tcp 10.0.2.105 54241 -> 195.113.214.249 443 SRPA* 0 0 57 40168 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:42.468970 3.003132 tcp 10.0.2.105 54242 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:53:51.470661 0.000000 tcp 10.0.2.105 54242 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:53:57.470835 0.062292 tcp 10.0.2.105 54243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:57.533435 0.068664 tcp 10.0.2.105 54244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:57.602447 0.938487 tcp 10.0.2.105 54245 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:59.095262 0.381109 tcp 10.0.2.105 54246 -> 46.48.223.67 15494 SPA_* 0 0 9 1221 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:53:59.606472 2.962411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 02:54:05.556398 0.833210 tcp 10.0.2.105 54246 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:05.557211 0.128651 tcp 10.0.2.105 54247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:05.686066 0.068177 tcp 10.0.2.105 54248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:05.754545 0.156663 tcp 10.0.2.105 54249 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:06.389422 2.956537 tcp 10.0.2.105 54250 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:06.532897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:54:14.447599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:54:15.288262 0.000000 tcp 10.0.2.105 54250 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:21.218507 0.061577 tcp 10.0.2.105 54251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:21.280507 0.064103 tcp 10.0.2.105 54252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:21.344914 0.168453 tcp 10.0.2.105 54253 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:21.738221 2.962336 tcp 10.0.2.105 54254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:30.260870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 02:54:30.627975 0.000000 tcp 10.0.2.105 54254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:36.555762 2.972274 tcp 10.0.2.105 54255 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:45.453951 0.000000 tcp 10.0.2.105 54255 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:54:50.213723 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 02:54:51.378354 1.353485 tcp 10.0.2.105 54256 -> 46.48.223.67 15494 FSPA* 0 0 13 1437 flow=From-Botnet-V2-TCP-Established 1970/02/17 02:54:52.732101 2.977251 tcp 10.0.2.105 54257 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:55:01.645026 0.000000 tcp 10.0.2.105 54257 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 02:55:01.889654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:00:07.602158 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:00:07.602314 2.993432 tcp 10.0.2.105 54258 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:16.595879 0.000000 tcp 10.0.2.105 54258 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:22.604782 0.079103 tcp 10.0.2.105 54259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:22.684146 0.060788 tcp 10.0.2.105 54260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:22.745255 0.167227 tcp 10.0.2.105 54261 -> 195.113.214.249 443 SRPA* 0 0 42 22668 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:23.209149 2.999325 tcp 10.0.2.105 54262 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:32.207093 0.000000 tcp 10.0.2.105 54262 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:38.205783 0.069052 tcp 10.0.2.105 54263 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:38.275139 0.071236 tcp 10.0.2.105 54264 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:38.346666 0.161495 tcp 10.0.2.105 54265 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:38.578141 2.179305 tcp 10.0.2.105 54266 -> 46.48.223.67 15494 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:40.441940 0.069096 tcp 10.0.2.105 54267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:40.511345 0.060778 tcp 10.0.2.105 54268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:40.572472 0.172797 tcp 10.0.2.105 54269 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:00:40.757682 2.995917 tcp 10.0.2.105 54270 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:49.764552 0.000000 tcp 10.0.2.105 54270 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:00:55.750793 2.994311 tcp 10.0.2.105 54271 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:01:06.983208 0.000000 tcp 10.0.2.105 54271 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:01:08.101515 2.969983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:01:11.736490 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:01:12.921115 1.946706 tcp 10.0.2.105 54272 -> 46.48.223.67 15494 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:01:15.025100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:01:22.931665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:01:38.747611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:02:10.366251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:04:42.076395 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:04:42.076498 0.340272 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:42.416297 0.175170 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:42.677218 0.107798 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:42.751868 0.126108 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:42.989969 0.172955 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:43.159479 0.185927 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:43.393906 0.183829 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:43.699841 0.057138 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:43.755221 0.202889 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:43.945467 0.182319 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:44.149205 0.167723 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:44.297154 0.259656 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:44.652265 0.216561 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:44.865711 0.087489 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:44.936730 0.202926 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:45.134751 0.106490 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:45.401480 0.389964 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:45.790009 0.133992 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:45.876538 0.175535 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:46.064234 0.190592 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:46.250746 0.208831 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:46.398867 0.037247 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:46.624062 0.238697 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:46.841619 0.186200 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:47.021183 0.441983 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:47.442925 0.192783 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:47.702940 0.348777 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:04:48.095212 0.084151 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:06:12.727899 0.000230 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:06:12.728653 3.002356 tcp 10.0.2.105 54273 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:06:21.730597 0.000000 tcp 10.0.2.105 54273 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:06:27.730106 0.062675 tcp 10.0.2.105 54274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:27.793030 0.063384 tcp 10.0.2.105 54275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:27.856355 0.163089 tcp 10.0.2.105 54276 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:28.436207 2.997194 tcp 10.0.2.105 54277 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:06:37.441899 0.000000 tcp 10.0.2.105 54277 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:06:43.431358 0.066034 tcp 10.0.2.105 54278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:43.497741 0.069096 tcp 10.0.2.105 54279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:43.567158 0.157926 tcp 10.0.2.105 54280 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:43.755144 0.377522 tcp 10.0.2.105 54281 -> 46.48.223.67 15494 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:56.798071 0.621838 tcp 10.0.2.105 54281 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:56.799051 0.064882 tcp 10.0.2.105 54282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:56.864233 0.068676 tcp 10.0.2.105 54283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:56.933241 0.156935 tcp 10.0.2.105 54284 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:06:57.420167 2.994705 tcp 10.0.2.105 54285 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:06.413509 0.000000 tcp 10.0.2.105 54285 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:12.412988 0.068593 tcp 10.0.2.105 54286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:07:12.481861 0.074262 tcp 10.0.2.105 54287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:07:12.556540 0.165314 tcp 10.0.2.105 54288 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:07:12.897381 2.999855 tcp 10.0.2.105 54289 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:21.895784 0.000000 tcp 10.0.2.105 54289 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:27.894698 3.004318 tcp 10.0.2.105 54290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:36.898829 0.000000 tcp 10.0.2.105 54290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:41.556650 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:07:42.896336 1.873255 tcp 10.0.2.105 54291 -> 46.48.223.67 15494 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:07:44.769417 3.003378 tcp 10.0.2.105 54292 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:07:53.781589 0.000000 tcp 10.0.2.105 54292 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:08:12.901885 3.001433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:08:19.909114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:08:27.910823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:08:43.913771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:09:15.919955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:12:59.762414 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:12:59.762617 2.993001 tcp 10.0.2.105 54293 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:08.754546 0.000000 tcp 10.0.2.105 54293 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:14.765085 0.061565 tcp 10.0.2.105 54294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:14.826943 0.061669 tcp 10.0.2.105 54295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:14.888885 0.150896 tcp 10.0.2.105 54296 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:15.075708 3.002232 tcp 10.0.2.105 54297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:24.076988 0.000000 tcp 10.0.2.105 54297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:30.075611 0.060296 tcp 10.0.2.105 54298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:30.136403 0.069399 tcp 10.0.2.105 54299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:30.206075 0.156449 tcp 10.0.2.105 54300 -> 195.113.214.249 443 SRPA* 0 0 40 31908 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:30.486694 0.390111 tcp 10.0.2.105 54301 -> 46.48.223.67 15494 SPA_* 0 0 9 1045 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:36.107051 0.702206 tcp 10.0.2.105 54301 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:36.108040 0.064427 tcp 10.0.2.105 54302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:36.172844 0.070246 tcp 10.0.2.105 54303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:36.243401 0.164960 tcp 10.0.2.105 54304 -> 195.113.214.249 443 SRPA* 0 0 27 11688 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:36.809488 3.000137 tcp 10.0.2.105 54305 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:45.809544 0.000000 tcp 10.0.2.105 54305 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:13:51.807267 0.065764 tcp 10.0.2.105 54306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:51.873318 0.066364 tcp 10.0.2.105 54307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:51.939980 0.158194 tcp 10.0.2.105 54308 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:13:52.183142 3.008199 tcp 10.0.2.105 54309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:14:01.190641 0.000000 tcp 10.0.2.105 54309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:14:07.179158 3.003500 tcp 10.0.2.105 54310 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:14:16.192665 0.000000 tcp 10.0.2.105 54310 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:14:21.051447 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:14:22.181160 0.388233 tcp 10.0.2.105 54311 -> 46.48.223.67 15494 SPA_* 0 0 9 1045 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:14:27.630973 0.000378 tcp 10.0.2.105 54311 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:14:27.631558 3.003102 tcp 10.0.2.105 54312 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:14:36.631044 0.000000 tcp 10.0.2.105 54312 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:15:19.925451 3.005281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:15:26.933285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:15:34.934529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:15:50.937935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:16:22.943833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:19:42.631459 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:19:42.631611 2.993791 tcp 10.0.2.105 54313 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:19:51.695616 0.000000 tcp 10.0.2.105 54313 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:19:57.664633 0.065125 tcp 10.0.2.105 54314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:19:57.730139 0.065570 tcp 10.0.2.105 54315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:19:57.796023 0.165377 tcp 10.0.2.105 54316 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:19:58.127283 2.970248 tcp 10.0.2.105 54317 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:07.098455 0.000000 tcp 10.0.2.105 54317 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:13.095475 0.103054 tcp 10.0.2.105 54318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:13.198867 0.062748 tcp 10.0.2.105 54319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:13.261943 0.153922 tcp 10.0.2.105 54320 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:13.611856 0.373014 tcp 10.0.2.105 54321 -> 46.48.223.67 15494 SPA_* 0 0 9 1216 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:21.585299 0.423184 tcp 10.0.2.105 54321 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:21.586111 0.063072 tcp 10.0.2.105 54322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:21.649436 0.064413 tcp 10.0.2.105 54323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:21.714180 0.154647 tcp 10.0.2.105 54324 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:22.008820 3.003211 tcp 10.0.2.105 54325 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:31.011422 0.000000 tcp 10.0.2.105 54325 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:37.009658 0.067164 tcp 10.0.2.105 54326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:37.077129 0.065309 tcp 10.0.2.105 54327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:37.142751 0.159041 tcp 10.0.2.105 54328 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:20:37.712060 2.992280 tcp 10.0.2.105 54329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:46.704497 0.000000 tcp 10.0.2.105 54329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:20:52.711930 2.993870 tcp 10.0.2.105 54330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:21:01.704179 0.000000 tcp 10.0.2.105 54330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:21:06.553271 0.000129 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:21:07.713261 2.992012 tcp 10.0.2.105 54331 -> 46.48.223.67 15494 FSPA* 0 0 12 1638 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:21:10.705507 3.006333 tcp 10.0.2.105 54332 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:21:19.710419 0.000000 tcp 10.0.2.105 54332 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:21:19.958223 0.000173 tcp 10.0.2.105 54331 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:22:30.955620 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:22:37.962821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:22:45.964491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:23:01.967558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:23:33.973476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:26:25.701011 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:26:25.701128 2.995843 tcp 10.0.2.105 54333 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:26:34.692976 0.000000 tcp 10.0.2.105 54333 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:26:40.703638 0.066761 tcp 10.0.2.105 54334 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:40.771318 0.062305 tcp 10.0.2.105 54335 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:40.833537 0.158825 tcp 10.0.2.105 54336 -> 195.113.214.249 443 SRPA* 0 0 33 25676 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:41.149618 2.997358 tcp 10.0.2.105 54337 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:26:50.147759 0.000000 tcp 10.0.2.105 54337 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:26:56.144806 0.130013 tcp 10.0.2.105 54338 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:56.275103 0.065537 tcp 10.0.2.105 54339 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:56.340965 0.170807 tcp 10.0.2.105 54340 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:26:56.623524 4.709048 tcp 10.0.2.105 54341 -> 46.48.223.67 15494 SPA_* 0 0 12 1468 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:01.333214 0.060980 tcp 10.0.2.105 54342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:01.394120 0.063601 tcp 10.0.2.105 54343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:01.458002 0.164903 tcp 10.0.2.105 54344 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:01.633805 0.000072 tcp 10.0.2.105 54341 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:01.634143 3.002289 tcp 10.0.2.105 54345 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:10.635136 0.000000 tcp 10.0.2.105 54345 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:16.634454 0.061892 tcp 10.0.2.105 54346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:16.696529 0.063117 tcp 10.0.2.105 54347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:16.760020 0.185664 tcp 10.0.2.105 54348 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:27:17.188685 3.000273 tcp 10.0.2.105 54349 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:26.187538 0.000000 tcp 10.0.2.105 54349 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:32.186954 3.003412 tcp 10.0.2.105 54350 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:41.188976 0.000000 tcp 10.0.2.105 54350 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:27:46.045736 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:27:47.192821 0.382182 tcp 10.0.2.105 54351 -> 46.48.223.67 15494 SPA_* 0 0 9 1046 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:28:11.293779 0.000351 tcp 10.0.2.105 54351 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:28:11.294399 3.001670 tcp 10.0.2.105 54352 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:28:20.295296 0.000000 tcp 10.0.2.105 54352 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:29:37.979415 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:29:44.986771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:29:52.995064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:30:08.995230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:30:40.997594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:34:57.887237 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:34:57.887432 0.114326 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:57.968173 0.124202 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:58.136967 0.173591 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:58.307219 0.347420 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:58.777141 0.176225 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:59.281417 0.194710 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:59.446924 0.186856 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:34:59.628204 0.056994 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:00.016658 0.202821 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:00.207238 0.182519 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:00.696871 0.169435 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:00.846810 0.238108 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:01.328417 0.214524 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:01.638435 0.106413 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:01.855833 0.201912 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:02.243280 0.127142 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:02.328837 0.177580 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:03.300055 0.186969 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:03.714762 0.091855 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:03.816419 0.409609 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:04.458282 0.168106 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:04.885734 0.024295 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:04.957892 0.239336 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:05.253983 0.185728 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:05.432689 0.347289 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:05.776154 0.089555 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:05.862996 0.449219 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:06.290731 0.191262 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/17 03:35:11.306656 3.003831 tcp 10.0.2.105 54353 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:20.309452 0.000000 tcp 10.0.2.105 54353 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:25.045940 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:35:26.309831 0.062810 tcp 10.0.2.105 54354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:26.372937 0.066798 tcp 10.0.2.105 54355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:26.440030 0.155459 tcp 10.0.2.105 54356 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:26.910088 3.002522 tcp 10.0.2.105 54357 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:35.921617 0.000000 tcp 10.0.2.105 54357 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:41.910834 0.061057 tcp 10.0.2.105 54358 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:41.972235 0.065978 tcp 10.0.2.105 54359 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:42.038510 0.178228 tcp 10.0.2.105 54360 -> 195.113.214.249 443 SRPA* 0 0 23 13178 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:42.396925 2.317902 tcp 10.0.2.105 54361 -> 46.48.223.67 15494 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:44.400900 0.063914 tcp 10.0.2.105 54362 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:44.465106 0.061657 tcp 10.0.2.105 54363 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:44.527036 0.155177 tcp 10.0.2.105 54364 -> 195.113.214.249 443 SRPA* 0 0 40 21976 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:44.715052 3.004987 tcp 10.0.2.105 54365 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:53.717231 0.000000 tcp 10.0.2.105 54365 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:35:59.716140 0.062077 tcp 10.0.2.105 54366 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:59.778512 0.065929 tcp 10.0.2.105 54367 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:35:59.844772 0.222010 tcp 10.0.2.105 54368 -> 195.113.214.249 443 SRPA* 0 0 41 22634 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:36:00.153993 3.006759 tcp 10.0.2.105 54369 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:09.159283 0.000000 tcp 10.0.2.105 54369 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:15.148123 3.004219 tcp 10.0.2.105 54370 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:24.150785 0.000000 tcp 10.0.2.105 54370 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:29.047793 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:36:30.149774 0.385699 tcp 10.0.2.105 54371 -> 46.48.223.67 15494 SPA_* 0 0 7 898 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:36:38.954708 0.000278 tcp 10.0.2.105 54371 -> 46.48.223.67 15494 FA_PA 0 0 3 422 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:36:38.955243 3.001279 tcp 10.0.2.105 54372 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:45.003700 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:36:47.097604 0.000145 tcp 10.0.2.105 54371 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:36:47.955003 0.000000 tcp 10.0.2.105 54372 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:36:52.014448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:37:00.012027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:37:16.015455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:37:48.022600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:41:53.955129 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:41:53.955234 3.004081 tcp 10.0.2.105 54373 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:42:02.962864 0.000000 tcp 10.0.2.105 54373 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:42:08.959371 0.066491 tcp 10.0.2.105 54374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:09.026201 0.071111 tcp 10.0.2.105 54375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:09.097683 0.173388 tcp 10.0.2.105 54376 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:09.928181 3.004166 tcp 10.0.2.105 54377 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:42:18.931100 0.000000 tcp 10.0.2.105 54377 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:42:24.930355 0.163094 tcp 10.0.2.105 54378 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:25.093768 0.065908 tcp 10.0.2.105 54379 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:25.159974 0.166412 tcp 10.0.2.105 54380 -> 195.113.214.249 443 SRPA* 0 0 40 21150 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:25.452643 0.402807 tcp 10.0.2.105 54381 -> 46.48.223.67 15494 SPA_* 0 0 9 1183 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:44.404886 0.981698 tcp 10.0.2.105 54381 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:44.405894 0.068632 tcp 10.0.2.105 54382 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:44.474825 0.065512 tcp 10.0.2.105 54383 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:44.540628 0.181696 tcp 10.0.2.105 54384 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:42:45.386825 3.012071 tcp 10.0.2.105 54385 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:42:54.404698 0.000000 tcp 10.0.2.105 54385 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:00.381396 0.061800 tcp 10.0.2.105 54386 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:43:00.443644 0.067600 tcp 10.0.2.105 54387 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:43:00.511511 0.172738 tcp 10.0.2.105 54388 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:43:00.706165 2.998750 tcp 10.0.2.105 54389 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:09.703807 0.000000 tcp 10.0.2.105 54389 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:15.704583 3.002370 tcp 10.0.2.105 54390 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:24.705268 0.000000 tcp 10.0.2.105 54390 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:29.552576 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:43:30.704327 0.402614 tcp 10.0.2.105 54391 -> 46.48.223.67 15494 SPA_* 0 0 9 1183 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:43:38.663507 0.000400 tcp 10.0.2.105 54391 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:43:38.664220 3.005817 tcp 10.0.2.105 54392 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:47.668587 0.000000 tcp 10.0.2.105 54392 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:43:52.027220 3.001810 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:43:59.034716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:44:07.035974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:44:23.039442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:44:55.045569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:48:53.658994 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:48:53.659116 3.006489 tcp 10.0.2.105 54393 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:49:02.674569 0.000000 tcp 10.0.2.105 54393 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:49:08.662039 0.062037 tcp 10.0.2.105 54394 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:08.724395 0.068116 tcp 10.0.2.105 54395 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:08.792808 0.172173 tcp 10.0.2.105 54396 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:09.216464 2.998462 tcp 10.0.2.105 54397 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:49:18.213229 0.000000 tcp 10.0.2.105 54397 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:49:24.213181 0.068849 tcp 10.0.2.105 54398 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:24.281966 0.064993 tcp 10.0.2.105 54399 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:24.347222 0.159646 tcp 10.0.2.105 54400 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:24.596089 0.371834 tcp 10.0.2.105 54401 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:54.967584 0.129428 tcp 10.0.2.105 54402 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:55.097391 0.066485 tcp 10.0.2.105 54403 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:55.164187 0.150743 tcp 10.0.2.105 54404 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:55.743612 0.376469 tcp 10.0.2.105 54401 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:49:55.743987 3.007937 tcp 10.0.2.105 54405 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:04.750689 0.000000 tcp 10.0.2.105 54405 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:10.741153 0.060762 tcp 10.0.2.105 54406 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:50:10.802226 0.067507 tcp 10.0.2.105 54407 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:50:10.870015 0.161737 tcp 10.0.2.105 54408 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:50:11.267544 2.996986 tcp 10.0.2.105 54409 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:20.275051 0.000000 tcp 10.0.2.105 54409 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:26.261802 2.994134 tcp 10.0.2.105 54410 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:35.254647 0.000000 tcp 10.0.2.105 54410 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:40.051670 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:50:41.265504 3.557411 tcp 10.0.2.105 54411 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:50:44.823202 3.009496 tcp 10.0.2.105 54412 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:50:53.834655 0.000000 tcp 10.0.2.105 54412 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:55:59.823068 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:55:59.823224 2.991710 tcp 10.0.2.105 54413 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:03.058251 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 03:56:08.814057 0.000000 tcp 10.0.2.105 54413 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:10.065500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:56:14.824499 0.061451 tcp 10.0.2.105 54414 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:14.886218 0.065501 tcp 10.0.2.105 54415 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:14.952294 0.172638 tcp 10.0.2.105 54416 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:15.156285 3.001355 tcp 10.0.2.105 54417 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:18.067413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:56:24.156129 0.000000 tcp 10.0.2.105 54417 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:30.155671 0.059933 tcp 10.0.2.105 54418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:30.215921 0.065550 tcp 10.0.2.105 54419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:30.281744 0.167811 tcp 10.0.2.105 54420 -> 195.113.214.249 443 SRPA* 0 0 22 11628 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:30.605194 0.384720 tcp 10.0.2.105 54421 -> 46.48.223.67 15494 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:34.070524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:56:39.442840 0.595752 tcp 10.0.2.105 54421 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:39.444030 0.063576 tcp 10.0.2.105 54422 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:39.507931 0.070427 tcp 10.0.2.105 54423 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:39.578615 0.173492 tcp 10.0.2.105 54424 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:40.038866 2.972309 tcp 10.0.2.105 54425 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:48.936600 0.000000 tcp 10.0.2.105 54425 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:56:54.855466 0.065880 tcp 10.0.2.105 54426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:54.921620 0.065034 tcp 10.0.2.105 54427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:54.986909 0.163841 tcp 10.0.2.105 54428 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:56:55.402230 2.961142 tcp 10.0.2.105 54429 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:57:04.291823 0.000000 tcp 10.0.2.105 54429 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:57:06.246962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 03:57:10.219512 2.951721 tcp 10.0.2.105 54430 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:57:19.097183 0.000000 tcp 10.0.2.105 54430 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:57:24.052419 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 03:57:25.104035 0.562811 tcp 10.0.2.105 54431 -> 46.48.223.67 15494 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:57:36.468516 0.000377 tcp 10.0.2.105 54431 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 03:57:36.469129 2.970789 tcp 10.0.2.105 54432 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 03:57:45.404822 0.000000 tcp 10.0.2.105 54432 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:03:10.092676 3.001241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:03:17.100849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:03:25.101804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:03:41.675916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:04:13.313818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:05:08.951048 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:05:08.951145 0.173897 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:09.122284 0.116053 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:09.204912 0.124913 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:09.429457 0.362509 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:09.934517 0.180879 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:10.398712 0.186832 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:10.558524 0.185578 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:10.722369 0.059728 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:10.826722 0.204380 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:11.019000 0.241135 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:11.252842 0.181867 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:11.430403 0.167888 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:11.578691 0.222589 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:11.797755 0.085994 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:12.078159 0.199922 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:12.279437 0.130580 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:12.362410 0.176239 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:12.829448 0.187183 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:13.013453 0.087909 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:13.543775 0.364553 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:13.879349 0.221663 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:14.007382 0.023229 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:14.129387 0.239625 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:14.349652 0.084962 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:14.609652 0.445520 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:15.031474 0.185547 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:15.210450 0.349698 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:15.555707 0.192023 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:05:21.409186 2.993726 tcp 10.0.2.105 54433 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:05:30.411551 0.000000 tcp 10.0.2.105 54433 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:05:35.049499 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:05:36.414793 0.065269 tcp 10.0.2.105 54434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:36.480377 0.080180 tcp 10.0.2.105 54435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:36.560896 0.158504 tcp 10.0.2.105 54436 -> 195.113.214.249 443 SRPA* 0 0 42 35078 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:37.529601 2.999254 tcp 10.0.2.105 54437 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:05:46.524834 0.000000 tcp 10.0.2.105 54437 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:05:52.528467 0.061573 tcp 10.0.2.105 54438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:52.590341 0.064636 tcp 10.0.2.105 54439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:52.654873 0.173233 tcp 10.0.2.105 54440 -> 195.113.214.249 443 SRPA* 0 0 42 22132 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:52.979957 2.332618 tcp 10.0.2.105 54441 -> 46.48.223.67 15494 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:54.872965 0.064022 tcp 10.0.2.105 54442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:54.937287 0.062399 tcp 10.0.2.105 54443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:54.999953 0.159457 tcp 10.0.2.105 54444 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:05:55.312829 3.008973 tcp 10.0.2.105 54445 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:04.324806 0.000000 tcp 10.0.2.105 54445 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:10.309625 0.063768 tcp 10.0.2.105 54446 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:06:10.373755 0.066470 tcp 10.0.2.105 54447 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:06:10.440560 0.155965 tcp 10.0.2.105 54448 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:06:10.749199 2.994690 tcp 10.0.2.105 54449 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:19.752671 0.000000 tcp 10.0.2.105 54449 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:25.744862 2.992324 tcp 10.0.2.105 54450 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:34.734204 0.000000 tcp 10.0.2.105 54450 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:39.553019 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:06:40.742739 2.235588 tcp 10.0.2.105 54451 -> 46.48.223.67 15494 FSPA* 0 0 14 1528 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:06:42.978572 3.002493 tcp 10.0.2.105 54452 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:06:51.978888 0.000000 tcp 10.0.2.105 54452 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:10:27.131309 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:10:34.138670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:10:42.140777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:10:58.142698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:11:30.148932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:11:57.979851 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:11:57.979958 2.992772 tcp 10.0.2.105 54453 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:06.981901 0.000000 tcp 10.0.2.105 54453 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:12.982338 0.073697 tcp 10.0.2.105 54454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:13.056341 0.061791 tcp 10.0.2.105 54455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:13.118401 0.183967 tcp 10.0.2.105 54456 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:13.367792 3.002064 tcp 10.0.2.105 54457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:22.363607 0.000000 tcp 10.0.2.105 54457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:28.363369 0.063496 tcp 10.0.2.105 54458 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:28.427180 0.064615 tcp 10.0.2.105 54459 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:28.492101 0.160827 tcp 10.0.2.105 54460 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:28.680611 2.669098 tcp 10.0.2.105 54461 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:30.609094 0.061339 tcp 10.0.2.105 54462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:30.670784 0.069635 tcp 10.0.2.105 54463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:30.740707 0.152171 tcp 10.0.2.105 54464 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:31.349962 3.001211 tcp 10.0.2.105 54465 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:40.349955 0.000000 tcp 10.0.2.105 54465 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:46.348996 0.068292 tcp 10.0.2.105 54466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:46.417600 0.064431 tcp 10.0.2.105 54467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:46.482316 0.156305 tcp 10.0.2.105 54468 -> 195.113.214.249 443 SRPA* 0 0 41 22040 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:12:46.710345 2.992640 tcp 10.0.2.105 54469 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:12:56.251832 0.000000 tcp 10.0.2.105 54469 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:13:02.180317 2.954107 tcp 10.0.2.105 54470 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:13:11.061502 0.000000 tcp 10.0.2.105 54470 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:13:15.850384 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:13:16.996768 0.377930 tcp 10.0.2.105 54471 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:13:23.016528 0.038330 tcp 10.0.2.105 54471 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:13:23.017061 2.959810 tcp 10.0.2.105 54472 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:13:31.901857 0.000000 tcp 10.0.2.105 54472 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:17:34.154489 3.001735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:17:41.204350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:17:49.173773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:18:05.176638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:18:37.182925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:18:37.804358 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:18:37.804542 3.003541 tcp 10.0.2.105 54473 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:18:46.806448 0.000000 tcp 10.0.2.105 54473 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:18:52.807353 0.065829 tcp 10.0.2.105 54474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:18:52.873497 0.063920 tcp 10.0.2.105 54475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:18:52.937781 0.167704 tcp 10.0.2.105 54476 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:18:53.156024 3.003541 tcp 10.0.2.105 54477 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:02.158798 0.000000 tcp 10.0.2.105 54477 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:08.158636 0.071480 tcp 10.0.2.105 54478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:08.230387 0.065368 tcp 10.0.2.105 54479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:08.296087 0.167488 tcp 10.0.2.105 54480 -> 195.113.214.249 443 SRPA* 0 0 41 22078 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:08.544221 2.544774 tcp 10.0.2.105 54481 -> 46.48.223.67 15494 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:10.424834 0.062414 tcp 10.0.2.105 54482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:10.487530 0.063369 tcp 10.0.2.105 54483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:10.551278 0.151156 tcp 10.0.2.105 54484 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:11.089199 2.996327 tcp 10.0.2.105 54485 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:20.084344 0.000000 tcp 10.0.2.105 54485 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:26.083500 0.060699 tcp 10.0.2.105 54486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:26.144508 0.061099 tcp 10.0.2.105 54487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:26.205893 0.150912 tcp 10.0.2.105 54488 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:19:27.043740 3.005234 tcp 10.0.2.105 54489 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:36.047591 0.000000 tcp 10.0.2.105 54489 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:42.036498 3.003964 tcp 10.0.2.105 54490 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:51.040816 0.000000 tcp 10.0.2.105 54490 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:19:55.545351 0.000134 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:19:57.037919 0.376887 tcp 10.0.2.105 54491 -> 46.48.223.67 15494 SPA_* 0 0 9 1046 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:20:08.577489 0.000381 tcp 10.0.2.105 54491 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:20:08.578080 3.000651 tcp 10.0.2.105 54492 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:20:17.577324 0.000000 tcp 10.0.2.105 54492 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:24:41.188785 3.003887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:24:48.196496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:24:56.198759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:25:12.200708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:25:23.577752 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:25:23.577852 3.004045 tcp 10.0.2.105 54493 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:25:32.580024 0.000000 tcp 10.0.2.105 54493 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:25:38.582413 0.063908 tcp 10.0.2.105 54494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:38.646610 0.061295 tcp 10.0.2.105 54495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:38.708239 0.160517 tcp 10.0.2.105 54496 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:39.230734 2.992965 tcp 10.0.2.105 54497 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:25:44.206766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:25:48.232535 0.000000 tcp 10.0.2.105 54497 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:25:54.222082 0.061087 tcp 10.0.2.105 54498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:54.283489 0.066425 tcp 10.0.2.105 54499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:54.350221 0.167046 tcp 10.0.2.105 54500 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:54.709120 2.499296 tcp 10.0.2.105 54501 -> 46.48.223.67 15494 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:56.590137 0.066851 tcp 10.0.2.105 54502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:56.657374 0.064568 tcp 10.0.2.105 54503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:56.722223 0.164123 tcp 10.0.2.105 54504 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:25:57.208648 3.001194 tcp 10.0.2.105 54505 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:06.208399 0.000000 tcp 10.0.2.105 54505 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:12.207339 0.064617 tcp 10.0.2.105 54506 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:26:12.271929 0.064935 tcp 10.0.2.105 54507 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:26:12.337123 0.283244 tcp 10.0.2.105 54508 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:26:12.749265 3.002805 tcp 10.0.2.105 54509 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:21.750752 0.000000 tcp 10.0.2.105 54509 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:27.749823 2.993703 tcp 10.0.2.105 54510 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:37.013676 0.000000 tcp 10.0.2.105 54510 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:41.764487 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:26:42.954214 0.376918 tcp 10.0.2.105 54511 -> 46.48.223.67 15494 SPA_* 0 0 9 1208 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:26:48.331531 0.000424 tcp 10.0.2.105 54511 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:26:48.332229 2.974921 tcp 10.0.2.105 54512 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:26:57.258968 0.000000 tcp 10.0.2.105 54512 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:31:48.212630 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:31:55.220069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:32:03.222809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:32:19.226677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:32:51.230929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:35:24.281170 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:35:24.281336 0.173886 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:24.451888 0.346167 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:24.797361 0.178415 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.057313 0.207369 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.236714 0.115555 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.336502 0.124037 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.441914 0.185538 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.757445 0.059987 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:25.815511 0.207836 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:26.007828 0.232393 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:26.412528 0.182461 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:26.589711 0.169020 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:26.739076 0.214314 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:26.951002 0.088434 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.085905 0.200468 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.289049 0.128466 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.371089 0.176037 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.586570 0.188559 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.772029 0.089285 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:27.891648 0.382538 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:28.266327 0.168546 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:28.574563 0.024327 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:28.618541 0.237308 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:28.836228 0.081060 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:29.083057 0.445662 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:29.504632 0.188217 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:29.683847 0.350785 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:30.030752 0.191295 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/17 04:35:33.204018 3.004120 tcp 10.0.2.105 54513 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:35:42.206752 0.000000 tcp 10.0.2.105 54513 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:35:48.207995 0.062368 tcp 10.0.2.105 54514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:35:48.270670 0.066401 tcp 10.0.2.105 54515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:35:48.336934 0.164088 tcp 10.0.2.105 54516 -> 195.113.214.249 443 SRPA* 0 0 43 21716 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:35:48.664588 3.005420 tcp 10.0.2.105 54517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:35:57.668867 0.000000 tcp 10.0.2.105 54517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:03.658249 0.061560 tcp 10.0.2.105 54518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:03.720078 0.067818 tcp 10.0.2.105 54519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:03.787670 0.160015 tcp 10.0.2.105 54520 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:04.054450 2.570780 tcp 10.0.2.105 54521 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:05.986529 0.068370 tcp 10.0.2.105 54522 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:06.055192 0.262591 tcp 10.0.2.105 54523 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:06.317809 0.163618 tcp 10.0.2.105 54524 -> 195.113.214.249 443 SRPA* 0 0 33 19150 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:06.625474 3.000622 tcp 10.0.2.105 54525 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:15.624530 0.000000 tcp 10.0.2.105 54525 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:21.623831 0.064626 tcp 10.0.2.105 54526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:21.688714 0.065378 tcp 10.0.2.105 54527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:21.754423 0.159868 tcp 10.0.2.105 54528 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:22.141004 2.997595 tcp 10.0.2.105 54529 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:31.136450 0.000000 tcp 10.0.2.105 54529 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:37.135749 3.003994 tcp 10.0.2.105 54530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:46.138427 0.000000 tcp 10.0.2.105 54530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:36:51.045470 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:36:52.137284 1.914695 tcp 10.0.2.105 54531 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:36:54.052160 2.994251 tcp 10.0.2.105 54532 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:37:03.052729 0.000000 tcp 10.0.2.105 54532 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:38:55.235922 3.002737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:39:02.243972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:39:10.251687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:39:26.248770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:39:58.258547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:42:09.053155 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:42:09.053237 3.004097 tcp 10.0.2.105 54533 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:18.055096 0.000000 tcp 10.0.2.105 54533 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:24.055988 0.062116 tcp 10.0.2.105 54534 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:24.118450 0.139841 tcp 10.0.2.105 54535 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:24.258538 0.154702 tcp 10.0.2.105 54536 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:24.964434 3.006287 tcp 10.0.2.105 54537 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:33.968628 0.000000 tcp 10.0.2.105 54537 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:39.957826 0.063233 tcp 10.0.2.105 54538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:40.021352 0.152599 tcp 10.0.2.105 54539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:40.174279 0.155120 tcp 10.0.2.105 54540 -> 195.113.214.249 443 SRPA* 0 0 25 14108 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:40.757675 2.461151 tcp 10.0.2.105 54541 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:42.722143 0.065596 tcp 10.0.2.105 54542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:42.788017 0.069350 tcp 10.0.2.105 54543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:42.857635 0.164389 tcp 10.0.2.105 54544 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:43.219086 2.996954 tcp 10.0.2.105 54545 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:52.214842 0.000000 tcp 10.0.2.105 54545 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:42:58.219393 0.061164 tcp 10.0.2.105 54546 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:58.280840 0.064934 tcp 10.0.2.105 54547 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:58.346054 0.160126 tcp 10.0.2.105 54548 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:42:58.819340 2.999306 tcp 10.0.2.105 54549 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:43:07.817467 0.000000 tcp 10.0.2.105 54549 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:43:13.816432 3.003712 tcp 10.0.2.105 54550 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:43:22.832855 0.000000 tcp 10.0.2.105 54550 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:43:27.545576 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:43:28.817649 2.049622 tcp 10.0.2.105 54551 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:43:30.867544 2.966744 tcp 10.0.2.105 54552 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:43:39.788238 0.000000 tcp 10.0.2.105 54552 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:46:02.260928 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:46:09.267865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:46:17.269468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:46:33.272813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:47:05.278284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:48:45.763617 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:48:45.763701 3.003774 tcp 10.0.2.105 54553 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:48:54.766139 0.000000 tcp 10.0.2.105 54553 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:49:00.766810 0.067171 tcp 10.0.2.105 54554 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:00.834265 0.064412 tcp 10.0.2.105 54555 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:00.898986 0.157867 tcp 10.0.2.105 54556 -> 195.113.214.249 443 SRPA* 0 0 41 22422 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:01.277941 3.001819 tcp 10.0.2.105 54557 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:49:10.278219 0.000000 tcp 10.0.2.105 54557 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:49:16.267648 0.067802 tcp 10.0.2.105 54558 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:16.335777 0.063103 tcp 10.0.2.105 54559 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:16.399141 0.201365 tcp 10.0.2.105 54560 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:16.934340 0.670610 tcp 10.0.2.105 54561 -> 46.48.223.67 15494 SPA_* 0 0 9 1051 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:36.605727 0.481594 tcp 10.0.2.105 54561 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:36.606756 0.062546 tcp 10.0.2.105 54562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:36.669601 0.068763 tcp 10.0.2.105 54563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:36.738636 0.160247 tcp 10.0.2.105 54564 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:37.087550 2.975920 tcp 10.0.2.105 54565 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:49:46.001551 0.000000 tcp 10.0.2.105 54565 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:49:52.000689 0.128134 tcp 10.0.2.105 54566 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:52.129158 0.067465 tcp 10.0.2.105 54567 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:52.196958 0.164826 tcp 10.0.2.105 54568 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:49:52.502128 2.976269 tcp 10.0.2.105 54569 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:50:01.452032 0.000000 tcp 10.0.2.105 54569 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:50:07.441026 2.993731 tcp 10.0.2.105 54570 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:50:16.433651 0.000000 tcp 10.0.2.105 54570 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:50:21.050499 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:50:22.442201 0.393774 tcp 10.0.2.105 54571 -> 46.48.223.67 15494 SPA_* 0 0 9 1051 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:50:42.011684 0.000686 tcp 10.0.2.105 54571 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:50:42.012138 2.991863 tcp 10.0.2.105 54572 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:50:51.002721 0.000000 tcp 10.0.2.105 54572 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:53:09.285710 3.000344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 04:53:16.291980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:53:24.293735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:53:40.296607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:54:12.303193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 04:55:57.013751 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:55:57.013835 3.003631 tcp 10.0.2.105 54573 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:06.016089 0.000000 tcp 10.0.2.105 54573 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:12.016790 0.063819 tcp 10.0.2.105 54574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:12.080952 0.064866 tcp 10.0.2.105 54575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:12.146121 0.155307 tcp 10.0.2.105 54576 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:12.590848 2.999187 tcp 10.0.2.105 54577 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:21.588661 0.000000 tcp 10.0.2.105 54577 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:27.590317 0.064345 tcp 10.0.2.105 54578 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:27.654997 0.065476 tcp 10.0.2.105 54579 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:27.720768 0.152597 tcp 10.0.2.105 54580 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:28.175851 0.376706 tcp 10.0.2.105 54581 -> 46.48.223.67 15494 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:40.022001 0.468236 tcp 10.0.2.105 54581 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:40.022963 0.064268 tcp 10.0.2.105 54582 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:40.087541 0.136155 tcp 10.0.2.105 54583 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:40.223972 0.160475 tcp 10.0.2.105 54584 -> 195.113.214.249 443 SRPA* 0 0 21 10308 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:40.490462 2.999582 tcp 10.0.2.105 54585 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:49.488496 0.000000 tcp 10.0.2.105 54585 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:56:55.487795 0.069141 tcp 10.0.2.105 54586 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:55.557379 0.063262 tcp 10.0.2.105 54587 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:55.620900 0.160041 tcp 10.0.2.105 54588 -> 195.113.214.249 443 SRPA* 0 0 48 24470 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:56:56.381374 3.001487 tcp 10.0.2.105 54589 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:57:05.391422 0.000000 tcp 10.0.2.105 54589 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:57:11.380421 2.993891 tcp 10.0.2.105 54590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:57:20.373133 0.000000 tcp 10.0.2.105 54590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:57:25.049652 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 04:57:26.381931 0.384754 tcp 10.0.2.105 54591 -> 46.48.223.67 15494 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:57:37.983939 0.000489 tcp 10.0.2.105 54591 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 04:57:37.984638 3.008137 tcp 10.0.2.105 54592 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 04:57:46.991085 0.000000 tcp 10.0.2.105 54592 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:00:16.309156 3.003550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:00:23.316015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:00:31.317598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:00:47.320672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:01:19.328730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:05:57.376903 0.117842 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:05:57.494871 0.176417 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:57.667984 0.353922 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:58.516412 0.189563 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 1996 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:59.282086 0.187372 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:59.442242 0.109305 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2030 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:59.704870 0.060263 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:59.762523 0.254646 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:05:59.972620 0.125666 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:00.160607 0.184210 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:00.317379 0.240713 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:00.641574 0.183967 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:00.821158 0.168923 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:00.969470 0.214321 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:01.180640 0.093195 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:01.474474 0.204387 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:01.714302 0.128741 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:02.035195 0.085420 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:02.104348 0.356274 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:02.433699 0.178364 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:02.608568 0.190416 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:02.796304 0.198918 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:03.519200 0.030506 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:03.550669 0.264462 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:03.795643 0.081350 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:04.093305 0.355750 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:05.249167 0.494868 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:05.721957 0.188974 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:05.904493 0.191659 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:06:08.043700 2.966611 tcp 10.0.2.105 54593 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:06:16.995877 0.000000 tcp 10.0.2.105 54593 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:06:21.554611 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:06:23.004926 0.063461 tcp 10.0.2.105 54594 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:23.068678 0.068419 tcp 10.0.2.105 54595 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:23.137443 0.165326 tcp 10.0.2.105 54596 -> 195.113.214.249 443 SRPA* 0 0 27 11062 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:23.772758 3.009629 tcp 10.0.2.105 54597 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:06:32.777346 0.000000 tcp 10.0.2.105 54597 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:06:38.766526 0.063362 tcp 10.0.2.105 54598 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:38.830184 0.063150 tcp 10.0.2.105 54599 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:38.893622 0.156878 tcp 10.0.2.105 54600 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:39.635314 0.391345 tcp 10.0.2.105 54601 -> 46.48.223.67 15494 SPA_* 0 0 9 1164 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:45.239434 0.388948 tcp 10.0.2.105 54601 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:45.240362 0.061859 tcp 10.0.2.105 54602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:45.302500 0.063325 tcp 10.0.2.105 54603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:45.366085 0.162099 tcp 10.0.2.105 54604 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:06:45.628713 3.003903 tcp 10.0.2.105 54605 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:06:54.629432 0.000000 tcp 10.0.2.105 54605 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:00.628109 0.065230 tcp 10.0.2.105 54606 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:07:00.693644 0.062074 tcp 10.0.2.105 54607 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:07:00.755655 0.162438 tcp 10.0.2.105 54608 -> 195.113.214.249 443 SRPA* 0 0 22 12876 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:07:01.113916 2.998726 tcp 10.0.2.105 54609 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:10.114311 0.000000 tcp 10.0.2.105 54609 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:16.109849 2.993872 tcp 10.0.2.105 54610 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:23.332170 3.001946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:07:25.112622 0.000000 tcp 10.0.2.105 54610 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:30.049553 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:07:30.340361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:07:31.111603 1.885496 tcp 10.0.2.105 54611 -> 46.48.223.67 15494 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:07:32.997381 3.000832 tcp 10.0.2.105 54612 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:38.341478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:07:41.996839 0.000000 tcp 10.0.2.105 54612 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:07:54.344817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:08:26.350893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:12:47.997233 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:12:47.997337 3.003889 tcp 10.0.2.105 54613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:12:56.999790 0.000000 tcp 10.0.2.105 54613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:03.000541 0.069408 tcp 10.0.2.105 54614 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:03.070275 0.064804 tcp 10.0.2.105 54615 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:03.135362 0.151938 tcp 10.0.2.105 54616 -> 195.113.214.249 443 SRPA* 0 0 27 15012 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:03.463132 3.000220 tcp 10.0.2.105 54617 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:12.472679 0.000000 tcp 10.0.2.105 54617 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:18.461504 0.100505 tcp 10.0.2.105 54618 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:18.562298 0.061057 tcp 10.0.2.105 54619 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:18.623706 0.181938 tcp 10.0.2.105 54620 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:19.075962 2.366384 tcp 10.0.2.105 54621 -> 46.48.223.67 15494 FSPA* 0 0 12 1573 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:20.975354 0.062510 tcp 10.0.2.105 54622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:21.038199 0.063980 tcp 10.0.2.105 54623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:21.102442 0.163572 tcp 10.0.2.105 54624 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:21.442591 2.998044 tcp 10.0.2.105 54625 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:30.437746 0.000000 tcp 10.0.2.105 54625 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:36.436802 0.142212 tcp 10.0.2.105 54626 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:36.579293 0.070268 tcp 10.0.2.105 54627 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:36.649813 0.162469 tcp 10.0.2.105 54628 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:13:37.110049 3.001568 tcp 10.0.2.105 54629 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:46.114700 0.000000 tcp 10.0.2.105 54629 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:13:52.109120 3.003559 tcp 10.0.2.105 54630 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:14:01.164118 0.000000 tcp 10.0.2.105 54630 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:14:06.062809 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:14:07.116882 0.383344 tcp 10.0.2.105 54631 -> 46.48.223.67 15494 SPA_* 0 0 9 1151 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:14:19.591820 0.000344 tcp 10.0.2.105 54631 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:14:19.592438 3.000503 tcp 10.0.2.105 54632 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:14:28.602787 0.000000 tcp 10.0.2.105 54632 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:14:30.356331 3.001968 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:14:37.364036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:14:45.368699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:15:01.369400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:15:33.374723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:19:34.591891 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:19:34.592000 2.993584 tcp 10.0.2.105 54633 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:19:43.584063 0.000000 tcp 10.0.2.105 54633 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:19:49.594918 0.064449 tcp 10.0.2.105 54634 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:19:49.659593 0.064114 tcp 10.0.2.105 54635 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:19:49.723985 0.171742 tcp 10.0.2.105 54636 -> 195.113.214.249 443 SRPA* 0 0 25 13876 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:19:50.257921 3.000351 tcp 10.0.2.105 54637 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:19:59.256443 0.000000 tcp 10.0.2.105 54637 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:05.256241 0.064557 tcp 10.0.2.105 54638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:05.321056 0.061487 tcp 10.0.2.105 54639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:05.382887 0.164989 tcp 10.0.2.105 54640 -> 195.113.214.249 443 SRPA* 0 0 41 34792 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:05.850324 0.385828 tcp 10.0.2.105 54641 -> 46.48.223.67 15494 SPA_* 0 0 9 1047 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:10.985013 0.808048 tcp 10.0.2.105 54641 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:10.985900 0.063247 tcp 10.0.2.105 54642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:11.049406 0.063575 tcp 10.0.2.105 54643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:11.113326 0.157782 tcp 10.0.2.105 54644 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:11.793284 3.005980 tcp 10.0.2.105 54645 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:20.797820 0.000000 tcp 10.0.2.105 54645 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:26.787423 0.060520 tcp 10.0.2.105 54646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:26.848439 0.150800 tcp 10.0.2.105 54647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:26.999555 0.168797 tcp 10.0.2.105 54648 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:27.179769 3.001466 tcp 10.0.2.105 54649 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:36.179795 0.000000 tcp 10.0.2.105 54649 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:42.178897 3.500141 tcp 10.0.2.105 54650 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:51.612353 0.000000 tcp 10.0.2.105 54650 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:20:56.408127 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:20:57.537233 1.905635 tcp 10.0.2.105 54651 -> 46.48.223.67 15494 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:20:59.443102 2.953387 tcp 10.0.2.105 54652 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:21:08.322538 0.000000 tcp 10.0.2.105 54652 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:21:37.380714 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:21:44.387865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:21:52.389559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:22:08.687646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:22:40.408851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:26:14.117037 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:26:14.117266 3.002735 tcp 10.0.2.105 54653 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:26:23.118812 0.000000 tcp 10.0.2.105 54653 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:26:29.119092 0.061834 tcp 10.0.2.105 54654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:29.181217 0.065484 tcp 10.0.2.105 54655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:29.247037 0.163295 tcp 10.0.2.105 54656 -> 195.113.214.249 443 SRPA* 0 0 52 34250 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:29.829768 3.002928 tcp 10.0.2.105 54657 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:26:38.831315 0.000000 tcp 10.0.2.105 54657 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:26:44.830553 0.061584 tcp 10.0.2.105 54658 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:44.892464 0.066016 tcp 10.0.2.105 54659 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:44.958743 0.163735 tcp 10.0.2.105 54660 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:45.232171 2.965481 tcp 10.0.2.105 54661 -> 46.48.223.67 15494 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:47.877402 0.067898 tcp 10.0.2.105 54662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:47.945596 0.062387 tcp 10.0.2.105 54663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:48.008271 0.154408 tcp 10.0.2.105 54664 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:26:48.197875 3.001319 tcp 10.0.2.105 54665 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:26:57.197834 0.000000 tcp 10.0.2.105 54665 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:03.196610 0.062556 tcp 10.0.2.105 54666 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:27:03.259039 0.064569 tcp 10.0.2.105 54667 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:27:03.323896 0.190846 tcp 10.0.2.105 54668 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:27:03.733407 3.008190 tcp 10.0.2.105 54669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:12.742602 0.000000 tcp 10.0.2.105 54669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:18.728833 3.004145 tcp 10.0.2.105 54670 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:27.741741 0.000000 tcp 10.0.2.105 54670 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:32.550591 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:27:33.730282 1.932380 tcp 10.0.2.105 54671 -> 46.48.223.67 15494 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:27:35.662914 3.004306 tcp 10.0.2.105 54672 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:27:44.666065 0.000000 tcp 10.0.2.105 54672 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:28:44.414494 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:28:51.423906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:28:59.423617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:29:15.426389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:29:47.432247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:35:51.438942 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 05:35:58.446249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:36:06.447431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:36:11.104695 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:36:11.104839 0.170444 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:11.271876 0.196690 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:11.475226 0.345800 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.164621 0.181034 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.342668 0.111148 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2588 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.417414 0.058394 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.618153 0.206171 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.810905 0.123974 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:12.916510 0.186767 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:13.081180 0.235813 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:13.306316 0.186807 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:13.717733 0.169615 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:13.867898 0.224844 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:14.628845 0.086253 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:14.676810 0.199491 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:14.905354 0.126891 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:14.988577 0.138986 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:15.195830 0.193166 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:15.475094 0.353748 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 1952 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:15.802421 0.176885 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:16.192648 0.178194 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:16.316839 0.020762 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:16.446026 0.239609 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:16.749869 0.087947 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:16.817958 0.352301 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:17.376617 0.190170 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:17.559325 0.440453 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:17.978946 0.186014 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/17 05:36:20.694477 3.161954 tcp 10.0.2.105 54673 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:36:22.456829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:36:29.795850 0.000000 tcp 10.0.2.105 54673 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:36:35.741860 0.060795 tcp 10.0.2.105 54674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:35.802957 0.060854 tcp 10.0.2.105 54675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:35.864124 0.166928 tcp 10.0.2.105 54676 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:36.111608 2.970987 tcp 10.0.2.105 54677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:36:45.072889 0.000000 tcp 10.0.2.105 54677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:36:51.445854 0.065541 tcp 10.0.2.105 54678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:51.511662 0.064060 tcp 10.0.2.105 54679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:51.576006 0.155405 tcp 10.0.2.105 54680 -> 195.113.214.249 443 SRPA* 0 0 21 13034 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:52.110842 2.676611 tcp 10.0.2.105 54681 -> 46.48.223.67 15494 FSPA* 0 0 14 1743 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:53.996102 0.069786 tcp 10.0.2.105 54682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:54.066185 0.064881 tcp 10.0.2.105 54683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:54.131365 0.252438 tcp 10.0.2.105 54684 -> 195.113.214.249 443 SRPA* 0 0 42 21624 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:36:54.787531 2.978113 tcp 10.0.2.105 54685 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:36:54.814961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:37:03.707295 0.000000 tcp 10.0.2.105 54685 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:37:09.647923 0.070575 tcp 10.0.2.105 54686 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:37:09.718817 0.069169 tcp 10.0.2.105 54687 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:37:09.788283 0.153840 tcp 10.0.2.105 54688 -> 195.113.214.249 443 SRPA* 0 0 25 13876 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:37:10.266390 2.973678 tcp 10.0.2.105 54689 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:37:19.197944 0.000000 tcp 10.0.2.105 54689 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:37:25.131555 2.964892 tcp 10.0.2.105 54690 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:37:34.053457 0.000000 tcp 10.0.2.105 54690 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:37:39.050617 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:37:40.062411 0.376268 tcp 10.0.2.105 54691 -> 46.48.223.67 15494 SPA_* 0 0 9 1213 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:37:52.959530 1.851194 tcp 10.0.2.105 54691 -> 46.48.223.67 15494 FA_F* 0 0 6 844 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:37:54.810575 2.997125 tcp 10.0.2.105 54692 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:38:03.805800 0.000000 tcp 10.0.2.105 54692 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:42:58.472825 3.000904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:43:05.479832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:43:09.806646 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:43:09.806779 3.003534 tcp 10.0.2.105 54693 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:13.481421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:43:18.810687 0.000000 tcp 10.0.2.105 54693 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:24.810882 0.075163 tcp 10.0.2.105 54694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:24.886325 0.066490 tcp 10.0.2.105 54695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:24.953072 0.196235 tcp 10.0.2.105 54696 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:25.409555 3.003197 tcp 10.0.2.105 54697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:29.484576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:43:34.421706 0.000000 tcp 10.0.2.105 54697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:40.410591 0.067231 tcp 10.0.2.105 54698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:40.478069 0.063661 tcp 10.0.2.105 54699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:40.542022 0.162942 tcp 10.0.2.105 54700 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:40.726612 2.625778 tcp 10.0.2.105 54701 -> 46.48.223.67 15494 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:42.631437 0.066808 tcp 10.0.2.105 54702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:42.698538 0.063530 tcp 10.0.2.105 54703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:42.762420 0.186608 tcp 10.0.2.105 54704 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:43.352639 2.996294 tcp 10.0.2.105 54705 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:52.347319 0.000000 tcp 10.0.2.105 54705 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:43:58.346716 0.060540 tcp 10.0.2.105 54706 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:58.407504 0.065839 tcp 10.0.2.105 54707 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:58.473663 0.274922 tcp 10.0.2.105 54708 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:43:59.044068 3.007121 tcp 10.0.2.105 54709 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:44:01.490643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:44:08.049878 0.000000 tcp 10.0.2.105 54709 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:44:14.038892 3.003854 tcp 10.0.2.105 54710 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:44:23.052120 0.000000 tcp 10.0.2.105 54710 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:44:28.048779 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:44:29.040137 1.918911 tcp 10.0.2.105 54711 -> 46.48.223.67 15494 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:44:30.959235 2.998054 tcp 10.0.2.105 54712 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:44:39.955584 0.000000 tcp 10.0.2.105 54712 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:49:45.955987 0.121325 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:49:46.077485 2.964031 tcp 10.0.2.105 54713 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:49:54.990555 0.000000 tcp 10.0.2.105 54713 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:00.978753 0.066887 tcp 10.0.2.105 54714 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:01.045714 0.062094 tcp 10.0.2.105 54715 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:01.108100 0.166060 tcp 10.0.2.105 54716 -> 195.113.214.249 443 SRPA* 0 0 38 32998 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:01.614758 3.008075 tcp 10.0.2.105 54717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:10.621350 0.000000 tcp 10.0.2.105 54717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:16.610574 0.062786 tcp 10.0.2.105 54718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:16.673662 0.081286 tcp 10.0.2.105 54719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:16.754782 0.151781 tcp 10.0.2.105 54720 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:17.053006 3.292451 tcp 10.0.2.105 54721 -> 46.48.223.67 15494 FSPA* 0 0 14 1525 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:19.271283 0.061097 tcp 10.0.2.105 54722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:19.332741 0.062137 tcp 10.0.2.105 54723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:19.395154 0.178267 tcp 10.0.2.105 54724 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:20.345747 3.003917 tcp 10.0.2.105 54725 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:29.348020 0.000000 tcp 10.0.2.105 54725 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:35.347291 0.103371 tcp 10.0.2.105 54726 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:35.450935 0.067324 tcp 10.0.2.105 54727 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:35.518562 0.154853 tcp 10.0.2.105 54728 -> 195.113.214.249 443 SRPA* 0 0 36 27022 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:50:35.712068 2.999428 tcp 10.0.2.105 54729 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:44.710126 0.000000 tcp 10.0.2.105 54729 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:50.708828 3.004022 tcp 10.0.2.105 54730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:50:59.761303 0.000000 tcp 10.0.2.105 54730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:51:04.549023 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:51:05.710360 1.893340 tcp 10.0.2.105 54731 -> 46.48.223.67 15494 FSPA* 0 0 12 1417 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:51:07.603925 3.003621 tcp 10.0.2.105 54732 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:51:16.606159 0.000000 tcp 10.0.2.105 54732 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:55:38.505059 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 05:55:45.512767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:55:53.513904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:56:09.520842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:56:22.606775 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:56:22.606860 3.006500 tcp 10.0.2.105 54733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:56:31.609005 0.000000 tcp 10.0.2.105 54733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:56:37.609391 0.063741 tcp 10.0.2.105 54734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:37.673415 0.068044 tcp 10.0.2.105 54735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:37.741743 0.162745 tcp 10.0.2.105 54736 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:38.086971 3.005629 tcp 10.0.2.105 54737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:56:41.523044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 05:56:47.092681 0.000000 tcp 10.0.2.105 54737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:56:53.080554 0.060678 tcp 10.0.2.105 54738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:53.141505 0.064615 tcp 10.0.2.105 54739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:53.206503 0.162454 tcp 10.0.2.105 54740 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:56:53.571138 0.385654 tcp 10.0.2.105 54741 -> 46.48.223.67 15494 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:00.452068 0.326023 tcp 10.0.2.105 54741 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:00.453044 0.062118 tcp 10.0.2.105 54742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:00.515474 0.066036 tcp 10.0.2.105 54743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:00.581332 0.169737 tcp 10.0.2.105 54744 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:00.778406 2.999635 tcp 10.0.2.105 54745 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:09.777863 0.000000 tcp 10.0.2.105 54745 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:15.773146 0.063711 tcp 10.0.2.105 54746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:15.837243 0.070216 tcp 10.0.2.105 54747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:15.907808 0.152108 tcp 10.0.2.105 54748 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:57:16.565458 3.002390 tcp 10.0.2.105 54749 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:25.566625 0.000000 tcp 10.0.2.105 54749 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:31.565336 3.004073 tcp 10.0.2.105 54750 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:39.546723 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 05:57:40.567993 0.000000 tcp 10.0.2.105 54750 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:57:46.566816 0.379436 tcp 10.0.2.105 54751 -> 46.48.223.67 15494 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:58:04.790217 0.000343 tcp 10.0.2.105 54751 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 05:58:04.790785 2.996372 tcp 10.0.2.105 54752 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 05:58:13.789414 0.000000 tcp 10.0.2.105 54752 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:02:45.529642 3.001021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:02:52.536726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:03:00.538040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:03:16.545017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:03:48.546967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:06:35.047051 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:06:35.047162 0.173491 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:35.216908 0.179461 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:36.053293 0.188604 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:36.405311 0.345701 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:37.316718 0.109103 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:37.395159 0.065629 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:37.584949 0.660848 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:38.541980 0.123420 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:38.782540 0.185164 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:38.946978 0.237810 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:39.176878 0.216129 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:39.390773 0.182650 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:39.569136 0.169551 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:39.970343 0.090843 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:40.022103 0.199611 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:40.806526 0.139457 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:40.901008 0.086444 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:41.504994 0.186913 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:42.218519 0.164093 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:42.338382 0.363824 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:42.761360 0.176808 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:42.934560 0.023430 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:43.241422 0.243362 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:43.465195 0.083616 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:43.739059 0.353092 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:44.115383 0.187354 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:44.295088 0.190631 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:44.534902 0.450463 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:06:50.145657 2.982964 tcp 10.0.2.105 54753 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:06:59.070139 0.000000 tcp 10.0.2.105 54753 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:03.762606 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:07:05.019099 0.061934 tcp 10.0.2.105 54754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:05.081557 0.062164 tcp 10.0.2.105 54755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:05.144029 0.151288 tcp 10.0.2.105 54756 -> 195.113.214.249 443 SRPA* 0 0 23 12308 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:05.568337 2.973974 tcp 10.0.2.105 54757 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:14.507062 0.000000 tcp 10.0.2.105 54757 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:20.441739 0.062388 tcp 10.0.2.105 54758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:20.503897 0.094757 tcp 10.0.2.105 54759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:20.598482 0.162379 tcp 10.0.2.105 54760 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:21.104086 2.984997 tcp 10.0.2.105 54761 -> 46.48.223.67 15494 FSPA* 0 0 12 1451 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:23.759271 0.066936 tcp 10.0.2.105 54762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:23.826510 0.065805 tcp 10.0.2.105 54763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:23.892631 0.156118 tcp 10.0.2.105 54764 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:24.089444 2.977833 tcp 10.0.2.105 54765 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:33.049985 0.000000 tcp 10.0.2.105 54765 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:39.050526 0.066018 tcp 10.0.2.105 54766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:39.116861 0.097727 tcp 10.0.2.105 54767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:39.214893 1.205616 tcp 10.0.2.105 54768 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:07:40.575225 3.001770 tcp 10.0.2.105 54769 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:50.198726 0.000000 tcp 10.0.2.105 54769 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:07:56.772312 2.960165 tcp 10.0.2.105 54770 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:08:04.669629 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:08:05.667338 0.000000 tcp 10.0.2.105 54770 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:08:11.611516 0.387543 tcp 10.0.2.105 54771 -> 46.48.223.67 15494 SPA_* 0 0 9 1029 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:08:20.001962 0.000360 tcp 10.0.2.105 54771 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:08:20.002550 2.975742 tcp 10.0.2.105 54772 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:08:33.167441 0.000000 tcp 10.0.2.105 54772 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:10:20.194464 2.964796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:10:27.109016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:10:35.000763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:10:50.803068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:11:22.377189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:13:35.064232 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:13:35.064339 2.952177 tcp 10.0.2.105 54773 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:13:43.948622 0.000000 tcp 10.0.2.105 54773 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:13:49.867907 0.064526 tcp 10.0.2.105 54774 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:13:49.932722 0.066653 tcp 10.0.2.105 54775 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:13:49.999690 0.158967 tcp 10.0.2.105 54776 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:13:50.770048 2.955256 tcp 10.0.2.105 54777 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:13:59.649156 0.000000 tcp 10.0.2.105 54777 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:05.573457 0.061704 tcp 10.0.2.105 54778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:05.635443 0.068384 tcp 10.0.2.105 54779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:05.704100 0.173737 tcp 10.0.2.105 54780 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:06.090549 2.884037 tcp 10.0.2.105 54781 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:08.041799 0.388176 tcp 10.0.2.105 54782 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:08.430270 0.061784 tcp 10.0.2.105 54783 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:08.492383 0.165105 tcp 10.0.2.105 54784 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:08.974844 2.972361 tcp 10.0.2.105 54785 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:17.861960 0.000000 tcp 10.0.2.105 54785 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:23.770048 0.060706 tcp 10.0.2.105 54786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:23.831026 0.063232 tcp 10.0.2.105 54787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:23.894507 0.179766 tcp 10.0.2.105 54788 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:24.455052 2.959588 tcp 10.0.2.105 54789 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:33.330299 0.000000 tcp 10.0.2.105 54789 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:39.251143 2.965488 tcp 10.0.2.105 54790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:48.136445 0.000000 tcp 10.0.2.105 54790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:14:53.051919 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:14:54.124555 2.866296 tcp 10.0.2.105 54791 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:14:56.991055 3.001651 tcp 10.0.2.105 54792 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:15:05.990994 0.000000 tcp 10.0.2.105 54792 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:17:23.581647 3.001902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:17:30.589193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:17:38.590628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:17:54.593488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:18:26.599819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:20:11.991822 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:20:11.991914 2.993402 tcp 10.0.2.105 54793 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:20:20.984126 0.000000 tcp 10.0.2.105 54793 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:20:26.994538 0.065848 tcp 10.0.2.105 54794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:27.060688 0.066244 tcp 10.0.2.105 54795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:27.127253 0.151246 tcp 10.0.2.105 54796 -> 195.113.214.249 443 SRPA* 0 0 34 18154 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:27.698289 2.999715 tcp 10.0.2.105 54797 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:20:36.696877 0.000000 tcp 10.0.2.105 54797 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:20:42.695772 0.066762 tcp 10.0.2.105 54798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:42.762382 0.062493 tcp 10.0.2.105 54799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:42.825166 0.175528 tcp 10.0.2.105 54800 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:20:43.153233 0.953541 tcp 10.0.2.105 54801 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:04.988024 1.041603 tcp 10.0.2.105 54801 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:04.988853 0.064873 tcp 10.0.2.105 54802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:05.053999 0.063888 tcp 10.0.2.105 54803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:05.118227 0.150160 tcp 10.0.2.105 54804 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:05.646450 2.975920 tcp 10.0.2.105 54805 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:14.550969 0.000000 tcp 10.0.2.105 54805 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:20.468921 0.064753 tcp 10.0.2.105 54806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:20.533975 0.061499 tcp 10.0.2.105 54807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:20.595770 0.155194 tcp 10.0.2.105 54808 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:21:21.573182 2.960126 tcp 10.0.2.105 54809 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:30.460812 0.000000 tcp 10.0.2.105 54809 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:36.442428 2.994520 tcp 10.0.2.105 54810 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:44.053424 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:21:45.435485 0.000000 tcp 10.0.2.105 54810 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:21:51.568018 0.636800 tcp 10.0.2.105 54811 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:22:03.617383 0.000350 tcp 10.0.2.105 54811 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:22:03.617934 2.987877 tcp 10.0.2.105 54812 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:22:12.604391 0.000000 tcp 10.0.2.105 54812 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:24:30.606130 3.001202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:24:37.613183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:24:45.614767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:25:01.617809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:25:33.623622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:27:18.605332 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:27:18.605443 3.003319 tcp 10.0.2.105 54813 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:27:27.607454 0.000000 tcp 10.0.2.105 54813 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:27:33.607635 0.068126 tcp 10.0.2.105 54814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:33.676026 0.065582 tcp 10.0.2.105 54815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:33.741882 0.253612 tcp 10.0.2.105 54816 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:34.019226 3.005482 tcp 10.0.2.105 54817 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:27:43.019456 0.000000 tcp 10.0.2.105 54817 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:27:49.018794 0.106019 tcp 10.0.2.105 54818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:49.125115 0.062522 tcp 10.0.2.105 54819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:49.187923 0.162832 tcp 10.0.2.105 54820 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:49.393344 0.388432 tcp 10.0.2.105 54821 -> 46.48.223.67 15494 SPA_* 0 0 9 1137 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:55.172266 0.367378 tcp 10.0.2.105 54821 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:55.173017 0.064327 tcp 10.0.2.105 54822 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:55.237569 0.066068 tcp 10.0.2.105 54823 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:55.303496 0.159919 tcp 10.0.2.105 54824 -> 195.113.214.249 443 SRPA* 0 0 47 24776 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:27:55.539817 3.002154 tcp 10.0.2.105 54825 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:04.540763 0.000000 tcp 10.0.2.105 54825 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:10.539843 0.062068 tcp 10.0.2.105 54826 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:28:10.602224 0.064545 tcp 10.0.2.105 54827 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:28:10.667070 0.162487 tcp 10.0.2.105 54828 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:28:11.171116 2.992971 tcp 10.0.2.105 54829 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:20.173165 0.000000 tcp 10.0.2.105 54829 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:26.171460 2.994458 tcp 10.0.2.105 54830 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:35.164593 0.000000 tcp 10.0.2.105 54830 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:28:40.051844 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:28:41.173333 0.384598 tcp 10.0.2.105 54831 -> 46.48.223.67 15494 SPA_* 0 0 9 1137 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:28:53.907483 0.667429 tcp 10.0.2.105 54831 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:28:54.575154 3.001448 tcp 10.0.2.105 54832 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:29:03.575475 0.000000 tcp 10.0.2.105 54832 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:31:37.629940 3.001312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:31:44.636901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:31:52.638942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:32:08.641367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:32:40.647635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:36:45.449729 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:36:45.449829 0.220839 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:45.885496 0.188086 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:46.125265 0.185400 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:46.285411 0.059775 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:46.362512 0.204630 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:46.554080 0.348832 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:47.124878 0.112464 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:47.393005 0.125988 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:47.663254 0.184852 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:47.825563 0.234237 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.052696 0.215901 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.265929 0.082936 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.407265 0.182174 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.584888 0.170773 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.733539 0.200854 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:48.989727 0.124152 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:49.273066 0.084903 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:49.344664 0.353810 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:49.669688 0.175523 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:49.958732 0.187147 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:50.142471 0.199503 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:50.273627 0.023007 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:50.532800 0.256369 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:50.843873 0.082890 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:50.906023 0.186945 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:51.119478 0.349841 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:51.465160 0.184022 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:51.642303 0.445935 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/17 06:36:54.593114 3.004138 tcp 10.0.2.105 54833 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:03.595572 0.000000 tcp 10.0.2.105 54833 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:09.598974 0.063351 tcp 10.0.2.105 54834 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:09.662677 0.384937 tcp 10.0.2.105 54835 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:10.047915 0.156552 tcp 10.0.2.105 54836 -> 195.113.214.249 443 SRPA* 0 0 44 21082 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:10.346467 3.003325 tcp 10.0.2.105 54837 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:19.348464 0.000000 tcp 10.0.2.105 54837 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:25.394568 0.065257 tcp 10.0.2.105 54838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:25.459706 0.062111 tcp 10.0.2.105 54839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:25.522177 0.218002 tcp 10.0.2.105 54840 -> 195.113.214.249 443 SRPA* 0 0 72 78370 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:25.891858 2.419543 tcp 10.0.2.105 54841 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:27.830797 0.065531 tcp 10.0.2.105 54842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:27.896719 0.067867 tcp 10.0.2.105 54843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:27.964909 0.162742 tcp 10.0.2.105 54844 -> 195.113.214.249 443 SRPA* 0 0 50 39160 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:28.311635 2.972222 tcp 10.0.2.105 54845 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:37.273846 0.000000 tcp 10.0.2.105 54845 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:43.273253 0.064263 tcp 10.0.2.105 54846 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:43.337779 0.064938 tcp 10.0.2.105 54847 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:43.402935 0.160717 tcp 10.0.2.105 54848 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:37:43.977426 3.000771 tcp 10.0.2.105 54849 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:52.976746 0.000000 tcp 10.0.2.105 54849 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:37:58.982097 2.997974 tcp 10.0.2.105 54850 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:38:07.978257 0.000000 tcp 10.0.2.105 54850 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:38:12.544760 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:38:13.977155 2.542720 tcp 10.0.2.105 54851 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:38:16.519201 2.995684 tcp 10.0.2.105 54852 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:38:25.513897 0.000000 tcp 10.0.2.105 54852 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:38:44.657458 2.997827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:38:51.666476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:38:59.662709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:39:15.665507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:39:47.671474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:43:31.513864 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:43:31.514104 3.003480 tcp 10.0.2.105 54853 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:43:40.516472 0.000000 tcp 10.0.2.105 54853 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:43:46.517161 0.066789 tcp 10.0.2.105 54854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:43:46.584236 0.067099 tcp 10.0.2.105 54855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:43:46.651605 0.159310 tcp 10.0.2.105 54856 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:43:47.047664 3.003335 tcp 10.0.2.105 54857 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:43:56.048789 0.000000 tcp 10.0.2.105 54857 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:44:02.048126 0.060557 tcp 10.0.2.105 54858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:02.108979 0.067940 tcp 10.0.2.105 54859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:02.177238 0.163060 tcp 10.0.2.105 54860 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:02.662836 0.386748 tcp 10.0.2.105 54861 -> 46.48.223.67 15494 SPA_* 0 0 9 1027 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:20.467975 1.060858 tcp 10.0.2.105 54861 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:20.468896 0.067021 tcp 10.0.2.105 54862 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:20.536434 0.062100 tcp 10.0.2.105 54863 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:20.598875 0.170934 tcp 10.0.2.105 54864 -> 195.113.214.249 443 SRPA* 0 0 35 18594 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:21.529127 3.000439 tcp 10.0.2.105 54865 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:44:30.528163 0.000000 tcp 10.0.2.105 54865 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:44:36.527174 0.063488 tcp 10.0.2.105 54866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:36.590974 0.062977 tcp 10.0.2.105 54867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:36.654288 0.162099 tcp 10.0.2.105 54868 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:44:37.083334 3.008631 tcp 10.0.2.105 54869 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:44:46.091040 0.000000 tcp 10.0.2.105 54869 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:44:52.079539 2.999474 tcp 10.0.2.105 54870 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:45:01.082074 0.000000 tcp 10.0.2.105 54870 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:45:06.049258 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:45:07.081035 1.932351 tcp 10.0.2.105 54871 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:45:09.013078 3.004867 tcp 10.0.2.105 54872 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:45:18.016567 0.000000 tcp 10.0.2.105 54872 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:45:51.677795 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:45:58.684488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:46:06.686175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:46:22.689502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:46:54.695368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:50:24.017073 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:50:24.017226 3.005341 tcp 10.0.2.105 54873 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:50:33.019539 0.000000 tcp 10.0.2.105 54873 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:50:39.020170 0.060935 tcp 10.0.2.105 54874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:39.081391 0.068000 tcp 10.0.2.105 54875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:39.149668 0.161773 tcp 10.0.2.105 54876 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:39.699502 2.993596 tcp 10.0.2.105 54877 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:50:48.703550 0.000000 tcp 10.0.2.105 54877 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:50:54.691413 0.062504 tcp 10.0.2.105 54878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:54.754208 0.066587 tcp 10.0.2.105 54879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:54.821061 0.249921 tcp 10.0.2.105 54880 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:50:55.117019 1.388952 tcp 10.0.2.105 54881 -> 46.48.223.67 15494 SPA_* 0 0 9 1141 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:01.057039 0.743694 tcp 10.0.2.105 54881 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:01.057901 0.060346 tcp 10.0.2.105 54882 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:01.118541 0.065949 tcp 10.0.2.105 54883 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:01.184869 0.158284 tcp 10.0.2.105 54884 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:01.801000 2.993888 tcp 10.0.2.105 54885 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:10.793576 0.000000 tcp 10.0.2.105 54885 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:16.803357 0.060133 tcp 10.0.2.105 54886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:16.863878 0.064580 tcp 10.0.2.105 54887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:16.928764 0.185201 tcp 10.0.2.105 54888 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:17.415629 3.001905 tcp 10.0.2.105 54889 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:26.416392 0.000000 tcp 10.0.2.105 54889 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:32.415143 3.004630 tcp 10.0.2.105 54890 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:41.417575 0.000000 tcp 10.0.2.105 54890 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:51:46.044167 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:51:47.416602 4.915047 tcp 10.0.2.105 54891 -> 46.48.223.67 15494 FSPA* 0 0 14 1671 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:51:52.331251 2.996529 tcp 10.0.2.105 54892 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:52:01.326416 0.000000 tcp 10.0.2.105 54892 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:05.706660 3.001393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 06:57:07.326862 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:57:07.326953 3.003822 tcp 10.0.2.105 54893 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:12.714122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:57:16.329069 0.000000 tcp 10.0.2.105 54893 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:20.715842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:57:22.329649 0.065646 tcp 10.0.2.105 54894 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:22.395569 0.062825 tcp 10.0.2.105 54895 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:22.458634 0.157834 tcp 10.0.2.105 54896 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:22.754707 3.007940 tcp 10.0.2.105 54897 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:31.774209 0.000000 tcp 10.0.2.105 54897 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:36.720898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:57:37.751214 0.068073 tcp 10.0.2.105 54898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:37.819539 0.061059 tcp 10.0.2.105 54899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:37.880923 0.170702 tcp 10.0.2.105 54900 -> 195.113.214.249 443 SRPA* 0 0 31 14238 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:38.154262 4.825456 tcp 10.0.2.105 54901 -> 46.48.223.67 15494 SPA_* 0 0 12 1588 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:42.980309 0.060363 tcp 10.0.2.105 54902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:43.040923 0.113419 tcp 10.0.2.105 54903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:43.154599 0.156706 tcp 10.0.2.105 54904 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:43.460477 0.000084 tcp 10.0.2.105 54901 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:43.460861 3.001797 tcp 10.0.2.105 54905 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:52.461065 0.000000 tcp 10.0.2.105 54905 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:57:58.460421 0.069614 tcp 10.0.2.105 54906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:58.530291 0.065680 tcp 10.0.2.105 54907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:58.596310 0.168021 tcp 10.0.2.105 54908 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:57:59.409570 2.996134 tcp 10.0.2.105 54909 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:58:08.404190 0.000000 tcp 10.0.2.105 54909 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:58:08.725311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 06:58:14.403106 3.003791 tcp 10.0.2.105 54910 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:58:23.405790 0.000000 tcp 10.0.2.105 54910 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:58:28.052604 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 06:58:29.414434 1.265108 tcp 10.0.2.105 54911 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:58:45.719389 0.405570 tcp 10.0.2.105 54911 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 06:58:45.719901 3.002237 tcp 10.0.2.105 54912 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 06:58:54.720801 0.000000 tcp 10.0.2.105 54912 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:04:12.730736 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:04:19.738090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:04:27.739378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:04:43.742427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:05:15.754737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:06:54.943438 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:06:54.943531 0.185046 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:55.101130 0.060043 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:55.229564 0.173787 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:55.400046 0.180983 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:55.721019 0.204598 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:55.912373 0.351130 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:56.372886 0.192568 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:56.541375 0.237127 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:56.770973 0.222601 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:56.989579 0.115918 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:57.195196 0.124813 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:57.300695 0.081800 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:58.062361 0.184406 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:58.242302 0.170999 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:59.375425 0.200217 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:06:59.916143 0.177638 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:00.356491 0.087563 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:00.706435 0.190128 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:00.740048 2.993817 tcp 10.0.2.105 54913 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:00.978736 0.197977 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:01.109827 0.360521 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:01.439395 0.177995 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:01.645526 0.031048 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:01.907127 0.249548 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:02.135528 0.084329 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:02.719099 0.211888 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:03.109651 0.454989 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:03.536912 0.379989 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:04.017725 0.185341 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 1992 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:07:09.742202 0.000000 tcp 10.0.2.105 54913 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:15.743036 0.072118 tcp 10.0.2.105 54914 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:15.815549 0.065928 tcp 10.0.2.105 54915 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:15.881795 0.164807 tcp 10.0.2.105 54916 -> 195.113.214.249 443 SRPA* 0 0 44 21634 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:16.157412 2.978195 tcp 10.0.2.105 54917 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:25.134104 0.000000 tcp 10.0.2.105 54917 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:31.143856 0.145618 tcp 10.0.2.105 54918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:31.289794 0.073828 tcp 10.0.2.105 54919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:31.363926 0.170371 tcp 10.0.2.105 54920 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:32.688062 3.001494 tcp 10.0.2.105 54921 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:41.689368 0.000000 tcp 10.0.2.105 54921 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:47.687562 0.064450 tcp 10.0.2.105 54922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:47.752485 0.116619 tcp 10.0.2.105 54923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:47.869485 0.166497 tcp 10.0.2.105 54924 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:07:48.252972 3.009064 tcp 10.0.2.105 54925 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:07:57.265765 0.000000 tcp 10.0.2.105 54925 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:08:03.249595 2.993961 tcp 10.0.2.105 54926 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:08:12.572750 0.000000 tcp 10.0.2.105 54926 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:08:17.327149 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:08:18.523607 2.970466 tcp 10.0.2.105 54927 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:08:27.438785 0.000000 tcp 10.0.2.105 54927 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:11:19.754581 3.001798 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:11:26.761858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:11:34.764778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:11:50.766046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:12:22.772546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:13:33.254563 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:13:33.254667 3.003775 tcp 10.0.2.105 54928 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:13:42.256888 0.000000 tcp 10.0.2.105 54928 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:13:48.257914 0.065905 tcp 10.0.2.105 54929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:13:48.324124 0.063846 tcp 10.0.2.105 54930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:13:48.388405 0.268410 tcp 10.0.2.105 54931 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:13:48.871100 2.999727 tcp 10.0.2.105 54932 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:13:57.870649 0.000000 tcp 10.0.2.105 54932 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:03.868650 0.065895 tcp 10.0.2.105 54933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:03.934906 0.068209 tcp 10.0.2.105 54934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:04.003443 0.157621 tcp 10.0.2.105 54935 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:04.392173 1.385126 tcp 10.0.2.105 54936 -> 46.48.223.67 15494 SPA_* 0 0 9 1139 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:17.971353 0.716317 tcp 10.0.2.105 54936 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:17.972039 0.067878 tcp 10.0.2.105 54937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:18.040135 0.068618 tcp 10.0.2.105 54938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:18.109010 0.164252 tcp 10.0.2.105 54939 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:18.687925 2.995308 tcp 10.0.2.105 54940 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:27.697487 0.000000 tcp 10.0.2.105 54940 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:33.681421 0.068585 tcp 10.0.2.105 54941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:33.750272 0.065332 tcp 10.0.2.105 54942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:33.815869 0.169014 tcp 10.0.2.105 54943 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:14:34.098174 2.987322 tcp 10.0.2.105 54944 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:43.084519 0.000000 tcp 10.0.2.105 54944 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:49.093317 3.004056 tcp 10.0.2.105 54945 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:14:58.584506 0.000000 tcp 10.0.2.105 54945 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:15:03.487032 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:15:04.514627 0.381166 tcp 10.0.2.105 54946 -> 46.48.223.67 15494 SPA_* 0 0 9 1139 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:15:13.182373 0.000386 tcp 10.0.2.105 54946 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:15:13.182969 2.970538 tcp 10.0.2.105 54947 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:15:22.079906 0.000000 tcp 10.0.2.105 54947 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:18:26.778128 3.002017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:18:33.785896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:18:41.787433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:18:57.790615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:19:29.796794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:20:27.870707 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:20:27.870828 2.992819 tcp 10.0.2.105 54948 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:20:36.872681 0.000000 tcp 10.0.2.105 54948 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:20:42.873067 0.063059 tcp 10.0.2.105 54949 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:42.936419 0.061911 tcp 10.0.2.105 54950 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:42.998577 0.158503 tcp 10.0.2.105 54951 -> 195.113.214.249 443 SRPA* 0 0 50 40046 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:43.709597 2.997659 tcp 10.0.2.105 54952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:20:52.705737 0.000000 tcp 10.0.2.105 54952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:20:58.704669 0.064117 tcp 10.0.2.105 54953 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:58.769006 0.065048 tcp 10.0.2.105 54954 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:58.834384 0.160221 tcp 10.0.2.105 54955 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:20:59.564536 0.397466 tcp 10.0.2.105 54956 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:04.805925 1.199785 tcp 10.0.2.105 54956 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:04.806602 0.062501 tcp 10.0.2.105 54957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:04.869416 0.067389 tcp 10.0.2.105 54958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:04.937081 0.163093 tcp 10.0.2.105 54959 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:06.005984 3.003201 tcp 10.0.2.105 54960 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:15.010094 0.000000 tcp 10.0.2.105 54960 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:21.006406 0.063404 tcp 10.0.2.105 54961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:21.070120 0.068563 tcp 10.0.2.105 54962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:21.138952 0.159731 tcp 10.0.2.105 54963 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:21:21.728402 3.004047 tcp 10.0.2.105 54964 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:30.730600 0.000000 tcp 10.0.2.105 54964 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:36.729300 2.994846 tcp 10.0.2.105 54965 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:45.731681 0.000000 tcp 10.0.2.105 54965 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:21:50.549025 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:21:51.730646 0.953274 tcp 10.0.2.105 54966 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:22:03.892658 0.000947 tcp 10.0.2.105 54966 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:22:03.893150 3.008879 tcp 10.0.2.105 54967 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:22:12.900993 0.000000 tcp 10.0.2.105 54967 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:25:33.802250 3.002041 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:25:40.809951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:25:48.814484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:26:04.814823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:26:36.820546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:27:18.891602 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:27:18.891808 2.993304 tcp 10.0.2.105 54968 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:27:27.883859 0.000000 tcp 10.0.2.105 54968 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:27:33.893857 0.065875 tcp 10.0.2.105 54969 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:33.960008 0.065260 tcp 10.0.2.105 54970 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:34.025568 0.156779 tcp 10.0.2.105 54971 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:34.703896 3.003975 tcp 10.0.2.105 54972 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:27:43.706443 0.000000 tcp 10.0.2.105 54972 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:27:49.706658 0.067227 tcp 10.0.2.105 54973 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:49.774158 0.062806 tcp 10.0.2.105 54974 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:49.837348 0.161937 tcp 10.0.2.105 54975 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:50.413683 0.397413 tcp 10.0.2.105 54976 -> 46.48.223.67 15494 SPA_* 0 0 9 1223 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:58.529144 0.735424 tcp 10.0.2.105 54976 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:58.529959 0.065756 tcp 10.0.2.105 54977 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:58.596029 0.061904 tcp 10.0.2.105 54978 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:58.658236 0.167492 tcp 10.0.2.105 54979 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:27:59.264814 2.998452 tcp 10.0.2.105 54980 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:08.271427 0.000000 tcp 10.0.2.105 54980 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:14.260911 0.063242 tcp 10.0.2.105 54981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:28:14.324489 0.063054 tcp 10.0.2.105 54982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:28:14.387834 0.172108 tcp 10.0.2.105 54983 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:28:14.691371 2.993565 tcp 10.0.2.105 54984 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:23.683948 0.000000 tcp 10.0.2.105 54984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:29.692642 3.004393 tcp 10.0.2.105 54985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:38.695498 0.000000 tcp 10.0.2.105 54985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:43.552611 0.222981 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:28:44.893437 4.985030 tcp 10.0.2.105 54986 -> 46.48.223.67 15494 FSPA* 0 0 14 1753 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:28:49.877559 2.969847 tcp 10.0.2.105 54987 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:28:58.789878 0.000000 tcp 10.0.2.105 54987 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:32:40.831150 2.996900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:32:47.833964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:32:56.054172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:33:11.915116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:33:43.853840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:34:04.725507 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:34:04.725601 4.886467 tcp 10.0.2.105 54988 -> 46.48.223.67 15494 SPA_* 0 0 12 1664 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:34:09.612351 0.070064 tcp 10.0.2.105 54989 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:34:09.682706 0.068892 tcp 10.0.2.105 54990 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:34:09.751942 0.249366 tcp 10.0.2.105 54991 -> 195.113.214.249 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:34:10.217093 0.000066 tcp 10.0.2.105 54988 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:34:10.217412 4.887108 tcp 10.0.2.105 54992 -> 46.48.223.67 15494 FSPA* 0 0 14 1772 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:37:11.583338 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:37:11.583516 0.174883 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:11.755541 0.179690 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:11.976198 0.184811 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:12.130347 0.059578 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:12.213791 0.207869 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:12.406920 0.279546 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:12.686057 0.186107 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:12.849345 0.244330 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:13.086500 0.213383 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:13.295984 0.113521 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:13.608876 0.126243 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:13.715483 0.085806 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:14.188633 0.183195 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:14.366745 0.168567 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:14.515782 0.208549 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:14.852952 0.129691 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:14.937370 0.087704 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:15.200637 0.365578 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:15.531617 0.189472 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:15.717477 0.267717 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:15.938521 0.175476 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:16.144790 0.031107 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:16.353939 0.287991 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:16.620202 0.090234 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:16.885946 0.190695 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:17.069501 0.443620 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:17.491544 0.354889 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:37:17.842470 0.187910 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/17 07:39:15.101374 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:39:15.101555 2.992886 tcp 10.0.2.105 54993 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:39:24.097707 0.000000 tcp 10.0.2.105 54993 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:39:30.103997 0.071086 tcp 10.0.2.105 54994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:30.175337 0.066914 tcp 10.0.2.105 54995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:30.242541 0.220716 tcp 10.0.2.105 54996 -> 195.113.214.249 443 SRPA* 0 0 44 28578 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:30.501248 3.001479 tcp 10.0.2.105 54997 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:39:39.495553 0.000000 tcp 10.0.2.105 54997 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:39:45.495457 0.064695 tcp 10.0.2.105 54998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:45.560453 0.072595 tcp 10.0.2.105 54999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:45.633292 0.170290 tcp 10.0.2.105 55000 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:45.858110 4.792342 tcp 10.0.2.105 55001 -> 46.48.223.67 15494 SPA_* 0 0 12 1429 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:47.860454 3.006906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:39:50.651027 0.065523 tcp 10.0.2.105 55002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:50.716849 0.064053 tcp 10.0.2.105 55003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:50.781242 0.172718 tcp 10.0.2.105 55004 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:51.120315 0.000070 tcp 10.0.2.105 55001 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:39:51.120631 2.995526 tcp 10.0.2.105 55005 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:39:54.868024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:40:00.117976 0.000000 tcp 10.0.2.105 55005 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:02.869393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:40:06.114727 0.066736 tcp 10.0.2.105 55006 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:40:06.181718 0.065855 tcp 10.0.2.105 55007 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:40:06.247865 0.152607 tcp 10.0.2.105 55008 -> 195.113.214.249 443 SRPA* 0 0 23 13802 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:40:06.594644 3.004364 tcp 10.0.2.105 55009 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:15.599042 0.000000 tcp 10.0.2.105 55009 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:18.872395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:40:21.596172 3.004639 tcp 10.0.2.105 55010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:30.599258 0.000000 tcp 10.0.2.105 55010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:35.546218 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:40:36.598045 1.386770 tcp 10.0.2.105 55011 -> 46.48.223.67 15494 SPA_* 0 0 9 1007 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:40:42.389260 0.928495 tcp 10.0.2.105 55011 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:40:43.317947 3.003782 tcp 10.0.2.105 55012 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:40:50.880472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:40:52.323619 0.000000 tcp 10.0.2.105 55012 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:45:58.320800 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:45:58.320944 2.993329 tcp 10.0.2.105 55013 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:07.313278 0.000000 tcp 10.0.2.105 55013 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:14.024367 0.067328 tcp 10.0.2.105 55014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:14.091982 0.064464 tcp 10.0.2.105 55015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:14.156825 0.160343 tcp 10.0.2.105 55016 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:14.714924 2.965563 tcp 10.0.2.105 55017 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:23.610142 0.000000 tcp 10.0.2.105 55017 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:29.541724 0.064380 tcp 10.0.2.105 55018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:29.606399 0.065473 tcp 10.0.2.105 55019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:29.672147 0.160710 tcp 10.0.2.105 55020 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:30.458584 0.389107 tcp 10.0.2.105 55021 -> 46.48.223.67 15494 SPA_* 0 0 9 1031 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:37.874053 0.592221 tcp 10.0.2.105 55021 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:37.874887 0.064888 tcp 10.0.2.105 55022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:37.940047 0.074298 tcp 10.0.2.105 55023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:38.014630 0.159041 tcp 10.0.2.105 55024 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:38.466606 2.967810 tcp 10.0.2.105 55025 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:47.362918 0.000000 tcp 10.0.2.105 55025 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:53.295650 0.072402 tcp 10.0.2.105 55026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:53.368554 0.132273 tcp 10.0.2.105 55027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:53.501169 0.160811 tcp 10.0.2.105 55028 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:46:53.907574 2.965103 tcp 10.0.2.105 55029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:46:55.101546 2.960748 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:47:02.024799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:47:02.799504 0.000000 tcp 10.0.2.105 55029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:47:08.732120 2.957005 tcp 10.0.2.105 55030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:47:09.937958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:47:17.664514 0.000000 tcp 10.0.2.105 55030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:47:22.796027 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:47:23.907098 4.643655 tcp 10.0.2.105 55031 -> 46.48.223.67 15494 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:47:26.103022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:47:28.551005 2.972044 tcp 10.0.2.105 55032 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:47:37.474370 0.000000 tcp 10.0.2.105 55032 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:47:57.902671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:52:43.363185 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:52:43.363285 3.003992 tcp 10.0.2.105 55033 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:52:52.366782 0.000000 tcp 10.0.2.105 55033 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:52:58.365764 0.066161 tcp 10.0.2.105 55034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:52:58.432344 0.068753 tcp 10.0.2.105 55035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:52:58.501409 0.175015 tcp 10.0.2.105 55036 -> 195.113.214.249 443 SRPA* 0 0 44 37134 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:52:58.801980 2.997253 tcp 10.0.2.105 55037 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:07.797433 0.000000 tcp 10.0.2.105 55037 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:13.948727 0.067398 tcp 10.0.2.105 55038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:14.016427 0.066072 tcp 10.0.2.105 55039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:14.082805 0.163190 tcp 10.0.2.105 55040 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:14.588125 4.960033 tcp 10.0.2.105 55041 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:19.196063 0.065250 tcp 10.0.2.105 55042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:19.261614 0.068304 tcp 10.0.2.105 55043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:19.330197 0.158307 tcp 10.0.2.105 55044 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:19.548419 2.972220 tcp 10.0.2.105 55045 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:28.462342 0.000000 tcp 10.0.2.105 55045 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:34.446797 0.065540 tcp 10.0.2.105 55046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:34.512640 0.073344 tcp 10.0.2.105 55047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:34.586296 0.153472 tcp 10.0.2.105 55048 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:53:35.394892 3.007192 tcp 10.0.2.105 55049 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:44.400876 0.000000 tcp 10.0.2.105 55049 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:50.525572 2.968050 tcp 10.0.2.105 55050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:53:59.447741 0.000000 tcp 10.0.2.105 55050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:54:01.934698 2.978385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 07:54:04.059033 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:54:05.390695 4.566704 tcp 10.0.2.105 55051 -> 46.48.223.67 15494 FSPA* 0 0 14 1707 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:54:08.915527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:54:09.957687 3.003866 tcp 10.0.2.105 55052 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:54:16.916871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:54:18.961410 0.000000 tcp 10.0.2.105 55052 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:54:32.921306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:55:04.926327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 07:59:24.960723 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 07:59:24.960835 2.993620 tcp 10.0.2.105 55053 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:59:33.953148 0.000000 tcp 10.0.2.105 55053 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:59:39.963653 0.094489 tcp 10.0.2.105 55054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:40.058489 0.062958 tcp 10.0.2.105 55055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:40.121780 0.189987 tcp 10.0.2.105 55056 -> 195.113.214.249 443 SRPA* 0 0 35 26872 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:40.387481 2.999381 tcp 10.0.2.105 55057 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:59:49.385306 0.000000 tcp 10.0.2.105 55057 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 07:59:55.384708 0.066623 tcp 10.0.2.105 55058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:55.451621 0.065721 tcp 10.0.2.105 55059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:55.517676 0.161235 tcp 10.0.2.105 55060 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 07:59:55.772467 1.388964 tcp 10.0.2.105 55061 -> 46.48.223.67 15494 SPA_* 0 0 9 1191 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:03.277901 0.536847 tcp 10.0.2.105 55061 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:03.278711 0.064817 tcp 10.0.2.105 55062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:03.343826 0.088391 tcp 10.0.2.105 55063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:03.432503 0.159664 tcp 10.0.2.105 55064 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:03.814961 3.006655 tcp 10.0.2.105 55065 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:12.818850 0.000000 tcp 10.0.2.105 55065 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:18.808401 0.062222 tcp 10.0.2.105 55066 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:18.871056 0.062205 tcp 10.0.2.105 55067 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:18.933527 0.167561 tcp 10.0.2.105 55068 -> 195.113.214.249 443 SRPA* 0 0 43 22722 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:19.650394 3.002734 tcp 10.0.2.105 55069 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:28.661886 0.000000 tcp 10.0.2.105 55069 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:34.650722 2.994284 tcp 10.0.2.105 55070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:43.301227 0.066156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:00:44.435579 0.000000 tcp 10.0.2.105 55070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:00:50.369523 0.388657 tcp 10.0.2.105 55071 -> 46.48.223.67 15494 SPA_* 0 0 7 1083 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:56.608752 0.001022 tcp 10.0.2.105 55071 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:00:56.609353 2.960696 tcp 10.0.2.105 55072 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:01:05.495192 0.000000 tcp 10.0.2.105 55072 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:01:09.403086 2.963208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 08:01:16.842639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:01:24.744573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:01:40.559510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:02:12.189007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:07:47.719428 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:07:47.719523 0.187841 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:47.880558 0.058083 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:48.261720 0.171322 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:48.429759 0.178743 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:48.864557 0.207449 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:49.057915 0.283384 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:49.658291 0.185705 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:49.821702 0.256941 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:50.599099 0.215069 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:50.809975 0.096241 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:50.898435 0.183148 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:51.076931 0.113232 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:51.209846 0.124972 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:51.316074 0.169319 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:51.530437 0.213521 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:51.959066 0.128704 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:52.043096 0.088472 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:52.227062 0.192177 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:52.355392 0.176839 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:52.860736 0.022783 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:52.898846 0.374990 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:53.247962 0.190741 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:53.542253 0.327463 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:53.848362 0.083814 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:54.409054 0.191731 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:54.593286 0.187879 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:54.773691 0.446769 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:55.196776 0.354139 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:07:55.988881 3.000316 tcp 10.0.2.105 55073 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:04.987786 0.000000 tcp 10.0.2.105 55073 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:10.989814 0.066811 tcp 10.0.2.105 55074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:11.056929 0.433017 tcp 10.0.2.105 55075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:11.490331 0.159033 tcp 10.0.2.105 55076 -> 195.113.214.249 443 SRPA* 0 0 48 42022 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:12.054417 3.012636 tcp 10.0.2.105 55077 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:15.969541 2.998328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 08:08:21.061095 0.000000 tcp 10.0.2.105 55077 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:22.973857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:08:27.050282 0.062434 tcp 10.0.2.105 55078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:27.113028 0.064215 tcp 10.0.2.105 55079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:27.177492 0.166002 tcp 10.0.2.105 55080 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:28.180505 0.380597 tcp 10.0.2.105 55081 -> 46.48.223.67 15494 SPA_* 0 0 9 1096 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:30.975345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:08:34.193692 0.471811 tcp 10.0.2.105 55081 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:34.194531 0.073905 tcp 10.0.2.105 55082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:34.268640 0.066600 tcp 10.0.2.105 55083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:34.335591 0.161375 tcp 10.0.2.105 55084 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:34.665762 2.998860 tcp 10.0.2.105 55085 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:43.663667 0.000000 tcp 10.0.2.105 55085 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:46.978214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:08:49.662960 0.066507 tcp 10.0.2.105 55086 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:49.729750 0.063002 tcp 10.0.2.105 55087 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:49.793103 0.155363 tcp 10.0.2.105 55088 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:08:50.428693 2.998902 tcp 10.0.2.105 55089 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:08:59.425623 0.000000 tcp 10.0.2.105 55089 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:09:05.425022 3.004219 tcp 10.0.2.105 55090 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:09:14.427902 0.000000 tcp 10.0.2.105 55090 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:09:18.986241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:09:19.046103 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:09:20.426132 0.419818 tcp 10.0.2.105 55091 -> 46.48.223.67 15494 SPA_* 0 0 9 1096 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:09:26.341067 0.001605 tcp 10.0.2.105 55091 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:09:26.341549 2.997456 tcp 10.0.2.105 55092 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:09:35.337563 0.000000 tcp 10.0.2.105 55092 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:14:41.338016 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:14:41.338197 3.003808 tcp 10.0.2.105 55093 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:14:50.340591 0.000000 tcp 10.0.2.105 55093 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:14:56.341190 0.086050 tcp 10.0.2.105 55094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:14:56.427542 0.067105 tcp 10.0.2.105 55095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:14:56.494929 0.158009 tcp 10.0.2.105 55096 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:14:56.790478 2.993620 tcp 10.0.2.105 55097 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:05.792726 0.000000 tcp 10.0.2.105 55097 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:11.792270 0.062355 tcp 10.0.2.105 55098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:11.854958 0.073674 tcp 10.0.2.105 55099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:11.928893 0.160262 tcp 10.0.2.105 55100 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:12.469622 1.161503 tcp 10.0.2.105 55101 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:18.960968 0.447682 tcp 10.0.2.105 55101 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:18.961655 0.196856 tcp 10.0.2.105 55102 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:19.158807 0.067159 tcp 10.0.2.105 55103 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:19.226223 0.172467 tcp 10.0.2.105 55104 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:19.408884 2.967370 tcp 10.0.2.105 55105 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:23.640406 2.968395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 08:15:28.307937 0.000000 tcp 10.0.2.105 55105 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:30.564360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:15:34.262783 0.065867 tcp 10.0.2.105 55106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:34.328895 0.063641 tcp 10.0.2.105 55107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:34.392841 0.160463 tcp 10.0.2.105 55108 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:15:34.818968 2.964612 tcp 10.0.2.105 55109 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:38.506628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:15:43.705986 0.000000 tcp 10.0.2.105 55109 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:49.637783 2.968577 tcp 10.0.2.105 55110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:15:54.722454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:15:58.933698 0.000000 tcp 10.0.2.105 55110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:16:03.644452 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:16:04.859649 0.390660 tcp 10.0.2.105 55111 -> 46.48.223.67 15494 SPA_* 0 0 9 1198 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:16:10.414531 0.000975 tcp 10.0.2.105 55111 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:16:10.415022 2.964071 tcp 10.0.2.105 55112 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:16:19.305769 0.000000 tcp 10.0.2.105 55112 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:16:26.340131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:21:24.898484 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:21:24.898633 3.003850 tcp 10.0.2.105 55113 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:21:33.901049 0.000000 tcp 10.0.2.105 55113 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:21:39.902296 0.067254 tcp 10.0.2.105 55114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:39.969845 0.066651 tcp 10.0.2.105 55115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:40.036833 0.158470 tcp 10.0.2.105 55116 -> 195.113.214.249 443 SRPA* 0 0 25 13876 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:40.297907 2.996795 tcp 10.0.2.105 55117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:21:49.292851 0.000000 tcp 10.0.2.105 55117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:21:55.292575 0.065597 tcp 10.0.2.105 55118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:55.358428 0.066999 tcp 10.0.2.105 55119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:55.425737 0.157439 tcp 10.0.2.105 55120 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:21:55.621790 0.469235 tcp 10.0.2.105 55121 -> 46.48.223.67 15494 SPA_* 0 0 9 1187 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:01.104047 1.109370 tcp 10.0.2.105 55121 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:01.104944 0.071138 tcp 10.0.2.105 55122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:01.176382 0.069697 tcp 10.0.2.105 55123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:01.246371 0.163220 tcp 10.0.2.105 55124 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:02.213655 3.001845 tcp 10.0.2.105 55125 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:11.214294 0.000000 tcp 10.0.2.105 55125 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:17.213467 0.065481 tcp 10.0.2.105 55126 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:17.279244 0.068895 tcp 10.0.2.105 55127 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:17.348442 0.164990 tcp 10.0.2.105 55128 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:17.896590 3.002128 tcp 10.0.2.105 55129 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:26.897262 0.000000 tcp 10.0.2.105 55129 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:32.896047 3.004210 tcp 10.0.2.105 55130 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:34.029998 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 08:22:41.037458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:22:41.898850 0.000000 tcp 10.0.2.105 55130 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:22:46.545542 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:22:47.897454 1.385519 tcp 10.0.2.105 55131 -> 46.48.223.67 15494 SPA_* 0 0 9 1187 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:49.039105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:22:54.169805 0.001180 tcp 10.0.2.105 55131 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:22:54.170284 3.000419 tcp 10.0.2.105 55132 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:23:03.169319 0.000000 tcp 10.0.2.105 55132 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:23:05.041582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:23:37.048024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:28:09.171217 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:28:09.171328 2.992019 tcp 10.0.2.105 55133 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:28:18.171777 0.000000 tcp 10.0.2.105 55133 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:28:24.172718 0.065280 tcp 10.0.2.105 55134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:24.238268 0.062806 tcp 10.0.2.105 55135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:24.301359 0.159440 tcp 10.0.2.105 55136 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:24.838777 2.997072 tcp 10.0.2.105 55137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:28:33.834262 0.000000 tcp 10.0.2.105 55137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:28:39.833745 0.064338 tcp 10.0.2.105 55138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:39.898396 0.062165 tcp 10.0.2.105 55139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:39.960803 0.154406 tcp 10.0.2.105 55140 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:40.442595 0.383377 tcp 10.0.2.105 55141 -> 46.48.223.67 15494 SPA_* 0 0 9 1172 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:55.275457 0.476635 tcp 10.0.2.105 55141 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:55.276448 0.061905 tcp 10.0.2.105 55142 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:55.338658 0.065939 tcp 10.0.2.105 55143 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:55.404883 0.158613 tcp 10.0.2.105 55144 -> 195.113.214.249 443 SRPA* 0 0 27 11062 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:28:55.752332 2.998228 tcp 10.0.2.105 55145 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:04.749137 0.000000 tcp 10.0.2.105 55145 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:10.748492 0.062001 tcp 10.0.2.105 55146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:29:10.810868 0.067600 tcp 10.0.2.105 55147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:29:10.878823 0.163909 tcp 10.0.2.105 55148 -> 195.113.214.249 443 SRPA* 0 0 36 19630 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:29:11.501416 2.991589 tcp 10.0.2.105 55149 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:20.625976 0.000000 tcp 10.0.2.105 55149 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:26.569913 2.970361 tcp 10.0.2.105 55150 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:35.571804 0.000000 tcp 10.0.2.105 55150 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:40.081055 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:29:41.076204 2.992401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 08:29:41.521237 0.417123 tcp 10.0.2.105 55151 -> 46.48.223.67 15494 SPA_* 0 0 9 1172 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:29:46.664478 0.045375 tcp 10.0.2.105 55151 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:29:46.709649 2.993842 tcp 10.0.2.105 55152 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:48.061451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:29:55.712004 0.000000 tcp 10.0.2.105 55152 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:29:56.062311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:30:12.065911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:30:44.071665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:36:48.087365 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 08:36:55.095619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:37:03.097065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:37:19.099954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:37:51.105576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:38:08.310973 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 08:38:08.311055 0.175308 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:08.482068 0.189988 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:08.691352 0.060701 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:08.750680 0.176344 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:09.129814 0.206340 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:09.321699 0.278891 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:09.809936 0.181963 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:09.969779 0.079784 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:10.362973 0.183445 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:10.541349 0.159362 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:11.130809 0.241776 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:11.364855 0.213916 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:11.575112 0.125198 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:11.777779 0.169551 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:11.926526 0.211916 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:12.370659 0.134434 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:12.455675 0.175127 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:12.659709 0.024955 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:12.821260 0.090468 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:12.894706 0.200014 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:13.107639 0.377751 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:13.458396 0.189331 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:13.644803 0.239925 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:13.884319 0.182503 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:14.060317 0.085041 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:14.124188 0.191643 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:14.506559 0.442183 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:14.927173 0.354163 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/17 08:38:16.732960 3.004358 tcp 10.0.2.105 55153 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:38:25.739843 0.000000 tcp 10.0.2.105 55153 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:38:31.735953 0.045914 tcp 10.0.2.105 55154 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:31.782132 0.046430 tcp 10.0.2.105 55155 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:31.828846 0.157532 tcp 10.0.2.105 55156 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:32.029808 2.999167 tcp 10.0.2.105 55157 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:38:41.032724 0.000000 tcp 10.0.2.105 55157 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:38:47.027226 0.045132 tcp 10.0.2.105 55158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:47.072650 0.047013 tcp 10.0.2.105 55159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:47.119967 0.162188 tcp 10.0.2.105 55160 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:38:47.652036 1.375652 tcp 10.0.2.105 55161 -> 46.48.223.67 15494 SPA_* 0 0 9 1117 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:19.022961 0.046169 tcp 10.0.2.105 55162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:19.069050 0.044838 tcp 10.0.2.105 55163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:19.114201 0.171882 tcp 10.0.2.105 55164 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:19.436793 0.380298 tcp 10.0.2.105 55161 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:19.437137 3.000402 tcp 10.0.2.105 55165 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:39:28.435777 0.000000 tcp 10.0.2.105 55165 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 08:39:34.435218 0.046095 tcp 10.0.2.105 55166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:34.481179 0.055228 tcp 10.0.2.105 55167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:34.536717 0.165927 tcp 10.0.2.105 55168 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:39:35.190350 0.631339 tcp 10.0.2.105 55169 -> 95.104.66.207 7362 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/17 08:43:55.111843 3.028746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 08:44:02.129558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:44:10.134686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:44:26.133705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:44:58.139858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:56:08.145400 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 08:56:15.152993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:56:23.154792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:56:39.157810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 08:57:11.165114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:03:15.181683 2.989784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:03:22.177050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:03:30.178684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:03:46.181805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:04:18.187674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:08:25.503443 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 09:08:25.503686 0.057246 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:25.561293 0.165038 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:25.726722 0.190257 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:25.917345 0.169401 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.087191 0.159055 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.246674 0.270208 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.517320 0.159164 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.676847 0.039030 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.716210 0.227455 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:26.944081 0.176547 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.121012 0.085152 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.206550 0.208834 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.505182 0.103928 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.609512 0.148436 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.758386 0.204203 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.963011 0.029223 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:27.992690 0.075575 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:28.068671 0.124115 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:28.193239 0.091119 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:28.284769 0.171971 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:28.457189 0.362413 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:28.819991 0.183341 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:29.003733 0.219414 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:29.223586 0.179534 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:29.442523 0.077122 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:29.520009 0.182849 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:29.703274 0.419569 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:08:30.123262 0.349238 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:09:35.824760 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 09:09:35.825022 0.895092 tcp 10.0.2.105 55170 -> 95.104.66.207 7362 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/17 09:10:34.200698 3.002250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 09:10:41.208301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:10:49.209876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:11:05.213148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:11:37.218990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:17:41.226404 3.000495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:17:48.232598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:17:56.233732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:18:12.236959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:18:44.242872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:24:48.248913 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:24:55.255821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:25:03.258105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:25:19.261033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:25:51.269980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:31:55.273738 3.000527 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:32:02.280391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:32:10.283828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:32:26.284600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:32:58.291022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:38:34.505184 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 09:38:34.505297 0.056512 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:34.562187 0.179754 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:34.742384 0.154226 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:34.896960 0.282544 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:35.179922 0.158817 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:35.339180 0.049199 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:35.388730 0.150794 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:35.709112 0.187276 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:35.900428 0.232717 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.133502 0.176422 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.310332 0.074718 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.385501 0.208907 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.594812 0.105689 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.700932 0.147241 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:36.848647 0.201626 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.050679 0.020813 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.071844 0.074635 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.146947 0.123251 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.270578 0.094916 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.365898 0.171611 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.537913 0.329080 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:37.867412 0.184513 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:38.052320 0.216436 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:38.269135 0.174105 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:38.443613 0.063313 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:38.507291 0.344601 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:38.852232 0.181951 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:38:39.034567 0.420292 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/17 09:39:02.296827 3.001759 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:39:09.304469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:39:17.305874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:39:33.308903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:39:36.724016 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 09:39:36.724156 0.695196 tcp 10.0.2.105 55171 -> 95.104.66.207 7362 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/17 09:40:05.314304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:46:09.321673 3.000557 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:46:16.328131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:46:24.329795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:46:40.332984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:47:12.338796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:53:16.347438 2.999055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 09:53:23.356543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:53:31.353604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:53:47.360694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 09:54:19.362690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:00:23.369546 3.980902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:00:31.310668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:00:39.221647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:00:55.038353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:01:26.658389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:07:30.403056 3.001661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:07:37.410269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:07:45.411690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:08:01.418766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:08:33.420805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:08:41.692913 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 10:08:41.693024 0.157732 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:41.851124 0.280910 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.132440 0.160429 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.293253 0.055647 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.349315 0.168503 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.518226 0.060890 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.579575 0.149330 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.729316 0.198066 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:42.927784 0.237973 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.166118 0.177098 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.343612 0.077503 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.421537 0.208641 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.630554 0.105444 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.736372 0.146845 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:43.883625 0.201138 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.085240 0.023687 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.109283 0.070055 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.179665 0.140759 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.320772 0.133215 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.454346 0.273426 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:44.728146 0.288622 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:45.017119 0.173435 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:45.237750 0.323361 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:45.561485 0.193446 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:45.755295 0.066697 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:45.822347 0.344824 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:46.167574 0.182094 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:08:46.350012 0.421495 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:09:37.424050 0.558724 tcp 10.0.2.105 55172 -> 95.104.66.207 7362 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/17 10:14:37.426240 3.002213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 10:14:44.434037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:14:52.435619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:15:08.438570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:15:40.444569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:21:46.453761 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:21:53.461119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:22:01.462540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:22:17.465668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:22:49.471413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:28:53.478143 3.000964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:29:00.485146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:29:08.487414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:29:24.489309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:29:56.495554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:36:00.501176 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:36:07.509008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:36:15.510481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:36:31.515695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:37:03.643526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:38:53.568339 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 10:38:53.568465 0.157806 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:53.726637 0.054666 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:53.781658 0.169096 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:53.951084 0.043992 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:53.995433 0.148976 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:54.144854 0.158902 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:54.304141 0.279415 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:54.583952 0.190988 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:54.775317 0.228695 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.004403 0.175447 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.180404 0.083563 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.264499 0.217419 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.482360 0.105245 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.588051 0.148742 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.737127 0.202724 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.940229 0.023330 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:55.963942 0.072453 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.036756 0.120899 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.158019 0.083261 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.241723 0.184989 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.427073 0.218852 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.646344 0.171982 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:56.818770 0.607656 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:57.426764 0.178460 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:57.605576 0.062238 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:57.668155 0.347417 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:58.015954 0.182500 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:38:58.198922 0.424434 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/17 10:39:37.982766 0.764460 tcp 10.0.2.105 55173 -> 95.104.66.207 7362 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/02/17 10:43:07.536133 3.001102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 10:43:14.543148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:43:22.544633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:43:38.547539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:44:10.553456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:55:41.559143 3.002141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 10:55:48.567033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:55:56.568807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:56:12.571652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 10:56:44.577724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:02:48.584086 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:02:55.591121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:03:03.592762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:03:19.595599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:03:51.601689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:09:04.734243 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 11:09:04.734352 0.158482 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:04.893254 0.057421 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:04.951046 0.168886 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:05.120332 0.051054 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:05.171845 0.148624 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:05.320862 0.157996 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:05.713827 0.233287 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:05.947584 0.175795 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:06.123765 0.086637 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:06.210874 0.284977 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:06.496478 0.195502 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:06.692375 0.208495 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:06.901233 0.104451 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.006047 0.146193 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.152619 0.199002 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.352058 0.029444 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.381856 0.069222 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.451445 0.141592 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.593393 0.080506 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.674346 0.172072 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:07.846841 0.183739 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:08.031089 0.216092 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:08.247609 0.337644 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:08.585642 0.182168 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:08.768194 0.064802 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:08.833367 0.345440 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:09.179199 0.180831 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:09.360447 0.417706 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:09:38.751133 0.556286 tcp 10.0.2.105 55174 -> 95.104.66.207 7362 FSPA* 0 0 14 1649 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:10:18.610500 3.001946 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 11:10:25.622565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:10:33.619561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:10:49.830169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:11:21.638753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:17:25.645836 3.000378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:17:32.652195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:17:41.646346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:17:57.455149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:18:29.447213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:24:32.689014 3.001131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:24:39.695852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:24:47.697463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:25:03.700634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:25:35.706164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:31:39.712694 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:31:46.720649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:31:54.722295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:32:10.724391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:32:42.731104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:38:46.736356 3.003576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:38:53.743858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:39:01.747078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:39:17.749685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:39:32.550270 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 11:39:32.550434 0.168408 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:32.719202 0.042845 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:32.762435 0.150480 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:32.913271 0.158579 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.072230 0.056084 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.128648 0.156921 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.285929 0.228004 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.514360 0.176304 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.691070 0.081499 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:33.772995 0.275791 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.049183 0.195217 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.244749 0.208867 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.454030 0.105596 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.560070 0.148475 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.709007 0.197826 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.907201 0.023476 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:34.931029 0.000000 udp 10.0.2.105 7010 -> 213.123.183.68 8899 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 11:39:39.309749 0.572644 tcp 10.0.2.105 55175 -> 95.104.66.207 7362 FSPA* 0 0 14 1506 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:39:49.754549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:39:51.821441 0.066119 tcp 10.0.2.105 55176 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:39:51.887786 0.064659 tcp 10.0.2.105 55177 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:39:51.952706 0.134937 tcp 10.0.2.105 55178 -> 195.113.214.249 443 SRPA* 0 0 37 27023 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:39:52.088414 0.114796 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:52.203705 0.094681 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:52.298789 0.172350 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:52.788797 0.188030 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:52.977276 0.218236 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:53.195978 0.065218 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:53.261607 0.345842 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:53.607904 0.178391 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:39:53.786740 0.000000 udp 10.0.2.105 7010 -> 203.45.157.34 1089 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 11:40:10.033781 0.424502 tcp 10.0.2.105 55179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:40:10.458568 0.062931 tcp 10.0.2.105 55180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:40:10.521822 0.155365 tcp 10.0.2.105 55181 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 11:40:10.677708 0.353294 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:40:11.031436 0.177857 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/17 11:45:53.760391 3.001791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:46:00.768199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:46:08.769455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:46:24.772650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:46:56.778469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:53:00.784880 3.001310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 11:53:07.791880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:53:15.793486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:53:31.796327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 11:54:03.802529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:00:07.809178 3.008351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 12:00:14.905847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:00:22.846329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:00:38.830563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:01:10.836411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:07:18.847744 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 12:07:25.855395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:07:33.857065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:07:49.860616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:08:21.866005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:09:39.888677 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:09:39.888767 0.515694 tcp 10.0.2.105 55182 -> 95.104.66.207 7362 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:10:38.662878 0.108661 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:38.771955 0.569811 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.342132 0.157509 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.499994 0.055280 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.555671 0.155373 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.711398 0.162358 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.874121 0.042258 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:39.916823 0.165596 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:40.082838 0.176054 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:40.401942 0.190918 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:40.593288 0.234363 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:40.828088 0.278088 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.106683 0.078730 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.185874 0.200863 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.387187 0.025013 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.412637 0.217431 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.630447 0.147085 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.777971 0.104791 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.883152 0.082916 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:41.966489 0.139601 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:42.106586 0.217543 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:42.324572 0.062493 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:42.387405 0.189336 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:42.577112 0.172729 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:42.750283 0.348688 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:43.099374 0.180343 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:43.280100 0.338273 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:10:43.549834 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:10:43.618727 0.179398 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:14:25.871334 3.002661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 12:14:32.998084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:14:40.937670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:14:56.894163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:15:28.900064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:21:32.906842 3.000872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 12:21:39.913488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:21:47.915186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:22:03.917958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:22:36.936821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:28:39.939722 3.002247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 12:28:46.947554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:28:54.948902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:29:10.951545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:29:42.958043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:35:46.964572 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 12:35:53.971616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:36:01.973060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:36:17.975948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:36:49.981578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:39:40.407548 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:39:40.407657 3.003978 tcp 10.0.2.105 55183 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:39:49.876462 0.000000 tcp 10.0.2.105 55183 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:39:55.803213 0.065051 tcp 10.0.2.105 55184 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:39:55.868563 0.065412 tcp 10.0.2.105 55185 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:39:55.934221 0.142190 tcp 10.0.2.105 55186 -> 195.113.214.249 443 SRPA* 0 0 65 41315 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:39:56.251468 2.962598 tcp 10.0.2.105 55187 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:05.149158 0.000000 tcp 10.0.2.105 55187 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:11.064738 0.070000 tcp 10.0.2.105 55188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:11.135018 0.068299 tcp 10.0.2.105 55189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:11.203582 0.159087 tcp 10.0.2.105 55190 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:11.653906 2.961434 tcp 10.0.2.105 55191 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:20.540149 0.000000 tcp 10.0.2.105 55191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:26.463780 0.179775 tcp 10.0.2.105 55192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:26.640590 0.063314 tcp 10.0.2.105 55193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:26.704184 0.179971 tcp 10.0.2.105 55194 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:27.042051 2.272217 tcp 10.0.2.105 55195 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:28.808602 0.063708 tcp 10.0.2.105 55196 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:28.872647 0.068289 tcp 10.0.2.105 55197 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:28.941266 0.160796 tcp 10.0.2.105 55198 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:29.314501 3.007187 tcp 10.0.2.105 55199 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:38.320667 0.000000 tcp 10.0.2.105 55199 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:44.309498 0.064367 tcp 10.0.2.105 55200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:44.374189 0.064049 tcp 10.0.2.105 55201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:44.438455 0.158813 tcp 10.0.2.105 55202 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:40:45.169758 2.994239 tcp 10.0.2.105 55203 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:54.548544 0.000000 tcp 10.0.2.105 55203 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:40:56.941358 0.108227 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.049992 0.424629 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.475009 0.155612 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.631009 0.055317 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.686737 0.157790 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.844895 0.153276 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:57.998580 0.244535 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:58.243556 0.169154 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:58.413084 0.225842 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:58.639309 0.176845 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:58.816777 0.190472 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.007719 0.270858 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.279067 0.073987 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.353430 0.198250 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.552082 0.026776 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.579258 0.105203 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.684836 0.081309 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.766591 0.142762 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:40:59.909796 0.217043 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.127225 0.146502 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.274106 0.267806 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.507144 2.965070 tcp 10.0.2.105 55204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:41:00.542281 0.063613 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.606990 0.185581 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.792970 0.171777 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:00.965116 0.348356 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:01.313849 0.177588 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:01.491877 0.336663 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:01.828972 0.177022 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/17 12:41:08.320415 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:41:09.420600 0.000000 tcp 10.0.2.105 55204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:41:15.378208 2.977452 tcp 10.0.2.105 55205 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:41:24.298880 0.000000 tcp 10.0.2.105 55205 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:41:30.246695 2.316497 tcp 10.0.2.105 55206 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:41:32.563395 2.971694 tcp 10.0.2.105 55207 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:41:41.459826 0.000000 tcp 10.0.2.105 55207 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:42:53.986971 3.010845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 12:43:00.994848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:43:08.997097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:43:24.999908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:43:57.005540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:46:46.941418 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:46:46.941525 2.992492 tcp 10.0.2.105 55208 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:46:55.942970 0.000000 tcp 10.0.2.105 55208 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:01.943554 0.063981 tcp 10.0.2.105 55209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:02.007824 0.064437 tcp 10.0.2.105 55210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:02.072527 0.161674 tcp 10.0.2.105 55211 -> 195.113.214.249 443 SRPA* 0 0 25 14710 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:02.454170 3.002836 tcp 10.0.2.105 55212 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:11.455700 0.000000 tcp 10.0.2.105 55212 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:17.454349 0.061280 tcp 10.0.2.105 55213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:17.515977 0.061931 tcp 10.0.2.105 55214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:17.578215 0.170492 tcp 10.0.2.105 55215 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:17.964215 2.122106 tcp 10.0.2.105 55216 -> 46.48.223.67 15494 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:19.701404 0.063751 tcp 10.0.2.105 55217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:19.765543 0.072277 tcp 10.0.2.105 55218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:19.838154 0.155864 tcp 10.0.2.105 55219 -> 195.113.214.249 443 SRPA* 0 0 34 25686 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:20.086632 2.996082 tcp 10.0.2.105 55220 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:29.080889 0.000000 tcp 10.0.2.105 55220 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:35.080120 0.061662 tcp 10.0.2.105 55221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:35.142088 0.062040 tcp 10.0.2.105 55222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:35.204438 0.154744 tcp 10.0.2.105 55223 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:35.773577 3.001026 tcp 10.0.2.105 55224 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:44.773467 0.000000 tcp 10.0.2.105 55224 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:47:50.772483 0.061860 tcp 10.0.2.105 55225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:50.834619 0.063201 tcp 10.0.2.105 55226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:50.898155 0.154360 tcp 10.0.2.105 55227 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:47:51.675226 3.002560 tcp 10.0.2.105 55228 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:00.679101 0.000000 tcp 10.0.2.105 55228 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:06.675295 3.003886 tcp 10.0.2.105 55229 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:14.546453 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:48:15.677928 0.000000 tcp 10.0.2.105 55229 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:21.676777 1.719368 tcp 10.0.2.105 55230 -> 46.48.223.67 15494 FSPA* 0 0 14 1727 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:48:23.395847 2.997626 tcp 10.0.2.105 55231 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:32.401837 0.000000 tcp 10.0.2.105 55231 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:38.390814 2.994176 tcp 10.0.2.105 55232 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:47.390561 0.000000 tcp 10.0.2.105 55232 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:48:52.052587 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:53:53.393785 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:53:53.393868 3.003824 tcp 10.0.2.105 55233 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:02.396750 0.000000 tcp 10.0.2.105 55233 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:08.396836 0.061298 tcp 10.0.2.105 55234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:08.458416 0.067862 tcp 10.0.2.105 55235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:08.526567 0.156097 tcp 10.0.2.105 55236 -> 195.113.214.249 443 SRPA* 0 0 22 10794 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:08.907177 3.002994 tcp 10.0.2.105 55237 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:17.908632 0.000000 tcp 10.0.2.105 55237 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:23.907923 0.061012 tcp 10.0.2.105 55238 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:23.969285 0.061290 tcp 10.0.2.105 55239 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:24.030839 0.209297 tcp 10.0.2.105 55240 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:24.518613 3.584702 tcp 10.0.2.105 55241 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:27.532540 0.061446 tcp 10.0.2.105 55242 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:27.594281 0.068683 tcp 10.0.2.105 55243 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:27.663269 0.172916 tcp 10.0.2.105 55244 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:28.103532 3.004186 tcp 10.0.2.105 55245 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:37.106508 0.000000 tcp 10.0.2.105 55245 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:43.105609 0.059940 tcp 10.0.2.105 55246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:43.165860 0.067168 tcp 10.0.2.105 55247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:43.233344 0.153393 tcp 10.0.2.105 55248 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:43.657119 3.002887 tcp 10.0.2.105 55249 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:52.658798 0.000000 tcp 10.0.2.105 55249 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:54:58.657859 0.359011 tcp 10.0.2.105 55250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:59.017124 0.067854 tcp 10.0.2.105 55251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:59.085246 0.158688 tcp 10.0.2.105 55252 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:54:59.679702 2.980564 tcp 10.0.2.105 55253 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:08.601459 0.000000 tcp 10.0.2.105 55253 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:15.516078 2.959243 tcp 10.0.2.105 55254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:24.410642 0.000000 tcp 10.0.2.105 55254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:29.006655 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:55:30.334284 3.607138 tcp 10.0.2.105 55255 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/17 12:55:33.941673 2.970642 tcp 10.0.2.105 55256 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:36.875222 2.962263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 12:55:42.835352 0.000000 tcp 10.0.2.105 55256 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:43.795407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:55:48.758930 2.971262 tcp 10.0.2.105 55257 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:55:51.700486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:55:57.654653 0.000000 tcp 10.0.2.105 55257 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 12:56:02.588149 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 12:56:07.501367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 12:56:39.137875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:01:03.053796 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:01:03.053887 2.992750 tcp 10.0.2.105 55258 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:01:12.043754 0.000000 tcp 10.0.2.105 55258 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:01:18.055154 0.064125 tcp 10.0.2.105 55259 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:01:18.119563 0.061909 tcp 10.0.2.105 55260 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:01:18.181649 0.155521 tcp 10.0.2.105 55261 -> 195.113.214.249 443 SRPA* 0 0 36 19082 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:01:18.635273 3.002739 tcp 10.0.2.105 55262 -> 95.104.66.207 7362 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:01:27.636792 0.000000 tcp 10.0.2.105 55262 -> 95.104.66.207 7362 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:02:43.038536 3.004357 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:02:50.045196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:02:58.046754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:03:14.049393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:03:46.055539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:10:14.065651 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:10:21.073633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:10:29.074802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:10:45.083480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:11:11.626504 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:11:11.626601 0.184206 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:11.787946 0.058741 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:12.373922 0.206482 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:12.456419 0.451793 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2012 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:12.885451 0.189144 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:13.349177 0.178324 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:13.627262 0.085277 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:13.675821 0.170809 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:13.885866 0.243634 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:14.122067 0.183572 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:14.379639 0.209439 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:14.573361 0.289043 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:15.210302 0.112453 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:15.290178 0.200644 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:15.570416 0.032235 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:15.889677 0.123959 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:15.994199 0.221896 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:16.213564 0.170867 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:16.363299 0.240960 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2606 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:16.581589 0.084702 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:17.055144 0.122879 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:17.084057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:11:17.136166 0.157021 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:17.307139 0.192556 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:17.496145 0.178290 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:17.789140 0.349817 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:18.134860 0.190010 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:18.561635 0.361543 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:18.666744 3.003922 tcp 10.0.2.105 55263 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:11:18.896093 0.185712 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:11:27.669200 0.000000 tcp 10.0.2.105 55263 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:11:33.669843 0.067139 tcp 10.0.2.105 55264 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:33.737295 0.062992 tcp 10.0.2.105 55265 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:33.800605 0.166410 tcp 10.0.2.105 55266 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:34.236903 2.996068 tcp 10.0.2.105 55267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:11:43.241599 0.000000 tcp 10.0.2.105 55267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:11:49.231037 0.063803 tcp 10.0.2.105 55268 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:49.295084 0.064631 tcp 10.0.2.105 55269 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:49.360050 0.164329 tcp 10.0.2.105 55270 -> 195.113.214.249 443 SRPA* 0 0 22 10988 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:49.938148 3.529438 tcp 10.0.2.105 55271 -> 46.48.223.67 15494 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:52.980051 0.061668 tcp 10.0.2.105 55272 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:53.042022 0.061344 tcp 10.0.2.105 55273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:53.103676 0.157117 tcp 10.0.2.105 55274 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:11:53.467790 3.003301 tcp 10.0.2.105 55275 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:02.547588 0.000000 tcp 10.0.2.105 55275 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:08.495301 0.062662 tcp 10.0.2.105 55276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:08.558270 0.065088 tcp 10.0.2.105 55277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:08.623713 0.159815 tcp 10.0.2.105 55278 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:09.486277 0.878901 tcp 10.0.2.105 55279 -> 200.84.7.244 8038 FSPA* 0 0 13 1437 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:09.905802 0.061426 tcp 10.0.2.105 55280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:09.967520 0.066069 tcp 10.0.2.105 55281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:10.033955 0.165076 tcp 10.0.2.105 55282 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:10.365413 2.979125 tcp 10.0.2.105 55283 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:19.345681 0.000000 tcp 10.0.2.105 55283 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:25.352583 2.994115 tcp 10.0.2.105 55284 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:34.344908 0.000000 tcp 10.0.2.105 55284 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:39.041805 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:12:40.353772 3.242476 tcp 10.0.2.105 55285 -> 46.48.223.67 15494 FSPA* 0 0 14 1751 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:12:43.593793 2.999040 tcp 10.0.2.105 55286 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:52.591467 0.000000 tcp 10.0.2.105 55286 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:12:58.590237 0.419410 tcp 10.0.2.105 55287 -> 200.84.7.244 8038 FSPA* 0 0 13 1437 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:17:21.091122 3.000528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 13:17:28.097652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:17:36.098951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:17:52.101876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:17:59.002218 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:17:59.002310 2.993850 tcp 10.0.2.105 55288 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:07.994858 0.000000 tcp 10.0.2.105 55288 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:14.005322 0.065483 tcp 10.0.2.105 55289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:14.071083 0.061496 tcp 10.0.2.105 55290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:14.132975 0.150372 tcp 10.0.2.105 55291 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:14.318556 2.999741 tcp 10.0.2.105 55292 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:23.317003 0.000000 tcp 10.0.2.105 55292 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:24.108007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:18:29.316284 0.066389 tcp 10.0.2.105 55293 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:29.382977 0.067076 tcp 10.0.2.105 55294 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:29.450317 0.154627 tcp 10.0.2.105 55295 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:29.672901 4.127541 tcp 10.0.2.105 55296 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:33.125143 0.064446 tcp 10.0.2.105 55297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:33.189870 0.062822 tcp 10.0.2.105 55298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:33.253017 0.150550 tcp 10.0.2.105 55299 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:33.800703 2.995448 tcp 10.0.2.105 55300 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:42.795095 0.000000 tcp 10.0.2.105 55300 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 13:18:48.794101 0.060920 tcp 10.0.2.105 55301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:48.855315 0.063897 tcp 10.0.2.105 55302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:48.919473 0.165445 tcp 10.0.2.105 55303 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:18:49.378751 2.262571 tcp 10.0.2.105 55304 -> 200.84.7.244 8038 FSPA* 0 0 15 1593 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:24:30.117242 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:24:37.124181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:24:45.125788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:25:01.128898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:25:33.134549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:31:37.141891 3.081513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:31:44.193436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:31:52.160009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:32:08.162793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:32:40.168748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:38:44.174946 3.001519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:38:51.184493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:38:59.193963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:39:15.196920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:39:47.202976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:41:43.740544 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:41:43.740695 0.103923 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:43.845038 0.157906 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.003365 0.055124 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.058859 0.426096 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.485343 0.153519 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.639229 0.160952 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.800791 0.048005 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:44.849188 0.166723 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.016501 0.234142 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.251033 0.292133 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.543572 0.077074 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.621051 0.176631 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.798052 0.190466 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:45.988872 0.200357 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.189604 0.018569 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.208548 0.103943 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.312863 0.216909 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.530155 0.063247 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.593798 0.080688 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.675006 0.119713 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.795107 0.146977 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:46.942503 0.216294 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:47.159149 0.183590 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:47.343066 0.172575 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:47.516026 0.348737 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:47.865120 0.180057 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:48.045569 0.176694 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:41:48.222646 0.328376 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/17 13:45:51.208408 3.002176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:45:58.216481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:46:06.217827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:46:22.220701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:46:54.226279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:48:51.646256 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 13:48:51.646415 4.411714 tcp 10.0.2.105 55305 -> 200.84.7.244 8038 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/02/17 13:57:05.237603 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 13:57:12.245526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:57:20.252110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:57:36.249966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 13:58:08.255515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:04:12.262088 3.001097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:04:19.269548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:04:27.270877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:04:43.273630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:05:15.279954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:11:19.287863 2.999683 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:11:26.293160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:11:34.294330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:11:50.297923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:12:02.717082 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:12:02.717203 0.054231 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:02.771881 0.108143 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:02.880512 0.158004 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.038894 0.419686 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.458989 0.154721 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.614097 0.158271 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.772793 0.040265 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.813407 0.164114 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:03.977907 0.227860 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:04.206173 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 14:12:19.271527 0.060540 tcp 10.0.2.105 55306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:19.332357 0.063680 tcp 10.0.2.105 55307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:19.396476 0.168342 tcp 10.0.2.105 55308 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:19.565425 0.079961 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:19.645737 0.175794 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:19.821894 0.190916 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.013242 0.200833 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.214408 0.024682 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.239441 0.104983 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.610021 0.208511 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.818990 0.060633 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.880009 0.093362 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:20.973780 0.116650 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:21.090773 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 14:12:22.303794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:12:39.198577 0.060215 tcp 10.0.2.105 55309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:39.259030 0.061601 tcp 10.0.2.105 55310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:39.320931 0.153625 tcp 10.0.2.105 55311 -> 195.113.214.249 443 SRPA* 0 0 23 12060 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:12:39.475258 0.257415 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:39.733141 0.185790 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:39.919319 0.176814 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:40.149282 0.178575 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:40.328336 0.172314 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:40.501028 0.347891 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:12:40.849300 0.322448 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:18:26.309566 3.002101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:18:33.317333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:18:41.322720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:18:56.060743 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:18:56.060855 1.311327 tcp 10.0.2.105 55312 -> 200.84.7.244 8038 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:18:57.321982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:19:29.327988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:25:36.338183 3.001784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:25:43.345618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:25:51.347015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:26:07.350110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:26:39.356385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:32:43.362023 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:32:50.372850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:32:58.392590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:33:14.383883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:33:46.392478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:39:50.397008 3.000598 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:39:57.403367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:40:05.404936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:40:21.414082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:40:53.413641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:42:45.195312 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:42:45.195411 0.296709 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.492513 0.157735 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.650651 0.074629 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.725643 0.054645 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.780649 0.150146 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.931194 0.049035 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:45.980641 0.169049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:46.150114 0.290898 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:46.441373 0.443778 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:46.885532 0.157838 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.043745 0.155166 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.237503 0.173827 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.411757 0.190149 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.602304 0.201092 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.803842 0.025392 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.829591 0.104234 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:47.934232 0.218344 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.152999 0.064907 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.218284 0.084458 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.303181 0.076416 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.379975 0.115999 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.496551 0.177373 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.674326 0.179242 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:48.853933 0.171091 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:49.025477 0.347481 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:49.373399 0.223684 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:49.597449 0.187315 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:42:49.785180 0.329031 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/17 14:46:57.420047 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 14:47:04.427613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:47:12.428953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:47:28.431847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:48:00.438184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:48:57.380388 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:48:57.380473 0.209825 tcp 10.0.2.105 55313 -> 200.84.7.244 8038 SPA_* 0 0 9 1034 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:27.585458 0.066517 tcp 10.0.2.105 55314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:27.652387 0.208384 tcp 10.0.2.105 55315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:27.857762 0.347715 tcp 10.0.2.105 55313 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:27.858470 0.162395 tcp 10.0.2.105 55316 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:28.205713 3.002896 tcp 10.0.2.105 55317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:49:37.207119 0.000000 tcp 10.0.2.105 55317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:49:43.206507 0.064834 tcp 10.0.2.105 55318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:43.271665 0.062348 tcp 10.0.2.105 55319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:43.334323 0.148032 tcp 10.0.2.105 55320 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:43.804547 3.381306 tcp 10.0.2.105 55321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:49:53.127170 0.000000 tcp 10.0.2.105 55321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:49:59.074983 0.060745 tcp 10.0.2.105 55322 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:59.136109 0.061408 tcp 10.0.2.105 55323 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:59.197850 0.157808 tcp 10.0.2.105 55324 -> 195.113.214.249 443 SRPA* 0 0 23 12930 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:49:59.518356 2.274685 tcp 10.0.2.105 55325 -> 46.48.223.67 15494 FSPA* 0 0 14 1564 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:01.321430 0.060346 tcp 10.0.2.105 55326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:01.382062 0.060952 tcp 10.0.2.105 55327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:01.443336 0.152562 tcp 10.0.2.105 55328 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:01.793302 2.968062 tcp 10.0.2.105 55329 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:10.706067 0.000000 tcp 10.0.2.105 55329 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:16.652929 0.060441 tcp 10.0.2.105 55330 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:16.713659 0.065665 tcp 10.0.2.105 55331 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:16.779590 0.153938 tcp 10.0.2.105 55332 -> 195.113.214.249 443 SRPA* 0 0 36 19630 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:17.222299 0.426391 tcp 10.0.2.105 55333 -> 200.84.7.244 8038 FSPA* 0 0 13 1250 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:17.648914 2.982007 tcp 10.0.2.105 55334 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:26.571524 0.000000 tcp 10.0.2.105 55334 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:32.556877 3.005896 tcp 10.0.2.105 55335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:41.559557 0.000000 tcp 10.0.2.105 55335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:50:46.546743 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:50:47.558762 0.354296 tcp 10.0.2.105 55336 -> 46.48.223.67 15494 SPA_* 0 0 9 1034 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:55.227966 0.000540 tcp 10.0.2.105 55336 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:50:55.228780 2.994776 tcp 10.0.2.105 55337 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:51:04.232212 0.000000 tcp 10.0.2.105 55337 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:54:04.443466 3.002163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 14:54:11.451310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:54:19.453126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:54:35.456759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:55:07.461860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 14:56:10.222187 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 14:56:10.222360 2.994235 tcp 10.0.2.105 55338 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:56:19.217760 0.000000 tcp 10.0.2.105 55338 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:56:25.224997 0.066999 tcp 10.0.2.105 55339 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:25.292302 0.069686 tcp 10.0.2.105 55340 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:25.362311 0.160742 tcp 10.0.2.105 55341 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:25.641646 2.997165 tcp 10.0.2.105 55342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:56:34.637237 0.000000 tcp 10.0.2.105 55342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:56:40.636593 0.063882 tcp 10.0.2.105 55343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:40.700812 0.064462 tcp 10.0.2.105 55344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:40.765602 0.165543 tcp 10.0.2.105 55345 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:41.102917 0.359970 tcp 10.0.2.105 55346 -> 46.48.223.67 15494 SPA_* 0 0 9 1020 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:50.589913 0.694410 tcp 10.0.2.105 55346 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:50.590808 0.063210 tcp 10.0.2.105 55347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:50.654294 0.064301 tcp 10.0.2.105 55348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:50.718949 0.160837 tcp 10.0.2.105 55349 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:56:51.284559 3.000887 tcp 10.0.2.105 55350 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:57:00.283961 0.000000 tcp 10.0.2.105 55350 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 14:57:06.283944 0.065322 tcp 10.0.2.105 55351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:57:06.349587 0.062053 tcp 10.0.2.105 55352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:57:06.411919 0.171210 tcp 10.0.2.105 55353 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/17 14:57:06.713982 1.346057 tcp 10.0.2.105 55354 -> 200.84.7.244 8038 FSPA* 0 0 15 1581 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:01:11.468323 3.183431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 15:01:18.620358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:01:26.544114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:01:42.490827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:02:14.496132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:08:18.501962 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 15:08:25.509434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:08:33.510958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:08:49.514075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:09:21.520070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:12:52.573050 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:12:52.573195 0.348023 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:52.930264 0.170011 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:53.079851 0.211072 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:53.165374 0.059025 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:53.591755 0.201484 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:54.797057 0.098647 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:54.857353 0.333539 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:55.772351 0.180430 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:55.930457 0.185052 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:56.313118 0.239281 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:56.545426 0.468645 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:56.990474 0.183326 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:57.380692 0.207327 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:57.572467 0.206464 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:57.977210 0.019865 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:58.268176 0.123998 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:58.583831 0.215341 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:58.824775 0.087884 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:58.891750 0.127989 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:58.976386 0.110350 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:59.192658 0.194877 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:59.380689 0.174648 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:12:59.717258 0.349472 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:13:00.062505 0.310969 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:13:00.502545 0.185440 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:13:00.680353 0.399675 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:13:01.052834 0.238524 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:13:01.270981 0.195495 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:15:25.525222 3.002570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 15:15:32.533229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:15:40.537033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:15:56.537861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:16:28.543671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:22:38.558631 3.001870 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 15:22:45.565924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:22:53.567644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:23:09.570505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:23:41.576886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:27:08.063570 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:27:08.063656 1.215011 tcp 10.0.2.105 55355 -> 200.84.7.244 8038 FSPA* 0 0 13 1350 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:08.605718 0.069290 tcp 10.0.2.105 55356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:08.675294 0.062143 tcp 10.0.2.105 55357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:08.737816 0.153194 tcp 10.0.2.105 55358 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:09.278949 3.000472 tcp 10.0.2.105 55359 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:27:18.277883 0.000000 tcp 10.0.2.105 55359 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:27:24.277017 0.063403 tcp 10.0.2.105 55360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:24.340706 0.060800 tcp 10.0.2.105 55361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:24.401821 0.159122 tcp 10.0.2.105 55362 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:24.643209 3.008277 tcp 10.0.2.105 55363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:27:33.653670 0.000000 tcp 10.0.2.105 55363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:27:39.639753 0.063099 tcp 10.0.2.105 55364 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:39.703106 0.062963 tcp 10.0.2.105 55365 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:39.766374 0.153500 tcp 10.0.2.105 55366 -> 195.113.214.249 443 SRPA* 0 0 22 10988 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:39.973416 0.344866 tcp 10.0.2.105 55367 -> 46.48.223.67 15494 SPA_* 0 0 9 1134 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:46.061410 0.358415 tcp 10.0.2.105 55367 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:46.062334 0.066052 tcp 10.0.2.105 55368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:46.128687 0.065003 tcp 10.0.2.105 55369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:46.193939 0.165324 tcp 10.0.2.105 55370 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:27:46.420146 3.003436 tcp 10.0.2.105 55371 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:27:55.431407 0.000000 tcp 10.0.2.105 55371 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:01.423545 0.066049 tcp 10.0.2.105 55372 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:01.489886 0.067322 tcp 10.0.2.105 55373 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:01.557524 0.150864 tcp 10.0.2.105 55374 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:02.051323 0.283837 tcp 10.0.2.105 55375 -> 200.84.7.244 8038 SPA_* 0 0 9 1134 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:12.617591 0.000637 tcp 10.0.2.105 55375 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:12.618106 3.002366 tcp 10.0.2.105 55376 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:21.619184 0.000000 tcp 10.0.2.105 55376 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:27.617977 3.004090 tcp 10.0.2.105 55377 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:36.620816 0.000000 tcp 10.0.2.105 55377 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:41.547629 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:28:42.619521 0.340146 tcp 10.0.2.105 55378 -> 46.48.223.67 15494 SPA_* 0 0 9 1134 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:48.984071 0.096688 tcp 10.0.2.105 55378 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:28:49.080960 3.001936 tcp 10.0.2.105 55379 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:28:58.091114 0.000000 tcp 10.0.2.105 55379 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:29:47.585817 3.001180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 15:29:54.592764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:30:02.595733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:30:18.597268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:30:50.655232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:34:04.081724 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:34:04.081868 2.993628 tcp 10.0.2.105 55380 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:13.074479 0.000000 tcp 10.0.2.105 55380 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:19.085002 0.064021 tcp 10.0.2.105 55381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:19.149336 0.062394 tcp 10.0.2.105 55382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:19.211977 0.167829 tcp 10.0.2.105 55383 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:20.163630 3.005517 tcp 10.0.2.105 55384 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:29.167661 0.000000 tcp 10.0.2.105 55384 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:35.156243 0.066281 tcp 10.0.2.105 55385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:35.222832 0.067846 tcp 10.0.2.105 55386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:35.290986 0.153833 tcp 10.0.2.105 55387 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:35.701533 0.348290 tcp 10.0.2.105 55388 -> 46.48.223.67 15494 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:40.799636 0.849405 tcp 10.0.2.105 55388 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:40.800442 0.488931 tcp 10.0.2.105 55389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:41.289690 0.065398 tcp 10.0.2.105 55390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:41.355407 0.153435 tcp 10.0.2.105 55391 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:41.649296 2.978789 tcp 10.0.2.105 55392 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:50.571086 0.000000 tcp 10.0.2.105 55392 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:34:56.501137 0.060614 tcp 10.0.2.105 55393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:56.562116 0.062695 tcp 10.0.2.105 55394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:56.625103 0.148989 tcp 10.0.2.105 55395 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:57.131876 0.869566 tcp 10.0.2.105 55396 -> 200.84.7.244 8038 FSPA* 0 0 13 1209 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:57.681915 0.067270 tcp 10.0.2.105 55397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:57.749478 0.064720 tcp 10.0.2.105 55398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:57.814483 0.153645 tcp 10.0.2.105 55399 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:34:58.001735 2.974779 tcp 10.0.2.105 55400 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:06.929213 0.000000 tcp 10.0.2.105 55400 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:12.862737 3.004027 tcp 10.0.2.105 55401 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:21.819318 0.000000 tcp 10.0.2.105 55401 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:26.563131 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:35:27.772458 1.775686 tcp 10.0.2.105 55402 -> 46.48.223.67 15494 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:35:29.541829 2.996863 tcp 10.0.2.105 55403 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:38.537482 0.000000 tcp 10.0.2.105 55403 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:35:44.536612 0.555338 tcp 10.0.2.105 55404 -> 200.84.7.244 8038 FSPA* 0 0 13 1209 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:36:54.619600 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 15:37:01.626713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:37:09.628781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:37:25.631134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:37:57.637439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:40:45.088792 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:40:45.088901 3.003487 tcp 10.0.2.105 55405 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:40:54.090772 0.000000 tcp 10.0.2.105 55405 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:41:00.091478 0.063717 tcp 10.0.2.105 55406 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:00.155481 0.064156 tcp 10.0.2.105 55407 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:00.220000 0.157739 tcp 10.0.2.105 55408 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:00.838814 2.996403 tcp 10.0.2.105 55409 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:41:09.833566 0.000000 tcp 10.0.2.105 55409 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:41:15.833362 0.063274 tcp 10.0.2.105 55410 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:15.896992 0.061173 tcp 10.0.2.105 55411 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:15.958474 0.157492 tcp 10.0.2.105 55412 -> 195.113.214.249 443 SRPA* 0 0 42 22478 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:16.406780 3.798081 tcp 10.0.2.105 55413 -> 46.48.223.67 15494 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:19.576859 0.064427 tcp 10.0.2.105 55414 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:19.641518 0.062220 tcp 10.0.2.105 55415 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:19.704097 0.158564 tcp 10.0.2.105 55416 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:20.205107 3.007665 tcp 10.0.2.105 55417 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:41:29.221511 0.000000 tcp 10.0.2.105 55417 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 15:41:35.203621 0.064211 tcp 10.0.2.105 55418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:35.268073 0.065115 tcp 10.0.2.105 55419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:35.333547 0.152364 tcp 10.0.2.105 55420 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:41:36.051992 3.247091 tcp 10.0.2.105 55421 -> 200.84.7.244 8038 FSPA* 0 0 15 1749 flow=From-Botnet-V2-TCP-Established 1970/02/17 15:43:13.992493 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 15:43:13.992602 0.087189 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.080374 0.054835 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.135557 0.334629 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.470594 0.146818 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.617753 0.157088 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.775268 0.043172 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.818786 0.166544 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:14.985754 0.158202 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:15.144308 0.157036 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:15.301708 0.176117 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:15.478187 0.228750 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:15.707384 0.435221 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.143028 0.190540 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.334057 0.205142 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.539548 0.028494 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.568435 0.104420 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.673258 0.081580 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.755269 0.079443 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:16.835082 0.178431 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.013892 0.217934 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.232255 0.063118 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.295736 0.172239 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.468388 0.348300 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.817084 0.120204 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:17.937764 0.176565 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:18.114758 0.187515 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:18.302697 0.333762 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:43:18.636905 0.225353 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/17 15:44:01.644767 3.000834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 15:44:08.653572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:44:16.652304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:44:32.655210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:45:04.661325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:56:12.675508 3.000432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 15:56:19.684423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:56:27.683174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:56:43.686241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 15:57:15.703714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:03:19.707887 3.004021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:03:26.715953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:03:34.717727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:03:50.719996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:04:22.726003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:10:36.736557 3.021486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:10:43.754269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:10:51.755448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:11:07.758200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:11:39.304672 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:11:39.304904 1.565337 tcp 10.0.2.105 55422 -> 200.84.7.244 8038 FSPA* 0 0 13 1226 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:39.764060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:11:39.941117 0.064988 tcp 10.0.2.105 55423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:40.006449 0.064368 tcp 10.0.2.105 55424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:40.071101 0.151730 tcp 10.0.2.105 55425 -> 195.113.214.249 443 SRPA* 0 0 29 15268 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:40.870495 2.999429 tcp 10.0.2.105 55426 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:11:49.869179 0.000000 tcp 10.0.2.105 55426 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:11:55.868365 0.059891 tcp 10.0.2.105 55427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:55.928547 0.062033 tcp 10.0.2.105 55428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:55.990868 0.154073 tcp 10.0.2.105 55429 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:11:56.360863 3.001764 tcp 10.0.2.105 55430 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:05.371333 0.000000 tcp 10.0.2.105 55430 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:11.360633 0.061695 tcp 10.0.2.105 55431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:11.422597 0.064759 tcp 10.0.2.105 55432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:11.487615 0.157178 tcp 10.0.2.105 55433 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:12.366293 2.402948 tcp 10.0.2.105 55434 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:14.166087 0.061345 tcp 10.0.2.105 55435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:14.227743 0.065578 tcp 10.0.2.105 55436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:14.293600 0.156774 tcp 10.0.2.105 55437 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:14.769458 2.999615 tcp 10.0.2.105 55438 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:23.769918 0.000000 tcp 10.0.2.105 55438 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:29.767017 0.063205 tcp 10.0.2.105 55439 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:29.830525 0.065272 tcp 10.0.2.105 55440 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:29.896076 0.368558 tcp 10.0.2.105 55441 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:30.482835 0.632140 tcp 10.0.2.105 55442 -> 200.84.7.244 8038 FSPA* 0 0 13 1226 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:12:31.115298 3.009592 tcp 10.0.2.105 55443 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:40.131426 0.000000 tcp 10.0.2.105 55443 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:46.110512 2.993556 tcp 10.0.2.105 55444 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:12:55.442727 0.000000 tcp 10.0.2.105 55444 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:13:00.325466 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:13:01.389367 0.365250 tcp 10.0.2.105 55445 -> 46.48.223.67 15494 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:13:13.331787 0.000371 tcp 10.0.2.105 55445 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:13:13.332445 2.977626 tcp 10.0.2.105 55446 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:13:21.309991 0.214508 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:21.389315 0.058499 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:21.939399 0.338266 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:22.272018 0.000000 tcp 10.0.2.105 55446 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:13:22.340688 0.168232 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:22.490400 0.180045 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:22.845081 0.086152 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:22.891661 0.171254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:23.200737 0.180715 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:23.358428 0.762311 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:24.122807 0.443143 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:24.544149 0.191052 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:24.713005 0.182438 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 1907 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:25.606188 0.209824 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:25.798555 0.199452 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:26.579692 0.025802 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:26.686423 0.126394 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:27.019147 0.131670 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:27.754751 0.205776 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:27.926553 0.198521 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:28.117332 0.217216 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:28.331735 0.084928 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:28.743239 0.177092 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:29.637442 0.348711 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:30.010491 0.207065 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:30.140792 0.182080 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2617 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:30.314703 0.272707 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:30.567610 0.187837 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2549 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:13:31.207959 0.396514 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:17:43.770535 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 16:17:50.778054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:17:58.896395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:18:14.792616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:18:28.162357 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:18:28.162527 2.993472 tcp 10.0.2.105 55447 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:18:37.154523 0.000000 tcp 10.0.2.105 55447 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:18:43.164581 0.062074 tcp 10.0.2.105 55448 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:18:43.226949 0.061078 tcp 10.0.2.105 55449 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:18:43.288471 0.151387 tcp 10.0.2.105 55450 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:18:44.660950 2.999002 tcp 10.0.2.105 55451 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:18:46.798741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:18:53.658519 0.000000 tcp 10.0.2.105 55451 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:18:59.657949 0.060386 tcp 10.0.2.105 55452 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:18:59.718670 0.065263 tcp 10.0.2.105 55453 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:18:59.784214 0.155106 tcp 10.0.2.105 55454 -> 195.113.214.249 443 SRPA* 0 0 41 33160 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:00.117753 2.177066 tcp 10.0.2.105 55455 -> 46.48.223.67 15494 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:01.887055 0.065868 tcp 10.0.2.105 55456 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:01.953224 0.064630 tcp 10.0.2.105 55457 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:02.018184 0.152504 tcp 10.0.2.105 55458 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:02.295080 3.000041 tcp 10.0.2.105 55459 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:19:11.293384 0.000000 tcp 10.0.2.105 55459 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:19:17.293029 1.859058 tcp 10.0.2.105 55460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:19.151866 0.065111 tcp 10.0.2.105 55461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:19.217252 0.162420 tcp 10.0.2.105 55462 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:19:19.572625 1.935176 tcp 10.0.2.105 55463 -> 200.84.7.244 8038 FSPA* 0 0 15 1621 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:24:50.804577 3.633083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:24:58.399878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:25:06.306497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:25:22.106120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:25:53.842701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:31:57.848427 3.001805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:32:04.856164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:32:12.867663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:32:28.870552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:33:00.876636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:39:04.882318 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:39:11.889978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:39:19.891635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:39:35.894827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:40:07.900703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:43:37.021523 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:43:37.021676 0.079611 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.101767 0.146776 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.248921 0.055104 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.304447 0.326739 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.631529 0.232084 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.864015 0.049924 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:37.914377 0.170052 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:38.084772 0.156965 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:38.242154 0.231977 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:38.474579 0.447139 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:38.922171 0.157567 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.080138 0.178223 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.258856 0.193768 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.453002 0.214640 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.668033 0.026798 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 586 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.695261 0.104996 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.800677 0.081548 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:39.882642 0.219199 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:40.102203 0.080717 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:40.183382 0.183230 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:40.367075 0.062478 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:40.429941 0.171616 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:40.689716 0.350064 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:41.040150 0.141160 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:41.181758 0.181244 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:41.363392 0.216589 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:41.580451 0.183391 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:43:41.764352 0.327161 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/17 16:46:11.906312 3.002234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 16:46:18.913883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:46:26.915486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:46:42.921394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:47:14.924569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:49:19.924879 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:49:19.925091 1.265281 tcp 10.0.2.105 55464 -> 200.84.7.244 8038 FSPA* 0 0 13 1428 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:20.542704 0.061960 tcp 10.0.2.105 55465 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:20.604935 0.067988 tcp 10.0.2.105 55466 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:20.673192 0.155239 tcp 10.0.2.105 55467 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:21.190608 2.999576 tcp 10.0.2.105 55468 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:49:30.189023 0.000000 tcp 10.0.2.105 55468 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:49:36.188371 0.060085 tcp 10.0.2.105 55469 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:36.248774 0.065529 tcp 10.0.2.105 55470 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:36.314575 0.154138 tcp 10.0.2.105 55471 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:36.605053 3.007951 tcp 10.0.2.105 55472 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:49:45.611165 0.000000 tcp 10.0.2.105 55472 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:49:51.600652 0.059999 tcp 10.0.2.105 55473 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:51.660940 0.060960 tcp 10.0.2.105 55474 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:51.722176 0.153111 tcp 10.0.2.105 55475 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:49:52.177591 0.724140 tcp 10.0.2.105 55476 -> 46.48.223.67 15494 SPA_* 0 0 9 1212 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:03.740056 0.876931 tcp 10.0.2.105 55476 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:03.741023 0.063780 tcp 10.0.2.105 55477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:03.805127 0.067638 tcp 10.0.2.105 55478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:03.873026 0.155780 tcp 10.0.2.105 55479 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:04.617276 3.005337 tcp 10.0.2.105 55480 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:13.631565 0.000000 tcp 10.0.2.105 55480 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:19.610775 0.064742 tcp 10.0.2.105 55481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:19.675797 0.063516 tcp 10.0.2.105 55482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:19.739174 0.152936 tcp 10.0.2.105 55483 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:19.909888 0.632883 tcp 10.0.2.105 55484 -> 200.84.7.244 8038 FSPA* 0 0 13 1428 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:50:20.543008 3.002690 tcp 10.0.2.105 55485 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:29.544523 0.000000 tcp 10.0.2.105 55485 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:35.543220 3.005654 tcp 10.0.2.105 55486 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:44.546015 0.000000 tcp 10.0.2.105 55486 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:50:49.545110 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:50:50.544949 0.356869 tcp 10.0.2.105 55487 -> 46.48.223.67 15494 SPA_* 0 0 9 1212 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:51:03.273472 0.000388 tcp 10.0.2.105 55487 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:51:03.274135 3.003097 tcp 10.0.2.105 55488 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:51:12.275708 0.000000 tcp 10.0.2.105 55488 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:53:18.930485 3.001770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 16:53:25.937971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:53:33.939674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:53:49.941984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:54:21.948624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 16:56:18.275865 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 16:56:18.276013 3.003845 tcp 10.0.2.105 55489 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:56:27.279352 0.000000 tcp 10.0.2.105 55489 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:56:33.279506 0.069099 tcp 10.0.2.105 55490 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:33.348912 0.065882 tcp 10.0.2.105 55491 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:33.415074 0.153603 tcp 10.0.2.105 55492 -> 195.113.214.249 443 SRPA* 0 0 20 11288 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:34.019630 3.003114 tcp 10.0.2.105 55493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:56:43.021498 0.000000 tcp 10.0.2.105 55493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:56:50.919654 0.061305 tcp 10.0.2.105 55494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:50.981187 0.063544 tcp 10.0.2.105 55495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:51.045042 0.153441 tcp 10.0.2.105 55496 -> 195.113.214.249 443 SRPA* 0 0 34 17586 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:51.869214 0.358862 tcp 10.0.2.105 55497 -> 46.48.223.67 15494 SPA_* 0 0 9 1170 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:59.851523 0.533499 tcp 10.0.2.105 55497 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:59.852325 0.064035 tcp 10.0.2.105 55498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:59.916139 0.065228 tcp 10.0.2.105 55499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:56:59.981646 0.157827 tcp 10.0.2.105 55500 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:57:00.385275 2.959288 tcp 10.0.2.105 55501 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:57:09.271204 0.000000 tcp 10.0.2.105 55501 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 16:57:15.200962 0.060677 tcp 10.0.2.105 55502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:57:15.261981 0.062061 tcp 10.0.2.105 55503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:57:15.324339 0.157084 tcp 10.0.2.105 55504 -> 195.113.214.249 443 SRPA* 0 0 32 23228 flow=From-Botnet-V2-TCP-Established 1970/02/17 16:57:15.555742 2.157788 tcp 10.0.2.105 55505 -> 200.84.7.244 8038 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:00:25.953802 3.002425 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 17:00:32.962032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:00:40.962889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:00:56.966564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:01:28.972738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:07:32.979332 3.005415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:07:39.986537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:07:47.987579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:08:03.993441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:08:35.996217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:13:56.417353 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 17:13:56.417447 0.073172 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:56.491063 0.147610 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:56.639078 0.054939 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:56.694395 0.330628 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.025464 0.162242 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.188117 0.043546 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.232104 0.175102 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.407742 0.427206 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.835378 0.157879 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:57.993656 0.155628 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.149648 0.229682 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.379694 0.185640 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.565707 0.191638 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.757720 0.200536 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.958626 0.026808 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:58.985883 0.105275 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.091579 0.081628 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.173590 0.208399 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.382361 0.078995 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.461735 0.183455 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.645611 0.062101 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.708067 0.171114 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:13:59.879545 0.347794 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:00.227734 0.111322 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:00.339429 0.185700 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:00.525571 0.356362 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:00.882284 0.180127 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:01.062854 0.235061 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:14:40.002484 3.001626 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:14:47.012926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:14:55.011491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:15:11.014252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:15:43.020850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:21:48.028543 3.001166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:21:55.035302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:22:03.036461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:22:19.039724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:22:51.045622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:27:16.127232 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 17:27:16.127422 1.671180 tcp 10.0.2.105 55506 -> 200.84.7.244 8038 FSPA* 0 0 13 1270 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:16.563140 0.064104 tcp 10.0.2.105 55507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:16.627535 0.063052 tcp 10.0.2.105 55508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:16.690916 0.160875 tcp 10.0.2.105 55509 -> 195.113.214.249 443 SRPA* 0 0 33 17670 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:17.798826 2.994804 tcp 10.0.2.105 55510 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:27:26.802371 0.000000 tcp 10.0.2.105 55510 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:27:32.791654 0.059811 tcp 10.0.2.105 55511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:32.851754 0.065651 tcp 10.0.2.105 55512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:32.917700 0.156536 tcp 10.0.2.105 55513 -> 195.113.214.249 443 SRPA* 0 0 24 11526 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:33.313121 3.002445 tcp 10.0.2.105 55514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:27:42.314799 0.000000 tcp 10.0.2.105 55514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:27:48.856096 0.063666 tcp 10.0.2.105 55515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:48.920040 0.065272 tcp 10.0.2.105 55516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:48.985638 0.153148 tcp 10.0.2.105 55517 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:27:49.268543 0.361644 tcp 10.0.2.105 55518 -> 46.48.223.67 15494 SPA_* 0 0 9 1054 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:04.630709 0.375796 tcp 10.0.2.105 55518 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:04.631644 0.063327 tcp 10.0.2.105 55519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:04.695276 0.065778 tcp 10.0.2.105 55520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:04.761329 0.153982 tcp 10.0.2.105 55521 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:05.006761 2.979393 tcp 10.0.2.105 55522 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:13.911697 0.000000 tcp 10.0.2.105 55522 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:19.826562 0.060978 tcp 10.0.2.105 55523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:19.887809 0.062140 tcp 10.0.2.105 55524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:19.950235 0.165144 tcp 10.0.2.105 55525 -> 195.113.214.249 443 SRPA* 0 0 53 50544 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:20.598330 0.431552 tcp 10.0.2.105 55526 -> 200.84.7.244 8038 FSPA* 0 0 13 1270 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:21.030116 2.959105 tcp 10.0.2.105 55527 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:29.929392 0.000000 tcp 10.0.2.105 55527 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:35.861780 2.993844 tcp 10.0.2.105 55528 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:44.854634 0.000000 tcp 10.0.2.105 55528 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:28:49.541081 0.127482 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 17:28:50.968214 0.360953 tcp 10.0.2.105 55529 -> 46.48.223.67 15494 SPA_* 0 0 9 1054 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:55.123159 2.976902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 17:28:59.955583 0.000405 tcp 10.0.2.105 55529 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:28:59.956373 2.979631 tcp 10.0.2.105 55530 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:29:02.071454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:29:08.928987 0.000000 tcp 10.0.2.105 55530 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 17:29:10.060828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:29:26.063611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:29:58.069724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:34:14.928942 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 17:34:14.929027 1.966087 tcp 10.0.2.105 55531 -> 200.84.7.244 8038 FSPA* 0 0 15 1637 flow=From-Botnet-V2-TCP-Established 1970/02/17 17:36:02.075451 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:36:09.084550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:36:17.084152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:36:33.087955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:37:05.093664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:43:09.098938 3.257930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:43:16.318460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:43:24.253851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:43:40.121874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:44:02.183690 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 17:44:02.183851 0.224845 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:02.266563 0.321925 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:02.587898 0.177560 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:02.948464 0.168153 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:03.097207 0.058040 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:03.283079 0.084306 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:03.331078 0.173636 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:04.051297 0.447957 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:04.477221 0.243402 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:04.714183 0.189619 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:05.033823 0.184394 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:05.195956 0.180725 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:05.601073 0.210771 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:05.794206 0.206445 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:06.170296 0.024795 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:06.491922 0.125375 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:06.597550 0.127353 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:06.802478 0.195466 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:06.990851 0.087110 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:07.364320 0.214421 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:07.575564 0.110298 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:07.652336 0.177449 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:07.950229 0.360760 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:08.307092 0.180699 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:08.459071 0.183442 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:08.782927 0.189394 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:08.968837 0.358192 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:09.300529 0.306940 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/17 17:44:12.127734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:55:42.142768 3.001246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 17:55:49.150072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:55:57.151290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:56:13.157995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 17:56:45.160764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:02:49.166323 3.005014 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:02:56.173989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:03:04.175264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:03:20.178580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:03:52.184279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:04:16.900768 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 18:04:16.900865 1.804068 tcp 10.0.2.105 55532 -> 200.84.7.244 8038 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:10:18.192075 3.001481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:10:25.199642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:10:33.201129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:10:49.203806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:11:21.210070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:14:12.726516 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 18:14:12.726662 0.150901 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:12.877951 0.147330 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.025681 0.085537 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.111564 0.344828 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.456749 0.055787 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.512872 0.045832 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.559064 0.169160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.728628 0.159876 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:13.888849 0.156422 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:14.045668 0.422495 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:14.468559 0.226029 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:14.694915 0.175609 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:14.870976 0.191586 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.063025 0.199694 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.263075 0.021647 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.285124 0.181087 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.466586 0.103494 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.570485 0.080664 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.651547 0.062307 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.714282 0.207694 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:15.922344 0.077428 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:16.000189 0.170784 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:16.171357 0.174912 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:16.346631 0.183137 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:16.530114 0.345826 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:16.876427 0.233583 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:17.110472 0.326781 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:14:17.437629 0.269805 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:17:25.218259 3.003431 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:17:32.223879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:17:40.224966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:17:58.230874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:18:30.166510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:24:32.259992 3.177088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:24:39.399292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:24:47.328378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:25:03.281875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:25:35.421765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:31:41.307582 3.000915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:31:48.314171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:31:56.315909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:32:12.627990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:32:44.343891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:34:18.711625 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 18:34:18.711717 1.522003 tcp 10.0.2.105 55533 -> 200.84.7.244 8038 FSPA* 0 0 13 1334 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:19.143777 0.067976 tcp 10.0.2.105 55534 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:19.211992 0.063474 tcp 10.0.2.105 55535 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:19.275719 0.158811 tcp 10.0.2.105 55536 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:20.233974 3.003007 tcp 10.0.2.105 55537 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:34:29.235620 0.000000 tcp 10.0.2.105 55537 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:34:35.234702 0.064119 tcp 10.0.2.105 55538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:35.299144 0.065106 tcp 10.0.2.105 55539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:35.364588 0.165086 tcp 10.0.2.105 55540 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:35.594659 2.994459 tcp 10.0.2.105 55541 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:34:44.587601 0.000000 tcp 10.0.2.105 55541 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:34:50.598804 0.063948 tcp 10.0.2.105 55542 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:50.663023 0.062981 tcp 10.0.2.105 55543 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:50.726334 0.154053 tcp 10.0.2.105 55544 -> 195.113.214.249 443 SRPA* 0 0 31 22144 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:51.093975 0.365040 tcp 10.0.2.105 55545 -> 46.48.223.67 15494 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:58.064188 0.351587 tcp 10.0.2.105 55545 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:58.065155 0.060585 tcp 10.0.2.105 55546 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:58.126067 0.064129 tcp 10.0.2.105 55547 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:58.190470 0.154385 tcp 10.0.2.105 55548 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:34:58.415975 3.006047 tcp 10.0.2.105 55549 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:35:07.420177 0.000000 tcp 10.0.2.105 55549 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 18:35:13.409858 0.062950 tcp 10.0.2.105 55550 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:35:13.473058 0.061980 tcp 10.0.2.105 55551 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:35:13.535292 0.150466 tcp 10.0.2.105 55552 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:35:13.756395 1.554157 tcp 10.0.2.105 55553 -> 200.84.7.244 8038 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/17 18:38:48.340554 3.002089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 18:38:55.348158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:39:03.349899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:39:19.352888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:39:51.358885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:44:45.849842 0.211574 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 18:44:46.061476 0.083127 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.144991 0.357680 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.503046 0.056969 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.560427 0.049834 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.610614 0.149765 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.760757 0.147395 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:46.908589 0.166329 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.075295 0.158079 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.233804 0.164438 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.398659 0.175551 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.574605 0.196366 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.771506 0.198414 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:47.970383 0.435577 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:48.406336 0.233709 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:48.640581 0.022242 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:48.663244 0.213672 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:48.877323 0.103964 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:48.981969 0.081292 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.063617 0.064166 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.128170 0.217072 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.345623 0.079619 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.425623 0.181739 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.607741 0.343791 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:49.951901 0.171945 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:50.124258 0.175589 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:50.300241 0.217702 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:50.518408 0.118622 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:44:50.637479 0.330565 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/17 18:45:55.364807 3.001456 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:46:02.372271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:46:10.373717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:46:26.376351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:46:58.382774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:53:02.388662 3.001491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 18:53:09.396119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:53:17.397665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:53:33.400790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 18:54:05.406798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:00:09.412428 3.003634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 19:00:16.420020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:00:24.421698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:00:40.424871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:01:12.430819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:05:15.310271 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:05:15.310412 0.257287 tcp 10.0.2.105 55554 -> 200.84.7.244 8038 SPA_* 0 0 7 1041 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:25.812373 0.453746 tcp 10.0.2.105 55554 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:25.814588 0.063154 tcp 10.0.2.105 55555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:25.878013 0.064497 tcp 10.0.2.105 55556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:25.942827 0.153181 tcp 10.0.2.105 55557 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:26.266352 3.003668 tcp 10.0.2.105 55558 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:05:35.269694 0.000000 tcp 10.0.2.105 55558 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:05:41.286445 0.063418 tcp 10.0.2.105 55559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:41.350211 0.065412 tcp 10.0.2.105 55560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:41.415957 0.160722 tcp 10.0.2.105 55561 -> 195.113.214.249 443 SRPA* 0 0 24 10254 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:42.395516 3.000380 tcp 10.0.2.105 55562 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:05:51.400642 0.000000 tcp 10.0.2.105 55562 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:05:57.371042 0.059396 tcp 10.0.2.105 55563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:57.430719 0.059899 tcp 10.0.2.105 55564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:57.490933 0.154549 tcp 10.0.2.105 55565 -> 195.113.214.249 443 SRPA* 0 0 22 10988 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:05:58.697402 4.311060 tcp 10.0.2.105 55566 -> 46.48.223.67 15494 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:02.276685 0.061525 tcp 10.0.2.105 55567 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:02.338497 0.066101 tcp 10.0.2.105 55568 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:02.404867 0.153586 tcp 10.0.2.105 55569 -> 195.113.214.249 443 SRPA* 0 0 33 19152 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:03.008746 3.006983 tcp 10.0.2.105 55570 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:12.030482 0.000000 tcp 10.0.2.105 55570 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:18.003393 0.060264 tcp 10.0.2.105 55571 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:18.063927 0.061408 tcp 10.0.2.105 55572 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:18.125915 0.161136 tcp 10.0.2.105 55573 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:19.223188 0.420863 tcp 10.0.2.105 55574 -> 200.84.7.244 8038 FSPA* 0 0 13 1365 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:19.643922 3.006710 tcp 10.0.2.105 55575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:28.651421 0.000000 tcp 10.0.2.105 55575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:34.645066 3.012714 tcp 10.0.2.105 55576 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:43.653052 0.000000 tcp 10.0.2.105 55576 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:06:48.558772 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:06:49.660726 3.584076 tcp 10.0.2.105 55577 -> 46.48.223.67 15494 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:06:53.245029 2.991480 tcp 10.0.2.105 55578 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:07:02.233707 0.000000 tcp 10.0.2.105 55578 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:07:19.655618 2.977448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 19:07:26.606529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:07:34.562692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:07:50.452874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:08:22.459003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:12:08.241233 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:12:08.241347 2.996297 tcp 10.0.2.105 55579 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:12:17.236075 0.000000 tcp 10.0.2.105 55579 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:12:23.236901 0.065142 tcp 10.0.2.105 55580 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:23.302296 0.063711 tcp 10.0.2.105 55581 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:23.366269 0.162092 tcp 10.0.2.105 55582 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:24.481805 2.999293 tcp 10.0.2.105 55583 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:12:33.482581 0.000000 tcp 10.0.2.105 55583 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:12:39.960754 0.061106 tcp 10.0.2.105 55584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:40.022149 0.065055 tcp 10.0.2.105 55585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:40.087045 0.148961 tcp 10.0.2.105 55586 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:40.696856 0.360789 tcp 10.0.2.105 55587 -> 46.48.223.67 15494 SPA_* 0 0 9 1101 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:50.652447 1.544506 tcp 10.0.2.105 55587 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:50.653368 0.062726 tcp 10.0.2.105 55588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:50.716617 0.061562 tcp 10.0.2.105 55589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:50.778477 0.154992 tcp 10.0.2.105 55590 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:12:52.197225 2.970793 tcp 10.0.2.105 55591 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:01.092689 0.000000 tcp 10.0.2.105 55591 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:07.025199 1.200089 tcp 10.0.2.105 55592 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:08.225585 0.064704 tcp 10.0.2.105 55593 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:08.290609 0.149090 tcp 10.0.2.105 55594 -> 195.113.214.249 443 SRPA* 0 0 21 11340 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:08.855906 0.906326 tcp 10.0.2.105 55595 -> 200.84.7.244 8038 FSPA* 0 0 13 1317 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:09.286372 0.067487 tcp 10.0.2.105 55596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:09.354205 0.065944 tcp 10.0.2.105 55597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:09.419938 0.155530 tcp 10.0.2.105 55598 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:09.762519 2.962910 tcp 10.0.2.105 55599 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:18.680188 0.000000 tcp 10.0.2.105 55599 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:24.598059 2.954800 tcp 10.0.2.105 55600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:33.487049 0.000000 tcp 10.0.2.105 55600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:39.166927 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:13:40.582844 3.451432 tcp 10.0.2.105 55601 -> 46.48.223.67 15494 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:13:44.034519 2.973530 tcp 10.0.2.105 55602 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:13:52.942317 0.000000 tcp 10.0.2.105 55602 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:14:01.945771 3.661165 tcp 10.0.2.105 55603 -> 200.84.7.244 8038 FSPA* 0 0 13 1317 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:14:34.330369 2.958776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 19:14:41.251590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:14:49.154438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:15:04.941778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:15:05.239642 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:15:05.239925 0.217045 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:05.457373 0.319968 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:05.777754 0.054640 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:05.832897 0.056685 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:05.889967 0.149198 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.039587 0.147448 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.187409 0.180279 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.368188 0.156383 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.524984 0.156982 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.682434 0.200981 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:06.883883 0.417718 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:07.301991 0.175550 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:07.477914 0.194757 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:07.673038 0.236742 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:07.910170 0.024963 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:07.938403 0.172924 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.111800 0.103777 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.216045 0.084293 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.300840 0.063516 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.364824 0.217804 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.583105 0.396380 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:08.979869 0.170848 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:09.151146 0.178670 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:09.330251 0.080109 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:09.410762 0.182466 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:09.593618 0.330664 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:09.924686 0.221849 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:10.146937 0.143351 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:15:36.543972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:19:01.845867 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:19:01.845971 2.949661 tcp 10.0.2.105 55604 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:10.721670 0.000000 tcp 10.0.2.105 55604 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:16.659620 0.065203 tcp 10.0.2.105 55605 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:16.725105 0.064768 tcp 10.0.2.105 55606 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:16.790130 0.150287 tcp 10.0.2.105 55607 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:17.588953 2.970137 tcp 10.0.2.105 55608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:26.477445 0.000000 tcp 10.0.2.105 55608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:32.408311 0.064617 tcp 10.0.2.105 55609 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:32.473168 0.064837 tcp 10.0.2.105 55610 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:32.538270 0.153921 tcp 10.0.2.105 55611 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:33.366667 4.366253 tcp 10.0.2.105 55612 -> 46.48.223.67 15494 SPA_* 0 0 12 1561 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:37.733617 0.061208 tcp 10.0.2.105 55613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:37.795089 0.061905 tcp 10.0.2.105 55614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:37.857277 0.162301 tcp 10.0.2.105 55615 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:38.668590 0.000092 tcp 10.0.2.105 55612 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:38.669012 2.969300 tcp 10.0.2.105 55616 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:47.553711 0.000000 tcp 10.0.2.105 55616 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 19:19:53.471101 0.064553 tcp 10.0.2.105 55617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:53.535924 0.068307 tcp 10.0.2.105 55618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:53.604551 0.151800 tcp 10.0.2.105 55619 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:19:53.969607 1.562592 tcp 10.0.2.105 55620 -> 200.84.7.244 8038 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:21:35.879062 2.960108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 19:21:42.787640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:21:50.697269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:22:06.502713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:22:38.088835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:28:41.515448 3.000516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 19:28:48.521816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:28:56.523467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:29:12.525912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:29:44.532137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:35:48.548507 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 19:35:55.555853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:36:03.557258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:36:19.560324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:36:51.820399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:42:55.582330 3.001691 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 19:43:02.589744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:43:10.592894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:43:26.594378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:43:58.600135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:45:12.196606 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:45:12.196701 0.223142 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:12.284278 0.336191 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:13.061663 0.057786 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 3 947 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:13.118981 0.099919 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:13.337463 0.186291 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:13.702845 0.171881 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:13.852544 0.177501 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:14.493661 0.187646 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:14.699610 0.443953 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:15.121740 0.183907 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:16.092243 0.215192 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:16.909448 0.181241 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:17.067919 0.208256 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:17.887671 0.243301 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:18.123238 0.031054 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:18.194867 0.190192 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:18.376566 0.134906 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:18.842858 0.131584 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:18.928711 0.085627 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:19.246728 0.216278 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:19.623986 0.351537 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:20.290613 0.111818 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:20.370873 0.188180 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:21.077057 0.379361 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:21.428372 0.241937 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:21.923648 0.268550 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:22.068583 0.177120 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:45:22.314656 0.188449 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/17 19:49:51.779058 0.142934 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 19:49:51.922149 0.900372 tcp 10.0.2.105 55621 -> 200.84.7.244 8038 FSPA* 0 0 13 1302 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:49:52.350383 0.064697 tcp 10.0.2.105 55622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:49:52.415312 0.065240 tcp 10.0.2.105 55623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:49:52.480799 0.160331 tcp 10.0.2.105 55624 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:49:52.822767 1.524839 tcp 10.0.2.105 55625 -> 50.134.170.237 6892 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/17 19:55:37.608226 3.001427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 19:55:44.615339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:55:52.721347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:56:08.629977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 19:56:40.641389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:02:44.642069 3.001049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:02:51.649509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:02:59.652757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:03:15.654054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:03:47.660744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:10:15.670297 3.001698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:10:22.677649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:10:30.679382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:10:47.089828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:11:18.733264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:15:32.443561 0.021048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 20:15:32.464779 0.056112 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:32.521355 0.085515 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:32.607246 0.336317 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:32.944008 0.147540 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:33.091968 0.051409 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:33.143842 0.147873 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:33.292151 0.169711 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:33.462215 0.157587 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:33.620219 0.570586 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:34.191213 0.176768 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:34.368396 0.198273 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:34.567040 0.159243 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:34.726698 0.198406 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:34.925454 0.235221 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.161537 0.022716 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.184628 0.084018 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.269030 0.064166 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.333672 0.177972 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.511990 0.105357 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.617784 0.220218 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:35.838392 0.347662 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:36.186466 0.080577 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:36.267450 0.183048 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:36.457538 0.142073 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:36.600036 0.356027 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:36.956481 0.218181 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:37.175053 0.173467 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:15:37.348958 0.175567 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:17:22.703895 3.002644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:17:29.712129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:17:37.912162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:17:53.760440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:18:25.742278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:19:54.230024 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 20:19:54.230261 1.151071 tcp 10.0.2.105 55626 -> 50.134.170.237 6892 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/02/17 20:24:30.750920 3.000556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:24:37.757383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:24:45.758663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:25:01.761505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:25:33.787835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:31:40.799804 2.999821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:31:47.805455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:31:55.806876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:32:11.810079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:32:44.321847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:38:47.831647 3.002448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:38:54.839810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:39:02.840976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:39:18.843917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:39:50.852594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:45:54.855628 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:45:57.287133 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 20:45:57.287231 0.055443 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:57.343055 0.277556 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:57.621003 0.202828 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:57.824280 0.153155 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:57.977832 0.170504 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:58.148757 0.157918 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:58.307069 0.378538 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:58.685984 0.337646 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:59.024036 0.420096 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:59.444482 0.176697 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:59.621537 0.191374 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:59.813336 0.156491 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:45:59.970293 0.200580 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.171314 0.234827 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.406540 0.024575 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.431557 0.093052 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.524986 0.065360 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.590760 0.174734 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.765860 0.104401 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:00.870627 0.213056 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.084080 0.348631 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.433078 0.078601 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.512031 0.183382 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.695881 0.120850 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.817148 0.172146 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:01.863455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:46:01.989711 0.177500 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:02.167585 0.321951 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:02.489939 0.213864 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/17 20:46:09.864956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:46:25.867886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:46:57.873752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:49:55.389672 0.367352 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 20:49:55.757224 1.371279 tcp 10.0.2.105 55627 -> 50.134.170.237 6892 FSPA* 0 0 14 1582 flow=From-Botnet-V2-TCP-Established 1970/02/17 20:53:01.880471 3.001459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 20:53:08.887608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:53:16.890591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:53:32.892215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 20:54:04.984544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:00:08.914833 3.000746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:00:15.924502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:00:23.922957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:00:39.925986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:01:11.932061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:07:21.949433 2.998663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:07:28.953994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:07:36.956037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:07:52.960705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:08:24.964484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:14:28.980250 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:14:35.987581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:14:43.989471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:15:00.075785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:15:32.008667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:16:15.531420 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:16:15.531602 0.051558 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:15.583596 0.150022 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:15.734047 0.189224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:15.923653 0.056739 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:15.980812 0.148246 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:16.129499 0.158387 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:16.288501 0.079504 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:16.368375 0.326334 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:16.695060 0.198200 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:16.893632 0.158716 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:17.052762 0.199978 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:17.253118 0.000000 udp 10.0.2.105 7010 -> 203.45.157.34 1089 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 21:16:34.721255 0.066014 tcp 10.0.2.105 55628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:16:34.787571 0.063464 tcp 10.0.2.105 55629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:16:34.851342 0.137183 tcp 10.0.2.105 55630 -> 195.113.214.249 443 SRPA* 0 0 34 23487 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:16:34.989109 0.176662 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.166164 0.232031 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.545674 0.026016 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.572065 0.081616 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.654032 0.064345 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.718738 0.173176 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.892278 0.105167 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:35.997807 0.209197 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:36.207362 0.186021 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:36.393794 0.114751 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:36.508942 0.173437 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:36.682818 0.179588 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:36.862784 0.345010 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:37.208155 0.079269 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:37.287803 0.487931 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:16:37.776120 0.216394 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:19:56.789665 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:19:56.789907 1.767986 tcp 10.0.2.105 55631 -> 50.134.170.237 6892 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:21:36.015665 3.000874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 21:21:43.022101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:21:51.023749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:22:07.026386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:22:39.031954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:28:45.041518 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:28:52.048921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:29:00.054698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:29:16.053476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:29:48.059500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:35:52.066514 3.000273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:35:59.072638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:36:07.074578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:36:23.077172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:36:55.083420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:42:59.089604 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 21:43:06.096230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:43:14.098529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:43:30.101462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:44:02.108215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:47:05.951808 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:47:05.951887 0.422297 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.374641 0.191325 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.566340 0.058087 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.624835 0.148387 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.773636 0.041073 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.815078 0.151608 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:06.967055 0.345606 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:07.313128 0.197391 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:07.510898 0.158632 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:07.669911 0.160109 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:07.830432 0.082806 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:07.913750 0.210272 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.124457 0.175169 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.299980 0.226408 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.526823 0.023498 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.550704 0.093472 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.644668 0.063901 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.708986 0.173561 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.882999 0.104249 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:08.987619 0.213061 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:09.201106 0.174039 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:09.375504 0.177763 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:09.553662 0.182987 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:09.736995 0.112137 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:09.849507 0.329822 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:10.179678 0.346129 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:10.716990 0.081239 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:47:10.798655 0.217100 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/17 21:49:58.560004 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:49:58.560190 1.083952 tcp 10.0.2.105 55632 -> 50.134.170.237 6892 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:49:58.986025 0.067295 tcp 10.0.2.105 55633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:49:59.053599 0.060730 tcp 10.0.2.105 55634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:49:59.114592 0.158321 tcp 10.0.2.105 55635 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:49:59.644525 3.001410 tcp 10.0.2.105 55636 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:08.645980 0.000000 tcp 10.0.2.105 55636 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:14.643430 0.060359 tcp 10.0.2.105 55637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:14.704095 0.065847 tcp 10.0.2.105 55638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:14.770202 0.156244 tcp 10.0.2.105 55639 -> 195.113.214.249 443 SRPA* 0 0 35 18852 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:15.030698 2.997183 tcp 10.0.2.105 55640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:24.027509 0.000000 tcp 10.0.2.105 55640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:30.025693 1.298214 tcp 10.0.2.105 55641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:31.324170 0.286495 tcp 10.0.2.105 55642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:31.610976 0.160392 tcp 10.0.2.105 55643 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:32.855418 4.523291 tcp 10.0.2.105 55644 -> 46.48.223.67 15494 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:35.639112 0.067788 tcp 10.0.2.105 55645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:35.707180 0.061399 tcp 10.0.2.105 55646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:35.768916 0.149661 tcp 10.0.2.105 55647 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:37.378957 2.962380 tcp 10.0.2.105 55648 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:46.266731 0.000000 tcp 10.0.2.105 55648 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:50:52.199629 0.063743 tcp 10.0.2.105 55649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:52.263357 0.066429 tcp 10.0.2.105 55650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:52.330061 0.157840 tcp 10.0.2.105 55651 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:52.802930 1.042475 tcp 10.0.2.105 55652 -> 200.84.7.244 8038 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:53.242715 0.062634 tcp 10.0.2.105 55653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:53.305602 0.064743 tcp 10.0.2.105 55654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:53.370667 0.165929 tcp 10.0.2.105 55655 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:53.845660 0.421221 tcp 10.0.2.105 55656 -> 50.134.170.237 6892 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:50:54.267143 2.971801 tcp 10.0.2.105 55657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:03.172481 0.000000 tcp 10.0.2.105 55657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:09.084226 2.959481 tcp 10.0.2.105 55658 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:17.971953 0.000000 tcp 10.0.2.105 55658 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:22.650030 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:51:23.908444 0.357658 tcp 10.0.2.105 55659 -> 46.48.223.67 15494 SPA_* 0 0 9 1157 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:51:37.493853 0.000461 tcp 10.0.2.105 55659 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:51:37.494492 2.957795 tcp 10.0.2.105 55660 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:46.383991 0.000000 tcp 10.0.2.105 55660 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:51:52.325690 0.440240 tcp 10.0.2.105 55661 -> 200.84.7.244 8038 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:55:41.114656 3.002090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 21:55:48.122559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:55:56.123977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:56:12.126675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:56:44.132755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 21:56:52.505679 0.000199 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 21:56:52.505979 3.003131 tcp 10.0.2.105 55662 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:01.507774 0.000000 tcp 10.0.2.105 55662 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:07.508500 0.063878 tcp 10.0.2.105 55663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:07.572693 0.065572 tcp 10.0.2.105 55664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:07.638535 0.156424 tcp 10.0.2.105 55665 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:08.031193 3.000346 tcp 10.0.2.105 55666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:17.030060 0.000000 tcp 10.0.2.105 55666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:23.029537 0.060691 tcp 10.0.2.105 55667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:23.090574 0.186376 tcp 10.0.2.105 55668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:23.277260 0.166033 tcp 10.0.2.105 55669 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:23.848902 4.656303 tcp 10.0.2.105 55670 -> 46.48.223.67 15494 FSPA* 0 0 14 1742 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:27.489892 0.062235 tcp 10.0.2.105 55671 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:27.552459 0.062708 tcp 10.0.2.105 55672 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:27.615429 0.152065 tcp 10.0.2.105 55673 -> 195.113.214.249 443 SRPA* 0 0 21 11362 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:28.505453 2.995530 tcp 10.0.2.105 55674 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:37.499889 0.000000 tcp 10.0.2.105 55674 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 21:57:43.499158 0.065670 tcp 10.0.2.105 55675 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:43.564812 0.068250 tcp 10.0.2.105 55676 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:43.633500 0.153734 tcp 10.0.2.105 55677 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/17 21:57:44.285634 2.209984 tcp 10.0.2.105 55678 -> 200.84.7.244 8038 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:02:48.139699 3.000629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 22:02:55.146285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:03:03.147892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:03:19.150794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:03:51.166984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:10:19.177360 3.002222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:10:26.185138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:10:34.186068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:10:50.267636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:11:22.205517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:17:25.989006 0.000188 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 22:17:25.989283 0.056443 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.046106 0.149491 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.196068 0.047724 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.212564 3.000426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:17:26.244278 0.149557 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.394266 0.416172 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.810884 0.182828 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:26.994091 0.343295 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:27.337779 0.192881 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:27.531150 0.159764 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:27.691307 0.156841 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:27.848623 0.087503 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:27.936589 0.200303 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.137313 0.175703 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.313369 0.232111 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.545877 0.024781 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.571064 0.079494 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.650966 0.061376 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.713075 0.174581 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:28.887994 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 22:17:33.219205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:17:41.222724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:17:46.089040 0.201589 tcp 10.0.2.105 55679 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:17:46.290888 0.061664 tcp 10.0.2.105 55680 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:17:46.352849 0.156843 tcp 10.0.2.105 55681 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:17:46.510239 0.210198 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:46.720899 0.183330 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:46.904627 0.144200 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:47.049231 0.627712 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:47.677399 0.173040 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:47.850803 0.175685 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:48.026855 0.215645 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:48.242948 0.348447 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:48.591798 0.706950 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:17:57.223025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:18:29.229458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:24:34.238853 2.999592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:24:41.244067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:24:49.245282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:25:05.248729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:25:37.254744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:27:46.501241 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 22:27:46.501406 1.650261 tcp 10.0.2.105 55682 -> 200.84.7.244 8038 FSPA* 0 0 12 1629 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:31:45.266805 3.001269 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:31:52.276618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:32:00.275550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:32:16.278689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:32:48.283937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:38:52.290636 3.011882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:38:59.308398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:39:07.309481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:39:23.312204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:39:55.318742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:45:59.324287 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:46:06.332005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:46:14.332888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:46:30.336299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:47:02.342687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:48:16.929543 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 22:48:16.929644 0.104165 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.034203 0.047338 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.081939 0.061914 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.144301 0.146491 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.291242 0.171360 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.462972 0.332721 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.796097 0.150401 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:17.946908 0.422466 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:18.369844 0.191879 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:18.562136 0.094061 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:18.656579 0.203324 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:18.860300 0.175804 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.036633 0.158975 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.195988 0.164551 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.360900 0.080350 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.441649 0.063640 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.505660 0.177778 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.683845 0.026690 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.710926 0.231553 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:19.942851 0.123533 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:20.066724 0.218099 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:20.285218 0.186957 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:20.472564 0.614079 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:21.087054 0.173910 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:21.261421 0.177456 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:21.439286 0.217445 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:21.657101 0.347621 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:48:22.005057 0.078201 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/17 22:53:06.347863 3.003508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 22:53:13.356991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:53:24.853339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:53:40.639799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:54:12.224836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 22:57:48.151193 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 22:57:48.151343 0.928627 tcp 10.0.2.105 55683 -> 200.84.7.244 8038 FSPA* 0 0 13 1345 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:48.593655 0.065760 tcp 10.0.2.105 55684 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:48.659696 0.068780 tcp 10.0.2.105 55685 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:48.728785 0.153709 tcp 10.0.2.105 55686 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:49.080165 1.334852 tcp 10.0.2.105 55687 -> 50.134.170.237 6892 FSPA* 0 0 13 1345 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:49.507318 0.069431 tcp 10.0.2.105 55688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:49.577016 0.061307 tcp 10.0.2.105 55689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:49.638625 0.162536 tcp 10.0.2.105 55690 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:57:50.415292 3.003417 tcp 10.0.2.105 55691 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:57:59.417019 0.000000 tcp 10.0.2.105 55691 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:58:05.416532 1.402272 tcp 10.0.2.105 55692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:06.819050 0.067606 tcp 10.0.2.105 55693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:06.886847 0.156696 tcp 10.0.2.105 55694 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:08.092436 2.967751 tcp 10.0.2.105 55695 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:58:16.988138 0.000000 tcp 10.0.2.105 55695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:58:22.912068 0.067891 tcp 10.0.2.105 55696 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:22.980291 0.568957 tcp 10.0.2.105 55697 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:23.549532 0.158396 tcp 10.0.2.105 55698 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:24.334832 0.375155 tcp 10.0.2.105 55699 -> 46.48.223.67 15494 SPA_* 0 0 9 1129 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:29.545313 0.404281 tcp 10.0.2.105 55699 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:29.546037 0.060268 tcp 10.0.2.105 55700 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:29.606559 0.060008 tcp 10.0.2.105 55701 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:29.666842 0.162768 tcp 10.0.2.105 55702 -> 195.113.214.249 443 SRPA* 0 0 27 11250 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:29.949864 2.966513 tcp 10.0.2.105 55703 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:58:38.851988 0.000000 tcp 10.0.2.105 55703 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 22:58:44.844688 0.065656 tcp 10.0.2.105 55704 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:44.910603 0.061172 tcp 10.0.2.105 55705 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:44.972027 0.153481 tcp 10.0.2.105 55706 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 22:58:45.136859 1.599209 tcp 10.0.2.105 55707 -> 200.84.7.244 8038 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:00:13.381964 3.002007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 23:00:20.392626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:00:28.391125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:00:44.394576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:01:16.400268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:07:20.406246 3.002083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:07:27.413685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:07:35.415218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:07:51.418664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:08:24.828890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:14:27.440671 3.001228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:14:34.450544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:14:45.155728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:15:00.970229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:15:32.598659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:18:28.272306 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 23:18:28.272402 0.059451 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:28.332338 0.148467 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:28.481268 0.171152 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:28.652847 0.103546 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:28.756781 0.043906 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:28.801085 0.342867 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:29.144354 0.150901 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:29.295680 0.476179 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:29.772239 0.201554 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:30.389963 0.177841 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:30.568828 0.157954 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:30.727248 0.192176 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:30.919897 0.000000 udp 10.0.2.105 7010 -> 213.123.183.68 8899 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 23:18:46.822528 0.062479 tcp 10.0.2.105 55708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:18:46.885266 0.069205 tcp 10.0.2.105 55709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:18:46.954760 0.173768 tcp 10.0.2.105 55710 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:18:47.129003 0.162915 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.292307 0.082059 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.374773 0.063107 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.438262 0.180880 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.619539 0.017785 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.637713 0.228112 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:47.866168 0.182255 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:48.048772 0.110356 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:48.159521 0.209407 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:48.369322 0.824967 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:49.194629 0.172511 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:49.367464 0.175731 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:49.543680 0.083457 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:49.627484 0.215886 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:18:49.843740 0.347188 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:21:34.474865 3.001191 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:21:41.481992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:21:49.483090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:22:05.486211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:22:37.492638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:28:42.499695 3.001734 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:28:45.822333 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 23:28:45.822411 0.220826 tcp 10.0.2.105 55711 -> 200.84.7.244 8038 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:28:49.507142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:28:57.508829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:29:13.511805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:29:16.260101 0.542481 tcp 10.0.2.105 55711 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:16.262374 0.064472 tcp 10.0.2.105 55712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:16.327125 0.062619 tcp 10.0.2.105 55713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:16.390070 0.164837 tcp 10.0.2.105 55714 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:16.802851 1.279891 tcp 10.0.2.105 55715 -> 50.134.170.237 6892 FSPA* 0 0 13 1271 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:17.226112 0.062306 tcp 10.0.2.105 55716 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:17.288703 0.064339 tcp 10.0.2.105 55717 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:17.353352 0.150463 tcp 10.0.2.105 55718 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:18.082981 2.975638 tcp 10.0.2.105 55719 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:29:27.002930 0.000000 tcp 10.0.2.105 55719 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:29:32.945082 0.063212 tcp 10.0.2.105 55720 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:33.008636 0.063930 tcp 10.0.2.105 55721 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:33.072935 0.156068 tcp 10.0.2.105 55722 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:33.396573 2.970377 tcp 10.0.2.105 55723 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:29:42.323194 0.000000 tcp 10.0.2.105 55723 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:29:45.527698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:29:48.322450 0.938930 tcp 10.0.2.105 55724 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:49.261671 0.065231 tcp 10.0.2.105 55725 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:49.327214 0.149494 tcp 10.0.2.105 55726 -> 195.113.214.249 443 SRPA* 0 0 41 20850 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:50.295905 0.380835 tcp 10.0.2.105 55727 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:56.549288 0.547491 tcp 10.0.2.105 55727 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:56.550007 0.064485 tcp 10.0.2.105 55728 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:56.614806 0.065054 tcp 10.0.2.105 55729 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:56.680161 0.156612 tcp 10.0.2.105 55730 -> 195.113.214.249 443 SRPA* 0 0 25 13368 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:29:57.097031 2.959282 tcp 10.0.2.105 55731 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:05.983914 0.000000 tcp 10.0.2.105 55731 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:11.925341 0.063972 tcp 10.0.2.105 55732 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:11.989616 0.065876 tcp 10.0.2.105 55733 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:12.055836 0.160760 tcp 10.0.2.105 55734 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:12.372877 0.440044 tcp 10.0.2.105 55735 -> 200.84.7.244 8038 FSPA* 0 0 13 1271 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:12.813135 0.421709 tcp 10.0.2.105 55736 -> 50.134.170.237 6892 FSPA* 0 0 13 1271 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:13.235098 2.970047 tcp 10.0.2.105 55737 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:22.129837 0.000000 tcp 10.0.2.105 55737 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:28.057565 2.970809 tcp 10.0.2.105 55738 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:36.957356 0.000000 tcp 10.0.2.105 55738 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:41.794760 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 23:30:42.885724 2.864679 tcp 10.0.2.105 55739 -> 46.48.223.67 15494 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:30:45.745327 2.965587 tcp 10.0.2.105 55740 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:30:54.642914 0.000000 tcp 10.0.2.105 55740 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/17 23:35:49.534732 3.000650 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/17 23:35:56.544988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:36:00.537593 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 23:36:00.537681 1.718435 tcp 10.0.2.105 55741 -> 200.84.7.244 8038 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:36:04.542493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:36:20.545578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:36:52.551652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:42:56.557496 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:43:03.564968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:43:11.566696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:43:27.570624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:43:59.575663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:49:13.127548 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/17 23:49:13.127740 0.000000 udp 10.0.2.105 7010 -> 213.123.183.68 8899 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/17 23:49:31.398555 0.062422 tcp 10.0.2.105 55742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:49:31.461249 0.062720 tcp 10.0.2.105 55743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:49:31.524247 0.170104 tcp 10.0.2.105 55744 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/17 23:49:31.694911 0.175032 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:31.866440 0.125473 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:31.972626 0.086718 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:32.234085 0.060536 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:32.292875 0.170157 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:32.526333 0.342877 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:32.875270 0.177520 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:33.409408 0.460874 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:33.849466 0.200677 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:34.116709 0.182201 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:34.294532 0.190492 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:34.730914 0.210901 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:34.923689 0.188380 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:35.091655 0.142865 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:35.191126 0.084771 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:35.532194 0.191897 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:36.083838 0.023668 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:36.108827 0.236679 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:36.408786 0.270617 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:36.789544 0.247833 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:36.937265 0.217271 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:37.263594 0.184118 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:37.440497 0.155468 udp 10.0.2.105 7010 <-> 86.167.238.61 1971 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:37.719575 0.237534 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:37.936744 1.722785 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 3 853 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:39.668181 0.181069 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:49:39.846171 0.352790 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/17 23:55:36.590261 3.001772 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/17 23:55:45.510323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:55:53.427290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:56:09.249872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/17 23:56:41.781846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:02:43.634394 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 00:02:50.642552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:02:58.642807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:03:14.646362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:03:46.652201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:06:02.263959 0.000232 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 00:06:02.264325 0.213085 tcp 10.0.2.105 55745 -> 200.84.7.244 8038 SPA_* 0 0 9 1003 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:06:10.176775 0.217848 tcp 10.0.2.105 55745 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:10:14.662494 3.002300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 00:10:21.670205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:10:29.671979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:10:46.506957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:11:18.126426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:17:21.686409 3.002273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 00:17:28.694077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:17:36.695567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:17:52.698889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:18:24.704694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:19:49.116585 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 00:19:49.116675 0.168931 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.286070 0.058629 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.345092 0.147984 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.493405 0.105142 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.598979 0.045889 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.645264 0.345522 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:49.991269 0.160843 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:50.152682 0.433970 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:50.587031 0.206713 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:50.794101 0.175541 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:50.970105 0.157931 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.128403 0.191735 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.320565 0.156656 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.477615 0.096481 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.574549 0.066670 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.641615 0.228896 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:51.870886 0.180323 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.189609 0.028648 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.218655 0.186775 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.405846 0.134700 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.540905 0.208904 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.750270 0.180498 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:19:52.931238 0.000000 udp 10.0.2.105 7010 -> 86.167.238.61 1971 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 00:20:09.266940 0.063426 tcp 10.0.2.105 55746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:20:09.330633 0.121282 tcp 10.0.2.105 55747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:20:09.452230 0.164341 tcp 10.0.2.105 55748 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:20:09.617107 0.215311 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:20:09.832849 0.741581 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:20:10.574782 0.172499 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:20:10.747629 0.345884 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:24:28.711640 4.493247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 00:24:37.164329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:24:45.075151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:25:00.888968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:25:32.511228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:31:38.749904 0.997895 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/18 00:31:44.999467 3.945638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/18 00:31:56.840518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:32:12.636303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:32:44.223553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:36:10.738920 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 00:36:10.739010 3.696512 tcp 10.0.2.105 55749 -> 200.84.7.244 8038 FSPA* 0 0 13 1349 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:11.179279 0.066726 tcp 10.0.2.105 55750 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:11.246275 0.060847 tcp 10.0.2.105 55751 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:11.307368 0.164556 tcp 10.0.2.105 55752 -> 195.113.214.249 443 SRPA* 0 0 40 22367 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:14.435773 2.297234 tcp 10.0.2.105 55753 -> 46.48.235.250 16076 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:16.325030 0.065149 tcp 10.0.2.105 55754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:16.390508 0.064408 tcp 10.0.2.105 55755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:16.455287 0.163226 tcp 10.0.2.105 55756 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:16.733218 0.765261 tcp 10.0.2.105 55757 -> 50.134.170.237 6892 FSPA* 0 0 13 1349 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:17.160319 0.061720 tcp 10.0.2.105 55758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:17.222332 0.061121 tcp 10.0.2.105 55759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:17.283778 0.160720 tcp 10.0.2.105 55760 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:17.498706 2.965497 tcp 10.0.2.105 55761 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:36:26.385404 0.000000 tcp 10.0.2.105 55761 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:36:32.301034 0.061531 tcp 10.0.2.105 55762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:32.362842 0.072346 tcp 10.0.2.105 55763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:32.435445 0.236861 tcp 10.0.2.105 55764 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:32.740054 2.953060 tcp 10.0.2.105 55765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:36:41.701771 0.000000 tcp 10.0.2.105 55765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:36:47.691292 0.065127 tcp 10.0.2.105 55766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:47.756727 0.061767 tcp 10.0.2.105 55767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:47.818745 0.156589 tcp 10.0.2.105 55768 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:49.001173 0.376611 tcp 10.0.2.105 55769 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:54.687205 0.325778 tcp 10.0.2.105 55769 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:54.688030 0.062021 tcp 10.0.2.105 55770 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:54.750342 0.066552 tcp 10.0.2.105 55771 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:54.817179 0.165689 tcp 10.0.2.105 55772 -> 195.113.214.249 443 SRPA* 0 0 24 13234 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:36:55.013216 3.001857 tcp 10.0.2.105 55773 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:37:04.013929 0.000000 tcp 10.0.2.105 55773 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 00:37:10.013440 0.060929 tcp 10.0.2.105 55774 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:37:10.074723 0.073907 tcp 10.0.2.105 55775 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:37:10.148934 0.154881 tcp 10.0.2.105 55776 -> 195.113.214.249 443 SRPA* 0 0 21 10738 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:37:10.326174 1.794601 tcp 10.0.2.105 55777 -> 200.84.7.244 8038 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:38:45.793800 3.099066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 00:38:52.868930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:39:00.812279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:39:17.008571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:39:48.834069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:45:52.838144 3.000802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 00:45:59.849719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:46:07.845911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:46:23.849249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:46:55.855142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:50:28.431282 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 00:50:28.431378 0.000000 udp 10.0.2.105 7010 -> 86.167.238.61 1971 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 00:50:45.056220 0.066417 tcp 10.0.2.105 55778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:50:45.122937 0.072274 tcp 10.0.2.105 55779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:50:45.195452 0.158734 tcp 10.0.2.105 55780 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:50:45.354897 0.146427 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:45.501709 0.169748 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:45.671908 0.060873 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:45.733229 0.351810 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.085380 0.153101 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.238831 0.423458 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.662690 0.103837 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.766939 0.041475 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.808762 0.177117 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:46.986244 0.158166 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.144847 0.193001 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.338254 0.157774 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.496505 0.084391 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.581265 0.064438 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.646171 0.202457 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:47.849053 0.184670 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:48.034178 0.129663 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:50:48.164225 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 00:51:04.833359 0.061694 tcp 10.0.2.105 55781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:04.895321 0.076235 tcp 10.0.2.105 55782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:04.971906 0.159889 tcp 10.0.2.105 55783 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:05.132274 0.179117 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:51:05.311740 0.023399 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:51:05.335520 0.000000 udp 10.0.2.105 7010 -> 99.59.196.191 3144 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 00:51:22.409285 0.059976 tcp 10.0.2.105 55784 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:22.469546 0.065153 tcp 10.0.2.105 55785 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:22.535065 0.157040 tcp 10.0.2.105 55786 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:22.692708 0.217900 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:51:22.911086 0.215968 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:51:23.127505 0.347661 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:51:23.475576 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 00:51:40.524648 0.061960 tcp 10.0.2.105 55787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:40.586922 0.071153 tcp 10.0.2.105 55788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:40.658352 0.241112 tcp 10.0.2.105 55789 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 00:51:40.899931 0.173485 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 00:52:59.861281 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 00:53:06.868899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:53:14.870075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:53:30.874565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 00:54:02.878891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:00:06.894675 3.003174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:00:13.902549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:00:21.904070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:00:37.907162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:01:09.912490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:07:12.133896 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 01:07:12.133980 0.221113 tcp 10.0.2.105 55790 -> 200.84.7.244 8038 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:07:18.938526 3.000050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:07:19.107951 0.266828 tcp 10.0.2.105 55790 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:07:25.946152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:07:33.945372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:07:49.954538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:08:21.954417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:14:25.959725 3.002363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:14:32.967774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:14:40.971032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:14:56.972677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:15:28.978114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:21:32.984852 3.000975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:21:39.991774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:21:47.993190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:21:48.904520 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 01:21:48.904615 0.220303 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:49.125253 0.176098 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:49.301696 0.710820 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.012891 0.168509 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.181844 0.147274 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.329475 0.058150 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.387960 0.349660 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.737980 0.151298 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.889771 0.044145 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:50.934345 0.104950 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:51.039676 0.176669 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:51.216693 0.441177 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:51.658286 0.062998 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:51.721731 0.191822 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:51.913976 0.158561 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.072937 0.160328 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.233646 0.082088 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.316101 0.185730 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.502188 0.129925 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.632528 0.198422 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.831285 0.022674 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:52.854265 0.178818 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:53.033482 0.218154 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:53.251987 0.349198 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:53.601514 0.215171 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:21:53.817022 0.173098 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:22:03.996354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:22:36.002334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:28:42.016380 3.001908 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:28:49.018308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:28:57.019444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:29:13.023065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:29:45.039203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:35:49.044963 3.002010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 01:35:56.052689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:36:04.053884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:36:20.056892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:36:52.062954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:37:19.383138 0.644539 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 01:37:20.027874 1.389866 tcp 10.0.2.105 55791 -> 200.84.7.244 8038 FSPA* 0 0 13 1381 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:20.465657 0.065792 tcp 10.0.2.105 55792 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:20.531772 0.068920 tcp 10.0.2.105 55793 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:20.600953 0.141496 tcp 10.0.2.105 55794 -> 195.113.214.249 443 SRPA* 0 0 63 40107 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:21.418086 1.366362 tcp 10.0.2.105 55795 -> 46.48.235.250 16076 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:52.440931 0.067031 tcp 10.0.2.105 55796 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:52.508320 0.065429 tcp 10.0.2.105 55797 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:52.574051 0.171929 tcp 10.0.2.105 55798 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:53.329812 0.408761 tcp 10.0.2.105 55795 -> 46.48.235.250 16076 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:37:53.330141 2.959862 tcp 10.0.2.105 55799 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:38:02.225930 0.000000 tcp 10.0.2.105 55799 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:38:08.155938 0.066211 tcp 10.0.2.105 55800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:08.222468 0.067899 tcp 10.0.2.105 55801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:08.290715 0.163484 tcp 10.0.2.105 55802 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:08.498008 2.957501 tcp 10.0.2.105 55803 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:38:17.428090 0.000000 tcp 10.0.2.105 55803 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:38:23.424752 0.060292 tcp 10.0.2.105 55804 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:23.485330 0.075410 tcp 10.0.2.105 55805 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:23.561038 0.176623 tcp 10.0.2.105 55806 -> 195.113.214.249 443 SRPA* 0 0 43 23406 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:24.069540 0.392199 tcp 10.0.2.105 55807 -> 46.48.223.67 15494 SPA_* 0 0 9 1165 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:52.546011 0.593192 tcp 10.0.2.105 55807 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:52.546969 0.066041 tcp 10.0.2.105 55808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:52.613342 0.064478 tcp 10.0.2.105 55809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:52.678116 0.165395 tcp 10.0.2.105 55810 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:38:53.139482 3.003148 tcp 10.0.2.105 55811 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:39:02.139812 0.000000 tcp 10.0.2.105 55811 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 01:39:08.139282 0.067361 tcp 10.0.2.105 55812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:39:08.206946 0.068297 tcp 10.0.2.105 55813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:39:08.275082 0.185176 tcp 10.0.2.105 55814 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:39:08.471150 1.590169 tcp 10.0.2.105 55815 -> 200.84.7.244 8038 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:42:56.069063 3.794459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 01:43:03.814784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:43:11.725053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:43:27.540515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:43:59.157162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:51:55.922900 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 01:51:55.923012 0.234107 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:56.157527 0.177066 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:56.335037 0.886883 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.222356 0.170300 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.393019 0.147404 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.540780 0.058129 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.599391 0.051411 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.651270 0.105163 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.756794 0.176149 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:51:57.933268 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 01:52:13.249472 0.177717 tcp 10.0.2.105 55816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:13.427495 0.064570 tcp 10.0.2.105 55817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:13.492579 0.156408 tcp 10.0.2.105 55818 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:13.649595 0.150508 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:13.800580 0.420456 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.221445 0.064076 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.285976 0.193167 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.479519 0.153568 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.633453 0.159086 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.792865 0.082170 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:14.875477 0.185504 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:15.061360 0.126963 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:15.188753 0.197023 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:15.386223 0.028001 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:15.414572 0.179910 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:15.594890 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 01:52:32.826303 0.070320 tcp 10.0.2.105 55819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:32.896959 0.070399 tcp 10.0.2.105 55820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:32.967657 0.162947 tcp 10.0.2.105 55821 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 01:52:33.131159 0.172510 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:33.304086 0.342912 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:52:33.647374 0.216286 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/18 01:55:37.103207 3.001651 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 01:55:44.110493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:55:52.111905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:56:08.115499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 01:56:40.121685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:02:44.127481 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:02:51.134642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:02:59.135955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:03:15.139155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:03:47.145090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:09:10.069874 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 02:09:10.070021 1.474954 tcp 10.0.2.105 55822 -> 200.84.7.244 8038 FSPA* 0 0 14 1533 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:10:15.154776 3.002718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:10:22.162925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:10:30.164695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:10:46.169563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:11:18.173563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:17:22.179343 3.001963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:17:29.189566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:17:37.188676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:17:53.191486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:18:25.197585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:23:01.496064 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 02:23:01.496257 0.347886 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:01.844552 0.208991 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.053935 0.225615 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.279944 0.177770 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.458213 0.060941 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.519518 0.325808 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.845724 0.146985 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:02.993016 0.172417 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.165788 0.046255 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.212426 0.175617 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.388566 0.104971 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.493899 0.431148 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.925438 0.063280 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:03.989381 0.149789 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:04.139609 0.084399 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:04.224401 0.197555 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:04.422412 1.175183 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:05.598015 0.159042 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:05.757501 0.200867 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:05.958714 0.026740 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:05.985801 0.180675 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:06.298294 0.184798 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:06.483472 0.142127 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:06.625943 0.173538 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:06.799899 0.345481 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:23:07.145716 0.216156 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:24:30.221498 3.202913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:24:37.398328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:24:45.326961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:25:01.246958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:25:33.263156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:31:41.275076 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:31:48.282012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:31:56.283713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:32:12.286807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:32:44.292336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:38:48.298234 3.010015 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:38:55.306122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:39:03.307603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:39:11.555212 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 02:39:11.555325 1.098211 tcp 10.0.2.105 55823 -> 200.84.7.244 8038 FSPA* 0 0 13 1341 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:11.998705 0.062545 tcp 10.0.2.105 55824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:12.061524 0.060563 tcp 10.0.2.105 55825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:12.122360 0.156265 tcp 10.0.2.105 55826 -> 195.113.214.249 443 SRPA* 0 0 38 27481 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:12.653803 0.428910 tcp 10.0.2.105 55827 -> 46.48.235.250 16076 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:18.633681 1.323319 tcp 10.0.2.105 55827 -> 46.48.235.250 16076 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:18.634372 0.060972 tcp 10.0.2.105 55828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:18.695690 0.067287 tcp 10.0.2.105 55829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:18.762799 0.162750 tcp 10.0.2.105 55830 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:19.140596 2.993996 tcp 10.0.2.105 55831 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:39:19.310926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:39:28.478477 0.000000 tcp 10.0.2.105 55831 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:39:34.435012 0.068511 tcp 10.0.2.105 55832 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:34.503774 0.065478 tcp 10.0.2.105 55833 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:34.569686 0.165137 tcp 10.0.2.105 55834 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:34.999275 2.972853 tcp 10.0.2.105 55835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:39:43.914761 0.000000 tcp 10.0.2.105 55835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:39:49.861699 0.084309 tcp 10.0.2.105 55836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:49.946379 0.067106 tcp 10.0.2.105 55837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:50.013785 0.163489 tcp 10.0.2.105 55838 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:50.269576 1.120647 tcp 10.0.2.105 55839 -> 46.48.223.67 15494 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:39:51.449229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:40:21.261461 0.064871 tcp 10.0.2.105 55840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:21.326636 0.061435 tcp 10.0.2.105 55841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:21.388488 0.167930 tcp 10.0.2.105 55842 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:21.655551 0.383024 tcp 10.0.2.105 55839 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:21.655908 2.998143 tcp 10.0.2.105 55843 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:40:30.663305 0.000000 tcp 10.0.2.105 55843 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 02:40:36.655000 0.067169 tcp 10.0.2.105 55844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:36.722443 0.064484 tcp 10.0.2.105 55845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:36.787231 0.453524 tcp 10.0.2.105 55846 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:40:37.282239 1.490442 tcp 10.0.2.105 55847 -> 200.84.7.244 8038 FSPA* 0 0 14 1632 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:45:55.323918 3.000519 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:46:02.334101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:46:10.334846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:46:26.335403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:46:58.340852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:53:02.346623 3.001631 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 02:53:09.354043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:53:17.355486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:53:22.943863 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 02:53:22.943946 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 02:53:33.358771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:53:41.672502 0.070708 tcp 10.0.2.105 55848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:53:41.743476 0.066712 tcp 10.0.2.105 55849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:53:41.810515 0.156171 tcp 10.0.2.105 55850 -> 195.113.214.249 443 SRPA* 0 0 28 14872 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:53:41.967365 0.178092 udp 10.0.2.105 7010 <-> 99.59.196.191 3144 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:53:42.145925 0.058969 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:53:42.205264 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 02:54:00.388373 0.071973 tcp 10.0.2.105 55851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:00.460626 0.063250 tcp 10.0.2.105 55852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:00.524131 0.173737 tcp 10.0.2.105 55853 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:00.698480 0.210714 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:00.909591 0.350206 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.262159 0.147865 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.410511 0.169906 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.580815 0.043919 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.625096 0.176237 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.801719 0.105111 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:01.907273 0.457052 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:02.364698 0.061291 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:02.426352 0.149437 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:02.576197 0.096652 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:02.673291 0.192813 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:02.866482 0.198782 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:03.065603 0.026725 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:03.092728 1.026537 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.119643 0.158136 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.278166 0.179526 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.458127 0.183619 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.642168 0.126191 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.768852 0.172456 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/18 02:54:04.941712 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 9246 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 02:54:05.364371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 02:54:23.270838 0.065721 tcp 10.0.2.105 55854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:23.336824 0.065145 tcp 10.0.2.105 55855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:23.402254 0.162002 tcp 10.0.2.105 55856 -> 195.113.214.249 443 SRPA* 0 0 33 18048 flow=From-Botnet-V2-TCP-Established 1970/02/18 02:54:23.564907 0.215942 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:00:09.370386 3.313964 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 03:00:16.711940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:00:24.645316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:00:40.501320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:01:12.413242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:07:22.424479 3.152192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 03:07:29.556348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:07:37.494414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:07:53.445817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:08:25.452641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:10:38.773357 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:10:38.773561 0.212867 tcp 10.0.2.105 55857 -> 200.84.7.244 8038 SPA_* 0 0 9 1037 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:10:43.835467 0.212326 tcp 10.0.2.105 55857 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:14:29.457372 3.002070 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 03:14:36.464596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:14:44.467849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:15:00.469170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:15:32.475256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:21:36.492604 3.000166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 03:21:43.498372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:21:51.500578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:22:07.503794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:22:39.513670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:24:33.963512 0.000142 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:24:33.963738 0.225893 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:24:34.190025 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:24:50.219283 0.211419 tcp 10.0.2.105 55858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:24:50.431080 0.064059 tcp 10.0.2.105 55859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:24:50.495437 0.158088 tcp 10.0.2.105 55860 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:24:50.654078 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 9246 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:25:09.034763 0.500935 tcp 10.0.2.105 55861 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:09.535942 0.068227 tcp 10.0.2.105 55862 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:09.604033 0.161431 tcp 10.0.2.105 55863 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:09.766126 0.000000 udp 10.0.2.105 7010 -> 99.59.196.191 3144 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:25:25.232868 0.064100 tcp 10.0.2.105 55864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:25.297304 0.059686 tcp 10.0.2.105 55865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:25.357573 0.162373 tcp 10.0.2.105 55866 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:25.520671 0.000000 udp 10.0.2.105 7010 -> 81.157.252.245 6093 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:25:40.760768 0.064325 tcp 10.0.2.105 55867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:40.824993 0.070092 tcp 10.0.2.105 55868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:40.895412 0.164463 tcp 10.0.2.105 55869 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:25:41.060706 0.147750 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:41.208868 0.624121 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:41.833476 0.209970 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.044517 0.173222 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.218190 0.105264 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.323922 0.046050 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.370380 0.169320 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.540078 0.150066 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.690551 0.082200 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.773126 0.064661 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:42.838216 0.420832 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:43.259416 0.200814 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:43.460637 0.196632 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:43.657752 0.025063 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:43.683196 0.155315 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:44.437193 0.186057 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:44.623717 0.119326 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:44.743390 0.181149 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:44.924996 0.159021 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:45.084431 0.172746 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:45.257623 0.214446 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:45.851749 0.000000 udp 10.0.2.105 7010 -> 99.59.196.191 3144 REQ 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:25:53.823568 0.000000 udp 10.0.2.105 7010 -> 81.157.252.245 6093 REQ 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:25:59.446863 0.328495 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:59.775835 0.151262 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:25:59.927629 0.412426 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 829 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:00.340724 0.208659 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:00.549813 0.175154 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:00.725394 0.111698 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:00.837501 0.055354 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:00.893311 0.165550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:01.059432 0.151633 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 753 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:01.211556 0.129702 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 862 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:01.525704 0.059617 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:01.585770 0.452955 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.039213 0.190652 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.230416 0.197988 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.428962 0.022368 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.451784 0.185352 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.637571 0.159497 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 743 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.797631 0.177485 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:02.975564 0.168709 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:03.144694 0.168604 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:03.313791 0.219206 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:03.533451 0.127129 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 816 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:03.661148 0.055307 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:26:04.214135 0.000000 udp 10.0.2.105 7010 -> 24.215.90.141 9370 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:04.603486 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:26:09.601013 0.000000 udp 10.0.2.105 7010 -> 189.135.31.249 8369 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:14.828377 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 7217 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:21.098210 0.000000 udp 10.0.2.105 7010 -> 64.203.234.38 7762 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:27.427296 0.000000 udp 10.0.2.105 7010 -> 77.96.161.186 4205 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:32.043131 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:26:35.738888 0.000000 udp 10.0.2.105 7010 -> 188.131.70.138 9865 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:42.628445 0.000000 udp 10.0.2.105 7010 -> 206.116.22.27 6299 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:49.641766 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:26:56.771562 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:01.546034 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:27:02.867898 0.000000 udp 10.0.2.105 7010 -> 85.107.160.235 2982 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:11.640731 0.000000 udp 10.0.2.105 7010 -> 220.100.111.194 9297 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:20.232428 0.000000 udp 10.0.2.105 7010 -> 82.51.112.124 2254 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:27.623787 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:32.552633 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:27:35.975534 0.000000 udp 10.0.2.105 7010 -> 94.34.143.100 9141 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:42.354610 0.000000 udp 10.0.2.105 7010 -> 116.14.180.34 8975 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:47.562224 0.000000 udp 10.0.2.105 7010 -> 84.173.14.120 7912 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:53.761165 0.023045 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:27:54.161798 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:27:58.547854 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:28:00.090083 0.000000 udp 10.0.2.105 7010 -> 59.97.132.30 7970 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:07.721728 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:14.541115 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:20.019019 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:24.545243 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:28:25.377054 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 9246 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:31.395263 0.000000 udp 10.0.2.105 7010 -> 216.54.136.170 8207 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:37.203723 0.000000 udp 10.0.2.105 7010 -> 213.200.198.73 8374 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:44.174467 0.059356 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:44.233823 0.000000 icmp 151.58.244.201 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 140 flow=Background 1970/02/18 03:28:44.518242 2.999894 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 03:28:49.050706 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:28:51.524015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:28:52.658306 0.000000 udp 10.0.2.105 7010 -> 207.68.115.149 3269 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:28:59.525616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:29:00.853275 0.000000 udp 10.0.2.105 7010 -> 110.168.78.222 8909 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:06.595800 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:14.437335 0.628617 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 2 761 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:29:15.289745 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:15.528792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:29:19.043416 0.462798 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:29:22.053840 0.000000 udp 10.0.2.105 7010 -> 203.97.2.138 7156 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:27.314343 0.062954 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:29:27.685503 0.000000 udp 10.0.2.105 7010 -> 162.205.97.6 1458 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:36.041428 0.000000 udp 10.0.2.105 7010 -> 218.161.43.237 6826 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:42.306645 0.157827 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:29:42.867134 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:47.239430 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:29:47.726852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:29:49.740516 0.000000 udp 10.0.2.105 7010 -> 90.244.156.5 7625 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:29:58.597971 0.054584 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 780 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:29:58.906458 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:05.193055 0.000000 udp 10.0.2.105 7010 -> 2.135.213.194 9836 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:12.796760 0.054491 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 828 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:30:13.087230 0.269666 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:30:13.846368 0.000000 udp 10.0.2.105 7010 -> 95.112.85.55 7751 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:17.665636 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:30:21.507018 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:27.385163 0.000000 udp 10.0.2.105 7010 -> 89.240.184.29 7294 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:34.782834 0.000000 udp 10.0.2.105 7010 -> 92.135.252.62 7556 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:43.264470 0.000000 udp 10.0.2.105 7010 -> 217.155.220.189 8277 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:48.051700 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:30:51.005866 0.000000 udp 10.0.2.105 7010 -> 213.125.13.243 9610 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:30:57.465311 0.000000 udp 10.0.2.105 7010 -> 219.75.6.94 7810 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:02.545556 0.000000 udp 10.0.2.105 7010 -> 108.203.4.207 7270 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:11.435687 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:16.051786 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:31:18.044328 0.160510 udp 10.0.2.105 7010 <-> 67.52.16.254 1809 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:31:18.252810 0.000000 udp 10.0.2.105 7010 -> 84.17.28.238 3256 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:26.897773 0.208656 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 791 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:31:27.847785 0.000000 udp 10.0.2.105 7010 -> 98.101.83.154 5434 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:36.791908 0.141144 udp 10.0.2.105 7010 <-> 81.137.249.215 7633 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:31:37.579562 0.000000 udp 10.0.2.105 7010 -> 178.183.253.243 6133 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:41.548582 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:31:42.760865 0.575719 udp 10.0.2.105 7010 <-> 115.242.201.186 7553 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:31:43.761111 0.000000 udp 10.0.2.105 7010 -> 87.18.38.166 2165 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:31:50.193103 2.757612 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:31:53.337336 0.000000 udp 10.0.2.105 7010 -> 59.95.231.52 2434 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:01.474446 0.000000 udp 10.0.2.105 7010 -> 79.23.9.23 2593 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:08.189592 0.068215 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 799 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:32:08.684437 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:12.909778 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:32:16.429691 0.056903 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:32:16.625467 0.356098 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:32:17.218158 0.000000 udp 10.0.2.105 7010 -> 96.57.178.234 7769 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:23.528112 0.000000 udp 10.0.2.105 7010 -> 173.76.49.39 6939 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:29.844799 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:37.895734 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:42.544911 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:32:45.767559 0.000000 udp 10.0.2.105 7010 -> 92.115.136.227 3807 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:53.188889 0.000000 udp 10.0.2.105 7010 -> 188.30.11.19 5312 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:32:59.383195 0.000000 udp 10.0.2.105 7010 -> 74.94.50.153 5708 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:06.894614 0.000000 udp 10.0.2.105 7010 -> 95.227.83.156 7987 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:11.547923 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:33:14.300966 0.000000 udp 10.0.2.105 7010 -> 84.63.255.108 6478 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:20.963238 0.000000 udp 10.0.2.105 7010 -> 123.201.34.61 2622 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:29.340036 0.000000 udp 10.0.2.105 7010 -> 109.99.21.244 4784 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:36.482389 0.000000 udp 10.0.2.105 7010 -> 178.36.210.198 7759 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:41.201811 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:33:42.637552 0.000000 udp 10.0.2.105 7010 -> 87.28.39.93 6207 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:49.644396 0.061597 udp 10.0.2.105 7010 <-> 92.25.154.61 8345 CON 0 0 2 675 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:33:50.096227 0.204436 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:33:50.388763 0.098585 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:33:50.727550 0.000000 udp 10.0.2.105 7010 -> 108.68.148.194 6504 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:33:57.619439 0.000000 udp 10.0.2.105 7010 -> 87.16.35.165 2426 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:02.665301 0.000000 udp 10.0.2.105 7010 -> 110.169.206.124 4809 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:07.389775 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:34:09.372830 0.253987 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 748 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:34:10.626488 0.000000 udp 10.0.2.105 7010 -> 212.117.68.132 8816 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:18.700949 0.000000 udp 10.0.2.105 7010 -> 196.201.224.150 1807 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:27.439144 0.000000 udp 10.0.2.105 7010 -> 211.28.128.63 1279 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:32.112048 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:34:34.050294 0.466684 udp 10.0.2.105 7010 <-> 27.57.135.253 9499 CON 0 0 2 719 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:34:34.788442 0.124421 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:34:35.292923 0.078258 udp 10.0.2.105 7010 <-> 81.155.153.168 7785 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:34:35.540106 0.000000 udp 10.0.2.105 7010 -> 86.96.108.58 5509 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:44.347870 2.449813 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:34:48.003962 0.000000 udp 10.0.2.105 7010 -> 88.248.110.198 7494 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:54.850460 0.000000 udp 10.0.2.105 7010 -> 82.89.175.71 6750 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:34:59.666336 0.000204 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:35:01.625216 0.000000 udp 10.0.2.105 7010 -> 117.219.68.78 6935 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:08.114107 0.000000 udp 10.0.2.105 7010 -> 93.167.107.63 5449 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:13.148904 0.057747 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:35:13.478183 0.000000 udp 10.0.2.105 7010 -> 213.203.163.146 2858 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:19.413478 0.634077 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 708 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:35:20.269150 0.200625 udp 10.0.2.105 7010 <-> 115.252.123.182 6689 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:35:20.683850 0.089308 udp 10.0.2.105 7010 -> 41.233.97.70 8752 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:20.773158 0.000000 icmp 41.233.97.70 0x0303 -> 10.0.2.105 0x3022 URP 192 1 203 flow=Background 1970/02/18 03:35:24.880908 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:35:27.393878 0.000000 udp 10.0.2.105 7010 -> 88.149.166.196 9637 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:33.540002 0.065807 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:35:33.722001 0.046521 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:35:34.028912 0.000000 udp 10.0.2.105 7010 -> 213.16.195.139 3204 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:42.624530 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:51.043969 0.000000 udp 10.0.2.105 7010 -> 84.28.157.186 8143 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:35:54.498671 2.968358 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 03:35:55.993569 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:35:58.573582 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:01.421606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:36:07.212492 0.000000 udp 10.0.2.105 7010 -> 75.151.248.1 1027 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:09.321759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:36:15.421831 0.087948 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:36:16.240608 0.000000 udp 10.0.2.105 7010 -> 151.73.78.10 4708 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:20.176589 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:36:23.905140 0.000000 udp 10.0.2.105 7010 -> 190.246.234.47 2134 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:25.120544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:36:29.394979 0.000000 udp 10.0.2.105 7010 -> 14.96.114.214 5139 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:37.222677 0.000000 udp 10.0.2.105 7010 -> 88.64.251.160 6222 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:45.965077 0.000000 udp 10.0.2.105 7010 -> 98.221.12.77 9536 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:50.759202 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:36:53.593006 0.000000 udp 10.0.2.105 7010 -> 194.66.216.40 8606 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:36:56.684436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:37:02.135952 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:37:08.600969 0.054070 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 852 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:37:08.941371 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:37:15.637546 0.000000 udp 10.0.2.105 7010 -> 213.175.34.150 7460 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:37:20.360988 0.499755 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:37:22.237008 0.000000 udp 10.0.2.105 7010 -> 80.175.12.54 3704 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 03:37:29.356745 0.278565 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/02/18 03:40:44.048384 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 03:40:44.048479 1.449271 tcp 10.0.2.105 55870 -> 200.84.7.244 8038 FSPA* 0 0 15 1581 flow=From-Botnet-V2-TCP-Established 1970/02/18 03:42:58.564428 3.001693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 03:43:05.572051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:43:13.573571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:43:29.576354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:44:01.582680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:55:40.589953 3.004891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 03:55:47.597489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:55:55.599267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:56:11.603557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 03:56:43.607926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:02:47.614251 3.014366 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 04:02:54.631720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:03:02.633126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:03:18.636134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:03:50.642311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:07:43.307120 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:07:43.307309 0.229181 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:43.536997 0.338012 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:43.875445 0.166350 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.042202 0.093052 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.135644 0.148982 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.285039 0.103900 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.389705 0.046358 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.436534 0.064569 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.501529 0.218178 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.720081 0.204880 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.925654 0.020617 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:44.946671 0.188305 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.135379 0.156243 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.291974 0.181551 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.473978 0.173626 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.648130 0.055666 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.704266 0.215080 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:45.919761 0.157210 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:46.077366 0.158236 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:46.236007 0.022106 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:46.258517 0.524174 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:07:46.783124 0.000000 udp 10.0.2.105 7010 -> 79.77.214.142 6033 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:08:03.420329 0.069443 tcp 10.0.2.105 55871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:03.490019 0.066528 tcp 10.0.2.105 55872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:03.556838 0.154897 tcp 10.0.2.105 55873 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:03.712608 0.154698 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:03.867742 0.054580 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:03.922739 0.052575 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:03.975736 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:08:21.053837 0.066376 tcp 10.0.2.105 55874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:21.120576 0.062979 tcp 10.0.2.105 55875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:21.183912 0.167753 tcp 10.0.2.105 55876 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:21.352382 0.160345 udp 10.0.2.105 7010 <-> 67.52.16.254 1809 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:21.513128 0.234128 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:21.747671 0.090627 udp 10.0.2.105 7010 <-> 81.137.249.215 7633 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:21.838773 0.000000 udp 10.0.2.105 7010 -> 115.242.201.186 7553 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:08:40.545027 0.072701 tcp 10.0.2.105 55877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:40.618094 0.068076 tcp 10.0.2.105 55878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:40.686063 0.154325 tcp 10.0.2.105 55879 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:40.840926 0.141377 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:40.982734 0.058892 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:41.042093 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:08:56.563999 0.063726 tcp 10.0.2.105 55880 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:56.628120 0.067532 tcp 10.0.2.105 55881 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:56.695969 0.255412 tcp 10.0.2.105 55882 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:08:56.951928 0.377239 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:08:57.329630 0.000000 udp 10.0.2.105 7010 -> 92.25.154.61 8345 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:09:14.103524 0.061361 tcp 10.0.2.105 55883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:14.165163 0.068227 tcp 10.0.2.105 55884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:14.233737 0.160739 tcp 10.0.2.105 55885 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:14.395263 0.056318 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:14.452064 0.084635 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:14.537110 0.256828 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:14.794412 0.873922 udp 10.0.2.105 7010 <-> 27.57.135.253 9499 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:15.668784 0.138060 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:15.807324 0.072125 udp 10.0.2.105 7010 <-> 81.155.153.168 7785 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:15.879852 0.089734 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:15.970032 0.057170 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:16.027674 0.069386 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:16.097514 0.000000 udp 10.0.2.105 7010 -> 115.252.123.182 6689 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:09:34.488863 0.736950 tcp 10.0.2.105 55886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:35.226059 0.068371 tcp 10.0.2.105 55887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:35.294714 0.161540 tcp 10.0.2.105 55888 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:09:35.456831 0.061231 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:35.518502 0.046006 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:35.564894 0.083276 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:35.648555 0.052718 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:09:35.701744 0.289184 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:10:18.853877 3.705867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 04:10:26.518812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:10:34.428346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:10:46.113500 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:10:46.113698 0.226456 tcp 10.0.2.105 55889 -> 200.84.7.244 8038 SPA_* 0 0 9 1210 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:10:50.250227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:11:15.999999 0.067143 tcp 10.0.2.105 55890 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:16.067454 0.066245 tcp 10.0.2.105 55891 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:16.133971 0.179238 tcp 10.0.2.105 55892 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:16.558286 0.202229 tcp 10.0.2.105 55889 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:16.760746 4.199716 tcp 10.0.2.105 55893 -> 46.48.235.250 16076 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:19.729214 0.068488 tcp 10.0.2.105 55894 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:19.798034 0.066371 tcp 10.0.2.105 55895 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:19.864722 0.153828 tcp 10.0.2.105 55896 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:20.960721 2.954242 tcp 10.0.2.105 55897 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:11:21.888407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:11:29.855956 0.000000 tcp 10.0.2.105 55897 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:11:35.792574 0.068185 tcp 10.0.2.105 55898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:35.861095 0.066001 tcp 10.0.2.105 55899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:35.927365 0.164003 tcp 10.0.2.105 55900 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:36.362677 2.963424 tcp 10.0.2.105 55901 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:11:45.314665 0.000000 tcp 10.0.2.105 55901 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:11:51.313446 0.064586 tcp 10.0.2.105 55902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:51.378310 0.070603 tcp 10.0.2.105 55903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:51.449185 0.159535 tcp 10.0.2.105 55904 -> 195.113.214.249 443 SRPA* 0 0 32 17198 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:52.570111 4.886549 tcp 10.0.2.105 55905 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:57.094674 0.066747 tcp 10.0.2.105 55906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:57.161700 0.061897 tcp 10.0.2.105 55907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:57.223902 0.167008 tcp 10.0.2.105 55908 -> 195.113.214.249 443 SRPA* 0 0 24 12986 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:11:57.456864 2.999357 tcp 10.0.2.105 55909 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:06.457628 0.000000 tcp 10.0.2.105 55909 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:12.459807 0.061534 tcp 10.0.2.105 55910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:12.521247 0.065761 tcp 10.0.2.105 55911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:12.587330 0.157636 tcp 10.0.2.105 55912 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:12.971367 0.437931 tcp 10.0.2.105 55913 -> 200.84.7.244 8038 FSPA* 0 0 13 1426 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:13.409513 4.141544 tcp 10.0.2.105 55914 -> 46.48.235.250 16076 FSPA* 0 0 12 1632 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:17.551268 2.993589 tcp 10.0.2.105 55915 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:18.675403 0.000148 tcp 10.0.2.105 55914 -> 46.48.235.250 16076 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:26.543687 0.000000 tcp 10.0.2.105 55915 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:32.542435 2.994419 tcp 10.0.2.105 55916 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:41.678571 0.000000 tcp 10.0.2.105 55916 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:46.160420 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:12:47.642174 2.959068 tcp 10.0.2.105 55917 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:12:50.601084 2.980217 tcp 10.0.2.105 55918 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:12:59.531210 0.000000 tcp 10.0.2.105 55918 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:17:25.686286 3.001981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 04:17:32.916942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:17:40.846187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:17:56.708214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:18:05.531856 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:18:05.532043 1.619553 tcp 10.0.2.105 55919 -> 200.84.7.244 8038 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:18:28.715099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:24:33.725607 2.998159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 04:24:43.453652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:24:51.363440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:25:07.184537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:25:38.839090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:31:43.766714 2.995084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 04:31:50.767738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:31:58.769365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:32:14.772054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:32:46.778537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:38:50.788727 2.997373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 04:38:57.791640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:39:05.793081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:39:21.796025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:39:41.695127 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:39:41.695390 0.082972 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:39:41.755090 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:39:53.802446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:40:00.303546 0.062246 tcp 10.0.2.105 55920 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:00.366069 0.071016 tcp 10.0.2.105 55921 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:00.437382 0.237170 tcp 10.0.2.105 55922 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:00.675223 0.000000 udp 10.0.2.105 7010 -> 115.242.201.186 7553 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:40:19.429734 0.068216 tcp 10.0.2.105 55923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:19.498244 0.065544 tcp 10.0.2.105 55924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:19.564035 0.152254 tcp 10.0.2.105 55925 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:19.716832 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:40:37.104888 1.342421 tcp 10.0.2.105 55926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:38.447580 0.098440 tcp 10.0.2.105 55927 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:38.546285 0.168615 tcp 10.0.2.105 55928 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:38.715485 0.000000 udp 10.0.2.105 7010 -> 92.25.154.61 8345 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:40:53.774121 0.061480 tcp 10.0.2.105 55929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:53.835903 0.064811 tcp 10.0.2.105 55930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:53.900990 0.206112 tcp 10.0.2.105 55931 -> 195.113.214.249 443 SRPA* 0 0 32 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:40:54.107785 0.000000 udp 10.0.2.105 7010 -> 115.252.123.182 6689 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:41:09.213641 0.069476 tcp 10.0.2.105 55932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:09.283373 0.066377 tcp 10.0.2.105 55933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:09.350014 0.163145 tcp 10.0.2.105 55934 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:09.514192 0.235108 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:09.742085 0.090310 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:09.986747 0.174342 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:10.158083 0.559266 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:10.689121 0.177520 udp 10.0.2.105 7010 <-> 70.30.170.125 3161 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:16.492471 0.125839 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:16.598371 0.111525 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:17.156548 0.133128 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:17.242304 0.185114 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:17.431044 0.202168 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:17.904945 0.188313 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:18.090496 0.243001 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:18.309929 0.029443 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:18.848153 0.193521 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:19.034687 0.057560 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:19.486007 0.235690 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:19.704305 0.184357 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:19.866859 0.328796 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:22.310711 0.231000 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:23.101836 0.024321 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:23.137801 1.150146 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:23.653154 0.070693 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:23.706576 0.056907 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:24.066215 0.180323 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:24.370836 0.000000 udp 10.0.2.105 7010 -> 67.52.16.254 1809 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:41:42.668183 0.062577 tcp 10.0.2.105 55935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:42.731011 0.066165 tcp 10.0.2.105 55936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:42.797450 0.164346 tcp 10.0.2.105 55937 -> 195.113.214.249 443 SRPA* 0 0 41 22614 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:41:42.962462 0.069056 udp 10.0.2.105 7010 <-> 81.137.249.215 7633 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:43.017985 0.215297 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:43.444712 0.165329 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:43.617303 0.074647 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:41:43.678129 0.000000 udp 10.0.2.105 7010 -> 218.164.140.53 7010 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 04:42:00.207392 0.064253 tcp 10.0.2.105 55938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:42:00.272039 0.061044 tcp 10.0.2.105 55939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:42:00.333359 0.168657 tcp 10.0.2.105 55940 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:42:00.502556 0.263309 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:00.758327 0.993907 udp 10.0.2.105 7010 <-> 27.57.135.253 9499 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:01.405777 0.239475 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:02.051069 0.145881 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:02.175120 0.079639 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:02.294354 0.061231 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:02.576618 0.084849 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:02.881565 0.250425 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:03.169605 0.162327 udp 10.0.2.105 7010 <-> 81.155.153.168 7785 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:03.268847 0.049481 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:03.409905 0.096471 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:03.497007 0.072150 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:03.692358 0.313254 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:42:04.003057 0.084161 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/18 04:45:57.809967 3.000040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 04:46:04.815789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:46:12.817434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:46:28.820122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:47:00.826739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:48:07.152194 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 04:48:07.152391 0.275083 tcp 10.0.2.105 55941 -> 200.84.7.244 8038 SPA_* 0 0 9 1123 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:37.426659 0.067808 tcp 10.0.2.105 55942 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:37.494721 0.064341 tcp 10.0.2.105 55943 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:37.559347 0.155854 tcp 10.0.2.105 55944 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:37.701136 0.064980 tcp 10.0.2.105 55941 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:37.766284 3.003646 tcp 10.0.2.105 55945 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:48:46.768848 0.000000 tcp 10.0.2.105 55945 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:48:52.767563 0.068021 tcp 10.0.2.105 55946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:52.835950 0.067001 tcp 10.0.2.105 55947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:52.903301 0.167390 tcp 10.0.2.105 55948 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:48:53.343191 3.008954 tcp 10.0.2.105 55949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:49:02.366225 0.000000 tcp 10.0.2.105 55949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:49:08.341118 0.061600 tcp 10.0.2.105 55950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:08.403011 0.065063 tcp 10.0.2.105 55951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:08.468372 0.171524 tcp 10.0.2.105 55952 -> 195.113.214.249 443 SRPA* 0 0 34 19454 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:08.778388 3.257501 tcp 10.0.2.105 55953 -> 46.48.223.67 15494 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:11.673795 0.064744 tcp 10.0.2.105 55954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:11.738816 0.066904 tcp 10.0.2.105 55955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:11.806047 0.157674 tcp 10.0.2.105 55956 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:12.036147 3.003020 tcp 10.0.2.105 55957 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:49:21.040629 0.000000 tcp 10.0.2.105 55957 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 04:49:27.037528 0.072688 tcp 10.0.2.105 55958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:27.110069 0.071597 tcp 10.0.2.105 55959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:27.181954 0.163162 tcp 10.0.2.105 55960 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:27.620878 0.219599 tcp 10.0.2.105 55961 -> 200.84.7.244 8038 SPA_* 0 0 9 1123 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:49:48.496563 0.260597 tcp 10.0.2.105 55961 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/18 04:53:04.832661 3.001141 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 04:53:11.839520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:53:19.841196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:53:35.843872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 04:54:07.852079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:00:11.856203 3.001615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:00:18.863614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:00:26.864880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:00:42.868014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:01:14.874334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:07:18.879829 3.001982 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:07:25.887805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:07:38.013636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:07:53.815119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:08:26.601217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:12:13.460354 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 05:12:13.460464 0.000000 udp 10.0.2.105 7010 -> 67.52.16.254 1809 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:12:32.086601 0.223168 tcp 10.0.2.105 55962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:32.310106 0.066856 tcp 10.0.2.105 55963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:32.377242 0.153171 tcp 10.0.2.105 55964 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:32.530966 0.000000 udp 10.0.2.105 7010 -> 218.164.140.53 7010 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:12:49.296178 0.477631 tcp 10.0.2.105 55965 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:49.774177 0.066551 tcp 10.0.2.105 55966 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:49.840991 0.175716 tcp 10.0.2.105 55967 -> 195.113.214.249 443 SRPA* 0 0 27 11102 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:12:50.015230 0.000000 udp 10.0.2.105 7010 -> 79.77.214.142 6033 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:13:08.496628 0.070897 tcp 10.0.2.105 55968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:08.567776 0.061556 tcp 10.0.2.105 55969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:08.629703 0.165189 tcp 10.0.2.105 55970 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:08.793686 0.171160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:08.965222 0.064245 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:09.029850 0.226220 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:09.256588 0.684135 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:09.941207 0.105074 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:10.046736 0.000000 udp 10.0.2.105 7010 -> 70.30.170.125 3161 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:13:27.699495 0.063753 tcp 10.0.2.105 55971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:27.763565 0.069482 tcp 10.0.2.105 55972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:27.833355 0.164397 tcp 10.0.2.105 55973 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:27.998442 0.198480 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.197343 0.183149 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.380885 0.092381 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.473645 0.048923 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.522949 0.154580 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.677976 0.192348 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.870706 0.023731 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:28.894872 0.181047 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.076400 0.056373 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.133228 0.215469 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.349060 0.158605 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.508073 0.172373 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.680879 0.056184 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.737426 0.056127 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.793960 0.119428 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:29.913823 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:13:37.056965 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:13:37.057432 0.022139 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:37.079974 0.152832 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:37.397701 0.062856 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 213 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:37.460993 0.204393 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:37.665758 0.000000 udp 10.0.2.105 7010 -> 81.137.249.215 7633 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:13:54.864583 0.063561 tcp 10.0.2.105 55974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:54.928555 0.072473 tcp 10.0.2.105 55975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:55.001283 0.158588 tcp 10.0.2.105 55976 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:13:55.160503 0.138874 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:55.299776 0.251836 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:55.552047 0.614957 udp 10.0.2.105 7010 <-> 27.57.135.253 9499 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.167388 0.148816 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.316701 0.085478 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.402578 0.078175 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.481132 0.051804 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.533478 0.064260 udp 10.0.2.105 7010 <-> 81.155.153.168 7785 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.598116 0.045809 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.644520 0.084024 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.728931 0.068060 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.797360 0.122715 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.920657 0.060531 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:56.981543 0.050861 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:13:57.032745 0.282654 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:14:26.295350 2.954537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 05:14:33.207639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:14:41.105019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:14:56.936103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:15:28.942044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:19:48.755996 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 05:19:48.756101 4.712620 tcp 10.0.2.105 55977 -> 200.84.7.244 8038 FSPA* 0 0 15 1648 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:21:32.947898 3.001777 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:21:39.957238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:21:47.957244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:22:03.960174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:22:35.966076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:28:40.979449 2.995766 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:28:47.981196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:28:55.982236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:29:11.987852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:29:43.991648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:35:47.997771 3.001396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:35:55.005104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:36:03.016705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:36:19.019373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:36:51.025194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:42:55.031660 3.007325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 05:43:02.038993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:43:10.040244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:43:28.212155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:43:59.844402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:44:06.105206 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 05:44:06.105317 0.058455 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:06.164143 0.000000 udp 10.0.2.105 7010 -> 70.30.170.125 3161 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:44:23.541253 0.064434 tcp 10.0.2.105 55978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:23.605923 0.068474 tcp 10.0.2.105 55979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:23.674705 0.164034 tcp 10.0.2.105 55980 -> 195.113.214.249 443 SRPA* 0 0 41 23298 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:23.837935 0.000000 udp 10.0.2.105 7010 -> 81.137.249.215 7633 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:44:39.023303 0.067243 tcp 10.0.2.105 55981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:39.090867 0.064579 tcp 10.0.2.105 55982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:39.155704 0.157042 tcp 10.0.2.105 55983 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:39.313267 0.168745 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:39.482411 0.066546 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:39.549331 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:44:57.509906 0.062028 tcp 10.0.2.105 55984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:57.572233 0.062048 tcp 10.0.2.105 55985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:57.634585 0.159687 tcp 10.0.2.105 55986 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:44:57.794803 0.105101 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:57.900310 0.708536 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:58.609249 0.079863 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:58.689566 0.043162 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:58.733182 0.196705 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:58.930243 0.186419 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.117058 0.157383 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.274825 0.182963 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.458161 0.056546 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.515116 0.214991 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.730463 0.159649 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.890503 0.021584 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:44:59.912480 0.192247 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.105149 0.056337 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.161965 0.128625 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.291038 0.173934 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.465411 0.050880 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.516687 0.158275 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.923680 0.063131 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:00.987227 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 96 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:09.407563 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:09.407947 0.021928 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:09.430231 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:28.012018 0.063239 tcp 10.0.2.105 55987 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:28.075526 0.069054 tcp 10.0.2.105 55988 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:28.144874 0.163310 tcp 10.0.2.105 55989 -> 195.113.214.249 443 SRPA* 0 0 22 11394 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:28.308847 0.142942 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:28.452193 0.251784 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:28.704403 0.000000 udp 10.0.2.105 7010 -> 27.57.135.253 9499 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:35.037268 0.000000 udp 10.0.2.105 7010 <- 27.57.135.253 9499 RSP 0 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:35.037664 0.178061 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:35.216136 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 05:45:50.634390 0.062457 tcp 10.0.2.105 55990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:50.697129 0.067720 tcp 10.0.2.105 55991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:50.765138 0.164186 tcp 10.0.2.105 55992 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:45:50.929995 0.094096 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.024522 0.051655 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.076712 0.066931 udp 10.0.2.105 7010 <-> 81.155.153.168 7785 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.144039 0.043787 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.188208 0.264966 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.453561 0.067604 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.521609 0.353962 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.875978 0.059261 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.935642 0.049349 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:45:51.985374 0.286599 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 05:49:53.471166 0.000163 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 05:49:53.471450 0.223300 tcp 10.0.2.105 55993 -> 200.84.7.244 8038 SPA_* 0 0 9 1175 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:50:01.807747 0.538234 tcp 10.0.2.105 55993 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/18 05:55:35.074688 3.457887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 05:55:42.512538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:55:50.441213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:56:06.302065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 05:56:38.102242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:02:42.107643 3.002432 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:02:49.115904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:02:57.117013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:03:13.120568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:03:45.136113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:10:13.146565 3.720134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:10:20.826526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:10:28.730427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:10:44.543921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:11:19.382966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:16:17.237958 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 06:16:17.238143 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:16:34.374052 0.241304 tcp 10.0.2.105 55994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:34.615660 0.062399 tcp 10.0.2.105 55995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:34.678337 0.156091 tcp 10.0.2.105 55996 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:34.835112 0.206598 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:16:35.042055 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:16:53.320362 0.061305 tcp 10.0.2.105 55997 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:53.381970 0.069251 tcp 10.0.2.105 55998 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:53.451065 0.164727 tcp 10.0.2.105 55999 -> 195.113.214.249 443 SRPA* 0 0 22 11396 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:16:53.616423 0.062187 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:16:53.679020 0.169079 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:16:53.848655 0.061679 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:16:53.910743 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:17:12.517741 0.070644 tcp 10.0.2.105 56000 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:12.588678 0.066255 tcp 10.0.2.105 56001 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:12.655202 0.159329 tcp 10.0.2.105 56002 -> 195.113.214.249 443 SRPA* 0 0 41 23296 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:12.813375 0.200773 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:13.014540 0.186141 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:13.201113 0.156728 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:13.358277 0.082636 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:13.441345 0.797032 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.238801 0.061628 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.300799 0.159905 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.461040 0.020514 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.481933 0.191605 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.673888 0.055453 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.729675 0.130096 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:14.860200 0.224461 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.085105 0.182184 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.267664 0.055048 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.323070 0.171200 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.494694 0.153496 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.648592 0.054487 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.703462 0.061218 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:15.765088 2.796495 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:18.562051 0.022045 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:18.584772 0.140428 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:18.725560 0.252411 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:18.978377 0.000000 udp 10.0.2.105 7010 -> 27.57.135.253 9499 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:17:20.190486 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 06:17:27.198372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:17:35.199751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:17:37.903841 0.065868 tcp 10.0.2.105 56003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:37.970025 0.061301 tcp 10.0.2.105 56004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:38.031638 0.163840 tcp 10.0.2.105 56005 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:38.195978 0.295270 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:38.491597 0.077119 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:38.569090 0.051076 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:38.620694 0.000000 udp 10.0.2.105 7010 -> 81.155.153.168 7785 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:17:51.202635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:17:56.994059 0.072030 tcp 10.0.2.105 56006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:57.066383 0.060954 tcp 10.0.2.105 56007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:57.127643 0.155491 tcp 10.0.2.105 56008 -> 195.113.214.249 443 SRPA* 0 0 21 11536 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:17:57.283645 0.045555 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.329634 0.083190 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.413280 0.071590 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.485276 0.052767 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.538429 0.281232 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.820089 0.122231 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:17:57.942702 0.058476 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:18:23.397340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:20:03.152906 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 06:20:03.152998 1.305573 tcp 10.0.2.105 56009 -> 200.84.7.244 8038 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:24:27.235624 3.004407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:24:34.242268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:24:42.243508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:24:58.246910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:25:30.728241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:31:34.268821 3.001739 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:31:41.276324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:31:49.277648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:32:05.280585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:32:37.287301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:38:41.295512 2.999095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:38:48.300896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:38:56.301559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:39:12.305531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:39:44.310715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:45:48.326238 3.001765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 06:45:55.334050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:46:03.335711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:46:19.338468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:46:51.344138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:48:17.368911 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 06:48:17.369019 0.103557 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:17.472981 0.000000 udp 10.0.2.105 7010 -> 27.57.135.253 9499 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:48:29.293284 0.000000 udp 10.0.2.105 7010 <- 27.57.135.253 9499 RSP 0 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:48:29.293666 0.000000 udp 10.0.2.105 7010 -> 81.155.153.168 7785 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 06:48:46.821866 0.075271 tcp 10.0.2.105 56010 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:48:46.897360 0.061519 tcp 10.0.2.105 56011 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:48:46.959223 0.155035 tcp 10.0.2.105 56012 -> 195.113.214.249 443 SRPA* 0 0 46 41620 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:48:47.115076 0.203181 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.318694 0.168533 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.487606 0.055323 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.543357 0.067299 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.611121 0.201807 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.813307 0.079769 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:47.893521 0.931590 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:48.825462 0.188119 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:49.013949 0.196292 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:49.210594 0.055550 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:49.266479 0.129341 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:49.396445 0.216897 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:49.613751 0.159902 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.181569 0.055839 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.237834 0.019335 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.257582 0.333789 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.591822 0.157680 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.749867 0.053055 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:51.803351 0.066730 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:52.016680 0.179093 udp 10.0.2.105 7010 <-> 108.206.48.250 1466 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:52.196167 0.171514 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:52.368134 0.106617 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:52.475127 0.022026 udp 10.0.2.105 7010 <-> 195.96.245.164 9281 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:52.497529 4.723885 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:57.221791 0.141043 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:57.363223 0.255420 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:57.618985 0.077870 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:57.697277 0.272361 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:57.970080 0.050901 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.021411 0.045670 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.067504 0.083645 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.151517 0.065646 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.217599 0.052373 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.270317 0.065648 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.336598 0.282698 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:48:58.619636 0.121767 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/18 06:50:03.671494 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 06:50:03.671653 0.232816 tcp 10.0.2.105 56013 -> 200.84.7.244 8038 SPA_* 0 0 9 1155 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:50:28.078800 0.299693 tcp 10.0.2.105 56013 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/18 06:57:03.356387 3.151192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 06:57:10.481682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:57:18.414471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:57:34.379339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 06:58:06.390951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:04:10.390992 3.001785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:04:17.398718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:04:25.402876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:04:41.403121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:05:13.419261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:11:17.435616 3.000654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:11:24.442667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:11:32.443949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:11:48.447026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:12:20.453092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:18:24.463236 2.997730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:18:31.466275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:18:39.468232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:18:57.416220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:19:05.108839 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 07:19:05.108954 0.104030 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:05.213446 0.000000 udp 10.0.2.105 7010 -> 27.57.135.253 9499 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:19:20.077798 0.060915 tcp 10.0.2.105 56014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:20.138994 0.064222 tcp 10.0.2.105 56015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:20.203502 0.164236 tcp 10.0.2.105 56016 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:20.368473 0.209299 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:20.578220 0.169021 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:20.747612 0.057846 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:20.805864 0.063565 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:20.869865 0.197596 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:21.067852 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:19:29.055226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:19:36.063800 0.069339 tcp 10.0.2.105 56017 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:36.133410 0.066808 tcp 10.0.2.105 56018 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:36.200595 0.152108 tcp 10.0.2.105 56019 -> 195.113.214.249 443 SRPA* 0 0 33 19400 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:36.353354 0.484398 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:36.838131 0.187828 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.026391 0.194566 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.221345 0.063582 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.285430 0.113807 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.399636 0.216834 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.616835 0.018287 udp 10.0.2.105 7010 <-> 89.147.70.140 4662 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:37.635496 0.641292 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.277232 0.159522 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.437142 0.046491 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.484069 0.153758 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.638231 0.053448 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.692082 0.063679 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:19:38.756187 0.000000 udp 10.0.2.105 7010 -> 108.206.48.250 1466 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:19:56.588825 0.060197 tcp 10.0.2.105 56020 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:56.649280 0.070707 tcp 10.0.2.105 56021 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:56.720281 0.150578 tcp 10.0.2.105 56022 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:19:56.871533 0.000000 udp 10.0.2.105 7010 -> 195.96.245.164 9281 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:20:11.738302 0.071054 tcp 10.0.2.105 56023 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:20:11.809636 0.069618 tcp 10.0.2.105 56024 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:20:11.879569 0.165437 tcp 10.0.2.105 56025 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:20:12.045637 0.172824 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:12.218845 0.103765 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:12.323073 0.502972 udp 10.0.2.105 7010 <-> 72.251.11.16 2321 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:12.826418 0.140858 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:12.967725 0.251907 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.220070 0.084275 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.304780 0.130931 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.436076 0.056756 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.493288 0.045633 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.539588 0.084473 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.624647 0.071352 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.696594 0.052562 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.749537 0.139059 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.889005 0.065266 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:13.954694 0.291598 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:20:29.251742 1.543083 tcp 10.0.2.105 56026 -> 200.84.7.244 8038 FSPA* 0 0 15 1572 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:25:31.493428 3.414909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 07:25:38.878559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:25:46.806979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:26:02.670990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:26:34.521240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:32:38.527494 3.173763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:32:45.669023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:32:53.593849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:33:09.553724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:33:41.554765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:39:45.560793 3.002211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:39:52.571155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:40:00.569812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:40:16.572641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:40:48.579066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:46:52.584414 3.014620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 07:46:59.604698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:47:07.603949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:47:23.607077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:47:55.612958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:50:17.877991 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 07:50:17.878249 2.877089 udp 10.0.2.105 7010 -> 27.57.135.253 9499 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:50:20.755338 0.000000 icmp 27.57.135.253 0x0303 -> 10.0.2.105 0x1b25 URP 192 1 117 flow=Background 1970/02/18 07:50:29.955290 3.662346 tcp 10.0.2.105 56027 -> 200.84.7.244 8038 FSPA* 0 0 15 1595 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:35.399289 0.076019 tcp 10.0.2.105 56028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:35.475674 0.066671 tcp 10.0.2.105 56029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:35.542594 0.168288 tcp 10.0.2.105 56030 -> 195.113.214.249 443 SRPA* 0 0 26 13304 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:35.711470 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:50:54.370482 0.063895 tcp 10.0.2.105 56031 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:54.434683 0.067013 tcp 10.0.2.105 56032 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:54.501993 0.169433 tcp 10.0.2.105 56033 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:50:54.671943 0.000000 udp 10.0.2.105 7010 -> 108.206.48.250 1466 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:51:10.433716 0.089839 tcp 10.0.2.105 56034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:10.523859 0.071283 tcp 10.0.2.105 56035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:10.595401 0.165452 tcp 10.0.2.105 56036 -> 195.113.214.249 443 SRPA* 0 0 35 19198 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:10.759661 0.000000 udp 10.0.2.105 7010 -> 195.96.245.164 9281 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:51:29.340615 0.068485 tcp 10.0.2.105 56037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:29.409400 0.066372 tcp 10.0.2.105 56038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:29.476079 0.157131 tcp 10.0.2.105 56039 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:29.633881 0.104323 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:51:29.738632 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:51:47.336976 0.063942 tcp 10.0.2.105 56040 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:47.401274 0.065148 tcp 10.0.2.105 56041 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:47.466764 0.164838 tcp 10.0.2.105 56042 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:51:47.632151 0.243544 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:51:47.876064 0.000000 udp 10.0.2.105 7010 -> 79.77.214.142 6033 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:52:04.971609 0.059787 tcp 10.0.2.105 56043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:05.031682 0.063596 tcp 10.0.2.105 56044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:05.095582 0.157636 tcp 10.0.2.105 56045 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:05.253786 0.199731 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:05.453917 0.061671 udp 10.0.2.105 7010 <-> 81.149.216.20 6934 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:05.516022 0.131357 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:05.647745 0.185476 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:05.833649 0.192151 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:06.026231 0.065359 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:06.091946 0.157373 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:06.249760 0.158585 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:06.408746 0.048478 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:06.457595 0.000000 udp 10.0.2.105 7010 -> 89.147.70.140 4662 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:52:22.218307 0.061194 tcp 10.0.2.105 56046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:22.279758 0.067541 tcp 10.0.2.105 56047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:22.347604 0.167626 tcp 10.0.2.105 56048 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:22.515883 0.217109 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:22.733457 0.772620 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:23.506470 0.054877 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:23.561754 0.153053 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:23.715255 0.062797 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:23.778456 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:52:36.481039 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:52:36.481475 0.140582 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:36.622433 0.172743 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:36.795581 0.057317 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:36.853343 0.253353 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.107142 0.078432 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.185980 0.094078 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.280508 0.050877 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.331722 0.046281 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.378339 0.086159 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:37.464830 0.073346 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:38.165657 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 07:52:56.025781 0.060794 tcp 10.0.2.105 56049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:56.086856 0.081115 tcp 10.0.2.105 56050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:56.168226 0.152526 tcp 10.0.2.105 56051 -> 195.113.214.249 443 SRPA* 0 0 24 13822 flow=From-Botnet-V2-TCP-Established 1970/02/18 07:52:56.321418 0.121455 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:56.443290 0.059569 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:52:56.503272 0.276110 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/18 07:53:59.618549 3.002174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 07:54:06.625989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:54:14.627909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:54:30.635102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 07:55:02.639373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:01:06.644067 3.000416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:01:13.652962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:01:21.651903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:01:37.655214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:02:09.661229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:08:13.667146 3.003757 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:08:20.675850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:08:28.675280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:08:44.678726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:09:16.684519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:15:20.701284 3.001178 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:15:27.708470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:15:38.313899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:15:54.143583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:16:25.967664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:20:33.539542 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 08:20:33.539684 1.724597 tcp 10.0.2.105 56052 -> 200.84.7.244 8038 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:22:27.744493 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:22:34.755287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:22:42.753293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:22:58.756898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:23:22.021067 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 08:23:22.021210 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:23:30.772778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:23:40.137977 2.530393 tcp 10.0.2.105 56053 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:23:42.668736 0.137013 tcp 10.0.2.105 56054 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:23:42.805996 0.156962 tcp 10.0.2.105 56055 -> 195.113.214.249 443 SRPA* 0 0 45 34168 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:23:42.963195 0.056393 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:23:43.020000 0.000000 udp 10.0.2.105 7010 -> 89.147.70.140 4662 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:24:00.232461 0.065883 tcp 10.0.2.105 56056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:00.298671 0.083548 tcp 10.0.2.105 56057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:00.382526 0.171338 tcp 10.0.2.105 56058 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:00.554406 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:24:17.379435 0.063531 tcp 10.0.2.105 56059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:17.443308 0.064906 tcp 10.0.2.105 56060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:17.508539 0.153055 tcp 10.0.2.105 56061 -> 195.113.214.249 443 SRPA* 0 0 21 10740 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:17.662245 0.105310 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:17.767946 0.168168 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:17.936504 0.198627 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:18.135547 0.194325 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:18.330244 0.065273 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:18.396016 0.186452 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:18.582848 0.127094 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:18.710309 0.000000 udp 10.0.2.105 7010 -> 81.149.216.20 6934 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:24:37.012134 0.078608 tcp 10.0.2.105 56062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:37.091013 0.068081 tcp 10.0.2.105 56063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:37.159415 0.156380 tcp 10.0.2.105 56064 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:24:37.316465 0.161006 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:37.477849 0.154273 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:37.632613 1.940161 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:39.573185 0.216064 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:39.789635 0.155280 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:39.945375 0.062680 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:40.008436 0.050194 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:40.059042 0.495369 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:40.554784 0.173721 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:40.728898 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:24:46.256170 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:24:46.256572 0.141173 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.398113 0.077398 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.475908 0.058326 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.534603 0.056441 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.591438 0.051705 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.643579 0.082314 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.726352 0.068984 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:46.795712 0.253209 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:24:47.049373 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:25:04.397020 0.072205 tcp 10.0.2.105 56065 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:25:04.469518 0.067553 tcp 10.0.2.105 56066 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:25:04.537374 0.168550 tcp 10.0.2.105 56067 -> 195.113.214.249 443 SRPA* 0 0 21 11766 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:25:04.706509 0.282209 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:25:04.989176 0.132278 udp 10.0.2.105 7010 <-> 2.192.235.45 9511 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:25:05.121828 0.060644 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:29:34.778960 3.139448 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 08:29:41.893413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:29:49.834124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:30:05.800847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:30:37.806916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:36:41.812495 3.001794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:36:48.820428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:36:56.824596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:37:12.824217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:37:44.831050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:43:48.837097 3.218197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 08:43:56.024873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:44:04.090099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:44:19.958471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:44:53.105291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:50:35.269439 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 08:50:35.269536 0.213846 tcp 10.0.2.105 56068 -> 200.84.7.244 8038 SPA_* 0 0 9 1204 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:50:43.486429 0.105696 tcp 10.0.2.105 56068 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:55:30.042739 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 08:55:30.042836 0.000000 udp 10.0.2.105 7010 -> 81.149.216.20 6934 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:55:46.287856 0.463296 tcp 10.0.2.105 56069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:55:46.751437 0.060933 tcp 10.0.2.105 56070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:55:46.812700 0.157455 tcp 10.0.2.105 56071 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:55:46.970752 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:56:04.899155 2.997501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 08:56:05.547348 0.060595 tcp 10.0.2.105 56072 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:56:05.608390 0.143272 tcp 10.0.2.105 56073 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:56:05.751931 0.181011 tcp 10.0.2.105 56074 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:56:05.933467 0.057853 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:05.991742 0.167766 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.159878 0.201254 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.361543 0.105255 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.467228 0.115579 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.583332 0.184677 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.768386 0.068976 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:06.837712 0.191836 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:07.029964 0.157834 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:07.188157 0.152370 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:07.340869 0.215460 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:07.556696 2.520060 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.077159 0.047823 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.125404 0.330564 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.456594 0.171823 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.628833 0.064381 udp 10.0.2.105 7010 <-> 86.140.77.20 5873 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.693606 0.155787 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.849849 0.142186 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:10.992420 0.078617 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.071402 0.056641 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.128584 0.056719 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.185656 0.048589 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.234647 0.097702 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.332791 0.302213 udp 10.0.2.105 7010 <-> 86.139.179.116 6889 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:11.635338 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:56:11.902820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:56:19.903955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:56:25.432696 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:56:25.433041 0.255599 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:25.689032 0.060051 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:25.749499 0.288412 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 08:56:26.050102 0.159870 udp 10.0.2.105 7010 -> 2.192.235.45 9511 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 08:56:26.209972 0.000000 icmp 2.192.235.45 0x0303 -> 10.0.2.105 0x2725 URP 192 1 136 flow=Background 1970/02/18 08:56:30.048492 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 08:56:35.907221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 08:56:44.891368 0.063124 tcp 10.0.2.105 56075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:56:44.954756 0.065229 tcp 10.0.2.105 56076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:56:45.020361 0.254948 tcp 10.0.2.105 56077 -> 195.113.214.249 443 SRPA* 0 0 23 13180 flow=From-Botnet-V2-TCP-Established 1970/02/18 08:57:07.912773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:03:11.918794 3.002036 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:03:18.926247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:03:26.930965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:03:42.931149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:04:14.937226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:10:31.951135 3.001774 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:10:38.959336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:10:46.960717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:11:02.963488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:11:34.969724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:17:38.975586 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:17:45.982585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:17:53.984767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:18:09.987472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:18:41.998042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:20:43.598969 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 09:20:43.599164 2.773810 tcp 10.0.2.105 56078 -> 200.84.7.244 8038 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:24:46.000019 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:24:53.007191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:25:01.008813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:25:17.011899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:25:49.017623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:27:11.827822 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 09:27:11.827928 0.155343 udp 10.0.2.105 7010 -> 2.192.235.45 9511 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:27:11.983271 0.000000 icmp 2.192.235.45 0x0303 -> 10.0.2.105 0x2725 URP 192 1 260 flow=Background 1970/02/18 09:27:30.367809 0.073077 tcp 10.0.2.105 56079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:30.441196 0.070741 tcp 10.0.2.105 56080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:30.512453 0.173958 tcp 10.0.2.105 56081 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:30.686971 0.057889 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:30.745365 0.104192 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:30.849934 0.109659 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:30.959981 0.169612 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.129988 0.201482 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.331915 0.093431 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.425728 0.191218 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.617325 0.183369 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.801061 0.159393 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:31.960844 0.158589 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:32.119824 0.216228 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:32.336463 0.821521 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:33.158467 0.050577 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:33.209424 1.968916 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.178714 0.171707 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.350841 0.154274 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.505570 0.143066 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.743361 0.077357 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.821094 0.081619 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:35.903237 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:27:51.624536 0.200269 tcp 10.0.2.105 56082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:51.824789 0.073718 tcp 10.0.2.105 56083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:51.898796 0.225333 tcp 10.0.2.105 56084 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:27:52.124770 0.049989 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:27:52.175102 0.000000 udp 10.0.2.105 7010 -> 86.140.77.20 5873 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:28:08.874232 0.070934 tcp 10.0.2.105 56085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:08.945349 0.289757 tcp 10.0.2.105 56086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:09.235376 0.167861 tcp 10.0.2.105 56087 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:09.403898 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:28:26.436553 0.527953 tcp 10.0.2.105 56088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:26.964795 0.344214 tcp 10.0.2.105 56089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:27.309310 0.175211 tcp 10.0.2.105 56090 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:28:27.485054 0.085283 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:28:27.570733 0.252587 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:28:27.823716 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:28:35.461698 0.000000 udp 10.0.2.105 7010 <- 72.251.11.16 2321 RSP 0 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:28:35.462067 0.062731 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:28:35.525252 0.273227 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:31:53.027748 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 09:32:00.031155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:32:08.035324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:32:24.035579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:32:56.042585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:39:00.047486 3.360235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:39:07.374946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:39:15.304719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:39:31.173743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:40:03.075979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:46:07.082265 3.001041 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:46:14.089001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:46:22.090671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:46:38.103122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:47:10.280496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:50:46.040412 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 09:50:46.040491 0.215921 tcp 10.0.2.105 56091 -> 200.84.7.244 8038 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:50:55.033742 0.052774 tcp 10.0.2.105 56091 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:53:14.125165 3.002209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 09:53:21.132643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:53:29.144341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:53:45.147816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:54:17.156331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 09:59:01.773632 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 09:59:01.773730 0.000000 udp 10.0.2.105 7010 -> 86.140.77.20 5873 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:59:20.222596 0.158302 tcp 10.0.2.105 56092 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:20.381241 0.063214 tcp 10.0.2.105 56093 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:20.444727 0.161290 tcp 10.0.2.105 56094 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:20.788153 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:59:36.243000 0.062406 tcp 10.0.2.105 56095 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:36.305700 0.064744 tcp 10.0.2.105 56096 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:36.370805 0.162228 tcp 10.0.2.105 56097 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:36.533725 0.000000 udp 10.0.2.105 7010 -> 86.139.179.116 6889 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 09:59:55.250292 0.063417 tcp 10.0.2.105 56098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:55.314004 0.067828 tcp 10.0.2.105 56099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:55.382226 0.267947 tcp 10.0.2.105 56100 -> 195.113.214.249 443 SRPA* 0 0 44 35966 flow=From-Botnet-V2-TCP-Established 1970/02/18 09:59:55.650846 0.127716 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:55.778935 0.105818 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:55.885114 0.056137 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:55.941683 0.168254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:56.110335 0.184747 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:56.295533 0.158073 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:56.454056 0.156875 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:56.611330 0.198722 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:56.810415 0.191149 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.001971 0.067578 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.069964 0.218001 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.288347 0.329059 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.617813 0.055862 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.674059 0.056834 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.731247 0.153254 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.884917 0.048364 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:57.933664 0.171381 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.105561 0.138828 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.244790 0.104553 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.349697 0.059660 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.409760 0.083259 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.493397 0.257959 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/18 09:59:58.751752 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:00:16.630956 0.061749 tcp 10.0.2.105 56101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:00:16.693009 0.065995 tcp 10.0.2.105 56102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:00:16.759243 0.167685 tcp 10.0.2.105 56103 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:00:16.927521 0.063991 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:00:16.992003 0.271640 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:00:21.161634 2.999812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 10:00:28.167000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:00:36.172972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:00:52.171359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:01:24.177548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:07:28.189127 3.013351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 10:07:35.199198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:07:43.204530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:07:59.204388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:08:31.212684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:14:35.207956 3.011312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 10:14:42.225007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:14:50.226594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:15:06.229497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:15:38.235376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:20:55.091824 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:20:55.091927 1.445394 tcp 10.0.2.105 56104 -> 200.84.7.244 8038 FSPA* 0 0 15 1676 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:21:42.241789 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 10:21:49.249869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:21:57.666305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:22:13.523745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:22:45.274735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:28:49.274943 3.005857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 10:28:56.283834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:29:04.283951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:29:20.287443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:29:52.293323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:30:23.017913 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:30:23.018000 0.000000 udp 10.0.2.105 7010 -> 72.251.11.16 2321 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:30:41.325858 0.069401 tcp 10.0.2.105 56105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:30:41.395524 0.062918 tcp 10.0.2.105 56106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:30:41.458779 0.164742 tcp 10.0.2.105 56107 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:30:41.624332 0.118293 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:41.743085 0.263673 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.007232 0.186829 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.194481 0.162289 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.357127 0.102512 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.460040 0.066422 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.526827 0.191873 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.719099 0.070202 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.789662 0.199700 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:42.989797 0.361834 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:43.351993 0.053676 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:43.406075 0.060980 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:43.467464 0.401314 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:43.869127 0.216281 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:44.085789 0.060532 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:30:44.146720 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:02.074347 0.063634 tcp 10.0.2.105 56108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:31:02.138236 0.065482 tcp 10.0.2.105 56109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:31:02.204016 0.151884 tcp 10.0.2.105 56110 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:31:02.356562 0.141453 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:02.498362 0.078317 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:02.576997 0.049832 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:02.627180 0.095054 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:02.722575 0.155716 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:02.878640 0.257157 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:03.136386 0.070149 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:03.206882 0.289012 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:03.621587 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 REQ 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:09.885454 0.165005 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.050942 0.127604 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 806 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.179116 0.160561 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.340136 0.108489 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.449051 0.100393 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 709 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.549886 0.190347 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.740671 0.185656 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 826 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:10.926750 0.200801 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 679 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:11.128153 0.073628 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 778 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:11.202241 0.063092 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:11.265908 0.590282 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:11.856847 0.222619 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 682 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.079977 0.159595 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.240085 0.085034 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.325596 0.062204 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.388459 0.146247 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.535290 0.078773 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.614621 0.048764 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.663842 0.086377 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 678 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.750915 0.159376 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.910829 0.055758 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:12.967049 0.290056 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:13.257646 0.262963 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 767 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:31:13.521368 0.000000 udp 10.0.2.105 7010 -> 14.99.64.150 7544 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:21.571962 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:26.539001 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:31:27.310097 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 6533 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:33.088752 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:40.138536 0.000000 udp 10.0.2.105 7010 -> 71.43.117.181 7943 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:49.036731 0.155035 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:31:49.191766 0.000000 icmp 14.140.174.2 0x0303 -> 10.0.2.105 0x7017 URP 192 1 162 flow=Background 1970/02/18 10:31:53.547731 0.000036 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:31:54.890040 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 2782 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:02.904436 0.000000 udp 10.0.2.105 7010 -> 206.116.22.27 6299 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:10.051619 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:18.523825 0.000000 udp 10.0.2.105 7010 -> 181.66.156.46 1091 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:24.217716 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:32:24.775780 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:30.479093 0.076281 udp 10.0.2.105 7010 <-> 151.73.19.185 4594 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:32:31.302754 0.000000 udp 10.0.2.105 7010 -> 83.87.160.50 5710 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:37.545004 0.000000 udp 10.0.2.105 7010 -> 95.137.251.112 1025 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:44.837840 0.000000 udp 10.0.2.105 7010 -> 85.101.227.247 7280 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:32:49.425363 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:32:52.301795 0.000000 udp 10.0.2.105 7010 -> 78.147.45.11 8923 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:00.552575 0.401334 udp 10.0.2.105 7010 <-> 94.197.9.81 4890 CON 0 0 2 712 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:33:01.510834 0.000000 udp 10.0.2.105 7010 -> 152.22.0.222 1411 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:07.215741 0.000000 udp 10.0.2.105 7010 -> 202.172.118.245 6428 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:15.118692 0.000000 udp 10.0.2.105 7010 -> 187.163.187.62 4464 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:20.056964 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:33:23.610943 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:31.364657 0.000000 udp 10.0.2.105 7010 -> 94.34.143.100 9141 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:36.599139 0.000000 udp 10.0.2.105 7010 -> 91.142.23.194 6100 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:42.285331 0.000000 udp 10.0.2.105 7010 -> 115.74.250.190 1034 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:46.737753 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:33:47.400691 0.000000 udp 10.0.2.105 7010 -> 151.51.15.82 3242 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:52.405670 0.000000 udp 10.0.2.105 7010 -> 171.100.204.145 4840 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:33:57.457921 0.000000 udp 10.0.2.105 7010 -> 92.13.94.106 4213 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:02.724107 0.000000 udp 10.0.2.105 7010 -> 37.127.162.103 1864 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:08.140961 0.000000 udp 10.0.2.105 7010 -> 79.23.9.23 2593 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:13.335049 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:34:15.189893 0.000000 udp 10.0.2.105 7010 -> 46.196.186.190 1612 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:23.066779 0.000000 udp 10.0.2.105 7010 -> 38.109.47.130 4646 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:29.809642 0.000000 udp 10.0.2.105 7010 -> 83.7.40.233 7393 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:36.930575 0.090045 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:37.020620 0.000000 icmp 213.161.245.142 0x0303 -> 10.0.2.105 0x791a URP 192 1 178 flow=Background 1970/02/18 10:34:41.575771 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:34:45.014653 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:52.293359 0.000000 udp 10.0.2.105 7010 -> 92.2.77.112 8958 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:34:58.703193 0.151357 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 819 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:34:59.044170 0.000000 udp 10.0.2.105 7010 -> 207.150.245.254 5351 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:05.555933 0.000000 udp 10.0.2.105 7010 -> 209.156.227.34 3951 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:10.248658 0.116388 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:35:11.266095 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:17.728399 0.000000 udp 10.0.2.105 7010 -> 82.16.196.249 7794 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:23.061950 0.958987 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 672 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:35:24.123308 0.198917 udp 10.0.2.105 7010 <-> 189.191.166.158 7749 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:35:24.678694 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:30.216759 0.000000 udp 10.0.2.105 7010 -> 95.242.228.216 1546 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:35.068636 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:35:38.851662 0.000000 udp 10.0.2.105 7010 -> 76.244.144.22 4444 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:44.523643 1.073714 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:35:46.103595 0.079473 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:35:46.364943 0.332599 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:35:46.919522 0.000000 udp 10.0.2.105 7010 -> 24.146.199.108 5436 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:52.098295 0.000000 udp 10.0.2.105 7010 -> 108.54.243.194 4841 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:35:57.256456 3.019630 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 10:35:58.988451 0.000000 udp 10.0.2.105 7010 -> 2.97.62.207 6989 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:03.473657 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:36:04.233394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:36:06.670605 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:11.995910 0.169374 udp 10.0.2.105 7010 <-> 99.119.129.196 7576 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:36:12.154456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:36:12.680136 0.000000 udp 10.0.2.105 7010 -> 93.216.98.240 9196 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:19.316427 0.000000 udp 10.0.2.105 7010 -> 109.99.21.244 4784 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:24.767939 0.151199 udp 10.0.2.105 7010 <-> 109.55.246.108 7449 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:36:26.382070 0.144883 udp 10.0.2.105 7010 <-> 70.29.203.191 6233 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:36:26.913919 0.096183 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:36:27.264293 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:28.017462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:36:29.722864 0.139750 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:36:34.759966 0.000000 udp 10.0.2.105 7010 -> 93.193.158.225 7662 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:42.320757 0.000000 udp 10.0.2.105 7010 -> 74.94.175.201 7900 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:47.423711 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:52.711713 3.321523 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:36:57.538640 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:36:58.061344 0.000000 udp 10.0.2.105 7010 -> 74.218.116.214 3070 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:36:59.791277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:37:06.025209 0.000000 udp 10.0.2.105 7010 -> 151.74.102.87 3728 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:14.832125 0.195473 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:37:15.323307 0.000000 udp 10.0.2.105 7010 -> 72.234.28.79 1382 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:22.762646 0.000000 udp 10.0.2.105 7010 -> 90.208.10.244 2565 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:27.243945 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:37:28.507629 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:34.023044 0.000000 udp 10.0.2.105 7010 -> 79.7.246.131 7537 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:39.983309 2.871320 udp 10.0.2.105 7010 <-> 79.202.119.161 4717 CON 0 0 2 860 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:37:43.778358 0.000000 udp 10.0.2.105 7010 -> 95.252.80.182 4847 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:49.374737 0.000000 udp 10.0.2.105 7010 -> 98.221.12.77 9518 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:37:54.329155 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:37:57.772685 0.206710 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 747 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:37:58.213708 0.000000 udp 10.0.2.105 7010 -> 190.43.176.248 3153 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:04.445197 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:12.857654 0.000000 udp 10.0.2.105 7010 -> 92.239.253.141 8014 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:20.976597 0.000000 udp 10.0.2.105 7010 -> 95.230.96.137 9692 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:25.507186 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:38:26.981177 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:34.616111 0.000000 udp 10.0.2.105 7010 -> 79.51.39.223 1584 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:41.651051 0.000000 udp 10.0.2.105 7010 -> 79.5.96.59 8468 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:49.039160 0.000000 udp 10.0.2.105 7010 -> 87.25.195.39 6115 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:38:53.745878 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:38:57.759786 0.000000 udp 10.0.2.105 7010 -> 87.188.191.167 3885 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:05.922219 0.000000 udp 10.0.2.105 7010 -> 190.178.22.45 8957 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:13.182997 0.000000 udp 10.0.2.105 7010 -> 189.79.127.47 4808 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:18.078046 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:39:20.672744 0.000000 udp 10.0.2.105 7010 -> 87.173.35.214 5149 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:26.198400 0.040365 udp 10.0.2.105 7010 <-> 78.134.81.133 6943 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/18 10:39:26.395646 0.000000 udp 10.0.2.105 7010 -> 94.6.255.5 4044 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:32.555929 0.000000 udp 10.0.2.105 7010 -> 87.21.5.18 3768 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:40.286271 0.000000 udp 10.0.2.105 7010 -> 62.30.127.41 5086 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:45.207502 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:39:47.872632 0.000000 udp 10.0.2.105 7010 -> 72.16.245.225 7369 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:39:55.613163 0.000000 udp 10.0.2.105 7010 -> 87.22.77.107 8311 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:40:03.353620 0.000000 udp 10.0.2.105 7010 -> 76.76.71.25 3611 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:40:09.466059 3.127670 udp 10.0.2.105 7010 -> 109.66.151.50 2788 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:40:12.593729 0.000000 icmp 109.66.151.50 0x0103 -> 10.0.2.105 0x6d42 URH 192 1 178 flow=Background 1970/02/18 10:40:14.319877 0.000145 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:40:17.541700 0.000000 udp 10.0.2.105 7010 -> 62.224.80.66 2305 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:40:26.254839 0.000000 udp 10.0.2.105 7010 -> 162.233.227.161 2428 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 10:43:03.333439 3.005530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 10:43:10.341879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:43:18.342210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:43:34.345343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:44:06.353073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:50:56.541744 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 10:50:56.541830 4.087264 tcp 10.0.2.105 56111 -> 200.84.7.244 8038 FSPA* 0 0 15 1774 flow=From-Botnet-V2-TCP-Established 1970/02/18 10:55:44.357967 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 10:55:51.364742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:55:59.368609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:56:15.369538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 10:56:47.375543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:02:51.382553 3.000593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:02:58.389701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:03:06.390587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:03:22.393496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:03:54.399559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:10:22.419352 3.002374 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:10:29.427539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:10:37.431326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:10:53.431737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:10:57.404577 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 11:10:57.404748 0.168897 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:10:57.574055 0.115570 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:10:57.690004 0.158599 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:10:57.848998 0.104530 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:10:57.953910 0.058873 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:10:58.013208 0.000000 udp 10.0.2.105 7010 -> 108.215.114.209 4167 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:11:04.371879 0.000000 udp 10.0.2.105 7010 <- 108.215.114.209 4167 RSP 0 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:11:04.372459 0.182414 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:04.555344 0.198725 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:04.754515 0.328694 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.083637 0.215052 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.299051 0.060111 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.359581 0.055317 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.415301 0.495173 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.910849 0.054727 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:05.965943 0.217058 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.243772 0.142186 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.386340 0.078378 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.465204 0.045762 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.511376 0.084021 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.595761 0.155147 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.751378 0.065191 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:06.816951 0.274165 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:07.091500 0.396548 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:07.488517 0.000000 udp 10.0.2.105 7010 -> 151.73.19.185 4594 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:11:25.437892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:11:26.290910 0.197444 tcp 10.0.2.105 56112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:26.488629 0.068343 tcp 10.0.2.105 56113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:26.557232 0.150632 tcp 10.0.2.105 56114 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:26.708651 0.199144 udp 10.0.2.105 7010 <-> 94.197.9.81 4890 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:26.908387 0.148756 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:27.057602 0.553802 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:27.611798 0.202165 udp 10.0.2.105 7010 <-> 189.191.166.158 7749 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:27.814369 0.168444 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:27.983250 0.057181 udp 10.0.2.105 7010 <-> 89.232.24.88 9436 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:28.040864 0.328174 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:11:28.369407 0.000000 udp 10.0.2.105 7010 -> 99.119.129.196 7576 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:11:44.616422 0.155771 tcp 10.0.2.105 56115 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:44.772489 0.065752 tcp 10.0.2.105 56116 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:44.838551 0.161755 tcp 10.0.2.105 56117 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:11:45.000831 0.000000 udp 10.0.2.105 7010 -> 109.55.246.108 7449 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:12:01.551073 0.061107 tcp 10.0.2.105 56118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:01.612594 0.068638 tcp 10.0.2.105 56119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:01.681072 0.163216 tcp 10.0.2.105 56120 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:01.844951 0.328958 udp 10.0.2.105 7010 <-> 70.29.203.191 6233 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:12:02.174307 0.085410 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:12:02.260103 2.501071 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:12:04.761530 0.187072 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:12:04.948966 0.000000 udp 10.0.2.105 7010 -> 79.202.119.161 4717 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:12:22.290375 0.275305 tcp 10.0.2.105 56121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:22.566023 0.094981 tcp 10.0.2.105 56122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:22.661261 0.159371 tcp 10.0.2.105 56123 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:12:22.821228 0.206464 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:12:23.028085 0.039486 udp 10.0.2.105 7010 <-> 78.134.81.133 6943 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:17:29.446267 2.999291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 11:17:36.451618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:17:44.453182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:18:00.455875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:18:32.462607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:21:00.639197 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 11:21:00.639363 1.489657 tcp 10.0.2.105 56124 -> 200.84.7.244 8038 FSPA* 0 0 14 1642 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:24:36.478031 3.012653 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:24:43.494996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:24:51.497083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:25:07.499845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:25:39.505842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:31:43.512034 3.004467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:31:50.519525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:31:58.524685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:32:14.524059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:32:47.828224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:38:50.545596 3.274453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:38:57.790982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:39:05.726671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:39:21.590816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:39:53.573707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:42:39.342731 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 11:42:39.342902 0.000000 udp 10.0.2.105 7010 -> 151.73.19.185 4594 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:42:57.352692 0.550342 tcp 10.0.2.105 56125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:42:57.903310 0.108431 tcp 10.0.2.105 56126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:42:58.012060 0.169716 tcp 10.0.2.105 56127 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:42:58.182379 0.000000 udp 10.0.2.105 7010 -> 99.119.129.196 7576 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:43:13.224051 0.081925 tcp 10.0.2.105 56128 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:13.306273 0.065173 tcp 10.0.2.105 56129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:13.371693 0.166300 tcp 10.0.2.105 56130 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:13.538538 0.000000 udp 10.0.2.105 7010 -> 109.55.246.108 7449 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:43:31.229483 0.534402 tcp 10.0.2.105 56131 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:31.764149 0.062862 tcp 10.0.2.105 56132 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:31.827274 0.221053 tcp 10.0.2.105 56133 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:32.046696 0.000000 udp 10.0.2.105 7010 -> 79.202.119.161 4717 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:43:50.520419 0.069202 tcp 10.0.2.105 56134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:50.589881 0.066300 tcp 10.0.2.105 56135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:50.656645 0.165569 tcp 10.0.2.105 56136 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:43:50.822837 0.165153 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:50.988437 0.144432 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.133250 0.168728 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.302433 0.055579 udp 10.0.2.105 7010 <-> 79.77.214.142 6033 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.358448 0.104849 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.463695 0.191710 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.655790 0.183238 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:51.839405 0.198824 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:52.038680 0.322451 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:52.361575 0.227077 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:52.913370 0.156347 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.070097 0.070612 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.141198 0.056953 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.198558 0.055345 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.254281 0.152659 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.407371 0.065231 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.473053 0.044950 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.518388 0.142672 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.661428 0.194959 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:43:53.856871 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:44:11.859064 0.063459 tcp 10.0.2.105 56137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:11.922869 0.061650 tcp 10.0.2.105 56138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:11.984798 0.161765 tcp 10.0.2.105 56139 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:12.147193 0.086116 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:12.233769 0.255822 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:12.489985 0.286602 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:12.827832 0.147771 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:12.976015 0.000000 udp 10.0.2.105 7010 -> 94.197.9.81 4890 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:44:29.303704 0.066762 tcp 10.0.2.105 56140 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:29.370720 0.065788 tcp 10.0.2.105 56141 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:29.436902 0.176554 tcp 10.0.2.105 56142 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:29.612107 0.097689 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:29.710170 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:44:48.388960 0.060914 tcp 10.0.2.105 56143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:48.450229 0.061688 tcp 10.0.2.105 56144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:48.512273 0.158660 tcp 10.0.2.105 56145 -> 195.113.214.249 443 SRPA* 0 0 20 10686 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:44:48.671499 0.055972 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:44:48.727841 0.000000 udp 10.0.2.105 7010 -> 189.191.166.158 7749 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:45:07.175184 0.127706 tcp 10.0.2.105 56146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:07.303137 0.066012 tcp 10.0.2.105 56147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:07.369433 0.166039 tcp 10.0.2.105 56148 -> 195.113.214.249 443 SRPA* 0 0 23 13142 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:07.536189 0.337250 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:07.873816 0.139833 udp 10.0.2.105 7010 <-> 70.29.203.191 6233 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:08.014018 0.134508 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:08.148905 3.721730 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:11.871084 0.189203 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:12.060683 0.205823 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 11:45:12.266978 0.000000 udp 10.0.2.105 7010 -> 78.134.81.133 6943 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 11:45:28.055543 0.062976 tcp 10.0.2.105 56149 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:28.118870 0.061830 tcp 10.0.2.105 56150 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:28.181007 0.169381 tcp 10.0.2.105 56151 -> 195.113.214.249 443 SRPA* 0 0 23 13176 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:45:57.579760 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 11:46:04.589643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:46:12.588924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:46:28.591887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:47:00.597563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:51:02.125776 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 11:51:02.125867 0.210683 tcp 10.0.2.105 56152 -> 200.84.7.244 8038 SPA_* 0 0 9 1019 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:51:09.710861 0.433144 tcp 10.0.2.105 56152 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 11:53:04.603607 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 11:53:11.611355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:53:19.613048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:53:35.615972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 11:54:07.621691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:00:11.630025 3.271249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:00:18.870417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:00:26.798788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:00:42.664740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:01:14.656158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:07:18.662830 3.000421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:07:25.669346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:07:33.673262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:07:49.676205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:08:21.679835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:14:25.685796 3.208005 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:14:32.866712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:14:40.797284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:14:56.707739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:15:28.714174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:15:52.248132 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 12:15:52.248222 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:16:10.665683 0.064977 tcp 10.0.2.105 56153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:10.730999 0.067423 tcp 10.0.2.105 56154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:10.798683 0.274682 tcp 10.0.2.105 56155 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:11.073878 0.000000 udp 10.0.2.105 7010 -> 94.197.9.81 4890 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:16:28.841117 0.060719 tcp 10.0.2.105 56156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:28.902144 0.064071 tcp 10.0.2.105 56157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:28.966519 0.172184 tcp 10.0.2.105 56158 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:29.139423 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:16:47.126899 0.063676 tcp 10.0.2.105 56159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:47.190914 0.062705 tcp 10.0.2.105 56160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:47.253893 0.167255 tcp 10.0.2.105 56161 -> 195.113.214.249 443 SRPA* 0 0 26 13968 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:16:47.421655 0.000000 udp 10.0.2.105 7010 -> 189.191.166.158 7749 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:17:06.114677 0.059440 tcp 10.0.2.105 56162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:06.174437 0.065265 tcp 10.0.2.105 56163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:06.239555 0.158773 tcp 10.0.2.105 56164 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:06.398998 0.000000 udp 10.0.2.105 7010 -> 78.134.81.133 6943 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:17:21.727140 0.061496 tcp 10.0.2.105 56165 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:21.788926 0.061605 tcp 10.0.2.105 56166 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:21.850828 0.163966 tcp 10.0.2.105 56167 -> 195.113.214.249 443 SRPA* 0 0 25 13288 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:22.015444 0.169595 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:22.185424 0.124711 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:22.310537 0.105171 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:22.416084 0.000000 udp 10.0.2.105 7010 -> 79.77.214.142 6033 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:17:37.660383 0.065605 tcp 10.0.2.105 56168 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:37.725848 0.064622 tcp 10.0.2.105 56169 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:37.790743 0.163053 tcp 10.0.2.105 56170 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:17:37.954333 0.155543 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:38.110546 0.442511 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:38.553462 0.184642 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:38.738510 0.191278 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:38.930147 0.201351 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.131912 0.055376 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.187666 0.156919 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.344947 0.055545 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.400892 0.247490 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.648841 0.056361 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.705578 0.061008 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.766969 0.153259 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:39.920591 0.141210 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:40.062206 0.386934 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:40.449557 0.044959 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:40.494911 0.082504 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:40.577823 0.146870 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:40.725120 0.288409 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:41.013982 0.252175 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:41.266550 0.134779 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:41.401657 0.055126 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:41.457184 0.318370 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:41.990659 0.140843 udp 10.0.2.105 7010 <-> 70.29.203.191 6233 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:42.131919 0.112524 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:42.244807 1.485399 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:43.730563 0.190858 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:17:43.921892 0.207565 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:21:10.145119 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 12:21:10.145223 1.704223 tcp 10.0.2.105 56171 -> 200.84.7.244 8038 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:21:32.721011 3.003116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 12:21:39.956627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:21:48.019586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:22:03.872721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:22:35.760114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:28:39.763572 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:28:46.771260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:28:54.833854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:29:10.785502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:29:42.919427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:35:46.807279 3.333819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:35:54.417062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:36:02.316106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:36:18.138379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:36:49.845638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:42:53.853936 2.999526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 12:43:00.859154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:43:08.860853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:43:24.865227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:43:56.869215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:47:47.872039 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 12:47:47.872128 3.057157 udp 10.0.2.105 7010 -> 79.77.214.142 6033 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:47:50.929285 0.000000 icmp 79.77.214.142 0x0103 -> 10.0.2.105 0x4f4d URH 192 1 303 flow=Background 1970/02/18 12:48:03.425994 1.597817 tcp 10.0.2.105 56172 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:05.024113 0.060714 tcp 10.0.2.105 56173 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:05.085112 0.134653 tcp 10.0.2.105 56174 -> 195.113.214.249 443 SRPA* 0 0 37 26980 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:05.220447 0.145083 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:05.365916 0.165774 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:05.532057 0.104617 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:05.637122 0.159680 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:05.797203 0.200710 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:05.998276 0.196530 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:06.195179 0.569601 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:06.765172 0.183272 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:06.948816 0.057183 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.166561 0.156894 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.323897 0.057253 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.381478 0.260697 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.642588 0.052349 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.695339 0.060079 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.755775 0.153304 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:08.909453 0.141445 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:09.051357 0.082730 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:09.134474 0.147032 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:09.281921 0.289061 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:09.571395 0.403687 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:09.975441 0.047841 udp 10.0.2.105 7010 <-> 5.13.39.140 2778 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:10.023657 0.250881 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:10.274922 0.525690 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:10.800990 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 12:48:28.349970 0.062555 tcp 10.0.2.105 56175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:28.412839 0.064495 tcp 10.0.2.105 56176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:28.477590 0.167651 tcp 10.0.2.105 56177 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:48:28.645774 0.331290 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:28.977422 0.140328 udp 10.0.2.105 7010 <-> 70.29.203.191 6233 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:29.118117 0.087166 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:29.205666 0.202876 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:29.408970 3.043008 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:48:32.452604 0.190520 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/18 12:51:11.845456 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 12:51:11.845646 0.709089 tcp 10.0.2.105 56178 -> 200.84.7.244 8038 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:51:24.782575 0.238910 tcp 10.0.2.105 56178 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 12:55:34.876008 3.011307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 12:55:41.893436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:55:49.894506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:56:05.897849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 12:56:37.903780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:02:41.909978 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:02:48.917259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:02:56.919542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:03:12.922050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:03:44.938009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:10:12.948084 3.002164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:10:19.955783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:10:27.957411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:10:43.960494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:11:16.156616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:17:19.997479 2.996571 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:17:27.000007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:17:35.007651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:17:51.277481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:18:23.020508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:18:49.800919 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 13:18:49.801020 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:19:06.757756 0.062433 tcp 10.0.2.105 56179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:06.820589 0.060787 tcp 10.0.2.105 56180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:06.881633 0.152339 tcp 10.0.2.105 56181 -> 195.113.214.249 443 SRPA* 0 0 23 14602 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:07.034559 0.104813 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:07.139736 0.145621 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:07.285769 0.169505 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:07.455768 0.198304 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:07.916357 0.159550 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.076386 0.196475 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.273322 0.318163 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.591859 0.186588 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.778819 0.154823 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.934079 0.055139 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:08.989647 0.052204 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.042283 0.064283 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.106954 0.154206 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.261555 0.139738 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.401680 0.085291 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.487375 0.247638 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.735402 0.056957 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:09.792819 0.000000 udp 10.0.2.105 7010 -> 5.13.39.140 2778 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:19:28.694809 0.060513 tcp 10.0.2.105 56182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:28.755619 0.066797 tcp 10.0.2.105 56183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:28.822704 0.178052 tcp 10.0.2.105 56184 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:29.001226 0.145744 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:29.147376 0.278628 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:29.426442 1.670383 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:31.097207 0.250933 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:31.348651 0.136648 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:31.485788 0.341102 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:31.827302 0.000000 udp 10.0.2.105 7010 -> 70.29.203.191 6233 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:19:47.472683 0.064424 tcp 10.0.2.105 56185 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:47.537406 0.063177 tcp 10.0.2.105 56186 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:47.600833 0.164548 tcp 10.0.2.105 56187 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:19:47.766022 0.148672 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:47.915044 0.206057 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:19:48.121469 0.000000 udp 10.0.2.105 7010 -> 72.251.13.91 2321 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:19:56.128928 0.000000 udp 10.0.2.105 7010 <- 72.251.13.91 2321 RSP 0 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:19:58.906912 0.190455 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:21:25.022432 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 13:21:25.022738 1.500188 tcp 10.0.2.105 56188 -> 200.84.7.244 8038 FSPA* 0 0 15 1588 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:24:27.026076 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 13:24:34.033753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:24:42.036686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:24:58.038450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:25:30.054593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:31:34.071058 3.001058 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:31:41.077911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:31:49.079168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:32:05.082378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:32:37.088255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:38:41.094966 3.393976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:38:48.467763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:38:56.395164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:39:12.251779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:39:44.134942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:45:48.138615 3.001142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 13:45:55.145694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:46:03.147247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:46:19.150067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:46:51.156852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:50:29.049721 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 13:50:29.049863 0.000000 udp 10.0.2.105 7010 -> 5.13.39.140 2778 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:50:44.834701 0.174715 tcp 10.0.2.105 56189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:50:45.009609 0.063793 tcp 10.0.2.105 56190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:50:45.073229 0.153870 tcp 10.0.2.105 56191 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:50:45.227650 0.000000 udp 10.0.2.105 7010 -> 70.29.203.191 6233 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:51:03.389667 0.060739 tcp 10.0.2.105 56192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:03.450700 0.065842 tcp 10.0.2.105 56193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:03.516845 0.156026 tcp 10.0.2.105 56194 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:03.673429 0.104375 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:03.778159 0.157159 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:03.935714 0.165809 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:04.101938 0.153429 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:04.255733 0.199296 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:04.455394 0.318701 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:04.774444 0.191733 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:04.966555 0.054569 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.021497 0.060561 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.082416 0.156477 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.239267 0.183065 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.422740 0.055258 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.478370 0.230668 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:05.709417 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:51:23.772058 0.060960 tcp 10.0.2.105 56195 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:23.833326 0.068881 tcp 10.0.2.105 56196 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:23.902475 0.156419 tcp 10.0.2.105 56197 -> 195.113.214.249 443 SRPA* 0 0 35 19366 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:24.059290 0.154052 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:24.213796 0.095780 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:24.310048 0.139687 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:24.450121 0.147953 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:24.598486 0.287891 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:24.886763 2.247593 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:26.522586 0.211410 tcp 10.0.2.105 56198 -> 200.84.7.244 8038 SPA_* 0 0 9 1209 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:27.134731 0.333625 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:27.468823 0.174650 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:27.886051 0.251905 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:28.138321 0.163699 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:28.302375 0.203357 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:28.506196 0.000000 udp 10.0.2.105 7010 -> 72.251.13.91 2321 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:51:36.944031 0.405866 tcp 10.0.2.105 56198 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:36.944930 0.060913 tcp 10.0.2.105 56199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:37.006121 0.064590 tcp 10.0.2.105 56200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:37.071072 0.154809 tcp 10.0.2.105 56201 -> 195.113.214.249 443 SRPA* 0 0 42 23352 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:37.350141 3.002714 tcp 10.0.2.105 56202 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:51:37.443482 0.000000 udp 10.0.2.105 7010 <- 72.251.13.91 2321 RSP 0 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 13:51:37.443917 0.185873 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/18 13:51:46.354853 0.000000 tcp 10.0.2.105 56202 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:51:52.350746 0.062298 tcp 10.0.2.105 56203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:52.413329 0.061317 tcp 10.0.2.105 56204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:52.474957 0.160253 tcp 10.0.2.105 56205 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:51:53.818500 2.997154 tcp 10.0.2.105 56206 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:02.814445 0.000000 tcp 10.0.2.105 56206 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:08.813377 0.062727 tcp 10.0.2.105 56207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:08.876462 0.062419 tcp 10.0.2.105 56208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:08.939192 0.157624 tcp 10.0.2.105 56209 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:09.553151 3.407827 tcp 10.0.2.105 56210 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:12.288785 0.059227 tcp 10.0.2.105 56211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:12.348348 0.064154 tcp 10.0.2.105 56212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:12.412804 0.160147 tcp 10.0.2.105 56213 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:12.961237 3.001496 tcp 10.0.2.105 56214 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:21.974686 0.000000 tcp 10.0.2.105 56214 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:27.968564 0.063438 tcp 10.0.2.105 56215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:28.031866 0.069304 tcp 10.0.2.105 56216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:28.101442 0.159237 tcp 10.0.2.105 56217 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:28.390039 0.209569 tcp 10.0.2.105 56218 -> 200.84.7.244 8038 SPA_* 0 0 9 1209 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:38.810568 0.000293 tcp 10.0.2.105 56218 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:52:38.811067 2.999062 tcp 10.0.2.105 56219 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:47.809261 0.000000 tcp 10.0.2.105 56219 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:52:53.807610 3.004417 tcp 10.0.2.105 56220 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:53:02.842570 0.000000 tcp 10.0.2.105 56220 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:53:07.537537 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 13:53:08.810020 1.761599 tcp 10.0.2.105 56221 -> 46.48.223.67 15494 FSPA* 0 0 14 1739 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:53:10.570990 2.995270 tcp 10.0.2.105 56222 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:53:19.564157 0.000000 tcp 10.0.2.105 56222 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:57:04.170679 3.001076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 13:57:11.177850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:57:19.180675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:57:35.182248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:58:07.188530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 13:58:25.567324 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 13:58:25.567419 3.001423 tcp 10.0.2.105 56223 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:58:34.567728 0.000000 tcp 10.0.2.105 56223 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:58:40.568617 0.060679 tcp 10.0.2.105 56224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:40.629572 0.061990 tcp 10.0.2.105 56225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:40.691894 0.163620 tcp 10.0.2.105 56226 -> 195.113.214.249 443 SRPA* 0 0 25 13914 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:40.943607 3.833994 tcp 10.0.2.105 56227 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:58:50.701593 0.000000 tcp 10.0.2.105 56227 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:58:56.635231 0.059609 tcp 10.0.2.105 56228 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:56.695169 0.122841 tcp 10.0.2.105 56229 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:56.818299 0.158190 tcp 10.0.2.105 56230 -> 195.113.214.249 443 SRPA* 0 0 23 13804 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:57.508029 2.082997 tcp 10.0.2.105 56231 -> 46.48.223.67 15494 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:59.244279 0.059352 tcp 10.0.2.105 56232 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:59.303923 0.062310 tcp 10.0.2.105 56233 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:59.366048 0.151228 tcp 10.0.2.105 56234 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:58:59.591284 2.961460 tcp 10.0.2.105 56235 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:59:10.537502 0.000000 tcp 10.0.2.105 56235 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 13:59:16.472079 0.060356 tcp 10.0.2.105 56236 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:59:16.532690 0.060865 tcp 10.0.2.105 56237 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:59:16.593835 0.161748 tcp 10.0.2.105 56238 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 13:59:17.091015 1.635310 tcp 10.0.2.105 56239 -> 200.84.7.244 8038 FSPA* 0 0 15 1597 flow=From-Botnet-V2-TCP-Established 1970/02/18 14:04:11.194912 3.004104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 14:04:18.206789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:04:26.203098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:04:42.205980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:05:14.371155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:11:18.229189 3.000823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:11:25.235649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:11:34.563613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:11:50.372637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:12:22.013930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:18:25.262091 3.001793 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:18:32.269613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:18:40.271143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:18:56.274251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:19:28.280173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:21:54.811254 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 14:21:54.811366 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 14:22:12.719046 0.063509 tcp 10.0.2.105 56240 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 14:22:12.782845 0.060032 tcp 10.0.2.105 56241 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 14:22:12.843137 0.156856 tcp 10.0.2.105 56242 -> 195.113.214.249 443 SRPA* 0 0 80 58784 flow=From-Botnet-V2-TCP-Established 1970/02/18 14:22:13.001002 0.104515 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:13.105908 0.158092 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:13.264522 0.149430 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:13.414299 0.201470 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:13.616585 0.169036 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:13.785957 0.567881 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:14.354218 0.158155 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:14.512751 0.063406 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:14.576563 0.191714 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:16.485997 0.113458 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:16.599819 0.215618 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:16.815871 0.056239 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:16.872588 0.184132 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.057071 0.084286 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.141859 0.141456 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.283744 0.147329 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.431414 0.155069 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.586835 0.280752 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.868000 0.042541 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:17.910952 0.122806 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:18.034163 0.323930 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:18.358457 0.189919 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:18.548806 0.205992 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:18.755246 0.251590 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:19.007271 4.351667 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:22:23.359372 0.195895 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:25:32.285740 3.002045 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:25:39.293388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:25:47.295147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:26:03.298021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:26:35.304097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:29:16.215775 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 14:29:16.215973 2.136058 tcp 10.0.2.105 56243 -> 200.84.7.244 8038 FSPA* 0 0 15 1565 flow=From-Botnet-V2-TCP-Established 1970/02/18 14:32:39.312235 2.999565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:32:46.338457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:32:54.329136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:33:10.332377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:33:42.337990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:39:46.343796 3.002140 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:39:53.352602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:40:01.353149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:40:17.357277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:40:49.362108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:46:53.368117 3.001709 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:47:00.375621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:47:08.377155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:47:24.379929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:47:56.386500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:52:51.871380 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 14:52:51.871512 0.105107 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:51.977018 0.196004 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:52.173389 0.169798 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:52.343565 0.156297 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:52.500316 0.147772 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:52.648563 0.064799 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:52.713752 0.390174 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.104438 0.154458 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.259349 0.192125 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.451907 0.051121 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.503445 0.217968 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.721788 0.058428 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.780601 0.184802 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:53.965811 0.085560 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:54.051741 0.154914 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:54.206999 0.272752 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:54.480124 0.045617 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:54.526130 0.761032 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:55.287604 0.139395 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:55.427337 0.148094 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:55.575818 0.328213 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:55.904461 0.121517 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:56.026396 0.202827 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:56.229666 0.251289 udp 10.0.2.105 7010 <-> 200.29.129.178 4309 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:56.481399 0.531788 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:52:57.013604 0.189265 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/18 14:54:00.403116 3.000455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 14:54:07.409722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:54:15.415873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:54:31.413675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:55:03.420144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 14:59:18.357393 0.057115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 14:59:18.414708 1.496454 tcp 10.0.2.105 56244 -> 200.84.7.244 8038 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:01:07.426321 3.001258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:01:14.433371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:01:22.435182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:01:38.438013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:02:10.449113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:08:14.449930 3.001976 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:08:21.457673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:08:29.459585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:08:45.462280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:09:17.468219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:15:21.474600 3.001226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:15:28.482770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:15:36.483244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:15:52.485484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:16:24.492296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:22:28.497611 3.002276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:22:35.637632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:22:43.577945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:23:00.211409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:23:03.717230 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 15:23:03.717325 0.169390 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:03.887135 0.156106 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.043669 0.105017 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.149119 0.198756 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.348386 0.148351 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.497220 0.062460 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.560053 0.425066 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:04.985608 0.049585 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:05.035581 0.236096 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:05.272157 0.059132 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:05.331675 0.157515 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:05.489673 0.192004 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:05.682058 0.182827 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:06.551201 0.083519 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:06.635156 0.154305 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:06.789850 0.287047 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.077271 0.055260 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.132986 0.146958 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.280439 0.218295 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.499171 0.141631 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.641231 0.328732 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:07.970345 0.084563 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:08.055328 0.203204 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:08.258906 0.000000 udp 10.0.2.105 7010 -> 200.29.129.178 4309 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 15:23:24.861014 0.065350 tcp 10.0.2.105 56245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:23:24.926633 0.062991 tcp 10.0.2.105 56246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:23:24.989974 0.151864 tcp 10.0.2.105 56247 -> 195.113.214.249 443 SRPA* 0 0 48 41100 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:23:25.142376 0.460227 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:25.602968 0.186652 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:23:31.853326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:29:19.876838 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 15:29:19.876921 1.429163 tcp 10.0.2.105 56248 -> 200.84.7.244 8038 FSPA* 0 0 15 1793 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:29:35.551835 3.258306 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:29:42.783507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:29:53.982045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:30:09.779779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:30:41.372289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:36:42.596153 3.001518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:36:49.603833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:36:57.604560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:37:13.607769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:37:45.613927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:43:49.623255 2.998247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:43:56.627479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:44:04.628984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:44:20.636089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:44:52.637785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:53:37.643087 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 15:53:37.643201 0.000000 udp 10.0.2.105 7010 -> 200.29.129.178 4309 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 15:53:54.439047 0.209297 tcp 10.0.2.105 56249 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:53:54.648661 0.066137 tcp 10.0.2.105 56250 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:53:54.715109 0.153921 tcp 10.0.2.105 56251 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:53:54.869576 0.157746 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.027686 0.105271 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.133346 0.204059 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.337790 0.113376 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.451521 0.063282 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.515191 0.168897 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.684603 0.056122 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.741124 0.158973 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:55.900620 0.191985 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:56.092974 0.050549 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:56.143864 0.433474 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:56.577708 0.216005 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:56.794137 0.085262 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:56.879752 0.182491 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:57.062587 0.278335 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:57.341283 0.043428 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:57.385093 0.146343 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:57.531817 0.924597 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:58.456832 0.141870 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:58.599076 0.152923 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:58.752385 0.084127 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:58.836903 0.314556 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:59.151869 0.207196 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:59.359454 0.544340 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:53:59.904171 0.186820 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 15:56:05.647848 3.005785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 15:56:12.655535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:56:20.657064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:56:36.660212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:57:09.937500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 15:59:21.307442 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 15:59:21.307758 2.270999 tcp 10.0.2.105 56252 -> 200.84.7.244 8038 FSPA* 0 0 13 1339 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:21.743987 0.064511 tcp 10.0.2.105 56253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:21.808808 0.061353 tcp 10.0.2.105 56254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:21.870531 0.149937 tcp 10.0.2.105 56255 -> 195.113.214.249 443 SRPA* 0 0 21 11364 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:23.579043 3.000323 tcp 10.0.2.105 56256 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 15:59:32.573628 0.000000 tcp 10.0.2.105 56256 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 15:59:38.572434 1.832619 tcp 10.0.2.105 56257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:40.405318 0.061734 tcp 10.0.2.105 56258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:40.467339 0.152356 tcp 10.0.2.105 56259 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:40.773386 2.957085 tcp 10.0.2.105 56260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 15:59:49.660534 0.000000 tcp 10.0.2.105 56260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 15:59:55.595697 0.254047 tcp 10.0.2.105 56261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:55.850042 0.065422 tcp 10.0.2.105 56262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:55.915723 0.155690 tcp 10.0.2.105 56263 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:56.964030 3.188238 tcp 10.0.2.105 56264 -> 46.48.223.67 15494 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:59.796759 0.059710 tcp 10.0.2.105 56265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:59.856825 0.068060 tcp 10.0.2.105 56266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 15:59:59.925135 0.158411 tcp 10.0.2.105 56267 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:00.152557 2.968268 tcp 10.0.2.105 56268 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:09.062428 0.000000 tcp 10.0.2.105 56268 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:14.977892 0.060462 tcp 10.0.2.105 56269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:15.038624 0.065409 tcp 10.0.2.105 56270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:15.104372 0.158573 tcp 10.0.2.105 56271 -> 195.113.214.249 443 SRPA* 0 0 23 11450 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:15.487478 0.555815 tcp 10.0.2.105 56272 -> 200.84.7.244 8038 FSPA* 0 0 13 1339 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:16.043097 2.954616 tcp 10.0.2.105 56273 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:24.925411 0.000000 tcp 10.0.2.105 56273 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:30.852522 2.976194 tcp 10.0.2.105 56274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:39.763128 0.000000 tcp 10.0.2.105 56274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:00:44.239651 2.465502 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:00:48.145578 3.592044 tcp 10.0.2.105 56275 -> 46.48.223.67 15494 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:00:51.737882 2.947970 tcp 10.0.2.105 56276 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:01:00.608160 0.000000 tcp 10.0.2.105 56276 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:03:14.365141 2.958182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 16:03:21.281944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:03:29.200631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:03:44.988290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:04:16.574217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:06:03.157519 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:06:03.157602 1.772279 tcp 10.0.2.105 56277 -> 200.84.7.244 8038 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:10:33.716593 3.001247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 16:10:40.723523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:10:49.833998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:11:05.659093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:11:37.315985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:17:40.750697 3.001189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 16:17:47.757492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:17:57.117184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:18:13.531721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:18:45.147794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:24:01.275216 0.000219 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:24:01.275532 0.186125 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:01.438405 0.124232 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:01.543868 0.199176 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:02.307579 0.200882 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:02.438776 0.090600 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:03.108587 0.172131 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:03.277769 0.215851 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:03.472521 0.064985 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:03.645360 0.073537 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:03.906791 0.187842 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:04.064618 0.603539 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:04.750465 0.301703 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:05.030395 0.094599 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:05.115388 0.083643 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:05.397798 0.168357 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:05.546354 0.191999 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:05.734920 0.295989 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:06.021962 0.202801 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:07.098944 0.168646 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:07.785580 0.182583 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:07.943726 0.099111 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:08.770744 0.321065 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:09.745161 0.214871 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:10.417850 0.000000 udp 10.0.2.105 7010 -> 72.251.13.91 2321 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 16:24:17.706290 0.633393 udp 10.0.2.105 7010 <- 72.251.13.91 2321 RSP 0 0 5 2044 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 16:24:17.706646 0.227525 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:24:47.793881 3.002941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 16:24:54.801374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:25:02.802923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:25:18.806167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:25:50.888330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:31:54.838309 3.001511 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 16:32:01.845562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:32:09.847515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:32:25.850043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:32:57.856384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:36:04.935713 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:36:04.935919 1.185285 tcp 10.0.2.105 56278 -> 200.84.7.244 8038 FSPA* 0 0 13 1355 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:05.358414 0.283383 tcp 10.0.2.105 56279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:05.642046 0.065922 tcp 10.0.2.105 56280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:05.708284 0.145287 tcp 10.0.2.105 56281 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:06.121425 2.999978 tcp 10.0.2.105 56282 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:36:15.251303 0.000000 tcp 10.0.2.105 56282 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:36:21.189274 0.065861 tcp 10.0.2.105 56283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:21.255396 0.063304 tcp 10.0.2.105 56284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:21.318979 0.150989 tcp 10.0.2.105 56285 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:21.839893 2.971384 tcp 10.0.2.105 56286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:36:30.782702 0.000000 tcp 10.0.2.105 56286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:36:36.771545 0.064986 tcp 10.0.2.105 56287 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:36.836907 0.063535 tcp 10.0.2.105 56288 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:36.900795 0.159041 tcp 10.0.2.105 56289 -> 195.113.214.249 443 SRPA* 0 0 20 11308 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:37.519793 3.590698 tcp 10.0.2.105 56290 -> 46.48.223.67 15494 SPA_* 0 0 12 1561 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:41.110923 0.200347 tcp 10.0.2.105 56291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:41.311596 0.071851 tcp 10.0.2.105 56292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:41.383723 0.156364 tcp 10.0.2.105 56293 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:43.351660 0.000077 tcp 10.0.2.105 56290 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:36:43.352063 2.992794 tcp 10.0.2.105 56294 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:36:56.517178 0.000000 tcp 10.0.2.105 56294 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:02.449046 0.061195 tcp 10.0.2.105 56295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:02.510106 0.067566 tcp 10.0.2.105 56296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:02.577974 0.161063 tcp 10.0.2.105 56297 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:03.200233 0.447780 tcp 10.0.2.105 56298 -> 200.84.7.244 8038 FSPA* 0 0 13 1355 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:03.648234 2.958337 tcp 10.0.2.105 56299 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:12.520071 0.000000 tcp 10.0.2.105 56299 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:18.443943 2.964655 tcp 10.0.2.105 56300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:27.323852 0.000000 tcp 10.0.2.105 56300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:32.225404 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:37:33.241407 0.347386 tcp 10.0.2.105 56301 -> 46.48.223.67 15494 SPA_* 0 0 9 1139 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:39.429323 0.003120 tcp 10.0.2.105 56301 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:37:39.429820 2.973147 tcp 10.0.2.105 56302 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:37:48.319568 0.000000 tcp 10.0.2.105 56302 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:39:04.313682 2.958814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 16:39:11.220909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:39:19.122639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:39:36.424391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:40:08.656504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:42:52.355937 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:42:52.356151 2.954656 tcp 10.0.2.105 56303 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:02.561522 0.000000 tcp 10.0.2.105 56303 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:08.483070 0.061787 tcp 10.0.2.105 56304 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:08.545146 0.068702 tcp 10.0.2.105 56305 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:08.614114 0.768979 tcp 10.0.2.105 56306 -> 195.113.214.249 443 SRPA* 0 0 74 79108 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:09.840586 2.952536 tcp 10.0.2.105 56307 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:18.723514 0.000000 tcp 10.0.2.105 56307 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:24.647919 0.063956 tcp 10.0.2.105 56308 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:24.712377 0.060725 tcp 10.0.2.105 56309 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:24.773395 0.161697 tcp 10.0.2.105 56310 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:24.955742 4.368969 tcp 10.0.2.105 56311 -> 46.48.223.67 15494 FSPA* 0 0 14 1714 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:28.551335 0.059792 tcp 10.0.2.105 56312 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:28.611380 0.065446 tcp 10.0.2.105 56313 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:28.677158 0.152280 tcp 10.0.2.105 56314 -> 195.113.214.249 443 SRPA* 0 0 25 13912 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:29.325033 2.959928 tcp 10.0.2.105 56315 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:38.205756 0.000000 tcp 10.0.2.105 56315 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 16:43:44.128927 0.062696 tcp 10.0.2.105 56316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:44.191910 0.061348 tcp 10.0.2.105 56317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:44.253532 0.149353 tcp 10.0.2.105 56318 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:43:44.790862 1.667915 tcp 10.0.2.105 56319 -> 200.84.7.244 8038 FSPA* 0 0 15 1745 flow=From-Botnet-V2-TCP-Established 1970/02/18 16:46:09.171560 2.957361 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 16:46:16.080919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:46:23.975890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:46:39.918591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:47:11.923918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:53:15.930452 3.283600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 16:53:23.180234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:53:31.114685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:53:46.967229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:54:18.958732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 16:54:45.275702 1.513225 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 16:54:46.789031 0.158546 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:46.947966 0.103352 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.051713 0.062950 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.115116 0.198949 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.314463 0.130404 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.445263 0.169866 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.615508 0.191345 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.807206 0.049877 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.857461 0.056389 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:47.914254 0.160035 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:48.074719 0.473252 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:48.548381 0.375804 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:48.924580 0.089484 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:49.014454 0.183840 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:49.920957 0.275456 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:50.196791 0.080106 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:50.277254 0.146563 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:50.424208 0.570635 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:50.995240 0.143051 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:51.138719 0.154859 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:51.293965 0.085559 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:51.379904 0.320209 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:51.700718 0.207673 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:51.908769 2.423209 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/18 16:54:54.332473 0.190878 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:00:22.964184 3.001424 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:00:29.971117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:00:37.972864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:00:53.975954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:01:25.982100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:07:29.987184 3.002576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:07:36.995943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:07:44.997160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:08:01.000031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:08:33.006215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:13:44.304100 0.015690 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 17:13:44.319923 2.447649 tcp 10.0.2.105 56320 -> 200.84.7.244 8038 FSPA* 0 0 14 1626 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:14:37.013414 3.001421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:14:44.019700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:14:52.021479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:15:08.024141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:15:40.030042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:21:44.036126 3.003663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:21:51.043359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:21:59.045078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:22:15.050589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:22:47.054088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:25:08.538149 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 17:25:08.538258 0.159275 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:08.697928 0.103207 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:08.801480 0.062345 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:08.864178 0.206769 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.071302 0.128808 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.200566 0.168692 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.369696 0.055054 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.425200 0.157873 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.583528 0.191658 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.775666 0.048565 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:09.824681 0.493737 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:10.318795 0.258736 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:10.577912 0.084841 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:10.663176 0.049667 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:10.713247 0.183498 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:10.897205 0.289356 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.186993 0.148298 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.335632 0.111536 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.447504 0.141403 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.589382 0.156303 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.746021 0.112021 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:11.858435 0.324404 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:12.183275 0.206767 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:12.390512 0.480449 udp 10.0.2.105 7010 <-> 72.251.13.91 2321 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:25:12.871438 0.188594 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:28:51.059677 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:28:58.067671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:29:06.068955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:29:22.071875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:29:54.078019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:35:58.084428 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:36:05.091604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:36:13.092644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:36:29.095758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:37:01.101947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:43:05.107769 3.002209 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 17:43:12.115455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:43:20.116953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:43:36.119965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:43:46.765505 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 17:43:46.765743 0.842249 tcp 10.0.2.105 56321 -> 200.84.7.244 8038 FSPA* 0 0 13 1365 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:43:47.193667 0.060174 tcp 10.0.2.105 56322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:43:47.254119 0.069116 tcp 10.0.2.105 56323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:43:47.323583 0.154916 tcp 10.0.2.105 56324 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:43:47.608425 3.002217 tcp 10.0.2.105 56325 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:43:56.750044 0.000000 tcp 10.0.2.105 56325 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:44:02.697033 0.062622 tcp 10.0.2.105 56326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:02.759908 0.062105 tcp 10.0.2.105 56327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:02.822311 0.164783 tcp 10.0.2.105 56328 -> 195.113.214.249 443 SRPA* 0 0 21 11342 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:03.006946 2.979132 tcp 10.0.2.105 56329 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:44:08.169425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:44:11.932493 0.000000 tcp 10.0.2.105 56329 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:44:17.920782 0.752475 tcp 10.0.2.105 56330 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:18.673355 0.068951 tcp 10.0.2.105 56331 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:18.742668 0.151639 tcp 10.0.2.105 56332 -> 195.113.214.249 443 SRPA* 0 0 21 13072 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:19.207728 4.023022 tcp 10.0.2.105 56333 -> 46.48.223.67 15494 FSPA* 0 0 14 1679 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:22.645333 0.061180 tcp 10.0.2.105 56334 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:22.706819 0.068405 tcp 10.0.2.105 56335 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:22.775543 0.150420 tcp 10.0.2.105 56336 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:23.230986 2.978623 tcp 10.0.2.105 56337 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:44:32.138367 0.000000 tcp 10.0.2.105 56337 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 17:44:38.054386 0.061039 tcp 10.0.2.105 56338 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:38.114889 0.062147 tcp 10.0.2.105 56339 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:38.177296 0.164587 tcp 10.0.2.105 56340 -> 195.113.214.249 443 SRPA* 0 0 53 50240 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:44:38.403257 1.638873 tcp 10.0.2.105 56341 -> 200.84.7.244 8038 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:55:30.677666 0.079531 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 17:55:30.757305 0.061351 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:30.819097 0.198641 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.018142 0.158026 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.176593 0.104164 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.281764 0.120434 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.402704 0.169525 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.572973 0.055336 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.628703 0.154548 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.783618 0.191174 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:31.975263 0.048684 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:32.024389 0.483954 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:32.508749 0.265421 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:32.774525 0.083451 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:32.858374 0.060451 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:32.919292 0.184387 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:33.104082 0.281098 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:33.385583 0.147582 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:33.533562 0.873970 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:34.407966 0.139896 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:34.548255 0.152360 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:34.701016 0.097084 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:34.798498 0.000000 udp 10.0.2.105 7010 -> 72.251.13.91 2321 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 17:55:39.156358 3.575767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 17:55:46.695099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:55:50.909458 0.063819 tcp 10.0.2.105 56342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:55:50.973620 0.068224 tcp 10.0.2.105 56343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:55:51.042118 0.153862 tcp 10.0.2.105 56344 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 17:55:51.196680 0.188673 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:51.385830 0.354358 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:51.740645 0.205911 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/18 17:55:54.598055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:56:10.399201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 17:56:42.159967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:02:46.165775 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:02:53.173505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:03:01.174950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:03:17.178107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:03:49.184251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:10:15.194675 3.001164 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:10:22.200589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:10:30.200955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:10:47.900995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:11:19.559928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:14:39.599805 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:14:39.599963 0.236223 tcp 10.0.2.105 56345 -> 200.84.7.244 8038 SPA_* 0 0 9 1047 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:14:51.322674 0.291928 tcp 10.0.2.105 56345 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:17:22.229154 2.998221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:17:29.233684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:17:37.234582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:17:53.237549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:18:25.243248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:24:29.250609 3.187116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:24:36.401010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:24:44.331510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:25:00.271452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:25:32.277697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:25:57.887602 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:25:57.887774 0.000000 udp 10.0.2.105 7010 -> 72.251.13.91 2321 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:26:14.213864 0.060887 tcp 10.0.2.105 56346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:14.275098 0.060538 tcp 10.0.2.105 56347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:14.336006 0.153400 tcp 10.0.2.105 56348 -> 195.113.214.249 443 SRPA* 0 0 39 31854 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:14.490079 0.062834 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:14.553426 0.104267 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:14.658075 0.122168 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:14.780650 0.198641 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:14.979673 0.159480 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.139614 0.055297 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.195374 0.167079 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.362908 0.049605 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.413069 0.191050 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.604684 0.153807 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:15.758937 0.248876 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:16.008214 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:26:31.959060 0.059356 tcp 10.0.2.105 56349 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:32.018667 0.061243 tcp 10.0.2.105 56350 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:32.080171 0.148565 tcp 10.0.2.105 56351 -> 195.113.214.249 443 SRPA* 0 0 24 13860 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:26:32.229258 4.881013 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 4 976 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:32.518301 4.643390 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1148 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:32.564978 4.689222 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 4 973 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:32.653900 4.781668 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 4 1075 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:32.837902 4.748992 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 4 1173 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:32.986596 4.759183 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 4 1047 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:33.139718 4.693980 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1212 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:33.279066 4.699020 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 4 1129 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:33.422250 4.708020 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 4 959 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:33.544394 0.188095 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:33.732869 4.741368 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 4 1056 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:34.082692 4.597546 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 4 1158 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:34.758465 0.468828 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 834 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.227871 0.113538 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.341916 0.128920 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.471271 0.060152 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.531992 0.056456 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 664 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.588930 0.199415 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.788917 0.042173 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:35.831565 0.189361 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:36.021441 0.159666 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 784 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:36.233196 0.162089 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 845 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:36.395823 0.158085 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 652 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:36.554365 0.265823 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 844 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:38.680919 0.193754 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 768 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:26:38.875234 0.000000 udp 10.0.2.105 7010 -> 187.185.92.51 6333 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:26:44.182173 0.000000 udp 10.0.2.105 7010 -> 218.161.43.237 6826 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:26:49.498973 0.000000 udp 10.0.2.105 7010 -> 212.50.179.184 2782 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:26:57.867767 0.000000 udp 10.0.2.105 7010 -> 76.178.131.15 3230 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:02.631357 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:27:03.936723 0.000000 udp 10.0.2.105 7010 -> 206.116.22.27 6299 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:09.645612 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:17.738302 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:24.230309 0.000000 udp 10.0.2.105 7010 -> 180.168.138.163 4124 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:29.985085 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:27:34.026758 0.000000 udp 10.0.2.105 7010 -> 129.42.208.174 8474 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:41.940036 0.000000 udp 10.0.2.105 7010 -> 49.145.102.219 1034 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:50.362876 0.000000 udp 10.0.2.105 7010 -> 41.133.213.35 3445 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:27:55.129870 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:27:57.517246 0.000000 udp 10.0.2.105 7010 -> 81.137.205.62 2561 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:04.788648 0.000000 udp 10.0.2.105 7010 -> 175.143.0.5 9387 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:09.915938 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:17.906740 0.000000 udp 10.0.2.105 7010 -> 95.137.251.112 1025 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:22.786854 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:28:23.419164 0.000000 udp 10.0.2.105 7010 -> 78.237.105.63 5785 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:30.487392 0.000000 udp 10.0.2.105 7010 -> 197.242.246.1 4305 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:38.979188 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:46.144736 0.252858 udp 10.0.2.105 7010 <-> 101.58.180.147 1146 CON 0 0 2 701 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:28:47.197211 0.000000 udp 10.0.2.105 7010 -> 152.22.0.222 1411 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:28:50.740953 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:28:52.854990 0.000000 udp 10.0.2.105 7010 -> 80.232.221.58 4344 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:01.083637 0.000000 udp 10.0.2.105 7010 -> 203.116.128.12 6031 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:07.611706 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:15.324673 0.061216 udp 10.0.2.105 7010 -> 94.34.143.100 9141 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:15.385889 0.000000 icmp 94.34.143.100 0x0303 -> 10.0.2.105 0xb523 URP 192 1 277 flow=Background 1970/02/18 18:29:19.871083 0.000140 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:29:21.548118 0.000000 udp 10.0.2.105 7010 -> 58.182.150.59 6365 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:29.402182 0.000000 udp 10.0.2.105 7010 -> 124.122.138.198 6030 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:36.375596 0.000000 udp 10.0.2.105 7010 -> 70.28.95.84 2499 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:42.109517 0.137032 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:42.246549 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 117 flow=Background 1970/02/18 18:29:47.008432 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:29:49.105038 0.000000 udp 10.0.2.105 7010 -> 220.244.230.242 9107 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:29:55.871054 0.000000 udp 10.0.2.105 7010 -> 183.63.11.107 1183 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:01.061732 0.000000 udp 10.0.2.105 7010 -> 220.238.53.136 2803 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:08.612500 0.000000 udp 10.0.2.105 7010 -> 61.235.101.38 1188 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:13.141845 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:30:16.394152 0.000000 udp 10.0.2.105 7010 -> 24.248.59.130 6693 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:23.259578 1.743006 udp 10.0.2.105 7010 <-> 79.227.153.87 2430 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:25.324071 0.251754 udp 10.0.2.105 7010 <-> 190.198.176.19 3980 CON 0 0 2 843 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:25.971442 0.000000 udp 10.0.2.105 7010 -> 175.143.108.68 1608 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:31.219339 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:39.179557 0.185109 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 2 836 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:39.402505 0.373068 udp 10.0.2.105 7010 -> 175.139.195.170 8075 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:39.775573 0.000000 icmp 175.139.195.170 0x0303 -> 10.0.2.105 0x8b1f URP 192 1 211 flow=Background 1970/02/18 18:30:43.956583 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:30:44.607985 0.000000 udp 10.0.2.105 7010 -> 61.221.24.204 3248 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:49.806454 0.294547 udp 10.0.2.105 7010 <-> 171.78.147.78 9499 CON 0 0 2 805 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:50.779691 0.173417 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:51.110271 0.055999 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:51.352127 0.000000 udp 10.0.2.105 7010 -> 190.200.59.125 4727 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:30:56.626535 1.294962 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:30:58.251761 0.000000 udp 10.0.2.105 7010 -> 210.196.140.200 9791 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:04.500098 0.000000 udp 10.0.2.105 7010 -> 116.226.46.99 7217 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:09.058198 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:31:10.781342 0.000000 udp 10.0.2.105 7010 -> 64.203.234.38 7762 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:18.827058 0.000000 udp 10.0.2.105 7010 -> 173.251.83.227 9790 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:24.899935 0.000000 udp 10.0.2.105 7010 -> 77.96.161.186 4205 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:31.778536 0.000000 udp 10.0.2.105 7010 -> 188.131.70.138 9865 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:38.054044 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:31:39.629646 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:41.277668 2.957287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 18:31:46.348544 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:48.188309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:31:52.572041 0.000000 udp 10.0.2.105 7010 -> 82.51.112.124 2254 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:31:56.085237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:32:01.390733 0.349778 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:32:01.788702 0.394836 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 785 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:32:03.026601 0.000000 udp 10.0.2.105 7010 -> 84.17.28.238 3256 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:06.180459 0.248638 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:32:09.325872 0.000000 udp 10.0.2.105 7010 -> 97.83.162.247 7664 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:12.107645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:32:17.714653 0.537045 udp 10.0.2.105 7010 <-> 63.19.242.191 6366 CON 0 0 2 749 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:32:18.574685 0.000000 udp 10.0.2.105 7010 -> 69.24.204.241 8000 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:25.491712 0.069849 udp 10.0.2.105 7010 -> 217.86.251.133 3484 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:25.561561 0.000000 icmp 217.86.251.133 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 286 flow=Background 1970/02/18 18:32:30.114316 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:32:33.376165 0.000000 udp 10.0.2.105 7010 -> 223.29.243.77 5241 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:40.506747 0.320513 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 730 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:32:42.274030 0.503321 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:32:43.130884 0.000000 udp 10.0.2.105 7010 -> 116.14.180.34 8975 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:43.716035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:32:50.667582 0.000000 udp 10.0.2.105 7010 -> 113.170.144.192 7986 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:32:55.278369 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:32:57.753852 0.000000 udp 10.0.2.105 7010 -> 219.74.177.125 5208 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:06.570763 0.000000 udp 10.0.2.105 7010 -> 210.124.233.2 8650 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:13.173614 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:21.168788 0.409941 udp 10.0.2.105 7010 <-> 59.18.169.72 7386 CON 0 0 2 788 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:33:21.829774 0.000000 udp 10.0.2.105 7010 -> 58.8.194.26 7044 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:25.812420 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:33:26.994343 0.172758 udp 10.0.2.105 7010 <-> 99.111.178.245 3433 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:33:27.421914 4.909731 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:33:33.509740 0.000000 udp 10.0.2.105 7010 -> 121.101.83.34 7643 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:39.954952 0.000000 udp 10.0.2.105 7010 -> 2.187.190.141 9039 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:46.727999 0.375687 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:33:47.369567 0.000000 udp 10.0.2.105 7010 -> 221.125.7.177 8087 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:54.367226 0.000000 udp 10.0.2.105 7010 -> 175.139.222.237 4924 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:33:59.171950 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:33:59.752396 0.000000 udp 10.0.2.105 7010 -> 124.107.40.143 1098 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:07.037740 0.000000 udp 10.0.2.105 7010 -> 82.31.103.235 4708 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:15.654960 0.236008 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:34:16.069051 0.000000 udp 10.0.2.105 7010 -> 64.134.184.21 8775 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:22.800994 0.000000 udp 10.0.2.105 7010 -> 190.238.215.130 6955 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:27.298167 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:34:28.392451 0.000000 udp 10.0.2.105 7010 -> 120.149.36.87 1147 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:37.220416 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:44.498867 0.000000 udp 10.0.2.105 7010 -> 87.10.118.145 9265 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:51.967388 0.000000 udp 10.0.2.105 7010 -> 194.27.58.162 9119 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:34:56.412065 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:34:58.613336 0.000000 udp 10.0.2.105 7010 -> 70.30.170.125 3161 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:06.528732 0.154493 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 684 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:35:06.866422 0.000000 udp 10.0.2.105 7010 -> 95.254.225.130 9501 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:12.985243 0.000000 udp 10.0.2.105 7010 -> 86.167.238.61 1971 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:20.263380 0.070956 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:35:20.634304 0.177324 udp 10.0.2.105 7010 -> 97.91.121.218 4184 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:20.811628 0.000000 icmp 97.91.121.218 0x0303 -> 10.0.2.105 0x5810 URP 192 1 190 flow=Background 1970/02/18 18:35:25.127757 0.000036 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:35:26.860496 0.076055 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:35:27.154282 0.000000 udp 10.0.2.105 7010 -> 49.144.230.206 9525 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:32.934421 4.950747 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:35:38.041136 0.000000 udp 10.0.2.105 7010 -> 24.8.74.218 8807 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:46.058680 0.000000 udp 10.0.2.105 7010 -> 213.137.0.155 9710 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:51.916639 0.362426 udp 10.0.2.105 7010 <-> 49.144.127.30 9276 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:35:52.399060 0.000000 udp 10.0.2.105 7010 -> 80.178.160.151 2002 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:35:56.547577 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:35:58.279108 0.000000 udp 10.0.2.105 7010 -> 61.45.36.149 7569 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:07.055962 0.000000 udp 10.0.2.105 7010 -> 122.99.97.189 1405 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:15.551741 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:20.260460 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:36:21.584723 0.000000 udp 10.0.2.105 7010 -> 171.98.35.200 6263 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:28.080978 0.000000 udp 10.0.2.105 7010 -> 85.228.168.150 1204 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:34.772927 0.000000 udp 10.0.2.105 7010 -> 2.240.197.86 3039 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:40.674365 3.002712 udp 10.0.2.105 7010 -> 213.226.245.28 3286 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:43.677077 0.000000 icmp 213.226.229.178 0x0103 -> 10.0.2.105 0xd5e2 URH 192 1 281 flow=Background 1970/02/18 18:36:45.425690 0.000036 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:36:48.992797 0.038342 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 710 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:36:49.161442 0.203136 udp 10.0.2.105 7010 <-> 172.250.72.133 4822 CON 0 0 2 800 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:36:49.464178 0.000000 udp 10.0.2.105 7010 -> 182.253.39.7 6720 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:36:56.222848 0.335518 udp 10.0.2.105 7010 <-> 112.204.154.2 4737 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:36:56.676204 0.067880 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 857 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:36:56.753322 0.000000 udp 10.0.2.105 7010 -> 83.110.222.198 7988 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:37:03.520608 0.000000 udp 10.0.2.105 7010 -> 68.196.213.200 7516 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 18:37:12.040674 0.075503 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 796 flow=From-Botnet-V2-UDP-Established 1970/02/18 18:37:16.523424 0.000211 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:38:53.495091 2.964987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 18:39:00.409305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:39:08.303798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:39:24.103737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:39:55.682014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:44:57.001676 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 18:44:57.001787 4.631040 tcp 10.0.2.105 56352 -> 200.84.7.244 8038 SPA_* 0 0 14 1752 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:45:02.193115 0.000221 tcp 10.0.2.105 56352 -> 200.84.7.244 8038 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/18 18:45:54.947203 2.968235 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:46:01.862909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:46:11.897554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:46:27.704163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:46:59.318466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:57:03.381176 3.017488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 18:57:10.396898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:57:18.398238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:57:34.401223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 18:58:06.407206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:04:10.413297 3.040028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 19:04:17.438234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:04:25.434770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:04:41.440655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:05:13.462787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:07:26.042285 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:07:26.042446 0.056203 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:07:26.098649 0.000000 icmp 82.211.187.89 0x0303 -> 10.0.2.105 0xd713 URP 192 1 200 flow=Background 1970/02/18 19:07:42.405127 0.078861 tcp 10.0.2.105 56353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:07:42.484414 0.064371 tcp 10.0.2.105 56354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:07:42.549126 0.151031 tcp 10.0.2.105 56355 -> 195.113.214.249 443 SRPA* 0 0 22 11418 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:07:42.701009 0.470725 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.172113 0.103815 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.276487 0.132634 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.409497 0.062274 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.472171 0.200269 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.672822 0.050587 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.723839 0.190975 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:43.915197 0.156345 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:44.238544 0.167312 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:44.406234 0.160012 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:44.566702 0.186955 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:07:44.754024 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:08:00.582333 0.063081 tcp 10.0.2.105 56356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:00.645739 0.471972 tcp 10.0.2.105 56357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:01.118008 0.160901 tcp 10.0.2.105 56358 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:01.279639 0.235569 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:01.515684 0.287442 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:01.803616 0.056100 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:01.860173 0.084287 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:01.944961 0.810207 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:02.755616 0.341271 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:03.097356 0.155056 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:03.252900 0.083460 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:03.336837 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:08:20.130312 0.434376 tcp 10.0.2.105 56359 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:20.564972 0.064984 tcp 10.0.2.105 56360 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:20.630211 0.155113 tcp 10.0.2.105 56361 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:20.785902 0.184685 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:20.970973 0.208744 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:21.193567 0.262977 udp 10.0.2.105 7010 <-> 101.58.180.147 1146 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:21.457004 0.030339 udp 10.0.2.105 7010 <-> 79.227.153.87 2430 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:21.487786 0.000000 udp 10.0.2.105 7010 -> 190.198.176.19 3980 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:08:39.975261 0.064135 tcp 10.0.2.105 56362 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:40.039218 0.103039 tcp 10.0.2.105 56363 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:40.142597 0.183050 tcp 10.0.2.105 56364 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:40.326203 0.000000 udp 10.0.2.105 7010 -> 75.81.152.178 5604 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:08:56.009174 0.258695 tcp 10.0.2.105 56365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:56.267688 0.061272 tcp 10.0.2.105 56366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:56.329256 0.162266 tcp 10.0.2.105 56367 -> 195.113.214.249 443 SRPA* 0 0 35 19220 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:08:56.491685 0.252251 udp 10.0.2.105 7010 <-> 171.78.147.78 9499 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:56.744450 0.172980 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:56.917797 0.054373 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:56.972630 0.351159 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:58.192216 0.344683 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:58.537385 0.392807 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:58.930569 0.440188 udp 10.0.2.105 7010 <-> 63.19.242.191 6366 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:59.371137 0.186486 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:08:59.558060 0.468301 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:00.026820 0.000000 udp 10.0.2.105 7010 -> 59.18.169.72 7386 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:09:17.339223 0.060993 tcp 10.0.2.105 56368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:09:17.400529 0.065518 tcp 10.0.2.105 56369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:09:17.466362 0.170398 tcp 10.0.2.105 56370 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:09:17.637474 0.166963 udp 10.0.2.105 7010 <-> 99.111.178.245 3433 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:17.804899 0.177206 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:17.982602 0.368446 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:18.351443 0.235765 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:18.587693 0.152453 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:18.740626 0.063298 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:18.804448 0.500081 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:19.304978 0.355861 udp 10.0.2.105 7010 <-> 49.144.127.30 9276 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:19.661258 0.038150 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:19.699785 0.376366 udp 10.0.2.105 7010 <-> 112.204.154.2 4737 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:20.076532 0.066515 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:09:20.143500 0.065830 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:11:17.457412 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 19:11:24.464719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:11:32.466135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:11:48.469163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:12:20.475287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:14:56.881625 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:14:56.881726 3.138167 tcp 10.0.2.105 56371 -> 200.84.7.244 8038 FSPA* 0 0 13 1290 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:14:57.308788 1.533020 tcp 10.0.2.105 56372 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:14:58.842107 0.061932 tcp 10.0.2.105 56373 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:14:58.904431 0.158825 tcp 10.0.2.105 56374 -> 195.113.214.249 443 SRPA* 0 0 20 10251 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:00.020114 3.005674 tcp 10.0.2.105 56375 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:09.127199 0.000000 tcp 10.0.2.105 56375 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:15.086237 0.061312 tcp 10.0.2.105 56376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:15.147889 0.061975 tcp 10.0.2.105 56377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:15.209696 0.154118 tcp 10.0.2.105 56378 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:15.770684 2.989124 tcp 10.0.2.105 56379 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:25.916951 0.000000 tcp 10.0.2.105 56379 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:31.852595 0.059052 tcp 10.0.2.105 56380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:31.911930 0.063743 tcp 10.0.2.105 56381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:31.975988 0.179567 tcp 10.0.2.105 56382 -> 195.113.214.249 443 SRPA* 0 0 27 11836 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:33.514129 4.006917 tcp 10.0.2.105 56383 -> 46.48.223.67 15494 SPA_* 0 0 9 1074 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:39.893868 0.793595 tcp 10.0.2.105 56383 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:39.894845 0.060432 tcp 10.0.2.105 56384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:39.955584 0.060656 tcp 10.0.2.105 56385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:40.016511 0.149485 tcp 10.0.2.105 56386 -> 195.113.214.249 443 SRPA* 0 0 22 12878 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:40.687669 2.983246 tcp 10.0.2.105 56387 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:50.749443 0.000000 tcp 10.0.2.105 56387 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:15:56.671872 0.059965 tcp 10.0.2.105 56388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:56.732192 0.061276 tcp 10.0.2.105 56389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:56.793797 0.154988 tcp 10.0.2.105 56390 -> 195.113.214.249 443 SRPA* 0 0 40 22370 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:15:57.725003 0.214577 tcp 10.0.2.105 56391 -> 200.84.7.244 8038 SPA_* 0 0 9 1074 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:16:27.575401 0.580717 tcp 10.0.2.105 56391 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:16:27.575770 2.962598 tcp 10.0.2.105 56392 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:16:39.392273 0.000000 tcp 10.0.2.105 56392 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:16:45.325042 4.011381 tcp 10.0.2.105 56393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:16:55.259200 0.000000 tcp 10.0.2.105 56393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:17:00.733412 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:17:01.916366 0.347615 tcp 10.0.2.105 56394 -> 46.48.223.67 15494 SPA_* 0 0 9 1074 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:17:07.993086 0.000328 tcp 10.0.2.105 56394 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:17:07.993645 2.967534 tcp 10.0.2.105 56395 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:17:16.897867 0.000000 tcp 10.0.2.105 56395 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 19:18:33.195261 2.965403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 19:18:40.119206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:18:48.037134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:19:03.836105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:19:35.468536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:22:19.525223 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:22:19.525340 1.769914 tcp 10.0.2.105 56396 -> 200.84.7.244 8038 FSPA* 0 0 14 1575 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:25:35.239813 2.954503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 19:25:42.158866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:25:50.057687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:26:07.668426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:26:39.284699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:32:38.538786 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 19:32:45.546192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:32:53.547791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:33:09.551285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:33:41.557148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:39:23.428846 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:39:23.428942 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:39:40.895657 0.664007 tcp 10.0.2.105 56397 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:41.559979 0.062561 tcp 10.0.2.105 56398 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:41.622803 0.155464 tcp 10.0.2.105 56399 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:41.778938 0.171817 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:39:41.930288 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:39:46.097468 2.967962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 19:39:53.022236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:39:58.426449 0.060267 tcp 10.0.2.105 56400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:58.486554 0.062478 tcp 10.0.2.105 56401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:58.549347 0.150786 tcp 10.0.2.105 56402 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:39:58.700712 0.000000 udp 10.0.2.105 7010 -> 190.198.176.19 3980 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:40:00.936444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:40:14.310484 0.066159 tcp 10.0.2.105 56403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:14.376940 0.061564 tcp 10.0.2.105 56404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:14.438786 0.158310 tcp 10.0.2.105 56405 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:14.597783 0.000000 udp 10.0.2.105 7010 -> 75.81.152.178 5604 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:40:16.745077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:40:33.399736 0.061021 tcp 10.0.2.105 56406 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:33.461022 0.061825 tcp 10.0.2.105 56407 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:33.523129 0.161513 tcp 10.0.2.105 56408 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:33.685207 0.441569 udp 10.0.2.105 7010 <-> 59.18.169.72 7386 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:34.122686 0.067659 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:34.912007 0.125245 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:35.017694 0.490050 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2608 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:36.107042 0.083874 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:36.863143 1.551886 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:38.672874 0.200948 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:38.897402 0.189440 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:39.062878 0.174040 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:39.233324 0.211178 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:39.467982 0.186611 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:39.628901 0.190888 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:39.817108 0.279889 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:40.341368 0.094006 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:40.425930 0.087080 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:40.914213 0.237477 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:41.130352 0.346981 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:41.486522 0.182369 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:42.843335 0.138434 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:42.960572 0.186919 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:43.632181 0.047187 udp 10.0.2.105 7010 <-> 79.227.153.87 2430 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:40:43.980743 0.000000 udp 10.0.2.105 7010 -> 101.58.180.147 1146 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:40:49.833781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:40:59.600621 0.060458 tcp 10.0.2.105 56409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:59.661366 0.061111 tcp 10.0.2.105 56410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:59.722761 0.154356 tcp 10.0.2.105 56411 -> 195.113.214.249 443 SRPA* 0 0 23 13806 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:40:59.877633 0.215818 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:00.086216 0.231280 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:00.929118 0.058862 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:00.985939 1.423988 udp 10.0.2.105 7010 <-> 171.78.147.78 9499 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:01.483294 0.177854 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:01.775467 0.346483 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:02.254530 0.350049 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:03.105948 0.623972 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:03.767680 0.396182 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:04.159549 0.000000 udp 10.0.2.105 7010 -> 63.19.242.191 6366 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 19:41:22.372039 0.061222 tcp 10.0.2.105 56412 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:41:22.433572 0.061440 tcp 10.0.2.105 56413 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:41:22.495266 0.156118 tcp 10.0.2.105 56414 -> 195.113.214.249 443 SRPA* 0 0 20 11310 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:41:22.652064 0.223024 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:22.843851 0.202621 udp 10.0.2.105 7010 <-> 99.111.178.245 3433 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:23.633922 0.254310 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:23.969933 0.161451 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:24.254848 0.086477 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:24.325011 0.451646 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:25.127067 0.236155 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:25.719932 3.705383 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:28.770562 0.438692 udp 10.0.2.105 7010 <-> 49.144.127.30 9276 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:29.683986 0.039804 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:29.979427 0.983621 udp 10.0.2.105 7010 <-> 112.204.154.2 4737 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:30.936937 0.071251 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2626 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:41:31.612110 0.076317 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/18 19:46:52.597686 3.191154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 19:46:59.758011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:47:07.687784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:47:23.619342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:47:55.627143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:52:15.178535 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 19:52:15.178643 1.888627 tcp 10.0.2.105 56415 -> 200.84.7.244 8038 FSPA* 0 0 15 1578 flow=From-Botnet-V2-TCP-Established 1970/02/18 19:53:59.631203 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 19:54:06.638444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:54:14.639928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:54:30.642703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 19:55:02.650745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:01:06.656583 3.192146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:01:13.823370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:01:21.751610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:01:37.676725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:02:09.682660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:08:13.688081 3.004113 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:08:20.695915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:08:28.697750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:08:44.701058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:09:16.706714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:11:42.826837 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 20:11:42.826945 0.000000 udp 10.0.2.105 7010 -> 101.58.180.147 1146 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:11:57.980532 0.063884 tcp 10.0.2.105 56416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:11:58.044690 0.065668 tcp 10.0.2.105 56417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:11:58.110644 0.161574 tcp 10.0.2.105 56418 -> 195.113.214.249 443 SRPA* 0 0 22 12006 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:11:58.272918 0.000000 udp 10.0.2.105 7010 -> 63.19.242.191 6366 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:12:14.974996 0.059664 tcp 10.0.2.105 56419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:15.034901 0.066250 tcp 10.0.2.105 56420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:15.101428 0.156346 tcp 10.0.2.105 56421 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:15.258404 0.149641 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:15.408418 0.000000 udp 10.0.2.105 7010 -> 59.18.169.72 7386 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:12:30.515879 0.059734 tcp 10.0.2.105 56422 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:30.575916 0.064920 tcp 10.0.2.105 56423 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:30.641095 0.162677 tcp 10.0.2.105 56424 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:30.804407 0.103641 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:30.908455 0.049050 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:30.957887 0.443444 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:31.401819 0.063474 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:31.465695 0.158041 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:31.624110 0.191561 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:31.816029 0.171889 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:31.988254 0.199194 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:32.187825 0.122722 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:32.310956 0.162873 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:32.474181 0.282799 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:32.757341 0.183756 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:32.941495 0.083299 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.025178 0.332557 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.358105 0.049859 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.408370 0.220402 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.629139 0.118622 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.748352 0.157257 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:33.905925 1.515213 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:35.421565 0.028613 udp 10.0.2.105 7010 <-> 79.227.153.87 2430 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:35.450640 0.200750 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:35.651863 0.055647 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:35.791213 0.190235 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:35.981802 0.338530 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:36.320724 0.173473 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:36.494714 0.000000 udp 10.0.2.105 7010 -> 171.78.147.78 9499 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:12:52.728342 0.063012 tcp 10.0.2.105 56425 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:52.791908 0.062229 tcp 10.0.2.105 56426 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:52.854414 0.250615 tcp 10.0.2.105 56427 -> 195.113.214.249 443 SRPA* 0 0 44 27166 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:12:53.105752 0.344227 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:53.450385 0.394292 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:53.845095 0.413268 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:54.258740 0.187236 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:12:54.446423 0.000000 udp 10.0.2.105 7010 -> 99.111.178.245 3433 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:13:12.676594 0.384953 tcp 10.0.2.105 56428 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:13.061824 0.062340 tcp 10.0.2.105 56429 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:13.124434 0.158036 tcp 10.0.2.105 56430 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:13.283079 0.175536 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:13.459051 0.153555 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:13.613009 0.067930 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:13.681658 0.372229 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:14.054257 0.235399 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:14.290012 2.443932 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:16.734336 0.351378 udp 10.0.2.105 7010 <-> 49.144.127.30 9276 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:17.086162 0.037266 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:17.123770 0.000000 udp 10.0.2.105 7010 -> 112.204.154.2 4737 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:13:32.609058 0.061772 tcp 10.0.2.105 56431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:32.671117 0.060894 tcp 10.0.2.105 56432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:32.732332 0.156261 tcp 10.0.2.105 56433 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:13:32.889259 0.049880 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:13:32.939526 0.077840 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:15:20.714177 2.999787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 20:15:27.720455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:15:35.722581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:15:51.724791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:16:23.732372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:22:17.069431 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 20:22:17.069530 1.653255 tcp 10.0.2.105 56434 -> 200.84.7.244 8038 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:22:27.737437 3.003122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:22:34.744512 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:22:42.745689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:22:58.749140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:23:30.757885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:29:34.763336 3.001778 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:29:41.768251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:29:51.469246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:30:07.288374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:30:38.920935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:36:41.795102 3.049398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:36:48.825392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:36:56.813517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:37:12.816189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:37:45.765030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:43:48.838295 3.002034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 20:43:55.848640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:44:00.074573 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 20:44:00.074762 0.420705 udp 10.0.2.105 7010 <-> 59.18.169.72 7386 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:00.666721 0.000000 udp 10.0.2.105 7010 -> 171.78.147.78 9499 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:44:03.847784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:44:15.836678 0.062702 tcp 10.0.2.105 56435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:15.899723 0.065396 tcp 10.0.2.105 56436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:15.965452 0.153728 tcp 10.0.2.105 56437 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:16.119769 0.000000 udp 10.0.2.105 7010 -> 99.111.178.245 3433 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:44:19.851565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:44:32.993195 0.061220 tcp 10.0.2.105 56438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:33.054683 0.063803 tcp 10.0.2.105 56439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:33.118786 0.153759 tcp 10.0.2.105 56440 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:33.273229 0.000000 udp 10.0.2.105 7010 -> 112.204.154.2 4737 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:44:51.663923 0.063361 tcp 10.0.2.105 56441 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:51.727524 0.067627 tcp 10.0.2.105 56442 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:51.795468 0.152165 tcp 10.0.2.105 56443 -> 195.113.214.249 443 SRPA* 0 0 21 12824 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:44:51.948305 0.146574 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:52.095290 0.051182 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:52.147011 0.104280 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:52.251752 0.169332 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:52.421509 0.200796 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:52.481286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:44:52.622757 3.865310 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:56.488692 0.158282 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:56.647353 0.064531 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:56.712339 0.500040 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:57.212808 0.117709 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:57.330886 0.083571 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:57.414807 0.158199 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:57.573437 0.187627 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:57.761472 0.286127 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.048029 0.123005 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.171424 0.156391 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.328269 0.342458 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.671228 0.216264 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.887935 0.043094 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:58.931478 0.188433 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:44:59.120282 0.000000 udp 10.0.2.105 7010 -> 79.227.153.87 2430 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:45:14.204287 0.392326 tcp 10.0.2.105 56444 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:14.596931 0.067522 tcp 10.0.2.105 56445 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:14.664727 0.153820 tcp 10.0.2.105 56446 -> 195.113.214.249 443 SRPA* 0 0 23 12932 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:14.819092 0.107203 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:14.926660 0.055483 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:14.982554 0.202979 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:15.185987 0.345682 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:15.532065 0.171866 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:15.704357 0.397184 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:16.101989 0.347731 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:16.450153 0.417607 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:16.868202 0.184332 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:17.052945 0.177146 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:17.230542 0.234956 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:17.465878 0.062227 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:17.528500 0.186358 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:17.715237 0.364517 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:18.080147 0.037956 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:18.118512 2.680487 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:20.925304 0.000000 udp 10.0.2.105 7010 -> 49.144.127.30 9276 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 20:45:35.863116 0.063478 tcp 10.0.2.105 56447 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:35.926915 0.062238 tcp 10.0.2.105 56448 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:35.989019 0.150426 tcp 10.0.2.105 56449 -> 195.113.214.249 443 SRPA* 0 0 21 12822 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:45:36.140072 0.049196 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:45:36.189720 0.070778 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/18 20:52:18.731653 0.093169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 20:52:18.824992 1.430870 tcp 10.0.2.105 56450 -> 200.84.7.244 8038 FSPA* 0 0 15 1576 flow=From-Botnet-V2-TCP-Established 1970/02/18 20:56:03.875673 3.001535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 20:56:10.882587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:56:21.945615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:56:37.758379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 20:57:09.355059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:03:10.909581 3.024388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:03:18.020202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:03:25.958482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:03:41.931608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:04:13.943779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:10:30.954472 2.999370 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:10:37.962749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:10:45.961288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:11:01.963901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:11:33.970187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:16:01.697791 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 21:16:01.697881 0.000000 udp 10.0.2.105 7010 -> 79.227.153.87 2430 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 21:16:16.710141 0.062144 tcp 10.0.2.105 56451 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:16.772598 0.064672 tcp 10.0.2.105 56452 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:16.837619 0.161463 tcp 10.0.2.105 56453 -> 195.113.214.249 443 SRPA* 0 0 22 13124 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:16.999585 0.000000 udp 10.0.2.105 7010 -> 49.144.127.30 9276 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 21:16:33.111733 0.060119 tcp 10.0.2.105 56454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:33.172107 0.064412 tcp 10.0.2.105 56455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:33.236867 0.159057 tcp 10.0.2.105 56456 -> 195.113.214.249 443 SRPA* 0 0 22 12006 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:33.396625 0.000000 udp 10.0.2.105 7010 -> 59.18.169.72 7386 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 21:16:48.813347 0.060933 tcp 10.0.2.105 56457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:48.874571 0.062679 tcp 10.0.2.105 56458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:48.937543 0.156188 tcp 10.0.2.105 56459 -> 195.113.214.249 443 SRPA* 0 0 22 13126 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:16:49.094334 0.168631 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.263343 0.201092 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.464777 0.054404 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.519567 0.146885 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.666856 0.117655 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.784935 0.160269 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:49.945641 0.191313 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:50.137352 0.065328 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:50.203125 0.182822 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:50.386339 0.187250 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:50.573944 0.401900 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:50.976326 0.123298 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:51.099981 0.083912 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:51.184397 0.154657 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:51.339428 0.289081 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:51.628906 0.121055 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:51.750354 0.333368 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:52.084098 0.187956 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:52.272440 0.044369 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:52.317179 0.215091 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:52.532639 0.203043 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:52.736216 0.338366 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:53.074996 0.171774 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:53.247139 1.657002 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:54.904706 0.058931 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:54.964064 0.437327 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:55.405287 0.344564 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:55.750255 0.396353 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.146952 0.234582 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.381908 0.066702 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.449071 0.152918 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.602396 0.176073 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.778833 0.189994 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:56.969197 0.038146 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:57.007711 1.620134 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:16:58.628228 3.161425 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:17:02.909899 0.049683 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:17:02.959968 0.072111 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:17:37.975936 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 21:17:44.983826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:17:52.985390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:18:08.988552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:18:40.994080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:22:20.180485 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 21:22:20.180589 3.382893 tcp 10.0.2.105 56460 -> 200.84.7.244 8038 FSPA* 0 0 15 1636 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:24:45.000535 3.002670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:24:52.007577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:25:00.009248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:25:16.012370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:25:48.018334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:31:52.024810 3.791213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:31:59.781838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:32:07.691942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:32:23.496534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:32:55.138313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:38:59.058060 3.001979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:39:06.065762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:39:14.066678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:39:30.250069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:40:02.086140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:46:06.092789 3.108652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 21:46:13.174585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:46:21.111123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:46:37.114737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:47:09.120009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:47:25.354030 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 21:47:25.354139 0.000000 udp 10.0.2.105 7010 -> 59.18.169.72 7386 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 21:47:42.620411 0.032955 tcp 10.0.2.105 56461 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:47:42.653669 0.089705 tcp 10.0.2.105 56462 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:47:42.743640 0.108455 tcp 10.0.2.105 56463 -> 195.113.214.249 443 SRPA* 0 0 34 25465 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:47:42.852701 0.168639 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.021768 0.199375 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.221634 0.056413 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.278455 0.146225 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.425098 0.104936 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.530431 0.158200 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.689036 0.192053 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.881449 0.061353 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:43.943138 0.154809 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:44.098324 0.189069 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:47:44.287746 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 21:48:03.218687 0.031320 tcp 10.0.2.105 56464 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:48:03.250254 0.032669 tcp 10.0.2.105 56465 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:48:03.283252 0.127409 tcp 10.0.2.105 56466 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:48:03.411159 0.183015 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:03.730011 0.084057 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:03.814477 0.089104 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:03.903968 0.321451 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:04.225885 0.155206 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:04.381543 0.274753 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:04.656655 0.188701 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:04.845821 0.056502 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:04.902763 0.216112 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:05.119273 0.206008 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:05.325625 0.349180 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:05.675179 0.172976 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:05.848722 0.657161 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:06.506268 0.056275 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:06.562943 0.396948 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:06.960328 0.398049 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:07.358725 0.346047 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:07.705129 0.234946 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:07.940518 0.069662 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:08.010521 0.227535 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:08.238398 0.176215 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:08.415050 0.187723 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:08.836885 0.038119 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:08.875359 0.363924 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:09.239674 0.094655 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:09.334704 2.471163 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:48:11.806235 0.048949 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/18 21:52:23.562458 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 21:52:23.562600 1.321676 tcp 10.0.2.105 56467 -> 200.84.7.244 8038 FSPA* 0 0 14 1516 flow=From-Botnet-V2-TCP-Established 1970/02/18 21:53:13.126460 3.001376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 21:53:20.133349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:53:28.135294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:53:44.138623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 21:54:16.144145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:00:20.151283 3.000455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:00:27.163376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:00:35.172444 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:00:51.172008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:01:23.178743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:07:27.184166 3.001474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:07:34.191639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:07:42.193007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:07:58.195741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:08:30.202151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:14:34.207742 3.114307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:14:41.305877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:14:49.242403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:15:05.230049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:15:37.236034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:18:24.398886 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 22:18:24.399029 0.467055 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:24.866458 0.085145 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:24.952050 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 22:18:40.461404 0.042989 tcp 10.0.2.105 56468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:40.504709 0.044616 tcp 10.0.2.105 56469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:40.549788 0.127565 tcp 10.0.2.105 56470 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:40.677962 0.157394 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:40.835771 0.333307 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.169551 0.117804 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.287743 0.187334 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.475457 0.043645 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.519648 0.205175 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.725188 0.214663 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:41.940396 0.283776 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:42.224526 0.350459 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:42.741408 0.174265 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:42.916086 0.058218 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:42.974630 0.144383 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:43.119387 0.391437 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:43.511257 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 22:18:58.736256 0.088391 tcp 10.0.2.105 56471 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:58.824939 0.033699 tcp 10.0.2.105 56472 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:58.858931 0.627380 tcp 10.0.2.105 56473 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:18:59.487352 0.067107 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:59.554847 0.235019 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:18:59.790303 0.442180 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:00.232947 0.186111 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:00.419587 0.037031 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:00.456979 0.151862 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:00.609228 0.177251 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:00.786921 0.392397 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:01.179735 0.077721 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:01.257891 2.433081 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:03.691325 0.049457 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:03.741152 0.169924 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:03.911448 0.158348 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.070140 0.066648 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.137132 0.191899 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.329375 0.159776 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.489493 0.104879 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.594759 0.147130 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.742311 0.058037 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:04.800743 0.199194 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:19:05.000374 0.188213 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:21:41.242105 3.001560 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 22:21:48.249956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:21:56.250997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:22:12.253926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:22:25.044838 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 22:22:25.044964 0.213761 tcp 10.0.2.105 56474 -> 200.84.7.244 8038 SPA_* 0 0 9 1210 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:22:44.270064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:22:49.296163 0.335375 tcp 10.0.2.105 56474 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:28:48.276215 3.001222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:28:55.283580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:29:03.284973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:29:19.287957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:29:51.296471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:35:55.300113 3.002703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:36:02.307441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:36:10.309049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:36:26.312648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:36:58.318127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:43:02.326884 2.998502 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 22:43:09.331529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:43:17.332430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:43:33.335839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:44:05.341903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:49:20.065053 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 22:49:20.065164 0.084120 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:20.149643 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 22:49:35.287578 0.121615 tcp 10.0.2.105 56475 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:35.409500 0.033542 tcp 10.0.2.105 56476 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:35.443361 0.211845 tcp 10.0.2.105 56477 -> 195.113.214.249 443 SRPA* 0 0 27 12038 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:35.654274 0.393102 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:36.047801 0.082990 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:36.131156 0.324473 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:36.456049 0.154626 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:36.611126 0.047993 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:36.659504 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 22:49:54.494299 0.033256 tcp 10.0.2.105 56478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:54.527863 0.059000 tcp 10.0.2.105 56479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:54.587155 0.208685 tcp 10.0.2.105 56480 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:49:54.796576 0.226445 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.023410 0.135241 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.159078 0.186317 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.345821 0.057912 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.404136 0.157178 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.561689 0.276959 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:55.880242 0.346144 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:56.226732 0.173224 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:56.400330 0.395129 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:56.795863 0.072426 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:56.868653 0.244041 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:57.113072 0.343991 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:57.457450 0.316250 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:57.774108 0.037433 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:57.811930 0.152982 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:57.965285 0.172941 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 197 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:58.138659 0.364249 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:58.503266 0.073625 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:58.577261 0.172413 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:58.750153 0.155580 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:58.906119 0.283864 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:59.190366 0.505039 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:59.695766 0.049629 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:59.745797 0.195514 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:49:59.941779 0.158401 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:50:00.100729 0.105133 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:50:00.206246 0.147758 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:50:00.354361 0.055542 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:50:00.410252 0.199061 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:50:00.609701 0.177783 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/18 22:52:49.636210 0.000175 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 22:52:49.636438 2.106266 tcp 10.0.2.105 56481 -> 200.84.7.244 8038 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/02/18 22:55:43.348055 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 22:55:50.355727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:55:58.356866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:56:14.360092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 22:56:46.366610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:02:50.372244 3.090319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 23:02:57.434553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:03:05.391285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:03:21.394018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:03:53.400101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:10:21.413533 2.998495 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 23:10:28.418018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:10:37.557547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:10:53.374891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:11:25.874011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:17:28.454105 3.007401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 23:17:35.462669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:17:43.463447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:17:59.466343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:18:31.906901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:20:07.931698 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 23:20:07.931954 0.201899 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:08.134244 0.085426 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:08.220049 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 23:20:24.637022 0.114010 tcp 10.0.2.105 56482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:24.751340 0.036098 tcp 10.0.2.105 56483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:24.787721 0.157528 tcp 10.0.2.105 56484 -> 195.113.214.249 443 SRPA* 0 0 22 11652 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:24.945727 0.083710 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.029793 0.156659 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.186849 0.334997 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.522230 0.046576 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.569201 0.215101 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.784715 0.112322 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:25.897399 0.188141 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:26.085881 0.061594 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:26.147834 0.714405 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:26.862617 0.287452 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:27.150491 0.339218 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:27.490123 0.174450 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:27.664951 0.245452 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:27.910906 0.397862 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:28.309145 0.068633 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:28.378144 0.349007 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:28.965950 0.185863 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.152343 0.038403 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.191222 0.153373 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.344994 0.094059 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.439410 0.172543 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.612348 0.176354 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:29.789122 0.390910 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:30.180471 0.156215 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:30.337108 0.063856 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:30.401329 3.469126 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:33.870870 0.000000 udp 10.0.2.105 7010 -> 217.220.223.100 6072 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 23:20:48.910817 0.032437 tcp 10.0.2.105 56485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:48.943541 0.032948 tcp 10.0.2.105 56486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:48.976851 0.135662 tcp 10.0.2.105 56487 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:20:49.113012 0.204652 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.318049 0.147856 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.466252 0.056738 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.523333 0.198712 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.722432 0.157292 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.880090 0.103960 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:20:49.984492 0.189813 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:22:51.747099 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 23:22:51.747188 1.112550 tcp 10.0.2.105 56488 -> 200.84.7.244 8038 FSPA* 0 0 13 1326 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:22:52.192095 0.031931 tcp 10.0.2.105 56489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:22:52.224316 0.033495 tcp 10.0.2.105 56490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:22:52.258061 0.128262 tcp 10.0.2.105 56491 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:22:52.859965 3.002666 tcp 10.0.2.105 56492 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:01.861336 0.000000 tcp 10.0.2.105 56492 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:07.860350 0.031772 tcp 10.0.2.105 56493 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:07.892440 0.034009 tcp 10.0.2.105 56494 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:07.926285 0.331109 tcp 10.0.2.105 56495 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:08.697758 2.997719 tcp 10.0.2.105 56496 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:17.693988 0.000000 tcp 10.0.2.105 56496 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:23.693491 0.788117 tcp 10.0.2.105 56497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:24.481916 0.034575 tcp 10.0.2.105 56498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:24.516750 0.128725 tcp 10.0.2.105 56499 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:24.661223 3.570309 tcp 10.0.2.105 56500 -> 46.48.223.67 15494 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:26.587962 0.336914 tcp 10.0.2.105 56501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:26.925130 0.033830 tcp 10.0.2.105 56502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:26.959356 0.138092 tcp 10.0.2.105 56503 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:28.231773 2.970797 tcp 10.0.2.105 56504 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:37.129683 0.000000 tcp 10.0.2.105 56504 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:43.046896 0.031987 tcp 10.0.2.105 56505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:43.078713 0.120552 tcp 10.0.2.105 56506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:43.199046 0.138673 tcp 10.0.2.105 56507 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:43.546848 0.424397 tcp 10.0.2.105 56508 -> 200.84.7.244 8038 FSPA* 0 0 13 1326 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:23:43.971471 2.962906 tcp 10.0.2.105 56509 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:52.864647 0.000000 tcp 10.0.2.105 56509 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:23:58.797074 3.519794 tcp 10.0.2.105 56510 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:24:08.247438 0.000000 tcp 10.0.2.105 56510 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:24:12.773403 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 23:24:14.188615 2.769766 tcp 10.0.2.105 56511 -> 46.48.223.67 15494 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:24:16.957898 2.966488 tcp 10.0.2.105 56512 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:24:25.860567 0.000000 tcp 10.0.2.105 56512 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:24:37.117429 2.967789 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 23:24:45.176316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:24:53.081337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:25:08.896528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:25:41.583971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:29:31.345842 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 23:29:31.345933 2.947715 tcp 10.0.2.105 56513 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:29:40.264388 0.000000 tcp 10.0.2.105 56513 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:29:47.350625 0.034377 tcp 10.0.2.105 56514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:29:47.385278 0.034723 tcp 10.0.2.105 56515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:29:47.420276 0.541455 tcp 10.0.2.105 56516 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:29:48.122301 2.965028 tcp 10.0.2.105 56517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:29:57.009028 0.000000 tcp 10.0.2.105 56517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:30:02.938637 0.032536 tcp 10.0.2.105 56518 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:02.971458 0.098192 tcp 10.0.2.105 56519 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:03.069934 0.140019 tcp 10.0.2.105 56520 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:03.455520 2.264281 tcp 10.0.2.105 56521 -> 46.48.223.67 15494 FSPA* 0 0 14 1758 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:05.313887 0.033016 tcp 10.0.2.105 56522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:05.346835 0.034031 tcp 10.0.2.105 56523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:05.380695 0.129854 tcp 10.0.2.105 56524 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:05.720052 2.970101 tcp 10.0.2.105 56525 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:30:14.632635 0.000000 tcp 10.0.2.105 56525 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/18 23:30:21.041009 0.032790 tcp 10.0.2.105 56526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:21.074133 0.034351 tcp 10.0.2.105 56527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:21.108806 0.744619 tcp 10.0.2.105 56528 -> 195.113.214.249 443 SRPA* 0 0 74 78482 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:30:22.400245 1.998013 tcp 10.0.2.105 56529 -> 200.84.7.244 8038 FSPA* 0 0 15 1789 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:31:42.782456 2.969840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 23:31:49.713137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:31:57.630352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:32:13.543936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:32:45.550599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:38:49.556784 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 23:38:56.569358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:39:04.565469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:39:20.568430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:39:52.574707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:45:56.580667 3.056703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/18 23:46:03.616770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:46:11.604485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:46:28.973809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:47:00.599895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:51:18.651442 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/18 23:51:18.651558 0.390465 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.042469 0.050696 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.093555 0.205362 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.299278 0.096787 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.396572 0.156928 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.553997 0.084542 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.638929 0.214500 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:19.853855 0.182443 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:20.036655 0.191262 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:20.228306 0.061168 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:20.289842 0.040657 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:20.330864 0.318041 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:20.649302 0.528027 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:21.177687 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 23:51:36.487808 0.032093 tcp 10.0.2.105 56530 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:36.520181 0.034482 tcp 10.0.2.105 56531 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:36.554916 0.276920 tcp 10.0.2.105 56532 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:36.832536 0.337299 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:37.170176 0.173524 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:37.344106 0.244261 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:37.588772 0.344532 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:37.933666 0.193117 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 585 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.127154 0.040039 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.167604 0.073546 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.241618 0.393884 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.635906 0.166331 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.802678 0.176611 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:38.979700 0.903283 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:39.883331 0.158891 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:40.042553 0.092875 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:40.135796 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/18 23:51:55.645353 0.034231 tcp 10.0.2.105 56533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:55.679831 0.034495 tcp 10.0.2.105 56534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:55.714626 0.141783 tcp 10.0.2.105 56535 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/18 23:51:55.857055 0.157652 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:56.015113 0.528986 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:56.544529 0.146444 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:56.691391 0.049777 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:56.741529 0.198434 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:56.940334 0.157237 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:57.308169 0.111131 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:57.419745 0.193211 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:51:57.613324 0.190587 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/18 23:53:03.624931 3.001236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/18 23:53:10.631732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:53:18.643526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:53:34.646620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/18 23:54:06.652785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:00:10.658863 3.001134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:00:17.665805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:00:23.253969 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 00:00:23.254156 2.241822 tcp 10.0.2.105 56536 -> 200.84.7.244 8038 FSPA* 0 0 15 1800 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:00:25.677732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:00:41.680423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:01:13.686140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:07:17.692559 3.443995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:07:25.109265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:07:33.039860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:07:48.910362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:08:20.730304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:14:24.738495 2.999475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:14:31.744096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:14:39.745136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:14:55.748176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:15:27.764254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:21:31.770107 3.001693 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:21:38.782814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:21:46.779366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:22:02.782142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:22:21.139088 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 00:22:21.139242 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 00:22:34.788639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:22:38.747610 0.042579 tcp 10.0.2.105 56537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:22:38.790443 0.065254 tcp 10.0.2.105 56538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:22:38.856024 0.134449 tcp 10.0.2.105 56539 -> 195.113.214.249 443 SRPA* 0 0 27 14804 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:22:38.991080 0.061314 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:39.052848 0.561879 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:39.615102 0.057480 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:39.673009 0.156149 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:39.918877 0.084202 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.003467 0.216104 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.219945 0.205456 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.425812 0.083600 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.509946 0.190042 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.700396 0.127635 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.828566 0.057875 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.886855 0.053282 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:40.940523 0.326875 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:41.267818 0.239746 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:41.507969 0.331971 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:41.840382 0.344668 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.185507 0.171986 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.357895 0.245040 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.603311 0.036418 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.640113 0.188062 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.828595 0.068735 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:42.897723 0.176123 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:43.074308 0.390713 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:43.465456 0.166491 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:43.632335 0.364583 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:43.997313 0.152669 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:44.150361 0.090135 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:44.240895 0.157380 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:44.398768 0.534713 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.178505 0.206141 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.385018 0.146712 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.532144 0.057089 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.589608 0.187822 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.777776 0.191134 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:45.969247 0.158296 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:22:46.127917 0.111537 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:28:38.793950 3.002021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:28:46.106880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:28:54.036673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:29:09.886466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:29:41.832612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:30:25.495613 0.000156 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 00:30:25.495851 4.242514 tcp 10.0.2.105 56540 -> 200.84.7.244 8038 FSPA* 0 0 15 1671 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:35:45.838218 3.001853 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:35:52.845694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:36:01.884352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:36:17.705696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:36:49.563125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:42:52.893230 3.000700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:42:59.899900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:43:07.901338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:43:23.903932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:43:55.910653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:53:15.294848 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 00:53:15.294997 0.064311 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:15.359692 0.156091 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:15.516158 0.082637 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:15.599186 0.212678 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:15.812274 0.321458 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:16.303909 0.061371 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:16.365714 0.203159 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:16.569317 0.122332 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:16.692062 0.189261 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:16.881708 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 00:53:33.322503 0.032860 tcp 10.0.2.105 56541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:53:33.355692 0.034367 tcp 10.0.2.105 56542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:53:33.390374 0.136953 tcp 10.0.2.105 56543 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/19 00:53:33.527922 0.059087 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:33.587393 0.055895 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:33.643675 0.345601 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:33.989688 0.348808 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:34.338839 0.322812 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:34.662102 0.767154 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:35.429676 0.173564 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:35.603630 0.245184 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:35.849151 0.038569 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:35.888056 0.184636 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:36.073078 0.072682 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:36.146196 0.176519 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:36.323118 0.364802 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:36.688544 0.152037 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:36.840965 0.394389 udp 10.0.2.105 7010 <-> 116.89.110.83 6487 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:37.235716 0.169395 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:37.405586 0.460034 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:37.866045 0.088889 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:37.955333 0.156267 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.111965 0.196688 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.309047 0.146783 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.456151 0.048272 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.504765 0.183448 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.688577 0.214016 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:38.902951 0.163647 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:53:39.067001 0.106007 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/19 00:55:33.916895 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 00:55:40.923881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:55:48.925811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:56:04.928544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 00:56:38.284061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:00:27.817149 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 01:00:27.817347 4.837307 tcp 10.0.2.105 56544 -> 200.84.7.244 8038 FSPA* 0 0 15 1804 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:02:41.400807 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:02:48.408628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:02:56.413122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:03:12.588059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:03:44.429364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:10:12.758476 3.006345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:10:19.767728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:10:27.769376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:10:43.771972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:11:15.778436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:17:19.799680 3.201281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:17:26.974363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:17:34.917768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:17:50.816015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:18:22.822014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:23:57.543637 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 01:23:57.543739 0.122884 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:57.667032 0.083419 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:57.750850 0.211996 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:57.963261 0.061196 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.024881 0.154848 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.180380 0.320112 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.500883 0.067327 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.568686 0.189716 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.758837 0.073318 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:58.832566 0.205115 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 205 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:59.038059 0.057183 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:59.095734 0.054267 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:59.150464 0.352409 udp 10.0.2.105 7010 <-> 111.253.61.85 5951 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:59.503341 0.345649 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:23:59.849414 0.327017 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:00.176813 0.466617 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:00.643774 0.171661 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:00.815874 0.243568 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.059861 0.041907 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.102267 0.190378 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.293062 0.071344 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.364761 0.172987 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.538134 0.360319 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:01.899256 0.153294 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:02.052926 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:24:20.077971 0.032594 tcp 10.0.2.105 56545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:24:20.110840 0.034489 tcp 10.0.2.105 56546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:24:20.145685 0.151715 tcp 10.0.2.105 56547 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:24:20.297885 0.168973 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:20.467248 0.654993 udp 10.0.2.105 7010 <-> 72.251.8.162 2321 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.122628 0.070209 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.193219 0.156610 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.350202 0.198597 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.549184 0.147362 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.696932 0.191689 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:21.889021 0.159392 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:22.048888 0.268883 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:22.318149 0.185826 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:22.504522 0.103434 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:24:26.827951 3.135474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:24:34.133075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:24:42.067662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:24:57.937660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:25:29.866145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:30:32.661915 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 01:30:32.662017 1.709351 tcp 10.0.2.105 56548 -> 200.84.7.244 8038 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:31:33.872622 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:31:41.090685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:31:49.018593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:32:04.893618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:32:36.899819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:38:40.906020 3.001718 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:38:47.912946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:38:55.914398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:39:11.918144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:39:43.923904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:45:47.930171 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 01:45:54.937620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:46:04.664883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:46:20.491115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:46:52.131988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:54:35.175914 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 01:54:35.176013 0.000000 udp 10.0.2.105 7010 -> 116.89.110.83 6487 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:54:51.410619 0.055174 tcp 10.0.2.105 56549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:54:51.466143 0.034546 tcp 10.0.2.105 56550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:54:51.501082 0.215511 tcp 10.0.2.105 56551 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:54:51.717487 0.222335 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:51.940439 0.061085 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.002012 0.158492 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.160887 0.132228 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.293643 0.084204 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.378230 0.060859 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.439461 0.186671 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.787386 0.085988 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:54:52.873765 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:55:11.117684 0.035902 tcp 10.0.2.105 56552 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:11.153879 0.032266 tcp 10.0.2.105 56553 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:11.186445 0.154783 tcp 10.0.2.105 56554 -> 195.113.214.249 443 SRPA* 0 0 44 25834 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:11.341489 0.060223 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:11.402148 0.329712 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:11.732274 0.043421 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:11.776077 0.000000 udp 10.0.2.105 7010 -> 111.253.61.85 5951 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:55:27.681362 0.055191 tcp 10.0.2.105 56555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:27.736861 0.034596 tcp 10.0.2.105 56556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:27.771321 0.131755 tcp 10.0.2.105 56557 -> 195.113.214.249 443 SRPA* 0 0 28 12096 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:27.903379 0.327044 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:28.230884 0.345189 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:28.576603 0.200483 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:28.777467 0.045274 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:28.823097 0.187119 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:29.010636 0.000000 udp 10.0.2.105 7010 -> 81.136.174.173 2006 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:55:47.810566 0.032706 tcp 10.0.2.105 56558 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:47.843617 0.036599 tcp 10.0.2.105 56559 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:47.880527 0.131661 tcp 10.0.2.105 56560 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:55:48.010984 0.234476 udp 10.0.2.105 7010 <-> 161.200.34.45 2983 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:48.245916 0.172176 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:48.418488 0.175757 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:48.594601 0.359003 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:48.954042 0.152743 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:49.107167 0.185121 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:49.292675 0.158961 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:55:49.452013 0.000000 udp 10.0.2.105 7010 -> 72.251.8.162 2321 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 01:56:07.078341 0.032646 tcp 10.0.2.105 56561 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:56:07.111298 0.055330 tcp 10.0.2.105 56562 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:56:07.166648 0.132985 tcp 10.0.2.105 56563 -> 195.113.214.249 443 SRPA* 0 0 46 40896 flow=From-Botnet-V2-TCP-Established 1970/02/19 01:56:07.300731 0.070601 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:07.371750 0.199694 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:07.571829 0.147948 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:07.720423 0.191192 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:07.911976 0.157785 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:08.070214 0.113651 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:08.184327 0.049676 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:56:08.234472 0.198282 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/19 01:57:02.971289 3.000375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 01:57:09.978118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:57:17.979538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:57:33.981964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 01:58:06.425911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:00:34.372487 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 02:00:34.372587 2.709326 tcp 10.0.2.105 56564 -> 200.84.7.244 8038 FSPA* 0 0 15 1702 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:04:10.004271 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:04:17.012298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:04:25.013835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:04:41.016925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:05:13.101763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:11:17.038270 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:11:24.045982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:11:32.047362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:11:48.050531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:12:20.056177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:18:24.063512 3.000520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:18:31.089803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:18:39.091329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:18:55.094638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:19:27.100770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:25:31.108885 2.999024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:25:38.114222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:25:46.115682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:26:02.118437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:26:34.123912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:26:39.729458 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 02:26:39.729650 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 101 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:26:54.876011 0.245248 tcp 10.0.2.105 56565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:26:55.121574 0.034210 tcp 10.0.2.105 56566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:26:55.156096 0.148606 tcp 10.0.2.105 56567 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:26:55.305425 0.000000 udp 10.0.2.105 7010 -> 111.253.61.85 5951 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:27:14.050848 0.032928 tcp 10.0.2.105 56568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:14.083721 0.243133 tcp 10.0.2.105 56569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:14.327169 0.129482 tcp 10.0.2.105 56570 -> 195.113.214.249 443 SRPA* 0 0 43 36980 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:14.457374 0.000000 udp 10.0.2.105 7010 -> 81.136.174.173 2006 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:27:31.125896 0.032781 tcp 10.0.2.105 56571 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:31.158523 0.036291 tcp 10.0.2.105 56572 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:31.195190 0.169857 tcp 10.0.2.105 56573 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:31.365594 0.000000 udp 10.0.2.105 7010 -> 72.251.8.162 2321 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:27:47.378472 0.059505 tcp 10.0.2.105 56574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:47.438292 0.033634 tcp 10.0.2.105 56575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:47.471860 0.126784 tcp 10.0.2.105 56576 -> 195.113.214.249 443 SRPA* 0 0 26 12740 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:27:47.599317 0.246141 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:47.845836 0.054185 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:47.900439 0.700196 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:48.600995 0.154188 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:48.755586 0.084112 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:49.773519 0.144527 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:49.918413 0.188924 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:50.107716 0.090515 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:50.198715 0.057910 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:50.257016 0.669220 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:50.926610 0.049540 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:27:50.976534 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 9246 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:28:09.060995 0.031570 tcp 10.0.2.105 56577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:09.092960 0.033982 tcp 10.0.2.105 56578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:09.127282 0.134450 tcp 10.0.2.105 56579 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:09.262418 0.329566 udp 10.0.2.105 7010 <-> 218.164.140.53 7010 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:09.592554 0.190025 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:09.782945 0.127490 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:09.910819 0.036790 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:09.947987 0.000000 udp 10.0.2.105 7010 -> 161.200.34.45 2983 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:28:27.031200 0.032618 tcp 10.0.2.105 56580 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:27.064166 0.060884 tcp 10.0.2.105 56581 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:27.125374 0.141866 tcp 10.0.2.105 56582 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:28:27.267977 0.171401 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:27.439835 0.177569 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:27.617778 0.151094 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:27.769286 0.517507 udp 10.0.2.105 7010 <-> 112.210.74.220 5414 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:28.287189 0.168169 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:28.455747 0.156210 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:28.630293 0.068990 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:28.699733 0.201414 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:28.901612 0.148500 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:29.050536 0.196538 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:29.247505 0.176095 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:29.423983 0.217741 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:29.642102 0.158002 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:28:29.800662 0.104375 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:30:37.084053 1.013928 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 02:30:38.098119 1.565580 tcp 10.0.2.105 56583 -> 200.84.7.244 8038 FSPA* 0 0 15 1707 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:32:38.140561 3.001678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 02:32:45.147900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:32:53.149307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:33:09.152432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:33:41.475062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:39:45.184820 3.000924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:39:52.192017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:40:00.193233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:40:16.196279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:40:48.202434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:46:52.218283 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:46:59.225913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:47:07.227383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:47:23.230594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:47:56.006966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:53:59.258594 2.994937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 02:54:06.262493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:54:14.262803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:54:30.266676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:55:02.270761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 02:58:55.816672 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 02:58:55.816843 0.000000 udp 10.0.2.105 7010 -> 113.28.179.100 9246 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:59:12.662738 0.048216 tcp 10.0.2.105 56584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:12.711283 0.032999 tcp 10.0.2.105 56585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:12.744604 0.161233 tcp 10.0.2.105 56586 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:12.906448 0.000000 udp 10.0.2.105 7010 -> 161.200.34.45 2983 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:59:31.277848 0.062306 tcp 10.0.2.105 56587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:31.340465 0.034891 tcp 10.0.2.105 56588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:31.375644 0.152998 tcp 10.0.2.105 56589 -> 195.113.214.249 443 SRPA* 0 0 44 24336 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:31.529305 0.246272 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:31.775939 0.059984 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:31.836307 0.156805 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:31.993497 0.787405 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:32.781391 0.189859 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:32.971663 0.125328 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:33.097408 0.083670 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:33.181477 0.766131 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:33.947991 0.072167 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:34.020594 0.058137 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:34.079182 0.061885 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:34.141473 0.157018 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:34.298938 0.273763 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:34.573099 0.000000 udp 10.0.2.105 7010 -> 218.164.140.53 7010 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 02:59:50.755827 0.669265 tcp 10.0.2.105 56590 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:51.425384 0.054995 tcp 10.0.2.105 56591 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:51.480758 0.130443 tcp 10.0.2.105 56592 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 02:59:51.611732 0.039587 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:51.651754 0.172003 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:51.824154 0.175410 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/19 02:59:51.999940 0.000000 udp 10.0.2.105 7010 -> 112.210.74.220 5414 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 03:00:10.435080 0.058463 tcp 10.0.2.105 56593 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:10.493883 0.034469 tcp 10.0.2.105 56594 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:10.528627 0.176700 tcp 10.0.2.105 56595 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:10.705899 0.170091 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:10.876558 0.159585 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.036635 0.079349 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.116523 0.154747 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.271730 0.148429 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.420621 0.192008 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.613013 0.053653 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.667092 0.218902 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:11.886448 0.198504 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:12.085405 0.158125 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:12.243924 0.126775 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:00:38.753001 1.234458 tcp 10.0.2.105 56596 -> 200.84.7.244 8038 FSPA* 0 0 11 1106 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:39.352984 0.034583 tcp 10.0.2.105 56597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:39.387871 0.036600 tcp 10.0.2.105 56598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:39.424771 0.133841 tcp 10.0.2.105 56599 -> 195.113.214.249 443 SRPA* 0 0 41 36076 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:39.987719 2.976304 tcp 10.0.2.105 56600 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:00:48.948977 0.000000 tcp 10.0.2.105 56600 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:00:54.938045 0.037515 tcp 10.0.2.105 56601 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:54.975827 0.035029 tcp 10.0.2.105 56602 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:55.011158 0.136288 tcp 10.0.2.105 56603 -> 195.113.214.249 443 SRPA* 0 0 25 10516 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:00:55.419698 3.002470 tcp 10.0.2.105 56604 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:04.421019 0.000000 tcp 10.0.2.105 56604 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:06.276081 3.002008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 03:01:10.420554 0.032168 tcp 10.0.2.105 56605 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:10.453038 0.034825 tcp 10.0.2.105 56606 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:10.488164 0.148672 tcp 10.0.2.105 56607 -> 195.113.214.249 443 SRPA* 0 0 48 43924 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:10.749564 0.551384 tcp 10.0.2.105 56608 -> 46.48.223.67 15494 SPA_* 0 0 9 998 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:13.283846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:01:16.031459 0.527749 tcp 10.0.2.105 56608 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:16.032277 0.035702 tcp 10.0.2.105 56609 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:16.068289 0.034669 tcp 10.0.2.105 56610 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:16.103270 0.149829 tcp 10.0.2.105 56611 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:16.559468 3.007123 tcp 10.0.2.105 56612 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:21.287217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:01:25.571479 0.000000 tcp 10.0.2.105 56612 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:31.560517 0.031920 tcp 10.0.2.105 56613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:31.592600 0.054175 tcp 10.0.2.105 56614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:31.647068 0.149341 tcp 10.0.2.105 56615 -> 195.113.214.249 443 SRPA* 0 0 41 22696 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:32.128965 0.460407 tcp 10.0.2.105 56616 -> 200.84.7.244 8038 FSPA* 0 0 13 1214 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:01:32.589166 2.996670 tcp 10.0.2.105 56617 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:37.289610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:01:41.584442 0.000000 tcp 10.0.2.105 56617 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:47.583213 3.004306 tcp 10.0.2.105 56618 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:01:56.586063 0.000000 tcp 10.0.2.105 56618 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:02:01.343036 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:02:02.584648 0.378139 tcp 10.0.2.105 56619 -> 46.48.223.67 15494 SPA_* 0 0 9 998 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:02:09.294413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:02:12.210421 0.000793 tcp 10.0.2.105 56619 -> 46.48.223.67 15494 FA_F* 0 0 6 844 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:02:12.211015 2.963992 tcp 10.0.2.105 56620 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:02:21.097268 0.000000 tcp 10.0.2.105 56620 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:07:24.307827 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:07:24.307933 3.003604 tcp 10.0.2.105 56621 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:07:33.310810 0.000000 tcp 10.0.2.105 56621 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:07:39.310413 0.032232 tcp 10.0.2.105 56622 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:39.342989 0.085098 tcp 10.0.2.105 56623 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:39.428473 0.135515 tcp 10.0.2.105 56624 -> 195.113.214.249 443 SRPA* 0 0 23 12462 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:39.707999 2.995589 tcp 10.0.2.105 56625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:07:48.895143 0.000000 tcp 10.0.2.105 56625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:07:54.833175 0.128320 tcp 10.0.2.105 56626 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:54.961787 0.033249 tcp 10.0.2.105 56627 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:54.995350 0.583764 tcp 10.0.2.105 56628 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:07:55.856567 0.405579 tcp 10.0.2.105 56629 -> 46.48.223.67 15494 SPA_* 0 0 9 1147 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:11.461024 2.136391 tcp 10.0.2.105 56629 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:11.461824 0.054274 tcp 10.0.2.105 56630 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:11.516413 0.055183 tcp 10.0.2.105 56631 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:11.571898 0.146646 tcp 10.0.2.105 56632 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:13.310483 3.001597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 03:08:13.597605 3.004918 tcp 10.0.2.105 56633 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:08:20.318041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:08:22.601245 0.000000 tcp 10.0.2.105 56633 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:08:28.422391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:08:28.692319 0.039502 tcp 10.0.2.105 56634 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:28.732107 0.035795 tcp 10.0.2.105 56635 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:28.768165 0.154739 tcp 10.0.2.105 56636 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:28.936863 1.717424 tcp 10.0.2.105 56637 -> 200.84.7.244 8038 FSPA* 0 0 15 1708 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:08:44.322312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:09:16.838710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:15:20.344617 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 03:15:27.351719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:15:35.352881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:15:51.356176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:16:23.362604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:22:31.374176 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 03:22:38.381850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:22:46.382729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:23:03.942296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:23:35.569337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:29:38.408015 3.260396 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 03:29:45.635454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:29:53.566469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:30:09.429886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:30:34.656559 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:30:34.656753 0.000000 udp 10.0.2.105 7010 -> 218.164.140.53 7010 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 03:30:41.436939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:30:53.034554 0.039793 tcp 10.0.2.105 56638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:30:53.074680 0.038626 tcp 10.0.2.105 56639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:30:53.113583 0.144992 tcp 10.0.2.105 56640 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:30:53.259265 0.000000 udp 10.0.2.105 7010 -> 112.210.74.220 5414 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 03:31:11.480058 0.031858 tcp 10.0.2.105 56641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:31:11.512564 0.033705 tcp 10.0.2.105 56642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:31:11.546596 0.161968 tcp 10.0.2.105 56643 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:31:11.709077 0.268708 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:11.956685 0.063297 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:12.093923 0.180973 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:12.659898 0.178657 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:12.780668 0.093994 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:13.464804 0.454426 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:13.900061 0.228797 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:14.150808 0.227483 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:14.711170 0.059083 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2614 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:14.768706 0.514162 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:15.253086 0.121557 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:15.543041 0.093306 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:15.599005 0.215967 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:16.151111 0.038630 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:16.266876 0.182849 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:16.444717 0.178155 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:17.608958 0.173478 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:17.779479 0.186816 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:17.935962 0.087500 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 1995 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:18.224969 0.199929 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:18.418565 0.166720 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:18.567217 0.220094 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 5 1993 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:18.824316 0.204655 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:19.314229 0.211953 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:19.507549 0.075977 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:20.442864 0.180876 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:31:20.600761 0.125909 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 03:36:45.441997 3.100663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 03:36:52.514589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:37:00.463092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:37:16.463933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:37:48.470044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:38:30.571406 1.163591 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:38:31.735106 0.214524 tcp 10.0.2.105 56644 -> 200.84.7.244 8038 SPA_* 0 0 9 1099 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:38:52.163303 0.507274 tcp 10.0.2.105 56644 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:38:52.165152 0.034013 tcp 10.0.2.105 56645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:38:52.199509 0.041408 tcp 10.0.2.105 56646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:38:52.241219 0.125674 tcp 10.0.2.105 56647 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:38:52.670817 2.954683 tcp 10.0.2.105 56648 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:01.561241 0.000000 tcp 10.0.2.105 56648 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:07.492177 0.031275 tcp 10.0.2.105 56649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:07.523740 0.033225 tcp 10.0.2.105 56650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:07.557268 0.136346 tcp 10.0.2.105 56651 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:08.623954 4.510211 tcp 10.0.2.105 56652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:19.066708 0.000000 tcp 10.0.2.105 56652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:24.999689 0.399635 tcp 10.0.2.105 56653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:25.399659 0.038384 tcp 10.0.2.105 56654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:25.438388 0.126356 tcp 10.0.2.105 56655 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:25.577730 0.409224 tcp 10.0.2.105 56656 -> 46.48.223.67 15494 SPA_* 0 0 9 1099 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:35.001109 0.376598 tcp 10.0.2.105 56656 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:35.001875 0.035437 tcp 10.0.2.105 56657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:35.037589 0.033631 tcp 10.0.2.105 56658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:35.071524 0.228877 tcp 10.0.2.105 56659 -> 195.113.214.249 443 FSRP* 0 0 28 9296 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:35.378043 2.955402 tcp 10.0.2.105 56660 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:44.262728 0.000000 tcp 10.0.2.105 56660 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:39:51.046034 0.031891 tcp 10.0.2.105 56661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:51.078181 0.032519 tcp 10.0.2.105 56662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:51.111066 0.137897 tcp 10.0.2.105 56663 -> 195.113.214.249 443 SRPA* 0 0 41 21476 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:51.302094 0.428505 tcp 10.0.2.105 56664 -> 200.84.7.244 8038 FSPA* 0 0 13 1315 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:39:51.730845 2.963103 tcp 10.0.2.105 56665 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:40:00.625442 0.000000 tcp 10.0.2.105 56665 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:40:06.560367 2.969607 tcp 10.0.2.105 56666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:40:15.458371 0.000000 tcp 10.0.2.105 56666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:40:20.147479 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:40:21.381789 3.265802 tcp 10.0.2.105 56667 -> 46.48.223.67 15494 FSPA* 0 0 12 1521 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:40:24.647804 2.959946 tcp 10.0.2.105 56668 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:40:29.781429 0.000141 tcp 10.0.2.105 56667 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:40:33.533404 0.000000 tcp 10.0.2.105 56668 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:43:52.476153 3.001713 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 03:43:59.483607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:44:07.485123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:44:23.488091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:44:55.852455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:45:37.394619 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:45:37.394802 3.003746 tcp 10.0.2.105 56669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:45:46.397235 0.000000 tcp 10.0.2.105 56669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:45:52.398421 0.033086 tcp 10.0.2.105 56670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:45:52.431808 0.034708 tcp 10.0.2.105 56671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:45:52.466880 0.137934 tcp 10.0.2.105 56672 -> 195.113.214.249 443 SRPA* 0 0 24 10294 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:45:52.835881 3.004816 tcp 10.0.2.105 56673 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:01.839457 0.000000 tcp 10.0.2.105 56673 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:07.828760 0.037890 tcp 10.0.2.105 56674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:07.866980 0.034723 tcp 10.0.2.105 56675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:07.902014 0.144375 tcp 10.0.2.105 56676 -> 195.113.214.249 443 SRPA* 0 0 46 24556 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:08.844971 2.651488 tcp 10.0.2.105 56677 -> 46.48.223.67 15494 SPA_* 0 0 9 996 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:23.924358 0.240189 tcp 10.0.2.105 56677 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:23.925245 0.031442 tcp 10.0.2.105 56678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:23.956998 0.037115 tcp 10.0.2.105 56679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:23.994403 0.155459 tcp 10.0.2.105 56680 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:24.164776 3.000819 tcp 10.0.2.105 56681 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:33.164108 0.000000 tcp 10.0.2.105 56681 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:39.163714 0.032401 tcp 10.0.2.105 56682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:39.196605 1.793915 tcp 10.0.2.105 56683 -> 195.113.214.249 80 FSPA* 0 0 11 3056 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:40.990782 0.140291 tcp 10.0.2.105 56684 -> 195.113.214.249 443 SRPA* 0 0 48 23792 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:41.164968 0.676484 tcp 10.0.2.105 56685 -> 200.84.7.244 8038 FSPA* 0 0 13 1212 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:41.590964 0.032764 tcp 10.0.2.105 56686 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:41.624011 0.041920 tcp 10.0.2.105 56687 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:41.665789 0.162038 tcp 10.0.2.105 56688 -> 195.113.214.249 443 SRPA* 0 0 40 19962 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:46:41.841750 2.999524 tcp 10.0.2.105 56689 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:52.262155 0.000000 tcp 10.0.2.105 56689 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:46:58.194924 2.967286 tcp 10.0.2.105 56690 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:47:07.103507 0.000000 tcp 10.0.2.105 56690 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:47:12.043573 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 03:47:13.024657 0.379996 tcp 10.0.2.105 56691 -> 46.48.223.67 15494 SPA_* 0 0 9 996 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:47:21.303706 2.294378 tcp 10.0.2.105 56691 -> 46.48.223.67 15494 FA_F* 0 0 6 844 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:47:23.598535 2.966476 tcp 10.0.2.105 56692 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:47:32.494004 0.000000 tcp 10.0.2.105 56692 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 03:47:38.420668 1.332558 tcp 10.0.2.105 56693 -> 200.84.7.244 8038 FSPA* 0 0 14 1503 flow=From-Botnet-V2-TCP-Established 1970/02/19 03:56:07.512415 3.001707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 03:56:14.520154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:56:22.521667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:56:38.524928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 03:57:10.531064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:01:28.241889 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 04:01:28.241992 0.245684 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:28.488066 0.059897 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:28.548419 0.158130 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:28.706990 0.124503 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:28.831838 0.083783 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:28.915955 0.301041 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:29.217339 0.192314 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.100862 0.355895 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.457215 0.133361 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.591180 0.057388 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.649013 0.086392 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.735750 0.051668 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.787766 0.185523 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:30.973641 0.039577 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.013560 0.179114 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.193094 0.170237 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.363780 0.072627 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.436743 0.172047 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.609164 0.166203 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.775708 0.154835 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:31.931006 0.147667 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:32.079115 0.215116 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:32.294578 0.199767 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:32.494744 0.193695 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:32.688857 0.320809 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:33.010063 0.052308 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:01:33.062854 0.160835 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:03:14.539344 2.999272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:03:21.543649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:03:29.545733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:03:46.123705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:04:17.754396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:10:32.576638 3.004016 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:10:39.590785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:10:47.585671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:11:03.598690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:11:35.604846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:17:38.877494 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 04:17:38.877701 1.703796 tcp 10.0.2.105 56694 -> 200.84.7.244 8038 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/19 04:17:39.609917 3.002605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:17:46.617856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:17:54.620547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:18:10.622789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:18:42.629264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:24:46.634220 3.262547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:24:53.865649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:25:01.798480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:25:19.715777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:25:51.405078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:31:53.698296 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:32:00.706117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:32:02.699199 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 04:32:02.699296 0.246933 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:02.946649 0.148868 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.095918 0.084500 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.180835 0.117945 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.299178 0.059562 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.359180 0.159408 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.519023 0.190247 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.772166 0.056029 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.828694 0.074888 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.903963 0.051339 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:03.955778 0.186849 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:04.143011 0.496148 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:04.639528 1.253779 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:05.893808 0.061775 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:05.956045 0.198127 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.154504 0.157295 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.312210 0.067867 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.380465 0.171211 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.552070 0.169379 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.721892 0.220593 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:06.942932 0.196988 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:07.140310 0.154543 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:07.295292 0.147190 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:07.442943 0.068297 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:07.511648 0.157433 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:07.669552 0.560083 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:08.230024 0.104148 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/19 04:32:08.707341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:32:24.720889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:32:56.726548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:39:00.737691 2.996809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:39:07.739826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:39:15.741575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:39:31.767262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:40:03.780636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:46:07.786541 3.002318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:46:14.798802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:46:22.795979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:46:38.798579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:47:10.804571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:47:40.588049 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 04:47:40.588165 1.861501 tcp 10.0.2.105 56695 -> 200.84.7.244 8038 FSPA* 0 0 15 1707 flow=From-Botnet-V2-TCP-Established 1970/02/19 04:53:14.820060 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 04:53:21.827973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:53:29.828893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:53:45.832543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 04:54:17.840470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:00:21.844903 3.001316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:00:28.851819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:00:36.853411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:00:52.855937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:01:24.862198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:02:16.417387 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 05:02:16.417488 0.084608 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:16.502459 0.245809 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:16.748764 0.115822 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:16.864968 0.067705 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:16.933101 0.055445 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:16.988988 0.156609 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:17.146019 0.186967 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 204 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:17.333381 0.058246 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:17.392027 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 05:02:35.399320 0.033506 tcp 10.0.2.105 56696 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 05:02:35.433129 0.033969 tcp 10.0.2.105 56697 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 05:02:35.467369 0.119076 tcp 10.0.2.105 56698 -> 195.113.214.249 443 SRPA* 0 0 34 25179 flow=From-Botnet-V2-TCP-Established 1970/02/19 05:02:35.587082 0.042970 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:35.630474 0.189272 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:35.820226 0.381273 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:36.201886 0.224867 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:36.427220 0.041078 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:36.468751 0.175740 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:36.644895 0.172960 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:37.215162 0.169234 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:37.384773 0.220635 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:37.605804 0.199041 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:37.805291 0.335720 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.141462 0.077396 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.219324 0.152914 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.372726 0.147607 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.520776 0.053725 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.574904 0.158053 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.733403 0.196548 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:02:38.930356 0.108343 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:07:28.868555 3.119491 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:07:35.960119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:07:46.054249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:08:05.717851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:08:37.310750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:14:37.160851 2.960293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:14:44.077336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:14:51.975687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:15:07.767001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:15:39.370987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:17:42.449394 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 05:17:42.449589 2.726191 tcp 10.0.2.105 56699 -> 200.84.7.244 8038 FSPA* 0 0 15 1642 flow=From-Botnet-V2-TCP-Established 1970/02/19 05:21:42.965855 3.002287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:21:49.973859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:21:57.975111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:22:15.215124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:22:46.843414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:28:50.010294 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:28:57.018449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:29:05.095760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:29:21.032348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:29:53.038420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:32:55.722472 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 05:32:55.722609 0.083847 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:55.806851 0.244992 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:56.052217 0.128462 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:56.181062 0.853462 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.034892 0.060227 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.095528 0.159430 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.255309 0.082764 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.338396 0.194883 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.533662 0.055293 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:57.589329 0.951021 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:58.540767 0.043555 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:58.584752 0.188235 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:58.773381 0.131507 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:58.905259 0.038756 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:58.944405 0.175571 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:59.120462 0.172981 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:59.293814 0.172262 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:59.466470 0.198578 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:59.665424 0.199630 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:32:59.865412 0.157652 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.023522 0.093270 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.117247 0.153333 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.271009 0.148436 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.419873 0.053002 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.473344 0.157464 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.631202 0.191424 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:33:00.822965 0.103060 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/19 05:35:57.044422 3.002400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:36:04.052174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:36:12.053513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:36:28.056626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:37:00.062695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:43:04.068325 3.001648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:43:11.079259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:43:19.077561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:43:36.007807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:44:07.648055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:47:44.028971 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 05:47:44.029130 1.253068 tcp 10.0.2.105 56700 -> 200.84.7.244 8038 FSPA* 0 0 14 1520 flow=From-Botnet-V2-TCP-Established 1970/02/19 05:55:44.111205 3.001661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 05:55:51.123057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:55:59.120932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:56:15.123383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 05:56:48.817167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:02:51.145346 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:02:58.152279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:03:02.179127 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 06:03:02.179212 0.131199 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:02.310875 0.105947 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:02.417214 0.246918 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:02.664519 0.790967 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:03.455872 0.059348 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:03.515582 0.159332 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:03.675328 0.055306 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:03.731021 0.083582 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:03.815075 0.189772 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:04.005256 0.669339 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:04.674980 0.048335 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:04.723710 0.190013 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:04.914190 0.559734 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:05.474348 0.038874 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:05.513618 0.176153 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:05.690182 0.173348 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:05.863897 0.170456 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.034703 0.206379 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.153663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:03:06.241444 0.197585 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.439464 0.157704 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.597594 0.072191 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.670222 0.153685 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.824378 0.157725 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:06.982495 0.195489 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:07.178367 0.103694 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:07.282457 0.148704 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:07.431540 0.052828 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:03:22.157222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:03:54.163203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:10:22.174192 3.001213 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:10:29.181020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:10:37.182927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:10:53.185808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:11:25.201881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:17:29.207500 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:17:36.215143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:17:44.216955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:17:45.288763 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 06:17:45.288856 1.474703 tcp 10.0.2.105 56701 -> 200.84.7.244 8038 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/19 06:18:00.219699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:18:32.225716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:24:36.231715 3.001589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:24:43.239085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:24:51.240531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:25:07.243539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:25:39.249557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:31:43.255808 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:31:50.263215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:31:58.264672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:32:14.267518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:32:46.273728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:33:30.637638 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 06:33:30.637729 0.231309 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:30.869468 0.110818 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:30.980664 0.095485 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:31.076578 0.563381 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:31.640338 0.059951 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:31.700693 0.157639 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:31.858722 0.059143 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:31.918261 0.084416 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:32.003060 0.191236 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:32.194671 0.819335 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.014413 0.045755 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.060549 0.186147 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.247078 0.142279 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.389725 0.039719 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.429809 0.177758 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.608002 0.173575 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.782010 0.161130 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:33.943621 0.184719 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.128757 0.200011 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.329163 0.157365 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.486898 0.082369 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.569670 0.169329 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.739362 0.104703 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.844480 0.147711 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:34.992550 0.058398 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:35.051356 0.157436 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:33:35.209201 0.192126 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/19 06:38:50.279776 3.001573 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:38:57.287293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:39:05.288953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:39:21.291648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:39:53.297601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:45:57.303748 3.001714 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:46:04.310839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:46:12.312538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:46:28.315312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:47:00.321796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:47:46.769078 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 06:47:46.769216 1.262279 tcp 10.0.2.105 56702 -> 200.84.7.244 8038 FSPA* 0 0 15 1552 flow=From-Botnet-V2-TCP-Established 1970/02/19 06:53:04.327126 3.002064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 06:53:11.334819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:53:19.336702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:53:35.339644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 06:54:07.345717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:00:11.352255 3.000753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:00:18.358823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:00:26.360374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:00:42.363847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:01:14.376100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:03:54.129872 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 07:03:54.129995 0.102635 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:54.233101 0.214357 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:54.447848 0.129386 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:54.577642 0.325491 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:54.903537 0.054019 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:54.957953 0.161016 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:55.119377 0.057837 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:55.177627 0.084064 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:55.262061 0.190230 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:55.452674 0.425150 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:55.878183 0.553038 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:56.431613 1.104936 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:57.536985 0.230223 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:57.767573 0.039211 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:57.807190 0.215187 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.022767 0.173249 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.196375 0.163597 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.360488 0.184065 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.544939 0.198714 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.744035 0.154200 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.898627 0.083663 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:58.982656 0.152967 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:59.136067 0.104431 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:59.240933 0.148263 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:59.389603 0.052796 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:59.442811 0.157626 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:03:59.600824 0.192696 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:07:18.375311 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:07:25.385690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:07:33.404405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:07:49.387641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:08:21.393299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:14:25.400506 3.000762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:14:32.410744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:14:40.408620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:14:56.411840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:15:28.417827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:17:48.038577 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 07:17:48.038679 1.367046 tcp 10.0.2.105 56703 -> 200.84.7.244 8038 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/19 07:21:32.423768 3.001300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:21:39.430874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:21:47.432717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:22:03.435143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:22:35.441604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:28:39.448650 3.000647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:28:46.454762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:28:54.456136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:29:10.459295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:29:42.465578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:34:07.907301 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 07:34:07.907451 0.111175 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:08.018997 0.105767 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:08.125165 0.214396 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:08.340013 1.382221 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:09.722633 0.059758 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:09.782820 0.157830 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:09.941010 0.059630 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.001018 0.189647 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.191074 0.082642 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.274121 0.190581 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.465166 0.453230 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.918752 0.047270 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:10.966388 0.110020 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.076811 0.042184 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.119416 0.166766 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.286574 0.233151 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.520101 0.185052 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.705572 0.171758 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:11.877689 0.199477 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.077610 0.157052 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.235084 0.072839 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.308297 0.153420 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.462157 0.267242 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.729769 0.158816 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:12.888934 0.193083 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:13.082460 0.317262 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:34:13.400098 0.052529 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/19 07:35:46.471194 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:35:53.479265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:36:01.481411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:36:17.483291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:36:49.490252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:42:53.495645 3.001672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:43:00.502787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:43:08.510293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:43:24.507389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:43:56.513529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:47:49.408927 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 07:47:49.409108 0.215316 tcp 10.0.2.105 56704 -> 200.84.7.244 8038 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/19 07:47:55.596738 0.022582 tcp 10.0.2.105 56704 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/19 07:55:35.523525 2.999013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 07:55:42.528334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:55:50.530703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:56:06.532798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 07:56:38.538883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:02:42.554590 2.992244 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:02:49.552601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:02:57.553774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:03:13.559734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:03:45.573923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:04:27.026102 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:04:27.026198 0.118224 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:27.144840 0.085393 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:27.230647 0.223462 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:27.454488 0.733334 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.188233 0.059342 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.247957 0.156889 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.405277 0.058575 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.464279 0.185857 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.650535 0.082980 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.733949 0.190465 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:28.924774 0.762906 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:29.688135 0.042187 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:29.730773 0.647762 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:30.378947 0.038906 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:30.418319 0.168110 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:30.586884 0.173273 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:30.760737 0.198484 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:30.959642 0.156453 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.116522 0.185138 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.302062 0.270329 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.572785 0.086261 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.659419 0.155211 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.814996 0.104958 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:31.920371 0.162327 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:32.083128 0.191707 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:32.275272 0.145865 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:04:32.421490 0.054494 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:10:13.573467 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:10:20.580958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:10:28.583194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:10:44.585558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:11:16.591246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:17:20.597089 3.002328 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:17:27.604885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:17:35.606075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:17:51.609433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:17:55.615283 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:17:55.615458 1.418593 tcp 10.0.2.105 56705 -> 200.84.7.244 8038 FSPA* 0 0 15 1765 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:18:23.615225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:24:27.623094 2.999589 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:24:34.629131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:24:42.631370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:24:58.633039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:25:30.643325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:31:34.647001 3.000384 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:31:41.652715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:31:49.660745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:32:05.657406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:32:37.663215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:34:53.118367 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:34:53.118534 0.147614 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:53.266568 0.093504 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:53.360447 0.059914 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:53.420740 0.230012 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:53.651147 0.753697 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:54.405215 0.157933 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:54.563564 0.076957 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:54.640916 0.331437 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:54.972789 0.084586 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:55.057779 0.193433 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:55.251609 0.622683 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:55.874671 0.050745 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:55.925820 0.693400 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:56.619605 0.041097 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:56.661129 0.220121 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:56.881654 0.174169 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.056410 0.200094 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.256883 0.157235 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.414527 0.182844 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.597916 0.246465 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.844797 0.080646 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:57.925823 0.154839 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:58.081063 0.106644 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:58.188091 0.146247 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:58.334698 0.056898 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:58.392001 0.165158 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:34:58.557560 0.195263 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/19 08:38:41.669963 3.000886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:38:48.683752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:38:56.678298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:39:12.680942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:39:44.687314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:45:48.693923 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 08:45:55.700525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:46:03.702135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:46:19.704906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:46:51.712701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:47:57.049245 0.000224 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:47:57.049572 0.672217 tcp 10.0.2.105 56706 -> 200.84.7.244 8038 FSPA* 0 0 13 1271 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:47:57.484086 0.051019 tcp 10.0.2.105 56707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:47:57.535375 0.051494 tcp 10.0.2.105 56708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:47:57.587148 0.114908 tcp 10.0.2.105 56709 -> 195.113.214.249 443 SRPA* 0 0 57 36283 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:47:57.722013 2.998487 tcp 10.0.2.105 56710 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:48:06.719261 0.000000 tcp 10.0.2.105 56710 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:48:12.708106 0.049788 tcp 10.0.2.105 56711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:12.758261 0.051822 tcp 10.0.2.105 56712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:12.810445 0.128400 tcp 10.0.2.105 56713 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:12.950572 3.002685 tcp 10.0.2.105 56714 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:48:21.951260 0.000000 tcp 10.0.2.105 56714 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:48:27.954406 0.063036 tcp 10.0.2.105 56715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:28.017741 0.052738 tcp 10.0.2.105 56716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:28.070703 0.128809 tcp 10.0.2.105 56717 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:28.218840 0.506265 tcp 10.0.2.105 56718 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:58.724187 0.050566 tcp 10.0.2.105 56719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:58.775027 0.052963 tcp 10.0.2.105 56720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:58.828453 0.207782 tcp 10.0.2.105 56721 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:59.062465 0.000086 tcp 10.0.2.105 56718 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:48:59.062782 2.995831 tcp 10.0.2.105 56722 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:49:08.060707 0.000000 tcp 10.0.2.105 56722 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:49:14.056466 0.060248 tcp 10.0.2.105 56723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:14.116980 0.051468 tcp 10.0.2.105 56724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:14.168780 0.128960 tcp 10.0.2.105 56725 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:14.308087 0.217857 tcp 10.0.2.105 56726 -> 200.84.7.244 8038 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:24.737631 0.000206 tcp 10.0.2.105 56718 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:44.519741 0.223066 tcp 10.0.2.105 56726 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:49:44.520076 2.993703 tcp 10.0.2.105 56727 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:49:53.522557 0.000000 tcp 10.0.2.105 56727 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:49:59.521452 2.995397 tcp 10.0.2.105 56728 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:50:08.514028 0.000000 tcp 10.0.2.105 56728 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:50:13.342877 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:50:14.523390 3.003590 tcp 10.0.2.105 56729 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:50:22.892554 0.002028 tcp 10.0.2.105 56729 -> 46.48.223.67 15494 PA_SA 0 0 8 993 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:50:52.888011 3.109444 tcp 10.0.2.105 56729 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:50:52.888590 3.003761 tcp 10.0.2.105 56730 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:51:01.892914 0.000000 tcp 10.0.2.105 56730 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:56:07.891539 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:56:07.891710 2.992920 tcp 10.0.2.105 56731 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:56:16.883249 0.000000 tcp 10.0.2.105 56731 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:56:22.897059 0.050333 tcp 10.0.2.105 56732 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:22.947661 0.052509 tcp 10.0.2.105 56733 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:23.000490 0.137656 tcp 10.0.2.105 56734 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:23.163341 2.994022 tcp 10.0.2.105 56735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:56:32.155700 0.000000 tcp 10.0.2.105 56735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:56:38.156494 0.050455 tcp 10.0.2.105 56736 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:38.207257 0.050921 tcp 10.0.2.105 56737 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:38.258459 0.128402 tcp 10.0.2.105 56738 -> 195.113.214.249 443 SRPA* 0 0 41 22488 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:56:38.414763 3.475840 tcp 10.0.2.105 56739 -> 46.48.223.67 15494 SPA_* 0 0 10 1054 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:03.723875 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 08:57:10.731392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:57:11.893634 0.050766 tcp 10.0.2.105 56740 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:11.944701 0.051637 tcp 10.0.2.105 56741 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:11.996637 0.140299 tcp 10.0.2.105 56742 -> 195.113.214.249 443 SRPA* 0 0 50 44032 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:12.159129 0.000150 tcp 10.0.2.105 56739 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:12.159448 2.997959 tcp 10.0.2.105 56743 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:18.732756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:57:21.156095 0.000000 tcp 10.0.2.105 56743 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:27.155393 0.050737 tcp 10.0.2.105 56744 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.205995 0.113967 tcp 10.0.2.105 56745 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.320269 0.133618 tcp 10.0.2.105 56746 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.466160 0.705419 tcp 10.0.2.105 56747 -> 200.84.7.244 8038 FSPA* 0 0 13 1208 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.893386 0.052121 tcp 10.0.2.105 56748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.945842 0.051550 tcp 10.0.2.105 56749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:27.997751 0.161604 tcp 10.0.2.105 56750 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:57:28.171791 2.999073 tcp 10.0.2.105 56751 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:34.735261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:57:37.171355 0.000000 tcp 10.0.2.105 56751 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:43.167956 3.004307 tcp 10.0.2.105 56752 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:52.170716 0.000000 tcp 10.0.2.105 56752 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:57:56.837579 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 08:57:58.169560 3.489321 tcp 10.0.2.105 56753 -> 46.48.223.67 15494 SPA_* 0 0 10 1054 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:58:06.741630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 08:58:31.657552 0.465370 tcp 10.0.2.105 56753 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:58:31.657917 3.003874 tcp 10.0.2.105 56754 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:58:40.660470 0.000000 tcp 10.0.2.105 56754 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 08:58:46.659257 0.437197 tcp 10.0.2.105 56755 -> 200.84.7.244 8038 FSPA* 0 0 13 1208 flow=From-Botnet-V2-TCP-Established 1970/02/19 08:59:12.155648 0.000000 tcp 10.0.2.105 56739 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 08:59:16.842596 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:03:47.091737 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:03:47.091825 0.753492 tcp 10.0.2.105 56756 -> 200.84.7.244 8038 FSPA* 0 0 13 1346 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:03:47.523488 0.051641 tcp 10.0.2.105 56757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:03:47.575408 0.050828 tcp 10.0.2.105 56758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:03:47.626558 0.148149 tcp 10.0.2.105 56759 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:03:47.845569 0.464259 tcp 10.0.2.105 56760 -> 200.84.7.244 8038 FSPA* 0 0 13 1346 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:04:10.747596 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:04:17.755042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:04:25.756804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:04:41.759701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:05:07.506588 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:05:07.506742 0.180916 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:07.621733 0.248105 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:07.848433 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 09:05:13.765740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:05:23.180335 0.032843 tcp 10.0.2.105 56761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:05:23.213531 0.040404 tcp 10.0.2.105 56762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:05:23.254240 0.146185 tcp 10.0.2.105 56763 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:05:23.400972 0.063624 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:23.462764 0.092217 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:23.532568 0.182068 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:23.737552 0.059694 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:23.795283 0.221081 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:23.985604 0.101424 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:24.164187 0.230692 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:24.411910 0.353044 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:24.737124 0.081551 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:24.783327 0.430650 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:25.052747 0.045095 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:25.092301 0.173633 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:25.262601 0.176996 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:25.435965 0.201081 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:25.654618 1.345768 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:26.971365 0.195213 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.163345 0.183835 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.342778 0.100613 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.444762 0.163204 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.600527 0.126136 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.707326 0.183885 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:27.869884 0.246774 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:28.096962 0.168481 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:05:28.246628 0.078892 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:08:48.304533 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:08:48.304647 3.003941 tcp 10.0.2.105 56764 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:08:57.307287 0.000000 tcp 10.0.2.105 56764 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:03.307428 0.157071 tcp 10.0.2.105 56765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:03.464819 0.034684 tcp 10.0.2.105 56766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:03.499849 0.129996 tcp 10.0.2.105 56767 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:03.639888 3.001073 tcp 10.0.2.105 56768 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:12.639100 0.000000 tcp 10.0.2.105 56768 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:18.643150 0.032011 tcp 10.0.2.105 56769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:18.675522 0.035056 tcp 10.0.2.105 56770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:18.710854 0.134156 tcp 10.0.2.105 56771 -> 195.113.214.249 443 SRPA* 0 0 26 14844 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:18.862660 2.999873 tcp 10.0.2.105 56772 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:27.861077 0.000000 tcp 10.0.2.105 56772 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:33.860306 0.033678 tcp 10.0.2.105 56773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:33.894240 0.035791 tcp 10.0.2.105 56774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:33.930318 0.127044 tcp 10.0.2.105 56775 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:34.068823 2.995148 tcp 10.0.2.105 56776 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:43.075277 0.000000 tcp 10.0.2.105 56776 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:49.062222 0.032064 tcp 10.0.2.105 56777 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.094629 0.037019 tcp 10.0.2.105 56778 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.131910 0.137035 tcp 10.0.2.105 56779 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.320527 0.655666 tcp 10.0.2.105 56780 -> 200.84.7.244 8038 FSPA* 0 0 13 1229 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.740591 0.049980 tcp 10.0.2.105 56781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.790909 0.044313 tcp 10.0.2.105 56782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.835574 0.130963 tcp 10.0.2.105 56783 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:09:49.976442 3.000890 tcp 10.0.2.105 56784 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:09:58.975759 0.000000 tcp 10.0.2.105 56784 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:04.974051 3.004667 tcp 10.0.2.105 56785 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:13.982148 0.000000 tcp 10.0.2.105 56785 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:18.844411 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:10:19.977066 3.003384 tcp 10.0.2.105 56786 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:28.979024 0.000000 tcp 10.0.2.105 56786 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:34.977677 3.003951 tcp 10.0.2.105 56787 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:42.839062 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:10:43.980388 0.000000 tcp 10.0.2.105 56787 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:10:49.979276 0.434669 tcp 10.0.2.105 56788 -> 200.84.7.244 8038 FSPA* 0 0 13 1229 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:11:17.771706 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:11:24.779472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:11:32.780838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:11:48.783147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:12:20.791205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:15:50.411775 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:15:50.411965 2.993676 tcp 10.0.2.105 56789 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:15:59.403871 0.000000 tcp 10.0.2.105 56789 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:05.414743 0.033917 tcp 10.0.2.105 56790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:05.448978 0.034258 tcp 10.0.2.105 56791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:05.483582 0.133244 tcp 10.0.2.105 56792 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:05.630934 2.996327 tcp 10.0.2.105 56793 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:14.625876 0.000000 tcp 10.0.2.105 56793 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:20.625158 0.032542 tcp 10.0.2.105 56794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:20.657975 0.034784 tcp 10.0.2.105 56795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:20.693025 0.148637 tcp 10.0.2.105 56796 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:20.856057 3.003136 tcp 10.0.2.105 56797 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:28.282440 2.767580 tcp 10.0.2.105 56797 -> 46.48.223.67 15494 FPA_* 0 0 12 1161 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:30.813242 0.048158 tcp 10.0.2.105 56798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:30.861735 0.034160 tcp 10.0.2.105 56799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:30.896187 0.143725 tcp 10.0.2.105 56800 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:31.050269 2.993209 tcp 10.0.2.105 56801 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:40.052481 0.000000 tcp 10.0.2.105 56801 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:46.051695 0.130915 tcp 10.0.2.105 56802 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:46.182959 0.034409 tcp 10.0.2.105 56803 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:46.217624 0.143531 tcp 10.0.2.105 56804 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:16:46.380184 2.995876 tcp 10.0.2.105 56805 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:16:55.374494 0.000000 tcp 10.0.2.105 56805 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:17:01.373422 3.003937 tcp 10.0.2.105 56806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:17:10.375827 0.000000 tcp 10.0.2.105 56806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:17:15.343043 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:17:16.375149 3.509738 tcp 10.0.2.105 56807 -> 46.48.223.67 15494 SPA_* 0 0 10 1069 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:17:49.886149 0.000099 tcp 10.0.2.105 56807 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:17:49.886478 3.000733 tcp 10.0.2.105 56808 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:17:58.885462 0.000000 tcp 10.0.2.105 56808 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:18:24.796472 3.001295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:18:31.802789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:18:39.804652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:18:55.811750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:19:27.813666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:19:49.885405 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:19:49.885495 0.000000 tcp 10.0.2.105 56807 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 09:23:04.886594 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:23:04.886709 3.003093 tcp 10.0.2.105 56809 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:13.888726 0.000000 tcp 10.0.2.105 56809 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:19.889142 0.032685 tcp 10.0.2.105 56810 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:19.922109 0.034325 tcp 10.0.2.105 56811 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:19.956728 0.135783 tcp 10.0.2.105 56812 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:20.108899 3.002790 tcp 10.0.2.105 56813 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:29.110471 0.000000 tcp 10.0.2.105 56813 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:35.109772 0.040348 tcp 10.0.2.105 56814 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:35.150456 0.036018 tcp 10.0.2.105 56815 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:35.186762 0.135532 tcp 10.0.2.105 56816 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:35.332408 2.991366 tcp 10.0.2.105 56817 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:44.336834 0.000000 tcp 10.0.2.105 56817 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:50.331747 0.136447 tcp 10.0.2.105 56818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:50.468484 0.033116 tcp 10.0.2.105 56819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:50.501579 0.132897 tcp 10.0.2.105 56820 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:23:50.644713 3.001189 tcp 10.0.2.105 56821 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:23:59.644891 0.000000 tcp 10.0.2.105 56821 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:05.649778 0.037830 tcp 10.0.2.105 56822 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:24:05.687868 0.035678 tcp 10.0.2.105 56823 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:24:05.723768 0.151448 tcp 10.0.2.105 56824 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:24:05.886243 2.992580 tcp 10.0.2.105 56825 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:14.876319 0.000000 tcp 10.0.2.105 56825 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:20.874840 3.012861 tcp 10.0.2.105 56826 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:29.877864 0.000000 tcp 10.0.2.105 56826 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:34.853155 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:24:35.889589 2.992927 tcp 10.0.2.105 56827 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:44.879882 0.000000 tcp 10.0.2.105 56827 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:50.878092 3.004678 tcp 10.0.2.105 56828 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:24:58.839549 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:24:59.880910 0.000000 tcp 10.0.2.105 56828 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:25:31.819977 3.001084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:25:38.827238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:25:46.828530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:26:02.836846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:26:34.837707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:30:05.881401 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:30:05.881487 2.994252 tcp 10.0.2.105 56829 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:30:14.880602 0.000000 tcp 10.0.2.105 56829 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:30:20.884513 0.032321 tcp 10.0.2.105 56830 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:20.917164 0.034507 tcp 10.0.2.105 56831 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:20.952010 0.139462 tcp 10.0.2.105 56832 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:21.103698 3.003736 tcp 10.0.2.105 56833 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:30:30.105693 0.000000 tcp 10.0.2.105 56833 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:30:36.105241 0.048816 tcp 10.0.2.105 56834 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:36.154340 0.033916 tcp 10.0.2.105 56835 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:36.188543 0.139356 tcp 10.0.2.105 56836 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:30:36.339235 0.463287 tcp 10.0.2.105 56837 -> 46.48.223.67 15494 SPA_* 0 0 9 1130 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:06.799377 0.037196 tcp 10.0.2.105 56838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:06.836863 0.035383 tcp 10.0.2.105 56839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:06.872579 0.143151 tcp 10.0.2.105 56840 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:07.033339 0.000095 tcp 10.0.2.105 56837 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:07.033666 2.999692 tcp 10.0.2.105 56841 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:16.041803 0.000000 tcp 10.0.2.105 56841 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:22.031570 0.207826 tcp 10.0.2.105 56842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:22.240017 0.035082 tcp 10.0.2.105 56843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:22.275396 0.503323 tcp 10.0.2.105 56844 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:31:22.793963 2.992002 tcp 10.0.2.105 56845 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:31.784396 0.000000 tcp 10.0.2.105 56845 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:37.793308 3.005127 tcp 10.0.2.105 56846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:46.795924 0.000000 tcp 10.0.2.105 56846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:31:51.342794 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:31:52.794983 1.564196 tcp 10.0.2.105 56847 -> 46.48.223.67 15494 SPA_* 0 0 9 1130 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:32:24.360315 2.430294 tcp 10.0.2.105 56847 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:32:24.360656 2.993610 tcp 10.0.2.105 56848 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:32:33.363300 0.000000 tcp 10.0.2.105 56848 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:32:38.843697 3.001376 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:32:45.851001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:32:53.853006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:33:07.048918 0.000000 tcp 10.0.2.105 56837 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 09:33:09.855391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:33:11.838198 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:33:41.861413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:35:40.923311 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:35:40.923399 0.146187 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:41.047374 0.188729 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:41.175346 0.238459 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:41.393639 0.063515 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:41.455447 0.797594 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.230552 0.184902 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.433575 0.059573 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.492061 0.224357 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.683570 0.093823 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.767432 0.232711 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:42.960439 0.359348 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.294432 0.083882 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.337994 0.212270 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.484954 0.039893 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.526172 0.172374 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.695192 0.177197 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:43.869580 0.203729 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:35:44.082209 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 09:36:01.904935 0.033341 tcp 10.0.2.105 56849 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:36:01.938471 0.035001 tcp 10.0.2.105 56850 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:36:01.973705 0.134467 tcp 10.0.2.105 56851 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:36:02.108743 0.190005 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:02.295398 0.184595 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:02.474348 0.087515 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2566 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:02.563337 0.165955 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:02.720621 0.126963 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:02.827767 0.274877 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:03.079295 0.212233 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:03.274278 0.168595 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:36:03.422179 0.073981 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/19 09:37:39.363235 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:37:39.363339 3.007326 tcp 10.0.2.105 56852 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:37:48.365889 0.000000 tcp 10.0.2.105 56852 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:37:54.365309 0.033000 tcp 10.0.2.105 56853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:37:54.398597 0.036313 tcp 10.0.2.105 56854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:37:54.435163 0.151617 tcp 10.0.2.105 56855 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:37:54.606606 3.004753 tcp 10.0.2.105 56856 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:03.608519 0.000000 tcp 10.0.2.105 56856 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:09.607402 0.033914 tcp 10.0.2.105 56857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:09.641608 0.033008 tcp 10.0.2.105 56858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:09.674905 0.134470 tcp 10.0.2.105 56859 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:09.821900 2.999327 tcp 10.0.2.105 56860 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:18.820041 0.000000 tcp 10.0.2.105 56860 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:24.818963 0.032277 tcp 10.0.2.105 56861 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:24.851507 0.033947 tcp 10.0.2.105 56862 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:24.885741 0.135864 tcp 10.0.2.105 56863 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:38:25.030884 3.002052 tcp 10.0.2.105 56864 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:34.041775 0.000000 tcp 10.0.2.105 56864 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:40.030986 2.993438 tcp 10.0.2.105 56865 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:49.033159 0.000000 tcp 10.0.2.105 56865 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:38:53.841174 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:38:55.031911 2.994163 tcp 10.0.2.105 56866 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:39:04.024490 0.000000 tcp 10.0.2.105 56866 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:39:45.867253 3.003638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:39:52.875095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:40:00.876800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:40:16.879395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:40:48.884855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:44:10.035329 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:44:10.035494 3.004211 tcp 10.0.2.105 56867 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:19.037610 0.000000 tcp 10.0.2.105 56867 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:25.037826 0.065689 tcp 10.0.2.105 56868 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:25.103823 0.035074 tcp 10.0.2.105 56869 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:25.139206 0.138998 tcp 10.0.2.105 56870 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:25.288811 3.002069 tcp 10.0.2.105 56871 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:34.291406 0.000000 tcp 10.0.2.105 56871 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:40.289127 0.285945 tcp 10.0.2.105 56872 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:40.575348 0.310453 tcp 10.0.2.105 56873 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:40.886125 0.128036 tcp 10.0.2.105 56874 -> 195.113.214.249 443 SRPA* 0 0 23 13202 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:41.032505 2.991017 tcp 10.0.2.105 56875 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:50.032515 0.000000 tcp 10.0.2.105 56875 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:44:56.041774 0.032152 tcp 10.0.2.105 56876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:56.074255 0.037282 tcp 10.0.2.105 56877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:56.111801 0.136333 tcp 10.0.2.105 56878 -> 195.113.214.249 443 SRPA* 0 0 25 14790 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:44:56.259163 2.988653 tcp 10.0.2.105 56879 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:45:05.243934 0.000000 tcp 10.0.2.105 56879 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:45:11.242861 3.004536 tcp 10.0.2.105 56880 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:45:20.245842 0.000000 tcp 10.0.2.105 56880 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:45:24.842076 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:45:26.244123 3.004588 tcp 10.0.2.105 56881 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:45:35.247416 0.000000 tcp 10.0.2.105 56881 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:46:52.895299 3.000095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:46:59.899037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:47:07.900432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:47:23.903420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:47:55.909728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:50:41.248413 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:50:41.248506 3.004855 tcp 10.0.2.105 56882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:50:50.250108 0.000000 tcp 10.0.2.105 56882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:50:56.250493 0.033354 tcp 10.0.2.105 56883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:50:56.284186 0.202020 tcp 10.0.2.105 56884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:50:56.486485 0.146050 tcp 10.0.2.105 56885 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:50:56.643598 3.000034 tcp 10.0.2.105 56886 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:05.652587 0.000000 tcp 10.0.2.105 56886 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:11.641962 0.037105 tcp 10.0.2.105 56887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:11.679398 0.035429 tcp 10.0.2.105 56888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:11.715316 0.134826 tcp 10.0.2.105 56889 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:11.869734 2.996019 tcp 10.0.2.105 56890 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:20.864168 0.000000 tcp 10.0.2.105 56890 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:26.863605 0.033027 tcp 10.0.2.105 56891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:26.896913 0.033605 tcp 10.0.2.105 56892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:26.930808 0.134682 tcp 10.0.2.105 56893 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:51:27.103108 2.994163 tcp 10.0.2.105 56894 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:36.096089 0.000000 tcp 10.0.2.105 56894 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:42.094655 3.004272 tcp 10.0.2.105 56895 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:51.097649 0.000000 tcp 10.0.2.105 56895 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:51:55.843706 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:51:57.095859 3.004809 tcp 10.0.2.105 56896 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:52:06.104451 0.000000 tcp 10.0.2.105 56896 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:53:59.916803 3.000442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 09:54:06.922889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:54:14.924195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:54:30.927477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:55:02.934313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 09:57:12.099887 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 09:57:12.099982 3.003691 tcp 10.0.2.105 56897 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:57:21.111777 0.000000 tcp 10.0.2.105 56897 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:57:27.104647 0.032479 tcp 10.0.2.105 56898 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:57:27.137389 0.037467 tcp 10.0.2.105 56899 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:57:27.175120 0.372893 tcp 10.0.2.105 56900 -> 195.113.214.249 443 SRPA* 0 0 22 12521 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:57:27.557711 3.006796 tcp 10.0.2.105 56901 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:57:33.978059 0.001896 tcp 10.0.2.105 56901 -> 46.48.223.67 15494 PA_SA 0 0 8 1020 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:03.974010 0.048074 tcp 10.0.2.105 56902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:04.022409 0.036141 tcp 10.0.2.105 56903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:04.058842 0.128471 tcp 10.0.2.105 56904 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:04.217850 0.000086 tcp 10.0.2.105 56901 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:04.218171 3.000748 tcp 10.0.2.105 56905 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:13.218984 0.000000 tcp 10.0.2.105 56905 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:19.216185 0.033659 tcp 10.0.2.105 56906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:19.250260 0.033638 tcp 10.0.2.105 56907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:19.284174 0.127494 tcp 10.0.2.105 56908 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:19.421385 2.999143 tcp 10.0.2.105 56909 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:28.418989 0.000000 tcp 10.0.2.105 56909 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:34.417646 3.006463 tcp 10.0.2.105 56910 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:40.895358 0.002054 tcp 10.0.2.105 56910 -> 46.48.223.67 15494 PA_SA 0 0 8 1020 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:47.132338 0.000340 tcp 10.0.2.105 56910 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 09:58:47.132937 2.997120 tcp 10.0.2.105 56911 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 09:58:56.129287 0.000000 tcp 10.0.2.105 56911 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:00:04.216494 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:00:04.216633 0.000000 tcp 10.0.2.105 56901 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 10:01:06.938598 3.002808 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:01:13.946680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:01:21.948558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:01:37.951181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:02:09.957332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:06:30.783558 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:06:30.783651 0.575304 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:31.328829 0.099382 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:31.407476 0.217757 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:31.576048 0.235251 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:31.791488 0.063478 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:31.853450 0.638033 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:32.145087 3.003362 tcp 10.0.2.105 56912 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:06:32.470126 0.217921 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:32.658314 0.093497 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:32.742952 0.000000 udp 10.0.2.105 7010 -> 81.157.252.245 6093 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 10:06:41.147450 0.000000 tcp 10.0.2.105 56912 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:06:47.147398 0.037754 tcp 10.0.2.105 56913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:47.185413 0.043632 tcp 10.0.2.105 56914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:47.229336 0.150251 tcp 10.0.2.105 56915 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:47.390358 3.000853 tcp 10.0.2.105 56916 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:06:48.147689 0.091854 tcp 10.0.2.105 56917 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:48.239805 0.178313 tcp 10.0.2.105 56918 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:48.418349 0.138302 tcp 10.0.2.105 56919 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:06:48.557183 0.180971 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:48.717003 0.358143 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.044919 0.226828 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.238063 0.041751 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.279397 0.172613 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.448747 0.177795 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.622834 0.202928 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2573 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.827083 0.191841 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:49.979233 0.091037 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.029663 0.191916 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.218568 0.183384 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.450437 0.097063 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.538236 0.193211 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.739564 0.127102 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:50.846624 0.182708 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:51.006911 0.214389 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:51.203930 0.169110 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:51.353773 0.072905 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:06:56.389492 0.000000 tcp 10.0.2.105 56916 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:08:13.963317 3.001698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 10:08:20.970681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:08:28.972210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:08:44.975244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:09:16.981236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:12:02.389733 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:12:02.389891 3.005162 tcp 10.0.2.105 56920 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:11.402194 0.000000 tcp 10.0.2.105 56920 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:17.392974 0.037363 tcp 10.0.2.105 56921 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:17.430662 0.166331 tcp 10.0.2.105 56922 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:17.597271 0.475877 tcp 10.0.2.105 56923 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:18.082185 2.993876 tcp 10.0.2.105 56924 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:27.074755 0.000000 tcp 10.0.2.105 56924 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:33.084032 0.033573 tcp 10.0.2.105 56925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:33.117868 0.039805 tcp 10.0.2.105 56926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:33.157916 0.193625 tcp 10.0.2.105 56927 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:12:33.370081 2.997915 tcp 10.0.2.105 56928 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:42.366523 0.000000 tcp 10.0.2.105 56928 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:48.365701 3.003958 tcp 10.0.2.105 56929 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:12:57.368112 0.000000 tcp 10.0.2.105 56929 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:13:02.345368 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:15:20.988016 3.009807 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:15:27.994452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:15:35.996149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:15:51.999521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:16:24.005432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:18:03.368765 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:18:03.368917 3.006006 tcp 10.0.2.105 56930 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:12.371866 0.000000 tcp 10.0.2.105 56930 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:18.371300 0.033244 tcp 10.0.2.105 56931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:18.404811 0.032761 tcp 10.0.2.105 56932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:18.437823 0.142316 tcp 10.0.2.105 56933 -> 195.113.214.249 443 SRPA* 0 0 33 18134 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:18.591998 2.992963 tcp 10.0.2.105 56934 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:27.596099 0.000000 tcp 10.0.2.105 56934 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:33.593827 0.033004 tcp 10.0.2.105 56935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:33.627055 0.045693 tcp 10.0.2.105 56936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:33.673041 0.157697 tcp 10.0.2.105 56937 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:18:33.841362 2.994551 tcp 10.0.2.105 56938 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:42.834840 0.000000 tcp 10.0.2.105 56938 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:48.833705 3.004058 tcp 10.0.2.105 56939 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:18:57.836691 0.000000 tcp 10.0.2.105 56939 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:19:02.342913 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:19:06.177322 0.000180 tcp 10.0.2.105 56938 -> 46.48.223.67 15494 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:22:33.019764 3.000607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:22:40.025963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:22:48.027406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:23:04.030336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:23:36.036178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:24:03.836818 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:24:03.837039 4.118089 tcp 10.0.2.105 56940 -> 46.48.223.67 15494 FSPA* 0 0 14 1322 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:07.728954 0.034996 tcp 10.0.2.105 56941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:07.764298 0.035150 tcp 10.0.2.105 56942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:07.799757 0.141262 tcp 10.0.2.105 56943 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:07.955283 3.001910 tcp 10.0.2.105 56944 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:16.955373 0.000000 tcp 10.0.2.105 56944 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:22.954325 0.254171 tcp 10.0.2.105 56945 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:23.208788 0.034131 tcp 10.0.2.105 56946 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:23.243163 0.462469 tcp 10.0.2.105 56947 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:24:23.716059 3.003501 tcp 10.0.2.105 56948 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:32.717795 0.000000 tcp 10.0.2.105 56948 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:38.716675 3.004386 tcp 10.0.2.105 56949 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:47.719462 0.000000 tcp 10.0.2.105 56949 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:24:52.336342 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:29:40.042489 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:29:47.049770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:29:53.719754 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:29:53.719850 2.993531 tcp 10.0.2.105 56950 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:29:55.053307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:30:02.722638 0.000000 tcp 10.0.2.105 56950 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:08.722830 0.053079 tcp 10.0.2.105 56951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:08.776486 0.052214 tcp 10.0.2.105 56952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:08.828999 0.144475 tcp 10.0.2.105 56953 -> 195.113.214.249 443 SRPA* 0 0 50 36732 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:08.984691 3.000399 tcp 10.0.2.105 56954 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:11.054280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:30:17.984606 0.000000 tcp 10.0.2.105 56954 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:23.983715 0.050737 tcp 10.0.2.105 56955 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:24.034805 0.051662 tcp 10.0.2.105 56956 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:24.086777 0.132557 tcp 10.0.2.105 56957 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:30:24.229331 2.998177 tcp 10.0.2.105 56958 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:33.228810 0.000000 tcp 10.0.2.105 56958 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:39.225409 3.006482 tcp 10.0.2.105 56959 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:43.074597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:30:48.236519 0.000000 tcp 10.0.2.105 56959 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:30:52.844381 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:36:47.065722 3.002803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 10:36:54.073688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:37:02.075302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:37:04.530405 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:37:04.530553 0.070652 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:04.599058 0.187881 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:04.728354 0.186826 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:04.884038 0.110606 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:04.972579 0.872460 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:05.825035 0.063479 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:05.887054 0.238096 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:06.104526 0.195762 udp 10.0.2.105 7010 <-> 67.236.69.108 7434 CON 0 0 3 981 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:06.292883 0.100317 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:06.383352 0.226458 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:06.574152 0.182889 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:06.764569 0.356249 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:07.094437 0.052600 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:07.170249 0.171986 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:07.338808 0.180857 udp 10.0.2.105 7010 <-> 99.119.39.1 1556 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:07.516958 0.203390 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:07.717830 0.496514 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:08.174150 0.280584 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:08.414452 0.197208 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:08.607591 0.224085 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:08.826834 0.084331 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:08.928725 0.170405 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:09.092651 0.125680 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:09.197725 0.166908 udp 10.0.2.105 7010 <-> 76.4.89.123 6271 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:09.235957 3.503826 tcp 10.0.2.105 56960 -> 46.48.223.67 15494 SPA_* 0 0 10 1068 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:09.345036 0.074289 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:09.399299 0.183216 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:09.560127 0.211471 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/19 10:37:18.078834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:37:42.735247 0.052095 tcp 10.0.2.105 56961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:42.787629 0.053351 tcp 10.0.2.105 56962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:42.841343 0.130779 tcp 10.0.2.105 56963 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:42.989906 0.000109 tcp 10.0.2.105 56960 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:42.990259 2.998611 tcp 10.0.2.105 56964 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:37:50.084652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:37:51.987207 0.000000 tcp 10.0.2.105 56964 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:37:57.986202 0.049847 tcp 10.0.2.105 56965 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:58.036527 0.051377 tcp 10.0.2.105 56966 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:58.088167 0.140777 tcp 10.0.2.105 56967 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:37:58.240730 0.092732 tcp 10.0.2.105 56968 -> 93.177.155.184 5413 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:19.387364 0.277566 tcp 10.0.2.105 56968 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:19.388472 0.050215 tcp 10.0.2.105 56969 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:19.438938 0.052426 tcp 10.0.2.105 56970 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:19.491763 0.131928 tcp 10.0.2.105 56971 -> 195.113.214.249 443 SRPA* 0 0 41 23378 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:19.665150 3.005996 tcp 10.0.2.105 56972 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:38:28.669768 0.000000 tcp 10.0.2.105 56972 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:38:34.658842 3.004447 tcp 10.0.2.105 56973 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:38:43.661475 0.000000 tcp 10.0.2.105 56973 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:38:44.169007 0.000181 tcp 10.0.2.105 56972 -> 46.48.223.67 15494 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:38:48.338149 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:38:49.660598 0.091758 tcp 10.0.2.105 56974 -> 93.177.155.184 5413 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:39:10.898480 0.000415 tcp 10.0.2.105 56974 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:39:42.994654 0.000000 tcp 10.0.2.105 56960 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 10:39:47.843379 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:43:54.090939 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:44:01.111351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:44:09.099242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:44:10.892284 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:44:10.892463 2.995066 tcp 10.0.2.105 56975 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:19.884689 0.000000 tcp 10.0.2.105 56975 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:25.102530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:44:25.894546 0.051073 tcp 10.0.2.105 56976 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:25.945885 0.053394 tcp 10.0.2.105 56977 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:25.999604 0.271357 tcp 10.0.2.105 56978 -> 195.113.214.249 443 SRPA* 0 0 23 13258 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:26.285431 3.003253 tcp 10.0.2.105 56979 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:35.286764 0.000000 tcp 10.0.2.105 56979 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:41.292432 0.051541 tcp 10.0.2.105 56980 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:41.344443 0.052349 tcp 10.0.2.105 56981 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:41.397149 0.129483 tcp 10.0.2.105 56982 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:41.536737 2.993521 tcp 10.0.2.105 56983 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:50.530983 0.000000 tcp 10.0.2.105 56983 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:44:56.527996 0.051821 tcp 10.0.2.105 56984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:56.580090 0.054183 tcp 10.0.2.105 56985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:56.634545 0.126331 tcp 10.0.2.105 56986 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:56.771685 0.094481 tcp 10.0.2.105 56987 -> 93.177.155.184 5413 SPA_* 0 0 9 1117 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:44:57.111124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:45:17.855690 0.257561 tcp 10.0.2.105 56987 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:45:17.856620 0.051112 tcp 10.0.2.105 56988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:45:17.908019 0.052598 tcp 10.0.2.105 56989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:45:17.960894 0.133270 tcp 10.0.2.105 56990 -> 195.113.214.249 443 SRPA* 0 0 20 11506 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:45:18.113515 3.009207 tcp 10.0.2.105 56991 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:45:27.131738 0.000000 tcp 10.0.2.105 56991 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:45:33.110749 2.995947 tcp 10.0.2.105 56992 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:45:42.113206 0.000000 tcp 10.0.2.105 56992 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:45:46.840024 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:45:48.112051 2.993914 tcp 10.0.2.105 56993 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:45:57.105685 0.000000 tcp 10.0.2.105 56993 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:46:03.113618 0.090834 tcp 10.0.2.105 56994 -> 93.177.155.184 5413 SPA_* 0 0 9 1117 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:46:24.247447 0.000306 tcp 10.0.2.105 56994 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:24.245514 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:51:24.245746 3.514050 tcp 10.0.2.105 56995 -> 46.48.223.67 15494 SPA_* 0 0 10 1239 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:57.755006 0.049832 tcp 10.0.2.105 56996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:57.805105 0.054175 tcp 10.0.2.105 56997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:57.859548 0.127199 tcp 10.0.2.105 56998 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:58.002663 0.000078 tcp 10.0.2.105 56995 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:51:58.002971 2.996249 tcp 10.0.2.105 56999 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:52:06.996982 0.000000 tcp 10.0.2.105 56999 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:52:12.996546 0.049639 tcp 10.0.2.105 57000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:13.046466 0.052573 tcp 10.0.2.105 57001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:13.099310 0.132070 tcp 10.0.2.105 57002 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:13.249621 3.004897 tcp 10.0.2.105 57003 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:52:22.248429 0.000000 tcp 10.0.2.105 57003 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:52:28.248275 0.050333 tcp 10.0.2.105 57004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:28.298889 0.052884 tcp 10.0.2.105 57005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:28.352031 0.196250 tcp 10.0.2.105 57006 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:28.558241 0.091812 tcp 10.0.2.105 57007 -> 93.177.155.184 5413 SPA_* 0 0 9 1177 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:49.706134 0.267014 tcp 10.0.2.105 57007 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:49.707020 0.049840 tcp 10.0.2.105 57008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:49.757160 0.050213 tcp 10.0.2.105 57009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:49.808625 0.144562 tcp 10.0.2.105 57010 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:52:49.973397 3.002266 tcp 10.0.2.105 57011 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:52:58.972759 0.000000 tcp 10.0.2.105 57011 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:53:04.970175 2.993561 tcp 10.0.2.105 57012 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:53:13.972736 0.000000 tcp 10.0.2.105 57012 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:53:18.839594 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:53:19.971623 1.471935 tcp 10.0.2.105 57013 -> 46.48.235.250 16076 SPA_* 0 0 9 1177 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:53:51.448858 0.000093 tcp 10.0.2.105 57013 -> 46.48.235.250 16076 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:53:51.449183 0.092402 tcp 10.0.2.105 57014 -> 93.177.155.184 5413 SPA_* 0 0 9 1177 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:53:57.995849 0.000000 tcp 10.0.2.105 56995 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 10:54:06.195241 0.000182 tcp 10.0.2.105 57013 -> 46.48.235.250 16076 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:54:12.593114 0.000368 tcp 10.0.2.105 57014 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:56:08.115828 3.001962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 10:56:15.122738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:56:23.125756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:56:39.127749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:57:11.133638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 10:59:12.589225 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 10:59:12.589428 3.486527 tcp 10.0.2.105 57015 -> 46.48.223.67 15494 SPA_* 0 0 10 1301 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:59:46.085569 0.051951 tcp 10.0.2.105 57016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:59:46.137826 0.051215 tcp 10.0.2.105 57017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:59:46.189428 0.131608 tcp 10.0.2.105 57018 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:59:46.332779 0.000109 tcp 10.0.2.105 57015 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 10:59:46.333137 3.003613 tcp 10.0.2.105 57019 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 10:59:55.331734 0.000000 tcp 10.0.2.105 57019 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:00:01.319054 0.050540 tcp 10.0.2.105 57020 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:01.369865 0.052617 tcp 10.0.2.105 57021 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:01.422805 0.130631 tcp 10.0.2.105 57022 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:01.565506 2.997703 tcp 10.0.2.105 57023 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:00:10.571843 0.000000 tcp 10.0.2.105 57023 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:00:16.562440 0.051805 tcp 10.0.2.105 57024 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:16.614110 0.055889 tcp 10.0.2.105 57025 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:16.670235 0.141012 tcp 10.0.2.105 57026 -> 195.113.214.249 443 SRPA* 0 0 21 13058 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:16.833665 0.093289 tcp 10.0.2.105 57027 -> 93.177.155.184 5413 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:37.958554 0.408287 tcp 10.0.2.105 57027 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:37.959586 0.174910 tcp 10.0.2.105 57028 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:38.134765 0.051646 tcp 10.0.2.105 57029 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:38.186700 0.154296 tcp 10.0.2.105 57030 -> 195.113.214.249 443 SRPA* 0 0 22 13110 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:00:38.367144 2.998932 tcp 10.0.2.105 57031 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:00:47.364760 3.461003 tcp 10.0.2.105 57031 -> 46.48.223.67 15494 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:01:02.253898 0.000335 tcp 10.0.2.105 57031 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:01:02.254482 3.005803 tcp 10.0.2.105 57032 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:01:11.259047 0.000000 tcp 10.0.2.105 57032 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:01:17.254462 3.001150 tcp 10.0.2.105 57033 -> 46.48.235.250 16076 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:01:26.250721 0.000000 tcp 10.0.2.105 57033 -> 46.48.235.250 16076 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:01:30.841134 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:01:32.251945 0.091521 tcp 10.0.2.105 57034 -> 93.177.155.184 5413 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:01:46.329254 0.000000 tcp 10.0.2.105 57015 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 11:01:53.302826 0.000388 tcp 10.0.2.105 57034 -> 93.177.155.184 5413 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:03:15.139650 3.001542 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:03:22.154690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:03:30.149199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:03:46.151598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:04:18.163749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:06:53.300980 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:06:53.301151 2.994054 tcp 10.0.2.105 57035 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:07:02.293319 0.000000 tcp 10.0.2.105 57035 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:07:08.303874 0.267231 tcp 10.0.2.105 57036 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:08.571325 0.051394 tcp 10.0.2.105 57037 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:08.623038 0.230460 tcp 10.0.2.105 57038 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:08.864079 3.003522 tcp 10.0.2.105 57039 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:07:17.865811 0.000000 tcp 10.0.2.105 57039 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:07:34.821056 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:07:39.337331 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:07:50.143245 0.052384 tcp 10.0.2.105 57040 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:50.195928 0.051745 tcp 10.0.2.105 57041 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:50.247921 0.135593 tcp 10.0.2.105 57042 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:07:50.384047 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:08:07.358113 0.032501 tcp 10.0.2.105 57043 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:07.390903 0.236814 tcp 10.0.2.105 57044 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:07.628016 0.136566 tcp 10.0.2.105 57045 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:07.765178 0.060388 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:07.844620 0.174586 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:07.964023 0.327289 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:08.215575 0.054711 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:08.268238 0.237785 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:08.484658 0.000000 udp 10.0.2.105 7010 -> 67.236.69.108 7434 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:08:26.959882 0.032873 tcp 10.0.2.105 57046 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:26.992995 0.033907 tcp 10.0.2.105 57047 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:27.027254 0.131305 tcp 10.0.2.105 57048 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:27.159107 0.183501 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:27.342889 0.369816 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:27.684619 0.073888 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:27.758089 0.097990 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:27.840852 0.227817 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:28.087519 0.171854 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:28.256061 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:08:46.814625 0.035103 tcp 10.0.2.105 57049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:46.849983 0.038366 tcp 10.0.2.105 57050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:46.888654 0.139395 tcp 10.0.2.105 57051 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:08:47.028621 0.203949 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:47.241042 0.191693 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:47.390977 0.096425 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:47.450119 0.198834 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:08:47.646225 0.000000 udp 10.0.2.105 7010 -> 65.114.199.182 4317 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:09:04.630458 0.034787 tcp 10.0.2.105 57052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:04.665552 0.034127 tcp 10.0.2.105 57053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:04.699945 0.137514 tcp 10.0.2.105 57054 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:04.838078 0.088476 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:09:04.938166 0.170861 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:09:05.101579 0.125636 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:09:05.208282 0.181541 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:09:05.366916 0.309365 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:09:05.584710 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:09:21.144041 0.059307 tcp 10.0.2.105 57055 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:21.203618 0.036637 tcp 10.0.2.105 57056 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:21.240624 0.132317 tcp 10.0.2.105 57057 -> 195.113.214.249 443 SRPA* 0 0 23 12538 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:09:21.373543 0.073466 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:10:34.173821 2.999261 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:10:41.178612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:10:49.180085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:11:05.183206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:11:37.191019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:12:23.866091 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:12:23.866264 3.003622 tcp 10.0.2.105 57058 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:12:32.868898 0.000000 tcp 10.0.2.105 57058 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:12:38.869657 0.032176 tcp 10.0.2.105 57059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:38.902112 0.035380 tcp 10.0.2.105 57060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:38.937766 0.178380 tcp 10.0.2.105 57061 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:39.126533 3.005959 tcp 10.0.2.105 57062 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:12:48.131894 0.000000 tcp 10.0.2.105 57062 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:12:54.120323 0.031798 tcp 10.0.2.105 57063 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:54.152438 0.050057 tcp 10.0.2.105 57064 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:54.202786 0.166089 tcp 10.0.2.105 57065 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:12:54.386583 3.000884 tcp 10.0.2.105 57066 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:13:03.393225 0.000000 tcp 10.0.2.105 57066 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:13:09.389120 0.034941 tcp 10.0.2.105 57067 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:13:09.424561 0.035184 tcp 10.0.2.105 57068 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:13:09.460066 0.143265 tcp 10.0.2.105 57069 -> 195.113.214.249 443 SRPA* 0 0 43 25818 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:13:09.615622 0.486932 tcp 10.0.2.105 57070 -> 46.48.223.67 15494 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:13:21.537881 0.000325 tcp 10.0.2.105 57070 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:13:21.538492 3.004937 tcp 10.0.2.105 57071 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:13:30.552071 0.000000 tcp 10.0.2.105 57071 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:13:36.530989 1.196240 tcp 10.0.2.105 57072 -> 46.48.220.129 23395 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:14:07.725237 0.000110 tcp 10.0.2.105 57072 -> 46.48.220.129 23395 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:15:12.244800 0.000277 tcp 10.0.2.105 57072 -> 46.48.220.129 23395 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:15:12.245009 0.000031 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:17:41.195069 3.001762 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:17:48.202418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:17:56.204004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:18:12.207433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:18:44.212987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:19:07.727522 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:19:07.727653 3.003315 tcp 10.0.2.105 57073 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:16.729592 0.000000 tcp 10.0.2.105 57073 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:22.729843 0.034190 tcp 10.0.2.105 57074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:22.764227 0.039130 tcp 10.0.2.105 57075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:22.803695 0.135431 tcp 10.0.2.105 57076 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:22.950446 3.002058 tcp 10.0.2.105 57077 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:31.961534 0.000000 tcp 10.0.2.105 57077 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:37.950729 0.037273 tcp 10.0.2.105 57078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:37.988291 0.034611 tcp 10.0.2.105 57079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:38.023180 0.141459 tcp 10.0.2.105 57080 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:38.187061 2.997812 tcp 10.0.2.105 57081 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:45.546949 0.780557 tcp 10.0.2.105 57081 -> 46.48.220.129 23395 FPA_* 0 0 12 1260 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:45.999709 0.031721 tcp 10.0.2.105 57082 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:46.031766 0.039796 tcp 10.0.2.105 57083 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:46.071886 0.245633 tcp 10.0.2.105 57084 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:19:46.327732 2.998331 tcp 10.0.2.105 57085 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:19:55.325177 0.000000 tcp 10.0.2.105 57085 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:20:01.323942 3.004093 tcp 10.0.2.105 57086 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:20:10.326695 0.000000 tcp 10.0.2.105 57086 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:20:14.842653 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:20:16.327412 3.011175 tcp 10.0.2.105 57087 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:20:25.328681 0.000000 tcp 10.0.2.105 57087 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:24:48.218739 3.001874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:24:55.226189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:25:03.227800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:25:19.231906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:25:31.328731 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:25:31.328976 3.003842 tcp 10.0.2.105 57088 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:25:40.331420 0.000000 tcp 10.0.2.105 57088 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:25:46.332889 0.044174 tcp 10.0.2.105 57089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:25:46.377334 0.033213 tcp 10.0.2.105 57090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:25:46.410891 0.131269 tcp 10.0.2.105 57091 -> 195.113.214.249 443 SRPA* 0 0 41 21368 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:25:46.553938 2.990937 tcp 10.0.2.105 57092 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:25:51.237057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:25:55.553335 0.000000 tcp 10.0.2.105 57092 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:26:01.559951 0.038196 tcp 10.0.2.105 57093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:01.598447 0.063969 tcp 10.0.2.105 57094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:01.662761 0.722376 tcp 10.0.2.105 57095 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:02.395324 2.992785 tcp 10.0.2.105 57096 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:26:11.385739 0.000000 tcp 10.0.2.105 57096 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:26:17.384896 0.032271 tcp 10.0.2.105 57097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:17.417468 0.403716 tcp 10.0.2.105 57098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:17.821425 0.514390 tcp 10.0.2.105 57099 -> 195.113.214.249 443 SRPA* 0 0 46 24482 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:18.353683 3.439806 tcp 10.0.2.105 57100 -> 46.48.223.67 15494 SPA_* 0 0 10 1224 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:51.811432 0.000141 tcp 10.0.2.105 57100 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:26:51.811792 3.000139 tcp 10.0.2.105 57101 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:27:00.797101 0.000000 tcp 10.0.2.105 57101 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:27:06.795550 3.004387 tcp 10.0.2.105 57102 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:27:15.798735 0.000000 tcp 10.0.2.105 57102 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:27:20.345211 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:27:38.998519 0.000238 tcp 10.0.2.105 57100 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:31:55.243007 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:32:02.250203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:32:10.251825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:32:21.798870 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:32:21.798952 3.003742 tcp 10.0.2.105 57103 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:32:26.255310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:32:30.801648 1.067178 tcp 10.0.2.105 57103 -> 46.48.223.67 15494 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:32:58.260992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:33:01.867399 0.065039 tcp 10.0.2.105 57104 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:01.932708 0.033989 tcp 10.0.2.105 57105 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:01.966996 0.492047 tcp 10.0.2.105 57106 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:02.468582 0.439351 tcp 10.0.2.105 57103 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:02.468901 3.002343 tcp 10.0.2.105 57107 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:11.469816 0.000000 tcp 10.0.2.105 57107 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:17.469527 0.032988 tcp 10.0.2.105 57108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:17.502810 0.154759 tcp 10.0.2.105 57109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:17.657926 0.140851 tcp 10.0.2.105 57110 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:17.822219 2.991201 tcp 10.0.2.105 57111 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:26.821816 0.000000 tcp 10.0.2.105 57111 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:32.820946 0.033595 tcp 10.0.2.105 57112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:32.854793 0.035950 tcp 10.0.2.105 57113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:32.891059 0.146448 tcp 10.0.2.105 57114 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:33.047241 1.459718 tcp 10.0.2.105 57115 -> 46.48.223.67 15494 SPA_* 0 0 9 1004 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:39.336417 0.000287 tcp 10.0.2.105 57115 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:33:39.336931 2.997011 tcp 10.0.2.105 57116 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:48.342996 0.000000 tcp 10.0.2.105 57116 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:33:54.331621 2.994053 tcp 10.0.2.105 57117 -> 46.48.220.129 23395 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:34:03.324211 0.000000 tcp 10.0.2.105 57117 -> 46.48.220.129 23395 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:34:07.843538 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:39:02.267602 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:39:09.274350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:39:17.276128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:39:33.278787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:39:46.508183 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:39:46.508281 0.198511 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:39:46.680138 0.114731 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:39:46.774188 0.000000 udp 10.0.2.105 7010 -> 67.236.69.108 7434 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:39:54.339528 3.587504 tcp 10.0.2.105 57118 -> 46.48.223.67 15494 SPA_* 0 0 10 1195 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:03.023550 0.045457 tcp 10.0.2.105 57119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:03.069346 0.041945 tcp 10.0.2.105 57120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:03.111539 0.140283 tcp 10.0.2.105 57121 -> 195.113.214.249 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:03.252411 0.000000 udp 10.0.2.105 7010 -> 99.119.39.1 1556 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:40:05.284867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:40:21.729373 0.055560 tcp 10.0.2.105 57122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:21.785225 0.034116 tcp 10.0.2.105 57123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:21.819718 0.144010 tcp 10.0.2.105 57124 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:21.964534 0.000000 udp 10.0.2.105 7010 -> 65.114.199.182 4317 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:40:27.927852 0.032612 tcp 10.0.2.105 57125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:27.960717 0.042633 tcp 10.0.2.105 57126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:28.003744 0.129185 tcp 10.0.2.105 57127 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:28.152097 0.000108 tcp 10.0.2.105 57118 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:28.152413 2.999637 tcp 10.0.2.105 57128 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:40:37.150794 0.000000 tcp 10.0.2.105 57128 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:40:37.231515 0.049429 tcp 10.0.2.105 57129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:37.281268 0.194956 tcp 10.0.2.105 57130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:37.476518 0.150292 tcp 10.0.2.105 57131 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:37.627464 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:40:55.858394 0.295845 tcp 10.0.2.105 57132 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:56.154498 0.038294 tcp 10.0.2.105 57133 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:56.193065 0.407702 tcp 10.0.2.105 57134 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:40:56.601290 4.687609 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 8 3043 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:56.708473 4.630971 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 8 2771 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:56.784859 4.784769 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 3019 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:57.002830 4.619480 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 8 2862 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:57.055592 0.600145 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:57.633714 4.159038 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 8 3133 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:57.710335 4.417434 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3174 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.066642 4.148921 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2930 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.151515 4.282661 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3149 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.346065 4.254419 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3184 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.519364 4.275178 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 8 2879 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.711152 4.267582 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 8 3007 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:58.899614 4.079546 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 7 2509 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:59.706079 4.905242 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 2909 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:59.909147 4.898923 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3117 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:40:59.971887 4.836654 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 7 2351 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.126194 0.127587 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.254098 0.227481 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.457771 0.124799 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.562723 0.369705 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.854081 0.076163 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:00.935107 0.079260 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 777 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:01.014785 0.160107 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 685 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:02.216020 0.060525 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:04.411940 0.000000 udp 10.0.2.105 7010 <- 109.55.26.3 5025 RSP 0 0 1 544 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:05.472080 0.000000 udp 10.0.2.105 7010 <- 74.141.181.225 2384 RSP 0 0 1 542 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:05.472581 0.098805 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:05.571845 0.107861 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 746 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:05.680127 0.472786 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:06.153368 0.042603 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 771 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:06.196551 0.159810 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 2 728 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:41:06.356911 0.000000 udp 10.0.2.105 7010 -> 123.215.240.253 6038 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:14.915025 0.000000 udp 10.0.2.105 7010 -> 95.13.77.225 8667 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:19.847488 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:41:21.564458 0.000000 udp 10.0.2.105 7010 -> 187.162.127.254 6533 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:30.227293 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:38.598853 0.000000 udp 10.0.2.105 7010 -> 216.85.155.2 1890 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:47.161831 0.000000 udp 10.0.2.105 7010 -> 173.212.23.158 9517 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:41:51.838183 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:41:55.783751 0.000000 udp 10.0.2.105 7010 -> 74.117.230.57 5606 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:01.081618 0.000000 udp 10.0.2.105 7010 -> 92.1.89.142 8193 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:08.582151 0.142442 udp 10.0.2.105 7010 <-> 2.88.199.131 6100 CON 0 0 2 769 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:42:08.743315 0.000000 udp 10.0.2.105 7010 -> 95.14.68.119 1777 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:15.381869 0.000000 udp 10.0.2.105 7010 -> 5.118.147.245 3166 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:20.341468 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:42:24.334728 0.000000 udp 10.0.2.105 7010 -> 190.87.188.232 4498 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:28.150527 0.000000 tcp 10.0.2.105 57118 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 11:42:31.715214 0.000000 udp 10.0.2.105 7010 -> 95.137.251.112 1048 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:40.428059 0.000000 udp 10.0.2.105 7010 -> 76.65.234.43 2750 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:45.344920 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:42:45.595448 0.484065 udp 10.0.2.105 7010 <-> 188.29.127.244 4890 CON 0 0 2 699 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:42:46.099742 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:42:53.707401 0.000000 udp 10.0.2.105 7010 -> 74.74.137.232 9503 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:00.487062 0.000000 udp 10.0.2.105 7010 -> 174.91.241.139 6063 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:07.581029 0.000000 udp 10.0.2.105 7010 -> 66.69.253.188 3984 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:12.343555 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:43:12.714395 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:21.437506 0.000000 udp 10.0.2.105 7010 -> 94.34.135.181 9141 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:30.049762 0.000000 udp 10.0.2.105 7010 -> 211.186.137.130 7101 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:37.349828 0.125884 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:37.475712 0.000000 icmp 50.75.207.98 0x0303 -> 10.0.2.105 0x940b URP 192 1 142 flow=Background 1970/02/19 11:43:42.337421 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:43:42.477648 0.000000 udp 10.0.2.105 7010 -> 72.95.221.77 5120 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:50.268544 0.000000 udp 10.0.2.105 7010 -> 92.13.114.164 3487 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:43:57.478830 0.000000 udp 10.0.2.105 7010 -> 134.117.114.115 4253 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:03.717772 0.205742 udp 10.0.2.105 7010 -> 208.48.253.210 4760 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:03.923514 0.000000 icmp 208.48.253.213 0x0303 -> 10.0.2.105 0x9812 URP 192 1 202 flow=Background 1970/02/19 11:44:08.345809 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:44:09.135926 0.000000 udp 10.0.2.105 7010 -> 220.189.251.66 6849 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:15.775158 0.000000 udp 10.0.2.105 7010 -> 12.12.253.26 2275 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:21.023083 0.000000 udp 10.0.2.105 7010 -> 83.7.40.224 7393 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:29.995195 0.000000 udp 10.0.2.105 7010 -> 76.4.89.123 6271 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:34.842255 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:44:35.693499 0.000000 udp 10.0.2.105 7010 -> 142.24.13.134 6059 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:42.313587 0.000000 udp 10.0.2.105 7010 -> 165.228.198.24 6221 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:49.473560 0.000000 udp 10.0.2.105 7010 -> 84.177.48.131 4751 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:44:56.884084 0.000000 udp 10.0.2.105 7010 -> 95.246.215.103 5349 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:01.840966 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:45:02.592225 4.296113 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 2 831 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:06.897720 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:15.551175 0.000000 udp 10.0.2.105 7010 -> 80.13.218.234 6144 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:20.588148 0.000000 udp 10.0.2.105 7010 -> 82.31.103.235 4708 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:27.628484 0.000000 udp 10.0.2.105 7010 -> 173.12.33.163 2248 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:32.345173 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:45:33.116480 0.000000 udp 10.0.2.105 7010 -> 213.137.0.155 9710 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:39.755912 0.198734 udp 10.0.2.105 7010 <-> 172.1.12.194 3057 CON 0 0 2 821 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:39.965574 0.069304 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 793 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:40.046521 0.463623 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:40.520307 0.054377 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 837 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:40.588903 0.055394 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 704 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:45:40.660976 0.000000 udp 10.0.2.105 7010 -> 213.123.168.89 6462 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:43.150910 0.455837 tcp 10.0.2.105 57135 -> 46.48.223.67 15494 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:45:47.436995 0.000000 udp 10.0.2.105 7010 -> 175.101.129.61 1046 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:45:54.667478 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:02.611372 0.000000 udp 10.0.2.105 7010 -> 89.243.182.25 8970 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:05.869750 0.324024 tcp 10.0.2.105 57135 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:05.871706 0.033536 tcp 10.0.2.105 57136 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:05.905488 0.034559 tcp 10.0.2.105 57137 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:05.940319 0.234302 tcp 10.0.2.105 57138 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:06.193982 3.004008 tcp 10.0.2.105 57139 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:08.657569 0.000000 udp 10.0.2.105 7010 -> 85.101.227.247 7280 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:09.291090 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:46:15.196852 0.000000 tcp 10.0.2.105 57139 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:16.298460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:46:17.079659 0.000000 udp 10.0.2.105 7010 -> 50.197.16.202 2946 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:21.195704 0.031287 tcp 10.0.2.105 57140 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:21.227251 0.036840 tcp 10.0.2.105 57141 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:21.264340 0.154129 tcp 10.0.2.105 57142 -> 195.113.214.249 443 SRPA* 0 0 42 24228 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:21.435779 3.146774 tcp 10.0.2.105 57143 -> 188.242.252.23 28347 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:24.299707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:46:24.365730 0.033627 tcp 10.0.2.105 57144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:24.399648 0.037669 tcp 10.0.2.105 57145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:24.437573 0.134973 tcp 10.0.2.105 57146 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:24.582767 2.992079 tcp 10.0.2.105 57147 -> 46.48.240.210 29630 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:24.760704 0.184788 udp 10.0.2.105 7010 <-> 99.138.46.1 9417 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:46:24.954179 0.068729 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:46:25.042870 0.000000 udp 10.0.2.105 7010 -> 181.176.210.17 1034 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:31.850357 0.000000 udp 10.0.2.105 7010 -> 177.17.201.206 3220 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:33.583140 0.000000 tcp 10.0.2.105 57147 -> 46.48.240.210 29630 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:39.051311 0.000000 udp 10.0.2.105 7010 -> 66.11.183.180 6905 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:39.582352 0.035935 tcp 10.0.2.105 57148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:39.618568 0.034889 tcp 10.0.2.105 57149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:39.653765 0.130130 tcp 10.0.2.105 57150 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:46:39.799520 2.996655 tcp 10.0.2.105 57151 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:40.302953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:46:45.540746 0.032679 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:46:45.595239 0.000000 udp 10.0.2.105 7010 -> 83.28.131.217 8192 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:48.794889 0.000000 tcp 10.0.2.105 57151 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:52.981626 0.000000 udp 10.0.2.105 7010 -> 41.130.214.197 2611 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:46:54.793662 3.004003 tcp 10.0.2.105 57152 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:46:58.469150 0.000000 udp 10.0.2.105 7010 -> 109.156.231.109 7785 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:03.335656 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:47:03.796740 0.000000 tcp 10.0.2.105 57152 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:47:07.312022 1.951869 udp 10.0.2.105 7010 <-> 172.129.1.20 8864 CON 0 0 2 808 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:47:09.273109 0.000000 udp 10.0.2.105 7010 -> 124.38.192.98 2624 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:09.795265 0.067685 tcp 10.0.2.105 57153 -> 188.242.252.23 28347 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:47:12.309132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:47:17.706415 0.000000 udp 10.0.2.105 7010 -> 84.170.185.184 3546 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:25.457850 0.000000 udp 10.0.2.105 7010 -> 72.38.70.74 4099 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:31.556456 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:36.343457 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:47:39.628524 0.000000 udp 10.0.2.105 7010 -> 87.216.182.244 1620 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:39.858577 0.426120 tcp 10.0.2.105 57153 -> 188.242.252.23 28347 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:47:39.858944 3.005973 tcp 10.0.2.105 57154 -> 46.48.240.210 29630 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:47:48.091816 0.148060 udp 10.0.2.105 7010 <-> 109.55.247.249 6416 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:47:48.256869 0.000000 udp 10.0.2.105 7010 -> 78.38.9.251 3592 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:47:48.869841 0.444536 tcp 10.0.2.105 57154 -> 46.48.240.210 29630 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:47:54.811034 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:00.351374 0.000000 udp 10.0.2.105 7010 -> 189.154.226.74 2493 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:08.789993 0.053722 udp 10.0.2.105 7010 <-> 176.73.115.123 4437 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:48:08.870943 0.225179 udp 10.0.2.105 7010 <-> 108.235.114.121 8839 CON 0 0 2 679 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:48:09.105686 0.000000 udp 10.0.2.105 7010 -> 14.97.241.33 8216 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:13.337064 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:48:15.840211 0.000000 udp 10.0.2.105 7010 -> 151.58.244.201 8478 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:19.305005 2.934879 tcp 10.0.2.105 57154 -> 46.48.240.210 29630 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:48:22.239770 0.000000 udp 10.0.2.105 7010 -> 82.48.9.52 2611 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:27.477479 0.000000 udp 10.0.2.105 7010 -> 213.44.79.10 9925 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:35.460442 0.000000 udp 10.0.2.105 7010 -> 174.36.111.203 4181 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:44.301210 0.000000 udp 10.0.2.105 7010 -> 109.66.195.170 4165 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:48.837753 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:48:49.659286 0.000000 udp 10.0.2.105 7010 -> 188.112.160.14 9392 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:48:58.481656 0.364350 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 2 762 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:48:58.906230 0.000000 udp 10.0.2.105 7010 -> 67.90.202.67 7263 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:07.694889 0.077677 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 727 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:49:07.808490 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:15.216638 0.130809 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 2 770 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:49:15.357342 0.215445 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 2 811 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:49:15.585269 0.000000 udp 10.0.2.105 7010 -> 87.22.129.177 1178 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:19.842078 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:49:23.657885 0.097919 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 2 783 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:49:23.778663 0.000000 udp 10.0.2.105 7010 -> 184.180.239.226 1766 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:28.865239 0.000000 udp 10.0.2.105 7010 -> 2.97.71.243 7294 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:35.344690 0.000000 udp 10.0.2.105 7010 -> 50.79.139.54 6047 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:41.163246 0.000000 udp 10.0.2.105 7010 -> 88.105.62.15 2481 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:45.839857 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:49:46.233765 0.098391 udp 10.0.2.105 7010 <-> 197.205.244.249 8422 CON 0 0 2 794 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:49:46.354089 0.000000 udp 10.0.2.105 7010 -> 98.125.156.32 4337 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:49:53.821120 0.000000 udp 10.0.2.105 7010 -> 207.161.107.110 2451 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:01.101882 0.000000 udp 10.0.2.105 7010 -> 113.193.137.222 8521 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:09.523743 0.000000 udp 10.0.2.105 7010 -> 89.232.24.88 9436 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:14.340574 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:50:17.804958 0.000000 udp 10.0.2.105 7010 -> 181.132.129.224 7218 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:22.812197 0.000000 udp 10.0.2.105 7010 -> 87.188.191.167 3885 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:31.134865 0.099376 udp 10.0.2.105 7010 <-> 2.29.118.253 4634 CON 0 0 2 717 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:50:31.245091 0.000000 udp 10.0.2.105 7010 -> 151.28.22.223 7829 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:39.216344 0.799591 udp 10.0.2.105 7010 -> 190.237.211.4 2940 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:40.015935 0.000000 icmp 190.237.211.4 0x0303 -> 10.0.2.105 0x7c0b URP 192 1 161 flow=Background 1970/02/19 11:50:43.842880 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:50:44.363984 0.000000 udp 10.0.2.105 7010 -> 94.6.255.5 4044 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:50:52.826159 0.000000 udp 10.0.2.105 7010 -> 188.169.133.171 5510 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:00.126708 0.000000 udp 10.0.2.105 7010 -> 87.21.5.18 3768 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:06.395690 0.000000 udp 10.0.2.105 7010 -> 50.240.132.37 6904 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:11.342510 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:51:15.288306 0.000000 udp 10.0.2.105 7010 -> 67.65.166.233 1774 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:23.970992 0.000000 udp 10.0.2.105 7010 -> 72.16.245.225 7369 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:31.593482 0.000000 udp 10.0.2.105 7010 -> 94.240.198.62 7534 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:36.339584 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:51:39.828845 0.000000 udp 10.0.2.105 7010 -> 87.22.77.107 8311 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:46.736799 0.000000 udp 10.0.2.105 7010 -> 78.183.131.47 7796 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:52.501750 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:51:57.859482 0.000000 udp 10.0.2.105 7010 -> 76.76.71.25 3611 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:02.836815 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:52:03.437822 0.000000 udp 10.0.2.105 7010 -> 103.30.188.36 5289 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:10.477663 0.000000 udp 10.0.2.105 7010 -> 97.68.63.159 9737 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:18.679899 0.071454 udp 10.0.2.105 7010 <-> 84.173.73.29 7912 CON 0 0 2 763 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:52:18.761206 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:25.869709 0.000000 udp 10.0.2.105 7010 -> 88.78.136.78 4543 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:30.836066 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:52:33.260839 0.000000 udp 10.0.2.105 7010 -> 41.134.20.234 8954 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:41.200762 0.088226 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 841 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:52:41.306587 0.064862 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:52:41.380400 0.000000 udp 10.0.2.105 7010 -> 99.121.104.252 9848 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:48.712868 0.239291 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 850 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:52:48.971706 0.000000 udp 10.0.2.105 7010 -> 77.52.21.243 8772 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:52:56.223524 0.000000 udp 10.0.2.105 7010 -> 72.204.145.167 6875 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:53:00.839870 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 11:53:05.176410 0.051626 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 848 flow=From-Botnet-V2-UDP-Established 1970/02/19 11:53:05.237466 0.000000 udp 10.0.2.105 7010 -> 37.232.10.196 5941 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 11:53:16.315775 3.001079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 11:53:19.307346 3.466252 tcp 10.0.2.105 57155 -> 46.48.223.67 15494 SPA_* 0 0 10 1111 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:53:23.322277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:53:31.323800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:53:47.326938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:53:52.776289 0.080247 tcp 10.0.2.105 57156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:53:52.856822 0.057043 tcp 10.0.2.105 57157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:53:52.914144 0.143267 tcp 10.0.2.105 57158 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:53:53.068503 0.000072 tcp 10.0.2.105 57155 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:53:53.068817 3.000450 tcp 10.0.2.105 57159 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:54:02.067797 0.000000 tcp 10.0.2.105 57159 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:54:08.066588 0.033924 tcp 10.0.2.105 57160 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:08.100730 0.044790 tcp 10.0.2.105 57161 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:08.145803 0.133219 tcp 10.0.2.105 57162 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:08.288695 0.066826 tcp 10.0.2.105 57163 -> 188.242.252.23 28347 SPA_* 0 0 9 1049 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:19.333078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 11:54:38.353486 0.035628 tcp 10.0.2.105 57164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:38.389452 0.042640 tcp 10.0.2.105 57165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:38.432357 0.221482 tcp 10.0.2.105 57166 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:38.700900 0.811122 tcp 10.0.2.105 57163 -> 188.242.252.23 28347 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:38.701199 2.993256 tcp 10.0.2.105 57167 -> 46.48.240.210 29630 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:54:47.693202 0.000000 tcp 10.0.2.105 57167 -> 46.48.240.210 29630 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:54:53.692901 0.034905 tcp 10.0.2.105 57168 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:53.728112 0.033897 tcp 10.0.2.105 57169 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:53.762276 0.129880 tcp 10.0.2.105 57170 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:53.916960 3.791290 tcp 10.0.2.105 57171 -> 46.48.223.67 15494 FSPA* 0 0 14 1327 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:53.985477 0.000160 tcp 10.0.2.105 57155 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:54:57.708517 3.003603 tcp 10.0.2.105 57172 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:55:06.710907 0.000000 tcp 10.0.2.105 57172 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 11:55:12.709962 0.067284 tcp 10.0.2.105 57173 -> 188.242.252.23 28347 SPA_* 0 0 9 1049 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:55:21.764149 0.000369 tcp 10.0.2.105 57173 -> 188.242.252.23 28347 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 11:55:21.764770 4.819580 tcp 10.0.2.105 57174 -> 46.48.240.210 29630 FSPA* 0 0 14 1327 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:23.378975 3.002965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:00:26.622165 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:00:26.622302 0.403080 tcp 10.0.2.105 57175 -> 46.48.223.67 15494 SPA_* 0 0 9 1202 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:30.386003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:00:38.387624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:00:54.391402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:00:57.026415 0.032801 tcp 10.0.2.105 57176 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:57.059497 0.052265 tcp 10.0.2.105 57177 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:57.112099 0.167979 tcp 10.0.2.105 57178 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:57.301659 0.367031 tcp 10.0.2.105 57175 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:00:57.301960 2.999438 tcp 10.0.2.105 57179 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:01:06.297633 0.000000 tcp 10.0.2.105 57179 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:01:12.297612 0.031935 tcp 10.0.2.105 57180 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:12.329849 0.034657 tcp 10.0.2.105 57181 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:12.364780 0.132540 tcp 10.0.2.105 57182 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:12.514294 0.067135 tcp 10.0.2.105 57183 -> 188.242.252.23 28347 SPA_* 0 0 9 1202 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:18.925737 0.238920 tcp 10.0.2.105 57183 -> 188.242.252.23 28347 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:18.926461 0.035504 tcp 10.0.2.105 57184 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:18.962303 0.035286 tcp 10.0.2.105 57185 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:18.997907 0.157107 tcp 10.0.2.105 57186 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:19.164887 3.005720 tcp 10.0.2.105 57187 -> 46.48.240.210 29630 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:01:26.397141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:01:28.169470 0.374386 tcp 10.0.2.105 57187 -> 46.48.240.210 29630 SPA_* 0 0 9 1202 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:58.543974 0.031868 tcp 10.0.2.105 57188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:58.576194 0.047367 tcp 10.0.2.105 57189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:58.623864 0.135010 tcp 10.0.2.105 57190 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:58.796840 0.356310 tcp 10.0.2.105 57187 -> 46.48.240.210 29630 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:01:58.797128 0.357157 tcp 10.0.2.105 57191 -> 46.48.223.67 15494 SPA_* 0 0 9 1202 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:02:29.157273 0.369955 tcp 10.0.2.105 57191 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:02:29.157616 3.007675 tcp 10.0.2.105 57192 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:02:38.160263 0.000000 tcp 10.0.2.105 57192 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:02:44.158583 4.097880 tcp 10.0.2.105 57193 -> 188.242.252.23 28347 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:02:48.256693 0.366725 tcp 10.0.2.105 57194 -> 46.48.240.210 29630 SPA_* 0 0 9 1202 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:02:53.767217 0.031017 tcp 10.0.2.105 57194 -> 46.48.240.210 29630 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:07:30.408807 2.996080 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:07:37.410221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:07:45.411649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:07:53.754977 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:07:53.755060 0.354819 tcp 10.0.2.105 57195 -> 46.48.223.67 15494 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:01.414524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:08:11.619872 0.233200 tcp 10.0.2.105 57195 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:11.622002 0.032890 tcp 10.0.2.105 57196 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:11.655181 0.045536 tcp 10.0.2.105 57197 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:11.700980 0.131426 tcp 10.0.2.105 57198 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:11.853286 2.990779 tcp 10.0.2.105 57199 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:08:20.852577 0.000000 tcp 10.0.2.105 57199 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:08:26.851587 0.034340 tcp 10.0.2.105 57200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:26.886162 0.035044 tcp 10.0.2.105 57201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:26.921485 0.135173 tcp 10.0.2.105 57202 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:27.066555 3.234180 tcp 10.0.2.105 57203 -> 188.242.252.23 28347 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:30.075579 0.032486 tcp 10.0.2.105 57204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:30.108310 0.033119 tcp 10.0.2.105 57205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:30.141728 0.144262 tcp 10.0.2.105 57206 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:30.301035 0.361869 tcp 10.0.2.105 57207 -> 46.48.240.210 29630 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:33.421546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:08:42.302650 0.261036 tcp 10.0.2.105 57207 -> 46.48.240.210 29630 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:42.303599 0.032338 tcp 10.0.2.105 57208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:42.336252 0.082404 tcp 10.0.2.105 57209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:42.418963 0.133218 tcp 10.0.2.105 57210 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:08:42.563985 0.363693 tcp 10.0.2.105 57211 -> 46.48.223.67 15494 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:09:12.927644 0.000090 tcp 10.0.2.105 57211 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:09:12.927970 3.003872 tcp 10.0.2.105 57212 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:09:21.930184 0.000000 tcp 10.0.2.105 57212 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:09:27.929899 0.067133 tcp 10.0.2.105 57213 -> 188.242.252.23 28347 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:09:34.461285 0.000346 tcp 10.0.2.105 57213 -> 188.242.252.23 28347 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:09:34.461853 4.508738 tcp 10.0.2.105 57214 -> 46.48.240.210 29630 FSPA* 0 0 14 1620 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:09:49.424073 0.000324 tcp 10.0.2.105 57211 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:14:37.427271 3.006516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:14:44.437577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:14:52.436142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:15:08.439000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:15:40.444638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:21:44.452640 3.000266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 12:21:51.469175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:21:59.459769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:22:15.462808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:22:47.473894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:23:43.069223 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:23:43.069327 0.185084 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.228388 0.202524 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.360516 0.125700 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.465594 0.063142 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.527091 0.239497 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.746143 0.067735 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.812323 0.131716 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:43.940473 0.359218 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:44.273666 0.093815 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:44.358327 1.277664 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:45.615655 0.183893 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:45.808812 0.172760 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:45.978716 0.230449 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.233058 0.192927 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.423038 0.202029 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.626403 0.084906 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.673034 0.170139 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.784011 0.211514 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:46.979119 0.069845 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.033804 0.209728 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.233239 0.091736 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.350770 0.125042 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.457466 0.178116 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.613602 0.241572 udp 10.0.2.105 7010 <-> 108.235.114.121 8839 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:23:47.850815 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:23:54.024946 3.188905 tcp 10.0.2.105 57215 -> 46.48.223.67 15494 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:23:56.988644 0.036343 tcp 10.0.2.105 57216 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:23:57.025252 0.044475 tcp 10.0.2.105 57217 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:23:57.070003 0.133280 tcp 10.0.2.105 57218 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:23:57.214167 2.988888 tcp 10.0.2.105 57219 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:24:02.937496 0.031984 tcp 10.0.2.105 57220 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:02.969735 0.037200 tcp 10.0.2.105 57221 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:03.007191 0.134017 tcp 10.0.2.105 57222 -> 195.113.214.249 443 SRPA* 0 0 40 19962 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:03.141634 0.000000 udp 10.0.2.105 7010 -> 2.88.199.131 6100 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:24:06.212033 0.000000 tcp 10.0.2.105 57219 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:24:12.211833 0.083160 tcp 10.0.2.105 57223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:12.295301 0.034302 tcp 10.0.2.105 57224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:12.329914 0.128486 tcp 10.0.2.105 57225 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:12.468570 2.694009 tcp 10.0.2.105 57226 -> 46.48.223.67 15494 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:15.162787 3.006678 tcp 10.0.2.105 57227 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:24:18.249800 0.032430 tcp 10.0.2.105 57228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:18.282536 0.035311 tcp 10.0.2.105 57229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:18.318184 0.157110 tcp 10.0.2.105 57230 -> 195.113.214.249 443 SRPA* 0 0 21 12224 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:18.475906 0.124288 udp 10.0.2.105 7010 <-> 188.29.127.244 4890 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:18.611514 0.372387 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:18.963809 0.079350 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:19.044489 0.140765 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:19.176996 0.217395 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:19.386137 0.099161 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:19.486844 0.000000 udp 10.0.2.105 7010 -> 197.205.244.249 8422 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:24:24.167714 0.000000 tcp 10.0.2.105 57227 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:24:35.964972 0.157149 tcp 10.0.2.105 57231 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:36.122445 0.034420 tcp 10.0.2.105 57232 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:36.157220 0.130592 tcp 10.0.2.105 57233 -> 195.113.214.249 443 SRPA* 0 0 21 12467 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:36.288490 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:24:41.967001 0.674789 udp 10.0.2.105 7010 <- 72.251.8.78 2321 RSP 0 0 5 2343 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:24:41.967555 0.000000 udp 10.0.2.105 7010 -> 2.29.118.253 4634 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:24:59.379122 0.054009 tcp 10.0.2.105 57234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:59.433423 0.036030 tcp 10.0.2.105 57235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:59.469318 0.260461 tcp 10.0.2.105 57236 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:24:59.730311 0.058900 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:59.788789 0.221212 udp 10.0.2.105 7010 <-> 172.1.12.194 3057 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:24:59.988713 0.057093 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.064110 0.170756 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.247990 0.055119 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.320167 0.189237 udp 10.0.2.105 7010 <-> 99.138.46.1 9417 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.506214 0.091195 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.579497 0.080192 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:00.643598 4.552565 udp 10.0.2.105 7010 <-> 172.129.1.20 8864 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:04.626576 0.000000 udp 10.0.2.105 7010 -> 109.55.247.249 6416 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:25:21.350514 0.033266 tcp 10.0.2.105 57237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:25:21.384036 0.034582 tcp 10.0.2.105 57238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:25:21.418916 0.150248 tcp 10.0.2.105 57239 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:25:21.569645 0.096063 udp 10.0.2.105 7010 <-> 84.173.73.29 7912 CON 0 0 6 2008 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:21.636217 0.110527 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:21.708739 0.069596 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:21.773113 0.298504 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:25:22.036549 0.062654 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:28:51.474945 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:28:58.482053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:29:06.483559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:29:22.487312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:29:30.158159 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:29:30.158265 3.003589 tcp 10.0.2.105 57240 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:29:39.160653 0.000000 tcp 10.0.2.105 57240 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:29:45.165219 0.032671 tcp 10.0.2.105 57241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:45.198167 0.034959 tcp 10.0.2.105 57242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:45.233390 0.129911 tcp 10.0.2.105 57243 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:45.378306 2.019283 tcp 10.0.2.105 57244 -> 46.48.223.67 15494 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:47.167723 0.032244 tcp 10.0.2.105 57245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:47.200393 0.034923 tcp 10.0.2.105 57246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:47.235636 0.152469 tcp 10.0.2.105 57247 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:29:47.397833 2.999274 tcp 10.0.2.105 57248 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:29:54.493317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:29:56.395230 0.000000 tcp 10.0.2.105 57248 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:02.400106 0.038017 tcp 10.0.2.105 57249 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:02.438396 0.046391 tcp 10.0.2.105 57250 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:02.485071 0.450463 tcp 10.0.2.105 57251 -> 195.113.214.249 443 SRPA* 0 0 23 13828 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:02.946981 2.993843 tcp 10.0.2.105 57252 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:11.947494 0.000000 tcp 10.0.2.105 57252 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:17.936874 0.032396 tcp 10.0.2.105 57253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:17.969548 0.046168 tcp 10.0.2.105 57254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:18.016060 0.154742 tcp 10.0.2.105 57255 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:18.190891 3.000420 tcp 10.0.2.105 57256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:27.189768 0.000000 tcp 10.0.2.105 57256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:33.188485 0.355587 tcp 10.0.2.105 57257 -> 46.48.223.67 15494 SPA_* 0 0 9 1220 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:40.393225 0.000615 tcp 10.0.2.105 57257 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:30:40.393747 2.999419 tcp 10.0.2.105 57258 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:49.401832 0.000000 tcp 10.0.2.105 57258 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:30:55.391549 2.993011 tcp 10.0.2.105 57259 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:31:04.383238 0.000000 tcp 10.0.2.105 57259 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:31:09.381605 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:35:58.498262 3.005043 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:36:05.506986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:36:10.393592 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:36:10.393732 3.003525 tcp 10.0.2.105 57260 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:13.507474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:36:19.395755 0.000000 tcp 10.0.2.105 57260 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:25.396813 0.035348 tcp 10.0.2.105 57261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:25.432578 0.034055 tcp 10.0.2.105 57262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:25.466933 0.132796 tcp 10.0.2.105 57263 -> 195.113.214.249 443 SRPA* 0 0 38 19854 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:25.614687 2.284323 tcp 10.0.2.105 57264 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:27.394010 0.327234 tcp 10.0.2.105 57265 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:27.721544 0.033774 tcp 10.0.2.105 57266 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:27.755659 0.133326 tcp 10.0.2.105 57267 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:27.899251 3.003293 tcp 10.0.2.105 57268 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:29.510745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:36:36.901066 0.000000 tcp 10.0.2.105 57268 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:42.900517 0.290748 tcp 10.0.2.105 57269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:43.191578 0.413153 tcp 10.0.2.105 57270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:43.605002 0.132281 tcp 10.0.2.105 57271 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:43.759505 2.995611 tcp 10.0.2.105 57272 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:52.753861 0.000000 tcp 10.0.2.105 57272 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:36:58.753169 0.037062 tcp 10.0.2.105 57273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:58.790517 0.033555 tcp 10.0.2.105 57274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:58.824360 0.166800 tcp 10.0.2.105 57275 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:36:59.002579 2.995054 tcp 10.0.2.105 57276 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:01.516487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:37:07.995284 0.000000 tcp 10.0.2.105 57276 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:13.994675 1.707449 tcp 10.0.2.105 57277 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:37:15.702377 2.998771 tcp 10.0.2.105 57278 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:24.707624 0.000000 tcp 10.0.2.105 57278 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:30.698919 3.003749 tcp 10.0.2.105 57279 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:39.701573 0.000000 tcp 10.0.2.105 57279 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:37:44.378406 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:42:45.703135 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:42:45.703292 2.992325 tcp 10.0.2.105 57280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:42:54.694149 0.000000 tcp 10.0.2.105 57280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:00.704356 0.057498 tcp 10.0.2.105 57281 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:00.762163 0.034666 tcp 10.0.2.105 57282 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:00.797074 0.131400 tcp 10.0.2.105 57283 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:00.939334 2.070241 tcp 10.0.2.105 57284 -> 46.48.223.67 15494 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:02.780491 0.032021 tcp 10.0.2.105 57285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:02.812804 0.045655 tcp 10.0.2.105 57286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:02.858738 0.132738 tcp 10.0.2.105 57287 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:03.009825 3.000918 tcp 10.0.2.105 57288 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:05.522438 3.001581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:43:12.009041 0.000000 tcp 10.0.2.105 57288 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:12.530525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:43:18.008304 0.315817 tcp 10.0.2.105 57289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:18.324429 0.035693 tcp 10.0.2.105 57290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:18.360448 0.132029 tcp 10.0.2.105 57291 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:18.504302 3.008425 tcp 10.0.2.105 57292 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:20.531498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:43:27.521777 0.000000 tcp 10.0.2.105 57292 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:33.500694 0.032077 tcp 10.0.2.105 57293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:33.533050 0.034506 tcp 10.0.2.105 57294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:33.567845 0.153810 tcp 10.0.2.105 57295 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:33.733567 3.001060 tcp 10.0.2.105 57296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:36.534376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:43:42.743514 0.000000 tcp 10.0.2.105 57296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:43:48.732036 4.424344 tcp 10.0.2.105 57297 -> 46.48.223.67 15494 FSPA* 0 0 14 1547 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:43:53.156251 3.006493 tcp 10.0.2.105 57298 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:44:02.161581 0.000000 tcp 10.0.2.105 57298 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:44:08.153681 2.991067 tcp 10.0.2.105 57299 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:44:08.543497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:44:17.153024 0.000000 tcp 10.0.2.105 57299 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:44:21.879664 0.000137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:49:23.153217 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:49:23.153374 3.003904 tcp 10.0.2.105 57300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:49:32.155677 0.000000 tcp 10.0.2.105 57300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:49:38.155760 0.033749 tcp 10.0.2.105 57301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:38.189772 0.297654 tcp 10.0.2.105 57302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:38.487693 0.140622 tcp 10.0.2.105 57303 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:38.640967 0.364298 tcp 10.0.2.105 57304 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:45.302849 0.213311 tcp 10.0.2.105 57304 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:45.303613 0.033402 tcp 10.0.2.105 57305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:45.337322 0.035489 tcp 10.0.2.105 57306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:45.373036 0.132395 tcp 10.0.2.105 57307 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:49:45.516423 3.003079 tcp 10.0.2.105 57308 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:49:54.521367 0.000000 tcp 10.0.2.105 57308 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:50:00.517592 0.128472 tcp 10.0.2.105 57309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:50:00.646349 0.034642 tcp 10.0.2.105 57310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:50:00.681290 0.137003 tcp 10.0.2.105 57311 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:50:00.835152 3.006344 tcp 10.0.2.105 57312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:50:09.840004 0.000000 tcp 10.0.2.105 57312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:50:15.828979 0.359280 tcp 10.0.2.105 57313 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:50:21.445208 0.000382 tcp 10.0.2.105 57313 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:50:21.445804 3.005421 tcp 10.0.2.105 57314 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:50:30.449515 0.000000 tcp 10.0.2.105 57314 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:55:27.437391 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 12:55:27.437537 0.000000 udp 10.0.2.105 7010 -> 176.73.115.123 4437 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:55:40.548977 3.001019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 12:55:45.514795 0.032942 tcp 10.0.2.105 57315 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:55:45.548017 0.032357 tcp 10.0.2.105 57316 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:55:45.580653 0.128598 tcp 10.0.2.105 57317 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:55:45.709791 0.204847 udp 10.0.2.105 7010 <-> 2.88.199.131 6100 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:55:45.838371 0.000000 udp 10.0.2.105 7010 -> 197.205.244.249 8422 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:55:47.555938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:55:51.441410 2.994077 tcp 10.0.2.105 57318 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:55:55.557225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:56:00.434020 0.000000 tcp 10.0.2.105 57318 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:56:02.828426 0.045125 tcp 10.0.2.105 57319 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:02.873824 0.033537 tcp 10.0.2.105 57320 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:02.907636 0.129339 tcp 10.0.2.105 57321 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:03.037522 0.000000 udp 10.0.2.105 7010 -> 2.29.118.253 4634 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:56:06.443469 0.034877 tcp 10.0.2.105 57322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:06.478579 0.032203 tcp 10.0.2.105 57323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:06.511118 0.134681 tcp 10.0.2.105 57324 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:06.662314 2.995203 tcp 10.0.2.105 57325 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:56:11.560011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:56:15.658453 0.000000 tcp 10.0.2.105 57325 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 12:56:19.452599 0.032033 tcp 10.0.2.105 57326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:19.484907 0.033894 tcp 10.0.2.105 57327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:19.519046 0.131002 tcp 10.0.2.105 57328 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:19.650775 0.000000 udp 10.0.2.105 7010 -> 109.55.247.249 6416 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:56:37.564776 0.031284 tcp 10.0.2.105 57329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:37.596330 0.034362 tcp 10.0.2.105 57330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:37.631051 0.144723 tcp 10.0.2.105 57331 -> 195.113.214.249 443 SRPA* 0 0 44 26774 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:37.776600 0.174674 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:37.897225 0.109979 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:37.986162 0.059182 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.043452 0.239052 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.261327 0.060398 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.319939 0.190221 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.479871 0.130447 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.606745 0.353171 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:38.931748 0.094273 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:39.017329 0.181328 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:39.175798 0.179906 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:39.352915 1.013504 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:40.348135 0.071753 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:40.403238 0.086895 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:40.456697 0.220742 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:40.686851 0.190547 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:40.874398 0.220075 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:41.069620 0.839002 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:41.830218 0.229103 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.059698 0.182170 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.218595 0.124677 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.323826 0.251246 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.567878 0.071143 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 5 1814 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.683989 0.230014 udp 10.0.2.105 7010 <-> 108.235.114.121 8839 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:42.911215 0.378426 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:43.270512 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:56:43.566013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 12:56:59.510053 0.032518 tcp 10.0.2.105 57332 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:59.542919 0.032343 tcp 10.0.2.105 57333 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:59.575522 0.134610 tcp 10.0.2.105 57334 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 12:56:59.710732 0.107526 udp 10.0.2.105 7010 <-> 188.29.127.244 4890 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:59.801467 0.098762 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:56:59.901732 0.140419 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:00.034486 0.226303 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:00.253527 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:57:07.913267 0.579336 udp 10.0.2.105 7010 <- 72.251.8.78 2321 RSP 0 0 5 1998 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 12:57:07.913648 0.062048 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:07.987607 0.060060 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.049149 0.216380 udp 10.0.2.105 7010 <-> 172.1.12.194 3057 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.249176 0.188060 udp 10.0.2.105 7010 <-> 99.138.46.1 9417 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.434182 0.090635 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.506945 0.052667 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.548105 0.055212 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.604468 0.166296 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:08.754091 3.656837 udp 10.0.2.105 7010 <-> 172.129.1.20 8864 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:12.127230 0.068717 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:12.211786 0.254408 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:12.429880 0.063509 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:12.476397 0.101343 udp 10.0.2.105 7010 <-> 84.173.73.29 7912 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/19 12:57:12.545651 0.111345 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:01:21.662884 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:01:21.663077 2.997550 tcp 10.0.2.105 57335 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:01:30.658849 0.000000 tcp 10.0.2.105 57335 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:01:36.659210 0.044730 tcp 10.0.2.105 57336 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:36.704223 0.036192 tcp 10.0.2.105 57337 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:36.740672 0.128235 tcp 10.0.2.105 57338 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:36.878469 1.354823 tcp 10.0.2.105 57339 -> 46.48.223.67 15494 SPA_* 0 0 9 1238 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:43.714361 0.210023 tcp 10.0.2.105 57339 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:43.715322 0.032068 tcp 10.0.2.105 57340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:43.747670 0.033045 tcp 10.0.2.105 57341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:43.780954 0.133412 tcp 10.0.2.105 57342 -> 195.113.214.249 443 SRPA* 0 0 24 12632 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:43.924597 3.007496 tcp 10.0.2.105 57343 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:01:52.931058 0.000000 tcp 10.0.2.105 57343 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:01:58.923333 0.033372 tcp 10.0.2.105 57344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:58.956969 0.034944 tcp 10.0.2.105 57345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:58.992234 0.133221 tcp 10.0.2.105 57346 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:01:59.141712 2.992096 tcp 10.0.2.105 57347 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:08.142811 0.000000 tcp 10.0.2.105 57347 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:14.134349 0.045008 tcp 10.0.2.105 57348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:02:14.179650 0.043536 tcp 10.0.2.105 57349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:02:14.223513 0.140728 tcp 10.0.2.105 57350 -> 195.113.214.249 443 SRPA* 0 0 22 12448 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:02:14.375367 3.000576 tcp 10.0.2.105 57351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:23.375872 0.000000 tcp 10.0.2.105 57351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:29.373436 1.730321 tcp 10.0.2.105 57352 -> 46.48.223.67 15494 FSPA* 0 0 14 1768 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:02:31.103992 3.006178 tcp 10.0.2.105 57353 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:40.109353 0.000000 tcp 10.0.2.105 57353 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:46.097623 3.003810 tcp 10.0.2.105 57354 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:47.572000 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:02:54.582632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:02:55.101654 0.000000 tcp 10.0.2.105 57354 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:02:59.879785 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:03:02.580866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:03:18.584022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:03:50.590146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:08:01.100889 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:08:01.101082 2.993592 tcp 10.0.2.105 57355 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:10.114978 0.000000 tcp 10.0.2.105 57355 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:16.102961 0.034296 tcp 10.0.2.105 57356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:16.137511 0.034611 tcp 10.0.2.105 57357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:16.172440 0.133234 tcp 10.0.2.105 57358 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:16.315300 0.368006 tcp 10.0.2.105 57359 -> 46.48.223.67 15494 SPA_* 0 0 9 1210 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:21.463077 0.208189 tcp 10.0.2.105 57359 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:21.463942 0.032147 tcp 10.0.2.105 57360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:21.496524 0.033538 tcp 10.0.2.105 57361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:21.530330 0.131738 tcp 10.0.2.105 57362 -> 195.113.214.249 443 SRPA* 0 0 41 22696 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:21.671464 2.998010 tcp 10.0.2.105 57363 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:30.672992 0.000000 tcp 10.0.2.105 57363 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:36.677277 0.031770 tcp 10.0.2.105 57364 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:36.709382 0.036856 tcp 10.0.2.105 57365 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:36.746521 0.154070 tcp 10.0.2.105 57366 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:36.911201 2.994191 tcp 10.0.2.105 57367 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:45.904444 0.000000 tcp 10.0.2.105 57367 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:08:51.903959 0.032511 tcp 10.0.2.105 57368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:51.936764 0.034818 tcp 10.0.2.105 57369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:51.971887 0.131496 tcp 10.0.2.105 57370 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:08:52.124052 3.012796 tcp 10.0.2.105 57371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:01.126315 0.000000 tcp 10.0.2.105 57371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:07.125208 1.736178 tcp 10.0.2.105 57372 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:09:08.861627 3.000496 tcp 10.0.2.105 57373 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:17.860737 0.000000 tcp 10.0.2.105 57373 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:23.859420 2.994097 tcp 10.0.2.105 57374 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:32.862174 0.000000 tcp 10.0.2.105 57374 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:09:37.378545 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:10:02.597678 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:10:09.605125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:10:17.606993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:10:33.609919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:11:05.615730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:14:38.862164 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:14:38.862331 2.996455 tcp 10.0.2.105 57375 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:14:47.854784 0.000000 tcp 10.0.2.105 57375 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:14:53.865206 0.032762 tcp 10.0.2.105 57376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:53.898286 0.033210 tcp 10.0.2.105 57377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:53.931761 0.135520 tcp 10.0.2.105 57378 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:54.077439 2.128856 tcp 10.0.2.105 57379 -> 46.48.223.67 15494 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:55.886661 0.034802 tcp 10.0.2.105 57380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:55.921797 0.139491 tcp 10.0.2.105 57381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:56.061649 0.133677 tcp 10.0.2.105 57382 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:14:56.206593 3.006680 tcp 10.0.2.105 57383 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:05.210124 0.000000 tcp 10.0.2.105 57383 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:11.199257 0.031783 tcp 10.0.2.105 57384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:11.231382 0.032819 tcp 10.0.2.105 57385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:11.264560 0.137979 tcp 10.0.2.105 57386 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:11.413087 3.010218 tcp 10.0.2.105 57387 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:20.431725 0.000000 tcp 10.0.2.105 57387 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:26.410688 0.032135 tcp 10.0.2.105 57388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:26.443105 0.034281 tcp 10.0.2.105 57389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:26.477631 0.130154 tcp 10.0.2.105 57390 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:26.644365 3.000714 tcp 10.0.2.105 57391 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:35.643788 0.000000 tcp 10.0.2.105 57391 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:41.642726 4.828089 tcp 10.0.2.105 57392 -> 46.48.223.67 15494 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:15:46.470472 2.992975 tcp 10.0.2.105 57393 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:15:55.472538 0.000000 tcp 10.0.2.105 57393 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:16:01.471262 2.997621 tcp 10.0.2.105 57394 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:16:10.463712 0.000000 tcp 10.0.2.105 57394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:16:15.381057 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:17:09.622564 3.000725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:17:16.629084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:17:24.630669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:17:40.633621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:18:12.639537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:21:16.474249 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:21:16.474348 3.003836 tcp 10.0.2.105 57395 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:21:25.476133 0.000000 tcp 10.0.2.105 57395 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:21:31.477849 0.034196 tcp 10.0.2.105 57396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:31.512407 0.046046 tcp 10.0.2.105 57397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:31.558832 0.133793 tcp 10.0.2.105 57398 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:31.704207 4.806565 tcp 10.0.2.105 57399 -> 46.48.223.67 15494 SPA_* 0 0 12 1525 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:36.511447 0.031348 tcp 10.0.2.105 57400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:36.543150 0.336977 tcp 10.0.2.105 57401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:36.880539 0.127945 tcp 10.0.2.105 57402 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:37.069653 0.000103 tcp 10.0.2.105 57399 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:37.069977 3.000616 tcp 10.0.2.105 57403 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:21:46.066036 0.000000 tcp 10.0.2.105 57403 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:21:52.066268 0.059869 tcp 10.0.2.105 57404 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:52.126425 0.034498 tcp 10.0.2.105 57405 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:52.161186 0.193531 tcp 10.0.2.105 57406 -> 195.113.214.249 443 SRPA* 0 0 25 13444 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:21:52.366377 3.008727 tcp 10.0.2.105 57407 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:01.368436 0.000000 tcp 10.0.2.105 57407 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:07.371509 0.031297 tcp 10.0.2.105 57408 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:22:07.403046 0.116920 tcp 10.0.2.105 57409 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:22:07.520328 0.130316 tcp 10.0.2.105 57410 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:22:07.748896 3.003845 tcp 10.0.2.105 57411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:16.750670 0.000000 tcp 10.0.2.105 57411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:22.739232 4.717729 tcp 10.0.2.105 57412 -> 46.48.223.67 15494 FSPA* 0 0 14 1633 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:22:27.457193 3.003411 tcp 10.0.2.105 57413 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:36.459166 0.000000 tcp 10.0.2.105 57413 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:42.457723 3.004218 tcp 10.0.2.105 57414 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:51.460352 0.000000 tcp 10.0.2.105 57414 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:22:56.377374 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:24:16.646082 3.001256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:24:23.663882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:24:31.654334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:24:47.665644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:25:19.663442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:27:16.591779 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:27:16.591976 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:27:34.520177 0.032473 tcp 10.0.2.105 57415 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:34.552969 0.231086 tcp 10.0.2.105 57416 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:34.784328 0.131003 tcp 10.0.2.105 57417 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:34.916149 0.000000 udp 10.0.2.105 7010 -> 2.88.199.131 6100 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:27:49.990571 0.074914 tcp 10.0.2.105 57418 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:50.065774 0.035553 tcp 10.0.2.105 57419 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:50.101547 0.137983 tcp 10.0.2.105 57420 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:27:50.240103 0.052724 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.291363 0.239580 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.512484 0.060521 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.571681 0.187047 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.728705 0.186965 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.854590 0.121747 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:50.955784 0.094903 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.041413 0.181583 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.225646 0.358938 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.554631 0.129561 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.681812 0.171439 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.849676 0.087306 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.898041 0.069549 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:51.950080 0.257444 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:52.188656 0.192750 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:52.377202 0.220853 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:52.575157 0.204017 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:52.774885 0.205785 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:52.932817 0.200883 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:53.110696 0.221345 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:53.298192 0.125306 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:27:53.404858 0.000000 udp 10.0.2.105 7010 -> 108.235.114.121 8839 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:27:57.460827 0.354843 tcp 10.0.2.105 57421 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:03.931574 0.204754 tcp 10.0.2.105 57421 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:03.932893 0.029561 tcp 10.0.2.105 57422 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:03.962715 0.033411 tcp 10.0.2.105 57423 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:03.996539 0.129590 tcp 10.0.2.105 57424 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:04.136565 2.997482 tcp 10.0.2.105 57425 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:28:10.169542 0.031823 tcp 10.0.2.105 57426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:10.201655 0.033322 tcp 10.0.2.105 57427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:10.235228 0.146015 tcp 10.0.2.105 57428 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:10.381762 1.418285 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:11.829285 0.165039 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:11.992961 0.380260 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:12.350068 0.172150 udp 10.0.2.105 7010 <-> 188.29.127.244 4890 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:12.442460 0.223658 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:12.658891 0.102239 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:12.762466 0.141531 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:12.896660 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:28:13.142720 0.000000 tcp 10.0.2.105 57425 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:28:19.132547 0.032126 tcp 10.0.2.105 57429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:19.164916 0.033989 tcp 10.0.2.105 57430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:19.199179 0.140062 tcp 10.0.2.105 57431 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:19.356262 0.352583 tcp 10.0.2.105 57432 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:25.557886 0.000578 tcp 10.0.2.105 57432 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:25.558560 2.996468 tcp 10.0.2.105 57433 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:28:28.475422 0.031979 tcp 10.0.2.105 57434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:28.507651 0.034099 tcp 10.0.2.105 57435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:28.541991 0.135610 tcp 10.0.2.105 57436 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:28.678120 0.060944 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:28.749997 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:28:34.553614 0.000000 tcp 10.0.2.105 57433 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:28:47.373317 0.031968 tcp 10.0.2.105 57437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:47.405595 0.125659 tcp 10.0.2.105 57438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:47.531545 0.127344 tcp 10.0.2.105 57439 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:28:47.659409 0.215810 udp 10.0.2.105 7010 <-> 172.1.12.194 3057 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:28:47.854107 0.000000 udp 10.0.2.105 7010 -> 99.138.46.1 9417 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:29:03.385628 0.031369 tcp 10.0.2.105 57440 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:03.417233 0.034249 tcp 10.0.2.105 57441 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:03.451747 0.129628 tcp 10.0.2.105 57442 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:03.581944 0.091981 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:03.656553 0.166619 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:03.827201 0.046577 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:03.858580 0.066517 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:03.926435 0.000000 udp 10.0.2.105 7010 -> 172.129.1.20 8864 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 13:29:21.444609 0.031214 tcp 10.0.2.105 57443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:21.476230 0.033899 tcp 10.0.2.105 57444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:21.510450 0.131012 tcp 10.0.2.105 57445 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:29:21.641972 0.073940 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:21.726357 0.248422 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:21.942232 0.062443 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:21.992531 0.096118 udp 10.0.2.105 7010 <-> 84.173.73.29 7912 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:29:22.061329 0.108726 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/19 13:31:23.670150 3.001111 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:31:30.677467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:31:38.678528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:31:54.681427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:32:26.693586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:33:40.553960 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:33:40.554075 3.003877 tcp 10.0.2.105 57446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:33:49.556620 0.000000 tcp 10.0.2.105 57446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:33:55.556654 0.033550 tcp 10.0.2.105 57447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:33:55.590430 0.033733 tcp 10.0.2.105 57448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:33:55.624549 0.126128 tcp 10.0.2.105 57449 -> 195.113.214.249 443 SRPA* 0 0 41 22070 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:33:55.761647 0.346420 tcp 10.0.2.105 57450 -> 46.48.223.67 15494 SPA_* 0 0 9 994 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:26.114521 0.031657 tcp 10.0.2.105 57451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:26.146569 0.033653 tcp 10.0.2.105 57452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:26.180602 0.148378 tcp 10.0.2.105 57453 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:26.339407 0.000081 tcp 10.0.2.105 57450 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:26.339702 2.995330 tcp 10.0.2.105 57454 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:34:35.342930 0.000000 tcp 10.0.2.105 57454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:34:41.332957 0.031804 tcp 10.0.2.105 57455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:41.365116 0.043380 tcp 10.0.2.105 57456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:41.408875 0.126738 tcp 10.0.2.105 57457 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:41.546569 2.999031 tcp 10.0.2.105 57458 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:34:50.544056 0.000000 tcp 10.0.2.105 57458 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:34:51.385870 0.000216 tcp 10.0.2.105 57450 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:34:56.543563 0.357722 tcp 10.0.2.105 57459 -> 46.48.223.67 15494 SPA_* 0 0 9 994 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:35:26.896084 0.000314 tcp 10.0.2.105 57459 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:35:26.896578 3.004028 tcp 10.0.2.105 57460 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:35:35.899310 0.000000 tcp 10.0.2.105 57460 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:35:52.251888 0.000248 tcp 10.0.2.105 57459 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:35:56.883004 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:38:30.693587 3.001297 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:38:37.702772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:38:45.702300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:39:01.705062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:39:33.711541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:40:41.900870 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:40:41.901076 2.992554 tcp 10.0.2.105 57461 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:40:50.902351 0.000000 tcp 10.0.2.105 57461 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:40:56.903235 0.033287 tcp 10.0.2.105 57462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:56.936751 0.033381 tcp 10.0.2.105 57463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:56.970400 0.315649 tcp 10.0.2.105 57464 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:57.310028 2.005598 tcp 10.0.2.105 57465 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:59.113475 0.031436 tcp 10.0.2.105 57466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:59.145176 0.032478 tcp 10.0.2.105 57467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:59.177913 0.127270 tcp 10.0.2.105 57468 -> 195.113.214.249 443 SRPA* 0 0 25 13312 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:40:59.315834 3.007409 tcp 10.0.2.105 57469 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:41:08.317361 0.000000 tcp 10.0.2.105 57469 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:41:14.317582 0.032022 tcp 10.0.2.105 57470 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:41:14.349880 0.033832 tcp 10.0.2.105 57471 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:41:14.383978 0.124205 tcp 10.0.2.105 57472 -> 195.113.214.249 443 SRPA* 0 0 21 11766 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:41:14.535639 3.005139 tcp 10.0.2.105 57473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:41:23.540312 0.000000 tcp 10.0.2.105 57473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:41:29.527929 0.348961 tcp 10.0.2.105 57474 -> 46.48.223.67 15494 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:41:59.871501 0.000114 tcp 10.0.2.105 57474 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:41:59.871864 2.994165 tcp 10.0.2.105 57475 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:42:08.864334 0.000000 tcp 10.0.2.105 57475 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:42:26.069306 0.000289 tcp 10.0.2.105 57474 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:42:30.885222 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:45:37.717426 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:45:44.724699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:45:52.726391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:46:08.729368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:46:40.735207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:47:14.874417 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:47:14.874505 3.004584 tcp 10.0.2.105 57476 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:47:23.877569 0.000000 tcp 10.0.2.105 57476 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:47:29.877430 0.031758 tcp 10.0.2.105 57477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:29.909457 0.032933 tcp 10.0.2.105 57478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:29.942670 0.129358 tcp 10.0.2.105 57479 -> 195.113.214.249 443 SRPA* 0 0 27 13590 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:30.132011 2.983931 tcp 10.0.2.105 57480 -> 46.48.223.67 15494 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:32.906690 0.032263 tcp 10.0.2.105 57481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:32.939271 0.034091 tcp 10.0.2.105 57482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:32.973608 0.126105 tcp 10.0.2.105 57483 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:33.116187 2.998645 tcp 10.0.2.105 57484 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:47:42.112940 0.000000 tcp 10.0.2.105 57484 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:47:48.123236 0.033250 tcp 10.0.2.105 57485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:48.156749 0.033092 tcp 10.0.2.105 57486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:48.190098 0.125651 tcp 10.0.2.105 57487 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:47:48.338989 2.999051 tcp 10.0.2.105 57488 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:47:57.325771 0.000000 tcp 10.0.2.105 57488 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:48:03.334091 1.743030 tcp 10.0.2.105 57489 -> 46.48.223.67 15494 FSPA* 0 0 12 1527 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:48:05.076588 3.004497 tcp 10.0.2.105 57490 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:48:14.081333 0.000000 tcp 10.0.2.105 57490 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:53:20.094426 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:53:20.094528 2.989999 tcp 10.0.2.105 57491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:53:29.082313 0.000000 tcp 10.0.2.105 57491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:53:35.082766 0.042683 tcp 10.0.2.105 57492 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:35.125688 0.058199 tcp 10.0.2.105 57493 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:35.184184 0.128485 tcp 10.0.2.105 57494 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:35.362960 1.984160 tcp 10.0.2.105 57495 -> 46.48.223.67 15494 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:37.139711 0.032184 tcp 10.0.2.105 57496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:37.172183 0.033874 tcp 10.0.2.105 57497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:37.206367 0.131451 tcp 10.0.2.105 57498 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:53:37.347338 3.001988 tcp 10.0.2.105 57499 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:53:46.347381 0.000000 tcp 10.0.2.105 57499 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 13:53:52.346330 1.783982 tcp 10.0.2.105 57500 -> 46.48.223.67 15494 FSPA* 0 0 14 1698 flow=From-Botnet-V2-TCP-Established 1970/02/19 13:56:57.746051 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 13:57:04.753130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:57:12.754124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:57:28.757414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:58:00.763350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 13:59:45.383994 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 13:59:45.384136 0.000000 udp 10.0.2.105 7010 -> 2.88.199.131 6100 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:00:02.450200 0.159955 tcp 10.0.2.105 57501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:02.610423 0.034250 tcp 10.0.2.105 57502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:02.644970 0.128374 tcp 10.0.2.105 57503 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:02.773894 0.000000 udp 10.0.2.105 7010 -> 108.235.114.121 8839 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:00:19.623351 0.031738 tcp 10.0.2.105 57504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:19.655348 0.032938 tcp 10.0.2.105 57505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:19.688549 0.130185 tcp 10.0.2.105 57506 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:19.819215 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:00:35.466240 0.031829 tcp 10.0.2.105 57507 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:35.498375 0.033218 tcp 10.0.2.105 57508 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:35.531878 0.130704 tcp 10.0.2.105 57509 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:35.663119 0.795654 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:36.138906 0.000000 udp 10.0.2.105 7010 -> 99.138.46.1 9417 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:00:39.130852 0.355304 tcp 10.0.2.105 57510 -> 46.48.223.67 15494 SPA_* 0 0 9 1106 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:50.616553 0.210609 tcp 10.0.2.105 57510 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:50.617408 0.032703 tcp 10.0.2.105 57511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:50.650421 0.033599 tcp 10.0.2.105 57512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:50.684287 0.129502 tcp 10.0.2.105 57513 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:50.827391 1.726106 tcp 10.0.2.105 57514 -> 46.48.223.67 15494 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:51.779162 0.073231 tcp 10.0.2.105 57515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:51.852691 0.032828 tcp 10.0.2.105 57516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:51.885822 0.131622 tcp 10.0.2.105 57517 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:00:52.018103 2.062132 udp 10.0.2.105 7010 <-> 172.129.1.20 8864 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:53.872422 0.094771 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:53.957373 0.188156 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.117132 0.060371 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.177758 0.128985 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 698 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.302301 0.217854 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.434804 0.059600 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.492677 0.237324 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:54.709436 0.408212 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.092609 0.091930 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.143275 0.179521 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.317655 0.180706 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.514011 0.040226 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.555624 0.073410 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.610900 0.207098 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:55.812341 0.196144 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.005535 0.213150 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.200783 0.083136 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.262865 0.181817 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.421725 0.295091 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.742780 0.124381 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:56.849393 0.226467 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:57.040441 0.166624 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:57.195113 0.087882 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:57.284550 0.139951 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:57.416396 0.098250 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:57.516747 1.605918 udp 10.0.2.105 7010 <-> 188.29.127.244 4890 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:59.093913 0.219238 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:59.306523 0.382024 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:00:59.665966 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:01:15.694042 0.031499 tcp 10.0.2.105 57518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:15.725788 0.033117 tcp 10.0.2.105 57519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:15.759176 0.126414 tcp 10.0.2.105 57520 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:15.886123 0.218763 udp 10.0.2.105 7010 <-> 172.1.12.194 3057 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.085488 0.057912 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.157861 0.167453 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.348783 0.093144 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.424017 0.046618 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.484840 0.255039 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.706008 0.060698 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:16.749848 0.000000 udp 10.0.2.105 7010 -> 84.173.73.29 7912 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:01:34.761278 0.032049 tcp 10.0.2.105 57521 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:34.793625 0.033184 tcp 10.0.2.105 57522 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:34.827153 0.127969 tcp 10.0.2.105 57523 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:01:34.955611 0.104851 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:01:35.024167 0.066324 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:04:04.769412 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:04:11.776116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:04:19.781807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:04:35.780974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:05:07.787434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:05:52.551679 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:05:52.551871 2.993823 tcp 10.0.2.105 57524 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:01.544143 0.000000 tcp 10.0.2.105 57524 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:07.554769 0.032954 tcp 10.0.2.105 57525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:07.588417 0.032573 tcp 10.0.2.105 57526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:07.621272 0.128739 tcp 10.0.2.105 57527 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:07.951538 2.597928 tcp 10.0.2.105 57528 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:09.772803 0.032451 tcp 10.0.2.105 57529 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:09.805580 0.035563 tcp 10.0.2.105 57530 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:09.841435 0.128837 tcp 10.0.2.105 57531 -> 195.113.214.249 443 SRPA* 0 0 44 24280 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:10.549793 3.002793 tcp 10.0.2.105 57532 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:19.552880 0.000000 tcp 10.0.2.105 57532 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:25.549687 0.031727 tcp 10.0.2.105 57533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:25.581729 0.035647 tcp 10.0.2.105 57534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:25.617742 0.128498 tcp 10.0.2.105 57535 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:25.760115 3.003148 tcp 10.0.2.105 57536 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:34.771873 0.000000 tcp 10.0.2.105 57536 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:40.761455 0.031475 tcp 10.0.2.105 57537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:40.793260 0.033054 tcp 10.0.2.105 57538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:40.826676 0.128184 tcp 10.0.2.105 57539 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:40.966852 2.998164 tcp 10.0.2.105 57540 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:49.963871 0.000000 tcp 10.0.2.105 57540 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:06:55.962318 1.733147 tcp 10.0.2.105 57541 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:06:57.695685 3.003553 tcp 10.0.2.105 57542 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:07:06.697870 0.000000 tcp 10.0.2.105 57542 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:07:12.696585 3.004449 tcp 10.0.2.105 57543 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:07:21.699593 0.000000 tcp 10.0.2.105 57543 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:07:26.376028 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:11:11.793435 3.000634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:11:18.800544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:11:26.801905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:11:42.804359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:12:14.811068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:12:27.699944 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:12:27.700033 2.993785 tcp 10.0.2.105 57544 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:12:36.702571 0.000000 tcp 10.0.2.105 57544 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:12:42.702815 0.033015 tcp 10.0.2.105 57545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:42.736145 0.032750 tcp 10.0.2.105 57546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:42.769250 0.128653 tcp 10.0.2.105 57547 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:42.930447 1.979139 tcp 10.0.2.105 57548 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:44.702176 0.031115 tcp 10.0.2.105 57549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:44.733549 0.033239 tcp 10.0.2.105 57550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:44.767078 0.128556 tcp 10.0.2.105 57551 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:44.909788 2.998910 tcp 10.0.2.105 57552 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:12:53.910191 0.000000 tcp 10.0.2.105 57552 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:12:59.906585 0.032193 tcp 10.0.2.105 57553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:59.939063 0.032404 tcp 10.0.2.105 57554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:12:59.971818 0.132341 tcp 10.0.2.105 57555 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:13:00.166588 3.004069 tcp 10.0.2.105 57556 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:13:09.169161 0.000000 tcp 10.0.2.105 57556 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:13:15.168301 0.032994 tcp 10.0.2.105 57557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:13:15.201580 0.032625 tcp 10.0.2.105 57558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:13:15.234516 0.128938 tcp 10.0.2.105 57559 -> 195.113.214.249 443 SRPA* 0 0 47 43700 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:13:15.391227 3.001213 tcp 10.0.2.105 57560 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:13:24.390917 0.000000 tcp 10.0.2.105 57560 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:13:30.389778 0.342779 tcp 10.0.2.105 57561 -> 46.48.223.67 15494 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:14:00.733028 0.000090 tcp 10.0.2.105 57561 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:14:00.733410 3.004424 tcp 10.0.2.105 57562 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:14:09.735964 0.000000 tcp 10.0.2.105 57562 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:14:15.734896 3.004217 tcp 10.0.2.105 57563 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:14:24.737792 0.000000 tcp 10.0.2.105 57563 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:14:29.374226 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:16:00.735912 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:16:00.736082 0.000000 tcp 10.0.2.105 57561 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 14:18:18.816606 3.002252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:18:25.824529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:18:33.825913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:18:49.828903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:19:21.835012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:19:30.738269 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:19:30.738383 3.003528 tcp 10.0.2.105 57564 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:19:39.740942 0.000000 tcp 10.0.2.105 57564 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:19:45.742165 0.034676 tcp 10.0.2.105 57565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:45.777175 0.032534 tcp 10.0.2.105 57566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:45.809998 0.129596 tcp 10.0.2.105 57567 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:46.039498 2.423570 tcp 10.0.2.105 57568 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:47.793601 0.031549 tcp 10.0.2.105 57569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:47.824989 0.266097 tcp 10.0.2.105 57570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:48.091247 0.129253 tcp 10.0.2.105 57571 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:19:48.463339 3.004231 tcp 10.0.2.105 57572 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:19:57.466697 0.000000 tcp 10.0.2.105 57572 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:20:03.465636 0.032178 tcp 10.0.2.105 57573 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:03.498131 0.032803 tcp 10.0.2.105 57574 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:03.531247 0.131968 tcp 10.0.2.105 57575 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:03.743164 3.006144 tcp 10.0.2.105 57576 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:20:12.747958 0.000000 tcp 10.0.2.105 57576 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:20:18.737590 0.031531 tcp 10.0.2.105 57577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:18.769385 0.034037 tcp 10.0.2.105 57578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:18.803687 0.133691 tcp 10.0.2.105 57579 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:20:19.076491 3.005073 tcp 10.0.2.105 57580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:20:28.080491 0.000000 tcp 10.0.2.105 57580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:20:34.069050 0.351471 tcp 10.0.2.105 57581 -> 46.48.223.67 15494 SPA_* 0 0 9 1032 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:21:04.422789 0.000099 tcp 10.0.2.105 57581 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:21:04.423162 2.993145 tcp 10.0.2.105 57582 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:21:13.415404 0.000000 tcp 10.0.2.105 57582 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:21:19.424063 3.004222 tcp 10.0.2.105 57583 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:21:28.427148 0.000000 tcp 10.0.2.105 57583 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:21:33.373934 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:23:04.415058 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:23:04.415208 0.000000 tcp 10.0.2.105 57581 ?> 46.48.223.67 15494 RA_ 0 1 54 flow=Background 1970/02/19 14:25:25.841474 3.001280 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:25:32.851796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:25:40.849913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:25:56.852661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:26:28.858891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:26:34.427471 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:26:34.427566 3.003605 tcp 10.0.2.105 57584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:26:43.429677 0.000000 tcp 10.0.2.105 57584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:26:49.430743 0.034250 tcp 10.0.2.105 57585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:49.465262 0.033448 tcp 10.0.2.105 57586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:49.499143 0.128423 tcp 10.0.2.105 57587 -> 195.113.214.249 443 SRPA* 0 0 48 43090 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:49.803987 2.043076 tcp 10.0.2.105 57588 -> 46.48.223.67 15494 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:51.573972 0.031519 tcp 10.0.2.105 57589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:51.605763 0.037651 tcp 10.0.2.105 57590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:51.643714 0.128477 tcp 10.0.2.105 57591 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:26:51.847330 2.998895 tcp 10.0.2.105 57592 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:00.844867 0.000000 tcp 10.0.2.105 57592 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:06.844158 0.032099 tcp 10.0.2.105 57593 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:06.876528 0.032514 tcp 10.0.2.105 57594 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:06.909320 0.127194 tcp 10.0.2.105 57595 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:07.165811 3.002705 tcp 10.0.2.105 57596 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:16.166899 0.000000 tcp 10.0.2.105 57596 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:22.166409 0.031793 tcp 10.0.2.105 57597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:22.198510 0.034985 tcp 10.0.2.105 57598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:22.233752 0.134376 tcp 10.0.2.105 57599 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:22.395021 3.005038 tcp 10.0.2.105 57600 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:31.398743 0.000000 tcp 10.0.2.105 57600 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:37.387462 2.012950 tcp 10.0.2.105 57601 -> 46.48.223.67 15494 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:27:39.400678 2.993935 tcp 10.0.2.105 57602 -> 176.73.115.123 1806 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:48.393162 0.000000 tcp 10.0.2.105 57602 -> 176.73.115.123 1806 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:27:54.402082 2.994054 tcp 10.0.2.105 57603 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:28:03.394811 0.000000 tcp 10.0.2.105 57603 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:28:08.381884 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:31:47.978051 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:31:47.978321 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:32:03.010888 0.032583 tcp 10.0.2.105 57604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:03.043723 0.032189 tcp 10.0.2.105 57605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:03.076356 0.125285 tcp 10.0.2.105 57606 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:03.202275 0.000000 udp 10.0.2.105 7010 -> 84.173.73.29 7912 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:32:22.008556 0.031637 tcp 10.0.2.105 57607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:22.040527 0.032459 tcp 10.0.2.105 57608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:22.073380 0.131080 tcp 10.0.2.105 57609 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:22.205140 3.138946 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:24.960748 0.058275 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:25.017236 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:32:32.874975 3.007566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:32:39.882373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:32:40.043414 0.032777 tcp 10.0.2.105 57610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:40.076579 0.035388 tcp 10.0.2.105 57611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:40.112221 0.127067 tcp 10.0.2.105 57612 -> 195.113.214.249 443 SRPA* 0 0 27 11876 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:40.239779 0.093771 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:40.324055 0.000000 udp 10.0.2.105 7010 -> 172.129.1.20 8864 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:32:47.883775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:32:59.203170 0.032390 tcp 10.0.2.105 57613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:59.235870 0.033887 tcp 10.0.2.105 57614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:59.270032 0.132414 tcp 10.0.2.105 57615 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:32:59.403001 0.189563 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:59.561719 0.059408 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:59.630531 0.192991 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:59.757926 0.243266 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:32:59.978853 0.081339 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.125744 0.069892 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.178273 0.348754 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.500529 0.088956 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.579862 0.181232 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.736833 0.172596 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:00.906323 0.213597 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:01.102092 0.601598 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:01.681708 0.202628 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:02.032598 0.186868 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:02.216528 0.181342 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:02.375722 0.194411 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:02.519874 0.124916 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:02.754885 0.231686 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:03.056858 0.101854 udp 10.0.2.105 7010 <-> 31.192.6.202 9158 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:03.280742 0.195770 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:03.633128 0.069611 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:03.797694 0.137751 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:03.889789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:33:03.927729 0.218742 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:04.139192 0.000000 udp 10.0.2.105 7010 -> 188.29.127.244 4890 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:33:09.408994 3.000968 tcp 10.0.2.105 57616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:33:18.407872 0.000000 tcp 10.0.2.105 57616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:33:20.482674 0.032163 tcp 10.0.2.105 57617 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:20.515161 0.033382 tcp 10.0.2.105 57618 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:20.548875 0.129428 tcp 10.0.2.105 57619 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:20.678820 0.380063 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:21.038321 0.055075 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:21.190167 0.000000 udp 10.0.2.105 7010 -> 172.1.12.194 3057 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 14:33:24.406544 0.031537 tcp 10.0.2.105 57620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:24.438318 0.032393 tcp 10.0.2.105 57621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:24.470944 0.133082 tcp 10.0.2.105 57622 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:24.724075 0.362764 tcp 10.0.2.105 57623 -> 46.48.223.67 15494 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:32.550113 0.307944 tcp 10.0.2.105 57623 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:32.550883 0.032578 tcp 10.0.2.105 57624 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:32.583298 0.033544 tcp 10.0.2.105 57625 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:32.617157 0.139496 tcp 10.0.2.105 57626 -> 195.113.214.249 443 SRPA* 0 0 35 18780 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:32.858295 3.004552 tcp 10.0.2.105 57627 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:33:35.892983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:33:37.796013 0.031903 tcp 10.0.2.105 57628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:37.828173 0.033496 tcp 10.0.2.105 57629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:37.861991 0.188228 tcp 10.0.2.105 57630 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:38.050830 0.045384 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.080777 0.252098 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.393504 0.068412 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.443297 0.091494 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.659362 0.166601 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.918814 0.113058 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:38.991182 0.064863 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/19 14:33:41.875656 0.000000 tcp 10.0.2.105 57627 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:33:47.851532 0.031429 tcp 10.0.2.105 57631 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:47.883241 0.032717 tcp 10.0.2.105 57632 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:47.916224 0.129249 tcp 10.0.2.105 57633 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:33:48.136394 2.988198 tcp 10.0.2.105 57634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:33:57.123306 0.000000 tcp 10.0.2.105 57634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:34:03.132104 0.345524 tcp 10.0.2.105 57635 -> 46.48.223.67 15494 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:34:16.981625 0.000405 tcp 10.0.2.105 57635 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:34:16.982349 2.993263 tcp 10.0.2.105 57636 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:34:25.974867 0.000000 tcp 10.0.2.105 57636 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:39:31.985290 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:39:31.985414 3.003706 tcp 10.0.2.105 57637 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:39:39.898024 3.002782 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:39:40.987949 0.000000 tcp 10.0.2.105 57637 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:39:46.906101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:39:46.988646 0.033152 tcp 10.0.2.105 57638 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:39:47.022156 0.032815 tcp 10.0.2.105 57639 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:39:47.055210 0.126266 tcp 10.0.2.105 57640 -> 195.113.214.249 443 SRPA* 0 0 24 13388 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:39:47.294385 0.348591 tcp 10.0.2.105 57641 -> 46.48.223.67 15494 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:39:54.907955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:40:10.910833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:40:17.641672 0.031647 tcp 10.0.2.105 57642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:17.673647 0.034874 tcp 10.0.2.105 57643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:17.708826 0.129820 tcp 10.0.2.105 57644 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:18.031485 0.000149 tcp 10.0.2.105 57641 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:18.031792 2.993602 tcp 10.0.2.105 57645 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:40:24.460787 0.000255 tcp 10.0.2.105 57641 -> 46.48.223.67 15494 RA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:27.027080 0.000000 tcp 10.0.2.105 57645 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:40:33.023625 0.031978 tcp 10.0.2.105 57646 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:33.055881 0.032469 tcp 10.0.2.105 57647 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:33.088735 0.131116 tcp 10.0.2.105 57648 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:33.235264 3.001985 tcp 10.0.2.105 57649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:40:42.235686 0.000000 tcp 10.0.2.105 57649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:40:42.916498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:40:48.234828 1.781421 tcp 10.0.2.105 57650 -> 46.48.223.67 15494 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:40:50.016503 3.004788 tcp 10.0.2.105 57651 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:40:59.019991 0.000000 tcp 10.0.2.105 57651 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:46:05.010404 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:46:05.010493 2.998315 tcp 10.0.2.105 57652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:46:14.012590 0.000000 tcp 10.0.2.105 57652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:46:20.012982 0.447510 tcp 10.0.2.105 57653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:20.460754 0.033078 tcp 10.0.2.105 57654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:20.494131 0.132170 tcp 10.0.2.105 57655 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:20.741394 0.358501 tcp 10.0.2.105 57656 -> 46.48.223.67 15494 SPA_* 0 0 9 1206 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:46.981486 2.972127 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:46:50.814759 0.032114 tcp 10.0.2.105 57657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:50.847146 0.032638 tcp 10.0.2.105 57658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:50.880153 0.134873 tcp 10.0.2.105 57659 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:51.272606 4.290138 tcp 10.0.2.105 57656 -> 46.48.223.67 15494 FRA_* 0 0 7 638 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:46:51.272918 2.987945 tcp 10.0.2.105 57660 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:46:53.930707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:47:00.259216 0.000000 tcp 10.0.2.105 57660 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:47:01.931744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:47:06.259855 0.031704 tcp 10.0.2.105 57661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:47:06.291940 0.032231 tcp 10.0.2.105 57662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:47:06.324581 0.124697 tcp 10.0.2.105 57663 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:47:06.603235 2.999580 tcp 10.0.2.105 57664 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:47:15.611588 0.000000 tcp 10.0.2.105 57664 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:47:17.934951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:47:21.600531 1.717391 tcp 10.0.2.105 57665 -> 46.48.223.67 15494 FSPA* 0 0 14 1736 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:47:23.318271 2.998607 tcp 10.0.2.105 57666 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:47:32.315578 0.000000 tcp 10.0.2.105 57666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:47:49.940800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:52:38.316347 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:52:38.316533 3.003189 tcp 10.0.2.105 57667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:52:47.320902 0.000000 tcp 10.0.2.105 57667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:52:53.323285 0.032629 tcp 10.0.2.105 57668 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:52:53.356423 0.033569 tcp 10.0.2.105 57669 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:52:53.390305 0.126838 tcp 10.0.2.105 57670 -> 195.113.214.249 443 SRPA* 0 0 35 18780 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:52:53.923498 0.355794 tcp 10.0.2.105 57671 -> 46.48.223.67 15494 SPA_* 0 0 9 1231 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:52:59.971834 0.219600 tcp 10.0.2.105 57671 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:52:59.972702 0.032042 tcp 10.0.2.105 57672 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:00.005031 0.033720 tcp 10.0.2.105 57673 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:00.039078 0.127879 tcp 10.0.2.105 57674 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:00.191680 3.003020 tcp 10.0.2.105 57675 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:09.189899 0.000000 tcp 10.0.2.105 57675 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:15.189507 0.031715 tcp 10.0.2.105 57676 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:15.221531 0.032463 tcp 10.0.2.105 57677 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:15.254003 0.126193 tcp 10.0.2.105 57678 -> 195.113.214.249 443 SRPA* 0 0 27 14046 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:15.585922 2.997297 tcp 10.0.2.105 57679 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:24.593012 0.000000 tcp 10.0.2.105 57679 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:30.580861 3.759589 tcp 10.0.2.105 57680 -> 46.48.223.67 15494 FSPA* 0 0 14 1761 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:53:34.340691 2.999644 tcp 10.0.2.105 57681 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:43.338934 0.000000 tcp 10.0.2.105 57681 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 14:53:53.947402 3.004119 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 14:54:00.954078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:54:08.955702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:54:24.958925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:54:56.964743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 14:58:49.344629 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 14:58:49.344734 4.060924 tcp 10.0.2.105 57682 -> 46.48.223.67 15494 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:58:53.166587 0.032179 tcp 10.0.2.105 57683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:58:53.198727 0.033098 tcp 10.0.2.105 57684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:58:53.231726 0.126929 tcp 10.0.2.105 57685 -> 195.113.214.249 443 SRPA* 0 0 26 13536 flow=From-Botnet-V2-TCP-Established 1970/02/19 14:58:53.405893 3.840699 tcp 10.0.2.105 57686 -> 46.48.223.67 15494 FSPA* 0 0 14 1684 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:01:00.971396 3.000430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 15:01:07.978069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:01:15.979741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:01:31.982703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:02:03.989116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:03:55.599528 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:03:55.599665 0.097106 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:03:55.676913 0.000000 udp 10.0.2.105 7010 -> 172.129.1.20 8864 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:03:57.243579 4.125231 tcp 10.0.2.105 57687 -> 46.48.223.67 15494 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:01.100438 0.033494 tcp 10.0.2.105 57688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:01.134280 0.032398 tcp 10.0.2.105 57689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:01.166923 0.171193 tcp 10.0.2.105 57690 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:01.369019 3.822790 tcp 10.0.2.105 57691 -> 46.48.223.67 15494 FSPA* 0 0 14 1537 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:11.422445 0.031447 tcp 10.0.2.105 57692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:11.454217 0.033115 tcp 10.0.2.105 57693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:11.487578 0.128793 tcp 10.0.2.105 57694 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:11.616911 0.000000 udp 10.0.2.105 7010 -> 188.29.127.244 4890 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:04:29.268135 0.031516 tcp 10.0.2.105 57695 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:29.299896 0.032666 tcp 10.0.2.105 57696 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:29.332876 0.127341 tcp 10.0.2.105 57697 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:29.461095 0.000000 udp 10.0.2.105 7010 -> 172.1.12.194 3057 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:04:47.834696 0.032016 tcp 10.0.2.105 57698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:47.866944 0.033334 tcp 10.0.2.105 57699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:47.900155 0.130599 tcp 10.0.2.105 57700 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:04:48.031271 0.789800 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:48.526317 0.058046 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:48.582576 0.095533 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:48.721944 0.197218 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:48.851098 0.237101 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.067161 0.040141 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.113976 0.190873 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.271633 0.055864 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.365406 0.174616 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.537202 0.212454 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.733715 0.181706 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.943554 0.092682 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:49.995730 0.352539 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:50.320147 0.067716 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:50.372067 0.201675 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:50.774980 0.803926 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2662 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:51.555149 0.226175 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:04:51.822233 0.000000 udp 10.0.2.105 7010 -> 31.192.6.202 9158 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:05:08.254455 0.032406 tcp 10.0.2.105 57701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:05:08.287208 0.117919 tcp 10.0.2.105 57702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:05:08.405401 0.128420 tcp 10.0.2.105 57703 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:05:08.534471 0.204726 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:08.665674 0.185869 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:08.828366 0.190795 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.015288 0.124530 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.120590 0.220263 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.333134 0.090410 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.656875 0.164935 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.812999 0.142457 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:09.947586 0.380728 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.310063 0.057325 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.368494 0.045914 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.398726 0.068200 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.490512 0.091363 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.563672 0.167966 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.812203 0.107629 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.881005 0.063636 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:05:10.981320 0.249550 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:08:07.994381 3.002617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:08:15.002280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:08:23.003223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:08:39.006800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:09:05.184191 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:09:05.184407 3.004288 tcp 10.0.2.105 57704 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:11.012564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:09:14.187080 0.000000 tcp 10.0.2.105 57704 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:20.187644 0.033019 tcp 10.0.2.105 57705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:20.220953 0.033565 tcp 10.0.2.105 57706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:20.254802 0.124258 tcp 10.0.2.105 57707 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:20.484302 2.834500 tcp 10.0.2.105 57708 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:23.082857 0.032215 tcp 10.0.2.105 57709 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:23.115406 0.034074 tcp 10.0.2.105 57710 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:23.149767 0.128449 tcp 10.0.2.105 57711 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:23.319076 2.996233 tcp 10.0.2.105 57712 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:32.313319 0.000000 tcp 10.0.2.105 57712 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:38.661266 0.032123 tcp 10.0.2.105 57713 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:38.693656 0.032842 tcp 10.0.2.105 57714 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:38.726840 0.126765 tcp 10.0.2.105 57715 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:38.910601 2.972794 tcp 10.0.2.105 57716 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:47.829432 0.000000 tcp 10.0.2.105 57716 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:09:53.772616 0.356831 tcp 10.0.2.105 57717 -> 46.48.223.67 15494 SPA_* 0 0 9 1020 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:58.792192 0.000617 tcp 10.0.2.105 57717 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:09:58.793034 2.965897 tcp 10.0.2.105 57718 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:10:07.705089 0.000000 tcp 10.0.2.105 57718 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:13.624038 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:15:13.624379 3.004114 tcp 10.0.2.105 57719 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:15.018734 3.004492 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:15:22.025991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:15:22.626938 0.000000 tcp 10.0.2.105 57719 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:28.627797 0.032728 tcp 10.0.2.105 57720 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:28.660846 0.032510 tcp 10.0.2.105 57721 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:28.693651 0.128497 tcp 10.0.2.105 57722 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:28.862242 0.980957 tcp 10.0.2.105 57723 -> 46.48.223.67 15494 SPA_* 0 0 9 1031 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:30.028190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:15:34.523893 0.206729 tcp 10.0.2.105 57723 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:34.524644 0.031908 tcp 10.0.2.105 57724 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:34.556849 0.033543 tcp 10.0.2.105 57725 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:34.590668 0.129682 tcp 10.0.2.105 57726 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:34.730900 2.997781 tcp 10.0.2.105 57727 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:43.727222 0.000000 tcp 10.0.2.105 57727 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:46.030929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:15:49.726625 0.031412 tcp 10.0.2.105 57728 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:49.758302 0.032274 tcp 10.0.2.105 57729 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:49.790858 0.297041 tcp 10.0.2.105 57730 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:15:50.156128 3.004669 tcp 10.0.2.105 57731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:15:59.159736 0.000000 tcp 10.0.2.105 57731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:16:05.148848 4.913007 tcp 10.0.2.105 57732 -> 46.48.223.67 15494 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:16:10.062085 2.997282 tcp 10.0.2.105 57733 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:16:18.036731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:16:19.057968 0.000000 tcp 10.0.2.105 57733 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:21:25.059191 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:21:25.059277 3.003371 tcp 10.0.2.105 57734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:21:34.061090 0.000000 tcp 10.0.2.105 57734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:21:40.061464 0.031637 tcp 10.0.2.105 57735 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:40.093348 0.033083 tcp 10.0.2.105 57736 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:40.126742 0.130582 tcp 10.0.2.105 57737 -> 195.113.214.249 443 SRPA* 0 0 44 28328 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:40.269230 4.785739 tcp 10.0.2.105 57738 -> 46.48.223.67 15494 SPA_* 0 0 12 1430 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:45.050273 0.031369 tcp 10.0.2.105 57739 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:45.081993 0.033202 tcp 10.0.2.105 57740 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:45.115454 0.129080 tcp 10.0.2.105 57741 -> 195.113.214.249 443 SRPA* 0 0 41 22864 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:45.273893 0.000071 tcp 10.0.2.105 57738 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:21:45.274240 3.007253 tcp 10.0.2.105 57742 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:21:54.280160 0.000000 tcp 10.0.2.105 57742 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:22:00.269518 0.030894 tcp 10.0.2.105 57743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:22:00.300666 0.034221 tcp 10.0.2.105 57744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:22:00.335135 0.127156 tcp 10.0.2.105 57745 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:22:00.525460 2.997887 tcp 10.0.2.105 57746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:22:09.532188 0.000000 tcp 10.0.2.105 57746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:22:15.520700 4.662020 tcp 10.0.2.105 57747 -> 46.48.223.67 15494 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:22:20.182927 2.998808 tcp 10.0.2.105 57748 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:22:22.042831 3.001393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:22:29.054401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:22:29.183525 0.000000 tcp 10.0.2.105 57748 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:22:37.052171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:22:53.059564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:23:25.060827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:27:35.181058 0.030058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:27:35.211202 2.971257 tcp 10.0.2.105 57749 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:27:44.183155 0.000000 tcp 10.0.2.105 57749 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:27:50.193691 0.061571 tcp 10.0.2.105 57750 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:50.255532 0.032696 tcp 10.0.2.105 57751 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:50.288512 0.126575 tcp 10.0.2.105 57752 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:50.586249 1.355306 tcp 10.0.2.105 57753 -> 46.48.223.67 15494 SPA_* 0 0 9 1026 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:57.416075 0.385837 tcp 10.0.2.105 57753 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:57.416923 0.031970 tcp 10.0.2.105 57754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:57.449210 0.034506 tcp 10.0.2.105 57755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:57.483981 0.135145 tcp 10.0.2.105 57756 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:27:57.802181 2.994880 tcp 10.0.2.105 57757 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:28:06.795416 0.000000 tcp 10.0.2.105 57757 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:28:12.795030 0.203900 tcp 10.0.2.105 57758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:28:12.999227 0.053622 tcp 10.0.2.105 57759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:28:13.053125 0.139013 tcp 10.0.2.105 57760 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:28:13.242470 2.996838 tcp 10.0.2.105 57761 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:28:22.238114 0.000000 tcp 10.0.2.105 57761 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:28:28.237001 0.360329 tcp 10.0.2.105 57762 -> 46.48.223.67 15494 SPA_* 0 0 9 1026 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:28:33.365328 0.000381 tcp 10.0.2.105 57762 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:28:33.365893 3.002191 tcp 10.0.2.105 57763 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:28:42.366700 0.000000 tcp 10.0.2.105 57763 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:29:29.067487 3.000983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:29:36.074188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:29:44.075793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:30:00.078970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:30:32.084963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:35:15.113680 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:35:15.113784 0.000000 udp 10.0.2.105 7010 -> 31.192.6.202 9158 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:35:31.577382 0.054343 tcp 10.0.2.105 57764 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:31.631986 0.054162 tcp 10.0.2.105 57765 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:31.686418 0.146365 tcp 10.0.2.105 57766 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:31.833479 0.110480 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:31.922427 0.095154 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:32.008876 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:35:33.380623 0.365779 tcp 10.0.2.105 57767 -> 46.48.223.67 15494 SPA_* 0 0 9 1135 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:38.439732 0.266895 tcp 10.0.2.105 57767 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:38.440677 0.053617 tcp 10.0.2.105 57768 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:38.494567 0.054472 tcp 10.0.2.105 57769 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:38.549300 0.147701 tcp 10.0.2.105 57770 -> 195.113.214.249 443 SRPA* 0 0 48 43924 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:38.706828 1.354345 tcp 10.0.2.105 57771 -> 46.48.223.67 15494 SPA_* 0 0 9 1135 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:49.501890 0.054042 tcp 10.0.2.105 57772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:49.556231 0.054661 tcp 10.0.2.105 57773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:49.611142 0.146091 tcp 10.0.2.105 57774 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:35:49.757795 0.058053 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:49.823256 0.266565 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.071353 0.039497 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.116756 0.183235 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.273079 0.059343 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.330855 0.220899 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.549148 0.175419 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.668469 0.213178 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.864061 0.077759 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:50.921354 0.205945 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:51.140754 0.082571 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:51.185075 0.183481 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:51.386959 0.350948 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:51.710698 0.224683 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:51.899970 0.294064 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.170216 0.184249 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.332832 0.151114 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.423695 0.219553 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.634572 0.079340 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.721749 0.164691 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:52.877531 0.141613 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:53.010895 0.187300 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:53.194477 0.126235 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:53.299879 0.376779 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:35:53.656520 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 15:35:53.677250 0.000561 tcp 10.0.2.105 57771 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:36:09.860863 0.053189 tcp 10.0.2.105 57775 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:36:09.914315 0.055498 tcp 10.0.2.105 57776 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:36:09.970137 0.143718 tcp 10.0.2.105 57777 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:36:10.114383 0.046534 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.146035 0.064490 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.192686 0.089730 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.265719 0.164532 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2062 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.441420 0.110157 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.512748 0.064205 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:10.615430 0.256994 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/19 15:36:36.091774 3.000561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:36:43.098067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:36:51.104000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:37:07.102482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:37:39.108629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:40:53.668992 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:40:53.669171 3.003557 tcp 10.0.2.105 57778 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:02.673196 0.000000 tcp 10.0.2.105 57778 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:08.671951 0.054870 tcp 10.0.2.105 57779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:08.727058 0.055830 tcp 10.0.2.105 57780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:08.783177 0.147554 tcp 10.0.2.105 57781 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:08.954291 0.370760 tcp 10.0.2.105 57782 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:14.086178 0.260858 tcp 10.0.2.105 57782 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:14.086898 0.054188 tcp 10.0.2.105 57783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:14.141339 0.054769 tcp 10.0.2.105 57784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:14.196388 0.141139 tcp 10.0.2.105 57785 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:14.347295 2.995299 tcp 10.0.2.105 57786 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:23.341761 0.000000 tcp 10.0.2.105 57786 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:29.334178 0.054440 tcp 10.0.2.105 57787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:29.388963 0.055224 tcp 10.0.2.105 57788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:29.444514 0.142981 tcp 10.0.2.105 57789 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:29.615069 2.989500 tcp 10.0.2.105 57790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:38.612861 0.000000 tcp 10.0.2.105 57790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:41:44.611559 1.356397 tcp 10.0.2.105 57791 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:51.417416 0.000613 tcp 10.0.2.105 57791 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:41:51.417939 2.997453 tcp 10.0.2.105 57792 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:42:00.414199 0.000000 tcp 10.0.2.105 57792 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:43:43.114886 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:43:50.122373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:43:58.123341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:44:14.125982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:44:46.132806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:47:06.414517 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:47:06.414712 3.003798 tcp 10.0.2.105 57793 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:15.417110 0.000000 tcp 10.0.2.105 57793 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:21.417392 0.055701 tcp 10.0.2.105 57794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:21.473334 0.054763 tcp 10.0.2.105 57795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:21.528375 0.140481 tcp 10.0.2.105 57796 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:21.685160 2.025920 tcp 10.0.2.105 57797 -> 46.48.223.67 15494 FSPA* 0 0 14 1617 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:23.454301 0.053015 tcp 10.0.2.105 57798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:23.507658 0.055145 tcp 10.0.2.105 57799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:23.563082 0.137854 tcp 10.0.2.105 57800 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:23.711291 2.991948 tcp 10.0.2.105 57801 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:32.718480 0.000000 tcp 10.0.2.105 57801 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:38.713643 0.053307 tcp 10.0.2.105 57802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:38.767216 0.054870 tcp 10.0.2.105 57803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:38.822338 0.142364 tcp 10.0.2.105 57804 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:47:38.975287 2.999967 tcp 10.0.2.105 57805 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:47.974194 0.000000 tcp 10.0.2.105 57805 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:47:53.973149 0.358047 tcp 10.0.2.105 57806 -> 46.48.223.67 15494 SPA_* 0 0 9 1087 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:48:05.577316 0.000334 tcp 10.0.2.105 57806 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:48:05.577908 2.995602 tcp 10.0.2.105 57807 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:48:14.582240 0.000000 tcp 10.0.2.105 57807 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:53:20.572873 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:53:20.572965 3.003888 tcp 10.0.2.105 57808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:53:29.575228 0.000000 tcp 10.0.2.105 57808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:53:35.575241 0.054879 tcp 10.0.2.105 57809 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:35.630412 0.055807 tcp 10.0.2.105 57810 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:35.686508 0.141564 tcp 10.0.2.105 57811 -> 195.113.214.249 443 SRPA* 0 0 40 22432 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:35.853965 0.369351 tcp 10.0.2.105 57812 -> 46.48.223.67 15494 SPA_* 0 0 9 1144 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:40.864797 0.266261 tcp 10.0.2.105 57812 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:40.865567 0.053937 tcp 10.0.2.105 57813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:40.919781 0.055237 tcp 10.0.2.105 57814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:40.975292 0.144798 tcp 10.0.2.105 57815 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:41.131291 2.994740 tcp 10.0.2.105 57816 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:53:50.126644 0.000000 tcp 10.0.2.105 57816 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:53:56.127557 0.053953 tcp 10.0.2.105 57817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:56.181866 0.054902 tcp 10.0.2.105 57818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:56.237040 0.145973 tcp 10.0.2.105 57819 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:53:56.407284 3.011084 tcp 10.0.2.105 57820 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:54:05.406714 0.000000 tcp 10.0.2.105 57820 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:54:11.405772 1.793437 tcp 10.0.2.105 57821 -> 46.48.223.67 15494 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:54:13.199506 3.003270 tcp 10.0.2.105 57822 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:54:22.200664 0.000000 tcp 10.0.2.105 57822 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:56:01.145898 3.001465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 15:56:08.153161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:56:16.154200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:56:32.157659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:57:04.163767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 15:59:28.201797 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 15:59:28.201892 2.993098 tcp 10.0.2.105 57823 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:59:37.193625 0.000000 tcp 10.0.2.105 57823 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:59:43.206056 0.031600 tcp 10.0.2.105 57824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:43.237936 0.031923 tcp 10.0.2.105 57825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:43.270146 0.123715 tcp 10.0.2.105 57826 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:43.424378 0.374816 tcp 10.0.2.105 57827 -> 46.48.223.67 15494 SPA_* 0 0 9 1215 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:48.463115 0.201452 tcp 10.0.2.105 57827 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:48.463952 0.031112 tcp 10.0.2.105 57828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:48.495315 0.033201 tcp 10.0.2.105 57829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:48.528811 0.120339 tcp 10.0.2.105 57830 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 15:59:48.664790 2.991176 tcp 10.0.2.105 57831 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 15:59:57.655767 0.000000 tcp 10.0.2.105 57831 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:00:03.662402 0.031309 tcp 10.0.2.105 57832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:00:03.693981 0.032098 tcp 10.0.2.105 57833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:00:03.726396 0.121708 tcp 10.0.2.105 57834 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:00:03.876872 2.999105 tcp 10.0.2.105 57835 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:00:12.874328 0.000000 tcp 10.0.2.105 57835 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:00:18.873937 4.863730 tcp 10.0.2.105 57836 -> 46.48.223.67 15494 FSPA* 0 0 14 1745 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:00:23.737878 2.996989 tcp 10.0.2.105 57837 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:00:32.733441 0.000000 tcp 10.0.2.105 57837 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:03:08.170114 3.001308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:03:15.180428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:03:23.178807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:03:39.182009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:04:11.187822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:06:20.554001 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:06:20.554159 4.153284 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:24.134916 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 16:06:38.740179 1.982554 tcp 10.0.2.105 57838 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:39.983198 0.032961 tcp 10.0.2.105 57839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.016516 0.032167 tcp 10.0.2.105 57840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.049022 0.123626 tcp 10.0.2.105 57841 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.173317 0.130849 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.285303 0.094256 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.370643 0.059197 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2577 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.427909 0.245706 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.513348 0.031110 tcp 10.0.2.105 57842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.544714 0.032313 tcp 10.0.2.105 57843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.577356 0.122950 tcp 10.0.2.105 57844 -> 195.113.214.249 443 SRPA* 0 0 46 42318 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.652228 0.039775 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.698123 0.170836 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.723003 4.702799 tcp 10.0.2.105 57845 -> 46.48.223.67 15494 FSPA* 0 0 14 1595 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:40.865588 0.059003 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:40.922562 0.186048 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:41.079028 0.222303 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:41.272685 0.069565 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:41.323924 0.203532 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:41.528788 0.186942 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:41.643851 0.407078 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.022695 0.220336 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.211568 0.103450 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.293912 0.184156 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.484611 0.077851 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.525773 0.222224 udp 10.0.2.105 7010 <-> 108.232.100.12 3695 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:42.740392 0.073134 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 5 2164 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:59.179729 0.030885 tcp 10.0.2.105 57846 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:59.210884 0.032224 tcp 10.0.2.105 57847 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:59.243439 0.124271 tcp 10.0.2.105 57848 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:06:59.368540 0.517148 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:06:59.877398 0.143314 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:00.013008 0.191625 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:00.181768 0.201157 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:00.313051 0.000000 udp 10.0.2.105 7010 -> 114.24.65.171 7701 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 16:07:07.821548 0.021113 udp 10.0.2.105 7010 <- 114.24.65.171 7701 RSP 0 0 5 2154 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 16:07:07.821934 0.193875 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.012981 0.123183 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.324279 0.044652 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.354650 0.135523 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.471871 0.172058 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.619379 0.106876 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.690190 0.068904 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.754675 0.253642 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:07:08.974485 0.062016 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:10:18.197948 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:10:25.207832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:10:33.206948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:10:49.210222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:11:21.216529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:11:45.411278 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:11:45.411391 2.994391 tcp 10.0.2.105 57849 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:11:54.409095 0.000000 tcp 10.0.2.105 57849 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:00.414240 0.047336 tcp 10.0.2.105 57850 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:00.461827 0.033387 tcp 10.0.2.105 57851 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:00.495458 0.125748 tcp 10.0.2.105 57852 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:00.632114 4.860916 tcp 10.0.2.105 57853 -> 46.48.223.67 15494 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:05.287965 0.031740 tcp 10.0.2.105 57854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:05.320002 0.033154 tcp 10.0.2.105 57855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:05.352968 0.120556 tcp 10.0.2.105 57856 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:05.493334 3.000452 tcp 10.0.2.105 57857 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:14.514061 0.000000 tcp 10.0.2.105 57857 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:20.491953 0.031767 tcp 10.0.2.105 57858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:20.524008 0.032126 tcp 10.0.2.105 57859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:20.556452 0.125088 tcp 10.0.2.105 57860 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:20.693069 3.002091 tcp 10.0.2.105 57861 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:29.694179 0.000000 tcp 10.0.2.105 57861 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:35.693370 1.762373 tcp 10.0.2.105 57862 -> 46.48.223.67 15494 FSPA* 0 0 12 1461 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:12:37.455935 3.003889 tcp 10.0.2.105 57863 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:12:46.459103 0.000000 tcp 10.0.2.105 57863 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:17:25.223310 3.000135 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:17:32.229470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:17:40.231136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:17:52.458761 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:17:52.458933 3.003693 tcp 10.0.2.105 57864 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:17:56.233848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:18:01.461481 0.000000 tcp 10.0.2.105 57864 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:18:07.461821 0.031824 tcp 10.0.2.105 57865 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:07.493914 0.032945 tcp 10.0.2.105 57866 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:07.527131 0.125271 tcp 10.0.2.105 57867 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:07.667635 4.723098 tcp 10.0.2.105 57868 -> 46.48.223.67 15494 FSPA* 0 0 14 1619 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:12.195291 0.032068 tcp 10.0.2.105 57869 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:12.227704 0.031923 tcp 10.0.2.105 57870 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:12.259956 0.120454 tcp 10.0.2.105 57871 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:12.390935 3.000464 tcp 10.0.2.105 57872 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:18:21.390046 0.000000 tcp 10.0.2.105 57872 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:18:27.389675 0.031460 tcp 10.0.2.105 57873 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:27.421458 0.032058 tcp 10.0.2.105 57874 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:27.453786 0.121946 tcp 10.0.2.105 57875 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:27.586042 2.997290 tcp 10.0.2.105 57876 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:18:28.240122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:18:36.591892 0.000000 tcp 10.0.2.105 57876 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:18:42.580991 0.360400 tcp 10.0.2.105 57877 -> 46.48.223.67 15494 SPA_* 0 0 9 1089 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:56.364473 0.000376 tcp 10.0.2.105 57877 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:18:56.365114 2.999712 tcp 10.0.2.105 57878 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:19:05.364894 0.000000 tcp 10.0.2.105 57878 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:24:11.364002 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:24:11.364159 3.003306 tcp 10.0.2.105 57879 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:24:20.366489 0.000000 tcp 10.0.2.105 57879 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:24:26.366904 0.032857 tcp 10.0.2.105 57880 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:26.400073 0.033608 tcp 10.0.2.105 57881 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:26.433982 0.123408 tcp 10.0.2.105 57882 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:26.567271 0.367527 tcp 10.0.2.105 57883 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:32.245791 3.001995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:24:39.253478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:24:47.255037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:24:49.564861 0.205821 tcp 10.0.2.105 57883 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:49.565743 0.032150 tcp 10.0.2.105 57884 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:49.598175 0.032408 tcp 10.0.2.105 57885 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:49.630858 0.123539 tcp 10.0.2.105 57886 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:24:49.770937 3.002304 tcp 10.0.2.105 57887 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:24:58.771231 0.000000 tcp 10.0.2.105 57887 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:25:03.260286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:25:04.762007 0.031822 tcp 10.0.2.105 57888 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:25:04.794121 0.031908 tcp 10.0.2.105 57889 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:25:04.826279 0.128712 tcp 10.0.2.105 57890 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:25:04.976000 2.998465 tcp 10.0.2.105 57891 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:25:13.973000 0.000000 tcp 10.0.2.105 57891 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:25:19.972137 1.773019 tcp 10.0.2.105 57892 -> 46.48.223.67 15494 FSPA* 0 0 14 1585 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:25:21.714343 3.005487 tcp 10.0.2.105 57893 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:25:30.717446 0.000000 tcp 10.0.2.105 57893 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:25:35.267408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:30:36.714004 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:30:36.714198 3.007256 tcp 10.0.2.105 57894 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:30:45.710262 0.000000 tcp 10.0.2.105 57894 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:30:51.711154 0.032415 tcp 10.0.2.105 57895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:51.743879 0.032336 tcp 10.0.2.105 57896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:51.776515 0.124024 tcp 10.0.2.105 57897 -> 195.113.214.249 443 SRPA* 0 0 36 19082 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:51.913033 1.996945 tcp 10.0.2.105 57898 -> 46.48.223.67 15494 FSPA* 0 0 14 1757 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:53.713593 0.031004 tcp 10.0.2.105 57899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:53.744925 0.032840 tcp 10.0.2.105 57900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:53.778068 0.120308 tcp 10.0.2.105 57901 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:30:53.910295 2.998482 tcp 10.0.2.105 57902 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:02.904892 0.000000 tcp 10.0.2.105 57902 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:08.903601 0.030932 tcp 10.0.2.105 57903 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:31:08.934805 0.031986 tcp 10.0.2.105 57904 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:31:08.967111 0.121265 tcp 10.0.2.105 57905 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:31:09.183510 3.005188 tcp 10.0.2.105 57906 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:18.186824 0.000000 tcp 10.0.2.105 57906 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:24.175966 0.362129 tcp 10.0.2.105 57907 -> 46.48.223.67 15494 SPA_* 0 0 9 1227 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:31:36.772933 0.000429 tcp 10.0.2.105 57907 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:31:36.773622 3.004122 tcp 10.0.2.105 57908 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:39.270415 3.001407 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:31:45.776299 0.000000 tcp 10.0.2.105 57908 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:31:46.277393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:31:54.279176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:32:10.282188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:32:42.287982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:37:37.442286 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:37:37.442461 0.070613 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:37.538998 0.831064 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.068664 0.281297 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.331538 0.042598 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.369713 0.119472 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1979 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.471655 0.094313 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.556566 0.057490 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.612357 0.207897 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.790661 0.053326 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:38.922197 0.171795 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:39.091458 0.068272 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:39.143026 0.201234 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:39.348858 0.175154 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:39.469699 0.211235 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:39.664148 0.420937 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:40.062601 0.185040 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:40.251119 0.086530 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:40.299258 0.225979 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:40.491669 0.372300 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:40.835620 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 16:37:51.783186 0.352519 tcp 10.0.2.105 57909 -> 46.48.223.67 15494 SPA_* 0 0 9 1054 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:57.184912 0.209423 tcp 10.0.2.105 57909 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:57.187441 0.032466 tcp 10.0.2.105 57910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:57.220391 0.032489 tcp 10.0.2.105 57911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:57.253254 0.123441 tcp 10.0.2.105 57912 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:57.394640 0.362853 tcp 10.0.2.105 57913 -> 46.48.223.67 15494 SPA_* 0 0 9 1054 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:58.532935 0.031055 tcp 10.0.2.105 57914 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:58.564460 0.032287 tcp 10.0.2.105 57915 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:58.597038 0.125557 tcp 10.0.2.105 57916 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:37:58.723126 0.162770 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:58.878261 0.200442 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.008652 0.140273 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.141618 0.185516 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.303097 0.380724 udp 10.0.2.105 7010 <-> 114.24.65.171 7701 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.662808 0.193792 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.872105 0.124206 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:37:59.978326 0.047447 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.035236 0.104570 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.103822 0.064773 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.170326 0.247708 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.385061 0.067917 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.436683 0.093117 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:00.511313 0.168809 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 16:38:02.673199 0.000429 tcp 10.0.2.105 57913 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:38:46.293780 3.002027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 16:38:53.301688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:39:01.302832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:39:17.307536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:39:49.311706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:43:02.670168 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:43:02.670317 0.366201 tcp 10.0.2.105 57917 -> 46.48.223.67 15494 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:07.869240 0.216079 tcp 10.0.2.105 57917 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:07.871697 0.032244 tcp 10.0.2.105 57918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:07.904232 0.032829 tcp 10.0.2.105 57919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:07.937366 0.120880 tcp 10.0.2.105 57920 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:08.085546 3.006108 tcp 10.0.2.105 57921 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:43:17.090298 0.000000 tcp 10.0.2.105 57921 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:43:23.081771 0.031371 tcp 10.0.2.105 57922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:23.113514 0.032469 tcp 10.0.2.105 57923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:23.146317 0.122492 tcp 10.0.2.105 57924 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:23.278827 0.359094 tcp 10.0.2.105 57925 -> 46.48.223.67 15494 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:28.330272 0.000701 tcp 10.0.2.105 57925 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:43:28.330779 3.000181 tcp 10.0.2.105 57926 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:43:37.329612 0.000000 tcp 10.0.2.105 57926 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:45:53.318428 3.000866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:46:00.325415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:46:08.326610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:46:24.333248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:46:56.335858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:48:43.336701 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:48:43.336858 0.357835 tcp 10.0.2.105 57927 -> 46.48.223.67 15494 SPA_* 0 0 9 1237 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:48:57.784784 0.199783 tcp 10.0.2.105 57927 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:48:57.786573 0.031972 tcp 10.0.2.105 57928 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:48:57.818782 0.033072 tcp 10.0.2.105 57929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:48:57.852148 0.121027 tcp 10.0.2.105 57930 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:48:57.984743 3.000590 tcp 10.0.2.105 57931 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:49:06.983344 0.000000 tcp 10.0.2.105 57931 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:49:12.983023 0.031636 tcp 10.0.2.105 57932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:49:13.014946 0.031604 tcp 10.0.2.105 57933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:49:13.046799 0.122974 tcp 10.0.2.105 57934 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:49:13.179956 4.897039 tcp 10.0.2.105 57935 -> 46.48.223.67 15494 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:49:18.060561 2.993246 tcp 10.0.2.105 57936 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:49:27.062635 0.000000 tcp 10.0.2.105 57936 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:53:00.342766 3.000633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 16:53:07.349012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:53:15.351174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:53:31.353658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:54:03.359992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 16:54:33.053392 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 16:54:33.053569 4.814424 tcp 10.0.2.105 57937 -> 46.48.223.67 15494 SPA_* 0 0 12 1480 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:37.869863 0.032848 tcp 10.0.2.105 57938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:37.903060 0.032027 tcp 10.0.2.105 57939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:37.935423 0.123936 tcp 10.0.2.105 57940 -> 195.113.214.249 443 SRPA* 0 0 22 12070 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:38.075892 0.000072 tcp 10.0.2.105 57937 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:38.076209 2.997684 tcp 10.0.2.105 57941 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:54:47.082615 0.000000 tcp 10.0.2.105 57941 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:54:53.071729 0.031677 tcp 10.0.2.105 57942 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:53.103682 0.033145 tcp 10.0.2.105 57943 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:53.137129 0.125084 tcp 10.0.2.105 57944 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:54:53.273382 0.361971 tcp 10.0.2.105 57945 -> 46.48.223.67 15494 SPA_* 0 0 9 1058 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:55:10.886107 0.000392 tcp 10.0.2.105 57945 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 16:55:10.886801 2.996012 tcp 10.0.2.105 57946 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 16:55:19.880019 0.000000 tcp 10.0.2.105 57946 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:00:07.366186 3.001104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:00:14.373442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:00:22.374541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:00:25.883529 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:00:25.883716 1.971404 tcp 10.0.2.105 57947 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:27.657444 0.032346 tcp 10.0.2.105 57948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:27.690115 0.032971 tcp 10.0.2.105 57949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:27.723438 0.120357 tcp 10.0.2.105 57950 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:27.855345 3.001687 tcp 10.0.2.105 57951 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:00:36.855455 0.000000 tcp 10.0.2.105 57951 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:00:38.377722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:00:42.860685 0.031865 tcp 10.0.2.105 57952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:42.892870 0.033393 tcp 10.0.2.105 57953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:42.926570 0.126439 tcp 10.0.2.105 57954 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:43.072151 4.568356 tcp 10.0.2.105 57955 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:00:47.640741 2.989902 tcp 10.0.2.105 57956 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:00:56.625778 0.000000 tcp 10.0.2.105 57956 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:01:10.383495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:07:21.389679 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 17:07:28.401198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:07:36.398995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:07:52.401754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:08:04.249701 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:08:04.249837 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:08:21.858928 0.031924 tcp 10.0.2.105 57957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:21.891109 0.032328 tcp 10.0.2.105 57958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:21.923711 0.125690 tcp 10.0.2.105 57959 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:22.050115 0.073219 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:22.129652 1.629385 udp 10.0.2.105 7010 <-> 72.251.8.78 2321 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.060272 0.040211 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.112648 0.112997 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1370 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.204622 0.094627 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.289225 0.059797 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.347844 0.188524 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.508213 0.059425 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.566027 0.175323 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.738650 0.262119 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:23.980463 0.068627 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:24.054891 0.636095 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:24.410104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:08:24.670973 0.199498 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:24.879427 0.159558 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:24.987375 0.214973 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:25.183513 0.225854 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:25.373677 0.353290 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:25.696939 0.091102 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:25.747742 0.181845 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:25.919113 0.139720 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:26.050837 0.164794 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:26.207697 0.204996 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:26.338823 0.180516 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:26.495424 0.000000 udp 10.0.2.105 7010 -> 114.24.65.171 7701 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:08:32.639931 0.366157 tcp 10.0.2.105 57960 -> 46.48.223.67 15494 SPA_* 0 0 9 1032 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:42.384310 0.031489 tcp 10.0.2.105 57961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:42.416085 0.080973 tcp 10.0.2.105 57962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:42.497373 0.119858 tcp 10.0.2.105 57963 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:42.617707 0.188927 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:42.804136 0.130644 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:42.915171 0.046761 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:42.968695 0.109293 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:43.039356 0.067369 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:43.103334 0.092270 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:43.178001 0.168326 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:43.382458 0.250383 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:43.596991 0.068799 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:08:44.856274 0.197556 tcp 10.0.2.105 57960 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:44.856898 0.031551 tcp 10.0.2.105 57964 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:44.888731 0.031794 tcp 10.0.2.105 57965 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:44.920812 0.121564 tcp 10.0.2.105 57966 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:08:45.054058 2.997955 tcp 10.0.2.105 57967 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:08:54.050960 0.000000 tcp 10.0.2.105 57967 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:09:00.051250 0.031673 tcp 10.0.2.105 57968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:09:00.083249 0.032250 tcp 10.0.2.105 57969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:09:00.115898 0.124043 tcp 10.0.2.105 57970 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:09:00.266414 4.446672 tcp 10.0.2.105 57971 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:09:04.713297 3.006799 tcp 10.0.2.105 57972 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:09:13.718839 0.000000 tcp 10.0.2.105 57972 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:14:19.709300 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:14:19.709456 0.355339 tcp 10.0.2.105 57973 -> 46.48.223.67 15494 SPA_* 0 0 9 1235 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:28.344191 0.231497 tcp 10.0.2.105 57973 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:28.346120 0.036558 tcp 10.0.2.105 57974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:28.382974 0.036833 tcp 10.0.2.105 57975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:28.413746 3.001620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:14:28.420057 0.131722 tcp 10.0.2.105 57976 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:28.575960 2.999779 tcp 10.0.2.105 57977 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:14:35.425763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:14:37.575456 0.000000 tcp 10.0.2.105 57977 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:14:43.422740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:14:43.573514 0.036138 tcp 10.0.2.105 57978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:43.609922 0.037031 tcp 10.0.2.105 57979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:43.647237 0.128410 tcp 10.0.2.105 57980 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:43.879378 4.405387 tcp 10.0.2.105 57981 -> 46.48.223.67 15494 FSPA* 0 0 14 1765 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:14:48.284954 2.999048 tcp 10.0.2.105 57982 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:14:57.293159 0.000000 tcp 10.0.2.105 57982 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:14:59.425793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:15:31.431560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:20:03.285214 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:20:03.285393 4.582920 tcp 10.0.2.105 57983 -> 46.48.223.67 15494 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:07.655646 0.041349 tcp 10.0.2.105 57984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:07.697272 0.034078 tcp 10.0.2.105 57985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:07.731630 0.125610 tcp 10.0.2.105 57986 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:07.868524 2.998963 tcp 10.0.2.105 57987 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:20:16.874869 0.000000 tcp 10.0.2.105 57987 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:20:22.861312 0.032743 tcp 10.0.2.105 57988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:22.894365 0.034165 tcp 10.0.2.105 57989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:22.928813 0.129367 tcp 10.0.2.105 57990 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:23.070379 4.292176 tcp 10.0.2.105 57991 -> 46.48.223.67 15494 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:20:27.362792 2.998913 tcp 10.0.2.105 57992 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:20:36.359964 0.000000 tcp 10.0.2.105 57992 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:21:35.437393 3.001897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:21:42.445378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:21:50.447262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:22:06.450192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:22:38.455520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:25:42.360778 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:25:42.360951 0.361125 tcp 10.0.2.105 57993 -> 46.48.223.67 15494 SPA_* 0 0 9 1204 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:25:50.565773 0.228624 tcp 10.0.2.105 57993 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:25:50.567733 0.036659 tcp 10.0.2.105 57994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:25:50.604724 0.034219 tcp 10.0.2.105 57995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:25:50.639192 0.127016 tcp 10.0.2.105 57996 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:25:50.794655 3.001169 tcp 10.0.2.105 57997 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:25:59.795259 0.000000 tcp 10.0.2.105 57997 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:26:05.794455 0.036704 tcp 10.0.2.105 57998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:26:05.831520 0.035763 tcp 10.0.2.105 57999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:26:05.867622 0.129618 tcp 10.0.2.105 58000 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:26:06.013913 4.170401 tcp 10.0.2.105 58001 -> 46.48.223.67 15494 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:26:10.184134 3.000302 tcp 10.0.2.105 58002 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:26:19.193131 0.000000 tcp 10.0.2.105 58002 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:28:42.461949 3.002880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:28:49.469794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:28:57.470745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:29:13.473714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:29:45.479741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:35:49.485730 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 17:35:56.492905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:36:04.494538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:36:20.497729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:36:52.503700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:38:46.699536 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:38:46.699725 0.000000 udp 10.0.2.105 7010 -> 114.24.65.171 7701 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:39:01.761032 0.036890 tcp 10.0.2.105 58003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:01.798214 0.036782 tcp 10.0.2.105 58004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:01.835258 0.127262 tcp 10.0.2.105 58005 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:01.963077 0.068831 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:02.042909 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:39:09.716270 0.289655 udp 10.0.2.105 7010 <- 72.251.8.78 2321 RSP 0 0 3 1053 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:39:09.716668 0.116811 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:09.812466 0.095492 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:09.897951 0.058823 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:09.954973 0.185062 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:10.112403 0.000000 udp 10.0.2.105 7010 -> 217.220.223.100 6072 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 17:39:10.231868 1.951955 tcp 10.0.2.105 58006 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:11.971947 0.035879 tcp 10.0.2.105 58007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:12.008145 0.037777 tcp 10.0.2.105 58008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:12.046299 0.128474 tcp 10.0.2.105 58009 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:12.184047 0.385577 tcp 10.0.2.105 58010 -> 46.48.223.67 15494 SPA_* 0 0 9 1116 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:17.288610 0.000416 tcp 10.0.2.105 58010 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:25.445832 0.035622 tcp 10.0.2.105 58011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:25.481730 0.037518 tcp 10.0.2.105 58012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:25.519505 0.127142 tcp 10.0.2.105 58013 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:39:25.647158 0.175083 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:25.819457 0.235948 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.037211 0.069158 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.089713 0.039717 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.158465 0.091451 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.229064 0.177122 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.348306 0.213754 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.542861 0.228440 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.777740 0.203323 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:26.982415 0.139724 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.114794 0.164882 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.274134 0.207385 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.405540 0.180368 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.563910 0.091543 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.614761 0.358764 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:27.945456 0.184289 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.157570 0.197347 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.352239 0.124343 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.457982 0.045279 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.724653 0.105675 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.921060 0.064037 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:28.993657 0.092427 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:29.069010 0.163418 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:29.210878 0.248634 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:39:29.424957 0.062365 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/19 17:42:56.509579 3.001945 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:43:03.521273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:43:11.524523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:43:27.530469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:43:59.527467 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:44:17.283586 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:44:17.283731 1.973793 tcp 10.0.2.105 58014 -> 46.48.223.67 15494 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:19.047417 0.034274 tcp 10.0.2.105 58015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:19.081951 0.034520 tcp 10.0.2.105 58016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:19.116782 0.129389 tcp 10.0.2.105 58017 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:19.257853 3.002632 tcp 10.0.2.105 58018 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:44:28.259214 0.000000 tcp 10.0.2.105 58018 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:44:34.260867 0.035330 tcp 10.0.2.105 58019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:34.296520 0.033812 tcp 10.0.2.105 58020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:34.330606 0.128002 tcp 10.0.2.105 58021 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:34.468457 1.766734 tcp 10.0.2.105 58022 -> 46.48.223.67 15494 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:44:36.235415 2.999006 tcp 10.0.2.105 58023 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:44:45.233161 0.000000 tcp 10.0.2.105 58023 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:49:51.234206 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:49:51.234341 0.361769 tcp 10.0.2.105 58024 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:01.093774 0.231735 tcp 10.0.2.105 58024 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:01.095785 0.037213 tcp 10.0.2.105 58025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:01.133264 0.038428 tcp 10.0.2.105 58026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:01.171956 0.136040 tcp 10.0.2.105 58027 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:01.325742 3.002553 tcp 10.0.2.105 58028 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:50:10.328889 0.000000 tcp 10.0.2.105 58028 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:50:16.320825 0.033075 tcp 10.0.2.105 58029 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:16.354244 0.036661 tcp 10.0.2.105 58030 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:16.391261 0.134613 tcp 10.0.2.105 58031 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:16.536847 1.714273 tcp 10.0.2.105 58032 -> 46.48.223.67 15494 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:50:18.251274 2.995123 tcp 10.0.2.105 58033 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:50:27.244911 0.000000 tcp 10.0.2.105 58033 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:55:33.245787 0.000133 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 17:55:33.246024 0.364531 tcp 10.0.2.105 58034 -> 46.48.223.67 15494 SPA_* 0 0 9 1201 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:40.538523 3.001406 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 17:55:44.386704 0.221326 tcp 10.0.2.105 58034 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:44.389120 0.036946 tcp 10.0.2.105 58035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:44.426308 0.034736 tcp 10.0.2.105 58036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:44.461363 0.127143 tcp 10.0.2.105 58037 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:44.608408 2.997106 tcp 10.0.2.105 58038 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:55:47.545517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:55:53.605777 0.000000 tcp 10.0.2.105 58038 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:55:55.547338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:55:59.603439 0.036049 tcp 10.0.2.105 58039 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:59.639749 0.037251 tcp 10.0.2.105 58040 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:59.677332 0.132979 tcp 10.0.2.105 58041 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:55:59.830312 1.786572 tcp 10.0.2.105 58042 -> 46.48.223.67 15494 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/02/19 17:56:01.617116 3.009343 tcp 10.0.2.105 58043 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:56:10.619036 0.000000 tcp 10.0.2.105 58043 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 17:56:11.549835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 17:56:43.556261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:01:16.623011 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:01:16.623162 1.979976 tcp 10.0.2.105 58044 -> 46.48.223.67 15494 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:18.385330 0.034543 tcp 10.0.2.105 58045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:18.420136 0.037251 tcp 10.0.2.105 58046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:18.457642 0.122922 tcp 10.0.2.105 58047 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:18.603378 3.002370 tcp 10.0.2.105 58048 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:01:27.609807 0.000000 tcp 10.0.2.105 58048 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:01:33.616450 0.033686 tcp 10.0.2.105 58049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:33.650455 0.033981 tcp 10.0.2.105 58050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:33.684715 0.134788 tcp 10.0.2.105 58051 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:33.836293 0.353511 tcp 10.0.2.105 58052 -> 46.48.223.67 15494 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:40.824027 0.000363 tcp 10.0.2.105 58052 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:01:40.824591 3.003298 tcp 10.0.2.105 58053 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:01:49.825734 0.000000 tcp 10.0.2.105 58053 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:02:47.566068 2.997565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 18:02:54.569414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:03:02.571145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:03:18.574688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:03:50.580341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:09:30.969842 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:09:30.970027 0.054967 udp 10.0.2.105 7010 -> 217.220.223.100 6072 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 18:09:31.024994 0.000000 icmp 217.220.223.100 0x0303 -> 10.0.2.105 0xb817 URP 192 1 138 flow=Background 1970/02/19 18:09:49.227996 0.033648 tcp 10.0.2.105 58054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:09:49.261931 0.037071 tcp 10.0.2.105 58055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:09:49.299238 0.136205 tcp 10.0.2.105 58056 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:09:49.436115 0.071701 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:09:49.587890 0.095397 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:09:49.674587 0.059308 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:09:49.732026 0.186816 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:09:49.891400 0.185462 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:09:50.077278 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 18:09:55.844816 0.346495 tcp 10.0.2.105 58057 -> 46.48.223.67 15494 SPA_* 0 0 9 1053 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:03.589314 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 18:10:03.780165 0.214789 tcp 10.0.2.105 58057 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:03.781141 0.033965 tcp 10.0.2.105 58058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:03.815355 0.037124 tcp 10.0.2.105 58059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:03.852820 0.132118 tcp 10.0.2.105 58060 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:03.995253 1.752242 tcp 10.0.2.105 58061 -> 46.48.223.67 15494 FSPA* 0 0 14 1583 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:05.469627 0.033815 tcp 10.0.2.105 58062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:05.503772 0.034070 tcp 10.0.2.105 58063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:05.538124 0.125344 tcp 10.0.2.105 58064 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:10:05.664184 0.069738 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:05.715915 0.039618 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:05.755635 0.175671 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:05.927840 0.244048 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:06.151393 0.512422 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:06.642918 0.174796 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:06.762481 0.223620 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:06.967647 0.229831 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:07.159751 0.202681 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:07.383740 0.142517 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:07.517772 0.180788 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:07.673642 0.088609 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:07.737103 0.365700 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.075541 0.182713 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.283150 0.163550 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.436334 0.152760 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.541409 0.192428 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.730565 0.124234 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.834966 0.046791 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.871166 0.109373 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:08.939610 0.063039 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:09.024023 0.143222 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:09.147928 0.063413 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:09.232452 0.166620 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:09.421193 0.251235 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:10:10.596559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:10:18.597871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:10:34.601504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:11:06.607207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:15:05.741114 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:15:05.741261 2.293616 tcp 10.0.2.105 58065 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:07.814799 0.033955 tcp 10.0.2.105 58066 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:07.848990 0.034462 tcp 10.0.2.105 58067 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:07.883690 0.128104 tcp 10.0.2.105 58068 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:08.035146 3.003440 tcp 10.0.2.105 58069 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:15:17.037160 0.000000 tcp 10.0.2.105 58069 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:15:23.036116 0.036041 tcp 10.0.2.105 58070 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:23.072442 0.036380 tcp 10.0.2.105 58071 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:23.109156 0.130118 tcp 10.0.2.105 58072 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:23.253767 1.764948 tcp 10.0.2.105 58073 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:15:25.018952 3.004113 tcp 10.0.2.105 58074 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:15:34.021784 0.000000 tcp 10.0.2.105 58074 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:17:10.613156 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 18:17:17.620547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:17:25.621919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:17:41.625142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:18:13.631997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:20:40.021840 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:20:40.022031 2.002321 tcp 10.0.2.105 58075 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:41.803480 0.037579 tcp 10.0.2.105 58076 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:41.841337 0.037488 tcp 10.0.2.105 58077 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:41.879043 0.130820 tcp 10.0.2.105 58078 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:42.024675 3.004111 tcp 10.0.2.105 58079 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:20:51.027167 0.000000 tcp 10.0.2.105 58079 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:20:57.026357 0.033446 tcp 10.0.2.105 58080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:57.060095 0.034062 tcp 10.0.2.105 58081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:57.094454 0.136686 tcp 10.0.2.105 58082 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:57.248252 1.693789 tcp 10.0.2.105 58083 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:20:58.942308 3.000517 tcp 10.0.2.105 58084 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:21:07.951273 0.000000 tcp 10.0.2.105 58084 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:24:17.637362 3.006707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 18:24:24.645411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:24:32.645740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:24:48.649326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:25:20.655079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:26:13.942060 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:26:13.942170 2.897198 tcp 10.0.2.105 58085 -> 46.48.223.67 15494 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:16.623125 0.034133 tcp 10.0.2.105 58086 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:16.657590 0.037817 tcp 10.0.2.105 58087 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:16.695721 0.133659 tcp 10.0.2.105 58088 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:16.839577 3.000342 tcp 10.0.2.105 58089 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:26:25.838578 0.000000 tcp 10.0.2.105 58089 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:26:31.837977 0.036184 tcp 10.0.2.105 58090 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:31.874456 0.036730 tcp 10.0.2.105 58091 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:31.911424 0.133141 tcp 10.0.2.105 58092 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:32.061626 2.380596 tcp 10.0.2.105 58093 -> 46.48.223.67 15494 FSPA* 0 0 14 1616 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:26:34.442116 2.995114 tcp 10.0.2.105 58094 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:26:43.433982 0.000000 tcp 10.0.2.105 58094 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:31:24.661168 3.001898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 18:31:31.674959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:31:39.669632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:31:49.444686 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:31:49.444912 1.984014 tcp 10.0.2.105 58095 -> 46.48.223.67 15494 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:31:51.218056 0.036850 tcp 10.0.2.105 58096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:31:51.255175 0.034274 tcp 10.0.2.105 58097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:31:51.289748 0.130084 tcp 10.0.2.105 58098 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:31:51.429226 3.001752 tcp 10.0.2.105 58099 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:31:55.674920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:32:00.429923 0.000000 tcp 10.0.2.105 58099 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:32:06.429047 0.032494 tcp 10.0.2.105 58100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:32:06.461808 0.034582 tcp 10.0.2.105 58101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:32:06.496737 0.132301 tcp 10.0.2.105 58102 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:32:06.646650 1.755875 tcp 10.0.2.105 58103 -> 46.48.223.67 15494 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:32:08.402801 2.992913 tcp 10.0.2.105 58104 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:32:17.394141 0.000000 tcp 10.0.2.105 58104 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:32:27.679268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:38:31.685013 3.001497 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 18:38:38.692521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:38:46.693408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:39:02.696991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:39:34.702460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:40:37.243234 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:40:37.243346 0.000000 udp 10.0.2.105 7010 -> 72.251.8.78 2321 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 18:40:54.128893 0.036773 tcp 10.0.2.105 58105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:40:54.165931 0.038100 tcp 10.0.2.105 58106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:40:54.204331 0.134833 tcp 10.0.2.105 58107 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:40:54.339833 0.187808 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.498862 0.112618 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.588722 0.093229 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.673227 0.074866 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.747981 0.058767 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.826296 0.069914 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.877201 0.042524 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:54.924126 0.173466 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:55.094964 0.239168 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:55.313843 0.244925 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:55.535016 0.226397 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:55.725893 0.507749 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.213622 0.165543 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.329856 0.203759 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.542190 0.142747 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.677097 0.273824 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.928400 0.089552 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:56.975864 0.369194 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:57.317748 0.183181 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:57.518981 0.920368 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.427208 0.200133 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.549423 0.188405 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.734658 0.124997 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.838574 0.044996 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.868781 0.106208 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:58.936114 0.061600 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:59.008536 0.089093 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:59.079785 0.274405 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:59.319447 0.062348 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:40:59.395312 0.165352 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/19 18:41:08.427965 1.917011 tcp 10.0.2.105 58108 -> 46.48.223.67 15494 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:10.131337 0.035791 tcp 10.0.2.105 58109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:10.167434 0.034206 tcp 10.0.2.105 58110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:10.201927 0.131329 tcp 10.0.2.105 58111 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:10.345224 3.000273 tcp 10.0.2.105 58112 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:41:19.343348 0.000000 tcp 10.0.2.105 58112 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:41:25.342478 0.034134 tcp 10.0.2.105 58113 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:25.376893 0.037082 tcp 10.0.2.105 58114 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:25.414228 0.130892 tcp 10.0.2.105 58115 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:25.555063 1.691561 tcp 10.0.2.105 58116 -> 46.48.223.67 15494 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:41:27.246783 3.002334 tcp 10.0.2.105 58117 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:41:36.247667 0.000000 tcp 10.0.2.105 58117 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:45:38.708384 3.001869 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 18:45:45.715758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:45:53.717863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:46:09.720859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:46:41.727354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:46:42.248350 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:46:42.248532 1.968872 tcp 10.0.2.105 58118 -> 46.48.223.67 15494 FSPA* 0 0 14 1757 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:43.990650 0.037163 tcp 10.0.2.105 58119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:44.028095 0.037033 tcp 10.0.2.105 58120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:44.065455 0.128486 tcp 10.0.2.105 58121 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:44.217672 2.996941 tcp 10.0.2.105 58122 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:46:53.223569 0.000000 tcp 10.0.2.105 58122 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:46:59.212934 0.036585 tcp 10.0.2.105 58123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:59.249796 0.036745 tcp 10.0.2.105 58124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:59.286810 0.129291 tcp 10.0.2.105 58125 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:46:59.427113 1.713956 tcp 10.0.2.105 58126 -> 46.48.223.67 15494 FSPA* 0 0 14 1757 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:47:01.141269 2.997763 tcp 10.0.2.105 58127 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:47:10.137491 0.000000 tcp 10.0.2.105 58127 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:52:16.138056 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:52:16.138156 1.891093 tcp 10.0.2.105 58128 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:17.834936 0.033556 tcp 10.0.2.105 58129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:17.868758 0.034391 tcp 10.0.2.105 58130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:17.903414 0.111790 tcp 10.0.2.105 58131 -> 195.113.214.249 443 SRPA* 0 0 34 25422 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:18.029411 2.995650 tcp 10.0.2.105 58132 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:52:27.034830 0.000000 tcp 10.0.2.105 58132 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:52:33.022687 0.036116 tcp 10.0.2.105 58133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:33.059053 0.034773 tcp 10.0.2.105 58134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:33.094118 0.126641 tcp 10.0.2.105 58135 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:33.239503 1.738832 tcp 10.0.2.105 58136 -> 46.48.223.67 15494 FSPA* 0 0 14 1596 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:52:34.978537 3.004633 tcp 10.0.2.105 58137 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:52:43.977595 0.000000 tcp 10.0.2.105 58137 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:57:01.741061 3.001591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 18:57:08.748756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:57:16.749743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:57:32.752961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:57:49.978018 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 18:57:49.978172 0.382173 tcp 10.0.2.105 58138 -> 46.48.223.67 15494 SPA_* 0 0 9 1155 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:57:58.112615 0.215064 tcp 10.0.2.105 58138 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:57:58.115036 0.036991 tcp 10.0.2.105 58139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:57:58.152430 0.038604 tcp 10.0.2.105 58140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:57:58.191367 0.125780 tcp 10.0.2.105 58141 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:57:58.327928 2.995864 tcp 10.0.2.105 58142 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:58:04.760864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 18:58:07.332744 0.000000 tcp 10.0.2.105 58142 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:58:13.321996 0.035866 tcp 10.0.2.105 58143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:58:13.358105 0.033852 tcp 10.0.2.105 58144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:58:13.392309 0.127795 tcp 10.0.2.105 58145 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:58:13.559181 2.654243 tcp 10.0.2.105 58146 -> 46.48.223.67 15494 FSPA* 0 0 14 1685 flow=From-Botnet-V2-TCP-Established 1970/02/19 18:58:16.213597 3.005888 tcp 10.0.2.105 58147 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 18:58:25.218040 0.000000 tcp 10.0.2.105 58147 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:04:08.764482 3.002064 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 19:04:15.772818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:04:23.773375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:04:39.776693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:05:11.801735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:11:15.789410 3.001654 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 19:11:22.796206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:11:25.720927 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:11:25.721088 0.184342 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:25.877950 0.119626 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:25.977057 0.096626 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.062947 0.071561 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.136690 0.056070 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.191281 0.072333 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.244865 0.039748 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.307381 0.173470 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.477568 0.229630 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.721328 0.239005 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:26.939527 0.211930 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:27.133969 0.752616 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:27.866490 0.202395 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:27.986007 0.200172 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:28.207975 0.140141 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:28.340172 0.181211 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:28.499264 0.088556 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:28.678784 0.373396 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:29.054579 0.182739 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:29.537158 0.162159 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:29.692934 0.191738 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:29.819124 0.199917 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.016140 0.123846 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.121662 0.045793 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.170111 0.108424 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.241544 0.067585 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.311478 0.092740 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.385464 0.166962 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.552718 0.253786 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.771702 0.069936 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:11:30.797406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:11:31.259025 1.956748 tcp 10.0.2.105 58148 -> 46.48.223.67 15494 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:33.001217 0.033848 tcp 10.0.2.105 58149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:33.035435 0.038119 tcp 10.0.2.105 58150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:33.073933 0.130697 tcp 10.0.2.105 58151 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:33.216081 2.999542 tcp 10.0.2.105 58152 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:11:42.213959 0.000000 tcp 10.0.2.105 58152 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:11:46.800807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:11:48.213781 0.036830 tcp 10.0.2.105 58153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:48.250404 0.036444 tcp 10.0.2.105 58154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:48.287161 0.127700 tcp 10.0.2.105 58155 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:48.435023 1.715756 tcp 10.0.2.105 58156 -> 46.48.223.67 15494 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:11:50.150082 2.999773 tcp 10.0.2.105 58157 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:11:59.150760 0.000000 tcp 10.0.2.105 58157 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:12:18.806791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:17:05.139322 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:17:05.139480 1.981608 tcp 10.0.2.105 58158 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:06.909892 0.036903 tcp 10.0.2.105 58159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:06.947068 0.034839 tcp 10.0.2.105 58160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:06.982194 0.125301 tcp 10.0.2.105 58161 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:07.121464 2.994121 tcp 10.0.2.105 58162 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:17:16.114150 0.000000 tcp 10.0.2.105 58162 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:17:22.123503 0.032620 tcp 10.0.2.105 58163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:22.156574 0.036896 tcp 10.0.2.105 58164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:22.193706 0.136015 tcp 10.0.2.105 58165 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:22.340914 1.731250 tcp 10.0.2.105 58166 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:17:24.072381 2.997633 tcp 10.0.2.105 58167 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:17:33.068616 0.000000 tcp 10.0.2.105 58167 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:18:22.813137 3.001046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 19:18:29.820063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:18:37.823947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:18:53.824741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:19:25.830770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:22:39.069615 0.000196 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:22:39.069937 1.936723 tcp 10.0.2.105 58168 -> 46.48.223.67 15494 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:40.787804 0.034467 tcp 10.0.2.105 58169 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:40.822557 0.037410 tcp 10.0.2.105 58170 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:40.860273 0.135926 tcp 10.0.2.105 58171 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:41.006928 2.988817 tcp 10.0.2.105 58172 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:22:49.997240 0.000000 tcp 10.0.2.105 58172 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:22:55.993794 0.038128 tcp 10.0.2.105 58173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:56.032387 0.034214 tcp 10.0.2.105 58174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:56.066942 0.127927 tcp 10.0.2.105 58175 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:56.206205 1.776310 tcp 10.0.2.105 58176 -> 46.48.223.67 15494 FSPA* 0 0 14 1621 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:22:57.982701 2.997549 tcp 10.0.2.105 58177 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:23:06.978852 0.000000 tcp 10.0.2.105 58177 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:25:29.836371 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 19:25:36.843591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:25:44.849480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:26:00.848673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:26:32.854904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:28:12.979802 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:28:12.979924 1.956426 tcp 10.0.2.105 58178 -> 46.48.223.67 15494 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:14.716996 0.037644 tcp 10.0.2.105 58179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:14.754916 0.034680 tcp 10.0.2.105 58180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:14.789857 0.130231 tcp 10.0.2.105 58181 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:14.936653 2.998421 tcp 10.0.2.105 58182 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:28:23.934205 0.000000 tcp 10.0.2.105 58182 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:28:29.933818 0.035478 tcp 10.0.2.105 58183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:29.969589 0.034979 tcp 10.0.2.105 58184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:30.004851 0.126307 tcp 10.0.2.105 58185 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:30.150230 0.342808 tcp 10.0.2.105 58186 -> 46.48.223.67 15494 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:38.826923 0.000355 tcp 10.0.2.105 58186 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:28:38.827476 3.002694 tcp 10.0.2.105 58187 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:28:47.829215 0.000000 tcp 10.0.2.105 58187 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:32:36.860741 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 19:32:43.868159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:32:51.869644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:33:07.872727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:33:39.879009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:39:43.886839 2.999040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 19:39:50.892006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:39:58.893588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:40:14.896805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:40:46.902589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:41:45.269272 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:41:45.269471 0.095443 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:45.356895 0.069583 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:45.439990 0.058984 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:45.792110 0.186138 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:45.948185 0.115299 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:46.091195 0.070528 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:46.145415 0.041729 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:46.423459 0.172632 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:46.592589 0.230228 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:47.017052 0.239218 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:47.234545 0.213524 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:47.596452 0.203670 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:47.817189 0.678546 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:48.474297 0.179366 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:48.598439 0.141033 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:48.731709 0.185527 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:48.977935 0.085798 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.027418 0.415966 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.414530 0.160611 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.509306 0.187693 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.693878 0.123646 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.800560 0.046737 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:49.850034 0.182073 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.009168 0.167357 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.164044 0.113315 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.238334 0.066773 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.315091 0.086513 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.382985 0.164647 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.523358 0.256310 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:50.741740 0.069815 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/19 19:41:53.879436 0.345246 tcp 10.0.2.105 58188 -> 46.48.223.67 15494 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:41:58.991649 0.206642 tcp 10.0.2.105 58188 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:41:58.993697 0.033876 tcp 10.0.2.105 58189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:41:59.027816 0.034341 tcp 10.0.2.105 58190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:41:59.062397 0.126247 tcp 10.0.2.105 58191 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:41:59.198458 3.003011 tcp 10.0.2.105 58192 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:42:08.199993 0.000000 tcp 10.0.2.105 58192 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:42:14.198995 0.033794 tcp 10.0.2.105 58193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:42:14.233055 0.034567 tcp 10.0.2.105 58194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:42:14.267833 0.129715 tcp 10.0.2.105 58195 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:42:14.413849 1.346118 tcp 10.0.2.105 58196 -> 46.48.223.67 15494 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:42:24.199528 0.000406 tcp 10.0.2.105 58196 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:42:24.200242 2.996688 tcp 10.0.2.105 58197 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:42:33.195330 0.000000 tcp 10.0.2.105 58197 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:46:50.907554 3.002970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 19:46:57.915675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:47:05.917641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:47:21.920652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:47:39.196406 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:47:39.196559 0.350389 tcp 10.0.2.105 58198 -> 46.48.223.67 15494 SPA_* 0 0 9 1191 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:47:53.776751 0.228336 tcp 10.0.2.105 58198 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:47:53.778631 0.033938 tcp 10.0.2.105 58199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:47:53.812858 0.037353 tcp 10.0.2.105 58200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:47:53.850521 0.131173 tcp 10.0.2.105 58201 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:47:53.929840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:47:54.005400 2.995894 tcp 10.0.2.105 58202 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:48:02.999200 0.000000 tcp 10.0.2.105 58202 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:48:08.998677 0.032941 tcp 10.0.2.105 58203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:48:09.031863 0.034285 tcp 10.0.2.105 58204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:48:09.066407 0.131915 tcp 10.0.2.105 58205 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:48:09.210288 0.347683 tcp 10.0.2.105 58206 -> 46.48.223.67 15494 SPA_* 0 0 9 1191 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:48:14.608656 0.000396 tcp 10.0.2.105 58206 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:48:14.609261 3.001562 tcp 10.0.2.105 58207 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:48:23.609386 0.000000 tcp 10.0.2.105 58207 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:53:29.610130 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:53:29.610318 1.963563 tcp 10.0.2.105 58208 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:31.342808 0.036119 tcp 10.0.2.105 58209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:31.379207 0.039149 tcp 10.0.2.105 58210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:31.418690 0.141438 tcp 10.0.2.105 58211 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:31.574077 3.007647 tcp 10.0.2.105 58212 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:53:40.574898 0.000000 tcp 10.0.2.105 58212 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:53:46.573983 0.032759 tcp 10.0.2.105 58213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:46.607073 0.035532 tcp 10.0.2.105 58214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:46.642932 0.134846 tcp 10.0.2.105 58215 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:46.787048 2.755400 tcp 10.0.2.105 58216 -> 46.48.223.67 15494 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:53:49.542725 2.999353 tcp 10.0.2.105 58217 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:53:57.933149 3.004292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 19:53:58.540883 0.000000 tcp 10.0.2.105 58217 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:54:04.939808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:54:12.941531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:54:28.950556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:55:00.950887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 19:59:04.541532 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 19:59:04.541720 1.982406 tcp 10.0.2.105 58218 -> 46.48.223.67 15494 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:06.300540 0.038346 tcp 10.0.2.105 58219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:06.339212 0.035272 tcp 10.0.2.105 58220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:06.374739 0.131616 tcp 10.0.2.105 58221 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:06.524353 3.003362 tcp 10.0.2.105 58222 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:59:15.526898 0.000000 tcp 10.0.2.105 58222 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:59:21.525704 0.032911 tcp 10.0.2.105 58223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:21.558917 0.037807 tcp 10.0.2.105 58224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:21.596998 0.130581 tcp 10.0.2.105 58225 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:21.753882 1.720699 tcp 10.0.2.105 58226 -> 46.48.223.67 15494 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/19 19:59:23.474779 3.007851 tcp 10.0.2.105 58227 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 19:59:32.480954 0.000000 tcp 10.0.2.105 58227 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:01:04.957387 3.000933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 20:01:11.963519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:01:19.965394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:01:35.968809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:02:07.974315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:08:11.981036 3.002446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 20:08:18.987957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:08:26.991911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:08:42.991935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:09:14.998326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:12:10.363463 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:12:10.363682 0.060045 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.422603 0.186693 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.580699 0.108354 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.667588 0.071029 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.720597 0.094087 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.805191 0.088040 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.894908 0.043823 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:10.934379 0.171720 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:11.102591 0.221719 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:11.292781 0.202448 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:11.510148 0.238093 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:11.727585 0.212688 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:11.921965 0.667395 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:12.567225 0.166722 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:12.682768 0.140476 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:12.814878 0.179348 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:12.972220 0.086963 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:13.018796 0.471384 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:13.461493 0.211704 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:13.605333 0.190823 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:13.811409 0.124446 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:14.154374 0.045361 udp 10.0.2.105 7010 <-> 79.227.179.121 2430 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:14.187553 0.180378 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:14.498012 0.162380 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:14.651956 0.143171 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:14.777845 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 20:12:23.520400 2.120925 tcp 10.0.2.105 58228 -> 46.48.223.67 15494 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:25.351739 0.036433 tcp 10.0.2.105 58229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:25.388468 0.036734 tcp 10.0.2.105 58230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:25.425481 0.131514 tcp 10.0.2.105 58231 -> 195.113.214.249 443 SRPA* 0 0 50 44032 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:25.641567 2.995452 tcp 10.0.2.105 58232 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:12:33.304394 0.032979 tcp 10.0.2.105 58233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:33.337673 0.034514 tcp 10.0.2.105 58234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:33.372425 0.128373 tcp 10.0.2.105 58235 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:33.501352 0.256308 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:33.722359 0.062324 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:33.927944 0.107518 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:34.467408 0.063884 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:12:34.635905 0.000000 tcp 10.0.2.105 58232 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:12:40.636477 0.032700 tcp 10.0.2.105 58236 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:40.669463 0.034572 tcp 10.0.2.105 58237 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:40.704402 0.133719 tcp 10.0.2.105 58238 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:40.849470 0.358054 tcp 10.0.2.105 58239 -> 46.48.223.67 15494 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:47.691984 0.000602 tcp 10.0.2.105 58239 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:12:47.692758 2.996115 tcp 10.0.2.105 58240 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:12:56.690620 0.000000 tcp 10.0.2.105 58240 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:15:19.005848 2.999830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 20:15:26.012050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:15:34.013328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:15:50.021575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:16:22.025218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:18:02.687751 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:18:02.687848 0.372475 tcp 10.0.2.105 58241 -> 46.48.223.67 15494 SPA_* 0 0 9 1232 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:18.712478 0.219532 tcp 10.0.2.105 58241 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:18.714440 0.036989 tcp 10.0.2.105 58242 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:18.751889 0.037660 tcp 10.0.2.105 58243 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:18.789824 0.132008 tcp 10.0.2.105 58244 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:18.932288 3.000751 tcp 10.0.2.105 58245 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:18:27.922770 0.000000 tcp 10.0.2.105 58245 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:18:33.932713 0.036151 tcp 10.0.2.105 58246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:33.969103 0.037896 tcp 10.0.2.105 58247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:34.007338 0.128056 tcp 10.0.2.105 58248 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:34.190472 0.371317 tcp 10.0.2.105 58249 -> 46.48.223.67 15494 SPA_* 0 0 9 1232 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:40.493341 0.000395 tcp 10.0.2.105 58249 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:18:40.493976 3.001767 tcp 10.0.2.105 58250 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:18:49.494694 0.000000 tcp 10.0.2.105 58250 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:22:26.028027 3.002236 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 20:22:33.039929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:22:41.040275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:22:57.040637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:23:29.047090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:23:55.494926 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:23:55.495107 2.013598 tcp 10.0.2.105 58251 -> 46.48.223.67 15494 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:23:57.287394 0.036733 tcp 10.0.2.105 58252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:23:57.324405 0.034321 tcp 10.0.2.105 58253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:23:57.358994 0.130950 tcp 10.0.2.105 58254 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:23:57.508938 3.004100 tcp 10.0.2.105 58255 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:24:06.511533 0.000000 tcp 10.0.2.105 58255 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:24:12.509540 0.035966 tcp 10.0.2.105 58256 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:24:12.545784 0.034232 tcp 10.0.2.105 58257 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:24:12.580480 0.124766 tcp 10.0.2.105 58258 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:24:12.724879 1.849455 tcp 10.0.2.105 58259 -> 46.48.223.67 15494 FSPA* 0 0 14 1667 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:24:14.574534 3.001761 tcp 10.0.2.105 58260 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:24:23.574583 0.000000 tcp 10.0.2.105 58260 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:29:29.575494 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:29:29.575708 0.379261 tcp 10.0.2.105 58261 -> 46.48.223.67 15494 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:33.052955 3.000717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 20:29:35.382730 0.221656 tcp 10.0.2.105 58261 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:35.385120 0.035555 tcp 10.0.2.105 58262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:35.420996 0.035571 tcp 10.0.2.105 58263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:35.456836 0.131348 tcp 10.0.2.105 58264 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:35.604613 3.003043 tcp 10.0.2.105 58265 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:29:40.059958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:29:44.606145 0.000000 tcp 10.0.2.105 58265 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:29:48.061353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:29:50.605638 0.036208 tcp 10.0.2.105 58266 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:50.642143 0.036376 tcp 10.0.2.105 58267 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:50.678769 0.126150 tcp 10.0.2.105 58268 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:50.819118 1.840648 tcp 10.0.2.105 58269 -> 46.48.223.67 15494 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:29:52.659976 3.002255 tcp 10.0.2.105 58270 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:30:01.663007 0.000000 tcp 10.0.2.105 58270 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:30:04.064283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:30:36.070556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:35:07.661495 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:35:07.661603 0.374925 tcp 10.0.2.105 58271 -> 46.48.223.67 15494 SPA_* 0 0 9 1042 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:35:21.730541 0.247697 tcp 10.0.2.105 58271 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:35:21.732991 0.037017 tcp 10.0.2.105 58272 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:35:21.770343 0.037188 tcp 10.0.2.105 58273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:35:21.807804 0.133802 tcp 10.0.2.105 58274 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:35:21.978504 1.920805 tcp 10.0.2.105 58275 -> 46.48.223.67 15494 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:36:40.076544 3.001265 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 20:36:47.083607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:36:55.085530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:37:11.089748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:37:43.093798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:42:47.382346 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:42:47.382449 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 20:43:04.438903 0.034361 tcp 10.0.2.105 58276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:04.473515 0.037558 tcp 10.0.2.105 58277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:04.511451 0.137049 tcp 10.0.2.105 58278 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:04.649190 0.184751 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:04.805418 0.101124 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:04.885960 0.075435 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:04.945079 0.094823 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.030978 0.071657 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.111671 0.042852 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.170195 0.172294 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.339514 0.059372 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.397223 0.238401 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.613920 0.212845 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:05.809222 0.201139 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.012667 0.232023 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.245016 0.140318 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.377894 0.185502 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.538201 0.081316 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.612637 0.366084 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.810528 0.097817 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.884621 0.125961 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:06.991038 0.000000 udp 10.0.2.105 7010 -> 79.227.179.121 2430 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 20:43:08.913220 0.378237 tcp 10.0.2.105 58279 -> 46.48.223.67 15494 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:18.376815 0.213501 tcp 10.0.2.105 58279 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:18.377582 0.033115 tcp 10.0.2.105 58280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:18.410980 0.036620 tcp 10.0.2.105 58281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:18.447882 0.132483 tcp 10.0.2.105 58282 -> 195.113.214.249 443 SRPA* 0 0 21 12394 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:18.590588 3.000498 tcp 10.0.2.105 58283 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:43:24.475983 0.032376 tcp 10.0.2.105 58284 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:24.508657 0.037707 tcp 10.0.2.105 58285 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:24.546631 0.133842 tcp 10.0.2.105 58286 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:24.681012 0.379874 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.033058 0.203394 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.154683 0.192415 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.344187 0.088643 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.418472 0.222753 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.632466 0.181893 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:25.822900 0.282889 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:26.074484 0.067390 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:26.132711 0.105226 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:26.201061 0.067197 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/19 20:43:27.590757 0.000000 tcp 10.0.2.105 58283 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:43:33.591619 0.036013 tcp 10.0.2.105 58287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:33.627909 0.034523 tcp 10.0.2.105 58288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:33.662699 0.138628 tcp 10.0.2.105 58289 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:33.811066 0.381578 tcp 10.0.2.105 58290 -> 46.48.223.67 15494 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:47.100025 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 20:43:50.695156 0.000361 tcp 10.0.2.105 58290 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:43:50.695697 3.001569 tcp 10.0.2.105 58291 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:43:54.107763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:43:59.695589 0.000000 tcp 10.0.2.105 58291 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:44:02.109248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:44:18.112549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:44:50.118770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:49:05.696893 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:49:05.697065 0.384530 tcp 10.0.2.105 58292 -> 46.48.223.67 15494 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:16.977436 0.230427 tcp 10.0.2.105 58292 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:16.979393 0.036282 tcp 10.0.2.105 58293 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:17.015944 0.037820 tcp 10.0.2.105 58294 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:17.054100 0.131602 tcp 10.0.2.105 58295 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:17.208083 2.998665 tcp 10.0.2.105 58296 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:49:26.205303 0.000000 tcp 10.0.2.105 58296 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:49:32.204229 0.033060 tcp 10.0.2.105 58297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:32.237538 0.036820 tcp 10.0.2.105 58298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:32.274676 0.131571 tcp 10.0.2.105 58299 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:32.424637 0.377605 tcp 10.0.2.105 58300 -> 46.48.223.67 15494 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:58.859123 0.000418 tcp 10.0.2.105 58300 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:49:58.859759 2.996738 tcp 10.0.2.105 58301 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:50:07.855273 0.000000 tcp 10.0.2.105 58301 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:55:13.858212 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 20:55:13.858320 0.376363 tcp 10.0.2.105 58302 -> 46.48.223.67 15494 SPA_* 0 0 9 1176 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:29.089947 0.231309 tcp 10.0.2.105 58302 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:29.091872 0.034031 tcp 10.0.2.105 58303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:29.126147 0.037374 tcp 10.0.2.105 58304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:29.163844 0.132584 tcp 10.0.2.105 58305 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:29.321492 3.000571 tcp 10.0.2.105 58306 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:55:38.320187 0.000000 tcp 10.0.2.105 58306 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:55:44.319932 0.052784 tcp 10.0.2.105 58307 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:44.373037 0.033998 tcp 10.0.2.105 58308 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:44.407333 0.132596 tcp 10.0.2.105 58309 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:44.656400 1.874527 tcp 10.0.2.105 58310 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/19 20:55:46.531255 2.995328 tcp 10.0.2.105 58311 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:55:55.524893 0.000000 tcp 10.0.2.105 58311 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 20:56:02.127367 3.001963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 20:56:09.134508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:56:17.136005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:56:33.139425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 20:57:05.144914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:01:01.525463 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:01:01.525651 2.004036 tcp 10.0.2.105 58312 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:03.255243 0.033443 tcp 10.0.2.105 58313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:03.288941 0.033812 tcp 10.0.2.105 58314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:03.323043 0.196340 tcp 10.0.2.105 58315 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:03.529927 3.002735 tcp 10.0.2.105 58316 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:01:12.531219 0.000000 tcp 10.0.2.105 58316 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:01:18.530322 0.036264 tcp 10.0.2.105 58317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:18.566854 0.033880 tcp 10.0.2.105 58318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:18.601010 0.127950 tcp 10.0.2.105 58319 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:18.738980 0.349021 tcp 10.0.2.105 58320 -> 46.48.223.67 15494 SPA_* 0 0 9 1027 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:28.037188 0.000328 tcp 10.0.2.105 58320 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:01:28.037759 2.999707 tcp 10.0.2.105 58321 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:01:37.035604 0.000000 tcp 10.0.2.105 58321 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:03:09.151379 3.001415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:03:16.158398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:03:24.161991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:03:40.163176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:04:12.169269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:06:43.035884 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:06:43.035973 4.868201 tcp 10.0.2.105 58322 -> 46.48.223.67 15494 FSPA* 0 0 15 1652 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:06:47.309060 0.033844 tcp 10.0.2.105 58323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:06:47.343188 0.040320 tcp 10.0.2.105 58324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:06:47.383805 0.128174 tcp 10.0.2.105 58325 -> 195.113.214.249 443 SRPA* 0 0 43 36354 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:06:47.523188 1.806026 tcp 10.0.2.105 58326 -> 46.48.223.67 15494 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:10:19.179365 3.001735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 21:10:26.186902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:10:34.188432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:10:50.191541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:11:22.197358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:13:27.477876 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:13:27.477990 0.000000 udp 10.0.2.105 7010 -> 79.227.179.121 2430 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 21:13:45.775471 0.034456 tcp 10.0.2.105 58327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:13:45.810312 0.034787 tcp 10.0.2.105 58328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:13:45.845436 0.134337 tcp 10.0.2.105 58329 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:13:45.980507 0.111234 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.070554 0.075942 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.128719 0.094630 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.213796 0.072807 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.285825 0.038404 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.331326 0.209676 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.514081 0.238277 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.730605 0.172674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:46.898313 0.203884 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.103350 0.244775 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.297323 0.059708 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.355215 0.229410 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.549064 0.083899 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.598321 0.174929 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:47.720862 0.889138 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:48.589062 0.124979 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:48.695297 0.180819 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:48.853734 0.137732 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:48.983678 0.357303 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:49.313710 0.193326 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:49.344775 0.356324 tcp 10.0.2.105 58330 -> 46.48.223.67 15494 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:13:49.455786 0.188764 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:49.641044 0.092957 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:49.715368 0.164603 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:49.871115 0.178182 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:50.026958 0.283584 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:50.274079 0.068224 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:50.348461 0.111235 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:13:50.421789 0.064252 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:14:00.700351 0.207981 tcp 10.0.2.105 58330 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:00.701114 0.033831 tcp 10.0.2.105 58331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:00.735191 0.034363 tcp 10.0.2.105 58332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:00.769812 0.126793 tcp 10.0.2.105 58333 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:00.908623 3.002224 tcp 10.0.2.105 58334 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:14:09.908739 0.000000 tcp 10.0.2.105 58334 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:14:15.907732 0.033109 tcp 10.0.2.105 58335 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:15.941088 0.037213 tcp 10.0.2.105 58336 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:15.978153 0.127469 tcp 10.0.2.105 58337 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:16.129079 3.514727 tcp 10.0.2.105 58338 -> 46.48.223.67 15494 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:14:19.228840 3.002330 tcp 10.0.2.105 58339 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:14:28.225008 0.000000 tcp 10.0.2.105 58339 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:17:26.203951 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:17:33.210964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:17:41.212076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:17:57.215494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:18:29.221129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:19:34.225133 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:19:34.225345 0.362167 tcp 10.0.2.105 58340 -> 46.48.223.67 15494 SPA_* 0 0 9 1223 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:19:46.624744 0.211655 tcp 10.0.2.105 58340 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:19:46.626697 0.034135 tcp 10.0.2.105 58341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:19:46.661113 0.034038 tcp 10.0.2.105 58342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:19:46.695440 0.131170 tcp 10.0.2.105 58343 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:19:46.836695 3.000422 tcp 10.0.2.105 58344 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:19:55.835862 0.000000 tcp 10.0.2.105 58344 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:20:01.835247 0.033374 tcp 10.0.2.105 58345 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:20:01.868978 0.034407 tcp 10.0.2.105 58346 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:20:01.903723 0.126287 tcp 10.0.2.105 58347 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:20:02.040427 0.385751 tcp 10.0.2.105 58348 -> 46.48.223.67 15494 SPA_* 0 0 9 1223 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:20:19.749246 0.000345 tcp 10.0.2.105 58348 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:20:19.749832 2.994689 tcp 10.0.2.105 58349 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:20:28.752729 0.000000 tcp 10.0.2.105 58349 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:24:33.227694 3.001336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:24:40.234856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:24:48.236211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:25:04.239376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:25:34.743394 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:25:34.743592 0.349097 tcp 10.0.2.105 58350 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:36.245261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:25:43.448616 0.224957 tcp 10.0.2.105 58350 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:43.450495 0.034357 tcp 10.0.2.105 58351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:43.485158 0.034329 tcp 10.0.2.105 58352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:43.519736 0.130253 tcp 10.0.2.105 58353 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:43.673793 3.006264 tcp 10.0.2.105 58354 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:25:52.678911 0.000000 tcp 10.0.2.105 58354 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:25:58.667912 0.034296 tcp 10.0.2.105 58355 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:58.702464 0.033554 tcp 10.0.2.105 58356 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:58.736286 0.134428 tcp 10.0.2.105 58357 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:25:58.881186 0.351775 tcp 10.0.2.105 58358 -> 46.48.223.67 15494 SPA_* 0 0 9 1012 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:26:09.261606 0.000370 tcp 10.0.2.105 58358 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:26:09.262233 2.994927 tcp 10.0.2.105 58359 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:26:18.255771 0.000000 tcp 10.0.2.105 58359 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:31:24.256593 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:31:24.256789 0.365273 tcp 10.0.2.105 58360 -> 46.48.223.67 15494 SPA_* 0 0 9 1210 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:40.251403 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:31:43.791030 0.212541 tcp 10.0.2.105 58360 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:43.793110 0.034346 tcp 10.0.2.105 58361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:43.827782 0.034768 tcp 10.0.2.105 58362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:43.862809 0.131029 tcp 10.0.2.105 58363 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:44.003794 3.004878 tcp 10.0.2.105 58364 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:31:47.258989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:31:53.007166 0.000000 tcp 10.0.2.105 58364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:31:55.260149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:31:58.996214 0.033142 tcp 10.0.2.105 58365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:59.029658 0.034363 tcp 10.0.2.105 58366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:59.064350 0.134654 tcp 10.0.2.105 58367 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:31:59.209275 1.786852 tcp 10.0.2.105 58368 -> 46.48.223.67 15494 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:32:00.996325 3.006526 tcp 10.0.2.105 58369 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:32:10.001365 0.000000 tcp 10.0.2.105 58369 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:32:11.263429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:32:43.269590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:38:47.275911 3.000975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 21:38:54.283293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:39:02.284370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:39:18.287189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:39:50.293369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:43:55.396088 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:43:55.396185 0.093917 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:55.481091 0.123288 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:55.583636 0.069540 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 1947 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:55.695332 1.281757 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:56.975301 0.042755 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.013559 0.184709 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.173642 0.237215 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.390428 0.171431 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.559083 0.201547 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.776736 0.225534 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:57.968410 0.083797 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:58.016374 0.174069 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:58.139244 0.212348 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:58.333912 0.062261 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:58.397433 0.709481 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.003348 0.128577 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.134485 0.203024 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.317229 0.138482 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.447505 0.393568 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.811914 0.123532 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:43:59.901615 0.188348 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.085984 0.090287 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.157527 0.412931 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.561804 0.185841 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.738076 0.114226 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.809662 0.063818 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:00.874708 0.252958 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:01.034090 0.347512 tcp 10.0.2.105 58370 -> 46.48.223.67 15494 SPA_* 0 0 9 1193 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:01.091644 0.068586 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/19 21:44:14.130582 0.212920 tcp 10.0.2.105 58370 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:14.133013 0.036250 tcp 10.0.2.105 58371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:14.169524 0.034713 tcp 10.0.2.105 58372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:14.204514 0.128185 tcp 10.0.2.105 58373 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:14.343738 2.993468 tcp 10.0.2.105 58374 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:44:23.335735 0.000000 tcp 10.0.2.105 58374 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:44:29.335130 0.045441 tcp 10.0.2.105 58375 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:29.380993 0.034049 tcp 10.0.2.105 58376 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:29.415388 0.127215 tcp 10.0.2.105 58377 -> 195.113.214.249 443 SRPA* 0 0 24 12592 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:29.556141 1.889417 tcp 10.0.2.105 58378 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:44:31.445758 2.997693 tcp 10.0.2.105 58379 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:44:40.440919 0.000000 tcp 10.0.2.105 58379 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:45:54.299337 3.001935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:46:01.306951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:46:09.308033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:46:25.311466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:46:57.317327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:49:46.440821 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:49:46.440991 1.976115 tcp 10.0.2.105 58380 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:49:48.195569 0.036826 tcp 10.0.2.105 58381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:49:48.232627 0.038124 tcp 10.0.2.105 58382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:49:48.271012 0.135621 tcp 10.0.2.105 58383 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:49:48.417350 3.000157 tcp 10.0.2.105 58384 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:49:57.416068 0.000000 tcp 10.0.2.105 58384 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:50:03.415506 0.035493 tcp 10.0.2.105 58385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:50:03.451279 0.035989 tcp 10.0.2.105 58386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:50:03.487545 0.129454 tcp 10.0.2.105 58387 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:50:03.649947 0.350730 tcp 10.0.2.105 58388 -> 46.48.223.67 15494 SPA_* 0 0 9 1153 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:50:21.554415 0.000415 tcp 10.0.2.105 58388 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:50:21.555100 3.000097 tcp 10.0.2.105 58389 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:50:30.553742 0.000000 tcp 10.0.2.105 58389 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:53:01.324150 3.000857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 21:53:08.331033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:53:16.332131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:53:32.335328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:54:04.341339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 21:55:36.557344 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 21:55:36.557532 2.297596 tcp 10.0.2.105 58390 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:38.636665 0.036361 tcp 10.0.2.105 58391 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:38.673247 0.037111 tcp 10.0.2.105 58392 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:38.710613 0.134058 tcp 10.0.2.105 58393 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:38.855380 3.005992 tcp 10.0.2.105 58394 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:55:47.859932 0.000000 tcp 10.0.2.105 58394 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:55:53.851889 0.033491 tcp 10.0.2.105 58395 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:53.885693 0.035391 tcp 10.0.2.105 58396 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:53.921442 0.132455 tcp 10.0.2.105 58397 -> 195.113.214.249 443 SRPA* 0 0 70 69958 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:54.075547 2.774243 tcp 10.0.2.105 58398 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/19 21:55:56.850053 2.997266 tcp 10.0.2.105 58399 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 21:56:05.845709 0.000000 tcp 10.0.2.105 58399 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:00:08.355427 2.994153 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 22:00:15.354591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:00:23.359059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:00:39.359136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:01:11.365121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:01:11.845885 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:01:11.846023 0.353059 tcp 10.0.2.105 58400 -> 46.48.223.67 15494 SPA_* 0 0 9 1036 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:24.591820 0.219924 tcp 10.0.2.105 58400 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:24.593903 0.033914 tcp 10.0.2.105 58401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:24.628173 0.034771 tcp 10.0.2.105 58402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:24.663270 0.138772 tcp 10.0.2.105 58403 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:24.811997 2.996773 tcp 10.0.2.105 58404 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:01:33.807324 0.000000 tcp 10.0.2.105 58404 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:01:39.806678 0.035483 tcp 10.0.2.105 58405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:39.842428 0.037336 tcp 10.0.2.105 58406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:39.880048 0.135550 tcp 10.0.2.105 58407 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:40.028938 4.705207 tcp 10.0.2.105 58408 -> 46.48.223.67 15494 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:01:44.734415 3.003169 tcp 10.0.2.105 58409 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:01:53.735724 0.000000 tcp 10.0.2.105 58409 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:07:20.378295 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 22:07:27.385601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:07:35.389918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:07:51.390225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:08:23.396809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:14:13.660182 0.000217 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:14:13.660498 0.073219 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:13.716306 0.093807 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:14.319736 0.153302 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 779 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:14.915315 3.478405 tcp 10.0.2.105 58410 -> 46.48.223.67 15494 FSPA* 0 0 14 1627 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:14.915813 0.186715 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:15.074198 0.080038 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:15.329211 0.040975 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:15.912160 0.238140 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:16.129837 0.173667 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:16.642758 0.199282 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:16.701579 0.036672 tcp 10.0.2.105 58411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:16.738524 0.035228 tcp 10.0.2.105 58412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:16.774085 0.131474 tcp 10.0.2.105 58413 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:18.393934 0.418270 tcp 10.0.2.105 58414 -> 46.48.223.67 15494 SPA_* 0 0 9 1097 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:18.506695 0.225449 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:19.680648 0.083086 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:19.729439 0.167234 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:20.487003 0.213171 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:20.681602 0.061306 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:20.740956 0.656114 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:21.374576 0.125012 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:21.546471 0.639522 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.154308 0.210878 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.306895 0.190231 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.493854 0.091997 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.641605 0.180922 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2071 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.800396 0.139181 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:22.931108 0.164065 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:23.086533 0.182924 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:24.273801 0.110370 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:24.345298 0.062494 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:24.679285 0.271126 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:25.235880 0.064678 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:14:27.402326 3.001509 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 22:14:33.240970 0.000344 tcp 10.0.2.105 58414 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:14:36.853211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:14:44.756183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:15:00.560251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:15:32.164499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:19:30.766684 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:19:30.766927 2.051936 tcp 10.0.2.105 58415 -> 46.48.223.67 15494 FSPA* 0 0 14 1588 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:32.535034 0.036114 tcp 10.0.2.105 58416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:32.571390 0.034869 tcp 10.0.2.105 58417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:32.606527 0.140589 tcp 10.0.2.105 58418 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:32.819100 3.003945 tcp 10.0.2.105 58419 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:19:41.831524 0.000000 tcp 10.0.2.105 58419 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:19:47.821160 0.035403 tcp 10.0.2.105 58420 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:47.856872 0.034521 tcp 10.0.2.105 58421 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:47.891656 0.130417 tcp 10.0.2.105 58422 -> 195.113.214.249 443 SRPA* 0 0 45 40672 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:48.035844 0.351456 tcp 10.0.2.105 58423 -> 46.48.223.67 15494 SPA_* 0 0 9 1058 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:56.523410 0.000358 tcp 10.0.2.105 58423 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:19:56.523981 3.003310 tcp 10.0.2.105 58424 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:20:05.525728 0.000000 tcp 10.0.2.105 58424 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:21:34.435656 3.002263 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 22:21:41.443752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:21:49.445572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:22:05.448457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:22:37.454030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:25:11.527864 0.000227 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:25:11.528199 0.349485 tcp 10.0.2.105 58425 -> 46.48.223.67 15494 SPA_* 0 0 9 1224 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:16.539330 0.218773 tcp 10.0.2.105 58425 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:16.542018 0.033626 tcp 10.0.2.105 58426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:16.576030 0.037811 tcp 10.0.2.105 58427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:16.614163 0.134771 tcp 10.0.2.105 58428 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:16.758305 2.999085 tcp 10.0.2.105 58429 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:25:25.756374 0.000000 tcp 10.0.2.105 58429 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:25:31.755201 0.037201 tcp 10.0.2.105 58430 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:31.792587 0.036067 tcp 10.0.2.105 58431 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:31.828975 0.139371 tcp 10.0.2.105 58432 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:31.978548 1.803766 tcp 10.0.2.105 58433 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:25:33.782581 2.999247 tcp 10.0.2.105 58434 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:25:42.782507 0.000000 tcp 10.0.2.105 58434 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:28:41.460449 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 22:28:48.467562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:28:56.472771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:29:12.472514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:29:44.478194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:30:48.781351 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:30:48.781513 0.358011 tcp 10.0.2.105 58435 -> 46.48.223.67 15494 SPA_* 0 0 9 1216 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:30:56.050055 0.326753 tcp 10.0.2.105 58435 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:30:56.052525 0.035395 tcp 10.0.2.105 58436 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:30:56.088142 0.038667 tcp 10.0.2.105 58437 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:30:56.127103 0.136112 tcp 10.0.2.105 58438 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:30:56.377054 2.999286 tcp 10.0.2.105 58439 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:31:05.374316 0.000000 tcp 10.0.2.105 58439 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:31:11.381279 0.036648 tcp 10.0.2.105 58440 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:31:11.418379 0.033785 tcp 10.0.2.105 58441 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:31:11.452620 0.130418 tcp 10.0.2.105 58442 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:31:12.976751 2.175280 tcp 10.0.2.105 58443 -> 46.48.223.67 15494 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:31:15.152395 3.000226 tcp 10.0.2.105 58444 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:31:24.161518 0.000000 tcp 10.0.2.105 58444 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:35:48.485431 3.000450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 22:35:55.491634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:36:03.492834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:36:19.501638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:36:30.152030 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:36:30.152192 0.360176 tcp 10.0.2.105 58445 -> 46.48.223.67 15494 SPA_* 0 0 9 1095 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:41.667782 0.262190 tcp 10.0.2.105 58445 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:41.669940 0.037171 tcp 10.0.2.105 58446 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:41.707418 0.035105 tcp 10.0.2.105 58447 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:41.742791 0.127823 tcp 10.0.2.105 58448 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:41.930214 3.006651 tcp 10.0.2.105 58449 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:36:51.246210 0.000000 tcp 10.0.2.105 58449 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:36:51.813023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:36:57.189661 0.036329 tcp 10.0.2.105 58450 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:57.226268 0.042649 tcp 10.0.2.105 58451 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:57.268891 0.133420 tcp 10.0.2.105 58452 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:36:57.429206 2.818362 tcp 10.0.2.105 58453 -> 46.48.223.67 15494 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:37:00.247769 2.972702 tcp 10.0.2.105 58454 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:37:09.160857 0.000000 tcp 10.0.2.105 58454 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:42:55.507796 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 22:43:02.515732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:43:10.517003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:43:26.520040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:43:58.526230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:44:33.516494 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:44:33.516708 0.075952 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:33.573419 0.226557 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:33.773262 0.102752 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:33.866794 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 22:44:45.033381 2.052668 tcp 10.0.2.105 58455 -> 46.48.223.67 15494 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:46.827996 0.034843 tcp 10.0.2.105 58456 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:46.863364 0.034924 tcp 10.0.2.105 58457 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:46.898638 0.135823 tcp 10.0.2.105 58458 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:47.086265 1.749419 tcp 10.0.2.105 58459 -> 46.48.223.67 15494 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:50.251247 0.033355 tcp 10.0.2.105 58460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:50.284923 0.034235 tcp 10.0.2.105 58461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:50.319433 0.134170 tcp 10.0.2.105 58462 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:44:50.454185 0.238499 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:50.672150 1.381601 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.051602 0.038454 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.143112 0.173791 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.313895 0.201040 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.582032 0.225493 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.918030 0.088324 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:52.969226 0.062071 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:53.290311 0.201285 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:53.421064 0.219308 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:53.615641 0.743361 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:54.339108 0.127599 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:54.447456 0.660684 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 3 880 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.101352 0.183360 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.240978 0.188237 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.427193 0.089872 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.498300 0.178935 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.655200 0.140816 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.785233 0.164387 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:55.940744 0.066711 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:56.021012 0.183889 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:56.197880 0.106075 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:56.267191 0.303930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:44:56.530548 0.062074 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/19 22:49:48.830012 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:49:48.830158 2.886092 tcp 10.0.2.105 58463 -> 46.48.223.67 15494 FSPA* 0 0 14 1578 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:49:51.481399 0.034471 tcp 10.0.2.105 58464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:49:51.516148 0.037263 tcp 10.0.2.105 58465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:49:51.553768 0.139331 tcp 10.0.2.105 58466 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:49:51.716474 3.001878 tcp 10.0.2.105 58467 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:50:00.717148 0.000000 tcp 10.0.2.105 58467 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:50:06.716045 0.037431 tcp 10.0.2.105 58468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:50:06.753763 0.034932 tcp 10.0.2.105 58469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:50:06.788950 0.136337 tcp 10.0.2.105 58470 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:50:06.949017 0.353918 tcp 10.0.2.105 58471 -> 46.48.223.67 15494 SPA_* 0 0 9 1048 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:50:13.504363 0.000333 tcp 10.0.2.105 58471 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:50:13.504900 3.012231 tcp 10.0.2.105 58472 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:50:22.508739 0.000000 tcp 10.0.2.105 58472 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:55:28.499482 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 22:55:28.499680 2.042670 tcp 10.0.2.105 58473 -> 46.48.223.67 15494 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:30.288670 0.037403 tcp 10.0.2.105 58474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:30.326402 0.039306 tcp 10.0.2.105 58475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:30.365948 0.143650 tcp 10.0.2.105 58476 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:30.542608 2.992648 tcp 10.0.2.105 58477 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:55:38.535350 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 22:55:39.533846 0.000000 tcp 10.0.2.105 58477 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:55:45.542797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:55:45.543264 0.033414 tcp 10.0.2.105 58478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:45.576933 0.036066 tcp 10.0.2.105 58479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:45.613264 0.139963 tcp 10.0.2.105 58480 -> 195.113.214.249 443 SRPA* 0 0 21 12186 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:45.762352 2.895308 tcp 10.0.2.105 58481 -> 46.48.223.67 15494 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/19 22:55:48.657525 3.003977 tcp 10.0.2.105 58482 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:55:53.544174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:55:57.660181 0.000000 tcp 10.0.2.105 58482 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 22:56:09.547209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 22:56:41.553139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:01:03.650758 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:01:03.650866 0.350843 tcp 10.0.2.105 58483 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:15.081089 0.259909 tcp 10.0.2.105 58483 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:15.083515 0.034022 tcp 10.0.2.105 58484 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:15.117746 0.039798 tcp 10.0.2.105 58485 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:15.157888 0.132546 tcp 10.0.2.105 58486 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:15.341280 2.999911 tcp 10.0.2.105 58487 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:01:24.339533 0.000000 tcp 10.0.2.105 58487 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:01:30.340202 0.035585 tcp 10.0.2.105 58488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:30.376048 0.035778 tcp 10.0.2.105 58489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:30.412115 0.143310 tcp 10.0.2.105 58490 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:30.565405 1.864055 tcp 10.0.2.105 58491 -> 46.48.223.67 15494 FSPA* 0 0 14 1676 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:01:32.429744 2.995826 tcp 10.0.2.105 58492 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:01:41.424193 0.000000 tcp 10.0.2.105 58492 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:02:45.559145 3.001858 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 23:02:52.567074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:03:00.568079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:03:16.570965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:03:48.577233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:06:47.425116 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:06:47.425222 0.354250 tcp 10.0.2.105 58493 -> 46.48.223.67 15494 SPA_* 0 0 9 1174 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:01.624499 0.227244 tcp 10.0.2.105 58493 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:01.626791 0.038044 tcp 10.0.2.105 58494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:01.665100 0.035392 tcp 10.0.2.105 58495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:01.700756 0.141111 tcp 10.0.2.105 58496 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:01.851935 2.997393 tcp 10.0.2.105 58497 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:07:10.848144 0.000000 tcp 10.0.2.105 58497 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:07:16.846520 0.033972 tcp 10.0.2.105 58498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:16.880772 0.036885 tcp 10.0.2.105 58499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:16.917916 0.135781 tcp 10.0.2.105 58500 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:17.169147 1.785696 tcp 10.0.2.105 58501 -> 46.48.223.67 15494 FSPA* 0 0 14 1704 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:07:18.955076 2.998906 tcp 10.0.2.105 58502 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:07:27.962993 0.000000 tcp 10.0.2.105 58502 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:10:01.587233 3.000430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 23:10:08.593558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:10:16.595273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:10:32.598234 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:11:04.604132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:15:25.471502 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:15:25.471650 0.108935 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:25.560310 0.503169 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.063314 0.070096 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.114984 0.094224 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.261068 0.236738 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.477401 0.069868 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.564460 0.042260 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.608152 0.175423 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.780241 0.200619 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:26.994119 0.232817 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:27.232071 0.105069 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:27.297064 0.229300 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:27.491412 0.061916 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:27.551794 0.179482 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:27.674793 0.776109 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:28.428398 0.133107 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:28.543265 0.611535 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.127091 0.182149 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.259061 0.187552 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.443061 0.097031 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.519932 0.183347 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.680044 0.141380 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2630 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.813004 0.170186 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:29.974896 0.068618 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:30.039493 0.184872 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:30.239283 0.065327 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:30.284846 0.116391 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:30.363427 0.267640 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:15:34.160564 2.008280 tcp 10.0.2.105 58503 -> 46.48.223.67 15494 FSPA* 0 0 14 1719 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:35.939864 0.037050 tcp 10.0.2.105 58504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:35.977197 0.037961 tcp 10.0.2.105 58505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:36.015455 0.131834 tcp 10.0.2.105 58506 -> 195.113.214.249 443 SRPA* 0 0 24 14850 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:36.169079 2.970445 tcp 10.0.2.105 58507 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:15:45.080090 0.000000 tcp 10.0.2.105 58507 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:15:51.020009 0.093456 tcp 10.0.2.105 58508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:51.113797 0.036505 tcp 10.0.2.105 58509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:51.150661 0.133841 tcp 10.0.2.105 58510 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:51.303233 0.364692 tcp 10.0.2.105 58511 -> 46.48.223.67 15494 SPA_* 0 0 9 1189 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:57.511344 0.000421 tcp 10.0.2.105 58511 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:15:57.511969 2.997584 tcp 10.0.2.105 58512 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:16:06.508053 0.000000 tcp 10.0.2.105 58512 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:17:08.614291 2.997609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 23:17:15.617630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:17:23.618991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:17:39.627360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:18:11.628889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:21:12.509031 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:21:12.509215 2.009598 tcp 10.0.2.105 58513 -> 46.48.223.67 15494 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:14.281603 0.037474 tcp 10.0.2.105 58514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:14.319369 0.038388 tcp 10.0.2.105 58515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:14.358072 0.133654 tcp 10.0.2.105 58516 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:14.519084 2.996064 tcp 10.0.2.105 58517 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:21:23.513685 0.000000 tcp 10.0.2.105 58517 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:21:29.513262 0.036368 tcp 10.0.2.105 58518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:29.549903 0.040338 tcp 10.0.2.105 58519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:29.590508 0.132221 tcp 10.0.2.105 58520 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:29.735659 1.716604 tcp 10.0.2.105 58521 -> 46.48.223.67 15494 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:21:31.452453 2.997257 tcp 10.0.2.105 58522 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:21:40.452693 0.000000 tcp 10.0.2.105 58522 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:24:15.633972 3.001637 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 23:24:22.641320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:24:30.643118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:24:46.649828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:25:18.656849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:26:46.449085 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:26:46.449194 2.943293 tcp 10.0.2.105 58523 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:26:49.152468 0.035368 tcp 10.0.2.105 58524 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:26:49.188096 0.043179 tcp 10.0.2.105 58525 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:26:49.231581 0.145079 tcp 10.0.2.105 58526 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:26:49.392784 2.994162 tcp 10.0.2.105 58527 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:26:58.385346 0.000000 tcp 10.0.2.105 58527 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:27:04.394167 0.034955 tcp 10.0.2.105 58528 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:27:04.429407 0.035252 tcp 10.0.2.105 58529 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:27:04.464970 0.131273 tcp 10.0.2.105 58530 -> 195.113.214.249 443 SRPA* 0 0 35 19572 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:27:04.613829 1.773954 tcp 10.0.2.105 58531 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:27:06.388019 3.005997 tcp 10.0.2.105 58532 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:27:15.390022 0.000000 tcp 10.0.2.105 58532 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:31:22.657765 3.006163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 23:31:29.665264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:31:37.666831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:31:53.670093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:32:21.401028 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:32:21.401211 2.817477 tcp 10.0.2.105 58533 -> 46.48.223.67 15494 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:23.994677 0.038709 tcp 10.0.2.105 58534 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:24.033774 0.038044 tcp 10.0.2.105 58535 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:24.072129 0.136023 tcp 10.0.2.105 58536 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:24.218901 2.989134 tcp 10.0.2.105 58537 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:32:25.679392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:32:33.206914 0.000000 tcp 10.0.2.105 58537 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:32:39.206272 0.036964 tcp 10.0.2.105 58538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:39.243542 0.035400 tcp 10.0.2.105 58539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:39.279217 0.140190 tcp 10.0.2.105 58540 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:39.428998 0.349718 tcp 10.0.2.105 58541 -> 46.48.223.67 15494 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:47.085075 0.000392 tcp 10.0.2.105 58541 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:32:47.085683 3.005546 tcp 10.0.2.105 58542 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:32:56.093337 0.000000 tcp 10.0.2.105 58542 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:38:29.686012 2.997819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 23:38:36.689337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:38:44.691213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:39:00.693652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:39:32.699790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:45:36.706225 3.001420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/19 23:45:36.973328 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:45:36.973609 0.074018 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.025755 0.093356 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.109232 0.239181 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.326327 0.110360 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.415321 0.194861 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.584119 0.072070 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.670723 0.042336 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.755959 0.173497 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:37.925709 0.199421 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:38.126773 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 23:45:43.713163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:45:47.128738 1.186820 tcp 10.0.2.105 58543 -> 46.48.223.67 15494 SPA_* 0 0 9 1225 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:51.714513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:45:53.824740 0.614865 tcp 10.0.2.105 58543 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:53.826573 0.082904 tcp 10.0.2.105 58544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:53.909746 0.034016 tcp 10.0.2.105 58545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:53.944035 0.137402 tcp 10.0.2.105 58546 -> 195.113.214.249 443 SRPA* 0 0 25 15530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:54.095531 4.530909 tcp 10.0.2.105 58547 -> 46.48.223.67 15494 FSPA* 0 0 14 1755 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:54.788835 0.039853 tcp 10.0.2.105 58548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:54.829021 0.036539 tcp 10.0.2.105 58549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:54.865823 0.140771 tcp 10.0.2.105 58550 -> 195.113.214.249 443 SRPA* 0 0 41 22272 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:45:55.007269 0.081914 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:55.053714 0.221599 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:55.248435 0.059081 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:55.305992 0.214198 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:45:55.436354 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/19 23:46:07.720624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:46:10.792837 0.083680 tcp 10.0.2.105 58551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:46:10.876862 0.039011 tcp 10.0.2.105 58552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:46:10.916107 0.136784 tcp 10.0.2.105 58553 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:46:11.053354 0.206501 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:11.214272 0.188978 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:11.398526 0.124286 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:11.504123 0.782315 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.256786 0.098524 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.336752 0.186549 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.500118 0.143048 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.634501 0.170049 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.799196 0.069606 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:12.870290 0.185241 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:13.073418 0.062981 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:13.118331 0.116619 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:13.195362 0.278216 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/19 23:46:39.723900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:50:58.616464 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:50:58.616654 2.005399 tcp 10.0.2.105 58554 -> 46.48.223.67 15494 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:00.380053 0.035492 tcp 10.0.2.105 58555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:00.415882 0.039116 tcp 10.0.2.105 58556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:00.455333 0.145487 tcp 10.0.2.105 58557 -> 195.113.214.249 443 SRPA* 0 0 41 21368 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:00.622355 3.000980 tcp 10.0.2.105 58558 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:51:09.632237 0.000000 tcp 10.0.2.105 58558 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:51:15.621497 0.033629 tcp 10.0.2.105 58559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:15.655420 0.036301 tcp 10.0.2.105 58560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:15.692005 0.139747 tcp 10.0.2.105 58561 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:15.852217 0.354583 tcp 10.0.2.105 58562 -> 46.48.223.67 15494 SPA_* 0 0 9 1171 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:22.631057 0.000445 tcp 10.0.2.105 58562 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:51:22.631690 2.998342 tcp 10.0.2.105 58563 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:51:31.623378 0.000000 tcp 10.0.2.105 58563 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:56:37.633960 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/19 23:56:37.634125 0.348707 tcp 10.0.2.105 58564 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:56:49.066548 0.226322 tcp 10.0.2.105 58564 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:56:49.068438 0.034589 tcp 10.0.2.105 58565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:56:49.103286 0.035424 tcp 10.0.2.105 58566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:56:49.139023 0.137038 tcp 10.0.2.105 58567 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:56:49.293107 2.991335 tcp 10.0.2.105 58568 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:56:58.283229 0.000000 tcp 10.0.2.105 58568 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:56:59.737485 3.006254 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/19 23:57:04.297140 0.033881 tcp 10.0.2.105 58569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:57:04.331330 0.035146 tcp 10.0.2.105 58570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:57:04.366801 0.133662 tcp 10.0.2.105 58571 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:57:04.546568 1.713444 tcp 10.0.2.105 58572 -> 46.48.223.67 15494 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/02/19 23:57:06.260194 2.998874 tcp 10.0.2.105 58573 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:57:06.745378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:57:14.746834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:57:15.257867 0.000000 tcp 10.0.2.105 58573 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/19 23:57:30.749766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/19 23:58:02.755903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:02:21.258169 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:02:21.258357 2.011776 tcp 10.0.2.105 58574 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:23.028063 0.035797 tcp 10.0.2.105 58575 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:23.064226 0.039082 tcp 10.0.2.105 58576 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:23.103632 0.149250 tcp 10.0.2.105 58577 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:23.270368 2.994022 tcp 10.0.2.105 58578 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:02:32.263524 0.000000 tcp 10.0.2.105 58578 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:02:38.263319 0.036392 tcp 10.0.2.105 58579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:38.299981 0.039253 tcp 10.0.2.105 58580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:38.339490 0.138909 tcp 10.0.2.105 58581 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:38.531349 0.345422 tcp 10.0.2.105 58582 -> 46.48.223.67 15494 SPA_* 0 0 9 1114 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:52.691121 0.000356 tcp 10.0.2.105 58582 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:02:52.691717 2.999347 tcp 10.0.2.105 58583 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:03:01.685290 0.000000 tcp 10.0.2.105 58583 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:04:06.762172 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:04:13.769308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:04:21.772807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:04:37.773613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:05:09.779730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:08:07.686327 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:08:07.686574 0.357107 tcp 10.0.2.105 58584 -> 46.48.223.67 15494 SPA_* 0 0 9 1083 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:16.088948 0.428210 tcp 10.0.2.105 58584 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:16.091109 0.035459 tcp 10.0.2.105 58585 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:16.126883 0.044341 tcp 10.0.2.105 58586 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:16.171516 0.157036 tcp 10.0.2.105 58587 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:16.517376 3.005301 tcp 10.0.2.105 58588 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:08:25.520936 0.000000 tcp 10.0.2.105 58588 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:08:31.510483 0.035066 tcp 10.0.2.105 58589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:31.545861 0.036697 tcp 10.0.2.105 58590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:31.582852 0.138185 tcp 10.0.2.105 58591 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:31.734385 1.698011 tcp 10.0.2.105 58592 -> 46.48.223.67 15494 FSPA* 0 0 14 1613 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:08:33.432613 2.994626 tcp 10.0.2.105 58593 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:08:42.425549 0.000000 tcp 10.0.2.105 58593 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:11:13.786146 3.001529 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:11:20.793129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:11:28.794671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:11:44.797944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:12:16.803679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:16:20.313817 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:16:20.313988 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 00:16:37.039851 0.044217 tcp 10.0.2.105 58594 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:37.084598 0.036028 tcp 10.0.2.105 58595 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:37.120974 0.136166 tcp 10.0.2.105 58596 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:37.257716 0.778429 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.014528 0.092687 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.097738 0.073328 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.153628 0.077410 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.276122 0.042955 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.317318 0.174919 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:38.487586 0.203059 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.153586 0.107587 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.242928 0.238293 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.459728 0.187934 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.618220 0.083009 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.693206 0.171589 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:39.811138 0.212493 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:40.005433 0.061593 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:40.064921 0.148763 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:40.158140 0.124361 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:40.263501 0.187188 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:40.447613 0.678019 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.097882 0.094533 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.171219 0.182038 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.329496 0.139324 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.460272 0.164553 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.615709 0.080642 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.697681 0.183647 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.858641 0.070222 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:41.933663 0.123310 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:42.016493 0.272289 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:16:48.857006 1.964453 tcp 10.0.2.105 58597 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:50.600610 0.033486 tcp 10.0.2.105 58598 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:50.634391 0.035854 tcp 10.0.2.105 58599 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:50.670493 0.136632 tcp 10.0.2.105 58600 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:16:50.821717 3.000436 tcp 10.0.2.105 58601 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:16:59.820853 0.000000 tcp 10.0.2.105 58601 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:17:05.820355 0.033882 tcp 10.0.2.105 58602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:17:05.854472 0.038327 tcp 10.0.2.105 58603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:17:05.893115 0.141409 tcp 10.0.2.105 58604 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:17:06.045332 1.727621 tcp 10.0.2.105 58605 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:17:07.773213 2.993003 tcp 10.0.2.105 58606 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:17:16.765078 0.000000 tcp 10.0.2.105 58606 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:18:22.293413 3.007206 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:18:29.299073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:18:37.290984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:18:53.293766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:19:25.300129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:22:22.775581 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:22:22.775767 0.348900 tcp 10.0.2.105 58607 -> 46.48.223.67 15494 SPA_* 0 0 9 1052 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:34.193665 0.218427 tcp 10.0.2.105 58607 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:34.195523 0.034735 tcp 10.0.2.105 58608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:34.230580 0.035736 tcp 10.0.2.105 58609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:34.266588 0.136004 tcp 10.0.2.105 58610 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:34.412396 2.993755 tcp 10.0.2.105 58611 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:22:43.404709 0.000000 tcp 10.0.2.105 58611 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:22:49.414390 0.033991 tcp 10.0.2.105 58612 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:49.448648 0.039772 tcp 10.0.2.105 58613 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:49.488686 0.138744 tcp 10.0.2.105 58614 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:22:49.639329 0.365910 tcp 10.0.2.105 58615 -> 46.48.223.67 15494 SPA_* 0 0 9 1052 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:23:17.534501 0.318325 tcp 10.0.2.105 58615 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:23:17.535066 3.003060 tcp 10.0.2.105 58616 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:23:26.541602 0.000000 tcp 10.0.2.105 58616 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:25:29.445752 3.002690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:25:36.453614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:25:44.455015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:26:00.458239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:26:32.463920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:28:32.537483 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:28:32.537657 0.343962 tcp 10.0.2.105 58617 -> 46.48.223.67 15494 SPA_* 0 0 9 1065 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:28:48.174526 0.215671 tcp 10.0.2.105 58617 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:28:48.176808 0.034580 tcp 10.0.2.105 58618 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:28:48.211648 0.035412 tcp 10.0.2.105 58619 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:28:48.247441 0.132227 tcp 10.0.2.105 58620 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:28:48.390459 2.993067 tcp 10.0.2.105 58621 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:28:57.392654 0.000000 tcp 10.0.2.105 58621 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:29:03.382030 0.037937 tcp 10.0.2.105 58622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:29:03.420269 0.104999 tcp 10.0.2.105 58623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:29:03.525559 0.140984 tcp 10.0.2.105 58624 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:29:03.694050 0.345456 tcp 10.0.2.105 58625 -> 46.48.223.67 15494 SPA_* 0 0 9 1065 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:29:34.037148 0.381319 tcp 10.0.2.105 58625 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:29:34.037498 3.024053 tcp 10.0.2.105 58626 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:29:43.037883 0.000000 tcp 10.0.2.105 58626 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:32:36.470681 3.001073 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:32:43.477784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:32:51.479050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:33:07.484215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:33:39.488101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:34:49.038345 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:34:49.038435 0.346748 tcp 10.0.2.105 58627 -> 46.48.223.67 15494 SPA_* 0 0 9 1091 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:01.587218 0.230258 tcp 10.0.2.105 58627 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:01.589367 0.036751 tcp 10.0.2.105 58628 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:01.626383 0.035223 tcp 10.0.2.105 58629 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:01.661874 0.144988 tcp 10.0.2.105 58630 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:01.817697 3.003759 tcp 10.0.2.105 58631 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:35:10.819367 0.000000 tcp 10.0.2.105 58631 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:35:16.808620 0.032805 tcp 10.0.2.105 58632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:16.841700 0.046922 tcp 10.0.2.105 58633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:16.888907 0.134119 tcp 10.0.2.105 58634 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:17.033838 0.347582 tcp 10.0.2.105 58635 -> 46.48.223.67 15494 SPA_* 0 0 9 1091 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:25.628135 0.000437 tcp 10.0.2.105 58635 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:35:25.628774 2.996034 tcp 10.0.2.105 58636 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:35:34.623384 0.000000 tcp 10.0.2.105 58636 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:39:43.494069 3.001733 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:39:50.501953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:39:58.503072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:40:14.505964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:40:46.519434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:46:50.517887 3.004848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 00:46:54.573633 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:46:54.573792 0.075423 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:54.629681 0.073088 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:54.707864 0.575130 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.260785 0.108060 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.359979 0.205473 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.568817 0.039329 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.609428 0.172904 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.663700 2.094855 tcp 10.0.2.105 58637 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:46:55.778358 0.110071 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:55.867689 0.235664 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.085035 0.189316 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.241969 0.084726 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.290376 0.177121 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.413837 0.225839 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.615489 0.059329 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.672962 0.120948 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:56.786491 0.716114 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:57.473793 0.102493 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:57.525653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:46:57.535352 0.038197 tcp 10.0.2.105 58638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:46:57.558582 0.123916 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:57.573926 0.036097 tcp 10.0.2.105 58639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:46:57.610306 0.138823 tcp 10.0.2.105 58640 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:46:57.664736 0.191304 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2020 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:57.758736 3.372791 tcp 10.0.2.105 58641 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:46:57.851873 0.181401 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.010343 0.140827 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.142894 0.166833 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.296982 0.066724 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.374633 0.181974 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.550500 0.062003 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.594761 0.219034 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:46:58.772044 0.332585 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/20 00:47:05.527371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:47:21.530105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:47:53.535948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:52:01.139719 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:52:01.139832 2.131316 tcp 10.0.2.105 58642 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:03.023146 0.035207 tcp 10.0.2.105 58643 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:03.058626 0.037026 tcp 10.0.2.105 58644 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:03.095976 0.150968 tcp 10.0.2.105 58645 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:03.271364 2.997973 tcp 10.0.2.105 58646 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:52:12.268101 0.000000 tcp 10.0.2.105 58646 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:52:18.267178 0.033296 tcp 10.0.2.105 58647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:18.300766 0.037476 tcp 10.0.2.105 58648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:18.338555 0.128848 tcp 10.0.2.105 58649 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:18.478983 0.357747 tcp 10.0.2.105 58650 -> 46.48.223.67 15494 SPA_* 0 0 9 1108 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:25.877116 0.000416 tcp 10.0.2.105 58650 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:52:25.877827 3.004058 tcp 10.0.2.105 58651 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:52:34.880665 0.000000 tcp 10.0.2.105 58651 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:53:57.541833 3.001847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 00:54:04.553944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:54:12.552709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:54:28.555837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:55:00.560169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 00:57:40.901740 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 00:57:40.901941 0.356587 tcp 10.0.2.105 58652 -> 46.48.223.67 15494 SPA_* 0 0 9 1038 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:05.931586 0.278396 tcp 10.0.2.105 58652 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:05.933740 0.045517 tcp 10.0.2.105 58653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:05.979512 0.036096 tcp 10.0.2.105 58654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:06.015921 0.144944 tcp 10.0.2.105 58655 -> 195.113.214.249 443 SRPA* 0 0 48 43754 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:06.210270 3.000782 tcp 10.0.2.105 58656 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:58:15.209681 0.000000 tcp 10.0.2.105 58656 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:58:21.209510 0.034450 tcp 10.0.2.105 58657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:21.243829 0.036075 tcp 10.0.2.105 58658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:21.279805 0.141563 tcp 10.0.2.105 58659 -> 195.113.214.249 443 SRPA* 0 0 41 23454 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:21.461424 4.753508 tcp 10.0.2.105 58660 -> 46.48.223.67 15494 FSPA* 0 0 13 1522 flow=From-Botnet-V2-TCP-Established 1970/02/20 00:58:26.215132 3.004983 tcp 10.0.2.105 58661 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 00:58:35.218646 0.000000 tcp 10.0.2.105 58661 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:01:04.575874 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:01:11.583358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:01:19.585013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:01:35.587657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:02:07.598554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:03:41.209335 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:03:41.209440 3.615363 tcp 10.0.2.105 58662 -> 46.48.223.67 15494 FSPA* 0 0 14 1660 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:44.580874 0.046226 tcp 10.0.2.105 58663 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:44.627388 0.036312 tcp 10.0.2.105 58664 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:44.664090 0.144744 tcp 10.0.2.105 58665 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:44.825031 3.002920 tcp 10.0.2.105 58666 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:03:53.826710 0.000000 tcp 10.0.2.105 58666 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:03:59.825843 0.036221 tcp 10.0.2.105 58667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:59.862349 0.038517 tcp 10.0.2.105 58668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:03:59.901132 0.139333 tcp 10.0.2.105 58669 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:04:00.053737 1.346795 tcp 10.0.2.105 58670 -> 46.48.223.67 15494 SPA_* 0 0 9 1130 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:04:14.122187 0.000400 tcp 10.0.2.105 58670 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:04:14.122821 2.997815 tcp 10.0.2.105 58671 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:04:23.143633 0.000000 tcp 10.0.2.105 58671 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:08:11.599756 3.001887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:08:18.607343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:08:26.611881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:08:42.611892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:09:14.617959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:09:29.119715 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:09:29.119825 0.344583 tcp 10.0.2.105 58672 -> 46.48.223.67 15494 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:09:44.735871 0.244048 tcp 10.0.2.105 58672 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:09:44.757256 0.036521 tcp 10.0.2.105 58673 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:09:44.794126 0.040080 tcp 10.0.2.105 58674 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:09:44.834514 0.132802 tcp 10.0.2.105 58675 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:09:44.980123 2.995490 tcp 10.0.2.105 58676 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:09:53.974548 0.000000 tcp 10.0.2.105 58676 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:09:59.973635 0.036338 tcp 10.0.2.105 58677 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:10:00.010283 0.038319 tcp 10.0.2.105 58678 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:10:00.048919 0.144920 tcp 10.0.2.105 58679 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:10:00.205449 0.350630 tcp 10.0.2.105 58680 -> 46.48.223.67 15494 SPA_* 0 0 9 1073 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:10:14.373308 0.000476 tcp 10.0.2.105 58680 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:10:14.374069 3.003847 tcp 10.0.2.105 58681 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:10:23.377161 0.000000 tcp 10.0.2.105 58681 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:15:18.624214 3.013485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:15:25.638645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:15:33.633045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:15:49.635659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:16:21.642055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:17:27.086268 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:17:27.086420 0.073604 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:27.143825 0.073676 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:27.218892 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 01:17:29.389755 2.033838 tcp 10.0.2.105 58682 -> 46.48.223.67 15494 FSPA* 0 0 12 1463 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:31.199266 0.034532 tcp 10.0.2.105 58683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:31.234087 0.035764 tcp 10.0.2.105 58684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:31.270149 0.140615 tcp 10.0.2.105 58685 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:31.423799 0.365020 tcp 10.0.2.105 58686 -> 46.48.223.67 15494 SPA_* 0 0 9 1041 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:41.821942 0.001016 tcp 10.0.2.105 58686 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:45.274651 0.092308 tcp 10.0.2.105 58687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:45.367259 0.036683 tcp 10.0.2.105 58688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:45.404257 0.160826 tcp 10.0.2.105 58689 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:17:45.565559 0.094442 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:45.651268 0.208867 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:45.864781 0.044287 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:45.910431 0.174146 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:46.080733 0.113514 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:46.173418 0.238499 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:46.390348 0.185611 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:46.546593 0.589897 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.096338 0.210669 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.231431 0.212748 udp 10.0.2.105 7010 <-> 108.215.114.209 4167 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.426736 0.059359 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.483986 0.143200 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.597495 0.167010 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.744099 0.190593 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:47.931634 0.182713 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:48.089020 0.138112 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:48.219157 0.625009 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:48.817002 0.094198 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:48.891497 0.195036 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:49.077792 0.064699 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:49.153001 0.184582 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:49.350626 0.061610 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:49.394217 0.119496 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:17:49.475794 0.261739 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:22:25.650654 2.998960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 01:22:32.655305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:22:40.657021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:22:41.819295 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:22:41.819464 2.324806 tcp 10.0.2.105 58690 -> 46.48.223.67 15494 SPA_* 0 0 9 1044 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:22:56.659856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:23:01.197107 0.268459 tcp 10.0.2.105 58690 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:01.199458 0.037146 tcp 10.0.2.105 58691 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:01.236868 0.038579 tcp 10.0.2.105 58692 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:01.275715 0.148853 tcp 10.0.2.105 58693 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:01.465804 3.005596 tcp 10.0.2.105 58694 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:23:10.469706 0.000000 tcp 10.0.2.105 58694 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:23:16.459575 0.047813 tcp 10.0.2.105 58695 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:16.507730 0.038492 tcp 10.0.2.105 58696 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:16.546555 0.135307 tcp 10.0.2.105 58697 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:16.697454 0.585772 tcp 10.0.2.105 58698 -> 46.48.223.67 15494 SPA_* 0 0 9 1044 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:26.799414 0.000425 tcp 10.0.2.105 58698 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:23:26.800084 3.002621 tcp 10.0.2.105 58699 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:23:28.665834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:23:35.796158 0.000000 tcp 10.0.2.105 58699 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:28:41.796286 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:28:41.796386 1.310429 tcp 10.0.2.105 58700 -> 46.48.223.67 15494 SPA_* 0 0 9 1096 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:13.103111 0.034310 tcp 10.0.2.105 58701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:13.137693 0.040977 tcp 10.0.2.105 58702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:13.178999 0.139856 tcp 10.0.2.105 58703 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:13.350066 0.380119 tcp 10.0.2.105 58700 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:13.350381 3.002139 tcp 10.0.2.105 58704 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:29:22.343672 0.000000 tcp 10.0.2.105 58704 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:29:28.343611 0.036868 tcp 10.0.2.105 58705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:28.380785 0.078614 tcp 10.0.2.105 58706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:28.459779 0.144369 tcp 10.0.2.105 58707 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:28.621552 0.404634 tcp 10.0.2.105 58708 -> 46.48.223.67 15494 SPA_* 0 0 7 988 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:32.671844 3.001768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:29:38.332520 0.000624 tcp 10.0.2.105 58708 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:29:38.333059 2.998708 tcp 10.0.2.105 58709 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:29:39.679186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:29:47.330381 0.000000 tcp 10.0.2.105 58709 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:29:47.680643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:30:03.683746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:30:35.689729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:34:53.330851 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:34:53.330962 0.432910 tcp 10.0.2.105 58710 -> 46.48.223.67 15494 SPA_* 0 0 9 1151 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:23.766027 0.034904 tcp 10.0.2.105 58711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:23.801177 0.042333 tcp 10.0.2.105 58712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:23.843828 0.146002 tcp 10.0.2.105 58713 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:24.002197 0.379408 tcp 10.0.2.105 58710 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:24.002567 2.996385 tcp 10.0.2.105 58714 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:35:33.011174 0.000000 tcp 10.0.2.105 58714 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:35:38.996349 0.036266 tcp 10.0.2.105 58715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:39.033006 0.040652 tcp 10.0.2.105 58716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:39.073943 0.151248 tcp 10.0.2.105 58717 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:35:39.235200 0.393569 tcp 10.0.2.105 58718 -> 46.48.223.67 15494 SPA_* 0 0 9 1151 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:36:02.595020 0.000370 tcp 10.0.2.105 58718 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:36:02.595625 2.998501 tcp 10.0.2.105 58719 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:36:11.602823 0.000000 tcp 10.0.2.105 58719 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:36:39.695682 3.001920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:36:46.703198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:36:54.704539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:37:10.707931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:37:42.714108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:41:17.593284 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:41:17.593412 0.379256 tcp 10.0.2.105 58720 -> 46.48.223.67 15494 SPA_* 0 0 9 1205 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:39.565995 0.226458 tcp 10.0.2.105 58720 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:39.567907 0.034592 tcp 10.0.2.105 58721 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:39.602769 0.038342 tcp 10.0.2.105 58722 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:39.641424 0.137061 tcp 10.0.2.105 58723 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:39.792708 2.996219 tcp 10.0.2.105 58724 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:41:48.787555 0.000000 tcp 10.0.2.105 58724 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:41:54.788755 0.040374 tcp 10.0.2.105 58725 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:54.829478 0.035066 tcp 10.0.2.105 58726 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:54.864805 0.140468 tcp 10.0.2.105 58727 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:41:55.016196 0.375308 tcp 10.0.2.105 58728 -> 46.48.223.67 15494 SPA_* 0 0 9 1205 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:42:03.831823 0.000373 tcp 10.0.2.105 58728 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:42:03.832586 2.990572 tcp 10.0.2.105 58729 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:42:12.832057 0.000000 tcp 10.0.2.105 58729 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:43:46.719644 3.007356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:43:53.727083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:44:01.730629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:44:17.731638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:44:49.738106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:48:00.303178 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:48:00.303298 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 01:48:17.208020 0.035038 tcp 10.0.2.105 58730 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:17.243334 0.034971 tcp 10.0.2.105 58731 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:17.278565 0.155812 tcp 10.0.2.105 58732 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:17.434913 0.074897 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:17.489603 0.085007 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:17.572508 0.095116 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:17.656862 0.200837 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:17.872923 0.039796 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:17.921111 0.187471 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:18.101679 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 01:48:18.839128 2.207645 tcp 10.0.2.105 58733 -> 46.48.223.67 15494 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:20.829587 0.035264 tcp 10.0.2.105 58734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:20.865133 0.036260 tcp 10.0.2.105 58735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:20.901677 0.135542 tcp 10.0.2.105 58736 -> 195.113.214.249 443 SRPA* 0 0 39 21208 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:21.046998 2.287806 tcp 10.0.2.105 58737 -> 46.48.223.67 15494 SPA_* 0 0 9 1026 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:27.674821 0.000422 tcp 10.0.2.105 58737 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:34.212005 0.035475 tcp 10.0.2.105 58738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:34.247832 0.046041 tcp 10.0.2.105 58739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:34.294222 0.190170 tcp 10.0.2.105 58740 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:34.485093 0.081022 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:34.528735 0.111487 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:34.620958 0.238735 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:34.838106 0.184756 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:34.964515 0.000000 udp 10.0.2.105 7010 -> 108.215.114.209 4167 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 01:48:52.807951 0.035534 tcp 10.0.2.105 58741 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:52.843739 0.036443 tcp 10.0.2.105 58742 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:52.880454 0.135621 tcp 10.0.2.105 58743 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:48:53.016616 0.062065 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.076854 0.236064 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.262731 0.125558 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.368937 0.190244 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.556302 0.187513 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.721292 0.097908 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.799214 0.167082 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:53.953628 0.139037 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:54.084541 0.707799 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1264 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:54.777450 0.076341 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:54.855061 0.184760 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:55.030486 0.065947 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:55.081438 0.130654 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:48:55.172484 0.263887 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/20 01:53:27.672929 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:53:27.673037 0.562813 tcp 10.0.2.105 58744 -> 46.48.223.67 15494 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:35.820281 0.253691 tcp 10.0.2.105 58744 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:35.822374 0.042171 tcp 10.0.2.105 58745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:35.864795 0.034307 tcp 10.0.2.105 58746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:35.899387 0.150657 tcp 10.0.2.105 58747 -> 195.113.214.249 443 SRPA* 0 0 26 14958 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:36.074199 3.004793 tcp 10.0.2.105 58748 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:53:45.077957 0.000000 tcp 10.0.2.105 58748 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:53:51.071483 0.033972 tcp 10.0.2.105 58749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:51.105732 0.034990 tcp 10.0.2.105 58750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:51.141116 0.134345 tcp 10.0.2.105 58751 -> 195.113.214.249 443 SRPA* 0 0 25 14904 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:53:51.296567 0.376828 tcp 10.0.2.105 58752 -> 46.48.223.67 15494 SPA_* 0 0 9 1118 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:54:09.941457 0.000356 tcp 10.0.2.105 58752 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:54:09.942004 2.995484 tcp 10.0.2.105 58753 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:54:18.936132 0.000000 tcp 10.0.2.105 58753 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:56:01.746707 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 01:56:08.753825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:56:16.755431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:56:32.758656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:57:04.770805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 01:59:24.936639 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 01:59:24.936751 4.988018 tcp 10.0.2.105 58754 -> 46.48.223.67 15494 FSPA* 0 0 15 1729 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:26.752121 0.034749 tcp 10.0.2.105 58755 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:26.787196 0.038751 tcp 10.0.2.105 58756 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:26.826260 0.137688 tcp 10.0.2.105 58757 -> 195.113.214.249 443 SRPA* 0 0 53 37620 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:26.975136 3.008429 tcp 10.0.2.105 58758 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:59:35.991874 0.000000 tcp 10.0.2.105 58758 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:59:41.978437 0.034764 tcp 10.0.2.105 58759 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:42.013473 0.038398 tcp 10.0.2.105 58760 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:42.052161 0.133590 tcp 10.0.2.105 58761 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:42.219926 0.354848 tcp 10.0.2.105 58762 -> 46.48.223.67 15494 SPA_* 0 0 9 1145 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:50.168033 0.000369 tcp 10.0.2.105 58762 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 01:59:50.168608 2.997889 tcp 10.0.2.105 58763 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 01:59:59.165460 0.000000 tcp 10.0.2.105 58763 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:03:08.770479 3.002881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:03:15.780652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:03:23.779402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:03:39.781976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:04:11.788607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:05:05.165874 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:05:05.165970 0.357704 tcp 10.0.2.105 58764 -> 46.48.223.67 15494 SPA_* 0 0 9 1074 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:22.214935 0.179352 tcp 10.0.2.105 58764 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:22.217014 0.035624 tcp 10.0.2.105 58765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:22.252930 0.130809 tcp 10.0.2.105 58766 -> 195.113.214.249 80 SRPA* 0 0 21 16042 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:22.394488 3.001973 tcp 10.0.2.105 58767 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:05:31.403210 0.000000 tcp 10.0.2.105 58767 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:05:37.392366 0.035573 tcp 10.0.2.105 58768 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:37.428244 0.035434 tcp 10.0.2.105 58769 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:37.464000 0.139461 tcp 10.0.2.105 58770 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:05:37.614292 0.353832 tcp 10.0.2.105 58771 -> 46.48.223.67 15494 SPA_* 0 0 9 1074 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:06:05.395390 0.000342 tcp 10.0.2.105 58771 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:06:05.395957 2.999940 tcp 10.0.2.105 58772 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:06:14.394660 0.000000 tcp 10.0.2.105 58772 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:10:27.801314 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:10:34.811032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:10:42.811598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:10:58.813515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:11:20.394859 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:11:20.394982 1.435119 tcp 10.0.2.105 58773 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:30.819658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:11:32.321376 0.222168 tcp 10.0.2.105 58773 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:32.323535 0.036680 tcp 10.0.2.105 58774 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:32.360538 0.037931 tcp 10.0.2.105 58775 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:32.398807 0.133896 tcp 10.0.2.105 58776 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:32.543825 2.993618 tcp 10.0.2.105 58777 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:11:41.535231 0.000000 tcp 10.0.2.105 58777 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:11:47.534573 0.036147 tcp 10.0.2.105 58778 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:47.570996 0.035739 tcp 10.0.2.105 58779 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:47.607053 0.153261 tcp 10.0.2.105 58780 -> 195.113.214.249 443 SRPA* 0 0 25 12645 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:47.771807 0.361923 tcp 10.0.2.105 58781 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:59.338881 0.000360 tcp 10.0.2.105 58781 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:11:59.339481 2.995374 tcp 10.0.2.105 58782 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:12:08.333530 0.000000 tcp 10.0.2.105 58782 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:17:34.825492 3.001967 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 02:17:41.837267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:17:49.834675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:18:05.837582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:18:37.843676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:19:08.217838 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:19:08.217960 0.187163 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:08.374760 0.000000 udp 10.0.2.105 7010 -> 108.215.114.209 4167 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 02:19:14.346688 2.921704 tcp 10.0.2.105 58783 -> 46.48.223.67 15494 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:16.817439 0.038102 tcp 10.0.2.105 58784 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:16.855887 0.035663 tcp 10.0.2.105 58785 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:16.891903 0.252664 tcp 10.0.2.105 58786 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:17.268672 0.416608 tcp 10.0.2.105 58787 -> 46.48.223.67 15494 SPA_* 0 0 9 1068 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:23.812144 0.000484 tcp 10.0.2.105 58787 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:26.289290 0.033729 tcp 10.0.2.105 58788 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:26.323330 0.035797 tcp 10.0.2.105 58789 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:26.359445 0.130784 tcp 10.0.2.105 58790 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:26.490935 0.094439 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:26.576166 0.080330 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:27.481671 0.076572 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:27.539758 0.206018 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:28.062153 0.038804 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:28.315886 0.198116 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:28.505720 0.189255 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:28.633807 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 02:19:45.271279 0.036746 tcp 10.0.2.105 58791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:45.308300 0.038162 tcp 10.0.2.105 58792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:45.346837 0.141916 tcp 10.0.2.105 58793 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:19:45.489392 0.089628 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:45.541122 0.238340 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:45.758956 0.061811 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:45.969405 0.214515 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.099871 0.159924 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.240169 0.187057 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.424516 0.183923 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.585654 0.100302 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.666720 0.163851 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:46.820759 0.289073 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:47.111697 0.187341 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2557 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:47.274231 0.062541 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:47.322436 0.726527 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:19:48.019666 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 02:20:05.431944 0.039081 tcp 10.0.2.105 58794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:20:05.471342 0.036264 tcp 10.0.2.105 58795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:20:05.507942 0.132458 tcp 10.0.2.105 58796 -> 195.113.214.249 443 SRPA* 0 0 26 14048 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:20:05.640942 0.114912 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:20:05.717206 0.267776 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:24:23.811496 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:24:23.811596 1.370187 tcp 10.0.2.105 58797 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:31.278957 0.239963 tcp 10.0.2.105 58797 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:31.281159 0.034546 tcp 10.0.2.105 58798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:31.316012 0.038961 tcp 10.0.2.105 58799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:31.355276 0.144020 tcp 10.0.2.105 58800 -> 195.113.214.249 443 SRPA* 0 0 25 14828 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:31.519160 2.997613 tcp 10.0.2.105 58801 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:24:40.515057 0.000000 tcp 10.0.2.105 58801 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:24:41.850129 3.001686 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:24:46.514162 0.034259 tcp 10.0.2.105 58802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:46.548801 0.038394 tcp 10.0.2.105 58803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:46.587508 0.135821 tcp 10.0.2.105 58804 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:46.757604 0.361172 tcp 10.0.2.105 58805 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:48.857621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:24:52.791672 0.002502 tcp 10.0.2.105 58805 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:24:52.792408 2.994747 tcp 10.0.2.105 58806 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:24:56.858964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:25:01.785275 0.000000 tcp 10.0.2.105 58806 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:25:12.861592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:25:44.867028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:30:07.786206 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:30:07.786318 0.364667 tcp 10.0.2.105 58807 -> 46.48.223.67 15494 SPA_* 0 0 9 1161 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:13.646491 0.249763 tcp 10.0.2.105 58807 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:13.648460 0.037619 tcp 10.0.2.105 58808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:13.686379 0.041067 tcp 10.0.2.105 58809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:13.727796 0.148847 tcp 10.0.2.105 58810 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:13.896508 3.002175 tcp 10.0.2.105 58811 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:30:22.899254 0.000000 tcp 10.0.2.105 58811 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:30:28.896670 0.036031 tcp 10.0.2.105 58812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:28.932996 0.036960 tcp 10.0.2.105 58813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:28.970341 0.137473 tcp 10.0.2.105 58814 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:29.209526 0.365229 tcp 10.0.2.105 58815 -> 46.48.223.67 15494 SPA_* 0 0 7 1053 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:59.570069 0.357100 tcp 10.0.2.105 58815 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:30:59.570486 2.993838 tcp 10.0.2.105 58816 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:31:08.572896 0.000000 tcp 10.0.2.105 58816 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:31:48.874352 3.001051 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:31:55.883262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:32:03.882208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:32:19.885614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:32:51.894018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:36:14.573994 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:36:14.574172 1.460853 tcp 10.0.2.105 58817 -> 46.48.223.67 15494 SPA_* 0 0 9 1175 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:30.228473 0.238866 tcp 10.0.2.105 58817 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:30.230812 0.035065 tcp 10.0.2.105 58818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:30.266237 0.035444 tcp 10.0.2.105 58819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:30.301980 0.152792 tcp 10.0.2.105 58820 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:30.467636 3.002706 tcp 10.0.2.105 58821 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:36:39.469135 0.000000 tcp 10.0.2.105 58821 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:36:45.473409 0.037765 tcp 10.0.2.105 58822 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:45.511508 0.053457 tcp 10.0.2.105 58823 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:45.565220 0.136816 tcp 10.0.2.105 58824 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:36:45.762531 0.392402 tcp 10.0.2.105 58825 -> 46.48.223.67 15494 SPA_* 0 0 9 1175 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:37:00.030848 0.000409 tcp 10.0.2.105 58825 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:37:00.031549 3.008133 tcp 10.0.2.105 58826 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:37:09.031265 0.000000 tcp 10.0.2.105 58826 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:38:55.903958 2.995326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:39:02.905152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:39:10.910535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:39:26.909653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:39:58.915557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:42:15.047149 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:42:15.047315 0.387843 tcp 10.0.2.105 58827 -> 46.48.223.67 15494 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:34.466200 0.225422 tcp 10.0.2.105 58827 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:34.468850 0.036530 tcp 10.0.2.105 58828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:34.505627 0.035129 tcp 10.0.2.105 58829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:34.541047 0.140093 tcp 10.0.2.105 58830 -> 195.113.214.249 443 SRPA* 0 0 24 14812 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:34.691853 2.991806 tcp 10.0.2.105 58831 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:42:43.692677 0.000000 tcp 10.0.2.105 58831 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:42:49.691717 0.036775 tcp 10.0.2.105 58832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:49.728714 0.038648 tcp 10.0.2.105 58833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:49.767645 0.134992 tcp 10.0.2.105 58834 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:42:50.070245 0.379507 tcp 10.0.2.105 58835 -> 46.48.223.67 15494 SPA_* 0 0 9 1230 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:43:03.447805 0.001862 tcp 10.0.2.105 58835 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:43:03.448532 2.996758 tcp 10.0.2.105 58836 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:43:12.443864 0.000000 tcp 10.0.2.105 58836 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:46:02.922679 3.000372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:46:09.928978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:46:17.933981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:46:33.936487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:47:05.939321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:50:26.318362 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:50:26.318491 0.109274 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.406592 0.065938 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.474112 0.186902 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.632509 0.094486 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.717422 0.200794 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.928789 0.075298 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:26.985896 0.094125 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:27.120729 0.224666 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:27.256615 0.617269 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:27.867034 0.040669 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:27.919458 0.059310 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:27.976536 0.206388 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.141496 0.237514 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.358472 0.084081 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.404467 0.190655 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.591857 0.181438 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.751184 0.098019 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.831185 0.161440 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:28.986483 0.136977 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:29.374806 0.124607 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:29.655211 0.061663 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:29.699074 0.187451 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:29.947635 0.674551 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:30.586454 0.117461 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:30.663899 0.281565 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 02:50:33.460687 0.383140 tcp 10.0.2.105 58837 -> 46.48.223.67 15494 SPA_* 0 0 9 1171 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:00.337954 0.232267 tcp 10.0.2.105 58837 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:00.339879 0.036508 tcp 10.0.2.105 58838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:00.376413 0.036536 tcp 10.0.2.105 58839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:00.413221 0.144358 tcp 10.0.2.105 58840 -> 195.113.214.249 443 SRPA* 0 0 47 40930 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:00.570683 3.000369 tcp 10.0.2.105 58841 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:51:09.570643 0.000000 tcp 10.0.2.105 58841 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:51:15.569467 0.039057 tcp 10.0.2.105 58842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:15.608859 0.037476 tcp 10.0.2.105 58843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:15.646691 0.133976 tcp 10.0.2.105 58844 -> 195.113.214.249 443 SRPA* 0 0 42 21460 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:15.821418 0.389466 tcp 10.0.2.105 58845 -> 46.48.223.67 15494 SPA_* 0 0 9 1171 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:30.883629 2.769785 tcp 10.0.2.105 58845 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:51:30.884164 2.990632 tcp 10.0.2.105 58846 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:51:39.883242 0.000000 tcp 10.0.2.105 58846 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:53:09.946518 3.000621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 02:53:16.953111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:53:24.954508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:53:40.959064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:54:12.963413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 02:56:45.884141 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 02:56:45.884257 0.403204 tcp 10.0.2.105 58847 -> 46.48.223.67 15494 SPA_* 0 0 9 1062 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:16.288943 0.037417 tcp 10.0.2.105 58848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:16.326671 0.035040 tcp 10.0.2.105 58849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:16.362099 0.132195 tcp 10.0.2.105 58850 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:16.404336 0.111814 tcp 10.0.2.105 58847 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:16.516576 3.005484 tcp 10.0.2.105 58851 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:57:25.520160 0.000000 tcp 10.0.2.105 58851 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:57:31.509500 0.034409 tcp 10.0.2.105 58852 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:31.544276 0.039633 tcp 10.0.2.105 58853 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:31.584163 0.162352 tcp 10.0.2.105 58854 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:32.015477 2.833558 tcp 10.0.2.105 58855 -> 46.48.223.67 15494 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/20 02:57:34.845982 3.002955 tcp 10.0.2.105 58856 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 02:57:43.850806 0.000000 tcp 10.0.2.105 58856 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:00:16.970273 3.000938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:00:23.976916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:00:31.978580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:00:47.981493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:01:19.987588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:02:49.847171 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:02:49.847254 0.365187 tcp 10.0.2.105 58857 -> 46.48.223.67 15494 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:20.212127 0.033924 tcp 10.0.2.105 58858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:20.246292 0.043034 tcp 10.0.2.105 58859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:20.289602 0.135765 tcp 10.0.2.105 58860 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:20.447088 0.385818 tcp 10.0.2.105 58857 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:20.447447 2.997512 tcp 10.0.2.105 58861 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:03:29.443511 0.000000 tcp 10.0.2.105 58861 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:03:35.442986 0.037885 tcp 10.0.2.105 58862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:35.481132 0.035029 tcp 10.0.2.105 58863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:35.516481 0.146463 tcp 10.0.2.105 58864 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:35.674321 0.390293 tcp 10.0.2.105 58865 -> 46.48.223.67 15494 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:41.847521 0.001352 tcp 10.0.2.105 58865 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:03:41.848078 2.997676 tcp 10.0.2.105 58866 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:03:50.844728 0.000000 tcp 10.0.2.105 58866 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:07:23.994053 3.002813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:07:31.000944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:07:39.001850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:07:55.007233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:08:27.011671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:08:56.844996 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:08:56.845182 1.020895 tcp 10.0.2.105 58867 -> 46.48.223.67 15494 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:27.850523 0.048525 tcp 10.0.2.105 58868 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:27.899392 0.037189 tcp 10.0.2.105 58869 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:27.936938 0.146087 tcp 10.0.2.105 58870 -> 195.113.214.249 443 SRPA* 0 0 33 18758 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:28.093710 0.637253 tcp 10.0.2.105 58867 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:28.094018 2.999419 tcp 10.0.2.105 58871 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:09:37.102639 0.000000 tcp 10.0.2.105 58871 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:09:43.091423 0.036857 tcp 10.0.2.105 58872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:43.128564 0.048554 tcp 10.0.2.105 58873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:43.177416 0.136374 tcp 10.0.2.105 58874 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:09:43.324134 0.394048 tcp 10.0.2.105 58875 -> 46.48.223.67 15494 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:10:13.714949 2.599228 tcp 10.0.2.105 58875 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:10:13.715273 3.009110 tcp 10.0.2.105 58876 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:10:22.717777 0.000000 tcp 10.0.2.105 58876 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:14:31.023147 2.996343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:14:38.025128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:14:46.026046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:15:02.029759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:15:34.035334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:20:44.241644 0.000000 arp 10.0.2.105 who 10.0.2.2 INT 1 42 flow=Background-ARP 1970/02/20 03:20:54.758978 0.000000 arp 10.0.2.105 who 10.0.2.2 RSP 1 42 flow=Background-ARP 1970/02/20 03:20:54.759113 0.188656 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:20:54.918410 0.093758 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:20:56.206423 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 03:21:09.050855 2.167097 tcp 10.0.2.105 58877 -> 46.48.223.67 15494 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:10.973858 0.034778 tcp 10.0.2.105 58878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.008990 0.034941 tcp 10.0.2.105 58879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.044505 0.138829 tcp 10.0.2.105 58880 -> 195.113.214.249 443 SRPA* 0 0 50 38880 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.179996 0.037214 tcp 10.0.2.105 58881 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.217534 0.038061 tcp 10.0.2.105 58882 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.218154 0.665206 tcp 10.0.2.105 58883 -> 46.48.223.67 15494 SPA_* 0 0 9 1133 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.255882 0.236445 tcp 10.0.2.105 58884 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:11.492912 0.082880 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:11.555817 0.106541 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:11.642188 0.064045 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:11.911371 0.081055 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.089280 0.185666 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.207852 0.058417 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.524183 0.119993 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.616487 0.173933 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.786510 0.039565 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:12.827681 0.238314 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.045234 0.081911 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.153318 0.187982 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.338087 0.184890 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.500105 0.096116 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.575966 0.163861 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.731531 0.141314 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:13.994690 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 03:21:17.816052 0.000395 tcp 10.0.2.105 58883 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:30.936351 0.036437 tcp 10.0.2.105 58885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:30.973083 0.033970 tcp 10.0.2.105 58886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:31.007324 0.134537 tcp 10.0.2.105 58887 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:21:31.142396 0.063561 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:31.187006 0.182742 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:31.965426 0.265191 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:32.188784 0.371606 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:32.534189 0.111811 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:21:47.808747 2.960711 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:21:54.921803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:22:02.829517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:22:18.610847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:22:50.176345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:26:13.888827 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:26:13.888918 0.351604 tcp 10.0.2.105 58888 -> 46.48.223.67 15494 SPA_* 0 0 9 1042 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:29.033868 0.211911 tcp 10.0.2.105 58888 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:29.035830 0.034042 tcp 10.0.2.105 58889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:29.070128 0.038046 tcp 10.0.2.105 58890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:29.108511 0.119468 tcp 10.0.2.105 58891 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:29.246014 2.967237 tcp 10.0.2.105 58892 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:26:38.141184 0.000000 tcp 10.0.2.105 58892 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:26:44.038622 0.036716 tcp 10.0.2.105 58893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:44.075598 0.038842 tcp 10.0.2.105 58894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:44.114809 0.142721 tcp 10.0.2.105 58895 -> 195.113.214.249 443 SRPA* 0 0 36 19120 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:44.280390 0.354259 tcp 10.0.2.105 58896 -> 46.48.223.67 15494 SPA_* 0 0 9 1042 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:52.820483 0.000348 tcp 10.0.2.105 58896 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:26:52.821038 2.959415 tcp 10.0.2.105 58897 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:27:01.693823 0.000000 tcp 10.0.2.105 58897 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:28:49.147139 2.953094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:28:56.053980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:29:03.937707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:29:19.731114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:29:51.303050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:32:03.450570 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:32:03.450684 0.397057 tcp 10.0.2.105 58898 -> 46.48.223.67 15494 SPA_* 0 0 9 1041 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:25.472865 0.222850 tcp 10.0.2.105 58898 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:25.475393 0.034243 tcp 10.0.2.105 58899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:25.509912 0.041032 tcp 10.0.2.105 58900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:25.551279 0.133868 tcp 10.0.2.105 58901 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:25.695972 2.965474 tcp 10.0.2.105 58902 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:32:34.577991 0.000000 tcp 10.0.2.105 58902 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:32:40.494052 0.034072 tcp 10.0.2.105 58903 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:40.528578 0.034275 tcp 10.0.2.105 58904 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:40.563108 0.143566 tcp 10.0.2.105 58905 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:40.722748 1.911504 tcp 10.0.2.105 58906 -> 46.48.223.67 15494 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:32:42.634509 2.959503 tcp 10.0.2.105 58907 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:32:51.506755 0.000000 tcp 10.0.2.105 58907 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:35:52.100705 3.000324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:35:59.106766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:36:07.108564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:36:23.111325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:36:55.117243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:37:56.837315 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:37:56.837411 0.382949 tcp 10.0.2.105 58908 -> 46.48.223.67 15494 SPA_* 0 0 9 1170 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:18.372345 0.238749 tcp 10.0.2.105 58908 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:18.374355 0.036310 tcp 10.0.2.105 58909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:18.410918 0.034623 tcp 10.0.2.105 58910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:18.445836 0.154265 tcp 10.0.2.105 58911 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:18.611349 3.000403 tcp 10.0.2.105 58912 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:38:27.610106 0.000000 tcp 10.0.2.105 58912 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:38:33.610079 0.034808 tcp 10.0.2.105 58913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:33.645183 0.036221 tcp 10.0.2.105 58914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:33.681745 0.143698 tcp 10.0.2.105 58915 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:33.855831 0.386541 tcp 10.0.2.105 58916 -> 46.48.223.67 15494 SPA_* 0 0 9 1170 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:48.532968 0.000768 tcp 10.0.2.105 58916 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:38:48.533565 3.001355 tcp 10.0.2.105 58917 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:38:57.533324 0.000000 tcp 10.0.2.105 58917 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:42:59.123738 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:43:06.131026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:43:14.132612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:43:30.135358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:44:02.141340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:44:03.533920 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:44:03.534025 2.001293 tcp 10.0.2.105 58918 -> 46.48.223.67 15494 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:05.311420 0.038227 tcp 10.0.2.105 58919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:05.349876 0.036767 tcp 10.0.2.105 58920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:05.387017 0.131907 tcp 10.0.2.105 58921 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:05.535549 3.005083 tcp 10.0.2.105 58922 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:44:14.539190 0.000000 tcp 10.0.2.105 58922 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:44:20.528421 0.041096 tcp 10.0.2.105 58923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:20.569826 0.038856 tcp 10.0.2.105 58924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:20.609055 0.143677 tcp 10.0.2.105 58925 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:20.765529 3.315592 tcp 10.0.2.105 58926 -> 46.48.223.67 15494 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:44:24.081326 2.997245 tcp 10.0.2.105 58927 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:44:33.075619 0.000000 tcp 10.0.2.105 58927 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:51:45.507944 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:51:45.508126 0.201810 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:51:45.720761 0.667588 udp 10.0.2.105 7010 <-> 85.250.5.183 3636 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:51:46.388851 0.184545 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:51:46.547064 0.096445 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:51:46.632905 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 03:51:54.090160 0.381418 tcp 10.0.2.105 58928 -> 46.48.223.67 15494 SPA_* 0 0 9 1217 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.256039 0.041568 tcp 10.0.2.105 58929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.297883 0.038249 tcp 10.0.2.105 58930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.336573 0.148665 tcp 10.0.2.105 58931 -> 195.113.214.249 443 SRPA* 0 0 25 16212 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.485802 0.082764 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:04.501192 0.235513 tcp 10.0.2.105 58928 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.501787 0.036641 tcp 10.0.2.105 58932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.538821 0.038320 tcp 10.0.2.105 58933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.577478 0.148757 tcp 10.0.2.105 58934 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.581848 0.168140 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:04.700255 0.098945 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:04.736849 1.378055 tcp 10.0.2.105 58935 -> 46.48.223.67 15494 SPA_* 0 0 9 1217 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:52:04.778319 0.084002 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:04.846929 0.128590 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:04.931772 0.171596 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.100196 0.075410 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.175305 0.238138 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.393187 0.089139 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.442068 0.190933 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.629750 0.059097 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.699368 0.141071 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.832108 0.183076 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:05.993390 0.097317 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.071869 0.173361 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.227267 0.061262 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.271660 0.186662 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.433728 0.111827 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.506692 0.270056 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:06.735605 0.367655 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/20 03:52:15.620038 0.000505 tcp 10.0.2.105 58935 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:55:40.148360 3.001272 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 03:55:47.154737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:55:55.156634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:56:11.161013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:56:43.165637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 03:57:15.612554 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 03:57:15.612688 0.365551 tcp 10.0.2.105 58936 -> 46.48.223.67 15494 SPA_* 0 0 9 1194 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:31.943995 0.239034 tcp 10.0.2.105 58936 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:31.945915 0.035303 tcp 10.0.2.105 58937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:31.981538 0.039962 tcp 10.0.2.105 58938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:32.021754 0.140222 tcp 10.0.2.105 58939 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:32.183341 2.996947 tcp 10.0.2.105 58940 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:57:41.179090 0.000000 tcp 10.0.2.105 58940 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:57:47.178282 0.036343 tcp 10.0.2.105 58941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:47.214931 0.038566 tcp 10.0.2.105 58942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:47.253837 0.145189 tcp 10.0.2.105 58943 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:47.408949 2.655573 tcp 10.0.2.105 58944 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/20 03:57:50.064805 3.001116 tcp 10.0.2.105 58945 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 03:57:59.064082 0.000000 tcp 10.0.2.105 58945 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:02:47.171446 3.001912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:02:54.179384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:03:02.180292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:03:05.065077 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:03:05.065221 4.434431 tcp 10.0.2.105 58946 -> 46.48.223.67 15494 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:09.280629 0.037434 tcp 10.0.2.105 58947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:09.318340 0.034782 tcp 10.0.2.105 58948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:09.353407 0.136431 tcp 10.0.2.105 58949 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:09.499866 2.995369 tcp 10.0.2.105 58950 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:03:18.184911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:03:18.495312 0.000000 tcp 10.0.2.105 58950 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:03:24.492970 0.035584 tcp 10.0.2.105 58951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:24.528869 0.071768 tcp 10.0.2.105 58952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:24.600882 0.151171 tcp 10.0.2.105 58953 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:24.768728 2.678714 tcp 10.0.2.105 58954 -> 46.48.223.67 15494 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:03:27.447654 3.003507 tcp 10.0.2.105 58955 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:03:36.449672 0.000000 tcp 10.0.2.105 58955 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:03:50.189433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:08:42.450565 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:08:42.450756 0.358048 tcp 10.0.2.105 58956 -> 46.48.223.67 15494 SPA_* 0 0 9 1136 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:12.804676 0.039448 tcp 10.0.2.105 58957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:12.844541 0.043745 tcp 10.0.2.105 58958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:12.888590 0.141253 tcp 10.0.2.105 58959 -> 195.113.214.249 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:13.039859 0.371042 tcp 10.0.2.105 58956 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:13.040208 2.997681 tcp 10.0.2.105 58960 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:09:22.036644 0.000000 tcp 10.0.2.105 58960 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:09:28.035828 0.035290 tcp 10.0.2.105 58961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:28.071405 0.036965 tcp 10.0.2.105 58962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:28.108649 0.143837 tcp 10.0.2.105 58963 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:28.263699 0.356168 tcp 10.0.2.105 58964 -> 46.48.223.67 15494 SPA_* 0 0 9 1136 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:38.479839 0.000402 tcp 10.0.2.105 58964 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:09:38.480507 2.993976 tcp 10.0.2.105 58965 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:09:47.483185 0.000000 tcp 10.0.2.105 58965 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:10:18.199881 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:10:25.207701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:10:33.209245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:10:49.211724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:11:21.221013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:14:53.483940 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:14:53.484050 0.357748 tcp 10.0.2.105 58966 -> 46.48.223.67 15494 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:03.838458 0.228341 tcp 10.0.2.105 58966 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:03.840958 0.038785 tcp 10.0.2.105 58967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:03.879995 0.035343 tcp 10.0.2.105 58968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:03.915593 0.141527 tcp 10.0.2.105 58969 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:04.067006 3.006318 tcp 10.0.2.105 58970 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:15:13.071161 0.000000 tcp 10.0.2.105 58970 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:15:19.060578 0.036980 tcp 10.0.2.105 58971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:19.097847 0.035175 tcp 10.0.2.105 58972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:19.133279 0.137850 tcp 10.0.2.105 58973 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:19.288059 1.989435 tcp 10.0.2.105 58974 -> 46.48.223.67 15494 FSPA* 0 0 14 1570 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:15:21.277741 3.000049 tcp 10.0.2.105 58975 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:15:30.275856 0.000000 tcp 10.0.2.105 58975 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:17:25.223994 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:17:32.231383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:17:40.233208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:17:56.236475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:18:28.242236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:22:20.806506 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:22:20.806732 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:22:38.924988 0.037240 tcp 10.0.2.105 58976 -> 195.113.214.245 80 FSPA* 0 0 10 1882 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:38.962452 0.049410 tcp 10.0.2.105 58977 -> 195.113.214.249 80 FSPA* 0 0 10 1913 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:39.012204 0.148236 tcp 10.0.2.105 58978 -> 195.113.214.249 443 SRPA* 0 0 21 13054 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:39.160991 0.201226 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:22:39.382341 0.095012 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:22:39.467990 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:22:51.290410 0.357211 tcp 10.0.2.105 58979 -> 46.48.223.67 15494 SPA_* 0 0 9 1176 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.160343 0.034425 tcp 10.0.2.105 58980 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.194681 0.034667 tcp 10.0.2.105 58981 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.229608 0.142430 tcp 10.0.2.105 58982 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.372818 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:22:58.727943 0.333087 tcp 10.0.2.105 58979 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.728544 0.033993 tcp 10.0.2.105 58983 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.762790 0.037911 tcp 10.0.2.105 58984 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:58.801006 0.165788 tcp 10.0.2.105 58985 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:22:59.061253 0.357548 tcp 10.0.2.105 58986 -> 46.48.223.67 15494 SPA_* 0 0 9 1176 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:23:15.114810 0.036702 tcp 10.0.2.105 58987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:23:15.151821 0.035682 tcp 10.0.2.105 58988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:23:15.187764 0.142251 tcp 10.0.2.105 58989 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:23:15.330548 0.126202 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1415 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:15.446396 0.114473 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:15.542831 0.087964 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:15.632990 0.154243 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:15.736856 0.164880 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:15.841674 0.302461 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.141722 0.041077 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.184420 0.237626 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.401730 0.093567 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.454875 0.142652 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.589555 0.220484 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.787583 0.092089 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:16.863547 0.187592 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.047782 0.061096 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.107079 0.163104 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.262291 0.062330 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.306584 0.186024 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.470388 0.109157 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 1930 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.542637 0.266771 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:17.770220 0.354167 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:18.125580 0.000000 udp 10.0.2.105 7010 -> 85.250.5.183 3636 REQ 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:23:23.256218 0.000000 udp 10.0.2.105 7010 -> 70.52.239.176 3931 REQ 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:23:24.013015 0.000411 tcp 10.0.2.105 58986 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:23:28.583829 0.180356 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 2873 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:28.754823 0.602078 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 3161 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:29.365628 1.700137 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 2989 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:31.045695 0.101710 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 8 3206 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:31.129074 0.163250 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 8 3247 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:31.301592 0.265303 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 8 2860 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:31.520046 0.303471 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 8 2908 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:31.771705 0.328766 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3065 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:32.097525 0.077961 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 8 2955 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:32.190146 0.458542 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 2801 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:32.629445 0.143294 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2971 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:32.735541 0.274261 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 8 3025 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:33.001424 0.338120 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 8 3029 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:33.318954 0.155583 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 8 3033 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:33.456146 0.367055 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 8 3083 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:33.820434 0.101158 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 8 2880 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:33.920463 0.107275 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 2944 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:34.010001 0.337158 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3056 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:34.324077 0.173633 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 8 3202 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:34.455941 0.507943 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3078 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:34.921010 0.680510 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 2955 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:35.574691 0.312399 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 8 2910 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:23:35.880768 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:23:44.484965 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:23:49.382525 0.000143 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:23:53.131001 0.000000 udp 10.0.2.105 7010 -> 86.111.207.35 7043 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:23:58.404810 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:03.413993 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:08.491788 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:13.277872 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:24:14.900476 0.000000 udp 10.0.2.105 7010 -> 81.174.18.218 7660 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:22.741651 0.000000 udp 10.0.2.105 7010 -> 77.96.161.186 4205 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:29.511394 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:32.248137 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:24:34.648854 0.000000 udp 10.0.2.105 7010 -> 24.196.62.34 5071 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:39.255312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:24:39.285317 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:24:41.759589 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:47.256959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:24:50.271350 0.000000 udp 10.0.2.105 7010 -> 198.109.142.207 3620 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:24:57.283626 0.000000 udp 10.0.2.105 7010 -> 41.133.213.35 3445 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:03.259918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:25:05.363562 0.000000 udp 10.0.2.105 7010 -> 74.123.121.2 5888 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:10.280093 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:25:11.822323 0.000000 udp 10.0.2.105 7010 -> 93.167.174.219 1060 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:17.160150 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:22.458614 0.000000 udp 10.0.2.105 7010 -> 105.225.95.151 3276 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:30.379264 0.064103 udp 10.0.2.105 7010 -> 94.34.135.181 9141 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:30.443367 0.000000 icmp 94.34.135.181 0x0303 -> 10.0.2.105 0xb523 URP 192 1 284 flow=Background 1970/02/20 04:25:35.280494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:25:35.300339 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:25:36.107311 0.000000 udp 10.0.2.105 7010 -> 5.64.164.125 6810 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:42.917101 0.000000 udp 10.0.2.105 7010 -> 41.251.191.156 1965 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:51.519686 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:25:57.247555 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:01.783627 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:26:02.945801 0.000000 udp 10.0.2.105 7010 -> 85.37.188.113 5284 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:09.459468 0.000000 udp 10.0.2.105 7010 -> 93.193.137.247 7662 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:18.167808 0.000000 udp 10.0.2.105 7010 -> 37.116.141.157 1160 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:26.898846 0.000000 udp 10.0.2.105 7010 -> 108.176.77.223 2660 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:31.782787 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:26:32.454944 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:39.614716 0.000000 udp 10.0.2.105 7010 -> 87.236.253.84 2434 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:47.692776 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:26:55.391427 0.000000 udp 10.0.2.105 7010 -> 84.177.48.131 4751 INT 0 1 314 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:00.277931 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:27:03.733536 0.000000 udp 10.0.2.105 7010 -> 195.251.4.38 4713 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:12.685894 0.000000 udp 10.0.2.105 7010 -> 122.168.61.47 7527 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:18.163849 0.000000 udp 10.0.2.105 7010 -> 58.11.127.101 3563 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:25.674714 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:30.281076 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:27:34.587591 0.000000 udp 10.0.2.105 7010 -> 50.192.180.74 9237 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:41.838085 0.000000 udp 10.0.2.105 7010 -> 74.246.131.85 6143 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:48.317514 0.000000 udp 10.0.2.105 7010 -> 82.31.103.235 4708 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:54.607231 0.000000 udp 10.0.2.105 7010 -> 2.145.78.81 7265 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:27:59.282978 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:28:02.036447 0.000000 udp 10.0.2.105 7010 -> 80.13.85.187 6632 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:07.975843 0.000000 udp 10.0.2.105 7010 -> 5.55.59.69 3472 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:13.863920 0.000000 udp 10.0.2.105 7010 -> 89.148.189.101 1620 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:22.706480 0.000000 udp 10.0.2.105 7010 -> 79.15.159.149 4487 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:24.009046 0.353252 tcp 10.0.2.105 58990 -> 46.48.223.67 15494 SPA_* 0 0 9 1199 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:30.700944 0.000000 udp 10.0.2.105 7010 -> 36.70.130.204 6594 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:35.895786 0.000000 udp 10.0.2.105 7010 -> 210.11.5.74 8551 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:36.056534 0.594135 tcp 10.0.2.105 58990 -> 46.48.223.67 15494 FA_F* 0 0 6 840 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:36.058731 0.039466 tcp 10.0.2.105 58991 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:36.098538 0.038914 tcp 10.0.2.105 58992 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:36.137753 0.148257 tcp 10.0.2.105 58993 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:36.303292 3.006968 tcp 10.0.2.105 58994 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:28:43.006249 0.000000 udp 10.0.2.105 7010 -> 68.115.251.18 1081 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:45.327020 0.000000 tcp 10.0.2.105 58994 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:28:50.065770 0.000000 udp 10.0.2.105 7010 -> 12.228.223.66 1918 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:28:51.298578 0.101804 tcp 10.0.2.105 58995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:51.400679 0.037572 tcp 10.0.2.105 58996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:51.438554 0.140786 tcp 10.0.2.105 58997 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:51.589175 0.358285 tcp 10.0.2.105 58998 -> 46.48.223.67 15494 SPA_* 0 0 9 1199 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:28:56.646323 0.000000 udp 10.0.2.105 7010 -> 95.241.117.244 9044 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:00.720772 0.000391 tcp 10.0.2.105 58998 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:29:00.721398 2.994484 tcp 10.0.2.105 58999 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:29:05.301900 0.224074 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 8 3251 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:29:05.518957 0.000000 udp 10.0.2.105 7010 -> 5.178.114.71 6892 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:09.714525 0.000000 tcp 10.0.2.105 58999 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:29:13.711785 0.000000 udp 10.0.2.105 7010 -> 95.244.85.160 1675 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:19.985183 0.000000 udp 10.0.2.105 7010 -> 86.150.192.235 3805 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:24.785498 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:29:28.423064 0.000000 udp 10.0.2.105 7010 -> 74.92.139.9 6232 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:34.710470 0.000000 udp 10.0.2.105 7010 -> 72.204.145.167 6875 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:42.011118 0.000000 udp 10.0.2.105 7010 -> 79.41.65.36 9512 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:49.832071 0.161051 udp 10.0.2.105 7010 -> 83.63.205.173 5172 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:29:49.993122 0.000000 icmp 83.63.205.173 0x0303 -> 10.0.2.105 0x3414 URP 192 1 227 flow=Background 1970/02/20 04:29:54.778912 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:29:56.100838 0.000000 udp 10.0.2.105 7010 -> 149.148.152.15 4602 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:02.140599 1.945010 udp 10.0.2.105 7010 <-> 14.96.35.23 5139 CON 0 0 8 3329 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:30:04.039086 0.000000 udp 10.0.2.105 7010 -> 2.24.54.176 7327 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:12.143721 0.000000 udp 10.0.2.105 7010 -> 49.49.50.50 3211 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:18.946415 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 3695 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:23.780497 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:30:26.825444 0.000000 udp 10.0.2.105 7010 -> 69.142.19.111 5316 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:34.186121 0.000000 udp 10.0.2.105 7010 -> 93.65.172.16 9969 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:41.015884 0.000000 udp 10.0.2.105 7010 -> 62.103.237.181 6235 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:46.423329 0.000000 udp 10.0.2.105 7010 -> 67.205.210.66 9868 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:51.280135 0.000297 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:30:52.542484 0.000000 udp 10.0.2.105 7010 -> 185.30.65.165 7249 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:30:58.461120 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:04.609646 0.000000 udp 10.0.2.105 7010 -> 190.11.70.224 1028 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:13.055514 0.000000 udp 10.0.2.105 7010 -> 188.216.16.156 9444 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:17.778417 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:31:21.293716 0.154191 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 8 2922 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:31:21.457777 0.000000 udp 10.0.2.105 7010 -> 81.145.152.146 6563 INT 0 1 307 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:29.375014 0.000000 udp 10.0.2.105 7010 -> 62.38.240.175 2343 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:37.015861 0.000000 udp 10.0.2.105 7010 -> 81.136.159.188 4898 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:39.272701 3.000821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:31:41.783018 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:31:44.276631 0.493307 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 8 2745 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:31:44.776718 0.000000 udp 10.0.2.105 7010 -> 86.42.95.150 6606 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:46.279265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:31:50.706154 0.698289 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 8 3034 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:31:51.428709 0.068269 udp 10.0.2.105 7010 <-> 151.100.6.227 2255 CON 0 0 8 3066 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:31:51.513461 0.377668 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 8 2942 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:31:51.916547 0.000000 udp 10.0.2.105 7010 -> 93.136.180.6 8796 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:31:54.281177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:32:00.750539 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:07.820386 0.000000 udp 10.0.2.105 7010 -> 41.134.20.234 8954 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:10.285880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:32:12.777890 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:32:13.068898 0.000000 udp 10.0.2.105 7010 -> 95.226.48.49 8701 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:21.742430 0.000000 udp 10.0.2.105 7010 -> 79.24.111.17 8548 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:30.493317 0.000000 udp 10.0.2.105 7010 -> 41.218.250.123 5865 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:38.674589 0.092273 udp 10.0.2.105 7010 -> 41.233.127.128 8752 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:38.766862 0.000000 icmp 41.233.127.128 0x0303 -> 10.0.2.105 0x3022 URP 192 1 260 flow=Background 1970/02/20 04:32:42.290279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:32:43.281293 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:32:45.163985 0.000000 udp 10.0.2.105 7010 -> 201.22.95.14 5701 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:53.876880 0.000000 udp 10.0.2.105 7010 -> 212.76.75.90 8093 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:32:59.696751 0.000000 udp 10.0.2.105 7010 -> 195.67.143.122 9832 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:05.253452 0.000000 udp 10.0.2.105 7010 -> 41.56.12.56 1126 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:09.779534 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:33:11.872714 0.000000 udp 10.0.2.105 7010 -> 197.218.197.114 1719 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:19.713535 0.000000 udp 10.0.2.105 7010 -> 109.46.205.179 1863 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:26.704794 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:35.416662 0.000000 udp 10.0.2.105 7010 -> 121.54.49.20 6868 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:40.283341 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:33:42.857395 0.000000 udp 10.0.2.105 7010 -> 188.13.62.92 8086 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:48.805671 0.000000 udp 10.0.2.105 7010 -> 82.166.84.225 1082 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:33:55.445382 0.385457 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 8 2931 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:33:55.841647 0.000000 udp 10.0.2.105 7010 -> 93.62.189.220 6399 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:02.895825 0.088642 udp 10.0.2.105 7010 -> 85.107.160.235 2982 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:02.984467 0.000000 icmp 85.107.160.235 0x0303 -> 10.0.2.105 0xa60b URP 192 1 337 flow=Background 1970/02/20 04:34:07.782718 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:34:11.343882 0.000000 udp 10.0.2.105 7010 -> 129.42.208.174 8474 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:15.724639 0.348927 tcp 10.0.2.105 59000 -> 46.48.223.67 15494 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:18.328362 0.000000 udp 10.0.2.105 7010 -> 203.45.32.207 3828 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:25.388298 0.481044 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 8 3183 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:34:25.886709 0.000000 udp 10.0.2.105 7010 -> 31.193.18.31 8857 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:32.154859 0.266983 tcp 10.0.2.105 59000 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:32.156768 0.037704 tcp 10.0.2.105 59001 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:32.194774 0.079695 tcp 10.0.2.105 59002 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:32.274783 0.136959 tcp 10.0.2.105 59003 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:32.422076 3.000525 tcp 10.0.2.105 59004 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:34:33.770251 0.000000 udp 10.0.2.105 7010 -> 62.103.214.8 4029 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:40.810160 0.079489 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 8 3256 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:34:40.898808 0.000000 udp 10.0.2.105 7010 -> 76.118.185.82 7983 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:41.422795 0.000000 tcp 10.0.2.105 59004 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:34:46.969371 0.000000 udp 10.0.2.105 7010 -> 95.242.141.15 5824 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:47.420380 0.036249 tcp 10.0.2.105 59005 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:47.456975 0.038239 tcp 10.0.2.105 59006 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:47.495544 0.138056 tcp 10.0.2.105 59007 -> 195.113.214.249 443 SRPA* 0 0 34 19478 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:47.651745 0.348962 tcp 10.0.2.105 59008 -> 46.48.223.67 15494 SPA_* 0 0 9 1023 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:54.780463 0.244885 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 3020 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:34:55.006051 0.548859 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 8 3133 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:34:55.581925 0.000000 udp 10.0.2.105 7010 -> 78.38.9.251 3592 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:34:59.233185 0.000371 tcp 10.0.2.105 59008 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:34:59.233782 3.009168 tcp 10.0.2.105 59009 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:35:04.144009 0.000000 udp 10.0.2.105 7010 -> 222.92.109.219 7434 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:08.239983 0.000000 tcp 10.0.2.105 59009 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:35:12.646076 0.000000 udp 10.0.2.105 7010 -> 71.123.169.224 2475 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:20.427434 0.000000 udp 10.0.2.105 7010 -> 2.14.32.183 2078 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:25.284034 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:35:28.238719 0.000000 udp 10.0.2.105 7010 -> 41.102.177.156 3803 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:36.200057 0.827482 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 2955 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:35:37.053645 0.000000 udp 10.0.2.105 7010 -> 165.145.81.35 9653 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:43.881238 0.117081 udp 10.0.2.105 7010 <-> 86.180.100.233 7055 CON 0 0 8 3179 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:35:43.997596 0.000000 udp 10.0.2.105 7010 -> 49.205.80.105 2801 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:52.103392 0.000000 udp 10.0.2.105 7010 -> 68.150.80.145 8704 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:35:56.779245 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:35:57.570959 0.000000 udp 10.0.2.105 7010 -> 95.240.125.163 6576 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:05.572473 0.000000 udp 10.0.2.105 7010 -> 94.5.84.81 6956 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:12.372366 0.000000 udp 10.0.2.105 7010 -> 24.150.237.208 6408 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:21.184692 0.163697 udp 10.0.2.105 7010 -> 183.82.0.3 8676 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:21.348389 0.000000 icmp 183.82.0.3 0x0303 -> 10.0.2.105 0xe421 URP 192 1 116 flow=Background 1970/02/20 04:36:25.781047 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:36:29.196206 0.000000 udp 10.0.2.105 7010 -> 213.175.34.150 7460 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:35.147745 0.000000 udp 10.0.2.105 7010 -> 193.231.137.1 1279 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:43.266404 0.357670 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 8 3182 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:36:43.651860 0.000000 udp 10.0.2.105 7010 -> 171.4.210.6 6984 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 04:36:49.886035 0.710830 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 8 2940 flow=From-Botnet-V2-UDP-Established 1970/02/20 04:36:54.782129 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:38:46.295560 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:38:53.303424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:39:01.304596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:39:17.307960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:39:49.313854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:40:14.230382 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:40:14.230526 2.993384 tcp 10.0.2.105 59010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:40:23.232828 0.000000 tcp 10.0.2.105 59010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:40:29.232945 0.035329 tcp 10.0.2.105 59011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:29.268508 0.038885 tcp 10.0.2.105 59012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:29.307713 0.138903 tcp 10.0.2.105 59013 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:29.456957 0.359712 tcp 10.0.2.105 59014 -> 46.48.223.67 15494 SPA_* 0 0 9 1047 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:37.945687 0.246165 tcp 10.0.2.105 59014 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:37.946445 0.050267 tcp 10.0.2.105 59015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:37.996983 0.036455 tcp 10.0.2.105 59016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:38.033768 0.148698 tcp 10.0.2.105 59017 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:38.192057 2.996509 tcp 10.0.2.105 59018 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:40:47.186852 0.000000 tcp 10.0.2.105 59018 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:40:53.186619 0.087512 tcp 10.0.2.105 59019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:53.274422 0.038542 tcp 10.0.2.105 59020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:53.313299 0.143414 tcp 10.0.2.105 59021 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:40:53.468161 3.001941 tcp 10.0.2.105 59022 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:41:02.469059 0.000000 tcp 10.0.2.105 59022 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:41:08.467841 1.164321 tcp 10.0.2.105 59023 -> 46.48.223.67 15494 SPA_* 0 0 9 1047 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:41:15.581711 0.000371 tcp 10.0.2.105 59023 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:41:15.582297 2.999741 tcp 10.0.2.105 59024 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:41:24.580866 0.000000 tcp 10.0.2.105 59024 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:45:53.319728 3.004862 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:46:00.333691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:46:08.328713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:46:24.332013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:46:30.581623 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:46:30.581827 2.993465 tcp 10.0.2.105 59025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:46:39.573476 0.000000 tcp 10.0.2.105 59025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:46:45.595602 0.039535 tcp 10.0.2.105 59026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:45.635459 0.041110 tcp 10.0.2.105 59027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:45.676905 0.206282 tcp 10.0.2.105 59028 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:45.893770 2.073138 tcp 10.0.2.105 59029 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:47.723046 0.042333 tcp 10.0.2.105 59030 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:47.765676 0.038657 tcp 10.0.2.105 59031 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:47.804569 0.151172 tcp 10.0.2.105 59032 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:46:47.967199 3.005484 tcp 10.0.2.105 59033 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:46:56.337655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:46:56.968648 0.000000 tcp 10.0.2.105 59033 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:47:02.967924 0.035473 tcp 10.0.2.105 59034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:47:03.003688 0.038446 tcp 10.0.2.105 59035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:47:03.042460 0.145956 tcp 10.0.2.105 59036 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:47:03.225224 3.006853 tcp 10.0.2.105 59037 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:47:12.231226 0.000000 tcp 10.0.2.105 59037 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:47:18.219349 4.531817 tcp 10.0.2.105 59038 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:47:22.751358 2.998950 tcp 10.0.2.105 59039 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:47:31.748929 0.000000 tcp 10.0.2.105 59039 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:52:37.749392 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:52:37.749579 3.003609 tcp 10.0.2.105 59040 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:52:46.761365 0.000000 tcp 10.0.2.105 59040 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:52:52.751937 0.037644 tcp 10.0.2.105 59041 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:52.789840 0.040789 tcp 10.0.2.105 59042 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:52.830940 0.133410 tcp 10.0.2.105 59043 -> 195.113.214.249 443 SRPA* 0 0 35 26480 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:52.985105 2.084661 tcp 10.0.2.105 59044 -> 46.48.223.67 15494 FSPA* 0 0 14 1519 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:54.821541 0.043419 tcp 10.0.2.105 59045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:54.865249 0.036489 tcp 10.0.2.105 59046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:54.902067 0.150593 tcp 10.0.2.105 59047 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:52:55.070011 2.997637 tcp 10.0.2.105 59048 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:53:00.344487 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 04:53:04.066309 0.000000 tcp 10.0.2.105 59048 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:53:07.351354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:53:10.067378 0.357012 tcp 10.0.2.105 59049 -> 46.48.223.67 15494 SPA_* 0 0 9 989 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:53:15.353126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:53:18.219351 0.000361 tcp 10.0.2.105 59049 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:53:31.356537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:54:03.367128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 04:58:18.218480 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 04:58:18.218628 3.003677 tcp 10.0.2.105 59050 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:58:27.221185 0.000000 tcp 10.0.2.105 59050 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:58:33.221772 0.038035 tcp 10.0.2.105 59051 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:33.260082 0.037817 tcp 10.0.2.105 59052 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:33.298195 0.137132 tcp 10.0.2.105 59053 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:33.453814 0.352818 tcp 10.0.2.105 59054 -> 46.48.223.67 15494 SPA_* 0 0 9 1187 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:43.724352 0.246346 tcp 10.0.2.105 59054 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:43.725263 0.040356 tcp 10.0.2.105 59055 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:43.765921 0.042961 tcp 10.0.2.105 59056 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:43.809157 0.139781 tcp 10.0.2.105 59057 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 04:58:43.970939 2.998374 tcp 10.0.2.105 59058 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:58:52.967949 0.000000 tcp 10.0.2.105 59058 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 04:58:58.967078 1.783420 tcp 10.0.2.105 59059 -> 46.48.223.67 15494 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:00:07.367889 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:00:14.381147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:00:22.377011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:00:38.379783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:01:10.385806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:06:56.293776 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:06:56.293958 0.094329 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.379299 0.205711 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.582174 0.073991 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.640473 0.076570 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.717005 0.120313 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.817079 0.043265 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.861640 0.213456 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:56.993546 0.211350 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.090397 0.174561 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.260962 0.148308 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.401305 0.188325 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.568196 0.241016 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2565 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.787878 0.078440 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.830260 0.059915 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.891927 0.069122 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:57.942969 0.184329 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:58.132198 0.093087 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:58.207959 0.187226 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:58.391426 0.109570 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:58.461129 0.573836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:58.995508 0.162180 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:59.151525 0.796739 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:06:59.919642 0.146586 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:00.029331 1.477340 udp 10.0.2.105 7010 <-> 14.96.35.23 5139 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:00.771433 0.477214 tcp 10.0.2.105 59060 -> 46.48.223.67 15494 SPA_* 0 0 9 1241 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:01.371708 0.072708 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2064 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:01.425911 0.222841 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:01.645332 0.379374 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.038220 0.195302 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.229499 0.034241 udp 10.0.2.105 7010 <-> 151.100.6.227 2255 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.265265 0.179053 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.445786 0.240773 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.679594 0.047898 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.740566 0.127108 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:02.826494 0.296300 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:03.123152 0.461644 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:03.581360 0.068577 udp 10.0.2.105 7010 <-> 86.180.100.233 7055 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:03.635720 0.182924 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:03.814231 0.355190 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:07:13.801790 0.244515 tcp 10.0.2.105 59060 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:13.804078 0.035977 tcp 10.0.2.105 59061 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:13.840556 0.040192 tcp 10.0.2.105 59062 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:13.880976 0.147677 tcp 10.0.2.105 59063 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:14.046564 3.006662 tcp 10.0.2.105 59064 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:07:20.399941 3.001940 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 05:07:23.061585 0.000000 tcp 10.0.2.105 59064 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:07:27.413118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:07:29.043502 0.035671 tcp 10.0.2.105 59065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:29.079422 0.043914 tcp 10.0.2.105 59066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:29.123678 0.142579 tcp 10.0.2.105 59067 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:29.279264 2.001509 tcp 10.0.2.105 59068 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:07:31.280981 2.996600 tcp 10.0.2.105 59069 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:07:35.409254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:07:40.276698 0.000000 tcp 10.0.2.105 59069 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:07:51.412442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:08:23.419072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:12:46.277083 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:12:46.277251 3.003408 tcp 10.0.2.105 59070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:12:55.279864 0.000000 tcp 10.0.2.105 59070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:01.279380 0.038307 tcp 10.0.2.105 59071 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:01.317951 0.051614 tcp 10.0.2.105 59072 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:01.369806 0.144848 tcp 10.0.2.105 59073 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:01.525904 2.104452 tcp 10.0.2.105 59074 -> 46.48.223.67 15494 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:03.370891 0.037605 tcp 10.0.2.105 59075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:03.408805 0.035894 tcp 10.0.2.105 59076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:03.444972 0.175915 tcp 10.0.2.105 59077 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:03.630574 2.995032 tcp 10.0.2.105 59078 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:12.623979 0.000000 tcp 10.0.2.105 59078 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:18.623501 0.038621 tcp 10.0.2.105 59079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:18.662454 0.040694 tcp 10.0.2.105 59080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:18.703496 0.142666 tcp 10.0.2.105 59081 -> 195.113.214.249 443 SRPA* 0 0 25 14866 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:18.857990 2.999601 tcp 10.0.2.105 59082 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:27.855946 0.000000 tcp 10.0.2.105 59082 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:33.854336 2.004296 tcp 10.0.2.105 59083 -> 46.48.223.67 15494 FSPA* 0 0 14 1581 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:13:35.849253 3.002422 tcp 10.0.2.105 59084 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:13:44.850630 0.000000 tcp 10.0.2.105 59084 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:14:27.424541 3.004221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:14:34.438574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:14:42.433611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:14:58.436041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:15:30.442295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:18:50.851166 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:18:50.851259 2.992754 tcp 10.0.2.105 59085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:18:59.843380 0.000000 tcp 10.0.2.105 59085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:05.853916 0.039585 tcp 10.0.2.105 59086 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:05.893770 0.037336 tcp 10.0.2.105 59087 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:05.931387 0.159758 tcp 10.0.2.105 59088 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:06.102156 0.351654 tcp 10.0.2.105 59089 -> 46.48.223.67 15494 SPA_* 0 0 9 1122 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:14.083977 0.222352 tcp 10.0.2.105 59089 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:14.084727 0.034635 tcp 10.0.2.105 59090 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:14.119614 0.038762 tcp 10.0.2.105 59091 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:14.158660 0.138191 tcp 10.0.2.105 59092 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:14.306610 3.002160 tcp 10.0.2.105 59093 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:23.307347 0.000000 tcp 10.0.2.105 59093 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:29.306172 0.036735 tcp 10.0.2.105 59094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:29.343224 0.039238 tcp 10.0.2.105 59095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:29.382737 0.146514 tcp 10.0.2.105 59096 -> 195.113.214.249 443 SRPA* 0 0 23 12464 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:29.539886 3.000875 tcp 10.0.2.105 59097 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:38.539124 0.000000 tcp 10.0.2.105 59097 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:44.544401 1.938220 tcp 10.0.2.105 59098 -> 46.48.223.67 15494 FSPA* 0 0 12 1544 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:46.482894 2.992790 tcp 10.0.2.105 59099 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:19:51.743835 0.000187 tcp 10.0.2.105 59098 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:19:55.483397 0.000000 tcp 10.0.2.105 59099 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:21:34.448050 3.002572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:21:41.456833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:21:49.457506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:22:05.460127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:22:37.466429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:25:01.473769 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:25:01.473945 3.003493 tcp 10.0.2.105 59100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:10.475871 0.000000 tcp 10.0.2.105 59100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:16.476699 0.037546 tcp 10.0.2.105 59101 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:16.514499 0.038562 tcp 10.0.2.105 59102 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:16.553330 0.153548 tcp 10.0.2.105 59103 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:16.724960 0.354311 tcp 10.0.2.105 59104 -> 46.48.223.67 15494 SPA_* 0 0 9 1013 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:25.026749 0.235627 tcp 10.0.2.105 59104 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:25.027502 0.037404 tcp 10.0.2.105 59105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:25.065145 0.039552 tcp 10.0.2.105 59106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:25.104996 0.148076 tcp 10.0.2.105 59107 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:25.262604 2.999493 tcp 10.0.2.105 59108 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:34.261774 0.000000 tcp 10.0.2.105 59108 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:40.269254 0.036707 tcp 10.0.2.105 59109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:40.306315 0.036227 tcp 10.0.2.105 59110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:40.342883 0.156952 tcp 10.0.2.105 59111 -> 195.113.214.249 443 SRPA* 0 0 21 11598 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:25:40.524974 2.988540 tcp 10.0.2.105 59112 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:49.522538 0.000000 tcp 10.0.2.105 59112 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:25:55.511136 0.374643 tcp 10.0.2.105 59113 -> 46.48.223.67 15494 SPA_* 0 0 7 905 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:26:01.050646 0.000341 tcp 10.0.2.105 59113 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:26:01.051248 3.002016 tcp 10.0.2.105 59114 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:26:10.061688 0.000000 tcp 10.0.2.105 59114 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:28:41.475639 2.998327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:28:48.479485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:28:56.481272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:29:12.484031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:29:44.490201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:31:16.042449 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:31:16.042541 2.993542 tcp 10.0.2.105 59115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:31:25.034844 0.000000 tcp 10.0.2.105 59115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:31:31.045101 0.036452 tcp 10.0.2.105 59116 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:31:31.081809 0.039863 tcp 10.0.2.105 59117 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:31:31.121935 0.146234 tcp 10.0.2.105 59118 -> 195.113.214.249 443 SRPA* 0 0 24 12632 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:31:31.278327 2.999783 tcp 10.0.2.105 59119 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:31:40.276721 0.000000 tcp 10.0.2.105 59119 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:35:48.496042 3.001847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 05:35:55.503612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:36:03.505663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:36:19.508643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:36:51.514264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:37:21.628039 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:37:21.628377 0.072583 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:21.682596 0.091365 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:21.766281 0.118734 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:21.863215 0.041698 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:21.918923 0.094611 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.004280 0.199878 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.214987 0.172681 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.337481 0.203032 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.495210 0.173859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.665896 0.148668 udp 10.0.2.105 7010 <-> 71.181.41.207 9274 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.805641 0.183510 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:22.965186 0.057658 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.021635 0.071372 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.072949 0.187859 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.275874 0.097904 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.354367 0.237639 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.571596 0.092593 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.632937 0.190909 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.820814 0.116051 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:23.896003 0.271826 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:24.125365 0.161768 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:24.281011 0.674210 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:24.926054 0.126393 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:25.010879 0.215458 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:25.222928 0.360604 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:25.584154 0.000000 udp 10.0.2.105 7010 -> 14.96.35.23 5139 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 05:37:31.282329 2.023587 tcp 10.0.2.105 59120 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:33.050578 0.062544 tcp 10.0.2.105 59121 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:33.113442 0.039362 tcp 10.0.2.105 59122 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:33.153092 0.134916 tcp 10.0.2.105 59123 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:33.306171 3.003802 tcp 10.0.2.105 59124 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:37:42.307154 0.000000 tcp 10.0.2.105 59124 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:37:43.128873 0.038325 tcp 10.0.2.105 59125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:43.167437 0.038888 tcp 10.0.2.105 59126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:43.206605 0.138668 tcp 10.0.2.105 59127 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:43.345965 0.094062 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:43.419966 0.194019 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:37:43.609869 0.000000 udp 10.0.2.105 7010 -> 151.100.6.227 2255 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 05:37:48.306281 0.037601 tcp 10.0.2.105 59128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:48.344206 0.040123 tcp 10.0.2.105 59129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:48.384680 0.141499 tcp 10.0.2.105 59130 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:48.539105 4.621261 tcp 10.0.2.105 59131 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:37:53.160691 2.987543 tcp 10.0.2.105 59132 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:38:02.076290 0.037779 tcp 10.0.2.105 59133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:02.114384 0.039024 tcp 10.0.2.105 59134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:02.145874 0.000000 tcp 10.0.2.105 59132 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:38:02.153756 0.153741 tcp 10.0.2.105 59135 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:02.308033 0.191810 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:02.502165 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 05:38:20.993916 0.035970 tcp 10.0.2.105 59136 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:21.030153 0.034990 tcp 10.0.2.105 59137 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:21.065437 0.139818 tcp 10.0.2.105 59138 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:21.205833 0.046741 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:21.238617 0.130147 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:21.323770 0.295666 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:21.610768 0.203653 udp 10.0.2.105 7010 <-> 65.114.199.182 4317 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:21.809710 0.354984 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:22.164554 0.408091 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/20 05:38:22.531147 0.000000 udp 10.0.2.105 7010 -> 86.180.100.233 7055 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 05:38:39.409915 0.034980 tcp 10.0.2.105 59139 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:39.445140 0.038175 tcp 10.0.2.105 59140 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:38:39.483653 0.152789 tcp 10.0.2.105 59141 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:42:55.521111 3.004038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:43:02.527471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:43:08.146484 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:43:08.146648 3.003341 tcp 10.0.2.105 59142 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:10.529282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:43:17.148903 0.000000 tcp 10.0.2.105 59142 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:23.148988 0.035204 tcp 10.0.2.105 59143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:23.184591 0.038869 tcp 10.0.2.105 59144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:23.223802 0.133827 tcp 10.0.2.105 59145 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:23.383639 2.093601 tcp 10.0.2.105 59146 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:25.174021 0.036551 tcp 10.0.2.105 59147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:25.210849 0.035798 tcp 10.0.2.105 59148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:25.246926 0.216883 tcp 10.0.2.105 59149 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:25.477480 2.997624 tcp 10.0.2.105 59150 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:26.532099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:43:34.473317 0.000000 tcp 10.0.2.105 59150 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:40.472696 0.038091 tcp 10.0.2.105 59151 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:40.511038 0.038238 tcp 10.0.2.105 59152 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:40.549611 0.153845 tcp 10.0.2.105 59153 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:40.729067 2.998226 tcp 10.0.2.105 59154 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:49.725772 0.000000 tcp 10.0.2.105 59154 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:43:55.724065 4.236931 tcp 10.0.2.105 59155 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:43:58.537957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:43:59.961188 2.993381 tcp 10.0.2.105 59156 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:44:08.963298 0.000000 tcp 10.0.2.105 59156 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:14.963872 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:49:14.963962 3.003311 tcp 10.0.2.105 59157 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:23.965951 0.000000 tcp 10.0.2.105 59157 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:29.966303 0.040065 tcp 10.0.2.105 59158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:30.006756 0.038272 tcp 10.0.2.105 59159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:30.045316 0.137275 tcp 10.0.2.105 59160 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:30.208184 4.261801 tcp 10.0.2.105 59161 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:34.209601 0.038969 tcp 10.0.2.105 59162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:34.248933 0.039673 tcp 10.0.2.105 59163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:34.288901 0.141622 tcp 10.0.2.105 59164 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:34.470215 2.995195 tcp 10.0.2.105 59165 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:43.463967 0.000000 tcp 10.0.2.105 59165 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:49.463763 0.033411 tcp 10.0.2.105 59166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:49.497495 0.038861 tcp 10.0.2.105 59167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:49.536707 0.179005 tcp 10.0.2.105 59168 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:49:49.756754 3.000519 tcp 10.0.2.105 59169 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:49:58.759233 0.000000 tcp 10.0.2.105 59169 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:50:04.755705 4.097043 tcp 10.0.2.105 59170 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:50:08.852983 3.002099 tcp 10.0.2.105 59171 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:50:17.853035 0.000000 tcp 10.0.2.105 59171 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:55:23.853528 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 05:55:23.853738 3.003936 tcp 10.0.2.105 59172 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:55:32.855702 0.000000 tcp 10.0.2.105 59172 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:55:38.856299 0.039418 tcp 10.0.2.105 59173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:38.895933 0.039001 tcp 10.0.2.105 59174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:38.935224 0.151346 tcp 10.0.2.105 59175 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:39.109164 1.993643 tcp 10.0.2.105 59176 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:39.548330 3.002413 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 05:55:40.869582 0.037333 tcp 10.0.2.105 59177 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:40.907153 0.040013 tcp 10.0.2.105 59178 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:40.947032 0.142157 tcp 10.0.2.105 59179 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:41.103114 3.040985 tcp 10.0.2.105 59180 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:55:46.576661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:55:50.111468 0.000000 tcp 10.0.2.105 59180 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:55:54.557789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:55:56.100664 0.045533 tcp 10.0.2.105 59181 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:56.146543 0.042639 tcp 10.0.2.105 59182 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:56.189478 0.146167 tcp 10.0.2.105 59183 -> 195.113.214.249 443 SRPA* 0 0 23 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:55:56.346408 2.998262 tcp 10.0.2.105 59184 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:56:05.353333 0.000000 tcp 10.0.2.105 59184 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:56:10.563289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 05:56:11.343099 1.772618 tcp 10.0.2.105 59185 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/20 05:56:13.115922 3.004923 tcp 10.0.2.105 59186 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:56:22.106968 0.000000 tcp 10.0.2.105 59186 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 05:56:42.569302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:01:28.107886 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:01:28.108087 3.003181 tcp 10.0.2.105 59187 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:01:37.116936 0.000000 tcp 10.0.2.105 59187 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:01:43.118495 0.039071 tcp 10.0.2.105 59188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:43.157847 0.039832 tcp 10.0.2.105 59189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:43.198004 0.133707 tcp 10.0.2.105 59190 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:43.360436 3.743514 tcp 10.0.2.105 59191 -> 46.48.223.67 15494 FSPA* 0 0 14 1647 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:46.790362 0.041248 tcp 10.0.2.105 59192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:46.831887 0.044611 tcp 10.0.2.105 59193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:46.876760 0.216857 tcp 10.0.2.105 59194 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:01:47.104207 3.004311 tcp 10.0.2.105 59195 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:01:56.107375 0.000000 tcp 10.0.2.105 59195 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:02:02.108809 0.362982 tcp 10.0.2.105 59196 -> 46.48.223.67 15494 SPA_* 0 0 9 1117 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:02:17.045026 0.000467 tcp 10.0.2.105 59196 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:02:46.572877 3.005419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:02:53.589761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:03:01.581847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:03:17.586009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:03:49.590420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:08:48.680860 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:08:48.680960 0.000000 udp 10.0.2.105 7010 -> 14.96.35.23 5139 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:09:05.787151 0.037000 tcp 10.0.2.105 59197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:05.824614 0.035166 tcp 10.0.2.105 59198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:05.860061 0.155445 tcp 10.0.2.105 59199 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:06.016508 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:09:22.980567 0.035010 tcp 10.0.2.105 59200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:23.015855 0.038718 tcp 10.0.2.105 59201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:23.054858 0.138965 tcp 10.0.2.105 59202 -> 195.113.214.249 443 SRPA* 0 0 23 11838 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:23.194363 0.000000 udp 10.0.2.105 7010 -> 151.100.6.227 2255 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:09:41.587561 0.037905 tcp 10.0.2.105 59203 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:41.625840 0.037119 tcp 10.0.2.105 59204 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:41.663277 0.134607 tcp 10.0.2.105 59205 -> 195.113.214.249 443 SRPA* 0 0 21 13094 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:09:41.798445 0.000000 udp 10.0.2.105 7010 -> 86.180.100.233 7055 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:10:00.301531 0.044107 tcp 10.0.2.105 59206 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:00.345939 0.035490 tcp 10.0.2.105 59207 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:00.381722 0.136579 tcp 10.0.2.105 59208 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:00.518961 0.096457 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:00.605717 0.242637 udp 10.0.2.105 7010 <-> 86.26.89.125 3345 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:00.909162 0.114460 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:01.083099 0.078418 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:01.169140 0.074488 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:01.300397 0.000000 udp 10.0.2.105 7010 -> 69.158.122.75 5797 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:10:02.063814 2.240001 tcp 10.0.2.105 59209 -> 46.48.223.67 15494 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:04.068585 0.035910 tcp 10.0.2.105 59210 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:04.104809 0.038134 tcp 10.0.2.105 59211 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:04.143235 0.150071 tcp 10.0.2.105 59212 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:04.304080 0.360792 tcp 10.0.2.105 59213 -> 46.48.223.67 15494 SPA_* 0 0 9 1163 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:10.151845 0.000339 tcp 10.0.2.105 59213 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:12.705458 0.029261 udp 10.0.2.105 7010 <- 69.158.122.75 5797 RSP 0 0 5 1966 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:10:12.705895 0.058969 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:12.992272 0.064166 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:13.038417 0.193280 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:13.166828 0.204189 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:13.367954 0.172744 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:13.537831 0.204942 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:13.699124 0.000000 udp 10.0.2.105 7010 -> 71.181.41.207 9274 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:10:18.602291 3.002088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:10:25.610000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:10:29.863661 0.049762 tcp 10.0.2.105 59214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:29.913797 0.040151 tcp 10.0.2.105 59215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:29.954258 0.145635 tcp 10.0.2.105 59216 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:30.100698 0.111468 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.175241 0.237303 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.393210 0.096081 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2071 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.487164 0.184614 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.688513 0.085061 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.736189 0.190065 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:30.922745 0.301192 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:31.180776 0.162547 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:31.337655 0.565741 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:31.875645 0.133333 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:31.967926 0.350887 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:32.338530 0.216600 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:32.552585 0.074670 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:32.606018 0.193966 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:32.796612 0.191416 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:33.006482 0.409795 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 5 2018 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:10:33.407800 0.000000 udp 10.0.2.105 7010 -> 65.114.199.182 4317 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:10:33.612967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:10:49.614614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:10:49.975525 0.037092 tcp 10.0.2.105 59217 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:50.012925 0.035829 tcp 10.0.2.105 59218 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:50.049043 0.140519 tcp 10.0.2.105 59219 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:10:50.190107 0.000000 udp 10.0.2.105 7010 -> 79.227.180.34 2430 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:11:05.197533 0.039613 tcp 10.0.2.105 59220 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:11:05.237493 0.037591 tcp 10.0.2.105 59221 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:11:05.275332 0.151142 tcp 10.0.2.105 59222 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:11:05.426973 0.180972 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:11:05.563177 0.355834 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:11:05.920479 0.358209 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:11:21.620909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:15:10.149601 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:15:10.149729 2.993559 tcp 10.0.2.105 59223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:19.151743 0.000000 tcp 10.0.2.105 59223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:25.153251 0.040000 tcp 10.0.2.105 59224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:25.193550 0.038988 tcp 10.0.2.105 59225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:25.232793 0.135274 tcp 10.0.2.105 59226 -> 195.113.214.249 443 SRPA* 0 0 24 11968 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:25.382121 2.016995 tcp 10.0.2.105 59227 -> 46.48.223.67 15494 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:27.167703 0.038023 tcp 10.0.2.105 59228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:27.206073 0.036912 tcp 10.0.2.105 59229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:27.243286 0.136827 tcp 10.0.2.105 59230 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:27.399384 3.002623 tcp 10.0.2.105 59231 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:36.396847 0.000000 tcp 10.0.2.105 59231 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:42.396116 0.037115 tcp 10.0.2.105 59232 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:42.433564 0.034687 tcp 10.0.2.105 59233 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:42.468497 0.148597 tcp 10.0.2.105 59234 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:42.627737 3.006073 tcp 10.0.2.105 59235 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:51.631649 0.000000 tcp 10.0.2.105 59235 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:15:57.627857 1.797318 tcp 10.0.2.105 59236 -> 46.48.223.67 15494 FSPA* 0 0 14 1746 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:15:59.425537 2.999033 tcp 10.0.2.105 59237 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:16:08.433114 0.000000 tcp 10.0.2.105 59237 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:17:25.626440 3.001768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:17:32.634024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:17:40.635545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:17:56.641747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:18:28.646037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:21:14.424434 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:21:14.424571 3.002698 tcp 10.0.2.105 59238 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:21:23.425888 0.000000 tcp 10.0.2.105 59238 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:21:29.426385 0.038199 tcp 10.0.2.105 59239 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:29.464884 0.043546 tcp 10.0.2.105 59240 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:29.508807 0.145848 tcp 10.0.2.105 59241 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:29.664475 4.019994 tcp 10.0.2.105 59242 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:33.440555 0.036985 tcp 10.0.2.105 59243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:33.477904 0.038830 tcp 10.0.2.105 59244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:33.517222 0.156012 tcp 10.0.2.105 59245 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:33.684745 3.000147 tcp 10.0.2.105 59246 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:21:42.683392 0.000000 tcp 10.0.2.105 59246 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:21:48.682588 0.037310 tcp 10.0.2.105 59247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:48.720175 0.044299 tcp 10.0.2.105 59248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:48.764745 0.161008 tcp 10.0.2.105 59249 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:21:48.944384 3.001760 tcp 10.0.2.105 59250 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:21:57.945571 0.000000 tcp 10.0.2.105 59250 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:22:03.943747 1.787338 tcp 10.0.2.105 59251 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:22:05.731240 2.999953 tcp 10.0.2.105 59252 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:22:14.729449 0.000000 tcp 10.0.2.105 59252 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:24:32.650112 3.008910 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:24:39.663414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:24:47.659387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:25:03.662789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:25:35.674804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:27:20.729839 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:27:20.730010 2.993717 tcp 10.0.2.105 59253 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:27:29.732081 0.000000 tcp 10.0.2.105 59253 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:27:35.733165 0.040683 tcp 10.0.2.105 59254 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:35.774178 0.037037 tcp 10.0.2.105 59255 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:35.811420 0.133454 tcp 10.0.2.105 59256 -> 195.113.214.249 443 SRPA* 0 0 41 22658 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:35.998357 2.030990 tcp 10.0.2.105 59257 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:37.803990 0.033797 tcp 10.0.2.105 59258 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:37.838094 0.037847 tcp 10.0.2.105 59259 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:37.876378 0.143542 tcp 10.0.2.105 59260 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:38.029559 3.004076 tcp 10.0.2.105 59261 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:27:47.027772 0.000000 tcp 10.0.2.105 59261 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:27:53.026398 0.036884 tcp 10.0.2.105 59262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:53.063554 0.100286 tcp 10.0.2.105 59263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:53.164191 0.149190 tcp 10.0.2.105 59264 -> 195.113.214.249 443 SRPA* 0 0 24 14642 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:27:53.326700 3.003931 tcp 10.0.2.105 59265 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:28:02.329191 0.000000 tcp 10.0.2.105 59265 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:28:08.327945 3.657058 tcp 10.0.2.105 59266 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:28:11.985194 3.002202 tcp 10.0.2.105 59267 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:28:20.986354 0.000000 tcp 10.0.2.105 59267 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:31:39.679464 2.997540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:31:46.682575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:31:54.684076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:32:10.686423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:32:42.692273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:33:26.986134 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:33:26.986286 3.004202 tcp 10.0.2.105 59268 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:33:35.992126 0.000000 tcp 10.0.2.105 59268 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:33:41.989430 0.038026 tcp 10.0.2.105 59269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:42.027731 0.045143 tcp 10.0.2.105 59270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:42.073210 0.133298 tcp 10.0.2.105 59271 -> 195.113.214.249 443 SRPA* 0 0 41 22752 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:42.217017 2.084129 tcp 10.0.2.105 59272 -> 46.48.223.67 15494 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:44.077660 0.035809 tcp 10.0.2.105 59273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:44.113736 0.039865 tcp 10.0.2.105 59274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:44.153844 0.136670 tcp 10.0.2.105 59275 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:44.301379 2.993878 tcp 10.0.2.105 59276 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:33:53.293707 0.000000 tcp 10.0.2.105 59276 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:33:59.293553 0.039770 tcp 10.0.2.105 59277 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:59.333618 0.038808 tcp 10.0.2.105 59278 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:59.372749 0.149290 tcp 10.0.2.105 59279 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:33:59.532829 2.994204 tcp 10.0.2.105 59280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:34:08.525593 0.000000 tcp 10.0.2.105 59280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:34:14.525184 1.873612 tcp 10.0.2.105 59281 -> 46.48.223.67 15494 FSPA* 0 0 14 1599 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:34:16.399005 3.002192 tcp 10.0.2.105 59282 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:34:25.402403 0.000000 tcp 10.0.2.105 59282 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:38:46.697757 3.002597 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:38:53.705588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:39:01.707877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:39:17.710611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:39:49.716120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:41:15.450214 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:41:15.450318 0.000000 udp 10.0.2.105 7010 -> 71.181.41.207 9274 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:41:30.473269 0.036692 tcp 10.0.2.105 59283 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:30.510289 0.037475 tcp 10.0.2.105 59284 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:30.548069 0.137828 tcp 10.0.2.105 59285 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:30.686435 0.000000 udp 10.0.2.105 7010 -> 65.114.199.182 4317 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:41:49.250924 0.043922 tcp 10.0.2.105 59286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:49.295181 0.044608 tcp 10.0.2.105 59287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:49.340075 0.143325 tcp 10.0.2.105 59288 -> 195.113.214.249 443 SRPA* 0 0 41 22790 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:41:49.484025 0.046461 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:41:49.514966 0.000000 udp 10.0.2.105 7010 -> 86.26.89.125 3345 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 06:42:01.416378 2.830644 tcp 10.0.2.105 59289 -> 46.48.223.67 15494 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:04.010016 0.034529 tcp 10.0.2.105 59290 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:04.044813 0.034729 tcp 10.0.2.105 59291 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:04.079842 0.150881 tcp 10.0.2.105 59292 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:04.247346 2.816031 tcp 10.0.2.105 59293 -> 46.48.223.67 15494 FSPA* 0 0 14 1556 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:07.775192 0.039020 tcp 10.0.2.105 59294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:07.814474 0.040328 tcp 10.0.2.105 59295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:07.855378 0.138379 tcp 10.0.2.105 59296 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:42:07.994410 0.096123 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.079255 0.146938 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.226677 0.072301 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.280896 0.111144 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.409498 0.181493 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.569131 0.199614 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.770344 0.196765 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.901192 0.068594 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:08.951799 0.060737 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.010424 0.210270 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.146858 0.175253 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.319578 0.238152 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.537100 0.117289 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.654592 0.098476 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.735511 0.190211 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.922640 0.091289 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:09.975928 0.186232 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:10.189681 0.261408 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:10.411944 0.271705 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:10.676008 0.860900 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:11.507576 0.227492 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:11.732552 0.349067 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:12.093865 0.136297 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:12.191149 0.256799 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:12.426419 0.205075 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:12.633109 0.194628 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:12.824196 0.283901 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:13.100777 0.134665 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:13.187094 0.355345 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:42:13.572198 0.366941 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/20 06:45:53.722807 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:46:00.730154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:46:08.731346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:46:24.734238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:46:56.740472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:47:07.055771 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:47:07.055893 3.003863 tcp 10.0.2.105 59297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:16.063877 0.000000 tcp 10.0.2.105 59297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:22.060935 0.038196 tcp 10.0.2.105 59298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:22.099428 0.037759 tcp 10.0.2.105 59299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:22.137460 0.140241 tcp 10.0.2.105 59300 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:22.296254 2.324747 tcp 10.0.2.105 59301 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:24.397242 0.036313 tcp 10.0.2.105 59302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:24.433803 0.037567 tcp 10.0.2.105 59303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:24.471678 0.138086 tcp 10.0.2.105 59304 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:24.621240 2.993399 tcp 10.0.2.105 59305 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:33.613485 0.000000 tcp 10.0.2.105 59305 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:39.612614 0.037011 tcp 10.0.2.105 59306 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:39.649895 0.041945 tcp 10.0.2.105 59307 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:39.692192 0.167405 tcp 10.0.2.105 59308 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:39.871475 2.995097 tcp 10.0.2.105 59309 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:48.865139 0.000000 tcp 10.0.2.105 59309 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:47:54.864037 2.793479 tcp 10.0.2.105 59310 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:47:57.657055 3.005216 tcp 10.0.2.105 59311 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:48:06.672209 0.000000 tcp 10.0.2.105 59311 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:00.746136 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 06:53:07.759844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:53:12.652072 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:53:12.652184 2.992880 tcp 10.0.2.105 59312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:15.754990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:53:21.643500 0.000000 tcp 10.0.2.105 59312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:27.654636 0.038873 tcp 10.0.2.105 59313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:27.693819 0.045119 tcp 10.0.2.105 59314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:27.739206 0.151458 tcp 10.0.2.105 59315 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:27.901610 2.062438 tcp 10.0.2.105 59316 -> 46.48.223.67 15494 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:29.690493 0.040251 tcp 10.0.2.105 59317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:29.731023 0.073573 tcp 10.0.2.105 59318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:29.804966 0.148846 tcp 10.0.2.105 59319 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:29.964309 3.006491 tcp 10.0.2.105 59320 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:31.758335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:53:38.969037 0.000000 tcp 10.0.2.105 59320 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:44.958191 0.057824 tcp 10.0.2.105 59321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:45.016449 0.038667 tcp 10.0.2.105 59322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:45.055408 0.147117 tcp 10.0.2.105 59323 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:53:45.222213 2.999582 tcp 10.0.2.105 59324 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:53:54.220534 0.000000 tcp 10.0.2.105 59324 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:54:00.219751 1.839107 tcp 10.0.2.105 59325 -> 46.48.223.67 15494 FSPA* 0 0 14 1606 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:54:02.059123 2.996943 tcp 10.0.2.105 59326 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:54:03.764348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 06:54:11.054626 0.000000 tcp 10.0.2.105 59326 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:59:17.057389 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 06:59:17.057481 3.001987 tcp 10.0.2.105 59327 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:59:26.057831 0.000000 tcp 10.0.2.105 59327 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:59:32.058075 0.037725 tcp 10.0.2.105 59328 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:32.096121 0.038366 tcp 10.0.2.105 59329 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:32.134860 0.159643 tcp 10.0.2.105 59330 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:32.947707 0.370840 tcp 10.0.2.105 59331 -> 46.48.223.67 15494 SPA_* 0 0 9 1200 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:44.477661 0.233846 tcp 10.0.2.105 59331 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:44.478445 0.036601 tcp 10.0.2.105 59332 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:44.515331 0.036303 tcp 10.0.2.105 59333 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:44.551881 0.140677 tcp 10.0.2.105 59334 -> 195.113.214.249 443 SRPA* 0 0 41 22790 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:44.711796 3.001121 tcp 10.0.2.105 59335 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:59:53.707495 0.000000 tcp 10.0.2.105 59335 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 06:59:59.708515 0.035016 tcp 10.0.2.105 59336 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:59.743795 0.038646 tcp 10.0.2.105 59337 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:59.782743 0.142025 tcp 10.0.2.105 59338 -> 195.113.214.249 443 SRPA* 0 0 25 16288 flow=From-Botnet-V2-TCP-Established 1970/02/20 06:59:59.947073 3.003847 tcp 10.0.2.105 59339 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:00:07.771250 3.000811 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:00:08.949460 0.000000 tcp 10.0.2.105 59339 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:00:14.777687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:00:14.938258 1.839717 tcp 10.0.2.105 59340 -> 46.48.223.67 15494 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:00:16.778415 2.996512 tcp 10.0.2.105 59341 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:00:22.783823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:00:25.773533 0.000000 tcp 10.0.2.105 59341 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:00:38.782583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:01:10.788703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:05:31.774201 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:05:31.774400 3.004891 tcp 10.0.2.105 59342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:05:40.776091 0.000000 tcp 10.0.2.105 59342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:05:46.776649 0.058728 tcp 10.0.2.105 59343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:46.835630 0.060599 tcp 10.0.2.105 59344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:46.896560 0.145228 tcp 10.0.2.105 59345 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:47.051345 2.117992 tcp 10.0.2.105 59346 -> 46.48.223.67 15494 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:48.907210 0.060725 tcp 10.0.2.105 59347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:48.968233 0.059498 tcp 10.0.2.105 59348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:49.028019 0.131760 tcp 10.0.2.105 59349 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:05:49.169572 3.003292 tcp 10.0.2.105 59350 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:05:58.171407 0.000000 tcp 10.0.2.105 59350 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:06:04.173963 0.054022 tcp 10.0.2.105 59351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:06:04.228485 0.060401 tcp 10.0.2.105 59352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:06:04.289170 0.143669 tcp 10.0.2.105 59353 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:06:04.449873 2.995112 tcp 10.0.2.105 59354 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:06:13.443518 0.000000 tcp 10.0.2.105 59354 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:06:19.442692 1.857788 tcp 10.0.2.105 59355 -> 46.48.223.67 15494 FSPA* 0 0 14 1598 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:06:21.300173 2.998922 tcp 10.0.2.105 59356 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:06:30.297431 0.000000 tcp 10.0.2.105 59356 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:07:22.796378 3.001211 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:07:29.804081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:07:37.804566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:07:53.807794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:08:25.813828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:12:17.176677 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:12:17.176876 0.000000 udp 10.0.2.105 7010 -> 86.26.89.125 3345 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 07:12:32.390822 0.054828 tcp 10.0.2.105 59357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:32.445866 0.060780 tcp 10.0.2.105 59358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:32.506998 0.143012 tcp 10.0.2.105 59359 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:32.650589 0.045269 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:32.681914 0.093920 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:32.765629 0.096805 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:32.842221 0.072601 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:32.897771 0.128828 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.017020 0.179992 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.172935 0.203643 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.380746 0.163911 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 1955 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.496859 0.065475 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.541354 0.064228 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.603220 0.164397 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.737734 0.170929 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:33.905590 0.238224 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.120507 0.108833 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.190516 0.098778 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.272526 0.187594 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.456657 0.081906 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.500577 0.182991 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:34.674144 0.187929 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2629 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:35.043155 0.270864 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:35.273034 0.345274 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:35.627572 0.386749 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:35.982572 0.229051 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:36.209123 0.128125 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:36.296920 0.073608 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:36.303987 0.371673 tcp 10.0.2.105 59360 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:36.382676 0.179112 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:36.563303 0.197097 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:36.756029 0.297128 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:37.044226 0.380252 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:37.419997 0.130366 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:37.502026 0.355483 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:12:51.317037 0.272717 tcp 10.0.2.105 59360 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:51.317914 0.054848 tcp 10.0.2.105 59361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:51.373040 0.059839 tcp 10.0.2.105 59362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:51.433174 0.141724 tcp 10.0.2.105 59363 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:12:51.590036 3.000079 tcp 10.0.2.105 59364 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:13:00.588817 0.000000 tcp 10.0.2.105 59364 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:13:06.588217 0.058955 tcp 10.0.2.105 59365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:13:06.647032 0.060578 tcp 10.0.2.105 59366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:13:06.707922 0.141639 tcp 10.0.2.105 59367 -> 195.113.214.249 443 SRPA* 0 0 47 29456 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:13:06.865937 1.799555 tcp 10.0.2.105 59368 -> 46.48.223.67 15494 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:13:08.665652 2.999240 tcp 10.0.2.105 59369 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:13:17.673195 0.000000 tcp 10.0.2.105 59369 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:14:29.819697 3.002330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:14:36.827349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:14:44.828759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:15:00.834267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:15:32.837907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:18:23.664156 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:18:23.664327 3.003441 tcp 10.0.2.105 59370 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:18:32.666430 0.000000 tcp 10.0.2.105 59370 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:18:38.666673 0.059158 tcp 10.0.2.105 59371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:38.726126 0.064478 tcp 10.0.2.105 59372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:38.790875 0.147480 tcp 10.0.2.105 59373 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:38.959439 2.112175 tcp 10.0.2.105 59374 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:40.783857 0.057871 tcp 10.0.2.105 59375 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:40.842025 0.057966 tcp 10.0.2.105 59376 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:40.900453 0.151059 tcp 10.0.2.105 59377 -> 195.113.214.249 443 SRPA* 0 0 42 22048 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:41.071877 3.001316 tcp 10.0.2.105 59378 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:18:50.071304 0.000000 tcp 10.0.2.105 59378 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:18:56.070497 0.058786 tcp 10.0.2.105 59379 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:56.129576 0.060912 tcp 10.0.2.105 59380 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:56.190833 0.144622 tcp 10.0.2.105 59381 -> 195.113.214.249 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:18:56.352874 3.001334 tcp 10.0.2.105 59382 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:19:05.356556 0.000000 tcp 10.0.2.105 59382 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:19:11.352119 1.870658 tcp 10.0.2.105 59383 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:19:13.223018 2.995912 tcp 10.0.2.105 59384 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:19:22.217558 0.000000 tcp 10.0.2.105 59384 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:21:36.844093 3.000950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:21:43.851573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:21:51.852859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:22:07.855864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:22:39.865631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:24:28.218245 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:24:28.218345 3.003583 tcp 10.0.2.105 59385 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:24:37.220167 0.000000 tcp 10.0.2.105 59385 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:24:43.221043 0.057008 tcp 10.0.2.105 59386 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:43.278471 0.081486 tcp 10.0.2.105 59387 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:43.360445 0.148744 tcp 10.0.2.105 59388 -> 195.113.214.249 443 SRPA* 0 0 36 19082 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:43.523965 2.119506 tcp 10.0.2.105 59389 -> 46.48.223.67 15494 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:45.377691 0.057213 tcp 10.0.2.105 59390 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:45.435151 0.058177 tcp 10.0.2.105 59391 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:45.493637 0.139708 tcp 10.0.2.105 59392 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:24:45.643827 3.003423 tcp 10.0.2.105 59393 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:24:54.645305 0.000000 tcp 10.0.2.105 59393 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:25:00.644659 0.059961 tcp 10.0.2.105 59394 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:25:00.704922 0.060026 tcp 10.0.2.105 59395 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:25:00.765282 0.153675 tcp 10.0.2.105 59396 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:25:00.937076 3.001815 tcp 10.0.2.105 59397 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:25:09.939805 0.000000 tcp 10.0.2.105 59397 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:25:15.939420 2.000270 tcp 10.0.2.105 59398 -> 46.48.223.67 15494 FSPA* 0 0 14 1693 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:25:17.939923 2.993455 tcp 10.0.2.105 59399 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:25:26.941727 0.000000 tcp 10.0.2.105 59399 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:28:43.867972 3.001433 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:28:50.874692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:28:58.876732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:29:14.887657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:29:46.884995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:30:32.943606 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:30:32.943725 2.996244 tcp 10.0.2.105 59400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:30:41.934578 0.000000 tcp 10.0.2.105 59400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:30:47.954478 0.057599 tcp 10.0.2.105 59401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:30:48.012418 0.060901 tcp 10.0.2.105 59402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:30:48.073627 0.137826 tcp 10.0.2.105 59403 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:30:48.221877 0.361638 tcp 10.0.2.105 59404 -> 46.48.223.67 15494 SPA_* 0 0 9 1082 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:06.241044 0.256844 tcp 10.0.2.105 59404 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:06.241931 0.056562 tcp 10.0.2.105 59405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:06.298854 0.057217 tcp 10.0.2.105 59406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:06.356454 0.130543 tcp 10.0.2.105 59407 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:06.498181 2.996461 tcp 10.0.2.105 59408 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:31:15.502940 0.000000 tcp 10.0.2.105 59408 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:31:21.492411 0.057453 tcp 10.0.2.105 59409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:21.550132 0.059615 tcp 10.0.2.105 59410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:21.610027 0.161202 tcp 10.0.2.105 59411 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:21.796399 3.000084 tcp 10.0.2.105 59412 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:31:30.794327 0.000000 tcp 10.0.2.105 59412 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:31:36.793711 1.839312 tcp 10.0.2.105 59413 -> 46.48.223.67 15494 FSPA* 0 0 14 1612 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:31:38.633226 3.007592 tcp 10.0.2.105 59414 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:31:47.639562 0.000000 tcp 10.0.2.105 59414 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:35:50.891865 3.001486 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:35:57.899588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:36:05.900644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:36:21.903552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:36:53.629925 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:36:53.630085 2.993249 tcp 10.0.2.105 59415 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:36:53.909815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:37:02.632100 0.000000 tcp 10.0.2.105 59415 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:37:08.632612 0.058276 tcp 10.0.2.105 59416 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:37:08.691179 0.060282 tcp 10.0.2.105 59417 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:37:08.751808 0.146355 tcp 10.0.2.105 59418 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:37:08.912737 2.992687 tcp 10.0.2.105 59419 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:37:17.904079 0.000000 tcp 10.0.2.105 59419 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:42:50.913525 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:42:50.913648 0.132074 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.025712 0.068886 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.076657 0.089271 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.157380 0.046258 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.188541 0.094781 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.273140 0.184294 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.435437 0.201624 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.646781 0.183957 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.764741 0.062052 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.886286 0.061601 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:51.946592 0.187927 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.108819 0.172285 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.277474 0.236561 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.493853 0.116340 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.569636 0.088675 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.641554 0.190580 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.828654 0.086320 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:52.875354 0.166663 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2687 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:53.029494 0.193942 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:53.224890 0.351550 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:53.552447 0.274260 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:53.783651 0.319584 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:53.918256 0.371678 tcp 10.0.2.105 59420 -> 46.48.223.67 15494 SPA_* 0 0 9 1203 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:42:54.104846 0.228958 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:54.330702 0.128658 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:42:54.419270 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 07:42:57.917180 3.000324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:43:04.923154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:43:08.117402 0.279570 tcp 10.0.2.105 59420 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:08.120404 0.058563 tcp 10.0.2.105 59421 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:08.179236 0.058498 tcp 10.0.2.105 59422 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:08.238036 0.148679 tcp 10.0.2.105 59423 -> 195.113.214.249 443 SRPA* 0 0 25 14904 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:08.397255 3.005833 tcp 10.0.2.105 59424 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:43:10.353939 0.078921 tcp 10.0.2.105 59425 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:10.433111 0.058331 tcp 10.0.2.105 59426 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:10.491729 0.132953 tcp 10.0.2.105 59427 -> 195.113.214.249 443 SRPA* 0 0 21 11804 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:10.625347 0.191418 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:10.830071 0.211174 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:11.037351 0.286937 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:11.315143 0.355633 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:11.672300 0.373493 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:12.041965 0.129934 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/20 07:43:12.924568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:43:17.401075 0.000000 tcp 10.0.2.105 59424 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:43:23.390507 0.061424 tcp 10.0.2.105 59428 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:23.452437 0.058812 tcp 10.0.2.105 59429 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:23.511533 0.147506 tcp 10.0.2.105 59430 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:23.670288 1.864123 tcp 10.0.2.105 59431 -> 46.48.223.67 15494 FSPA* 0 0 12 1625 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:43:25.534630 3.002480 tcp 10.0.2.105 59432 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:43:28.927350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:43:34.535789 0.000000 tcp 10.0.2.105 59432 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:44:00.933523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:48:40.536002 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:48:40.536142 3.003807 tcp 10.0.2.105 59433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:48:49.538688 0.000000 tcp 10.0.2.105 59433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:48:55.538801 0.042196 tcp 10.0.2.105 59434 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:48:55.581357 0.043030 tcp 10.0.2.105 59435 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:48:55.624720 0.144400 tcp 10.0.2.105 59436 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:48:55.784953 0.369839 tcp 10.0.2.105 59437 -> 46.48.223.67 15494 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:01.364375 0.225077 tcp 10.0.2.105 59437 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:01.365059 0.033757 tcp 10.0.2.105 59438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:01.399074 0.036003 tcp 10.0.2.105 59439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:01.435357 0.144746 tcp 10.0.2.105 59440 -> 195.113.214.249 443 SRPA* 0 0 23 12464 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:01.589682 3.000467 tcp 10.0.2.105 59441 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:49:10.588854 0.000000 tcp 10.0.2.105 59441 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:49:16.587972 0.034983 tcp 10.0.2.105 59442 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:16.623309 0.047170 tcp 10.0.2.105 59443 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:16.670736 0.143682 tcp 10.0.2.105 59444 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:16.825601 3.005888 tcp 10.0.2.105 59445 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:49:25.830819 0.000000 tcp 10.0.2.105 59445 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:49:31.819220 1.828200 tcp 10.0.2.105 59446 -> 46.48.223.67 15494 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:49:33.647608 2.998937 tcp 10.0.2.105 59447 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:49:42.644952 0.000000 tcp 10.0.2.105 59447 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:54:48.645775 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 07:54:48.645893 3.003431 tcp 10.0.2.105 59448 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:54:57.647661 0.000000 tcp 10.0.2.105 59448 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:55:03.650968 0.055099 tcp 10.0.2.105 59449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:03.706429 0.296106 tcp 10.0.2.105 59450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:04.002843 0.147851 tcp 10.0.2.105 59451 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:04.195245 0.368062 tcp 10.0.2.105 59452 -> 46.48.223.67 15494 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:28.393230 2.112763 tcp 10.0.2.105 59452 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:28.394244 0.033634 tcp 10.0.2.105 59453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:28.428117 0.040010 tcp 10.0.2.105 59454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:28.468560 0.182802 tcp 10.0.2.105 59455 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:28.672909 2.993535 tcp 10.0.2.105 59456 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:55:36.946621 3.002330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 07:55:37.664984 0.000000 tcp 10.0.2.105 59456 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:55:43.674362 0.034267 tcp 10.0.2.105 59457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:43.708920 0.106991 tcp 10.0.2.105 59458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:43.816184 0.262622 tcp 10.0.2.105 59459 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:55:43.954635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:55:44.089113 2.999951 tcp 10.0.2.105 59460 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:55:51.955881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:55:53.093856 0.000000 tcp 10.0.2.105 59460 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:55:59.086353 0.366346 tcp 10.0.2.105 59461 -> 46.48.223.67 15494 SPA_* 0 0 9 1211 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:56:05.283897 0.000528 tcp 10.0.2.105 59461 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 07:56:05.284644 3.004817 tcp 10.0.2.105 59462 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:56:07.958945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 07:56:14.287992 0.000000 tcp 10.0.2.105 59462 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 07:56:39.964856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:01:20.278958 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:01:20.279143 3.002984 tcp 10.0.2.105 59463 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:01:29.280671 0.000000 tcp 10.0.2.105 59463 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:01:35.281485 0.059028 tcp 10.0.2.105 59464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:35.340854 0.061248 tcp 10.0.2.105 59465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:35.402442 0.142315 tcp 10.0.2.105 59466 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:35.554576 0.369290 tcp 10.0.2.105 59467 -> 46.48.223.67 15494 SPA_* 0 0 9 1103 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:40.867574 0.276724 tcp 10.0.2.105 59467 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:40.868329 0.056912 tcp 10.0.2.105 59468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:40.925523 0.059210 tcp 10.0.2.105 59469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:40.985011 0.143838 tcp 10.0.2.105 59470 -> 195.113.214.249 443 SRPA* 0 0 23 13814 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:41.144592 3.007499 tcp 10.0.2.105 59471 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:01:50.152980 0.000000 tcp 10.0.2.105 59471 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:01:56.140178 0.080515 tcp 10.0.2.105 59472 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:56.221059 0.060331 tcp 10.0.2.105 59473 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:56.281753 0.141855 tcp 10.0.2.105 59474 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:01:56.444250 2.999872 tcp 10.0.2.105 59475 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:02:05.453179 0.000000 tcp 10.0.2.105 59475 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:02:11.441797 0.374043 tcp 10.0.2.105 59476 -> 46.48.223.67 15494 SPA_* 0 0 9 1103 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:02:16.598233 0.000410 tcp 10.0.2.105 59476 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:02:16.598922 2.994367 tcp 10.0.2.105 59477 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:02:25.601714 0.000000 tcp 10.0.2.105 59477 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:02:43.971347 3.000771 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:02:50.981076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:02:58.980890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:03:14.983180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:03:46.988932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:07:31.603693 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:07:31.603832 2.992326 tcp 10.0.2.105 59478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:07:40.595184 0.000000 tcp 10.0.2.105 59478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:07:46.605048 0.125290 tcp 10.0.2.105 59479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:46.730652 0.059542 tcp 10.0.2.105 59480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:46.790463 0.144201 tcp 10.0.2.105 59481 -> 195.113.214.249 443 SRPA* 0 0 26 14920 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:46.975513 0.363655 tcp 10.0.2.105 59482 -> 46.48.223.67 15494 SPA_* 0 0 9 1188 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:52.012496 0.264778 tcp 10.0.2.105 59482 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:52.013440 0.057838 tcp 10.0.2.105 59483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:52.071562 0.058441 tcp 10.0.2.105 59484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:52.130295 0.135281 tcp 10.0.2.105 59485 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:07:52.277496 2.998213 tcp 10.0.2.105 59486 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:08:01.274435 0.000000 tcp 10.0.2.105 59486 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:08:07.275214 2.027186 tcp 10.0.2.105 59487 -> 46.48.223.67 15494 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:10:15.000136 3.002618 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:10:22.007545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:10:30.008692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:10:46.011378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:11:18.017385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:13:39.060184 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:13:39.060347 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:13:57.259123 0.059136 tcp 10.0.2.105 59488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:13:57.318545 0.060278 tcp 10.0.2.105 59489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:13:57.379096 0.139944 tcp 10.0.2.105 59490 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:13:57.519676 0.120007 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:13:57.649318 0.107415 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:13:57.736682 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:14:09.303727 4.894924 tcp 10.0.2.105 59491 -> 46.48.223.67 15494 SPA_* 0 0 12 1659 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:14.199355 0.058940 tcp 10.0.2.105 59492 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:14.258571 0.059608 tcp 10.0.2.105 59493 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:14.318521 0.157537 tcp 10.0.2.105 59494 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:14.485466 0.000081 tcp 10.0.2.105 59491 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:14.485772 4.800438 tcp 10.0.2.105 59495 -> 46.48.223.67 15494 FSPA* 0 0 14 1767 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:16.484328 0.058594 tcp 10.0.2.105 59496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:16.543184 0.057976 tcp 10.0.2.105 59497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:16.601430 0.225269 tcp 10.0.2.105 59498 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:16.827213 0.094814 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:16.911466 0.183374 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.072687 0.200672 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.282659 0.177748 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.400559 0.070467 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.450933 0.046220 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.527938 0.161012 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.637353 0.061818 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.697134 0.112575 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.771022 0.094786 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:17.847374 0.189576 udp 10.0.2.105 7010 <-> 99.41.90.165 8471 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.033269 0.088396 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.083756 0.163902 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.238902 0.174552 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.410347 0.238450 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.627981 0.309915 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:18.955422 0.195225 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:19.126694 0.587655 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:19.688326 0.272843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:19.920595 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:14:35.822222 0.062162 tcp 10.0.2.105 59499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:35.884674 0.060225 tcp 10.0.2.105 59500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:35.945187 0.141293 tcp 10.0.2.105 59501 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:14:36.087087 0.132466 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:36.179758 0.178947 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:36.377838 0.213122 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:36.586750 0.384635 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:36.967125 0.132658 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:37.054960 0.307831 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:14:37.376537 0.355464 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:17:22.023378 3.001914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:17:29.031024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:17:37.037061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:17:53.035544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:18:25.041490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:19:19.279692 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:19:19.279801 2.993654 tcp 10.0.2.105 59502 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:19:28.282179 0.000000 tcp 10.0.2.105 59502 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:19:34.283048 0.056651 tcp 10.0.2.105 59503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:34.339964 0.059834 tcp 10.0.2.105 59504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:34.400112 0.142448 tcp 10.0.2.105 59505 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:34.623463 4.661263 tcp 10.0.2.105 59506 -> 46.48.223.67 15494 SPA_* 0 0 12 1561 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:39.284977 0.058045 tcp 10.0.2.105 59507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:39.343336 0.114965 tcp 10.0.2.105 59508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:39.458571 0.137908 tcp 10.0.2.105 59509 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:39.637621 0.000096 tcp 10.0.2.105 59506 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:39.637940 3.004935 tcp 10.0.2.105 59510 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:19:48.651693 0.000000 tcp 10.0.2.105 59510 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:19:54.633938 0.057877 tcp 10.0.2.105 59511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:54.692137 0.058827 tcp 10.0.2.105 59512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:54.751233 0.134268 tcp 10.0.2.105 59513 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:19:54.910910 2.994036 tcp 10.0.2.105 59514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:20:03.903291 0.000000 tcp 10.0.2.105 59514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:20:09.903262 0.366959 tcp 10.0.2.105 59515 -> 46.48.223.67 15494 SPA_* 0 0 9 1139 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:20:17.883717 0.000882 tcp 10.0.2.105 59515 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:20:17.884410 3.005334 tcp 10.0.2.105 59516 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:20:26.886005 0.000000 tcp 10.0.2.105 59516 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:24:29.047498 3.005411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:24:36.059014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:24:44.056003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:25:00.059369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:25:32.065388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:25:32.886646 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:25:32.886741 3.004353 tcp 10.0.2.105 59517 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:25:41.889403 0.000000 tcp 10.0.2.105 59517 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:25:47.889815 0.058919 tcp 10.0.2.105 59518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:47.949013 0.057697 tcp 10.0.2.105 59519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:48.006987 0.140568 tcp 10.0.2.105 59520 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:48.166504 4.811955 tcp 10.0.2.105 59521 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:52.702222 0.057631 tcp 10.0.2.105 59522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:52.760219 0.059563 tcp 10.0.2.105 59523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:52.820126 0.146567 tcp 10.0.2.105 59524 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:25:52.978737 3.000707 tcp 10.0.2.105 59525 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:26:01.983377 0.000000 tcp 10.0.2.105 59525 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:26:07.977833 0.058209 tcp 10.0.2.105 59526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:26:08.036398 0.059113 tcp 10.0.2.105 59527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:26:08.095838 0.148778 tcp 10.0.2.105 59528 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:26:08.254523 3.007032 tcp 10.0.2.105 59529 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:26:17.260151 0.000000 tcp 10.0.2.105 59529 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:26:23.249083 1.825314 tcp 10.0.2.105 59530 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:26:25.074609 3.001132 tcp 10.0.2.105 59531 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:26:34.073713 0.000000 tcp 10.0.2.105 59531 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:31:36.071306 3.001533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:31:40.074793 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:31:40.074933 3.006752 tcp 10.0.2.105 59532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:31:43.081851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:31:49.080013 0.000000 tcp 10.0.2.105 59532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:31:51.079978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:31:55.077238 0.108951 tcp 10.0.2.105 59533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:31:55.186459 0.057950 tcp 10.0.2.105 59534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:31:55.244730 0.137051 tcp 10.0.2.105 59535 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:31:55.409037 0.362961 tcp 10.0.2.105 59536 -> 46.48.223.67 15494 SPA_* 0 0 9 1059 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:02.041870 0.274661 tcp 10.0.2.105 59536 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:02.042635 0.057948 tcp 10.0.2.105 59537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:02.100847 0.059327 tcp 10.0.2.105 59538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:02.160465 0.145599 tcp 10.0.2.105 59539 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:02.316770 3.004185 tcp 10.0.2.105 59540 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:32:07.083463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:32:11.319331 0.000000 tcp 10.0.2.105 59540 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:32:17.319317 0.058432 tcp 10.0.2.105 59541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:17.378075 0.057928 tcp 10.0.2.105 59542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:17.436298 0.142801 tcp 10.0.2.105 59543 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:17.588804 3.004037 tcp 10.0.2.105 59544 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:32:26.592081 0.000000 tcp 10.0.2.105 59544 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:32:32.589796 3.825243 tcp 10.0.2.105 59545 -> 46.48.223.67 15494 FSPA* 0 0 14 1589 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:32:36.415355 3.017215 tcp 10.0.2.105 59546 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:32:39.102773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:32:45.418477 0.000000 tcp 10.0.2.105 59546 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:37:51.409296 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:37:51.409538 3.003293 tcp 10.0.2.105 59547 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:00.411179 0.000000 tcp 10.0.2.105 59547 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:06.411628 0.057780 tcp 10.0.2.105 59548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:06.469626 0.058887 tcp 10.0.2.105 59549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:06.528806 0.141179 tcp 10.0.2.105 59550 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:06.689925 4.495655 tcp 10.0.2.105 59551 -> 46.48.223.67 15494 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:10.930596 0.058824 tcp 10.0.2.105 59552 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:10.989651 0.059472 tcp 10.0.2.105 59553 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:11.049416 0.126447 tcp 10.0.2.105 59554 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:11.185775 3.010311 tcp 10.0.2.105 59555 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:20.189918 0.000000 tcp 10.0.2.105 59555 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:26.178856 0.056854 tcp 10.0.2.105 59556 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:26.236015 0.194018 tcp 10.0.2.105 59557 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:26.430287 0.137440 tcp 10.0.2.105 59558 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:26.608916 2.994364 tcp 10.0.2.105 59559 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:35.612336 0.000000 tcp 10.0.2.105 59559 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:41.611005 4.256653 tcp 10.0.2.105 59560 -> 46.48.223.67 15494 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:38:43.095292 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:38:45.867872 3.002887 tcp 10.0.2.105 59561 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:50.102993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:38:54.869379 0.000000 tcp 10.0.2.105 59561 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:38:58.103956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:39:14.107279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:39:46.113187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:45:04.942425 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:45:04.942618 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:45:19.955025 0.058114 tcp 10.0.2.105 59562 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:20.013426 0.059829 tcp 10.0.2.105 59563 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:20.073521 0.141765 tcp 10.0.2.105 59564 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:20.215957 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:45:36.076958 0.058608 tcp 10.0.2.105 59565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:36.135792 0.056044 tcp 10.0.2.105 59566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:36.192263 0.132314 tcp 10.0.2.105 59567 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:36.325246 0.108617 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.452955 0.109172 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.542679 0.181353 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.701830 0.102002 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.794286 0.063434 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.839571 0.046833 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.871016 0.164329 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:36.981509 0.243905 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:37.133161 0.224665 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:37.352178 0.110028 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:37.424405 0.101442 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2613 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:37.507698 0.000000 udp 10.0.2.105 7010 -> 99.41.90.165 8471 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 08:45:45.880667 4.543460 tcp 10.0.2.105 59568 -> 46.48.223.67 15494 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:50.105047 0.058978 tcp 10.0.2.105 59569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:50.119154 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:45:50.164475 0.102943 tcp 10.0.2.105 59570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:50.267664 0.146080 tcp 10.0.2.105 59571 -> 195.113.214.249 443 SRPA* 0 0 24 14774 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:50.424352 3.007135 tcp 10.0.2.105 59572 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:45:56.466492 0.057016 tcp 10.0.2.105 59573 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:56.523796 0.059905 tcp 10.0.2.105 59574 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:56.583960 0.134071 tcp 10.0.2.105 59575 -> 195.113.214.249 443 SRPA* 0 0 22 12866 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:45:56.718674 0.089912 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:56.772210 0.057529 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:56.827762 0.286463 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:57.115485 0.185391 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:57.126907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:45:57.347097 0.176502 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:57.520351 0.174135 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:57.778507 0.236674 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:57.994748 0.265120 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:58.218609 0.376101 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:58.563186 0.124347 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:58.649830 0.202053 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:58.847434 0.365337 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:59.207728 0.130654 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:59.291967 0.178859 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:59.430311 0.000000 tcp 10.0.2.105 59572 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:45:59.472644 0.297844 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:45:59.761286 0.355043 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/20 08:46:05.128376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:46:05.418919 0.059356 tcp 10.0.2.105 59576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:46:05.478555 0.061370 tcp 10.0.2.105 59577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:46:05.540205 0.135439 tcp 10.0.2.105 59578 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:46:05.687372 1.834516 tcp 10.0.2.105 59579 -> 46.48.223.67 15494 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:46:07.522164 2.993619 tcp 10.0.2.105 59580 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:46:16.514251 0.000000 tcp 10.0.2.105 59580 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:46:21.131500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:46:53.137110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:51:22.525231 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:51:22.525331 3.003709 tcp 10.0.2.105 59581 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:51:31.527329 0.000000 tcp 10.0.2.105 59581 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:51:37.528351 0.038869 tcp 10.0.2.105 59582 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:37.567520 0.034948 tcp 10.0.2.105 59583 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:37.602794 0.142808 tcp 10.0.2.105 59584 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:37.780722 2.072956 tcp 10.0.2.105 59585 -> 46.48.223.67 15494 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:39.621917 0.039768 tcp 10.0.2.105 59586 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:39.662027 0.038326 tcp 10.0.2.105 59587 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:39.700657 0.140674 tcp 10.0.2.105 59588 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:39.853934 2.991503 tcp 10.0.2.105 59589 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:51:48.852084 0.000000 tcp 10.0.2.105 59589 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:51:54.853797 0.036916 tcp 10.0.2.105 59590 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:54.890961 0.038352 tcp 10.0.2.105 59591 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:54.929563 0.143536 tcp 10.0.2.105 59592 -> 195.113.214.249 443 SRPA* 0 0 33 18134 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:51:55.085193 3.000774 tcp 10.0.2.105 59593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:52:04.084201 0.000000 tcp 10.0.2.105 59593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:52:10.083223 4.084663 tcp 10.0.2.105 59594 -> 46.48.223.67 15494 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:52:14.168117 3.004791 tcp 10.0.2.105 59595 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:52:23.181889 0.000000 tcp 10.0.2.105 59595 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:57:03.147766 3.003309 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 08:57:10.153869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:57:18.155945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:57:29.162706 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 08:57:29.162913 2.993585 tcp 10.0.2.105 59596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:57:34.159280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:57:38.154346 0.000000 tcp 10.0.2.105 59596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:57:44.165285 0.058765 tcp 10.0.2.105 59597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:44.224543 0.059051 tcp 10.0.2.105 59598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:44.283927 0.143562 tcp 10.0.2.105 59599 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:44.437716 4.253825 tcp 10.0.2.105 59600 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:48.426540 0.058224 tcp 10.0.2.105 59601 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:48.485197 0.060560 tcp 10.0.2.105 59602 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:48.546040 0.135415 tcp 10.0.2.105 59603 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:57:48.691770 2.992285 tcp 10.0.2.105 59604 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:57:57.692792 0.000000 tcp 10.0.2.105 59604 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:58:03.691906 0.057992 tcp 10.0.2.105 59605 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:58:03.750262 0.059932 tcp 10.0.2.105 59606 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:58:03.810492 0.145428 tcp 10.0.2.105 59607 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:58:03.967521 2.998004 tcp 10.0.2.105 59608 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:58:06.164682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 08:58:12.964598 0.000000 tcp 10.0.2.105 59608 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:58:18.963675 1.145974 tcp 10.0.2.105 59609 -> 46.48.223.67 15494 SPA_* 0 0 9 1072 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:58:24.954976 0.000325 tcp 10.0.2.105 59609 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 08:58:24.955550 3.000521 tcp 10.0.2.105 59610 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 08:58:33.954844 0.000000 tcp 10.0.2.105 59610 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:03:39.955768 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:03:39.955876 3.003140 tcp 10.0.2.105 59611 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:03:48.957428 0.000000 tcp 10.0.2.105 59611 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:03:54.958211 0.058774 tcp 10.0.2.105 59612 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:55.017274 0.059667 tcp 10.0.2.105 59613 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:55.077266 0.146094 tcp 10.0.2.105 59614 -> 195.113.214.249 443 SRPA* 0 0 23 13202 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:55.238401 2.019472 tcp 10.0.2.105 59615 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:56.998349 0.055975 tcp 10.0.2.105 59616 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:57.054585 0.058215 tcp 10.0.2.105 59617 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:57.113090 0.133800 tcp 10.0.2.105 59618 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:03:57.258157 2.995609 tcp 10.0.2.105 59619 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:06.262970 0.000000 tcp 10.0.2.105 59619 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:10.170553 3.002180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:04:12.251828 0.057660 tcp 10.0.2.105 59620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:04:12.309789 0.059262 tcp 10.0.2.105 59621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:04:12.369325 0.147066 tcp 10.0.2.105 59622 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:04:12.530885 2.995099 tcp 10.0.2.105 59623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:17.179005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:04:21.524373 0.000000 tcp 10.0.2.105 59623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:25.180011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:04:27.526021 4.459552 tcp 10.0.2.105 59624 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:04:31.985527 2.997935 tcp 10.0.2.105 59625 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:40.992048 0.000000 tcp 10.0.2.105 59625 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:04:41.182199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:05:13.189187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:09:46.982589 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:09:46.982686 3.003791 tcp 10.0.2.105 59626 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:09:55.985427 0.000000 tcp 10.0.2.105 59626 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:10:01.991692 0.057797 tcp 10.0.2.105 59627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:02.049768 0.060725 tcp 10.0.2.105 59628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:02.110776 0.145725 tcp 10.0.2.105 59629 -> 195.113.214.249 443 SRPA* 0 0 25 14790 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:02.267836 4.735484 tcp 10.0.2.105 59630 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:06.654349 0.056716 tcp 10.0.2.105 59631 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:06.711338 0.057428 tcp 10.0.2.105 59632 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:06.769026 0.224341 tcp 10.0.2.105 59633 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:10:07.003536 3.001298 tcp 10.0.2.105 59634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:10:16.004232 0.000000 tcp 10.0.2.105 59634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:10:22.003274 4.418999 tcp 10.0.2.105 59635 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:11:17.195369 3.001158 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:11:24.202107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:11:32.203788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:11:48.207211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:12:20.213007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:16:04.215017 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:16:04.215178 0.000000 udp 10.0.2.105 7010 -> 99.41.90.165 8471 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 09:16:21.982503 0.057413 tcp 10.0.2.105 59636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:22.040146 0.296743 tcp 10.0.2.105 59637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:22.337213 0.138021 tcp 10.0.2.105 59638 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:22.475846 0.109960 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:22.565743 0.394794 udp 10.0.2.105 7010 <-> 69.158.122.75 5797 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:22.936503 0.096370 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.023036 0.069467 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.073619 0.047661 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.105648 0.178962 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.240594 0.197209 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.367169 0.108581 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.477584 0.115134 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.552327 0.201746 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.764728 0.095007 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.840802 0.087210 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.893073 0.061029 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:23.988235 0.295212 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:24.292148 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 2384 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 09:16:26.426967 4.582983 tcp 10.0.2.105 59639 -> 46.48.223.67 15494 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:29.915331 0.008325 udp 10.0.2.105 7010 <- 74.141.181.225 2384 RSP 0 0 5 2055 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 09:16:29.915704 0.251904 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:30.146872 0.186392 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:30.305969 0.175814 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:30.478118 0.251510 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:30.693228 0.377535 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:30.735712 0.058213 tcp 10.0.2.105 59640 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:30.794205 0.057506 tcp 10.0.2.105 59641 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:30.852064 0.141343 tcp 10.0.2.105 59642 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:31.010186 2.987539 tcp 10.0.2.105 59643 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:16:31.040231 0.136954 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:31.139126 0.195997 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:31.330958 0.179954 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:31.512552 0.284948 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:31.788305 0.355270 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:32.144882 0.359686 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:32.500657 0.153788 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:16:39.996572 0.000000 tcp 10.0.2.105 59643 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:16:45.995527 0.057637 tcp 10.0.2.105 59644 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:46.053459 0.060884 tcp 10.0.2.105 59645 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:46.114690 0.144539 tcp 10.0.2.105 59646 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:46.284209 4.253425 tcp 10.0.2.105 59647 -> 46.48.223.67 15494 FSPA* 0 0 14 1665 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:16:50.537861 2.997900 tcp 10.0.2.105 59648 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:16:59.537392 0.000000 tcp 10.0.2.105 59648 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:18:24.218682 3.001886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:18:31.228731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:18:39.230123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:18:55.230736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:19:27.236847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:22:05.535066 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:22:05.535249 3.003653 tcp 10.0.2.105 59649 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:14.537505 0.000000 tcp 10.0.2.105 59649 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:20.544495 0.061400 tcp 10.0.2.105 59650 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:20.606183 0.059185 tcp 10.0.2.105 59651 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:20.665662 0.143828 tcp 10.0.2.105 59652 -> 195.113.214.249 443 SRPA* 0 0 25 16288 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:20.828628 4.916727 tcp 10.0.2.105 59653 -> 46.48.223.67 15494 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:25.470314 0.057186 tcp 10.0.2.105 59654 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:25.527902 0.058413 tcp 10.0.2.105 59655 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:25.586612 0.137617 tcp 10.0.2.105 59656 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:25.745535 3.002053 tcp 10.0.2.105 59657 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:34.746111 0.000000 tcp 10.0.2.105 59657 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:40.745619 0.057475 tcp 10.0.2.105 59658 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:40.803355 0.059664 tcp 10.0.2.105 59659 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:40.863281 0.129378 tcp 10.0.2.105 59660 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:22:41.012693 2.996898 tcp 10.0.2.105 59661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:50.008148 0.000000 tcp 10.0.2.105 59661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:22:56.011122 4.177872 tcp 10.0.2.105 59662 -> 46.48.223.67 15494 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:23:00.188083 2.999216 tcp 10.0.2.105 59663 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:23:09.186181 0.000000 tcp 10.0.2.105 59663 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:25:31.243128 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:25:38.250231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:25:46.251534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:26:02.254718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:26:34.261111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:28:15.186553 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:28:15.186636 3.003319 tcp 10.0.2.105 59664 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:28:24.188512 0.000000 tcp 10.0.2.105 59664 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:28:30.188979 0.056318 tcp 10.0.2.105 59665 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:30.245619 0.057458 tcp 10.0.2.105 59666 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:30.303423 0.197291 tcp 10.0.2.105 59667 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:30.512527 4.408822 tcp 10.0.2.105 59668 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:34.630737 0.056427 tcp 10.0.2.105 59669 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:34.687383 0.058936 tcp 10.0.2.105 59670 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:34.746594 0.156497 tcp 10.0.2.105 59671 -> 195.113.214.249 443 SRPA* 0 0 33 18134 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:34.921681 2.997133 tcp 10.0.2.105 59672 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:28:43.917334 0.000000 tcp 10.0.2.105 59672 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:28:49.916330 0.058295 tcp 10.0.2.105 59673 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:49.974928 0.058982 tcp 10.0.2.105 59674 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:50.034173 0.135275 tcp 10.0.2.105 59675 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:28:50.378918 3.002012 tcp 10.0.2.105 59676 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:28:59.379436 0.000000 tcp 10.0.2.105 59676 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:29:05.378423 4.100799 tcp 10.0.2.105 59677 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:29:09.479458 2.998988 tcp 10.0.2.105 59678 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:29:18.480880 0.000000 tcp 10.0.2.105 59678 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:32:38.267567 3.000998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:32:45.273926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:32:53.275639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:33:09.278878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:33:41.285060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:34:24.484485 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:34:24.484642 3.002455 tcp 10.0.2.105 59679 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:34:33.483788 0.000000 tcp 10.0.2.105 59679 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:34:39.481450 0.058345 tcp 10.0.2.105 59680 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:39.540059 0.058086 tcp 10.0.2.105 59681 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:39.598412 0.138833 tcp 10.0.2.105 59682 -> 195.113.214.249 443 SRPA* 0 0 22 11858 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:39.755543 4.454855 tcp 10.0.2.105 59683 -> 46.48.223.67 15494 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:43.855747 0.056291 tcp 10.0.2.105 59684 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:43.912450 0.057905 tcp 10.0.2.105 59685 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:43.970624 0.229379 tcp 10.0.2.105 59686 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:44.210633 2.998517 tcp 10.0.2.105 59687 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:34:53.207966 0.000000 tcp 10.0.2.105 59687 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:34:59.207488 0.057739 tcp 10.0.2.105 59688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:59.265481 0.058742 tcp 10.0.2.105 59689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:59.324513 0.137566 tcp 10.0.2.105 59690 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:34:59.480422 3.000930 tcp 10.0.2.105 59691 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:35:08.480006 0.000000 tcp 10.0.2.105 59691 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:35:14.478816 4.090702 tcp 10.0.2.105 59692 -> 46.48.223.67 15494 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:35:18.569739 2.999113 tcp 10.0.2.105 59693 -> 68.123.230.161 5582 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:35:27.567653 0.000000 tcp 10.0.2.105 59693 -> 68.123.230.161 5582 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:39:45.293992 2.998445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:39:52.298139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:40:00.303623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:40:16.302566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:40:33.568049 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:40:33.568355 3.003559 tcp 10.0.2.105 59694 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:40:42.570288 0.000000 tcp 10.0.2.105 59694 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:40:48.308800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:40:48.570611 0.058403 tcp 10.0.2.105 59695 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:48.629266 0.058917 tcp 10.0.2.105 59696 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:48.688615 0.148504 tcp 10.0.2.105 59697 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:48.851164 4.416312 tcp 10.0.2.105 59698 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:52.999061 0.056446 tcp 10.0.2.105 59699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:53.055853 0.058852 tcp 10.0.2.105 59700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:53.115013 0.142744 tcp 10.0.2.105 59701 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:40:53.267686 3.007744 tcp 10.0.2.105 59702 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:41:02.268873 0.000000 tcp 10.0.2.105 59702 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:41:08.267616 0.349416 tcp 10.0.2.105 59703 -> 46.48.223.67 15494 SPA_* 0 0 9 1072 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:41:13.397101 0.000903 tcp 10.0.2.105 59703 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:34.286491 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:46:34.286587 0.103173 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:34.378382 0.068670 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:34.429194 0.047732 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:34.548942 0.102889 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:34.631329 0.000000 udp 10.0.2.105 7010 -> 69.158.122.75 5797 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 09:46:43.399599 4.356047 tcp 10.0.2.105 59704 -> 46.48.223.67 15494 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:47.446233 0.063248 tcp 10.0.2.105 59705 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:47.509759 0.057145 tcp 10.0.2.105 59706 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:47.567201 0.174174 tcp 10.0.2.105 59707 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:47.755970 4.053567 tcp 10.0.2.105 59708 -> 46.48.223.67 15494 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:50.792306 0.054826 tcp 10.0.2.105 59709 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:50.847413 0.058731 tcp 10.0.2.105 59710 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:50.906452 0.142824 tcp 10.0.2.105 59711 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:46:51.049807 0.176228 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.180939 0.157448 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.288016 0.138909 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.428225 0.114483 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.506009 0.201400 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.708866 0.096045 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.787904 0.120510 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.870727 0.062339 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:51.931289 0.291828 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:52.224492 0.166546 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:52.314323 3.001754 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:46:52.379046 0.236146 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:52.596722 0.185591 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:52.789971 0.258896 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:53.046199 0.248865 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:53.260512 0.357416 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:53.592118 0.126708 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:53.682902 0.287092 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:53.966714 0.356584 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:54.338250 0.195515 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:54.530058 0.191627 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:54.738140 0.355487 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:55.089284 0.133423 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/20 09:46:59.322132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:47:07.323476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:47:23.326636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:47:55.332821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:51:51.802949 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:51:51.803065 3.004358 tcp 10.0.2.105 59712 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:52:00.805306 0.000000 tcp 10.0.2.105 59712 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:52:06.805741 0.058161 tcp 10.0.2.105 59713 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:06.864144 0.058717 tcp 10.0.2.105 59714 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:06.923157 0.147378 tcp 10.0.2.105 59715 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:07.171016 4.295057 tcp 10.0.2.105 59716 -> 46.48.223.67 15494 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:11.208387 0.056296 tcp 10.0.2.105 59717 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:11.264957 0.058911 tcp 10.0.2.105 59718 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:11.324157 0.132623 tcp 10.0.2.105 59719 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:52:11.466340 2.999237 tcp 10.0.2.105 59720 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:52:20.463526 0.000000 tcp 10.0.2.105 59720 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:52:26.462328 4.021424 tcp 10.0.2.105 59721 -> 46.48.223.67 15494 FSPA* 0 0 14 1534 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:53:59.339490 3.001118 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 09:54:06.346088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:54:14.347576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:54:30.350545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:55:02.359794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 09:57:30.479794 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 09:57:30.479954 2.993912 tcp 10.0.2.105 59722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:57:39.482603 0.000000 tcp 10.0.2.105 59722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:57:45.483366 0.057757 tcp 10.0.2.105 59723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:45.541381 0.058661 tcp 10.0.2.105 59724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:45.600352 0.131926 tcp 10.0.2.105 59725 -> 195.113.214.249 443 SRPA* 0 0 25 14790 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:45.766069 4.283247 tcp 10.0.2.105 59726 -> 46.48.223.67 15494 FSPA* 0 0 14 1597 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:49.757750 0.061247 tcp 10.0.2.105 59727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:49.819253 0.058842 tcp 10.0.2.105 59728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:49.878401 0.146593 tcp 10.0.2.105 59729 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/20 09:57:50.049561 3.002173 tcp 10.0.2.105 59730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:57:59.050690 0.000000 tcp 10.0.2.105 59730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 09:58:05.049226 1.732101 tcp 10.0.2.105 59731 -> 46.48.223.67 15494 FSPA* 0 0 14 1597 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:01:06.362498 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:01:13.371828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:01:21.371636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:01:37.374836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:02:09.380605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:03:06.779629 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:03:06.779785 2.998978 tcp 10.0.2.105 59732 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:03:15.775808 0.000000 tcp 10.0.2.105 59732 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:03:21.775964 0.058841 tcp 10.0.2.105 59733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:21.835093 0.060402 tcp 10.0.2.105 59734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:21.895800 0.143915 tcp 10.0.2.105 59735 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:22.060127 4.221732 tcp 10.0.2.105 59736 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:26.001399 0.056666 tcp 10.0.2.105 59737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:26.058411 0.057008 tcp 10.0.2.105 59738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:26.115800 0.155946 tcp 10.0.2.105 59739 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:03:26.282063 2.993420 tcp 10.0.2.105 59740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:03:35.273951 0.000000 tcp 10.0.2.105 59740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:03:41.292933 3.926076 tcp 10.0.2.105 59741 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:08:13.386948 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:08:20.399083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:08:28.395540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:08:44.401941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:08:45.210689 0.000244 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:08:45.211040 2.992918 tcp 10.0.2.105 59742 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:08:54.212136 0.000000 tcp 10.0.2.105 59742 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:09:00.214697 0.057528 tcp 10.0.2.105 59743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:00.272533 0.060436 tcp 10.0.2.105 59744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:00.333274 0.145533 tcp 10.0.2.105 59745 -> 195.113.214.249 443 SRPA* 0 0 23 12464 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:00.489120 1.987495 tcp 10.0.2.105 59746 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:02.213571 0.058384 tcp 10.0.2.105 59747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:02.272199 0.059388 tcp 10.0.2.105 59748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:02.331875 0.134926 tcp 10.0.2.105 59749 -> 195.113.214.249 443 SRPA* 0 0 28 16450 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:09:02.476852 3.001867 tcp 10.0.2.105 59750 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:09:11.477402 0.000000 tcp 10.0.2.105 59750 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:09:16.404549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:09:17.476490 3.883116 tcp 10.0.2.105 59751 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:15:20.410416 3.001554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 10:15:27.417811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:15:35.422796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:15:51.422660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:16:23.428860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:17:00.101533 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:17:00.101750 0.000000 udp 10.0.2.105 7010 -> 69.158.122.75 5797 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 10:17:19.050538 0.058313 tcp 10.0.2.105 59752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:19.109167 0.059973 tcp 10.0.2.105 59753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:19.169400 0.219277 tcp 10.0.2.105 59754 -> 195.113.214.249 443 SRPA* 0 0 46 40800 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:19.389720 0.107509 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:19.478569 0.067920 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:21.138592 0.100660 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:21.781890 4.209184 tcp 10.0.2.105 59755 -> 46.48.223.67 15494 FSPA* 0 0 14 1544 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:21.921654 0.045103 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:21.952020 0.199222 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.084863 0.185097 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.208459 0.142608 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.359737 0.118424 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.437479 0.203370 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.636180 0.097644 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.715273 0.089149 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.767612 0.064117 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:22.830405 0.281072 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.119730 0.165360 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.275193 0.240163 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.494947 0.185691 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.705114 0.170990 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.873113 0.125410 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:23.958875 0.292998 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:24.242843 0.253905 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:24.462891 0.354967 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:24.790685 0.355269 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:25.154350 0.197103 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:25.346896 0.193128 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:25.548348 0.372790 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:25.710856 0.060419 tcp 10.0.2.105 59756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:25.771596 0.059021 tcp 10.0.2.105 59757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:25.830935 0.141877 tcp 10.0.2.105 59758 -> 195.113.214.249 443 SRPA* 0 0 38 19228 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:25.917607 0.131146 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:17:25.991305 1.236841 tcp 10.0.2.105 59759 -> 46.48.223.67 15494 SPA_* 0 0 9 1014 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:17:32.314319 0.000438 tcp 10.0.2.105 59759 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:27.434533 3.001480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:22:32.315081 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:22:32.315181 2.998108 tcp 10.0.2.105 59760 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:22:34.442117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:22:41.321533 0.000000 tcp 10.0.2.105 59760 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:22:42.443521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:22:47.311952 0.057476 tcp 10.0.2.105 59761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:47.369660 0.058256 tcp 10.0.2.105 59762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:47.428174 0.144384 tcp 10.0.2.105 59763 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:47.587259 4.788869 tcp 10.0.2.105 59764 -> 46.48.223.67 15494 SPA_* 0 0 12 1512 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:52.376907 0.056472 tcp 10.0.2.105 59765 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:52.433675 0.058129 tcp 10.0.2.105 59766 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:52.492042 0.137927 tcp 10.0.2.105 59767 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:52.640794 0.000058 tcp 10.0.2.105 59764 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:22:52.641130 3.005364 tcp 10.0.2.105 59768 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:22:58.447378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:23:01.641134 0.000000 tcp 10.0.2.105 59768 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:23:07.640429 0.348212 tcp 10.0.2.105 59769 -> 46.48.223.67 15494 SPA_* 0 0 9 1090 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:23:16.313975 0.000380 tcp 10.0.2.105 59769 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:23:30.452834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:28:16.313755 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:28:16.313858 3.003832 tcp 10.0.2.105 59770 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:28:25.316126 0.000000 tcp 10.0.2.105 59770 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:28:31.321059 0.058118 tcp 10.0.2.105 59771 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:31.379523 0.058574 tcp 10.0.2.105 59772 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:31.438377 0.141537 tcp 10.0.2.105 59773 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:31.590299 4.817623 tcp 10.0.2.105 59774 -> 46.48.223.67 15494 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:36.141148 0.057824 tcp 10.0.2.105 59775 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:36.199308 0.058741 tcp 10.0.2.105 59776 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:36.258325 0.139730 tcp 10.0.2.105 59777 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:36.408147 2.998529 tcp 10.0.2.105 59778 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:28:45.405300 0.000000 tcp 10.0.2.105 59778 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:28:51.403822 0.350282 tcp 10.0.2.105 59779 -> 46.48.223.67 15494 SPA_* 0 0 9 1120 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:28:58.801980 0.000317 tcp 10.0.2.105 59779 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:29:34.458689 3.001197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:29:41.465755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:29:49.467289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:30:05.470703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:30:37.476855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:33:58.796222 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:33:58.796357 3.003774 tcp 10.0.2.105 59780 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:34:07.799097 0.000000 tcp 10.0.2.105 59780 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:34:13.798987 0.056678 tcp 10.0.2.105 59781 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:13.856014 0.059090 tcp 10.0.2.105 59782 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:13.915371 0.146484 tcp 10.0.2.105 59783 -> 195.113.214.249 443 SRPA* 0 0 29 15044 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:14.072528 4.791303 tcp 10.0.2.105 59784 -> 46.48.223.67 15494 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:18.584641 0.057944 tcp 10.0.2.105 59785 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:18.642861 0.058552 tcp 10.0.2.105 59786 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:18.701675 0.152841 tcp 10.0.2.105 59787 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:34:18.864064 3.009753 tcp 10.0.2.105 59788 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:34:27.867832 0.000000 tcp 10.0.2.105 59788 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:34:33.856485 4.445248 tcp 10.0.2.105 59789 -> 46.48.223.67 15494 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:36:41.482388 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:36:48.491653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:36:56.496779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:37:12.503749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:37:44.500678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:39:38.294340 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:39:38.294437 3.004276 tcp 10.0.2.105 59790 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:39:47.297105 0.000000 tcp 10.0.2.105 59790 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:39:53.298057 0.058929 tcp 10.0.2.105 59791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:53.357271 0.057857 tcp 10.0.2.105 59792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:53.415493 0.197923 tcp 10.0.2.105 59793 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:53.623836 2.039908 tcp 10.0.2.105 59794 -> 46.48.223.67 15494 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:55.388069 0.059573 tcp 10.0.2.105 59795 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:55.448015 0.060683 tcp 10.0.2.105 59796 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:55.508973 0.144968 tcp 10.0.2.105 59797 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:39:55.663996 3.009242 tcp 10.0.2.105 59798 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:40:04.681799 0.000000 tcp 10.0.2.105 59798 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:40:10.661010 3.027370 tcp 10.0.2.105 59799 -> 46.48.223.67 15494 FSPA* 0 0 14 1530 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:43:48.506238 3.001926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:43:55.516455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:44:03.515207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:44:20.532373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:44:52.155538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:47:36.932944 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:47:36.933056 0.119870 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.031985 0.064676 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.076753 0.191114 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.210028 0.094575 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.293997 0.046908 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.354443 0.242921 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2051 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.503687 0.111424 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.623325 0.118393 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.705831 0.205494 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.908456 0.094799 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:37.982569 0.088412 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.031617 0.061595 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.091327 0.273091 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.377882 0.165271 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.533774 0.239705 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.753216 0.186046 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:38.974156 0.175077 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:39.146328 0.125461 udp 10.0.2.105 7010 <-> 79.49.211.49 7430 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:39.287572 0.472427 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:39.733142 0.355507 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:40.090214 0.290401 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:40.375619 0.327843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:40.667126 0.368847 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:41.032194 0.131447 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:41.117900 0.198316 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:41.312566 0.191557 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/20 10:47:43.702883 2.992683 tcp 10.0.2.105 59800 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:47:52.694496 0.000000 tcp 10.0.2.105 59800 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:47:58.704811 0.059753 tcp 10.0.2.105 59801 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:47:58.764804 0.058965 tcp 10.0.2.105 59802 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:47:58.824104 0.165458 tcp 10.0.2.105 59803 -> 195.113.214.249 443 SRPA* 0 0 24 14774 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:47:59.003782 2.054008 tcp 10.0.2.105 59804 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:48:00.792612 0.057555 tcp 10.0.2.105 59805 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:48:00.850491 0.058558 tcp 10.0.2.105 59806 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:48:00.909301 0.133278 tcp 10.0.2.105 59807 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:48:01.058009 3.003224 tcp 10.0.2.105 59808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:48:10.059790 0.000000 tcp 10.0.2.105 59808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:48:16.059264 1.770434 tcp 10.0.2.105 59809 -> 46.48.223.67 15494 FSPA* 0 0 14 1550 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:17.824025 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:53:17.824349 2.992177 tcp 10.0.2.105 59810 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:53:26.814593 0.000000 tcp 10.0.2.105 59810 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:53:32.825767 0.051322 tcp 10.0.2.105 59811 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:32.877348 0.051450 tcp 10.0.2.105 59812 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:32.929134 0.162490 tcp 10.0.2.105 59813 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:33.111897 2.014259 tcp 10.0.2.105 59814 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:34.835490 0.050242 tcp 10.0.2.105 59815 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:34.886055 0.052147 tcp 10.0.2.105 59816 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:34.938524 0.173530 tcp 10.0.2.105 59817 -> 195.113.214.249 443 SRPA* 0 0 24 14812 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:53:35.126459 3.004998 tcp 10.0.2.105 59818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:53:44.130027 0.000000 tcp 10.0.2.105 59818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:53:50.118995 1.742538 tcp 10.0.2.105 59819 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:56:04.547392 2.998831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 10:56:11.553165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:56:19.553416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:56:35.560834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:57:07.563007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 10:58:51.862948 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 10:58:51.863048 3.003707 tcp 10.0.2.105 59820 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:59:00.864880 0.000000 tcp 10.0.2.105 59820 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:59:06.865614 0.051465 tcp 10.0.2.105 59821 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:06.917370 0.049583 tcp 10.0.2.105 59822 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:06.967256 0.135610 tcp 10.0.2.105 59823 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:07.127943 2.040337 tcp 10.0.2.105 59824 -> 46.48.223.67 15494 FSPA* 0 0 12 1416 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:08.909957 0.051085 tcp 10.0.2.105 59825 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:08.961318 0.049837 tcp 10.0.2.105 59826 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:09.011437 0.136995 tcp 10.0.2.105 59827 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 10:59:09.168539 3.003920 tcp 10.0.2.105 59828 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:59:18.170596 0.000000 tcp 10.0.2.105 59828 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 10:59:24.169380 1.749921 tcp 10.0.2.105 59829 -> 46.48.223.67 15494 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:03:11.568450 3.001854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:03:18.575774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:03:26.577791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:03:42.580845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:04:14.587003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:04:25.913174 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:04:25.913332 3.004061 tcp 10.0.2.105 59830 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:04:34.915659 0.000000 tcp 10.0.2.105 59830 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:04:40.916453 0.051377 tcp 10.0.2.105 59831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:40.968176 0.049522 tcp 10.0.2.105 59832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:41.018072 0.146512 tcp 10.0.2.105 59833 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:41.185006 4.979348 tcp 10.0.2.105 59834 -> 46.48.223.67 15494 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:45.915599 0.050051 tcp 10.0.2.105 59835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:45.965918 0.050429 tcp 10.0.2.105 59836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:46.016182 0.137916 tcp 10.0.2.105 59837 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:04:46.164563 3.001700 tcp 10.0.2.105 59838 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:04:55.165002 0.000000 tcp 10.0.2.105 59838 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:05:01.163666 1.791076 tcp 10.0.2.105 59839 -> 46.48.223.67 15494 FSPA* 0 0 14 1605 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:10:31.601437 3.001234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:10:38.609137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:10:46.610038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:11:02.612868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:11:34.619082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:17:38.626526 2.999692 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 11:17:42.127844 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:17:42.127943 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:17:45.632851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:17:53.634252 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:18:00.936042 0.051594 tcp 10.0.2.105 59840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:00.987912 0.051625 tcp 10.0.2.105 59841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:01.039832 0.149814 tcp 10.0.2.105 59842 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:01.190145 0.070932 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:01.241662 0.185800 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:01.383915 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:18:02.998165 2.095622 tcp 10.0.2.105 59843 -> 46.48.223.67 15494 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:04.839404 0.051052 tcp 10.0.2.105 59844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:04.890696 0.051705 tcp 10.0.2.105 59845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:04.942765 0.139856 tcp 10.0.2.105 59846 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:05.094008 0.346986 tcp 10.0.2.105 59847 -> 46.48.223.67 15494 SPA_* 0 0 9 1217 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:09.637150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:18:10.209024 0.000495 tcp 10.0.2.105 59847 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:16.457412 0.050229 tcp 10.0.2.105 59848 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:16.507922 0.052518 tcp 10.0.2.105 59849 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:16.560740 0.140355 tcp 10.0.2.105 59850 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:16.701319 0.044625 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:16.731742 0.204307 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:16.876520 0.114430 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.010989 0.120949 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.092126 0.213800 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.307480 0.095679 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.385885 0.085320 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.432751 0.062624 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.493774 0.286392 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2052 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.781357 0.164757 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:17.937480 0.238704 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:18.156645 0.183978 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:18.369699 0.177361 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:18.541394 0.355681 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:18.916137 0.000000 udp 10.0.2.105 7010 -> 79.49.211.49 7430 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:18:35.024277 0.049999 tcp 10.0.2.105 59851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:35.074605 0.052212 tcp 10.0.2.105 59852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:35.127115 0.135485 tcp 10.0.2.105 59853 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:18:35.263221 0.514350 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:35.748448 0.290863 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:36.030691 0.256105 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:36.250780 0.349673 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:36.596349 0.128421 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:36.679922 0.197718 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:36.873768 0.179001 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:18:41.643367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:23:10.210029 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:23:10.210121 2.997115 tcp 10.0.2.105 59854 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:23:19.212023 0.000000 tcp 10.0.2.105 59854 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:23:25.212799 0.052445 tcp 10.0.2.105 59855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:25.265589 0.051850 tcp 10.0.2.105 59856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:25.317737 0.141937 tcp 10.0.2.105 59857 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:25.471323 2.028677 tcp 10.0.2.105 59858 -> 46.48.223.67 15494 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:27.226484 0.050849 tcp 10.0.2.105 59859 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:27.277575 0.053095 tcp 10.0.2.105 59860 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:27.330951 0.140020 tcp 10.0.2.105 59861 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:23:27.500207 2.998508 tcp 10.0.2.105 59862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:23:36.497350 0.000000 tcp 10.0.2.105 59862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:23:42.495894 1.794489 tcp 10.0.2.105 59863 -> 46.48.223.67 15494 FSPA* 0 0 14 1695 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:24:45.649535 3.004545 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:24:52.656569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:25:00.660825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:25:16.661146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:25:48.667299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:28:44.290178 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:28:44.290335 2.993343 tcp 10.0.2.105 59864 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:28:53.292638 0.000000 tcp 10.0.2.105 59864 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:28:59.293027 0.053548 tcp 10.0.2.105 59865 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:28:59.346900 0.052294 tcp 10.0.2.105 59866 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:28:59.399516 0.141092 tcp 10.0.2.105 59867 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:28:59.558303 1.987889 tcp 10.0.2.105 59868 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:29:01.293848 0.051053 tcp 10.0.2.105 59869 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:29:01.345250 0.051946 tcp 10.0.2.105 59870 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:29:01.397477 0.138823 tcp 10.0.2.105 59871 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:29:01.546428 3.007386 tcp 10.0.2.105 59872 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:29:10.547678 0.000000 tcp 10.0.2.105 59872 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:29:16.545878 2.826251 tcp 10.0.2.105 59873 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:31:52.673204 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:31:59.680923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:32:07.682018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:32:23.684766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:32:55.690862 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:34:19.372099 0.000261 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:34:19.372458 2.992999 tcp 10.0.2.105 59874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:34:28.364244 0.000000 tcp 10.0.2.105 59874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:34:34.374468 0.051430 tcp 10.0.2.105 59875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:34.426191 0.050839 tcp 10.0.2.105 59876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:34.477294 0.134162 tcp 10.0.2.105 59877 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:34.622689 2.224392 tcp 10.0.2.105 59878 -> 46.48.223.67 15494 FSPA* 0 0 14 1770 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:36.548641 0.050530 tcp 10.0.2.105 59879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:36.599426 0.052091 tcp 10.0.2.105 59880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:36.651840 0.173838 tcp 10.0.2.105 59881 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:34:36.847410 3.003412 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:34:45.849235 0.000000 tcp 10.0.2.105 59882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:34:51.848357 1.814614 tcp 10.0.2.105 59883 -> 46.48.223.67 15494 FSPA* 0 0 14 1770 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:38:59.697417 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:39:06.704211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:39:14.708455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:39:30.708906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:39:53.662701 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:39:53.662790 2.993308 tcp 10.0.2.105 59884 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:40:02.654876 0.000000 tcp 10.0.2.105 59884 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:40:02.714620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:40:08.665311 0.049932 tcp 10.0.2.105 59885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:08.715490 0.050466 tcp 10.0.2.105 59886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:08.766161 0.133096 tcp 10.0.2.105 59887 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:08.909062 2.059201 tcp 10.0.2.105 59888 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:10.669797 0.049808 tcp 10.0.2.105 59889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:10.719899 0.059644 tcp 10.0.2.105 59890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:10.779792 0.139425 tcp 10.0.2.105 59891 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:40:10.968487 3.002774 tcp 10.0.2.105 59892 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:40:19.969651 0.000000 tcp 10.0.2.105 59892 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:40:25.969080 1.753472 tcp 10.0.2.105 59893 -> 46.48.223.67 15494 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:46:06.721770 3.002420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 11:46:13.728706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:46:21.729975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:46:37.732858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:47:09.744700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:48:46.188135 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:48:46.188244 0.107972 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:48:46.275546 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:48:57.744738 0.349569 tcp 10.0.2.105 59894 -> 46.48.223.67 15494 SPA_* 0 0 9 1027 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:02.873593 0.037504 tcp 10.0.2.105 59895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:02.911323 0.039076 tcp 10.0.2.105 59896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:02.950655 0.177746 tcp 10.0.2.105 59897 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:03.128941 0.000000 udp 10.0.2.105 7010 -> 79.49.211.49 7430 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:49:12.716956 0.227800 tcp 10.0.2.105 59894 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:12.717685 0.034911 tcp 10.0.2.105 59898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:12.752877 0.037873 tcp 10.0.2.105 59899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:12.791093 0.142060 tcp 10.0.2.105 59900 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:12.944972 1.757481 tcp 10.0.2.105 59901 -> 46.48.223.67 15494 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:21.269162 0.033787 tcp 10.0.2.105 59902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:21.303220 0.040269 tcp 10.0.2.105 59903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:21.343763 0.140122 tcp 10.0.2.105 59904 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:21.484566 0.070526 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.569221 0.155659 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.669432 0.111112 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.747211 0.167558 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.859605 0.046637 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.899384 0.080272 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:21.985439 0.094709 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:22.061531 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:49:39.094524 0.037200 tcp 10.0.2.105 59905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:39.131966 0.037596 tcp 10.0.2.105 59906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:39.169831 0.146134 tcp 10.0.2.105 59907 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:39.316615 0.062555 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:39.393356 0.280308 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:39.675144 0.165394 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:39.832079 0.234263 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2004 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:40.047209 0.202164 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2587 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:40.250578 0.196409 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:40.420623 0.238406 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1640 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:59.123434 0.081472 tcp 10.0.2.105 59908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:59.205258 0.037976 tcp 10.0.2.105 59909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:59.243552 0.145310 tcp 10.0.2.105 59910 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:49:59.389423 0.355305 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:49:59.747590 0.503788 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 2117 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:15.887210 0.038940 tcp 10.0.2.105 59911 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:50:15.926484 0.038495 tcp 10.0.2.105 59912 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:50:15.965280 0.143531 tcp 10.0.2.105 59913 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:50:16.109332 0.292117 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:16.400825 0.282859 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1364 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:16.661072 0.398629 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 4 1549 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:17.055108 0.142384 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:17.155018 0.329002 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:17.480308 0.179098 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:17.685115 0.207762 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3010 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:17.852657 0.516434 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 7 2964 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:23.137302 0.791970 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:28.525203 0.232319 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 2817 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:28.738566 0.126717 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:28.846464 0.167909 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 8 3022 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:28.977566 0.305019 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 8 3005 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:29.222537 1.597475 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 8 3087 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:30.829797 0.571402 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 8 3042 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:31.353465 0.099953 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 8 2958 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:31.439836 0.155592 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 8 3077 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:31.576101 0.105527 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 8 2957 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:31.680524 0.557204 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 8 3030 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:32.238308 0.361496 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3282 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:32.575971 0.314675 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 8 2900 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:32.890161 0.451631 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 3049 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:33.320262 0.402010 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 2844 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:33.723750 0.710375 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 8 3101 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:34.443223 0.569449 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 8 2902 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:35.011211 0.792616 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 2875 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:35.799287 0.567972 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2003 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:36.328369 0.375207 udp 10.0.2.105 7010 <-> 99.58.199.73 7403 CON 0 0 8 3079 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:36.699194 0.358047 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 8 3243 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:37.076107 0.245751 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 3118 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:50:37.278854 0.000000 udp 10.0.2.105 7010 -> 79.11.239.126 3159 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:50:39.781130 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:50:44.147408 0.000000 udp 10.0.2.105 7010 -> 190.86.137.36 4331 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:50:50.286267 0.000000 udp 10.0.2.105 7010 -> 88.236.91.52 6019 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:50:58.721326 0.000000 udp 10.0.2.105 7010 -> 203.144.15.203 9044 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:03.745604 0.000000 udp 10.0.2.105 7010 -> 121.210.81.137 8825 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:08.281704 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:51:08.993217 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:14.020403 0.000000 udp 10.0.2.105 7010 -> 74.117.230.57 5606 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:21.971906 0.000000 udp 10.0.2.105 7010 -> 109.164.203.151 1038 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:30.887118 0.000000 udp 10.0.2.105 7010 -> 201.240.226.148 1030 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:35.781442 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:51:38.775925 0.000000 udp 10.0.2.105 7010 -> 194.208.77.117 7724 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:44.373867 0.000000 udp 10.0.2.105 7010 -> 122.173.148.212 2604 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:51.083737 0.342365 udp 10.0.2.105 7010 <-> 2.198.185.242 4752 CON 0 0 8 2777 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:51:51.415419 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 1027 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:57.943712 0.030878 udp 10.0.2.105 7010 -> 91.187.115.39 7453 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:51:57.974590 0.000000 icmp 91.187.115.39 0x0303 -> 10.0.2.105 0x1d1d URP 192 1 223 flow=Background 1970/02/20 11:52:02.779880 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:52:03.891949 0.000000 udp 10.0.2.105 7010 -> 66.69.253.188 3984 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:11.543299 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:17.281907 0.000000 udp 10.0.2.105 7010 -> 94.34.141.5 9141 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:24.742155 0.000000 udp 10.0.2.105 7010 -> 109.232.61.113 7779 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:29.278306 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:52:30.220021 0.000000 udp 10.0.2.105 7010 -> 75.67.154.24 4924 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:37.183729 0.000000 udp 10.0.2.105 7010 -> 70.28.95.84 2499 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:44.080039 0.000000 udp 10.0.2.105 7010 -> 2.85.56.241 5627 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:49.337396 0.000000 udp 10.0.2.105 7010 -> 93.193.137.247 7662 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:52:55.114455 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:52:58.632939 0.000000 udp 10.0.2.105 7010 -> 188.9.38.41 3741 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:05.597611 0.000000 udp 10.0.2.105 7010 -> 188.27.239.91 6925 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:14.064107 0.000000 udp 10.0.2.105 7010 -> 95.248.83.141 3777 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:14.340693 2.958379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 11:53:18.817017 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:53:19.400879 0.000000 udp 10.0.2.105 7010 -> 95.230.96.137 9692 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:21.259618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:53:28.131524 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:29.168991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:53:35.396675 0.113606 udp 10.0.2.105 7010 <-> 46.49.70.63 1041 CON 0 0 8 3086 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:53:35.772009 0.000000 udp 10.0.2.105 7010 -> 68.227.125.209 3557 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:41.523303 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:44.985303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:53:45.996348 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:53:49.668727 0.000000 udp 10.0.2.105 7010 -> 207.150.245.254 5351 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:53:58.261460 0.000000 udp 10.0.2.105 7010 -> 71.105.88.221 4585 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:04.435380 0.000000 udp 10.0.2.105 7010 -> 66.183.177.153 4502 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:10.909232 0.000000 udp 10.0.2.105 7010 -> 195.251.4.38 4713 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:14.702000 2.993066 tcp 10.0.2.105 59914 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:54:15.781544 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:54:16.765280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 11:54:17.095479 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:23.705135 0.000000 tcp 10.0.2.105 59914 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:54:25.976468 0.200573 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 8 2932 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:54:26.213038 0.000000 udp 10.0.2.105 7010 -> 194.70.27.37 6199 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:29.703204 0.057912 tcp 10.0.2.105 59915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:29.761389 0.062443 tcp 10.0.2.105 59916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:29.824131 0.146554 tcp 10.0.2.105 59917 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:29.981348 0.349467 tcp 10.0.2.105 59918 -> 46.48.223.67 15494 SPA_* 0 0 9 1127 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:33.167018 0.000000 udp 10.0.2.105 7010 -> 181.228.20.100 4919 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:35.936647 0.290073 tcp 10.0.2.105 59918 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:35.937620 0.070211 tcp 10.0.2.105 59919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:36.008188 0.063101 tcp 10.0.2.105 59920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:36.071538 0.137852 tcp 10.0.2.105 59921 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:36.226997 2.998194 tcp 10.0.2.105 59922 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:54:39.555999 0.000000 udp 10.0.2.105 7010 -> 197.65.200.79 7385 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:45.143961 0.000000 udp 10.0.2.105 7010 -> 91.183.201.190 6902 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:54:45.223652 0.000000 tcp 10.0.2.105 59922 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:54:51.222811 1.728480 tcp 10.0.2.105 59923 -> 46.48.223.67 15494 FSPA* 0 0 14 1657 flow=From-Botnet-V2-TCP-Established 1970/02/20 11:54:53.489802 0.000000 udp 10.0.2.105 7010 -> 84.107.208.251 5121 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:02.249134 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:10.119944 0.000000 udp 10.0.2.105 7010 -> 109.7.36.50 6800 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:18.902676 0.000000 udp 10.0.2.105 7010 -> 210.11.5.74 8551 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:23.779555 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:55:26.072265 0.000000 udp 10.0.2.105 7010 -> 49.144.103.2 9276 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:34.935495 0.000000 udp 10.0.2.105 7010 -> 74.92.133.179 2367 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:43.487870 0.000000 udp 10.0.2.105 7010 -> 181.65.159.246 8855 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:55:48.273934 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:55:49.677063 2.524675 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 8 3128 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:55:52.203552 0.124513 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 8 3406 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:55:52.353968 0.000000 udp 10.0.2.105 7010 -> 82.53.6.60 8996 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:00.192089 0.000000 udp 10.0.2.105 7010 -> 176.221.130.44 8720 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:08.467164 0.000000 udp 10.0.2.105 7010 -> 64.250.66.143 2614 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:13.280538 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:56:15.233531 0.449395 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:56:15.692166 0.000000 udp 10.0.2.105 7010 -> 203.125.247.226 5590 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:23.855981 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:31.247017 0.143435 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 8 2900 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:56:31.403532 0.359640 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 8 3223 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:56:31.773023 0.000000 udp 10.0.2.105 7010 -> 190.60.46.219 5086 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:39.478575 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:44.274982 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:56:45.256938 0.000000 udp 10.0.2.105 7010 -> 74.87.119.146 2204 INT 0 1 170 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:51.595795 0.000000 udp 10.0.2.105 7010 -> 190.40.42.41 4851 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:56:59.397093 0.000000 udp 10.0.2.105 7010 -> 188.169.212.137 9409 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:05.616184 0.000000 udp 10.0.2.105 7010 -> 95.252.174.102 7829 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:10.282722 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:57:10.633430 0.000000 udp 10.0.2.105 7010 -> 41.105.90.119 9937 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:16.201227 0.000000 udp 10.0.2.105 7010 -> 199.200.243.253 4561 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:22.540690 0.000000 udp 10.0.2.105 7010 -> 196.215.158.59 1792 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:31.463317 0.000000 udp 10.0.2.105 7010 -> 190.117.156.7 7778 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:36.279923 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:57:38.556004 0.000000 udp 10.0.2.105 7010 -> 134.117.114.115 4253 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:46.364716 0.000000 udp 10.0.2.105 7010 -> 187.67.42.221 8208 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:57:54.265967 0.553058 udp 10.0.2.105 7010 <-> 190.39.39.145 5166 CON 0 0 7 2633 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:57:54.791380 0.000000 udp 10.0.2.105 7010 -> 68.6.205.151 2645 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:02.006808 0.188047 udp 10.0.2.105 7010 <-> 151.72.43.178 5160 CON 0 0 8 3138 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:58:02.206275 0.118611 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 8 3160 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:58:02.365036 0.000000 udp 10.0.2.105 7010 -> 79.41.65.36 9512 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:06.773675 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:58:10.279018 0.373594 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 8 2975 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:58:10.658603 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:15.826802 0.000000 udp 10.0.2.105 7010 -> 82.55.182.37 2254 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:21.395259 0.000000 udp 10.0.2.105 7010 -> 187.75.223.138 8902 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:27.462965 0.000000 udp 10.0.2.105 7010 -> 46.117.193.32 9968 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:32.280809 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:58:35.735428 1.495010 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 7 2557 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:58:36.960039 0.000000 udp 10.0.2.105 7010 -> 204.27.156.146 7940 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:42.425480 0.218359 udp 10.0.2.105 7010 <-> 79.44.163.158 8578 CON 0 0 8 3173 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:58:42.634859 0.000000 udp 10.0.2.105 7010 -> 170.89.9.1 3626 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:48.998808 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:58:55.964754 0.000000 udp 10.0.2.105 7010 -> 81.157.18.7 7659 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:00.781253 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:59:02.323729 0.000000 udp 10.0.2.105 7010 -> 95.226.48.49 8701 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:08.723008 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:13.980737 0.000000 udp 10.0.2.105 7010 -> 46.197.69.240 6253 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:19.571270 0.000000 udp 10.0.2.105 7010 -> 72.16.245.225 7369 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:27.700631 0.000000 udp 10.0.2.105 7010 -> 87.28.246.44 6821 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:32.275952 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 11:59:34.129491 0.000000 udp 10.0.2.105 7010 -> 190.147.85.174 1299 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:39.537374 0.000000 udp 10.0.2.105 7010 -> 72.54.241.201 6491 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:47.528990 0.530976 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 7 2874 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:59:52.824829 0.990237 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:59:52.954063 2.996559 tcp 10.0.2.105 59924 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 11:59:53.803046 0.453580 udp 10.0.2.105 7010 <-> 188.131.17.21 9865 CON 0 0 8 3138 flow=From-Botnet-V2-UDP-Established 1970/02/20 11:59:54.202661 0.000000 udp 10.0.2.105 7010 -> 49.181.247.59 4484 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 11:59:57.773258 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:00:01.949232 0.000000 tcp 10.0.2.105 59924 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:02.470067 0.091920 udp 10.0.2.105 7010 <-> 5.13.8.110 2778 CON 0 0 8 2975 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:00:02.600821 0.521918 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:00:07.871423 0.423358 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 8 3078 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:00:07.949689 0.088890 tcp 10.0.2.105 59925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:08.038868 0.041684 tcp 10.0.2.105 59926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:08.080825 0.140117 tcp 10.0.2.105 59927 -> 195.113.214.249 443 SRPA* 0 0 42 24266 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:08.235059 3.007951 tcp 10.0.2.105 59928 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:08.296447 0.000000 udp 10.0.2.105 7010 -> 58.241.37.53 5798 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:15.729877 0.000000 udp 10.0.2.105 7010 -> 181.112.5.178 1570 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:17.241294 0.000000 tcp 10.0.2.105 59928 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:20.769394 3.001592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:00:23.230811 0.036996 tcp 10.0.2.105 59929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:23.268091 0.037966 tcp 10.0.2.105 59930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:23.306350 0.141602 tcp 10.0.2.105 59931 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:23.460500 2.060184 tcp 10.0.2.105 59932 -> 46.48.223.67 15494 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:24.011199 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:25.282803 0.033461 tcp 10.0.2.105 59933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:25.316543 0.035914 tcp 10.0.2.105 59934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:25.352847 0.149862 tcp 10.0.2.105 59935 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:25.520905 2.996310 tcp 10.0.2.105 59936 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:27.776128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:00:31.292704 0.574220 udp 10.0.2.105 7010 <-> 180.215.30.164 4386 CON 0 0 8 2994 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:00:31.847177 0.000000 udp 10.0.2.105 7010 -> 76.176.186.238 4072 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:34.516030 0.000000 tcp 10.0.2.105 59936 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:35.785492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:00:38.421991 0.000000 udp 10.0.2.105 7010 -> 41.100.192.153 8621 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:40.515144 3.004163 tcp 10.0.2.105 59937 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:45.071430 0.000000 udp 10.0.2.105 7010 -> 70.28.16.103 6790 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:49.517761 0.000000 tcp 10.0.2.105 59937 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:00:49.778160 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:00:51.781019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:00:52.481992 0.000000 udp 10.0.2.105 7010 -> 92.13.114.164 3487 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:00:55.516634 0.350875 tcp 10.0.2.105 59938 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:00:59.261999 0.000000 udp 10.0.2.105 7010 -> 207.253.16.76 3814 INT 0 1 285 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:05.100335 0.000422 tcp 10.0.2.105 59938 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:01:06.031651 0.000000 udp 10.0.2.105 7010 -> 2.177.219.26 4373 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:11.179402 0.000000 udp 10.0.2.105 7010 -> 62.214.65.21 4422 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:17.518808 0.000000 udp 10.0.2.105 7010 -> 190.118.122.96 8251 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:23.786794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:01:25.068993 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:29.775422 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:01:30.697250 0.000000 udp 10.0.2.105 7010 -> 109.173.135.202 9318 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:38.671519 0.000000 udp 10.0.2.105 7010 -> 79.31.27.52 3792 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:01:45.358073 0.000000 udp 10.0.2.105 7010 -> 200.223.31.39 1987 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:06:05.114937 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:06:05.115098 2.981269 tcp 10.0.2.105 59939 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:14.099461 0.000000 tcp 10.0.2.105 59939 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:20.105004 0.048992 tcp 10.0.2.105 59940 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:20.154249 0.045919 tcp 10.0.2.105 59941 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:20.200627 0.137897 tcp 10.0.2.105 59942 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:20.351143 2.996781 tcp 10.0.2.105 59943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:29.346282 0.000000 tcp 10.0.2.105 59943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:35.350176 0.036325 tcp 10.0.2.105 59944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:35.386761 0.034950 tcp 10.0.2.105 59945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:35.421936 0.143182 tcp 10.0.2.105 59946 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:35.584867 1.981174 tcp 10.0.2.105 59947 -> 46.48.223.67 15494 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:37.337607 0.033380 tcp 10.0.2.105 59948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:37.371260 0.036402 tcp 10.0.2.105 59949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:37.407951 0.147558 tcp 10.0.2.105 59950 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:06:37.566308 3.006384 tcp 10.0.2.105 59951 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:46.571035 0.000000 tcp 10.0.2.105 59951 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:06:52.560121 2.993772 tcp 10.0.2.105 59952 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:07:01.562736 0.000000 tcp 10.0.2.105 59952 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:07:06.279160 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:07:07.561478 1.840401 tcp 10.0.2.105 59953 -> 46.48.223.67 15494 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:07:27.792346 3.002208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:07:34.800567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:07:42.801816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:07:58.804934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:08:30.815542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:12:09.395798 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:12:09.395921 3.003481 tcp 10.0.2.105 59954 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:18.398113 0.000000 tcp 10.0.2.105 59954 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:24.398797 0.035176 tcp 10.0.2.105 59955 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:24.434148 0.035200 tcp 10.0.2.105 59956 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:24.469731 0.130758 tcp 10.0.2.105 59957 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:24.613485 3.007843 tcp 10.0.2.105 59958 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:33.628485 0.000000 tcp 10.0.2.105 59958 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:39.609589 0.035780 tcp 10.0.2.105 59959 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:39.645634 0.037208 tcp 10.0.2.105 59960 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:39.683135 0.141133 tcp 10.0.2.105 59961 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:39.833786 1.946480 tcp 10.0.2.105 59962 -> 46.48.223.67 15494 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:41.545318 0.039086 tcp 10.0.2.105 59963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:41.584712 0.040116 tcp 10.0.2.105 59964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:41.625148 0.145504 tcp 10.0.2.105 59965 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:12:41.780515 2.995525 tcp 10.0.2.105 59966 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:50.774648 0.000000 tcp 10.0.2.105 59966 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:12:56.773502 3.004014 tcp 10.0.2.105 59967 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:13:05.776064 0.000000 tcp 10.0.2.105 59967 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:13:10.773270 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:13:11.775303 1.783482 tcp 10.0.2.105 59968 -> 46.48.223.67 15494 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:14:34.816236 3.013442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:14:41.824655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:14:49.825742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:15:05.833515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:15:37.835000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:18:13.567685 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:18:13.567855 2.995210 tcp 10.0.2.105 59969 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:18:22.571878 0.000000 tcp 10.0.2.105 59969 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:18:28.562147 0.034848 tcp 10.0.2.105 59970 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:28.597268 0.040006 tcp 10.0.2.105 59971 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:28.637522 0.140795 tcp 10.0.2.105 59972 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:28.835753 3.000710 tcp 10.0.2.105 59973 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:18:37.833010 0.000000 tcp 10.0.2.105 59973 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:18:43.832936 0.037855 tcp 10.0.2.105 59974 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:43.871107 0.035657 tcp 10.0.2.105 59975 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:43.907076 0.136530 tcp 10.0.2.105 59976 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:44.054899 1.995161 tcp 10.0.2.105 59977 -> 46.48.223.67 15494 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:45.821556 0.033877 tcp 10.0.2.105 59978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:45.855666 0.036820 tcp 10.0.2.105 59979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:45.892728 0.140193 tcp 10.0.2.105 59980 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:18:46.050292 2.999758 tcp 10.0.2.105 59981 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:18:55.048558 0.000000 tcp 10.0.2.105 59981 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:19:01.046957 3.004576 tcp 10.0.2.105 59982 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:19:10.050121 0.000000 tcp 10.0.2.105 59982 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:19:14.776915 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:19:16.048765 1.787970 tcp 10.0.2.105 59983 -> 46.48.223.67 15494 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:21:41.840425 3.002238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:21:48.849097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:21:56.850417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:22:12.855396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:22:44.858608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:24:17.832771 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:24:17.832917 1.976985 tcp 10.0.2.105 59984 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:24:19.583348 0.039022 tcp 10.0.2.105 59985 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:24:19.622713 0.040309 tcp 10.0.2.105 59986 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:24:19.663366 0.134953 tcp 10.0.2.105 59987 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:24:19.810155 0.348016 tcp 10.0.2.105 59988 -> 46.48.223.67 15494 SPA_* 0 0 9 1072 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:24:26.737695 0.000341 tcp 10.0.2.105 59988 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:28:48.863921 3.002544 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 12:28:55.872362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:29:03.873630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:29:19.876976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:29:51.883017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:31:58.325024 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:31:58.325157 0.186305 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:58.470116 0.155185 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:58.621922 0.068972 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:58.671992 0.111554 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:58.745804 0.458393 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.175171 0.110658 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.265442 0.214333 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.436143 0.076646 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.521517 0.047448 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.552699 0.096431 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2503 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.629623 0.061541 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.689979 0.201529 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:31:59.818326 0.273071 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:00.099527 0.189671 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:00.293879 0.227546 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:00.511871 0.201337 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:00.728802 0.236369 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:00.945841 0.355301 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:01.316905 0.296855 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:01.604928 0.349462 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:01.950467 0.268051 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:02.179706 0.000000 udp 10.0.2.105 7010 -> 99.58.199.73 7403 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:32:11.754510 3.004169 tcp 10.0.2.105 59989 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:32:17.174116 0.037472 tcp 10.0.2.105 59990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:17.211953 0.039975 tcp 10.0.2.105 59991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:17.252227 0.142183 tcp 10.0.2.105 59992 -> 195.113.214.249 443 SRPA* 0 0 81 57216 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:17.394961 0.192850 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:17.590487 0.133775 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:17.676911 0.000000 udp 10.0.2.105 7010 -> 2.198.185.242 4752 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:32:20.757074 0.000000 tcp 10.0.2.105 59989 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:32:26.755586 0.036482 tcp 10.0.2.105 59993 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:26.792402 0.038841 tcp 10.0.2.105 59994 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:26.831528 0.139078 tcp 10.0.2.105 59995 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:26.990421 0.364755 tcp 10.0.2.105 59996 -> 46.48.223.67 15494 SPA_* 0 0 9 1129 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:32.745996 0.103987 tcp 10.0.2.105 59997 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:32.850231 0.036580 tcp 10.0.2.105 59998 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:32.886732 0.138954 tcp 10.0.2.105 59999 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:33.026223 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 1041 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:32:36.285078 0.228118 tcp 10.0.2.105 59996 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:36.285686 0.042195 tcp 10.0.2.105 60000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:36.327699 0.036358 tcp 10.0.2.105 60001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:36.364529 0.137848 tcp 10.0.2.105 60002 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:36.513380 3.000180 tcp 10.0.2.105 60003 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:32:45.522901 0.000000 tcp 10.0.2.105 60003 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:32:48.226848 0.036338 tcp 10.0.2.105 60004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:48.263436 0.036761 tcp 10.0.2.105 60005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:48.300508 0.136912 tcp 10.0.2.105 60006 -> 195.113.214.249 443 SRPA* 0 0 43 23138 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:32:48.437942 0.327591 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:48.784906 0.061761 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:48.846499 0.246872 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:49.059686 0.206562 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:49.260064 0.068429 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:49.329768 0.178987 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:49.534455 0.237286 udp 10.0.2.105 7010 <-> 190.39.39.145 5166 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:49.734224 0.085226 udp 10.0.2.105 7010 <-> 151.72.43.178 5160 CON 0 0 2 601 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:32:51.511128 0.352630 tcp 10.0.2.105 60007 -> 46.48.223.67 15494 SPA_* 0 0 9 1129 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:02.137572 0.000395 tcp 10.0.2.105 60007 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:08.055648 0.033779 tcp 10.0.2.105 60008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:08.089724 0.037528 tcp 10.0.2.105 60009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:08.127515 0.138446 tcp 10.0.2.105 60010 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:08.266483 0.056147 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:08.319670 0.190206 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:08.502674 0.854850 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:08.994541 0.000000 udp 10.0.2.105 7010 -> 79.44.163.158 8578 INT 0 1 234 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 12:33:27.934320 0.040846 tcp 10.0.2.105 60011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:27.975410 0.037903 tcp 10.0.2.105 60012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:28.013581 0.136981 tcp 10.0.2.105 60013 -> 195.113.214.249 443 SRPA* 0 0 41 22696 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:33:28.151202 0.230504 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:28.374068 0.830072 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:29.181839 0.270594 udp 10.0.2.105 7010 <-> 188.131.17.21 9865 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:29.584618 0.047159 udp 10.0.2.105 7010 <-> 5.13.8.110 2778 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:29.642148 0.227752 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:29.863387 0.220275 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:33:30.076136 0.346746 udp 10.0.2.105 7010 <-> 180.215.30.164 4386 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 12:35:55.888973 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:36:02.895579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:36:10.898984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:36:26.900901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:36:58.906775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:38:02.138492 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:38:02.138692 3.003864 tcp 10.0.2.105 60014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:11.140571 0.000000 tcp 10.0.2.105 60014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:17.145541 0.037849 tcp 10.0.2.105 60015 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:17.183745 0.041874 tcp 10.0.2.105 60016 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:17.225963 0.133770 tcp 10.0.2.105 60017 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:17.371882 2.992712 tcp 10.0.2.105 60018 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:26.372898 0.000000 tcp 10.0.2.105 60018 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:32.361758 0.037338 tcp 10.0.2.105 60019 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:32.399442 0.035037 tcp 10.0.2.105 60020 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:32.434769 0.144685 tcp 10.0.2.105 60021 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:32.597231 0.362327 tcp 10.0.2.105 60022 -> 46.48.223.67 15494 SPA_* 0 0 9 1209 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:41.413741 0.220184 tcp 10.0.2.105 60022 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:41.414667 0.036497 tcp 10.0.2.105 60023 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:41.451524 0.036067 tcp 10.0.2.105 60024 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:41.487889 0.134146 tcp 10.0.2.105 60025 -> 195.113.214.249 443 SRPA* 0 0 41 22864 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:38:41.634170 2.997289 tcp 10.0.2.105 60026 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:50.627352 0.000000 tcp 10.0.2.105 60026 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:38:56.626943 3.004614 tcp 10.0.2.105 60027 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:39:05.629163 0.000000 tcp 10.0.2.105 60027 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:39:10.278982 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:39:11.632941 0.350047 tcp 10.0.2.105 60028 -> 46.48.223.67 15494 SPA_* 0 0 9 1209 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:39:19.128995 0.000379 tcp 10.0.2.105 60028 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:43:02.912788 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:43:09.923756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:43:17.921844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:43:33.924787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:44:05.930207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:44:19.130289 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:44:19.130435 2.993167 tcp 10.0.2.105 60029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:44:28.132734 0.000000 tcp 10.0.2.105 60029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:44:34.132959 0.034251 tcp 10.0.2.105 60030 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:34.167479 0.037150 tcp 10.0.2.105 60031 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:34.204920 0.211261 tcp 10.0.2.105 60032 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:34.434764 2.991501 tcp 10.0.2.105 60033 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:44:43.424730 0.000000 tcp 10.0.2.105 60033 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:44:49.441004 0.036046 tcp 10.0.2.105 60034 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:49.477378 0.037372 tcp 10.0.2.105 60035 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:49.515122 0.140232 tcp 10.0.2.105 60036 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:49.676582 0.345360 tcp 10.0.2.105 60037 -> 46.48.223.67 15494 SPA_* 0 0 9 1142 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:55.357686 0.238426 tcp 10.0.2.105 60037 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:55.358397 0.036871 tcp 10.0.2.105 60038 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:55.395518 0.035860 tcp 10.0.2.105 60039 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:55.431616 0.140391 tcp 10.0.2.105 60040 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:44:55.596386 3.000737 tcp 10.0.2.105 60041 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:45:04.595053 0.000000 tcp 10.0.2.105 60041 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:45:10.594028 3.003903 tcp 10.0.2.105 60042 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:45:19.602186 0.000000 tcp 10.0.2.105 60042 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:45:24.273118 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:45:25.595635 4.668509 tcp 10.0.2.105 60043 -> 46.48.223.67 15494 FSPA* 0 0 14 1672 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:50:30.265936 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:50:30.266073 3.001510 tcp 10.0.2.105 60044 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:50:39.266531 0.000000 tcp 10.0.2.105 60044 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:50:45.266672 0.039290 tcp 10.0.2.105 60045 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:50:45.306324 0.038743 tcp 10.0.2.105 60046 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:50:45.345319 0.144695 tcp 10.0.2.105 60047 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:50:45.501926 3.011047 tcp 10.0.2.105 60048 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:50:54.501372 0.000000 tcp 10.0.2.105 60048 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:51:00.497772 0.043732 tcp 10.0.2.105 60049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:00.541888 0.038029 tcp 10.0.2.105 60050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:00.580392 0.140889 tcp 10.0.2.105 60051 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:00.745106 0.346748 tcp 10.0.2.105 60052 -> 46.48.223.67 15494 SPA_* 0 0 9 1127 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:07.421036 0.306097 tcp 10.0.2.105 60052 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:07.421823 0.099813 tcp 10.0.2.105 60053 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:07.521935 0.037753 tcp 10.0.2.105 60054 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:07.559989 0.155475 tcp 10.0.2.105 60055 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:07.727436 3.004049 tcp 10.0.2.105 60056 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:51:16.730033 0.000000 tcp 10.0.2.105 60056 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:51:22.718883 3.000587 tcp 10.0.2.105 60057 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:51:31.721478 0.000000 tcp 10.0.2.105 60057 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:51:36.278547 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:51:37.720703 0.349074 tcp 10.0.2.105 60058 -> 46.48.223.67 15494 SPA_* 0 0 9 1127 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:51:47.405561 0.000422 tcp 10.0.2.105 60058 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:55:42.945028 3.002150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 12:55:49.953118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:55:57.954919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:56:13.957520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:56:45.963538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 12:56:47.405942 0.000149 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:56:47.406186 3.003724 tcp 10.0.2.105 60059 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:56:56.408752 0.000000 tcp 10.0.2.105 60059 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:02.408935 0.031804 tcp 10.0.2.105 60060 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:02.440974 0.032554 tcp 10.0.2.105 60061 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:02.473808 0.136316 tcp 10.0.2.105 60062 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:02.621961 3.000178 tcp 10.0.2.105 60063 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:11.620652 0.000000 tcp 10.0.2.105 60063 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:17.619686 0.031063 tcp 10.0.2.105 60064 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:17.651051 0.032378 tcp 10.0.2.105 60065 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:17.683694 0.135990 tcp 10.0.2.105 60066 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:18.044986 0.373656 tcp 10.0.2.105 60067 -> 46.48.223.67 15494 SPA_* 0 0 9 1242 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:26.226394 0.210402 tcp 10.0.2.105 60067 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:26.227299 0.031678 tcp 10.0.2.105 60068 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:26.259272 0.036868 tcp 10.0.2.105 60069 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:26.296569 0.128813 tcp 10.0.2.105 60070 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:57:26.437024 2.999001 tcp 10.0.2.105 60071 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:35.434534 0.000000 tcp 10.0.2.105 60071 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:41.433565 3.003857 tcp 10.0.2.105 60072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:50.436221 0.000000 tcp 10.0.2.105 60072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 12:57:55.273147 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 12:57:56.435485 0.368524 tcp 10.0.2.105 60073 -> 46.48.223.67 15494 SPA_* 0 0 9 1242 flow=From-Botnet-V2-TCP-Established 1970/02/20 12:58:07.294143 0.000357 tcp 10.0.2.105 60073 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:02:49.970500 3.003794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:02:56.976359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:03:04.978608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:03:20.981606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:03:52.987717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:04:00.168350 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:04:00.168559 0.000000 udp 10.0.2.105 7010 -> 99.58.199.73 7403 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:04:16.453602 0.032977 tcp 10.0.2.105 60074 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:16.486846 0.034782 tcp 10.0.2.105 60075 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:16.521924 0.128215 tcp 10.0.2.105 60076 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:16.650760 0.000000 udp 10.0.2.105 7010 -> 2.198.185.242 4752 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:04:35.269440 0.031689 tcp 10.0.2.105 60077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:35.301392 0.033095 tcp 10.0.2.105 60078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:35.334752 0.126469 tcp 10.0.2.105 60079 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:35.461755 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 1041 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:04:53.875668 0.032514 tcp 10.0.2.105 60080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:53.908690 0.035118 tcp 10.0.2.105 60081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:53.944110 0.137738 tcp 10.0.2.105 60082 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:04:54.082375 0.083878 udp 10.0.2.105 7010 <-> 151.72.43.178 5160 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:07.304596 3.004148 tcp 10.0.2.105 60083 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:05:11.260912 0.031676 tcp 10.0.2.105 60084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:11.292914 0.033387 tcp 10.0.2.105 60085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:11.326554 0.127481 tcp 10.0.2.105 60086 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:11.454539 0.000000 udp 10.0.2.105 7010 -> 79.44.163.158 8578 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:05:16.307089 0.000000 tcp 10.0.2.105 60083 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:05:22.306683 0.031716 tcp 10.0.2.105 60087 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:22.338753 0.033400 tcp 10.0.2.105 60088 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:22.372558 0.130632 tcp 10.0.2.105 60089 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:22.521401 3.002431 tcp 10.0.2.105 60090 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:05:29.149555 0.041925 tcp 10.0.2.105 60091 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:29.191703 0.038646 tcp 10.0.2.105 60092 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:29.230657 0.140665 tcp 10.0.2.105 60093 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:29.372051 0.067662 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:29.421823 0.163555 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:29.581577 0.402834 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:29.946077 0.111799 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.020051 0.091743 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.069008 0.060691 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.128034 0.206790 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.259900 0.291522 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.550885 0.080712 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.641283 0.096083 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.720005 0.253401 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.892737 0.046929 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:30.943366 0.099931 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:31.023137 0.182980 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:31.184166 0.243599 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:31.406352 0.202861 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:31.519725 0.000000 tcp 10.0.2.105 60090 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:05:31.626050 0.267619 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:31.884989 0.355248 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:32.254623 0.290479 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:32.503688 0.286830 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:32.781394 0.375237 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:33.152506 0.179500 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:33.333938 0.144390 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:33.431100 0.395243 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:33.788522 0.057018 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:33.855229 0.355203 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:34.209449 0.210713 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:34.415912 0.183135 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2584 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:34.597789 0.056128 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:34.678693 0.000000 udp 10.0.2.105 7010 -> 190.39.39.145 5166 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:05:53.020842 0.034254 tcp 10.0.2.105 60094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:53.055399 0.037649 tcp 10.0.2.105 60095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:53.093296 0.129895 tcp 10.0.2.105 60096 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:05:53.223848 0.735504 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:53.743820 0.192040 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:53.942001 0.061606 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:54.000816 0.228942 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:54.222284 0.708989 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:54.909953 0.224231 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:55.098331 0.222035 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:05:55.313357 0.000000 udp 10.0.2.105 7010 -> 188.131.17.21 9865 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:06:12.821847 0.031606 tcp 10.0.2.105 60097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:06:12.853728 0.034297 tcp 10.0.2.105 60098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:06:12.888339 0.127387 tcp 10.0.2.105 60099 -> 195.113.214.249 443 SRPA* 0 0 21 13058 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:06:13.016412 0.047748 udp 10.0.2.105 7010 <-> 5.13.8.110 2778 CON 0 0 6 2017 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:06:13.075604 0.000000 udp 10.0.2.105 7010 -> 180.215.30.164 4386 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:06:29.242509 0.032634 tcp 10.0.2.105 60100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:06:29.275385 0.034283 tcp 10.0.2.105 60101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:06:29.309948 0.126654 tcp 10.0.2.105 60102 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:10:20.997787 3.001952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:10:28.005542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:10:36.007078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:10:37.519617 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:10:37.519719 2.993735 tcp 10.0.2.105 60103 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:10:46.521858 0.000000 tcp 10.0.2.105 60103 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:10:52.017229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:10:52.528692 0.032115 tcp 10.0.2.105 60104 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:10:52.561085 0.033565 tcp 10.0.2.105 60105 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:10:52.594972 0.130955 tcp 10.0.2.105 60106 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:10:52.762683 2.992252 tcp 10.0.2.105 60107 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:01.753647 0.000000 tcp 10.0.2.105 60107 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:07.753260 0.034026 tcp 10.0.2.105 60108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:07.787591 0.036208 tcp 10.0.2.105 60109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:07.824141 0.127552 tcp 10.0.2.105 60110 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:07.969115 1.896962 tcp 10.0.2.105 60111 -> 46.48.223.67 15494 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:09.660585 0.031490 tcp 10.0.2.105 60112 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:09.692376 0.032533 tcp 10.0.2.105 60113 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:09.725147 0.129881 tcp 10.0.2.105 60114 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:09.866319 3.003400 tcp 10.0.2.105 60115 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:18.870106 0.000000 tcp 10.0.2.105 60115 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:24.015766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:11:24.867074 3.004329 tcp 10.0.2.105 60116 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:33.870150 0.000000 tcp 10.0.2.105 60116 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:11:38.780163 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:11:39.871085 0.344080 tcp 10.0.2.105 60117 -> 46.48.223.67 15494 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:11:47.490671 0.000413 tcp 10.0.2.105 60117 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:16:47.491553 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:16:47.491738 2.993616 tcp 10.0.2.105 60118 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:16:56.483698 0.000000 tcp 10.0.2.105 60118 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:02.494249 0.032967 tcp 10.0.2.105 60119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:02.527507 0.033359 tcp 10.0.2.105 60120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:02.561212 0.129447 tcp 10.0.2.105 60121 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:02.701496 2.995752 tcp 10.0.2.105 60122 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:11.695151 0.000000 tcp 10.0.2.105 60122 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:17.695006 0.031883 tcp 10.0.2.105 60123 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:17.727199 0.032887 tcp 10.0.2.105 60124 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:17.760387 0.130260 tcp 10.0.2.105 60125 -> 195.113.214.249 443 SRPA* 0 0 23 13962 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:17.901010 3.112701 tcp 10.0.2.105 60126 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:20.810065 0.031474 tcp 10.0.2.105 60127 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:20.841800 0.034639 tcp 10.0.2.105 60128 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:20.876717 0.127762 tcp 10.0.2.105 60129 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:21.014007 2.998887 tcp 10.0.2.105 60130 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:28.054905 2.985134 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:17:30.044542 0.000000 tcp 10.0.2.105 60130 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:35.029336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:17:36.010911 2.994423 tcp 10.0.2.105 60131 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:43.031026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:17:45.003553 0.000000 tcp 10.0.2.105 60131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:17:49.780607 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:17:51.012285 3.192924 tcp 10.0.2.105 60132 -> 46.48.223.67 15494 FSPA* 0 0 14 1722 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:17:59.040547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:18:31.040163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:22:54.198708 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:22:54.198806 3.003884 tcp 10.0.2.105 60133 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:03.201547 0.000000 tcp 10.0.2.105 60133 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:09.202256 0.032848 tcp 10.0.2.105 60134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:09.235403 0.033062 tcp 10.0.2.105 60135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:09.268771 0.124411 tcp 10.0.2.105 60136 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:09.429025 2.995656 tcp 10.0.2.105 60137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:18.425875 0.000000 tcp 10.0.2.105 60137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:24.422327 0.031196 tcp 10.0.2.105 60138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:24.453792 0.032409 tcp 10.0.2.105 60139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:24.486524 0.126428 tcp 10.0.2.105 60140 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:24.639711 3.626739 tcp 10.0.2.105 60141 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:28.026814 0.031070 tcp 10.0.2.105 60142 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:28.058243 0.033094 tcp 10.0.2.105 60143 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:28.091639 0.124207 tcp 10.0.2.105 60144 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:23:28.266652 3.004859 tcp 10.0.2.105 60145 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:37.270492 0.000000 tcp 10.0.2.105 60145 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:43.259919 3.003510 tcp 10.0.2.105 60146 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:52.271893 0.000000 tcp 10.0.2.105 60146 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:23:56.778248 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:23:58.260301 3.495433 tcp 10.0.2.105 60147 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:24:35.045954 3.007288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:24:42.056834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:24:50.057850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:25:06.058066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:25:38.064064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:29:01.757153 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:29:01.757264 3.003701 tcp 10.0.2.105 60148 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:10.759723 0.000000 tcp 10.0.2.105 60148 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:16.760185 0.032562 tcp 10.0.2.105 60149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:16.792969 0.032102 tcp 10.0.2.105 60150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:16.825320 0.126220 tcp 10.0.2.105 60151 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:16.986060 3.006768 tcp 10.0.2.105 60152 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:26.001757 0.000000 tcp 10.0.2.105 60152 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:31.981115 0.030824 tcp 10.0.2.105 60153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:32.012351 0.032637 tcp 10.0.2.105 60154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:32.045300 0.128713 tcp 10.0.2.105 60155 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:32.184175 3.757873 tcp 10.0.2.105 60156 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:35.740659 0.031467 tcp 10.0.2.105 60157 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:35.772407 0.032945 tcp 10.0.2.105 60158 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:35.805620 0.125869 tcp 10.0.2.105 60159 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:29:35.942295 2.997916 tcp 10.0.2.105 60160 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:44.938650 0.000000 tcp 10.0.2.105 60160 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:50.937711 3.003782 tcp 10.0.2.105 60161 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:29:59.940551 0.000000 tcp 10.0.2.105 60161 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:30:04.777209 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:30:05.939153 3.619352 tcp 10.0.2.105 60162 -> 46.48.223.67 15494 FSPA* 0 0 14 1535 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:31:42.069893 3.001640 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:31:49.077502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:31:57.078912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:32:13.081861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:32:45.094815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:36:49.169405 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:36:49.169543 0.000000 udp 10.0.2.105 7010 -> 190.39.39.145 5166 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:37:04.593044 0.032573 tcp 10.0.2.105 60163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:04.625895 0.033003 tcp 10.0.2.105 60164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:04.659211 0.125097 tcp 10.0.2.105 60165 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:04.784878 0.000000 udp 10.0.2.105 7010 -> 188.131.17.21 9865 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:37:22.858021 0.030870 tcp 10.0.2.105 60166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:22.889162 0.032435 tcp 10.0.2.105 60167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:22.921904 0.118338 tcp 10.0.2.105 60168 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:23.040811 0.000000 udp 10.0.2.105 7010 -> 180.215.30.164 4386 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:37:38.931102 0.032329 tcp 10.0.2.105 60169 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:38.963732 0.032220 tcp 10.0.2.105 60170 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:38.996231 0.126652 tcp 10.0.2.105 60171 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:39.123545 0.068894 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.173868 0.161389 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.332113 0.059027 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.389914 0.167918 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.506568 0.277136 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.571926 0.354901 tcp 10.0.2.105 60172 -> 46.48.223.67 15494 SPA_* 0 0 9 1109 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:39.785214 0.082362 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.879851 0.093829 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:39.954848 0.211473 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.082909 0.046234 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.116016 0.134009 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1359 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.240375 0.194487 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.411961 0.243047 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.633570 0.116261 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.710091 0.091977 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:40.763936 0.357514 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:41.088611 0.355491 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:41.467274 0.289415 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:41.747730 0.162741 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:41.902111 0.203135 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.114476 0.284010 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.358413 0.125383 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.442481 0.146026 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.587571 0.211936 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.793360 0.183610 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:42.975897 0.059645 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:43.037709 0.192859 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:43.240540 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:37:45.302619 0.215401 tcp 10.0.2.105 60172 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:45.303394 0.031289 tcp 10.0.2.105 60173 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:45.334953 0.032420 tcp 10.0.2.105 60174 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:45.367601 0.123666 tcp 10.0.2.105 60175 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:45.518233 4.617364 tcp 10.0.2.105 60176 -> 46.48.223.67 15494 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:59.352020 0.031069 tcp 10.0.2.105 60177 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:59.383344 0.033214 tcp 10.0.2.105 60178 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:59.416848 0.124570 tcp 10.0.2.105 60179 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:37:59.542015 0.223425 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:37:59.731038 0.371026 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:00.097898 0.230495 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:00.321587 4.979088 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:05.301070 0.190142 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:05.431301 0.166246 udp 10.0.2.105 7010 <- 72.251.11.248 2321 RSP 0 0 4 1899 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:38:05.483368 0.056169 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:05.582504 0.225223 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:05.817825 0.218433 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:06.028663 0.760239 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/20 13:38:06.766986 0.000000 udp 10.0.2.105 7010 -> 5.13.8.110 2778 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 13:38:22.173565 0.031425 tcp 10.0.2.105 60180 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:38:22.205341 0.034423 tcp 10.0.2.105 60181 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:38:22.240147 0.123467 tcp 10.0.2.105 60182 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:38:49.098196 2.997689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:38:56.101207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:39:04.102814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:39:20.105843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:39:52.111619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:42:50.128432 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:42:50.128664 3.003202 tcp 10.0.2.105 60183 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:42:59.130700 0.000000 tcp 10.0.2.105 60183 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:05.131095 0.031872 tcp 10.0.2.105 60184 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:05.163231 0.032138 tcp 10.0.2.105 60185 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:05.195641 0.122977 tcp 10.0.2.105 60186 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:05.328683 2.995044 tcp 10.0.2.105 60187 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:14.334444 0.000000 tcp 10.0.2.105 60187 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:20.321872 0.067030 tcp 10.0.2.105 60188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:20.389175 0.032380 tcp 10.0.2.105 60189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:20.421846 0.121266 tcp 10.0.2.105 60190 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:20.553818 3.821107 tcp 10.0.2.105 60191 -> 46.48.223.67 15494 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:24.106160 0.031049 tcp 10.0.2.105 60192 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:24.137543 0.035254 tcp 10.0.2.105 60193 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:24.173084 0.122350 tcp 10.0.2.105 60194 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:43:24.375123 3.005969 tcp 10.0.2.105 60195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:33.379981 0.000000 tcp 10.0.2.105 60195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:39.369051 3.004079 tcp 10.0.2.105 60196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:48.381707 0.000000 tcp 10.0.2.105 60196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:43:53.282858 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:43:54.373408 1.779579 tcp 10.0.2.105 60197 -> 46.48.223.67 15494 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:45:56.117410 3.002007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:46:03.126042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:46:11.126066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:46:27.130131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:46:59.141793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:48:56.156477 0.000251 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:48:56.156888 3.001996 tcp 10.0.2.105 60198 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:05.157298 0.000000 tcp 10.0.2.105 60198 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:11.157129 0.032909 tcp 10.0.2.105 60199 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:11.190287 0.032044 tcp 10.0.2.105 60200 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:11.222619 0.120759 tcp 10.0.2.105 60201 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:11.353889 3.006144 tcp 10.0.2.105 60202 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:20.358945 0.000000 tcp 10.0.2.105 60202 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:26.347834 0.030758 tcp 10.0.2.105 60203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:26.378900 0.032452 tcp 10.0.2.105 60204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:26.411664 0.124304 tcp 10.0.2.105 60205 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:26.546325 2.927602 tcp 10.0.2.105 60206 -> 46.48.223.67 15494 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:29.269958 0.032168 tcp 10.0.2.105 60207 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:29.302361 0.032400 tcp 10.0.2.105 60208 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:29.335043 0.123984 tcp 10.0.2.105 60209 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:49:29.474144 3.002360 tcp 10.0.2.105 60210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:38.475720 0.000000 tcp 10.0.2.105 60210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:44.473624 3.004426 tcp 10.0.2.105 60211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:53.478495 0.000000 tcp 10.0.2.105 60211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:49:58.273280 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:49:59.475238 2.958555 tcp 10.0.2.105 60212 -> 46.48.223.67 15494 FSPA* 0 0 14 1701 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:53:03.142811 3.000546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 13:53:10.149244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:53:18.151247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:53:34.161370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:54:06.159587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 13:55:02.431192 0.000154 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:55:02.431441 2.993577 tcp 10.0.2.105 60213 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:11.423345 0.000000 tcp 10.0.2.105 60213 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:17.433864 0.032335 tcp 10.0.2.105 60214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:17.466450 0.035172 tcp 10.0.2.105 60215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:17.501903 0.132213 tcp 10.0.2.105 60216 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:17.650205 2.996969 tcp 10.0.2.105 60217 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:26.645422 0.000000 tcp 10.0.2.105 60217 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:32.644848 0.031175 tcp 10.0.2.105 60218 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:32.676341 0.032552 tcp 10.0.2.105 60219 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:32.708974 0.132720 tcp 10.0.2.105 60220 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:32.897539 2.152966 tcp 10.0.2.105 60221 -> 46.48.223.67 15494 FSPA* 0 0 14 1551 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:34.846336 0.030910 tcp 10.0.2.105 60222 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:34.877607 0.032663 tcp 10.0.2.105 60223 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:34.910541 0.123924 tcp 10.0.2.105 60224 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:55:35.050783 3.001082 tcp 10.0.2.105 60225 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:44.050687 0.000000 tcp 10.0.2.105 60225 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:50.049423 3.006436 tcp 10.0.2.105 60226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:55:59.061828 0.000000 tcp 10.0.2.105 60226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 13:56:03.778659 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 13:56:05.051107 0.356933 tcp 10.0.2.105 60227 -> 46.48.223.67 15494 SPA_* 0 0 9 1021 flow=From-Botnet-V2-TCP-Established 1970/02/20 13:56:16.258326 0.000420 tcp 10.0.2.105 60227 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:00:10.164957 3.002702 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:00:17.172973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:00:25.174724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:00:41.177674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:01:13.183650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:01:16.258964 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:01:16.259074 3.003838 tcp 10.0.2.105 60228 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:01:25.261430 0.000000 tcp 10.0.2.105 60228 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:01:31.265269 0.031854 tcp 10.0.2.105 60229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:31.297405 0.033986 tcp 10.0.2.105 60230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:31.331706 0.129595 tcp 10.0.2.105 60231 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:31.520378 2.993868 tcp 10.0.2.105 60232 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:01:40.523170 0.000000 tcp 10.0.2.105 60232 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:01:46.512407 0.031298 tcp 10.0.2.105 60233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:46.543961 0.034330 tcp 10.0.2.105 60234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:46.578614 0.122819 tcp 10.0.2.105 60235 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:01:46.851844 0.360399 tcp 10.0.2.105 60236 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:06.763961 0.212567 tcp 10.0.2.105 60236 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:06.765044 0.032102 tcp 10.0.2.105 60237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:06.797482 0.033449 tcp 10.0.2.105 60238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:06.831200 0.125644 tcp 10.0.2.105 60239 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:06.976800 2.998994 tcp 10.0.2.105 60240 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:02:15.973785 0.000000 tcp 10.0.2.105 60240 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:02:21.972834 2.998670 tcp 10.0.2.105 60241 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:02:30.965720 0.000000 tcp 10.0.2.105 60241 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:02:35.775832 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:02:36.977237 0.351699 tcp 10.0.2.105 60242 -> 46.48.223.67 15494 SPA_* 0 0 9 1055 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:02:42.072219 0.000378 tcp 10.0.2.105 60242 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:07:24.190062 3.005049 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:07:31.197143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:07:39.198832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:07:55.201576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:08:27.207958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:08:45.123912 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:08:45.124013 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 14:09:01.418704 0.032062 tcp 10.0.2.105 60243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:01.451086 0.031893 tcp 10.0.2.105 60244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:01.483269 0.124122 tcp 10.0.2.105 60245 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:01.608032 0.000000 udp 10.0.2.105 7010 -> 5.13.8.110 2778 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 14:09:18.064634 0.031178 tcp 10.0.2.105 60246 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:18.095674 0.031750 tcp 10.0.2.105 60247 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:18.127718 0.122110 tcp 10.0.2.105 60248 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:18.250360 0.068909 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:18.299435 0.210039 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:18.419372 0.292339 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2545 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:18.737716 0.084817 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:18.866060 0.095928 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:18.942545 0.217886 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.076689 0.047693 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.109294 0.060761 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.223296 0.223271 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.508931 0.109160 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.578463 0.146212 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:19.688466 0.385863 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:20.045291 0.233905 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:20.259573 0.187734 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1329 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:20.593326 0.187781 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:20.796176 0.291688 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:21.078972 0.355345 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:21.464943 0.167381 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:21.619259 0.204133 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:21.877001 0.204987 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:22.188818 0.205509 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:22.404376 0.055880 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:22.532582 0.142794 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:22.631532 0.257344 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:22.844447 0.203099 udp 10.0.2.105 7010 <-> 176.73.173.20 9362 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:23.045159 0.194404 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:23.243177 0.370480 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:23.610067 0.192600 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:23.765790 0.230027 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:23.989142 0.264248 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:24.286165 0.220597 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:24.499064 0.056176 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:24.630529 0.192289 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:24.814477 0.788875 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:25.321706 0.718639 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:09:27.074083 3.004073 tcp 10.0.2.105 60249 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:09:36.076856 0.000000 tcp 10.0.2.105 60249 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:09:42.078190 0.031192 tcp 10.0.2.105 60250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:42.109666 0.032440 tcp 10.0.2.105 60251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:42.142364 0.120833 tcp 10.0.2.105 60252 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:42.393203 2.996961 tcp 10.0.2.105 60253 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:09:51.391379 0.000000 tcp 10.0.2.105 60253 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:09:57.388046 0.031023 tcp 10.0.2.105 60254 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:57.419349 0.031702 tcp 10.0.2.105 60255 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:57.451398 0.127701 tcp 10.0.2.105 60256 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:09:57.916492 0.351489 tcp 10.0.2.105 60257 -> 46.48.223.67 15494 SPA_* 0 0 9 1086 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:07.935440 0.411020 tcp 10.0.2.105 60257 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:07.936525 0.030841 tcp 10.0.2.105 60258 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:07.967663 0.032609 tcp 10.0.2.105 60259 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:08.000542 0.122725 tcp 10.0.2.105 60260 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:08.346759 3.001159 tcp 10.0.2.105 60261 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:10:17.346047 0.000000 tcp 10.0.2.105 60261 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:10:23.345194 3.003843 tcp 10.0.2.105 60262 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:10:32.347788 0.000000 tcp 10.0.2.105 60262 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:10:37.274616 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:10:38.346519 0.358064 tcp 10.0.2.105 60263 -> 46.48.223.67 15494 SPA_* 0 0 9 1086 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:10:47.124691 0.000369 tcp 10.0.2.105 60263 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:14:31.213902 3.001362 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:14:38.221123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:14:46.222508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:15:02.228852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:15:34.231911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:15:47.120150 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:15:47.120370 2.994490 tcp 10.0.2.105 60264 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:15:56.123297 0.000000 tcp 10.0.2.105 60264 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:02.123060 0.032558 tcp 10.0.2.105 60265 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:02.155814 0.032641 tcp 10.0.2.105 60266 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:02.188825 0.124711 tcp 10.0.2.105 60267 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:02.510791 3.000195 tcp 10.0.2.105 60268 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:11.504979 0.000000 tcp 10.0.2.105 60268 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:17.504258 0.032111 tcp 10.0.2.105 60269 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:17.536718 0.031897 tcp 10.0.2.105 60270 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:17.568906 0.122585 tcp 10.0.2.105 60271 -> 195.113.214.249 443 SRPA* 0 0 20 11544 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:17.756526 0.359335 tcp 10.0.2.105 60272 -> 46.48.223.67 15494 SPA_* 0 0 9 1110 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:24.759360 0.362901 tcp 10.0.2.105 60272 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:24.760133 0.031338 tcp 10.0.2.105 60273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:24.791783 0.032518 tcp 10.0.2.105 60274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:24.824631 0.122246 tcp 10.0.2.105 60275 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:16:25.122523 2.996537 tcp 10.0.2.105 60276 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:34.117677 0.000000 tcp 10.0.2.105 60276 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:40.115987 3.004701 tcp 10.0.2.105 60277 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:49.119144 0.000000 tcp 10.0.2.105 60277 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:16:53.775641 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:16:55.118085 1.734455 tcp 10.0.2.105 60278 -> 46.48.223.67 15494 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:21:38.237878 3.001341 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:21:45.245137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:21:53.246587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:21:56.852494 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:21:56.852594 2.993370 tcp 10.0.2.105 60279 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:05.844776 0.000000 tcp 10.0.2.105 60279 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:09.249764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:22:11.855411 0.032004 tcp 10.0.2.105 60280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:11.887712 0.033057 tcp 10.0.2.105 60281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:11.921073 0.121661 tcp 10.0.2.105 60282 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:12.249252 2.998929 tcp 10.0.2.105 60283 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:21.246661 0.000000 tcp 10.0.2.105 60283 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:27.246030 0.031004 tcp 10.0.2.105 60284 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:27.277282 0.032763 tcp 10.0.2.105 60285 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:27.310413 0.122269 tcp 10.0.2.105 60286 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:27.498831 0.355657 tcp 10.0.2.105 60287 -> 46.48.223.67 15494 SPA_* 0 0 9 1214 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:32.665037 0.347891 tcp 10.0.2.105 60287 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:32.665842 0.031393 tcp 10.0.2.105 60288 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:32.697526 0.032481 tcp 10.0.2.105 60289 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:32.730259 0.125074 tcp 10.0.2.105 60290 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:22:33.013169 3.010438 tcp 10.0.2.105 60291 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:41.255777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:22:42.016672 0.000000 tcp 10.0.2.105 60291 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:48.005531 3.007062 tcp 10.0.2.105 60292 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:22:57.008325 0.000000 tcp 10.0.2.105 60292 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:23:01.774982 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:23:03.006507 4.152169 tcp 10.0.2.105 60293 -> 46.48.223.67 15494 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:07.155435 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:28:07.155547 3.003109 tcp 10.0.2.105 60294 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:28:16.160419 0.000000 tcp 10.0.2.105 60294 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:28:22.157442 0.031412 tcp 10.0.2.105 60295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:22.189174 0.032490 tcp 10.0.2.105 60296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:22.221963 0.123118 tcp 10.0.2.105 60297 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:22.474225 3.006354 tcp 10.0.2.105 60298 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:28:31.479067 0.000000 tcp 10.0.2.105 60298 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:28:37.468390 0.030966 tcp 10.0.2.105 60299 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:37.499602 0.032179 tcp 10.0.2.105 60300 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:37.532111 0.125317 tcp 10.0.2.105 60301 -> 195.113.214.249 443 SRPA* 0 0 44 28538 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:37.901881 0.350784 tcp 10.0.2.105 60302 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:45.262519 3.663860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:28:48.008701 0.220703 tcp 10.0.2.105 60302 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:48.009445 0.030671 tcp 10.0.2.105 60303 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:48.040556 0.032311 tcp 10.0.2.105 60304 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:48.073176 0.124225 tcp 10.0.2.105 60305 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:28:48.229645 2.959061 tcp 10.0.2.105 60306 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:28:52.884510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:28:57.119789 0.000000 tcp 10.0.2.105 60306 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:29:00.792800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:29:03.048865 2.965559 tcp 10.0.2.105 60307 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:29:11.941136 0.000000 tcp 10.0.2.105 60307 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:29:16.593737 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:29:16.603726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:29:17.868903 0.352244 tcp 10.0.2.105 60308 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:29:27.005390 0.000410 tcp 10.0.2.105 60308 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:29:48.289162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:35:52.295680 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 14:35:59.305237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:36:07.304098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:36:23.307763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:36:55.313499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:39:31.518468 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:39:31.518578 0.071966 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:31.569545 0.251568 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:31.726781 0.330475 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.076808 0.078219 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.197338 0.093259 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.272028 0.144373 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.370613 0.046285 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.680939 0.103080 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.749729 0.085357 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:32.845267 0.357881 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:33.175882 0.236623 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:33.391924 0.058482 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:33.551958 0.156206 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:33.704084 0.121176 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:33.805227 0.186196 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:34.113893 0.286807 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:34.399704 0.355180 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:34.961208 0.487854 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:35.440151 0.200649 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:35.680624 0.055902 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:36.003486 0.126852 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:36.086405 0.256717 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:36.300925 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 14:39:41.843810 3.041680 tcp 10.0.2.105 60309 -> 46.48.223.67 15494 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:44.612077 0.032093 tcp 10.0.2.105 60310 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:44.644605 0.032860 tcp 10.0.2.105 60311 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:44.677850 0.121524 tcp 10.0.2.105 60312 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:44.885703 3.320980 tcp 10.0.2.105 60313 -> 46.48.223.67 15494 FSPA* 0 0 14 1737 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:53.661963 0.031415 tcp 10.0.2.105 60314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:53.693208 0.032056 tcp 10.0.2.105 60315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:53.725522 0.119658 tcp 10.0.2.105 60316 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:39:53.845771 0.210054 udp 10.0.2.105 7010 <-> 177.227.224.64 8061 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:54.136437 0.178965 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:54.314274 0.192898 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:54.550420 0.371955 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:54.917843 0.196296 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:55.079703 0.229030 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:55.301292 0.229919 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:55.495613 0.191183 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:39:55.679211 0.000000 udp 10.0.2.105 7010 -> 72.251.11.248 2321 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 14:40:00.707313 0.597003 udp 10.0.2.105 7010 <- 72.251.11.248 2321 RSP 0 0 5 1899 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 14:40:00.707724 0.217958 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:40:01.129590 0.056610 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:40:01.182960 0.725383 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/20 14:42:59.319634 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:43:06.327186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:43:14.328709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:43:30.331586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:44:02.337747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:44:48.207500 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:44:48.207769 2.999992 tcp 10.0.2.105 60317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:44:57.205982 0.000000 tcp 10.0.2.105 60317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:03.206779 0.032082 tcp 10.0.2.105 60318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:03.239168 0.032336 tcp 10.0.2.105 60319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:03.271850 0.120978 tcp 10.0.2.105 60320 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:03.548782 3.001000 tcp 10.0.2.105 60321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:12.548841 0.000000 tcp 10.0.2.105 60321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:18.548139 0.033479 tcp 10.0.2.105 60322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:18.581898 0.032331 tcp 10.0.2.105 60323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:18.614553 0.120237 tcp 10.0.2.105 60324 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:18.745685 0.369314 tcp 10.0.2.105 60325 -> 46.48.223.67 15494 SPA_* 0 0 9 1147 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:30.326544 0.314559 tcp 10.0.2.105 60325 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:30.327393 0.030524 tcp 10.0.2.105 60326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:30.358234 0.032419 tcp 10.0.2.105 60327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:30.390966 0.120948 tcp 10.0.2.105 60328 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:45:30.641388 2.997257 tcp 10.0.2.105 60329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:39.637279 0.000000 tcp 10.0.2.105 60329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:45.636263 3.003895 tcp 10.0.2.105 60330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:54.638843 0.000000 tcp 10.0.2.105 60330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:45:59.275790 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:46:00.637971 1.772336 tcp 10.0.2.105 60331 -> 46.48.223.67 15494 FSPA* 0 0 14 1677 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:02.411837 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:51:02.411929 2.994050 tcp 10.0.2.105 60332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:11.407755 0.000000 tcp 10.0.2.105 60332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:17.414265 0.031799 tcp 10.0.2.105 60333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:17.446268 0.033297 tcp 10.0.2.105 60334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:17.479443 0.124579 tcp 10.0.2.105 60335 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:17.829828 2.998284 tcp 10.0.2.105 60336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:26.830887 0.000000 tcp 10.0.2.105 60336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:32.825970 0.032148 tcp 10.0.2.105 60337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:32.858470 0.031651 tcp 10.0.2.105 60338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:32.890438 0.121405 tcp 10.0.2.105 60339 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:33.030090 3.139861 tcp 10.0.2.105 60340 -> 46.48.223.67 15494 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:35.944626 0.031203 tcp 10.0.2.105 60341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:35.976126 0.031547 tcp 10.0.2.105 60342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:36.007925 0.121857 tcp 10.0.2.105 60343 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:51:36.170198 2.993959 tcp 10.0.2.105 60344 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:45.173058 0.000000 tcp 10.0.2.105 60344 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:51:51.161837 2.993518 tcp 10.0.2.105 60345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:52:00.154752 0.000000 tcp 10.0.2.105 60345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:52:04.771108 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:52:06.163468 3.181392 tcp 10.0.2.105 60346 -> 46.48.223.67 15494 FSPA* 0 0 14 1554 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:55:38.350988 3.001546 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 14:55:45.358580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:55:53.359694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:56:09.362820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:56:41.369022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 14:57:09.339457 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:57:09.339550 3.003694 tcp 10.0.2.105 60347 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:18.351887 0.000000 tcp 10.0.2.105 60347 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:24.342670 0.031849 tcp 10.0.2.105 60348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:24.374790 0.032303 tcp 10.0.2.105 60349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:24.407371 0.106555 tcp 10.0.2.105 60350 -> 195.113.214.249 443 SRPA* 0 0 37 25166 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:24.642656 2.992561 tcp 10.0.2.105 60351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:33.633971 0.000000 tcp 10.0.2.105 60351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:39.643214 0.031221 tcp 10.0.2.105 60352 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:39.674719 0.032208 tcp 10.0.2.105 60353 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:39.707184 0.125601 tcp 10.0.2.105 60354 -> 195.113.214.249 443 SRPA* 0 0 40 22014 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:39.967221 3.674432 tcp 10.0.2.105 60355 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:43.351295 0.031052 tcp 10.0.2.105 60356 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:43.382640 0.032775 tcp 10.0.2.105 60357 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:43.415747 0.120435 tcp 10.0.2.105 60358 -> 195.113.214.249 443 SRPA* 0 0 24 12592 flow=From-Botnet-V2-TCP-Established 1970/02/20 14:57:43.641905 3.000866 tcp 10.0.2.105 60359 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:52.641292 0.000000 tcp 10.0.2.105 60359 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:57:58.640134 2.994315 tcp 10.0.2.105 60360 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:58:07.642530 0.000000 tcp 10.0.2.105 60360 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 14:58:12.279565 0.000132 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 14:58:13.641520 3.477873 tcp 10.0.2.105 60361 -> 46.48.223.67 15494 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:02:45.375167 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:02:52.382211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:03:00.383585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:03:16.388510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:03:17.119309 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:03:17.119452 3.002580 tcp 10.0.2.105 60362 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:03:26.120879 0.000000 tcp 10.0.2.105 60362 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:03:32.120802 0.031367 tcp 10.0.2.105 60363 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:32.152557 0.032126 tcp 10.0.2.105 60364 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:32.184960 0.125384 tcp 10.0.2.105 60365 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:32.382007 2.991824 tcp 10.0.2.105 60366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:03:41.382631 0.000000 tcp 10.0.2.105 60366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:03:47.382284 0.030856 tcp 10.0.2.105 60367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:47.413451 0.032202 tcp 10.0.2.105 60368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:47.445976 0.121831 tcp 10.0.2.105 60369 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:47.715541 3.994998 tcp 10.0.2.105 60370 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:48.392847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:03:51.233636 0.032166 tcp 10.0.2.105 60371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:51.265628 0.032186 tcp 10.0.2.105 60372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:51.298096 0.121097 tcp 10.0.2.105 60373 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:03:51.710781 3.000936 tcp 10.0.2.105 60374 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:04:00.710462 0.000000 tcp 10.0.2.105 60374 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:04:06.712927 2.990471 tcp 10.0.2.105 60375 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:04:15.712012 0.000000 tcp 10.0.2.105 60375 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:04:20.278628 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:04:21.710360 3.573869 tcp 10.0.2.105 60376 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:12.375949 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:10:12.376058 0.000000 udp 10.0.2.105 7010 -> 176.73.173.20 9362 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 15:10:16.403145 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:10:23.410787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:10:30.202555 0.031899 tcp 10.0.2.105 60377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:30.234798 0.032043 tcp 10.0.2.105 60378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:30.267142 0.119794 tcp 10.0.2.105 60379 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:30.387654 0.335589 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:30.748891 0.077791 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:30.824835 0.063596 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.032825 0.165968 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.146987 0.046585 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.412335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:10:31.457064 0.104942 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.584490 0.090879 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.639163 0.361728 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:31.971038 0.093143 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:32.451774 0.188217 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:32.594317 0.167680 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:32.759417 0.134128 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1292 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:33.125993 0.185715 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:33.288721 0.059576 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:33.426718 0.261054 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:33.668539 0.355854 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:34.558834 0.283498 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:34.833530 0.127114 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:34.918061 0.204656 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:35.166030 0.164825 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:35.533859 0.057265 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:35.716107 0.261466 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:35.935073 0.000000 udp 10.0.2.105 7010 -> 177.227.224.64 8061 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 15:10:40.285264 0.359393 tcp 10.0.2.105 60380 -> 46.48.223.67 15494 SPA_* 0 0 9 1176 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:47.415406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:10:47.590017 0.272086 tcp 10.0.2.105 60380 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:47.591168 0.031337 tcp 10.0.2.105 60381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:47.622336 0.032144 tcp 10.0.2.105 60382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:47.654802 0.124015 tcp 10.0.2.105 60383 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:47.862353 3.597476 tcp 10.0.2.105 60384 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:51.812816 0.033361 tcp 10.0.2.105 60385 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:51.846005 0.031797 tcp 10.0.2.105 60386 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:51.878102 0.119559 tcp 10.0.2.105 60387 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:10:51.998322 0.179016 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:52.538849 0.349228 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:52.884589 0.202448 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:53.153589 0.179364 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:53.334387 0.229245 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:53.776565 0.190712 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:53.959674 0.229716 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:54.182024 0.057146 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:54.246443 0.778608 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:54.724803 0.217752 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:10:54.994816 0.634196 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:11:19.424813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:15:51.452616 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:15:51.452768 3.003710 tcp 10.0.2.105 60388 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:16:00.455313 0.000000 tcp 10.0.2.105 60388 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:16:06.455879 0.031817 tcp 10.0.2.105 60389 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:06.488005 0.034996 tcp 10.0.2.105 60390 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:06.523355 0.122113 tcp 10.0.2.105 60391 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:06.769727 4.913452 tcp 10.0.2.105 60392 -> 46.48.223.67 15494 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:10.451409 0.032236 tcp 10.0.2.105 60393 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:10.484015 0.032522 tcp 10.0.2.105 60394 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:10.516787 0.120432 tcp 10.0.2.105 60395 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:16:11.683427 3.002195 tcp 10.0.2.105 60396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:16:20.684384 0.000000 tcp 10.0.2.105 60396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:16:26.682960 3.667532 tcp 10.0.2.105 60397 -> 46.48.223.67 15494 FSPA* 0 0 14 1640 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:17:23.427139 3.002079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:17:30.435893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:17:38.436483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:17:54.439227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:18:26.446017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:21:30.350097 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:21:30.350184 2.993640 tcp 10.0.2.105 60398 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:21:39.352695 0.000000 tcp 10.0.2.105 60398 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:21:45.353105 0.031784 tcp 10.0.2.105 60399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:45.385178 0.031989 tcp 10.0.2.105 60400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:45.417449 0.122438 tcp 10.0.2.105 60401 -> 195.113.214.249 443 SRPA* 0 0 21 13058 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:45.616158 3.905428 tcp 10.0.2.105 60402 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:49.249018 0.036589 tcp 10.0.2.105 60403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:49.285880 0.032539 tcp 10.0.2.105 60404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:49.318628 0.125172 tcp 10.0.2.105 60405 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:21:49.521818 2.999594 tcp 10.0.2.105 60406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:21:58.520091 0.000000 tcp 10.0.2.105 60406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:22:04.519087 3.646615 tcp 10.0.2.105 60407 -> 46.48.223.67 15494 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:24:30.451727 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:24:37.458730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:24:45.460084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:25:01.463162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:25:33.469079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:27:08.165838 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:27:08.165944 3.003576 tcp 10.0.2.105 60408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:27:17.168342 0.000000 tcp 10.0.2.105 60408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:27:23.168869 0.032549 tcp 10.0.2.105 60409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:23.201685 0.032380 tcp 10.0.2.105 60410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:23.234406 0.125183 tcp 10.0.2.105 60411 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:23.374456 3.837174 tcp 10.0.2.105 60412 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:26.999200 0.031422 tcp 10.0.2.105 60413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:27.030878 0.032024 tcp 10.0.2.105 60414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:27.063156 0.120922 tcp 10.0.2.105 60415 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:27:27.211872 2.995474 tcp 10.0.2.105 60416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:27:36.205667 0.000000 tcp 10.0.2.105 60416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:27:42.204416 1.754310 tcp 10.0.2.105 60417 -> 46.48.223.67 15494 FSPA* 0 0 14 1724 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:31:37.474547 3.002303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:31:44.482691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:31:52.484011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:32:08.488526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:32:40.493480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:32:43.965193 0.000206 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:32:43.965506 2.999169 tcp 10.0.2.105 60418 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:32:52.961116 0.000000 tcp 10.0.2.105 60418 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:32:58.961455 0.031837 tcp 10.0.2.105 60419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:32:58.993606 0.031898 tcp 10.0.2.105 60420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:32:59.025814 0.123265 tcp 10.0.2.105 60421 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:32:59.195775 4.016154 tcp 10.0.2.105 60422 -> 46.48.223.67 15494 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:33:02.863653 0.030599 tcp 10.0.2.105 60423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:33:02.894550 0.031914 tcp 10.0.2.105 60424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:33:02.926747 0.122302 tcp 10.0.2.105 60425 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:33:03.212232 2.997680 tcp 10.0.2.105 60426 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:33:12.208628 0.000000 tcp 10.0.2.105 60426 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:33:18.207523 3.651214 tcp 10.0.2.105 60427 -> 46.48.223.67 15494 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:38:44.500436 3.000347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:38:51.506911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:38:59.508213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:39:15.511228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:39:47.518710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:40:57.237787 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:40:57.237956 0.000000 udp 10.0.2.105 7010 -> 177.227.224.64 8061 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 15:41:14.794436 0.031959 tcp 10.0.2.105 60428 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:14.826659 0.031802 tcp 10.0.2.105 60429 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:14.858715 0.120799 tcp 10.0.2.105 60430 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:14.980008 0.062809 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.023541 0.193987 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.152752 0.312550 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.466235 0.069440 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.534869 0.100453 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.599248 0.358204 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.934087 0.047135 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:15.966085 0.105241 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.035327 0.095862 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.113489 0.155464 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.215032 0.187412 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.411678 0.186097 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.595112 0.106913 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.681413 0.059113 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.738327 0.231713 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:16.951364 0.355256 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:17.310612 0.208293 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:17.520343 0.129877 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:17.604403 0.296542 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:17.899668 0.201959 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:18.091259 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 15:41:21.872960 1.982786 tcp 10.0.2.105 60431 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:23.661639 0.031719 tcp 10.0.2.105 60432 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:23.693652 0.032002 tcp 10.0.2.105 60433 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:23.725938 0.121060 tcp 10.0.2.105 60434 -> 195.113.214.249 443 SRPA* 0 0 41 22694 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:23.855980 1.750753 tcp 10.0.2.105 60435 -> 46.48.223.67 15494 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:34.681862 0.032059 tcp 10.0.2.105 60436 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:34.714177 0.032492 tcp 10.0.2.105 60437 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:34.746942 0.124633 tcp 10.0.2.105 60438 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:41:34.872213 0.254422 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:35.083758 0.192889 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:35.288477 0.299447 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:35.583870 0.272627 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:35.818614 0.181508 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:35.999112 0.220932 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:36.186278 0.191442 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:36.370281 0.890055 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:36.920141 0.232143 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:37.144955 0.056121 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:37.227915 0.218856 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:41:37.439394 0.897815 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/20 15:45:51.527154 2.998004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:45:58.530428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:46:06.532538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:46:22.534954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:46:25.599649 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:46:25.599805 2.993898 tcp 10.0.2.105 60439 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:46:34.602548 0.000000 tcp 10.0.2.105 60439 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:46:40.602525 0.031695 tcp 10.0.2.105 60440 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:40.634564 0.033440 tcp 10.0.2.105 60441 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:40.668354 0.121482 tcp 10.0.2.105 60442 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:40.802025 1.896880 tcp 10.0.2.105 60443 -> 46.48.223.67 15494 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:42.501523 0.030945 tcp 10.0.2.105 60444 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:42.532740 0.033121 tcp 10.0.2.105 60445 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:42.566125 0.121938 tcp 10.0.2.105 60446 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:46:42.699165 2.999329 tcp 10.0.2.105 60447 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:46:51.697258 0.000000 tcp 10.0.2.105 60447 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:46:54.541177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:46:57.695797 1.729261 tcp 10.0.2.105 60448 -> 46.48.223.67 15494 FSPA* 0 0 14 1584 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:51:59.428066 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:51:59.428410 2.985307 tcp 10.0.2.105 60449 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:52:08.422837 0.000000 tcp 10.0.2.105 60449 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:52:14.430743 0.032182 tcp 10.0.2.105 60450 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:14.463170 0.032000 tcp 10.0.2.105 60451 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:14.495527 0.122475 tcp 10.0.2.105 60452 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:14.633686 0.352770 tcp 10.0.2.105 60453 -> 46.48.223.67 15494 SPA_* 0 0 9 1242 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:21.519919 0.192819 tcp 10.0.2.105 60453 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:21.520835 0.030942 tcp 10.0.2.105 60454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:21.552064 0.032091 tcp 10.0.2.105 60455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:21.584388 0.118771 tcp 10.0.2.105 60456 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:52:21.712967 2.992854 tcp 10.0.2.105 60457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:52:30.704240 0.000000 tcp 10.0.2.105 60457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:52:36.713056 1.789869 tcp 10.0.2.105 60458 -> 46.48.223.67 15494 FSPA* 0 0 14 1772 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:05.551889 3.002163 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 15:57:12.561232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:57:20.561261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:57:36.564139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:57:38.497348 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 15:57:38.497451 3.003895 tcp 10.0.2.105 60459 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:57:47.499850 0.000000 tcp 10.0.2.105 60459 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:57:53.500903 0.032660 tcp 10.0.2.105 60460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:53.533839 0.031908 tcp 10.0.2.105 60461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:53.566044 0.124178 tcp 10.0.2.105 60462 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:53.700861 1.954485 tcp 10.0.2.105 60463 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:55.441978 0.030882 tcp 10.0.2.105 60464 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:55.473108 0.032593 tcp 10.0.2.105 60465 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:55.506030 0.140019 tcp 10.0.2.105 60466 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/20 15:57:55.655572 3.000487 tcp 10.0.2.105 60467 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:58:04.654972 0.000000 tcp 10.0.2.105 60467 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 15:58:08.570137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 15:58:10.653447 1.703024 tcp 10.0.2.105 60468 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:12.357527 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:03:12.357616 3.004016 tcp 10.0.2.105 60469 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:03:21.359587 0.000000 tcp 10.0.2.105 60469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:03:27.360480 0.032114 tcp 10.0.2.105 60470 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:27.392852 0.034395 tcp 10.0.2.105 60471 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:27.427531 0.119357 tcp 10.0.2.105 60472 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:27.557184 2.043657 tcp 10.0.2.105 60473 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:29.400722 0.031531 tcp 10.0.2.105 60474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:29.432557 0.032315 tcp 10.0.2.105 60475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:29.465159 0.125089 tcp 10.0.2.105 60476 -> 195.113.214.249 443 SRPA* 0 0 47 42372 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:03:29.601115 2.994778 tcp 10.0.2.105 60477 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:03:38.603824 0.000000 tcp 10.0.2.105 60477 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:03:44.594761 1.809925 tcp 10.0.2.105 60478 -> 46.48.223.67 15494 FSPA* 0 0 12 1538 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:04:12.576555 3.001518 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:04:19.583636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:04:27.585518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:04:43.588532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:05:15.594058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:11:19.600589 3.002174 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 16:11:26.607759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:11:34.609055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:11:50.612705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:11:55.439255 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:11:55.439400 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 16:12:11.613919 0.032379 tcp 10.0.2.105 60479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:11.646517 0.032354 tcp 10.0.2.105 60480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:11.679141 0.124134 tcp 10.0.2.105 60481 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:11.803955 0.069209 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:11.852427 0.206574 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:11.982346 0.087677 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.030823 0.368425 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.371127 0.045094 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.412526 0.103753 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2031 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.481001 0.098307 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.561236 0.155299 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.657056 0.331761 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:12.989416 0.069721 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.058605 0.107895 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.146498 0.061380 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.206703 0.235867 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.421251 0.194221 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.591154 0.158022 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.745876 0.139221 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:13.841221 0.290034 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:14.121635 0.171412 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:14.276819 0.198710 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:14.481456 0.355774 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:14.851067 0.254614 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:15.064490 0.271796 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:15.299385 0.193681 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:15.491866 0.230558 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:15.731276 0.191864 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:15.924646 0.299888 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:16.220548 0.191902 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:16.404615 1.005566 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:16.425004 2.988639 tcp 10.0.2.105 60482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:12:17.157837 0.229778 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:17.380147 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 16:12:22.618369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:12:25.422504 0.000000 tcp 10.0.2.105 60482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:12:31.422128 0.031322 tcp 10.0.2.105 60483 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:31.453763 0.032446 tcp 10.0.2.105 60484 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:31.486484 0.120678 tcp 10.0.2.105 60485 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:31.618226 1.991922 tcp 10.0.2.105 60486 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.243835 0.031235 tcp 10.0.2.105 60487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.275337 0.032969 tcp 10.0.2.105 60488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.308643 0.122313 tcp 10.0.2.105 60489 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.413084 0.031798 tcp 10.0.2.105 60490 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.431767 0.218256 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:33.445237 0.031881 tcp 10.0.2.105 60491 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.477478 0.123508 tcp 10.0.2.105 60492 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:12:33.610327 2.998514 tcp 10.0.2.105 60493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:12:33.642830 0.611266 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:12:42.607416 0.000000 tcp 10.0.2.105 60493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:12:48.606147 1.761184 tcp 10.0.2.105 60494 -> 46.48.223.67 15494 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:17:50.359880 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:17:50.359981 2.993650 tcp 10.0.2.105 60495 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:17:59.362818 0.000000 tcp 10.0.2.105 60495 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:18:05.363451 0.031551 tcp 10.0.2.105 60496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:05.395298 0.031938 tcp 10.0.2.105 60497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:05.427490 0.119764 tcp 10.0.2.105 60498 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:05.562202 1.985215 tcp 10.0.2.105 60499 -> 46.48.223.67 15494 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:07.336914 0.031132 tcp 10.0.2.105 60500 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:07.368346 0.031622 tcp 10.0.2.105 60501 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:07.400221 0.120530 tcp 10.0.2.105 60502 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:07.547676 3.001272 tcp 10.0.2.105 60503 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:18:16.549137 0.000000 tcp 10.0.2.105 60503 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:18:22.546011 2.892861 tcp 10.0.2.105 60504 -> 46.48.223.67 15494 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:18:26.624163 3.003354 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:18:33.631791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:18:41.633108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:18:57.635958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:19:29.642914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:23:25.431749 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:23:25.431947 2.993325 tcp 10.0.2.105 60505 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:23:34.424123 0.000000 tcp 10.0.2.105 60505 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:23:40.434743 0.031975 tcp 10.0.2.105 60506 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:40.467000 0.032167 tcp 10.0.2.105 60507 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:40.499440 0.124417 tcp 10.0.2.105 60508 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:40.636978 1.951835 tcp 10.0.2.105 60509 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:42.393471 0.031003 tcp 10.0.2.105 60510 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:42.424828 0.032855 tcp 10.0.2.105 60511 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:42.458069 0.120032 tcp 10.0.2.105 60512 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:23:42.589045 3.001130 tcp 10.0.2.105 60513 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:23:51.589194 0.000000 tcp 10.0.2.105 60513 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:23:57.587838 1.751694 tcp 10.0.2.105 60514 -> 46.48.223.67 15494 FSPA* 0 0 14 1546 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:25:33.649626 3.000312 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:25:40.655780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:25:48.661179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:26:04.660039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:26:36.666660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:28:59.332276 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:28:59.332457 2.992853 tcp 10.0.2.105 60515 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:29:08.324112 0.000000 tcp 10.0.2.105 60515 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:29:14.334517 0.032574 tcp 10.0.2.105 60516 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:14.367382 0.032457 tcp 10.0.2.105 60517 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:14.400079 0.123242 tcp 10.0.2.105 60518 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:14.533105 1.952072 tcp 10.0.2.105 60519 -> 46.48.223.67 15494 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:16.268105 0.031511 tcp 10.0.2.105 60520 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:16.300012 0.032601 tcp 10.0.2.105 60521 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:16.332959 0.122208 tcp 10.0.2.105 60522 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:29:16.485390 3.004708 tcp 10.0.2.105 60523 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:29:25.489007 0.000000 tcp 10.0.2.105 60523 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:29:31.477473 1.735800 tcp 10.0.2.105 60524 -> 46.48.223.67 15494 FSPA* 0 0 14 1592 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:32:40.673246 3.000547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:32:47.679517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:32:55.682295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:33:11.685969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:33:43.693239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:34:33.207934 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:34:33.208130 1.951509 tcp 10.0.2.105 60525 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:34:34.962050 0.032506 tcp 10.0.2.105 60526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:34:34.994784 0.031775 tcp 10.0.2.105 60527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:34:35.026889 0.123638 tcp 10.0.2.105 60528 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:34:35.159835 1.764966 tcp 10.0.2.105 60529 -> 46.48.223.67 15494 FSPA* 0 0 14 1706 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:39:47.696014 3.001855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 16:39:54.703306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:40:02.704701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:40:18.707998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:40:50.714157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:42:53.243028 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:42:53.243180 0.061663 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.302163 0.158787 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.423494 0.063331 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.473851 0.214544 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.597273 0.048509 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2540 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.628926 0.107970 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.763617 0.096062 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.842508 0.196373 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:53.988936 0.328438 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:54.330093 0.341766 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:54.646359 0.107750 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:54.734142 0.059645 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:54.792402 0.068269 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:54.861979 0.162508 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:55.020437 0.131156 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:55.107869 0.294724 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:55.397620 0.182715 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:55.557617 0.234516 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:55.770204 0.354773 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:56.126248 0.261178 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:56.345808 0.166137 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:56.504063 0.203641 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:56.709312 0.225870 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:56.959577 0.191789 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:57.159559 0.350875 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:57.506639 0.198540 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:57.703645 0.303132 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:42:57.970645 3.227669 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:43:00.624529 0.192671 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:43:01.039685 0.232046 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:43:01.575683 0.000000 udp 10.0.2.105 7010 -> 99.44.126.59 1364 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 16:43:06.940649 2.993429 tcp 10.0.2.105 60530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:43:15.942681 0.000000 tcp 10.0.2.105 60530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:43:19.259220 0.031735 tcp 10.0.2.105 60531 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:19.291213 0.031342 tcp 10.0.2.105 60532 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:19.322931 0.124350 tcp 10.0.2.105 60533 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:19.447881 0.606031 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/20 16:43:21.949971 0.031302 tcp 10.0.2.105 60534 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:21.981625 0.033397 tcp 10.0.2.105 60535 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:22.015316 0.125021 tcp 10.0.2.105 60536 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:22.150367 1.960818 tcp 10.0.2.105 60537 -> 46.48.223.67 15494 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:23.914032 0.031396 tcp 10.0.2.105 60538 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:23.945835 0.032230 tcp 10.0.2.105 60539 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:23.978343 0.122417 tcp 10.0.2.105 60540 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:43:24.111460 2.987856 tcp 10.0.2.105 60541 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:43:33.087395 0.000000 tcp 10.0.2.105 60541 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:43:39.086576 1.737929 tcp 10.0.2.105 60542 -> 46.48.223.67 15494 FSPA* 0 0 14 1625 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:46:54.720540 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:47:01.727812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:47:09.728947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:47:25.731851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:47:57.738241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:48:40.823372 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:48:40.823562 2.989990 tcp 10.0.2.105 60543 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:48:49.822888 0.000000 tcp 10.0.2.105 60543 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:48:55.823228 0.032002 tcp 10.0.2.105 60544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:55.855456 0.031456 tcp 10.0.2.105 60545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:55.887211 0.123629 tcp 10.0.2.105 60546 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:56.021065 1.972638 tcp 10.0.2.105 60547 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:57.798865 0.031159 tcp 10.0.2.105 60548 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:57.830302 0.032245 tcp 10.0.2.105 60549 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:57.862814 0.121249 tcp 10.0.2.105 60550 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:48:57.993906 3.007792 tcp 10.0.2.105 60551 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:49:06.997585 0.000000 tcp 10.0.2.105 60551 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:49:12.985914 4.807738 tcp 10.0.2.105 60552 -> 46.48.223.67 15494 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:01.745382 3.000347 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 16:54:08.751483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:54:16.752387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:54:17.794802 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:54:17.794898 3.003861 tcp 10.0.2.105 60553 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:54:26.797386 0.000000 tcp 10.0.2.105 60553 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:54:32.756090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:54:32.797778 0.031987 tcp 10.0.2.105 60554 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:32.829995 0.031484 tcp 10.0.2.105 60555 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:32.861731 0.122063 tcp 10.0.2.105 60556 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:32.994019 1.948562 tcp 10.0.2.105 60557 -> 46.48.223.67 15494 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:34.733037 0.030913 tcp 10.0.2.105 60558 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:34.764237 0.032142 tcp 10.0.2.105 60559 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:34.796668 0.121751 tcp 10.0.2.105 60560 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:54:34.942849 2.990067 tcp 10.0.2.105 60561 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:54:43.942549 0.000000 tcp 10.0.2.105 60561 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 16:54:49.940624 1.736019 tcp 10.0.2.105 60562 -> 46.48.223.67 15494 FSPA* 0 0 14 1576 flow=From-Botnet-V2-TCP-Established 1970/02/20 16:55:04.762078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 16:59:51.675006 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 16:59:51.675145 3.003440 tcp 10.0.2.105 60563 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:00:00.677523 0.000000 tcp 10.0.2.105 60563 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:00:06.677868 0.031872 tcp 10.0.2.105 60564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:06.710034 0.032501 tcp 10.0.2.105 60565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:06.742906 0.121135 tcp 10.0.2.105 60566 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:06.874444 1.947058 tcp 10.0.2.105 60567 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:08.622669 0.031601 tcp 10.0.2.105 60568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:08.654584 0.031932 tcp 10.0.2.105 60569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:08.686941 0.123126 tcp 10.0.2.105 60570 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:00:08.821735 3.001684 tcp 10.0.2.105 60571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:00:17.832279 0.000000 tcp 10.0.2.105 60571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:00:23.820697 1.733482 tcp 10.0.2.105 60572 -> 46.48.223.67 15494 FSPA* 0 0 14 1624 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:01:08.767092 3.002584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:01:15.775303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:01:23.777256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:01:39.781531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:02:11.785299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:08:15.792121 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 17:08:22.799223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:08:30.801078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:08:46.804011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:09:18.809671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:13:43.140285 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:13:43.140454 0.000000 udp 10.0.2.105 7010 -> 99.44.126.59 1364 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 17:13:58.283400 0.032661 tcp 10.0.2.105 60573 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:13:58.316394 0.031456 tcp 10.0.2.105 60574 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:13:58.348134 0.122639 tcp 10.0.2.105 60575 -> 195.113.214.249 443 SRPA* 0 0 21 11766 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:13:58.471488 0.097204 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:58.528701 0.062653 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:58.573351 0.166095 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:58.685546 0.046217 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:58.847743 0.109167 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:58.920984 0.096621 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:59.000216 0.154648 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:59.094979 0.056007 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:59.186173 0.318950 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:59.506146 0.060631 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:13:59.564514 1.201641 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:00.767598 0.156418 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:00.920130 0.130103 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:01.004276 0.108239 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:01.091140 0.347924 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:01.411320 0.238394 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:01.628662 0.358539 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:01.995020 0.187685 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:02.190987 0.294300 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:02.475404 0.227990 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:02.714295 0.193085 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:02.922740 0.254779 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:03.137961 0.164483 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:03.292517 0.202223 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:03.496723 0.230343 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:03.692695 0.178552 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:04.045442 0.370899 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:04.412663 0.194357 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:04.597866 3.060917 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:07.004363 0.236714 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:07.233804 0.848368 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:14:10.609820 2.994119 tcp 10.0.2.105 60576 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:14:19.612633 0.000000 tcp 10.0.2.105 60576 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:14:24.279074 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:14:25.611637 0.032323 tcp 10.0.2.105 60577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:25.644283 0.031875 tcp 10.0.2.105 60578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:25.676471 0.125689 tcp 10.0.2.105 60579 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:25.817921 1.997138 tcp 10.0.2.105 60580 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:27.612132 0.031877 tcp 10.0.2.105 60581 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:27.644353 0.032807 tcp 10.0.2.105 60582 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:27.677463 0.119909 tcp 10.0.2.105 60583 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:14:27.815374 3.003145 tcp 10.0.2.105 60584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:14:36.817083 0.000000 tcp 10.0.2.105 60584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:14:42.815865 1.763620 tcp 10.0.2.105 60585 -> 46.48.223.67 15494 FSPA* 0 0 14 1771 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:15:22.815864 3.001668 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:15:29.823436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:15:37.824850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:15:53.827772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:16:25.833977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:19:44.570022 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:19:44.570188 2.993563 tcp 10.0.2.105 60586 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:19:53.572662 0.000000 tcp 10.0.2.105 60586 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:19:59.573478 0.032576 tcp 10.0.2.105 60587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:19:59.606323 0.031810 tcp 10.0.2.105 60588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:19:59.638442 0.123001 tcp 10.0.2.105 60589 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:19:59.779000 1.998647 tcp 10.0.2.105 60590 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:20:01.571137 0.031268 tcp 10.0.2.105 60591 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:20:01.602720 0.031782 tcp 10.0.2.105 60592 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:20:01.634768 0.121174 tcp 10.0.2.105 60593 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:20:01.777856 3.000750 tcp 10.0.2.105 60594 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:20:10.777279 0.000000 tcp 10.0.2.105 60594 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:20:16.780943 1.723678 tcp 10.0.2.105 60595 -> 46.48.223.67 15494 FSPA* 0 0 14 1760 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:22:29.840750 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:22:36.847705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:22:44.849400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:23:00.855016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:23:32.857756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:25:18.500202 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:25:18.500317 2.993540 tcp 10.0.2.105 60596 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:25:27.502464 0.000000 tcp 10.0.2.105 60596 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:25:33.502566 0.032660 tcp 10.0.2.105 60597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:33.535495 0.032610 tcp 10.0.2.105 60598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:33.568871 0.120563 tcp 10.0.2.105 60599 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:33.700423 3.104040 tcp 10.0.2.105 60600 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:36.597214 0.031984 tcp 10.0.2.105 60601 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:36.629400 0.031702 tcp 10.0.2.105 60602 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:36.661541 0.121473 tcp 10.0.2.105 60603 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:25:36.804698 3.005675 tcp 10.0.2.105 60604 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:25:45.812708 0.000000 tcp 10.0.2.105 60604 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:25:51.799180 3.174772 tcp 10.0.2.105 60605 -> 46.48.223.67 15494 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:29:36.864093 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:29:43.872978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:29:51.872812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:30:07.875826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:30:39.881743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:30:54.963279 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:30:54.963380 3.004358 tcp 10.0.2.105 60606 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:31:03.966459 0.000000 tcp 10.0.2.105 60606 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:31:09.966793 0.032540 tcp 10.0.2.105 60607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:09.999620 0.032072 tcp 10.0.2.105 60608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:10.031967 0.122528 tcp 10.0.2.105 60609 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:10.172711 3.513822 tcp 10.0.2.105 60610 -> 46.48.223.67 15494 FSPA* 0 0 14 1764 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:13.486938 0.031470 tcp 10.0.2.105 60611 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:13.518774 0.032977 tcp 10.0.2.105 60612 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:13.552113 0.124462 tcp 10.0.2.105 60613 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:31:13.686773 2.997769 tcp 10.0.2.105 60614 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:31:22.683086 0.000000 tcp 10.0.2.105 60614 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:31:28.682245 1.766638 tcp 10.0.2.105 60615 -> 46.48.223.67 15494 FSPA* 0 0 14 1764 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:36:43.886791 3.004854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:36:50.894685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:36:58.896732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:37:14.899779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:37:46.905756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:43:50.916148 2.996662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 17:43:57.919183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:44:05.920709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:44:21.923792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:44:34.202258 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:44:34.202449 0.123871 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.288895 0.064729 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.334477 0.184671 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.457937 0.045322 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.489595 0.112932 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.562793 0.093457 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.639166 0.197188 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.770660 0.056239 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:34.837867 0.341682 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.180572 0.059413 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.237840 0.128224 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.324574 0.103207 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.406296 0.070400 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.473117 0.165217 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.630745 0.353549 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:35.954226 0.234038 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:36.168422 0.375813 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:36.555767 0.186163 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:36.761953 0.205702 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:36.969406 0.261747 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:37.188039 0.286070 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:37.465021 0.228677 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:37.656072 0.180303 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:37.827318 0.201649 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:38.030323 0.425996 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:38.418777 0.179429 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:38.606022 0.390032 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:38.991181 0.192591 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:39.176260 1.420738 udp 10.0.2.105 7010 <-> 72.251.11.248 2321 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:39.986093 0.235069 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:40.213976 0.612322 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/20 17:44:45.497955 3.003859 tcp 10.0.2.105 60616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:44:53.929708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:44:54.500655 0.000000 tcp 10.0.2.105 60616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:44:59.277514 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:45:00.501024 0.031881 tcp 10.0.2.105 60617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:00.533197 0.031925 tcp 10.0.2.105 60618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:00.565415 0.120924 tcp 10.0.2.105 60619 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:00.701015 1.999678 tcp 10.0.2.105 60620 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:02.467263 0.033473 tcp 10.0.2.105 60621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:02.501045 0.032284 tcp 10.0.2.105 60622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:02.533240 0.120755 tcp 10.0.2.105 60623 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:45:02.700952 2.998618 tcp 10.0.2.105 60624 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:45:11.695235 0.000000 tcp 10.0.2.105 60624 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:45:17.698270 3.474258 tcp 10.0.2.105 60625 -> 46.48.223.67 15494 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:21.170501 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:50:21.170596 3.009110 tcp 10.0.2.105 60626 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:50:30.164507 0.000000 tcp 10.0.2.105 60626 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:50:36.176959 0.032967 tcp 10.0.2.105 60627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:36.210265 0.033333 tcp 10.0.2.105 60628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:36.243952 0.124178 tcp 10.0.2.105 60629 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:36.380526 4.725345 tcp 10.0.2.105 60630 -> 46.48.223.67 15494 FSPA* 0 0 14 1703 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:40.904318 0.031123 tcp 10.0.2.105 60631 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:40.935680 0.032171 tcp 10.0.2.105 60632 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:40.968129 0.121266 tcp 10.0.2.105 60633 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:50:41.106079 3.007001 tcp 10.0.2.105 60634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:50:50.121487 0.000000 tcp 10.0.2.105 60634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:50:56.100493 0.368140 tcp 10.0.2.105 60635 -> 46.48.223.67 15494 SPA_* 0 0 9 1173 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:51:03.282458 0.000611 tcp 10.0.2.105 60635 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:03.283205 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 17:56:03.283342 2.993240 tcp 10.0.2.105 60636 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:56:05.938213 3.002120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 17:56:12.275898 0.000000 tcp 10.0.2.105 60636 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:56:12.945346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:56:18.285479 0.033038 tcp 10.0.2.105 60637 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:18.318745 0.031527 tcp 10.0.2.105 60638 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:18.350562 0.124981 tcp 10.0.2.105 60639 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:18.491033 1.293222 tcp 10.0.2.105 60640 -> 46.48.223.67 15494 SPA_* 0 0 9 1013 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:20.947365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:56:32.802696 0.196104 tcp 10.0.2.105 60640 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:32.803423 0.031347 tcp 10.0.2.105 60641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:32.835010 0.031686 tcp 10.0.2.105 60642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:32.866989 0.124873 tcp 10.0.2.105 60643 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:56:32.999015 3.004699 tcp 10.0.2.105 60644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:56:36.951031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 17:56:41.997876 0.000000 tcp 10.0.2.105 60644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 17:56:47.986131 4.993403 tcp 10.0.2.105 60645 -> 46.48.223.67 15494 FSPA* 0 0 14 1543 flow=From-Botnet-V2-TCP-Established 1970/02/20 17:57:08.956729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:01:52.975199 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:01:52.975367 3.004101 tcp 10.0.2.105 60646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:02:01.981450 0.000000 tcp 10.0.2.105 60646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:02:07.978447 0.032481 tcp 10.0.2.105 60647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:08.011219 0.031909 tcp 10.0.2.105 60648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:08.043409 0.122734 tcp 10.0.2.105 60649 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:08.176922 4.804958 tcp 10.0.2.105 60650 -> 46.48.223.67 15494 SPA_* 0 0 12 1542 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:12.982443 0.031212 tcp 10.0.2.105 60651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:13.013947 0.032402 tcp 10.0.2.105 60652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:13.046623 0.124173 tcp 10.0.2.105 60653 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:13.189560 0.000074 tcp 10.0.2.105 60650 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:02:13.189909 2.998233 tcp 10.0.2.105 60654 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:02:22.187166 0.000000 tcp 10.0.2.105 60654 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:02:28.185893 4.816447 tcp 10.0.2.105 60655 -> 46.48.223.67 15494 FSPA* 0 0 14 1650 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:03:12.968516 2.995572 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:03:19.969849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:03:27.972939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:03:43.974468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:04:15.980597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:10:32.996161 3.000716 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 18:10:40.002736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:10:48.003808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:11:04.007084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:11:36.013459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:14:51.704747 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:14:51.704943 0.091648 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:51.758012 0.061993 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:51.809871 0.172942 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:51.931647 0.047196 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:51.984022 0.108452 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.055497 0.093223 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.130983 0.208576 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.263657 0.057019 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.317395 0.350736 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.683682 0.059814 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.741583 0.127486 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.823933 0.107587 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.910928 0.069579 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:52.981930 0.787987 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:53.767010 0.379574 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:54.117948 0.235938 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:54.332747 0.192731 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:54.598157 0.259741 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:54.815222 0.373487 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:55.203872 0.183038 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:55.364608 0.291808 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:55.647307 0.224627 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:55.835945 0.177402 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:56.006808 0.202296 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:56.210419 0.348273 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:56.555243 0.192519 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:56.739353 0.209980 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:56.914785 0.183999 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:14:57.092724 0.000000 udp 10.0.2.105 7010 -> 72.251.11.248 2321 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 18:15:03.042110 2.992912 tcp 10.0.2.105 60656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:15:12.033744 0.000000 tcp 10.0.2.105 60656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:15:15.724491 0.032712 tcp 10.0.2.105 60657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:15.757467 0.032144 tcp 10.0.2.105 60658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:15.789900 0.121264 tcp 10.0.2.105 60659 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:15.911997 0.233238 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:15:16.137814 0.699916 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:15:18.044049 0.032105 tcp 10.0.2.105 60660 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:18.076016 0.032439 tcp 10.0.2.105 60661 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:18.108716 0.123688 tcp 10.0.2.105 60662 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:18.246927 4.929995 tcp 10.0.2.105 60663 -> 46.48.223.67 15494 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:22.980451 0.031728 tcp 10.0.2.105 60664 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:23.012475 0.032278 tcp 10.0.2.105 60665 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:23.045013 0.122583 tcp 10.0.2.105 60666 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:15:23.177154 2.996885 tcp 10.0.2.105 60667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:15:32.182812 0.000000 tcp 10.0.2.105 60667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:15:38.171430 1.736442 tcp 10.0.2.105 60668 -> 46.48.223.67 15494 FSPA* 0 0 14 1631 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:17:40.019702 3.003090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:17:47.026882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:17:55.028050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:18:11.037712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:18:43.037448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:20:39.905009 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:20:39.905176 3.004341 tcp 10.0.2.105 60669 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:20:48.908611 0.000000 tcp 10.0.2.105 60669 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:20:54.913892 0.032107 tcp 10.0.2.105 60670 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:20:54.946276 0.033157 tcp 10.0.2.105 60671 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:20:54.979693 0.125284 tcp 10.0.2.105 60672 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:20:55.115044 0.355744 tcp 10.0.2.105 60673 -> 46.48.223.67 15494 SPA_* 0 0 9 1022 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:21:03.680391 0.201836 tcp 10.0.2.105 60673 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:21:03.681171 0.031458 tcp 10.0.2.105 60674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:21:03.712986 0.031886 tcp 10.0.2.105 60675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:21:03.745104 0.121861 tcp 10.0.2.105 60676 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:21:03.882468 2.995977 tcp 10.0.2.105 60677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:21:12.882881 0.000000 tcp 10.0.2.105 60677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:21:18.881707 4.549318 tcp 10.0.2.105 60678 -> 46.48.223.67 15494 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:24:47.043267 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:24:54.050645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:25:02.051913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:25:18.055043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:25:50.060923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:26:23.419596 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:26:23.419759 2.993799 tcp 10.0.2.105 60679 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:26:32.422962 0.000000 tcp 10.0.2.105 60679 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:26:38.422147 0.032278 tcp 10.0.2.105 60680 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:38.454722 0.032646 tcp 10.0.2.105 60681 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:38.487665 0.123027 tcp 10.0.2.105 60682 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:38.624981 1.943956 tcp 10.0.2.105 60683 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:40.372750 0.032126 tcp 10.0.2.105 60684 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:40.404712 0.032276 tcp 10.0.2.105 60685 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:40.437297 0.121857 tcp 10.0.2.105 60686 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:26:40.569141 2.998748 tcp 10.0.2.105 60687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:26:49.567050 0.000000 tcp 10.0.2.105 60687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:26:55.565431 1.743521 tcp 10.0.2.105 60688 -> 46.48.223.67 15494 FSPA* 0 0 14 1541 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:31:54.067789 3.004835 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:31:57.313570 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:31:57.313656 2.995946 tcp 10.0.2.105 60689 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:32:01.082201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:32:06.312733 0.000000 tcp 10.0.2.105 60689 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:32:09.078759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:32:12.313172 0.032424 tcp 10.0.2.105 60690 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:12.345977 0.033002 tcp 10.0.2.105 60691 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:12.379235 0.121764 tcp 10.0.2.105 60692 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:12.512728 4.653561 tcp 10.0.2.105 60693 -> 46.48.223.67 15494 FSPA* 0 0 14 1763 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:16.967086 0.031152 tcp 10.0.2.105 60694 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:16.998524 0.031678 tcp 10.0.2.105 60695 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:17.030502 0.122667 tcp 10.0.2.105 60696 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:17.166572 3.005202 tcp 10.0.2.105 60697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:32:25.079010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:32:26.170587 0.000000 tcp 10.0.2.105 60697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:32:32.159225 4.346580 tcp 10.0.2.105 60698 -> 46.48.223.67 15494 FSPA* 0 0 14 1763 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:32:57.085095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:39:01.091372 3.000947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 18:39:08.099029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:39:16.100146 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:39:32.102885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:40:04.109328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:45:28.097296 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:45:28.097509 0.000000 udp 10.0.2.105 7010 -> 72.251.11.248 2321 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 18:45:45.181459 0.032556 tcp 10.0.2.105 60699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:45:45.214270 0.031454 tcp 10.0.2.105 60700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:45:45.245969 0.123360 tcp 10.0.2.105 60701 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:45:45.369885 0.190725 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.495801 0.046248 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.549640 0.111112 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.620264 0.094889 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.697932 0.085482 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.744935 0.068150 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.795812 0.062536 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2679 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:45.854816 0.340915 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.197028 0.059576 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.254784 0.192902 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.411929 0.110337 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.500087 0.067668 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.569185 0.133234 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.655263 0.159492 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:46.812102 0.354716 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:47.138410 0.355239 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:47.495101 0.192991 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:47.689525 0.243857 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:47.913262 0.249916 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:48.124523 0.290049 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:48.405948 0.228442 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:48.596775 0.164322 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:48.795052 0.209437 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:49.046309 0.186978 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:49.212879 0.179735 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:49.391445 0.347689 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:49.736140 0.191578 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:49.919180 0.208720 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:50.091478 0.234941 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:50.318801 0.611471 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/20 18:45:51.559224 2.993652 tcp 10.0.2.105 60702 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:46:00.561481 0.000000 tcp 10.0.2.105 60702 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:46:06.560566 0.031901 tcp 10.0.2.105 60703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:06.592812 0.032379 tcp 10.0.2.105 60704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:06.625536 0.122610 tcp 10.0.2.105 60705 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:06.777330 0.357189 tcp 10.0.2.105 60706 -> 46.48.223.67 15494 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:08.115421 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:46:15.122951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:46:16.201749 0.198014 tcp 10.0.2.105 60706 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:16.202688 0.032173 tcp 10.0.2.105 60707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:16.235144 0.031856 tcp 10.0.2.105 60708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:16.267271 0.122562 tcp 10.0.2.105 60709 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:16.400019 3.001542 tcp 10.0.2.105 60710 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:46:23.124075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:46:25.397241 0.000000 tcp 10.0.2.105 60710 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:46:31.396478 4.296543 tcp 10.0.2.105 60711 -> 46.48.223.67 15494 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:46:39.127070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:47:11.132864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:51:35.693643 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:51:35.693736 3.003926 tcp 10.0.2.105 60712 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:51:44.696133 0.000000 tcp 10.0.2.105 60712 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:51:50.696272 0.032548 tcp 10.0.2.105 60713 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:50.729151 0.032477 tcp 10.0.2.105 60714 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:50.761914 0.125601 tcp 10.0.2.105 60715 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:50.898593 4.382400 tcp 10.0.2.105 60716 -> 46.48.223.67 15494 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:55.083346 0.031779 tcp 10.0.2.105 60717 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:55.115394 0.031992 tcp 10.0.2.105 60718 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:55.147643 0.122665 tcp 10.0.2.105 60719 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:51:55.281247 2.994817 tcp 10.0.2.105 60720 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:52:04.274517 0.000000 tcp 10.0.2.105 60720 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:52:10.273519 0.355588 tcp 10.0.2.105 60721 -> 46.48.223.67 15494 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:52:15.339737 0.000345 tcp 10.0.2.105 60721 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:53:15.139085 3.001550 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 18:53:22.146760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:53:30.147796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:53:46.151089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:54:18.160938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 18:57:15.344870 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 18:57:15.345012 2.992391 tcp 10.0.2.105 60722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:57:24.324717 0.000000 tcp 10.0.2.105 60722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:57:30.334916 0.032918 tcp 10.0.2.105 60723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:30.368014 0.032790 tcp 10.0.2.105 60724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:30.400634 0.122811 tcp 10.0.2.105 60725 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:30.541894 4.345356 tcp 10.0.2.105 60726 -> 46.48.223.67 15494 FSPA* 0 0 14 1763 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:34.685164 0.030685 tcp 10.0.2.105 60727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:34.716095 0.033197 tcp 10.0.2.105 60728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:34.749581 0.122379 tcp 10.0.2.105 60729 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 18:57:34.887457 2.986514 tcp 10.0.2.105 60730 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:57:43.882560 0.000000 tcp 10.0.2.105 60730 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 18:57:49.871704 4.147004 tcp 10.0.2.105 60731 -> 46.48.223.67 15494 FSPA* 0 0 14 1763 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:00:22.165979 2.998787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:00:29.170229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:00:37.171748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:00:53.175125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:01:25.182023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:02:54.018881 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:02:54.019032 3.003934 tcp 10.0.2.105 60732 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:03:03.031902 0.000000 tcp 10.0.2.105 60732 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:03:09.021937 0.032186 tcp 10.0.2.105 60733 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:09.054456 0.031745 tcp 10.0.2.105 60734 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:09.086496 0.119903 tcp 10.0.2.105 60735 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:09.257794 4.257980 tcp 10.0.2.105 60736 -> 46.48.223.67 15494 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:13.317300 0.030664 tcp 10.0.2.105 60737 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:13.348455 0.032863 tcp 10.0.2.105 60738 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:13.381592 0.124542 tcp 10.0.2.105 60739 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:03:13.516001 3.005155 tcp 10.0.2.105 60740 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:03:22.519616 0.000000 tcp 10.0.2.105 60740 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:03:28.509066 2.566286 tcp 10.0.2.105 60741 -> 46.48.223.67 15494 FSPA* 0 0 14 1538 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:07:29.191526 2.997091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:07:36.194110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:07:44.196136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:08:00.198787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:08:32.204892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:14:36.212021 3.000699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 19:14:43.218564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:14:51.219611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:15:07.222870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:15:39.228892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:16:15.513173 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:16:15.513346 0.166239 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.623239 0.047674 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.683027 0.113770 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.757050 0.095025 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.833180 0.090814 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.886884 0.069919 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.936559 0.056562 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:15.990192 0.344498 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:16.123673 4.600375 tcp 10.0.2.105 60742 -> 46.48.223.67 15494 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:16:16.337838 0.117543 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:16.455747 0.092691 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:16.744900 0.128632 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:16.829715 0.160113 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:16.986331 0.406466 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:17.365841 0.060905 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:17.425111 0.203315 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:17.578950 0.368195 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:17.998595 0.191681 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:18.191516 0.236767 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:18.405824 0.254657 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:18.617615 0.165054 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:18.790917 0.202350 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:18.994906 0.185460 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:19.238921 0.285899 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:19.519817 0.228747 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:19.752150 0.183968 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:19.928288 0.362704 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:20.141278 0.031682 tcp 10.0.2.105 60743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:16:20.173273 0.032514 tcp 10.0.2.105 60744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:16:20.206065 0.122207 tcp 10.0.2.105 60745 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:16:20.287129 0.190765 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:20.724291 3.961713 tcp 10.0.2.105 60746 -> 46.48.223.67 15494 FSPA* 0 0 14 1553 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:16:20.740794 0.187026 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:20.934190 0.234493 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:16:21.161553 0.797181 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:21:24.685717 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:21:24.685849 3.007025 tcp 10.0.2.105 60747 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:21:33.688532 0.000000 tcp 10.0.2.105 60747 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:21:39.689573 0.033216 tcp 10.0.2.105 60748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:39.723134 0.032613 tcp 10.0.2.105 60749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:39.756085 0.121786 tcp 10.0.2.105 60750 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:39.903416 0.351444 tcp 10.0.2.105 60751 -> 46.48.223.67 15494 SPA_* 0 0 9 1057 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:43.236009 3.000902 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:21:50.242954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:21:54.813382 0.198182 tcp 10.0.2.105 60751 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:54.814235 0.031940 tcp 10.0.2.105 60752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:54.846525 0.032156 tcp 10.0.2.105 60753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:54.878926 0.121452 tcp 10.0.2.105 60754 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:21:55.011724 2.991874 tcp 10.0.2.105 60755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:21:58.243806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:22:04.012442 0.000000 tcp 10.0.2.105 60755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:22:10.011689 3.983899 tcp 10.0.2.105 60756 -> 46.48.223.67 15494 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:22:14.246868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:22:46.253072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:27:13.988611 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:27:13.988727 3.003420 tcp 10.0.2.105 60757 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:27:22.991241 0.000000 tcp 10.0.2.105 60757 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:27:28.991271 0.035690 tcp 10.0.2.105 60758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:29.027320 0.032499 tcp 10.0.2.105 60759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:29.060085 0.124598 tcp 10.0.2.105 60760 -> 195.113.214.249 443 SRPA* 0 0 41 22488 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:29.201866 4.141214 tcp 10.0.2.105 60761 -> 46.48.223.67 15494 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:33.143110 0.031384 tcp 10.0.2.105 60762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:33.174769 0.032712 tcp 10.0.2.105 60763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:33.207774 0.126051 tcp 10.0.2.105 60764 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:27:33.343329 3.006477 tcp 10.0.2.105 60765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:27:42.348565 0.000000 tcp 10.0.2.105 60765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:27:48.337104 1.736720 tcp 10.0.2.105 60766 -> 46.48.223.67 15494 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:28:50.259653 3.006240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:28:57.266063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:29:05.267875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:29:21.272065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:29:53.278799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:32:50.071764 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:32:50.071927 2.996502 tcp 10.0.2.105 60767 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:32:59.063847 0.000000 tcp 10.0.2.105 60767 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:33:05.073491 0.032567 tcp 10.0.2.105 60768 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:05.106265 0.032839 tcp 10.0.2.105 60769 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:05.139420 0.127687 tcp 10.0.2.105 60770 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:05.293973 1.985671 tcp 10.0.2.105 60771 -> 46.48.223.67 15494 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:07.069086 0.031945 tcp 10.0.2.105 60772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:07.101304 0.031887 tcp 10.0.2.105 60773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:07.133482 0.125478 tcp 10.0.2.105 60774 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:33:07.279860 3.000227 tcp 10.0.2.105 60775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:33:16.278892 0.000000 tcp 10.0.2.105 60775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:33:22.277679 1.766766 tcp 10.0.2.105 60776 -> 46.48.223.67 15494 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:35:57.283025 3.001547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:36:04.290122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:36:12.292378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:36:28.294809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:37:00.300367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:38:24.041711 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:38:24.041945 2.993789 tcp 10.0.2.105 60777 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:38:33.034032 0.000000 tcp 10.0.2.105 60777 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:38:39.044918 0.032500 tcp 10.0.2.105 60778 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:39.077777 0.031700 tcp 10.0.2.105 60779 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:39.109759 0.124199 tcp 10.0.2.105 60780 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:39.244679 4.061894 tcp 10.0.2.105 60781 -> 46.48.223.67 15494 FSPA* 0 0 14 1526 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:43.068900 0.031747 tcp 10.0.2.105 60782 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:43.100885 0.031788 tcp 10.0.2.105 60783 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:43.132928 0.125078 tcp 10.0.2.105 60784 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:38:43.306871 3.006566 tcp 10.0.2.105 60785 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:38:52.323165 0.000000 tcp 10.0.2.105 60785 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:38:58.300761 3.849995 tcp 10.0.2.105 60786 -> 46.48.223.67 15494 FSPA* 0 0 13 1472 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:39:03.652036 0.000184 tcp 10.0.2.105 60786 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:43:04.306916 3.001440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:43:11.314326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:43:19.315501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:43:35.318582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:44:07.324835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:46:47.525531 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:46:47.525740 0.225276 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.658667 0.047663 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.711746 0.109497 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.783374 0.097291 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.862023 0.083218 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.906774 0.067489 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:47.959211 0.061561 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.017246 0.068388 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.113525 0.146843 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.212236 0.165136 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.387628 0.329498 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.718328 0.132010 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2622 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:48.827778 0.346941 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:49.146920 0.060725 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:49.206366 0.177754 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:49.340405 0.358381 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:49.708862 0.191683 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:49.912625 0.166362 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:50.069216 0.203488 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:50.281092 0.186993 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:50.443481 0.234140 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:50.657920 0.267836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:50.883109 0.283603 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:51.167159 0.225544 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:51.492115 0.178916 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:51.687575 0.189773 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:51.841490 0.235695 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:52.069098 0.373378 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:52.439064 0.193463 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:46:52.623156 0.762798 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/20 19:47:02.166394 3.006689 tcp 10.0.2.105 60787 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:47:11.168822 0.000000 tcp 10.0.2.105 60787 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:47:15.775489 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:47:17.169400 0.032645 tcp 10.0.2.105 60788 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:17.202298 0.032575 tcp 10.0.2.105 60789 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:17.235148 0.123420 tcp 10.0.2.105 60790 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:17.368939 0.351881 tcp 10.0.2.105 60791 -> 46.48.223.67 15494 SPA_* 0 0 9 1238 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:23.146470 0.198953 tcp 10.0.2.105 60791 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:23.147285 0.031758 tcp 10.0.2.105 60792 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:23.179317 0.033156 tcp 10.0.2.105 60793 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:23.212843 0.122752 tcp 10.0.2.105 60794 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:23.345672 3.005173 tcp 10.0.2.105 60795 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:47:32.355802 0.000000 tcp 10.0.2.105 60795 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:47:38.338156 0.369874 tcp 10.0.2.105 60796 -> 46.48.223.67 15494 SPA_* 0 0 9 1238 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:47:43.901555 0.000478 tcp 10.0.2.105 60796 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:52:43.897917 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:52:43.898053 3.003705 tcp 10.0.2.105 60797 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:52:52.900165 0.000000 tcp 10.0.2.105 60797 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:52:58.900986 0.033108 tcp 10.0.2.105 60798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:52:58.934422 0.032884 tcp 10.0.2.105 60799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:52:58.967642 0.124083 tcp 10.0.2.105 60800 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:52:59.139963 0.360165 tcp 10.0.2.105 60801 -> 46.48.223.67 15494 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:04.517231 0.199892 tcp 10.0.2.105 60801 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:04.517964 0.031211 tcp 10.0.2.105 60802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:04.549434 0.032951 tcp 10.0.2.105 60803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:04.582637 0.124318 tcp 10.0.2.105 60804 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:04.717329 3.004090 tcp 10.0.2.105 60805 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:53:13.720437 0.000000 tcp 10.0.2.105 60805 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:53:19.709062 1.342958 tcp 10.0.2.105 60806 -> 46.48.223.67 15494 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:53:25.879994 0.000398 tcp 10.0.2.105 60806 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:55:45.332345 3.000609 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 19:55:52.338767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:56:00.339779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:56:16.342942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:56:48.349127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 19:58:25.879409 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 19:58:25.879571 2.993904 tcp 10.0.2.105 60807 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:58:34.882003 0.000000 tcp 10.0.2.105 60807 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:58:40.882755 0.032875 tcp 10.0.2.105 60808 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:40.915959 0.034746 tcp 10.0.2.105 60809 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:40.950996 0.123052 tcp 10.0.2.105 60810 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:41.093254 0.343208 tcp 10.0.2.105 60811 -> 46.48.223.67 15494 SPA_* 0 0 9 1234 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:52.034583 0.197558 tcp 10.0.2.105 60811 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:52.035337 0.031533 tcp 10.0.2.105 60812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:52.067142 0.031807 tcp 10.0.2.105 60813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:52.099247 0.123587 tcp 10.0.2.105 60814 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 19:58:52.232374 2.998848 tcp 10.0.2.105 60815 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:59:01.229999 0.000000 tcp 10.0.2.105 60815 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 19:59:07.229084 1.767172 tcp 10.0.2.105 60816 -> 46.48.223.67 15494 FSPA* 0 0 14 1764 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:02:52.355304 3.001349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:02:59.362908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:03:07.363596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:03:23.366999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:03:55.373249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:04:08.993245 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:04:08.993449 3.003110 tcp 10.0.2.105 60817 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:04:17.995543 0.000000 tcp 10.0.2.105 60817 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:04:23.995544 0.033202 tcp 10.0.2.105 60818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:24.029008 0.031779 tcp 10.0.2.105 60819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:24.061109 0.125253 tcp 10.0.2.105 60820 -> 195.113.214.249 443 SRPA* 0 0 44 27912 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:24.195987 4.806771 tcp 10.0.2.105 60821 -> 46.48.223.67 15494 SPA_* 0 0 12 1419 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:29.003343 0.032126 tcp 10.0.2.105 60822 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:29.035720 0.032933 tcp 10.0.2.105 60823 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:29.068958 0.124689 tcp 10.0.2.105 60824 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:29.212404 0.000116 tcp 10.0.2.105 60821 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:04:29.212744 2.993381 tcp 10.0.2.105 60825 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:04:38.204434 0.000000 tcp 10.0.2.105 60825 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:04:44.220849 4.740756 tcp 10.0.2.105 60826 -> 46.48.223.67 15494 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:10:23.382666 3.002523 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:10:30.390863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:10:38.392749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:10:54.395402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:11:26.401541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:17:03.847203 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:17:03.847366 0.181471 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:03.971073 0.046644 udp 10.0.2.105 7010 <-> 79.227.180.34 2430 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:03.997616 4.827323 tcp 10.0.2.105 60827 -> 46.48.223.67 15494 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:17:04.102794 0.112610 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.175625 0.095987 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.253920 0.086238 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.299871 0.064740 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.347315 0.056720 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.401413 0.071609 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.526129 0.125559 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.607657 0.147375 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:04.733286 0.445514 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:05.151638 0.059924 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:05.209658 0.239755 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:05.425089 0.355491 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:05.794962 0.189679 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:05.938142 0.363092 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:06.300868 0.205512 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:06.526281 0.163129 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:06.680962 0.235888 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:06.895495 0.257992 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:07.114022 0.289942 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 1979 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:07.395301 0.203922 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:07.608045 0.191954 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:07.809638 0.231268 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:08.046604 0.179211 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:08.224712 0.303525 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:08.492708 0.238267 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:08.626272 0.032265 tcp 10.0.2.105 60828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:17:08.658808 0.031992 tcp 10.0.2.105 60829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:17:08.691061 0.124626 tcp 10.0.2.105 60830 -> 195.113.214.249 443 SRPA* 0 0 41 22488 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:17:08.723688 0.373006 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:08.825197 4.608270 tcp 10.0.2.105 60831 -> 46.48.223.67 15494 FSPA* 0 0 14 1744 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:17:09.093385 0.190977 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:09.275856 1.218417 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:17:30.407459 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 20:17:37.415883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:17:45.416170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:18:01.419202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:18:33.429048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:22:13.422268 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:22:13.422359 2.998257 tcp 10.0.2.105 60832 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:22:22.414565 0.000000 tcp 10.0.2.105 60832 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:22:28.424894 0.032540 tcp 10.0.2.105 60833 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:28.457710 0.032802 tcp 10.0.2.105 60834 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:28.490813 0.129205 tcp 10.0.2.105 60835 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:28.638378 4.702627 tcp 10.0.2.105 60836 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:33.139525 0.030826 tcp 10.0.2.105 60837 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:33.170622 0.032683 tcp 10.0.2.105 60838 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:33.203589 0.123065 tcp 10.0.2.105 60839 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:22:33.341217 2.993236 tcp 10.0.2.105 60840 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:22:42.333364 0.000000 tcp 10.0.2.105 60840 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:22:48.331907 1.729745 tcp 10.0.2.105 60841 -> 46.48.223.67 15494 FSPA* 0 0 14 1721 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:24:37.431365 3.001786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:24:44.439044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:24:52.441056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:25:08.443877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:25:40.453071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:27:50.056178 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:27:50.056443 3.003277 tcp 10.0.2.105 60842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:27:59.063586 0.000000 tcp 10.0.2.105 60842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:28:05.063127 0.033193 tcp 10.0.2.105 60843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:05.096626 0.033044 tcp 10.0.2.105 60844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:05.129990 0.124575 tcp 10.0.2.105 60845 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:05.316865 1.964810 tcp 10.0.2.105 60846 -> 46.48.223.67 15494 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:07.074117 0.031619 tcp 10.0.2.105 60847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:07.105990 0.032360 tcp 10.0.2.105 60848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:07.138642 0.126499 tcp 10.0.2.105 60849 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:28:07.281901 2.992387 tcp 10.0.2.105 60850 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:28:16.273389 0.000000 tcp 10.0.2.105 60850 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:28:22.283216 4.310733 tcp 10.0.2.105 60851 -> 46.48.223.67 15494 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:31:44.456178 3.000850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:31:51.462968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:31:59.464180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:32:15.471438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:32:47.473398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:33:26.589792 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:33:26.589962 2.993963 tcp 10.0.2.105 60852 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:33:35.592764 0.000000 tcp 10.0.2.105 60852 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:33:41.592441 0.031840 tcp 10.0.2.105 60853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:41.624527 0.032729 tcp 10.0.2.105 60854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:41.657538 0.123576 tcp 10.0.2.105 60855 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:41.791085 4.800285 tcp 10.0.2.105 60856 -> 46.48.223.67 15494 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:46.010663 0.031570 tcp 10.0.2.105 60857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:46.042495 0.032062 tcp 10.0.2.105 60858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:46.074872 0.122799 tcp 10.0.2.105 60859 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:33:46.591605 3.001074 tcp 10.0.2.105 60860 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:33:55.591208 0.000000 tcp 10.0.2.105 60860 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:34:01.589966 1.715990 tcp 10.0.2.105 60861 -> 46.48.223.67 15494 FSPA* 0 0 14 1590 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:38:51.481034 2.999904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:38:58.486966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:39:03.303843 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:39:03.303928 3.004385 tcp 10.0.2.105 60862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:39:06.488738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:39:12.311461 0.000000 tcp 10.0.2.105 60862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:39:18.306992 0.031619 tcp 10.0.2.105 60863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:18.338879 0.032488 tcp 10.0.2.105 60864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:18.371658 0.124396 tcp 10.0.2.105 60865 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:18.573734 0.360610 tcp 10.0.2.105 60866 -> 46.48.223.67 15494 SPA_* 0 0 9 1031 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:22.491239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:39:27.598509 0.203184 tcp 10.0.2.105 60866 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:27.599403 0.031563 tcp 10.0.2.105 60867 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:27.631283 0.032892 tcp 10.0.2.105 60868 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:27.664629 0.126764 tcp 10.0.2.105 60869 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:27.801927 2.972570 tcp 10.0.2.105 60870 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:39:36.714350 0.000000 tcp 10.0.2.105 60870 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:39:42.653296 4.136856 tcp 10.0.2.105 60871 -> 46.48.223.67 15494 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:39:54.674531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:45:58.516352 2.998681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 20:46:05.521124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:46:13.522167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:46:29.525334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:47:01.531126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:47:39.305895 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:47:39.306104 0.118510 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2585 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:39.383006 0.171897 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:39.501206 0.000000 udp 10.0.2.105 7010 -> 79.227.180.34 2430 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 20:47:46.566766 1.974097 tcp 10.0.2.105 60872 -> 46.48.223.67 15494 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:48.333092 0.032387 tcp 10.0.2.105 60873 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:48.365754 0.031387 tcp 10.0.2.105 60874 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:48.397415 0.125331 tcp 10.0.2.105 60875 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:48.541093 4.043483 tcp 10.0.2.105 60876 -> 46.48.223.67 15494 FSPA* 0 0 14 1748 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:56.400557 0.031029 tcp 10.0.2.105 60877 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:56.431880 0.032990 tcp 10.0.2.105 60878 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:56.465142 0.202355 tcp 10.0.2.105 60879 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:47:56.668086 0.092806 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:56.740857 0.091967 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:56.795674 0.067668 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:56.845460 0.061420 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:56.904122 0.071657 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:56.971774 0.132133 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.057845 0.108225 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.146401 0.380453 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2684 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.495214 0.060161 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.553182 0.163345 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.670774 0.164239 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:57.830167 0.335840 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:58.166944 0.358699 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:58.527048 0.205501 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:58.733932 0.291355 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:59.016058 0.236024 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:59.229342 0.250242 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:59.436658 0.184617 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:59.631086 0.228587 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:47:59.869565 0.198263 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:00.068310 0.290564 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:00.349877 0.219259 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:00.564818 0.217829 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:00.748116 0.233824 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2120 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:00.975116 0.371068 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:01.351976 0.191930 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:48:01.536570 0.889736 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/20 20:52:52.576425 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:52:52.576600 3.003560 tcp 10.0.2.105 60880 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:53:01.578647 0.000000 tcp 10.0.2.105 60880 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:53:05.537179 3.002149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 20:53:07.579640 0.032932 tcp 10.0.2.105 60881 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:07.612864 0.031707 tcp 10.0.2.105 60882 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:07.644899 0.128988 tcp 10.0.2.105 60883 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:07.795373 4.486630 tcp 10.0.2.105 60884 -> 46.48.223.67 15494 FSPA* 0 0 15 1764 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:11.740547 0.032189 tcp 10.0.2.105 60885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:11.773071 0.032610 tcp 10.0.2.105 60886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:11.805953 0.120434 tcp 10.0.2.105 60887 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:11.936763 3.001429 tcp 10.0.2.105 60888 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:53:12.544607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:53:20.546253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:53:20.936755 0.000000 tcp 10.0.2.105 60888 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:53:26.938211 3.886139 tcp 10.0.2.105 60889 -> 46.48.223.67 15494 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:53:36.548960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:54:08.555162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 20:58:30.822536 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 20:58:30.822781 2.993704 tcp 10.0.2.105 60890 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:58:39.814479 0.000000 tcp 10.0.2.105 60890 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:58:45.825232 0.032636 tcp 10.0.2.105 60891 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:45.858184 0.033266 tcp 10.0.2.105 60892 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:45.891829 0.127400 tcp 10.0.2.105 60893 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:46.028571 4.143680 tcp 10.0.2.105 60894 -> 46.48.223.67 15494 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:49.975299 0.032775 tcp 10.0.2.105 60895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:50.007910 0.032624 tcp 10.0.2.105 60896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:50.040376 0.122225 tcp 10.0.2.105 60897 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 20:58:50.172455 2.991971 tcp 10.0.2.105 60898 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:58:59.173173 0.000000 tcp 10.0.2.105 60898 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 20:59:05.171730 1.767373 tcp 10.0.2.105 60899 -> 46.48.223.67 15494 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:00:12.570816 2.993926 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:00:19.569123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:00:27.569912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:00:43.573206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:01:15.579270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:04:06.935881 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:04:06.935976 3.003742 tcp 10.0.2.105 60900 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:04:15.938716 0.000000 tcp 10.0.2.105 60900 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:04:21.938626 0.033278 tcp 10.0.2.105 60901 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:21.972122 0.032455 tcp 10.0.2.105 60902 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:22.004820 0.128444 tcp 10.0.2.105 60903 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:22.143692 4.353452 tcp 10.0.2.105 60904 -> 46.48.223.67 15494 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:26.295698 0.032300 tcp 10.0.2.105 60905 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:26.328263 0.032124 tcp 10.0.2.105 60906 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:26.360690 0.124819 tcp 10.0.2.105 60907 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:04:26.497363 3.000623 tcp 10.0.2.105 60908 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:04:35.496748 0.000000 tcp 10.0.2.105 60908 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:04:41.495649 2.034031 tcp 10.0.2.105 60909 -> 46.48.223.67 15494 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:07:19.585540 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:07:26.592819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:07:34.594012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:07:50.597305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:08:22.603259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:09:43.520064 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:09:43.520398 2.993419 tcp 10.0.2.105 60910 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:09:52.522235 0.000000 tcp 10.0.2.105 60910 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:09:58.522721 0.032069 tcp 10.0.2.105 60911 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:09:58.555098 0.032193 tcp 10.0.2.105 60912 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:09:58.587597 0.125008 tcp 10.0.2.105 60913 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:09:58.722698 2.928359 tcp 10.0.2.105 60914 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:10:01.451057 0.031251 tcp 10.0.2.105 60915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:10:01.482583 0.031718 tcp 10.0.2.105 60916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:10:01.514560 0.123803 tcp 10.0.2.105 60917 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:10:01.651294 2.998625 tcp 10.0.2.105 60918 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:10:10.649556 0.000000 tcp 10.0.2.105 60918 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:10:16.647278 2.018924 tcp 10.0.2.105 60919 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:14:26.609838 3.000882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:14:33.617137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:14:41.617880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:14:57.620796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:15:29.627165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:18:27.253284 0.000146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:18:27.253525 0.000000 udp 10.0.2.105 7010 -> 79.227.180.34 2430 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 21:18:45.230265 0.031773 tcp 10.0.2.105 60920 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:18:45.262314 0.032758 tcp 10.0.2.105 60921 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:18:45.295384 0.123509 tcp 10.0.2.105 60922 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:18:45.419539 0.179603 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:45.598145 0.281681 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:45.870114 0.205359 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2004 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:46.073046 0.372273 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 1998 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:46.441701 0.231761 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:46.665233 0.197992 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:46.826270 0.192638 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.010285 0.492147 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.482466 0.112167 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.559541 0.180622 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.685386 0.095761 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.762427 0.056229 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.815595 0.084052 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:47.925501 0.142720 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.022628 0.106007 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.109924 0.097921 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.167846 0.062427 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.218836 0.174327 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.341117 0.158344 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.496680 0.342701 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.683192 3.004769 tcp 10.0.2.105 60923 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:18:48.858335 0.061941 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:48.918739 0.356748 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2550 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:49.245211 0.368554 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:49.615102 0.163505 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:49.770241 0.236683 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:49.985470 0.205420 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:50.200403 0.192773 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:50.411998 0.231820 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:50.777002 0.251843 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:18:57.685866 0.000000 tcp 10.0.2.105 60923 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:19:03.685052 0.033641 tcp 10.0.2.105 60924 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:03.718966 0.032828 tcp 10.0.2.105 60925 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:03.752056 0.122166 tcp 10.0.2.105 60926 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:03.890262 0.387100 tcp 10.0.2.105 60927 -> 46.48.223.67 15494 SPA_* 0 0 9 1093 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:08.922653 0.284045 tcp 10.0.2.105 60927 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:08.923430 0.033040 tcp 10.0.2.105 60928 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:08.956734 0.032332 tcp 10.0.2.105 60929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:08.989343 0.206830 tcp 10.0.2.105 60930 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:19:09.206931 3.000194 tcp 10.0.2.105 60931 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:19:18.212590 0.000000 tcp 10.0.2.105 60931 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:19:24.209357 4.976241 tcp 10.0.2.105 60932 -> 46.48.223.67 15494 FSPA* 0 0 14 1623 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:21:33.633198 3.001566 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:21:40.640315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:21:48.642005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:22:04.645201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:22:36.651156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:24:29.183611 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:24:29.183784 3.003344 tcp 10.0.2.105 60933 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:24:38.185753 0.000000 tcp 10.0.2.105 60933 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:24:44.186126 0.032613 tcp 10.0.2.105 60934 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:44.219051 0.032768 tcp 10.0.2.105 60935 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:44.252109 0.122134 tcp 10.0.2.105 60936 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:44.384390 4.866379 tcp 10.0.2.105 60937 -> 46.48.223.67 15494 SPA_* 0 0 12 1485 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:49.251226 0.032437 tcp 10.0.2.105 60938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:49.283933 0.032056 tcp 10.0.2.105 60939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:49.316326 0.144443 tcp 10.0.2.105 60940 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:49.470743 0.000102 tcp 10.0.2.105 60937 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:24:49.471069 2.995164 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:24:58.464876 0.000000 tcp 10.0.2.105 60941 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:25:04.463633 4.871274 tcp 10.0.2.105 60942 -> 46.48.223.67 15494 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:28:40.657393 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:28:47.664580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:28:55.666306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:29:11.669038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:29:43.675103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:30:09.332417 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:30:09.332627 2.993948 tcp 10.0.2.105 60943 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:30:18.324852 0.000000 tcp 10.0.2.105 60943 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:30:24.335023 0.032078 tcp 10.0.2.105 60944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:24.367345 0.033470 tcp 10.0.2.105 60945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:24.401174 0.126896 tcp 10.0.2.105 60946 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:24.539882 4.847199 tcp 10.0.2.105 60947 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:29.108180 0.086479 tcp 10.0.2.105 60948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:29.194945 0.041548 tcp 10.0.2.105 60949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:29.236765 0.127726 tcp 10.0.2.105 60950 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:30:29.387393 2.997635 tcp 10.0.2.105 60951 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:30:38.383522 0.000000 tcp 10.0.2.105 60951 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:30:44.382529 4.518039 tcp 10.0.2.105 60952 -> 46.48.223.67 15494 FSPA* 0 0 14 1754 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:35:47.681537 3.000955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:35:48.891057 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:35:48.891163 2.992618 tcp 10.0.2.105 60953 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:35:54.688585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:35:57.893185 0.000000 tcp 10.0.2.105 60953 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:36:02.689691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:36:03.892944 0.033042 tcp 10.0.2.105 60954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:03.926216 0.032591 tcp 10.0.2.105 60955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:03.959153 0.132326 tcp 10.0.2.105 60956 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:04.107494 0.381200 tcp 10.0.2.105 60957 -> 46.48.223.67 15494 SPA_* 0 0 9 1194 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:15.736438 0.207400 tcp 10.0.2.105 60957 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:15.737202 0.031594 tcp 10.0.2.105 60958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:15.769125 0.033864 tcp 10.0.2.105 60959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:15.803234 0.123103 tcp 10.0.2.105 60960 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:15.944071 3.009034 tcp 10.0.2.105 60961 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:36:18.692705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:36:24.961919 0.000000 tcp 10.0.2.105 60961 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:36:30.940933 0.388108 tcp 10.0.2.105 60962 -> 46.48.223.67 15494 SPA_* 0 0 9 1194 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:36:50.699081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:37:01.324429 0.380107 tcp 10.0.2.105 60962 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:42:54.705599 3.000948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 21:43:01.712288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:43:09.713357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:43:25.717492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:43:57.722828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:48:54.249948 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:48:54.250050 0.201548 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:54.462040 0.179580 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:54.640757 0.289734 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:54.921378 0.261804 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:55.145617 0.192704 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:55.335821 0.347964 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:55.680220 0.230647 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:55.903684 0.419893 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.301661 0.112898 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.375856 0.171226 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.498316 0.094739 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.576249 0.056494 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.629632 0.079328 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.718816 0.142363 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.817031 0.109289 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.904590 0.085914 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:56.952443 0.064612 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:57.007748 0.341840 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:57.369517 0.060792 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:57.428275 0.341837 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:57.743732 0.169918 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:57.853721 0.157381 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:58.007838 0.355669 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:58.386210 0.161793 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 1942 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:58.541596 0.233320 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:58.755280 0.191490 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:58.977704 0.259756 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:59.193949 0.186803 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:48:59.355740 0.222362 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/20 21:49:01.369931 2.993858 tcp 10.0.2.105 60963 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:49:10.372496 0.000000 tcp 10.0.2.105 60963 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:49:16.375230 0.031997 tcp 10.0.2.105 60964 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:16.407522 0.032928 tcp 10.0.2.105 60965 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:16.440733 0.129011 tcp 10.0.2.105 60966 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:16.581007 1.351161 tcp 10.0.2.105 60967 -> 46.48.223.67 15494 SPA_* 0 0 9 1025 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:21.874735 0.214784 tcp 10.0.2.105 60967 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:21.875535 0.032248 tcp 10.0.2.105 60968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:21.908087 0.032940 tcp 10.0.2.105 60969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:21.941306 0.130814 tcp 10.0.2.105 60970 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:49:22.089791 2.994375 tcp 10.0.2.105 60971 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:49:31.091927 0.000000 tcp 10.0.2.105 60971 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:49:37.091032 4.272199 tcp 10.0.2.105 60972 -> 46.48.223.67 15494 FSPA* 0 0 14 1555 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:54:41.358613 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 21:54:41.358699 3.003925 tcp 10.0.2.105 60973 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:54:50.361034 0.000000 tcp 10.0.2.105 60973 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:54:56.361853 0.032608 tcp 10.0.2.105 60974 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:54:56.394706 0.032481 tcp 10.0.2.105 60975 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:54:56.427495 0.127201 tcp 10.0.2.105 60976 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:54:56.570685 4.501464 tcp 10.0.2.105 60977 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:55:00.859224 0.031941 tcp 10.0.2.105 60978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:55:00.891446 0.033402 tcp 10.0.2.105 60979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:55:00.925165 0.128321 tcp 10.0.2.105 60980 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:55:01.072518 3.000411 tcp 10.0.2.105 60981 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:55:10.069549 0.000000 tcp 10.0.2.105 60981 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 21:55:16.069580 1.709559 tcp 10.0.2.105 60982 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/20 21:55:36.730953 3.001085 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 21:55:43.740677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:55:51.739644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:56:07.742590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 21:56:39.748752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:00:17.773113 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:00:17.773216 2.993047 tcp 10.0.2.105 60983 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:00:26.764927 0.000000 tcp 10.0.2.105 60983 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:00:32.775463 0.032845 tcp 10.0.2.105 60984 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:32.808620 0.032965 tcp 10.0.2.105 60985 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:32.841885 0.126103 tcp 10.0.2.105 60986 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:32.985573 1.964521 tcp 10.0.2.105 60987 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:34.744185 0.032878 tcp 10.0.2.105 60988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:34.777383 0.035410 tcp 10.0.2.105 60989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:34.813088 0.127731 tcp 10.0.2.105 60990 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:00:34.950264 3.000908 tcp 10.0.2.105 60991 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:00:43.949641 0.000000 tcp 10.0.2.105 60991 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:00:49.948645 4.114735 tcp 10.0.2.105 60992 -> 46.48.223.67 15494 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:02:43.757582 2.998539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:02:50.762015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:02:58.763433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:03:14.778584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:03:46.772669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:05:54.059658 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:05:54.059886 2.999732 tcp 10.0.2.105 60993 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:06:03.058426 0.000000 tcp 10.0.2.105 60993 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:06:09.058623 0.032254 tcp 10.0.2.105 60994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:09.091108 0.032907 tcp 10.0.2.105 60995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:09.124453 0.129739 tcp 10.0.2.105 60996 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:09.275159 1.653137 tcp 10.0.2.105 60997 -> 46.48.223.67 15494 FSPA* 0 0 13 1337 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:10.715982 0.032156 tcp 10.0.2.105 60998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:10.748513 0.036627 tcp 10.0.2.105 60999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:10.785442 0.133536 tcp 10.0.2.105 61000 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:06:10.928591 2.995084 tcp 10.0.2.105 61001 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:06:19.933153 0.000000 tcp 10.0.2.105 61001 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:06:25.921306 4.084291 tcp 10.0.2.105 61002 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:10:14.783476 3.002856 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:10:21.790730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:10:29.792042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:10:45.795023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:11:17.801229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:17:21.807205 3.009744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 22:17:28.814225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:17:36.818833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:17:52.818768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:18:24.825067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:19:19.744597 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:19:19.744690 0.286171 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:20.020569 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 22:19:30.049315 4.625522 tcp 10.0.2.105 61003 -> 46.48.223.67 15494 FSPA* 0 0 14 1769 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:34.112403 0.033167 tcp 10.0.2.105 61004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:34.145862 0.032369 tcp 10.0.2.105 61005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:34.178484 0.134345 tcp 10.0.2.105 61006 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:34.675065 1.347758 tcp 10.0.2.105 61007 -> 46.48.223.67 15494 SPA_* 0 0 9 1239 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:38.691563 0.031610 tcp 10.0.2.105 61008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:38.723454 0.032997 tcp 10.0.2.105 61009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:38.756708 0.130917 tcp 10.0.2.105 61010 -> 195.113.214.249 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:38.888167 0.175391 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:39.062269 0.287799 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:39.314591 0.192161 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:39.499214 0.349951 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:39.845605 0.111629 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:39.916671 0.230587 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:40.140587 0.504200 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:40.625417 0.235222 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:40.764675 0.100521 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:40.844017 0.062122 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:40.902835 0.110428 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.037047 0.135031 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.122534 0.112223 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.214015 0.087559 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.263615 0.062726 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.308434 0.352627 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.468747 0.000307 tcp 10.0.2.105 61007 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:19:41.632172 0.338699 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:41.986016 0.063149 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:42.047599 0.362910 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:42.411861 0.203464 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:42.553280 0.157256 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:42.708124 0.161778 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:42.863967 0.234045 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:43.077857 0.193018 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:43.272302 0.228476 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:43.462871 0.252984 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:19:43.675667 0.190599 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:24:28.830688 3.002166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 22:24:35.838778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:24:41.467239 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:24:41.467401 3.003507 tcp 10.0.2.105 61011 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:24:43.839945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:24:50.469518 0.000000 tcp 10.0.2.105 61011 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:24:56.470932 0.032184 tcp 10.0.2.105 61012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:24:56.503379 0.033207 tcp 10.0.2.105 61013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:24:56.536848 0.128014 tcp 10.0.2.105 61014 -> 195.113.214.249 443 SRPA* 0 0 25 13312 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:24:56.681037 0.373899 tcp 10.0.2.105 61015 -> 46.48.223.67 15494 SPA_* 0 0 9 1088 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:24:59.843052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:25:01.826877 0.226177 tcp 10.0.2.105 61015 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:01.827760 0.031598 tcp 10.0.2.105 61016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:01.859659 0.035225 tcp 10.0.2.105 61017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:01.895175 0.136980 tcp 10.0.2.105 61018 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:02.053308 3.006715 tcp 10.0.2.105 61019 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:25:11.058923 0.000000 tcp 10.0.2.105 61019 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:25:17.048443 0.369360 tcp 10.0.2.105 61020 -> 46.48.223.67 15494 SPA_* 0 0 9 1088 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:22.210368 0.000363 tcp 10.0.2.105 61020 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:25:31.848846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:30:22.206803 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:30:22.207029 3.003767 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:30:31.209529 0.000000 tcp 10.0.2.105 61021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:30:37.215234 0.032691 tcp 10.0.2.105 61022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:37.248258 0.034233 tcp 10.0.2.105 61023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:37.282840 0.128806 tcp 10.0.2.105 61024 -> 195.113.214.249 443 SRPA* 0 0 47 25956 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:37.423251 4.993158 tcp 10.0.2.105 61025 -> 46.48.223.67 15494 SPA_* 0 0 10 1324 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:42.417153 0.032537 tcp 10.0.2.105 61026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:42.449987 0.031962 tcp 10.0.2.105 61027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:42.482259 0.134176 tcp 10.0.2.105 61028 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:42.625747 0.000066 tcp 10.0.2.105 61025 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:30:42.626058 3.001678 tcp 10.0.2.105 61029 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:30:51.619089 0.000000 tcp 10.0.2.105 61029 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:30:57.617402 4.751640 tcp 10.0.2.105 61030 -> 46.48.223.67 15494 FSPA* 0 0 14 1540 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:31:35.856673 2.999821 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:31:42.862661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:31:50.863849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:32:06.866525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:32:38.877291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:36:02.365641 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:36:02.365809 3.004732 tcp 10.0.2.105 61031 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:36:11.368551 0.000000 tcp 10.0.2.105 61031 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:36:17.368919 0.032237 tcp 10.0.2.105 61032 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:17.401394 0.035146 tcp 10.0.2.105 61033 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:17.436847 0.132530 tcp 10.0.2.105 61034 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:17.583315 4.822821 tcp 10.0.2.105 61035 -> 46.48.223.67 15494 SPA_* 0 0 12 1455 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:22.406685 0.031884 tcp 10.0.2.105 61036 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:22.438927 0.033911 tcp 10.0.2.105 61037 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:22.473197 0.131657 tcp 10.0.2.105 61038 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:22.618034 0.000067 tcp 10.0.2.105 61035 -> 46.48.223.67 15494 FA_A 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:36:22.618337 3.000505 tcp 10.0.2.105 61039 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:36:31.620649 0.000000 tcp 10.0.2.105 61039 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:36:37.616246 4.737893 tcp 10.0.2.105 61040 -> 46.48.223.67 15494 FSPA* 0 0 14 1563 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:38:42.881057 2.999513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:38:49.886655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:38:57.887729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:39:13.890789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:39:45.897826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:41:42.354715 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:41:42.354826 3.004225 tcp 10.0.2.105 61041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:41:51.358988 0.000000 tcp 10.0.2.105 61041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:41:57.357377 0.033762 tcp 10.0.2.105 61042 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:41:57.391367 0.033516 tcp 10.0.2.105 61043 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:41:57.425158 0.132584 tcp 10.0.2.105 61044 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:41:57.574433 4.730109 tcp 10.0.2.105 61045 -> 46.48.223.67 15494 FSPA* 0 0 13 1548 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:42:02.084951 0.032530 tcp 10.0.2.105 61046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:42:02.117760 0.035580 tcp 10.0.2.105 61047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:42:02.153626 0.135652 tcp 10.0.2.105 61048 -> 195.113.214.249 443 SRPA* 0 0 33 18134 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:42:02.304745 3.002491 tcp 10.0.2.105 61049 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:42:02.653670 0.000160 tcp 10.0.2.105 61045 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:42:11.305795 0.000000 tcp 10.0.2.105 61049 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:42:17.304729 4.414844 tcp 10.0.2.105 61050 -> 46.48.223.67 15494 FSPA* 0 0 14 1602 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:45:49.902093 3.002515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:45:56.910022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:46:04.912732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:46:20.914576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:46:52.920225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:49:50.496335 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:49:50.496556 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 22:50:07.853251 0.032469 tcp 10.0.2.105 61051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:07.885940 0.032804 tcp 10.0.2.105 61052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:07.919049 0.133975 tcp 10.0.2.105 61053 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:08.053511 0.299446 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:08.344020 0.179041 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:08.521880 0.371448 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2015 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:08.890171 0.108648 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:08.959184 0.232356 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:09.184784 0.283007 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:09.431042 0.191746 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:09.615998 0.862910 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:10.457274 0.256361 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:10.665167 0.099343 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:10.745881 0.056665 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:10.799429 0.072146 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:10.966883 0.230327 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.152607 0.128447 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.259085 0.082625 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.305756 0.337953 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.654618 0.061388 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2601 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.714195 0.068564 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:11.764028 0.737922 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:12.475887 0.357414 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:12.844073 0.215477 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:12.982024 0.167148 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:13.144614 0.163664 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:13.299646 0.234299 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:13.513450 0.377184 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:13.849331 0.184332 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:14.016377 0.205202 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:14.238299 0.228644 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/20 22:50:21.731329 2.993815 tcp 10.0.2.105 61054 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:50:30.723898 0.000000 tcp 10.0.2.105 61054 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:50:35.270268 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:50:36.733032 0.031614 tcp 10.0.2.105 61055 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:36.764955 0.034078 tcp 10.0.2.105 61056 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:36.799273 0.129705 tcp 10.0.2.105 61057 -> 195.113.214.249 443 SRPA* 0 0 23 11874 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:36.938480 0.341325 tcp 10.0.2.105 61058 -> 46.48.223.67 15494 SPA_* 0 0 9 1018 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:45.160635 0.213816 tcp 10.0.2.105 61058 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:45.161358 0.031659 tcp 10.0.2.105 61059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:45.193245 0.035553 tcp 10.0.2.105 61060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:45.229112 0.128236 tcp 10.0.2.105 61061 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:50:45.374659 3.004738 tcp 10.0.2.105 61062 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:50:54.378119 0.000000 tcp 10.0.2.105 61062 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:51:00.367076 4.347846 tcp 10.0.2.105 61063 -> 46.48.223.67 15494 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:04.714393 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 22:56:04.714549 3.004366 tcp 10.0.2.105 61064 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:56:13.717172 0.000000 tcp 10.0.2.105 61064 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:56:19.717085 0.031736 tcp 10.0.2.105 61065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:19.749061 0.032613 tcp 10.0.2.105 61066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:19.781980 0.125955 tcp 10.0.2.105 61067 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:19.957539 4.491740 tcp 10.0.2.105 61068 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:24.233111 0.035797 tcp 10.0.2.105 61069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:24.269270 0.033843 tcp 10.0.2.105 61070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:24.303421 0.135860 tcp 10.0.2.105 61071 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:56:24.449487 2.997575 tcp 10.0.2.105 61072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:56:33.445587 0.000000 tcp 10.0.2.105 61072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 22:56:39.444563 4.248964 tcp 10.0.2.105 61073 -> 46.48.223.67 15494 FSPA* 0 0 14 1656 flow=From-Botnet-V2-TCP-Established 1970/02/20 22:57:04.933386 3.001892 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 22:57:11.940578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:57:19.941899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:57:35.945142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 22:58:08.021687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:01:43.762007 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:01:43.762232 2.993673 tcp 10.0.2.105 61074 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:01:52.754449 0.000000 tcp 10.0.2.105 61074 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:01:58.765102 0.033126 tcp 10.0.2.105 61075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:01:58.798549 0.034954 tcp 10.0.2.105 61076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:01:58.833820 0.137833 tcp 10.0.2.105 61077 -> 195.113.214.249 443 SRPA* 0 0 21 12356 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:01:58.986342 4.404231 tcp 10.0.2.105 61078 -> 46.48.223.67 15494 FSPA* 0 0 14 1766 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:02:03.169531 0.031228 tcp 10.0.2.105 61079 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:02:03.201039 0.036011 tcp 10.0.2.105 61080 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:02:03.237345 0.143637 tcp 10.0.2.105 61081 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:02:03.390798 2.993215 tcp 10.0.2.105 61082 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:02:12.398033 0.000000 tcp 10.0.2.105 61082 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:02:18.391782 4.155318 tcp 10.0.2.105 61083 -> 46.48.223.67 15494 FSPA* 0 0 12 1658 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:02:25.427853 0.000179 tcp 10.0.2.105 61083 -> 46.48.223.67 15494 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:04:12.027734 3.001303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:04:19.038622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:04:27.036510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:04:43.039409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:05:15.045070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:07:22.549254 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:07:22.549461 3.003797 tcp 10.0.2.105 61084 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:07:31.561739 0.000000 tcp 10.0.2.105 61084 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:07:37.555535 0.032562 tcp 10.0.2.105 61085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:37.588608 0.034386 tcp 10.0.2.105 61086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:37.623299 0.131307 tcp 10.0.2.105 61087 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:37.765266 4.306255 tcp 10.0.2.105 61088 -> 46.48.223.67 15494 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:41.871632 0.032829 tcp 10.0.2.105 61089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:41.904743 0.032577 tcp 10.0.2.105 61090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:41.937618 0.124190 tcp 10.0.2.105 61091 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:07:42.071762 2.999585 tcp 10.0.2.105 61092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:07:51.070018 0.000000 tcp 10.0.2.105 61092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:07:57.068859 0.342788 tcp 10.0.2.105 61093 -> 46.48.223.67 15494 SPA_* 0 0 9 1132 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:08:14.673587 0.000520 tcp 10.0.2.105 61093 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:11:19.051665 3.001742 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:11:26.063484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:11:34.060721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:11:50.063287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:12:22.069600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:18:26.083259 2.993690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 23:18:33.088614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:18:41.098121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:18:57.087652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:19:29.093275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:20:21.208583 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:20:21.208771 0.349297 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:21.553678 0.283656 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:21.828267 0.177663 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.004470 0.191003 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.159796 0.112495 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.235273 0.230869 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.458726 0.191838 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.642918 0.100371 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.722015 0.056354 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.775101 0.097118 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:22.881866 0.631182 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.491383 0.197167 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.619916 0.127197 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.703548 0.124678 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1933 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.812578 0.091158 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.866575 0.070427 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:23.918767 0.350553 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:24.278489 0.063950 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:24.340525 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 23:20:29.700810 2.993599 tcp 10.0.2.105 61094 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:20:38.698507 0.000000 tcp 10.0.2.105 61094 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:20:41.810869 0.034872 tcp 10.0.2.105 61095 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:41.846010 0.032423 tcp 10.0.2.105 61096 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:41.878739 0.250863 tcp 10.0.2.105 61097 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:42.130172 0.382318 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:42.680152 0.211881 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:43.444885 0.160860 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2110 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:43.602291 0.218241 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:43.811974 0.236053 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:44.026322 0.193197 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:44.219553 0.289471 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:44.469205 0.186947 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:44.702430 0.033437 tcp 10.0.2.105 61098 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:44.736139 0.031955 tcp 10.0.2.105 61099 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:44.768376 0.127386 tcp 10.0.2.105 61100 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:45.162798 4.380850 tcp 10.0.2.105 61101 -> 46.48.223.67 15494 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:45.203962 0.230045 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:20:49.298512 0.033187 tcp 10.0.2.105 61102 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:49.331975 0.032137 tcp 10.0.2.105 61103 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:49.364493 0.129599 tcp 10.0.2.105 61104 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:20:49.543899 2.999585 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:20:58.551979 0.000000 tcp 10.0.2.105 61105 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:21:04.541071 4.139478 tcp 10.0.2.105 61106 -> 46.48.223.67 15494 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:25:33.099423 3.001625 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:25:40.107089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:25:48.113274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:26:04.112100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:26:08.681336 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:26:08.681449 3.009825 tcp 10.0.2.105 61107 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:26:17.680994 0.000000 tcp 10.0.2.105 61107 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:26:23.681614 0.032176 tcp 10.0.2.105 61108 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:23.714052 0.033397 tcp 10.0.2.105 61109 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:23.747814 0.139351 tcp 10.0.2.105 61110 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:23.904534 4.297892 tcp 10.0.2.105 61111 -> 46.48.223.67 15494 FSPA* 0 0 14 1539 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:27.990246 0.032826 tcp 10.0.2.105 61112 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:28.023361 0.034265 tcp 10.0.2.105 61113 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:28.057881 0.134862 tcp 10.0.2.105 61114 -> 195.113.214.249 443 SRPA* 0 0 26 14160 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:28.202663 3.001883 tcp 10.0.2.105 61115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:26:36.117374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:26:37.203833 0.000000 tcp 10.0.2.105 61115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:26:43.202667 0.365994 tcp 10.0.2.105 61116 -> 46.48.223.67 15494 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:26:49.492852 0.360362 tcp 10.0.2.105 61116 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:31:49.488381 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:31:49.488471 3.003538 tcp 10.0.2.105 61117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:31:58.491190 0.000000 tcp 10.0.2.105 61117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:32:04.491037 0.032355 tcp 10.0.2.105 61118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:04.523678 0.032935 tcp 10.0.2.105 61119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:04.556930 0.125527 tcp 10.0.2.105 61120 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:04.698485 2.062515 tcp 10.0.2.105 61121 -> 46.48.223.67 15494 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:06.435639 0.033092 tcp 10.0.2.105 61122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:06.469021 0.033740 tcp 10.0.2.105 61123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:06.502974 0.132974 tcp 10.0.2.105 61124 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:06.761267 2.995922 tcp 10.0.2.105 61125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:32:15.755566 0.000000 tcp 10.0.2.105 61125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:32:21.754196 0.349840 tcp 10.0.2.105 61126 -> 46.48.223.67 15494 SPA_* 0 0 9 1148 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:27.351502 0.000421 tcp 10.0.2.105 61126 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:32:40.125011 2.999991 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:32:47.130462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:32:55.132695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:33:11.135198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:33:43.141287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:37:27.346397 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:37:27.346513 3.001681 tcp 10.0.2.105 61127 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:37:36.349225 0.000000 tcp 10.0.2.105 61127 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:37:42.346730 0.033889 tcp 10.0.2.105 61128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:42.380902 0.031914 tcp 10.0.2.105 61129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:42.413097 0.129014 tcp 10.0.2.105 61130 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:42.618448 0.352131 tcp 10.0.2.105 61131 -> 46.48.223.67 15494 SPA_* 0 0 9 1001 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:48.052605 3.638074 tcp 10.0.2.105 61131 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:48.053449 0.033532 tcp 10.0.2.105 61132 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:48.087261 0.034971 tcp 10.0.2.105 61133 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:48.122579 0.136604 tcp 10.0.2.105 61134 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:37:48.268746 2.999175 tcp 10.0.2.105 61135 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:37:57.269478 0.000000 tcp 10.0.2.105 61135 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:38:03.271739 1.879848 tcp 10.0.2.105 61136 -> 46.48.223.67 15494 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:39:47.147002 3.001901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:39:54.154828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:40:02.157596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:40:18.159331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:40:50.165557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:46:54.171223 3.004160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/20 23:47:01.178741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:47:09.180100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:47:25.183191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:47:57.189237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:51:13.541966 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:51:13.542129 0.714059 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:14.226576 0.288054 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:14.513535 0.182815 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:14.695182 0.196560 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:14.856444 0.104743 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:14.979022 0.352088 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.326930 0.103004 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.409295 0.061398 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.468060 0.232594 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.693933 0.085894 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.767120 0.193921 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:15.950902 0.775834 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2030 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:16.706852 0.119009 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:16.806309 0.084024 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:16.869889 0.062699 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:16.913694 0.339481 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:17.254460 0.133151 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:17.341646 0.172899 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:17.461927 0.062911 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:17.538683 0.365063 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:17.913140 0.142178 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:18.005238 0.244619 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:18.242072 0.164380 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:18.414662 0.233741 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:18.627854 0.191123 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:18.820539 0.249456 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:19.030736 0.188823 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/20 23:51:19.249030 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/20 23:51:20.201781 2.993604 tcp 10.0.2.105 61137 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:51:29.194008 0.000000 tcp 10.0.2.105 61137 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:51:35.204325 0.035600 tcp 10.0.2.105 61138 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:35.240259 0.034998 tcp 10.0.2.105 61139 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:35.275510 0.129648 tcp 10.0.2.105 61140 -> 195.113.214.249 443 SRPA* 0 0 24 14052 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:35.416259 1.976492 tcp 10.0.2.105 61141 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:36.464784 0.032950 tcp 10.0.2.105 61142 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:36.498024 0.034403 tcp 10.0.2.105 61143 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:36.532694 0.125465 tcp 10.0.2.105 61144 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:37.156449 0.031636 tcp 10.0.2.105 61145 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:37.188394 0.036676 tcp 10.0.2.105 61146 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:37.225356 0.128692 tcp 10.0.2.105 61147 -> 195.113.214.249 443 SRPA* 0 0 48 43546 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:51:37.393049 2.997172 tcp 10.0.2.105 61148 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:51:46.389465 0.000000 tcp 10.0.2.105 61148 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:51:52.387805 1.725100 tcp 10.0.2.105 61149 -> 46.48.223.67 15494 FSPA* 0 0 14 1686 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:54:01.195787 3.000914 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/20 23:54:08.202606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:54:16.203930 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:54:32.207164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:55:04.215434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/20 23:56:54.111735 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/20 23:56:54.111848 2.993952 tcp 10.0.2.105 61150 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:57:03.104175 0.000000 tcp 10.0.2.105 61150 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:57:09.114873 0.034186 tcp 10.0.2.105 61151 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:09.149301 0.033381 tcp 10.0.2.105 61152 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:09.183002 0.130161 tcp 10.0.2.105 61153 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:09.326362 1.344955 tcp 10.0.2.105 61154 -> 46.48.223.67 15494 SPA_* 0 0 9 1164 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:15.251074 0.205626 tcp 10.0.2.105 61154 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:15.252052 0.032280 tcp 10.0.2.105 61155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:15.284610 0.035525 tcp 10.0.2.105 61156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:15.320415 0.127158 tcp 10.0.2.105 61157 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/20 23:57:15.456906 2.999342 tcp 10.0.2.105 61158 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:57:24.455195 0.000000 tcp 10.0.2.105 61158 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/20 23:57:30.456061 4.871991 tcp 10.0.2.105 61159 -> 46.48.223.67 15494 FSPA* 0 0 14 1694 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:01:08.222352 2.998487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:01:15.229070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:01:23.228609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:01:39.231327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:02:11.237184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:02:35.322445 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:02:35.322652 2.993359 tcp 10.0.2.105 61160 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:02:44.314714 0.000000 tcp 10.0.2.105 61160 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:02:50.324891 0.032168 tcp 10.0.2.105 61161 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:50.357277 0.036466 tcp 10.0.2.105 61162 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:50.394059 0.146075 tcp 10.0.2.105 61163 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:50.554572 0.349066 tcp 10.0.2.105 61164 -> 46.48.223.67 15494 SPA_* 0 0 9 1035 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:57.329931 0.208969 tcp 10.0.2.105 61164 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:57.330715 0.034376 tcp 10.0.2.105 61165 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:57.365366 0.035907 tcp 10.0.2.105 61166 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:57.401625 0.127070 tcp 10.0.2.105 61167 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:02:57.539152 2.998815 tcp 10.0.2.105 61168 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:03:06.536884 0.000000 tcp 10.0.2.105 61168 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:03:12.535913 0.349401 tcp 10.0.2.105 61169 -> 46.48.223.67 15494 SPA_* 0 0 9 1035 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:03:19.017113 0.000364 tcp 10.0.2.105 61169 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:15.244367 3.000428 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:08:19.015883 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:08:19.015966 3.003974 tcp 10.0.2.105 61170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:08:22.250670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:08:28.019103 0.000000 tcp 10.0.2.105 61170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:08:30.252022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:08:34.019123 0.031628 tcp 10.0.2.105 61171 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:34.051038 0.034211 tcp 10.0.2.105 61172 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:34.085531 0.133143 tcp 10.0.2.105 61173 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:34.228726 0.364309 tcp 10.0.2.105 61174 -> 46.48.223.67 15494 SPA_* 0 0 9 1112 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:40.760373 0.215118 tcp 10.0.2.105 61174 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:40.761130 0.039308 tcp 10.0.2.105 61175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:40.800758 0.033197 tcp 10.0.2.105 61176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:40.833831 0.130732 tcp 10.0.2.105 61177 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:08:40.975774 3.005960 tcp 10.0.2.105 61178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:08:46.255161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:08:49.980520 0.000000 tcp 10.0.2.105 61178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:08:55.969693 0.355554 tcp 10.0.2.105 61179 -> 46.48.223.67 15494 SPA_* 0 0 9 1112 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:09:03.503471 0.000367 tcp 10.0.2.105 61179 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:09:18.261019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:15:22.267148 3.001850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 00:15:29.279134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:15:37.276017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:15:53.279236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:16:25.285141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:21:48.700597 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:21:48.700744 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 00:22:07.127572 0.033124 tcp 10.0.2.105 61180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:07.160931 0.034752 tcp 10.0.2.105 61181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:07.195968 0.130539 tcp 10.0.2.105 61182 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:07.327154 0.177891 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:07.518399 0.417326 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:07.899604 0.724849 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 3 834 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:08.617804 0.299186 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:08.907464 0.365834 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.268706 0.097116 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.347442 0.062185 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.464023 0.114448 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.538619 0.192115 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.723331 0.083350 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:09.820852 0.229998 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:10.042997 0.090117 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:10.095226 0.114166 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:10.188186 0.727311 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:10.895359 0.131034 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:10.978143 0.185663 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:11.113356 0.064191 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:11.175652 0.062051 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:11.218604 0.341856 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:11.561721 0.143311 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:11.672916 0.355639 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.029915 0.192863 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.224181 0.236207 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.440401 0.161499 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.595629 0.157550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.750364 0.272439 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:12.978939 0.189930 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:22:18.553377 3.004029 tcp 10.0.2.105 61183 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:22:27.555726 0.000000 tcp 10.0.2.105 61183 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:22:29.291109 3.001514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:22:32.342708 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:22:33.555200 0.031904 tcp 10.0.2.105 61184 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:33.587407 0.035985 tcp 10.0.2.105 61185 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:33.623667 0.131746 tcp 10.0.2.105 61186 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:33.774293 1.934330 tcp 10.0.2.105 61187 -> 46.48.223.67 15494 FSPA* 0 0 14 1688 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:35.500606 0.034905 tcp 10.0.2.105 61188 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:35.535957 0.034108 tcp 10.0.2.105 61189 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:35.570372 0.128524 tcp 10.0.2.105 61190 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:35.708887 3.003037 tcp 10.0.2.105 61191 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:22:36.298778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:22:44.299867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:22:44.710866 0.000000 tcp 10.0.2.105 61191 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:22:50.709675 0.391225 tcp 10.0.2.105 61192 -> 46.48.223.67 15494 SPA_* 0 0 9 1158 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:22:57.007228 0.000320 tcp 10.0.2.105 61192 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:23:00.302993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:23:32.309213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:27:57.000208 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:27:57.000415 2.993099 tcp 10.0.2.105 61193 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:28:06.002378 0.000000 tcp 10.0.2.105 61193 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:28:12.003126 0.037578 tcp 10.0.2.105 61194 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:12.040990 0.032840 tcp 10.0.2.105 61195 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:12.074105 0.138632 tcp 10.0.2.105 61196 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:12.228916 0.359388 tcp 10.0.2.105 61197 -> 46.48.223.67 15494 SPA_* 0 0 9 1086 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:18.318836 0.209081 tcp 10.0.2.105 61197 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:18.319616 0.032535 tcp 10.0.2.105 61198 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:18.352574 0.032610 tcp 10.0.2.105 61199 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:18.385468 0.131503 tcp 10.0.2.105 61200 -> 195.113.214.249 443 SRPA* 0 0 24 13352 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:18.528203 2.998474 tcp 10.0.2.105 61201 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:28:27.523541 0.000000 tcp 10.0.2.105 61201 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:28:33.522437 0.358943 tcp 10.0.2.105 61202 -> 46.48.223.67 15494 SPA_* 0 0 9 1086 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:28:39.376829 0.000629 tcp 10.0.2.105 61202 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:29:36.314853 3.001900 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:29:43.322742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:29:51.323802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:30:07.327268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:30:39.333225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:33:39.372287 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:33:39.372468 2.993469 tcp 10.0.2.105 61203 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:33:48.364660 0.000000 tcp 10.0.2.105 61203 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:33:54.374847 0.038307 tcp 10.0.2.105 61204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:33:54.413445 0.035028 tcp 10.0.2.105 61205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:33:54.448774 0.128766 tcp 10.0.2.105 61206 -> 195.113.214.249 443 SRPA* 0 0 38 21076 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:33:54.593975 0.360945 tcp 10.0.2.105 61207 -> 46.48.223.67 15494 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:00.274953 0.694883 tcp 10.0.2.105 61207 -> 46.48.223.67 15494 FA_F* 0 0 6 584 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:00.275670 0.031915 tcp 10.0.2.105 61208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:00.307971 0.100294 tcp 10.0.2.105 61209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:00.408568 0.153993 tcp 10.0.2.105 61210 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:00.613302 2.993365 tcp 10.0.2.105 61211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:34:09.605565 0.000000 tcp 10.0.2.105 61211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:34:15.616090 0.355280 tcp 10.0.2.105 61212 -> 46.48.223.67 15494 SPA_* 0 0 9 1081 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:34:28.486439 0.000343 tcp 10.0.2.105 61212 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:36:43.345518 3.005931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:36:50.346416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:36:58.347933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:37:14.359980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:37:46.357632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:39:28.483901 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:39:28.484009 3.005097 tcp 10.0.2.105 61213 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:39:37.489646 0.000000 tcp 10.0.2.105 61213 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:39:43.487526 0.057852 tcp 10.0.2.105 61214 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:43.545676 0.033499 tcp 10.0.2.105 61215 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:43.579463 0.130479 tcp 10.0.2.105 61216 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:43.719623 4.596087 tcp 10.0.2.105 61217 -> 46.48.223.67 15494 FSPA* 0 0 14 1629 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:48.085044 0.047532 tcp 10.0.2.105 61218 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:48.132864 0.032922 tcp 10.0.2.105 61219 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:48.166096 0.130730 tcp 10.0.2.105 61220 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:39:48.316009 3.000816 tcp 10.0.2.105 61221 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:39:57.315299 0.000000 tcp 10.0.2.105 61221 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:40:03.314021 0.358967 tcp 10.0.2.105 61222 -> 46.48.223.67 15494 SPA_* 0 0 7 991 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:40:08.507676 0.000639 tcp 10.0.2.105 61222 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:43:50.363421 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:43:57.370380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:44:05.371990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:44:21.374933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:44:53.383143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:52:34.222813 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:52:34.222969 0.178837 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:34.400409 0.219811 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:35.834120 0.374517 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:36.670507 0.779084 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:37.421897 0.284813 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:37.924907 0.101783 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:38.020427 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 00:52:38.550270 2.993734 tcp 10.0.2.105 61223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:52:47.553098 0.000000 tcp 10.0.2.105 61223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:52:53.552998 0.032688 tcp 10.0.2.105 61224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:53.586070 0.034339 tcp 10.0.2.105 61225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:53.620630 0.130843 tcp 10.0.2.105 61226 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:53.761617 0.360314 tcp 10.0.2.105 61227 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:54.392865 0.033128 tcp 10.0.2.105 61228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:54.426304 0.033413 tcp 10.0.2.105 61229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:54.460008 0.129736 tcp 10.0.2.105 61230 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:54.590370 0.115181 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:54.666768 0.192717 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:54.851023 0.073320 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:54.946139 0.232219 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:55.170958 0.090830 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:55.222478 0.097184 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:55.299761 0.837285 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:56.116560 0.140865 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:56.213607 0.165938 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:56.329428 0.062916 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:56.390841 0.667697 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:57.039599 0.355210 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:57.404326 0.192775 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:57.598620 0.343029 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:57.942875 0.157101 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.033300 0.234399 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.247008 0.186809 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.424860 0.166246 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.588573 0.275815 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.817397 0.189948 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2573 flow=From-Botnet-V2-UDP-Established 1970/02/21 00:52:58.905348 0.350497 tcp 10.0.2.105 61227 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:58.906189 0.034178 tcp 10.0.2.105 61231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:58.940718 0.034279 tcp 10.0.2.105 61232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:58.975386 0.140368 tcp 10.0.2.105 61233 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:52:59.256090 2.997598 tcp 10.0.2.105 61234 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:53:08.262297 0.000000 tcp 10.0.2.105 61234 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:53:14.251271 0.345457 tcp 10.0.2.105 61235 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:53:25.773381 0.000993 tcp 10.0.2.105 61235 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:56:07.393609 3.003257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 00:56:14.400036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:56:22.401563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:56:38.406954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:57:10.411717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 00:58:25.779345 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 00:58:25.779456 3.003622 tcp 10.0.2.105 61236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:58:34.791860 0.000000 tcp 10.0.2.105 61236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:58:40.782332 0.038275 tcp 10.0.2.105 61237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:40.820958 0.032592 tcp 10.0.2.105 61238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:40.853902 0.199618 tcp 10.0.2.105 61239 -> 195.113.214.249 443 SRPA* 0 0 67 41118 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:41.073757 0.374612 tcp 10.0.2.105 61240 -> 46.48.223.67 15494 SPA_* 0 0 9 1104 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:48.188488 0.210952 tcp 10.0.2.105 61240 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:48.189290 0.031540 tcp 10.0.2.105 61241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:48.221142 0.033389 tcp 10.0.2.105 61242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:48.254830 0.127983 tcp 10.0.2.105 61243 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:58:48.399715 2.995963 tcp 10.0.2.105 61244 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:58:57.394407 0.000000 tcp 10.0.2.105 61244 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 00:59:03.393307 0.375959 tcp 10.0.2.105 61245 -> 46.48.223.67 15494 SPA_* 0 0 9 1104 flow=From-Botnet-V2-TCP-Established 1970/02/21 00:59:10.255830 0.000420 tcp 10.0.2.105 61245 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:03:14.427190 3.001010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:03:21.433888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:03:29.435425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:03:45.438582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:04:10.255343 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:04:10.255532 3.003459 tcp 10.0.2.105 61246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:04:17.444419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:04:19.257373 0.000000 tcp 10.0.2.105 61246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:04:25.258290 0.093972 tcp 10.0.2.105 61247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:25.352560 0.032814 tcp 10.0.2.105 61248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:25.385669 0.144809 tcp 10.0.2.105 61249 -> 195.113.214.249 443 SRPA* 0 0 47 40178 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:25.542261 2.852987 tcp 10.0.2.105 61250 -> 46.48.223.67 15494 FSPA* 0 0 14 1730 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:28.186232 0.031577 tcp 10.0.2.105 61251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:28.218091 0.033573 tcp 10.0.2.105 61252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:28.251959 0.127222 tcp 10.0.2.105 61253 -> 195.113.214.249 443 SRPA* 0 0 29 15746 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:28.395505 2.999068 tcp 10.0.2.105 61254 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:04:37.393056 0.000000 tcp 10.0.2.105 61254 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:04:43.392141 0.355452 tcp 10.0.2.105 61255 -> 46.48.223.67 15494 SPA_* 0 0 9 1200 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:04:49.694247 0.000358 tcp 10.0.2.105 61255 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:09:49.692728 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:09:49.692912 2.993553 tcp 10.0.2.105 61256 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:09:58.684731 0.000000 tcp 10.0.2.105 61256 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:10:04.695328 0.041617 tcp 10.0.2.105 61257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:04.737235 0.032885 tcp 10.0.2.105 61258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:04.770386 0.127833 tcp 10.0.2.105 61259 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:04.910001 1.345384 tcp 10.0.2.105 61260 -> 46.48.223.67 15494 SPA_* 0 0 9 1031 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:20.772288 0.242504 tcp 10.0.2.105 61260 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:20.773195 0.053678 tcp 10.0.2.105 61261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:20.827215 0.033868 tcp 10.0.2.105 61262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:20.861359 0.132472 tcp 10.0.2.105 61263 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:21.015094 3.006591 tcp 10.0.2.105 61264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:10:30.020363 0.000000 tcp 10.0.2.105 61264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:10:34.462734 2.998468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:10:36.011511 0.354687 tcp 10.0.2.105 61265 -> 46.48.223.67 15494 SPA_* 0 0 9 1031 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:41.466749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:10:46.166808 0.000391 tcp 10.0.2.105 61265 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:10:49.468433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:11:05.471358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:11:37.477217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:17:41.483166 3.002102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 01:17:48.491081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:17:56.492276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:18:12.495417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:18:44.501266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:23:26.447286 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:23:26.447453 0.055830 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 1964 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:26.500871 0.178590 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:26.679756 0.217354 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:26.861698 0.350031 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:27.206546 0.095804 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:27.283462 0.284006 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:27.559656 0.557077 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.087906 0.115366 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2579 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.161700 0.228920 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.383437 0.101125 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.443985 0.121306 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.543884 0.193574 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.728636 0.072650 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:28.854912 0.590658 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:29.424559 0.133292 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:29.512037 0.199974 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:29.631625 0.063206 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2068 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:29.823269 0.064415 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:29.913993 0.356330 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:30.315744 0.195113 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:30.466876 0.192815 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:30.669139 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 01:23:31.213904 3.007775 tcp 10.0.2.105 61266 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:23:40.216712 0.000000 tcp 10.0.2.105 61266 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:23:46.217180 0.031832 tcp 10.0.2.105 61267 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.249277 0.032551 tcp 10.0.2.105 61268 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.282202 0.132110 tcp 10.0.2.105 61269 -> 195.113.214.249 443 SRPA* 0 0 41 22826 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.433196 0.363766 tcp 10.0.2.105 61270 -> 46.48.223.67 15494 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.505600 0.037143 tcp 10.0.2.105 61271 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.543025 0.032329 tcp 10.0.2.105 61272 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.575638 0.131923 tcp 10.0.2.105 61273 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:46.708106 0.233321 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:46.920795 0.162065 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:47.076543 0.168169 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:47.236719 0.303224 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:47.497712 0.184696 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:23:55.408090 0.260936 tcp 10.0.2.105 61270 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:55.409000 0.035197 tcp 10.0.2.105 61274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:55.444635 0.031874 tcp 10.0.2.105 61275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:55.476784 0.174771 tcp 10.0.2.105 61276 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:23:55.669280 3.003595 tcp 10.0.2.105 61277 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:24:04.694273 0.000000 tcp 10.0.2.105 61277 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:24:10.660856 0.359161 tcp 10.0.2.105 61278 -> 46.48.223.67 15494 SPA_* 0 0 9 1186 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:24:19.056635 0.000462 tcp 10.0.2.105 61278 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:24:48.507210 3.001799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:24:55.514875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:25:03.526226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:25:19.519926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:25:51.525613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:29:19.054087 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:29:19.054206 3.003532 tcp 10.0.2.105 61279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:29:28.056103 0.000000 tcp 10.0.2.105 61279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:29:34.058702 0.122129 tcp 10.0.2.105 61280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:34.181077 0.032333 tcp 10.0.2.105 61281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:34.213711 0.128250 tcp 10.0.2.105 61282 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:34.363386 0.358362 tcp 10.0.2.105 61283 -> 46.48.223.67 15494 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:42.506109 0.236690 tcp 10.0.2.105 61283 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:42.506975 0.031257 tcp 10.0.2.105 61284 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:42.538492 0.033922 tcp 10.0.2.105 61285 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:42.572734 0.134702 tcp 10.0.2.105 61286 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:29:42.743102 2.998901 tcp 10.0.2.105 61287 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:29:51.740390 0.000000 tcp 10.0.2.105 61287 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:29:57.739292 1.356623 tcp 10.0.2.105 61288 -> 46.48.223.67 15494 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:30:07.652329 0.000348 tcp 10.0.2.105 61288 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:31:55.532653 3.005831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:32:02.539690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:32:10.540649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:32:26.543313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:32:58.560913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:35:07.645210 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:35:07.645396 3.003865 tcp 10.0.2.105 61289 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:35:16.647767 0.000000 tcp 10.0.2.105 61289 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:35:22.648853 0.035895 tcp 10.0.2.105 61290 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:22.685021 0.034728 tcp 10.0.2.105 61291 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:22.720017 0.153528 tcp 10.0.2.105 61292 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:22.883578 0.350178 tcp 10.0.2.105 61293 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:36.039601 0.407979 tcp 10.0.2.105 61293 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:36.040677 0.032649 tcp 10.0.2.105 61294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:36.073636 0.033618 tcp 10.0.2.105 61295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:36.107545 0.157279 tcp 10.0.2.105 61296 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:36.447851 3.002788 tcp 10.0.2.105 61297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:35:45.449095 0.000000 tcp 10.0.2.105 61297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:35:51.449563 0.384168 tcp 10.0.2.105 61298 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:35:58.696660 0.000389 tcp 10.0.2.105 61298 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:39:02.555272 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:39:09.562897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:39:17.564077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:39:33.567256 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:40:05.579616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:40:58.689925 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:40:58.690037 2.993351 tcp 10.0.2.105 61299 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:41:07.692198 0.000000 tcp 10.0.2.105 61299 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:41:13.692867 0.035159 tcp 10.0.2.105 61300 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:13.728349 0.033946 tcp 10.0.2.105 61301 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:13.762570 0.176830 tcp 10.0.2.105 61302 -> 195.113.214.249 443 SRPA* 0 0 21 11766 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:13.958639 0.358212 tcp 10.0.2.105 61303 -> 46.48.223.67 15494 SPA_* 0 0 9 1057 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:20.731882 0.243532 tcp 10.0.2.105 61303 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:20.732634 0.031849 tcp 10.0.2.105 61304 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:20.764770 0.033270 tcp 10.0.2.105 61305 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:20.798265 0.147773 tcp 10.0.2.105 61306 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:41:20.975688 2.999913 tcp 10.0.2.105 61307 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:41:29.974504 0.000000 tcp 10.0.2.105 61307 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:41:35.973373 1.981165 tcp 10.0.2.105 61308 -> 46.48.223.67 15494 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:46:09.579378 3.001540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 01:46:16.586994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:46:24.587994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:46:40.590999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:47:12.596771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:53:16.603682 3.001389 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 01:53:23.613820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:53:31.618167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:53:47.616127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:54:07.814259 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:54:07.814367 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 01:54:19.623250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 01:54:23.218825 0.033088 tcp 10.0.2.105 61309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:23.252157 0.033581 tcp 10.0.2.105 61310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:23.286089 0.143808 tcp 10.0.2.105 61311 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:23.430633 0.179285 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:23.608152 0.258904 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:23.831017 0.372695 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:24.199679 0.103554 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:24.286297 0.060846 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:24.344341 0.291535 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:24.626737 0.769024 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:25.368649 0.112144 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:25.440932 0.086057 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:25.489653 0.231155 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:25.712834 0.193444 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:25.897902 0.090522 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:26.004311 0.158288 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:26.140995 0.059944 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:26.198845 0.062745 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:26.242754 0.357797 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:26.611520 0.775906 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:27.365175 0.127936 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:27.449323 0.211712 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:27.581860 0.272102 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:27.805043 0.192442 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2000 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:28.014669 0.164052 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:28.175307 0.236014 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:28.390125 0.168492 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:28.545430 0.257319 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:28.761813 0.188647 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/21 01:54:37.997658 3.004082 tcp 10.0.2.105 61312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:54:47.000285 0.000000 tcp 10.0.2.105 61312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:54:51.847253 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 01:54:52.999870 0.034540 tcp 10.0.2.105 61313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:53.034699 0.037259 tcp 10.0.2.105 61314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:53.072241 0.138073 tcp 10.0.2.105 61315 -> 195.113.214.249 443 SRPA* 0 0 43 24358 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:53.222419 2.222097 tcp 10.0.2.105 61316 -> 46.48.223.67 15494 FSPA* 0 0 14 1773 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:55.213273 0.032082 tcp 10.0.2.105 61317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:55.245633 0.037601 tcp 10.0.2.105 61318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:55.283546 0.137481 tcp 10.0.2.105 61319 -> 195.113.214.249 443 SRPA* 0 0 25 14866 flow=From-Botnet-V2-TCP-Established 1970/02/21 01:54:55.444785 3.002017 tcp 10.0.2.105 61320 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:55:04.445491 0.000000 tcp 10.0.2.105 61320 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 01:55:10.444094 2.236344 tcp 10.0.2.105 61321 -> 46.48.223.67 15494 FSPA* 0 0 14 1773 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:12.679286 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:00:12.679426 2.993428 tcp 10.0.2.105 61322 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:00:21.681956 0.000000 tcp 10.0.2.105 61322 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:00:23.627970 3.001307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:00:27.681966 0.033508 tcp 10.0.2.105 61323 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:27.715885 0.034599 tcp 10.0.2.105 61324 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:27.750784 0.182159 tcp 10.0.2.105 61325 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:27.944475 1.950494 tcp 10.0.2.105 61326 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:29.669550 0.032805 tcp 10.0.2.105 61327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:29.702625 0.033670 tcp 10.0.2.105 61328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:29.736608 0.149590 tcp 10.0.2.105 61329 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:29.895182 3.002384 tcp 10.0.2.105 61330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:00:30.634641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:00:38.636037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:00:38.895916 0.000000 tcp 10.0.2.105 61330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:00:44.894859 2.058300 tcp 10.0.2.105 61331 -> 46.48.223.67 15494 FSPA* 0 0 14 1646 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:00:54.638872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:01:26.645294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:05:46.949659 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:05:46.949877 2.993357 tcp 10.0.2.105 61332 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:05:55.952140 0.000000 tcp 10.0.2.105 61332 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:06:01.952832 0.032166 tcp 10.0.2.105 61333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:01.985272 0.033609 tcp 10.0.2.105 61334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:02.019181 0.129241 tcp 10.0.2.105 61335 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:02.182328 2.011679 tcp 10.0.2.105 61336 -> 46.48.223.67 15494 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:03.979826 0.031267 tcp 10.0.2.105 61337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:04.011460 0.032447 tcp 10.0.2.105 61338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:04.044192 0.139084 tcp 10.0.2.105 61339 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:04.194233 3.004177 tcp 10.0.2.105 61340 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:06:13.199973 0.000000 tcp 10.0.2.105 61340 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:06:19.196117 0.349804 tcp 10.0.2.105 61341 -> 46.48.223.67 15494 SPA_* 0 0 9 1121 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:06:32.893310 0.350086 tcp 10.0.2.105 61341 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:07:30.651166 3.001601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:07:37.658566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:07:45.660202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:08:01.663396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:08:33.669319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:11:32.887282 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:11:32.887422 3.003535 tcp 10.0.2.105 61342 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:11:41.889775 0.000000 tcp 10.0.2.105 61342 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:11:47.891076 0.032600 tcp 10.0.2.105 61343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:47.923994 0.033358 tcp 10.0.2.105 61344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:47.957705 0.129097 tcp 10.0.2.105 61345 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:48.103921 2.154039 tcp 10.0.2.105 61346 -> 46.48.223.67 15494 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:49.890694 0.032199 tcp 10.0.2.105 61347 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:49.923137 0.038514 tcp 10.0.2.105 61348 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:49.961937 0.284644 tcp 10.0.2.105 61349 -> 195.113.214.249 443 SRPA* 0 0 40 21312 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:11:50.258196 2.997848 tcp 10.0.2.105 61350 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:11:59.254735 0.000000 tcp 10.0.2.105 61350 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:12:05.253350 1.743483 tcp 10.0.2.105 61351 -> 46.48.223.67 15494 FSPA* 0 0 14 1571 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:14:37.674687 3.002385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:14:44.682632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:14:52.683766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:15:08.686866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:15:40.692688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:21:44.698903 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 02:21:51.706125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:21:59.707835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:22:15.711394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:22:47.717317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:24:48.430902 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:24:48.431054 0.201337 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:48.644419 0.191332 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:48.799866 0.058449 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:48.853132 0.371736 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:49.221329 0.100486 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:49.302345 0.295354 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:49.590884 0.087808 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:49.641151 0.232400 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:49.866181 0.193825 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:50.051586 0.379161 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:50.403684 0.116214 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:50.481379 0.076238 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:24:50.572980 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 02:24:52.046100 3.003740 tcp 10.0.2.105 61352 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:25:01.048792 0.000000 tcp 10.0.2.105 61352 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:25:06.959299 0.038124 tcp 10.0.2.105 61353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:06.997792 0.034581 tcp 10.0.2.105 61354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.032618 0.140468 tcp 10.0.2.105 61355 -> 195.113.214.249 443 SRPA* 0 0 25 14108 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.047825 0.086150 tcp 10.0.2.105 61356 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.134274 0.035663 tcp 10.0.2.105 61357 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.170238 0.178497 tcp 10.0.2.105 61358 -> 195.113.214.249 443 SRPA* 0 0 41 22030 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.173583 0.059047 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:07.234269 0.067839 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:07.285247 0.355606 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:07.358983 2.042893 tcp 10.0.2.105 61359 -> 46.48.223.67 15494 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:07.645579 0.209229 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:07.771249 0.179168 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:07.920911 0.817289 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:08.716872 0.131319 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:08.801834 0.191243 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:09.020601 0.159890 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:09.177858 0.233697 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:09.191491 0.033651 tcp 10.0.2.105 61360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:09.225454 0.033336 tcp 10.0.2.105 61361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:09.259049 0.132770 tcp 10.0.2.105 61362 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:09.393033 0.162509 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:09.402081 2.992958 tcp 10.0.2.105 61363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:25:09.547059 0.254120 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:09.759021 0.187298 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:25:18.393463 0.000000 tcp 10.0.2.105 61363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:25:24.402455 0.361062 tcp 10.0.2.105 61364 -> 46.48.223.67 15494 SPA_* 0 0 9 1153 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:25:35.525385 0.000427 tcp 10.0.2.105 61364 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:28:51.723000 3.001628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:28:58.730298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:29:06.739792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:29:22.734804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:29:54.740883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:30:35.520462 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:30:35.520607 2.993044 tcp 10.0.2.105 61365 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:30:44.522536 0.000000 tcp 10.0.2.105 61365 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:30:50.523473 0.039016 tcp 10.0.2.105 61366 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:30:50.562731 0.034962 tcp 10.0.2.105 61367 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:30:50.597951 0.240729 tcp 10.0.2.105 61368 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:30:50.858486 0.367320 tcp 10.0.2.105 61369 -> 46.48.223.67 15494 SPA_* 0 0 9 1225 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:20.824794 0.300873 tcp 10.0.2.105 61369 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:20.825664 0.032146 tcp 10.0.2.105 61370 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:20.858069 0.035440 tcp 10.0.2.105 61371 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:20.893834 0.222187 tcp 10.0.2.105 61372 -> 195.113.214.249 443 SRPA* 0 0 24 11968 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:21.125913 3.007141 tcp 10.0.2.105 61373 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:31:30.131137 0.000000 tcp 10.0.2.105 61373 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:31:36.129001 0.373445 tcp 10.0.2.105 61374 -> 46.48.223.67 15494 SPA_* 0 0 9 1225 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:31:51.425862 0.000524 tcp 10.0.2.105 61374 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:35:58.747320 3.001414 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:36:05.753941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:36:13.755834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:36:29.758965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:36:51.420620 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:36:51.420811 3.012259 tcp 10.0.2.105 61375 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:37:00.435241 0.000000 tcp 10.0.2.105 61375 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:37:01.771665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:37:06.423289 0.032929 tcp 10.0.2.105 61376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:06.456496 0.033444 tcp 10.0.2.105 61377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:06.490220 0.133462 tcp 10.0.2.105 61378 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:06.648303 0.379557 tcp 10.0.2.105 61379 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:12.221975 0.225876 tcp 10.0.2.105 61379 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:12.222825 0.031686 tcp 10.0.2.105 61380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:12.254826 0.035078 tcp 10.0.2.105 61381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:12.290197 0.127960 tcp 10.0.2.105 61382 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:12.448051 2.986427 tcp 10.0.2.105 61383 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:37:21.433083 0.000000 tcp 10.0.2.105 61383 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:37:27.432162 0.377033 tcp 10.0.2.105 61384 -> 46.48.223.67 15494 SPA_* 0 0 9 1146 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:37:33.059888 0.000326 tcp 10.0.2.105 61384 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:33.061730 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:42:33.061869 2.993652 tcp 10.0.2.105 61385 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:42:42.053966 0.000000 tcp 10.0.2.105 61385 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:42:48.064677 0.032642 tcp 10.0.2.105 61386 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:48.097651 0.039027 tcp 10.0.2.105 61387 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:48.137005 0.135253 tcp 10.0.2.105 61388 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:48.283748 1.950509 tcp 10.0.2.105 61389 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:50.018519 0.039234 tcp 10.0.2.105 61390 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:50.058102 0.033194 tcp 10.0.2.105 61391 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:50.091087 0.133407 tcp 10.0.2.105 61392 -> 195.113.214.249 443 SRPA* 0 0 43 24396 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:42:50.234494 3.007074 tcp 10.0.2.105 61393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:42:59.239286 0.000000 tcp 10.0.2.105 61393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:43:05.227525 1.766565 tcp 10.0.2.105 61394 -> 46.48.223.67 15494 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:43:05.772011 3.000680 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:43:12.781821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:43:20.779695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:43:36.782117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:44:08.789089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:48:06.991626 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:48:06.991740 2.040395 tcp 10.0.2.105 61395 -> 46.48.223.67 15494 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:48:08.820550 0.035796 tcp 10.0.2.105 61396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:48:08.856676 0.033328 tcp 10.0.2.105 61397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:48:08.890274 0.131639 tcp 10.0.2.105 61398 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:48:09.032377 0.365198 tcp 10.0.2.105 61399 -> 46.48.223.67 15494 SPA_* 0 0 9 1193 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:48:16.706112 0.000330 tcp 10.0.2.105 61399 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:15.297404 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 02:55:15.297584 0.107650 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:15.385953 0.055607 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:15.438761 0.350445 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:15.785288 0.104826 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:15.873608 0.178614 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.071031 0.192387 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.228476 0.230713 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.451383 0.193502 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.636655 0.095936 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.694158 0.284724 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:16.719958 2.993421 tcp 10.0.2.105 61400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:55:16.969440 0.112647 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.045037 0.442002 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.456252 0.078972 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.537782 0.059640 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.595450 0.067870 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.646326 0.141191 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:17.747833 0.355599 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:18.108718 0.199979 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:18.233977 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 02:55:25.722080 0.000000 tcp 10.0.2.105 61400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:55:31.722270 0.032687 tcp 10.0.2.105 61401 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:31.755283 0.033574 tcp 10.0.2.105 61402 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:31.789094 0.142539 tcp 10.0.2.105 61403 -> 195.113.214.249 443 SRPA* 0 0 40 21352 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:31.956450 0.612635 tcp 10.0.2.105 61404 -> 46.48.223.67 15494 SPA_* 0 0 9 1087 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:35.076071 0.034387 tcp 10.0.2.105 61405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:35.110812 0.034146 tcp 10.0.2.105 61406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:35.144813 0.143220 tcp 10.0.2.105 61407 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:35.288587 0.128972 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:35.372535 0.205180 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:35.579102 0.163706 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:35.739550 0.261129 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:35.957879 0.188229 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:36.165503 0.234046 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:36.379137 0.165754 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/21 02:55:40.795526 3.002787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 02:55:47.803399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:55:49.671415 0.213453 tcp 10.0.2.105 61404 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:49.672386 0.031831 tcp 10.0.2.105 61408 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:49.704478 0.035686 tcp 10.0.2.105 61409 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:49.740509 0.131413 tcp 10.0.2.105 61410 -> 195.113.214.249 443 SRPA* 0 0 23 12538 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:55:49.885134 3.006165 tcp 10.0.2.105 61411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:55:55.805525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:55:58.889518 0.000000 tcp 10.0.2.105 61411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 02:56:04.881057 0.378609 tcp 10.0.2.105 61412 -> 46.48.223.67 15494 SPA_* 0 0 9 1087 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:56:11.811148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 02:56:35.251942 1.101722 tcp 10.0.2.105 61412 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 02:56:43.814192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:01:35.253941 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:01:35.254092 3.003707 tcp 10.0.2.105 61413 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:01:44.256871 0.000000 tcp 10.0.2.105 61413 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:01:50.256200 0.035038 tcp 10.0.2.105 61414 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:01:50.291539 0.041603 tcp 10.0.2.105 61415 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:01:50.333386 0.137430 tcp 10.0.2.105 61416 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:01:50.480752 0.381279 tcp 10.0.2.105 61417 -> 46.48.223.67 15494 SPA_* 0 0 9 1051 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:16.701105 0.244168 tcp 10.0.2.105 61417 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:16.701922 0.037594 tcp 10.0.2.105 61418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:16.739766 0.032926 tcp 10.0.2.105 61419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:16.772906 0.160728 tcp 10.0.2.105 61420 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:16.945504 3.002394 tcp 10.0.2.105 61421 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:02:25.946323 0.000000 tcp 10.0.2.105 61421 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:02:31.944416 1.727855 tcp 10.0.2.105 61422 -> 46.48.223.67 15494 SPA_* 0 0 9 1051 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:44.018172 0.000369 tcp 10.0.2.105 61422 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:02:47.820516 3.001655 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:02:54.827748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:03:02.829277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:03:18.832533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:03:50.838271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:07:44.013998 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:07:44.014167 3.003726 tcp 10.0.2.105 61423 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:07:53.015865 0.000000 tcp 10.0.2.105 61423 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:07:59.016992 0.033554 tcp 10.0.2.105 61424 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:07:59.050794 0.035672 tcp 10.0.2.105 61425 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:07:59.086723 0.132662 tcp 10.0.2.105 61426 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:07:59.238063 0.620064 tcp 10.0.2.105 61427 -> 46.48.223.67 15494 SPA_* 0 0 9 997 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:08:14.755781 0.218582 tcp 10.0.2.105 61427 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:08:14.756716 0.032312 tcp 10.0.2.105 61428 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:08:14.789314 0.032901 tcp 10.0.2.105 61429 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:08:14.822573 0.141035 tcp 10.0.2.105 61430 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:08:14.974603 3.007540 tcp 10.0.2.105 61431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:08:23.983563 0.000000 tcp 10.0.2.105 61431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:08:29.970163 0.391539 tcp 10.0.2.105 61432 -> 46.48.223.67 15494 SPA_* 0 0 9 997 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:09:00.363576 0.365672 tcp 10.0.2.105 61432 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:10:17.849042 3.000570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:10:24.854871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:10:32.862197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:10:48.859610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:11:20.865020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:14:00.365312 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:14:00.365486 3.003366 tcp 10.0.2.105 61433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:14:09.367559 0.000000 tcp 10.0.2.105 61433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:14:15.367966 0.032765 tcp 10.0.2.105 61434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:15.400999 0.033009 tcp 10.0.2.105 61435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:15.434284 0.133630 tcp 10.0.2.105 61436 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:15.579215 0.364674 tcp 10.0.2.105 61437 -> 46.48.223.67 15494 SPA_* 0 0 9 1200 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:23.246174 0.209102 tcp 10.0.2.105 61437 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:23.246914 0.034048 tcp 10.0.2.105 61438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:23.281279 0.032806 tcp 10.0.2.105 61439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:23.314380 0.130133 tcp 10.0.2.105 61440 -> 195.113.214.249 443 SRPA* 0 0 44 37134 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:14:23.455529 3.006713 tcp 10.0.2.105 61441 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:14:32.460778 0.000000 tcp 10.0.2.105 61441 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:14:38.449801 0.363098 tcp 10.0.2.105 61442 -> 46.48.223.67 15494 SPA_* 0 0 9 1200 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:15:08.812683 0.363204 tcp 10.0.2.105 61442 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:17:24.872533 3.000365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:17:31.878738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:17:39.880518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:17:55.883090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:18:27.889540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:24:31.912909 2.996256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 03:24:38.902675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:24:46.904333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:25:02.907456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:25:34.913353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:25:56.427203 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:25:56.427299 0.679208 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.085010 0.350729 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.431834 0.109197 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.520684 0.055608 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.573464 0.197534 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.736487 0.255702 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:57.984485 0.104424 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.068974 0.184199 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.243947 0.300418 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.534372 0.110526 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.605155 0.089418 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.660721 0.191876 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.844890 0.063133 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.906633 0.063801 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:58.949699 0.213725 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:59.123084 0.098132 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:59.237222 0.448598 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:59.660217 0.182818 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:25:59.786915 0.355421 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2022 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:00.144743 0.134926 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:00.232947 0.178996 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:00.422479 0.163033 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:00.582311 0.233862 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:00.795767 0.252121 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:01.007312 0.184198 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:01.209251 0.158563 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:26:08.852600 2.993686 tcp 10.0.2.105 61443 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:26:17.844996 0.000000 tcp 10.0.2.105 61443 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:26:22.852349 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:26:23.855596 0.035176 tcp 10.0.2.105 61444 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:23.891080 0.035857 tcp 10.0.2.105 61445 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:23.927218 0.131537 tcp 10.0.2.105 61446 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:24.068827 0.363462 tcp 10.0.2.105 61447 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:54.429413 0.035920 tcp 10.0.2.105 61448 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:54.465855 0.036523 tcp 10.0.2.105 61449 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:54.502686 0.133828 tcp 10.0.2.105 61450 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:54.646780 0.368874 tcp 10.0.2.105 61447 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:26:54.647076 3.005397 tcp 10.0.2.105 61451 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:27:03.650757 0.000000 tcp 10.0.2.105 61451 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:27:09.641214 1.770833 tcp 10.0.2.105 61452 -> 46.48.223.67 15494 FSPA* 0 0 14 1696 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:31:38.919613 3.001669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:31:45.926213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:31:53.928549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:32:09.930855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:32:11.403874 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:32:11.403979 3.003717 tcp 10.0.2.105 61453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:32:20.409523 0.000000 tcp 10.0.2.105 61453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:32:26.409844 0.033912 tcp 10.0.2.105 61454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:26.444048 0.047003 tcp 10.0.2.105 61455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:26.491456 0.137449 tcp 10.0.2.105 61456 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:27.043392 0.362205 tcp 10.0.2.105 61457 -> 46.48.223.67 15494 SPA_* 0 0 9 1029 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:41.937254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:32:50.344062 0.270923 tcp 10.0.2.105 61457 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:50.345255 0.031695 tcp 10.0.2.105 61458 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:50.377219 0.034249 tcp 10.0.2.105 61459 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:50.411776 0.162918 tcp 10.0.2.105 61460 -> 195.113.214.249 443 SRPA* 0 0 43 37080 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:32:50.615286 2.998556 tcp 10.0.2.105 61461 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:32:59.632184 0.000000 tcp 10.0.2.105 61461 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:33:05.611363 0.362145 tcp 10.0.2.105 61462 -> 46.48.223.67 15494 SPA_* 0 0 9 1029 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:33:27.729790 0.000380 tcp 10.0.2.105 61462 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:27.724932 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:38:27.725019 3.003912 tcp 10.0.2.105 61463 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:38:36.727267 0.000000 tcp 10.0.2.105 61463 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:38:42.727985 0.033658 tcp 10.0.2.105 61464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:42.761954 0.032519 tcp 10.0.2.105 61465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:42.794789 0.136176 tcp 10.0.2.105 61466 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:43.358140 0.352335 tcp 10.0.2.105 61467 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:45.945650 2.999257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:38:52.950767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:38:54.909713 0.259283 tcp 10.0.2.105 61467 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:54.910565 0.031820 tcp 10.0.2.105 61468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:54.942761 0.033058 tcp 10.0.2.105 61469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:54.976093 0.154848 tcp 10.0.2.105 61470 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:38:55.169198 2.998994 tcp 10.0.2.105 61471 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:39:00.952458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:39:04.166787 0.000000 tcp 10.0.2.105 61471 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:39:10.165403 0.364808 tcp 10.0.2.105 61472 -> 46.48.223.67 15494 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:39:16.955081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:39:36.502093 0.000298 tcp 10.0.2.105 61472 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:39:48.961318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:44:36.495200 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:44:36.495501 3.003299 tcp 10.0.2.105 61473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:44:45.497345 0.000000 tcp 10.0.2.105 61473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:44:51.497993 0.033054 tcp 10.0.2.105 61474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:44:51.531413 0.033465 tcp 10.0.2.105 61475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:44:51.565231 0.128719 tcp 10.0.2.105 61476 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:44:52.061339 0.362937 tcp 10.0.2.105 61477 -> 46.48.223.67 15494 SPA_* 0 0 9 1106 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:02.810328 0.256144 tcp 10.0.2.105 61477 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:02.811173 0.032346 tcp 10.0.2.105 61478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:02.843382 0.034673 tcp 10.0.2.105 61479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:02.878381 0.130198 tcp 10.0.2.105 61480 -> 195.113.214.249 443 SRPA* 0 0 27 11876 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:03.066737 3.000379 tcp 10.0.2.105 61481 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:45:12.065898 0.000000 tcp 10.0.2.105 61481 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 03:45:18.064393 0.377104 tcp 10.0.2.105 61482 -> 46.48.223.67 15494 SPA_* 0 0 9 1106 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:39.773228 0.383115 tcp 10.0.2.105 61482 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:45:52.966294 3.002660 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 03:45:59.974796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:46:07.976182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:46:23.979120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:46:55.985034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:56:30.691795 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 03:56:30.691995 0.893444 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:31.563977 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 03:56:39.804364 0.353818 tcp 10.0.2.105 61483 -> 46.48.223.67 15494 SPA_* 0 0 9 1036 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:47.417717 0.041540 tcp 10.0.2.105 61484 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:47.459553 0.033199 tcp 10.0.2.105 61485 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:47.493111 0.145262 tcp 10.0.2.105 61486 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:47.639115 0.211781 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:47.815634 0.230186 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:48.037631 0.098894 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:48.117634 0.179048 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:48.304982 0.369971 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:56:48.671649 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 112 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 03:56:49.861058 0.220655 tcp 10.0.2.105 61483 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:49.861708 0.033225 tcp 10.0.2.105 61487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:49.895222 0.032902 tcp 10.0.2.105 61488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:49.928504 0.134432 tcp 10.0.2.105 61489 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:56:50.081983 0.353602 tcp 10.0.2.105 61490 -> 46.48.223.67 15494 SPA_* 0 0 9 1036 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:57:04.994633 3.000487 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 03:57:06.543511 0.032327 tcp 10.0.2.105 61491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:57:06.576090 0.033974 tcp 10.0.2.105 61492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:57:06.610348 0.129378 tcp 10.0.2.105 61493 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:57:06.740233 0.286151 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.017104 0.117092 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.095316 0.089598 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.149001 0.193594 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.334112 0.062848 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.394592 0.064024 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.439779 0.150539 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.569056 0.076462 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:07.657883 0.355465 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:08.046940 0.133107 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:08.133150 0.494071 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:08.596757 0.178560 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:08.718899 0.191045 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:08.930314 0.162157 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:09.089606 0.234892 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:09.305444 0.259827 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:09.522142 0.196056 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:09.730741 0.160267 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/21 03:57:12.000845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:57:14.733087 0.000361 tcp 10.0.2.105 61490 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 03:57:20.002580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:57:36.008142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 03:58:08.011344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:02:14.726127 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:02:14.726231 3.004388 tcp 10.0.2.105 61494 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:02:23.729068 0.000000 tcp 10.0.2.105 61494 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:02:29.729654 0.037232 tcp 10.0.2.105 61495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:29.767199 0.032396 tcp 10.0.2.105 61496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:29.799869 0.149966 tcp 10.0.2.105 61497 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:29.959938 0.359655 tcp 10.0.2.105 61498 -> 46.48.223.67 15494 SPA_* 0 0 9 1037 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:45.045043 0.237300 tcp 10.0.2.105 61498 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:45.045970 0.032990 tcp 10.0.2.105 61499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:45.078874 0.033833 tcp 10.0.2.105 61500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:45.113068 0.130623 tcp 10.0.2.105 61501 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:02:45.282585 2.991450 tcp 10.0.2.105 61502 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:02:54.283113 0.000000 tcp 10.0.2.105 61502 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:03:00.281672 0.360656 tcp 10.0.2.105 61503 -> 46.48.223.67 15494 SPA_* 0 0 9 1037 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:03:16.048653 0.000328 tcp 10.0.2.105 61503 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:04:12.018202 3.000847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:04:19.024976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:04:27.026289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:04:43.029520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:05:15.036893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:08:16.045705 0.000245 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:08:16.046058 3.003857 tcp 10.0.2.105 61504 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:08:25.048770 0.000000 tcp 10.0.2.105 61504 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:08:31.050922 0.035142 tcp 10.0.2.105 61505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:31.086404 0.032716 tcp 10.0.2.105 61506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:31.119466 0.134609 tcp 10.0.2.105 61507 -> 195.113.214.249 443 SRPA* 0 0 42 22086 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:31.548206 0.363570 tcp 10.0.2.105 61508 -> 46.48.223.67 15494 SPA_* 0 0 9 1226 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:40.659525 0.309086 tcp 10.0.2.105 61508 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:40.660714 0.039309 tcp 10.0.2.105 61509 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:40.699782 0.033482 tcp 10.0.2.105 61510 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:40.733006 0.137233 tcp 10.0.2.105 61511 -> 195.113.214.249 443 SRPA* 0 0 27 10624 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:08:40.968996 2.996517 tcp 10.0.2.105 61512 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:08:49.966652 0.000000 tcp 10.0.2.105 61512 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:08:55.964860 0.356309 tcp 10.0.2.105 61513 -> 46.48.223.67 15494 SPA_* 0 0 9 1226 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:09:05.192668 0.000380 tcp 10.0.2.105 61513 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:11:19.050709 2.991965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:11:26.048932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:11:34.057982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:11:50.054238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:12:22.064086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:14:05.193101 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:14:05.193221 3.001320 tcp 10.0.2.105 61514 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:14:14.196060 0.000000 tcp 10.0.2.105 61514 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:14:20.194377 0.049700 tcp 10.0.2.105 61515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:20.244472 0.033913 tcp 10.0.2.105 61516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:20.278669 0.130667 tcp 10.0.2.105 61517 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:20.421810 0.357385 tcp 10.0.2.105 61518 -> 46.48.223.67 15494 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:34.796827 0.213101 tcp 10.0.2.105 61518 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:34.797795 0.031881 tcp 10.0.2.105 61519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:34.829997 0.032115 tcp 10.0.2.105 61520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:34.862423 0.138743 tcp 10.0.2.105 61521 -> 195.113.214.249 443 SRPA* 0 0 58 37890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:14:35.010253 2.994780 tcp 10.0.2.105 61522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:14:44.006844 0.000000 tcp 10.0.2.105 61522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:14:50.004034 0.368383 tcp 10.0.2.105 61523 -> 46.48.223.67 15494 SPA_* 0 0 9 1084 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:15:05.129143 0.000508 tcp 10.0.2.105 61523 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:18:26.065595 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:18:33.073004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:18:41.075156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:18:57.077348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:19:29.084032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:20:05.115681 0.000198 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:20:05.115975 3.003304 tcp 10.0.2.105 61524 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:20:14.118121 0.000000 tcp 10.0.2.105 61524 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:20:20.119041 0.032926 tcp 10.0.2.105 61525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:20.152480 0.034116 tcp 10.0.2.105 61526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:20.186960 0.139472 tcp 10.0.2.105 61527 -> 195.113.214.249 443 SRPA* 0 0 54 37674 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:20.344639 0.371168 tcp 10.0.2.105 61528 -> 46.48.223.67 15494 SPA_* 0 0 9 1182 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:46.099428 0.259303 tcp 10.0.2.105 61528 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:46.100288 0.034947 tcp 10.0.2.105 61529 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:46.135075 0.044280 tcp 10.0.2.105 61530 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:46.179684 0.147148 tcp 10.0.2.105 61531 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:20:46.359006 2.999795 tcp 10.0.2.105 61532 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:20:55.358620 0.000000 tcp 10.0.2.105 61532 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:21:01.355961 1.760749 tcp 10.0.2.105 61533 -> 46.48.223.67 15494 FSPA* 0 0 14 1712 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:25:33.090555 3.000411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:25:40.096396 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:25:48.098217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:26:04.101334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:26:36.107135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:27:29.854979 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:27:29.855072 0.107829 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:29.942809 0.061086 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:30.000992 0.633753 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:30.594394 0.178320 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:30.771430 0.232513 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:30.996161 0.190366 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:31.153004 0.105721 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:31.248398 0.353824 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:31.597965 0.285418 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:31.874465 0.119320 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:31.951421 0.094503 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:32.007447 0.193011 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:32.397999 0.063603 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:32.951587 0.069984 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:33.134275 3.000619 tcp 10.0.2.105 61534 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:27:33.232916 0.142625 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:33.336492 0.071402 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:33.457713 0.355755 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:33.813255 0.136756 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:33.901414 0.178945 udp 10.0.2.105 7010 <-> 207.62.238.200 8980 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:34.090045 0.443065 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:34.506035 0.213275 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:34.741918 0.187569 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:34.926734 0.232595 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:35.140386 0.256523 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:35.356510 0.189061 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:35.556709 0.164564 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:27:42.142095 0.000000 tcp 10.0.2.105 61534 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:27:48.132459 0.033174 tcp 10.0.2.105 61535 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:27:48.165927 0.035052 tcp 10.0.2.105 61536 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:27:48.201289 0.247640 tcp 10.0.2.105 61537 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:27:48.470708 0.355110 tcp 10.0.2.105 61538 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:28:01.752379 0.236094 tcp 10.0.2.105 61538 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:28:01.753159 0.033505 tcp 10.0.2.105 61539 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:28:01.786914 0.038070 tcp 10.0.2.105 61540 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:28:01.825205 0.138988 tcp 10.0.2.105 61541 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:28:01.988813 2.996912 tcp 10.0.2.105 61542 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:28:10.983636 0.000000 tcp 10.0.2.105 61542 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:28:16.987166 1.827865 tcp 10.0.2.105 61543 -> 46.48.223.67 15494 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:32:40.113486 3.001531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:32:47.120906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:32:55.122001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:33:11.129542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:33:18.805993 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:33:18.806135 3.004896 tcp 10.0.2.105 61544 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:33:27.809070 0.000000 tcp 10.0.2.105 61544 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:33:33.811746 0.033593 tcp 10.0.2.105 61545 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:33.845603 0.032585 tcp 10.0.2.105 61546 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:33.878587 0.131754 tcp 10.0.2.105 61547 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:34.021012 0.365335 tcp 10.0.2.105 61548 -> 46.48.223.67 15494 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:40.943032 0.214695 tcp 10.0.2.105 61548 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:40.943781 0.031696 tcp 10.0.2.105 61549 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:40.975787 0.035055 tcp 10.0.2.105 61550 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:41.011218 0.134921 tcp 10.0.2.105 61551 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:33:41.157967 3.004668 tcp 10.0.2.105 61552 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:33:43.131241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:33:50.161060 0.000000 tcp 10.0.2.105 61552 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:33:56.150353 0.369934 tcp 10.0.2.105 61553 -> 46.48.223.67 15494 SPA_* 0 0 9 1006 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:34:11.215417 0.000332 tcp 10.0.2.105 61553 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:11.213454 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:39:11.213611 3.003766 tcp 10.0.2.105 61554 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:39:20.215752 0.000000 tcp 10.0.2.105 61554 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:39:26.217098 0.033523 tcp 10.0.2.105 61555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:26.250901 0.035451 tcp 10.0.2.105 61556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:26.286645 0.154607 tcp 10.0.2.105 61557 -> 195.113.214.249 443 SRPA* 0 0 22 12410 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:26.464779 0.603530 tcp 10.0.2.105 61558 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:41.889633 1.257365 tcp 10.0.2.105 61558 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:41.890754 0.071585 tcp 10.0.2.105 61559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:41.962741 0.034283 tcp 10.0.2.105 61560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:41.997459 0.157702 tcp 10.0.2.105 61561 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:39:43.147265 3.006038 tcp 10.0.2.105 61562 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:39:47.361128 2.973729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:39:52.339138 0.000000 tcp 10.0.2.105 61562 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:39:54.300778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:39:58.260868 0.370078 tcp 10.0.2.105 61563 -> 46.48.223.67 15494 SPA_* 0 0 9 1075 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:40:02.223668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:40:04.719786 0.037532 tcp 10.0.2.105 61563 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:40:18.149375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:40:50.155236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:45:04.691412 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:45:04.691514 2.993606 tcp 10.0.2.105 61564 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:45:13.683920 0.000000 tcp 10.0.2.105 61564 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:45:19.694436 0.033297 tcp 10.0.2.105 61565 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:19.728054 0.053884 tcp 10.0.2.105 61566 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:19.782206 0.123243 tcp 10.0.2.105 61567 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:20.009515 2.054027 tcp 10.0.2.105 61568 -> 46.48.223.67 15494 FSPA* 0 0 14 1572 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:21.841981 0.035726 tcp 10.0.2.105 61569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:21.878006 0.031936 tcp 10.0.2.105 61570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:21.910218 0.143756 tcp 10.0.2.105 61571 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:22.063776 3.007126 tcp 10.0.2.105 61572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:45:31.069696 0.000000 tcp 10.0.2.105 61572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 04:45:37.057988 0.361152 tcp 10.0.2.105 61573 -> 46.48.223.67 15494 SPA_* 0 0 9 1042 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:45:43.206073 0.000326 tcp 10.0.2.105 61573 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:46:54.163574 2.999319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 04:47:01.168821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:47:09.173989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:47:25.173141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:47:57.179175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:54:01.185966 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 04:54:08.192860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:54:16.195028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:54:32.197374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:55:04.203472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 04:57:37.333880 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 04:57:37.333996 0.122606 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:37.435359 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 04:57:43.242218 2.440597 tcp 10.0.2.105 61574 -> 46.48.223.67 15494 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:45.052135 0.033031 tcp 10.0.2.105 61575 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:45.085523 0.033366 tcp 10.0.2.105 61576 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:45.119244 0.551014 tcp 10.0.2.105 61577 -> 195.113.214.249 443 SRPA* 0 0 32 24901 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:45.683073 1.235522 tcp 10.0.2.105 61578 -> 46.48.223.67 15494 SPA_* 0 0 9 1217 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:54.318255 0.032276 tcp 10.0.2.105 61579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:54.350843 0.032920 tcp 10.0.2.105 61580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:54.384041 0.385997 tcp 10.0.2.105 61581 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:57:54.770616 0.896486 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:55.646628 0.180205 udp 10.0.2.105 7010 <-> 75.81.152.178 5604 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:55.825809 0.231138 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.049827 0.203268 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.218822 0.108742 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.307357 0.110712 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.378112 0.106407 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.444909 0.348161 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:56.789535 0.281864 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.069891 0.193554 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.255815 0.058468 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.316197 0.062036 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.397249 0.145045 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.502315 0.137126 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:57:57.597603 0.000000 udp 10.0.2.105 7010 -> 207.62.238.200 8980 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 04:58:02.053786 0.000523 tcp 10.0.2.105 61578 -> 46.48.223.67 15494 FA_F* 0 0 5 786 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:58:14.447358 0.031648 tcp 10.0.2.105 61582 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:58:14.479276 0.037284 tcp 10.0.2.105 61583 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:58:14.517385 0.384121 tcp 10.0.2.105 61584 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/21 04:58:14.902171 0.083569 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:14.989375 0.355057 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:15.345752 0.390623 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:15.708988 0.197432 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:15.834730 0.158031 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:15.989558 0.233054 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:16.201953 0.255986 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:16.416726 0.187766 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 04:58:16.636098 0.168889 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:01:08.210311 3.001057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:01:15.216798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:01:23.218189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:01:39.221184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:02:11.227014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:03:02.050721 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:03:02.050891 2.993497 tcp 10.0.2.105 61585 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:03:11.053171 0.000000 tcp 10.0.2.105 61585 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:03:17.054865 0.034323 tcp 10.0.2.105 61586 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:17.089550 0.033445 tcp 10.0.2.105 61587 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:17.123390 0.112739 tcp 10.0.2.105 61588 -> 195.113.214.249 443 SRPA* 0 0 59 37869 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:17.256925 0.359987 tcp 10.0.2.105 61589 -> 46.48.223.67 15494 SPA_* 0 0 9 1101 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:31.854451 0.225335 tcp 10.0.2.105 61589 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:31.855222 0.032781 tcp 10.0.2.105 61590 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:31.888518 0.031476 tcp 10.0.2.105 61591 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:31.920305 0.144204 tcp 10.0.2.105 61592 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:03:32.080041 2.997546 tcp 10.0.2.105 61593 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:03:41.076836 0.000000 tcp 10.0.2.105 61593 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:03:47.075022 0.360409 tcp 10.0.2.105 61594 -> 46.48.223.67 15494 SPA_* 0 0 9 1101 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:04:13.423058 0.000361 tcp 10.0.2.105 61594 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:08:15.233666 3.003166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:08:22.240953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:08:30.242094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:08:46.244948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:09:13.471245 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:09:13.471391 2.972524 tcp 10.0.2.105 61595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:09:18.261089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:09:22.427375 0.000000 tcp 10.0.2.105 61595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:09:28.429226 0.052115 tcp 10.0.2.105 61596 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:28.481621 0.049772 tcp 10.0.2.105 61597 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:28.531665 0.138641 tcp 10.0.2.105 61598 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:28.879533 1.260567 tcp 10.0.2.105 61599 -> 46.48.223.67 15494 SPA_* 0 0 9 1208 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:42.797557 0.863716 tcp 10.0.2.105 61599 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:42.798468 0.050876 tcp 10.0.2.105 61600 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:42.849695 0.050066 tcp 10.0.2.105 61601 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:42.900033 0.142694 tcp 10.0.2.105 61602 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:09:43.661502 3.000459 tcp 10.0.2.105 61603 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:09:52.660735 0.000000 tcp 10.0.2.105 61603 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:09:58.659335 0.355926 tcp 10.0.2.105 61604 -> 46.48.223.67 15494 SPA_* 0 0 9 1208 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:10:10.979604 0.000345 tcp 10.0.2.105 61604 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:10.978707 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:15:10.978827 3.003931 tcp 10.0.2.105 61605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:15:19.981238 0.000000 tcp 10.0.2.105 61605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:15:22.267116 3.003799 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:15:25.982786 0.051289 tcp 10.0.2.105 61606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:26.034368 0.049995 tcp 10.0.2.105 61607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:26.084648 0.550661 tcp 10.0.2.105 61608 -> 195.113.214.249 443 SRPA* 0 0 61 38147 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:26.655616 0.366612 tcp 10.0.2.105 61609 -> 46.48.223.67 15494 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:29.274710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:15:37.276521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:15:38.378579 1.768366 tcp 10.0.2.105 61609 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:38.379503 0.050644 tcp 10.0.2.105 61610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:38.430346 0.051693 tcp 10.0.2.105 61611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:38.482419 0.384495 tcp 10.0.2.105 61612 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:15:40.147202 2.997191 tcp 10.0.2.105 61613 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:15:49.153131 0.000000 tcp 10.0.2.105 61613 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:15:53.279273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:15:55.142011 0.353090 tcp 10.0.2.105 61614 -> 46.48.223.67 15494 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:16:06.157599 2.440164 tcp 10.0.2.105 61614 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:16:25.284891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:21:06.159797 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:21:06.159968 3.003222 tcp 10.0.2.105 61615 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:21:15.171899 0.000000 tcp 10.0.2.105 61615 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:21:21.162422 0.051290 tcp 10.0.2.105 61616 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:21.214019 0.051403 tcp 10.0.2.105 61617 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:21.265734 0.116390 tcp 10.0.2.105 61618 -> 195.113.214.249 443 SRPA* 0 0 35 25063 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:21.393124 0.361397 tcp 10.0.2.105 61619 -> 46.48.223.67 15494 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:31.892016 0.239048 tcp 10.0.2.105 61619 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:31.892825 0.050362 tcp 10.0.2.105 61620 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:31.943458 0.050453 tcp 10.0.2.105 61621 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:31.994272 0.127494 tcp 10.0.2.105 61622 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:32.131297 2.999332 tcp 10.0.2.105 61623 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:21:41.129491 0.000000 tcp 10.0.2.105 61623 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:21:47.128946 0.360136 tcp 10.0.2.105 61624 -> 46.48.223.67 15494 SPA_* 0 0 9 1009 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:21:57.166081 0.000410 tcp 10.0.2.105 61624 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:22:29.291226 3.001624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:22:36.299096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:22:44.300124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:23:00.303109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:23:32.309575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:28:32.020489 0.000155 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:28:32.020801 0.056468 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:28:32.074086 0.000000 udp 10.0.2.105 7010 -> 207.62.238.200 8980 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 05:28:42.175138 2.754511 tcp 10.0.2.105 61625 -> 46.48.223.67 15494 FSPA* 0 0 14 1758 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:44.688030 0.051942 tcp 10.0.2.105 61626 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:44.740358 0.050568 tcp 10.0.2.105 61627 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:44.791273 0.129571 tcp 10.0.2.105 61628 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:44.929934 0.357834 tcp 10.0.2.105 61629 -> 46.48.223.67 15494 SPA_* 0 0 9 1228 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:50.176437 0.050774 tcp 10.0.2.105 61630 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:50.227519 0.050319 tcp 10.0.2.105 61631 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:50.278091 0.129505 tcp 10.0.2.105 61632 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:28:50.408686 0.107274 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:28:50.497590 0.236089 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:28:50.725806 0.807401 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:28:51.512676 0.000000 udp 10.0.2.105 7010 -> 75.81.152.178 5604 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 05:28:54.214865 0.000373 tcp 10.0.2.105 61629 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:29:07.111548 0.050931 tcp 10.0.2.105 61633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:29:07.162750 0.051535 tcp 10.0.2.105 61634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:29:07.214574 0.129788 tcp 10.0.2.105 61635 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:29:07.344935 0.101986 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2541 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:07.426825 0.194053 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:07.584626 0.373122 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:07.953831 0.087550 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.019496 0.117879 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.097870 0.059366 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.155467 0.063626 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.218032 0.600505 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.808535 0.193015 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:08.993620 0.293478 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:09.277209 0.134616 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:09.361556 0.083495 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:09.446635 0.358675 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:09.806746 0.797385 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:10.575806 0.187698 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:10.705915 0.160861 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:10.863224 0.238615 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:11.080548 0.181947 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:11.254781 0.305139 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:11.515656 0.189638 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:29:36.315134 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:29:43.322770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:29:51.323964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:30:07.327516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:30:39.336033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:33:54.213767 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:33:54.213944 3.003471 tcp 10.0.2.105 61636 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:34:03.218103 0.000000 tcp 10.0.2.105 61636 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:34:09.216341 0.051405 tcp 10.0.2.105 61637 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:09.268044 0.050968 tcp 10.0.2.105 61638 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:09.319314 0.129970 tcp 10.0.2.105 61639 -> 195.113.214.249 443 SRPA* 0 0 23 12464 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:09.460814 0.353008 tcp 10.0.2.105 61640 -> 46.48.223.67 15494 SPA_* 0 0 9 1078 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:18.334266 0.259992 tcp 10.0.2.105 61640 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:18.335030 0.049919 tcp 10.0.2.105 61641 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:18.385279 0.051543 tcp 10.0.2.105 61642 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:18.437136 0.140296 tcp 10.0.2.105 61643 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:34:18.594499 3.008325 tcp 10.0.2.105 61644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:34:27.601355 0.000000 tcp 10.0.2.105 61644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:34:33.590177 1.764668 tcp 10.0.2.105 61645 -> 46.48.223.67 15494 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:36:43.339442 3.001103 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:36:50.346458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:36:58.348066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:37:14.351382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:37:46.357111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:39:35.354100 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:39:35.354249 3.004372 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:39:44.356873 0.000000 tcp 10.0.2.105 61646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:39:50.356839 0.032493 tcp 10.0.2.105 61647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:50.389626 0.034224 tcp 10.0.2.105 61648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:50.424150 0.167020 tcp 10.0.2.105 61649 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:50.600789 0.353304 tcp 10.0.2.105 61650 -> 46.48.223.67 15494 SPA_* 0 0 9 1046 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:58.830019 0.627319 tcp 10.0.2.105 61650 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:58.830813 0.033010 tcp 10.0.2.105 61651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:58.864075 0.033605 tcp 10.0.2.105 61652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:58.897992 0.549698 tcp 10.0.2.105 61653 -> 195.113.214.249 443 SRPA* 0 0 35 25727 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:39:59.457567 3.005110 tcp 10.0.2.105 61654 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:40:08.461340 0.000000 tcp 10.0.2.105 61654 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:40:14.450006 0.341479 tcp 10.0.2.105 61655 -> 46.48.223.67 15494 SPA_* 0 0 9 1046 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:40:22.413166 0.000616 tcp 10.0.2.105 61655 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:43:50.363236 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:43:57.370314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:44:05.371985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:44:21.374899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:44:53.381468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:45:22.413291 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:45:22.413424 3.003803 tcp 10.0.2.105 61656 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:45:31.415753 0.000000 tcp 10.0.2.105 61656 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:45:37.415901 0.037383 tcp 10.0.2.105 61657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:37.453589 0.034842 tcp 10.0.2.105 61658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:37.488721 0.113156 tcp 10.0.2.105 61659 -> 195.113.214.249 443 SRPA* 0 0 34 25217 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:37.612934 1.914045 tcp 10.0.2.105 61660 -> 46.48.223.67 15494 FSPA* 0 0 14 1643 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:39.307238 0.038740 tcp 10.0.2.105 61661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:39.346353 0.034770 tcp 10.0.2.105 61662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:39.381385 0.131654 tcp 10.0.2.105 61663 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:45:39.527211 3.004219 tcp 10.0.2.105 61664 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:45:48.535674 0.000000 tcp 10.0.2.105 61664 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:45:54.531366 0.343603 tcp 10.0.2.105 61665 -> 46.48.223.67 15494 SPA_* 0 0 9 1113 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:46:05.453667 0.000660 tcp 10.0.2.105 61665 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:05.446609 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:51:05.446797 3.006318 tcp 10.0.2.105 61666 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:51:14.448851 0.000000 tcp 10.0.2.105 61666 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:51:20.449532 0.033357 tcp 10.0.2.105 61667 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:20.483242 0.035112 tcp 10.0.2.105 61668 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:20.518694 0.135135 tcp 10.0.2.105 61669 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:20.673647 0.352783 tcp 10.0.2.105 61670 -> 46.48.223.67 15494 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:27.714303 0.221019 tcp 10.0.2.105 61670 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:27.715091 0.033391 tcp 10.0.2.105 61671 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:27.748846 0.033517 tcp 10.0.2.105 61672 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:27.782647 0.141872 tcp 10.0.2.105 61673 -> 195.113.214.249 443 SRPA* 0 0 34 18814 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:27.935606 3.009122 tcp 10.0.2.105 61674 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:51:36.941520 0.000000 tcp 10.0.2.105 61674 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 05:51:42.930000 0.361642 tcp 10.0.2.105 61675 -> 46.48.223.67 15494 SPA_* 0 0 9 1008 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:51:53.016003 0.000513 tcp 10.0.2.105 61675 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:56:06.391596 3.001400 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 05:56:13.401935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:56:21.400474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:56:37.402954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:57:09.409091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 05:59:38.223385 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 05:59:38.223587 0.000000 udp 10.0.2.105 7010 -> 75.81.152.178 5604 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 05:59:53.326429 0.033361 tcp 10.0.2.105 61676 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:59:53.360050 0.100897 tcp 10.0.2.105 61677 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:59:53.461381 0.543182 tcp 10.0.2.105 61678 -> 195.113.214.249 443 SRPA* 0 0 36 25951 flow=From-Botnet-V2-TCP-Established 1970/02/21 05:59:54.005149 0.061577 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:54.063159 0.140718 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:54.183224 0.230383 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:54.405332 0.105610 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:54.483238 0.124989 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:54.587349 0.927289 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:55.476447 0.375363 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:55.847960 0.120536 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:55.919589 0.108874 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:55.986859 0.062635 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.047797 0.071313 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.098265 0.196713 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.266810 0.191397 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.452190 0.285085 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.728064 0.127492 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/21 05:59:56.811879 0.000000 udp 10.0.2.105 7010 -> 194.150.233.9 6644 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:00:08.035692 3.004989 tcp 10.0.2.105 61679 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:00:12.212732 0.032249 tcp 10.0.2.105 61680 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:12.245259 0.116113 tcp 10.0.2.105 61681 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:12.361681 0.380666 tcp 10.0.2.105 61682 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:12.742911 0.355352 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:13.114773 0.650942 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:13.738556 0.212403 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:13.872047 0.158533 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:14.027014 0.233030 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:14.240576 0.169224 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:14.400486 0.297053 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:14.651749 0.189251 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:14.867605 0.176879 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:15.037007 0.116432 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 8 3097 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:15.150251 1.315224 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 2950 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:16.443823 0.306017 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 8 3173 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:16.731077 0.236846 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 3006 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:16.946850 0.446117 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3127 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:17.039157 0.000000 tcp 10.0.2.105 61679 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:00:17.385207 1.639662 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 3055 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:18.130404 0.449599 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 8 2944 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:18.543072 0.951153 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 8 2960 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:19.456380 0.104203 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 8 3051 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:19.560848 0.172875 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3069 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:19.694935 0.374290 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 8 2969 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:20.062348 0.546177 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 8 3180 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:20.607161 0.298379 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 8 2989 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:20.875498 0.118079 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 3084 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:20.974449 0.225980 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 8 3074 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:21.156497 0.710278 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 8 3258 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:21.876450 1.372709 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 2830 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:23.038212 0.030829 tcp 10.0.2.105 61683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:23.069358 0.035017 tcp 10.0.2.105 61684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:23.104663 0.381949 tcp 10.0.2.105 61685 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:23.223616 0.354207 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 8 2845 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:23.494833 0.295978 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2565 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:23.505468 0.603745 tcp 10.0.2.105 61686 -> 46.48.223.67 15494 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:23.788481 0.326836 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 8 3009 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:24.106522 0.731812 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3061 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:24.792690 0.451384 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 2814 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:25.223032 0.351236 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3106 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:00:25.550801 0.000000 udp 10.0.2.105 7010 -> 77.176.152.151 9077 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:00:33.272588 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:00:39.640098 0.477783 tcp 10.0.2.105 61686 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:39.641071 0.031258 tcp 10.0.2.105 61687 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:39.672648 0.033693 tcp 10.0.2.105 61688 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:39.706663 0.111492 tcp 10.0.2.105 61689 -> 195.113.214.249 443 SRPA* 0 0 32 24939 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:40.118107 2.998283 tcp 10.0.2.105 61690 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:00:40.392612 0.000000 udp 10.0.2.105 7010 -> 66.55.26.170 8235 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:00:48.434287 0.000000 udp 10.0.2.105 7010 -> 79.1.23.230 5712 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:00:49.114853 0.000000 tcp 10.0.2.105 61690 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:00:55.113400 0.345251 tcp 10.0.2.105 61691 -> 46.48.223.67 15494 SPA_* 0 0 9 1233 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:00:56.956641 0.000000 udp 10.0.2.105 7010 -> 14.140.174.2 6000 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:04.821899 0.000000 udp 10.0.2.105 7010 -> 78.189.27.204 9027 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:08.487070 0.000348 tcp 10.0.2.105 61691 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:01:13.129725 0.000000 udp 10.0.2.105 7010 -> 213.148.158.245 4496 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:19.469057 0.000000 udp 10.0.2.105 7010 -> 71.226.16.227 4848 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:25.617907 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 301 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:31.326088 0.046605 udp 10.0.2.105 7010 -> 88.243.151.23 4072 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:31.372693 0.000000 icmp 88.243.151.23 0x0303 -> 10.0.2.105 0xe80f URP 192 1 226 flow=Background 1970/02/21 06:01:35.852192 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:01:36.653400 0.000000 udp 10.0.2.105 7010 -> 112.209.219.225 9574 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:42.361783 0.000000 udp 10.0.2.105 7010 -> 85.39.108.122 2907 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:49.702038 0.000000 udp 10.0.2.105 7010 -> 81.137.205.62 2561 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:01:56.852812 0.000000 udp 10.0.2.105 7010 -> 98.173.166.120 9081 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:01.849686 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:02:05.164793 0.000000 udp 10.0.2.105 7010 -> 95.242.30.218 4398 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:10.833076 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:18.253522 0.000000 udp 10.0.2.105 7010 -> 87.169.59.12 9487 INT 0 1 240 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:25.343768 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:30.351140 0.000127 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:02:33.685420 0.000000 udp 10.0.2.105 7010 -> 66.69.253.188 3984 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:42.107572 0.000000 udp 10.0.2.105 7010 -> 94.34.141.5 9141 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:47.815918 0.000000 udp 10.0.2.105 7010 -> 31.193.18.31 8857 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:54.034571 0.000000 udp 10.0.2.105 7010 -> 98.23.121.226 1782 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:02:58.851498 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:03:02.236965 0.351331 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 8 3117 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:03:02.570486 0.000000 udp 10.0.2.105 7010 -> 81.102.193.222 6454 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:08.085077 0.569313 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 5 1562 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:03:08.667633 0.000000 udp 10.0.2.105 7010 -> 84.13.53.74 3646 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:13.415242 3.002145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:03:14.985375 0.000000 udp 10.0.2.105 7010 -> 79.32.76.191 5580 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:20.422720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:03:23.477475 0.000000 udp 10.0.2.105 7010 -> 80.228.61.82 9419 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:28.346837 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:03:28.426832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:03:30.718033 0.000000 udp 10.0.2.105 7010 -> 84.177.42.90 4751 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:38.839308 0.000000 udp 10.0.2.105 7010 -> 89.106.30.18 8755 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:44.426989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:03:46.611574 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:54.091554 0.000000 udp 10.0.2.105 7010 -> 94.122.138.226 1929 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:03:58.847662 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:04:01.281749 0.000000 udp 10.0.2.105 7010 -> 79.33.72.14 2142 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:06.899734 0.000000 udp 10.0.2.105 7010 -> 88.244.193.36 4768 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:15.612320 0.000000 udp 10.0.2.105 7010 -> 95.137.206.183 1042 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:16.433259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:04:21.610996 0.139844 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:21.750840 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 185 flow=Background 1970/02/21 06:04:26.347556 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:04:27.038990 0.000000 udp 10.0.2.105 7010 -> 2.216.194.67 9017 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:35.460830 0.158468 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 8 2855 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:35.638468 0.785261 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 8 3088 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:36.350748 0.386799 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 8 3059 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:36.727030 0.000000 udp 10.0.2.105 7010 -> 79.144.165.208 8684 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:42.120148 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:49.631414 0.000000 udp 10.0.2.105 7010 -> 99.138.46.1 9417 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:04:54.348267 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:04:57.592442 0.897365 udp 10.0.2.105 7010 <-> 121.216.43.103 2815 CON 0 0 8 3105 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:58.439376 0.223812 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 8 3008 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:58.680197 0.109506 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 8 3017 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:04:58.800848 0.000000 udp 10.0.2.105 7010 -> 79.48.122.15 6737 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:04.322165 0.000000 udp 10.0.2.105 7010 -> 82.50.118.131 8169 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:11.031916 0.000000 udp 10.0.2.105 7010 -> 122.173.148.212 2604 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:16.600368 0.000000 udp 10.0.2.105 7010 -> 86.18.222.123 2749 INT 0 1 313 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:21.346801 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:05:23.689764 0.115900 udp 10.0.2.105 7010 <-> 86.145.212.99 8059 CON 0 0 8 2892 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:05:23.803043 0.000000 udp 10.0.2.105 7010 -> 75.236.40.213 6550 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:32.272936 0.000000 udp 10.0.2.105 7010 -> 70.184.184.44 7497 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:38.281961 0.440441 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 8 2870 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:05:38.751003 0.319489 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 8 3129 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:05:39.176172 0.000000 udp 10.0.2.105 7010 -> 213.153.141.44 5247 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:48.005148 0.225018 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 8 3092 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:05:48.203256 0.000000 udp 10.0.2.105 7010 -> 190.4.62.58 3299 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:05:52.851038 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:05:54.153844 0.000000 udp 10.0.2.105 7010 -> 113.91.101.115 8041 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:01.734983 0.000000 udp 10.0.2.105 7010 -> 186.84.169.36 4548 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:06.751895 0.000000 udp 10.0.2.105 7010 -> 190.78.117.119 3164 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:08.484608 3.004138 tcp 10.0.2.105 61692 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:06:12.590219 0.133008 udp 10.0.2.105 7010 <-> 86.136.180.112 7670 CON 0 0 8 3072 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:06:12.722877 0.000000 udp 10.0.2.105 7010 -> 86.179.171.56 9633 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:17.347118 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:06:17.487098 0.000000 tcp 10.0.2.105 61692 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:06:20.532043 0.387519 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 8 3149 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:06:20.938761 0.000000 udp 10.0.2.105 7010 -> 67.180.211.195 1153 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:23.496756 0.032830 tcp 10.0.2.105 61693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:23.529935 0.032927 tcp 10.0.2.105 61694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:23.563205 0.148857 tcp 10.0.2.105 61695 -> 195.113.214.249 443 SRPA* 0 0 41 22658 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:23.722917 0.364065 tcp 10.0.2.105 61696 -> 46.48.223.67 15494 SPA_* 0 0 9 1110 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:29.774354 0.000000 udp 10.0.2.105 7010 -> 74.92.133.179 2367 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:38.227515 0.180871 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 8 3070 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:06:38.410441 0.000000 udp 10.0.2.105 7010 -> 77.96.201.71 5562 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:46.258834 0.000000 udp 10.0.2.105 7010 -> 64.72.85.124 5317 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:46.685414 0.252591 tcp 10.0.2.105 61696 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:46.686289 0.033440 tcp 10.0.2.105 61697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:46.720014 0.034137 tcp 10.0.2.105 61698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:46.754511 0.166749 tcp 10.0.2.105 61699 -> 195.113.214.249 443 SRPA* 0 0 43 35520 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:06:46.938251 2.996275 tcp 10.0.2.105 61700 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:06:53.829159 0.000000 udp 10.0.2.105 7010 -> 2.29.118.253 4634 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:06:55.942679 0.000000 tcp 10.0.2.105 61700 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:07:00.869518 0.000000 udp 10.0.2.105 7010 -> 110.175.250.181 1203 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:01.931545 0.031876 tcp 10.0.2.105 61701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:07:01.963311 0.034817 tcp 10.0.2.105 61702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:07:01.998486 0.134713 tcp 10.0.2.105 61703 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:07:02.161782 2.993760 tcp 10.0.2.105 61704 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:07:06.367565 0.000000 udp 10.0.2.105 7010 -> 188.217.156.46 1941 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:11.154181 0.000000 tcp 10.0.2.105 61704 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:07:15.351075 0.000000 udp 10.0.2.105 7010 -> 176.198.66.204 5230 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:17.163397 0.366802 tcp 10.0.2.105 61705 -> 46.48.223.67 15494 SPA_* 0 0 9 1110 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:07:24.293510 0.418619 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 8 3211 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:07:24.746089 0.000000 udp 10.0.2.105 7010 -> 79.16.117.16 5643 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:30.158338 0.000371 tcp 10.0.2.105 61705 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:07:30.158935 2.997100 tcp 10.0.2.105 61706 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:07:30.392095 0.000000 udp 10.0.2.105 7010 -> 78.164.214.211 1090 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:38.303700 0.000000 udp 10.0.2.105 7010 -> 213.115.107.42 6192 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:39.154737 0.000000 tcp 10.0.2.105 61706 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:07:47.086436 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:53.455469 2.185925 udp 10.0.2.105 7010 <-> 2.193.253.81 9511 CON 0 0 8 2739 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:07:55.764760 0.000000 udp 10.0.2.105 7010 -> 137.207.136.81 1503 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:07:58.352126 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:08:03.440227 0.000000 udp 10.0.2.105 7010 -> 87.28.39.93 6207 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:10.029211 0.000000 udp 10.0.2.105 7010 -> 210.11.5.74 8551 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:18.611406 0.000000 udp 10.0.2.105 7010 -> 95.230.10.88 1517 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:23.348027 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:08:26.923786 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:32.051005 0.000000 udp 10.0.2.105 7010 -> 95.225.106.112 9979 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:37.629098 0.000000 udp 10.0.2.105 7010 -> 87.203.119.206 3236 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:43.166825 0.149869 udp 10.0.2.105 7010 <-> 88.238.68.87 2925 CON 0 0 8 3108 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:08:43.409871 0.000000 udp 10.0.2.105 7010 -> 50.84.50.211 9576 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:47.843365 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:08:48.515624 0.153611 udp 10.0.2.105 7010 <-> 2.28.207.123 3547 CON 0 0 8 3018 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:08:48.671256 0.000000 udp 10.0.2.105 7010 -> 66.240.7.34 7030 INT 0 1 309 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:08:55.885067 0.149129 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 8 3028 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:08:56.030628 0.000000 udp 10.0.2.105 7010 -> 208.48.253.210 4760 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:04.098532 0.000000 udp 10.0.2.105 7010 -> 46.49.31.108 8386 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:10.095740 0.000000 udp 10.0.2.105 7010 -> 2.122.32.165 3346 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:14.851961 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:09:18.217350 0.000000 udp 10.0.2.105 7010 -> 62.204.166.90 8724 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:26.279160 0.000000 udp 10.0.2.105 7010 -> 213.16.179.102 3371 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:33.048408 0.000000 udp 10.0.2.105 7010 -> 176.237.149.229 2200 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:41.851106 0.031093 udp 10.0.2.105 7010 -> 88.64.226.243 6222 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:41.882199 0.000000 icmp 88.64.226.243 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 147 flow=Background 1970/02/21 06:09:46.848165 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:09:47.278985 0.365947 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 8 3049 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:09:47.914089 0.000000 udp 10.0.2.105 7010 -> 86.163.242.253 3145 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:09:53.828173 0.000000 udp 10.0.2.105 7010 -> 80.123.157.74 8101 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:01.329399 0.404840 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 3041 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:10:01.755382 0.000000 udp 10.0.2.105 7010 -> 90.186.219.118 6799 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:10.452304 0.000000 udp 10.0.2.105 7010 -> 78.186.142.186 8181 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:15.349074 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:10:17.432405 0.000000 udp 10.0.2.105 7010 -> 69.254.154.213 1390 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:22.999972 0.125010 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 8 2980 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:10:23.149086 0.000000 udp 10.0.2.105 7010 -> 85.107.160.235 1050 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:30.441239 0.000000 udp 10.0.2.105 7010 -> 110.142.2.209 4982 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:31.445149 3.001681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:10:37.020842 0.033796 udp 10.0.2.105 7010 -> 37.5.218.253 4013 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:37.054638 0.000000 icmp 37.5.218.253 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 248 flow=Background 1970/02/21 06:10:38.452498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:10:41.847300 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:10:44.611444 0.000000 udp 10.0.2.105 7010 -> 79.29.77.45 2110 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:46.454002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:10:49.758937 0.000000 udp 10.0.2.105 7010 -> 72.251.14.73 2321 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:10:56.295134 0.000530 udp 10.0.2.105 7010 <-> 72.251.14.73 2321 CON 0 0 2 789 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:11:01.331469 0.000000 udp 10.0.2.105 7010 -> 95.227.151.231 5519 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:02.458071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:11:02.560719 0.701246 udp 10.0.2.105 7010 <- 72.251.14.73 2321 RSP 0 0 5 2326 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:05.854713 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:11:09.957706 0.000000 udp 10.0.2.105 7010 -> 82.40.180.197 2467 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:16.317125 0.000000 udp 10.0.2.105 7010 -> 77.98.215.148 3351 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:22.666035 0.000000 udp 10.0.2.105 7010 -> 91.176.183.70 9098 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:31.338880 0.000000 udp 10.0.2.105 7010 -> 86.143.134.185 5938 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:34.462925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:11:35.844955 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:11:37.036580 0.000000 udp 10.0.2.105 7010 -> 69.142.19.111 5316 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:42.494836 0.000000 udp 10.0.2.105 7010 -> 98.175.158.135 7355 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:48.903841 0.000000 udp 10.0.2.105 7010 -> 95.148.19.57 2040 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:55.283353 0.000000 udp 10.0.2.105 7010 -> 186.46.91.78 1868 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:11:59.849767 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:12:02.453477 0.000000 udp 10.0.2.105 7010 -> 87.29.1.128 7990 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:12:45.155293 3.003722 tcp 10.0.2.105 61707 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:12:49.851250 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:12:54.157557 0.000000 tcp 10.0.2.105 61707 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:00.158662 0.031828 tcp 10.0.2.105 61708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:00.190780 0.032906 tcp 10.0.2.105 61709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:00.223973 0.136918 tcp 10.0.2.105 61710 -> 195.113.214.249 443 SRPA* 0 0 24 12632 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:00.373948 0.353834 tcp 10.0.2.105 61711 -> 46.48.223.67 15494 SPA_* 0 0 9 1201 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:11.155672 0.210212 tcp 10.0.2.105 61711 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:11.156491 0.031545 tcp 10.0.2.105 61712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:11.188513 0.033275 tcp 10.0.2.105 61713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:11.222091 0.133297 tcp 10.0.2.105 61714 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:11.366161 3.000500 tcp 10.0.2.105 61715 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:20.365504 0.000000 tcp 10.0.2.105 61715 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:26.367274 0.031409 tcp 10.0.2.105 61716 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:26.398987 0.032650 tcp 10.0.2.105 61717 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:26.431955 0.131395 tcp 10.0.2.105 61718 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:26.581435 2.997103 tcp 10.0.2.105 61719 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:35.577237 0.000000 tcp 10.0.2.105 61719 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:41.576334 2.053046 tcp 10.0.2.105 61720 -> 46.48.223.67 15494 FSPA* 0 0 14 1731 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:13:43.629638 3.003705 tcp 10.0.2.105 61721 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:13:52.641289 0.000000 tcp 10.0.2.105 61721 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:17:38.473918 2.997474 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:17:45.476661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:17:53.478349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:18:09.481011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:18:41.487425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:18:58.621988 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:18:58.622163 2.993618 tcp 10.0.2.105 61722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:19:07.614314 0.000000 tcp 10.0.2.105 61722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:19:13.625064 0.033329 tcp 10.0.2.105 61723 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:13.658668 0.034664 tcp 10.0.2.105 61724 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:13.693642 0.130716 tcp 10.0.2.105 61725 -> 195.113.214.249 443 SRPA* 0 0 22 11782 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:13.841031 0.369331 tcp 10.0.2.105 61726 -> 46.48.223.67 15494 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:38.914672 0.222028 tcp 10.0.2.105 61726 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:38.915658 0.033032 tcp 10.0.2.105 61727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:38.949000 0.032328 tcp 10.0.2.105 61728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:38.981637 0.144978 tcp 10.0.2.105 61729 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:39.136921 2.997093 tcp 10.0.2.105 61730 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:19:48.142683 0.000000 tcp 10.0.2.105 61730 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:19:54.136344 0.032361 tcp 10.0.2.105 61731 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:54.169035 0.033625 tcp 10.0.2.105 61732 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:54.202976 0.141684 tcp 10.0.2.105 61733 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:19:54.354942 2.991730 tcp 10.0.2.105 61734 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:20:03.344189 0.000000 tcp 10.0.2.105 61734 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:20:09.343474 1.818095 tcp 10.0.2.105 61735 -> 46.48.223.67 15494 FSPA* 0 0 14 1601 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:20:11.161803 2.998383 tcp 10.0.2.105 61736 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:20:20.159093 0.000000 tcp 10.0.2.105 61736 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:24:45.493278 3.001386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:24:52.500387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:25:00.502143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:25:16.504834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:25:26.159296 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:25:26.159443 3.003899 tcp 10.0.2.105 61737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:25:35.171746 0.000000 tcp 10.0.2.105 61737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:25:41.161922 0.032964 tcp 10.0.2.105 61738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:41.195156 0.033984 tcp 10.0.2.105 61739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:41.229431 0.133196 tcp 10.0.2.105 61740 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:41.372745 2.032351 tcp 10.0.2.105 61741 -> 46.48.223.67 15494 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:43.174304 0.042347 tcp 10.0.2.105 61742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:43.216925 0.032305 tcp 10.0.2.105 61743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:43.249523 0.144064 tcp 10.0.2.105 61744 -> 195.113.214.249 443 SRPA* 0 0 23 14588 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:43.405332 3.002671 tcp 10.0.2.105 61745 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:25:48.510733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:25:52.406623 0.000000 tcp 10.0.2.105 61745 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:25:58.406000 0.035271 tcp 10.0.2.105 61746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:58.441555 0.034196 tcp 10.0.2.105 61747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:58.476052 0.150625 tcp 10.0.2.105 61748 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:25:58.640002 2.999983 tcp 10.0.2.105 61749 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:26:07.640615 0.000000 tcp 10.0.2.105 61749 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:26:13.637572 0.366359 tcp 10.0.2.105 61750 -> 46.48.223.67 15494 SPA_* 0 0 9 1167 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:26:22.214481 0.000503 tcp 10.0.2.105 61750 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:26:22.215181 2.998301 tcp 10.0.2.105 61751 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:26:31.222271 0.000000 tcp 10.0.2.105 61751 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:31:37.212749 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:31:37.212960 2.994403 tcp 10.0.2.105 61752 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:31:46.205029 0.000000 tcp 10.0.2.105 61752 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:31:52.215621 0.035003 tcp 10.0.2.105 61753 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:31:52.250926 0.034827 tcp 10.0.2.105 61754 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:31:52.286033 0.168177 tcp 10.0.2.105 61755 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:31:52.516620 0.366028 tcp 10.0.2.105 61756 -> 46.48.223.67 15494 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:31:52.518200 3.001388 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:31:59.524423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:32:00.704823 0.297016 tcp 10.0.2.105 61756 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:00.705647 0.032603 tcp 10.0.2.105 61757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:00.738594 0.033929 tcp 10.0.2.105 61758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:00.772852 0.218776 tcp 10.0.2.105 61759 -> 195.113.214.249 443 SRPA* 0 0 40 21106 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:01.002089 2.998937 tcp 10.0.2.105 61760 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:32:07.526530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:32:09.999729 0.000000 tcp 10.0.2.105 61760 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:32:15.997948 0.374740 tcp 10.0.2.105 61761 -> 46.48.223.67 15494 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:23.529487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:32:23.859554 0.000443 tcp 10.0.2.105 61761 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:32:55.538934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:38:59.543359 2.999107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 06:39:06.550566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:39:14.550456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:39:30.553372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:40:02.559151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:42:24.623476 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:42:24.623695 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:42:40.057194 0.034036 tcp 10.0.2.105 61762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:42:40.091524 0.035454 tcp 10.0.2.105 61763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:42:40.127229 0.135391 tcp 10.0.2.105 61764 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:42:40.263210 0.101593 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:40.391998 0.095803 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:40.470736 0.862347 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:41.312672 0.238965 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:41.544023 0.123456 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 5 1945 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:41.652201 0.370848 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.019193 0.195260 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.179877 0.061972 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.269864 0.094033 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.324724 0.202173 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.519906 0.107251 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.588486 0.285012 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.868089 0.063272 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:42.913070 0.179509 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:43.045475 0.131152 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:43.147133 0.354968 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:43.519552 0.627075 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:44.117627 0.172625 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:44.238625 0.160114 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:44.395545 0.160090 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:44.550443 0.241078 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:44.771893 0.303812 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:45.037008 0.189579 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:42:45.238050 0.000000 udp 10.0.2.105 7010 -> 108.73.115.135 7576 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:42:53.895118 3.004452 tcp 10.0.2.105 61765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:43:02.898701 0.000000 tcp 10.0.2.105 61765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:43:03.349504 0.033293 tcp 10.0.2.105 61766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:03.383085 0.034192 tcp 10.0.2.105 61767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:03.417574 0.140229 tcp 10.0.2.105 61768 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:03.558340 0.380672 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 3 762 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:03.931930 0.079238 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:04.012919 0.000000 udp 10.0.2.105 7010 -> 173.202.66.177 7510 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:43:08.896916 0.031647 tcp 10.0.2.105 61769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:08.928830 0.041246 tcp 10.0.2.105 61770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:08.970425 0.136208 tcp 10.0.2.105 61771 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:09.116294 0.364659 tcp 10.0.2.105 61772 -> 46.48.223.67 15494 SPA_* 0 0 9 1212 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:20.644123 0.035388 tcp 10.0.2.105 61773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:20.679821 0.033601 tcp 10.0.2.105 61774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:20.713719 0.131107 tcp 10.0.2.105 61775 -> 195.113.214.249 443 SRPA* 0 0 40 21352 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:20.845503 0.435781 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:21.188163 0.000000 udp 10.0.2.105 7010 -> 121.216.43.103 2815 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:43:36.667714 0.044701 tcp 10.0.2.105 61776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:36.712782 0.032546 tcp 10.0.2.105 61777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:36.745620 0.144920 tcp 10.0.2.105 61778 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:36.891129 0.122579 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.012045 0.084898 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.078908 0.064969 udp 10.0.2.105 7010 <-> 86.145.212.99 8059 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.130798 0.227365 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.322479 0.164252 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2512 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.508032 0.130837 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.598535 0.076166 udp 10.0.2.105 7010 <-> 86.136.180.112 7670 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.659136 0.198239 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.850709 0.093979 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:37.935877 0.213649 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.142125 0.136551 udp 10.0.2.105 7010 <-> 2.193.253.81 9511 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.284985 0.077566 udp 10.0.2.105 7010 <-> 88.238.68.87 2925 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.355857 0.090906 udp 10.0.2.105 7010 <-> 2.28.207.123 3547 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.413709 0.082719 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.482861 0.185641 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.677545 0.203520 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:38.876886 0.245969 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/21 06:43:39.103871 0.000000 udp 10.0.2.105 7010 -> 72.251.14.73 2321 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:43:39.481384 0.033481 tcp 10.0.2.105 61779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:39.515130 0.034981 tcp 10.0.2.105 61780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:39.550339 0.177263 tcp 10.0.2.105 61781 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:39.741398 0.357831 tcp 10.0.2.105 61772 -> 46.48.223.67 15494 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:43:39.741768 2.993628 tcp 10.0.2.105 61782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:43:47.513118 0.634565 udp 10.0.2.105 7010 <- 72.251.14.73 2321 RSP 0 0 5 2167 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 06:43:48.733878 0.000000 tcp 10.0.2.105 61782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:43:54.742982 0.362544 tcp 10.0.2.105 61783 -> 46.48.223.67 15494 SPA_* 0 0 9 1212 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:44:02.087157 0.000459 tcp 10.0.2.105 61783 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:46:06.564820 3.001931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:46:13.572241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:46:21.573823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:46:37.576804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:47:09.584653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:49:02.085225 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 06:49:02.085340 3.003646 tcp 10.0.2.105 61784 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:49:11.087567 0.000000 tcp 10.0.2.105 61784 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:49:17.087864 0.036144 tcp 10.0.2.105 61785 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:17.124283 0.040483 tcp 10.0.2.105 61786 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:17.165069 0.143636 tcp 10.0.2.105 61787 -> 195.113.214.249 443 SRPA* 0 0 40 21276 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:17.320794 2.025451 tcp 10.0.2.105 61788 -> 46.48.223.67 15494 FSPA* 0 0 14 1756 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:19.089363 0.043831 tcp 10.0.2.105 61789 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:19.133457 0.067495 tcp 10.0.2.105 61790 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:19.201250 0.134002 tcp 10.0.2.105 61791 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:19.346515 0.217523 tcp 10.0.2.105 61792 -> 200.84.7.244 8038 SPA_* 0 0 9 1226 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:49.563444 0.031945 tcp 10.0.2.105 61793 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:49.595706 0.034160 tcp 10.0.2.105 61794 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:49.630143 0.134273 tcp 10.0.2.105 61795 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:49.783679 0.053342 tcp 10.0.2.105 61792 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:49:49.783964 3.003570 tcp 10.0.2.105 61796 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:49:58.785984 0.000000 tcp 10.0.2.105 61796 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 06:50:04.784164 0.366555 tcp 10.0.2.105 61797 -> 46.48.223.67 15494 SPA_* 0 0 9 1226 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:50:11.676348 0.000337 tcp 10.0.2.105 61797 -> 46.48.223.67 15494 FA_F* 0 0 5 530 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:50:11.676873 4.946874 tcp 10.0.2.105 61798 -> 200.84.7.244 8038 FSPA* 0 0 15 1787 flow=From-Botnet-V2-TCP-Established 1970/02/21 06:53:13.588959 3.001871 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 06:53:20.596037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:53:28.598012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:53:44.600991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 06:54:16.606836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:00:20.613259 3.001092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:00:27.620723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:00:35.621958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:00:51.633498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:01:23.630848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:07:27.636800 3.001863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:07:34.644026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:07:42.645534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:07:58.648654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:08:30.654464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:13:57.775594 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 07:13:57.775703 0.056775 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:13:57.829510 0.201739 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:13:58.044346 0.201256 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:13:58.223165 0.000000 udp 10.0.2.105 7010 -> 121.216.43.103 2815 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:14:14.281275 0.040240 tcp 10.0.2.105 61799 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:14.321778 0.033591 tcp 10.0.2.105 61800 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:14.355646 0.130879 tcp 10.0.2.105 61801 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:14.487254 1.841072 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:16.329428 0.100384 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:16.407962 0.890509 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:17.276352 0.186193 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:17.428537 0.059499 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:17.486048 0.109038 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:17.555567 0.230707 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:17.778518 0.349054 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.123058 0.111931 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.214574 0.141005 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.311777 0.112874 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.387694 0.192007 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.573648 0.299450 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.862971 0.070681 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:18.913474 0.189354 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:19.073388 0.355248 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:19.445925 0.188477 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:19.573354 0.467609 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:20.011439 0.187665 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:20.201129 0.233484 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:20.414173 0.165391 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:20.576540 2.257615 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:22.825326 0.254390 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:23.042421 0.308822 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:23.351652 0.077674 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:23.456111 0.608348 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:23.971748 0.139235 udp 10.0.2.105 7010 <-> 86.145.212.99 8059 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.096309 0.226626 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.289395 0.121969 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 6 1934 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.410169 0.066843 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.460457 0.152966 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.631059 0.119610 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.711477 0.073539 udp 10.0.2.105 7010 <-> 86.136.180.112 7670 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.769157 0.194199 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:24.959087 0.093279 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.043470 0.214546 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.248938 0.126988 udp 10.0.2.105 7010 <-> 2.193.253.81 9511 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.364629 0.079605 udp 10.0.2.105 7010 <-> 88.238.68.87 2925 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.435350 0.194894 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.644066 0.198724 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.844179 0.072200 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.897162 0.101263 udp 10.0.2.105 7010 <-> 2.28.207.123 3547 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:25.967440 0.085566 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:14:26.039156 0.000000 udp 10.0.2.105 7010 -> 72.251.14.73 2321 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:14:34.660475 3.001861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:14:41.668630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:14:44.142218 0.032524 tcp 10.0.2.105 61802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:44.175020 0.032481 tcp 10.0.2.105 61803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:44.207784 0.133315 tcp 10.0.2.105 61804 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:14:49.669623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:15:05.672610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:15:37.678785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:20:16.630220 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 07:20:16.630317 1.353059 tcp 10.0.2.105 61805 -> 200.84.7.244 8038 FSPA* 0 0 14 1639 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:21:41.684489 3.001130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:21:48.692008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:21:56.693275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:22:12.696231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:22:44.702597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:28:48.709052 3.001687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:28:55.715629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:29:03.717686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:29:19.720833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:29:51.726492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:35:55.732793 3.001101 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:36:02.740145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:36:10.741342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:36:26.744238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:36:58.751213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:43:02.756397 3.002364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 07:43:09.763990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:43:17.765483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:43:33.769047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:44:05.774796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:45:03.167594 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 07:45:03.167798 0.000000 udp 10.0.2.105 7010 -> 72.251.14.73 2321 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:45:20.063789 0.032484 tcp 10.0.2.105 61806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:20.096569 0.038622 tcp 10.0.2.105 61807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:20.135440 0.140588 tcp 10.0.2.105 61808 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:20.276617 0.198614 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:45:20.455704 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:45:38.589385 0.032077 tcp 10.0.2.105 61809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:38.621754 0.034289 tcp 10.0.2.105 61810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:38.656491 0.130568 tcp 10.0.2.105 61811 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:38.787710 0.288080 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:45:39.029762 0.000000 udp 10.0.2.105 7010 -> 194.150.233.9 6644 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:45:55.062291 0.031514 tcp 10.0.2.105 61812 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:55.094108 0.037181 tcp 10.0.2.105 61813 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:55.131539 0.131860 tcp 10.0.2.105 61814 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:45:55.264003 0.101608 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:45:55.347056 0.870174 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:45:56.196485 0.083307 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:45:56.243037 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:46:12.577960 0.033747 tcp 10.0.2.105 61815 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:12.611972 0.034616 tcp 10.0.2.105 61816 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:12.646875 0.139194 tcp 10.0.2.105 61817 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:12.786566 0.349323 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.132130 0.099576 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.210581 0.135275 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2556 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.297316 0.107096 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.367322 0.310733 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 4 1291 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.651839 0.060932 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.737868 0.064594 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.783777 0.154465 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:13.888135 0.193797 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:14.073558 0.292852 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:14.357072 0.185080 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:14.573790 0.202661 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:14.692450 0.355728 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:15.066056 0.501223 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 2137 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:34.068704 0.032012 tcp 10.0.2.105 61818 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:34.101060 0.039288 tcp 10.0.2.105 61819 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:34.140636 0.127830 tcp 10.0.2.105 61820 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:34.268981 0.234168 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:34.481687 0.261644 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:34.791928 0.452073 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 3 1099 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.224654 0.295908 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1402 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.485724 0.163723 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.642488 0.066158 udp 10.0.2.105 7010 <-> 86.145.212.99 8059 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.693882 0.231369 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.887718 0.078393 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:35.967484 0.506694 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 5 1807 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.375969 0.159414 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.544026 0.131671 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.635733 0.073354 udp 10.0.2.105 7010 <-> 86.136.180.112 7670 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.715713 0.068425 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.767406 0.110311 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.876121 0.095824 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:36.961978 0.266432 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.215435 0.139013 udp 10.0.2.105 7010 <-> 2.193.253.81 9511 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.332665 0.196162 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.524710 0.071871 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.576126 0.099028 udp 10.0.2.105 7010 <-> 2.28.207.123 3547 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.649267 0.088397 udp 10.0.2.105 7010 <-> 86.161.40.244 7211 CON 0 0 6 2507 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.721371 0.192374 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:46:37.940926 0.000000 udp 10.0.2.105 7010 -> 88.238.68.87 2925 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 07:46:55.248884 0.031948 tcp 10.0.2.105 61821 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:55.281177 0.032733 tcp 10.0.2.105 61822 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:55.314185 0.140936 tcp 10.0.2.105 61823 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:46:55.455630 0.202747 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 07:50:17.990366 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 07:50:17.990539 0.263181 tcp 10.0.2.105 61824 -> 200.84.7.244 8038 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:50:31.897932 0.019887 tcp 10.0.2.105 61824 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/21 07:55:43.784489 2.997541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 07:55:50.788014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:55:58.793347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:56:14.792494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 07:56:46.801048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:02:50.805763 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:02:57.811454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:03:05.813569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:03:21.816729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:03:53.822118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:10:20.831861 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:10:27.839184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:10:35.840897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:10:51.843637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:11:23.849788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:17:11.770101 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 08:17:11.770203 0.056090 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:11.823813 0.095605 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:11.945155 0.251589 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:12.189163 0.682151 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:12.845281 0.000000 udp 10.0.2.105 7010 -> 88.238.68.87 2925 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:17:27.855321 3.002687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:17:29.947583 0.050122 tcp 10.0.2.105 61825 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:29.997960 0.049991 tcp 10.0.2.105 61826 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:30.048230 0.132667 tcp 10.0.2.105 61827 -> 195.113.214.249 443 SRPA* 0 0 33 18094 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:30.181492 0.201820 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.362398 0.219512 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.534500 0.101706 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.616619 0.090189 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.667220 0.170600 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.817723 0.118418 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:30.896529 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:17:34.862765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:17:42.864632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:17:46.430682 0.050675 tcp 10.0.2.105 61828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:46.481640 0.049652 tcp 10.0.2.105 61829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:46.531627 0.135582 tcp 10.0.2.105 61830 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:17:46.667827 0.370711 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.035332 0.132162 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.120487 0.064555 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.165106 0.174673 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.294161 0.191218 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.478027 0.288785 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:47.759135 0.339162 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:48.066569 0.057342 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:48.122803 0.355334 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:48.496474 0.224669 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:48.631571 0.191243 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2067 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:48.831140 0.303005 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:49.095389 0.202314 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:49.289336 0.235667 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:17:49.504869 0.000000 udp 10.0.2.105 7010 -> 86.145.212.99 8059 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:17:58.868134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:18:05.618497 0.050855 tcp 10.0.2.105 61831 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:05.669569 0.051188 tcp 10.0.2.105 61832 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:05.720999 0.137529 tcp 10.0.2.105 61833 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:05.859030 0.228471 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:06.051853 0.104699 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:06.157739 0.442504 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:06.506662 0.258787 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:06.730111 0.171278 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:06.896843 0.148490 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2453 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.042935 0.071523 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.097002 0.122558 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.218177 0.093772 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.302456 0.221384 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.515140 0.120968 udp 10.0.2.105 7010 <-> 2.193.253.81 9511 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:07.630474 0.000000 udp 10.0.2.105 7010 -> 86.136.180.112 7670 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:18:22.672688 0.050202 tcp 10.0.2.105 61834 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:22.723223 0.050621 tcp 10.0.2.105 61835 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:22.774173 0.129511 tcp 10.0.2.105 61836 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:22.904165 0.132971 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:22.996372 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:18:30.873668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:18:41.569550 0.049738 tcp 10.0.2.105 61837 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:41.619549 0.052432 tcp 10.0.2.105 61838 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:41.672234 0.133548 tcp 10.0.2.105 61839 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:18:41.806687 0.185484 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:42.002442 0.196350 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:42.195192 0.074285 udp 10.0.2.105 7010 <-> 86.166.10.243 7431 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:18:42.246616 0.000000 udp 10.0.2.105 7010 -> 2.28.207.123 3547 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:19:00.937729 0.049852 tcp 10.0.2.105 61840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:19:00.987893 0.053211 tcp 10.0.2.105 61841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:19:01.041436 0.132042 tcp 10.0.2.105 61842 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:19:01.174031 0.198946 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:20:31.918385 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 08:20:31.918493 1.332978 tcp 10.0.2.105 61843 -> 200.84.7.244 8038 FSPA* 0 0 15 1693 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:24:34.880690 3.000353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 08:24:41.887018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:24:49.888717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:25:05.891326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:25:37.897683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:31:41.903733 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:31:48.911067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:31:56.912853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:32:12.915732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:32:44.921749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:38:48.927420 3.003373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:38:55.934658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:39:03.936031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:39:19.939723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:39:51.945422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:45:55.952169 3.001040 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 08:46:02.959806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:46:10.960782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:46:26.963309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:46:58.969466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:49:26.481819 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 08:49:26.482016 0.084364 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:49:26.566772 0.000000 udp 10.0.2.105 7010 -> 86.145.212.99 8059 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:49:45.220744 0.086082 tcp 10.0.2.105 61844 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:49:45.307167 0.054001 tcp 10.0.2.105 61845 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:49:45.361421 0.130961 tcp 10.0.2.105 61846 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:49:45.493080 0.000000 udp 10.0.2.105 7010 -> 86.136.180.112 7670 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:50:01.523343 0.044194 tcp 10.0.2.105 61847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:01.567805 0.052871 tcp 10.0.2.105 61848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:01.620949 0.126149 tcp 10.0.2.105 61849 -> 195.113.214.249 443 SRPA* 0 0 26 14958 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:01.747601 0.000000 udp 10.0.2.105 7010 -> 86.161.40.244 7211 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:50:17.024559 0.035972 tcp 10.0.2.105 61850 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:17.060771 0.101106 tcp 10.0.2.105 61851 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:17.162119 0.138058 tcp 10.0.2.105 61852 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:17.300675 0.000000 udp 10.0.2.105 7010 -> 2.28.207.123 3547 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:50:33.258627 0.206972 tcp 10.0.2.105 61853 -> 200.84.7.244 8038 SPA_* 0 0 9 1210 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:35.284070 0.032843 tcp 10.0.2.105 61854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:35.317163 0.033104 tcp 10.0.2.105 61855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:35.350598 0.133755 tcp 10.0.2.105 61856 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:35.484875 0.221995 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:35.707288 0.091164 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:35.798870 0.056384 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:35.855637 0.857277 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:36.713364 0.173735 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:36.887485 0.044354 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:36.932165 0.293815 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:37.226347 0.561179 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:37.787893 0.168190 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:37.956521 0.078457 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.035380 0.049193 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.084957 0.084236 udp 10.0.2.105 7010 <-> 88.34.50.180 6143 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.169565 0.200778 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.370702 0.367266 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.738368 0.183715 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:38.922494 0.286660 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.209808 0.181087 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.391387 0.059545 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.451349 0.232490 udp 10.0.2.105 7010 <-> 190.37.35.209 3980 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.684263 0.168372 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.853040 0.131543 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:39.985044 0.354278 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:40.339728 0.169446 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:40.509597 0.213260 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:40.723293 0.099803 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:40.823533 0.194926 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.018943 0.153949 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.173308 0.109100 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.282879 0.084956 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.368385 0.220683 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.589467 0.049902 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.639803 0.148560 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:41.788732 0.363623 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:50:42.152775 0.000000 udp 10.0.2.105 7010 -> 2.193.253.81 9511 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:50:42.418361 0.023438 tcp 10.0.2.105 61853 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:59.536514 0.141511 tcp 10.0.2.105 61857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:59.678298 0.032774 tcp 10.0.2.105 61858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:59.711294 0.199687 tcp 10.0.2.105 61859 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:50:59.911720 0.211332 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:51:00.123384 0.089370 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:51:00.213134 0.189294 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:51:00.402833 0.187908 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:51:00.591113 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 08:51:19.414395 0.040477 tcp 10.0.2.105 61860 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:51:19.455130 0.034759 tcp 10.0.2.105 61861 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:51:19.490166 0.129848 tcp 10.0.2.105 61862 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 08:51:19.620740 0.199070 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/21 08:53:02.975612 3.001729 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 08:53:09.982728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:53:17.984323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:53:33.987589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 08:54:05.993575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:00:09.999674 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:00:17.007038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:00:25.008828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:00:41.011482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:01:13.017771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:07:25.024933 3.002057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:07:32.032097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:07:40.033969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:07:56.036633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:08:28.043061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:14:32.048295 3.002877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:14:39.056671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:14:47.057797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:15:03.061068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:15:35.067208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:20:42.449397 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 09:20:42.449565 1.286108 tcp 10.0.2.105 61863 -> 200.84.7.244 8038 FSPA* 0 0 15 1719 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:21:28.875570 0.000000 udp 10.0.2.105 7010 -> 2.193.253.81 9511 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:21:33.842632 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 09:21:39.073843 3.000720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 09:21:44.059273 0.050587 tcp 10.0.2.105 61864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:21:44.110139 0.054731 tcp 10.0.2.105 61865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:21:44.165137 0.135599 tcp 10.0.2.105 61866 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:21:44.301303 0.000000 udp 10.0.2.105 7010 -> 86.166.10.243 7431 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:21:46.080645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:21:54.081938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:22:02.264240 0.050693 tcp 10.0.2.105 61867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:02.315254 0.050381 tcp 10.0.2.105 61868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:02.365936 0.126006 tcp 10.0.2.105 61869 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:02.492477 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:22:10.084749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:22:20.110457 0.049833 tcp 10.0.2.105 61870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:20.160594 0.050932 tcp 10.0.2.105 61871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:20.211813 0.136948 tcp 10.0.2.105 61872 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:20.349278 0.051349 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:20.401017 0.102400 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:20.503820 0.220934 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:20.725166 0.344237 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.069882 0.047003 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.117341 0.177524 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.295277 0.069069 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.364761 0.079012 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.444202 0.499693 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:21.944250 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:22:39.828397 0.049507 tcp 10.0.2.105 61873 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:39.878199 0.049542 tcp 10.0.2.105 61874 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:39.928021 0.132357 tcp 10.0.2.105 61875 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:40.060912 0.167636 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:40.228941 0.042101 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:40.271473 0.343421 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:40.615311 0.109290 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:40.725037 0.183191 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:40.908637 0.205695 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:41.114720 0.287133 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:41.402294 0.053868 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:41.456604 0.000000 udp 10.0.2.105 7010 -> 190.37.35.209 3980 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:22:42.091231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:22:57.274015 0.051410 tcp 10.0.2.105 61876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:57.325730 0.051875 tcp 10.0.2.105 61877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:57.377908 0.133710 tcp 10.0.2.105 61878 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:22:57.512136 0.162488 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:57.675089 0.130992 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:57.806458 0.106568 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 203 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:57.913418 0.174941 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.088783 0.353903 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.443068 0.215048 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.658571 0.085040 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.743966 0.152158 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.896488 0.047618 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:58.944463 0.216865 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:59.161742 0.191327 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:59.353437 0.130912 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:59.484986 0.158684 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:22:59.644081 0.356781 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:23:00.001494 0.089427 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:23:00.091315 0.214049 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:23:00.306179 0.189388 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:23:00.496042 0.181630 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:23:00.678032 0.196441 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:28:46.097288 3.002398 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:28:53.103845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:29:01.106142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:29:17.109226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:29:49.114638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:35:53.120812 3.001561 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:36:00.128679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:36:08.129992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:36:24.132991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:36:56.139138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:43:00.144937 3.001695 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 09:43:07.152329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:43:15.153445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:43:31.157367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:44:03.162947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:50:43.739437 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 09:50:43.739589 2.238896 tcp 10.0.2.105 61879 -> 200.84.7.244 8038 FSPA* 0 0 15 1688 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:53:29.947859 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 09:53:29.948100 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:53:47.915353 0.050862 tcp 10.0.2.105 61880 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:53:47.966435 0.050715 tcp 10.0.2.105 61881 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:53:48.017451 0.130759 tcp 10.0.2.105 61882 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:53:48.148792 0.000000 udp 10.0.2.105 7010 -> 88.34.50.180 6143 INT 0 1 103 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:54:03.947617 0.050048 tcp 10.0.2.105 61883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:03.997931 0.051251 tcp 10.0.2.105 61884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:04.049505 0.132670 tcp 10.0.2.105 61885 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:04.182692 0.000000 udp 10.0.2.105 7010 -> 190.37.35.209 3980 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:54:22.974468 0.050912 tcp 10.0.2.105 61886 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:23.025632 0.050107 tcp 10.0.2.105 61887 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:23.076019 0.148017 tcp 10.0.2.105 61888 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:23.224734 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:54:42.141901 0.049720 tcp 10.0.2.105 61889 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:42.191880 0.050138 tcp 10.0.2.105 61890 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:42.242317 0.126167 tcp 10.0.2.105 61891 -> 195.113.214.249 443 SRPA* 0 0 21 11804 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:42.369008 0.329754 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:54:42.699165 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 09:54:59.848113 0.049834 tcp 10.0.2.105 61892 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:59.898219 0.051298 tcp 10.0.2.105 61893 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:54:59.949815 0.138173 tcp 10.0.2.105 61894 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/21 09:55:00.088713 0.180357 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:00.269497 0.072302 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:00.342178 0.221251 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:00.563849 0.144839 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:00.709066 0.614381 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:01.323900 0.083494 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:01.407878 0.169905 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:01.578243 0.048418 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:01.627105 0.372814 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.000374 0.167411 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.168171 0.279201 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.447814 0.178343 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.626566 0.164312 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.791258 0.054843 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.846472 0.119480 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:02.966328 0.076614 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.043306 0.175859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.219560 0.160093 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.380126 0.218367 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.598908 0.090731 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.690039 0.153253 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.843670 0.048314 udp 10.0.2.105 7010 <-> 217.41.46.163 8041 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:03.892533 0.215271 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:04.108197 0.189037 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:04.297696 0.354070 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:04.652192 0.142283 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:04.794811 0.348837 udp 10.0.2.105 7010 <-> 49.144.27.114 9276 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.144032 0.091504 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.235970 0.209810 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.446205 0.118863 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.565440 0.200786 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.766612 0.189275 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:05.956440 0.191103 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/21 09:55:38.178737 2.998652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 09:55:45.181988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:55:53.191373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:56:09.186881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 09:56:41.192758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:02:45.199473 3.001208 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:02:52.205889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:03:00.207718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:03:16.211045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:03:48.216966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:10:16.226985 3.001928 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:10:23.234085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:10:31.235987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:10:47.239134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:11:19.245208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:17:23.251224 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:17:30.258959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:17:38.260138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:17:54.263033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:18:26.269380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:20:45.980301 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 10:20:45.980389 1.279127 tcp 10.0.2.105 61895 -> 200.84.7.244 8038 FSPA* 0 0 15 1659 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:24:30.275109 3.001467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:24:37.282671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:24:45.284029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:25:01.287126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:25:32.251797 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 10:25:32.251972 0.051119 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:32.303545 0.050784 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:32.354738 0.332763 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:32.687922 0.221881 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:32.910201 0.114048 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:33.024641 0.179134 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:33.204257 0.080656 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:33.285389 0.457048 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:33.292796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:25:33.742843 0.079907 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:33.823129 0.354883 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:34.178452 0.240973 udp 10.0.2.105 7010 <-> 99.142.74.60 5819 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:34.419874 0.000000 udp 10.0.2.105 7010 -> 108.73.115.135 7576 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:25:49.548831 0.192048 tcp 10.0.2.105 61896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:25:49.741164 0.055632 tcp 10.0.2.105 61897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:25:49.797087 0.153862 tcp 10.0.2.105 61898 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:25:49.951560 0.041507 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:49.993444 0.142909 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.136769 0.055530 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.192818 0.288361 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.481592 0.183137 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.665097 0.125875 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.791423 0.104219 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:50.896020 0.174654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:51.071078 0.160308 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:51.231777 0.159042 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:25:51.391247 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:26:08.253936 0.083602 tcp 10.0.2.105 61899 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:08.337849 0.054838 tcp 10.0.2.105 61900 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:08.392972 0.685400 tcp 10.0.2.105 61901 -> 195.113.214.249 443 SRPA* 0 0 72 76948 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:09.078869 0.218959 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:09.298157 0.213951 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:09.512524 0.082643 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:09.595555 0.309081 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:09.905007 0.354062 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:10.259525 0.146908 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:10.406813 0.209339 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:10.616548 0.000000 udp 10.0.2.105 7010 -> 49.144.27.114 9276 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:26:27.922136 0.068583 tcp 10.0.2.105 61902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:27.990960 0.054564 tcp 10.0.2.105 61903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:28.045817 0.174281 tcp 10.0.2.105 61904 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:26:28.220630 0.087927 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:28.308926 0.189055 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:28.498375 0.184074 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:28.682832 0.119438 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:26:28.802693 0.201149 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:31:37.298927 3.002199 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 10:31:44.306714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:31:52.313662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:32:08.311067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:32:40.318097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:38:44.323633 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:38:51.331055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:38:59.332119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:39:15.335367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:39:47.341067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:45:51.346693 3.002092 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 10:45:58.354390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:46:06.355899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:46:22.358998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:46:54.365098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:50:47.260922 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 10:50:47.261101 0.211701 tcp 10.0.2.105 61905 -> 200.84.7.244 8038 SPA_* 0 0 9 1208 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:50:55.522126 0.017290 tcp 10.0.2.105 61905 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:56:57.151957 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 10:56:57.152123 0.169159 udp 10.0.2.105 7010 <-> 108.73.115.135 7576 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:56:57.321714 0.000000 udp 10.0.2.105 7010 -> 217.41.46.163 8041 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:57:05.376189 3.001726 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 10:57:12.383551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:57:14.929379 0.052178 tcp 10.0.2.105 61906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:14.981793 0.053993 tcp 10.0.2.105 61907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:15.036302 0.153534 tcp 10.0.2.105 61908 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:15.190460 0.000000 udp 10.0.2.105 7010 -> 49.144.27.114 9276 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:57:20.385171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:57:31.221617 0.049769 tcp 10.0.2.105 61909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:31.271803 0.049420 tcp 10.0.2.105 61910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:31.321483 0.148489 tcp 10.0.2.105 61911 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:31.470621 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:57:36.388368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:57:48.181166 0.052496 tcp 10.0.2.105 61912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:48.233923 0.050520 tcp 10.0.2.105 61913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:48.284733 0.172657 tcp 10.0.2.105 61914 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:57:48.458037 0.048914 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:48.507351 0.079094 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:48.586855 0.179646 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:48.766879 0.333695 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:49.100976 0.100997 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:49.202364 0.214340 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:49.417129 0.082254 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:49.499805 0.680099 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:50.180284 0.350822 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:57:50.531544 0.000000 udp 10.0.2.105 7010 -> 99.142.74.60 5819 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 10:58:06.111496 0.049160 tcp 10.0.2.105 61915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:58:06.161039 0.049250 tcp 10.0.2.105 61916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:58:06.210645 0.148570 tcp 10.0.2.105 61917 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 10:58:06.359742 0.152541 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:06.512685 0.048505 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:06.561585 0.055877 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:06.617863 0.083761 udp 10.0.2.105 7010 <-> 93.177.151.238 4270 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:06.702001 0.170287 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:06.872718 0.158454 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.031566 0.280245 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.312346 0.183727 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.496493 0.125305 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.622191 0.148525 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.771074 0.215061 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:07.986525 0.354241 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:08.341174 0.086884 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:08.394040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 10:58:08.428643 0.212476 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:08.641534 0.193217 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:08.835127 0.210288 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.045811 0.149222 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.195458 0.090295 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.286148 0.118944 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.405530 0.200778 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.606693 0.188977 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/21 10:58:09.796092 0.190770 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:04:12.401821 2.999962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:04:19.410427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:04:27.409566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:04:43.411971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:05:15.417848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:11:19.423984 3.002021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:11:26.431381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:11:34.432758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:11:50.435977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:12:22.442682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:18:27.451784 2.999394 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:18:34.457074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:18:42.458164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:18:58.461363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:19:30.467349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:20:55.540921 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 11:20:55.541017 1.310571 tcp 10.0.2.105 61918 -> 200.84.7.244 8038 FSPA* 0 0 15 1587 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:25:34.473778 3.001387 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:25:41.480798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:25:49.482039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:26:05.485328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:26:37.491413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:28:15.622644 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 11:28:15.622753 0.051030 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:28:15.674186 0.000000 udp 10.0.2.105 7010 -> 99.142.74.60 5819 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:28:33.900512 0.063249 tcp 10.0.2.105 61919 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:33.964078 0.056351 tcp 10.0.2.105 61920 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:34.020730 0.149929 tcp 10.0.2.105 61921 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:34.171225 0.000000 udp 10.0.2.105 7010 -> 108.73.115.135 7576 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:28:52.365657 0.055913 tcp 10.0.2.105 61922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:52.421790 0.055755 tcp 10.0.2.105 61923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:52.477821 0.147263 tcp 10.0.2.105 61924 -> 195.113.214.249 443 SRPA* 0 0 33 18722 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:28:52.625858 0.071934 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:28:52.698161 0.050550 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:28:52.749105 0.335315 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:28:53.084797 0.179267 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:28:53.264468 0.000000 udp 10.0.2.105 7010 -> 194.150.233.9 6644 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:29:11.994097 0.054864 tcp 10.0.2.105 61925 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:12.049289 0.055491 tcp 10.0.2.105 61926 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:12.105090 0.143331 tcp 10.0.2.105 61927 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:12.249093 0.079058 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:12.328729 0.221723 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:12.550825 0.370682 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:12.921854 0.805325 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:13.727587 0.055988 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:13.783938 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:29:30.440696 0.054603 tcp 10.0.2.105 61928 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:30.495544 0.057266 tcp 10.0.2.105 61929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:30.553108 0.146041 tcp 10.0.2.105 61930 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:30.699658 0.098950 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:30.799061 0.047983 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:30.847500 0.176624 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:31.024686 0.170418 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:31.195543 0.277801 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:31.473712 0.153698 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:31.627796 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:29:47.585967 0.054099 tcp 10.0.2.105 61931 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:47.640353 0.059838 tcp 10.0.2.105 61932 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:47.700470 0.140357 tcp 10.0.2.105 61933 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:29:47.841313 0.184079 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:48.025768 0.126258 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:48.152500 0.212334 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:48.365272 0.354341 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:29:48.720016 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 11:30:07.704244 0.053994 tcp 10.0.2.105 61934 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:30:07.758529 0.053613 tcp 10.0.2.105 61935 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:30:07.812464 0.144815 tcp 10.0.2.105 61936 -> 195.113.214.249 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:30:07.957928 0.189024 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.147388 0.210636 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.358443 0.147539 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.506391 0.103747 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.610534 0.193963 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.804896 0.185223 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:08.990485 0.108681 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:30:09.099582 0.197821 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/21 11:32:41.497459 3.001356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 11:32:48.504894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:32:56.506577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:33:12.511882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:33:44.515878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:39:48.522390 3.000792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:39:55.529230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:40:03.530575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:40:19.533278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:40:51.539268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:46:55.545341 3.001840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:47:02.552616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:47:10.554262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:47:26.557921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:47:58.563470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:50:56.861598 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 11:50:56.861755 1.291293 tcp 10.0.2.105 61937 -> 200.84.7.244 8038 FSPA* 0 0 14 1683 flow=From-Botnet-V2-TCP-Established 1970/02/21 11:54:02.569474 3.001577 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 11:54:09.577341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:54:17.578598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:54:33.581391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 11:55:05.587742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:00:22.353094 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:00:22.353203 0.000000 udp 10.0.2.105 7010 -> 108.73.115.135 7576 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:00:38.797687 0.050732 tcp 10.0.2.105 61938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:38.848640 0.049810 tcp 10.0.2.105 61939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:38.898787 0.146428 tcp 10.0.2.105 61940 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:39.045708 0.071781 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:00:39.117844 0.000000 udp 10.0.2.105 7010 -> 93.177.151.238 4270 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:00:57.403652 0.052941 tcp 10.0.2.105 61941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:57.456860 0.050006 tcp 10.0.2.105 61942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:57.507138 0.142710 tcp 10.0.2.105 61943 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:00:57.650413 0.217006 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:00:57.867791 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:01:09.593683 3.001137 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 12:01:16.600642 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:01:16.771115 0.051218 tcp 10.0.2.105 61944 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:16.822680 0.049851 tcp 10.0.2.105 61945 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:16.872922 0.146139 tcp 10.0.2.105 61946 -> 195.113.214.249 443 SRPA* 0 0 27 15012 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:17.019605 0.050230 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.070245 0.179921 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.250589 0.078871 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.329820 0.050575 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.380740 0.465461 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.846532 0.077733 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:17.924647 0.348653 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:18.273740 0.220713 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:18.494844 0.745201 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.240751 0.054510 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.295646 0.167995 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.464029 0.149973 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.614416 0.047546 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.662323 0.175991 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.838721 0.153768 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:19.992898 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:01:24.602205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:01:36.950634 0.048772 tcp 10.0.2.105 61947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:36.999698 0.049776 tcp 10.0.2.105 61948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:37.049780 0.146248 tcp 10.0.2.105 61949 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:37.196680 0.112061 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:37.309148 0.183445 udp 10.0.2.105 7010 <-> 99.108.96.93 8821 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:37.492973 0.211797 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:37.705196 0.354261 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:38.059990 0.188569 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:38.248895 0.210441 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:38.459744 0.191160 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:01:38.651342 0.000000 udp 10.0.2.105 7010 -> 115.252.120.126 6689 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:01:40.605276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:01:56.348375 0.049797 tcp 10.0.2.105 61950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:56.398460 0.050698 tcp 10.0.2.105 61951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:56.449435 0.146178 tcp 10.0.2.105 61952 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:01:56.596119 0.000000 udp 10.0.2.105 7010 -> 134.117.114.115 4253 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:02:12.611412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:02:14.904900 0.050101 tcp 10.0.2.105 61953 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:02:14.955298 0.050130 tcp 10.0.2.105 61954 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:02:15.005681 0.145861 tcp 10.0.2.105 61955 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:02:15.152046 0.213254 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:02:15.365692 0.156390 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:02:15.522484 0.089808 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:08:16.616678 3.002368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 12:08:23.624509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:08:31.626106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:08:47.628970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:09:19.635155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:15:23.641862 3.000988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 12:15:30.648857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:15:38.650324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:15:54.653118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:16:26.669099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:20:58.159896 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:20:58.160082 0.874100 tcp 10.0.2.105 61956 -> 200.84.7.244 8038 FSPA* 0 0 13 1296 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:20:58.592386 0.064947 tcp 10.0.2.105 61957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:20:58.657603 0.054028 tcp 10.0.2.105 61958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:20:58.711890 0.151066 tcp 10.0.2.105 61959 -> 195.113.214.249 443 SRPA* 0 0 46 43020 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:20:59.034391 3.000453 tcp 10.0.2.105 61960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:08.033426 0.000000 tcp 10.0.2.105 61960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:14.033436 0.058109 tcp 10.0.2.105 61961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:14.091809 0.056672 tcp 10.0.2.105 61962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:14.148773 0.147182 tcp 10.0.2.105 61963 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:14.307269 2.999610 tcp 10.0.2.105 61964 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:23.305553 0.000000 tcp 10.0.2.105 61964 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:29.304801 0.057720 tcp 10.0.2.105 61965 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:29.362774 0.062265 tcp 10.0.2.105 61966 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:29.425392 0.145571 tcp 10.0.2.105 61967 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:29.600235 2.998571 tcp 10.0.2.105 61968 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:38.597424 0.000000 tcp 10.0.2.105 61968 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:44.597236 0.053822 tcp 10.0.2.105 61969 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:44.651347 0.052712 tcp 10.0.2.105 61970 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:44.704545 0.144142 tcp 10.0.2.105 61971 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:44.862824 0.423522 tcp 10.0.2.105 61972 -> 200.84.7.244 8038 FSPA* 0 0 13 1296 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:21:45.286552 3.011450 tcp 10.0.2.105 61973 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:21:54.289800 0.000000 tcp 10.0.2.105 61973 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:22:00.278946 3.004638 tcp 10.0.2.105 61974 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:22:09.291791 0.000000 tcp 10.0.2.105 61974 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:22:13.848340 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:22:15.280464 2.994126 tcp 10.0.2.105 61975 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:22:24.283255 0.000000 tcp 10.0.2.105 61975 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:22:30.675239 3.002288 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 12:22:37.682622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:22:45.683729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:23:01.687371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:23:33.692968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:27:30.283845 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:27:30.284026 3.003449 tcp 10.0.2.105 61976 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:27:39.286360 0.000000 tcp 10.0.2.105 61976 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:27:45.286674 0.042539 tcp 10.0.2.105 61977 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:27:45.329512 0.052703 tcp 10.0.2.105 61978 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:27:45.382459 0.169368 tcp 10.0.2.105 61979 -> 195.113.214.249 443 SRPA* 0 0 26 14956 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:27:45.739540 3.000055 tcp 10.0.2.105 61980 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:27:54.738328 0.000000 tcp 10.0.2.105 61980 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:28:00.737978 0.033278 tcp 10.0.2.105 61981 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:00.771564 0.034542 tcp 10.0.2.105 61982 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:00.806466 0.137760 tcp 10.0.2.105 61983 -> 195.113.214.249 443 SRPA* 0 0 24 14848 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:00.954783 3.006639 tcp 10.0.2.105 61984 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:28:09.960031 0.000000 tcp 10.0.2.105 61984 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 12:28:15.949617 0.055399 tcp 10.0.2.105 61985 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:16.005419 0.032236 tcp 10.0.2.105 61986 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:16.037986 0.149188 tcp 10.0.2.105 61987 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:28:16.230335 1.310332 tcp 10.0.2.105 61988 -> 200.84.7.244 8038 FSPA* 0 0 15 1659 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:29:37.699164 3.001505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 12:29:44.706236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:29:52.707750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:30:08.710823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:30:40.717112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:32:19.569347 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:32:19.569496 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:32:35.293253 0.035869 tcp 10.0.2.105 61989 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:35.329441 0.032185 tcp 10.0.2.105 61990 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:35.361956 0.125990 tcp 10.0.2.105 61991 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:35.488695 0.184196 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:35.673255 0.000000 udp 10.0.2.105 7010 -> 134.117.114.115 4253 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:32:51.735741 0.032649 tcp 10.0.2.105 61992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:51.768654 0.032987 tcp 10.0.2.105 61993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:51.801902 0.138022 tcp 10.0.2.105 61994 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:32:51.940582 0.079364 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.020417 0.232256 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.253037 0.048712 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.302150 0.077064 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.379702 0.181057 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.561171 0.063393 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.624963 0.339584 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:52.964930 0.075694 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.041031 0.378861 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.420356 0.221236 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.642086 0.041683 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.684167 0.055175 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.739748 0.159201 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:53.899365 0.110646 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:54.010442 0.067858 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:54.078854 0.156222 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:54.235476 0.215275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:32:54.451136 0.000000 udp 10.0.2.105 7010 -> 99.108.96.93 8821 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 12:33:09.872195 0.032779 tcp 10.0.2.105 61995 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:33:09.905354 0.038096 tcp 10.0.2.105 61996 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:33:09.943741 0.126481 tcp 10.0.2.105 61997 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:33:10.070886 0.126021 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:10.197303 0.211252 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:10.409020 0.189073 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:10.598551 0.354148 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:10.953196 0.283421 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:11.237021 0.190282 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:11.427702 0.085798 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:11.514424 0.200766 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:33:11.715641 0.150719 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/21 12:36:44.723347 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 12:36:51.729757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:36:59.731897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:37:15.738235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:37:47.740956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:43:51.746407 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 12:43:58.754173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:44:06.758857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:44:22.758800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:44:54.764378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:56:06.773675 3.001865 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 12:56:13.781137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:56:21.786162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:56:37.785790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:57:09.791765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 12:58:17.539808 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 12:58:17.539973 0.208967 tcp 10.0.2.105 61998 -> 200.84.7.244 8038 SPA_* 0 0 9 1125 flow=From-Botnet-V2-TCP-Established 1970/02/21 12:58:32.728768 0.008738 tcp 10.0.2.105 61998 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:03:13.797529 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:03:20.805504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:03:28.806497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:03:37.799965 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 13:03:37.800181 0.000000 udp 10.0.2.105 7010 -> 99.108.96.93 8821 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 13:03:44.814579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:03:56.793157 0.044692 tcp 10.0.2.105 61999 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:03:56.838207 0.043507 tcp 10.0.2.105 62000 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:03:56.882079 0.151554 tcp 10.0.2.105 62001 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:03:57.034190 0.184479 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:57.219189 0.132869 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:57.219532 3.035149 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 SPA_* 0 0 48 28997 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:03:57.352678 0.240504 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:57.603587 0.065732 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:57.669728 0.055956 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:57.726071 0.955446 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:58.681926 0.075036 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:58.757416 0.181281 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:58.939300 0.073254 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.012963 0.221937 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.235355 0.048219 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.283984 0.057322 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.341687 0.169456 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.511585 0.094583 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:03:59.606541 0.834348 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:00.441266 0.153045 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:00.594696 0.371035 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:00.966120 0.170581 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:01.137155 0.145866 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:01.283458 0.212432 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:01.496391 0.191062 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:01.687933 0.354209 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:02.042589 0.211756 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:02.254763 0.200580 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:02.455743 0.158669 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:02.614829 0.189258 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:02.742019 4.783579 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 54 44620 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:02.804543 0.119448 udp 10.0.2.105 7010 <-> 80.181.112.4 7430 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:04:07.894172 4.690353 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 31 22858 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:13.273358 4.894257 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 56 44936 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:16.825858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:04:18.333197 4.394976 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 51 40466 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:23.412040 4.828459 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 57 50182 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:28.424737 4.457140 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 82 75508 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:33.569663 4.645006 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 76 61200 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:38.904963 4.878194 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 61 47150 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:44.336452 4.829065 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 44 31544 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:49.349335 4.129222 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 59 52442 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:04:54.758977 4.574428 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 64 54304 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:05:00.025090 4.944011 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 39 29682 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:05:05.649493 4.020334 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 51 43114 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:05:10.946736 4.884430 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 50 36916 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:05:16.508328 4.476836 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 A_PA 0 0 32 23408 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:05:21.668534 4.367864 tcp 10.0.2.105 62002 -> 115.252.120.126 6200 FPA_* 0 0 51 34147 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:10:32.840251 3.000559 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 13:10:39.846479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:10:47.847681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:11:03.850351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:11:35.858965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:17:39.865909 2.998696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:17:46.870118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:17:54.871926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:18:10.874229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:18:42.880912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:24:46.887002 3.002302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:24:53.894188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:25:01.896019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:25:17.899228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:25:49.904898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:28:32.739858 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 13:28:32.740052 1.691335 tcp 10.0.2.105 62003 -> 200.84.7.244 8038 FSPA* 0 0 14 1729 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:31:53.913016 3.000181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:32:00.918889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:32:08.925573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:32:24.922946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:32:56.929386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:34:17.014194 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 13:34:17.014478 0.184405 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.199286 0.075052 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.274752 0.214047 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.489223 0.055669 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.545308 0.056335 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.602037 0.230530 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.832959 0.070543 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:17.903883 0.938731 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:18.843039 0.078786 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:18.922225 0.222744 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.145407 0.048021 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.193804 0.054826 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.249073 0.160019 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.409518 0.091026 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.500962 0.459554 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:19.960891 0.175284 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:20.136550 0.153085 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:20.290016 0.343048 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:20.633493 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 13:34:27.591290 0.000000 udp 10.0.2.105 7010 <- 79.44.241.120 9715 RSP 0 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 13:34:27.591702 0.211428 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:27.803540 0.177462 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:27.981378 0.206538 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:28.188361 0.376177 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:28.564889 0.214682 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:28.780038 0.000000 udp 10.0.2.105 7010 -> 80.181.112.4 7430 INT 0 1 180 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 13:34:43.934889 0.033438 tcp 10.0.2.105 62004 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:34:43.968676 0.032493 tcp 10.0.2.105 62005 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:34:44.001481 0.122299 tcp 10.0.2.105 62006 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:34:44.124283 0.150654 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:34:44.275352 0.188790 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/21 13:39:00.934983 3.001458 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:39:07.942684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:39:15.947170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:39:31.946538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:40:03.953229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:46:07.958152 3.004601 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:46:14.965854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:46:22.967925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:46:38.973489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:47:10.980551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:53:14.984089 2.999980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 13:53:21.990349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:53:29.992029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:53:45.994986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:54:18.000792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 13:58:34.429940 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 13:58:34.430039 0.635140 tcp 10.0.2.105 62007 -> 200.84.7.244 8038 FSPA* 0 0 13 1416 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:34.846189 0.033087 tcp 10.0.2.105 62008 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:34.879494 0.032157 tcp 10.0.2.105 62009 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:34.911924 0.128657 tcp 10.0.2.105 62010 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:35.065399 2.999303 tcp 10.0.2.105 62011 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:58:44.073097 0.000000 tcp 10.0.2.105 62011 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:58:50.062562 0.031177 tcp 10.0.2.105 62012 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:50.094011 0.032271 tcp 10.0.2.105 62013 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:50.126548 0.127082 tcp 10.0.2.105 62014 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:58:50.314589 3.002339 tcp 10.0.2.105 62015 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:58:59.315279 0.000000 tcp 10.0.2.105 62015 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:05.314418 0.032426 tcp 10.0.2.105 62016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:05.347152 0.033193 tcp 10.0.2.105 62017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:05.380589 0.124122 tcp 10.0.2.105 62018 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:05.522874 2.999346 tcp 10.0.2.105 62019 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:14.517694 0.000000 tcp 10.0.2.105 62019 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:20.517266 0.031404 tcp 10.0.2.105 62020 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:20.548932 0.032456 tcp 10.0.2.105 62021 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:20.581654 0.124330 tcp 10.0.2.105 62022 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:20.723164 0.413339 tcp 10.0.2.105 62023 -> 200.84.7.244 8038 FSPA* 0 0 13 1416 flow=From-Botnet-V2-TCP-Established 1970/02/21 13:59:21.136708 3.004162 tcp 10.0.2.105 62024 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:30.139586 0.000000 tcp 10.0.2.105 62024 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:36.128747 3.003888 tcp 10.0.2.105 62025 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:45.131255 0.000000 tcp 10.0.2.105 62025 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 13:59:49.847953 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 13:59:51.129773 2.994372 tcp 10.0.2.105 62026 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:00:00.132852 0.000000 tcp 10.0.2.105 62026 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:00:22.006372 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 14:00:29.013972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:00:37.015397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:00:53.018984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:01:25.024639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:05:06.033251 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 14:05:06.033401 0.000000 udp 10.0.2.105 7010 -> 80.181.112.4 7430 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:05:06.133713 3.003077 tcp 10.0.2.105 62027 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:15.135929 0.000000 tcp 10.0.2.105 62027 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:21.135263 0.032002 tcp 10.0.2.105 62028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:21.167500 0.032624 tcp 10.0.2.105 62029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:21.200416 0.143944 tcp 10.0.2.105 62030 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:21.357830 3.001185 tcp 10.0.2.105 62031 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:22.546963 0.031413 tcp 10.0.2.105 62032 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:22.578680 0.031886 tcp 10.0.2.105 62033 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:22.610796 0.123824 tcp 10.0.2.105 62034 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:22.735295 0.191160 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:22.927027 0.068950 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:22.996640 0.050087 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:23.047146 0.177567 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:23.225123 0.068801 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:23.294312 0.503609 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:23.798296 0.047788 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:23.846476 1.110014 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:24.956911 0.047879 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.005183 0.056811 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.062435 0.222691 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.285531 0.081537 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.367410 0.339206 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.707066 0.163910 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:25.871363 0.149184 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:26.021002 0.138128 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:26.159607 0.169157 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:26.329158 0.365226 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:26.695037 0.192124 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:26.887532 0.200856 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:27.089562 0.205764 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:27.295740 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:05:30.357037 0.000000 tcp 10.0.2.105 62031 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:34.061757 0.000000 udp 10.0.2.105 7010 <- 79.44.241.120 9715 RSP 0 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:05:34.062291 0.354384 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:34.417093 0.214856 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:34.632411 0.156078 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:34.788840 0.191143 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:05:36.356503 0.030912 tcp 10.0.2.105 62035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:36.387732 0.032641 tcp 10.0.2.105 62036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:36.420715 0.124873 tcp 10.0.2.105 62037 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:36.558697 3.002123 tcp 10.0.2.105 62038 -> 77.70.16.3 1237 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:45.559073 0.000000 tcp 10.0.2.105 62038 -> 77.70.16.3 1237 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:05:51.558404 0.031478 tcp 10.0.2.105 62039 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:51.590197 0.032292 tcp 10.0.2.105 62040 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:51.622789 0.127628 tcp 10.0.2.105 62041 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:51.865232 0.511784 tcp 10.0.2.105 62042 -> 200.84.7.244 8038 SPA_* 0 0 9 1001 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:05:57.440320 0.165253 tcp 10.0.2.105 62042 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:07:29.031285 3.000864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 14:07:36.038461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:07:44.040621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:08:00.043537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:08:32.048793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:14:36.054609 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 14:14:43.062023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:14:51.063568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:15:07.066076 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:15:39.072653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:21:43.078767 3.001422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 14:21:50.085922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:21:58.087576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:22:14.090254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:22:46.096773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:28:50.102008 3.002114 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 14:28:57.109932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:29:05.111541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:29:21.114162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:29:53.120663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:35:57.126099 3.001966 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 14:35:57.605293 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 14:35:57.605447 3.003729 tcp 10.0.2.105 62043 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:36:02.512741 0.192004 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:02.851055 0.070282 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:03.033991 0.060874 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:03.091859 0.201088 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:03.271457 0.104008 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:03.422352 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:36:04.134793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:36:06.607462 0.000000 tcp 10.0.2.105 62043 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:36:12.135479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:36:12.608119 0.031791 tcp 10.0.2.105 62044 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:12.640383 0.032546 tcp 10.0.2.105 62045 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:12.673260 0.126028 tcp 10.0.2.105 62046 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:12.865617 3.005180 tcp 10.0.2.105 62047 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:36:21.599439 0.031116 tcp 10.0.2.105 62048 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:21.630789 0.032305 tcp 10.0.2.105 62049 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:21.663415 0.126456 tcp 10.0.2.105 62050 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:21.790435 0.083414 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:21.837458 0.059908 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:21.869411 0.000000 tcp 10.0.2.105 62047 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:36:22.119435 0.233375 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:22.345698 0.092290 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:22.419727 0.825957 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:23.218180 0.070851 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:23.266967 0.406674 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:23.653298 0.168688 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:23.836073 0.165612 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:23.992883 0.206362 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:24.138186 0.184821 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:24.352372 0.382680 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:24.731373 0.223745 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:24.971226 0.203213 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:25.220921 0.220939 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 1999 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:25.434797 0.238049 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:25.652321 0.157159 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:25.826035 0.198121 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2617 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:36:26.020157 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:36:28.117705 0.000134 tcp 10.0.2.105 62047 -> 200.84.7.244 8038 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:28.138494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:36:28.878017 0.000167 tcp 10.0.2.105 62043 -> 200.84.7.244 8038 R_SA 0 0 2 112 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:36:33.380142 0.220848 udp 10.0.2.105 7010 <- 79.44.241.120 9715 RSP 0 0 5 2039 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 14:36:33.380568 0.356012 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/21 14:37:00.144304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:41:27.859943 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 14:41:27.860074 2.993019 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:41:36.862292 0.000000 tcp 10.0.2.105 62051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:41:42.862500 0.032089 tcp 10.0.2.105 62052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:42.894842 0.032641 tcp 10.0.2.105 62053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:42.927767 0.126122 tcp 10.0.2.105 62054 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:43.089520 2.996027 tcp 10.0.2.105 62055 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:41:52.083543 0.000000 tcp 10.0.2.105 62055 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 14:41:58.083793 0.031075 tcp 10.0.2.105 62056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:58.115181 0.032264 tcp 10.0.2.105 62057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:58.147841 0.124532 tcp 10.0.2.105 62058 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:41:58.294650 3.133081 tcp 10.0.2.105 62059 -> 200.84.7.244 8038 SPA_* 0 0 11 1334 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:42:04.790701 0.019037 tcp 10.0.2.105 62059 -> 200.84.7.244 8038 FA_F* 0 0 5 275 flow=From-Botnet-V2-TCP-Established 1970/02/21 14:43:04.150396 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 14:43:11.157962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:43:19.159466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:43:35.162644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:44:07.168896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:55:44.183759 3.001260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 14:55:51.190812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:55:59.192127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:56:15.195436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 14:56:47.201216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:02:51.207162 3.001934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:02:58.216864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:03:06.216140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:03:22.219193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:03:54.225362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:06:35.307213 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 15:06:35.307317 0.609470 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:35.874334 0.198174 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:36.240783 0.087113 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:36.568744 0.187751 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:36.766393 0.056784 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:36.914321 0.109406 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:36.981992 0.091215 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:37.307554 0.058143 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:37.364068 0.232166 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:37.588772 0.067960 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:38.551474 0.098601 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:38.840037 0.375396 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:39.186691 0.831286 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2519 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:39.995858 0.175783 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:40.168838 0.161943 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2001 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:40.365077 0.110353 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:40.632970 0.185788 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:41.531681 0.201895 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:41.768903 0.360022 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:42.125302 0.229130 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:42.358663 0.222351 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:42.572360 0.237395 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:42.786736 0.157804 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:43.326690 0.195855 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:06:43.518287 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 15:06:50.622084 0.050276 udp 10.0.2.105 7010 <- 79.44.241.120 9715 RSP 0 0 5 2137 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 15:06:50.622453 0.355867 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:10:22.238472 2.999048 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:10:29.243168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:10:37.252438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:10:53.248690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:11:25.254401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:12:04.811400 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 15:12:04.811511 3.346271 tcp 10.0.2.105 62060 -> 200.84.7.244 8038 FSPA* 0 0 15 1667 flow=From-Botnet-V2-TCP-Established 1970/02/21 15:17:29.259392 3.002019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:17:36.267124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:17:44.268557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:18:00.271598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:18:32.277449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:24:36.283754 3.001507 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:24:43.291044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:24:51.292661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:25:07.295529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:25:39.301584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:31:43.307673 3.001603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:31:50.315188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:31:58.316328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:32:14.319550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:32:46.328970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:37:00.391156 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 15:37:00.391255 0.269636 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:00.619806 0.193609 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:00.793735 0.073044 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:00.910590 0.189036 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.108930 0.062032 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.167650 0.111877 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.237910 0.096879 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.293414 0.059286 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.351082 0.230489 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.574651 0.371122 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.916655 0.069078 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:01.981103 0.094213 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:02.057578 0.809196 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:02.845248 0.181123 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:03.103668 0.193501 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:03.288864 0.212575 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:03.437213 0.184394 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:03.595473 0.201907 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:03.854776 0.464760 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:04.315760 0.225224 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:04.560175 0.223189 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:04.775919 0.238320 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:04.994794 0.158046 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:05.155609 0.193665 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2577 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:05.361398 0.296857 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/21 15:37:05.601367 0.000000 udp 10.0.2.105 7010 -> 163.15.173.210 1503 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 15:37:23.956860 0.032492 tcp 10.0.2.105 62061 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 15:37:23.989672 0.031676 tcp 10.0.2.105 62062 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 15:37:24.021683 0.124198 tcp 10.0.2.105 62063 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 15:38:50.332180 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:38:57.339092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:39:05.340742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:39:21.343438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:39:53.349692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:42:08.163471 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 15:42:08.163621 2.381298 tcp 10.0.2.105 62064 -> 200.84.7.244 8038 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/21 15:45:57.355511 3.001815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:46:04.363246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:46:12.364540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:46:28.367648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:47:00.373695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:53:04.379532 3.002067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 15:53:11.386952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:53:19.388592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:53:35.391526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 15:54:07.397602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:00:11.402981 3.002364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:00:18.410925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:00:26.412768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:00:42.415364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:01:14.421288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:07:18.427497 3.001584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:07:25.434695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:07:26.186377 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 16:07:26.186551 0.360754 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:26.556803 0.196338 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:26.732407 0.081378 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:26.823096 0.195024 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.019478 0.061578 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.078832 0.111039 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.153906 0.088029 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.201387 0.059551 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.265930 0.309840 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.534010 0.098602 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.614778 0.232579 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:27.840333 0.361424 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:28.174247 0.067166 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:28.224284 0.496205 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:28.700530 0.166858 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:28.883153 0.180851 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:29.125050 0.180621 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:29.260062 0.364319 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:29.620630 0.201790 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:29.823829 0.184698 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:30.012241 0.231670 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:30.244421 0.156690 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:30.394182 0.194657 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:30.584740 0.233726 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:30.798931 0.223919 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:31.016272 0.337847 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:07:33.436601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:07:49.439185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:08:21.445408 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:12:10.545430 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 16:12:10.545589 3.334293 tcp 10.0.2.105 62065 -> 200.84.7.244 8038 FSPA* 0 0 14 1565 flow=From-Botnet-V2-TCP-Established 1970/02/21 16:14:25.450870 3.003250 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:14:32.462304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:14:40.460403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:14:56.463511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:15:28.473301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:21:32.475521 3.001520 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:21:39.483176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:21:47.484658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:22:03.487232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:22:35.496298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:28:39.499226 3.002304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:28:46.507041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:28:54.511702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:29:10.512489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:29:42.518164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:35:46.523151 3.002082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:35:53.530717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:36:01.533151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:36:17.535336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:36:49.541353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:37:50.699667 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 16:37:50.699862 0.072594 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:50.781916 0.362126 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.166135 0.201357 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.345520 0.187952 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.545694 0.061382 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.604092 0.112221 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.679377 0.089929 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.747381 0.059982 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:51.805811 0.466335 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:52.226702 0.094767 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:52.302871 0.066292 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:52.367025 0.229287 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:52.589696 0.359514 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:52.918562 0.264596 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:53.161943 0.165050 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:53.317691 0.375535 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:53.687433 0.200625 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:53.909243 0.183988 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.090622 0.112087 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.181168 0.186022 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.341677 0.227902 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.569853 0.156944 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.722118 0.192642 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:54.910342 0.185415 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:55.035660 0.303023 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:37:55.319089 0.221365 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/21 16:42:13.878216 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 16:42:13.878455 1.505990 tcp 10.0.2.105 62066 -> 200.84.7.244 8038 FSPA* 0 0 15 1594 flow=From-Botnet-V2-TCP-Established 1970/02/21 16:42:53.549266 2.999725 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 16:43:00.554839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:43:08.556584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:43:24.559381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:43:56.565331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:55:35.572515 3.002190 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 16:55:42.580506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:55:50.582161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:56:06.584839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 16:56:38.590906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:02:42.596662 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:02:49.604130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:02:57.605643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:03:13.609119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:03:45.614717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:08:23.183907 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:08:23.184009 0.199509 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:23.364138 0.075756 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:23.439571 0.362216 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:23.958417 0.185035 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.164791 0.060892 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.222964 0.110669 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.293163 0.088801 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.342938 0.060197 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.401337 0.273746 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.633113 0.095532 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.710867 0.063522 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.756369 0.229836 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:24.978662 0.554031 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:25.503398 0.549046 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:26.032430 1.027406 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:27.062614 0.180451 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:27.239222 0.234986 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:27.405810 0.185564 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:27.651155 0.355954 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.006385 0.202265 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.217849 0.230407 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.453503 0.195913 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.648012 0.198583 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.876539 0.172253 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:28.995872 0.398334 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:08:29.373648 0.225192 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:10:13.626483 3.000515 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:10:20.632820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:10:28.634082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:10:44.637309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:11:16.643198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:12:15.388115 0.000326 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:12:15.388523 2.078138 tcp 10.0.2.105 62067 -> 200.84.7.244 8038 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:17:20.649346 3.004010 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:17:27.656962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:17:35.658696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:17:51.661662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:18:23.667347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:24:27.673318 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:24:34.680554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:24:42.682210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:24:58.686266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:25:30.691156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:31:34.696932 3.002065 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:31:41.704990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:31:49.705977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:32:05.709238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:32:37.714960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:38:34.979480 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:38:34.979617 0.365644 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.355960 0.204571 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.538778 0.076094 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.634536 0.182121 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.831315 0.061319 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.889490 0.107282 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:35.958885 0.093044 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.011637 0.068721 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.079026 0.273974 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.310882 0.099821 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.390742 0.312085 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.437486 0.225993 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.656145 0.370475 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:36.998741 0.514012 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:37.493394 0.103235 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:37.585066 0.184686 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:37.753049 0.364913 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:38.126260 0.165355 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:38.292926 0.169599 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:38.459066 0.204085 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:38.661536 0.229044 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:38.854951 0.155904 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:39.006788 0.195816 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:39.198570 0.172422 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:39.318019 0.336531 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:39.633859 0.226456 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/21 17:38:41.722292 3.000455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 17:38:48.729092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:38:56.729947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:39:12.733402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:39:44.739407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:42:17.469309 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:42:17.469407 0.704675 tcp 10.0.2.105 62068 -> 200.84.7.244 8038 FSPA* 0 0 13 1343 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:17.979085 0.032681 tcp 10.0.2.105 62069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:18.012012 0.033296 tcp 10.0.2.105 62070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:18.045571 0.105639 tcp 10.0.2.105 62071 -> 195.113.214.249 443 SRPA* 0 0 34 25630 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:18.174401 2.999689 tcp 10.0.2.105 62072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:42:27.183047 0.000000 tcp 10.0.2.105 62072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:42:33.172175 0.060300 tcp 10.0.2.105 62073 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:33.232730 0.031694 tcp 10.0.2.105 62074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:33.264783 0.124294 tcp 10.0.2.105 62075 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:33.410619 2.995283 tcp 10.0.2.105 62076 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:42:42.404511 0.000000 tcp 10.0.2.105 62076 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:42:48.404464 0.031233 tcp 10.0.2.105 62077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:48.435986 0.032504 tcp 10.0.2.105 62078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:48.468840 0.125134 tcp 10.0.2.105 62079 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:48.608552 0.685680 tcp 10.0.2.105 62080 -> 200.84.7.244 8038 FSPA* 0 0 13 1343 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:42:49.294419 3.004676 tcp 10.0.2.105 62081 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:42:58.297627 0.000000 tcp 10.0.2.105 62081 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:43:04.286213 3.004184 tcp 10.0.2.105 62082 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:43:13.289214 0.000000 tcp 10.0.2.105 62082 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:43:17.845307 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:45:48.748192 2.998936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 17:45:55.752584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:46:03.753830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:46:19.756989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:46:51.763070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:48:19.289766 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 17:48:19.289981 2.993265 tcp 10.0.2.105 62083 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:48:28.291886 0.000000 tcp 10.0.2.105 62083 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:48:34.292182 0.032308 tcp 10.0.2.105 62084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:34.324712 0.031945 tcp 10.0.2.105 62085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:34.357002 0.121825 tcp 10.0.2.105 62086 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:34.488473 2.999551 tcp 10.0.2.105 62087 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:48:43.483530 0.000000 tcp 10.0.2.105 62087 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 17:48:49.483130 0.032238 tcp 10.0.2.105 62088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:49.515622 0.032849 tcp 10.0.2.105 62089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:49.548754 0.122681 tcp 10.0.2.105 62090 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:48:49.687543 1.317409 tcp 10.0.2.105 62091 -> 200.84.7.244 8038 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/21 17:57:03.776314 3.001038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 17:57:10.783226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:57:18.784116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:57:34.787759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 17:58:06.793031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:04:10.799729 3.000918 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:04:17.807158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:04:25.808607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:04:41.811616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:05:13.817910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:08:58.951984 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:08:58.952203 0.000000 udp 10.0.2.105 7010 -> 163.15.173.210 1503 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 18:09:15.617202 0.031825 tcp 10.0.2.105 62092 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:09:15.649327 0.032497 tcp 10.0.2.105 62093 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:09:15.682107 0.126314 tcp 10.0.2.105 62094 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:09:15.808893 0.198060 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:15.985893 0.068894 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.064232 0.195234 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.260966 0.061715 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.319468 0.116030 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.393858 0.088648 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.451253 0.070168 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.520753 0.268583 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.744159 0.099795 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:16.826035 0.359242 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:17.156673 0.062386 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:17.201248 0.230446 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:17.425075 0.407592 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:17.810290 0.184266 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:17.946873 0.186836 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:18.162497 0.364108 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:18.538810 0.158995 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:18.688931 0.228154 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:18.917446 0.152126 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:19.105489 0.197345 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:19.298476 0.181442 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:19.419953 0.183356 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:19.600956 0.199979 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:19.802776 0.236325 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:09:20.018605 0.220927 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:11:17.823740 3.001554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:11:24.831131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:11:32.832686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:11:48.835778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:12:20.841664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:18:25.847990 3.002875 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:18:32.856391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:18:40.859271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:18:51.012959 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:18:51.013066 0.640381 tcp 10.0.2.105 62095 -> 200.84.7.244 8038 FSPA* 0 0 13 1416 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:18:51.439611 0.032779 tcp 10.0.2.105 62096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:18:51.472718 0.032041 tcp 10.0.2.105 62097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:18:51.505033 0.125203 tcp 10.0.2.105 62098 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:18:51.653730 3.004110 tcp 10.0.2.105 62099 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:18:56.863109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:19:00.656788 0.000000 tcp 10.0.2.105 62099 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:06.655723 0.031812 tcp 10.0.2.105 62100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:06.687805 0.031891 tcp 10.0.2.105 62101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:06.719970 0.123012 tcp 10.0.2.105 62102 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:06.855240 3.004465 tcp 10.0.2.105 62103 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:15.858451 0.000000 tcp 10.0.2.105 62103 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:21.858969 0.031600 tcp 10.0.2.105 62104 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:21.890841 0.032290 tcp 10.0.2.105 62105 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:21.923503 0.121674 tcp 10.0.2.105 62106 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:22.056121 1.821667 tcp 10.0.2.105 62107 -> 200.84.7.244 8038 FSPA* 0 0 13 1416 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:19:23.877951 2.995962 tcp 10.0.2.105 62108 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:28.867191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:19:32.883232 0.000000 tcp 10.0.2.105 62108 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:38.871570 2.994076 tcp 10.0.2.105 62109 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:47.864134 0.000000 tcp 10.0.2.105 62109 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:19:52.841708 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:24:53.879452 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:24:53.879629 2.998953 tcp 10.0.2.105 62110 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:25:02.877617 0.000000 tcp 10.0.2.105 62110 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:25:08.877448 0.031943 tcp 10.0.2.105 62111 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:08.909663 0.032667 tcp 10.0.2.105 62112 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:08.942661 0.124722 tcp 10.0.2.105 62113 -> 195.113.214.249 443 SRPA* 0 0 46 43020 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:09.082385 2.997902 tcp 10.0.2.105 62114 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:25:18.079031 0.000000 tcp 10.0.2.105 62114 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:25:24.078651 0.031042 tcp 10.0.2.105 62115 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:24.109966 0.032205 tcp 10.0.2.105 62116 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:24.142457 0.126310 tcp 10.0.2.105 62117 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:24.281704 1.443514 tcp 10.0.2.105 62118 -> 200.84.7.244 8038 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:25:32.872876 3.001872 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 18:25:39.880493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:25:47.882084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:26:03.884491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:26:35.891093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:32:39.896593 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:32:46.903776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:32:54.905584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:33:10.909501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:33:42.915430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:39:43.293754 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:39:43.293874 0.000000 udp 10.0.2.105 7010 -> 163.15.173.210 1503 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 18:39:46.925721 2.997221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:39:53.929193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:40:00.289590 0.033381 tcp 10.0.2.105 62119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:00.323245 0.032893 tcp 10.0.2.105 62120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:00.356476 0.125150 tcp 10.0.2.105 62121 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:00.482399 0.196573 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:00.657999 0.076573 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:00.745646 0.194391 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:00.941985 0.055834 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:00.994990 0.114014 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.072007 0.103271 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.136081 0.060275 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.194607 0.320558 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.473634 0.093655 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.548611 0.360816 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.879917 0.062617 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.922916 0.231683 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:01.929724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:40:02.146331 0.836307 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:02.961737 0.152191 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:03.049667 0.184534 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:03.213017 0.377835 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:03.609928 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 2384 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 18:40:17.933038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:40:19.475847 0.031744 tcp 10.0.2.105 62122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:19.507888 0.031498 tcp 10.0.2.105 62123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:19.539702 0.125696 tcp 10.0.2.105 62124 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:40:19.666451 0.229655 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:19.937052 0.151663 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:20.097307 0.196048 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:20.289308 0.206018 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:20.423590 0.224742 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:20.639468 0.208252 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:20.841724 0.236200 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:21.056318 0.223181 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/21 18:40:49.939192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:46:53.945504 3.001741 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:47:00.952624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:47:08.953834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:47:24.956970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:47:56.962872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:54:00.969094 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 18:54:07.976472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:54:15.978100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:54:31.983334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:55:03.986373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 18:55:25.728414 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 18:55:25.728498 0.317975 tcp 10.0.2.105 62125 -> 200.84.7.244 8038 SPA_* 0 0 9 1044 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:55:56.043024 0.032479 tcp 10.0.2.105 62126 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:55:56.075823 0.032258 tcp 10.0.2.105 62127 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:55:56.108348 0.124014 tcp 10.0.2.105 62128 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:55:56.263059 1.776282 tcp 10.0.2.105 62125 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:55:58.039691 2.999171 tcp 10.0.2.105 62129 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:56:07.037564 0.000000 tcp 10.0.2.105 62129 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:56:13.036880 0.031097 tcp 10.0.2.105 62130 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:13.068272 0.036022 tcp 10.0.2.105 62131 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:13.104650 0.125223 tcp 10.0.2.105 62132 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:13.240950 2.999789 tcp 10.0.2.105 62133 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:56:22.241820 0.000000 tcp 10.0.2.105 62133 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 18:56:28.238920 0.031615 tcp 10.0.2.105 62134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:28.270774 0.032755 tcp 10.0.2.105 62135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:28.303793 0.120954 tcp 10.0.2.105 62136 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:28.544064 0.214545 tcp 10.0.2.105 62137 -> 200.84.7.244 8038 SPA_* 0 0 9 1044 flow=From-Botnet-V2-TCP-Established 1970/02/21 18:56:37.650150 0.025018 tcp 10.0.2.105 62137 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/21 19:01:07.992944 3.001712 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 19:01:15.000179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:01:23.001917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:01:39.004471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:02:11.010715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:08:15.015923 3.002513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:08:22.024196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:08:30.025136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:08:46.028450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:09:18.034696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:10:41.465092 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 19:10:41.465240 0.189822 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:41.648807 0.185954 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.026558 0.056045 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.079833 0.108518 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.276024 0.083859 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.552640 0.058903 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.609932 0.200539 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.790705 0.072009 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:42.864414 0.368518 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:43.205065 0.068657 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:43.255025 0.233412 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:43.480934 0.096685 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:43.563123 1.908195 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:45.428530 0.210862 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:45.779193 0.526319 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:46.286164 0.187402 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:46.502975 0.355068 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:46.853804 0.154873 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:47.019080 0.196024 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:47.210911 0.228779 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:47.400429 0.214542 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:47.645404 0.205261 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:47.847609 0.234844 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:48.061987 0.221116 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:10:48.274675 0.263052 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:15:22.041388 3.001167 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:15:29.048318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:15:37.049590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:15:53.052790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:16:25.059250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:22:29.064339 3.002313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:22:36.072570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:22:44.073598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:23:00.076776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:23:32.082989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:26:37.679856 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 19:26:37.680051 1.427027 tcp 10.0.2.105 62138 -> 200.84.7.244 8038 FSPA* 0 0 14 1666 flow=From-Botnet-V2-TCP-Established 1970/02/21 19:29:36.088438 3.001783 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:29:43.095654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:29:51.097600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:30:07.100644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:30:39.106848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:36:43.112626 3.001152 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:36:50.120046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:36:58.122078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:37:14.124672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:37:46.130612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:40:59.249101 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 19:40:59.249231 0.056344 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.302486 0.114394 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.379809 0.169442 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2553 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.534402 0.191806 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.737100 0.086984 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.787085 0.062327 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:40:59.847587 0.201414 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.029711 0.079473 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.113452 0.234131 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.404461 0.096718 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.482988 0.366947 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.822307 0.063278 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:00.873718 0.265036 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:01.095237 0.209774 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:01.231183 0.291680 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:01.503019 0.152504 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:01.651148 0.184152 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:01.812575 0.391065 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:02.199052 0.194023 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:02.388869 0.223842 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:02.577142 0.180548 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:02.750951 0.220052 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:02.963155 0.232744 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:03.100128 0.202939 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:41:03.313641 0.233917 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 19:43:50.136756 3.001826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:43:57.143929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:44:05.145274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:44:21.148510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:44:53.154375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:56:06.165212 3.003713 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 19:56:13.172753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:56:21.173640 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:56:37.177229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 19:56:39.109928 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 19:56:39.110130 2.207230 tcp 10.0.2.105 62139 -> 200.84.7.244 8038 FSPA* 0 0 14 1741 flow=From-Botnet-V2-TCP-Established 1970/02/21 19:57:09.182903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:03:13.188902 3.001744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:03:20.196197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:03:28.197818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:03:44.200666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:04:16.207079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:10:33.221715 3.008539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:10:40.229087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:10:48.230671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:11:04.233459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:11:31.173314 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 20:11:31.173497 0.061065 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.231618 0.110487 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.303463 0.164626 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.459499 0.179026 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.650665 0.086628 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.698552 0.060921 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.760193 0.201210 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:31.940271 0.071905 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:32.024506 0.231276 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:32.248733 0.153712 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:32.385818 0.382875 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:32.741149 0.067540 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:32.933811 0.284373 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:33.177084 0.110233 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:33.265692 0.187039 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:33.431314 0.384237 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:33.812017 0.199055 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:34.006457 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 20:11:36.239600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:11:52.034609 0.032329 tcp 10.0.2.105 62140 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:11:52.067264 0.032823 tcp 10.0.2.105 62141 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:11:52.100425 0.124229 tcp 10.0.2.105 62142 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:11:52.225332 0.152843 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:52.389016 0.225180 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:52.580438 0.174891 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:52.752150 0.219287 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:52.963325 0.495193 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:53.352827 0.210619 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:11:53.564631 0.233566 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:17:40.245391 3.001904 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:17:47.253119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:17:55.254563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:18:11.257515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:18:43.263760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:24:47.269300 3.002224 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:24:54.277083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:25:02.278701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:25:18.281499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:25:50.287713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:26:41.323584 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 20:26:41.323744 0.644193 tcp 10.0.2.105 62143 -> 200.84.7.244 8038 FSPA* 0 0 13 1317 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:41.757245 0.032734 tcp 10.0.2.105 62144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:41.790470 0.032768 tcp 10.0.2.105 62145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:41.823537 0.124427 tcp 10.0.2.105 62146 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:41.968351 2.997630 tcp 10.0.2.105 62147 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 20:26:50.964608 0.000000 tcp 10.0.2.105 62147 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 20:26:56.964163 0.031953 tcp 10.0.2.105 62148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:56.996521 0.031863 tcp 10.0.2.105 62149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:57.028673 0.122642 tcp 10.0.2.105 62150 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:26:57.186412 3.001568 tcp 10.0.2.105 62151 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 20:27:06.186138 0.000000 tcp 10.0.2.105 62151 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 20:27:12.185856 0.031655 tcp 10.0.2.105 62152 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:27:12.217894 0.032643 tcp 10.0.2.105 62153 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:27:12.250832 0.124562 tcp 10.0.2.105 62154 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:27:12.411211 1.424873 tcp 10.0.2.105 62155 -> 200.84.7.244 8038 FSPA* 0 0 14 1608 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:31:54.303161 2.991980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 20:32:01.300904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:32:09.302245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:32:25.307175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:32:57.311343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:39:01.318737 3.000259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:39:08.324873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:39:16.326281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:39:32.329494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:40:04.335359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:42:06.921754 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 20:42:06.921892 0.634234 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.534795 0.056622 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.588536 0.116321 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.662413 0.188459 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2498 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.860578 0.091827 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.916863 0.060783 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:07.976109 0.202016 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:08.157160 0.074643 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:08.240822 0.241088 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:08.473485 0.100003 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:08.553157 0.230674 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:08.775958 0.548032 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 4 1273 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:09.304618 0.128739 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:09.417618 0.184473 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:09.579959 0.061716 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:09.629061 0.366405 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:09.965455 0.196655 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:10.157563 0.383330 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:10.537429 0.166568 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:10.705648 0.229140 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:10.897191 0.183553 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:11.077911 0.217174 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:11.325879 0.194125 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:11.456653 0.200479 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:42:11.658519 0.234635 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/21 20:46:08.342234 3.000883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:46:15.348769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:46:23.350154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:46:39.353335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:47:11.359111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:53:15.368864 2.998258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 20:53:22.372952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:53:30.373982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:53:46.377089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:54:18.383240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 20:57:13.835903 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 20:57:13.836102 0.341276 tcp 10.0.2.105 62156 -> 200.84.7.244 8038 SPA_* 0 0 9 1209 flow=From-Botnet-V2-TCP-Established 1970/02/21 20:57:27.896021 0.087330 tcp 10.0.2.105 62156 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:00:22.392471 2.998698 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:00:29.397009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:00:37.404935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:00:53.401226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:01:25.407570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:07:29.413965 3.001087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:07:36.420932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:07:44.422595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:08:00.425213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:08:32.431290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:12:33.378169 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 21:12:33.378374 0.566062 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:33.922951 0.056017 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:33.975662 0.115368 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.051399 0.188215 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.241342 0.090493 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.289043 0.059149 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.346786 0.201944 udp 10.0.2.105 7010 <-> 173.202.66.177 7510 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.528152 0.072983 udp 10.0.2.105 7010 <-> 194.150.233.9 6644 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.619786 0.230394 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:34.843391 0.322001 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:35.127491 1.210303 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:36.328923 0.096728 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2451 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:38.227849 0.154564 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:40.546292 0.185845 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:41.010660 0.061668 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:41.954633 0.733031 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:42.662815 0.197553 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:43.001589 0.225813 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:43.861546 0.180513 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:44.038817 0.218512 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:45.074367 0.372763 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:45.546550 0.155334 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:45.705299 0.231735 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:45.943495 0.165609 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:12:46.058885 0.205512 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:14:36.437276 3.001878 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:14:43.444556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:14:51.447100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:15:07.449681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:15:39.455845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:21:43.461129 3.001602 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:21:50.468792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:21:58.473711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:22:14.472946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:22:46.482216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:27:27.983629 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 21:27:27.983833 1.449593 tcp 10.0.2.105 62157 -> 200.84.7.244 8038 FSPA* 0 0 14 1678 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:28:50.486055 3.001475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:28:57.492545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:29:05.493807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:29:21.497200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:29:53.503237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:35:57.509959 3.001489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:36:04.518154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:36:12.518025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:36:28.521376 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:37:00.527363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:42:54.766800 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 21:42:54.766979 0.110476 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:42:54.839638 0.188250 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:42:55.029396 0.540780 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:42:55.549663 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 21:43:04.533102 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:43:11.542550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:43:14.357370 0.031970 tcp 10.0.2.105 62158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:14.389620 0.032861 tcp 10.0.2.105 62159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:14.422895 0.213664 tcp 10.0.2.105 62160 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:14.637182 0.088073 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:14.688329 0.061630 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:14.747795 0.000000 udp 10.0.2.105 7010 -> 173.202.66.177 7510 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 21:43:19.542087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:43:31.139258 0.032442 tcp 10.0.2.105 62161 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:31.171977 0.031823 tcp 10.0.2.105 62162 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:31.204158 0.122624 tcp 10.0.2.105 62163 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:31.327287 0.000000 udp 10.0.2.105 7010 -> 194.150.233.9 6644 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 21:43:35.544748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:43:49.245448 0.031886 tcp 10.0.2.105 62164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:49.277567 0.032206 tcp 10.0.2.105 62165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:49.310080 0.126718 tcp 10.0.2.105 62166 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:43:49.437033 0.232787 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:49.663020 0.456006 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.077077 0.157798 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.228857 0.104806 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.312591 0.179068 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.444051 0.185620 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.604503 0.068957 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:50.654504 0.582407 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:51.209261 0.194719 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:51.399699 0.224899 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:51.590744 0.180195 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:51.767947 0.219400 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:51.979797 0.233588 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:52.192960 0.247187 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:52.345324 0.202992 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:52.562365 0.452646 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:43:53.011505 0.156318 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/21 21:44:07.551365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:55:40.560144 3.001873 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 21:55:47.567299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:55:55.569356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:56:11.572168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:56:43.577874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 21:57:29.434433 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 21:57:29.434595 0.217221 tcp 10.0.2.105 62167 -> 200.84.7.244 8038 SPA_* 0 0 9 1185 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:57:59.649990 0.032972 tcp 10.0.2.105 62168 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:57:59.683225 0.034037 tcp 10.0.2.105 62169 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:57:59.717522 0.134735 tcp 10.0.2.105 62170 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:57:59.866100 0.006793 tcp 10.0.2.105 62167 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:57:59.873186 2.998907 tcp 10.0.2.105 62171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:08.869928 0.000000 tcp 10.0.2.105 62171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:14.869969 0.030916 tcp 10.0.2.105 62172 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:14.901196 0.032151 tcp 10.0.2.105 62173 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:14.933701 0.129157 tcp 10.0.2.105 62174 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:15.085518 2.998524 tcp 10.0.2.105 62175 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:24.092797 0.000000 tcp 10.0.2.105 62175 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:30.081910 0.032766 tcp 10.0.2.105 62176 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:30.114893 0.033264 tcp 10.0.2.105 62177 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:30.148564 0.126503 tcp 10.0.2.105 62178 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:30.294591 0.420097 tcp 10.0.2.105 62179 -> 200.84.7.244 8038 FSPA* 0 0 13 1401 flow=From-Botnet-V2-TCP-Established 1970/02/21 21:58:30.714904 3.001256 tcp 10.0.2.105 62180 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:39.714794 0.000000 tcp 10.0.2.105 62180 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:45.713746 3.004101 tcp 10.0.2.105 62181 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:54.716635 0.000000 tcp 10.0.2.105 62181 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 21:58:59.343571 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:02:47.585896 3.000252 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 22:02:54.596013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:03:02.592834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:03:18.599035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:03:50.601945 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:04:00.718611 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:04:00.718788 3.001888 tcp 10.0.2.105 62182 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 22:04:09.719357 0.000000 tcp 10.0.2.105 62182 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 22:04:15.720033 0.032357 tcp 10.0.2.105 62183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:15.752760 0.032950 tcp 10.0.2.105 62184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:15.785935 0.123561 tcp 10.0.2.105 62185 -> 195.113.214.249 443 SRPA* 0 0 24 13314 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:15.919273 3.003409 tcp 10.0.2.105 62186 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 22:04:24.921559 0.000000 tcp 10.0.2.105 62186 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 22:04:30.920470 0.031581 tcp 10.0.2.105 62187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:30.952468 0.034991 tcp 10.0.2.105 62188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:30.987766 0.124052 tcp 10.0.2.105 62189 -> 195.113.214.249 443 SRPA* 0 0 42 22086 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:04:31.132206 1.334820 tcp 10.0.2.105 62190 -> 200.84.7.244 8038 FSPA* 0 0 14 1614 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:10:16.609704 3.002340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 22:10:23.617071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:10:31.618928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:10:47.622254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:11:19.627769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:14:14.529566 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:14:14.529715 0.055022 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:14.581738 0.000000 udp 10.0.2.105 7010 -> 173.202.66.177 7510 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:14:33.578766 0.033528 tcp 10.0.2.105 62191 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:33.612588 0.034315 tcp 10.0.2.105 62192 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:33.647197 0.200965 tcp 10.0.2.105 62193 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:33.848720 0.000000 udp 10.0.2.105 7010 -> 194.150.233.9 6644 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:14:51.863465 0.031982 tcp 10.0.2.105 62194 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:51.895691 0.032966 tcp 10.0.2.105 62195 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:51.929022 0.126823 tcp 10.0.2.105 62196 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:14:52.056432 0.115142 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:52.131765 0.192397 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:53.520253 0.580267 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:54.917388 4.993287 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3012 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:55.336682 4.787931 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 14 5179 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:55.535824 4.902629 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 14 5521 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:55.692314 0.100189 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:55.773535 0.220985 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:55.987039 0.270100 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:56.214358 0.132550 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:56.305332 0.187063 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:56.475447 0.068890 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:56.578832 0.655893 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:57.208675 0.196097 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:57.400448 0.229289 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:57.636463 0.177483 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:57.810749 0.226313 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:58.029697 0.233088 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:58.242726 0.150617 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:58.347073 0.162227 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:58.512512 0.202734 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:58.736525 0.369923 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:59.137097 0.117108 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 8 3088 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:59.251314 0.172662 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 8 2858 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:59.387910 0.384632 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 8 2925 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:14:59.955345 0.090439 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:00.432142 1.534022 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 2796 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:01.946631 0.155228 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 8 3026 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:02.084065 0.423643 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3154 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:02.500814 0.508938 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 3394 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:02.964900 0.294088 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 8 3087 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:03.211172 0.342184 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 2888 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:03.532472 0.115865 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 3079 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:03.630990 0.388657 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 8 2957 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:04.015596 1.040768 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3086 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:05.027458 0.420133 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 8 3205 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:05.411962 0.328949 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3175 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:05.737874 0.421983 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:06.152933 0.449467 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 2900 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:06.583117 0.410909 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 8 2968 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:06.945005 0.302901 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 8 3039 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:07.245760 0.733840 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 2814 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:07.976831 0.411948 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 8 2964 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:08.407092 0.000000 udp 10.0.2.105 7010 -> 117.206.146.114 1673 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:17.350437 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:22.336480 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:15:23.088051 0.000000 udp 10.0.2.105 7010 -> 62.212.47.101 7176 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:30.809097 0.000000 udp 10.0.2.105 7010 -> 117.204.239.52 5580 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:37.629022 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:43.477320 0.000000 udp 10.0.2.105 7010 -> 198.179.125.51 3837 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:15:48.333771 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:15:51.149004 0.440716 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 8 2984 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:15:51.493188 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:00.060818 0.000000 udp 10.0.2.105 7010 -> 69.205.122.151 1305 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:07.211358 0.000000 udp 10.0.2.105 7010 -> 92.198.65.172 6016 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:14.672052 0.000000 udp 10.0.2.105 7010 -> 80.152.152.209 7819 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:19.339129 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:16:21.552077 0.000000 udp 10.0.2.105 7010 -> 14.97.162.44 9819 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:26.619396 0.000000 udp 10.0.2.105 7010 -> 190.77.125.201 3490 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:34.230309 0.000000 udp 10.0.2.105 7010 -> 144.132.166.12 2755 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:42.752168 0.000000 udp 10.0.2.105 7010 -> 86.96.32.209 9856 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:47.338682 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:16:49.361855 0.000000 udp 10.0.2.105 7010 -> 222.146.182.54 6572 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:16:58.284373 0.000000 udp 10.0.2.105 7010 -> 59.125.219.100 9517 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:04.814081 0.000000 udp 10.0.2.105 7010 -> 2.178.111.71 1632 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:10.602445 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:15.339176 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:17:17.452045 0.000000 udp 10.0.2.105 7010 -> 50.75.207.98 2964 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:23.636161 2.998922 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 22:17:24.003214 1.163751 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 8 3030 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:17:25.368945 0.000000 udp 10.0.2.105 7010 -> 112.208.197.202 1055 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:30.641060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:17:33.645600 0.000000 udp 10.0.2.105 7010 -> 117.213.233.137 6242 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:38.642666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:17:40.885668 0.472228 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 8 2788 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:17:41.374635 0.075848 udp 10.0.2.105 7010 <-> 79.219.113.228 2430 CON 0 0 8 2812 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:17:41.456526 0.116488 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 8 2874 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:17:41.599473 0.000000 udp 10.0.2.105 7010 -> 203.194.103.85 9765 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:45.842275 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:17:49.127961 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:17:54.645619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:17:55.947649 0.000000 udp 10.0.2.105 7010 -> 50.196.99.201 7471 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:04.700128 0.000000 udp 10.0.2.105 7010 -> 50.84.63.126 9414 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:13.012405 0.000000 udp 10.0.2.105 7010 -> 113.106.56.209 4577 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:17.838300 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:18:20.843483 0.425680 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 3 1093 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:18:26.289774 0.000000 udp 10.0.2.105 7010 -> 86.152.66.132 5515 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:26.651667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:18:33.301581 0.000000 udp 10.0.2.105 7010 -> 41.134.100.145 8335 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:39.610072 0.000000 udp 10.0.2.105 7010 -> 93.193.137.149 7662 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:44.337061 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:18:46.469995 0.893461 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 8 3070 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:18:47.363977 1.449911 udp 10.0.2.105 7010 <-> 72.251.8.48 2321 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:18:48.488947 0.000000 udp 10.0.2.105 7010 -> 210.210.158.142 7934 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:18:56.304566 0.689184 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 8 2971 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:18:57.003070 0.000000 udp 10.0.2.105 7010 -> 79.130.12.102 6817 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:03.765080 0.000000 udp 10.0.2.105 7010 -> 203.198.37.65 1784 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:08.342700 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:19:09.703273 0.000000 udp 10.0.2.105 7010 -> 213.161.245.142 6777 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:17.024011 0.000000 udp 10.0.2.105 7010 -> 213.44.79.10 9925 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:25.716505 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:30.934122 0.665113 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 8 3118 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:19:31.619905 0.121017 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 3 1002 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:19:35.841103 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:19:36.752878 0.000000 udp 10.0.2.105 7010 -> 190.72.25.63 2831 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:43.552189 0.000000 udp 10.0.2.105 7010 -> 176.198.66.204 5230 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:49.520943 0.000000 udp 10.0.2.105 7010 -> 187.133.148.143 8063 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:56.090361 0.453652 udp 10.0.2.105 7010 -> 120.139.97.122 3726 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:19:56.544013 0.000000 icmp 120.139.97.122 0x0303 -> 10.0.2.105 0x8e0e URP 192 1 249 flow=Background 1970/02/21 22:20:00.836871 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:20:03.230709 0.000000 udp 10.0.2.105 7010 -> 60.54.70.213 5178 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:11.292151 0.337070 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 8 3033 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:20:11.646528 0.000000 udp 10.0.2.105 7010 -> 70.88.138.242 3550 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:20.285242 0.000000 udp 10.0.2.105 7010 -> 190.113.211.155 8251 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:24.841361 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:20:26.213804 0.000000 udp 10.0.2.105 7010 -> 220.225.217.137 9195 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:33.354170 0.000000 udp 10.0.2.105 7010 -> 212.33.125.131 4724 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:38.401119 0.000000 udp 10.0.2.105 7010 -> 81.137.195.248 2873 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:46.832648 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:51.339515 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:20:53.322835 0.000000 udp 10.0.2.105 7010 -> 80.13.218.234 6144 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:20:58.760253 0.412733 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 8 3233 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:20:59.350306 0.000000 udp 10.0.2.105 7010 -> 74.92.133.179 2367 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:05.951169 0.155053 udp 10.0.2.105 7010 <-> 86.139.181.239 7119 CON 0 0 8 2949 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:21:06.106140 0.000000 udp 10.0.2.105 7010 -> 5.234.78.210 1046 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:13.321298 0.000000 udp 10.0.2.105 7010 -> 80.2.53.164 2262 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:17.838114 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:21:21.043165 0.000000 udp 10.0.2.105 7010 -> 117.241.228.98 6467 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:26.630546 0.411586 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 8 3016 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:21:27.066980 0.000000 udp 10.0.2.105 7010 -> 210.212.176.178 3064 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:35.313512 0.353891 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3189 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:21:35.655558 0.000000 udp 10.0.2.105 7010 -> 95.56.157.31 9202 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:42.533556 0.000000 udp 10.0.2.105 7010 -> 98.220.118.134 8430 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:47.340343 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:21:48.101408 0.000000 udp 10.0.2.105 7010 -> 71.183.134.13 7569 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:21:56.143601 0.000000 udp 10.0.2.105 7010 -> 93.45.127.234 1923 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:02.453440 0.000000 udp 10.0.2.105 7010 -> 2.177.186.48 4373 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:08.501184 0.000000 udp 10.0.2.105 7010 -> 2.228.137.4 4136 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:13.341777 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:22:16.473286 0.000000 udp 10.0.2.105 7010 -> 183.38.193.20 2742 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:23.562862 0.000000 udp 10.0.2.105 7010 -> 79.26.194.78 4544 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:31.973959 0.000000 udp 10.0.2.105 7010 -> 203.198.139.49 1384 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:39.965976 0.000000 udp 10.0.2.105 7010 -> 24.164.71.63 8550 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:44.842630 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:22:48.227863 0.000000 udp 10.0.2.105 7010 -> 79.129.109.136 2212 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:22:56.329768 0.000000 udp 10.0.2.105 7010 -> 101.78.243.31 9892 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:04.763155 0.000000 udp 10.0.2.105 7010 -> 62.18.127.14 8118 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:09.337952 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:23:12.042137 0.000000 udp 10.0.2.105 7010 -> 67.141.45.14 5668 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:20.063657 0.000000 udp 10.0.2.105 7010 -> 84.127.240.99 9519 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:26.662841 0.000000 udp 10.0.2.105 7010 -> 213.175.34.150 7460 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:31.895561 0.000000 udp 10.0.2.105 7010 -> 202.212.22.145 4755 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:36.837418 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:23:37.989232 0.000000 udp 10.0.2.105 7010 -> 79.1.209.142 3264 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:45.400141 0.000000 udp 10.0.2.105 7010 -> 83.220.53.43 9477 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:51.158237 0.315248 udp 10.0.2.105 7010 <-> 99.45.44.111 8496 CON 0 0 8 3146 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:23:51.487490 0.000000 udp 10.0.2.105 7010 -> 80.46.222.162 2431 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:58.138387 0.732602 udp 10.0.2.105 7010 <-> 118.200.33.80 3544 CON 0 0 8 3102 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:23:58.892788 0.117859 udp 10.0.2.105 7010 -> 178.59.23.3 6070 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:23:59.010647 0.000000 icmp 178.59.23.3 0x0303 -> 10.0.2.105 0xb617 URP 192 1 280 flow=Background 1970/02/21 22:24:02.834721 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:24:07.751437 0.862242 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 3124 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:24:08.609343 0.729355 udp 10.0.2.105 7010 <-> 202.171.9.46 9549 CON 0 0 8 2967 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:24:09.358738 0.000000 udp 10.0.2.105 7010 -> 121.128.190.211 4317 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:14.543431 0.000000 udp 10.0.2.105 7010 -> 125.208.137.151 4515 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:23.093748 0.328872 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 8 2866 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:24:23.415174 0.000000 udp 10.0.2.105 7010 -> 59.90.9.135 6391 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:27.841120 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:24:30.657420 3.002399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 22:24:30.985190 0.000000 udp 10.0.2.105 7010 -> 95.137.168.160 1004 INT 0 1 300 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:37.664831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:24:38.132015 0.000000 udp 10.0.2.105 7010 -> 173.212.143.153 8694 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:45.666403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:24:47.008960 0.321470 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 8 3116 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:24:47.358176 0.000000 udp 10.0.2.105 7010 -> 209.48.84.15 5018 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:24:51.835371 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:24:55.631831 0.000000 udp 10.0.2.105 7010 -> 217.190.242.182 3172 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:01.049097 0.000000 udp 10.0.2.105 7010 -> 46.59.139.192 1324 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:01.669951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:25:09.540924 0.000000 udp 10.0.2.105 7010 -> 122.179.160.14 6634 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:14.959182 0.000000 udp 10.0.2.105 7010 -> 24.43.106.173 3874 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:19.835439 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:25:21.518386 0.310734 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 8 2961 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:25:21.824918 0.000000 udp 10.0.2.105 7010 -> 115.115.129.116 9107 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:28.668867 0.808251 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 8 3075 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:25:29.477885 0.579787 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 8 3045 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:25:30.040806 0.112950 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 8 3133 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:25:30.164512 0.000000 udp 10.0.2.105 7010 -> 67.173.14.147 9976 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:33.675539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:25:37.180988 0.000000 udp 10.0.2.105 7010 -> 31.53.3.170 7642 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:43.139225 0.000000 udp 10.0.2.105 7010 -> 81.136.251.125 4169 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:25:47.835655 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:25:51.491326 0.637687 udp 10.0.2.105 7010 <-> 121.174.163.252 4792 CON 0 0 8 3164 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:25:52.146534 0.000000 udp 10.0.2.105 7010 -> 50.29.239.83 8927 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:00.494110 0.000000 udp 10.0.2.105 7010 -> 67.233.78.10 6123 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:07.594167 0.169506 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 8 2983 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:26:07.758396 0.000000 udp 10.0.2.105 7010 -> 12.10.117.18 3708 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:12.341361 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:26:12.972218 0.000000 udp 10.0.2.105 7010 -> 123.243.116.219 8876 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:19.201288 0.000000 udp 10.0.2.105 7010 -> 86.162.159.94 8591 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:25.860671 0.000000 udp 10.0.2.105 7010 -> 218.107.210.2 8379 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:32.400109 0.000000 udp 10.0.2.105 7010 -> 197.237.29.174 3344 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:37.336895 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:26:39.420291 0.345277 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 8 3130 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:26:39.776788 0.000000 udp 10.0.2.105 7010 -> 49.187.75.123 5291 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:48.573235 0.000000 udp 10.0.2.105 7010 -> 103.9.141.1 3104 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:26:55.223295 0.000000 udp 10.0.2.105 7010 -> 122.154.230.98 4882 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:31:37.682280 3.001078 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 22:31:44.689098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:31:52.690284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:32:08.693117 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:32:40.699875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:34:32.470465 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:34:32.470633 1.630749 tcp 10.0.2.105 62197 -> 200.84.7.244 8038 FSPA* 0 0 15 1626 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:38:44.705629 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 22:38:51.712808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:38:59.714213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:39:15.717344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:39:47.723144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:45:51.730457 3.000500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 22:45:58.736927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:46:06.738896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:46:22.741193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:46:54.747484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:57:04.757988 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 22:57:11.764679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:57:18.224117 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 22:57:18.224335 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:57:19.766065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:57:35.420903 0.033007 tcp 10.0.2.105 62198 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:57:35.454173 0.033171 tcp 10.0.2.105 62199 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:57:35.487622 0.129898 tcp 10.0.2.105 62200 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:57:35.618236 0.116876 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:35.696619 0.192817 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:35.769320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 22:57:35.898322 0.087995 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:35.947860 0.063013 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:36.009503 0.163776 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:36.164371 0.880391 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.024581 0.099090 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.101933 0.230951 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.326508 0.264726 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.550134 0.063039 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.624674 0.104102 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.717186 0.185367 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:37.920617 0.196671 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:38.113535 0.452355 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:39.500662 0.229086 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:40.016429 0.181219 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:42.344252 0.219047 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:42.554815 0.234899 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:42.768132 0.225585 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:42.903453 0.152921 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:43.052057 0.350770 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:43.399416 0.202990 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2565 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:43.611917 0.171854 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:43.753832 0.412477 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2552 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:44.122665 0.240691 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:44.350469 0.045225 udp 10.0.2.105 7010 <-> 79.219.113.228 2430 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:44.441010 0.058264 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:44.515194 0.451528 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:44.936243 0.472120 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:45.394269 0.773535 udp 10.0.2.105 7010 <-> 72.251.8.48 2321 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:45.915305 0.354003 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:46.265242 0.333012 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:46.591397 0.227660 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:46.819438 0.190500 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:47.009027 0.215798 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:47.207626 0.096066 udp 10.0.2.105 7010 <-> 86.139.181.239 7119 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:47.925161 0.215917 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:48.138334 0.188222 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:57:48.299527 0.000000 udp 10.0.2.105 7010 -> 118.200.33.80 3544 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 22:58:03.790218 0.032718 tcp 10.0.2.105 62201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:58:03.823184 0.032309 tcp 10.0.2.105 62202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:58:03.855772 0.126819 tcp 10.0.2.105 62203 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/21 22:58:03.983305 0.450057 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:04.407866 0.176950 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:04.558835 0.167726 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:04.719326 0.167013 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:04.864423 0.478163 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:05.275185 0.063537 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:05.339821 0.338158 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:05.605011 0.334765 udp 10.0.2.105 7010 <-> 121.174.163.252 4792 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:05.941059 0.110360 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:06.035746 0.177841 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/21 22:58:07.774964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:04:11.781192 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 23:04:18.788853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:04:26.789964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:04:34.100805 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:04:34.100957 0.662719 tcp 10.0.2.105 62204 -> 200.84.7.244 8038 FSPA* 0 0 13 1264 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:34.526009 0.032977 tcp 10.0.2.105 62205 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:34.559238 0.033246 tcp 10.0.2.105 62206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:34.592787 0.138855 tcp 10.0.2.105 62207 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:34.763948 3.001393 tcp 10.0.2.105 62208 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:04:42.792699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:04:43.764540 0.000000 tcp 10.0.2.105 62208 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:04:49.763796 0.032641 tcp 10.0.2.105 62209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:49.796849 0.032926 tcp 10.0.2.105 62210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:49.830056 0.127971 tcp 10.0.2.105 62211 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:04:49.972484 2.995081 tcp 10.0.2.105 62212 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:04:58.965815 0.000000 tcp 10.0.2.105 62212 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:05:04.965491 0.032006 tcp 10.0.2.105 62213 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:05:04.997784 0.031742 tcp 10.0.2.105 62214 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:05:05.029756 0.129235 tcp 10.0.2.105 62215 -> 195.113.214.249 443 SRPA* 0 0 22 11784 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:05:05.185180 0.434503 tcp 10.0.2.105 62216 -> 200.84.7.244 8038 FSPA* 0 0 13 1264 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:05:05.619913 3.000491 tcp 10.0.2.105 62217 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:05:14.618874 0.000000 tcp 10.0.2.105 62217 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:05:14.799259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:05:20.617443 3.004271 tcp 10.0.2.105 62218 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:05:29.620544 0.000000 tcp 10.0.2.105 62218 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:05:34.337098 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:10:35.620920 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:10:35.621018 2.993502 tcp 10.0.2.105 62219 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:10:44.623339 0.000000 tcp 10.0.2.105 62219 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:10:50.623822 0.035935 tcp 10.0.2.105 62220 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:10:50.660048 0.035240 tcp 10.0.2.105 62221 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:10:50.695678 0.128905 tcp 10.0.2.105 62222 -> 195.113.214.249 443 SRPA* 0 0 23 11914 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:10:50.834577 3.001816 tcp 10.0.2.105 62223 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:10:59.834964 0.000000 tcp 10.0.2.105 62223 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:11:05.834481 0.030825 tcp 10.0.2.105 62224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:11:05.865647 0.038356 tcp 10.0.2.105 62225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:11:05.904259 0.125932 tcp 10.0.2.105 62226 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:11:06.040607 1.908629 tcp 10.0.2.105 62227 -> 200.84.7.244 8038 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:11:18.804886 3.001831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 23:11:25.812621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:11:33.814017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:11:49.817251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:12:21.823107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:18:27.832502 3.000998 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 23:18:34.839453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:18:42.841082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:18:58.843809 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:19:30.849773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:25:34.856308 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 23:25:41.862752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:25:49.864876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:26:05.867712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:26:37.873295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:28:18.238741 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:28:18.238950 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:28:36.896046 0.033111 tcp 10.0.2.105 62228 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:36.929425 0.097075 tcp 10.0.2.105 62229 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:37.026789 0.130204 tcp 10.0.2.105 62230 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:37.157513 0.000000 udp 10.0.2.105 7010 -> 118.200.33.80 3544 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:28:52.698590 0.031360 tcp 10.0.2.105 62231 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:52.730243 0.035110 tcp 10.0.2.105 62232 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:52.765620 0.135136 tcp 10.0.2.105 62233 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:28:52.901312 0.110276 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:52.975744 0.061068 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:53.046018 0.167952 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:53.201666 0.189219 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:53.392780 0.081089 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:53.437163 0.638216 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.056164 0.279318 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.296671 0.070251 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.350422 0.130442 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.459191 0.232445 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.684015 0.100552 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.767199 0.186541 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:54.975225 0.197426 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:55.168523 0.579405 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:55.718175 0.227340 udp 10.0.2.105 7010 <-> 174.91.167.145 6960 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:55.911790 0.175036 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.083854 0.174748 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.204693 0.152168 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.373527 0.220323 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.586452 0.235216 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.801887 0.217851 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:56.919307 0.201806 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:57.120631 0.361292 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:57.481102 0.046585 udp 10.0.2.105 7010 <-> 79.219.113.228 2430 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:57.524069 0.252250 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:57.778223 0.412650 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:58.145020 0.061021 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:28:58.214803 0.000000 udp 10.0.2.105 7010 -> 2.184.245.140 4768 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:29:16.031670 0.032488 tcp 10.0.2.105 62234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:16.064526 0.033316 tcp 10.0.2.105 62235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:16.098154 0.132697 tcp 10.0.2.105 62236 -> 195.113.214.249 443 SRPA* 0 0 25 14904 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:16.231483 0.444039 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:16.660977 0.360523 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:17.018205 0.000000 udp 10.0.2.105 7010 -> 72.251.8.48 2321 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:29:32.875930 0.031441 tcp 10.0.2.105 62237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:32.907568 0.035434 tcp 10.0.2.105 62238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:32.943280 0.125836 tcp 10.0.2.105 62239 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:33.069607 0.335730 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:33.398412 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:29:51.062187 0.033190 tcp 10.0.2.105 62240 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:51.095672 0.033360 tcp 10.0.2.105 62241 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:51.129358 0.128659 tcp 10.0.2.105 62242 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:29:51.258496 0.187735 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:51.445412 0.219843 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:51.646187 0.185821 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:51.803627 0.215343 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:29:52.015354 0.000000 udp 10.0.2.105 7010 -> 86.139.181.239 7119 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/21 23:30:10.119732 0.032080 tcp 10.0.2.105 62243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:30:10.152114 0.032689 tcp 10.0.2.105 62244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:30:10.185058 0.135211 tcp 10.0.2.105 62245 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:30:10.320735 0.446763 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:10.743685 0.161598 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:10.882320 0.176311 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:11.035889 0.188075 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:11.216612 0.955271 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:12.122249 0.063461 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:12.209385 0.351427 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:12.494258 0.174282 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:12.669982 0.328228 udp 10.0.2.105 7010 <-> 121.174.163.252 4792 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:30:13.018532 0.103339 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/21 23:32:41.879940 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 23:32:48.887061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:32:56.889297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:33:12.891411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:33:44.897925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:39:48.903925 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 23:39:55.911607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:40:03.912886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:40:19.915238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:40:51.922044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:41:07.954985 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:41:07.955158 0.216565 tcp 10.0.2.105 62246 -> 200.84.7.244 8038 SPA_* 0 0 9 1139 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:38.170659 0.033473 tcp 10.0.2.105 62247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:38.204431 0.032304 tcp 10.0.2.105 62248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:38.237100 0.127604 tcp 10.0.2.105 62249 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:38.388203 0.005396 tcp 10.0.2.105 62246 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:38.393872 3.009414 tcp 10.0.2.105 62250 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:41:47.413704 0.000000 tcp 10.0.2.105 62250 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:41:53.390810 0.033839 tcp 10.0.2.105 62251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:53.424976 0.034744 tcp 10.0.2.105 62252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:53.460001 0.140748 tcp 10.0.2.105 62253 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:41:53.612096 2.992396 tcp 10.0.2.105 62254 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:02.603545 0.000000 tcp 10.0.2.105 62254 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:08.612517 0.031419 tcp 10.0.2.105 62255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:42:08.644185 0.032027 tcp 10.0.2.105 62256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:42:08.676480 0.127006 tcp 10.0.2.105 62257 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:42:09.198020 0.421505 tcp 10.0.2.105 62258 -> 200.84.7.244 8038 FSPA* 0 0 13 1355 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:42:09.619747 2.997976 tcp 10.0.2.105 62259 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:18.616476 0.000000 tcp 10.0.2.105 62259 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:24.615008 3.004226 tcp 10.0.2.105 62260 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:33.617893 0.000000 tcp 10.0.2.105 62260 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:42:38.334814 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:46:55.927603 3.001958 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/21 23:47:02.934944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:47:10.936763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:47:26.939667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:47:39.618549 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/21 23:47:39.618696 3.006824 tcp 10.0.2.105 62261 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:47:48.620663 0.000000 tcp 10.0.2.105 62261 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:47:54.621113 0.032346 tcp 10.0.2.105 62262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:47:54.653730 0.031817 tcp 10.0.2.105 62263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:47:54.685826 0.128744 tcp 10.0.2.105 62264 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:47:54.885179 2.998473 tcp 10.0.2.105 62265 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:47:58.945416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:48:03.892918 0.000000 tcp 10.0.2.105 62265 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/21 23:48:09.882184 0.032254 tcp 10.0.2.105 62266 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:48:09.914723 0.032669 tcp 10.0.2.105 62267 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:48:09.947707 0.131827 tcp 10.0.2.105 62268 -> 195.113.214.249 443 SRPA* 0 0 26 13498 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:48:10.090108 1.663082 tcp 10.0.2.105 62269 -> 200.84.7.244 8038 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/21 23:54:02.952206 3.001493 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/21 23:54:09.959361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:54:17.963237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:54:33.963622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/21 23:55:05.969493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:00:36.555211 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 00:00:36.555333 0.451524 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:00:36.971351 0.000000 udp 10.0.2.105 7010 -> 72.251.8.48 2321 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:00:53.140896 0.032118 tcp 10.0.2.105 62270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:00:53.173278 0.041578 tcp 10.0.2.105 62271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:00:53.215135 0.134237 tcp 10.0.2.105 62272 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:00:53.349986 0.126971 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:00:53.455313 0.000000 udp 10.0.2.105 7010 -> 86.139.181.239 7119 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:01:09.682945 0.038167 tcp 10.0.2.105 62273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:09.721398 0.032712 tcp 10.0.2.105 62274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:09.754434 0.128648 tcp 10.0.2.105 62275 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:09.883809 0.157793 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:09.977152 3.000225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 00:01:10.035175 0.061862 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.095444 0.318580 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.375274 0.192867 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.570138 0.068251 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.698145 0.193916 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.870898 0.088285 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:10.920692 0.313100 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.193802 0.231235 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.418941 0.107081 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.506203 0.185385 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.703138 0.162573 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.807066 0.196821 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:11.998363 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:01:16.983304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:01:24.984732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:01:29.182019 0.032644 tcp 10.0.2.105 62276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:29.214945 0.032926 tcp 10.0.2.105 62277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:29.248138 0.129108 tcp 10.0.2.105 62278 -> 195.113.214.249 443 SRPA* 0 0 42 37026 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:29.378017 0.181043 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:29.555711 0.820993 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 1776 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:30.355901 0.153008 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2575 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:30.780109 0.384533 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:31.005076 0.220217 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:31.342503 0.203676 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:31.917765 0.203673 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:32.454387 0.234056 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:32.669121 0.417960 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:33.035958 0.434107 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:33.586679 0.000000 udp 10.0.2.105 7010 -> 79.219.113.228 2430 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:01:40.987417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:01:51.263429 0.032758 tcp 10.0.2.105 62279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:51.296494 0.034175 tcp 10.0.2.105 62280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:51.330935 0.137439 tcp 10.0.2.105 62281 -> 195.113.214.249 443 SRPA* 0 0 41 22070 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:01:51.469032 0.351818 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:51.816655 0.061331 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:52.047858 0.452315 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:52.484054 0.354170 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:52.834573 0.342400 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:53.169835 0.189475 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:53.325855 0.231842 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:53.554018 0.210481 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:53.745453 0.189352 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:53.933665 0.326219 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:54.237072 0.180941 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:54.439163 0.185657 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:54.617749 0.532687 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:55.129879 0.063531 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:55.191832 0.481963 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:55.614301 0.327735 udp 10.0.2.105 7010 <-> 121.174.163.252 4792 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:55.957644 0.095392 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:56.036545 0.393760 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:01:56.360257 0.170410 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:02:12.993574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:08:16.999565 3.001854 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 00:08:24.006812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:08:32.008777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:08:48.011533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:09:20.017441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:15:24.023997 3.001359 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 00:15:31.031059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:15:39.033005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:15:55.035540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:16:27.041983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:18:11.752950 0.000135 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 00:18:11.753164 0.210193 tcp 10.0.2.105 62282 -> 200.84.7.244 8038 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:22.284820 0.232740 tcp 10.0.2.105 62282 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:22.286873 0.032569 tcp 10.0.2.105 62283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:22.319679 0.033403 tcp 10.0.2.105 62284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:22.353307 0.130135 tcp 10.0.2.105 62285 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:22.517839 3.004011 tcp 10.0.2.105 62286 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 00:18:31.520977 0.000000 tcp 10.0.2.105 62286 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 00:18:37.519817 0.031894 tcp 10.0.2.105 62287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:37.551963 0.033426 tcp 10.0.2.105 62288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:37.585643 0.126247 tcp 10.0.2.105 62289 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:37.724898 2.998634 tcp 10.0.2.105 62290 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 00:18:46.732533 0.000000 tcp 10.0.2.105 62290 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 00:18:52.721946 0.033853 tcp 10.0.2.105 62291 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:52.756077 0.034431 tcp 10.0.2.105 62292 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:52.790825 0.132125 tcp 10.0.2.105 62293 -> 195.113.214.249 443 SRPA* 0 0 24 13220 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:18:53.008826 0.214791 tcp 10.0.2.105 62294 -> 200.84.7.244 8038 SPA_* 0 0 9 1166 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:19:00.560609 0.028210 tcp 10.0.2.105 62294 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:22:33.050695 3.001344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 00:22:40.058861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:22:48.059374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:23:04.064935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:23:36.068696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:29:40.074848 3.000627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 00:29:47.081970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:29:55.084617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:30:11.085920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:30:43.092641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:32:04.850561 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 00:32:04.850781 0.000000 udp 10.0.2.105 7010 -> 174.91.167.145 6960 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:32:20.113783 0.034715 tcp 10.0.2.105 62295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:20.148853 0.034936 tcp 10.0.2.105 62296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:20.184085 0.125308 tcp 10.0.2.105 62297 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:20.309902 0.000000 udp 10.0.2.105 7010 -> 79.219.113.228 2430 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:32:35.725194 0.031694 tcp 10.0.2.105 62298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:35.757190 0.033053 tcp 10.0.2.105 62299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:35.790534 0.130653 tcp 10.0.2.105 62300 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:32:35.921754 0.453983 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.334904 0.107454 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.422102 0.161989 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.598922 0.081888 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.682427 0.089548 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.734629 0.188578 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.924732 0.111870 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:36.995816 0.068156 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:37.045787 0.831829 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:37.857851 0.104931 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:37.942224 0.224321 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:38.158902 0.270774 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:38.386491 0.185061 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:38.600891 0.265526 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:38.798455 0.195216 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:38.989712 0.180282 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:39.166917 0.558874 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:39.697940 0.175729 udp 10.0.2.105 7010 <-> 79.44.241.120 9715 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:39.945321 0.154112 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:40.096844 0.218710 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:40.308094 0.203876 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:40.432040 0.510801 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:40.850174 0.233971 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:41.065837 0.202043 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:41.269229 0.252473 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:41.525531 0.442897 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:41.983871 0.061221 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2544 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:42.069011 0.872908 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:42.927258 0.406926 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:32:43.329883 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:33:01.942715 0.033357 tcp 10.0.2.105 62301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:01.976420 0.032756 tcp 10.0.2.105 62302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:02.009503 0.131976 tcp 10.0.2.105 62303 -> 195.113.214.249 443 SRPA* 0 0 39 20504 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:02.141685 0.189089 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:02.303982 0.227655 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:02.528133 0.210244 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:02.719557 0.169645 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:02.888306 0.344061 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:03.253410 0.175463 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:03.405704 0.172652 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:03.571274 0.448604 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:03.995910 0.063185 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:04.057227 0.092440 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:04.132747 0.316027 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:04.379022 0.795115 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:33:05.106525 0.000000 udp 10.0.2.105 7010 -> 121.174.163.252 4792 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 00:33:20.940194 0.031679 tcp 10.0.2.105 62304 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:20.972129 0.034716 tcp 10.0.2.105 62305 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:21.007156 0.129507 tcp 10.0.2.105 62306 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:33:21.137200 0.168848 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/22 00:36:47.098026 3.002314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 00:36:54.105839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:37:02.107219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:37:18.110143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:37:50.116099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:43:54.122301 3.002104 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 00:44:01.129734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:44:09.131390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:44:25.134004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:44:57.140736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:49:00.593357 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 00:49:00.593535 1.457904 tcp 10.0.2.105 62307 -> 200.84.7.244 8038 FSPA* 0 0 14 1670 flow=From-Botnet-V2-TCP-Established 1970/02/22 00:56:07.146532 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 00:56:14.153586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:56:22.155303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:56:38.158017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 00:57:10.164241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:03:14.180086 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:03:21.187598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:03:29.189423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:03:45.198000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:03:49.468938 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 01:03:49.469102 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:04:07.155464 0.032673 tcp 10.0.2.105 62308 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:07.188478 0.053976 tcp 10.0.2.105 62309 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:07.242782 0.135800 tcp 10.0.2.105 62310 -> 195.113.214.249 443 SRPA* 0 0 23 11838 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:07.379242 0.000000 udp 10.0.2.105 7010 -> 121.174.163.252 4792 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:04:17.198243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:04:23.728415 0.032317 tcp 10.0.2.105 62311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:23.761050 0.035515 tcp 10.0.2.105 62312 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:23.796859 0.141173 tcp 10.0.2.105 62313 -> 195.113.214.249 443 SRPA* 0 0 73 67140 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:23.938714 0.449411 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.352765 0.061846 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.412829 0.093341 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.466858 0.188194 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.656604 0.105803 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.726418 0.068676 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.776616 0.162727 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:24.939797 0.097015 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:25.017875 0.262428 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:25.240122 0.233629 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2515 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:25.466020 0.852981 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:26.296748 0.096979 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:26.373922 0.195880 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:26.567834 0.186790 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:26.738214 0.211934 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:26.890193 0.186275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:27.070641 0.220209 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:27.283071 0.702349 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:27.957379 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:04:45.609775 0.031642 tcp 10.0.2.105 62314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:45.641716 0.033315 tcp 10.0.2.105 62315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:45.675350 0.138386 tcp 10.0.2.105 62316 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:04:45.814265 0.153052 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2058 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:45.963195 0.202222 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:46.175215 0.272768 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:46.297039 0.411817 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:46.661051 0.234120 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:46.874559 0.625235 udp 10.0.2.105 7010 <-> 58.68.71.106 4499 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:04:47.468789 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:05:04.136215 0.032197 tcp 10.0.2.105 62317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:05:04.168700 0.033769 tcp 10.0.2.105 62318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:05:04.202782 0.134805 tcp 10.0.2.105 62319 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:05:04.338407 0.064007 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:04.410461 0.475680 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:04.882688 0.502734 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:05.369690 0.180102 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:05.522333 0.189347 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:05.709845 0.168114 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:05.870656 0.175941 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:06.023165 0.215365 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:06.234559 0.214518 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:06.431577 0.169664 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:06.584220 0.310152 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2033 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:06.828886 0.182379 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:07.003473 0.449893 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:07.432090 0.064027 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:07.494772 0.438484 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:05:07.874216 0.174951 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:10:32.210598 3.001002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 01:10:39.217671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:10:47.219019 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:11:03.222065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:11:35.228049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:17:39.234358 3.001229 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:17:46.241965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:17:54.243290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:18:10.245383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:18:42.251820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:19:02.060750 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 01:19:02.060911 4.572747 tcp 10.0.2.105 62320 -> 200.84.7.244 8038 FSPA* 0 0 15 1610 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:24:46.258035 3.003123 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:24:53.265753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:25:01.266910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:25:17.269922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:25:49.275966 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:31:53.282673 3.000937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:32:00.289386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:32:08.291611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:32:24.293826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:32:56.300113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:35:14.939679 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 01:35:14.939854 0.000000 udp 10.0.2.105 7010 -> 79.44.241.120 9715 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:35:32.167191 0.038550 tcp 10.0.2.105 62321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:32.206027 0.035928 tcp 10.0.2.105 62322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:32.242314 0.135813 tcp 10.0.2.105 62323 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:32.378690 0.371346 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:32.746076 0.110975 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:32.819098 0.061709 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:32.884683 0.085472 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:32.931773 0.058190 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:32.988506 0.448000 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:33.400786 0.188288 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:33.590432 0.229548 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:33.812623 0.164845 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:33.968906 0.204049 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 4 1365 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:34.163841 0.272379 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:34.391912 0.825295 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:35.195262 0.197392 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:35.388264 0.101951 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:35.472355 0.180042 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:35.649551 0.176250 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:35.796220 0.224632 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:36.013185 0.188861 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:36.205373 0.363793 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:36.540137 0.148552 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:36.684208 0.397057 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:37.049712 0.234630 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:37.264879 0.201542 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:37.467881 0.295151 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:37.633453 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 01:35:56.169213 0.091635 tcp 10.0.2.105 62324 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:56.261227 0.035671 tcp 10.0.2.105 62325 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:56.297190 0.128677 tcp 10.0.2.105 62326 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:35:56.426393 0.061101 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:56.508013 0.353068 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:56.857199 0.508532 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:57.349751 0.185561 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:57.507171 0.168232 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:57.676422 0.170631 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:57.870999 0.175546 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:58.025197 0.229315 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:58.250414 0.314416 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:58.494786 0.165935 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:58.653276 0.446850 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:59.078297 0.062997 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:59.184604 0.222738 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:59.388483 0.100600 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:59.473768 0.396977 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 4 1379 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:35:59.859075 0.183980 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/22 01:39:00.306028 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 01:39:07.313357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:39:15.314859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:39:31.318379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:40:03.323777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:46:07.329944 3.001700 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:46:14.337206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:46:22.338790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:46:38.342086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:47:10.347972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:49:06.635300 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 01:49:06.635504 1.658628 tcp 10.0.2.105 62327 -> 200.84.7.244 8038 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/22 01:53:14.354101 3.001369 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 01:53:21.361629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:53:29.363001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:53:45.365785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 01:54:17.371592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:00:21.378232 3.001326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 02:00:28.385176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:00:36.386664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:00:52.389770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:01:24.395902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:06:13.513493 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:06:13.513662 0.000000 udp 10.0.2.105 7010 -> 58.68.71.106 4499 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:06:30.998314 0.066833 tcp 10.0.2.105 62328 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:31.065479 0.058206 tcp 10.0.2.105 62329 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:31.124169 0.169439 tcp 10.0.2.105 62330 -> 195.113.214.249 443 SRPA* 0 0 35 25063 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:31.294252 0.064544 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:31.340064 0.085048 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:31.399828 0.061919 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:31.459697 0.370579 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:31.826684 0.115628 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:31.905509 0.231395 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:32.129343 0.160949 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:32.284454 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:06:49.774217 0.059800 tcp 10.0.2.105 62331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:49.834312 0.065673 tcp 10.0.2.105 62332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:49.900468 0.155559 tcp 10.0.2.105 62333 -> 195.113.214.249 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:06:50.056984 0.448333 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:50.468912 0.189030 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:50.659498 0.084246 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:50.721222 0.264799 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:50.946247 0.196488 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:51.156849 0.244583 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:51.382352 0.219997 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:51.595383 0.183556 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:52.095232 0.180518 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:52.272165 0.108645 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:52.362042 0.586864 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:52.941168 0.150379 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:53.113058 0.486127 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:53.572041 0.233812 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:53.785108 0.200453 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:54.042003 0.297207 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:54.159528 0.061277 udp 10.0.2.105 7010 <-> 155.207.48.72 6617 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:54.256542 0.352522 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:54.605347 0.451385 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:55.042316 0.186341 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:55.198475 0.186547 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:55.383568 0.168184 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:55.528181 0.389210 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:55.894777 0.220043 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:56.111977 0.295390 udp 10.0.2.105 7010 <-> 117.207.33.97 3044 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:56.336014 0.175048 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:56.504052 0.450154 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:56.933688 0.063044 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:56.994905 0.454549 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:57.379570 0.165778 udp 10.0.2.105 7010 <-> 106.51.44.10 3949 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:57.866831 0.220052 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:06:58.067414 0.234162 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:07:28.401533 3.002035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 02:07:35.409066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:07:43.411017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:07:59.413553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:08:31.419951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:14:35.426410 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 02:14:42.433348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:14:50.434670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:15:06.437592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:15:38.443539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:19:08.295818 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:19:08.296000 0.215762 tcp 10.0.2.105 62334 -> 200.84.7.244 8038 SPA_* 0 0 9 1168 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:28.725737 0.313388 tcp 10.0.2.105 62334 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:28.727575 0.056799 tcp 10.0.2.105 62335 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:28.784662 0.067213 tcp 10.0.2.105 62336 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:28.852242 0.155772 tcp 10.0.2.105 62337 -> 195.113.214.249 443 SRPA* 0 0 48 41654 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:29.039389 3.000372 tcp 10.0.2.105 62338 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:19:38.038036 0.000000 tcp 10.0.2.105 62338 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:19:44.037448 0.061269 tcp 10.0.2.105 62339 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:44.098975 0.055618 tcp 10.0.2.105 62340 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:44.154946 0.162672 tcp 10.0.2.105 62341 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:44.336473 3.005253 tcp 10.0.2.105 62342 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:19:53.339876 0.000000 tcp 10.0.2.105 62342 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:19:59.329993 0.065266 tcp 10.0.2.105 62343 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:59.395878 0.054807 tcp 10.0.2.105 62344 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:59.451006 0.146198 tcp 10.0.2.105 62345 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:19:59.608041 0.422253 tcp 10.0.2.105 62346 -> 200.84.7.244 8038 FSPA* 0 0 13 1384 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:20:00.030530 2.993545 tcp 10.0.2.105 62347 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:20:09.032621 0.000000 tcp 10.0.2.105 62347 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:20:15.031746 2.993758 tcp 10.0.2.105 62348 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:20:24.024220 0.000000 tcp 10.0.2.105 62348 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:20:28.850956 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:21:42.448943 3.002648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 02:21:49.456644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:21:57.459050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:22:13.461955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:22:45.467615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:25:30.035886 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:25:30.036074 3.002530 tcp 10.0.2.105 62349 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:25:39.037229 0.000000 tcp 10.0.2.105 62349 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:25:45.037295 0.065635 tcp 10.0.2.105 62350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:25:45.103189 0.063110 tcp 10.0.2.105 62351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:25:45.166612 0.154125 tcp 10.0.2.105 62352 -> 195.113.214.249 443 SRPA* 0 0 22 12448 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:25:45.331321 2.999368 tcp 10.0.2.105 62353 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:25:54.329520 0.000000 tcp 10.0.2.105 62353 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 02:26:00.328538 0.064430 tcp 10.0.2.105 62354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:26:00.393224 0.061501 tcp 10.0.2.105 62355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:26:00.455053 0.146352 tcp 10.0.2.105 62356 -> 195.113.214.249 443 SRPA* 0 0 20 10292 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:26:00.614232 0.371410 tcp 10.0.2.105 62357 -> 200.84.7.244 8038 SPA_* 0 0 9 1102 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:26:09.280839 0.020786 tcp 10.0.2.105 62357 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:28:49.473941 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 02:28:56.481373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:29:04.482887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:29:20.485726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:29:52.491724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:35:56.497068 3.002155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 02:36:03.505013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:36:11.506474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:36:27.509844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:36:59.516437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:37:04.333197 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:37:04.333326 0.117637 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:04.430098 0.095186 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:04.486268 0.070880 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:04.555240 0.058935 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:04.719312 0.262184 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:04.973164 0.114138 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:05.049548 0.350267 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:05.395607 0.223965 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:05.612601 0.442052 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.018860 0.185802 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.214222 0.084999 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.277711 0.251697 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.495951 0.218523 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.707223 0.198612 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:06.901165 0.177163 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:07.154186 0.101251 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:07.262840 0.184639 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2003 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:07.677586 0.174539 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:07.849359 0.398543 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:08.216239 0.150912 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:08.368687 0.365755 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:08.704872 0.233637 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:08.917137 0.203683 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:09.118780 0.167045 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:09.226233 0.000000 udp 10.0.2.105 7010 -> 155.207.48.72 6617 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:37:27.377983 0.056180 tcp 10.0.2.105 62358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:27.434462 0.054596 tcp 10.0.2.105 62359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:27.489374 0.149741 tcp 10.0.2.105 62360 -> 195.113.214.249 443 SRPA* 0 0 43 24320 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:27.639734 0.354345 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:27.990262 0.462886 udp 10.0.2.105 7010 <-> 124.120.243.77 8909 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:28.437369 0.167731 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:28.582631 0.177631 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:28.737635 0.188686 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:28.896698 0.166810 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:29.062409 0.218484 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:37:29.278436 0.000000 udp 10.0.2.105 7010 -> 117.207.33.97 3044 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:37:47.054915 0.057007 tcp 10.0.2.105 62361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:47.112216 0.065102 tcp 10.0.2.105 62362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:47.177624 0.153008 tcp 10.0.2.105 62363 -> 195.113.214.249 443 SRPA* 0 0 24 14016 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:37:47.331177 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:38:05.190475 0.065915 tcp 10.0.2.105 62364 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:05.256695 0.054578 tcp 10.0.2.105 62365 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:05.311539 0.171288 tcp 10.0.2.105 62366 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:05.483406 0.931813 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:38:06.426532 0.455803 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:38:06.861468 0.057208 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:38:06.916656 0.000000 udp 10.0.2.105 7010 -> 106.51.44.10 3949 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 02:38:22.175430 0.061073 tcp 10.0.2.105 62367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:22.236777 0.055637 tcp 10.0.2.105 62368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:22.292190 0.161385 tcp 10.0.2.105 62369 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:38:22.454187 0.222948 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2629 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:38:22.656217 0.524208 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/22 02:43:03.522421 3.001090 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 02:43:10.529225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:43:18.530711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:43:34.533500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:44:06.539452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:55:43.554049 3.001924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 02:55:50.561900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:55:58.563318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:56:09.309405 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 02:56:09.309635 1.460375 tcp 10.0.2.105 62370 -> 200.84.7.244 8038 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/22 02:56:14.566021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 02:56:46.572697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:02:50.578007 3.001895 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 03:02:57.585771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:03:05.587135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:03:21.591017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:03:53.596490 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:08:39.577732 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 03:08:39.577947 0.000000 udp 10.0.2.105 7010 -> 155.207.48.72 6617 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:08:57.585471 0.050615 tcp 10.0.2.105 62371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:08:57.636413 0.051386 tcp 10.0.2.105 62372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:08:57.688114 0.244505 tcp 10.0.2.105 62373 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:08:57.933277 0.000000 udp 10.0.2.105 7010 -> 117.207.33.97 3044 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:09:14.528661 0.063368 tcp 10.0.2.105 62374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:14.592338 0.051614 tcp 10.0.2.105 62375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:14.644448 0.145140 tcp 10.0.2.105 62376 -> 195.113.214.249 443 SRPA* 0 0 41 21368 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:14.790215 0.169033 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:14.951944 0.000000 udp 10.0.2.105 7010 -> 106.51.44.10 3949 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:09:30.230758 0.051295 tcp 10.0.2.105 62377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:30.282359 0.050644 tcp 10.0.2.105 62378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:30.333311 0.160814 tcp 10.0.2.105 62379 -> 195.113.214.249 443 SRPA* 0 0 47 43036 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:30.494855 0.106779 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:30.564663 0.084350 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:30.619642 0.067637 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:30.669365 0.168129 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:30.825062 0.069596 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:30.969558 0.123543 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2673 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:31.071022 0.356596 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:31.424515 0.194668 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:31.621004 0.470873 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:32.056475 0.230362 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:32.280005 0.196630 udp 10.0.2.105 7010 <-> 98.191.103.138 3289 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:32.472031 0.220912 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:32.685206 0.258165 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:32.907666 0.107324 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:33.036130 0.118136 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:33.135822 0.099059 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:33.215340 0.185884 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:33.434234 0.176859 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:33.607186 0.452689 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:34.019243 0.202247 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2468 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:34.222584 0.232233 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:34.435334 0.618341 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:35.025133 0.152270 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:35.187929 0.154087 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:35.312702 0.353474 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:35.662216 0.184129 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:35.817921 0.169604 udp 10.0.2.105 7010 <-> 113.193.186.206 6627 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:36.011045 0.000000 udp 10.0.2.105 7010 -> 124.120.243.77 8909 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:09:51.922715 0.053206 tcp 10.0.2.105 62380 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:51.975721 0.050895 tcp 10.0.2.105 62381 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:52.026980 0.158902 tcp 10.0.2.105 62382 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:09:52.186099 0.169042 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:52.331466 0.172463 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:52.479089 0.228826 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:52.703470 0.557812 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:53.241395 0.484332 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:53.666040 0.063428 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:53.736743 0.206915 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:09:53.928617 0.098731 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:10:21.607003 3.001565 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 03:10:28.614043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:10:36.615780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:10:52.618882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:11:24.624728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:17:28.630323 3.002470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 03:17:35.638330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:17:43.639781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:17:59.642854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:18:31.649175 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:24:35.655933 3.000475 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 03:24:42.662219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:24:50.663592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:25:06.666721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:25:38.673235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:26:10.773374 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 03:26:10.773503 0.737046 tcp 10.0.2.105 62383 -> 200.84.7.244 8038 FSPA* 0 0 13 1330 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:11.210589 0.052563 tcp 10.0.2.105 62384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:11.263446 0.051180 tcp 10.0.2.105 62385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:11.314930 0.151397 tcp 10.0.2.105 62386 -> 195.113.214.249 443 SRPA* 0 0 49 43144 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:11.510846 2.993291 tcp 10.0.2.105 62387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:20.512868 0.000000 tcp 10.0.2.105 62387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:26.502015 0.050790 tcp 10.0.2.105 62388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:26.553186 0.050343 tcp 10.0.2.105 62389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:26.603786 0.148361 tcp 10.0.2.105 62390 -> 195.113.214.249 443 SRPA* 0 0 25 16250 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:26.770194 2.995456 tcp 10.0.2.105 62391 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:35.764500 0.000000 tcp 10.0.2.105 62391 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:41.763714 0.051838 tcp 10.0.2.105 62392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:41.815938 0.051370 tcp 10.0.2.105 62393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:41.867694 0.177069 tcp 10.0.2.105 62394 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:42.055298 0.488703 tcp 10.0.2.105 62395 -> 200.84.7.244 8038 FSPA* 0 0 13 1330 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:26:42.544448 3.004426 tcp 10.0.2.105 62396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:51.547355 0.000000 tcp 10.0.2.105 62396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:26:57.536189 3.004327 tcp 10.0.2.105 62397 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:27:06.539007 0.000000 tcp 10.0.2.105 62397 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:27:11.345864 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 03:31:42.679213 3.001522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 03:31:49.685770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:31:57.687752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:32:12.539617 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 03:32:12.539803 2.993467 tcp 10.0.2.105 62398 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:32:13.690653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:32:21.542236 0.000000 tcp 10.0.2.105 62398 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:32:27.542760 0.055295 tcp 10.0.2.105 62399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:27.598331 0.053500 tcp 10.0.2.105 62400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:27.652144 0.168857 tcp 10.0.2.105 62401 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:27.838470 3.003296 tcp 10.0.2.105 62402 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:32:36.833881 0.000000 tcp 10.0.2.105 62402 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 03:32:42.833333 0.051736 tcp 10.0.2.105 62403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:42.885354 0.056475 tcp 10.0.2.105 62404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:42.942157 0.164153 tcp 10.0.2.105 62405 -> 195.113.214.249 443 SRPA* 0 0 40 21352 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:43.116462 1.485544 tcp 10.0.2.105 62406 -> 200.84.7.244 8038 FSPA* 0 0 15 1649 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:32:45.696529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:38:49.702944 3.001441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 03:38:56.710324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:39:04.711388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:39:20.714549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:39:52.720616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:40:13.540939 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 03:40:13.541042 0.000000 udp 10.0.2.105 7010 -> 124.120.243.77 8909 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:40:29.114529 0.053026 tcp 10.0.2.105 62407 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:29.167406 0.049883 tcp 10.0.2.105 62408 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:29.217608 0.147239 tcp 10.0.2.105 62409 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:29.365085 0.168984 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.526833 0.085122 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.574724 0.061744 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.658556 0.164193 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.814236 0.060420 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2548 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.872882 0.111501 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:29.964456 0.371139 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:30.331897 0.110919 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:30.405811 0.188971 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:30.605205 0.000000 udp 10.0.2.105 7010 -> 98.191.103.138 3289 INT 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:40:47.640380 0.050326 tcp 10.0.2.105 62410 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:47.690997 0.052075 tcp 10.0.2.105 62411 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:47.743408 0.154066 tcp 10.0.2.105 62412 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:40:47.897986 0.230773 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:48.122274 0.448366 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:48.537091 0.082818 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:48.598788 0.183034 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2581 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:48.751853 0.101663 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:48.832981 0.184673 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:49.000909 0.174102 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:49.171715 0.253657 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:49.389940 0.219619 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:49.601779 0.235950 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:49.816093 1.200356 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:50.964586 0.203984 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:51.164069 0.165877 udp 10.0.2.105 7010 <-> 188.131.64.20 9865 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:51.269878 0.347932 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2640 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:51.613613 0.187430 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:40:51.774829 0.000000 udp 10.0.2.105 7010 -> 113.193.186.206 6627 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 03:41:07.739416 0.049572 tcp 10.0.2.105 62413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:41:07.789277 0.052551 tcp 10.0.2.105 62414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:41:07.842148 0.157608 tcp 10.0.2.105 62415 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/22 03:41:08.000408 0.515728 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:08.487483 0.152302 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:09.824797 0.177455 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:09.978015 0.221509 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:10.195425 0.164270 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:10.468106 0.063930 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:10.530349 0.211990 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:11.073874 0.309883 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:11.369283 0.445004 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:41:11.792481 0.543169 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/22 03:45:56.725971 3.002533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 03:46:03.733948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:46:11.735620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:46:27.739459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:46:59.744480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:53:03.750566 3.059685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 03:53:10.787708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:53:18.769506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:53:34.772572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 03:54:07.188054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:00:10.795023 3.001192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 04:00:17.801974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:00:25.803471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:00:41.806211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:01:13.812678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:02:44.603568 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:02:44.603686 0.220370 tcp 10.0.2.105 62416 -> 200.84.7.244 8038 SPA_* 0 0 9 1170 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:14.827804 0.054070 tcp 10.0.2.105 62417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:14.882235 0.060896 tcp 10.0.2.105 62418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:14.943410 0.149696 tcp 10.0.2.105 62419 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:15.087328 0.106627 tcp 10.0.2.105 62416 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:15.194179 3.007032 tcp 10.0.2.105 62420 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:03:24.199928 0.000000 tcp 10.0.2.105 62420 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:03:30.189393 0.050804 tcp 10.0.2.105 62421 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:30.240538 0.052081 tcp 10.0.2.105 62422 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:30.292964 0.187157 tcp 10.0.2.105 62423 -> 195.113.214.249 443 SRPA* 0 0 72 78374 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:30.903198 3.000666 tcp 10.0.2.105 62424 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:03:39.912783 0.000000 tcp 10.0.2.105 62424 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:03:45.901774 0.052979 tcp 10.0.2.105 62425 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:45.953482 0.051066 tcp 10.0.2.105 62426 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:46.004870 0.151599 tcp 10.0.2.105 62427 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:46.772374 0.470324 tcp 10.0.2.105 62428 -> 200.84.7.244 8038 FSPA* 0 0 13 1386 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:03:47.242528 2.995053 tcp 10.0.2.105 62429 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:03:56.236008 0.000000 tcp 10.0.2.105 62429 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:04:02.234868 3.003896 tcp 10.0.2.105 62430 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:04:11.237659 0.000000 tcp 10.0.2.105 62430 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:04:15.844016 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:07:24.820757 2.999815 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 04:07:31.825977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:07:39.827581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:07:55.830372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:08:27.836246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:09:17.238420 0.000239 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:09:17.238780 3.003072 tcp 10.0.2.105 62431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:09:26.240279 0.000000 tcp 10.0.2.105 62431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:09:32.242706 0.051289 tcp 10.0.2.105 62432 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:32.294448 0.054797 tcp 10.0.2.105 62433 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:32.349596 0.156260 tcp 10.0.2.105 62434 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:32.515220 2.998440 tcp 10.0.2.105 62435 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:09:41.523040 0.000000 tcp 10.0.2.105 62435 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:09:47.511792 0.051236 tcp 10.0.2.105 62436 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:47.563387 0.050735 tcp 10.0.2.105 62437 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:47.613987 0.152275 tcp 10.0.2.105 62438 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:09:47.778605 1.428679 tcp 10.0.2.105 62439 -> 200.84.7.244 8038 FSPA* 0 0 15 1775 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:11:33.785115 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:11:33.785225 0.000000 udp 10.0.2.105 7010 -> 98.191.103.138 3289 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:11:48.856110 0.051629 tcp 10.0.2.105 62440 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:11:48.908031 0.054997 tcp 10.0.2.105 62441 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:11:48.962853 0.165419 tcp 10.0.2.105 62442 -> 195.113.214.249 443 SRPA* 0 0 74 53518 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:11:49.126332 0.000000 udp 10.0.2.105 7010 -> 113.193.186.206 6627 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:12:04.448475 0.049743 tcp 10.0.2.105 62443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:04.497927 0.050763 tcp 10.0.2.105 62444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:04.549076 0.160490 tcp 10.0.2.105 62445 -> 195.113.214.249 443 SRPA* 0 0 75 55164 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:04.707914 0.062463 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:04.768629 0.161618 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:04.908942 0.190392 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:05.092128 0.061685 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:05.160409 0.114191 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:05.233452 0.165777 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:05.474210 0.109609 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:05.931284 0.367392 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:06.295585 0.194758 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:06.491995 0.229118 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:06.714150 0.184276 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:06.888589 0.449086 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:07.302051 0.186365 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:07.531973 0.174294 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:07.730722 0.102143 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:07.814967 0.082460 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:07.876558 0.235511 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:08.090830 0.221743 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:08.305550 0.268410 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:08.537828 0.199395 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:08.743869 0.416034 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:09.112155 0.353695 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:09.461829 0.000000 udp 10.0.2.105 7010 -> 188.131.64.20 9865 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:12:26.461507 0.051016 tcp 10.0.2.105 62446 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:26.512955 0.051673 tcp 10.0.2.105 62447 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:26.564922 0.145017 tcp 10.0.2.105 62448 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:12:26.709494 0.191181 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:26.873822 0.505281 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:27.350782 0.155644 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:27.507661 0.177958 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:27.662038 0.213676 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:27.872549 0.216830 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:28.070189 0.166476 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:28.211226 0.063241 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:28.273234 0.424451 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:28.651922 0.241086 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:12:28.877042 0.441394 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:14:31.843441 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 04:14:38.850145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:14:46.851414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:15:02.854314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:15:34.860613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:22:01.679190 2.993930 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 04:22:08.623015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:22:16.518039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:22:32.302561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:23:09.955627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:29:26.596129 3.055728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 04:29:33.652178 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:29:41.543826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:29:57.294525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:30:28.794272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:36:27.143056 2.954480 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 04:36:34.048163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:36:41.930027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:36:57.822849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:37:29.328385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:40:19.870599 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:40:19.870764 0.206245 tcp 10.0.2.105 62449 -> 200.84.7.244 8038 SPA_* 0 0 9 1225 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:40:49.614245 0.051538 tcp 10.0.2.105 62450 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:40:49.666136 0.049541 tcp 10.0.2.105 62451 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:40:49.715968 0.151570 tcp 10.0.2.105 62452 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:40:49.919106 0.362901 tcp 10.0.2.105 62449 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:40:49.919466 2.963313 tcp 10.0.2.105 62453 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:40:58.789579 0.000000 tcp 10.0.2.105 62453 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:04.693094 0.050675 tcp 10.0.2.105 62454 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:04.744051 0.050287 tcp 10.0.2.105 62455 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:04.794665 0.144895 tcp 10.0.2.105 62456 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:04.983131 2.958169 tcp 10.0.2.105 62457 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:13.846646 0.000000 tcp 10.0.2.105 62457 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:19.753123 0.049348 tcp 10.0.2.105 62458 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:19.802783 0.052431 tcp 10.0.2.105 62459 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:19.855557 0.168404 tcp 10.0.2.105 62460 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:20.657722 0.981180 tcp 10.0.2.105 62461 -> 200.84.7.244 8038 FSPA* 0 0 13 1441 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:41:21.639173 2.945577 tcp 10.0.2.105 62462 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:30.495099 0.000000 tcp 10.0.2.105 62462 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:36.409683 2.940236 tcp 10.0.2.105 62463 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:45.259042 0.000000 tcp 10.0.2.105 62463 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:41:50.171572 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:42:59.502296 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:42:59.502454 0.000000 udp 10.0.2.105 7010 -> 188.131.64.20 9865 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:43:14.354046 0.052112 tcp 10.0.2.105 62464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:14.406404 0.052470 tcp 10.0.2.105 62465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:14.459158 0.151312 tcp 10.0.2.105 62466 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:14.611134 0.109616 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:14.699509 0.175711 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:14.867515 0.062055 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:14.910578 0.088806 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2085 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:14.961907 0.156143 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:15.111848 0.113356 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:15.184848 0.059107 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 1999 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:15.260520 0.218222 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:15.472445 0.353393 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:15.821839 0.000000 udp 10.0.2.105 7010 -> 2.184.245.140 4768 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:43:28.233553 2.962274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 04:43:32.716620 0.052040 tcp 10.0.2.105 62467 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:32.768920 0.661020 tcp 10.0.2.105 62468 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:33.430254 0.155997 tcp 10.0.2.105 62469 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:33.586800 0.187276 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:33.723973 0.185278 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:33.922854 0.186700 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:34.138063 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 04:43:35.132727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:43:43.016050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:43:50.810048 0.049028 tcp 10.0.2.105 62470 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:50.859347 0.049596 tcp 10.0.2.105 62471 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:50.909229 0.147009 tcp 10.0.2.105 62472 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:43:51.056779 0.234711 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:51.271061 0.217527 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:51.481680 0.253868 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:51.701935 0.203641 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:51.900961 0.105202 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:51.987049 0.180238 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:52.163851 0.352609 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:52.512636 0.441742 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2555 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:52.900117 0.184840 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:53.054420 0.484560 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:53.512156 0.154175 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:53.662612 0.176593 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:53.815252 0.561605 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:54.368666 0.218234 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:54.570184 0.435284 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2021 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:54.969859 0.101340 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:55.056018 0.446518 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:55.480873 0.161920 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:55.618977 0.057502 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/22 04:43:58.804470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:44:30.302655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:46:46.515904 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:46:46.516007 2.959257 tcp 10.0.2.105 62473 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:46:55.378452 0.000000 tcp 10.0.2.105 62473 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:47:01.283289 0.130452 tcp 10.0.2.105 62474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:01.414008 0.051442 tcp 10.0.2.105 62475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:01.465752 0.144436 tcp 10.0.2.105 62476 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:01.627957 2.959530 tcp 10.0.2.105 62477 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:47:10.493245 0.000000 tcp 10.0.2.105 62477 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:47:16.396792 0.049647 tcp 10.0.2.105 62478 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:16.446733 0.052148 tcp 10.0.2.105 62479 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:16.499187 0.150987 tcp 10.0.2.105 62480 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:16.660423 0.257990 tcp 10.0.2.105 62481 -> 200.84.7.244 8038 SPA_* 0 0 9 1149 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:46.447777 0.049434 tcp 10.0.2.105 62482 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:46.497492 0.050965 tcp 10.0.2.105 62483 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:46.548797 0.159970 tcp 10.0.2.105 62484 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:46.733613 0.420403 tcp 10.0.2.105 62481 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:47:46.733920 2.941811 tcp 10.0.2.105 62485 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:47:55.585761 0.000000 tcp 10.0.2.105 62485 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:48:01.491420 2.954019 tcp 10.0.2.105 62486 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:48:10.343043 0.000000 tcp 10.0.2.105 62486 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:48:15.087451 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:48:16.249059 0.439796 tcp 10.0.2.105 62487 -> 200.84.7.244 8038 FSPA* 0 0 13 1365 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:12.053278 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 04:53:12.053391 2.958014 tcp 10.0.2.105 62488 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:53:20.912913 0.000000 tcp 10.0.2.105 62488 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:53:26.821073 0.052662 tcp 10.0.2.105 62489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:26.874082 0.051334 tcp 10.0.2.105 62490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:26.925721 0.146851 tcp 10.0.2.105 62491 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:27.110924 2.950792 tcp 10.0.2.105 62492 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:53:35.969997 0.000000 tcp 10.0.2.105 62492 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 04:53:41.877844 0.052345 tcp 10.0.2.105 62493 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:41.930493 0.051015 tcp 10.0.2.105 62494 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:41.981878 0.153372 tcp 10.0.2.105 62495 -> 195.113.214.249 443 SRPA* 0 0 26 13498 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:53:42.155315 1.424503 tcp 10.0.2.105 62496 -> 200.84.7.244 8038 FSPA* 0 0 14 1562 flow=From-Botnet-V2-TCP-Established 1970/02/22 04:55:54.502258 2.962246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 04:56:01.403068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:56:09.287416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:56:25.046808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 04:56:56.555635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:02:54.914218 2.953670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:03:01.808548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:03:09.683005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:03:25.429036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:03:56.948326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:10:17.999001 2.960037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:10:24.896803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:10:32.774039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:10:48.534177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:11:20.029225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:13:32.450628 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 05:13:32.450716 0.448206 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:32.863984 0.091014 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:32.934805 0.122174 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.036623 0.094975 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.094451 0.163511 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.249280 0.180187 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.394491 0.059520 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.454870 0.065799 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.503139 0.224240 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.719783 0.189380 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:33.902362 0.382931 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:34.281224 0.185125 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:34.468701 0.142753 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:34.581967 0.186745 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:34.780568 0.235501 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:34.996760 0.224682 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:35.214698 0.369221 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:35.547743 0.203774 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:35.749374 0.101545 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:35.831724 0.424767 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:36.208456 0.182967 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:36.363357 0.181613 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:36.541656 0.352691 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:36.890688 0.178508 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:37.080599 0.809502 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:37.863862 0.167729 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:38.025091 0.214786 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:38.236820 0.214518 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:38.434265 2.389870 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:40.756495 0.595807 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:41.336328 0.063862 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:41.398605 0.447273 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:13:41.823645 0.000000 udp 10.0.2.105 7010 -> 70.53.183.198 9504 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 05:13:59.231216 0.050836 tcp 10.0.2.105 62497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:13:59.282359 0.051978 tcp 10.0.2.105 62498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:13:59.334626 0.155526 tcp 10.0.2.105 62499 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:17:22.083496 3.001688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:17:29.090905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:17:37.092597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:17:53.095193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:18:25.101108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:23:25.002717 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 05:23:25.002880 0.218568 tcp 10.0.2.105 62500 -> 200.84.7.244 8038 SPA_* 0 0 9 1100 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:23:30.201120 0.001799 tcp 10.0.2.105 62500 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:24:29.109432 2.999535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:24:36.114843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:24:44.115720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:25:00.119539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:25:32.124938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:31:36.131326 3.001938 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:31:43.138978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:31:51.140274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:32:07.143405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:32:39.149286 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:38:43.155420 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:38:50.162261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:38:58.163969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:39:14.167563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:39:46.173217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:44:11.434439 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 05:44:11.434542 0.167287 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:11.578209 0.725017 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.283551 0.122069 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.384144 0.087978 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.433635 0.162620 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2025 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.605431 0.116844 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.685409 0.061021 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.888967 0.068792 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:12.953887 0.453950 udp 10.0.2.105 7010 <-> 2.184.245.140 4768 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:13.372191 0.188012 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:13.569417 0.230205 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:13.793084 0.196562 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:13.982081 0.348918 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:14.326833 0.229909 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:14.536059 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 05:44:32.216031 0.117927 tcp 10.0.2.105 62501 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:44:32.334260 0.053811 tcp 10.0.2.105 62502 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:44:32.388474 0.148517 tcp 10.0.2.105 62503 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:44:32.538050 0.189489 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:32.768966 0.201264 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2613 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:32.908800 0.103758 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:32.993348 0.429965 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:33.363550 0.736128 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:34.063362 0.201538 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2753 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:34.274122 0.353447 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:34.623782 0.173804 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:35.283275 0.180882 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:35.460815 0.178885 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:35.931804 0.357552 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:36.261152 0.150084 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:36.408037 0.230441 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:36.634907 0.218006 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:36.833232 0.467521 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 5 1684 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:37.281003 0.104802 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:37.369332 0.063882 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:44:37.431372 0.447870 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/22 05:45:50.181622 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:45:57.186781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:46:05.188159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:46:21.195204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:46:53.197300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:53:30.208710 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 05:53:30.208901 1.379243 tcp 10.0.2.105 62504 -> 200.84.7.244 8038 FSPA* 0 0 14 1675 flow=From-Botnet-V2-TCP-Established 1970/02/22 05:57:04.208972 3.000826 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 05:57:11.215955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:57:19.217241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:57:35.220535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 05:58:07.226091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:04:11.232266 3.001697 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:04:18.239587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:04:26.241341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:04:42.243975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:05:14.250828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:11:18.255827 3.002319 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:11:25.265398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:11:33.265363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:11:49.268165 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:12:21.274196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:14:37.882034 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 06:14:37.882216 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:14:54.597482 0.057295 tcp 10.0.2.105 62505 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:14:54.655118 0.054870 tcp 10.0.2.105 62506 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:14:54.710281 0.171860 tcp 10.0.2.105 62507 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:14:54.882901 0.464776 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:14:55.323342 0.172664 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:14:55.475442 0.094633 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:14:55.539838 0.166620 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:14:55.700230 0.115166 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:14:55.774751 0.000000 udp 10.0.2.105 7010 -> 81.157.252.245 6093 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:15:13.624002 0.053708 tcp 10.0.2.105 62508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:13.677629 0.055167 tcp 10.0.2.105 62509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:13.733082 0.148391 tcp 10.0.2.105 62510 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:13.882182 0.085982 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:13.946157 0.064062 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:14.020412 0.189096 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:14.202294 0.000000 udp 10.0.2.105 7010 -> 2.184.245.140 4768 INT 0 1 105 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:15:33.000805 0.054867 tcp 10.0.2.105 62511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:33.055958 0.063437 tcp 10.0.2.105 62512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:33.119803 0.150546 tcp 10.0.2.105 62513 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:15:33.270961 0.194498 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:33.490088 0.235770 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:33.718432 0.382171 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:34.096790 0.235563 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:34.311665 0.187040 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:34.506855 0.247129 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2543 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:34.753237 0.105244 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:34.840158 0.417520 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:35.226029 2.067615 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:37.256605 0.201803 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:37.460057 0.352967 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:37.809414 0.184611 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:37.965694 0.174254 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:38.117602 0.228390 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:38.337076 0.670891 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:38.977991 0.170837 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:39.144380 0.225904 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:39.367585 0.216377 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:39.567200 0.063651 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:39.640562 0.476916 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:40.095994 2.533707 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:15:42.552992 0.102397 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:18:25.280580 3.001383 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 06:18:32.287611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:18:40.289169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:18:56.291936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:19:28.298364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:23:31.589945 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 06:23:31.590141 0.239621 tcp 10.0.2.105 62514 -> 200.84.7.244 8038 SPA_* 0 0 9 1151 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:23:55.442279 0.011569 tcp 10.0.2.105 62514 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:25:32.304920 3.000791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:25:39.311741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:25:47.315566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:26:03.316051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:26:35.321989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:32:39.328173 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:32:46.335895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:32:54.337116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:33:10.339916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:33:42.346068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:39:46.351615 3.002042 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:39:53.362093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:40:01.361160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:40:17.364180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:40:49.370632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:45:49.542299 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 06:45:49.542461 0.000000 udp 10.0.2.105 7010 -> 81.157.252.245 6093 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:46:07.359161 0.055614 tcp 10.0.2.105 62515 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:07.415130 0.054076 tcp 10.0.2.105 62516 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:07.469492 0.146684 tcp 10.0.2.105 62517 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:07.616866 0.000000 udp 10.0.2.105 7010 -> 2.184.245.140 4768 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:46:24.532835 0.054864 tcp 10.0.2.105 62518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:24.588082 0.057973 tcp 10.0.2.105 62519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:24.646436 0.145057 tcp 10.0.2.105 62520 -> 195.113.214.249 443 SRPA* 0 0 22 11652 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:24.792028 0.117852 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:24.869044 0.160979 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:25.011155 0.171794 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:25.171731 0.092315 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:25.224694 0.181775 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:25.398066 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 06:46:43.169314 0.054297 tcp 10.0.2.105 62521 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:43.223893 0.056662 tcp 10.0.2.105 62522 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:43.280929 0.155198 tcp 10.0.2.105 62523 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:46:43.436664 0.068150 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:43.486181 0.085642 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:43.549834 0.187846 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:43.761974 0.226856 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:43.981104 0.185045 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:44.182732 0.395629 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:44.576076 0.239948 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:44.797652 0.183067 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:44.950805 0.101595 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:45.031882 0.484527 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:45.484625 0.266960 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:45.714146 0.201707 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:45.917481 0.177806 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:46.071750 0.174583 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:46.243380 0.352949 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:46.592877 0.528371 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 1964 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:47.095924 0.762593 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:47.831279 0.147250 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:47.979873 0.213689 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:48.190384 0.443866 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 1904 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:48.612515 0.212980 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:48.806529 0.063761 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:48.868465 1.513906 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:50.311809 0.104855 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/22 06:46:53.376053 3.001720 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 06:47:00.383472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:47:08.384900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:47:24.387828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:47:56.394103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:53:55.460778 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 06:53:55.460867 1.321259 tcp 10.0.2.105 62524 -> 200.84.7.244 8038 FSPA* 0 0 14 1664 flow=From-Botnet-V2-TCP-Established 1970/02/22 06:54:00.399933 3.001775 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 06:54:07.407358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:54:15.408985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:54:31.412161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 06:55:03.418148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:01:07.424266 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:01:14.431457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:01:22.433006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:01:38.435987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:02:10.442177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:08:14.448178 3.001308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:08:21.455362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:08:29.456667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:08:45.460061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:09:17.465861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:15:21.471935 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:15:28.479532 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:15:36.481476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:15:52.483923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:16:24.490093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:16:58.659838 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 07:16:58.660018 0.187086 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:16:58.839930 0.105968 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:16:58.905737 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 102 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 07:17:16.927352 0.056120 tcp 10.0.2.105 62525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:17:16.983790 0.055783 tcp 10.0.2.105 62526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:17:17.039898 0.147739 tcp 10.0.2.105 62527 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:17:17.188605 0.114857 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.266532 0.170987 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.429837 0.178026 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.601910 0.063764 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.659713 0.087128 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.725879 0.182217 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:17.917977 0.230186 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:18.140563 0.186775 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:18.343034 0.303993 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:18.557085 0.103537 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:18.640604 0.370374 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:19.007653 0.234651 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:19.222845 0.408183 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:19.599393 0.269103 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:19.831453 0.204580 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:20.052406 0.176203 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2079 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:20.207154 0.197610 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:20.401354 0.353697 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:20.751162 0.188441 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:20.910350 0.226313 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:21.133004 0.565729 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:21.672369 0.160578 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:21.834418 0.444449 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:22.254895 0.215606 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:22.453207 0.063645 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:22.515129 0.489830 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:17:22.935400 0.100408 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:22:32.501927 3.001333 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:22:39.509140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:22:47.511229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:23:03.513800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:23:35.523799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:23:56.791004 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 07:23:56.791206 0.219230 tcp 10.0.2.105 62528 -> 200.84.7.244 8038 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:24:01.975244 0.001716 tcp 10.0.2.105 62528 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:29:39.527234 3.000129 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:29:46.533103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:29:54.534728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:30:10.537471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:30:42.543593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:36:46.550689 3.001033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:36:53.557065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:37:01.558743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:37:17.561625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:37:49.567827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:43:53.573934 3.001176 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 07:44:00.581005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:44:08.583144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:44:24.585637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:44:56.591627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:47:48.309254 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 07:47:48.309341 0.181060 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:48.468183 0.190474 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:48.650612 0.090383 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:48.703517 0.319030 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.013952 0.112080 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.111018 0.168778 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.256142 0.063530 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.323143 0.350968 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.653384 0.185106 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:49.854510 0.225989 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:50.072474 0.190494 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:50.292482 0.191429 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:50.454415 0.103934 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:50.537848 0.354651 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:50.888442 0.236420 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:51.103434 0.416301 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:51.472554 0.175886 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:51.626144 0.176291 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:51.800018 0.264605 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:52.028221 0.202649 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:52.232367 0.216712 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:52.445883 0.352964 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:52.795163 0.182172 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:52.950365 0.741140 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:53.665295 0.153219 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:53.814055 0.448824 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:54.240861 0.217756 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:54.439765 0.063542 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:54.501808 0.846940 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:47:55.299158 0.153946 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/22 07:54:01.976195 0.000162 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 07:54:01.976461 1.384080 tcp 10.0.2.105 62529 -> 200.84.7.244 8038 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/02/22 07:56:07.598760 3.001746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 07:56:14.606299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:56:22.608219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:56:38.613682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 07:57:10.616845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:03:14.622618 3.001962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:03:21.630218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:03:29.631897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:03:45.634697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:04:17.641209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:10:32.653016 3.001326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:10:39.659901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:10:47.661460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:11:03.667174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:11:35.670854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:17:39.677366 3.001445 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:17:46.683698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:17:54.685561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:18:01.325306 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 08:18:01.325407 0.085236 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:01.371797 0.176385 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:01.548552 0.108546 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:01.622108 0.164199 udp 10.0.2.105 7010 <-> 70.53.183.198 9504 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:01.762465 0.162691 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:01.904599 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 08:18:10.688893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:18:18.001150 0.051849 tcp 10.0.2.105 62530 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:18.053342 0.051664 tcp 10.0.2.105 62531 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:18.105387 0.147199 tcp 10.0.2.105 62532 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:18.253222 0.000000 udp 10.0.2.105 7010 -> 62.131.39.243 1960 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 08:18:34.062703 0.051926 tcp 10.0.2.105 62533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:34.114970 0.051810 tcp 10.0.2.105 62534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:34.167059 0.146890 tcp 10.0.2.105 62535 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:18:34.314509 0.083794 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:34.377532 0.189272 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:34.568176 0.229356 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:34.790386 0.100959 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:34.872779 0.377379 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:35.246717 0.234646 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:35.460177 0.185860 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:35.628566 0.232040 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:35.810497 0.423989 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:36.184941 0.176125 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:36.339904 0.184526 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2505 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:36.518714 0.266234 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:36.748895 0.201447 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:36.951779 0.183854 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:37.106358 0.226201 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2081 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:37.329405 0.354792 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:37.680759 0.724694 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:38.380408 0.146167 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:38.536693 0.471945 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:38.986644 0.221039 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:39.185665 0.063783 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:39.402079 0.432436 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:39.789824 0.109747 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:18:42.694462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:24:03.366445 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 08:24:03.366639 0.221456 tcp 10.0.2.105 62536 -> 200.84.7.244 8038 SPA_* 0 0 9 1179 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:24:08.832530 0.014107 tcp 10.0.2.105 62536 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:24:46.700276 3.001827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:24:53.708033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:25:01.709631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:25:17.712758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:25:49.718722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:31:53.725156 3.001033 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:32:00.731893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:32:08.733350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:32:24.736466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:32:56.742702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:39:00.747789 3.002392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:39:07.755973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:39:15.759036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:39:31.760681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:40:03.766366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:46:07.773904 2.999924 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:46:14.779833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:46:22.781416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:46:38.784123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:47:10.790632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:48:53.077807 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 08:48:53.077895 0.177509 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:48:53.249168 0.064215 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:48:53.295177 0.165938 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:48:53.452647 0.088311 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:48:53.502607 0.000000 udp 10.0.2.105 7010 -> 70.53.183.198 9504 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 08:49:11.195303 0.051416 tcp 10.0.2.105 62537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:49:11.247017 0.052890 tcp 10.0.2.105 62538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:49:11.300199 0.154691 tcp 10.0.2.105 62539 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:49:11.455711 0.111359 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:11.528607 0.217806 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:11.725977 0.098049 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:11.804236 0.101660 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:11.887792 0.375858 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:12.259826 0.185228 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:12.455885 0.234942 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2595 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:12.682752 0.228907 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:12.892148 0.187815 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:13.093026 0.185535 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:13.247841 0.419602 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:13.623723 0.263232 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:13.849747 0.201927 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:14.062562 0.183419 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:14.220560 0.176417 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:14.372567 0.180599 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:14.550297 0.230854 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:14.774666 0.352563 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:15.123371 0.693455 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:15.790452 0.152098 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:15.956146 0.447364 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:16.380759 0.216762 udp 10.0.2.105 7010 <-> 204.83.137.61 9926 CON 0 0 6 2083 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:16.580542 0.103630 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:16.669808 0.062579 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:49:16.730574 1.012928 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/22 08:53:14.796350 3.004628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 08:53:21.808699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:53:29.805309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:53:45.808599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 08:54:08.851783 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 08:54:08.851890 1.322131 tcp 10.0.2.105 62540 -> 200.84.7.244 8038 FSPA* 0 0 14 1604 flow=From-Botnet-V2-TCP-Established 1970/02/22 08:54:17.814401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:00:21.820504 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:00:28.827819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:00:36.829204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:00:52.832673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:01:24.838990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:07:28.863481 3.004959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:07:35.871799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:07:43.872888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:07:59.876358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:08:31.882724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:14:35.889127 3.000881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:14:42.895879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:14:50.897242 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:15:06.900588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:15:38.905847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:19:40.964894 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 09:19:40.965002 0.000000 udp 10.0.2.105 7010 -> 70.53.183.198 9504 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 09:19:57.059356 0.051219 tcp 10.0.2.105 62541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:19:57.110869 0.050050 tcp 10.0.2.105 62542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:19:57.161211 0.147597 tcp 10.0.2.105 62543 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:19:57.309374 0.087087 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.358279 0.066942 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.428665 0.175699 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2470 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.596654 0.160777 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.747727 0.121404 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2555 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.825618 0.191357 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:57.996284 0.171871 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:58.147998 0.100387 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:58.229022 0.373305 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:58.598724 0.237106 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:58.813540 0.191766 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:59.006736 0.269915 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:59.268217 0.188369 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:59.484465 0.239923 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:19:59.712922 0.426222 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:00.083319 0.189820 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2379 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:00.244015 0.179863 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:00.459680 0.262425 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:00.684671 0.200765 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:00.884897 0.176369 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:01.058114 0.208373 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:01.263711 0.352664 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 1976 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:01.612502 0.748258 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:02.333035 0.153922 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:02.492923 0.445987 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:02.918693 0.063753 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:02.995432 0.000000 udp 10.0.2.105 7010 -> 204.83.137.61 9926 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 09:20:19.700449 0.051177 tcp 10.0.2.105 62544 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:20:19.751886 0.051311 tcp 10.0.2.105 62545 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:20:19.803511 0.150327 tcp 10.0.2.105 62546 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:20:19.954350 0.094470 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:20:20.034324 0.446822 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:21:42.913020 3.001318 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 09:21:49.919851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:21:57.921270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:22:13.923649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:22:45.930706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:24:10.181893 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 09:24:10.181982 0.219048 tcp 10.0.2.105 62547 -> 200.84.7.244 8038 SPA_* 0 0 9 1195 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:24:27.020481 0.001824 tcp 10.0.2.105 62547 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:28:49.936522 3.001599 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:28:56.943322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:29:04.945098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:29:20.948000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:29:52.954145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:35:56.961593 3.000449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:36:03.969492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:36:11.969261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:36:27.972296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:36:59.978261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:43:03.984869 3.000817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 09:43:10.991826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:43:18.993316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:43:34.998740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:44:07.002258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:50:37.904520 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 09:50:37.904681 0.000000 udp 10.0.2.105 7010 -> 204.83.137.61 9926 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 09:50:55.421559 0.051155 tcp 10.0.2.105 62548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:50:55.472994 0.050476 tcp 10.0.2.105 62549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:50:55.523766 0.169825 tcp 10.0.2.105 62550 -> 195.113.214.249 443 SRPA* 0 0 37 21060 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:50:55.694165 0.170838 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:55.857837 0.165066 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.014401 0.112968 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.090452 0.088650 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.140829 0.079891 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.201652 0.081339 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.261833 0.100462 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.342967 0.162937 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.486316 0.366077 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:56.848049 0.187489 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:57.045841 0.230856 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:57.269715 0.191657 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:57.462706 0.232873 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:57.675003 0.183635 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:57.831681 1.469400 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:59.268494 0.242792 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2039 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:59.450905 0.201667 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:59.661836 0.175994 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:50:59.835025 0.227021 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:00.059520 0.176156 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:00.215247 0.264866 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:00.443284 0.352355 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:00.791975 0.442580 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:01.211281 0.063875 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:01.273106 0.356580 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:01.599767 0.152439 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:01.752888 0.107907 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:51:01.844485 0.432326 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/22 09:54:27.023828 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 09:54:27.023958 1.456247 tcp 10.0.2.105 62551 -> 200.84.7.244 8038 FSPA* 0 0 15 1758 flow=From-Botnet-V2-TCP-Established 1970/02/22 09:55:44.017566 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 09:55:51.024238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:55:59.025842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:56:15.029035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 09:56:47.034632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:02:51.041385 3.001247 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:02:58.048573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:03:06.049738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:03:22.053131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:03:54.059325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:10:22.069896 3.001116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:10:29.077385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:10:37.078543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:10:53.082888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:11:25.087495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:17:29.095218 2.999344 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:17:36.101531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:17:44.102127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:18:00.105091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:18:32.111419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:21:02.968794 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 10:21:02.968890 0.114323 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:03.047194 0.087984 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:03.123491 0.065918 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:03.171705 0.169080 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:03.333535 0.167862 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:03.490686 0.608247 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2582 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:04.076186 0.101445 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2122 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:04.368993 0.164481 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:04.512294 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 10:21:23.089200 0.061657 tcp 10.0.2.105 62552 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 10:21:23.151156 0.055178 tcp 10.0.2.105 62553 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 10:21:23.206609 0.152797 tcp 10.0.2.105 62554 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/22 10:21:23.360105 0.187922 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:23.550737 0.188098 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:23.780726 0.222519 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:23.996358 0.234925 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:24.211006 0.564423 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:24.747647 0.437380 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2571 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:25.127106 0.261945 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:25.337775 0.217512 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:25.552412 0.176529 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:25.708628 0.202251 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:25.912818 0.176063 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:26.085551 0.261663 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:26.309925 0.347745 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:26.653821 0.445520 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:27.078583 0.063070 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:27.140064 0.105876 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:27.228757 0.485999 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:27.643114 0.364917 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:21:27.979654 0.154666 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:24:28.483953 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 10:24:28.484099 0.218915 tcp 10.0.2.105 62555 -> 200.84.7.244 8038 SPA_* 0 0 9 1184 flow=From-Botnet-V2-TCP-Established 1970/02/22 10:24:36.118393 3.005315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 10:24:37.668470 0.020347 tcp 10.0.2.105 62555 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 10:24:43.124771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:24:51.126078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:25:07.129350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:25:39.135704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:31:43.141533 3.001563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:31:50.148835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:31:58.150397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:32:14.153219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:32:46.159213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:38:50.165489 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:38:57.172752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:39:05.174558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:39:21.176996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:39:53.183032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:45:57.189133 3.001802 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:46:04.196779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:46:12.198289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:46:28.201226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:47:00.207333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:51:34.331969 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 10:51:34.332123 0.382180 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:34.710193 0.061515 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:34.754736 0.189461 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:34.936756 0.109289 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.008101 0.094202 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.070228 0.164231 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.235925 0.463303 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.678909 0.106599 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.768169 0.175875 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:35.923825 0.230241 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:36.147204 0.234737 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:36.361696 0.186188 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:36.549224 0.183825 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:36.709110 0.186798 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:36.867623 0.418592 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2590 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:37.236595 0.176684 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:37.391617 0.200803 udp 10.0.2.105 7010 <-> 24.108.97.158 9398 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:37.593835 0.185197 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:37.776059 0.287941 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:37.944590 0.216484 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:38.158162 0.266246 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:38.388982 0.346731 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:38.731982 0.106378 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:39.927521 0.479436 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:40.347478 0.574769 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:40.898428 0.063949 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:40.961110 0.361082 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:51:41.294921 0.155556 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 10:53:04.213244 3.001273 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 10:53:11.221795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:53:19.222274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:53:35.225362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:54:07.231365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 10:54:37.695395 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 10:54:37.695495 1.387403 tcp 10.0.2.105 62556 -> 200.84.7.244 8038 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:00:11.240636 2.998249 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:00:18.244906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:00:26.245995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:00:42.249159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:01:14.255319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:07:18.262742 2.999860 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:07:25.268794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:07:33.270355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:07:49.274840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:08:21.279265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:14:25.285479 3.001556 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:14:32.292657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:14:40.293981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:14:56.301066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:15:28.303110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:21:32.309774 3.001057 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:21:39.316572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:21:47.323071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:21:48.163341 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 11:21:48.163456 0.353117 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:48.513691 0.063767 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:48.558470 0.086856 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:48.606215 0.205951 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:48.803904 0.175994 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:48.972429 0.115800 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:49.049507 0.861549 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:49.891324 0.101602 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:49.974158 0.164431 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:50.119359 0.188240 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:50.309080 0.188870 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:50.522085 0.232003 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:50.746629 0.234330 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:50.962258 0.186126 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:51.119986 0.406918 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:51.487035 0.177733 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:51.642881 0.248583 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:21:51.901635 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 11:22:03.321501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:22:08.010349 0.051554 tcp 10.0.2.105 62557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:22:08.062237 0.274125 tcp 10.0.2.105 62558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:22:08.336624 0.148330 tcp 10.0.2.105 62559 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:22:08.485553 0.209846 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:08.687318 0.346429 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:09.030004 0.220111 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:09.246965 0.262695 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:09.474875 0.141892 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:09.601044 0.433188 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:09.997437 0.373482 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:10.342869 0.148018 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:10.492435 0.451552 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2601 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:10.918499 0.057089 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:22:35.327225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:24:39.084639 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 11:24:39.084782 0.266380 tcp 10.0.2.105 62560 -> 200.84.7.244 8038 SPA_* 0 0 9 1040 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:24:46.482917 0.005302 tcp 10.0.2.105 62560 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:28:39.332789 3.001749 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:28:46.340671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:28:54.341871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:29:10.344955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:29:42.351022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:35:46.357574 3.001256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:35:53.364159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:36:01.365971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:36:17.368961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:36:49.377024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:42:53.381645 3.000912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 11:43:00.389035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:43:08.389972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:43:24.393224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:43:56.399156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:52:34.694404 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 11:52:34.694517 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 11:52:50.268636 0.055788 tcp 10.0.2.105 62561 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:52:50.324717 0.057737 tcp 10.0.2.105 62562 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:52:50.382961 0.148931 tcp 10.0.2.105 62563 -> 195.113.214.249 443 SRPA* 0 0 42 22022 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:52:50.532671 0.359567 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:52:50.888637 0.069282 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:52:50.939368 0.111244 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:52:51.012865 0.086905 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:52:51.060906 0.164241 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:52:51.216703 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 11:53:08.072694 0.055788 tcp 10.0.2.105 62564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:53:08.128775 0.055253 tcp 10.0.2.105 62565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:53:08.184302 0.155496 tcp 10.0.2.105 62566 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:53:08.340407 0.116200 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2026 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:08.436948 0.095982 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:08.514065 0.146554 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:08.640681 0.188044 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:08.805698 0.223232 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:09.022133 0.248639 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:09.249570 0.182606 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:09.433789 0.180270 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:09.627200 0.139185 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:09.727824 0.422435 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:10.120684 0.187823 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:10.277751 0.181227 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:10.456072 0.268499 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:10.688793 0.104110 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:10.778340 0.354217 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:11.128383 0.215196 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:11.339807 0.430798 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:11.730860 0.363506 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:12.064471 0.162802 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:12.222261 0.452215 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:53:12.655380 0.064041 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/22 11:54:46.493876 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 11:54:46.494044 1.625491 tcp 10.0.2.105 62567 -> 200.84.7.244 8038 FSPA* 0 0 14 1645 flow=From-Botnet-V2-TCP-Established 1970/02/22 11:55:36.408179 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 11:55:43.415468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:55:51.417315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:56:07.420083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 11:56:39.425988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:02:43.432432 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 12:02:50.439330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:02:58.441074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:03:14.443873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:03:46.449980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:10:14.460920 3.001217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 12:10:21.468141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:10:29.469380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:10:45.472689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:11:17.479218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:17:21.485739 3.000595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 12:17:28.491895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:17:36.493240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:17:52.496255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:18:24.502625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:23:27.638355 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:23:27.638457 0.184385 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:27.815123 0.091310 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:27.869208 0.216755 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.077265 0.063427 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.123970 0.389096 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.509400 0.111863 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2042 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.587115 0.107733 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.673467 0.097574 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:28.761405 0.783446 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:29.524466 0.233542 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:29.737522 0.190704 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:29.947291 0.229585 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:30.169602 0.191864 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:30.384207 0.177895 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:30.579508 0.183788 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:30.733861 0.181700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:30.912962 0.457890 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 5 1818 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:31.321643 0.190595 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:31.481205 0.353958 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:31.831398 0.263963 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:32.060263 0.100609 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:32.145730 0.215237 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:32.357121 2.380449 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:34.663996 0.579142 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:35.214777 0.155811 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:35.382535 0.448121 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:23:35.807441 0.062981 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:24:28.510414 3.000091 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 12:24:35.516471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:24:43.517880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:24:48.124442 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:24:48.124596 0.213894 tcp 10.0.2.105 62568 -> 200.84.7.244 8038 SPA_* 0 0 9 1000 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:24:59.520173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:25:18.340021 0.056131 tcp 10.0.2.105 62569 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:18.396464 0.054581 tcp 10.0.2.105 62570 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:18.451379 0.127162 tcp 10.0.2.105 62571 -> 195.113.214.249 443 SRPA* 0 0 35 24224 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:18.550527 0.053220 tcp 10.0.2.105 62568 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:18.604008 3.008142 tcp 10.0.2.105 62572 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:25:27.610755 0.000000 tcp 10.0.2.105 62572 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:25:31.526614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:25:33.601519 0.054705 tcp 10.0.2.105 62573 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:33.656585 0.058231 tcp 10.0.2.105 62574 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:33.715102 0.152160 tcp 10.0.2.105 62575 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:33.884860 2.998849 tcp 10.0.2.105 62576 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:25:42.892770 0.000000 tcp 10.0.2.105 62576 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:25:48.882183 0.053809 tcp 10.0.2.105 62577 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:48.936389 0.056288 tcp 10.0.2.105 62578 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:48.993077 0.177431 tcp 10.0.2.105 62579 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:49.186336 0.438410 tcp 10.0.2.105 62580 -> 200.84.7.244 8038 FSPA* 0 0 13 1216 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:25:49.624949 3.001534 tcp 10.0.2.105 62581 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:25:58.625523 0.000000 tcp 10.0.2.105 62581 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:26:04.624454 3.004230 tcp 10.0.2.105 62582 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:26:13.626982 0.000000 tcp 10.0.2.105 62582 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:26:18.343508 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:31:19.627446 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:31:19.627632 3.003677 tcp 10.0.2.105 62583 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:31:28.629900 0.000000 tcp 10.0.2.105 62583 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:31:34.630577 0.056375 tcp 10.0.2.105 62584 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:34.687263 0.055704 tcp 10.0.2.105 62585 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:34.743289 0.147798 tcp 10.0.2.105 62586 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:34.902639 2.990649 tcp 10.0.2.105 62587 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:31:35.532751 3.001139 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 12:31:42.540222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:31:43.901729 0.000000 tcp 10.0.2.105 62587 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:31:49.901218 0.055367 tcp 10.0.2.105 62588 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:49.956856 0.059217 tcp 10.0.2.105 62589 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.016451 0.147619 tcp 10.0.2.105 62590 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.176173 0.802255 tcp 10.0.2.105 62591 -> 200.84.7.244 8038 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.541369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:31:50.608874 0.056375 tcp 10.0.2.105 62592 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.665575 0.057919 tcp 10.0.2.105 62593 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.723721 0.244902 tcp 10.0.2.105 62594 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:31:50.978687 2.997534 tcp 10.0.2.105 62595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:31:59.974935 0.000000 tcp 10.0.2.105 62595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:32:05.973491 3.004292 tcp 10.0.2.105 62596 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:32:06.544479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:32:14.975797 0.000000 tcp 10.0.2.105 62596 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:32:19.843220 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:32:20.974735 0.443984 tcp 10.0.2.105 62597 -> 200.84.7.244 8038 FSPA* 0 0 13 1390 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:32:38.550852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:37:21.419274 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:37:21.419423 3.002033 tcp 10.0.2.105 62598 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:37:30.419862 0.000000 tcp 10.0.2.105 62598 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:37:36.420593 0.058361 tcp 10.0.2.105 62599 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:36.479216 0.055901 tcp 10.0.2.105 62600 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:36.535420 0.145547 tcp 10.0.2.105 62601 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:36.709609 3.003621 tcp 10.0.2.105 62602 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:37:45.721855 0.000000 tcp 10.0.2.105 62602 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 12:37:51.711161 0.054591 tcp 10.0.2.105 62603 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:51.766053 0.055001 tcp 10.0.2.105 62604 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:51.821364 0.150471 tcp 10.0.2.105 62605 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:37:51.988920 1.383283 tcp 10.0.2.105 62606 -> 200.84.7.244 8038 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:38:42.557115 3.006965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 12:38:49.564821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:38:57.565419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:39:13.568265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:39:45.574428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:45:49.580138 3.001644 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 12:45:56.587857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:46:04.589199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:46:20.592233 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:46:52.598533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:53:49.878551 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 12:53:49.878714 0.000000 udp 10.0.2.105 7010 -> 108.217.233.48 8312 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 12:54:07.896133 0.056792 tcp 10.0.2.105 62607 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:07.953225 0.054618 tcp 10.0.2.105 62608 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:08.008149 0.147493 tcp 10.0.2.105 62609 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:08.156201 0.082057 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:08.201210 0.000000 udp 10.0.2.105 7010 -> 74.141.181.225 2384 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 12:54:25.810513 0.055068 tcp 10.0.2.105 62610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:25.865924 0.054225 tcp 10.0.2.105 62611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:25.920478 0.161920 tcp 10.0.2.105 62612 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/22 12:54:26.083186 0.068246 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.132434 0.355018 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.484395 0.112694 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.561201 0.115618 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.656975 0.100099 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.738829 0.187373 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:26.933433 0.522160 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:27.434199 0.266179 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:27.679895 0.230161 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:27.902931 0.188887 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:28.093612 0.175606 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:28.244983 0.194214 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:28.399165 0.181384 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:28.576737 0.463750 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:28.984810 0.182770 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:29.140184 0.116206 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:29.240339 0.226774 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:29.463487 0.354144 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:29.814228 0.261735 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:30.039741 0.491937 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:30.438215 0.393339 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:30.804304 0.063505 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:30.866217 0.158286 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:54:31.014670 0.577926 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/22 12:57:04.611553 3.001160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 12:57:11.618487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:57:19.619788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:57:35.622719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 12:58:07.628739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:04:11.635195 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:04:18.642302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:04:26.643795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:04:42.649346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:05:14.652782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:07:53.371236 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:07:53.371422 0.716713 tcp 10.0.2.105 62613 -> 200.84.7.244 8038 FSPA* 0 0 13 1286 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:07:53.802887 0.058136 tcp 10.0.2.105 62614 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:07:53.861381 0.055328 tcp 10.0.2.105 62615 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:07:53.917021 0.144549 tcp 10.0.2.105 62616 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:07:54.088572 2.998694 tcp 10.0.2.105 62617 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:03.084848 0.000000 tcp 10.0.2.105 62617 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:09.083816 0.054481 tcp 10.0.2.105 62618 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:09.138549 0.057228 tcp 10.0.2.105 62619 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:09.196024 0.146686 tcp 10.0.2.105 62620 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:09.367949 3.000590 tcp 10.0.2.105 62621 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:18.367018 0.000000 tcp 10.0.2.105 62621 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:24.366329 0.055683 tcp 10.0.2.105 62622 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:24.422385 0.055106 tcp 10.0.2.105 62623 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:24.477803 0.145734 tcp 10.0.2.105 62624 -> 195.113.214.249 443 SRPA* 0 0 42 35296 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:24.643694 0.437339 tcp 10.0.2.105 62625 -> 200.84.7.244 8038 FSPA* 0 0 13 1286 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:08:25.081280 2.999699 tcp 10.0.2.105 62626 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:34.079395 0.000000 tcp 10.0.2.105 62626 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:40.079139 3.003633 tcp 10.0.2.105 62627 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:49.081259 0.000000 tcp 10.0.2.105 62627 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:08:53.837942 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:11:18.658933 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 13:11:25.666079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:11:33.668176 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:11:49.670943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:12:21.676925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:13:55.081649 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:13:55.081801 2.993640 tcp 10.0.2.105 62628 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:14:04.073603 0.000000 tcp 10.0.2.105 62628 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:14:10.084810 0.055014 tcp 10.0.2.105 62629 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:10.140114 0.054476 tcp 10.0.2.105 62630 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:10.194869 0.146584 tcp 10.0.2.105 62631 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:10.352170 2.995049 tcp 10.0.2.105 62632 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:14:19.346060 0.000000 tcp 10.0.2.105 62632 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 13:14:25.345220 0.053956 tcp 10.0.2.105 62633 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:25.399494 0.055825 tcp 10.0.2.105 62634 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:25.455548 0.145157 tcp 10.0.2.105 62635 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:14:25.622808 1.398952 tcp 10.0.2.105 62636 -> 200.84.7.244 8038 FSPA* 0 0 15 1692 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:18:25.682764 3.001437 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 13:18:32.690128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:18:40.691261 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:18:56.694521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:19:28.700615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:24:53.688438 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:24:53.688616 0.166936 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:53.848556 0.164428 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.014312 0.268167 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.246260 0.059598 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.289255 0.361085 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.646738 0.113423 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.721372 0.114397 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:54.921335 0.104509 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 1969 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:55.008777 0.180941 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:55.177905 0.447951 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:55.603588 0.235288 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:55.818496 0.229509 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.040724 0.185490 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.227637 0.177837 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.383899 0.182199 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.535727 0.186522 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.694086 0.198654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2559 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:56.887213 0.461872 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:57.285771 0.347041 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:57.629316 0.110073 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:57.722670 0.220592 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:57.939920 0.271528 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:58.175970 0.580794 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:58.666968 0.148153 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:58.812178 0.360301 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:59.143345 0.057646 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:24:59.199468 0.439829 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:25:32.706192 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:25:39.714206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:25:47.715253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:26:03.718722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:26:35.724525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:32:39.731348 3.001851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:32:46.737998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:32:54.739610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:33:10.742693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:33:42.749047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:39:46.754344 3.002038 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:39:53.761843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:40:01.769756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:40:17.766440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:40:49.772634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:44:27.025364 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:44:27.025530 1.335044 tcp 10.0.2.105 62637 -> 200.84.7.244 8038 FSPA* 0 0 14 1557 flow=From-Botnet-V2-TCP-Established 1970/02/22 13:46:53.780112 3.000109 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:47:00.785913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:47:08.787652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:47:24.790806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:47:56.796307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:54:00.802350 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 13:54:07.809897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:54:15.811450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:54:31.814641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:55:03.823028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 13:55:09.168417 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 13:55:09.168563 0.083371 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:09.217412 0.060301 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:09.284558 0.183764 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:09.644968 0.177278 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:09.807400 0.361209 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.164787 0.111596 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.290457 0.115918 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.386595 0.099711 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.467661 0.185607 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.647252 0.231346 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:10.871296 0.188353 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:11.080650 0.746000 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:11.805711 0.237146 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:12.021085 0.178860 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:12.175997 0.205934 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:12.333256 0.294888 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:12.597996 0.169826 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:12.764482 0.478835 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 5 1962 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:13.193326 0.223939 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:13.414697 0.260102 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:13.641487 0.352929 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:13.990423 0.109273 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:14.084082 0.432672 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:14.483012 0.154323 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:14.636166 0.360057 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:14.971500 0.063403 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/22 13:55:15.033325 0.446950 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:01:07.826126 3.002444 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:01:14.833763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:01:22.835586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:01:38.838736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:02:10.844921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:08:14.855804 2.997019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:08:21.858021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:08:29.859445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:08:45.862764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:09:17.868748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:14:28.365047 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 14:14:28.365205 1.354881 tcp 10.0.2.105 62638 -> 200.84.7.244 8038 FSPA* 0 0 14 1600 flow=From-Botnet-V2-TCP-Established 1970/02/22 14:15:21.874100 3.001397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:15:28.882002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:15:36.883204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:15:52.887183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:16:24.891902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:22:32.906352 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:22:39.911685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:22:47.913245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:23:03.916472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:23:35.922349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:25:23.931603 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 14:25:23.931761 0.311000 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:24.100565 0.240888 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:24.688847 0.063569 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:24.731714 0.163148 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:24.917752 0.384620 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:25.298920 0.111522 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:25.487508 0.184247 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:25.734881 0.224864 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:25.951814 0.102487 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:26.094378 0.093524 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:26.170532 0.191903 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:26.516145 0.550260 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:27.046629 0.235711 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:27.261928 0.216231 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:27.555838 0.173055 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:27.659327 0.186277 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:27.816677 0.190133 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:28.003311 0.267860 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:28.232653 2.068791 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:30.233265 0.212429 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:31.297562 0.354065 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:31.647689 0.097618 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:31.994248 0.438079 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:32.404908 0.057162 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:33.101934 0.486840 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:33.495174 0.153175 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:25:33.712577 0.442074 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:29:39.928909 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:29:46.935641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:29:54.937079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:30:10.940214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:30:42.945579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:36:46.951942 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:36:53.959179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:37:01.960915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:37:17.963890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:37:49.970196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:43:53.976428 3.001419 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:44:00.983471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:44:08.984976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:44:24.988188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:44:29.725015 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 14:44:29.725127 1.405709 tcp 10.0.2.105 62639 -> 200.84.7.244 8038 FSPA* 0 0 14 1703 flow=From-Botnet-V2-TCP-Established 1970/02/22 14:44:56.993954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:55:53.879110 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 14:55:53.879284 0.179756 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:54.051113 0.157637 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:54.202566 0.348557 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:54.546965 0.108054 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:54.656903 0.084175 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.015145 0.063048 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.058783 0.187916 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.302403 0.230645 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.525360 0.111021 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.690039 0.102693 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2482 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:55.773080 0.182028 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:56.014085 0.731372 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:56.725355 0.235400 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:56.940851 0.198768 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 1965 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:57.193071 0.206246 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:57.323435 0.186924 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:57.483720 0.168700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:57.649609 0.269648 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:57.884849 0.418495 udp 10.0.2.105 7010 <-> 58.164.72.200 2815 CON 0 0 6 2430 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:58.249035 0.233393 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:58.479650 0.354157 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:58.830291 0.099044 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:58.958010 0.384421 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:59.314786 0.063638 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:59.426333 0.460191 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 1990 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:55:59.850457 0.480693 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:56:00.241315 0.151782 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/22 14:56:08.002532 3.000256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 14:56:15.009017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:56:23.010597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:56:39.012837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 14:57:11.019645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:03:15.025227 3.001852 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:03:22.032910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:03:30.034356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:03:46.037581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:04:18.043326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:10:34.056067 3.065522 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:10:41.100483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:10:49.075773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:11:05.078853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:11:37.088845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:14:31.137139 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 15:14:31.137247 1.534711 tcp 10.0.2.105 62640 -> 200.84.7.244 8038 FSPA* 0 0 15 1731 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:17:41.091200 3.000615 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:17:48.098105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:17:56.099603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:18:12.102082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:18:44.108851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:24:48.114646 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:24:55.122949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:25:03.123377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:25:21.574731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:25:53.190613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:26:14.158497 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 15:26:14.158598 0.173751 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:14.324233 0.219747 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:16.405935 0.372165 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:34.316863 0.054704 tcp 10.0.2.105 62641 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:34.371859 0.054448 tcp 10.0.2.105 62642 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:34.426565 0.147723 tcp 10.0.2.105 62643 -> 195.113.214.249 443 SRPA* 0 0 34 25384 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:34.574982 0.109552 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:34.646552 0.084971 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:34.925871 0.067251 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:34.974895 0.187733 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:35.325861 0.230641 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:35.549923 0.188206 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:35.754479 0.123275 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2036 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:35.857975 0.093474 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:36.045390 0.439848 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:36.463476 0.234806 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:36.678951 0.175935 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:37.103364 0.170961 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:37.249691 0.188253 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:37.409387 0.174286 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:37.783298 0.261806 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:38.009040 0.353955 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:38.359170 0.000000 udp 10.0.2.105 7010 -> 58.164.72.200 2815 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 15:26:54.247077 0.053720 tcp 10.0.2.105 62644 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:54.301146 0.054839 tcp 10.0.2.105 62645 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:54.356398 0.140212 tcp 10.0.2.105 62646 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:26:54.497521 0.218598 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 1966 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:54.713085 0.110594 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:54.807629 0.359667 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:55.137683 0.063712 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:55.257060 0.445076 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:55.680670 0.505183 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:26:56.121227 0.147582 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:31:55.168616 3.001463 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 15:32:02.175965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:32:10.183441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:32:26.180683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:32:58.186084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:39:02.193532 3.000050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:39:09.200123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:39:17.201646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:39:33.204274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:40:05.213248 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:44:32.675636 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 15:44:32.675825 1.405219 tcp 10.0.2.105 62647 -> 200.84.7.244 8038 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:46:09.216675 3.001496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:46:16.223904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:46:24.225604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:46:40.228751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:47:12.234876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:53:16.240686 3.001329 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 15:53:23.247946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:53:31.249296 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:53:47.252219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:54:19.258618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 15:56:57.105653 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 15:56:57.105766 0.347957 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:56:57.450900 0.000000 udp 10.0.2.105 7010 -> 58.164.72.200 2815 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 15:57:16.144550 0.053977 tcp 10.0.2.105 62648 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:57:16.198776 0.055347 tcp 10.0.2.105 62649 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:57:16.254418 0.146885 tcp 10.0.2.105 62650 -> 195.113.214.249 443 SRPA* 0 0 22 11444 flow=From-Botnet-V2-TCP-Established 1970/02/22 15:57:16.401960 0.162617 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:16.557718 0.258177 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:16.824635 0.111227 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:16.895164 0.186531 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:17.098499 0.230712 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:17.322036 0.061883 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:17.366386 0.100242 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:17.427775 0.179151 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:17.616707 0.713278 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.307068 0.229903 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.516599 0.101825 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.600171 0.106338 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.686685 0.192575 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.837706 0.173530 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:18.990516 0.190964 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:19.152364 0.175085 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:19.324561 0.280601 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:19.569468 0.352874 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:19.918628 0.232244 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2536 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:20.147558 0.103764 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:20.288744 0.354592 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:20.612315 0.062869 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:20.673551 0.159182 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:20.838672 0.448432 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/22 15:57:21.265793 0.530267 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:00:23.265417 3.000434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:00:30.271826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:00:38.273226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:00:54.275972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:01:26.282375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:07:30.288448 3.001679 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:07:37.295914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:07:45.297301 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:08:01.300509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:08:33.306583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:14:34.085650 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 16:14:34.085822 0.275585 tcp 10.0.2.105 62651 -> 200.84.7.244 8038 SPA_* 0 0 9 1224 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:14:37.312918 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:14:44.320046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:14:52.321349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:14:54.347534 0.001664 tcp 10.0.2.105 62651 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:15:08.324569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:15:40.330717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:21:44.335717 3.002553 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:21:51.344032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:21:59.345303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:22:15.348715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:22:47.354109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:27:48.307206 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 16:27:48.307407 0.371946 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:48.675591 0.169824 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:48.981651 0.171070 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:50.293201 0.115235 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:50.427835 0.198104 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:50.659456 0.229164 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:50.881238 0.066725 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:51.051707 0.107897 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:51.118020 0.185162 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:51.384951 0.098756 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:51.466288 0.094278 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:51.728455 0.810854 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:52.520241 0.236827 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:52.735334 0.229371 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:52.886598 0.176439 udp 10.0.2.105 7010 <-> 70.53.145.52 2579 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:53.041273 0.192858 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:53.204149 0.175654 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:53.377094 0.363467 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:53.704506 0.353768 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:54.054501 0.216369 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:55.714252 0.097588 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:56.149122 0.377955 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:56.500760 0.064163 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:56.710400 0.151271 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:56.896732 0.448579 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:27:57.320337 0.486725 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:28:51.360189 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:28:58.367958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:29:06.369505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:29:22.372762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:29:54.378655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:35:58.384193 3.002471 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:36:05.391654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:36:13.393179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:36:29.396729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:37:01.402082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:43:05.409965 2.999980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:43:12.416011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:43:20.417284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:43:36.420350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:44:08.426262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:44:54.352196 0.000180 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 16:44:54.352422 1.985825 tcp 10.0.2.105 62652 -> 200.84.7.244 8038 FSPA* 0 0 14 1720 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:55:46.433245 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 16:55:53.439990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:56:01.441405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:56:17.444270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:56:49.450221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 16:58:10.347184 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 16:58:10.347367 0.379905 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:10.723197 0.186639 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:10.902315 0.184282 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.071967 0.112849 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.144454 0.182440 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.304925 0.226168 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.523828 0.062079 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.566918 0.095379 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.642450 0.112207 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.734015 0.092127 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.786855 0.191584 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:11.979752 0.826706 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:12.783536 0.244657 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:13.007754 0.168046 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:13.116377 0.000000 udp 10.0.2.105 7010 -> 70.53.145.52 2579 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 16:58:28.164420 0.054877 tcp 10.0.2.105 62653 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:58:28.219662 0.054043 tcp 10.0.2.105 62654 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:58:28.273976 0.145130 tcp 10.0.2.105 62655 -> 195.113.214.249 443 SRPA* 0 0 22 12521 flow=From-Botnet-V2-TCP-Established 1970/02/22 16:58:28.419699 0.362890 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:28.749802 0.353767 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:29.099865 0.190900 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:29.262047 0.183053 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:29.442201 0.238406 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:29.675987 0.107377 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:29.768951 0.355928 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:30.097262 0.063588 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:30.159208 0.150851 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2494 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:30.304907 0.447994 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/22 16:58:30.731877 0.425971 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 1957 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:02:53.455865 3.002375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 17:03:00.463911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:03:08.465205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:03:24.469223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:03:56.474136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:10:09.483293 3.001882 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 17:10:16.490707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:10:24.492114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:10:40.496859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:11:12.501326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:14:56.343570 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:14:56.343733 0.770983 tcp 10.0.2.105 62656 -> 200.84.7.244 8038 FSPA* 0 0 13 1365 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:14:56.839093 0.032912 tcp 10.0.2.105 62657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:14:56.872434 0.032095 tcp 10.0.2.105 62658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:14:56.904859 0.187635 tcp 10.0.2.105 62659 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:14:57.114962 3.006521 tcp 10.0.2.105 62660 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:06.118259 0.000000 tcp 10.0.2.105 62660 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:12.116470 0.053351 tcp 10.0.2.105 62661 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:12.170093 0.032538 tcp 10.0.2.105 62662 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:12.202868 0.142741 tcp 10.0.2.105 62663 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:12.355509 3.005426 tcp 10.0.2.105 62664 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:21.359100 0.000000 tcp 10.0.2.105 62664 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:27.348236 0.031847 tcp 10.0.2.105 62665 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:27.380491 0.054279 tcp 10.0.2.105 62666 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:27.435239 0.144159 tcp 10.0.2.105 62667 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:27.595023 0.484865 tcp 10.0.2.105 62668 -> 200.84.7.244 8038 FSPA* 0 0 13 1365 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:15:28.080175 3.002585 tcp 10.0.2.105 62669 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:37.091859 0.000000 tcp 10.0.2.105 62669 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:43.080732 4.635050 tcp 10.0.2.105 62670 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:53.657583 0.000000 tcp 10.0.2.105 62670 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:15:58.355885 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:17:17.029297 2.961970 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 17:17:23.947168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:17:31.843547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:17:47.639065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:18:19.525371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:20:58.094001 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:20:58.094121 3.003549 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:21:07.096156 0.000000 tcp 10.0.2.105 62671 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:21:13.096728 0.032189 tcp 10.0.2.105 62672 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:13.129266 0.055761 tcp 10.0.2.105 62673 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:13.185260 0.125038 tcp 10.0.2.105 62674 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:13.321581 2.997853 tcp 10.0.2.105 62675 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:21:22.317873 0.000000 tcp 10.0.2.105 62675 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:21:28.316788 0.054326 tcp 10.0.2.105 62676 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:28.371401 0.031828 tcp 10.0.2.105 62677 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:28.403471 0.145077 tcp 10.0.2.105 62678 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:21:28.561788 1.389266 tcp 10.0.2.105 62679 -> 200.84.7.244 8038 FSPA* 0 0 14 1611 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:24:23.532612 3.000658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 17:24:30.539174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:24:38.540385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:24:54.543341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:25:26.549151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:28:41.810572 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:28:41.810749 0.000000 udp 10.0.2.105 7010 -> 70.53.145.52 2579 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 17:29:00.158030 0.055084 tcp 10.0.2.105 62680 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:29:00.213350 0.055414 tcp 10.0.2.105 62681 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:29:00.269054 0.125269 tcp 10.0.2.105 62682 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:29:00.394866 0.165190 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:00.551254 0.111936 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:00.626215 0.349443 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:00.972281 0.177542 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.140711 0.226425 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.359636 0.067372 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.409179 0.197440 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.593874 0.109071 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.682171 0.100531 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.747327 0.096608 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:01.825885 0.192774 udp 10.0.2.105 7010 <-> 115.252.120.126 6689 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:02.020100 0.196551 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:02.173085 0.254956 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:02.407921 0.544126 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:02.930330 0.188756 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:03.091443 0.263527 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:03.318053 0.353411 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:03.667776 0.176068 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:03.840515 0.216959 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:04.054667 0.099273 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:04.138196 0.162728 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:04.295772 0.366704 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:04.635735 0.057321 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:04.691318 0.596242 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:29:05.267695 0.423138 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:31:30.555296 3.001612 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 17:31:37.562871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:31:45.564026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:32:01.567445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:32:33.573181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:38:37.579722 3.001243 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 17:38:44.586721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:38:52.588522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:39:08.591075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:39:40.597168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:45:44.603364 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 17:45:51.610712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:45:59.611972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:46:15.615124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:46:47.621880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:51:29.957505 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:51:29.957654 0.721300 tcp 10.0.2.105 62683 -> 200.84.7.244 8038 FSPA* 0 0 13 1455 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:30.396918 0.054235 tcp 10.0.2.105 62684 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:30.451430 0.054735 tcp 10.0.2.105 62685 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:30.506491 0.145573 tcp 10.0.2.105 62686 -> 195.113.214.249 443 SRPA* 0 0 33 16474 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:30.679182 3.003162 tcp 10.0.2.105 62687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:51:39.680924 0.000000 tcp 10.0.2.105 62687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:51:45.680488 0.030760 tcp 10.0.2.105 62688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:45.711596 0.032232 tcp 10.0.2.105 62689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:45.744149 0.128949 tcp 10.0.2.105 62690 -> 195.113.214.249 443 SRPA* 0 0 38 31402 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:51:45.937031 2.997306 tcp 10.0.2.105 62691 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:51:54.943067 0.000000 tcp 10.0.2.105 62691 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:52:00.932186 0.031330 tcp 10.0.2.105 62692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:52:00.963820 0.033048 tcp 10.0.2.105 62693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:52:00.997178 0.127545 tcp 10.0.2.105 62694 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:52:01.170107 0.438217 tcp 10.0.2.105 62695 -> 200.84.7.244 8038 FSPA* 0 0 13 1455 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:52:01.608646 2.998266 tcp 10.0.2.105 62696 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:52:10.605353 0.000000 tcp 10.0.2.105 62696 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:52:16.604197 3.004482 tcp 10.0.2.105 62697 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:52:25.606604 0.000000 tcp 10.0.2.105 62697 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:52:30.333671 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:57:01.637039 3.001494 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 17:57:08.643936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:57:16.645960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:57:31.607717 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:57:31.607896 3.003872 tcp 10.0.2.105 62698 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:57:32.649779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:57:40.609722 0.000000 tcp 10.0.2.105 62698 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:57:46.609951 0.032489 tcp 10.0.2.105 62699 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:57:46.642720 0.055169 tcp 10.0.2.105 62700 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:57:46.698194 0.126943 tcp 10.0.2.105 62701 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:57:46.846391 2.996797 tcp 10.0.2.105 62702 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:57:55.851921 0.000000 tcp 10.0.2.105 62702 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 17:58:01.841048 0.055162 tcp 10.0.2.105 62703 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:58:01.896528 0.054924 tcp 10.0.2.105 62704 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:58:01.951753 0.145818 tcp 10.0.2.105 62705 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:58:02.109329 1.830057 tcp 10.0.2.105 62706 -> 200.84.7.244 8038 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:58:04.654702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 17:59:17.008906 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 17:59:17.009023 0.371968 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:17.377022 0.163757 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:17.531967 0.108022 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:17.600385 0.177027 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:17.770478 0.235349 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:17.997879 0.061596 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:18.072056 0.181653 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:18.232200 0.108323 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:18.320756 0.086506 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2142 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:18.369048 0.095459 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:18.446067 0.000000 udp 10.0.2.105 7010 -> 115.252.120.126 6689 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 17:59:37.018287 0.053573 tcp 10.0.2.105 62707 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:59:37.072170 0.054044 tcp 10.0.2.105 62708 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:59:37.126566 0.143656 tcp 10.0.2.105 62709 -> 195.113.214.249 443 SRPA* 0 0 20 10710 flow=From-Botnet-V2-TCP-Established 1970/02/22 17:59:37.270784 0.157028 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:37.357848 0.235149 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:37.573657 0.924272 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:38.478361 0.194463 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:38.640797 0.245912 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:38.883845 0.217012 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:39.097968 0.261157 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:39.325226 0.352849 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2131 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:39.674116 0.109906 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:39.768426 0.154301 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:39.944801 0.362475 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:40.278309 0.063494 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:40.340129 0.471278 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/22 17:59:40.789720 0.400771 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 3 786 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:04:08.660989 3.001271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 18:04:15.667890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:04:23.669385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:04:39.672483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:05:11.678574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:11:15.685845 2.999960 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 18:11:22.691845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:11:30.693213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:11:46.696126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:12:18.702624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:18:22.708462 3.001665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 18:18:29.715789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:18:37.717438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:18:53.720594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:19:25.726357 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:25:29.732351 3.001605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 18:25:36.740041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:25:44.741403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:26:00.744303 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:26:32.750608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:28:03.942562 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:28:03.942705 0.889606 tcp 10.0.2.105 62710 -> 200.84.7.244 8038 SPA_* 0 0 9 1137 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:16.415022 0.211387 tcp 10.0.2.105 62710 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:16.417183 0.032757 tcp 10.0.2.105 62711 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:16.450157 0.032030 tcp 10.0.2.105 62712 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:16.482006 0.123680 tcp 10.0.2.105 62713 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:16.626680 2.997309 tcp 10.0.2.105 62714 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:28:25.632897 0.000000 tcp 10.0.2.105 62714 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:28:31.625335 0.031526 tcp 10.0.2.105 62715 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:31.657174 0.033219 tcp 10.0.2.105 62716 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:31.690714 0.122846 tcp 10.0.2.105 62717 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:31.837177 2.998769 tcp 10.0.2.105 62718 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:28:40.834437 0.000000 tcp 10.0.2.105 62718 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:28:46.833540 0.054196 tcp 10.0.2.105 62719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:46.887991 0.032224 tcp 10.0.2.105 62720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:46.920542 0.146458 tcp 10.0.2.105 62721 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:28:47.096360 0.227487 tcp 10.0.2.105 62722 -> 200.84.7.244 8038 SPA_* 0 0 9 1137 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:29:07.579480 0.000324 tcp 10.0.2.105 62722 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:29:07.580067 2.997617 tcp 10.0.2.105 62723 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:29:16.575817 0.000000 tcp 10.0.2.105 62723 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:29:22.574985 3.004331 tcp 10.0.2.105 62724 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:29:31.577551 0.000000 tcp 10.0.2.105 62724 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:29:36.334417 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:29:45.477896 0.000000 udp 10.0.2.105 7010 -> 115.252.120.126 6689 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:30:03.784567 0.054272 tcp 10.0.2.105 62725 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:03.839060 0.054784 tcp 10.0.2.105 62726 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:03.894133 0.125925 tcp 10.0.2.105 62727 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:04.020767 0.110166 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:04.092296 0.182917 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:04.467624 0.316805 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:04.810008 0.166926 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:04.964844 0.203041 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:06.549829 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:30:23.502813 0.031304 tcp 10.0.2.105 62728 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:23.534380 0.055476 tcp 10.0.2.105 62729 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:23.590216 0.125332 tcp 10.0.2.105 62730 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:30:23.716483 0.093318 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:23.769468 0.097264 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:23.937622 0.061786 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:23.980924 0.234848 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:24.208504 0.218868 udp 10.0.2.105 7010 <-> 109.55.26.3 5025 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:24.341845 0.237792 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:24.558515 0.739376 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:25.276764 0.219392 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:25.491149 0.188633 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:25.650971 0.254527 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:25.898215 0.261119 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:26.126581 0.352858 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:26.475435 0.111583 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:26.569832 0.063678 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:26.631780 0.177020 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2638 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:26.807192 0.361804 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:27.140841 0.448781 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:27.569096 0.478050 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:27.985953 0.212903 udp 10.0.2.105 7010 <-> 95.238.125.142 3394 CON 0 0 8 3104 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:28.179639 0.164496 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 8 2825 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:28.307380 0.318324 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 8 3026 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:28.616650 0.629009 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 3031 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:29.242409 0.333013 udp 10.0.2.105 7010 <-> 108.217.233.48 8312 CON 0 0 8 3120 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:29.568517 0.361914 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3085 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:29.906126 0.136079 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 2990 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:30.005028 0.153970 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 8 3066 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:30.140669 0.103749 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 3020 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:30.226982 0.000000 udp 10.0.2.105 7010 -> 109.55.26.3 5025 REQ 0 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:30:38.563754 0.459328 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 8 2889 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:39.003870 0.455389 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3124 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:39.452253 1.493715 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 8 3075 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:40.925183 0.415778 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 8 2931 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:41.338146 0.343413 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3068 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:41.654223 0.400919 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 2870 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:42.047511 0.703111 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 8 3198 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:42.746748 0.196860 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 8 2918 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:42.928036 0.125131 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 8 2980 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:43.051689 0.294098 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 8 2855 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:43.341157 0.489809 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 8 2928 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:43.796694 0.867729 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 2932 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:44.643899 1.236610 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 8 2889 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:45.847043 0.698507 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 3156 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:46.517327 0.369621 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 8 2874 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:46.956595 0.000000 udp 10.0.2.105 7010 -> 162.205.97.6 1458 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:30:47.336046 0.000035 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:30:53.004712 0.000000 udp 10.0.2.105 7010 -> 106.188.103.219 6198 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:30:58.663603 0.517255 udp 10.0.2.105 7010 <-> 186.35.92.132 4743 CON 0 0 8 2946 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:59.219070 0.722518 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 8 3065 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:30:59.939694 0.000000 udp 10.0.2.105 7010 -> 46.196.161.121 8513 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:05.112414 0.000000 udp 10.0.2.105 7010 -> 210.89.93.241 6674 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:11.741617 0.000000 udp 10.0.2.105 7010 -> 203.168.200.51 9798 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:16.341478 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:31:18.702866 0.000000 udp 10.0.2.105 7010 -> 216.121.177.196 1160 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:23.769002 0.349309 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 8 2814 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:31:24.212126 0.446333 udp 10.0.2.105 7010 <-> 189.191.117.208 7749 CON 0 0 8 3090 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:31:24.780420 0.341828 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 8 3081 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:31:25.130018 0.000000 udp 10.0.2.105 7010 -> 88.225.211.28 8793 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:31.570238 0.000000 udp 10.0.2.105 7010 -> 173.202.56.73 7510 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:38.940825 0.000000 udp 10.0.2.105 7010 -> 201.183.29.150 3575 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:43.837585 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:31:45.750964 0.000000 udp 10.0.2.105 7010 -> 109.67.20.176 6219 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:51.018182 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:31:57.667721 0.464430 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 8 2948 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:31:58.543066 0.000000 udp 10.0.2.105 7010 -> 79.1.198.12 3244 INT 0 1 164 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:05.789616 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:10.335656 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:32:13.400085 0.000000 udp 10.0.2.105 7010 -> 96.21.140.216 1783 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:19.869796 1.668438 udp 10.0.2.105 7010 <-> 72.251.11.9 2321 CON 0 0 8 3162 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:32:21.059479 0.000000 udp 10.0.2.105 7010 -> 49.187.75.123 5291 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:26.889613 0.000000 udp 10.0.2.105 7010 -> 189.164.5.125 1590 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:32.678025 0.000000 udp 10.0.2.105 7010 -> 222.45.182.131 1697 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:36.755740 3.002182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 18:32:37.334417 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:32:38.816799 0.425526 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 8 2962 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:32:39.301818 0.233390 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 824 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:32:39.544689 0.226148 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 815 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:32:39.780823 0.000000 udp 10.0.2.105 7010 -> 116.15.34.3 1636 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:43.763941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:32:45.296458 0.000000 udp 10.0.2.105 7010 -> 68.88.233.61 4873 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:32:51.765322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:32:53.678272 0.000000 udp 10.0.2.105 7010 -> 171.98.35.200 6263 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:00.718321 0.000000 udp 10.0.2.105 7010 -> 36.238.33.169 6105 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:05.334617 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:33:07.247995 0.113737 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:33:07.371255 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:07.768360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:33:14.207873 0.000000 udp 10.0.2.105 7010 -> 86.136.180.112 7670 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:20.176496 0.000000 udp 10.0.2.105 7010 -> 203.158.176.17 3171 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:28.087556 0.000000 udp 10.0.2.105 7010 -> 95.231.26.35 3237 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:32.834401 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:33:35.619065 0.000000 udp 10.0.2.105 7010 -> 71.10.220.236 9962 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:39.774442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:33:42.838723 0.330749 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 695 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:33:43.185966 0.000000 udp 10.0.2.105 7010 -> 210.11.5.74 8551 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:48.446363 0.000000 udp 10.0.2.105 7010 -> 95.230.10.88 1517 INT 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:54.928405 0.193673 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:33:55.133781 0.000000 udp 10.0.2.105 7010 -> 99.142.74.60 5819 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:33:59.833205 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:34:01.735731 0.000000 udp 10.0.2.105 7010 -> 216.67.11.60 6318 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:09.997968 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:15.115169 0.000000 udp 10.0.2.105 7010 -> 87.203.119.206 3236 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:23.087351 0.000000 udp 10.0.2.105 7010 -> 50.84.50.211 9576 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:27.833418 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:34:28.714938 0.000000 udp 10.0.2.105 7010 -> 24.108.97.158 9398 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:34.363077 0.000000 udp 10.0.2.105 7010 -> 122.166.16.76 7760 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:37.577969 3.003845 tcp 10.0.2.105 62731 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:34:40.171333 0.000000 udp 10.0.2.105 7010 -> 109.129.54.136 8716 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:45.198732 0.000000 udp 10.0.2.105 7010 -> 180.252.66.203 1083 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:46.580463 0.000000 tcp 10.0.2.105 62731 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:34:52.586360 0.060895 tcp 10.0.2.105 62732 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:34:52.647539 0.054883 tcp 10.0.2.105 62733 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:34:52.702730 0.134811 tcp 10.0.2.105 62734 -> 195.113.214.249 443 SRPA* 0 0 42 35296 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:34:52.849779 2.995574 tcp 10.0.2.105 62735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:34:54.025570 0.000000 udp 10.0.2.105 7010 -> 95.241.28.40 7707 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:34:59.929634 0.000000 udp 10.0.2.105 7010 -> 82.63.220.138 7380 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:01.852585 0.000000 tcp 10.0.2.105 62735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:35:05.227558 0.202686 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:35:05.447891 0.000000 udp 10.0.2.105 7010 -> 178.51.61.173 3027 INT 0 1 121 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:07.841989 0.031778 tcp 10.0.2.105 62736 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:07.874089 0.031798 tcp 10.0.2.105 62737 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:07.906266 0.145836 tcp 10.0.2.105 62738 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:08.072616 2.993086 tcp 10.0.2.105 62739 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:35:13.829764 0.060311 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:35:13.905336 0.000000 udp 10.0.2.105 7010 -> 181.67.34.40 8957 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:17.064203 0.000000 tcp 10.0.2.105 62739 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 18:35:19.588205 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:23.073516 0.032102 tcp 10.0.2.105 62740 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:23.105886 0.054670 tcp 10.0.2.105 62741 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:23.160897 0.120930 tcp 10.0.2.105 62742 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:23.291178 0.217278 tcp 10.0.2.105 62743 -> 200.84.7.244 8038 SPA_* 0 0 9 1180 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:25.396505 0.000000 udp 10.0.2.105 7010 -> 110.169.235.81 9181 INT 0 1 288 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:32.396341 0.000000 udp 10.0.2.105 7010 -> 71.195.194.13 6326 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:39.847667 0.141489 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:35:40.013497 0.000000 udp 10.0.2.105 7010 -> 24.203.109.95 1544 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:41.906069 0.078725 tcp 10.0.2.105 62743 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 18:35:46.406350 0.000000 udp 10.0.2.105 7010 -> 70.45.165.242 1606 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:52.516169 0.000000 udp 10.0.2.105 7010 -> 173.217.251.187 9784 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:35:58.913994 0.000000 udp 10.0.2.105 7010 -> 69.35.248.158 2508 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:04.743010 0.000000 udp 10.0.2.105 7010 -> 92.112.188.53 2251 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:09.339411 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:36:12.734451 0.000000 udp 10.0.2.105 7010 -> 75.3.121.23 3826 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:18.973235 0.000000 udp 10.0.2.105 7010 -> 69.234.17.4 7606 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:26.504721 0.146474 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 840 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:36:26.677369 0.288710 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 734 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:36:26.978194 0.000000 udp 10.0.2.105 7010 -> 87.19.119.36 5923 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:35.833859 0.000000 udp 10.0.2.105 7010 -> 193.165.72.208 4255 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:40.333850 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:36:44.481848 0.000000 udp 10.0.2.105 7010 -> 186.145.46.93 3653 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:50.959542 0.000000 udp 10.0.2.105 7010 -> 69.248.253.212 6612 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:36:58.110160 0.000000 udp 10.0.2.105 7010 -> 137.135.45.169 1024 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:04.138772 0.128636 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:37:04.278408 0.000000 udp 10.0.2.105 7010 -> 88.39.150.210 7376 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:08.834746 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:37:09.666289 0.000000 udp 10.0.2.105 7010 -> 24.159.72.10 1432 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:15.894771 0.087148 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:37:15.993605 0.000000 udp 10.0.2.105 7010 -> 178.20.75.216 9199 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:23.877036 0.000000 udp 10.0.2.105 7010 -> 217.201.200.215 9153 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:30.877273 0.090702 udp 10.0.2.105 7010 -> 84.222.243.66 7438 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:30.967975 0.000000 icmp 84.222.243.66 0x0303 -> 10.0.2.105 0x0e1d URP 192 1 225 flow=Background 1970/02/22 18:37:35.833848 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:37:38.087469 0.000000 udp 10.0.2.105 7010 -> 92.43.177.10 3198 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:44.967399 0.000000 udp 10.0.2.105 7010 -> 87.228.207.194 1974 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:53.038858 0.000000 udp 10.0.2.105 7010 -> 82.104.68.98 6396 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:37:58.526311 0.000000 udp 10.0.2.105 7010 -> 39.221.56.88 1294 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:03.334695 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:38:05.516818 0.000000 udp 10.0.2.105 7010 -> 62.28.136.214 2432 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:13.879162 0.064002 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 817 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:38:13.961240 0.208029 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 679 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:38:14.186113 0.000000 udp 10.0.2.105 7010 -> 74.71.223.201 7749 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:22.050494 0.000000 udp 10.0.2.105 7010 -> 38.104.230.106 5560 INT 0 1 302 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:28.269565 0.000000 udp 10.0.2.105 7010 -> 80.15.77.145 1622 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:32.839130 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:38:33.279487 0.000000 udp 10.0.2.105 7010 -> 112.204.159.195 1045 INT 0 1 118 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:41.909123 0.000000 udp 10.0.2.105 7010 -> 99.103.56.21 3499 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:50.861921 0.000000 udp 10.0.2.105 7010 -> 39.229.169.109 8635 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:38:57.691680 0.000000 udp 10.0.2.105 7010 -> 218.186.75.222 7034 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:02.338054 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:39:04.251042 0.000000 udp 10.0.2.105 7010 -> 93.39.243.184 3763 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:10.860849 0.117504 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:39:10.995209 0.000000 udp 10.0.2.105 7010 -> 116.25.205.135 3891 INT 0 1 287 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:17.720688 0.000000 udp 10.0.2.105 7010 -> 190.233.186.211 9836 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:23.269931 0.000000 udp 10.0.2.105 7010 -> 2.231.19.222 1710 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:27.834818 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:39:28.916472 0.000000 udp 10.0.2.105 7010 -> 60.188.101.139 6923 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:33.996001 0.000000 udp 10.0.2.105 7010 -> 79.39.23.172 8106 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:39.011295 0.000000 udp 10.0.2.105 7010 -> 105.250.70.81 2384 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:43.781694 3.000225 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 18:39:46.852512 0.000000 udp 10.0.2.105 7010 -> 122.169.105.61 7000 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:50.787876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:39:51.839229 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:39:54.002888 0.000000 udp 10.0.2.105 7010 -> 68.52.67.182 9374 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:39:58.789387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:40:01.183451 0.000000 udp 10.0.2.105 7010 -> 180.251.163.173 3315 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:10.045585 0.000000 udp 10.0.2.105 7010 -> 79.183.224.199 6118 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:14.792316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:40:15.874108 0.000000 udp 10.0.2.105 7010 -> 58.211.47.140 2896 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:20.840932 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:40:22.833910 0.000000 udp 10.0.2.105 7010 -> 203.206.159.34 1828 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:29.774088 0.000000 udp 10.0.2.105 7010 -> 207.62.236.140 5716 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:37.697398 0.000000 udp 10.0.2.105 7010 -> 68.196.213.200 7516 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:43.720900 0.000000 udp 10.0.2.105 7010 -> 173.224.40.15 4466 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:46.992903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:40:48.522065 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:40:50.694219 0.000000 udp 10.0.2.105 7010 -> 113.240.193.115 1206 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:40:56.460275 0.000000 udp 10.0.2.105 7010 -> 58.7.8.233 1404 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:03.224688 0.221850 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 861 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:41:03.458035 0.195501 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:41:03.671222 0.000000 udp 10.0.2.105 7010 -> 24.178.52.98 9808 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:11.593895 0.390291 udp 10.0.2.105 7010 -> 184.170.18.237 7824 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:11.984186 0.000000 icmp 184.170.18.237 0x0303 -> 10.0.2.105 0x901e URP 192 1 212 flow=Background 1970/02/22 18:41:16.340672 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:41:18.373705 0.188674 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:41:18.573430 0.000000 udp 10.0.2.105 7010 -> 213.175.34.150 7460 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:24.482664 0.711612 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 732 flow=From-Botnet-V2-UDP-Established 1970/02/22 18:41:25.346586 0.000000 udp 10.0.2.105 7010 -> 86.144.3.53 6006 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:32.554131 0.000000 udp 10.0.2.105 7010 -> 101.50.233.247 4113 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:39.844853 0.000000 udp 10.0.2.105 7010 -> 84.232.168.61 8812 INT 0 1 134 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:41:44.844097 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 18:41:48.006057 0.000000 udp 10.0.2.105 7010 -> 69.199.78.98 6081 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 18:46:50.808809 2.997569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 18:46:57.811818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:47:05.813697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:47:21.816204 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:47:53.822200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:53:57.828263 3.001936 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 18:54:04.835954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:54:12.837275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:54:28.840184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 18:55:00.846504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:01:04.852720 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 19:01:11.859852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:01:19.861099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:01:35.864011 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:02:07.870182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:05:41.988637 0.000216 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 19:05:41.988972 1.326536 tcp 10.0.2.105 62744 -> 200.84.7.244 8038 FSPA* 0 0 15 1637 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:08:11.877409 3.000827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 19:08:18.883712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:08:26.884925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:08:42.887976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:09:14.898805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:12:02.215069 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 19:12:02.215262 0.153812 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:02.369591 0.000000 udp 10.0.2.105 7010 -> 95.238.125.142 3394 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:12:17.449150 0.056048 tcp 10.0.2.105 62745 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:17.505605 0.032273 tcp 10.0.2.105 62746 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:17.538228 0.178413 tcp 10.0.2.105 62747 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:17.717460 0.074610 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:17.792520 0.164668 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:17.957713 0.049942 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.008030 0.366050 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.376816 0.074915 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.452212 0.048177 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.500828 0.214199 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.715539 0.222802 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:18.938877 0.345669 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:19.284994 0.180297 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:19.465829 0.214974 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:19.681302 0.154102 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:19.835801 0.059667 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:19.895966 0.342695 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:20.239173 0.076496 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:20.316136 0.149147 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:20.465774 0.222528 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:20.688747 0.421108 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:21.110225 0.410276 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:21.520911 0.351732 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:21.873205 0.182418 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:22.056020 0.339641 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:22.396156 0.257967 udp 10.0.2.105 7010 <-> 186.35.92.132 4743 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:22.654602 0.179540 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:22.834704 0.144455 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:22.979655 0.000000 udp 10.0.2.105 7010 -> 189.191.117.208 7749 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:12:38.137163 0.033283 tcp 10.0.2.105 62748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:38.170864 0.033477 tcp 10.0.2.105 62749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:38.204672 0.126793 tcp 10.0.2.105 62750 -> 195.113.214.249 443 SRPA* 0 0 26 14334 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:12:38.332103 0.224718 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:38.557305 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:12:44.769313 0.000000 udp 10.0.2.105 7010 <- 72.251.11.9 2321 RSP 0 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:12:44.771412 0.216340 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:44.988245 0.225883 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:45.214541 0.216937 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:45.431938 0.117173 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:45.549536 0.330311 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:45.880521 0.189818 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.070915 0.198689 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.270054 0.057312 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.327764 0.138060 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.466261 0.274317 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.740991 0.143827 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:46.885345 0.124200 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.009926 0.084331 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.094716 0.064079 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.159191 0.206722 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.366347 0.116767 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.483621 0.217149 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.701202 0.189542 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:47.891125 0.189661 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:12:48.081213 0.225576 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:15:18.899864 3.001800 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 19:15:25.907393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:15:33.909535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:15:49.911775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:16:21.918229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:22:25.924124 3.001813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 19:22:32.931239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:22:40.932708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:22:56.935743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:23:28.942084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:29:32.947415 3.003819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 19:29:39.955343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:29:47.957084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:30:03.960097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:30:35.965647 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:35:43.318211 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 19:35:43.318359 0.658547 tcp 10.0.2.105 62751 -> 200.84.7.244 8038 FSPA* 0 0 13 1371 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:43.760101 0.033316 tcp 10.0.2.105 62752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:43.793705 0.031696 tcp 10.0.2.105 62753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:43.825734 0.128062 tcp 10.0.2.105 62754 -> 195.113.214.249 443 SRPA* 0 0 21 11390 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:43.977157 2.995887 tcp 10.0.2.105 62755 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:35:52.981876 0.000000 tcp 10.0.2.105 62755 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:35:58.970965 0.031152 tcp 10.0.2.105 62756 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:59.002400 0.055823 tcp 10.0.2.105 62757 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:59.058446 0.123405 tcp 10.0.2.105 62758 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:35:59.206525 2.998345 tcp 10.0.2.105 62759 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:08.203618 0.000000 tcp 10.0.2.105 62759 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:14.202855 0.032081 tcp 10.0.2.105 62760 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:14.235180 0.032027 tcp 10.0.2.105 62761 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:14.267518 0.145817 tcp 10.0.2.105 62762 -> 195.113.214.249 443 SRPA* 0 0 20 11372 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:14.455109 3.002304 tcp 10.0.2.105 62763 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:23.455647 0.000000 tcp 10.0.2.105 62763 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:29.454957 0.031586 tcp 10.0.2.105 62764 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:29.486791 0.032013 tcp 10.0.2.105 62765 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:29.519086 0.128652 tcp 10.0.2.105 62766 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:29.669836 0.437536 tcp 10.0.2.105 62767 -> 200.84.7.244 8038 FSPA* 0 0 13 1371 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:36:30.107617 3.001848 tcp 10.0.2.105 62768 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:39.108165 0.000000 tcp 10.0.2.105 62768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:39.972924 3.000704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 19:36:45.107171 3.003806 tcp 10.0.2.105 62769 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:46.979333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:36:54.109864 0.000000 tcp 10.0.2.105 62769 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:36:54.980704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:36:58.836800 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 19:37:00.111339 3.001324 tcp 10.0.2.105 62770 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:37:09.111375 0.000000 tcp 10.0.2.105 62770 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:37:10.983393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:37:42.990111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:42:15.112016 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 19:42:15.112188 2.993189 tcp 10.0.2.105 62771 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:42:24.104142 0.000000 tcp 10.0.2.105 62771 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:42:30.114940 0.032479 tcp 10.0.2.105 62772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:30.147780 0.032186 tcp 10.0.2.105 62773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:30.180388 0.125768 tcp 10.0.2.105 62774 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:30.321406 2.995966 tcp 10.0.2.105 62775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:42:39.316184 0.000000 tcp 10.0.2.105 62775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:42:45.315302 0.032188 tcp 10.0.2.105 62776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:45.347884 0.032548 tcp 10.0.2.105 62777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:45.380704 0.128785 tcp 10.0.2.105 62778 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:42:45.522401 2.996867 tcp 10.0.2.105 62779 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:42:54.517921 0.000000 tcp 10.0.2.105 62779 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 19:43:00.267129 0.000000 udp 10.0.2.105 7010 -> 189.191.117.208 7749 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:43:00.517660 0.032071 tcp 10.0.2.105 62780 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:00.550029 0.032706 tcp 10.0.2.105 62781 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:00.583033 0.123914 tcp 10.0.2.105 62782 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:00.723334 1.329138 tcp 10.0.2.105 62783 -> 200.84.7.244 8038 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:17.831966 0.032451 tcp 10.0.2.105 62784 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:17.864686 0.031948 tcp 10.0.2.105 62785 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:17.896897 0.125469 tcp 10.0.2.105 62786 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:18.023032 0.152921 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.176326 0.052665 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.229396 0.066805 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.296586 0.168844 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.465888 0.075119 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.541474 0.047291 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.589165 0.213090 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:18.802664 0.371897 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:19.174985 0.222119 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:19.397543 0.213686 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:19.611575 0.151734 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:19.763784 0.176594 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:19.940867 0.170567 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:20.111789 0.060493 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:20.172718 0.149751 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:20.322887 0.222416 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:20.545734 0.418859 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:20.964998 0.343364 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:21.308834 0.075460 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:21.384681 0.179615 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:21.564795 0.329759 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:21.894952 0.458449 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:22.353888 0.179085 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:22.533449 0.141877 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:22.675759 0.370191 udp 10.0.2.105 7010 <-> 186.35.92.132 4743 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:23.046336 0.341054 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:23.387799 0.226517 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:23.614707 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:43:38.812465 0.030781 tcp 10.0.2.105 62787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:38.843513 0.033163 tcp 10.0.2.105 62788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:38.876970 0.125349 tcp 10.0.2.105 62789 -> 195.113.214.249 443 SRPA* 0 0 40 31758 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:39.002882 0.212075 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:39.215429 0.113313 udp 10.0.2.105 7010 <-> 46.117.105.10 3326 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:39.329151 0.329418 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:39.658983 0.187775 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:39.847139 0.227536 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:40.075103 0.216758 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:40.292306 0.213057 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:40.505685 0.056870 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:40.562977 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 19:43:46.995198 3.005639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 19:43:54.003006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:43:57.649925 0.031586 tcp 10.0.2.105 62790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:57.681833 0.032153 tcp 10.0.2.105 62791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:57.714271 0.137495 tcp 10.0.2.105 62792 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 19:43:57.852421 0.285326 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.138143 0.137201 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.275764 0.124607 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.400734 0.085183 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.486313 0.116580 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.603403 0.207377 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:58.811266 0.197288 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:59.008991 0.186732 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:59.196093 0.062747 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:59.259200 0.220152 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:43:59.479789 0.222248 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/22 19:44:02.004979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:44:18.008065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:44:50.013896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:56:04.025356 3.001953 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 19:56:11.033208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:56:19.034138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:56:35.037869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 19:57:07.043706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:03:11.049971 3.001390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 20:03:18.057228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:03:26.058781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:03:42.061540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:04:14.067874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:10:22.079934 3.001327 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 20:10:29.087004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:10:37.088403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:10:53.091530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:11:25.097474 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:13:02.057460 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 20:13:02.057549 0.658436 tcp 10.0.2.105 62793 -> 200.84.7.244 8038 FSPA* 0 0 13 1284 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:02.491412 0.032079 tcp 10.0.2.105 62794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:02.523778 0.054418 tcp 10.0.2.105 62795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:02.578476 0.108781 tcp 10.0.2.105 62796 -> 195.113.214.249 443 SRPA* 0 0 33 23951 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:02.716433 3.005659 tcp 10.0.2.105 62797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:11.720746 0.000000 tcp 10.0.2.105 62797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:17.709921 0.034633 tcp 10.0.2.105 62798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:17.744825 0.032403 tcp 10.0.2.105 62799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:17.777517 0.144114 tcp 10.0.2.105 62800 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:17.940709 2.993219 tcp 10.0.2.105 62801 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:26.942668 0.000000 tcp 10.0.2.105 62801 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:32.941933 0.032221 tcp 10.0.2.105 62802 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:32.974429 0.032471 tcp 10.0.2.105 62803 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:33.007224 0.124897 tcp 10.0.2.105 62804 -> 195.113.214.249 443 SRPA* 0 0 20 11372 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:33.143150 3.003291 tcp 10.0.2.105 62805 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:42.144606 0.000000 tcp 10.0.2.105 62805 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:48.143863 0.032028 tcp 10.0.2.105 62806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:48.176238 0.032542 tcp 10.0.2.105 62807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:48.209094 0.147303 tcp 10.0.2.105 62808 -> 195.113.214.249 443 SRPA* 0 0 60 41314 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:48.371202 0.439906 tcp 10.0.2.105 62809 -> 200.84.7.244 8038 FSPA* 0 0 13 1284 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:13:48.811181 2.997542 tcp 10.0.2.105 62810 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:13:57.806908 0.000000 tcp 10.0.2.105 62810 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:14:03.805839 3.005390 tcp 10.0.2.105 62811 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:14:04.587393 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:14:10.832285 0.615274 udp 10.0.2.105 7010 <- 72.251.11.9 2321 RSP 0 0 5 2138 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:14:10.833089 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:14:12.808766 0.000000 tcp 10.0.2.105 62811 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:14:15.331999 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 20:14:18.807532 3.003851 tcp 10.0.2.105 62812 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:14:27.811010 0.000000 tcp 10.0.2.105 62812 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:14:27.851929 0.054382 tcp 10.0.2.105 62813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:27.906666 0.054293 tcp 10.0.2.105 62814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:27.961293 0.170336 tcp 10.0.2.105 62815 -> 195.113.214.249 443 SRPA* 0 0 22 11444 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:28.132193 0.178946 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.289303 0.093280 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.382424 0.069034 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.523423 0.229368 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.732422 0.107316 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.834152 0.106038 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:28.899368 0.162472 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:29.145240 0.213535 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:29.356105 0.184344 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:29.511260 0.540941 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:30.030078 0.175527 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:30.201970 0.234734 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:30.429084 0.356150 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:30.781473 0.268815 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:31.224476 0.156050 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:31.375040 0.063583 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:31.436683 0.445665 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:31.860168 0.104897 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:31.947406 0.354773 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2524 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:32.298243 0.189603 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2473 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:32.476698 0.355487 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:32.802911 0.286764 udp 10.0.2.105 7010 <-> 186.35.92.132 4743 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:33.095612 0.173750 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:33.480022 0.179236 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:33.653862 0.421619 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:34.025673 0.373601 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:34.389073 0.245303 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2587 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:34.626872 0.335164 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:34.957993 0.224460 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:35.149119 0.215079 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:35.355018 0.261429 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:35.580405 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:14:50.984267 0.031071 tcp 10.0.2.105 62816 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:51.015633 0.054165 tcp 10.0.2.105 62817 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:51.070054 0.122994 tcp 10.0.2.105 62818 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:14:51.193587 0.222526 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:51.391924 0.216892 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:51.605549 0.073439 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:51.693494 0.284232 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:51.972577 0.153167 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.116976 0.144202 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.243310 0.099816 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.334274 0.118457 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.456478 0.214008 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.667722 0.187467 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:52.856011 0.218739 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:53.071504 0.287204 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:53.297549 0.196399 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:14:53.486370 0.062688 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:17:29.105028 3.000278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 20:17:36.110783 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:17:44.112319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:18:00.115293 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:18:32.121416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:19:33.810674 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 20:19:33.810855 2.993797 tcp 10.0.2.105 62819 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:19:42.812989 0.000000 tcp 10.0.2.105 62819 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:19:48.813140 0.054820 tcp 10.0.2.105 62820 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:19:48.868182 0.053386 tcp 10.0.2.105 62821 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:19:48.921880 0.147020 tcp 10.0.2.105 62822 -> 195.113.214.249 443 SRPA* 0 0 20 10084 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:19:49.129219 2.996979 tcp 10.0.2.105 62823 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:19:58.125005 0.000000 tcp 10.0.2.105 62823 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:20:04.124164 0.053162 tcp 10.0.2.105 62824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:04.177708 0.032674 tcp 10.0.2.105 62825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:04.210667 0.145721 tcp 10.0.2.105 62826 -> 195.113.214.249 443 SRPA* 0 0 21 10308 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:04.366257 3.001832 tcp 10.0.2.105 62827 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:20:13.367283 0.000000 tcp 10.0.2.105 62827 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:20:19.366333 0.031485 tcp 10.0.2.105 62828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:19.398084 0.031828 tcp 10.0.2.105 62829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:19.430174 0.125476 tcp 10.0.2.105 62830 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:20:20.216452 1.439109 tcp 10.0.2.105 62831 -> 200.84.7.244 8038 FSPA* 0 0 14 1628 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:24:36.126875 3.002667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 20:24:43.135127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:24:51.136459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:25:07.141371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:25:39.145543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:31:43.151691 3.001149 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 20:31:50.158780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:31:58.160598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:32:14.162773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:32:46.170650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:38:50.175814 3.001120 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 20:38:57.182774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:39:05.184127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:39:21.189255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:39:53.193184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:45:05.091982 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 20:45:05.092415 0.000000 udp 10.0.2.105 7010 -> 46.117.105.10 3326 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:45:20.165048 0.032600 tcp 10.0.2.105 62832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:20.197903 0.032620 tcp 10.0.2.105 62833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:20.230842 0.121231 tcp 10.0.2.105 62834 -> 195.113.214.249 443 SRPA* 0 0 32 24769 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:20.352718 0.440402 udp 10.0.2.105 7010 <-> 72.251.11.9 2321 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:20.793783 0.041041 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:20.835224 0.214697 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.050370 0.067698 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.118487 0.049822 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.168735 0.158602 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.327802 0.078953 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.407259 0.159927 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:21.567606 0.548185 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:22.116211 0.507259 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:22.623906 0.159398 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:22.783868 0.218149 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:23.002405 0.338289 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:23.341119 0.222305 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:23.563786 0.059597 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:23.623747 0.422967 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:24.047132 0.082696 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:24.130233 0.224995 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:24.355576 0.150500 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:24.506507 0.347823 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:24.854836 0.000000 udp 10.0.2.105 7010 -> 186.35.92.132 4743 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 20:45:43.297403 0.032244 tcp 10.0.2.105 62835 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:43.330059 0.032240 tcp 10.0.2.105 62836 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:43.362600 0.140052 tcp 10.0.2.105 62837 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:45:43.503203 0.362529 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:43.866189 0.179835 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:44.046502 0.170715 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:44.217633 0.145002 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:44.363016 0.381260 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:44.744644 0.329771 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:45.074895 0.361836 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:45.437285 0.230367 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:45.668074 0.211092 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:45.879616 0.185606 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:46.065721 0.226146 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:46.292241 0.198841 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:46.491507 0.210051 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:46.701942 0.056945 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:46.759333 0.275050 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.034991 0.144032 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.179521 0.124844 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.304807 0.084155 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.389427 0.116773 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.506652 0.209322 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.716563 0.195254 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:47.912330 0.210160 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:48.122974 0.062950 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:48.186386 0.417786 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:48.604661 0.186869 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/22 20:45:57.198743 3.002420 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 20:46:04.207101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:46:12.208883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:46:28.211309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:47:00.220044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:50:21.660470 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 20:50:21.660653 0.217944 tcp 10.0.2.105 62838 -> 200.84.7.244 8038 SPA_* 0 0 9 1061 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:42.092918 0.234718 tcp 10.0.2.105 62838 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:42.095047 0.032113 tcp 10.0.2.105 62839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:42.127399 0.031877 tcp 10.0.2.105 62840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:42.159583 0.125813 tcp 10.0.2.105 62841 -> 195.113.214.249 443 SRPA* 0 0 22 11482 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:42.327865 3.003154 tcp 10.0.2.105 62842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:50:51.329755 0.000000 tcp 10.0.2.105 62842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:50:57.329226 0.031460 tcp 10.0.2.105 62843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:57.360939 0.032025 tcp 10.0.2.105 62844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:57.393258 0.123661 tcp 10.0.2.105 62845 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:50:57.532391 3.000401 tcp 10.0.2.105 62846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:51:06.531537 0.000000 tcp 10.0.2.105 62846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:51:12.531366 0.054656 tcp 10.0.2.105 62847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:12.586340 0.033483 tcp 10.0.2.105 62848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:12.620125 0.124649 tcp 10.0.2.105 62849 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:12.768996 2.995707 tcp 10.0.2.105 62850 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:51:21.763104 0.000000 tcp 10.0.2.105 62850 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 20:51:27.762349 0.031931 tcp 10.0.2.105 62851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:27.794549 0.032610 tcp 10.0.2.105 62852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:27.827456 0.123852 tcp 10.0.2.105 62853 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:28.002007 0.220308 tcp 10.0.2.105 62854 -> 200.84.7.244 8038 SPA_* 0 0 9 1061 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:51:35.260013 0.017176 tcp 10.0.2.105 62854 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/22 20:53:04.223261 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 20:53:11.230711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:53:19.232061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:53:35.234631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 20:54:07.241370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:00:11.246357 3.002735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:00:18.254568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:00:26.256332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:00:42.259073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:01:14.264991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:07:23.278696 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:07:30.285915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:07:38.287004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:07:54.290237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:08:26.296346 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:14:30.302365 3.001629 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:14:37.309944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:14:45.311322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:15:01.314081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:15:33.320800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:16:13.027720 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 21:16:13.027884 0.000000 udp 10.0.2.105 7010 -> 186.35.92.132 4743 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 21:16:30.637673 0.072340 tcp 10.0.2.105 62855 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:30.710352 0.033254 tcp 10.0.2.105 62856 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:30.743878 0.146519 tcp 10.0.2.105 62857 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:30.890974 0.214515 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.105875 0.071304 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.177601 0.492230 udp 10.0.2.105 7010 <-> 72.251.11.9 2321 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.670241 0.049023 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.719698 0.053737 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.773898 0.154709 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:31.929026 0.771059 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:32.700515 0.077438 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:32.778406 0.161827 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:32.940686 0.201679 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:33.142824 0.152169 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:33.295418 0.481207 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:33.777103 0.423561 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:34.201086 0.078899 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:34.280452 0.360761 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:34.641614 0.221002 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:34.862967 0.059997 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:34.923400 0.348945 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:35.272787 0.147508 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:35.420706 0.225596 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:35.646710 0.324472 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:35.971579 0.180235 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:36.152268 0.162116 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:36.314735 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 21:16:52.404673 0.031583 tcp 10.0.2.105 62858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:52.436566 0.032839 tcp 10.0.2.105 62859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:52.469741 0.126813 tcp 10.0.2.105 62860 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:16:52.597200 0.449641 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:53.047263 0.329166 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:53.376810 0.209046 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:53.586266 0.187779 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:53.774485 0.349028 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:54.123982 0.229769 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:54.354171 0.225074 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:54.579673 0.197918 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:54.778012 0.209822 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:54.988373 0.054587 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.043386 0.287456 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.331247 0.143743 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.475435 0.123454 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.599279 0.082232 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.682112 0.116689 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:55.799181 0.220443 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:56.020068 0.189821 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:56.210311 0.221125 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:56.431951 0.188177 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:56.620716 0.064727 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:16:56.685895 0.227378 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:21:35.281178 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 21:21:35.281316 1.307544 tcp 10.0.2.105 62861 -> 200.84.7.244 8038 FSPA* 0 0 14 1524 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:21:37.326310 3.001539 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 21:21:44.334170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:21:52.335222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:22:08.338198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:22:40.344218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:28:44.350494 3.001289 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:28:51.357746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:28:59.359264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:29:15.362153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:29:47.368429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:35:51.375549 3.002052 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:35:58.381770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:36:06.383107 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:36:22.386432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:36:54.393229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:42:58.399275 3.000385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 21:43:05.405685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:43:13.407089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:43:29.410104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:44:01.416292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:47:20.001796 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 21:47:20.001910 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 109 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 21:47:36.036579 0.032006 tcp 10.0.2.105 62862 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:47:36.068898 0.033123 tcp 10.0.2.105 62863 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:47:36.102399 0.128210 tcp 10.0.2.105 62864 -> 195.113.214.249 443 SRPA* 0 0 43 25736 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:47:36.231418 0.213401 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:36.445261 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 21:47:42.798982 0.000000 udp 10.0.2.105 7010 <- 72.251.11.9 2321 RSP 0 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 21:47:42.799403 0.048198 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:42.847991 0.049311 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:42.897734 0.160381 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:43.058591 0.074668 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:43.133617 0.164447 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:43.298503 0.072447 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:43.371343 1.224382 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:44.596155 0.158138 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:44.754750 0.493205 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:45.248366 0.147806 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:45.396616 0.077085 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:45.474119 0.362791 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:45.837332 0.221844 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:46.059617 0.060779 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:46.120791 0.424415 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:46.545638 0.322723 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:46.868774 0.142832 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:47.011948 0.349281 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:47.361679 0.224220 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:47.586347 0.158780 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:47.745545 0.181306 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:47.927264 0.381754 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:48.309453 0.185155 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:48.495072 0.376232 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:48.871690 0.325037 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:49.197186 0.209127 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:49.406763 0.225444 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:49.632683 0.225198 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:49.858237 0.198388 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.057050 0.209804 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.267279 0.054776 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.322532 0.287764 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.610742 0.137436 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.748558 0.124724 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.873681 0.083129 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:50.957253 0.116506 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:51.074216 0.209128 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:51.283749 0.187407 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:51.471605 0.059509 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:51.531548 0.374785 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:51.906783 0.183278 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:47:52.090584 0.206788 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/22 21:51:36.591030 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 21:51:36.591197 4.255474 tcp 10.0.2.105 62865 -> 200.84.7.244 8038 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/02/22 21:55:41.425323 3.001453 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 21:55:48.432607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:55:56.434266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:56:12.437141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 21:56:44.443288 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:02:48.449737 3.001008 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 22:02:55.456552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:03:03.458020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:03:19.461391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:03:51.467326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:10:04.476845 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 22:10:11.483455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:10:19.484987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:10:35.488166 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:11:07.493652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:17:11.500439 3.001337 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 22:17:18.508190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:17:26.509637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:17:42.511880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:18:07.478061 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:18:07.478220 0.215504 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:07.694158 0.052292 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:07.746888 0.174373 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:07.921680 0.069737 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:07.991902 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:18:13.330470 0.000000 udp 10.0.2.105 7010 <- 72.251.11.9 2321 RSP 0 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:18:13.330930 0.047120 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:13.378423 0.170788 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:13.549634 0.076925 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:13.627004 0.848507 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:14.475909 0.154783 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:14.517992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:18:14.631128 0.485748 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:15.117354 0.152362 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:15.270115 0.084923 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:15.355448 0.378605 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:15.734471 0.222486 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:15.957310 0.059772 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:16.017468 0.146971 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:16.164912 0.425934 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:16.591290 0.329023 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:16.920741 0.348768 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:17.269955 0.228162 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:17.498553 0.165042 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:17.663980 0.182136 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:17.846502 0.351139 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:18.198064 0.384954 udp 10.0.2.105 7010 <-> 58.166.36.1 9726 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:18.583387 0.187362 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:18.771220 0.231113 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:19.002721 0.222866 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:19.226074 0.210048 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:19.436700 0.329426 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:19.766536 0.214958 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:19.981904 0.210291 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.192628 0.057951 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.251036 0.283891 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.535414 0.143511 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.679345 0.124707 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.804493 0.091279 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:20.896357 0.116244 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:21.013002 0.065122 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:21.078588 0.482777 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:21.561728 0.194788 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:21.756989 0.220468 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:21.977904 0.188541 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:18:22.166914 0.207201 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:21:40.855100 0.000128 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:21:40.855315 0.663906 tcp 10.0.2.105 62866 -> 200.84.7.244 8038 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:41.296541 0.033340 tcp 10.0.2.105 62867 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:41.330207 0.032324 tcp 10.0.2.105 62868 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:41.362863 0.128214 tcp 10.0.2.105 62869 -> 195.113.214.249 443 SRPA* 0 0 40 21234 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:41.519540 3.000937 tcp 10.0.2.105 62870 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:21:50.518891 0.000000 tcp 10.0.2.105 62870 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:21:56.518052 0.032136 tcp 10.0.2.105 62871 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:56.550425 0.033141 tcp 10.0.2.105 62872 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:56.583897 0.161710 tcp 10.0.2.105 62873 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:21:56.762841 3.008435 tcp 10.0.2.105 62874 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:05.770355 0.000000 tcp 10.0.2.105 62874 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:11.759640 0.031636 tcp 10.0.2.105 62875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:11.791551 0.033202 tcp 10.0.2.105 62876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:11.825093 0.128559 tcp 10.0.2.105 62877 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:11.965472 2.998049 tcp 10.0.2.105 62878 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:20.972202 0.000000 tcp 10.0.2.105 62878 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:26.961659 0.032798 tcp 10.0.2.105 62879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:26.994763 0.032951 tcp 10.0.2.105 62880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:27.028015 0.129501 tcp 10.0.2.105 62881 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:27.167955 0.430608 tcp 10.0.2.105 62882 -> 200.84.7.244 8038 FSPA* 0 0 13 1329 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:22:27.598860 2.997124 tcp 10.0.2.105 62883 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:36.594835 0.000000 tcp 10.0.2.105 62883 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:42.595923 3.001840 tcp 10.0.2.105 62884 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:51.596551 0.000000 tcp 10.0.2.105 62884 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:22:56.333415 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:22:57.595024 3.006337 tcp 10.0.2.105 62885 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:23:06.598642 0.000000 tcp 10.0.2.105 62885 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:24:18.524969 3.001128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 22:24:25.531559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:24:33.532998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:24:49.536066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:25:21.541889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:28:12.598502 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:28:12.598676 3.003314 tcp 10.0.2.105 62886 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:21.601453 0.000000 tcp 10.0.2.105 62886 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:27.601048 0.034045 tcp 10.0.2.105 62887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:27.635361 0.033628 tcp 10.0.2.105 62888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:27.669260 0.129728 tcp 10.0.2.105 62889 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:27.826055 2.997909 tcp 10.0.2.105 62890 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:36.832467 0.000000 tcp 10.0.2.105 62890 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:42.822009 0.133342 tcp 10.0.2.105 62891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:42.955178 0.034396 tcp 10.0.2.105 62892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:42.989874 0.129979 tcp 10.0.2.105 62893 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:43.131909 2.994108 tcp 10.0.2.105 62894 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:52.124848 0.000000 tcp 10.0.2.105 62894 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/22 22:28:58.124152 0.032635 tcp 10.0.2.105 62895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:58.157139 0.032882 tcp 10.0.2.105 62896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:58.190293 0.244237 tcp 10.0.2.105 62897 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:28:58.460169 1.311876 tcp 10.0.2.105 62898 -> 200.84.7.244 8038 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:31:25.548425 3.001305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 22:31:32.555749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:31:40.556852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:31:56.560106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:32:28.566098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:38:32.572056 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 22:38:39.579499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:38:47.581142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:39:03.583827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:39:35.593561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:45:39.596470 3.001290 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 22:45:46.603184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:45:54.606927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:46:10.607848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:46:42.614181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:48:31.200615 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:48:31.200710 0.190015 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.362462 0.108010 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.433437 0.234777 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.645726 0.092627 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.701166 0.185595 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.883407 0.104264 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:31.966847 1.309213 udp 10.0.2.105 7010 <-> 72.251.11.9 2321 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:32.611309 0.063641 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:32.656436 0.232470 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2072 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:32.869287 0.188415 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:33.077520 0.516012 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:33.586591 0.384760 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:33.967971 0.229922 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:34.190582 0.063166 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:34.252073 0.338510 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:34.581139 0.106532 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:34.671477 0.360006 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:35.004471 0.153059 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:35.159112 0.448751 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:35.585656 0.350549 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:35.932136 0.267117 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:36.164612 0.000000 udp 10.0.2.105 7010 -> 68.56.221.70 8447 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:48:53.253223 0.032801 tcp 10.0.2.105 62899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:48:53.286334 0.032846 tcp 10.0.2.105 62900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:48:53.319524 0.130448 tcp 10.0.2.105 62901 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:48:53.450575 0.195755 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:53.633931 0.225053 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:53.823464 0.239707 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:54.055449 0.354494 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:48:54.395439 0.000000 udp 10.0.2.105 7010 -> 58.166.36.1 9726 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:49:11.739390 0.031566 tcp 10.0.2.105 62902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:11.771334 0.033968 tcp 10.0.2.105 62903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:11.805694 0.158744 tcp 10.0.2.105 62904 -> 195.113.214.249 443 SRPA* 0 0 26 13878 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:11.965914 0.324416 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:12.303351 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:49:29.065461 0.033758 tcp 10.0.2.105 62905 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:29.099517 0.033620 tcp 10.0.2.105 62906 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:29.133418 0.128422 tcp 10.0.2.105 62907 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:29.262426 0.250791 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:29.481255 0.237175 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:29.695103 0.210491 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:29.902674 0.072363 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:29.957470 0.288056 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.240484 0.149418 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.380160 0.143114 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.505096 0.101111 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.597708 0.118015 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.736631 0.066979 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:30.805171 0.213693 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:31.016207 0.372565 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:31.338958 0.194396 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:31.532961 0.196181 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/22 22:49:31.721745 0.000000 udp 10.0.2.105 7010 -> 99.98.252.106 9529 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 22:49:49.503659 0.031102 tcp 10.0.2.105 62908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:49.535025 0.034456 tcp 10.0.2.105 62909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:49:49.569764 0.128006 tcp 10.0.2.105 62910 -> 195.113.214.249 443 SRPA* 0 0 21 10972 flow=From-Botnet-V2-TCP-Established 1970/02/22 22:57:02.628053 3.001737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 22:57:09.636922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:57:17.636712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:57:33.640063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:58:05.646198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 22:58:59.774046 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 22:58:59.774223 1.284976 tcp 10.0.2.105 62911 -> 200.84.7.244 8038 FSPA* 0 0 14 1607 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:04:09.652374 3.001275 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:04:16.663711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:04:24.660985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:04:40.663929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:05:12.670123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:11:16.676176 3.001330 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:11:23.683021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:11:31.684569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:11:47.688092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:12:19.693715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:18:23.699595 3.002055 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:18:30.707459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:18:38.708777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:18:54.711791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:19:26.717807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:20:06.515860 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 23:20:06.516037 0.164067 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:06.680507 0.000000 udp 10.0.2.105 7010 -> 58.166.36.1 9726 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:20:21.839045 0.055252 tcp 10.0.2.105 62912 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:21.894688 0.054468 tcp 10.0.2.105 62913 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:21.949467 0.149584 tcp 10.0.2.105 62914 -> 195.113.214.249 443 SRPA* 0 0 33 18094 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:22.099728 0.208334 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:22.308500 0.202533 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:22.511399 0.049942 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:22.561727 0.213026 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:22.775186 0.074797 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:22.850395 0.174724 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:23.025534 0.080637 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:23.106610 0.176802 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:23.283814 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:20:41.626420 0.054163 tcp 10.0.2.105 62915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:41.680923 0.056540 tcp 10.0.2.105 62916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:41.737778 0.143522 tcp 10.0.2.105 62917 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:20:41.881840 0.086634 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:41.968920 0.159788 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:42.129135 0.579076 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:42.708596 0.060385 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:42.769363 0.216843 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:42.986638 0.351024 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:43.338058 0.494498 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:43.832954 0.153359 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:43.986723 0.085084 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:44.072278 0.332176 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:44.404850 0.422801 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:44.828022 0.144900 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:44.973340 0.348800 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:45.322549 0.224423 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:45.547392 0.169469 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:45.717325 0.229779 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:45.947509 0.186655 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:46.134621 0.346796 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:46.481914 0.331406 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:46.813681 0.211917 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.026070 0.220445 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.246863 0.278654 udp 10.0.2.105 7010 <-> 61.21.234.75 4240 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.525950 0.143563 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.669882 0.055240 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.725540 0.211309 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:47.937300 0.116214 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:48.053950 0.064526 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:48.118901 0.207459 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:48.326743 0.138798 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:48.465955 0.491549 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:48.957909 0.194790 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:49.153122 0.627497 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:20:49.781045 0.186596 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:25:30.723934 3.001508 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 23:25:37.731059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:25:45.734555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:26:01.735558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:26:33.741725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:29:01.064162 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 23:29:01.064366 1.335517 tcp 10.0.2.105 62918 -> 200.84.7.244 8038 FSPA* 0 0 14 1663 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:32:37.747281 3.005661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:32:44.755269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:32:52.757039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:33:08.759669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:33:40.765632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:39:44.771712 3.001590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:39:51.779124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:39:59.780913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:40:15.783771 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:40:47.789649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:46:51.795605 3.001790 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/22 23:46:58.803149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:47:06.804937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:47:22.807739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:47:54.813617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:51:13.289848 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 23:51:13.290023 0.000000 udp 10.0.2.105 7010 -> 72.251.11.9 2321 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:51:29.174216 0.054906 tcp 10.0.2.105 62919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:29.229437 0.057108 tcp 10.0.2.105 62920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:29.286804 0.149112 tcp 10.0.2.105 62921 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:29.436154 0.163430 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:29.600014 0.047644 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:29.648109 0.212418 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:29.860935 0.072441 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:29.933732 0.156914 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.091217 0.081388 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.173117 0.206108 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.379626 0.220896 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.600944 0.171186 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.772732 0.160363 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:30.933490 0.078026 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:31.012005 0.059685 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:31.072156 0.221462 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:31.294102 0.511873 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:31.806361 0.166600 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:31.973372 0.086468 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:32.060262 0.350411 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:32.411073 0.487104 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:32.898595 0.329919 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:33.229007 0.423484 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:33.652981 0.145656 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:33.799078 0.178685 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:33.978218 0.228351 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:34.206991 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:51:52.396130 0.053719 tcp 10.0.2.105 62922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:52.450210 0.059347 tcp 10.0.2.105 62923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:52.509902 0.146092 tcp 10.0.2.105 62924 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:51:52.656527 0.348977 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:53.006138 0.229059 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:53.235615 0.198266 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:53.434258 0.343190 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:53.777828 0.330007 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:54.108206 0.228590 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:51:54.337266 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:52:10.772136 0.054817 tcp 10.0.2.105 62925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:52:10.827239 0.054742 tcp 10.0.2.105 62926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:52:10.882280 0.152739 tcp 10.0.2.105 62927 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:52:11.035512 0.144380 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.180369 0.059162 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.239928 0.211404 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.451712 0.116576 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.568654 0.066142 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.635154 0.083552 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.719062 0.195702 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:11.915153 0.208553 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:12.124139 0.126403 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:12.250946 0.443548 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/22 23:52:12.694908 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/22 23:52:30.483380 0.054975 tcp 10.0.2.105 62928 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:52:30.538708 0.110892 tcp 10.0.2.105 62929 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:52:30.649896 0.148384 tcp 10.0.2.105 62930 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/22 23:53:58.820004 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/22 23:54:05.827089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:54:13.828879 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:54:29.831841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:55:01.837657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/22 23:59:02.404084 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/22 23:59:02.404425 1.292899 tcp 10.0.2.105 62931 -> 200.84.7.244 8038 FSPA* 0 0 15 1757 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:01:05.843836 3.001583 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:01:12.851222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:01:20.852475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:01:36.855655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:02:08.861555 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:08:12.868804 3.005227 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:08:19.875329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:08:27.876916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:08:43.880085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:09:15.884964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:15:19.891632 3.001638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:15:26.898913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:15:34.900566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:15:50.903737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:16:22.910305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:22:26.915541 3.001913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:22:33.922883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:22:41.924281 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:22:44.808988 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 00:22:44.809089 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 00:22:57.927420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:23:02.456925 0.054702 tcp 10.0.2.105 62932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:02.511962 0.055366 tcp 10.0.2.105 62933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:02.567634 0.149780 tcp 10.0.2.105 62934 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:02.717783 0.000000 udp 10.0.2.105 7010 -> 61.21.234.75 4240 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 00:23:18.607678 0.054044 tcp 10.0.2.105 62935 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:18.662060 0.055070 tcp 10.0.2.105 62936 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:18.717450 0.140806 tcp 10.0.2.105 62937 -> 195.113.214.249 443 SRPA* 0 0 21 10308 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:18.858810 0.187646 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.046890 0.042680 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.089975 0.157512 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.247909 0.211871 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.460206 0.070866 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.531527 0.158473 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.690426 0.081712 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.772607 0.156086 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:19.929145 0.208188 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.137717 0.163946 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.302079 0.209013 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.511459 0.053933 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.565829 0.047306 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.613629 0.221628 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.835739 0.151187 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:20.987344 0.519770 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:21.507529 0.089478 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:21.597379 0.366224 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:21.963985 0.488293 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:22.452747 0.329744 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:22.782833 0.425083 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:23.208422 0.149939 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:23.358814 0.180436 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:23.539626 0.225898 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:23.765911 0.348003 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:24.114323 0.226742 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:24.341492 0.199012 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:24.541018 0.441574 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:24.982974 0.226527 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:25.209949 0.331583 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:25.541929 0.209600 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:25.751949 0.055839 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:25.808228 0.143916 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:25.952702 0.068579 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.021662 0.116654 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.138721 0.125979 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.265094 0.189704 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.455176 0.089602 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.545185 0.207596 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:23:26.753192 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 00:23:29.933399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:23:42.762473 0.054236 tcp 10.0.2.105 62938 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:42.817051 0.054554 tcp 10.0.2.105 62939 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:23:42.871973 0.146425 tcp 10.0.2.105 62940 -> 195.113.214.249 443 SRPA* 0 0 41 22254 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:29:03.703599 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 00:29:03.703763 1.310234 tcp 10.0.2.105 62941 -> 200.84.7.244 8038 FSPA* 0 0 14 1734 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:29:33.940731 3.000238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 00:29:40.946306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:29:48.951017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:30:04.951330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:30:36.957558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:36:40.964468 3.000677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:36:47.970958 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:36:55.972633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:37:11.975327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:37:43.981407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:43:47.986439 3.002881 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 00:43:54.995025 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:44:03.000778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:44:18.999302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:44:51.005622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:54:10.430476 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 00:54:10.430673 0.390086 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:10.821184 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 00:54:27.256125 0.056630 tcp 10.0.2.105 62942 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:27.313015 0.056216 tcp 10.0.2.105 62943 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:27.369525 0.243739 tcp 10.0.2.105 62944 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:27.613894 0.046399 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:27.660761 0.212817 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:27.874005 0.072974 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:27.947382 0.155176 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.103037 0.078100 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.181518 0.158680 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.340614 0.207081 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.548084 0.164630 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.713137 0.209116 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.922745 0.059731 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:28.982848 0.192698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:29.175972 0.216840 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:29.393304 1.339702 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:30.733378 0.046538 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:30.780345 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 00:54:48.635359 0.053321 tcp 10.0.2.105 62945 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:48.688986 0.055179 tcp 10.0.2.105 62946 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:48.744539 0.145632 tcp 10.0.2.105 62947 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:54:48.890744 0.072005 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:48.963107 0.361783 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:49.325279 0.355066 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:49.680801 0.489739 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:50.170997 0.181009 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:50.352487 0.223882 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:50.576796 0.348327 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:50.925560 0.424887 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:51.350894 0.148290 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:51.499658 0.338395 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:51.838483 0.225598 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:52.064480 0.200230 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:52.265081 0.331259 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:52.596704 0.224026 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:52.821125 0.066828 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:52.888582 0.229106 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.118120 0.076124 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.194785 0.118243 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.313511 0.143312 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.457273 0.208754 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.666466 0.181525 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.848552 0.123182 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:54:53.972240 0.083476 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/23 00:56:03.014283 3.001791 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 00:56:10.021449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:56:18.023954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:56:34.026190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:57:06.031611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 00:59:05.498959 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 00:59:05.499137 0.218190 tcp 10.0.2.105 62948 -> 200.84.7.244 8038 SPA_* 0 0 9 993 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:35.578986 0.055295 tcp 10.0.2.105 62949 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:35.634601 0.054745 tcp 10.0.2.105 62950 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:35.689659 0.149169 tcp 10.0.2.105 62951 -> 195.113.214.249 443 SRPA* 0 0 41 21436 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:35.931585 0.142677 tcp 10.0.2.105 62948 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:36.074570 2.997864 tcp 10.0.2.105 62952 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 00:59:45.070595 0.000000 tcp 10.0.2.105 62952 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 00:59:51.060114 0.054860 tcp 10.0.2.105 62953 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:51.115216 0.054681 tcp 10.0.2.105 62954 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:51.170221 0.147284 tcp 10.0.2.105 62955 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/23 00:59:51.328445 2.995719 tcp 10.0.2.105 62956 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 01:00:00.333061 0.000000 tcp 10.0.2.105 62956 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 01:00:06.321843 0.054878 tcp 10.0.2.105 62957 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:06.377098 0.055373 tcp 10.0.2.105 62958 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:06.432806 0.146354 tcp 10.0.2.105 62959 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:06.597349 2.998822 tcp 10.0.2.105 62960 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 01:00:15.601939 0.000000 tcp 10.0.2.105 62960 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 01:00:21.594342 0.054327 tcp 10.0.2.105 62961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:21.648960 0.093560 tcp 10.0.2.105 62962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:21.742903 0.144401 tcp 10.0.2.105 62963 -> 195.113.214.249 443 SRPA* 0 0 38 32160 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:00:21.899476 1.387926 tcp 10.0.2.105 62964 -> 200.84.7.244 8038 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:03:10.378856 3.001738 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 01:03:17.385944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:03:25.387570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:03:41.390614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:04:13.396813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:10:17.402724 3.001324 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:10:24.410185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:10:32.411730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:10:48.414765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:11:20.420691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:17:30.435433 3.001548 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:17:37.442614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:17:45.444116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:18:01.447421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:18:33.455997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:24:41.465293 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:24:48.475895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:24:56.474092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:25:12.477182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:25:20.078726 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 01:25:20.078935 0.187463 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:20.266898 0.864216 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:21.131499 0.518680 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:21.650622 0.044642 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:21.695728 0.080405 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:21.776687 0.161555 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:21.938693 0.212554 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.151709 0.078332 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.230429 0.163868 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.394714 0.208309 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.603406 0.160979 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.764872 0.222381 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:22.987721 0.209152 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.197365 0.060074 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.257932 0.177782 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.436123 0.152998 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.589509 0.046597 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.636497 0.083079 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:23.719960 0.379957 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:24.100481 0.386522 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:24.487429 0.500275 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:24.988174 0.179465 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:25.168025 0.228820 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:25.397321 0.148312 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:25.546140 0.341717 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:25.888473 0.424400 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:26.313351 0.347813 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:26.661572 0.228463 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:26.890504 0.200445 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:27.091354 0.330275 udp 10.0.2.105 7010 <-> 36.239.232.191 7010 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:27.422070 0.246458 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:27.668977 0.055433 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:27.724842 0.226304 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:27.951610 0.066866 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.018899 0.116741 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.136049 0.144730 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.281180 0.123663 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.405222 0.084451 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.490068 0.208105 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:28.698590 0.196558 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:25:44.482955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:30:23.294072 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 01:30:23.294255 1.942966 tcp 10.0.2.105 62965 -> 200.84.7.244 8038 FSPA* 0 0 14 1669 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:31:48.490326 3.000496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:31:55.496727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:32:03.498032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:32:19.500891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:32:51.507027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:38:55.512476 3.002162 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:39:02.520658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:39:10.521973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:39:26.524972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:39:58.530759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:46:02.536566 3.002416 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:46:09.544484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:46:17.545863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:46:33.548892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:47:05.554816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:53:09.562345 3.000234 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 01:53:16.568438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:53:24.570090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:53:40.572950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:54:12.579020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 01:55:43.640150 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 01:55:43.640328 0.188050 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:43.828787 0.859879 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:44.689045 0.081203 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:44.770761 0.157376 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:44.928638 0.213875 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:45.143013 0.073350 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:45.216769 0.494626 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:45.711782 0.056547 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:45.768797 0.157819 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:45.927072 0.208034 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.135497 0.160438 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.296376 0.221380 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.518124 0.210059 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.728642 0.154727 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.883782 0.044801 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:46.929032 0.086927 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:47.016478 0.356828 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:47.373760 0.059540 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:47.433765 0.176582 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:47.610785 0.369378 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:47.980721 0.210773 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:48.191938 0.179101 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:48.371530 0.347820 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:48.719823 0.231396 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:55:48.951886 0.000000 udp 10.0.2.105 7010 -> 69.133.33.19 2866 INT 0 1 264 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 01:56:06.444115 0.055221 tcp 10.0.2.105 62966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:06.499624 0.055239 tcp 10.0.2.105 62967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:06.555176 0.147612 tcp 10.0.2.105 62968 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:06.703406 0.232905 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:06.936744 0.199287 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:07.136435 0.422725 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:07.559519 0.362080 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:07.922035 0.000000 udp 10.0.2.105 7010 -> 36.239.232.191 7010 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 01:56:26.422071 0.055516 tcp 10.0.2.105 62969 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:26.477852 0.054464 tcp 10.0.2.105 62970 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:26.532639 0.152343 tcp 10.0.2.105 62971 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/23 01:56:26.685675 0.216423 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:26.902495 0.057956 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:26.960832 0.225100 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.186387 0.066106 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.252882 0.116784 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.370123 0.085904 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.456484 0.221319 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.678222 0.197496 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:27.876128 0.144123 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 01:56:28.020696 0.125168 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:00:16.584411 3.002326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 02:00:23.592349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:00:25.245187 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 02:00:25.245398 1.368782 tcp 10.0.2.105 62972 -> 200.84.7.244 8038 FSPA* 0 0 14 1622 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:00:31.593724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:00:47.596887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:01:19.602727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:07:23.609604 3.001151 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:07:30.616569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:07:38.617714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:07:54.620893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:08:26.627808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:14:30.632319 3.002024 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:14:37.640308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:14:45.641631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:15:01.644869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:15:33.651079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:21:37.656975 3.001756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:21:44.664077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:21:52.665608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:22:08.668688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:22:40.674581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:26:39.538312 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 02:26:39.538459 0.148313 udp 10.0.2.105 7010 -> 69.133.33.19 2866 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 02:26:39.686772 0.000000 icmp 69.133.33.19 0x0303 -> 10.0.2.105 0x320b URP 192 1 153 flow=Background 1970/02/23 02:26:54.601411 0.055213 tcp 10.0.2.105 62973 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:26:54.656865 0.054462 tcp 10.0.2.105 62974 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:26:54.711608 0.147184 tcp 10.0.2.105 62975 -> 195.113.214.249 443 SRPA* 0 0 40 21914 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:26:54.859103 0.000000 udp 10.0.2.105 7010 -> 36.239.232.191 7010 INT 0 1 230 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 02:27:11.394398 0.053776 tcp 10.0.2.105 62976 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:27:11.448509 0.111501 tcp 10.0.2.105 62977 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:27:11.560607 0.145426 tcp 10.0.2.105 62978 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:27:11.706964 0.182923 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:11.890288 0.158422 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:12.049170 0.082517 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:12.132129 0.870023 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:13.002574 0.068960 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:13.071967 0.496832 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:13.569254 0.206274 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:13.775972 0.222003 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:13.998454 0.161236 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.160102 0.164360 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.324864 0.044601 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.369864 0.079020 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.449293 0.215440 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.665140 0.152805 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:14.818362 0.210947 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.029685 0.047655 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.077822 0.170853 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.249163 0.372678 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.622244 0.059894 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.682548 0.211010 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:15.894044 0.333812 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:16.228418 0.180236 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:16.409054 0.342932 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:16.752443 0.230466 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:16.983328 0.232764 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:17.216480 0.200041 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:17.416956 0.419109 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:17.836707 0.341254 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.178369 0.055747 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.234555 0.209764 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.444633 0.066933 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.512072 0.116687 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.629236 0.083733 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.713436 0.220209 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:18.934060 0.222898 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:19.157423 0.123643 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:19.281604 0.182951 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:27:19.464969 0.143283 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:28:44.680876 3.001364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 02:28:51.688159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:28:59.689636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:29:15.692662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:29:47.699254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:30:26.614974 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 02:30:26.615079 1.343315 tcp 10.0.2.105 62979 -> 200.84.7.244 8038 FSPA* 0 0 14 1691 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:35:51.705657 3.000642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:35:58.711811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:36:06.713504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:36:22.716486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:36:54.722658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:42:58.728373 3.001847 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:43:05.735868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:43:13.737630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:43:29.740917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:44:01.746552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:55:39.752883 3.001466 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 02:55:46.760210 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:55:54.761787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:56:10.764939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:56:42.770740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 02:57:30.489554 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 02:57:30.489718 0.092547 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:30.582814 0.188882 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:30.772409 0.152174 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:30.925004 0.793490 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:31.718942 0.072048 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:31.791440 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 02:57:50.400444 0.056379 tcp 10.0.2.105 62980 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:57:50.457141 0.056364 tcp 10.0.2.105 62981 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:57:50.513763 0.149421 tcp 10.0.2.105 62982 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:57:50.662202 0.212695 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:50.875314 0.207124 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.082781 0.161863 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.245083 0.163688 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.409164 0.050546 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.460424 0.151863 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.612845 0.213127 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.826353 0.047580 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:51.874372 0.179240 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:52.054135 0.077980 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:57:52.132701 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 02:58:09.035547 0.055401 tcp 10.0.2.105 62983 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:09.091294 0.054701 tcp 10.0.2.105 62984 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:09.146298 0.144454 tcp 10.0.2.105 62985 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:09.291276 0.372338 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:09.664069 0.059978 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:09.724572 0.486368 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:10.211388 0.354441 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:10.566201 0.179416 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:10.746000 0.230716 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:10.977116 0.343039 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:11.320819 0.228086 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:11.549350 0.386664 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:11.936500 0.059390 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:11.996340 0.197961 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:12.194681 0.423881 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:12.619005 0.211424 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:12.830853 0.064066 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:12.895321 0.116719 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:13.012713 0.084533 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:13.097766 0.220045 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:13.318335 0.470478 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:13.789301 0.000000 udp 10.0.2.105 7010 -> 212.251.104.12 4482 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 02:58:31.196965 0.054138 tcp 10.0.2.105 62986 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:31.251395 0.055737 tcp 10.0.2.105 62987 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:31.307415 0.292074 tcp 10.0.2.105 62988 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/23 02:58:31.600079 0.187899 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 02:58:31.788391 0.137418 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:00:27.965335 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:00:27.965513 0.748634 tcp 10.0.2.105 62989 -> 200.84.7.244 8038 FSPA* 0 0 13 1278 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:28.408070 0.056521 tcp 10.0.2.105 62990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:28.464856 0.055428 tcp 10.0.2.105 62991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:28.520596 0.163016 tcp 10.0.2.105 62992 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:28.714449 3.005524 tcp 10.0.2.105 62993 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:00:37.718732 0.000000 tcp 10.0.2.105 62993 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:00:43.707856 0.057292 tcp 10.0.2.105 62994 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:43.765466 0.054989 tcp 10.0.2.105 62995 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:43.820725 0.145961 tcp 10.0.2.105 62996 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:43.996786 3.004932 tcp 10.0.2.105 62997 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:00:53.000945 0.000000 tcp 10.0.2.105 62997 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:00:58.991144 0.054491 tcp 10.0.2.105 62998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:59.045894 0.055895 tcp 10.0.2.105 62999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:59.102068 0.154428 tcp 10.0.2.105 63000 -> 195.113.214.249 443 SRPA* 0 0 44 21600 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:00:59.267542 2.996175 tcp 10.0.2.105 63001 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:08.272515 0.000000 tcp 10.0.2.105 63001 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:14.261754 0.053522 tcp 10.0.2.105 63002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:01:14.315583 0.054642 tcp 10.0.2.105 63003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:01:14.370511 0.149726 tcp 10.0.2.105 63004 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:01:14.534917 0.442982 tcp 10.0.2.105 63005 -> 200.84.7.244 8038 FSPA* 0 0 13 1278 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:01:14.978139 2.998089 tcp 10.0.2.105 63006 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:23.974662 0.000000 tcp 10.0.2.105 63006 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:29.973792 3.004036 tcp 10.0.2.105 63007 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:38.976137 0.000000 tcp 10.0.2.105 63007 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:43.673124 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:01:44.975172 3.004517 tcp 10.0.2.105 63008 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:01:53.978286 0.000000 tcp 10.0.2.105 63008 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:02:46.776919 3.000898 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 03:02:53.784259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:03:01.785621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:03:17.792577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:03:49.794848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:06:59.978791 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:06:59.978941 3.003528 tcp 10.0.2.105 63009 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:08.981097 0.000000 tcp 10.0.2.105 63009 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:14.981360 0.056093 tcp 10.0.2.105 63010 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:15.037792 0.055326 tcp 10.0.2.105 63011 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:15.093400 0.144830 tcp 10.0.2.105 63012 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:15.286456 2.997819 tcp 10.0.2.105 63013 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:24.293073 0.000000 tcp 10.0.2.105 63013 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:30.282572 0.055069 tcp 10.0.2.105 63014 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:30.337919 0.054653 tcp 10.0.2.105 63015 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:30.392930 0.148546 tcp 10.0.2.105 63016 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:30.553166 2.993597 tcp 10.0.2.105 63017 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:40.324572 0.000000 tcp 10.0.2.105 63017 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:07:46.266495 0.054159 tcp 10.0.2.105 63018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:46.320998 0.056374 tcp 10.0.2.105 63019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:46.377675 0.143282 tcp 10.0.2.105 63020 -> 195.113.214.249 443 SRPA* 0 0 35 28244 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:07:46.540575 1.356209 tcp 10.0.2.105 63021 -> 200.84.7.244 8038 FSPA* 0 0 14 1710 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:10:17.806483 3.000171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 03:10:24.812639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:10:32.814536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:10:48.817219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:11:20.823184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:17:24.829944 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 03:17:31.836002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:17:39.841353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:17:55.842596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:18:27.847822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:24:32.854392 3.001743 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 03:24:39.862070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:24:47.863599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:25:03.866720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:25:35.872665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:28:49.913167 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:28:49.913280 0.493868 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:50.407542 0.216630 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:50.624680 0.158123 udp 10.0.2.105 7010 <-> 212.251.104.12 4482 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:50.783242 0.079250 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:50.862917 0.153704 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:51.017036 0.188107 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:51.205529 0.069209 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:51.275140 0.846575 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:52.122160 0.212306 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:52.334970 0.164857 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:52.500260 0.160186 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:52.660917 0.207926 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:52.869205 0.704522 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:53.574202 0.075932 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:53.650541 0.147149 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:53.798078 0.048693 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:53.847904 0.212152 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:54.060495 0.176962 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:54.237911 0.492638 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:54.731100 0.053729 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:54.785272 0.370675 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:55.156540 0.335098 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:55.492037 0.182334 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:55.674773 0.225978 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:55.901269 0.348461 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:56.250167 0.225958 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:56.476626 0.198005 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:56.675105 0.060095 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:56.735620 0.374514 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:57.110545 0.064451 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:57.175427 0.209818 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:57.385682 0.424663 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:57.810812 0.117109 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:57.928521 0.150987 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:58.079844 0.203538 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:58.283908 0.419711 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:58.704020 0.182081 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:28:58.886492 0.137088 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:31:39.877580 3.002989 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 03:31:46.885828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:31:54.887810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:32:10.890424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:32:42.896005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:37:47.214362 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:37:47.214478 0.825682 tcp 10.0.2.105 63022 -> 200.84.7.244 8038 FSPA* 0 0 13 1348 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:37:47.736597 0.057865 tcp 10.0.2.105 63023 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:37:47.794836 0.054912 tcp 10.0.2.105 63024 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:37:47.850166 0.156369 tcp 10.0.2.105 63025 -> 195.113.214.249 443 SRPA* 0 0 44 27478 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:37:48.040662 2.999012 tcp 10.0.2.105 63026 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:37:57.038016 0.000000 tcp 10.0.2.105 63026 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:03.037251 0.054757 tcp 10.0.2.105 63027 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:03.092241 0.055597 tcp 10.0.2.105 63028 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:03.148190 0.151686 tcp 10.0.2.105 63029 -> 195.113.214.249 443 SRPA* 0 0 26 13992 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:03.315198 3.006260 tcp 10.0.2.105 63030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:12.320656 0.000000 tcp 10.0.2.105 63030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:18.309659 0.054496 tcp 10.0.2.105 63031 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:18.364597 0.054661 tcp 10.0.2.105 63032 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:18.419564 0.147906 tcp 10.0.2.105 63033 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:18.682002 2.991640 tcp 10.0.2.105 63034 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:27.682196 0.000000 tcp 10.0.2.105 63034 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:33.681433 0.054992 tcp 10.0.2.105 63035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:33.736797 0.152424 tcp 10.0.2.105 63036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:33.889570 0.145847 tcp 10.0.2.105 63037 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:34.054727 0.482078 tcp 10.0.2.105 63038 -> 200.84.7.244 8038 FSPA* 0 0 13 1348 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:38:34.537000 2.999627 tcp 10.0.2.105 63039 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:43.535018 0.000000 tcp 10.0.2.105 63039 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:46.903105 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 03:38:49.533640 3.004240 tcp 10.0.2.105 63040 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:38:53.909978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:38:58.536817 0.000000 tcp 10.0.2.105 63040 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:39:01.912655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:39:03.173105 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:39:04.535626 3.003821 tcp 10.0.2.105 63041 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:39:13.538627 0.000000 tcp 10.0.2.105 63041 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 03:39:17.914341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:39:49.920639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:44:19.538973 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:44:19.539100 1.385659 tcp 10.0.2.105 63042 -> 200.84.7.244 8038 FSPA* 0 0 14 1499 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:45:53.926297 3.002083 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 03:46:00.934080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:46:08.935250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:46:24.938785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:46:56.944769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:53:00.950412 3.001292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 03:53:07.958024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:53:15.959348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:53:31.962497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:54:03.968624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 03:59:21.755588 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 03:59:21.755665 0.380103 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:22.077930 0.224835 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:22.295080 0.000000 udp 10.0.2.105 7010 -> 212.251.104.12 4482 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 03:59:38.981428 0.142133 tcp 10.0.2.105 63043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:59:39.123910 0.054495 tcp 10.0.2.105 63044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:59:39.178699 0.150886 tcp 10.0.2.105 63045 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/23 03:59:39.330155 0.100493 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:39.410249 0.189265 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:39.573096 0.196981 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:39.762483 0.110284 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:39.835938 0.662544 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:40.478298 0.234960 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:40.691776 0.171542 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:40.858082 0.187592 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.097361 0.212818 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.306642 0.168390 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.462344 0.063313 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.506733 0.224393 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.723385 0.174545 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.894988 0.093074 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:41.948905 0.107434 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:42.041422 0.361621 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:42.395146 0.063808 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:42.457172 0.344068 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:42.797324 0.264895 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:43.026032 0.353552 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:43.375557 0.373412 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:43.722562 0.194008 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:43.905606 0.240395 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:44.138776 0.223226 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:44.339279 0.074307 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:44.399074 0.360951 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:44.745959 0.070161 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:44.902968 0.272296 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:45.172064 0.095076 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:45.257889 0.226653 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:45.481493 0.453382 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:45.913268 0.118147 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:46.044307 0.155084 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2491 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:46.189364 0.347910 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/23 03:59:46.499601 0.190687 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:00:07.974959 3.001095 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:00:14.982128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:00:22.983221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:00:38.986143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:01:10.991982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:07:23.000182 3.001325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:07:30.007280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:07:38.009045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:07:54.011796 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:08:26.017961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:14:20.929046 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 04:14:20.929201 0.252305 tcp 10.0.2.105 63046 -> 200.84.7.244 8038 SPA_* 0 0 9 1010 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:14:30.026353 2.999260 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:14:30.940634 0.009673 tcp 10.0.2.105 63046 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:14:37.031484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:14:45.032637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:15:01.035569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:15:33.041986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:21:37.049359 3.001578 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:21:44.055388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:21:52.524106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:22:08.328609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:22:40.075805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:28:46.085781 3.000526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:28:53.092174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:29:01.093570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:29:17.096906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:29:49.103039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:30:10.783958 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 04:30:10.784151 0.000000 udp 10.0.2.105 7010 -> 212.251.104.12 4482 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 04:30:26.689388 0.055950 tcp 10.0.2.105 63047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:30:26.745592 0.060708 tcp 10.0.2.105 63048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:30:26.806609 0.144778 tcp 10.0.2.105 63049 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:30:26.951949 0.422259 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:27.374615 0.221146 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:27.596138 0.087400 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:27.683915 0.153179 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:27.837487 0.184378 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:28.022280 0.074555 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:28.097220 0.809985 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:28.981044 0.212222 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:29.193703 0.158122 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:29.352171 0.160364 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:29.512936 0.207416 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:29.720938 0.151475 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:29.872820 0.175954 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.049185 0.047862 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.097507 0.084002 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.181930 0.047612 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.229959 0.208478 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.438824 0.491941 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.931142 0.059490 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:30.991049 0.348430 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:31.339885 0.382075 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:31.722412 0.228576 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:31.951361 0.342810 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:32.294564 0.180889 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:32.475870 0.056375 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:32.532717 0.391958 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:32.925141 0.231037 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.156631 0.198990 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.356011 0.066060 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.422560 0.212880 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.635807 0.082676 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.718906 0.116567 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:33.835903 0.207284 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:34.043623 0.423972 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:34.468033 0.190196 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:34.658615 0.143707 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:30:34.802752 0.330281 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 04:35:53.108916 3.001061 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:36:00.116369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:36:08.117616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:36:24.120568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:36:56.127039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:43:00.133177 3.001107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:43:07.140105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:43:15.141669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:43:31.144138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:44:03.151013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:44:30.951210 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 04:44:30.951411 1.335285 tcp 10.0.2.105 63050 -> 200.84.7.244 8038 FSPA* 0 0 14 1738 flow=From-Botnet-V2-TCP-Established 1970/02/23 04:55:42.158978 3.787662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 04:55:49.900831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:55:57.801551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:56:13.610007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 04:56:46.663668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:00:58.641000 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 05:00:58.641092 0.093136 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:00:58.734614 0.156856 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:00:58.891885 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 107 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 05:01:15.397538 0.055373 tcp 10.0.2.105 63051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:01:15.453170 0.056156 tcp 10.0.2.105 63052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:01:15.509688 0.148679 tcp 10.0.2.105 63053 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:01:15.658957 0.068718 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:15.728053 0.364352 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:16.092790 0.221696 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:16.314867 0.397691 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:16.712928 0.214048 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:16.927396 0.159456 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.087234 0.159664 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.247805 0.207936 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.456215 0.146414 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.603059 0.176613 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.780087 0.044275 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.824735 0.080899 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.906055 0.048762 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:17.955203 0.210257 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:18.165882 0.497595 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:18.663924 0.060859 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 588 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:18.725203 0.226913 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:18.952643 0.342517 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:19.295652 0.370044 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:19.666064 0.060634 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:19.727158 0.377894 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:20.105559 0.224641 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:20.330620 0.398221 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:20.729301 0.180734 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:20.910428 0.210696 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.121562 0.065186 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.187346 0.204622 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.392484 0.083797 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.476807 0.116315 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.593561 0.207914 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.801879 0.143643 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:21.945907 0.418520 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:22.364905 0.423217 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:01:22.788551 0.189433 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:02:49.202136 3.001696 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:02:56.209619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:03:04.212960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:03:20.214829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:03:52.220105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:10:21.233405 3.000350 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:10:32.810636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:10:40.702860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:10:56.482202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:11:28.038043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:14:33.428656 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 05:14:33.428746 0.221504 tcp 10.0.2.105 63054 -> 200.84.7.244 8038 SPA_* 0 0 9 1201 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:14:40.436931 0.009113 tcp 10.0.2.105 63054 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:17:28.266809 3.000935 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:17:35.273620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:17:43.275244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:17:59.278170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:18:31.283882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:24:36.292486 3.000736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:24:43.304898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:24:51.300610 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:25:07.303545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:25:39.309680 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:31:39.738700 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 05:31:39.738858 0.188355 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:39.927650 0.077676 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:40.005840 0.149155 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:40.155428 0.072718 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:40.228810 0.898389 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:41.127623 0.220809 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:41.348868 1.632090 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:42.981347 0.218388 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.200232 0.163155 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.363871 0.160811 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.525124 0.176373 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.701901 0.052672 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.754989 0.093462 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.848844 0.048069 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:43.897336 0.214085 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:44.111868 0.154605 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:44.266895 0.214209 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:44.481560 0.491748 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:44.973752 0.059871 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:45.034085 0.222834 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:45.257380 0.349147 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:45.606940 0.370670 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:45.978118 0.058610 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:46.037107 0.333539 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:46.320733 3.000831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:31:46.371079 0.348128 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:46.719607 0.228458 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:46.948679 0.177516 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.126702 0.212391 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.339558 0.066461 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.406514 0.204324 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.611273 0.089964 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.701743 0.143633 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.845908 0.117181 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:47.963474 0.223027 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:48.186930 0.430196 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:48.617486 0.423849 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:49.041791 0.192386 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/23 05:31:53.327528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:32:01.328919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:32:17.334847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:32:49.337779 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:38:53.343556 3.001941 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:39:00.351111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:39:08.352516 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:39:24.355960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:39:56.361639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:44:39.409394 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 05:44:39.409571 1.323174 tcp 10.0.2.105 63055 -> 200.84.7.244 8038 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/23 05:46:00.367453 3.001929 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:46:07.375463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:46:15.376896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:46:31.379674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:47:03.386386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:53:07.392939 3.000307 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 05:53:14.399131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:53:22.400697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:53:38.403599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 05:54:10.410929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:00:14.417280 2.999988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:00:21.423211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:00:29.429614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:00:45.428853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:01:17.433742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:02:12.853890 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 06:02:12.854012 0.151208 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:13.005611 0.477107 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:13.483126 0.188810 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:13.672616 0.085191 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:13.758220 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 06:02:29.258663 0.056006 tcp 10.0.2.105 63056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 06:02:29.314937 0.070792 tcp 10.0.2.105 63057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 06:02:29.386048 0.145453 tcp 10.0.2.105 63058 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/23 06:02:29.532091 0.222172 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:29.754666 0.740608 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:30.495700 0.212294 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:30.708491 0.176216 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:30.885214 0.043750 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:30.929394 0.081991 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.011772 0.043407 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.055637 0.206902 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.263014 0.156456 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.419933 0.163185 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.583572 0.152422 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.736463 0.213484 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:31.950317 0.475752 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:32.426507 0.059906 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:32.486922 0.344725 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:32.832145 0.059518 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:32.892098 0.226282 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:33.118836 0.348751 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:33.468073 0.228895 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:33.697390 0.180352 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:33.878107 0.324339 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:34.202969 0.361762 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:34.565158 0.198796 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:34.764376 0.066069 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:34.830913 0.209745 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.041009 0.084796 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.126198 0.143660 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.270377 0.146086 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.416901 0.222271 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.639567 0.191862 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:35.831804 0.353337 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:02:36.185491 0.422642 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:07:21.440457 3.002076 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:07:28.495706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:07:36.458749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:07:52.461550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:08:24.467506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:14:28.474491 3.000867 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:14:35.483773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:14:40.739381 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 06:14:40.739563 3.243479 tcp 10.0.2.105 63059 -> 200.84.7.244 8038 FSPA* 0 0 15 1613 flow=From-Botnet-V2-TCP-Established 1970/02/23 06:14:43.482767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:14:59.485644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:15:31.491627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:21:35.497927 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:21:42.505544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:21:50.506918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:22:06.654267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:22:38.525644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:28:43.533907 3.000459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:28:50.540769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:28:58.542238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:29:14.544564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:29:46.551147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:32:55.773730 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 06:32:55.773927 0.225390 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:55.999718 0.154339 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:56.154495 0.188701 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:56.343618 0.072483 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:56.416680 0.079764 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:56.496939 0.221972 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:56.719301 0.722643 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:57.442414 0.212925 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:57.655737 0.175081 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:57.831211 0.045264 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:57.876872 0.208236 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:58.085520 0.163410 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:58.249447 0.162853 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:58.412814 0.151358 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:58.564801 0.210553 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:58.775696 0.460072 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.236403 0.084719 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.321585 0.048497 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.370527 0.059582 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.430548 0.372414 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.803447 0.058205 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:32:59.862081 0.226004 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:00.088675 0.343503 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:00.432601 0.230787 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:00.663827 0.178891 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:00.843224 0.343299 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:01.186974 0.353407 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:01.540827 0.199191 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:01.740437 0.064762 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:01.805597 0.210401 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:02.016402 0.083126 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:02.099926 0.209025 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:02.309333 0.182640 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:02.492507 0.229553 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:02.722488 0.425427 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:03.148495 0.143217 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:33:03.292112 0.116784 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 06:35:50.557322 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:35:57.564684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:36:05.565957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:36:21.569033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:36:53.575031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:42:57.581161 3.001353 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:43:04.588559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:43:12.589954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:43:28.593766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:44:00.598863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:44:43.991751 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 06:44:43.991926 1.509836 tcp 10.0.2.105 63060 -> 200.84.7.244 8038 FSPA* 0 0 15 1592 flow=From-Botnet-V2-TCP-Established 1970/02/23 06:55:37.614334 3.000885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 06:55:44.621033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:55:52.622692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:56:08.625695 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 06:56:40.632012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:02:44.638005 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:02:51.645142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:02:59.646569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:03:15.649694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:03:16.190953 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 07:03:16.191060 0.260036 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:16.451572 0.156751 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:16.608830 0.083224 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:16.692573 0.221538 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:16.914509 0.187396 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:17.102310 0.072414 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:17.175169 0.698722 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:17.874356 0.217985 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.092824 0.178254 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.271485 0.045868 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.317775 0.210111 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.528361 0.167830 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.696725 0.208978 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:18.906156 0.482958 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.389508 0.157697 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.547634 0.161927 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.710041 0.083066 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.793576 0.047890 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.841814 0.053443 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:19.895659 0.367244 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:20.263341 0.057801 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:20.321543 0.222231 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:20.544305 0.183018 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:20.727807 0.325578 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:21.053851 0.348648 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:21.403001 0.231295 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:21.634794 0.345442 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:21.980630 0.196862 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:22.177926 0.066418 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:22.244737 0.212129 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:22.457229 0.082304 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:22.540000 0.376123 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:22.916553 0.422441 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:23.339364 0.208322 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:23.548116 0.196054 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:23.744644 0.138629 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:23.883713 0.116662 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:03:47.655711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:10:15.666899 3.000848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:10:22.673530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:10:30.675137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:10:46.678243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:11:18.686623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:14:45.502192 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 07:14:45.502430 1.347950 tcp 10.0.2.105 63061 -> 200.84.7.244 8038 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/23 07:17:22.690345 3.001240 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:17:29.697707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:17:37.698928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:17:53.702258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:18:25.707989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:24:29.713512 3.002168 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:24:36.721520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:24:44.723246 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:25:00.726101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:25:32.732321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:31:39.741968 3.002142 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:31:46.751291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:31:54.751361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:32:10.754463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:32:42.760517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:33:33.113282 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 07:33:33.113422 0.083867 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:33.197734 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 07:33:51.421046 0.056708 tcp 10.0.2.105 63062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 07:33:51.478065 0.055981 tcp 10.0.2.105 63063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 07:33:51.534316 0.134120 tcp 10.0.2.105 63064 -> 195.113.214.249 443 SRPA* 0 0 35 24432 flow=From-Botnet-V2-TCP-Established 1970/02/23 07:33:51.669132 0.376912 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.046436 0.153376 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.200359 0.188713 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.389479 0.070178 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.460119 0.441298 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.901812 0.044571 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:52.946787 0.202963 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:53.150187 0.187299 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:53.337991 0.209557 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:53.547978 0.213631 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:53.762087 0.170403 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:53.932885 0.490201 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.423497 0.171959 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.595952 0.161231 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.757604 0.086010 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.844639 0.042456 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.887492 0.060288 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:54.948278 0.225303 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:55.174030 0.177729 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:55.352134 0.345774 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:55.698331 0.058014 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:55.756771 0.228145 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:55.985289 0.332165 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:56.317835 0.348566 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:56.666814 0.337191 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.004615 0.198929 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.204050 0.067158 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.271606 0.216321 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.488375 0.083074 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.571827 0.214991 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:57.787239 0.399490 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:58.187177 0.576209 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:58.763882 0.116304 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:58.880583 0.192990 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:33:59.074012 0.143479 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 07:38:46.766673 3.004381 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:38:53.773713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:39:01.775387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:39:17.781211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:39:49.784279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:44:46.852070 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 07:44:46.852426 2.010288 tcp 10.0.2.105 63065 -> 200.84.7.244 8038 FSPA* 0 0 15 1750 flow=From-Botnet-V2-TCP-Established 1970/02/23 07:45:53.790112 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:46:00.797550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:46:08.799131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:46:24.802648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:46:56.808653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:53:00.814677 3.001203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 07:53:07.821661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:53:15.823243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:53:31.826255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 07:54:03.832106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:00:07.838101 3.002449 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:00:14.845515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:00:22.847193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:00:38.850906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:01:10.856676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:04:16.903952 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 08:04:16.904159 0.220811 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.125381 0.080631 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.206445 0.261556 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.468379 0.157497 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.626300 0.186954 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.813669 0.074274 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:17.888353 0.423974 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:18.312770 0.047382 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:18.360578 0.000000 udp 10.0.2.105 7010 -> 99.98.252.106 9529 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 08:04:36.503716 0.095044 tcp 10.0.2.105 63066 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:04:36.599162 0.055515 tcp 10.0.2.105 63067 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:04:36.655007 0.139528 tcp 10.0.2.105 63068 -> 195.113.214.249 443 SRPA* 0 0 33 23703 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:04:36.795184 0.218272 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:37.013891 0.175471 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:37.189737 0.170787 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:37.360984 0.210620 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:37.572061 0.486963 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.059432 0.164196 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.224090 0.160770 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.385291 0.076810 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.462566 0.049895 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.512868 0.059834 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.573097 0.221432 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.794937 0.058965 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:38.854365 0.227116 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:39.081943 0.173926 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:39.256440 0.349085 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:39.606004 0.342256 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:39.948690 0.199736 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:40.148873 0.384283 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:40.533579 0.442705 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:40.976720 0.060674 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:41.037824 0.217386 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:41.255653 0.085762 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:41.341822 0.626525 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:41.968803 0.329672 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:42.298817 0.196221 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:42.495422 0.143379 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:42.639298 0.509406 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:04:43.149187 0.117222 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:07:19.870434 3.000690 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:07:26.876201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:07:34.878378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:07:50.881495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:08:22.887478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:14:26.893691 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:14:33.900965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:14:41.901689 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:14:48.862847 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 08:14:48.862957 2.049648 tcp 10.0.2.105 63069 -> 200.84.7.244 8038 FSPA* 0 0 13 1628 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:14:58.179449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:15:29.911361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:21:33.918731 3.000489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:21:40.924939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:21:48.926239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:22:04.929407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:22:36.935377 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:28:42.944706 3.000896 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:28:49.951792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:28:57.952737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:29:13.955583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:29:45.962631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:35:04.510261 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 08:35:04.510409 0.207428 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:04.718289 0.359987 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:05.078821 0.160802 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:05.240020 0.223432 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:05.463907 0.080219 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:05.544545 0.450324 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:05.995225 0.045552 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.041199 0.201429 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.243064 0.072415 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.315946 0.169643 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.486071 0.149348 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.635936 0.215133 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:06.851515 0.164213 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:07.016202 0.166702 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:07.183338 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 08:35:25.121982 0.057241 tcp 10.0.2.105 63070 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:25.179510 0.054924 tcp 10.0.2.105 63071 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:25.234730 0.231729 tcp 10.0.2.105 63072 -> 195.113.214.249 443 SRPA* 0 0 42 34632 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:25.467407 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 08:35:40.532379 0.054471 tcp 10.0.2.105 63073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:40.587219 0.057350 tcp 10.0.2.105 63074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:40.644941 0.154832 tcp 10.0.2.105 63075 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:35:40.800383 0.074573 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:40.875451 0.042613 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:40.918523 0.060604 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 587 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:40.979548 0.225570 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:41.205625 0.061347 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:41.267495 0.230657 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:41.498564 0.182118 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:41.681168 0.219555 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:41.901201 0.350393 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:42.252012 0.348957 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:42.601405 0.324993 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:42.926782 0.348316 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:43.275498 0.070287 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:43.346228 0.212083 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:43.558801 0.090411 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:43.649639 0.210721 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:43.860761 0.264879 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:44.126094 0.524951 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:44.651470 0.116411 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:44.768351 0.196695 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:44.965519 0.143078 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/23 08:35:49.968720 3.001132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 08:35:56.975517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:36:04.977074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:36:20.980162 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:36:52.985613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:42:56.993587 3.000182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:43:03.999432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:43:12.000999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:43:28.004095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:44:00.009691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:44:50.563347 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 08:44:50.563536 1.774107 tcp 10.0.2.105 63076 -> 200.84.7.244 8038 FSPA* 0 0 14 1697 flow=From-Botnet-V2-TCP-Established 1970/02/23 08:55:39.018049 3.005278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 08:55:46.025430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:55:54.027075 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:56:10.029595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 08:56:42.035652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:02:46.041887 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 09:02:53.049007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:03:01.050299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:03:17.053619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:03:49.059684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:05:52.848237 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:05:52.848388 0.498023 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:53.346856 0.208640 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:53.556042 0.218859 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:53.775387 0.203377 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:53.979325 1.413670 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:55.393411 2.851218 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:58.245008 0.053681 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:05:58.299036 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 09:06:16.845016 0.056442 tcp 10.0.2.105 63077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:16.901724 0.056318 tcp 10.0.2.105 63078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:16.957912 0.152988 tcp 10.0.2.105 63079 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:17.111596 0.081748 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:17.193780 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 09:06:34.137405 0.054401 tcp 10.0.2.105 63080 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:34.192175 0.055402 tcp 10.0.2.105 63081 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:34.247829 0.148168 tcp 10.0.2.105 63082 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:06:34.396784 0.171835 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:34.569114 0.162083 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:34.731701 0.153949 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:34.886103 0.175675 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.062145 0.072712 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.135366 0.223799 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.359642 0.082565 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.442585 0.074046 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.517010 0.059724 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.577117 0.221444 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.798943 0.181083 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:35.980559 0.198558 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:36.179542 0.349692 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:36.529652 0.055211 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:36.585347 0.231020 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:36.816999 0.343141 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:37.160554 0.334638 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:37.495711 0.350370 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:37.846504 0.067195 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:37.914089 0.210193 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:38.124779 0.084805 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:38.210088 0.221526 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:38.432017 0.479563 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:38.911947 0.181991 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:39.094317 0.144788 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:39.239489 0.424543 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:06:39.664579 0.116288 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:10:17.071704 3.000291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 09:10:24.077491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:10:32.079054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:10:48.082016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:11:20.088302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:14:52.343830 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:14:52.343993 1.301346 tcp 10.0.2.105 63083 -> 200.84.7.244 8038 FSPA* 0 0 14 1574 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:17:24.099073 2.996246 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 09:17:31.101465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:17:39.103149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:17:55.106180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:18:27.112549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:24:31.117721 3.002300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 09:24:38.125729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:24:46.127099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:25:02.130094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:25:34.136240 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:31:42.147990 3.001607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 09:31:49.155388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:31:57.156894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:32:13.159583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:32:45.165756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:37:00.223381 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:37:00.223499 0.221364 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:00.445322 0.187462 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:00.633379 0.221835 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:00.855700 0.223383 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:01.079445 0.203196 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:01.283155 0.214559 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:01.498114 2.045684 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:03.544407 0.465046 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.009846 0.051291 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.061645 0.076993 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.139035 0.189125 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.328538 0.163952 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.492944 0.162835 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.656181 0.227889 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.884503 0.073079 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:04.958017 0.215821 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.174315 0.091034 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.265836 0.088680 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.354974 0.053649 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.409091 0.224181 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.633789 0.344998 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:05.979156 0.057818 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:06.037376 0.230543 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:06.268560 0.181382 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:06.450353 0.202291 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:06.653043 0.346448 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:06.999855 0.325730 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:07.325944 0.348217 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:07.674541 0.064169 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:07.739078 0.209682 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:07.949183 0.083312 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:08.033159 0.207422 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:08.241031 0.143395 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:08.384907 0.282161 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:08.667488 0.189282 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:08.857219 0.424970 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:37:09.282647 0.116795 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/23 09:38:49.171664 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 09:38:56.179382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:39:04.180776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:39:20.183839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:39:52.190127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:44:53.653903 0.000234 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:44:53.654265 0.720348 tcp 10.0.2.105 63084 -> 200.84.7.244 8038 FSPA* 0 0 11 1097 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:44:54.078711 0.059907 tcp 10.0.2.105 63085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:44:54.138852 0.060704 tcp 10.0.2.105 63086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:44:54.199842 0.147746 tcp 10.0.2.105 63087 -> 195.113.214.249 443 SRPA* 0 0 42 22022 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:44:54.374929 3.004095 tcp 10.0.2.105 63088 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:03.377155 0.000000 tcp 10.0.2.105 63088 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:09.376591 0.055724 tcp 10.0.2.105 63089 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:09.432661 0.055425 tcp 10.0.2.105 63090 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:09.488388 0.149224 tcp 10.0.2.105 63091 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:09.679651 3.000928 tcp 10.0.2.105 63092 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:18.679352 0.000000 tcp 10.0.2.105 63092 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:24.678666 0.059463 tcp 10.0.2.105 63093 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:24.738435 0.054641 tcp 10.0.2.105 63094 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:24.793539 0.154791 tcp 10.0.2.105 63095 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:24.965862 3.006321 tcp 10.0.2.105 63096 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:33.971350 0.000000 tcp 10.0.2.105 63096 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:39.960230 0.053610 tcp 10.0.2.105 63097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:40.014125 0.062947 tcp 10.0.2.105 63098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:40.077419 0.140475 tcp 10.0.2.105 63099 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:40.234219 0.429980 tcp 10.0.2.105 63100 -> 200.84.7.244 8038 FSPA* 0 0 13 1205 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:45:40.664469 3.001168 tcp 10.0.2.105 63101 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:49.663565 0.000000 tcp 10.0.2.105 63101 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:55.662813 2.993799 tcp 10.0.2.105 63102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:45:56.195323 3.002002 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 09:46:03.203186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:46:04.655089 0.000000 tcp 10.0.2.105 63102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:46:09.171797 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:46:10.664138 3.004529 tcp 10.0.2.105 63103 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:46:11.204570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:46:19.667017 0.000000 tcp 10.0.2.105 63103 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:46:27.208026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:46:59.213596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:51:25.667518 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 09:51:25.667721 3.003600 tcp 10.0.2.105 63104 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:51:34.669708 0.000000 tcp 10.0.2.105 63104 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:51:40.670551 0.057593 tcp 10.0.2.105 63105 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:40.728558 0.055432 tcp 10.0.2.105 63106 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:40.784432 0.147053 tcp 10.0.2.105 63107 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:40.946047 2.996987 tcp 10.0.2.105 63108 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:51:49.951930 0.000000 tcp 10.0.2.105 63108 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:51:55.941191 0.071905 tcp 10.0.2.105 63109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:56.013447 0.055795 tcp 10.0.2.105 63110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:56.069553 0.246614 tcp 10.0.2.105 63111 -> 195.113.214.249 443 SRPA* 0 0 25 14828 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:51:56.334275 2.990935 tcp 10.0.2.105 63112 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:52:05.323749 0.000000 tcp 10.0.2.105 63112 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 09:52:11.333396 0.054228 tcp 10.0.2.105 63113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:52:11.387896 0.060725 tcp 10.0.2.105 63114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:52:11.448975 0.151586 tcp 10.0.2.105 63115 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:52:11.625005 1.299514 tcp 10.0.2.105 63116 -> 200.84.7.244 8038 FSPA* 0 0 15 1667 flow=From-Botnet-V2-TCP-Established 1970/02/23 09:53:03.219517 3.001642 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 09:53:10.227215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:53:18.228867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:53:34.231823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 09:54:06.238032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:00:10.244529 3.001115 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:00:17.251309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:00:25.252727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:00:41.255751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:01:13.261742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:07:23.276037 3.002197 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:07:30.283729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:07:31.445854 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 10:07:31.445972 0.209124 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:31.655580 0.223095 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:31.879091 0.222831 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:32.102413 0.188418 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:32.291213 0.212266 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:32.504012 0.207805 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:32.712202 2.137168 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:34.849832 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 10:07:38.286124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:07:44.861726 0.000000 udp 10.0.2.105 7010 <- 213.123.178.217 3364 RSP 0 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 10:07:44.862189 0.054049 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:44.916637 0.079938 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:44.997048 0.160413 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.157988 0.175801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.334202 0.073465 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.408052 0.227162 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.635773 0.153966 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.790209 0.165301 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:45.955979 0.080554 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.036992 0.046926 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.084482 0.060218 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.145129 0.226168 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.371658 0.374069 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.746141 0.058634 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:46.805186 0.200412 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:47.006112 0.344249 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:47.350871 0.228722 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:47.580028 0.181089 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:47.761601 0.354378 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:48.116371 0.347493 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:48.464270 0.067113 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:48.531888 0.211434 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:48.743818 0.089724 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:48.834028 0.203125 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:49.037566 0.181254 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:49.219198 0.142633 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:49.362306 0.270453 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:49.633164 0.422652 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:50.056383 0.116361 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:07:54.288368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:08:26.294500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:14:30.300711 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:14:37.307569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:14:45.309177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:15:01.312078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:15:33.318472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:21:37.324750 3.000979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:21:44.331649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:21:52.332838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:22:08.336405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:22:12.923332 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 10:22:12.923455 2.028125 tcp 10.0.2.105 63117 -> 200.84.7.244 8038 FSPA* 0 0 15 1760 flow=From-Botnet-V2-TCP-Established 1970/02/23 10:22:40.342179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:28:45.349459 3.001828 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:28:52.357127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:29:00.358935 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:29:16.361480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:29:48.367782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:35:52.373440 3.001886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:35:59.381042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:36:07.382727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:36:23.385672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:36:55.391645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:38:03.990726 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 10:38:03.990903 0.217156 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:04.208493 0.225538 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:04.434411 0.203014 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:04.637923 0.210068 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:04.848466 0.222317 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:05.071215 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 10:38:20.496056 0.054964 tcp 10.0.2.105 63118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 10:38:20.551364 0.055554 tcp 10.0.2.105 63119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 10:38:20.607224 0.144076 tcp 10.0.2.105 63120 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/23 10:38:20.751939 0.513660 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:21.265996 0.083077 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:21.349508 0.161737 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:21.511619 0.175676 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:21.687740 0.814487 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:22.502718 0.061161 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:22.564461 0.076164 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 590 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:22.641025 0.227477 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:22.868967 0.151755 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.021164 0.163800 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.185355 0.091804 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.277583 0.047962 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.325966 0.059352 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.385687 0.057988 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.444068 0.219096 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:23.663606 0.357556 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:24.021605 0.226252 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:24.248402 0.181363 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:24.430190 0.192978 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:24.623598 0.341167 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:24.965214 0.324933 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:25.290571 0.348881 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:25.639917 0.065857 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:25.706148 0.221140 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:25.927668 0.187130 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:26.115301 0.144681 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:26.260665 0.413678 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:26.674737 0.225104 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:26.900217 0.082847 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:26.983577 0.421950 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:38:27.405995 0.116501 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/23 10:42:59.397715 3.002320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:43:06.405069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:43:14.406561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:43:30.409397 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:44:02.415510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:52:14.953699 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 10:52:14.953898 1.316262 tcp 10.0.2.105 63121 -> 200.84.7.244 8038 FSPA* 0 0 14 1615 flow=From-Botnet-V2-TCP-Established 1970/02/23 10:55:42.427822 2.998292 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 10:55:49.431969 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:55:57.433484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:56:13.436623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 10:56:45.442764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:02:49.450656 2.999767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:02:56.456324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:03:04.457641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:03:20.460847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:03:52.467044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:08:50.555109 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 11:08:50.555212 0.189215 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:50.744808 0.223668 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:50.968945 0.222803 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:51.192185 0.212389 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:51.405024 0.222809 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:51.628433 0.213501 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:51.842352 2.309866 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.152622 0.080342 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.233425 0.162858 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.396759 0.176224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.573492 0.074753 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.648693 0.213712 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:54.862766 0.153942 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.017174 0.169575 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.187190 0.388819 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.576604 0.052387 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.629482 0.091443 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.721303 0.048484 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.770231 0.059999 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.830607 0.058211 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:55.889295 0.309501 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:56.199294 0.343567 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:56.543322 0.229894 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:56.773574 0.347144 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:57.121126 0.180074 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:57.301701 0.242739 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:57.544855 0.329203 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:57.874487 0.347543 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:58.222479 0.066510 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:58.289422 0.216420 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:58.506269 0.187884 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:58.694646 0.143298 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:08:58.838391 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 11:09:17.796402 0.055762 tcp 10.0.2.105 63122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:17.852454 0.055356 tcp 10.0.2.105 63123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:17.908129 0.158934 tcp 10.0.2.105 63124 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:18.065307 0.000000 udp 10.0.2.105 7010 -> 190.72.25.63 2831 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 11:09:33.077022 0.058041 tcp 10.0.2.105 63125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:33.135437 0.055329 tcp 10.0.2.105 63126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:33.191135 0.146802 tcp 10.0.2.105 63127 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:09:33.338579 0.205772 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:09:33.544824 0.423594 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:09:33.968833 0.116583 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:10:21.479325 3.001248 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 11:10:28.486194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:10:36.487465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:10:52.490725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:11:24.499856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:17:28.503020 3.001130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:17:35.510299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:17:43.511359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:17:59.513968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:18:31.520355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:22:16.273970 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 11:22:16.274133 0.209859 tcp 10.0.2.105 63128 -> 200.84.7.244 8038 SPA_* 0 0 9 1071 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:22:24.005744 0.013549 tcp 10.0.2.105 63128 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:24:35.534282 2.997089 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:24:42.533808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:24:50.535299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:25:06.538270 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:25:38.544402 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:31:45.555667 3.000965 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:31:52.562090 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:32:00.563666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:32:16.566604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:32:48.573005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:38:52.579330 3.001442 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:38:59.586291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:39:07.588936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:39:23.590718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:39:42.187731 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 11:39:42.187947 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 11:39:55.596811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:39:59.074162 0.057407 tcp 10.0.2.105 63129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:39:59.131910 0.054265 tcp 10.0.2.105 63130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:39:59.186463 0.187682 tcp 10.0.2.105 63131 -> 195.113.214.249 443 SRPA* 0 0 41 37954 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:39:59.374997 0.268186 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:39:59.643627 0.224681 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:39:59.868841 0.187953 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:00.057284 0.221226 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:00.278921 0.215760 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:00.495099 0.213728 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:00.709333 0.227615 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:00.937385 0.071269 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.009058 0.085246 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.094724 0.153409 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.248539 0.164076 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.413036 0.169554 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.583000 0.163303 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:01.746673 0.588126 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.335261 0.054230 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.389884 0.087460 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.477815 0.048377 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.526667 0.053909 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.581010 0.060543 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.641952 0.215563 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:02.858004 0.177618 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:03.036035 0.214182 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:03.250617 0.179402 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:03.430395 0.193812 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:03.624698 0.348143 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:03.973231 0.233346 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:04.207033 0.349509 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:04.556967 0.347633 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:04.905005 0.194059 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 567 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.099513 0.143832 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.243769 0.344159 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.588381 0.064958 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.653779 0.207896 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.862095 0.116351 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:05.978872 0.209558 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:40:06.188857 0.424096 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 11:45:59.602795 3.001746 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:46:06.610151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:46:14.611658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:46:30.614656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:47:02.620715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:52:24.023166 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 11:52:24.023378 1.280585 tcp 10.0.2.105 63132 -> 200.84.7.244 8038 FSPA* 0 0 14 1569 flow=From-Botnet-V2-TCP-Established 1970/02/23 11:53:06.626368 3.002279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 11:53:13.634206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:53:21.635761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:53:37.638726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 11:54:09.644442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:00:13.651283 3.000830 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:00:20.658254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:00:28.659599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:00:44.662861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:01:16.668972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:07:25.682808 3.000490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:07:32.689164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:07:40.690724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:07:56.693645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:08:28.699579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:10:29.293298 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 12:10:29.293408 0.189075 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:29.482914 0.267373 udp 10.0.2.105 7010 <-> 190.72.25.63 2831 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:29.750743 0.209465 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:29.960683 0.222188 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:30.183395 0.221818 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:30.405587 0.213069 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:30.619043 0.228897 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:30.848436 0.072783 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:30.921666 0.080194 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:31.002306 0.158809 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 565 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:31.161527 0.161369 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:31.323323 0.162396 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:31.486198 0.175632 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:31.662289 3.092194 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:34.754850 0.046864 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:34.802086 0.087422 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:34.889911 0.041466 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:34.931817 0.053604 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:34.985792 0.057481 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:35.043709 0.218402 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:35.262643 0.176284 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:35.439426 0.207961 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:35.647784 0.349256 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:35.997469 0.229529 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:36.227460 0.599915 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:36.827826 0.193622 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:37.021826 0.371770 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:37.394103 0.338924 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:37.733398 0.195605 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:37.929459 0.143645 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:38.073613 0.211058 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:38.285102 0.116744 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:38.402353 0.210829 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:38.613707 0.348665 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:38.962823 0.067141 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:10:39.030426 0.425471 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:14:32.706364 3.000781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:14:39.713127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:14:47.714785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:15:03.717832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:15:35.723570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:21:39.729335 3.002180 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:21:46.738086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:21:54.739023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:22:10.741530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:22:25.303260 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 12:22:25.303480 0.216183 tcp 10.0.2.105 63133 -> 200.84.7.244 8038 SPA_* 0 0 9 1132 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:22:34.573429 0.020165 tcp 10.0.2.105 63133 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:22:42.747785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:28:48.756772 3.001482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:28:55.763719 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:29:03.765515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:29:19.768577 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:29:51.774455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:35:55.780128 3.002212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:36:02.787971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:36:10.789541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:36:26.792615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:36:58.798599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:40:42.220076 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 12:40:42.220374 0.188759 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:42.409560 0.222092 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:42.632050 0.000000 udp 10.0.2.105 7010 -> 190.72.25.63 2831 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 12:40:58.565515 0.083608 tcp 10.0.2.105 63134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:40:58.649436 0.070091 tcp 10.0.2.105 63135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:40:58.719816 0.126049 tcp 10.0.2.105 63136 -> 195.113.214.249 443 SRPA* 0 0 24 13846 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:40:58.846480 0.212259 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.059157 0.208281 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.267896 0.210388 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.478676 0.227834 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.706898 0.077217 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.784546 0.081423 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:40:59.866374 0.155905 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.022648 0.148269 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.171308 0.160928 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.332642 0.170796 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.503912 0.075385 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.579746 0.043937 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.624102 0.060217 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:00.684690 0.330379 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.015573 0.059026 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.075039 0.057674 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.133116 0.219033 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.352591 0.168010 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.521107 0.214123 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:01.735721 0.332709 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:02.068860 0.230594 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:02.299873 0.183055 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:02.483407 0.213792 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:02.697660 0.372395 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:03.070490 0.348052 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:03.418983 0.190018 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:03.609441 0.144023 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:03.753942 0.221119 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:03.975457 0.349745 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:04.325632 0.116419 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:04.442515 0.223921 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:04.666858 0.064739 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:41:04.732115 0.439786 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 12:43:02.804020 3.002210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:43:09.811847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:43:17.813235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:43:33.817993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:44:05.822693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:52:34.594191 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 12:52:34.594331 1.284192 tcp 10.0.2.105 63137 -> 200.84.7.244 8038 FSPA* 0 0 14 1568 flow=From-Botnet-V2-TCP-Established 1970/02/23 12:55:39.834107 3.001332 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 12:55:46.840961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:55:54.842503 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:56:10.844653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 12:56:42.850675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:02:46.856547 3.001993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:02:53.863993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:03:01.865698 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:03:17.868840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:03:49.874936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:10:16.883409 3.002046 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:10:23.891168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:10:31.892850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:10:47.895927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:11:08.816137 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 13:11:08.816309 0.000000 udp 10.0.2.105 7010 -> 190.72.25.63 2831 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 13:11:19.901742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:11:24.039591 0.055437 tcp 10.0.2.105 63138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:11:24.095343 0.054958 tcp 10.0.2.105 63139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:11:24.150673 0.145549 tcp 10.0.2.105 63140 -> 195.113.214.249 443 SRPA* 0 0 41 21646 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:11:24.297141 0.186464 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:24.484002 0.221175 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:24.705695 0.212786 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:24.918862 0.213153 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.132681 0.212265 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.345432 0.222681 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.568609 0.066851 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.635933 0.079176 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.715575 0.156688 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:25.872659 0.149634 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.022727 0.157791 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.180945 0.170417 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.351796 0.082790 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.434991 0.042346 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.477841 0.054159 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:26.532437 0.725798 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:27.258763 0.045313 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:27.304706 0.057574 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:27.362811 0.222799 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:27.586085 0.322461 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:27.909015 0.217764 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:28.127238 0.171619 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:28.299335 0.201001 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:28.500787 0.384150 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:28.885329 0.229282 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:29.115094 0.181504 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:29.297088 0.345200 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:29.642699 0.198188 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:29.841268 0.137569 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:29.979229 0.207952 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:30.187618 0.216788 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:30.404832 0.070795 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:30.476033 0.521191 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:30.997806 0.348801 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:11:31.346978 0.116810 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:17:23.907834 3.001314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:17:30.915109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:17:38.916198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:17:54.919761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:18:26.925681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:22:35.884432 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 13:22:35.884645 0.214986 tcp 10.0.2.105 63141 -> 200.84.7.244 8038 SPA_* 0 0 9 1170 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:22:41.187193 0.005817 tcp 10.0.2.105 63141 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:24:30.932815 3.000678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:24:37.943053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:24:45.940821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:25:01.943784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:25:33.953108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:31:40.960101 3.002822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:31:47.967487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:31:55.969026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:32:11.972000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:32:43.978110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:38:47.984777 3.000885 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:38:54.991562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:39:02.992980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:39:18.995602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:39:51.002276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:41:45.226050 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 13:41:45.226229 0.186774 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:45.413436 0.216059 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:45.629917 0.229627 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:45.860062 0.202616 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.063075 0.211665 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.275200 0.225638 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.501344 0.071810 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.573601 0.075832 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.649836 0.157894 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.808204 0.172346 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:46.981001 0.079853 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:47.061283 0.049075 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:47.110771 0.053377 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:47.164694 0.152644 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:47.317746 0.159274 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:47.477452 0.682731 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:48.160755 0.048176 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:48.209423 0.058019 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:48.267939 0.212353 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:48.480784 0.342960 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:41:48.824146 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 13:42:04.385516 0.055605 tcp 10.0.2.105 63142 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:42:04.441416 0.055461 tcp 10.0.2.105 63143 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:42:04.497192 0.147367 tcp 10.0.2.105 63144 -> 195.113.214.249 443 SRPA* 0 0 41 21606 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:42:04.645169 0.366144 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:05.011686 0.231009 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:05.243106 0.179568 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:05.423090 0.199521 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:05.623116 0.181926 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:05.805541 0.346651 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:06.152644 0.180541 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:06.333641 0.143209 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:06.477252 0.222140 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:06.699816 0.423025 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:07.123295 0.348366 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:07.472089 0.116541 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:07.589100 0.210489 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:42:07.800033 0.068086 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 13:45:55.007490 3.002223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:46:02.015707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:46:10.016925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:46:26.019963 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:46:58.025638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:52:41.199830 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 13:52:41.200031 1.250518 tcp 10.0.2.105 63145 -> 200.84.7.244 8038 FSPA* 0 0 14 1509 flow=From-Botnet-V2-TCP-Established 1970/02/23 13:53:02.031570 3.002897 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 13:53:09.039777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:53:17.042748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:53:33.043986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 13:54:05.049887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:00:09.056222 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:00:16.063534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:00:24.065152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:00:40.068098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:01:12.074127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:07:20.086074 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:07:27.093127 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:07:35.096398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:07:51.097756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:08:23.103359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:12:19.564122 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 14:12:19.564370 0.215550 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:19.780479 0.222210 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.003074 0.220686 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.224185 0.211875 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.436454 0.187400 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.624453 0.221942 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.846801 0.068275 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.915495 0.073940 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:20.989911 0.151015 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.141374 0.223229 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.364982 0.081288 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.446668 0.045401 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.492546 0.059749 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.552803 0.175126 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:21.728333 0.412066 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.140898 0.050300 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.191712 0.055357 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.247915 0.158759 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.407496 0.153163 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.561087 0.351298 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:22.913996 0.214600 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:23.129157 0.345129 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:23.474714 0.224250 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:23.699462 0.179858 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:23.930761 0.337858 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:24.269086 0.000000 udp 10.0.2.105 7010 -> 68.56.221.70 8447 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 14:12:42.662341 0.055236 tcp 10.0.2.105 63146 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:12:42.717916 0.060709 tcp 10.0.2.105 63147 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:12:42.778960 0.147370 tcp 10.0.2.105 63148 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:12:42.927072 0.200456 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:43.128014 0.181299 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:43.309757 0.143988 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:43.454161 0.219801 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:12:43.674380 0.000000 udp 10.0.2.105 7010 -> 203.45.157.34 1089 INT 0 1 211 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 14:13:01.884965 0.054407 tcp 10.0.2.105 63149 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:13:01.939746 0.057622 tcp 10.0.2.105 63150 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:13:01.997747 0.146561 tcp 10.0.2.105 63151 -> 195.113.214.249 443 SRPA* 0 0 41 35034 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:13:02.145198 0.211260 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:13:02.356986 0.070379 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:13:02.427806 0.347356 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:13:02.775569 0.116499 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:14:27.110415 3.000906 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 14:14:34.117170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:14:42.118637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:14:58.121746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:15:30.127733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:21:34.133528 3.037526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:21:41.152003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:21:49.152510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:22:05.155388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:22:37.161395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:22:42.451834 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 14:22:42.451995 4.270471 tcp 10.0.2.105 63152 -> 200.84.7.244 8038 FSPA* 0 0 14 1661 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:28:43.172070 2.999915 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:28:50.178081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:28:58.179595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:29:14.181995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:29:46.188847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:35:50.195653 3.000365 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:35:57.201778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:36:05.202811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:36:21.205928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:36:53.212590 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:42:57.217904 3.002283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:43:04.225864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:43:12.227715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:43:28.235008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:43:32.657035 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 14:43:32.657251 0.177302 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:32.835089 0.478448 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:33.313962 0.219886 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:33.534283 0.225079 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:33.759796 0.220636 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:33.980963 0.206344 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.187761 0.074110 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.262391 0.079836 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.342761 0.156794 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.501784 0.222151 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.724352 0.084054 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.808860 0.041858 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:34.851142 0.216658 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.068434 0.199641 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.268614 0.182035 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.451172 0.059862 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.511428 0.159619 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.671432 0.153238 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:35.825165 0.328597 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:36.154211 0.212276 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:36.366954 0.356265 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:36.723687 0.800994 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:37.525103 0.046827 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:37.572363 0.059449 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:37.632271 0.228515 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:37.861216 0.350162 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:38.211784 0.180062 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:38.392415 0.137241 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:38.530039 0.207947 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:38.738336 0.197448 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:38.936223 0.214064 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:39.150727 0.347768 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:39.498989 0.116570 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:39.615973 0.209760 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:43:39.826213 0.064933 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/23 14:44:00.236180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:52:46.723466 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 14:52:46.723584 3.048864 tcp 10.0.2.105 63153 -> 200.84.7.244 8038 FSPA* 0 0 16 1659 flow=From-Botnet-V2-TCP-Established 1970/02/23 14:55:38.243684 3.000776 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 14:55:45.249983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:55:53.251497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:56:09.254452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 14:56:41.260756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:02:45.266646 3.001801 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:02:52.275163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:03:00.275594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:03:16.281606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:03:48.284020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:10:16.295476 3.003756 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:10:23.302475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:10:31.303988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:10:47.306843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:11:19.322929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:14:08.997020 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 15:14:08.997167 0.178156 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:09.175727 0.217422 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:09.393606 0.216266 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:09.610349 0.212107 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:09.822938 0.067569 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:09.890899 0.440124 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:10.331499 0.237335 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:10.569292 0.075086 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:10.644790 0.151989 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:10.797161 0.406263 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.203819 0.081327 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.285616 0.041094 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.327089 0.215482 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.542979 0.169674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.713136 0.187252 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.901018 0.053234 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:11.954701 0.159894 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:12.115109 0.160578 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:12.276189 0.326058 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:12.602712 0.221185 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:12.824274 0.348398 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:13.173221 0.054086 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:13.227685 0.230227 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:13.458265 0.349801 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:13.808504 0.680197 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:14.489224 0.043978 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:14.533681 0.179434 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:14.713559 0.142965 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:14.857037 0.208678 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:15.066144 0.191430 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:15.258088 0.198695 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:15.457238 0.210709 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:15.668441 0.064531 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:15.733386 0.343778 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:14:16.077608 0.116666 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:17:23.329230 3.032088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:17:30.347200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:17:38.347812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:17:54.351105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:18:26.357147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:22:49.776127 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 15:22:49.776255 0.221207 tcp 10.0.2.105 63154 -> 200.84.7.244 8038 SPA_* 0 0 9 1205 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:20.001035 0.054863 tcp 10.0.2.105 63155 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:20.056192 0.054883 tcp 10.0.2.105 63156 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:20.111361 0.145097 tcp 10.0.2.105 63157 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:20.219017 0.161015 tcp 10.0.2.105 63154 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:20.380523 2.993387 tcp 10.0.2.105 63158 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:23:29.382695 0.000000 tcp 10.0.2.105 63158 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:23:35.407506 0.054117 tcp 10.0.2.105 63159 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:35.461948 0.055033 tcp 10.0.2.105 63160 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:35.517326 0.150603 tcp 10.0.2.105 63161 -> 195.113.214.249 443 SRPA* 0 0 33 18758 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:35.949474 2.976895 tcp 10.0.2.105 63162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:23:44.924994 0.000000 tcp 10.0.2.105 63162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:23:50.923858 0.054340 tcp 10.0.2.105 63163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:50.978511 0.054138 tcp 10.0.2.105 63164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:51.032928 0.146754 tcp 10.0.2.105 63165 -> 195.113.214.249 443 SRPA* 0 0 59 38966 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:23:51.470462 2.998345 tcp 10.0.2.105 63166 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:24:00.467450 0.000000 tcp 10.0.2.105 63166 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:24:06.466516 0.053099 tcp 10.0.2.105 63167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:24:06.519937 0.054290 tcp 10.0.2.105 63168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:24:06.574057 0.143817 tcp 10.0.2.105 63169 -> 195.113.214.249 443 SRPA* 0 0 40 21118 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:24:06.727544 0.220400 tcp 10.0.2.105 63170 -> 200.84.7.244 8038 SPA_* 0 0 7 1097 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:24:31.364408 3.007138 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 15:24:36.950920 0.216877 tcp 10.0.2.105 63170 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:24:36.951331 2.992711 tcp 10.0.2.105 63171 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:24:38.372038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:24:45.952718 0.000000 tcp 10.0.2.105 63171 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:24:46.373262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:24:51.951601 2.996040 tcp 10.0.2.105 63172 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:25:00.944255 0.000000 tcp 10.0.2.105 63172 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:25:02.376608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:25:05.671026 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 15:25:06.952950 3.004345 tcp 10.0.2.105 63173 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:25:15.955867 0.000000 tcp 10.0.2.105 63173 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:25:34.382317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:30:21.956133 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 15:30:21.956374 3.003961 tcp 10.0.2.105 63174 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:30:30.958754 0.000000 tcp 10.0.2.105 63174 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:30:36.959670 0.053800 tcp 10.0.2.105 63175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:37.013788 0.054894 tcp 10.0.2.105 63176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:37.069063 0.146037 tcp 10.0.2.105 63177 -> 195.113.214.249 443 SRPA* 0 0 40 32970 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:37.226925 3.005159 tcp 10.0.2.105 63178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:30:46.230684 0.000000 tcp 10.0.2.105 63178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:30:52.220200 0.053934 tcp 10.0.2.105 63179 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:52.274459 0.055649 tcp 10.0.2.105 63180 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:52.330417 0.146547 tcp 10.0.2.105 63181 -> 195.113.214.249 443 SRPA* 0 0 41 33612 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:30:52.499568 2.994447 tcp 10.0.2.105 63182 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:31:01.502677 0.000000 tcp 10.0.2.105 63182 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 15:31:07.491882 0.054081 tcp 10.0.2.105 63183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:31:07.546338 0.055396 tcp 10.0.2.105 63184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:31:07.602021 0.139023 tcp 10.0.2.105 63185 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:31:07.887071 1.342365 tcp 10.0.2.105 63186 -> 200.84.7.244 8038 FSPA* 0 0 15 1776 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:31:41.392960 3.001305 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 15:31:48.399991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:31:56.401502 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:32:12.405323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:32:44.411064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:38:48.417671 3.000662 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:38:55.424038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:39:03.425596 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:39:19.428858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:39:51.434733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:44:18.498829 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 15:44:18.498945 0.000000 udp 10.0.2.105 7010 -> 68.56.221.70 8447 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 15:44:36.045695 0.055301 tcp 10.0.2.105 63187 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:44:36.101275 0.054198 tcp 10.0.2.105 63188 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:44:36.155800 0.146606 tcp 10.0.2.105 63189 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/23 15:44:36.302959 0.233033 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:36.519198 0.111661 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:36.591878 0.219769 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:36.805889 0.259136 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:37.030519 0.093738 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:37.138791 0.445127 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:37.562406 0.213275 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2119 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:37.773043 0.203574 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:37.948584 0.391872 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.282586 0.115743 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.382179 0.061528 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.428537 0.197563 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.617722 0.064100 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.679854 0.190286 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:38.854626 0.224921 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:39.183444 0.188885 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:39.506019 0.164470 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:39.973763 0.360320 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:40.305841 0.237248 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:40.522479 0.240466 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:40.755321 0.376215 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:41.127827 0.071878 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2136 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:41.185895 0.355989 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:41.532057 0.860900 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:42.371869 0.094254 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2532 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:42.484987 0.194873 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:42.668159 0.154253 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:42.813309 0.206512 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:43.016685 0.215446 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:43.228772 0.062604 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:43.339269 0.189597 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:43.584849 0.260794 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:43.816770 0.353645 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:44:44.166713 0.116982 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/23 15:45:55.443566 3.002047 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:46:02.448057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:46:10.449494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:46:26.452777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:46:58.458808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:53:02.465807 3.000259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 15:53:09.472576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:53:17.473582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:53:33.476561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 15:54:05.482742 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:00:09.488804 3.001937 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:00:16.496039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:00:24.497363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:00:40.500909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:01:09.232536 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 16:01:09.232749 1.556154 tcp 10.0.2.105 63190 -> 200.84.7.244 8038 FSPA* 0 0 14 1733 flow=From-Botnet-V2-TCP-Established 1970/02/23 16:01:12.506741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:07:22.522683 3.000150 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:07:29.528627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:07:37.530177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:07:53.533182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:08:25.539251 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:14:29.546382 3.000688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:14:36.552715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:14:44.553918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:14:57.343228 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 16:14:57.343340 0.178538 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:57.522298 0.214592 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:57.737266 0.221917 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:57.959601 0.077131 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:58.037133 0.212002 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:58.249534 0.070508 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:58.320481 0.424713 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:58.745614 0.206899 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:58.952896 0.156304 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:59.109670 0.382035 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:59.492173 0.181902 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:59.674495 0.054035 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:59.728919 0.159964 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:14:59.889303 0.220301 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.110040 0.076730 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.187241 0.040756 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.228432 0.175978 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.404867 0.153088 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 211 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.557078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:15:00.558329 0.219769 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:00.778538 0.344026 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:01.123003 0.060744 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:01.184160 0.349489 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:01.534142 0.224018 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:01.758553 0.346160 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:02.105174 0.449815 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:02.555372 0.054797 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:02.610646 0.178400 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:02.789449 0.147874 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:02.937822 0.207919 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:03.146154 0.209696 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:03.356309 0.199444 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:03.556199 0.348522 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:03.905191 0.062016 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:03.967644 0.181509 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:04.149659 0.116347 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:15:32.563345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:21:36.570553 3.000390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:21:43.576651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:21:51.578132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:22:07.581262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:22:39.587243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:28:44.594149 3.002638 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:28:51.601883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:28:59.603368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:29:15.606769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:29:47.612863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:31:10.792790 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 16:31:10.792970 1.256915 tcp 10.0.2.105 63191 -> 200.84.7.244 8038 FSPA* 0 0 14 1658 flow=From-Botnet-V2-TCP-Established 1970/02/23 16:35:51.620573 2.999663 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:35:58.625860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:36:06.627415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:36:22.630699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:36:54.636625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:42:58.643822 3.000447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:43:05.650083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:43:13.651890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:43:29.654677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:44:01.661020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:45:09.848969 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 16:45:09.849079 0.172979 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:10.022467 0.504236 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:10.527205 0.310017 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:10.837669 0.078923 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:10.917034 0.217048 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:11.134526 0.072104 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:11.207126 0.166733 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:11.374273 0.496290 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:11.870986 0.424255 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:12.295653 0.220283 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:12.516308 0.182248 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:12.699052 0.060093 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:12.759541 0.157718 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:12.917674 0.221761 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.139837 0.088881 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.229138 0.048053 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.277590 0.175011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.453093 0.152960 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.606404 0.226240 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:13.833040 0.333941 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:14.167486 0.282372 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:14.450341 0.378734 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:14.829514 0.057560 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:14.887545 0.345322 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:15.233379 0.817812 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:16.051568 0.056873 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:16.108818 0.181140 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:16.290471 0.144271 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:16.435182 0.222084 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:16.657715 0.347583 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:17.005741 0.071003 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:17.077250 0.190109 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:17.267774 0.116646 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 573 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:17.384810 0.223643 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:45:17.608848 0.208008 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/23 16:55:41.671002 3.000271 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 16:55:48.677330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:55:56.678925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:56:12.681333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 16:56:44.687539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:01:12.052604 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 17:01:12.052772 1.316857 tcp 10.0.2.105 63192 -> 200.84.7.244 8038 FSPA* 0 0 15 1579 flow=From-Botnet-V2-TCP-Established 1970/02/23 17:02:48.693644 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:02:55.700828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:03:03.702513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:03:19.705546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:03:51.711641 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:10:19.723886 2.999917 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:10:26.729459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:10:34.730868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:10:50.733694 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:11:22.740079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:15:36.585037 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 17:15:36.585206 0.178236 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:36.763880 0.076119 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:36.840423 0.211957 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:37.052766 0.068747 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:37.121891 0.213200 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:37.335503 0.217364 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:37.553411 0.157928 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:37.711722 0.518129 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:38.230278 0.490536 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:38.721208 0.059888 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:38.781556 0.167041 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:38.949103 0.216833 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.166394 0.081161 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.247997 0.046938 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.295347 0.206279 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.502029 0.186784 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.689278 0.175735 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:39.865460 0.156033 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:40.022002 0.228473 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:40.250877 0.330194 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:40.581510 0.057484 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:40.639519 0.346207 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:40.986119 0.270903 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:41.257527 0.354570 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:41.612496 0.181621 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:41.794529 0.825074 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:42.620069 0.047998 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:42.668556 0.144309 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:42.813297 0.219306 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.033006 0.344358 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.377758 0.062660 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.440832 0.194339 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.635568 0.197038 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.833038 0.116776 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:15:43.950237 0.209364 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:17:26.745367 3.001995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:17:33.753435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:17:41.754906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:17:57.757825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:18:29.763804 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:24:34.771442 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:24:41.778821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:24:49.780191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:25:05.783158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:25:37.789563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:31:13.372393 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 17:31:13.372565 1.304878 tcp 10.0.2.105 63193 -> 200.84.7.244 8038 FSPA* 0 0 14 1682 flow=From-Botnet-V2-TCP-Established 1970/02/23 17:31:44.799837 3.001530 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:31:51.807313 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:31:59.808543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:32:15.811552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:32:47.817793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:38:51.823471 3.001879 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:38:58.830673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:39:06.833126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:39:22.835855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:39:54.842361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:45:58.847791 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:46:01.088583 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 17:46:01.088687 0.000000 udp 10.0.2.105 7010 -> 68.56.221.70 8447 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 17:46:05.855184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:46:13.856196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:46:18.564966 0.032531 tcp 10.0.2.105 63194 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 17:46:18.597759 0.055249 tcp 10.0.2.105 63195 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 17:46:18.653296 0.125730 tcp 10.0.2.105 63196 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/23 17:46:18.779611 0.071030 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:18.851052 0.209920 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:19.061377 0.219788 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:19.281694 0.153216 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:19.435339 0.078028 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:19.513719 0.214623 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:19.728766 0.294264 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.023431 0.423289 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.447119 0.060028 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.507587 0.164377 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.672379 0.220480 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.893291 0.079722 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:20.973541 0.041229 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.015205 0.206719 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.222399 0.186924 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.409868 0.170035 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.580390 0.146395 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.727167 0.230384 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:21.957987 0.329028 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:22.287565 0.055348 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:22.343444 0.350205 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:22.694113 0.173798 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:22.868431 0.346641 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:23.215557 0.350720 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:23.566695 0.313005 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:23.880238 0.056975 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:23.937729 0.144465 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 577 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:24.082664 0.202603 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:24.285735 0.348160 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:24.634276 0.210600 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:24.845305 0.116211 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:24.962027 0.209257 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:25.171697 0.060535 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:25.232966 0.188597 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 17:46:29.859703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:47:01.865427 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:53:05.875759 2.997325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 17:53:12.878928 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:53:20.880597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:53:36.883371 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 17:54:08.889017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:00:12.896677 3.000422 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:00:19.902724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:00:27.904540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:00:43.907416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:01:14.682088 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 18:01:14.682201 1.362167 tcp 10.0.2.105 63197 -> 200.84.7.244 8038 FSPA* 0 0 14 1689 flow=From-Botnet-V2-TCP-Established 1970/02/23 18:01:15.913463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:07:25.928850 3.000708 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:07:33.274872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:07:41.200120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:07:57.058612 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:08:28.955459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:14:32.962535 3.000567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:14:39.969386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:14:47.971009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:15:03.973463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:15:35.979961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:16:45.360355 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 18:16:45.360532 0.178209 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:45.539132 0.226289 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:45.765814 0.067462 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:45.833748 0.217797 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.051954 0.157103 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.209514 0.075447 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.285403 0.212174 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.498071 0.221801 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.720475 0.170567 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:46.891471 0.221613 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.113457 0.088717 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.202539 0.047391 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 251 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.250318 0.206236 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.457074 0.422363 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.879875 0.059725 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:47.940007 0.186478 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:48.126951 0.197712 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:48.325091 0.153373 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:48.478859 0.230487 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:48.709831 0.331203 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:49.041393 0.175965 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:49.217842 0.344147 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:49.562426 0.057964 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:49.620821 0.360323 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:49.981505 0.261147 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:50.243077 0.405827 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:50.649361 0.045564 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:50.695369 0.142842 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:50.838640 0.208054 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.047153 0.116855 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.164443 0.216779 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.381654 0.062421 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.444535 0.348883 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.793855 0.199259 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:16:51.993533 0.191714 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:21:39.985713 3.002171 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:21:46.995369 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:21:54.994850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:22:10.997890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:22:43.003964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:28:49.013646 3.000822 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:28:56.020615 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:29:04.021769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:29:20.024209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:29:52.030836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:31:16.052283 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 18:31:16.052485 1.877878 tcp 10.0.2.105 63198 -> 200.84.7.244 8038 FSPA* 0 0 14 1728 flow=From-Botnet-V2-TCP-Established 1970/02/23 18:35:56.036280 3.005620 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:36:03.044265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:36:11.045627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:36:27.048810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:36:59.055106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:43:03.061326 3.001325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:43:10.068599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:43:18.069800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:43:34.072738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:44:06.079039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:47:04.335337 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 18:47:04.335443 0.067407 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:04.403296 0.211562 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:04.615307 0.176832 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:04.792765 0.253056 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:05.046261 0.203691 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:05.250344 0.350965 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:05.601763 0.152021 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:05.754282 0.075267 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:05.829962 0.170451 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.000892 0.222692 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.224026 0.074597 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.299053 0.041988 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.341628 0.238255 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.580474 0.188185 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:06.769062 0.423084 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:07.192785 0.059338 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:07.252800 0.170927 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:07.424143 0.152757 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:07.577314 0.224492 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:07.802217 0.331307 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:08.134028 0.062783 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:08.197263 0.180928 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:08.378610 0.336087 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:08.715168 0.367271 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:09.082882 0.398529 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:09.481854 0.758196 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:10.240624 0.047225 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:10.288440 0.144476 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:10.433397 0.207710 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:10.641550 0.116534 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:10.758470 0.347886 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:11.106859 0.210045 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:11.317391 0.209664 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:11.527515 0.062627 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:47:11.590564 0.181243 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/23 18:55:39.087866 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 18:55:46.095182 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:55:54.096536 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:56:10.099608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 18:56:42.105863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:01:17.933140 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 19:01:17.933297 1.325128 tcp 10.0.2.105 63199 -> 200.84.7.244 8038 FSPA* 0 0 14 1566 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:02:46.111310 3.002131 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:02:53.119064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:03:01.121222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:03:17.123419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:03:49.129816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:10:17.141735 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:10:24.147824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:10:32.149378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:10:48.152382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:11:20.160123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:17:24.163964 3.001877 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:17:29.769999 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 19:17:29.770129 0.179046 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:29.949681 0.230848 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:30.180921 0.209197 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:30.390589 0.067609 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:30.458703 0.212304 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:30.671393 0.677748 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:31.171778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:17:31.349652 0.156770 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:31.506861 0.079269 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:31.586541 0.176546 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:31.763461 0.220490 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:31.984587 0.086878 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.071872 0.187330 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.259593 0.421364 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.681334 0.059695 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.741436 0.040797 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.782760 0.207397 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:32.990637 0.176529 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:33.167597 0.153418 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:33.321512 0.234196 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:33.556109 0.331996 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:33.888547 0.053991 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:33.943064 0.379528 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:34.323039 0.181439 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:34.504862 0.339606 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:34.844882 0.049939 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:34.895369 0.247343 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:35.143124 0.306265 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:35.449775 0.143054 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:35.593340 0.208073 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:35.801875 0.116402 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:35.918772 0.348766 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:36.267947 0.065458 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:36.333796 0.181895 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:36.516426 0.184915 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:36.701847 0.210190 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:17:39.173276 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:17:55.176018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:18:27.182118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:24:31.187745 3.001987 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:24:38.195706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:24:46.197054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:25:02.200540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:25:34.205997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:31:19.262906 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 19:31:19.263094 0.218909 tcp 10.0.2.105 63200 -> 200.84.7.244 8038 SPA_* 0 0 9 1192 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:31:41.216457 3.001731 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:31:48.223884 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:31:49.477328 0.032088 tcp 10.0.2.105 63201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:31:49.509712 0.053792 tcp 10.0.2.105 63202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:31:49.563881 0.126687 tcp 10.0.2.105 63203 -> 195.113.214.249 443 SRPA* 0 0 30 21698 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:31:49.700418 0.010386 tcp 10.0.2.105 63200 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:31:49.711028 2.999169 tcp 10.0.2.105 63204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:31:56.225544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:31:58.708794 0.000000 tcp 10.0.2.105 63204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:32:04.708132 0.031496 tcp 10.0.2.105 63205 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:04.740041 0.054763 tcp 10.0.2.105 63206 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:04.795175 0.104057 tcp 10.0.2.105 63207 -> 195.113.214.249 443 SRPA* 0 0 47 31179 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:04.931339 3.001011 tcp 10.0.2.105 63208 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:32:12.228359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:32:13.930754 0.000000 tcp 10.0.2.105 63208 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:32:19.930279 0.032158 tcp 10.0.2.105 63209 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:19.962743 0.032473 tcp 10.0.2.105 63210 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:19.995505 0.124846 tcp 10.0.2.105 63211 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:20.138413 2.995729 tcp 10.0.2.105 63212 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:32:29.144698 0.000000 tcp 10.0.2.105 63212 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 19:32:35.131815 0.054834 tcp 10.0.2.105 63213 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:35.186949 0.032470 tcp 10.0.2.105 63214 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:35.219679 0.165890 tcp 10.0.2.105 63215 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:35.435699 1.397201 tcp 10.0.2.105 63216 -> 200.84.7.244 8038 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/23 19:32:44.239470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:38:48.240785 3.007182 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:38:55.249088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:39:03.249494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:39:19.253083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:39:51.258421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:45:55.264514 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:46:02.271727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:46:10.273337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:46:26.276344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:46:58.282390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:48:01.763684 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 19:48:01.763904 0.209273 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:01.973588 0.074333 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:02.048341 0.211504 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:02.260353 0.174143 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:02.434843 0.230117 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:02.665318 0.617721 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:03.283517 0.184814 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:03.468720 0.074866 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:03.543970 0.159783 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:03.704152 0.223409 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:03.928059 0.081769 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.010337 0.187740 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.198572 0.422433 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.621503 0.059620 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.681491 0.046885 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.728757 0.259477 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:04.988734 0.171995 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:05.161100 0.151564 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:05.313052 0.229821 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:05.543298 0.366115 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:05.909796 0.181041 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:06.091252 0.346976 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:06.438618 0.044233 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:06.483293 0.335245 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:06.818963 0.056318 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:06.875651 0.231319 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:07.107351 0.493292 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:07.601067 0.142755 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:07.744177 0.221111 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:07.965684 0.116904 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:08.082997 0.349168 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:08.432556 0.059135 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:08.492090 0.208015 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:08.700549 0.180610 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:48:08.881604 0.198511 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/23 19:53:02.293642 2.996484 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 19:53:09.295711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:53:17.297302 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:53:33.300560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 19:54:05.306623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:00:09.313176 3.000784 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:00:16.319682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:00:24.321328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:00:40.323902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:01:12.330328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:02:37.044951 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 20:02:37.045092 1.373875 tcp 10.0.2.105 63217 -> 200.84.7.244 8038 FSPA* 0 0 14 1500 flow=From-Botnet-V2-TCP-Established 1970/02/23 20:07:19.350931 3.001639 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:07:26.358245 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:07:34.359393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:07:50.362837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:08:22.368757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:14:26.375276 3.001352 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:14:33.382224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:14:41.383629 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:14:57.386701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:15:29.392706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:18:15.101014 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 20:18:15.101189 0.221549 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:15.323134 0.207845 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:15.531381 0.069334 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:15.601224 0.244651 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:15.846233 0.172158 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.018848 0.229342 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.248603 0.186979 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.436066 0.072678 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.509147 0.157313 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.666950 0.222856 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.890248 0.082124 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:16.972764 0.186421 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:17.159703 0.041594 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:17.201770 0.220675 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:17.422836 0.426236 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:17.849455 0.053377 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:17.903206 0.176049 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:18.079731 0.153213 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:18.233461 0.222805 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:18.456747 0.349120 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:18.806295 0.043734 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:18.850431 0.336703 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:19.187565 0.057574 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:19.245585 0.177845 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:19.423874 0.343279 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:19.767633 0.214863 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:19.982915 0.849632 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:20.832944 0.143399 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:20.976739 0.349842 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:21.327018 0.060206 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:21.387626 0.210232 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:21.598316 0.202683 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:21.801477 0.116602 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:21.918501 0.200352 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:18:22.119308 0.199246 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:21:33.399382 3.000786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:21:40.405942 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:21:48.407508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:22:04.410817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:22:36.416960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:28:40.422545 3.001454 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:28:47.430017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:28:55.431625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:29:11.434048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:29:43.440389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:32:38.232743 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 20:32:38.232978 1.316422 tcp 10.0.2.105 63218 -> 200.84.7.244 8038 FSPA* 0 0 14 1634 flow=From-Botnet-V2-TCP-Established 1970/02/23 20:35:47.447170 3.001291 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:35:54.453853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:36:02.455432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:36:18.458798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:36:50.464854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:42:54.471582 3.000889 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:43:01.477752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:43:09.479718 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:43:25.482630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:43:57.488714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:48:24.663066 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 20:48:24.663243 0.072050 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:24.735778 0.385766 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:25.121986 0.176893 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:25.299276 0.218887 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:25.518617 0.208755 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:25.727704 0.224783 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:25.952953 0.172588 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.125971 0.077432 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.203979 0.157888 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.362271 0.222087 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.584883 0.081726 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.667030 0.206829 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:26.874302 0.444852 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.319571 0.053489 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.373530 0.170437 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.544607 0.187043 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.732078 0.048145 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.780749 0.153135 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:27.934392 0.230719 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:28.165541 0.355412 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:28.521400 0.060481 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:28.582274 0.180860 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:28.763543 0.344048 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:29.107957 0.213275 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:29.321703 0.348932 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:29.671130 0.055250 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:29.726864 0.692441 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:30.419703 0.144805 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:30.564974 0.343749 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:30.909160 0.061602 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:30.971199 0.208984 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 212 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:31.180837 0.202616 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:31.383917 0.116306 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:31.500684 0.182655 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:48:31.683792 0.199639 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 20:55:37.497504 3.001673 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 20:55:44.505211 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:55:52.506750 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:56:08.509663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 20:56:40.515602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:02:39.552421 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 21:02:39.552618 1.327047 tcp 10.0.2.105 63219 -> 200.84.7.244 8038 FSPA* 0 0 14 1718 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:02:44.521516 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:02:51.531102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:02:59.531099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:03:15.533458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:03:47.539622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:10:16.552588 3.000737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:10:23.558910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:10:31.560153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:10:48.969607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:11:20.573707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:17:23.585309 3.001803 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:17:30.592745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:17:38.594437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:17:54.597614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:18:26.603521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:18:37.859864 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 21:18:37.860043 0.072841 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:37.933280 0.239588 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:38.173303 0.208173 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:38.381911 0.163310 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:38.545685 0.205199 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:38.751319 0.228836 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:38.980647 0.156338 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:39.137475 0.079736 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:39.217602 0.159252 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:39.377270 0.222403 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:39.600109 0.434694 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.035237 0.060219 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.095902 0.092669 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.189130 0.206633 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.396351 0.178264 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.575035 0.187656 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.763081 0.048467 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.811975 0.152812 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:40.965180 0.042367 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:41.008026 0.180607 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:41.189055 0.230891 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 576 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:41.420376 0.342980 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:41.763742 0.342320 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:42.106500 0.211685 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:42.318635 0.329031 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:42.648058 0.055013 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:42.703444 0.317721 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.021557 0.144406 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.166358 0.347625 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.514467 0.059734 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.574648 0.116526 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.691561 0.180760 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:43.872784 0.197186 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:44.070399 0.223908 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:18:44.294761 0.207721 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:24:30.610564 3.000535 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:24:37.616875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:24:45.618347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:25:01.621549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:25:33.627334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:31:37.633764 3.001972 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:31:44.640734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:31:52.642634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:32:08.645501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:32:40.651460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:32:40.881908 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 21:32:40.882099 0.225500 tcp 10.0.2.105 63220 -> 200.84.7.244 8038 SPA_* 0 0 9 1147 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:33:00.561014 0.001864 tcp 10.0.2.105 63220 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:38:44.658465 3.000717 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:38:51.665012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:38:59.666070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:39:15.669410 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:39:47.675336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:45:51.681705 3.001044 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 21:45:58.688791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:46:06.690060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:46:22.692923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:46:54.699319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:49:13.409214 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 21:49:13.409327 0.511922 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:13.921659 0.164609 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:14.086635 0.225317 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:14.312380 0.226060 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:14.538910 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 21:49:32.688457 0.032983 tcp 10.0.2.105 63221 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:32.721711 0.032890 tcp 10.0.2.105 63222 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:32.754925 0.127395 tcp 10.0.2.105 63223 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:32.883112 0.208492 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:33.092095 0.156271 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:33.248909 0.079928 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:33.329244 0.159866 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:33.489583 0.215306 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:33.705291 0.425999 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.131819 0.060037 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.192455 0.077178 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.270029 0.207914 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.478329 0.273576 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.752405 0.189285 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.942120 0.047525 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:34.990093 0.166742 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:35.157256 0.050127 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:35.207769 0.344418 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:35.552636 0.344816 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:35.897914 0.181359 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:36.079763 0.228730 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:36.309005 0.059828 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:36.369260 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 21:49:54.308259 0.054795 tcp 10.0.2.105 63224 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:54.363384 0.032715 tcp 10.0.2.105 63225 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:54.396484 0.128040 tcp 10.0.2.105 63226 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/23 21:49:54.525008 0.207076 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:54.732580 0.375397 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.108562 0.142680 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.251748 0.344319 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.596469 0.061351 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.658251 0.116973 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.775681 0.186610 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:55.962669 0.196814 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:56.159905 0.205448 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:49:56.365747 0.208947 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/23 21:57:06.713121 3.000409 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 21:57:13.719290 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:57:21.720687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:57:37.723707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 21:58:09.729864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:03:00.568682 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 22:03:00.568871 1.368321 tcp 10.0.2.105 63227 -> 200.84.7.244 8038 FSPA* 0 0 14 1497 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:04:13.735996 3.001627 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:04:20.743340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:04:28.744507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:04:44.747793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:05:16.753480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:11:20.759663 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:11:27.768115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:11:35.768863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:11:51.771471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:12:23.779129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:18:27.784361 3.001088 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:18:34.791140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:18:42.792683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:18:58.795661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:19:30.802992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:19:56.599280 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 22:19:56.599401 0.423314 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:57.023123 0.566907 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:57.590393 0.223542 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:57.814452 0.163781 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:57.978646 0.068009 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.047084 0.229578 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.277101 0.074278 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.351771 0.160769 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.512937 0.150060 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.663386 0.209463 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.873338 0.059783 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:58.933530 0.076087 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:59.010102 0.426432 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:59.437148 0.219621 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:59.657189 0.186421 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:59.844075 0.041617 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:19:59.886199 0.206932 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:00.093581 0.176547 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:00.270569 0.047628 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:00.318604 0.153976 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:00.473029 0.344502 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:00.817954 0.341351 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:01.159721 0.180301 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:01.340519 0.248821 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:01.589725 0.059400 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:01.649578 0.211759 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:01.861807 0.497986 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:02.360206 0.144243 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:02.504933 0.348908 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:02.854306 0.064525 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:02.919250 0.210293 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:03.129964 0.117392 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:03.247794 0.189173 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:03.437383 0.209586 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:20:03.647445 0.208451 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:25:34.808662 3.000737 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:25:41.815309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:25:49.816820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:26:05.819586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:26:37.825810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:32:41.831284 3.002613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:32:48.839518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:32:56.840604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:33:01.938529 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 22:33:01.938641 0.220835 tcp 10.0.2.105 63228 -> 200.84.7.244 8038 SPA_* 0 0 9 1161 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:12.843624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:33:32.166534 0.055275 tcp 10.0.2.105 63229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:32.222093 0.032832 tcp 10.0.2.105 63230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:32.255215 0.151962 tcp 10.0.2.105 63231 -> 195.113.214.249 443 SRPA* 0 0 35 18828 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:32.378096 0.059439 tcp 10.0.2.105 63228 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:32.437814 2.998120 tcp 10.0.2.105 63232 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:33:41.434733 0.000000 tcp 10.0.2.105 63232 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:33:44.849429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:33:47.433871 0.031163 tcp 10.0.2.105 63233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:47.465365 0.055851 tcp 10.0.2.105 63234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:47.521470 0.125053 tcp 10.0.2.105 63235 -> 195.113.214.249 443 SRPA* 0 0 33 19386 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:33:48.481816 2.997109 tcp 10.0.2.105 63236 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:33:57.477829 0.000000 tcp 10.0.2.105 63236 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:34:03.476599 0.053673 tcp 10.0.2.105 63237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:03.530537 0.032463 tcp 10.0.2.105 63238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:03.563284 0.122578 tcp 10.0.2.105 63239 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:03.886598 3.004536 tcp 10.0.2.105 63240 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:34:14.254233 0.000000 tcp 10.0.2.105 63240 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 22:34:20.169450 0.032443 tcp 10.0.2.105 63241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:20.202192 0.032551 tcp 10.0.2.105 63242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:20.235029 0.128128 tcp 10.0.2.105 63243 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:34:20.381906 1.430807 tcp 10.0.2.105 63244 -> 200.84.7.244 8038 FSPA* 0 0 15 1722 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:39:48.856123 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 22:39:55.862957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:40:03.864544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:40:19.867362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:40:51.873509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:46:55.879657 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:47:02.887115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:47:10.888786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:47:26.891543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:47:58.897601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:50:18.949407 0.000125 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 22:50:18.949632 0.630057 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:19.580139 0.165029 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:19.745562 0.074747 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:19.820663 0.063568 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:19.884683 0.226367 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.111416 0.228848 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.340743 0.073005 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.414159 0.159970 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.574488 0.156357 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.731354 0.211171 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.942957 0.053473 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:20.996891 0.081280 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:21.078599 0.187239 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:21.266303 0.041269 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:21.307966 0.220668 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:21.529042 0.428164 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:21.957635 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 137 flow=From-Botnet-V2-UDP-Attempt 1970/02/23 22:50:40.331731 0.054861 tcp 10.0.2.105 63245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:50:40.386914 0.055816 tcp 10.0.2.105 63246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:50:40.443000 0.145448 tcp 10.0.2.105 63247 -> 195.113.214.249 443 SRPA* 0 0 35 17568 flow=From-Botnet-V2-TCP-Established 1970/02/23 22:50:40.589278 0.169019 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:40.758659 0.053058 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:40.812110 0.152903 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:40.965442 0.368748 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:41.334626 0.230042 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:41.565185 0.058154 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:41.623716 0.213449 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:41.837533 0.340360 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:42.178241 0.179511 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:42.358096 0.332305 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:42.690809 0.137631 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:42.828892 0.343538 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:43.172844 0.059661 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:43.232890 0.182977 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:43.416277 0.216610 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:43.633307 0.203099 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:43.836833 0.198018 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:50:44.035372 0.116463 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/23 22:54:02.904727 3.000338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 22:54:09.910974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:54:17.912653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:54:33.915724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 22:55:05.921518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:01:09.927601 3.002201 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:01:16.935196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:01:24.935787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:01:40.941459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:02:12.945378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:04:20.539387 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:04:20.539484 1.395232 tcp 10.0.2.105 63248 -> 200.84.7.244 8038 FSPA* 0 0 14 1536 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:08:16.991379 3.001154 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:08:23.998908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:08:32.000691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:08:48.003468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:09:20.009097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:15:24.015509 3.215279 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:15:31.202133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:15:39.128378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:15:55.537418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:16:27.160529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:21:10.301312 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:21:10.301483 0.216108 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:10.518066 0.077896 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:10.596367 0.478428 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.075256 0.210501 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.286148 0.241293 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.527855 0.157281 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.685527 0.078555 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.764630 0.160088 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:11.925112 0.229930 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.155421 0.156934 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.312797 0.187418 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.500691 0.047733 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.548897 0.221052 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.770364 0.079272 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.850048 0.053946 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:12.904622 0.203223 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:13.108501 0.426548 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:13.535473 0.175645 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:13.711541 0.054723 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:13.766650 0.164141 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:13.931296 0.343001 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:14.274766 0.212263 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:14.487458 0.340170 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:14.828058 0.265197 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.093696 0.056837 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.151049 0.181182 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.332672 0.322877 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.655956 0.142340 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.798826 0.182612 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:15.981958 0.347959 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:16.330384 0.064501 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:16.395393 0.193941 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:16.589735 0.116472 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:16.706620 0.210638 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:21:16.917743 0.208432 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:22:31.058890 3.002079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:22:38.066888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:22:46.068482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:23:02.071367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:23:34.077253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:29:38.083391 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:29:45.090772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:29:53.092485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:30:09.095559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:30:41.101345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:34:21.979442 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:34:21.979555 0.730923 tcp 10.0.2.105 63249 -> 200.84.7.244 8038 FSPA* 0 0 13 1255 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:22.422036 0.056141 tcp 10.0.2.105 63250 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:22.478473 0.055018 tcp 10.0.2.105 63251 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:22.533871 0.140612 tcp 10.0.2.105 63252 -> 195.113.214.249 443 SRPA* 0 0 24 14054 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:22.710765 2.993383 tcp 10.0.2.105 63253 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:34:31.712913 0.000000 tcp 10.0.2.105 63253 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:34:37.711904 0.054056 tcp 10.0.2.105 63254 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:37.766227 0.055757 tcp 10.0.2.105 63255 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:37.822288 0.133056 tcp 10.0.2.105 63256 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:38.005489 3.000966 tcp 10.0.2.105 63257 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:34:47.004844 0.000000 tcp 10.0.2.105 63257 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:34:53.004225 0.031670 tcp 10.0.2.105 63258 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:53.036126 0.054763 tcp 10.0.2.105 63259 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:53.091162 0.147832 tcp 10.0.2.105 63260 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:34:53.322321 3.144505 tcp 10.0.2.105 63261 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:02.404355 0.000000 tcp 10.0.2.105 63261 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:08.362365 0.100441 tcp 10.0.2.105 63262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:35:08.463083 0.032688 tcp 10.0.2.105 63263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:35:08.496074 0.129367 tcp 10.0.2.105 63264 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:35:08.700092 0.426398 tcp 10.0.2.105 63265 -> 200.84.7.244 8038 FSPA* 0 0 13 1255 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:35:09.126736 2.973055 tcp 10.0.2.105 63266 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:18.059472 0.000000 tcp 10.0.2.105 63266 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:24.058488 3.004318 tcp 10.0.2.105 63267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:33.061011 0.000000 tcp 10.0.2.105 63267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:37.697698 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:35:39.059814 2.993857 tcp 10.0.2.105 63268 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:35:48.062965 0.000000 tcp 10.0.2.105 63268 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:36:45.107553 3.003393 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 23:36:52.114939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:37:00.116854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:37:16.119365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:37:48.125507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:40:54.063494 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:40:54.063622 3.003311 tcp 10.0.2.105 63269 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:03.065713 0.000000 tcp 10.0.2.105 63269 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:09.066082 0.055008 tcp 10.0.2.105 63270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:09.121413 0.055619 tcp 10.0.2.105 63271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:09.177378 0.145530 tcp 10.0.2.105 63272 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:09.412130 2.997020 tcp 10.0.2.105 63273 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:18.407488 0.000000 tcp 10.0.2.105 63273 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:24.407331 0.033707 tcp 10.0.2.105 63274 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:24.441307 0.032734 tcp 10.0.2.105 63275 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:24.474416 0.126072 tcp 10.0.2.105 63276 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:24.637404 3.003493 tcp 10.0.2.105 63277 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:33.639572 0.000000 tcp 10.0.2.105 63277 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/23 23:41:39.639281 0.031835 tcp 10.0.2.105 63278 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:39.671471 0.054509 tcp 10.0.2.105 63279 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:39.726347 0.142214 tcp 10.0.2.105 63280 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:41:39.958458 1.361284 tcp 10.0.2.105 63281 -> 200.84.7.244 8038 FSPA* 0 0 14 1651 flow=From-Botnet-V2-TCP-Established 1970/02/23 23:43:52.131458 3.001661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/23 23:43:59.138705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:44:07.140331 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:44:23.143491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:44:55.149367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:51:28.275103 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/23 23:51:28.275211 0.425233 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:28.679021 0.231582 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:28.903131 0.112978 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:29.029663 0.227557 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:29.252625 0.587069 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:29.780481 0.174541 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:29.975148 0.095710 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:30.048888 0.187636 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:30.257803 0.267794 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:30.491282 0.068216 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:30.630875 0.213199 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:30.883484 0.117822 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:31.198489 0.063569 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:31.260370 0.219573 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:31.471955 0.186401 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:31.630312 0.197395 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:31.820589 0.449480 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:32.247576 0.173849 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:32.418286 0.087848 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:32.606867 0.189469 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2555 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:32.787962 0.357659 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:33.135932 0.241232 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:33.369275 0.076002 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:33.532482 0.355666 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:33.996131 0.230624 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:34.204132 0.187071 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:34.378648 0.363918 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2496 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:34.713016 0.155238 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:34.878313 0.192995 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:35.081248 0.235643 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:35.294154 0.117197 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:35.423512 0.222098 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:35.642417 0.226617 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:35.865787 0.352728 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:51:36.214847 0.063685 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/23 23:56:08.161937 2.999349 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/23 23:56:15.167063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:56:23.168871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:56:39.171477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/23 23:57:11.177489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:03:15.183567 3.002020 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:03:22.191041 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:03:30.192726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:03:46.195320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:04:18.201665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:10:35.216934 3.000986 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:10:42.223649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:10:50.225314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:11:06.228192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:11:38.234366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:11:41.319255 0.000290 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 00:11:41.319654 0.217378 tcp 10.0.2.105 63282 -> 200.84.7.244 8038 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:11:51.752048 0.320885 tcp 10.0.2.105 63282 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:11:51.754354 0.055467 tcp 10.0.2.105 63283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:11:51.810126 0.055181 tcp 10.0.2.105 63284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:11:51.865611 0.153034 tcp 10.0.2.105 63285 -> 195.113.214.249 443 SRPA* 0 0 41 35412 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:11:52.073235 3.005346 tcp 10.0.2.105 63286 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:01.077015 0.000000 tcp 10.0.2.105 63286 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:07.066115 0.640800 tcp 10.0.2.105 63287 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:07.707219 0.053917 tcp 10.0.2.105 63288 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:07.761436 0.152392 tcp 10.0.2.105 63289 -> 195.113.214.249 443 SRPA* 0 0 30 20844 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:08.104138 2.962576 tcp 10.0.2.105 63290 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:16.987202 0.000000 tcp 10.0.2.105 63290 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:22.912798 0.036149 tcp 10.0.2.105 63291 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:22.949210 0.055089 tcp 10.0.2.105 63292 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:23.004608 0.152289 tcp 10.0.2.105 63293 -> 195.113.214.249 443 SRPA* 0 0 22 11024 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:23.221404 2.965326 tcp 10.0.2.105 63294 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:32.116037 0.000000 tcp 10.0.2.105 63294 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 00:12:38.043873 0.055175 tcp 10.0.2.105 63295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:38.099359 0.054592 tcp 10.0.2.105 63296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:38.154243 0.146210 tcp 10.0.2.105 63297 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:38.329893 0.216070 tcp 10.0.2.105 63298 -> 200.84.7.244 8038 SPA_* 0 0 9 1119 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:12:47.370599 0.027003 tcp 10.0.2.105 63298 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:17:42.240569 3.001124 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 00:17:49.247815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:17:57.249347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:18:13.252664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:18:45.258141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:22:04.314421 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 00:22:04.314596 0.855108 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:05.170070 0.210720 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:05.381227 0.222077 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:05.603732 0.072131 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:05.676250 0.077528 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:05.754181 0.452890 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.207561 0.164812 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.372764 0.160041 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.533261 0.223553 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.757244 0.041747 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.799369 0.060984 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:06.860734 0.207923 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:07.069048 0.077526 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:07.147002 0.187089 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:07.334445 0.209457 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:07.544371 0.151153 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:07.695969 0.423991 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.120375 0.170651 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.291413 0.056609 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.348402 0.224420 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.573226 0.052516 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.626109 0.153295 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:08.779764 0.351172 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:09.131288 0.348041 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:09.479698 0.372258 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:09.852339 0.213872 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.066689 0.182387 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.249493 0.143863 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.393760 0.197919 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.592137 0.212971 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.805507 0.116273 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:10.922225 0.217029 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:11.139644 0.208334 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:11.348349 0.349354 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:22:11.698043 0.060370 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:24:49.274476 3.002526 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:24:56.281619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:25:04.282853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:25:20.285812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:25:52.292655 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:31:56.297831 3.001956 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:32:03.305705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:32:11.306607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:32:27.310077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:33:00.319797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:39:03.331936 3.001913 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:39:10.339485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:39:18.340859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:39:34.343910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:40:06.350003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:42:47.312020 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 00:42:47.312187 1.279629 tcp 10.0.2.105 63299 -> 200.84.7.244 8038 FSPA* 0 0 14 1747 flow=From-Botnet-V2-TCP-Established 1970/02/24 00:46:10.356409 3.001302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:46:17.363106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:46:25.364955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:46:41.367943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:47:13.374063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:52:38.672167 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 00:52:38.672262 0.069048 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:38.741771 0.072229 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:38.814407 0.077740 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:38.892588 0.217417 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:39.110420 0.220748 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:39.331593 0.539389 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:39.871481 0.157635 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.029514 0.160418 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.190392 0.223830 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 218 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.414609 0.041095 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 214 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.456161 0.059683 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.516379 0.207698 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.724554 0.080751 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.805712 0.156346 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:40.962475 0.424252 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:41.387157 0.187151 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:41.574770 0.207985 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:41.783224 0.197470 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:41.981124 0.049466 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:42.031010 0.231125 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:42.262566 0.059128 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:42.322240 0.153123 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:42.475866 0.339501 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:42.815794 0.211969 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:43.028183 0.350232 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:43.378949 0.330959 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:43.710267 0.182240 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:43.892951 0.143732 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.037094 0.187520 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.225119 0.196807 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.422328 0.116361 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.539125 0.283898 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.823425 0.063612 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:44.887538 0.209177 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:52:45.097187 0.349528 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/24 00:53:17.379983 3.001905 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 00:53:24.387295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:53:32.389184 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:53:48.391993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 00:54:20.398196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:00:24.414410 3.001255 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:00:31.421706 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:00:39.423135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:00:55.425960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:01:27.431864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:07:31.439409 3.000217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:07:38.445535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:07:46.446956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:08:02.449792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:08:34.456095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:12:48.602170 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 01:12:48.602317 0.221193 tcp 10.0.2.105 63300 -> 200.84.7.244 8038 SPA_* 0 0 9 1037 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:12:54.491478 0.056348 tcp 10.0.2.105 63300 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:14:38.461815 3.001963 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:14:45.469506 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:14:53.470791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:15:09.473939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:15:41.480070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:21:45.486078 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:21:52.493195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:22:00.494812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:22:16.497852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:22:46.931284 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 01:22:46.931438 0.076685 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:47.008629 0.224353 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:47.233324 0.586685 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:47.820400 0.073203 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:47.893992 0.215488 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.109906 0.288367 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.398705 0.158948 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.504266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:22:48.558047 0.160952 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.719456 0.226143 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.945979 0.048223 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:48.994593 0.056882 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:49.051857 0.155482 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:49.207713 0.207613 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:49.415810 0.088200 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:49.504596 0.208242 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:49.713211 0.425279 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.138932 0.188827 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.328121 0.175967 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.504593 0.044354 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.549395 0.242623 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.792454 0.058472 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:50.851367 0.155250 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:51.007017 0.472107 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:51.479512 0.212598 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:22:51.692604 0.000000 udp 10.0.2.105 7010 -> 99.116.154.145 1056 INT 0 1 100 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 01:23:08.734446 0.056633 tcp 10.0.2.105 63301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:23:08.790888 0.056486 tcp 10.0.2.105 63302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:23:08.847210 0.170665 tcp 10.0.2.105 63303 -> 195.113.214.249 443 SRPA* 0 0 42 35202 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:23:09.018508 0.366203 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:09.385187 0.329654 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:09.715282 0.143684 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:09.859421 0.188750 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.048824 0.208721 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.257949 0.116934 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.375353 0.220747 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.596479 0.210351 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.807314 0.063160 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:23:10.870947 0.347606 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:28:52.509726 3.001890 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:28:59.517453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:29:07.518789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:29:23.521785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:29:55.528118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:35:59.537066 2.998568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:36:06.541218 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:36:14.542882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:36:30.545799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:37:02.551989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:42:54.548595 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 01:42:54.548700 1.313433 tcp 10.0.2.105 63304 -> 200.84.7.244 8038 FSPA* 0 0 14 1618 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:43:06.558401 3.001170 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 01:43:13.565315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:43:21.566890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:43:37.569910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:44:09.575813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:53:21.379214 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 01:53:21.379398 0.180637 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:21.560445 0.076046 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:21.636924 0.073619 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:21.710991 0.221554 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:21.933041 0.000000 udp 10.0.2.105 7010 -> 162.239.137.12 5604 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 01:53:38.975864 0.055280 tcp 10.0.2.105 63305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:39.031448 0.054911 tcp 10.0.2.105 63306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:39.086612 0.157858 tcp 10.0.2.105 63307 -> 195.113.214.249 443 SRPA* 0 0 35 18456 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:39.244918 0.740914 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:39.986196 0.381661 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:40.368266 0.228663 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:40.597356 0.041960 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:40.639775 0.060318 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:40.700682 0.162322 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:40.863444 0.156244 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:41.020146 0.081852 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:41.102450 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 01:53:58.733656 0.055908 tcp 10.0.2.105 63308 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:58.789901 0.055159 tcp 10.0.2.105 63309 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:58.845380 0.214770 tcp 10.0.2.105 63310 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:53:59.060759 0.425147 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:59.486274 0.156045 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:59.642762 0.220342 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:59.863487 0.053100 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:53:59.916985 0.293829 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:00.211287 0.057924 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:00.269718 0.152844 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:00.422955 0.175557 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:00.599017 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 210 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 01:54:17.831653 0.054991 tcp 10.0.2.105 63311 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:54:17.886959 0.055273 tcp 10.0.2.105 63312 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:54:17.942099 0.148859 tcp 10.0.2.105 63313 -> 195.113.214.249 443 SRPA* 0 0 22 11858 flow=From-Botnet-V2-TCP-Established 1970/02/24 01:54:18.091494 0.213048 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:18.305002 0.473183 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:18.778640 0.143287 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:18.922323 0.182721 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:19.105491 0.355780 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:19.461693 0.365366 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:19.827494 0.197631 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:20.025621 0.117124 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:20.143134 0.208325 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:20.351948 0.210674 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:20.563093 0.062826 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:54:20.626329 0.348587 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/24 01:55:42.584670 3.001866 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 01:55:49.592367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:55:57.593818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:56:13.596777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 01:56:45.605824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:02:49.608815 3.001916 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:02:56.616332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:03:04.617886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:03:20.620785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:03:52.626967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:10:19.637673 3.000087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:10:26.643123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:10:34.644593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:10:50.647964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:11:22.653687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:12:55.868551 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 02:12:55.868692 0.214354 tcp 10.0.2.105 63314 -> 200.84.7.244 8038 SPA_* 0 0 9 1039 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:13:01.530946 0.195475 tcp 10.0.2.105 63314 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:17:26.659268 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:17:33.667172 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:17:41.668854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:17:57.671793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:18:29.677803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:24:33.684187 3.000923 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:24:40.691070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:24:48.692716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:24:49.103759 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 02:24:49.103882 0.209322 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:49.313668 0.211303 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:49.525373 0.188755 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:49.714513 0.071267 udp 10.0.2.105 7010 <-> 86.183.156.3 6503 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:49.786182 0.181670 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:49.968318 0.075223 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:50.043999 0.222477 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:50.266942 0.828887 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.096309 0.321732 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.418476 0.060094 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.479025 0.078585 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.558086 0.067028 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.625556 0.226649 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:51.852617 0.162924 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:52.015979 0.162137 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:52.178501 0.159345 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:52.338288 0.418954 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:52.757661 0.228339 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:52.986387 0.061633 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.048477 0.151990 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.200876 0.043767 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.245098 0.207759 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.453323 0.176180 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.629905 0.212619 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:53.842966 0.186625 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:54.030041 0.346547 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:54.377025 0.143052 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:54.520666 0.365597 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:54.886698 0.326969 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:55.214146 0.208360 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:55.422999 0.210678 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:55.634063 0.116425 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:55.750945 0.348451 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:56.099767 0.210278 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:24:56.310493 0.060285 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:25:04.695494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:25:36.701991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:31:40.707695 3.001606 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:31:47.715099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:31:55.716691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:32:11.719608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:32:43.725335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:38:47.731758 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:38:54.739306 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:39:02.740558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:39:18.743520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:39:50.769563 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:43:01.734742 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 02:43:01.734903 1.369167 tcp 10.0.2.105 63315 -> 200.84.7.244 8038 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:45:54.776972 3.000426 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:46:01.783905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:46:09.784481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:46:25.787417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:46:57.799898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:53:01.799445 3.001893 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 02:53:08.806890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:53:16.808795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:53:32.811723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:54:04.817569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 02:55:20.777106 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 02:55:20.777273 0.188277 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:20.965928 0.000000 udp 10.0.2.105 7010 -> 86.183.156.3 6503 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 02:55:36.801740 0.055173 tcp 10.0.2.105 63316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:55:36.857271 0.055695 tcp 10.0.2.105 63317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:55:36.913250 0.148270 tcp 10.0.2.105 63318 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 02:55:37.062059 0.180927 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:37.243494 0.076991 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:37.320847 0.222535 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:37.543867 0.207430 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:37.751674 0.221733 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:37.973796 0.867135 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:38.841389 0.085356 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:38.927148 0.078517 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.006029 0.227101 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.233468 0.163431 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.397245 0.161178 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.558780 0.231829 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.790980 0.053486 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:39.844843 0.155073 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:40.000510 0.423418 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:40.424275 0.231110 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:40.655831 0.058402 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:40.714607 0.202109 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:40.917118 0.177151 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:41.094629 0.213804 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:41.308887 0.187888 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:41.497070 0.152919 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:41.650397 0.051233 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:41.701997 0.971578 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:42.674015 0.144064 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:42.818446 0.366359 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:43.185226 0.196930 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:43.382551 0.116425 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:43.499393 0.347885 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:43.847730 0.372303 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:46.926684 0.210426 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 591 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:47.137492 0.254469 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/24 02:55:47.392448 0.059072 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:00:08.834638 3.000687 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:00:15.841049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:00:23.842493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:00:39.845762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:01:11.851458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:07:20.864518 3.002107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:07:27.872134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:07:35.873786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:07:51.876784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:08:23.883475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:13:03.104853 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 03:13:03.104971 0.219820 tcp 10.0.2.105 63319 -> 200.84.7.244 8038 SPA_* 0 0 9 1025 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:13:10.101791 0.105411 tcp 10.0.2.105 63319 -> 200.84.7.244 8038 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:14:27.888415 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:14:34.896510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:14:42.897662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:14:58.900824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:15:30.906968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:21:34.914356 3.000116 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:21:41.920054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:21:49.921778 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:22:05.924616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:22:37.930550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:25:56.696537 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 03:25:56.696709 0.000000 udp 10.0.2.105 7010 -> 86.183.156.3 6503 INT 0 1 99 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 03:26:13.565667 0.054780 tcp 10.0.2.105 63320 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:26:13.620739 0.056755 tcp 10.0.2.105 63321 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:26:13.677872 0.146265 tcp 10.0.2.105 63322 -> 195.113.214.249 443 SRPA* 0 0 41 21288 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:26:13.824761 0.187524 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.012840 0.210240 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.223583 0.179643 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.403677 0.067623 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.471697 0.209710 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.681896 0.221350 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:14.903757 0.154365 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.058551 0.080884 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.139850 0.041899 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.182220 0.160033 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.342602 0.229329 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.572427 0.164615 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.737477 0.154512 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:15.892542 0.383378 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:16.276576 0.054136 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:16.331120 0.423766 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:16.755401 0.227599 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:16.983495 0.061412 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.045395 0.202073 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.247932 0.186527 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.434921 0.152362 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.587768 0.045303 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.633529 0.175385 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:17.809338 0.213463 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:18.023268 0.472196 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:18.495872 0.143632 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:18.639895 0.365850 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:19.006256 0.213299 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:19.219986 0.116851 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:19.337277 0.348310 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:19.685994 0.335068 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:20.021599 0.066634 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:20.088640 0.220816 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:26:20.309887 0.210358 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:28:41.937637 3.000538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:28:48.944195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:28:56.945807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:29:12.948617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:29:44.954875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:35:48.960353 3.001840 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:35:55.968012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:36:03.969714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:36:19.972559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:36:51.978739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:42:55.984019 3.002408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:43:02.991877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:43:10.213002 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 03:43:10.213173 1.389974 tcp 10.0.2.105 63323 -> 200.84.7.244 8038 FSPA* 0 0 14 1593 flow=From-Botnet-V2-TCP-Established 1970/02/24 03:43:10.993341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:43:26.996832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:43:59.002637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:55:38.010557 3.001301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 03:55:45.017637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:55:53.019375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:56:09.022224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 03:56:33.087053 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 03:56:33.087165 0.187445 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:33.274987 0.216093 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:33.491496 0.179966 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:33.671840 0.071913 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:33.744186 0.209529 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:33.954079 0.221954 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:34.176458 0.374122 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:34.550990 0.089838 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:34.641251 0.062964 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:34.704612 0.164819 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:34.869770 0.157757 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:35.027888 0.161476 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:35.189788 0.226061 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:35.416374 0.484021 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:35.900811 0.053962 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:35.955143 0.423791 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:36.379319 0.225442 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:36.605170 0.064860 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:36.670454 0.152500 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:36.823299 0.047627 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:36.871291 0.170011 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:37.041773 0.211606 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:37.253781 0.220274 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:37.474456 0.195527 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:37.670416 0.346865 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:38.017692 0.143658 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:38.161765 0.365775 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:38.527931 0.349566 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:38.877935 0.329104 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:39.207472 0.063292 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:39.271205 0.209203 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:39.480795 0.116351 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:39.597592 0.203574 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:39.809125 0.223876 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/24 03:56:41.028321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:02:45.035584 3.000364 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:02:52.041549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:03:00.043109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:03:16.045994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:03:48.052016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:10:16.062850 3.001262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:10:23.069905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:10:31.071822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:10:47.074189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:11:19.081455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:13:11.603200 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 04:13:11.603339 0.902341 tcp 10.0.2.105 63324 -> 200.84.7.244 8038 FSPA* 0 0 13 1344 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:12.035755 0.097582 tcp 10.0.2.105 63325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:12.133577 0.055796 tcp 10.0.2.105 63326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:12.189794 0.154578 tcp 10.0.2.105 63327 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:12.505971 3.003708 tcp 10.0.2.105 63328 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:21.506755 0.000000 tcp 10.0.2.105 63328 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:27.506118 0.350265 tcp 10.0.2.105 63329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:27.856852 0.054893 tcp 10.0.2.105 63330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:27.912044 0.150535 tcp 10.0.2.105 63331 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:28.489372 3.001961 tcp 10.0.2.105 63332 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:37.492626 0.000000 tcp 10.0.2.105 63332 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:43.489030 0.061207 tcp 10.0.2.105 63333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:43.550596 0.058132 tcp 10.0.2.105 63334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:43.609076 0.160502 tcp 10.0.2.105 63335 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:43.779223 3.003870 tcp 10.0.2.105 63336 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:52.794517 0.000000 tcp 10.0.2.105 63336 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 04:13:58.780919 0.054866 tcp 10.0.2.105 63337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:58.836102 0.054390 tcp 10.0.2.105 63338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:58.890820 0.144544 tcp 10.0.2.105 63339 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:13:59.083405 0.220222 tcp 10.0.2.105 63340 -> 200.84.7.244 8038 SPA_* 0 0 9 1128 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:14:10.132872 0.091267 tcp 10.0.2.105 63340 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:17:23.087743 3.000485 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 04:17:30.093932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:17:38.095628 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:17:54.098122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:18:26.104845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:24:30.111218 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:24:37.118112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:24:45.119621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:25:01.122716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:25:33.128751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:26:44.801974 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 04:26:44.802133 0.188430 udp 10.0.2.105 7010 <-> 70.138.90.11 8107 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:44.991045 0.222790 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:45.214311 0.210337 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:45.425062 0.221688 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:45.647195 0.183088 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:45.830779 0.075713 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:45.906961 0.285153 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.192657 0.080337 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.273451 0.041098 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.314982 0.163366 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.478842 0.259682 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.738909 0.151145 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:46.890437 0.155684 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:26:47.046556 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 149 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 04:27:02.148343 0.055257 tcp 10.0.2.105 63341 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:27:02.203873 0.059152 tcp 10.0.2.105 63342 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:27:02.263338 0.146428 tcp 10.0.2.105 63343 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:27:02.410404 0.059602 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:02.470427 0.581440 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.052485 0.226030 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.278942 0.059747 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.339076 0.153065 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.492673 0.042232 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.535363 0.207617 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.743347 0.185275 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:03.929048 0.212981 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:04.142375 0.144323 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:04.287126 0.189513 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:04.477050 0.344549 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:04.821971 0.379429 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:05.201791 0.348160 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:05.550366 0.195654 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:05.746392 0.328582 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:06.075341 0.066789 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:06.142588 0.216430 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:06.359386 0.116311 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:27:06.476112 0.208280 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:31:37.135879 3.000242 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:31:44.142159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:31:52.143608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:32:08.146949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:32:40.152722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:38:44.158509 3.001666 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:38:51.166100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:38:59.167543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:39:15.170682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:39:47.176653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:44:10.224967 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 04:44:10.225125 1.546179 tcp 10.0.2.105 63344 -> 200.84.7.244 8038 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:45:51.182016 3.001647 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:45:58.190522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:46:06.191497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:46:22.194445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:46:54.200305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:57:06.213367 3.001382 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 04:57:13.220703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:57:13.861531 0.000187 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 04:57:13.861901 0.381969 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:14.244363 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 04:57:21.221973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:57:32.139212 0.055362 tcp 10.0.2.105 63345 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:57:32.194844 0.057334 tcp 10.0.2.105 63346 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:57:32.252553 0.156049 tcp 10.0.2.105 63347 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/24 04:57:32.409261 0.181450 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:32.591214 0.070630 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:32.662427 0.510252 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:33.173080 0.209313 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:33.382781 0.210279 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:33.593503 0.222821 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:33.816719 0.041913 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:33.859080 0.164329 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.023787 0.224523 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.248758 0.156233 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.405430 0.159560 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.565372 0.072531 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.638305 0.059936 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:34.698734 0.419949 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.119087 0.228626 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.348028 0.063454 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.411927 0.152822 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.565144 0.048108 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.613652 0.207685 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.821758 0.176152 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:35.998346 0.213568 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:36.212395 0.344485 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:36.557276 0.344116 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:36.901813 0.143750 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:37.045958 0.184266 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:37.224931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 04:57:37.230672 0.341999 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:37.573112 0.197116 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:37.770641 0.329171 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:38.100202 0.062216 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:38.162912 0.220933 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:38.384234 0.253558 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:57:38.638307 0.116525 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/24 04:58:09.230938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:04:13.238234 3.000500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 05:04:20.244103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:04:28.246064 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:04:44.249070 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:05:16.255328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:11:20.262179 3.000490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 05:11:27.268527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:11:35.269896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:11:51.273052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:12:23.279531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:14:11.775505 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:14:11.775686 0.733766 tcp 10.0.2.105 63348 -> 200.84.7.244 8038 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:12.217304 0.055857 tcp 10.0.2.105 63349 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:12.273461 0.058208 tcp 10.0.2.105 63350 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:12.331999 0.158133 tcp 10.0.2.105 63351 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:12.509735 3.000410 tcp 10.0.2.105 63352 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:21.508996 0.000000 tcp 10.0.2.105 63352 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:27.508430 0.056205 tcp 10.0.2.105 63353 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:27.565007 0.055506 tcp 10.0.2.105 63354 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:27.620861 0.144188 tcp 10.0.2.105 63355 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:27.798340 3.003427 tcp 10.0.2.105 63356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:36.800409 0.000000 tcp 10.0.2.105 63356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:42.799966 0.054387 tcp 10.0.2.105 63357 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:42.854633 0.054796 tcp 10.0.2.105 63358 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:42.909777 0.146050 tcp 10.0.2.105 63359 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:43.069533 2.994679 tcp 10.0.2.105 63360 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:52.072918 0.000000 tcp 10.0.2.105 63360 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:14:58.062260 0.055626 tcp 10.0.2.105 63361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:58.118205 0.054809 tcp 10.0.2.105 63362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:58.173396 0.156820 tcp 10.0.2.105 63363 -> 195.113.214.249 443 SRPA* 0 0 41 33364 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:58.342005 0.432010 tcp 10.0.2.105 63364 -> 200.84.7.244 8038 FSPA* 0 0 13 1373 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:14:58.774298 3.002527 tcp 10.0.2.105 63365 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:15:07.778130 0.000000 tcp 10.0.2.105 63365 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:15:13.774357 3.004288 tcp 10.0.2.105 63366 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:15:22.776887 0.000000 tcp 10.0.2.105 63366 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:15:27.713801 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:15:28.781232 2.999381 tcp 10.0.2.105 63367 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:15:37.778631 0.000000 tcp 10.0.2.105 63367 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:18:27.284681 3.001649 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 05:18:34.292355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:18:42.293903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:18:58.296638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:19:30.303017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:20:43.778947 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:20:43.779150 3.003542 tcp 10.0.2.105 63368 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:20:52.791500 0.000000 tcp 10.0.2.105 63368 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:20:58.781965 0.060230 tcp 10.0.2.105 63369 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:20:58.842512 0.054499 tcp 10.0.2.105 63370 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:20:58.897271 0.148218 tcp 10.0.2.105 63371 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:20:59.077164 2.997614 tcp 10.0.2.105 63372 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:21:08.073315 0.000000 tcp 10.0.2.105 63372 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:21:14.072907 0.054467 tcp 10.0.2.105 63373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:14.127699 0.056199 tcp 10.0.2.105 63374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:14.184236 0.157766 tcp 10.0.2.105 63375 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:14.444783 2.991981 tcp 10.0.2.105 63376 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:21:23.435762 0.000000 tcp 10.0.2.105 63376 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:21:29.444675 0.055237 tcp 10.0.2.105 63377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:29.500352 0.054955 tcp 10.0.2.105 63378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:29.555573 0.149049 tcp 10.0.2.105 63379 -> 195.113.214.249 443 SRPA* 0 0 39 23568 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:21:29.758812 2.130974 tcp 10.0.2.105 63380 -> 200.84.7.244 8038 FSPA* 0 0 14 1577 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:25:34.308447 3.002816 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 05:25:41.316058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:25:49.317894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:26:05.320976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:26:37.329916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:28:01.428078 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:28:01.428308 0.000000 udp 10.0.2.105 7010 -> 70.138.90.11 8107 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 05:28:18.644469 0.119619 tcp 10.0.2.105 63381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:18.764373 0.055284 tcp 10.0.2.105 63382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:18.819895 0.145848 tcp 10.0.2.105 63383 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:18.966421 0.311457 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:19.220024 0.191189 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:19.587263 0.117973 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:21.213027 0.846716 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:22.038185 0.213691 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:22.592758 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 05:28:39.503706 0.055413 tcp 10.0.2.105 63384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:39.559393 0.057029 tcp 10.0.2.105 63385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:39.616720 0.146783 tcp 10.0.2.105 63386 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:28:39.764004 0.231565 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:40.491863 0.064060 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:41.606019 0.174802 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:43.375950 0.184148 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:44.888222 0.107136 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:44.979291 0.057697 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:46.469955 0.408398 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:46.843512 0.182454 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2043 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:46.997755 0.467773 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:48.150353 0.242284 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:48.385938 0.077566 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:48.919859 0.226234 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:49.142883 0.199736 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:49.339762 0.158611 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 1954 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:51.682132 0.096551 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:51.741499 0.235749 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:52.073169 0.355567 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:52.418620 0.349154 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:53.009678 0.163756 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:53.164388 0.195979 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:53.408722 0.371666 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:53.751373 0.349205 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:55.091073 0.221732 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:55.290508 0.215246 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:56.532332 0.118051 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:56.938912 0.067326 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2092 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:28:57.938276 0.212640 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:32:41.333274 3.001270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 05:32:48.340507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:32:56.342111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:33:12.345382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:33:44.350925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:39:48.357471 3.001633 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 05:39:55.363867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:40:03.365716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:40:19.369031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:40:51.374907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:46:55.381304 3.001355 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 05:47:02.388338 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:47:10.389895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:47:26.392761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:47:58.762870 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:51:31.896192 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:51:31.896442 0.751228 tcp 10.0.2.105 63387 -> 200.84.7.244 8038 SPA_* 0 0 9 1181 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:02.641787 0.056406 tcp 10.0.2.105 63388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:02.698460 0.055528 tcp 10.0.2.105 63389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:02.754289 0.134437 tcp 10.0.2.105 63390 -> 195.113.214.249 443 SRPA* 0 0 34 24378 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:03.385622 0.319067 tcp 10.0.2.105 63387 -> 200.84.7.244 8038 FA_FA 0 0 4 216 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:03.704953 3.000522 tcp 10.0.2.105 63391 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:13.526967 0.000000 tcp 10.0.2.105 63391 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:19.454288 0.053503 tcp 10.0.2.105 63392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:19.508062 0.053849 tcp 10.0.2.105 63393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:19.562191 0.451856 tcp 10.0.2.105 63394 -> 195.113.214.249 443 SRPA* 0 0 31 23425 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:20.617515 2.962876 tcp 10.0.2.105 63395 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:29.502969 0.000000 tcp 10.0.2.105 63395 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:35.425809 0.057409 tcp 10.0.2.105 63396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:35.483509 0.054081 tcp 10.0.2.105 63397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:35.537851 0.159971 tcp 10.0.2.105 63398 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:36.689856 2.973469 tcp 10.0.2.105 63399 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:45.587821 0.000000 tcp 10.0.2.105 63399 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 05:52:51.500739 0.054112 tcp 10.0.2.105 63400 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:51.555078 0.055809 tcp 10.0.2.105 63401 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:51.611153 0.148022 tcp 10.0.2.105 63402 -> 195.113.214.249 443 SRPA* 0 0 37 19732 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:51.836448 0.514358 tcp 10.0.2.105 63403 -> 200.84.7.244 8038 SPA_* 0 0 9 1181 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:52:58.989313 0.064672 tcp 10.0.2.105 63403 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 05:54:02.414754 3.004128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 05:54:09.422856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:54:17.423700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:54:33.426770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:55:05.432712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 05:58:58.529092 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 05:58:58.529202 0.205450 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:58:58.735112 0.248781 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:58:58.984551 0.184320 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:58:59.169244 0.073885 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:58:59.243539 3.382224 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:02.626108 0.209699 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:02.836452 0.221423 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.058299 0.043403 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.102182 0.164885 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.267555 0.160835 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.428761 0.084053 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.513231 0.156726 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.670361 0.053349 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.724152 0.225724 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:03.950260 0.423802 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:04.374471 0.230294 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:04.605126 0.061414 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:04.666880 0.202620 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:04.869886 0.169620 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:05.039929 0.213701 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:05.253965 0.152858 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:05.407234 0.049819 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:05.457509 0.144171 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:05.602059 0.464507 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:06.066940 0.371096 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:06.438518 0.196174 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:06.635126 0.324883 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:06.960428 0.348034 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:07.308916 0.199207 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:07.508554 0.210150 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:07.719060 0.116454 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:07.835937 0.065048 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/24 05:59:07.901410 0.223406 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:01:09.440059 3.000489 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:01:16.446063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:01:24.447674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:01:40.450814 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:02:12.456920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:08:16.463291 3.000787 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:08:23.469881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:08:31.471451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:08:47.474665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:09:19.480926 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:15:23.486352 3.002034 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:15:30.493997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:15:38.495525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:15:54.498758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:16:26.504441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:22:30.510894 3.001200 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:22:37.518195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:22:45.519761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:22:58.799060 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 06:22:58.799214 1.793310 tcp 10.0.2.105 63404 -> 200.84.7.244 8038 FSPA* 0 0 14 1529 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:23:01.522823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:23:33.531790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:29:20.239386 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 06:29:20.239529 0.181122 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:20.421056 0.072355 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:20.493807 0.208622 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:20.702905 0.428422 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:21.131717 0.723990 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:21.856085 0.221057 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.077490 0.223828 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.301692 0.040629 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.342703 0.163781 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.506876 0.157211 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.664487 0.053364 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:22.718248 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 113 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 06:29:37.538756 2.997415 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:29:37.777608 0.052230 tcp 10.0.2.105 63405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:29:37.830205 0.054572 tcp 10.0.2.105 63406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:29:37.885822 0.166827 tcp 10.0.2.105 63407 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:29:38.053343 0.160522 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:38.214279 0.083536 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:38.298268 0.424829 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:38.723512 0.229453 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:38.953330 0.061772 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.015502 0.220366 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.236242 0.215928 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.452560 0.210799 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.663710 0.143742 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.807811 0.154895 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:39.963132 0.064690 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:40.028190 0.189431 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:40.218105 0.347037 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:40.565488 0.377916 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:40.943770 0.322672 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:41.266861 0.216703 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:41.483916 0.116601 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 553 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:41.600898 0.062938 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:41.664230 0.348071 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:42.012693 0.196856 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:42.209931 0.210180 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:29:44.542138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:29:52.543416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:30:08.546488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:30:40.552776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:36:44.558681 3.001795 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:36:51.565717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:36:59.567574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:37:15.570370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:37:47.576595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:43:51.583918 3.000343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:43:58.590207 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:44:06.592152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:44:22.594669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:44:54.720093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:53:00.599793 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 06:53:00.599981 0.211836 tcp 10.0.2.105 63408 -> 200.84.7.244 8038 SPA_* 0 0 9 1115 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:53:07.118886 1.075788 tcp 10.0.2.105 63408 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 06:56:08.622353 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 06:56:15.629784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:56:23.631171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:56:39.633985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:57:11.640561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 06:59:46.773672 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 06:59:46.773797 0.217726 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:46.991953 0.210716 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:47.203113 0.255373 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:47.458846 0.183080 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:47.642371 0.073284 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:47.716072 0.677107 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:48.393621 0.221853 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:48.615931 0.156955 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:48.773334 0.060104 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:48.833902 0.221289 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.055636 0.048139 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.104274 0.165148 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.269835 0.162311 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.432722 0.076877 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.510013 0.425719 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:49.936133 0.273348 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.209914 0.060559 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.270894 0.217798 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.489193 0.142360 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.632054 0.151675 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.784070 0.042346 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:50.826821 0.188850 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:51.016056 0.207516 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:51.224039 0.170597 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:51.395057 0.351163 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:51.746652 0.373097 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:52.120349 0.116431 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:52.237227 0.064218 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:52.301894 0.348033 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:52.650360 0.199486 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:52.850309 0.331666 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:53.182305 0.204292 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 06:59:53.387024 0.207764 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:03:15.646116 3.001621 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:03:22.653913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:03:30.655141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:03:46.657947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:04:18.664061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:10:36.670263 3.442032 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:10:44.077188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:10:52.000999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:11:07.847592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:11:39.688542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:17:43.694664 3.029160 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:17:50.711725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:17:58.712856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:18:14.716570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:18:46.722354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:23:08.199098 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 07:23:08.199292 1.405308 tcp 10.0.2.105 63409 -> 200.84.7.244 8038 FSPA* 0 0 14 1674 flow=From-Botnet-V2-TCP-Established 1970/02/24 07:24:50.728104 3.001843 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:24:57.735509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:25:05.737271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:25:21.740310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:25:53.746300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:30:19.268087 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 07:30:19.268254 0.230518 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:19.499173 0.181880 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:19.681431 0.095280 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:19.777127 0.211730 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:19.989286 0.254600 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:20.244323 0.573831 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:20.818551 1.178176 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:21.997120 0.157728 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.155222 0.080736 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.236377 0.223531 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.460373 0.047867 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.508669 0.092818 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.601927 0.162798 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.765066 0.159555 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:22.924983 0.421844 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:23.347318 0.336691 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:23.684461 0.064173 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:23.748989 0.241854 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:23.991213 0.044397 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:24.035985 0.205247 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 579 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:24.241638 0.143888 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:24.385942 0.147430 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:24.533843 0.359577 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:24.893779 0.220607 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:25.114748 0.176260 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:25.291451 0.340714 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:25.632564 0.116613 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:25.819887 0.064178 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:25.884450 0.347823 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:26.232670 0.226527 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:26.459520 0.208618 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:26.668741 0.327484 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:30:26.996644 0.223176 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/24 07:31:57.752312 3.001607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:32:04.759784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:32:12.761058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:32:28.763895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:33:00.779991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:39:04.786019 3.001740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:39:11.793430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:39:19.794881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:39:35.798072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:40:07.824305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:46:11.820384 3.001368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:46:18.827660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:46:26.829130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:46:42.832049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:47:14.838348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:53:09.609022 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 07:53:09.609173 4.699377 tcp 10.0.2.105 63410 -> 200.84.7.244 8038 FSPA* 0 0 15 1651 flow=From-Botnet-V2-TCP-Established 1970/02/24 07:53:18.843982 3.001819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 07:53:25.851454 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:53:33.853100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:53:49.855877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 07:54:21.862684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:00:25.867838 3.001949 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:00:32.875726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:00:37.942987 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 08:00:37.943099 0.074683 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:38.018137 0.210652 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:38.229176 0.230759 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:38.460346 0.178160 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:38.638906 0.268193 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:38.907513 0.537082 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:39.445021 0.510571 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:39.956008 0.153106 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.109611 0.049014 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.159074 0.079858 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.239288 0.167283 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.406929 0.158401 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.565740 0.060457 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.626615 0.216934 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.843944 0.425759 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:40.877359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:00:41.270104 0.232427 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:41.502911 0.063566 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:41.566919 0.214786 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:41.782120 0.050129 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:41.832667 2.885613 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:44.718776 0.362178 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:45.081293 0.208019 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:45.377313 0.195288 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:45.572988 0.143631 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:45.716994 0.176289 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:45.893632 0.343785 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:46.237787 0.116624 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:46.354842 0.066747 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:46.422008 0.208501 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:46.630939 0.330084 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:46.961398 0.210750 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:47.172514 0.347041 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:47.519948 0.199020 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:00:56.880535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:01:28.886114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:07:32.892087 3.151417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:07:40.016332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:07:47.949650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:08:03.913938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:08:35.920364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:14:39.927728 2.999983 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:14:46.933476 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:14:54.935083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:15:10.938007 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:15:45.482144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:21:46.959926 3.001736 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:21:53.967575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:22:01.968547 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:22:17.972434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:22:49.978274 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:23:14.313217 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 08:23:14.313410 1.380238 tcp 10.0.2.105 63411 -> 200.84.7.244 8038 FSPA* 0 0 14 1648 flow=From-Botnet-V2-TCP-Established 1970/02/24 08:28:53.983865 3.001880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:29:00.991572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:29:08.992458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:29:24.995863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:29:57.001893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:31:16.286390 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 08:31:16.286509 0.073098 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:16.360018 0.222693 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:16.583101 0.272298 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:16.855847 0.231640 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:17.087912 0.179562 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:17.267898 0.685065 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:17.953377 0.501307 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:18.455079 0.159284 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:18.614864 0.042213 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:18.657514 0.081653 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:18.739564 0.060074 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:18.800024 0.222336 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:19.022812 0.164354 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:19.187552 0.161236 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:19.349259 0.423232 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:19.772921 0.228239 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.001532 0.062754 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.064736 0.209196 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.274327 0.050408 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.325137 0.152437 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.478101 0.189370 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:20.667831 0.346944 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:21.015193 0.207125 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:21.222766 0.143826 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:21.367009 0.179801 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:21.547231 0.343704 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:21.891319 0.116587 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:22.008291 0.320851 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:22.329568 0.060423 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:22.390427 0.221235 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:22.612095 0.210302 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:22.822801 0.349208 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:31:23.172373 0.211412 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 229 flow=From-Botnet-V2-UDP-Established 1970/02/24 08:36:01.007569 3.001864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:36:08.015110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:36:16.016987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:36:32.019987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:37:04.025823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:43:08.031674 3.001886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:43:15.039478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:43:23.041205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:43:39.043711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:44:11.050062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:53:15.693293 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 08:53:15.693448 0.232986 tcp 10.0.2.105 63412 -> 200.84.7.244 8038 SPA_* 0 0 9 1234 flow=From-Botnet-V2-TCP-Established 1970/02/24 08:53:20.755757 0.429703 tcp 10.0.2.105 63412 -> 200.84.7.244 8038 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/24 08:55:43.056973 3.002203 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 08:55:50.064871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:55:58.066152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:56:14.069486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 08:56:46.783854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:01:51.975499 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 09:01:51.975704 0.459315 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:52.435400 0.221588 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:52.657416 0.067823 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:52.725645 0.217019 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:52.943036 0.183077 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:53.126556 0.924734 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:54.051695 0.748298 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:54.800385 0.154937 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:54.955708 0.047371 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.003531 0.086577 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.090560 0.059842 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.150774 0.222468 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.373596 0.163443 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.537529 0.162078 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:55.700047 0.421327 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:56.121710 0.230349 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:56.352493 0.058665 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:56.411615 0.153603 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:56.565613 0.197593 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:56.763660 0.349299 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.113393 0.207892 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.321633 0.212811 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.534831 0.043441 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.578652 0.139274 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.718308 0.175931 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:57.894610 0.337934 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:58.232944 0.117860 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:58.351169 0.221299 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:58.572822 0.210045 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:58.783225 0.349408 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:59.133047 0.382635 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:59.516057 0.066914 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:01:59.583364 0.198906 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:02:50.091532 3.373192 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:02:57.433135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:03:05.360002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:03:21.209620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:03:53.119584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:10:20.129776 3.000501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:10:27.135937 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:10:35.137559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:10:51.140483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:11:23.146513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:17:27.152037 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:17:34.164714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:17:42.161644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:17:58.164660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:18:30.180567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:23:21.189316 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 09:23:21.189432 1.939746 tcp 10.0.2.105 63413 -> 200.84.7.244 8038 FSPA* 0 0 15 1794 flow=From-Botnet-V2-TCP-Established 1970/02/24 09:24:34.185896 3.002217 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:24:41.193520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:24:49.195774 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:25:05.198511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:25:37.204643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:31:41.214650 2.997239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:31:48.221504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:31:56.221785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:32:12.222363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:32:16.809151 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 09:32:16.809300 0.077005 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:16.886739 0.227202 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:17.114338 0.228284 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:17.343038 0.207594 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:17.551099 0.184404 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:17.735894 0.523545 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.259868 0.214925 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.475256 0.150893 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.626483 0.047956 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.674854 0.085678 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.760934 0.059918 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:18.821260 0.216680 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:19.038320 0.163209 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:19.201896 0.159413 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:19.361771 0.423820 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:19.785937 0.233359 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.019717 0.062764 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.082899 0.163281 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.246565 0.185903 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.432854 0.350871 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.784152 0.049245 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.833730 0.143719 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:20.977775 0.173535 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:21.151736 0.365861 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:21.518029 0.215143 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:21.753301 0.212243 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:21.965963 0.116631 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:22.082983 0.208723 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:22.292092 0.209907 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:22.502465 0.344434 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:22.847323 0.206270 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:23.054005 0.340730 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:23.395097 0.069421 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/24 09:32:44.228300 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:38:48.235801 3.000159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:38:55.242116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:39:03.243445 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:39:19.246292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:39:51.252913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:45:55.258441 3.001703 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:46:02.265801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:46:10.267422 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:46:26.270756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:46:58.276985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:53:02.282767 3.001145 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 09:53:09.289760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:53:17.291269 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:53:23.130116 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 09:53:23.130197 4.233794 tcp 10.0.2.105 63414 -> 200.84.7.244 8038 FSPA* 0 0 14 1652 flow=From-Botnet-V2-TCP-Established 1970/02/24 09:53:33.294515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 09:54:05.300690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:00:09.306495 3.001331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:00:16.319321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:00:24.315323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:00:40.318850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:01:12.324174 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:02:42.836464 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:02:42.836661 0.068844 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:42.905998 0.293482 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:43.199921 0.182408 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:43.382781 0.228638 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:43.611817 0.210525 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:43.822705 0.849690 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:44.672821 0.211329 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:44.884671 0.152176 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.249465 0.099614 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.349492 0.088907 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.438725 0.060009 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.499066 0.214861 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.714328 0.163191 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:45.877984 0.161373 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:46.039709 0.423648 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:46.463729 0.230478 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:46.694546 0.062089 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:46.756982 0.347803 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.105141 0.052806 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.158309 0.143713 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.302427 0.169456 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.472213 0.151581 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.624198 0.183886 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:47.808507 0.370552 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:48.179487 0.221872 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:48.401764 0.215973 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:48.618159 0.116818 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:48.735357 0.349264 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:49.085012 0.219012 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:49.304389 0.216484 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:49.521314 0.222153 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:49.743841 0.349647 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:02:50.093865 0.062632 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:07:22.338866 3.001812 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:07:29.346332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:07:37.347916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:07:53.350954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:08:25.356759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:14:29.372506 3.002023 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:14:36.380407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:14:44.381901 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:15:00.384860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:15:32.391004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:21:36.396725 3.001944 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:21:43.404342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:21:51.405803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:22:07.408954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:22:39.414853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:23:27.364130 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:23:27.364392 2.007574 tcp 10.0.2.105 63415 -> 200.84.7.244 8038 FSPA* 0 0 15 1669 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:28:43.421238 3.001066 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:28:50.428530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:28:58.429812 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:29:14.432700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:29:46.448692 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:33:12.245184 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:33:12.245333 0.182424 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:12.428178 0.228166 udp 10.0.2.105 7010 <-> 200.84.7.244 8376 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:12.656828 0.072785 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:12.729985 0.239915 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:12.970339 0.222878 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:13.193604 0.211763 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:13.405813 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 10:33:30.382513 0.054202 tcp 10.0.2.105 63416 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:30.486737 0.059023 tcp 10.0.2.105 63417 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:30.546014 0.133072 tcp 10.0.2.105 63418 -> 195.113.214.249 443 SRPA* 0 0 33 24156 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:30.679628 0.154435 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:30.834505 0.048974 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:30.883885 0.083326 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:30.967625 0.060112 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:31.028098 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 10:33:39.619677 0.000000 udp 10.0.2.105 7010 <- 213.123.178.217 3364 RSP 0 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 10:33:48.527523 0.053946 tcp 10.0.2.105 63419 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:48.581796 0.054463 tcp 10.0.2.105 63420 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:48.636581 0.151571 tcp 10.0.2.105 63421 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:33:48.788685 0.168546 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:48.957634 0.158909 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:49.116917 0.425328 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:49.542621 0.230083 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:49.773096 0.061331 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:49.834908 0.345234 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.180523 0.046642 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.227563 0.137758 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.365689 0.176168 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.542193 0.151584 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.694114 0.220396 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:50.914893 0.206116 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:51.121406 0.116614 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:51.238460 0.181437 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:51.420306 0.380667 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:51.801355 0.348783 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:52.150493 0.200265 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:52.351170 0.220064 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:52.571655 0.204460 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:52.776560 0.340396 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:33:53.117304 0.065718 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/24 10:35:50.455098 3.001978 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 10:35:57.462311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:36:05.463729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:36:21.466784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:36:53.472842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:42:57.479593 3.001062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 10:43:04.486260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:43:12.487623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:43:28.490873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:44:00.496924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:53:29.375260 0.000195 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:53:29.375614 3.003419 tcp 10.0.2.105 63422 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:53:38.377748 0.000000 tcp 10.0.2.105 63422 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:53:44.378729 0.055380 tcp 10.0.2.105 63423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:53:44.434465 0.054923 tcp 10.0.2.105 63424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:53:44.489655 0.177052 tcp 10.0.2.105 63425 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:53:44.883506 3.007612 tcp 10.0.2.105 63426 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:53:53.890023 0.000000 tcp 10.0.2.105 63426 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:53:59.880493 0.053383 tcp 10.0.2.105 63427 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:53:59.934213 0.054653 tcp 10.0.2.105 63428 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:53:59.989117 0.151807 tcp 10.0.2.105 63429 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:00.329336 3.003523 tcp 10.0.2.105 63430 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:09.342052 0.000000 tcp 10.0.2.105 63430 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:15.331188 0.058313 tcp 10.0.2.105 63431 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:15.389754 0.054725 tcp 10.0.2.105 63432 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:15.444769 0.143196 tcp 10.0.2.105 63433 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:15.776810 2.998664 tcp 10.0.2.105 63434 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:24.774275 0.000000 tcp 10.0.2.105 63434 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:30.773563 0.053669 tcp 10.0.2.105 63435 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:30.827528 0.082699 tcp 10.0.2.105 63436 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:30.910507 0.147876 tcp 10.0.2.105 63437 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/24 10:54:31.399921 2.998045 tcp 10.0.2.105 63438 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:40.396827 0.000000 tcp 10.0.2.105 63438 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:46.395424 3.004352 tcp 10.0.2.105 63439 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:54:55.398140 0.000000 tcp 10.0.2.105 63439 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:55:00.205568 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:55:01.397144 3.004012 tcp 10.0.2.105 63440 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:55:10.399884 0.000000 tcp 10.0.2.105 63440 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:55:16.398488 3.004354 tcp 10.0.2.105 63441 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:55:24.209674 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 10:55:25.411363 0.000000 tcp 10.0.2.105 63441 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 10:55:40.507193 3.004735 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 10:55:47.512758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:55:55.514849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:56:11.517781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 10:56:43.523868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:00:31.401672 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:00:31.401863 2.993679 tcp 10.0.2.105 63442 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:00:40.394192 0.000000 tcp 10.0.2.105 63442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:00:46.405070 0.054830 tcp 10.0.2.105 63443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:00:46.460162 0.055002 tcp 10.0.2.105 63444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:00:46.515454 0.153394 tcp 10.0.2.105 63445 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:00:47.754189 3.005089 tcp 10.0.2.105 63446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:00:56.757909 0.000000 tcp 10.0.2.105 63446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:02.747012 0.054079 tcp 10.0.2.105 63447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:02.801348 0.053811 tcp 10.0.2.105 63448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:02.855442 0.160450 tcp 10.0.2.105 63449 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:03.268738 3.002775 tcp 10.0.2.105 63450 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:12.270037 0.000000 tcp 10.0.2.105 63450 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:18.275359 0.054794 tcp 10.0.2.105 63451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:18.330459 0.055031 tcp 10.0.2.105 63452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:18.385845 0.144867 tcp 10.0.2.105 63453 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:18.727504 2.987973 tcp 10.0.2.105 63454 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:27.722541 0.000000 tcp 10.0.2.105 63454 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:33.721611 0.054328 tcp 10.0.2.105 63455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:33.776210 0.056895 tcp 10.0.2.105 63456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:33.833436 0.147156 tcp 10.0.2.105 63457 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:01:34.477178 2.989407 tcp 10.0.2.105 63458 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:43.465261 0.000000 tcp 10.0.2.105 63458 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:49.473640 3.004346 tcp 10.0.2.105 63459 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:01:58.476537 0.000000 tcp 10.0.2.105 63459 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:02:03.202741 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:02:04.475375 3.004073 tcp 10.0.2.105 63460 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:02:13.478089 0.000000 tcp 10.0.2.105 63460 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:02:19.476991 3.004122 tcp 10.0.2.105 63461 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:02:27.207994 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:02:28.480142 0.000000 tcp 10.0.2.105 63461 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:02:47.529841 3.001684 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 11:02:54.537297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:03:02.538790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:03:18.541690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:03:50.547885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:04:02.649695 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:04:02.649857 0.656949 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 2 581 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:03.307249 0.221334 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:03.529012 0.247247 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:03.776650 0.213454 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:03.990457 0.180807 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:04.171660 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 11:04:22.550386 0.056244 tcp 10.0.2.105 63462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:04:22.606933 0.057745 tcp 10.0.2.105 63463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:04:22.664972 0.146225 tcp 10.0.2.105 63464 -> 195.113.214.249 443 SRPA* 0 0 41 22254 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:04:22.811778 0.074255 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:22.886483 0.213312 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.100207 0.059768 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.160409 0.155588 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.316382 0.048258 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.365015 0.086506 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.451923 0.166423 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:23.618769 0.162732 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:24.593421 0.419897 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:25.013710 0.231335 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:25.245428 0.058803 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:25.304616 0.341363 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:25.790502 0.065284 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:25.856183 0.157619 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.014184 0.206953 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.221558 0.215059 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.436996 0.116716 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.554172 0.144199 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.698765 0.175904 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:26.875136 0.194249 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:27.069798 0.345002 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:27.415176 0.348572 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:27.764178 0.210587 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:27.975149 0.354471 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:28.330021 0.064286 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:28.394676 0.210891 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:04:28.605961 0.217552 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:07:34.480026 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:07:34.480189 2.993642 tcp 10.0.2.105 63465 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:07:43.482484 0.000000 tcp 10.0.2.105 63465 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:07:49.482887 0.054789 tcp 10.0.2.105 63466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:07:49.537964 0.055007 tcp 10.0.2.105 63467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:07:49.593311 0.150624 tcp 10.0.2.105 63468 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:07:49.849624 2.996324 tcp 10.0.2.105 63469 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:07:58.844049 0.000000 tcp 10.0.2.105 63469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:04.843390 0.053770 tcp 10.0.2.105 63470 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:04.897570 0.054621 tcp 10.0.2.105 63471 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:04.952504 0.152431 tcp 10.0.2.105 63472 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:05.274624 3.004439 tcp 10.0.2.105 63473 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:14.277073 0.000000 tcp 10.0.2.105 63473 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:20.276563 0.062897 tcp 10.0.2.105 63474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:20.339750 0.054664 tcp 10.0.2.105 63475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:20.394697 0.146868 tcp 10.0.2.105 63476 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:20.740422 3.000370 tcp 10.0.2.105 63477 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:29.739061 0.000000 tcp 10.0.2.105 63477 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:35.738445 0.055582 tcp 10.0.2.105 63478 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:35.794290 0.054722 tcp 10.0.2.105 63479 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:35.849401 0.189770 tcp 10.0.2.105 63480 -> 195.113.214.249 443 SRPA* 0 0 34 23334 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:08:36.109808 3.002903 tcp 10.0.2.105 63481 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:45.111355 0.000000 tcp 10.0.2.105 63481 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:08:51.110182 2.993899 tcp 10.0.2.105 63482 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:09:00.112739 0.000000 tcp 10.0.2.105 63482 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:09:04.709310 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:09:06.111794 3.423459 tcp 10.0.2.105 63483 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:09:15.474536 0.000000 tcp 10.0.2.105 63483 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:09:21.438136 2.975011 tcp 10.0.2.105 63484 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:09:28.946462 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:09:30.353904 0.000000 tcp 10.0.2.105 63484 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:10:19.569744 3.001580 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 11:10:26.576890 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:10:34.578573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:10:50.581588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:11:22.587716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:14:36.126631 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:14:36.126763 3.002822 tcp 10.0.2.105 63485 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:14:45.128586 0.000000 tcp 10.0.2.105 63485 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:14:51.128928 0.056518 tcp 10.0.2.105 63486 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:14:51.185719 0.054232 tcp 10.0.2.105 63487 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:14:51.240327 0.147597 tcp 10.0.2.105 63488 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:14:51.648084 3.004573 tcp 10.0.2.105 63489 -> 200.84.7.244 8038 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:15:00.651062 0.000000 tcp 10.0.2.105 63489 -> 200.84.7.244 8038 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:17:26.593413 3.001767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 11:17:33.601259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:17:41.602658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:17:57.605668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:18:29.611483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:24:33.617343 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 11:24:40.625305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:24:48.626715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:25:04.629663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:25:36.635519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:31:40.641552 3.001613 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 11:31:47.649315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:31:55.650595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:32:11.653544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:32:43.659576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:34:38.885428 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:34:38.885611 0.000000 udp 10.0.2.105 7010 -> 200.84.7.244 8376 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 11:34:54.649855 0.055114 tcp 10.0.2.105 63490 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:34:54.705231 0.152484 tcp 10.0.2.105 63491 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:34:54.858059 0.171977 tcp 10.0.2.105 63492 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:34:55.030597 0.546858 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:55.557556 0.230171 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:56.380035 0.229096 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:56.790651 0.423491 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:57.161518 0.187426 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:57.999449 0.116550 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:58.077124 0.224661 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:58.761364 0.063810 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:34:58.823651 0.190580 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:00.105459 0.064400 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:00.888132 0.098073 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:00.970449 0.183443 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:01.148599 0.189171 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:01.794723 0.447984 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:02.220259 0.381633 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:02.594760 0.072918 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:02.965583 0.366391 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:03.322145 0.090928 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:03.757006 0.235824 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:03.972099 0.117667 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:04.355751 0.154979 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:04.501388 0.162674 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:04.657578 0.252472 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:06.377528 0.176173 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:06.678118 0.194107 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:06.829636 3.000151 tcp 10.0.2.105 63493 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:07.341097 0.361767 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:07.699625 0.365339 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:08.928546 0.068705 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:09.071446 0.354497 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:10.221045 0.226882 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:10.955605 0.221983 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:11.715109 0.234285 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/24 11:35:15.828313 0.000000 tcp 10.0.2.105 63493 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:20.707865 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:35:21.827831 0.053233 tcp 10.0.2.105 63494 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:21.881353 0.055742 tcp 10.0.2.105 63495 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:21.937381 0.145804 tcp 10.0.2.105 63496 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:22.237768 3.003984 tcp 10.0.2.105 63497 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:31.240805 0.000000 tcp 10.0.2.105 63497 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:37.240044 0.055654 tcp 10.0.2.105 63498 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:37.296097 0.055533 tcp 10.0.2.105 63499 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:37.351940 0.255887 tcp 10.0.2.105 63500 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:35:38.063885 4.988508 tcp 10.0.2.105 63501 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:48.980413 0.000000 tcp 10.0.2.105 63501 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:35:54.917468 2.952140 tcp 10.0.2.105 63502 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:36:03.798054 0.000000 tcp 10.0.2.105 63502 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:36:08.382885 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:38:47.666419 3.000995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 11:38:54.673156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:39:02.674639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:39:18.677481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:39:51.953535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:41:08.385773 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:41:08.385920 2.968442 tcp 10.0.2.105 63503 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:17.278225 0.000000 tcp 10.0.2.105 63503 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:23.201478 0.055629 tcp 10.0.2.105 63504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:23.257457 0.055034 tcp 10.0.2.105 63505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:23.312799 0.148717 tcp 10.0.2.105 63506 -> 195.113.214.249 443 SRPA* 0 0 39 32290 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:23.554912 2.974742 tcp 10.0.2.105 63507 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:32.453280 0.000000 tcp 10.0.2.105 63507 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:38.429347 0.054524 tcp 10.0.2.105 63508 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:38.484194 0.054798 tcp 10.0.2.105 63509 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:38.539265 0.152904 tcp 10.0.2.105 63510 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:38.786281 3.007002 tcp 10.0.2.105 63511 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:47.801764 0.000000 tcp 10.0.2.105 63511 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:41:53.781149 0.057862 tcp 10.0.2.105 63512 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:53.839348 0.054465 tcp 10.0.2.105 63513 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:53.894114 0.146734 tcp 10.0.2.105 63514 -> 195.113.214.249 443 SRPA* 0 0 41 22696 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:41:54.152439 2.992743 tcp 10.0.2.105 63515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:42:03.143823 0.000000 tcp 10.0.2.105 63515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:42:10.590702 2.959910 tcp 10.0.2.105 63516 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:42:19.474847 0.000000 tcp 10.0.2.105 63516 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:42:23.963889 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:42:25.398516 2.963850 tcp 10.0.2.105 63517 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:42:34.281080 0.000000 tcp 10.0.2.105 63517 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:45:54.700850 3.000298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 11:46:01.707173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:46:09.708849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:46:25.711262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:46:57.717572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:47:39.157010 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:47:39.157166 3.004671 tcp 10.0.2.105 63518 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:47:48.160004 0.000000 tcp 10.0.2.105 63518 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:47:54.160377 0.055811 tcp 10.0.2.105 63519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:47:54.216503 0.056143 tcp 10.0.2.105 63520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:47:54.272952 0.148710 tcp 10.0.2.105 63521 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:47:54.511796 2.991635 tcp 10.0.2.105 63522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:03.512158 0.000000 tcp 10.0.2.105 63522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:09.511785 0.054568 tcp 10.0.2.105 63523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:48:09.566643 0.120667 tcp 10.0.2.105 63524 -> 195.113.214.249 80 SRPA* 0 0 20 13512 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:48:09.852457 2.993240 tcp 10.0.2.105 63525 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:18.876862 0.000000 tcp 10.0.2.105 63525 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:24.853472 0.053871 tcp 10.0.2.105 63526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:48:24.907674 0.055324 tcp 10.0.2.105 63527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:48:24.963316 0.148423 tcp 10.0.2.105 63528 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:48:26.413796 3.005575 tcp 10.0.2.105 63529 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:35.418079 0.000000 tcp 10.0.2.105 63529 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:41.407047 3.003832 tcp 10.0.2.105 63530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:49.207897 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:48:50.409641 0.000000 tcp 10.0.2.105 63530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:48:56.408594 3.003974 tcp 10.0.2.105 63531 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:49:05.411085 0.000000 tcp 10.0.2.105 63531 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:53:01.723182 3.001645 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 11:53:08.730752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:53:16.732420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:53:32.735118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:54:07.127955 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 11:54:13.699239 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:54:13.699363 2.954047 tcp 10.0.2.105 63532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:22.580020 0.000000 tcp 10.0.2.105 63532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:28.516361 0.055419 tcp 10.0.2.105 63533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:28.572168 0.057963 tcp 10.0.2.105 63534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:28.630462 0.147453 tcp 10.0.2.105 63535 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:29.506464 2.957613 tcp 10.0.2.105 63536 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:38.384542 0.000000 tcp 10.0.2.105 63536 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:44.311586 0.053884 tcp 10.0.2.105 63537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:44.365806 0.055666 tcp 10.0.2.105 63538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:44.421779 0.148455 tcp 10.0.2.105 63539 -> 195.113.214.249 443 SRPA* 0 0 25 13312 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:44.591287 2.972530 tcp 10.0.2.105 63540 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:53.485077 0.000000 tcp 10.0.2.105 63540 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:54:59.396535 0.053480 tcp 10.0.2.105 63541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:59.450310 0.056205 tcp 10.0.2.105 63542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:59.506808 0.153637 tcp 10.0.2.105 63543 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 11:54:59.730123 2.962653 tcp 10.0.2.105 63544 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:55:08.616481 0.000000 tcp 10.0.2.105 63544 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:55:14.537124 2.955781 tcp 10.0.2.105 63545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:55:23.432692 0.000000 tcp 10.0.2.105 63545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:55:28.058493 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 11:55:29.355649 3.432847 tcp 10.0.2.105 63546 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 11:55:38.711343 0.000000 tcp 10.0.2.105 63546 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:00:08.767155 3.001868 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:00:15.775124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:00:23.776535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:00:39.779321 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:00:43.034776 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:00:43.034952 3.003641 tcp 10.0.2.105 63547 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:00:52.037266 0.000000 tcp 10.0.2.105 63547 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:00:58.038173 0.057700 tcp 10.0.2.105 63548 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:00:58.096138 0.053913 tcp 10.0.2.105 63549 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:00:58.150377 0.151078 tcp 10.0.2.105 63550 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:00:58.313638 3.007132 tcp 10.0.2.105 63551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:01:07.318898 0.000000 tcp 10.0.2.105 63551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:01:11.785123 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:05:25.411040 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:05:25.411240 0.515076 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:25.905302 0.277743 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2027 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:26.129013 0.231448 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:26.353553 0.528499 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:26.900952 0.194657 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.083472 0.118326 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.225237 0.227084 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.445029 0.063845 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.526962 0.185570 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.686482 0.169477 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.850896 0.064281 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:27.932594 0.108383 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:28.023428 0.188265 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:28.234439 0.449704 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:28.659388 0.238595 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:28.891091 0.079141 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:28.954438 0.356832 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:29.301282 0.085787 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:30.069122 0.228139 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2035 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:30.277463 0.165389 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:30.598822 0.118102 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:31.799528 0.155331 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:31.995506 0.274852 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2528 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:32.264693 0.202396 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:32.541391 0.189291 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:32.933125 0.352800 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:33.282253 0.445821 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:33.698445 0.065990 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:33.981417 0.354460 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:34.332081 0.222136 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2002 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:34.789031 0.223015 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:05:34.990021 0.213496 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:06:13.309530 2.993899 tcp 10.0.2.105 63552 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:18.208790 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:06:22.311930 0.000000 tcp 10.0.2.105 63552 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:28.312718 0.054151 tcp 10.0.2.105 63553 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:28.367144 0.057256 tcp 10.0.2.105 63554 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:28.424787 0.144150 tcp 10.0.2.105 63555 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:28.652220 2.997738 tcp 10.0.2.105 63556 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:37.643764 0.000000 tcp 10.0.2.105 63556 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:43.931473 0.054193 tcp 10.0.2.105 63557 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:43.985944 0.055031 tcp 10.0.2.105 63558 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:44.041234 0.183658 tcp 10.0.2.105 63559 -> 195.113.214.249 443 SRPA* 0 0 75 77234 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:45.029948 2.975230 tcp 10.0.2.105 63560 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:53.946977 0.000000 tcp 10.0.2.105 63560 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:06:59.886372 0.055852 tcp 10.0.2.105 63561 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:59.942500 0.055381 tcp 10.0.2.105 63562 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:06:59.998190 0.146748 tcp 10.0.2.105 63563 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:07:00.743434 2.976923 tcp 10.0.2.105 63564 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:09.662219 0.000000 tcp 10.0.2.105 63564 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:15.628833 2.994121 tcp 10.0.2.105 63565 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:23.792868 3.002528 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:07:24.631610 0.000000 tcp 10.0.2.105 63565 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:29.208254 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:07:30.630445 3.298667 tcp 10.0.2.105 63566 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:31.131283 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:07:39.054637 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:07:39.880108 0.000000 tcp 10.0.2.105 63566 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:07:54.902564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:08:26.810855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:12:45.643737 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:12:45.643915 3.003429 tcp 10.0.2.105 63567 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:12:54.647442 0.000000 tcp 10.0.2.105 63567 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:00.646829 0.055536 tcp 10.0.2.105 63568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:00.702647 0.054448 tcp 10.0.2.105 63569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:00.757372 0.150798 tcp 10.0.2.105 63570 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:01.354741 3.282441 tcp 10.0.2.105 63571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:10.578536 0.000000 tcp 10.0.2.105 63571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:16.515332 0.054142 tcp 10.0.2.105 63572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:16.569752 0.133026 tcp 10.0.2.105 63573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:16.703078 0.143454 tcp 10.0.2.105 63574 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:16.876876 2.972229 tcp 10.0.2.105 63575 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:25.788725 0.000000 tcp 10.0.2.105 63575 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:31.727794 0.056556 tcp 10.0.2.105 63576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:31.784664 0.056015 tcp 10.0.2.105 63577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:31.841036 0.142911 tcp 10.0.2.105 63578 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:13:32.163489 2.980500 tcp 10.0.2.105 63579 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:41.152731 0.000000 tcp 10.0.2.105 63579 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:47.151747 2.997605 tcp 10.0.2.105 63580 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:13:56.144052 0.000000 tcp 10.0.2.105 63580 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:14:00.700858 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:14:02.152943 3.004235 tcp 10.0.2.105 63581 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:14:11.155806 0.000000 tcp 10.0.2.105 63581 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:14:30.817186 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:14:37.824336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:14:45.825777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:15:01.831197 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:15:33.834576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:19:17.156714 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:19:17.156931 3.006598 tcp 10.0.2.105 63582 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:19:26.159243 0.000000 tcp 10.0.2.105 63582 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:19:32.159458 0.055785 tcp 10.0.2.105 63583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:32.215521 0.055657 tcp 10.0.2.105 63584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:32.271485 0.147949 tcp 10.0.2.105 63585 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:32.479772 3.002637 tcp 10.0.2.105 63586 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:19:41.481043 0.000000 tcp 10.0.2.105 63586 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:19:47.480134 0.055046 tcp 10.0.2.105 63587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:47.535411 0.053628 tcp 10.0.2.105 63588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:47.589297 0.161176 tcp 10.0.2.105 63589 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:19:48.125576 2.998914 tcp 10.0.2.105 63590 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:19:57.133305 0.000000 tcp 10.0.2.105 63590 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:03.122469 0.053682 tcp 10.0.2.105 63591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:20:03.176466 0.054242 tcp 10.0.2.105 63592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:20:03.231014 0.147273 tcp 10.0.2.105 63593 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:20:03.482685 2.994182 tcp 10.0.2.105 63594 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:12.475358 0.000000 tcp 10.0.2.105 63594 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:18.474295 3.004197 tcp 10.0.2.105 63595 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:27.477177 0.000000 tcp 10.0.2.105 63595 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:32.203835 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:20:33.475691 3.004494 tcp 10.0.2.105 63596 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:20:42.478630 0.000000 tcp 10.0.2.105 63596 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:21:37.842345 3.000385 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:21:44.848499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:21:52.849980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:22:08.853094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:22:40.858950 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:25:48.479952 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:25:48.480126 3.002896 tcp 10.0.2.105 63597 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:25:57.491513 0.000000 tcp 10.0.2.105 63597 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:03.483190 0.054366 tcp 10.0.2.105 63598 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:03.537799 0.054886 tcp 10.0.2.105 63599 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:03.592941 0.145507 tcp 10.0.2.105 63600 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:03.925756 2.998723 tcp 10.0.2.105 63601 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:12.923807 0.000000 tcp 10.0.2.105 63601 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:18.923191 0.055376 tcp 10.0.2.105 63602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:18.978875 0.054983 tcp 10.0.2.105 63603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:19.034245 0.150506 tcp 10.0.2.105 63604 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:19.201058 2.995824 tcp 10.0.2.105 63605 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:28.195666 0.000000 tcp 10.0.2.105 63605 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:34.194751 0.056702 tcp 10.0.2.105 63606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:34.251253 0.058500 tcp 10.0.2.105 63607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:34.310100 0.149739 tcp 10.0.2.105 63608 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:26:34.887229 3.002355 tcp 10.0.2.105 63609 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:43.888398 0.000000 tcp 10.0.2.105 63609 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:26:53.153691 2.966130 tcp 10.0.2.105 63610 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:27:02.038300 0.000000 tcp 10.0.2.105 63610 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:27:06.788606 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:27:07.957217 2.965134 tcp 10.0.2.105 63611 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:27:16.848849 0.000000 tcp 10.0.2.105 63611 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:28:46.547751 2.952740 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:28:53.455663 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:29:01.341151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:29:17.115511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:29:48.684873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:35:48.402304 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:35:48.402492 1.744509 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:50.126295 0.390724 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:50.460070 0.230538 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:50.683529 0.226374 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:50.908972 0.194939 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.143808 0.120675 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.223847 0.226839 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.443579 0.064104 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.527996 0.189070 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.698516 0.175673 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.877947 0.068467 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:51.889326 3.001397 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 12:35:51.938995 0.104649 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:52.026941 0.188106 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:52.189442 0.449408 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:52.616142 0.243115 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:52.851789 0.079526 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:52.915557 0.353213 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:53.258553 0.164974 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:53.414607 0.088759 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:53.528216 0.235550 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:53.743594 0.118259 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:53.871569 0.150334 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:54.011614 0.212133 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:54.220678 0.178509 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:55.096210 0.197214 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:55.368940 0.068939 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:55.808916 0.353101 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:56.158167 0.376532 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:56.531094 0.434021 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:56.934760 0.216206 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:57.147545 0.224654 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:57.347374 0.212811 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/24 12:35:58.896289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:36:04.915237 3.003560 tcp 10.0.2.105 63612 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:06.897751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:36:12.705728 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:36:13.919011 0.000000 tcp 10.0.2.105 63612 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:19.918450 0.055557 tcp 10.0.2.105 63613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:19.974353 0.054365 tcp 10.0.2.105 63614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:20.029009 0.149078 tcp 10.0.2.105 63615 -> 195.113.214.249 443 SRPA* 0 0 41 22254 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:20.235513 3.005677 tcp 10.0.2.105 63616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:22.900992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:36:29.242755 0.000000 tcp 10.0.2.105 63616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:35.228907 0.053380 tcp 10.0.2.105 63617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:35.282634 0.054565 tcp 10.0.2.105 63618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:35.337544 0.157264 tcp 10.0.2.105 63619 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:35.566941 2.996404 tcp 10.0.2.105 63620 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:44.572167 0.000000 tcp 10.0.2.105 63620 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:50.561115 0.055382 tcp 10.0.2.105 63621 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:50.616780 0.053159 tcp 10.0.2.105 63622 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:50.670231 0.145219 tcp 10.0.2.105 63623 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:36:51.003483 3.001674 tcp 10.0.2.105 63624 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:36:54.906411 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:37:00.004024 0.000000 tcp 10.0.2.105 63624 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:37:06.002969 3.003887 tcp 10.0.2.105 63625 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:37:15.005168 0.000000 tcp 10.0.2.105 63625 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:37:19.702188 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:37:21.004411 3.004478 tcp 10.0.2.105 63626 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:37:30.007189 0.000000 tcp 10.0.2.105 63626 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:42:36.008082 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:42:36.008332 3.003749 tcp 10.0.2.105 63627 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:42:45.010125 0.000000 tcp 10.0.2.105 63627 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:42:51.014441 0.055683 tcp 10.0.2.105 63628 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:42:51.070427 0.055034 tcp 10.0.2.105 63629 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:42:51.125804 0.156468 tcp 10.0.2.105 63630 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:42:51.575361 2.988362 tcp 10.0.2.105 63631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:42:58.911939 3.002455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:43:00.572258 0.000000 tcp 10.0.2.105 63631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:05.919599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:43:06.571933 0.077531 tcp 10.0.2.105 63632 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:06.649747 0.055993 tcp 10.0.2.105 63633 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:06.705994 0.147875 tcp 10.0.2.105 63634 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:06.927144 2.998799 tcp 10.0.2.105 63635 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:13.921319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:43:15.924597 0.000000 tcp 10.0.2.105 63635 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:21.923920 0.054157 tcp 10.0.2.105 63636 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:21.978372 0.054990 tcp 10.0.2.105 63637 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:22.033690 0.148627 tcp 10.0.2.105 63638 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:43:22.634692 3.010280 tcp 10.0.2.105 63639 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:29.924227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:43:31.637258 0.000000 tcp 10.0.2.105 63639 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:37.636041 3.004005 tcp 10.0.2.105 63640 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:46.638655 0.000000 tcp 10.0.2.105 63640 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:43:51.205288 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:43:52.637626 3.004039 tcp 10.0.2.105 63641 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:44:01.640204 0.000000 tcp 10.0.2.105 63641 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:44:01.930995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:49:07.640780 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:49:07.640927 2.993151 tcp 10.0.2.105 63642 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:16.643209 0.000000 tcp 10.0.2.105 63642 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:22.643832 0.055173 tcp 10.0.2.105 63643 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:22.699292 0.055611 tcp 10.0.2.105 63644 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:22.755162 0.147563 tcp 10.0.2.105 63645 -> 195.113.214.249 443 SRPA* 0 0 41 21628 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:23.024446 3.001629 tcp 10.0.2.105 63646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:32.025289 0.000000 tcp 10.0.2.105 63646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:38.024584 0.053268 tcp 10.0.2.105 63647 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:38.078120 0.055570 tcp 10.0.2.105 63648 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:38.133969 0.279595 tcp 10.0.2.105 63649 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:38.500662 2.998250 tcp 10.0.2.105 63650 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:47.497728 0.000000 tcp 10.0.2.105 63650 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:49:53.496855 0.054703 tcp 10.0.2.105 63651 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:53.551852 0.053614 tcp 10.0.2.105 63652 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:53.605714 0.156472 tcp 10.0.2.105 63653 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:49:53.878332 3.003018 tcp 10.0.2.105 63654 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:50:02.879833 0.000000 tcp 10.0.2.105 63654 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:50:08.879756 4.003489 tcp 10.0.2.105 63655 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:50:18.811780 0.000000 tcp 10.0.2.105 63655 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:50:23.578810 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:50:24.747870 2.955017 tcp 10.0.2.105 63656 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:50:33.640597 0.000000 tcp 10.0.2.105 63656 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:55:38.893081 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:55:38.893252 3.003928 tcp 10.0.2.105 63657 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:55:41.940003 3.001829 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 12:55:47.895427 0.000000 tcp 10.0.2.105 63657 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:55:48.947067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:55:53.895920 0.054908 tcp 10.0.2.105 63658 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:55:53.951102 0.055514 tcp 10.0.2.105 63659 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:55:54.006895 0.147286 tcp 10.0.2.105 63660 -> 195.113.214.249 443 SRPA* 0 0 23 13828 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:55:54.449341 3.000109 tcp 10.0.2.105 63661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:55:56.948837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:56:03.448579 0.000000 tcp 10.0.2.105 63661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:09.447350 0.054441 tcp 10.0.2.105 63662 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:09.502069 0.055602 tcp 10.0.2.105 63663 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:09.557973 0.144898 tcp 10.0.2.105 63664 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:09.719421 3.001923 tcp 10.0.2.105 63665 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:12.951722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:56:18.719960 0.000000 tcp 10.0.2.105 63665 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:24.719506 0.055357 tcp 10.0.2.105 63666 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:24.775130 0.054664 tcp 10.0.2.105 63667 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:24.830111 0.148599 tcp 10.0.2.105 63668 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 12:56:25.976184 2.998624 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:34.973496 0.000000 tcp 10.0.2.105 63669 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:40.972404 2.994163 tcp 10.0.2.105 63670 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:44.957880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 12:56:48.704019 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 12:56:49.965090 0.000000 tcp 10.0.2.105 63670 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:56:55.975240 3.002825 tcp 10.0.2.105 63671 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 12:57:04.976190 0.000000 tcp 10.0.2.105 63671 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:02:48.964661 3.000839 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 13:02:56.069752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:03:04.004607 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:03:19.990888 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:03:51.991780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:06:18.515831 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:06:18.515957 1.134116 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:19.629249 0.215281 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:22.358893 0.196282 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:24.531210 0.110098 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:24.861485 0.445727 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:26.003125 3.004525 tcp 10.0.2.105 63672 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:06:27.795070 0.230220 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:30.154363 0.222678 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:30.429130 0.194723 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:33.731962 0.192719 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:35.006179 0.000000 tcp 10.0.2.105 63672 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:06:35.121991 0.184432 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:35.310650 0.061675 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:35.498830 0.115236 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:35.785230 0.184627 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:36.003976 0.077713 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:36.624404 0.481853 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:37.359777 0.242580 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:38.102396 0.357160 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:41.010066 0.055077 tcp 10.0.2.105 63673 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:06:41.065409 0.054853 tcp 10.0.2.105 63674 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:06:41.120546 0.147533 tcp 10.0.2.105 63675 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:06:41.441136 0.166663 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:41.489942 3.000034 tcp 10.0.2.105 63676 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:06:41.597797 0.092124 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:42.175112 0.237618 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:43.396580 0.118214 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:44.230126 0.153592 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:44.960034 0.212858 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:45.405409 0.180892 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:45.687181 0.354514 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:46.507754 0.197008 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:47.018620 0.068035 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:47.235410 0.353452 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:47.585168 0.359549 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:48.652580 0.229199 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:50.196232 0.399241 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:06:50.666428 0.000000 tcp 10.0.2.105 63676 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:06:50.977459 0.207778 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 1986 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:10:20.003866 3.000189 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:10:27.251373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:10:35.178258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:10:51.025492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:11:23.030635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:11:56.489301 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:11:56.489413 3.003279 tcp 10.0.2.105 63677 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:05.491339 0.000000 tcp 10.0.2.105 63677 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:13.473988 0.060285 tcp 10.0.2.105 63678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:13.534587 0.054949 tcp 10.0.2.105 63679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:13.590031 0.143727 tcp 10.0.2.105 63680 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:14.204660 2.953285 tcp 10.0.2.105 63681 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:23.083729 0.000000 tcp 10.0.2.105 63681 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:29.019450 0.053600 tcp 10.0.2.105 63682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:29.073344 0.054418 tcp 10.0.2.105 63683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:29.128106 0.151946 tcp 10.0.2.105 63684 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:29.329983 2.958170 tcp 10.0.2.105 63685 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:38.216152 0.000000 tcp 10.0.2.105 63685 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:44.142102 0.054263 tcp 10.0.2.105 63686 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:44.196673 0.053679 tcp 10.0.2.105 63687 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:44.250699 0.145296 tcp 10.0.2.105 63688 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:12:44.653417 2.967459 tcp 10.0.2.105 63689 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:53.543029 0.000000 tcp 10.0.2.105 63689 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:12:59.461266 2.972565 tcp 10.0.2.105 63690 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:13:08.355770 0.000000 tcp 10.0.2.105 63690 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:13:12.927190 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:13:14.276824 2.971954 tcp 10.0.2.105 63691 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:13:23.181785 0.000000 tcp 10.0.2.105 63691 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:17:27.035683 3.002294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:17:34.043518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:17:42.044747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:17:58.048556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:18:28.072002 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:18:28.072158 2.992888 tcp 10.0.2.105 63692 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:18:30.054086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:18:37.064170 0.000000 tcp 10.0.2.105 63692 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:18:43.074887 0.055563 tcp 10.0.2.105 63693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:43.130781 0.055010 tcp 10.0.2.105 63694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:43.186028 0.144005 tcp 10.0.2.105 63695 -> 195.113.214.249 443 SRPA* 0 0 42 21682 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:43.428322 2.999608 tcp 10.0.2.105 63696 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:18:52.426639 0.000000 tcp 10.0.2.105 63696 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:18:58.425679 0.054756 tcp 10.0.2.105 63697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:58.480693 0.054016 tcp 10.0.2.105 63698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:58.535019 0.151053 tcp 10.0.2.105 63699 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:18:59.107079 3.002772 tcp 10.0.2.105 63700 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:09.050870 0.000000 tcp 10.0.2.105 63700 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:14.975145 0.055778 tcp 10.0.2.105 63701 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:19:15.031210 0.152521 tcp 10.0.2.105 63702 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:19:15.184078 0.141466 tcp 10.0.2.105 63703 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:19:16.297494 2.957090 tcp 10.0.2.105 63704 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:25.190662 0.000000 tcp 10.0.2.105 63704 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:31.117580 2.954290 tcp 10.0.2.105 63705 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:38.783350 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:19:39.999729 0.000000 tcp 10.0.2.105 63705 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:45.935292 2.961333 tcp 10.0.2.105 63706 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:19:54.823915 0.000000 tcp 10.0.2.105 63706 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:24:34.061100 3.000886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:24:41.067537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:24:49.071336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:25:00.446582 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:25:00.446690 3.003031 tcp 10.0.2.105 63707 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:05.072192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:25:09.448788 0.000000 tcp 10.0.2.105 63707 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:15.449471 0.054555 tcp 10.0.2.105 63708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:15.504315 0.054882 tcp 10.0.2.105 63709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:15.559500 0.142267 tcp 10.0.2.105 63710 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:15.888993 3.003536 tcp 10.0.2.105 63711 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:24.890732 0.000000 tcp 10.0.2.105 63711 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:30.890073 0.094008 tcp 10.0.2.105 63712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:30.984386 0.056433 tcp 10.0.2.105 63713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:31.041241 0.145099 tcp 10.0.2.105 63714 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:31.357625 2.996713 tcp 10.0.2.105 63715 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:37.078278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:25:40.363109 0.000000 tcp 10.0.2.105 63715 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:46.352197 0.053396 tcp 10.0.2.105 63716 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:46.406018 0.054199 tcp 10.0.2.105 63717 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:46.460511 0.435118 tcp 10.0.2.105 63718 -> 195.113.214.249 443 SRPA* 0 0 78 77490 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:25:47.167399 2.989408 tcp 10.0.2.105 63719 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:25:56.155747 0.000000 tcp 10.0.2.105 63719 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:26:02.153903 3.004715 tcp 10.0.2.105 63720 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:26:11.157202 0.000000 tcp 10.0.2.105 63720 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:26:15.703445 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:26:17.155391 4.717387 tcp 10.0.2.105 63721 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:26:27.798918 0.000000 tcp 10.0.2.105 63721 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:31:32.169466 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:31:32.169672 3.003269 tcp 10.0.2.105 63722 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:31:41.084999 3.001183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:31:41.181848 0.000000 tcp 10.0.2.105 63722 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:31:47.172194 0.054377 tcp 10.0.2.105 63723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:31:47.226874 0.054270 tcp 10.0.2.105 63724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:31:47.281548 0.145766 tcp 10.0.2.105 63725 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:31:47.467009 2.998263 tcp 10.0.2.105 63726 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:31:48.091795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:31:56.093358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:31:56.463556 0.000000 tcp 10.0.2.105 63726 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:02.463239 0.053504 tcp 10.0.2.105 63727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:02.517105 0.056523 tcp 10.0.2.105 63728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:02.573893 0.154710 tcp 10.0.2.105 63729 -> 195.113.214.249 443 SRPA* 0 0 67 69796 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:03.602077 2.995994 tcp 10.0.2.105 63730 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:12.096192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:32:12.596924 0.000000 tcp 10.0.2.105 63730 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:18.596128 0.053766 tcp 10.0.2.105 63731 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:18.650179 0.056005 tcp 10.0.2.105 63732 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:18.706021 0.147393 tcp 10.0.2.105 63733 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:32:18.863291 3.007548 tcp 10.0.2.105 63734 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:27.868868 0.000000 tcp 10.0.2.105 63734 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:33.857634 3.003950 tcp 10.0.2.105 63735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:42.862884 0.000000 tcp 10.0.2.105 63735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:44.102908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:32:47.707432 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:32:48.859124 2.993984 tcp 10.0.2.105 63736 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:32:57.862656 0.000000 tcp 10.0.2.105 63736 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:37:15.172717 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:37:15.172883 0.735728 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:15.887666 0.215271 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:16.285290 0.195517 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:17.327243 0.110907 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:17.493684 0.381348 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2070 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:17.825230 0.232308 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:18.261111 0.220399 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:18.482106 0.057347 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:18.850521 0.182965 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:19.028862 0.189334 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:19.747517 0.184107 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:20.592448 0.060610 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:21.225882 0.108659 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:22.124114 0.075288 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:22.222640 0.447269 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:22.646592 0.246278 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:22.885865 0.345692 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:23.221757 0.161660 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2060 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:23.819834 0.087536 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:23.971273 0.231004 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:24.181550 0.118110 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:25.522288 0.148801 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:25.661466 0.225202 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:26.386648 0.175224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:26.559021 0.353964 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:26.909648 0.189765 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:27.564808 0.069092 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:27.703005 0.372216 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:28.071723 0.356704 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:28.402262 0.356386 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:28.755855 0.224852 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:37:29.462038 0.213871 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/24 13:38:03.862273 2.994139 tcp 10.0.2.105 63737 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:08.708859 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:38:12.855171 0.000000 tcp 10.0.2.105 63737 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:18.865862 0.055537 tcp 10.0.2.105 63738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:18.921690 0.054000 tcp 10.0.2.105 63739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:18.975983 0.146420 tcp 10.0.2.105 63740 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:19.134214 3.003814 tcp 10.0.2.105 63741 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:28.136960 0.000000 tcp 10.0.2.105 63741 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:34.136040 0.054814 tcp 10.0.2.105 63742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:34.191093 0.057316 tcp 10.0.2.105 63743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:34.248800 0.152800 tcp 10.0.2.105 63744 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:34.499576 3.000876 tcp 10.0.2.105 63745 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:43.499225 0.000000 tcp 10.0.2.105 63745 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:48.108388 3.001501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:38:49.498205 0.053619 tcp 10.0.2.105 63746 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:49.552138 0.054257 tcp 10.0.2.105 63747 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:49.606682 0.143781 tcp 10.0.2.105 63748 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:38:49.762815 2.999067 tcp 10.0.2.105 63749 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:38:55.115475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:38:58.760862 0.000000 tcp 10.0.2.105 63749 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:39:03.117017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:39:04.759694 2.993984 tcp 10.0.2.105 63750 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:39:13.762602 0.000000 tcp 10.0.2.105 63750 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:39:18.709460 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:39:19.120143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:39:19.760995 2.994053 tcp 10.0.2.105 63751 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:39:28.753992 0.000000 tcp 10.0.2.105 63751 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:39:51.126215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:44:34.764458 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:44:34.764635 3.003947 tcp 10.0.2.105 63752 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:44:43.767007 0.000000 tcp 10.0.2.105 63752 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:44:49.766678 0.054808 tcp 10.0.2.105 63753 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:44:49.821815 0.061245 tcp 10.0.2.105 63754 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:44:49.883367 0.139374 tcp 10.0.2.105 63755 -> 195.113.214.249 443 SRPA* 0 0 39 30868 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:44:50.115626 3.004493 tcp 10.0.2.105 63756 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:44:59.119121 0.000000 tcp 10.0.2.105 63756 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:05.118393 0.054498 tcp 10.0.2.105 63757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:05.173195 0.055898 tcp 10.0.2.105 63758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:05.229378 0.147416 tcp 10.0.2.105 63759 -> 195.113.214.249 443 SRPA* 0 0 41 22254 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:05.734834 3.007969 tcp 10.0.2.105 63760 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:14.751531 0.000000 tcp 10.0.2.105 63760 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:20.730707 0.054261 tcp 10.0.2.105 63761 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:20.785276 0.055541 tcp 10.0.2.105 63762 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:20.841100 0.144989 tcp 10.0.2.105 63763 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:45:22.208243 2.998354 tcp 10.0.2.105 63764 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:31.205079 0.000000 tcp 10.0.2.105 63764 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:37.204034 3.004067 tcp 10.0.2.105 63765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:45.205176 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:45:46.206501 0.000000 tcp 10.0.2.105 63765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:52.205654 3.004051 tcp 10.0.2.105 63766 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:45:55.132047 3.001781 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:46:01.208672 0.000000 tcp 10.0.2.105 63766 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:46:02.139671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:46:10.141034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:46:26.143527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:46:58.150161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:51:07.208884 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:51:07.209084 3.003602 tcp 10.0.2.105 63767 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:16.211170 0.000000 tcp 10.0.2.105 63767 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:22.211463 0.055885 tcp 10.0.2.105 63768 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:22.267722 0.054745 tcp 10.0.2.105 63769 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:22.322272 0.148221 tcp 10.0.2.105 63770 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:22.601118 2.993650 tcp 10.0.2.105 63771 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:31.593366 0.000000 tcp 10.0.2.105 63771 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:37.602717 0.053840 tcp 10.0.2.105 63772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:37.656877 0.054470 tcp 10.0.2.105 63773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:37.711628 0.139513 tcp 10.0.2.105 63774 -> 195.113.214.249 443 SRPA* 0 0 37 29300 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:37.951608 2.994634 tcp 10.0.2.105 63775 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:46.944687 0.000000 tcp 10.0.2.105 63775 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:51:53.054981 0.053954 tcp 10.0.2.105 63776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:53.109222 0.053931 tcp 10.0.2.105 63777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:53.163088 0.226766 tcp 10.0.2.105 63778 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:51:53.942279 2.997324 tcp 10.0.2.105 63779 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:52:02.938496 0.000000 tcp 10.0.2.105 63779 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:52:08.937224 3.003912 tcp 10.0.2.105 63780 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:52:16.707905 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:52:17.939713 0.000000 tcp 10.0.2.105 63780 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:52:23.938790 3.004088 tcp 10.0.2.105 63781 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:52:32.951429 0.000000 tcp 10.0.2.105 63781 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:53:02.156713 3.000992 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 13:53:09.163341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:53:17.165235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:53:33.168158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:54:05.174257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 13:57:38.942306 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:57:38.942485 2.993309 tcp 10.0.2.105 63782 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:57:47.934436 0.000000 tcp 10.0.2.105 63782 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:57:53.961573 0.055064 tcp 10.0.2.105 63783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:57:54.016998 0.054716 tcp 10.0.2.105 63784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:57:54.072042 0.144284 tcp 10.0.2.105 63785 -> 195.113.214.249 443 SRPA* 0 0 28 13266 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:57:54.231292 2.996378 tcp 10.0.2.105 63786 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:03.225960 0.000000 tcp 10.0.2.105 63786 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:09.225316 0.054113 tcp 10.0.2.105 63787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:09.279741 0.056051 tcp 10.0.2.105 63788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:09.336087 0.150027 tcp 10.0.2.105 63789 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:09.497315 3.002229 tcp 10.0.2.105 63790 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:18.498211 0.000000 tcp 10.0.2.105 63790 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:24.497729 0.053949 tcp 10.0.2.105 63791 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:24.551958 0.055041 tcp 10.0.2.105 63792 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:24.607297 0.144512 tcp 10.0.2.105 63793 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/24 13:58:25.556604 3.006078 tcp 10.0.2.105 63794 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:34.565358 0.000000 tcp 10.0.2.105 63794 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:40.550293 2.993961 tcp 10.0.2.105 63795 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:48.200930 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 13:58:49.552844 0.000000 tcp 10.0.2.105 63795 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:58:55.551773 2.997178 tcp 10.0.2.105 63796 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 13:59:04.544495 0.000000 tcp 10.0.2.105 63796 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:00:09.180274 3.001646 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:00:16.187384 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:00:24.189118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:00:40.192524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:01:12.198082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:07:18.207699 3.001769 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 14:07:25.214247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:07:33.215717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:07:42.139702 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:07:42.139820 0.904926 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2411 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:43.022833 0.227115 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:44.385207 0.404606 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:45.581427 0.229705 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:45.803562 0.195982 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:45.988569 0.110528 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:46.078403 0.226427 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:46.296492 0.057721 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:46.381111 0.189292 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:46.543832 0.181438 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:46.855073 0.183735 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:47.281059 0.067651 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:47.330006 0.130076 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:47.549098 0.068753 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:47.602925 0.446298 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:48.026151 0.243239 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:48.261940 0.357650 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:48.608991 0.243379 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:48.830768 0.169655 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:49.219029 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:07:49.252891 0.087338 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:49.847066 0.118030 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:49.980976 0.154085 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:50.125117 0.212853 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:50.335100 0.167888 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:50.499709 0.346880 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:50.842721 0.347941 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:51.187036 0.196374 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:51.583513 0.074773 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:51.899849 0.373539 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:52.246337 0.210630 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2076 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:52.453777 0.225278 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:52.653991 0.212927 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:07:55.578460 3.003946 tcp 10.0.2.105 63797 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:04.581036 0.000000 tcp 10.0.2.105 63797 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:09.207456 0.000166 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:08:10.581476 0.056017 tcp 10.0.2.105 63798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:10.637885 0.054372 tcp 10.0.2.105 63799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:10.692583 0.150633 tcp 10.0.2.105 63800 -> 195.113.214.249 443 SRPA* 0 0 41 21172 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:10.941462 2.994030 tcp 10.0.2.105 63801 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:19.932899 0.000000 tcp 10.0.2.105 63801 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:21.224562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:08:25.942502 0.054061 tcp 10.0.2.105 63802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:25.996953 0.054481 tcp 10.0.2.105 63803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:26.051845 0.145981 tcp 10.0.2.105 63804 -> 195.113.214.249 443 SRPA* 0 0 26 12702 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:26.223170 3.003324 tcp 10.0.2.105 63805 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:35.225100 0.000000 tcp 10.0.2.105 63805 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:41.224441 0.054184 tcp 10.0.2.105 63806 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:41.278945 0.054604 tcp 10.0.2.105 63807 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:41.333940 0.144110 tcp 10.0.2.105 63808 -> 195.113.214.249 443 SRPA* 0 0 41 22594 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:08:41.625704 3.006488 tcp 10.0.2.105 63809 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:50.627327 0.000000 tcp 10.0.2.105 63809 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:08:56.615913 3.004116 tcp 10.0.2.105 63810 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:09:05.619002 0.000000 tcp 10.0.2.105 63810 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:09:10.205444 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:09:11.617460 3.004564 tcp 10.0.2.105 63811 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:09:20.620120 0.000000 tcp 10.0.2.105 63811 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:14:25.231178 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:14:26.620900 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:14:26.621086 2.993700 tcp 10.0.2.105 63812 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:14:32.238565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:14:35.613083 0.000000 tcp 10.0.2.105 63812 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:14:40.241372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:14:41.623768 0.054858 tcp 10.0.2.105 63813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:41.679020 0.053797 tcp 10.0.2.105 63814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:41.733164 0.143247 tcp 10.0.2.105 63815 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:42.661680 2.995956 tcp 10.0.2.105 63816 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:14:51.655987 0.000000 tcp 10.0.2.105 63816 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:14:56.242687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:14:57.655522 0.053712 tcp 10.0.2.105 63817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:57.709487 0.055245 tcp 10.0.2.105 63818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:57.765065 0.143360 tcp 10.0.2.105 63819 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:14:58.830065 3.000239 tcp 10.0.2.105 63820 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:07.829496 0.000000 tcp 10.0.2.105 63820 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:13.828866 0.053735 tcp 10.0.2.105 63821 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:15:13.882887 0.054540 tcp 10.0.2.105 63822 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:15:13.937830 0.142570 tcp 10.0.2.105 63823 -> 195.113.214.249 443 SRPA* 0 0 43 20940 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:15:15.075229 2.998842 tcp 10.0.2.105 63824 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:24.082896 0.000000 tcp 10.0.2.105 63824 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:28.249012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:15:30.071487 2.994232 tcp 10.0.2.105 63825 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:37.702334 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:15:39.064063 0.000000 tcp 10.0.2.105 63825 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:45.072851 4.871255 tcp 10.0.2.105 63826 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:15:55.868257 0.000000 tcp 10.0.2.105 63826 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:00.086652 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:21:00.086831 3.006250 tcp 10.0.2.105 63827 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:09.089062 0.000000 tcp 10.0.2.105 63827 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:15.089444 0.055093 tcp 10.0.2.105 63828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:15.144830 0.054201 tcp 10.0.2.105 63829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:15.199368 0.145181 tcp 10.0.2.105 63830 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:15.394449 3.007713 tcp 10.0.2.105 63831 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:24.402013 0.000000 tcp 10.0.2.105 63831 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:30.389906 0.053980 tcp 10.0.2.105 63832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:30.443759 0.053646 tcp 10.0.2.105 63833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:30.497666 0.149788 tcp 10.0.2.105 63834 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:31.094917 2.999726 tcp 10.0.2.105 63835 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:32.254471 3.002062 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:21:39.262669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:21:40.092926 0.000000 tcp 10.0.2.105 63835 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:46.213016 0.054408 tcp 10.0.2.105 63836 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:46.267769 0.054684 tcp 10.0.2.105 63837 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:46.322806 0.143258 tcp 10.0.2.105 63838 -> 195.113.214.249 443 SRPA* 0 0 35 18782 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:21:46.521597 2.975975 tcp 10.0.2.105 63839 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:21:47.373761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:21:55.447291 0.000000 tcp 10.0.2.105 63839 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:22:01.404302 3.007077 tcp 10.0.2.105 63840 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:22:03.272104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:22:10.407053 0.000000 tcp 10.0.2.105 63840 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:22:15.203692 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:22:16.406931 3.003273 tcp 10.0.2.105 63841 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:22:25.408899 0.000000 tcp 10.0.2.105 63841 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:22:35.273195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:27:31.409012 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:27:31.409101 3.004059 tcp 10.0.2.105 63842 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:27:40.421502 0.000000 tcp 10.0.2.105 63842 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:27:46.411973 0.054389 tcp 10.0.2.105 63843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:27:46.466562 0.054326 tcp 10.0.2.105 63844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:27:46.521187 0.147758 tcp 10.0.2.105 63845 -> 195.113.214.249 443 SRPA* 0 0 21 11730 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:27:46.938346 2.996562 tcp 10.0.2.105 63846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:27:55.935846 0.000000 tcp 10.0.2.105 63846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:01.932632 0.055213 tcp 10.0.2.105 63847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:01.988151 0.055489 tcp 10.0.2.105 63848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:02.043923 0.146451 tcp 10.0.2.105 63849 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:02.347818 2.999551 tcp 10.0.2.105 63850 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:11.346041 0.000000 tcp 10.0.2.105 63850 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:17.345493 0.054125 tcp 10.0.2.105 63851 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:17.399956 0.053257 tcp 10.0.2.105 63852 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:17.453550 0.143271 tcp 10.0.2.105 63853 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:28:17.632016 2.997222 tcp 10.0.2.105 63854 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:26.628110 0.000000 tcp 10.0.2.105 63854 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:32.627555 3.005753 tcp 10.0.2.105 63855 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:39.278634 3.001845 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:28:41.629654 0.000000 tcp 10.0.2.105 63855 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:46.206139 0.863018 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:28:47.128967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:28:48.458850 2.970306 tcp 10.0.2.105 63856 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:28:55.036038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:28:57.356490 0.000000 tcp 10.0.2.105 63856 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:29:10.850221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:29:42.460426 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:35:46.304046 3.000253 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 14:35:53.310226 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:36:01.311619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:36:17.314738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:36:49.320834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:37:54.815177 0.000172 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:37:54.815459 1.626750 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:56.420419 0.208839 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:56.693045 0.354523 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:57.585111 0.230574 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:57.807871 0.197224 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:58.271757 0.113824 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:58.707019 0.222279 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2583 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:58.921202 0.063692 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:37:58.983294 0.189692 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:00.642254 0.068243 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:00.832428 0.185089 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:01.757072 0.185397 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:02.046363 0.447232 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:02.470784 0.247628 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:02.917287 3.003742 tcp 10.0.2.105 63857 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:03.295900 0.099373 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:03.398284 0.086812 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:03.500690 0.358561 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:06.635981 0.235078 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:07.157899 0.163023 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2471 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:07.347987 0.154011 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:07.493103 0.085970 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:07.673101 0.117385 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:07.908811 0.353474 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:08.257821 0.215602 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:08.470588 0.174596 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:08.642181 0.361240 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:08.999518 0.200614 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:09.195696 0.070613 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:09.397422 0.237202 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:09.610614 0.213430 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:10.722969 0.354673 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:11.048444 0.215572 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/24 14:38:11.919406 0.000000 tcp 10.0.2.105 63857 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:17.920424 0.056676 tcp 10.0.2.105 63858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:17.977488 0.054351 tcp 10.0.2.105 63859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:18.032220 0.142827 tcp 10.0.2.105 63860 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:18.319974 3.003097 tcp 10.0.2.105 63861 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:27.331544 0.000000 tcp 10.0.2.105 63861 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:33.320820 0.053147 tcp 10.0.2.105 63862 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:33.374280 0.054516 tcp 10.0.2.105 63863 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:33.429124 0.147030 tcp 10.0.2.105 63864 -> 195.113.214.249 443 SRPA* 0 0 40 30920 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:38:33.894992 3.000216 tcp 10.0.2.105 63865 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:42.893518 0.000000 tcp 10.0.2.105 63865 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:48.892790 3.004348 tcp 10.0.2.105 63866 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:38:57.895171 0.000000 tcp 10.0.2.105 63866 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:39:02.702602 0.424784 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:42:53.326521 3.002025 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:43:00.334272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:43:08.336040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:43:24.338515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:43:56.344717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:44:03.895849 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:44:03.896034 3.003841 tcp 10.0.2.105 63867 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:12.898599 0.000000 tcp 10.0.2.105 63867 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:18.899666 0.055803 tcp 10.0.2.105 63868 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:18.955797 0.054478 tcp 10.0.2.105 63869 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:19.010565 0.142560 tcp 10.0.2.105 63870 -> 195.113.214.249 443 SRPA* 0 0 40 30922 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:19.198246 3.003604 tcp 10.0.2.105 63871 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:28.200549 0.000000 tcp 10.0.2.105 63871 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:34.416938 0.053714 tcp 10.0.2.105 63872 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:34.470940 0.053984 tcp 10.0.2.105 63873 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:34.525244 0.146064 tcp 10.0.2.105 63874 -> 195.113.214.249 443 SRPA* 0 0 42 22476 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:34.719695 2.970382 tcp 10.0.2.105 63875 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:43.641524 0.000000 tcp 10.0.2.105 63875 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:49.573665 0.054195 tcp 10.0.2.105 63876 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:49.628116 0.054466 tcp 10.0.2.105 63877 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:49.682937 0.144492 tcp 10.0.2.105 63878 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:44:50.099634 2.969230 tcp 10.0.2.105 63879 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:44:59.034930 0.000000 tcp 10.0.2.105 63879 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:45:05.033485 3.004175 tcp 10.0.2.105 63880 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:45:14.036411 0.000000 tcp 10.0.2.105 63880 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:45:18.702974 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:45:20.035318 3.003987 tcp 10.0.2.105 63881 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:45:29.038171 0.000000 tcp 10.0.2.105 63881 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:50:35.038409 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:50:35.038538 3.003422 tcp 10.0.2.105 63882 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:50:44.040976 0.000000 tcp 10.0.2.105 63882 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:50:50.041273 0.054704 tcp 10.0.2.105 63883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:50:50.096263 0.091773 tcp 10.0.2.105 63884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:50:50.188496 0.148312 tcp 10.0.2.105 63885 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:50:51.902767 2.993482 tcp 10.0.2.105 63886 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:00.897229 0.000000 tcp 10.0.2.105 63886 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:06.903965 1.776938 tcp 10.0.2.105 63887 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:08.681156 0.053748 tcp 10.0.2.105 63888 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:08.735315 0.144228 tcp 10.0.2.105 63889 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:09.701130 2.969123 tcp 10.0.2.105 63890 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:18.590603 0.000000 tcp 10.0.2.105 63890 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:24.500853 0.054031 tcp 10.0.2.105 63891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:24.555315 0.053938 tcp 10.0.2.105 63892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:24.609509 0.145594 tcp 10.0.2.105 63893 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:51:25.950077 2.968207 tcp 10.0.2.105 63894 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:34.853604 0.000000 tcp 10.0.2.105 63894 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:40.764526 2.955656 tcp 10.0.2.105 63895 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:48.417799 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:51:49.654476 0.000000 tcp 10.0.2.105 63895 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:51:55.600085 2.954091 tcp 10.0.2.105 63896 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:52:04.483017 0.000000 tcp 10.0.2.105 63896 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:55:36.355644 2.999623 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 14:55:43.361005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:55:51.362835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:56:07.365940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:56:39.372005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 14:57:09.465633 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:57:09.465820 3.003528 tcp 10.0.2.105 63897 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:18.468084 0.000000 tcp 10.0.2.105 63897 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:24.468515 0.054317 tcp 10.0.2.105 63898 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:24.523147 0.054923 tcp 10.0.2.105 63899 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:24.578422 0.149478 tcp 10.0.2.105 63900 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:24.737697 3.003800 tcp 10.0.2.105 63901 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:33.740772 0.000000 tcp 10.0.2.105 63901 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:39.741503 0.053954 tcp 10.0.2.105 63902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:39.795277 0.055412 tcp 10.0.2.105 63903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:39.851060 0.146516 tcp 10.0.2.105 63904 -> 195.113.214.249 443 SRPA* 0 0 38 31194 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:40.131568 2.991753 tcp 10.0.2.105 63905 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:49.132107 0.000000 tcp 10.0.2.105 63905 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:57:55.131644 0.054043 tcp 10.0.2.105 63906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:55.185985 0.053743 tcp 10.0.2.105 63907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:55.240058 0.142437 tcp 10.0.2.105 63908 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 14:57:55.543206 3.002306 tcp 10.0.2.105 63909 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:58:04.543935 0.000000 tcp 10.0.2.105 63909 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:58:10.543070 3.004034 tcp 10.0.2.105 63910 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:58:19.545778 0.000000 tcp 10.0.2.105 63910 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:58:24.201909 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 14:58:25.544786 3.004143 tcp 10.0.2.105 63911 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 14:58:34.547381 0.000000 tcp 10.0.2.105 63911 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:02:43.378119 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:02:50.385431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:02:58.386656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:03:14.390004 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:03:40.547977 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:03:40.548177 3.003275 tcp 10.0.2.105 63912 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:03:46.395704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:03:49.550623 0.000000 tcp 10.0.2.105 63912 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:03:55.550872 0.056293 tcp 10.0.2.105 63913 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:03:55.607436 0.053785 tcp 10.0.2.105 63914 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:03:55.661484 0.143495 tcp 10.0.2.105 63915 -> 195.113.214.249 443 SRPA* 0 0 33 17300 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:03:56.435433 2.998821 tcp 10.0.2.105 63916 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:04:05.443252 0.000000 tcp 10.0.2.105 63916 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:08:25.617400 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:08:25.617565 0.318966 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:25.917169 0.215164 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2063 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:27.109098 0.376488 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:28.556123 0.229690 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:28.778258 0.221691 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:29.802765 0.063289 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:30.645864 0.465068 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:31.198000 0.111883 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2450 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:31.271114 0.188494 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:31.627284 0.336149 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:32.284466 0.186695 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:34.205824 0.183613 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:34.464629 0.451594 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2568 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:34.892303 0.073272 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2611 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:35.137896 0.234902 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:36.280571 0.115428 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:36.786331 0.356386 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:37.318917 0.235988 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:37.670333 0.087588 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:38.516847 0.118326 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:39.703818 1.069360 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:40.783937 0.167275 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:42.140598 0.153250 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:43.113961 0.229147 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:43.887950 0.181692 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:44.234092 0.424076 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:46.114694 0.196555 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:47.601704 0.064259 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:47.834756 0.236727 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:48.232623 0.226144 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:49.150538 0.365337 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:49.921947 0.228417 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2497 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:08:50.790848 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:09:11.433930 3.003567 tcp 10.0.2.105 63917 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:16.199844 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:09:20.435841 0.000000 tcp 10.0.2.105 63917 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:26.437370 0.300048 tcp 10.0.2.105 63918 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:26.737703 0.055041 tcp 10.0.2.105 63919 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:26.793021 0.146479 tcp 10.0.2.105 63920 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:29.180316 2.974515 tcp 10.0.2.105 63921 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:38.094170 0.000000 tcp 10.0.2.105 63921 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:44.034113 0.054909 tcp 10.0.2.105 63922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:44.089273 0.055201 tcp 10.0.2.105 63923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:44.144776 0.144527 tcp 10.0.2.105 63924 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:44.635426 2.969599 tcp 10.0.2.105 63925 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:53.573704 0.000000 tcp 10.0.2.105 63925 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:09:59.573605 0.054597 tcp 10.0.2.105 63926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:59.628596 0.054716 tcp 10.0.2.105 63927 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:09:59.683615 0.143933 tcp 10.0.2.105 63928 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:10:00.887095 3.001569 tcp 10.0.2.105 63929 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:09.887143 0.000000 tcp 10.0.2.105 63929 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:14.462836 2.995316 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:10:15.885823 3.004206 tcp 10.0.2.105 63930 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:21.463391 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:10:23.707168 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:10:24.888935 0.000000 tcp 10.0.2.105 63930 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:29.465545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:10:31.012645 2.982707 tcp 10.0.2.105 63931 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:39.944735 0.000000 tcp 10.0.2.105 63931 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:10:45.486180 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:11:18.106903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:15:45.895717 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:15:45.895826 2.988435 tcp 10.0.2.105 63932 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:15:54.882928 0.000000 tcp 10.0.2.105 63932 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:00.893741 0.054481 tcp 10.0.2.105 63933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:00.948513 0.055208 tcp 10.0.2.105 63934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:01.004071 0.146388 tcp 10.0.2.105 63935 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:01.774635 3.002882 tcp 10.0.2.105 63936 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:10.775960 0.000000 tcp 10.0.2.105 63936 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:16.775269 1.127965 tcp 10.0.2.105 63937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:17.903591 0.054553 tcp 10.0.2.105 63938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:17.958468 0.146113 tcp 10.0.2.105 63939 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:18.577485 2.967018 tcp 10.0.2.105 63940 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:27.469723 0.000000 tcp 10.0.2.105 63940 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:33.395449 0.053773 tcp 10.0.2.105 63941 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:33.449485 0.054571 tcp 10.0.2.105 63942 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:33.504350 0.143107 tcp 10.0.2.105 63943 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:16:34.107716 2.972936 tcp 10.0.2.105 63944 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:45.407918 0.000000 tcp 10.0.2.105 63944 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:51.311152 2.951422 tcp 10.0.2.105 63945 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:16:59.519154 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:17:00.536045 0.000000 tcp 10.0.2.105 63945 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:17:06.450516 2.949027 tcp 10.0.2.105 63946 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:17:15.315915 0.000000 tcp 10.0.2.105 63946 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:17:24.460670 2.964465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:17:31.366666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:17:39.339026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:17:55.133061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:18:26.705493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:22:18.234875 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:22:18.235071 3.003749 tcp 10.0.2.105 63947 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:22:27.237228 0.000000 tcp 10.0.2.105 63947 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:22:33.238157 0.054886 tcp 10.0.2.105 63948 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:33.293387 0.054423 tcp 10.0.2.105 63949 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:33.348081 0.143737 tcp 10.0.2.105 63950 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:34.158744 3.002726 tcp 10.0.2.105 63951 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:22:43.159966 0.000000 tcp 10.0.2.105 63951 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:22:49.159683 0.054806 tcp 10.0.2.105 63952 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:49.214344 0.055426 tcp 10.0.2.105 63953 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:49.270033 0.141407 tcp 10.0.2.105 63954 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:22:50.444215 3.000679 tcp 10.0.2.105 63955 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:22:59.443514 0.000000 tcp 10.0.2.105 63955 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:05.442726 0.054521 tcp 10.0.2.105 63956 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:23:05.497559 0.054139 tcp 10.0.2.105 63957 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:23:05.552073 0.141219 tcp 10.0.2.105 63958 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:23:05.822028 2.995075 tcp 10.0.2.105 63959 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:14.815693 0.000000 tcp 10.0.2.105 63959 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:20.814368 3.004295 tcp 10.0.2.105 63960 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:30.007880 0.000000 tcp 10.0.2.105 63960 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:34.847858 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:23:35.946990 2.980467 tcp 10.0.2.105 63961 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:23:44.868738 0.000000 tcp 10.0.2.105 63961 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:24:28.534310 3.001605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:24:35.541627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:24:43.543035 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:24:59.546330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:25:31.552150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:28:50.819789 0.000141 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:28:50.820063 2.992642 tcp 10.0.2.105 63962 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:28:59.822595 0.000000 tcp 10.0.2.105 63962 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:05.821935 0.055043 tcp 10.0.2.105 63963 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:05.877218 0.054762 tcp 10.0.2.105 63964 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:05.932374 0.147698 tcp 10.0.2.105 63965 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:06.222897 3.002182 tcp 10.0.2.105 63966 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:15.223429 0.000000 tcp 10.0.2.105 63966 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:21.223278 1.519148 tcp 10.0.2.105 63967 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:22.742724 0.053760 tcp 10.0.2.105 63968 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:22.796732 0.157398 tcp 10.0.2.105 63969 -> 195.113.214.249 443 SRPA* 0 0 20 11544 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:23.188031 2.957827 tcp 10.0.2.105 63970 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:35.909505 0.000000 tcp 10.0.2.105 63970 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:41.826858 0.053181 tcp 10.0.2.105 63971 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:41.880397 0.055382 tcp 10.0.2.105 63972 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:41.936096 0.142891 tcp 10.0.2.105 63973 -> 195.113.214.249 443 SRPA* 0 0 22 11650 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:29:42.157886 2.959614 tcp 10.0.2.105 63974 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:51.030120 0.000000 tcp 10.0.2.105 63974 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:29:56.941590 2.967272 tcp 10.0.2.105 63975 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:30:05.824461 0.000000 tcp 10.0.2.105 63975 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:30:10.387775 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:30:11.734996 2.964144 tcp 10.0.2.105 63976 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:30:20.612382 0.000000 tcp 10.0.2.105 63976 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:31:39.009816 2.961195 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:31:45.918973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:31:53.804601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:32:09.599405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:32:41.153312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:38:42.582272 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 15:38:49.589867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:38:57.598358 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:39:01.186749 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:39:01.186837 0.954658 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:02.121229 0.213809 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:02.780099 0.363469 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:03.084010 0.231653 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:03.564193 0.221452 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:03.856198 0.063783 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:04.421978 0.196700 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 1998 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:04.608050 0.118190 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:04.807232 0.268260 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:05.886666 0.068263 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:06.355478 0.180745 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:07.233177 3.006346 tcp 10.0.2.105 63977 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:07.233520 0.185631 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:08.370798 0.438459 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:08.786439 0.076562 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:09.754527 0.276599 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 1986 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:12.088780 0.102533 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:13.587641 0.964430 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:14.190931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:39:14.540375 0.237047 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:15.294939 0.093435 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:15.552073 0.118589 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:15.724973 0.349398 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:16.214075 0.164877 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:16.798723 0.000000 tcp 10.0.2.105 63977 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:17.320411 0.153362 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:17.622768 0.213138 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:17.918272 0.181106 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:18.938267 0.379682 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:19.556205 0.223531 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:20.488646 0.193152 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:21.616043 0.068844 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:22.000729 0.215740 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:22.714950 0.054658 tcp 10.0.2.105 63978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:22.769907 0.054806 tcp 10.0.2.105 63979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:22.825010 0.140169 tcp 10.0.2.105 63980 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:23.365660 2.974185 tcp 10.0.2.105 63981 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:23.383520 0.412958 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:23.767228 0.215038 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/24 15:39:32.265275 0.000000 tcp 10.0.2.105 63981 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:38.181456 0.054155 tcp 10.0.2.105 63982 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:38.235925 0.054567 tcp 10.0.2.105 63983 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:38.290774 0.149209 tcp 10.0.2.105 63984 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:39:38.754759 2.957535 tcp 10.0.2.105 63985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:45.808859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:39:47.648855 0.000000 tcp 10.0.2.105 63985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:39:53.562064 2.953814 tcp 10.0.2.105 63986 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:40:02.444375 0.000000 tcp 10.0.2.105 63986 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:40:07.201642 0.528184 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:45:08.454709 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:45:08.454931 3.003679 tcp 10.0.2.105 63987 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:17.457316 0.000000 tcp 10.0.2.105 63987 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:23.457724 0.054212 tcp 10.0.2.105 63988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:23.512375 0.054866 tcp 10.0.2.105 63989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:23.567062 0.143338 tcp 10.0.2.105 63990 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:24.004889 3.005983 tcp 10.0.2.105 63991 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:33.182075 0.000000 tcp 10.0.2.105 63991 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:39.116171 0.053988 tcp 10.0.2.105 63992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:39.170458 0.055003 tcp 10.0.2.105 63993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:39.225773 0.143799 tcp 10.0.2.105 63994 -> 195.113.214.249 443 SRPA* 0 0 20 10710 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:41.270642 2.963102 tcp 10.0.2.105 63995 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:49.622945 3.065681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:45:50.173168 0.000000 tcp 10.0.2.105 63995 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:45:56.211460 0.054183 tcp 10.0.2.105 63996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:56.265908 0.055311 tcp 10.0.2.105 63997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:56.321487 0.146845 tcp 10.0.2.105 63998 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:45:56.658693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:45:56.814586 2.977456 tcp 10.0.2.105 63999 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:04.615190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:46:06.395861 0.000000 tcp 10.0.2.105 63999 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:12.322069 2.974095 tcp 10.0.2.105 64000 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:21.074554 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:46:21.222165 0.000000 tcp 10.0.2.105 64000 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:26.084251 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:46:27.146174 2.970860 tcp 10.0.2.105 64001 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:36.044418 0.000000 tcp 10.0.2.105 64001 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:46:52.695671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:51:41.780439 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:51:41.780622 2.993532 tcp 10.0.2.105 64002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:51:50.782806 0.000000 tcp 10.0.2.105 64002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:51:56.782837 0.054822 tcp 10.0.2.105 64003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:51:56.837929 0.054948 tcp 10.0.2.105 64004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:51:56.893173 0.148540 tcp 10.0.2.105 64005 -> 195.113.214.249 443 SRPA* 0 0 43 32298 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:51:58.723708 3.006766 tcp 10.0.2.105 64006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:07.727136 0.000000 tcp 10.0.2.105 64006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:13.726276 0.055022 tcp 10.0.2.105 64007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:13.781572 0.054226 tcp 10.0.2.105 64008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:13.836099 0.140321 tcp 10.0.2.105 64009 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:14.377587 3.003716 tcp 10.0.2.105 64010 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:23.597434 0.000000 tcp 10.0.2.105 64010 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:29.540832 0.119912 tcp 10.0.2.105 64011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:29.661025 0.465653 tcp 10.0.2.105 64012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:30.126536 0.139051 tcp 10.0.2.105 64013 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:52:31.064809 2.957750 tcp 10.0.2.105 64014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:39.974969 0.000000 tcp 10.0.2.105 64014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:45.917619 2.960500 tcp 10.0.2.105 64015 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:52:53.703286 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:52:54.845046 0.000000 tcp 10.0.2.105 64015 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:53:00.853590 3.004387 tcp 10.0.2.105 64016 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:53:10.184498 0.000000 tcp 10.0.2.105 64016 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:57:04.646349 3.002241 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 15:57:11.653986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:57:19.655738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:57:35.658723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:58:07.668551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 15:58:15.856701 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:58:15.856873 3.003543 tcp 10.0.2.105 64017 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:58:24.861889 0.000000 tcp 10.0.2.105 64017 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:58:30.859533 0.055442 tcp 10.0.2.105 64018 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:30.915276 0.056089 tcp 10.0.2.105 64019 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:30.971651 0.143329 tcp 10.0.2.105 64020 -> 195.113.214.249 443 SRPA* 0 0 20 10710 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:31.437975 2.995211 tcp 10.0.2.105 64021 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:58:40.441672 0.000000 tcp 10.0.2.105 64021 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:58:46.431273 0.053978 tcp 10.0.2.105 64022 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:46.485543 0.054962 tcp 10.0.2.105 64023 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:46.540831 0.143777 tcp 10.0.2.105 64024 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:58:47.037000 2.998331 tcp 10.0.2.105 64025 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:58:56.034320 0.000000 tcp 10.0.2.105 64025 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:02.826269 0.053203 tcp 10.0.2.105 64026 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:59:02.879799 0.055281 tcp 10.0.2.105 64027 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:59:02.935335 0.142998 tcp 10.0.2.105 64028 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 15:59:03.601944 2.963017 tcp 10.0.2.105 64029 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:12.490670 0.000000 tcp 10.0.2.105 64029 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:18.415495 2.975740 tcp 10.0.2.105 64030 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:26.227164 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 15:59:27.328539 0.000000 tcp 10.0.2.105 64030 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:33.254134 2.970446 tcp 10.0.2.105 64031 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 15:59:42.150114 0.000000 tcp 10.0.2.105 64031 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:04:11.671689 3.002003 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:04:18.678118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:04:26.679455 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:04:42.682469 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:04:47.820495 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:04:47.820732 2.993729 tcp 10.0.2.105 64032 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:04:56.822948 0.000000 tcp 10.0.2.105 64032 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:02.823104 0.055049 tcp 10.0.2.105 64033 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:02.878531 0.054380 tcp 10.0.2.105 64034 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:02.933167 0.145849 tcp 10.0.2.105 64035 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:03.115059 3.000666 tcp 10.0.2.105 64036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:12.114932 0.000000 tcp 10.0.2.105 64036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:14.688487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:05:18.114190 0.054627 tcp 10.0.2.105 64037 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:18.169172 0.055562 tcp 10.0.2.105 64038 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:18.224962 0.144663 tcp 10.0.2.105 64039 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:05:18.619181 3.075170 tcp 10.0.2.105 64040 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:27.640477 0.000000 tcp 10.0.2.105 64040 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:33.626214 3.004122 tcp 10.0.2.105 64041 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:42.628804 0.000000 tcp 10.0.2.105 64041 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:05:47.205270 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:09:44.737310 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:09:44.737414 0.488098 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:45.204653 0.517105 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:45.959664 0.358457 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:46.673598 0.315348 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1980 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:49.724817 0.222356 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:50.106105 0.063793 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:50.507419 0.202258 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:51.165271 0.113707 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:52.053024 0.188762 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:52.714167 0.062768 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:52.965110 0.187529 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:54.728024 0.187036 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:56.591339 0.446140 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:57.017017 0.077482 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:57.409482 0.243103 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:57.644979 0.093554 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:09:58.517574 0.365663 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:00.924238 0.117792 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:02.717701 0.297906 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:03.299925 0.085969 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:03.911675 0.352121 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:04.547553 0.207619 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:05.354588 0.155369 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:05.679992 0.224860 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:05.915167 0.176524 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:08.701134 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:10:09.579612 0.450486 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:10.433463 0.224098 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:10.731822 0.200396 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2252 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:12.188236 0.065041 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:12.991425 0.211689 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:13.200235 0.363835 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:14.976670 0.216904 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:10:48.629386 2.996368 tcp 10.0.2.105 64042 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:10:53.205535 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:10:57.631800 0.000000 tcp 10.0.2.105 64042 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:03.632718 0.065566 tcp 10.0.2.105 64043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:03.698637 0.054513 tcp 10.0.2.105 64044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:03.753482 0.150958 tcp 10.0.2.105 64045 -> 195.113.214.249 443 SRPA* 0 0 68 69850 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:04.223728 3.001651 tcp 10.0.2.105 64046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:18.263923 0.000000 tcp 10.0.2.105 64046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:23.653852 2.952228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:11:24.177169 0.053269 tcp 10.0.2.105 64047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:24.230722 0.054424 tcp 10.0.2.105 64048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:24.285422 0.148524 tcp 10.0.2.105 64049 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:25.379930 2.959632 tcp 10.0.2.105 64050 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:30.560528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:11:34.249849 0.000000 tcp 10.0.2.105 64050 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:38.447660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:11:40.157423 0.053731 tcp 10.0.2.105 64051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:40.211433 0.055701 tcp 10.0.2.105 64052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:40.267649 0.147105 tcp 10.0.2.105 64053 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:11:40.724753 2.968076 tcp 10.0.2.105 64054 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:49.605314 0.000000 tcp 10.0.2.105 64054 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:11:54.226173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:11:55.523980 2.955965 tcp 10.0.2.105 64055 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:12:04.408350 0.000000 tcp 10.0.2.105 64055 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:12:09.031793 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:12:10.328280 2.954450 tcp 10.0.2.105 64056 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:12:19.213973 0.000000 tcp 10.0.2.105 64056 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:12:25.812845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:17:21.023789 0.000205 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:17:21.024100 3.003187 tcp 10.0.2.105 64057 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:17:30.026014 0.000000 tcp 10.0.2.105 64057 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:17:36.026259 0.056216 tcp 10.0.2.105 64058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:36.082765 0.053969 tcp 10.0.2.105 64059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:36.137025 0.141831 tcp 10.0.2.105 64060 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:36.419713 3.002821 tcp 10.0.2.105 64061 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:17:45.417938 0.000000 tcp 10.0.2.105 64061 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:17:51.417309 0.143392 tcp 10.0.2.105 64062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:51.561092 0.054558 tcp 10.0.2.105 64063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:51.615964 0.146013 tcp 10.0.2.105 64064 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:17:51.802914 2.983549 tcp 10.0.2.105 64065 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:00.744705 0.000000 tcp 10.0.2.105 64065 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:06.719237 0.110065 tcp 10.0.2.105 64066 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:18:06.829585 0.055160 tcp 10.0.2.105 64067 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:18:06.885074 0.143703 tcp 10.0.2.105 64068 -> 195.113.214.249 443 SRPA* 0 0 22 12940 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:18:07.125293 2.998101 tcp 10.0.2.105 64069 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:16.132463 0.000000 tcp 10.0.2.105 64069 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:22.121501 2.993479 tcp 10.0.2.105 64070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:25.718125 3.002340 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:18:31.113325 0.000000 tcp 10.0.2.105 64070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:32.726135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:18:35.700490 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:18:37.122541 2.994263 tcp 10.0.2.105 64071 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:40.727534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:18:46.115519 0.000000 tcp 10.0.2.105 64071 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:18:56.730732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:19:28.746378 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:23:52.125761 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:23:52.125863 3.003816 tcp 10.0.2.105 64072 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:01.128130 0.000000 tcp 10.0.2.105 64072 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:07.128385 0.053566 tcp 10.0.2.105 64073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:07.182236 0.053840 tcp 10.0.2.105 64074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:07.236394 0.143867 tcp 10.0.2.105 64075 -> 195.113.214.249 443 SRPA* 0 0 18 7302 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:07.476180 2.995410 tcp 10.0.2.105 64076 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:16.470888 0.000000 tcp 10.0.2.105 64076 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:22.469625 0.054509 tcp 10.0.2.105 64077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:22.524483 0.055028 tcp 10.0.2.105 64078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:22.579758 0.141808 tcp 10.0.2.105 64079 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:23.030703 4.392914 tcp 10.0.2.105 64080 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:33.362995 0.000000 tcp 10.0.2.105 64080 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:39.296553 0.054367 tcp 10.0.2.105 64081 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:39.351277 0.054680 tcp 10.0.2.105 64082 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:39.406235 0.140803 tcp 10.0.2.105 64083 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:24:39.767510 2.958495 tcp 10.0.2.105 64084 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:48.651455 0.000000 tcp 10.0.2.105 64084 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:24:54.581531 4.839974 tcp 10.0.2.105 64085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:25:05.793683 0.000000 tcp 10.0.2.105 64085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:25:10.420571 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:25:11.723507 3.042972 tcp 10.0.2.105 64086 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:25:20.680919 0.000000 tcp 10.0.2.105 64086 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:25:35.699664 2.955901 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:25:42.612069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:25:50.505579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:26:06.282823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:26:37.849423 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:30:25.917542 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:30:25.917643 2.966128 tcp 10.0.2.105 64087 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:30:34.800711 0.000000 tcp 10.0.2.105 64087 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:30:40.718056 0.055543 tcp 10.0.2.105 64088 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:40.773937 0.054408 tcp 10.0.2.105 64089 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:40.828757 0.140321 tcp 10.0.2.105 64090 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:41.480706 2.957651 tcp 10.0.2.105 64091 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:30:50.356514 0.000000 tcp 10.0.2.105 64091 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:30:56.280912 0.053364 tcp 10.0.2.105 64092 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:56.334585 0.053999 tcp 10.0.2.105 64093 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:56.388897 0.144254 tcp 10.0.2.105 64094 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:30:57.641567 2.963135 tcp 10.0.2.105 64095 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:06.517739 0.000000 tcp 10.0.2.105 64095 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:12.430112 0.053466 tcp 10.0.2.105 64096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:31:12.483880 0.054461 tcp 10.0.2.105 64097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:31:12.538663 0.147953 tcp 10.0.2.105 64098 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:31:12.919425 2.964694 tcp 10.0.2.105 64099 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:21.799244 0.000000 tcp 10.0.2.105 64099 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:27.710566 2.964893 tcp 10.0.2.105 64100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:36.591934 0.000000 tcp 10.0.2.105 64100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:41.040242 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:31:42.506185 2.951092 tcp 10.0.2.105 64101 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:31:51.382810 0.000000 tcp 10.0.2.105 64101 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:32:40.288723 2.962501 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:32:47.202905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:32:55.091838 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:33:10.882390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:33:42.814648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:39:46.821431 3.000765 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 16:39:53.828050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:40:01.829914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:40:17.832702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:40:41.234079 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:40:41.234173 0.719277 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 5 1737 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:41.727201 0.219177 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:42.521781 0.414786 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:42.885328 0.233851 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:43.239728 0.194642 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:43.422684 0.229752 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:43.645436 0.065371 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.022928 0.113932 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.097359 0.188752 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.353444 0.068058 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.401903 0.187600 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.820714 0.072301 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:44.877709 0.183908 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:45.285891 0.443296 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:45.707027 0.250054 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:45.949695 0.097332 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:46.129788 0.360778 udp 10.0.2.105 7010 <-> 124.58.128.15 5022 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:46.478412 0.117877 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:46.815546 0.240505 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:47.034702 0.097692 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:47.183503 0.353845 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:47.533418 0.215619 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:47.962035 0.196999 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:48.144603 0.153984 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:48.289177 0.180261 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2431 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:48.540640 0.355385 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:48.892081 0.239413 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:49.106657 0.230840 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:49.333093 0.064358 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:49.481349 0.363858 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:49.848954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:40:50.051396 0.355703 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:50.378946 0.222714 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/24 16:40:56.218043 3.005155 tcp 10.0.2.105 64102 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:05.220727 0.000000 tcp 10.0.2.105 64102 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:10.208036 0.000169 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:41:11.221627 0.053771 tcp 10.0.2.105 64103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:11.275836 0.055239 tcp 10.0.2.105 64104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:11.331403 0.141888 tcp 10.0.2.105 64105 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:11.617479 2.996238 tcp 10.0.2.105 64106 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:20.622816 0.000000 tcp 10.0.2.105 64106 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:26.612052 0.054369 tcp 10.0.2.105 64107 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:26.666686 0.055593 tcp 10.0.2.105 64108 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:26.722561 0.146152 tcp 10.0.2.105 64109 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:27.265610 3.000828 tcp 10.0.2.105 64110 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:36.265272 0.000000 tcp 10.0.2.105 64110 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:42.264539 0.054882 tcp 10.0.2.105 64111 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:42.319725 0.055356 tcp 10.0.2.105 64112 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:42.375386 0.145416 tcp 10.0.2.105 64113 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:41:43.568571 3.001496 tcp 10.0.2.105 64114 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:52.568801 0.000000 tcp 10.0.2.105 64114 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:41:58.567920 3.003698 tcp 10.0.2.105 64115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:42:06.198255 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:42:07.570704 0.000000 tcp 10.0.2.105 64115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:42:13.571961 3.000897 tcp 10.0.2.105 64116 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:42:22.581807 0.000000 tcp 10.0.2.105 64116 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:46:53.854123 3.002440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:47:00.861831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:47:08.863140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:47:24.866722 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:47:28.573972 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:47:28.574062 2.992588 tcp 10.0.2.105 64117 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:47:37.564690 0.000000 tcp 10.0.2.105 64117 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:47:43.575075 0.054933 tcp 10.0.2.105 64118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:43.630313 0.053805 tcp 10.0.2.105 64119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:43.684615 0.141935 tcp 10.0.2.105 64120 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:44.457459 3.001513 tcp 10.0.2.105 64121 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:47:53.457722 0.000000 tcp 10.0.2.105 64121 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:47:56.873003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:47:59.456976 0.054517 tcp 10.0.2.105 64122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:59.511412 0.053976 tcp 10.0.2.105 64123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:59.565665 0.141842 tcp 10.0.2.105 64124 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:47:59.878132 3.002959 tcp 10.0.2.105 64125 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:09.006400 0.000000 tcp 10.0.2.105 64125 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:14.949385 0.053838 tcp 10.0.2.105 64126 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:48:15.003628 0.053794 tcp 10.0.2.105 64127 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:48:15.057693 0.145376 tcp 10.0.2.105 64128 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:48:15.446455 2.965409 tcp 10.0.2.105 64129 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:24.382003 0.000000 tcp 10.0.2.105 64129 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:30.380975 2.997849 tcp 10.0.2.105 64130 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:39.373338 0.000000 tcp 10.0.2.105 64130 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:44.200639 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:48:45.382787 2.994047 tcp 10.0.2.105 64131 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:48:54.377771 0.000000 tcp 10.0.2.105 64131 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:00.386217 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:54:00.386318 3.003320 tcp 10.0.2.105 64132 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:00.878633 3.001750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 16:54:07.886194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:54:09.388170 0.000000 tcp 10.0.2.105 64132 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:15.388687 0.054562 tcp 10.0.2.105 64133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:15.443555 0.054163 tcp 10.0.2.105 64134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:15.498078 0.144785 tcp 10.0.2.105 64135 -> 195.113.214.249 443 SRPA* 0 0 40 21234 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:15.887763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:54:15.982108 2.999186 tcp 10.0.2.105 64136 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:24.980705 0.000000 tcp 10.0.2.105 64136 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:30.979798 0.053381 tcp 10.0.2.105 64137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:31.033450 0.054628 tcp 10.0.2.105 64138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:31.088397 0.142803 tcp 10.0.2.105 64139 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:31.357660 2.995762 tcp 10.0.2.105 64140 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:31.890951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:54:40.362583 0.000000 tcp 10.0.2.105 64140 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:46.351995 0.053275 tcp 10.0.2.105 64141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:46.405604 0.056178 tcp 10.0.2.105 64142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:46.462098 0.140961 tcp 10.0.2.105 64143 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 16:54:46.726245 2.999565 tcp 10.0.2.105 64144 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:54:55.726466 0.000000 tcp 10.0.2.105 64144 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:55:01.727599 3.001113 tcp 10.0.2.105 64145 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:55:03.898823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 16:55:10.726123 0.000000 tcp 10.0.2.105 64145 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:55:15.705205 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 16:55:16.724830 3.004310 tcp 10.0.2.105 64146 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 16:55:25.727858 0.000000 tcp 10.0.2.105 64146 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:00:31.728352 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:00:31.728494 3.003641 tcp 10.0.2.105 64147 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:00:40.730736 0.000000 tcp 10.0.2.105 64147 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:00:46.731518 0.055251 tcp 10.0.2.105 64148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:00:46.787025 0.054852 tcp 10.0.2.105 64149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:00:46.842149 0.146244 tcp 10.0.2.105 64150 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:00:48.415613 3.000737 tcp 10.0.2.105 64151 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:00:57.414785 0.000000 tcp 10.0.2.105 64151 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:03.413883 0.309769 tcp 10.0.2.105 64152 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:03.723935 0.055330 tcp 10.0.2.105 64153 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:03.779596 0.144604 tcp 10.0.2.105 64154 -> 195.113.214.249 443 SRPA* 0 0 22 11652 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:04.186006 2.977977 tcp 10.0.2.105 64155 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:08.109742 2.970968 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:01:13.104939 0.000000 tcp 10.0.2.105 64155 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:15.051155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:01:19.045070 0.054320 tcp 10.0.2.105 64156 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:19.099712 0.055851 tcp 10.0.2.105 64157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:19.155810 0.140325 tcp 10.0.2.105 64158 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:01:19.680952 2.980337 tcp 10.0.2.105 64159 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:22.977177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:01:28.602256 0.000000 tcp 10.0.2.105 64159 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:34.588643 3.003971 tcp 10.0.2.105 64160 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:38.914253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:01:43.771530 0.000000 tcp 10.0.2.105 64160 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:48.331123 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:01:49.714714 2.965233 tcp 10.0.2.105 64161 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:01:58.631381 0.000000 tcp 10.0.2.105 64161 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:02:11.796611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:08:14.937074 3.000980 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 17:08:21.943826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:08:29.945356 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:08:45.948573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:09:18.859766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:10:55.341264 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:10:55.341355 0.341890 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2397 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:10:55.662700 0.220209 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:10:56.206529 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 17:11:04.618440 3.003908 tcp 10.0.2.105 64162 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:11:11.581074 0.056185 tcp 10.0.2.105 64163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:11.637627 0.054997 tcp 10.0.2.105 64164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:11.692954 0.145219 tcp 10.0.2.105 64165 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:11.838787 0.231234 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:12.063146 0.058828 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:12.120174 0.116518 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:13.621508 0.000000 tcp 10.0.2.105 64162 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:11:14.971381 0.196514 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2069 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:15.430571 0.233168 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:15.762270 0.184927 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:16.079634 0.069943 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:16.187515 0.211577 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 1994 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:16.391325 0.073864 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:18.793875 0.185048 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:19.217127 0.103221 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:19.303781 0.446786 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:19.620070 0.055446 tcp 10.0.2.105 64166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:19.675872 0.055125 tcp 10.0.2.105 64167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:19.728055 0.247931 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:19.731352 0.143910 tcp 10.0.2.105 64168 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:20.709327 2.995824 tcp 10.0.2.105 64169 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:11:21.007640 0.000000 udp 10.0.2.105 7010 -> 124.58.128.15 5022 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 17:11:29.703495 0.000000 tcp 10.0.2.105 64169 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:11:39.523350 0.053604 tcp 10.0.2.105 64170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:39.577274 0.055090 tcp 10.0.2.105 64171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:39.632656 0.142224 tcp 10.0.2.105 64172 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:11:39.775413 0.117591 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2597 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:42.591390 0.230459 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:43.421560 0.090426 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:43.632373 0.159401 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:44.695511 0.352135 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:45.044120 0.212903 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:46.245013 0.157931 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2135 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:46.397396 0.180747 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2077 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:46.574655 0.370434 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:47.463644 0.224140 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:47.665114 0.226062 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:48.318212 0.622965 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:49.784896 0.123613 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:50.300068 0.369888 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:11:50.685696 0.217036 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:15:21.970083 3.003974 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:15:28.980776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:15:36.979550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:15:52.981777 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:16:24.988519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:16:35.704933 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:16:35.705091 3.003025 tcp 10.0.2.105 64173 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:16:44.706147 0.000000 tcp 10.0.2.105 64173 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:16:50.706731 0.055540 tcp 10.0.2.105 64174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:16:50.762579 0.054242 tcp 10.0.2.105 64175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:16:50.817120 0.143571 tcp 10.0.2.105 64176 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:16:51.228949 3.001271 tcp 10.0.2.105 64177 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:00.229312 0.000000 tcp 10.0.2.105 64177 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:06.228316 0.076382 tcp 10.0.2.105 64178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:06.305066 0.054468 tcp 10.0.2.105 64179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:06.359836 0.144323 tcp 10.0.2.105 64180 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:07.266907 2.996557 tcp 10.0.2.105 64181 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:16.272152 0.000000 tcp 10.0.2.105 64181 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:22.261629 0.054208 tcp 10.0.2.105 64182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:22.316154 0.054585 tcp 10.0.2.105 64183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:22.371083 0.142417 tcp 10.0.2.105 64184 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:17:22.725022 3.000663 tcp 10.0.2.105 64185 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:31.724712 0.000000 tcp 10.0.2.105 64185 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:37.723067 3.005443 tcp 10.0.2.105 64186 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:46.725611 0.000000 tcp 10.0.2.105 64186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:17:51.703010 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:17:52.724932 3.003906 tcp 10.0.2.105 64187 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:18:01.727285 0.000000 tcp 10.0.2.105 64187 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:22:28.996694 3.000196 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:22:36.002489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:22:44.003480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:23:00.006167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:23:08.059068 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:23:08.059252 2.976730 tcp 10.0.2.105 64188 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:16.976360 0.000000 tcp 10.0.2.105 64188 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:22.916939 0.054715 tcp 10.0.2.105 64189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:22.971891 0.054803 tcp 10.0.2.105 64190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:23.026955 0.140183 tcp 10.0.2.105 64191 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:23.446015 2.971961 tcp 10.0.2.105 64192 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:32.131711 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:23:32.370320 0.000000 tcp 10.0.2.105 64192 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:38.300521 0.053914 tcp 10.0.2.105 64193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:38.354727 0.054065 tcp 10.0.2.105 64194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:38.409109 0.141481 tcp 10.0.2.105 64195 -> 195.113.214.249 443 SRPA* 0 0 26 13992 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:38.714199 2.969682 tcp 10.0.2.105 64196 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:47.675152 0.000000 tcp 10.0.2.105 64196 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:23:53.673800 0.054713 tcp 10.0.2.105 64197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:53.728806 0.054881 tcp 10.0.2.105 64198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:53.783972 0.139552 tcp 10.0.2.105 64199 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:23:54.244409 3.004260 tcp 10.0.2.105 64200 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:24:03.247184 0.000000 tcp 10.0.2.105 64200 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:24:09.238498 3.001730 tcp 10.0.2.105 64201 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:24:18.239055 0.000000 tcp 10.0.2.105 64201 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:24:23.205496 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:24:24.237993 3.003564 tcp 10.0.2.105 64202 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:24:33.240337 0.000000 tcp 10.0.2.105 64202 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:29:36.037713 3.002648 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:29:39.240901 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:29:39.241000 2.993748 tcp 10.0.2.105 64203 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:29:43.045881 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:29:48.243040 0.000000 tcp 10.0.2.105 64203 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:29:51.049848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:29:54.243912 0.055766 tcp 10.0.2.105 64204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:29:54.299972 0.054548 tcp 10.0.2.105 64205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:29:54.354826 0.142420 tcp 10.0.2.105 64206 -> 195.113.214.249 443 SRPA* 0 0 45 40484 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:29:54.996622 3.000642 tcp 10.0.2.105 64207 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:03.996037 0.000000 tcp 10.0.2.105 64207 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:07.050343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:30:09.995229 0.678165 tcp 10.0.2.105 64208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:10.673726 0.055514 tcp 10.0.2.105 64209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:10.729502 0.355455 tcp 10.0.2.105 64210 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:11.170796 2.999943 tcp 10.0.2.105 64211 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:20.169378 0.000000 tcp 10.0.2.105 64211 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:26.168353 0.282754 tcp 10.0.2.105 64212 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:26.451408 0.053699 tcp 10.0.2.105 64213 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:26.505359 0.144675 tcp 10.0.2.105 64214 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:30:28.290469 2.965833 tcp 10.0.2.105 64215 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:37.198969 0.000000 tcp 10.0.2.105 64215 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:39.149080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:30:43.140631 2.961094 tcp 10.0.2.105 64216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:50.736021 0.987441 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:30:53.067555 0.000000 tcp 10.0.2.105 64216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:30:59.003788 2.964989 tcp 10.0.2.105 64217 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:31:07.888458 0.000000 tcp 10.0.2.105 64217 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:13.087597 0.000121 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:36:13.087818 3.003020 tcp 10.0.2.105 64218 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:22.089361 0.000000 tcp 10.0.2.105 64218 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:28.090187 0.055330 tcp 10.0.2.105 64219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:28.145806 0.054400 tcp 10.0.2.105 64220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:28.200535 0.144618 tcp 10.0.2.105 64221 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:29.005490 2.998287 tcp 10.0.2.105 64222 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:38.012682 0.000000 tcp 10.0.2.105 64222 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:43.062747 3.000952 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:36:44.001641 0.055191 tcp 10.0.2.105 64223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:44.057135 0.031000 tcp 10.0.2.105 64224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:44.088420 0.144769 tcp 10.0.2.105 64225 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:36:44.885335 3.000783 tcp 10.0.2.105 64226 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:51.411583 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:36:55.175368 0.000000 tcp 10.0.2.105 64226 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:36:59.310776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:37:01.099218 0.054372 tcp 10.0.2.105 64227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:37:01.153881 0.054246 tcp 10.0.2.105 64228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:37:01.208440 0.139281 tcp 10.0.2.105 64229 -> 195.113.214.249 443 SRPA* 0 0 35 19454 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:37:01.623836 2.955953 tcp 10.0.2.105 64230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:10.498594 0.000000 tcp 10.0.2.105 64230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:15.109910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:37:16.424199 2.976300 tcp 10.0.2.105 64231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:25.428953 0.000000 tcp 10.0.2.105 64231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:30.165417 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:37:31.356264 2.971386 tcp 10.0.2.105 64232 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:40.254816 0.000000 tcp 10.0.2.105 64232 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:37:46.841921 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:42:03.731085 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:42:03.731203 0.336122 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:04.014912 0.000000 udp 10.0.2.105 7010 -> 124.58.128.15 5022 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 17:42:19.675305 0.032048 tcp 10.0.2.105 64233 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:42:19.707647 0.032734 tcp 10.0.2.105 64234 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:42:19.740724 0.145397 tcp 10.0.2.105 64235 -> 195.113.214.249 443 SRPA* 0 0 32 17990 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:42:19.885832 0.776114 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:20.638630 0.240758 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:21.568692 0.230762 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:22.080025 0.063603 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:22.196191 0.197456 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:22.382101 0.113178 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:23.078811 0.067670 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:23.971891 0.190519 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:24.630239 0.252966 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:24.863656 0.181703 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:25.046856 0.076805 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:25.108132 0.187887 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:26.411248 0.105220 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:26.500893 0.444932 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:27.367992 0.248077 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:27.609342 0.118155 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:28.223862 0.395983 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:28.749267 0.085987 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:28.873120 0.162915 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:30.446055 0.347087 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:31.136138 0.152924 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2030 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:31.279922 0.179841 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:31.539284 0.213270 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:31.749709 0.231796 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:33.046060 0.212926 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:33.255737 0.368053 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:33.620135 0.366897 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:34.201406 0.221070 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:34.419526 0.064912 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:34.954462 0.379296 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/24 17:42:45.411061 2.993939 tcp 10.0.2.105 64236 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:42:50.197384 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:42:54.403517 0.000000 tcp 10.0.2.105 64236 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:00.412854 0.052983 tcp 10.0.2.105 64237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:00.466117 0.032315 tcp 10.0.2.105 64238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:00.498757 0.140088 tcp 10.0.2.105 64239 -> 195.113.214.249 443 SRPA* 0 0 20 10084 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:01.464202 3.003766 tcp 10.0.2.105 64240 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:10.466655 0.000000 tcp 10.0.2.105 64240 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:16.466339 0.053811 tcp 10.0.2.105 64241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:16.520486 0.054674 tcp 10.0.2.105 64242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:16.575489 0.139289 tcp 10.0.2.105 64243 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:17.282996 3.118831 tcp 10.0.2.105 64244 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:26.432471 0.000000 tcp 10.0.2.105 64244 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:32.381571 0.054426 tcp 10.0.2.105 64245 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:32.436414 0.054751 tcp 10.0.2.105 64246 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:32.491553 0.140791 tcp 10.0.2.105 64247 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:43:32.871233 2.980619 tcp 10.0.2.105 64248 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:41.803378 0.000000 tcp 10.0.2.105 64248 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:47.780537 2.993784 tcp 10.0.2.105 64249 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:50.086929 3.000887 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:43:56.772706 0.000000 tcp 10.0.2.105 64249 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:43:57.093316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:44:01.700465 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:44:02.782105 2.994013 tcp 10.0.2.105 64250 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:44:05.094827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:44:11.774993 0.000000 tcp 10.0.2.105 64250 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:44:21.098003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:44:53.104504 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:49:17.785411 0.000166 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:49:17.785669 3.003813 tcp 10.0.2.105 64251 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:49:26.840660 0.000000 tcp 10.0.2.105 64251 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:49:32.790655 0.055214 tcp 10.0.2.105 64252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:32.846150 0.054099 tcp 10.0.2.105 64253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:32.900613 0.125987 tcp 10.0.2.105 64254 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:33.037968 3.003220 tcp 10.0.2.105 64255 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:49:42.043422 0.000000 tcp 10.0.2.105 64255 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:49:48.029376 0.054230 tcp 10.0.2.105 64256 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:48.083897 0.055405 tcp 10.0.2.105 64257 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:48.139591 0.124133 tcp 10.0.2.105 64258 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:49:48.591598 2.991858 tcp 10.0.2.105 64259 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:49:57.591906 0.000000 tcp 10.0.2.105 64259 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:03.591257 0.055053 tcp 10.0.2.105 64260 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:50:03.646598 0.056741 tcp 10.0.2.105 64261 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:50:03.703606 0.130867 tcp 10.0.2.105 64262 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:50:04.025443 3.000262 tcp 10.0.2.105 64263 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:13.024151 0.000000 tcp 10.0.2.105 64263 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:19.022906 3.004561 tcp 10.0.2.105 64264 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:28.025882 0.000000 tcp 10.0.2.105 64264 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:32.702455 0.257252 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:50:34.249507 2.977697 tcp 10.0.2.105 64265 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:50:43.167199 0.000000 tcp 10.0.2.105 64265 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:55:49.027874 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:55:49.028065 3.003288 tcp 10.0.2.105 64266 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:55:58.029960 0.000000 tcp 10.0.2.105 64266 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:04.031721 0.054504 tcp 10.0.2.105 64267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:04.086564 0.031971 tcp 10.0.2.105 64268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:04.118857 0.144543 tcp 10.0.2.105 64269 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:04.442151 2.991638 tcp 10.0.2.105 64270 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:06.114400 3.001512 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 17:56:13.121967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:56:13.442687 0.000000 tcp 10.0.2.105 64270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:19.441643 0.031841 tcp 10.0.2.105 64271 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:19.473774 0.055496 tcp 10.0.2.105 64272 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:19.529606 0.145918 tcp 10.0.2.105 64273 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:20.182021 2.993859 tcp 10.0.2.105 64274 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:21.123605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:56:29.175248 0.000000 tcp 10.0.2.105 64274 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:35.174200 0.054852 tcp 10.0.2.105 64275 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:35.229348 0.055401 tcp 10.0.2.105 64276 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:35.285008 0.142967 tcp 10.0.2.105 64277 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 17:56:35.510429 2.997998 tcp 10.0.2.105 64278 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:37.128710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:56:44.507138 0.000000 tcp 10.0.2.105 64278 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:50.506164 3.004076 tcp 10.0.2.105 64279 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:56:59.508833 0.000000 tcp 10.0.2.105 64279 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:57:04.205844 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 17:57:05.507522 3.004067 tcp 10.0.2.105 64280 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 17:57:09.132760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 17:57:14.509950 0.000000 tcp 10.0.2.105 64280 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:02:20.510477 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:02:20.510639 2.993859 tcp 10.0.2.105 64281 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:02:29.513196 0.000000 tcp 10.0.2.105 64281 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:02:35.513555 0.055387 tcp 10.0.2.105 64282 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:35.569221 0.032299 tcp 10.0.2.105 64283 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:35.601748 0.143603 tcp 10.0.2.105 64284 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:35.845291 3.003308 tcp 10.0.2.105 64285 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:02:44.845252 0.000000 tcp 10.0.2.105 64285 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:02:50.843904 0.552286 tcp 10.0.2.105 64286 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:51.396564 0.056410 tcp 10.0.2.105 64287 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:51.453317 0.146072 tcp 10.0.2.105 64288 -> 195.113.214.249 443 SRPA* 0 0 21 12885 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:02:52.914681 2.969798 tcp 10.0.2.105 64289 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:01.804044 0.000000 tcp 10.0.2.105 64289 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:07.720803 0.032006 tcp 10.0.2.105 64290 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:03:07.753121 0.033456 tcp 10.0.2.105 64291 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:03:07.786854 0.139108 tcp 10.0.2.105 64292 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:03:09.113924 2.957885 tcp 10.0.2.105 64293 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:13.369289 2.972582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:03:18.012334 0.000000 tcp 10.0.2.105 64293 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:20.294548 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:03:23.930760 3.468817 tcp 10.0.2.105 64294 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:28.719892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:03:32.232399 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:03:33.329020 0.000000 tcp 10.0.2.105 64294 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:39.279721 2.966140 tcp 10.0.2.105 64295 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:03:44.535043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:03:48.172165 0.000000 tcp 10.0.2.105 64295 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:04:16.156542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:10:34.164393 3.000021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 18:10:41.170021 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:10:49.171621 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:11:05.174916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:11:37.345999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:12:40.442091 0.000191 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:12:40.442391 0.280490 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:40.669089 0.957014 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:41.984394 0.063699 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:42.175624 0.215603 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:42.387258 0.231179 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:42.611371 0.199980 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:45.229356 0.110095 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:47.573209 0.068025 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:47.957997 0.179836 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:48.197194 0.073729 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:48.812671 0.182084 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:49.176574 0.245468 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:49.414118 0.187826 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:50.356480 0.104970 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2419 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:50.806618 0.447607 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:51.229901 0.248006 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:52.117247 0.117687 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:52.812648 0.269808 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:53.327316 0.085589 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:53.984462 2.991474 tcp 10.0.2.105 64296 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:12:54.002898 0.148857 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:54.401854 0.161926 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:55.952817 0.353322 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:56.302099 0.176136 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:56.511653 0.227363 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:56.721339 0.222665 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:57.365382 0.213353 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:12:57.575896 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 18:13:02.973874 0.000000 tcp 10.0.2.105 64296 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:07.700605 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:13:08.975160 0.087808 tcp 10.0.2.105 64297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:09.063312 0.086720 tcp 10.0.2.105 64298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:09.150346 0.124947 tcp 10.0.2.105 64299 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:10.189219 2.999549 tcp 10.0.2.105 64300 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:13.179265 0.053616 tcp 10.0.2.105 64301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:13.233254 0.054599 tcp 10.0.2.105 64302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:13.288145 0.146261 tcp 10.0.2.105 64303 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:13.435085 0.326332 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2009 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:13:13.812702 0.222581 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:13:14.087150 0.064842 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:13:14.406362 0.359260 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:13:19.186620 0.000000 tcp 10.0.2.105 64300 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:25.186329 0.031461 tcp 10.0.2.105 64304 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:25.218084 0.032894 tcp 10.0.2.105 64305 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:25.251281 0.123264 tcp 10.0.2.105 64306 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:13:25.855112 3.005620 tcp 10.0.2.105 64307 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:34.859796 0.000000 tcp 10.0.2.105 64307 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:40.848760 3.004014 tcp 10.0.2.105 64308 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:49.851221 0.000000 tcp 10.0.2.105 64308 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:13:54.698611 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:17:41.196225 3.002059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:17:48.204026 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:17:56.205790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:18:12.208727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:18:44.215438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:18:55.851994 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:18:55.852136 2.994315 tcp 10.0.2.105 64309 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:04.844097 0.000000 tcp 10.0.2.105 64309 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:10.854352 0.056897 tcp 10.0.2.105 64310 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:10.911580 0.037144 tcp 10.0.2.105 64311 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:10.948994 0.180529 tcp 10.0.2.105 64312 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:12.230388 2.998884 tcp 10.0.2.105 64313 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:21.227810 0.000000 tcp 10.0.2.105 64313 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:27.345972 0.032729 tcp 10.0.2.105 64314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:27.378973 0.055106 tcp 10.0.2.105 64315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:27.434415 0.131204 tcp 10.0.2.105 64316 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:28.270282 2.984079 tcp 10.0.2.105 64317 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:37.201930 0.000000 tcp 10.0.2.105 64317 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:43.160131 1.032545 tcp 10.0.2.105 64318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:44.192925 0.054466 tcp 10.0.2.105 64319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:44.247703 0.129657 tcp 10.0.2.105 64320 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:19:44.485995 2.989695 tcp 10.0.2.105 64321 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:53.474157 0.000000 tcp 10.0.2.105 64321 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:19:59.483020 3.004047 tcp 10.0.2.105 64322 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:20:08.485689 0.000000 tcp 10.0.2.105 64322 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:20:13.371376 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:20:14.641240 2.973112 tcp 10.0.2.105 64323 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:20:23.555397 0.000000 tcp 10.0.2.105 64323 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:24:48.221188 3.001132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:24:55.227854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:25:03.229539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:25:19.242843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:25:29.488861 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:25:29.489057 3.002465 tcp 10.0.2.105 64324 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:25:38.490573 0.000000 tcp 10.0.2.105 64324 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:25:44.490711 0.087616 tcp 10.0.2.105 64325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:25:44.578643 0.032904 tcp 10.0.2.105 64326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:25:44.611893 0.122981 tcp 10.0.2.105 64327 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:25:45.249780 2.994330 tcp 10.0.2.105 64328 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:25:51.248767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:25:54.252624 0.000000 tcp 10.0.2.105 64328 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:00.252117 0.031148 tcp 10.0.2.105 64329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:00.283632 0.031350 tcp 10.0.2.105 64330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:00.315270 0.143613 tcp 10.0.2.105 64331 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:00.706379 2.999665 tcp 10.0.2.105 64332 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:09.704806 0.000000 tcp 10.0.2.105 64332 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:15.704238 0.031304 tcp 10.0.2.105 64333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:15.735821 0.032076 tcp 10.0.2.105 64334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:15.768244 0.142246 tcp 10.0.2.105 64335 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:26:16.100786 2.998079 tcp 10.0.2.105 64336 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:25.097341 0.000000 tcp 10.0.2.105 64336 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:31.096125 3.005301 tcp 10.0.2.105 64337 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:40.098896 0.000000 tcp 10.0.2.105 64337 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:44.705226 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:26:46.097470 3.003931 tcp 10.0.2.105 64338 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:26:55.100592 0.000000 tcp 10.0.2.105 64338 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:31:55.254726 3.001490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:32:01.100672 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:32:01.100858 2.993716 tcp 10.0.2.105 64339 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:02.262045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:32:10.102774 0.000000 tcp 10.0.2.105 64339 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:10.262976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:32:16.103381 0.054556 tcp 10.0.2.105 64340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:16.158208 0.088087 tcp 10.0.2.105 64341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:16.246554 0.124047 tcp 10.0.2.105 64342 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:17.174871 3.002785 tcp 10.0.2.105 64343 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:26.175824 0.000000 tcp 10.0.2.105 64343 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:26.265972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:32:32.175736 0.031595 tcp 10.0.2.105 64344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:32.207624 0.032872 tcp 10.0.2.105 64345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:32.240906 0.860516 tcp 10.0.2.105 64346 -> 195.113.214.249 443 SRPA* 0 0 29 20227 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:33.265328 3.005728 tcp 10.0.2.105 64347 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:42.269582 0.000000 tcp 10.0.2.105 64347 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:48.258710 0.053903 tcp 10.0.2.105 64348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:48.312906 0.054183 tcp 10.0.2.105 64349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:48.367399 0.387062 tcp 10.0.2.105 64350 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:32:48.865285 2.988081 tcp 10.0.2.105 64351 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:57.862654 0.000000 tcp 10.0.2.105 64351 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:32:58.273015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:33:03.860914 2.994174 tcp 10.0.2.105 64352 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:33:16.315320 0.000000 tcp 10.0.2.105 64352 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:33:21.094791 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:33:22.241168 2.944982 tcp 10.0.2.105 64353 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:33:31.102189 0.000000 tcp 10.0.2.105 64353 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:38:33.865527 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:38:33.865666 3.003960 tcp 10.0.2.105 64354 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:38:42.868024 0.000000 tcp 10.0.2.105 64354 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:38:48.868067 0.033112 tcp 10.0.2.105 64355 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:38:48.901459 0.055055 tcp 10.0.2.105 64356 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:38:48.956915 0.104411 tcp 10.0.2.105 64357 -> 195.113.214.249 443 SRPA* 0 0 30 21739 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:38:49.414209 3.007759 tcp 10.0.2.105 64358 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:38:58.425560 0.000000 tcp 10.0.2.105 64358 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:39:02.278725 3.001266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:39:09.285979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:39:17.287319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:39:33.290758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:40:05.296643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:43:33.776331 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:43:33.776494 0.375462 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:34.147987 0.550474 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:34.780607 0.063608 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:35.563966 0.511556 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:38.057578 0.369979 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:41.157087 0.230641 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:41.687641 0.199155 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:41.977424 0.110696 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2057 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:42.163856 0.181463 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:42.354257 0.069441 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2217 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:42.406137 0.187620 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2148 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:42.564497 0.074991 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:42.939353 0.231772 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:43.163443 0.447117 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:43.657544 0.100568 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:45.884988 0.183806 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:47.425116 0.245303 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:47.663118 0.120185 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 5 1745 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:47.938397 0.234975 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:48.153472 0.097347 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:48.303006 0.158188 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:48.883629 0.169153 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:49.681491 0.249304 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:49.928338 0.176985 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:50.153380 0.354506 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2023 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:50.504483 0.237109 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:50.850327 0.214028 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 1958 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:51.061859 0.294912 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:51.469000 0.218775 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:52.728622 0.067157 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 1875 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:53.329801 0.354596 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/24 18:43:57.700689 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:44:04.410693 2.993491 tcp 10.0.2.105 64359 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:13.404978 0.000000 tcp 10.0.2.105 64359 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:19.413604 0.032178 tcp 10.0.2.105 64360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:19.446047 0.031668 tcp 10.0.2.105 64361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:19.478012 0.125248 tcp 10.0.2.105 64362 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:19.697213 2.999280 tcp 10.0.2.105 64363 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:28.694991 0.000000 tcp 10.0.2.105 64363 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:34.694102 0.031751 tcp 10.0.2.105 64364 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:34.726155 0.055155 tcp 10.0.2.105 64365 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:34.781579 0.124203 tcp 10.0.2.105 64366 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:35.706270 3.003144 tcp 10.0.2.105 64367 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:44.708336 0.000000 tcp 10.0.2.105 64367 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:44:50.707908 0.142109 tcp 10.0.2.105 64368 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:50.850263 0.032002 tcp 10.0.2.105 64369 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:50.882600 0.125523 tcp 10.0.2.105 64370 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:44:51.299837 2.984803 tcp 10.0.2.105 64371 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:45:00.234520 0.000000 tcp 10.0.2.105 64371 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:45:06.219411 2.994115 tcp 10.0.2.105 64372 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:45:15.222218 0.000000 tcp 10.0.2.105 64372 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:45:20.199391 1.945012 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:45:23.144362 2.954519 tcp 10.0.2.105 64373 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:45:32.029082 0.000000 tcp 10.0.2.105 64373 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:46:10.640206 2.964699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:46:17.560850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:46:25.466097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:46:41.270799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:47:12.884500 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:50:36.224210 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:50:36.224332 3.003634 tcp 10.0.2.105 64374 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:50:45.225946 0.000000 tcp 10.0.2.105 64374 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:50:51.227099 0.032814 tcp 10.0.2.105 64375 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:50:51.260206 0.056373 tcp 10.0.2.105 64376 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:50:51.316875 0.124180 tcp 10.0.2.105 64377 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:50:51.833193 3.007106 tcp 10.0.2.105 64378 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:00.839176 0.000000 tcp 10.0.2.105 64378 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:06.828307 0.053181 tcp 10.0.2.105 64379 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:06.881839 0.053747 tcp 10.0.2.105 64380 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:06.935824 0.144130 tcp 10.0.2.105 64381 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:07.310163 3.002558 tcp 10.0.2.105 64382 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:16.742412 0.000000 tcp 10.0.2.105 64382 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:22.682306 0.031227 tcp 10.0.2.105 64383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:22.713849 0.031967 tcp 10.0.2.105 64384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:22.746200 0.132088 tcp 10.0.2.105 64385 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:51:23.517063 2.971829 tcp 10.0.2.105 64386 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:32.429813 0.000000 tcp 10.0.2.105 64386 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:38.370206 2.970164 tcp 10.0.2.105 64387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:47.281271 0.000000 tcp 10.0.2.105 64387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:51:51.783587 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:51:53.222256 2.976412 tcp 10.0.2.105 64388 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:52:02.156735 0.000000 tcp 10.0.2.105 64388 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:53:16.326475 3.001569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 18:53:23.333693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:53:31.335627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:53:47.338620 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:54:19.344986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 18:57:08.157661 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:57:08.157746 3.003818 tcp 10.0.2.105 64389 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:17.159965 0.000000 tcp 10.0.2.105 64389 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:23.160575 0.054536 tcp 10.0.2.105 64390 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:23.215478 0.032127 tcp 10.0.2.105 64391 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:23.247992 0.144765 tcp 10.0.2.105 64392 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:23.440729 2.992707 tcp 10.0.2.105 64393 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:32.442186 0.000000 tcp 10.0.2.105 64393 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:38.441235 0.031311 tcp 10.0.2.105 64394 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:38.472851 0.054592 tcp 10.0.2.105 64395 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:38.527771 0.690567 tcp 10.0.2.105 64396 -> 195.113.214.249 443 SRPA* 0 0 32 24731 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:39.265504 3.000596 tcp 10.0.2.105 64397 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:48.265892 0.000000 tcp 10.0.2.105 64397 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:57:54.264372 0.031635 tcp 10.0.2.105 64398 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:54.296298 0.057090 tcp 10.0.2.105 64399 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:54.353640 0.379581 tcp 10.0.2.105 64400 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/24 18:57:55.181769 2.997494 tcp 10.0.2.105 64401 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:58:04.177445 0.000000 tcp 10.0.2.105 64401 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:58:10.176421 3.004421 tcp 10.0.2.105 64402 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:58:19.179342 0.000000 tcp 10.0.2.105 64402 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:58:23.705675 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 18:58:25.178063 3.004294 tcp 10.0.2.105 64403 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 18:58:34.180848 0.000000 tcp 10.0.2.105 64403 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:00:23.350225 3.002540 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:00:30.357960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:00:38.359456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:00:54.362164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:01:26.368865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:03:40.181580 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:03:40.181739 2.993254 tcp 10.0.2.105 64404 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:03:49.173706 0.000000 tcp 10.0.2.105 64404 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:03:55.184695 1.436370 tcp 10.0.2.105 64405 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:03:56.621318 0.054518 tcp 10.0.2.105 64406 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:03:56.676158 0.765766 tcp 10.0.2.105 64407 -> 195.113.214.249 443 SRPA* 0 0 31 20675 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:03:58.550382 2.969735 tcp 10.0.2.105 64408 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:07.441451 0.000000 tcp 10.0.2.105 64408 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:13.352814 0.031212 tcp 10.0.2.105 64409 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:13.384530 0.032524 tcp 10.0.2.105 64410 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:13.417298 0.486310 tcp 10.0.2.105 64411 -> 195.113.214.249 443 SRPA* 0 0 24 14736 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:14.003806 2.973147 tcp 10.0.2.105 64412 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:22.900521 0.000000 tcp 10.0.2.105 64412 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:28.813773 0.725080 tcp 10.0.2.105 64413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:29.539126 0.053443 tcp 10.0.2.105 64414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:29.592885 0.378997 tcp 10.0.2.105 64415 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:04:31.070942 2.961509 tcp 10.0.2.105 64416 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:39.956460 0.000000 tcp 10.0.2.105 64416 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:45.880543 2.960410 tcp 10.0.2.105 64417 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:04:53.711348 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:04:54.956161 0.000000 tcp 10.0.2.105 64417 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:05:00.882889 2.964349 tcp 10.0.2.105 64418 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:05:09.773841 0.000000 tcp 10.0.2.105 64418 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:07:30.376666 2.999166 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:07:37.381860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:07:45.383379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:08:01.386241 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:08:33.392328 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:14:08.724813 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:14:08.724906 0.349942 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:09.071303 0.651166 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:09.665774 0.056716 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2038 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:09.729323 0.575569 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:10.282881 0.449518 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:11.245588 0.234652 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:11.473322 0.194248 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:14.493068 3.005741 tcp 10.0.2.105 64419 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:14:15.681464 0.118698 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:15.775099 0.179226 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 1997 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:16.375277 0.076646 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 1990 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:17.942771 0.223625 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:18.321150 0.178121 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:19.488566 0.068409 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:20.508313 1.874183 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:22.573859 0.094907 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:22.651563 0.189443 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2534 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:23.495395 0.000000 tcp 10.0.2.105 64419 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:14:24.617277 0.250529 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:25.251595 0.240852 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:26.383515 0.237802 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:26.599876 0.087617 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2012 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:26.709104 0.148476 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:26.847740 0.175603 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:29.496080 0.032077 tcp 10.0.2.105 64420 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:29.528376 0.031741 tcp 10.0.2.105 64421 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:29.560494 0.107056 tcp 10.0.2.105 64422 -> 195.113.214.249 443 SRPA* 0 0 32 24275 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:30.819812 3.247735 tcp 10.0.2.105 64423 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:14:31.135377 0.165629 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:33.132318 0.219256 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:33.600853 0.352971 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:34.073046 0.223372 udp 10.0.2.105 7010 <-> 99.16.61.201 4937 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:35.720056 0.474441 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:36.412627 0.299391 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:36.849081 0.216503 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:37.062267 0.061999 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2526 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:37.614832 2.987861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 19:14:38.541029 0.367576 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:14:40.023144 0.000000 tcp 10.0.2.105 64423 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:14:44.570448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:14:45.984952 0.524464 tcp 10.0.2.105 64424 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:46.509724 0.054970 tcp 10.0.2.105 64425 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:46.564983 0.292952 tcp 10.0.2.105 64426 -> 195.113.214.249 443 SRPA* 0 0 32 24769 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:14:47.150283 2.963701 tcp 10.0.2.105 64427 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:14:52.946600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:14:56.054749 0.000000 tcp 10.0.2.105 64427 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:15:02.045338 3.331878 tcp 10.0.2.105 64428 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:15:09.205264 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:15:11.303070 0.000000 tcp 10.0.2.105 64428 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:15:17.132892 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:15:42.067116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:20:16.553929 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:20:16.554025 3.003323 tcp 10.0.2.105 64429 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:20:25.556077 0.000000 tcp 10.0.2.105 64429 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:20:31.558928 0.032123 tcp 10.0.2.105 64430 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:31.591327 0.055214 tcp 10.0.2.105 64431 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:31.646863 0.122451 tcp 10.0.2.105 64432 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:32.424154 3.006266 tcp 10.0.2.105 64433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:20:41.429048 0.000000 tcp 10.0.2.105 64433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:20:47.418428 0.053656 tcp 10.0.2.105 64434 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:47.472360 0.066894 tcp 10.0.2.105 64435 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:47.539475 0.126699 tcp 10.0.2.105 64436 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:20:48.228778 3.004412 tcp 10.0.2.105 64437 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:20:57.241744 0.000000 tcp 10.0.2.105 64437 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:03.221209 0.031329 tcp 10.0.2.105 64438 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:21:03.252825 0.031935 tcp 10.0.2.105 64439 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:21:03.285030 0.124699 tcp 10.0.2.105 64440 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:21:03.851712 2.993975 tcp 10.0.2.105 64441 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:12.844355 0.000000 tcp 10.0.2.105 64441 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:18.853300 3.003947 tcp 10.0.2.105 64442 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:27.855528 0.000000 tcp 10.0.2.105 64442 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:33.137502 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:21:34.274305 3.073211 tcp 10.0.2.105 64443 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:43.275791 0.000000 tcp 10.0.2.105 64443 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:21:44.825726 2.963661 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:21:51.746200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:21:59.652565 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:22:15.458541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:22:47.440424 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:26:48.867956 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:26:48.868099 3.003690 tcp 10.0.2.105 64444 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:26:57.870343 0.000000 tcp 10.0.2.105 64444 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:03.870988 0.032141 tcp 10.0.2.105 64445 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:03.903383 0.032662 tcp 10.0.2.105 64446 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:03.936364 0.126771 tcp 10.0.2.105 64447 -> 195.113.214.249 443 SRPA* 0 0 22 12522 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:04.821697 2.992320 tcp 10.0.2.105 64448 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:13.822783 0.000000 tcp 10.0.2.105 64448 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:19.822459 0.032180 tcp 10.0.2.105 64449 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:19.855020 0.032957 tcp 10.0.2.105 64450 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:19.888439 0.125189 tcp 10.0.2.105 64451 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:20.261533 2.995220 tcp 10.0.2.105 64452 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:29.255599 0.000000 tcp 10.0.2.105 64452 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:35.254222 0.054529 tcp 10.0.2.105 64453 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:35.309045 0.032973 tcp 10.0.2.105 64454 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:35.342359 0.153764 tcp 10.0.2.105 64455 -> 195.113.214.249 443 SRPA* 0 0 73 77380 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:27:36.926194 3.004604 tcp 10.0.2.105 64456 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:45.929371 0.000000 tcp 10.0.2.105 64456 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:51.918328 3.004154 tcp 10.0.2.105 64457 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:27:59.699170 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:28:00.920969 0.000000 tcp 10.0.2.105 64457 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:28:06.919652 2.993792 tcp 10.0.2.105 64458 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:28:15.922483 0.000000 tcp 10.0.2.105 64458 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:28:51.446723 3.001373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:28:58.453374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:29:06.455082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:29:22.459739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:29:54.464101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:33:21.923193 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:33:21.923308 3.003525 tcp 10.0.2.105 64459 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:33:30.925060 0.000000 tcp 10.0.2.105 64459 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:33:36.925831 0.031843 tcp 10.0.2.105 64460 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:36.957915 0.032762 tcp 10.0.2.105 64461 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:36.990938 0.125553 tcp 10.0.2.105 64462 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:37.510550 3.002978 tcp 10.0.2.105 64463 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:33:46.507966 0.000000 tcp 10.0.2.105 64463 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:33:52.507055 3.324510 tcp 10.0.2.105 64464 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:55.831882 0.054301 tcp 10.0.2.105 64465 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:55.886525 0.120261 tcp 10.0.2.105 64466 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:33:56.199637 2.971065 tcp 10.0.2.105 64467 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:05.098442 0.000000 tcp 10.0.2.105 64467 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:11.015108 0.031062 tcp 10.0.2.105 64468 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:34:11.046466 0.031916 tcp 10.0.2.105 64469 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:34:11.078690 0.126915 tcp 10.0.2.105 64470 -> 195.113.214.249 443 SRPA* 0 0 21 10972 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:34:11.857133 2.953404 tcp 10.0.2.105 64471 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:20.737293 0.000000 tcp 10.0.2.105 64471 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:27.003797 2.966065 tcp 10.0.2.105 64472 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:34.751988 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:34:35.897525 0.000000 tcp 10.0.2.105 64472 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:41.843898 2.965746 tcp 10.0.2.105 64473 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:34:50.731875 0.000000 tcp 10.0.2.105 64473 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:35:59.939404 2.968957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:36:06.859871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:36:14.767909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:36:30.578666 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:37:02.200746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:39:54.387637 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:39:54.387724 3.003290 tcp 10.0.2.105 64474 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:03.389650 0.000000 tcp 10.0.2.105 64474 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:09.390882 0.055017 tcp 10.0.2.105 64475 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:09.446131 0.032042 tcp 10.0.2.105 64476 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:09.478448 0.122006 tcp 10.0.2.105 64477 -> 195.113.214.249 443 SRPA* 0 0 35 19284 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:09.812118 2.991199 tcp 10.0.2.105 64478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:18.811846 0.000000 tcp 10.0.2.105 64478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:24.811480 0.053412 tcp 10.0.2.105 64479 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:24.865184 0.031738 tcp 10.0.2.105 64480 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:24.897214 0.621072 tcp 10.0.2.105 64481 -> 195.113.214.249 443 SRPA* 0 0 73 78424 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:40:26.804779 3.002985 tcp 10.0.2.105 64482 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:35.806352 0.000000 tcp 10.0.2.105 64482 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:41.804942 3.004372 tcp 10.0.2.105 64483 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:40:49.696565 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:40:50.807761 0.000000 tcp 10.0.2.105 64483 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:43:05.494102 3.001809 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:43:12.501461 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:43:20.503018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:43:36.506558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:44:08.512354 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:45:06.235394 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:45:06.235541 0.370354 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:06.601919 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 19:45:24.022914 0.055834 tcp 10.0.2.105 64484 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:24.079100 0.053753 tcp 10.0.2.105 64485 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:24.133165 0.126265 tcp 10.0.2.105 64486 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:24.260086 0.638026 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:24.839050 0.057586 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:25.237970 0.228600 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:27.612580 0.232444 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:27.922131 0.200350 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:29.382730 0.110850 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2028 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:30.222841 0.190250 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:30.549271 0.073705 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:30.634948 0.222613 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:30.850659 0.174645 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:31.250331 0.063686 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:32.001065 0.446568 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2003 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:32.425680 0.121578 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:33.109903 0.195168 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:33.399787 0.244131 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:33.850807 0.085973 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:33.925518 0.147669 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:34.092642 0.117644 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:34.505571 0.235056 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:34.717834 0.178921 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:34.909388 0.164766 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:35.066930 0.203084 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:35.266994 0.348069 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2513 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:35.741087 0.000000 udp 10.0.2.105 7010 -> 99.16.61.201 4937 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 19:45:51.911657 0.032645 tcp 10.0.2.105 64487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:51.944663 0.032710 tcp 10.0.2.105 64488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:51.977654 0.128284 tcp 10.0.2.105 64489 -> 195.113.214.249 443 SRPA* 0 0 20 10710 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:45:52.106571 0.227253 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2573 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:52.330935 0.228494 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:52.578836 0.243526 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:52.819064 0.061901 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:53.025175 0.354672 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/24 19:45:56.808610 3.003772 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:05.810992 0.000000 tcp 10.0.2.105 64490 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:11.810196 0.033135 tcp 10.0.2.105 64491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:11.843632 0.031795 tcp 10.0.2.105 64492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:11.875758 0.119221 tcp 10.0.2.105 64493 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:12.094454 2.999523 tcp 10.0.2.105 64494 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:21.102952 0.000000 tcp 10.0.2.105 64494 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:27.091904 0.947448 tcp 10.0.2.105 64495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:28.039613 0.054878 tcp 10.0.2.105 64496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:28.094844 0.122061 tcp 10.0.2.105 64497 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:28.421223 2.954301 tcp 10.0.2.105 64498 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:37.305536 0.000000 tcp 10.0.2.105 64498 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:43.234920 0.053816 tcp 10.0.2.105 64499 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:43.289050 0.054592 tcp 10.0.2.105 64500 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:43.343937 0.143486 tcp 10.0.2.105 64501 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:46:43.555859 2.961257 tcp 10.0.2.105 64502 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:52.444429 0.000000 tcp 10.0.2.105 64502 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:46:58.367587 2.973345 tcp 10.0.2.105 64503 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:47:07.265704 0.000000 tcp 10.0.2.105 64503 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:47:12.049461 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:47:13.191068 2.970658 tcp 10.0.2.105 64504 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:47:22.087341 0.000000 tcp 10.0.2.105 64504 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:52:27.860784 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:52:27.860902 2.993407 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:52:36.862851 0.000000 tcp 10.0.2.105 64505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:52:42.863357 0.032905 tcp 10.0.2.105 64506 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:42.896540 0.032170 tcp 10.0.2.105 64507 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:42.928993 0.124481 tcp 10.0.2.105 64508 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:43.398336 2.998108 tcp 10.0.2.105 64509 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:52:52.395574 0.000000 tcp 10.0.2.105 64509 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:52:58.394877 0.032332 tcp 10.0.2.105 64510 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:58.427505 0.032237 tcp 10.0.2.105 64511 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:58.460039 0.122798 tcp 10.0.2.105 64512 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:52:59.754849 3.005284 tcp 10.0.2.105 64513 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:08.758823 0.000000 tcp 10.0.2.105 64513 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:14.748079 0.054493 tcp 10.0.2.105 64514 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:53:14.802871 0.054649 tcp 10.0.2.105 64515 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:53:14.857925 0.125128 tcp 10.0.2.105 64516 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:53:15.601416 3.001633 tcp 10.0.2.105 64517 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:24.611682 0.000000 tcp 10.0.2.105 64517 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:30.600332 2.994063 tcp 10.0.2.105 64518 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:39.603133 0.000000 tcp 10.0.2.105 64518 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:44.199777 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:53:45.602264 2.993764 tcp 10.0.2.105 64519 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:53:54.594962 0.000000 tcp 10.0.2.105 64519 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:55:41.521755 3.001264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 19:55:48.528929 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:55:56.530305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:56:12.533164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:56:44.539343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 19:59:00.605614 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 19:59:00.605717 3.003416 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:09.607981 0.000000 tcp 10.0.2.105 64520 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:15.608338 0.054505 tcp 10.0.2.105 64521 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:15.663096 0.054636 tcp 10.0.2.105 64522 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:15.718020 0.144016 tcp 10.0.2.105 64523 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:15.914655 3.008016 tcp 10.0.2.105 64524 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:24.919859 0.000000 tcp 10.0.2.105 64524 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:30.908976 0.030930 tcp 10.0.2.105 64525 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:30.940341 0.031874 tcp 10.0.2.105 64526 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:30.972480 0.125155 tcp 10.0.2.105 64527 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:31.676408 2.987189 tcp 10.0.2.105 64528 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:40.672751 0.000000 tcp 10.0.2.105 64528 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:46.672179 0.054838 tcp 10.0.2.105 64529 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:46.727353 0.054990 tcp 10.0.2.105 64530 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:46.782672 0.147609 tcp 10.0.2.105 64531 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 19:59:47.032872 2.993184 tcp 10.0.2.105 64532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 19:59:56.024259 0.000000 tcp 10.0.2.105 64532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:00:02.032826 3.004473 tcp 10.0.2.105 64533 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:00:11.035927 0.000000 tcp 10.0.2.105 64533 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:00:15.702716 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:00:17.034907 3.004310 tcp 10.0.2.105 64534 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:00:26.037707 0.000000 tcp 10.0.2.105 64534 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:02:48.546389 3.000490 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:02:55.552768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:03:03.554143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:03:19.558810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:03:51.563385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:05:32.038176 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:05:32.038281 3.003428 tcp 10.0.2.105 64535 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:05:41.040694 0.000000 tcp 10.0.2.105 64535 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:05:47.041062 0.032339 tcp 10.0.2.105 64536 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:05:47.073657 0.032382 tcp 10.0.2.105 64537 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:05:47.106343 0.126045 tcp 10.0.2.105 64538 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:05:48.234163 3.001095 tcp 10.0.2.105 64539 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:05:57.233838 0.000000 tcp 10.0.2.105 64539 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:03.233598 0.086094 tcp 10.0.2.105 64540 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:03.319981 0.032574 tcp 10.0.2.105 64541 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:03.352847 0.126700 tcp 10.0.2.105 64542 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:04.510145 2.998261 tcp 10.0.2.105 64543 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:13.507168 0.000000 tcp 10.0.2.105 64543 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:19.506603 0.031537 tcp 10.0.2.105 64544 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:19.538512 0.032566 tcp 10.0.2.105 64545 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:19.571394 0.124240 tcp 10.0.2.105 64546 -> 195.113.214.249 443 SRPA* 0 0 20 11371 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:06:21.295726 3.792995 tcp 10.0.2.105 64547 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:31.016706 0.000000 tcp 10.0.2.105 64547 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:37.613986 2.961582 tcp 10.0.2.105 64548 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:45.420662 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:06:46.498931 0.000000 tcp 10.0.2.105 64548 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:06:52.678944 2.953229 tcp 10.0.2.105 64549 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:07:01.557037 0.000000 tcp 10.0.2.105 64549 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:10:17.570249 3.002278 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:10:24.579936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:10:32.579661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:10:48.582842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:11:20.588739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:15:55.684556 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:15:55.684710 0.875231 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:15:56.539831 0.000000 udp 10.0.2.105 7010 -> 99.16.61.201 4937 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 20:16:06.330151 2.993684 tcp 10.0.2.105 64550 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:16:13.962284 0.055096 tcp 10.0.2.105 64551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:14.017615 0.032256 tcp 10.0.2.105 64552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:14.050196 0.142402 tcp 10.0.2.105 64553 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:14.193100 0.373219 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:14.562814 0.063269 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:15.332636 0.000000 tcp 10.0.2.105 64550 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:16:15.702157 0.340678 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:15.983229 0.215625 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:16.210671 0.233238 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1980 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:16.437763 0.111113 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2107 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:16.513012 0.227969 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:18.252870 0.188012 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:19.283994 0.175338 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:21.331741 0.030976 tcp 10.0.2.105 64554 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:21.362994 0.054092 tcp 10.0.2.105 64555 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:21.417348 0.143778 tcp 10.0.2.105 64556 -> 195.113.214.249 443 SRPA* 0 0 33 19386 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:16:21.595391 0.222248 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2472 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:21.717988 2.997754 tcp 10.0.2.105 64557 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:16:21.911986 0.076022 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:22.099399 0.063071 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:22.319892 0.101478 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:22.406016 0.528202 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 1971 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:23.162483 0.154380 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:24.551386 0.295241 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:24.796659 0.188449 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:24.998449 0.091284 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:25.048505 0.234988 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:26.274761 0.181241 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:27.790476 0.163769 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:29.790710 0.212204 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:30.714425 0.000000 tcp 10.0.2.105 64557 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:16:31.007223 0.117503 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:31.224538 0.354671 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:31.692729 0.230252 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2050 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:32.349248 0.071534 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2546 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:33.799253 0.215278 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:34.011688 0.190217 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:16:34.387593 0.360095 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:17:24.595232 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:17:31.602213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:17:39.603836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:17:55.606811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:18:27.612797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:21:36.714935 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:21:36.715100 3.003967 tcp 10.0.2.105 64558 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:21:45.717753 0.000000 tcp 10.0.2.105 64558 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:21:51.717439 0.031976 tcp 10.0.2.105 64559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:21:51.749702 0.032846 tcp 10.0.2.105 64560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:21:51.782856 0.128151 tcp 10.0.2.105 64561 -> 195.113.214.249 443 SRPA* 0 0 33 19216 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:21:52.012738 2.998051 tcp 10.0.2.105 64562 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:01.009611 0.000000 tcp 10.0.2.105 64562 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:07.008974 0.031688 tcp 10.0.2.105 64563 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:07.040956 0.034141 tcp 10.0.2.105 64564 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:07.075330 0.146024 tcp 10.0.2.105 64565 -> 195.113.214.249 443 SRPA* 0 0 21 10972 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:07.303926 3.009335 tcp 10.0.2.105 64566 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:16.321495 0.000000 tcp 10.0.2.105 64566 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:22.301174 0.054041 tcp 10.0.2.105 64567 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:22.355485 0.032042 tcp 10.0.2.105 64568 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:22.387761 0.143196 tcp 10.0.2.105 64569 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:22:22.600386 2.994354 tcp 10.0.2.105 64570 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:31.593402 0.000000 tcp 10.0.2.105 64570 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:37.592256 2.994491 tcp 10.0.2.105 64571 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:46.586776 0.000000 tcp 10.0.2.105 64571 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:22:51.201513 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:22:52.593637 3.004451 tcp 10.0.2.105 64572 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:23:01.596666 0.000000 tcp 10.0.2.105 64572 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:24:31.618333 3.002345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:24:38.626101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:24:46.629948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:25:02.630889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:25:34.853699 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:28:07.597142 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:28:07.597287 3.003780 tcp 10.0.2.105 64573 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:16.599473 0.000000 tcp 10.0.2.105 64573 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:22.599968 0.032732 tcp 10.0.2.105 64574 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:22.633011 0.054509 tcp 10.0.2.105 64575 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:22.687814 0.143154 tcp 10.0.2.105 64576 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:24.461608 2.993430 tcp 10.0.2.105 64577 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:33.453552 0.000000 tcp 10.0.2.105 64577 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:39.463115 0.031725 tcp 10.0.2.105 64578 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:39.495156 0.031728 tcp 10.0.2.105 64579 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:39.527230 0.121948 tcp 10.0.2.105 64580 -> 195.113.214.249 443 SRPA* 0 0 20 11372 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:39.994746 3.002796 tcp 10.0.2.105 64581 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:48.995966 0.000000 tcp 10.0.2.105 64581 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:28:54.995314 0.031281 tcp 10.0.2.105 64582 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:55.026865 0.032976 tcp 10.0.2.105 64583 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:55.060145 0.124083 tcp 10.0.2.105 64584 -> 195.113.214.249 443 SRPA* 0 0 21 12886 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:28:55.363462 3.005963 tcp 10.0.2.105 64585 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:29:04.420548 0.000000 tcp 10.0.2.105 64585 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:29:10.357264 3.003854 tcp 10.0.2.105 64586 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:29:19.359751 0.000000 tcp 10.0.2.105 64586 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:29:24.197993 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:29:25.359159 3.003492 tcp 10.0.2.105 64587 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:29:34.361265 0.000000 tcp 10.0.2.105 64587 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:31:38.652765 3.001294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:31:45.660316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:31:53.661749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:32:09.664528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:32:41.671001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:34:40.362034 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:34:40.362118 2.993350 tcp 10.0.2.105 64588 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:34:49.353854 0.000000 tcp 10.0.2.105 64588 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:34:55.364419 0.032585 tcp 10.0.2.105 64589 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:34:55.397285 0.032146 tcp 10.0.2.105 64590 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:34:55.429685 0.126327 tcp 10.0.2.105 64591 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:34:56.171303 2.997126 tcp 10.0.2.105 64592 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:05.167647 0.000000 tcp 10.0.2.105 64592 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:11.165937 0.053830 tcp 10.0.2.105 64593 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:11.220043 0.032458 tcp 10.0.2.105 64594 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:11.252786 0.145238 tcp 10.0.2.105 64595 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:12.910569 0.000000 tcp 10.0.2.105 64596 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:18.380853 0.000000 tcp 10.0.2.105 64596 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:24.303521 0.000000 tcp 10.0.2.105 64596 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:30.236407 0.054609 tcp 10.0.2.105 64597 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:30.291362 0.055132 tcp 10.0.2.105 64598 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:30.346781 0.143543 tcp 10.0.2.105 64599 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:35:30.583728 2.945581 tcp 10.0.2.105 64600 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:39.462675 0.000000 tcp 10.0.2.105 64600 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:45.400954 2.954334 tcp 10.0.2.105 64601 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:54.284494 0.000000 tcp 10.0.2.105 64601 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:35:59.163003 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:36:00.221219 2.965306 tcp 10.0.2.105 64602 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:36:09.108381 0.000000 tcp 10.0.2.105 64602 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:38:45.677975 3.000464 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:38:52.683672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:39:00.685712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:39:16.688981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:39:48.694657 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:41:13.276918 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:41:13.277084 3.003537 tcp 10.0.2.105 64603 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:22.279203 0.000000 tcp 10.0.2.105 64603 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:28.279451 0.055054 tcp 10.0.2.105 64604 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:28.334798 0.053708 tcp 10.0.2.105 64605 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:28.388791 0.127588 tcp 10.0.2.105 64606 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:29.345400 2.998309 tcp 10.0.2.105 64607 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:38.352584 0.000000 tcp 10.0.2.105 64607 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:44.341711 0.031786 tcp 10.0.2.105 64608 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:44.373897 0.032108 tcp 10.0.2.105 64609 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:44.406274 0.126391 tcp 10.0.2.105 64610 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:44.631395 2.994372 tcp 10.0.2.105 64611 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:53.624243 0.000000 tcp 10.0.2.105 64611 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:41:59.633299 0.031069 tcp 10.0.2.105 64612 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:59.664688 0.053536 tcp 10.0.2.105 64613 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:41:59.718497 0.122911 tcp 10.0.2.105 64614 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:42:01.555893 3.003985 tcp 10.0.2.105 64615 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:42:10.558764 0.000000 tcp 10.0.2.105 64615 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:42:16.557296 3.004229 tcp 10.0.2.105 64616 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:42:24.198381 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:42:25.560421 0.000000 tcp 10.0.2.105 64616 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:42:31.558993 2.994345 tcp 10.0.2.105 64617 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:42:40.561707 0.000000 tcp 10.0.2.105 64617 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:45:52.701424 3.000685 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:45:59.708066 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:46:07.709492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:46:23.712749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:46:41.598430 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:46:41.598653 0.659566 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:42.236018 0.359936 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2484 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:42.591698 0.212244 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:42.800969 0.057475 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:43.231006 0.281011 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:43.633997 0.233193 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:43.860360 0.116773 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2533 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:44.149013 0.223403 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:44.360482 0.184113 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2074 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:44.518149 0.077638 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2428 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:44.704736 0.177668 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:44.877362 0.221419 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:46.689348 0.438300 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:47.105664 0.067855 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:47.726528 0.104486 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:47.814380 0.154951 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:48.925140 0.239911 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:49.158522 0.181849 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:49.751480 0.085660 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:49.799057 0.235760 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2415 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:50.014572 0.180739 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:50.199572 0.164901 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:50.355564 0.211899 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:50.965693 0.117777 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:51.295385 0.353290 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2536 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:51.644786 0.216395 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:52.321174 0.066478 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:52.520239 0.219885 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:52.737174 0.194338 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:53.070489 0.370900 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/24 20:46:55.720984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:47:46.562443 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:47:46.562629 2.993205 tcp 10.0.2.105 64618 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:47:55.554922 0.000000 tcp 10.0.2.105 64618 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:01.565365 0.054162 tcp 10.0.2.105 64619 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:01.619801 0.033442 tcp 10.0.2.105 64620 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:01.653570 0.145241 tcp 10.0.2.105 64621 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:01.809918 2.998106 tcp 10.0.2.105 64622 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:10.806547 0.000000 tcp 10.0.2.105 64622 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:16.806048 0.031548 tcp 10.0.2.105 64623 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:16.837863 0.032191 tcp 10.0.2.105 64624 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:16.870335 0.124819 tcp 10.0.2.105 64625 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:17.346088 3.004311 tcp 10.0.2.105 64626 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:26.464483 0.000000 tcp 10.0.2.105 64626 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:32.401718 0.031927 tcp 10.0.2.105 64627 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:32.433987 0.074544 tcp 10.0.2.105 64628 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:32.508877 0.124622 tcp 10.0.2.105 64629 -> 195.113.214.249 443 SRPA* 0 0 37 19592 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:48:32.967750 2.975550 tcp 10.0.2.105 64630 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:41.921293 0.000000 tcp 10.0.2.105 64630 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:47.919999 2.994144 tcp 10.0.2.105 64631 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:48:56.912536 0.000000 tcp 10.0.2.105 64631 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:49:01.699511 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:49:02.921907 2.993925 tcp 10.0.2.105 64632 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:49:11.914200 0.000000 tcp 10.0.2.105 64632 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:17.924909 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:54:17.925084 3.003844 tcp 10.0.2.105 64633 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:26.930958 0.000000 tcp 10.0.2.105 64633 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:32.927979 0.032087 tcp 10.0.2.105 64634 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:32.960374 0.054893 tcp 10.0.2.105 64635 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:33.015619 0.120137 tcp 10.0.2.105 64636 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:33.554766 3.006321 tcp 10.0.2.105 64637 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:42.559953 0.000000 tcp 10.0.2.105 64637 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:48.552408 0.031610 tcp 10.0.2.105 64638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:48.584338 0.054529 tcp 10.0.2.105 64639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:48.639243 0.128569 tcp 10.0.2.105 64640 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:54:49.113176 2.995821 tcp 10.0.2.105 64641 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:54:58.112190 0.000000 tcp 10.0.2.105 64641 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:04.111492 0.031343 tcp 10.0.2.105 64642 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:55:04.143089 0.033544 tcp 10.0.2.105 64643 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:55:04.176963 0.141997 tcp 10.0.2.105 64644 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 20:55:04.461135 2.994489 tcp 10.0.2.105 64645 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:13.454165 0.000000 tcp 10.0.2.105 64645 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:19.453248 3.003888 tcp 10.0.2.105 64646 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:28.455757 0.000000 tcp 10.0.2.105 64646 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:33.202888 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 20:55:34.454069 3.004555 tcp 10.0.2.105 64647 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:55:43.457418 0.000000 tcp 10.0.2.105 64647 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 20:57:05.728911 3.001032 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 20:57:12.735661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:57:20.737359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:57:36.740345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 20:58:08.745867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:00:49.457810 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:00:49.458038 3.003505 tcp 10.0.2.105 64648 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:00:58.460621 0.000000 tcp 10.0.2.105 64648 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:04.460805 0.032342 tcp 10.0.2.105 64649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:04.493412 0.031943 tcp 10.0.2.105 64650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:04.525616 0.128404 tcp 10.0.2.105 64651 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:04.799945 2.993629 tcp 10.0.2.105 64652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:13.802256 0.000000 tcp 10.0.2.105 64652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:19.801037 0.052942 tcp 10.0.2.105 64653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:19.854292 0.055086 tcp 10.0.2.105 64654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:19.909689 0.141152 tcp 10.0.2.105 64655 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:20.251757 2.994276 tcp 10.0.2.105 64656 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:29.244418 0.000000 tcp 10.0.2.105 64656 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:35.253659 0.053903 tcp 10.0.2.105 64657 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:35.307859 0.054005 tcp 10.0.2.105 64658 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:35.362111 0.144548 tcp 10.0.2.105 64659 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:01:37.041630 2.998872 tcp 10.0.2.105 64660 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:46.038594 0.000000 tcp 10.0.2.105 64660 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:52.037493 3.004119 tcp 10.0.2.105 64661 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:01:59.698294 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:02:01.040259 0.000000 tcp 10.0.2.105 64661 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:02:07.038845 3.003995 tcp 10.0.2.105 64662 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:02:16.051725 0.000000 tcp 10.0.2.105 64662 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:04:12.753180 3.000707 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:04:19.759674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:04:27.761513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:04:43.763959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:05:16.008394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:07:22.043380 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:07:22.043583 2.992021 tcp 10.0.2.105 64663 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:07:31.034051 0.000000 tcp 10.0.2.105 64663 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:07:37.045317 0.033583 tcp 10.0.2.105 64664 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:37.079172 0.054590 tcp 10.0.2.105 64665 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:37.134046 0.142564 tcp 10.0.2.105 64666 -> 195.113.214.249 443 SRPA* 0 0 76 55012 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:38.605130 3.004836 tcp 10.0.2.105 64667 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:07:47.608626 0.000000 tcp 10.0.2.105 64667 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:07:53.597589 0.360439 tcp 10.0.2.105 64668 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:53.958343 0.031498 tcp 10.0.2.105 64669 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:53.990213 0.126717 tcp 10.0.2.105 64670 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:07:55.202749 2.970585 tcp 10.0.2.105 64671 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:04.124759 0.000000 tcp 10.0.2.105 64671 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:10.056721 0.031400 tcp 10.0.2.105 64672 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:08:10.087988 0.032128 tcp 10.0.2.105 64673 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:08:10.120615 0.196243 tcp 10.0.2.105 64674 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:08:11.647990 2.967973 tcp 10.0.2.105 64675 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:20.557344 0.000000 tcp 10.0.2.105 64675 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:26.498993 3.000316 tcp 10.0.2.105 64676 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:34.205689 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:08:35.497259 0.000000 tcp 10.0.2.105 64676 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:41.499721 3.000402 tcp 10.0.2.105 64677 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:08:50.498891 0.000000 tcp 10.0.2.105 64677 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:11:19.785945 3.001934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:11:26.793381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:11:34.795244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:11:50.798347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:12:22.804393 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:17:20.853082 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:17:20.853255 0.765960 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:21.596660 0.065273 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:21.828201 0.352904 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:22.176877 0.228746 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:23.042427 0.109717 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:23.908469 0.562254 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:24.411431 0.231705 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:24.635327 0.220733 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:24.932505 0.179988 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:25.085766 0.080890 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:25.394794 0.161116 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:25.682824 0.218183 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:26.091649 0.450062 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:26.516181 0.062217 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:26.521169 2.994323 tcp 10.0.2.105 64678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:17:27.005820 0.097959 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:27.733775 0.171955 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:27.890347 0.244225 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:28.126779 0.231446 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:28.336903 0.173983 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:28.864741 0.183229 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2150 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:29.159908 0.101247 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:29.302720 0.160226 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:29.456740 0.208466 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:31.158453 0.118079 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:31.621884 0.354384 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:31.972428 0.228539 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2572 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:32.924788 0.200219 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:33.272717 0.217190 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:33.587285 0.064073 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:33.801534 0.517938 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:17:35.513885 0.000000 tcp 10.0.2.105 64678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:17:41.524098 0.055596 tcp 10.0.2.105 64679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:41.579992 0.032243 tcp 10.0.2.105 64680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:41.612663 0.125984 tcp 10.0.2.105 64681 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:41.748987 2.998243 tcp 10.0.2.105 64682 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:17:50.745568 0.000000 tcp 10.0.2.105 64682 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:17:56.744847 0.032009 tcp 10.0.2.105 64683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:56.777187 0.032775 tcp 10.0.2.105 64684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:56.810232 0.127125 tcp 10.0.2.105 64685 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:17:57.244415 3.006481 tcp 10.0.2.105 64686 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:18:06.247921 0.000000 tcp 10.0.2.105 64686 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:18:12.236378 3.004342 tcp 10.0.2.105 64687 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:18:21.239747 0.000000 tcp 10.0.2.105 64687 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:18:26.196644 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:18:26.810108 3.001732 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:18:33.817546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:18:41.819203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:18:57.822135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:19:29.828401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:23:27.240164 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:23:27.240371 2.993375 tcp 10.0.2.105 64688 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:23:36.242612 0.000000 tcp 10.0.2.105 64688 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:23:42.243047 0.032069 tcp 10.0.2.105 64689 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:42.275401 0.031772 tcp 10.0.2.105 64690 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:42.307449 0.128120 tcp 10.0.2.105 64691 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:42.561666 2.994229 tcp 10.0.2.105 64692 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:23:51.554963 0.000000 tcp 10.0.2.105 64692 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:23:57.563582 0.031366 tcp 10.0.2.105 64693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:57.595222 0.032661 tcp 10.0.2.105 64694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:57.628155 0.128026 tcp 10.0.2.105 64695 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:23:58.212214 2.996248 tcp 10.0.2.105 64696 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:07.206949 0.000000 tcp 10.0.2.105 64696 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:13.206270 0.031709 tcp 10.0.2.105 64697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:24:13.238270 0.053899 tcp 10.0.2.105 64698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:24:13.292482 0.143717 tcp 10.0.2.105 64699 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:24:13.556091 3.006869 tcp 10.0.2.105 64700 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:22.559074 0.000000 tcp 10.0.2.105 64700 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:28.557847 3.004185 tcp 10.0.2.105 64701 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:37.560851 0.000000 tcp 10.0.2.105 64701 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:42.197125 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:24:43.559459 2.994183 tcp 10.0.2.105 64702 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:24:52.562138 0.000000 tcp 10.0.2.105 64702 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:25:33.834354 3.122372 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:25:40.932370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:25:48.868780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:26:04.856138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:26:36.861970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:29:58.562507 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:29:58.562648 2.994056 tcp 10.0.2.105 64703 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:07.555075 0.000000 tcp 10.0.2.105 64703 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:13.565748 0.032275 tcp 10.0.2.105 64704 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:13.598322 0.034152 tcp 10.0.2.105 64705 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:13.632796 0.124208 tcp 10.0.2.105 64706 -> 195.113.214.249 443 SRPA* 0 0 38 18786 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:13.797031 3.001296 tcp 10.0.2.105 64707 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:22.796937 0.000000 tcp 10.0.2.105 64707 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:28.796352 0.054544 tcp 10.0.2.105 64708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:28.850720 0.032801 tcp 10.0.2.105 64709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:28.883878 0.224333 tcp 10.0.2.105 64710 -> 195.113.214.249 443 SRPA* 0 0 75 78532 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:29.462066 2.998897 tcp 10.0.2.105 64711 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:38.459471 0.000000 tcp 10.0.2.105 64711 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:44.458735 0.054054 tcp 10.0.2.105 64712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:44.513108 0.054687 tcp 10.0.2.105 64713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:44.568058 0.131050 tcp 10.0.2.105 64714 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:30:46.113910 3.001031 tcp 10.0.2.105 64715 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:30:55.113472 0.000000 tcp 10.0.2.105 64715 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:31:01.112108 2.993845 tcp 10.0.2.105 64716 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:31:08.703091 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:31:10.104803 0.000000 tcp 10.0.2.105 64716 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:31:16.113405 3.004635 tcp 10.0.2.105 64717 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:31:25.116624 0.000000 tcp 10.0.2.105 64717 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:32:40.867796 3.002395 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:32:47.876190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:32:55.877311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:33:11.880008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:33:43.886086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:36:31.117238 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:36:31.117341 3.003542 tcp 10.0.2.105 64718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:36:40.119555 0.000000 tcp 10.0.2.105 64718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:36:46.120139 0.032407 tcp 10.0.2.105 64719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:36:46.152925 0.034713 tcp 10.0.2.105 64720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:36:46.187917 0.132628 tcp 10.0.2.105 64721 -> 195.113.214.249 443 SRPA* 0 0 42 33666 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:36:46.349993 3.003002 tcp 10.0.2.105 64722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:36:55.351231 0.000000 tcp 10.0.2.105 64722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:01.350643 0.053586 tcp 10.0.2.105 64723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:01.404520 0.054371 tcp 10.0.2.105 64724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:01.459199 0.129267 tcp 10.0.2.105 64725 -> 195.113.214.249 443 SRPA* 0 0 40 21118 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:01.842842 2.992122 tcp 10.0.2.105 64726 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:10.833032 0.000000 tcp 10.0.2.105 64726 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:16.833694 0.031742 tcp 10.0.2.105 64727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:16.865707 0.054869 tcp 10.0.2.105 64728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:16.920901 0.129384 tcp 10.0.2.105 64729 -> 195.113.214.249 443 SRPA* 0 0 44 39102 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:37:17.233054 2.994107 tcp 10.0.2.105 64730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:26.226029 0.000000 tcp 10.0.2.105 64730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:32.234791 3.004073 tcp 10.0.2.105 64731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:41.237418 0.000000 tcp 10.0.2.105 64731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:46.204552 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:37:47.235993 3.004260 tcp 10.0.2.105 64732 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:37:56.239210 0.000000 tcp 10.0.2.105 64732 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:39:47.891609 3.002050 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:39:54.899442 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:40:02.901053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:40:18.904016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:40:50.920153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:43:02.239421 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:43:02.239517 2.993768 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:43:11.241591 0.000000 tcp 10.0.2.105 64733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:43:17.242423 0.055362 tcp 10.0.2.105 64734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:43:17.298075 0.054008 tcp 10.0.2.105 64735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:43:17.352410 0.142110 tcp 10.0.2.105 64736 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:43:17.621067 2.994242 tcp 10.0.2.105 64737 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:43:26.613674 0.000000 tcp 10.0.2.105 64737 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:46:54.926035 3.001831 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 21:47:01.932911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:47:09.934712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:47:25.937968 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:47:57.953767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:48:00.754110 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:48:00.754328 0.363218 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:01.113748 0.792978 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:01.886286 0.057837 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2563 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:01.959741 0.229429 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:02.186397 0.115919 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:02.743730 0.283606 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:03.037143 0.226052 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2034 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:03.256773 0.219921 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:03.464701 0.186495 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2516 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:03.619113 0.219620 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2462 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:03.875290 0.075468 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2465 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:04.479767 0.167778 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:04.641665 0.448685 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:05.065766 0.070074 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:05.199660 0.114364 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:05.411542 0.154661 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:05.555852 0.240923 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:05.789700 0.186675 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.029977 0.087925 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2073 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.079814 0.235462 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.295695 0.168952 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.460920 0.162730 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.614706 0.213331 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.825244 0.117573 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:06.950888 0.352906 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:07.299938 0.227233 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:07.524123 0.190040 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:07.725498 0.661739 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2056 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:08.362633 0.216959 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:08.575712 0.074885 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/24 21:48:32.624383 3.003911 tcp 10.0.2.105 64738 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:48:37.200583 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:48:41.626623 0.000000 tcp 10.0.2.105 64738 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:48:47.627115 0.097477 tcp 10.0.2.105 64739 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:48:47.724833 0.054323 tcp 10.0.2.105 64740 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:48:47.779452 0.142695 tcp 10.0.2.105 64741 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:48:48.284180 3.006760 tcp 10.0.2.105 64742 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:48:57.289409 0.000000 tcp 10.0.2.105 64742 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:03.278459 0.031310 tcp 10.0.2.105 64743 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:03.310054 0.032266 tcp 10.0.2.105 64744 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:03.342576 0.125917 tcp 10.0.2.105 64745 -> 195.113.214.249 443 SRPA* 0 0 24 13846 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:03.795483 3.007486 tcp 10.0.2.105 64746 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:13.109561 0.000000 tcp 10.0.2.105 64746 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:19.029855 0.032341 tcp 10.0.2.105 64747 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:19.062475 0.033323 tcp 10.0.2.105 64748 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:19.096099 0.130484 tcp 10.0.2.105 64749 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:49:19.281557 2.969276 tcp 10.0.2.105 64750 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:28.192733 0.000000 tcp 10.0.2.105 64750 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:34.135672 2.961100 tcp 10.0.2.105 64751 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:43.039222 0.000000 tcp 10.0.2.105 64751 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:47.701831 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:49:49.043781 3.004373 tcp 10.0.2.105 64752 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:49:58.046720 0.000000 tcp 10.0.2.105 64752 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:54:01.949945 3.001417 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 21:54:08.957592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:54:16.958767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:54:32.961556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:55:04.047575 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:55:04.047872 3.003195 tcp 10.0.2.105 64753 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:04.968014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 21:55:13.049708 0.000000 tcp 10.0.2.105 64753 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:19.049994 0.032200 tcp 10.0.2.105 64754 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:19.082442 0.031862 tcp 10.0.2.105 64755 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:19.114584 0.128283 tcp 10.0.2.105 64756 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:19.602022 3.001228 tcp 10.0.2.105 64757 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:28.611919 0.000000 tcp 10.0.2.105 64757 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:34.601413 0.031923 tcp 10.0.2.105 64758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:34.633723 0.031639 tcp 10.0.2.105 64759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:34.665627 0.126120 tcp 10.0.2.105 64760 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:35.608511 2.997772 tcp 10.0.2.105 64761 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:44.604852 0.000000 tcp 10.0.2.105 64761 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:55:50.603726 0.031196 tcp 10.0.2.105 64762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:50.635239 0.053732 tcp 10.0.2.105 64763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:50.689232 0.127978 tcp 10.0.2.105 64764 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/24 21:55:51.111904 2.996910 tcp 10.0.2.105 64765 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:56:00.107042 0.000000 tcp 10.0.2.105 64765 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:56:06.110868 3.000004 tcp 10.0.2.105 64766 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:56:15.110643 0.000000 tcp 10.0.2.105 64766 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:56:21.339854 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 21:56:22.739557 2.970810 tcp 10.0.2.105 64767 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 21:56:31.637089 0.000000 tcp 10.0.2.105 64767 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:01:08.974990 3.000624 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:01:15.981477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:01:23.982755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:01:36.110949 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:01:36.111104 2.993416 tcp 10.0.2.105 64768 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:01:39.985875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:01:45.113246 0.000000 tcp 10.0.2.105 64768 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:01:51.114026 0.032788 tcp 10.0.2.105 64769 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:01:51.147065 0.054617 tcp 10.0.2.105 64770 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:01:51.201936 0.151852 tcp 10.0.2.105 64771 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:01:51.432690 3.004220 tcp 10.0.2.105 64772 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:00.435342 0.000000 tcp 10.0.2.105 64772 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:06.434453 0.031850 tcp 10.0.2.105 64773 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:06.466547 0.032028 tcp 10.0.2.105 64774 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:06.498839 0.147573 tcp 10.0.2.105 64775 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:06.709335 2.999343 tcp 10.0.2.105 64776 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:11.991951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:02:15.707478 0.000000 tcp 10.0.2.105 64776 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:21.706112 0.053981 tcp 10.0.2.105 64777 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:21.760601 0.054343 tcp 10.0.2.105 64778 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:21.815237 0.139724 tcp 10.0.2.105 64779 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:02:22.725354 3.006153 tcp 10.0.2.105 64780 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:32.581123 0.000000 tcp 10.0.2.105 64780 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:38.493777 2.966124 tcp 10.0.2.105 64781 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:46.375482 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:02:47.394842 0.000000 tcp 10.0.2.105 64781 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:02:53.312610 2.953900 tcp 10.0.2.105 64782 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:03:02.231754 0.000000 tcp 10.0.2.105 64782 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:07.723917 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:08:07.724026 3.003876 tcp 10.0.2.105 64783 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:15.998631 3.001159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:08:16.726284 0.000000 tcp 10.0.2.105 64783 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:23.404241 0.032208 tcp 10.0.2.105 64784 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:23.436714 0.053767 tcp 10.0.2.105 64785 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:23.490820 0.124440 tcp 10.0.2.105 64786 -> 195.113.214.249 443 SRPA* 0 0 48 29730 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:23.681117 2.967320 tcp 10.0.2.105 64787 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:23.690440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:08:31.587181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:08:32.570436 0.000000 tcp 10.0.2.105 64787 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:38.491896 0.630500 tcp 10.0.2.105 64788 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:39.122737 0.032577 tcp 10.0.2.105 64789 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:39.155562 0.126408 tcp 10.0.2.105 64790 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:39.639332 2.972140 tcp 10.0.2.105 64791 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:47.401794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:08:48.550958 0.000000 tcp 10.0.2.105 64791 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:08:54.458151 0.045160 tcp 10.0.2.105 64792 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:54.503617 0.053715 tcp 10.0.2.105 64793 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:54.557626 0.148380 tcp 10.0.2.105 64794 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:08:56.129581 2.957835 tcp 10.0.2.105 64795 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:09:05.010768 0.000000 tcp 10.0.2.105 64795 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:09:10.939692 2.969750 tcp 10.0.2.105 64796 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:09:19.053119 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:09:19.380681 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:09:20.193880 0.000000 tcp 10.0.2.105 64796 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:09:26.118682 2.973475 tcp 10.0.2.105 64797 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:09:35.181193 0.000000 tcp 10.0.2.105 64797 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:15:23.032119 3.000971 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 22:15:30.039201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:15:38.040835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:15:57.250034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:16:28.801863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:18:32.557637 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:18:32.557771 0.370545 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2130 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:32.924901 0.215892 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:33.836384 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 22:18:40.102628 0.023491 udp 10.0.2.105 7010 <- 213.123.178.217 3364 RSP 0 0 5 2247 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 22:18:40.103096 0.063584 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:41.001019 0.108439 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:41.072619 0.568574 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:42.068767 2.955935 tcp 10.0.2.105 64798 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:18:42.640585 0.226357 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:43.206146 0.217562 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:44.294761 0.089918 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2112 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:45.899887 0.182818 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:49.441627 0.224967 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:50.276242 0.061508 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:50.938893 0.000000 tcp 10.0.2.105 64798 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:18:51.349557 0.112820 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:51.511779 0.165524 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:51.672003 0.503378 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:52.931215 0.655426 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2551 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:53.576477 0.241105 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:54.099180 0.185633 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:54.261449 0.094808 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:56.372547 0.000041 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:18:56.736650 0.235759 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:56.952208 0.212287 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:57.348582 0.054893 tcp 10.0.2.105 64799 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:18:57.403752 0.031255 tcp 10.0.2.105 64800 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:18:57.435278 0.125101 tcp 10.0.2.105 64801 -> 195.113.214.249 443 SRPA* 0 0 23 13998 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:18:58.120916 2.970240 tcp 10.0.2.105 64802 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:18:58.465832 0.117777 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2504 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:58.795649 0.181230 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:59.257735 0.162562 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:59.533731 0.347571 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:18:59.877402 0.215311 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:19:00.554032 0.191008 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2350 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:19:01.043477 0.064421 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 1981 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:19:01.152200 0.690834 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:19:01.813547 0.211624 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:19:07.001980 0.000000 tcp 10.0.2.105 64802 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:19:12.910282 0.031370 tcp 10.0.2.105 64803 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:19:12.941953 0.035128 tcp 10.0.2.105 64804 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:19:12.977361 0.127222 tcp 10.0.2.105 64805 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:19:13.899684 2.949900 tcp 10.0.2.105 64806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:19:22.778025 0.000000 tcp 10.0.2.105 64806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:19:28.695143 2.946498 tcp 10.0.2.105 64807 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:19:36.307601 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:19:37.560780 0.000000 tcp 10.0.2.105 64807 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:22:30.065524 3.002018 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:22:37.073355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:22:45.074860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:23:01.078063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:23:33.083836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:24:42.984729 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:24:42.984825 3.009900 tcp 10.0.2.105 64808 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:24:51.987283 0.000000 tcp 10.0.2.105 64808 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:24:57.987659 0.033490 tcp 10.0.2.105 64809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:24:58.021384 0.032032 tcp 10.0.2.105 64810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:24:58.053731 0.143577 tcp 10.0.2.105 64811 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:24:58.579626 3.001613 tcp 10.0.2.105 64812 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:07.579708 0.000000 tcp 10.0.2.105 64812 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:13.578825 0.031405 tcp 10.0.2.105 64813 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:13.610480 0.054205 tcp 10.0.2.105 64814 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:13.664916 0.145219 tcp 10.0.2.105 64815 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:13.879003 2.993939 tcp 10.0.2.105 64816 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:22.881694 0.000000 tcp 10.0.2.105 64816 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:28.883375 0.032623 tcp 10.0.2.105 64817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:28.916253 0.032850 tcp 10.0.2.105 64818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:28.949442 0.126752 tcp 10.0.2.105 64819 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:25:29.213193 2.992288 tcp 10.0.2.105 64820 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:38.203615 0.000000 tcp 10.0.2.105 64820 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:44.212702 2.993854 tcp 10.0.2.105 64821 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:53.205604 0.000000 tcp 10.0.2.105 64821 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:25:58.202641 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:25:59.213892 3.004710 tcp 10.0.2.105 64822 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:26:08.217283 0.000000 tcp 10.0.2.105 64822 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:29:37.090226 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:29:44.097336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:29:52.098848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:30:08.102009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:30:40.107832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:31:14.217686 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:31:14.217857 3.003329 tcp 10.0.2.105 64823 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:31:23.219835 0.000000 tcp 10.0.2.105 64823 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:31:29.220368 0.031872 tcp 10.0.2.105 64824 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:29.252555 0.032595 tcp 10.0.2.105 64825 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:29.285442 0.124139 tcp 10.0.2.105 64826 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:29.905047 2.998555 tcp 10.0.2.105 64827 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:31:38.934567 0.000000 tcp 10.0.2.105 64827 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:31:44.901883 0.054868 tcp 10.0.2.105 64828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:44.957028 0.053944 tcp 10.0.2.105 64829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:45.011324 0.125636 tcp 10.0.2.105 64830 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:31:45.511246 2.995715 tcp 10.0.2.105 64831 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:31:54.504601 0.000000 tcp 10.0.2.105 64831 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:00.503986 0.053629 tcp 10.0.2.105 64832 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:32:00.557886 0.053577 tcp 10.0.2.105 64833 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:32:00.611761 0.138140 tcp 10.0.2.105 64834 -> 195.113.214.249 443 SRPA* 0 0 72 78206 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:32:01.169870 2.998820 tcp 10.0.2.105 64835 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:10.167292 0.000000 tcp 10.0.2.105 64835 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:16.165779 3.004661 tcp 10.0.2.105 64836 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:25.169138 0.000000 tcp 10.0.2.105 64836 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:29.695516 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:32:31.167784 3.004041 tcp 10.0.2.105 64837 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:32:40.170604 0.000000 tcp 10.0.2.105 64837 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:36:44.114303 3.001238 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:36:51.121125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:36:59.122531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:37:15.126034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:37:46.171152 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:37:46.171296 2.993670 tcp 10.0.2.105 64838 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:37:47.131805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:37:55.163359 0.000000 tcp 10.0.2.105 64838 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:01.173923 0.054797 tcp 10.0.2.105 64839 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:01.229024 0.055765 tcp 10.0.2.105 64840 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:01.285059 0.125886 tcp 10.0.2.105 64841 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:02.141371 2.996275 tcp 10.0.2.105 64842 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:11.136298 0.000000 tcp 10.0.2.105 64842 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:17.135627 0.054173 tcp 10.0.2.105 64843 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:17.190105 0.054521 tcp 10.0.2.105 64844 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:17.244954 0.143040 tcp 10.0.2.105 64845 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:17.772863 2.997185 tcp 10.0.2.105 64846 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:26.768776 0.000000 tcp 10.0.2.105 64846 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:32.768142 0.032904 tcp 10.0.2.105 64847 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:32.801358 0.053852 tcp 10.0.2.105 64848 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:32.855483 0.147262 tcp 10.0.2.105 64849 -> 195.113.214.249 443 SRPA* 0 0 33 18134 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:38:33.038147 3.003835 tcp 10.0.2.105 64850 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:42.040915 0.000000 tcp 10.0.2.105 64850 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:48.039508 2.994045 tcp 10.0.2.105 64851 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:38:57.042080 0.000000 tcp 10.0.2.105 64851 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:39:01.698979 0.000153 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:39:03.041227 2.994002 tcp 10.0.2.105 64852 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:39:12.045812 0.000000 tcp 10.0.2.105 64852 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:43:51.138059 3.001476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:43:58.145462 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:44:06.146856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:44:18.044235 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:44:18.044446 3.004144 tcp 10.0.2.105 64853 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:44:22.149813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:44:27.046195 0.000000 tcp 10.0.2.105 64853 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:44:33.046470 0.054635 tcp 10.0.2.105 64854 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:33.101388 0.032431 tcp 10.0.2.105 64855 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:33.134102 0.150897 tcp 10.0.2.105 64856 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:33.472665 2.998120 tcp 10.0.2.105 64857 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:44:42.469050 0.000000 tcp 10.0.2.105 64857 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:44:48.468442 0.054674 tcp 10.0.2.105 64858 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:48.523418 0.056467 tcp 10.0.2.105 64859 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:48.580184 0.141899 tcp 10.0.2.105 64860 -> 195.113.214.249 443 SRPA* 0 0 34 25686 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:44:48.738807 3.003470 tcp 10.0.2.105 64861 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:44:54.155602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:44:57.740843 0.000000 tcp 10.0.2.105 64861 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:45:03.739746 2.993997 tcp 10.0.2.105 64862 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:45:12.742584 0.000000 tcp 10.0.2.105 64862 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:45:17.699458 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:49:07.209881 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:49:07.209990 0.362508 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2454 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:07.569317 0.212065 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:07.776931 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 22:49:23.914909 0.033374 tcp 10.0.2.105 64863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:23.948544 0.055144 tcp 10.0.2.105 64864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:24.003999 0.146710 tcp 10.0.2.105 64865 -> 195.113.214.249 443 SRPA* 0 0 53 30004 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:24.151713 0.057866 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:24.207650 0.111136 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:24.856095 0.613871 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:26.639080 0.232078 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:26.863844 0.218587 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:27.645768 0.081613 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:27.711092 0.188938 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:31.311881 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 22:49:49.281025 0.109112 tcp 10.0.2.105 64866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:49.390443 0.033193 tcp 10.0.2.105 64867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:49.423953 0.140874 tcp 10.0.2.105 64868 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:49:49.565413 0.172456 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:49.732755 0.061924 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:49.961794 0.112080 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:50.058509 0.450542 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2223 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:50.487860 0.153768 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2134 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:52.665430 0.243532 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2126 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:53.708415 0.186764 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:53.901774 0.099438 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:53.962768 0.235505 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:54.659775 0.226627 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:54.931409 0.118297 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:55.128378 0.183527 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:55.319632 0.159898 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2246 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:55.473098 0.354060 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:49:57.577571 0.062887 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:50:00.681970 0.207007 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:50:05.526947 0.184682 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:50:05.766645 0.743796 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:50:06.483033 0.222939 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/24 22:50:18.743021 3.003769 tcp 10.0.2.105 64869 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:50:23.699568 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:50:27.745304 0.000000 tcp 10.0.2.105 64869 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:50:33.744999 0.032499 tcp 10.0.2.105 64870 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:33.777867 0.055037 tcp 10.0.2.105 64871 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:33.833218 0.130561 tcp 10.0.2.105 64872 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:34.212657 2.996329 tcp 10.0.2.105 64873 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:50:43.207742 0.000000 tcp 10.0.2.105 64873 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:50:49.207273 0.054524 tcp 10.0.2.105 64874 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:49.262097 0.054927 tcp 10.0.2.105 64875 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:49.317286 0.123345 tcp 10.0.2.105 64876 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:50:49.944235 3.007383 tcp 10.0.2.105 64877 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:50:58.950792 0.000000 tcp 10.0.2.105 64877 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:04.943283 0.053683 tcp 10.0.2.105 64878 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:51:04.997262 0.053968 tcp 10.0.2.105 64879 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:51:05.051499 0.145573 tcp 10.0.2.105 64880 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:51:07.301364 2.995282 tcp 10.0.2.105 64881 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:18.541469 0.000000 tcp 10.0.2.105 64881 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:24.468627 2.965262 tcp 10.0.2.105 64882 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:32.270181 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:51:33.355418 0.000000 tcp 10.0.2.105 64882 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:39.282560 2.968840 tcp 10.0.2.105 64883 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:51:48.172483 0.000000 tcp 10.0.2.105 64883 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:56:06.165004 3.001128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 22:56:13.172202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:56:21.173499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:56:37.176108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:56:53.031121 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:56:53.031265 2.968944 tcp 10.0.2.105 64884 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:01.922623 0.000000 tcp 10.0.2.105 64884 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:08.359727 0.054182 tcp 10.0.2.105 64885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:08.414168 0.055964 tcp 10.0.2.105 64886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:08.470416 0.145403 tcp 10.0.2.105 64887 -> 195.113.214.249 443 SRPA* 0 0 41 30976 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:08.872448 2.953124 tcp 10.0.2.105 64888 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:10.227589 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 22:57:17.750652 0.000000 tcp 10.0.2.105 64888 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:23.684973 0.031533 tcp 10.0.2.105 64889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:23.716865 0.053890 tcp 10.0.2.105 64890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:23.771021 0.123701 tcp 10.0.2.105 64891 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:24.484485 2.953971 tcp 10.0.2.105 64892 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:33.364478 0.000000 tcp 10.0.2.105 64892 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:39.289365 0.031721 tcp 10.0.2.105 64893 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:39.321339 0.055085 tcp 10.0.2.105 64894 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:39.376718 0.146836 tcp 10.0.2.105 64895 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/24 22:57:40.564839 3.355450 tcp 10.0.2.105 64896 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:49.841563 0.000000 tcp 10.0.2.105 64896 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:57:55.768013 2.967698 tcp 10.0.2.105 64897 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:58:03.446182 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 22:58:04.663693 0.000000 tcp 10.0.2.105 64897 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:58:10.590114 2.955359 tcp 10.0.2.105 64898 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 22:58:19.485420 0.000000 tcp 10.0.2.105 64898 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:03:13.198069 3.002285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:03:20.206042 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:03:24.933329 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:03:24.934240 3.002770 tcp 10.0.2.105 64899 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:03:28.207593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:03:33.935879 0.000000 tcp 10.0.2.105 64899 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:03:39.936218 0.055152 tcp 10.0.2.105 64900 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:39.991670 0.033304 tcp 10.0.2.105 64901 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:40.025295 0.145191 tcp 10.0.2.105 64902 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:40.191569 2.997611 tcp 10.0.2.105 64903 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:03:44.210795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:03:49.187921 0.000000 tcp 10.0.2.105 64903 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:03:55.187318 0.053805 tcp 10.0.2.105 64904 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:55.241410 0.054476 tcp 10.0.2.105 64905 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:55.296256 0.144695 tcp 10.0.2.105 64906 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:03:55.454270 3.006627 tcp 10.0.2.105 64907 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:04.459740 0.000000 tcp 10.0.2.105 64907 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:10.449898 0.056077 tcp 10.0.2.105 64908 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:04:10.506316 0.054524 tcp 10.0.2.105 64909 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:04:10.561136 0.140989 tcp 10.0.2.105 64910 -> 195.113.214.249 443 SRPA* 0 0 54 33214 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:04:10.875501 2.997163 tcp 10.0.2.105 64911 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:16.216648 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:04:19.881241 0.000000 tcp 10.0.2.105 64911 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:25.871201 2.996641 tcp 10.0.2.105 64912 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:34.863474 0.000000 tcp 10.0.2.105 64912 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:39.700605 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:04:40.872552 2.993845 tcp 10.0.2.105 64913 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:04:49.864474 0.000000 tcp 10.0.2.105 64913 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:09:55.875780 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:09:55.875884 3.003641 tcp 10.0.2.105 64914 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:05.235437 0.000000 tcp 10.0.2.105 64914 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:11.176387 0.055045 tcp 10.0.2.105 64915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:11.231784 0.055091 tcp 10.0.2.105 64916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:11.287160 0.146410 tcp 10.0.2.105 64917 -> 195.113.214.249 443 SRPA* 0 0 41 33612 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:12.072190 2.973824 tcp 10.0.2.105 64918 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:20.984564 0.000000 tcp 10.0.2.105 64918 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:26.923843 0.053399 tcp 10.0.2.105 64919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:26.977525 0.053598 tcp 10.0.2.105 64920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:27.031424 0.146124 tcp 10.0.2.105 64921 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:28.866551 2.960095 tcp 10.0.2.105 64922 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:33.313043 2.973371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:10:37.770212 0.000000 tcp 10.0.2.105 64922 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:40.250418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:10:43.737556 0.032692 tcp 10.0.2.105 64923 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:43.770572 0.056667 tcp 10.0.2.105 64924 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:43.827608 0.145511 tcp 10.0.2.105 64925 -> 195.113.214.249 443 SRPA* 0 0 33 26258 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:10:44.397882 3.001670 tcp 10.0.2.105 64926 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:48.240086 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:10:53.397671 0.000000 tcp 10.0.2.105 64926 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:10:59.396386 3.004213 tcp 10.0.2.105 64927 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:11:04.243265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:11:08.399153 0.000000 tcp 10.0.2.105 64927 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:11:13.196124 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:11:14.397959 3.004273 tcp 10.0.2.105 64928 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:11:23.400954 0.000000 tcp 10.0.2.105 64928 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:11:36.249054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:17:40.255592 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/24 23:17:47.262956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:17:55.264566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:18:11.267737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:18:43.273556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:20:21.316167 0.000186 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:20:21.316399 0.590709 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:21.885795 0.222370 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:23.691935 0.372888 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:24.440787 0.226246 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:24.955367 0.063354 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2045 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:25.162758 0.113060 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:25.302061 1.470099 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:28.215503 0.231171 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2477 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:28.439146 0.217571 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:28.750821 0.074180 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:28.809244 0.188610 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:32.739609 2.994929 tcp 10.0.2.105 64929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:20:34.161024 0.104463 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:34.964170 0.173279 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:36.925248 0.060849 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:38.004380 0.512270 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2137 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:40.783288 0.154897 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:41.094971 0.000000 udp 10.0.2.105 7010 -> 88.111.35.230 1439 INT 0 1 95 flow=From-Botnet-V2-UDP-Attempt 1970/02/24 23:20:41.779588 0.000000 tcp 10.0.2.105 64929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:20:45.719819 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:20:47.741219 0.055132 tcp 10.0.2.105 64930 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:47.796623 0.053460 tcp 10.0.2.105 64931 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:47.850364 0.146851 tcp 10.0.2.105 64932 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:48.493193 2.994428 tcp 10.0.2.105 64933 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:20:56.494760 0.053030 tcp 10.0.2.105 64934 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:56.548140 0.032954 tcp 10.0.2.105 64935 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:56.581355 0.127312 tcp 10.0.2.105 64936 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:20:56.709174 0.245653 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:56.947804 0.187537 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:57.198453 0.234845 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:57.457332 0.207194 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:57.486589 0.000000 tcp 10.0.2.105 64933 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:20:57.661623 0.118784 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2278 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:57.883203 0.353850 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:58.812062 0.157565 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:58.961204 0.454506 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:59.619252 0.064771 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:59.736888 0.208829 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:20:59.943058 0.198408 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:21:00.751682 0.654298 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:21:01.711344 0.215888 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2129 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:21:03.485322 0.053989 tcp 10.0.2.105 64937 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:21:03.539588 0.255655 tcp 10.0.2.105 64938 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:21:03.594548 0.146027 tcp 10.0.2.105 64939 -> 195.113.214.249 443 SRPA* 0 0 21 11560 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:21:03.864451 3.005513 tcp 10.0.2.105 64940 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:21:12.868612 0.000000 tcp 10.0.2.105 64940 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:21:18.856923 3.003718 tcp 10.0.2.105 64941 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:21:27.859832 0.000000 tcp 10.0.2.105 64941 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:21:32.696901 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:24:47.280551 3.000469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:24:54.298541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:25:02.298201 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:25:18.301130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:25:50.307144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:26:33.860268 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:26:33.860510 2.993575 tcp 10.0.2.105 64942 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:26:42.862196 0.000000 tcp 10.0.2.105 64942 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:26:48.862628 0.055081 tcp 10.0.2.105 64943 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:26:48.917994 0.054625 tcp 10.0.2.105 64944 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:26:48.972873 0.156674 tcp 10.0.2.105 64945 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:26:50.390728 2.997090 tcp 10.0.2.105 64946 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:26:59.386566 0.000000 tcp 10.0.2.105 64946 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:05.385846 0.053820 tcp 10.0.2.105 64947 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:05.439957 0.054039 tcp 10.0.2.105 64948 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:05.494276 0.144311 tcp 10.0.2.105 64949 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:06.085189 2.995374 tcp 10.0.2.105 64950 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:15.079215 0.000000 tcp 10.0.2.105 64950 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:21.078556 0.052627 tcp 10.0.2.105 64951 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:21.131484 0.052870 tcp 10.0.2.105 64952 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:21.184638 0.144177 tcp 10.0.2.105 64953 -> 195.113.214.249 443 SRPA* 0 0 24 13388 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:27:21.428714 3.004177 tcp 10.0.2.105 64954 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:30.431016 0.000000 tcp 10.0.2.105 64954 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:36.429872 2.994090 tcp 10.0.2.105 64955 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:45.432787 0.000000 tcp 10.0.2.105 64955 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:27:50.199400 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:27:51.431558 2.993983 tcp 10.0.2.105 64956 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:28:00.424427 0.000000 tcp 10.0.2.105 64956 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:31:54.313504 3.001408 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:32:01.320737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:32:09.322329 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:32:25.325292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:32:57.331330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:33:06.440732 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:33:06.440875 2.998346 tcp 10.0.2.105 64957 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:15.448011 0.000000 tcp 10.0.2.105 64957 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:21.438163 0.129002 tcp 10.0.2.105 64958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:21.567507 0.054361 tcp 10.0.2.105 64959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:21.622238 0.142950 tcp 10.0.2.105 64960 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:21.946633 3.004501 tcp 10.0.2.105 64961 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:30.949824 0.000000 tcp 10.0.2.105 64961 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:36.948871 0.063177 tcp 10.0.2.105 64962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:37.012531 0.107655 tcp 10.0.2.105 64963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:37.120663 0.139037 tcp 10.0.2.105 64964 -> 195.113.214.249 443 SRPA* 0 0 25 13274 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:37.411427 3.001772 tcp 10.0.2.105 64965 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:46.421997 0.000000 tcp 10.0.2.105 64965 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:33:52.410804 0.104128 tcp 10.0.2.105 64966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:52.515240 0.053844 tcp 10.0.2.105 64967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:52.569374 0.154276 tcp 10.0.2.105 64968 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:33:52.817812 2.997460 tcp 10.0.2.105 64969 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:34:01.813545 0.000000 tcp 10.0.2.105 64969 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:34:07.812754 2.993438 tcp 10.0.2.105 64970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:34:16.805057 0.000000 tcp 10.0.2.105 64970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:34:21.702855 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:34:22.814173 3.003786 tcp 10.0.2.105 64971 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:34:31.816855 0.000000 tcp 10.0.2.105 64971 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:39:01.337397 3.001274 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:39:08.344717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:39:16.345871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:39:32.349116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:39:37.817856 0.000148 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:39:37.818128 3.002561 tcp 10.0.2.105 64972 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:39:46.819286 0.000000 tcp 10.0.2.105 64972 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:39:52.820188 0.054122 tcp 10.0.2.105 64973 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:39:52.874575 0.054942 tcp 10.0.2.105 64974 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:39:52.929780 0.149969 tcp 10.0.2.105 64975 -> 195.113.214.249 443 SRPA* 0 0 59 41920 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:39:53.127018 3.006243 tcp 10.0.2.105 64976 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:02.142061 0.000000 tcp 10.0.2.105 64976 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:04.354971 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:40:08.121615 0.055114 tcp 10.0.2.105 64977 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:08.177042 0.054123 tcp 10.0.2.105 64978 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:08.231541 0.148499 tcp 10.0.2.105 64979 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:08.556003 2.999375 tcp 10.0.2.105 64980 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:17.553873 0.000000 tcp 10.0.2.105 64980 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:23.553480 0.054369 tcp 10.0.2.105 64981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:23.608127 0.061737 tcp 10.0.2.105 64982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:23.670142 0.216284 tcp 10.0.2.105 64983 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:40:24.716377 3.002394 tcp 10.0.2.105 64984 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:33.717285 0.000000 tcp 10.0.2.105 64984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:39.716025 3.004141 tcp 10.0.2.105 64985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:47.697587 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:40:48.718898 0.000000 tcp 10.0.2.105 64985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:40:54.719600 3.002244 tcp 10.0.2.105 64986 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:41:03.720713 0.000000 tcp 10.0.2.105 64986 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:08.361710 3.001026 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:46:09.724123 0.000276 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:46:09.724498 2.990313 tcp 10.0.2.105 64987 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:15.368473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:46:18.713306 0.000000 tcp 10.0.2.105 64987 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:23.370360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:46:24.723493 0.054488 tcp 10.0.2.105 64988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:24.778249 0.058506 tcp 10.0.2.105 64989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:24.837022 0.147404 tcp 10.0.2.105 64990 -> 195.113.214.249 443 SRPA* 0 0 41 22594 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:25.015124 3.001209 tcp 10.0.2.105 64991 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:34.015734 0.000000 tcp 10.0.2.105 64991 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:39.373194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:46:40.014561 0.053938 tcp 10.0.2.105 64992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:40.068743 0.053863 tcp 10.0.2.105 64993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:40.122922 0.147326 tcp 10.0.2.105 64994 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:46:40.836124 3.003416 tcp 10.0.2.105 64995 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:49.838023 0.000000 tcp 10.0.2.105 64995 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:46:55.836978 3.003552 tcp 10.0.2.105 64996 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:47:03.698055 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:47:04.839279 0.000000 tcp 10.0.2.105 64996 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:47:11.379347 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:51:17.443193 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:51:17.443356 0.091915 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2539 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:17.495759 0.494009 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:17.975005 0.220147 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:18.607664 0.113582 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:18.967668 0.215954 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:19.286464 0.378719 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:19.662149 0.063702 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:19.792919 0.648936 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:20.390646 0.086806 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:25.560464 0.224826 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:26.086745 0.230155 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:26.656727 0.189852 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:28.180983 0.101645 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2299 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:28.267452 0.168528 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:28.687452 0.066441 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 1984 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:28.735610 0.154213 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:30.195227 0.446472 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:30.620725 0.243199 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:30.856478 0.186855 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2208 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:31.285624 0.118315 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:31.405684 0.182785 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:31.585487 0.229786 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:31.794915 0.212269 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:32.004484 0.160035 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:32.158350 0.214226 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:32.369485 0.347450 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:32.713047 0.065211 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:32.871714 0.197389 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:33.078926 0.758731 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2547 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:51:33.807327 0.216024 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/24 23:52:10.840159 2.993538 tcp 10.0.2.105 64997 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:15.696642 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:52:19.842602 0.000000 tcp 10.0.2.105 64997 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:25.842446 0.062782 tcp 10.0.2.105 64998 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:25.905424 0.054423 tcp 10.0.2.105 64999 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:25.960161 0.142342 tcp 10.0.2.105 65000 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:27.610130 2.997933 tcp 10.0.2.105 65001 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:36.606822 0.000000 tcp 10.0.2.105 65001 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:42.606264 0.053364 tcp 10.0.2.105 65002 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:42.659884 0.054123 tcp 10.0.2.105 65003 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:42.714259 0.151309 tcp 10.0.2.105 65004 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:43.497846 3.002998 tcp 10.0.2.105 65005 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:52.499571 0.000000 tcp 10.0.2.105 65005 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:52:58.498601 0.054412 tcp 10.0.2.105 65006 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:58.553277 0.053758 tcp 10.0.2.105 65007 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:58.607394 0.143734 tcp 10.0.2.105 65008 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:52:58.845389 2.997617 tcp 10.0.2.105 65009 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:07.851709 0.000000 tcp 10.0.2.105 65009 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:13.840739 2.993502 tcp 10.0.2.105 65010 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:15.385470 3.001264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/24 23:53:22.392541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:53:22.833284 0.000000 tcp 10.0.2.105 65010 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:27.700468 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:53:28.842940 2.993221 tcp 10.0.2.105 65011 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:30.394191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:53:37.834526 0.000000 tcp 10.0.2.105 65011 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:53:46.397158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:54:18.403299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/24 23:58:43.845348 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:58:43.845446 3.004356 tcp 10.0.2.105 65012 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:58:52.847777 0.000000 tcp 10.0.2.105 65012 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:58:58.847832 0.054579 tcp 10.0.2.105 65013 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:58:58.902644 0.054307 tcp 10.0.2.105 65014 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:58:58.957203 0.140310 tcp 10.0.2.105 65015 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:58:59.426918 3.004643 tcp 10.0.2.105 65016 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:08.430192 0.000000 tcp 10.0.2.105 65016 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:14.432513 0.054201 tcp 10.0.2.105 65017 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:14.487011 0.055165 tcp 10.0.2.105 65018 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:14.542577 0.148523 tcp 10.0.2.105 65019 -> 195.113.214.249 443 SRPA* 0 0 43 38156 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:15.977231 3.016441 tcp 10.0.2.105 65020 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:24.973682 0.000000 tcp 10.0.2.105 65020 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:30.983139 0.053578 tcp 10.0.2.105 65021 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:31.036942 0.055090 tcp 10.0.2.105 65022 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:31.092373 0.143520 tcp 10.0.2.105 65023 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/24 23:59:32.158467 3.000162 tcp 10.0.2.105 65024 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:41.159508 0.000000 tcp 10.0.2.105 65024 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:47.155986 3.004740 tcp 10.0.2.105 65025 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/24 23:59:55.521721 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/24 23:59:56.970110 0.000000 tcp 10.0.2.105 65025 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:00:02.896624 2.972549 tcp 10.0.2.105 65026 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:00:11.794550 0.000000 tcp 10.0.2.105 65026 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:00:22.904388 2.970819 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:00:29.830131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:00:38.077559 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:00:53.888700 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:01:25.494120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:05:17.160878 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:05:17.160998 2.993068 tcp 10.0.2.105 65027 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:05:26.163151 0.000000 tcp 10.0.2.105 65027 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:05:32.163648 0.055593 tcp 10.0.2.105 65028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:32.219555 0.174099 tcp 10.0.2.105 65029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:32.393914 0.204649 tcp 10.0.2.105 65030 -> 195.113.214.249 443 SRPA* 0 0 32 17200 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:32.908889 2.998174 tcp 10.0.2.105 65031 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:05:41.906773 0.000000 tcp 10.0.2.105 65031 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:05:47.904792 0.101545 tcp 10.0.2.105 65032 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:48.006674 0.056739 tcp 10.0.2.105 65033 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:48.063712 0.140443 tcp 10.0.2.105 65034 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:05:48.695401 3.004337 tcp 10.0.2.105 65035 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:05:57.932819 0.000000 tcp 10.0.2.105 65035 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:03.876372 0.055316 tcp 10.0.2.105 65036 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:06:03.932019 0.055905 tcp 10.0.2.105 65037 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:06:03.988507 0.148136 tcp 10.0.2.105 65038 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:06:04.994517 2.979202 tcp 10.0.2.105 65039 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:13.925415 0.000000 tcp 10.0.2.105 65039 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:19.846435 2.968305 tcp 10.0.2.105 65040 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:27.812352 0.178484 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:06:29.081476 0.000000 tcp 10.0.2.105 65040 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:35.033156 2.960319 tcp 10.0.2.105 65041 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:06:43.935746 0.000000 tcp 10.0.2.105 65041 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:07:29.443250 3.001399 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:07:36.450682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:07:44.454825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:08:00.454852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:08:32.461190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:11:49.825213 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:11:49.825302 3.003860 tcp 10.0.2.105 65042 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:11:58.828388 0.000000 tcp 10.0.2.105 65042 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:04.828376 0.055044 tcp 10.0.2.105 65043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:04.883735 0.054367 tcp 10.0.2.105 65044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:04.938441 0.148073 tcp 10.0.2.105 65045 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:05.673376 3.008703 tcp 10.0.2.105 65046 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:14.682578 0.000000 tcp 10.0.2.105 65046 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:20.678381 0.169513 tcp 10.0.2.105 65047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:20.848438 0.055269 tcp 10.0.2.105 65048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:20.904030 0.221772 tcp 10.0.2.105 65049 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:21.377540 2.976904 tcp 10.0.2.105 65050 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:30.322211 0.000000 tcp 10.0.2.105 65050 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:36.265227 0.054839 tcp 10.0.2.105 65051 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:36.320468 0.054820 tcp 10.0.2.105 65052 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:36.375603 0.152197 tcp 10.0.2.105 65053 -> 195.113.214.249 443 SRPA* 0 0 25 13274 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:12:37.183230 3.003892 tcp 10.0.2.105 65054 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:46.185707 0.000000 tcp 10.0.2.105 65054 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:12:52.184412 3.004836 tcp 10.0.2.105 65055 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:13:01.187297 0.000000 tcp 10.0.2.105 65055 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:13:05.693774 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:13:07.186297 3.035128 tcp 10.0.2.105 65056 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:13:16.188855 0.000000 tcp 10.0.2.105 65056 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:14:36.476244 3.002794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:14:43.484438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:14:51.485739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:15:07.488790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:15:39.495238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:21:38.451647 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:21:38.451772 0.602712 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:39.016918 0.461724 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:39.456942 0.221168 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:39.954106 0.116928 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:40.344391 0.215040 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2561 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:40.556109 0.377414 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:40.929983 0.082147 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:41.300165 0.553876 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:42.506024 0.084749 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2422 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:42.901971 0.222796 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:43.111575 0.229770 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:43.345524 0.166157 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:43.501541 3.001094 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 00:21:43.506004 0.068166 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:43.992456 0.191976 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:44.293747 0.790816 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:45.069113 0.231508 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:45.228612 0.446271 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:45.653697 0.117441 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:45.839415 0.239715 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:46.071527 0.185900 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:47.328528 0.175305 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:47.500218 0.228481 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:47.709256 0.212985 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:47.918518 0.159606 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:48.155982 0.226258 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2426 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:48.379116 0.354734 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:48.730299 0.131324 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:48.884268 0.196093 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:49.125299 0.747286 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1350 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:49.858157 0.218416 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2243 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:21:50.551345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:21:52.244170 2.971929 tcp 10.0.2.105 65057 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:21:58.520970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:22:01.213977 0.000000 tcp 10.0.2.105 65057 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:06.200744 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:22:07.224210 0.054851 tcp 10.0.2.105 65058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:07.279349 0.053130 tcp 10.0.2.105 65059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:07.332823 0.174345 tcp 10.0.2.105 65060 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:08.803126 3.056021 tcp 10.0.2.105 65061 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:14.556656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:22:17.815830 0.000000 tcp 10.0.2.105 65061 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:23.806942 0.054307 tcp 10.0.2.105 65062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:23.861200 0.055571 tcp 10.0.2.105 65063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:23.917144 0.150893 tcp 10.0.2.105 65064 -> 195.113.214.249 443 SRPA* 0 0 48 26908 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:24.360053 3.001471 tcp 10.0.2.105 65065 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:33.360561 0.000000 tcp 10.0.2.105 65065 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:39.359379 0.055306 tcp 10.0.2.105 65066 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:39.414997 0.055193 tcp 10.0.2.105 65067 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:39.470540 0.152088 tcp 10.0.2.105 65068 -> 195.113.214.249 443 SRPA* 0 0 46 23720 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:22:39.658712 2.994628 tcp 10.0.2.105 65069 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:46.858054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:22:48.972079 0.000000 tcp 10.0.2.105 65069 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:22:54.902523 2.964875 tcp 10.0.2.105 65070 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:23:03.809422 0.000000 tcp 10.0.2.105 65070 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:23:08.319562 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:23:09.759223 2.963960 tcp 10.0.2.105 65071 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:23:18.663546 0.000000 tcp 10.0.2.105 65071 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:24.655697 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:28:24.655849 3.003540 tcp 10.0.2.105 65072 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:35.331714 0.000000 tcp 10.0.2.105 65072 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:41.257624 0.055709 tcp 10.0.2.105 65073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:41.312536 0.053371 tcp 10.0.2.105 65074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:41.366172 0.139673 tcp 10.0.2.105 65075 -> 195.113.214.249 443 SRPA* 0 0 43 38194 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:41.589879 2.965155 tcp 10.0.2.105 65076 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:50.481341 0.000000 tcp 10.0.2.105 65076 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:52.009702 2.959665 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:28:56.407639 0.055548 tcp 10.0.2.105 65077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:56.463526 0.054974 tcp 10.0.2.105 65078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:56.518809 0.144637 tcp 10.0.2.105 65079 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:28:57.760579 2.959964 tcp 10.0.2.105 65080 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:28:58.932525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:29:06.648041 0.000000 tcp 10.0.2.105 65080 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:06.836626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:29:12.574991 0.053458 tcp 10.0.2.105 65081 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:29:12.628746 0.054824 tcp 10.0.2.105 65082 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:29:12.683830 0.147280 tcp 10.0.2.105 65083 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:29:13.250357 2.961951 tcp 10.0.2.105 65084 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:22.134432 0.000000 tcp 10.0.2.105 65084 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:22.643463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:29:28.066003 2.970009 tcp 10.0.2.105 65085 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:36.959564 0.000000 tcp 10.0.2.105 65085 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:41.557338 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:29:42.881593 2.972527 tcp 10.0.2.105 65086 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:51.777330 0.000000 tcp 10.0.2.105 65086 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:29:54.261868 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:34:57.039839 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:34:57.040034 2.993458 tcp 10.0.2.105 65087 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:06.042303 0.000000 tcp 10.0.2.105 65087 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:12.042920 0.055416 tcp 10.0.2.105 65088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:12.098611 0.054519 tcp 10.0.2.105 65089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:12.153536 0.150085 tcp 10.0.2.105 65090 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:12.559078 2.996886 tcp 10.0.2.105 65091 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:21.554458 0.000000 tcp 10.0.2.105 65091 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:27.553735 0.053890 tcp 10.0.2.105 65092 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:27.607911 0.054214 tcp 10.0.2.105 65093 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:27.662392 0.146069 tcp 10.0.2.105 65094 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:28.626374 3.714306 tcp 10.0.2.105 65095 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:38.261121 0.000000 tcp 10.0.2.105 65095 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:44.197164 0.056278 tcp 10.0.2.105 65096 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:44.253787 0.055196 tcp 10.0.2.105 65097 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:44.309343 0.154493 tcp 10.0.2.105 65098 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:35:44.539040 2.966624 tcp 10.0.2.105 65099 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:53.430708 0.000000 tcp 10.0.2.105 65099 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:35:57.951829 2.964699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:35:59.350662 2.968402 tcp 10.0.2.105 65100 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:36:04.869757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:36:08.241297 0.000000 tcp 10.0.2.105 65100 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:36:12.771538 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:36:12.899404 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:36:14.168162 2.955210 tcp 10.0.2.105 65101 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:36:23.060799 0.000000 tcp 10.0.2.105 65101 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:36:28.583988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:37:00.577073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:41:28.983460 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:41:28.983622 3.003498 tcp 10.0.2.105 65102 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:41:37.985818 0.000000 tcp 10.0.2.105 65102 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:41:43.986580 0.055086 tcp 10.0.2.105 65103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:41:44.041946 0.056295 tcp 10.0.2.105 65104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:41:44.098555 0.146779 tcp 10.0.2.105 65105 -> 195.113.214.249 443 SRPA* 0 0 41 21628 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:41:44.411725 2.998031 tcp 10.0.2.105 65106 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:41:53.407831 0.000000 tcp 10.0.2.105 65106 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:41:59.945379 0.055112 tcp 10.0.2.105 65107 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:00.000747 0.057603 tcp 10.0.2.105 65108 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:00.058659 0.153827 tcp 10.0.2.105 65109 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:00.233224 2.970244 tcp 10.0.2.105 65110 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:09.128602 0.000000 tcp 10.0.2.105 65110 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:15.053215 0.055352 tcp 10.0.2.105 65111 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:15.108847 0.054524 tcp 10.0.2.105 65112 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:15.163647 0.145006 tcp 10.0.2.105 65113 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:42:15.472727 2.954035 tcp 10.0.2.105 65114 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:24.363328 0.000000 tcp 10.0.2.105 65114 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:30.288762 2.953351 tcp 10.0.2.105 65115 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:39.168629 0.000000 tcp 10.0.2.105 65115 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:43.699569 0.703411 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:42:45.789197 2.951070 tcp 10.0.2.105 65116 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:42:54.674593 0.000000 tcp 10.0.2.105 65116 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:43:05.014068 2.963563 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:43:11.937089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:43:19.838661 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:43:35.636916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:44:07.600941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:52:09.634190 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:52:09.634359 0.118360 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:09.711881 0.471353 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:10.223052 0.221617 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:10.437570 0.349714 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:10.784942 0.066771 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:10.878678 0.111633 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:12.110166 0.216831 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:12.324128 0.630407 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 1983 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:12.903023 0.083495 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:13.700710 0.218816 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:13.908857 0.061808 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:15.152587 2.993339 tcp 10.0.2.105 65117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:52:15.799317 0.185838 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:15.971075 0.233343 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:16.196619 0.169560 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2244 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:16.360969 0.500747 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2401 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:16.844634 0.153974 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:17.894076 0.240921 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:19.169429 0.447021 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:19.594608 0.118037 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2373 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:21.530761 0.188505 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:22.603795 0.175060 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:22.775219 0.231517 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:23.158963 0.924289 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:24.538993 0.164477 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2141 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:24.695174 0.217602 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:24.838870 0.000000 tcp 10.0.2.105 65117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:52:27.641931 0.187606 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2520 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:28.188400 0.352497 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:28.536836 0.071290 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:30.222205 0.705385 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:30.779476 0.055444 tcp 10.0.2.105 65118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:30.835277 0.054146 tcp 10.0.2.105 65119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:30.889739 0.153111 tcp 10.0.2.105 65120 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:31.552078 2.965163 tcp 10.0.2.105 65121 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:52:32.386984 0.216970 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/25 00:52:40.440352 0.000000 tcp 10.0.2.105 65121 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:52:46.362997 0.055761 tcp 10.0.2.105 65122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:46.419008 0.057694 tcp 10.0.2.105 65123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:46.477022 0.157470 tcp 10.0.2.105 65124 -> 195.113.214.249 443 SRPA* 0 0 24 11930 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:52:46.765779 2.976578 tcp 10.0.2.105 65125 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:52:55.665761 0.000000 tcp 10.0.2.105 65125 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:53:01.579011 2.968916 tcp 10.0.2.105 65126 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:53:10.471708 0.000000 tcp 10.0.2.105 65126 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:53:15.264283 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:55:44.616471 3.000770 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 00:55:51.623145 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:55:59.624821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:56:15.627702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:56:47.633754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 00:58:16.361986 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:58:16.362104 2.993621 tcp 10.0.2.105 65127 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:58:25.354218 0.000000 tcp 10.0.2.105 65127 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:58:31.364516 0.055189 tcp 10.0.2.105 65128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:31.420079 0.055232 tcp 10.0.2.105 65129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:31.475647 0.145557 tcp 10.0.2.105 65130 -> 195.113.214.249 443 SRPA* 0 0 40 33558 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:31.778626 2.998417 tcp 10.0.2.105 65131 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:58:40.776777 0.000000 tcp 10.0.2.105 65131 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:58:46.775806 0.053929 tcp 10.0.2.105 65132 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:46.830138 0.057314 tcp 10.0.2.105 65133 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:46.887858 0.223554 tcp 10.0.2.105 65134 -> 195.113.214.249 443 SRPA* 0 0 33 21822 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:58:47.334081 3.006158 tcp 10.0.2.105 65135 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:58:56.340709 0.000000 tcp 10.0.2.105 65135 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:02.327881 0.054799 tcp 10.0.2.105 65136 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:59:02.382962 0.055386 tcp 10.0.2.105 65137 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:59:02.438633 0.148698 tcp 10.0.2.105 65138 -> 195.113.214.249 443 SRPA* 0 0 40 21214 flow=From-Botnet-V2-TCP-Established 1970/02/25 00:59:02.597664 3.004448 tcp 10.0.2.105 65139 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:11.600789 0.000000 tcp 10.0.2.105 65139 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:17.589692 2.993893 tcp 10.0.2.105 65140 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:26.592125 0.000000 tcp 10.0.2.105 65140 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:31.218880 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 00:59:32.590899 2.994350 tcp 10.0.2.105 65141 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 00:59:41.583727 0.000000 tcp 10.0.2.105 65141 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:02:51.659650 3.001796 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:02:58.667032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:03:06.668749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:03:22.671651 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:03:54.677653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:04:47.594137 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:04:47.594310 3.003829 tcp 10.0.2.105 65142 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:04:56.596687 0.000000 tcp 10.0.2.105 65142 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:02.598472 0.054569 tcp 10.0.2.105 65143 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:02.653401 0.055033 tcp 10.0.2.105 65144 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:02.708948 0.142874 tcp 10.0.2.105 65145 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:02.963654 3.006486 tcp 10.0.2.105 65146 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:11.968904 0.000000 tcp 10.0.2.105 65146 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:17.958248 0.053754 tcp 10.0.2.105 65147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:18.012304 0.059255 tcp 10.0.2.105 65148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:18.071926 0.146882 tcp 10.0.2.105 65149 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:18.236326 3.005647 tcp 10.0.2.105 65150 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:27.240824 0.000000 tcp 10.0.2.105 65150 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:33.230172 0.054850 tcp 10.0.2.105 65151 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:33.285297 0.056194 tcp 10.0.2.105 65152 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:33.341824 0.144396 tcp 10.0.2.105 65153 -> 195.113.214.249 443 SRPA* 0 0 41 21798 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:05:33.535480 2.998592 tcp 10.0.2.105 65154 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:42.545464 0.000000 tcp 10.0.2.105 65154 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:48.531723 2.993745 tcp 10.0.2.105 65155 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:05:57.524181 0.000000 tcp 10.0.2.105 65155 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:06:02.220826 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:06:03.533263 3.003729 tcp 10.0.2.105 65156 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:06:12.535740 0.000000 tcp 10.0.2.105 65156 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:10:22.687736 3.002039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:10:29.695128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:10:37.697084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:10:53.699918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:11:18.626174 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:11:18.626338 2.975539 tcp 10.0.2.105 65157 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:11:25.730560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:11:27.539308 0.000000 tcp 10.0.2.105 65157 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:11:33.720265 0.055882 tcp 10.0.2.105 65158 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:33.776541 0.055240 tcp 10.0.2.105 65159 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:33.832124 0.153102 tcp 10.0.2.105 65160 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:34.358549 3.004180 tcp 10.0.2.105 65161 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:11:43.371649 0.000000 tcp 10.0.2.105 65161 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:11:49.360881 0.054199 tcp 10.0.2.105 65162 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:49.415341 0.057015 tcp 10.0.2.105 65163 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:49.472651 0.149014 tcp 10.0.2.105 65164 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:11:51.004500 3.002278 tcp 10.0.2.105 65165 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:00.004818 0.000000 tcp 10.0.2.105 65165 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:06.004992 0.053834 tcp 10.0.2.105 65166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:12:06.059195 0.057261 tcp 10.0.2.105 65167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:12:06.116807 0.152344 tcp 10.0.2.105 65168 -> 195.113.214.249 443 SRPA* 0 0 40 21118 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:12:06.583856 3.005584 tcp 10.0.2.105 65169 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:15.587627 0.000000 tcp 10.0.2.105 65169 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:21.576754 3.004085 tcp 10.0.2.105 65170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:30.579355 0.000000 tcp 10.0.2.105 65170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:35.215547 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:12:36.578252 3.004363 tcp 10.0.2.105 65171 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:12:45.580805 0.000000 tcp 10.0.2.105 65171 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:17:29.722028 3.782338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:17:37.467317 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:17:45.376470 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:17:52.138168 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:17:52.138326 2.956223 tcp 10.0.2.105 65172 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:18:01.023353 0.000000 tcp 10.0.2.105 65172 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:18:01.187112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:18:06.963480 0.222510 tcp 10.0.2.105 65173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:18:07.186268 0.054648 tcp 10.0.2.105 65174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:18:07.241205 0.154076 tcp 10.0.2.105 65175 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:18:09.555947 2.968159 tcp 10.0.2.105 65176 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:18:18.448507 0.000000 tcp 10.0.2.105 65176 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:18:32.960284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:22:54.877578 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:22:54.877703 0.121735 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:22:54.961466 0.764824 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:22:56.712538 0.255193 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:22:57.686017 0.371456 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2313 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:22:58.053358 0.064042 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:22:58.858752 0.113000 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:02.626772 0.234496 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2084 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:02.858491 0.290617 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2525 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:03.088413 0.073276 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:03.219525 0.220622 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:03.428420 0.061511 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:04.847836 0.203161 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2487 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:05.168947 0.233547 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:05.395215 0.171289 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:05.561406 0.111336 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2053 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:05.690302 0.154953 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2404 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:05.835604 0.240948 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:06.068643 0.448880 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:06.493988 0.117992 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:07.131861 0.184385 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:07.896839 0.181061 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:08.074843 0.236016 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:09.129523 0.218559 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:09.344793 0.165377 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2461 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:09.782745 0.208388 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2474 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:09.987604 0.191970 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:10.521313 0.352974 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:10.870587 0.070108 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:11.447731 0.749604 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:12.197741 0.216342 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:23:24.059343 2.994072 tcp 10.0.2.105 65177 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:23:28.792035 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:23:33.106262 0.000000 tcp 10.0.2.105 65177 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:23:39.062496 0.056974 tcp 10.0.2.105 65178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:39.119751 0.056029 tcp 10.0.2.105 65179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:39.176033 0.145004 tcp 10.0.2.105 65180 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:40.557889 2.999054 tcp 10.0.2.105 65181 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:23:49.555462 0.000000 tcp 10.0.2.105 65181 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:23:55.555368 0.055236 tcp 10.0.2.105 65182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:55.610927 0.055655 tcp 10.0.2.105 65183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:55.666922 0.153322 tcp 10.0.2.105 65184 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:23:57.172809 3.008103 tcp 10.0.2.105 65185 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:06.179540 0.000000 tcp 10.0.2.105 65185 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:14.875562 0.055216 tcp 10.0.2.105 65186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:24:14.931054 0.054899 tcp 10.0.2.105 65187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:24:14.986295 0.148636 tcp 10.0.2.105 65188 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:24:17.148787 2.959146 tcp 10.0.2.105 65189 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:26.034091 0.000000 tcp 10.0.2.105 65189 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:31.959035 2.960989 tcp 10.0.2.105 65190 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:39.156872 3.411818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:24:39.610693 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:24:40.845744 0.000000 tcp 10.0.2.105 65190 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:46.528132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:24:47.223039 2.963738 tcp 10.0.2.105 65191 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:24:54.426161 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:24:56.106490 0.000000 tcp 10.0.2.105 65191 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:25:10.224624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:25:41.843364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:29:59.468126 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:29:59.468342 3.003702 tcp 10.0.2.105 65192 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:08.470323 0.000000 tcp 10.0.2.105 65192 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:14.470837 0.062801 tcp 10.0.2.105 65193 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:14.534049 0.054264 tcp 10.0.2.105 65194 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:14.588723 0.150804 tcp 10.0.2.105 65195 -> 195.113.214.249 443 SRPA* 0 0 41 22864 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:14.876741 2.997036 tcp 10.0.2.105 65196 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:23.882704 0.000000 tcp 10.0.2.105 65196 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:29.875180 0.052984 tcp 10.0.2.105 65197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:29.928554 0.056396 tcp 10.0.2.105 65198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:29.985262 0.145517 tcp 10.0.2.105 65199 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:30.166906 2.998695 tcp 10.0.2.105 65200 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:39.163938 0.000000 tcp 10.0.2.105 65200 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:45.163755 0.053996 tcp 10.0.2.105 65201 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:45.218118 0.067015 tcp 10.0.2.105 65202 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:45.285397 0.153644 tcp 10.0.2.105 65203 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:30:45.487888 3.000119 tcp 10.0.2.105 65204 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:30:54.486663 0.000000 tcp 10.0.2.105 65204 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:31:00.485374 3.005389 tcp 10.0.2.105 65205 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:31:09.487984 0.000000 tcp 10.0.2.105 65205 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:31:14.214864 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:31:15.486959 3.004172 tcp 10.0.2.105 65206 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:31:24.489496 0.000000 tcp 10.0.2.105 65206 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:31:43.781295 3.000386 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:31:50.787684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:31:58.789044 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:32:14.791480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:32:46.798115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:36:30.490185 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:36:30.490363 2.993383 tcp 10.0.2.105 65207 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:36:39.492578 0.000000 tcp 10.0.2.105 65207 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:36:45.492875 0.055671 tcp 10.0.2.105 65208 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:36:45.548747 0.058001 tcp 10.0.2.105 65209 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:36:45.607017 0.145564 tcp 10.0.2.105 65210 -> 195.113.214.249 443 SRPA* 0 0 33 18796 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:36:46.420177 2.996055 tcp 10.0.2.105 65211 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:36:55.415346 0.000000 tcp 10.0.2.105 65211 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:01.414557 0.054129 tcp 10.0.2.105 65212 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:01.468984 0.053784 tcp 10.0.2.105 65213 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:01.523071 0.147418 tcp 10.0.2.105 65214 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:02.850543 0.000000 tcp 10.0.2.105 65215 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:07.983704 0.000000 tcp 10.0.2.105 65215 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:13.906257 0.000000 tcp 10.0.2.105 65215 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:19.840414 0.056174 tcp 10.0.2.105 65216 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:19.896879 0.055129 tcp 10.0.2.105 65217 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:19.952361 0.146758 tcp 10.0.2.105 65218 -> 195.113.214.249 443 SRPA* 0 0 25 13482 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:37:20.649192 2.969526 tcp 10.0.2.105 65219 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:29.552975 0.000000 tcp 10.0.2.105 65219 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:35.459614 2.956376 tcp 10.0.2.105 65220 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:44.340395 0.000000 tcp 10.0.2.105 65220 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:48.837889 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:37:50.274235 2.953017 tcp 10.0.2.105 65221 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:37:59.150629 0.000000 tcp 10.0.2.105 65221 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:38:51.637403 2.958859 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:38:58.558308 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:39:06.462477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:39:22.263704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:39:53.876227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:43:03.675036 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:43:03.675228 3.004108 tcp 10.0.2.105 65222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:12.677865 0.000000 tcp 10.0.2.105 65222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:18.678172 0.056223 tcp 10.0.2.105 65223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:18.734777 0.055778 tcp 10.0.2.105 65224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:18.790872 0.145352 tcp 10.0.2.105 65225 -> 195.113.214.249 443 SRPA* 0 0 28 16394 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:19.102438 2.998967 tcp 10.0.2.105 65226 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:28.099937 0.000000 tcp 10.0.2.105 65226 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:34.101514 0.395608 tcp 10.0.2.105 65227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:34.497430 0.055065 tcp 10.0.2.105 65228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:34.552789 0.233167 tcp 10.0.2.105 65229 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:35.294925 2.989779 tcp 10.0.2.105 65230 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:44.293366 0.000000 tcp 10.0.2.105 65230 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:43:50.293046 1.867421 tcp 10.0.2.105 65231 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:52.160786 0.053584 tcp 10.0.2.105 65232 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:52.214669 0.145783 tcp 10.0.2.105 65233 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:43:52.953693 2.957192 tcp 10.0.2.105 65234 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:44:01.834725 0.000000 tcp 10.0.2.105 65234 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:44:07.762676 2.969450 tcp 10.0.2.105 65235 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:44:16.656055 0.000000 tcp 10.0.2.105 65235 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:44:21.156860 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:44:22.579881 2.972541 tcp 10.0.2.105 65236 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:44:31.476109 0.000000 tcp 10.0.2.105 65236 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:45:58.052152 2.964704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 01:46:04.969170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:46:12.877981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:46:28.840121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:47:00.846024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:53:04.853506 2.999995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 01:53:11.859289 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:53:19.860344 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:53:34.432208 0.000225 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:53:34.432494 0.100691 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:34.491915 0.879863 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:35.863723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:53:36.808638 3.001139 tcp 10.0.2.105 65237 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:53:36.887645 0.223751 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:37.352716 0.360791 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:41.170088 0.058381 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:41.329438 0.111007 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:42.239608 0.213571 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2370 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:42.450481 0.314062 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2149 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:42.760819 0.082137 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:43.928687 0.218066 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:44.136109 0.070397 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2457 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:44.272813 0.733083 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:45.698108 0.231860 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:45.807983 0.000000 tcp 10.0.2.105 65237 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:53:46.004728 0.164147 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:46.163657 0.111266 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:46.656232 0.152832 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2065 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:47.193120 0.248083 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2221 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:47.432501 0.461795 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:47.872617 0.117715 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:48.350848 0.187868 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:48.514300 0.177026 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:49.215708 0.233647 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:49.428544 0.213615 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2425 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:50.622227 0.163542 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:50.777038 0.226140 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:51.502543 0.200100 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:51.808613 0.055308 tcp 10.0.2.105 65238 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:53:51.864306 0.054509 tcp 10.0.2.105 65239 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:53:51.919146 0.147832 tcp 10.0.2.105 65240 -> 195.113.214.249 443 SRPA* 0 0 42 21492 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:53:52.047528 0.347146 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:52.180367 3.001155 tcp 10.0.2.105 65241 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:53:52.390872 0.064155 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:53.460986 0.659459 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1186 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:53:54.107080 0.216086 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 01:54:01.549027 0.000000 tcp 10.0.2.105 65241 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:54:08.174907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 01:59:07.181095 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 01:59:07.181239 2.992673 tcp 10.0.2.105 65242 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:16.173238 0.000000 tcp 10.0.2.105 65242 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:22.183789 0.054702 tcp 10.0.2.105 65243 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:22.238868 0.053691 tcp 10.0.2.105 65244 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:22.292858 0.148458 tcp 10.0.2.105 65245 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:22.608010 2.998864 tcp 10.0.2.105 65246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:31.605379 0.000000 tcp 10.0.2.105 65246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:37.604455 0.053908 tcp 10.0.2.105 65247 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:37.658667 0.053989 tcp 10.0.2.105 65248 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:37.712951 0.142065 tcp 10.0.2.105 65249 -> 195.113.214.249 443 SRPA* 0 0 21 12430 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:37.947294 3.001567 tcp 10.0.2.105 65250 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:46.947570 0.000000 tcp 10.0.2.105 65250 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 01:59:52.946901 0.054116 tcp 10.0.2.105 65251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:53.001366 0.054358 tcp 10.0.2.105 65252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:53.056127 0.147849 tcp 10.0.2.105 65253 -> 195.113.214.249 443 SRPA* 0 0 25 16288 flow=From-Botnet-V2-TCP-Established 1970/02/25 01:59:53.294760 3.005978 tcp 10.0.2.105 65254 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:02.299551 0.000000 tcp 10.0.2.105 65254 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:08.288821 3.004498 tcp 10.0.2.105 65255 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:11.875237 3.002301 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:00:17.291077 0.000000 tcp 10.0.2.105 65255 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:18.883190 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:00:22.221976 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:00:23.291882 2.992043 tcp 10.0.2.105 65256 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:26.884920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:00:32.292754 0.000000 tcp 10.0.2.105 65256 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:00:42.888205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:01:14.894419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:05:38.293331 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:05:38.293426 3.003202 tcp 10.0.2.105 65257 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:05:47.295508 0.000000 tcp 10.0.2.105 65257 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:05:53.296730 0.056165 tcp 10.0.2.105 65258 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:05:53.353157 0.054046 tcp 10.0.2.105 65259 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:05:53.407526 0.151768 tcp 10.0.2.105 65260 -> 195.113.214.249 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:05:53.972913 3.006740 tcp 10.0.2.105 65261 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:02.977975 0.000000 tcp 10.0.2.105 65261 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:08.967186 0.055193 tcp 10.0.2.105 65262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:09.022675 0.057665 tcp 10.0.2.105 65263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:09.080654 0.410155 tcp 10.0.2.105 65264 -> 195.113.214.249 443 SRPA* 0 0 74 78478 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:09.781740 3.000557 tcp 10.0.2.105 65265 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:18.780730 0.000000 tcp 10.0.2.105 65265 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:24.779973 0.053968 tcp 10.0.2.105 65266 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:24.834212 0.054322 tcp 10.0.2.105 65267 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:24.888886 0.149218 tcp 10.0.2.105 65268 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:06:25.371387 2.993523 tcp 10.0.2.105 65269 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:34.363149 0.000000 tcp 10.0.2.105 65269 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:40.372154 0.000000 tcp 10.0.2.105 65270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:45.988421 0.000000 tcp 10.0.2.105 65270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:51.918004 0.000000 tcp 10.0.2.105 65270 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:06:56.718784 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:06:57.866570 2.969662 tcp 10.0.2.105 65271 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:07:06.758803 0.000000 tcp 10.0.2.105 65271 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:07:28.015068 2.967314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:07:34.937373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:07:42.839900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:07:58.644438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:08:30.249390 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:12:10.386690 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:12:10.386868 3.003900 tcp 10.0.2.105 65272 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:19.389276 0.000000 tcp 10.0.2.105 65272 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:25.391740 0.057191 tcp 10.0.2.105 65273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:25.449265 0.056787 tcp 10.0.2.105 65274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:25.506403 0.148263 tcp 10.0.2.105 65275 -> 195.113.214.249 443 SRPA* 0 0 45 36540 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:27.117329 2.996727 tcp 10.0.2.105 65276 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:36.113257 0.000000 tcp 10.0.2.105 65276 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:42.112680 0.054825 tcp 10.0.2.105 65277 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:42.167833 0.055427 tcp 10.0.2.105 65278 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:42.223582 0.143342 tcp 10.0.2.105 65279 -> 195.113.214.249 443 SRPA* 0 0 42 21226 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:42.543213 3.003518 tcp 10.0.2.105 65280 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:51.545666 0.000000 tcp 10.0.2.105 65280 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:12:57.544665 0.052701 tcp 10.0.2.105 65281 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:57.597674 0.053862 tcp 10.0.2.105 65282 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:57.651906 0.153573 tcp 10.0.2.105 65283 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:12:59.145427 3.005632 tcp 10.0.2.105 65284 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:13:08.149554 0.000000 tcp 10.0.2.105 65284 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:13:14.138527 3.003873 tcp 10.0.2.105 65285 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:13:21.719262 0.267215 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:13:23.386352 0.000000 tcp 10.0.2.105 65285 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:13:29.325511 2.964820 tcp 10.0.2.105 65286 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:13:38.240888 0.000000 tcp 10.0.2.105 65286 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:14:32.923958 3.001699 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:14:39.930792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:14:47.932733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:15:03.935811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:15:35.942016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:18:44.142569 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:18:44.142782 3.003368 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:18:53.145682 0.000000 tcp 10.0.2.105 65287 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:18:59.145507 0.059203 tcp 10.0.2.105 65288 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:18:59.205003 0.055487 tcp 10.0.2.105 65289 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:18:59.260789 0.148615 tcp 10.0.2.105 65290 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:18:59.745612 3.003612 tcp 10.0.2.105 65291 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:08.747742 0.000000 tcp 10.0.2.105 65291 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:14.747200 0.055182 tcp 10.0.2.105 65292 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:14.802689 0.055094 tcp 10.0.2.105 65293 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:14.858107 0.149260 tcp 10.0.2.105 65294 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:16.292881 3.009924 tcp 10.0.2.105 65295 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:25.311684 0.000000 tcp 10.0.2.105 65295 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:31.290812 0.517396 tcp 10.0.2.105 65296 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:31.808500 0.054604 tcp 10.0.2.105 65297 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:31.863383 0.145135 tcp 10.0.2.105 65298 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:19:32.132159 2.969020 tcp 10.0.2.105 65299 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:41.040440 0.000000 tcp 10.0.2.105 65299 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:46.985124 2.964938 tcp 10.0.2.105 65300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:19:55.900195 0.000000 tcp 10.0.2.105 65300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:20:00.404527 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:20:01.849453 2.977630 tcp 10.0.2.105 65301 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:20:10.767225 0.000000 tcp 10.0.2.105 65301 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:21:39.948047 3.001587 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:21:46.954799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:21:57.921670 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:22:13.697087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:22:45.259389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:24:21.508722 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:24:21.508857 0.084328 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:21.554426 0.378641 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:22.005050 0.221967 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:22.310801 0.365144 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:22.672122 0.057702 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:22.727633 0.115482 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:22.803431 0.232393 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:23.033239 0.650752 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:23.626132 0.061537 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:23.764840 0.074728 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:23.824601 0.189975 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.001763 0.185869 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2227 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.179777 0.231763 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.405074 0.167408 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.662984 0.105053 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.752289 0.154348 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:24.897154 0.252161 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:25.140222 0.456032 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:25.568164 0.117272 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2366 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:25.970579 0.189467 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:26.574860 0.179727 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2151 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:26.751552 0.233757 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:26.964901 0.212667 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:27.174755 0.195404 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:27.361429 0.225363 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:27.583688 0.198403 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:27.791121 0.347365 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:28.134608 0.062227 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2044 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:28.219366 0.660758 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:24:28.853207 0.210940 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:25:16.824120 3.838414 tcp 10.0.2.105 65302 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:25:22.164238 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:25:26.579227 0.000000 tcp 10.0.2.105 65302 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:25:32.505833 0.055827 tcp 10.0.2.105 65303 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:32.561944 0.055891 tcp 10.0.2.105 65304 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:32.618111 0.147140 tcp 10.0.2.105 65305 -> 195.113.214.249 443 SRPA* 0 0 23 13334 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:32.952873 2.953266 tcp 10.0.2.105 65306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:25:41.831703 0.000000 tcp 10.0.2.105 65306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:25:47.748533 0.056509 tcp 10.0.2.105 65307 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:47.805307 0.054537 tcp 10.0.2.105 65308 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:47.860133 0.154346 tcp 10.0.2.105 65309 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:25:48.432387 2.951657 tcp 10.0.2.105 65310 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:25:57.302358 0.000000 tcp 10.0.2.105 65310 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:03.220364 0.054766 tcp 10.0.2.105 65311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:26:03.275425 0.054716 tcp 10.0.2.105 65312 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:26:03.330503 0.146872 tcp 10.0.2.105 65313 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:26:03.739991 2.954659 tcp 10.0.2.105 65314 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:12.605499 0.000000 tcp 10.0.2.105 65314 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:18.523623 2.962549 tcp 10.0.2.105 65315 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:27.397436 0.000000 tcp 10.0.2.105 65315 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:32.215218 0.643894 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:26:33.983957 2.971958 tcp 10.0.2.105 65316 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:26:42.878651 0.000000 tcp 10.0.2.105 65316 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:28:46.981331 3.002258 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:28:53.989404 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:29:01.990364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:29:17.993741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:29:49.999693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:31:48.370223 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:31:48.370401 2.993675 tcp 10.0.2.105 65317 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:31:57.372730 0.000000 tcp 10.0.2.105 65317 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:03.373577 0.055010 tcp 10.0.2.105 65318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:03.428884 0.054493 tcp 10.0.2.105 65319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:03.483627 0.146319 tcp 10.0.2.105 65320 -> 195.113.214.249 443 SRPA* 0 0 42 22308 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:03.973644 3.003073 tcp 10.0.2.105 65321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:12.975568 0.000000 tcp 10.0.2.105 65321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:18.974161 0.056560 tcp 10.0.2.105 65322 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:19.031093 0.056227 tcp 10.0.2.105 65323 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:19.087609 0.151140 tcp 10.0.2.105 65324 -> 195.113.214.249 443 SRPA* 0 0 25 13900 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:19.439717 2.999217 tcp 10.0.2.105 65325 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:28.437468 0.000000 tcp 10.0.2.105 65325 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:34.436646 0.054470 tcp 10.0.2.105 65326 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:34.491407 0.057973 tcp 10.0.2.105 65327 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:34.549651 0.161905 tcp 10.0.2.105 65328 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:32:36.830562 2.993365 tcp 10.0.2.105 65329 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:45.832610 0.000000 tcp 10.0.2.105 65329 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:51.831469 2.993982 tcp 10.0.2.105 65330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:32:59.722504 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:33:00.824273 0.000000 tcp 10.0.2.105 65330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:33:06.832873 3.004340 tcp 10.0.2.105 65331 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:33:15.843027 0.000000 tcp 10.0.2.105 65331 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:35:54.005916 3.001622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:36:01.013318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:36:09.014193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:36:25.017919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:36:57.023915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:38:21.836262 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:38:21.836383 3.003782 tcp 10.0.2.105 65332 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:38:30.838916 0.000000 tcp 10.0.2.105 65332 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:38:36.839097 0.055459 tcp 10.0.2.105 65333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:36.894832 0.056064 tcp 10.0.2.105 65334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:36.951224 0.147482 tcp 10.0.2.105 65335 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:37.534692 3.007992 tcp 10.0.2.105 65336 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:38:46.541142 0.000000 tcp 10.0.2.105 65336 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:38:52.530647 0.055359 tcp 10.0.2.105 65337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:52.586278 0.055107 tcp 10.0.2.105 65338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:52.641670 0.150173 tcp 10.0.2.105 65339 -> 195.113.214.249 443 SRPA* 0 0 45 23672 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:38:52.848883 3.223048 tcp 10.0.2.105 65340 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:02.024740 0.000000 tcp 10.0.2.105 65340 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:07.975308 0.053116 tcp 10.0.2.105 65341 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:39:08.028722 0.054714 tcp 10.0.2.105 65342 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:39:08.083731 0.150257 tcp 10.0.2.105 65343 -> 195.113.214.249 443 SRPA* 0 0 23 13828 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:39:08.669728 2.961627 tcp 10.0.2.105 65344 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:17.573724 0.000000 tcp 10.0.2.105 65344 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:23.554648 3.003999 tcp 10.0.2.105 65345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:32.557435 0.000000 tcp 10.0.2.105 65345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:37.213839 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:39:38.555970 3.004474 tcp 10.0.2.105 65346 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:39:47.559162 0.000000 tcp 10.0.2.105 65346 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:43:01.029645 3.001959 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:43:08.037183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:43:16.038785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:43:32.041473 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:44:04.047863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:44:53.559840 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:44:53.560046 2.993092 tcp 10.0.2.105 65347 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:02.561848 0.000000 tcp 10.0.2.105 65347 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:08.562936 0.057414 tcp 10.0.2.105 65348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:08.620625 0.056374 tcp 10.0.2.105 65349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:08.677322 0.151794 tcp 10.0.2.105 65350 -> 195.113.214.249 443 SRPA* 0 0 38 29354 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:08.845569 2.999682 tcp 10.0.2.105 65351 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:17.843866 0.000000 tcp 10.0.2.105 65351 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:23.843273 0.053960 tcp 10.0.2.105 65352 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:23.897543 0.053904 tcp 10.0.2.105 65353 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:23.951702 0.191886 tcp 10.0.2.105 65354 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:24.768504 3.000225 tcp 10.0.2.105 65355 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:33.766797 0.000000 tcp 10.0.2.105 65355 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:39.766008 0.128744 tcp 10.0.2.105 65356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:39.895136 0.055588 tcp 10.0.2.105 65357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:39.951017 0.155822 tcp 10.0.2.105 65358 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:45:40.275295 3.005401 tcp 10.0.2.105 65359 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:49.278966 0.000000 tcp 10.0.2.105 65359 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:45:55.268006 3.004488 tcp 10.0.2.105 65360 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:46:04.270564 0.000000 tcp 10.0.2.105 65360 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:46:09.217638 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:46:10.269790 2.993594 tcp 10.0.2.105 65361 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:46:19.840367 0.000000 tcp 10.0.2.105 65361 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:54:35.135440 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:54:35.135697 0.097963 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2521 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:35.192216 0.646422 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:36.227627 0.226302 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2224 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:36.446288 0.371857 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:37.357797 0.063646 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:37.641678 0.112258 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:37.716987 0.213301 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:37.927686 0.077874 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2464 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:39.302701 0.196073 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:39.486801 0.192323 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2439 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:40.861888 2.995730 tcp 10.0.2.105 65362 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:54:40.862234 0.565013 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:41.751463 0.061533 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:42.164056 0.230818 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:42.413812 0.166247 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:42.967047 0.188640 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:43.369076 0.153777 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:44.016120 0.242336 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2188 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:44.257651 0.444081 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:44.681449 0.117491 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2158 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:44.857243 0.235437 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:45.970993 0.214666 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2627 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:46.284662 0.186858 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:47.666687 0.173674 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:47.836786 0.176619 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:48.106405 0.212729 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:48.315563 0.197157 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:48.778211 0.352568 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 1958 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:49.127433 0.062693 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:49.338951 0.610924 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:49.856660 0.000000 tcp 10.0.2.105 65362 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:54:49.921914 0.210539 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/25 02:54:55.856698 0.055933 tcp 10.0.2.105 65363 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:54:55.912857 0.054260 tcp 10.0.2.105 65364 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:54:55.967417 0.150738 tcp 10.0.2.105 65365 -> 195.113.214.249 443 SRPA* 0 0 39 31170 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:54:56.498167 3.002017 tcp 10.0.2.105 65366 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:05.502856 0.000000 tcp 10.0.2.105 65366 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:11.498040 0.055879 tcp 10.0.2.105 65367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:55:11.554313 0.059000 tcp 10.0.2.105 65368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:55:11.613637 0.157635 tcp 10.0.2.105 65369 -> 195.113.214.249 443 SRPA* 0 0 46 22862 flow=From-Botnet-V2-TCP-Established 1970/02/25 02:55:11.821628 3.000555 tcp 10.0.2.105 65370 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:20.820749 0.000000 tcp 10.0.2.105 65370 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:26.819672 2.994981 tcp 10.0.2.105 65371 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:35.822516 0.000000 tcp 10.0.2.105 65371 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 02:55:39.061692 2.999603 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 02:55:40.719514 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 02:55:46.067028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:55:54.184788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:56:10.081625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 02:56:42.087730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:00:41.822802 0.000139 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:00:41.823030 3.003661 tcp 10.0.2.105 65372 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:00:50.826660 0.000000 tcp 10.0.2.105 65372 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:00:56.825986 0.055735 tcp 10.0.2.105 65373 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:00:56.882088 0.054778 tcp 10.0.2.105 65374 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:00:56.937141 0.147352 tcp 10.0.2.105 65375 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:00:57.622965 3.006414 tcp 10.0.2.105 65376 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:06.628043 0.000000 tcp 10.0.2.105 65376 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:12.617218 0.054296 tcp 10.0.2.105 65377 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:12.671836 0.055100 tcp 10.0.2.105 65378 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:12.727258 0.145522 tcp 10.0.2.105 65379 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:12.911558 0.000000 tcp 10.0.2.105 65380 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:18.304787 0.000000 tcp 10.0.2.105 65380 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:24.229973 0.000000 tcp 10.0.2.105 65380 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:30.165954 0.054680 tcp 10.0.2.105 65381 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:30.221021 0.056226 tcp 10.0.2.105 65382 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:30.277521 0.149766 tcp 10.0.2.105 65383 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:01:31.037759 2.953990 tcp 10.0.2.105 65384 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:39.929810 0.000000 tcp 10.0.2.105 65384 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:45.857032 2.952253 tcp 10.0.2.105 65385 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:01:53.702578 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:01:54.768818 0.000000 tcp 10.0.2.105 65385 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:02:00.705983 2.964557 tcp 10.0.2.105 65386 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:02:09.593261 0.000000 tcp 10.0.2.105 65386 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:02:47.411643 2.960957 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:02:54.330493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:03:02.230617 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:03:18.028704 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:03:51.674931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:07:13.806309 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:07:13.806441 3.003965 tcp 10.0.2.105 65387 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:22.808522 0.000000 tcp 10.0.2.105 65387 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:28.809286 0.054738 tcp 10.0.2.105 65388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:28.864395 0.055756 tcp 10.0.2.105 65389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:28.920417 0.147304 tcp 10.0.2.105 65390 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:29.233501 3.008632 tcp 10.0.2.105 65391 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:38.240931 0.000000 tcp 10.0.2.105 65391 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:44.230131 0.053859 tcp 10.0.2.105 65392 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:44.284447 0.225531 tcp 10.0.2.105 65393 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:44.509837 0.150058 tcp 10.0.2.105 65394 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:44.862823 3.001990 tcp 10.0.2.105 65395 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:53.863447 0.000000 tcp 10.0.2.105 65395 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:07:59.863113 0.054123 tcp 10.0.2.105 65396 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:59.917531 0.056963 tcp 10.0.2.105 65397 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:07:59.974824 0.151123 tcp 10.0.2.105 65398 -> 195.113.214.249 443 SRPA* 0 0 42 22920 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:08:01.236164 3.002078 tcp 10.0.2.105 65399 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:08:10.236395 0.000000 tcp 10.0.2.105 65399 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:08:16.235953 3.004019 tcp 10.0.2.105 65400 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:08:24.217075 0.238092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:08:25.458710 0.000000 tcp 10.0.2.105 65400 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:08:31.396080 2.978468 tcp 10.0.2.105 65401 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:08:40.312570 0.000000 tcp 10.0.2.105 65401 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:10:17.131717 3.002022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:10:24.139387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:10:32.142715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:10:48.143541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:11:23.710037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:13:47.735687 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:13:47.735856 2.950937 tcp 10.0.2.105 65402 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:13:56.609139 0.000000 tcp 10.0.2.105 65402 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:02.529855 0.056229 tcp 10.0.2.105 65403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:02.586403 0.054424 tcp 10.0.2.105 65404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:02.641090 0.148839 tcp 10.0.2.105 65405 -> 195.113.214.249 443 SRPA* 0 0 43 24920 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:02.989792 2.952086 tcp 10.0.2.105 65406 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:11.857834 0.000000 tcp 10.0.2.105 65406 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:17.788070 0.054219 tcp 10.0.2.105 65407 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:17.842540 0.055860 tcp 10.0.2.105 65408 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:17.898648 0.217823 tcp 10.0.2.105 65409 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:18.617601 2.959243 tcp 10.0.2.105 65410 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:27.491268 0.000000 tcp 10.0.2.105 65410 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:33.406006 0.055645 tcp 10.0.2.105 65411 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:33.461966 0.058153 tcp 10.0.2.105 65412 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:33.520632 0.148577 tcp 10.0.2.105 65413 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:14:33.787320 2.960112 tcp 10.0.2.105 65414 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:42.663556 0.000000 tcp 10.0.2.105 65414 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:48.578569 2.962127 tcp 10.0.2.105 65415 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:14:57.466679 0.000000 tcp 10.0.2.105 65415 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:15:02.174338 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:15:03.371221 2.947726 tcp 10.0.2.105 65416 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:15:12.235812 0.000000 tcp 10.0.2.105 65416 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:17:24.165898 3.125590 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:17:31.266084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:17:39.198441 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:17:55.188158 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:18:27.193679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:20:17.933318 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:20:17.933417 3.004398 tcp 10.0.2.105 65417 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:20:26.936042 0.000000 tcp 10.0.2.105 65417 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:20:32.936633 0.083932 tcp 10.0.2.105 65418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:20:33.020793 0.054704 tcp 10.0.2.105 65419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:20:33.075802 0.154965 tcp 10.0.2.105 65420 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:20:33.272431 2.997192 tcp 10.0.2.105 65421 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:20:42.268389 0.000000 tcp 10.0.2.105 65421 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:24:31.200423 3.577950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 03:24:38.732643 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:24:46.643845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:24:54.836606 0.828672 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:24:55.665492 0.086152 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:24:55.712270 0.661102 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2522 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:24:56.542348 0.219786 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:02.778200 2.710648 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:05.488698 0.372263 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2245 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:05.637383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:25:08.068997 0.063831 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:08.229214 0.208879 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2320 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:08.800441 0.075764 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:11.694676 0.199567 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2535 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:11.881748 0.186004 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:13.398838 0.280052 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2200 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:13.964749 0.065969 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 1999 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:14.294707 0.225742 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2460 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:17.280793 0.166573 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:18.075881 0.106234 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2432 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:19.129049 0.154878 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:19.934855 0.242788 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2416 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:20.169586 0.442089 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:21.901577 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:25:23.181916 0.118238 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2041 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:25.080379 0.232452 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:27.680721 0.213168 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:27.890841 0.189952 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:28.386138 0.174505 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:28.557406 0.159561 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:28.957700 0.211879 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:29.162101 0.198973 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:35.623424 0.348465 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:35.992893 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 03:25:37.204534 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:25:51.046285 2.964099 tcp 10.0.2.105 65422 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:25:52.965493 0.055990 tcp 10.0.2.105 65423 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:25:53.021750 0.068241 tcp 10.0.2.105 65424 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:25:53.090367 0.150780 tcp 10.0.2.105 65425 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:25:53.241767 0.688752 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:53.904589 0.216020 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:25:59.925208 0.000000 tcp 10.0.2.105 65422 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:05.836617 0.053609 tcp 10.0.2.105 65426 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:05.890522 0.053597 tcp 10.0.2.105 65427 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:05.944565 0.154082 tcp 10.0.2.105 65428 -> 195.113.214.249 443 SRPA* 0 0 41 32568 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:06.800939 2.950589 tcp 10.0.2.105 65429 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:15.667579 0.000000 tcp 10.0.2.105 65429 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:21.583642 0.055400 tcp 10.0.2.105 65430 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:21.639399 0.055194 tcp 10.0.2.105 65431 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:21.694990 0.157026 tcp 10.0.2.105 65432 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:26:22.108629 2.952841 tcp 10.0.2.105 65433 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:30.970809 0.000000 tcp 10.0.2.105 65433 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:38.766218 2.963172 tcp 10.0.2.105 65434 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:47.640323 0.000000 tcp 10.0.2.105 65434 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:26:52.506586 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:31:38.234432 3.001283 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:31:45.241351 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:31:49.778465 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:31:49.778568 3.003534 tcp 10.0.2.105 65435 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:31:53.243188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:31:58.781045 0.000000 tcp 10.0.2.105 65435 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:04.782182 0.055575 tcp 10.0.2.105 65436 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:04.838045 0.058418 tcp 10.0.2.105 65437 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:04.896764 0.157782 tcp 10.0.2.105 65438 -> 195.113.214.249 443 SRPA* 0 0 26 13326 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:05.833882 3.001735 tcp 10.0.2.105 65439 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:09.246055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:32:14.834017 0.000000 tcp 10.0.2.105 65439 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:20.833300 0.054933 tcp 10.0.2.105 65440 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:20.888569 0.060976 tcp 10.0.2.105 65441 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:20.949796 0.147011 tcp 10.0.2.105 65442 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:21.182840 3.004548 tcp 10.0.2.105 65443 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:30.186643 0.000000 tcp 10.0.2.105 65443 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:36.185470 0.054406 tcp 10.0.2.105 65444 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:36.240180 0.054457 tcp 10.0.2.105 65445 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:36.295013 0.140666 tcp 10.0.2.105 65446 -> 195.113.214.249 443 SRPA* 0 0 40 31758 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:32:37.340192 3.000697 tcp 10.0.2.105 65447 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:41.252236 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:32:46.339434 0.000000 tcp 10.0.2.105 65447 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:32:52.338177 3.004291 tcp 10.0.2.105 65448 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:33:00.219242 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:33:01.340813 0.000000 tcp 10.0.2.105 65448 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:33:07.339806 2.993940 tcp 10.0.2.105 65449 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:33:16.342627 0.000000 tcp 10.0.2.105 65449 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:38:22.343249 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:38:22.343391 3.003402 tcp 10.0.2.105 65450 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:38:31.345315 0.000000 tcp 10.0.2.105 65450 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:38:37.345643 0.054858 tcp 10.0.2.105 65451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:37.400752 0.055244 tcp 10.0.2.105 65452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:37.456465 0.146841 tcp 10.0.2.105 65453 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:38.062180 2.997299 tcp 10.0.2.105 65454 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:38:45.258257 3.001689 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:38:47.057983 0.000000 tcp 10.0.2.105 65454 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:38:52.267153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:38:53.057421 0.057487 tcp 10.0.2.105 65455 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:53.115215 0.055221 tcp 10.0.2.105 65456 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:53.170722 0.144681 tcp 10.0.2.105 65457 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:38:53.418151 3.003078 tcp 10.0.2.105 65458 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:00.266585 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:39:02.419902 0.000000 tcp 10.0.2.105 65458 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:08.419343 0.054680 tcp 10.0.2.105 65459 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:39:08.474422 0.055385 tcp 10.0.2.105 65460 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:39:08.530100 0.149029 tcp 10.0.2.105 65461 -> 195.113.214.249 443 SRPA* 0 0 40 21312 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:39:08.717674 2.995415 tcp 10.0.2.105 65462 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:16.270100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:39:17.722035 0.000000 tcp 10.0.2.105 65462 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:23.710947 2.994013 tcp 10.0.2.105 65463 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:32.703675 0.000000 tcp 10.0.2.105 65463 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:37.220192 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:39:38.712310 2.993797 tcp 10.0.2.105 65464 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:47.704972 0.000000 tcp 10.0.2.105 65464 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:39:48.276109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:44:53.715510 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:44:53.715600 3.004562 tcp 10.0.2.105 65465 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:02.718242 0.000000 tcp 10.0.2.105 65465 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:08.718309 0.054605 tcp 10.0.2.105 65466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:08.773188 0.068766 tcp 10.0.2.105 65467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:08.842208 0.150381 tcp 10.0.2.105 65468 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:09.697550 3.004798 tcp 10.0.2.105 65469 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:18.701360 0.000000 tcp 10.0.2.105 65469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:24.690712 0.099835 tcp 10.0.2.105 65470 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:24.790844 0.069677 tcp 10.0.2.105 65471 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:24.860828 0.165092 tcp 10.0.2.105 65472 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:25.196821 2.998198 tcp 10.0.2.105 65473 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:35.451198 0.000000 tcp 10.0.2.105 65473 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:41.383904 0.072382 tcp 10.0.2.105 65474 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:41.456627 0.055499 tcp 10.0.2.105 65475 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:41.512595 0.149206 tcp 10.0.2.105 65476 -> 195.113.214.249 443 SRPA* 0 0 41 22488 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:45:41.934756 2.955908 tcp 10.0.2.105 65477 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:50.812388 0.000000 tcp 10.0.2.105 65477 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:45:53.324146 2.965676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:45:56.741203 2.969008 tcp 10.0.2.105 65478 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:46:00.246446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:46:05.632465 0.000000 tcp 10.0.2.105 65478 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:46:08.921282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:46:11.309649 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:46:12.325985 2.972439 tcp 10.0.2.105 65479 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:46:21.222208 0.000000 tcp 10.0.2.105 65479 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:46:24.724752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:46:56.331439 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:51:25.749218 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:51:25.749378 2.993343 tcp 10.0.2.105 65480 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:51:34.751575 0.000000 tcp 10.0.2.105 65480 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:51:40.752955 0.055513 tcp 10.0.2.105 65481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:51:40.808843 0.055790 tcp 10.0.2.105 65482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:51:40.864902 0.150945 tcp 10.0.2.105 65483 -> 195.113.214.249 443 SRPA* 0 0 58 35346 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:51:41.956436 3.000007 tcp 10.0.2.105 65484 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:51:50.955258 0.000000 tcp 10.0.2.105 65484 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:56:09.757698 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:56:09.757861 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 261 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 03:56:28.585621 0.056348 tcp 10.0.2.105 65485 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:56:28.642307 0.054940 tcp 10.0.2.105 65486 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:56:28.697496 0.161810 tcp 10.0.2.105 65487 -> 195.113.214.249 443 SRPA* 0 0 43 34840 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:56:28.979192 0.088911 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:29.028856 0.746257 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:30.307245 0.217128 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:31.439740 0.117348 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:32.259238 0.372086 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:32.627256 0.063301 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:33.472536 0.218683 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:33.688602 0.071838 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:34.353613 0.190966 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:34.533337 0.942302 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:35.448188 0.062597 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:35.912193 0.354000 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:36.208084 0.231910 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:37.050596 0.174125 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:37.749175 0.117354 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:37.849452 0.148896 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:38.501472 0.246858 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:38.739773 0.547819 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:39.530153 0.117436 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:39.870136 0.214294 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:40.081333 0.234361 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2273 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:40.368712 0.180730 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:40.525996 0.214201 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:40.850294 0.167704 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:41.009043 0.223087 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:41.229386 0.347210 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:41.572650 0.200794 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:42.001836 0.698033 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:42.672312 0.257369 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 03:56:56.955148 3.004233 tcp 10.0.2.105 65488 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:01.711926 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:57:05.310812 3.000438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 03:57:05.957762 0.000000 tcp 10.0.2.105 65488 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:11.957102 0.056832 tcp 10.0.2.105 65489 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:12.014232 0.057247 tcp 10.0.2.105 65490 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:12.071809 0.149947 tcp 10.0.2.105 65491 -> 195.113.214.249 443 SRPA* 0 0 39 21338 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:12.317280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:57:12.829608 3.002463 tcp 10.0.2.105 65492 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:20.318844 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:57:21.830726 0.000000 tcp 10.0.2.105 65492 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:27.830011 0.053848 tcp 10.0.2.105 65493 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:27.884205 0.057695 tcp 10.0.2.105 65494 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:27.942228 0.163437 tcp 10.0.2.105 65495 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:28.241140 2.993429 tcp 10.0.2.105 65496 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:36.321649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:57:37.232971 0.000000 tcp 10.0.2.105 65496 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:43.243531 0.054609 tcp 10.0.2.105 65497 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:43.298401 0.057152 tcp 10.0.2.105 65498 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:43.355837 0.184831 tcp 10.0.2.105 65499 -> 195.113.214.249 443 SRPA* 0 0 75 79162 flow=From-Botnet-V2-TCP-Established 1970/02/25 03:57:44.159368 2.997686 tcp 10.0.2.105 65500 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:53.155707 0.000000 tcp 10.0.2.105 65500 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:57:59.158835 3.000193 tcp 10.0.2.105 65501 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:58:08.157304 0.000000 tcp 10.0.2.105 65501 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:58:08.327653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 03:58:12.713582 0.000107 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 03:58:14.156139 3.004084 tcp 10.0.2.105 65502 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 03:58:23.159022 0.000000 tcp 10.0.2.105 65502 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:03:29.159594 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:03:29.159713 3.003490 tcp 10.0.2.105 65503 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:03:38.171491 0.000000 tcp 10.0.2.105 65503 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:03:44.162259 0.061070 tcp 10.0.2.105 65504 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:03:44.223618 0.055371 tcp 10.0.2.105 65505 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:03:44.279359 0.147906 tcp 10.0.2.105 65506 -> 195.113.214.249 443 SRPA* 0 0 38 29354 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:03:44.553122 3.002253 tcp 10.0.2.105 65507 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:03:53.553913 0.000000 tcp 10.0.2.105 65507 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:03:59.558783 0.055433 tcp 10.0.2.105 65508 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:03:59.614560 0.054382 tcp 10.0.2.105 65509 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:03:59.669274 0.272658 tcp 10.0.2.105 65510 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:04:00.212401 2.995420 tcp 10.0.2.105 65511 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:09.206939 0.000000 tcp 10.0.2.105 65511 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:12.349480 3.000373 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:04:15.209123 0.075463 tcp 10.0.2.105 65512 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:04:15.284886 0.056897 tcp 10.0.2.105 65513 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:04:15.342074 0.158214 tcp 10.0.2.105 65514 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:04:16.642787 2.998717 tcp 10.0.2.105 65515 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:19.340909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:04:25.640167 0.000000 tcp 10.0.2.105 65515 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:27.342717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:04:31.629046 3.004041 tcp 10.0.2.105 65516 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:39.219577 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:04:40.641537 0.000000 tcp 10.0.2.105 65516 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:43.345598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:04:46.630818 2.993179 tcp 10.0.2.105 65517 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:04:55.623181 0.000000 tcp 10.0.2.105 65517 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:05:15.352085 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:10:01.633798 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:10:01.633966 3.003472 tcp 10.0.2.105 65518 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:10.636902 0.000000 tcp 10.0.2.105 65518 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:16.636719 0.314373 tcp 10.0.2.105 65519 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:16.951407 0.055136 tcp 10.0.2.105 65520 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:17.006853 0.144814 tcp 10.0.2.105 65521 -> 195.113.214.249 443 SRPA* 0 0 47 26032 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:17.553797 2.969305 tcp 10.0.2.105 65522 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:26.461756 0.000000 tcp 10.0.2.105 65522 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:32.398231 0.054520 tcp 10.0.2.105 65523 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:32.453029 0.055266 tcp 10.0.2.105 65524 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:32.508567 0.145359 tcp 10.0.2.105 65525 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:32.935314 2.975940 tcp 10.0.2.105 65526 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:41.851320 0.000000 tcp 10.0.2.105 65526 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:47.851000 0.055872 tcp 10.0.2.105 65527 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:47.907194 0.055524 tcp 10.0.2.105 65528 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:47.962997 0.162701 tcp 10.0.2.105 65529 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:10:48.383148 3.001621 tcp 10.0.2.105 65530 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:10:57.383435 0.000000 tcp 10.0.2.105 65530 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:11:03.382561 2.993575 tcp 10.0.2.105 65531 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:11:12.374865 0.000000 tcp 10.0.2.105 65531 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:11:17.211978 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:11:18.383731 3.004227 tcp 10.0.2.105 65532 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:11:19.357865 3.001552 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:11:26.365048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:11:27.386125 0.000000 tcp 10.0.2.105 65532 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:11:34.366599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:11:50.369813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:12:22.375776 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:16:33.386471 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:16:33.386626 3.004243 tcp 10.0.2.105 65533 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:16:42.389455 0.000000 tcp 10.0.2.105 65533 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:16:48.389735 0.055905 tcp 10.0.2.105 65534 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:16:48.445905 0.054673 tcp 10.0.2.105 49157 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:16:48.500897 0.154609 tcp 10.0.2.105 49158 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:16:49.927920 2.996815 tcp 10.0.2.105 49159 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:16:58.923302 0.000000 tcp 10.0.2.105 49159 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:06.221266 2.245022 tcp 10.0.2.105 49160 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:08.466573 0.055534 tcp 10.0.2.105 49161 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:08.522421 0.145151 tcp 10.0.2.105 49162 -> 195.113.214.249 443 SRPA* 0 0 22 11820 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:08.920621 2.953000 tcp 10.0.2.105 49163 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:17.795459 0.000000 tcp 10.0.2.105 49163 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:23.712412 0.054267 tcp 10.0.2.105 49164 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:23.766982 0.061535 tcp 10.0.2.105 49165 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:23.828803 0.156588 tcp 10.0.2.105 49166 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:17:24.235256 2.961233 tcp 10.0.2.105 49167 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:33.108769 0.000000 tcp 10.0.2.105 49167 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:39.018715 2.969175 tcp 10.0.2.105 49168 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:47.923599 0.000000 tcp 10.0.2.105 49168 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:17:52.596423 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:17:53.844586 2.964178 tcp 10.0.2.105 49169 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:18:02.723789 0.000000 tcp 10.0.2.105 49169 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:18:28.745802 2.960817 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:18:35.651139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:18:43.545705 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:18:59.327287 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:19:30.896141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:25:33.405105 3.002222 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 04:25:40.413046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:25:48.567882 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:26:04.427511 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:26:36.433530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:27:04.383959 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:27:04.384143 0.105401 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2596 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:04.448219 0.695798 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2266 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:05.123207 0.219484 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:05.335773 0.112026 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:05.524460 0.348970 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:06.063971 4.218652 tcp 10.0.2.105 49170 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:06.154219 0.065679 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:08.066729 0.211150 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:08.349160 0.078325 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2527 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:09.827842 0.190781 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2567 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:10.030659 0.183307 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2467 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:10.251290 0.061776 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:10.416459 0.282786 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:10.641412 0.231678 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2553 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:11.005977 0.173659 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:11.171842 0.102914 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:12.493089 0.227006 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:12.656368 0.236848 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:12.885587 0.490928 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:13.334212 0.126880 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:13.834542 0.213769 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:14.044966 0.236201 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:14.796057 0.187707 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:15.108774 0.227447 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:15.333650 0.353571 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:16.218752 0.000000 tcp 10.0.2.105 49170 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:17.130646 0.163688 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:17.287861 0.227605 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:17.512691 0.198697 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2459 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:17.773384 0.878977 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 1655 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:18.631160 0.230722 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2420 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:27:22.136026 0.055303 tcp 10.0.2.105 49171 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:22.191592 0.059348 tcp 10.0.2.105 49172 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:22.251269 0.154366 tcp 10.0.2.105 49173 -> 195.113.214.249 443 SRPA* 0 0 22 12483 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:22.944364 2.960146 tcp 10.0.2.105 49174 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:31.840527 0.000000 tcp 10.0.2.105 49174 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:37.756208 0.054796 tcp 10.0.2.105 49175 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:37.811304 0.055090 tcp 10.0.2.105 49176 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:37.866696 0.149775 tcp 10.0.2.105 49177 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:27:38.229812 2.957808 tcp 10.0.2.105 49178 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:47.112343 0.000000 tcp 10.0.2.105 49178 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:27:53.036523 2.960863 tcp 10.0.2.105 49179 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:28:01.924793 0.000000 tcp 10.0.2.105 49179 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:28:06.732489 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:32:40.439947 3.001313 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:32:47.447120 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:32:55.448483 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:33:07.347664 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:33:07.347840 3.002046 tcp 10.0.2.105 49180 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:11.451721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:33:16.348818 0.000000 tcp 10.0.2.105 49180 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:22.349442 0.058610 tcp 10.0.2.105 49181 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:22.408509 0.056015 tcp 10.0.2.105 49182 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:22.464850 0.157178 tcp 10.0.2.105 49183 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:23.081888 3.003038 tcp 10.0.2.105 49184 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:32.147843 0.000000 tcp 10.0.2.105 49184 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:38.095215 0.054427 tcp 10.0.2.105 49185 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:38.149926 0.154310 tcp 10.0.2.105 49186 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:38.304626 0.152439 tcp 10.0.2.105 49187 -> 195.113.214.249 443 SRPA* 0 0 39 31704 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:38.964497 2.990634 tcp 10.0.2.105 49188 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:43.457586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:33:47.953420 0.000000 tcp 10.0.2.105 49188 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:33:53.953263 0.055361 tcp 10.0.2.105 49189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:54.008939 0.056032 tcp 10.0.2.105 49190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:54.065273 0.157300 tcp 10.0.2.105 49191 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:33:54.468967 2.998610 tcp 10.0.2.105 49192 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:34:03.469047 0.000000 tcp 10.0.2.105 49192 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:34:09.464958 3.004285 tcp 10.0.2.105 49193 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:34:18.467929 0.000000 tcp 10.0.2.105 49193 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:34:23.214537 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:34:24.467199 3.003484 tcp 10.0.2.105 49194 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:34:33.469362 0.000000 tcp 10.0.2.105 49194 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:39:39.469933 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:39:39.470045 2.994987 tcp 10.0.2.105 49195 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:39:47.464395 3.001185 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:39:48.472436 0.000000 tcp 10.0.2.105 49195 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:39:54.471156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:39:54.472860 0.055207 tcp 10.0.2.105 49196 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:39:54.528434 0.055544 tcp 10.0.2.105 49197 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:39:54.584280 0.150666 tcp 10.0.2.105 49198 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:39:54.991122 2.994401 tcp 10.0.2.105 49199 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:02.472676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:40:03.984685 0.000000 tcp 10.0.2.105 49199 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:09.983999 0.062387 tcp 10.0.2.105 49200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:10.046687 0.054104 tcp 10.0.2.105 49201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:10.101119 0.155530 tcp 10.0.2.105 49202 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:10.486435 3.001914 tcp 10.0.2.105 49203 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:18.475537 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:40:19.486954 0.000000 tcp 10.0.2.105 49203 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:25.486372 0.054682 tcp 10.0.2.105 49204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:25.541409 0.073752 tcp 10.0.2.105 49205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:25.615440 0.154982 tcp 10.0.2.105 49206 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:40:27.343989 3.008549 tcp 10.0.2.105 49207 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:36.351293 0.000000 tcp 10.0.2.105 49207 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:42.341069 2.992897 tcp 10.0.2.105 49208 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:50.220812 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:40:50.481452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:40:51.342604 0.000000 tcp 10.0.2.105 49208 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:40:57.341833 2.993857 tcp 10.0.2.105 49209 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:41:06.333890 0.000000 tcp 10.0.2.105 49209 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:12.344941 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:46:12.345093 3.003482 tcp 10.0.2.105 49210 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:21.346922 0.000000 tcp 10.0.2.105 49210 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:27.347621 0.060373 tcp 10.0.2.105 49211 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:27.408489 0.057057 tcp 10.0.2.105 49212 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:27.465852 0.154055 tcp 10.0.2.105 49213 -> 195.113.214.249 443 SRPA* 0 0 37 18340 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:27.630510 3.000430 tcp 10.0.2.105 49214 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:36.629146 0.000000 tcp 10.0.2.105 49214 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:42.628626 0.054995 tcp 10.0.2.105 49215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:42.683937 0.056840 tcp 10.0.2.105 49216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:42.741079 0.152279 tcp 10.0.2.105 49217 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:43.059749 3.002800 tcp 10.0.2.105 49218 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:52.061447 0.000000 tcp 10.0.2.105 49218 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:46:54.487463 3.001933 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 04:46:58.060622 0.054427 tcp 10.0.2.105 49219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:58.115347 0.054980 tcp 10.0.2.105 49220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:58.170534 0.149689 tcp 10.0.2.105 49221 -> 195.113.214.249 443 SRPA* 0 0 24 12632 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:46:58.330814 2.993904 tcp 10.0.2.105 49222 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:01.495012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:47:07.333434 0.000000 tcp 10.0.2.105 49222 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:09.496552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:47:13.331997 2.994322 tcp 10.0.2.105 49223 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:22.324902 0.000000 tcp 10.0.2.105 49223 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:25.499413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:47:27.211919 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:47:28.333631 3.004003 tcp 10.0.2.105 49224 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:37.336886 0.000000 tcp 10.0.2.105 49224 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:47:57.505326 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:52:43.336501 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:52:43.336690 3.004079 tcp 10.0.2.105 49225 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:52:52.339165 0.000000 tcp 10.0.2.105 49225 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:52:58.339525 0.059511 tcp 10.0.2.105 49226 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:52:58.399265 0.055316 tcp 10.0.2.105 49227 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:52:58.454894 0.154430 tcp 10.0.2.105 49228 -> 195.113.214.249 443 SRPA* 0 0 42 22156 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:52:58.754543 3.008013 tcp 10.0.2.105 49229 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:53:07.772590 0.000000 tcp 10.0.2.105 49229 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:54:01.511204 3.001932 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 04:54:08.519023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:54:16.520278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:54:32.523337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:55:04.529507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 04:57:47.684160 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 04:57:47.684351 0.219121 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:47.896444 0.085497 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:48.283337 0.583081 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:48.846313 0.111564 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 1979 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:49.241521 0.348890 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:49.586849 0.063901 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2447 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:50.333675 0.216590 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:50.694841 0.074258 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:50.917863 0.193401 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:51.100501 0.188521 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:51.902887 0.068868 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:51.953180 0.174274 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:52.221127 0.409094 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2354 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:57:52.579242 0.000000 udp 10.0.2.105 7010 -> 108.255.78.239 8326 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 04:58:07.804971 0.055550 tcp 10.0.2.105 49230 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:07.860803 0.068478 tcp 10.0.2.105 49231 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:07.929604 0.156903 tcp 10.0.2.105 49232 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:08.087024 0.099315 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2280 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:08.169508 0.458189 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2417 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:08.604082 0.175113 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:08.762016 0.243649 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:08.997418 0.125508 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:09.304743 0.000000 udp 10.0.2.105 7010 -> 99.98.252.106 9529 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 04:58:13.751582 2.994136 tcp 10.0.2.105 49233 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:22.744499 0.000000 tcp 10.0.2.105 49233 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:25.809309 0.058768 tcp 10.0.2.105 49234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:25.868448 0.060474 tcp 10.0.2.105 49235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:25.929236 0.146474 tcp 10.0.2.105 49236 -> 195.113.214.249 443 SRPA* 0 0 41 22102 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:26.076305 0.235171 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:26.290974 0.188455 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:27.099194 0.227224 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:27.323460 0.347313 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:27.666896 0.160776 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:28.550517 0.180352 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:28.727450 0.192946 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2286 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:28.753374 0.056685 tcp 10.0.2.105 49237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:28.810375 0.055347 tcp 10.0.2.105 49238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:28.866068 0.157240 tcp 10.0.2.105 49239 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:29.117270 3.000263 tcp 10.0.2.105 49240 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:29.127442 0.386485 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:29.483974 0.217279 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/25 04:58:38.116419 0.000000 tcp 10.0.2.105 49240 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:44.115300 0.057515 tcp 10.0.2.105 49241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:44.173107 0.054924 tcp 10.0.2.105 49242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:44.228374 0.154502 tcp 10.0.2.105 49243 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 04:58:44.647512 3.002733 tcp 10.0.2.105 49244 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:53.648847 0.000000 tcp 10.0.2.105 49244 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:58:59.647474 3.004193 tcp 10.0.2.105 49245 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:59:08.650287 0.000000 tcp 10.0.2.105 49245 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 04:59:13.216494 0.000096 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:01:08.535398 3.069035 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:01:15.580496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:01:23.554586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:01:39.557280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:02:11.563452 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:04:14.651388 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:04:14.651500 2.993282 tcp 10.0.2.105 49246 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:04:23.643441 0.000000 tcp 10.0.2.105 49246 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:04:29.653442 0.057154 tcp 10.0.2.105 49247 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:29.710977 0.056590 tcp 10.0.2.105 49248 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:29.767826 0.148205 tcp 10.0.2.105 49249 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:29.928608 2.998115 tcp 10.0.2.105 49250 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:04:38.925145 0.000000 tcp 10.0.2.105 49250 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:04:44.924600 0.053744 tcp 10.0.2.105 49251 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:44.978623 0.055002 tcp 10.0.2.105 49252 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:45.033915 0.145366 tcp 10.0.2.105 49253 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:04:45.195410 3.003649 tcp 10.0.2.105 49254 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:04:54.197137 0.000000 tcp 10.0.2.105 49254 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:00.196547 0.055450 tcp 10.0.2.105 49255 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:05:00.252273 0.060844 tcp 10.0.2.105 49256 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:05:00.313451 0.159058 tcp 10.0.2.105 49257 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:05:00.486630 3.007100 tcp 10.0.2.105 49258 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:09.489364 0.000000 tcp 10.0.2.105 49258 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:15.488475 3.003600 tcp 10.0.2.105 49259 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:24.490782 0.000000 tcp 10.0.2.105 49259 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:29.217410 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:05:30.489908 2.993655 tcp 10.0.2.105 49260 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:05:39.492159 0.000000 tcp 10.0.2.105 49260 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:08:15.569832 3.001277 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:08:22.577101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:08:30.579486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:08:46.581550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:09:18.587415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:10:45.492723 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:10:45.492890 3.003660 tcp 10.0.2.105 49261 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:10:54.495188 0.000000 tcp 10.0.2.105 49261 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:00.495475 0.056392 tcp 10.0.2.105 49262 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:00.552123 0.055254 tcp 10.0.2.105 49263 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:00.607677 0.147382 tcp 10.0.2.105 49264 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:00.764279 2.994333 tcp 10.0.2.105 49265 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:09.757388 0.000000 tcp 10.0.2.105 49265 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:15.766131 0.055415 tcp 10.0.2.105 49266 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:15.821894 0.054521 tcp 10.0.2.105 49267 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:15.876627 0.158163 tcp 10.0.2.105 49268 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:16.045432 3.005168 tcp 10.0.2.105 49269 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:25.049191 0.000000 tcp 10.0.2.105 49269 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:31.038300 0.055855 tcp 10.0.2.105 49270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:31.094463 0.054965 tcp 10.0.2.105 49271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:31.149729 0.151303 tcp 10.0.2.105 49272 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:11:31.311769 3.000912 tcp 10.0.2.105 49273 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:40.310995 0.000000 tcp 10.0.2.105 49273 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:46.310184 2.993925 tcp 10.0.2.105 49274 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:11:55.312707 0.000000 tcp 10.0.2.105 49274 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:12:00.219891 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:12:01.311764 2.993893 tcp 10.0.2.105 49275 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:12:10.309251 0.000000 tcp 10.0.2.105 49275 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:15:22.593619 3.001438 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:15:29.600752 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:15:37.602275 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:15:53.605522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:16:25.611468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:17:16.314722 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:17:16.314909 3.003867 tcp 10.0.2.105 49276 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:17:25.317906 0.000000 tcp 10.0.2.105 49276 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:17:31.317834 0.055774 tcp 10.0.2.105 49277 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:31.373918 0.064555 tcp 10.0.2.105 49278 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:31.438794 0.148426 tcp 10.0.2.105 49279 -> 195.113.214.249 443 SRPA* 0 0 34 24340 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:31.603391 3.007241 tcp 10.0.2.105 49280 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:17:40.609236 0.000000 tcp 10.0.2.105 49280 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:17:46.598650 0.057412 tcp 10.0.2.105 49281 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:46.656660 0.057414 tcp 10.0.2.105 49282 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:46.714391 0.154732 tcp 10.0.2.105 49283 -> 195.113.214.249 443 SRPA* 0 0 43 34894 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:17:46.889729 3.002936 tcp 10.0.2.105 49284 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:17:55.891188 0.000000 tcp 10.0.2.105 49284 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:01.890544 0.056216 tcp 10.0.2.105 49285 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:18:01.947036 0.057955 tcp 10.0.2.105 49286 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:18:02.005278 0.149533 tcp 10.0.2.105 49287 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:18:02.169297 2.995165 tcp 10.0.2.105 49288 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:11.163241 0.000000 tcp 10.0.2.105 49288 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:17.161904 2.997254 tcp 10.0.2.105 49289 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:26.154456 0.000000 tcp 10.0.2.105 49289 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:30.711007 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:18:32.163624 3.003993 tcp 10.0.2.105 49290 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:18:41.168853 0.000000 tcp 10.0.2.105 49290 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:22:29.617461 3.001447 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:22:36.624736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:22:44.626619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:23:00.629712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:23:32.636949 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:23:47.166821 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:23:47.166935 3.004633 tcp 10.0.2.105 49291 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:23:56.169375 0.000000 tcp 10.0.2.105 49291 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:24:02.169592 0.055911 tcp 10.0.2.105 49292 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:24:02.225928 0.062836 tcp 10.0.2.105 49293 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:24:02.288578 0.152422 tcp 10.0.2.105 49294 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:24:02.451347 3.003832 tcp 10.0.2.105 49295 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:24:11.451098 0.000000 tcp 10.0.2.105 49295 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:28:59.655709 0.000114 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:28:59.655937 0.233184 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:28:59.882431 0.226681 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:00.106429 0.221079 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:00.320355 0.439716 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:00.719611 0.110274 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 1982 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:00.792926 0.596059 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2101 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:01.368498 0.382221 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:01.747485 0.222093 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:01.966072 0.063845 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:02.027702 0.074423 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:02.086763 0.195457 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:02.269438 0.068459 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:02.448647 0.170414 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:02.889093 0.185798 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:04.266987 0.289947 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:05.296578 0.130319 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:05.409705 0.153641 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:06.056685 0.442694 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:06.478784 0.242006 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:06.711987 0.127495 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2355 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:07.035438 0.235087 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:07.754361 0.184272 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2374 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:08.416712 0.213289 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:08.627071 0.347960 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:09.815117 0.164175 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:09.970676 0.181343 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:10.148598 0.193325 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:10.337878 0.743953 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 4 1432 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:11.067104 0.224376 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:29:17.451601 2.993934 tcp 10.0.2.105 49296 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:29:25.212115 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:29:26.444028 0.000000 tcp 10.0.2.105 49296 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:29:32.454368 0.055006 tcp 10.0.2.105 49297 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:32.509659 0.054851 tcp 10.0.2.105 49298 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:32.564811 0.150963 tcp 10.0.2.105 49299 -> 195.113.214.249 443 SRPA* 0 0 52 38964 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:32.727177 3.000276 tcp 10.0.2.105 49300 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:29:36.641458 3.001418 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:29:41.725822 0.000000 tcp 10.0.2.105 49300 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:29:43.648775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:29:47.725440 0.054000 tcp 10.0.2.105 49301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:47.779706 0.063984 tcp 10.0.2.105 49302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:47.843984 0.158071 tcp 10.0.2.105 49303 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:29:48.029902 2.999666 tcp 10.0.2.105 49304 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:29:51.650096 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:29:57.029343 0.000000 tcp 10.0.2.105 49304 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:03.026726 0.054677 tcp 10.0.2.105 49305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:30:03.081731 0.057144 tcp 10.0.2.105 49306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:30:03.139152 0.152740 tcp 10.0.2.105 49307 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:30:03.308698 3.002399 tcp 10.0.2.105 49308 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:07.653871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:30:12.311105 0.000000 tcp 10.0.2.105 49308 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:18.308796 3.003966 tcp 10.0.2.105 49309 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:27.321435 0.000000 tcp 10.0.2.105 49309 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:32.218887 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:30:33.310755 2.993744 tcp 10.0.2.105 49310 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:30:39.659494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:30:42.302811 0.000000 tcp 10.0.2.105 49310 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:35:48.313961 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:35:48.314146 3.003287 tcp 10.0.2.105 49311 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:35:57.316160 0.000000 tcp 10.0.2.105 49311 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:03.315691 0.056512 tcp 10.0.2.105 49312 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:03.372459 0.057524 tcp 10.0.2.105 49313 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:03.430350 0.144672 tcp 10.0.2.105 49314 -> 195.113.214.249 443 SRPA* 0 0 23 12538 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:03.583968 2.996298 tcp 10.0.2.105 49315 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:12.582472 0.000000 tcp 10.0.2.105 49315 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:18.577464 0.054474 tcp 10.0.2.105 49316 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:18.632270 0.054288 tcp 10.0.2.105 49317 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:18.686888 0.147778 tcp 10.0.2.105 49318 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:18.850897 3.000198 tcp 10.0.2.105 49319 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:27.850246 0.000000 tcp 10.0.2.105 49319 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:33.849116 0.059691 tcp 10.0.2.105 49320 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:33.909080 0.054992 tcp 10.0.2.105 49321 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:33.964571 0.149196 tcp 10.0.2.105 49322 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:36:34.123495 3.009528 tcp 10.0.2.105 49323 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:43.141696 0.000000 tcp 10.0.2.105 49323 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:43.666699 3.000479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:36:49.120918 2.993310 tcp 10.0.2.105 49324 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:50.672953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:36:58.123414 0.000000 tcp 10.0.2.105 49324 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:36:58.674115 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:37:02.720012 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:37:04.122069 2.994434 tcp 10.0.2.105 49325 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:37:13.115080 0.000000 tcp 10.0.2.105 49325 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:37:14.677228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:37:46.683188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:42:19.125755 0.214826 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:42:19.340787 2.966233 tcp 10.0.2.105 49326 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:42:28.246079 0.000000 tcp 10.0.2.105 49326 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:42:34.195749 0.054780 tcp 10.0.2.105 49327 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:34.250833 0.059664 tcp 10.0.2.105 49328 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:34.310869 0.151382 tcp 10.0.2.105 49329 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:34.507345 2.974060 tcp 10.0.2.105 49330 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:42:43.450138 0.000000 tcp 10.0.2.105 49330 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:42:49.449399 0.054361 tcp 10.0.2.105 49331 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:49.503990 0.055008 tcp 10.0.2.105 49332 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:49.559279 0.213253 tcp 10.0.2.105 49333 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:42:49.830359 2.992994 tcp 10.0.2.105 49334 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:42:58.831950 0.000000 tcp 10.0.2.105 49334 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:04.831267 0.054883 tcp 10.0.2.105 49335 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:43:04.886411 0.056047 tcp 10.0.2.105 49336 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:43:04.942748 0.150715 tcp 10.0.2.105 49337 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:43:05.345383 3.000258 tcp 10.0.2.105 49338 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:14.344425 0.000000 tcp 10.0.2.105 49338 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:20.343361 3.003833 tcp 10.0.2.105 49339 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:29.345771 0.000000 tcp 10.0.2.105 49339 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:34.212490 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:43:35.344774 3.003953 tcp 10.0.2.105 49340 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:44.347286 0.000000 tcp 10.0.2.105 49340 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:43:50.688699 3.001979 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:43:57.696660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:44:05.697997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:44:21.701243 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:44:53.707111 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:48:50.347802 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:48:50.347896 3.003747 tcp 10.0.2.105 49341 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:48:59.350766 0.000000 tcp 10.0.2.105 49341 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:05.351316 0.076301 tcp 10.0.2.105 49342 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:05.427917 0.055147 tcp 10.0.2.105 49343 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:05.483368 0.158376 tcp 10.0.2.105 49344 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:05.817878 2.996112 tcp 10.0.2.105 49345 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:14.822567 0.000000 tcp 10.0.2.105 49345 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:20.811812 0.055647 tcp 10.0.2.105 49346 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:20.867760 0.055333 tcp 10.0.2.105 49347 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:20.923354 0.147339 tcp 10.0.2.105 49348 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:21.133385 3.002613 tcp 10.0.2.105 49349 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:30.134457 0.000000 tcp 10.0.2.105 49349 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:36.133794 0.055271 tcp 10.0.2.105 49350 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:36.189363 0.054702 tcp 10.0.2.105 49351 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:36.244455 0.155416 tcp 10.0.2.105 49352 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:49:36.499936 2.998139 tcp 10.0.2.105 49353 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:45.496761 0.000000 tcp 10.0.2.105 49353 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:49:51.495544 3.004546 tcp 10.0.2.105 49354 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:50:00.498091 0.000000 tcp 10.0.2.105 49354 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:50:05.215473 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:50:06.497188 3.004353 tcp 10.0.2.105 49355 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:50:15.501194 0.000000 tcp 10.0.2.105 49355 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 05:56:06.716977 3.002439 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 05:56:13.724978 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:56:21.726206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:56:37.729481 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:57:09.735618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 05:59:41.223708 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 05:59:41.223864 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 05:59:58.282751 0.055603 tcp 10.0.2.105 49356 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:59:58.338621 0.055055 tcp 10.0.2.105 49357 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:59:58.393933 0.149076 tcp 10.0.2.105 49358 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/25 05:59:58.543571 0.227124 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/25 05:59:58.763779 0.000000 udp 10.0.2.105 7010 -> 99.98.252.106 9529 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 06:00:06.530411 2.993517 tcp 10.0.2.105 49359 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:00:15.532889 0.000000 tcp 10.0.2.105 49359 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:00:17.396010 0.054149 tcp 10.0.2.105 49360 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:17.450416 0.055416 tcp 10.0.2.105 49361 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:17.506078 0.151759 tcp 10.0.2.105 49362 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:17.658448 0.618390 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.255936 0.090828 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.308252 0.117086 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.384724 0.349672 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2255 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.730531 0.215272 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.942016 0.058630 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:18.998843 0.080381 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.064087 0.194294 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2440 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.246483 0.068525 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2229 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.319465 0.174596 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2024 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.486222 0.179120 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2088 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.639303 0.399747 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2211 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:19.980760 0.095309 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2179 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:20.060736 0.175176 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2102 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:20.219300 0.127644 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:20.355755 0.449952 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:20.783023 0.242740 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2433 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.018130 0.238233 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.234157 0.189801 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2412 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.400838 0.212329 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2138 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.532111 0.053909 tcp 10.0.2.105 49363 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:21.586306 0.061647 tcp 10.0.2.105 49364 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:21.610153 0.185419 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.648197 0.173719 tcp 10.0.2.105 49365 -> 195.113.214.249 443 SRPA* 0 0 35 27162 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:00:21.792949 0.191542 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:21.855260 3.000292 tcp 10.0.2.105 49366 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:00:22.001648 0.353232 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:22.351238 0.161733 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:22.506341 0.762710 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 5 1860 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:23.248618 0.217544 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2436 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:00:30.854735 0.000000 tcp 10.0.2.105 49366 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:03:13.742205 3.001007 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:03:20.749008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:03:28.750350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:03:44.753591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:04:16.759471 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:05:36.855071 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:05:36.855165 3.003809 tcp 10.0.2.105 49367 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:05:45.859815 0.000000 tcp 10.0.2.105 49367 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:05:51.858076 0.059869 tcp 10.0.2.105 49368 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:05:51.918318 0.054062 tcp 10.0.2.105 49369 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:05:51.972690 0.150598 tcp 10.0.2.105 49370 -> 195.113.214.249 443 SRPA* 0 0 23 13790 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:05:52.870972 3.000902 tcp 10.0.2.105 49371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:01.870664 0.000000 tcp 10.0.2.105 49371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:07.869375 0.055766 tcp 10.0.2.105 49372 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:07.925007 0.055874 tcp 10.0.2.105 49373 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:07.981169 0.146632 tcp 10.0.2.105 49374 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:08.145679 3.000427 tcp 10.0.2.105 49375 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:17.152433 0.000000 tcp 10.0.2.105 49375 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:23.141819 0.057995 tcp 10.0.2.105 49376 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:23.200126 0.061675 tcp 10.0.2.105 49377 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:23.262099 0.156615 tcp 10.0.2.105 49378 -> 195.113.214.249 443 SRPA* 0 0 33 19386 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:06:23.430089 2.997343 tcp 10.0.2.105 49379 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:32.424579 0.000000 tcp 10.0.2.105 49379 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:38.426004 3.001589 tcp 10.0.2.105 49380 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:47.426022 0.000000 tcp 10.0.2.105 49380 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:06:52.212801 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:06:53.425346 3.003952 tcp 10.0.2.105 49381 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:07:02.427651 0.000000 tcp 10.0.2.105 49381 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:10:33.774196 3.001643 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:10:40.781575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:10:48.783121 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:11:04.786095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:11:36.792168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:12:08.428510 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:12:08.428690 3.003066 tcp 10.0.2.105 49382 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:17.430498 0.000000 tcp 10.0.2.105 49382 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:23.432145 0.055994 tcp 10.0.2.105 49383 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:23.488549 0.106960 tcp 10.0.2.105 49384 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:23.595785 0.151442 tcp 10.0.2.105 49385 -> 195.113.214.249 443 SRPA* 0 0 79 60768 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:23.768267 2.997100 tcp 10.0.2.105 49386 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:32.772437 0.000000 tcp 10.0.2.105 49386 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:38.763624 0.054662 tcp 10.0.2.105 49387 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:38.818586 0.055561 tcp 10.0.2.105 49388 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:38.874436 0.157461 tcp 10.0.2.105 49389 -> 195.113.214.249 443 SRPA* 0 0 25 13936 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:40.219563 2.998016 tcp 10.0.2.105 49390 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:49.215837 0.000000 tcp 10.0.2.105 49390 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:12:55.215141 0.140743 tcp 10.0.2.105 49391 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:55.356201 0.056573 tcp 10.0.2.105 49392 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:55.413090 0.149389 tcp 10.0.2.105 49393 -> 195.113.214.249 443 SRPA* 0 0 22 13148 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:12:55.957303 3.002914 tcp 10.0.2.105 49394 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:13:04.959027 0.000000 tcp 10.0.2.105 49394 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:13:10.957590 3.004102 tcp 10.0.2.105 49395 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:13:19.963700 0.000000 tcp 10.0.2.105 49395 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:13:24.717295 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:13:25.959466 2.993827 tcp 10.0.2.105 49396 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:13:34.962839 0.000000 tcp 10.0.2.105 49396 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:17:40.798356 3.001298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:17:47.805623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:17:55.807173 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:18:11.809822 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:18:40.962463 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:18:40.962551 2.993417 tcp 10.0.2.105 49397 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:18:43.815482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:18:49.954543 0.000000 tcp 10.0.2.105 49397 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:18:55.965802 0.056581 tcp 10.0.2.105 49398 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:18:56.022618 0.057589 tcp 10.0.2.105 49399 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:18:56.080628 0.150604 tcp 10.0.2.105 49400 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:18:56.240249 2.997950 tcp 10.0.2.105 49401 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:05.236972 0.000000 tcp 10.0.2.105 49401 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:11.236535 0.053872 tcp 10.0.2.105 49402 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:11.290680 0.055347 tcp 10.0.2.105 49403 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:11.346303 0.149856 tcp 10.0.2.105 49404 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:11.506573 3.003550 tcp 10.0.2.105 49405 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:20.510682 0.000000 tcp 10.0.2.105 49405 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:26.508381 0.054910 tcp 10.0.2.105 49406 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:26.563598 0.056907 tcp 10.0.2.105 49407 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:26.620841 0.145466 tcp 10.0.2.105 49408 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:19:26.777365 3.004573 tcp 10.0.2.105 49409 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:35.780685 0.000000 tcp 10.0.2.105 49409 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:41.769307 2.993715 tcp 10.0.2.105 49410 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:50.772127 0.000000 tcp 10.0.2.105 49410 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:19:55.719350 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:19:56.771669 2.993679 tcp 10.0.2.105 49411 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:20:05.764052 0.000000 tcp 10.0.2.105 49411 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:24:47.822072 3.001794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:24:54.829611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:25:02.830988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:25:11.774211 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:25:11.774374 3.003790 tcp 10.0.2.105 49412 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:18.833984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:25:20.776688 0.000000 tcp 10.0.2.105 49412 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:26.777635 0.055241 tcp 10.0.2.105 49413 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:26.833111 0.069825 tcp 10.0.2.105 49414 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:26.903132 0.168792 tcp 10.0.2.105 49415 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:27.082376 2.997809 tcp 10.0.2.105 49416 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:36.078732 0.000000 tcp 10.0.2.105 49416 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:42.077937 0.055412 tcp 10.0.2.105 49417 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:42.133618 0.059446 tcp 10.0.2.105 49418 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:42.193319 0.150338 tcp 10.0.2.105 49419 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:42.354305 3.007724 tcp 10.0.2.105 49420 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:50.841208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:25:51.361415 0.000000 tcp 10.0.2.105 49420 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:25:57.350685 0.054565 tcp 10.0.2.105 49421 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:57.405620 0.054522 tcp 10.0.2.105 49422 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:57.460630 0.151711 tcp 10.0.2.105 49423 -> 195.113.214.249 443 SRPA* 0 0 22 13110 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:25:57.622767 2.991052 tcp 10.0.2.105 49424 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:26:06.622865 0.000000 tcp 10.0.2.105 49424 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:26:12.621555 2.994046 tcp 10.0.2.105 49425 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:26:21.614141 0.000000 tcp 10.0.2.105 49425 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:26:26.210757 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:26:27.623141 3.004194 tcp 10.0.2.105 49426 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:26:36.625840 0.000000 tcp 10.0.2.105 49426 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:30:38.784151 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:30:38.784256 0.224559 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2105 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:39.001543 0.213532 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:39.212002 0.232393 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:39.437245 0.109568 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:39.506069 0.798106 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:40.283822 0.090902 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:40.336820 0.375606 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:40.708419 0.215751 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:40.920910 0.064793 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:40.984159 0.074154 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:41.041841 0.196167 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:41.225385 0.063112 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:41.270579 0.178144 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:41.443595 0.184462 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2413 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:41.598488 0.709237 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2125 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:42.253652 0.127707 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:42.386684 0.107121 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2213 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:42.478588 0.173541 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:42.642730 0.235805 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:42.856733 0.454634 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2360 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:43.290919 0.239513 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:43.522650 0.187261 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:43.701016 0.217649 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:43.916020 0.180359 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:44.092808 0.195015 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:44.283908 0.354865 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:44.635237 0.164003 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:44.790945 0.452253 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2047 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:30:45.218372 0.229822 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/25 06:31:42.626499 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:31:42.626653 3.004039 tcp 10.0.2.105 49427 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:31:51.629178 0.000000 tcp 10.0.2.105 49427 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:31:54.846094 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:31:57.629304 0.055387 tcp 10.0.2.105 49428 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:31:57.684960 0.055528 tcp 10.0.2.105 49429 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:31:57.740775 0.145860 tcp 10.0.2.105 49430 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:31:57.914200 3.007725 tcp 10.0.2.105 49431 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:01.853334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:32:06.920806 0.000000 tcp 10.0.2.105 49431 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:09.854754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:32:12.910462 0.055571 tcp 10.0.2.105 49432 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:12.966296 0.092445 tcp 10.0.2.105 49433 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:13.059080 0.146426 tcp 10.0.2.105 49434 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:13.216421 3.000591 tcp 10.0.2.105 49435 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:22.222585 0.000000 tcp 10.0.2.105 49435 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:25.858153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:32:28.211993 0.058718 tcp 10.0.2.105 49436 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:28.270982 0.055415 tcp 10.0.2.105 49437 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:28.326665 0.145735 tcp 10.0.2.105 49438 -> 195.113.214.249 443 SRPA* 0 0 44 23212 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:32:28.490007 2.995929 tcp 10.0.2.105 49439 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:37.484598 0.000000 tcp 10.0.2.105 49439 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:43.483441 3.005875 tcp 10.0.2.105 49440 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:52.486299 0.000000 tcp 10.0.2.105 49440 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:32:57.212810 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:32:57.863446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:32:58.485422 3.003750 tcp 10.0.2.105 49441 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:33:07.487798 0.000000 tcp 10.0.2.105 49441 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:13.488976 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:38:13.489168 3.002902 tcp 10.0.2.105 49442 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:22.491183 0.000000 tcp 10.0.2.105 49442 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:28.490995 0.058381 tcp 10.0.2.105 49443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:28.549647 0.056276 tcp 10.0.2.105 49444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:28.606230 0.149168 tcp 10.0.2.105 49445 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:28.816758 2.997339 tcp 10.0.2.105 49446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:37.822671 0.000000 tcp 10.0.2.105 49446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:43.812008 0.053416 tcp 10.0.2.105 49447 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:43.865730 0.055125 tcp 10.0.2.105 49448 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:43.921141 0.140917 tcp 10.0.2.105 49449 -> 195.113.214.249 443 SRPA* 0 0 33 19422 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:44.073842 3.002387 tcp 10.0.2.105 49450 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:53.074789 0.000000 tcp 10.0.2.105 49450 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:38:59.074313 0.056971 tcp 10.0.2.105 49451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:59.131588 0.057572 tcp 10.0.2.105 49452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:59.189442 0.149811 tcp 10.0.2.105 49453 -> 195.113.214.249 443 SRPA* 0 0 47 26032 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:38:59.358381 2.999932 tcp 10.0.2.105 49454 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:39:01.871281 3.000303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:39:08.356888 0.000000 tcp 10.0.2.105 49454 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:39:08.877280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:39:14.355521 3.004120 tcp 10.0.2.105 49455 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:39:16.879130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:39:23.358550 0.000000 tcp 10.0.2.105 49455 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:39:28.215519 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:39:29.357122 3.003982 tcp 10.0.2.105 49456 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:39:32.882418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:39:38.359733 0.000000 tcp 10.0.2.105 49456 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:40:04.888799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:44:44.360429 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:44:44.360648 2.994579 tcp 10.0.2.105 49457 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:44:53.363021 0.000000 tcp 10.0.2.105 49457 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:44:59.363187 0.055883 tcp 10.0.2.105 49458 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:44:59.419372 0.055647 tcp 10.0.2.105 49459 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:44:59.475413 0.154644 tcp 10.0.2.105 49460 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:44:59.640422 2.995759 tcp 10.0.2.105 49461 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:08.634769 0.000000 tcp 10.0.2.105 49461 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:14.633957 0.054407 tcp 10.0.2.105 49462 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:14.688651 0.057471 tcp 10.0.2.105 49463 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:14.746396 0.162243 tcp 10.0.2.105 49464 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:14.918621 2.999360 tcp 10.0.2.105 49465 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:23.916764 0.000000 tcp 10.0.2.105 49465 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:29.915965 0.054561 tcp 10.0.2.105 49466 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:29.970857 0.055091 tcp 10.0.2.105 49467 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:30.026234 0.193058 tcp 10.0.2.105 49468 -> 195.113.214.249 443 SRPA* 0 0 31 15892 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:45:30.236959 3.002840 tcp 10.0.2.105 49469 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:39.238731 0.000000 tcp 10.0.2.105 49469 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:45.237573 3.004086 tcp 10.0.2.105 49470 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:54.240104 0.000000 tcp 10.0.2.105 49470 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:45:59.217202 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:46:00.238902 2.994350 tcp 10.0.2.105 49471 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:46:08.894031 3.001450 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:46:09.241674 0.000000 tcp 10.0.2.105 49471 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:46:15.901496 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:46:23.902567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:46:39.905856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:47:11.911831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:51:15.242314 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:51:15.242494 2.993360 tcp 10.0.2.105 49472 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:51:24.234707 0.000000 tcp 10.0.2.105 49472 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:51:30.245378 0.134672 tcp 10.0.2.105 49473 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:30.380344 0.058686 tcp 10.0.2.105 49474 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:30.439340 0.149879 tcp 10.0.2.105 49475 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:30.617808 3.000445 tcp 10.0.2.105 49476 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:51:39.616616 0.000000 tcp 10.0.2.105 49476 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:51:45.616372 0.055705 tcp 10.0.2.105 49477 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:45.672481 0.059067 tcp 10.0.2.105 49478 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:45.731911 0.151875 tcp 10.0.2.105 49479 -> 195.113.214.249 443 SRPA* 0 0 40 22642 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:51:45.893606 3.006655 tcp 10.0.2.105 49480 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:51:54.898801 0.000000 tcp 10.0.2.105 49480 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:00.888045 0.053547 tcp 10.0.2.105 49481 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:52:00.941857 0.055831 tcp 10.0.2.105 49482 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:52:00.997986 0.156239 tcp 10.0.2.105 49483 -> 195.113.214.249 443 SRPA* 0 0 42 20866 flow=From-Botnet-V2-TCP-Established 1970/02/25 06:52:01.187825 3.004291 tcp 10.0.2.105 49484 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:10.190670 0.000000 tcp 10.0.2.105 49484 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:16.189538 2.994141 tcp 10.0.2.105 49485 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:25.192518 0.000000 tcp 10.0.2.105 49485 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:29.718556 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 06:52:31.191297 2.994098 tcp 10.0.2.105 49486 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:52:40.183657 0.000000 tcp 10.0.2.105 49486 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 06:53:15.917883 3.001864 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 06:53:22.926130 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:53:30.926550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:53:46.929874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 06:54:18.935688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:00:22.941847 3.001730 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 07:00:29.949459 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:00:37.950599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:00:51.823664 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:00:51.823824 0.220340 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2499 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:52.036696 0.266048 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:52.299711 0.859582 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.135924 0.130488 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2059 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.230835 0.225946 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.448837 0.112138 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.523182 0.383839 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.903872 0.210503 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:53.953703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:00:54.110784 0.065766 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 1993 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:54.175149 0.075512 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:54.235227 0.197100 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:54.420900 0.063263 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:54.465335 0.160523 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2116 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:54.635408 2.227807 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:56.833481 0.702181 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2577 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:57.473569 0.127703 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2196 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:57.602657 0.243441 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:57.825591 0.444309 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:58.248062 0.096942 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2304 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:58.329686 0.147069 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2103 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:58.467450 0.239023 udp 10.0.2.105 7010 <-> 99.21.148.224 1466 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:58.699615 0.188114 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2362 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:58.882860 0.225438 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:59.105592 0.180523 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:59.282271 0.187824 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2441 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:00:59.465533 0.571129 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:01:00.010226 0.352119 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2189 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:01:00.358874 0.158312 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:01:00.507684 0.223646 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:01:01.214334 3.004539 tcp 10.0.2.105 49487 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:10.217219 0.000000 tcp 10.0.2.105 49487 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:16.217650 0.055248 tcp 10.0.2.105 49488 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:16.273135 0.056940 tcp 10.0.2.105 49489 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:16.330452 0.151412 tcp 10.0.2.105 49490 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:16.492587 2.998002 tcp 10.0.2.105 49491 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:25.490629 0.000000 tcp 10.0.2.105 49491 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:25.960867 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:01:31.488589 0.053578 tcp 10.0.2.105 49492 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:31.542468 0.057559 tcp 10.0.2.105 49493 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:31.600448 0.147310 tcp 10.0.2.105 49494 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:31.760029 3.003000 tcp 10.0.2.105 49495 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:40.761304 0.000000 tcp 10.0.2.105 49495 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:46.760327 0.059493 tcp 10.0.2.105 49496 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:46.820112 0.056662 tcp 10.0.2.105 49497 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:46.877109 0.152423 tcp 10.0.2.105 49498 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:01:47.041868 2.992181 tcp 10.0.2.105 49499 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:01:56.033107 0.000000 tcp 10.0.2.105 49499 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:02:02.041907 2.994076 tcp 10.0.2.105 49500 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:02:11.034404 0.000000 tcp 10.0.2.105 49500 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:02:15.711406 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:02:17.043618 3.003995 tcp 10.0.2.105 49501 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:02:26.046315 0.000000 tcp 10.0.2.105 49501 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:07:29.965863 3.001555 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 07:07:32.046741 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:07:32.046831 3.003514 tcp 10.0.2.105 49502 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:07:36.972925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:07:41.049444 0.000000 tcp 10.0.2.105 49502 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:07:44.974730 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:07:47.049636 0.068181 tcp 10.0.2.105 49503 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:07:47.118121 0.055126 tcp 10.0.2.105 49504 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:07:47.173552 0.150707 tcp 10.0.2.105 49505 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:07:47.334090 3.008608 tcp 10.0.2.105 49506 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:07:56.341218 0.000000 tcp 10.0.2.105 49506 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:00.977873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:08:02.330788 0.055881 tcp 10.0.2.105 49507 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:02.386999 0.054985 tcp 10.0.2.105 49508 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:02.442299 0.158252 tcp 10.0.2.105 49509 -> 195.113.214.249 443 SRPA* 0 0 38 32784 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:02.610984 2.993407 tcp 10.0.2.105 49510 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:11.603185 0.000000 tcp 10.0.2.105 49510 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:17.612757 0.055848 tcp 10.0.2.105 49511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:17.668946 0.056420 tcp 10.0.2.105 49512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:17.725578 0.156668 tcp 10.0.2.105 49513 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:08:17.905577 3.000941 tcp 10.0.2.105 49514 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:26.905020 0.000000 tcp 10.0.2.105 49514 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:32.903887 3.003938 tcp 10.0.2.105 49515 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:32.983614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:08:41.906689 0.000000 tcp 10.0.2.105 49515 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:46.713144 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:08:47.905059 3.004464 tcp 10.0.2.105 49516 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:08:56.908933 0.000000 tcp 10.0.2.105 49516 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:02.908881 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:14:02.909045 3.003620 tcp 10.0.2.105 49517 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:11.911267 0.000000 tcp 10.0.2.105 49517 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:17.911479 0.056110 tcp 10.0.2.105 49518 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:17.967912 0.054327 tcp 10.0.2.105 49519 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:18.022561 0.159667 tcp 10.0.2.105 49520 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:19.699475 2.996900 tcp 10.0.2.105 49521 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:28.694880 0.000000 tcp 10.0.2.105 49521 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:34.694020 0.054541 tcp 10.0.2.105 49522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:34.748862 0.055693 tcp 10.0.2.105 49523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:34.804814 0.147627 tcp 10.0.2.105 49524 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:36.761142 3.439751 tcp 10.0.2.105 49525 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:37.454707 2.974988 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 07:14:44.400054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:14:46.147340 0.000000 tcp 10.0.2.105 49525 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:14:52.100797 0.054734 tcp 10.0.2.105 49526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:52.155775 0.058079 tcp 10.0.2.105 49527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:52.214166 0.148262 tcp 10.0.2.105 49528 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:14:52.328729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:14:52.384414 2.981207 tcp 10.0.2.105 49529 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:01.316641 0.000000 tcp 10.0.2.105 49529 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:07.240025 3.850386 tcp 10.0.2.105 49530 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:09.074448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:15:17.027568 0.000000 tcp 10.0.2.105 49530 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:21.638008 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:15:22.965117 2.950563 tcp 10.0.2.105 49531 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:31.843201 0.000000 tcp 10.0.2.105 49531 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:15:40.685421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:20:37.065502 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:20:37.065611 3.003499 tcp 10.0.2.105 49532 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:20:46.068138 0.000000 tcp 10.0.2.105 49532 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:20:52.068074 0.054607 tcp 10.0.2.105 49533 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:20:52.122938 0.060009 tcp 10.0.2.105 49534 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:20:52.183245 0.160401 tcp 10.0.2.105 49535 -> 195.113.214.249 443 SRPA* 0 0 48 27584 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:20:52.368018 3.003097 tcp 10.0.2.105 49536 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:01.369827 0.000000 tcp 10.0.2.105 49536 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:07.369098 0.054172 tcp 10.0.2.105 49537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:07.423583 0.055434 tcp 10.0.2.105 49538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:07.479344 0.151492 tcp 10.0.2.105 49539 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:07.650749 2.992501 tcp 10.0.2.105 49540 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:16.651619 0.000000 tcp 10.0.2.105 49540 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:22.652443 0.053468 tcp 10.0.2.105 49541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:22.706231 0.053680 tcp 10.0.2.105 49542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:22.760203 0.154823 tcp 10.0.2.105 49543 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:21:22.935281 2.999489 tcp 10.0.2.105 49544 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:31.933591 0.000000 tcp 10.0.2.105 49544 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:37.932524 2.994112 tcp 10.0.2.105 49545 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:44.013840 3.001423 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 07:21:46.925264 0.000000 tcp 10.0.2.105 49545 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:51.021285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:21:51.711945 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:21:52.934126 3.004430 tcp 10.0.2.105 49546 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:21:59.022807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:22:01.936190 0.000000 tcp 10.0.2.105 49546 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:22:15.025061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:22:47.031139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:28:51.037674 3.001794 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 07:28:58.045225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:29:06.046626 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:29:22.049749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:29:54.055529 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:31:15.733046 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:31:15.733210 0.231768 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:15.957037 0.221562 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2442 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:16.175475 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 200 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 07:31:22.963634 3.004179 tcp 10.0.2.105 49547 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:31:31.748026 0.054593 tcp 10.0.2.105 49548 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:31.802839 0.056233 tcp 10.0.2.105 49549 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:31.859370 0.146238 tcp 10.0.2.105 49550 -> 195.113.214.249 443 SRPA* 0 0 37 27894 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:31.966452 0.000000 tcp 10.0.2.105 49547 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:31:32.006329 0.110725 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.076764 0.225587 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.294992 0.114281 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2423 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.369450 0.348948 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2383 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.714532 0.227211 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2500 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.938169 0.062952 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2007 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:32.999563 0.077199 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:33.060710 0.194415 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2238 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:33.243343 0.067308 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:33.291953 0.172686 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:33.457057 2.190811 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:35.618044 0.583268 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:36.144919 0.126167 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:36.287484 0.235564 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2357 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:36.502913 0.192475 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:36.685773 0.452409 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:37.116134 0.099531 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2127 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:37.199638 0.213767 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:37.410603 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 07:31:37.964979 0.053646 tcp 10.0.2.105 49551 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:38.018921 0.055401 tcp 10.0.2.105 49552 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:38.074608 0.149809 tcp 10.0.2.105 49553 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:38.235531 3.004185 tcp 10.0.2.105 49554 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:31:47.238506 0.000000 tcp 10.0.2.105 49554 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:31:53.237937 0.055787 tcp 10.0.2.105 49555 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:53.293580 0.055432 tcp 10.0.2.105 49556 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:53.349330 0.147447 tcp 10.0.2.105 49557 -> 195.113.214.249 443 SRPA* 0 0 41 22102 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:53.525606 3.006199 tcp 10.0.2.105 49558 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:31:54.779903 0.053706 tcp 10.0.2.105 49559 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:54.833882 0.056509 tcp 10.0.2.105 49560 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:54.890663 0.151056 tcp 10.0.2.105 49561 -> 195.113.214.249 443 SRPA* 0 0 41 22102 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:31:55.041027 0.183396 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:55.230750 0.180626 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2523 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:55.407776 0.194777 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:55.598821 0.163552 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2399 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:55.756408 0.363208 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2165 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:56.092995 0.353395 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2342 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:31:56.442567 0.229262 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2153 flow=From-Botnet-V2-UDP-Established 1970/02/25 07:32:02.530331 0.000000 tcp 10.0.2.105 49558 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:32:08.519576 3.003119 tcp 10.0.2.105 49562 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:32:17.531857 0.000000 tcp 10.0.2.105 49562 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:32:22.218863 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:35:58.062100 3.001136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 07:36:05.069052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:36:13.070775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:36:29.073545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:37:01.079728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:37:23.522514 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:37:23.522692 2.993454 tcp 10.0.2.105 49563 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:37:32.514655 0.000000 tcp 10.0.2.105 49563 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:37:38.525500 0.055062 tcp 10.0.2.105 49564 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:38.580837 0.055420 tcp 10.0.2.105 49565 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:38.636515 0.152782 tcp 10.0.2.105 49566 -> 195.113.214.249 443 SRPA* 0 0 40 21422 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:38.799544 2.998460 tcp 10.0.2.105 49567 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:37:47.796703 0.000000 tcp 10.0.2.105 49567 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:37:53.796002 0.053342 tcp 10.0.2.105 49568 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:53.849605 0.055446 tcp 10.0.2.105 49569 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:53.905365 0.157051 tcp 10.0.2.105 49570 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:37:54.072159 2.998356 tcp 10.0.2.105 49571 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:03.068676 0.000000 tcp 10.0.2.105 49571 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:09.067785 0.053612 tcp 10.0.2.105 49572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:38:09.121754 0.055009 tcp 10.0.2.105 49573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:38:09.177102 0.154890 tcp 10.0.2.105 49574 -> 195.113.214.249 443 SRPA* 0 0 26 13536 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:38:09.358235 3.004246 tcp 10.0.2.105 49575 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:18.360605 0.000000 tcp 10.0.2.105 49575 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:24.359643 2.993539 tcp 10.0.2.105 49576 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:33.362469 0.000000 tcp 10.0.2.105 49576 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:38.219140 0.000147 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:38:39.361056 2.994122 tcp 10.0.2.105 49577 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:38:48.353628 0.000000 tcp 10.0.2.105 49577 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:43:05.085352 3.002157 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 07:43:12.092876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:43:20.094702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:43:36.097798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:43:54.364723 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:43:54.364839 3.003373 tcp 10.0.2.105 49578 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:03.366536 0.000000 tcp 10.0.2.105 49578 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:08.103733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:44:09.367183 0.055967 tcp 10.0.2.105 49579 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:09.423497 0.054969 tcp 10.0.2.105 49580 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:09.478314 0.150643 tcp 10.0.2.105 49581 -> 195.113.214.249 443 SRPA* 0 0 34 17552 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:09.638480 3.001971 tcp 10.0.2.105 49582 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:18.638762 0.000000 tcp 10.0.2.105 49582 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:24.638098 0.056390 tcp 10.0.2.105 49583 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:24.694851 0.055891 tcp 10.0.2.105 49584 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:24.751043 0.147679 tcp 10.0.2.105 49585 -> 195.113.214.249 443 SRPA* 0 0 33 17498 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:26.447817 2.996420 tcp 10.0.2.105 49586 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:35.453770 0.000000 tcp 10.0.2.105 49586 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:41.441911 0.053727 tcp 10.0.2.105 49587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:41.495909 0.055306 tcp 10.0.2.105 49588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:41.551523 0.149073 tcp 10.0.2.105 49589 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:44:41.725658 3.000260 tcp 10.0.2.105 49590 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:50.724909 0.000000 tcp 10.0.2.105 49590 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:44:56.723658 3.004030 tcp 10.0.2.105 49591 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:45:05.726495 0.000000 tcp 10.0.2.105 49591 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:45:10.713150 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:45:11.724904 3.004505 tcp 10.0.2.105 49592 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:45:20.727911 0.000000 tcp 10.0.2.105 49592 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:50:26.728670 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:50:26.728816 3.003387 tcp 10.0.2.105 49593 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:50:35.730674 0.000000 tcp 10.0.2.105 49593 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:50:41.731649 0.055880 tcp 10.0.2.105 49594 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:41.787812 0.056000 tcp 10.0.2.105 49595 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:41.844105 0.243555 tcp 10.0.2.105 49596 -> 195.113.214.249 443 SRPA* 0 0 48 27546 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:42.098738 2.995522 tcp 10.0.2.105 49597 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:50:51.102714 0.000000 tcp 10.0.2.105 49597 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:50:57.092498 0.056054 tcp 10.0.2.105 49598 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:57.148857 0.153893 tcp 10.0.2.105 49599 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:57.303062 0.147573 tcp 10.0.2.105 49600 -> 195.113.214.249 443 SRPA* 0 0 27 11248 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:50:57.460703 2.995751 tcp 10.0.2.105 49601 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:06.454947 0.000000 tcp 10.0.2.105 49601 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:12.454275 0.054706 tcp 10.0.2.105 49602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:51:12.509331 0.054896 tcp 10.0.2.105 49603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:51:12.564573 0.159418 tcp 10.0.2.105 49604 -> 195.113.214.249 443 SRPA* 0 0 39 19908 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:51:12.735305 3.003326 tcp 10.0.2.105 49605 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:21.737250 0.000000 tcp 10.0.2.105 49605 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:27.735718 3.004299 tcp 10.0.2.105 49606 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:36.738729 0.000000 tcp 10.0.2.105 49606 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:41.715839 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:51:42.740993 3.000432 tcp 10.0.2.105 49607 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:51:51.740152 0.000000 tcp 10.0.2.105 49607 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:55:59.509788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 1 146 flow=Background 1970/02/25 07:56:42.150291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:57:05.469995 3.962084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/25 07:57:18.152914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:57:36.895365 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:58:15.228739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 07:58:29.271366 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:58:29.271483 2.948650 tcp 10.0.2.105 49608 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:58:40.088869 0.000000 tcp 10.0.2.105 49608 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:58:46.016218 0.061332 tcp 10.0.2.105 49609 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:58:46.077842 0.054339 tcp 10.0.2.105 49610 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:58:46.132671 0.480683 tcp 10.0.2.105 49611 -> 195.113.214.249 443 SRPA* 0 0 72 76950 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:58:47.586527 2.958988 tcp 10.0.2.105 49612 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:58:56.502067 0.000000 tcp 10.0.2.105 49612 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:02.419025 0.088661 tcp 10.0.2.105 49613 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:02.507966 0.086175 tcp 10.0.2.105 49614 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:02.594427 0.145283 tcp 10.0.2.105 49615 -> 195.113.214.249 443 SRPA* 0 0 26 13536 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:02.949246 2.967662 tcp 10.0.2.105 49616 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:12.088684 0.000000 tcp 10.0.2.105 49616 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:17.989637 0.054305 tcp 10.0.2.105 49617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:18.044259 0.057375 tcp 10.0.2.105 49618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:18.101967 0.147646 tcp 10.0.2.105 49619 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 07:59:18.974774 3.039521 tcp 10.0.2.105 49620 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:27.938365 0.000000 tcp 10.0.2.105 49620 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:33.840204 2.946311 tcp 10.0.2.105 49621 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:41.585591 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 07:59:42.699622 0.000000 tcp 10.0.2.105 49621 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:48.624278 2.945720 tcp 10.0.2.105 49622 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 07:59:57.483038 0.000000 tcp 10.0.2.105 49622 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:03:31.111853 0.303008 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:03:31.415148 0.713686 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2091 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:31.908632 0.000000 udp 10.0.2.105 7010 -> 99.21.148.224 1466 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 08:03:47.774792 0.080044 tcp 10.0.2.105 49623 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:03:47.855173 0.085112 tcp 10.0.2.105 49624 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:03:47.940560 0.152831 tcp 10.0.2.105 49625 -> 195.113.214.249 443 SRPA* 0 0 32 16780 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:03:48.094010 0.224140 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:48.310392 0.212767 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:48.519835 0.139144 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2435 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:48.656671 0.226567 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2475 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:48.874700 0.118610 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:03:49.213597 0.211904 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2531 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:04.843443 0.000000 tcp 10.0.2.105 49626 -> 195.113.214.245 80 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:04:12.791386 0.053420 tcp 10.0.2.105 49626 -> 195.113.214.245 80 FPA_* 0 0 9 1828 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:04:12.845057 0.055660 tcp 10.0.2.105 49627 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:04:12.900949 2.078682 tcp 10.0.2.105 49628 -> 195.113.214.249 443 SRPA* 0 0 29 14988 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:04:15.085471 0.348542 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:16.466626 0.080353 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:17.259172 0.196037 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:20.180724 0.070425 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:22.396999 0.057690 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2262 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:25.019085 0.164055 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2597 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:25.956854 0.127219 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2476 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:27.552921 0.512502 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 1980 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:28.193327 0.184966 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:29.593508 2.965128 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:04:30.288653 0.109339 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:30.597019 0.234341 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:31.044873 0.176528 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:32.454650 0.447134 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:34.147364 0.219981 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:34.364633 0.185396 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 1943 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:36.511065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:04:37.003526 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:04:37.262439 0.176811 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:37.434786 0.193367 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2282 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:39.019215 0.164167 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:39.695933 0.657408 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2427 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:40.323751 0.353454 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:40.674495 0.219642 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:04:44.426786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:05:00.480829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:05:08.006962 2.962108 tcp 10.0.2.105 49629 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:12.794532 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:05:16.885000 0.000000 tcp 10.0.2.105 49629 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:22.800113 0.055292 tcp 10.0.2.105 49630 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:22.886732 0.053962 tcp 10.0.2.105 49631 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:22.941035 1.453298 tcp 10.0.2.105 49632 -> 195.113.214.249 443 SRPA* 0 0 73 78422 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:25.397301 2.953648 tcp 10.0.2.105 49633 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:32.198434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:05:34.400169 0.000000 tcp 10.0.2.105 49633 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:41.133716 0.053150 tcp 10.0.2.105 49634 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:41.187142 0.056019 tcp 10.0.2.105 49635 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:41.243479 0.165138 tcp 10.0.2.105 49636 -> 195.113.214.249 443 SRPA* 0 0 41 22658 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:05:42.420172 2.957453 tcp 10.0.2.105 49637 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:51.650126 0.000000 tcp 10.0.2.105 49637 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:05:58.745980 1.483944 tcp 10.0.2.105 49638 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:06:00.230181 0.054282 tcp 10.0.2.105 49639 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:06:00.284717 0.579068 tcp 10.0.2.105 49640 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:06:01.990451 2.963241 tcp 10.0.2.105 49641 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:06:11.580089 0.000000 tcp 10.0.2.105 49641 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:06:17.494988 3.870861 tcp 10.0.2.105 49642 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:06:31.268701 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:06:32.709799 0.000000 tcp 10.0.2.105 49642 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:06:38.625528 4.730814 tcp 10.0.2.105 49643 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:06:49.265933 0.000000 tcp 10.0.2.105 49643 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:11:51.535025 0.107575 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:11:51.642905 2.945161 tcp 10.0.2.105 49644 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:00.488770 0.000000 tcp 10.0.2.105 49644 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:05.446369 2.991827 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:12:06.408758 0.053302 tcp 10.0.2.105 49645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:06.462316 0.053893 tcp 10.0.2.105 49646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:06.516506 0.153559 tcp 10.0.2.105 49647 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:08.432942 2.965904 tcp 10.0.2.105 49648 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:12.383535 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:12:17.301893 0.000000 tcp 10.0.2.105 49648 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:20.255964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:12:23.211653 0.056033 tcp 10.0.2.105 49649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:23.267989 0.056139 tcp 10.0.2.105 49650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:23.324510 0.147492 tcp 10.0.2.105 49651 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:23.483097 2.952881 tcp 10.0.2.105 49652 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:32.340559 0.000000 tcp 10.0.2.105 49652 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:36.026717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:12:38.248842 0.056395 tcp 10.0.2.105 49653 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:38.305547 0.055642 tcp 10.0.2.105 49654 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:38.361450 0.152442 tcp 10.0.2.105 49655 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:12:38.723789 2.945961 tcp 10.0.2.105 49656 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:47.577328 0.000000 tcp 10.0.2.105 49656 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:12:53.484157 2.954187 tcp 10.0.2.105 49657 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:13:02.337074 0.000000 tcp 10.0.2.105 49657 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:13:07.002374 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:13:07.526549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:13:08.241849 2.966474 tcp 10.0.2.105 49658 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:13:17.115869 0.000000 tcp 10.0.2.105 49658 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:18.447824 0.000039 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:18:18.447906 2.958534 tcp 10.0.2.105 49659 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:27.326065 0.000000 tcp 10.0.2.105 49659 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:33.225560 0.050768 tcp 10.0.2.105 49660 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:33.276561 0.050446 tcp 10.0.2.105 49661 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:33.327305 0.155592 tcp 10.0.2.105 49662 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:33.520461 2.950537 tcp 10.0.2.105 49663 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:42.400737 0.000000 tcp 10.0.2.105 49663 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:48.310236 0.051025 tcp 10.0.2.105 49664 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:48.361607 0.049351 tcp 10.0.2.105 49665 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:48.411375 0.147981 tcp 10.0.2.105 49666 -> 195.113.214.249 443 SRPA* 0 0 21 11804 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:18:48.607972 2.951132 tcp 10.0.2.105 49667 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:18:57.469123 0.000000 tcp 10.0.2.105 49667 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:03.381531 0.050140 tcp 10.0.2.105 49668 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:19:03.431926 0.050718 tcp 10.0.2.105 49669 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:19:03.482910 0.147072 tcp 10.0.2.105 49670 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:19:03.640549 2.952039 tcp 10.0.2.105 49671 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:06.022740 2.960232 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:19:12.497949 0.000000 tcp 10.0.2.105 49671 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:12.923707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:19:18.401320 2.969753 tcp 10.0.2.105 49672 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:20.809811 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:19:27.276269 0.000000 tcp 10.0.2.105 49672 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:32.085799 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:19:33.184909 2.960803 tcp 10.0.2.105 49673 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:19:36.571479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:19:42.051842 0.000000 tcp 10.0.2.105 49673 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:20:08.074576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:24:43.356982 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:24:43.357161 2.942736 tcp 10.0.2.105 49674 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:24:52.206434 0.000000 tcp 10.0.2.105 49674 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:24:58.123694 0.052155 tcp 10.0.2.105 49675 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:24:58.176085 0.097881 tcp 10.0.2.105 49676 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:24:58.274232 0.151091 tcp 10.0.2.105 49677 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:24:58.479004 2.950127 tcp 10.0.2.105 49678 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:07.337930 0.000000 tcp 10.0.2.105 49678 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:13.244721 0.048972 tcp 10.0.2.105 49679 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:13.293978 0.050981 tcp 10.0.2.105 49680 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:13.345213 0.152064 tcp 10.0.2.105 49681 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:13.523960 2.952608 tcp 10.0.2.105 49682 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:22.377638 0.000000 tcp 10.0.2.105 49682 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:28.284759 0.050218 tcp 10.0.2.105 49683 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:28.335278 0.050567 tcp 10.0.2.105 49684 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:28.386120 0.146104 tcp 10.0.2.105 49685 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:25:28.612049 2.964108 tcp 10.0.2.105 49686 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:37.478159 0.000000 tcp 10.0.2.105 49686 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:43.369077 2.959306 tcp 10.0.2.105 49687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:52.233523 0.000000 tcp 10.0.2.105 49687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:25:57.065770 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:25:58.142795 2.945433 tcp 10.0.2.105 49688 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:26:06.481094 2.950000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:26:07.008314 0.000000 tcp 10.0.2.105 49688 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:26:13.382975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:26:21.261855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:26:37.018214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:27:08.546131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:33:06.947845 2.956028 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 08:33:13.843784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:33:21.714889 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:33:37.474477 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:34:08.994023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:34:38.838373 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:34:38.838533 0.217885 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:34:39.053825 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 08:34:49.881050 2.964601 tcp 10.0.2.105 49689 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:34:56.435220 0.051691 tcp 10.0.2.105 49690 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:34:56.487208 0.051411 tcp 10.0.2.105 49691 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:34:56.538921 0.146441 tcp 10.0.2.105 49692 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:34:56.686050 0.226109 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:34:56.909252 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 08:34:58.750133 0.000000 tcp 10.0.2.105 49689 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:35:04.655607 0.050624 tcp 10.0.2.105 49693 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:04.706490 0.050176 tcp 10.0.2.105 49694 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:04.756932 0.234901 tcp 10.0.2.105 49695 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:05.011523 2.951317 tcp 10.0.2.105 49696 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:35:13.867438 0.000000 tcp 10.0.2.105 49696 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:35:14.873036 0.050509 tcp 10.0.2.105 49697 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:14.923820 0.051166 tcp 10.0.2.105 49698 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:14.975317 0.148268 tcp 10.0.2.105 49699 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:15.124119 0.202393 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:15.287455 0.234905 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2458 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:15.516097 0.122686 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:15.602106 0.347909 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:15.945936 0.075641 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.006613 0.195851 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.190503 0.063131 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.234942 0.063402 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.296523 0.166248 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.552075 0.130875 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2258 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:16.704665 0.376647 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:17.025749 1.958716 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2310 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:18.956483 0.108213 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2501 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:19.048177 0.236949 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2518 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:19.263368 0.149454 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:19.402367 0.637423 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2323 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:20.009629 0.220464 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:20.226895 0.186027 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:20.502384 0.181157 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:20.680385 0.191414 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2306 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:20.875264 0.164193 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2489 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:21.047210 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 08:35:37.981700 0.052208 tcp 10.0.2.105 49700 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:38.034234 0.051322 tcp 10.0.2.105 49701 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:38.085938 0.152718 tcp 10.0.2.105 49702 -> 195.113.214.249 443 SRPA* 0 0 21 11598 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:35:38.239207 0.353833 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:35:38.588707 0.224564 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/25 08:40:07.419204 2.954421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:40:14.315965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:40:15.164777 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:40:15.164879 2.943355 tcp 10.0.2.105 49703 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:40:22.192683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:40:24.014355 0.000000 tcp 10.0.2.105 49703 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:40:29.931667 0.055149 tcp 10.0.2.105 49704 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:29.987091 0.056198 tcp 10.0.2.105 49705 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:30.043570 0.147806 tcp 10.0.2.105 49706 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:30.201853 2.945621 tcp 10.0.2.105 49707 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:40:37.944367 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:40:39.056399 0.000000 tcp 10.0.2.105 49707 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:40:44.963500 0.054781 tcp 10.0.2.105 49708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:45.018536 0.054371 tcp 10.0.2.105 49709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:45.073160 0.147389 tcp 10.0.2.105 49710 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:40:46.241891 2.958198 tcp 10.0.2.105 49711 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:40:55.102277 0.000000 tcp 10.0.2.105 49711 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:01.003899 0.053886 tcp 10.0.2.105 49712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:41:01.058093 0.055524 tcp 10.0.2.105 49713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:41:01.113925 0.152843 tcp 10.0.2.105 49714 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:41:01.277639 2.963111 tcp 10.0.2.105 49715 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:09.451278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:41:10.160274 0.000000 tcp 10.0.2.105 49715 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:16.049344 2.944773 tcp 10.0.2.105 49716 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:24.916143 0.000000 tcp 10.0.2.105 49716 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:29.514016 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:41:30.827156 2.942349 tcp 10.0.2.105 49717 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:41:39.681137 0.000000 tcp 10.0.2.105 49717 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:46:44.809282 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:46:44.809371 3.003705 tcp 10.0.2.105 49718 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:46:53.811932 0.000000 tcp 10.0.2.105 49718 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:46:59.812187 0.056185 tcp 10.0.2.105 49719 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:46:59.868723 0.055348 tcp 10.0.2.105 49720 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:46:59.924387 0.153501 tcp 10.0.2.105 49721 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:00.398178 3.007461 tcp 10.0.2.105 49722 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:09.405079 0.000000 tcp 10.0.2.105 49722 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:12.111341 3.001378 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:47:15.393575 0.059035 tcp 10.0.2.105 49723 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:15.452940 0.056694 tcp 10.0.2.105 49724 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:15.509902 0.177655 tcp 10.0.2.105 49725 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:15.705503 2.992069 tcp 10.0.2.105 49726 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:19.118089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:47:24.705894 0.000000 tcp 10.0.2.105 49726 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:27.119679 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:47:30.705648 0.054885 tcp 10.0.2.105 49727 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:30.760851 0.060167 tcp 10.0.2.105 49728 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:30.821333 0.193058 tcp 10.0.2.105 49729 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:47:31.024957 2.994560 tcp 10.0.2.105 49730 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:40.017633 0.000000 tcp 10.0.2.105 49730 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:43.123472 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:47:46.017781 2.993444 tcp 10.0.2.105 49731 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:55.009927 0.000000 tcp 10.0.2.105 49731 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:47:59.976957 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:48:01.018976 3.003730 tcp 10.0.2.105 49732 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:48:10.021416 0.000000 tcp 10.0.2.105 49732 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:48:15.128808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:53:16.022115 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:53:16.022340 3.003413 tcp 10.0.2.105 49733 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:53:25.024480 0.000000 tcp 10.0.2.105 49733 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:53:31.024991 0.055190 tcp 10.0.2.105 49734 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:31.080492 0.054653 tcp 10.0.2.105 49735 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:31.135455 0.162412 tcp 10.0.2.105 49736 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:31.323125 2.994617 tcp 10.0.2.105 49737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:53:40.326296 0.000000 tcp 10.0.2.105 49737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:53:46.325751 0.054411 tcp 10.0.2.105 49738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:46.380046 0.057592 tcp 10.0.2.105 49739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:46.437903 0.156064 tcp 10.0.2.105 49740 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:53:46.604009 2.995804 tcp 10.0.2.105 49741 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:53:55.597632 0.000000 tcp 10.0.2.105 49741 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:01.597783 0.055619 tcp 10.0.2.105 49742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:54:01.653691 0.054302 tcp 10.0.2.105 49743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:54:01.708382 0.156445 tcp 10.0.2.105 49744 -> 195.113.214.249 443 SRPA* 0 0 24 14850 flow=From-Botnet-V2-TCP-Established 1970/02/25 08:54:01.875505 2.995938 tcp 10.0.2.105 49745 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:10.870510 0.000000 tcp 10.0.2.105 49745 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:16.869088 3.004021 tcp 10.0.2.105 49746 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:19.134601 3.001657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 08:54:25.872014 0.000000 tcp 10.0.2.105 49746 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:26.142707 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:54:30.478097 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:54:31.870944 3.003765 tcp 10.0.2.105 49747 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:34.143654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:54:40.873420 0.000000 tcp 10.0.2.105 49747 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:54:50.146981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:55:22.153084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 08:59:46.873744 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 08:59:46.873889 2.996029 tcp 10.0.2.105 49748 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 08:59:55.876533 0.000000 tcp 10.0.2.105 49748 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:01.876626 0.055414 tcp 10.0.2.105 49749 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:01.932352 0.054480 tcp 10.0.2.105 49750 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:01.987129 0.156280 tcp 10.0.2.105 49751 -> 195.113.214.249 443 SRPA* 0 0 36 27502 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:02.400070 3.000057 tcp 10.0.2.105 49752 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:11.398969 0.000000 tcp 10.0.2.105 49752 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:17.397880 0.053769 tcp 10.0.2.105 49753 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:17.451901 0.060703 tcp 10.0.2.105 49754 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:17.512811 0.152040 tcp 10.0.2.105 49755 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:17.674306 2.997626 tcp 10.0.2.105 49756 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:26.670544 0.000000 tcp 10.0.2.105 49756 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:32.669373 0.054443 tcp 10.0.2.105 49757 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:32.724054 0.057145 tcp 10.0.2.105 49758 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:32.781483 0.158746 tcp 10.0.2.105 49759 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:00:32.954372 2.999589 tcp 10.0.2.105 49760 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:41.952697 0.000000 tcp 10.0.2.105 49760 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:47.951592 3.003824 tcp 10.0.2.105 49761 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:00:56.954002 0.000000 tcp 10.0.2.105 49761 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:01:01.480435 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:01:02.952657 3.004388 tcp 10.0.2.105 49762 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:01:11.955767 0.000000 tcp 10.0.2.105 49762 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:01:26.158326 3.002130 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:01:33.166285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:01:41.167744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:01:57.174686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:02:29.176927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:05:35.745413 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:05:35.745571 0.851210 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:36.575240 0.224893 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2209 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:36.793113 0.359593 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:37.124299 0.210784 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:37.332482 0.209849 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:37.539651 0.111469 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2226 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:37.611332 0.371795 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:37.979245 0.225207 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.196789 0.092488 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.250057 0.080968 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.316984 0.064010 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.379415 0.165775 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.539881 0.127036 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2206 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.668038 0.314642 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.924568 0.068784 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2307 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:38.974961 0.196428 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:39.159466 2.180573 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:41.310055 0.097199 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:41.390941 0.239787 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:41.610580 0.153457 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:41.755643 0.443830 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:42.179166 0.183144 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2032 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:42.358100 0.184697 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:42.700917 0.164150 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:42.856850 0.181208 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:43.014663 0.225487 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2443 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:43.237202 0.354561 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:05:43.587421 0.217026 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2228 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:06:17.956135 2.994059 tcp 10.0.2.105 49763 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:06:22.482023 0.000038 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:06:26.948892 0.000000 tcp 10.0.2.105 49763 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:06:32.959016 0.055902 tcp 10.0.2.105 49764 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:33.015219 0.055954 tcp 10.0.2.105 49765 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:33.071518 0.149254 tcp 10.0.2.105 49766 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:33.257331 3.004852 tcp 10.0.2.105 49767 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:06:42.260907 0.000000 tcp 10.0.2.105 49767 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:06:48.259907 0.057188 tcp 10.0.2.105 49768 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:48.317430 0.055576 tcp 10.0.2.105 49769 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:48.373311 0.152768 tcp 10.0.2.105 49770 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:06:48.537153 3.006837 tcp 10.0.2.105 49771 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:06:57.542767 0.000000 tcp 10.0.2.105 49771 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:03.531673 0.053653 tcp 10.0.2.105 49772 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:07:03.585623 0.068362 tcp 10.0.2.105 49773 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:07:03.654394 0.162805 tcp 10.0.2.105 49774 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:07:03.846908 2.988898 tcp 10.0.2.105 49775 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:12.834590 0.000000 tcp 10.0.2.105 49775 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:18.833555 3.003907 tcp 10.0.2.105 49776 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:27.846016 0.000000 tcp 10.0.2.105 49776 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:32.482880 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:07:33.835008 2.994019 tcp 10.0.2.105 49777 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:07:42.840031 0.000000 tcp 10.0.2.105 49777 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:08:33.183004 3.001212 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:08:40.190237 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:08:48.191656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:09:04.194646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:09:36.200892 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:12:48.838691 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:12:48.838819 3.002990 tcp 10.0.2.105 49778 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:12:57.840845 0.000000 tcp 10.0.2.105 49778 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:03.840966 0.056236 tcp 10.0.2.105 49779 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:03.897476 0.056307 tcp 10.0.2.105 49780 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:03.954096 0.148602 tcp 10.0.2.105 49781 -> 195.113.214.249 443 SRPA* 0 0 38 21702 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:04.113298 3.000618 tcp 10.0.2.105 49782 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:13.112680 0.000000 tcp 10.0.2.105 49782 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:19.111953 0.053575 tcp 10.0.2.105 49783 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:19.165979 0.055641 tcp 10.0.2.105 49784 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:19.222002 0.147186 tcp 10.0.2.105 49785 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:19.381163 3.004833 tcp 10.0.2.105 49786 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:28.384459 0.000000 tcp 10.0.2.105 49786 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:34.373855 0.054347 tcp 10.0.2.105 49787 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:34.428487 0.071969 tcp 10.0.2.105 49788 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:34.500757 0.150136 tcp 10.0.2.105 49789 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:13:34.661703 2.995764 tcp 10.0.2.105 49790 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:43.666654 0.000000 tcp 10.0.2.105 49790 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:49.654647 2.994604 tcp 10.0.2.105 49791 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:13:58.648393 0.000000 tcp 10.0.2.105 49791 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:14:03.474708 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:14:04.657076 2.993607 tcp 10.0.2.105 49792 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:14:13.649633 0.000000 tcp 10.0.2.105 49792 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:15:40.206608 3.001997 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:15:47.214325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:15:55.215485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:16:11.218729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:16:43.224784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:19:19.659525 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:19:19.659678 3.005579 tcp 10.0.2.105 49793 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:19:28.662745 0.000000 tcp 10.0.2.105 49793 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:19:34.662557 0.389125 tcp 10.0.2.105 49794 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:35.051941 0.057214 tcp 10.0.2.105 49795 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:35.109536 0.156143 tcp 10.0.2.105 49796 -> 195.113.214.249 443 SRPA* 0 0 25 14904 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:36.690363 2.971386 tcp 10.0.2.105 49797 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:19:45.610122 0.000000 tcp 10.0.2.105 49797 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:19:51.537142 0.053133 tcp 10.0.2.105 49798 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:51.590566 0.056320 tcp 10.0.2.105 49799 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:51.647126 0.145082 tcp 10.0.2.105 49800 -> 195.113.214.249 443 SRPA* 0 0 23 13814 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:19:51.802827 2.962277 tcp 10.0.2.105 49801 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:00.710865 0.000000 tcp 10.0.2.105 49801 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:06.654493 0.054556 tcp 10.0.2.105 49802 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:20:06.709359 0.055530 tcp 10.0.2.105 49803 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:20:06.765191 0.148706 tcp 10.0.2.105 49804 -> 195.113.214.249 443 SRPA* 0 0 60 39702 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:20:06.931916 2.979836 tcp 10.0.2.105 49805 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:15.910520 0.000000 tcp 10.0.2.105 49805 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:21.909286 3.003953 tcp 10.0.2.105 49806 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:30.911859 0.000000 tcp 10.0.2.105 49806 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:36.827564 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:20:38.240486 2.973622 tcp 10.0.2.105 49807 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:20:47.137959 0.000000 tcp 10.0.2.105 49807 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:22:47.230077 3.002270 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:22:54.238097 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:23:02.239654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:23:18.242885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:23:50.250522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:25:51.917062 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:25:51.917225 3.000630 tcp 10.0.2.105 49808 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:00.926548 0.000000 tcp 10.0.2.105 49808 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:06.917533 0.057662 tcp 10.0.2.105 49809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:06.975443 0.056233 tcp 10.0.2.105 49810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:07.031964 0.147329 tcp 10.0.2.105 49811 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:07.189873 3.000342 tcp 10.0.2.105 49812 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:16.188497 0.000000 tcp 10.0.2.105 49812 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:22.187347 0.054875 tcp 10.0.2.105 49813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:22.242516 0.056439 tcp 10.0.2.105 49814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:22.299201 0.147129 tcp 10.0.2.105 49815 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:22.457188 3.004547 tcp 10.0.2.105 49816 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:31.460360 0.000000 tcp 10.0.2.105 49816 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:37.449555 0.058548 tcp 10.0.2.105 49817 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:37.508372 0.054749 tcp 10.0.2.105 49818 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:37.563413 0.151076 tcp 10.0.2.105 49819 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:26:37.730013 3.003577 tcp 10.0.2.105 49820 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:46.732444 0.000000 tcp 10.0.2.105 49820 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:26:52.731256 3.004135 tcp 10.0.2.105 49821 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:27:01.733939 0.000000 tcp 10.0.2.105 49821 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:27:06.480653 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:27:07.732809 3.004045 tcp 10.0.2.105 49822 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:27:16.739858 0.000000 tcp 10.0.2.105 49822 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:29:54.256532 2.999996 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:30:01.262059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:30:09.264155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:30:25.266480 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:30:57.273400 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:35:44.415831 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:35:44.416003 0.835195 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2097 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:45.231791 0.227957 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:45.456901 0.213330 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:45.667617 0.115751 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2493 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:45.742742 0.222466 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:45.957069 0.375392 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:46.306025 0.348013 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 1961 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:47.393048 0.378918 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2424 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:47.762758 0.090903 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:48.393030 0.082467 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:49.070009 0.063779 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2133 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:49.169116 0.168582 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:50.477212 0.125830 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:50.612345 0.431655 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2562 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:50.981980 0.060755 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2104 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:51.493079 0.194676 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:51.899863 0.228902 udp 10.0.2.105 7010 <-> 207.119.2.171 8296 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:52.467259 2.230632 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:52.855289 2.999863 tcp 10.0.2.105 49823 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:35:54.667553 0.106288 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:55.253655 0.180251 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:55.431306 0.154448 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2311 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:55.576887 0.446460 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:56.001351 0.196935 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2225 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:56.253776 0.165561 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:56.605650 0.187295 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:57.038434 0.225832 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2386 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:57.261313 0.354166 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:35:57.611640 0.216153 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2154 flow=From-Botnet-V2-UDP-Established 1970/02/25 09:36:01.850961 0.000000 tcp 10.0.2.105 49823 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:07.850708 0.054974 tcp 10.0.2.105 49824 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:07.905949 0.055521 tcp 10.0.2.105 49825 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:07.961781 0.148644 tcp 10.0.2.105 49826 -> 195.113.214.249 443 SRPA* 0 0 23 13202 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:08.304006 3.000026 tcp 10.0.2.105 49827 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:17.303248 0.000000 tcp 10.0.2.105 49827 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:23.302324 0.055517 tcp 10.0.2.105 49828 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:23.358080 0.056715 tcp 10.0.2.105 49829 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:23.415097 0.150755 tcp 10.0.2.105 49830 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:36:23.586415 3.003009 tcp 10.0.2.105 49831 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:32.590598 0.000000 tcp 10.0.2.105 49831 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:38.583563 2.993856 tcp 10.0.2.105 49832 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:47.586316 0.000000 tcp 10.0.2.105 49832 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:36:52.473454 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:37:01.283090 2.998267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:37:08.286016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:37:16.287212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:37:32.290975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:38:04.297010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:41:53.587057 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:41:53.587262 2.993399 tcp 10.0.2.105 49833 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:02.579076 0.000000 tcp 10.0.2.105 49833 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:08.590106 0.055768 tcp 10.0.2.105 49834 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:08.646181 0.056200 tcp 10.0.2.105 49835 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:08.702661 0.148763 tcp 10.0.2.105 49836 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:08.886096 2.998881 tcp 10.0.2.105 49837 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:17.881021 0.000000 tcp 10.0.2.105 49837 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:23.880535 0.054751 tcp 10.0.2.105 49838 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:23.935555 0.054215 tcp 10.0.2.105 49839 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:23.990066 0.145286 tcp 10.0.2.105 49840 -> 195.113.214.249 443 SRPA* 0 0 41 23454 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:24.147922 3.006484 tcp 10.0.2.105 49841 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:33.153399 0.000000 tcp 10.0.2.105 49841 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:39.142481 0.069159 tcp 10.0.2.105 49842 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:39.211915 0.055738 tcp 10.0.2.105 49843 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:39.267956 0.158653 tcp 10.0.2.105 49844 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:42:39.437314 3.008770 tcp 10.0.2.105 49845 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:48.444846 0.000000 tcp 10.0.2.105 49845 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:42:54.433867 2.994114 tcp 10.0.2.105 49846 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:43:03.436815 0.000000 tcp 10.0.2.105 49846 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:43:07.973159 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:43:09.435543 2.994235 tcp 10.0.2.105 49847 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:43:18.428013 0.000000 tcp 10.0.2.105 49847 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:44:08.302620 3.001411 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:44:15.310003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:44:23.311624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:44:39.314734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:45:11.320842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:48:24.438849 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:48:24.439067 3.003450 tcp 10.0.2.105 49848 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:48:33.441266 0.000000 tcp 10.0.2.105 49848 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:48:39.441883 0.065598 tcp 10.0.2.105 49849 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:39.507723 0.060747 tcp 10.0.2.105 49850 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:39.568722 0.146768 tcp 10.0.2.105 49851 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:39.730178 3.004335 tcp 10.0.2.105 49852 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:48:48.733483 0.000000 tcp 10.0.2.105 49852 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:48:54.726210 0.055654 tcp 10.0.2.105 49853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:54.782143 0.055329 tcp 10.0.2.105 49854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:54.837769 0.151400 tcp 10.0.2.105 49855 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:48:54.998833 2.997771 tcp 10.0.2.105 49856 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:03.995126 0.000000 tcp 10.0.2.105 49856 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:09.994359 0.054414 tcp 10.0.2.105 49857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:49:10.049041 0.054224 tcp 10.0.2.105 49858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:49:10.103543 0.206949 tcp 10.0.2.105 49859 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:49:10.361932 2.996823 tcp 10.0.2.105 49860 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:19.367112 0.000000 tcp 10.0.2.105 49860 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:25.357250 2.993328 tcp 10.0.2.105 49861 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:34.349091 0.000000 tcp 10.0.2.105 49861 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:38.975135 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:49:40.357580 3.004395 tcp 10.0.2.105 49862 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:49:49.360525 0.000000 tcp 10.0.2.105 49862 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:54:55.361149 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:54:55.361366 3.003267 tcp 10.0.2.105 49863 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:04.363422 0.000000 tcp 10.0.2.105 49863 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:10.363620 0.057300 tcp 10.0.2.105 49864 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:10.421180 0.056740 tcp 10.0.2.105 49865 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:10.478187 0.148658 tcp 10.0.2.105 49866 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:10.639148 3.007741 tcp 10.0.2.105 49867 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:19.645157 0.000000 tcp 10.0.2.105 49867 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:25.634433 0.054115 tcp 10.0.2.105 49868 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:25.688836 0.057779 tcp 10.0.2.105 49869 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:25.746932 0.145587 tcp 10.0.2.105 49870 -> 195.113.214.249 443 SRPA* 0 0 33 19424 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:25.913765 2.994791 tcp 10.0.2.105 49871 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:34.916812 0.000000 tcp 10.0.2.105 49871 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:40.906359 0.057557 tcp 10.0.2.105 49872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:40.964232 0.055233 tcp 10.0.2.105 49873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:41.019738 0.226151 tcp 10.0.2.105 49874 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 09:55:41.280031 3.000837 tcp 10.0.2.105 49875 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:50.279300 0.000000 tcp 10.0.2.105 49875 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:55:56.278106 3.004134 tcp 10.0.2.105 49876 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:56:05.280771 0.000000 tcp 10.0.2.105 49876 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:56:09.977732 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 09:56:11.279641 3.003973 tcp 10.0.2.105 49877 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:56:20.282565 0.000000 tcp 10.0.2.105 49877 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 09:58:09.334398 2.998891 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 09:58:16.339220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:58:24.341082 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:58:40.343791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 09:59:12.349806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:01:26.282807 0.000116 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:01:26.283018 3.006183 tcp 10.0.2.105 49878 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:01:35.285792 0.000000 tcp 10.0.2.105 49878 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:01:41.285823 0.055441 tcp 10.0.2.105 49879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:01:41.341519 0.056535 tcp 10.0.2.105 49880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:01:41.398373 0.148463 tcp 10.0.2.105 49881 -> 195.113.214.249 443 SRPA* 0 0 26 13992 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:01:41.557796 3.004947 tcp 10.0.2.105 49882 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:01:50.567268 0.000000 tcp 10.0.2.105 49882 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:05:16.355708 3.001724 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 10:05:23.363478 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:05:31.366977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:05:47.367741 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:06:07.947680 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:06:07.947848 0.085306 udp 10.0.2.105 7010 <-> 213.123.178.217 3364 CON 0 0 6 2336 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:08.012478 0.120218 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:08.091936 0.224472 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:08.307502 0.227606 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:08.532558 0.511063 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:09.030882 0.362744 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2099 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:09.367268 0.361306 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:09.724861 0.229631 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:09.947006 0.057263 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2205 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.002469 0.103690 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2322 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.066030 0.083224 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.133436 0.455549 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2272 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.530761 0.171949 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2037 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.695246 0.126622 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2339 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.821629 0.068506 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:10.879063 0.194450 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:11.061513 0.000000 udp 10.0.2.105 7010 -> 207.119.2.171 8296 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 10:06:19.377714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:06:29.330554 0.055588 tcp 10.0.2.105 49883 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:06:29.386421 0.055389 tcp 10.0.2.105 49884 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:06:29.442088 0.258193 tcp 10.0.2.105 49885 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:06:29.701025 2.046057 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:31.717178 0.095983 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2455 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:31.795901 0.213818 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 1904 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:32.002797 0.153192 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2111 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:32.147309 0.439797 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:32.566915 0.192010 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2380 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:32.765393 0.160800 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2169 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:33.170662 0.187911 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2250 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:33.373967 0.223473 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:33.594810 0.213578 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:33.807276 0.342399 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2118 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:06:56.556896 3.004472 tcp 10.0.2.105 49886 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:01.474156 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:07:05.559464 0.000000 tcp 10.0.2.105 49886 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:11.559312 0.055029 tcp 10.0.2.105 49887 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:11.614695 0.057681 tcp 10.0.2.105 49888 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:11.672683 0.158479 tcp 10.0.2.105 49889 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:11.851073 3.002249 tcp 10.0.2.105 49890 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:20.851844 0.000000 tcp 10.0.2.105 49890 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:26.851121 0.060680 tcp 10.0.2.105 49891 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:26.912069 0.054514 tcp 10.0.2.105 49892 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:26.966952 0.146924 tcp 10.0.2.105 49893 -> 195.113.214.249 443 SRPA* 0 0 41 22790 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:27.123368 3.002044 tcp 10.0.2.105 49894 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:36.124426 0.000000 tcp 10.0.2.105 49894 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:42.123541 0.054148 tcp 10.0.2.105 49895 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:42.177977 0.058787 tcp 10.0.2.105 49896 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:42.237059 0.161794 tcp 10.0.2.105 49897 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:07:42.406527 3.000652 tcp 10.0.2.105 49898 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:51.415823 0.000000 tcp 10.0.2.105 49898 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:07:57.405217 2.993647 tcp 10.0.2.105 49899 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:08:06.407783 0.000000 tcp 10.0.2.105 49899 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:08:10.974077 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:08:12.406171 3.012832 tcp 10.0.2.105 49900 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:08:21.399378 0.000000 tcp 10.0.2.105 49900 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:12:23.384431 2.998846 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:12:30.387206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:12:38.389139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:12:54.391485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:13:26.397760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:13:27.410022 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:13:27.410183 3.003213 tcp 10.0.2.105 49901 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:13:36.412892 0.000000 tcp 10.0.2.105 49901 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:13:42.412916 0.054354 tcp 10.0.2.105 49902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:42.467543 0.054838 tcp 10.0.2.105 49903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:42.522642 0.161805 tcp 10.0.2.105 49904 -> 195.113.214.249 443 SRPA* 0 0 41 22102 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:42.752190 3.003379 tcp 10.0.2.105 49905 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:13:51.753913 0.000000 tcp 10.0.2.105 49905 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:13:57.753506 0.055515 tcp 10.0.2.105 49906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:57.809386 0.055090 tcp 10.0.2.105 49907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:57.864778 0.174516 tcp 10.0.2.105 49908 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:13:58.049975 2.997599 tcp 10.0.2.105 49909 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:07.056110 0.000000 tcp 10.0.2.105 49909 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:13.046146 0.058735 tcp 10.0.2.105 49910 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:14:13.105153 0.054318 tcp 10.0.2.105 49911 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:14:13.159710 0.149460 tcp 10.0.2.105 49912 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:14:13.329262 3.002759 tcp 10.0.2.105 49913 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:22.327940 0.000000 tcp 10.0.2.105 49913 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:28.327057 2.993705 tcp 10.0.2.105 49914 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:37.319420 0.000000 tcp 10.0.2.105 49914 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:41.976180 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:14:43.328523 3.004284 tcp 10.0.2.105 49915 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:14:52.331175 0.000000 tcp 10.0.2.105 49915 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:19:30.403792 3.001436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:19:37.411112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:19:45.412768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:19:58.331949 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:19:58.332035 3.003307 tcp 10.0.2.105 49916 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:01.415746 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:20:07.334106 0.000000 tcp 10.0.2.105 49916 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:13.334238 0.056878 tcp 10.0.2.105 49917 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:13.391468 0.054341 tcp 10.0.2.105 49918 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:13.446114 0.145483 tcp 10.0.2.105 49919 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:13.604920 2.992517 tcp 10.0.2.105 49920 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:22.605950 0.000000 tcp 10.0.2.105 49920 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:28.605736 0.054963 tcp 10.0.2.105 49921 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:28.660985 0.056397 tcp 10.0.2.105 49922 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:28.717745 0.153313 tcp 10.0.2.105 49923 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:28.890907 2.998705 tcp 10.0.2.105 49924 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:33.421672 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:20:37.887982 0.000000 tcp 10.0.2.105 49924 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:43.887532 0.054804 tcp 10.0.2.105 49925 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:43.942632 0.055389 tcp 10.0.2.105 49926 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:43.998305 0.146777 tcp 10.0.2.105 49927 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:20:44.155277 2.997097 tcp 10.0.2.105 49928 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:53.149979 0.000000 tcp 10.0.2.105 49928 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:20:59.149034 3.004055 tcp 10.0.2.105 49929 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:21:08.151717 0.000000 tcp 10.0.2.105 49929 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:21:12.978731 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:21:14.150237 3.004343 tcp 10.0.2.105 49930 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:21:23.153540 0.000000 tcp 10.0.2.105 49930 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:26:29.153610 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:26:29.153784 2.993752 tcp 10.0.2.105 49931 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:26:37.427841 3.001257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:26:38.155897 0.000000 tcp 10.0.2.105 49931 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:26:44.157411 0.055683 tcp 10.0.2.105 49932 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:44.213365 0.056794 tcp 10.0.2.105 49933 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:44.270420 0.146617 tcp 10.0.2.105 49934 -> 195.113.214.249 443 SRPA* 0 0 68 49102 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:44.436084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:26:44.439675 2.999727 tcp 10.0.2.105 49935 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:26:52.436691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:26:53.437846 0.000000 tcp 10.0.2.105 49935 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:26:59.437577 0.054066 tcp 10.0.2.105 49936 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:59.491918 0.053913 tcp 10.0.2.105 49937 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:59.546143 0.155135 tcp 10.0.2.105 49938 -> 195.113.214.249 443 SRPA* 0 0 25 13444 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:26:59.711659 2.999727 tcp 10.0.2.105 49939 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:08.439614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:27:08.709357 0.000000 tcp 10.0.2.105 49939 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:14.709249 0.053620 tcp 10.0.2.105 49940 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:27:14.763157 0.055143 tcp 10.0.2.105 49941 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:27:14.818583 0.147256 tcp 10.0.2.105 49942 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:27:14.998269 3.005085 tcp 10.0.2.105 49943 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:24.001907 0.000000 tcp 10.0.2.105 49943 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:29.994044 3.000756 tcp 10.0.2.105 49944 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:38.993463 0.000000 tcp 10.0.2.105 49944 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:40.445639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:27:43.980714 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:27:44.992864 3.003954 tcp 10.0.2.105 49945 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:27:53.995104 0.000000 tcp 10.0.2.105 49945 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:33:44.452049 3.001146 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 10:33:51.460860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:33:59.460318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:34:15.463492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:34:47.468931 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:36:54.072255 0.000177 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:36:54.072596 0.000000 udp 10.0.2.105 7010 -> 207.119.2.171 8296 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 10:37:12.210019 0.059697 tcp 10.0.2.105 49946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:12.270036 0.053878 tcp 10.0.2.105 49947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:12.324169 0.152929 tcp 10.0.2.105 49948 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:12.510529 0.226177 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:12.729022 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 272 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 10:37:15.022097 3.003887 tcp 10.0.2.105 49949 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:37:24.025621 0.000000 tcp 10.0.2.105 49949 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:37:30.023915 0.056375 tcp 10.0.2.105 49950 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:30.080586 0.058374 tcp 10.0.2.105 49951 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:30.139248 0.147179 tcp 10.0.2.105 49952 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:30.297074 3.000855 tcp 10.0.2.105 49953 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:37:30.965055 0.054323 tcp 10.0.2.105 49954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:31.019647 0.055778 tcp 10.0.2.105 49955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:31.075681 0.150791 tcp 10.0.2.105 49956 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:37:31.227014 0.118947 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:31.307324 0.385858 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:31.688677 0.214749 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:31.899251 0.609974 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:32.496750 0.368210 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:32.834347 0.229160 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:33.055994 0.099271 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2264 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:33.116312 0.078878 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2396 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:33.308850 0.521759 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2511 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:33.769839 0.173020 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2089 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:33.937590 0.127132 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:34.065860 0.067801 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:34.115693 0.196687 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:34.300903 0.063982 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2479 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:34.363122 2.241725 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2502 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:36.573373 0.103451 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:36.660635 0.179520 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2303 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:36.837659 0.154355 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:36.982064 0.442518 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2098 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:37.404833 0.193341 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2108 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:37.612902 0.170582 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:37.768588 0.189472 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:37.977557 0.352967 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:38.326939 0.224218 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:38.547735 0.223129 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2115 flow=From-Botnet-V2-UDP-Established 1970/02/25 10:37:39.313080 0.000000 tcp 10.0.2.105 49953 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:40:51.477806 3.001169 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:40:58.483215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:41:06.484545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:41:22.487272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:41:54.493438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:42:45.298149 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:42:45.298289 2.992468 tcp 10.0.2.105 49957 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:42:54.289473 0.000000 tcp 10.0.2.105 49957 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:00.300205 0.054658 tcp 10.0.2.105 49958 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:00.355123 0.054938 tcp 10.0.2.105 49959 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:00.410388 0.158438 tcp 10.0.2.105 49960 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:00.592806 2.989940 tcp 10.0.2.105 49961 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:09.581406 0.000000 tcp 10.0.2.105 49961 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:15.580182 0.053555 tcp 10.0.2.105 49962 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:15.633980 0.057735 tcp 10.0.2.105 49963 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:15.692014 0.178708 tcp 10.0.2.105 49964 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:15.880767 3.004354 tcp 10.0.2.105 49965 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:24.883371 0.000000 tcp 10.0.2.105 49965 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:30.882478 0.054571 tcp 10.0.2.105 49966 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:30.937334 0.054480 tcp 10.0.2.105 49967 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:30.992161 0.152895 tcp 10.0.2.105 49968 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:43:31.170058 3.006679 tcp 10.0.2.105 49969 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:40.175723 0.000000 tcp 10.0.2.105 49969 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:46.164113 2.994488 tcp 10.0.2.105 49970 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:55.167398 0.000000 tcp 10.0.2.105 49970 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:43:59.973804 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:44:01.166220 2.993563 tcp 10.0.2.105 49971 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:44:10.158919 0.000000 tcp 10.0.2.105 49971 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:47:58.500093 3.001159 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:48:05.506907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:48:13.508627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:48:29.511434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:49:01.517734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:49:16.169309 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:49:16.169486 3.003746 tcp 10.0.2.105 49972 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:49:25.173051 0.000000 tcp 10.0.2.105 49972 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:49:31.171648 0.055123 tcp 10.0.2.105 49973 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:31.227038 0.055053 tcp 10.0.2.105 49974 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:31.282379 0.156808 tcp 10.0.2.105 49975 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:31.507250 2.997699 tcp 10.0.2.105 49976 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:49:40.507756 0.000000 tcp 10.0.2.105 49976 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:49:46.504168 0.070120 tcp 10.0.2.105 49977 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:46.574597 0.056830 tcp 10.0.2.105 49978 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:46.631753 0.151253 tcp 10.0.2.105 49979 -> 195.113.214.249 443 SRPA* 0 0 42 20904 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:49:46.802815 3.004115 tcp 10.0.2.105 49980 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:49:55.805598 0.000000 tcp 10.0.2.105 49980 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:01.794684 0.055876 tcp 10.0.2.105 49981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:50:01.850934 0.053960 tcp 10.0.2.105 49982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:50:01.905180 0.151172 tcp 10.0.2.105 49983 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:50:02.066924 2.992080 tcp 10.0.2.105 49984 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:11.067409 0.000000 tcp 10.0.2.105 49984 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:17.066265 2.994346 tcp 10.0.2.105 49985 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:26.059001 0.000000 tcp 10.0.2.105 49985 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:30.976042 0.000117 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:50:32.067869 3.003985 tcp 10.0.2.105 49986 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:50:41.070657 0.000000 tcp 10.0.2.105 49986 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:55:05.524193 3.001175 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 10:55:12.530925 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:55:20.532580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:55:36.535447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:55:47.071058 0.000099 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:55:47.071249 3.003430 tcp 10.0.2.105 49987 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:55:56.073538 0.000000 tcp 10.0.2.105 49987 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:02.074276 0.054627 tcp 10.0.2.105 49988 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:02.129193 0.056737 tcp 10.0.2.105 49989 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:02.186190 0.154103 tcp 10.0.2.105 49990 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:02.350902 3.006316 tcp 10.0.2.105 49991 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:08.541413 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 10:56:11.355514 0.000000 tcp 10.0.2.105 49991 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:17.344954 0.128060 tcp 10.0.2.105 49992 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:17.473257 0.055958 tcp 10.0.2.105 49993 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:17.529578 0.219609 tcp 10.0.2.105 49994 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:17.879604 3.001943 tcp 10.0.2.105 49995 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:26.877963 0.000000 tcp 10.0.2.105 49995 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:32.877298 0.057509 tcp 10.0.2.105 49996 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:32.935096 0.054676 tcp 10.0.2.105 49997 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:32.990177 0.156421 tcp 10.0.2.105 49998 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/25 10:56:33.192413 2.988817 tcp 10.0.2.105 49999 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:42.180037 0.000000 tcp 10.0.2.105 49999 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:48.189076 3.004078 tcp 10.0.2.105 50000 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:56:57.191178 0.000000 tcp 10.0.2.105 50000 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:57:01.978582 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 10:57:03.190482 3.004144 tcp 10.0.2.105 50001 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 10:57:12.193261 0.000000 tcp 10.0.2.105 50001 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:12.547343 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:02:18.193867 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:02:18.194048 2.995894 tcp 10.0.2.105 50002 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:19.555696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:02:27.195705 0.000000 tcp 10.0.2.105 50002 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:27.556635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:02:33.195983 0.055215 tcp 10.0.2.105 50003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:33.251461 0.057388 tcp 10.0.2.105 50004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:33.309137 0.147058 tcp 10.0.2.105 50005 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:33.466013 2.992903 tcp 10.0.2.105 50006 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:42.457401 0.000000 tcp 10.0.2.105 50006 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:43.558797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:02:48.467048 0.058397 tcp 10.0.2.105 50007 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:48.525680 0.057571 tcp 10.0.2.105 50008 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:48.583514 0.255746 tcp 10.0.2.105 50009 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:02:48.849894 2.991267 tcp 10.0.2.105 50010 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:02:57.839967 0.000000 tcp 10.0.2.105 50010 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:03.848849 0.054075 tcp 10.0.2.105 50011 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:03:03.903194 0.055607 tcp 10.0.2.105 50012 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:03:03.959102 0.148588 tcp 10.0.2.105 50013 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:03:04.118792 3.004726 tcp 10.0.2.105 50014 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:13.122009 0.000000 tcp 10.0.2.105 50014 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:15.565416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:03:19.120640 3.006387 tcp 10.0.2.105 50015 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:28.123260 0.000000 tcp 10.0.2.105 50015 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:32.980504 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:03:34.122405 3.004641 tcp 10.0.2.105 50016 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:03:43.125171 0.000000 tcp 10.0.2.105 50016 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:07:55.718938 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:07:55.719097 0.000000 udp 10.0.2.105 7010 -> 213.123.178.217 3364 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 11:08:11.362508 0.056087 tcp 10.0.2.105 50017 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:11.418842 0.054124 tcp 10.0.2.105 50018 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:11.473273 0.147739 tcp 10.0.2.105 50019 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:11.621492 0.222030 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:11.835645 0.228467 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2321 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:12.060330 0.125916 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:12.145588 0.375997 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:12.517386 0.227178 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:12.741527 0.361259 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2344 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:13.074651 0.231780 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 1971 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:13.299712 0.085980 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2174 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:13.405419 0.080622 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2279 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:13.470891 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 11:08:28.977273 0.056471 tcp 10.0.2.105 50020 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:29.034377 0.056285 tcp 10.0.2.105 50021 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:29.090972 0.152253 tcp 10.0.2.105 50022 -> 195.113.214.249 443 SRPA* 0 0 51 31312 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:08:29.244049 0.167532 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:29.413894 0.126938 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:29.542114 0.069485 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:29.591992 0.194916 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:29.775263 0.057903 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2490 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:29.831306 0.180488 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2267 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:30.008660 0.174620 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:30.173327 1.753283 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2421 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:31.894937 0.104839 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2161 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:31.985032 0.445249 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:32.408806 0.197245 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:32.602614 0.161767 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2207 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:32.757893 0.187596 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:32.973191 0.226094 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:33.196818 0.353073 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2289 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:33.546217 0.215787 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2186 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:08:49.125410 2.993736 tcp 10.0.2.105 50023 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:08:53.981905 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:08:58.117745 0.000000 tcp 10.0.2.105 50023 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:04.127163 0.055932 tcp 10.0.2.105 50024 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:04.183365 0.054193 tcp 10.0.2.105 50025 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:04.237853 0.143685 tcp 10.0.2.105 50026 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:04.404101 2.996964 tcp 10.0.2.105 50027 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:13.399952 0.000000 tcp 10.0.2.105 50027 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:19.399111 0.054080 tcp 10.0.2.105 50028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:19.453453 0.055682 tcp 10.0.2.105 50029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:19.509390 0.146779 tcp 10.0.2.105 50030 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:19.570735 3.002505 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:09:19.693467 2.999845 tcp 10.0.2.105 50031 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:26.578765 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:09:28.692665 0.000000 tcp 10.0.2.105 50031 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:34.580177 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:09:34.690898 0.054954 tcp 10.0.2.105 50032 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:34.746122 0.054728 tcp 10.0.2.105 50033 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:34.801345 0.155869 tcp 10.0.2.105 50034 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:09:34.986106 2.999122 tcp 10.0.2.105 50035 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:43.983656 0.000000 tcp 10.0.2.105 50035 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:49.982991 3.003962 tcp 10.0.2.105 50036 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:09:50.583380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:09:58.985477 0.000000 tcp 10.0.2.105 50036 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:10:03.972619 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:10:04.984061 2.994610 tcp 10.0.2.105 50037 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:10:13.987087 0.000000 tcp 10.0.2.105 50037 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:10:22.589212 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:15:19.987799 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:15:19.987903 3.003290 tcp 10.0.2.105 50038 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:15:28.990069 0.000000 tcp 10.0.2.105 50038 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:15:34.990602 0.056941 tcp 10.0.2.105 50039 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:35.047832 0.055424 tcp 10.0.2.105 50040 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:35.103590 0.155001 tcp 10.0.2.105 50041 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:35.282845 3.000453 tcp 10.0.2.105 50042 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:15:44.281925 0.000000 tcp 10.0.2.105 50042 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:15:50.281370 0.056077 tcp 10.0.2.105 50043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:50.337746 0.057697 tcp 10.0.2.105 50044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:50.395679 0.165699 tcp 10.0.2.105 50045 -> 195.113.214.249 443 SRPA* 0 0 41 21368 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:15:50.585457 2.999994 tcp 10.0.2.105 50046 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:15:59.584090 0.000000 tcp 10.0.2.105 50046 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:05.583281 0.054531 tcp 10.0.2.105 50047 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:16:05.638131 0.057966 tcp 10.0.2.105 50048 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:16:05.696491 0.150142 tcp 10.0.2.105 50049 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:16:05.865174 3.002115 tcp 10.0.2.105 50050 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:14.875828 0.000000 tcp 10.0.2.105 50050 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:20.864784 2.994101 tcp 10.0.2.105 50051 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:26.596887 3.000031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:16:29.867460 0.000000 tcp 10.0.2.105 50051 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:33.603003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:16:34.473988 0.000104 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:16:35.865949 2.993986 tcp 10.0.2.105 50052 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:41.604209 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:16:44.859233 0.000000 tcp 10.0.2.105 50052 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:16:57.607322 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:17:29.613206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:21:50.869318 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:21:50.869451 3.003795 tcp 10.0.2.105 50053 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:21:59.871890 0.000000 tcp 10.0.2.105 50053 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:05.871788 0.055178 tcp 10.0.2.105 50054 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:05.927213 0.055176 tcp 10.0.2.105 50055 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:05.982695 0.148222 tcp 10.0.2.105 50056 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:06.140456 2.994713 tcp 10.0.2.105 50057 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:15.133605 0.000000 tcp 10.0.2.105 50057 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:21.133514 0.053787 tcp 10.0.2.105 50058 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:21.187569 0.056509 tcp 10.0.2.105 50059 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:21.244484 0.157306 tcp 10.0.2.105 50060 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:21.411743 3.007705 tcp 10.0.2.105 50061 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:30.415923 0.000000 tcp 10.0.2.105 50061 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:36.405360 0.053710 tcp 10.0.2.105 50062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:36.459299 0.055852 tcp 10.0.2.105 50063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:36.515503 0.149489 tcp 10.0.2.105 50064 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:22:36.686919 2.992351 tcp 10.0.2.105 50065 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:45.677316 0.000000 tcp 10.0.2.105 50065 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:22:51.686986 2.993556 tcp 10.0.2.105 50066 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:23:00.679268 0.000000 tcp 10.0.2.105 50066 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:23:05.476189 0.000208 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:23:06.687500 3.004681 tcp 10.0.2.105 50067 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:23:15.690906 0.000000 tcp 10.0.2.105 50067 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:23:33.620778 3.000132 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:23:40.626685 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:23:48.628159 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:24:04.631361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:24:36.637839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:28:21.691422 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:28:21.691622 3.003432 tcp 10.0.2.105 50068 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:28:30.693704 0.000000 tcp 10.0.2.105 50068 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:28:36.694055 0.055451 tcp 10.0.2.105 50069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:36.749789 0.057289 tcp 10.0.2.105 50070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:36.807354 0.147502 tcp 10.0.2.105 50071 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:36.964861 3.002258 tcp 10.0.2.105 50072 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:28:45.965648 0.000000 tcp 10.0.2.105 50072 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:28:51.964862 0.056732 tcp 10.0.2.105 50073 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:52.021906 0.055585 tcp 10.0.2.105 50074 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:52.077748 0.149375 tcp 10.0.2.105 50075 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:28:52.291375 2.997796 tcp 10.0.2.105 50076 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:01.288384 0.000000 tcp 10.0.2.105 50076 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:07.287563 0.056479 tcp 10.0.2.105 50077 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:29:07.344405 0.056958 tcp 10.0.2.105 50078 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:29:07.401619 0.144059 tcp 10.0.2.105 50079 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:29:08.107954 3.003827 tcp 10.0.2.105 50080 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:17.110733 0.000000 tcp 10.0.2.105 50080 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:23.109433 3.003971 tcp 10.0.2.105 50081 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:30.979927 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:29:32.112294 0.000000 tcp 10.0.2.105 50081 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:38.110703 3.005335 tcp 10.0.2.105 50082 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:29:47.113591 0.000000 tcp 10.0.2.105 50082 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:30:40.643018 3.002451 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:30:47.650654 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:30:55.652943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:31:11.655148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:31:43.661382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:37:47.668506 3.000467 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 11:37:54.674785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:38:02.676298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:38:18.678876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:38:43.585485 0.000120 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:38:43.585727 0.283923 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:43.810413 0.120581 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2393 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:43.893071 0.226752 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:44.112456 0.216441 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:44.324956 0.376217 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2302 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:44.697358 0.366696 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.036595 0.212238 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2123 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.245397 0.091196 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2488 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.296701 0.245890 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.535029 0.083613 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.603674 0.167441 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2157 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.788360 0.126928 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2382 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.916738 0.064255 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:45.961470 0.192919 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:46.143070 0.153592 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:46.287787 0.063697 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2316 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:46.349769 0.180971 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:46.527548 0.503521 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:46.991361 1.466143 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2093 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:48.431883 0.104238 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:48.517818 0.196483 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:48.712008 0.161243 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:48.867098 0.186690 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:49.083766 0.217155 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2438 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:49.297959 0.353951 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:49.648081 0.220847 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/25 11:38:50.684913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:38:53.139747 3.003619 tcp 10.0.2.105 50083 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:02.141678 0.000000 tcp 10.0.2.105 50083 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:08.142161 0.058267 tcp 10.0.2.105 50084 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:08.200692 0.055429 tcp 10.0.2.105 50085 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:08.256457 0.144955 tcp 10.0.2.105 50086 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:08.411986 3.003177 tcp 10.0.2.105 50087 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:17.420062 0.000000 tcp 10.0.2.105 50087 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:23.412750 0.055063 tcp 10.0.2.105 50088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:23.468111 0.055090 tcp 10.0.2.105 50089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:23.523493 0.154526 tcp 10.0.2.105 50090 -> 195.113.214.249 443 SRPA* 0 0 41 22032 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:23.698664 3.008375 tcp 10.0.2.105 50091 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:32.705937 0.000000 tcp 10.0.2.105 50091 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:38.694553 0.054113 tcp 10.0.2.105 50092 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:38.748935 0.055842 tcp 10.0.2.105 50093 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:38.805053 0.150302 tcp 10.0.2.105 50094 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:39:38.981070 2.998133 tcp 10.0.2.105 50095 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:47.977630 0.000000 tcp 10.0.2.105 50095 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:39:53.976952 2.993563 tcp 10.0.2.105 50096 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:40:02.969285 0.000000 tcp 10.0.2.105 50096 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:40:07.475741 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:40:08.978236 3.004134 tcp 10.0.2.105 50097 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:40:17.980703 0.000000 tcp 10.0.2.105 50097 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:44:54.690975 3.001994 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:45:01.698656 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:45:09.702591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:45:23.981521 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:45:23.981720 3.003440 tcp 10.0.2.105 50098 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:45:25.703510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:45:32.983487 0.000000 tcp 10.0.2.105 50098 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:45:38.984463 0.055644 tcp 10.0.2.105 50099 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:39.040560 0.055850 tcp 10.0.2.105 50100 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:39.096688 0.150490 tcp 10.0.2.105 50101 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:39.257499 3.009562 tcp 10.0.2.105 50102 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:45:48.265702 0.000000 tcp 10.0.2.105 50102 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:45:54.254703 0.055200 tcp 10.0.2.105 50103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:54.310172 0.054840 tcp 10.0.2.105 50104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:54.365329 0.151027 tcp 10.0.2.105 50105 -> 195.113.214.249 443 SRPA* 0 0 41 20832 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:45:54.604773 2.994374 tcp 10.0.2.105 50106 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:45:57.709527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:46:03.597643 0.000000 tcp 10.0.2.105 50106 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:09.609513 0.056175 tcp 10.0.2.105 50107 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:46:09.666036 0.054532 tcp 10.0.2.105 50108 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:46:09.720907 0.152727 tcp 10.0.2.105 50109 -> 195.113.214.249 443 SRPA* 0 0 21 12468 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:46:09.884218 2.996746 tcp 10.0.2.105 50110 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:18.879635 0.000000 tcp 10.0.2.105 50110 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:24.878407 3.004247 tcp 10.0.2.105 50111 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:33.881340 0.000000 tcp 10.0.2.105 50111 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:38.477812 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:46:39.879764 3.004434 tcp 10.0.2.105 50112 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:46:48.882799 0.000000 tcp 10.0.2.105 50112 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:51:54.883287 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:51:54.883403 3.003420 tcp 10.0.2.105 50113 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:03.888056 0.000000 tcp 10.0.2.105 50113 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:09.885993 0.055239 tcp 10.0.2.105 50114 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:09.941508 0.059281 tcp 10.0.2.105 50115 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:10.001051 0.149553 tcp 10.0.2.105 50116 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:10.174751 2.994399 tcp 10.0.2.105 50117 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:19.167850 0.000000 tcp 10.0.2.105 50117 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:25.166793 0.054163 tcp 10.0.2.105 50118 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:25.221314 0.054591 tcp 10.0.2.105 50119 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:25.276225 0.147580 tcp 10.0.2.105 50120 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:25.441500 2.999419 tcp 10.0.2.105 50121 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:34.439348 0.000000 tcp 10.0.2.105 50121 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:40.438668 0.054934 tcp 10.0.2.105 50122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:40.493846 0.054296 tcp 10.0.2.105 50123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:40.548405 0.144342 tcp 10.0.2.105 50124 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:52:40.709970 3.002877 tcp 10.0.2.105 50125 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:49.711568 0.000000 tcp 10.0.2.105 50125 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:52:55.710252 3.005191 tcp 10.0.2.105 50126 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:53:04.713280 0.000000 tcp 10.0.2.105 50126 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:53:09.479316 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:53:10.711843 3.004105 tcp 10.0.2.105 50127 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:53:19.715097 0.000000 tcp 10.0.2.105 50127 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:58:25.715290 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:58:25.715455 2.993509 tcp 10.0.2.105 50128 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:58:33.719326 3.000657 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 11:58:34.707096 0.000000 tcp 10.0.2.105 50128 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:58:40.718122 0.054766 tcp 10.0.2.105 50129 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:40.726079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:58:40.773135 0.055385 tcp 10.0.2.105 50130 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:40.828833 0.149963 tcp 10.0.2.105 50131 -> 195.113.214.249 443 SRPA* 0 0 52 41908 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:40.990083 3.003133 tcp 10.0.2.105 50132 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:58:48.728037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:58:49.989481 0.000000 tcp 10.0.2.105 50132 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:58:55.990158 0.054252 tcp 10.0.2.105 50133 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:56.044677 0.058167 tcp 10.0.2.105 50134 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:56.103169 0.148671 tcp 10.0.2.105 50135 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:58:57.504556 3.000009 tcp 10.0.2.105 50136 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:04.730701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:59:06.503381 0.000000 tcp 10.0.2.105 50136 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:12.505846 0.054013 tcp 10.0.2.105 50137 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:59:12.560164 0.056515 tcp 10.0.2.105 50138 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:59:12.616957 0.148204 tcp 10.0.2.105 50139 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 11:59:12.784140 3.002820 tcp 10.0.2.105 50140 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:21.785357 0.000000 tcp 10.0.2.105 50140 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:27.776195 2.991370 tcp 10.0.2.105 50141 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:36.736674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 11:59:36.776700 0.000000 tcp 10.0.2.105 50141 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:41.473482 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 11:59:42.775784 2.993749 tcp 10.0.2.105 50142 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 11:59:51.768017 0.000000 tcp 10.0.2.105 50142 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:05:40.744006 3.000102 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 12:05:47.750109 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:05:55.751795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:06:11.754668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:06:43.761273 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:08:58.234609 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:08:58.234712 0.236306 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2409 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:58.463547 0.286785 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2259 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:58.690975 0.116734 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:58.770827 0.480368 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2274 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:59.222828 0.207862 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2364 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:59.427576 0.217832 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:59.642794 0.349636 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2328 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:08:59.988172 0.090868 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2163 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.042475 0.234811 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2166 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.270892 0.083015 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.337731 0.170071 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.502524 0.126743 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.630617 0.067641 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.680089 0.193944 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2193 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:00.862804 0.176409 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.035996 0.450665 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.465670 0.153990 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.610102 0.057310 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2049 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.700314 0.188813 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2381 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.859993 0.107112 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2334 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:01.950849 0.200478 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2100 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:02.161060 0.159719 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2388 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:02.311918 0.188115 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2408 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:02.475942 0.255339 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:02.727794 0.224765 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:02.949690 0.348101 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2001 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:09:12.805488 2.993851 tcp 10.0.2.105 50143 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:21.797843 0.000000 tcp 10.0.2.105 50143 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:26.474802 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:09:27.808816 0.054934 tcp 10.0.2.105 50144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:27.864030 0.054000 tcp 10.0.2.105 50145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:27.918264 0.153062 tcp 10.0.2.105 50146 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:28.087431 2.994380 tcp 10.0.2.105 50147 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:37.080009 0.000000 tcp 10.0.2.105 50147 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:43.089809 0.054270 tcp 10.0.2.105 50148 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:43.144515 0.057244 tcp 10.0.2.105 50149 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:43.202046 0.158057 tcp 10.0.2.105 50150 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:43.377336 2.996049 tcp 10.0.2.105 50151 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:52.371748 0.000000 tcp 10.0.2.105 50151 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:09:58.371208 0.053193 tcp 10.0.2.105 50152 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:58.424678 0.053882 tcp 10.0.2.105 50153 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:58.478786 0.145080 tcp 10.0.2.105 50154 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:09:58.733953 3.001462 tcp 10.0.2.105 50155 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:10:07.733874 0.000000 tcp 10.0.2.105 50155 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:10:13.732976 3.004094 tcp 10.0.2.105 50156 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:10:22.735653 0.000000 tcp 10.0.2.105 50156 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:10:27.472768 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:10:28.734610 2.993557 tcp 10.0.2.105 50157 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:10:37.737047 0.000000 tcp 10.0.2.105 50157 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:12:47.766941 3.001472 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:12:54.774056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:13:02.775954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:13:18.778922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:13:50.785060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:15:43.737336 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:15:43.737508 3.003986 tcp 10.0.2.105 50158 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:15:52.740257 0.000000 tcp 10.0.2.105 50158 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:15:58.740904 0.058462 tcp 10.0.2.105 50159 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:15:58.799647 0.058293 tcp 10.0.2.105 50160 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:15:58.858233 0.194303 tcp 10.0.2.105 50161 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:15:59.257542 3.006180 tcp 10.0.2.105 50162 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:08.262656 0.000000 tcp 10.0.2.105 50162 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:14.251351 0.058732 tcp 10.0.2.105 50163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:14.310304 0.062834 tcp 10.0.2.105 50164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:14.373400 0.161514 tcp 10.0.2.105 50165 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:14.545729 3.000046 tcp 10.0.2.105 50166 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:23.544470 0.000000 tcp 10.0.2.105 50166 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:29.544028 0.059054 tcp 10.0.2.105 50167 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:29.603499 0.059512 tcp 10.0.2.105 50168 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:29.663268 0.151666 tcp 10.0.2.105 50169 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:16:29.824831 2.992641 tcp 10.0.2.105 50170 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:38.826298 0.000000 tcp 10.0.2.105 50170 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:44.825334 2.993784 tcp 10.0.2.105 50171 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:53.817744 0.000000 tcp 10.0.2.105 50171 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:16:58.476405 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:16:59.827211 2.993098 tcp 10.0.2.105 50172 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:17:08.819498 0.000000 tcp 10.0.2.105 50172 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:19:54.791499 3.001287 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:20:01.798787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:20:09.799533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:20:25.803049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:20:57.808387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:22:14.830111 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:22:14.830263 3.003449 tcp 10.0.2.105 50173 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:22:23.832462 0.000000 tcp 10.0.2.105 50173 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:22:29.833050 0.059599 tcp 10.0.2.105 50174 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:29.892896 0.058535 tcp 10.0.2.105 50175 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:29.951795 0.154937 tcp 10.0.2.105 50176 -> 195.113.214.249 443 SRPA* 0 0 25 13406 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:30.150672 3.005253 tcp 10.0.2.105 50177 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:22:39.154456 0.000000 tcp 10.0.2.105 50177 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:22:45.144451 0.058332 tcp 10.0.2.105 50178 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:45.203138 0.059499 tcp 10.0.2.105 50179 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:45.262906 0.159844 tcp 10.0.2.105 50180 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:22:45.432927 2.994869 tcp 10.0.2.105 50181 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:22:54.436443 0.000000 tcp 10.0.2.105 50181 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:00.425939 0.058720 tcp 10.0.2.105 50182 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:23:00.484916 0.059117 tcp 10.0.2.105 50183 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:23:00.544460 0.153372 tcp 10.0.2.105 50184 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:23:00.719741 2.999777 tcp 10.0.2.105 50185 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:09.717885 0.000000 tcp 10.0.2.105 50185 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:15.717507 2.993706 tcp 10.0.2.105 50186 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:24.709727 0.000000 tcp 10.0.2.105 50186 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:29.476563 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:23:30.719066 3.004479 tcp 10.0.2.105 50187 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:23:39.721404 0.000000 tcp 10.0.2.105 50187 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:27:01.815784 3.000753 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:27:08.822028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:27:16.823561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:27:32.826946 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:28:04.832913 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:28:45.722194 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:28:45.722353 3.003404 tcp 10.0.2.105 50188 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:28:54.724606 0.000000 tcp 10.0.2.105 50188 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:00.725727 0.062814 tcp 10.0.2.105 50189 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:00.788821 0.058331 tcp 10.0.2.105 50190 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:00.847482 0.161358 tcp 10.0.2.105 50191 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:01.019321 2.998384 tcp 10.0.2.105 50192 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:10.027327 0.000000 tcp 10.0.2.105 50192 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:16.015660 0.057564 tcp 10.0.2.105 50193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:16.073477 0.058244 tcp 10.0.2.105 50194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:16.131971 0.161478 tcp 10.0.2.105 50195 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:16.311783 2.998332 tcp 10.0.2.105 50196 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:25.313402 0.000000 tcp 10.0.2.105 50196 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:31.307674 0.058034 tcp 10.0.2.105 50197 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:31.365963 0.062884 tcp 10.0.2.105 50198 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:31.429162 0.164893 tcp 10.0.2.105 50199 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:29:31.614861 2.996912 tcp 10.0.2.105 50200 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:40.610503 0.000000 tcp 10.0.2.105 50200 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:46.611111 3.004229 tcp 10.0.2.105 50201 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:29:55.611819 0.000000 tcp 10.0.2.105 50201 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:30:00.478712 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:30:01.610989 3.003876 tcp 10.0.2.105 50202 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:30:10.613485 0.000000 tcp 10.0.2.105 50202 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:34:08.838403 3.001943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:34:15.846189 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:34:23.847797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:34:39.850977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:35:11.856593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:39:18.401554 0.000130 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:39:18.401797 0.226201 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2155 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:18.620049 0.355332 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:18.949833 0.213248 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2075 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:19.160044 0.598988 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:19.702585 0.118973 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:19.782875 0.216383 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2517 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:19.996497 0.348711 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:20.341174 0.093762 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2172 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:20.398881 0.239181 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2203 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:20.630891 0.081597 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:20.695919 0.166125 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2181 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:20.871096 0.125132 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.006099 0.069483 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.056080 0.196783 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.241470 0.180982 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2175 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.419356 0.446215 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.844519 0.154989 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2418 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:21.989833 0.057192 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2241 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.045480 0.180840 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2325 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.198268 0.101828 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.283662 0.199731 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2156 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.497640 0.240721 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2301 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.734746 0.208244 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:22.939876 0.159455 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:23.092991 0.186438 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2087 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:23.283503 0.352679 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/25 12:39:31.640636 3.003735 tcp 10.0.2.105 50203 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:39:40.643260 0.000000 tcp 10.0.2.105 50203 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:39:45.496652 0.000131 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:39:46.656943 0.058862 tcp 10.0.2.105 50204 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:39:46.716061 0.058520 tcp 10.0.2.105 50205 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:39:46.774938 0.149408 tcp 10.0.2.105 50206 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:39:46.934838 2.998055 tcp 10.0.2.105 50207 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:39:55.927301 0.000000 tcp 10.0.2.105 50207 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:01.924127 0.060416 tcp 10.0.2.105 50208 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:01.984900 0.058026 tcp 10.0.2.105 50209 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:02.043188 0.154100 tcp 10.0.2.105 50210 -> 195.113.214.249 443 SRPA* 0 0 22 13112 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:02.207629 3.001192 tcp 10.0.2.105 50211 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:11.217177 0.000000 tcp 10.0.2.105 50211 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:17.206488 0.057564 tcp 10.0.2.105 50212 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:17.264354 0.058691 tcp 10.0.2.105 50213 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:17.323316 0.152301 tcp 10.0.2.105 50214 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:40:17.494344 2.995879 tcp 10.0.2.105 50215 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:26.493143 0.000000 tcp 10.0.2.105 50215 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:32.487499 3.004373 tcp 10.0.2.105 50216 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:41.490496 0.000000 tcp 10.0.2.105 50216 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:46.477789 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:40:47.489312 3.004137 tcp 10.0.2.105 50217 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:40:56.492254 0.000000 tcp 10.0.2.105 50217 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:41:15.862986 3.001375 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:41:22.870340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:41:30.871810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:41:46.874550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:42:18.880569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:46:02.492720 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:46:02.492897 3.003626 tcp 10.0.2.105 50218 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:11.494997 0.000000 tcp 10.0.2.105 50218 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:17.495096 0.058632 tcp 10.0.2.105 50219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:17.554003 0.060490 tcp 10.0.2.105 50220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:17.614783 0.160396 tcp 10.0.2.105 50221 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:17.785584 2.993049 tcp 10.0.2.105 50222 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:26.786961 0.000000 tcp 10.0.2.105 50222 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:32.786011 0.057778 tcp 10.0.2.105 50223 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:32.844050 0.058671 tcp 10.0.2.105 50224 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:32.902995 0.147768 tcp 10.0.2.105 50225 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:33.060789 2.999954 tcp 10.0.2.105 50226 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:42.059211 0.000000 tcp 10.0.2.105 50226 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:48.058498 0.057178 tcp 10.0.2.105 50227 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:48.115940 0.061369 tcp 10.0.2.105 50228 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:48.177618 0.152658 tcp 10.0.2.105 50229 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:46:48.340389 3.001942 tcp 10.0.2.105 50230 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:46:57.341117 0.000000 tcp 10.0.2.105 50230 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:47:03.339714 3.004239 tcp 10.0.2.105 50231 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:47:12.342602 0.000000 tcp 10.0.2.105 50231 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:47:16.979268 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:47:18.341334 3.004245 tcp 10.0.2.105 50232 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:47:27.343879 0.000000 tcp 10.0.2.105 50232 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:48:22.886907 3.001517 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:48:29.893953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:48:37.897398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:48:53.898370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:49:25.909315 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:52:33.345819 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:52:33.346010 2.992546 tcp 10.0.2.105 50233 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:52:42.346975 0.000000 tcp 10.0.2.105 50233 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:52:48.347140 0.062623 tcp 10.0.2.105 50234 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:52:48.409982 0.341365 tcp 10.0.2.105 50235 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:52:48.751604 0.155234 tcp 10.0.2.105 50236 -> 195.113.214.249 443 SRPA* 0 0 33 24367 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:52:48.916851 3.004069 tcp 10.0.2.105 50237 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:52:57.919160 0.000000 tcp 10.0.2.105 50237 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:03.918316 0.062047 tcp 10.0.2.105 50238 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:03.980644 0.061208 tcp 10.0.2.105 50239 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:04.042161 0.165097 tcp 10.0.2.105 50240 -> 195.113.214.249 443 SRPA* 0 0 42 33380 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:04.279998 3.002774 tcp 10.0.2.105 50241 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:13.281655 0.000000 tcp 10.0.2.105 50241 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:19.280621 0.062085 tcp 10.0.2.105 50242 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:19.342972 0.063531 tcp 10.0.2.105 50243 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:19.406787 0.206573 tcp 10.0.2.105 50244 -> 195.113.214.249 443 SRPA* 0 0 41 22424 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:53:19.643021 3.001989 tcp 10.0.2.105 50245 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:28.643470 0.000000 tcp 10.0.2.105 50245 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:34.642234 3.004377 tcp 10.0.2.105 50246 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:43.645526 0.000000 tcp 10.0.2.105 50246 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:48.472114 0.000266 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:53:49.644085 2.999308 tcp 10.0.2.105 50247 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:53:58.646714 0.000000 tcp 10.0.2.105 50247 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:55:29.909857 3.002331 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 12:55:36.918156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:55:44.919974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:56:00.922702 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:56:32.928770 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 12:59:04.647778 0.000119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 12:59:04.647973 3.002907 tcp 10.0.2.105 50248 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:13.649801 0.000000 tcp 10.0.2.105 50248 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:19.650591 0.058619 tcp 10.0.2.105 50249 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:19.709506 0.061012 tcp 10.0.2.105 50250 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:19.770776 0.136220 tcp 10.0.2.105 50251 -> 195.113.214.249 443 SRPA* 0 0 34 25217 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:19.917794 2.995312 tcp 10.0.2.105 50252 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:28.911100 0.000000 tcp 10.0.2.105 50252 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:34.910933 0.057820 tcp 10.0.2.105 50253 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:34.969042 0.058998 tcp 10.0.2.105 50254 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:35.028332 0.153289 tcp 10.0.2.105 50255 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:35.201171 3.003606 tcp 10.0.2.105 50256 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:44.207016 0.000000 tcp 10.0.2.105 50256 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:50.202725 0.058611 tcp 10.0.2.105 50257 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:50.261610 0.057304 tcp 10.0.2.105 50258 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:50.319192 0.153754 tcp 10.0.2.105 50259 -> 195.113.214.249 443 SRPA* 0 0 27 12040 flow=From-Botnet-V2-TCP-Established 1970/02/25 12:59:50.483217 3.003727 tcp 10.0.2.105 50260 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 12:59:59.485441 0.000000 tcp 10.0.2.105 50260 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:00:05.484353 2.993901 tcp 10.0.2.105 50261 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:00:14.487033 0.000000 tcp 10.0.2.105 50261 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:00:19.474024 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:00:20.485777 2.994053 tcp 10.0.2.105 50262 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:00:29.478490 0.000000 tcp 10.0.2.105 50262 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:02:36.934618 3.001954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:02:43.941785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:02:51.943324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:03:07.947038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:03:39.952660 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:09:25.629218 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:09:25.629417 0.212133 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2168 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:25.838293 0.222947 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:26.053219 0.357768 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2177 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:26.384712 0.221709 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2281 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:26.603784 0.279054 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:26.830296 0.117369 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2292 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:26.984700 0.382612 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2219 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:27.363540 0.099580 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:27.445644 0.229799 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:27.668453 0.074635 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2346 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:27.726041 0.164553 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2218 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:27.885424 0.126346 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2233 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.029081 0.068884 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2117 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.079350 0.195133 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.261175 0.152893 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2048 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.405016 0.062749 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2011 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.466307 0.187077 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.624553 0.180556 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2469 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:28.802127 0.449322 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:29.230505 0.125279 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:29.393737 0.192799 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2480 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:29.582229 0.223120 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:29.801324 0.229166 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2378 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:30.027184 0.169913 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2349 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:30.182141 0.183649 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2308 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:30.442232 0.352647 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2387 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:09:35.514519 2.993248 tcp 10.0.2.105 50263 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:09:43.958693 3.001304 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 13:09:44.516743 0.000000 tcp 10.0.2.105 50263 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:09:49.473774 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:09:50.516818 0.059271 tcp 10.0.2.105 50264 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:09:50.576370 0.059959 tcp 10.0.2.105 50265 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:09:50.636613 0.150676 tcp 10.0.2.105 50266 -> 195.113.214.249 443 SRPA* 0 0 23 11876 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:09:50.796595 2.993536 tcp 10.0.2.105 50267 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:09:50.965998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:09:58.967826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:09:59.788896 0.000000 tcp 10.0.2.105 50267 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:05.797890 0.057738 tcp 10.0.2.105 50268 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:05.855940 0.058339 tcp 10.0.2.105 50269 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:05.914559 0.149854 tcp 10.0.2.105 50270 -> 195.113.214.249 443 SRPA* 0 0 38 21284 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:06.081419 3.000357 tcp 10.0.2.105 50271 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:14.970744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:10:15.080557 0.000000 tcp 10.0.2.105 50271 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:21.079636 0.081009 tcp 10.0.2.105 50272 -> 195.113.214.245 80 FSPA* 0 0 10 1535 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:21.160912 0.059743 tcp 10.0.2.105 50273 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:21.220880 0.162829 tcp 10.0.2.105 50274 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:10:21.409642 3.004354 tcp 10.0.2.105 50275 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:30.412744 0.000000 tcp 10.0.2.105 50275 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:36.411483 3.004050 tcp 10.0.2.105 50276 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:45.413999 0.000000 tcp 10.0.2.105 50276 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:10:46.976858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:10:49.980455 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:10:51.412911 3.004205 tcp 10.0.2.105 50277 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:11:00.415824 0.000000 tcp 10.0.2.105 50277 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:06.416269 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:16:06.416396 2.993628 tcp 10.0.2.105 50278 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:15.409290 0.000000 tcp 10.0.2.105 50278 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:21.419002 0.058415 tcp 10.0.2.105 50279 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:21.477666 0.057855 tcp 10.0.2.105 50280 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:21.535801 0.152247 tcp 10.0.2.105 50281 -> 195.113.214.249 443 SRPA* 0 0 44 36238 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:21.698478 3.003647 tcp 10.0.2.105 50282 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:30.700964 0.000000 tcp 10.0.2.105 50282 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:36.700736 0.058059 tcp 10.0.2.105 50283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:36.759084 0.057549 tcp 10.0.2.105 50284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:36.816946 0.146920 tcp 10.0.2.105 50285 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:36.973988 3.002360 tcp 10.0.2.105 50286 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:45.972480 0.000000 tcp 10.0.2.105 50286 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:51.972064 0.057460 tcp 10.0.2.105 50287 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:51.984328 3.001193 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:16:52.029806 0.091563 tcp 10.0.2.105 50288 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:52.121632 0.149265 tcp 10.0.2.105 50289 -> 195.113.214.249 443 SRPA* 0 0 23 12576 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:16:52.280856 3.004935 tcp 10.0.2.105 50290 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:16:58.991440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:17:01.284477 0.000000 tcp 10.0.2.105 50290 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:17:06.992625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:17:07.273572 2.993941 tcp 10.0.2.105 50291 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:17:16.275989 0.000000 tcp 10.0.2.105 50291 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:17:20.972688 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:17:22.275176 2.994338 tcp 10.0.2.105 50292 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:17:22.996350 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:17:31.281097 0.000000 tcp 10.0.2.105 50292 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:17:55.001763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:22:37.278076 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:22:37.278172 3.003688 tcp 10.0.2.105 50293 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:22:46.280649 0.000000 tcp 10.0.2.105 50293 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:22:52.283573 0.059106 tcp 10.0.2.105 50294 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:22:52.342984 0.059400 tcp 10.0.2.105 50295 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:22:52.402678 0.152406 tcp 10.0.2.105 50296 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:22:52.596979 2.997328 tcp 10.0.2.105 50297 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:01.592718 0.000000 tcp 10.0.2.105 50297 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:07.592208 0.057956 tcp 10.0.2.105 50298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:07.650454 0.058999 tcp 10.0.2.105 50299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:07.709736 0.149262 tcp 10.0.2.105 50300 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:07.868779 3.007409 tcp 10.0.2.105 50301 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:16.874947 0.000000 tcp 10.0.2.105 50301 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:22.864075 0.057140 tcp 10.0.2.105 50302 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:22.921432 0.057467 tcp 10.0.2.105 50303 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:22.979182 0.152361 tcp 10.0.2.105 50304 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:23:23.142968 2.994897 tcp 10.0.2.105 50305 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:32.151100 0.000000 tcp 10.0.2.105 50305 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:38.135384 2.994165 tcp 10.0.2.105 50306 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:47.128418 0.000000 tcp 10.0.2.105 50306 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:51.974975 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:23:53.136832 2.994644 tcp 10.0.2.105 50307 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:23:59.007498 3.002267 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:24:02.129914 0.000000 tcp 10.0.2.105 50307 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:24:06.015434 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:24:14.017192 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:24:30.019801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:25:02.026023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:29:08.140533 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:29:08.140731 3.006464 tcp 10.0.2.105 50308 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:17.143059 0.000000 tcp 10.0.2.105 50308 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:23.143085 0.058708 tcp 10.0.2.105 50309 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:23.202136 0.058307 tcp 10.0.2.105 50310 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:23.260753 0.148684 tcp 10.0.2.105 50311 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:23.420714 3.005529 tcp 10.0.2.105 50312 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:32.424610 0.000000 tcp 10.0.2.105 50312 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:38.414044 0.057037 tcp 10.0.2.105 50313 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:38.471340 0.058258 tcp 10.0.2.105 50314 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:38.529887 0.153507 tcp 10.0.2.105 50315 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:38.693648 2.994172 tcp 10.0.2.105 50316 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:47.695874 0.000000 tcp 10.0.2.105 50316 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:29:53.695697 0.057631 tcp 10.0.2.105 50317 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:53.753651 0.057680 tcp 10.0.2.105 50318 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:53.811626 0.151711 tcp 10.0.2.105 50319 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:29:53.973334 2.996834 tcp 10.0.2.105 50320 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:30:02.968534 0.000000 tcp 10.0.2.105 50320 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:30:08.967421 3.004087 tcp 10.0.2.105 50321 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:30:17.969985 0.000000 tcp 10.0.2.105 50321 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:30:22.476560 0.000118 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:30:23.968691 3.004387 tcp 10.0.2.105 50322 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:30:32.975438 0.000000 tcp 10.0.2.105 50322 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:31:06.031839 3.001674 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:31:13.042956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:31:21.040696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:31:37.044024 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:32:09.050091 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:38:13.055689 3.001981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 13:38:20.063766 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:38:28.064858 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:38:44.067727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:39:16.073721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:39:37.665648 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:39:37.665813 0.628240 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2390 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:38.266150 0.213779 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:38.476143 0.225192 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:38.698097 0.223428 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2538 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:38.912881 0.431128 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2055 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:38.997276 2.993735 tcp 10.0.2.105 50323 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:39:39.288460 0.113040 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:39.362647 0.348734 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2319 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:39.707878 0.120522 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2162 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:39.791635 0.229814 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.013911 0.077807 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2095 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.076095 0.185954 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2463 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.253887 0.126834 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2338 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.403110 0.061523 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.446854 0.191721 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2492 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.627003 0.154255 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2293 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.771547 0.063856 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2327 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:40.833623 2.205435 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2078 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.014056 0.180545 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2145 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.191095 0.185629 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2176 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.380826 0.215235 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2106 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.592413 0.217669 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2182 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.802692 0.163559 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2352 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:43.957456 0.479305 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2147 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:44.414359 0.100332 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2445 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:44.497827 0.185262 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2090 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:44.684031 0.348462 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2392 flow=From-Botnet-V2-UDP-Established 1970/02/25 13:39:47.989607 0.000000 tcp 10.0.2.105 50323 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:39:53.999659 0.058133 tcp 10.0.2.105 50324 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:39:54.058091 0.058344 tcp 10.0.2.105 50325 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:39:54.116747 0.149100 tcp 10.0.2.105 50326 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:39:54.275955 2.996863 tcp 10.0.2.105 50327 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:40:03.273338 0.000000 tcp 10.0.2.105 50327 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:09.272381 0.000124 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:45:09.272622 3.006545 tcp 10.0.2.105 50328 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:18.274543 0.000000 tcp 10.0.2.105 50328 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:20.079158 3.002604 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:45:24.274837 0.058977 tcp 10.0.2.105 50329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:24.334052 0.058511 tcp 10.0.2.105 50330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:24.392863 0.151915 tcp 10.0.2.105 50331 -> 195.113.214.249 443 SRPA* 0 0 39 31248 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:24.557865 2.999992 tcp 10.0.2.105 50332 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:27.087062 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:45:33.566580 0.000000 tcp 10.0.2.105 50332 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:35.088991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:45:39.555762 0.056901 tcp 10.0.2.105 50333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:39.612997 0.057364 tcp 10.0.2.105 50334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:39.670642 0.153879 tcp 10.0.2.105 50335 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:39.834202 2.998552 tcp 10.0.2.105 50336 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:48.828908 0.000000 tcp 10.0.2.105 50336 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:45:51.091601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:45:54.828135 0.059535 tcp 10.0.2.105 50337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:54.887939 0.058285 tcp 10.0.2.105 50338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:54.946510 0.150800 tcp 10.0.2.105 50339 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:45:55.130395 3.001555 tcp 10.0.2.105 50340 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:46:04.164613 0.000000 tcp 10.0.2.105 50340 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:46:10.129293 3.003975 tcp 10.0.2.105 50341 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:46:19.131769 0.000000 tcp 10.0.2.105 50341 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:46:23.097724 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:46:23.979040 0.000092 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:46:25.130717 3.004306 tcp 10.0.2.105 50342 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:46:34.133528 0.000000 tcp 10.0.2.105 50342 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:51:40.134567 0.000108 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:51:40.134741 2.993026 tcp 10.0.2.105 50343 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:51:49.136643 0.000000 tcp 10.0.2.105 50343 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:51:55.136990 0.058713 tcp 10.0.2.105 50344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:51:55.195989 0.058060 tcp 10.0.2.105 50345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:51:55.254396 0.149697 tcp 10.0.2.105 50346 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:51:55.415409 2.994346 tcp 10.0.2.105 50347 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:04.408594 0.000000 tcp 10.0.2.105 50347 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:10.417966 0.057217 tcp 10.0.2.105 50348 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:10.475529 0.057251 tcp 10.0.2.105 50349 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:10.533090 0.148238 tcp 10.0.2.105 50350 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:10.690610 3.001334 tcp 10.0.2.105 50351 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:19.689742 0.000000 tcp 10.0.2.105 50351 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:25.689749 0.057868 tcp 10.0.2.105 50352 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:25.747927 0.057963 tcp 10.0.2.105 50353 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:25.806375 0.151805 tcp 10.0.2.105 50354 -> 195.113.214.249 443 SRPA* 0 0 41 22828 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:52:25.968962 3.004838 tcp 10.0.2.105 50355 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:34.972690 0.000000 tcp 10.0.2.105 50355 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:40.961174 3.004336 tcp 10.0.2.105 50356 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:49.963849 0.000000 tcp 10.0.2.105 50356 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:52:54.480529 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:52:55.962853 3.004187 tcp 10.0.2.105 50357 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:53:04.965390 0.000000 tcp 10.0.2.105 50357 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:10.966137 0.000122 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:58:10.966367 2.993330 tcp 10.0.2.105 50358 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:19.958463 0.000000 tcp 10.0.2.105 50358 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:25.968813 0.057978 tcp 10.0.2.105 50359 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:26.027051 0.060222 tcp 10.0.2.105 50360 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:26.087549 0.148044 tcp 10.0.2.105 50361 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:26.247029 2.994607 tcp 10.0.2.105 50362 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:35.240256 0.000000 tcp 10.0.2.105 50362 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:41.239512 0.057137 tcp 10.0.2.105 50363 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:41.296981 0.057013 tcp 10.0.2.105 50364 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:41.354321 0.145362 tcp 10.0.2.105 50365 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:41.525017 2.998674 tcp 10.0.2.105 50366 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:47.110820 3.000805 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 13:58:50.522528 0.000000 tcp 10.0.2.105 50366 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:58:54.117675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:58:56.521573 0.057784 tcp 10.0.2.105 50367 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:56.579638 0.058839 tcp 10.0.2.105 50368 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:56.638802 0.153906 tcp 10.0.2.105 50369 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/25 13:58:56.802758 3.006120 tcp 10.0.2.105 50370 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:02.119433 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:59:05.804154 0.000000 tcp 10.0.2.105 50370 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:11.803126 3.004191 tcp 10.0.2.105 50371 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:18.121951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 13:59:20.816101 0.000000 tcp 10.0.2.105 50371 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:25.472677 0.000091 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 13:59:26.805071 2.994178 tcp 10.0.2.105 50372 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:35.807571 0.000000 tcp 10.0.2.105 50372 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 13:59:50.128526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:04:41.808158 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:04:41.808279 3.003622 tcp 10.0.2.105 50373 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:04:50.810506 0.000000 tcp 10.0.2.105 50373 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:04:56.810543 0.058868 tcp 10.0.2.105 50374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:04:56.869694 0.060076 tcp 10.0.2.105 50375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:04:56.930027 0.150410 tcp 10.0.2.105 50376 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:04:57.096075 2.997476 tcp 10.0.2.105 50377 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:06.092528 0.000000 tcp 10.0.2.105 50377 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:12.091652 0.056417 tcp 10.0.2.105 50378 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:05:12.148578 0.058393 tcp 10.0.2.105 50379 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:05:12.207362 0.148685 tcp 10.0.2.105 50380 -> 195.113.214.249 443 SRPA* 0 0 41 33610 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:05:12.422849 3.006119 tcp 10.0.2.105 50381 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:21.424517 0.000000 tcp 10.0.2.105 50381 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:27.423021 2.994270 tcp 10.0.2.105 50382 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:36.425884 0.000000 tcp 10.0.2.105 50382 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:05:40.974671 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:05:54.134104 3.001861 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:06:07.580307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:06:15.470435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:06:31.249324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:07:02.793780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:09:48.436423 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:09:48.436516 0.363711 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2236 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:48.771108 0.231934 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2287 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:49.145347 0.223570 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:49.365886 0.212831 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2284 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:49.576544 0.286963 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:49.805685 0.111328 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2333 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:49.890206 0.370492 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:50.256789 0.083621 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2260 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:50.302916 0.335344 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:50.630331 0.079535 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:50.733528 0.183512 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2552 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:50.909832 0.125796 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2506 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.075057 0.066927 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2086 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.191101 0.203190 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2096 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.383073 0.154398 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.527749 0.063372 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2132 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.589300 0.177196 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2231 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.738604 0.185858 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:51.920674 0.193299 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2444 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:52.121287 0.215859 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:52.333585 0.213635 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:52.544104 0.167104 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:52.703209 0.188977 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2400 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:52.907170 0.352694 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2324 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:53.256079 0.443073 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2144 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:09:53.679621 0.105177 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:10:44.943665 2.956890 tcp 10.0.2.105 50383 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:10:49.429071 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:10:53.817093 0.000000 tcp 10.0.2.105 50383 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:10:59.753983 0.057202 tcp 10.0.2.105 50384 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:10:59.811475 0.057577 tcp 10.0.2.105 50385 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:10:59.869327 0.148422 tcp 10.0.2.105 50386 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:00.082272 2.955193 tcp 10.0.2.105 50387 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:08.949075 0.000000 tcp 10.0.2.105 50387 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:14.867105 0.056557 tcp 10.0.2.105 50388 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:14.923993 0.058764 tcp 10.0.2.105 50389 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:14.983003 0.152341 tcp 10.0.2.105 50390 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:15.168905 2.958094 tcp 10.0.2.105 50391 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:24.038388 0.000000 tcp 10.0.2.105 50391 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:29.949339 0.057752 tcp 10.0.2.105 50392 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:30.007415 0.058115 tcp 10.0.2.105 50393 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:30.065780 0.153115 tcp 10.0.2.105 50394 -> 195.113.214.249 443 SRPA* 0 0 23 13202 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:11:30.570931 2.966741 tcp 10.0.2.105 50395 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:39.451633 0.000000 tcp 10.0.2.105 50395 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:45.353191 2.951257 tcp 10.0.2.105 50396 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:54.230363 0.000000 tcp 10.0.2.105 50396 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:11:58.936800 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:12:00.142663 2.947064 tcp 10.0.2.105 50397 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:12:09.003366 0.000000 tcp 10.0.2.105 50397 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:13:01.769669 2.959814 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:13:08.683291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:13:16.579014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:13:32.358497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:14:04.185550 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:17:13.699341 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:17:13.699453 3.003258 tcp 10.0.2.105 50398 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:22.701282 0.000000 tcp 10.0.2.105 50398 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:28.701436 0.058303 tcp 10.0.2.105 50399 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:28.760066 0.057657 tcp 10.0.2.105 50400 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:28.818055 0.149368 tcp 10.0.2.105 50401 -> 195.113.214.249 443 SRPA* 0 0 45 39156 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:29.007092 2.997807 tcp 10.0.2.105 50402 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:38.003312 0.000000 tcp 10.0.2.105 50402 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:44.002808 0.057109 tcp 10.0.2.105 50403 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:44.060270 0.058614 tcp 10.0.2.105 50404 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:44.119255 0.150370 tcp 10.0.2.105 50405 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:44.439135 2.997885 tcp 10.0.2.105 50406 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:53.439489 0.000000 tcp 10.0.2.105 50406 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:17:59.434472 0.057358 tcp 10.0.2.105 50407 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:59.492127 0.060727 tcp 10.0.2.105 50408 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:59.553093 0.149529 tcp 10.0.2.105 50409 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:17:59.792957 2.996236 tcp 10.0.2.105 50410 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:18:08.797803 0.000000 tcp 10.0.2.105 50410 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:18:14.786661 2.993573 tcp 10.0.2.105 50411 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:18:23.778907 0.000000 tcp 10.0.2.105 50411 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:18:28.475937 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:18:29.788354 3.003777 tcp 10.0.2.105 50412 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:18:38.790950 0.000000 tcp 10.0.2.105 50412 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:20:08.191906 3.723995 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:20:15.871914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:20:23.775116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:20:39.593122 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:21:11.349914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:23:44.791345 0.065612 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:23:44.857113 2.976794 tcp 10.0.2.105 50413 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:23:53.812734 0.000000 tcp 10.0.2.105 50413 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:23:59.803997 0.191119 tcp 10.0.2.105 50414 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:23:59.995337 0.058800 tcp 10.0.2.105 50415 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:00.054501 0.154556 tcp 10.0.2.105 50416 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:00.362295 2.985265 tcp 10.0.2.105 50417 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:09.306200 0.000000 tcp 10.0.2.105 50417 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:15.275132 0.058012 tcp 10.0.2.105 50418 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:15.333426 0.057968 tcp 10.0.2.105 50419 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:15.391693 0.151825 tcp 10.0.2.105 50420 -> 195.113.214.249 443 SRPA* 0 0 23 11042 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:15.794356 2.995280 tcp 10.0.2.105 50421 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:25.585062 0.000000 tcp 10.0.2.105 50421 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:31.509739 0.057346 tcp 10.0.2.105 50422 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:31.567391 0.058241 tcp 10.0.2.105 50423 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:31.625952 0.153394 tcp 10.0.2.105 50424 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:24:32.565908 2.966703 tcp 10.0.2.105 50425 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:41.451958 0.000000 tcp 10.0.2.105 50425 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:47.369804 2.967734 tcp 10.0.2.105 50426 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:24:54.890790 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:24:56.259509 0.000000 tcp 10.0.2.105 50426 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:25:02.179866 2.972581 tcp 10.0.2.105 50427 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:25:11.079999 0.000000 tcp 10.0.2.105 50427 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:27:15.251630 3.034363 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:27:22.263564 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:27:30.265168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:27:46.267972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:28:18.273374 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:30:16.854863 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:30:16.855038 2.993725 tcp 10.0.2.105 50428 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:30:25.857621 0.000000 tcp 10.0.2.105 50428 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:30:31.857406 0.083282 tcp 10.0.2.105 50429 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:31.940910 0.057313 tcp 10.0.2.105 50430 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:31.998497 0.151486 tcp 10.0.2.105 50431 -> 195.113.214.249 443 SRPA* 0 0 39 34472 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:32.579158 3.002104 tcp 10.0.2.105 50432 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:30:41.579954 0.000000 tcp 10.0.2.105 50432 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:30:47.980596 0.057836 tcp 10.0.2.105 50433 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:48.038656 0.058627 tcp 10.0.2.105 50434 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:48.097223 0.150763 tcp 10.0.2.105 50435 -> 195.113.214.249 443 SRPA* 0 0 26 13992 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:30:48.307130 2.977424 tcp 10.0.2.105 50436 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:30:57.224814 0.000000 tcp 10.0.2.105 50436 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:03.154159 0.057616 tcp 10.0.2.105 50437 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:31:03.212056 0.058128 tcp 10.0.2.105 50438 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:31:03.270493 0.153599 tcp 10.0.2.105 50439 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:31:03.438958 2.983173 tcp 10.0.2.105 50440 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:12.362193 0.000000 tcp 10.0.2.105 50440 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:18.291591 2.976863 tcp 10.0.2.105 50441 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:27.209331 0.000000 tcp 10.0.2.105 50441 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:31.972599 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:31:33.184475 2.993471 tcp 10.0.2.105 50442 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:31:42.187291 0.000000 tcp 10.0.2.105 50442 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:34:22.280010 3.026214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:34:29.297479 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:34:37.298932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:34:53.304842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:35:25.308067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:40:12.630656 0.012324 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:40:12.643155 0.000000 udp 10.0.2.105 7010 -> 211.38.175.27 5959 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 14:40:28.515486 0.098360 tcp 10.0.2.105 50443 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:28.614208 0.073111 tcp 10.0.2.105 50444 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:28.688087 0.152329 tcp 10.0.2.105 50445 -> 195.113.214.249 443 SRPA* 0 0 41 22866 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:28.841007 0.226201 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2478 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:29.059256 0.213402 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2315 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:29.380405 0.225843 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2332 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:29.603418 0.389047 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:29.937215 0.113760 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2353 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:30.137506 0.384038 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2109 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:30.517697 0.098809 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:30.827383 0.232077 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:31.723236 0.087860 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:32.481774 0.176062 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:33.086267 0.127598 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2305 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:33.225545 2.989349 tcp 10.0.2.105 50446 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:40:33.345046 0.068107 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2402 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:33.528823 0.194667 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2345 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:34.537796 0.153735 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2257 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:35.947571 0.063263 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2152 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:36.150828 0.191180 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2270 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:36.313555 0.181451 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:36.543399 0.184784 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2114 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:36.945785 0.440197 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:37.377221 0.185664 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:37.992178 0.352471 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2268 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:38.340698 0.472526 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2160 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:38.792379 0.093118 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2437 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:38.896731 0.234720 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2198 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:39.127695 0.212948 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/25 14:40:42.213333 0.000000 tcp 10.0.2.105 50446 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:40:48.212881 0.056800 tcp 10.0.2.105 50447 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:48.269971 0.058698 tcp 10.0.2.105 50448 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:48.328954 0.151527 tcp 10.0.2.105 50449 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:40:48.720990 3.009942 tcp 10.0.2.105 50450 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:40:57.735334 0.000000 tcp 10.0.2.105 50450 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:41:03.717638 0.057971 tcp 10.0.2.105 50451 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:41:03.775485 0.057507 tcp 10.0.2.105 50452 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:41:03.833273 0.150795 tcp 10.0.2.105 50453 -> 195.113.214.249 443 SRPA* 0 0 40 29822 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:41:04.173732 2.995727 tcp 10.0.2.105 50454 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:41:13.167994 0.000000 tcp 10.0.2.105 50454 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:41:19.171407 2.989267 tcp 10.0.2.105 50455 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:41:28.159586 0.000000 tcp 10.0.2.105 50455 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:41:29.323866 3.001921 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:41:32.976764 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:41:36.331284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:41:44.332748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:42:00.335747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:42:32.341905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:46:34.170250 0.246179 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:46:34.416539 2.968168 tcp 10.0.2.105 50456 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:46:43.379712 0.000000 tcp 10.0.2.105 50456 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:46:49.427318 0.058764 tcp 10.0.2.105 50457 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:46:49.486350 0.269472 tcp 10.0.2.105 50458 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:46:49.756072 0.145793 tcp 10.0.2.105 50459 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:46:49.983294 2.972113 tcp 10.0.2.105 50460 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:46:58.898179 0.000000 tcp 10.0.2.105 50460 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:04.839389 0.111156 tcp 10.0.2.105 50461 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:04.950577 0.056727 tcp 10.0.2.105 50462 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:05.007593 0.148995 tcp 10.0.2.105 50463 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:05.696541 2.967566 tcp 10.0.2.105 50464 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:14.619752 0.000000 tcp 10.0.2.105 50464 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:20.679950 0.057502 tcp 10.0.2.105 50465 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:20.737756 0.058174 tcp 10.0.2.105 50466 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:20.796280 0.146968 tcp 10.0.2.105 50467 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:47:21.190438 2.965278 tcp 10.0.2.105 50468 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:30.100761 0.000000 tcp 10.0.2.105 50468 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:36.392176 0.000000 tcp 10.0.2.105 50469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:47:58.198497 0.000000 tcp 10.0.2.105 50469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:48:10.107962 0.000000 tcp 10.0.2.105 50469 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:48:19.273707 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:48:20.645661 4.837498 tcp 10.0.2.105 50470 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:48:31.387730 0.000000 tcp 10.0.2.105 50470 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:49:07.304965 2.955481 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:49:14.211605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:49:22.095299 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:49:37.856842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:50:09.390003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:53:32.757459 0.104383 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:53:32.861981 2.953095 tcp 10.0.2.105 50471 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:53:41.720867 0.000000 tcp 10.0.2.105 50471 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:53:47.635295 0.057696 tcp 10.0.2.105 50472 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:53:47.693290 0.059416 tcp 10.0.2.105 50473 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:53:47.752959 0.149666 tcp 10.0.2.105 50474 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:53:48.417297 2.953756 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:53:57.278682 0.000000 tcp 10.0.2.105 50475 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:03.191713 0.058919 tcp 10.0.2.105 50476 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:03.250926 0.059132 tcp 10.0.2.105 50477 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:03.310342 0.154610 tcp 10.0.2.105 50478 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:03.533421 2.946829 tcp 10.0.2.105 50479 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:12.416727 0.000000 tcp 10.0.2.105 50479 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:18.439412 0.071051 tcp 10.0.2.105 50480 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:18.510758 0.072801 tcp 10.0.2.105 50481 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:18.583879 0.169696 tcp 10.0.2.105 50482 -> 195.113.214.249 443 SRPA* 0 0 21 12470 flow=From-Botnet-V2-TCP-Established 1970/02/25 14:54:18.807642 2.958134 tcp 10.0.2.105 50483 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:27.670418 0.000000 tcp 10.0.2.105 50483 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:33.574910 2.963769 tcp 10.0.2.105 50484 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:42.448991 0.000000 tcp 10.0.2.105 50484 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:47.265844 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:54:48.358049 2.962296 tcp 10.0.2.105 50485 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:54:57.231997 0.000000 tcp 10.0.2.105 50485 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 14:56:08.422608 2.988838 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 14:56:15.360866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:56:23.235507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:56:39.001756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:57:10.536323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 14:59:58.676104 0.023799 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 14:59:58.700026 2.935276 tcp 10.0.2.105 50486 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:07.546286 0.000000 tcp 10.0.2.105 50486 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:13.476633 0.058748 tcp 10.0.2.105 50487 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:13.535659 0.058436 tcp 10.0.2.105 50488 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:13.594338 0.149076 tcp 10.0.2.105 50489 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:13.824563 2.947367 tcp 10.0.2.105 50490 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:22.683586 0.000000 tcp 10.0.2.105 50490 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:28.590573 0.072140 tcp 10.0.2.105 50491 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:28.663011 0.058681 tcp 10.0.2.105 50492 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:28.722068 0.146675 tcp 10.0.2.105 50493 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:28.971398 2.954855 tcp 10.0.2.105 50494 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:38.181239 0.000000 tcp 10.0.2.105 50494 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:44.337868 0.057223 tcp 10.0.2.105 50495 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:44.395435 0.058945 tcp 10.0.2.105 50496 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:44.454646 0.147548 tcp 10.0.2.105 50497 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:00:45.367999 2.965020 tcp 10.0.2.105 50498 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:00:54.348307 0.000000 tcp 10.0.2.105 50498 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:01:00.391249 2.947096 tcp 10.0.2.105 50499 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:01:07.943213 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:01:09.257261 0.000000 tcp 10.0.2.105 50499 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:01:15.164402 2.943387 tcp 10.0.2.105 50500 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:01:24.014327 0.000000 tcp 10.0.2.105 50500 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:03:10.024641 3.221813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:03:17.188756 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:03:25.067181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:03:40.822531 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:04:12.315447 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:06:25.639078 0.298872 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:06:25.938126 3.164595 tcp 10.0.2.105 50501 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:06:35.115831 0.000000 tcp 10.0.2.105 50501 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:06:41.032000 0.164217 tcp 10.0.2.105 50502 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:06:41.196473 0.057789 tcp 10.0.2.105 50503 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:06:41.254555 0.147140 tcp 10.0.2.105 50504 -> 195.113.214.249 443 SRPA* 0 0 20 10084 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:06:41.716355 2.968340 tcp 10.0.2.105 50505 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:06:50.600659 0.000000 tcp 10.0.2.105 50505 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:10:11.531645 3.158792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 15:10:18.642835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:10:26.520910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:10:42.280058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:10:56.195897 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:10:56.196194 0.690671 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2326 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:10:57.618114 0.225634 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2530 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:10:58.164532 0.278443 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:10:58.454714 0.110667 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2210 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:10:59.169576 0.214005 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2204 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:00.673950 0.207406 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:01.490373 0.353710 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2309 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:02.774185 0.124183 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2403 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:03.588221 0.222932 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2317 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:03.803675 0.077890 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2329 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:03.902081 0.188245 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2124 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.082716 0.125828 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2040 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.361987 0.063529 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2372 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.407352 0.192625 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.587999 0.155608 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2466 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.733412 0.063274 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2121 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:04.795149 0.195615 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2510 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:05.134414 0.189340 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2361 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:05.293906 0.174748 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2173 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:05.750984 0.166458 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2113 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:06.238127 0.183602 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2394 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:06.423990 0.107917 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2351 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:06.538775 0.218383 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2590 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:06.753294 0.354014 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2263 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:07.103633 0.446458 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:07.963851 0.212891 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2180 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:11:14.090495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:11:52.611011 2.946012 tcp 10.0.2.105 50506 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:11:57.490672 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:12:01.479011 0.000000 tcp 10.0.2.105 50506 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:07.392078 0.058904 tcp 10.0.2.105 50507 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:07.451256 0.057617 tcp 10.0.2.105 50508 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:07.509151 0.150887 tcp 10.0.2.105 50509 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:07.714501 2.944569 tcp 10.0.2.105 50510 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:16.574072 0.000000 tcp 10.0.2.105 50510 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:22.484123 0.058015 tcp 10.0.2.105 50511 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:22.542430 0.093991 tcp 10.0.2.105 50512 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:22.636748 0.153345 tcp 10.0.2.105 50513 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:23.356113 2.959169 tcp 10.0.2.105 50514 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:32.221119 0.000000 tcp 10.0.2.105 50514 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:38.123788 0.057314 tcp 10.0.2.105 50515 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:38.181436 0.057650 tcp 10.0.2.105 50516 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:38.239412 0.146705 tcp 10.0.2.105 50517 -> 195.113.214.249 443 SRPA* 0 0 21 11766 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:12:38.950087 2.956906 tcp 10.0.2.105 50518 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:47.815614 0.000000 tcp 10.0.2.105 50518 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:12:53.721738 2.958135 tcp 10.0.2.105 50519 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:13:01.541474 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:13:02.596927 0.000000 tcp 10.0.2.105 50519 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:13:08.497355 2.944260 tcp 10.0.2.105 50520 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:13:17.350120 0.000000 tcp 10.0.2.105 50520 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:17:17.585196 3.044136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:17:24.573817 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:17:32.455632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:17:48.225116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:18:18.932693 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:18:18.932852 2.954587 tcp 10.0.2.105 50521 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:18:19.925687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:18:27.795290 0.000000 tcp 10.0.2.105 50521 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:18:33.704835 0.058741 tcp 10.0.2.105 50522 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:33.763881 0.058640 tcp 10.0.2.105 50523 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:33.822814 0.153008 tcp 10.0.2.105 50524 -> 195.113.214.249 443 SRPA* 0 0 40 32344 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:34.164486 2.953604 tcp 10.0.2.105 50525 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:18:43.051828 0.000000 tcp 10.0.2.105 50525 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:18:49.001278 0.057465 tcp 10.0.2.105 50526 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:49.059027 0.058791 tcp 10.0.2.105 50527 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:49.118187 0.152121 tcp 10.0.2.105 50528 -> 195.113.214.249 443 SRPA* 0 0 32 17246 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:18:49.590508 2.963444 tcp 10.0.2.105 50529 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:18:58.460151 0.000000 tcp 10.0.2.105 50529 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:04.357031 0.058232 tcp 10.0.2.105 50530 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:19:04.415521 0.057653 tcp 10.0.2.105 50531 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:19:04.473489 0.274602 tcp 10.0.2.105 50532 -> 195.113.214.249 443 SRPA* 0 0 58 43378 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:19:04.771039 2.953238 tcp 10.0.2.105 50533 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:13.670357 0.000000 tcp 10.0.2.105 50533 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:20.020475 2.944481 tcp 10.0.2.105 50534 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:28.908789 0.000000 tcp 10.0.2.105 50534 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:33.680351 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:19:35.083669 2.956814 tcp 10.0.2.105 50535 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:19:43.945139 0.000000 tcp 10.0.2.105 50535 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:24:19.854058 3.037021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:24:26.829967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:24:34.844078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:24:45.987888 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:24:45.987989 2.968117 tcp 10.0.2.105 50536 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:24:50.610839 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:24:54.867669 0.000000 tcp 10.0.2.105 50536 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:00.775645 0.058034 tcp 10.0.2.105 50537 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:00.833947 0.058473 tcp 10.0.2.105 50538 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:00.892687 0.152374 tcp 10.0.2.105 50539 -> 195.113.214.249 443 SRPA* 0 0 33 17300 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:01.477108 2.957739 tcp 10.0.2.105 50540 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:10.440613 0.000000 tcp 10.0.2.105 50540 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:16.342740 0.058574 tcp 10.0.2.105 50541 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:16.401661 0.059438 tcp 10.0.2.105 50542 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:16.461372 0.249771 tcp 10.0.2.105 50543 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:17.302619 2.947971 tcp 10.0.2.105 50544 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:22.232079 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:25:26.164405 0.000000 tcp 10.0.2.105 50544 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:32.166088 0.057509 tcp 10.0.2.105 50545 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:32.223878 0.058153 tcp 10.0.2.105 50546 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:32.282311 0.150440 tcp 10.0.2.105 50547 -> 195.113.214.249 443 SRPA* 0 0 48 39316 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:25:32.667424 2.949115 tcp 10.0.2.105 50548 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:42.070385 0.000000 tcp 10.0.2.105 50548 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:47.986537 2.961871 tcp 10.0.2.105 50549 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:25:56.854443 0.000000 tcp 10.0.2.105 50549 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:26:01.665091 0.000037 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:26:02.756361 2.964127 tcp 10.0.2.105 50550 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:26:13.191145 0.000000 tcp 10.0.2.105 50550 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:16.223205 0.119629 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:31:16.343017 2.937029 tcp 10.0.2.105 50551 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:24.703875 2.947379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:31:25.196052 0.000000 tcp 10.0.2.105 50551 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:31.113130 0.344126 tcp 10.0.2.105 50552 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:31.457589 0.058784 tcp 10.0.2.105 50553 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:31.516666 0.151461 tcp 10.0.2.105 50554 -> 195.113.214.249 443 SRPA* 0 0 44 27874 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:31.622200 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:31:31.889614 2.939736 tcp 10.0.2.105 50555 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:39.494973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:31:40.737148 0.000000 tcp 10.0.2.105 50555 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:46.707884 0.072894 tcp 10.0.2.105 50556 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:46.781062 0.058263 tcp 10.0.2.105 50557 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:46.839605 0.149764 tcp 10.0.2.105 50558 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:31:47.111669 2.955262 tcp 10.0.2.105 50559 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:31:55.318588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:31:55.982020 0.000000 tcp 10.0.2.105 50559 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:01.882382 0.057750 tcp 10.0.2.105 50560 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:32:01.940487 0.058326 tcp 10.0.2.105 50561 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:32:01.999089 0.154081 tcp 10.0.2.105 50562 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:32:02.810202 2.958260 tcp 10.0.2.105 50563 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:11.669318 0.000000 tcp 10.0.2.105 50563 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:18.326123 2.950381 tcp 10.0.2.105 50564 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:25.975073 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:32:27.198844 0.000000 tcp 10.0.2.105 50564 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:27.590008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:32:33.114635 2.952208 tcp 10.0.2.105 50565 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:32:42.001489 0.000000 tcp 10.0.2.105 50565 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:38:30.622644 3.412013 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 15:38:38.000527 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:38:45.927551 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:39:01.777100 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:39:33.650989 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:41:12.613548 0.127468 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:41:12.741230 0.371016 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2195 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:13.076951 0.220845 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2481 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:13.838794 0.538265 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2275 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:14.316182 0.114275 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:15.058993 0.215375 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2508 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:16.239186 0.207922 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2216 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:16.881668 0.303444 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2285 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:17.391341 3.011132 tcp 10.0.2.105 50566 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:41:17.391687 0.087527 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2331 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:18.812674 0.180601 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2005 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:19.617750 0.102037 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2385 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:20.274031 0.225407 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:20.695418 0.125729 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2187 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:21.052077 0.061218 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2253 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:21.881070 0.199305 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2297 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:22.593777 0.148691 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:23.894343 0.063430 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2159 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:25.153453 0.194984 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2330 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:25.999718 0.161535 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:26.382460 0.000000 tcp 10.0.2.105 50566 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:41:28.435317 0.201251 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2184 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:29.090255 0.181507 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2395 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:30.441127 0.185044 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2358 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:32.491827 0.106816 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2082 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:32.582927 0.224745 udp 10.0.2.105 7010 <-> 108.89.200.228 3096 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:32.662559 0.058706 tcp 10.0.2.105 50567 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:41:32.721563 0.057006 tcp 10.0.2.105 50568 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:41:32.778819 0.496605 tcp 10.0.2.105 50569 -> 195.113.214.249 443 SRPA* 0 0 54 36856 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:41:33.924467 2.974878 tcp 10.0.2.105 50570 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:41:33.924871 0.352994 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:34.572702 0.447437 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2407 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:36.343411 0.227012 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2094 flow=From-Botnet-V2-UDP-Established 1970/02/25 15:41:43.259975 0.000000 tcp 10.0.2.105 50570 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:45:37.658571 3.194293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:45:44.823229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:46:04.626557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:46:20.403944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:46:51.970618 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:46:59.405688 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:46:59.405875 2.947965 tcp 10.0.2.105 50571 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:08.269215 0.000000 tcp 10.0.2.105 50571 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:14.196887 0.105143 tcp 10.0.2.105 50572 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:14.302280 0.058073 tcp 10.0.2.105 50573 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:14.360653 0.149175 tcp 10.0.2.105 50574 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:14.877386 2.957504 tcp 10.0.2.105 50575 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:23.826027 0.000000 tcp 10.0.2.105 50575 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:29.754703 0.057763 tcp 10.0.2.105 50576 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:29.812884 0.056816 tcp 10.0.2.105 50577 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:29.869925 0.153106 tcp 10.0.2.105 50578 -> 195.113.214.249 443 SRPA* 0 0 35 18232 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:30.235110 2.958216 tcp 10.0.2.105 50579 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:39.104893 0.000000 tcp 10.0.2.105 50579 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:45.073345 0.057751 tcp 10.0.2.105 50580 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:45.131362 0.057349 tcp 10.0.2.105 50581 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:45.189010 0.146913 tcp 10.0.2.105 50582 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:47:45.783852 2.965846 tcp 10.0.2.105 50583 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:47:54.732274 0.000000 tcp 10.0.2.105 50583 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:48:00.623101 2.950538 tcp 10.0.2.105 50584 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:48:08.496452 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:48:09.493240 0.000000 tcp 10.0.2.105 50584 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:48:15.421172 3.183287 tcp 10.0.2.105 50585 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:48:24.524425 0.000000 tcp 10.0.2.105 50585 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:53:27.019131 0.233110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:53:27.252455 2.964915 tcp 10.0.2.105 50586 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:53:36.132303 0.000000 tcp 10.0.2.105 50586 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:53:42.066591 0.058064 tcp 10.0.2.105 50587 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:42.124895 0.113757 tcp 10.0.2.105 50588 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:42.238996 0.153823 tcp 10.0.2.105 50589 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:42.681589 2.969237 tcp 10.0.2.105 50590 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:53:51.830395 0.000000 tcp 10.0.2.105 50590 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:53:57.737512 0.058178 tcp 10.0.2.105 50591 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:57.795995 0.057774 tcp 10.0.2.105 50592 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:57.854162 0.149530 tcp 10.0.2.105 50593 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:53:58.077249 2.949720 tcp 10.0.2.105 50594 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:07.065178 0.000000 tcp 10.0.2.105 50594 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:16.686891 0.057639 tcp 10.0.2.105 50595 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:54:16.744835 0.058698 tcp 10.0.2.105 50596 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:54:16.803915 0.149842 tcp 10.0.2.105 50597 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 15:54:17.129551 2.987503 tcp 10.0.2.105 50598 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:26.120734 0.000000 tcp 10.0.2.105 50598 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:32.039680 4.206548 tcp 10.0.2.105 50599 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:42.164093 0.000000 tcp 10.0.2.105 50599 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:46.838338 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:54:48.093833 2.959198 tcp 10.0.2.105 50600 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:54:57.120617 0.000000 tcp 10.0.2.105 50600 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 15:59:02.110861 3.004605 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 15:59:09.141244 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:59:17.028847 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:59:32.814600 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 15:59:58.966234 0.189119 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 15:59:59.155577 2.960378 tcp 10.0.2.105 50601 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:04.548874 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:00:08.027716 0.000000 tcp 10.0.2.105 50601 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:13.957843 0.058736 tcp 10.0.2.105 50602 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:14.016843 0.057792 tcp 10.0.2.105 50603 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:14.075077 0.151145 tcp 10.0.2.105 50604 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:14.579077 2.957784 tcp 10.0.2.105 50605 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:23.562091 0.000000 tcp 10.0.2.105 50605 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:29.469168 0.058837 tcp 10.0.2.105 50606 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:29.528271 0.057049 tcp 10.0.2.105 50607 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:29.585621 0.150093 tcp 10.0.2.105 50608 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:29.955439 2.958427 tcp 10.0.2.105 50609 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:38.830665 0.000000 tcp 10.0.2.105 50609 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:44.751043 1.389028 tcp 10.0.2.105 50610 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:46.140450 0.058063 tcp 10.0.2.105 50611 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:46.198871 0.149134 tcp 10.0.2.105 50612 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:00:46.506695 2.958350 tcp 10.0.2.105 50613 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:00:55.379924 0.000000 tcp 10.0.2.105 50613 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:01:01.295097 2.970059 tcp 10.0.2.105 50614 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:01:10.182790 0.000000 tcp 10.0.2.105 50614 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:01:14.831473 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:01:16.100077 2.965569 tcp 10.0.2.105 50615 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:01:24.982244 0.000000 tcp 10.0.2.105 50615 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:06:05.001800 2.973262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:06:12.155031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:06:20.169485 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:06:27.073293 1.339487 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:06:28.412920 2.939601 tcp 10.0.2.105 50616 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:06:37.281159 0.000000 tcp 10.0.2.105 50616 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:06:37.281324 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:06:43.267308 0.068568 tcp 10.0.2.105 50617 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:43.336352 0.058683 tcp 10.0.2.105 50618 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:43.395361 0.150810 tcp 10.0.2.105 50619 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:43.604062 2.947555 tcp 10.0.2.105 50620 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:06:52.475790 0.000000 tcp 10.0.2.105 50620 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:06:58.394615 0.057704 tcp 10.0.2.105 50621 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:58.452557 0.057355 tcp 10.0.2.105 50622 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:58.510200 0.147798 tcp 10.0.2.105 50623 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:06:59.235034 2.960687 tcp 10.0.2.105 50624 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:08.109182 0.000000 tcp 10.0.2.105 50624 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:08.934016 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:07:14.034226 0.057712 tcp 10.0.2.105 50625 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:07:14.092396 0.058065 tcp 10.0.2.105 50626 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:07:14.150716 0.151988 tcp 10.0.2.105 50627 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:07:14.942343 2.968907 tcp 10.0.2.105 50628 -> 94.137.168.16 9773 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:23.838616 0.000000 tcp 10.0.2.105 50628 -> 94.137.168.16 9773 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:29.743927 2.950414 tcp 10.0.2.105 50629 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:38.618443 0.000000 tcp 10.0.2.105 50629 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:43.156786 0.937806 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:07:45.458736 2.948466 tcp 10.0.2.105 50630 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:07:54.324167 0.000000 tcp 10.0.2.105 50630 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:12:09.452846 0.281650 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:12:09.734611 0.432660 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2183 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:10.138406 0.356502 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:10.840758 0.733244 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2340 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:11.518364 0.111163 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:11.821645 0.214632 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2414 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:12.033128 0.225964 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2167 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:12.255790 0.349147 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2410 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:12.635114 0.082146 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2369 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:12.699892 0.180983 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:13.202663 0.092619 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2197 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:13.308309 0.232162 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2446 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:13.532701 0.124965 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2283 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:14.338045 0.078858 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2254 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:14.397549 0.200482 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:14.722025 0.147868 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2194 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:14.860715 0.064308 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2574 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:14.923478 0.192676 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:15.124108 0.182233 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:15.297702 0.189296 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:15.458287 0.180950 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2066 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:15.642243 0.188290 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2271 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:16.031852 0.109923 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2485 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:16.124647 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 16:12:31.092745 0.105746 tcp 10.0.2.105 50631 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:12:31.198785 0.060098 tcp 10.0.2.105 50632 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:12:31.259208 0.148591 tcp 10.0.2.105 50633 -> 195.113.214.249 443 SRPA* 0 0 33 24783 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:12:31.408688 0.353467 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2164 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:31.758741 0.460856 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:32.195745 0.217464 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2029 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:12:56.863403 3.019453 tcp 10.0.2.105 50634 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:01.464316 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:13:05.793048 0.000000 tcp 10.0.2.105 50634 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:09.650831 2.950019 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:13:11.717818 0.063708 tcp 10.0.2.105 50635 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:11.781798 0.062773 tcp 10.0.2.105 50636 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:11.844845 0.155891 tcp 10.0.2.105 50637 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:12.147004 2.958643 tcp 10.0.2.105 50638 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:16.557688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:13:21.018002 0.000000 tcp 10.0.2.105 50638 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:24.442821 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:13:26.927420 0.056748 tcp 10.0.2.105 50639 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:26.984442 0.061036 tcp 10.0.2.105 50640 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:27.045763 0.155884 tcp 10.0.2.105 50641 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:13:27.289107 2.968040 tcp 10.0.2.105 50642 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:36.170393 0.000000 tcp 10.0.2.105 50642 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:40.222574 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:13:42.082845 2.950192 tcp 10.0.2.105 50643 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:50.978021 0.000000 tcp 10.0.2.105 50643 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:13:55.710974 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:14:11.812708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:18:55.677505 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:18:55.677600 3.003999 tcp 10.0.2.105 50644 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:04.686879 0.000000 tcp 10.0.2.105 50644 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:10.679564 0.057854 tcp 10.0.2.105 50645 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:10.737724 0.063228 tcp 10.0.2.105 50646 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:10.801270 0.154438 tcp 10.0.2.105 50647 -> 195.113.214.249 443 SRPA* 0 0 49 30398 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:11.101962 3.001766 tcp 10.0.2.105 50648 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:20.102583 0.000000 tcp 10.0.2.105 50648 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:26.101388 0.179910 tcp 10.0.2.105 50649 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:26.281590 0.059706 tcp 10.0.2.105 50650 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:26.341613 0.158267 tcp 10.0.2.105 50651 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:19:26.532870 3.002717 tcp 10.0.2.105 50652 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:35.538486 0.000000 tcp 10.0.2.105 50652 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:41.533008 3.004356 tcp 10.0.2.105 50653 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:50.545712 0.000000 tcp 10.0.2.105 50653 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:19:55.472938 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:20:14.803796 3.001469 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:20:21.810298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:20:29.814912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:20:45.825549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:21:19.890898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:24:56.536538 0.167658 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:24:56.704675 2.945646 tcp 10.0.2.105 50654 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:05.815116 0.000000 tcp 10.0.2.105 50654 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:11.906163 0.124734 tcp 10.0.2.105 50655 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:12.031103 0.222475 tcp 10.0.2.105 50656 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:12.253842 0.172100 tcp 10.0.2.105 50657 -> 195.113.214.249 443 SRPA* 0 0 42 33666 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:12.453520 2.969986 tcp 10.0.2.105 50658 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:21.362622 0.000000 tcp 10.0.2.105 50658 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:27.305757 0.067874 tcp 10.0.2.105 50659 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:27.373914 0.068704 tcp 10.0.2.105 50660 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:27.442805 0.170816 tcp 10.0.2.105 50661 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:25:27.815482 2.983562 tcp 10.0.2.105 50662 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:36.739174 0.000000 tcp 10.0.2.105 50662 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:42.669897 2.976976 tcp 10.0.2.105 50663 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:51.602046 0.000000 tcp 10.0.2.105 50663 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:25:56.471975 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:27:21.848204 3.059682 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:27:28.887193 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:27:36.866595 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:27:52.869348 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:28:24.875539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:30:57.574935 0.034917 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:30:57.609976 2.969745 tcp 10.0.2.105 50664 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:06.605413 0.000000 tcp 10.0.2.105 50664 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:12.588197 0.071615 tcp 10.0.2.105 50665 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:12.660087 0.068845 tcp 10.0.2.105 50666 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:12.729304 0.171078 tcp 10.0.2.105 50667 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:13.008572 2.993033 tcp 10.0.2.105 50668 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:21.999878 0.000000 tcp 10.0.2.105 50668 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:28.009298 0.066610 tcp 10.0.2.105 50669 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:28.076161 0.069763 tcp 10.0.2.105 50670 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:28.146237 0.171613 tcp 10.0.2.105 50671 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:31:28.428218 3.005147 tcp 10.0.2.105 50672 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:37.433121 0.000000 tcp 10.0.2.105 50672 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:43.421149 3.003981 tcp 10.0.2.105 50673 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:52.423622 0.000000 tcp 10.0.2.105 50673 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:31:56.970297 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:34:28.881115 3.002110 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:34:35.888956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:34:43.900518 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:34:59.903428 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:35:31.909501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:41:35.915549 3.088591 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 16:41:42.973330 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:41:50.934399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:42:06.937349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:42:38.953335 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:42:49.104916 0.024247 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:42:49.129458 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 16:43:07.543696 0.271620 tcp 10.0.2.105 50674 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:07.815560 0.089497 tcp 10.0.2.105 50675 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:07.905324 0.142071 tcp 10.0.2.105 50676 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:08.145754 0.363030 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2509 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:08.478895 0.234644 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:09.994174 0.110760 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2335 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:10.068143 0.610106 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:10.620149 0.217579 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2277 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:10.835442 0.084770 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2495 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:10.903714 0.348893 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2222 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:11.247524 0.226085 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2371 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:12.141650 0.230542 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2240 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:12.365175 0.174810 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2234 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:12.730972 0.087179 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2398 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:12.780367 0.206433 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2391 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:12.974937 0.154412 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2365 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:13.143007 0.061985 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2239 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:13.185988 0.135304 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2300 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:13.844201 0.188175 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2294 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:14.004872 0.178437 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2171 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:14.235238 2.959241 tcp 10.0.2.105 50677 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:43:14.236694 0.063266 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2242 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:14.298128 0.230065 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2235 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:14.631776 0.824822 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2170 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:15.443307 0.106110 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:15.742860 0.187349 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2248 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:15.907725 0.353337 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2405 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:16.257003 0.535443 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2348 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:16.754974 0.222908 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2377 flow=From-Botnet-V2-UDP-Established 1970/02/25 16:43:23.129208 0.000000 tcp 10.0.2.105 50677 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:43:29.045962 0.059846 tcp 10.0.2.105 50678 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:29.106091 0.061188 tcp 10.0.2.105 50679 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:29.167553 0.138634 tcp 10.0.2.105 50680 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:29.882013 2.956385 tcp 10.0.2.105 50681 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:43:38.763520 0.000000 tcp 10.0.2.105 50681 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:43:44.691226 0.060782 tcp 10.0.2.105 50682 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:44.752451 0.061070 tcp 10.0.2.105 50683 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:44.813845 0.159255 tcp 10.0.2.105 50684 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:43:45.335367 2.964974 tcp 10.0.2.105 50685 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:43:54.220567 0.000000 tcp 10.0.2.105 50685 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:44:00.147827 2.966682 tcp 10.0.2.105 50686 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:44:09.055057 0.000000 tcp 10.0.2.105 50686 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:44:13.969814 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:48:42.969183 3.031568 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:48:49.999401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:48:57.997900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:49:14.001334 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:49:15.053298 0.000109 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:49:15.053496 3.003647 tcp 10.0.2.105 50687 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:49:25.174887 0.000000 tcp 10.0.2.105 50687 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:49:31.088732 0.060411 tcp 10.0.2.105 50688 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:31.149391 0.053013 tcp 10.0.2.105 50689 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:31.202738 0.284560 tcp 10.0.2.105 50690 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:31.939073 2.961651 tcp 10.0.2.105 50691 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:49:40.824337 0.000000 tcp 10.0.2.105 50691 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:49:46.747811 0.059555 tcp 10.0.2.105 50692 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:46.807618 0.061111 tcp 10.0.2.105 50693 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:46.836581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:49:46.868981 0.155919 tcp 10.0.2.105 50694 -> 195.113.214.249 443 SRPA* 0 0 40 22434 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:49:47.054573 2.959364 tcp 10.0.2.105 50695 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:49:55.938335 0.000000 tcp 10.0.2.105 50695 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:50:01.865606 2.969807 tcp 10.0.2.105 50696 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:50:10.760404 0.000000 tcp 10.0.2.105 50696 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:50:15.458347 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:55:16.223100 0.033355 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:55:16.256584 2.984051 tcp 10.0.2.105 50697 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:25.225182 0.000000 tcp 10.0.2.105 50697 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:32.546354 0.082201 tcp 10.0.2.105 50698 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:32.628866 0.053243 tcp 10.0.2.105 50699 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:32.682412 0.141322 tcp 10.0.2.105 50700 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:33.126688 2.960503 tcp 10.0.2.105 50701 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:42.015951 0.000000 tcp 10.0.2.105 50701 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:47.942179 0.051365 tcp 10.0.2.105 50702 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:47.993827 0.054330 tcp 10.0.2.105 50703 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:48.048540 0.142737 tcp 10.0.2.105 50704 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 16:55:48.248606 2.952324 tcp 10.0.2.105 50705 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:51.114363 2.970899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 16:55:57.129587 0.000000 tcp 10.0.2.105 50705 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:55:58.036897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:56:03.056597 2.965624 tcp 10.0.2.105 50706 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:56:05.942810 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:56:11.944942 0.000000 tcp 10.0.2.105 50706 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 16:56:16.765707 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 16:56:21.752258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 16:56:53.353851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:01:17.101490 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:01:17.101637 3.003705 tcp 10.0.2.105 50707 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:01:26.103796 0.000000 tcp 10.0.2.105 50707 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:01:32.107299 0.053941 tcp 10.0.2.105 50708 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:32.161564 0.052190 tcp 10.0.2.105 50709 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:32.214057 0.101055 tcp 10.0.2.105 50710 -> 195.113.214.249 443 SRPA* 0 0 54 50777 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:32.326142 3.002452 tcp 10.0.2.105 50711 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:01:41.338367 0.000000 tcp 10.0.2.105 50711 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:01:47.325117 0.211568 tcp 10.0.2.105 50712 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:47.537008 0.051640 tcp 10.0.2.105 50713 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:47.588948 0.117682 tcp 10.0.2.105 50714 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:01:48.368348 2.967738 tcp 10.0.2.105 50715 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:01:57.285616 0.000000 tcp 10.0.2.105 50715 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:02:03.234667 2.986894 tcp 10.0.2.105 50716 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:02:10.978106 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:02:12.220522 0.000000 tcp 10.0.2.105 50716 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:02:57.037550 3.001813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 17:03:04.045399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:03:12.046522 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:03:28.049857 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:04:00.055448 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:10:12.072968 3.001581 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 17:10:19.080592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:10:27.081904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:10:43.084860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:11:15.091221 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:13:37.776292 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:13:37.776445 0.355574 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2312 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.105782 0.229942 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2139 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.328976 0.110174 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2080 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.403174 0.286347 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2406 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.631444 0.224312 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2434 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.853181 0.083902 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2230 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:38.921716 0.375661 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2318 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:39.293454 0.189984 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:39.477991 0.094658 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2296 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:39.535489 0.225270 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2486 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:39.757705 0.224278 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2384 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:39.974608 0.194784 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.250325 0.154237 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2261 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.394365 0.069363 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2337 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.445664 0.140451 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2265 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.587283 0.057206 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2185 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.643112 0.267716 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 1987 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:40.938497 0.187198 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2191 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:41.096994 0.182511 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2249 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:41.276358 0.162667 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2290 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:41.430672 0.098002 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2232 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:41.598158 0.188433 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2449 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:41.799508 0.354395 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2452 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:42.149922 0.456015 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2190 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:42.585269 0.228678 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2212 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:13:48.261623 3.003859 tcp 10.0.2.105 50717 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:13:57.264028 0.000000 tcp 10.0.2.105 50717 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:01.970907 0.000093 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:14:03.265525 0.032479 tcp 10.0.2.105 50718 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:03.298207 0.032559 tcp 10.0.2.105 50719 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:03.331128 0.121352 tcp 10.0.2.105 50720 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:03.463344 3.003791 tcp 10.0.2.105 50721 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:12.475638 0.000000 tcp 10.0.2.105 50721 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:18.464987 0.031472 tcp 10.0.2.105 50722 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:18.496696 0.031642 tcp 10.0.2.105 50723 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:18.528600 0.120456 tcp 10.0.2.105 50724 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:14:18.686879 3.002422 tcp 10.0.2.105 50725 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:27.697552 0.000000 tcp 10.0.2.105 50725 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:33.686754 2.995509 tcp 10.0.2.105 50726 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:42.679502 0.000000 tcp 10.0.2.105 50726 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:14:47.475994 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:17:29.101257 3.001521 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 17:17:36.109151 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:17:44.110163 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:18:00.113260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:18:32.119258 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:19:48.689729 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:19:48.689877 3.003628 tcp 10.0.2.105 50727 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:19:57.692176 0.000000 tcp 10.0.2.105 50727 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:03.691957 0.031452 tcp 10.0.2.105 50728 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:03.723675 0.032084 tcp 10.0.2.105 50729 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:03.756024 0.121575 tcp 10.0.2.105 50730 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:03.887093 2.998505 tcp 10.0.2.105 50731 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:12.884469 0.000000 tcp 10.0.2.105 50731 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:18.883400 0.030648 tcp 10.0.2.105 50732 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:18.914395 0.031338 tcp 10.0.2.105 50733 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:18.946074 0.120990 tcp 10.0.2.105 50734 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:20:19.107562 3.010124 tcp 10.0.2.105 50735 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:28.126109 0.000000 tcp 10.0.2.105 50735 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:34.105002 2.993932 tcp 10.0.2.105 50736 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:43.107661 0.000000 tcp 10.0.2.105 50736 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:20:47.974777 0.000042 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:24:36.125534 3.001221 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 17:24:43.132697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:24:51.133979 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:25:07.136967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:25:39.143216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:25:49.107979 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:25:49.108072 3.004230 tcp 10.0.2.105 50737 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:25:58.111650 0.000000 tcp 10.0.2.105 50737 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:04.110710 0.039943 tcp 10.0.2.105 50738 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:04.150875 0.031814 tcp 10.0.2.105 50739 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:04.182998 0.120751 tcp 10.0.2.105 50740 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:04.313503 3.000024 tcp 10.0.2.105 50741 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:13.312720 0.000000 tcp 10.0.2.105 50741 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:19.311524 0.031231 tcp 10.0.2.105 50742 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:19.343045 0.032723 tcp 10.0.2.105 50743 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:19.376071 0.121364 tcp 10.0.2.105 50744 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:26:19.508823 2.996639 tcp 10.0.2.105 50745 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:28.504032 0.000000 tcp 10.0.2.105 50745 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:34.502892 3.004006 tcp 10.0.2.105 50746 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:43.505785 0.000000 tcp 10.0.2.105 50746 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:26:48.473210 0.000105 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:31:43.149363 3.001792 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 17:31:49.506137 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:31:49.506299 2.993463 tcp 10.0.2.105 50747 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:31:50.156588 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:31:58.158349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:31:58.498543 0.000000 tcp 10.0.2.105 50747 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:04.508803 0.031859 tcp 10.0.2.105 50748 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:04.540991 0.031397 tcp 10.0.2.105 50749 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:04.572659 0.120656 tcp 10.0.2.105 50750 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:04.760836 3.001523 tcp 10.0.2.105 50751 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:13.760661 0.000000 tcp 10.0.2.105 50751 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:14.161747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:32:19.759845 0.031080 tcp 10.0.2.105 50752 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:19.791191 0.032020 tcp 10.0.2.105 50753 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:19.823576 0.120820 tcp 10.0.2.105 50754 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:32:19.964740 2.998870 tcp 10.0.2.105 50755 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:28.962540 0.000000 tcp 10.0.2.105 50755 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:34.961522 3.003935 tcp 10.0.2.105 50756 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:43.963739 0.000000 tcp 10.0.2.105 50756 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:32:46.167318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:32:48.470678 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:38:50.172763 3.006302 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 17:38:57.180816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:39:05.182084 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:39:21.185220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:39:53.191359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:43:49.550617 0.022603 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:43:49.573368 0.412498 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2128 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:49.959340 0.223503 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:50.012822 2.994707 tcp 10.0.2.105 50757 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:43:50.173593 0.113752 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:50.246216 0.278514 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 6 2314 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:50.465900 0.215631 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2295 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:50.678236 0.079705 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2363 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:50.741893 0.347961 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2291 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:51.085959 0.219601 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2192 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:51.302351 0.232355 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2347 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:43:51.527711 0.000000 udp 10.0.2.105 7010 -> 99.116.154.145 1056 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 17:43:59.004557 0.000000 tcp 10.0.2.105 50757 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:44:05.004995 0.032520 tcp 10.0.2.105 50758 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:05.037763 0.031199 tcp 10.0.2.105 50759 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:05.069236 0.121715 tcp 10.0.2.105 50760 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:05.216051 3.003121 tcp 10.0.2.105 50761 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:44:08.959413 0.034189 tcp 10.0.2.105 50762 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:08.993897 0.032670 tcp 10.0.2.105 50763 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:09.027091 0.121682 tcp 10.0.2.105 50764 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:44:09.149362 0.181407 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2251 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.343047 0.089543 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2376 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.394330 0.147574 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2215 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.533022 0.066863 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2140 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.584271 0.126577 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2343 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.749145 0.063469 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2247 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:09.811068 0.355244 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2288 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:10.175161 0.189678 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2367 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:10.335324 0.175264 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2375 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:10.506875 0.190768 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2256 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:10.681251 0.354637 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2448 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:11.032024 0.162663 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2201 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:11.186573 0.111286 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:11.281317 0.501953 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2061 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:11.764806 0.215083 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 2276 flow=From-Botnet-V2-UDP-Established 1970/02/25 17:44:14.226542 0.000000 tcp 10.0.2.105 50761 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:45:57.198174 3.000722 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 17:46:04.204636 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:46:12.206058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:46:28.208961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:47:00.215003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:49:20.216648 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:49:20.216821 2.994038 tcp 10.0.2.105 50765 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:49:29.209274 0.000000 tcp 10.0.2.105 50765 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:49:35.219623 0.033899 tcp 10.0.2.105 50766 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:35.253785 0.031606 tcp 10.0.2.105 50767 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:35.285625 0.122866 tcp 10.0.2.105 50768 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:35.435476 2.997434 tcp 10.0.2.105 50769 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:49:44.431564 0.000000 tcp 10.0.2.105 50769 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:49:50.430120 0.031947 tcp 10.0.2.105 50770 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:50.462327 0.032681 tcp 10.0.2.105 50771 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:50.495268 0.127336 tcp 10.0.2.105 50772 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:49:50.654637 2.999460 tcp 10.0.2.105 50773 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:49:59.653009 0.000000 tcp 10.0.2.105 50773 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:50:05.651950 3.003972 tcp 10.0.2.105 50774 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:50:14.654568 0.000000 tcp 10.0.2.105 50774 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:50:19.471598 0.000061 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:55:20.655400 0.000098 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:55:20.655597 2.993600 tcp 10.0.2.105 50775 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:55:29.657619 0.000000 tcp 10.0.2.105 50775 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:55:35.657390 0.047594 tcp 10.0.2.105 50776 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:35.705240 0.032697 tcp 10.0.2.105 50777 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:35.738202 0.121942 tcp 10.0.2.105 50778 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:35.930348 3.000681 tcp 10.0.2.105 50779 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:55:44.929321 0.000000 tcp 10.0.2.105 50779 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:55:50.928789 0.031106 tcp 10.0.2.105 50780 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:50.960172 0.031289 tcp 10.0.2.105 50781 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:50.991732 0.123229 tcp 10.0.2.105 50782 -> 195.113.214.249 443 SRPA* 0 0 21 11390 flow=From-Botnet-V2-TCP-Established 1970/02/25 17:55:51.153181 3.000055 tcp 10.0.2.105 50783 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:56:00.151689 0.000000 tcp 10.0.2.105 50783 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:56:06.153215 3.001003 tcp 10.0.2.105 50784 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:56:15.152889 0.000000 tcp 10.0.2.105 50784 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 17:56:19.970001 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 17:59:04.228218 3.002310 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 17:59:11.235988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:59:19.237832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 17:59:35.240813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:00:07.246908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:01:21.153834 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:01:21.153934 3.003280 tcp 10.0.2.105 50785 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:01:30.155801 0.000000 tcp 10.0.2.105 50785 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:01:36.156059 0.031850 tcp 10.0.2.105 50786 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:36.188183 0.032320 tcp 10.0.2.105 50787 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:36.220755 0.122975 tcp 10.0.2.105 50788 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:36.354249 2.994929 tcp 10.0.2.105 50789 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:01:45.350961 0.000000 tcp 10.0.2.105 50789 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:01:51.346858 0.031052 tcp 10.0.2.105 50790 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:51.378204 0.031537 tcp 10.0.2.105 50791 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:51.409995 0.119157 tcp 10.0.2.105 50792 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:01:51.657376 3.003609 tcp 10.0.2.105 50793 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:02:00.659361 0.000000 tcp 10.0.2.105 50793 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:02:06.658415 3.004214 tcp 10.0.2.105 50794 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:02:15.660807 0.000000 tcp 10.0.2.105 50794 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:02:20.478140 0.000083 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:06:11.253213 3.000942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 18:06:18.260017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:06:26.261961 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:06:42.264797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:07:14.270710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:07:25.034223 0.000106 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:07:25.034421 2.966633 tcp 10.0.2.105 50795 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:07:33.911816 0.000000 tcp 10.0.2.105 50795 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:07:40.046414 0.031898 tcp 10.0.2.105 50796 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:40.078604 0.032318 tcp 10.0.2.105 50797 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:40.111233 0.122121 tcp 10.0.2.105 50798 -> 195.113.214.249 443 SRPA* 0 0 34 21912 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:40.718563 2.953482 tcp 10.0.2.105 50799 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:07:49.599417 0.000000 tcp 10.0.2.105 50799 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:07:55.514573 0.030959 tcp 10.0.2.105 50800 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:55.545792 0.033430 tcp 10.0.2.105 50801 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:55.579542 0.121850 tcp 10.0.2.105 50802 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:07:56.047580 2.955365 tcp 10.0.2.105 50803 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:08:04.925307 0.000000 tcp 10.0.2.105 50803 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:08:11.292527 2.960035 tcp 10.0.2.105 50804 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:08:20.362195 0.000000 tcp 10.0.2.105 50804 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:08:24.900341 0.000052 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:13:18.286459 3.001670 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 18:13:25.294010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:13:33.295389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:13:49.298567 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:14:18.611182 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:14:18.611369 0.000000 udp 10.0.2.105 7010 -> 99.116.154.145 1056 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:14:21.304475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:14:35.877428 0.044835 tcp 10.0.2.105 50805 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:35.922519 0.031381 tcp 10.0.2.105 50806 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:35.954226 0.119698 tcp 10.0.2.105 50807 -> 195.113.214.249 443 SRPA* 0 0 44 28330 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:36.074697 4.994033 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 14 5316 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:36.152423 0.385677 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 6 2456 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:36.509781 4.783317 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 9 3318 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:36.737652 4.777823 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 7 2492 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.007475 0.376616 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 6 2237 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.380196 0.212843 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.589661 0.077036 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 6 2359 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.651721 0.218777 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 6 2368 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.867882 0.233250 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 6 2429 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:37.894825 3.009642 tcp 10.0.2.105 50808 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:14:38.092482 0.187050 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 6 2389 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.274499 0.093393 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 6 2356 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.327714 0.148176 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 6 2269 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.466627 0.066521 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 6 2146 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.516018 0.137933 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 6 2202 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.655293 0.063616 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 6 2220 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:38.717096 0.372463 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 6 2341 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:39.110386 0.184787 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 6 2143 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:39.271096 0.352484 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 6 2178 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:39.619880 0.170293 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 6 2537 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:39.774770 0.107171 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 6 2483 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:39.865326 0.187242 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 6 2298 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:40.022963 0.180617 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 6 2199 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:40.200027 0.460038 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 6 2214 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:40.638097 0.215586 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 6 1988 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:41.515086 0.011472 udp 10.0.2.105 7010 <- 108.232.100.12 7437 RSP 0 0 5 2058 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:14:41.754669 0.353644 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 7 2639 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:42.054463 0.715860 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 8 2980 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:42.742373 0.777465 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 8 3321 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:43.515314 0.413719 udp 10.0.2.105 7010 <-> 99.98.252.106 9529 CON 0 0 8 2951 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:43.926186 0.119840 udp 10.0.2.105 7010 <-> 86.132.181.104 9131 CON 0 0 8 2952 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:44.031531 0.418480 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 8 2913 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:44.446863 0.450034 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 8 3233 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:44.888706 0.368962 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 8 3244 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:45.260609 0.142180 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 8 3157 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:45.363441 0.289167 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 8 3189 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:45.643460 0.119061 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 8 3222 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:45.742396 0.275059 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 8 3070 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:46.019070 0.144614 udp 10.0.2.105 7010 <-> 217.220.223.100 6072 CON 0 0 8 3255 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:46.162169 0.780971 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 8 2926 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:46.891345 0.000000 tcp 10.0.2.105 50808 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:14:46.954937 0.345588 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 8 3159 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:47.275831 0.319590 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 8 3171 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:47.587238 0.184439 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 8 3101 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:47.755592 0.351624 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 8 3013 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:48.078671 0.343566 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 8 3298 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:48.419238 0.702677 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 8 3114 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:49.118064 0.423983 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 8 2945 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:49.539173 0.995269 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 8 2922 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:14:50.514212 0.000000 udp 10.0.2.105 7010 -> 27.96.221.122 6677 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:14:52.890539 0.031064 tcp 10.0.2.105 50809 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:52.921915 0.031682 tcp 10.0.2.105 50810 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:52.953853 0.123377 tcp 10.0.2.105 50811 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:14:53.086547 2.997846 tcp 10.0.2.105 50812 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:14:59.249455 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:02.083198 0.000000 tcp 10.0.2.105 50812 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:15:04.817517 0.000000 udp 10.0.2.105 7010 -> 50.194.95.142 1806 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:08.082597 0.031486 tcp 10.0.2.105 50813 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:15:08.114358 0.031663 tcp 10.0.2.105 50814 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:15:08.146339 0.120462 tcp 10.0.2.105 50815 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:15:08.280861 3.005873 tcp 10.0.2.105 50816 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:15:11.296981 0.000000 udp 10.0.2.105 7010 -> 129.42.208.174 8474 INT 0 1 150 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:17.285161 0.000000 tcp 10.0.2.105 50816 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:15:18.036345 0.000000 udp 10.0.2.105 7010 -> 27.110.244.204 5908 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:23.133955 0.000000 udp 10.0.2.105 7010 -> 116.246.25.164 4927 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:23.273839 2.994181 tcp 10.0.2.105 50817 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:15:30.864938 0.187735 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 8 3234 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:15:31.490940 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:32.276565 0.000000 tcp 10.0.2.105 50817 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:15:35.470958 0.000077 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:15:38.025054 0.000000 udp 10.0.2.105 7010 -> 23.25.26.65 9820 INT 0 1 185 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:46.727238 0.000000 udp 10.0.2.105 7010 -> 91.187.115.39 7453 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:54.108461 0.000000 udp 10.0.2.105 7010 -> 24.240.171.82 8021 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:15:59.365542 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:03.971984 0.000101 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:16:05.574531 0.000000 udp 10.0.2.105 7010 -> 218.188.206.39 7384 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:11.523354 0.000000 udp 10.0.2.105 7010 -> 128.111.92.83 7922 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:18.282929 0.000000 udp 10.0.2.105 7010 -> 113.91.64.224 9147 INT 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:26.454515 0.077143 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 8 3039 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:16:26.555379 0.000000 udp 10.0.2.105 7010 -> 86.136.180.112 7670 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:30.971119 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:16:31.561991 1.032373 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 8 3166 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:16:32.851826 0.000000 udp 10.0.2.105 7010 -> 203.59.235.88 9173 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:39.693851 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:47.345832 0.000000 udp 10.0.2.105 7010 -> 79.77.221.140 6033 INT 0 1 295 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:53.603645 0.968614 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 8 2824 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:16:55.855427 0.000000 udp 10.0.2.105 7010 -> 24.146.199.108 5436 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:16:58.470389 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:17:04.089123 0.448329 udp 10.0.2.105 7010 <-> 75.54.17.81 3982 CON 0 0 8 3072 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:17:04.554380 0.662673 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 8 3019 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:17:05.227610 0.000000 udp 10.0.2.105 7010 -> 221.125.235.119 2316 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:13.512361 0.000000 udp 10.0.2.105 7010 -> 5.29.1.253 1375 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:18.589800 0.102461 udp 10.0.2.105 7010 -> 82.49.136.125 2254 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:18.692261 0.000000 icmp 82.49.136.125 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 198 flow=Background 1970/02/25 18:17:23.476606 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:17:24.097550 0.000000 udp 10.0.2.105 7010 -> 222.146.182.54 6572 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:30.146716 0.000000 udp 10.0.2.105 7010 -> 66.66.29.32 5224 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:35.353916 0.000000 udp 10.0.2.105 7010 -> 109.67.21.243 9003 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:40.741534 0.564179 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 7 2610 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:17:41.395856 0.000000 udp 10.0.2.105 7010 -> 203.198.139.147 2785 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:47.571202 0.000000 udp 10.0.2.105 7010 -> 203.117.128.224 6031 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:17:52.478465 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:17:55.753692 0.000000 udp 10.0.2.105 7010 -> 66.69.253.188 3984 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:04.707854 0.000000 udp 10.0.2.105 7010 -> 87.228.207.22 1247 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:11.205339 0.000000 udp 10.0.2.105 7010 -> 58.65.229.82 8064 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:19.867543 0.000000 udp 10.0.2.105 7010 -> 50.195.153.65 4906 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:24.473995 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:18:27.569084 0.893143 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 8 2893 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:28.459949 0.348933 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 8 3100 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:28.988858 0.000000 udp 10.0.2.105 7010 -> 122.173.245.102 2604 INT 0 1 226 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:34.819294 0.423949 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 8 3066 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:35.216714 0.000000 udp 10.0.2.105 7010 -> 190.39.63.221 5166 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:42.355006 0.000000 udp 10.0.2.105 7010 -> 64.85.143.89 6555 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:48.228863 0.042063 udp 10.0.2.105 7010 -> 83.238.125.190 9050 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:18:48.270926 0.000000 icmp 83.238.125.189 0x0303 -> 10.0.2.105 0x5a23 URP 192 1 124 flow=Background 1970/02/25 18:18:52.975227 0.000166 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:18:54.888345 0.317601 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 8 3062 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:55.232872 0.106266 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 8 3274 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:55.360526 0.336544 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 8 3208 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:18:55.693319 0.000000 udp 10.0.2.105 7010 -> 201.139.140.185 2349 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:03.610740 0.000000 udp 10.0.2.105 7010 -> 203.168.200.51 9798 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:09.158640 1.502213 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 8 2776 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:19:12.008211 1.162924 udp 10.0.2.105 7010 <-> 182.188.140.173 4537 CON 0 0 8 3181 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:19:13.117867 0.246442 udp 10.0.2.105 7010 -> 183.89.145.159 4493 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:13.364309 0.000000 icmp 183.89.145.159 0x0303 -> 10.0.2.105 0x8d11 URP 192 1 306 flow=Background 1970/02/25 18:19:17.752927 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:19:18.471283 0.000000 udp 10.0.2.105 7010 -> 2.177.165.55 3291 INT 0 1 239 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:24.527485 0.000000 udp 10.0.2.105 7010 -> 213.137.0.155 9710 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:29.595966 0.000000 udp 10.0.2.105 7010 -> 95.6.87.219 2670 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:37.516380 0.143340 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:37.659720 0.000000 icmp 24.212.7.34 0x0303 -> 10.0.2.105 0xd219 URP 192 1 209 flow=Background 1970/02/25 18:19:42.450416 0.000064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:19:43.509129 0.000000 udp 10.0.2.105 7010 -> 174.77.93.198 4282 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:50.842231 0.000000 udp 10.0.2.105 7010 -> 80.216.225.141 8508 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:19:59.250462 0.000000 udp 10.0.2.105 7010 -> 150.101.247.125 7518 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:04.698270 0.000000 udp 10.0.2.105 7010 -> 66.176.241.237 3260 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:09.602788 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:20:12.535615 0.303378 udp 10.0.2.105 7010 <-> 69.112.92.35 9786 CON 0 0 8 3232 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:20:12.984551 0.000000 udp 10.0.2.105 7010 -> 203.125.247.226 5590 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:20.320994 0.000000 udp 10.0.2.105 7010 -> 95.58.28.24 4536 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:25.315260 2.997108 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 18:20:25.359561 0.000000 udp 10.0.2.105 7010 -> 184.178.233.217 2875 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:31.256560 0.000000 udp 10.0.2.105 7010 -> 68.100.160.3 9999 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:32.317908 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:20:35.973517 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:20:38.277232 3.003970 tcp 10.0.2.105 50818 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:20:40.249567 0.000000 udp 10.0.2.105 7010 -> 61.201.36.70 2637 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:40.319745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:20:47.279283 0.000000 tcp 10.0.2.105 50818 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:20:48.801875 0.000000 udp 10.0.2.105 7010 -> 80.28.159.218 6380 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:53.280440 0.032254 tcp 10.0.2.105 50819 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:20:53.312949 0.031498 tcp 10.0.2.105 50820 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:20:53.344719 0.120821 tcp 10.0.2.105 50821 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:20:53.528126 3.004926 tcp 10.0.2.105 50822 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:20:54.890851 0.183462 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 8 2905 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:20:55.074991 0.000000 udp 10.0.2.105 7010 -> 121.96.239.36 3281 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:20:56.322967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:21:00.378550 0.477016 udp 10.0.2.105 7010 <-> 76.8.12.150 3839 CON 0 0 8 3142 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:21:00.866366 0.000000 udp 10.0.2.105 7010 -> 200.86.227.6 3109 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:02.531512 0.000000 tcp 10.0.2.105 50822 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:21:07.879498 0.000000 udp 10.0.2.105 7010 -> 92.109.136.209 1060 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:08.535985 0.031108 tcp 10.0.2.105 50823 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:21:08.567370 0.031227 tcp 10.0.2.105 50824 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:21:08.598844 0.143651 tcp 10.0.2.105 50825 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:21:08.751883 3.003034 tcp 10.0.2.105 50826 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:21:15.400406 0.000000 udp 10.0.2.105 7010 -> 58.61.214.216 4718 INT 0 1 312 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:17.753360 0.000000 tcp 10.0.2.105 50826 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:21:23.151310 0.499517 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 8 3016 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:21:23.739297 0.000000 udp 10.0.2.105 7010 -> 125.255.18.94 7727 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:23.751837 3.004667 tcp 10.0.2.105 50827 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:21:28.328552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:21:32.354739 0.000000 udp 10.0.2.105 7010 -> 114.79.29.194 3686 INT 0 1 177 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:32.754710 0.000000 tcp 10.0.2.105 50827 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:21:36.970949 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:21:38.313637 0.000000 udp 10.0.2.105 7010 -> 190.6.226.68 2794 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:45.353620 0.407791 udp 10.0.2.105 7010 <-> 23.115.109.72 7330 CON 0 0 8 2980 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:21:45.776301 0.000000 udp 10.0.2.105 7010 -> 72.239.204.48 4912 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:21:54.205833 0.000000 udp 10.0.2.105 7010 -> 115.241.187.239 7040 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:00.164622 0.000000 udp 10.0.2.105 7010 -> 117.198.160.96 4402 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:04.971186 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:22:07.445029 0.000000 udp 10.0.2.105 7010 -> 183.63.204.252 4335 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:14.324831 0.000000 udp 10.0.2.105 7010 -> 65.25.165.98 3350 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:20.135838 0.445661 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 5 1583 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:22:20.612060 0.189576 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 705 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:22:20.818022 0.167880 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:22:21.008369 0.000000 udp 10.0.2.105 7010 -> 98.221.12.77 9288 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:27.693636 0.190373 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 673 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:22:27.918533 0.000000 udp 10.0.2.105 7010 -> 190.119.20.47 7389 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:32.470544 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:22:33.392910 0.000000 udp 10.0.2.105 7010 -> 75.84.229.36 3652 INT 0 1 280 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:39.771671 0.000000 udp 10.0.2.105 7010 -> 69.11.88.87 1203 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:45.950384 0.000000 udp 10.0.2.105 7010 -> 108.243.224.239 6650 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:54.472907 0.000000 udp 10.0.2.105 7010 -> 72.251.13.130 2321 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:22:59.469595 0.000080 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:23:00.010536 0.000000 udp 10.0.2.105 7010 -> 79.27.75.27 2142 INT 0 1 298 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:00.127553 0.000000 udp 10.0.2.105 7010 <- 72.251.13.130 2321 RSP 0 0 1 539 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:08.112332 0.326432 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:23:08.544854 0.000000 udp 10.0.2.105 7010 -> 79.6.92.37 1675 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:16.393856 0.318814 udp 10.0.2.105 7010 <-> 221.149.100.2 5856 CON 0 0 2 755 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:23:16.763296 0.000000 udp 10.0.2.105 7010 -> 190.239.160.200 6830 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:22.643824 0.310474 udp 10.0.2.105 7010 <-> 59.12.27.231 5908 CON 0 0 2 698 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:23:24.298669 2.218630 udp 10.0.2.105 7010 -> 109.53.85.93 6192 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:26.517299 0.000000 icmp 109.53.85.93 0x0303 -> 10.0.2.105 0x3018 URP 192 1 327 flow=Background 1970/02/25 18:23:27.469636 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:23:31.005136 0.000000 udp 10.0.2.105 7010 -> 108.160.254.230 5230 INT 0 1 119 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:36.192837 0.000000 udp 10.0.2.105 7010 -> 202.29.237.249 2475 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:44.093947 0.000000 udp 10.0.2.105 7010 -> 107.5.197.209 8867 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:49.251461 0.588235 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 797 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:23:50.497161 0.000000 udp 10.0.2.105 7010 -> 94.14.205.57 3149 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:23:53.977857 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:23:56.502059 0.000000 udp 10.0.2.105 7010 -> 86.5.175.14 1691 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:05.174735 0.000000 udp 10.0.2.105 7010 -> 62.2.88.10 8270 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:13.922816 0.000000 udp 10.0.2.105 7010 -> 119.74.199.35 4508 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:19.171897 0.334907 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:24:19.597494 0.223747 udp 10.0.2.105 7010 <-> 186.90.54.31 9719 CON 0 0 2 774 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:24:19.831746 0.000000 udp 10.0.2.105 7010 -> 175.139.221.188 1383 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:24.025861 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:24:26.479138 0.146773 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 856 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:24:26.642786 0.000000 udp 10.0.2.105 7010 -> 220.150.113.11 2127 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:32.154668 0.000000 udp 10.0.2.105 7010 -> 216.104.120.53 1470 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:38.766329 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:45.074549 0.000000 udp 10.0.2.105 7010 -> 64.108.146.254 5069 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:49.734234 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:24:52.136762 0.000000 udp 10.0.2.105 7010 -> 218.5.149.170 7972 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:24:59.795628 0.353918 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 782 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:25:00.159825 0.222370 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:25:00.390941 0.000000 udp 10.0.2.105 7010 -> 61.145.214.90 9184 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:25:05.801381 0.161051 udp 10.0.2.105 7010 <-> 111.92.152.120 2514 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:25:07.158612 0.000000 udp 10.0.2.105 7010 -> 108.89.200.228 3096 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:25:14.461526 0.000000 udp 10.0.2.105 7010 -> 210.124.233.2 8650 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:25:19.346373 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:25:21.007095 0.000000 udp 10.0.2.105 7010 -> 151.27.134.23 3035 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:25:29.234911 0.000000 udp 10.0.2.105 7010 -> 107.19.146.6 5200 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:26:38.755336 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:26:38.755470 2.993663 tcp 10.0.2.105 50828 -> 31.192.24.67 3527 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:26:47.747978 0.000000 tcp 10.0.2.105 50828 -> 31.192.24.67 3527 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:26:55.366293 0.032695 tcp 10.0.2.105 50829 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:26:55.399240 0.031466 tcp 10.0.2.105 50830 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:26:55.430973 0.120094 tcp 10.0.2.105 50831 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:26:56.570883 2.957044 tcp 10.0.2.105 50832 -> 46.48.223.67 15494 S_ 0 2 124 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:27:07.369234 0.000000 tcp 10.0.2.105 50832 -> 46.48.223.67 15494 S_ 0 1 62 flow=From-Botnet-V2-TCP-Attempt 1970/02/25 18:27:13.429936 0.031431 tcp 10.0.2.105 50833 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:27:13.461705 0.032799 tcp 10.0.2.105 50834 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:27:13.494866 0.125304 tcp 10.0.2.105 50835 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:27:15.608999 2.608432 tcp 10.0.2.105 50836 -> 211.38.175.27 4598 FSPA* 0 0 14 1559 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:27:35.517555 2.965857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 18:27:42.425457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:27:50.315208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:28:06.092599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:28:37.649128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:34:39.358804 3.001351 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 18:34:46.365820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:34:54.367768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:35:10.370794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:35:42.376508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:41:46.382804 3.001635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 18:41:53.390543 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:42:01.394753 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:42:17.404715 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:42:49.410745 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:48:53.417503 3.011681 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 18:49:00.434002 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:49:08.435784 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:49:24.438943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:49:56.445032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:55:45.877178 0.029471 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 18:55:45.906779 0.223649 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.130836 0.212327 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.343615 0.179870 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.523902 0.048700 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.573063 0.124605 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.698159 0.144081 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.842669 0.047802 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:46.890901 0.284896 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:47.176378 0.161152 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:47.337913 0.078597 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:47.416968 0.157244 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:47.574587 0.152822 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:47.727828 0.350499 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.078732 0.171012 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.250130 0.209391 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.459904 0.423834 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.884346 0.073083 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.957804 0.029650 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:48.987873 0.382471 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:49.370800 0.082253 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:49.453450 0.229337 udp 10.0.2.105 7010 <-> 75.54.17.81 3982 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:49.683276 0.339306 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:50.023031 0.209268 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:50.232737 0.404502 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:50.637643 0.041383 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:50.679452 0.174169 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:50.854024 0.158413 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:51.012832 0.155902 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:51.169140 0.056243 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:55:51.225766 0.000000 udp 10.0.2.105 7010 -> 210.217.148.171 5054 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:56:00.450195 3.001925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 18:56:07.249506 0.031749 tcp 10.0.2.105 50837 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:07.281539 0.031987 tcp 10.0.2.105 50838 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:07.313859 0.122661 tcp 10.0.2.105 50839 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:07.437050 0.289768 udp 10.0.2.105 7010 <-> 182.188.140.173 4537 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:56:07.457980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:56:07.727168 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:56:15.459457 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:56:24.492852 0.030812 tcp 10.0.2.105 50840 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:24.523937 0.031421 tcp 10.0.2.105 50841 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:24.555619 0.123154 tcp 10.0.2.105 50842 -> 195.113.214.249 443 SRPA* 0 0 22 11482 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:24.679311 0.074641 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:56:24.754343 0.000000 udp 10.0.2.105 7010 -> 76.8.12.150 3839 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:56:31.462632 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:56:43.190357 0.031908 tcp 10.0.2.105 50843 -> 195.113.214.245 80 FSPA* 0 0 10 1884 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:43.222608 0.032341 tcp 10.0.2.105 50844 -> 195.113.214.249 80 FSPA* 0 0 10 1916 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:43.255284 0.122419 tcp 10.0.2.105 50845 -> 195.113.214.249 443 SRPA* 0 0 20 11371 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:56:43.378292 0.232424 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:56:43.611298 0.000000 udp 10.0.2.105 7010 -> 23.115.109.72 7330 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:57:01.385924 0.031462 tcp 10.0.2.105 50846 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:01.417641 0.032148 tcp 10.0.2.105 50847 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:01.450064 0.124797 tcp 10.0.2.105 50848 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:01.575402 0.162531 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:01.738318 0.259277 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:01.998012 0.191050 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:02.189527 0.188100 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:02.377996 0.333450 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:02.711872 0.000000 udp 10.0.2.105 7010 -> 221.149.100.2 5856 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:57:03.468415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 18:57:14.785273 2.208746 tcp 10.0.2.105 50849 -> 211.38.175.27 4598 FSPA* 0 0 14 1653 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:17.759338 0.030796 tcp 10.0.2.105 50850 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:17.790409 0.032165 tcp 10.0.2.105 50851 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:17.822839 0.121912 tcp 10.0.2.105 50852 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:17.945242 0.000000 udp 10.0.2.105 7010 -> 59.12.27.231 5908 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 18:57:34.428845 0.031399 tcp 10.0.2.105 50853 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:34.460530 0.102137 tcp 10.0.2.105 50854 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:34.562974 0.119942 tcp 10.0.2.105 50855 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/25 18:57:34.683438 0.797266 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:35.481115 0.214847 udp 10.0.2.105 7010 <-> 186.90.54.31 9719 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:35.696521 0.335163 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:36.032153 0.152796 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:36.185331 0.206943 udp 10.0.2.105 7010 <-> 99.44.126.59 1364 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:36.392688 0.338774 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/25 18:57:36.731901 0.182123 udp 10.0.2.105 7010 <-> 111.92.152.120 2514 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:03:07.474316 3.012934 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:03:14.491833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:03:22.493449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:03:38.496285 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:04:10.502757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:10:30.521053 3.418470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:10:37.910432 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:10:45.835693 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:11:01.706872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:11:33.548990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:17:46.557982 3.023226 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:17:53.585755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:18:01.587147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:18:17.590059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:18:49.598150 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:24:53.602354 3.021617 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:25:00.629627 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:25:08.631278 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:25:24.635667 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:25:56.642342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:27:16.996212 0.000188 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 19:27:16.996435 4.188879 tcp 10.0.2.105 50856 -> 211.38.175.27 4598 FSPA* 0 0 15 1784 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:27:38.047491 0.310826 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:27:38.358738 0.000000 udp 10.0.2.105 7010 -> 69.112.92.35 9786 INT 0 1 148 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:27:53.227611 0.032068 tcp 10.0.2.105 50857 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:27:53.259943 0.032615 tcp 10.0.2.105 50858 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:27:53.292813 0.122458 tcp 10.0.2.105 50859 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:27:53.415839 0.000000 udp 10.0.2.105 7010 -> 76.8.12.150 3839 INT 0 1 182 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:28:10.858068 0.031063 tcp 10.0.2.105 50860 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:10.889529 0.031890 tcp 10.0.2.105 50861 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:10.921681 0.121003 tcp 10.0.2.105 50862 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:11.043231 0.000000 udp 10.0.2.105 7010 -> 23.115.109.72 7330 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:28:27.527987 0.031080 tcp 10.0.2.105 50863 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:27.559373 0.031975 tcp 10.0.2.105 50864 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:27.591632 0.122818 tcp 10.0.2.105 50865 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:27.715172 0.000000 udp 10.0.2.105 7010 -> 221.149.100.2 5856 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:28:43.931289 0.030670 tcp 10.0.2.105 50866 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:43.962257 0.033181 tcp 10.0.2.105 50867 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:43.995739 0.121461 tcp 10.0.2.105 50868 -> 195.113.214.249 443 SRPA* 0 0 22 11444 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:28:44.117766 0.000000 udp 10.0.2.105 7010 -> 59.12.27.231 5908 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:29:00.495933 0.032356 tcp 10.0.2.105 50869 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:00.528651 0.032436 tcp 10.0.2.105 50870 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:00.561367 0.123403 tcp 10.0.2.105 50871 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:00.685357 0.226278 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:00.912030 0.218020 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.130426 0.177548 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.308448 0.057213 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.366088 0.142783 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.509331 0.139955 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.649731 0.047513 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.697639 0.080643 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:01.778720 0.359390 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:02.138578 0.159063 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:02.298074 0.155306 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:02.453799 0.348496 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:02.802679 0.163668 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:02.966746 0.151399 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:03.118585 0.208777 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:03.327769 0.028624 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:03.356777 0.487378 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:03.844702 0.074754 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:03.919847 0.382430 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:04.302649 0.141528 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:04.444802 0.228864 udp 10.0.2.105 7010 <-> 75.54.17.81 3982 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:04.674068 0.304127 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:04.978698 0.343032 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:05.322131 0.147005 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:05.469623 0.168996 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:05.639035 0.040909 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:05.680494 0.420558 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:06.101468 0.050363 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:06.152228 0.157288 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:06.309940 0.000000 udp 10.0.2.105 7010 -> 182.188.140.173 4537 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:29:22.203354 0.000000 udp 10.0.2.105 7010 <- 182.188.140.173 4537 RSP 0 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:29:22.203748 0.079367 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:22.283547 0.226393 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:22.510417 0.189064 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:22.699987 0.172142 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:22.872500 0.278924 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:23.151844 0.186954 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:23.339232 0.342505 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:23.682203 1.044552 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:24.727261 0.327019 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:25.054779 0.146738 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:25.201945 0.215922 udp 10.0.2.105 7010 <-> 186.90.54.31 9719 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:29:25.418309 0.000000 udp 10.0.2.105 7010 -> 111.92.152.120 2514 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:29:26.973054 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 19:29:42.491538 0.031600 tcp 10.0.2.105 50872 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:42.523001 0.031833 tcp 10.0.2.105 50873 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:42.554672 0.123050 tcp 10.0.2.105 50874 -> 195.113.214.249 443 SRPA* 0 0 20 10710 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:42.678393 0.000000 udp 10.0.2.105 7010 -> 99.44.126.59 1364 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 19:29:59.119632 0.031810 tcp 10.0.2.105 50875 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:59.151303 0.031667 tcp 10.0.2.105 50876 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:59.183283 0.126857 tcp 10.0.2.105 50877 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:29:59.310697 0.345787 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/25 19:32:00.647468 3.009947 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 19:32:07.663594 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:32:15.665238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:32:31.668077 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:33:03.674573 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:39:07.683369 3.027440 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:39:14.701463 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:39:22.700058 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:39:38.702544 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:40:10.708549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:46:14.717456 3.158336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:46:21.845976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:46:29.783828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:46:45.736183 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:47:17.742213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:57:20.509458 0.021453 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 19:57:20.531076 3.166782 tcp 10.0.2.105 50878 -> 211.38.175.27 4598 FSPA* 0 0 14 1579 flow=From-Botnet-V2-TCP-Established 1970/02/25 19:59:14.756055 3.001259 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 19:59:21.763446 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:59:29.764982 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 19:59:45.767652 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:00:17.773579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:00:24.273702 0.000102 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 20:00:24.273893 0.000000 udp 10.0.2.105 7010 -> 111.92.152.120 2514 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 20:00:40.538099 0.045520 tcp 10.0.2.105 50879 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:40.583870 0.031757 tcp 10.0.2.105 50880 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:40.616024 0.120479 tcp 10.0.2.105 50881 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:40.737013 0.000000 udp 10.0.2.105 7010 -> 99.44.126.59 1364 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 20:00:57.181347 0.031714 tcp 10.0.2.105 50882 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:57.213339 0.033238 tcp 10.0.2.105 50883 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:57.246919 0.123110 tcp 10.0.2.105 50884 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:00:57.370565 0.307836 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:57.678836 0.219063 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:57.898306 0.222261 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.121038 0.172616 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.294034 0.140913 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.435359 0.049209 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.485043 0.081577 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.566991 0.143177 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.710578 0.161643 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:58.872661 0.248230 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:59.121269 0.070556 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:59.192189 0.151575 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:59.344189 0.176003 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:59.520585 0.347204 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:00:59.868132 0.152821 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:00.021292 0.430269 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:00.451977 0.074476 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:00.526820 0.394491 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:00.921706 0.029232 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:00.951298 0.221321 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:01.172975 0.231566 udp 10.0.2.105 7010 <-> 75.54.17.81 3982 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:01.404894 0.845997 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:02.251318 0.235206 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:02.486900 0.174409 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:02.661771 0.040133 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:02.702291 0.424184 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.126920 0.050590 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.177954 0.152401 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.330784 0.336674 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.667865 0.148203 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.816509 0.080924 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:03.897868 0.000000 udp 10.0.2.105 7010 -> 182.188.140.173 4537 INT 0 1 93 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 20:01:20.694719 0.031576 tcp 10.0.2.105 50885 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:01:20.726563 0.031810 tcp 10.0.2.105 50886 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:01:20.758701 0.122977 tcp 10.0.2.105 50887 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:01:20.882273 0.314951 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:21.197646 0.166007 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:21.364562 0.188817 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:21.553783 0.228876 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:21.783038 0.340561 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:22.123968 0.185563 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:22.309959 0.326866 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:22.637187 0.229557 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:22.867211 0.150646 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:23.018298 0.216660 udp 10.0.2.105 7010 <-> 186.90.54.31 9719 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:01:23.235337 0.346517 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:06:21.780296 3.023122 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 20:06:28.797387 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:06:36.798875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:06:52.801917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:07:24.807850 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:13:28.813878 3.001499 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:13:35.820927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:13:43.822755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:13:59.825786 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:14:31.831525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:20:35.837356 3.013710 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:20:42.855280 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:20:50.857284 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:21:06.859948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:21:38.865918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:27:23.701958 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 20:27:23.702060 1.934931 tcp 10.0.2.105 50888 -> 211.38.175.27 4598 FSPA* 0 0 15 1698 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:27:42.874355 2.999004 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:27:49.879414 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:27:57.880144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:28:13.883488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:28:45.890015 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:31:38.448043 0.014189 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 20:31:38.462326 0.000000 udp 10.0.2.105 7010 -> 182.188.140.173 4537 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 20:31:56.064991 0.031846 tcp 10.0.2.105 50889 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:31:56.097090 0.053388 tcp 10.0.2.105 50890 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:31:56.150776 0.125656 tcp 10.0.2.105 50891 -> 195.113.214.249 443 SRPA* 0 0 33 24823 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:31:56.277107 0.226300 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:56.503793 0.310215 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:56.814509 0.230684 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.045568 0.126187 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.172131 0.041460 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.213937 0.092822 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.307136 0.143696 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.451212 0.165225 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.616874 0.173818 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.791080 0.175725 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:57.967206 0.221238 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:58.188862 0.050088 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:58.239447 0.157324 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:58.397168 0.347373 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:58.745212 0.158948 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:58.904547 0.421495 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:59.326456 0.074697 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:59.401552 0.222965 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:59.624892 0.227827 udp 10.0.2.105 7010 <-> 75.54.17.81 3982 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:31:59.853092 0.362202 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.215713 0.028231 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.244576 0.039831 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.284805 0.127095 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.412542 0.227518 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.640817 0.173211 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.814452 0.153125 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:00.967988 0.439225 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:01.407667 0.056046 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:01.464192 0.149542 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 253 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:01.614152 0.327740 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:01.942313 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 20:32:17.765091 0.052342 tcp 10.0.2.105 50892 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:32:17.817723 0.031626 tcp 10.0.2.105 50893 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:32:17.849590 0.121039 tcp 10.0.2.105 50894 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/25 20:32:17.971134 0.266003 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:18.237539 0.163901 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:18.401885 0.187676 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:18.589984 0.222215 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:18.812620 0.333396 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:19.146450 0.697786 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:19.844674 0.191352 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:20.036479 0.334252 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:20.371101 0.152276 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:20.523755 0.230291 udp 10.0.2.105 7010 <-> 186.90.54.31 9719 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:32:20.754434 0.343652 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/25 20:34:49.895595 3.001975 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 20:34:56.903343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:35:04.904110 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:35:20.907789 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:35:52.913484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:41:56.920620 3.011909 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:42:03.937584 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:42:11.938606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:42:27.941828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:42:59.947723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:49:03.954044 3.011622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:49:10.971134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:49:18.973147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:49:34.975580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:50:06.981905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:56:10.988264 3.021813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 20:56:18.004956 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:56:26.006560 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:56:42.013018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:57:14.015526 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 20:57:25.644165 0.000097 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 20:57:25.644351 2.100283 tcp 10.0.2.105 50895 -> 211.38.175.27 4598 FSPA* 0 0 15 1800 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:02:24.492700 0.013347 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 21:02:24.506164 0.102597 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:24.609220 0.210697 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:24.820509 0.125298 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:24.946259 0.041791 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:24.988604 0.088040 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:25.077113 0.222243 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:25.299771 0.303133 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:25.603315 0.160376 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:25.764125 0.164802 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:25.929325 0.168771 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.098502 0.189180 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 221 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.288142 0.137791 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.426366 0.054211 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.481007 0.156387 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.637806 0.348119 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:26.986330 0.151883 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:27.138636 0.073913 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:27.212995 0.221585 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:27.434991 0.000000 udp 10.0.2.105 7010 -> 75.54.17.81 3982 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:02:45.655140 0.032281 tcp 10.0.2.105 50896 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:02:45.687701 0.032350 tcp 10.0.2.105 50897 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:02:45.720322 0.103965 tcp 10.0.2.105 50898 -> 195.113.214.249 443 SRPA* 0 0 55 34791 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:02:45.825011 0.388074 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:46.213544 0.028702 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:46.242646 0.040105 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:46.283129 0.421254 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:02:46.704732 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 87 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:03:05.154222 0.031279 tcp 10.0.2.105 50899 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:05.185795 0.032183 tcp 10.0.2.105 50900 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:05.218271 0.123675 tcp 10.0.2.105 50901 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:05.342458 0.122788 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:05.465684 0.284711 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:05.750770 0.169012 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:05.920204 0.151300 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:06.071930 0.341508 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:06.413925 0.055417 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:06.469784 0.428084 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:06.898338 0.255323 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:07.154102 0.171016 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:07.325533 0.191837 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:07.517810 0.224038 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:07.742255 0.331517 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:08.074153 0.510740 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:08.585304 0.187518 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:08.773304 0.000000 udp 10.0.2.105 7010 -> 186.90.54.31 9719 INT 0 1 141 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:03:18.024215 2.999266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 21:03:25.028970 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:03:25.750180 0.030956 tcp 10.0.2.105 50902 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:25.781387 0.032028 tcp 10.0.2.105 50903 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:25.813749 0.120894 tcp 10.0.2.105 50904 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:03:25.935151 0.354301 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:26.289938 0.325764 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:26.616089 0.147457 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:03:33.030343 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:03:49.033489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:04:21.039983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:10:45.054989 3.001582 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:10:52.061999 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:11:00.063095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:11:16.066333 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:11:48.072157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:18:00.081204 3.284669 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:18:07.335831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:18:15.256495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:18:31.101891 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:19:03.108047 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:25:07.113839 3.001676 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:25:14.121061 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:25:22.123101 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:25:38.126031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:26:10.131836 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:27:27.743934 0.016221 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 21:27:27.760396 3.801145 tcp 10.0.2.105 50905 -> 211.38.175.27 4598 FSPA* 0 0 14 1523 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:32:14.137837 3.001452 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:32:21.145257 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:32:29.146977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:32:45.150008 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:33:17.155658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:33:48.109420 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 21:33:48.109574 0.000000 udp 10.0.2.105 7010 -> 75.54.17.81 3982 INT 0 1 204 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:34:06.026789 0.032098 tcp 10.0.2.105 50906 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:06.059196 0.031688 tcp 10.0.2.105 50907 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:06.091203 0.122630 tcp 10.0.2.105 50908 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:06.214382 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:34:24.592464 0.031082 tcp 10.0.2.105 50909 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:24.623840 0.034432 tcp 10.0.2.105 50910 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:24.658565 0.121199 tcp 10.0.2.105 50911 -> 195.113.214.249 443 SRPA* 0 0 19 10030 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:24.780433 0.000000 udp 10.0.2.105 7010 -> 186.90.54.31 9719 INT 0 1 126 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:34:39.821063 0.032922 tcp 10.0.2.105 50912 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:39.854268 0.031950 tcp 10.0.2.105 50913 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:39.886497 0.126711 tcp 10.0.2.105 50914 -> 195.113.214.249 443 SRPA* 0 0 42 37554 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:34:40.014035 0.116438 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.130855 0.078393 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.209617 0.222981 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.432969 0.209821 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.643317 0.041979 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.685686 0.125120 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.811205 0.162889 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:40.974505 0.161458 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.136408 0.309910 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.446729 0.151140 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.598270 0.058675 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.657326 0.143237 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.800950 0.189686 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:41.991182 0.169382 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:42.161027 0.348956 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:42.510407 0.147542 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:42.658316 0.075904 udp 10.0.2.105 7010 <-> 151.60.40.165 5908 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:42.734641 0.223743 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:42.958777 0.421241 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:43.380415 0.040615 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 557 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:43.421420 0.029006 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:43.450809 0.452887 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:43.904076 0.175047 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:44.079499 0.147854 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:44.227807 0.132104 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:44.360309 0.348287 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:34:44.708997 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 21:35:01.255845 0.030853 tcp 10.0.2.105 50915 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:35:01.286945 0.032052 tcp 10.0.2.105 50916 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:35:01.319278 0.124677 tcp 10.0.2.105 50917 -> 195.113.214.249 443 SRPA* 0 0 21 10764 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:35:01.444740 0.348277 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:01.793386 0.164098 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:01.957887 0.250896 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:02.209184 0.427358 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:02.636961 0.215424 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:02.852764 0.185126 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:03.038403 0.337616 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:03.376548 0.272349 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:03.649346 0.181760 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:03.831478 0.359892 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:04.191811 0.323987 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:35:04.516345 0.151991 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/25 21:39:21.172742 3.010570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 21:39:28.189430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:39:36.190759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:39:52.193591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:40:24.199829 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:46:28.207963 3.024441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:46:35.223675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:46:43.224807 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:46:59.228131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:47:31.233542 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:57:31.567132 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 21:57:31.567261 1.895430 tcp 10.0.2.105 50918 -> 211.38.175.27 4598 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/02/25 21:59:18.242772 3.001634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 21:59:25.250880 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:59:33.253312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 21:59:49.254691 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:00:21.264624 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:05:22.504689 0.000152 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 22:05:22.504946 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 22:05:39.691241 0.037561 tcp 10.0.2.105 50919 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:39.729055 0.032352 tcp 10.0.2.105 50920 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:39.761686 0.125130 tcp 10.0.2.105 50921 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:39.887395 0.222650 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.110462 0.073382 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.184268 0.076225 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.260895 0.125974 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.387287 0.155960 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.543689 0.160045 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 334 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:40.704129 0.302862 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.007395 0.205239 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.213031 0.048876 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.262334 0.152010 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.414721 0.187434 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.602562 0.169761 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.772781 0.144053 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.917214 0.047790 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:41.965398 0.000000 udp 10.0.2.105 7010 -> 151.60.40.165 5908 INT 0 1 212 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 22:05:58.475922 0.032079 tcp 10.0.2.105 50922 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:58.508268 0.031336 tcp 10.0.2.105 50923 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:58.539864 0.134412 tcp 10.0.2.105 50924 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:05:58.675023 0.222094 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:58.897490 0.421242 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:59.319118 0.040006 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:59.359492 0.027276 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 272 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:59.387085 0.152005 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:59.539503 0.348677 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:05:59.888668 0.143061 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:00.032148 0.397898 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:00.430393 0.175390 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:00.606120 0.147566 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:00.754065 0.233071 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:00.987518 0.210537 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:01.198506 0.343247 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:01.668798 0.164696 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:01.833929 0.429363 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:02.263741 0.210033 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:02.474239 0.188763 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:02.663399 0.185635 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:02.849700 0.344662 udp 10.0.2.105 7010 <-> 163.15.173.210 1503 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:03.194776 0.324169 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:03.519366 0.976651 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:04.496465 0.584558 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:05.081453 0.154345 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:06:25.266781 3.001574 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 22:06:32.274219 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:06:40.275800 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:06:56.278254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:07:28.284703 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:13:37.297969 3.001477 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:13:44.320764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:13:52.306787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:14:08.310217 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:14:40.315943 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:20:44.321631 3.011925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:20:51.339420 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:20:59.341103 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:21:15.343947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:21:47.350116 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:27:33.467928 0.017137 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 22:27:33.485168 3.590162 tcp 10.0.2.105 50925 -> 211.38.175.27 4598 FSPA* 0 0 15 1550 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:27:51.357013 3.000813 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:27:58.363429 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:28:06.364799 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:28:22.368250 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:28:54.380861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:34:58.380451 3.001694 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:35:05.387339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:35:13.389067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:35:29.392125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:36:01.401569 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:36:54.093568 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 22:36:54.093768 0.000000 udp 10.0.2.105 7010 -> 151.60.40.165 5908 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 22:37:12.221689 0.032691 tcp 10.0.2.105 50926 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:12.254641 0.032826 tcp 10.0.2.105 50927 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:12.287694 0.122448 tcp 10.0.2.105 50928 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:12.410886 0.092188 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 569 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:12.503480 0.125603 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:12.629442 0.164196 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:12.794040 0.221661 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.016094 0.072374 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.088919 0.302485 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.391811 0.160175 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.552583 0.042178 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.595167 0.164435 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.760041 0.188877 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:13.949352 0.210465 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:14.160282 0.143918 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:14.304623 0.174570 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:14.479597 0.054097 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:14.534088 0.221338 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:14.755860 0.633099 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:15.389382 0.041044 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:15.430811 0.027592 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:15.489142 0.153194 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:15.642795 0.347390 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:15.990558 0.248872 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:16.239853 0.143958 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:16.384352 0.298192 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:16.682948 0.204979 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:16.888509 0.621458 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:17.510416 0.168259 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:17.679085 0.358481 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:18.037960 0.164902 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:18.203303 0.422381 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:18.626068 0.220583 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:18.847025 0.000000 udp 10.0.2.105 7010 -> 163.15.173.210 1503 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 22:37:33.901622 0.031617 tcp 10.0.2.105 50929 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:33.933628 0.032698 tcp 10.0.2.105 50930 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:33.966712 0.121510 tcp 10.0.2.105 50931 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/25 22:37:34.088866 0.319801 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:34.409061 0.187006 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:34.596455 0.178939 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:34.775870 0.888340 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:35.664621 0.325369 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:37:35.990457 0.152699 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/25 22:42:05.405388 3.010256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 22:42:12.421373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:42:20.423012 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:42:36.425863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:43:08.431936 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:49:12.438710 3.003368 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:49:19.445394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:49:27.449265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:49:43.452633 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:50:15.455907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:56:19.461340 3.002081 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 22:56:26.469558 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:56:34.470405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:56:50.473662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:57:22.489562 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 22:57:37.081278 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 22:57:37.081464 1.906821 tcp 10.0.2.105 50932 -> 211.38.175.27 4598 FSPA* 0 0 14 1716 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:03:26.495861 3.001516 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:03:33.503170 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:03:41.504759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:03:57.507579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:04:29.513803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:07:57.653561 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 23:07:57.653661 0.000000 udp 10.0.2.105 7010 -> 163.15.173.210 1503 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:08:13.727859 0.041297 tcp 10.0.2.105 50933 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:13.769391 0.032877 tcp 10.0.2.105 50934 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:13.802515 0.134543 tcp 10.0.2.105 50935 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:13.937613 0.163367 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.101420 0.215880 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.317691 0.102262 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.420429 0.096788 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.517641 0.124185 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.642233 0.158244 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.800870 0.040782 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.842063 0.151760 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:14.994234 0.190662 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:15.185279 0.210014 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:15.395699 0.305250 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:15.701396 0.144117 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:15.845937 0.169338 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:16.015709 0.204430 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:16.220540 0.066389 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:16.287359 0.428053 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:16.715799 0.154152 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:16.870408 0.347369 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:17.218238 0.380184 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:17.598787 0.028078 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:17.627257 0.040527 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:17.668212 0.247954 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:17.916564 0.142690 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:18.059655 0.241670 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:18.301670 0.160108 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:18.462187 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:08:33.635480 0.031823 tcp 10.0.2.105 50936 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:33.667509 0.031526 tcp 10.0.2.105 50937 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:33.699345 0.125613 tcp 10.0.2.105 50938 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:33.825629 0.174025 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:34.000929 0.369499 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:34.370855 0.000000 udp 10.0.2.105 7010 -> 174.52.213.208 2114 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:08:52.142104 0.032148 tcp 10.0.2.105 50939 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:52.174631 0.033754 tcp 10.0.2.105 50940 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:52.208724 0.125389 tcp 10.0.2.105 50941 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:08:52.334635 0.552271 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:08:52.887329 0.000000 udp 10.0.2.105 7010 -> 115.252.123.245 6689 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:09:10.388173 0.031199 tcp 10.0.2.105 50942 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:09:10.419647 0.032607 tcp 10.0.2.105 50943 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:09:10.452538 0.126810 tcp 10.0.2.105 50944 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:09:10.579817 0.324657 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 241 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:09:10.904928 0.190612 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:09:11.095966 0.000000 udp 10.0.2.105 7010 -> 96.11.143.66 1569 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:09:19.031451 0.000000 udp 10.0.2.105 7010 <- 96.11.143.66 1569 RSP 0 0 1 290 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:09:19.031878 0.641401 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:09:19.673658 0.327677 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:10:58.525568 3.001903 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/25 23:11:05.533268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:11:13.533951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:11:29.537731 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:12:01.543673 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:18:07.552383 3.022082 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:18:14.579992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:18:22.581497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:18:38.584582 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:19:10.589953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:25:14.595899 3.002950 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:25:21.603959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:25:29.605337 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:25:45.608403 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:26:17.614406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:27:38.992156 0.000273 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 23:27:38.992514 2.566505 tcp 10.0.2.105 50945 -> 211.38.175.27 4598 FSPA* 0 0 14 1636 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:32:21.620471 3.022039 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:32:28.638034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:32:36.640142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:32:52.644743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:33:24.647849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:39:21.461630 0.016962 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 23:39:21.478696 0.332928 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:21.812051 0.000000 udp 10.0.2.105 7010 -> 174.52.213.208 2114 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/25 23:39:28.654083 3.002181 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:39:35.662206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:39:39.248959 0.031924 tcp 10.0.2.105 50946 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:39:39.281161 0.032626 tcp 10.0.2.105 50947 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:39:39.314064 0.132070 tcp 10.0.2.105 50948 -> 195.113.214.249 443 SRPA* 0 0 44 27874 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:39:39.446868 0.186021 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:39.633295 0.158186 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:39.791937 0.125562 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:39.917921 0.160141 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.078482 0.216834 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.295768 0.079186 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.375364 0.073104 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.448911 0.041741 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.491020 0.196761 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.688202 0.158986 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:40.847563 0.210632 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:41.058593 0.303200 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:41.362208 0.179093 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:41.541655 0.155058 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:41.697057 0.455919 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:42.153348 0.045661 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:42.199387 0.209457 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:42.409234 0.151819 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:42.561446 0.349421 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:42.911259 0.252510 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:43.164240 0.040616 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:43.205289 0.030360 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:43.236077 4.587987 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:43.665089 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:39:47.824548 0.148482 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:47.973508 0.164264 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:48.138195 0.290940 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:48.429585 0.169442 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:48.599473 0.378411 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:48.978259 0.440651 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:49.419333 0.193138 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:49.612862 0.346619 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:49.959858 0.152680 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:50.112957 0.369208 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:50.482541 0.326288 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/25 23:39:59.665852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:40:31.672603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:46:35.677857 3.001767 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:46:42.686118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:46:50.687319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:47:06.690307 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:47:38.696668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:57:41.564179 0.021084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/25 23:57:41.585364 3.701459 tcp 10.0.2.105 50949 -> 211.38.175.27 4598 FSPA* 0 0 14 1512 flow=From-Botnet-V2-TCP-Established 1970/02/25 23:59:23.702688 3.001538 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/25 23:59:30.709597 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:59:38.711575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/25 23:59:54.714575 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:00:26.721013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:06:30.725786 3.019017 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:06:37.743863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:06:45.745638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:07:01.748790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:07:33.754828 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:10:08.257095 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 00:10:08.257247 0.341238 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:08.598853 0.124124 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:08.723727 0.158068 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 230 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:08.882170 0.220326 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:09.102910 0.191362 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:09.294730 0.159830 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:09.454943 0.502566 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:09.957932 0.080920 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.039249 0.043328 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.083037 0.186570 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.269975 0.156516 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.426871 0.211450 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.638738 0.144293 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:10.783468 0.445878 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:11.229761 0.085338 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:11.315442 0.303635 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:11.619466 0.173214 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:11.793103 0.208561 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.002300 0.153581 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.156294 0.352132 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.508880 0.251274 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.760693 0.039791 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.800890 0.028944 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.830416 0.163490 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:12.994296 4.986998 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:17.981726 0.146935 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:18.129062 0.386527 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:18.515994 0.227517 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:18.743896 0.174176 udp 10.0.2.105 7010 <-> 99.104.18.196 6339 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:18.918493 0.439468 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:19.358308 0.194932 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:19.553654 0.333186 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:19.887242 0.152820 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:20.040420 0.506567 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:10:20.547368 0.333843 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:13:42.767618 3.001763 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:13:49.775231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:13:57.777033 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:14:13.779147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:14:45.785394 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:20:49.793268 3.016214 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:20:56.809196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:21:04.811078 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:21:20.813747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:21:52.819508 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:27:45.287423 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 00:27:45.287636 3.678504 tcp 10.0.2.105 50950 -> 211.38.175.27 4598 SPA_* 0 0 8 1089 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:27:56.825862 3.008410 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:28:02.753735 0.001175 tcp 10.0.2.105 50950 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:28:03.835196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:28:11.844644 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:28:27.847790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:28:59.853917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:35:03.860719 3.000688 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:35:10.866991 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:35:18.868717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:35:34.872088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:36:06.878017 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:40:33.901982 0.133685 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 00:40:34.035849 0.162766 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 235 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:34.199050 0.215453 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:34.414909 0.185489 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:34.600775 0.159397 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:34.760557 0.341148 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.102097 0.125991 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.228583 0.086388 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.315360 0.080700 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.396570 0.046929 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.443901 0.195928 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.640261 0.158439 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:35.799159 0.212679 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:36.012205 0.142741 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:36.155315 0.430579 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:36.586296 0.053641 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:36.640460 0.297831 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:36.938683 0.177018 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:37.116102 0.222881 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:37.339407 0.153607 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:37.493381 0.348153 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:37.841918 0.029610 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:37.871907 0.162878 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.035170 0.272617 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.308237 0.040885 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.349560 0.134638 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.484635 0.150526 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.635536 0.357589 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:38.993514 0.226444 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:39.220523 0.000000 udp 10.0.2.105 7010 -> 99.104.18.196 6339 INT 0 1 97 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 00:40:57.297237 0.032871 tcp 10.0.2.105 50951 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:40:57.330393 0.032875 tcp 10.0.2.105 50952 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:40:57.363614 0.129730 tcp 10.0.2.105 50953 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:40:57.493903 0.428959 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:40:57.923244 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 00:41:13.279357 0.036481 tcp 10.0.2.105 50954 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:41:13.316153 0.032349 tcp 10.0.2.105 50955 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:41:13.348791 0.128813 tcp 10.0.2.105 50956 -> 195.113.214.249 443 SRPA* 0 0 47 31300 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:41:13.478131 0.642965 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:41:14.121516 0.332720 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:41:14.454614 0.342555 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:41:14.797623 0.152054 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 500 flow=From-Botnet-V2-UDP-Established 1970/02/26 00:42:10.885746 2.999496 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 00:42:17.891049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:42:25.893277 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:42:41.895965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:43:13.901613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:49:17.907250 3.003850 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:49:24.915043 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:49:32.916932 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:49:48.919492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:50:20.925866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:56:24.933312 3.035067 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 00:56:31.949106 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:56:39.950491 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:56:55.953520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:57:27.959528 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 00:58:02.759741 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 00:58:02.759898 3.625504 tcp 10.0.2.105 50957 -> 211.38.175.27 4598 SPA_* 0 0 10 1288 flow=From-Botnet-V2-TCP-Established 1970/02/26 00:58:09.150710 0.027336 tcp 10.0.2.105 50957 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:03:31.986015 3.001500 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:03:39.012967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:03:46.994611 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:04:02.997524 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:04:35.005815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:11:03.016591 3.024899 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:11:10.031363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:11:18.033370 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:11:21.558379 0.000090 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 01:11:21.558542 0.000000 udp 10.0.2.105 7010 -> 99.104.18.196 6339 INT 0 1 98 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 01:11:34.036973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:11:39.025420 0.032944 tcp 10.0.2.105 50958 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:39.058722 0.034286 tcp 10.0.2.105 50959 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:39.093396 0.127285 tcp 10.0.2.105 50960 -> 195.113.214.249 443 SRPA* 0 0 43 35256 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:39.221424 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 01:11:55.357516 0.033178 tcp 10.0.2.105 50961 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:55.390963 0.032588 tcp 10.0.2.105 50962 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:55.423817 0.134664 tcp 10.0.2.105 50963 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:11:55.559161 0.160958 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:55.720700 0.221109 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:55.942203 0.345996 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.288608 0.124184 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.413189 0.074596 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.488179 0.086488 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.575145 0.046651 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.622185 0.184827 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.807457 0.164418 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:56.972317 0.188083 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:57.160788 0.209951 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:57.371117 0.152159 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:57.523725 0.143608 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:57.667693 0.169240 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:57.837289 0.208894 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:58.046634 0.424359 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:58.471412 0.303502 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 593 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:58.775362 0.064579 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:58.840527 0.169082 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.010038 0.258921 udp 10.0.2.105 7010 <-> 190.37.41.159 3980 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.269392 0.039810 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.309613 0.348961 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.658971 0.153212 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.812667 0.029404 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:11:59.842447 0.314274 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:00.157105 0.239799 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:00.397351 0.147236 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:00.544979 0.359197 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:00.904799 0.411303 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:01.316488 0.805986 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:02.122879 0.153132 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:02.276497 0.327179 udp 10.0.2.105 7010 <-> 114.32.172.181 6523 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:02.604062 0.320071 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:12:06.043046 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:18:12.051199 3.013942 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:18:19.068309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:18:27.069805 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:18:43.072907 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:19:15.081063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:25:19.085606 3.018592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:25:26.131137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:25:34.104020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:25:50.106875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:26:22.113601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:28:09.197378 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 01:28:09.197572 3.609401 tcp 10.0.2.105 50964 -> 211.38.175.27 4598 SPA_* 0 0 10 1060 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:28:15.936452 0.015714 tcp 10.0.2.105 50964 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:32:26.119017 3.029594 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:32:33.139959 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:32:41.154063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:32:57.141187 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:33:29.146843 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:39:33.153301 3.013567 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:39:40.170355 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:39:48.171772 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:40:04.174638 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:40:36.180815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:42:05.870188 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 01:42:05.870327 0.159404 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.030237 0.125553 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.156295 0.076306 udp 10.0.2.105 7010 <-> 86.46.238.128 8274 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.232996 0.216192 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.449588 0.334453 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.784563 0.094531 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.879497 0.048137 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:06.928095 0.188473 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:07.116964 0.166434 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:07.283873 0.194948 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:07.479233 0.138007 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:07.617686 0.169370 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:07.787469 0.212559 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:08.000412 0.161128 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 549 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:08.161913 0.221969 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:08.384251 0.433000 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:08.817649 0.306120 udp 10.0.2.105 7010 <-> 210.217.148.171 5054 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:09.124166 0.050341 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:09.174868 0.161120 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:09.336465 0.000000 udp 10.0.2.105 7010 -> 190.37.41.159 3980 INT 0 1 151 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 01:42:26.531514 0.033299 tcp 10.0.2.105 50965 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:26.565218 0.032339 tcp 10.0.2.105 50966 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:26.597815 0.124784 tcp 10.0.2.105 50967 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:26.723200 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 01:42:42.393501 0.031679 tcp 10.0.2.105 50968 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:42.425491 0.040182 tcp 10.0.2.105 50969 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:42.465951 0.161574 tcp 10.0.2.105 50970 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:42:42.628179 0.029049 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:42.657618 0.222079 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:42.880156 0.349813 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:43.230328 0.152883 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:43.383665 0.123885 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:43.507910 0.148235 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:43.656507 0.375273 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:44.032128 0.423007 udp 10.0.2.105 7010 <-> 124.120.48.23 8909 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:44.455539 0.659840 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:45.115828 0.152703 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:42:45.268940 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 01:43:01.200041 0.032057 tcp 10.0.2.105 50971 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:43:01.232408 0.032867 tcp 10.0.2.105 50972 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:43:01.265509 0.130841 tcp 10.0.2.105 50973 -> 195.113.214.249 443 SRPA* 0 0 46 24518 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:43:01.396914 0.345452 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/26 01:46:40.186611 3.050962 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 01:46:47.216827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:46:55.205865 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:47:11.212036 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:47:43.215052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:58:15.955275 0.733424 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 01:58:16.688869 4.585491 tcp 10.0.2.105 50974 -> 211.38.175.27 4598 FSPA* 0 0 14 1644 flow=From-Botnet-V2-TCP-Established 1970/02/26 01:59:27.331262 2.958514 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 01:59:34.254824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:59:42.238616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 01:59:59.140093 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:00:30.745323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:06:34.274428 3.114303 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 02:06:41.358515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:06:49.294967 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:07:05.295732 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:07:37.301788 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:13:11.692796 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 02:13:11.692975 0.039878 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:13:11.733203 0.000000 udp 10.0.2.105 7010 -> 190.37.41.159 3980 INT 0 1 110 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:13:27.497055 0.035865 tcp 10.0.2.105 50975 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:27.533208 0.032691 tcp 10.0.2.105 50976 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:27.566283 0.135146 tcp 10.0.2.105 50977 -> 195.113.214.249 443 SRPA* 0 0 41 30976 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:27.702116 0.000000 udp 10.0.2.105 7010 -> 114.32.172.181 6523 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:13:46.007883 0.673669 tcp 10.0.2.105 50978 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:46.681858 0.032717 tcp 10.0.2.105 50979 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:46.714835 0.127101 tcp 10.0.2.105 50980 -> 195.113.214.249 443 SRPA* 0 0 39 31494 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:13:46.842470 0.125167 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:13:46.968073 0.160440 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:13:47.128889 0.000000 udp 10.0.2.105 7010 -> 86.46.238.128 8274 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:13:48.111515 2.964536 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 02:13:56.343279 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:14:03.911577 0.032333 tcp 10.0.2.105 50981 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:03.944161 0.033098 tcp 10.0.2.105 50982 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:03.977599 0.129893 tcp 10.0.2.105 50983 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:04.108178 0.048796 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:04.157360 0.184027 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:04.247871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:14:04.341806 0.162326 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:04.504739 0.223648 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:04.842626 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 INT 0 1 104 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:14:20.058845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:14:21.487229 0.034808 tcp 10.0.2.105 50984 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:21.521848 0.032742 tcp 10.0.2.105 50985 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:21.554998 0.125548 tcp 10.0.2.105 50986 -> 195.113.214.249 443 SRPA* 0 0 42 22712 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:21.681315 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:14:36.942883 0.033959 tcp 10.0.2.105 50987 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:36.976760 0.034056 tcp 10.0.2.105 50988 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:37.011135 0.126373 tcp 10.0.2.105 50989 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:37.138616 0.158488 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:37.297571 0.171170 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:37.469138 0.196916 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:37.666463 0.210460 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:37.877371 0.143302 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:38.021072 0.000000 udp 10.0.2.105 7010 -> 210.217.148.171 5054 INT 0 1 117 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:14:51.671202 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:14:54.262291 0.031420 tcp 10.0.2.105 50990 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:54.294169 0.032032 tcp 10.0.2.105 50991 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:54.326521 0.125659 tcp 10.0.2.105 50992 -> 195.113.214.249 443 SRPA* 0 0 23 13298 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:14:54.452747 0.417572 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:54.870731 0.208813 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.079975 0.058157 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.138578 0.162505 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.301577 0.029788 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.331820 0.246137 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.578362 0.349304 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:55.928073 0.145787 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:56.074249 0.365914 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:56.440787 2.914729 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:59.355918 0.152058 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:14:59.508409 0.000000 udp 10.0.2.105 7010 -> 124.120.48.23 8909 INT 0 1 251 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:15:16.609649 0.039689 tcp 10.0.2.105 50993 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:15:16.649641 0.033038 tcp 10.0.2.105 50994 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:15:16.682502 0.135765 tcp 10.0.2.105 50995 -> 195.113.214.249 443 SRPA* 0 0 54 28112 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:15:16.818979 0.584875 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:15:17.404412 0.146208 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:15:17.551031 0.336848 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:20:54.350413 3.001619 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 02:21:01.357674 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:21:09.359186 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:21:25.362438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:21:58.888020 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:28:01.394655 3.001401 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 02:28:08.401832 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:28:16.403385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:28:20.609746 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 02:28:20.609955 3.708839 tcp 10.0.2.105 50996 -> 211.38.175.27 4598 SPA_* 0 0 10 1264 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:28:27.392670 0.124320 tcp 10.0.2.105 50996 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:28:32.406072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:29:04.412388 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:35:08.418570 3.001326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 02:35:15.425860 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:35:23.427171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:35:39.430360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:36:11.436586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:42:15.442750 3.000954 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 02:42:22.449484 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:42:30.451249 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:42:46.454034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:43:18.460509 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:45:24.612087 0.000073 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 02:45:24.612240 0.000000 udp 10.0.2.105 7010 -> 86.46.238.128 8274 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:45:41.929185 0.032032 tcp 10.0.2.105 50997 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:41.961592 0.032452 tcp 10.0.2.105 50998 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:41.994370 0.129813 tcp 10.0.2.105 50999 -> 195.113.214.249 443 SRPA* 0 0 25 13312 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:42.124909 0.000000 udp 10.0.2.105 7010 -> 219.103.237.245 1532 INT 0 1 135 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:45:59.099035 0.032208 tcp 10.0.2.105 51000 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:59.131545 0.032464 tcp 10.0.2.105 51001 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:59.164466 0.282152 tcp 10.0.2.105 51002 -> 195.113.214.249 443 SRPA* 0 0 28 12098 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:45:59.446473 0.092730 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:45:59.539680 0.000000 udp 10.0.2.105 7010 -> 210.217.148.171 5054 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:46:16.396690 0.040767 tcp 10.0.2.105 51003 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:16.437747 0.043982 tcp 10.0.2.105 51004 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:16.482052 0.205382 tcp 10.0.2.105 51005 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:16.687957 0.000000 udp 10.0.2.105 7010 -> 124.120.48.23 8909 INT 0 1 173 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:46:33.430666 0.117289 tcp 10.0.2.105 51006 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:33.548285 0.033761 tcp 10.0.2.105 51007 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:33.582016 0.138755 tcp 10.0.2.105 51008 -> 195.113.214.249 443 SRPA* 0 0 22 12484 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:33.721325 0.039697 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:33.761401 0.161794 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:33.923676 0.125223 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.049308 0.040828 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.090555 0.221490 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.312675 0.163760 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.476822 0.195251 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.672691 0.169189 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:34.842287 0.190317 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.095711 0.158808 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.254913 0.216227 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.471547 0.143330 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.615367 0.162866 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.778632 0.030273 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:35.809368 0.213875 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:36.023630 0.222629 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:36.246636 0.425954 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:36.672973 0.054139 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:36.727575 0.406693 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:37.134702 0.348579 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:37.483673 0.000000 udp 10.0.2.105 7010 -> 69.133.33.19 2866 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 02:46:52.570827 0.039231 tcp 10.0.2.105 51009 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:52.610358 0.032881 tcp 10.0.2.105 51010 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:52.643493 0.126332 tcp 10.0.2.105 51011 -> 195.113.214.249 443 SRPA* 0 0 24 12594 flow=From-Botnet-V2-TCP-Established 1970/02/26 02:46:52.770378 4.218585 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:56.989424 0.153355 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:57.143164 0.343684 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:57.487323 0.667780 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:46:58.155495 0.153350 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 02:57:05.471040 3.002611 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 02:57:12.479052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:57:20.480556 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:57:36.483775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:58:08.491826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 02:58:27.517295 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 02:58:27.517492 3.724826 tcp 10.0.2.105 51012 -> 211.38.175.27 4598 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:04:12.495583 3.001818 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:04:19.503148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:04:27.504751 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:04:43.507846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:05:15.513725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:11:38.527374 3.249462 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:11:45.746415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:11:53.675650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:12:11.965366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:12:43.575349 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:17:08.509187 0.131372 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 03:17:08.640700 0.000000 udp 10.0.2.105 7010 -> 69.133.33.19 2866 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 03:17:26.636975 0.034176 tcp 10.0.2.105 51013 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:26.671402 0.032078 tcp 10.0.2.105 51014 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:26.703760 0.129570 tcp 10.0.2.105 51015 -> 195.113.214.249 443 SRPA* 0 0 41 21628 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:26.833976 0.072781 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:26.907214 0.125595 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.033228 0.048092 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.081668 0.222463 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.304718 0.039704 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.344807 0.159328 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.504652 0.185410 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.690484 0.162873 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:27.853726 0.157804 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:28.011945 0.182377 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:28.194727 0.175099 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:28.370276 0.168859 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:28.539604 0.000000 udp 10.0.2.105 7010 -> 79.227.147.182 2430 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 03:17:44.541093 0.035463 tcp 10.0.2.105 51016 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:44.576924 0.034945 tcp 10.0.2.105 51017 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:44.612196 0.125728 tcp 10.0.2.105 51018 -> 195.113.214.249 443 SRPA* 0 0 25 13938 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:17:44.738416 0.310741 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:45.049589 0.222108 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:45.272166 0.154587 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:45.427186 0.209830 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:45.637385 0.432092 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:46.069894 0.057075 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:46.127485 0.387026 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:46.514908 0.344767 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:46.860029 0.168643 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 452 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:47.029076 0.151419 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:47.180887 0.150876 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:47.332477 0.359460 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:17:47.692484 0.193955 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 470 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:18:45.571243 3.001470 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 03:18:52.578614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:19:00.599757 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:19:16.602758 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:19:48.608957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:25:52.615966 3.010880 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:25:59.633056 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:26:07.634013 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:26:23.636729 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:26:55.643138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:28:31.240892 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 03:28:31.241015 2.006827 tcp 10.0.2.105 51019 -> 211.38.175.27 4598 FSPA* 0 0 14 1573 flow=From-Botnet-V2-TCP-Established 1970/02/26 03:32:59.648741 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:33:06.659739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:33:14.658359 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:33:30.661625 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:34:02.666957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:40:06.672133 3.002455 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:40:13.680678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:40:21.681869 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:40:37.684768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:41:09.693668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:47:13.697388 3.001268 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:47:20.704727 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:47:28.705896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:47:44.708998 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:48:16.714576 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:48:17.947443 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 03:48:17.947566 0.113648 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.061642 0.046811 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.108861 0.221348 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.330650 0.041127 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.372163 0.073321 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.445902 0.125474 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.571866 0.168626 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.740951 0.152133 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:18.893537 0.182802 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 504 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:19.076818 0.175239 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:19.253545 0.193828 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 282 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:19.447763 0.162169 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 580 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:19.610335 0.163654 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:19.774332 0.304082 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:20.078868 0.209118 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:20.288373 0.478895 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 538 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:20.767641 0.042769 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:20.810839 0.143466 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:20.954680 0.211616 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:21.166801 0.367347 udp 10.0.2.105 7010 <-> 220.255.48.72 4003 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:21.534572 0.348628 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:21.883577 0.873916 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:22.757904 0.152887 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:22.911160 0.152143 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:23.063745 0.351511 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:48:23.415616 0.206458 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/26 03:54:20.723626 2.999022 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 03:54:27.727852 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:54:35.731701 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:54:51.733040 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:55:23.738933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 03:58:33.252375 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 03:58:33.252477 2.203428 tcp 10.0.2.105 51020 -> 211.38.175.27 4598 FSPA* 0 0 14 1735 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:01:27.746463 3.010266 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:01:34.762125 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:01:42.763793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:01:58.773840 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:02:30.772790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:08:34.779180 3.001652 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:08:41.786295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:08:49.788118 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:09:05.790934 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:09:37.803623 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:15:41.802571 3.008210 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:15:48.810088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:15:56.811986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:16:12.814976 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:16:44.820861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:18:45.704664 0.000110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 04:18:45.704857 0.220602 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:45.925827 0.040683 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:45.966974 0.028643 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:45.996100 0.042117 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.038660 0.080308 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.119387 0.125550 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.245367 0.177646 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.423459 0.153734 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.577591 0.181932 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.759975 0.163160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:46.923548 0.194032 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:47.117946 0.167235 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:47.285653 0.166186 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:47.452344 0.261008 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:47.713736 0.208558 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:47.922787 0.143603 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:48.066788 0.223680 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:48.290895 0.441242 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:48.732629 0.053667 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:18:48.786721 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 243 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 04:19:05.315278 0.039301 tcp 10.0.2.105 51021 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:19:05.354886 0.035528 tcp 10.0.2.105 51022 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:19:05.390788 0.116174 tcp 10.0.2.105 51023 -> 195.113.214.249 443 SRPA* 0 0 41 25557 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:19:05.507430 0.347737 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:19:05.855591 0.151571 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:19:06.007556 0.235171 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:19:06.243155 0.153813 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:19:06.397465 0.363231 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:19:06.761138 0.205890 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:22:48.826412 3.002436 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:22:55.834198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:23:03.835487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:23:19.838927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:23:51.844904 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:28:35.466295 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 04:28:35.466427 2.818673 tcp 10.0.2.105 51024 -> 211.38.175.27 4598 FSPA* 0 0 14 1659 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:29:55.850336 3.001745 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:30:02.857678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:30:10.860169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:30:26.862710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:30:58.868808 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:37:02.875776 3.000584 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:37:09.882994 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:37:17.885835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:37:33.886909 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:38:05.892918 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:44:09.899294 3.000672 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 04:44:16.912381 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:44:24.907743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:44:40.910723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:45:12.916798 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:49:17.428802 0.000089 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 04:49:17.428974 0.000000 udp 10.0.2.105 7010 -> 220.255.48.72 4003 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 04:49:35.996586 0.049874 tcp 10.0.2.105 51025 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:49:36.046716 0.039809 tcp 10.0.2.105 51026 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:49:36.086832 0.129845 tcp 10.0.2.105 51027 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:49:36.217278 0.040899 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.258558 0.029237 udp 10.0.2.105 7010 <-> 79.227.147.182 2430 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.288238 0.042433 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.331067 0.074678 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.406179 0.125470 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.532134 0.224002 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 433 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.756525 0.183499 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:36.940624 0.165057 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.106157 0.185253 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.291880 0.160140 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.452495 0.175700 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.628624 0.156660 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.785683 0.208568 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:37.994693 0.166596 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:38.161758 0.222950 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:38.385072 0.164098 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:38.549644 0.269017 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:38.819364 0.175160 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:38.995001 0.500064 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:39.495498 0.078861 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 223 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:39.574748 0.347888 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:39.927445 0.151814 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:40.079645 0.201339 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:40.281409 0.152912 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 04:49:40.434831 0.000000 udp 10.0.2.105 7010 -> 218.164.103.119 7010 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 04:49:57.286211 0.033695 tcp 10.0.2.105 51028 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:49:57.320198 0.033614 tcp 10.0.2.105 51029 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:49:57.354183 0.127356 tcp 10.0.2.105 51030 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:58:09.929793 3.008446 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 04:58:16.946915 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:58:24.945153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:58:38.285258 0.000067 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 04:58:38.285424 2.683405 tcp 10.0.2.105 51031 -> 211.38.175.27 4598 FSPA* 0 0 14 1515 flow=From-Botnet-V2-TCP-Established 1970/02/26 04:58:40.948725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 04:59:12.954755 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:05:16.963130 2.999482 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:05:23.969962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:05:31.969785 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:05:47.972399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:06:19.978206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:12:23.985977 3.000402 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:12:30.991866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:12:38.996677 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:12:54.996767 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:13:27.002795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:19:31.009317 3.000768 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:19:38.016059 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:19:46.017546 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:20:02.020458 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:20:03.803525 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:20:03.803712 0.000000 udp 10.0.2.105 7010 -> 218.164.103.119 7010 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:20:22.702537 0.033095 tcp 10.0.2.105 51032 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:22.735885 0.056926 tcp 10.0.2.105 51033 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:22.793105 0.139114 tcp 10.0.2.105 51034 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:22.932800 0.048619 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:22.981812 0.074931 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:23.057148 0.125550 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:23.183087 0.220892 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:23.404616 0.182146 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:23.587232 0.041343 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:23.628971 0.000000 udp 10.0.2.105 7010 -> 79.227.147.182 2430 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:20:34.026401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:20:41.698104 0.035628 tcp 10.0.2.105 51035 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:41.733999 0.033927 tcp 10.0.2.105 51036 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:41.768187 0.129671 tcp 10.0.2.105 51037 -> 195.113.214.249 443 SRPA* 0 0 21 11768 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:20:41.898441 0.162024 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.060912 0.169678 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.231062 0.156107 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.387587 0.164462 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.552491 0.185341 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.738224 0.213729 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:42.952548 0.165066 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:43.118081 0.208641 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:43.327222 0.177566 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:43.505192 0.424610 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 310 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:43.930247 0.229797 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:44.160481 0.047138 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:44.208045 0.202549 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:44.410980 0.348951 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:44.760422 0.118184 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:44.879042 0.152057 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:45.031550 0.154259 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:45.424368 0.000000 udp 10.0.2.105 7010 -> 79.227.147.182 2430 REQ 0 1 304 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:20:53.063792 0.125688 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 810 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:20:53.189934 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 REQ 0 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:00.367045 0.049296 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 792 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:00.417007 0.040235 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:00.457698 0.184378 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 825 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:00.642549 0.220543 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 803 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:00.863533 0.169160 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 726 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:01.033149 0.158483 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 776 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:01.192107 0.161301 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 795 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:01.354018 0.000000 udp 10.0.2.105 7010 -> 68.56.221.70 8447 REQ 0 0 1 305 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:05.492404 0.000045 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:21:09.036321 0.186007 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 745 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:09.222778 0.208491 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 750 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:09.431679 0.170200 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 758 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:09.602421 0.207771 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:09.810730 0.443840 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 827 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:10.255090 0.251186 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 772 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:10.506692 0.058725 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:10.565867 0.161258 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:10.727664 0.204053 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 670 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:10.932306 0.349408 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 710 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:11.282223 0.118121 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:11.400823 0.153231 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:11.554477 0.154372 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:11.709390 0.000000 udp 10.0.2.105 7010 -> 87.25.37.123 6604 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:20.072833 0.000000 udp 10.0.2.105 7010 -> 113.116.190.102 8738 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:25.691001 0.047160 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 729 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:21:25.767272 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 116 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:30.487124 0.000084 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:21:31.389106 0.000000 udp 10.0.2.105 7010 -> 50.194.95.142 1806 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:39.211212 0.000000 udp 10.0.2.105 7010 -> 94.14.205.57 3149 INT 0 1 233 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:46.276796 0.000000 udp 10.0.2.105 7010 -> 2.14.5.180 7556 INT 0 1 145 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:51.719704 0.000000 udp 10.0.2.105 7010 -> 49.147.95.187 9574 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:21:56.484761 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:21:58.217619 0.000000 udp 10.0.2.105 7010 -> 92.103.102.98 4423 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:06.979976 0.000000 udp 10.0.2.105 7010 -> 126.64.217.6 6888 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:13.391798 0.000000 udp 10.0.2.105 7010 -> 94.64.110.6 8868 INT 0 1 201 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:20.129453 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:24.985868 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:22:27.510535 0.000000 udp 10.0.2.105 7010 -> 93.180.16.23 6280 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:33.748394 0.000000 udp 10.0.2.105 7010 -> 94.66.63.51 5377 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:39.006342 0.147723 udp 10.0.2.105 7010 <-> 37.99.112.166 8113 CON 0 0 2 786 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:22:39.428037 0.000000 udp 10.0.2.105 7010 -> 24.240.171.82 8021 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:47.408469 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 115 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:22:51.984804 0.000113 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:22:54.879279 0.000000 udp 10.0.2.105 7010 -> 173.65.4.44 5672 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:02.251802 0.084873 udp 10.0.2.105 7010 <-> 79.129.138.103 6161 CON 0 0 2 692 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:23:02.347051 0.000000 udp 10.0.2.105 7010 -> 80.28.159.218 6380 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:10.030902 0.000000 udp 10.0.2.105 7010 -> 95.224.27.14 5692 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:15.568845 0.000000 udp 10.0.2.105 7010 -> 218.188.206.39 7384 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:20.486234 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:23:20.936900 0.000000 udp 10.0.2.105 7010 -> 93.193.134.158 7662 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:27.826427 0.000000 udp 10.0.2.105 7010 -> 84.56.112.8 3156 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:36.080307 0.000000 udp 10.0.2.105 7010 -> 79.40.165.88 5817 INT 0 1 155 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:44.413362 0.059729 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 697 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:23:44.485077 0.000000 udp 10.0.2.105 7010 -> 152.26.13.1 9815 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:48.986595 0.000126 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:23:53.042953 0.156919 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:23:53.222076 0.000000 udp 10.0.2.105 7010 -> 92.45.112.161 2943 INT 0 1 205 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:23:59.502101 0.000000 udp 10.0.2.105 7010 -> 186.188.42.67 2459 INT 0 1 271 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:07.523394 0.000000 udp 10.0.2.105 7010 -> 95.247.231.93 5817 INT 0 1 144 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:16.085974 0.099515 udp 10.0.2.105 7010 -> 37.54.56.148 1950 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:16.185489 0.000000 icmp 37.54.56.148 0x0303 -> 10.0.2.105 0x9e07 URP 192 1 196 flow=Background 1970/02/26 05:24:20.982722 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:24:24.077424 0.000000 udp 10.0.2.105 7010 -> 80.241.249.86 2119 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:32.579585 0.000000 udp 10.0.2.105 7010 -> 46.151.79.173 2230 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:37.877318 0.000000 udp 10.0.2.105 7010 -> 212.131.238.11 7208 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:46.590037 0.045422 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 847 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:24:46.646177 0.000000 udp 10.0.2.105 7010 -> 94.44.255.226 3680 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:24:51.486420 0.000136 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:24:54.911964 0.000000 udp 10.0.2.105 7010 -> 86.179.171.56 9633 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:00.379517 0.000000 udp 10.0.2.105 7010 -> 2.34.177.36 4625 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:07.339665 0.064760 udp 10.0.2.105 7010 <-> 86.173.101.230 7823 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:25:07.445376 0.689291 udp 10.0.2.105 7010 <-> 72.251.12.191 2321 CON 0 0 2 859 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:25:08.213048 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:13.378333 0.000000 udp 10.0.2.105 7010 -> 24.116.157.154 2935 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:17.984508 0.000070 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:25:20.939117 0.000000 udp 10.0.2.105 7010 -> 63.255.62.90 6159 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:29.080977 0.000000 udp 10.0.2.105 7010 -> 180.215.80.156 7340 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:37.082330 0.182463 udp 10.0.2.105 7010 -> 190.80.239.34 3759 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:37.264793 0.000000 icmp 190.80.239.34 0x0303 -> 10.0.2.105 0xaf0e URP 192 1 154 flow=Background 1970/02/26 05:25:41.989105 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:25:44.292800 0.000000 udp 10.0.2.105 7010 -> 109.150.5.128 2915 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:25:53.155432 0.000000 udp 10.0.2.105 7010 -> 95.245.23.170 3641 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:01.581235 0.000000 udp 10.0.2.105 7010 -> 105.225.208.87 1700 INT 0 1 125 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:06.484482 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:26:10.530227 0.000000 udp 10.0.2.105 7010 -> 84.173.21.156 7912 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:16.398869 0.000000 udp 10.0.2.105 7010 -> 75.236.62.253 6550 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:24.761082 0.000000 udp 10.0.2.105 7010 -> 151.64.16.195 2163 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:33.333214 0.000000 udp 10.0.2.105 7010 -> 107.212.117.79 8303 INT 0 1 283 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:37.991547 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:26:38.035051 2.999059 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 05:26:39.912838 0.000000 udp 10.0.2.105 7010 -> 79.33.7.53 2593 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:45.040023 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:26:45.941324 0.000000 udp 10.0.2.105 7010 -> 181.114.70.15 1042 INT 0 1 220 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:51.669126 0.000000 udp 10.0.2.105 7010 -> 95.224.135.132 7634 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:26:53.041366 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:26:57.528379 0.000000 udp 10.0.2.105 7010 -> 95.245.47.48 5580 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:02.486731 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:27:04.197633 0.184726 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 700 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:04.394930 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:09.044568 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:27:11.467849 0.053646 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 790 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:11.530557 0.087451 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 724 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:11.628142 0.000000 udp 10.0.2.105 7010 -> 79.29.246.107 9258 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:20.220712 0.024108 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 757 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:20.261958 0.000000 udp 10.0.2.105 7010 -> 176.73.158.232 1767 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:25.648620 0.184618 udp 10.0.2.105 7010 <-> 128.111.92.83 7922 CON 0 0 2 687 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:25.865663 0.000000 udp 10.0.2.105 7010 -> 130.204.63.59 8142 INT 0 1 246 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:30.486485 0.000112 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:27:33.840149 0.000000 udp 10.0.2.105 7010 -> 41.215.151.144 4902 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:41.050215 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:27:41.471044 0.160658 udp 10.0.2.105 7010 <-> 2.192.231.146 9511 CON 0 0 2 668 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:41.646005 0.176056 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:41.845959 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:50.005016 0.053566 udp 10.0.2.105 7010 -> 95.117.134.229 2482 INT 0 1 187 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:27:50.058582 0.000000 icmp 95.117.134.229 0x0d03 -> 10.0.2.105 0x0000 URFIL 192 1 187 flow=Background 1970/02/26 05:27:54.990204 0.000185 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:27:56.595238 0.339669 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 839 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:56.945427 0.096941 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 663 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:27:57.069689 0.000000 udp 10.0.2.105 7010 -> 75.2.213.222 5231 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:03.823290 0.077142 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 691 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:28:03.944685 0.000000 udp 10.0.2.105 7010 -> 188.121.218.101 1995 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:09.722034 0.000000 udp 10.0.2.105 7010 -> 151.56.132.117 7955 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:15.530135 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 130 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:20.486693 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:28:23.962412 0.000000 udp 10.0.2.105 7010 -> 49.245.222.169 9731 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:31.012671 0.000000 udp 10.0.2.105 7010 -> 80.13.85.187 6632 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:38.875237 0.000000 udp 10.0.2.105 7010 -> 118.44.163.92 4441 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:40.977369 0.781633 tcp 10.0.2.105 51038 -> 211.38.175.27 4598 SPA_* 0 0 9 1182 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:28:44.812580 0.000000 udp 10.0.2.105 7010 -> 110.143.131.101 7355 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:47.393532 0.008163 tcp 10.0.2.105 51038 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 05:28:50.360087 0.000000 udp 10.0.2.105 7010 -> 72.89.102.42 2280 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:28:56.298827 0.195314 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:28:56.509305 0.070556 udp 10.0.2.105 7010 <-> 88.238.90.87 2925 CON 0 0 2 715 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:28:56.611819 0.057747 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 849 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:28:56.726665 0.000000 udp 10.0.2.105 7010 -> 203.125.247.226 5590 INT 0 1 228 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:01.977116 0.000000 udp 10.0.2.105 7010 -> 71.50.58.185 5256 INT 0 1 282 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:08.466235 0.000000 udp 10.0.2.105 7010 -> 95.241.246.203 7271 INT 0 1 294 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:12.982650 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:29:16.647370 0.000000 udp 10.0.2.105 7010 -> 82.51.107.218 9485 INT 0 1 248 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:21.815590 0.000000 udp 10.0.2.105 7010 -> 173.237.199.187 1817 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:27.403403 0.000000 udp 10.0.2.105 7010 -> 95.230.96.137 9692 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:34.473679 0.000000 udp 10.0.2.105 7010 -> 86.21.151.171 6169 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:38.989964 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:29:42.575474 0.056286 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 742 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:29:42.652682 0.000000 udp 10.0.2.105 7010 -> 173.188.242.222 5259 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:49.835942 0.000000 udp 10.0.2.105 7010 -> 79.2.208.132 2363 INT 0 1 174 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:29:56.124809 0.000000 udp 10.0.2.105 7010 -> 201.230.151.170 4844 INT 0 1 131 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:04.066786 0.185706 udp 10.0.2.105 7010 -> 190.112.225.139 3692 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:04.252492 0.000000 icmp 190.112.225.139 0x0303 -> 10.0.2.105 0x6c0e URP 192 1 237 flow=Background 1970/02/26 05:30:08.983017 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:30:09.574070 0.000000 udp 10.0.2.105 7010 -> 78.146.18.155 9574 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:18.536856 0.000000 udp 10.0.2.105 7010 -> 95.227.151.231 5519 INT 0 1 244 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:24.225317 0.000000 udp 10.0.2.105 7010 -> 218.164.103.119 7010 INT 0 1 237 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:30.294084 0.000000 udp 10.0.2.105 7010 -> 79.38.126.135 1109 INT 0 1 166 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:34.992424 0.000082 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:30:39.047107 0.000000 udp 10.0.2.105 7010 -> 92.66.231.65 4362 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:45.856120 0.000000 udp 10.0.2.105 7010 -> 85.171.203.185 6734 INT 0 1 157 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:52.345503 0.000000 udp 10.0.2.105 7010 -> 182.48.201.48 9617 INT 0 1 273 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:57.883562 0.140019 udp 10.0.2.105 7010 -> 192.211.55.30 3709 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:30:58.023581 0.000000 icmp 192.211.55.30 0x0303 -> 10.0.2.105 0x7d0e URP 192 1 190 flow=Background 1970/02/26 05:31:02.490378 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:31:04.332882 0.000000 udp 10.0.2.105 7010 -> 220.185.140.80 6923 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:09.740966 0.000000 udp 10.0.2.105 7010 -> 62.49.65.225 3917 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:17.551971 0.000000 udp 10.0.2.105 7010 -> 79.46.249.237 3858 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:24.011185 0.000000 udp 10.0.2.105 7010 -> 96.31.226.46 2106 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:28.988020 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:31:29.338880 0.056196 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:31:29.405922 0.092768 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 838 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:31:29.507911 0.000000 udp 10.0.2.105 7010 -> 75.77.11.138 8762 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:34.576582 0.055553 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:31:34.646912 0.000000 udp 10.0.2.105 7010 -> 86.186.125.249 2959 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:42.738256 0.213328 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 822 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:31:44.196567 0.069405 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 854 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:31:44.334267 0.000000 udp 10.0.2.105 7010 -> 64.89.248.141 2999 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:52.811967 0.000000 udp 10.0.2.105 7010 -> 65.116.87.165 6896 INT 0 1 267 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:31:57.488746 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:31:58.911427 0.000000 udp 10.0.2.105 7010 -> 86.136.180.112 7670 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:32:06.231875 0.000000 udp 10.0.2.105 7010 -> 210.11.5.74 8551 INT 0 1 167 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:32:12.641301 0.000000 udp 10.0.2.105 7010 -> 95.230.10.88 1517 INT 0 1 221 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:32:19.441304 0.156456 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 733 flow=From-Botnet-V2-UDP-Established 1970/02/26 05:32:19.619847 0.000000 udp 10.0.2.105 7010 -> 146.185.56.190 8355 INT 0 1 311 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:32:23.987265 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:32:26.130796 0.000000 udp 10.0.2.105 7010 -> 87.203.119.206 3236 INT 0 1 277 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:32:33.160751 0.000000 udp 10.0.2.105 7010 -> 50.84.50.211 9576 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 05:33:45.056962 3.001338 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 05:33:52.063833 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:34:00.065231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:34:16.071733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:34:48.073803 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:40:52.081138 3.000886 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:40:59.087725 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:41:07.089431 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:41:23.092521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:41:55.102793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:47:59.105523 3.000441 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:48:06.111819 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:48:14.113416 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:48:30.116141 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:49:02.122339 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:55:06.131031 2.998874 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 05:55:13.136223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:55:21.137305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:55:37.140412 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:56:09.147157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 05:58:47.404139 0.000218 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 05:58:47.404443 3.989432 tcp 10.0.2.105 51039 -> 211.38.175.27 4598 FSPA* 0 0 15 1779 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:02:13.152811 3.001186 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:02:20.159710 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:02:28.161379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:02:44.164185 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:02:49.903152 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 06:02:49.903347 0.125484 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.029261 0.089768 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.119413 0.040317 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.160177 0.181890 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.342508 0.221083 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.563937 0.169550 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.733962 0.156005 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:50.890414 0.159560 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:51.050484 0.192076 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:51.242948 0.221601 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:51.464952 0.435510 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:51.900859 0.208886 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:52.110171 0.162635 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:52.273191 0.055451 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:52.329043 0.170036 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:52.499497 0.198480 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:52.698363 0.341396 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:02:53.040221 0.000000 udp 10.0.2.105 7010 -> 59.91.121.129 7978 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:03:09.542400 0.037188 tcp 10.0.2.105 51040 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:09.579854 0.032765 tcp 10.0.2.105 51041 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:09.612883 0.144909 tcp 10.0.2.105 51042 -> 195.113.214.249 443 SRPA* 0 0 41 33024 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:09.758415 0.086495 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:09.845291 0.152629 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:09.998352 0.153493 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 578 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:10.152257 0.045060 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:10.197792 0.000000 udp 10.0.2.105 7010 -> 37.99.112.166 8113 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:03:16.170342 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:03:27.897725 0.033512 tcp 10.0.2.105 51043 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:27.931622 0.038252 tcp 10.0.2.105 51044 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:27.970176 0.209491 tcp 10.0.2.105 51045 -> 195.113.214.249 443 SRPA* 0 0 40 21978 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:28.180495 0.000000 udp 10.0.2.105 7010 -> 79.129.138.103 6161 INT 0 1 127 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:03:44.321626 0.031349 tcp 10.0.2.105 51046 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:44.353297 0.035502 tcp 10.0.2.105 51047 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:44.389100 0.157365 tcp 10.0.2.105 51048 -> 195.113.214.249 443 SRPA* 0 0 41 33024 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:03:44.547196 0.060824 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:44.608562 0.153180 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:44.762101 0.044501 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:44.806978 0.500003 udp 10.0.2.105 7010 <-> 72.251.12.191 2321 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.307352 0.055416 udp 10.0.2.105 7010 <-> 86.173.101.230 7823 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.363157 0.182434 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.545997 0.082976 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.629377 0.054481 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.684280 0.026925 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.711632 0.171664 udp 10.0.2.105 7010 <-> 128.111.92.83 7922 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:45.883741 0.132624 udp 10.0.2.105 7010 <-> 2.192.231.146 9511 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:46.016779 0.090368 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:46.107568 0.349222 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:46.457171 0.096719 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:03:46.554275 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:04:01.716489 0.031699 tcp 10.0.2.105 51049 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:01.748575 0.081795 tcp 10.0.2.105 51050 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:01.830691 0.152755 tcp 10.0.2.105 51051 -> 195.113.214.249 443 SRPA* 0 0 23 13962 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:01.984028 0.057387 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.041828 0.069252 udp 10.0.2.105 7010 <-> 88.238.90.87 2925 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.111651 0.184776 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.296941 0.059922 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.357248 0.093815 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.451494 0.055742 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.507577 0.055322 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:02.563319 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 255 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:04:18.791706 0.040436 tcp 10.0.2.105 51052 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:18.832576 0.033585 tcp 10.0.2.105 51053 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:18.866441 0.127755 tcp 10.0.2.105 51054 -> 195.113.214.249 443 SRPA* 0 0 55 33744 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:04:18.994746 0.068799 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:04:19.063996 0.150259 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:09:20.176079 3.011600 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 06:09:27.193665 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:09:35.195375 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:09:51.198065 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:10:23.204126 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:16:27.209919 3.002021 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:16:34.217604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:16:42.218951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:16:58.222053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:17:30.228309 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:23:34.234706 3.001392 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:23:41.241579 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:23:49.243139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:24:05.246198 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:24:37.252157 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:28:51.397970 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 06:28:51.398082 3.676385 tcp 10.0.2.105 51055 -> 211.38.175.27 4598 FSPA* 0 0 12 1474 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:28:57.642299 0.000188 tcp 10.0.2.105 51055 -> 211.38.175.27 4598 A_FA 0 0 2 108 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:30:41.259476 3.000295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:30:48.265373 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:30:56.267068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:31:12.270080 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:31:44.275938 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:34:21.422497 0.000085 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 06:34:21.422663 0.301361 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:21.724735 0.182712 udp 10.0.2.105 7010 <-> 37.99.112.166 8113 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:21.907819 0.000000 udp 10.0.2.105 7010 -> 79.129.138.103 6161 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:34:38.258128 0.033543 tcp 10.0.2.105 51056 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:38.292032 0.034651 tcp 10.0.2.105 51057 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:38.327007 0.127258 tcp 10.0.2.105 51058 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:38.454828 0.241233 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:38.696540 0.212767 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:38.909708 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:34:56.543272 0.034463 tcp 10.0.2.105 51059 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:56.577993 0.032215 tcp 10.0.2.105 51060 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:56.610475 0.134827 tcp 10.0.2.105 51061 -> 195.113.214.249 443 SRPA* 0 0 40 22016 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:34:56.745197 0.050020 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:56.795627 0.125197 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:56.921252 0.214854 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:57.136682 0.170731 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:57.307852 0.183509 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:57.491910 1.537222 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 305 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:59.029581 0.203853 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:59.233895 0.158492 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:59.396479 0.196766 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:34:59.593624 0.422421 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:00.016640 0.500035 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:00.517123 0.157421 udp 10.0.2.105 7010 <-> 71.72.224.26 1511 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:00.674947 0.202642 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 438 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:00.878062 0.262043 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:01.140555 0.166595 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:01.307567 0.343835 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:01.651782 0.153809 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:01.805946 0.091477 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:01.897792 0.153956 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.052121 0.048467 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 464 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.101010 0.154484 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.255935 0.058826 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.315263 0.044181 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.359820 0.482949 udp 10.0.2.105 7010 <-> 72.251.12.191 2321 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.843227 0.057613 udp 10.0.2.105 7010 <-> 86.173.101.230 7823 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.901249 0.024918 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:02.926589 0.185389 udp 10.0.2.105 7010 <-> 128.111.92.83 7922 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:03.112612 0.000000 udp 10.0.2.105 7010 -> 2.192.231.146 9511 INT 0 1 252 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:35:18.434907 0.031467 tcp 10.0.2.105 51062 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:18.466658 0.033764 tcp 10.0.2.105 51063 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:18.500719 0.144412 tcp 10.0.2.105 51064 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:18.645686 0.092050 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:18.738104 0.053814 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:18.792353 0.083099 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:18.875856 0.186740 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:19.063109 0.097335 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:19.160842 0.000000 udp 10.0.2.105 7010 -> 202.66.77.193 7693 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 06:35:34.547598 0.032846 tcp 10.0.2.105 51065 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:34.580730 0.035301 tcp 10.0.2.105 51066 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:34.616388 0.135137 tcp 10.0.2.105 51067 -> 195.113.214.249 443 SRPA* 0 0 31 13598 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:35:34.752067 0.055618 udp 10.0.2.105 7010 <-> 95.104.54.85 8509 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:34.808060 0.063491 udp 10.0.2.105 7010 <-> 88.238.90.87 2925 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:34.871960 0.087771 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:34.960450 0.054905 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 268 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:35.015789 0.057228 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:35.073450 0.190106 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:35.263954 0.054912 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:35.319254 0.072132 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:35:35.391787 0.146274 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/26 06:37:48.283541 3.000172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 06:37:55.289837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:38:03.290916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:38:19.293990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:38:51.300152 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:44:55.306393 3.001595 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:45:02.313521 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:45:10.314855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:45:26.320385 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:45:58.323886 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:58:33.332552 3.001586 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 06:58:40.340438 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:58:48.344906 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:58:55.081332 0.000151 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 06:58:55.081599 0.716370 tcp 10.0.2.105 51068 -> 211.38.175.27 4598 SPA_* 0 0 9 1093 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:59:01.054604 0.023634 tcp 10.0.2.105 51068 -> 211.38.175.27 4598 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/26 06:59:04.344071 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 06:59:36.350797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:05:40.355822 3.002293 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:05:47.363435 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:05:48.315477 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 07:05:48.315636 0.041647 udp 10.0.2.105 7010 <-> 84.186.65.149 7869 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:05:48.357763 0.000000 udp 10.0.2.105 7010 -> 2.192.231.146 9511 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:05:55.365291 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:06:03.778620 0.033311 tcp 10.0.2.105 51069 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:03.812216 0.033064 tcp 10.0.2.105 51070 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:03.845617 0.133362 tcp 10.0.2.105 51071 -> 195.113.214.249 443 SRPA* 0 0 41 22658 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:03.979535 0.305000 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:04.284912 0.120062 udp 10.0.2.105 7010 <-> 37.99.112.166 8113 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:04.405410 0.261963 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:04.667836 0.213207 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:04.881521 0.288148 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.170062 0.220258 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.390691 0.124783 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.515896 0.043329 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.559709 0.169398 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.729498 0.183805 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:05.913726 0.161046 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:06.075159 0.222788 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:06.298385 0.151478 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:06.450300 0.188771 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:06.639440 0.432479 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:07.072519 0.998887 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:08.071840 0.144709 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:08.217043 0.000000 udp 10.0.2.105 7010 -> 71.72.224.26 1511 INT 0 1 262 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:06:11.368443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:06:27.211812 0.036653 tcp 10.0.2.105 51072 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:27.248734 0.033922 tcp 10.0.2.105 51073 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:27.282918 0.127169 tcp 10.0.2.105 51074 -> 195.113.214.249 443 SRPA* 0 0 41 21628 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:27.410751 0.208964 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:27.620146 0.474436 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.095089 0.093063 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.188626 0.146570 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.335672 0.046258 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.382330 0.152949 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.535656 0.058345 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.594380 0.045336 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.640098 0.347842 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:28.988423 0.153379 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:29.145165 0.000000 udp 10.0.2.105 7010 -> 128.111.92.83 7922 INT 0 1 194 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:06:43.375265 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:06:45.918495 0.032870 tcp 10.0.2.105 51075 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:45.951768 0.032461 tcp 10.0.2.105 51076 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:45.984514 0.137746 tcp 10.0.2.105 51077 -> 195.113.214.249 443 SRPA* 0 0 21 11806 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:06:46.122855 0.093836 udp 10.0.2.105 7010 <-> 86.173.101.230 7823 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:46.217089 0.535633 udp 10.0.2.105 7010 <-> 72.251.12.191 2321 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:46.753116 0.023771 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:46.777328 0.084060 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:46.861894 0.183627 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:47.045896 0.096694 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 491 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:47.142985 0.054316 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:47.197709 0.095784 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 564 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:06:47.293872 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 276 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:07:04.194501 0.032389 tcp 10.0.2.105 51078 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:04.226715 0.032638 tcp 10.0.2.105 51079 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:04.259702 0.129627 tcp 10.0.2.105 51080 -> 195.113.214.249 443 SRPA* 0 0 23 13166 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:04.389978 0.069587 udp 10.0.2.105 7010 <-> 88.238.90.87 2925 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.459985 0.094231 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.554663 0.066212 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.621308 0.054820 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.676518 0.184537 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.861531 0.057473 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:07:04.919453 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:07:22.911774 0.032332 tcp 10.0.2.105 51081 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:22.943940 0.083658 tcp 10.0.2.105 51082 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:23.027860 0.138186 tcp 10.0.2.105 51083 -> 195.113.214.249 443 SRPA* 0 0 20 10918 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:07:23.166547 0.148934 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:12:47.380397 3.001498 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:12:54.387605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:13:02.389222 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:13:18.395153 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:13:50.397951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:19:54.420311 2.985531 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:20:01.411436 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:20:09.413137 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:20:25.416113 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:20:57.421992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:27:01.428041 3.001705 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:27:08.435419 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:27:16.437206 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:27:32.440460 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:28:04.448421 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:29:01.077793 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 07:29:01.077943 2.410752 tcp 10.0.2.105 51084 -> 211.38.175.27 4598 FSPA* 0 0 14 1561 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:34:08.470378 2.983356 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:34:15.459368 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:34:23.463495 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:34:39.463974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:35:11.469830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:37:46.453397 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 07:37:46.453555 0.000000 udp 10.0.2.105 7010 -> 71.72.224.26 1511 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:38:03.178583 0.048496 tcp 10.0.2.105 51085 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:03.227367 0.037476 tcp 10.0.2.105 51086 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:03.265142 0.126657 tcp 10.0.2.105 51087 -> 195.113.214.249 443 SRPA* 0 0 36 30212 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:03.392601 0.000000 udp 10.0.2.105 7010 -> 128.111.92.83 7922 INT 0 1 176 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:38:19.030104 0.033368 tcp 10.0.2.105 51088 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:19.063762 0.040069 tcp 10.0.2.105 51089 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:19.104122 0.128358 tcp 10.0.2.105 51090 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:19.233109 0.000000 udp 10.0.2.105 7010 -> 95.104.54.85 8509 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:38:36.315184 0.031833 tcp 10.0.2.105 51091 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:36.347314 0.034597 tcp 10.0.2.105 51092 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:36.382270 0.131179 tcp 10.0.2.105 51093 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:36.514048 0.062962 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:38:36.577462 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:38:53.579978 0.031979 tcp 10.0.2.105 51094 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:53.612219 0.033166 tcp 10.0.2.105 51095 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:53.645610 0.148968 tcp 10.0.2.105 51096 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:38:53.795074 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:39:11.636160 0.037394 tcp 10.0.2.105 51097 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:11.673446 0.039917 tcp 10.0.2.105 51098 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:11.713675 0.132781 tcp 10.0.2.105 51099 -> 195.113.214.249 443 SRPA* 0 0 50 27692 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:11.847212 0.000000 udp 10.0.2.105 7010 -> 59.91.121.129 7978 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:39:29.852212 0.031513 tcp 10.0.2.105 51100 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:29.884091 0.033607 tcp 10.0.2.105 51101 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:29.917983 0.133964 tcp 10.0.2.105 51102 -> 195.113.214.249 443 SRPA* 0 0 22 11822 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:30.052726 0.312536 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:30.365659 0.216729 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:30.582891 0.000000 udp 10.0.2.105 7010 -> 37.99.112.166 8113 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:39:48.869748 0.031414 tcp 10.0.2.105 51103 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:48.901464 0.034811 tcp 10.0.2.105 51104 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:48.936592 0.127474 tcp 10.0.2.105 51105 -> 195.113.214.249 443 SRPA* 0 0 22 13150 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:39:49.064631 0.183462 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.248486 0.161135 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.410044 0.168097 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.578521 0.155289 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.734202 0.191377 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.926004 0.042573 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:49.968927 0.125823 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:50.095136 0.221532 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:50.317126 0.208960 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 512 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:50.526560 0.424568 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 447 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:50.951579 0.044510 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:50.996536 0.144056 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.140978 0.046770 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.188175 0.150398 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.338972 0.059372 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.398725 0.044882 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.444065 0.203851 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.648266 0.154459 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.803141 0.153787 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:51.957331 0.205659 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.163385 0.153400 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.317209 0.349518 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.667156 0.053656 udp 10.0.2.105 7010 <-> 86.173.101.230 7823 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.721287 0.084858 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.806586 0.182812 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:52.989866 0.097094 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:53.087385 0.053335 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:53.141205 0.091728 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 306 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:53.233290 0.025280 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:39:53.258991 0.000000 udp 10.0.2.105 7010 -> 72.251.12.191 2321 INT 0 1 88 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:40:09.369027 0.032339 tcp 10.0.2.105 51106 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:09.401663 0.036576 tcp 10.0.2.105 51107 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:09.438540 0.133077 tcp 10.0.2.105 51108 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:09.572228 0.055394 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:40:09.627984 0.191801 udp 10.0.2.105 7010 <-> 174.89.104.63 6960 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:40:09.820120 0.056731 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:40:09.877317 0.000000 udp 10.0.2.105 7010 -> 88.238.90.87 2925 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 07:40:24.891693 0.031765 tcp 10.0.2.105 51109 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:24.923742 0.033188 tcp 10.0.2.105 51110 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:24.957222 0.135387 tcp 10.0.2.105 51111 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 07:40:25.093199 0.093675 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:40:25.187289 0.057372 udp 10.0.2.105 7010 <-> 46.49.112.20 3869 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:40:25.245073 0.146539 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 07:41:15.476959 3.000468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 07:41:22.483320 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:41:30.484920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:41:46.487827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:42:18.493872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:48:22.500300 3.001823 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:48:29.510148 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:48:37.508986 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:48:53.511859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:49:25.520228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:55:29.524067 3.001608 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 07:55:36.531831 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:55:44.533057 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:56:00.535761 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:56:32.541883 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 07:59:03.489193 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 07:59:03.489291 3.199864 tcp 10.0.2.105 51112 -> 211.38.175.27 4598 FSPA* 0 0 14 1723 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:02:36.547463 3.002121 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:02:43.555449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:02:51.556917 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:03:07.559846 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:03:39.565837 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:09:43.571288 3.002098 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:09:50.578664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:09:58.580851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:10:14.583871 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:10:46.589781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:10:49.824639 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 08:10:49.824812 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 269 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:11:07.242004 0.126165 tcp 10.0.2.105 51113 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:07.368471 0.033691 tcp 10.0.2.105 51114 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:07.402538 0.136413 tcp 10.0.2.105 51115 -> 195.113.214.249 443 SRPA* 0 0 46 37242 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:07.539624 0.238542 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 202 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:11:07.778574 0.000000 udp 10.0.2.105 7010 -> 37.99.112.166 8113 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:11:26.598149 0.036990 tcp 10.0.2.105 51116 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:26.635444 0.034548 tcp 10.0.2.105 51117 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:26.670304 0.130167 tcp 10.0.2.105 51118 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:26.801119 0.339696 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:11:27.141246 0.000000 udp 10.0.2.105 7010 -> 72.251.12.191 2321 INT 0 1 231 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:11:44.063359 0.033310 tcp 10.0.2.105 51119 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:44.096927 0.035325 tcp 10.0.2.105 51120 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:44.132671 0.133713 tcp 10.0.2.105 51121 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:11:44.266956 0.000000 udp 10.0.2.105 7010 -> 88.238.90.87 2925 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:12:02.249394 0.031716 tcp 10.0.2.105 51122 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:02.281418 0.037876 tcp 10.0.2.105 51123 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:02.319652 0.128403 tcp 10.0.2.105 51124 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:02.448627 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 114 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:12:19.474110 0.031852 tcp 10.0.2.105 51125 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:19.506290 0.033572 tcp 10.0.2.105 51126 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:19.540131 0.160372 tcp 10.0.2.105 51127 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:19.700966 0.307184 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.008725 0.212339 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.221519 0.183090 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.405063 0.178360 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.583924 0.052932 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.637317 0.124385 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 548 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.762106 0.221674 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 514 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:20.984184 0.156652 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.141223 0.176378 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.318007 0.159273 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.477676 0.145213 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.623452 0.045628 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.669461 0.155022 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.824963 0.059845 udp 10.0.2.105 7010 <-> 95.160.227.82 1351 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:21.885187 0.426355 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:22.312021 0.049447 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:22.361930 0.210102 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 283 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:22.572427 0.543073 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.115949 0.146225 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.262557 0.047283 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.310267 0.147890 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.458531 0.202476 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.661424 0.153911 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.815799 0.084049 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:23.900189 0.186563 udp 10.0.2.105 7010 <-> 68.224.96.174 9675 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:24.087245 0.126922 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:24.214559 0.052884 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:24.267876 0.093080 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:24.361382 0.023296 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 575 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:24.385168 0.000000 udp 10.0.2.105 7010 -> 86.173.101.230 7823 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:12:41.415554 0.032336 tcp 10.0.2.105 51128 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:41.448240 0.046992 tcp 10.0.2.105 51129 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:41.495545 0.131924 tcp 10.0.2.105 51130 -> 195.113.214.249 443 SRPA* 0 0 23 13204 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:41.627971 0.343003 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:12:41.971363 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 111 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:12:59.942039 0.031597 tcp 10.0.2.105 51131 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:12:59.973956 0.035160 tcp 10.0.2.105 51132 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:13:00.009387 0.136068 tcp 10.0.2.105 51133 -> 195.113.214.249 443 SRPA* 0 0 22 12486 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:13:00.146000 0.092417 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:13:00.238858 0.056619 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:13:00.295892 0.146812 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:13:00.443222 0.091710 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 436 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:13:00.535339 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:13:19.249893 0.037431 tcp 10.0.2.105 51134 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:13:19.287637 0.033557 tcp 10.0.2.105 51135 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:13:19.321545 0.129930 tcp 10.0.2.105 51136 -> 195.113.214.249 443 SRPA* 0 0 42 35466 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:16:50.595367 3.011635 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 08:16:57.613430 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:17:05.614903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:17:21.617960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:17:53.623813 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:23:57.630755 3.000610 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:24:04.637230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:24:12.639131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:24:28.642028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:25:00.651466 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:29:06.692046 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 08:29:06.692205 4.004490 tcp 10.0.2.105 51137 -> 211.38.175.27 4598 FSPA* 0 0 14 1591 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:31:04.653518 3.002504 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:31:11.661267 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:31:19.662282 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:31:35.665332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:32:07.671992 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:38:11.677537 3.001461 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:38:18.685132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:38:26.686605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:38:42.690362 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:39:14.695905 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:43:47.267604 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 08:43:47.267786 0.063219 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:43:47.331365 0.000000 udp 10.0.2.105 7010 -> 86.173.101.230 7823 INT 0 1 224 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:44:04.314559 0.037264 tcp 10.0.2.105 51138 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:04.351854 0.032899 tcp 10.0.2.105 51139 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:04.384996 0.130005 tcp 10.0.2.105 51140 -> 195.113.214.249 443 SRPA* 0 0 24 13258 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:04.516043 0.000000 udp 10.0.2.105 7010 -> 174.89.104.63 6960 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:44:22.899600 0.032901 tcp 10.0.2.105 51141 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:22.932793 0.032960 tcp 10.0.2.105 51142 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:22.966104 0.137050 tcp 10.0.2.105 51143 -> 195.113.214.249 443 SRPA* 0 0 27 10624 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:23.103375 0.000000 udp 10.0.2.105 7010 -> 46.49.112.20 3869 INT 0 1 179 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:44:39.844014 0.034813 tcp 10.0.2.105 51144 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:39.879177 0.033720 tcp 10.0.2.105 51145 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:39.913236 0.180917 tcp 10.0.2.105 51146 -> 195.113.214.249 443 SRPA* 0 0 36 23406 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:44:40.094796 0.316218 udp 10.0.2.105 7010 <-> 59.91.121.129 7978 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:40.411386 0.363664 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:40.775472 0.307898 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 261 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.083794 0.125138 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.209360 0.221796 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.431614 0.043079 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.475156 0.187771 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.663468 0.211699 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:41.875598 0.181979 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.057990 0.048307 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.106800 0.172738 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 540 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.279951 0.155342 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.435669 0.154076 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.590196 0.176476 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:44:42.767052 0.000000 udp 10.0.2.105 7010 -> 95.160.227.82 1351 INT 0 1 89 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:45:01.404701 0.033827 tcp 10.0.2.105 51147 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:01.438865 0.085171 tcp 10.0.2.105 51148 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:01.523957 0.134040 tcp 10.0.2.105 51149 -> 195.113.214.249 443 SRPA* 0 0 45 32538 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:01.658716 0.143049 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:01.802263 0.052386 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:01.855127 0.424222 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:02.279729 0.217528 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:02.497650 0.153563 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:02.651649 0.152463 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:02.804538 0.152501 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 228 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:02.957486 0.043590 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 240 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:03.001551 0.487632 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:03.489631 0.213254 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:03.703344 0.052154 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:03.755944 0.000000 udp 10.0.2.105 7010 -> 81.131.216.140 5105 INT 0 1 171 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:45:18.702077 3.001239 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 08:45:22.505624 0.032441 tcp 10.0.2.105 51150 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:22.538435 0.044280 tcp 10.0.2.105 51151 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:22.583008 0.128318 tcp 10.0.2.105 51152 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:22.711859 0.023952 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:22.736211 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 08:45:25.709074 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:45:33.710552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:45:38.728829 0.038295 tcp 10.0.2.105 51153 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:38.767396 0.035939 tcp 10.0.2.105 51154 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:38.803765 0.137804 tcp 10.0.2.105 51155 -> 195.113.214.249 443 SRPA* 0 0 23 12578 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:45:38.942077 0.083444 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.025961 0.097160 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.123633 0.348037 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.472129 0.121241 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.593842 0.139305 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.733647 0.147565 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:39.881672 0.089407 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 08:45:49.713675 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:46:21.719737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:58:47.734354 3.001788 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 08:58:54.742684 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:59:02.744143 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:59:10.695808 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 08:59:10.695899 3.536189 tcp 10.0.2.105 51156 -> 211.38.175.27 4598 FSPA* 0 0 14 1603 flow=From-Botnet-V2-TCP-Established 1970/02/26 08:59:18.747225 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 08:59:50.752997 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:05:54.758827 3.001863 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:06:01.766523 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:06:09.767965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:06:25.771031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:06:57.777155 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:13:01.782312 3.002390 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:13:08.790095 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:13:16.792048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:13:32.794974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:14:04.800609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:16:06.265978 0.000049 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 09:16:06.266072 0.000000 udp 10.0.2.105 7010 -> 95.160.227.82 1351 INT 0 1 196 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:16:24.543920 0.050646 tcp 10.0.2.105 51157 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:24.594857 0.050929 tcp 10.0.2.105 51158 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:24.646150 0.134247 tcp 10.0.2.105 51159 -> 195.113.214.249 443 SRPA* 0 0 26 13498 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:24.781006 0.093967 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:16:24.875318 0.000000 udp 10.0.2.105 7010 -> 68.224.96.174 9675 INT 0 1 160 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:16:42.398267 0.049683 tcp 10.0.2.105 51160 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:42.448371 0.050805 tcp 10.0.2.105 51161 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:42.499485 0.127329 tcp 10.0.2.105 51162 -> 195.113.214.249 443 SRPA* 0 0 24 13390 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:16:42.627339 0.000000 udp 10.0.2.105 7010 -> 84.127.239.194 3036 INT 0 1 146 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:17:00.323986 0.051266 tcp 10.0.2.105 51163 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:00.375483 0.050145 tcp 10.0.2.105 51164 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:00.425990 0.139097 tcp 10.0.2.105 51165 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:00.565591 0.000000 udp 10.0.2.105 7010 -> 59.91.121.129 7978 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:17:18.009293 0.050116 tcp 10.0.2.105 51166 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:18.059801 0.051248 tcp 10.0.2.105 51167 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:18.111333 0.134819 tcp 10.0.2.105 51168 -> 195.113.214.249 443 SRPA* 0 0 42 23376 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:17:18.245398 0.317865 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:18.563718 0.235366 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 490 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:18.799624 0.125663 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:18.925691 0.186510 udp 10.0.2.105 7010 <-> 115.252.123.245 6689 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.112674 0.063872 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 232 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.176979 0.199275 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 537 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.376749 0.048091 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.425245 0.221748 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.647387 0.186462 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:19.834335 0.217505 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:20.052255 0.161826 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:20.214442 0.176257 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:20.391382 0.153393 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 544 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:20.545227 0.439619 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:20.985242 0.061840 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.047500 0.138590 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.186513 0.152702 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.339695 0.044765 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.384898 0.208055 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.593394 0.152166 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.746011 0.148233 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 543 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:21.894615 0.493569 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.388693 0.054204 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.443321 0.204490 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.648210 0.023229 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.671945 0.097869 udp 10.0.2.105 7010 <-> 31.192.24.15 6539 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.770279 0.082774 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.853448 0.056589 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 558 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:22.910392 0.148434 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:23.059553 0.087443 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:23.147434 0.348375 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:17:23.496269 0.055886 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:20:13.813671 3.002097 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 09:20:20.821014 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:20:28.824973 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:20:44.826060 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:21:16.831996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:27:20.838142 3.011276 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:27:27.857875 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:27:35.857053 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:27:51.860069 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:28:23.866304 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:29:14.239028 0.000043 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 09:29:14.239123 2.977692 tcp 10.0.2.105 51169 -> 211.38.175.27 4598 FSPA* 0 0 15 1774 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:34:27.872871 3.000664 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:34:34.879235 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:34:42.881104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:34:58.883984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:35:30.890139 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:41:34.895726 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:41:41.903372 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:41:49.904748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:42:05.907848 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:42:37.913793 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:47:47.659615 0.000094 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 09:47:47.659804 0.083346 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:47:47.743572 0.000000 udp 10.0.2.105 7010 -> 59.91.121.129 7978 INT 0 1 223 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:48:04.766316 0.033310 tcp 10.0.2.105 51170 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:04.799988 0.032556 tcp 10.0.2.105 51171 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:04.832856 0.129176 tcp 10.0.2.105 51172 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:04.962515 0.465862 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:05.428881 0.305388 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:05.734664 0.068392 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 252 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:05.803485 0.125204 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:05.929129 0.000000 udp 10.0.2.105 7010 -> 115.252.123.245 6689 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:48:23.100726 0.032707 tcp 10.0.2.105 51173 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:23.133808 0.034363 tcp 10.0.2.105 51174 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:23.168015 0.144416 tcp 10.0.2.105 51175 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:23.313023 0.047471 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:23.361130 0.099567 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 473 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:23.461340 0.162310 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:23.624129 0.224397 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:23.848902 0.160655 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:24.010022 0.169794 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:24.180206 2.256469 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:26.437054 0.185203 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:26.622785 0.223601 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:26.846777 0.428616 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.275887 0.046584 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.322905 0.144833 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.468201 0.161368 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.629983 0.044765 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.675147 0.206289 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:27.881793 0.154823 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:28.037042 0.146884 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:28.184431 0.551333 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:28.736274 0.056593 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:28.793301 0.282258 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:29.076005 0.023639 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:29.100092 0.000000 udp 10.0.2.105 7010 -> 31.192.24.15 6539 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 09:48:41.919701 3.002112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 09:48:47.135342 0.032885 tcp 10.0.2.105 51176 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:47.168584 0.036844 tcp 10.0.2.105 51177 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:47.205759 0.125575 tcp 10.0.2.105 51178 -> 195.113.214.249 443 SRPA* 0 0 23 13336 flow=From-Botnet-V2-TCP-Established 1970/02/26 09:48:47.331846 0.082135 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:47.414460 0.056474 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:47.471387 0.150828 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:47.622614 0.089347 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:47.712435 0.348536 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:48.061358 0.072931 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/26 09:48:48.927545 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:48:56.929083 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:49:12.931965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:49:44.937894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:55:48.945047 3.000632 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 09:55:55.951263 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:56:03.953063 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:56:19.955924 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:56:51.961754 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 09:59:17.221322 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 09:59:17.221439 2.342725 tcp 10.0.2.105 51179 -> 211.38.175.27 4598 FSPA* 0 0 14 1740 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:02:55.967454 3.016294 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:03:02.985138 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:03:10.987318 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:03:26.989923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:03:58.996067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:10:03.002782 3.000576 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:10:10.009298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:10:18.011168 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:10:34.013841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:11:06.019984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:17:14.032654 3.000592 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:17:21.038951 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:17:29.040340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:17:45.043310 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:18:17.049507 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:18:58.889834 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 10:18:58.889965 0.000000 udp 10.0.2.105 7010 -> 115.252.123.245 6689 INT 0 1 257 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:19:16.757332 0.052720 tcp 10.0.2.105 51180 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:16.810374 0.055294 tcp 10.0.2.105 51181 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:16.866043 0.129879 tcp 10.0.2.105 51182 -> 195.113.214.249 443 SRPA* 0 0 51 28644 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:16.996728 0.000000 udp 10.0.2.105 7010 -> 31.192.24.15 6539 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:19:32.829105 0.051656 tcp 10.0.2.105 51183 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:32.881040 0.052855 tcp 10.0.2.105 51184 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:32.934173 0.136479 tcp 10.0.2.105 51185 -> 195.113.214.249 443 SRPA* 0 0 44 22130 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:33.071318 0.067773 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:33.139551 0.246218 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 243 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:33.386206 0.125274 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:33.511924 0.304792 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:33.817145 0.093035 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:33.910572 0.221928 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:34.132909 0.156996 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:34.290320 0.174813 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:34.465551 0.048601 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:34.514532 0.109924 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:35.215346 0.000000 udp 10.0.2.105 7010 -> 62.131.39.243 1960 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:19:51.886527 0.052559 tcp 10.0.2.105 51186 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:51.939387 0.052969 tcp 10.0.2.105 51187 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:51.992692 0.129097 tcp 10.0.2.105 51188 -> 195.113.214.249 443 SRPA* 0 0 40 21914 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:19:52.122537 0.186705 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:52.309715 0.205338 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:52.515494 0.553400 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 526 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:53.069402 0.066850 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:53.136656 2.267737 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:55.404779 0.252208 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:55.657412 0.153783 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:55.811581 0.161668 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:55.973642 0.155121 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.129137 0.153688 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.283213 0.045453 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 400 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.329064 0.199731 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 302 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.529232 0.025338 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.555022 0.222727 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 276 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.778158 0.054325 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.833010 0.056573 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:56.890024 0.142071 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:57.032567 0.085313 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:57.118302 0.348687 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:57.467392 0.056611 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:19:57.524425 0.090172 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:24:21.056215 3.001144 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 10:24:28.062939 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:24:36.064486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:24:52.067255 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:25:24.074005 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:29:19.562610 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 10:29:19.562705 2.054987 tcp 10.0.2.105 51189 -> 211.38.175.27 4598 FSPA* 0 0 15 1639 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:31:28.080442 3.010919 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:31:35.097557 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:31:43.098885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:31:59.101581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:32:31.107578 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:38:35.114058 3.001087 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:38:42.121247 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:38:50.122696 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:39:06.125622 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:39:38.131417 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:45:42.137550 3.001488 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 10:45:49.145068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:45:57.146494 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:46:13.149601 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:46:45.155194 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:50:05.884546 0.000072 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 10:50:05.884689 0.052079 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:05.937228 0.071082 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:06.008791 0.125088 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:06.134320 0.323737 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:06.458504 0.097935 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:06.556855 0.292512 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 239 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:06.849849 0.160629 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:07.010869 0.220547 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:07.231807 0.047560 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:07.279785 0.169630 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:07.449905 0.000000 udp 10.0.2.105 7010 -> 109.53.213.72 5025 INT 0 1 270 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:50:23.992074 0.054052 tcp 10.0.2.105 51190 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:24.046344 0.052215 tcp 10.0.2.105 51191 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:24.098880 0.140495 tcp 10.0.2.105 51192 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:24.239922 0.183012 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:24.423324 0.046343 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:24.470084 0.212726 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:24.683257 0.422120 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:25.105781 0.156419 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:25.262653 0.354519 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:25.617609 0.152812 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:25.770831 0.147756 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:25.919099 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:50:41.035295 0.050792 tcp 10.0.2.105 51193 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:41.086375 0.051091 tcp 10.0.2.105 51194 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:41.137785 0.138607 tcp 10.0.2.105 51195 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:41.277042 0.176599 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:41.454059 0.044003 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 262 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:41.498481 0.000000 udp 10.0.2.105 7010 -> 65.8.208.209 9193 INT 0 1 281 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 10:50:56.629082 0.050568 tcp 10.0.2.105 51196 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:56.679669 0.051302 tcp 10.0.2.105 51197 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:56.731265 0.129833 tcp 10.0.2.105 51198 -> 195.113.214.249 443 SRPA* 0 0 33 18760 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:50:56.861832 0.024986 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:56.887311 0.230291 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.118023 0.054402 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.172896 0.057052 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.230344 0.150809 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.381543 0.084512 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.466480 0.083707 udp 10.0.2.105 7010 <-> 2.229.89.35 1072 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.550573 0.343959 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:50:57.894966 0.056218 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 236 flow=From-Botnet-V2-UDP-Established 1970/02/26 10:58:55.168623 3.012607 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 10:59:02.185353 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:59:10.186863 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:59:21.623547 0.000044 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 10:59:21.623636 2.467891 tcp 10.0.2.105 51199 -> 211.38.175.27 4598 FSPA* 0 0 14 1655 flow=From-Botnet-V2-TCP-Established 1970/02/26 10:59:26.189649 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 10:59:58.195415 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:06:02.202413 3.002479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:06:09.209406 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:06:17.213747 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:06:33.213497 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:07:05.219603 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:13:09.226001 3.003320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:13:16.233099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:13:24.234505 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:13:40.237498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:14:12.243683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:20:19.253998 3.001391 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:20:26.261297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:20:34.262720 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:20:50.266009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:21:20.049212 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 11:21:20.049341 0.160936 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:20.210850 0.153284 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:20.364582 0.000000 udp 10.0.2.105 7010 -> 65.8.208.209 9193 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 11:21:22.271668 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:21:37.425785 0.034061 tcp 10.0.2.105 51200 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:37.460163 0.036601 tcp 10.0.2.105 51201 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:37.496752 0.135953 tcp 10.0.2.105 51202 -> 195.113.214.249 443 SRPA* 0 0 44 23030 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:37.632902 0.066334 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:37.699632 0.047426 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:37.747442 0.124210 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:37.872120 0.304944 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.177541 0.068964 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.246956 0.093472 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.340880 0.183542 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.524875 0.222409 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.747711 0.176089 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.924216 0.046054 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:38.970671 0.185149 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:39.156256 0.051025 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:39.207746 0.209749 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:39.417941 0.000000 udp 10.0.2.105 7010 -> 203.45.157.34 1089 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 11:21:56.691282 0.051651 tcp 10.0.2.105 51203 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:56.743206 0.034950 tcp 10.0.2.105 51204 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:56.778427 0.142977 tcp 10.0.2.105 51205 -> 195.113.214.249 443 SRPA* 0 0 20 10254 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:21:56.921953 0.156314 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.078730 0.148781 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.227968 0.220959 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.449400 0.153001 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.602823 0.044607 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.647845 0.143733 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.792065 0.023934 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:57.816489 0.217671 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.034590 0.054204 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.089244 0.056500 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.146155 0.149228 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 255 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.295756 0.091198 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.387400 0.053506 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:21:58.441344 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 159 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 11:22:15.899472 0.036643 tcp 10.0.2.105 51206 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:22:15.936495 0.032546 tcp 10.0.2.105 51207 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:22:15.969321 0.143680 tcp 10.0.2.105 51208 -> 195.113.214.249 443 SRPA* 0 0 23 13260 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:22:16.113480 0.341810 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:27:26.277426 3.002027 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 11:27:33.285054 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:27:41.286604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:27:57.289972 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:28:29.295944 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:29:24.095176 0.000088 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 11:29:24.095335 3.807666 tcp 10.0.2.105 51209 -> 211.38.175.27 4598 FSPA* 0 0 14 1717 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:34:33.301494 3.002037 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:34:40.309099 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:34:48.310759 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:35:04.313683 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:35:36.319993 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:41:40.326257 3.001072 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:41:47.332996 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:41:55.334825 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:42:11.337739 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:42:43.343797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:48:47.350968 3.018750 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:48:54.367268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:49:02.379639 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:49:18.391553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:49:50.397614 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:52:27.333688 0.010062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 11:52:27.343929 0.425493 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:27.769815 0.000000 udp 10.0.2.105 7010 -> 2.229.89.35 1072 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 11:52:45.601480 0.061868 tcp 10.0.2.105 51210 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:52:45.663676 0.033097 tcp 10.0.2.105 51211 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:52:45.697035 0.147386 tcp 10.0.2.105 51212 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/26 11:52:45.845087 0.166685 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.012175 0.154630 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.167231 0.125317 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.293108 0.307678 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 304 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.601176 0.253347 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.854902 0.097482 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:46.952758 0.049366 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 566 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.002542 0.060082 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.063088 0.170358 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.233891 0.221858 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.456199 0.192273 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.648880 0.052558 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.701910 0.050796 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.753104 0.161445 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:47.914964 0.211804 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.127209 0.154047 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.281730 0.152415 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.434633 0.152244 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 533 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.587343 0.044319 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.632143 0.157137 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.789689 0.023128 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:48.813236 0.259445 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.073189 0.054373 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.127979 0.055288 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.183700 0.150662 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.334812 0.220366 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.555592 0.053640 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.609635 0.089405 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:52:49.699444 0.348066 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/26 11:55:54.404927 3.010658 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 11:56:01.421128 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:56:09.423050 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:56:25.425593 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:56:57.431790 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 11:59:27.908347 0.022146 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 11:59:27.930667 2.936629 tcp 10.0.2.105 51213 -> 211.38.175.27 4598 FSPA* 0 0 14 1668 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:03:01.438094 3.001479 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:03:08.445191 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:03:16.446669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:03:32.449262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:04:04.455734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:10:20.470326 3.020262 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:10:27.486295 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:10:35.487763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:10:51.740383 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:11:23.516851 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:17:36.536606 3.015925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:17:43.553169 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:17:51.554762 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:18:07.557737 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:18:39.563910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:23:04.505055 0.004457 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 12:23:04.509615 0.423591 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:04.933649 0.129490 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.063544 0.337630 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.401667 0.154872 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.557010 0.124398 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.681888 0.071324 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.753762 0.098143 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.852350 0.046769 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 219 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.899504 0.070260 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:05.970232 0.168900 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.139542 0.054826 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.194814 0.048509 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.243747 0.159974 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.404138 0.222344 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.626922 0.182587 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 231 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:06.809881 0.215032 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.025342 0.157801 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.183600 0.153130 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.337103 0.144798 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.482307 0.046187 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.528900 0.144259 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.673587 0.025859 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:07.699868 0.502762 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.203091 0.056970 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.260666 0.055907 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.317007 0.148376 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.465844 0.087294 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.553565 0.349634 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:08.903585 0.198899 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:23:09.102876 0.053431 udp 10.0.2.105 7010 <-> 46.49.70.63 2473 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:24:43.569263 3.002616 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:24:50.576658 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:24:58.579003 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:25:14.581768 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:25:46.587802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:29:30.880977 0.007611 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 12:29:30.888684 2.120372 tcp 10.0.2.105 51214 -> 211.38.175.27 4598 FSPA* 0 0 14 1548 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:31:50.593968 3.011476 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:31:57.611363 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:32:05.613179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:32:21.615781 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:32:53.621893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:38:57.637720 3.021883 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:39:04.665801 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:39:12.667129 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:39:28.669514 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:40:00.676898 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:46:04.681827 3.001948 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:46:11.689399 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:46:19.690592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:46:35.696092 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:47:07.700114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:53:38.512696 0.000063 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 12:53:38.512850 0.463026 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:38.976400 0.102766 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:39.079684 0.304885 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:39.385046 0.153617 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 267 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:39.539052 0.125711 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:39.665158 0.314986 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:39.980557 0.092446 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.073397 0.042250 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.116099 0.067895 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.184425 0.176302 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.361139 0.082750 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.444502 0.048149 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.493060 0.160567 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.653996 0.221984 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:40.876559 0.185013 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.061963 0.212410 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.274751 0.167500 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.442946 0.152875 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.596223 0.156972 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.753691 0.046369 udp 10.0.2.105 7010 <-> 5.13.19.49 2778 CON 0 0 2 312 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.800749 0.143787 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.945199 0.023176 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 582 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:41.968766 0.386406 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:42.355921 0.054786 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 414 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:42.411169 0.055114 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:42.466778 0.348782 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:42.815965 0.207689 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:53:43.024107 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 2473 INT 0 1 217 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 12:54:00.074860 0.033268 tcp 10.0.2.105 51215 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:54:00.108434 0.032987 tcp 10.0.2.105 51216 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:54:00.141701 0.135481 tcp 10.0.2.105 51217 -> 195.113.214.249 443 SRPA* 0 0 26 13498 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:54:00.277747 0.157356 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:54:00.435470 0.088983 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/26 12:59:08.708875 3.001427 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 12:59:15.717027 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:59:23.717760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 12:59:33.012265 0.000111 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 12:59:33.012455 3.220012 tcp 10.0.2.105 51218 -> 211.38.175.27 4598 FSPA* 0 0 15 1644 flow=From-Botnet-V2-TCP-Established 1970/02/26 12:59:39.721022 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:00:11.742591 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:06:15.733674 3.001281 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:06:22.741853 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:06:30.742144 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:06:46.744927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:07:18.750977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:13:23.759623 3.010421 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:13:30.776140 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:13:38.777659 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:13:54.780894 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:14:26.786876 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:20:30.791878 3.024752 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:20:37.809842 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:20:45.811493 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:21:01.814224 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:21:33.820196 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:24:15.232875 0.000103 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 13:24:15.233078 0.000000 udp 10.0.2.105 7010 -> 46.49.70.63 2473 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 13:24:30.456263 0.032324 tcp 10.0.2.105 51219 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:30.488826 0.032957 tcp 10.0.2.105 51220 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:30.522095 0.127662 tcp 10.0.2.105 51221 -> 195.113.214.249 443 SRPA* 0 0 40 20778 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:30.650379 0.460286 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.111063 0.087112 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.198650 0.309857 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.508973 0.154843 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.664190 0.125520 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.790131 0.047980 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.838475 0.074348 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:31.913244 0.175698 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:32.089405 1.382660 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:33.472637 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 13:24:50.283881 0.031494 tcp 10.0.2.105 51222 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:50.315667 0.032128 tcp 10.0.2.105 51223 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:50.348077 0.128153 tcp 10.0.2.105 51224 -> 195.113.214.249 443 SRPA* 0 0 23 14000 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:24:50.476870 0.048319 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:50.525614 0.052091 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:50.578109 0.182271 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:50.760739 0.163669 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:50.924889 0.221476 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:51.146786 0.151723 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:24:51.298858 0.000000 udp 10.0.2.105 7010 -> 5.13.19.49 2778 INT 0 1 124 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 13:25:10.222027 0.031991 tcp 10.0.2.105 51225 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:25:10.254305 0.032358 tcp 10.0.2.105 51226 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:25:10.286968 0.127770 tcp 10.0.2.105 51227 -> 195.113.214.249 443 SRPA* 0 0 24 13884 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:25:10.415296 0.157585 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:10.573277 0.212994 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 280 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:10.786680 0.153543 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:10.940640 0.486684 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 373 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:11.427702 0.053644 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 495 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:11.481697 0.055041 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 242 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:11.537167 0.143412 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:11.681024 0.028341 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 506 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:11.709735 0.347954 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:12.058069 0.247745 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:12.306172 0.148585 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:25:12.455157 0.091468 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:27:37.827318 3.001155 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 13:27:44.834030 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:27:52.835364 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:28:08.838271 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:28:40.844743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:29:36.234372 0.000138 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 13:29:36.234603 1.862482 tcp 10.0.2.105 51228 -> 211.38.175.27 4598 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:34:44.850668 3.001677 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:34:51.867845 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:34:59.872773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:35:15.873039 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:35:47.878539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:41:51.884356 3.024079 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:41:58.901686 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:42:06.903499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:42:22.906323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:42:54.939861 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:48:58.918417 3.001468 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:49:05.925953 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:49:13.927088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:49:29.930743 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:50:01.936714 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:55:34.184384 0.912989 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 13:55:35.097636 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 13:55:53.342631 0.035098 tcp 10.0.2.105 51229 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:55:53.378017 0.035172 tcp 10.0.2.105 51230 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:55:53.413506 0.128753 tcp 10.0.2.105 51231 -> 195.113.214.249 443 SRPA* 0 0 41 21968 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:55:53.543102 0.000000 udp 10.0.2.105 7010 -> 5.13.19.49 2778 INT 0 1 268 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 13:56:06.458863 2.965857 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 13:56:11.453886 0.030783 tcp 10.0.2.105 51232 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:11.484937 0.032774 tcp 10.0.2.105 51233 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:11.518015 0.127079 tcp 10.0.2.105 51234 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:11.645702 0.719641 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.365776 0.074846 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.441084 0.047342 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.441481 4.387670 tcp 10.0.2.105 51235 -> 109.53.213.72 6491 SPA_* 0 0 574 420425 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:12.488867 0.071177 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.560591 0.180044 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.741007 0.153392 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:12.894787 0.304865 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.200007 0.125536 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.326088 0.095364 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.378947 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:56:13.421859 0.183262 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.605536 0.160934 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.766837 0.220973 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:13.988274 0.159543 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.148222 0.048278 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.196979 0.059461 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 556 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.256810 0.152948 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.410137 0.156267 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.566815 0.211018 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:14.778197 0.477767 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.256512 0.055282 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.312200 0.055169 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 534 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.367759 0.143860 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.511988 0.024408 udp 10.0.2.105 7010 <-> 89.173.11.69 3866 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.536859 0.348158 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:15.885434 0.229365 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:16.115179 0.147028 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:16.262579 0.089891 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 13:56:19.480491 2.655640 tcp 10.0.2.105 51235 -> 109.53.213.72 6491 A_PA 0 0 377 319579 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:24.279653 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:56:31.350267 0.084646 tcp 10.0.2.105 51235 -> 109.53.213.72 6491 FPA_* 0 0 6 328 flow=From-Botnet-V2-TCP-Established 1970/02/26 13:56:44.463409 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:57:16.419709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 13:59:43.449587 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 13:59:43.449682 2.076614 tcp 10.0.2.105 51236 -> 211.38.175.27 4598 FSPA* 0 0 14 1711 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:03:15.277305 2.974678 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 14:03:22.201873 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:03:30.091105 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:03:45.867389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:04:17.413877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:10:39.009889 1.921641 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/26 14:10:46.665804 3.954202 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 2 292 flow=Background 1970/02/26 14:10:58.509067 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:11:14.287049 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:11:45.840864 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:17:54.054589 3.105336 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 14:18:01.128841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:18:09.072112 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:18:25.075142 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:18:57.080856 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:25:01.088932 3.035547 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 14:25:08.104682 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:25:16.106081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:25:36.354034 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:26:07.913220 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:26:33.859344 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 14:26:33.859502 0.471582 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.331485 0.156990 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 496 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.489014 0.041835 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 301 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.531302 0.065069 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.596772 0.260739 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.857927 0.125272 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:34.983656 0.321435 udp 10.0.2.105 7010 <-> 81.131.216.140 5105 CON 0 0 2 552 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:35.305531 0.150779 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:35.456814 0.305736 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:35.762950 0.190453 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:35.953811 0.159732 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.113973 0.221340 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.335729 0.154702 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.490910 0.047925 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.539216 0.157896 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.697491 0.209546 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.907452 0.049027 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 571 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:36.956958 0.155183 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:37.112685 0.501308 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:37.614389 0.054288 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:37.669109 0.055063 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:37.724618 0.143668 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:37.868686 0.233948 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:38.103021 0.000000 udp 10.0.2.105 7010 -> 89.173.11.69 3866 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 14:26:53.277499 0.032791 tcp 10.0.2.105 51237 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:26:53.310583 0.031235 tcp 10.0.2.105 51238 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:26:53.342098 0.107669 tcp 10.0.2.105 51239 -> 195.113.214.249 443 SRPA* 0 0 33 23622 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:26:53.450348 0.342457 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:53.793184 0.164454 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 539 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:26:53.958015 0.084347 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:29:41.072755 0.000051 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 14:29:41.072869 1.909590 tcp 10.0.2.105 51240 -> 211.38.175.27 4598 FSPA* 0 0 14 1560 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:32:08.130866 3.021634 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 14:32:15.230488 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:32:23.164451 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:32:39.163216 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:33:11.169398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:39:15.174896 3.069977 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 14:39:22.215619 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:39:30.193877 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:39:46.196912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:40:18.202985 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:46:22.209396 3.125848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 14:46:29.315038 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:46:37.250872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:46:53.231068 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:47:25.237087 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:56:51.521418 0.057582 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 14:56:51.579122 0.000000 udp 10.0.2.105 7010 -> 89.173.11.69 3866 INT 0 1 120 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 14:57:09.959326 0.071814 tcp 10.0.2.105 51241 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:10.031422 0.031593 tcp 10.0.2.105 51242 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:10.063280 0.125399 tcp 10.0.2.105 51243 -> 195.113.214.249 443 SRPA* 0 0 22 12524 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:10.189284 0.082351 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:10.272085 0.041110 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:10.313622 0.059744 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:10.373844 0.176095 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:10.550400 0.480567 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:11.031432 0.153620 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:11.185384 0.126016 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:11.311773 0.366502 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:11.678700 0.000000 udp 10.0.2.105 7010 -> 81.131.216.140 5105 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 14:57:27.785718 0.031386 tcp 10.0.2.105 51244 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:27.817412 0.031259 tcp 10.0.2.105 51245 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:27.848952 0.124357 tcp 10.0.2.105 51246 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:57:27.973865 0.188407 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.162847 0.153200 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 476 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.316518 0.053943 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.370866 0.154341 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.525584 0.220757 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.746807 0.158481 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:28.905726 0.152043 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.058140 0.481896 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.540455 0.052888 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.593714 0.061565 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.655664 0.211026 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 560 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.867151 0.047662 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 238 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:29.915174 0.143642 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:30.059231 0.207520 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:30.267413 0.087006 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:30.354799 0.348675 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:57:30.703877 0.152305 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 345 flow=From-Botnet-V2-UDP-Established 1970/02/26 14:59:18.245047 3.024001 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 14:59:25.262214 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:59:33.263604 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 14:59:42.156798 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 14:59:42.156938 2.152748 tcp 10.0.2.105 51247 -> 211.38.175.27 4598 FSPA* 0 0 14 1531 flow=From-Botnet-V2-TCP-Established 1970/02/26 14:59:49.266272 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:00:21.272540 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:06:25.278782 3.153000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:06:32.404631 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:06:40.340988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:06:56.300728 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:07:28.306885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:13:39.332827 3.065920 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:13:46.374820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:13:54.351787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:14:10.354332 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:14:42.361055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:20:46.367273 3.079851 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:20:53.420312 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:21:01.385899 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:21:17.388983 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:21:49.394912 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:27:52.517355 0.252695 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 15:27:52.770249 0.000000 udp 10.0.2.105 7010 -> 81.131.216.140 5105 INT 0 1 266 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 15:27:53.627875 2.971855 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:28:00.569487 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:28:08.495262 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:28:09.952843 0.065040 tcp 10.0.2.105 51248 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:28:10.018112 0.032090 tcp 10.0.2.105 51249 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:28:10.050526 0.122249 tcp 10.0.2.105 51250 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:28:10.173511 0.121235 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.295135 0.047454 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.342961 0.062565 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.405910 0.176668 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 542 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.582995 0.126446 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.709830 0.153187 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:10.863388 0.439736 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:11.303485 0.357750 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:11.661723 0.189974 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:11.852082 0.145538 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:11.998000 0.045951 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.044356 0.151145 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.195964 0.222249 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.418639 0.157707 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.576802 0.053674 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 572 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.630863 0.055001 udp 10.0.2.105 7010 <-> 82.211.187.89 5079 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.686315 0.152127 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:12.838838 0.470928 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:13.310232 0.210170 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:13.520789 0.060654 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:13.581864 0.145759 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:13.728066 0.207792 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:13.936446 0.142814 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 343 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:14.079746 0.086562 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:14.166693 0.348830 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:28:24.423088 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:28:56.429028 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:29:44.317944 0.218584 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 15:29:44.536625 2.616526 tcp 10.0.2.105 51251 -> 211.38.175.27 4598 FSPA* 0 0 14 1732 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:35:00.434575 3.193223 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:35:07.656794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:35:15.580001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:35:31.446820 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:36:03.452948 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:42:07.458921 3.040183 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:42:14.480489 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:42:22.477708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:42:38.480775 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:43:10.486188 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:49:14.493014 3.166993 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:49:21.672208 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:49:29.599345 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:49:45.534570 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:50:17.540606 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:56:21.546617 3.155371 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 15:56:28.677268 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:56:36.861499 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:56:52.712866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:57:24.584818 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 15:58:24.211227 0.000087 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 15:58:24.211434 0.064324 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:24.276155 0.091952 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:24.368546 0.048004 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:24.417007 0.163867 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:24.581288 0.423911 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 2 318 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:25.005671 0.215616 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:25.221683 0.125488 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:25.347637 0.405643 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:25.753686 0.190019 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:25.944161 0.145919 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:26.090473 0.048079 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:26.138947 0.152646 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:26.291988 0.216642 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:26.509059 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 15:58:41.947668 0.145526 tcp 10.0.2.105 51252 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:58:42.093522 0.031570 tcp 10.0.2.105 51253 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:58:42.125550 0.127888 tcp 10.0.2.105 51254 -> 195.113.214.249 443 SRPA* 0 0 40 31302 flow=From-Botnet-V2-TCP-Established 1970/02/26 15:58:42.254022 0.152436 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 555 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:42.406879 0.476486 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:42.883775 0.160247 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 248 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.044426 0.052650 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.097541 0.211179 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.309187 0.055066 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.364666 0.137650 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.502880 0.221007 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.724329 0.158875 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.883601 0.084280 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:58:43.968273 0.349587 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 574 flow=From-Botnet-V2-UDP-Established 1970/02/26 15:59:46.950161 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 15:59:46.950282 4.602386 tcp 10.0.2.105 51255 -> 211.38.175.27 4598 FSPA* 0 0 14 1507 flow=From-Botnet-V2-TCP-Established 1970/02/26 16:03:28.592908 3.019836 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 16:03:35.641311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:03:43.609645 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:04:00.097229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:04:31.719878 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:10:59.654629 3.107981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 16:11:06.738561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:11:14.670678 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:11:30.671311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:12:02.676797 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:18:10.690166 3.119172 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 16:18:17.801154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:18:25.738687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:18:41.720443 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:19:13.726815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:25:17.732560 3.041786 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 16:25:24.763988 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:25:32.762032 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:25:48.765094 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:26:20.770709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:28:51.297665 0.181284 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:28:51.479107 0.000000 udp 10.0.2.105 7010 -> 82.211.187.89 5079 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:06.652469 0.052367 tcp 10.0.2.105 51256 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 16:29:06.705100 0.031681 tcp 10.0.2.105 51257 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 16:29:06.737098 0.127645 tcp 10.0.2.105 51258 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/26 16:29:06.865409 4.443471 udp 10.0.2.105 7010 <-> 62.131.39.243 1960 CON 0 0 4 1278 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:06.913286 4.552629 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 4 1247 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.067009 4.461362 udp 10.0.2.105 7010 <-> 84.127.239.194 3036 CON 0 0 4 1342 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.129955 4.516434 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 4 1090 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.254867 4.516560 udp 10.0.2.105 7010 <-> 208.97.31.40 4950 CON 0 0 4 1125 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.380485 4.761749 udp 10.0.2.105 7010 <-> 203.45.157.34 1089 CON 0 0 3 747 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.797315 4.144199 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 4 1262 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:07.974679 4.121145 udp 10.0.2.105 7010 <-> 96.11.143.66 1569 CON 0 0 4 977 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:08.129599 4.012119 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 4 1282 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:08.174177 4.742228 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 4 1102 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:08.527948 4.586456 udp 10.0.2.105 7010 <-> 72.193.127.113 3933 CON 0 0 4 1072 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:08.724015 4.610651 udp 10.0.2.105 7010 <-> 108.255.78.239 8326 CON 0 0 4 1328 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:08.946577 4.547816 udp 10.0.2.105 7010 <-> 70.52.239.176 3931 CON 0 0 4 1405 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:09.106435 4.537186 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 4 1132 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:09.256130 4.878699 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 4 1227 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:09.749804 4.551598 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 4 1337 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:09.913788 4.438883 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 4 1082 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:09.968515 4.593007 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 4 1092 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.178715 4.446819 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 4 1362 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.233884 4.536932 udp 10.0.2.105 7010 <-> 69.130.23.150 3391 CON 0 0 4 1064 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.377923 0.091342 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.469658 4.522103 udp 10.0.2.105 7010 <-> 99.109.95.10 1251 CON 0 0 4 1238 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.690454 4.454518 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 4 1066 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:10.838449 4.657621 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 4 1173 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:12.561922 0.000000 udp 10.0.2.105 7010 <- 203.45.157.34 1089 RSP 0 0 1 543 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:15.496680 0.091754 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 813 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:15.589112 0.000000 udp 10.0.2.105 7010 -> 79.48.122.15 6737 INT 0 1 140 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:22.823011 0.179195 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 676 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:29:23.301849 0.000000 udp 10.0.2.105 7010 -> 82.91.27.63 6705 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:28.774462 0.000000 udp 10.0.2.105 7010 -> 177.130.198.42 1139 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:33.487902 0.000161 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:29:36.482131 0.000000 udp 10.0.2.105 7010 -> 113.161.144.242 8604 INT 0 1 122 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:42.440997 0.000000 udp 10.0.2.105 7010 -> 194.121.246.177 1110 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:49.741694 0.000000 udp 10.0.2.105 7010 -> 186.18.141.67 4252 INT 0 1 152 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:29:51.554181 3.897029 tcp 10.0.2.105 51259 -> 211.38.175.27 4598 FSPA* 0 0 14 1552 flow=From-Botnet-V2-TCP-Established 1970/02/26 16:29:56.450656 0.000000 udp 10.0.2.105 7010 -> 106.188.105.74 6198 INT 0 1 250 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:01.909108 0.000000 udp 10.0.2.105 7010 -> 87.4.16.92 6545 INT 0 1 308 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:09.699671 0.000000 udp 10.0.2.105 7010 -> 75.65.22.95 4717 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:18.472995 0.000000 udp 10.0.2.105 7010 -> 212.145.149.172 2745 INT 0 1 190 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:22.989301 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:30:25.763300 0.114804 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 703 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:30:26.433402 0.000000 udp 10.0.2.105 7010 -> 67.52.43.61 1510 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:32.573402 0.000000 udp 10.0.2.105 7010 -> 166.62.234.49 3251 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:40.434190 0.000000 udp 10.0.2.105 7010 -> 184.20.254.47 1661 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:46.823662 0.000000 udp 10.0.2.105 7010 -> 186.177.34.151 1271 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:51.489740 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:30:52.411085 0.173018 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 855 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:30:53.017574 0.000000 udp 10.0.2.105 7010 -> 122.173.245.102 2604 INT 0 1 189 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:30:58.730767 0.000000 udp 10.0.2.105 7010 -> 219.76.180.167 5162 INT 0 1 163 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:05.410523 0.000000 udp 10.0.2.105 7010 -> 200.8.57.75 1308 INT 0 1 249 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:13.712404 0.000000 udp 10.0.2.105 7010 -> 95.227.80.204 3289 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:18.489142 0.000066 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:31:21.894074 0.000000 udp 10.0.2.105 7010 -> 181.225.37.154 7918 INT 0 1 128 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:28.954915 0.000000 udp 10.0.2.105 7010 -> 24.240.171.82 8021 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:37.587081 0.000000 udp 10.0.2.105 7010 -> 80.177.43.66 9982 INT 0 1 209 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:42.493537 0.000053 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:31:45.588008 0.000000 udp 10.0.2.105 7010 -> 79.31.65.247 7701 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:31:54.103995 0.000000 udp 10.0.2.105 7010 -> 203.122.210.133 2648 INT 0 1 129 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:00.269448 0.000000 udp 10.0.2.105 7010 -> 218.188.206.39 7384 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:06.518013 0.217893 udp 10.0.2.105 7010 <-> 108.235.114.121 8839 CON 0 0 2 689 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:07.158356 0.000000 udp 10.0.2.105 7010 -> 121.7.130.129 6612 INT 0 1 278 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:11.495431 0.000100 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:32:12.176177 0.350196 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 842 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:13.151891 0.000000 udp 10.0.2.105 7010 -> 95.252.126.164 7829 INT 0 1 236 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:21.229512 0.196702 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 807 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:21.528162 0.000000 udp 10.0.2.105 7010 -> 82.53.116.51 2254 INT 0 1 156 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:24.778520 3.000286 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 16:32:28.779689 0.000000 udp 10.0.2.105 7010 -> 189.164.14.139 1590 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:31.784238 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:32:35.239802 0.000000 udp 10.0.2.105 7010 -> 210.241.49.15 1046 INT 0 1 161 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:39.785769 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:32:39.996307 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:32:40.507122 0.058799 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 804 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:40.627294 0.000000 udp 10.0.2.105 7010 -> 95.225.247.32 6524 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:47.116657 0.000000 udp 10.0.2.105 7010 -> 72.220.170.109 7818 INT 0 1 207 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:52.968985 0.115978 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 658 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:53.138338 0.085799 udp 10.0.2.105 7010 <-> 88.240.152.173 6019 CON 0 0 2 752 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:53.254567 0.000000 udp 10.0.2.105 7010 -> 161.43.220.14 9895 INT 0 1 296 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:32:55.788734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:32:59.665181 0.079623 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 740 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:32:59.821138 0.000000 udp 10.0.2.105 7010 -> 72.50.80.88 2083 INT 0 1 139 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:04.490971 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:33:08.567525 0.289077 udp 10.0.2.105 7010 <-> 182.188.163.168 4537 CON 0 0 2 721 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:33:09.040042 0.205369 udp 10.0.2.105 7010 <-> 190.213.20.84 9924 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:33:09.526616 0.000000 udp 10.0.2.105 7010 -> 76.84.153.33 2521 INT 0 1 162 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:15.817721 0.000000 udp 10.0.2.105 7010 -> 66.133.206.139 9176 INT 0 1 242 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:24.440399 0.000000 udp 10.0.2.105 7010 -> 67.188.20.253 9015 INT 0 1 245 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:27.795156 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:33:28.986856 0.000048 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:33:30.408849 0.000000 udp 10.0.2.105 7010 -> 71.83.116.52 7983 INT 0 1 297 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:36.417630 0.000000 udp 10.0.2.105 7010 -> 87.5.12.56 6692 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:41.825167 0.000000 udp 10.0.2.105 7010 -> 108.73.114.185 7576 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:50.007036 0.000000 udp 10.0.2.105 7010 -> 203.177.171.27 1041 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:33:54.993792 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:33:58.549433 0.238427 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 751 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:33:58.803962 0.000000 udp 10.0.2.105 7010 -> 108.181.66.70 6857 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:04.197618 0.000000 udp 10.0.2.105 7010 -> 88.203.200.250 3249 INT 0 1 198 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:11.577417 0.000000 udp 10.0.2.105 7010 -> 190.155.223.76 8764 INT 0 1 181 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:17.596942 0.179436 udp 10.0.2.105 7010 <-> 77.172.62.169 9623 CON 0 0 2 759 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:34:17.978039 0.334214 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 814 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:34:18.539694 0.234195 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 756 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:34:19.143093 0.000000 udp 10.0.2.105 7010 -> 50.73.52.221 6919 INT 0 1 303 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:22.554927 0.000074 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:34:26.469386 0.000000 udp 10.0.2.105 7010 -> 68.81.165.222 4625 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:33.078671 0.000000 udp 10.0.2.105 7010 -> 125.215.190.253 5233 INT 0 1 169 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:40.690044 0.119887 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 754 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:34:40.835140 0.000000 udp 10.0.2.105 7010 -> 180.51.135.246 1151 INT 0 1 123 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:48.049824 0.000000 udp 10.0.2.105 7010 -> 66.177.67.39 3570 INT 0 1 192 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:34:52.987328 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:34:55.851209 0.000000 udp 10.0.2.105 7010 -> 72.185.230.51 7753 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:00.918958 0.000000 udp 10.0.2.105 7010 -> 72.251.13.90 2321 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:06.807169 0.000000 udp 10.0.2.105 7010 -> 198.72.60.198 2497 INT 0 1 256 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:11.914460 0.000000 udp 10.0.2.105 7010 -> 91.183.201.190 6902 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:17.532915 0.172243 udp 10.0.2.105 7010 -> 142.165.14.102 6117 INT 0 1 216 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:17.705158 0.000000 icmp 142.165.14.102 0x0303 -> 10.0.2.105 0xe517 URP 192 1 216 flow=Background 1970/02/26 16:35:22.490120 0.000040 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:35:23.601656 0.000000 udp 10.0.2.105 7010 -> 24.212.7.34 6610 INT 0 1 241 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:31.973531 0.056677 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:35:32.108029 0.000000 udp 10.0.2.105 7010 -> 210.124.233.2 8650 INT 0 1 136 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:37.221455 0.077063 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 798 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:35:37.610830 0.000000 udp 10.0.2.105 7010 -> 2.227.113.242 3042 INT 0 1 165 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:44.972199 0.125068 udp 10.0.2.105 7010 <-> 2.86.71.68 7012 CON 0 0 2 760 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:35:45.157110 0.000000 udp 10.0.2.105 7010 -> 75.149.59.254 3982 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:35:49.488456 0.000069 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:35:54.125696 0.000000 udp 10.0.2.105 7010 -> 84.186.65.149 7869 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:00.645027 0.000000 udp 10.0.2.105 7010 -> 180.190.164.117 1239 INT 0 1 293 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:06.353137 0.000000 udp 10.0.2.105 7010 -> 75.84.229.36 3652 INT 0 1 206 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:14.625020 0.000000 udp 10.0.2.105 7010 -> 95.210.233.209 5298 INT 0 1 286 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:19.491763 0.000065 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:36:23.397436 0.000000 udp 10.0.2.105 7010 -> 83.153.23.110 4807 INT 0 1 202 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:30.547826 0.000000 udp 10.0.2.105 7010 -> 128.111.92.83 7922 INT 0 1 191 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:36.804055 0.000000 udp 10.0.2.105 7010 -> 181.209.150.240 8575 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:43.322404 0.000000 udp 10.0.2.105 7010 -> 63.131.60.201 3971 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:48.032803 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:36:51.064544 0.000000 udp 10.0.2.105 7010 -> 171.100.235.74 3054 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:36:59.783867 0.000000 udp 10.0.2.105 7010 -> 84.107.208.251 5121 INT 0 1 225 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:06.674940 0.000000 udp 10.0.2.105 7010 -> 50.161.134.135 9921 INT 0 1 259 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:12.117981 0.000000 udp 10.0.2.105 7010 -> 64.130.164.55 8073 INT 0 1 306 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:16.782356 0.000060 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:37:20.331835 0.040142 udp 10.0.2.105 7010 <-> 78.134.105.186 6943 CON 0 0 2 720 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:20.431417 0.000000 udp 10.0.2.105 7010 -> 173.239.143.42 9596 INT 0 1 235 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:27.132508 0.079194 udp 10.0.2.105 7010 <-> 31.207.252.217 6577 CON 0 0 2 823 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:27.230192 0.978469 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 707 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:28.362695 0.343973 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 681 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:28.808617 0.000000 udp 10.0.2.105 7010 -> 190.238.68.34 1372 INT 0 1 247 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:33.760392 0.064713 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 765 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:33.943008 0.000000 udp 10.0.2.105 7010 -> 209.48.84.15 5018 INT 0 1 142 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:41.048775 0.215491 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:41.345522 0.000000 udp 10.0.2.105 7010 -> 70.189.57.97 8256 INT 0 1 199 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:45.918441 0.000062 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:37:49.217487 0.000000 udp 10.0.2.105 7010 -> 186.42.1.26 1024 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:37:58.105335 0.172489 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 764 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:37:58.318110 0.000000 udp 10.0.2.105 7010 -> 116.49.154.68 7651 INT 0 1 284 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:04.584638 0.000000 udp 10.0.2.105 7010 -> 122.169.105.61 7000 INT 0 1 227 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:09.663358 0.233284 udp 10.0.2.105 7010 -> 190.236.66.112 7588 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:09.896642 0.000000 icmp 190.236.66.112 0x0303 -> 10.0.2.105 0xa41d URP 192 1 319 flow=Background 1970/02/26 16:38:14.554378 0.000047 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:38:15.060591 0.000000 udp 10.0.2.105 7010 -> 99.231.130.110 2602 INT 0 1 158 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:21.026736 0.000000 udp 10.0.2.105 7010 -> 94.138.172.34 7117 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:26.686962 0.000000 udp 10.0.2.105 7010 -> 69.234.25.81 7606 INT 0 1 289 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:33.635007 0.196874 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 738 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:38:33.842941 0.000000 udp 10.0.2.105 7010 -> 58.61.214.216 4718 INT 0 1 253 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:38.491602 0.000095 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:38:40.965527 0.200149 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 683 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:38:41.364195 0.000000 udp 10.0.2.105 7010 -> 110.32.124.16 8341 INT 0 1 208 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:48.696495 0.000000 udp 10.0.2.105 7010 -> 88.59.190.210 9048 INT 0 1 292 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:38:56.337505 0.205012 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 781 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:38:58.167251 0.000000 udp 10.0.2.105 7010 -> 110.139.207.12 1068 INT 0 1 138 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:02.986481 0.000055 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:39:05.911665 0.000000 udp 10.0.2.105 7010 -> 69.130.154.48 1271 INT 0 1 143 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:14.789563 0.068476 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 737 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:15.184426 0.081038 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 706 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:15.398186 0.337509 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 666 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:15.910331 0.251890 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 723 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:16.339693 0.000000 udp 10.0.2.105 7010 -> 93.34.179.218 9276 INT 0 1 299 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:24.257707 0.319311 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 662 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:24.600388 0.067835 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 718 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:24.715978 0.125913 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 802 flow=From-Botnet-V2-UDP-Established 1970/02/26 16:39:24.937689 0.000000 udp 10.0.2.105 7010 -> 95.240.125.163 6576 INT 0 1 172 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:28.994247 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:39:31.162926 0.000000 udp 10.0.2.105 7010 -> 87.22.129.177 1178 INT 0 1 291 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:31.805349 2.997797 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 16:39:38.807855 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:39:40.131298 0.000000 udp 10.0.2.105 7010 -> 24.16.42.169 3979 INT 0 1 274 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 16:39:46.809794 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:40:02.813009 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:40:34.828984 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:46:38.836708 3.018011 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 16:46:46.026482 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:46:54.014764 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:47:09.863510 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:47:41.863072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:59:23.885582 3.029575 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 16:59:30.902230 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:59:38.903826 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:59:54.906360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 16:59:55.437961 0.000123 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 16:59:55.438171 2.759058 tcp 10.0.2.105 51260 -> 211.38.175.27 4598 FSPA* 0 0 15 1760 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:00:26.912916 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:06:30.918846 3.013308 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 17:06:37.936541 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:06:45.938134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:07:01.940229 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:07:33.946687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:10:11.223534 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 17:10:11.223631 0.046860 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:11.270945 0.226159 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:11.497622 0.169856 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 531 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:11.667877 0.085320 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:11.753602 0.378402 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:12.132423 0.164853 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:12.297701 0.172213 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:12.470372 0.490290 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:12.961079 0.054315 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.015841 0.056545 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.072882 0.186312 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.259640 0.204760 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.464812 0.088844 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.554050 0.347822 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:13.902261 0.181054 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:14.083795 0.196098 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:14.280463 0.182787 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:14.463644 0.000000 udp 10.0.2.105 7010 -> 108.235.114.121 8839 INT 0 1 154 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:10:31.944686 0.052705 tcp 10.0.2.105 51261 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:31.997707 0.053572 tcp 10.0.2.105 51262 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:32.051617 0.123526 tcp 10.0.2.105 51263 -> 195.113.214.249 443 SRPA* 0 0 30 21741 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:32.175738 0.331415 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:32.507605 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 108 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:10:50.610482 0.053497 tcp 10.0.2.105 51264 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:50.664317 0.054666 tcp 10.0.2.105 51265 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:50.719347 0.145675 tcp 10.0.2.105 51266 -> 195.113.214.249 443 SRPA* 0 0 20 11336 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:10:50.865673 0.047937 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 388 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:50.914013 0.107941 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:10:51.022345 0.000000 udp 10.0.2.105 7010 -> 88.240.152.173 6019 INT 0 1 218 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:11:09.988399 0.053502 tcp 10.0.2.105 51267 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:10.042218 0.053919 tcp 10.0.2.105 51268 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:10.096614 0.144360 tcp 10.0.2.105 51269 -> 195.113.214.249 443 SRPA* 0 0 21 12432 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:10.241728 0.088492 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:10.330798 0.282232 udp 10.0.2.105 7010 <-> 182.188.163.168 4537 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:10.613483 0.000000 udp 10.0.2.105 7010 -> 190.213.20.84 9924 INT 0 1 168 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:11:25.650463 0.052804 tcp 10.0.2.105 51270 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:25.703565 0.054839 tcp 10.0.2.105 51271 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:25.758667 0.149405 tcp 10.0.2.105 51272 -> 195.113.214.249 443 SRPA* 0 0 40 21314 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:25.908751 0.238304 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:26.147555 0.341112 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:26.489091 0.000000 udp 10.0.2.105 7010 -> 77.172.62.169 9623 INT 0 1 147 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:11:41.973988 0.051570 tcp 10.0.2.105 51273 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:42.025834 0.053908 tcp 10.0.2.105 51274 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:42.080008 0.142023 tcp 10.0.2.105 51275 -> 195.113.214.249 443 SRPA* 0 0 20 10880 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:42.222603 0.233752 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 480 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:42.456745 0.106937 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:42.564069 0.056379 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:42.620814 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 INT 0 1 153 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:11:57.997049 0.052970 tcp 10.0.2.105 51276 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:58.050314 0.053165 tcp 10.0.2.105 51277 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:58.103766 0.140663 tcp 10.0.2.105 51278 -> 195.113.214.249 443 SRPA* 0 0 23 12996 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:11:58.244922 0.119847 udp 10.0.2.105 7010 <-> 2.86.71.68 7012 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:58.365170 0.039388 udp 10.0.2.105 7010 <-> 78.134.105.186 6943 CON 0 0 2 254 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:58.405005 0.626449 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.031951 0.224923 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.257287 0.063584 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.321242 0.210699 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.532357 0.175783 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.708577 0.161859 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:11:59.870846 0.198696 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:00.069988 0.178624 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:00.249016 0.064404 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:00.313872 0.070532 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:00.384757 0.420775 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:00.805922 0.248739 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:01.055017 0.065924 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:01.121387 0.324061 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:12:01.445821 0.128257 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:13:51.963129 3.001541 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 17:13:58.970609 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:14:06.972135 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:14:22.975001 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:14:54.980885 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:20:58.986674 3.011943 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 17:21:06.004580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:21:14.006223 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:21:30.009553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:22:02.015167 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:28:06.021325 3.013264 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 17:28:13.038294 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:28:21.043834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:28:37.042830 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:29:09.049464 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:29:58.200041 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 17:29:58.200190 1.957897 tcp 10.0.2.105 51279 -> 211.38.175.27 4598 FSPA* 0 0 14 1638 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:35:13.055422 3.016343 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 17:35:20.072401 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:35:28.073919 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:35:44.076902 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:36:16.092981 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:42:16.731669 0.024064 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 17:42:16.755853 0.000000 udp 10.0.2.105 7010 -> 108.235.114.121 8839 INT 0 1 232 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:42:20.103318 2.997459 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 17:42:27.106827 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:42:35.090382 0.053557 tcp 10.0.2.105 51280 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:35.108081 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:42:35.144179 0.051926 tcp 10.0.2.105 51281 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:35.196394 0.138019 tcp 10.0.2.105 51282 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:35.334895 0.342188 udp 10.0.2.105 7010 <-> 85.74.90.216 2536 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:42:35.677477 0.000000 udp 10.0.2.105 7010 -> 88.240.152.173 6019 INT 0 1 184 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:42:51.110735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:42:52.032737 0.052264 tcp 10.0.2.105 51283 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:52.085284 0.032310 tcp 10.0.2.105 51284 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:52.117875 0.140052 tcp 10.0.2.105 51285 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:42:52.258488 0.000000 udp 10.0.2.105 7010 -> 190.213.20.84 9924 INT 0 1 195 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:43:08.907241 0.052894 tcp 10.0.2.105 51286 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:08.960534 0.052943 tcp 10.0.2.105 51287 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:09.013751 0.139855 tcp 10.0.2.105 51288 -> 195.113.214.249 443 SRPA* 0 0 21 12888 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:09.154131 0.000000 udp 10.0.2.105 7010 -> 77.172.62.169 9623 INT 0 1 132 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:43:23.116990 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:43:27.925705 0.031842 tcp 10.0.2.105 51289 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:27.957917 0.053089 tcp 10.0.2.105 51290 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:28.011426 0.143214 tcp 10.0.2.105 51291 -> 195.113.214.249 443 SRPA* 0 0 35 18828 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:28.155223 0.095154 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.250770 0.045084 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.296244 0.169224 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.465944 0.160268 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.626730 0.079198 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.706316 0.154908 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:28.861603 0.148365 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:29.010372 0.352416 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:29.363225 0.088896 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:29.452642 0.220750 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:29.673757 0.480453 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:30.154574 0.151781 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:30.390792 0.059316 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:30.450510 0.053740 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:30.506520 0.182312 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:30.689261 0.342176 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.031821 0.122863 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.155106 0.180860 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.336577 0.343314 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 583 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.680299 0.099111 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.779819 0.070704 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 308 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.850969 0.071750 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:31.923114 0.000000 udp 10.0.2.105 7010 -> 182.188.163.168 4537 INT 0 1 133 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:43:47.283705 0.052230 tcp 10.0.2.105 51292 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:47.336205 0.052661 tcp 10.0.2.105 51293 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:47.389208 0.140226 tcp 10.0.2.105 51294 -> 195.113.214.249 443 SRPA* 0 0 20 11372 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:43:47.530044 0.230104 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:47.760643 0.324641 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:48.085691 0.050790 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:48.136918 0.118784 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:43:48.256079 0.000000 udp 10.0.2.105 7010 -> 161.200.34.23 2983 INT 0 1 193 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:44:04.246817 0.032468 tcp 10.0.2.105 51295 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:04.279698 0.051714 tcp 10.0.2.105 51296 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:04.331735 0.126070 tcp 10.0.2.105 51297 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:04.458477 0.000000 udp 10.0.2.105 7010 -> 78.134.105.186 6943 INT 0 1 106 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:44:22.633110 0.031625 tcp 10.0.2.105 51298 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:22.665034 0.053170 tcp 10.0.2.105 51299 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:22.718514 0.146035 tcp 10.0.2.105 51300 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:22.865612 0.849370 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:23.715419 0.000000 udp 10.0.2.105 7010 -> 2.86.71.68 7012 INT 0 1 279 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 17:44:40.448494 0.051985 tcp 10.0.2.105 51301 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:40.500782 0.053427 tcp 10.0.2.105 51302 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:40.554511 0.126821 tcp 10.0.2.105 51303 -> 195.113.214.249 443 SRPA* 0 0 21 10934 flow=From-Botnet-V2-TCP-Established 1970/02/26 17:44:40.681836 0.059181 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:40.741360 0.210599 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:40.952400 0.175652 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:41.128641 0.344477 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:41.473575 0.198820 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:41.672765 0.191002 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:41.864232 0.067528 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:41.932124 0.076772 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:42.009307 0.166596 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:42.176302 0.242472 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 279 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:42.419183 0.061640 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 244 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:42.481182 0.325572 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:42.807100 0.330765 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 513 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:44:43.138310 0.104271 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 17:57:08.125719 3.022435 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 17:57:15.142977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:57:23.144690 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:57:39.147635 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 17:58:11.153712 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:00:00.161200 0.000058 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 18:00:00.161315 2.136130 tcp 10.0.2.105 51304 -> 211.38.175.27 4598 FSPA* 0 0 14 1527 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:04:15.160713 3.000622 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:04:22.167164 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:04:30.173723 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:04:46.181859 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:05:18.187608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:11:36.194820 3.010628 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:11:43.211341 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:11:51.212782 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:12:07.215964 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:12:39.221893 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:14:58.071738 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 18:14:58.071930 0.000000 udp 10.0.2.105 7010 -> 182.188.163.168 4537 INT 0 1 203 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:15:16.419484 0.053537 tcp 10.0.2.105 51305 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:16.473311 0.420340 tcp 10.0.2.105 51306 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:16.893926 0.146216 tcp 10.0.2.105 51307 -> 195.113.214.249 443 SRPA* 0 0 33 18096 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:17.040898 0.233580 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:15:17.274872 0.000000 udp 10.0.2.105 7010 -> 2.86.71.68 7012 INT 0 1 238 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:15:34.945172 0.052722 tcp 10.0.2.105 51308 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:34.998254 0.054265 tcp 10.0.2.105 51309 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:35.052765 0.146387 tcp 10.0.2.105 51310 -> 195.113.214.249 443 SRPA* 0 0 39 31704 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:35.199921 0.000000 udp 10.0.2.105 7010 -> 78.134.105.186 6943 INT 0 1 263 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:15:51.608685 0.083712 tcp 10.0.2.105 51311 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:51.692714 0.053720 tcp 10.0.2.105 51312 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:51.746694 0.147902 tcp 10.0.2.105 51313 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:15:51.895068 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 229 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:16:07.722051 0.030384 tcp 10.0.2.105 51314 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:16:07.752708 0.031675 tcp 10.0.2.105 51315 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:16:07.784699 0.120068 tcp 10.0.2.105 51316 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:16:07.905284 0.134844 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:08.040535 0.044361 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:08.085263 0.348990 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 331 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:08.434717 0.154863 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 376 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:08.589967 0.155048 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 492 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:08.745411 0.169142 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:12.567405 0.160504 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:12.728416 0.083939 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:12.812854 0.090710 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 258 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:12.903979 0.481314 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:13.385694 0.224968 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:13.611055 0.128624 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:13.740147 0.151548 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:13.892084 0.348183 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.240677 0.180548 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.421900 0.053319 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.475597 0.044067 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.520047 0.176768 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.697190 0.088781 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:14.786374 0.346983 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.133819 0.107602 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.241794 0.049204 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.291475 0.053434 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 445 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.345322 0.338498 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.684183 0.250356 udp 10.0.2.105 7010 <-> 174.52.213.208 2114 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:15.934888 0.119204 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 296 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:16.054459 0.225565 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:16.280428 0.176505 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:16.457307 0.063143 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:16.520815 0.226512 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:16.747705 0.498434 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 366 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.246548 0.192365 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.439303 0.178526 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.618208 0.068018 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.686599 0.072844 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.759794 0.166144 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:17.926307 0.325157 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 393 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:18.251907 0.331543 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:18.583835 0.114283 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:18.698508 0.252644 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:16:18.951659 0.065918 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:18:43.228164 3.001228 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 18:18:50.235311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:18:58.236903 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:19:14.239549 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:19:46.245735 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:25:50.251323 3.016136 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:25:57.269379 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:26:05.270824 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:26:21.273688 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:26:53.283052 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:30:02.301866 0.000086 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 18:30:02.302043 2.019318 tcp 10.0.2.105 51317 -> 211.38.175.27 4598 FSPA* 0 0 14 1709 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:32:57.285742 3.011513 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:33:04.303305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:33:12.304791 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:33:28.307780 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:34:00.313896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:40:04.320193 3.019533 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:40:11.337361 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:40:19.338895 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:40:35.341676 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:41:07.347613 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:46:47.523456 0.010764 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 18:46:47.534315 0.000000 udp 10.0.2.105 7010 -> 85.74.90.216 2536 INT 0 1 219 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:47:03.351973 0.069511 tcp 10.0.2.105 51318 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:03.421782 0.053694 tcp 10.0.2.105 51319 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:03.475758 0.145913 tcp 10.0.2.105 51320 -> 195.113.214.249 443 SRPA* 0 0 21 11428 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:03.622318 0.233079 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:03.855811 0.400135 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.256429 0.094141 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.351096 0.044716 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.396397 0.154180 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.551012 0.155212 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.706676 0.175099 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 328 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:04.882127 0.161137 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:05.043664 0.096955 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 485 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:05.141039 0.084567 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:05.225962 0.110809 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:05.337177 0.495368 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 352 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:05.833057 0.215149 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.048607 0.184423 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.233539 0.054263 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.288153 0.059616 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 419 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.348153 0.150620 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.499145 0.351573 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:06.851142 0.180235 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 249 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.031785 0.072225 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.104423 0.337728 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.442592 0.103247 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.546208 0.047686 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.594355 0.050807 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.645553 0.119208 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 508 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:07.765141 0.286303 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 265 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:08.051804 0.337450 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:08.389680 0.000000 udp 10.0.2.105 7010 -> 174.52.213.208 2114 INT 0 1 91 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 18:47:11.353391 3.001806 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:47:18.360897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:47:25.572555 0.030885 tcp 10.0.2.105 51321 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:25.603774 0.052866 tcp 10.0.2.105 51322 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:25.656953 0.125215 tcp 10.0.2.105 51323 -> 195.113.214.249 443 SRPA* 0 0 35 19246 flow=From-Botnet-V2-TCP-Established 1970/02/26 18:47:25.782717 0.211031 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:25.994134 0.174945 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:26.169496 0.061676 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:26.231593 0.376359 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:26.362927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:47:26.608485 0.201598 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:26.810468 0.178601 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:26.989489 0.067668 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:27.057579 0.071091 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:27.129106 0.167927 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 329 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:27.297470 0.116186 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:27.414070 0.320065 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:27.734598 0.335983 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:28.071049 0.246373 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:28.317910 0.064040 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 505 flow=From-Botnet-V2-UDP-Established 1970/02/26 18:47:42.365744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:48:14.371646 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:54:18.377654 3.022912 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 18:54:25.395136 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:54:33.396734 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:54:49.399763 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 18:55:21.405572 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:00:04.323274 0.000079 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 19:00:04.323437 1.926509 tcp 10.0.2.105 51324 -> 211.38.175.27 4598 FSPA* 0 0 14 1662 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:01:25.412026 3.001345 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:01:32.418952 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:01:40.420738 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:01:56.423486 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:02:28.700911 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:08:32.445374 3.021554 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:08:39.463133 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:08:47.466539 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:09:03.467319 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:09:35.473586 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:15:39.479649 3.026257 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:15:46.506995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:15:54.508492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:16:10.511650 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:16:42.517253 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:17:50.916002 0.000068 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 19:17:50.916181 0.000000 udp 10.0.2.105 7010 -> 174.52.213.208 2114 INT 0 1 213 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 19:18:08.453636 0.031713 tcp 10.0.2.105 51325 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:18:08.485686 0.054761 tcp 10.0.2.105 51326 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:18:08.540726 0.125333 tcp 10.0.2.105 51327 -> 195.113.214.249 443 SRPA* 0 0 22 12942 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:18:08.666759 0.091781 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:08.758972 0.234546 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:08.993877 0.353786 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 423 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:09.348089 0.153011 udp 10.0.2.105 7010 <-> 65.92.208.16 8057 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:09.501516 0.148013 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:09.649912 0.178180 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 551 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:09.828603 0.159104 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:09.988121 0.118585 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:10.107126 0.086789 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 297 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:10.194278 0.118620 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:10.313351 0.045035 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:10.358931 0.214942 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:10.574229 0.495358 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.069965 0.053699 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.124044 0.055095 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 324 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.179612 0.180582 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 461 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.360649 0.171322 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 281 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.532427 0.073295 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.606118 0.144142 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:11.750684 0.367641 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.118722 0.070190 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.189269 0.051133 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.240826 0.107008 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 525 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.348264 0.416455 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.765106 0.102063 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:12.867614 0.333268 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 462 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:13.201369 0.334372 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:13.536210 0.061077 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:13.597712 0.213328 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 503 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:13.811465 0.176398 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 355 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:13.988221 0.223182 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 233 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.211840 0.191932 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.404436 0.178455 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.583291 0.069936 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 260 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.653622 0.071162 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.725275 0.162745 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:14.888398 0.330712 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 263 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:15.219626 0.255818 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 342 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:15.475874 0.067566 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:15.543815 0.128821 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 440 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:18:15.673061 0.323855 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:22:46.523267 3.021931 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:22:53.550900 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:23:01.552553 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:23:17.555425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:23:49.561580 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:29:53.567814 3.000785 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:30:00.574872 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:30:06.253428 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 19:30:06.253709 2.349954 tcp 10.0.2.105 51328 -> 211.38.175.27 4598 FSPA* 0 0 14 1750 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:30:08.582592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:30:24.579227 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:30:57.483048 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:37:00.616592 2.997256 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:37:07.619213 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:37:15.620896 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:37:31.623552 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:38:03.629709 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:44:07.635557 3.023314 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:44:14.653000 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:44:22.654749 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:44:38.658098 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:45:10.664382 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:48:30.000467 0.000081 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 19:48:30.000628 0.352851 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 408 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:30.368454 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 175 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 19:48:47.897991 0.053863 tcp 10.0.2.105 51329 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:48:47.952085 0.032583 tcp 10.0.2.105 51330 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:48:47.984961 0.126098 tcp 10.0.2.105 51331 -> 195.113.214.249 443 SRPA* 0 0 20 11374 flow=From-Botnet-V2-TCP-Established 1970/02/26 19:48:48.111815 0.074379 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.186616 0.233134 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 497 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.420319 0.153353 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.574028 0.176091 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 422 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.750473 0.161618 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 541 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.912556 0.081268 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:48.994234 0.084482 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 397 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:49.079105 0.149366 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 247 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:49.228804 0.471598 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 458 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:49.700835 0.053645 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:49.754870 0.046140 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:49.801412 0.212024 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 303 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.013857 0.043434 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.057770 0.175809 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 426 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.233989 0.179761 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 320 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.414152 0.075019 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.489619 0.149246 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 363 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.639238 0.347772 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:50.987387 0.052701 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.040616 0.050794 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 515 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.091799 0.107046 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 448 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.199182 0.203662 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.403245 0.338852 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 323 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.742468 0.061301 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.804111 0.105623 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 522 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:51.910109 0.327940 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:52.238512 0.360013 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 425 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:52.598971 0.204145 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 269 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:52.803552 0.211989 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 536 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.015986 0.173209 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 386 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.189555 0.191002 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.380968 0.062878 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.444266 0.078804 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 528 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.523493 0.167507 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:53.691395 0.333938 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:54.025741 0.116778 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:54.142971 0.325700 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 354 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:54.469073 0.251933 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 562 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:48:54.721386 0.066801 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 250 flow=From-Botnet-V2-UDP-Established 1970/02/26 19:58:10.677752 3.019465 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 19:58:17.694599 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:58:25.696957 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:58:41.699072 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 19:59:13.705662 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:00:08.605437 0.000078 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 20:00:08.605600 2.741809 tcp 10.0.2.105 51332 -> 211.38.175.27 4598 FSPA* 0 0 14 1687 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:05:17.711968 3.001430 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:05:24.719102 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:05:32.720708 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:05:48.723602 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:06:20.729392 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:12:24.736120 3.001403 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:12:31.743160 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:12:39.744669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:12:55.747336 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:13:28.093513 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:19:04.848971 0.016110 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 20:19:04.865207 0.000000 udp 10.0.2.105 7010 -> 65.92.208.16 8057 INT 0 1 222 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 20:19:22.775553 0.052227 tcp 10.0.2.105 51333 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:19:22.849760 0.053147 tcp 10.0.2.105 51334 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:19:22.903328 0.123761 tcp 10.0.2.105 51335 -> 195.113.214.249 443 SRPA* 0 0 45 40804 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:19:23.027906 0.349618 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:23.377964 0.078564 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 406 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:23.456906 0.233318 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:23.690639 0.152393 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 357 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:23.843463 0.175747 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.019605 0.161671 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.181721 0.091062 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.273222 0.091296 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.364951 0.129750 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 478 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.495208 0.046028 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 270 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.541719 0.204304 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.746656 0.047726 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 516 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.794942 0.180945 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:24.976484 0.480792 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 535 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:25.457702 0.054321 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 409 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:25.512454 0.174496 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 420 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:25.687391 0.073715 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:25.761539 0.150269 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:25.912387 0.341572 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 372 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.254343 0.055378 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 314 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.310265 0.055702 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 246 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.366423 0.130530 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 207 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.497627 0.063909 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.562013 0.107729 udp 10.0.2.105 7010 <-> 197.205.50.46 2337 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:26.670157 0.335739 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 286 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:27.006328 0.577282 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:27.583997 0.332609 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:27.916996 0.275082 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 316 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:28.192593 0.191860 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:28.384834 0.210987 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:28.596238 0.170156 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 292 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:28.766892 0.209326 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 222 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:28.976731 0.167167 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:29.144299 0.809063 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:29.953768 0.126380 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:30.080543 0.063985 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:30.144919 0.074425 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 455 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:30.219713 0.067533 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:30.287652 0.323576 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:30.611651 0.243078 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:19:31.770671 3.000779 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:19:38.776733 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:19:46.778566 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:20:02.781195 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:20:34.787634 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:26:38.803613 3.001834 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:26:45.810920 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:26:53.812787 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:27:09.815179 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:27:41.821205 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:30:11.346984 0.000115 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 20:30:11.347178 2.021312 tcp 10.0.2.105 51336 -> 211.38.175.27 4598 FSPA* 0 0 14 1635 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:33:45.826744 3.002434 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:33:52.835149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:34:00.836045 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:34:16.849203 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:34:48.855561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:40:52.861241 3.022295 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:40:59.879131 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:41:07.880316 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:41:23.883325 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:41:55.889398 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:47:59.897126 2.999955 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 20:48:06.903199 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:48:14.904456 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:48:30.907239 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:49:02.913664 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:49:46.466425 0.000054 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 20:49:46.466535 0.350241 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 446 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:49:46.817297 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 INT 0 1 275 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 20:50:01.960394 0.044342 tcp 10.0.2.105 51337 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:02.005028 0.033856 tcp 10.0.2.105 51338 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:02.039212 0.104962 tcp 10.0.2.105 51339 -> 195.113.214.249 443 SRPA* 0 0 33 24785 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:02.144769 0.232755 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 289 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:02.377923 0.149403 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 511 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:02.527791 0.169746 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:02.697980 0.160620 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 466 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:02.859024 0.210150 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 224 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.069653 0.091766 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.161848 0.208886 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.371135 0.051681 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.423235 0.175296 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.599058 0.161881 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.761382 0.046380 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:03.808386 0.458616 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:04.267454 0.053454 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:04.321315 0.170308 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:04.492006 0.074021 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:04.566398 0.155516 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:04.722304 0.348971 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 521 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:05.071692 0.054205 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:05.126299 0.050903 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:05.177617 0.000000 udp 10.0.2.105 7010 -> 197.205.50.46 2337 INT 0 1 188 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 20:50:22.528838 0.031268 tcp 10.0.2.105 51340 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:22.560446 0.031644 tcp 10.0.2.105 51341 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:22.592360 0.129404 tcp 10.0.2.105 51342 -> 195.113.214.249 443 SRPA* 0 0 22 11444 flow=From-Botnet-V2-TCP-Established 1970/02/26 20:50:22.722339 0.326915 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:23.049626 0.106716 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:23.156745 0.061425 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:23.218560 0.326581 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:23.545526 0.190607 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 365 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:23.736514 0.368143 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:24.105057 0.330075 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:24.435509 0.212620 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 444 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:24.648573 0.176013 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 237 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:24.825054 0.209340 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.034833 0.166571 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 367 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.201800 0.068343 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 477 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.270534 0.072960 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.343899 0.065608 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 435 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.409909 0.381721 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.792088 0.120715 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 449 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:25.913339 0.319046 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:50:26.232835 0.249776 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/26 20:55:06.919635 3.017981 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 20:55:13.936962 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:55:21.938592 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:55:37.940977 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 20:56:09.947405 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:00:13.367797 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 21:00:13.367951 0.658072 tcp 10.0.2.105 51343 -> 211.38.175.27 4598 SPA_* 0 0 9 999 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:00:19.748611 0.036263 tcp 10.0.2.105 51343 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:02:13.953094 3.002569 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:02:20.960923 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:02:28.962616 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:02:44.965266 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:03:16.972815 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:09:20.977422 3.025744 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:09:27.994726 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:09:35.996975 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:09:51.999340 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:10:24.005713 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:16:28.010566 3.012614 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:16:35.029031 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:16:43.030154 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:16:59.033119 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:17:31.039418 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:20:48.854039 0.000076 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 21:20:48.854228 0.104512 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 415 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:20:48.959122 0.000000 udp 10.0.2.105 7010 -> 197.205.50.46 2337 INT 0 1 94 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 21:21:06.433878 0.039380 tcp 10.0.2.105 51344 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:06.473560 0.032124 tcp 10.0.2.105 51345 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:06.505946 0.127411 tcp 10.0.2.105 51346 -> 195.113.214.249 443 SRPA* 0 0 41 23322 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:06.633861 0.367461 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.001842 0.216218 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 498 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.218539 0.233422 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.452421 0.152948 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 387 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.605865 0.159306 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 325 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.765593 0.209933 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:07.975981 0.057360 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:08.033767 0.085064 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:08.119327 0.078232 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:08.198017 0.047714 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 530 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:08.246135 1.222084 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:09.468617 0.179896 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:09.648942 0.157694 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 368 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:09.807023 0.075533 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 493 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:09.882912 0.149601 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:10.032908 0.505314 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 374 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:10.538649 0.054791 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 484 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:10.593833 0.056482 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 300 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:10.650700 0.067026 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:10.718095 0.346387 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:11.064875 0.067985 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:11.133278 0.328228 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 499 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:11.461891 0.119290 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 359 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:11.581600 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 254 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 21:21:29.272513 0.031835 tcp 10.0.2.105 51347 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:29.304652 0.032541 tcp 10.0.2.105 51348 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:29.337487 0.126231 tcp 10.0.2.105 51349 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:21:29.464541 0.192559 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:29.657520 0.368454 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:30.026353 0.176115 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:30.202852 0.330607 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:30.533860 0.203977 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 278 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:30.738405 0.196875 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:30.935705 0.167216 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.103339 0.066620 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.170371 0.074375 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.245152 0.069747 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.315243 0.396251 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 401 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.711931 0.129251 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:31.841592 0.324615 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:21:32.166637 0.250311 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:23:38.049811 3.001562 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 21:23:45.057407 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:23:53.059292 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:24:09.061987 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:24:41.067360 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:30:19.785090 0.043717 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 21:30:19.828945 3.749947 tcp 10.0.2.105 51350 -> 211.38.175.27 4598 FSPA* 0 0 14 1699 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:30:45.073531 3.001848 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:30:52.081124 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:31:00.082980 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:31:16.088941 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:31:48.091608 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:37:52.097396 3.012911 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:37:59.115254 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:38:07.116806 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:38:23.119581 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:38:55.125792 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:44:59.131589 3.011473 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 21:45:06.149006 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:45:14.150492 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:45:30.153468 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:46:02.159501 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:51:33.797123 0.015636 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 21:51:33.812905 0.234011 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:34.047310 0.000000 udp 10.0.2.105 7010 -> 95.252.173.157 3394 INT 0 1 197 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 21:51:51.974639 0.247617 tcp 10.0.2.105 51351 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:51:52.222544 0.032649 tcp 10.0.2.105 51352 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:51:52.255447 0.129481 tcp 10.0.2.105 51353 -> 195.113.214.249 443 SRPA* 0 0 22 11860 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:51:52.385402 0.350245 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:52.736090 0.648405 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:53.384928 0.162348 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:53.547707 0.217092 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:53.765323 0.233069 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:53.998767 0.087125 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 483 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.086277 0.127064 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.213718 0.045709 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 313 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.259846 0.055633 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.315968 0.152059 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.468435 0.161970 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.630925 0.072481 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 311 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.703802 0.151273 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 554 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:54.855455 0.318249 udp 10.0.2.105 7010 <-> 94.243.124.105 9865 CON 0 0 2 432 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:55.174155 0.179094 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 317 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:51:55.353607 0.000000 udp 10.0.2.105 7010 -> 80.153.225.69 9585 INT 0 1 260 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 21:52:13.394093 0.032008 tcp 10.0.2.105 51354 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:52:13.426551 0.031916 tcp 10.0.2.105 51355 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:52:13.458714 0.173745 tcp 10.0.2.105 51356 -> 195.113.214.249 443 SRPA* 0 0 73 78266 flow=From-Botnet-V2-TCP-Established 1970/02/26 21:52:13.633052 0.047480 udp 10.0.2.105 7010 <-> 2.29.105.254 5312 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:13.680979 0.348370 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.029808 0.063816 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.094133 0.055166 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.149838 0.216131 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 284 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.366378 0.106994 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 430 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.473765 0.355456 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 416 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:14.829622 0.176382 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 335 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:15.006413 0.191020 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 322 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:15.197889 0.764812 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:15.963121 0.325927 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:16.289468 0.214589 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 450 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:16.504599 0.196884 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:16.701889 0.167366 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:16.869658 0.063707 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:16.933864 0.074273 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:17.008733 0.065865 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:17.075043 0.318699 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 266 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:17.394117 0.479144 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 340 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:17.873658 0.129472 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:52:18.003531 0.248774 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 227 flow=From-Botnet-V2-UDP-Established 1970/02/26 21:58:37.167739 3.016112 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 21:58:44.185311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:58:52.221748 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:59:08.199530 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 21:59:40.205841 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:00:23.579742 0.000050 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 22:00:23.579858 0.713754 tcp 10.0.2.105 51357 -> 211.38.175.27 4598 SPA_* 0 0 9 1072 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:00:30.945015 0.028116 tcp 10.0.2.105 51357 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:05:44.212042 3.188326 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:05:51.367954 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:05:59.322297 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:06:15.233561 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:06:55.360598 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:12:54.397261 3.005300 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:13:01.354716 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:13:09.291940 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:13:25.081323 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:13:56.617914 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:20:01.303763 3.013320 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:20:08.321389 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:20:16.322823 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:20:32.326132 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:21:04.342380 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:22:46.359090 0.000056 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 22:22:46.359248 0.079080 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 347 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:46.438865 0.050717 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 395 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:46.489915 0.247182 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 234 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:46.737474 0.409075 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 427 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:47.146982 0.233877 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:47.381250 0.161103 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 274 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:47.542916 0.615001 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:48.158656 0.212499 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 489 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:48.371660 2.361463 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:50.733571 0.084220 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:50.818470 0.054461 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 294 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:50.873327 0.152399 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.026142 0.170614 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 570 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.197176 0.047564 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 394 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.245154 0.178676 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.424171 0.147306 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 502 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.571853 0.072479 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 362 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:22:51.644895 0.000000 udp 10.0.2.105 7010 -> 94.243.124.105 9865 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:23:09.443953 0.032092 tcp 10.0.2.105 51358 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:09.476287 0.032898 tcp 10.0.2.105 51359 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:09.509482 0.128766 tcp 10.0.2.105 51360 -> 195.113.214.249 443 SRPA* 0 0 39 29200 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:09.638834 0.000000 udp 10.0.2.105 7010 -> 2.29.105.254 5312 INT 0 1 265 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:23:25.085006 0.032694 tcp 10.0.2.105 51361 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:25.117994 0.032290 tcp 10.0.2.105 51362 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:25.150581 0.142320 tcp 10.0.2.105 51363 -> 195.113.214.249 443 SRPA* 0 0 33 18798 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:23:25.293640 0.341506 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 402 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:25.635544 0.222420 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 471 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:25.858345 0.119377 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:25.978099 0.062846 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 369 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:26.041364 0.055338 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 411 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:26.097164 0.190789 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 349 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:26.288349 0.330075 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 197 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:26.618834 0.172062 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 418 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:26.791328 0.210743 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 486 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.002543 0.341815 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 380 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.344775 0.230808 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.575967 0.190708 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 208 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.767058 0.072051 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 454 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.839514 0.069072 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 293 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:27.908972 0.167503 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 333 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:28.076855 0.068345 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 375 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:28.145611 0.129423 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 392 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:28.275440 0.324915 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 384 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:28.600751 0.644510 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 463 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:23:29.259715 0.248504 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 377 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:27:08.348149 3.001667 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 22:27:15.355630 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:27:23.357037 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:27:39.359965 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:28:11.366104 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:30:31.369284 0.000071 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 22:30:31.369447 0.702244 tcp 10.0.2.105 51364 -> 211.38.175.27 4598 SPA_* 0 0 9 1194 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:30:40.311391 0.033853 tcp 10.0.2.105 51364 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:34:15.372147 3.011325 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:34:22.389795 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:34:30.390927 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:34:46.393995 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:35:18.400010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:41:22.406856 3.021074 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:41:29.423327 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:41:37.429386 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:41:53.427816 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:42:25.433744 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:48:29.439968 3.001593 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 22:48:36.447147 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:48:44.452974 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:49:00.451933 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:49:32.460475 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:53:49.578152 0.014650 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 22:53:49.592942 0.163845 udp 10.0.2.105 7010 -> 94.243.124.105 9865 INT 0 1 178 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:53:49.756787 0.000000 icmp 94.243.124.105 0x0303 -> 10.0.2.105 0x8926 URP 192 1 206 flow=Background 1970/02/26 22:54:05.432633 0.050119 tcp 10.0.2.105 51365 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:05.483108 0.032635 tcp 10.0.2.105 51366 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:05.516029 0.126622 tcp 10.0.2.105 51367 -> 195.113.214.249 443 SRPA* 0 0 21 13096 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:05.643406 0.000000 udp 10.0.2.105 7010 -> 2.29.105.254 5312 INT 0 1 183 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:54:24.178082 0.031821 tcp 10.0.2.105 51368 -> 195.113.214.245 80 FSPA* 0 0 10 1886 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:24.210175 0.031878 tcp 10.0.2.105 51369 -> 195.113.214.249 80 FSPA* 0 0 10 1919 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:24.242358 0.128310 tcp 10.0.2.105 51370 -> 195.113.214.249 443 SRPA* 0 0 23 13372 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:24.371277 0.056896 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 443 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:24.428626 0.073821 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:24.502938 0.000000 udp 10.0.2.105 7010 -> 69.225.8.160 4908 INT 0 1 215 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:54:41.516000 0.031218 tcp 10.0.2.105 51371 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:41.547532 0.032334 tcp 10.0.2.105 51372 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:41.580200 0.134300 tcp 10.0.2.105 51373 -> 195.113.214.249 443 SRPA* 0 0 23 13830 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:41.715180 0.354462 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 474 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:42.070097 0.233858 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 412 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:42.304568 0.161130 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 407 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:42.466083 0.000000 udp 10.0.2.105 7010 -> 108.232.100.12 7437 INT 0 1 258 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 22:54:57.876325 0.031482 tcp 10.0.2.105 51374 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:57.908071 0.032969 tcp 10.0.2.105 51375 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:57.941299 0.129389 tcp 10.0.2.105 51376 -> 195.113.214.249 443 SRPA* 0 0 23 12540 flow=From-Botnet-V2-TCP-Established 1970/02/26 22:54:58.071157 0.686432 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:58.757983 0.153134 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 559 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:58.911475 0.163475 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.075360 0.048362 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.124070 0.061651 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.186142 0.075964 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 428 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.262474 0.089508 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 336 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.352376 0.073516 udp 10.0.2.105 7010 <-> 151.60.36.216 5908 CON 0 0 2 257 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.426300 0.148022 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 299 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.574682 0.179772 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 546 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:54:59.754896 0.412613 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 520 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:00.167921 0.062776 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 453 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:00.231100 0.055033 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:00.286546 0.192213 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:00.479149 0.348794 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:00.828433 0.176094 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 431 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:01.004975 0.221322 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 291 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:01.226679 0.131894 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 523 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:01.358997 0.844424 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 481 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:02.203824 0.334533 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:02.538740 0.208267 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:02.747401 0.192425 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:02.940200 0.167848 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.108505 0.070517 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 475 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.179470 0.183984 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 264 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.363845 0.317831 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 330 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.682130 0.066363 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 256 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.748911 0.068984 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 398 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:03.818273 0.621130 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 378 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:04.439840 0.243682 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/26 22:55:36.465164 3.000379 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 22:55:43.471228 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:55:51.473134 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:56:07.475834 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 22:56:39.481897 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:00:40.028094 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 23:00:40.028304 0.731731 tcp 10.0.2.105 51377 -> 211.38.175.27 4598 SPA_* 0 0 9 1231 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:00:46.424528 0.044728 tcp 10.0.2.105 51377 -> 211.38.175.27 4598 FA_F* 0 0 6 561 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:02:43.487368 3.002084 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:02:50.521260 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:02:58.516773 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:03:14.519571 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:03:46.525887 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:09:50.531469 3.022031 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:09:57.559437 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:10:05.560802 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:10:21.563910 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:10:53.569453 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:17:00.580067 3.450284 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:17:07.998231 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:17:15.919449 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:17:31.767520 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:18:05.396010 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:24:07.624024 3.020728 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:24:14.641587 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:24:22.642671 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:24:38.646259 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:25:10.652055 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:25:28.367716 0.000057 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 23:25:28.367885 0.271776 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 510 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:28.640039 0.209180 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 364 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:28.849633 0.051393 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 346 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:28.901378 0.076163 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 273 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:28.977961 0.233408 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 381 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:29.211750 0.365107 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:29.577281 0.157901 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 210 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:29.735560 0.176248 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 298 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:29.912208 0.155366 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 417 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:30.067940 0.161969 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 479 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:30.543014 0.048760 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 561 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:30.592393 0.045741 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 468 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:30.638527 0.000000 udp 10.0.2.105 7010 -> 151.60.36.216 5908 INT 0 1 214 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 23:25:46.585471 4.147247 tcp 10.0.2.105 51378 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:25:50.733015 0.031787 tcp 10.0.2.105 51379 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:25:50.765115 0.129705 tcp 10.0.2.105 51380 -> 195.113.214.249 443 SRPA* 0 0 24 13428 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:25:50.895368 0.148151 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 220 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.043916 0.177851 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 287 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.222155 0.144081 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 351 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.366637 0.089898 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 371 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.456944 0.343262 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 275 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.800613 0.114476 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 527 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.915540 0.053382 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 547 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:51.969382 0.186397 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 216 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:52.156150 0.340337 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 457 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:52.496925 0.176758 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 245 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:52.674135 0.254731 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 307 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:52.929265 0.131180 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 353 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:53.060826 0.826606 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 467 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:53.887894 0.320881 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 439 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.209218 0.212954 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 321 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.422631 0.204691 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.627716 0.167732 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 545 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.796074 0.066681 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 326 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.863137 0.072956 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:54.936542 0.071791 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 509 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:55.008848 0.131107 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 421 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:55.140377 0.324186 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 517 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:55.464972 0.705256 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 456 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:25:56.170692 0.250455 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 209 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:30:46.509990 0.020341 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 23:30:46.530442 0.737062 tcp 10.0.2.105 51381 -> 211.38.175.27 4598 SPA_* 0 0 9 1124 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:30:58.667456 0.009426 tcp 10.0.2.105 51381 -> 211.38.175.27 4598 FA_F* 0 0 5 507 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:31:14.673901 2.997107 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 INT 0 3 438 flow=Background 1970/02/26 23:31:21.675517 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:31:29.677232 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:31:45.680114 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:32:17.686181 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:38:21.691962 3.024925 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:38:28.709051 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:38:36.710736 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:38:52.713960 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:39:24.719498 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:45:28.726145 3.500285 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:45:36.182697 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:45:44.548073 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:46:00.349525 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:46:31.949717 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:56:08.643932 0.020533 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/26 23:56:08.664628 0.000000 udp 10.0.2.105 7010 -> 151.60.36.216 5908 INT 0 1 186 flow=From-Botnet-V2-UDP-Attempt 1970/02/26 23:56:25.109782 0.520344 tcp 10.0.2.105 51382 -> 195.113.214.245 80 FSPA* 0 0 10 1890 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:56:25.653475 0.034286 tcp 10.0.2.105 51383 -> 195.113.214.249 80 FSPA* 0 0 10 1925 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:56:25.688036 0.127690 tcp 10.0.2.105 51384 -> 195.113.214.249 443 SRPA* 0 0 23 13374 flow=From-Botnet-V2-TCP-Established 1970/02/26 23:56:25.816623 0.056846 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 472 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:25.873866 0.098545 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 339 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:25.972796 0.233388 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 370 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:26.206670 0.470809 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:26.677909 0.209860 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 361 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:26.888174 0.177885 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 396 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.066475 0.151782 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 399 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.218739 0.359659 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 460 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.578815 0.160400 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 360 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.739605 0.164087 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 437 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.904111 0.046811 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:27.951312 0.052513 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 382 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:28.004268 0.148435 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 385 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:28.153088 0.180172 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 405 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:28.333668 4.985369 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 348 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:33.319433 0.085269 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 469 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:33.405124 0.349310 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 501 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:33.754825 0.106550 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 379 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:33.861756 0.056739 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:33.918955 0.190057 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 225 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:34.109456 0.209260 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 295 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:34.319168 0.119005 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 290 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:34.438547 0.342802 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 451 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:34.781811 0.175944 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 259 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:34.958170 0.909483 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:35.868091 0.336217 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 344 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.204709 0.214008 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 383 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.419123 0.191414 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 413 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.610957 0.166344 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 358 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.777688 0.066794 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 315 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.844869 0.070516 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 285 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.915822 0.073680 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 494 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:36.989991 0.121844 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 434 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:37.112212 0.325991 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:37.438653 0.699154 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 338 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:56:38.138260 0.247358 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 482 flow=From-Botnet-V2-UDP-Established 1970/02/26 23:58:48.766549 3.072503 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/26 23:58:55.811519 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:59:03.785352 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:59:19.788669 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/26 23:59:51.804298 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:00:58.680935 0.000075 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/27 00:00:58.681096 4.028728 tcp 10.0.2.105 51385 -> 211.38.175.27 4598 FSPA* 0 0 14 1587 flow=From-Botnet-V2-TCP-Established 1970/02/27 00:05:55.810357 3.001537 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:06:02.817605 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:06:10.819425 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:06:26.822311 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:06:58.828450 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:13:02.834354 3.060315 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:13:18.075018 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:13:25.998465 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:13:41.783108 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:14:13.337849 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:20:18.339550 2.988570 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:20:25.274922 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:20:33.175866 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:20:48.956171 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:21:20.521305 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:26:45.630825 0.000059 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/27 00:26:45.630980 0.474757 udp 10.0.2.105 7010 <-> 161.200.34.23 2983 CON 0 0 2 332 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:46.106157 0.050542 udp 10.0.2.105 7010 <-> 80.153.225.69 9585 CON 0 0 2 390 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:46.157169 0.073924 udp 10.0.2.105 7010 <-> 95.252.173.157 3394 CON 0 0 2 488 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:46.231572 0.318290 udp 10.0.2.105 7010 <-> 69.225.8.160 4908 CON 0 0 2 403 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:46.637771 0.205102 udp 10.0.2.105 7010 <-> 108.232.100.12 7437 CON 0 0 2 532 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:46.843303 0.175665 udp 10.0.2.105 7010 <-> 99.128.195.100 7061 CON 0 0 2 391 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.019369 0.152524 udp 10.0.2.105 7010 <-> 74.141.181.225 2384 CON 0 0 2 341 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.172400 0.353643 udp 10.0.2.105 7010 <-> 202.66.77.193 7693 CON 0 0 2 519 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.526538 0.162623 udp 10.0.2.105 7010 <-> 64.231.220.63 5207 CON 0 0 2 529 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.689644 0.164569 udp 10.0.2.105 7010 <-> 68.56.221.70 8447 CON 0 0 2 441 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.854609 0.049577 udp 10.0.2.105 7010 <-> 80.1.220.176 8048 CON 0 0 2 584 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.904611 0.086078 udp 10.0.2.105 7010 <-> 88.111.35.230 1439 CON 0 0 2 410 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:47.991125 0.147997 udp 10.0.2.105 7010 <-> 69.133.33.19 2866 CON 0 0 2 563 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:48.139518 0.180445 udp 10.0.2.105 7010 <-> 99.116.154.145 1056 CON 0 0 2 404 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:48.320429 0.113264 udp 10.0.2.105 7010 <-> 109.53.213.72 5025 CON 0 0 2 459 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:48.434108 0.086767 udp 10.0.2.105 7010 <-> 82.193.156.176 1989 CON 0 0 2 309 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:48.521279 0.349657 udp 10.0.2.105 7010 <-> 113.28.179.100 9246 CON 0 0 2 550 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:48.871367 0.232981 udp 10.0.2.105 7010 <-> 86.159.85.210 3866 CON 0 0 2 518 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:49.104839 0.055050 udp 10.0.2.105 7010 <-> 81.157.252.245 6093 CON 0 0 2 524 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:49.160421 0.197379 udp 10.0.2.105 7010 <-> 208.186.92.18 3885 CON 0 0 2 327 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:49.358241 0.334687 udp 10.0.2.105 7010 <-> 219.103.237.245 1532 CON 0 0 2 487 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:49.693378 0.205664 udp 10.0.2.105 7010 <-> 162.239.137.12 5604 CON 0 0 2 429 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:49.899475 0.106681 udp 10.0.2.105 7010 <-> 134.117.114.115 4253 CON 0 0 2 337 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:50.006562 0.172333 udp 10.0.2.105 7010 <-> 108.238.72.103 5944 CON 0 0 2 319 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:50.179278 0.702942 udp 10.0.2.105 7010 <-> 65.8.208.209 9193 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:50.882657 0.319658 udp 10.0.2.105 7010 <-> 218.164.103.119 7010 CON 0 0 2 288 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:51.202700 0.212403 udp 10.0.2.105 7010 <-> 201.243.141.69 8168 CON 0 0 2 389 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:51.415494 0.191112 udp 10.0.2.105 7010 <-> 207.62.236.140 5716 CON 0 0 2 356 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:51.607050 0.160916 udp 10.0.2.105 7010 <-> 99.120.245.122 6170 CON 0 0 2 277 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:51.768419 0.069396 udp 10.0.2.105 7010 <-> 81.136.174.173 2006 CON 0 0 2 568 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:51.838226 0.230896 udp 10.0.2.105 7010 <-> 79.41.243.54 9715 CON 0 0 2 350 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:52.069608 0.325605 udp 10.0.2.105 7010 <-> 220.136.36.198 1158 CON 0 0 2 424 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:52.395630 0.066584 udp 10.0.2.105 7010 <-> 213.123.183.68 8899 CON 0 0 2 507 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:52.462658 0.070298 udp 10.0.2.105 7010 <-> 81.135.126.251 4575 CON 0 0 2 442 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:52.533422 0.764306 udp 10.0.2.105 7010 <-> 211.38.175.27 5959 CON 0 0 2 271 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:26:53.298132 0.258076 udp 10.0.2.105 7010 <-> 200.55.153.18 8903 CON 0 0 2 465 flow=From-Botnet-V2-UDP-Established 1970/02/27 00:27:25.144534 2.975298 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:27:32.081854 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:27:40.006395 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:27:55.935687 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:28:27.941740 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:31:02.714566 0.000046 arp 10.0.2.105 who 10.0.2.2 CON 2 84 flow=Background-ARP 1970/02/27 00:31:02.714660 3.885823 tcp 10.0.2.105 51386 -> 211.38.175.27 4598 FSPA* 0 0 15 1558 flow=From-Botnet-V2-TCP-Established 1970/02/27 00:34:31.947826 3.001512 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:34:38.955314 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:34:46.956760 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:35:02.959721 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:35:34.965533 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:41:38.971428 3.001704 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 3 438 flow=Background 1970/02/27 00:41:45.979149 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:41:53.980835 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:42:09.983515 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background 1970/02/27 00:42:42.176440 0.000000 udp fe80::d5e6:502a:54ce:e387 546 -> ff02::1:2 547 REQ 0 1 146 flow=Background